@growthub/cli 0.14.10 → 0.14.11

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/workspace-data-model.js

@@ -895,6 +895,27 @@ const OBJECT_TYPE_PRESETS = {
       "version",
       "runLocality",
       "schedulerRegistryId",
+      "schedulerProviderId",
+      "schedulerProductId",
+      "schedulerRegion",
+      "scheduleId",
+      "schedulerCron",
+      "schedulerTriggerInput",
+      "schedulerDestination",
+      "schedulerCallbackUrl",
+      "schedulerFailureCallbackUrl",
+      "schedulerInstalledAt",
+      "schedulerPaused",
+      "schedulerPausedAt",
+      "schedulerResumedAt",
+      "lastScheduledRunStatus",
+      "lastScheduledRunMessageId",
+      "lastScheduledRunAttemptedAt",
+      "lastScheduledRunSucceededAt",
+      "lastScheduledRunFailedAt",
+      "lastScheduledRunFailureReason",
+      "lastScheduledRunBodyPreview",
+      "lastScheduledRunRetries",
       "runtime",
       "adapter",
       "agentHost",

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/workspace-operator-auth.js

@@ -0,0 +1,32 @@
+/**
+ * Mutation access boundary — single hook for operator/admin authorization on
+ * high-impact governed workspace mutations (schedule install/uninstall, provider
+ * sync, product sync). These routes can spend provider credentials, create/delete
+ * remote infrastructure, and mutate workspace config, so they must sit behind the
+ * SAME boundary as any governed write.
+ *
+ * In the open-source starter kit this is intentionally a NO-OP: the kit is
+ * local/dev-only unless the host application wraps these routes. Hosted
+ * deployments (e.g. Agency Portal / private) replace this with a real check —
+ * session/role, the same middleware that guards `/api/workspace`, or an app-scope
+ * gate — WITHOUT changing any route: every mutation route calls this one function.
+ *
+ * Returns { ok: true } when allowed, or { ok: false, status, error } to reject.
+ */
+
+function requireWorkspaceOperator(_request) {
+  // Starter kit: no built-in auth. Host app is responsible for protecting these
+  // routes (reverse proxy, middleware, or platform auth). Set
+  // GROWTHUB_REQUIRE_OPERATOR_AUTH=true with no provider configured to hard-block
+  // mutations on an unprotected public deployment.
+  if (String(process.env.GROWTHUB_REQUIRE_OPERATOR_AUTH || "").trim() === "true") {
+    return {
+      ok: false,
+      status: 403,
+      error: "operator authorization required but no operator auth provider is configured for this deployment",
+    };
+  }
+  return { ok: true };
+}
+
+export { requireWorkspaceOperator };

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/scripts/scheduler-ingress-smoke.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+const baseUrl = (process.argv[2] || "http://localhost:3000").replace(/\/+$/, "");
+
+const routes = [
+  "/api/workspace/workflows/upstash",
+  "/api/workspace/add-ons/upstash/callback",
+  "/api/workspace/add-ons/upstash/failure",
+];
+
+const methods = ["HEAD", "OPTIONS"];
+
+let failed = false;
+
+for (const route of routes) {
+  for (const method of methods) {
+    const response = await fetch(`${baseUrl}${route}`, { method, redirect: "manual" });
+    const ok = method === "HEAD"
+      ? response.status === 200
+      : response.status === 204 && String(response.headers.get("allow") || "").includes("POST");
+    console.log(`${method} ${route} -> ${response.status}${ok ? "" : " FAIL"}`);
+    if (!ok) failed = true;
+  }
+}
+
+if (failed) process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growthub/cli",
-  "version": "0.14.10",
+  "version": "0.14.11",
   "description": "CLI control plane for Growthub Local and Agent Workspace as Code: export, fork, inspect, operate, sync, and optionally activate governed AI workspaces.",
   "type": "module",
   "bin": {