@positronic/cloudflare 0.0.63 → 0.0.64

package/dist/src/api/index.js

@@ -169,6 +169,13 @@ app.use('*', function(c, next) {
                     next()
                 ];
             }
+            // Ignore favicon requests (browsers auto-request this when loading pages)
+            if (c.req.path === '/favicon.ico') {
+                return [
+                    2,
+                    c.body(null, 204)
+                ];
+            }
             // Skip auth for viewing pages (GET /pages/:slug but not GET /pages/ or /pages/:slug/meta)
             if (c.req.method === 'GET' && c.req.path.startsWith('/pages/') && !c.req.path.endsWith('/meta')) {
                 return [

package/dist/src/api/webhooks/coordination.js

@@ -1,11 +1,3 @@
-function _array_like_to_array(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_with_holes(arr) {
-    if (Array.isArray(arr)) return arr;
-}
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -35,44 +27,6 @@ function _async_to_generator(fn) {
         });
     };
 }
-function _iterable_to_array_limit(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
-        }
-    }
-    return _arr;
-}
-function _non_iterable_rest() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _sliced_to_array(arr, i) {
-    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
-}
-function _unsupported_iterable_to_array(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
-}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -164,16 +118,16 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-import { isSignalValid, brainMachineDefinition } from '@positronic/core';
+import { isSignalValid, brainMachineDefinition, validateWebhookToken } from '@positronic/core';
 /**
  * Find a brain waiting for a webhook, queue the WEBHOOK_RESPONSE signal, and wake it up.
  * Returns a JSON response object suitable for returning from a webhook endpoint.
  *
  * This is the signal-based approach: webhook response data flows through the signal queue
  * rather than being passed directly to the resume method.
- */ export function queueWebhookAndWakeUp(context, slug, identifier, response) {
+ */ export function queueWebhookAndWakeUp(context, slug, identifier, response, submittedToken) {
     return _async_to_generator(function() {
-        var monitorId, monitorStub, brainRunId, run, validation, namespace, doId, stub;
+        var monitorId, monitorStub, result, brainRunId, expectedToken, tokenValidation, run, validation, namespace, doId, stub;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -184,11 +138,30 @@ import { isSignalValid, brainMachineDefinition } from '@positronic/core';
                         monitorStub.findWaitingBrain(slug, identifier)
                     ];
                 case 1:
-                    brainRunId = _state.sent();
-                    if (!brainRunId) return [
+                    result = _state.sent();
+                    if (!result) return [
                         3,
                         5
                     ];
+                    brainRunId = result.brainRunId, expectedToken = result.token;
+                    // Validate CSRF token
+                    tokenValidation = validateWebhookToken(expectedToken, submittedToken);
+                    if (!tokenValidation.valid) {
+                        return [
+                            2,
+                            {
+                                received: true,
+                                action: 'ignored',
+                                identifier: identifier,
+                                brainRunId: brainRunId,
+                                reason: tokenValidation.reason
+                            }
+                        ];
+                    }
+                    // Warn in dev mode when no token is present — may indicate an unprotected form
+                    if (!expectedToken && !submittedToken && context.env.NODE_ENV === 'development') {
+                        console.warn('[positronic] Webhook "'.concat(slug, '" received without a CSRF token. ') + "This is fine if you validate the request in your webhook handler, " + "but if this webhook receives form submissions from a page, consider " + "adding a token with generateFormToken(). See the docs for details.");
+                    }
                     return [
                         4,
                         monitorStub.getRun(brainRunId)
@@ -254,49 +227,5 @@ import { isSignalValid, brainMachineDefinition } from '@positronic/core';
         });
     })();
 }
-/**
- * Parse form data into a plain object, handling array fields.
- * Supports:
- * - name[] syntax for explicit arrays
- * - Multiple values with same key (converted to array)
- */ export function parseFormData(formData) {
-    var result = {};
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = formData.entries()[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array(_step.value, 2), key = _step_value[0], value = _step_value[1];
-            // Handle array fields (e.g., name[] for multi-select)
-            if (key.endsWith('[]')) {
-                var baseKey = key.slice(0, -2);
-                if (!result[baseKey]) {
-                    result[baseKey] = [];
-                }
-                result[baseKey].push(value);
-            } else if (result[key] !== undefined) {
-                // Convert to array if same key appears multiple times
-                if (!Array.isArray(result[key])) {
-                    result[key] = [
-                        result[key]
-                    ];
-                }
-                result[key].push(value);
-            } else {
-                result[key] = value;
-            }
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    return result;
-}
+// Re-export parseFormData from core for backwards compatibility
+export { parseFormData } from '@positronic/core';

package/dist/src/api/webhooks/index.js

@@ -197,7 +197,7 @@ webhooks.get('/', function(context) {
 // Receive incoming webhook from external service (user-defined webhooks)
 webhooks.post('/:slug', function(context) {
     return _async_to_generator(function() {
-        var slug, webhookManifest, webhook, handlerResult, result, error;
+        var slug, webhookManifest, webhook, clonedReq, handlerResult, submittedToken, contentType, formData, e, result, error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -216,10 +216,13 @@ webhooks.post('/:slug', function(context) {
                 case 1:
                     _state.trys.push([
                         1,
-                        4,
+                        8,
                         ,
-                        5
+                        9
                     ]);
+                    // Clone the request so we can extract the CSRF token separately
+                    // without consuming the body that the user's handler needs
+                    clonedReq = context.req.raw.clone();
                     return [
                         4,
                         webhook.handler(context.req.raw)
@@ -235,11 +238,44 @@ webhooks.post('/:slug', function(context) {
                             })
                         ];
                     }
+                    // Extract CSRF token from form submissions
+                    submittedToken = null;
+                    contentType = clonedReq.headers.get('content-type') || '';
+                    if (!(contentType.includes('form-urlencoded') || contentType.includes('form-data'))) return [
+                        3,
+                        6
+                    ];
+                    _state.label = 3;
+                case 3:
+                    _state.trys.push([
+                        3,
+                        5,
+                        ,
+                        6
+                    ]);
                     return [
                         4,
-                        queueWebhookAndWakeUp(context, slug, handlerResult.identifier, handlerResult.response)
+                        clonedReq.formData()
                     ];
-                case 3:
+                case 4:
+                    formData = _state.sent();
+                    submittedToken = formData.get('__positronic_token');
+                    return [
+                        3,
+                        6
+                    ];
+                case 5:
+                    e = _state.sent();
+                    return [
+                        3,
+                        6
+                    ];
+                case 6:
+                    return [
+                        4,
+                        queueWebhookAndWakeUp(context, slug, handlerResult.identifier, handlerResult.response, submittedToken)
+                    ];
+                case 7:
                     result = _state.sent();
                     // For user webhooks, return 'queued' instead of 'not_found' when no brain is waiting
                     // This allows webhooks to be received even when no brain is actively waiting
@@ -257,7 +293,7 @@ webhooks.post('/:slug', function(context) {
                         2,
                         context.json(result)
                     ];
-                case 4:
+                case 8:
                     error = _state.sent();
                     console.error("Error receiving webhook ".concat(slug, ":"), error);
                     return [
@@ -266,7 +302,7 @@ webhooks.post('/:slug', function(context) {
                             error: 'Failed to process webhook'
                         }, 500)
                     ];
-                case 5:
+                case 9:
                     return [
                         2
                     ];

package/dist/src/api/webhooks/system.js

@@ -181,7 +181,7 @@ var system = new Hono();
  * Content-Type: application/x-www-form-urlencoded or multipart/form-data
  */ system.post('/ui-form', function(context) {
     return _async_to_generator(function() {
-        var identifier, formData, response, result, error;
+        var identifier, formData, _parseFormData, response, token, result, error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -208,13 +208,32 @@ var system = new Hono();
                     ];
                 case 2:
                     formData = _state.sent();
-                    response = parseFormData(formData);
+                    _parseFormData = parseFormData(formData), response = _parseFormData.data, token = _parseFormData.token;
+                    // System ui-form endpoint always requires a CSRF token
+                    if (!token) {
+                        return [
+                            2,
+                            context.json({
+                                received: false,
+                                action: 'ignored',
+                                identifier: identifier,
+                                reason: 'Missing form token'
+                            }, 403)
+                        ];
+                    }
                     return [
                         4,
-                        queueWebhookAndWakeUp(context, 'ui-form', identifier, response)
+                        queueWebhookAndWakeUp(context, 'ui-form', identifier, response, token)
                     ];
                 case 3:
                     result = _state.sent();
+                    // Return 403 if token mismatch
+                    if (result.action === 'ignored' && result.reason === 'Invalid form token') {
+                        return [
+                            2,
+                            context.json(result, 403)
+                        ];
+                    }
                     // Return 404 if no brain was waiting
                     if (result.action === 'not_found') {
                         return [

package/dist/src/monitor-do.js

@@ -259,6 +259,12 @@ export var MonitorDO = /*#__PURE__*/ function(DurableObject) {
         _this.storage = state.storage.sql;
         // Update table schema and indexes
         _this.storage.exec("\n      CREATE TABLE IF NOT EXISTS brain_runs (\n        run_id TEXT PRIMARY KEY,\n        brain_title TEXT NOT NULL,\n        brain_description TEXT,\n        type TEXT NOT NULL,\n        status TEXT NOT NULL,\n        options TEXT,\n        error TEXT,\n        created_at INTEGER NOT NULL,\n        started_at INTEGER,\n        completed_at INTEGER\n      );\n\n      CREATE TABLE IF NOT EXISTS brain_events (\n        id INTEGER PRIMARY KEY AUTOINCREMENT,\n        run_id TEXT NOT NULL,\n        event_type TEXT NOT NULL,\n        event_data TEXT NOT NULL,\n        created_at INTEGER NOT NULL\n      );\n\n      CREATE INDEX IF NOT EXISTS idx_brain_events_run\n      ON brain_events(run_id, id);\n\n      CREATE INDEX IF NOT EXISTS idx_brain_status -- Renamed index\n      ON brain_runs(brain_title, status);\n\n      CREATE INDEX IF NOT EXISTS idx_brain_time -- Renamed index\n      ON brain_runs(created_at DESC);\n\n      CREATE TABLE IF NOT EXISTS webhook_registrations (\n        id INTEGER PRIMARY KEY AUTOINCREMENT,\n        slug TEXT NOT NULL,\n        identifier TEXT NOT NULL,\n        brain_run_id TEXT NOT NULL,\n        created_at INTEGER NOT NULL\n      );\n\n      CREATE INDEX IF NOT EXISTS idx_webhook_lookup\n      ON webhook_registrations(slug, identifier);\n\n      CREATE INDEX IF NOT EXISTS idx_webhook_brain_run\n      ON webhook_registrations(brain_run_id);\n\n      CREATE TABLE IF NOT EXISTS page_registrations (\n        id INTEGER PRIMARY KEY AUTOINCREMENT,\n        slug TEXT NOT NULL UNIQUE,\n        brain_run_id TEXT NOT NULL,\n        persist INTEGER NOT NULL DEFAULT 0,\n        created_at INTEGER NOT NULL\n      );\n\n      CREATE INDEX IF NOT EXISTS idx_page_brain_run\n      ON page_registrations(brain_run_id);\n\n      CREATE INDEX IF NOT EXISTS idx_page_persist\n      ON page_registrations(persist);\n    ");
+        // Migration: add token column to webhook_registrations
+        try {
+            _this.storage.exec("ALTER TABLE webhook_registrations ADD COLUMN token TEXT");
+        } catch (e) {
+        // Column already exists
+        }
         return _this;
     }
     _create_class(MonitorDO, [
@@ -476,18 +482,24 @@ export var MonitorDO = /*#__PURE__*/ function(DurableObject) {
    * Register a webhook to wait for
    * Called when a brain emits a WEBHOOK event
    */ key: "registerWebhook",
-            value: function registerWebhook(slug, identifier, brainRunId) {
-                this.storage.exec("\n      INSERT INTO webhook_registrations (slug, identifier, brain_run_id, created_at)\n      VALUES (?, ?, ?, ?)\n    ", slug, identifier, brainRunId, Date.now());
+            value: function registerWebhook(slug, identifier, brainRunId, token) {
+                this.storage.exec("\n      INSERT INTO webhook_registrations (slug, identifier, brain_run_id, token, created_at)\n      VALUES (?, ?, ?, ?, ?)\n    ", slug, identifier, brainRunId, token !== null && token !== void 0 ? token : null, Date.now());
             }
         },
         {
             /**
    * Find a brain waiting for this webhook
-   * Returns the brain_run_id if found, null otherwise
+   * Returns the brain_run_id and token if found, null otherwise
    */ key: "findWaitingBrain",
             value: function findWaitingBrain(slug, identifier) {
-                var results = this.storage.exec("\n      SELECT brain_run_id as brainRunId\n      FROM webhook_registrations\n      WHERE slug = ? AND identifier = ?\n      LIMIT 1\n    ", slug, identifier).toArray();
-                return results.length > 0 ? results[0].brainRunId : null;
+                var results = this.storage.exec("\n      SELECT brain_run_id as brainRunId, token\n      FROM webhook_registrations\n      WHERE slug = ? AND identifier = ?\n      LIMIT 1\n    ", slug, identifier).toArray();
+                if (results.length === 0) return null;
+                var row = results[0];
+                var _row_token;
+                return {
+                    brainRunId: row.brainRunId,
+                    token: (_row_token = row.token) !== null && _row_token !== void 0 ? _row_token : null
+                };
             }
         },
         {

package/dist/src/webhook-adapter.js

@@ -195,7 +195,7 @@ import { BRAIN_EVENTS } from '@positronic/core';
                                 registration = _step.value;
                                 return [
                                     4,
-                                    this.monitorStub.registerWebhook(registration.slug, registration.identifier, event.brainRunId)
+                                    this.monitorStub.registerWebhook(registration.slug, registration.identifier, event.brainRunId, registration.token)
                                 ];
                             case 3:
                                 _state.sent();

package/dist/types/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU3C,QAAA,MAAM,GAAG;cAAwB,QAAQ;yCAAK,CAAC;AA4D/C,eAAe,GAAG,CAAC;AAGnB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU3C,QAAA,MAAM,GAAG;cAAwB,QAAQ;yCAAK,CAAC;AAiE/C,eAAe,GAAG,CAAC;AAGnB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}

package/dist/types/api/webhooks/coordination.d.ts

@@ -18,7 +18,7 @@ export type WebhookHandlerResult = {
  * This is the signal-based approach: webhook response data flows through the signal queue
  * rather than being passed directly to the resume method.
  */
-export declare function queueWebhookAndWakeUp(context: Context, slug: string, identifier: string, response: Record<string, unknown>): Promise<{
+export declare function queueWebhookAndWakeUp(context: Context, slug: string, identifier: string, response: Record<string, unknown>, submittedToken?: string | null): Promise<{
     received: boolean;
     action: 'resumed' | 'not_found' | 'queued' | 'ignored';
     identifier: string;
@@ -26,11 +26,5 @@ export declare function queueWebhookAndWakeUp(context: Context, slug: string, id
     message?: string;
     reason?: string;
 }>;
-/**
- * Parse form data into a plain object, handling array fields.
- * Supports:
- * - name[] syntax for explicit arrays
- * - Multiple values with same key (converted to array)
- */
-export declare function parseFormData(formData: FormData): Record<string, unknown>;
+export { parseFormData } from '@positronic/core';
 //# sourceMappingURL=coordination.d.ts.map

package/dist/types/api/webhooks/coordination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordination.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/coordination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEhF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CA6CD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzE"}
+{"version":3,"file":"coordination.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/coordination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEhF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAoED;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types/api/webhooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,QAAA,MAAM,QAAQ;cAAwB,QAAQ;yCAAK,CAAC;AAgEpD,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,QAAA,MAAM,QAAQ;cAAwB,QAAQ;yCAAK,CAAC;AAiFpD,eAAe,QAAQ,CAAC"}

package/dist/types/api/webhooks/system.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,QAAA,MAAM,MAAM;cAAwB,QAAQ;yCAAK,CAAC;AAqClD,eAAe,MAAM,CAAC"}
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,QAAA,MAAM,MAAM;cAAwB,QAAQ;yCAAK,CAAC;AAoDlD,eAAe,MAAM,CAAC"}

package/dist/types/monitor-do.d.ts

@@ -22,12 +22,15 @@ export declare class MonitorDO extends DurableObject<Env> {
      * Register a webhook to wait for
      * Called when a brain emits a WEBHOOK event
      */
-    registerWebhook(slug: string, identifier: string, brainRunId: string): void;
+    registerWebhook(slug: string, identifier: string, brainRunId: string, token?: string): void;
     /**
      * Find a brain waiting for this webhook
-     * Returns the brain_run_id if found, null otherwise
+     * Returns the brain_run_id and token if found, null otherwise
      */
-    findWaitingBrain(slug: string, identifier: string): string | null;
+    findWaitingBrain(slug: string, identifier: string): {
+        brainRunId: string;
+        token: string | null;
+    } | null;
     /**
      * Clear all webhook registrations for a brain run
      * Called when brain completes, errors, or is cancelled

package/dist/types/monitor-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"monitor-do.d.ts","sourceRoot":"","sources":["../../src/monitor-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,GAAG;CAEnB;AAED,qBAAa,SAAU,SAAQ,aAAa,CAAC,GAAG,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,kBAAkB,CAA4B;IAEtD,OAAO,CAAC,QAAQ,CAAwC;gBAE5C,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG;IAkE/C,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;YAmHzB,sBAAsB;IA4B9B,KAAK,CAAC,OAAO,EAAE,OAAO;IAmE5B,YAAY,CAAC,UAAU,EAAE,MAAM;IAa/B;;;OAGG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM;IAqCzB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW;IA6B9C,UAAU,CAAC,UAAU,EAAE,MAAM;IA2B7B;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAapE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBjE;;;OAGG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM;IAU5C;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAgB/D;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM;IAU3B;;;OAGG;IACH,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAezD;;;OAGG;IACH,sBAAsB,CAAC,UAAU,EAAE,MAAM;CAU1C"}
+{"version":3,"file":"monitor-do.d.ts","sourceRoot":"","sources":["../../src/monitor-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,GAAG;CAEnB;AAED,qBAAa,SAAU,SAAQ,aAAa,CAAC,GAAG,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,kBAAkB,CAA4B;IAEtD,OAAO,CAAC,QAAQ,CAAwC;gBAE5C,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG;IAyE/C,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;YAmHzB,sBAAsB;IA4B9B,KAAK,CAAC,OAAO,EAAE,OAAO;IAmE5B,YAAY,CAAC,UAAU,EAAE,MAAM;IAa/B;;;OAGG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM;IAqCzB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW;IA6B9C,UAAU,CAAC,UAAU,EAAE,MAAM;IA2B7B;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;IAcpF;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAmBvG;;;OAGG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM;IAU5C;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAgB/D;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM;IAU3B;;;OAGG;IACH,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAezD;;;OAGG;IACH,sBAAsB,CAAC,UAAU,EAAE,MAAM;CAU1C"}

package/dist/types/webhook-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-adapter.d.ts","sourceRoot":"","sources":["../../src/webhook-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,qBAAa,cAAe,YAAW,OAAO;IAChC,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE;QAAE,eAAe,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAA;KAAE;IAE5E,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAejD"}
+{"version":3,"file":"webhook-adapter.d.ts","sourceRoot":"","sources":["../../src/webhook-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,qBAAa,cAAe,YAAW,OAAO;IAChC,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE;QAAE,eAAe,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAA;KAAE;IAE5E,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBjD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cloudflare",
-  "version": "0.0.63",
+  "version": "0.0.64",
   "publishConfig": {
     "access": "public"
   },
@@ -31,9 +31,9 @@
     "clean": "rm -rf tsconfig.tsbuildinfo dist"
   },
   "dependencies": {
-    "@positronic/core": "^0.0.63",
-    "@positronic/spec": "^0.0.63",
-    "@positronic/template-new-project": "^0.0.63",
+    "@positronic/core": "^0.0.64",
+    "@positronic/spec": "^0.0.64",
+    "@positronic/template-new-project": "^0.0.64",
     "aws4fetch": "^1.0.18",
     "caz": "^2.0.0",
     "cron-schedule": "^5.0.4",