runwork 0.13.4 → 0.14.0

package/bundled-types/core-endpoints.d.ts

@@ -10,9 +10,16 @@ import { z } from 'zod';
 import type { Hono } from 'hono';
 type ZodSchema = z.ZodType<any, any, any>;
 /**
- * Authentication type for public endpoints
+ * Authentication requirement declared by an endpoint definition.
  */
 export type EndpointAuthType = 'apiKey' | 'public';
+/**
+ * Caller principal type resolved by the platform and passed via the
+ * `X-Public-Endpoint-Auth-Type` header. `user` and `workspace_key` are
+ * authenticated principals the platform has already authorized; `api_key`
+ * additionally carries a validated key id; `none` is unauthenticated.
+ */
+export type EndpointPrincipalType = 'none' | 'api_key' | 'workspace_key' | 'user';
 /**
  * HTTP methods supported by endpoints
  */
@@ -53,10 +60,14 @@ export interface EndpointContext<TQuery = Record<string, unknown>, TBody = unkno
  * Authentication information passed to handlers
  */
 export interface EndpointAuthInfo {
-    /** Authentication type used */
+    /** Authentication requirement declared by the endpoint */
     type: EndpointAuthType;
-    /** API key ID (if authenticated with API key) */
+    /** Resolved caller principal type (api_key, workspace_key, user, none) */
+    principalType?: EndpointPrincipalType;
+    /** API key ID (if authenticated with an API key) */
     apiKeyId?: string;
+    /** User ID (if authenticated as a workspace member) */
+    userId?: string;
     /** Scopes granted to the API key */
     scopes?: string[];
     /** Whether request is authenticated */
@@ -112,8 +123,9 @@ export declare function isEndpointDefinition(entry: unknown): entry is EndpointD
 export interface ParsedEndpointRequest {
     endpointId: string;
     appId: string;
-    authType: EndpointAuthType;
+    authType: EndpointPrincipalType;
     apiKeyId?: string;
+    userId?: string;
     scopes?: string[];
 }
 /**

package/dist/agents/claude-desktop-plugin-tree.js

@@ -1,6 +1,6 @@
 import { chmodSync, mkdirSync, rmSync, existsSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { appendTokenToUrl, buildSkillMd } from './types.js';
+import { appendTokenToUrl, buildSkillMd, RUNWORK_WORKSPACE_MCP_NAME } from './types.js';
 import { SESSION_START_HOOK_SCRIPT } from './session-start-hook.js';
 /**
  * Write <destDir>/.claude-plugin/plugin.json.
@@ -24,13 +24,28 @@ export function writePluginMcpConfig(destDir, mcpServers) {
     mkdirSync(destDir, { recursive: true });
     const mcpEntries = {};
     for (const server of mcpServers) {
-        const token = server.headers?.Authorization?.replace(/^Bearer\s+/i, '');
-        const connectorUrl = token ? appendTokenToUrl(server.url, token) : server.url;
-        mcpEntries[server.name] = {
-            type: 'http',
-            url: connectorUrl,
-            ...(server.description ? { description: server.description } : {}),
-        };
+        if (server.name === RUNWORK_WORKSPACE_MCP_NAME) {
+            // Preserve the exact, known-working behavior for the Runwork connector: embed
+            // the workspace key in the URL, no headers field. Claude Desktop's native
+            // connector did not reliably honor request headers here, which is why the token
+            // lives in the URL — do NOT change this.
+            const token = server.headers?.Authorization?.replace(/^Bearer\s+/i, '');
+            mcpEntries[server.name] = {
+                type: 'http',
+                url: token ? appendTokenToUrl(server.url, token) : server.url,
+                ...(server.description ? { description: server.description } : {}),
+            };
+        }
+        else {
+            // Third-party servers: forward the auth header map (same .mcp.json schema
+            // claude-code uses). Their secrets must NEVER be placed in the URL.
+            mcpEntries[server.name] = {
+                type: 'http',
+                url: server.url,
+                ...(server.headers ? { headers: server.headers } : {}),
+                ...(server.description ? { description: server.description } : {}),
+            };
+        }
     }
     writeFileSync(join(destDir, '.mcp.json'), JSON.stringify({ mcpServers: mcpEntries }, null, 2));
 }

package/dist/agents/claude-desktop.js

@@ -189,12 +189,15 @@ export class ClaudeDesktopAdapter {
         // For cowork connectors, embed the auth token in the URL query string.
         // This lets Claude Desktop connect without requiring the user to go through
         // an OAuth flow or manually click "Connect" in the Connectors UI.
-        // Write to claude_desktop_config.json via mcp-remote (chat mode fallback)
+        // Write to claude_desktop_config.json via mcp-remote (chat mode fallback).
+        // Forward every auth header (Authorization, X-Api-Key, etc.) as a --header arg.
         const entries = {};
         for (const s of servers) {
             const args = ['mcp-remote', s.url];
-            if (s.headers?.Authorization) {
-                args.push('--header', `Authorization:${s.headers.Authorization}`);
+            if (s.headers) {
+                for (const [name, value] of Object.entries(s.headers)) {
+                    args.push('--header', `${name}:${value}`);
+                }
             }
             entries[s.name] = {
                 command: 'npx',

package/dist/agents/codex.js

@@ -45,15 +45,23 @@ export class CodexAdapter {
                 delete mcpServers[key];
             }
         }
-        // Add new entries (sanitize names to match Codex's ^[a-zA-Z0-9_-]+$ requirement)
+        // Add new entries (sanitize names to match Codex's ^[a-zA-Z0-9_-]+$ requirement).
         for (const s of servers) {
             const safeName = s.name.replace(/[^a-zA-Z0-9_-]/g, '-').replace(/-+/g, '-').replace(/^-|-$/g, '');
-            // Embed auth token in URL so Codex doesn't need a separate env var
-            const token = s.headers?.Authorization?.replace(/^Bearer\s+/i, '');
-            const serverUrl = token ? appendTokenToUrl(s.url, token) : s.url;
-            mcpServers[safeName] = {
-                url: serverUrl,
-            };
+            const entry = { url: s.url };
+            if (s.name === RUNWORK_WORKSPACE_MCP_NAME) {
+                // Preserve the known-working behavior: embed the workspace key in the URL.
+                // Codex's header-based auth was historically unreliable here, so do NOT change it.
+                const token = s.headers?.Authorization?.replace(/^Bearer\s+/i, '');
+                if (token)
+                    entry.url = appendTokenToUrl(s.url, token);
+            }
+            else if (s.headers && Object.keys(s.headers).length > 0) {
+                // External servers: forward headers via Codex's documented http_headers field
+                // (static literal values). These had no prior working path, so this is additive.
+                entry.http_headers = s.headers;
+            }
+            mcpServers[safeName] = entry;
         }
         mkdirSync(join(configPath, '..'), { recursive: true });
         writeFileSync(configPath, stringify(parsed));

package/dist/api/client.d.ts

@@ -141,6 +141,11 @@ export declare class ApiClient {
         transport: 'sse' | 'streamable-http';
     }): Promise<McpServerConfig>;
     removeMcpServer(workspaceId: string, serverId: string): Promise<void>;
+    /**
+     * Resolve decrypted auth headers for header-auth MCP servers, scoped to the
+     * authenticated user (their own + workspace-wide credentials). Keyed by server id.
+     */
+    resolveMcpCredentials(workspaceId: string): Promise<Record<string, Record<string, string>>>;
     searchCommunitySkills(query: string, limit?: number, includeContent?: boolean): Promise<{
         query: string;
         count: number;

package/dist/api/client.js

@@ -194,6 +194,14 @@ export class ApiClient {
     async removeMcpServer(workspaceId, serverId) {
         await this.request(`/api/workspaces/${workspaceId}/mcp-servers/${serverId}`, { method: 'DELETE' });
     }
+    /**
+     * Resolve decrypted auth headers for header-auth MCP servers, scoped to the
+     * authenticated user (their own + workspace-wide credentials). Keyed by server id.
+     */
+    async resolveMcpCredentials(workspaceId) {
+        const res = await this.request(`/api/workspaces/${workspaceId}/mcp-credentials/resolved`);
+        return res.data.servers;
+    }
     // --- Community Marketplace ---
     async searchCommunitySkills(query, limit = 10, includeContent = false) {
         const res = await this.request(`/api/community/skills/search?q=${encodeURIComponent(query)}&limit=${limit}&include_content=${includeContent}`);

package/dist/commands/__tests__/mcp-entries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/mcp-entries.test.js

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { buildExternalMcpEntries } from '../mcp-entries.js';
+const PLATFORM_KEY = 'rk_ws_live_supersecretplatformkey';
+function server(overrides) {
+    return {
+        id: 'srv-1',
+        name: 'example',
+        url: 'https://mcp.example.com',
+        transport: 'streamable-http',
+        enabled: true,
+        addedAt: 0,
+        addedBy: 'user-1',
+        ...overrides,
+    };
+}
+describe('buildExternalMcpEntries', () => {
+    it('never injects the Runwork platform key onto external entries', () => {
+        const entries = buildExternalMcpEntries([
+            server({ id: 'a', authType: 'header' }),
+            server({ id: 'b', authType: 'oauth' }),
+            server({ id: 'c', authType: 'none' }),
+            server({ id: 'd' }), // authType unset
+        ], { a: { Authorization: 'Bearer user-token' } });
+        // Regression: the platform key must not appear anywhere in the output.
+        expect(JSON.stringify(entries)).not.toContain(PLATFORM_KEY);
+    });
+    it('injects resolved per-server headers for header-auth servers', () => {
+        const entries = buildExternalMcpEntries([server({ id: 'a', authType: 'header' })], { a: { Authorization: 'Bearer tok', 'X-Api-Key': 'key123' } });
+        expect(entries[0].headers).toEqual({ Authorization: 'Bearer tok', 'X-Api-Key': 'key123' });
+    });
+    it('emits no auth header for oauth servers (local agent runs its own flow)', () => {
+        const entries = buildExternalMcpEntries([server({ id: 'a', authType: 'oauth' })], { a: { Authorization: 'Bearer should-not-be-used' } });
+        expect(entries[0].headers).toBeUndefined();
+    });
+    it('emits no auth header for none/unset servers', () => {
+        const entries = buildExternalMcpEntries([server({ id: 'a', authType: 'none' }), server({ id: 'b' })], {});
+        expect(entries[0].headers).toBeUndefined();
+        expect(entries[1].headers).toBeUndefined();
+    });
+    it('omits headers when a header-auth server has no resolved credentials', () => {
+        const entries = buildExternalMcpEntries([server({ id: 'a', authType: 'header' })], {});
+        expect(entries[0].headers).toBeUndefined();
+    });
+    it('skips disabled servers', () => {
+        const entries = buildExternalMcpEntries([server({ id: 'a', enabled: false })], {});
+        expect(entries).toHaveLength(0);
+    });
+});

package/dist/commands/mcp-entries.d.ts

@@ -0,0 +1,13 @@
+import type { McpServerConfig } from '../types.js';
+import type { McpServerEntry } from '../agents/types.js';
+/**
+ * Build local-agent MCP entries for external (third-party) servers added to the
+ * workspace. Auth handling by `authType`:
+ * - 'header': inject the user's resolved per-server headers (decrypted server-side).
+ * - 'oauth': emit no auth header so the local agent runs its own browser flow.
+ * - 'none'/unset: no auth header.
+ *
+ * Critically, external entries never receive the Runwork platform API key. That key
+ * belongs only on the Runwork workspace-tools entry, which is added separately.
+ */
+export declare function buildExternalMcpEntries(mcpServers: McpServerConfig[], resolvedCredentials: Record<string, Record<string, string>>): McpServerEntry[];

package/dist/commands/mcp-entries.js

@@ -0,0 +1,26 @@
+import { RUNWORK_MCP_PREFIX } from '../agents/types.js';
+/**
+ * Build local-agent MCP entries for external (third-party) servers added to the
+ * workspace. Auth handling by `authType`:
+ * - 'header': inject the user's resolved per-server headers (decrypted server-side).
+ * - 'oauth': emit no auth header so the local agent runs its own browser flow.
+ * - 'none'/unset: no auth header.
+ *
+ * Critically, external entries never receive the Runwork platform API key. That key
+ * belongs only on the Runwork workspace-tools entry, which is added separately.
+ */
+export function buildExternalMcpEntries(mcpServers, resolvedCredentials) {
+    return mcpServers
+        .filter(s => s.enabled)
+        .map(s => {
+        const resolved = s.authType === 'header' ? resolvedCredentials[s.id] : undefined;
+        const headers = resolved && Object.keys(resolved).length > 0 ? resolved : undefined;
+        return {
+            name: `${RUNWORK_MCP_PREFIX}${s.name}`,
+            url: s.url,
+            transport: s.transport,
+            ...(headers ? { headers } : {}),
+            description: `Runwork MCP server: ${s.name}. Provides tools for interacting with this workspace resource.`,
+        };
+    });
+}

package/dist/commands/sync.js

@@ -7,6 +7,7 @@ import { ApiClient } from '../api/client.js';
 import { getAdapterBySlug, detectAgents } from '../agents/detect.js';
 import { CodexAdapter } from '../agents/codex.js';
 import { RUNWORK_MCP_PREFIX, RUNWORK_WORKSPACE_MCP_NAME } from '../agents/types.js';
+import { buildExternalMcpEntries } from './mcp-entries.js';
 import { RUNWORK_AGENT_DEFAULTS, AGENT_DEFAULTS_SCHEMA_VERSION } from '../agents/default-config.js';
 import { resolveAgentDefaults } from '../agents/defaults-merge.js';
 import { collectTelemetryEvents, printTelemetryVerbose, summarizeTelemetryForDryRun, } from './sync-telemetry.js';
@@ -135,7 +136,7 @@ export async function syncFromState(state, statePath, credentials, opts) {
     }
     console.log('  Fetching workspace data...');
     // Fetch latest data (includeContent=true gets all skill content in one request)
-    const [allSkills, mcpServers, externalSkills, registries, connectedIntegrations] = await Promise.all([
+    const [allSkills, mcpServers, externalSkills, registries, connectedIntegrations, resolvedMcpCredentials] = await Promise.all([
         client.listWorkspaceSkills(state.workspaceId, true),
         client.listMcpServers(state.workspaceId),
         client.listExternalSkills(state.workspaceId),
@@ -143,6 +144,9 @@ export async function syncFromState(state, statePath, credentials, opts) {
         client.listConnectedIntegrations(state.workspaceId)
             .then(list => list.map(i => i.canonicalId ?? i.integrationId))
             .catch(() => []),
+        // Decrypted auth headers for header-auth servers, scoped to this user.
+        // Tolerate older backends that lack the endpoint.
+        client.resolveMcpCredentials(state.workspaceId).catch(() => ({})),
     ]);
     const appCount = allSkills.filter(s => s.type === 'app').length;
     const parts = [];
@@ -167,15 +171,7 @@ export async function syncFromState(state, statePath, credentials, opts) {
     }
     // Build MCP entries (pull-only)
     const baseUrl = credentials.baseUrl || 'https://runwork.ai';
-    const mcpEntries = mcpServers
-        .filter(s => s.enabled)
-        .map(s => ({
-        name: `${RUNWORK_MCP_PREFIX}${s.name}`,
-        url: s.url,
-        transport: s.transport,
-        headers: { Authorization: `Bearer ${credentials.apiKey}` },
-        description: `Runwork MCP server: ${s.name}. Provides tools for interacting with this workspace resource.`,
-    }));
+    const mcpEntries = buildExternalMcpEntries(mcpServers, resolvedMcpCredentials);
     mcpEntries.push({
         name: RUNWORK_WORKSPACE_MCP_NAME,
         url: `${baseUrl}/api/workspaces/${state.workspaceId}/mcp`,

package/dist/generated/bundled-types.js

@@ -37,7 +37,7 @@ export const BUNDLED_TYPES = {
     "core-types.d.ts": "/**\n * This file defines default types provided by the platform.\n * DO NOT EDIT THIS FILE. You can define your own types in `shared/types.ts` file.\n */\nexport interface ApiResponse<T = unknown> {\n    success: boolean;\n    data?: T;\n    error?: string;\n}\n/**\n * Response from a Nango action or sync trigger\n */\nexport interface NangoActionResponse<T = unknown> {\n    success: boolean;\n    data?: T;\n    error?: string;\n    /** True if error is due to missing integration connection (user hasn't connected yet) */\n    isConnectionError?: boolean;\n    /** True if error is due to insufficient permissions/scopes (401/403 from external API) */\n    isPermissionError?: boolean;\n    /** HTTP status code from the external API (if available) */\n    statusCode?: number;\n}\n/**\n * Nango proxy request options - used for direct API calls through Nango\n */\nexport interface NangoProxyOptions {\n    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n    endpoint: string;\n    providerConfigKey: string;\n    data?: Record<string, unknown>;\n    headers?: Record<string, string>;\n    params?: Record<string, string>;\n    retries?: number;\n}\n/**\n * Metadata for a stored file\n */\nexport interface FileMetadata {\n    id: string;\n    key: string;\n    name: string;\n    size: number;\n    contentType: string;\n    uploadedAt: number;\n    uploadedBy?: string;\n    customMetadata?: Record<string, string>;\n}\n/**\n * Options for uploading a file\n */\nexport interface UploadOptions {\n    key?: string;\n    name?: string;\n    contentType?: string;\n    uploadedBy?: string;\n    customMetadata?: Record<string, string>;\n}\n/**\n * Options for downloading a file\n */\nexport interface DownloadOptions {\n    range?: {\n        offset?: number;\n        length?: number;\n    };\n}\n/**\n * Options for listing files\n */\nexport interface ListFilesOptions {\n    prefix?: string;\n    limit?: number;\n    cursor?: string;\n    delimiter?: string;\n}\n/**\n * Result of listing files\n */\nexport interface ListFilesResult {\n    files: FileMetadata[];\n    cursor?: string;\n    truncated: boolean;\n}\n/**\n * Request for generating a presigned URL\n */\nexport interface PresignedUrlRequest {\n    appId: string;\n    key: string;\n    action: 'read' | 'write';\n    contentType?: string;\n    expiresIn?: number;\n}\n/**\n * Response containing a presigned URL\n */\nexport interface PresignedUrlResponse {\n    url: string;\n    expiresAt: number;\n}\n",
     "core-workflow-types.d.ts": "/**\n * Workflow Types - Shared types for native workflow engine\n * DO NOT MODIFY THIS FILE - You may break the project functionality\n */\nimport type { Env } from './core-utils';\nimport type { IntegrationClient } from './core-integrations';\nexport type NativeWorkflowStatus = 'pending' | 'running' | 'sleeping' | 'waiting' | 'paused' | 'completed' | 'failed' | 'cancelled' | 'timedOut';\nexport type NativeStepStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped';\nexport type NativeStepType = 'do' | 'sleep' | 'sleepUntil' | 'waitEvent';\nexport interface NativeWorkflowError {\n    code: string;\n    message: string;\n    stack?: string;\n    retryable: boolean;\n}\nexport interface NativeStepAttempt {\n    attemptNumber: number;\n    startedAt: number;\n    completedAt?: number;\n    error?: NativeWorkflowError;\n}\nexport interface NativeStepExecution {\n    id: string;\n    name: string;\n    type: NativeStepType;\n    status: NativeStepStatus;\n    input?: unknown;\n    output?: unknown;\n    error?: NativeWorkflowError;\n    attempts: NativeStepAttempt[];\n    maxRetries: number;\n    startedAt?: number;\n    completedAt?: number;\n    timeoutMs?: number;\n    sleepUntil?: number;\n    eventType?: string;\n    eventTimeoutAt?: number;\n}\nexport interface NativeWorkflowInstance {\n    id: string;\n    workflowName: string;\n    status: NativeWorkflowStatus;\n    input: unknown;\n    output?: unknown;\n    error?: NativeWorkflowError;\n    createdAt: number;\n    startedAt?: number;\n    completedAt?: number;\n    steps: NativeStepExecution[];\n    currentStepId?: string;\n    config: NativeWorkflowConfig;\n    metadata?: Record<string, unknown>;\n}\nexport interface NativeWorkflowConfig {\n    maxRetries: number;\n    retryBackoffMs: number;\n    stepTimeoutMs: number;\n    workflowTimeoutMs: number;\n}\nexport declare const DEFAULT_WORKFLOW_CONFIG: NativeWorkflowConfig;\nexport interface NativeStepContext {\n    /** Unique instance ID for this workflow execution */\n    instanceId: string;\n    /** Input passed when workflow was started */\n    workflowInput: unknown;\n    /** Results from previous steps */\n    previousSteps: Record<string, {\n        output: unknown;\n        status: NativeStepStatus;\n    }>;\n}\nexport interface WorkflowIndexEntry {\n    instanceId: string;\n    workflowName: string;\n    status: NativeWorkflowStatus;\n    createdAt: number;\n    completedAt?: number;\n}\nexport interface ListWorkflowsOptions {\n    workflowName?: string;\n    status?: NativeWorkflowStatus;\n    limit?: number;\n    offset?: number;\n}\nexport interface ExecuteStepRequest {\n    instanceId: string;\n    stepId: string;\n    stepName: string;\n    workflowName: string;\n    workflowInput: unknown;\n    previousSteps: Record<string, {\n        output: unknown;\n        status: NativeStepStatus;\n    }>;\n}\nexport interface ExecuteStepResponse {\n    success: boolean;\n    output?: unknown;\n    error?: NativeWorkflowError;\n}\nexport interface PendingEvent {\n    instanceId: string;\n    stepId: string;\n    eventType: string;\n    waitingSince: number;\n    timeoutAt?: number;\n}\nexport interface ReceivedEvent {\n    type: string;\n    payload: unknown;\n    timestamp: number;\n}\n/**\n * Result returned by a workflow execution\n */\nexport interface WorkflowResult {\n    success: boolean;\n    [key: string]: unknown;\n}\n/**\n * Possible states of a workflow instance\n */\nexport type WorkflowStatus = 'queued' | 'running' | 'paused' | 'errored' | 'terminated' | 'complete' | 'waiting';\n/**\n * Information about a workflow instance\n */\nexport interface WorkflowInstanceInfo {\n    id: string;\n    workflowName: string;\n    status: WorkflowStatus;\n    params?: Record<string, unknown>;\n    createdAt: number;\n    startedAt?: number;\n    completedAt?: number;\n    error?: string;\n    result?: WorkflowResult;\n}\n/**\n * Interface for WorkflowInstance DO stub methods\n * Used to type the DurableObjectStub without importing the class\n */\nexport interface WorkflowInstanceStub {\n    create(workflowName: string, params: Record<string, unknown>, instanceId: string, config?: Partial<NativeWorkflowConfig>, metadata?: Record<string, unknown>): Promise<void>;\n    getStatus(): Promise<NativeWorkflowInstance | null>;\n    signal(eventType: string, payload: unknown): Promise<void>;\n    pause(): Promise<void>;\n    resume(): Promise<void>;\n    cancel(): Promise<void>;\n}\n/**\n * Interface for WorkflowCoordinator DO stub methods\n * Used to type the DurableObjectStub without importing the class\n */\nexport interface WorkflowCoordinatorStub {\n    create(workflowName: string, params: Record<string, unknown>, config?: Partial<NativeWorkflowConfig>, metadata?: Record<string, unknown>): Promise<string>;\n    signal(instanceId: string, eventType: string, payload: unknown): Promise<void>;\n    getInstanceInfo(instanceId: string): Promise<WorkflowInstanceInfo | null>;\n    listInstances(options?: ListWorkflowsOptions): Promise<WorkflowInstanceInfo[]>;\n    updateIndex(instanceId: string, workflowName: string, status: NativeWorkflowStatus): Promise<void>;\n    pause(instanceId: string): Promise<void>;\n    resume(instanceId: string): Promise<void>;\n    cancel(instanceId: string): Promise<void>;\n}\n/**\n * Definition for a workflow handler\n */\nexport interface WorkflowDefinition<TParams = unknown, TResult = unknown> {\n    /** Unique name for this workflow (kebab-case, e.g., \"order-fulfillment\") */\n    name: string;\n    /** Human-readable description of what this workflow does */\n    description?: string;\n    /** The workflow handler function */\n    handler: (ctx: WorkflowContext<TParams>) => Promise<TResult>;\n    /** Whether the workflow is enabled (default: true) */\n    enabled?: boolean;\n}\n/**\n * Context passed to workflow handlers\n */\nexport interface WorkflowContext<TParams = unknown> {\n    /** Environment bindings */\n    env: Env;\n    /** Unique instance ID for this workflow execution */\n    instanceId: string;\n    /** Parameters passed when workflow was started */\n    params: TParams;\n    /** Step utilities for durable execution */\n    step: WorkflowStepUtilities;\n    /** Integration client for external service calls */\n    integrations: IntegrationClient;\n    /** Logger for structured workflow logging */\n    logger: WorkflowLogger;\n}\n/**\n * Step utilities for durable workflow execution\n */\nexport interface WorkflowStepUtilities {\n    /** Execute a step with automatic retry and persistence */\n    do<T>(name: string, fn: () => Promise<T>): Promise<T>;\n    do<T>(name: string, options: StepOptions, fn: () => Promise<T>): Promise<T>;\n    /** Sleep for a duration (e.g., '5 minutes', '1 hour', '24 hours') */\n    sleep(name: string, duration: string): Promise<void>;\n    /** Sleep until a specific timestamp */\n    sleepUntil(name: string, timestamp: Date): Promise<void>;\n    /** Wait for an external event */\n    waitForEvent<T = unknown>(name: string, options?: WaitEventOptions): Promise<T>;\n}\n/**\n * Options for step execution\n */\nexport interface StepOptions {\n    retries?: {\n        limit: number;\n        delay: string;\n        backoff?: 'constant' | 'linear' | 'exponential';\n    };\n    timeout?: string;\n}\n/**\n * Options for waitForEvent\n */\nexport interface WaitEventOptions {\n    type?: string;\n    timeout?: string;\n}\n/**\n * Logger interface for workflow execution\n */\nexport interface WorkflowLogger {\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n}\n/**\n * State of a registered workflow\n */\nexport interface WorkflowState {\n    name: string;\n    description?: string;\n    enabled: boolean;\n    activeInstances: number;\n    totalRuns: number;\n    lastRun: number | null;\n    lastError?: string;\n}\n/**\n * Response from workflow status API\n */\nexport interface WorkflowStatusResponse {\n    workflows: WorkflowState[];\n}\n",
     "workflows.d.ts": "import type { WorkflowDefinition } from './core-workflow-types';\n/**\n * APP_WORKFLOWS - runtime accessor for registered workflow definitions.\n * Used by internal dynamic imports in core-workflow-cloudflare and core-workflow-instance.\n * This is a getter-backed constant so it always reflects the current registry state.\n */\nexport declare const APP_WORKFLOWS: WorkflowDefinition[];\nexport { triggerWorkflow, sendWorkflowEvent, getWorkflowStatus, workflowRoutes, } from './core-workflows';\nexport type { WorkflowResult, WorkflowStatus, WorkflowInstanceInfo, WorkflowDefinition, WorkflowContext, WorkflowStepUtilities, StepOptions, WaitEventOptions, WorkflowLogger, WorkflowState, WorkflowStatusResponse, } from './core-workflows';\nexport type { NativeWorkflowStatus, NativeStepStatus, NativeStepType, NativeWorkflowError, NativeStepAttempt, NativeStepExecution, NativeWorkflowInstance, NativeWorkflowConfig, NativeStepContext, WorkflowIndexEntry, ListWorkflowsOptions, ExecuteStepRequest, ExecuteStepResponse, PendingEvent, ReceivedEvent, WorkflowInstanceStub, WorkflowCoordinatorStub, } from './core-workflow-types';\nexport { DEFAULT_WORKFLOW_CONFIG } from './core-workflow-types';\nexport { WORKFLOW_INFRA_MODE } from './core-workflow-config';\nexport { WorkflowInstanceDO } from './core-workflow-instance';\nexport { WorkflowCoordinator } from './core-workflow-coordinator';\nexport { WorkflowPausedError, isWorkflowControlSignal } from './core-workflow-instance';\n",
-    "core-endpoints.d.ts": "/**\n * Core Public Endpoints Framework\n * DO NOT MODIFY THIS FILE - You may break the project functionality\n *\n * This module provides the infrastructure for exposing public API endpoints\n * that external systems can consume with API key authentication or public access.\n */\nimport { type Env } from './core-utils';\nimport { z } from 'zod';\nimport type { Hono } from 'hono';\ntype ZodSchema = z.ZodType<any, any, any>;\n/**\n * Authentication type for public endpoints\n */\nexport type EndpointAuthType = 'apiKey' | 'public';\n/**\n * HTTP methods supported by endpoints\n */\nexport type EndpointMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n/**\n * Schema definition for endpoint validation\n */\nexport interface EndpointSchema<TQuery = unknown, TBody = unknown, TResponse = unknown> {\n    /** Query parameters schema */\n    query?: ZodSchema;\n    /** Request body schema (for POST/PUT/PATCH) */\n    body?: ZodSchema;\n    /** Response schema for documentation */\n    response?: ZodSchema;\n}\n/**\n * Context provided to endpoint handlers\n */\nexport interface EndpointContext<TQuery = Record<string, unknown>, TBody = unknown> {\n    /** Environment bindings */\n    env: Env;\n    /** Original request object */\n    request: Request;\n    /** Validated query parameters */\n    query: TQuery;\n    /** Validated request body (null for GET/DELETE) */\n    body: TBody | null;\n    /** Path parameters extracted from URL */\n    params: Record<string, string>;\n    /** Authentication information */\n    auth: EndpointAuthInfo;\n    /** Request headers */\n    headers: Headers;\n    /** Logger for endpoint operations */\n    logger: EndpointLogger;\n}\n/**\n * Authentication information passed to handlers\n */\nexport interface EndpointAuthInfo {\n    /** Authentication type used */\n    type: EndpointAuthType;\n    /** API key ID (if authenticated with API key) */\n    apiKeyId?: string;\n    /** Scopes granted to the API key */\n    scopes?: string[];\n    /** Whether request is authenticated */\n    authenticated: boolean;\n}\n/**\n * Logger for endpoint operations\n */\nexport interface EndpointLogger {\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n}\n/**\n * Metadata for endpoint documentation\n */\nexport interface EndpointMeta {\n    /** Human-readable description */\n    description?: string;\n    /** Tags for grouping in documentation */\n    tags?: string[];\n    /** Deprecated flag */\n    deprecated?: boolean;\n    /** Deprecation message */\n    deprecationMessage?: string;\n}\n/**\n * Public endpoint definition\n */\nexport interface EndpointDefinition<TQuery = Record<string, unknown>, TBody = unknown, TResponse = unknown> {\n    /** URL path (e.g., '/v1/todos', '/users/:id') */\n    path: string;\n    /** HTTP method */\n    method: EndpointMethod;\n    /** Authentication requirement */\n    auth: EndpointAuthType;\n    /** Validation schemas */\n    schema?: EndpointSchema<TQuery, TBody, TResponse>;\n    /** Request handler */\n    handler: EndpointHandler<TQuery, TBody, TResponse>;\n    /** Endpoint metadata for documentation */\n    meta?: EndpointMeta;\n}\n/**\n * Endpoint handler function type\n */\nexport type EndpointHandler<TQuery = Record<string, unknown>, TBody = unknown, TResponse = unknown> = (ctx: EndpointContext<TQuery, TBody>) => Promise<TResponse>;\n/** Type guard to distinguish EndpointDefinition from function-based route registrars */\nexport declare function isEndpointDefinition(entry: unknown): entry is EndpointDefinition;\n/**\n * Internal: Parsed endpoint info from request headers\n */\nexport interface ParsedEndpointRequest {\n    endpointId: string;\n    appId: string;\n    authType: EndpointAuthType;\n    apiKeyId?: string;\n    scopes?: string[];\n}\n/**\n * Create a JSON response\n */\nexport declare function jsonResponse<T>(data: T, status?: number): Response;\n/**\n * Create an error response\n */\nexport declare function errorResponse(message: string, status?: number, code?: string): Response;\n/**\n * Convert Zod schema to JSON Schema for documentation\n * This is a simplified conversion that handles common cases\n */\nexport declare function zodToJsonSchema(schema: ZodSchema | undefined): Record<string, unknown> | undefined;\n/**\n * Endpoint router that matches requests to handlers\n */\nexport declare class EndpointRouter {\n    private endpoints;\n    /**\n     * Register endpoints\n     */\n    register(endpoints: EndpointDefinition<unknown, unknown, unknown>[]): void;\n    /**\n     * Find endpoint matching the request\n     */\n    findEndpoint(method: string, path: string): {\n        endpoint: EndpointDefinition<unknown, unknown, unknown>;\n        params: Record<string, string>;\n    } | null;\n    /**\n     * Get all registered endpoints for documentation\n     */\n    getAllEndpoints(): EndpointDefinition<unknown, unknown, unknown>[];\n}\n/**\n * Mount an EndpointDefinition as a native Hono route.\n *\n * Registers the endpoint at its natural path using the correct HTTP method,\n * with Zod validation for query/body schemas and full EndpointContext support.\n * This allows EndpointDefinition entries in APP_ROUTES to work as first-class\n * Hono routes with middleware, streaming, and WebSocket support intact.\n */\nexport declare function mountEndpointAsHonoRoute(app: Hono<{\n    Bindings: Env;\n}>, endpoint: EndpointDefinition): void;\n/**\n * Handle an incoming public endpoint request.\n * Called by the platform when routing requests to the app.\n */\nexport declare function handleEndpointRequest<TQuery = unknown, TBody = unknown, TResponse = unknown>(request: Request, env: Env, endpoints: EndpointDefinition<TQuery, TBody, TResponse>[]): Promise<Response>;\n/**\n * Custom error for endpoint handlers\n * Use this to return specific HTTP status codes\n */\nexport declare class EndpointError extends Error {\n    status: number;\n    code?: string | undefined;\n    constructor(message: string, status?: number, code?: string | undefined);\n    static badRequest(message: string): EndpointError;\n    static unauthorized(message?: string): EndpointError;\n    static forbidden(message?: string): EndpointError;\n    static notFound(message?: string): EndpointError;\n    static conflict(message: string): EndpointError;\n}\n/**\n * Convert endpoint definition to registration data for workspace\n */\nexport declare function endpointToRegistration<TQuery = unknown, TBody = unknown, TResponse = unknown>(endpoint: EndpointDefinition<TQuery, TBody, TResponse>): {\n    path: string;\n    method: EndpointMethod;\n    auth: EndpointAuthType;\n    description?: string;\n    tags?: string[];\n    schema?: {\n        query?: Record<string, unknown>;\n        body?: Record<string, unknown>;\n        response?: Record<string, unknown>;\n    };\n};\nexport {};\n",
+    "core-endpoints.d.ts": "/**\n * Core Public Endpoints Framework\n * DO NOT MODIFY THIS FILE - You may break the project functionality\n *\n * This module provides the infrastructure for exposing public API endpoints\n * that external systems can consume with API key authentication or public access.\n */\nimport { type Env } from './core-utils';\nimport { z } from 'zod';\nimport type { Hono } from 'hono';\ntype ZodSchema = z.ZodType<any, any, any>;\n/**\n * Authentication requirement declared by an endpoint definition.\n */\nexport type EndpointAuthType = 'apiKey' | 'public';\n/**\n * Caller principal type resolved by the platform and passed via the\n * `X-Public-Endpoint-Auth-Type` header. `user` and `workspace_key` are\n * authenticated principals the platform has already authorized; `api_key`\n * additionally carries a validated key id; `none` is unauthenticated.\n */\nexport type EndpointPrincipalType = 'none' | 'api_key' | 'workspace_key' | 'user';\n/**\n * HTTP methods supported by endpoints\n */\nexport type EndpointMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n/**\n * Schema definition for endpoint validation\n */\nexport interface EndpointSchema<TQuery = unknown, TBody = unknown, TResponse = unknown> {\n    /** Query parameters schema */\n    query?: ZodSchema;\n    /** Request body schema (for POST/PUT/PATCH) */\n    body?: ZodSchema;\n    /** Response schema for documentation */\n    response?: ZodSchema;\n}\n/**\n * Context provided to endpoint handlers\n */\nexport interface EndpointContext<TQuery = Record<string, unknown>, TBody = unknown> {\n    /** Environment bindings */\n    env: Env;\n    /** Original request object */\n    request: Request;\n    /** Validated query parameters */\n    query: TQuery;\n    /** Validated request body (null for GET/DELETE) */\n    body: TBody | null;\n    /** Path parameters extracted from URL */\n    params: Record<string, string>;\n    /** Authentication information */\n    auth: EndpointAuthInfo;\n    /** Request headers */\n    headers: Headers;\n    /** Logger for endpoint operations */\n    logger: EndpointLogger;\n}\n/**\n * Authentication information passed to handlers\n */\nexport interface EndpointAuthInfo {\n    /** Authentication requirement declared by the endpoint */\n    type: EndpointAuthType;\n    /** Resolved caller principal type (api_key, workspace_key, user, none) */\n    principalType?: EndpointPrincipalType;\n    /** API key ID (if authenticated with an API key) */\n    apiKeyId?: string;\n    /** User ID (if authenticated as a workspace member) */\n    userId?: string;\n    /** Scopes granted to the API key */\n    scopes?: string[];\n    /** Whether request is authenticated */\n    authenticated: boolean;\n}\n/**\n * Logger for endpoint operations\n */\nexport interface EndpointLogger {\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n}\n/**\n * Metadata for endpoint documentation\n */\nexport interface EndpointMeta {\n    /** Human-readable description */\n    description?: string;\n    /** Tags for grouping in documentation */\n    tags?: string[];\n    /** Deprecated flag */\n    deprecated?: boolean;\n    /** Deprecation message */\n    deprecationMessage?: string;\n}\n/**\n * Public endpoint definition\n */\nexport interface EndpointDefinition<TQuery = Record<string, unknown>, TBody = unknown, TResponse = unknown> {\n    /** URL path (e.g., '/v1/todos', '/users/:id') */\n    path: string;\n    /** HTTP method */\n    method: EndpointMethod;\n    /** Authentication requirement */\n    auth: EndpointAuthType;\n    /** Validation schemas */\n    schema?: EndpointSchema<TQuery, TBody, TResponse>;\n    /** Request handler */\n    handler: EndpointHandler<TQuery, TBody, TResponse>;\n    /** Endpoint metadata for documentation */\n    meta?: EndpointMeta;\n}\n/**\n * Endpoint handler function type\n */\nexport type EndpointHandler<TQuery = Record<string, unknown>, TBody = unknown, TResponse = unknown> = (ctx: EndpointContext<TQuery, TBody>) => Promise<TResponse>;\n/** Type guard to distinguish EndpointDefinition from function-based route registrars */\nexport declare function isEndpointDefinition(entry: unknown): entry is EndpointDefinition;\n/**\n * Internal: Parsed endpoint info from request headers\n */\nexport interface ParsedEndpointRequest {\n    endpointId: string;\n    appId: string;\n    authType: EndpointPrincipalType;\n    apiKeyId?: string;\n    userId?: string;\n    scopes?: string[];\n}\n/**\n * Create a JSON response\n */\nexport declare function jsonResponse<T>(data: T, status?: number): Response;\n/**\n * Create an error response\n */\nexport declare function errorResponse(message: string, status?: number, code?: string): Response;\n/**\n * Convert Zod schema to JSON Schema for documentation\n * This is a simplified conversion that handles common cases\n */\nexport declare function zodToJsonSchema(schema: ZodSchema | undefined): Record<string, unknown> | undefined;\n/**\n * Endpoint router that matches requests to handlers\n */\nexport declare class EndpointRouter {\n    private endpoints;\n    /**\n     * Register endpoints\n     */\n    register(endpoints: EndpointDefinition<unknown, unknown, unknown>[]): void;\n    /**\n     * Find endpoint matching the request\n     */\n    findEndpoint(method: string, path: string): {\n        endpoint: EndpointDefinition<unknown, unknown, unknown>;\n        params: Record<string, string>;\n    } | null;\n    /**\n     * Get all registered endpoints for documentation\n     */\n    getAllEndpoints(): EndpointDefinition<unknown, unknown, unknown>[];\n}\n/**\n * Mount an EndpointDefinition as a native Hono route.\n *\n * Registers the endpoint at its natural path using the correct HTTP method,\n * with Zod validation for query/body schemas and full EndpointContext support.\n * This allows EndpointDefinition entries in APP_ROUTES to work as first-class\n * Hono routes with middleware, streaming, and WebSocket support intact.\n */\nexport declare function mountEndpointAsHonoRoute(app: Hono<{\n    Bindings: Env;\n}>, endpoint: EndpointDefinition): void;\n/**\n * Handle an incoming public endpoint request.\n * Called by the platform when routing requests to the app.\n */\nexport declare function handleEndpointRequest<TQuery = unknown, TBody = unknown, TResponse = unknown>(request: Request, env: Env, endpoints: EndpointDefinition<TQuery, TBody, TResponse>[]): Promise<Response>;\n/**\n * Custom error for endpoint handlers\n * Use this to return specific HTTP status codes\n */\nexport declare class EndpointError extends Error {\n    status: number;\n    code?: string | undefined;\n    constructor(message: string, status?: number, code?: string | undefined);\n    static badRequest(message: string): EndpointError;\n    static unauthorized(message?: string): EndpointError;\n    static forbidden(message?: string): EndpointError;\n    static notFound(message?: string): EndpointError;\n    static conflict(message: string): EndpointError;\n}\n/**\n * Convert endpoint definition to registration data for workspace\n */\nexport declare function endpointToRegistration<TQuery = unknown, TBody = unknown, TResponse = unknown>(endpoint: EndpointDefinition<TQuery, TBody, TResponse>): {\n    path: string;\n    method: EndpointMethod;\n    auth: EndpointAuthType;\n    description?: string;\n    tags?: string[];\n    schema?: {\n        query?: Record<string, unknown>;\n        body?: Record<string, unknown>;\n        response?: Record<string, unknown>;\n    };\n};\nexport {};\n",
     "core-utils.d.ts": "/**\n * Core Utilities\n * DO NOT MODIFY THIS FILE - You may break the project functionality\n *\n * This module provides:\n * - Env type: Environment bindings for Cloudflare Workers\n * - API helpers: Response utilities for Hono routes\n *\n * Entity System: See core-entities.ts\n * Workspace Context: See core-workspace.ts\n * Scheduler: See core-scheduler.ts\n */\nimport type { Context } from 'hono';\nimport type { EntityDO } from './core-entity-do';\nimport type { SchedulerDO } from './core-scheduler';\nimport type { BaseAgent } from './core-base-agent';\n/**\n * Environment bindings for Cloudflare Workers\n */\nexport interface Env {\n    EntityDO: DurableObjectNamespace<EntityDO>;\n    SchedulerDO: DurableObjectNamespace<SchedulerDO>;\n    BaseAgent?: DurableObjectNamespace<BaseAgent>;\n    WorkspaceObject?: DurableObjectNamespace;\n    WorkflowInstance: DurableObjectNamespace;\n    WorkflowCoordinator: DurableObjectNamespace;\n    BUCKET?: R2Bucket;\n    WORKSPACE_ID?: string;\n    APP_ID?: string;\n    APP_NAME?: string;\n    WORKSPACE_API_URL?: string;\n    WORKSPACE_API_BASE_URL?: string;\n    WORKSPACE_API_KEY?: string;\n    DEPLOYMENT_MODE?: 'preview' | 'production';\n    VITE_DEPLOYMENT_MODE?: 'preview' | 'production';\n    RUNWORK_AI_PROXY_URL?: string;\n    RUNWORK_PROXY_TOKEN?: string;\n    INTEGRATIONS_PROXY_URL?: string;\n    ALLOWED_ORIGINS?: string;\n}\n/**\n * Return a successful JSON response.\n * Returns the data directly as the response body with 200 status.\n */\nexport declare const ok: <T>(c: Context, data: T) => Response & import(\"hono\").TypedResponse<{\n    [x: string]: import(\"hono/utils/types\").JSONValue;\n}, import(\"hono/utils/http-status\").ContentfulStatusCode, \"json\">;\n/**\n * Return a 400 Bad Request response\n * Automatically logs the error for debugging in production logs\n */\nexport declare const bad: (c: Context, error: string) => Response & import(\"hono\").TypedResponse<{\n    error: string;\n}, 400, \"json\">;\n/**\n * Return a 404 Not Found response\n * Automatically logs the error for debugging in production logs\n */\nexport declare const notFound: (c: Context, error?: string) => Response & import(\"hono\").TypedResponse<{\n    error: string;\n}, 404, \"json\">;\n/**\n * Type guard for non-empty strings\n */\nexport declare const isStr: (s: unknown) => s is string;\n/**\n * Safely clone a value for Durable Object storage.\n * Strips non-serializable references (R2Bucket, D1Database, DO stubs, etc.)\n * that would cause structured clone to fail in ctx.storage.put().\n */\nexport declare function safeClone<T>(value: T, fallback?: T): T;\nexport declare function platformFetch(env: Env, url: string | URL, init?: RequestInit): Promise<Response>;\n/**\n * Workspace API fetch - routes workspace service requests through WorkspaceObject DO\n * for production WfP workers, avoiding 522 recursive invocation errors.\n *\n * Workers for Platforms workers cannot HTTP-fetch back to their dispatcher domain.\n * This routes through the WorkspaceObject DO binding in production, and falls back\n * to standard HTTP with x-workspace-key auth header in preview/sandbox.\n *\n * @param env - Environment with workspace bindings\n * @param path - Workspace API sub-path (e.g., '/ingest-event')\n * @param init - Standard fetch options\n */\nexport declare function workspaceApiFetch(env: Pick<Env, 'WORKSPACE_API_URL' | 'WORKSPACE_API_KEY' | 'WORKSPACE_ID' | 'DEPLOYMENT_MODE' | 'WorkspaceObject'>, path: string, init?: RequestInit): Promise<Response>;\n",
     "vite.d.ts": "import { defineConfig, type Plugin } from \"vite\";\nexport interface RunworkPluginOptions {\n    /**\n     * Override the detected mode. By default, the plugin detects sandbox mode\n     * when DEPLOYMENT_MODE or WORKSPACE_ID environment variables are present.\n     */\n    mode?: \"sandbox\" | \"local\";\n    /**\n     * Root directory of the project. Defaults to process.cwd().\n     */\n    root?: string;\n    /**\n     * Path aliases to configure. Defaults to { \"@\": \"./src\", \"@shared\": \"./shared\" }.\n     */\n    aliases?: Record<string, string>;\n    /**\n     * Whether to use JSON logging (pino) in sandbox mode.\n     * Defaults to true when VITE_LOGGER_TYPE=json.\n     */\n    jsonLogger?: boolean;\n}\nexport declare function runwork(options?: RunworkPluginOptions): ReturnType<typeof defineConfig>;\nexport type { Plugin };\n",
     "core-channels.d.ts": "/**\n * Core Channels\n * DO NOT MODIFY THIS FILE - You may break the project functionality\n *\n * This module provides:\n * - postToChannel(): Post rich markdown messages to workspace channels\n *\n * Channels are auto-created if they don't exist, with automatic app event filtering.\n * When running outside a workspace (standalone mode), calls are silently skipped.\n */\nexport interface PostToChannelParams {\n    /** Channel name (e.g., \"#inventory-alerts\" or \"inventory-alerts\"). Auto-normalized: # stripped, lowercased, trimmed. */\n    channel: string;\n    /** Markdown message content */\n    content: string;\n    /** Optional structured metadata attached to the message */\n    metadata?: Record<string, unknown>;\n}\ninterface ChannelEnv {\n    WORKSPACE_API_URL?: string;\n    WORKSPACE_API_KEY?: string;\n    WORKSPACE_ID?: string;\n    APP_ID?: string;\n    APP_NAME?: string;\n    DEPLOYMENT_MODE?: 'preview' | 'production';\n    WorkspaceObject?: DurableObjectNamespace;\n}\n/**\n * Any context that supports waitUntil - compatible with both\n * ExecutionContext (Hono route handlers) and DurableObjectState (DOs).\n */\ntype WaitUntilContext = Pick<ExecutionContext, 'waitUntil'>;\n/**\n * Post a rich markdown message to a workspace channel.\n * Fire-and-forget: uses ctx.waitUntil so it doesn't block the response.\n * Silently skips if workspace env vars are not configured (standalone mode).\n *\n * Channels are auto-created on first use. The channel will automatically\n * include this app's system events via filter projection.\n */\nexport declare function postToChannel(ctx: WaitUntilContext, env: ChannelEnv, params: PostToChannelParams): void;\nexport {};\n",

package/dist/generated/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.13.4";
+export declare const VERSION = "0.14.0";

package/dist/generated/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/embed-types.ts -- do not edit
-export const VERSION = "0.13.4";
+export const VERSION = "0.14.0";

package/dist/types.d.ts

@@ -115,6 +115,7 @@ export interface ExternalSkillRegistration {
     importedAt: number;
     importedBy: string;
 }
+export type McpAuthType = 'none' | 'oauth' | 'header';
 export interface McpServerConfig {
     id: string;
     name: string;
@@ -125,6 +126,8 @@ export interface McpServerConfig {
     addedBy: string;
     lastConnectedAt?: number;
     toolCount?: number;
+    authType?: McpAuthType;
+    headerNames?: string[];
 }
 /**
  * Per-agent state tracking baked-in default permission rules that the CLI

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runwork",
-  "version": "0.13.4",
+  "version": "0.14.0",
   "description": "CLI for Runwork: develop, preview, and deploy Runwork apps from your local machine.",
   "license": "UNLICENSED",
   "author": "Runwork <info@runwork.ai> (https://www.runwork.ai)",