@revenexx/studio-integrations 3.0.2 → 3.1.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @revenexx/studio-integrations
 
+## 3.1.0
+
+### Minor Changes
+
+- 23bb093: The audit log offers every kind of change and of thing a tenant's log can hold — a cancelled or resumed run, a retired or restored node version, deleted stored state — and names a trigger by its kind and workflow and a run by its workflow, since the platform records no name for either. A connection test the platform could not run (its test broker was busy, or the reader may not try changed values) now reads "Not tested" instead of a failed connection. A secret key may be anything the platform stores — lower case and hyphens included, up to 191 characters; a runs search is cut to the platform's 200 characters instead of being refused; an install name stops at 255. Installing a template wires a step with two credential settings setting by setting,, a template's industry outside the six the studio used to know is kept and found by search, and a template started by a webhook says which method it answers rather than a path it never carries. An answer the schedules page cannot read is reported as a failed load, not as a tenant with no schedules.
+  
+  For hosts: single workflows, runs and credentials are now read only in the bare shape the Integrations service sends; a `data`-wrapped answer is refused. `instantiate()` also accepts `{ nodeId: { settingKey: credentialId } }` beside a bare id. Three exported types widen to what the service sends — `WorkflowTemplate.industries` is `string[]`, `CredentialType.icon` and `description` may be `null`, and a credential field option's `label` may be localised.
+
+### Patch Changes
+
+- ef3f3eb: A dead letter's `reason` is typed as the string the platform always sends (empty when nothing was recorded) and its `trigger_id` as the number it is. Rotating a webhook's endpoint secret reads the platform's answer in the one shape it has ever sent. Nothing else a host sees changes: the rest of this release brings the browser tests' mock in line with what the Integrations service actually answers.
+
+## 3.0.3
+
+### Patch Changes
+
+- 0ae03e4: A connection test the service refuses because a secret was left blank while the server or another setting changed no longer reads as a failed connection: the credential's detail view marks the secret's field with the reason and puts the cursor there, as it does for a refused save. The service no longer sends a stored secret to a server it was not entered for, so the secret has to be entered again.
+  
+  A save that makes the service drop a credential's consent (other settings on an OAuth credential) now says that the credential has to be reconnected, and no longer runs a connection test that could only fail.
+
 ## 3.0.2
 
 ### Patch Changes

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@revenexx/studio-integrations",
   "configKey": "studioIntegrations",
-  "version": "3.0.2",
+  "version": "3.1.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/runtime/components/Integrations/CredentialCreateDialog.vue

@@ -23,6 +23,7 @@ import { resolveLocalized } from "../../utils/localize";
 import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 import { errorReason } from "../../utils/apiError";
 import { keepOpenBeside } from "../../utils/dialog";
+import { testOutcomeView } from "../../utils/credentialTest";
 const props = defineProps({
   open: { type: Boolean, required: true },
   credentialType: { type: [String, Array], required: false }
@@ -247,12 +248,12 @@ async function submit() {
         <div
           v-if="testResult"
           class="rounded-md px-3 py-2 text-sm"
-          :class="testResult.ok ? 'bg-emerald-500/10 text-emerald-700' : 'bg-rose-500/10 text-rose-700'"
+          :class="testOutcomeView(testResult, t).toneClass"
         >
           <!-- The type's own sentence, either way. This is the surface where it is
                worth the most: nothing is stored yet, so the operator is deciding
                whether these access data reach what they meant (specs/credential-test.md). -->
-          {{ testResult.ok ? testResult.message ?? t("integration.credentials.shared.test.ok") : testResult.error ?? testResult.message ?? t("integration.credentials.shared.test.failed") }}
+          {{ testOutcomeView(testResult, t).text }}
         </div>
       </div>
 

package/dist/runtime/components/Integrations/CredentialDetailDialog.vue

@@ -39,6 +39,7 @@ import { hasRevenexxSource } from "../../utils/revenexxCredentialSource";
 import { resolveLocalized } from "../../utils/localize";
 import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 import { keepOpenBeside } from "../../utils/dialog";
+import { testOutcomeView } from "../../utils/credentialTest";
 const props = defineProps({
   open: { type: Boolean, required: true },
   credential: { type: [Object, null], required: true },
@@ -134,6 +135,12 @@ async function runTest() {
     const payload = buildConfigPayload();
     const edited = credentialEditDiffers(fieldsOf(props.type), payload, props.credential.public_config ?? {});
     const result = await test(props.credential.id, edited ? payload : void 0);
+    if (result.refusal) {
+      if (opening !== viewOpening) return;
+      saveRefusal.value = result.refusal;
+      void focusFirstRefusedField();
+      return;
+    }
     if (result.recorded !== false) {
       await load(true);
       emit("changed");
@@ -156,11 +163,13 @@ async function save() {
   const payload = buildConfigPayload();
   const edited = credentialEditDiffers(fieldsOf(props.type), payload, props.credential.public_config ?? {});
   try {
-    await update(id, { name: form.name.trim(), config: payload });
+    const wasConnected = props.credential.status !== "needs_reauth";
+    const updated = await update(id, { name: form.name.trim(), config: payload });
+    const lostConsent = wasConnected && updated.status === "needs_reauth";
     emit("changed");
     emit("update:open", false);
-    toast.success(t("integration.credentials.toast.updated"));
-    if (edited) void testSaved(id);
+    toast.success(t(lostConsent ? "integration.credentials.toast.updatedReconnect" : "integration.credentials.toast.updated"));
+    if (edited && !lostConsent) void testSaved(id);
   } catch (e) {
     saveRefusal.value = e;
     void focusFirstRefusedField();
@@ -367,9 +376,9 @@ async function connect() {
               <div
                 v-if="liveTest"
                 class="rounded-md px-3 py-2 text-sm"
-                :class="liveTest.ok ? 'bg-emerald-500/10 text-emerald-700' : 'bg-rose-500/10 text-rose-700'"
+                :class="testOutcomeView(liveTest, t).toneClass"
               >
-                {{ liveTest.ok ? liveTest.message ?? t("integration.credentials.shared.test.ok") : liveTest.error ?? liveTest.message ?? t("integration.credentials.shared.test.failed") }}
+                {{ testOutcomeView(liveTest, t).text }}
               </div>
 
             </div>

package/dist/runtime/components/Integrations/NodeInspector.vue

@@ -472,7 +472,7 @@ async function rotateEndpointSecret() {
     const api2 = useIntegrationsApi();
     const res = await api2.post(`/workflows/${props.workflowId}/triggers/${wt.id}/rotate-secret`, {});
     const body = res ?? {};
-    const secret = body.inbound_secret ?? body.data?.inbound_secret ?? null;
+    const secret = body.inbound_secret ?? null;
     if (secret) {
       rotatedSecret.value = secret;
       rotateOpen.value = true;

package/dist/runtime/components/Integrations/TemplateFlowPreview.vue

@@ -30,7 +30,7 @@ const boxes = computed(() => {
   triggers.forEach((t2, i) => {
     const pos = blob.triggerPositions?.[t2.id] ?? { x: 40, y: 40 + i * 160 };
     const template = TRIGGER_TEMPLATES.find((tt) => tt.type === t2.type);
-    const subtitle = t2.type === "schedule" && t2.config?.cron ? describeCron(String(t2.config.cron)) ?? String(t2.config.cron) : t2.type === "webhook" && t2.config?.path ? String(t2.config.path) : resolveLocalized(template?.description ?? "");
+    const subtitle = t2.type === "schedule" && t2.config?.cron ? describeCron(String(t2.config.cron)) ?? String(t2.config.cron) : t2.type === "webhook" && t2.config?.method ? String(t2.config.method).toUpperCase() : resolveLocalized(template?.description ?? "");
     out.push({
       key: `t-${t2.id}`,
       kind: "trigger",

package/dist/runtime/components/Integrations/TemplateInstallStep.vue

@@ -29,6 +29,7 @@ const installing = ref(false);
 const error = ref(null);
 const name = ref("");
 const bindings = reactive({});
+const slotKey = (nodeId, configKey) => `${nodeId}\0${configKey}`;
 let run = 0;
 watch(() => props.slug, async (slug) => {
   const mine = ++run;
@@ -68,16 +69,30 @@ const secretChecks = computed(() => {
     present: secretKeys.value.includes(key)
   }));
 });
-function nodesFor(usedBy) {
-  return [...new Set(usedBy.map((u) => u.nodeId))];
+function slotsFor(usedBy) {
+  const all = credentialReqs.value.flatMap((r) => r.usedBy);
+  const seen = /* @__PURE__ */ new Set();
+  return usedBy.filter((u) => {
+    const key = slotKey(u.nodeId, u.configKey);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).map((u) => ({
+    key: slotKey(u.nodeId, u.configKey),
+    nodeId: u.nodeId,
+    configKey: u.configKey,
+    label: new Set(all.filter((o) => o.nodeId === u.nodeId).map((o) => o.configKey)).size > 1 ? t("integration.templates.detail.install.settingLabel", { id: u.nodeId, setting: u.configKey }) : t("integration.templates.detail.install.nodeLabel", { id: u.nodeId })
+  }));
 }
 async function confirmInstall() {
   installing.value = true;
   error.value = null;
   try {
     const credentialBindings = {};
-    for (const [nodeId, credId] of Object.entries(bindings)) {
-      if (credId && credId !== SELECT_LATER) credentialBindings[nodeId] = credId;
+    for (const [key, credId] of Object.entries(bindings)) {
+      if (!credId || credId === SELECT_LATER) continue;
+      const [nodeId, configKey] = key.split("\0");
+      (credentialBindings[nodeId] ??= {})[configKey] = credId;
     }
     const id = await instantiate(props.slug, {
       name: name.value.trim(),
@@ -98,7 +113,8 @@ async function confirmInstall() {
     <div class="space-y-4 py-1 max-h-[28rem] overflow-y-auto pr-1">
       <div class="space-y-1.5">
         <Label for="tpl-install-name">{{ t("integration.templates.detail.install.nameLabel") }}</Label>
-        <Input id="tpl-install-name" v-model="name" class="bg-white" :placeholder="t('integration.templates.detail.install.namePlaceholder')" />
+        <!-- 255: the platform's limit on a workflow's name (InstantiateTemplateRequest). -->
+        <Input id="tpl-install-name" v-model="name" class="bg-white" :maxlength="255" :placeholder="t('integration.templates.detail.install.namePlaceholder')" />
       </div>
 
       <div v-if="loading" class="flex items-center gap-2 py-4 text-sm text-muted-foreground">
@@ -131,15 +147,17 @@ async function confirmInstall() {
               <NuxtLink to="/integrations/credentials" class="text-primary hover:underline">{{ t("integration.templates.detail.install.createOneLink") }}</NuxtLink>
               {{ t("integration.templates.detail.install.orInstallLater") }}
             </p>
-            <div v-for="nodeId in nodesFor(req.usedBy)" v-else :key="nodeId" class="space-y-1">
-              <Label :for="`tpl-cred-${nodeId}`" class="text-xs text-muted-foreground font-mono">{{ t("integration.templates.detail.install.nodeLabel", { id: nodeId }) }}</Label>
+            <div v-for="(slot, si) in slotsFor(req.usedBy)" v-else :key="slot.key" class="space-y-1">
+              <!-- By position, not by joining two free strings: `a-b`+`c` and `a`+`b-c`
+                   would share an id, and a label would name the wrong select. -->
+              <Label :for="`tpl-cred-${req.slug}-${si}`" class="text-xs text-muted-foreground font-mono">{{ slot.label }}</Label>
               <Select
-                :model-value="bindings[nodeId] ?? SELECT_LATER"
+                :model-value="bindings[slot.key] ?? SELECT_LATER"
                 @update:model-value="(v) => {
-  bindings[nodeId] = v ?? SELECT_LATER;
+  bindings[slot.key] = v ?? SELECT_LATER;
 }"
               >
-                <SelectTrigger :id="`tpl-cred-${nodeId}`" class="bg-white">
+                <SelectTrigger :id="`tpl-cred-${req.slug}-${si}`" class="bg-white">
                   <SelectValue :placeholder="t('integration.templates.detail.install.selectLater')" />
                 </SelectTrigger>
                 <SelectContent>

package/dist/runtime/composables/useIntegrationsAudit.d.ts

@@ -1,5 +1,3 @@
-export type AuditResourceType = 'credential' | 'secret' | 'workflow' | 'trigger' | 'workflow_run';
-export type AuditAction = 'create' | 'update' | 'delete' | 'run.started' | 'run.finished' | 'run.failed';
 export interface AuditEntry {
     id: number;
     org_id?: string;
@@ -8,12 +6,19 @@ export interface AuditEntry {
     /** As the actor's sign-in stated it when the entry was written; null for the platform, and for entries from before names were recorded (PO-609). */
     actor_name?: string | null;
     actor_email?: string | null;
+    /** Whether the platform wrote the entry with no person behind it, and by which route it arrived. Sent on every row; not shown yet. */
+    via_system?: boolean;
+    channel?: string;
     action: string;
     resource_type: string;
     resource_id?: string;
     metadata?: Record<string, unknown> | null;
     created_at: string;
 }
+/**
+ * The narrowing the feed itself accepts. The page sends none of it today — it
+ * narrows in the browser over what it has loaded (specs/audit-log.md `## Gaps`).
+ */
 export interface AuditFilters {
     sub?: string;
     resource_type?: string;

package/dist/runtime/composables/useIntegrationsCredentials.d.ts

@@ -1,4 +1,5 @@
 import type { Credential } from '../types/integrations.js';
+import { IntegrationsApiError } from '../utils/apiError.js';
 /**
  * Typed, per-tenant credential instances, backed by the Integrations service
  * (`/api/v1/credentials`). Secret field values are NEVER returned — the list
@@ -7,11 +8,13 @@ import type { Credential } from '../types/integrations.js';
  *   GET    /credentials[?type=slug]      → list
  *   POST   /credentials                  → create { credential_type_slug, name, config }
  *   GET    /credentials/{id}             → show (masked)
- *   PATCH  /credentials/{id}             → update { name?, config? } (blank secret = keep)
+ *   PATCH  /credentials/{id}             → update { name?, config? } (blank secret = keep,
+ *                                          unless the same edit changes any other value:
+ *                                          then 422 at config.<secret>, PO-765)
  *   DELETE /credentials/{id}             → remove
  *   POST   /credentials/test             → inline test { credential_type_slug, config }
- *   POST   /credentials/{id}/test        → test saved instance
- *   POST   /credentials/{id}/oauth/authorize-url → { authorize_url, state }
+ *   POST   /credentials/{id}/test        → test { config? } → { ok, message, recorded, last_test_at, last_test_ok }
+ *   POST   /credentials/{id}/oauth/authorize-url → { authorize_url }
  */
 /**
  * `message` is what the credential type said about the test, whichever way it went —
@@ -32,6 +35,18 @@ export interface CredentialTestResult {
      * test of an edit that tried values other than the stored ones (PO-535).
      */
     recorded?: boolean;
+    /**
+     * The test did not happen, so it says nothing about the credential: the platform's
+     * test broker had no room for it, or the reader may not try changed values (IN-22).
+     * Drawn neither as a pass nor as a failure.
+     */
+    untested?: true;
+    /**
+     * The refusal the service answered instead of testing, held as it arrived: values it
+     * would not try as given — a stored secret kept for a changed server (PO-765). A form
+     * marks the fields it names, as it does for a refused save.
+     */
+    refusal?: IntegrationsApiError;
 }
 export declare function useIntegrationsCredentials(): {
     credentials: any;

package/dist/runtime/composables/useIntegrationsCredentials.js

@@ -2,7 +2,7 @@ import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { IntegrationsApiError, errorReason } from "../utils/apiError.js";
-import { unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord, unwrapList } from "../utils/apiEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
 export function useIntegrationsCredentials() {
   const credentials = useState("integrations.credentials", () => []);
@@ -33,15 +33,15 @@ export function useIntegrationsCredentials() {
     return credentials.value.filter((c) => c.credential_type_slug === slug);
   }
   async function get(id) {
-    return unwrapRecord(await api.get(`/credentials/${encodeURIComponent(id)}`));
+    return bareRecord(await api.get(`/credentials/${encodeURIComponent(id)}`));
   }
   async function create(input) {
-    const created = unwrapRecord(await api.post("/credentials", input));
+    const created = bareRecord(await api.post("/credentials", input));
     await load(true);
     return created;
   }
   async function update(id, input) {
-    const updated = unwrapRecord(await api.patch(`/credentials/${encodeURIComponent(id)}`, input));
+    const updated = bareRecord(await api.patch(`/credentials/${encodeURIComponent(id)}`, input));
     await load(true);
     return updated;
   }
@@ -63,14 +63,19 @@ export function useIntegrationsCredentials() {
         `/credentials/${encodeURIComponent(id)}/test`,
         config ? { config } : void 0
       );
+      if (!config && res?.ok === false && res.recorded === false) return { ...res, untested: true };
       return res?.ok === false ? res : { ok: true, message: res?.message, recorded: res?.recorded };
     } catch (e) {
-      return { ok: false, error: errorReason(e, t("integration.credentials.error.testFailed")) };
+      if (config && e instanceof IntegrationsApiError && e.status === 403) {
+        return { ok: false, untested: true, error: t("integration.credentials.shared.test.notAllowed") };
+      }
+      const refusal = e instanceof IntegrationsApiError && e.status === 422 ? e : void 0;
+      return { ok: false, error: errorReason(e, t("integration.credentials.error.testFailed")), refusal };
     }
   }
   async function oauthAuthorizeUrl(id) {
     const res = await api.post(`/credentials/${encodeURIComponent(id)}/oauth/authorize-url`);
-    const authorizeUrl = unwrapRecord(res).authorize_url;
+    const authorizeUrl = bareRecord(res).authorize_url;
     if (!authorizeUrl) throw new IntegrationsApiError(0, res, t("integration.credentials.error.noAuthorizeUrl"));
     return authorizeUrl;
   }

package/dist/runtime/composables/useIntegrationsRuns.d.ts

@@ -44,7 +44,7 @@ export declare function useIntegrationsRuns(): {
     latestLoading: any;
     loadLatestPerWorkflow: (force?: boolean) => Promise<WorkflowRun[]>;
     lastRunFor: (workflowId: number) => WorkflowRun | null;
-    trigger: (workflowId: number | string, payload?: Record<string, unknown>, mode?: "async" | "sync") => Promise<unknown>;
+    trigger: (workflowId: number | string, payload?: Record<string, unknown>, mode?: "sync" | "async") => Promise<unknown>;
     cancelRun: (workflowId: number | string, runId: number | string, reason?: string) => Promise<unknown>;
     terminateRun: (workflowId: number | string, runId: number | string, reason?: string) => Promise<unknown>;
     retryRun: (workflowId: number | string, runId: number | string) => Promise<unknown>;

package/dist/runtime/composables/useIntegrationsRuns.js

@@ -2,7 +2,7 @@ import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { errorReason } from "../utils/apiError.js";
-import { unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord } from "../utils/apiEnvelope.js";
 import { RUN_OWN_FIELDS } from "../utils/runEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
 import {
@@ -58,6 +58,10 @@ export function useIntegrationsRuns() {
       // The platform reports what started the run. This was hardcoded to
       // `manual` because the payload carried nothing, which left the trigger
       // column and its filter with one populated value in production.
+      // Null — the trigger was deleted, or the run predates trigger_handle, or the
+      // row came from a per-workflow read, which sends no trigger at all — is read
+      // as `manual` here although the platform said nothing (IN-9, api-contract
+      // runs.feed F6 and runs.execution F2).
       triggerType: r.trigger_type ?? "manual",
       startedAt: r.started_at ?? "",
       finishedAt: r.completed_at ?? null,
@@ -187,11 +191,11 @@ export function useIntegrationsRuns() {
   async function trigger(workflowId, payload = {}, mode) {
     const body = { trigger_payload: payload };
     if (mode) body.mode = mode;
-    return unwrapRecord(await api.post(`/workflows/${workflowId}/runs`, body));
+    return bareRecord(await api.post(`/workflows/${workflowId}/runs`, body), RUN_OWN_FIELDS);
   }
   async function runAction(workflowId, runId, action, reason) {
     const body = reason ? { reason } : {};
-    return unwrapRecord(await api.post(`/workflows/${workflowId}/runs/${runId}/${action}`, body));
+    return bareRecord(await api.post(`/workflows/${workflowId}/runs/${runId}/${action}`, body), RUN_OWN_FIELDS);
   }
   const cancelRun = (workflowId, runId, reason) => runAction(workflowId, runId, "cancel", reason);
   const terminateRun = (workflowId, runId, reason) => runAction(workflowId, runId, "terminate", reason);
@@ -199,7 +203,7 @@ export function useIntegrationsRuns() {
   const resumeRun = (workflowId, runId, reason) => runAction(workflowId, runId, "resume", reason);
   const getRun = (workflowId, runId) => api.get(`/workflows/${workflowId}/runs/${runId}`);
   async function fetchRun(workflowId, runId, workflowName) {
-    const apiRun = unwrapRecord(await getRun(workflowId, runId), RUN_OWN_FIELDS);
+    const apiRun = bareRecord(await getRun(workflowId, runId), RUN_OWN_FIELDS);
     return mapRun(apiRun, workflowName);
   }
   const getDetails = (workflowId, runId) => api.get(`/workflows/${workflowId}/runs/${runId}/details`);

package/dist/runtime/composables/useIntegrationsSchedules.js

@@ -2,7 +2,8 @@ import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { useLoadGate } from "./useLoadGate.js";
-import { errorReason } from "../utils/apiError.js";
+import { errorReason, IntegrationsApiError } from "../utils/apiError.js";
+import { unwrapList } from "../utils/apiEnvelope.js";
 import { scheduleTimezone } from "../utils/schedule.js";
 export function useIntegrationsSchedules() {
   const api = useIntegrationsApi();
@@ -66,8 +67,10 @@ export function useIntegrationsSchedules() {
     error.value = null;
     try {
       const res = await api.get("/schedules");
-      entries.value = (res?.data ?? []).map(mapEntry);
-      meta.value = res?.meta ?? { total: 0, live_count: 0, timezones: [] };
+      const rows = unwrapList(res);
+      if (!res?.meta) throw new IntegrationsApiError(200, res, "");
+      entries.value = rows.map(mapEntry);
+      meta.value = res.meta;
       loaded.value = true;
     } catch (e) {
       error.value = errorReason(e, t("integration.schedules.error.loadFailed"));

package/dist/runtime/composables/useIntegrationsSecrets.d.ts

@@ -1,12 +1,13 @@
 import type { SecretRecord } from '../types/integrations.js';
+export declare const SECRET_KEY_MAX = 191;
 /**
  * Per-tenant encrypted key/value store, backed by the Integrations service
- * (`/api/v1/secrets`). The backend NEVER returns values — only keys +
- * timestamps — so the list is keys-only by design.
+ * (`/api/v1/secrets`). The backend NEVER returns a value.
  *
- *   GET    /secrets          → list (keys + timestamps)
- *   POST   /secrets          → upsert  { key, value }
- *   DELETE /secrets/{key}    → remove
+ *   GET    /secrets          → { data: [{ key, created_at, updated_at }] }, key-ascending
+ *   POST   /secrets          → upsert { key, value } — 201 created, 200 replaced, bare record
+ *   PATCH  /secrets/{key}    → replace the value (404 unknown key) — not used by this UI
+ *   DELETE /secrets/{key}    → 204, or 404 for a key this tenant does not hold
  */
 export declare function useIntegrationsSecrets(): {
     secrets: any;

package/dist/runtime/composables/useIntegrationsSecrets.js

@@ -4,7 +4,8 @@ import { useIntegrationsT } from "./useIntegrationsT.js";
 import { errorReason } from "../utils/apiError.js";
 import { unwrapList } from "../utils/apiEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
-const KEY_PATTERN = /^[A-Z0-9_]+$/;
+const KEY_PATTERN = /^[\w-]+$/;
+export const SECRET_KEY_MAX = 191;
 export function useIntegrationsSecrets() {
   const secrets = useState("integrations.secrets", () => []);
   const loading = useState("integrations.secrets.loading", () => false);
@@ -14,7 +15,7 @@ export function useIntegrationsSecrets() {
   const api = useIntegrationsApi();
   const t = useIntegrationsT();
   function isValidKey(key) {
-    return KEY_PATTERN.test(key);
+    return KEY_PATTERN.test(key) && [...key].length <= SECRET_KEY_MAX;
   }
   function normalize(res) {
     const obj = res;

package/dist/runtime/composables/useIntegrationsTemplates.d.ts

@@ -14,7 +14,7 @@ export declare function useIntegrationsTemplates(): {
     requirements: (slug: string) => Promise<TemplateRequirements | null>;
     instantiate: (slug: string, opts?: {
         name?: string;
-        credentialBindings?: Record<string, string>;
+        credentialBindings?: Record<string, string | Record<string, string>>;
     }) => Promise<number | null>;
     install: (slug: string) => Promise<number | null>;
 };

package/dist/runtime/composables/useIntegrationsTemplates.js

@@ -1,12 +1,11 @@
 import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { errorReason } from "../utils/apiError.js";
-import { unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord, unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
 import { resolveLocalized } from "../utils/localize.js";
 import { useLoadGate } from "./useLoadGate.js";
 import { createDetailLoader, keyedBatch } from "../utils/detailLoader.js";
 const BLOB_VERSION = "v0-draft";
-const INDUSTRY_VALUES = ["mechanical-engineering", "chemicals", "wholesale", "manufacturing", "retail", "any"];
 function plainExcerpt(md) {
   for (const raw of md.split("\n")) {
     const line = raw.trim();
@@ -21,7 +20,7 @@ function publisherFor(slug, vendors) {
   return { name: ns, kind };
 }
 function mapIndustries(arr) {
-  return (arr ?? []).filter((i) => INDUSTRY_VALUES.includes(i));
+  return (arr ?? []).filter((i) => typeof i === "string" && i.trim() !== "").map((i) => i.trim());
 }
 function emptyBlob(name) {
   return { nodeManifestVersion: BLOB_VERSION, name, nodes: [], edges: [], triggerPositions: {}, triggers: [] };
@@ -58,7 +57,7 @@ function mapListItem(api) {
 function applyDetail(base, api) {
   const def = api.definition ?? {};
   const triggers = (api.triggers ?? []).map((t) => ({
-    id: t.handle ?? String(t.id ?? ""),
+    id: t.handle,
     type: t.type,
     name: typeof t.name === "string" ? t.name : void 0,
     active: t.active,
@@ -184,10 +183,10 @@ export function useIntegrationsTemplates() {
     const body = {};
     if (opts.name) body.name = opts.name;
     const bindings = Object.fromEntries(
-      Object.entries(opts.credentialBindings ?? {}).filter(([, v]) => v)
+      Object.entries(opts.credentialBindings ?? {}).map(([nodeId, b]) => [nodeId, typeof b === "string" ? b : Object.fromEntries(Object.entries(b).filter(([, id]) => id))]).filter(([, b]) => typeof b === "string" ? b !== "" : Object.keys(b).length > 0)
     );
     if (Object.keys(bindings).length) body.credential_bindings = bindings;
-    const created = unwrapRecord(await api.post(`/templates/${slug}/instantiate`, body));
+    const created = bareRecord(await api.post(`/templates/${slug}/instantiate`, body));
     return Number(created.id);
   }
   async function install(slug) {

package/dist/runtime/composables/useIntegrationsWorkflows.js

@@ -3,7 +3,7 @@ import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { assignTriggerHandles, pausedTriggers } from "../utils/workflowFile.js";
 import { errorReason } from "../utils/apiError.js";
-import { unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord, unwrapList } from "../utils/apiEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
 import { eventConfigForPlatform } from "../data/eventTrigger.js";
 const BLOB_VERSION = "v0-draft";
@@ -140,7 +140,7 @@ export function useIntegrationsWorkflows() {
   }
   async function get(id, { strict = false } = {}) {
     try {
-      const wf = ingest(unwrapRecord(await api.get(`/workflows/${id}`)));
+      const wf = ingest(bareRecord(await api.get(`/workflows/${id}`)));
       upsertCache(wf);
       return wf;
     } catch (e) {
@@ -149,7 +149,7 @@ export function useIntegrationsWorkflows() {
     }
   }
   async function create(input) {
-    const wf = ingest(unwrapRecord(await api.post("/workflows", toPayload({
+    const wf = ingest(bareRecord(await api.post("/workflows", toPayload({
       name: input.name,
       description: input.description,
       blob: input.blob,
@@ -182,7 +182,7 @@ export function useIntegrationsWorkflows() {
     throw lastError instanceof Error ? lastError : new Error(t("integration.workflows.error.duplicateFailed"));
   }
   async function update(id, patch) {
-    const wf = ingest(unwrapRecord(await api.put(`/workflows/${id}`, toPayload({
+    const wf = ingest(bareRecord(await api.put(`/workflows/${id}`, toPayload({
       name: patch.name,
       description: patch.description,
       blob: patch.blob,

package/dist/runtime/composables/useNodeRetirement.js

@@ -1,5 +1,5 @@
 import { IntegrationsApiError } from "../utils/apiError.js";
-import { unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord, unwrapList } from "../utils/apiEnvelope.js";
 import { useIntegrationsApi } from "./integrationsApi.js";
 function versionPath(slug, version) {
   return `/nodes/${encodeURIComponent(slug)}/${encodeURIComponent(version)}`;
@@ -11,7 +11,7 @@ export function useNodeRetirement() {
     return all.filter((n) => n.package?.name === packageName);
   }
   async function usage(slug, version) {
-    const answer = unwrapRecord(await api.get(`${versionPath(slug, version)}/usage`), ["usage"]);
+    const answer = bareRecord(await api.get(`${versionPath(slug, version)}/usage`));
     const counts = answer?.usage;
     if (!counts || typeof counts.workflows !== "number") {
       throw new IntegrationsApiError(200, answer, "");
@@ -19,13 +19,13 @@ export function useNodeRetirement() {
     return counts;
   }
   async function retire(slug, version, reason) {
-    return unwrapRecord(await api.post(`${versionPath(slug, version)}/retire`, {
+    return bareRecord(await api.post(`${versionPath(slug, version)}/retire`, {
       confirm: `${slug}@${version}`,
       ...reason ? { reason } : {}
-    }), ["usage"]);
+    }));
   }
   async function restore(slug, version) {
-    return unwrapRecord(await api.del(`${versionPath(slug, version)}/retire`), ["usage"]);
+    return bareRecord(await api.del(`${versionPath(slug, version)}/retire`));
   }
   return { versionsOfPackage, usage, retire, restore };
 }