@codemation/host 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,18 +1,20 @@
-import { n as definePlugin, t as defineCodemationApp } from "./CodemationAuthoring.types-DZl-sJaM.js";
+import { n as definePlugin, t as defineCodemationApp } from "./CodemationAuthoring.types-NGkBcmmT.js";
 import "./LogLevelPolicyFactory-DCUzIN6G.js";
-import { t as ApiPaths } from "./ApiPaths-CLTHphYZ.js";
-import { i as CodemationFrontendAuthSnapshotJsonCodec, n as InternalAuthBootstrapJsonCodec, r as FrontendAppConfigJsonCodec, t as PublicFrontendBootstrapJsonCodec } from "./PublicFrontendBootstrapJsonCodec-DzqvA0uo.js";
-import { t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-BeAUS144.js";
-import "./ServerLoggerFactory-BKSIh9Xv.js";
+import { t as ApiPaths } from "./ApiPaths-Dv1dcHu_.js";
+import { i as CodemationFrontendAuthSnapshotJsonCodec, n as InternalAuthBootstrapJsonCodec, r as FrontendAppConfigJsonCodec, t as PublicFrontendBootstrapJsonCodec } from "./PublicFrontendBootstrapJsonCodec-CegIF_ne.js";
+import { t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-GYpBBvqE.js";
+import { o as BootTimer } from "./ServerLoggerFactory-Ckk52S3w.js";
 import "./decorateParam-BWxkAUSj.js";
 import "./decorate-CXWmflG_.js";
-import { d as ApplicationTokens } from "./CredentialServices-CgxwguAv.js";
-import { D as CodemationFrontendAuthSnapshotFactory, E as FrontendAppConfigFactory, N as UpsertLocalBootstrapUserCommand, P as ListUserAccountsQuery, T as InternalAuthBootstrapFactory, a as GetCollectionQuery, c as InsertCollectionRowCommand, d as FrontendRuntime, f as CollectionSchemaSyncerHolder, i as GetCollectionRowQuery, l as DeleteCollectionRowCommand, m as AppContainerLifecycle, n as ListCollectionsQuery, o as UpdateCollectionRowCommand, p as DatabaseMigrations, r as ListCollectionRowsQuery, s as SyncCollectionsCommand, t as AppContainerFactory, u as WorkerRuntime, w as PublicFrontendBootstrapFactory } from "./AppContainerFactory-qaqc-R1D.js";
-import "./WorkflowPolicyUiPresentationFactory-DhPqQ9aB.js";
-import { n as CodemationPluginPackageMetadata, t as AppConfigFactory } from "./AppConfigFactory-C6q-CSKb.js";
-import { n as CodemationBootstrapRequest, t as CodemationPluginListMerger } from "./CodemationPluginListMerger-B-W5Fa_X.js";
-import { t as CodemationPostgresPrismaClientFactory } from "./persistenceServer-CmsIKnO9.js";
-import { r as CodemationServerGateway } from "./server-CJFfY67o.js";
+import { f as ApplicationRequestError, m as ApplicationTokens } from "./CredentialServices-Dk8yypeL.js";
+import "./CodemationTsyringeTypeInfoRegistrar-Bj6FJYFz.js";
+import { D as FrontendAppConfigFactory, E as InternalAuthBootstrapFactory, F as StartWorkflowRunCommand, I as UpsertLocalBootstrapUserCommand, L as ListUserAccountsQuery, N as GetRunStateQuery, O as CodemationFrontendAuthSnapshotFactory, T as PublicFrontendBootstrapFactory, a as GetCollectionQuery, c as InsertCollectionRowCommand, d as FrontendRuntime, f as CollectionSchemaSyncerHolder, i as GetCollectionRowQuery, l as DeleteCollectionRowCommand, m as AppContainerLifecycle, n as ListCollectionsQuery, o as UpdateCollectionRowCommand, p as DatabaseMigrations, r as ListCollectionRowsQuery, s as SyncCollectionsCommand, t as AppContainerFactory, u as WorkerRuntime } from "./AppContainerFactory-DqKYCRNP.js";
+import "./WorkflowPolicyUiPresentationFactory-Bb-ae_Zh.js";
+import "./InternalPingRegistrar-DY3kSfxP.js";
+import { r as CodemationPluginPackageMetadata, t as AppConfigFactory } from "./AppConfigFactory-Cx4qQvRk.js";
+import { n as CodemationBootstrapRequest, t as CodemationPluginListMerger } from "./CodemationPluginListMerger-D1B1IEbt.js";
+import { t as CodemationPostgresPrismaClientFactory } from "./persistenceServer-C-hH4z6l.js";
+import { r as CodemationServerGateway } from "./server-Y7kxwtCK.js";
 import { workflow } from "@codemation/core-nodes";
 
-export { ApiPaths, AppConfigFactory, AppContainerFactory, AppContainerLifecycle, ApplicationTokens, CodemationBootstrapRequest, CodemationConsumerConfigLoader, CodemationFrontendAuthSnapshotFactory, CodemationFrontendAuthSnapshotJsonCodec, CodemationPluginListMerger, CodemationPluginPackageMetadata, CodemationPostgresPrismaClientFactory, CodemationServerGateway, CollectionSchemaSyncerHolder, DatabaseMigrations, DeleteCollectionRowCommand, FrontendAppConfigFactory, FrontendAppConfigJsonCodec, FrontendRuntime, GetCollectionQuery, GetCollectionRowQuery, InsertCollectionRowCommand, InternalAuthBootstrapFactory, InternalAuthBootstrapJsonCodec, ListCollectionRowsQuery, ListCollectionsQuery, ListUserAccountsQuery, PublicFrontendBootstrapFactory, PublicFrontendBootstrapJsonCodec, SyncCollectionsCommand, UpdateCollectionRowCommand, UpsertLocalBootstrapUserCommand, WorkerRuntime, defineCodemationApp, definePlugin, workflow };
+export { ApiPaths, AppConfigFactory, AppContainerFactory, AppContainerLifecycle, ApplicationRequestError, ApplicationTokens, BootTimer, CodemationBootstrapRequest, CodemationConsumerConfigLoader, CodemationFrontendAuthSnapshotFactory, CodemationFrontendAuthSnapshotJsonCodec, CodemationPluginListMerger, CodemationPluginPackageMetadata, CodemationPostgresPrismaClientFactory, CodemationServerGateway, CollectionSchemaSyncerHolder, DatabaseMigrations, DeleteCollectionRowCommand, FrontendAppConfigFactory, FrontendAppConfigJsonCodec, FrontendRuntime, GetCollectionQuery, GetCollectionRowQuery, GetRunStateQuery, InsertCollectionRowCommand, InternalAuthBootstrapFactory, InternalAuthBootstrapJsonCodec, ListCollectionRowsQuery, ListCollectionsQuery, ListUserAccountsQuery, PublicFrontendBootstrapFactory, PublicFrontendBootstrapJsonCodec, StartWorkflowRunCommand, SyncCollectionsCommand, UpdateCollectionRowCommand, UpsertLocalBootstrapUserCommand, WorkerRuntime, defineCodemationApp, definePlugin, workflow };

package/dist/mapping.d.ts

@@ -1,3 +1,3 @@
-import "./ItemsInputNormalizer-C-KHg9Mo.js";
-import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-DQEY-h_S.js";
+import "./ItemsInputNormalizer-_RwIfRIQ.js";
+import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-6MyjCvBO.js";
 export { WorkflowPolicyUiPresentationFactory };

package/dist/mapping.js

@@ -1,3 +1,3 @@
-import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-DhPqQ9aB.js";
+import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-Bb-ae_Zh.js";
 
 export { WorkflowPolicyUiPresentationFactory };

package/dist/nextServer.d.ts

@@ -1,18 +1,20 @@
-import { t as RunIntentService } from "./index-BbBk26m0.js";
-import { Ct as CredentialTypeDefinition, E as WebhookInvocationMatch, F as BinaryAttachment, G as RunIdFactory, I as Item, J as WorkflowDefinition, P as ActivationIdFactory, _t as CredentialOAuth2AuthDefinition, o as BinaryStorage, w as WorkflowActivationPolicy } from "./ItemsInputNormalizer-C-KHg9Mo.js";
-import { r as AppConfig } from "./CodemationAppContext-DRu1Dpri.js";
-import { l as Logger, u as LoggerFactory } from "./CodemationWhitelabelConfig-CWbcyQqn.js";
-import { n as logLevelPolicyFactory, t as LogLevelPolicyFactory } from "./LogLevelPolicyFactory-CampWO0l.js";
-import { a as CodemationFrontendAuthSnapshot, i as CodemationFrontendAuthProviderSnapshot, n as InternalAuthBootstrap, r as FrontendAppConfig, t as PublicFrontendBootstrap } from "./PublicFrontendBootstrap-DzBgwOnG.js";
-import "./CodemationConfigNormalizer-DVko3cVN.js";
-import { a as CredentialInstanceService, c as CredentialSecretCipher, i as CredentialBindingService, l as CredentialFieldEnvOverlayService, o as CredentialOAuth2ScopeResolver, r as CredentialRuntimeMaterialService, s as CredentialMaterialResolver, t as CredentialStore, u as CredentialTypeRegistryImpl } from "./CredentialServices-UfvHB-rN.js";
-import "./CredentialContractsRegistry-DrMIDSw8.js";
-import "./TelemetryContracts-DbaNomrH.js";
-import { i as WorkflowSummary, t as WorkflowDto } from "./WorkflowViewContracts-CzK2KFuz.js";
-import { _ as WorkflowWebsocketServer, a as WorkflowDebuggerOverlayRepository, b as CommandBus, c as FrontendRuntime, d as LogFilter, f as WorkflowRunRepository, g as AppContainerFactory, h as AppContainerLifecycle, i as HonoApiRouteRegistrar, l as WorkflowRunRetentionPruneScheduler, m as DatabaseMigrations, n as CodemationBootstrapRequest, o as SessionVerifier, r as ApplicationTokens, s as WorkerRuntime, t as CodemationPluginListMerger, u as ServerLoggerFactory, v as QueryBus } from "./CodemationPluginListMerger-DGc-jfa2.js";
-import { t as AppConfigFactory } from "./AppConfigFactory-YnveXE9k.js";
-import { n as InternalAuthBootstrapFactory, r as FrontendAppConfigFactory, t as PublicFrontendBootstrapFactory } from "./PublicFrontendBootstrapFactory-Cb2pLmDd.js";
-import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-DQEY-h_S.js";
+import { n as RunIntentService, t as OAuthFlowExecutor } from "./index-DilAYwnH.js";
+import { D as WebhookInvocationMatch, F as ActivationIdFactory, I as BinaryAttachment, L as Item, X as WorkflowDefinition, o as BinaryStorage, q as RunIdFactory, w as WorkflowActivationPolicy } from "./ItemsInputNormalizer-_RwIfRIQ.js";
+import { r as AppConfig } from "./CodemationAppContext-CKVv9W9q.js";
+import { l as Logger, u as LoggerFactory } from "./CodemationWhitelabelConfig-Ca2mCUeC.js";
+import { n as logLevelPolicyFactory, t as LogLevelPolicyFactory } from "./LogLevelPolicyFactory-ewCHLDLn.js";
+import { a as CodemationFrontendAuthSnapshot, i as CodemationFrontendAuthProviderSnapshot, n as InternalAuthBootstrap, r as FrontendAppConfig, t as PublicFrontendBootstrap } from "./PublicFrontendBootstrap-Cev3qK46.js";
+import "./CodemationConfigNormalizer-BAKjetJ6.js";
+import { a as CredentialSecretCipher, i as CredentialInstanceService, o as McpServerCatalog, r as CredentialBindingService, t as CredentialStore } from "./CredentialServices-Be2I60Th.js";
+import "./CredentialContractsRegistry-Bq2bq28t.js";
+import "./TelemetryContracts-BtDx84Cp.js";
+import { i as WorkflowSummary, t as WorkflowDto } from "./WorkflowViewContracts-B7aFQcIw.js";
+import { _ as AppContainerFactory, a as HonoApiRouteRegistrar, c as WorkerRuntime, d as ServerLoggerFactory, f as LogFilter, g as AppContainerLifecycle, h as DatabaseMigrations, i as ManagedCorsMiddleware, l as FrontendRuntime, n as CodemationBootstrapRequest, o as WorkflowDebuggerOverlayRepository, p as WorkflowRunRepository, r as ApplicationTokens, s as SessionVerifier, t as CodemationPluginListMerger, u as WorkflowRunRetentionPruneScheduler, v as WorkflowWebsocketServer, x as CommandBus, y as QueryBus } from "./CodemationPluginListMerger-DKLAHT2b.js";
+import { t as AppConfigFactory } from "./AppConfigFactory-DnLoQ9Li.js";
+import { n as InternalAuthBootstrapFactory, r as FrontendAppConfigFactory, t as PublicFrontendBootstrapFactory } from "./PublicFrontendBootstrapFactory-CY2FS-5g.js";
+import { t as InternalHonoApiRouteRegistrar } from "./InternalHonoApiRouteRegistrar-Ce1yxpnO.js";
+import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-6MyjCvBO.js";
+import { t as PairingConfig } from "./pairing.types-snfZ_OzB.js";
 import { Hono } from "hono";
 
 //#region src/application/dev/DevBootstrapSummaryJson.types.d.ts
@@ -91,7 +93,8 @@ interface DataMapper<TSource, TTarget> {
 declare class WorkflowDefinitionMapper implements DataMapper<WorkflowDefinition, WorkflowDto> {
   private readonly policyUi;
   private readonly workflowActivationPolicy;
-  constructor(policyUi: WorkflowPolicyUiPresentationFactory, workflowActivationPolicy: WorkflowActivationPolicy);
+  private readonly mcpCatalog;
+  constructor(policyUi: WorkflowPolicyUiPresentationFactory, workflowActivationPolicy: WorkflowActivationPolicy, mcpCatalog: McpServerCatalog);
   map(workflow: WorkflowDefinition): Promise<WorkflowDto>;
   mapSync(workflow: WorkflowDefinition): WorkflowDto;
   toSummary(workflow: WorkflowDefinition): WorkflowSummary;
@@ -109,6 +112,7 @@ declare class WorkflowDefinitionMapper implements DataMapper<WorkflowDefinition,
    * Omit optional port fields when undefined so persisted snapshot DTOs (which never serialize
    * undefined keys) stay aligned with live workflow mapping.
    */
+  private readInspectorSummary;
   private nodePortFieldsFromConfig;
   private nodeTypeName;
 }
@@ -148,7 +152,7 @@ declare class BinaryHttpRouteHandler {
 //#region src/presentation/http/hono/CodemationHonoApiAppFactory.d.ts
 declare class CodemationHonoApiApp {
   private readonly app;
-  constructor(sessionVerifier: SessionVerifier, registrars: ReadonlyArray<HonoApiRouteRegistrar>, binaryHttpRouteHandler: BinaryHttpRouteHandler);
+  constructor(sessionVerifier: SessionVerifier, registrars: ReadonlyArray<HonoApiRouteRegistrar>, binaryHttpRouteHandler: BinaryHttpRouteHandler, internalRegistrars: ReadonlyArray<InternalHonoApiRouteRegistrar>, corsMiddlewareList: ReadonlyArray<ManagedCorsMiddleware>);
   getHono(): Hono;
   fetch(request: Request): Response | Promise<Response>;
 }
@@ -157,7 +161,9 @@ declare class CodemationHonoApiApp {
 declare class CredentialHttpRouteHandler {
   private readonly queryBus;
   private readonly commandBus;
-  constructor(queryBus: QueryBus, commandBus: CommandBus);
+  private readonly sessionVerifier;
+  private readonly pairingConfig;
+  constructor(queryBus: QueryBus, commandBus: CommandBus, sessionVerifier: SessionVerifier, pairingConfig: PairingConfig | null);
   getCredentialTypes(): Promise<Response>;
   getCredentialFieldEnvStatus(): Promise<Response>;
   getCredentialInstances(): Promise<Response>;
@@ -170,87 +176,36 @@ declare class CredentialHttpRouteHandler {
   getWorkflowCredentialHealth(_: Request, params: ServerHttpRouteParams): Promise<Response>;
 }
 //#endregion
-//#region src/domain/credentials/OAuth2ProviderRegistry.d.ts
-type JsonRecord = Readonly<Record<string, unknown>>;
-type OAuth2ResolvedProvider = Readonly<{
-  providerId: string;
-  authorizeUrl: string;
-  tokenUrl: string;
-  userInfoUrl?: string;
-}>;
-declare class OAuth2ProviderRegistry {
-  private static readonly googleProvider;
-  resolve(definition: CredentialTypeDefinition, publicConfig: JsonRecord): OAuth2ResolvedProvider;
-  resolveClientId(auth: CredentialOAuth2AuthDefinition, publicConfig: JsonRecord): string;
-  resolveClientSecretFieldKey(auth: CredentialOAuth2AuthDefinition): string;
-  private resolveBuiltInProvider;
-  private resolveTemplateProvider;
-  private expandTemplate;
-  private resolvePublicConfigProvider;
-}
-//#endregion
-//#region src/domain/credentials/OAuth2ConnectServiceFactory.d.ts
-type OAuth2AuthRedirectResult = Readonly<{
-  instanceId: string;
-  redirectUri: string;
-  redirectUrl: string;
-}>;
-type OAuth2CallbackResult = Readonly<{
-  instanceId: string;
-  connectedEmail?: string;
-}>;
-declare class OAuth2ConnectService {
-  private readonly credentialStore;
-  private readonly credentialInstanceService;
-  private readonly credentialTypeRegistry;
-  private readonly credentialRuntimeMaterialService;
-  private readonly credentialFieldEnvOverlayService;
-  private readonly credentialMaterialResolver;
-  private readonly credentialSecretCipher;
-  private readonly credentialOAuth2ScopeResolver;
-  private readonly oauth2ProviderRegistry;
+//#region src/domain/credentials/OAuth2RedirectUriResolver.d.ts
+/**
+ * Resolves the canonical OAuth2 redirect URI from the public base URL or request origin.
+ * The redirect URI always points to `/api/oauth2/callback`, which is the URL operators
+ * register with their OAuth provider.
+ */
+declare class OAuth2RedirectUriResolver {
   private readonly appConfig;
-  private static readonly stateTtlMs;
-  constructor(credentialStore: CredentialStore, credentialInstanceService: CredentialInstanceService, credentialTypeRegistry: CredentialTypeRegistryImpl, credentialRuntimeMaterialService: CredentialRuntimeMaterialService, credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService, credentialMaterialResolver: CredentialMaterialResolver, credentialSecretCipher: CredentialSecretCipher, credentialOAuth2ScopeResolver: CredentialOAuth2ScopeResolver, oauth2ProviderRegistry: OAuth2ProviderRegistry, appConfig: AppConfig);
-  createAuthRedirect(instanceId: string, requestOrigin: string): Promise<OAuth2AuthRedirectResult>;
-  handleCallback(args: Readonly<{
-    code?: string | null;
-    state?: string | null;
-    requestOrigin: string;
-  }>): Promise<OAuth2CallbackResult>;
-  getRedirectUri(requestOrigin: string): string;
+  constructor(appConfig: AppConfig);
+  resolve(requestOrigin: string): string;
   /**
-   * `new URL(path, base)` requires `base` to be an absolute URL with a scheme.
-   * Misconfigured CODEMATION_PUBLIC_BASE_URL (e.g. `localhost:3000` without http://) or odd
-   * forwarded headers otherwise throw TypeError: Invalid URL.
-   *
-   * Comma-separated values (proxy chains or copy-paste mistakes like `http,http`) use the
-   * first segment only; obviously invalid hostnames are rejected.
+   * Ensures the base URL has an http/https scheme. Comma-separated values (proxy chains) use
+   * the first segment only.
    */
-  private ensureAbsoluteUrlForOAuth2Base;
-  private requireOAuth2Type;
-  private exchangeAuthorizationCode;
-  private mergeTokenMaterial;
-  private resolveExpiry;
-  private resolveGrantedScopes;
-  private resolveConnectedEmail;
-  private findEmail;
-  private parseJsonRecord;
-  private createTokenExchangeErrorMessage;
-  private createOpaqueValue;
-  private createPkceCodeChallenge;
+  private ensureAbsoluteUrl;
   private normalizeBaseUrl;
 }
 //#endregion
 //#region src/presentation/http/routeHandlers/OAuth2HttpRouteHandlerFactory.d.ts
 declare class OAuth2HttpRouteHandler {
-  private readonly oauth2ConnectService;
+  private readonly redirectUriResolver;
   private readonly credentialInstanceService;
-  constructor(oauth2ConnectService: OAuth2ConnectService, credentialInstanceService: CredentialInstanceService);
-  getAuthRedirect(request: Request): Promise<Response>;
-  getCallback(request: Request): Promise<Response>;
+  private readonly oauthFlowExecutor;
+  private readonly credentialStore;
+  private readonly credentialSecretCipher;
+  constructor(redirectUriResolver: OAuth2RedirectUriResolver, credentialInstanceService: CredentialInstanceService, oauthFlowExecutor: OAuthFlowExecutor, credentialStore: CredentialStore, credentialSecretCipher: CredentialSecretCipher);
   getRedirectUri(request: Request): Promise<Response>;
   postDisconnect(request: Request): Promise<Response>;
+  postOAuthStart(request: Request): Promise<Response>;
+  getOAuthCallback(request: Request): Promise<Response>;
   private resolveRequestOrigin;
   /** Proxies may send comma-separated lists (chain); use the first host/proto only. */
   private static firstCommaSeparatedValue;

package/dist/nextServer.js

@@ -1,12 +1,14 @@
 import { n as logLevelPolicyFactory, t as LogLevelPolicyFactory } from "./LogLevelPolicyFactory-DCUzIN6G.js";
-import "./ApiPaths-CLTHphYZ.js";
-import { a as FilteringLogger, i as PerformanceLogPolicy, n as PerformanceLogPolicyFactory, r as performanceLogPolicyFactory, t as ServerLoggerFactory } from "./ServerLoggerFactory-BKSIh9Xv.js";
+import "./ApiPaths-Dv1dcHu_.js";
+import { a as FilteringLogger, i as PerformanceLogPolicy, n as PerformanceLogPolicyFactory, r as performanceLogPolicyFactory, t as ServerLoggerFactory } from "./ServerLoggerFactory-Ckk52S3w.js";
 import "./decorateParam-BWxkAUSj.js";
 import "./decorate-CXWmflG_.js";
-import { a as CredentialInstanceService, d as ApplicationTokens, i as CredentialBindingService } from "./CredentialServices-CgxwguAv.js";
-import { C as BinaryHttpRouteHandler, E as FrontendAppConfigFactory, M as RunBinaryAttachmentLookupService, O as WorkflowWebsocketServer, S as CodemationHonoApiApp, T as InternalAuthBootstrapFactory, _ as WebhookHttpRouteHandler, b as OAuth2HttpRouteHandler, d as FrontendRuntime, g as WorkflowHttpRouteHandler, h as WorkflowRunRetentionPruneScheduler, k as WorkflowDefinitionMapper, m as AppContainerLifecycle, p as DatabaseMigrations, t as AppContainerFactory, u as WorkerRuntime, v as RequestToWebhookItemMapper, w as PublicFrontendBootstrapFactory, x as CredentialHttpRouteHandler, y as RunHttpRouteHandler } from "./AppContainerFactory-qaqc-R1D.js";
-import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-DhPqQ9aB.js";
-import { t as AppConfigFactory } from "./AppConfigFactory-C6q-CSKb.js";
-import { n as CodemationBootstrapRequest, t as CodemationPluginListMerger } from "./CodemationPluginListMerger-B-W5Fa_X.js";
+import { a as CredentialInstanceService, i as CredentialBindingService, m as ApplicationTokens } from "./CredentialServices-Dk8yypeL.js";
+import "./CodemationTsyringeTypeInfoRegistrar-Bj6FJYFz.js";
+import { A as WorkflowDefinitionMapper, C as CodemationHonoApiApp, D as FrontendAppConfigFactory, E as InternalAuthBootstrapFactory, P as RunBinaryAttachmentLookupService, S as CredentialHttpRouteHandler, T as PublicFrontendBootstrapFactory, _ as WorkflowHttpRouteHandler, b as RunHttpRouteHandler, d as FrontendRuntime, h as WorkflowRunRetentionPruneScheduler, k as WorkflowWebsocketServer, m as AppContainerLifecycle, p as DatabaseMigrations, t as AppContainerFactory, u as WorkerRuntime, v as WebhookHttpRouteHandler, w as BinaryHttpRouteHandler, x as OAuth2HttpRouteHandler, y as RequestToWebhookItemMapper } from "./AppContainerFactory-DqKYCRNP.js";
+import { t as WorkflowPolicyUiPresentationFactory } from "./WorkflowPolicyUiPresentationFactory-Bb-ae_Zh.js";
+import "./InternalPingRegistrar-DY3kSfxP.js";
+import { t as AppConfigFactory } from "./AppConfigFactory-Cx4qQvRk.js";
+import { n as CodemationBootstrapRequest, t as CodemationPluginListMerger } from "./CodemationPluginListMerger-D1B1IEbt.js";
 
 export { AppConfigFactory, AppContainerFactory, AppContainerLifecycle, ApplicationTokens, BinaryHttpRouteHandler, CodemationBootstrapRequest, CodemationHonoApiApp, CodemationPluginListMerger, CredentialBindingService, CredentialHttpRouteHandler, CredentialInstanceService, DatabaseMigrations, FilteringLogger, FrontendAppConfigFactory, FrontendRuntime, InternalAuthBootstrapFactory, LogLevelPolicyFactory, OAuth2HttpRouteHandler, PerformanceLogPolicy, PerformanceLogPolicyFactory, PublicFrontendBootstrapFactory, RequestToWebhookItemMapper, RunBinaryAttachmentLookupService, RunHttpRouteHandler, ServerLoggerFactory, WebhookHttpRouteHandler, WorkerRuntime, WorkflowDefinitionMapper, WorkflowHttpRouteHandler, WorkflowPolicyUiPresentationFactory, WorkflowRunRetentionPruneScheduler, WorkflowWebsocketServer, logLevelPolicyFactory, performanceLogPolicyFactory };

package/dist/pairing.d.ts

@@ -0,0 +1,93 @@
+import "./index-DilAYwnH.js";
+import { g as TypeToken } from "./ItemsInputNormalizer-_RwIfRIQ.js";
+import { t as InternalHonoApiRouteRegistrar } from "./InternalHonoApiRouteRegistrar-Ce1yxpnO.js";
+import { i as PairingVerificationSuccess, n as PairingVerificationFailure, r as PairingVerificationResult, t as PairingConfig } from "./pairing.types-snfZ_OzB.js";
+import { Hono, MiddlewareHandler } from "hono";
+
+//#region src/pairing/HmacRequestSigner.d.ts
+interface SignedHeaders {
+  readonly Authorization: string;
+}
+declare class HmacRequestSigner {
+  private readonly config;
+  constructor(config: PairingConfig);
+  sign(method: string, urlOrPath: string, body: string): SignedHeaders;
+}
+//#endregion
+//#region src/pairing/PairedFetch.d.ts
+/**
+ * Thin fetch wrapper that automatically HMAC-signs outgoing requests
+ * to the control plane using the workspace's pairing secret.
+ *
+ * Use this for any server-to-server request from the installation to the CP.
+ */
+declare class PairedFetch {
+  private readonly signer;
+  constructor(signer: HmacRequestSigner);
+  get(url: string): Promise<Response>;
+  post(url: string, body: unknown): Promise<Response>;
+  delete(url: string): Promise<Response>;
+}
+//#endregion
+//#region src/pairing/IncomingHmacVerifier.d.ts
+/**
+ * Verifies incoming HMAC-signed requests from the control plane.
+ * Mirrors the control-plane HmacVerifier — both sides follow docs/pairing-protocol.md.
+ */
+declare class IncomingHmacVerifier {
+  private readonly config;
+  private readonly usedNonces;
+  private readonly nonceTtlSeconds;
+  constructor(config: PairingConfig);
+  verify(method: string, url: string, body: string, authHeader: string | null): PairingVerificationResult;
+  private parseHeader;
+  private pruneExpiredNonces;
+}
+//#endregion
+//#region src/pairing/InternalHmacAuthMiddleware.d.ts
+/**
+ * Hono middleware that verifies HMAC-signed requests on /internal/* routes.
+ * Rejects with 401 on any auth failure (failure mode is never leaked).
+ *
+ * Downstream handlers read the consumed body from `c.get("body")` when needed —
+ * do NOT call `c.req.text()` again after this middleware runs.
+ */
+declare class InternalHmacAuthMiddleware {
+  private readonly verifier;
+  constructor(verifier: IncomingHmacVerifier);
+  handle(): MiddlewareHandler;
+}
+//#endregion
+//#region src/pairing/InternalPingRegistrar.d.ts
+/**
+ * Registers GET /internal/ping — a smoke-test endpoint for verifying workspace pairing.
+ * Returns { pong: true, workspaceId } when the HMAC signature validates correctly.
+ */
+declare class InternalPingRegistrar implements InternalHonoApiRouteRegistrar {
+  private readonly hmacMiddleware;
+  private readonly pairingConfig;
+  constructor(hmacMiddleware: InternalHmacAuthMiddleware, pairingConfig: PairingConfig);
+  register(app: Hono): void;
+}
+//#endregion
+//#region src/pairing/PairingConfigFactory.d.ts
+/**
+ * Reads pairing configuration from environment variables.
+ *
+ * Required env vars when pairing is enabled:
+ *   WORKSPACE_ID               — the workspace's database ID
+ *   WORKSPACE_PAIRING_SECRET   — base64-encoded 32-byte shared secret
+ *   CONTROL_PLANE_URL          — base URL of the control plane API
+ *
+ * Returns null if any required variable is absent (pairing disabled).
+ * See docs/pairing-protocol.md for full bootstrap instructions.
+ */
+declare class PairingConfigFactory {
+  create(env: Readonly<NodeJS.ProcessEnv>): PairingConfig | null;
+}
+//#endregion
+//#region src/pairing/PairingConfigToken.d.ts
+declare const PairingConfigToken: TypeToken<PairingConfig>;
+//#endregion
+export { HmacRequestSigner, IncomingHmacVerifier, InternalHmacAuthMiddleware, InternalPingRegistrar, PairedFetch, type PairingConfig, PairingConfigFactory, PairingConfigToken, type PairingVerificationFailure, type PairingVerificationResult, type PairingVerificationSuccess, type SignedHeaders };
+//# sourceMappingURL=pairing.d.ts.map

package/dist/pairing.js

@@ -0,0 +1,5 @@
+import "./decorateParam-BWxkAUSj.js";
+import "./decorate-CXWmflG_.js";
+import { a as PairedFetch, i as PairingConfigFactory, n as InternalHmacAuthMiddleware, o as HmacRequestSigner, r as IncomingHmacVerifier, s as PairingConfigToken, t as InternalPingRegistrar } from "./InternalPingRegistrar-DY3kSfxP.js";
+
+export { HmacRequestSigner, IncomingHmacVerifier, InternalHmacAuthMiddleware, InternalPingRegistrar, PairedFetch, PairingConfigFactory, PairingConfigToken };

package/dist/pairing.types-snfZ_OzB.d.ts

@@ -0,0 +1,19 @@
+//#region src/pairing/pairing.types.d.ts
+interface PairingConfig {
+  /** The workspace's database ID. */
+  readonly workspaceId: string;
+  /** Base64-encoded 32-byte raw secret shared with the control plane. */
+  readonly pairingSecret: string;
+  /** Base URL of the control plane API, e.g. https://api.codemation.io */
+  readonly controlPlaneUrl: string;
+}
+type PairingVerificationFailure = {
+  readonly failure: "missing" | "version" | "expired" | "workspace" | "signature" | "replay";
+};
+type PairingVerificationSuccess = {
+  readonly workspaceId: string;
+};
+type PairingVerificationResult = PairingVerificationSuccess | PairingVerificationFailure;
+//#endregion
+export { PairingVerificationSuccess as i, PairingVerificationFailure as n, PairingVerificationResult as r, PairingConfig as t };
+//# sourceMappingURL=pairing.types-snfZ_OzB.d.ts.map

package/dist/{persistenceServer-CmsIKnO9.js → persistenceServer-C-hH4z6l.js}

@@ -1,5 +1,5 @@
 import { i as __toESM } from "./chunk-7V6ThxGB.js";
-import { i as require_client } from "./AppConfigFactory-C6q-CSKb.js";
+import { a as require_client } from "./AppConfigFactory-Cx4qQvRk.js";
 import { PrismaPg } from "@prisma/adapter-pg";
 
 //#region src/infrastructure/persistence/CodemationPostgresPrismaClientFactory.ts
@@ -12,4 +12,4 @@ var CodemationPostgresPrismaClientFactory = class {
 
 //#endregion
 export { CodemationPostgresPrismaClientFactory as t };
-//# sourceMappingURL=persistenceServer-CmsIKnO9.js.map
+//# sourceMappingURL=persistenceServer-C-hH4z6l.js.map

package/dist/{persistenceServer-CmsIKnO9.js.map → persistenceServer-C-hH4z6l.js.map}

@@ -1 +1 @@
-{"version":3,"file":"persistenceServer-CmsIKnO9.js","names":["PrismaClient"],"sources":["../src/infrastructure/persistence/CodemationPostgresPrismaClientFactory.ts"],"sourcesContent":["import { PrismaPg } from \"@prisma/adapter-pg\";\nimport { PrismaClient } from \"../../../prisma-generated/prisma-postgresql-client/client.js\";\n\nexport class CodemationPostgresPrismaClientFactory {\n  static create(databaseUrl: string): PrismaClient {\n    const adapter = new PrismaPg({ connectionString: databaseUrl });\n    return new PrismaClient({ adapter });\n  }\n}\n"],"mappings":";;;;;;AAGA,IAAa,wCAAb,MAAmD;CACjD,OAAO,OAAO,aAAmC;AAE/C,SAAO,IAAIA,2BAAa,EAAE,SADV,IAAI,SAAS,EAAE,kBAAkB,aAAa,CAAC,EAC5B,CAAC"}
+{"version":3,"file":"persistenceServer-C-hH4z6l.js","names":["PrismaClient"],"sources":["../src/infrastructure/persistence/CodemationPostgresPrismaClientFactory.ts"],"sourcesContent":["import { PrismaPg } from \"@prisma/adapter-pg\";\nimport { PrismaClient } from \"../../../prisma-generated/prisma-postgresql-client/client.js\";\n\nexport class CodemationPostgresPrismaClientFactory {\n  static create(databaseUrl: string): PrismaClient {\n    const adapter = new PrismaPg({ connectionString: databaseUrl });\n    return new PrismaClient({ adapter });\n  }\n}\n"],"mappings":";;;;;;AAGA,IAAa,wCAAb,MAAmD;CACjD,OAAO,OAAO,aAAmC;AAE/C,SAAO,IAAIA,2BAAa,EAAE,SADV,IAAI,SAAS,EAAE,kBAAkB,aAAa,CAAC,EAC5B,CAAC"}

package/dist/persistenceServer-CeTHtC6E.d.ts

@@ -0,0 +1,30 @@
+import { i as AppPersistenceConfig } from "./CodemationAppContext-CKVv9W9q.js";
+import { i as PrismaClient } from "./AppConfigFactory-DnLoQ9Li.js";
+
+//#region src/infrastructure/persistence/CodemationPostgresPrismaClientFactory.d.ts
+declare class CodemationPostgresPrismaClientFactory {
+  static create(databaseUrl: string): PrismaClient;
+}
+//#endregion
+//#region src/infrastructure/persistence/CodemationDatabaseUrlParser.d.ts
+/**
+ * Parses `CODEMATION_DATABASE_URL` into an {@link AppPersistenceConfig}.
+ *
+ * Supported schemes (case-insensitive):
+ *   - `sqlite://relative/path/to/file.db`    → resolved relative to consumerRoot
+ *   - `sqlite:///absolute/path/to/file.db`   → leading slash = POSIX absolute
+ *   - `sqlite://C:/path/file.db`             → Windows-style absolute (path.isAbsolute()
+ *                                              returns true for these)
+ *   - `pgsql://user:pass@host:5432/dbname`   → normalised to postgresql://
+ *   - `postgresql://user:pass@host:5432/db`  → pass-through (Prisma's expected scheme)
+ *   - `postgres://user:pass@host:5432/db`    → pass-through (common alias)
+ *
+ * Throws on any other scheme. Empty / whitespace input is also an error — callers
+ * should default before calling parse().
+ */
+declare class CodemationDatabaseUrlParser {
+  parse(url: string, consumerRoot: string): AppPersistenceConfig;
+}
+//#endregion
+export { CodemationPostgresPrismaClientFactory as n, CodemationDatabaseUrlParser as t };
+//# sourceMappingURL=persistenceServer-CeTHtC6E.d.ts.map

package/dist/persistenceServer.d.ts

@@ -1,8 +1,8 @@
-import "./index-BbBk26m0.js";
-import "./ItemsInputNormalizer-C-KHg9Mo.js";
-import { i as AppPersistenceConfig } from "./CodemationAppContext-DRu1Dpri.js";
-import "./CodemationWhitelabelConfig-CWbcyQqn.js";
-import "./CodemationConfigNormalizer-DVko3cVN.js";
-import { n as PrismaMigrationDeployer, r as PrismaDatabaseClient, t as AppConfigFactory } from "./AppConfigFactory-YnveXE9k.js";
-import { t as CodemationPostgresPrismaClientFactory } from "./persistenceServer-vtJAGDat.js";
-export { AppConfigFactory, AppPersistenceConfig, CodemationPostgresPrismaClientFactory, PrismaDatabaseClient as PrismaClient, PrismaMigrationDeployer };
+import "./index-DilAYwnH.js";
+import "./ItemsInputNormalizer-_RwIfRIQ.js";
+import { i as AppPersistenceConfig } from "./CodemationAppContext-CKVv9W9q.js";
+import "./CodemationWhitelabelConfig-Ca2mCUeC.js";
+import "./CodemationConfigNormalizer-BAKjetJ6.js";
+import { n as PrismaMigrationDeployer, r as PrismaDatabaseClient, t as AppConfigFactory } from "./AppConfigFactory-DnLoQ9Li.js";
+import { n as CodemationPostgresPrismaClientFactory, t as CodemationDatabaseUrlParser } from "./persistenceServer-CeTHtC6E.js";
+export { AppConfigFactory, AppPersistenceConfig, CodemationDatabaseUrlParser, CodemationPostgresPrismaClientFactory, PrismaDatabaseClient as PrismaClient, PrismaMigrationDeployer };

package/dist/persistenceServer.js

@@ -1,5 +1,5 @@
 import "./decorate-CXWmflG_.js";
-import { r as PrismaMigrationDeployer, t as AppConfigFactory } from "./AppConfigFactory-C6q-CSKb.js";
-import { t as CodemationPostgresPrismaClientFactory } from "./persistenceServer-CmsIKnO9.js";
+import { i as PrismaMigrationDeployer, n as CodemationDatabaseUrlParser, t as AppConfigFactory } from "./AppConfigFactory-Cx4qQvRk.js";
+import { t as CodemationPostgresPrismaClientFactory } from "./persistenceServer-C-hH4z6l.js";
 
-export { AppConfigFactory, CodemationPostgresPrismaClientFactory, PrismaMigrationDeployer };
+export { AppConfigFactory, CodemationDatabaseUrlParser, CodemationPostgresPrismaClientFactory, PrismaMigrationDeployer };

package/dist/{server-MUNGsBYK.d.ts → server-C4bS62rg.d.ts}

@@ -1,8 +1,23 @@
-import { m as CodemationConfig, o as CodemationPlugin, r as AppConfig } from "./CodemationAppContext-DRu1Dpri.js";
-import { t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-DJWr86f-.js";
-import { i as WorkflowSummary, t as WorkflowDto } from "./WorkflowViewContracts-CzK2KFuz.js";
-import { t as AppConfigFactory } from "./AppConfigFactory-YnveXE9k.js";
+import { m as CodemationConfig, o as CodemationPlugin, r as AppConfig } from "./CodemationAppContext-CKVv9W9q.js";
+import { t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-nxOqvv46.js";
+import { i as WorkflowSummary, t as WorkflowDto } from "./WorkflowViewContracts-B7aFQcIw.js";
+import { t as AppConfigFactory } from "./AppConfigFactory-DnLoQ9Li.js";
+import { a as ProcessRunOptions, o as ProcessRunResult, s as ProcessRunner } from "./PublicFrontendBootstrapFactory-CY2FS-5g.js";
+import { ChildProcess } from "node:child_process";
 
+//#region src/process/ExecaProcessRunner.d.ts
+/**
+ * Production {@link ProcessRunner}. Defers cross-platform executable resolution (`pnpm` ↔ `pnpm.cmd`,
+ * `.cmd` / `.bat` / `.ps1` shims on Windows) and argument quoting to execa so call sites stop having
+ * to hand-roll platform conditionals.
+ */
+declare class ExecaProcessRunner implements ProcessRunner {
+  spawn(command: string, args: ReadonlyArray<string>, options?: ProcessRunOptions): ChildProcess;
+  runSync(command: string, args: ReadonlyArray<string>, options?: ProcessRunOptions): ProcessRunResult;
+  private toExecaOptions;
+  private toExecaSyncOptions;
+}
+//#endregion
 //#region src/presentation/http/CodemationServerGatewayFactory.d.ts
 declare class CodemationServerGateway {
   private readonly config;
@@ -88,5 +103,5 @@ declare class WorkflowDiscoveryPathSegmentsComputer {
   }>): readonly string[] | undefined;
 }
 //#endregion
-export { CodemationResolvedPluginPackage as a, CodemationServerGateway as c, CodemationPluginDiscovery as i, WorkflowModulePathFinder as n, AppConfigLoadResult as o, CodemationDiscoveredPluginPackage as r, AppConfigLoader as s, WorkflowDiscoveryPathSegmentsComputer as t };
-//# sourceMappingURL=server-MUNGsBYK.d.ts.map
+export { CodemationResolvedPluginPackage as a, CodemationServerGateway as c, CodemationPluginDiscovery as i, ExecaProcessRunner as l, WorkflowModulePathFinder as n, AppConfigLoadResult as o, CodemationDiscoveredPluginPackage as r, AppConfigLoader as s, WorkflowDiscoveryPathSegmentsComputer as t };
+//# sourceMappingURL=server-C4bS62rg.d.ts.map

package/dist/{server-CJFfY67o.js → server-Y7kxwtCK.js}

@@ -1,7 +1,7 @@
-import { a as CodemationConfigNormalizer, t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-BeAUS144.js";
-import { d as ApplicationTokens } from "./CredentialServices-CgxwguAv.js";
-import { A as GetWorkflowSummariesQuery, S as CodemationHonoApiApp, d as FrontendRuntime, j as GetWorkflowDetailQuery, k as WorkflowDefinitionMapper, m as AppContainerLifecycle, t as AppContainerFactory } from "./AppContainerFactory-qaqc-R1D.js";
-import { n as CodemationPluginPackageMetadata, t as AppConfigFactory } from "./AppConfigFactory-C6q-CSKb.js";
+import { a as CodemationConfigNormalizer, t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-GYpBBvqE.js";
+import { m as ApplicationTokens } from "./CredentialServices-Dk8yypeL.js";
+import { A as WorkflowDefinitionMapper, C as CodemationHonoApiApp, M as GetWorkflowDetailQuery, d as FrontendRuntime, j as GetWorkflowSummariesQuery, m as AppContainerLifecycle, t as AppContainerFactory } from "./AppContainerFactory-DqKYCRNP.js";
+import { r as CodemationPluginPackageMetadata, t as AppConfigFactory } from "./AppConfigFactory-Cx4qQvRk.js";
 import { readFile, readdir } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
@@ -189,7 +189,8 @@ var CodemationPluginDiscovery = class {
 		const pluginValue = value;
 		if (pluginValue.register !== void 0 && typeof pluginValue.register !== "function") return false;
 		if (pluginValue.credentialTypes !== void 0 && !Array.isArray(pluginValue.credentialTypes)) return false;
-		return pluginValue.register !== void 0 || pluginValue.credentialTypes !== void 0 || pluginValue.sandbox !== void 0 || Object.keys(pluginValue).length === 0;
+		if (pluginValue.mcpServers !== void 0 && !Array.isArray(pluginValue.mcpServers)) return false;
+		return pluginValue.register !== void 0 || pluginValue.credentialTypes !== void 0 || pluginValue.mcpServers !== void 0 || pluginValue.sandbox !== void 0 || Object.keys(pluginValue).length === 0;
 	}
 	resolvePluginEntry(discoveredPackage) {
 		return process.env.CODEMATION_PREFER_PLUGIN_SOURCE_ENTRY === "true" && typeof discoveredPackage.developmentEntry === "string" && discoveredPackage.developmentEntry.trim().length > 0 ? discoveredPackage.developmentEntry : discoveredPackage.pluginEntry;
@@ -218,4 +219,4 @@ var CodemationPluginDiscovery = class {
 
 //#endregion
 export { AppConfigLoader as n, CodemationServerGateway as r, CodemationPluginDiscovery as t };
-//# sourceMappingURL=server-CJFfY67o.js.map
+//# sourceMappingURL=server-Y7kxwtCK.js.map