@plitzi/sdk-server 0.33.2 → 0.34.0

package/dist/modules/actions/runtime/runLogger.d.ts

@@ -0,0 +1,31 @@
+import { ActionRejectRecord, ActionRunRecord, ServerLogger } from '@plitzi/sdk-shared';
+/**
+ * `onRun`, wired into the log stream the server already reports through.
+ *
+ * Without an `onRun` a deployment gets nothing at all about its flows: the request log says a call was answered,
+ * and a run started by a webhook or a schedule has no request to say anything about. This is the smallest useful
+ * answer to that, and it needs no store — whatever sink is already collecting `ServerLogEvent`s (a console, a
+ * file, a log shipper) starts carrying runs too, because a run is emitted as one more event on the same stream.
+ *
+ * What it reports is the SHAPE of the run — which steps ran and how each ended — and never what they held. A
+ * deployment that wants run HISTORY rather than run logs keeps its own `onRun` and writes rows; the two compose,
+ * since `onRun` is one function.
+ *
+ * Never throws: the runner treats the record as best-effort, and a logging outage must not take an action down.
+ */
+export declare const createRunLogger: (logger: ServerLogger) => (record: ActionRunRecord) => void;
+/**
+ * `onReject`, wired into the same log stream.
+ *
+ * The refusals are the half a deployment notices it is missing at the worst possible moment: an integration is
+ * being set up, every delivery is answered 401, and nothing anywhere says which check refused it. This puts them
+ * on the stream the server already reports through, as their own `kind` so a sink can route them somewhere
+ * louder than a run.
+ *
+ * It carries no body, no signature and no header — what went wrong is `reason`, and `detail` is the server's own
+ * words about it.
+ *
+ * Never throws, for the same reason the run logger does not: the caller was refused either way, and a sink's
+ * problem must not become the response's.
+ */
+export declare const createRejectLogger: (logger: ServerLogger) => (record: ActionRejectRecord) => void;

package/dist/modules/actions/runtime/runLogger.js

@@ -0,0 +1,66 @@
+//#region src/modules/actions/runtime/runLogger.ts
+/**
+* `onRun`, wired into the log stream the server already reports through.
+*
+* Without an `onRun` a deployment gets nothing at all about its flows: the request log says a call was answered,
+* and a run started by a webhook or a schedule has no request to say anything about. This is the smallest useful
+* answer to that, and it needs no store — whatever sink is already collecting `ServerLogEvent`s (a console, a
+* file, a log shipper) starts carrying runs too, because a run is emitted as one more event on the same stream.
+*
+* What it reports is the SHAPE of the run — which steps ran and how each ended — and never what they held. A
+* deployment that wants run HISTORY rather than run logs keeps its own `onRun` and writes rows; the two compose,
+* since `onRun` is one function.
+*
+* Never throws: the runner treats the record as best-effort, and a logging outage must not take an action down.
+*/
+var createRunLogger = (logger) => (record) => {
+	try {
+		logger({
+			kind: "run",
+			name: record.actionId,
+			spaceId: record.spaceId,
+			environment: record.environment,
+			trigger: record.trigger,
+			status: record.status,
+			...record.userId === void 0 ? {} : { userId: record.userId },
+			steps: record.nodes.map((node) => `${node.action}:${node.status}`),
+			durationMs: record.durationMs,
+			ok: record.status === "completed",
+			...record.error === void 0 ? {} : { error: record.error },
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	} catch {}
+};
+/**
+* `onReject`, wired into the same log stream.
+*
+* The refusals are the half a deployment notices it is missing at the worst possible moment: an integration is
+* being set up, every delivery is answered 401, and nothing anywhere says which check refused it. This puts them
+* on the stream the server already reports through, as their own `kind` so a sink can route them somewhere
+* louder than a run.
+*
+* It carries no body, no signature and no header — what went wrong is `reason`, and `detail` is the server's own
+* words about it.
+*
+* Never throws, for the same reason the run logger does not: the caller was refused either way, and a sink's
+* problem must not become the response's.
+*/
+var createRejectLogger = (logger) => (record) => {
+	try {
+		logger({
+			kind: "reject",
+			name: record.actionId,
+			spaceId: record.spaceId,
+			environment: record.environment,
+			trigger: record.trigger,
+			reason: record.reason,
+			...record.callerId === void 0 ? {} : { callerId: record.callerId },
+			durationMs: 0,
+			ok: false,
+			...record.detail === void 0 ? {} : { error: record.detail },
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	} catch {}
+};
+//#endregion
+export { createRejectLogger, createRunLogger };

package/dist/modules/actions/runtime/runLogger.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/runtime/schedule.d.ts

@@ -0,0 +1,35 @@
+import { ActionsModule } from '../index';
+import { ActionLookups } from '../types';
+import { Environment } from '@plitzi/sdk-shared';
+export type ScheduleTick = {
+    spaceId: number;
+    environment?: Environment;
+    /** The minute being asked about. Passed in rather than read here so a tick is testable and a missed one can be
+     *  replayed deliberately — never guessed at. */
+    at?: Date;
+};
+export type ScheduleResult = {
+    ran: {
+        actionId: string;
+        runId: string;
+        status: string;
+    }[];
+    skipped: {
+        actionId: string;
+        reason: string;
+    }[];
+};
+export type ScheduleRunner = {
+    tick: (params: ScheduleTick) => Promise<ScheduleResult>;
+};
+/**
+ * Runs the actions a space has scheduled for this minute.
+ *
+ * It owns no timer, on purpose. What ticks it is the deployment's: a leader-locked interval in one role, a k8s
+ * CronJob hitting an endpoint, a queue consumer — all of which have to answer "which replica" and "what happens
+ * on restart", and none of which the SDK can answer for a deployment it cannot see.
+ *
+ * Missed ticks are NOT replayed. A scheduler that catches up fires an hour of digests at once after an outage,
+ * which is worse than the digest nobody got; the caller that wants a replay asks for that minute explicitly.
+ */
+export declare const createScheduleRunner: (lookups: ActionLookups, module: ActionsModule) => ScheduleRunner;

package/dist/modules/actions/runtime/schedule.js

@@ -0,0 +1,76 @@
+import { ActionRunError } from "./errors.js";
+import { findTriggerNode, triggerParams } from "./triggers.js";
+import { cronMatches } from "@plitzi/sdk-shared/actions";
+//#region src/modules/actions/runtime/schedule.ts
+/**
+* Runs the actions a space has scheduled for this minute.
+*
+* It owns no timer, on purpose. What ticks it is the deployment's: a leader-locked interval in one role, a k8s
+* CronJob hitting an endpoint, a queue consumer — all of which have to answer "which replica" and "what happens
+* on restart", and none of which the SDK can answer for a deployment it cannot see.
+*
+* Missed ticks are NOT replayed. A scheduler that catches up fires an hour of digests at once after an outage,
+* which is worse than the digest nobody got; the caller that wants a replay asks for that minute explicitly.
+*/
+var createScheduleRunner = (lookups, module) => {
+	const tick = async ({ spaceId, environment = "main", at = /* @__PURE__ */ new Date() }) => {
+		const result = {
+			ran: [],
+			skipped: []
+		};
+		const entries = await lookups.listActions?.(spaceId) ?? [];
+		for (const entry of entries) {
+			const schedule = findTriggerNode(entry.document.nodes, "schedule");
+			const params = schedule ? triggerParams(schedule) : void 0;
+			const cron = params?.cron;
+			if (!schedule?.enabled || !cron) continue;
+			if (!cronMatches(cron, at, typeof params.timezone === "string" ? params.timezone : void 0)) continue;
+			let run;
+			try {
+				run = await module.guards.begin({
+					spaceId,
+					actionId: entry.id,
+					callerId: "schedule",
+					input: {},
+					idempotencyKey: `schedule:${at.toISOString().slice(0, 16)}`,
+					sharedKey: true,
+					ttlMs: module.limitsFor(entry.document).timeoutMs
+				});
+			} catch (error) {
+				result.skipped.push({
+					actionId: entry.id,
+					reason: error instanceof ActionRunError ? error.reason : "failed"
+				});
+				continue;
+			}
+			try {
+				const run_ = await module.runAction({
+					entry,
+					input: {},
+					spaceId,
+					environment,
+					trigger: "schedule",
+					callerId: "schedule",
+					runId: run.runId,
+					signal: run.controller.signal
+				});
+				result.ran.push({
+					actionId: entry.id,
+					runId: run_.runId,
+					status: run_.status
+				});
+			} catch (error) {
+				result.skipped.push({
+					actionId: entry.id,
+					reason: error instanceof ActionRunError ? error.reason : "failed"
+				});
+			} finally {
+				await module.guards.end(run);
+			}
+		}
+		return result;
+	};
+	return { tick };
+};
+//#endregion
+export { createScheduleRunner };

package/dist/modules/actions/runtime/schedule.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/runtime/scope.d.ts

@@ -0,0 +1,40 @@
+import { ActionCredential } from '../types';
+import { ActionField, SSRUser } from '@plitzi/sdk-shared';
+export type FieldValidation = {
+    values: Record<string, unknown>;
+    missing: string[];
+    invalid: string[];
+};
+/**
+ * Coerces a value bag against declared fields.
+ *
+ * Undeclared keys are DROPPED rather than passed through, and this is what makes twig-in-params safe: every token
+ * a node interpolates resolves against values that survived a contract someone wrote down. A pass-through bag
+ * would let a caller inject whatever a template happens to reference.
+ */
+export declare const applyFields: (fields: Record<string, ActionField>, raw: Record<string, unknown>) => FieldValidation;
+/** The visitor as a flow sees them. The token is deliberately absent — see the `auth.currentUser` task. */
+export declare const projectUser: (user?: SSRUser) => {
+    id: number;
+    username: string;
+    email: string;
+    verified: boolean;
+    permissions: string[];
+    roles: string[];
+} | undefined;
+/**
+ * Redacts every secret the run has actually resolved, wherever it appears, at any depth.
+ *
+ * Keyed on the VALUES rather than on field names, because a secret does not stay in the field it came from: it
+ * travels into a header a node built, into an error a provider echoed back, and from there into the trace and the
+ * log. Matching names would redact the one place it was already safe.
+ *
+ * It learns as the run goes rather than being built up front from a declared list. That is what makes dropping
+ * the declaration safe: a credential is registered the moment the task that needed it resolved one, which is
+ * always before that task's own result is redacted — and what was never resolved was never at risk.
+ */
+export declare const createRedactor: () => {
+    /** Everything long enough to be a secret rather than a flag. Short values would redact ordinary text. */
+    add: (credential: ActionCredential) => void;
+    redact: <T>(value: T) => T;
+};

package/dist/modules/actions/runtime/scope.js

@@ -0,0 +1,103 @@
+//#region src/modules/actions/runtime/scope.ts
+var coerce = (type, value) => {
+	switch (type) {
+		case "number": {
+			const parsed = typeof value === "number" ? value : Number(value);
+			return Number.isFinite(parsed) ? parsed : void 0;
+		}
+		case "boolean":
+			if (typeof value === "boolean") return value;
+			return value === "true" ? true : value === "false" ? false : void 0;
+		case "json":
+			if (typeof value !== "string") return value;
+			try {
+				return JSON.parse(value);
+			} catch {
+				return;
+			}
+		default: return typeof value === "object" && value !== null ? void 0 : String(value);
+	}
+};
+/**
+* Coerces a value bag against declared fields.
+*
+* Undeclared keys are DROPPED rather than passed through, and this is what makes twig-in-params safe: every token
+* a node interpolates resolves against values that survived a contract someone wrote down. A pass-through bag
+* would let a caller inject whatever a template happens to reference.
+*/
+var applyFields = (fields, raw) => {
+	const values = {};
+	const missing = [];
+	const invalid = [];
+	Object.entries(fields).forEach(([key, field]) => {
+		const provided = raw[key] ?? field.defaultValue;
+		if (provided === void 0 || provided === null || provided === "") {
+			if (field.required) missing.push(key);
+			return;
+		}
+		const coerced = coerce(field.type, provided);
+		if (coerced === void 0) {
+			invalid.push(key);
+			return;
+		}
+		values[key] = coerced;
+	});
+	return {
+		values,
+		missing,
+		invalid
+	};
+};
+/** The visitor as a flow sees them. The token is deliberately absent — see the `auth.currentUser` task. */
+var projectUser = (user) => {
+	if (!user) return;
+	const { id, username, email, verified, permissions, roles } = user;
+	return {
+		id,
+		username,
+		email,
+		verified,
+		permissions,
+		roles
+	};
+};
+/**
+* Redacts every secret the run has actually resolved, wherever it appears, at any depth.
+*
+* Keyed on the VALUES rather than on field names, because a secret does not stay in the field it came from: it
+* travels into a header a node built, into an error a provider echoed back, and from there into the trace and the
+* log. Matching names would redact the one place it was already safe.
+*
+* It learns as the run goes rather than being built up front from a declared list. That is what makes dropping
+* the declaration safe: a credential is registered the moment the task that needed it resolved one, which is
+* always before that task's own result is redacted — and what was never resolved was never at risk.
+*/
+var createRedactor = () => {
+	const secrets = /* @__PURE__ */ new Set();
+	const redactString = (value) => {
+		let output = value;
+		for (const secret of secrets) output = output.split(secret).join("«redacted»");
+		return output;
+	};
+	const redact = (value) => {
+		if (secrets.size === 0) return value;
+		if (typeof value === "string") return redactString(value);
+		if (Array.isArray(value)) return value.map((item) => redact(item));
+		if (value !== null && typeof value === "object") return Object.entries(value).reduce((acum, [key, item]) => {
+			acum[key] = redact(item);
+			return acum;
+		}, {});
+		return value;
+	};
+	return {
+		/** Everything long enough to be a secret rather than a flag. Short values would redact ordinary text. */
+		add: (credential) => {
+			Object.values(credential).forEach((value) => {
+				if (typeof value === "string" && value.length >= 8) secrets.add(value);
+			});
+		},
+		redact
+	};
+};
+//#endregion
+export { applyFields, createRedactor, projectUser };

package/dist/modules/actions/runtime/triggers.d.ts

@@ -0,0 +1,12 @@
+import { ActionTriggerParams, ActionTriggerType, ElementInteraction } from '@plitzi/sdk-shared';
+/**
+ * The step that starts a flow, for one way in.
+ *
+ * An action holds its ways in as trigger STEPS, exactly as an element holds `onClick` and `onSubmit` in one node
+ * map — so finding the entry point means finding the trigger whose kind matches what fired, not reading a list
+ * beside the flow. An action with no step for that kind cannot be started that way, and that is the whole of the
+ * "does it declare this trigger" check.
+ */
+export declare const findTriggerNode: (nodes: Record<string, ElementInteraction>, kind: ActionTriggerType) => ElementInteraction | undefined;
+/** What a trigger step carries: who may start it, what it takes, and whatever its kind needs. */
+export declare const triggerParams: (node: ElementInteraction) => ActionTriggerParams;

package/dist/modules/actions/runtime/triggers.js

@@ -0,0 +1,14 @@
+//#region src/modules/actions/runtime/triggers.ts
+/**
+* The step that starts a flow, for one way in.
+*
+* An action holds its ways in as trigger STEPS, exactly as an element holds `onClick` and `onSubmit` in one node
+* map — so finding the entry point means finding the trigger whose kind matches what fired, not reading a list
+* beside the flow. An action with no step for that kind cannot be started that way, and that is the whole of the
+* "does it declare this trigger" check.
+*/
+var findTriggerNode = (nodes, kind) => Object.values(nodes).find((node) => node.type === "trigger" && node.action === kind);
+/** What a trigger step carries: who may start it, what it takes, and whatever its kind needs. */
+var triggerParams = (node) => node.params;
+//#endregion
+export { findTriggerNode, triggerParams };

package/dist/modules/actions/taskCatalog.d.ts

@@ -0,0 +1,26 @@
+import { ActionTaskRegistry, RegisteredTask } from './types';
+/**
+ * A task as an editor renders it.
+ *
+ * `run` is dropped rather than left to JSON to discard silently — it is server code. `params` goes over as it is,
+ * because it is already the `InteractionCallbackParam` map the builder's WorkflowNode draws.
+ *
+ * What does not survive the trip is a FUNCTION-valued param: a `when`, or options computed from another param.
+ * Those are a task author's way of saying "this field depends on that one", and a catalog served over the wire
+ * keeps only the static half — worth knowing when writing a deployment task meant to be authored visually.
+ *
+ * They are STRIPPED here rather than left for the transport to choke on: a JSON scalar refuses a function outright,
+ * so `http.request` — whose `body` is hidden on GET — took the whole catalog down with it.
+ */
+export type ActionTaskDescriptor = {
+    name: string;
+    namespace: string;
+    action: string;
+    title: string;
+    description?: string;
+    /** Serializable params only — see above. */
+    params: Record<string, unknown>;
+};
+export declare const describeTask: (task: RegisteredTask) => ActionTaskDescriptor;
+/** The whole catalog, in the order the registry holds it. */
+export declare const describeCatalog: (registry: ActionTaskRegistry) => ActionTaskDescriptor[];

package/dist/modules/actions/taskCatalog.js

@@ -0,0 +1,24 @@
+//#region src/modules/actions/taskCatalog.ts
+/** Drops anything JSON cannot carry, at any depth. Functions are the only such value a task declares today. */
+var jsonSafe = (value) => {
+	if (typeof value === "function") return;
+	if (Array.isArray(value)) return value.map(jsonSafe).filter((item) => item !== void 0);
+	if (value !== null && typeof value === "object") return Object.entries(value).reduce((acum, [key, item]) => {
+		const safe = jsonSafe(item);
+		if (safe !== void 0) acum[key] = safe;
+		return acum;
+	}, {});
+	return value;
+};
+var describeTask = (task) => ({
+	name: task.name,
+	namespace: task.namespace,
+	action: task.action,
+	title: task.title,
+	description: task.description,
+	params: jsonSafe(task.params)
+});
+/** The whole catalog, in the order the registry holds it. */
+var describeCatalog = (registry) => registry.list().map(describeTask);
+//#endregion
+export { describeCatalog, describeTask };

package/dist/modules/actions/taskCatalog.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/tasks/auth.d.ts

@@ -0,0 +1,2 @@
+import { ActionTask } from '../types';
+export declare const authTasks: ActionTask<Record<string, unknown>>[];

package/dist/modules/actions/tasks/auth.js

@@ -0,0 +1,40 @@
+var authTasks = [{
+	namespace: "auth",
+	action: "currentUser",
+	title: "Current User",
+	params: {},
+	run: (_params, ctx) => {
+		const { user } = ctx;
+		if (!user) return { signedIn: false };
+		const { id, username, email, verified, permissions, roles } = user;
+		return {
+			signedIn: true,
+			id,
+			username,
+			email,
+			verified,
+			permissions,
+			roles
+		};
+	}
+}, {
+	namespace: "auth",
+	action: "requireRole",
+	title: "Require Permissions",
+	params: { permissions: {
+		type: "text",
+		canBind: true,
+		defaultValue: "",
+		label: "Permissions (comma separated)"
+	} },
+	run: ({ permissions }, ctx) => {
+		const required = permissions.split(",").map((permission) => permission.trim()).filter(Boolean);
+		if (required.length === 0) throw new Error("No permissions declared to require");
+		const held = new Set(ctx.user?.permissions ?? []);
+		const missing = required.filter((permission) => !held.has(permission));
+		if (missing.length > 0) throw new Error(`Missing permissions: ${missing.join(", ")}`);
+		return { granted: required };
+	}
+}];
+//#endregion
+export { authTasks };

package/dist/modules/actions/tasks/builtins.d.ts

@@ -0,0 +1,8 @@
+import { ActionTask } from '../types';
+/**
+ * The tasks `sdk-server` itself ships: the ones that are mechanism rather than policy.
+ *
+ * Anything needing an account somewhere — email, AI, object storage — is the DEPLOYMENT's, registered through
+ * `actions.tasks`. A server with no mail transport must not offer a step whose only possible outcome is failure.
+ */
+export declare const builtinTasks: ActionTask<Record<string, unknown>>[];

package/dist/modules/actions/tasks/builtins.js

@@ -0,0 +1,24 @@
+import { authTasks } from "./auth.js";
+import { connectorTasks } from "./connector.js";
+import { flowTasks, streamTasks } from "./flow.js";
+import { httpTasks } from "./http.js";
+import { kvTasks } from "./kv.js";
+import { transformTasks } from "./transform.js";
+//#region src/modules/actions/tasks/builtins.ts
+/**
+* The tasks `sdk-server` itself ships: the ones that are mechanism rather than policy.
+*
+* Anything needing an account somewhere — email, AI, object storage — is the DEPLOYMENT's, registered through
+* `actions.tasks`. A server with no mail transport must not offer a step whose only possible outcome is failure.
+*/
+var builtinTasks = [
+	...flowTasks,
+	...transformTasks,
+	...httpTasks,
+	...connectorTasks,
+	...authTasks,
+	...kvTasks,
+	...streamTasks
+];
+//#endregion
+export { builtinTasks };

package/dist/modules/actions/tasks/connector.d.ts

@@ -0,0 +1,2 @@
+import { ActionTask } from '../types';
+export declare const connectorTasks: ActionTask<Record<string, unknown>>[];

package/dist/modules/actions/tasks/connector.js

@@ -0,0 +1,141 @@
+import { fetchConnectorRecords, writeConnectorRecord } from "../../connectors/engine.js";
+//#region src/modules/actions/tasks/connector.ts
+var parseFilters = (value) => {
+	if (Array.isArray(value)) return value;
+	if (typeof value !== "string" || value === "") return [];
+	try {
+		const parsed = JSON.parse(value);
+		return Array.isArray(parsed) ? parsed : [];
+	} catch {
+		throw new Error("Filters are not valid JSON");
+	}
+};
+var parseValues = (value) => {
+	if (value !== null && typeof value === "object") return value;
+	if (typeof value !== "string" || value === "") return {};
+	try {
+		const parsed = JSON.parse(value);
+		return parsed !== null && typeof parsed === "object" ? parsed : {};
+	} catch {
+		throw new Error("Values are not valid JSON");
+	}
+};
+var toNumber = (value) => {
+	if (value === void 0 || value === "") return;
+	const parsed = typeof value === "number" ? value : Number.parseInt(value, 10);
+	return Number.isFinite(parsed) ? parsed : void 0;
+};
+var connectorTasks = [{
+	namespace: "connector",
+	action: "read",
+	title: "Connector Read",
+	params: {
+		connector: {
+			type: "text",
+			canBind: true,
+			defaultValue: "",
+			label: "Connector"
+		},
+		endpoint: {
+			type: "text",
+			canBind: true,
+			defaultValue: "list",
+			label: "Endpoint"
+		},
+		resource: {
+			type: "text",
+			canBind: true,
+			defaultValue: "",
+			label: "Resource"
+		},
+		limit: {
+			type: "text",
+			canBind: true,
+			defaultValue: "10",
+			label: "Limit"
+		},
+		offset: {
+			type: "text",
+			canBind: true,
+			defaultValue: "0",
+			label: "Offset"
+		},
+		filters: {
+			type: "codemirror-json",
+			canBind: true,
+			defaultValue: "[]",
+			label: "Filters"
+		}
+	},
+	run: async (params, ctx) => {
+		const resolved = await ctx.connector(params.connector);
+		if (!resolved) throw new Error(`Connector "${params.connector}" is not available for this space`);
+		const result = await fetchConnectorRecords({
+			manifest: resolved.manifest,
+			endpoint: params.endpoint || void 0,
+			credential: resolved.credential,
+			query: {
+				resource: params.resource || void 0,
+				limit: toNumber(params.limit),
+				offset: toNumber(params.offset),
+				filters: parseFilters(params.filters)
+			},
+			fetchImpl: ctx.fetch
+		});
+		return {
+			records: result.records,
+			pageInfo: result.pageInfo
+		};
+	}
+}, {
+	namespace: "connector",
+	action: "write",
+	title: "Connector Write",
+	params: {
+		connector: {
+			type: "text",
+			canBind: true,
+			defaultValue: "",
+			label: "Connector"
+		},
+		endpoint: {
+			type: "text",
+			canBind: true,
+			defaultValue: "create",
+			label: "Endpoint"
+		},
+		resource: {
+			type: "text",
+			canBind: true,
+			defaultValue: "",
+			label: "Resource"
+		},
+		recordId: {
+			type: "text",
+			canBind: true,
+			defaultValue: "",
+			label: "Record Id"
+		},
+		values: {
+			type: "codemirror-json",
+			canBind: true,
+			defaultValue: "{}",
+			label: "Values"
+		}
+	},
+	run: async (params, ctx) => {
+		const resolved = await ctx.connector(params.connector);
+		if (!resolved) throw new Error(`Connector "${params.connector}" is not available for this space`);
+		return { record: await writeConnectorRecord({
+			manifest: resolved.manifest,
+			credential: resolved.credential,
+			action: params.endpoint,
+			resource: params.resource || void 0,
+			recordId: params.recordId || void 0,
+			values: parseValues(params.values),
+			fetchImpl: ctx.fetch
+		}) ?? null };
+	}
+}];
+//#endregion
+export { connectorTasks };

package/dist/modules/actions/tasks/db.d.ts

@@ -0,0 +1,2 @@
+import { ActionTask } from '../types';
+export declare const dbTasks: ActionTask<Record<string, unknown>>[];