@codemation/host 0.8.0 → 0.9.0

package/dist/{server-vtRCPgRJ.js.map → server-BlG9qV5S.js.map}

@@ -1 +1 @@
-{"version":3,"file":"server-vtRCPgRJ.js","names":["config: CodemationConfig","consumerRoot: string","configSource?: string","workflowSources: ReadonlyArray<string>","env?: Readonly<NodeJS.ProcessEnv>","consumerConfigLoader: CodemationConsumerConfigLoader","appConfigFactory: AppConfigFactory","discoveredPackages: CodemationDiscoveredPluginPackage[]","resolvedPackages: CodemationResolvedPluginPackage[]","packageRoots: string[]"],"sources":["../src/presentation/http/CodemationServerGatewayFactory.ts","../src/presentation/server/AppConfigLoader.ts","../src/presentation/server/CodemationPluginDiscovery.ts"],"sourcesContent":["import { accessSync } from \"node:fs\";\nimport path from \"node:path\";\nimport type { QueryBus } from \"../../application/bus/QueryBus\";\nimport type { WorkflowDto, WorkflowSummary } from \"../../application/contracts/WorkflowViewContracts\";\nimport { WorkflowDefinitionMapper } from \"../../application/mapping/WorkflowDefinitionMapper\";\nimport { GetWorkflowDetailQuery } from \"../../application/queries/GetWorkflowDetailQuery\";\nimport { GetWorkflowSummariesQuery } from \"../../application/queries/GetWorkflowSummariesQuery\";\nimport { ApplicationTokens } from \"../../applicationTokens\";\nimport { AppContainerFactory } from \"../../bootstrap/AppContainerFactory\";\nimport { AppContainerLifecycle } from \"../../bootstrap/AppContainerLifecycle\";\nimport { FrontendRuntime } from \"../../bootstrap/runtime/FrontendRuntime\";\nimport { AppConfigFactory } from \"../../bootstrap/runtime/AppConfigFactory\";\nimport type { CodemationConfig } from \"../config/CodemationConfig\";\nimport { CodemationConfigNormalizer } from \"../config/CodemationConfigNormalizer\";\nimport { CodemationHonoApiApp } from \"./hono/CodemationHonoApiAppFactory\";\n\ntype ServerGatewayContext = Readonly<{\n  container: import(\"@codemation/core\").Container;\n  httpApi: CodemationHonoApiApp;\n  queryBus: QueryBus;\n  workflowDefinitionMapper: WorkflowDefinitionMapper;\n}>;\n\nexport class CodemationServerGateway {\n  private static readonly contextsByConfig = new WeakMap<object, Promise<ServerGatewayContext>>();\n\n  constructor(\n    private readonly config: CodemationConfig,\n    private readonly consumerRoot: string,\n    private readonly configSource?: string,\n    private readonly workflowSources: ReadonlyArray<string> = [],\n    private readonly env?: Readonly<NodeJS.ProcessEnv>,\n  ) {}\n\n  async dispatch(request: Request): Promise<Response> {\n    return await (await this.getContext()).httpApi.fetch(request);\n  }\n\n  async prepare(): Promise<void> {\n    await this.getContext();\n  }\n\n  async close(): Promise<void> {\n    const cachedContext = CodemationServerGateway.contextsByConfig.get(this.config as object);\n    if (!cachedContext) {\n      return;\n    }\n    CodemationServerGateway.contextsByConfig.delete(this.config as object);\n    await (await cachedContext).container.resolve(AppContainerLifecycle).stop();\n  }\n\n  async loadWorkflowSummaries(): Promise<ReadonlyArray<WorkflowSummary>> {\n    const context = await this.getContext();\n    const workflows = await context.queryBus.execute(new GetWorkflowSummariesQuery());\n    return workflows.map((workflow) => context.workflowDefinitionMapper.toSummary(workflow));\n  }\n\n  async loadWorkflowDetail(workflowId: string): Promise<WorkflowDto> {\n    const context = await this.getContext();\n    const workflow = await context.queryBus.execute(new GetWorkflowDetailQuery(workflowId));\n    if (!workflow) {\n      throw new Error(`Unknown workflowId: ${workflowId}`);\n    }\n    return await context.workflowDefinitionMapper.map(workflow);\n  }\n\n  private getContext(): Promise<ServerGatewayContext> {\n    const cachedContext = CodemationServerGateway.contextsByConfig.get(this.config as object);\n    if (cachedContext) {\n      return cachedContext;\n    }\n    const nextContext = this.createContext();\n    CodemationServerGateway.contextsByConfig.set(this.config as object, nextContext);\n    return nextContext;\n  }\n\n  private async createContext(): Promise<ServerGatewayContext> {\n    const repoRoot = this.detectWorkspaceRoot(this.consumerRoot);\n    // This gateway is the config/env boundary that materializes AppConfig from raw inputs.\n    // eslint-disable-next-line no-restricted-properties\n    const env = this.env ?? process.env;\n    const appConfig = new AppConfigFactory().create({\n      repoRoot,\n      consumerRoot: this.consumerRoot,\n      env,\n      config: new CodemationConfigNormalizer().normalize(this.config),\n      workflowSources: this.resolveWorkflowSources(),\n    });\n    const container = await new AppContainerFactory().create({\n      appConfig,\n      sharedWorkflowWebsocketServer: null,\n    });\n    await container.resolve(FrontendRuntime).start();\n    return {\n      container,\n      httpApi: container.resolve(CodemationHonoApiApp),\n      queryBus: container.resolve(ApplicationTokens.QueryBus),\n      workflowDefinitionMapper: container.resolve(WorkflowDefinitionMapper),\n    };\n  }\n\n  private resolveWorkflowSources(): ReadonlyArray<string> {\n    if (this.workflowSources.length > 0) {\n      return [...this.workflowSources];\n    }\n    if (!this.configSource || !this.config.workflows || this.config.workflows.length === 0) {\n      return [];\n    }\n    return [this.configSource];\n  }\n  private detectWorkspaceRoot(startDirectory: string): string {\n    let currentDirectory = path.resolve(startDirectory);\n    while (true) {\n      try {\n        accessSync(path.resolve(currentDirectory, \"pnpm-workspace.yaml\"));\n        return currentDirectory;\n      } catch {\n        const parentDirectory = path.dirname(currentDirectory);\n        if (parentDirectory === currentDirectory) {\n          return startDirectory;\n        }\n        currentDirectory = parentDirectory;\n      }\n    }\n  }\n}\n","import type { AppConfig } from \"../config/AppConfig\";\nimport { CodemationConsumerConfigLoader } from \"./CodemationConsumerConfigLoader\";\nimport { AppConfigFactory } from \"../../bootstrap/runtime/AppConfigFactory\";\n\nexport type AppConfigLoadResult = Readonly<{\n  appConfig: AppConfig;\n  bootstrapSource: string | null;\n}>;\n\nexport class AppConfigLoader {\n  constructor(\n    private readonly consumerConfigLoader: CodemationConsumerConfigLoader = new CodemationConsumerConfigLoader(),\n    private readonly appConfigFactory: AppConfigFactory = new AppConfigFactory(),\n  ) {}\n\n  async load(\n    args: Readonly<{\n      consumerRoot: string;\n      repoRoot: string;\n      env: NodeJS.ProcessEnv;\n      configPathOverride?: string;\n    }>,\n  ): Promise<AppConfigLoadResult> {\n    const resolution = await this.consumerConfigLoader.load({\n      consumerRoot: args.consumerRoot,\n      configPathOverride: args.configPathOverride,\n    });\n    return {\n      appConfig: this.appConfigFactory.create({\n        repoRoot: args.repoRoot,\n        consumerRoot: args.consumerRoot,\n        env: args.env,\n        config: resolution.config,\n        workflowSources: resolution.workflowSources,\n      }),\n      bootstrapSource: resolution.bootstrapSource,\n    };\n  }\n}\n","import type { CodemationPackageManifest } from \"../config/CodemationPackageManifest\";\nimport { CodemationPluginPackageMetadata, type CodemationPlugin } from \"../config/CodemationPlugin\";\nimport { readFile, readdir } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nexport type CodemationDiscoveredPluginPackage = Readonly<{\n  packageName: string;\n  packageRoot: string;\n  pluginEntry: string;\n  developmentEntry?: string;\n}>;\n\nexport type CodemationResolvedPluginPackage = Readonly<\n  CodemationDiscoveredPluginPackage & {\n    plugin: CodemationPlugin;\n  }\n>;\n\ntype PackageJsonShape = Readonly<{\n  codemation?: CodemationPackageManifest;\n  name?: string;\n  exports?: Readonly<Record<string, unknown>>;\n}>;\n\nexport class CodemationPluginDiscovery {\n  private readonly pluginPackageMetadata = new CodemationPluginPackageMetadata();\n\n  async discover(consumerRoot: string): Promise<ReadonlyArray<CodemationDiscoveredPluginPackage>> {\n    const nodeModulesRoot = path.resolve(consumerRoot, \"node_modules\");\n    const packageRoots = await this.collectPackageRoots(nodeModulesRoot);\n    const discoveredPackages: CodemationDiscoveredPluginPackage[] = [];\n    for (const packageRoot of packageRoots) {\n      const packageJson = await this.readPackageJson(path.resolve(packageRoot, \"package.json\"));\n      const pluginManifest = packageJson.codemation?.plugin;\n      if (!packageJson.name || typeof pluginManifest !== \"string\" || pluginManifest.trim().length === 0) {\n        continue;\n      }\n      discoveredPackages.push({\n        packageName: packageJson.name,\n        packageRoot,\n        pluginEntry: pluginManifest,\n        developmentEntry: await this.resolveDevelopmentPluginEntry(packageRoot),\n      });\n    }\n    return discoveredPackages.sort((left, right) => left.packageName.localeCompare(right.packageName));\n  }\n\n  async resolvePlugins(consumerRoot: string): Promise<ReadonlyArray<CodemationResolvedPluginPackage>> {\n    const discoveredPackages = await this.discover(consumerRoot);\n    return await this.resolveDiscoveredPackages(discoveredPackages);\n  }\n\n  async resolveDiscoveredPackages(\n    discoveredPackages: ReadonlyArray<CodemationDiscoveredPluginPackage>,\n  ): Promise<ReadonlyArray<CodemationResolvedPluginPackage>> {\n    const resolvedPackages: CodemationResolvedPluginPackage[] = [];\n    for (const discoveredPackage of discoveredPackages) {\n      resolvedPackages.push({\n        ...discoveredPackage,\n        plugin: await this.loadPlugin(discoveredPackage),\n      });\n    }\n    return resolvedPackages;\n  }\n\n  private async collectPackageRoots(nodeModulesRoot: string): Promise<ReadonlyArray<string>> {\n    try {\n      const entries = await readdir(nodeModulesRoot, { withFileTypes: true });\n      const packageRoots: string[] = [];\n      for (const entry of entries) {\n        if (!entry.isDirectory() && !entry.isSymbolicLink()) {\n          continue;\n        }\n        if (entry.name.startsWith(\"@\")) {\n          const scopedEntries = await readdir(path.resolve(nodeModulesRoot, entry.name), { withFileTypes: true });\n          for (const scopedEntry of scopedEntries) {\n            if (scopedEntry.isDirectory() || scopedEntry.isSymbolicLink()) {\n              packageRoots.push(path.resolve(nodeModulesRoot, entry.name, scopedEntry.name));\n            }\n          }\n          continue;\n        }\n        packageRoots.push(path.resolve(nodeModulesRoot, entry.name));\n      }\n      return packageRoots;\n    } catch {\n      return [];\n    }\n  }\n\n  private async readPackageJson(packageJsonPath: string): Promise<PackageJsonShape> {\n    try {\n      const rawPackageJson = await readFile(packageJsonPath, \"utf8\");\n      return JSON.parse(rawPackageJson) as PackageJsonShape;\n    } catch {\n      return {};\n    }\n  }\n\n  private async loadPlugin(discoveredPackage: CodemationDiscoveredPluginPackage): Promise<CodemationPlugin> {\n    const pluginModulePath = path.resolve(discoveredPackage.packageRoot, this.resolvePluginEntry(discoveredPackage));\n    const importedModule = (await import(\n      /* webpackIgnore: true */ this.resolvePluginModuleSpecifier(pluginModulePath)\n    )) as Record<string, unknown>;\n    const exportedValue = importedModule.default;\n    const plugin = this.resolvePluginValue(exportedValue);\n    if (!plugin) {\n      throw new Error(`Plugin package \"${discoveredPackage.packageName}\" did not default-export a Codemation plugin.`);\n    }\n    return this.pluginPackageMetadata.attachPackageName(plugin, discoveredPackage.packageName);\n  }\n\n  private resolvePluginValue(value: unknown): CodemationPlugin | null {\n    if (this.isPluginConfig(value)) {\n      return value;\n    }\n    return null;\n  }\n\n  private isPluginConfig(value: unknown): value is CodemationPlugin {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n      return false;\n    }\n    const pluginValue = value as {\n      credentialTypes?: unknown;\n      mcpServers?: unknown;\n      register?: unknown;\n      sandbox?: unknown;\n    };\n    if (pluginValue.register !== undefined && typeof pluginValue.register !== \"function\") {\n      return false;\n    }\n    if (pluginValue.credentialTypes !== undefined && !Array.isArray(pluginValue.credentialTypes)) {\n      return false;\n    }\n    if (pluginValue.mcpServers !== undefined && !Array.isArray(pluginValue.mcpServers)) {\n      return false;\n    }\n    return (\n      pluginValue.register !== undefined ||\n      pluginValue.credentialTypes !== undefined ||\n      pluginValue.mcpServers !== undefined ||\n      pluginValue.sandbox !== undefined ||\n      Object.keys(pluginValue).length === 0\n    );\n  }\n\n  private resolvePluginEntry(discoveredPackage: CodemationDiscoveredPluginPackage): string {\n    const preferSource =\n      process.env.CODEMATION_PREFER_PLUGIN_SOURCE_ENTRY === \"true\" &&\n      typeof discoveredPackage.developmentEntry === \"string\" &&\n      discoveredPackage.developmentEntry.trim().length > 0;\n    const selectedEntry = preferSource ? discoveredPackage.developmentEntry : discoveredPackage.pluginEntry;\n    return selectedEntry;\n  }\n\n  private async resolveDevelopmentPluginEntry(packageRoot: string): Promise<string | undefined> {\n    const candidates = [\n      path.resolve(packageRoot, \"codemation.plugin.ts\"),\n      path.resolve(packageRoot, \"codemation.plugin.js\"),\n      path.resolve(packageRoot, \"src\", \"codemation.plugin.ts\"),\n      path.resolve(packageRoot, \"src\", \"codemation.plugin.js\"),\n    ];\n    for (const candidate of candidates) {\n      if (await this.exists(candidate)) {\n        return path.relative(packageRoot, candidate);\n      }\n    }\n    return undefined;\n  }\n\n  private async exists(filePath: string): Promise<boolean> {\n    try {\n      await readFile(filePath, \"utf8\");\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private resolvePluginModuleSpecifier(pluginModulePath: string): string {\n    return pathToFileURL(pluginModulePath).href;\n  }\n}\n"],"mappings":";;;;;;;;;;AAuBA,IAAa,0BAAb,MAAa,wBAAwB;CACnC,OAAwB,mCAAmB,IAAI,SAAgD;CAE/F,YACE,AAAiBA,QACjB,AAAiBC,cACjB,AAAiBC,cACjB,AAAiBC,kBAAyC,EAAE,EAC5D,AAAiBC,KACjB;EALiB;EACA;EACA;EACA;EACA;;CAGnB,MAAM,SAAS,SAAqC;AAClD,SAAO,OAAO,MAAM,KAAK,YAAY,EAAE,QAAQ,MAAM,QAAQ;;CAG/D,MAAM,UAAyB;AAC7B,QAAM,KAAK,YAAY;;CAGzB,MAAM,QAAuB;EAC3B,MAAM,gBAAgB,wBAAwB,iBAAiB,IAAI,KAAK,OAAiB;AACzF,MAAI,CAAC,cACH;AAEF,0BAAwB,iBAAiB,OAAO,KAAK,OAAiB;AACtE,SAAO,MAAM,eAAe,UAAU,QAAQ,sBAAsB,CAAC,MAAM;;CAG7E,MAAM,wBAAiE;EACrE,MAAM,UAAU,MAAM,KAAK,YAAY;AAEvC,UADkB,MAAM,QAAQ,SAAS,QAAQ,IAAI,2BAA2B,CAAC,EAChE,KAAK,aAAa,QAAQ,yBAAyB,UAAU,SAAS,CAAC;;CAG1F,MAAM,mBAAmB,YAA0C;EACjE,MAAM,UAAU,MAAM,KAAK,YAAY;EACvC,MAAM,WAAW,MAAM,QAAQ,SAAS,QAAQ,IAAI,uBAAuB,WAAW,CAAC;AACvF,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,uBAAuB,aAAa;AAEtD,SAAO,MAAM,QAAQ,yBAAyB,IAAI,SAAS;;CAG7D,AAAQ,aAA4C;EAClD,MAAM,gBAAgB,wBAAwB,iBAAiB,IAAI,KAAK,OAAiB;AACzF,MAAI,cACF,QAAO;EAET,MAAM,cAAc,KAAK,eAAe;AACxC,0BAAwB,iBAAiB,IAAI,KAAK,QAAkB,YAAY;AAChF,SAAO;;CAGT,MAAc,gBAA+C;EAC3D,MAAM,WAAW,KAAK,oBAAoB,KAAK,aAAa;EAG5D,MAAM,MAAM,KAAK,OAAO,QAAQ;EAChC,MAAM,YAAY,IAAI,kBAAkB,CAAC,OAAO;GAC9C;GACA,cAAc,KAAK;GACnB;GACA,QAAQ,IAAI,4BAA4B,CAAC,UAAU,KAAK,OAAO;GAC/D,iBAAiB,KAAK,wBAAwB;GAC/C,CAAC;EACF,MAAM,YAAY,MAAM,IAAI,qBAAqB,CAAC,OAAO;GACvD;GACA,+BAA+B;GAChC,CAAC;AACF,QAAM,UAAU,QAAQ,gBAAgB,CAAC,OAAO;AAChD,SAAO;GACL;GACA,SAAS,UAAU,QAAQ,qBAAqB;GAChD,UAAU,UAAU,QAAQ,kBAAkB,SAAS;GACvD,0BAA0B,UAAU,QAAQ,yBAAyB;GACtE;;CAGH,AAAQ,yBAAgD;AACtD,MAAI,KAAK,gBAAgB,SAAS,EAChC,QAAO,CAAC,GAAG,KAAK,gBAAgB;AAElC,MAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,OAAO,aAAa,KAAK,OAAO,UAAU,WAAW,EACnF,QAAO,EAAE;AAEX,SAAO,CAAC,KAAK,aAAa;;CAE5B,AAAQ,oBAAoB,gBAAgC;EAC1D,IAAI,mBAAmB,KAAK,QAAQ,eAAe;AACnD,SAAO,KACL,KAAI;AACF,cAAW,KAAK,QAAQ,kBAAkB,sBAAsB,CAAC;AACjE,UAAO;UACD;GACN,MAAM,kBAAkB,KAAK,QAAQ,iBAAiB;AACtD,OAAI,oBAAoB,iBACtB,QAAO;AAET,sBAAmB;;;;;;;AChH3B,IAAa,kBAAb,MAA6B;CAC3B,YACE,AAAiBC,uBAAuD,IAAI,gCAAgC,EAC5G,AAAiBC,mBAAqC,IAAI,kBAAkB,EAC5E;EAFiB;EACA;;CAGnB,MAAM,KACJ,MAM8B;EAC9B,MAAM,aAAa,MAAM,KAAK,qBAAqB,KAAK;GACtD,cAAc,KAAK;GACnB,oBAAoB,KAAK;GAC1B,CAAC;AACF,SAAO;GACL,WAAW,KAAK,iBAAiB,OAAO;IACtC,UAAU,KAAK;IACf,cAAc,KAAK;IACnB,KAAK,KAAK;IACV,QAAQ,WAAW;IACnB,iBAAiB,WAAW;IAC7B,CAAC;GACF,iBAAiB,WAAW;GAC7B;;;;;;ACXL,IAAa,4BAAb,MAAuC;CACrC,AAAiB,wBAAwB,IAAI,iCAAiC;CAE9E,MAAM,SAAS,cAAiF;EAC9F,MAAM,kBAAkB,KAAK,QAAQ,cAAc,eAAe;EAClE,MAAM,eAAe,MAAM,KAAK,oBAAoB,gBAAgB;EACpE,MAAMC,qBAA0D,EAAE;AAClE,OAAK,MAAM,eAAe,cAAc;GACtC,MAAM,cAAc,MAAM,KAAK,gBAAgB,KAAK,QAAQ,aAAa,eAAe,CAAC;GACzF,MAAM,iBAAiB,YAAY,YAAY;AAC/C,OAAI,CAAC,YAAY,QAAQ,OAAO,mBAAmB,YAAY,eAAe,MAAM,CAAC,WAAW,EAC9F;AAEF,sBAAmB,KAAK;IACtB,aAAa,YAAY;IACzB;IACA,aAAa;IACb,kBAAkB,MAAM,KAAK,8BAA8B,YAAY;IACxE,CAAC;;AAEJ,SAAO,mBAAmB,MAAM,MAAM,UAAU,KAAK,YAAY,cAAc,MAAM,YAAY,CAAC;;CAGpG,MAAM,eAAe,cAA+E;EAClG,MAAM,qBAAqB,MAAM,KAAK,SAAS,aAAa;AAC5D,SAAO,MAAM,KAAK,0BAA0B,mBAAmB;;CAGjE,MAAM,0BACJ,oBACyD;EACzD,MAAMC,mBAAsD,EAAE;AAC9D,OAAK,MAAM,qBAAqB,mBAC9B,kBAAiB,KAAK;GACpB,GAAG;GACH,QAAQ,MAAM,KAAK,WAAW,kBAAkB;GACjD,CAAC;AAEJ,SAAO;;CAGT,MAAc,oBAAoB,iBAAyD;AACzF,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,iBAAiB,EAAE,eAAe,MAAM,CAAC;GACvE,MAAMC,eAAyB,EAAE;AACjC,QAAK,MAAM,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,aAAa,IAAI,CAAC,MAAM,gBAAgB,CACjD;AAEF,QAAI,MAAM,KAAK,WAAW,IAAI,EAAE;KAC9B,MAAM,gBAAgB,MAAM,QAAQ,KAAK,QAAQ,iBAAiB,MAAM,KAAK,EAAE,EAAE,eAAe,MAAM,CAAC;AACvG,UAAK,MAAM,eAAe,cACxB,KAAI,YAAY,aAAa,IAAI,YAAY,gBAAgB,CAC3D,cAAa,KAAK,KAAK,QAAQ,iBAAiB,MAAM,MAAM,YAAY,KAAK,CAAC;AAGlF;;AAEF,iBAAa,KAAK,KAAK,QAAQ,iBAAiB,MAAM,KAAK,CAAC;;AAE9D,UAAO;UACD;AACN,UAAO,EAAE;;;CAIb,MAAc,gBAAgB,iBAAoD;AAChF,MAAI;GACF,MAAM,iBAAiB,MAAM,SAAS,iBAAiB,OAAO;AAC9D,UAAO,KAAK,MAAM,eAAe;UAC3B;AACN,UAAO,EAAE;;;CAIb,MAAc,WAAW,mBAAiF;EACxG,MAAM,mBAAmB,KAAK,QAAQ,kBAAkB,aAAa,KAAK,mBAAmB,kBAAkB,CAAC;EAIhH,MAAM,iBAHkB,MAAM;;GACF,KAAK,6BAA6B,iBAAiB;GAE1C;EACrC,MAAM,SAAS,KAAK,mBAAmB,cAAc;AACrD,MAAI,CAAC,OACH,OAAM,IAAI,MAAM,mBAAmB,kBAAkB,YAAY,+CAA+C;AAElH,SAAO,KAAK,sBAAsB,kBAAkB,QAAQ,kBAAkB,YAAY;;CAG5F,AAAQ,mBAAmB,OAAyC;AAClE,MAAI,KAAK,eAAe,MAAM,CAC5B,QAAO;AAET,SAAO;;CAGT,AAAQ,eAAe,OAA2C;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;EAET,MAAM,cAAc;AAMpB,MAAI,YAAY,aAAa,UAAa,OAAO,YAAY,aAAa,WACxE,QAAO;AAET,MAAI,YAAY,oBAAoB,UAAa,CAAC,MAAM,QAAQ,YAAY,gBAAgB,CAC1F,QAAO;AAET,MAAI,YAAY,eAAe,UAAa,CAAC,MAAM,QAAQ,YAAY,WAAW,CAChF,QAAO;AAET,SACE,YAAY,aAAa,UACzB,YAAY,oBAAoB,UAChC,YAAY,eAAe,UAC3B,YAAY,YAAY,UACxB,OAAO,KAAK,YAAY,CAAC,WAAW;;CAIxC,AAAQ,mBAAmB,mBAA8D;AAMvF,SAJE,QAAQ,IAAI,0CAA0C,UACtD,OAAO,kBAAkB,qBAAqB,YAC9C,kBAAkB,iBAAiB,MAAM,CAAC,SAAS,IAChB,kBAAkB,mBAAmB,kBAAkB;;CAI9F,MAAc,8BAA8B,aAAkD;EAC5F,MAAM,aAAa;GACjB,KAAK,QAAQ,aAAa,uBAAuB;GACjD,KAAK,QAAQ,aAAa,uBAAuB;GACjD,KAAK,QAAQ,aAAa,OAAO,uBAAuB;GACxD,KAAK,QAAQ,aAAa,OAAO,uBAAuB;GACzD;AACD,OAAK,MAAM,aAAa,WACtB,KAAI,MAAM,KAAK,OAAO,UAAU,CAC9B,QAAO,KAAK,SAAS,aAAa,UAAU;;CAMlD,MAAc,OAAO,UAAoC;AACvD,MAAI;AACF,SAAM,SAAS,UAAU,OAAO;AAChC,UAAO;UACD;AACN,UAAO;;;CAIX,AAAQ,6BAA6B,kBAAkC;AACrE,SAAO,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"server-BlG9qV5S.js","names":["config: CodemationConfig","consumerRoot: string","configSource?: string","workflowSources: ReadonlyArray<string>","env?: Readonly<NodeJS.ProcessEnv>","consumerConfigLoader: CodemationConsumerConfigLoader","appConfigFactory: AppConfigFactory","discoveredPackages: CodemationDiscoveredPluginPackage[]","resolvedPackages: CodemationResolvedPluginPackage[]","packageRoots: string[]"],"sources":["../src/presentation/http/CodemationServerGatewayFactory.ts","../src/presentation/server/AppConfigLoader.ts","../src/presentation/server/CodemationPluginDiscovery.ts"],"sourcesContent":["import { accessSync } from \"node:fs\";\nimport path from \"node:path\";\nimport type { QueryBus } from \"../../application/bus/QueryBus\";\nimport type { WorkflowDto, WorkflowSummary } from \"../../application/contracts/WorkflowViewContracts\";\nimport { WorkflowDefinitionMapper } from \"../../application/mapping/WorkflowDefinitionMapper\";\nimport { GetWorkflowDetailQuery } from \"../../application/queries/GetWorkflowDetailQuery\";\nimport { GetWorkflowSummariesQuery } from \"../../application/queries/GetWorkflowSummariesQuery\";\nimport { ApplicationTokens } from \"../../applicationTokens\";\nimport { AppContainerFactory } from \"../../bootstrap/AppContainerFactory\";\nimport { AppContainerLifecycle } from \"../../bootstrap/AppContainerLifecycle\";\nimport { FrontendRuntime } from \"../../bootstrap/runtime/FrontendRuntime\";\nimport { AppConfigFactory } from \"../../bootstrap/runtime/AppConfigFactory\";\nimport type { CodemationConfig } from \"../config/CodemationConfig\";\nimport { CodemationConfigNormalizer } from \"../config/CodemationConfigNormalizer\";\nimport { CodemationHonoApiApp } from \"./hono/CodemationHonoApiAppFactory\";\n\ntype ServerGatewayContext = Readonly<{\n  container: import(\"@codemation/core\").Container;\n  httpApi: CodemationHonoApiApp;\n  queryBus: QueryBus;\n  workflowDefinitionMapper: WorkflowDefinitionMapper;\n}>;\n\nexport class CodemationServerGateway {\n  private static readonly contextsByConfig = new WeakMap<object, Promise<ServerGatewayContext>>();\n\n  constructor(\n    private readonly config: CodemationConfig,\n    private readonly consumerRoot: string,\n    private readonly configSource?: string,\n    private readonly workflowSources: ReadonlyArray<string> = [],\n    private readonly env?: Readonly<NodeJS.ProcessEnv>,\n  ) {}\n\n  async dispatch(request: Request): Promise<Response> {\n    return await (await this.getContext()).httpApi.fetch(request);\n  }\n\n  async prepare(): Promise<void> {\n    await this.getContext();\n  }\n\n  async close(): Promise<void> {\n    const cachedContext = CodemationServerGateway.contextsByConfig.get(this.config as object);\n    if (!cachedContext) {\n      return;\n    }\n    CodemationServerGateway.contextsByConfig.delete(this.config as object);\n    await (await cachedContext).container.resolve(AppContainerLifecycle).stop();\n  }\n\n  async loadWorkflowSummaries(): Promise<ReadonlyArray<WorkflowSummary>> {\n    const context = await this.getContext();\n    const workflows = await context.queryBus.execute(new GetWorkflowSummariesQuery());\n    return workflows.map((workflow) => context.workflowDefinitionMapper.toSummary(workflow));\n  }\n\n  async loadWorkflowDetail(workflowId: string): Promise<WorkflowDto> {\n    const context = await this.getContext();\n    const workflow = await context.queryBus.execute(new GetWorkflowDetailQuery(workflowId));\n    if (!workflow) {\n      throw new Error(`Unknown workflowId: ${workflowId}`);\n    }\n    return await context.workflowDefinitionMapper.map(workflow);\n  }\n\n  private getContext(): Promise<ServerGatewayContext> {\n    const cachedContext = CodemationServerGateway.contextsByConfig.get(this.config as object);\n    if (cachedContext) {\n      return cachedContext;\n    }\n    const nextContext = this.createContext();\n    CodemationServerGateway.contextsByConfig.set(this.config as object, nextContext);\n    return nextContext;\n  }\n\n  private async createContext(): Promise<ServerGatewayContext> {\n    const repoRoot = this.detectWorkspaceRoot(this.consumerRoot);\n    // This gateway is the config/env boundary that materializes AppConfig from raw inputs.\n    // eslint-disable-next-line no-restricted-properties\n    const env = this.env ?? process.env;\n    const appConfig = new AppConfigFactory().create({\n      repoRoot,\n      consumerRoot: this.consumerRoot,\n      env,\n      config: new CodemationConfigNormalizer().normalize(this.config),\n      workflowSources: this.resolveWorkflowSources(),\n    });\n    const container = await new AppContainerFactory().create({\n      appConfig,\n      sharedWorkflowWebsocketServer: null,\n    });\n    await container.resolve(FrontendRuntime).start();\n    return {\n      container,\n      httpApi: container.resolve(CodemationHonoApiApp),\n      queryBus: container.resolve(ApplicationTokens.QueryBus),\n      workflowDefinitionMapper: container.resolve(WorkflowDefinitionMapper),\n    };\n  }\n\n  private resolveWorkflowSources(): ReadonlyArray<string> {\n    if (this.workflowSources.length > 0) {\n      return [...this.workflowSources];\n    }\n    if (!this.configSource || !this.config.workflows || this.config.workflows.length === 0) {\n      return [];\n    }\n    return [this.configSource];\n  }\n  private detectWorkspaceRoot(startDirectory: string): string {\n    let currentDirectory = path.resolve(startDirectory);\n    while (true) {\n      try {\n        accessSync(path.resolve(currentDirectory, \"pnpm-workspace.yaml\"));\n        return currentDirectory;\n      } catch {\n        const parentDirectory = path.dirname(currentDirectory);\n        if (parentDirectory === currentDirectory) {\n          return startDirectory;\n        }\n        currentDirectory = parentDirectory;\n      }\n    }\n  }\n}\n","import type { AppConfig } from \"../config/AppConfig\";\nimport { CodemationConsumerConfigLoader } from \"./CodemationConsumerConfigLoader\";\nimport { AppConfigFactory } from \"../../bootstrap/runtime/AppConfigFactory\";\n\nexport type AppConfigLoadResult = Readonly<{\n  appConfig: AppConfig;\n  bootstrapSource: string | null;\n}>;\n\nexport class AppConfigLoader {\n  constructor(\n    private readonly consumerConfigLoader: CodemationConsumerConfigLoader = new CodemationConsumerConfigLoader(),\n    private readonly appConfigFactory: AppConfigFactory = new AppConfigFactory(),\n  ) {}\n\n  async load(\n    args: Readonly<{\n      consumerRoot: string;\n      repoRoot: string;\n      env: NodeJS.ProcessEnv;\n      configPathOverride?: string;\n    }>,\n  ): Promise<AppConfigLoadResult> {\n    const resolution = await this.consumerConfigLoader.load({\n      consumerRoot: args.consumerRoot,\n      configPathOverride: args.configPathOverride,\n    });\n    return {\n      appConfig: this.appConfigFactory.create({\n        repoRoot: args.repoRoot,\n        consumerRoot: args.consumerRoot,\n        env: args.env,\n        config: resolution.config,\n        workflowSources: resolution.workflowSources,\n      }),\n      bootstrapSource: resolution.bootstrapSource,\n    };\n  }\n}\n","import type { CodemationPackageManifest } from \"../config/CodemationPackageManifest\";\nimport { CodemationPluginPackageMetadata, type CodemationPlugin } from \"../config/CodemationPlugin\";\nimport { readFile, readdir } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nexport type CodemationDiscoveredPluginPackage = Readonly<{\n  packageName: string;\n  packageRoot: string;\n  pluginEntry: string;\n  developmentEntry?: string;\n}>;\n\nexport type CodemationResolvedPluginPackage = Readonly<\n  CodemationDiscoveredPluginPackage & {\n    plugin: CodemationPlugin;\n  }\n>;\n\ntype PackageJsonShape = Readonly<{\n  codemation?: CodemationPackageManifest;\n  name?: string;\n  exports?: Readonly<Record<string, unknown>>;\n}>;\n\nexport class CodemationPluginDiscovery {\n  private readonly pluginPackageMetadata = new CodemationPluginPackageMetadata();\n\n  async discover(consumerRoot: string): Promise<ReadonlyArray<CodemationDiscoveredPluginPackage>> {\n    const nodeModulesRoot = path.resolve(consumerRoot, \"node_modules\");\n    const packageRoots = await this.collectPackageRoots(nodeModulesRoot);\n    const discoveredPackages: CodemationDiscoveredPluginPackage[] = [];\n    for (const packageRoot of packageRoots) {\n      const packageJson = await this.readPackageJson(path.resolve(packageRoot, \"package.json\"));\n      const pluginManifest = packageJson.codemation?.plugin;\n      if (!packageJson.name || typeof pluginManifest !== \"string\" || pluginManifest.trim().length === 0) {\n        continue;\n      }\n      discoveredPackages.push({\n        packageName: packageJson.name,\n        packageRoot,\n        pluginEntry: pluginManifest,\n        developmentEntry: await this.resolveDevelopmentPluginEntry(packageRoot),\n      });\n    }\n    return discoveredPackages.sort((left, right) => left.packageName.localeCompare(right.packageName));\n  }\n\n  async resolvePlugins(consumerRoot: string): Promise<ReadonlyArray<CodemationResolvedPluginPackage>> {\n    const discoveredPackages = await this.discover(consumerRoot);\n    return await this.resolveDiscoveredPackages(discoveredPackages);\n  }\n\n  async resolveDiscoveredPackages(\n    discoveredPackages: ReadonlyArray<CodemationDiscoveredPluginPackage>,\n  ): Promise<ReadonlyArray<CodemationResolvedPluginPackage>> {\n    const resolvedPackages: CodemationResolvedPluginPackage[] = [];\n    for (const discoveredPackage of discoveredPackages) {\n      resolvedPackages.push({\n        ...discoveredPackage,\n        plugin: await this.loadPlugin(discoveredPackage),\n      });\n    }\n    return resolvedPackages;\n  }\n\n  private async collectPackageRoots(nodeModulesRoot: string): Promise<ReadonlyArray<string>> {\n    try {\n      const entries = await readdir(nodeModulesRoot, { withFileTypes: true });\n      const packageRoots: string[] = [];\n      for (const entry of entries) {\n        if (!entry.isDirectory() && !entry.isSymbolicLink()) {\n          continue;\n        }\n        if (entry.name.startsWith(\"@\")) {\n          const scopedEntries = await readdir(path.resolve(nodeModulesRoot, entry.name), { withFileTypes: true });\n          for (const scopedEntry of scopedEntries) {\n            if (scopedEntry.isDirectory() || scopedEntry.isSymbolicLink()) {\n              packageRoots.push(path.resolve(nodeModulesRoot, entry.name, scopedEntry.name));\n            }\n          }\n          continue;\n        }\n        packageRoots.push(path.resolve(nodeModulesRoot, entry.name));\n      }\n      return packageRoots;\n    } catch {\n      return [];\n    }\n  }\n\n  private async readPackageJson(packageJsonPath: string): Promise<PackageJsonShape> {\n    try {\n      const rawPackageJson = await readFile(packageJsonPath, \"utf8\");\n      return JSON.parse(rawPackageJson) as PackageJsonShape;\n    } catch {\n      return {};\n    }\n  }\n\n  private async loadPlugin(discoveredPackage: CodemationDiscoveredPluginPackage): Promise<CodemationPlugin> {\n    const pluginModulePath = path.resolve(discoveredPackage.packageRoot, this.resolvePluginEntry(discoveredPackage));\n    const importedModule = (await import(\n      /* webpackIgnore: true */ this.resolvePluginModuleSpecifier(pluginModulePath)\n    )) as Record<string, unknown>;\n    const exportedValue = importedModule.default;\n    const plugin = this.resolvePluginValue(exportedValue);\n    if (!plugin) {\n      throw new Error(`Plugin package \"${discoveredPackage.packageName}\" did not default-export a Codemation plugin.`);\n    }\n    return this.pluginPackageMetadata.attachPackageName(plugin, discoveredPackage.packageName);\n  }\n\n  private resolvePluginValue(value: unknown): CodemationPlugin | null {\n    if (this.isPluginConfig(value)) {\n      return value;\n    }\n    return null;\n  }\n\n  private isPluginConfig(value: unknown): value is CodemationPlugin {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n      return false;\n    }\n    const pluginValue = value as {\n      credentialTypes?: unknown;\n      mcpServers?: unknown;\n      register?: unknown;\n      sandbox?: unknown;\n    };\n    if (pluginValue.register !== undefined && typeof pluginValue.register !== \"function\") {\n      return false;\n    }\n    if (pluginValue.credentialTypes !== undefined && !Array.isArray(pluginValue.credentialTypes)) {\n      return false;\n    }\n    if (pluginValue.mcpServers !== undefined && !Array.isArray(pluginValue.mcpServers)) {\n      return false;\n    }\n    return (\n      pluginValue.register !== undefined ||\n      pluginValue.credentialTypes !== undefined ||\n      pluginValue.mcpServers !== undefined ||\n      pluginValue.sandbox !== undefined ||\n      Object.keys(pluginValue).length === 0\n    );\n  }\n\n  private resolvePluginEntry(discoveredPackage: CodemationDiscoveredPluginPackage): string {\n    const preferSource =\n      process.env.CODEMATION_PREFER_PLUGIN_SOURCE_ENTRY === \"true\" &&\n      typeof discoveredPackage.developmentEntry === \"string\" &&\n      discoveredPackage.developmentEntry.trim().length > 0;\n    const selectedEntry = preferSource ? discoveredPackage.developmentEntry : discoveredPackage.pluginEntry;\n    return selectedEntry;\n  }\n\n  private async resolveDevelopmentPluginEntry(packageRoot: string): Promise<string | undefined> {\n    const candidates = [\n      path.resolve(packageRoot, \"codemation.plugin.ts\"),\n      path.resolve(packageRoot, \"codemation.plugin.js\"),\n      path.resolve(packageRoot, \"src\", \"codemation.plugin.ts\"),\n      path.resolve(packageRoot, \"src\", \"codemation.plugin.js\"),\n    ];\n    for (const candidate of candidates) {\n      if (await this.exists(candidate)) {\n        return path.relative(packageRoot, candidate);\n      }\n    }\n    return undefined;\n  }\n\n  private async exists(filePath: string): Promise<boolean> {\n    try {\n      await readFile(filePath, \"utf8\");\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private resolvePluginModuleSpecifier(pluginModulePath: string): string {\n    return pathToFileURL(pluginModulePath).href;\n  }\n}\n"],"mappings":";;;;;;;;;;AAuBA,IAAa,0BAAb,MAAa,wBAAwB;CACnC,OAAwB,mCAAmB,IAAI,SAAgD;CAE/F,YACE,AAAiBA,QACjB,AAAiBC,cACjB,AAAiBC,cACjB,AAAiBC,kBAAyC,EAAE,EAC5D,AAAiBC,KACjB;EALiB;EACA;EACA;EACA;EACA;;CAGnB,MAAM,SAAS,SAAqC;AAClD,SAAO,OAAO,MAAM,KAAK,YAAY,EAAE,QAAQ,MAAM,QAAQ;;CAG/D,MAAM,UAAyB;AAC7B,QAAM,KAAK,YAAY;;CAGzB,MAAM,QAAuB;EAC3B,MAAM,gBAAgB,wBAAwB,iBAAiB,IAAI,KAAK,OAAiB;AACzF,MAAI,CAAC,cACH;AAEF,0BAAwB,iBAAiB,OAAO,KAAK,OAAiB;AACtE,SAAO,MAAM,eAAe,UAAU,QAAQ,sBAAsB,CAAC,MAAM;;CAG7E,MAAM,wBAAiE;EACrE,MAAM,UAAU,MAAM,KAAK,YAAY;AAEvC,UADkB,MAAM,QAAQ,SAAS,QAAQ,IAAI,2BAA2B,CAAC,EAChE,KAAK,aAAa,QAAQ,yBAAyB,UAAU,SAAS,CAAC;;CAG1F,MAAM,mBAAmB,YAA0C;EACjE,MAAM,UAAU,MAAM,KAAK,YAAY;EACvC,MAAM,WAAW,MAAM,QAAQ,SAAS,QAAQ,IAAI,uBAAuB,WAAW,CAAC;AACvF,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,uBAAuB,aAAa;AAEtD,SAAO,MAAM,QAAQ,yBAAyB,IAAI,SAAS;;CAG7D,AAAQ,aAA4C;EAClD,MAAM,gBAAgB,wBAAwB,iBAAiB,IAAI,KAAK,OAAiB;AACzF,MAAI,cACF,QAAO;EAET,MAAM,cAAc,KAAK,eAAe;AACxC,0BAAwB,iBAAiB,IAAI,KAAK,QAAkB,YAAY;AAChF,SAAO;;CAGT,MAAc,gBAA+C;EAC3D,MAAM,WAAW,KAAK,oBAAoB,KAAK,aAAa;EAG5D,MAAM,MAAM,KAAK,OAAO,QAAQ;EAChC,MAAM,YAAY,IAAI,kBAAkB,CAAC,OAAO;GAC9C;GACA,cAAc,KAAK;GACnB;GACA,QAAQ,IAAI,4BAA4B,CAAC,UAAU,KAAK,OAAO;GAC/D,iBAAiB,KAAK,wBAAwB;GAC/C,CAAC;EACF,MAAM,YAAY,MAAM,IAAI,qBAAqB,CAAC,OAAO;GACvD;GACA,+BAA+B;GAChC,CAAC;AACF,QAAM,UAAU,QAAQ,gBAAgB,CAAC,OAAO;AAChD,SAAO;GACL;GACA,SAAS,UAAU,QAAQ,qBAAqB;GAChD,UAAU,UAAU,QAAQ,kBAAkB,SAAS;GACvD,0BAA0B,UAAU,QAAQ,yBAAyB;GACtE;;CAGH,AAAQ,yBAAgD;AACtD,MAAI,KAAK,gBAAgB,SAAS,EAChC,QAAO,CAAC,GAAG,KAAK,gBAAgB;AAElC,MAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,OAAO,aAAa,KAAK,OAAO,UAAU,WAAW,EACnF,QAAO,EAAE;AAEX,SAAO,CAAC,KAAK,aAAa;;CAE5B,AAAQ,oBAAoB,gBAAgC;EAC1D,IAAI,mBAAmB,KAAK,QAAQ,eAAe;AACnD,SAAO,KACL,KAAI;AACF,cAAW,KAAK,QAAQ,kBAAkB,sBAAsB,CAAC;AACjE,UAAO;UACD;GACN,MAAM,kBAAkB,KAAK,QAAQ,iBAAiB;AACtD,OAAI,oBAAoB,iBACtB,QAAO;AAET,sBAAmB;;;;;;;AChH3B,IAAa,kBAAb,MAA6B;CAC3B,YACE,AAAiBC,uBAAuD,IAAI,gCAAgC,EAC5G,AAAiBC,mBAAqC,IAAI,kBAAkB,EAC5E;EAFiB;EACA;;CAGnB,MAAM,KACJ,MAM8B;EAC9B,MAAM,aAAa,MAAM,KAAK,qBAAqB,KAAK;GACtD,cAAc,KAAK;GACnB,oBAAoB,KAAK;GAC1B,CAAC;AACF,SAAO;GACL,WAAW,KAAK,iBAAiB,OAAO;IACtC,UAAU,KAAK;IACf,cAAc,KAAK;IACnB,KAAK,KAAK;IACV,QAAQ,WAAW;IACnB,iBAAiB,WAAW;IAC7B,CAAC;GACF,iBAAiB,WAAW;GAC7B;;;;;;ACXL,IAAa,4BAAb,MAAuC;CACrC,AAAiB,wBAAwB,IAAI,iCAAiC;CAE9E,MAAM,SAAS,cAAiF;EAC9F,MAAM,kBAAkB,KAAK,QAAQ,cAAc,eAAe;EAClE,MAAM,eAAe,MAAM,KAAK,oBAAoB,gBAAgB;EACpE,MAAMC,qBAA0D,EAAE;AAClE,OAAK,MAAM,eAAe,cAAc;GACtC,MAAM,cAAc,MAAM,KAAK,gBAAgB,KAAK,QAAQ,aAAa,eAAe,CAAC;GACzF,MAAM,iBAAiB,YAAY,YAAY;AAC/C,OAAI,CAAC,YAAY,QAAQ,OAAO,mBAAmB,YAAY,eAAe,MAAM,CAAC,WAAW,EAC9F;AAEF,sBAAmB,KAAK;IACtB,aAAa,YAAY;IACzB;IACA,aAAa;IACb,kBAAkB,MAAM,KAAK,8BAA8B,YAAY;IACxE,CAAC;;AAEJ,SAAO,mBAAmB,MAAM,MAAM,UAAU,KAAK,YAAY,cAAc,MAAM,YAAY,CAAC;;CAGpG,MAAM,eAAe,cAA+E;EAClG,MAAM,qBAAqB,MAAM,KAAK,SAAS,aAAa;AAC5D,SAAO,MAAM,KAAK,0BAA0B,mBAAmB;;CAGjE,MAAM,0BACJ,oBACyD;EACzD,MAAMC,mBAAsD,EAAE;AAC9D,OAAK,MAAM,qBAAqB,mBAC9B,kBAAiB,KAAK;GACpB,GAAG;GACH,QAAQ,MAAM,KAAK,WAAW,kBAAkB;GACjD,CAAC;AAEJ,SAAO;;CAGT,MAAc,oBAAoB,iBAAyD;AACzF,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,iBAAiB,EAAE,eAAe,MAAM,CAAC;GACvE,MAAMC,eAAyB,EAAE;AACjC,QAAK,MAAM,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,aAAa,IAAI,CAAC,MAAM,gBAAgB,CACjD;AAEF,QAAI,MAAM,KAAK,WAAW,IAAI,EAAE;KAC9B,MAAM,gBAAgB,MAAM,QAAQ,KAAK,QAAQ,iBAAiB,MAAM,KAAK,EAAE,EAAE,eAAe,MAAM,CAAC;AACvG,UAAK,MAAM,eAAe,cACxB,KAAI,YAAY,aAAa,IAAI,YAAY,gBAAgB,CAC3D,cAAa,KAAK,KAAK,QAAQ,iBAAiB,MAAM,MAAM,YAAY,KAAK,CAAC;AAGlF;;AAEF,iBAAa,KAAK,KAAK,QAAQ,iBAAiB,MAAM,KAAK,CAAC;;AAE9D,UAAO;UACD;AACN,UAAO,EAAE;;;CAIb,MAAc,gBAAgB,iBAAoD;AAChF,MAAI;GACF,MAAM,iBAAiB,MAAM,SAAS,iBAAiB,OAAO;AAC9D,UAAO,KAAK,MAAM,eAAe;UAC3B;AACN,UAAO,EAAE;;;CAIb,MAAc,WAAW,mBAAiF;EACxG,MAAM,mBAAmB,KAAK,QAAQ,kBAAkB,aAAa,KAAK,mBAAmB,kBAAkB,CAAC;EAIhH,MAAM,iBAHkB,MAAM;;GACF,KAAK,6BAA6B,iBAAiB;GAE1C;EACrC,MAAM,SAAS,KAAK,mBAAmB,cAAc;AACrD,MAAI,CAAC,OACH,OAAM,IAAI,MAAM,mBAAmB,kBAAkB,YAAY,+CAA+C;AAElH,SAAO,KAAK,sBAAsB,kBAAkB,QAAQ,kBAAkB,YAAY;;CAG5F,AAAQ,mBAAmB,OAAyC;AAClE,MAAI,KAAK,eAAe,MAAM,CAC5B,QAAO;AAET,SAAO;;CAGT,AAAQ,eAAe,OAA2C;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;EAET,MAAM,cAAc;AAMpB,MAAI,YAAY,aAAa,UAAa,OAAO,YAAY,aAAa,WACxE,QAAO;AAET,MAAI,YAAY,oBAAoB,UAAa,CAAC,MAAM,QAAQ,YAAY,gBAAgB,CAC1F,QAAO;AAET,MAAI,YAAY,eAAe,UAAa,CAAC,MAAM,QAAQ,YAAY,WAAW,CAChF,QAAO;AAET,SACE,YAAY,aAAa,UACzB,YAAY,oBAAoB,UAChC,YAAY,eAAe,UAC3B,YAAY,YAAY,UACxB,OAAO,KAAK,YAAY,CAAC,WAAW;;CAIxC,AAAQ,mBAAmB,mBAA8D;AAMvF,SAJE,QAAQ,IAAI,0CAA0C,UACtD,OAAO,kBAAkB,qBAAqB,YAC9C,kBAAkB,iBAAiB,MAAM,CAAC,SAAS,IAChB,kBAAkB,mBAAmB,kBAAkB;;CAI9F,MAAc,8BAA8B,aAAkD;EAC5F,MAAM,aAAa;GACjB,KAAK,QAAQ,aAAa,uBAAuB;GACjD,KAAK,QAAQ,aAAa,uBAAuB;GACjD,KAAK,QAAQ,aAAa,OAAO,uBAAuB;GACxD,KAAK,QAAQ,aAAa,OAAO,uBAAuB;GACzD;AACD,OAAK,MAAM,aAAa,WACtB,KAAI,MAAM,KAAK,OAAO,UAAU,CAC9B,QAAO,KAAK,SAAS,aAAa,UAAU;;CAMlD,MAAc,OAAO,UAAoC;AACvD,MAAI;AACF,SAAM,SAAS,UAAU,OAAO;AAChC,UAAO;UACD;AACN,UAAO;;;CAIX,AAAQ,6BAA6B,kBAAkC;AACrE,SAAO,cAAc,iBAAiB,CAAC"}

package/dist/server.d.ts

@@ -1,14 +1,14 @@
-import "./index-DilAYwnH.js";
-import "./ItemsInputNormalizer-_RwIfRIQ.js";
-import "./CodemationAppContext-CGFYVcSb.js";
+import "./index-ChIfeWzk.js";
+import "./ItemsInputNormalizer-CFkfNMLt.js";
+import "./CodemationAppContext-K51b7oXe.js";
 import "./CodemationWhitelabelConfig-Ca2mCUeC.js";
-import { a as ApiPaths, i as CodemationFrontendAuthSnapshotJsonCodec, n as InternalAuthBootstrapJsonCodec, r as FrontendAppConfigJsonCodec, t as PublicFrontendBootstrapJsonCodec } from "./PublicFrontendBootstrapJsonCodec-CXG9Dxft.js";
+import { a as ApiPaths, i as CodemationFrontendAuthSnapshotJsonCodec, n as InternalAuthBootstrapJsonCodec, r as FrontendAppConfigJsonCodec, t as PublicFrontendBootstrapJsonCodec } from "./PublicFrontendBootstrapJsonCodec-HNItQ7ol.js";
 import { n as InternalAuthBootstrap, r as FrontendAppConfig, t as PublicFrontendBootstrap } from "./PublicFrontendBootstrap-Cev3qK46.js";
-import "./CodemationConfigNormalizer-48f-T66P.js";
-import { i as CodemationConsumerAppResolver, n as CodemationConsumerConfigResolution, r as CodemationConsumerApp, t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-_PIYqwVx.js";
+import "./CodemationConfigNormalizer-B4rDYC9h.js";
+import { i as CodemationConsumerAppResolver, n as CodemationConsumerConfigResolution, r as CodemationConsumerApp, t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-Dt4jyLx6.js";
 import "./WorkflowViewContracts-B7aFQcIw.js";
-import { r as PrismaDatabaseClient } from "./AppConfigFactory-BT0y0LVC.js";
-import { a as ProcessRunOptions, i as CodemationFrontendAuthSnapshotFactory, n as InternalAuthBootstrapFactory, o as ProcessRunResult, r as FrontendAppConfigFactory, s as ProcessRunner, t as PublicFrontendBootstrapFactory } from "./PublicFrontendBootstrapFactory-Dv04tJ-6.js";
-import { n as CodemationPostgresPrismaClientFactory } from "./persistenceServer-B71RGvSj.js";
-import { a as CodemationResolvedPluginPackage, c as CodemationServerGateway, i as CodemationPluginDiscovery, l as ExecaProcessRunner, n as WorkflowModulePathFinder, o as AppConfigLoadResult, r as CodemationDiscoveredPluginPackage, s as AppConfigLoader, t as WorkflowDiscoveryPathSegmentsComputer } from "./server-09PKasWR.js";
+import { n as PrismaDatabaseClient } from "./AppConfigFactory-DncmwCD1.js";
+import { a as ProcessRunOptions, i as CodemationFrontendAuthSnapshotFactory, n as InternalAuthBootstrapFactory, o as ProcessRunResult, r as FrontendAppConfigFactory, s as ProcessRunner, t as PublicFrontendBootstrapFactory } from "./PublicFrontendBootstrapFactory-ClEjZP74.js";
+import { t as CodemationPostgresPrismaClientFactory } from "./CodemationPostgresPrismaClientFactory-CTNTPnDr.js";
+import { a as CodemationResolvedPluginPackage, c as CodemationServerGateway, i as CodemationPluginDiscovery, l as ExecaProcessRunner, n as WorkflowModulePathFinder, o as AppConfigLoadResult, r as CodemationDiscoveredPluginPackage, s as AppConfigLoader, t as WorkflowDiscoveryPathSegmentsComputer } from "./server-B5trn7y4.js";
 export { ApiPaths, AppConfigLoadResult, AppConfigLoader, CodemationConsumerApp, CodemationConsumerAppResolver, CodemationConsumerConfigLoader, CodemationConsumerConfigResolution, CodemationDiscoveredPluginPackage, CodemationFrontendAuthSnapshotFactory, CodemationFrontendAuthSnapshotJsonCodec, CodemationPluginDiscovery, CodemationPostgresPrismaClientFactory, CodemationResolvedPluginPackage, CodemationServerGateway, ExecaProcessRunner, FrontendAppConfig, FrontendAppConfigFactory, FrontendAppConfigJsonCodec, InternalAuthBootstrap, InternalAuthBootstrapFactory, InternalAuthBootstrapJsonCodec, PrismaDatabaseClient as PrismaClient, ProcessRunOptions, ProcessRunResult, ProcessRunner, PublicFrontendBootstrap, PublicFrontendBootstrapFactory, PublicFrontendBootstrapJsonCodec, WorkflowDiscoveryPathSegmentsComputer, WorkflowModulePathFinder };

package/dist/server.js

@@ -1,17 +1,17 @@
 import "./LogLevelPolicyFactory-DCUzIN6G.js";
-import { t as ApiPaths } from "./ApiPaths-Dv1dcHu_.js";
+import { t as ApiPaths } from "./ApiPaths-DCvrlIjg.js";
 import { i as CodemationFrontendAuthSnapshotJsonCodec, n as InternalAuthBootstrapJsonCodec, r as FrontendAppConfigJsonCodec, t as PublicFrontendBootstrapJsonCodec } from "./PublicFrontendBootstrapJsonCodec-CegIF_ne.js";
 import { i as CodemationConsumerAppResolver, n as WorkflowDiscoveryPathSegmentsComputer, r as WorkflowModulePathFinder, t as CodemationConsumerConfigLoader } from "./CodemationConsumerConfigLoader-By-6tuGc.js";
 import "./ServerLoggerFactory-Ckk52S3w.js";
 import "./decorateParam-BWxkAUSj.js";
 import "./decorate-CXWmflG_.js";
-import "./CredentialServices-Dk8yypeL.js";
+import "./CredentialServices-Bios0dM8.js";
 import "./CodemationTsyringeTypeInfoRegistrar-Bj6FJYFz.js";
-import { D as FrontendAppConfigFactory, E as InternalAuthBootstrapFactory, O as CodemationFrontendAuthSnapshotFactory, T as PublicFrontendBootstrapFactory, g as ExecaProcessRunner } from "./AppContainerFactory-DRTjG7nG.js";
-import "./WorkflowPolicyUiPresentationFactory-Bb-ae_Zh.js";
-import "./InternalPingRegistrar-DY3kSfxP.js";
-import "./AppConfigFactory-Cx4qQvRk.js";
-import { t as CodemationPostgresPrismaClientFactory } from "./persistenceServer-C-hH4z6l.js";
-import { n as AppConfigLoader, r as CodemationServerGateway, t as CodemationPluginDiscovery } from "./server-vtRCPgRJ.js";
+import { D as FrontendAppConfigFactory, E as InternalAuthBootstrapFactory, O as CodemationFrontendAuthSnapshotFactory, T as PublicFrontendBootstrapFactory, g as ExecaProcessRunner } from "./AppContainerFactory-jpYXGZGe.js";
+import "./InternalPingRegistrar-BavAAnvk.js";
+import "./WorkflowPolicyUiPresentationFactory-DfvD2VHk.js";
+import "./AppConfigFactory-D4LL1aOR.js";
+import { t as CodemationPostgresPrismaClientFactory } from "./CodemationPostgresPrismaClientFactory-C7156Fe-.js";
+import { n as AppConfigLoader, r as CodemationServerGateway, t as CodemationPluginDiscovery } from "./server-BlG9qV5S.js";
 
 export { ApiPaths, AppConfigLoader, CodemationConsumerAppResolver, CodemationConsumerConfigLoader, CodemationFrontendAuthSnapshotFactory, CodemationFrontendAuthSnapshotJsonCodec, CodemationPluginDiscovery, CodemationPostgresPrismaClientFactory, CodemationServerGateway, ExecaProcessRunner, FrontendAppConfigFactory, FrontendAppConfigJsonCodec, InternalAuthBootstrapFactory, InternalAuthBootstrapJsonCodec, PublicFrontendBootstrapFactory, PublicFrontendBootstrapJsonCodec, WorkflowDiscoveryPathSegmentsComputer, WorkflowModulePathFinder };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codemation/host",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "publishConfig": {
     "access": "public"
   },
@@ -93,9 +93,12 @@
     "@prisma/client": "^7.0.0",
     "@prisma/client-runtime-utils": "^7.5.0",
     "ai": "^6.0.168",
+    "ajv": "^8.20.0",
     "bcryptjs": "^3.0.3",
     "better-auth": "^1.5.6",
     "bullmq": "^5.58.3",
+    "dotenv": "^17.3.1",
+    "execa": "^9.6.1",
     "hono": "^4.12.8",
     "jose": "^6.2.2",
     "pg": "^8.16.3",
@@ -103,13 +106,11 @@
     "reflect-metadata": "^0.2.2",
     "sanitize-filename": "^1.6.4",
     "serialize-javascript": "^7.0.4",
-    "dotenv": "^17.3.1",
-    "execa": "^9.6.1",
     "tsx": "^4.21.0",
     "ws": "^8.19.0",
-    "@codemation/core-nodes": "0.8.1",
-    "@codemation/eventbus-redis": "0.0.39",
-    "@codemation/core": "0.11.1",
+    "@codemation/core": "0.12.0",
+    "@codemation/core-nodes": "0.9.0",
+    "@codemation/eventbus-redis": "0.0.40",
     "@codemation/managed-auth": "0.1.0"
   },
   "devDependencies": {
@@ -152,13 +153,13 @@
     "vitest": "^4.0.18",
     "zod": "^4.3.6",
     "zxcvbn": "^4.4.2",
-    "@codemation/core-nodes-gmail": "0.3.1"
+    "@codemation/core-nodes-gmail": "0.3.2"
   },
   "scripts": {
     "changeset:verify": "pnpm --workspace-root run changeset:verify",
     "prisma:generate": "node ./scripts/generate-prisma-clients.mjs && node ./scripts/ensure-prisma-runtime-sourcemaps.mjs",
-    "build": "tsdown src/index.ts src/authoring.ts src/client.ts src/credentials.ts src/consumer.ts src/dto.ts src/mapping.ts src/nextServer.ts src/server.ts src/devServerSidecar.ts src/persistenceServer.ts src/pairing.ts --out-dir dist --sourcemap",
-    "dev": "tsdown src/index.ts src/authoring.ts src/client.ts src/credentials.ts src/consumer.ts src/dto.ts src/mapping.ts src/nextServer.ts src/server.ts src/devServerSidecar.ts src/persistenceServer.ts src/pairing.ts --out-dir dist --sourcemap --watch",
+    "build": "tsdown src/index.ts src/authoring.ts src/client.ts src/credentials.ts src/consumer.ts src/dto.ts src/mapping.ts src/nextServer.ts src/server.ts src/devServerSidecar.ts src/persistenceServer.ts src/pairing.ts src/infrastructure/persistence/PrismaMigrationOperations.ts --out-dir dist --sourcemap",
+    "dev": "tsdown src/index.ts src/authoring.ts src/client.ts src/credentials.ts src/consumer.ts src/dto.ts src/mapping.ts src/nextServer.ts src/server.ts src/devServerSidecar.ts src/persistenceServer.ts src/pairing.ts src/infrastructure/persistence/PrismaMigrationOperations.ts --out-dir dist --sourcemap --watch",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint .",
     "test": "pnpm -w exec concurrently -m 5 -c auto -n unit,integration,ui,browser,e2e \"pnpm run test:unit\" \"pnpm run test:integration\" \"pnpm run test:ui\" \"pnpm run test:browser\" \"pnpm run test:e2e\"",

package/playwright.config.ts

@@ -55,12 +55,18 @@ export default defineConfig({
     /** Align with app URL and AUTH_URL so Auth.js cookies are not split across localhost vs 127.0.0.1. */
     baseURL: baseUrl,
     trace: "retain-on-failure",
-    video: "retain-on-failure",
+    // Video is disabled: it requires Playwright's ffmpeg binary, and every
+    // cdn.playwright.dev download hangs on CI (delivers bytes then never closes the
+    // stream). trace + screenshot already cover on-failure debugging without ffmpeg.
+    video: "off",
   },
   projects: [
     {
       name: "chromium",
-      use: { ...devices["Desktop Chrome"] },
+      // Use the runner's preinstalled Google Chrome (channel) instead of Playwright's
+      // bundled chromium: cdn.playwright.dev deterministically hangs after the binary
+      // download on CI, and the system Chrome is the same engine/version.
+      use: { ...devices["Desktop Chrome"], channel: "chrome" },
     },
   ],
   webServer: {

package/playwright.scaffolded-dev.config.ts

@@ -34,13 +34,19 @@ export default defineConfig({
   ],
   use: {
     trace: "retain-on-failure",
-    video: "retain-on-failure",
+    // Video is disabled: it requires Playwright's ffmpeg binary, and every
+    // cdn.playwright.dev download hangs on CI (delivers bytes then never closes the
+    // stream). trace + screenshot already cover on-failure debugging without ffmpeg.
+    video: "off",
     screenshot: "only-on-failure",
   },
   projects: [
     {
       name: "chromium",
-      use: { ...devices["Desktop Chrome"] },
+      // Use the runner's preinstalled Google Chrome (channel) instead of Playwright's
+      // bundled chromium: cdn.playwright.dev deterministically hangs after the binary
+      // download on CI, and the system Chrome is the same engine/version.
+      use: { ...devices["Desktop Chrome"], channel: "chrome" },
     },
   ],
 });

package/prisma/migrations/20260526120000_credential_material_pointer/migration.sql

@@ -0,0 +1,18 @@
+-- Migration: Credential material provider seam (credentials-vault sprint, story 01).
+-- Adds the {material_source, material_ref} pointer on CredentialInstance.
+-- See docs/design/credentials-oauth-unification.md "Material provider seam".
+--
+-- All existing rows are local-mode workspace rows; backfill the pointer to
+-- {source: "local", ref: instance_id} so the bytes still resolve via the
+-- existing PrismaCredentialStore tables (CredentialOAuth2Material /
+-- CredentialSecretMaterial).
+
+ALTER TABLE "CredentialInstance"
+  ADD COLUMN "material_source" TEXT NOT NULL DEFAULT 'local';
+
+ALTER TABLE "CredentialInstance"
+  ADD COLUMN "material_ref" TEXT NOT NULL DEFAULT '';
+
+UPDATE "CredentialInstance"
+  SET "material_ref" = "instance_id"
+  WHERE "material_ref" = '';

package/prisma/migrations/20260527120000_add_human_task/migration.sql

@@ -0,0 +1,32 @@
+-- Create HumanTask table for HITL story 02: durable task record + signed resume token.
+-- Indexed for efficient "pending tasks for workspace/workflow" queries (story 06, 09).
+
+CREATE TABLE "human_task" (
+    "id"                   TEXT NOT NULL,
+    "run_id"               TEXT NOT NULL,
+    "workflow_id"          TEXT NOT NULL,
+    "workspace_id"         TEXT,
+    "node_id"              TEXT NOT NULL,
+    "activation_id"        TEXT NOT NULL,
+    "item_index"           INTEGER NOT NULL,
+    "status"               TEXT NOT NULL,
+    "channel"              TEXT NOT NULL,
+    "subject_json"         TEXT NOT NULL,
+    "metadata_json"        TEXT NOT NULL,
+    "decision_schema_json" TEXT NOT NULL,
+    "decision_schema_hash" TEXT NOT NULL,
+    "on_timeout"           TEXT NOT NULL,
+    "delivery_ref_json"    TEXT,
+    "decision_json"        TEXT,
+    "decided_at"           TIMESTAMP(3),
+    "decided_by_json"      TEXT,
+    "resume_token_hash"    TEXT NOT NULL,
+    "expires_at"           TIMESTAMP(3) NOT NULL,
+    "created_at"           TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "human_task_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "human_task_run_id_idx" ON "human_task"("run_id");
+CREATE INDEX "human_task_workflow_id_status_idx" ON "human_task"("workflow_id", "status");
+CREATE INDEX "human_task_workspace_id_status_expires_at_idx" ON "human_task"("workspace_id", "status", "expires_at");

package/prisma/migrations/20260527130000_add_hitl_state_json/migration.sql

@@ -0,0 +1,6 @@
+-- Add dedicated hitl_state_json column to Run table.
+-- Replaces the interim _hitl* key stash inside mutable_state_json (commit 63a6cfb3).
+-- Old rows with _hitl* keys inside mutable_state_json are still handled by the
+-- repository's legacy-fallback load path until re-saved with the new column.
+
+ALTER TABLE "Run" ADD COLUMN "hitl_state_json" TEXT;

package/prisma/migrations/20260527130000_add_hmac_nonce/migration.sql

@@ -0,0 +1,12 @@
+-- Migration: Durable HMAC nonce store for replay protection (T6 security fix).
+-- Replaces the in-memory Map in IncomingHmacVerifier with a Prisma-backed store
+-- so replay protection survives process restarts within the 300-second window.
+
+CREATE TABLE "hmac_nonce" (
+    "nonce"      TEXT NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "hmac_nonce_pkey" PRIMARY KEY ("nonce")
+);
+
+CREATE INDEX "hmac_nonce_expires_at_idx" ON "hmac_nonce"("expires_at");

package/prisma/migrations.sqlite/20260526120000_credential_material_pointer/migration.sql

@@ -0,0 +1,13 @@
+-- Migration: Credential material provider seam (credentials-vault sprint, story 01) - SQLite variant.
+-- Adds the {material_source, material_ref} pointer on CredentialInstance.
+-- See docs/design/credentials-oauth-unification.md "Material provider seam".
+
+ALTER TABLE "CredentialInstance"
+  ADD COLUMN "material_source" TEXT NOT NULL DEFAULT 'local';
+
+ALTER TABLE "CredentialInstance"
+  ADD COLUMN "material_ref" TEXT NOT NULL DEFAULT '';
+
+UPDATE "CredentialInstance"
+  SET "material_ref" = "instance_id"
+  WHERE "material_ref" = '';

package/prisma/migrations.sqlite/20260527120000_add_human_task/migration.sql

@@ -0,0 +1,30 @@
+-- Create HumanTask table for HITL story 02 (SQLite variant).
+-- Mirrors the PostgreSQL migration but uses TEXT for timestamp columns (SQLite has no native TIMESTAMP type).
+
+CREATE TABLE "human_task" (
+    "id"                   TEXT NOT NULL PRIMARY KEY,
+    "run_id"               TEXT NOT NULL,
+    "workflow_id"          TEXT NOT NULL,
+    "workspace_id"         TEXT,
+    "node_id"              TEXT NOT NULL,
+    "activation_id"        TEXT NOT NULL,
+    "item_index"           INTEGER NOT NULL,
+    "status"               TEXT NOT NULL,
+    "channel"              TEXT NOT NULL,
+    "subject_json"         TEXT NOT NULL,
+    "metadata_json"        TEXT NOT NULL,
+    "decision_schema_json" TEXT NOT NULL,
+    "decision_schema_hash" TEXT NOT NULL,
+    "on_timeout"           TEXT NOT NULL,
+    "delivery_ref_json"    TEXT,
+    "decision_json"        TEXT,
+    "decided_at"           DATETIME,
+    "decided_by_json"      TEXT,
+    "resume_token_hash"    TEXT NOT NULL,
+    "expires_at"           DATETIME NOT NULL,
+    "created_at"           DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX "human_task_run_id_idx" ON "human_task"("run_id");
+CREATE INDEX "human_task_workflow_id_status_idx" ON "human_task"("workflow_id", "status");
+CREATE INDEX "human_task_workspace_id_status_expires_at_idx" ON "human_task"("workspace_id", "status", "expires_at");

package/prisma/migrations.sqlite/20260527130000_add_hitl_state_json/migration.sql

@@ -0,0 +1,6 @@
+-- Add dedicated hitl_state_json column to Run table (SQLite variant).
+-- Replaces the interim _hitl* key stash inside mutable_state_json (commit 63a6cfb3).
+-- Old rows with _hitl* keys inside mutable_state_json are still handled by the
+-- repository's legacy-fallback load path until re-saved with the new column.
+
+ALTER TABLE "Run" ADD COLUMN "hitl_state_json" TEXT;

package/prisma/migrations.sqlite/20260527130000_add_hmac_nonce/migration.sql

@@ -0,0 +1,9 @@
+-- Migration: Durable HMAC nonce store for replay protection (T6 security fix, SQLite variant).
+-- Mirrors the PostgreSQL migration but uses TEXT for the timestamp column (SQLite has no native TIMESTAMP type).
+
+CREATE TABLE "hmac_nonce" (
+    "nonce"      TEXT NOT NULL PRIMARY KEY,
+    "expires_at" DATETIME NOT NULL
+);
+
+CREATE INDEX "hmac_nonce_expires_at_idx" ON "hmac_nonce"("expires_at");

package/prisma/schema.postgresql.prisma

@@ -22,6 +22,7 @@ model Run {
   policySnapshotJson   String? @map("policy_snapshot_json")
   engineCountersJson   String? @map("engine_counters_json")
   mutableStateJson     String? @map("mutable_state_json")
+  hitlStateJson        String? @map("hitl_state_json")
   outputsByNodeJson    String  @map("outputs_by_node_json")
   updatedAt            String  @map("updated_at")
   testSuiteRunId       String? @map("test_suite_run_id")
@@ -344,6 +345,10 @@ model CredentialInstance {
   setupStatus      String @map("setup_status")
   createdAt        String @map("created_at")
   updatedAt        String @map("updated_at")
+  // Material provider seam — see docs/design/credentials-oauth-unification.md.
+  // Pointer to where the bytes live (workspace DB vs control plane).
+  materialSource   String @default("local") @map("material_source")
+  materialRef      String @default("") @map("material_ref")
 }
 
 model CredentialSecretMaterial {
@@ -507,3 +512,46 @@ model WorkflowAuditLog {
   @@index([workflowId, occurredAt])
   @@map("workflow_audit_log")
 }
+
+/// HMAC nonce store for replay protection (T6 security fix).
+/// Nonces are persisted across process restarts so a replayed request within
+/// the 300-second timestamp window is rejected even after a restart.
+model HmacNonce {
+  nonce     String   @id @map("nonce")
+  expiresAt DateTime @map("expires_at")
+
+  @@index([expiresAt])
+  @@map("hmac_nonce")
+}
+
+model HumanTask {
+  id                 String    @id @map("id")
+  runId              String    @map("run_id")
+  workflowId         String    @map("workflow_id")
+  workspaceId        String?   @map("workspace_id")
+  nodeId             String    @map("node_id")
+  activationId       String    @map("activation_id")
+  itemIndex          Int       @map("item_index")
+  /// pending | decided | timed_out | auto_accepted | cancelled
+  status             String    @map("status")
+  /// local | control-plane-inbox
+  channel            String    @map("channel")
+  subjectJson        String    @map("subject_json")
+  metadataJson       String    @map("metadata_json")
+  decisionSchemaJson String    @map("decision_schema_json")
+  decisionSchemaHash String    @map("decision_schema_hash")
+  /// halt | auto-accept
+  onTimeout          String    @map("on_timeout")
+  deliveryRefJson    String?   @map("delivery_ref_json")
+  decisionJson       String?   @map("decision_json")
+  decidedAt          DateTime? @map("decided_at")
+  decidedByJson      String?   @map("decided_by_json")
+  resumeTokenHash    String    @map("resume_token_hash")
+  expiresAt          DateTime  @map("expires_at")
+  createdAt          DateTime  @default(now()) @map("created_at")
+
+  @@index([runId])
+  @@index([workflowId, status])
+  @@index([workspaceId, status, expiresAt])
+  @@map("human_task")
+}

package/prisma/schema.sqlite.prisma

@@ -22,6 +22,7 @@ model Run {
   policySnapshotJson   String? @map("policy_snapshot_json")
   engineCountersJson   String? @map("engine_counters_json")
   mutableStateJson     String? @map("mutable_state_json")
+  hitlStateJson        String? @map("hitl_state_json")
   outputsByNodeJson    String  @map("outputs_by_node_json")
   updatedAt            String  @map("updated_at")
   testSuiteRunId       String? @map("test_suite_run_id")
@@ -345,6 +346,10 @@ model CredentialInstance {
   setupStatus      String @map("setup_status")
   createdAt        String @map("created_at")
   updatedAt        String @map("updated_at")
+  // Material provider seam — see docs/design/credentials-oauth-unification.md.
+  // Pointer to where the bytes live (workspace DB vs control plane).
+  materialSource   String @default("local") @map("material_source")
+  materialRef      String @default("") @map("material_ref")
 }
 
 model CredentialSecretMaterial {
@@ -507,3 +512,46 @@ model WorkflowAuditLog {
   @@index([workflowId, occurredAt])
   @@map("workflow_audit_log")
 }
+
+/// HMAC nonce store for replay protection (T6 security fix).
+/// Nonces are persisted across process restarts so a replayed request within
+/// the 300-second timestamp window is rejected even after a restart.
+model HmacNonce {
+  nonce     String   @id @map("nonce")
+  expiresAt DateTime @map("expires_at")
+
+  @@index([expiresAt])
+  @@map("hmac_nonce")
+}
+
+model HumanTask {
+  id                 String    @id @map("id")
+  runId              String    @map("run_id")
+  workflowId         String    @map("workflow_id")
+  workspaceId        String?   @map("workspace_id")
+  nodeId             String    @map("node_id")
+  activationId       String    @map("activation_id")
+  itemIndex          Int       @map("item_index")
+  /// pending | decided | timed_out | auto_accepted | cancelled
+  status             String    @map("status")
+  /// local | control-plane-inbox
+  channel            String    @map("channel")
+  subjectJson        String    @map("subject_json")
+  metadataJson       String    @map("metadata_json")
+  decisionSchemaJson String    @map("decision_schema_json")
+  decisionSchemaHash String    @map("decision_schema_hash")
+  /// halt | auto-accept
+  onTimeout          String    @map("on_timeout")
+  deliveryRefJson    String?   @map("delivery_ref_json")
+  decisionJson       String?   @map("decision_json")
+  decidedAt          DateTime? @map("decided_at")
+  decidedByJson      String?   @map("decided_by_json")
+  resumeTokenHash    String    @map("resume_token_hash")
+  expiresAt          DateTime  @map("expires_at")
+  createdAt          DateTime  @default(now()) @map("created_at")
+
+  @@index([runId])
+  @@index([workflowId, status])
+  @@index([workspaceId, status, expiresAt])
+  @@map("human_task")
+}