fix(prefetch): parse the file-folder seed through its contract

The audit found this key was the workspaceFilesKeys bug waiting to recur. The
manager's record type and workspaceFileFolderSchema are two independent
declarations that agree today by coincidence; the seed had no parse, so adding a
column to one would have silently cached a shape a client fetch strips — and
three of its fields are z.coerce.date(), the exact divergence that put ISO
strings under the file-list key.

Its sibling is immune because listWorkspaceFilesWithShares parses at the data
layer. This does the same at the seed, and adds the shape-parity assertion the
key never had. Verified falsifiable: removing the parse turns it red. Doing so
also exposed the existing folder test as fixture-thin — a folder with only an
id, which the contract rightly rejects — so it now uses a real row.

Also points the credential block's fetchQuery at the exported staleTime
constant instead of restating 60 * 1000; it was a fifth producer on that key
free to drift from the four that share it.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/files/prefetch.ts

@@ -1,4 +1,5 @@
 import type { QueryClient } from '@tanstack/react-query'
+import { listWorkspaceFileFoldersContract } from '@/lib/api/contracts/workspace-file-folders'
 import { listWorkspaceFileFolders } from '@/lib/uploads/contexts/workspace/workspace-file-folder-manager'
 import { getWorkspaceHostContextForViewer } from '@/lib/workspaces/host-context'
 import { prefetchResourceListChrome } from '@/app/workspace/[workspaceId]/lib/prefetch-resource-list-chrome'
@@ -40,7 +41,17 @@ export async function prefetchFilesBrowser(
   await Promise.all([
     queryClient.prefetchQuery({
       queryKey: workspaceFileFolderKeys.list(workspaceId, 'active'),
-      queryFn: () => listWorkspaceFileFolders(workspaceId, { scope: 'active' }),
+      /**
+       * Parsed through the route's own response schema rather than seeded raw. The
+       * manager's record type and `workspaceFileFolderSchema` are two independent
+       * declarations that happen to agree today; without this parse, adding a column
+       * to one silently seeds a shape a client fetch would have stripped — the exact
+       * divergence that put ISO strings under `workspaceFilesKeys.list`.
+       */
+      queryFn: async () => {
+        const folders = await listWorkspaceFileFolders(workspaceId, { scope: 'active' })
+        return listWorkspaceFileFoldersContract.response.schema.shape.folders.parse(folders)
+      },
       staleTime: WORKSPACE_FILE_FOLDERS_STALE_TIME,
     }),
     prefetchResourceListChrome(queryClient, workspaceId, 'file', userId),

apps/sim/app/workspace/[workspaceId]/lib/prefetch.test.ts

@@ -290,17 +290,67 @@ describe('workspace list prefetches', () => {
     })
   })
   describe('prefetchFilesBrowser', () => {
+    /**
+     * The sibling `workspaceFilesKeys.list` once held ISO strings from one producer and
+     * `Date`s from another because a seed skipped the contract parse. This key is fed by
+     * a manager whose record type and the contract schema are independent declarations,
+     * so the parse — and this assertion — are what stop that recurring here.
+     */
+    it('seeds the shape a client fetch caches, not the raw manager row', async () => {
+      mockListWorkspaceFileFolders.mockResolvedValue([
+        {
+          id: 'folder-1',
+          workspaceId: WORKSPACE_ID,
+          userId: USER_ID,
+          name: 'Docs',
+          parentId: null,
+          path: '/Docs',
+          sortOrder: 0,
+          deletedAt: null,
+          createdAt: '2026-01-01T00:00:00.000Z',
+          updatedAt: '2026-01-02T00:00:00.000Z',
+          serverOnlyColumn: 'should-be-stripped',
+        },
+      ])
+      const client = makeClient()
+
+      await prefetchFilesBrowser(client, WORKSPACE_ID, USER_ID)
+
+      const [cached] = client.getQueryData(
+        workspaceFileFolderKeys.list(WORKSPACE_ID, 'active')
+      ) as Array<Record<string, unknown>>
+      expect(cached.createdAt).toBeInstanceOf(Date)
+      expect(cached.updatedAt).toBeInstanceOf(Date)
+      expect(cached).not.toHaveProperty('serverOnlyColumn')
+    })
+
     it('primes the folder key the client hook reads', async () => {
-      const folders = [{ id: 'folder-1' }]
+      const folders = [
+        {
+          id: 'folder-1',
+          workspaceId: WORKSPACE_ID,
+          userId: USER_ID,
+          name: 'Docs',
+          parentId: null,
+          path: '/Docs',
+          sortOrder: 0,
+          deletedAt: null,
+          createdAt: '2026-01-01T00:00:00.000Z',
+          updatedAt: '2026-01-02T00:00:00.000Z',
+        },
+      ]
       mockListWorkspaceFileFolders.mockResolvedValue(folders)
       const client = makeClient()
 
       await prefetchFilesBrowser(client, WORKSPACE_ID, USER_ID)
 
       expect(mockListWorkspaceFileFolders).toHaveBeenCalledWith(WORKSPACE_ID, { scope: 'active' })
-      expect(client.getQueryData(workspaceFileFolderKeys.list(WORKSPACE_ID, 'active'))).toEqual(
-        folders
-      )
+      /** Shape parity is asserted by the sibling test; this one pins the key and the args. */
+      expect(
+        client.getQueryData(workspaceFileFolderKeys.list(WORKSPACE_ID, 'active')) as Array<{
+          id: string
+        }>
+      ).toHaveLength(folders.length)
     })
 
     /**

apps/sim/blocks/blocks/credential.ts

@@ -3,7 +3,10 @@ import { getServiceConfigByProviderId } from '@/lib/oauth/utils'
 import { getQueryClient } from '@/app/_shell/providers/get-query-client'
 import type { BlockConfig } from '@/blocks/types'
 import { workspaceCredentialKeys } from '@/hooks/queries/utils/credential-keys'
-import { fetchWorkspaceCredentialList } from '@/hooks/queries/utils/fetch-workspace-credentials'
+import {
+  fetchWorkspaceCredentialList,
+  WORKSPACE_CREDENTIAL_LIST_STALE_TIME,
+} from '@/hooks/queries/utils/fetch-workspace-credentials'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 
 interface CredentialBlockOutput {
@@ -72,7 +75,7 @@ export const CredentialBlock: BlockConfig<CredentialBlockOutput> = {
         const credentials = await getQueryClient().fetchQuery({
           queryKey: workspaceCredentialKeys.list(workspaceId),
           queryFn: () => fetchWorkspaceCredentialList(workspaceId),
-          staleTime: 60 * 1000,
+          staleTime: WORKSPACE_CREDENTIAL_LIST_STALE_TIME,
         })
 
         const seen = new Set<string>()