@codemation/host 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @codemation/host
 
+## 0.8.0
+
+### Minor Changes
+
+- [#150](https://github.com/MadeRelevant/codemation/pull/150) [`8ac207a`](https://github.com/MadeRelevant/codemation/commit/8ac207ab263542e46fad0b9e1ea584fbb71a747c) Thanks [@cblokland90](https://github.com/cblokland90)! - Add workspace-host Docker image packaging and managed template peerDeps fix.
+  - Move @codemation/\* from dependencies to peerDependencies in the managed template (avoids n8n-style dual-instance singleton trap at runtime; framework packages resolve from the base image)
+  - Add codemationVersion: "1.0.0" field to managed template codemation.config.ts and DefineCodemationAppOptions (reserved compatibility-date slot, no enforcement yet)
+  - Add packages/host/src/bin/server.ts standalone entry point for workspace pod runtime
+  - Add packaging/workspace-host/Dockerfile for the codemation-workspace-host:1.0.0 base image
+
+### Patch Changes
+
+- [#153](https://github.com/MadeRelevant/codemation/pull/153) [`a70e182`](https://github.com/MadeRelevant/codemation/commit/a70e182a852026e4f6d8f317fe9862417dc23ce6) Thanks [@cblokland90](https://github.com/cblokland90)! - Move UI-only packages (monaco-editor, react, @xyflow/react, dagre, lucide-react, rc-tree, etc.) from `dependencies` to `devDependencies` in @codemation/host. No runtime source in `packages/host/src` imports these packages — they were vestigial from before the UI was extracted to @codemation/next-host. Moving them ensures pnpm filtered installs (e.g. `--filter @codemation/host...`) no longer pull in ~1.5 GB of UI dependencies, which is required for the workspace-host container image to stay small.
+
+- [#156](https://github.com/MadeRelevant/codemation/pull/156) [`5315e23`](https://github.com/MadeRelevant/codemation/commit/5315e2361492560601ac2c97491aa58c49346fd4) Thanks [@cblokland90](https://github.com/cblokland90)! - fix(host): only throw on invalid WORKSPACE_PAIRING_SECRET in managed mode
+
+  Previously, setting WORKSPACE_PAIRING_SECRET to an invalid value (not a 32-byte base64 string) would crash the host at boot time even when running in non-managed mode (the default). Framework consumers who accidentally set this env var or left a misconfigured value would see an opaque boot error unrelated to their actual configuration.
+
+  After this fix, the invalid-secret error is only propagated in `auth.kind: "managed"` mode. In all other modes, the error is caught, a warning is logged, and the host boots normally without pairing infrastructure wired up. Managed-mode consumers continue to see the full error at startup.
+
+- [#152](https://github.com/MadeRelevant/codemation/pull/152) [`ac860a5`](https://github.com/MadeRelevant/codemation/commit/ac860a5af1df3e5766581e644fef8cc0d1b24eba) Thanks [@cblokland90](https://github.com/cblokland90)! - Fix ControlPlaneCatalogFetcher calling wrong URL path (sprint-mvp/01).
+
+  The fetcher was calling `/api/catalog/*` (session-gated in the CP) instead of
+  `/internal/catalog/*` (HMAC-gated). The CP's `/api/*` router returned 401 for
+  every HMAC-signed request because it requires a Better Auth session cookie, not a
+  workspace pairing signature.
+
+  This caused every provisioned workspace to log steady `HTTP 401 Unauthorized`
+  errors from `ControlPlaneCatalogFetcher`, blocking OAuth credential-type and MCP
+  server catalog fetches.
+
+- [#157](https://github.com/MadeRelevant/codemation/pull/157) [`3025b86`](https://github.com/MadeRelevant/codemation/commit/3025b8685b0d7ad60c506b5a0f21967e681a25ea) Thanks [@cblokland90](https://github.com/cblokland90)! - Shrink workspace-host Docker image by decoupling CLI from next-host at runtime.
+
+  `@codemation/cli`: demote `@codemation/next-host` from `dependencies` to `devDependencies`. The CLI's
+  non-headless serve path resolves the next-host package at runtime via `require.resolve()`; the
+  headless path (used by workspace-host pods) never touches it. Consumers that install `@codemation/cli`
+  from the registry and need the UI shell must add `@codemation/next-host` as a direct dependency.
+
+  `@codemation/core-nodes`: demote `lucide-react` from `dependencies` to `devDependencies`. The package
+  only references lucide icon names as strings (e.g. `"lucide:bot"`); it never imports the react library
+  at runtime. This removes ~46 MB from runtime installs of `@codemation/core-nodes`.
+
+  `@codemation/host`: promote `execa` and `dotenv` from `devDependencies` to `dependencies`. Both are
+  required at Dockerfile build time by `scripts/generate-prisma-clients.mjs` (imports `execaSync` from
+  `execa`) and `prisma.config.ts` (imports `dotenv/config`). These files run during `prisma:generate`
+  which executes in the production builder stage with `--prod` install (no devDeps available).
+
+- Updated dependencies [[`e0933eb`](https://github.com/MadeRelevant/codemation/commit/e0933ebc51806a9593f94758860c591b8346a7a5), [`3025b86`](https://github.com/MadeRelevant/codemation/commit/3025b8685b0d7ad60c506b5a0f21967e681a25ea)]:
+  - @codemation/core@0.11.1
+  - @codemation/core-nodes@0.8.1
+  - @codemation/eventbus-redis@0.0.39
+
 ## 0.7.0
 
 ### Minor Changes

package/LICENSE

@@ -1 +1,37 @@
-../../LICENSE
+Codemation Pre-Stable License
+
+Copyright (c) Made Relevant B.V. All rights reserved.
+
+1. Definitions
+
+   "Software" means the Codemation source code, documentation, and artifacts in this repository and any published npm packages in the Codemation monorepo.
+
+   "Stable Version" means the first published release of the package `@codemation/core` on the public npm registry with version 1.0.0 or higher.
+
+2. Permitted use (before Stable Version)
+
+   Until a Stable Version exists, you may use, copy, modify, and distribute the Software only for non-commercial purposes, including personal learning, research, evaluation, and internal use within your organization that does not charge third parties for access to the Software or a product or service whose primary value is the Software.
+
+3. Restrictions (before Stable Version)
+
+   Until a Stable Version exists, you must not:
+
+   a) Sell, rent, lease, or sublicense the Software or a derivative work for a fee;
+
+   b) Offer the Software or a derivative work as part of a paid product or service (including hosting, support, or consulting) where the Software is a material part of the offering;
+
+   c) Use the Software or a derivative work primarily to generate revenue or commercial advantage for you or others.
+
+   These restrictions apply to all versions published before a Stable Version, even if a later Stable Version is released under different terms.
+
+4. After Stable Version
+
+   The maintainers may publish a Stable Version under different license terms. If they do, those terms apply only to that Stable Version and subsequent releases they designate; they do not automatically apply to earlier pre-stable versions.
+
+5. No warranty
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+6. Third-party components
+
+   The Software may include third-party components under their own licenses. Those licenses govern those components.

package/dist/{AppConfigFactory-DnLoQ9Li.d.ts → AppConfigFactory-BT0y0LVC.d.ts}

@@ -1,5 +1,5 @@
-import { i as AppPersistenceConfig, r as AppConfig } from "./CodemationAppContext-CKVv9W9q.js";
-import { t as NormalizedCodemationConfig } from "./CodemationConfigNormalizer-BAKjetJ6.js";
+import { i as AppPersistenceConfig, r as AppConfig } from "./CodemationAppContext-CGFYVcSb.js";
+import { t as NormalizedCodemationConfig } from "./CodemationConfigNormalizer-48f-T66P.js";
 import { AnyNull, AnyNullClass, DbNull, DbNullClass, Decimal, JsonNull, JsonNullClass, NullTypes as NullTypes$1, ObjectEnumValue, PrismaClientInitializationError, PrismaClientKnownRequestError, PrismaClientRustPanicError, PrismaClientUnknownRequestError, PrismaClientValidationError, RawValue, Sql, Value, empty, isAnyNull, isDbNull, isJsonNull, isObjectEnumValue, join, raw, sql as sqltag } from "@prisma/client-runtime-utils";
 
 //#region prisma-generated/prisma-postgresql-client/runtime/client.d.ts
@@ -42408,4 +42408,4 @@ declare class AppConfigFactory {
 }
 //#endregion
 export { PrismaClient as i, PrismaMigrationDeployer as n, PrismaDatabaseClient as r, AppConfigFactory as t };
-//# sourceMappingURL=AppConfigFactory-DnLoQ9Li.d.ts.map
+//# sourceMappingURL=AppConfigFactory-BT0y0LVC.d.ts.map

package/dist/{AppContainerFactory-DqKYCRNP.js → AppContainerFactory-DRTjG7nG.js}

@@ -22570,9 +22570,9 @@ let ControlPlaneCatalogFetcher = class ControlPlaneCatalogFetcher$1 {
 		const logger = this.loggers.create("ControlPlaneCatalogFetcher");
 		const base = this.pairingConfig.controlPlaneUrl;
 		const [oauthResult, mcpResult, credTypesResult] = await Promise.allSettled([
-			this.pairedFetch.get(`${base}/api/catalog/oauth-apps`),
-			this.pairedFetch.get(`${base}/api/catalog/mcp-servers`),
-			this.pairedFetch.get(`${base}/api/catalog/credential-types`)
+			this.pairedFetch.get(`${base}/internal/catalog/oauth-apps`),
+			this.pairedFetch.get(`${base}/internal/catalog/mcp-servers`),
+			this.pairedFetch.get(`${base}/internal/catalog/credential-types`)
 		]);
 		await this.handleEndpointResult(oauthResult, this.oauthAppsState, "oauth-apps", (data) => {
 			this._oauthApps = data;
@@ -25745,7 +25745,15 @@ var AppContainerFactory = class AppContainerFactory {
 		container$1.registerSingleton(ApplicationTokens.HonoApiRouteRegistrar, ManagedMeHonoApiRouteRegistrar);
 	}
 	registerPairingInfrastructure(container$1, appConfig) {
-		const pairingConfig = new PairingConfigFactory().create(appConfig.env);
+		const isManagedMode = appConfig.auth?.kind === "managed";
+		let pairingConfig;
+		try {
+			pairingConfig = new PairingConfigFactory().create(appConfig.env);
+		} catch (err) {
+			if (isManagedMode) throw err;
+			container$1.resolve(ServerLoggerFactory).create("codemation.pairing").warn(`WORKSPACE_PAIRING_SECRET is set but invalid — pairing disabled. ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
 		if (!pairingConfig) {
 			const missingVars = [];
 			if (!appConfig.env["WORKSPACE_ID"]) missingVars.push("WORKSPACE_ID");
@@ -25922,4 +25930,4 @@ var AppContainerFactory = class AppContainerFactory {
 
 //#endregion
 export { WorkflowDefinitionMapper as A, CodemationHonoApiApp as C, FrontendAppConfigFactory as D, InternalAuthBootstrapFactory as E, StartWorkflowRunCommand as F, UpsertLocalBootstrapUserCommand as I, ListUserAccountsQuery as L, GetWorkflowDetailQuery as M, GetRunStateQuery as N, CodemationFrontendAuthSnapshotFactory as O, RunBinaryAttachmentLookupService as P, CredentialHttpRouteHandler as S, PublicFrontendBootstrapFactory as T, WorkflowHttpRouteHandler as _, GetCollectionQuery as a, RunHttpRouteHandler as b, InsertCollectionRowCommand as c, FrontendRuntime as d, CollectionSchemaSyncerHolder as f, ExecaProcessRunner as g, WorkflowRunRetentionPruneScheduler as h, GetCollectionRowQuery as i, GetWorkflowSummariesQuery as j, WorkflowWebsocketServer as k, DeleteCollectionRowCommand as l, AppContainerLifecycle as m, ListCollectionsQuery as n, UpdateCollectionRowCommand as o, DatabaseMigrations as p, ListCollectionRowsQuery as r, SyncCollectionsCommand as s, AppContainerFactory as t, WorkerRuntime as u, WebhookHttpRouteHandler as v, BinaryHttpRouteHandler as w, OAuth2HttpRouteHandler as x, RequestToWebhookItemMapper as y };
-//# sourceMappingURL=AppContainerFactory-DqKYCRNP.js.map
+//# sourceMappingURL=AppContainerFactory-DRTjG7nG.js.map