@revenexx/studio-integrations 3.0.3 → 3.2.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @revenexx/studio-integrations
 
+## 3.2.0
+
+### Minor Changes
+
+- 60e6143: A template whose requirements the platform could not answer for is no longer shown as ready to install. The template page's setup rail and the install step now say they could not check what the template needs, with the platform's reason, instead of "Everything is ready to install" and "This template needs no credentials"; installing stays possible. While the answer is still on its way, the rail claims nothing.
+  
+  For hosts: `useIntegrationsTemplates()` gains `checkRequirements(slug)`, which rejects with the platform's reason where `requirements(slug)` resolves to `null`, and `uncheckedReason(error)`, which turns that rejection into the sentence the studio shows. `requirements` still behaves as before but is now deprecated: its `null` cannot tell "could not check" from "needs nothing", so a host that reads it as an empty answer shows an unchecked template as ready. Switch to `checkRequirements`.
+
+### Patch Changes
+
+- e62ae58: A failed step now says why it failed in one sentence. The run record's step list showed the whole error the platform sends, as a block of JSON; it now shows the message. The replay's debug panel shows the message and the failure's type, and the places in the node's own code where it failed as a list that stays folded until opened.
+
+## 3.1.0
+
+### Minor Changes
+
+- 23bb093: The audit log offers every kind of change and of thing a tenant's log can hold — a cancelled or resumed run, a retired or restored node version, deleted stored state — and names a trigger by its kind and workflow and a run by its workflow, since the platform records no name for either. A connection test the platform could not run (its test broker was busy, or the reader may not try changed values) now reads "Not tested" instead of a failed connection. A secret key may be anything the platform stores — lower case and hyphens included, up to 191 characters; a runs search is cut to the platform's 200 characters instead of being refused; an install name stops at 255. Installing a template wires a step with two credential settings setting by setting,, a template's industry outside the six the studio used to know is kept and found by search, and a template started by a webhook says which method it answers rather than a path it never carries. An answer the schedules page cannot read is reported as a failed load, not as a tenant with no schedules.
+  
+  For hosts: single workflows, runs and credentials are now read only in the bare shape the Integrations service sends; a `data`-wrapped answer is refused. `instantiate()` also accepts `{ nodeId: { settingKey: credentialId } }` beside a bare id. Three exported types widen to what the service sends — `WorkflowTemplate.industries` is `string[]`, `CredentialType.icon` and `description` may be `null`, and a credential field option's `label` may be localised.
+
+### Patch Changes
+
+- ef3f3eb: A dead letter's `reason` is typed as the string the platform always sends (empty when nothing was recorded) and its `trigger_id` as the number it is. Rotating a webhook's endpoint secret reads the platform's answer in the one shape it has ever sent. Nothing else a host sees changes: the rest of this release brings the browser tests' mock in line with what the Integrations service actually answers.
+
 ## 3.0.3
 
 ### Patch Changes

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@revenexx/studio-integrations",
   "configKey": "studioIntegrations",
-  "version": "3.0.3",
+  "version": "3.2.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/runtime/components/Integrations/CredentialCreateDialog.vue

@@ -23,6 +23,7 @@ import { resolveLocalized } from "../../utils/localize";
 import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 import { errorReason } from "../../utils/apiError";
 import { keepOpenBeside } from "../../utils/dialog";
+import { testOutcomeView } from "../../utils/credentialTest";
 const props = defineProps({
   open: { type: Boolean, required: true },
   credentialType: { type: [String, Array], required: false }
@@ -247,12 +248,12 @@ async function submit() {
         <div
           v-if="testResult"
           class="rounded-md px-3 py-2 text-sm"
-          :class="testResult.ok ? 'bg-emerald-500/10 text-emerald-700' : 'bg-rose-500/10 text-rose-700'"
+          :class="testOutcomeView(testResult, t).toneClass"
         >
           <!-- The type's own sentence, either way. This is the surface where it is
                worth the most: nothing is stored yet, so the operator is deciding
                whether these access data reach what they meant (specs/credential-test.md). -->
-          {{ testResult.ok ? testResult.message ?? t("integration.credentials.shared.test.ok") : testResult.error ?? testResult.message ?? t("integration.credentials.shared.test.failed") }}
+          {{ testOutcomeView(testResult, t).text }}
         </div>
       </div>
 

package/dist/runtime/components/Integrations/CredentialDetailDialog.vue

@@ -39,6 +39,7 @@ import { hasRevenexxSource } from "../../utils/revenexxCredentialSource";
 import { resolveLocalized } from "../../utils/localize";
 import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 import { keepOpenBeside } from "../../utils/dialog";
+import { testOutcomeView } from "../../utils/credentialTest";
 const props = defineProps({
   open: { type: Boolean, required: true },
   credential: { type: [Object, null], required: true },
@@ -375,9 +376,9 @@ async function connect() {
               <div
                 v-if="liveTest"
                 class="rounded-md px-3 py-2 text-sm"
-                :class="liveTest.ok ? 'bg-emerald-500/10 text-emerald-700' : 'bg-rose-500/10 text-rose-700'"
+                :class="testOutcomeView(liveTest, t).toneClass"
               >
-                {{ liveTest.ok ? liveTest.message ?? t("integration.credentials.shared.test.ok") : liveTest.error ?? liveTest.message ?? t("integration.credentials.shared.test.failed") }}
+                {{ testOutcomeView(liveTest, t).text }}
               </div>
 
             </div>

package/dist/runtime/components/Integrations/NodeInspector.vue

@@ -472,7 +472,7 @@ async function rotateEndpointSecret() {
     const api2 = useIntegrationsApi();
     const res = await api2.post(`/workflows/${props.workflowId}/triggers/${wt.id}/rotate-secret`, {});
     const body = res ?? {};
-    const secret = body.inbound_secret ?? body.data?.inbound_secret ?? null;
+    const secret = body.inbound_secret ?? null;
     if (secret) {
       rotatedSecret.value = secret;
       rotateOpen.value = true;

package/dist/runtime/components/Integrations/RunDetailPanel.vue

@@ -4,6 +4,7 @@ import { Download as DownloadIcon, RefreshCircle as RefreshIcon } from "#solar-i
 import { Badge, Button, Dialog, DialogContent, DialogHeader, DialogTitle } from "@revenexx/studio";
 import { runStatusClass, runStatusLabel } from "../../utils/statusStyle";
 import { isSkippedStep, skipReasonMessage, stepStatusLabel } from "../../utils/skippedStep";
+import { stepError } from "../../utils/stepError";
 import { IntegrationsApiError, errorReason } from "../../utils/apiError";
 import { createPollBudget, SAFETY_POLL_MS } from "../../utils/pollBudget";
 import { formatDuration } from "../../utils/formatDuration";
@@ -764,8 +765,8 @@ async function confirmAction() {
               <span class="text-xs text-muted-foreground tabular-nums shrink-0">{{ fmtMs(st.duration_ms) }}</span>
               <span v-if="!isSkippedStep(st)" class="text-[10px] text-muted-foreground shrink-0">{{ expandedStep === stepKey(st, i) ? "\u25BC" : "\u25B6" }}</span>
             </button>
-            <div v-if="st.error" class="px-3 pb-2 -mt-1">
-              <div class="rounded-md border border-rose-500/20 bg-rose-500/5 px-2 py-1 text-xs text-rose-700 break-words">{{ st.error }}</div>
+            <div v-if="stepError(st.error)" class="px-3 pb-2 -mt-1">
+              <div class="rounded-md border border-rose-500/20 bg-rose-500/5 px-2 py-1 text-xs text-rose-700 break-words whitespace-pre-wrap" data-testid="step-error">{{ stepError(st.error).message }}</div>
             </div>
             <div v-if="expandedStep === stepKey(st, i)" class="px-3 pb-3 space-y-2">
               <template v-if="hasPayload(st)">

package/dist/runtime/components/Integrations/TemplateFlowPreview.vue

@@ -30,7 +30,7 @@ const boxes = computed(() => {
   triggers.forEach((t2, i) => {
     const pos = blob.triggerPositions?.[t2.id] ?? { x: 40, y: 40 + i * 160 };
     const template = TRIGGER_TEMPLATES.find((tt) => tt.type === t2.type);
-    const subtitle = t2.type === "schedule" && t2.config?.cron ? describeCron(String(t2.config.cron)) ?? String(t2.config.cron) : t2.type === "webhook" && t2.config?.path ? String(t2.config.path) : resolveLocalized(template?.description ?? "");
+    const subtitle = t2.type === "schedule" && t2.config?.cron ? describeCron(String(t2.config.cron)) ?? String(t2.config.cron) : t2.type === "webhook" && t2.config?.method ? String(t2.config.method).toUpperCase() : resolveLocalized(template?.description ?? "");
     out.push({
       key: `t-${t2.id}`,
       kind: "trigger",

package/dist/runtime/components/Integrations/TemplateInstallStep.vue

@@ -20,64 +20,77 @@ const props = defineProps({
 });
 const emit = defineEmits(["installed", "update:loading", "update:installing"]);
 const t = useIntegrationsT();
-const { get, load, fetchDetail, requirements, instantiate } = useIntegrationsTemplates();
+const { get, load, fetchDetail, checkRequirements, uncheckedReason, instantiate } = useIntegrationsTemplates();
 const { keys: secretKeys, load: loadSecrets } = useIntegrationsSecrets();
 const { ofType, refresh: refreshCredentials } = useIntegrationsCredentials();
 const reqs = ref(null);
+const reqsError = ref(null);
 const loading = ref(true);
 const installing = ref(false);
 const error = ref(null);
 const name = ref("");
 const bindings = reactive({});
+const slotKey = (nodeId, configKey) => `${nodeId}\0${configKey}`;
 let run = 0;
 watch(() => props.slug, async (slug) => {
   const mine = ++run;
   loading.value = true;
   reqs.value = null;
+  reqsError.value = null;
   error.value = null;
   name.value = "";
   for (const k of Object.keys(bindings)) delete bindings[k];
-  await load();
-  if (mine !== run) return;
-  if (name.value === "") name.value = get(slug)?.name ?? "";
-  await Promise.all([fetchDetail(slug), refreshCredentials(), loadSecrets()]);
-  if (mine !== run) return;
-  const answer = await requirements(slug);
+  let answer = null;
+  let failure = null;
+  try {
+    await load();
+    if (mine !== run) return;
+    if (name.value === "") name.value = get(slug)?.name ?? "";
+    await Promise.all([fetchDetail(slug), refreshCredentials(), loadSecrets()]);
+    if (mine !== run) return;
+    answer = await checkRequirements(slug);
+  } catch (e) {
+    failure = uncheckedReason(e);
+  }
   if (mine !== run) return;
   reqs.value = answer;
+  reqsError.value = failure;
   loading.value = false;
 }, { immediate: true });
 watch(loading, (v) => emit("update:loading", v), { immediate: true });
 watch(installing, (v) => emit("update:installing", v));
 onBeforeUnmount(() => emit("update:loading", false));
-const tpl = computed(() => get(props.slug));
 const credentialReqs = computed(() => reqs.value?.credentialTypes ?? []);
 const secretReqs = computed(() => reqs.value?.secrets ?? []);
-const secretChecks = computed(() => {
-  const fromApi = secretReqs.value;
-  if (fromApi.length) {
-    return fromApi.map((s) => ({
-      key: s.key,
-      label: s.key ?? t("integration.templates.detail.secrets.chosenAtInstall"),
-      present: s.exists || (s.key ? secretKeys.value.includes(s.key) : false)
-    }));
-  }
-  return (tpl.value?.requiredSecrets ?? []).map((key) => ({
-    key,
-    label: key,
-    present: secretKeys.value.includes(key)
+const secretChecks = computed(() => secretReqs.value.map((s) => ({
+  key: s.key,
+  label: s.key ?? t("integration.templates.detail.secrets.chosenAtInstall"),
+  present: s.exists || (s.key ? secretKeys.value.includes(s.key) : false)
+})));
+function slotsFor(usedBy) {
+  const all = credentialReqs.value.flatMap((r) => r.usedBy);
+  const seen = /* @__PURE__ */ new Set();
+  return usedBy.filter((u) => {
+    const key = slotKey(u.nodeId, u.configKey);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).map((u) => ({
+    key: slotKey(u.nodeId, u.configKey),
+    nodeId: u.nodeId,
+    configKey: u.configKey,
+    label: new Set(all.filter((o) => o.nodeId === u.nodeId).map((o) => o.configKey)).size > 1 ? t("integration.templates.detail.install.settingLabel", { id: u.nodeId, setting: u.configKey }) : t("integration.templates.detail.install.nodeLabel", { id: u.nodeId })
   }));
-});
-function nodesFor(usedBy) {
-  return [...new Set(usedBy.map((u) => u.nodeId))];
 }
 async function confirmInstall() {
   installing.value = true;
   error.value = null;
   try {
     const credentialBindings = {};
-    for (const [nodeId, credId] of Object.entries(bindings)) {
-      if (credId && credId !== SELECT_LATER) credentialBindings[nodeId] = credId;
+    for (const [key, credId] of Object.entries(bindings)) {
+      if (!credId || credId === SELECT_LATER) continue;
+      const [nodeId, configKey] = key.split("\0");
+      (credentialBindings[nodeId] ??= {})[configKey] = credId;
     }
     const id = await instantiate(props.slug, {
       name: name.value.trim(),
@@ -98,7 +111,8 @@ async function confirmInstall() {
     <div class="space-y-4 py-1 max-h-[28rem] overflow-y-auto pr-1">
       <div class="space-y-1.5">
         <Label for="tpl-install-name">{{ t("integration.templates.detail.install.nameLabel") }}</Label>
-        <Input id="tpl-install-name" v-model="name" class="bg-white" :placeholder="t('integration.templates.detail.install.namePlaceholder')" />
+        <!-- 255: the platform's limit on a workflow's name (InstantiateTemplateRequest). -->
+        <Input id="tpl-install-name" v-model="name" class="bg-white" :maxlength="255" :placeholder="t('integration.templates.detail.install.namePlaceholder')" />
       </div>
 
       <div v-if="loading" class="flex items-center gap-2 py-4 text-sm text-muted-foreground">
@@ -112,7 +126,13 @@ async function confirmInstall() {
           <div class="text-mono text-muted-foreground border-b border-black/[0.06] pb-1.5">
             {{ t("integration.templates.detail.credentials.title") }}
           </div>
-          <p v-if="!credentialReqs.length" class="text-sm text-muted-foreground italic">
+          <!-- Two lines, not one sentence around {reason}: the platform's message
+               ends in a full stop or not, and a template cannot know which. -->
+          <div v-if="reqsError" class="rounded-md border-l-2 border-amber-500/40 bg-amber-500/5 px-2.5 py-1.5 text-sm text-amber-700" data-testid="template-install-unchecked">
+            <p>{{ t("integration.templates.detail.setup.unchecked", { reason: reqsError }) }}</p>
+            <p>{{ t("integration.templates.detail.install.stillInstallable") }}</p>
+          </div>
+          <p v-else-if="!credentialReqs.length" class="text-sm text-muted-foreground italic">
             {{ t("integration.templates.detail.install.noCredentials") }}
           </p>
           <div v-for="req in credentialReqs" :key="req.slug" class="space-y-2">
@@ -131,15 +151,17 @@ async function confirmInstall() {
               <NuxtLink to="/integrations/credentials" class="text-primary hover:underline">{{ t("integration.templates.detail.install.createOneLink") }}</NuxtLink>
               {{ t("integration.templates.detail.install.orInstallLater") }}
             </p>
-            <div v-for="nodeId in nodesFor(req.usedBy)" v-else :key="nodeId" class="space-y-1">
-              <Label :for="`tpl-cred-${nodeId}`" class="text-xs text-muted-foreground font-mono">{{ t("integration.templates.detail.install.nodeLabel", { id: nodeId }) }}</Label>
+            <div v-for="(slot, si) in slotsFor(req.usedBy)" v-else :key="slot.key" class="space-y-1">
+              <!-- By position, not by joining two free strings: `a-b`+`c` and `a`+`b-c`
+                   would share an id, and a label would name the wrong select. -->
+              <Label :for="`tpl-cred-${req.slug}-${si}`" class="text-xs text-muted-foreground font-mono">{{ slot.label }}</Label>
               <Select
-                :model-value="bindings[nodeId] ?? SELECT_LATER"
+                :model-value="bindings[slot.key] ?? SELECT_LATER"
                 @update:model-value="(v) => {
-  bindings[nodeId] = v ?? SELECT_LATER;
+  bindings[slot.key] = v ?? SELECT_LATER;
 }"
               >
-                <SelectTrigger :id="`tpl-cred-${nodeId}`" class="bg-white">
+                <SelectTrigger :id="`tpl-cred-${req.slug}-${si}`" class="bg-white">
                   <SelectValue :placeholder="t('integration.templates.detail.install.selectLater')" />
                 </SelectTrigger>
                 <SelectContent>

package/dist/runtime/components/Integrations/WorkflowRunReplayPanel.vue

@@ -31,6 +31,7 @@ import { formatDuration } from "../../utils/formatDuration";
 import { SAFETY_POLL_MS } from "../../utils/pollBudget";
 import { runStatusClass, runStatusLabel } from "../../utils/statusStyle";
 import { executedNodeIds, isSkippedStep, skipReasonMessage, stepStatusLabel } from "../../utils/skippedStep";
+import { frameLabel, stepError } from "../../utils/stepError";
 import { errorReason } from "../../utils/apiError";
 const props = defineProps({
   workflow: { type: Object, required: true },
@@ -108,6 +109,7 @@ const playing = ref(false);
 let playTimer = null;
 const safeCursor = computed(() => steps.value.length === 0 ? 0 : Math.min(cursor.value, steps.value.length - 1));
 const activeStep = computed(() => steps.value[safeCursor.value]);
+const activeError = computed(() => stepError(activeStep.value?.error));
 function seek(i) {
   playing.value = false;
   cursor.value = Math.max(0, Math.min(i, steps.value.length - 1));
@@ -529,9 +531,19 @@ watch(() => props.initialRunId, (id) => {
           <code class="rounded bg-black/[0.05] px-1.5 py-0.5 font-mono">{{ activeStep.branch }}</code>
         </div>
 
-        <div v-if="activeStep.error" class="text-sm">
+        <div v-if="activeError" class="text-sm" data-testid="replay-step-error">
           <div class="text-mono text-muted-foreground mb-1">{{ t("integration.replay.debug.field.error") }}</div>
-          <pre class="max-h-40 overflow-auto rounded-md border border-rose-500/20 bg-rose-500/5 p-2 font-mono text-sm text-rose-700">{{ activeStep.error }}</pre>
+          <div class="max-h-40 overflow-auto rounded-md border border-rose-500/20 bg-rose-500/5 p-2 text-sm text-rose-700 break-words whitespace-pre-wrap">{{ activeError.message }}</div>
+          <div v-if="activeError.type" class="mt-1 font-mono text-xs text-muted-foreground">{{ activeError.type }}</div>
+          <!-- Where the node's own code failed (PO-447): for whoever maintains the
+               node, so folded rather than beside the reason (IN-12). Keyed on the step so
+               it folds again on the next failed one. -->
+          <details v-if="activeError.frames?.length" :key="safeCursor" class="mt-1">
+            <summary class="cursor-pointer text-xs text-muted-foreground">{{ t("integration.replay.debug.field.frames") }}</summary>
+            <ol class="mt-1 space-y-0.5 font-mono text-xs">
+              <li v-for="(frame, fi) in activeError.frames" :key="fi">{{ frameLabel(frame) }}</li>
+            </ol>
+          </details>
         </div>
 
         <div v-if="activeStep.input !== void 0 && activeStep.input !== null" class="text-sm">

package/dist/runtime/composables/useIntegrationsAudit.d.ts

@@ -1,5 +1,3 @@
-export type AuditResourceType = 'credential' | 'secret' | 'workflow' | 'trigger' | 'workflow_run';
-export type AuditAction = 'create' | 'update' | 'delete' | 'run.started' | 'run.finished' | 'run.failed';
 export interface AuditEntry {
     id: number;
     org_id?: string;
@@ -8,12 +6,19 @@ export interface AuditEntry {
     /** As the actor's sign-in stated it when the entry was written; null for the platform, and for entries from before names were recorded (PO-609). */
     actor_name?: string | null;
     actor_email?: string | null;
+    /** Whether the platform wrote the entry with no person behind it, and by which route it arrived. Sent on every row; not shown yet. */
+    via_system?: boolean;
+    channel?: string;
     action: string;
     resource_type: string;
     resource_id?: string;
     metadata?: Record<string, unknown> | null;
     created_at: string;
 }
+/**
+ * The narrowing the feed itself accepts. The page sends none of it today — it
+ * narrows in the browser over what it has loaded (specs/audit-log.md `## Gaps`).
+ */
 export interface AuditFilters {
     sub?: string;
     resource_type?: string;

package/dist/runtime/composables/useIntegrationsCredentials.d.ts

@@ -8,11 +8,13 @@ import { IntegrationsApiError } from '../utils/apiError.js';
  *   GET    /credentials[?type=slug]      → list
  *   POST   /credentials                  → create { credential_type_slug, name, config }
  *   GET    /credentials/{id}             → show (masked)
- *   PATCH  /credentials/{id}             → update { name?, config? } (blank secret = keep)
+ *   PATCH  /credentials/{id}             → update { name?, config? } (blank secret = keep,
+ *                                          unless the same edit changes any other value:
+ *                                          then 422 at config.<secret>, PO-765)
  *   DELETE /credentials/{id}             → remove
  *   POST   /credentials/test             → inline test { credential_type_slug, config }
- *   POST   /credentials/{id}/test        → test saved instance
- *   POST   /credentials/{id}/oauth/authorize-url → { authorize_url, state }
+ *   POST   /credentials/{id}/test        → test { config? } → { ok, message, recorded, last_test_at, last_test_ok }
+ *   POST   /credentials/{id}/oauth/authorize-url → { authorize_url }
  */
 /**
  * `message` is what the credential type said about the test, whichever way it went —
@@ -33,6 +35,12 @@ export interface CredentialTestResult {
      * test of an edit that tried values other than the stored ones (PO-535).
      */
     recorded?: boolean;
+    /**
+     * The test did not happen, so it says nothing about the credential: the platform's
+     * test broker had no room for it, or the reader may not try changed values (IN-22).
+     * Drawn neither as a pass nor as a failure.
+     */
+    untested?: true;
     /**
      * The refusal the service answered instead of testing, held as it arrived: values it
      * would not try as given — a stored secret kept for a changed server (PO-765). A form

package/dist/runtime/composables/useIntegrationsCredentials.js

@@ -2,7 +2,7 @@ import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { IntegrationsApiError, errorReason } from "../utils/apiError.js";
-import { unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord, unwrapList } from "../utils/apiEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
 export function useIntegrationsCredentials() {
   const credentials = useState("integrations.credentials", () => []);
@@ -33,15 +33,15 @@ export function useIntegrationsCredentials() {
     return credentials.value.filter((c) => c.credential_type_slug === slug);
   }
   async function get(id) {
-    return unwrapRecord(await api.get(`/credentials/${encodeURIComponent(id)}`));
+    return bareRecord(await api.get(`/credentials/${encodeURIComponent(id)}`));
   }
   async function create(input) {
-    const created = unwrapRecord(await api.post("/credentials", input));
+    const created = bareRecord(await api.post("/credentials", input));
     await load(true);
     return created;
   }
   async function update(id, input) {
-    const updated = unwrapRecord(await api.patch(`/credentials/${encodeURIComponent(id)}`, input));
+    const updated = bareRecord(await api.patch(`/credentials/${encodeURIComponent(id)}`, input));
     await load(true);
     return updated;
   }
@@ -63,15 +63,19 @@ export function useIntegrationsCredentials() {
         `/credentials/${encodeURIComponent(id)}/test`,
         config ? { config } : void 0
       );
+      if (!config && res?.ok === false && res.recorded === false) return { ...res, untested: true };
       return res?.ok === false ? res : { ok: true, message: res?.message, recorded: res?.recorded };
     } catch (e) {
+      if (config && e instanceof IntegrationsApiError && e.status === 403) {
+        return { ok: false, untested: true, error: t("integration.credentials.shared.test.notAllowed") };
+      }
       const refusal = e instanceof IntegrationsApiError && e.status === 422 ? e : void 0;
       return { ok: false, error: errorReason(e, t("integration.credentials.error.testFailed")), refusal };
     }
   }
   async function oauthAuthorizeUrl(id) {
     const res = await api.post(`/credentials/${encodeURIComponent(id)}/oauth/authorize-url`);
-    const authorizeUrl = unwrapRecord(res).authorize_url;
+    const authorizeUrl = bareRecord(res).authorize_url;
     if (!authorizeUrl) throw new IntegrationsApiError(0, res, t("integration.credentials.error.noAuthorizeUrl"));
     return authorizeUrl;
   }

package/dist/runtime/composables/useIntegrationsRuns.js

@@ -2,7 +2,7 @@ import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { errorReason } from "../utils/apiError.js";
-import { unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord } from "../utils/apiEnvelope.js";
 import { RUN_OWN_FIELDS } from "../utils/runEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
 import {
@@ -58,6 +58,10 @@ export function useIntegrationsRuns() {
       // The platform reports what started the run. This was hardcoded to
       // `manual` because the payload carried nothing, which left the trigger
       // column and its filter with one populated value in production.
+      // Null — the trigger was deleted, or the run predates trigger_handle, or the
+      // row came from a per-workflow read, which sends no trigger at all — is read
+      // as `manual` here although the platform said nothing (IN-9, api-contract
+      // runs.feed F6 and runs.execution F2).
       triggerType: r.trigger_type ?? "manual",
       startedAt: r.started_at ?? "",
       finishedAt: r.completed_at ?? null,
@@ -187,11 +191,11 @@ export function useIntegrationsRuns() {
   async function trigger(workflowId, payload = {}, mode) {
     const body = { trigger_payload: payload };
     if (mode) body.mode = mode;
-    return unwrapRecord(await api.post(`/workflows/${workflowId}/runs`, body));
+    return bareRecord(await api.post(`/workflows/${workflowId}/runs`, body), RUN_OWN_FIELDS);
   }
   async function runAction(workflowId, runId, action, reason) {
     const body = reason ? { reason } : {};
-    return unwrapRecord(await api.post(`/workflows/${workflowId}/runs/${runId}/${action}`, body));
+    return bareRecord(await api.post(`/workflows/${workflowId}/runs/${runId}/${action}`, body), RUN_OWN_FIELDS);
   }
   const cancelRun = (workflowId, runId, reason) => runAction(workflowId, runId, "cancel", reason);
   const terminateRun = (workflowId, runId, reason) => runAction(workflowId, runId, "terminate", reason);
@@ -199,7 +203,7 @@ export function useIntegrationsRuns() {
   const resumeRun = (workflowId, runId, reason) => runAction(workflowId, runId, "resume", reason);
   const getRun = (workflowId, runId) => api.get(`/workflows/${workflowId}/runs/${runId}`);
   async function fetchRun(workflowId, runId, workflowName) {
-    const apiRun = unwrapRecord(await getRun(workflowId, runId), RUN_OWN_FIELDS);
+    const apiRun = bareRecord(await getRun(workflowId, runId), RUN_OWN_FIELDS);
     return mapRun(apiRun, workflowName);
   }
   const getDetails = (workflowId, runId) => api.get(`/workflows/${workflowId}/runs/${runId}/details`);

package/dist/runtime/composables/useIntegrationsSchedules.js

@@ -2,7 +2,8 @@ import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { useIntegrationsT } from "./useIntegrationsT.js";
 import { useLoadGate } from "./useLoadGate.js";
-import { errorReason } from "../utils/apiError.js";
+import { errorReason, IntegrationsApiError } from "../utils/apiError.js";
+import { unwrapList } from "../utils/apiEnvelope.js";
 import { scheduleTimezone } from "../utils/schedule.js";
 export function useIntegrationsSchedules() {
   const api = useIntegrationsApi();
@@ -66,8 +67,10 @@ export function useIntegrationsSchedules() {
     error.value = null;
     try {
       const res = await api.get("/schedules");
-      entries.value = (res?.data ?? []).map(mapEntry);
-      meta.value = res?.meta ?? { total: 0, live_count: 0, timezones: [] };
+      const rows = unwrapList(res);
+      if (!res?.meta) throw new IntegrationsApiError(200, res, "");
+      entries.value = rows.map(mapEntry);
+      meta.value = res.meta;
       loaded.value = true;
     } catch (e) {
       error.value = errorReason(e, t("integration.schedules.error.loadFailed"));

package/dist/runtime/composables/useIntegrationsSecrets.d.ts

@@ -1,12 +1,13 @@
 import type { SecretRecord } from '../types/integrations.js';
+export declare const SECRET_KEY_MAX = 191;
 /**
  * Per-tenant encrypted key/value store, backed by the Integrations service
- * (`/api/v1/secrets`). The backend NEVER returns values — only keys +
- * timestamps — so the list is keys-only by design.
+ * (`/api/v1/secrets`). The backend NEVER returns a value.
  *
- *   GET    /secrets          → list (keys + timestamps)
- *   POST   /secrets          → upsert  { key, value }
- *   DELETE /secrets/{key}    → remove
+ *   GET    /secrets          → { data: [{ key, created_at, updated_at }] }, key-ascending
+ *   POST   /secrets          → upsert { key, value } — 201 created, 200 replaced, bare record
+ *   PATCH  /secrets/{key}    → replace the value (404 unknown key) — not used by this UI
+ *   DELETE /secrets/{key}    → 204, or 404 for a key this tenant does not hold
  */
 export declare function useIntegrationsSecrets(): {
     secrets: any;

package/dist/runtime/composables/useIntegrationsSecrets.js

@@ -4,7 +4,8 @@ import { useIntegrationsT } from "./useIntegrationsT.js";
 import { errorReason } from "../utils/apiError.js";
 import { unwrapList } from "../utils/apiEnvelope.js";
 import { useLoadGate } from "./useLoadGate.js";
-const KEY_PATTERN = /^[A-Z0-9_]+$/;
+const KEY_PATTERN = /^[\w-]+$/;
+export const SECRET_KEY_MAX = 191;
 export function useIntegrationsSecrets() {
   const secrets = useState("integrations.secrets", () => []);
   const loading = useState("integrations.secrets.loading", () => false);
@@ -14,7 +15,7 @@ export function useIntegrationsSecrets() {
   const api = useIntegrationsApi();
   const t = useIntegrationsT();
   function isValidKey(key) {
-    return KEY_PATTERN.test(key);
+    return KEY_PATTERN.test(key) && [...key].length <= SECRET_KEY_MAX;
   }
   function normalize(res) {
     const obj = res;

package/dist/runtime/composables/useIntegrationsTemplates.d.ts

@@ -12,9 +12,11 @@ export declare function useIntegrationsTemplates(): {
     fetchDetail: (slug: string) => Promise<WorkflowTemplate | null>;
     ensureDetails: (slugs: string[], _concurrency?: number) => Promise<void>;
     requirements: (slug: string) => Promise<TemplateRequirements | null>;
+    checkRequirements: (slug: string) => Promise<TemplateRequirements>;
+    uncheckedReason: (err: unknown) => string;
     instantiate: (slug: string, opts?: {
         name?: string;
-        credentialBindings?: Record<string, string>;
+        credentialBindings?: Record<string, string | Record<string, string>>;
     }) => Promise<number | null>;
     install: (slug: string) => Promise<number | null>;
 };

package/dist/runtime/composables/useIntegrationsTemplates.js

@@ -1,12 +1,11 @@
 import { computed } from "vue";
 import { useIntegrationsApi } from "./integrationsApi.js";
 import { errorReason } from "../utils/apiError.js";
-import { unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
+import { bareRecord, unwrapList, unwrapRecord } from "../utils/apiEnvelope.js";
 import { resolveLocalized } from "../utils/localize.js";
 import { useLoadGate } from "./useLoadGate.js";
 import { createDetailLoader, keyedBatch } from "../utils/detailLoader.js";
 const BLOB_VERSION = "v0-draft";
-const INDUSTRY_VALUES = ["mechanical-engineering", "chemicals", "wholesale", "manufacturing", "retail", "any"];
 function plainExcerpt(md) {
   for (const raw of md.split("\n")) {
     const line = raw.trim();
@@ -21,7 +20,7 @@ function publisherFor(slug, vendors) {
   return { name: ns, kind };
 }
 function mapIndustries(arr) {
-  return (arr ?? []).filter((i) => INDUSTRY_VALUES.includes(i));
+  return (arr ?? []).filter((i) => typeof i === "string" && i.trim() !== "").map((i) => i.trim());
 }
 function emptyBlob(name) {
   return { nodeManifestVersion: BLOB_VERSION, name, nodes: [], edges: [], triggerPositions: {}, triggers: [] };
@@ -58,7 +57,7 @@ function mapListItem(api) {
 function applyDetail(base, api) {
   const def = api.definition ?? {};
   const triggers = (api.triggers ?? []).map((t) => ({
-    id: t.handle ?? String(t.id ?? ""),
+    id: t.handle,
     type: t.type,
     name: typeof t.name === "string" ? t.name : void 0,
     active: t.active,
@@ -166,16 +165,22 @@ export function useIntegrationsTemplates() {
     if (!wanted.length) return;
     remember(await loader.many(wanted));
   }
+  async function checkRequirements(slug) {
+    const raw = unwrapRecord(await api.get(`/templates/${slug}/requirements`));
+    return {
+      ...raw,
+      credentialTypes: (raw.credentialTypes ?? []).map((c) => ({
+        ...c,
+        name: c.name ? resolveLocalized(c.name) : c.name
+      }))
+    };
+  }
+  function uncheckedReason(err) {
+    return errorReason(err, t("integration.templates.detail.setup.uncheckedFallback"));
+  }
   async function requirements(slug) {
     try {
-      const raw = unwrapRecord(await api.get(`/templates/${slug}/requirements`));
-      return {
-        ...raw,
-        credentialTypes: (raw.credentialTypes ?? []).map((c) => ({
-          ...c,
-          name: c.name ? resolveLocalized(c.name) : c.name
-        }))
-      };
+      return await checkRequirements(slug);
     } catch {
       return null;
     }
@@ -184,10 +189,10 @@ export function useIntegrationsTemplates() {
     const body = {};
     if (opts.name) body.name = opts.name;
     const bindings = Object.fromEntries(
-      Object.entries(opts.credentialBindings ?? {}).filter(([, v]) => v)
+      Object.entries(opts.credentialBindings ?? {}).map(([nodeId, b]) => [nodeId, typeof b === "string" ? b : Object.fromEntries(Object.entries(b).filter(([, id]) => id))]).filter(([, b]) => typeof b === "string" ? b !== "" : Object.keys(b).length > 0)
     );
     if (Object.keys(bindings).length) body.credential_bindings = bindings;
-    const created = unwrapRecord(await api.post(`/templates/${slug}/instantiate`, body));
+    const created = bareRecord(await api.post(`/templates/${slug}/instantiate`, body));
     return Number(created.id);
   }
   async function install(slug) {
@@ -195,5 +200,5 @@ export function useIntegrationsTemplates() {
   }
   const total = computed(() => templates.value.length);
   const startingPoints = computed(() => templates.value.slice(0, 4));
-  return { templates, loaded, loading, error, total, startingPoints, load, list, get, fetchDetail, ensureDetails, requirements, instantiate, install };
+  return { templates, loaded, loading, error, total, startingPoints, load, list, get, fetchDetail, ensureDetails, requirements, checkRequirements, uncheckedReason, instantiate, install };
 }