@codemation/host 0.0.15 → 0.0.18

package/src/presentation/config/CodemationPluginListMerger.ts

@@ -1,46 +1,50 @@
-import type { CodemationPlugin } from "./CodemationPlugin";
+import { CodemationPluginPackageMetadata, type CodemationPlugin } from "./CodemationPlugin";
 
 /**
  * Merges explicitly configured plugins with auto-discovered plugins.
  * Configured plugins are applied first; discovered plugins fill in gaps.
- * Plugins that declare `pluginPackageId` are deduped by that string so the same npm package is not
- * registered twice when the consumer config lists a plugin and discovery also finds it, or when two
- * module evaluations produce different `constructor` identities for the same logical plugin.
+ * Plugins discovered from package.json manifests are deduped by npm package name so the same package is not
+ * registered twice when the consumer config lists a discovered plugin explicitly and auto-discovery also finds it.
  */
 export class CodemationPluginListMerger {
+  constructor(private readonly packageMetadata: CodemationPluginPackageMetadata) {}
+
   merge(
     configuredPlugins: ReadonlyArray<CodemationPlugin>,
     discoveredPlugins: ReadonlyArray<CodemationPlugin>,
   ): ReadonlyArray<CodemationPlugin> {
     const pluginsByPackageId = new Map<string, CodemationPlugin>();
-    const pluginsByConstructor = new Map<unknown, CodemationPlugin>();
+    const pluginsByReference = new Set<CodemationPlugin>();
     const result: CodemationPlugin[] = [];
 
-    const tryAdd = (plugin: CodemationPlugin): void => {
-      const packageId = plugin.pluginPackageId;
-      if (typeof packageId === "string" && packageId.trim().length > 0) {
-        const key = packageId.trim();
-        if (pluginsByPackageId.has(key)) {
-          return;
-        }
-        pluginsByPackageId.set(key, plugin);
-        result.push(plugin);
-        return;
-      }
-      const constructorKey = Object.getPrototypeOf(plugin)?.constructor ?? plugin;
-      if (pluginsByConstructor.has(constructorKey)) {
-        return;
-      }
-      pluginsByConstructor.set(constructorKey, plugin);
-      result.push(plugin);
-    };
-
     for (const plugin of configuredPlugins) {
-      tryAdd(plugin);
+      this.tryAdd(plugin, pluginsByPackageId, pluginsByReference, result);
     }
     for (const plugin of discoveredPlugins) {
-      tryAdd(plugin);
+      this.tryAdd(plugin, pluginsByPackageId, pluginsByReference, result);
     }
     return result;
   }
+
+  private tryAdd(
+    plugin: CodemationPlugin,
+    pluginsByPackageId: Map<string, CodemationPlugin>,
+    pluginsByReference: Set<CodemationPlugin>,
+    result: CodemationPlugin[],
+  ): void {
+    const packageId = this.packageMetadata.readPackageName(plugin);
+    if (packageId) {
+      if (pluginsByPackageId.has(packageId)) {
+        return;
+      }
+      pluginsByPackageId.set(packageId, plugin);
+      result.push(plugin);
+      return;
+    }
+    if (pluginsByReference.has(plugin)) {
+      return;
+    }
+    pluginsByReference.add(plugin);
+    result.push(plugin);
+  }
 }

package/src/presentation/frontend/CodemationFrontendAuthSnapshotFactory.ts

@@ -39,6 +39,13 @@ export class CodemationFrontendAuthSnapshotFactory {
   }
 
   private resolveUiAuthEnabled(authConfig: CodemationAuthConfig | undefined, env: NodeJS.ProcessEnv): boolean {
+    const configuredOverride = env.CODEMATION_UI_AUTH_ENABLED?.trim().toLowerCase();
+    if (configuredOverride === "true") {
+      return true;
+    }
+    if (configuredOverride === "false") {
+      return false;
+    }
     return !(env.NODE_ENV !== "production" && authConfig?.allowUnauthenticatedInDevelopment === true);
   }
 

package/src/presentation/frontend/InternalAuthBootstrap.ts

@@ -0,0 +1,12 @@
+import type { CodemationAuthConfig } from "../config/CodemationAuthConfig";
+import type { CodemationFrontendAuthProviderSnapshot } from "./CodemationFrontendAuthSnapshot";
+
+/**
+ * Node-side runtime bootstrap for NextAuth provider wiring.
+ */
+export type InternalAuthBootstrap = Readonly<{
+  authConfig: CodemationAuthConfig | undefined;
+  credentialsEnabled: boolean;
+  oauthProviders: ReadonlyArray<CodemationFrontendAuthProviderSnapshot>;
+  uiAuthEnabled: boolean;
+}>;

package/src/presentation/frontend/InternalAuthBootstrapFactory.ts

@@ -0,0 +1,26 @@
+import { inject, injectable } from "@codemation/core";
+
+import { ApplicationTokens } from "../../applicationTokens";
+import type { AppConfig } from "../config/AppConfig";
+import { CodemationFrontendAuthSnapshotFactory } from "./CodemationFrontendAuthSnapshotFactory";
+import type { InternalAuthBootstrap } from "./InternalAuthBootstrap";
+
+@injectable()
+export class InternalAuthBootstrapFactory {
+  constructor(
+    @inject(ApplicationTokens.AppConfig)
+    private readonly appConfig: AppConfig,
+    @inject(CodemationFrontendAuthSnapshotFactory)
+    private readonly authSnapshotFactory: CodemationFrontendAuthSnapshotFactory,
+  ) {}
+
+  create(): InternalAuthBootstrap {
+    const authSnapshot = this.authSnapshotFactory.createFromAppConfig(this.appConfig);
+    return {
+      authConfig: this.appConfig.auth,
+      credentialsEnabled: authSnapshot.credentialsEnabled,
+      oauthProviders: authSnapshot.oauthProviders,
+      uiAuthEnabled: authSnapshot.uiAuthEnabled,
+    };
+  }
+}

package/src/presentation/frontend/InternalAuthBootstrapJsonCodec.ts

@@ -0,0 +1,49 @@
+import type { CodemationAuthConfig } from "../config/CodemationAuthConfig";
+import type { CodemationFrontendAuthProviderSnapshot } from "./CodemationFrontendAuthSnapshot";
+import type { InternalAuthBootstrap } from "./InternalAuthBootstrap";
+
+export class InternalAuthBootstrapJsonCodec {
+  serialize(bootstrap: InternalAuthBootstrap): string {
+    return JSON.stringify(bootstrap);
+  }
+
+  deserialize(serialized: string | undefined): InternalAuthBootstrap | null {
+    if (!serialized || serialized.trim().length === 0) {
+      return null;
+    }
+    try {
+      const parsed = JSON.parse(serialized) as Partial<InternalAuthBootstrap> | null;
+      if (!parsed || typeof parsed !== "object") {
+        return null;
+      }
+      return {
+        authConfig: this.resolveAuthConfig(parsed.authConfig),
+        credentialsEnabled: parsed.credentialsEnabled === true,
+        oauthProviders: this.resolveOauthProviders(parsed.oauthProviders),
+        uiAuthEnabled: parsed.uiAuthEnabled !== false,
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  private resolveAuthConfig(value: unknown): CodemationAuthConfig | undefined {
+    return value && typeof value === "object" ? (value as CodemationAuthConfig) : undefined;
+  }
+
+  private resolveOauthProviders(value: unknown): ReadonlyArray<CodemationFrontendAuthProviderSnapshot> {
+    if (!Array.isArray(value)) {
+      return [];
+    }
+    return value.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") {
+        return [];
+      }
+      const provider = entry as Partial<CodemationFrontendAuthProviderSnapshot>;
+      if (typeof provider.id !== "string" || typeof provider.name !== "string") {
+        return [];
+      }
+      return [{ id: provider.id, name: provider.name }];
+    });
+  }
+}

package/src/presentation/frontend/PublicFrontendBootstrap.ts

@@ -0,0 +1,12 @@
+import type { CodemationFrontendAuthProviderSnapshot } from "./CodemationFrontendAuthSnapshot";
+
+/**
+ * Frontend-safe runtime bootstrap consumed by the Next.js shell.
+ */
+export type PublicFrontendBootstrap = Readonly<{
+  credentialsEnabled: boolean;
+  logoUrl: string | null;
+  oauthProviders: ReadonlyArray<CodemationFrontendAuthProviderSnapshot>;
+  productName: string;
+  uiAuthEnabled: boolean;
+}>;

package/src/presentation/frontend/PublicFrontendBootstrapFactory.ts

@@ -0,0 +1,23 @@
+import { inject, injectable } from "@codemation/core";
+
+import { FrontendAppConfigFactory } from "./FrontendAppConfigFactory";
+import type { PublicFrontendBootstrap } from "./PublicFrontendBootstrap";
+
+@injectable()
+export class PublicFrontendBootstrapFactory {
+  constructor(
+    @inject(FrontendAppConfigFactory)
+    private readonly frontendAppConfigFactory: FrontendAppConfigFactory,
+  ) {}
+
+  create(): PublicFrontendBootstrap {
+    const frontendAppConfig = this.frontendAppConfigFactory.create();
+    return {
+      credentialsEnabled: frontendAppConfig.auth.credentialsEnabled,
+      logoUrl: frontendAppConfig.logoUrl,
+      oauthProviders: frontendAppConfig.auth.oauthProviders,
+      productName: frontendAppConfig.productName,
+      uiAuthEnabled: frontendAppConfig.auth.uiAuthEnabled,
+    };
+  }
+}

package/src/presentation/frontend/PublicFrontendBootstrapJsonCodec.ts

@@ -0,0 +1,48 @@
+import type { PublicFrontendBootstrap } from "./PublicFrontendBootstrap";
+import type { CodemationFrontendAuthProviderSnapshot } from "./CodemationFrontendAuthSnapshot";
+
+export class PublicFrontendBootstrapJsonCodec {
+  serialize(bootstrap: PublicFrontendBootstrap): string {
+    return JSON.stringify(bootstrap);
+  }
+
+  deserialize(serialized: string | undefined): PublicFrontendBootstrap | null {
+    if (!serialized || serialized.trim().length === 0) {
+      return null;
+    }
+    try {
+      const parsed = JSON.parse(serialized) as Partial<PublicFrontendBootstrap> | null;
+      if (!parsed || typeof parsed !== "object") {
+        return null;
+      }
+      return {
+        credentialsEnabled: parsed.credentialsEnabled === true,
+        logoUrl: typeof parsed.logoUrl === "string" && parsed.logoUrl.trim().length > 0 ? parsed.logoUrl : null,
+        oauthProviders: this.resolveOauthProviders(parsed.oauthProviders),
+        productName:
+          typeof parsed.productName === "string" && parsed.productName.trim().length > 0
+            ? parsed.productName
+            : "Codemation",
+        uiAuthEnabled: parsed.uiAuthEnabled !== false,
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  private resolveOauthProviders(value: unknown): ReadonlyArray<CodemationFrontendAuthProviderSnapshot> {
+    if (!Array.isArray(value)) {
+      return [];
+    }
+    return value.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") {
+        return [];
+      }
+      const provider = entry as Partial<CodemationFrontendAuthProviderSnapshot>;
+      if (typeof provider.id !== "string" || typeof provider.name !== "string") {
+        return [];
+      }
+      return [{ id: provider.id, name: provider.name }];
+    });
+  }
+}

package/src/presentation/http/ApiPaths.ts

@@ -15,6 +15,8 @@ export class ApiPaths {
 
   private static readonly whitelabelBasePath = `${this.apiBasePath}/whitelabel`;
 
+  private static readonly bootstrapBasePath = `${this.apiBasePath}/bootstrap`;
+
   static workflows(): string {
     return this.workflowsBasePath;
   }
@@ -162,4 +164,12 @@ export class ApiPaths {
   static whitelabelLogo(): string {
     return `${this.whitelabelBasePath}/logo`;
   }
+
+  static frontendBootstrap(): string {
+    return `${this.bootstrapBasePath}/frontend`;
+  }
+
+  static internalAuthBootstrap(): string {
+    return `${this.bootstrapBasePath}/auth/internal`;
+  }
 }

package/src/presentation/http/hono/HonoHttpAnonymousRoutePolicyRegistry.ts

@@ -16,6 +16,9 @@ export class HonoHttpAnonymousRoutePolicy {
     if (pathname === "/api/dev/runtime" || pathname === "/api/dev/bootstrap-summary") {
       return true;
     }
+    if (pathname === ApiPaths.frontendBootstrap() || pathname === ApiPaths.internalAuthBootstrap()) {
+      return true;
+    }
     if (pathname === ApiPaths.userInviteVerify() || pathname === ApiPaths.userInviteAccept()) {
       return true;
     }

package/src/presentation/http/hono/registrars/BootstrapHonoApiRouteRegistrar.ts

@@ -0,0 +1,32 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { ApiPaths } from "../../ApiPaths";
+import { InternalAuthBootstrapHttpRouteHandler } from "../../routeHandlers/InternalAuthBootstrapHttpRouteHandler";
+import { PublicFrontendBootstrapHttpRouteHandler } from "../../routeHandlers/PublicFrontendBootstrapHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: BootstrapHonoApiRouteRegistrar }])
+export class BootstrapHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(
+    @inject(PublicFrontendBootstrapHttpRouteHandler)
+    private readonly publicFrontendBootstrapHttpRouteHandler: PublicFrontendBootstrapHttpRouteHandler,
+    @inject(InternalAuthBootstrapHttpRouteHandler)
+    private readonly internalAuthBootstrapHttpRouteHandler: InternalAuthBootstrapHttpRouteHandler,
+  ) {}
+
+  register(app: Hono): void {
+    app.get(this.resolveRelativePath(ApiPaths.frontendBootstrap()), () =>
+      this.publicFrontendBootstrapHttpRouteHandler.getBootstrap(),
+    );
+    app.get(this.resolveRelativePath(ApiPaths.internalAuthBootstrap()), () =>
+      this.internalAuthBootstrapHttpRouteHandler.getBootstrap(),
+    );
+  }
+
+  private resolveRelativePath(pathname: string): string {
+    return pathname.replace(/^\/api/, "");
+  }
+}

package/src/presentation/http/routeHandlers/InternalAuthBootstrapHttpRouteHandler.ts

@@ -0,0 +1,18 @@
+import { inject, injectable } from "@codemation/core";
+
+import { InternalAuthBootstrapFactory } from "../../frontend/InternalAuthBootstrapFactory";
+
+@injectable()
+export class InternalAuthBootstrapHttpRouteHandler {
+  constructor(
+    @inject(InternalAuthBootstrapFactory)
+    private readonly bootstrapFactory: InternalAuthBootstrapFactory,
+  ) {}
+
+  getBootstrap(): Response {
+    return new Response(JSON.stringify(this.bootstrapFactory.create()), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }
+}

package/src/presentation/http/routeHandlers/PublicFrontendBootstrapHttpRouteHandler.ts

@@ -0,0 +1,18 @@
+import { inject, injectable } from "@codemation/core";
+
+import { PublicFrontendBootstrapFactory } from "../../frontend/PublicFrontendBootstrapFactory";
+
+@injectable()
+export class PublicFrontendBootstrapHttpRouteHandler {
+  constructor(
+    @inject(PublicFrontendBootstrapFactory)
+    private readonly bootstrapFactory: PublicFrontendBootstrapFactory,
+  ) {}
+
+  getBootstrap(): Response {
+    return new Response(JSON.stringify(this.bootstrapFactory.create()), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }
+}

package/src/presentation/server/CodemationConsumerConfigLoader.ts

@@ -3,7 +3,6 @@ import { access, stat } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import type { NamespacedUnregister } from "tsx/esm/api";
-import { register } from "tsx/esm/api";
 import type { CodemationConfig } from "../config/CodemationConfig";
 import { CodemationConfigNormalizer } from "../config/CodemationConfigNormalizer";
 import type { NormalizedCodemationConfig } from "../config/CodemationConfigNormalizer";
@@ -23,6 +22,7 @@ export type CodemationConsumerConfigResolution = Readonly<{
 
 export class CodemationConsumerConfigLoader {
   private static readonly importerRegistrationsByTsconfig = new Map<string, NamespacedUnregister>();
+  private static readonly importerNamespaceVersionByTsconfig = new Map<string, number>();
   private readonly configExportsResolver = new CodemationConsumerConfigExportsResolver();
   private readonly configNormalizer = new CodemationConfigNormalizer();
   private readonly workflowModulePathFinder = new WorkflowModulePathFinder();
@@ -173,10 +173,15 @@ export class CodemationConsumerConfigLoader {
       return await this.importModuleWithNativeRuntime(modulePath);
     }
     const tsconfigPath = await this.resolveTsconfigPath(modulePath);
+    if (this.shouldResetImporterBeforeImport()) {
+      await this.resetImporter(tsconfigPath);
+    }
     const importSpecifier = await this.createImportSpecifier(modulePath);
     for (let attempt = 0; attempt < 3; attempt += 1) {
       try {
-        const importedModule = await this.getOrCreateImporter(tsconfigPath).import(importSpecifier, import.meta.url);
+        const importedModule = await (
+          await this.getOrCreateImporter(tsconfigPath)
+        ).import(importSpecifier, import.meta.url);
         return importedModule as Record<string, unknown>;
       } catch (error) {
         if (!this.isStoppedTransformServiceError(error) || attempt === 2) {
@@ -202,14 +207,17 @@ export class CodemationConsumerConfigLoader {
     return discoveredPath ?? false;
   }
 
-  private getOrCreateImporter(tsconfigPath: string | false): NamespacedUnregister {
+  private async getOrCreateImporter(tsconfigPath: string | false): Promise<NamespacedUnregister> {
     const cacheKey = tsconfigPath || "default";
     const existingImporter = CodemationConsumerConfigLoader.importerRegistrationsByTsconfig.get(cacheKey);
     if (existingImporter) {
       return existingImporter;
     }
+    const { register } = await import(/* webpackIgnore: true */ this.resolveTsxImporterModuleSpecifier());
+    const namespaceVersion = this.nextNamespaceVersion(cacheKey);
     const nextImporter = register({
-      namespace: this.toNamespace(cacheKey),
+      // A fresh namespace prevents cache hits from prior scoped imports after a dev rebuild.
+      namespace: this.toNamespace(cacheKey, namespaceVersion),
       tsconfig: tsconfigPath,
     });
     CodemationConsumerConfigLoader.importerRegistrationsByTsconfig.set(cacheKey, nextImporter);
@@ -226,8 +234,18 @@ export class CodemationConsumerConfigLoader {
     await existingImporter.unregister().catch(() => null);
   }
 
-  private toNamespace(cacheKey: string): string {
-    return `codemation_consumer_${cacheKey.replace(/[^a-zA-Z0-9_-]+/g, "_")}`;
+  private nextNamespaceVersion(cacheKey: string): number {
+    const nextVersion = (CodemationConsumerConfigLoader.importerNamespaceVersionByTsconfig.get(cacheKey) ?? 0) + 1;
+    CodemationConsumerConfigLoader.importerNamespaceVersionByTsconfig.set(cacheKey, nextVersion);
+    return nextVersion;
+  }
+
+  private toNamespace(cacheKey: string, namespaceVersion: number): string {
+    return `codemation_consumer_${cacheKey.replace(/[^a-zA-Z0-9_-]+/g, "_")}_${namespaceVersion}`;
+  }
+
+  private resolveTsxImporterModuleSpecifier(): string {
+    return ["tsx", "esm", "api"].join("/");
   }
 
   private async findNearestTsconfig(modulePath: string): Promise<string | null> {
@@ -256,6 +274,10 @@ export class CodemationConsumerConfigLoader {
     return process.env.CODEMATION_TS_RUNTIME === "ts-node";
   }
 
+  private shouldResetImporterBeforeImport(): boolean {
+    return (process.env.CODEMATION_DEV_SERVER_TOKEN?.trim().length ?? 0) > 0;
+  }
+
   private isStoppedTransformServiceError(error: unknown): boolean {
     return error instanceof Error && error.message.includes("The service is no longer running");
   }

package/src/presentation/server/CodemationPluginDiscovery.ts

@@ -1,5 +1,5 @@
 import type { CodemationPackageManifest } from "../config/CodemationPackageManifest";
-import type { CodemationPlugin } from "../config/CodemationPlugin";
+import { CodemationPluginPackageMetadata, type CodemationPlugin } from "../config/CodemationPlugin";
 import { readFile, readdir } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
@@ -7,7 +7,7 @@ import { pathToFileURL } from "node:url";
 export type CodemationDiscoveredPluginPackage = Readonly<{
   packageName: string;
   packageRoot: string;
-  manifest: NonNullable<CodemationPackageManifest["plugin"]>;
+  pluginEntry: string;
   developmentEntry?: string;
 }>;
 
@@ -24,6 +24,8 @@ type PackageJsonShape = Readonly<{
 }>;
 
 export class CodemationPluginDiscovery {
+  private readonly pluginPackageMetadata = new CodemationPluginPackageMetadata();
+
   async discover(consumerRoot: string): Promise<ReadonlyArray<CodemationDiscoveredPluginPackage>> {
     const nodeModulesRoot = path.resolve(consumerRoot, "node_modules");
     const packageRoots = await this.collectPackageRoots(nodeModulesRoot);
@@ -31,14 +33,14 @@ export class CodemationPluginDiscovery {
     for (const packageRoot of packageRoots) {
       const packageJson = await this.readPackageJson(path.resolve(packageRoot, "package.json"));
       const pluginManifest = packageJson.codemation?.plugin;
-      if (!packageJson.name || !pluginManifest || pluginManifest.kind !== "plugin") {
+      if (!packageJson.name || typeof pluginManifest !== "string" || pluginManifest.trim().length === 0) {
         continue;
       }
       discoveredPackages.push({
         packageName: packageJson.name,
         packageRoot,
-        manifest: pluginManifest,
-        developmentEntry: this.resolveDevelopmentPluginEntry(packageJson),
+        pluginEntry: pluginManifest,
+        developmentEntry: await this.resolveDevelopmentPluginEntry(packageRoot),
       });
     }
     return discoveredPackages.sort((left, right) => left.packageName.localeCompare(right.packageName));
@@ -98,37 +100,47 @@ export class CodemationPluginDiscovery {
 
   private async loadPlugin(discoveredPackage: CodemationDiscoveredPluginPackage): Promise<CodemationPlugin> {
     const pluginModulePath = path.resolve(discoveredPackage.packageRoot, this.resolvePluginEntry(discoveredPackage));
-    const importedModule = (await import(pathToFileURL(pluginModulePath).href)) as Record<string, unknown>;
-    const pluginExportName = discoveredPackage.manifest.exportName;
-    const explicitExport = pluginExportName ? importedModule[pluginExportName] : undefined;
-    const exportedValue = explicitExport ?? importedModule.default ?? importedModule.codemationPlugin;
+    const importedModule = (await import(
+      /* webpackIgnore: true */ this.resolvePluginModuleSpecifier(pluginModulePath)
+    )) as Record<string, unknown>;
+    const exportedValue = importedModule.default;
     const plugin = this.resolvePluginValue(exportedValue);
     if (!plugin) {
-      throw new Error(`Plugin package "${discoveredPackage.packageName}" did not export a Codemation plugin instance.`);
+      throw new Error(`Plugin package "${discoveredPackage.packageName}" did not default-export a Codemation plugin.`);
     }
-    return plugin;
+    return this.pluginPackageMetadata.attachPackageName(plugin, discoveredPackage.packageName);
   }
 
   private resolvePluginValue(value: unknown): CodemationPlugin | null {
-    if (this.isPlugin(value)) {
+    if (this.isPluginConfig(value)) {
       return value;
     }
-    if (this.isPluginConstructor(value)) {
-      return new value();
-    }
     return null;
   }
 
-  private isPlugin(value: unknown): value is CodemationPlugin {
+  private isPluginConfig(value: unknown): value is CodemationPlugin {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return false;
+    }
+    const pluginValue = value as {
+      credentialTypes?: unknown;
+      register?: unknown;
+      sandbox?: unknown;
+    };
+    if (pluginValue.register !== undefined && typeof pluginValue.register !== "function") {
+      return false;
+    }
+    if (pluginValue.credentialTypes !== undefined && !Array.isArray(pluginValue.credentialTypes)) {
+      return false;
+    }
     return (
-      Boolean(value) && typeof value === "object" && typeof (value as { register?: unknown }).register === "function"
+      pluginValue.register !== undefined ||
+      pluginValue.credentialTypes !== undefined ||
+      pluginValue.sandbox !== undefined ||
+      Object.keys(pluginValue).length === 0
     );
   }
 
-  private isPluginConstructor(value: unknown): value is new () => CodemationPlugin {
-    return typeof value === "function" && this.isPlugin(value.prototype);
-  }
-
   private resolvePluginEntry(discoveredPackage: CodemationDiscoveredPluginPackage): string {
     if (
       process.env.CODEMATION_PREFER_PLUGIN_SOURCE_ENTRY === "true" &&
@@ -137,15 +149,34 @@ export class CodemationPluginDiscovery {
     ) {
       return discoveredPackage.developmentEntry;
     }
-    return discoveredPackage.manifest.entry;
+    return discoveredPackage.pluginEntry;
   }
 
-  private resolveDevelopmentPluginEntry(packageJson: PackageJsonShape): string | undefined {
-    const exportRecord = packageJson.exports?.["./codemation-plugin"];
-    if (!exportRecord || typeof exportRecord !== "object") {
-      return undefined;
+  private async resolveDevelopmentPluginEntry(packageRoot: string): Promise<string | undefined> {
+    const candidates = [
+      path.resolve(packageRoot, "codemation.plugin.ts"),
+      path.resolve(packageRoot, "codemation.plugin.js"),
+      path.resolve(packageRoot, "src", "codemation.plugin.ts"),
+      path.resolve(packageRoot, "src", "codemation.plugin.js"),
+    ];
+    for (const candidate of candidates) {
+      if (await this.exists(candidate)) {
+        return path.relative(packageRoot, candidate);
+      }
     }
-    const importPath = (exportRecord as { import?: unknown }).import;
-    return typeof importPath === "string" && importPath.trim().length > 0 ? importPath : undefined;
+    return undefined;
+  }
+
+  private async exists(filePath: string): Promise<boolean> {
+    try {
+      await readFile(filePath, "utf8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  private resolvePluginModuleSpecifier(pluginModulePath: string): string {
+    return pathToFileURL(pluginModulePath).href;
   }
 }

package/src/server.ts

@@ -12,7 +12,13 @@ export { CodemationFrontendAuthSnapshotFactory } from "./presentation/frontend/C
 export { CodemationFrontendAuthSnapshotJsonCodec } from "./presentation/frontend/CodemationFrontendAuthSnapshotJsonCodec";
 export { FrontendAppConfigFactory } from "./presentation/frontend/FrontendAppConfigFactory";
 export { FrontendAppConfigJsonCodec } from "./presentation/frontend/FrontendAppConfigJsonCodec";
+export { InternalAuthBootstrapFactory } from "./presentation/frontend/InternalAuthBootstrapFactory";
+export { InternalAuthBootstrapJsonCodec } from "./presentation/frontend/InternalAuthBootstrapJsonCodec";
+export { PublicFrontendBootstrapFactory } from "./presentation/frontend/PublicFrontendBootstrapFactory";
+export { PublicFrontendBootstrapJsonCodec } from "./presentation/frontend/PublicFrontendBootstrapJsonCodec";
 export type { FrontendAppConfig } from "./presentation/frontend/FrontendAppConfig";
+export type { InternalAuthBootstrap } from "./presentation/frontend/InternalAuthBootstrap";
+export type { PublicFrontendBootstrap } from "./presentation/frontend/PublicFrontendBootstrap";
 export type {
   CodemationDiscoveredPluginPackage,
   CodemationResolvedPluginPackage,