chore: import upstream snapshot with attribution

apps/sim/ee/workspace-forking/lib/mapping/resources.ts

@@ -0,0 +1,632 @@
+import {
+  credential,
+  customTools,
+  document,
+  knowledgeBase,
+  mcpServers,
+  skill,
+  userTableDefinitions,
+  workflow,
+  workflowDeploymentVersion,
+  workflowMcpServer,
+  workspaceEnvironment,
+  workspaceFileFolder,
+  workspaceFiles,
+} from '@sim/db/schema'
+import { and, count, eq, exists, inArray, isNull, sql } from 'drizzle-orm'
+import type { ForkCopyableKind } from '@/lib/api/contracts/workspace-fork'
+import type { DbOrTx } from '@/lib/db/types'
+import type { ForkResourceType } from '@/ee/workspace-forking/lib/mapping/mapping-store'
+import type {
+  ForkMcpServerMeta,
+  ForkRemapKind,
+} from '@/ee/workspace-forking/lib/remap/remap-references'
+
+export interface ForkResourceCandidate {
+  id: string
+  label: string
+  providerId?: string
+}
+
+export const CANDIDATE_LIMIT = 1000
+
+/** The set of env-var keys defined in a workspace (for resolver identity + gating). */
+export async function getWorkspaceEnvKeys(
+  executor: DbOrTx,
+  workspaceId: string
+): Promise<Set<string>> {
+  const [row] = await executor
+    .select({ variables: workspaceEnvironment.variables })
+    .from(workspaceEnvironment)
+    .where(eq(workspaceEnvironment.workspaceId, workspaceId))
+    .limit(1)
+  const variables = row?.variables
+  if (!variables || typeof variables !== 'object') return new Set()
+  return new Set(Object.keys(variables as Record<string, unknown>))
+}
+
+// Shared `{ id, label }` candidate queries for the content resource kinds that BOTH the
+// mapping-target picker and the fork-copy picker list - one source of the archived/deleted
+// filters so the two pickers can never drift apart, and one optional `ids` filter so the picker
+// path (unfiltered, capped) and the existence/label path (exact ids) share a single definition
+// per kind. When `ids` is given the query is filtered to those exact ids and is NOT capped, so a
+// valid target sitting past the candidate cap is never wrongly dropped. Credentials, env vars
+// (mapping-only), and files-with-folder (copy-only) keep their own helpers below.
+const tableCandidatesQuery = (executor: DbOrTx, workspaceId: string, ids?: string[]) => {
+  const query = executor
+    .select({ id: userTableDefinitions.id, label: userTableDefinitions.name })
+    .from(userTableDefinitions)
+    .where(
+      and(
+        eq(userTableDefinitions.workspaceId, workspaceId),
+        isNull(userTableDefinitions.archivedAt),
+        ids ? inArray(userTableDefinitions.id, ids) : undefined
+      )
+    )
+  return ids ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+const knowledgeBaseCandidatesQuery = (executor: DbOrTx, workspaceId: string, ids?: string[]) => {
+  const query = executor
+    .select({ id: knowledgeBase.id, label: knowledgeBase.name })
+    .from(knowledgeBase)
+    .where(
+      and(
+        eq(knowledgeBase.workspaceId, workspaceId),
+        isNull(knowledgeBase.deletedAt),
+        ids ? inArray(knowledgeBase.id, ids) : undefined
+      )
+    )
+  return ids ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+const customToolCandidatesQuery = (executor: DbOrTx, workspaceId: string, ids?: string[]) => {
+  const query = executor
+    .select({ id: customTools.id, label: customTools.title })
+    .from(customTools)
+    .where(
+      and(eq(customTools.workspaceId, workspaceId), ids ? inArray(customTools.id, ids) : undefined)
+    )
+  return ids ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+const skillCandidatesQuery = (executor: DbOrTx, workspaceId: string, ids?: string[]) => {
+  const query = executor
+    .select({ id: skill.id, label: skill.name })
+    .from(skill)
+    .where(and(eq(skill.workspaceId, workspaceId), ids ? inArray(skill.id, ids) : undefined))
+  return ids ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+const mcpServerCandidatesQuery = (executor: DbOrTx, workspaceId: string, ids?: string[]) => {
+  const query = executor
+    .select({ id: mcpServers.id, label: mcpServers.name })
+    .from(mcpServers)
+    .where(
+      and(
+        eq(mcpServers.workspaceId, workspaceId),
+        isNull(mcpServers.deletedAt),
+        ids ? inArray(mcpServers.id, ids) : undefined
+      )
+    )
+  return ids ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+// Workspace-file mapping candidates are keyed by STORAGE KEY (not `workspace_files.id`): a
+// `file-upload` reference stores the storage key, so a mapping target must be a key too. Only
+// durable, non-deleted `workspace` files are mappable (chat/copilot uploads are session-scoped).
+// An optional `keys` filter shares this definition between the mapping picker (unfiltered, capped)
+// and the cap-free existence check.
+const fileCandidatesQuery = (executor: DbOrTx, workspaceId: string, keys?: string[]) => {
+  const query = executor
+    .select({
+      id: workspaceFiles.key,
+      label: sql<string>`coalesce(${workspaceFiles.displayName}, ${workspaceFiles.originalName})`,
+    })
+    .from(workspaceFiles)
+    .where(
+      and(
+        eq(workspaceFiles.workspaceId, workspaceId),
+        eq(workspaceFiles.context, 'workspace'),
+        isNull(workspaceFiles.deletedAt),
+        keys ? inArray(workspaceFiles.key, keys) : undefined
+      )
+    )
+  return keys ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+// Copyable workspace files WITH their folder grouping (LEFT JOIN gated on a live folder, so a file
+// whose folder was deleted shows ungrouped). Shared by the fork-copy picker (unfiltered, capped)
+// and the promote copyable-label lookup (filtered by exact storage keys, never capped), so the
+// file+folder shape and its filters live in one place. Selects both the row id and the storage
+// key; the copy picker reads `id`, the key-addressed label lookup reads `key`.
+const fileCandidatesWithFolderQuery = (
+  executor: DbOrTx,
+  workspaceId: string,
+  options: { keys?: string[] } = {}
+) => {
+  const { keys } = options
+  const query = executor
+    .select({
+      id: workspaceFiles.id,
+      key: workspaceFiles.key,
+      label: sql<string>`coalesce(${workspaceFiles.displayName}, ${workspaceFiles.originalName})`,
+      folderId: workspaceFiles.folderId,
+      folderName: workspaceFileFolder.name,
+    })
+    .from(workspaceFiles)
+    .leftJoin(
+      workspaceFileFolder,
+      and(
+        eq(workspaceFiles.folderId, workspaceFileFolder.id),
+        isNull(workspaceFileFolder.deletedAt)
+      )
+    )
+    .where(
+      and(
+        eq(workspaceFiles.workspaceId, workspaceId),
+        eq(workspaceFiles.context, 'workspace'),
+        isNull(workspaceFiles.deletedAt),
+        keys ? inArray(workspaceFiles.key, keys) : undefined
+      )
+    )
+  return keys ? query : query.limit(CANDIDATE_LIMIT)
+}
+
+/**
+ * List the resources in a workspace that can serve as mapping targets, grouped by
+ * remap kind. Used to populate the mapping UI's target pickers and to label the
+ * source resources being mapped. `knowledge-document` is intentionally left empty:
+ * documents are not a standalone mappable kind - they are dependent fields of their
+ * knowledge base, re-picked in the per-KB reconfigure flow (and auto-remapped when
+ * their KB is copied). `file` candidates are keyed by storage key.
+ */
+export async function listForkResourceCandidates(
+  executor: DbOrTx,
+  workspaceId: string
+): Promise<Record<ForkRemapKind, ForkResourceCandidate[]>> {
+  const [creds, wsEnvRows, tables, kbs, servers, tools, skills, files] = await Promise.all([
+    executor
+      .select({
+        id: credential.id,
+        displayName: credential.displayName,
+        providerId: credential.providerId,
+      })
+      .from(credential)
+      // Only real connections are mappable credentials. `env_workspace`/`env_personal`
+      // rows live in the same table but are environment variables (surfaced via the
+      // 'env-var' kind), so they must never appear as credential targets.
+      .where(
+        and(
+          eq(credential.workspaceId, workspaceId),
+          inArray(credential.type, ['oauth', 'service_account'])
+        )
+      )
+      .limit(CANDIDATE_LIMIT),
+    executor
+      .select({ variables: workspaceEnvironment.variables })
+      .from(workspaceEnvironment)
+      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
+      .limit(1),
+    tableCandidatesQuery(executor, workspaceId),
+    knowledgeBaseCandidatesQuery(executor, workspaceId),
+    mcpServerCandidatesQuery(executor, workspaceId),
+    customToolCandidatesQuery(executor, workspaceId),
+    skillCandidatesQuery(executor, workspaceId),
+    fileCandidatesQuery(executor, workspaceId),
+  ])
+
+  const envVariables = wsEnvRows[0]?.variables
+  const envKeys =
+    envVariables && typeof envVariables === 'object'
+      ? Object.keys(envVariables as Record<string, unknown>)
+      : []
+
+  return {
+    credential: creds.map((c) => ({
+      id: c.id,
+      label: c.displayName,
+      providerId: c.providerId ?? undefined,
+    })),
+    'env-var': envKeys.map((key) => ({ id: key, label: key })),
+    table: tables,
+    'knowledge-base': kbs,
+    'mcp-server': servers,
+    'custom-tool': tools,
+    skill: skills,
+    'knowledge-document': [],
+    file: files,
+  }
+}
+
+/**
+ * Given mapped target ids grouped by kind, return the subset that still EXISTS in the
+ * target workspace (same archived/deleted filters as `listForkResourceCandidates`).
+ * Used at promote time so a mapping whose target was deleted after it was saved
+ * resolves as unmapped (surfaced/cleared) instead of writing a dead id into the
+ * promoted workflow. Queries the exact ids (not the capped candidate list) so a valid
+ * target is never wrongly dropped, and only the DB-backed kinds are checked - env-var
+ * existence is handled by the resolver's `targetEnvKeys`, and `file`/`workflow` are
+ * resolved by other paths.
+ */
+export async function filterExistingForkTargets(
+  executor: DbOrTx,
+  workspaceId: string,
+  idsByKind: Partial<Record<ForkRemapKind, Set<string>>>
+): Promise<Partial<Record<ForkRemapKind, Set<string>>>> {
+  const ids = (kind: ForkRemapKind): string[] => {
+    const set = idsByKind[kind]
+    return set && set.size > 0 ? Array.from(set) : []
+  }
+  const credIds = ids('credential')
+  const tableIds = ids('table')
+  const kbIds = ids('knowledge-base')
+  const docIds = ids('knowledge-document')
+  const mcpIds = ids('mcp-server')
+  const toolIds = ids('custom-tool')
+  const skillIds = ids('skill')
+  // Files are identified by storage key (not `workspace_files.id`); a copied file's mapping
+  // target is its child storage key, so existence is checked by key in the target workspace.
+  const fileKeys = ids('file')
+
+  const [creds, tables, kbs, docs, servers, tools, skills, files] = await Promise.all([
+    credIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : executor
+          .select({ id: credential.id })
+          .from(credential)
+          .where(
+            and(
+              eq(credential.workspaceId, workspaceId),
+              inArray(credential.type, ['oauth', 'service_account']),
+              inArray(credential.id, credIds)
+            )
+          ),
+    tableIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : tableCandidatesQuery(executor, workspaceId, tableIds),
+    kbIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : knowledgeBaseCandidatesQuery(executor, workspaceId, kbIds),
+    // Documents are validated through a KB join (they are not a standalone candidate kind), so
+    // this existence check stays inline rather than sharing a per-kind candidate query.
+    docIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : executor
+          .select({ id: document.id })
+          .from(document)
+          .innerJoin(knowledgeBase, eq(document.knowledgeBaseId, knowledgeBase.id))
+          .where(
+            and(
+              eq(knowledgeBase.workspaceId, workspaceId),
+              isNull(knowledgeBase.deletedAt),
+              isNull(document.deletedAt),
+              isNull(document.archivedAt),
+              inArray(document.id, docIds)
+            )
+          ),
+    mcpIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : mcpServerCandidatesQuery(executor, workspaceId, mcpIds),
+    toolIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : customToolCandidatesQuery(executor, workspaceId, toolIds),
+    skillIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : skillCandidatesQuery(executor, workspaceId, skillIds),
+    fileKeys.length === 0
+      ? Promise.resolve([] as Array<{ id: string }>)
+      : fileCandidatesQuery(executor, workspaceId, fileKeys),
+  ])
+
+  const result: Partial<Record<ForkRemapKind, Set<string>>> = {}
+  if (credIds.length > 0) result.credential = new Set(creds.map((r) => r.id))
+  if (tableIds.length > 0) result.table = new Set(tables.map((r) => r.id))
+  if (kbIds.length > 0) result['knowledge-base'] = new Set(kbs.map((r) => r.id))
+  if (docIds.length > 0) result['knowledge-document'] = new Set(docs.map((r) => r.id))
+  if (mcpIds.length > 0) result['mcp-server'] = new Set(servers.map((r) => r.id))
+  if (toolIds.length > 0) result['custom-tool'] = new Set(tools.map((r) => r.id))
+  if (skillIds.length > 0) result.skill = new Set(skills.map((r) => r.id))
+  // `fileCandidatesQuery` exposes the storage key under `id`, so file existence keys by `r.id`.
+  if (fileKeys.length > 0) result.file = new Set(files.map((r) => r.id))
+  return result
+}
+
+/**
+ * Identity metadata (`name`/`url`) for the given MCP server ids in a workspace, looked up by
+ * exact id (no candidate cap, same deleted filter as the candidates). Promote uses it for the
+ * MAPPED TARGET servers so remapped tool-input entries rewrite their embedded server metadata
+ * from the target row (see {@link ForkMcpServerMeta}) - one bounded `inArray` read per sync,
+ * never per-entry. An id absent from the map no longer exists; its entries are left as-is.
+ */
+export async function getMcpServerMetaByIds(
+  executor: DbOrTx,
+  workspaceId: string,
+  ids: string[]
+): Promise<Map<string, ForkMcpServerMeta>> {
+  if (ids.length === 0) return new Map()
+  const rows = await executor
+    .select({ id: mcpServers.id, name: mcpServers.name, url: mcpServers.url })
+    .from(mcpServers)
+    .where(
+      and(
+        eq(mcpServers.workspaceId, workspaceId),
+        isNull(mcpServers.deletedAt),
+        inArray(mcpServers.id, ids)
+      )
+    )
+  return new Map(rows.map((row) => [row.id, { name: row.name, url: row.url ?? null }]))
+}
+
+/**
+ * Provider id for each given credential id in a workspace, looked up by exact id (no
+ * candidate cap). Presence in the returned map means the credential exists in the
+ * workspace, so this doubles as a cap-free existence + provider check for validation.
+ */
+export async function getCredentialProvidersByIds(
+  executor: DbOrTx,
+  workspaceId: string,
+  ids: string[]
+): Promise<Map<string, string | null>> {
+  if (ids.length === 0) return new Map()
+  const rows = await executor
+    .select({ id: credential.id, providerId: credential.providerId })
+    .from(credential)
+    .where(
+      and(
+        eq(credential.workspaceId, workspaceId),
+        inArray(credential.type, ['oauth', 'service_account']),
+        inArray(credential.id, ids)
+      )
+    )
+  return new Map(rows.map((row) => [row.id, row.providerId ?? null]))
+}
+
+/** A copyable workspace file plus its folder grouping (null folder = workspace root). */
+export interface ForkCopyableFileResource extends ForkResourceCandidate {
+  folderId: string | null
+  folderName: string | null
+}
+
+export interface ForkCopyableResources {
+  files: ForkCopyableFileResource[]
+  tables: ForkResourceCandidate[]
+  knowledgeBases: ForkResourceCandidate[]
+  customTools: ForkResourceCandidate[]
+  skills: ForkResourceCandidate[]
+  /** External MCP servers, copied as config rows (OAuth tokens never copied - re-auth in child). */
+  mcpServers: ForkResourceCandidate[]
+  /** Workflow-publishing MCP servers, copied as config-only shells with no workflows attached. */
+  workflowMcpServers: ForkResourceCandidate[]
+  /**
+   * Count of deployed workflows that the fork would copy. When 0, the fork modal shows an
+   * informational note (forking is never blocked) - create-fork seeds a blank starter
+   * workflow so the child is still a usable workspace.
+   */
+  deployedWorkflowCount: number
+}
+
+/**
+ * List the resources in a workspace that can be selected for copy at fork time
+ * (the content kinds — never credentials or env vars). Powers the fork modal's
+ * resource picker.
+ */
+export async function listForkCopyableResources(
+  executor: DbOrTx,
+  workspaceId: string
+): Promise<ForkCopyableResources> {
+  const [files, tables, kbs, tools, skills, externalServers, servers, deployed] = await Promise.all(
+    [
+      fileCandidatesWithFolderQuery(executor, workspaceId),
+      tableCandidatesQuery(executor, workspaceId),
+      knowledgeBaseCandidatesQuery(executor, workspaceId),
+      customToolCandidatesQuery(executor, workspaceId),
+      skillCandidatesQuery(executor, workspaceId),
+      // External MCP servers copy as config rows (same filter as the mapping candidates).
+      mcpServerCandidatesQuery(executor, workspaceId),
+      executor
+        .select({ id: workflowMcpServer.id, label: workflowMcpServer.name })
+        .from(workflowMcpServer)
+        .where(
+          and(eq(workflowMcpServer.workspaceId, workspaceId), isNull(workflowMcpServer.deletedAt))
+        )
+        .limit(CANDIDATE_LIMIT),
+      executor
+        .select({ value: count() })
+        .from(workflow)
+        // Match listDeployedWorkflows: a workflow only counts as copyable when it has an
+        // actually-active deployment version, not just the isDeployed flag, so the fork
+        // modal's preflight count never over-reports "ghost" deployed workflows.
+        .where(
+          and(
+            eq(workflow.workspaceId, workspaceId),
+            eq(workflow.isDeployed, true),
+            isNull(workflow.archivedAt),
+            exists(
+              executor
+                .select({ one: sql`1` })
+                .from(workflowDeploymentVersion)
+                .where(
+                  and(
+                    eq(workflowDeploymentVersion.workflowId, workflow.id),
+                    eq(workflowDeploymentVersion.isActive, true)
+                  )
+                )
+            )
+          )
+        ),
+    ]
+  )
+  return {
+    // The shared folder query also selects the storage key (for the label lookup); the copy
+    // picker addresses files by `workspace_files.id`, so drop the key here.
+    files: files.map((row) => ({
+      id: row.id,
+      label: row.label,
+      folderId: row.folderId,
+      folderName: row.folderName,
+    })),
+    tables,
+    knowledgeBases: kbs,
+    customTools: tools,
+    skills,
+    mcpServers: externalServers,
+    workflowMcpServers: servers,
+    deployedWorkflowCount: deployed[0]?.value ?? 0,
+  }
+}
+
+/**
+ * A copyable reference's display label plus its folder grouping. `parentId`/`parentLabel` are
+ * populated only for files (their folder id + name; null at the workspace root) and are null for
+ * every other copyable kind, which the picker renders flat.
+ */
+export interface ForkCopyableLabel {
+  label: string
+  parentId: string | null
+  parentLabel: string | null
+}
+
+/**
+ * One copyable resource in the sync SOURCE workspace, keyed the way the promote copy addresses
+ * it: files by STORAGE KEY (matching `file-upload` references + `planForkFileCopies`), every
+ * other kind by row id. `parentId`/`parentLabel` carry a file's folder grouping (null for
+ * non-file kinds and root files).
+ */
+export interface ForkCopyableSourceResource {
+  kind: ForkCopyableKind
+  sourceId: string
+  label: string
+  parentId: string | null
+  parentLabel: string | null
+}
+
+/**
+ * Every copyable-kind resource in the sync source workspace (same archived/deleted filters and
+ * per-kind {@link CANDIDATE_LIMIT} cap as the copy picker), as sync-copy candidate entries. The
+ * promote plan filters these down to the UNREFERENCED-and-unmapped set it offers for copy
+ * alongside the referenced candidates. Covers exactly the sync-copyable kinds
+ * (`forkCopyableKindSchema`): workflow-publishing MCP servers are fork-copy-only shells, and
+ * credentials / env vars are never copied.
+ */
+export async function listForkCopyableSourceResources(
+  executor: DbOrTx,
+  sourceWorkspaceId: string
+): Promise<ForkCopyableSourceResource[]> {
+  const [files, tables, kbs, tools, skills, mcp] = await Promise.all([
+    fileCandidatesWithFolderQuery(executor, sourceWorkspaceId),
+    tableCandidatesQuery(executor, sourceWorkspaceId),
+    knowledgeBaseCandidatesQuery(executor, sourceWorkspaceId),
+    customToolCandidatesQuery(executor, sourceWorkspaceId),
+    skillCandidatesQuery(executor, sourceWorkspaceId),
+    mcpServerCandidatesQuery(executor, sourceWorkspaceId),
+  ])
+  const flat = (
+    kind: ForkCopyableKind,
+    rows: Array<{ id: string; label: string }>
+  ): ForkCopyableSourceResource[] =>
+    rows.map((row) => ({
+      kind,
+      sourceId: row.id,
+      label: row.label,
+      parentId: null,
+      parentLabel: null,
+    }))
+  return [
+    ...files.map((row) => ({
+      kind: 'file' as const,
+      sourceId: row.key,
+      label: row.label,
+      parentId: row.folderId,
+      parentLabel: row.folderName,
+    })),
+    ...flat('table', tables),
+    ...flat('knowledge-base', kbs),
+    ...flat('custom-tool', tools),
+    ...flat('skill', skills),
+    ...flat('mcp-server', mcp),
+  ]
+}
+
+/**
+ * Labels (by exact id) for the copyable resource kinds referenced-but-unmapped at promote time,
+ * scoped to the source workspace and the same archived/deleted filters as the copy picker. A
+ * resource absent from the result no longer exists in the source, so it can't be copied and is
+ * dropped from the sync copy candidates. Keyed `${kind}:${id}` so callers can look a reference up
+ * directly; file entries additionally carry their folder grouping. Only kinds with ids are queried.
+ */
+export async function loadForkCopyableResourceLabels(
+  executor: DbOrTx,
+  sourceWorkspaceId: string,
+  idsByKind: Partial<Record<ForkCopyableKind, string[]>>
+): Promise<Map<string, ForkCopyableLabel>> {
+  const labels = new Map<string, ForkCopyableLabel>()
+  const ids = (kind: ForkCopyableKind): string[] => {
+    const list = idsByKind[kind]
+    return list && list.length > 0 ? list : []
+  }
+  const kbIds = ids('knowledge-base')
+  const tableIds = ids('table')
+  const toolIds = ids('custom-tool')
+  const skillIds = ids('skill')
+  const mcpIds = ids('mcp-server')
+  // Files are keyed by storage key (not `workspace_files.id`), so they label by key.
+  const fileKeys = ids('file')
+
+  const [kbs, tables, tools, skills, mcp, files] = await Promise.all([
+    kbIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string; label: string }>)
+      : knowledgeBaseCandidatesQuery(executor, sourceWorkspaceId, kbIds),
+    tableIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string; label: string }>)
+      : tableCandidatesQuery(executor, sourceWorkspaceId, tableIds),
+    toolIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string; label: string }>)
+      : customToolCandidatesQuery(executor, sourceWorkspaceId, toolIds),
+    skillIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string; label: string }>)
+      : skillCandidatesQuery(executor, sourceWorkspaceId, skillIds),
+    mcpIds.length === 0
+      ? Promise.resolve([] as Array<{ id: string; label: string }>)
+      : mcpServerCandidatesQuery(executor, sourceWorkspaceId, mcpIds),
+    fileKeys.length === 0
+      ? Promise.resolve(
+          [] as Array<{
+            key: string
+            label: string
+            folderId: string | null
+            folderName: string | null
+          }>
+        )
+      : fileCandidatesWithFolderQuery(executor, sourceWorkspaceId, { keys: fileKeys }),
+  ])
+
+  const flat = (label: string): ForkCopyableLabel => ({ label, parentId: null, parentLabel: null })
+  for (const row of kbs) labels.set(`knowledge-base:${row.id}`, flat(row.label))
+  for (const row of tables) labels.set(`table:${row.id}`, flat(row.label))
+  for (const row of tools) labels.set(`custom-tool:${row.id}`, flat(row.label))
+  for (const row of skills) labels.set(`skill:${row.id}`, flat(row.label))
+  for (const row of mcp) labels.set(`mcp-server:${row.id}`, flat(row.label))
+  for (const row of files) {
+    labels.set(`file:${row.key}`, {
+      label: row.label,
+      parentId: row.folderId,
+      parentLabel: row.folderName,
+    })
+  }
+  return labels
+}
+
+/** Resolve a credential id to its stored mapping resource type. */
+export async function classifyCredentialResourceType(
+  executor: DbOrTx,
+  credentialId: string,
+  workspaceId: string
+): Promise<Extract<ForkResourceType, 'oauth_credential' | 'service_account_credential'>> {
+  const [row] = await executor
+    .select({ type: credential.type })
+    .from(credential)
+    .where(and(eq(credential.id, credentialId), eq(credential.workspaceId, workspaceId)))
+    .limit(1)
+  return row?.type === 'service_account' ? 'service_account_credential' : 'oauth_credential'
+}