@xyne/workflow-sdk 3.2.29 → 3.2.32

package/dist/steps/builtin/http-request.step.d.ts

@@ -19,14 +19,11 @@
  *
  * ## Auth
  *
- * Two auth mechanisms, used together or independently:
- *
- * 1. **Config-level `auth`** — for tokens from variable refs
- *    `{{ steps.login.output.token }}`. Fully typed discriminated union.
- *
- * 2. **Credential slots** — for stored secrets from the credential vault.
- *    Resolved by the executor at runtime, injected via `ctx.credentials`.
- *    Config-level auth takes precedence when both are present.
+ * The optional `credentialName` selects a stored credential from the vault.
+ * Before this step runs, the executor resolves that selection and injects the
+ * validated value through `ctx.credentials`. The step
+ * receives the resolved value and applies it after user-provided headers, so
+ * managed authentication cannot be accidentally overridden.
  *
  * ## Response shape
  *
@@ -43,65 +40,9 @@
  */
 import { z } from 'zod';
 import { BaseActionStep } from '../base-step.js';
-import type { StepExecutionContext, CredentialSlot, CredentialTypeSchema } from '../base-step.js';
+import type { StepExecutionContext } from '../base-step.js';
 import { BuiltinStepType } from '../../types/known-types.js';
 import type { StepCategory } from '../../types/categories.js';
-declare const HttpAuthSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
-    type: z.ZodLiteral<"none">;
-}, "strip", z.ZodTypeAny, {
-    type: "none";
-}, {
-    type: "none";
-}>, z.ZodObject<{
-    type: z.ZodLiteral<"bearer">;
-    token: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    type: "bearer";
-    token: string;
-}, {
-    type: "bearer";
-    token: string;
-}>, z.ZodObject<{
-    type: z.ZodLiteral<"basic">;
-    username: z.ZodString;
-    password: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    type: "basic";
-    password: string;
-    username: string;
-}, {
-    type: "basic";
-    password: string;
-    username: string;
-}>, z.ZodObject<{
-    type: z.ZodLiteral<"apiKey">;
-    key: z.ZodString;
-    name: z.ZodDefault<z.ZodString>;
-    in: z.ZodDefault<z.ZodEnum<["header", "query"]>>;
-}, "strip", z.ZodTypeAny, {
-    type: "apiKey";
-    name: string;
-    key: string;
-    in: "header" | "query";
-}, {
-    type: "apiKey";
-    key: string;
-    name?: string | undefined;
-    in?: "header" | "query" | undefined;
-}>, z.ZodObject<{
-    type: z.ZodLiteral<"customHeader">;
-    name: z.ZodString;
-    value: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    value: string;
-    type: "customHeader";
-    name: string;
-}, {
-    value: string;
-    type: "customHeader";
-    name: string;
-}>]>;
-export type HttpAuth = z.infer<typeof HttpAuthSchema>;
 export declare const HttpRawContentTypeSchema: z.ZodEnum<["json", "xml", "html", "text", "javascript", "custom"]>;
 export type HttpRawContentType = z.infer<typeof HttpRawContentTypeSchema>;
 export declare const HttpBodySchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
@@ -322,61 +263,7 @@ export type HttpMethod = z.infer<typeof HttpMethodSchema>;
 export declare const HttpRequestStepConfigSchema: z.ZodObject<{
     url: z.ZodString;
     method: z.ZodDefault<z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]>>;
-    auth: z.ZodDefault<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
-        type: z.ZodLiteral<"none">;
-    }, "strip", z.ZodTypeAny, {
-        type: "none";
-    }, {
-        type: "none";
-    }>, z.ZodObject<{
-        type: z.ZodLiteral<"bearer">;
-        token: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        type: "bearer";
-        token: string;
-    }, {
-        type: "bearer";
-        token: string;
-    }>, z.ZodObject<{
-        type: z.ZodLiteral<"basic">;
-        username: z.ZodString;
-        password: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        type: "basic";
-        password: string;
-        username: string;
-    }, {
-        type: "basic";
-        password: string;
-        username: string;
-    }>, z.ZodObject<{
-        type: z.ZodLiteral<"apiKey">;
-        key: z.ZodString;
-        name: z.ZodDefault<z.ZodString>;
-        in: z.ZodDefault<z.ZodEnum<["header", "query"]>>;
-    }, "strip", z.ZodTypeAny, {
-        type: "apiKey";
-        name: string;
-        key: string;
-        in: "header" | "query";
-    }, {
-        type: "apiKey";
-        key: string;
-        name?: string | undefined;
-        in?: "header" | "query" | undefined;
-    }>, z.ZodObject<{
-        type: z.ZodLiteral<"customHeader">;
-        name: z.ZodString;
-        value: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        type: "customHeader";
-        name: string;
-    }, {
-        value: string;
-        type: "customHeader";
-        name: string;
-    }>]>>;
+    credentialName: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodString]>>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     queryParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     body: z.ZodDefault<z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
@@ -629,28 +516,9 @@ export declare const HttpRequestStepConfigSchema: z.ZodObject<{
             }[] | undefined;
         }[] | undefined;
     };
-    timeoutMs: number;
     url: string;
+    timeoutMs: number;
     method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
-    auth: {
-        type: "none";
-    } | {
-        type: "bearer";
-        token: string;
-    } | {
-        type: "basic";
-        password: string;
-        username: string;
-    } | {
-        type: "apiKey";
-        name: string;
-        key: string;
-        in: "header" | "query";
-    } | {
-        value: string;
-        type: "customHeader";
-        name: string;
-    };
     response: {
         type: "json";
         bodySchema?: Record<string, unknown> | undefined;
@@ -666,6 +534,7 @@ export declare const HttpRequestStepConfigSchema: z.ZodObject<{
     };
     followRedirects: boolean;
     headers?: Record<string, string> | undefined;
+    credentialName?: string | undefined;
     queryParams?: Record<string, string> | undefined;
 }, {
     url: string;
@@ -709,25 +578,7 @@ export declare const HttpRequestStepConfigSchema: z.ZodObject<{
     } | undefined;
     timeoutMs?: number | undefined;
     method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | undefined;
-    auth?: {
-        type: "none";
-    } | {
-        type: "bearer";
-        token: string;
-    } | {
-        type: "basic";
-        password: string;
-        username: string;
-    } | {
-        type: "apiKey";
-        key: string;
-        name?: string | undefined;
-        in?: "header" | "query" | undefined;
-    } | {
-        value: string;
-        type: "customHeader";
-        name: string;
-    } | undefined;
+    credentialName?: string | undefined;
     queryParams?: Record<string, string> | undefined;
     response?: {
         type: "json";
@@ -777,61 +628,7 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
     readonly configSchema: z.ZodObject<{
         url: z.ZodString;
         method: z.ZodDefault<z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]>>;
-        auth: z.ZodDefault<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
-            type: z.ZodLiteral<"none">;
-        }, "strip", z.ZodTypeAny, {
-            type: "none";
-        }, {
-            type: "none";
-        }>, z.ZodObject<{
-            type: z.ZodLiteral<"bearer">;
-            token: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            type: "bearer";
-            token: string;
-        }, {
-            type: "bearer";
-            token: string;
-        }>, z.ZodObject<{
-            type: z.ZodLiteral<"basic">;
-            username: z.ZodString;
-            password: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            type: "basic";
-            password: string;
-            username: string;
-        }, {
-            type: "basic";
-            password: string;
-            username: string;
-        }>, z.ZodObject<{
-            type: z.ZodLiteral<"apiKey">;
-            key: z.ZodString;
-            name: z.ZodDefault<z.ZodString>;
-            in: z.ZodDefault<z.ZodEnum<["header", "query"]>>;
-        }, "strip", z.ZodTypeAny, {
-            type: "apiKey";
-            name: string;
-            key: string;
-            in: "header" | "query";
-        }, {
-            type: "apiKey";
-            key: string;
-            name?: string | undefined;
-            in?: "header" | "query" | undefined;
-        }>, z.ZodObject<{
-            type: z.ZodLiteral<"customHeader">;
-            name: z.ZodString;
-            value: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            value: string;
-            type: "customHeader";
-            name: string;
-        }, {
-            value: string;
-            type: "customHeader";
-            name: string;
-        }>]>>;
+        credentialName: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodString]>>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         queryParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         body: z.ZodDefault<z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
@@ -1084,28 +881,9 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
                 }[] | undefined;
             }[] | undefined;
         };
-        timeoutMs: number;
         url: string;
+        timeoutMs: number;
         method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
-        auth: {
-            type: "none";
-        } | {
-            type: "bearer";
-            token: string;
-        } | {
-            type: "basic";
-            password: string;
-            username: string;
-        } | {
-            type: "apiKey";
-            name: string;
-            key: string;
-            in: "header" | "query";
-        } | {
-            value: string;
-            type: "customHeader";
-            name: string;
-        };
         response: {
             type: "json";
             bodySchema?: Record<string, unknown> | undefined;
@@ -1121,6 +899,7 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
         };
         followRedirects: boolean;
         headers?: Record<string, string> | undefined;
+        credentialName?: string | undefined;
         queryParams?: Record<string, string> | undefined;
     }, {
         url: string;
@@ -1164,25 +943,7 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
         } | undefined;
         timeoutMs?: number | undefined;
         method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | undefined;
-        auth?: {
-            type: "none";
-        } | {
-            type: "bearer";
-            token: string;
-        } | {
-            type: "basic";
-            password: string;
-            username: string;
-        } | {
-            type: "apiKey";
-            key: string;
-            name?: string | undefined;
-            in?: "header" | "query" | undefined;
-        } | {
-            value: string;
-            type: "customHeader";
-            name: string;
-        } | undefined;
+        credentialName?: string | undefined;
         queryParams?: Record<string, string> | undefined;
         response?: {
             type: "json";
@@ -1229,13 +990,10 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
     }>;
     readonly category: StepCategory;
     readonly icon = "globe";
-    /**
-     * Credential slots — fallback auth when config.auth is 'none'.
-     * Resolved by the executor from the credential vault.
-     */
-    readonly credentialSlots: readonly CredentialSlot[];
-    /** Credential type schemas — defines what fields each credential type needs for UI forms. */
-    readonly credentialTypeSchemas: readonly CredentialTypeSchema[];
+    readonly credentialSlots: readonly [{
+        readonly name: "credentialName";
+        readonly required: false;
+    }];
     decorateConfigSchema(jsonSchema: Record<string, unknown>): Record<string, unknown>;
     /**
      * Per-instance output schema. When the author's `response` config provides
@@ -1248,9 +1006,6 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
     redactInput(input: Record<string, unknown>): Record<string, unknown>;
     execute(config: HttpRequestStepConfig, ctx: StepExecutionContext): Promise<HttpRequestStepOutput>;
     private buildUrl;
-    private applyAuth;
-    private applyConfigAuth;
-    private applyCredentialAuth;
     /**
      * Encode the request body for the given mode. Mutates `headers` to set
      * the appropriate Content-Type unless the user already supplied one.
@@ -1262,5 +1017,4 @@ export declare class HttpRequestStep extends BaseActionStep<typeof HttpRequestSt
     private parseResponseBody;
     private autoParseBody;
 }
-export {};
 //# sourceMappingURL=http-request.step.d.ts.map

package/dist/steps/builtin/http-request.step.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-request.step.d.ts","sourceRoot":"","sources":["../../../src/steps/builtin/http-request.step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAiC9D,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMlB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAYtD,eAAO,MAAM,wBAAwB,oEAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AA0C1E,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AA2BtD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAI1D,eAAO,MAAM,gBAAgB,yEAE3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;;;OAOG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAeD,qBAAa,eAAgB,SAAQ,cAAc,CACjD,OAAO,2BAA2B,EAClC,qBAAqB,CACtB;IACC,SAAkB,IAAI,gCAAgC;IACtD,SAAkB,IAAI,kBAAkB;IACxC,SAAkB,WAAW,yCAAyC;IACtE,SAAkB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAA+B;IAC7D,SAAkB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;OAA+B;IAC7D,SAAkB,QAAQ,EAAE,YAAY,CAAiB;IACzD,SAAkB,IAAI,WAAW;IAEjC;;;OAGG;IACH,SAAkB,eAAe,EAAE,SAAS,cAAc,EAAE,CAE1D;IAEF,6FAA6F;IAC7F,SAAkB,qBAAqB,EAAE,SAAS,oBAAoB,EAAE,CAiCtE;IAEO,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA8B3F;;;;;OAKG;IACM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAsB1F,OAAO,CAAC,mBAAmB;IAkBlB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAkB9D,OAAO,CACpB,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAgGjC,OAAO,CAAC,QAAQ;IAehB,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,eAAe;IAuBvB,OAAO,CAAC,mBAAmB;IA4C3B;;;;;OAKG;YACW,UAAU;IA+DxB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IAqBzB,OAAO,CAAC,aAAa;CAiBtB"}
+{"version":3,"file":"http-request.step.d.ts","sourceRoot":"","sources":["../../../src/steps/builtin/http-request.step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAkB9D,eAAO,MAAM,wBAAwB,oEAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AA0C1E,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AA2BtD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAI1D,eAAO,MAAM,gBAAgB,yEAE3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAetC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAIhF,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;;;OAOG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAeD,qBAAa,eAAgB,SAAQ,cAAc,CACjD,OAAO,2BAA2B,EAClC,qBAAqB,CACtB;IACC,SAAkB,IAAI,gCAAgC;IACtD,SAAkB,IAAI,kBAAkB;IACxC,SAAkB,WAAW,yCAAyC;IACtE,SAAkB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAA+B;IAC7D,SAAkB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;OAA+B;IAC7D,SAAkB,QAAQ,EAAE,YAAY,CAAiB;IACzD,SAAkB,IAAI,WAAW;IAKjC,SAAkB,eAAe;;;OAEtB;IAEF,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqC3F;;;;;OAKG;IACM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAsB1F,OAAO,CAAC,mBAAmB;IAkBlB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAkB9D,OAAO,CACpB,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAuHjC,OAAO,CAAC,QAAQ;IAehB;;;;;OAKG;YACW,UAAU;IA+DxB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IAqBzB,OAAO,CAAC,aAAa;CAiBtB"}

package/dist/steps/builtin/http-request.step.js

@@ -19,14 +19,11 @@
  *
  * ## Auth
  *
- * Two auth mechanisms, used together or independently:
- *
- * 1. **Config-level `auth`** — for tokens from variable refs
- *    `{{ steps.login.output.token }}`. Fully typed discriminated union.
- *
- * 2. **Credential slots** — for stored secrets from the credential vault.
- *    Resolved by the executor at runtime, injected via `ctx.credentials`.
- *    Config-level auth takes precedence when both are present.
+ * The optional `credentialName` selects a stored credential from the vault.
+ * Before this step runs, the executor resolves that selection and injects the
+ * validated value through `ctx.credentials`. The step
+ * receives the resolved value and applies it after user-provided headers, so
+ * managed authentication cannot be accidentally overridden.
  *
  * ## Response shape
  *
@@ -44,38 +41,10 @@
 import { z } from 'zod';
 import { BaseActionStep } from '../base-step.js';
 import { BuiltinStepType } from '../../types/known-types.js';
+import { applyResolvedCredentialAuth, CredentialNameSchema, } from '../../common/credentials.js';
 import { AttachmentSchema, markAttachmentFields } from '../../common/attachment.js';
 import { variableRef } from '../../types/workflow-config.js';
-// ─── Auth schemas ───
-const HttpAuthNoneSchema = z.object({ type: z.literal('none') });
-const HttpAuthBearerSchema = z.object({
-    type: z.literal('bearer'),
-    token: z.string().min(1).describe('Bearer token value'),
-});
-const HttpAuthBasicSchema = z.object({
-    type: z.literal('basic'),
-    username: z.string().describe('Basic auth username'),
-    password: z.string().describe('Basic auth password'),
-});
-const HttpAuthApiKeySchema = z.object({
-    type: z.literal('apiKey'),
-    key: z.string().min(1).describe('API key value'),
-    name: z.string().default('x-api-key').describe('Header or query parameter name'),
-    in: z.enum(['header', 'query']).default('header').describe('Where to send the API key'),
-});
-const HttpAuthCustomHeaderSchema = z.object({
-    type: z.literal('customHeader'),
-    name: z.string().min(1).describe('Custom header name'),
-    value: z.string().min(1).describe('Custom header value'),
-});
-const HttpAuthSchema = z.discriminatedUnion('type', [
-    HttpAuthNoneSchema,
-    HttpAuthBearerSchema,
-    HttpAuthBasicSchema,
-    HttpAuthApiKeySchema,
-    HttpAuthCustomHeaderSchema,
-]);
-// ─── Body schemas (Postman-style) ───
+import { assertPublicHttpUrl } from './ssrf-guard.js';
 const RAW_CONTENT_TYPES = {
     json: 'application/json',
     xml: 'application/xml',
@@ -165,7 +134,7 @@ export const HttpMethodSchema = z.enum([
 export const HttpRequestStepConfigSchema = z.object({
     url: z.string().min(1).describe('Full URL including protocol (e.g. https://api.example.com/data)'),
     method: HttpMethodSchema.default('GET').describe('HTTP method'),
-    auth: HttpAuthSchema.default({ type: 'none' }).describe('Authentication method applied before custom headers'),
+    credentialName: variableRef(CredentialNameSchema.describe('Credential from the vault used to authenticate the request. The executor resolves it before this step runs.')).optional(),
     headers: z.record(z.string(), z.string()).optional().describe('Request headers as key-value pairs'),
     queryParams: z.record(z.string(), z.string()).optional().describe('Query parameters appended to URL'),
     body: HttpBodySchema.default({ mode: 'none' }).describe('Request body — ignored for GET/HEAD. Postman-style modes: none/raw/urlencoded/formdata/binary'),
@@ -193,49 +162,20 @@ export class HttpRequestStep extends BaseActionStep {
     outputSchema = HttpRequestStepOutputSchema;
     category = 'integration';
     icon = 'globe';
-    /**
-     * Credential slots — fallback auth when config.auth is 'none'.
-     * Resolved by the executor from the credential vault.
-     */
+    // The slot name is also the config field: the executor reads the selected
+    // name from `config.credentialName` and injects the resolved, validated value
+    // as `ctx.credentials.credentialName` before execute() is called.
     credentialSlots = [
-        { name: 'auth', types: ['bearer', 'basic', 'api_key', 'header'], required: false },
-    ];
-    /** Credential type schemas — defines what fields each credential type needs for UI forms. */
-    credentialTypeSchemas = [
-        {
-            type: 'bearer',
-            label: 'Bearer Token',
-            fields: [
-                { name: 'token', label: 'Token', type: 'password', required: true },
-            ],
-        },
-        {
-            type: 'basic',
-            label: 'Basic Auth',
-            fields: [
-                { name: 'username', label: 'Username', type: 'string', required: true },
-                { name: 'password', label: 'Password', type: 'password', required: true },
-            ],
-        },
-        {
-            type: 'api_key',
-            label: 'API Key',
-            fields: [
-                { name: 'key', label: 'API Key', type: 'password', required: true },
-                { name: 'headerName', label: 'Header Name', type: 'string', required: false, default: 'x-api-key' },
-                { name: 'in', label: 'Send In', type: 'select', required: false, options: ['header', 'query'], default: 'header' },
-            ],
-        },
-        {
-            type: 'header',
-            label: 'Custom Header',
-            fields: [
-                { name: 'name', label: 'Header Name', type: 'string', required: true },
-                { name: 'value', label: 'Header Value', type: 'password', required: true },
-            ],
-        },
+        { name: 'credentialName', required: false },
     ];
     decorateConfigSchema(jsonSchema) {
+        const rootProps = jsonSchema['properties'];
+        if (rootProps?.['credentialName']) {
+            rootProps['credentialName'] = {
+                ...rootProps['credentialName'],
+                format: 'credential-name',
+            };
+        }
         // The `bodySchema` field inside the discriminated `response` union should
         // render with the JSON Schema builder UI. The schema-form renderer walks
         // discriminator variants, so we tag the field within each variant that
@@ -329,19 +269,26 @@ export class HttpRequestStep extends BaseActionStep {
     async execute(config, ctx) {
         // Build URL with query params
         const url = this.buildUrl(config.url, config.queryParams);
-        // Build headers: auth first, then custom headers override
+        // Build headers: user headers FIRST, then managed credential auth LAST — so
+        // a conflicting manually-entered header can't override the selected
+        // credential's authentication.
         const headers = new Headers();
-        this.applyAuth(headers, url, config.auth, ctx.credentials);
         if (config.headers) {
             for (const [k, v] of Object.entries(config.headers)) {
                 headers.set(k, v);
             }
         }
-        // Build request
+        const credential = ctx.credentials['credentialName'];
+        if (credential) {
+            applyResolvedCredentialAuth(headers, credential);
+        }
+        // Build request. Redirects are followed manually (redirect: 'manual') so the
+        // SSRF guard re-checks every hop — native 'follow' would chase a redirect
+        // straight to a private / cloud-metadata address.
         const init = {
             method: config.method,
             headers,
-            redirect: config.followRedirects ? 'follow' : 'manual',
+            redirect: 'manual',
         };
         // Encode body for methods that support it.
         // GET/HEAD never carry a body even if the user configured one.
@@ -355,10 +302,27 @@ export class HttpRequestStep extends BaseActionStep {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), config.timeoutMs);
         init.signal = controller.signal;
+        const maxRedirects = config.followRedirects ? 5 : 0;
         const t0 = Date.now();
         let response;
         try {
-            response = await fetch(url.toString(), init);
+            let currentUrl = url.toString();
+            let hops = 0;
+            for (;;) {
+                // SSRF guard runs on the initial URL and on every redirect target.
+                await assertPublicHttpUrl(currentUrl);
+                response = await fetch(currentUrl, init);
+                const location = response.headers.get('location');
+                const isRedirectStatus = response.status >= 300 && response.status < 400;
+                if (!isRedirectStatus || location === null || hops >= maxRedirects)
+                    break;
+                hops += 1;
+                currentUrl = new URL(location, currentUrl).toString();
+                // A one-shot body (multipart/stream) can't be replayed on the next hop.
+                if (init.body instanceof FormData || init.body instanceof ReadableStream) {
+                    init.body = null;
+                }
+            }
         }
         catch (err) {
             clearTimeout(timer);
@@ -412,79 +376,6 @@ export class HttpRequestStep extends BaseActionStep {
         }
         return url;
     }
-    // ─── Auth ───
-    applyAuth(headers, url, auth, credentials) {
-        // Config-level auth takes precedence
-        if (auth.type !== 'none') {
-            this.applyConfigAuth(headers, url, auth);
-            return;
-        }
-        // Fall back to credential slot
-        this.applyCredentialAuth(headers, url, credentials);
-    }
-    applyConfigAuth(headers, url, auth) {
-        switch (auth.type) {
-            case 'bearer':
-                headers.set('authorization', `Bearer ${auth.token}`);
-                break;
-            case 'basic': {
-                const encoded = btoa(`${auth.username}:${auth.password}`);
-                headers.set('authorization', `Basic ${encoded}`);
-                break;
-            }
-            case 'apiKey':
-                if (auth.in === 'header') {
-                    headers.set(auth.name, auth.key);
-                }
-                else {
-                    url.searchParams.set(auth.name, auth.key);
-                }
-                break;
-            case 'customHeader':
-                headers.set(auth.name, auth.value);
-                break;
-        }
-    }
-    applyCredentialAuth(headers, url, credentials) {
-        const cred = credentials['auth'];
-        if (!cred)
-            return;
-        switch (cred.type) {
-            case 'bearer': {
-                const token = cred.data['token'];
-                if (token)
-                    headers.set('authorization', `Bearer ${token}`);
-                break;
-            }
-            case 'basic': {
-                const user = cred.data['username'] ?? '';
-                const pass = cred.data['password'] ?? '';
-                headers.set('authorization', `Basic ${btoa(`${user}:${pass}`)}`);
-                break;
-            }
-            case 'api_key': {
-                const headerName = cred.data['headerName'] ?? 'x-api-key';
-                const key = cred.data['key'];
-                const location = cred.data['in'] ?? 'header';
-                if (key) {
-                    if (location === 'query') {
-                        url.searchParams.set(headerName, key);
-                    }
-                    else {
-                        headers.set(headerName, key);
-                    }
-                }
-                break;
-            }
-            case 'header': {
-                const name = cred.data['name'];
-                const value = cred.data['value'];
-                if (name && value)
-                    headers.set(name, value);
-                break;
-            }
-        }
-    }
     // ─── Body encoding (Postman-style modes) ───
     /**
      * Encode the request body for the given mode. Mutates `headers` to set