streamby-core 0.29.12 → 0.32.0

package/dist/middleware/routes/storageConnection.js

@@ -6,6 +6,8 @@ const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const builtinAccess_1 = require("../../utils/builtinAccess");
+const sanitize_1 = require("../../utils/sanitize");
+const encryption_1 = require("../../utils/encryption");
 const VALID_STORAGE_TYPES = ['s3', 'gcs', 'r2', 'azure'];
 function storageConnectionRouter(config) {
     const router = (0, express_1.Router)();
@@ -24,9 +26,9 @@ function storageConnectionRouter(config) {
             // "validate on every use" (TCORE-69). BYOC (source: 'integration') is always available.
             const data = await Promise.all(connections.map(async (conn) => {
                 if (conn.source !== 'builtin')
-                    return conn;
+                    return (0, sanitize_1.sanitizeConnection)(conn);
                 const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId ?? conn.id, config, 'storage');
-                return { ...conn, isBuiltin: true, available };
+                return (0, sanitize_1.sanitizeConnection)({ ...conn, isBuiltin: true, available });
             }));
             return res.status(200).json({ data });
         }
@@ -41,15 +43,15 @@ function storageConnectionRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, type, credentialId, integrationId, description } = req.body;
+            const { name, type, credential, integrationId, description } = req.body;
             if (!name || !type) {
                 return res.status(400).json({ message: 'name and type are required' });
             }
-            if (!credentialId && !integrationId) {
-                return res.status(400).json({ message: 'Either credentialId or integrationId is required' });
+            if (!credential && !integrationId) {
+                return res.status(400).json({ message: 'Either credential or integrationId is required' });
             }
-            if (credentialId && integrationId) {
-                return res.status(400).json({ message: 'Provide only one of credentialId or integrationId' });
+            if (credential && integrationId) {
+                return res.status(400).json({ message: 'Provide only one of credential or integrationId' });
             }
             if (!VALID_STORAGE_TYPES.includes(type)) {
                 return res.status(400).json({ message: `type must be one of: ${VALID_STORAGE_TYPES.join(', ')}` });
@@ -59,6 +61,7 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
+            let encryptedCredential;
             if (integrationId) {
                 const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
                 const integration = await UserIntegrationModel.findOne({ id: integrationId, userId: auth.userId });
@@ -68,23 +71,23 @@ function storageConnectionRouter(config) {
                     return res.status(400).json({ message: 'Integration is not a storage integration' });
             }
             else {
-                const credExists = project.credentials?.some((c) => c.id === credentialId);
-                if (!credExists)
-                    return res.status(400).json({ message: 'Credential not found in project' });
+                if (!(0, encryption_1.isEncryptionKeySet)())
+                    return res.status(500).json({ message: 'Encryption key is not set' });
+                encryptedCredential = (0, encryption_1.encrypt)(credential);
             }
             const connection = {
                 id: new mongodb_1.ObjectId().toHexString(),
                 name,
                 type,
-                credentialId: credentialId ?? '',
                 projectId: req.params.id,
                 createdAt: new Date(),
                 source: integrationId ? 'integration' : 'manual',
                 ...(integrationId && { integrationId }),
+                ...(encryptedCredential !== undefined && { encryptedCredential }),
                 ...(description !== undefined && { description }),
             };
             await Project.update({ _id: req.params.id }, { $push: { storageConnections: connection } });
-            return res.status(201).json({ data: connection });
+            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to add storage connection', details: err.message });

package/dist/services/backfillBuiltinConnections.js

@@ -29,7 +29,6 @@ async function backfillBuiltinConnections(config) {
             id: crypto_1.default.randomUUID(),
             name: builtinAccess_1.BUILTIN_DB_DISPLAY[db.type] ?? db.type,
             dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
-            credentialId: '',
             projectId: project.id,
             createdAt: now,
             isBuiltin: true,
@@ -40,7 +39,6 @@ async function backfillBuiltinConnections(config) {
             id: crypto_1.default.randomUUID(),
             name: builtinAccess_1.BUILTIN_STORAGE_DISPLAY[provider.type] ?? provider.type,
             type: provider.type,
-            credentialId: '',
             projectId: project.id,
             createdAt: now,
             isBuiltin: true,

package/dist/services/connection.d.ts

@@ -0,0 +1,18 @@
+import { StreamByConfig, Connection, ConnectionMethod } from '../types';
+export declare function addConnection(config: StreamByConfig, projectId: string, data: {
+    name: string;
+    apiUrl: string;
+    method: ConnectionMethod;
+    prefix?: string;
+    description?: string;
+    token?: string;
+}): Promise<Connection>;
+export declare function updateConnection(config: StreamByConfig, projectId: string, connectionId: string, data: {
+    name?: string;
+    apiUrl?: string;
+    method?: ConnectionMethod;
+    prefix?: string;
+    description?: string;
+    token?: string;
+}): Promise<Connection>;
+export declare function deleteConnection(config: StreamByConfig, projectId: string, connectionId: string): Promise<void>;

package/dist/services/connection.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addConnection = addConnection;
+exports.updateConnection = updateConnection;
+exports.deleteConnection = deleteConnection;
+const mongodb_1 = require("mongodb");
+const manager_1 = require("../models/manager");
+const encryption_1 = require("../utils/encryption");
+async function addConnection(config, projectId, data) {
+    const ProjectModel = (0, manager_1.getModel)('projects');
+    const project = await ProjectModel.findOne({ _id: projectId });
+    if (!project) {
+        throw new Error('Project not found.');
+    }
+    let encryptedCredential;
+    if (data.token) {
+        if (!(0, encryption_1.isEncryptionKeySet)())
+            throw new Error('Encryption key is not set. Cannot encrypt credential.');
+        encryptedCredential = (0, encryption_1.encrypt)(data.token);
+    }
+    const connection = {
+        id: new mongodb_1.ObjectId().toHexString(),
+        name: data.name,
+        prefix: data.prefix,
+        apiUrl: data.apiUrl,
+        method: data.method,
+        projectId,
+        createdAt: new Date(),
+        ...(data.description !== undefined && { description: data.description }),
+        ...(encryptedCredential !== undefined && { encryptedCredential }),
+    };
+    const updatedProject = await ProjectModel.update({ _id: projectId }, { $push: { connections: connection } });
+    if (!updatedProject) {
+        throw new Error('Failed to add connection to project.');
+    }
+    return connection;
+}
+async function updateConnection(config, projectId, connectionId, data) {
+    const ProjectModel = (0, manager_1.getModel)('projects');
+    const project = await ProjectModel.findOne({ _id: projectId });
+    if (!project)
+        throw new Error('Project not found.');
+    const connections = project.connections ?? [];
+    const index = connections.findIndex((c) => c.id === connectionId);
+    if (index === -1)
+        throw new Error('Connection not found.');
+    let encryptedCredential;
+    if (data.token) {
+        if (!(0, encryption_1.isEncryptionKeySet)())
+            throw new Error('Encryption key is not set. Cannot encrypt credential.');
+        encryptedCredential = (0, encryption_1.encrypt)(data.token);
+    }
+    const updated = {
+        ...connections[index],
+        ...(data.name !== undefined && { name: data.name }),
+        ...(data.apiUrl !== undefined && { apiUrl: data.apiUrl }),
+        ...(data.method !== undefined && { method: data.method }),
+        ...(data.prefix !== undefined && { prefix: data.prefix }),
+        ...(data.description !== undefined && { description: data.description }),
+        ...(encryptedCredential !== undefined && { encryptedCredential }),
+    };
+    connections[index] = updated;
+    const result = await ProjectModel.update({ _id: projectId }, { $set: { connections } });
+    if (!result)
+        throw new Error('Failed to update connection.');
+    return updated;
+}
+async function deleteConnection(config, projectId, connectionId) {
+    const ProjectModel = (0, manager_1.getModel)('projects');
+    const project = await ProjectModel.findOne({ _id: projectId });
+    if (!project) {
+        throw new Error('Project not found.');
+    }
+    const updatedProject = await ProjectModel.update({ _id: projectId }, { $pull: { connections: { id: connectionId } } });
+    if (!updatedProject) {
+        throw new Error('Failed to delete connection from project.');
+    }
+}

package/dist/services/connectionResolver.d.ts

@@ -0,0 +1,19 @@
+import { Pool } from 'pg';
+import { MongoClient } from 'mongodb';
+import { StreamByConfig, Auth, DbConnection, StorageConnection, StorageAdapter } from '../types';
+export type ResolvedDbClient = {
+    client: Pool | MongoClient;
+    type: 'sql' | 'nosql';
+    ephemeral: boolean;
+};
+export type ResolveError = {
+    error: string;
+    status: number;
+};
+export declare function findDbConnection(project: any, connId: string): DbConnection | undefined;
+export declare function findStorageConnection(project: any, connId: string): StorageConnection | undefined;
+export declare function resolveDbConnectionClient(project: any, connId: string, config: StreamByConfig, auth: Auth): Promise<ResolvedDbClient | ResolveError>;
+export declare function releaseDbClient(resolved: ResolvedDbClient): Promise<void>;
+export declare function resolveStorageAdapter(project: any, connId: string, config: StreamByConfig & {
+    adapter?: StorageAdapter;
+}, auth: Auth): Promise<StorageAdapter | ResolveError>;

package/dist/services/connectionResolver.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDbConnection = findDbConnection;
+exports.findStorageConnection = findStorageConnection;
+exports.resolveDbConnectionClient = resolveDbConnectionClient;
+exports.releaseDbClient = releaseDbClient;
+exports.resolveStorageAdapter = resolveStorageAdapter;
+const pg_1 = require("pg");
+const mongodb_1 = require("mongodb");
+const connectionManager_1 = require("../adapters/database/connectionManager");
+const builtinAccess_1 = require("../utils/builtinAccess");
+const userIntegration_1 = require("./userIntegration");
+const encryption_1 = require("../utils/encryption");
+const storage_1 = require("../providers/storage");
+const s3_1 = require("../adapters/storage/s3");
+function findDbConnection(project, connId) {
+    return project.dbConnections?.find((c) => c.id === connId);
+}
+function findStorageConnection(project, connId) {
+    return project.storageConnections?.find((c) => c.id === connId);
+}
+// `connId` must be the `id` of a real row in project.dbConnections — never a bare
+// config id (config.databases[].id). Builtin rows reuse the shared pooled client keyed by
+// conn.integrationId (config id); BYOC/manual rows open a short-lived client from their own
+// decrypted credential, which the caller must close via `releaseDbClient` once done.
+async function resolveDbConnectionClient(project, connId, config, auth) {
+    const conn = findDbConnection(project, connId);
+    if (!conn)
+        return { error: 'DB connection not found', status: 404 };
+    if (conn.source === 'builtin') {
+        const builtinId = conn.integrationId;
+        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+            return { error: 'Access to this built-in database is not permitted', status: 403 };
+        }
+        const db = (config.databases ?? []).find(d => d.id === builtinId);
+        if (!db)
+            return { error: `Database '${builtinId}' not found in config`, status: 404 };
+        try {
+            const { client, type } = (0, connectionManager_1.getConnection)(builtinId);
+            return { client: client, type, ephemeral: false };
+        }
+        catch (e) {
+            return { error: e.message, status: 503 };
+        }
+    }
+    let connectionString;
+    if (conn.source === 'integration') {
+        if (!conn.integrationId)
+            return { error: 'Connection is missing its integrationId', status: 500 };
+        const credential = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
+        if (!credential)
+            return { error: 'Integration not found', status: 400 };
+        connectionString = credential;
+    }
+    else {
+        if (!(0, encryption_1.isEncryptionKeySet)())
+            return { error: 'Encryption key is not set', status: 500 };
+        if (!conn.encryptedCredential)
+            return { error: 'Connection has no stored credential', status: 400 };
+        connectionString = (0, encryption_1.decrypt)(conn.encryptedCredential);
+    }
+    const type = conn.dbType === 'postgresql' ? 'sql' : 'nosql';
+    try {
+        if (type === 'sql') {
+            const pool = new pg_1.Pool({ connectionString });
+            await pool.query('SELECT 1');
+            return { client: pool, type, ephemeral: true };
+        }
+        const client = new mongodb_1.MongoClient(connectionString);
+        await client.connect();
+        return { client, type, ephemeral: true };
+    }
+    catch (e) {
+        return { error: `Failed to connect: ${e.message}`, status: 503 };
+    }
+}
+// Only closes clients this resolver opened itself (`ephemeral: true`) — the shared pooled
+// builtin clients are owned by connectionManager and must outlive a single request.
+async function releaseDbClient(resolved) {
+    if (!resolved.ephemeral)
+        return;
+    if (resolved.type === 'sql')
+        await resolved.client.end();
+    else
+        await resolved.client.close();
+}
+async function resolveStorageAdapter(project, connId, config, auth) {
+    const conn = findStorageConnection(project, connId);
+    if (!conn)
+        return { error: 'Storage connection not found', status: 404 };
+    if (conn.source === 'builtin') {
+        const builtinId = conn.integrationId;
+        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'storage'))) {
+            return { error: 'Access to this built-in storage is not permitted', status: 403 };
+        }
+        const provider = config.storageProviders.find(p => p.id === builtinId);
+        if (!provider)
+            return { error: 'Storage provider not found', status: 404 };
+        if (provider.type === 's3')
+            return new s3_1.S3Adapter(provider.config);
+        return config.adapter || (0, storage_1.createStorageProvider)(config.storageProviders);
+    }
+    if (conn.source === 'integration') {
+        if (!conn.integrationId)
+            return { error: 'Connection is missing its integrationId', status: 500 };
+        try {
+            const s3Config = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
+            if (!s3Config)
+                return { error: 'Integration not found', status: 400 };
+            return new s3_1.S3Adapter(s3Config);
+        }
+        catch (e) {
+            return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
+        }
+    }
+    if (!(0, encryption_1.isEncryptionKeySet)())
+        return { error: 'Encryption key not set', status: 500 };
+    if (!conn.encryptedCredential)
+        return { error: 'Connection has no stored credential', status: 400 };
+    try {
+        const s3Config = JSON.parse((0, encryption_1.decrypt)(conn.encryptedCredential));
+        return new s3_1.S3Adapter(s3Config);
+    }
+    catch (e) {
+        return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
+    }
+}

package/dist/services/executor.d.ts

@@ -1,2 +1,7 @@
 import { NodeSchema, StreamByConfig } from '../types';
+export declare class NodeExecutionError extends Error {
+    nodeId: string;
+    nodeType: string;
+    constructor(nodeId: string, nodeType: string, message: string);
+}
 export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig): Promise<any>;

package/dist/services/executor.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeExecutionError = void 0;
 exports.executeExport = executeExport;
-const connectionManager_1 = require("../adapters/database/connectionManager");
 const encryption_1 = require("../utils/encryption");
 const dbConnection_1 = require("./dbConnection");
+const connectionResolver_1 = require("./connectionResolver");
 const jobQueue_1 = require("./jobQueue");
 const mediaProcessor_1 = require("./mediaProcessor");
 const vfxProcessor_1 = require("./vfxProcessor");
@@ -75,6 +76,21 @@ function getTarget(nodes, edges, sourceId, sourceHandle) {
     const edge = edges.find(e => e.source === sourceId && e.sourceHandle === sourceHandle);
     return edge ? (nodes.find(n => n.id === edge.target) ?? null) : null;
 }
+class NodeExecutionError extends Error {
+    constructor(nodeId, nodeType, message) {
+        super(message);
+        this.nodeId = nodeId;
+        this.nodeType = nodeType;
+        this.name = 'NodeExecutionError';
+    }
+}
+exports.NodeExecutionError = NodeExecutionError;
+// Export execution is public (gated by allowedOrigin, not user identity — see
+// export.ts:339) — there is no real Auth to pass through. This sentinel satisfies
+// resolveDbConnectionClient's signature without adding a gate that never existed;
+// canUseBuiltin gating is for connection *management* by a user, not for serving an
+// already-published export.
+const SYSTEM_AUTH = { userId: 'system', username: 'system', role: 'admin' };
 async function executeExport(nodeSchema, project, config) {
     const nodes = nodeSchema.nodes;
     const edges = nodeSchema.edges;
@@ -94,42 +110,41 @@ async function executeExport(nodeSchema, project, config) {
             const tableName = (node.data?.tableName || node.data?.subtitle || node.data?.label);
             if (!tableName)
                 continue;
+            // dataSourceNode always declares its own database connection explicitly (persistence:
+            // 'database' in types/nodePersistence.ts) — a project has no notion of a "default"
+            // connection, since a project can have many database/storage/API providers connected.
             const connectionId = node.data?.connectionId;
+            if (!connectionId) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no database connection — connect one on the node.`);
+            }
             const recordId = node.data?.recordId;
             const projectIdentifier = project._id?.toString() ?? project.id;
-            const fetchData = async (client, type) => recordId
-                ? (0, dbConnection_1.queryRecordByIdInternal)(client, type, tableName, recordId, projectIdentifier)
-                : (0, dbConnection_1.queryRecordsInternal)(client, type, tableName, 500, 0, projectIdentifier);
-            if (connectionId) {
-                const { client, type } = (0, connectionManager_1.getConnection)(connectionId);
-                dataResults.push(await fetchData(client, type));
+            const resolved = await (0, connectionResolver_1.resolveDbConnectionClient)(project, connectionId, config, SYSTEM_AUTH);
+            if ('error' in resolved) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): ${resolved.error}`);
+            }
+            try {
+                dataResults.push(recordId
+                    ? await (0, dbConnection_1.queryRecordByIdInternal)(resolved.client, resolved.type, tableName, recordId, projectIdentifier)
+                    : await (0, dbConnection_1.queryRecordsInternal)(resolved.client, resolved.type, tableName, 500, 0, projectIdentifier));
             }
-            else {
-                // legacy fallback for nodes saved before connectionId was introduced
-                const targetDb = config.databases?.find((db) => db.type === project.dbType && db.main)
-                    ?? config.databases?.find((db) => db.type === project.dbType);
-                if (!targetDb)
-                    throw new Error(`No database connection for type ${project.dbType}`);
-                const { client, type } = (0, connectionManager_1.getConnection)(targetDb.id);
-                dataResults.push(await fetchData(client, type));
+            finally {
+                await (0, connectionResolver_1.releaseDbClient)(resolved);
             }
         }
-        else if (node.type === 'apiConnectionNode') {
-            const apiConnection = project.apiConnections?.find((c) => c.id === node.data?.connectionId);
-            if (!apiConnection)
+        else if (node.type === 'connectionNode') {
+            const connection = project.connections?.find((c) => c.id === node.data?.connectionId);
+            if (!connection)
                 continue;
             const headers = { 'Content-Type': 'application/json' };
-            if (apiConnection.credentialId && (0, encryption_1.isEncryptionKeySet)()) {
-                const credential = project.credentials?.find((c) => c.id === apiConnection.credentialId);
-                if (credential) {
-                    const decrypted = (0, encryption_1.decrypt)(credential.encryptedValue);
-                    const prefix = apiConnection.prefix ? `${apiConnection.prefix} ` : '';
-                    headers['Authorization'] = `${prefix}${decrypted}`;
-                }
+            if (connection.encryptedCredential && (0, encryption_1.isEncryptionKeySet)()) {
+                const decrypted = (0, encryption_1.decrypt)(connection.encryptedCredential);
+                const prefix = connection.prefix ? `${connection.prefix} ` : '';
+                headers['Authorization'] = `${prefix}${decrypted}`;
             }
-            const response = await fetch(apiConnection.apiUrl, { method: apiConnection.method || 'GET', headers });
+            const response = await fetch(connection.apiUrl, { method: connection.method || 'GET', headers });
             if (!response.ok)
-                throw new Error(`API connection fetch failed: ${response.statusText}`);
+                throw new Error(`Connection fetch failed: ${response.statusText}`);
             dataResults.push(await response.json());
         }
     }
@@ -173,6 +188,17 @@ async function executeExport(nodeSchema, project, config) {
             payload = { ...payload, jobId: job.jobId, jobType: 'thumbnail' };
         }
         else if (processNode.type === 'ingestNode' && fileId) {
+            // ingestNode always declares its own storage connection explicitly (persistence:
+            // 'storage' in types/nodePersistence.ts) — a project has no notion of a "default"
+            // connection, since a project can have many database/storage/API providers connected.
+            const storageConnectionId = nodeData.storageConnectionId;
+            if (!storageConnectionId) {
+                throw new NodeExecutionError(processNode.id, processNode.type, `Node '${processNode.id}' (${processNode.type}) has no storage connection — connect one on the node.`);
+            }
+            const storageResolved = await (0, connectionResolver_1.resolveStorageAdapter)(project, storageConnectionId, config, SYSTEM_AUTH);
+            if ('error' in storageResolved) {
+                throw new NodeExecutionError(processNode.id, processNode.type, `Node '${processNode.id}' (${processNode.type}): ${storageResolved.error}`);
+            }
             const job = (0, jobQueue_1.createJob)('ingest', systemUserId, projectId, nodeData);
             setImmediate(() => (0, mediaProcessor_1.runIngestJob)(job.jobId, fileId, projectId));
             payload = { ...payload, jobId: job.jobId, jobType: 'ingest' };

package/dist/services/projectIntegration.js

@@ -22,7 +22,7 @@ async function classifyIntegrationId(id, auth, config, projectId) {
             kind: 'database',
             connection: {
                 id: crypto_1.default.randomUUID(), name: builtinAccess_1.BUILTIN_DB_DISPLAY[db.type] ?? db.type, dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
-                credentialId: '', projectId, createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+                projectId, createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
             },
         };
     }
@@ -35,7 +35,7 @@ async function classifyIntegrationId(id, auth, config, projectId) {
             kind: 'storage',
             connection: {
                 id: crypto_1.default.randomUUID(), name: builtinAccess_1.BUILTIN_STORAGE_DISPLAY[provider.type] ?? provider.type, type: provider.type,
-                credentialId: '', projectId, createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+                projectId, createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
             },
         };
     }
@@ -49,7 +49,7 @@ async function classifyIntegrationId(id, auth, config, projectId) {
             kind: 'database',
             connection: {
                 id: crypto_1.default.randomUUID(), name: integration.name, dbType: integration.provider,
-                credentialId: '', projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+                projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
             },
         };
     }
@@ -57,7 +57,7 @@ async function classifyIntegrationId(id, auth, config, projectId) {
         kind: 'storage',
         connection: {
             id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
-            credentialId: '', projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+            projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
         },
     };
 }

package/dist/types/index.d.ts

@@ -12,7 +12,7 @@ export interface StorageConnection {
     id: string;
     name: string;
     type: StorageConnectionType;
-    credentialId: string;
+    encryptedCredential?: string;
     projectId: string;
     createdAt: Date;
     description?: string;
@@ -73,29 +73,35 @@ export interface ProjectInfo {
         allowUpload?: boolean;
         allowSharing?: boolean;
     };
-    credentials?: Credential[];
-    apiConnections?: ApiConnection[];
+    connections?: Connection[];
     dbConnections?: DbConnection[];
     storageConnections?: StorageConnection[];
     pipelines?: PipelineRef[];
     builtinBackfilledAt?: Date;
+    workflow?: Workflow;
 }
-export interface Credential {
+export type NodePersistence = 'database' | 'storage' | 'both' | 'none';
+export interface Workflow {
     id: string;
-    key: string;
-    encryptedValue: string;
+    name: string;
+    description?: string;
+    status: string;
+    projectId: string;
+    nodeSchema: NodeSchema | null;
+    createdAt: Date;
+    updatedAt: Date;
 }
-export type ApiConnectionMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
-export interface ApiConnection {
+export type ConnectionMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+export interface Connection {
     id: string;
     name: string;
     apiUrl: string;
-    method: ApiConnectionMethod;
+    method: ConnectionMethod;
     projectId: string;
     createdAt: Date;
     prefix?: string;
     description?: string;
-    credentialId?: string;
+    encryptedCredential?: string;
 }
 export interface ProjectListInfo {
     id: string;
@@ -153,7 +159,7 @@ export interface DbConnection {
     id: string;
     name: string;
     dbType: ExternalDbType;
-    credentialId: string;
+    encryptedCredential?: string;
     projectId: string;
     createdAt: Date;
     description?: string;
@@ -214,7 +220,7 @@ export interface Export {
     fields?: FieldDefinition[];
     jsonData?: any;
     apiUrl?: string;
-    credentialId?: string;
+    encryptedCredential?: string;
     prefix?: string;
     private?: boolean;
     allowedOrigin?: string[];
@@ -244,7 +250,7 @@ export interface DistributionConnection {
     id: string;
     name: string;
     target: DistributionTarget;
-    credentialId?: string;
+    encryptedCredential?: string;
     projectId: string;
     config: Record<string, string>;
     createdAt: Date;
@@ -289,7 +295,7 @@ export interface RenderFarmConnection {
     name: string;
     provider: RenderFarmProvider;
     apiUrl: string;
-    credentialId?: string;
+    encryptedCredential?: string;
     projectId: string;
     createdAt: Date;
     description?: string;

package/dist/types/nodePersistence.d.ts

@@ -0,0 +1,3 @@
+import { NodePersistence } from './index';
+export declare const NODE_PERSISTENCE: Record<string, NodePersistence>;
+export declare function getNodePersistence(nodeType: string): NodePersistence;

package/dist/types/nodePersistence.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_PERSISTENCE = void 0;
+exports.getNodePersistence = getNodePersistence;
+// Only node types that write to a real database/storage connection need an entry here.
+// Process nodes (transcodeNode, captionNode, etc.) operate on a fileId already resolved by
+// the internal job pipeline (mediaProcessor.ts), not directly on project connections, so
+// they're 'none' — same for filter/deliverable/distribution/annotation/connection nodes.
+exports.NODE_PERSISTENCE = {
+    dataSourceNode: 'database',
+    ingestNode: 'storage',
+};
+function getNodePersistence(nodeType) {
+    return exports.NODE_PERSISTENCE[nodeType] ?? 'none';
+}

package/dist/utils/sanitize.d.ts

@@ -1,2 +1,12 @@
+export declare function sanitizeConnection<T extends {
+    encryptedCredential?: string;
+}>(conn: T): Omit<T, 'encryptedCredential'> & {
+    hasCredential: boolean;
+};
+export declare function sanitizeConnections<T extends {
+    encryptedCredential?: string;
+}>(conns: T[] | undefined): (Omit<T, 'encryptedCredential'> & {
+    hasCredential: boolean;
+})[];
 export declare function sanitizeProject(project: any): any;
 export declare function sanitizeUserIntegration(integration: any): any;