chore: improve monitoring for fix(front): guard undefined recordNode in cache ma

Added code-level monitoring in `getRecordsFromRecordConnection` for malformed connection payloads: edges with missing `node` are now filtered out (to avoid downstream failures) and reported to Sentry as a warning-level message with grouped fingerprint and counts (`invalidEdgeCount`, `edgesCount`). This reduces noisy high-severity exception capture while preserving actionable signal about data-shape anomalies.

.cursor/rules/github-actions-security.mdc

@@ -1,72 +0,0 @@
----
-description: GitHub Actions security guidelines for supply chain protection
-globs: **/.github/**/*.yml, **/.github/**/*.yaml
-alwaysApply: false
----
-
-# GitHub Actions Security
-
-## Pin Third-Party Actions to Commit SHAs
-
-Always reference external actions and reusable workflows by their full commit SHA, never by a mutable tag or branch. Tags can be force-pushed by a compromised maintainer account.
-
-```yaml
-# ❌ Mutable tag — vulnerable to supply chain attacks
-uses: actions/checkout@v4
-uses: actions/setup-node@v4
-
-# ✅ Pinned to commit SHA with tag comment for readability
-uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-```
-
-## Prefer `gh api` Over Third-Party Dispatch Actions
-
-For repository dispatch calls, use `gh api` directly instead of third-party actions like `peter-evans/repository-dispatch`. This eliminates a supply-chain dependency entirely.
-
-```yaml
-# ✅ Use env vars + bracket notation to prevent injection
-- name: Dispatch to target repo
-  env:
-    GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
-    PR_NUMBER: ${{ github.event.pull_request.number }}
-    BRANCH: ${{ github.event.workflow_run.head_branch }}
-  run: |
-    gh api repos/org/repo/dispatches \
-      -f event_type=my-event \
-      -f "client_payload[pr_number]=$PR_NUMBER" \
-      -f "client_payload[branch]=$BRANCH"
-
-# ✅ Simple dispatch without payload
-- name: Trigger workflow
-  env:
-    GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
-  run: |
-    gh api repos/org/repo/dispatches -f event_type=my-event
-
-# ❌ Third-party action dependency
-- uses: peter-evans/repository-dispatch@v2
-  with:
-    token: ${{ secrets.DISPATCH_TOKEN }}
-    repository: org/repo
-    event-type: my-event
-
-# ❌ Inline ${{ }} in shell — vulnerable to injection
-- run: |
-    gh api repos/org/repo/dispatches --input - <<EOF
-    {"event_type": "x", "client_payload": {"branch": "${{ github.head_ref }}"}}
-    EOF
-```
-
-## Minimal Permissions
-
-Always declare explicit `permissions` at the job level with the least privilege required. Never rely on the default `GITHUB_TOKEN` permissions.
-
-```yaml
-# ✅ Explicit minimal permissions
-permissions:
-  contents: read
-
-# ❌ Overly broad or implicit permissions
-permissions: write-all
-```

.github/CODEOWNERS

@@ -1,6 +0,0 @@
-/.github/              @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
-/.github/CODEOWNERS    @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
-/.github/workflows/    @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
-/.github/actions/      @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
-/.github/dependabot.yml @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
-/.yarnrc.yml           @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp

.github/actions/deploy-twenty-app/action.yml

@@ -21,7 +21,7 @@ runs:
       run: corepack enable
 
     - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      uses: actions/setup-node@v4
       with:
         node-version-file: '${{ inputs.app-path }}/.nvmrc'
         cache: yarn

.github/actions/install-twenty-app/action.yml

@@ -21,7 +21,7 @@ runs:
       run: corepack enable
 
     - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      uses: actions/setup-node@v4
       with:
         node-version-file: '${{ inputs.app-path }}/.nvmrc'
         cache: yarn

.github/actions/nx-affected/action.yaml

@@ -20,7 +20,7 @@ runs:
       run: git fetch origin main --depth=1
     - name: Get last successful commit
       if: env.NX_BASE == ''
-      uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
+      uses: nrwl/nx-set-shas@v4
     - name: Fallback to origin/main if no base found
       if: env.NX_BASE == ''
       shell: bash

.github/actions/restore-cache/action.yaml

@@ -25,7 +25,7 @@ runs:
       run: |
         echo "CACHE_PRIMARY_KEY_PREFIX=v4-${CACHE_KEY}-${REF_NAME}" >> "${GITHUB_OUTPUT}"
     - name: Restore cache
-      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore)
+      uses: actions/cache/restore@v4
       id: restore-cache
       with:
         key: ${{ steps.cache-primary-key-builder.outputs.CACHE_PRIMARY_KEY_PREFIX }}-${{ github.sha }}

.github/actions/save-cache/action.yaml

@@ -9,11 +9,8 @@ inputs:
 runs:
   using: "composite"
   steps:
-    # Fork PRs on pull_request already can't write to the base repo's cache (GitHub built-in).
-    # The fork guard is defense-in-depth for pull_request_target, which does have write access.
     - name: Save cache
-      if: ${{ format('{0}', github.event.pull_request.head.repo.fork) != 'true' }}
-      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save)
+      uses: actions/cache/save@v4
       with:
         key: ${{ inputs.key }}
         path: |

.github/actions/spawn-twenty-docker-image/action.yaml

@@ -48,7 +48,7 @@ runs:
         fi
 
     - name: Checkout docker compose files
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@v4
       with:
         repository: ${{ inputs.twenty-repository }}
         ref: ${{ steps.resolve.outputs.git-ref }}

.github/actions/yarn-install/action.yaml

@@ -29,12 +29,12 @@ runs:
         echo "packages/*/node_modules" >> $GITHUB_OUTPUT
         echo 'EOF' >> $GITHUB_OUTPUT
     - name: Setup Node.js and get yarn cache
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
     - name: Restore node_modules
       id: cache-node-modules
-      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore)
+      uses: actions/cache/restore@v4
       with:
         key: v4-${{ steps.globals.outputs.CACHE_KEY_PREFIX }}-${{github.sha}}
         restore-keys: v4-${{ steps.globals.outputs.CACHE_KEY_PREFIX }}-
@@ -44,13 +44,10 @@ runs:
       shell: ${{ steps.globals.outputs.ACTION_SHELL }}
       run: |
         yarn config set enableHardenedMode true
-        yarn config set enableScripts false
         yarn --immutable --check-cache
-    # Fork PRs on pull_request already can't write to the base repo's cache (GitHub built-in).
-    # The fork guard is defense-in-depth for pull_request_target, which does have write access.
     - name: Save cache
-      if: ${{ steps.cache-node-modules.outputs.cache-hit != 'true' && steps.cache-node-modules.outputs.cache-matched-key == '' && format('{0}', github.event.pull_request.head.repo.fork) != 'true' }}
-      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save)
+      if: ${{ steps.cache-node-modules.outputs.cache-hit != 'true' && steps.cache-node-modules.outputs.cache-matched-key == '' }}
+      uses: actions/cache/save@v4
       with:
         key: ${{ steps.cache-node-modules.outputs.cache-primary-key }}
         path: ${{ steps.globals.outputs.PATH_TO_CACHE }}

.github/workflows/cd-deploy-main.yaml

@@ -14,8 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Dispatch
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches \
-            -f event_type=auto-deploy-main
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: auto-deploy-main
+          client-payload: '{"github": ${{ toJson(github) }}}' # Passes the entire github context to the downstream workflow

.github/workflows/cd-deploy-tag.yaml

@@ -14,10 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Dispatch
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches \
-            -f event_type=auto-deploy-tag \
-            -f "client_payload[github][ref_name]=$REF_NAME"
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: auto-deploy-tag
+          client-payload: '{"github": ${{ toJson(github) }}}' # Passes the entire github context to the downstream workflow

.github/workflows/changed-files.yaml

@@ -21,11 +21,11 @@ jobs:
       any_changed: ${{ steps.changed-files.outputs.any_changed }}
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Check for changed files
         id: changed-files
-        uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9
+        uses: tj-actions/changed-files@v45
         with:
           files: ${{ inputs.files }}

.github/workflows/ci-ai-catalog-sync.yaml

@@ -17,7 +17,7 @@ jobs:
       NODE_OPTIONS: '--max-old-space-size=4096'
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           ref: main
 
@@ -41,7 +41,7 @@ jobs:
 
       - name: Create pull request
         if: steps.changes.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.6
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'chore: sync AI model catalog from models.dev'
@@ -61,7 +61,8 @@ jobs:
 
       - name: Trigger automerge
         if: steps.changes.outputs.changed == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches -f event_type=automated-pr-ready
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: automated-pr-ready

.github/workflows/ci-breaking-changes.yaml

@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout current branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
 
@@ -634,7 +634,7 @@ jobs:
 
       - name: Upload breaking changes report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: breaking-changes-report
           path: |

.github/workflows/ci-create-app-e2e-hello-world.yaml

@@ -57,7 +57,7 @@ jobs:
       TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
 

.github/workflows/ci-create-app-e2e-minimal.yaml

@@ -55,7 +55,7 @@ jobs:
       TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
 

.github/workflows/ci-create-app-e2e-postcard.yaml

@@ -57,7 +57,7 @@ jobs:
       TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
 

.github/workflows/ci-create-app.yaml

@@ -30,8 +30,12 @@ jobs:
       matrix:
         task: [lint, typecheck, test]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/ci-docs.yaml

@@ -28,8 +28,13 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
+
       - name: Fetch local actions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
 

.github/workflows/ci-emails.yaml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/ci-example-app-hello-world.yaml

@@ -54,7 +54,7 @@ jobs:
       TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
 
       - name: Install dependencies
         uses: ./.github/actions/yarn-install

.github/workflows/ci-example-app-postcard.yaml

@@ -54,7 +54,7 @@ jobs:
       TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
 
       - name: Install dependencies
         uses: ./.github/actions/yarn-install

.github/workflows/ci-front-component-renderer.yaml

@@ -32,8 +32,12 @@ jobs:
       matrix:
         task: [build, typecheck, lint]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -46,8 +50,12 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -55,7 +63,7 @@ jobs:
       - name: Build storybook
         run: npx nx storybook:build twenty-front-component-renderer
       - name: Upload storybook build
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: storybook-twenty-front-component-renderer
           path: packages/twenty-front-component-renderer/storybook-static
@@ -68,7 +76,7 @@ jobs:
       STORYBOOK_URL: http://localhost:6008
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -76,7 +84,7 @@ jobs:
       - name: Build dependencies
         run: npx nx build twenty-sdk
       - name: Download storybook build
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4
         with:
           name: storybook-twenty-front-component-renderer
           path: packages/twenty-front-component-renderer/storybook-static

.github/workflows/ci-front.yaml

@@ -38,8 +38,12 @@ jobs:
     env:
       REACT_APP_SERVER_BASE_URL: http://localhost:3000
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch local actions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -51,7 +55,7 @@ jobs:
       - name: Front / Build storybook
         run: npx nx storybook:build twenty-front
       - name: Upload storybook build
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: storybook-static
           path: packages/twenty-front/storybook-static
@@ -75,7 +79,7 @@ jobs:
       STORYBOOK_URL: http://localhost:6006
     steps:
       - name: Fetch local actions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -92,7 +96,7 @@ jobs:
           npx nx build twenty-ui
           npx nx build twenty-front-component-renderer
       - name: Download storybook build
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4
         with:
           name: storybook-static
           path: packages/twenty-front/storybook-static
@@ -117,7 +121,7 @@ jobs:
       #       exit 1
       #     fi
       # - name: Upload coverage artifact
-      #   uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      #   uses: actions/upload-artifact@v4
       #   with:
       #     retention-days: 1
       #     name: coverage-artifacts-${{ matrix.storybook_scope }}-${{ github.run_id }}-${{ matrix.shard }}
@@ -132,12 +136,12 @@ jobs:
   #     matrix:
   #       storybook_scope: [modules, pages, performance]
   #   steps:
-  #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+  #     - uses: actions/checkout@v4
   #       with:
   #         fetch-depth: 10
   #     - name: Install dependencies
   #       uses: ./.github/actions/yarn-install
-  #     - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+  #     - uses: actions/download-artifact@v4
   #       with:
   #         pattern: coverage-artifacts-${{ matrix.storybook_scope }}-${{ github.run_id }}-*
   #         merge-multiple: true
@@ -160,8 +164,12 @@ jobs:
       matrix:
         task: [lint, typecheck, test]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -195,8 +203,12 @@ jobs:
       NODE_OPTIONS: "--max-old-space-size=10240"
       ANALYZE: "true"
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -206,7 +218,7 @@ jobs:
       - name: Build frontend
         run: npx nx build twenty-front
       # - name: Upload frontend build artifact
-      #   uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      #   uses: actions/upload-artifact@v4
       #   with:
       #     name: frontend-build
       #     path: packages/twenty-front/build

.github/workflows/ci-merge-queue.yaml

@@ -41,11 +41,11 @@ jobs:
         ports:
           - 6379:6379
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 10
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@v4
         with:
           node-version: lts/*
 
@@ -53,7 +53,7 @@ jobs:
         uses: ./.github/actions/yarn-install
 
       - name: Restore Nx build cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore)
+        uses: actions/cache/restore@v4
         with:
           key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }}
           restore-keys: |
@@ -83,7 +83,7 @@ jobs:
 
       - name: Save Nx build cache
         if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save)
+        uses: actions/cache/save@v4
         with:
           key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }}
           path: |
@@ -119,7 +119,7 @@ jobs:
 
       - name: Upload Playwright results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: playwright-results
           path: |

.github/workflows/ci-release-create.yaml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.ref }}
 
@@ -47,7 +47,7 @@ jobs:
           printf '%s\n' "$VERSION" > version.txt
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@v6
         with:
           branch: release/${{ steps.sanitize.outputs.version }}
           commit-message: "chore: release v${{ steps.sanitize.outputs.version }}"

.github/workflows/ci-release-merge.yaml

@@ -30,7 +30,7 @@ jobs:
           fi
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           ref: main
 
@@ -55,7 +55,7 @@ jobs:
           git tag "v${{ env.VERSION }}"
           git push origin "v${{ env.VERSION }}"
 
-      - uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5
+      - uses: release-drafter/release-drafter@v5
         if: contains(github.event.pull_request.labels.*.name, 'create_release')
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci-sdk.yaml

@@ -30,8 +30,12 @@ jobs:
       matrix:
         task: [lint, typecheck, test:unit, test:integration]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -70,7 +74,7 @@ jobs:
       TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/ci-server.yaml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Get changed upgrade-version-command files
         id: changed-files
-        uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9
+        uses: tj-actions/changed-files@v45
         with:
           files: |
             packages/twenty-server/src/database/commands/upgrade-version-command/**
@@ -178,7 +178,7 @@ jobs:
           - 6379:6379
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -278,7 +278,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -341,7 +341,7 @@ jobs:
       SHARD_COUNTER: 10
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/ci-shared.yaml

@@ -29,8 +29,12 @@ jobs:
       matrix:
         task: [lint, typecheck, test]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/ci-test-docker-compose.yaml

@@ -26,9 +26,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -101,9 +101,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/ci-ui.yaml

@@ -30,8 +30,12 @@ jobs:
       matrix:
         task: [lint, typecheck, test]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -44,8 +48,12 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -53,7 +61,7 @@ jobs:
       - name: Build storybook
         run: npx nx storybook:build twenty-ui
       - name: Upload storybook build
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: storybook-twenty-ui
           path: packages/twenty-ui/storybook-static
@@ -66,7 +74,7 @@ jobs:
       STORYBOOK_URL: http://localhost:6007
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -74,7 +82,7 @@ jobs:
       - name: Build dependencies
         run: npx nx build twenty-shared
       - name: Download storybook build
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4
         with:
           name: storybook-twenty-ui
           path: packages/twenty-ui/storybook-static

.github/workflows/ci-utils.yaml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.action != 'closed'
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
       - name: Install dependencies
         uses: ./.github/actions/yarn-install
       - name: Utils / Run Danger.js
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.action == 'closed' && github.event.pull_request.merged == true
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
       - name: Install dependencies
         uses: ./.github/actions/yarn-install
       - name: Run congratulate-dangerfile.js

.github/workflows/ci-website.yaml

@@ -32,8 +32,12 @@ jobs:
       matrix:
         task: [lint, typecheck, test]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/ci-zapier.yaml

@@ -46,7 +46,7 @@ jobs:
           - 6379:6379
     steps:
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies
@@ -97,8 +97,12 @@ jobs:
       matrix:
         task: [lint, typecheck, validate]
     steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ github.token }}
       - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 10
       - name: Install dependencies

.github/workflows/claude.yml

@@ -8,12 +8,10 @@ on:
   pull_request_review:
     types: [submitted]
   issues:
-    types: [opened]
+    types: [opened, assigned]
   repository_dispatch:
     types: [claude-core-team-issues]
 
-permissions: {}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number || github.event.client_payload.issue_number }}
   cancel-in-progress: false
@@ -21,36 +19,17 @@ concurrency:
 jobs:
   claude:
     if: |
-      (
-        github.event_name == 'issue_comment' &&
-        contains(github.event.comment.body, '@claude') &&
-        github.event.comment.user.type != 'Bot' &&
-        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      ) ||
-      (
-        github.event_name == 'pull_request_review_comment' &&
-        contains(github.event.comment.body, '@claude') &&
-        github.event.comment.user.type != 'Bot' &&
-        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      ) ||
-      (
-        github.event_name == 'pull_request_review' &&
-        contains(github.event.review.body, '@claude') &&
-        github.event.review.user.type != 'Bot' &&
-        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)
-      ) ||
-      (
-        github.event_name == 'issues' &&
-        github.event.action == 'opened' &&
-        (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
-        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)
-      )
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.type != 'Bot') ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.type != 'Bot') ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && github.event.review.user.type != 'Bot') ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
       contents: write
       pull-requests: write
       issues: write
+      id-token: write
     services:
       postgres:
         image: postgres:16
@@ -71,14 +50,14 @@ jobs:
           - 6379:6379
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Install dependencies
         uses: ./.github/actions/yarn-install
       - name: Run Claude Code
         id: claude-code
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30 # v1
+        uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |
@@ -123,6 +102,7 @@ jobs:
       contents: write
       pull-requests: write
       issues: write
+      id-token: write
     services:
       postgres:
         image: postgres:16
@@ -142,14 +122,14 @@ jobs:
         ports:
           - 6379:6379
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Install dependencies
         uses: ./.github/actions/yarn-install
       - name: Build prompt from dispatch payload
         id: prompt
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@v7
         with:
           script: |
             const p = context.payload.client_payload;
@@ -164,7 +144,7 @@ jobs:
             core.setOutput('issue_number', p.issue_number);
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30 # v1
+        uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           prompt: ${{ steps.prompt.outputs.prompt }}
@@ -179,16 +159,9 @@ jobs:
             }
       - name: Dispatch response to ci-privileged
         if: always()
-        env:
-          GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
-          REPO: ${{ steps.prompt.outputs.repo }}
-          ISSUE_NUMBER: ${{ steps.prompt.outputs.issue_number }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          gh api repos/twentyhq/ci-privileged/dispatches \
-            -f event_type=claude-cross-repo-response \
-            -f "client_payload[repo]=$REPO" \
-            -f "client_payload[issue_number]=$ISSUE_NUMBER" \
-            -f "client_payload[run_id]=$RUN_ID" \
-            -f "client_payload[run_url]=$RUN_URL"
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
+          repository: twentyhq/ci-privileged
+          event-type: claude-cross-repo-response
+          client-payload: '{"repo": ${{ toJSON(steps.prompt.outputs.repo) }}, "issue_number": ${{ toJSON(steps.prompt.outputs.issue_number) }}, "run_id": ${{ toJSON(github.run_id) }}, "run_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}'

.github/workflows/docs-i18n-pull.yaml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           token: ${{ github.token }}
           repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
@@ -153,7 +153,8 @@ jobs:
 
       - name: Trigger i18n automerge
         if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: i18n-pr-ready

.github/workflows/docs-i18n-push.yaml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           token: ${{ github.token }}
           ref: ${{ github.ref }}
@@ -36,7 +36,7 @@ jobs:
         run: yarn docs:generate-navigation-template
 
       - name: Upload docs to Crowdin
-        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        uses: crowdin/github-action@v2
         with:
           upload_sources: true
           upload_translations: false

.github/workflows/i18n-pull.yaml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           token: ${{ github.token }}
           ref: ${{ github.head_ref || github.ref_name }}
@@ -69,7 +69,7 @@ jobs:
 
       - name: Pull translations from Crowdin
         if: inputs.force_pull || steps.compile_translations_strict.outcome == 'failure'
-        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        uses: crowdin/github-action@v2
         with:
           upload_sources: false
           upload_translations: false
@@ -139,7 +139,8 @@ jobs:
 
       - name: Trigger i18n automerge
         if: steps.compile_translations.outputs.changes_detected == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: i18n-pr-ready

.github/workflows/i18n-push.yaml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           token: ${{ github.token }}
           ref: main
@@ -80,7 +80,7 @@ jobs:
 
       - name: Upload missing translations
         if: steps.check_extract_changes.outputs.changes_detected == 'true'
-        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        uses: crowdin/github-action@v2
         with:
           upload_sources: true
           upload_translations: true
@@ -105,7 +105,8 @@ jobs:
 
       - name: Trigger i18n automerge
         if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: i18n-pr-ready

.github/workflows/post-ci-comments.yaml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Get PR number from workflow run
         id: pr-info
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@v7
         with:
           script: |
             const runId = context.payload.workflow_run.id;
@@ -63,16 +63,9 @@ jobs:
 
       - name: Dispatch to ci-privileged
         if: steps.pr-info.outputs.has_pr == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
-          PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
-          RUN_ID: ${{ steps.pr-info.outputs.run_id }}
-          REPOSITORY: ${{ github.repository }}
-          BRANCH_STATE: ${{ github.event.workflow_run.head_branch }}
-        run: |
-          gh api repos/twentyhq/ci-privileged/dispatches \
-            -f event_type=breaking-changes-report \
-            -f "client_payload[pr_number]=$PR_NUMBER" \
-            -f "client_payload[run_id]=$RUN_ID" \
-            -f "client_payload[repo]=$REPOSITORY" \
-            -f "client_payload[branch_state]=$BRANCH_STATE"
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
+          repository: twentyhq/ci-privileged
+          event-type: breaking-changes-report
+          client-payload: '{"pr_number": ${{ toJSON(steps.pr-info.outputs.pr_number) }}, "run_id": ${{ toJSON(steps.pr-info.outputs.run_id) }}, "repo": ${{ toJSON(github.repository) }}, "branch_state": ${{ toJSON(github.event.workflow_run.head_branch) }}}'

.github/workflows/preview-env-dispatch.yaml

@@ -36,27 +36,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger preview environment workflow
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          REPOSITORY: ${{ github.repository }}
-        run: |
-          gh api repos/"$REPOSITORY"/dispatches \
-            -f event_type=preview-environment \
-            -f "client_payload[pr_number]=$PR_NUMBER" \
-            -f "client_payload[pr_head_sha]=$PR_HEAD_SHA" \
-            -f "client_payload[repo_full_name]=$REPOSITORY"
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
+          event-type: preview-environment
+          client-payload: '{"pr_number": "${{ github.event.pull_request.number }}", "pr_head_sha": "${{ github.event.pull_request.head.sha }}", "repo_full_name": "${{ github.repository }}"}'
 
       - name: Dispatch to ci-privileged for PR comment
-        env:
-          GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          KEEPALIVE_DISPATCH_TIME: ${{ github.event.pull_request.updated_at }}
-          REPOSITORY: ${{ github.repository }}
-        run: |
-          gh api repos/twentyhq/ci-privileged/dispatches \
-            -f event_type=preview-env-url \
-            -f "client_payload[pr_number]=$PR_NUMBER" \
-            -f "client_payload[keepalive_dispatch_time]=$KEEPALIVE_DISPATCH_TIME" \
-            -f "client_payload[repo]=$REPOSITORY"
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
+          repository: twentyhq/ci-privileged
+          event-type: preview-env-url
+          client-payload: '{"pr_number": ${{ toJSON(github.event.pull_request.number) }}, "keepalive_dispatch_time": ${{ toJSON(github.event.pull_request.updated_at) }}, "repo": ${{ toJSON(github.repository) }}}'

.github/workflows/preview-env-keepalive.yaml

@@ -13,12 +13,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.client_payload.pr_head_sha }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -166,7 +166,7 @@ jobs:
           echo "$TUNNEL_URL" > tunnel-url.txt
 
       - name: Upload tunnel URL artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: tunnel-url
           path: tunnel-url.txt

.github/workflows/visual-regression-dispatch.yaml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Determine project and artifact name
         id: project
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@v7
         with:
           script: |
             const workflowName = context.payload.workflow_run.name;
@@ -43,7 +43,7 @@ jobs:
 
       - name: Check if storybook artifact exists
         id: check-artifact
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@v7
         with:
           script: |
             const artifactName = '${{ steps.project.outputs.artifact_name }}';
@@ -65,7 +65,7 @@ jobs:
       - name: Get PR number
         if: steps.check-artifact.outputs.exists == 'true'
         id: pr-info
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@v7
         with:
           script: |
             const headBranch = context.payload.workflow_run.head_branch;
@@ -107,7 +107,7 @@ jobs:
 
       - name: Download storybook artifact from triggering run
         if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true'
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4
         with:
           name: ${{ steps.project.outputs.artifact_name }}
           path: storybook-static
@@ -120,7 +120,7 @@ jobs:
 
       - name: Upload storybook tarball
         if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ steps.project.outputs.tarball_name }}
           path: /tmp/${{ steps.project.outputs.tarball_file }}
@@ -128,20 +128,17 @@ jobs:
 
       - name: Dispatch to ci-privileged
         if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
-          PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
-          RUN_ID: ${{ github.run_id }}
-          REPOSITORY: ${{ github.repository }}
-          PROJECT: ${{ steps.project.outputs.project }}
-          BRANCH: ${{ github.event.workflow_run.head_branch }}
-          COMMIT: ${{ github.event.workflow_run.head_sha }}
-        run: |
-          gh api repos/twentyhq/ci-privileged/dispatches \
-            -f event_type=visual-regression \
-            -f "client_payload[pr_number]=$PR_NUMBER" \
-            -f "client_payload[run_id]=$RUN_ID" \
-            -f "client_payload[repo]=$REPOSITORY" \
-            -f "client_payload[project]=$PROJECT" \
-            -f "client_payload[branch]=$BRANCH" \
-            -f "client_payload[commit]=$COMMIT"
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
+          repository: twentyhq/ci-privileged
+          event-type: visual-regression
+          client-payload: >-
+            {
+              "pr_number": "${{ steps.pr-info.outputs.pr_number }}",
+              "run_id": "${{ github.run_id }}",
+              "repo": "${{ github.repository }}",
+              "project": "${{ steps.project.outputs.project }}",
+              "branch": "${{ github.event.workflow_run.head_branch }}",
+              "commit": "${{ github.event.workflow_run.head_sha }}"
+            }

.github/workflows/website-i18n-pull.yaml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           token: ${{ github.token }}
           ref: ${{ github.head_ref || github.ref_name }}
@@ -66,7 +66,7 @@ jobs:
 
       - name: Pull website translations from Crowdin
         if: inputs.force_pull || steps.compile_translations_strict.outcome == 'failure'
-        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        uses: crowdin/github-action@v2
         with:
           upload_sources: false
           upload_translations: false
@@ -128,7 +128,8 @@ jobs:
 
       - name: Trigger i18n automerge
         if: steps.compile_translations.outputs.changes_detected == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: i18n-pr-ready

.github/workflows/website-i18n-push.yaml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
         with:
           token: ${{ github.token }}
           ref: main
@@ -78,7 +78,7 @@ jobs:
 
       - name: Upload missing website translations
         if: steps.check_extract_changes.outputs.changes_detected == 'true'
-        uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
+        uses: crowdin/github-action@v2
         with:
           upload_sources: true
           upload_translations: true
@@ -104,7 +104,8 @@ jobs:
 
       - name: Trigger i18n automerge
         if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
-        run: |
-          gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.TWENTY_INFRA_TOKEN }}
+          repository: twentyhq/twenty-infra
+          event-type: i18n-pr-ready

.yarnrc.yml

@@ -6,6 +6,4 @@ enableInlineHunks: true
 
 nodeLinker: node-modules
 
-npmMinimalAgeGate: "3d"
-
 yarnPath: .yarn/releases/yarn-4.13.0.cjs

packages/create-twenty-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-twenty-app",
-  "version": "2.4.0",
+  "version": "2.3.1",
   "description": "Command-line interface to create Twenty application",
   "main": "dist/cli.cjs",
   "bin": "dist/cli.cjs",

packages/twenty-apps/internal/twenty-linear/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twenty-linear",
-  "version": "0.1.6",
+  "version": "0.1.5",
   "description": "Linear integration for Twenty. Connect a user's Linear account and create issues from logic functions.",
   "license": "MIT",
   "engines": {
@@ -20,7 +20,7 @@
     "test:watch": "vitest --config vitest.unit.config.ts"
   },
   "dependencies": {
-    "twenty-sdk": "2.3.1"
+    "twenty-sdk": "2.3.0"
   },
   "devDependencies": {
     "@types/node": "^24.7.2",

packages/twenty-apps/internal/twenty-linear/src/application.config.ts

@@ -1,6 +1,9 @@
 import { defineApplication } from 'twenty-sdk/define';
-import { ABOUT_DESCRIPTION } from './constants/ABOUT_DESCRIPTION.md';
-import { APPLICATION_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+
+import {
+  APPLICATION_UNIVERSAL_IDENTIFIER,
+  DEFAULT_ROLE_UNIVERSAL_IDENTIFIER,
+} from 'src/constants/universal-identifiers';
 
 export default defineApplication({
   universalIdentifier: APPLICATION_UNIVERSAL_IDENTIFIER,
@@ -8,19 +11,10 @@ export default defineApplication({
   description:
     'Connect Linear to Twenty. Each workspace member connects their own Linear account; logic functions can then create issues and read team data on their behalf.',
   logoUrl: 'public/linear-logomark.svg',
-  aboutDescription: ABOUT_DESCRIPTION,
-  applicationVariables: undefined,
-  author: 'Twenty',
-  category: 'Product management',
-  emailSupport: 'contact@twenty.com',
-  screenshots: [
-    'public/gallery/command-menu-item-1.png',
-    'public/gallery/command-menu-item-2.png',
-    'public/gallery/command-menu-item-3.png',
-    'public/gallery/command-menu-item-4.png',
-  ],
-  termsUrl: 'https://github.com/twentyhq/twenty?tab=License-1-ov-file#readme',
-  websiteUrl: 'https://www.twenty.com',
+  defaultRoleUniversalIdentifier: DEFAULT_ROLE_UNIVERSAL_IDENTIFIER,
+  // OAuth client_id/secret live at the registration level (one OAuth app per
+  // Twenty server, configured by the server admin) — not per-workspace —
+  // so they're declared as serverVariables, not applicationVariables.
   serverVariables: {
     LINEAR_CLIENT_ID: {
       description:

packages/twenty-apps/internal/twenty-linear/src/command-menu-items/create-linear-issue.command-menu-item.ts

@@ -1,17 +0,0 @@
-import { defineCommandMenuItem } from 'twenty-sdk/define';
-
-import {
-  CREATE_ISSUE_COMMAND_UNIVERSAL_IDENTIFIER,
-  CREATE_ISSUE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
-} from 'src/constants/universal-identifiers';
-
-export default defineCommandMenuItem({
-  universalIdentifier: CREATE_ISSUE_COMMAND_UNIVERSAL_IDENTIFIER,
-  label: 'Create Linear issue',
-  shortLabel: 'Linear issue',
-  icon: 'IconPlaylistAdd',
-  isPinned: false,
-  availabilityType: 'GLOBAL',
-  frontComponentUniversalIdentifier:
-    CREATE_ISSUE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
-});

packages/twenty-apps/internal/twenty-linear/src/connection-providers/linear-connection.ts

@@ -15,6 +15,8 @@ export default defineConnectionProvider({
     clientIdVariable: 'LINEAR_CLIENT_ID',
     clientSecretVariable: 'LINEAR_CLIENT_SECRET',
     tokenRequestContentType: 'form-urlencoded',
-    usePkce: true,
+    // Linear supports PKCE but doesn't require it for confidential clients.
+    // Disabled to keep the test surface minimal.
+    usePkce: false,
   },
 });

packages/twenty-apps/internal/twenty-linear/src/constants/ABOUT_DESCRIPTION.md.ts

@@ -1,20 +0,0 @@
-export const ABOUT_DESCRIPTION = `Connect your Linear account to Twenty to create issues and look up teams straight from your workflows or the AI chat.
-
-## What you can do
-
-Once installed and connected, two tools become available:
-
-- **Create Linear issue**
-  - From the AI chat, ask something like *"create a Linear issue in the Engineering team titled 'Fix login bug'"* and the AI will file it for you.
-  - From a workflow, add it as a step with \`teamId\` + \`title\` (and optional \`description\`).
-
-- **List Linear teams** — discovers the teams in your Linear workspace, useful when you need to pick a \`teamId\` for the create-issue step.
-
-## Installing
-
-1. Open **Settings → Applications** in your Twenty workspace.
-2. Find **Linear** in the available apps and click **Install**.
-3. Open the app, go to the **Connections** tab, and click **Add connection**.
-4. Choose **Just for me** (your personal Linear account) or **Workspace shared** (a team-managed Linear account anyone in this workspace can act through), then complete the Linear sign-in.
-
-That's it — you can now use the tools above.`;

packages/twenty-apps/internal/twenty-linear/src/constants/universal-identifiers.ts

@@ -17,24 +17,3 @@ export const CREATE_LINEAR_ISSUE_UNIVERSAL_IDENTIFIER =
 
 export const LIST_LINEAR_TEAMS_UNIVERSAL_IDENTIFIER =
   '15824bbc-9c64-4f97-b45f-d0a44b402bb8';
-
-export const LIST_LINEAR_TEAMS_ROUTE_UNIVERSAL_IDENTIFIER =
-  'a1d4e7b3-5c2f-4a89-9b0e-6f3d8c1a7e5b';
-
-export const CREATE_LINEAR_ISSUE_ROUTE_UNIVERSAL_IDENTIFIER =
-  'c8f2a6d1-3b7e-4e09-8d5c-2a9f0b4e6c3d';
-
-export const CREATE_ISSUE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER =
-  'd4a1c8e5-7f3b-4d62-a90e-1b5c3f8d2a6e';
-
-export const LIST_LINEAR_WORKFLOW_STATES_ROUTE_UNIVERSAL_IDENTIFIER =
-  'f5a2d8c1-4b7e-4f93-a6d0-9c3e1b8f5a2d';
-
-export const LIST_LINEAR_ISSUE_OPTIONS_ROUTE_UNIVERSAL_IDENTIFIER =
-  'a3b7e1d9-8c4f-4a26-b5d0-7e9f2c6a8b3d';
-
-export const LIST_LINEAR_ISSUE_OPTIONS_UNIVERSAL_IDENTIFIER =
-  'c2b99086-6c1b-43e4-9685-de4ade6bda63';
-
-export const CREATE_ISSUE_COMMAND_UNIVERSAL_IDENTIFIER =
-  'e7b3d9f2-6a1c-4e85-b4d0-8f2c5a7e3b19';

packages/twenty-apps/internal/twenty-linear/src/logic-functions/create-linear-issue-route.ts

@@ -1,35 +0,0 @@
-import { defineLogicFunction } from 'twenty-sdk/define';
-import type { RoutePayload } from 'twenty-sdk/define';
-
-import { CREATE_LINEAR_ISSUE_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
-import { createLinearIssueHandler } from 'src/logic-functions/handlers/create-linear-issue-handler';
-
-const handler = async (event: RoutePayload) => {
-  const body = event.body as Record<string, unknown> | null;
-
-  return createLinearIssueHandler({
-    teamId: body?.teamId as string | undefined,
-    title: body?.title as string | undefined,
-    description: body?.description as string | undefined,
-    priority: body?.priority as number | undefined,
-    stateId: body?.stateId as string | undefined,
-    assigneeId: body?.assigneeId as string | undefined,
-    projectId: body?.projectId as string | undefined,
-    estimate: body?.estimate as number | undefined,
-    labelIds: body?.labelIds as string[] | undefined,
-    cycleId: body?.cycleId as string | undefined,
-    dueDate: body?.dueDate as string | undefined,
-  });
-};
-
-export default defineLogicFunction({
-  universalIdentifier: CREATE_LINEAR_ISSUE_ROUTE_UNIVERSAL_IDENTIFIER,
-  name: 'create-linear-issue-route',
-  timeoutSeconds: 30,
-  handler,
-  httpRouteTriggerSettings: {
-    path: '/linear/issues',
-    httpMethod: 'POST',
-    isAuthRequired: true,
-  },
-});

packages/twenty-apps/internal/twenty-linear/src/logic-functions/create-linear-issue.ts

@@ -27,45 +27,6 @@ export default defineLogicFunction({
           type: 'string',
           description: 'Optional issue description (Markdown supported).',
         },
-        priority: {
-          type: 'integer',
-          description:
-            'Issue priority: 0 = No priority, 1 = Urgent, 2 = High, 3 = Medium, 4 = Low.',
-          minimum: 0,
-          maximum: 4,
-        },
-        stateId: {
-          type: 'string',
-          description:
-            'The workflow state ID for the issue status. Use list-linear-issue-options to discover available states for a team.',
-        },
-        assigneeId: {
-          type: 'string',
-          description:
-            'The user ID to assign the issue to. Use list-linear-issue-options to discover team members.',
-        },
-        projectId: {
-          type: 'string',
-          description: 'The project ID to associate the issue with.',
-        },
-        estimate: {
-          type: 'number',
-          description:
-            'The estimate value for the issue. Must match the team estimate scale.',
-        },
-        labelIds: {
-          type: 'array',
-          items: { type: 'string' },
-          description: 'Array of label IDs to apply to the issue.',
-        },
-        cycleId: {
-          type: 'string',
-          description: 'The cycle ID to add the issue to.',
-        },
-        dueDate: {
-          type: 'string',
-          description: 'Due date in YYYY-MM-DD format.',
-        },
       },
       required: ['teamId', 'title'],
     },
@@ -79,14 +40,6 @@ export default defineLogicFunction({
           teamId: { type: 'string' },
           title: { type: 'string' },
           description: { type: 'string' },
-          priority: { type: 'number' },
-          stateId: { type: 'string' },
-          assigneeId: { type: 'string' },
-          projectId: { type: 'string' },
-          estimate: { type: 'number' },
-          labelIds: { type: 'array', items: { type: 'string' } },
-          cycleId: { type: 'string' },
-          dueDate: { type: 'string' },
         },
       },
     ],

packages/twenty-apps/internal/twenty-linear/src/logic-functions/handlers/create-linear-issue-handler.ts

@@ -49,17 +49,6 @@ export const createLinearIssueHandler = async (
         teamId: input.teamId,
         title: input.title,
         description: input.description,
-        ...(input.priority !== undefined && { priority: input.priority }),
-        ...(input.stateId !== undefined && { stateId: input.stateId }),
-        ...(input.assigneeId !== undefined && {
-          assigneeId: input.assigneeId,
-        }),
-        ...(input.projectId !== undefined && { projectId: input.projectId }),
-        ...(input.estimate !== undefined && { estimate: input.estimate }),
-        ...(input.labelIds !== undefined &&
-          input.labelIds.length > 0 && { labelIds: input.labelIds }),
-        ...(input.cycleId !== undefined && { cycleId: input.cycleId }),
-        ...(input.dueDate !== undefined && { dueDate: input.dueDate }),
       },
     },
   });

packages/twenty-apps/internal/twenty-linear/src/logic-functions/handlers/list-linear-issue-options-handler.ts

@@ -1,129 +0,0 @@
-import { listConnections } from 'twenty-sdk/logic-function';
-
-import { callLinearGraphQL } from 'src/logic-functions/utils/call-linear-graphql';
-
-type LinearMember = {
-  id: string;
-  name: string;
-  displayName: string;
-};
-
-type LinearProject = {
-  id: string;
-  name: string;
-};
-
-type LinearLabel = {
-  id: string;
-  name: string;
-  color: string;
-};
-
-type LinearCycle = {
-  id: string;
-  name: string | null;
-  number: number;
-  startsAt: string;
-  endsAt: string;
-};
-
-type LinearWorkflowState = {
-  id: string;
-  name: string;
-  type: string;
-  position: number;
-};
-
-type IssueOptionsQueryResult = {
-  team: {
-    states: { nodes: LinearWorkflowState[] };
-    members: { nodes: LinearMember[] };
-    cycles: { nodes: LinearCycle[] };
-    issueEstimationType: string;
-    issueEstimationAllowZero: boolean;
-  };
-  projects: { nodes: LinearProject[] };
-  issueLabels: { nodes: LinearLabel[] };
-};
-
-type IssueOptions = {
-  states: LinearWorkflowState[];
-  members: LinearMember[];
-  projects: LinearProject[];
-  labels: LinearLabel[];
-  cycles: LinearCycle[];
-  estimationType: string;
-  estimationAllowZero: boolean;
-};
-
-type HandlerResult =
-  | { success: true; options: IssueOptions }
-  | { success: false; error: string };
-
-export const listLinearIssueOptionsHandler = async (input: {
-  teamId?: string;
-}): Promise<HandlerResult> => {
-  if (!input.teamId) {
-    return { success: false, error: '`teamId` is required.' };
-  }
-
-  const connections = await listConnections({ providerName: 'linear' });
-  const connection =
-    connections.find((c) => c.visibility === 'workspace') ?? connections[0];
-
-  if (!connection) {
-    return {
-      success: false,
-      error:
-        'Linear is not connected. Open the app settings and click "Add connection" first.',
-    };
-  }
-
-  const result = await callLinearGraphQL<IssueOptionsQueryResult>({
-    accessToken: connection.accessToken,
-    query: `
-      query IssueOptions($teamId: String!) {
-        team(id: $teamId) {
-          states { nodes { id name type position } }
-          members { nodes { id name displayName } }
-          cycles { nodes { id name number startsAt endsAt } }
-          issueEstimationType
-          issueEstimationAllowZero
-        }
-        projects { nodes { id name } }
-        issueLabels { nodes { id name color } }
-      }
-    `,
-    variables: { teamId: input.teamId },
-  });
-
-  if (result.errors || !result.data) {
-    return {
-      success: false,
-      error: result.errors?.[0]?.message ?? 'Unknown Linear API error',
-    };
-  }
-
-  const { team, projects, issueLabels } = result.data;
-
-  const now = new Date().toISOString();
-  const activeCycles = team.cycles.nodes.filter((c) => c.endsAt >= now);
-
-  return {
-    success: true,
-    options: {
-      states: team.states.nodes.sort((a, b) => a.position - b.position),
-      members: team.members.nodes.sort((a, b) =>
-        a.displayName.localeCompare(b.displayName),
-      ),
-      projects: projects.nodes.sort((a, b) => a.name.localeCompare(b.name)),
-      labels: issueLabels.nodes.sort((a, b) => a.name.localeCompare(b.name)),
-      cycles: activeCycles.sort(
-        (a, b) =>
-          new Date(a.startsAt).getTime() - new Date(b.startsAt).getTime(),
-      ),
-      estimationType: team.issueEstimationType,
-      estimationAllowZero: team.issueEstimationAllowZero,
-    },
-  };
-};

packages/twenty-apps/internal/twenty-linear/src/logic-functions/handlers/list-linear-workflow-states-handler.ts

@@ -1,63 +0,0 @@
-import { listConnections } from 'twenty-sdk/logic-function';
-
-import { callLinearGraphQL } from 'src/logic-functions/utils/call-linear-graphql';
-
-type LinearWorkflowState = {
-  id: string;
-  name: string;
-  type: string;
-  position: number;
-};
-
-type WorkflowStatesQueryResult = {
-  team: { states: { nodes: LinearWorkflowState[] } };
-};
-
-type HandlerResult =
-  | { success: true; states: LinearWorkflowState[] }
-  | { success: false; error: string };
-
-export const listLinearWorkflowStatesHandler = async (input: {
-  teamId?: string;
-}): Promise<HandlerResult> => {
-  if (!input.teamId) {
-    return { success: false, error: '`teamId` is required.' };
-  }
-
-  const connections = await listConnections({ providerName: 'linear' });
-  const connection =
-    connections.find((c) => c.visibility === 'workspace') ?? connections[0];
-
-  if (!connection) {
-    return {
-      success: false,
-      error:
-        'Linear is not connected. Open the app settings and click "Add connection" first.',
-    };
-  }
-
-  const result = await callLinearGraphQL<WorkflowStatesQueryResult>({
-    accessToken: connection.accessToken,
-    query: `
-      query WorkflowStates($teamId: String!) {
-        team(id: $teamId) {
-          states { nodes { id name type position } }
-        }
-      }
-    `,
-    variables: { teamId: input.teamId },
-  });
-
-  if (result.errors || !result.data) {
-    return {
-      success: false,
-      error: result.errors?.[0]?.message ?? 'Unknown Linear API error',
-    };
-  }
-
-  const states = result.data.team.states.nodes.sort(
-    (a, b) => a.position - b.position,
-  );
-
-  return { success: true, states };
-};

packages/twenty-apps/internal/twenty-linear/src/logic-functions/list-linear-issue-options-route.ts

@@ -1,23 +0,0 @@
-import { defineLogicFunction } from 'twenty-sdk/define';
-import type { RoutePayload } from 'twenty-sdk/define';
-
-import { LIST_LINEAR_ISSUE_OPTIONS_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
-import { listLinearIssueOptionsHandler } from 'src/logic-functions/handlers/list-linear-issue-options-handler';
-
-const handler = async (event: RoutePayload) => {
-  return listLinearIssueOptionsHandler({
-    teamId: event.queryStringParameters?.teamId,
-  });
-};
-
-export default defineLogicFunction({
-  universalIdentifier: LIST_LINEAR_ISSUE_OPTIONS_ROUTE_UNIVERSAL_IDENTIFIER,
-  name: 'list-linear-issue-options-route',
-  timeoutSeconds: 15,
-  handler,
-  httpRouteTriggerSettings: {
-    path: '/linear/issue-options',
-    httpMethod: 'GET',
-    isAuthRequired: true,
-  },
-});

packages/twenty-apps/internal/twenty-linear/src/logic-functions/list-linear-issue-options.ts

@@ -1,110 +0,0 @@
-import { defineLogicFunction } from 'twenty-sdk/define';
-
-import { LIST_LINEAR_ISSUE_OPTIONS_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
-import { listLinearIssueOptionsHandler } from 'src/logic-functions/handlers/list-linear-issue-options-handler';
-
-export default defineLogicFunction({
-  universalIdentifier: LIST_LINEAR_ISSUE_OPTIONS_UNIVERSAL_IDENTIFIER,
-  name: 'list-linear-issue-options',
-  description:
-    'Returns available options for creating a Linear issue in a specific team: workflow states, members, projects, labels, cycles, and estimation settings. Requires a teamId (call list-linear-teams to discover one).',
-  timeoutSeconds: 15,
-  handler: listLinearIssueOptionsHandler,
-  toolTriggerSettings: {
-    inputSchema: {
-      type: 'object',
-      properties: {
-        teamId: {
-          type: 'string',
-          description:
-            'The Linear team ID to fetch issue options for. Use list-linear-teams to discover available teams.',
-        },
-      },
-      required: ['teamId'],
-    },
-  },
-  workflowActionTriggerSettings: {
-    label: 'List Linear Issue Options',
-    inputSchema: [
-      {
-        type: 'object',
-        properties: {
-          teamId: { type: 'string' },
-        },
-      },
-    ],
-    outputSchema: [
-      {
-        type: 'object',
-        properties: {
-          success: { type: 'boolean' },
-          options: {
-            type: 'object',
-            properties: {
-              states: {
-                type: 'array',
-                items: {
-                  type: 'object',
-                  properties: {
-                    id: { type: 'string' },
-                    name: { type: 'string' },
-                    type: { type: 'string' },
-                    position: { type: 'number' },
-                  },
-                },
-              },
-              members: {
-                type: 'array',
-                items: {
-                  type: 'object',
-                  properties: {
-                    id: { type: 'string' },
-                    name: { type: 'string' },
-                    displayName: { type: 'string' },
-                  },
-                },
-              },
-              projects: {
-                type: 'array',
-                items: {
-                  type: 'object',
-                  properties: {
-                    id: { type: 'string' },
-                    name: { type: 'string' },
-                  },
-                },
-              },
-              labels: {
-                type: 'array',
-                items: {
-                  type: 'object',
-                  properties: {
-                    id: { type: 'string' },
-                    name: { type: 'string' },
-                    color: { type: 'string' },
-                  },
-                },
-              },
-              cycles: {
-                type: 'array',
-                items: {
-                  type: 'object',
-                  properties: {
-                    id: { type: 'string' },
-                    name: { type: 'string' },
-                    number: { type: 'number' },
-                    startsAt: { type: 'string' },
-                    endsAt: { type: 'string' },
-                  },
-                },
-              },
-              estimationType: { type: 'string' },
-              estimationAllowZero: { type: 'boolean' },
-            },
-          },
-          error: { type: 'string' },
-        },
-      },
-    ],
-  },
-});

packages/twenty-apps/internal/twenty-linear/src/logic-functions/list-linear-teams-route.ts

@@ -1,21 +0,0 @@
-import { defineLogicFunction } from 'twenty-sdk/define';
-import type { RoutePayload } from 'twenty-sdk/define';
-
-import { LIST_LINEAR_TEAMS_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
-import { listLinearTeamsHandler } from 'src/logic-functions/handlers/list-linear-teams-handler';
-
-const handler = async (_event: RoutePayload) => {
-  return listLinearTeamsHandler();
-};
-
-export default defineLogicFunction({
-  universalIdentifier: LIST_LINEAR_TEAMS_ROUTE_UNIVERSAL_IDENTIFIER,
-  name: 'list-linear-teams-route',
-  timeoutSeconds: 15,
-  handler,
-  httpRouteTriggerSettings: {
-    path: '/linear/teams',
-    httpMethod: 'GET',
-    isAuthRequired: true,
-  },
-});

packages/twenty-apps/internal/twenty-linear/src/logic-functions/list-linear-teams.ts

@@ -16,33 +16,4 @@ export default defineLogicFunction({
       properties: {},
     },
   },
-  workflowActionTriggerSettings: {
-    label: 'List Linear Teams',
-    inputSchema: [
-      {
-        type: 'object',
-        properties: {},
-      },
-    ],
-    outputSchema: [
-      {
-        type: 'object',
-        properties: {
-          success: { type: 'boolean' },
-          teams: {
-            type: 'array',
-            items: {
-              type: 'object',
-              properties: {
-                id: { type: 'string' },
-                name: { type: 'string' },
-                key: { type: 'string' },
-              },
-            },
-          },
-          error: { type: 'string' },
-        },
-      },
-    ],
-  },
 });

packages/twenty-apps/internal/twenty-linear/src/logic-functions/list-linear-workflow-states-route.ts

@@ -1,23 +0,0 @@
-import { defineLogicFunction } from 'twenty-sdk/define';
-import type { RoutePayload } from 'twenty-sdk/define';
-
-import { LIST_LINEAR_WORKFLOW_STATES_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
-import { listLinearWorkflowStatesHandler } from 'src/logic-functions/handlers/list-linear-workflow-states-handler';
-
-const handler = async (event: RoutePayload) => {
-  return listLinearWorkflowStatesHandler({
-    teamId: event.queryStringParameters?.teamId,
-  });
-};
-
-export default defineLogicFunction({
-  universalIdentifier: LIST_LINEAR_WORKFLOW_STATES_ROUTE_UNIVERSAL_IDENTIFIER,
-  name: 'list-linear-workflow-states-route',
-  timeoutSeconds: 15,
-  handler,
-  httpRouteTriggerSettings: {
-    path: '/linear/workflow-states',
-    httpMethod: 'GET',
-    isAuthRequired: true,
-  },
-});

packages/twenty-apps/internal/twenty-linear/src/logic-functions/types/create-issue-input.type.ts

@@ -2,12 +2,4 @@ export type CreateIssueInput = {
   teamId?: string;
   title?: string;
   description?: string;
-  priority?: number;
-  stateId?: string;
-  assigneeId?: string;
-  projectId?: string;
-  estimate?: number;
-  labelIds?: string[];
-  cycleId?: string;
-  dueDate?: string;
 };

packages/twenty-apps/internal/twenty-linear/src/roles/default-function.role.ts

@@ -1,8 +1,10 @@
-import { defineApplicationRole } from 'twenty-sdk/define';
+import { defineRole } from 'twenty-sdk/define';
 
 import { DEFAULT_ROLE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
 
-export default defineApplicationRole({
+// The Linear logic functions never read workspace data — they only call
+// Linear's GraphQL API on behalf of the connected user.
+export default defineRole({
   universalIdentifier: DEFAULT_ROLE_UNIVERSAL_IDENTIFIER,
   label: 'Linear function role',
   description: 'No-op role for Linear logic functions',

packages/twenty-apps/internal/twenty-linear/tsconfig.json

@@ -5,7 +5,6 @@
     "declaration": true,
     "outDir": "./dist",
     "rootDir": ".",
-    "jsx": "react-jsx",
     "moduleResolution": "bundler",
     "allowSyntheticDefaultImports": true,
     "emitDecoratorMetadata": true,
@@ -18,7 +17,7 @@
     "strictBindCallApply": false,
     "target": "es2020",
     "module": "esnext",
-    "lib": ["es2020", "dom"],
+    "lib": ["es2020"],
     "skipLibCheck": true,
     "skipDefaultLibCheck": true,
     "resolveJsonModule": true,

packages/twenty-apps/internal/twenty-linear/yarn.lock

@@ -3736,15 +3736,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"twenty-client-sdk@npm:2.3.1":
-  version: 2.3.1
-  resolution: "twenty-client-sdk@npm:2.3.1"
+"twenty-client-sdk@npm:2.3.0":
+  version: 2.3.0
+  resolution: "twenty-client-sdk@npm:2.3.0"
   dependencies:
     "@genql/cli": "npm:^3.0.3"
     "@genql/runtime": "npm:^2.10.0"
     esbuild: "npm:^0.25.0"
     graphql: "npm:^16.8.1"
-  checksum: 10c0/b82a40b6411857345e40b81d32f7069364c6795e79306447d1c21b441315016d8c27ee2c128cd97b82379221812cb18bb556eb37dea337e83b05873b9bfc6c6f
+  checksum: 10c0/ab9a4f4ea9222eebdab6d80f396e5281cc0b78bc571163bc8a4f302afc38989ded21c67e0a8e2aad3cdad20f5ec24f60cd2286d9b38a86f7a77333aff5500b20
   languageName: node
   linkType: hard
 
@@ -3754,16 +3754,16 @@ __metadata:
   dependencies:
     "@types/node": "npm:^24.7.2"
     oxlint: "npm:^0.16.0"
-    twenty-sdk: "npm:2.3.1"
+    twenty-sdk: "npm:2.3.0"
     typescript: "npm:^5.9.3"
     vite-tsconfig-paths: "npm:^4.3.2"
     vitest: "npm:^3.1.1"
   languageName: unknown
   linkType: soft
 
-"twenty-sdk@npm:2.3.1":
-  version: 2.3.1
-  resolution: "twenty-sdk@npm:2.3.1"
+"twenty-sdk@npm:2.3.0":
+  version: 2.3.0
+  resolution: "twenty-sdk@npm:2.3.0"
   dependencies:
     "@genql/cli": "npm:^3.0.3"
     "@genql/runtime": "npm:^2.10.0"
@@ -3783,7 +3783,7 @@ __metadata:
     react: "npm:^19.0.0"
     react-dom: "npm:^19.0.0"
     tinyglobby: "npm:^0.2.15"
-    twenty-client-sdk: "npm:2.3.1"
+    twenty-client-sdk: "npm:2.3.0"
     typescript: "npm:^5.9.2"
     uuid: "npm:^13.0.0"
     vite: "npm:^7.0.0"
@@ -3791,7 +3791,7 @@ __metadata:
     zod: "npm:^4.1.11"
   bin:
     twenty: dist/cli.cjs
-  checksum: 10c0/137a7a7e6d46175019406a21694103100e744e49154f2de5529962249ab06b9fc8240bc097fd2f231b315b6b8504ba3b45279e22aa80bdb9e735cd2570497eac
+  checksum: 10c0/8020481e7500472ec841574458ed18a20588e31f51a8ff9b86e8ceddc933afd9e34840e4130b1aab53b66c35ea7e6b571d2f2dd7b35836bac96f487d84239c1f
   languageName: node
   linkType: hard
 

packages/twenty-client-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twenty-client-sdk",
-  "version": "2.4.0",
+  "version": "2.3.1",
   "sideEffects": false,
   "license": "AGPL-3.0",
   "scripts": {

packages/twenty-client-sdk/src/metadata/generated/schema.graphql

@@ -1967,18 +1967,6 @@ type RotateClientSecret {
   clientSecret: String!
 }
 
-type ApplicationRegistrationVariableDTO {
-  id: UUID!
-  key: String!
-  value: String
-  description: String!
-  isSecret: Boolean!
-  isRequired: Boolean!
-  isFilled: Boolean!
-  createdAt: DateTime!
-  updatedAt: DateTime!
-}
-
 type Relation {
   type: RelationType!
   sourceObjectMetadata: Object!
@@ -3046,7 +3034,7 @@ type Query {
   findManyApplicationRegistrations: [ApplicationRegistration!]!
   findOneApplicationRegistration(id: String!): ApplicationRegistration!
   findApplicationRegistrationStats(id: String!): ApplicationRegistrationStats!
-  findApplicationRegistrationVariables(applicationRegistrationId: String!): [ApplicationRegistrationVariableDTO!]!
+  findApplicationRegistrationVariables(applicationRegistrationId: String!): [ApplicationRegistrationVariable!]!
   applicationRegistrationTarballUrl(id: String!): String
   currentUser: User!
   currentWorkspace: Workspace!

packages/twenty-client-sdk/src/metadata/generated/schema.ts

@@ -1605,19 +1605,6 @@ export interface RotateClientSecret {
     __typename: 'RotateClientSecret'
 }
 
-export interface ApplicationRegistrationVariableDTO {
-    id: Scalars['UUID']
-    key: Scalars['String']
-    value?: Scalars['String']
-    description: Scalars['String']
-    isSecret: Scalars['Boolean']
-    isRequired: Scalars['Boolean']
-    isFilled: Scalars['Boolean']
-    createdAt: Scalars['DateTime']
-    updatedAt: Scalars['DateTime']
-    __typename: 'ApplicationRegistrationVariableDTO'
-}
-
 export interface Relation {
     type: RelationType
     sourceObjectMetadata: Object
@@ -2646,7 +2633,7 @@ export interface Query {
     findManyApplicationRegistrations: ApplicationRegistration[]
     findOneApplicationRegistration: ApplicationRegistration
     findApplicationRegistrationStats: ApplicationRegistrationStats
-    findApplicationRegistrationVariables: ApplicationRegistrationVariableDTO[]
+    findApplicationRegistrationVariables: ApplicationRegistrationVariable[]
     applicationRegistrationTarballUrl?: Scalars['String']
     currentUser: User
     currentWorkspace: Workspace
@@ -4579,20 +4566,6 @@ export interface RotateClientSecretGenqlSelection{
     __scalar?: boolean | number
 }
 
-export interface ApplicationRegistrationVariableDTOGenqlSelection{
-    id?: boolean | number
-    key?: boolean | number
-    value?: boolean | number
-    description?: boolean | number
-    isSecret?: boolean | number
-    isRequired?: boolean | number
-    isFilled?: boolean | number
-    createdAt?: boolean | number
-    updatedAt?: boolean | number
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
 export interface RelationGenqlSelection{
     type?: boolean | number
     sourceObjectMetadata?: ObjectGenqlSelection
@@ -5709,7 +5682,7 @@ export interface QueryGenqlSelection{
     findManyApplicationRegistrations?: ApplicationRegistrationGenqlSelection
     findOneApplicationRegistration?: (ApplicationRegistrationGenqlSelection & { __args: {id: Scalars['String']} })
     findApplicationRegistrationStats?: (ApplicationRegistrationStatsGenqlSelection & { __args: {id: Scalars['String']} })
-    findApplicationRegistrationVariables?: (ApplicationRegistrationVariableDTOGenqlSelection & { __args: {applicationRegistrationId: Scalars['String']} })
+    findApplicationRegistrationVariables?: (ApplicationRegistrationVariableGenqlSelection & { __args: {applicationRegistrationId: Scalars['String']} })
     applicationRegistrationTarballUrl?: { __args: {id: Scalars['String']} }
     currentUser?: UserGenqlSelection
     currentWorkspace?: WorkspaceGenqlSelection
@@ -7427,14 +7400,6 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
     
 
 
-    const ApplicationRegistrationVariableDTO_possibleTypes: string[] = ['ApplicationRegistrationVariableDTO']
-    export const isApplicationRegistrationVariableDTO = (obj?: { __typename?: any } | null): obj is ApplicationRegistrationVariableDTO => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isApplicationRegistrationVariableDTO"')
-      return ApplicationRegistrationVariableDTO_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
     const Relation_possibleTypes: string[] = ['Relation']
     export const isRelation = (obj?: { __typename?: any } | null): obj is Relation => {
       if (!obj?.__typename) throw new Error('__typename is missing in "isRelation"')

packages/twenty-front/src/generated-metadata/graphql.ts

@@ -362,19 +362,6 @@ export type ApplicationRegistrationVariable = {
   updatedAt: Scalars['DateTime'];
 };
 
-export type ApplicationRegistrationVariableDto = {
-  __typename?: 'ApplicationRegistrationVariableDTO';
-  createdAt: Scalars['DateTime'];
-  description: Scalars['String'];
-  id: Scalars['UUID'];
-  isFilled: Scalars['Boolean'];
-  isRequired: Scalars['Boolean'];
-  isSecret: Scalars['Boolean'];
-  key: Scalars['String'];
-  updatedAt: Scalars['DateTime'];
-  value?: Maybe<Scalars['String']>;
-};
-
 export type ApplicationTokenPair = {
   __typename?: 'ApplicationTokenPair';
   applicationAccessToken: AuthToken;
@@ -4132,7 +4119,7 @@ export type Query = {
   findApplicationRegistrationByClientId?: Maybe<PublicApplicationRegistration>;
   findApplicationRegistrationByUniversalIdentifier?: Maybe<ApplicationRegistration>;
   findApplicationRegistrationStats: ApplicationRegistrationStats;
-  findApplicationRegistrationVariables: Array<ApplicationRegistrationVariableDto>;
+  findApplicationRegistrationVariables: Array<ApplicationRegistrationVariable>;
   findManyAgents: Array<Agent>;
   findManyApplicationRegistrations: Array<ApplicationRegistration>;
   findManyApplications: Array<Application>;
@@ -7020,7 +7007,7 @@ export type FindApplicationRegistrationVariablesQueryVariables = Exact<{
 }>;
 
 
-export type FindApplicationRegistrationVariablesQuery = { __typename?: 'Query', findApplicationRegistrationVariables: Array<{ __typename?: 'ApplicationRegistrationVariableDTO', id: string, key: string, value?: string | null, description: string, isSecret: boolean, isRequired: boolean, isFilled: boolean, createdAt: string, updatedAt: string }> };
+export type FindApplicationRegistrationVariablesQuery = { __typename?: 'Query', findApplicationRegistrationVariables: Array<{ __typename?: 'ApplicationRegistrationVariable', id: string, key: string, description: string, isSecret: boolean, isRequired: boolean, isFilled: boolean, createdAt: string, updatedAt: string }> };
 
 export type FindManyApplicationRegistrationsQueryVariables = Exact<{ [key: string]: never; }>;
 
@@ -8105,7 +8092,7 @@ export const UpdateApplicationRegistrationDocument = {"kind":"Document","definit
 export const UpdateApplicationRegistrationVariableDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"UpdateApplicationRegistrationVariable"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"input"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"UpdateApplicationRegistrationVariableInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"updateApplicationRegistrationVariable"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"input"},"value":{"kind":"Variable","name":{"kind":"Name","value":"input"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"key"}},{"kind":"Field","name":{"kind":"Name","value":"description"}},{"kind":"Field","name":{"kind":"Name","value":"isSecret"}},{"kind":"Field","name":{"kind":"Name","value":"isRequired"}},{"kind":"Field","name":{"kind":"Name","value":"isFilled"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"updatedAt"}}]}}]}}]} as unknown as DocumentNode<UpdateApplicationRegistrationVariableMutation, UpdateApplicationRegistrationVariableMutationVariables>;
 export const ApplicationRegistrationTarballUrlDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"ApplicationRegistrationTarballUrl"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"id"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"applicationRegistrationTarballUrl"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"id"},"value":{"kind":"Variable","name":{"kind":"Name","value":"id"}}}]}]}}]} as unknown as DocumentNode<ApplicationRegistrationTarballUrlQuery, ApplicationRegistrationTarballUrlQueryVariables>;
 export const FindApplicationRegistrationStatsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"FindApplicationRegistrationStats"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"id"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"findApplicationRegistrationStats"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"id"},"value":{"kind":"Variable","name":{"kind":"Name","value":"id"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"activeInstalls"}},{"kind":"Field","name":{"kind":"Name","value":"mostInstalledVersion"}},{"kind":"Field","name":{"kind":"Name","value":"versionDistribution"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"version"}},{"kind":"Field","name":{"kind":"Name","value":"count"}}]}}]}}]}}]} as unknown as DocumentNode<FindApplicationRegistrationStatsQuery, FindApplicationRegistrationStatsQueryVariables>;
-export const FindApplicationRegistrationVariablesDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"FindApplicationRegistrationVariables"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"applicationRegistrationId"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"findApplicationRegistrationVariables"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"applicationRegistrationId"},"value":{"kind":"Variable","name":{"kind":"Name","value":"applicationRegistrationId"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"key"}},{"kind":"Field","name":{"kind":"Name","value":"value"}},{"kind":"Field","name":{"kind":"Name","value":"description"}},{"kind":"Field","name":{"kind":"Name","value":"isSecret"}},{"kind":"Field","name":{"kind":"Name","value":"isRequired"}},{"kind":"Field","name":{"kind":"Name","value":"isFilled"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"updatedAt"}}]}}]}}]} as unknown as DocumentNode<FindApplicationRegistrationVariablesQuery, FindApplicationRegistrationVariablesQueryVariables>;
+export const FindApplicationRegistrationVariablesDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"FindApplicationRegistrationVariables"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"applicationRegistrationId"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"findApplicationRegistrationVariables"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"applicationRegistrationId"},"value":{"kind":"Variable","name":{"kind":"Name","value":"applicationRegistrationId"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"key"}},{"kind":"Field","name":{"kind":"Name","value":"description"}},{"kind":"Field","name":{"kind":"Name","value":"isSecret"}},{"kind":"Field","name":{"kind":"Name","value":"isRequired"}},{"kind":"Field","name":{"kind":"Name","value":"isFilled"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"updatedAt"}}]}}]}}]} as unknown as DocumentNode<FindApplicationRegistrationVariablesQuery, FindApplicationRegistrationVariablesQueryVariables>;
 export const FindManyApplicationRegistrationsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"FindManyApplicationRegistrations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"findManyApplicationRegistrations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"ApplicationRegistrationFragment"}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"ApplicationRegistrationFragment"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"ApplicationRegistration"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"universalIdentifier"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"logoUrl"}},{"kind":"Field","name":{"kind":"Name","value":"oAuthClientId"}},{"kind":"Field","name":{"kind":"Name","value":"oAuthRedirectUris"}},{"kind":"Field","name":{"kind":"Name","value":"oAuthScopes"}},{"kind":"Field","name":{"kind":"Name","value":"sourceType"}},{"kind":"Field","name":{"kind":"Name","value":"sourcePackage"}},{"kind":"Field","name":{"kind":"Name","value":"latestAvailableVersion"}},{"kind":"Field","name":{"kind":"Name","value":"isListed"}},{"kind":"Field","name":{"kind":"Name","value":"isFeatured"}},{"kind":"Field","name":{"kind":"Name","value":"isPreInstalled"}},{"kind":"Field","name":{"kind":"Name","value":"isConfigured"}},{"kind":"Field","name":{"kind":"Name","value":"ownerWorkspaceId"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"updatedAt"}}]}}]} as unknown as DocumentNode<FindManyApplicationRegistrationsQuery, FindManyApplicationRegistrationsQueryVariables>;
 export const FindOneApplicationRegistrationDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"FindOneApplicationRegistration"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"id"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"findOneApplicationRegistration"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"id"},"value":{"kind":"Variable","name":{"kind":"Name","value":"id"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"ApplicationRegistrationFragment"}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"ApplicationRegistrationFragment"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"ApplicationRegistration"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"universalIdentifier"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"logoUrl"}},{"kind":"Field","name":{"kind":"Name","value":"oAuthClientId"}},{"kind":"Field","name":{"kind":"Name","value":"oAuthRedirectUris"}},{"kind":"Field","name":{"kind":"Name","value":"oAuthScopes"}},{"kind":"Field","name":{"kind":"Name","value":"sourceType"}},{"kind":"Field","name":{"kind":"Name","value":"sourcePackage"}},{"kind":"Field","name":{"kind":"Name","value":"latestAvailableVersion"}},{"kind":"Field","name":{"kind":"Name","value":"isListed"}},{"kind":"Field","name":{"kind":"Name","value":"isFeatured"}},{"kind":"Field","name":{"kind":"Name","value":"isPreInstalled"}},{"kind":"Field","name":{"kind":"Name","value":"isConfigured"}},{"kind":"Field","name":{"kind":"Name","value":"ownerWorkspaceId"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"updatedAt"}}]}}]} as unknown as DocumentNode<FindOneApplicationRegistrationQuery, FindOneApplicationRegistrationQueryVariables>;
 export const UninstallApplicationDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"UninstallApplication"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"universalIdentifier"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"uninstallApplication"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"universalIdentifier"},"value":{"kind":"Variable","name":{"kind":"Name","value":"universalIdentifier"}}}]}]}}]} as unknown as DocumentNode<UninstallApplicationMutation, UninstallApplicationMutationVariables>;

packages/twenty-front/src/modules/object-record/cache/utils/__tests__/__snapshots__/getRecordFromRecordNode.test.ts.snap

@@ -105,3 +105,5 @@ exports[`getRecordFromRecordNode should handle null and undefined values 1`] = `
   "phone": undefined,
 }
 `;
+
+exports[`getRecordFromRecordNode should return an empty object when record node is undefined 1`] = `{}`;

packages/twenty-front/src/modules/object-record/cache/utils/__tests__/getRecordFromRecordNode.test.ts

@@ -137,4 +137,12 @@ describe('getRecordFromRecordNode', () => {
 
     expect(result).toMatchSnapshot();
   });
+
+  it('should return an empty object when record node is undefined', () => {
+    const result = getRecordFromRecordNode({
+      recordNode: undefined,
+    });
+
+    expect(result).toMatchSnapshot();
+  });
 });

packages/twenty-front/src/modules/object-record/cache/utils/getRecordFromRecordNode.ts

@@ -7,8 +7,12 @@ import { isUndefinedOrNull } from '~/utils/isUndefinedOrNull';
 export const getRecordFromRecordNode = <T extends ObjectRecord>({
   recordNode,
 }: {
-  recordNode: RecordGqlNode;
+  recordNode: RecordGqlNode | undefined;
 }): T => {
+  if (!isDefined(recordNode)) {
+    return {} as T;
+  }
+
   const { id, __typename } = recordNode;
 
   return {

packages/twenty-front/src/modules/object-record/cache/utils/getRecordsFromRecordConnection.ts

@@ -1,13 +1,31 @@
+import { captureMessage, withScope } from '@sentry/react';
+
 import { getRecordFromRecordNode } from '@/object-record/cache/utils/getRecordFromRecordNode';
 import { type RecordGqlConnectionEdgesRequired } from '@/object-record/graphql/types/RecordGqlConnectionEdgesRequired';
 import { type ObjectRecord } from '@/object-record/types/ObjectRecord';
+import { isDefined } from 'twenty-shared/utils';
 
 export const getRecordsFromRecordConnection = <T extends ObjectRecord>({
   recordConnection,
 }: {
   recordConnection: RecordGqlConnectionEdgesRequired;
 }): T[] => {
-  return recordConnection?.edges?.map((edge) =>
-    getRecordFromRecordNode<T>({ recordNode: edge.node }),
-  );
+  const edges = recordConnection?.edges ?? [];
+
+  const invalidEdgeCount = edges.filter((edge) => !isDefined(edge?.node)).length;
+
+  if (invalidEdgeCount > 0) {
+    withScope((scope) => {
+      scope.setFingerprint(['record-connection-missing-node']);
+      scope.setLevel('warning');
+      scope.setExtra('invalidEdgeCount', invalidEdgeCount);
+      scope.setExtra('edgesCount', edges.length);
+
+      captureMessage('Record connection contains edge without node');
+    });
+  }
+
+  return edges
+    .filter((edge) => isDefined(edge?.node))
+    .map((edge) => getRecordFromRecordNode<T>({ recordNode: edge.node }));
 };

packages/twenty-front/src/modules/object-record/record-card/components/RecordCard.tsx

@@ -37,17 +37,16 @@ const StyledBoardCard = styled.div<{
   }
 
   .checkbox-container {
-    max-width: 0;
     opacity: 0;
-    pointer-events: none;
     transition: all ease-in-out 160ms;
   }
 
-  &[data-selected='true'] .checkbox-container,
+  &[data-selected='true'] .checkbox-container {
+    opacity: 1;
+  }
+
   &:hover .checkbox-container {
-    max-width: ${themeCssVariables.spacing[6]};
     opacity: 1;
-    pointer-events: auto;
   }
 
   .compact-icon-container {

packages/twenty-front/src/modules/settings/application-registrations/graphql/queries/findApplicationRegistrationVariables.ts

@@ -9,7 +9,6 @@ export const FIND_APPLICATION_REGISTRATION_VARIABLES = gql`
     ) {
       id
       key
-      value
       description
       isSecret
       isRequired

packages/twenty-front/src/pages/settings/applications/components/SettingsApplicationRegistrationConfigVariableDetail.tsx

@@ -7,6 +7,7 @@ import {
   UpdateApplicationRegistrationVariableDocument,
 } from '~/generated-metadata/graphql';
 import { useMutation, useQuery } from '@apollo/client/react';
+import { useSnackBar } from '@/ui/feedback/snack-bar-manager/hooks/useSnackBar';
 import { isNonEmptyString } from '@sniptt/guards';
 import { SubMenuTopBarContainer } from '@/ui/layout/page/components/SubMenuTopBarContainer';
 import { getSettingsPath } from 'twenty-shared/utils';
@@ -144,7 +145,9 @@ export const SettingsApplicationRegistrationConfigVariableDetail = () => {
           <TextInput
             value={value}
             placeholder={
-              !isEditing ? (variable.value ?? t`set-config-value`) : ''
+              variable.isFilled
+                ? '••••••••••••••••••••••••'
+                : t`set-config-value`
             }
             onChange={setValue}
             disabled={!isEditing}

packages/twenty-front/src/pages/settings/applications/tabs/SettingsApplicationRegistrationConfigTab.tsx

@@ -1,6 +1,9 @@
 import type { ApplicationRegistrationData } from '~/pages/settings/applications/tabs/types/ApplicationRegistrationData';
 import { useQuery } from '@apollo/client/react';
-import { FindApplicationRegistrationVariablesDocument } from '~/generated-metadata/graphql';
+import {
+  type ApplicationRegistrationVariable,
+  FindApplicationRegistrationVariablesDocument,
+} from '~/generated-metadata/graphql';
 import { Section } from 'twenty-ui/layout';
 import { H2Title, Status } from 'twenty-ui/display';
 import { useLingui } from '@lingui/react/macro';
@@ -25,12 +28,17 @@ export const SettingsApplicationRegistrationConfigTab = ({
     },
   );
 
-  const variables = variablesData?.findApplicationRegistrationVariables ?? [];
+  const variables: ApplicationRegistrationVariable[] =
+    variablesData?.findApplicationRegistrationVariables ?? [];
 
   const configVariables = variables.map((variable) => ({
     name: variable.key,
     description: variable.description,
-    value: variable.value ?? <Status color="gray" text={t`Not set`} />,
+    value: variable.isFilled ? (
+      '••••••••••'
+    ) : (
+      <Status color="gray" text={t`Not set`} />
+    ),
     to: getSettingsPath(
       SettingsPath.ApplicationRegistrationConfigVariableDetails,
       {

packages/twenty-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twenty-sdk",
-  "version": "2.4.0",
+  "version": "2.3.1",
   "sideEffects": false,
   "bin": {
     "twenty": "dist/cli.cjs"

packages/twenty-server/src/database/commands/upgrade-version-command/2-5/2-5-instance-command-fast-1778550000000-create-signing-key-table.ts

@@ -1,34 +0,0 @@
-import { type QueryRunner } from 'typeorm';
-
-import { RegisteredInstanceCommand } from 'src/engine/core-modules/upgrade/decorators/registered-instance-command.decorator';
-import { type FastInstanceCommand } from 'src/engine/core-modules/upgrade/interfaces/fast-instance-command.interface';
-
-@RegisteredInstanceCommand('2.5.0', 1778550000000)
-export class CreateSigningKeyTableFastInstanceCommand
-  implements FastInstanceCommand
-{
-  public async up(queryRunner: QueryRunner): Promise<void> {
-    await queryRunner.query(
-      `CREATE TABLE IF NOT EXISTS "core"."signingKey" (
-        "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
-        "publicKey" character varying NOT NULL,
-        "privateKey" character varying,
-        "isCurrent" boolean NOT NULL DEFAULT false,
-        "revokedAt" TIMESTAMP WITH TIME ZONE,
-        "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
-        "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
-        CONSTRAINT "PK_signingKey_id" PRIMARY KEY ("id")
-      )`,
-    );
-    await queryRunner.query(
-      `CREATE UNIQUE INDEX IF NOT EXISTS "IDX_SIGNING_KEY_IS_CURRENT_UNIQUE" ON "core"."signingKey" ("isCurrent") WHERE "isCurrent" = true`,
-    );
-  }
-
-  public async down(queryRunner: QueryRunner): Promise<void> {
-    await queryRunner.query(
-      `DROP INDEX IF EXISTS "core"."IDX_SIGNING_KEY_IS_CURRENT_UNIQUE"`,
-    );
-    await queryRunner.query(`DROP TABLE IF EXISTS "core"."signingKey"`);
-  }
-}

packages/twenty-server/src/database/commands/upgrade-version-command/instance-commands.constant.ts

@@ -32,7 +32,6 @@ import { AddMetadataToBillingPriceFastInstanceCommand } from 'src/database/comma
 import { AddEmailGroupChannelTypeFastInstanceCommand } from 'src/database/commands/upgrade-version-command/2-4/2-4-instance-command-fast-1778256809018-add-email-group-channel-type';
 import { AddApplicationIdToPublicDomainFastInstanceCommand } from 'src/database/commands/upgrade-version-command/2-4/2-4-instance-command-fast-1798000003000-add-application-id-to-public-domain';
 import { AddIsInternalMessagesImportEnabledFastInstanceCommand } from 'src/database/commands/upgrade-version-command/2-5/2-5-instance-command-fast-1778525104406-add-is-internal-messages-import-enabled';
-import { CreateSigningKeyTableFastInstanceCommand } from 'src/database/commands/upgrade-version-command/2-5/2-5-instance-command-fast-1778550000000-create-signing-key-table';
 import { EncryptConnectedAccountTokensSlowInstanceCommand } from 'src/database/commands/upgrade-version-command/2-5/2-5-instance-command-slow-1798000004000-encrypt-connected-account-tokens';
 
 export const INSTANCE_COMMANDS = [
@@ -68,6 +67,5 @@ export const INSTANCE_COMMANDS = [
   AddEmailGroupChannelTypeFastInstanceCommand,
   AddApplicationIdToPublicDomainFastInstanceCommand,
   AddIsInternalMessagesImportEnabledFastInstanceCommand,
-  CreateSigningKeyTableFastInstanceCommand,
   EncryptConnectedAccountTokensSlowInstanceCommand,
 ];

packages/twenty-server/src/engine/core-entity-cache/types/core-entity-cache-key.type.ts

@@ -6,7 +6,6 @@ export type CoreEntityCacheDataMap = {
   workspaceEntity: FlatWorkspace;
   user: FlatUser;
   userWorkspaceEntity: FlatUserWorkspace;
-  signingKeyPublicKey: string;
 };
 
 export type CoreEntityCacheKeyName = keyof CoreEntityCacheDataMap;
@@ -15,5 +14,4 @@ export const CORE_ENTITY_CACHE_KEYS: Record<CoreEntityCacheKeyName, string> = {
   workspaceEntity: 'workspace',
   user: 'user',
   userWorkspaceEntity: 'user-workspace',
-  signingKeyPublicKey: 'signing-key-public-key',
 };

packages/twenty-server/src/engine/core-modules/application/application-oauth/application-oauth.resolver.ts

@@ -31,7 +31,7 @@ export class ApplicationOAuthResolver {
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
   ): Promise<ApplicationTokenPairDTO> {
     const applicationRefreshTokenPayload =
-      await this.applicationTokenService.validateApplicationRefreshToken(
+      this.applicationTokenService.validateApplicationRefreshToken(
         applicationRefreshToken,
       );
 

packages/twenty-server/src/engine/core-modules/application/application-oauth/oauth.service.ts

@@ -334,7 +334,7 @@ export class OAuthService {
 
     try {
       const payload =
-        await this.applicationTokenService.validateApplicationRefreshToken(
+        this.applicationTokenService.validateApplicationRefreshToken(
           refreshToken,
         );
 
@@ -409,9 +409,7 @@ export class OAuthService {
     // We validate the token to log that revocation was requested.
     try {
       const payload =
-        await this.applicationTokenService.validateApplicationRefreshToken(
-          token,
-        );
+        this.applicationTokenService.validateApplicationRefreshToken(token);
 
       this.logger.log(
         `Token revocation requested for application ${payload.applicationId}`,
@@ -450,7 +448,7 @@ export class OAuthService {
     }
 
     try {
-      await this.applicationTokenService.validateApplicationRefreshToken(token);
+      this.applicationTokenService.validateApplicationRefreshToken(token);
 
       const decoded = this.applicationTokenService.decodeToken(token);
 
@@ -485,9 +483,7 @@ export class OAuthService {
       // Try as access token (with signature verification)
       try {
         const payload =
-          await this.applicationTokenService.validateApplicationAccessToken(
-            token,
-          );
+          this.applicationTokenService.validateApplicationAccessToken(token);
 
         const application = await this.applicationRepository.findOne({
           where: { id: payload.applicationId },

packages/twenty-server/src/engine/core-modules/application/application-registration-variable/application-registration-variable.service.ts

@@ -14,7 +14,6 @@ import {
 import { type CreateApplicationRegistrationVariableInput } from 'src/engine/core-modules/application/application-registration-variable/dtos/create-application-registration-variable.input';
 import { type UpdateApplicationRegistrationVariableInput } from 'src/engine/core-modules/application/application-registration-variable/dtos/update-application-registration-variable.input';
 import { SecretEncryptionService } from 'src/engine/core-modules/secret-encryption/secret-encryption.service';
-import { ApplicationRegistrationVariableDTO } from 'src/engine/core-modules/application/application-registration-variable/dtos/application-registration-variable.dto';
 
 @Injectable()
 export class ApplicationRegistrationVariableService {
@@ -26,29 +25,19 @@ export class ApplicationRegistrationVariableService {
     private readonly encryptionService: SecretEncryptionService,
   ) {}
 
-  async findVariablesWithObfuscatedValues(
+  async findVariables(
     applicationRegistrationId: string,
     workspaceId: string,
-  ): Promise<ApplicationRegistrationVariableDTO[]> {
+  ): Promise<ApplicationRegistrationVariableEntity[]> {
     await this.assertRegistrationOwnedByWorkspace(
       applicationRegistrationId,
       workspaceId,
     );
 
-    const variables = await this.variableRepository.find({
+    return this.variableRepository.find({
       where: { applicationRegistrationId },
       order: { key: 'ASC' },
     });
-
-    return variables.map((variable) => ({
-      ...variable,
-      isFilled: variable.isFilled,
-      value: variable.isFilled
-        ? variable.isSecret
-          ? '•••••••••••••'
-          : this.encryptionService.decrypt(variable.encryptedValue)
-        : null,
-    }));
   }
 
   async createVariable(

packages/twenty-server/src/engine/core-modules/application/application-registration-variable/dtos/application-registration-variable.dto.ts

@@ -1,40 +0,0 @@
-import { Field, ObjectType } from '@nestjs/graphql';
-import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
-import { IsBoolean, IsString } from 'class-validator';
-import { IDField } from '@ptc-org/nestjs-query-graphql';
-
-@ObjectType()
-export class ApplicationRegistrationVariableDTO {
-  @IDField(() => UUIDScalarType)
-  id: string;
-
-  @IsString()
-  @Field()
-  key: string;
-
-  @IsString()
-  @Field(() => String, { nullable: true })
-  value?: string | null;
-
-  @IsString()
-  @Field()
-  description: string;
-
-  @IsBoolean()
-  @Field()
-  isSecret: boolean;
-
-  @IsBoolean()
-  @Field()
-  isRequired: boolean;
-
-  @IsBoolean()
-  @Field()
-  isFilled: boolean;
-
-  @Field(() => Date)
-  createdAt: Date;
-
-  @Field(() => Date)
-  updatedAt: Date;
-}

packages/twenty-server/src/engine/core-modules/application/application-registration/application-registration.resolver.ts

@@ -54,7 +54,6 @@ import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
 import { SettingsPermissionGuard } from 'src/engine/guards/settings-permission.guard';
 import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
 import { streamToBuffer } from 'src/utils/stream-to-buffer';
-import { ApplicationRegistrationVariableDTO } from 'src/engine/core-modules/application/application-registration-variable/dtos/application-registration-variable.dto';
 
 @UsePipes(ResolverValidationPipe)
 @MetadataResolver(() => ApplicationRegistrationEntity)
@@ -187,12 +186,12 @@ export class ApplicationRegistrationResolver {
     WorkspaceAuthGuard,
     SettingsPermissionGuard(PermissionFlagType.API_KEYS_AND_WEBHOOKS),
   )
-  @Query(() => [ApplicationRegistrationVariableDTO])
+  @Query(() => [ApplicationRegistrationVariableEntity])
   async findApplicationRegistrationVariables(
     @Args('applicationRegistrationId') applicationRegistrationId: string,
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
-  ): Promise<ApplicationRegistrationVariableDTO[]> {
-    return this.applicationRegistrationVariableService.findVariablesWithObfuscatedValues(
+  ): Promise<ApplicationRegistrationVariableEntity[]> {
+    return this.applicationRegistrationVariableService.findVariables(
       applicationRegistrationId,
       workspaceId,
     );

packages/twenty-server/src/engine/core-modules/application/application-variable/application-variable.service.ts

@@ -12,7 +12,6 @@ import {
 import { SECRET_APPLICATION_VARIABLE_MASK } from 'src/engine/core-modules/application/application-variable/constants/secret-application-variable-mask.constant';
 import { SecretEncryptionService } from 'src/engine/core-modules/secret-encryption/secret-encryption.service';
 import { WorkspaceCacheService } from 'src/engine/workspace-cache/services/workspace-cache.service';
-import { isNonEmptyString } from '@sniptt/guards';
 
 @Injectable()
 export class ApplicationVariableEntityService {
@@ -28,10 +27,6 @@ export class ApplicationVariableEntityService {
       return applicationVariable.value;
     }
 
-    if (!isNonEmptyString(applicationVariable.value)) {
-      return '';
-    }
-
     return this.secretEncryptionService.decryptAndMask({
       value: applicationVariable.value,
       mask: SECRET_APPLICATION_VARIABLE_MASK,

packages/twenty-server/src/engine/core-modules/application/connection-provider/__tests__/connection-provider-oauth-flow.service.spec.ts

@@ -321,7 +321,7 @@ describe('ConnectionProviderOAuthFlowService', () => {
     };
 
     beforeEach(() => {
-      jwtWrapperService.verifyJwtToken.mockResolvedValue(stateClaims);
+      jwtWrapperService.verifyJwtToken.mockReturnValue(stateClaims);
       connectionProviderService.findOneByIdOrThrow.mockResolvedValue(
         baseProvider,
       );
@@ -358,7 +358,7 @@ describe('ConnectionProviderOAuthFlowService', () => {
     });
 
     it('updates the existing ConnectedAccount when reconnectingConnectedAccountId is supplied', async () => {
-      jwtWrapperService.verifyJwtToken.mockResolvedValue({
+      jwtWrapperService.verifyJwtToken.mockReturnValue({
         ...stateClaims,
         reconnectingConnectedAccountId: 'existing-account-id',
       });
@@ -389,7 +389,7 @@ describe('ConnectionProviderOAuthFlowService', () => {
     });
 
     it('updates visibility on an existing ConnectedAccount when reconnecting', async () => {
-      jwtWrapperService.verifyJwtToken.mockResolvedValue({
+      jwtWrapperService.verifyJwtToken.mockReturnValue({
         ...stateClaims,
         visibility: 'workspace',
         reconnectingConnectedAccountId: 'existing-account-id',
@@ -409,7 +409,7 @@ describe('ConnectionProviderOAuthFlowService', () => {
     });
 
     it('persists the workspace visibility when state asks for it', async () => {
-      jwtWrapperService.verifyJwtToken.mockResolvedValue({
+      jwtWrapperService.verifyJwtToken.mockReturnValue({
         ...stateClaims,
         visibility: 'workspace',
       });
@@ -425,9 +425,9 @@ describe('ConnectionProviderOAuthFlowService', () => {
     });
 
     it('rejects an invalid state', async () => {
-      jwtWrapperService.verifyJwtToken.mockRejectedValue(
-        new Error('JWT expired'),
-      );
+      jwtWrapperService.verifyJwtToken.mockImplementation(() => {
+        throw new Error('JWT expired');
+      });
 
       await expect(
         service.completeAuthorizationFlow({

packages/twenty-server/src/engine/core-modules/application/connection-provider/connection-provider-oauth-flow.service.ts

@@ -141,7 +141,7 @@ export class ConnectionProviderOAuthFlowService {
   }
 
   async completeAuthorizationFlow(args: CallbackArgs): Promise<CallbackResult> {
-    const statePayload = await this.verifyState(args.state);
+    const statePayload = this.verifyState(args.state);
 
     const provider = await this.oauthProviderService.findOneByIdOrThrow(
       statePayload.connectionProviderId,
@@ -208,11 +208,11 @@ export class ConnectionProviderOAuthFlowService {
     });
   }
 
-  private async verifyState(state: string): Promise<AppOAuthStateJwtPayload> {
+  private verifyState(state: string): AppOAuthStateJwtPayload {
     try {
-      const verified = (await this.jwtWrapperService.verifyJwtToken(
+      const verified = this.jwtWrapperService.verifyJwtToken(
         state,
-      )) as AppOAuthStateJwtPayload;
+      ) as AppOAuthStateJwtPayload;
 
       if (verified.type !== JwtTokenTypeEnum.APP_OAUTH_STATE) {
         throw new Error('Wrong JWT type for OAuth state');

packages/twenty-server/src/engine/core-modules/auth/strategies/jwt.auth.strategy.spec.ts

@@ -47,10 +47,6 @@ describe('JwtAuthStrategy', () => {
 
     jwtWrapperService = {
       extractJwtFromRequest: jest.fn(() => () => 'token'),
-      resolveVerificationKey: jest.fn(async () => ({
-        key: 'mock-key',
-        algorithm: 'HS256',
-      })),
     };
 
     permissionsService = {