runline 0.33.0 → 0.35.0

package/dist/plugins/stackby/src/index.js

@@ -1,26 +1,18 @@
-const BASE = "https://stackby.com/api/betav1";
-async function apiRequest(apiKey, method, endpoint, body, qs) {
-    const url = new URL(`${BASE}${endpoint}`);
-    if (qs) {
-        for (const [k, v] of Object.entries(qs)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
-    const init = {
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { stackbyCredential } from "./credentials.js";
+function apiRequest(ctx, method, endpoint, body, qs) {
+    return credentialJson(ctx, stackbyCredential, "stackby", {
+        target: "api",
+        path: endpoint,
         method,
-        headers: { "api-key": apiKey, "Content-Type": "application/json" },
-    };
-    if (body !== undefined)
-        init.body = JSON.stringify(body);
-    const res = await fetch(url.toString(), init);
-    if (!res.ok)
-        throw new Error(`Stackby error ${res.status}: ${await res.text()}`);
-    return res.json();
+        query: qs,
+        ...(body !== undefined ? { json: body } : {}),
+    });
 }
 export default function stackby(rl) {
     rl.setName("stackby");
     rl.setVersion("0.1.0");
+    rl.setCredential(stackbyCredential);
     rl.setConnectionSchema({
         apiKey: {
             type: "string",
@@ -29,7 +21,6 @@ export default function stackby(rl) {
             env: "STACKBY_API_KEY",
         },
     });
-    const key = (ctx) => ctx.connection.config.apiKey;
     rl.registerAction("row.read", {
         access: "read",
         description: "Read a row by ID",
@@ -40,7 +31,7 @@ export default function stackby(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            const data = (await apiRequest(key(ctx), "GET", `/rowlist/${p.stackId}/${encodeURIComponent(p.table)}`, undefined, { rowIds: p.rowId }));
+            const data = (await apiRequest(ctx, "GET", `rowlist/${pathSegment(p.stackId)}/${pathSegment(p.table)}`, undefined, { rowIds: p.rowId }));
             return data.map((d) => d.field);
         },
     });
@@ -60,7 +51,7 @@ export default function stackby(rl) {
                 qs.view = p.view;
             if (p.limit)
                 qs.maxrecord = p.limit;
-            const data = (await apiRequest(key(ctx), "GET", `/rowlist/${p.stackId}/${encodeURIComponent(p.table)}`, undefined, qs));
+            const data = (await apiRequest(ctx, "GET", `rowlist/${pathSegment(p.stackId)}/${pathSegment(p.table)}`, undefined, qs));
             return data.map((d) => d.field);
         },
     });
@@ -78,7 +69,7 @@ export default function stackby(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            const data = (await apiRequest(key(ctx), "POST", `/rowcreate/${p.stackId}/${encodeURIComponent(p.table)}`, { records: p.records }));
+            const data = (await apiRequest(ctx, "POST", `rowcreate/${pathSegment(p.stackId)}/${pathSegment(p.table)}`, { records: p.records }));
             return data.map((d) => d.field);
         },
     });
@@ -92,7 +83,7 @@ export default function stackby(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return apiRequest(key(ctx), "DELETE", `/rowdelete/${p.stackId}/${encodeURIComponent(p.table)}`, undefined, { rowIds: p.rowId });
+            return apiRequest(ctx, "DELETE", `rowdelete/${pathSegment(p.stackId)}/${pathSegment(p.table)}`, undefined, { rowIds: p.rowId });
         },
     });
 }

package/dist/plugins/steel/src/auth.js

@@ -0,0 +1,27 @@
+import { staticCredential } from "../../_shared/credentials.js";
+/**
+ * A Steel API key: the steel-api-key header on the REST API, and the
+ * apiKey query parameter of a session's CDP socket, which the broker
+ * signs — or relays, under a host that keeps the key.
+ */
+export const steelCredential = staticCredential({
+    id: "steel",
+    auth: {
+        kind: "static",
+        parts: ["apiKey"],
+        placements: [
+            { in: "header", part: "apiKey", name: "steel-api-key", targets: ["api"] },
+            { in: "query", part: "apiKey", name: "apiKey", targets: ["cdp"] },
+        ],
+    },
+    local: { apiKey: "apiKey" },
+    targets: {
+        // Scrapes, screenshots and PDFs answer once the page has rendered.
+        api: {
+            baseUrl: "https://api.steel.dev/",
+            methods: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+            timeoutMs: 120_000,
+        },
+        cdp: { baseUrl: "wss://connect.steel.dev/", methods: ["GET"], socket: true },
+    },
+});

package/dist/plugins/steel/src/browser.js

@@ -1,5 +1,6 @@
 import * as t from "typebox";
-import { SESSION_OPTIONS_SCHEMA, api, cdpUrl, compactRecord } from "./shared.js";
+import { pathSegment } from "../../_shared/credentials.js";
+import { SESSION_OPTIONS_SCHEMA, api, compactRecord, socketUrl } from "./shared.js";
 const SCRAPE_SCHEMA = {
     url: t.String({ description: "URL to scrape" }),
     format: t.Optional(t.Array(t.String(), { description: "Formats: html, cleaned_html, markdown, readability" })),
@@ -90,9 +91,9 @@ export function registerBrowserActions(rl) {
                     "Install it, or use the steel.page.* actions, which need nothing installed.");
             }
             const session = await api(ctx, "/v1/sessions", { method: "POST", body: compactRecord(sessionOptions) });
-            const endpoint = cdpUrl(ctx, String(session.id));
             let browser;
             try {
+                const endpoint = await socketUrl(ctx, String(session.id));
                 // No fallback shim on purpose. A hand-rolled lookalike that
                 // answers to the same names but implements a fraction of the API
                 // does not fail — it returns wrong results, which is worse.
@@ -106,7 +107,7 @@ export function registerBrowserActions(rl) {
             finally {
                 await browser?.close()?.catch?.(() => { });
                 if (release !== false && session.id) {
-                    await api(ctx, `/v1/sessions/${encodeURIComponent(String(session.id))}/release`, { method: "POST" }).catch(() => { });
+                    await api(ctx, `/v1/sessions/${pathSegment(session.id)}/release`, { method: "POST" }).catch(() => { });
                 }
             }
         },

package/dist/plugins/steel/src/captchas.js

@@ -1,22 +1,23 @@
 import * as t from "typebox";
+import { pathSegment } from "../../_shared/credentials.js";
 import { api, compactRecord } from "./shared.js";
 export function registerCaptchaActions(rl) {
     rl.registerAction("captcha.status", {
         access: "read",
         description: "Get CAPTCHA detection/solving status for a Steel session.",
         inputSchema: t.Object({ sessionId: t.String() }),
-        async execute(input, ctx) { return api(ctx, `/v1/sessions/${encodeURIComponent(input.sessionId)}/captchas/status`); },
+        async execute(input, ctx) { return api(ctx, `/v1/sessions/${pathSegment(input.sessionId)}/captchas/status`); },
     });
     rl.registerAction("captcha.solve", {
         access: "write",
         description: "Trigger CAPTCHA solving for all detected CAPTCHAs or a specific task/url/page.",
         inputSchema: t.Object({ sessionId: t.String(), taskId: t.Optional(t.String()), url: t.Optional(t.String()), pageId: t.Optional(t.String()) }),
-        async execute(input, ctx) { const { sessionId, ...body } = input; return api(ctx, `/v1/sessions/${encodeURIComponent(String(sessionId))}/captchas/solve`, { method: "POST", body: compactRecord(body) }); },
+        async execute(input, ctx) { const { sessionId, ...body } = input; return api(ctx, `/v1/sessions/${pathSegment(sessionId)}/captchas/solve`, { method: "POST", body: compactRecord(body) }); },
     });
     rl.registerAction("captcha.solveImage", {
         access: "write",
         description: "Solve an image CAPTCHA by XPath selectors.",
         inputSchema: t.Object({ sessionId: t.String(), imageXPath: t.String(), inputXPath: t.String(), url: t.Optional(t.String()) }),
-        async execute(input, ctx) { const { sessionId, ...body } = input; return api(ctx, `/v1/sessions/${encodeURIComponent(String(sessionId))}/captchas/solve-image`, { method: "POST", body: compactRecord(body) }); },
+        async execute(input, ctx) { const { sessionId, ...body } = input; return api(ctx, `/v1/sessions/${pathSegment(sessionId)}/captchas/solve-image`, { method: "POST", body: compactRecord(body) }); },
     });
 }

package/dist/plugins/steel/src/extensions.js

@@ -1,4 +1,5 @@
 import * as t from "typebox";
+import { pathSegment } from "../../_shared/credentials.js";
 import { api } from "./shared.js";
 function extensionForm(input) {
     const form = new FormData();
@@ -29,7 +30,7 @@ export function registerExtensionActions(rl) {
         inputSchema: t.Object({ id: t.String(), url: t.String() }),
         async execute(input, ctx) {
             const { id, ...body } = input;
-            return api(ctx, `/v1/extensions/${encodeURIComponent(String(id))}`, { method: "PUT", body: extensionForm(body) });
+            return api(ctx, `/v1/extensions/${pathSegment(id)}`, { method: "PUT", body: extensionForm(body) });
         },
     });
     rl.registerAction("extension.delete", {
@@ -37,7 +38,7 @@ export function registerExtensionActions(rl) {
         description: "Delete an extension by ID.",
         inputSchema: t.Object({ id: t.String() }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/extensions/${encodeURIComponent(input.id)}`, { method: "DELETE" });
+            return api(ctx, `/v1/extensions/${pathSegment(input.id)}`, { method: "DELETE" });
         },
     });
     rl.registerAction("extension.deleteAll", {

package/dist/plugins/steel/src/files.js

@@ -1,4 +1,5 @@
 import * as t from "typebox";
+import { pathSegment, pathSegments } from "../../_shared/credentials.js";
 import { api } from "./shared.js";
 function fileSchema() {
     return {
@@ -13,11 +14,9 @@ function fileForm(input) {
         form.set("path", String(input.path));
     return form;
 }
-function normalizeFilePath(path) {
-    return String(path).replace(/^\/files\/+/, "").replace(/^\/+/, "");
-}
+/** A file path beneath `files/`, each segment encoded; a leading `/files/` or `/` is dropped. */
 function encodeFilePath(path) {
-    return normalizeFilePath(path).split("/").map(encodeURIComponent).join("/");
+    return pathSegments(String(path).replace(/^\/files\/+/, "").replace(/^\/+/, ""));
 }
 export function registerFileActions(rl) {
     rl.registerAction("file.list", {
@@ -57,7 +56,7 @@ export function registerFileActions(rl) {
         description: "List files in a Steel session filesystem.",
         inputSchema: t.Object({ sessionId: t.String() }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.sessionId)}/files`);
+            return api(ctx, `/v1/sessions/${pathSegment(input.sessionId)}/files`);
         },
     });
     rl.registerAction("sessionFile.upload", {
@@ -66,7 +65,7 @@ export function registerFileActions(rl) {
         inputSchema: t.Object({ sessionId: t.String(), ...fileSchema() }),
         async execute(input, ctx) {
             const { sessionId, ...body } = input;
-            return api(ctx, `/v1/sessions/${encodeURIComponent(String(sessionId))}/files`, { method: "POST", body: fileForm(body) });
+            return api(ctx, `/v1/sessions/${pathSegment(sessionId)}/files`, { method: "POST", body: fileForm(body) });
         },
     });
     rl.registerAction("sessionFile.download", {
@@ -75,7 +74,7 @@ export function registerFileActions(rl) {
         inputSchema: t.Object({ sessionId: t.String(), path: t.String() }),
         async execute(input, ctx) {
             const { sessionId, path } = input;
-            return api(ctx, `/v1/sessions/${encodeURIComponent(String(sessionId))}/files/${encodeFilePath(path)}`);
+            return api(ctx, `/v1/sessions/${pathSegment(sessionId)}/files/${encodeFilePath(path)}`);
         },
     });
     rl.registerAction("sessionFile.downloadArchive", {
@@ -83,7 +82,7 @@ export function registerFileActions(rl) {
         description: "Download/read the zip archive of all files in a session.",
         inputSchema: t.Object({ sessionId: t.String() }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.sessionId)}/files.zip`);
+            return api(ctx, `/v1/sessions/${pathSegment(input.sessionId)}/files.zip`);
         },
     });
     rl.registerAction("sessionFile.delete", {
@@ -92,7 +91,7 @@ export function registerFileActions(rl) {
         inputSchema: t.Object({ sessionId: t.String(), path: t.String() }),
         async execute(input, ctx) {
             const { sessionId, path } = input;
-            return api(ctx, `/v1/sessions/${encodeURIComponent(String(sessionId))}/files/${encodeFilePath(path)}`, { method: "DELETE" });
+            return api(ctx, `/v1/sessions/${pathSegment(sessionId)}/files/${encodeFilePath(path)}`, { method: "DELETE" });
         },
     });
     rl.registerAction("sessionFile.deleteAll", {
@@ -100,7 +99,7 @@ export function registerFileActions(rl) {
         description: "Delete all files in a session filesystem.",
         inputSchema: t.Object({ sessionId: t.String() }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.sessionId)}/files`, { method: "DELETE" });
+            return api(ctx, `/v1/sessions/${pathSegment(input.sessionId)}/files`, { method: "DELETE" });
         },
     });
 }

package/dist/plugins/steel/src/index.js

@@ -1,4 +1,5 @@
 import * as t from "typebox";
+import { steelCredential } from "./auth.js";
 import { registerBrowserActions } from "./browser.js";
 import { registerCaptchaActions } from "./captchas.js";
 import { registerCredentialActions } from "./credentials.js";
@@ -10,6 +11,7 @@ import { registerSessionActions } from "./sessions.js";
 export default function steel(rl) {
     rl.setName("steel");
     rl.setVersion("0.1.0");
+    rl.setCredential(steelCredential);
     rl.setConnectionSchema(t.Object({
         apiKey: t.String({
             description: "Steel API key (https://app.steel.dev/settings/api-keys)",

package/dist/plugins/steel/src/page/tools.js

@@ -22,7 +22,7 @@
  * freely: losing one costs latency, never correctness.
  */
 import * as t from "typebox";
-import { cdpUrl, compactRecord } from "../shared.js";
+import { compactRecord, socketUrl } from "../shared.js";
 import { attachToPage, attachToTarget, CdpError, connectCdp, } from "./cdp.js";
 import { CdpDriver } from "./driver.js";
 import { SENSITIVE_VALUE_MARKER } from "./page-snapshot.js";
@@ -40,7 +40,7 @@ const targetId = t.Optional(t.String({
     description: "Page target id from page.targets; defaults to the session's first page.",
 }));
 async function open(ctx, id, target) {
-    const cdp = await connectCdp(cdpUrl(ctx, id));
+    const cdp = await connectCdp(await socketUrl(ctx, id));
     try {
         const page = target
             ? await attachToTarget(cdp, target)
@@ -486,7 +486,7 @@ export function registerPageActions(rl) {
             const args = input;
             // Browser-level, not page-level: this is the one action that is not
             // scoped to a single target, so it uses its own short-lived socket.
-            const cdp = await connectCdp(cdpUrl(ctx, String(args.sessionId)));
+            const cdp = await connectCdp(await socketUrl(ctx, String(args.sessionId)));
             try {
                 if (args.action === "new") {
                     const created = (await cdp.send("Target.createTarget", {

package/dist/plugins/steel/src/profiles.js

@@ -1,4 +1,5 @@
 import * as t from "typebox";
+import { pathSegment } from "../../_shared/credentials.js";
 import { api } from "./shared.js";
 function profileForm(input) {
     const form = new FormData();
@@ -23,7 +24,7 @@ export function registerProfileActions(rl) {
         description: "Get a Steel profile by ID.",
         inputSchema: t.Object({ id: t.String() }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/profiles/${encodeURIComponent(input.id)}`);
+            return api(ctx, `/v1/profiles/${pathSegment(input.id)}`);
         },
     });
     rl.registerAction("profile.create", {
@@ -39,7 +40,7 @@ export function registerProfileActions(rl) {
                 body: { timeout: 60000, inactivityTimeout: 30000, ...input, persistProfile: true },
             });
             try {
-                await api(ctx, `/v1/sessions/${encodeURIComponent(String(session.id))}/release`, { method: "POST" });
+                await api(ctx, `/v1/sessions/${pathSegment(session.id)}/release`, { method: "POST" });
             }
             catch {
                 // Profile creation is tied to session release. Return the session metadata even if release cleanup fails.
@@ -53,7 +54,7 @@ export function registerProfileActions(rl) {
         inputSchema: t.Object({ id: t.String(), userAgent: t.Optional(t.String()), proxy: t.Optional(t.Any()), metadata: t.Optional(t.Any()) }),
         async execute(input, ctx) {
             const { id, ...body } = input;
-            return api(ctx, `/v1/profiles/${encodeURIComponent(String(id))}`, { method: "PATCH", body: profileForm(body) });
+            return api(ctx, `/v1/profiles/${pathSegment(id)}`, { method: "PATCH", body: profileForm(body) });
         },
     });
 }

package/dist/plugins/steel/src/sessions.js

@@ -1,5 +1,6 @@
 import * as t from "typebox";
-import { LIST_INPUT_SCHEMA, SESSION_OPTIONS_SCHEMA, api, cdpUrl, compactRecord } from "./shared.js";
+import { pathSegment } from "../../_shared/credentials.js";
+import { LIST_INPUT_SCHEMA, SESSION_OPTIONS_SCHEMA, api, compactRecord, socketUrl } from "./shared.js";
 export function registerSessionActions(rl) {
     rl.registerAction("session.create", {
         access: "write",
@@ -22,7 +23,7 @@ export function registerSessionActions(rl) {
         description: "Get a Steel session by ID.",
         inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}`);
+            return api(ctx, `/v1/sessions/${pathSegment(input.id)}`);
         },
     });
     rl.registerAction("session.release", {
@@ -30,7 +31,7 @@ export function registerSessionActions(rl) {
         description: "Release a Steel session when work is done.",
         inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/release`, { method: "POST" });
+            return api(ctx, `/v1/sessions/${pathSegment(input.id)}/release`, { method: "POST" });
         },
     });
     rl.registerAction("session.releaseAll", {
@@ -46,7 +47,7 @@ export function registerSessionActions(rl) {
             for (const session of live) {
                 const id = String(session.id);
                 try {
-                    released.push({ id, result: await api(ctx, `/v1/sessions/${encodeURIComponent(id)}/release`, { method: "POST" }) });
+                    released.push({ id, result: await api(ctx, `/v1/sessions/${pathSegment(id)}/release`, { method: "POST" }) });
                 }
                 catch (error) {
                     failed.push({ id, error: String(error.message ?? error) });
@@ -60,7 +61,7 @@ export function registerSessionActions(rl) {
         description: "Capture cookies/localStorage context from a live session. Treat output as sensitive auth material.",
         inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/context`);
+            return api(ctx, `/v1/sessions/${pathSegment(input.id)}/context`);
         },
     });
     rl.registerAction("session.traces", {
@@ -73,7 +74,7 @@ export function registerSessionActions(rl) {
         }),
         async execute(input, ctx) {
             const { id, ...query } = input;
-            return api(ctx, `/v1/sessions/${encodeURIComponent(String(id))}/agent-traces`, { query });
+            return api(ctx, `/v1/sessions/${pathSegment(id)}/agent-traces`, { query });
         },
     });
     rl.registerAction("session.computer", {
@@ -94,7 +95,7 @@ export function registerSessionActions(rl) {
         async execute(input, ctx) {
             const { id, deltaX, deltaY, ...body } = input;
             const payload = compactRecord({ ...body, delta_x: deltaX, delta_y: deltaY });
-            return api(ctx, `/v1/sessions/${encodeURIComponent(String(id))}/computer`, { method: "POST", body: payload });
+            return api(ctx, `/v1/sessions/${pathSegment(id)}/computer`, { method: "POST", body: payload });
         },
     });
     rl.registerAction("session.events", {
@@ -102,7 +103,7 @@ export function registerSessionActions(rl) {
         description: "Fetch legacy recorded session events for replay tooling.",
         inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/events`);
+            return api(ctx, `/v1/sessions/${pathSegment(input.id)}/events`);
         },
     });
     rl.registerAction("session.hls", {
@@ -110,16 +111,15 @@ export function registerSessionActions(rl) {
         description: "Fetch the HLS playlist for a recorded headful Steel session.",
         inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
         async execute(input, ctx) {
-            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/hls`);
+            return api(ctx, `/v1/sessions/${pathSegment(input.id)}/hls`);
         },
     });
     rl.registerAction("session.cdpUrl", {
         access: "read",
-        description: "Build a Playwright/Puppeteer CDP URL for a Steel session using the configured API key.",
-        inputSchema: t.Object({ id: t.String({ description: "Session ID" }), websocketUrl: t.Optional(t.String({ description: "Optional websocketUrl returned by session.create. If omitted, uses wss://connect.steel.dev with sessionId." })) }),
+        description: "A Playwright/Puppeteer CDP URL for a Steel session. Locally it carries the connection's API key, so treat it as secret; under a host that keeps the key it is the host's relay.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
         async execute(input, ctx) {
-            const { id, websocketUrl } = input;
-            return { cdpUrl: cdpUrl(ctx, id, websocketUrl) };
+            return { cdpUrl: await socketUrl(ctx, input.id) };
         },
     });
 }

package/dist/plugins/steel/src/shared.js

@@ -1,61 +1,31 @@
 import * as t from "typebox";
-const BASE_URL = "https://api.steel.dev";
-export function apiKey(ctx) {
-    return ctx.connection.config.apiKey;
-}
+import { credentialOk, credentialSocketUrl, jsonAnswer, multipartBody } from "../../_shared/credentials.js";
+import { steelCredential } from "./auth.js";
+/** A REST call: a JSON answer parsed, any other answer (a file) as text. */
 export async function api(ctx, path, options = {}) {
-    const url = new URL(path, BASE_URL);
-    for (const [key, value] of Object.entries(options.query ?? {})) {
-        if (value === undefined || value === null || value === "")
-            continue;
-        if (Array.isArray(value)) {
-            for (const item of value)
-                url.searchParams.append(key, String(item));
-        }
-        else {
-            url.searchParams.set(key, String(value));
-        }
-    }
-    const headers = {
-        "steel-api-key": apiKey(ctx),
-        ...(options.headers ?? {}),
-    };
-    let body;
-    if (options.body !== undefined) {
-        if (options.body instanceof FormData) {
-            body = options.body;
-        }
-        else {
-            headers["Content-Type"] = "application/json";
-            body = JSON.stringify(options.body);
-        }
-    }
-    const res = await fetch(url.toString(), {
+    const query = Object.fromEntries(Object.entries(options.query ?? {}).filter(([, value]) => value !== ""));
+    const upload = options.body instanceof FormData ? await multipartBody(options.body) : undefined;
+    const res = await credentialOk(ctx, steelCredential, "steel", {
+        target: "api",
+        path: path.replace(/^\//, ""),
         method: options.method ?? "GET",
-        headers,
-        body,
+        query,
+        ...(upload
+            ? { body: upload.body, headers: { "Content-Type": upload.contentType } }
+            : options.body !== undefined
+                ? { json: options.body }
+                : {}),
     });
-    const text = await res.text();
-    if (!res.ok)
-        throw new Error(`Steel API error ${res.status}: ${text || res.statusText}`);
-    if (!text)
-        return {};
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType.includes("application/json") || text.startsWith("{") || text.startsWith("["))
-        return JSON.parse(text);
-    return text;
+    const type = res.headers.get("content-type") ?? "";
+    return res.status === 204 || type.includes("application/json") ? jsonAnswer(res) : res.text();
 }
 /**
- * The CDP endpoint for a session. One definition: this URL carries the
- * API key, so a second hand-written copy is a second place to leak it or
- * to forget encoding.
+ * The CDP socket URL for a session, from the broker: signed with the key
+ * by the local signer, or a relay the host controls. One definition, so
+ * no copy builds a key-bearing URL by hand.
  */
-export function cdpUrl(ctx, sessionId, websocketUrl) {
-    const key = encodeURIComponent(apiKey(ctx));
-    if (websocketUrl) {
-        return `${websocketUrl}${websocketUrl.includes("?") ? "&" : "?"}apiKey=${key}`;
-    }
-    return `wss://connect.steel.dev?apiKey=${key}&sessionId=${encodeURIComponent(sessionId)}`;
+export function socketUrl(ctx, sessionId) {
+    return credentialSocketUrl(ctx, steelCredential, { target: "cdp", path: "", query: { sessionId } });
 }
 export function compactRecord(input) {
     return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined && value !== null));

package/dist/plugins/storyblok/src/credentials.js

@@ -0,0 +1,37 @@
+import { staticCredential } from "../../_shared/credentials.js";
+/**
+ * A Content Delivery token, appended as the token query parameter on the
+ * content API, and a Management API token, sent in Authorization on the
+ * management API. A connection may hold either or both; a call to an API
+ * whose token it lacks is refused.
+ */
+export const storyblokCredential = staticCredential({
+    id: "storyblok",
+    auth: {
+        kind: "static",
+        parts: ["contentToken", "managementToken"],
+        optionalParts: ["contentToken", "managementToken"],
+        placements: [
+            {
+                in: "query",
+                part: "contentToken",
+                name: "token",
+                targets: ["content"],
+            },
+            {
+                in: "header",
+                part: "managementToken",
+                name: "Authorization",
+                targets: ["management"],
+            },
+        ],
+    },
+    local: { contentToken: "contentToken", managementToken: "managementToken" },
+    targets: {
+        content: { baseUrl: "https://api.storyblok.com/v1/cdn/", methods: ["GET"] },
+        management: {
+            baseUrl: "https://mapi.storyblok.com/v1/spaces/",
+            methods: ["GET", "DELETE"],
+        },
+    },
+});