@revenexx/integrations-node-sdk 1.8.1 → 1.9.1

package/dist/index.d.cts

@@ -1,1254 +0,0 @@
-/**
- * The comparison vocabulary, in one place because it is read in three:
- * a node that compares two values (a condition, a filter), a settings condition
- * saying when a field applies (`IConfigField.showIf`), and the editor drawing
- * that field. An author who has met these words in one of the three must not
- * have to learn a second set for the others.
- *
- * The names are the vocabulary; what each one *means* is {@link evaluate}, and
- * the answer table in `operators.test.ts` is what a second implementation of it
- * — the editor, the platform's workflow validator — is checked against.
- */
-declare const OPERATORS: readonly ["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "greaterThanOrEqual", "lessThan", "lessThanOrEqual", "exists", "notExists", "isEmpty", "isNotEmpty"];
-type Operator = (typeof OPERATORS)[number];
-/** The four that read whether a value is there rather than what it is. */
-declare const VALUELESS_OPERATORS: readonly Operator[];
-declare function isOperator(value: unknown): value is Operator;
-/** Whether an operator reads a second value at all, or only the first. */
-declare function takesValue(op: Operator): boolean;
-/**
- * What an operator means.
- *
- * Equality is deliberately lenient across the string/number line: a `select`
- * carries `1` where a text box carries `'1'`, and an author means one thing by
- * both. A second implementation has to reproduce that — and has to be careful
- * with booleans, whose default stringification differs between languages.
- */
-declare function evaluate(left: unknown, op: Operator, right: unknown): boolean;
-
-type LocalizedString = string | Record<string, string>;
-type DataType = 'any' | 'object' | 'array' | 'string' | 'number' | 'boolean';
-type OutputKind = 'default' | 'branch' | 'error';
-type NodeCategory = 'trigger' | 'action' | 'transform' | 'control' | 'io';
-type ConfigType = 'string' | 'number' | 'boolean' | 'select' | 'multiselect' | 'object' | 'array' | 'expression' | 'secret-ref' | 'credentials-ref' | 'state-ref' | 'dynamic-schema';
-/**
- * Semantic category of an image, driving how the registry/CDN organises and
- * displays it.
- */
-type ImageCategory = 'screenshot' | 'logo' | 'banner' | 'icon' | 'other';
-/**
- * A single image a node, credential type, or template ships alongside its
- * description (e.g. a screenshot, logo, or banner). The file is bundled into
- * the package tarball and uploaded to the Revenexx CDN when the package is
- * published.
- */
-interface IImage {
-    /** Path to the image file, relative to the package root (e.g. `images/screenshot.png`). */
-    src: string;
-    alt: LocalizedString;
-    title?: LocalizedString;
-    category: ImageCategory;
-}
-interface IInputPort {
-    dataType: DataType;
-    required?: boolean;
-    description?: LocalizedString;
-}
-/**
- * One value an output carries, as the editor offers it to the next step.
- *
- * Deliberately flat: there is no member describing what is inside the value,
- * because the registry's manifest schema refuses any key beside these three and
- * the studio reads none. What is inside a value is declared beside it, under a
- * dotted name — see `IOutputPort.fields` (PO-408).
- */
-interface IOutputField {
-    dataType: DataType;
-    /**
-     * What the value is called, for an author picking it in the editor's `{ }` list —
-     * "Rechnungen" where the key is `invoices` (PO-594). Left out, the editor shows the
-     * key, as before.
-     */
-    label?: LocalizedString;
-    description?: LocalizedString;
-}
-interface IOutputPort {
-    kind: OutputKind;
-    dataType: DataType;
-    name?: string;
-    label?: LocalizedString;
-    description?: LocalizedString;
-    /**
-     * The values this output carries, by name.
-     *
-     * A name containing `.` is a path into the value: `counts` as `object` and
-     * `counts.added` as `number`, side by side, offers both the object and the
-     * number inside it. The studio and the worker resolve that name as a path, so
-     * the record the node emits must really be nested — a record carrying a
-     * literal `"counts.added"` key is not reached by it (specs/output-fields.md).
-     */
-    fields?: Record<string, IOutputField>;
-    sourceFromConfig?: string;
-    /**
-     * Marks a generic port set resolved at author time by the node's
-     * `resolveOutputs` callback (PO-143), rather than a static `name` or a
-     * config-driven `sourceFromConfig`. Set at most one of `name`,
-     * `sourceFromConfig`, `resolveOutputs` — this is a server-validated
-     * constraint on publish, not enforced by this (intentionally flat) type.
-     */
-    resolveOutputs?: boolean;
-    fallback?: {
-        name: string;
-        label?: LocalizedString;
-        description?: LocalizedString;
-    };
-}
-interface IConfigOption {
-    value: string | number | boolean;
-    label: LocalizedString;
-}
-interface IConfigValidation {
-    pattern?: string;
-    min?: number;
-    max?: number;
-    minLength?: number;
-    maxLength?: number;
-}
-/**
- * A condition on another setting's value, deciding whether this one applies.
- *
- * One condition, one key, one operator — `showIf: { key: 'source', op:
- * 'equals', value: 'field' }` reads as the sentence a node would otherwise
- * write under the field. The driving key MUST be a literal (it may not set
- * `expressionAllowed`), because applicability has to be decidable while the
- * author is typing; the same limit `dependsOn` carries, for the same reason.
- */
-interface IShowIfCondition {
-    /** The `key` of another config field on the same node. */
-    key: string;
-    /** How to compare it — the shared comparison vocabulary, see `OPERATORS`. */
-    op: Operator;
-    /**
-     * What to compare it to. Left out by the four operators that read presence
-     * rather than content (`exists`, `notExists`, `isEmpty`, `isNotEmpty`).
-     */
-    value?: string | number | boolean;
-}
-interface IConfigFieldBase {
-    key: string;
-    label: LocalizedString;
-    type: ConfigType;
-    description?: LocalizedString;
-    required?: boolean;
-    default?: unknown;
-    placeholder?: LocalizedString;
-    expressionAllowed?: boolean;
-    multiline?: boolean;
-    validation?: IConfigValidation;
-    options?: IConfigOption[];
-    /**
-     * When true, a *known* field's `options` are resolved at author time via the
-     * node's `loadOptions` (a live/dependent dropdown) instead of a static
-     * `options[]`. Applies to `select` / `multiselect`; left unset for ordinary
-     * static fields.
-     *
-     * Independent of `type: 'dynamic-schema'`: that field type triggers
-     * `resolveConfigSchema` on its own and does NOT require `dynamic: true`.
-     */
-    dynamic?: boolean;
-    /**
-     * Config keys whose values drive this field's dynamic resolution. The editor
-     * re-resolves when one of them changes. A key listed here is
-     * *dependency-driving* and MUST be a literal (it may not set
-     * `expressionAllowed`), so its value is known at author time.
-     */
-    dependsOn?: string[];
-    /**
-     * When this field applies at all. The editor draws it only while the
-     * condition holds, so a node says once in its manifest what it would
-     * otherwise have to explain in prose under every affected field.
-     *
-     * Not to be confused with `dependsOn`, which sits beside it and does a
-     * different thing: `dependsOn` re-*resolves* a dynamic field's options when
-     * another field changes, and never decides whether the field is drawn.
-     *
-     * Left unset, the field always applies — so this is additive: a node that
-     * says nothing behaves as it always did, and so does an editor that does not
-     * know the key.
-     */
-    showIf?: IShowIfCondition;
-    /**
-     * What a value mapped into this field from an earlier step has to be — `'array'`
-     * for a setting that wants the list a previous node produced (PO-594).
-     *
-     * The editor uses it to put the earlier steps' outputs of that kind first in the
-     * `{ }` list, mark them, and offer the single matching one as a one-click answer
-     * under an empty field. So the author does not have to know what a previous node
-     * returns, or which of its fields is the list.
-     *
-     * Not to be confused with `type: 'array'`, which draws the setting itself as
-     * repeating rows the author fills in by hand. Only meaningful together with
-     * `expressionAllowed`. Left unset, every output is offered alike, as before.
-     */
-    accepts?: DataType;
-    /**
-     * Only meaningful when `type === 'credentials-ref'`: the namespaced slug(s) of
-     * the credential type(s) this field accepts (e.g. `revenexx:smtp`). The editor
-     * lists tenant credential instances of these type(s); the blob stores the
-     * chosen instance UUID. Pass a single string when only one type is accepted,
-     * or an array to let the field accept instances of any of several types (e.g.
-     * a node that works with both an OAuth and an API-token credential).
-     */
-    credentialType?: string | string[];
-    /**
-     * Only meaningful when `type === 'state-ref'`: which kind of state namespace
-     * this field accepts (PO-374). The editor lists the workflow's declared
-     * namespaces of that role — and lets the author declare a new one without
-     * leaving the node — and the blob stores the chosen NAME.
-     *
-     * Declare the field rather than hardcoding a namespace name in `execute`: a
-     * literal is a contract nothing checks, and the mismatch surfaces as a 403 in
-     * the first production run rather than as an empty picker while authoring. It
-     * also narrows what the node may reach — a namespace is reachable only from
-     * the node whose config names it.
-     */
-    stateRole?: 'mapping' | 'cursor' | 'dedupe' | 'digest';
-}
-interface IConfigField extends IConfigFieldBase {
-    /**
-     * The sub-settings of a field that holds a group of them (`type: 'object'`).
-     *
-     * A full `IConfigField`, not the base. `IConfigFieldBase` already carries
-     * `options`, `default`, `required`, `description` and `showIf`, so those were
-     * never what a nested setting was missing — `properties` and `items` were: the
-     * base has neither, so a sub-setting could not itself group or repeat without
-     * a cast. The manifest schema permits that nesting and the engine's config
-     * walker reads nested fields as first-class; the type was the only place
-     * stopping at one level (PO-436).
-     */
-    properties?: IConfigField[];
-    /**
-     * What one entry of a list field (`type: 'array'`) looks like.
-     *
-     * Full `IConfigField` for the same reason as `properties`, and this is the one
-     * that bit: `items.type: 'object'` plus `items.properties` is the repeating row
-     * every mapping-style setting is built from, and `items` typed as the base had
-     * no `properties` to give it. `SwitchNode` in integrations-nodes-core ends its
-     * items block with `as IConfigField` for exactly that reason.
-     */
-    items?: IConfigField;
-}
-interface INodeDescription {
-    slug: string;
-    version: string;
-    category: NodeCategory;
-    name: LocalizedString;
-    description?: LocalizedString;
-    /** A Lucide icon name, `lucide:<kebab-name>` as listed on lucide.dev (e.g. `lucide:globe`). The studio draws it as named; a name it cannot draw becomes a generic box. */
-    icon?: string;
-    /**
-     * Curated node-picker group path, outermost first (max 4 levels), e.g.
-     * `[{ en: 'Business Central' }, { en: 'Sales Orders' }]`. Optional —
-     * pickers without it fall back to package/category grouping.
-     */
-    groups?: LocalizedString[];
-    /**
-     * Where this node stands inside its innermost palette folder, among the nodes
-     * of the same package: lower comes first. Optional — the editor draws nodes
-     * with a position before those without, and those without in the order the
-     * package lists them in `NODES`, so a package that lists its main node first
-     * needs no position at all. Use it when the array order is not the palette
-     * order, e.g. when `NODES` is sorted for another reason. It orders nodes only
-     * within one package; where a folder takes nodes from several packages, the
-     * order between packages is the editor's.
-     */
-    paletteOrder?: number;
-    /** Associated images (screenshots, logos, banners) shipped with the package. */
-    images?: IImage[];
-    inputs: Record<string, IInputPort>;
-    /**
-     * Output ports the workflow editor wires to downstream nodes. An empty array
-     * marks a **terminal node**: the path ends here and no edge may leave it —
-     * the mirror image of `inputs: {}` on a trigger. `StopAndErrorNode` is the
-     * canonical case; it always throws, so there is no success path to wire, and
-     * a port that can never fire would leave a dead handle on the canvas. The
-     * key stays required so terminality is declared, not forgotten.
-     */
-    outputs: IOutputPort[];
-    config?: IConfigField[];
-}
-interface INodeContext {
-    signal: AbortSignal;
-    logger: {
-        info(message: string, meta?: Record<string, unknown>): void;
-        warn(message: string, meta?: Record<string, unknown>): void;
-        error(message: string, meta?: Record<string, unknown>): void;
-    };
-    secrets: {
-        get(key: string): Promise<string>;
-    };
-    /**
-     * Resolve the access data of a credential instance the node references via a
-     * `credentials-ref` config field. The runtime fulfils this from the
-     * credentials broker at execution time (inside the Temporal activity), so the
-     * returned value — e.g. a short-lived access token — is always current and
-     * never persisted into workflow history.
-     */
-    credentials: {
-        get(credentialsId: string): Promise<Record<string, unknown>>;
-    };
-    /**
-     * The tenant state store: what this workflow already knows from earlier runs
-     * (PO-374). Every call names a namespace the workflow declared in its
-     * `state[]` block; anything else is refused by the engine, so a node cannot
-     * reach state its workflow did not ask for.
-     */
-    state: INodeState;
-}
-/**
- * The four things a workflow can remember between runs, and the reason each is
- * its own operation rather than a generic get/set: the role decides *when* a
- * write becomes visible, and that decision is the engine's to make, not the
- * node author's.
- *
- * The four roles are named **mapping**, **cursor**, **dedupe** and **digest** —
- * those are the values a `state-ref` field's `stateRole` takes. `claim` below is
- * the *operation* on a dedupe namespace, not a role of its own.
- *
- * - **mapping** and **dedupe** take effect immediately. A correlation discarded
- *   because the run failed afterwards is how the next run creates a duplicate
- *   in the target system; a claim invisible to other runs protects against
- *   nothing.
- * - **cursor** and **digest** are staged and adopted only when the run
- *   completes. A watermark that advances on a failed run leaves exactly the gap
- *   it exists to prevent, and a digest may only count once the write it
- *   describes actually went through.
- *
- * At author time — the editor's "test this node" button — the store is
- * **read-only**: a rehearsal must not leave correlations behind that a later
- * production run would treat as truth. The write calls reject there.
- */
-interface INodeState {
-    /** Correlate an id on each side of an integration (PIM article ↔ ERP number). */
-    mapping: {
-        /**
-         * The partner id of a correlation, or `null` when it is unknown — which is
-         * the usual way to decide between creating and updating in the target
-         * system.
-         *
-         * `side` says which side of the pair `key` is on, not which side to return:
-         * the default `'left'` matches `key` against the left id and answers with
-         * the right one, and `'right'` does the reverse. It never searches both, so
-         * a lookup on the wrong side answers `null` rather than falling back — and
-         * `null` on the create path is what makes the target record a second time.
-         */
-        get(namespace: string, key: string, side?: 'left' | 'right'): Promise<string | null>;
-        /**
-         * Record a correlation. Takes effect immediately, and re-pointing one side
-         * of an existing pair is refused: an id correlated two ways is always a bug,
-         * and no later sync can untangle it.
-         */
-        put(namespace: string, left: string, right: string, metadata?: Record<string, unknown>): Promise<void>;
-    };
-    /** How far an incremental sync has read. */
-    cursor: {
-        /**
-         * The committed watermark — an arbitrary JSON value such as
-         * `{ updatedAfter }` or a provider page token — or `undefined` when the
-         * sync has never run. A value staged by *this* run is not visible yet.
-         */
-        get(namespace: string, partitionKey?: string): Promise<unknown>;
-        /**
-         * Stage a watermark. Adopted only if the run completes, so a failed run
-         * leaves the previous value in place and the next run picks the gap up.
-         * `partitionKey` separates e.g. one shop or company code from another.
-         */
-        set(namespace: string, value: unknown, partitionKey?: string): Promise<void>;
-    };
-    /**
-     * Claim a key for the duration of its TTL. `true` means this caller got it;
-     * `false` means the key is held and this delivery is a duplicate — the normal
-     * answer under at-least-once delivery, and a value to branch on rather than an
-     * error.
-     *
-     * **A claim outlives the attempt that made it.** The holder is not identified:
-     * a claim is taken over only once it has expired, so a retry of the very
-     * attempt that claimed the key — after a transient failure that happened
-     * *after* the claim — is also told `false`. Treating that as a duplicate drops
-     * the delivery for the rest of the TTL, which makes `ttlSeconds` the retry
-     * window as much as the duplicate-suppression window. Choose it against both,
-     * and do not claim earlier in the node than necessary.
-     *
-     * `ttlSeconds` defaults to 604800 (seven days) and is accepted between 1 and
-     * 31536000.
-     */
-    claim(namespace: string, key: string, opts?: {
-        ttlSeconds?: number;
-    }): Promise<boolean>;
-    /** Skip expensive writes for entities that have not changed. */
-    digest: {
-        /** Whether the entity still carries this hash — i.e. the write can be skipped. */
-        unchanged(namespace: string, entityKey: string, digest: string): Promise<boolean>;
-        /** Stage a hash; adopted only if the run completes. Call it *after* the write. */
-        set(namespace: string, entityKey: string, digest: string): Promise<void>;
-    };
-}
-interface INodeResult {
-    outputs: Record<string, unknown>;
-    branch?: string;
-}
-/**
- * Context handed to a node's *author-time* resolvers (`loadOptions`,
- * `resolveConfigSchema`, `resolveOutputs`). These run in the node-runtime host
- * (a Node side-container) while a user is editing the workflow — never in
- * `execute`. The result is snapshotted into the workflow blob at save, so the
- * runtime never calls these (PO-143).
- */
-interface INodeAuthorContext {
-    signal: AbortSignal;
-    logger: {
-        info(message: string, meta?: Record<string, unknown>): void;
-        warn(message: string, meta?: Record<string, unknown>): void;
-        error(message: string, meta?: Record<string, unknown>): void;
-    };
-    /** The user's current partial config values. */
-    config: Record<string, unknown>;
-    /**
-     * Lazily resolve a `secret-ref` config field's value (a key in the tenant
-     * secret store → a single string). Mirrors {@link INodeContext.secrets} so a
-     * resolver that authenticates via a secret-ref uses the same call it would in
-     * `execute`. Resolves against the internal secret endpoint; only the keys the
-     * resolver actually asks for are fetched.
-     */
-    secrets: {
-        get(key: string): Promise<string>;
-    };
-    /**
-     * Lazily resolve a `credentials-ref` instance's access data via the
-     * credentials broker (id → structured material, e.g. `{ accessToken }`).
-     * Mirrors {@link INodeContext.credentials}.
-     */
-    credentials: {
-        get(credentialsId: string): Promise<Record<string, unknown>>;
-    };
-    /** Preferred locale for resolved labels, when the caller supplies one. */
-    locale?: string;
-    /**
-     * The operator's type-to-search term for the option list being resolved.
-     * Only set for `loadOptions` calls. Providers may pass it to a server-side
-     * search endpoint or use it to filter the options they return.
-     */
-    search?: string;
-}
-interface INode {
-    description: INodeDescription;
-    execute(ctx: INodeContext, inputs: Record<string, unknown>): Promise<INodeResult>;
-    /**
-     * Author-time: resolve the options of a `dynamic` field (a live/dependent
-     * dropdown). `fieldKey` is the config key being resolved. Optional — declare
-     * it only for nodes with `dynamic` `select`/`multiselect` fields.
-     */
-    loadOptions?(ctx: INodeAuthorContext, fieldKey: string): Promise<IConfigOption[]>;
-    /**
-     * Author-time: resolve the flat set of typed config fields that replaces a
-     * `type: 'dynamic-schema'` marker (e.g. an API's parameters once app + API
-     * are chosen). Returns fields in the same config-field grammar; the node is
-     * responsible for flattening any nested API shape into flat keys.
-     */
-    resolveConfigSchema?(ctx: INodeAuthorContext): Promise<IConfigField[]>;
-    /**
-     * Author-time: resolve a generic output-port set for an output marked
-     * `resolveOutputs` (e.g. ports derived from a connected resource's schema).
-     */
-    resolveOutputs?(ctx: INodeAuthorContext): Promise<IOutputPort[]>;
-}
-/**
- * Optional capability interface for nodes that iterate over a collection.
- * Implement this alongside {@link INode} to signal to the runtime that this
- * node drives iteration — the runtime will call {@link extractItems} instead
- * of relying on slug-based detection.
- *
- * This interface is the designated dispatch point for future child-workflow
- * execution: once per-iteration isolation is needed, the runtime can swap the
- * inline loop for `executeChild` calls without any changes to the node or SDK.
- */
-interface INodeWithIteration {
-    /**
-     * Extracts the array of items to iterate over from the resolved inputs and
-     * config. Must be pure and synchronous — it runs inside a Temporal Activity.
-     */
-    extractItems(inputs: Record<string, unknown>, config: Record<string, unknown>): unknown[];
-}
-/**
- * Type guard that checks whether a node implements {@link INodeWithIteration}.
- */
-declare function isNodeWithIteration(node: INode): node is INode & INodeWithIteration;
-/**
- * The authentication strategy a credential type uses. Determines which SDK
- * base class a concrete credential extends and how the broker resolves it.
- */
-type CredentialAuthKind = 'static' | 'api-key' | 'basic' | 'oauth2-client-credentials' | 'oauth2-authcode';
-/**
- * Field types for the connection parameters a credential type declares. A
- * superset-subset of {@link ConfigType}: scalars plus `secret` for values that
- * must be masked in the UI and never returned in plaintext by the public API.
- */
-type CredentialFieldType = 'string' | 'number' | 'boolean' | 'select' | 'secret';
-interface ICredentialField {
-    key: string;
-    label: LocalizedString;
-    type: CredentialFieldType;
-    description?: LocalizedString;
-    required?: boolean;
-    default?: unknown;
-    placeholder?: LocalizedString;
-    validation?: IConfigValidation;
-    options?: IConfigOption[];
-}
-/**
- * The published contract of a credential type: how the editor renders its
- * config form and which auth strategy the broker applies. The imperative
- * `test`/`resolve` logic lives in the bundled {@link ICredential} code, not in
- * this description.
- */
-interface ICredentialDescription {
-    /** Stable namespaced identifier `<namespace>:<slug>` (e.g. `revenexx:smtp`). */
-    slug: string;
-    version: string;
-    name: LocalizedString;
-    description?: LocalizedString;
-    /** A Lucide icon name, `lucide:<kebab-name>` as listed on lucide.dev (e.g. `lucide:globe`). The studio draws it as named; a name it cannot draw becomes a generic box. */
-    icon?: string;
-    /** Associated images (screenshots, logos, banners) shipped with the package. */
-    images?: IImage[];
-    authKind: CredentialAuthKind;
-    fields: ICredentialField[];
-}
-/**
- * Runtime context handed to a credential's `test`/`resolve`. Runs in the
- * credentials broker (a Node side-container), never in workflow code.
- */
-interface ICredentialContext {
-    signal: AbortSignal;
-    logger: {
-        info(message: string, meta?: Record<string, unknown>): void;
-        warn(message: string, meta?: Record<string, unknown>): void;
-        error(message: string, meta?: Record<string, unknown>): void;
-    };
-    /**
-     * Persist updated durable credentials (e.g. a rotated `refresh_token`) back
-     * to storage. The broker wires this to `PATCH /v1/internal/credentials/{id}/durable-creds`.
-     * Absent during pre-save tests where no instance exists yet.
-     */
-    persistDurableCreds?(durableCreds: Record<string, unknown>): Promise<void>;
-}
-interface ICredentialTestResult {
-    ok: boolean;
-    message?: string;
-}
-interface ICredentialResolveResult {
-    /** The access data handed to the node (e.g. `{ host, port, user, password }` or `{ accessToken }`). */
-    credentials: Record<string, unknown>;
-    /** ISO-8601 expiry of the resolved access data; absent for non-expiring (static) credentials. */
-    expiresAt?: string;
-}
-/**
- * A credential type implementation. `config` is the validated, user-entered
- * field map; `durableCreds` holds system-managed long-lived secrets (e.g. a
- * `refresh_token` obtained via 3-legged OAuth) and is `null` until they exist.
- */
-interface ICredential {
-    description: ICredentialDescription;
-    test(ctx: ICredentialContext, config: Record<string, unknown>): Promise<ICredentialTestResult>;
-    resolve(ctx: ICredentialContext, config: Record<string, unknown>, durableCreds: Record<string, unknown> | null): Promise<ICredentialResolveResult>;
-}
-/**
- * Optional capability for `oauth2-authcode` credentials that need the
- * interactive (3-legged) consent dance. The broker exposes these via
- * `/oauth/authorize-url` and `/oauth/exchange-code`; Laravel proxies them.
- */
-interface ICredentialOAuthAuthorize {
-    buildAuthorizeUrl(ctx: ICredentialContext, config: Record<string, unknown>, params: {
-        redirectUri: string;
-        state: string;
-    }): Promise<{
-        authorizeUrl: string;
-        codeVerifier?: string;
-    }>;
-    exchangeCode(ctx: ICredentialContext, config: Record<string, unknown>, params: {
-        code: string;
-        redirectUri: string;
-        codeVerifier?: string;
-    }): Promise<{
-        durableCreds: Record<string, unknown>;
-    }>;
-}
-/**
- * Type guard for credentials that implement the 3-legged OAuth consent flow.
- */
-declare function isOAuthAuthorizeCredential(credential: ICredential): credential is ICredential & ICredentialOAuthAuthorize;
-/** Difficulty level surfaced in the template gallery. */
-type TemplateLevel = 'beginner' | 'intermediate' | 'advanced';
-/** Trigger kind a template can ship; mirrors the server's `TriggerType`. */
-type TemplateTriggerType = 'manual' | 'schedule' | 'webhook' | 'event';
-/**
- * A trigger a template instantiates alongside its workflow. The `handle` is a
- * stable UUID the workflow blob's edges reference via `from.nodeId`. Per-type
- * `config` shapes: `schedule` → `{ cron, timezone? }`, `webhook` →
- * `{ method, secretRef?, public? }`, `event` → `{ subject }`, `manual` → none.
- * The integrations server deep-validates `config` per `type` on publish.
- */
-interface ITemplateTrigger {
-    /** Stable UUID the blob's edges reference via `from.nodeId`. */
-    handle: string;
-    type: TemplateTriggerType;
-    name?: string;
-    config?: Record<string, unknown>;
-    active?: boolean;
-}
-/**
- * A workflow template a node package publishes: a ready-made workflow blueprint
- * the editor offers as a starting point. Unlike {@link INode}/{@link ICredential}
- * a template carries no executable code — it is plain data, so a package exports
- * its `ITemplateDescription`s directly (no class wrapper).
- *
- * The `definition` is a workflow blob authored against the workflow-blob grammar
- * named by `blobVersion`; the integrations server validates it on publish.
- */
-interface ITemplateDescription {
-    /** Stable namespaced identifier `<namespace>:<slug>` (e.g. `revenexx:slack-to-crm`). */
-    slug: string;
-    version: string;
-    /** Free-form grouping label shown in the gallery (e.g. `sales`). */
-    category: string;
-    level: TemplateLevel;
-    name: LocalizedString;
-    /** One-line summary shown on the template card. */
-    shortDescription?: LocalizedString;
-    /** Long-form description in Markdown. */
-    description?: LocalizedString;
-    /** A Lucide icon name, `lucide:<kebab-name>` as listed on lucide.dev (e.g. `lucide:globe`). The studio draws it as named; a name it cannot draw becomes a generic box. */
-    icon?: string;
-    /** Free-form industry tags (e.g. `any`, `medical`). */
-    industries?: string[];
-    /** Free-form vendor tags (e.g. `pipedrive`, `slack`). */
-    vendors?: string[];
-    /** Associated images (screenshots, logos, banners) shipped with the package. */
-    images?: IImage[];
-    /** Workflow-blob schema version `definition` targets (e.g. `v0-draft`). */
-    blobVersion: string;
-    /** The workflow blob instantiated when a user picks this template. */
-    definition: Record<string, unknown>;
-    /**
-     * Triggers instantiated alongside the workflow (their `handle`s are
-     * referenced by `definition`'s edges). Omit for a manual-only template.
-     */
-    triggers?: ITemplateTrigger[];
-}
-
-/**
- * Reduce a {@link LocalizedString} to a single plain string.
- *
- * Every consumer (the UI, the Laravel side) repeats the same "is it a
- * string or a localized map?" branch to render a name/label; this centralizes
- * it so the rules are defined once:
- *
- * - a plain string is trimmed and returned (or `undefined` if blank);
- * - a localized map prefers `fallbackLang` (default `en`), then the first
- *   non-empty value;
- * - a missing, empty, or blank-only value yields `undefined`, so the caller
- *   can apply its own fallback.
- */
-declare function normalizeLocalized(value: LocalizedString | undefined | null, fallbackLang?: string): string | undefined;
-
-/**
- * Whether a setting applies, given what the author has filled in so far.
- *
- * A setting with no condition always applies — which is what makes `showIf`
- * additive: a node that says nothing gets the behaviour it has today, and an
- * editor that does not know the key draws every field as before.
- *
- * The value the condition reads is taken from the config as it stands mid-edit,
- * so it is routinely `undefined`: the moment a node is dropped on the canvas
- * nothing is filled in. That is why `equals` against a missing value is `false`
- * rather than an error — the setting does not apply *yet*.
- */
-declare function settingApplies(field: {
-    showIf?: IShowIfCondition;
-}, config: Record<string, unknown>): boolean;
-
-/**
- * Reduce an `IConfigField.credentialType` (a single slug or an array of slugs)
- * to a normalized, deduplicated `string[]`.
- *
- * The union `string | string[]` exists so node authors can write the common
- * single-type case as a bare string, but every consumer (the editor that
- * lists tenant credential instances, the Laravel side) needs a list to
- * iterate. This centralizes the
- * "is it a string or an array?" branch — analogous to {@link normalizeLocalized}
- * for `LocalizedString` — so the rules are defined once:
- *
- * - a single non-empty slug becomes a one-element array;
- * - an array is trimmed of blank entries and deduplicated, preserving order;
- * - `undefined`, an empty string, or an empty/all-blank array yields `[]`, so
- *   the caller can treat "accepts nothing" uniformly.
- */
-declare function normalizeCredentialType(value: string | string[] | undefined): string[];
-
-declare class NodeError extends Error {
-    readonly code: string;
-    readonly meta?: Record<string, unknown>;
-    constructor(code: string, message: string, meta?: Record<string, unknown>);
-}
-
-/**
- * Canonical error-output shape emitted on a node's `error` port. It lives here
- * rather than in a node package because all four of them were building it
- * separately — `integrations-nodes-core` in an internal module, `deepl` in a
- * copy of that module, Business Central in `bc-fetch.ts` and Pipedrive in
- * `pipedrive-client.ts` — so the workflow editor's guarantee of one
- * `{ code, message, status }` payload rested on four files agreeing by hand
- * (PO-442; asked for by PO-134 in June and not done then).
- */
-interface NodeErrorOutput {
-    /** Machine-readable error code, e.g. `HTTP_ERROR`, `TIMEOUT`, `REQUEST_FAILED`. */
-    code: string;
-    message: string;
-    /** HTTP status code, or `0` for timeouts / network / non-HTTP errors. */
-    status: number;
-    /** Optional response body — HTTP-specific. */
-    body?: unknown;
-}
-/**
- * Normalize any caught value into the canonical {@link NodeErrorOutput} shape.
- * Use this in a node's `catch` block before routing to the `error` port.
- */
-declare function toErrorOutput(err: unknown): NodeErrorOutput;
-/** Wrap an error output into an `INodeResult` routed to the `error` port. */
-declare function errorResult(output: NodeErrorOutput, port?: string): INodeResult;
-/**
- * Catch-block shortcut: normalize any thrown value and route it to the failure
- * output. The one helper every node's `catch` funnels into, so the
- * `{ code, message, status }` mapping lives in a single place instead of being
- * re-implemented per protocol (FTP/SFTP) or per package.
- *
- * `port` is the output taken, `error` unless the node declares its failure
- * output under another name (`{ ...errorPort(), name: 'failed' }`) — pass the
- * same name here, or the branch names a port that node does not have.
- */
-declare function toErrorResult(err: unknown, port?: string): INodeResult;
-/**
- * Catch-block shortcut for the HTTP-style nodes whose failure output additionally
- * declares `body`: the canonical `{ code, message, status }` mapping plus the
- * response body a {@link NodeError} carries in `meta.body` (`null` when the
- * failure never reached a response). `port` names the output as above.
- */
-declare function httpErrorResult(err: unknown, port?: string): INodeResult;
-/**
- * Shared `error` output port — the uniform `{ code, message, status }` triple
- * declared on every node that has an `error` branch. Pass `body: true` for
- * HTTP-style nodes that additionally emit a response body on the port.
- *
- * The sentences travel with the port. The three values mean the same thing
- * behind every node, so they are written here once instead of per node; a node
- * whose failures are worth naming more precisely spreads the port and replaces
- * only its `description` (`{ ...errorPort(), description: … }`).
- *
- * The second sentence of the description is the rule this port exists under,
- * and it is promised in `specs/error-handling.md`: a fault in the author's own
- * configuration ends the run, a fault met while running is offered here.
- */
-declare function errorPort(opts?: {
-    body?: boolean;
-}): IOutputPort;
-
-declare function extractManifest(node: INode): INodeDescription;
-declare function extractManifests(nodes: INode[]): INodeDescription[];
-declare function extractCredentialManifest(credential: ICredential): ICredentialDescription;
-declare function extractCredentialManifests(credentials: ICredential[]): ICredentialDescription[];
-
-declare const DEFAULT_TIMEOUT_MS = 30000;
-declare const MAX_TIMEOUT_MS = 120000;
-/** Maximum number of redirect hops `safeFetch` follows before giving up. */
-declare const MAX_REDIRECTS = 5;
-/**
- * Whether a request header with this name goes on to the next hop when
- * {@link safeFetch} follows a redirect to another origin — `true` for `Accept`,
- * `Accept-Encoding`, `Accept-Language`, `Content-Encoding`, `Content-Language`,
- * `Content-Type`, `Idempotency-Key`, `If-Match`, `If-Modified-Since`,
- * `If-None-Match`, `If-Range`, `If-Unmodified-Since`, `Range`, `SOAPAction` and
- * `User-Agent`, in any case, and `false` for every other name. The keep-list is by
- * name, so it can only keep a secret out of the headers it drops: a credential
- * whose header name the author chooses must refuse a name this answers `true`
- * for, or its key would cross with the harmless headers.
- */
-declare function headerCrossesOrigin(name: string): boolean;
-declare const DEFAULT_RETRY_ATTEMPTS = 0;
-declare const MAX_RETRY_ATTEMPTS = 5;
-declare const DEFAULT_RETRY_DELAY_MS = 1000;
-/**
- * Default cap for response bodies read via {@link readArrayBuffer} /
- * {@link readText} / {@link readJsonOrText}. Guards the (shared) worker process
- * against a single oversized response exhausting its memory.
- */
-declare const DEFAULT_MAX_RESPONSE_BYTES: number;
-/**
- * Hard upper ceiling for any per-node `maxBytes`. Even a permissive node author
- * (who calls {@link maxBytesConfigField} without an explicit `max`, or passes a
- * large `maxBytes` to the `read*` helpers) can never lift the cap above this, so
- * the shared worker's memory stays bounded. Analogous to {@link MAX_TIMEOUT_MS}.
- */
-declare const MAX_RESPONSE_BYTES: number;
-/** Clamp a requested `maxBytes` into `[1, MAX_RESPONSE_BYTES]`. */
-declare function clampResponseBytes(maxBytes: number): number;
-interface SafeFetchRetry {
-    attempts: number;
-    delayMs?: number;
-}
-interface SafeFetchOptions extends RequestInit {
-    timeoutMs?: number;
-    /** Pass `ctx.signal` so the workflow engine can cancel the request. */
-    signal?: AbortSignal;
-    retry?: SafeFetchRetry;
-}
-declare function safeFetch(url: string | URL, options?: SafeFetchOptions): Promise<Response>;
-/**
- * Read a response body into an ArrayBuffer while enforcing a hard byte cap.
- *
- * The `Content-Length` header is used as a fast-reject (bail before downloading
- * anything), but the limit is *also* enforced while streaming, since the header
- * can be absent or lie. On overrun the stream is cancelled and a
- * `NodeError('RESPONSE_TOO_LARGE', …, { status })` is thrown. Both refusal paths
- * cancel the body first, so neither leaves the connection held.
- */
-declare function readArrayBuffer(res: Response, maxBytes?: number): Promise<ArrayBuffer>;
-/** Read a response body as UTF-8 text, capped at `maxBytes` (see {@link readArrayBuffer}). */
-declare function readText(res: Response, maxBytes?: number): Promise<string>;
-/**
- * Read a response body as JSON when the `Content-Type` denotes JSON (see
- * {@link isJsonContentType}), otherwise as text — the content-type sniff
- * previously duplicated across the HTTP/Upload/DeepL node sinks. Capped at
- * `maxBytes` (see {@link readArrayBuffer}).
- *
- * A malformed JSON body surfaces as `NodeError('RESPONSE_PARSE_ERROR', …, { status })`
- * rather than a raw `SyntaxError`, keeping to the SDK error contract.
- */
-declare function readJsonOrText(res: Response, maxBytes?: number): Promise<unknown>;
-/**
- * The setting a node offers its workflow author for the response size cap,
- * ready to spread into `description.config`.
- *
- * **What the node still has to do** (PO-497): declaring the setting does not
- * wire it up. Read the configured value in `execute` and pass it on — the
- * helpers here only produce the declaration, and a node that spreads this and
- * never reads `config.maxBytes` offers a setting that does nothing.
- *
- * Everything an author reads is supplied in both languages the node packages
- * write, so spreading this unchanged already satisfies the rule they hold.
- * Nothing is left to the caller on that side: a node that wants different
- * words replaces the field rather than completing it.
- */
-declare function maxBytesConfigField(opts?: {
-    default?: number;
-    max?: number;
-}): IConfigField;
-/**
- * The setting a node offers its workflow author for the request budget, ready
- * to spread into `description.config`.
- *
- * **What the node still has to do** (PO-497): pass the configured value to
- * `safeFetch` as `timeoutMs`. See {@link maxBytesConfigField} for the same note
- * and for why the label and description are not the caller's to complete.
- */
-declare function timeoutConfigField(opts?: {
-    default?: number;
-    max?: number;
-}): IConfigField;
-/**
- * The two settings a node offers its workflow author for the retry budget,
- * ready to spread into `description.config`.
- *
- * **What the node still has to do** (PO-497): pass both configured values to
- * `safeFetch` as `retry.attempts` and `retry.delayMs`. See
- * {@link maxBytesConfigField} for the same note and for why the labels and
- * descriptions are not the caller's to complete.
- */
-declare function retryConfigFields(opts?: {
-    defaultAttempts?: number;
-    defaultDelayMs?: number;
-}): IConfigField[];
-
-/**
- * A resolved DNS address, mirroring the shape of Node's `dns.LookupAddress`.
- * `family` is `4` or `6`; only `address` is consulted by the guard.
- */
-interface LookupAddress {
-    address: string;
-    family: number;
-}
-/**
- * Resolves a hostname to every address it maps to. Modelled on
- * `dns.lookup(host, { all: true })`. Injectable so tests can drive the guard
- * deterministically without real DNS — see {@link ssrfResolver}.
- */
-type LookupFn = (hostname: string) => Promise<LookupAddress[]>;
-/**
- * Return `true` when `ip` (a literal IPv4/IPv6 address) points at a private,
- * loopback, link-local, carrier-grade NAT, multicast, broadcast, reserved,
- * unallocated or otherwise non-public target that a server-side fetch must never be
- * steered to.
- *
- * The verdict is an allow-list: the address is refused unless the classification
- * calls its range public unicast and — for IPv6, where that verdict is a default
- * rather than a determination — it also sits inside the block IANA has allocated
- * (see {@link GLOBAL_UNICAST_V6}). The IPv6 forms that embed an IPv4 address are
- * unwrapped and the embedded address judged in its place, so a public host stays
- * reachable when it is written that way. An address we cannot parse is treated as
- * blocked (fail-closed).
- *
- * Promised behaviour: specs/ssrf-guard.md (AC-9, AC-11, AC-19).
- */
-declare function isBlockedAddress(ip: string): boolean;
-/**
- * Assert that `url` is safe for a server-side fetch: an http(s) URL whose target
- * resolves only to public addresses. Rejects non-http(s) protocols, empty hosts
- * and `localhost`, checks literal-IP hosts directly, and otherwise resolves the
- * hostname (via the injectable `lookup`, defaulting to {@link ssrfResolver}) and
- * rejects if **any** resolved address is private/reserved. Throws
- * `NodeError('BLOCKED_ADDRESS', …, { status: 0 })` on rejection.
- *
- * This is the pre-flight half of the guard: the connection that follows resolves
- * the name again on its own, so `safeFetch` also judges the address the socket
- * actually reached (PO-184). A caller that opens its own request after
- * `assertPublicUrl` gets the check and not that second half.
- *
- * Pass `signal` (the per-request timeout/cancellation budget) so a hung or
- * hostile DNS resolve cannot block the guard past that budget — see
- * {@link resolveHost}.
- */
-declare function assertPublicUrl(url: string | URL, opts?: {
-    lookup?: LookupFn;
-    signal?: AbortSignal;
-}): Promise<void>;
-
-/**
- * Transport-agnostic retry/backoff primitive (PO-139).
- *
- * Wraps *any* async operation — raw `fetch`, an SDK client (axios), a future
- * transport — with exponential backoff + full jitter, honouring a
- * server-dictated delay (HTTP `Retry-After`) when the caller supplies one.
- *
- * The retry decision lives with the connector: it throws a {@link RetryableError}
- * only when an attempt failed *and* is worth retrying. Everything else is
- * rethrown as-is, and terminal API errors that connectors model as *values*
- * (e.g. a `{ kind: 'http-error' }` union) simply flow back as the return value.
- *
- * This is deliberately NOT a circuit breaker, rate limiter, or HTTP client, and
- * it does not replace Temporal activity-level retries — it is the fine-grained,
- * idempotency-aware, `Retry-After`-honouring layer inside a single activity.
- */
-/** Thrown by the wrapped fn to signal "this attempt failed but is retryable". */
-declare class RetryableError extends Error {
-    /** Server-dictated delay before the next attempt, e.g. parsed from `Retry-After`. */
-    readonly retryAfterMs?: number;
-    constructor(message: string, opts?: {
-        retryAfterMs?: number;
-        cause?: unknown;
-    });
-}
-interface RetryPolicy {
-    /** Total tries including the first. */
-    maxAttempts: number;
-    /** Base delay for the exponential backoff. */
-    baseDelayMs: number;
-    /** Upper bound for any single computed delay. */
-    maxDelayMs: number;
-    /** Exponential growth factor. */
-    factor: number;
-    /** Apply full jitter to the computed backoff. */
-    jitter: boolean;
-}
-declare const DEFAULT_RETRY_POLICY: RetryPolicy;
-interface RetryHooks {
-    /** Pass `ctx.signal` so cancelling a workflow cancels the wait (and stops retrying) immediately. */
-    signal: AbortSignal;
-    logger?: {
-        warn(msg: string, meta?: Record<string, unknown>): void;
-    };
-    onRetry?(info: {
-        attempt: number;
-        delayMs: number;
-        error: unknown;
-    }): void;
-}
-/**
- * Pure backoff math, exported for testing/reuse. Returns the delay before the
- * retry that follows the given (1-based) failed `attempt`: an exponential term
- * `baseDelayMs * factor^(attempt-1)` capped at `maxDelayMs`, with full jitter
- * (`random() * cap`) when `policy.jitter` is set.
- */
-declare function backoffDelay(attempt: number, policy: RetryPolicy): number;
-/**
- * Abort-aware sleep. Resolves after `ms`, or rejects with the signal's reason
- * (a DOMException `AbortError` by default) as soon as `signal` aborts — so a
- * caller's retry loop stops cleanly instead of finishing the wait.
- */
-declare function sleepWithSignal(ms: number, signal: AbortSignal): Promise<void>;
-/**
- * Runs `fn`; if it throws a {@link RetryableError} and attempts remain, waits
- * (`RetryableError.retryAfterMs` when present, else the computed
- * {@link backoffDelay}) respecting `signal`, then retries. Any other throw is
- * rethrown immediately; on the final attempt the RetryableError itself is
- * thrown (preserving its `retryAfterMs`/`cause`), not its `.cause`.
- *
- * Distinct from `safeFetch`'s built-in fixed-delay `retry` option, which is
- * unchanged: that is a simple in-fetch retry; this is the richer, transport-
- * agnostic, `Retry-After`-aware primitive connectors wrap around any operation.
- */
-declare function withRetry<T>(fn: (attempt: number) => Promise<T>, policy: Partial<RetryPolicy>, hooks: RetryHooks): Promise<T>;
-
-/**
- * Envelope version expected by the integrations server-side
- * `TarballInspector`. Earlier (pre-registry) builds emitted a bare array
- * without any `manifestVersion` field; `v0-draft` is currently the only
- * accepted value (see `SchemaServiceProvider::DOMAIN_NODE` in the
- * integrations service). Keeping it versioned lets the registry evolve the
- * shape without breaking older publishers.
- */
-declare const MANIFEST_VERSION = "v0-draft";
-interface NodeManifest {
-    manifestVersion: typeof MANIFEST_VERSION;
-    nodes: INodeDescription[];
-    /**
-     * Credential types this package publishes. Optional and additive: packages
-     * that ship no credentials omit it (older publishers never set it).
-     */
-    credentials?: ICredentialDescription[];
-    /**
-     * Workflow templates this package publishes. Optional and additive: packages
-     * that ship no templates omit it. Templates are plain data (no executable
-     * code), so they are carried verbatim from the package's `TEMPLATES` export.
-     */
-    templates?: ITemplateDescription[];
-}
-/**
- * The registry-relevant fields of a node package's `package.json`, as read by
- * the CLI. `name`/`version` identify the package; `displayName` is the
- * human-readable bundle label shown in the editor's node palette (e.g.
- * „Business Central"); `icon` marks its folder there. All four are read straight
- * from `package.json` by the integrations server on upload — the CLI reads them
- * only to warn about a missing label, to annotate the manifest log line, and to
- * stop on an icon the server would refuse.
- *
- * The label lives under a namespaced `revenexx` group in `package.json`
- * (`{ "revenexx": { "displayName": "…" } }`), not a bespoke top-level key, so
- * it can't collide with unrelated tooling that squats on `displayName`.
- */
-interface NodePackageMeta {
-    name: string;
-    version: string;
-    /** Human-readable bundle label (e.g. „Business Central"); optional. */
-    displayName?: string;
-    /**
-     * The glyph that marks the package's folder in the studio's palette, as
-     * `lucide:<kebab-name>` (e.g. `lucide:bell`); optional. Declared by a package
-     * holding several services, which has no one vendor logo to mark its folder
-     * with — a package that is one vendor leaves it out. Trimmed, and a value that
-     * is not a string counts as none, as the server reads it; whether it is well
-     * formed is {@link packageIconProblem}'s question.
-     */
-    icon?: string;
-}
-/**
- * Why a declared `revenexx.icon` would be refused by the registry, or
- * `undefined` when it is fine (or absent). Lets the build stop where the author
- * can still fix it, rather than at upload. Takes the icon as
- * {@link parsePackageMeta} returns it — trimmed as the registry trims it; an
- * untrimmed raw value can be refused here although the registry accepts it.
- */
-declare function packageIconProblem(icon: string | undefined): string | undefined;
-/**
- * Extracts {@link NodePackageMeta} from parsed `package.json` contents, keeping
- * only the registry-relevant fields and coercing anything malformed to a safe
- * shape. All four fields are trimmed — the icon of ASCII whitespace only, as the
- * server's PHP `trim()` does, so a pasted no-break space is refused here as it
- * is there rather than trimmed away; a blank or whitespace-only value becomes
- * `''` (`name`/`version`) or `undefined` (`displayName`, `icon`, matching how the
- * server treats them), so whitespace can't masquerade as a present value in
- * tooling. The bundle label and the folder icon are read from the `revenexx`
- * group (`revenexx.displayName`, `revenexx.icon`).
- * Does not validate that `name`/`version` are present — the integrations server
- * enforces that on upload; this is a typed, lenient read for tooling.
- */
-declare function parsePackageMeta(raw: unknown): NodePackageMeta;
-/**
- * Builds the manifest envelope from a package's `NODES` (and optional
- * `CREDENTIALS` / `TEMPLATES`) exports. The result is what gets written to
- * `dist/manifest.json` and uploaded to the registry inside the tarball. The
- * bundle label is NOT carried here — the integrations server reads it straight
- * from `package.json` (`revenexx.displayName`).
- */
-declare function buildManifest(nodes: INode[], credentials?: ICredential[], templates?: ITemplateDescription[]): NodeManifest;
-
-/**
- * Reusable credential base classes. Concrete credential types (in node
- * packages) extend one of these and only supply field mappings / endpoints —
- * the auth strategy itself lives here so it is implemented once.
- *
- * All of this runs in the credentials broker (a Node side-container), never in
- * workflow code, so wall-clock time and network I/O are fine.
- */
-type Config = Record<string, unknown>;
-type DurableCreds = Record<string, unknown> | null;
-interface OAuthTokenResponse {
-    access_token?: string;
-    refresh_token?: string;
-    expires_in?: number;
-    token_type?: string;
-    /**
-     * Provider-specific base URL the access token must target (e.g. Pipedrive
-     * returns the company-scoped `api_domain` on both the initial exchange and
-     * every refresh). Absent for providers that use a single global API host.
-     */
-    api_domain?: string;
-    [key: string]: unknown;
-}
-/**
- * The base for every credential type. Stores the published description and
- * provides a small HTTP helper. `resolve` is abstract; `test` defaults to a
- * presence check and should be overridden where a real connection test exists.
- */
-declare abstract class BaseCredential implements ICredential {
-    abstract readonly description: ICredentialDescription;
-    abstract resolve(ctx: ICredentialContext, config: Config, durableCreds: DurableCreds): Promise<ICredentialResolveResult>;
-    test(_ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
-    /**
-     * POST `application/x-www-form-urlencoded` and parse a JSON token response.
-     *
-     * Goes through {@link safeFetch}, not a raw `fetch` (PO-185). The token
-     * endpoint is not a constant: `tokenUrl(config)` derives it from credential
-     * config, i.e. from a value someone types into a credential form. A raw fetch
-     * would happily POST the client secret at `http://169.254.169.254/…` or any
-     * other internal address, which is precisely what `assertPublicUrl` exists to
-     * prevent. Every OAuth token exchange in this file — client-credentials,
-     * auth-code, refresh — funnels through here, so this is the one call site that
-     * has to hold.
-     *
-     * Two behaviours safeFetch adds, both wanted here: a request budget
-     * (`DEFAULT_TIMEOUT_MS`) on top of `ctx.signal`, and manual redirect handling
-     * that re-checks each hop and drops `Authorization` across an origin boundary.
-     * Note that a 301/302 answer to this POST is downgraded to a bodiless GET —
-     * per the redirect rules, not a quirk of ours. Real token endpoints do not
-     * redirect; one that does was never going to complete the exchange anyway.
-     *
-     * The third protection is the caller's own: safeFetch hands back a `Response`
-     * and reading it is not its job, so the answer goes through {@link readText}
-     * under {@link MAX_TOKEN_RESPONSE_BYTES} rather than a bare `res.text()`.
-     * Both branches below read that same string, so the cap covers the refusal as
-     * well as the token — an error body is the less predictable of the two.
-     */
-    protected postForm(ctx: ICredentialContext, url: string, form: Record<string, string | undefined>, headers?: Record<string, string>): Promise<OAuthTokenResponse>;
-}
-/**
- * "Simple value retrieval": the validated config fields ARE the access data
- * handed to the node (e.g. SMTP host/port/user/password, SFTP host/key). No
- * token, no expiry. Override `test` to add a real connection check.
- */
-declare abstract class SimpleValueCredential extends BaseCredential {
-    resolve(_ctx: ICredentialContext, config: Config, _durableCreds: DurableCreds): Promise<ICredentialResolveResult>;
-}
-/**
- * API-key credential. Reads the key from the configured field and hands it to
- * the node under that same name; override {@link credentialShape} where the
- * node needs something else, or more than the key alone.
- */
-declare abstract class ApiKeyCredential extends BaseCredential {
-    /**
-     * Which field of the credential form the key is typed into. Override it to
-     * name the form field this provider calls its key — `botToken`, `authKey`,
-     * `webhookUrl`.
-     *
-     * **What this does not do** (PO-497): it does not decide what a node looks
-     * the key up under at run time. It used to do only half of that — it changed
-     * which field was *read* while {@link credentialShape} went on emitting
-     * `apiKey` — so a credential that renamed its form field alone handed the
-     * node a key under a name it was never told to expect, and the node refused
-     * a perfectly good key as a missing one. The default shape now follows this
-     * name, so overriding this alone is correct on both sides. Overriding
-     * {@link credentialShape} as well is still how a credential emits a
-     * different name, or more than the key.
-     *
-     * Note that no node test can see a mismatch between the two: a mocked node
-     * context is seeded with the resolved blob directly and never calls
-     * `resolve`. Only a credential test asserting the whole resolved shape
-     * catches it, and asserting it loosely still misses — a partial match is
-     * happy with the wrong key present beside the right one.
-     */
-    protected apiKeyField(): string;
-    /**
-     * What the node receives. Defaults to the key under the name
-     * {@link apiKeyField} returns, so the two cannot drift apart by default.
-     *
-     * Override it where the node needs a different name than the form uses, or
-     * needs more than the key — a base URL derived from it, say.
-     */
-    protected credentialShape(apiKey: string): Record<string, unknown>;
-    resolve(_ctx: ICredentialContext, config: Config, _durableCreds: DurableCreds): Promise<ICredentialResolveResult>;
-}
-/**
- * HTTP Basic auth credential. Exposes `{ username, password }` by default.
- */
-declare abstract class BasicAuthCredential extends BaseCredential {
-    protected usernameField(): string;
-    protected passwordField(): string;
-    resolve(_ctx: ICredentialContext, config: Config, _durableCreds: DurableCreds): Promise<ICredentialResolveResult>;
-}
-/**
- * OAuth2 client-credentials grant (service-to-service, no user, no
- * refresh_token). Concrete types supply the token endpoint + client creds via
- * the config field map. Robust to downtime: a fresh access token is minted on
- * every resolve when the broker cache misses.
- */
-declare abstract class OAuth2ClientCredentialsCredential extends BaseCredential {
-    protected abstract tokenUrl(config: Config): string;
-    protected abstract clientId(config: Config): string;
-    protected abstract clientSecret(config: Config): string;
-    protected scope(_config: Config): string | undefined;
-    /** Map the raw token response to the node-facing credentials. */
-    protected credentialShape(token: OAuthTokenResponse): Record<string, unknown>;
-    resolve(ctx: ICredentialContext, config: Config, _durableCreds: DurableCreds): Promise<ICredentialResolveResult>;
-    test(ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
-}
-/**
- * OAuth2 authorization-code grant (3-legged, interactive consent). Implements
- * the consent dance (with PKCE by default), code exchange, and refresh-token
- * based resolution. The long-lived `refresh_token` is stored in durableCreds;
- * if the provider rotates it, the new one is persisted via the context.
- */
-declare abstract class OAuth2AuthCodeCredential extends BaseCredential implements ICredentialOAuthAuthorize {
-    protected abstract authorizeUrl(config: Config): string;
-    protected abstract tokenUrl(config: Config): string;
-    protected abstract clientId(config: Config): string;
-    protected abstract clientSecret(config: Config): string;
-    protected scope(_config: Config): string | undefined;
-    protected usePkce(): boolean;
-    protected credentialShape(token: OAuthTokenResponse): Record<string, unknown>;
-    buildAuthorizeUrl(_ctx: ICredentialContext, config: Config, params: {
-        redirectUri: string;
-        state: string;
-    }): Promise<{
-        authorizeUrl: string;
-        codeVerifier?: string;
-    }>;
-    exchangeCode(ctx: ICredentialContext, config: Config, params: {
-        code: string;
-        redirectUri: string;
-        codeVerifier?: string;
-    }): Promise<{
-        durableCreds: Record<string, unknown>;
-    }>;
-    resolve(ctx: ICredentialContext, config: Config, durableCreds: DurableCreds): Promise<ICredentialResolveResult>;
-    test(_ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
-}
-
-export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, headerCrossesOrigin, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };