@xyne/workflow-sdk 3.2.31 → 3.2.33

package/dist/common/credentials.d.ts

@@ -0,0 +1,258 @@
+import { z } from 'zod';
+import type { Action } from '../authz/types.js';
+import type { ResourceAttributes } from '../authz/attributes.js';
+export declare const CredentialStatusSchema: z.ZodEnum<["ACTIVE", "REVOKED"]>;
+export type CredentialStatus = z.infer<typeof CredentialStatusSchema>;
+export type CredentialFieldControl = 'password' | 'text' | 'url';
+export interface CredentialRegistryInputField {
+    readonly key: string;
+    readonly label: string;
+    readonly control: CredentialFieldControl;
+    /** Optional example hint shown as the input's placeholder. */
+    readonly placeholder?: string;
+}
+export type CredentialRegistryEntryField = CredentialRegistryInputField;
+interface CredentialRegistryEntryBase {
+    readonly label: string;
+    readonly fields: readonly CredentialRegistryEntryField[];
+}
+/**
+ * Bearer token values.
+ *
+ * Runtime: `Authorization: Bearer <token>` is added to the request.
+ */
+export declare const BearerValuesSchema: z.ZodObject<{
+    token: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    token: string;
+}, {
+    token: string;
+}>;
+export type BearerValues = z.infer<typeof BearerValuesSchema>;
+/**
+ * HTTP Basic authentication values.
+ *
+ * Runtime: `Authorization: Basic base64(username:password)` is added.
+ */
+export declare const BasicValuesSchema: z.ZodObject<{
+    username: z.ZodString;
+    password: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    password: string;
+    username: string;
+}, {
+    password: string;
+    username: string;
+}>;
+export type BasicValues = z.infer<typeof BasicValuesSchema>;
+/**
+ * Custom header values.
+ *
+ * Runtime: a single header `<name>: <value>` is added to the request.
+ */
+export declare const CustomHeaderValuesSchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    name: string;
+}, {
+    value: string;
+    name: string;
+}>;
+export type CustomHeaderValues = z.infer<typeof CustomHeaderValuesSchema>;
+/**
+ * OAuth 2.0 client credentials values.
+ */
+export declare const OAuth2ClientCredentialsValuesSchema: z.ZodObject<{
+    tokenUrl: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+}, {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+}>;
+export type OAuth2ClientCredentialsValues = z.infer<typeof OAuth2ClientCredentialsValuesSchema>;
+/**
+ * Credential authentication is discriminated by `authType`, keeping each
+ * authentication type paired with its exact values shape.
+ */
+export declare const CredentialAuthSchema: z.ZodDiscriminatedUnion<"authType", [z.ZodObject<{
+    authType: z.ZodLiteral<"bearer">;
+    values: z.ZodObject<{
+        token: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        token: string;
+    }, {
+        token: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        token: string;
+    };
+    authType: "bearer";
+}, {
+    values: {
+        token: string;
+    };
+    authType: "bearer";
+}>, z.ZodObject<{
+    authType: z.ZodLiteral<"basic">;
+    values: z.ZodObject<{
+        username: z.ZodString;
+        password: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        password: string;
+        username: string;
+    }, {
+        password: string;
+        username: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        password: string;
+        username: string;
+    };
+    authType: "basic";
+}, {
+    values: {
+        password: string;
+        username: string;
+    };
+    authType: "basic";
+}>, z.ZodObject<{
+    authType: z.ZodLiteral<"custom_header">;
+    values: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        name: string;
+    }, {
+        value: string;
+        name: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        value: string;
+        name: string;
+    };
+    authType: "custom_header";
+}, {
+    values: {
+        value: string;
+        name: string;
+    };
+    authType: "custom_header";
+}>, z.ZodObject<{
+    authType: z.ZodLiteral<"oauth2_client_credentials">;
+    values: z.ZodObject<{
+        tokenUrl: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    }, {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    };
+    authType: "oauth2_client_credentials";
+}, {
+    values: {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    };
+    authType: "oauth2_client_credentials";
+}>]>;
+export type CredentialAuth = z.infer<typeof CredentialAuthSchema>;
+export type CredentialAuthType = CredentialAuth['authType'];
+export type AuthSpecificValues = CredentialAuth['values'];
+/**
+ * Per-auth-type value schemas, extracted from the discriminated union.
+ */
+export declare const CREDENTIAL_VALUE_SCHEMAS: Record<CredentialAuthType, z.ZodTypeAny>;
+export declare function validateCredentialAuth(authType: CredentialAuthType, values: unknown): CredentialAuth;
+export declare function validateCredentialValues(authType: CredentialAuthType, values: unknown): AuthSpecificValues;
+export declare const CredentialNameSchema: z.ZodString;
+export interface CredentialSummary {
+    readonly name: string;
+    readonly authType: CredentialAuthType;
+    readonly status: CredentialStatus;
+    readonly createdAt: number;
+    readonly updatedAt: number;
+}
+export type ResolvedCredential = Readonly<{
+    name: string;
+    status: CredentialStatus;
+}> & Readonly<CredentialAuth>;
+/**
+ * Apply an already-resolved credential to HTTP request headers.
+ *
+ * Credential resolution belongs to the executor/runtime. This shared helper
+ * only translates the validated credential value into its HTTP representation,
+ * so workflow steps and server-side credential testing use identical logic.
+ */
+export declare function applyResolvedCredentialAuth(headers: Headers, credential: ResolvedCredential): void;
+export type CreateCredentialInput = Readonly<{
+    name: string;
+}> & Readonly<CredentialAuth>;
+export interface ReplaceCredentialValuesInput {
+    readonly values: AuthSpecificValues;
+}
+/**
+ * One safe credential row returned by list operations.
+ *
+ * `summary` is the SDK-owned credential shape. `attributes` is the host-owned,
+ * typed metadata carried opaquely by the SDK. `permittedActions` is projected
+ * by the runtime so UIs can gate row actions without knowing host policy.
+ */
+export interface CredentialListItem {
+    readonly summary: CredentialSummary;
+    readonly attributes?: ResourceAttributes<'credential'>;
+    readonly permittedActions?: readonly Action[];
+}
+export interface CredentialListResponse {
+    readonly credentials: CredentialListItem[];
+}
+/** Safe request shape for testing a stored credential against an HTTP endpoint. */
+export interface TestCredentialInput {
+    readonly url: string;
+    readonly method?: string;
+    readonly headers?: Record<string, string>;
+    readonly body?: string;
+}
+/** Redacted result of a server-side credential test. Secret values are never returned. */
+export interface TestCredentialResult {
+    readonly ok: boolean;
+    readonly status?: number;
+    readonly statusText?: string;
+    readonly durationMs?: number;
+    readonly headers?: Record<string, string>;
+    readonly bodyText?: string;
+    readonly error?: string;
+}
+export interface CredentialRegistryEntry extends CredentialRegistryEntryBase {
+    readonly type: CredentialAuthType;
+}
+/**
+ * Minimal registry for host-rendered credential forms. Entries and field keys
+ * are extracted from CredentialAuthSchema; Zod remains the source of truth.
+ */
+export declare const CREDENTIAL_AUTH_REGISTRY: readonly CredentialRegistryEntry[];
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/common/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/common/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,eAAO,MAAM,sBAAsB,kCAAgC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAExE,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC1D;AAgBD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;EAOpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;EAWnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;EAa1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;EAerC,CAAC;AAEZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAkCF;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAK/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;AAC5D,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAKrB,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;AAEzD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,OAAO,GACd,cAAc,CAEhB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,OAAO,GACd,kBAAkB,CAEpB;AAED,eAAO,MAAM,oBAAoB,aAA6B,CAAC;AAE/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC,GACA,QAAQ,CAAC,cAAc,CAAC,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,kBAAkB,GAC7B,IAAI,CAuBN;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAC5D,QAAQ,CAAC,cAAc,CAAC,CAAC;AAE3B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAcD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,uBAAuB,EAKlE,CAAC"}

package/dist/common/credentials.js

@@ -0,0 +1,176 @@
+import { z } from 'zod';
+export const CredentialStatusSchema = z.enum(['ACTIVE', 'REVOKED']);
+const credentialFieldMetadata = new WeakMap();
+function credentialField(schema, metadata) {
+    const describedSchema = schema.describe(metadata.label);
+    credentialFieldMetadata.set(describedSchema, metadata);
+    return describedSchema;
+}
+/**
+ * Bearer token values.
+ *
+ * Runtime: `Authorization: Bearer <token>` is added to the request.
+ */
+export const BearerValuesSchema = z
+    .object({
+    token: credentialField(z.string().min(1), {
+        label: 'Token',
+        control: 'password',
+    }),
+})
+    .strict();
+/**
+ * HTTP Basic authentication values.
+ *
+ * Runtime: `Authorization: Basic base64(username:password)` is added.
+ */
+export const BasicValuesSchema = z
+    .object({
+    username: credentialField(z.string().min(1), {
+        label: 'Username',
+        control: 'text',
+    }),
+    password: credentialField(z.string().min(1), {
+        label: 'Password',
+        control: 'password',
+    }),
+})
+    .strict();
+/**
+ * Custom header values.
+ *
+ * Runtime: a single header `<name>: <value>` is added to the request.
+ */
+export const CustomHeaderValuesSchema = z
+    .object({
+    name: credentialField(z.string().min(1), {
+        label: 'Header name',
+        control: 'text',
+        placeholder: 'e.g. X-Custom-Token',
+    }),
+    value: credentialField(z.string().min(1), {
+        label: 'Header value',
+        control: 'password',
+        placeholder: 'The header value to send',
+    }),
+})
+    .strict();
+/**
+ * OAuth 2.0 client credentials values.
+ */
+export const OAuth2ClientCredentialsValuesSchema = z
+    .object({
+    tokenUrl: credentialField(z.string().url(), {
+        label: 'Token URL',
+        control: 'url',
+    }),
+    clientId: credentialField(z.string().min(1), {
+        label: 'Client ID',
+        control: 'text',
+    }),
+    clientSecret: credentialField(z.string().min(1), {
+        label: 'Client Secret',
+        control: 'password',
+    }),
+})
+    .strict();
+const BearerCredentialAuthSchema = z
+    .object({
+    authType: z.literal('bearer'),
+    values: BearerValuesSchema,
+})
+    .strict()
+    .describe('Bearer Token');
+const BasicCredentialAuthSchema = z
+    .object({
+    authType: z.literal('basic'),
+    values: BasicValuesSchema,
+})
+    .strict()
+    .describe('Basic Auth');
+const CustomHeaderCredentialAuthSchema = z
+    .object({
+    authType: z.literal('custom_header'),
+    values: CustomHeaderValuesSchema,
+})
+    .strict()
+    .describe('Custom Header');
+const OAuth2ClientCredentialsCredentialAuthSchema = z
+    .object({
+    authType: z.literal('oauth2_client_credentials'),
+    values: OAuth2ClientCredentialsValuesSchema,
+})
+    .strict()
+    .describe('OAuth 2.0 Client Credentials');
+/**
+ * Credential authentication is discriminated by `authType`, keeping each
+ * authentication type paired with its exact values shape.
+ */
+export const CredentialAuthSchema = z.discriminatedUnion('authType', [
+    BearerCredentialAuthSchema,
+    BasicCredentialAuthSchema,
+    CustomHeaderCredentialAuthSchema,
+    OAuth2ClientCredentialsCredentialAuthSchema,
+]);
+/**
+ * Per-auth-type value schemas, extracted from the discriminated union.
+ */
+export const CREDENTIAL_VALUE_SCHEMAS = Object.fromEntries(CredentialAuthSchema.options.map((option) => [
+    option.shape.authType.value,
+    option.shape.values,
+]));
+export function validateCredentialAuth(authType, values) {
+    return CredentialAuthSchema.parse({ authType, values });
+}
+export function validateCredentialValues(authType, values) {
+    return validateCredentialAuth(authType, values).values;
+}
+export const CredentialNameSchema = z.string().min(1).max(255);
+/**
+ * Apply an already-resolved credential to HTTP request headers.
+ *
+ * Credential resolution belongs to the executor/runtime. This shared helper
+ * only translates the validated credential value into its HTTP representation,
+ * so workflow steps and server-side credential testing use identical logic.
+ */
+export function applyResolvedCredentialAuth(headers, credential) {
+    switch (credential.authType) {
+        case 'bearer': {
+            const { token } = credential.values;
+            headers.set('authorization', `Bearer ${token}`);
+            break;
+        }
+        case 'basic': {
+            const { username, password } = credential.values;
+            headers.set('authorization', `Basic ${btoa(`${username}:${password}`)}`);
+            break;
+        }
+        case 'custom_header': {
+            const { name, value } = credential.values;
+            headers.set(name, value);
+            break;
+        }
+        case 'oauth2_client_credentials': {
+            throw new Error('oauth2_client_credentials is not yet supported for HTTP requests');
+        }
+    }
+}
+function extractRegistryFields(schema) {
+    return Object.entries(schema.shape).map(([key, fieldSchema]) => {
+        const metadata = credentialFieldMetadata.get(fieldSchema);
+        if (!metadata) {
+            throw new Error(`Credential field "${key}" is missing UI metadata`);
+        }
+        return { key, ...metadata };
+    });
+}
+/**
+ * Minimal registry for host-rendered credential forms. Entries and field keys
+ * are extracted from CredentialAuthSchema; Zod remains the source of truth.
+ */
+export const CREDENTIAL_AUTH_REGISTRY = CredentialAuthSchema.options.map((option) => ({
+    type: option.shape.authType.value,
+    label: option.description ?? option.shape.authType.value,
+    fields: extractRegistryFields(option.shape.values),
+}));
+//# sourceMappingURL=credentials.js.map

package/dist/common/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/common/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAoBpE,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAGxC,CAAC;AAEJ,SAAS,eAAe,CACtB,MAAe,EACf,QAAmD;IAEnD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,uBAAuB,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACxC,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,UAAU;KACpB,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,UAAU;KACpB,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACvC,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,qBAAqB;KACnC,CAAC;IACF,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACxC,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,0BAA0B;KACxC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1C,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,KAAK;KACf,CAAC;IACF,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC/C,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,UAAU;KACpB,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,EAAE,kBAAkB;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,cAAc,CAAC,CAAC;AAE5B,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,YAAY,CAAC,CAAC;AAE1B,MAAM,gCAAgC,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACpC,MAAM,EAAE,wBAAwB;CACjC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,eAAe,CAAC,CAAC;AAE7B,MAAM,2CAA2C,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAChD,MAAM,EAAE,mCAAmC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8BAA8B,CAAC,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACnE,0BAA0B;IAC1B,yBAAyB;IACzB,gCAAgC;IAChC,2CAA2C;CAC5C,CAAC,CAAC;AAMH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CACxD,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;IAC3B,MAAM,CAAC,KAAK,CAAC,MAAM;CACpB,CAAC,CACoD,CAAC;AAEzD,MAAM,UAAU,sBAAsB,CACpC,QAA4B,EAC5B,MAAe;IAEf,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,MAAe;IAEf,OAAO,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAgB/D;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAgB,EAChB,UAA8B;IAE9B,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YACzE,MAAM;QACR,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM;QACR,CAAC;QACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAiDD,SAAS,qBAAqB,CAC5B,MAAsB;IAEtB,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,WAA2B,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,0BAA0B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;IACjC,KAAK,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;IACxD,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC,CAAC"}

package/dist/common/index.d.ts

@@ -9,10 +9,14 @@
  * - {@link CitationRef} — runtime, agent-emitted provenance for one data point
  * - {@link ResumePayload} / {@link ResumeAttachment} / {@link ResumeAction} — pause/resume contract
  * - {@link isExecutable}, {@link extensionOf} — upload safety check used at both perimeter and UI
+ * - Credential vault schemas, types, and the minimal auth-type registry —
+ *   shared between the server (SDK router + persistence), the workflow-ui
+ *   credential dropdown, and the xyne-search frontend credential management
+ *   page. All of these imports are browser-safe (only `zod` is required).
  *
  * The main `@xyne/workflow-sdk` barrel still re-exports these for
  * server-side use; UI / builder code should import from here so that
- * Node-only modules (`node:vm`, persistence runtimes) stay out of the
+ * Node-only modules (persistence runtimes, DNS/socket APIs) stay out of the
  * browser bundle.
  */
 export type { Attachment } from './attachment.js';
@@ -24,4 +28,6 @@ export { validateTriggerPayload } from './validate-payload.js';
 export type { ResumePayload, ResumeAttachment, ResumeAction, } from './resume-payload.js';
 export { isExecutable, extensionOf, BLOCKED_EXECUTABLE_MIME_TYPES, BLOCKED_EXECUTABLE_EXTENSIONS, } from './executable-check.js';
 export { recordKey, framePrefix, leafStepId } from '../engine/node-path.js';
+export type { CredentialStatus, CredentialAuthType, BearerValues, BasicValues, CustomHeaderValues, OAuth2ClientCredentialsValues, CredentialAuth, AuthSpecificValues, CredentialSummary, ResolvedCredential, CreateCredentialInput, ReplaceCredentialValuesInput, CredentialListItem, CredentialListResponse, TestCredentialInput, TestCredentialResult, CredentialFieldControl, CredentialRegistryInputField, CredentialRegistryEntryField, CredentialRegistryEntry, } from './credentials.js';
+export { CredentialStatusSchema, BearerValuesSchema, BasicValuesSchema, CustomHeaderValuesSchema, OAuth2ClientCredentialsValuesSchema, CredentialAuthSchema, CREDENTIAL_VALUE_SCHEMAS, validateCredentialAuth, validateCredentialValues, applyResolvedCredentialAuth, CredentialNameSchema, CREDENTIAL_AUTH_REGISTRY, } from './credentials.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,WAAW,EACX,OAAO,EACP,WAAW,EACX,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,WAAW,EACX,OAAO,EACP,WAAW,EACX,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG5E,YAAY,EAEV,gBAAgB,EAChB,kBAAkB,EAGlB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,6BAA6B,EAE7B,cAAc,EACd,kBAAkB,EAIlB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EAGpB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAEL,sBAAsB,EAGtB,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,mCAAmC,EACnC,oBAAoB,EAIpB,wBAAwB,EAGxB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,EAG3B,oBAAoB,EAGpB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC"}

package/dist/common/index.js

@@ -9,10 +9,14 @@
  * - {@link CitationRef} — runtime, agent-emitted provenance for one data point
  * - {@link ResumePayload} / {@link ResumeAttachment} / {@link ResumeAction} — pause/resume contract
  * - {@link isExecutable}, {@link extensionOf} — upload safety check used at both perimeter and UI
+ * - Credential vault schemas, types, and the minimal auth-type registry —
+ *   shared between the server (SDK router + persistence), the workflow-ui
+ *   credential dropdown, and the xyne-search frontend credential management
+ *   page. All of these imports are browser-safe (only `zod` is required).
  *
  * The main `@xyne/workflow-sdk` barrel still re-exports these for
  * server-side use; UI / builder code should import from here so that
- * Node-only modules (`node:vm`, persistence runtimes) stay out of the
+ * Node-only modules (persistence runtimes, DNS/socket APIs) stay out of the
  * browser bundle.
  */
 export { AttachmentSchema, ATTACHMENT_FORMAT, ATTACHMENT_JSON_SCHEMA, ATTACHMENT_ARRAY_JSON_SCHEMA, markAttachmentFields, isAttachment, mimeAccepted, attachmentProperty, } from './attachment.js';
@@ -22,4 +26,18 @@ export { isExecutable, extensionOf, BLOCKED_EXECUTABLE_MIME_TYPES, BLOCKED_EXECU
 // Node-path addressing for step records — pure string utilities (no Node deps),
 // used by the execution viewer / approvals UI to map node-path keys ↔ config ids.
 export { recordKey, framePrefix, leafStepId } from '../engine/node-path.js';
+// ── Runtime value exports (Zod schemas, registry, validation helper) ──
+export { 
+// ─ Status & auth type Zod schemas ──
+CredentialStatusSchema, 
+// ─ Per-auth-type Zod value schemas ──
+BearerValuesSchema, BasicValuesSchema, CustomHeaderValuesSchema, OAuth2ClientCredentialsValuesSchema, CredentialAuthSchema, 
+// ─ Value schema registry (runtime validation) ──
+CREDENTIAL_VALUE_SCHEMAS, 
+// ─ Validation helper ──
+validateCredentialAuth, validateCredentialValues, applyResolvedCredentialAuth, 
+// ─ Credential name schema ──
+CredentialNameSchema, 
+// ─ The minimal auth-type registry ──
+CREDENTIAL_AUTH_REGISTRY, } from './credentials.js';
 //# sourceMappingURL=index.js.map

package/dist/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAM/D,OAAO,EACL,YAAY,EACZ,WAAW,EACX,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,gFAAgF;AAChF,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAM/D,OAAO,EACL,YAAY,EACZ,WAAW,EACX,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,gFAAgF;AAChF,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAmC5E,yEAAyE;AAEzE,OAAO;AACL,sCAAsC;AACtC,sBAAsB;AAEtB,uCAAuC;AACvC,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,mCAAmC,EACnC,oBAAoB;AAEpB,kDAAkD;AAElD,wBAAwB;AAExB,yBAAyB;AACzB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B;AAE3B,8BAA8B;AAC9B,oBAAoB;AAEpB,sCAAsC;AACtC,wBAAwB,GACzB,MAAM,kBAAkB,CAAC"}

package/dist/engine/workflow-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-executor.d.ts","sourceRoot":"","sources":["../../src/engine/workflow-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAU7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAI3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAQvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAoD,MAAM,wBAAwB,CAAC;AAI5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA+C1D,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,+GAA+G;IAC/G,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,qFAAqF;IACrF,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,gBAAgB,CAC3B,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWjE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAZ3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA6B;gBAInC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EACxC,YAAY,EAAE,YAAY,EAC1B,eAAe,EAAE,eAAe,EAChC,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,EACrD,OAAO,CAAC,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE;IAUzD,6DAA6D;IAC7D,OAAO,CAAC,SAAS;IAMjB;;;;;;OAMG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiLtD;;;;;OAKG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC;IAUlB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,GACA,OAAO,CAAC,MAAM,CAAC;YA0HJ,WAAW;IAmDzB;;;;;;;;;;;;OAYG;YACW,SAAS;IA2LvB,8EAA8E;YAChE,WAAW;YAiBX,oBAAoB;IAgClC;;;;;OAKG;YACW,WAAW;YAwHX,gBAAgB;CAsG/B"}
+{"version":3,"file":"workflow-executor.d.ts","sourceRoot":"","sources":["../../src/engine/workflow-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAU7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAI3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAYvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAoD,MAAM,wBAAwB,CAAC;AAI5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA+C1D,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,+GAA+G;IAC/G,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,qFAAqF;IACrF,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,gBAAgB,CAC3B,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWjE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAZ3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA6B;gBAInC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EACxC,YAAY,EAAE,YAAY,EAC1B,eAAe,EAAE,eAAe,EAChC,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,EACrD,OAAO,CAAC,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE;IAUzD,6DAA6D;IAC7D,OAAO,CAAC,SAAS;IAMjB;;;;;;OAMG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiLtD;;;;;OAKG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC;IAUlB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,GACA,OAAO,CAAC,MAAM,CAAC;YA0HJ,WAAW;IAmDzB;;;;;;;;;;;;OAYG;YACW,SAAS;IA2LvB,8EAA8E;YAChE,WAAW;YAiBX,oBAAoB;IAgClC;;;;;OAKG;YACW,WAAW;YA2HX,gBAAgB;CAuH/B"}

package/dist/engine/workflow-executor.js

@@ -609,7 +609,7 @@ export class WorkflowExecutor {
                 throw new Error(`Step "${step.id}" (${step.type}) config validation failed:\n${formatZodErrors(parsed.error)}`);
             }
             this.log.info(`step ${callCtx.isResuming ? 'RESUME' : 'START'} id=${step.id} type=${step.type}`);
-            const stepCtx = await this.buildStepContext(context, { ...callCtx, stepId: step.id, rawConfig: step.config }, stepImpl);
+            const stepCtx = await this.buildStepContext(context, { ...callCtx, stepId: step.id, rawConfig: step.config }, stepImpl, undefined, parsed.data);
             const output = await controlImpl.execute(parsed.data, {
                 ...stepCtx,
                 walkBranch: (branchSteps, branchScope, branchKey, iter) => this.walkScope(branchSteps, branchScope, framePrefix(prefix, step.id, branchKey ?? 'default', iter ?? 0), walkCtx),
@@ -638,7 +638,7 @@ export class WorkflowExecutor {
         };
         const actionImpl = stepImpl;
         const resumePayload = resumeData?.['resumePayload'];
-        const stepCtx = await this.buildStepContext(context, { ...callCtx, stepId: step.id, rawConfig: baseConfig }, stepImpl, resumePayload);
+        const stepCtx = await this.buildStepContext(context, { ...callCtx, stepId: step.id, rawConfig: baseConfig }, stepImpl, resumePayload, resolvedInput);
         this.log.info(`step ${callCtx.isResuming ? 'RESUME' : 'START'} id=${step.id} type=${step.type}`);
         try {
             let output;
@@ -671,19 +671,33 @@ export class WorkflowExecutor {
             throw err;
         }
     }
-    async buildStepContext(context, callCtx, stepImpl, resumePayload) {
-        // Resolve credentials if step declares credentialSlots
+    async buildStepContext(context, callCtx, stepImpl, resumePayload, resolvedConfig) {
         const credentials = {};
         if (stepImpl.credentialSlots && stepImpl.credentialSlots.length > 0) {
             for (const slot of stepImpl.credentialSlots) {
-                // Scope comes from the workflow's typed attributes — not the metadata
-                // bag, which also carries transient per-call plumbing.
-                const resolved = await this.persistence.resolveCredential(context.workflow.attributes, slot.name);
+                const configuredName = resolvedConfig?.[slot.name];
+                if (configuredName === undefined ||
+                    configuredName === null ||
+                    configuredName === '') {
+                    if (slot.required) {
+                        throw new Error(`Required credential slot "${slot.name}" is not configured`);
+                    }
+                    continue;
+                }
+                if (typeof configuredName !== 'string') {
+                    throw new Error(`Credential slot "${slot.name}" must resolve to a credential name`);
+                }
+                // Pass the running workflow so the adapter can identify and verify the
+                // workspace in which this execution is taking place.
+                const resolved = await this.persistence.resolveCredential(context.workflow, configuredName);
                 if (resolved) {
                     credentials[slot.name] = resolved;
                 }
                 else if (slot.required) {
-                    throw new Error(`Required credential "${slot.name}" not found`);
+                    throw new Error(`Required credential "${configuredName}" not found`);
+                }
+                else {
+                    throw new Error(`Credential "${configuredName}" not found or revoked`);
                 }
             }
         }
@@ -693,7 +707,7 @@ export class WorkflowExecutor {
         const metadata = resumePayload
             ? { ...context.workflow.metadata, resumePayload }
             : context.workflow.metadata;
-        return {
+        const stepContext = {
             workflow: context,
             runtime: {
                 executionId: callCtx.executionId,
@@ -741,6 +755,7 @@ export class WorkflowExecutor {
             },
             log: this.log,
         };
+        return stepContext;
     }
 }
 // ─── Helpers ───