fix(ci): restore staging files the branch split had reverted, and format

Three problems, all from assembling this branch by checking paths out of a WIP
branch built on an older `staging`. Anything `staging` changed since that base
came back as a revert.

- Root `package.json` had lost the `opentype.js` / `@types/opentype.js`
  dependencies `staging` added, which desynced `bun.lock` and failed `bun audit`.
  It also carried a `check:outbound-delivery` script belonging to other work.
  Every `package.json` is now taken from `staging` with only the `engines.bun`
  line re-applied.
- `executor/utils/block-data.test.ts` — a 77-line file `staging` added — was
  deleted outright. Restored.
- `executor/handlers/generic/generic-handler.test.ts` had lost a test `staging`
  added. Restored, with only the one `blockId` assertion re-applied.

Also formats `keyed-invocation-identity.test.ts` and sorts imports in
`internal-api-base-url.test.ts`, which is what `lint:check` failed on.

Author: icecrasher321

apps/sim/executor/handlers/generic/generic-handler.test.ts

@@ -1,6 +1,7 @@
 import '@sim/testing/mocks/executor'
 
 import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
+import { HarmonicBlock } from '@/blocks/blocks/harmonic'
 import { KnowledgeBlock } from '@/blocks/blocks/knowledge'
 import { getBlock } from '@/blocks/index'
 import { BlockType } from '@/executor/constants'
@@ -490,6 +491,47 @@ describe('GenericBlockHandler', () => {
     expect(transform).toHaveBeenCalledTimes(1)
   })
 
+  it('does not expose an invalid resolved Harmonic batch value in handler errors', async () => {
+    const resolvedSecret = 'sk-live-invalid-json-secret'
+    mockBlock.metadata = { id: 'harmonic', name: 'Harmonic' }
+    mockGetBlock.mockReturnValue(HarmonicBlock)
+    mockExecuteTool.mockResolvedValue({
+      success: false,
+      error: 'Harmonic "personUrns" must be a JSON array',
+    })
+
+    const registry = new ResolvedSecretTraceRegistry([
+      {
+        name: 'BATCH_IDENTIFIERS',
+        plaintext: resolvedSecret,
+        encryptedValue: 'encrypted-batch-identifiers',
+      },
+    ])
+    registry.recordResolvedAtInputPath('BATCH_IDENTIFIERS', resolvedSecret, ['personUrns'])
+    registry.recordResolvedInputProjection(['personUrns'], resolvedSecret, '{{BATCH_IDENTIFIERS}}')
+    mockContext.resolvedSecretTraceRegistry = registry
+
+    let thrown: unknown
+    try {
+      await handler.execute(mockContext, mockBlock, {
+        operation: 'harmonic_batch_get_people',
+        oauthCredential: 'credential-id',
+        personUrns: resolvedSecret,
+      })
+    } catch (error) {
+      thrown = error
+    }
+
+    expect(thrown).toBeInstanceOf(Error)
+    expect((thrown as Error).message).toBe('Harmonic "personUrns" must be a JSON array')
+    expect((thrown as Error).message).not.toContain(resolvedSecret)
+    expect(mockExecuteTool).toHaveBeenCalledWith(
+      'some_custom_tool',
+      expect.objectContaining({ personUrns: resolvedSecret }),
+      { executionContext: mockContext }
+    )
+  })
+
   it('should throw error if the associated tool is not found', async () => {
     const inputs = { param1: 'value' }
 

apps/sim/executor/handlers/generic/keyed-invocation-identity.test.ts

@@ -65,11 +65,21 @@ describe('keyed invocation identity', () => {
 
   it('separates two different blocks inside one execution', () => {
     const a = deriveDeliveryKey(
-      { executionId: 'exec-1', blockId: 'block-a', toolId: 'brex_create_transfer', invocationId: '1' },
+      {
+        executionId: 'exec-1',
+        blockId: 'block-a',
+        toolId: 'brex_create_transfer',
+        invocationId: '1',
+      },
       'brex_create_transfer'
     )
     const b = deriveDeliveryKey(
-      { executionId: 'exec-1', blockId: 'block-b', toolId: 'brex_create_transfer', invocationId: '1' },
+      {
+        executionId: 'exec-1',
+        blockId: 'block-b',
+        toolId: 'brex_create_transfer',
+        invocationId: '1',
+      },
       'brex_create_transfer'
     )
 
@@ -78,11 +88,21 @@ describe('keyed invocation identity', () => {
 
   it('separates the same block across two executions', () => {
     const first = deriveDeliveryKey(
-      { executionId: 'exec-1', blockId: 'block-1', toolId: 'brex_create_transfer', invocationId: '1' },
+      {
+        executionId: 'exec-1',
+        blockId: 'block-1',
+        toolId: 'brex_create_transfer',
+        invocationId: '1',
+      },
       'brex_create_transfer'
     )
     const second = deriveDeliveryKey(
-      { executionId: 'exec-2', blockId: 'block-1', toolId: 'brex_create_transfer', invocationId: '1' },
+      {
+        executionId: 'exec-2',
+        blockId: 'block-1',
+        toolId: 'brex_create_transfer',
+        invocationId: '1',
+      },
       'brex_create_transfer'
     )
 

apps/sim/executor/utils/block-data.test.ts

@@ -0,0 +1,77 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { getBlockSchema } from '@/executor/utils/block-data'
+import { resolveBlockReference } from '@/executor/utils/block-reference'
+import type { SerializedBlock } from '@/serializer/types'
+
+/**
+ * These assertions are about what the real block registry publishes, so the global stub — which
+ * returns one mock block with no outputs — would make every case here pass vacuously.
+ */
+vi.unmock('@/blocks/registry')
+
+function triggerBlock(type: string, params: Record<string, unknown> = {}): SerializedBlock {
+  return {
+    id: 'trigger-1',
+    metadata: { id: type, name: 'webhook1', category: 'triggers' },
+    position: { x: 0, y: 0 },
+    config: { tool: '', params },
+    inputs: {},
+    outputs: {},
+    enabled: true,
+  } as unknown as SerializedBlock
+}
+
+function resolve(
+  pathParts: string[],
+  schema: ReturnType<typeof getBlockSchema>
+): ReturnType<typeof resolveBlockReference> {
+  return resolveBlockReference(
+    'webhook1',
+    pathParts,
+    {
+      blockNameMapping: { webhook1: 'trigger-1' },
+      blockData: { 'trigger-1': { query: { env: 'prod' } } },
+      blockOutputSchemas: schema ? { 'trigger-1': schema } : {},
+    } as never,
+    {} as never
+  )
+}
+
+describe('generic webhook output schema', () => {
+  /**
+   * A generic webhook receives whatever the caller sends, so it must publish no schema at all.
+   * `collectBlockData` registers any non-empty output declaration as exhaustive, which turns
+   * every unlisted field into a hard `InvalidFieldError` rather than an absent value.
+   */
+  it('publishes no output schema, leaving the block shape open', () => {
+    expect(getBlockSchema(triggerBlock('generic_webhook'))).toBeUndefined()
+  })
+
+  it.each([
+    [{}, 'no flags set'],
+    [{ acceptOtherMethods: true, exposeRequestHeaders: true }, 'both request-metadata flags on'],
+  ])('stays open with %o (%s)', (params) => {
+    expect(getBlockSchema(triggerBlock('generic_webhook', params))).toBeUndefined()
+  })
+
+  /**
+   * The production regression this pins: a Slack interactive payload reaching a workflow that
+   * reads `actions.0.selected_option.value`. When a delivery omits the field the reference must
+   * resolve to `undefined` so the condition simply evaluates falsy — not abort the run.
+   */
+  it('resolves an absent body field to undefined instead of throwing', () => {
+    const schema = getBlockSchema(triggerBlock('generic_webhook'))
+
+    expect(() => resolve(['actions', '0', 'selected_option', 'value'], schema)).not.toThrow()
+    expect(resolve(['actions', '0', 'selected_option', 'value'], schema)?.value).toBeUndefined()
+  })
+
+  it('still resolves request metadata the provider merges into the input', () => {
+    const schema = getBlockSchema(triggerBlock('generic_webhook'))
+
+    expect(resolve(['query', 'env'], schema)?.value).toBe('prod')
+  })
+})

apps/sim/lib/core/utils/internal-api-base-url.test.ts

@@ -13,7 +13,6 @@
  */
 import { resetEnvMock, setEnv } from '@sim/testing'
 import { afterEach, describe, expect, it } from 'vitest'
-
 import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
 
 const PUBLIC_URL = 'https://sim.ai'

apps/sim/package.json

@@ -208,6 +208,7 @@
     "nuqs": "2.8.9",
     "officeparser": "^5.2.0",
     "openai": "7.0.0",
+    "opentype.js": "1.3.4",
     "pdf-lib": "1.17.1",
     "pdfjs-dist": "5.4.296",
     "postgres": "^3.4.5",
@@ -264,6 +265,7 @@
     "@types/mssql": "12.3.0",
     "@types/node": "24.2.1",
     "@types/nodemailer": "8.0.1",
+    "@types/opentype.js": "1.3.10",
     "@types/prismjs": "^1.26.5",
     "@types/react": "^19",
     "@types/react-dom": "^19",

package.json

@@ -51,7 +51,6 @@
     "check:icon-path-precision": "bun run scripts/check-icon-path-precision.ts",
     "check:migrations": "bun run scripts/check-migrations-safety.ts",
     "check:native-typecheck": "bun run scripts/check-native-typecheck.ts",
-    "check:outbound-delivery": "bun run scripts/check-outbound-delivery.ts",
     "check:source-text": "bun run scripts/check-source-text.ts",
     "check:audits": "bun run scripts/run-audits.ts",
     "check:skills": "bun run scripts/sync-skills.ts --check",