@codemation/host 0.6.0 → 0.8.0

package/src/presentation/server/WorkflowDefinitionExportsResolver.ts

@@ -1,20 +1,38 @@
 import type { WorkflowDefinition } from "@codemation/core";
+import { WorkflowEdgePortValidator } from "@codemation/core";
 
 /**
  * Collects exported values that match the {@link WorkflowDefinition} shape.
  * Other exports (helpers, constants, type-only re-exports) are ignored.
+ *
+ * Throws if any workflow's edges reference output ports not declared by the
+ * source node config. All violations are reported at once so an agent can
+ * self-correct in a single pass.
  */
 export class WorkflowDefinitionExportsResolver {
+  private readonly portValidator = new WorkflowEdgePortValidator();
+
   resolve(moduleExports: Readonly<Record<string, unknown>>): ReadonlyArray<WorkflowDefinition> {
     const workflows: WorkflowDefinition[] = [];
     for (const exportedValue of Object.values(moduleExports)) {
       if (this.isWorkflowDefinition(exportedValue)) {
+        this.validatePorts(exportedValue);
         workflows.push(exportedValue);
       }
     }
     return workflows;
   }
 
+  private validatePorts(workflow: WorkflowDefinition): void {
+    const result = this.portValidator.validate(workflow);
+    if (!result.valid) {
+      const lines = result.errors.map((e) => `  - ${e.message}`).join("\n");
+      throw new Error(
+        `Workflow "${workflow.id}" ("${workflow.name}") has ${result.errors.length} invalid edge port(s):\n${lines}`,
+      );
+    }
+  }
+
   private isWorkflowDefinition(value: unknown): value is WorkflowDefinition {
     if (!value || typeof value !== "object") {
       return false;

package/src/presentation/server/WorkflowModulePathFinder.ts

@@ -42,6 +42,17 @@ export class WorkflowModulePathFinder {
 
   private isWorkflowModulePath(modulePath: string): boolean {
     const extension = path.extname(modulePath);
-    return this.workflowExtensions.has(extension) && !modulePath.endsWith(".d.ts");
+    if (!this.workflowExtensions.has(extension)) {
+      return false;
+    }
+    const basename = path.basename(modulePath);
+    if (basename.endsWith(".d.ts") || basename.endsWith(".d.mts")) {
+      return false;
+    }
+    const withoutExt = basename.slice(0, -extension.length);
+    if (withoutExt.endsWith(".test") || withoutExt.endsWith(".spec")) {
+      return false;
+    }
+    return true;
   }
 }

package/src/presentation/websocket/ManagedWebsocketAuthenticator.ts

@@ -0,0 +1,50 @@
+import { injectable } from "@codemation/core";
+import type { ManagedJwtVerifier, VerifiedManagedPrincipal } from "@codemation/managed-auth";
+import type { WebsocketAuthenticator } from "./WebsocketAuthenticator.types";
+
+/**
+ * WebSocket authenticator for `auth.kind: "managed"`.
+ *
+ * Parses `?token=<jwt>` from the WS upgrade URL and delegates to
+ * `ManagedJwtVerifier`.  Returns the verified principal on success or `null`
+ * when the token is missing, expired, has the wrong audience, or is otherwise
+ * invalid.
+ *
+ * Note: browsers cannot set `Authorization` headers on `new WebSocket(url)`,
+ * so the bearer is carried as a query-string parameter.
+ */
+@injectable()
+export class ManagedWebsocketAuthenticator implements WebsocketAuthenticator {
+  constructor(private readonly verifier: ManagedJwtVerifier) {}
+
+  async authenticate(requestUrl: string | undefined): Promise<VerifiedManagedPrincipal | null> {
+    if (!requestUrl) {
+      return null;
+    }
+
+    const token = this.extractToken(requestUrl);
+    if (!token) {
+      return null;
+    }
+
+    const result = await this.verifier.verify(token);
+    if ("failure" in result) {
+      return null;
+    }
+
+    return result;
+  }
+
+  private extractToken(requestUrl: string): string | null {
+    // requestUrl is a relative path like "/__codemation/internal/ws?token=..."
+    // Use a dummy base so URL can parse relative URLs.
+    let url: URL;
+    try {
+      url = new URL(requestUrl, "http://placeholder");
+    } catch {
+      return null;
+    }
+    const token = url.searchParams.get("token");
+    return token && token.length > 0 ? token : null;
+  }
+}

package/src/presentation/websocket/WebsocketAuthenticator.types.ts

@@ -0,0 +1,12 @@
+import type { VerifiedManagedPrincipal } from "@codemation/managed-auth";
+
+/**
+ * Authenticates an incoming WebSocket upgrade request.
+ *
+ * Implementations parse the upgrade URL (e.g. `?token=<jwt>`) and verify the
+ * credential.  Returns the verified principal on success, or `null` when the
+ * request must be rejected with close-code 4401.
+ */
+export interface WebsocketAuthenticator {
+  authenticate(requestUrl: string | undefined): Promise<VerifiedManagedPrincipal | null>;
+}

package/src/presentation/websocket/WorkflowWebsocketServer.ts

@@ -1,8 +1,10 @@
 import { WebSocket, WebSocketServer } from "ws";
+import type { IncomingMessage } from "node:http";
 import type { WorkflowWebsocketMessage } from "../../application/contracts/WorkflowWebsocketMessage";
 import type { Logger } from "../../application/logging/Logger";
 import type { WorkflowWebsocketPublisher } from "../../application/websocket/WorkflowWebsocketPublisher";
 import { ApiPaths } from "../http/ApiPaths";
+import type { WebsocketAuthenticator } from "./WebsocketAuthenticator.types";
 
 type WorkflowWebsocketClientMessage =
   | Readonly<{ kind: "subscribe"; roomId: string }>
@@ -26,8 +28,18 @@ export class WorkflowWebsocketServer implements WorkflowWebsocketPublisher {
     private readonly port: number,
     private readonly bindHost: string,
     private readonly logger: Logger,
+    private readonly authenticator: WebsocketAuthenticator | null = null,
   ) {}
 
+  /** Returns the actual port the server is listening on (useful when constructed with port 0). */
+  get listeningPort(): number {
+    const addr = this.websocketServer?.address();
+    if (!addr || typeof addr === "string") {
+      return this.port;
+    }
+    return addr.port;
+  }
+
   async start(): Promise<void> {
     if (this.started) {
       return;
@@ -38,8 +50,8 @@ export class WorkflowWebsocketServer implements WorkflowWebsocketPublisher {
       path: ApiPaths.workflowWebsocket(),
     });
     this.websocketServer = websocketServer;
-    websocketServer.on("connection", (socket) => {
-      void this.connect(socket);
+    websocketServer.on("connection", (socket, request) => {
+      void this.connect(socket, request);
     });
     try {
       await this.awaitListening(websocketServer);
@@ -98,7 +110,16 @@ export class WorkflowWebsocketServer implements WorkflowWebsocketPublisher {
     this.logger.debug(`published room=${roomId} sockets=${deliveredSocketCount} kind=${message.kind}`);
   }
 
-  private async connect(socket: WebSocket): Promise<void> {
+  private async connect(socket: WebSocket, request: IncomingMessage): Promise<void> {
+    if (this.authenticator) {
+      const principal = await this.authenticator.authenticate(request.url);
+      if (!principal) {
+        this.logger.warn("websocket auth failed: closing with 4401");
+        socket.close(4401, "unauthorized");
+        return;
+      }
+    }
+
     this.sockets.add(socket);
     this.roomIdsBySocket.set(socket, new Set());
     this.logger.debug(`client connected activeSockets=${this.sockets.size}`);

package/src/presentation/websocket/WorkflowWebsocketServerFactory.ts

@@ -0,0 +1,16 @@
+import type { AppConfig } from "../config/AppConfig";
+import { WorkflowWebsocketServer } from "./WorkflowWebsocketServer";
+import { logLevelPolicyFactory } from "../../infrastructure/logging/LogLevelPolicyFactory";
+import { ServerLoggerFactory } from "../../infrastructure/logging/ServerLoggerFactory";
+
+const loggerFactory = new ServerLoggerFactory(logLevelPolicyFactory);
+
+export class WorkflowWebsocketServerFactory {
+  create(appConfig: AppConfig): WorkflowWebsocketServer {
+    return new WorkflowWebsocketServer(
+      appConfig.webSocketPort,
+      appConfig.webSocketBindHost,
+      loggerFactory.create("codemation-websocket.server"),
+    );
+  }
+}

package/src/process/ExecaProcessRunner.ts

@@ -0,0 +1,41 @@
+import type { ChildProcess } from "node:child_process";
+import { execa, execaSync, type Options as ExecaOptions, type SyncOptions as ExecaSyncOptions } from "execa";
+
+import type { ProcessRunner, ProcessRunOptions, ProcessRunResult } from "./ProcessRunner.types";
+
+/**
+ * Production {@link ProcessRunner}. Defers cross-platform executable resolution (`pnpm` ↔ `pnpm.cmd`,
+ * `.cmd` / `.bat` / `.ps1` shims on Windows) and argument quoting to execa so call sites stop having
+ * to hand-roll platform conditionals.
+ */
+export class ExecaProcessRunner implements ProcessRunner {
+  spawn(command: string, args: ReadonlyArray<string>, options?: ProcessRunOptions): ChildProcess {
+    return execa(command, [...args], this.toExecaOptions(options)) as unknown as ChildProcess;
+  }
+
+  runSync(command: string, args: ReadonlyArray<string>, options?: ProcessRunOptions): ProcessRunResult {
+    const result = execaSync(command, [...args], this.toExecaSyncOptions(options));
+    return { exitCode: result.exitCode ?? null };
+  }
+
+  private toExecaOptions(options?: ProcessRunOptions): ExecaOptions {
+    return {
+      reject: false,
+      cwd: options?.cwd,
+      env: options?.env,
+      stdio: options?.stdio as ExecaOptions["stdio"],
+      detached: options?.detached,
+      windowsHide: options?.windowsHide,
+    };
+  }
+
+  private toExecaSyncOptions(options?: ProcessRunOptions): ExecaSyncOptions {
+    return {
+      reject: false,
+      cwd: options?.cwd,
+      env: options?.env,
+      stdio: options?.stdio as ExecaSyncOptions["stdio"],
+      windowsHide: options?.windowsHide,
+    };
+  }
+}

package/src/process/ProcessRunner.types.ts

@@ -0,0 +1,39 @@
+import type { ChildProcess } from "node:child_process";
+
+export type ProcessRunOptions = Readonly<{
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  /**
+   * Mirrors `child_process.SpawnOptions["stdio"]`. The runner forwards the value verbatim to the
+   * underlying subprocess, so callers that need fine-grained per-fd control (e.g.
+   * `["ignore", "pipe", "pipe"]`) can pass a tuple.
+   */
+  stdio?: "inherit" | "pipe" | "ignore" | ReadonlyArray<"inherit" | "pipe" | "ignore">;
+  /**
+   * On Unix this detaches the child from the parent's process group so it becomes the group
+   * leader (used by {@link DevTrackedProcessTreeKiller} to broadcast SIGTERM to descendants).
+   * On Windows it is ignored — `windowsHide` should be used to suppress console windows instead.
+   */
+  detached?: boolean;
+  windowsHide?: boolean;
+}>;
+
+export type ProcessRunResult = Readonly<{
+  exitCode: number | null;
+}>;
+
+/**
+ * Cross-platform process spawning seam. Implementations resolve bare CLI names (`pnpm`, `prisma`,
+ * `next`, …) against the OS PATH using OS-appropriate executable lookup, so call sites stop having
+ * to remember `pnpm.cmd` or `shell: true` on Windows.
+ *
+ * `spawn` returns a Node `ChildProcess` so existing helpers like `DevNextChildProcessOutputFilter`
+ * and `DevTrackedProcessTreeKiller` keep working unchanged.
+ */
+export interface ProcessRunner {
+  /** Long-lived child (dev watcher, Next dev server). Returns a `ChildProcess`. */
+  spawn(command: string, args: ReadonlyArray<string>, options?: ProcessRunOptions): ChildProcess;
+
+  /** Synchronous one-shot (used by Prisma migrate deploy). */
+  runSync(command: string, args: ReadonlyArray<string>, options?: ProcessRunOptions): ProcessRunResult;
+}

package/src/server.ts

@@ -1,5 +1,7 @@
 export { CodemationPostgresPrismaClientFactory } from "./persistenceServer";
 export type { PrismaClient } from "./persistenceServer";
+export { ExecaProcessRunner } from "./process/ExecaProcessRunner";
+export type { ProcessRunner, ProcessRunOptions, ProcessRunResult } from "./process/ProcessRunner.types";
 export { ApiPaths } from "./presentation/http/ApiPaths";
 export { CodemationServerGateway } from "./presentation/http/CodemationServerGatewayFactory";
 export { CodemationConsumerAppResolver } from "./presentation/server/CodemationConsumerAppResolver";

package/src/workflows/InternalWorkflowActivationRegistrar.ts

@@ -0,0 +1,42 @@
+import { inject, injectable } from "@codemation/core";
+import type { Hono } from "hono";
+import { ApplicationTokens } from "../applicationTokens";
+import type { CommandBus } from "../application/bus/CommandBus";
+import { SetWorkflowActivationCommand } from "../application/commands/SetWorkflowActivationCommand";
+import { InternalHmacAuthMiddleware } from "../pairing/InternalHmacAuthMiddleware";
+import type { InternalHonoApiRouteRegistrar } from "../presentation/http/hono/InternalHonoApiRouteRegistrar";
+
+/**
+ * Registers POST /internal/workflows/:workflowId/activation — HMAC-verified endpoint
+ * that activates or deactivates a workflow. Used by the coding agent to toggle workflow
+ * triggers without requiring a user session.
+ */
+@injectable()
+export class InternalWorkflowActivationRegistrar implements InternalHonoApiRouteRegistrar {
+  constructor(
+    @inject(InternalHmacAuthMiddleware) private readonly hmacMiddleware: InternalHmacAuthMiddleware,
+    @inject(ApplicationTokens.CommandBus) private readonly commandBus: CommandBus,
+  ) {}
+
+  register(app: Hono): void {
+    app.post("/internal/workflows/:workflowId/activation", this.hmacMiddleware.handle(), async (c) => {
+      const workflowId = c.req.param("workflowId");
+      let body: { active?: unknown };
+      try {
+        body = await c.req.json<{ active?: unknown }>();
+      } catch {
+        return c.json({ error: "Request body must be JSON with boolean active" }, 400);
+      }
+      if (typeof body.active !== "boolean") {
+        return c.json({ error: "Request body must include boolean active" }, 400);
+      }
+      try {
+        const result = await this.commandBus.execute(new SetWorkflowActivationCommand(workflowId, body.active));
+        return c.json(result);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+      }
+    });
+  }
+}

package/src/workflows/InternalWorkflowDetailRegistrar.ts

@@ -0,0 +1,33 @@
+import { inject, injectable } from "@codemation/core";
+import type { Hono } from "hono";
+import { ApplicationTokens } from "../applicationTokens";
+import type { QueryBus } from "../application/bus/QueryBus";
+import { GetWorkflowDetailQuery } from "../application/queries/GetWorkflowDetailQuery";
+import { WorkflowDefinitionMapper } from "../application/mapping/WorkflowDefinitionMapper";
+import { InternalHmacAuthMiddleware } from "../pairing/InternalHmacAuthMiddleware";
+import type { InternalHonoApiRouteRegistrar } from "../presentation/http/hono/InternalHonoApiRouteRegistrar";
+
+/**
+ * Registers GET /internal/workflows/:workflowId — HMAC-verified endpoint that returns a
+ * single workflow's full DAG (nodes + edges). Used by the concierge agent to inspect a
+ * specific workflow. Returns 404 (empty body) when the workflow id doesn't exist.
+ */
+@injectable()
+export class InternalWorkflowDetailRegistrar implements InternalHonoApiRouteRegistrar {
+  constructor(
+    @inject(InternalHmacAuthMiddleware) private readonly hmacMiddleware: InternalHmacAuthMiddleware,
+    @inject(ApplicationTokens.QueryBus) private readonly queryBus: QueryBus,
+    @inject(WorkflowDefinitionMapper) private readonly mapper: WorkflowDefinitionMapper,
+  ) {}
+
+  register(app: Hono): void {
+    app.get("/internal/workflows/:workflowId", this.hmacMiddleware.handle(), async (c) => {
+      const workflowId = c.req.param("workflowId");
+      const workflow = await this.queryBus.execute(new GetWorkflowDetailQuery(workflowId));
+      if (!workflow) {
+        return c.body(null, 404);
+      }
+      return c.json(await this.mapper.map(workflow));
+    });
+  }
+}

package/src/workflows/InternalWorkflowTestRunRegistrar.ts

@@ -0,0 +1,91 @@
+import { inject, injectable } from "@codemation/core";
+import { Engine } from "@codemation/core/bootstrap";
+import { RunIntentService } from "@codemation/core/bootstrap";
+import type { Hono } from "hono";
+import { ApplicationTokens } from "../applicationTokens";
+import type { WorkflowDefinitionRepository } from "../domain/workflows/WorkflowDefinitionRepository";
+import { InternalHmacAuthMiddleware } from "../pairing/InternalHmacAuthMiddleware";
+import type { InternalHonoApiRouteRegistrar } from "../presentation/http/hono/InternalHonoApiRouteRegistrar";
+
+const TEST_RUN_TIMEOUT_MS = 30_000;
+
+/**
+ * Registers POST /internal/workflows/:workflowId/test-run — HMAC-verified endpoint
+ * that runs a workflow once synchronously without requiring it to be active.
+ * Used by the coding agent to verify a workflow before activating it.
+ */
+@injectable()
+export class InternalWorkflowTestRunRegistrar implements InternalHonoApiRouteRegistrar {
+  constructor(
+    @inject(InternalHmacAuthMiddleware) private readonly hmacMiddleware: InternalHmacAuthMiddleware,
+    @inject(RunIntentService) private readonly runIntentService: RunIntentService,
+    @inject(Engine) private readonly engine: Engine,
+    @inject(ApplicationTokens.WorkflowDefinitionRepository)
+    private readonly workflowDefinitionRepository: WorkflowDefinitionRepository,
+  ) {}
+
+  register(app: Hono): void {
+    app.post("/internal/workflows/:workflowId/test-run", this.hmacMiddleware.handle(), async (c) => {
+      const workflowId = c.req.param("workflowId");
+      const startMs = Date.now();
+
+      let input: unknown;
+      try {
+        const body = await c.req.json<{ input?: unknown }>();
+        input = body.input;
+      } catch {
+        input = undefined;
+      }
+
+      const workflow = await this.workflowDefinitionRepository.getDefinition(workflowId);
+      if (!workflow) {
+        return c.json({ ok: false, error: `Unknown workflowId: ${workflowId}`, durationMs: Date.now() - startMs }, 404);
+      }
+
+      const items = input !== undefined ? [{ json: input as Record<string, unknown> }] : [{ json: {} }];
+
+      let runResult;
+      try {
+        const timeoutPromise = new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error("test run timed out after 30s")), TEST_RUN_TIMEOUT_MS),
+        );
+        const runPromise = (async () => {
+          const result = await this.runIntentService.startWorkflow({
+            workflow,
+            items,
+            executionOptions: { localOnly: true },
+          });
+          if (result.status === "completed") {
+            return result;
+          }
+          if (result.status === "failed") {
+            return result;
+          }
+          // pending — wait for completion
+          return await this.engine.waitForCompletion(result.runId);
+        })();
+        runResult = await Promise.race([runPromise, timeoutPromise]);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ ok: false, error: message, durationMs: Date.now() - startMs });
+      }
+
+      if (runResult.status === "failed") {
+        return c.json({
+          ok: false,
+          runId: runResult.runId,
+          error: runResult.error.message,
+          durationMs: Date.now() - startMs,
+        });
+      }
+
+      // completed
+      return c.json({
+        ok: true,
+        runId: runResult.runId,
+        output: runResult.outputs,
+        durationMs: Date.now() - startMs,
+      });
+    });
+  }
+}

package/src/workflows/InternalWorkflowsListRegistrar.ts

@@ -0,0 +1,28 @@
+import { inject, injectable } from "@codemation/core";
+import type { Hono } from "hono";
+import { ApplicationTokens } from "../applicationTokens";
+import type { QueryBus } from "../application/bus/QueryBus";
+import { GetWorkflowSummariesQuery } from "../application/queries/GetWorkflowSummariesQuery";
+import { WorkflowDefinitionMapper } from "../application/mapping/WorkflowDefinitionMapper";
+import { InternalHmacAuthMiddleware } from "../pairing/InternalHmacAuthMiddleware";
+import type { InternalHonoApiRouteRegistrar } from "../presentation/http/hono/InternalHonoApiRouteRegistrar";
+
+/**
+ * Registers GET /internal/workflows — HMAC-verified endpoint that returns the list of
+ * workflow summaries. Used by the concierge agent to enumerate available workflows.
+ */
+@injectable()
+export class InternalWorkflowsListRegistrar implements InternalHonoApiRouteRegistrar {
+  constructor(
+    @inject(InternalHmacAuthMiddleware) private readonly hmacMiddleware: InternalHmacAuthMiddleware,
+    @inject(ApplicationTokens.QueryBus) private readonly queryBus: QueryBus,
+    @inject(WorkflowDefinitionMapper) private readonly mapper: WorkflowDefinitionMapper,
+  ) {}
+
+  register(app: Hono): void {
+    app.get("/internal/workflows", this.hmacMiddleware.handle(), async (c) => {
+      const workflows = await this.queryBus.execute(new GetWorkflowSummariesQuery());
+      return c.json(workflows.map((w) => this.mapper.toSummary(w)));
+    });
+  }
+}

package/src/workflows/discovery/WorkflowDirectoryDiscoverer.ts

@@ -0,0 +1,79 @@
+import type { WorkflowDefinition } from "@codemation/core";
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+
+/**
+ * Callable that imports a module from an absolute path and returns its exports.
+ * Injectable for testability — production callers use a dynamic `import()`.
+ */
+export type WorkflowModuleImporter = (absolutePath: string) => Promise<Readonly<Record<string, unknown>>>;
+
+/**
+ * Walks a directory recursively, imports every `*.ts` / `*.tsx` file
+ * (excluding `*.test.*` and `*.d.ts`), and returns all exported {@link WorkflowDefinition}
+ * values, deduplicated by id.
+ */
+export class WorkflowDirectoryDiscoverer {
+  constructor(private readonly importer: WorkflowModuleImporter) {}
+
+  async discover(
+    args: Readonly<{ consumerRoot: string; workflowsDir: string }>,
+  ): Promise<ReadonlyArray<WorkflowDefinition>> {
+    const absoluteDir = path.resolve(args.consumerRoot, args.workflowsDir);
+    const filePaths = await this.collectFilePaths(absoluteDir);
+    const workflowsById = new Map<string, WorkflowDefinition>();
+    for (const filePath of filePaths) {
+      const moduleExports = await this.importer(filePath);
+      for (const exported of Object.values(moduleExports)) {
+        if (this.isWorkflowDefinition(exported)) {
+          workflowsById.set(exported.id, exported);
+        }
+      }
+    }
+    return [...workflowsById.values()];
+  }
+
+  private async collectFilePaths(absoluteDir: string): Promise<ReadonlyArray<string>> {
+    let entries;
+    try {
+      entries = await readdir(absoluteDir, { withFileTypes: true });
+    } catch {
+      return [];
+    }
+    const filePaths: string[] = [];
+    for (const entry of entries) {
+      const entryPath = path.join(absoluteDir, entry.name);
+      if (entry.isDirectory()) {
+        filePaths.push(...(await this.collectFilePaths(entryPath)));
+        continue;
+      }
+      if (this.isDiscoverableFile(entry.name)) {
+        filePaths.push(entryPath);
+      }
+    }
+    return filePaths;
+  }
+
+  private isDiscoverableFile(filename: string): boolean {
+    const ext = path.extname(filename);
+    if (ext !== ".ts" && ext !== ".tsx") {
+      return false;
+    }
+    if (filename.endsWith(".d.ts")) {
+      return false;
+    }
+    // Exclude test files: *.test.ts, *.test.tsx, *.spec.ts, *.spec.tsx, etc.
+    const withoutExt = filename.slice(0, -ext.length);
+    if (withoutExt.endsWith(".test") || withoutExt.endsWith(".spec")) {
+      return false;
+    }
+    return true;
+  }
+
+  private isWorkflowDefinition(value: unknown): value is WorkflowDefinition {
+    if (!value || typeof value !== "object") {
+      return false;
+    }
+    return "id" in value && "name" in value && "nodes" in value && "edges" in value;
+  }
+}

package/tsconfig.json

@@ -15,6 +15,7 @@
       "@codemation/core-nodes": ["../core-nodes/src/index.ts"],
       "@codemation/core-nodes-gmail": ["../core-nodes-gmail/src/index.ts"],
       "@codemation/eventbus-redis": ["../eventbus-redis/src/index.ts"],
+      "@codemation/managed-auth": ["../managed-auth/src/index.ts"],
       "@codemation/host": ["./src/index.ts"],
       "@codemation/host/authoring": ["./src/authoring.ts"],
       "@codemation/host/client": ["./src/client.ts"],
@@ -26,6 +27,7 @@
       "@codemation/host/server": ["./src/server.ts"],
       "@codemation/host/dev-server-sidecar": ["./src/devServerSidecar.ts"],
       "@codemation/host/persistence": ["./src/persistenceServer.ts"],
+      "@codemation/canvas": ["../canvas/src/index.ts"],
       "@codemation/next-host/src/*": ["../next-host/src/*"],
       "@/*": ["../next-host/src/*"]
     }

package/vitest.shared.ts

@@ -9,6 +9,11 @@ export const hostVitestSharedConfig = {
   },
   resolve: {
     alias: [
+      { find: "@codemation/canvas", replacement: path.resolve(import.meta.dirname, "../canvas/src/index.ts") },
+      {
+        find: "@codemation/core/contracts",
+        replacement: path.resolve(import.meta.dirname, "../core/src/contracts.ts"),
+      },
       { find: "@codemation/core/browser", replacement: path.resolve(import.meta.dirname, "../core/src/browser.ts") },
       { find: /^@codemation\/next-host\/src\/(.+)$/, replacement: `${nextHostSrc}/$1` },
       { find: "@codemation/host/client", replacement: path.resolve(import.meta.dirname, "./src/client.ts") },

package/dist/ApiPaths-CLTHphYZ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ApiPaths-CLTHphYZ.js","names":[],"sources":["../src/infrastructure/auth/InAppCallbackUrlPolicy.ts","../src/presentation/http/ApiPaths.ts"],"sourcesContent":["/**\n * Restricts post-login navigation targets to same-origin relative paths (no open redirects).\n */\nexport class InAppCallbackUrlPolicy {\n  private static readonly fallbackPath = \"/\";\n\n  resolveSafeRelativeCallbackUrl(raw: string | undefined | null): string {\n    if (raw === undefined || raw === null) {\n      return InAppCallbackUrlPolicy.fallbackPath;\n    }\n    if (this.containsAsciiControl(raw)) {\n      return InAppCallbackUrlPolicy.fallbackPath;\n    }\n    const trimmed = raw.trim();\n    if (trimmed.length === 0) {\n      return InAppCallbackUrlPolicy.fallbackPath;\n    }\n    if (!trimmed.startsWith(\"/\")) {\n      return InAppCallbackUrlPolicy.fallbackPath;\n    }\n    if (trimmed.startsWith(\"//\")) {\n      return InAppCallbackUrlPolicy.fallbackPath;\n    }\n    if (trimmed.includes(\"\\\\\")) {\n      return InAppCallbackUrlPolicy.fallbackPath;\n    }\n    return trimmed;\n  }\n\n  private containsAsciiControl(value: string): boolean {\n    for (let index = 0; index < value.length; index += 1) {\n      const code = value.charCodeAt(index);\n      if (code <= 0x1f || code === 0x7f) {\n        return true;\n      }\n    }\n    return false;\n  }\n}\n","export class ApiPaths {\n  private static readonly apiBasePath = \"/api\";\n\n  private static readonly workflowsBasePath = `${this.apiBasePath}/workflows`;\n\n  private static readonly runsBasePath = `${this.apiBasePath}/runs`;\n\n  private static readonly credentialsBasePath = `${this.apiBasePath}/credentials`;\n\n  private static readonly oauth2BasePath = `${this.apiBasePath}/oauth2`;\n\n  private static readonly webhooksBasePath = `${this.apiBasePath}/webhooks`;\n\n  private static readonly usersBasePath = `${this.apiBasePath}/users`;\n\n  private static readonly telemetryBasePath = `${this.apiBasePath}/telemetry`;\n\n  private static readonly whitelabelBasePath = `${this.apiBasePath}/whitelabel`;\n\n  private static readonly bootstrapBasePath = `${this.apiBasePath}/bootstrap`;\n\n  private static readonly authBasePath = `${this.apiBasePath}/auth`;\n\n  private static readonly collectionsBasePath = `${this.apiBasePath}/collections`;\n\n  static collections(): string {\n    return this.collectionsBasePath;\n  }\n\n  static collection(name: string): string {\n    return `${this.collectionsBasePath}/${encodeURIComponent(name)}`;\n  }\n\n  static collectionRows(name: string): string {\n    return `${this.collection(name)}/rows`;\n  }\n\n  static collectionRow(name: string, id: string): string {\n    return `${this.collectionRows(name)}/${encodeURIComponent(id)}`;\n  }\n\n  static syncCollections(): string {\n    return `${this.collectionsBasePath}/sync`;\n  }\n\n  static workflows(): string {\n    return this.workflowsBasePath;\n  }\n\n  static workflow(workflowId: string): string {\n    return `${this.workflowsBasePath}/${encodeURIComponent(workflowId)}`;\n  }\n\n  static workflowActivation(workflowId: string): string {\n    return `${this.workflow(workflowId)}/activation`;\n  }\n\n  static workflowRuns(workflowId: string): string {\n    return `${this.workflow(workflowId)}/runs`;\n  }\n\n  static workflowTestSuiteRuns(workflowId: string): string {\n    return `${this.workflow(workflowId)}/test-suite-runs`;\n  }\n\n  /**\n   * `GET` returns per-assertion-metric trends across the workflow's recent suite runs. With\n   * no `names` arg, every distinct assertion name is returned (so the multi-select can populate);\n   * with `names`, only the requested subset is returned (order preserved).\n   */\n  static workflowAssertionMetricTrends(workflowId: string, names?: ReadonlyArray<string>): string {\n    const base = `${this.workflow(workflowId)}/assertion-metric-trends`;\n    if (!names || names.length === 0) {\n      return base;\n    }\n    return `${base}?names=${names.map((n) => encodeURIComponent(n)).join(\",\")}`;\n  }\n\n  static testSuiteRun(testSuiteRunId: string): string {\n    return `${this.apiBasePath}/test-suite-runs/${encodeURIComponent(testSuiteRunId)}`;\n  }\n\n  static testSuiteRunAssertions(testSuiteRunId: string): string {\n    return `${this.testSuiteRun(testSuiteRunId)}/assertions`;\n  }\n\n  static testSuiteRunChildRuns(testSuiteRunId: string): string {\n    return `${this.testSuiteRun(testSuiteRunId)}/runs`;\n  }\n\n  static runAssertions(runId: string): string {\n    return `${this.runState(runId)}/assertions`;\n  }\n\n  static workflowCredentialHealth(workflowId: string): string {\n    return `${this.workflow(workflowId)}/credential-health`;\n  }\n\n  static workflowDebuggerOverlay(workflowId: string): string {\n    return `${this.workflow(workflowId)}/debugger-overlay`;\n  }\n\n  static workflowDebuggerOverlayCopyRun(workflowId: string): string {\n    return `${this.workflowDebuggerOverlay(workflowId)}/copy-run`;\n  }\n\n  static workflowDebuggerOverlayBinaryUpload(workflowId: string): string {\n    return `${this.workflowDebuggerOverlay(workflowId)}/binary/upload`;\n  }\n\n  static workflowOverlayBinaryContent(workflowId: string, binaryId: string): string {\n    return `${this.workflow(workflowId)}/debugger-overlay/binary/${encodeURIComponent(binaryId)}/content`;\n  }\n\n  static runs(): string {\n    return this.runsBasePath;\n  }\n\n  static run(): string {\n    return this.runs();\n  }\n\n  static credentialTypes(): string {\n    return `${this.credentialsBasePath}/types`;\n  }\n\n  static credentialsEnvStatus(): string {\n    return `${this.credentialsBasePath}/env-status`;\n  }\n\n  static credentialInstances(): string {\n    return `${this.credentialsBasePath}/instances`;\n  }\n\n  static credentialInstance(instanceId: string, withSecrets?: boolean): string {\n    const base = `${this.credentialInstances()}/${encodeURIComponent(instanceId)}`;\n    return withSecrets ? `${base}?withSecrets=1` : base;\n  }\n\n  static credentialInstanceTest(instanceId: string): string {\n    return `${this.credentialInstance(instanceId)}/test`;\n  }\n\n  static credentialBindings(): string {\n    return `${this.apiBasePath}/credential-bindings`;\n  }\n\n  static oauth2Auth(instanceId: string): string {\n    return `${this.oauth2BasePath}/auth?instanceId=${encodeURIComponent(instanceId)}`;\n  }\n\n  static oauth2RedirectUri(): string {\n    return `${this.oauth2BasePath}/redirect-uri`;\n  }\n\n  static oauth2Disconnect(instanceId: string): string {\n    return `${this.oauth2BasePath}/disconnect?instanceId=${encodeURIComponent(instanceId)}`;\n  }\n\n  static workflowWebsocket(): string {\n    return `${this.workflowsBasePath}/ws`;\n  }\n\n  /** Dev gateway: stable browser WebSocket for build lifecycle (CLI → gateway → browser). */\n  static devGatewaySocket(): string {\n    return `${this.apiBasePath}/dev/socket`;\n  }\n\n  /** Dev gateway: HTTP notify endpoint used by the Codemation CLI during consumer rebuilds. */\n  static devGatewayNotify(): string {\n    return `${this.apiBasePath}/dev/notify`;\n  }\n\n  static webhooks(): string {\n    return this.webhooksBasePath;\n  }\n\n  static users(): string {\n    return this.usersBasePath;\n  }\n\n  static telemetryDashboardSummary(): string {\n    return `${this.telemetryBasePath}/dashboard/summary`;\n  }\n\n  static telemetryDashboardTimeseries(): string {\n    return `${this.telemetryBasePath}/dashboard/timeseries`;\n  }\n\n  static telemetryDashboardDimensions(): string {\n    return `${this.telemetryBasePath}/dashboard/dimensions`;\n  }\n\n  static telemetryDashboardRuns(): string {\n    return `${this.telemetryBasePath}/dashboard/runs`;\n  }\n\n  static telemetryRunTrace(runId: string): string {\n    return `${this.telemetryBasePath}/runs/${runId}/trace`;\n  }\n\n  static authSession(): string {\n    return `${this.authBasePath}/session`;\n  }\n\n  static authLogin(): string {\n    return `${this.authBasePath}/login`;\n  }\n\n  static authLogout(): string {\n    return `${this.authBasePath}/logout`;\n  }\n\n  static authOAuthStart(providerId: string, callbackUrl?: string): string {\n    const base = `${this.authBasePath}/oauth/${encodeURIComponent(providerId)}/start`;\n    if (!callbackUrl) {\n      return base;\n    }\n    return `${base}?callbackUrl=${encodeURIComponent(callbackUrl)}`;\n  }\n\n  static authOAuthCallback(providerId: string): string {\n    return `${this.authBasePath}/oauth/${encodeURIComponent(providerId)}/callback`;\n  }\n\n  static userInviteVerify(): string {\n    return `${this.usersBasePath}/invites/verify`;\n  }\n\n  static userInviteAccept(): string {\n    return `${this.usersBasePath}/invites/accept`;\n  }\n\n  static userInvites(): string {\n    return `${this.usersBasePath}/invites`;\n  }\n\n  static userInviteRegenerate(userId: string): string {\n    return `${this.usersBasePath}/${encodeURIComponent(userId)}/invites/regenerate`;\n  }\n\n  static userStatus(userId: string): string {\n    return `${this.usersBasePath}/${encodeURIComponent(userId)}/status`;\n  }\n\n  static runState(runId: string): string {\n    return `${this.runsBasePath}/${encodeURIComponent(runId)}`;\n  }\n\n  static runDetail(runId: string): string {\n    return `${this.runState(runId)}/detail`;\n  }\n\n  static runWorkflowSnapshot(runId: string): string {\n    return `${this.runState(runId)}/workflow-snapshot`;\n  }\n\n  static runNodePin(runId: string, nodeId: string): string {\n    return `${this.runState(runId)}/nodes/${encodeURIComponent(nodeId)}/pin`;\n  }\n\n  static runNode(runId: string, nodeId: string): string {\n    return `${this.runState(runId)}/nodes/${encodeURIComponent(nodeId)}/run`;\n  }\n\n  static runBinaryContent(runId: string, binaryId: string): string {\n    return `${this.runState(runId)}/binary/${encodeURIComponent(binaryId)}/content`;\n  }\n\n  /** Anonymous: consumer logo from `codemation.config.ts` whitelabel.logoPath. */\n  static whitelabelLogo(): string {\n    return `${this.whitelabelBasePath}/logo`;\n  }\n\n  static frontendBootstrap(): string {\n    return `${this.bootstrapBasePath}/frontend`;\n  }\n\n  static internalAuthBootstrap(): string {\n    return `${this.bootstrapBasePath}/auth/internal`;\n  }\n}\n"],"mappings":";;;;AAGA,IAAa,yBAAb,MAAa,uBAAuB;CAClC,OAAwB,eAAe;CAEvC,+BAA+B,KAAwC;AACrE,MAAI,QAAQ,UAAa,QAAQ,KAC/B,QAAO,uBAAuB;AAEhC,MAAI,KAAK,qBAAqB,IAAI,CAChC,QAAO,uBAAuB;EAEhC,MAAM,UAAU,IAAI,MAAM;AAC1B,MAAI,QAAQ,WAAW,EACrB,QAAO,uBAAuB;AAEhC,MAAI,CAAC,QAAQ,WAAW,IAAI,CAC1B,QAAO,uBAAuB;AAEhC,MAAI,QAAQ,WAAW,KAAK,CAC1B,QAAO,uBAAuB;AAEhC,MAAI,QAAQ,SAAS,KAAK,CACxB,QAAO,uBAAuB;AAEhC,SAAO;;CAGT,AAAQ,qBAAqB,OAAwB;AACnD,OAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;GACpD,MAAM,OAAO,MAAM,WAAW,MAAM;AACpC,OAAI,QAAQ,MAAQ,SAAS,IAC3B,QAAO;;AAGX,SAAO;;;;;;ACpCX,IAAa,WAAb,MAAsB;CACpB,OAAwB,cAAc;CAEtC,OAAwB,oBAAoB,GAAG,KAAK,YAAY;CAEhE,OAAwB,eAAe,GAAG,KAAK,YAAY;CAE3D,OAAwB,sBAAsB,GAAG,KAAK,YAAY;CAElE,OAAwB,iBAAiB,GAAG,KAAK,YAAY;CAE7D,OAAwB,mBAAmB,GAAG,KAAK,YAAY;CAE/D,OAAwB,gBAAgB,GAAG,KAAK,YAAY;CAE5D,OAAwB,oBAAoB,GAAG,KAAK,YAAY;CAEhE,OAAwB,qBAAqB,GAAG,KAAK,YAAY;CAEjE,OAAwB,oBAAoB,GAAG,KAAK,YAAY;CAEhE,OAAwB,eAAe,GAAG,KAAK,YAAY;CAE3D,OAAwB,sBAAsB,GAAG,KAAK,YAAY;CAElE,OAAO,cAAsB;AAC3B,SAAO,KAAK;;CAGd,OAAO,WAAW,MAAsB;AACtC,SAAO,GAAG,KAAK,oBAAoB,GAAG,mBAAmB,KAAK;;CAGhE,OAAO,eAAe,MAAsB;AAC1C,SAAO,GAAG,KAAK,WAAW,KAAK,CAAC;;CAGlC,OAAO,cAAc,MAAc,IAAoB;AACrD,SAAO,GAAG,KAAK,eAAe,KAAK,CAAC,GAAG,mBAAmB,GAAG;;CAG/D,OAAO,kBAA0B;AAC/B,SAAO,GAAG,KAAK,oBAAoB;;CAGrC,OAAO,YAAoB;AACzB,SAAO,KAAK;;CAGd,OAAO,SAAS,YAA4B;AAC1C,SAAO,GAAG,KAAK,kBAAkB,GAAG,mBAAmB,WAAW;;CAGpE,OAAO,mBAAmB,YAA4B;AACpD,SAAO,GAAG,KAAK,SAAS,WAAW,CAAC;;CAGtC,OAAO,aAAa,YAA4B;AAC9C,SAAO,GAAG,KAAK,SAAS,WAAW,CAAC;;CAGtC,OAAO,sBAAsB,YAA4B;AACvD,SAAO,GAAG,KAAK,SAAS,WAAW,CAAC;;;;;;;CAQtC,OAAO,8BAA8B,YAAoB,OAAuC;EAC9F,MAAM,OAAO,GAAG,KAAK,SAAS,WAAW,CAAC;AAC1C,MAAI,CAAC,SAAS,MAAM,WAAW,EAC7B,QAAO;AAET,SAAO,GAAG,KAAK,SAAS,MAAM,KAAK,MAAM,mBAAmB,EAAE,CAAC,CAAC,KAAK,IAAI;;CAG3E,OAAO,aAAa,gBAAgC;AAClD,SAAO,GAAG,KAAK,YAAY,mBAAmB,mBAAmB,eAAe;;CAGlF,OAAO,uBAAuB,gBAAgC;AAC5D,SAAO,GAAG,KAAK,aAAa,eAAe,CAAC;;CAG9C,OAAO,sBAAsB,gBAAgC;AAC3D,SAAO,GAAG,KAAK,aAAa,eAAe,CAAC;;CAG9C,OAAO,cAAc,OAAuB;AAC1C,SAAO,GAAG,KAAK,SAAS,MAAM,CAAC;;CAGjC,OAAO,yBAAyB,YAA4B;AAC1D,SAAO,GAAG,KAAK,SAAS,WAAW,CAAC;;CAGtC,OAAO,wBAAwB,YAA4B;AACzD,SAAO,GAAG,KAAK,SAAS,WAAW,CAAC;;CAGtC,OAAO,+BAA+B,YAA4B;AAChE,SAAO,GAAG,KAAK,wBAAwB,WAAW,CAAC;;CAGrD,OAAO,oCAAoC,YAA4B;AACrE,SAAO,GAAG,KAAK,wBAAwB,WAAW,CAAC;;CAGrD,OAAO,6BAA6B,YAAoB,UAA0B;AAChF,SAAO,GAAG,KAAK,SAAS,WAAW,CAAC,2BAA2B,mBAAmB,SAAS,CAAC;;CAG9F,OAAO,OAAe;AACpB,SAAO,KAAK;;CAGd,OAAO,MAAc;AACnB,SAAO,KAAK,MAAM;;CAGpB,OAAO,kBAA0B;AAC/B,SAAO,GAAG,KAAK,oBAAoB;;CAGrC,OAAO,uBAA+B;AACpC,SAAO,GAAG,KAAK,oBAAoB;;CAGrC,OAAO,sBAA8B;AACnC,SAAO,GAAG,KAAK,oBAAoB;;CAGrC,OAAO,mBAAmB,YAAoB,aAA+B;EAC3E,MAAM,OAAO,GAAG,KAAK,qBAAqB,CAAC,GAAG,mBAAmB,WAAW;AAC5E,SAAO,cAAc,GAAG,KAAK,kBAAkB;;CAGjD,OAAO,uBAAuB,YAA4B;AACxD,SAAO,GAAG,KAAK,mBAAmB,WAAW,CAAC;;CAGhD,OAAO,qBAA6B;AAClC,SAAO,GAAG,KAAK,YAAY;;CAG7B,OAAO,WAAW,YAA4B;AAC5C,SAAO,GAAG,KAAK,eAAe,mBAAmB,mBAAmB,WAAW;;CAGjF,OAAO,oBAA4B;AACjC,SAAO,GAAG,KAAK,eAAe;;CAGhC,OAAO,iBAAiB,YAA4B;AAClD,SAAO,GAAG,KAAK,eAAe,yBAAyB,mBAAmB,WAAW;;CAGvF,OAAO,oBAA4B;AACjC,SAAO,GAAG,KAAK,kBAAkB;;;CAInC,OAAO,mBAA2B;AAChC,SAAO,GAAG,KAAK,YAAY;;;CAI7B,OAAO,mBAA2B;AAChC,SAAO,GAAG,KAAK,YAAY;;CAG7B,OAAO,WAAmB;AACxB,SAAO,KAAK;;CAGd,OAAO,QAAgB;AACrB,SAAO,KAAK;;CAGd,OAAO,4BAAoC;AACzC,SAAO,GAAG,KAAK,kBAAkB;;CAGnC,OAAO,+BAAuC;AAC5C,SAAO,GAAG,KAAK,kBAAkB;;CAGnC,OAAO,+BAAuC;AAC5C,SAAO,GAAG,KAAK,kBAAkB;;CAGnC,OAAO,yBAAiC;AACtC,SAAO,GAAG,KAAK,kBAAkB;;CAGnC,OAAO,kBAAkB,OAAuB;AAC9C,SAAO,GAAG,KAAK,kBAAkB,QAAQ,MAAM;;CAGjD,OAAO,cAAsB;AAC3B,SAAO,GAAG,KAAK,aAAa;;CAG9B,OAAO,YAAoB;AACzB,SAAO,GAAG,KAAK,aAAa;;CAG9B,OAAO,aAAqB;AAC1B,SAAO,GAAG,KAAK,aAAa;;CAG9B,OAAO,eAAe,YAAoB,aAA8B;EACtE,MAAM,OAAO,GAAG,KAAK,aAAa,SAAS,mBAAmB,WAAW,CAAC;AAC1E,MAAI,CAAC,YACH,QAAO;AAET,SAAO,GAAG,KAAK,eAAe,mBAAmB,YAAY;;CAG/D,OAAO,kBAAkB,YAA4B;AACnD,SAAO,GAAG,KAAK,aAAa,SAAS,mBAAmB,WAAW,CAAC;;CAGtE,OAAO,mBAA2B;AAChC,SAAO,GAAG,KAAK,cAAc;;CAG/B,OAAO,mBAA2B;AAChC,SAAO,GAAG,KAAK,cAAc;;CAG/B,OAAO,cAAsB;AAC3B,SAAO,GAAG,KAAK,cAAc;;CAG/B,OAAO,qBAAqB,QAAwB;AAClD,SAAO,GAAG,KAAK,cAAc,GAAG,mBAAmB,OAAO,CAAC;;CAG7D,OAAO,WAAW,QAAwB;AACxC,SAAO,GAAG,KAAK,cAAc,GAAG,mBAAmB,OAAO,CAAC;;CAG7D,OAAO,SAAS,OAAuB;AACrC,SAAO,GAAG,KAAK,aAAa,GAAG,mBAAmB,MAAM;;CAG1D,OAAO,UAAU,OAAuB;AACtC,SAAO,GAAG,KAAK,SAAS,MAAM,CAAC;;CAGjC,OAAO,oBAAoB,OAAuB;AAChD,SAAO,GAAG,KAAK,SAAS,MAAM,CAAC;;CAGjC,OAAO,WAAW,OAAe,QAAwB;AACvD,SAAO,GAAG,KAAK,SAAS,MAAM,CAAC,SAAS,mBAAmB,OAAO,CAAC;;CAGrE,OAAO,QAAQ,OAAe,QAAwB;AACpD,SAAO,GAAG,KAAK,SAAS,MAAM,CAAC,SAAS,mBAAmB,OAAO,CAAC;;CAGrE,OAAO,iBAAiB,OAAe,UAA0B;AAC/D,SAAO,GAAG,KAAK,SAAS,MAAM,CAAC,UAAU,mBAAmB,SAAS,CAAC;;;CAIxE,OAAO,iBAAyB;AAC9B,SAAO,GAAG,KAAK,mBAAmB;;CAGpC,OAAO,oBAA4B;AACjC,SAAO,GAAG,KAAK,kBAAkB;;CAGnC,OAAO,wBAAgC;AACrC,SAAO,GAAG,KAAK,kBAAkB"}