@xyne/workflow-sdk 3.2.29 → 3.2.32

package/dist/persistence/types.d.ts

@@ -7,6 +7,8 @@
 import type { ResumePayload } from '../common/resume-payload.js';
 import type { Action } from '../authz/types.js';
 import type { ResourceAttributes } from '../authz/attributes.js';
+import type { WorkflowContext } from '../types/context.js';
+import type { CredentialSummary, CredentialListItem, ResolvedCredential, CreateCredentialInput, AuthSpecificValues } from '../common/credentials.js';
 /** What the engine stores about a workflow definition. */
 export interface WorkflowRecord {
     id: string;
@@ -342,34 +344,90 @@ export interface PersistenceAdapter<TFilter> {
         data: string;
         createdAt: Date;
     }>>;
-    /** Management: create a credential (tenant carried in `attributes`). Returns its id. */
-    createCredential(data: {
-        id?: string;
-        name: string;
-        type: string;
-        data: Record<string, unknown>;
-        attributes?: ResourceAttributes<'credential'>;
-    }): Promise<string>;
-    /** Management: fetch a credential by id — never the secret `data`. */
-    getCredential(id: string): Promise<CredentialRecord | null>;
-    /** Management: list credentials matching the caller's `filter` (redacted — no secret). */
-    listCredentials(filter: TFilter): Promise<CredentialRecord[]>;
-    /** Management: delete a credential by id. */
-    deleteCredential(id: string): Promise<void>;
     /**
-     * Resolution (execution path, no caller): fetch a secret for the running
-     * workflow by its logical `name`. `scope` is the workflow's own typed
-     * `attributes` — the resource carries its own security context.
+     * List all credentials in the workspace, returning safe summaries only.
+     *
+     * - Ordered by credential name.
+     * - Includes both `ACTIVE` and `REVOKED` credentials.
+     * - NEVER selects, decrypts, or returns stored values.
+     *
+     * @param filter - Host-defined visibility filter for the authenticated caller.
+     * @param page   - Optional database-level pagination.
+     * @returns Array of safe credential summaries (no `values` field).
      */
-    resolveCredential(scope: ResourceAttributes<'workflow'>, name: string): Promise<{
-        type: string;
-        data: Record<string, unknown>;
-    } | null>;
-    /** Resolution (execution path): the running workflow's credentials, for trigger pre-resolution. */
-    listTenantCredentials(scope: ResourceAttributes<'workflow'>): Promise<Array<{
-        name: string;
-        type: string;
-    }>>;
+    listCredentials(filter: TFilter, page?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<CredentialListItem[]>;
+    /**
+     * Create a new credential.
+     *
+     * - Insert only — never upsert. Duplicate names must be rejected by
+     *   the implementation (the caller may translate this to a `409`).
+     * - Sets both `createdAt` and `updatedAt` to the current time.
+     * - Status is always `ACTIVE` on creation.
+     *
+     * @param attributes - Host-defined credential scope and actor attributes.
+     * @param input     - Validated create input: `name`, `authType`, `values`.
+     * @returns The safe summary of the newly created credential.
+     */
+    createCredential(attributes: ResourceAttributes<'credential'>, input: CreateCredentialInput): Promise<CredentialSummary>;
+    /**
+     * Completely replace the stored values of an existing credential.
+     *
+     * - Does NOT decrypt old values — the new values replace the encrypted
+     *   blob entirely.
+     * - Validates the new complete value object using the STORED auth type
+     *   (the client cannot change the auth type).
+     * - Preserves `createdAt` and sets `updatedAt` to the current time.
+     * - Must reject if the credential is `REVOKED` (return `null` or throw,
+     *   depending on implementation convention).
+     *
+     * @param attributes - Host-defined credential scope and actor attributes.
+     * @param name      - The credential name (from the URL path).
+     * @param values    - The complete replacement value set (validated
+     *                    against the stored auth type's schema).
+     * @returns The safe summary of the updated credential, or `null` if
+     *          the credential was not found or is revoked.
+     */
+    replaceCredentialValues(attributes: ResourceAttributes<'credential'>, name: string, values: AuthSpecificValues): Promise<CredentialSummary | null>;
+    /**
+     * Revoke a credential — terminal transition from ACTIVE to REVOKED.
+     *
+     * - Preserve `createdAt`.
+     * - Sets `status` to `REVOKED`.
+     * - Sets `updatedAt` to the current time.
+     * - Never deletes the row — the credential remains visible.
+     * - If the credential is already revoked, return the existing summary
+     *   WITHOUT changing the original revocation identity/time (idempotent).
+     *
+     * @param attributes - Host-defined credential scope and actor attributes.
+     * @param name      - The credential name (from the URL path).
+     * @returns The safe summary of the revoked credential, or `null` if
+     *          the credential was not found.
+     */
+    revokeCredential(attributes: ResourceAttributes<'credential'>, name: string): Promise<CredentialSummary | null>;
+    /**
+     * Resolve a credential for execution-time use.
+     *
+     * This is the ONLY method that decrypts and returns stored values.
+     *
+     * - During execution, scope by the running workflow and credential name.
+     * - A raw workflow-attribute scope is also accepted for server-side
+     *   credential testing, where no workflow is running.
+     * - Return `null` for missing credentials.
+     * - Return `null` for revoked credentials — the executor uses this
+     *   to fail before making an external request.
+     * - Decrypt values, validate the decrypted JSON against the stored
+     *   auth type's schema, and return the in-memory `ResolvedCredential`.
+     *
+     * @param workflowOrAttributes - The running workflow, or host-defined scope
+     *                               attributes for a non-execution test request.
+     * @param name                 - The selected credential name.
+     * @returns The decrypted, validated credential, or `null` if the
+     *          credential is missing or revoked.
+     */
+    resolveCredential(workflowOrAttributes: WorkflowContext['workflow'] | ResourceAttributes<'workflow'>, name: string): Promise<ResolvedCredential | null>;
     /** Store a webhook path+secret for a workflow. */
     storeWebhookPath(workflowId: string, path: string, secret: string): Promise<void>;
     /** Remove the webhook registration for a workflow. */

package/dist/persistence/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/persistence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1G,UAAU,EAAE,KAAK,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;IACH,cAAc,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5G,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,oFAAoF;IACpF,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;yBAEqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnD,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qEAAqE;IACrE,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAID;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB,CAAC,OAAO;IAGzC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAExD,6EAA6E;IAC7E,aAAa,CACX,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B;;;OAGG;IACH,sBAAsB,CACpB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3F;;;;;OAKG;IACH,mBAAmB,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B,0EAA0E;IAC1E,cAAc,CAAC,IAAI,EAAE;QACnB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,2EAA2E;QAC3E,QAAQ,EAAE,MAAM,CAAC;QACjB,0EAA0E;QAC1E,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;KAC7C,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,8CAA8C;IAC9C,cAAc,CACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,2CAA2C;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEpD,mDAAmD;IACnD,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEtD;;;;;OAKG;IACH,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D,uDAAuD;IACvD,YAAY,CAAC,IAAI,EAAE;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,qEAAqE;QACrE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,0EAA0E;QAC1E,UAAU,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;KAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F,kEAAkE;IAClE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIxC,eAAe,CAAC,IAAI,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,uCAAuC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,0DAA0D;QAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,YAAY,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC;;;;OAIG;IACH,cAAc,CACZ,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;QACN,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC;QAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE9D,YAAY,CAAC,CACX,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1D,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAEvG,2EAA2E;IAC3E,mBAAmB,CAAC,CAClB,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAInC,iBAAiB,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAExC,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,kBAAkB,CAAC;KAChC,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB,UAAU,CACR,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAExD,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAI9B,UAAU,CACR,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,QAAQ,GAAG,kBAAkB,GAAG,WAAW,CAAC,CAAC;IAIxD,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjE,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,IAAI,GACX,OAAO,CACR,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CACnE,CAAC;IAWF,wFAAwF;IACxF,gBAAgB,CAAC,IAAI,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,sEAAsE;IACtE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAE5D,0FAA0F;IAC1F,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE9D,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C;;;;OAIG;IACH,iBAAiB,CACf,KAAK,EAAE,kBAAkB,CAAC,UAAU,CAAC,EACrC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEnE,mGAAmG;IACnG,qBAAqB,CACnB,KAAK,EAAE,kBAAkB,CAAC,UAAU,CAAC,GACpC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAIlD,kDAAkD;IAClD,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,sDAAsD;IACtD,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD,wDAAwD;IACxD,gBAAgB,CACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAIjC,qDAAqD;IACrD,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,sEAAsE;IACtE,gBAAgB,CACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAIjC;;;;;OAKG;IACH,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;;OAIG;IACH,2BAA2B,CACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE1C;;;OAGG;IACH,mBAAmB,CACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE1C;;;OAGG;IACH,sBAAsB,CACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC;;;;OAIG;IACH,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;WAKG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CACN,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/persistence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,0BAA0B,CAAC;AAIlC,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1G,UAAU,EAAE,KAAK,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;IACH,cAAc,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5G,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,oFAAoF;IACpF,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;yBAEqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnD,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qEAAqE;IACrE,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAID;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB,CAAC,OAAO;IAGzC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAExD,6EAA6E;IAC7E,aAAa,CACX,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B;;;OAGG;IACH,sBAAsB,CACpB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3F;;;;;OAKG;IACH,mBAAmB,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B,0EAA0E;IAC1E,cAAc,CAAC,IAAI,EAAE;QACnB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,2EAA2E;QAC3E,QAAQ,EAAE,MAAM,CAAC;QACjB,0EAA0E;QAC1E,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;KAC7C,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,8CAA8C;IAC9C,cAAc,CACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,2CAA2C;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEpD,mDAAmD;IACnD,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEtD;;;;;OAKG;IACH,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D,uDAAuD;IACvD,YAAY,CAAC,IAAI,EAAE;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,qEAAqE;QACrE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,0EAA0E;QAC1E,UAAU,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;KAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F,kEAAkE;IAClE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIxC,eAAe,CAAC,IAAI,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,uCAAuC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,0DAA0D;QAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpB,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,YAAY,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC;;;;OAIG;IACH,cAAc,CACZ,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;QACN,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC;QAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE9D,YAAY,CAAC,CACX,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1D,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAEvG,2EAA2E;IAC3E,mBAAmB,CAAC,CAClB,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAInC,iBAAiB,CACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAExC,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,kBAAkB,CAAC;KAChC,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjB,UAAU,CACR,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAExD,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAI9B,UAAU,CACR,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,QAAQ,GAAG,kBAAkB,GAAG,WAAW,CAAC,CAAC;IAIxD,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIjE,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,IAAI,GACX,OAAO,CACR,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CACnE,CAAC;IAIF;;;;;;;;;;OAUG;IACH,eAAe,CACb,MAAM,EAAE,OAAO,EACf,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEjC;;;;;;;;;;;OAWG;IACH,gBAAgB,CACd,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAC5C,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAC5C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAErC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CACd,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAC5C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CACf,oBAAoB,EAChB,eAAe,CAAC,UAAU,CAAC,GAC3B,kBAAkB,CAAC,UAAU,CAAC,EAClC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAItC,kDAAkD;IAClD,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,sDAAsD;IACtD,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD,wDAAwD;IACxD,gBAAgB,CACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAIjC,qDAAqD;IACrD,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,sEAAsE;IACtE,gBAAgB,CACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAIjC;;;;;OAKG;IACH,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;;OAIG;IACH,2BAA2B,CACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE1C;;;OAGG;IACH,mBAAmB,CACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE1C;;;OAGG;IACH,sBAAsB,CACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC;;;;OAIG;IACH,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;WAKG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CACN,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C"}

package/dist/router/workflow-router.d.ts

@@ -7,7 +7,9 @@
  *
  * Usage with Express:
  * ```ts
- * const routes = createWorkflowRouter(runtime, { authenticate });
+ * const routes = createWorkflowRouter(runtime, {
+ *   authenticate,
+ * });
  * for (const route of routes) {
  *   const handler = async (req, res) => {
  *     const result = await route.handler(

package/dist/router/workflow-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-router.d.ts","sourceRoot":"","sources":["../../src/router/workflow-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAA+B,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAyI3G,wBAAgB,oBAAoB,CAAC,IAAI,GAAG,WAAW,EAGrD,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAEnC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GACzB,eAAe,CAAC,IAAI,CAAC,EAAE,CAktCzB"}
+{"version":3,"file":"workflow-router.d.ts","sourceRoot":"","sources":["../../src/router/workflow-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAA+B,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA4J3G,wBAAgB,oBAAoB,CAAC,IAAI,GAAG,WAAW,EAGrD,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAEnC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GACzB,eAAe,CAAC,IAAI,CAAC,EAAE,CAk6CzB"}

package/dist/router/workflow-router.js

@@ -7,7 +7,9 @@
  *
  * Usage with Express:
  * ```ts
- * const routes = createWorkflowRouter(runtime, { authenticate });
+ * const routes = createWorkflowRouter(runtime, {
+ *   authenticate,
+ * });
  * for (const route of routes) {
  *   const handler = async (req, res) => {
  *     const result = await route.handler(
@@ -28,6 +30,7 @@ import { getAvailableContext } from '../engine/available-context.js';
 import { isExecutable } from '../common/executable-check.js';
 import { createEventChannel } from '../runtime/execution-event-bus.js';
 import { AccessDeniedError, ResourceNotFoundError } from '../authz/default.js';
+import { applyResolvedCredentialAuth, CredentialNameSchema, CredentialAuthSchema, validateCredentialValues, } from '../common/credentials.js';
 // ─── Helpers ───
 function ok(body) {
     return { status: 200, body };
@@ -41,6 +44,13 @@ function notFound(msg) {
 function badRequest(msg) {
     return { status: 400, body: { error: msg } };
 }
+// Step 12: 409 Conflict — used by the credential routes for two distinct
+// "the resource is in a state that forbids this operation" cases:
+//   - creating a credential whose name already exists, and
+//   - replacing values on a credential that has been REVOKED.
+function conflict(msg) {
+    return { status: 409, body: { error: msg } };
+}
 function error(status, msg) {
     return { status, body: { error: msg } };
 }
@@ -550,7 +560,13 @@ _opts) {
                     body: bytes,
                     headers: {
                         'Content-Type': mime,
-                        'Content-Disposition': `inline; filename="${encodeURIComponent(name)}"`,
+                        // Force download; never inline-render. An uploaded HTML/SVG must not
+                        // execute script in the app origin (stored XSS). nosniff stops the
+                        // browser re-interpreting the type; the CSP neuters any script if a
+                        // browser renders it regardless.
+                        'Content-Disposition': `attachment; filename="${encodeURIComponent(name)}"`,
+                        'X-Content-Type-Options': 'nosniff',
+                        'Content-Security-Policy': "default-src 'none'; sandbox",
                         'Content-Length': String(bytes.byteLength),
                     },
                 };
@@ -867,67 +883,229 @@ _opts) {
             }
         },
     });
-    // ─── Credentials ───
+    const findCredential = async (auth, name) => {
+        const all = await runtime.listCredentials(asCtx(auth));
+        return all.find((credential) => credential.summary.name === name);
+    };
+    // ── GET /credentials ──
+    // Returns a page of visible credential summaries (ACTIVE and REVOKED).
+    // Never decrypts or returns stored values.
     routes.push({
         method: 'GET',
         path: '/credentials',
-        handler: async (_req, auth) => {
-            const credentials = await runtime.listCredentials(asCtx(auth));
-            return ok({ credentials });
-        },
-    });
-    routes.push({
-        method: 'GET',
-        path: '/credentials/:id',
         handler: async (req, auth) => {
-            const id = req.params['id'];
-            if (!id)
-                return badRequest('Missing credential id');
-            const cred = await runtime.getCredential(asCtx(auth), id);
-            if (!cred)
-                return notFound(`Credential ${id} not found`);
-            return ok(cred);
+            const q = req.query;
+            const page = {};
+            if (typeof q['limit'] === 'string')
+                page.limit = Number(q['limit']);
+            if (typeof q['offset'] === 'string')
+                page.offset = Number(q['offset']);
+            const credentials = await runtime.listCredentials(asCtx(auth), page);
+            return ok({ credentials });
         },
     });
+    // ── POST /credentials ──
+    // Create a new credential. Strictly validates name and the discriminated
+    // authType/values pair.
     routes.push({
         method: 'POST',
         path: '/credentials',
         handler: async (req, auth) => {
+            if (auth === null) {
+                return error(401, 'Authentication required to create a credential');
+            }
+            const capabilities = await runtime.capabilities(auth);
+            if (!capabilities.includes('credential:manage')) {
+                return error(403, 'Not permitted to create credentials');
+            }
             const body = req.body;
-            if (!body || !body['name'] || !body['type'] || !body['data']) {
-                return badRequest('Body must contain "name", "type", and "data"');
+            if (!body)
+                return badRequest('Request body is required');
+            const nameResult = CredentialNameSchema.safeParse(body['name']);
+            if (!nameResult.success) {
+                return badRequest('Invalid or missing "name"');
+            }
+            const credentialAuthResult = CredentialAuthSchema.safeParse({
+                authType: body['authType'],
+                values: body['values'],
+            });
+            if (!credentialAuthResult.success) {
+                return badRequest('Invalid or mismatched "authType" and "values"');
             }
+            const input = {
+                name: nameResult.data,
+                ...credentialAuthResult.data,
+            };
             try {
-                const cred = await runtime.createCredential(asCtx(auth), {
-                    name: body['name'],
-                    type: body['type'],
-                    data: body['data'],
-                    attributes: body['attributes'],
-                });
+                const cred = await runtime.createCredential(body['attributes'], input);
                 return created(cred);
             }
             catch (err) {
-                if (err instanceof AccessDeniedError)
-                    throw err;
-                return error(400, err instanceof Error ? err.message : 'Create failed');
+                const msg = err instanceof Error ? err.message : String(err);
+                if (/already exists/i.test(msg)) {
+                    return conflict(`Credential "${input.name}" already exists`);
+                }
+                throw err;
             }
         },
     });
+    // ── PUT /credentials/:name ──
+    // Completely replace an existing credential's values. Name and auth type are
+    // immutable — the new values are validated against the STORED auth type.
     routes.push({
-        method: 'DELETE',
-        path: '/credentials/:id',
+        method: 'PUT',
+        path: '/credentials/:name',
         handler: async (req, auth) => {
-            const id = req.params['id'];
-            if (!id)
-                return badRequest('Missing credential id');
+            if (auth === null) {
+                return error(401, 'Authentication required to update a credential');
+            }
+            const name = req.params['name'];
+            if (!name)
+                return badRequest('Missing credential name');
+            const body = req.body;
+            if (!body || body['values'] === undefined) {
+                return badRequest('Body must contain "values"');
+            }
+            const credential = await findCredential(auth, name);
+            if (!credential) {
+                return notFound(`Credential "${name}" not found`);
+            }
+            if (!credential.permittedActions?.includes('credential:manage')) {
+                return error(403, `Not permitted to manage credential "${name}"`);
+            }
+            const { summary } = credential;
+            if (summary.status === 'REVOKED') {
+                return conflict(`Credential "${name}" is revoked and cannot be updated`);
+            }
+            let values;
             try {
-                await runtime.deleteCredential(asCtx(auth), id);
-                return { status: 204, body: undefined };
+                values = validateCredentialValues(summary.authType, body['values']);
             }
-            catch (err) {
-                if (err instanceof AccessDeniedError)
-                    throw err;
-                return notFound(err instanceof Error ? err.message : 'Delete failed');
+            catch {
+                return badRequest(`Invalid values for auth type "${summary.authType}"`);
+            }
+            const updated = await runtime.replaceCredentialValues(body['attributes'], name, values);
+            // Defensive: a concurrent revoke between our lookup and the write would
+            // make the adapter return null. Treat that as a 409.
+            if (!updated) {
+                return conflict(`Credential "${name}" could not be updated`);
+            }
+            return ok(updated);
+        },
+    });
+    // ── POST /credentials/:name/revoke ──
+    // Revoke a credential (terminal ACTIVE → REVOKED). No request body. Idempotent
+    // — revoking an already-revoked credential returns its existing summary
+    // unchanged.
+    routes.push({
+        method: 'POST',
+        path: '/credentials/:name/revoke',
+        handler: async (req, auth) => {
+            if (auth === null) {
+                return error(401, 'Authentication required to revoke a credential');
+            }
+            const name = req.params['name'];
+            if (!name)
+                return badRequest('Missing credential name');
+            const credential = await findCredential(auth, name);
+            if (!credential) {
+                return notFound(`Credential "${name}" not found`);
+            }
+            if (!credential.permittedActions?.includes('credential:manage')) {
+                return error(403, `Not permitted to manage credential "${name}"`);
+            }
+            const body = (req.body ?? {});
+            const revoked = await runtime.revokeCredential(body['attributes'], name);
+            if (!revoked) {
+                return notFound(`Credential "${name}" not found`);
+            }
+            return ok(revoked);
+        },
+    });
+    // ── POST /credentials/:name/test ──
+    // Make a one-off outbound request with this credential's auth applied, so the
+    // user can verify the credential works. The secret is resolved + applied
+    // SERVER-SIDE (via the same helper the HTTP step uses) and never returned to
+    // the browser. Returns a redacted response summary.
+    routes.push({
+        method: 'POST',
+        path: '/credentials/:name/test',
+        handler: async (req, auth) => {
+            if (auth === null) {
+                return error(401, 'Authentication required to test a credential');
+            }
+            const name = req.params['name'];
+            if (!name)
+                return badRequest('Missing credential name');
+            const body = (req.body ?? {});
+            if (!body.url || typeof body.url !== 'string') {
+                return badRequest('Body must contain a "url"');
+            }
+            let url;
+            try {
+                url = new URL(body.url);
+            }
+            catch {
+                return badRequest('Invalid URL');
+            }
+            // Resolve + decrypt the credential (workspace-scoped). Null = missing or
+            // revoked — only ACTIVE credentials can be tested.
+            const cred = await runtime.resolveCredential(body.attributes, name);
+            if (!cred) {
+                return conflict(`Credential "${name}" not found or revoked`);
+            }
+            const method = (body.method ?? 'GET').toUpperCase();
+            const headers = new Headers();
+            if (body.headers) {
+                for (const [k, v] of Object.entries(body.headers)) {
+                    if (k)
+                        headers.set(k, String(v));
+                }
+            }
+            // Apply the credential's auth exactly as the HTTP step does at execution.
+            try {
+                applyResolvedCredentialAuth(headers, cred);
+            }
+            catch (e) {
+                return ok({
+                    ok: false,
+                    error: e instanceof Error ? e.message : 'Failed to apply credential',
+                });
+            }
+            const init = { method, headers };
+            if (body.body && !['GET', 'HEAD'].includes(method)) {
+                init.body = body.body;
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 15_000);
+            init.signal = controller.signal;
+            const t0 = Date.now();
+            try {
+                const resp = await fetch(url.toString(), init);
+                const text = await resp.text();
+                const respHeaders = {};
+                resp.headers.forEach((v, k) => {
+                    respHeaders[k] = v;
+                });
+                clearTimeout(timer);
+                return ok({
+                    ok: resp.ok,
+                    status: resp.status,
+                    statusText: resp.statusText,
+                    durationMs: Date.now() - t0,
+                    headers: respHeaders,
+                    // Cap the returned body so a huge response can't bloat the UI.
+                    bodyText: text.length > 20_000 ? text.slice(0, 20_000) + '…' : text,
+                });
+            }
+            catch (e) {
+                clearTimeout(timer);
+                const msg = e instanceof DOMException && e.name === 'AbortError'
+                    ? 'Request timed out after 15s'
+                    : e instanceof Error
+                        ? e.message
+                        : String(e);
+                return ok({ ok: false, error: msg, durationMs: Date.now() - t0 });
             }
         },
     });