@agent-team-foundation/first-tree-hub 0.10.0 → 0.10.2

package/dist/{bootstrap-CtVqQA8a.mjs → bootstrap-Ca5Fiqz6.mjs}

@@ -548,7 +548,8 @@ const serverConfigSchema = defineConfig({
 	},
 	server: {
 		port: field(z.number().default(8e3), { env: "FIRST_TREE_HUB_PORT" }),
-		host: field(z.string().default("127.0.0.1"), { env: "FIRST_TREE_HUB_HOST" })
+		host: field(z.string().default("127.0.0.1"), { env: "FIRST_TREE_HUB_HOST" }),
+		publicUrl: field(z.string().optional(), { env: "FIRST_TREE_HUB_PUBLIC_URL" })
 	},
 	secrets: {
 		jwtSecret: field(z.string(), {
@@ -576,6 +577,14 @@ const serverConfigSchema = defineConfig({
 		}),
 		allowedOrg: field(z.string().optional(), { env: "FIRST_TREE_HUB_GITHUB_ALLOWED_ORG" })
 	},
+	oauth: optional({ github: optional({
+		clientId: field(z.string(), { env: "FIRST_TREE_HUB_GITHUB_OAUTH_CLIENT_ID" }),
+		clientSecret: field(z.string(), {
+			env: "FIRST_TREE_HUB_GITHUB_OAUTH_CLIENT_SECRET",
+			secret: true
+		}),
+		devCallbackEnabled: field(z.boolean().default(false), { env: "FIRST_TREE_HUB_GITHUB_OAUTH_DEV_CALLBACK" })
+	}) }),
 	cors: optional({ origin: field(z.string(), { env: "FIRST_TREE_HUB_CORS_ORIGIN" }) }),
 	rateLimit: optional({
 		max: field(z.number().default(100), { env: "FIRST_TREE_HUB_RATE_LIMIT_MAX" }),

package/dist/cli/index.mjs

@@ -1,26 +1,15 @@
 #!/usr/bin/env node
-import "../observability-DV_fQKqV-oxfXX6Z2.mjs";
-import { $ as configureClientLoggerForService, A as installClientService, B as createOwner, C as checkNodeVersion, D as checkWebSocket, E as checkServerReachable, G as setJsonMode, H as resolveReplyToFromEnv, I as stopPostgres, J as FirstTreeHubSDK, L as ClientRuntime, O as printResults, Q as applyClientLoggerConfig, R as handleClientOrgMismatch, S as checkDocker, T as checkServerHealth, W as print, X as SessionRegistry, Y as SdkError, Z as cleanWorkspaces, _ as runMigrations, a as COMMAND_VERSION, b as checkClientConfig, c as promptMissingFields, d as onboardCheck, f as onboardCreate, g as migrateLocalAgentDirs, h as createApiNameResolver, i as startServer, j as isServiceSupported, k as getClientServiceStatus, l as formatCheckReport, m as runHomeMigration, n as declineUpdate, o as isInteractive, p as saveOnboardState, q as ClientOrgMismatchError, r as promptUpdate, s as promptAddAgent, t as createExecuteUpdate, u as loadOnboardState, v as checkAgentConfigs, w as checkServerConfig, x as checkDatabase, y as checkBackgroundService } from "../core-BgiFGT7Y.mjs";
+import "../observability-DPyf745N-BSc8QNcR.mjs";
+import { $ as FirstTreeHubSDK, A as checkWebSocket, B as ClientRuntime, C as checkClientConfig, D as checkServerConfig, E as checkNodeVersion, G as resolveReplyToFromEnv, K as fail, M as getClientServiceStatus, N as installClientService, O as checkServerHealth, P as isServiceSupported, Q as ClientOrgMismatchError, S as checkBackgroundService, T as checkDocker, U as createOwner, V as handleClientOrgMismatch, X as setJsonMode, Y as print, _ as runHomeMigration, a as declineUpdate, b as runMigrations, c as COMMAND_VERSION, d as promptMissingFields, et as SdkError, f as formatCheckReport, g as saveOnboardState, h as onboardCreate, i as createExecuteUpdate, it as configureClientLoggerForService, j as printResults, k as checkServerReachable, l as isInteractive, m as onboardCheck, nt as cleanWorkspaces, o as promptUpdate, p as loadOnboardState, q as success, r as registerSaaSConnectCommand, rt as applyClientLoggerConfig, s as startServer, tt as SessionRegistry, u as promptAddAgent, v as createApiNameResolver, w as checkDatabase, x as checkAgentConfigs, y as migrateLocalAgentDirs, z as stopPostgres } from "../saas-connect-idjpoPTk.mjs";
 import "../logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { C as serverConfigSchema, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-CtVqQA8a.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-DEmwoNn_.mjs";
+import { C as serverConfigSchema, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-Ca5Fiqz6.mjs";
+import "../dist-CLiN7cVS.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-FTWnoOsc.mjs";
+import "../invitation-C_zAhB8x-8Khychlu.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { Command } from "commander";
 import { confirm, input, password, select } from "@inquirer/prompts";
-//#region src/cli/output.ts
-/**
-* CLI output re-exports. The underlying implementation lives in
-* `core/output.ts` (the Print layer). Keep these thin wrappers so callers that
-* only depend on `cli/output.ts` keep working during the migration.
-*/
-function success(data) {
-	print.result(data);
-}
-function fail(code, message, exitCode = 1) {
-	return print.fail(code, message, exitCode);
-}
-//#endregion
 //#region src/commands/agent-config.ts
 async function resolveAgentRecord(serverUrl, adminToken, agentName) {
 	const res = await fetch(`${serverUrl}/api/v1/admin/agents?limit=100`, {
@@ -1223,13 +1212,13 @@ function isSecretField(schema, dotPath) {
 //#region src/commands/onboard.ts
 async function promptMissing(args) {
 	if (!args.server) try {
-		const { resolveServerUrl } = await import("../bootstrap-CtVqQA8a.mjs").then((n) => n.t);
+		const { resolveServerUrl } = await import("../bootstrap-Ca5Fiqz6.mjs").then((n) => n.t);
 		resolveServerUrl();
 	} catch {
 		args.server = await input({ message: "Hub server URL:" });
 		saveOnboardState(args);
 	}
-	const { loadCredentials } = await import("../bootstrap-CtVqQA8a.mjs").then((n) => n.t);
+	const { loadCredentials } = await import("../bootstrap-Ca5Fiqz6.mjs").then((n) => n.t);
 	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub client connect <server-url>` before onboarding.");
 	if (!args.id) {
 		args.id = await input({ message: "Agent ID:" });
@@ -1506,6 +1495,7 @@ program.name("first-tree-hub").description("First Tree Hub — centralized colla
 	});
 	else applyClientLoggerConfig({ level: "warn" });
 });
+registerSaaSConnectCommand(program);
 registerServerCommands(program);
 registerClientCommands(program);
 registerAgentCommands(program);

package/dist/{feishu-DEmwoNn_.mjs → dist-CLiN7cVS.mjs}

@@ -1,4 +1,3 @@
-import { d as __exportAll } from "./esm-CYu4tXXn.mjs";
 import { z } from "zod";
 //#region ../shared/dist/index.mjs
 const MENTION_REGEX = /(?<![A-Za-z0-9_.@-])@([A-Za-z0-9][A-Za-z0-9_-]{0,63})\b/g;
@@ -38,6 +37,35 @@ function scanMentionTokens(content) {
 	}
 	return tokens;
 }
+/**
+* Single source of truth for "is this string safe to redirect to after a
+* successful OAuth callback".
+*
+* Both the server (`/auth/github/start` validates `?next=` before signing
+* the state JWT) and the web client (the fragment-consumer page validates
+* before navigating) must agree on the regex — drift here is what enables
+* open-redirect bugs. The server is authoritative; the client check is a
+* defense-in-depth.
+*
+* Allowed: a path that begins with exactly one `/` and is not the start of
+* an authority component (`//`, `/\`). Permits typical SPA paths with
+* query strings and fragments. Anything else (absolute URLs, scheme-less
+* authority components, `javascript:`) falls through to the safe default.
+*/
+const SAFE_NEXT_PATH = /^\/(?![/\\])[A-Za-z0-9_\-./?=&%#]*$/;
+/**
+* Return `next` if it is a syntactically safe relative path, otherwise the
+* default landing path. The check is deliberately conservative — the
+* intent is to reject anything that could be parsed as an absolute URL by
+* a browser navigation. Length is capped at 256 chars to defang
+* pathological inputs.
+*/
+function safeRedirectPath(next) {
+	if (!next || typeof next !== "string") return "/";
+	if (next.length > 256) return "/";
+	if (!SAFE_NEXT_PATH.test(next)) return "/";
+	return next;
+}
 const adapterPlatformSchema = z.enum([
 	"feishu",
 	"slack",
@@ -667,6 +695,42 @@ z.object({
 	ackedAt: z.string().nullable()
 }).extend({ message: clientMessageSchema });
 const inboxPollQuerySchema = z.object({ limit: z.coerce.number().int().min(1).max(50).default(10) });
+z.object({
+	organizationId: z.string(),
+	organizationName: z.string(),
+	organizationDisplayName: z.string(),
+	role: z.string()
+});
+z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	token: z.string(),
+	inviteUrl: z.string(),
+	role: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string().nullable()
+});
+/** Body for joining via invite token. */
+const joinByInvitationSchema = z.object({ token: z.string().min(1) });
+z.object({}).optional();
+z.enum([
+	"connect",
+	"create_agent",
+	"completed"
+]);
+z.object({
+	id: z.string(),
+	name: z.string(),
+	displayName: z.string(),
+	role: z.enum(["admin", "member"])
+});
+/** Body for `POST /me/organizations` — operator wants to create another team. */
+const createOrgFromMeSchema = z.object({
+	name: z.string().min(2).max(50).regex(/^[a-z0-9][a-z0-9-]*$/),
+	displayName: z.string().min(1).max(200)
+});
+/** Body for `POST /auth/switch-org`. */
+const switchOrgSchema = z.object({ organizationId: z.string().min(1) });
 const memberRoleSchema = z.enum(["admin", "member"]);
 const memberSchema = z.object({
 	id: z.string(),
@@ -724,6 +788,28 @@ const notificationQuerySchema = z.object({
 	read: z.enum(["true", "false"]).transform((v) => v === "true").optional(),
 	agentId: z.string().optional()
 });
+/**
+* `GET /api/v1/auth/github/start` query — `next` is the post-login landing
+* path. It is validated again before signing the state JWT (see
+* `safe-redirect.ts`); the schema only enforces the syntactic upper bound
+* so over-long paths bounce with a Zod error rather than silently truncate.
+*/
+const githubStartQuerySchema = z.object({ next: z.string().max(256).optional() });
+const githubCallbackQuerySchema = z.object({
+	code: z.string().min(1),
+	state: z.string().min(1)
+});
+/**
+* Dev-only callback to bypass the GitHub round-trip — sign in as a stub
+* Github user. Gated by NODE_ENV !== 'production' AND `oauth.github.devCallbackEnabled`.
+*/
+const githubDevCallbackQuerySchema = z.object({
+	githubId: z.string().min(1),
+	login: z.string().min(1),
+	email: z.string().email().optional(),
+	displayName: z.string().optional(),
+	next: z.string().max(256).optional()
+});
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const createOrganizationSchema = z.object({
 	name: z.string().min(2).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Must start with a letter or digit and contain only lowercase alphanumeric and hyphens").refine((v) => !UUID_PATTERN.test(v), "Name must not be a UUID format"),
@@ -1061,53 +1147,4 @@ z.object({
 	serverTimeMs: z.number().int().nonnegative()
 }).passthrough();
 //#endregion
-//#region src/core/feishu.ts
-var feishu_exports = /* @__PURE__ */ __exportAll({
-	bindFeishuBot: () => bindFeishuBot,
-	bindFeishuUser: () => bindFeishuUser
-});
-/**
-* Feishu-related core operations: bind-bot, bind-user.
-*
-* All agent-scoped calls carry both the member access JWT (Authorization)
-* and the acting agent UUID (X-Agent-Id); the server's agent-selector
-* middleware enforces Rule R-RUN.
-*/
-async function bindFeishuBot(serverUrl, accessToken, agentId, appId, appSecret) {
-	const res = await fetch(`${serverUrl}/api/v1/agent/me/feishu-bot`, {
-		method: "PUT",
-		headers: {
-			Authorization: `Bearer ${accessToken}`,
-			[AGENT_SELECTOR_HEADER]: agentId,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({
-			appId,
-			appSecret
-		})
-	});
-	if (!res.ok) {
-		const body = await res.json().catch(() => ({}));
-		throw new Error(body.error ?? `Bind Feishu bot failed: HTTP ${res.status}`);
-	}
-}
-async function bindFeishuUser(serverUrl, accessToken, agentId, humanAgentId, feishuUserId, displayName) {
-	const res = await fetch(`${serverUrl}/api/v1/agent/delegated/${encodeURIComponent(humanAgentId)}/feishu-user`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${accessToken}`,
-			[AGENT_SELECTOR_HEADER]: agentId,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({
-			feishuUserId,
-			displayName
-		})
-	});
-	if (!res.ok) {
-		const body = await res.json().catch(() => ({}));
-		throw new Error(body.error ?? `Bind Feishu user failed: HTTP ${res.status}`);
-	}
-}
-//#endregion
-export { sessionEventMessageSchema as $, createChatSchema as A, isReservedAgentName as B, agentRuntimeConfigPayloadSchema as C, createAdapterConfigSchema as D, connectTokenExchangeSchema as E, dryRunAgentRuntimeConfigSchema as F, paginationQuerySchema as G, loginSchema as H, extractMentions as I, scanMentionTokens as J, refreshTokenSchema as K, imageInlineContentSchema as L, createOrganizationSchema as M, createTaskSchema as N, createAdapterMappingSchema as O, delegateFeishuUserSchema as P, sessionCompletionMessageSchema as Q, inboxPollQuerySchema as R, agentPinnedMessageSchema as S, clientRegisterSchema as T, messageSourceSchema as U, linkTaskChatSchema as V, notificationQuerySchema as W, sendMessageSchema as X, selfServiceFeishuBotSchema as Y, sendToAgentSchema as Z, WS_AUTH_FRAME_TIMEOUT_MS as _, AGENT_NAME_REGEX as a, updateAgentRuntimeConfigSchema as at, adminUpdateTaskSchema as b, AGENT_STATUSES as c, updateMemberSchema as ct, DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD as d, updateTaskStatusSchema as dt, sessionEventSchema as et, SYSTEM_CONFIG_DEFAULTS as f, wsAuthFrameSchema as ft, TASK_TERMINAL_STATUSES as g, TASK_STATUSES as h, AGENT_BIND_REJECT_REASONS as i, updateAdapterConfigSchema as it, createMemberSchema as j, createAgentSchema as k, AGENT_TYPES as l, updateOrganizationSchema as lt, TASK_HEALTH_SIGNALS as m, bindFeishuUser as n, sessionStateMessageSchema as nt, AGENT_SELECTOR_HEADER as o, updateAgentSchema as ot, TASK_CREATOR_TYPES as p, runtimeStateMessageSchema as q, feishu_exports as r, taskListQuerySchema as rt, AGENT_SOURCES as s, updateChatSchema as st, bindFeishuBot as t, sessionReconcileRequestSchema as tt, AGENT_VISIBILITY as u, updateSystemConfigSchema as ut, addParticipantSchema as v, agentTypeSchema as w, agentBindRequestSchema as x, adminCreateTaskSchema as y, isRedactedEnvValue as z };
+export { sendMessageSchema as $, createOrganizationSchema as A, isRedactedEnvValue as B, connectTokenExchangeSchema as C, createChatSchema as D, createAgentSchema as E, githubCallbackQuerySchema as F, messageSourceSchema as G, joinByInvitationSchema as H, githubDevCallbackQuerySchema as I, refreshTokenSchema as J, notificationQuerySchema as K, githubStartQuerySchema as L, delegateFeishuUserSchema as M, dryRunAgentRuntimeConfigSchema as N, createMemberSchema as O, extractMentions as P, selfServiceFeishuBotSchema as Q, imageInlineContentSchema as R, clientRegisterSchema as S, createAdapterMappingSchema as T, linkTaskChatSchema as U, isReservedAgentName as V, loginSchema as W, safeRedirectPath as X, runtimeStateMessageSchema as Y, scanMentionTokens as Z, adminUpdateTaskSchema as _, AGENT_STATUSES as a, sessionStateMessageSchema as at, agentRuntimeConfigPayloadSchema as b, DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD as c, updateAdapterConfigSchema as ct, TASK_HEALTH_SIGNALS as d, updateChatSchema as dt, sendToAgentSchema as et, TASK_STATUSES as f, updateMemberSchema as ft, adminCreateTaskSchema as g, wsAuthFrameSchema as gt, addParticipantSchema as h, updateTaskStatusSchema as ht, AGENT_SOURCES as i, sessionReconcileRequestSchema as it, createTaskSchema as j, createOrgFromMeSchema as k, SYSTEM_CONFIG_DEFAULTS as l, updateAgentRuntimeConfigSchema as lt, WS_AUTH_FRAME_TIMEOUT_MS as m, updateSystemConfigSchema as mt, AGENT_NAME_REGEX as n, sessionEventMessageSchema as nt, AGENT_TYPES as o, switchOrgSchema as ot, TASK_TERMINAL_STATUSES as p, updateOrganizationSchema as pt, paginationQuerySchema as q, AGENT_SELECTOR_HEADER as r, sessionEventSchema as rt, AGENT_VISIBILITY as s, taskListQuerySchema as st, AGENT_BIND_REJECT_REASONS as t, sessionCompletionMessageSchema as tt, TASK_CREATOR_TYPES as u, updateAgentSchema as ut, agentBindRequestSchema as v, createAdapterConfigSchema as w, agentTypeSchema as x, agentPinnedMessageSchema as y, inboxPollQuerySchema as z };

package/dist/drizzle/0026_saas_onboarding.sql

@@ -0,0 +1,153 @@
+-- SaaS onboarding milestone — adds the data-model surface needed for
+-- public GitHub-OAuth signup, per-org invitation links, and "leave team"
+-- soft-delete. See proposals/hub-saas-onboarding.20260428.md for the full
+-- design contract.
+--
+-- Three independent additions, no destructive changes to existing tables:
+--
+--   1. `auth_identities` — third-party / local auth identities for a user.
+--      Models the "how does this user prove who they are" boundary.
+--      `(provider, identifier)` is globally unique. v1 stores the credential
+--      payload (password hash, webauthn pubkey) on the same row;
+--      v2 splits it into `auth_credentials` if multi-factor is needed
+--      (the migration is sketched in the schema file's header comment).
+--
+--   2. `invitations` + `invitation_redemptions` — org-level share links.
+--      The "one active link per org" rule is enforced by a partial UNIQUE
+--      index (Drizzle's TS DSL doesn't model partial uniques yet, so we
+--      add it directly here). Rotation = revoke prior + insert new in a
+--      single transaction. Redemptions are recorded for audit.
+--
+--   3. `members.status` — "active" | "left" soft-delete marker for the
+--      "leave team" flow. Existing rows backfill to "active" via the
+--      column DEFAULT. The auth middleware rejects tokens that resolve to
+--      a "left" member; join-by-invite flips a "left" row back to "active".
+--
+-- All three changes are append-only (new tables + new column with DEFAULT).
+-- ALTER TABLE on `members` takes a brief ACCESS EXCLUSIVE lock, which is
+-- safe on a v1 SaaS members table (small) but should be benchmarked on a
+-- large multi-tenant install before rolling.
+--
+-- See 0020_unified_user_token.sql header for why this file does NOT wrap in
+-- BEGIN;/COMMIT; — Drizzle migrator already runs every pending migration
+-- inside a single outer transaction.
+
+-- ---------------------------------------------------------------------------
+-- 1. auth_identities
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS "auth_identities" (
+	"id"                  text PRIMARY KEY NOT NULL,
+	"user_id"             text NOT NULL,
+	"provider"            text NOT NULL,
+	"identifier"          text NOT NULL,
+	"email"               text,
+	"verified_at"         timestamp with time zone,
+	"credential_type"     text,
+	"credential_payload"  jsonb,
+	"metadata"            jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"created_at"          timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at"          timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "uq_auth_identities_provider_identifier" UNIQUE ("provider", "identifier")
+);
+
+--> statement-breakpoint
+ALTER TABLE "auth_identities"
+	ADD CONSTRAINT "auth_identities_user_id_users_id_fk"
+	FOREIGN KEY ("user_id") REFERENCES "users"("id")
+	ON DELETE cascade ON UPDATE no action;
+
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_auth_identities_user" ON "auth_identities" ("user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_auth_identities_email" ON "auth_identities" ("email");
+
+-- ---------------------------------------------------------------------------
+-- 2. invitations + invitation_redemptions
+-- ---------------------------------------------------------------------------
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "invitations" (
+	"id"               text PRIMARY KEY NOT NULL,
+	"organization_id"  text NOT NULL,
+	"token"            text NOT NULL UNIQUE,
+	"role"             text DEFAULT 'member' NOT NULL,
+	"expires_at"       timestamp with time zone,
+	"revoked_at"       timestamp with time zone,
+	"created_by"       text NOT NULL,
+	"created_at"       timestamp with time zone DEFAULT now() NOT NULL
+);
+
+--> statement-breakpoint
+ALTER TABLE "invitations"
+	ADD CONSTRAINT "invitations_organization_id_organizations_id_fk"
+	FOREIGN KEY ("organization_id") REFERENCES "organizations"("id")
+	ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "invitations"
+	ADD CONSTRAINT "invitations_created_by_users_id_fk"
+	FOREIGN KEY ("created_by") REFERENCES "users"("id")
+	ON DELETE no action ON UPDATE no action;
+
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_invitations_token" ON "invitations" ("token");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_invitations_org" ON "invitations" ("organization_id");
+
+--> statement-breakpoint
+-- v1 enforced rule: each org may have at most one non-revoked invitation.
+-- The predicate is intentionally `revoked_at IS NULL` only — Postgres rejects
+-- `now()` in an index predicate (must be IMMUTABLE), and conflating "expired"
+-- with "no longer the active link" matches the v1 service contract anyway.
+-- The runtime "is this still usable" filter (which DOES check `expires_at`)
+-- lives in services/invitation.ts. Future "multiple links per org" relaxes by
+-- dropping this index.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_invitations_active_per_org"
+	ON "invitations" ("organization_id")
+	WHERE "revoked_at" IS NULL;
+
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "invitation_redemptions" (
+	"id"             text PRIMARY KEY NOT NULL,
+	"invitation_id"  text NOT NULL,
+	"user_id"        text NOT NULL,
+	"redeemed_at"    timestamp with time zone DEFAULT now() NOT NULL,
+	"ip"             text,
+	"user_agent"     text
+);
+
+--> statement-breakpoint
+ALTER TABLE "invitation_redemptions"
+	ADD CONSTRAINT "invitation_redemptions_invitation_id_invitations_id_fk"
+	FOREIGN KEY ("invitation_id") REFERENCES "invitations"("id")
+	ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "invitation_redemptions"
+	ADD CONSTRAINT "invitation_redemptions_user_id_users_id_fk"
+	FOREIGN KEY ("user_id") REFERENCES "users"("id")
+	ON DELETE cascade ON UPDATE no action;
+
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_invitation_redemptions_invitation"
+	ON "invitation_redemptions" ("invitation_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_invitation_redemptions_user"
+	ON "invitation_redemptions" ("user_id");
+
+-- ---------------------------------------------------------------------------
+-- 3. members.status — soft-delete marker for "leave team"
+-- ---------------------------------------------------------------------------
+--
+-- No partial index on `status='active'` is created in v1. Filter sites are:
+--   - middleware/member-auth.ts: lookup by members.id (already PK-indexed)
+--   - services/auth.ts (password login): WHERE user_id = ? AND status='active'
+--   - services/membership.ts (listActiveMemberships): same filter
+-- The existing `idx_members_user (user_id)` already collapses each user's
+-- members rows to ~1-5 typical, so the in-page status check is essentially
+-- free at the v1 SaaS scale (low six-digit users × low single-digit teams).
+-- A partial unique-eligible index becomes worth adding when:
+--   - members > ~100k rows AND
+--   - average rows-per-user > ~50
+-- whichever comes first. At that point the migration is a single
+-- `CREATE INDEX CONCURRENTLY ... WHERE status='active'`.
+--> statement-breakpoint
+ALTER TABLE "members"
+	ADD COLUMN IF NOT EXISTS "status" text DEFAULT 'active' NOT NULL;

package/dist/drizzle/meta/_journal.json

@@ -183,6 +183,13 @@
       "when": 1777420800000,
       "tag": "0025_inbox_silent_entries",
       "breakpoints": true
+    },
+    {
+      "idx": 26,
+      "version": "7",
+      "when": 1777507200000,
+      "tag": "0026_saas_onboarding",
+      "breakpoints": true
     }
   ]
 }

package/dist/feishu-FTWnoOsc.mjs

@@ -0,0 +1,52 @@
+import { d as __exportAll } from "./esm-CYu4tXXn.mjs";
+import { r as AGENT_SELECTOR_HEADER } from "./dist-CLiN7cVS.mjs";
+//#region src/core/feishu.ts
+var feishu_exports = /* @__PURE__ */ __exportAll({
+	bindFeishuBot: () => bindFeishuBot,
+	bindFeishuUser: () => bindFeishuUser
+});
+/**
+* Feishu-related core operations: bind-bot, bind-user.
+*
+* All agent-scoped calls carry both the member access JWT (Authorization)
+* and the acting agent UUID (X-Agent-Id); the server's agent-selector
+* middleware enforces Rule R-RUN.
+*/
+async function bindFeishuBot(serverUrl, accessToken, agentId, appId, appSecret) {
+	const res = await fetch(`${serverUrl}/api/v1/agent/me/feishu-bot`, {
+		method: "PUT",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			[AGENT_SELECTOR_HEADER]: agentId,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			appId,
+			appSecret
+		})
+	});
+	if (!res.ok) {
+		const body = await res.json().catch(() => ({}));
+		throw new Error(body.error ?? `Bind Feishu bot failed: HTTP ${res.status}`);
+	}
+}
+async function bindFeishuUser(serverUrl, accessToken, agentId, humanAgentId, feishuUserId, displayName) {
+	const res = await fetch(`${serverUrl}/api/v1/agent/delegated/${encodeURIComponent(humanAgentId)}/feishu-user`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			[AGENT_SELECTOR_HEADER]: agentId,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			feishuUserId,
+			displayName
+		})
+	});
+	if (!res.ok) {
+		const body = await res.json().catch(() => ({}));
+		throw new Error(body.error ?? `Bind Feishu user failed: HTTP ${res.status}`);
+	}
+}
+//#endregion
+export { bindFeishuUser as n, feishu_exports as r, bindFeishuBot as t };

package/dist/{getMachineId-bsd-BB-fnFLA.mjs → getMachineId-bsd-D0w3uAZa.mjs}

@@ -1,5 +1,5 @@
 import { f as __require, l as __commonJSMin, n as init_esm, p as __toCommonJS, t as esm_exports } from "./esm-CYu4tXXn.mjs";
-import { t as require_execAsync } from "./execAsync-CP8iWV5b.mjs";
+import { t as require_execAsync } from "./execAsync-XMc-nFn-.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-bsd.js
 var require_getMachineId_bsd = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{getMachineId-darwin-DAYWNsYK.mjs → getMachineId-darwin-DOoYFb2_.mjs}

@@ -1,5 +1,5 @@
 import { l as __commonJSMin, n as init_esm, p as __toCommonJS, t as esm_exports } from "./esm-CYu4tXXn.mjs";
-import { t as require_execAsync } from "./execAsync-CP8iWV5b.mjs";
+import { t as require_execAsync } from "./execAsync-XMc-nFn-.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-darwin.js
 var require_getMachineId_darwin = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{getMachineId-win-H5RT49ov.mjs → getMachineId-win-B6hY8edq.mjs}

@@ -1,5 +1,5 @@
 import { f as __require, l as __commonJSMin, n as init_esm, p as __toCommonJS, t as esm_exports } from "./esm-CYu4tXXn.mjs";
-import { t as require_execAsync } from "./execAsync-CP8iWV5b.mjs";
+import { t as require_execAsync } from "./execAsync-XMc-nFn-.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-win.js
 var require_getMachineId_win = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/index.mjs

@@ -1,6 +1,8 @@
-import "./observability-DV_fQKqV-oxfXX6Z2.mjs";
-import { A as installClientService, B as createOwner, C as checkNodeVersion, D as checkWebSocket, E as checkServerReachable, F as isDockerAvailable, I as stopPostgres, J as FirstTreeHubSDK, K as status, L as ClientRuntime, M as resolveCliInvocation, N as uninstallClientService, O as printResults, P as ensurePostgres, R as handleClientOrgMismatch, S as checkDocker, T as checkServerHealth, U as blank, V as hasUser, Y as SdkError, _ as runMigrations, b as checkClientConfig, c as promptMissingFields, d as onboardCheck, f as onboardCreate, i as startServer, j as isServiceSupported, k as getClientServiceStatus, l as formatCheckReport, m as runHomeMigration, o as isInteractive, s as promptAddAgent, v as checkAgentConfigs, w as checkServerConfig, x as checkDatabase, z as rotateClientIdWithBackup } from "./core-BgiFGT7Y.mjs";
+import "./observability-DPyf745N-BSc8QNcR.mjs";
+import { $ as FirstTreeHubSDK, A as checkWebSocket, B as ClientRuntime, C as checkClientConfig, D as checkServerConfig, E as checkNodeVersion, F as resolveCliInvocation, H as rotateClientIdWithBackup, I as uninstallClientService, J as blank, L as ensurePostgres, M as getClientServiceStatus, N as installClientService, O as checkServerHealth, P as isServiceSupported, R as isDockerAvailable, T as checkDocker, U as createOwner, V as handleClientOrgMismatch, W as hasUser, Z as status, _ as runHomeMigration, b as runMigrations, d as promptMissingFields, et as SdkError, f as formatCheckReport, h as onboardCreate, j as printResults, k as checkServerReachable, l as isInteractive, m as onboardCheck, n as deriveHubUrlFromToken, s as startServer, t as HubUrlDerivationError, u as promptAddAgent, w as checkDatabase, x as checkAgentConfigs, z as stopPostgres } from "./saas-connect-idjpoPTk.mjs";
 import "./logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-CtVqQA8a.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-DEmwoNn_.mjs";
-export { ClientRuntime, FirstTreeHubSDK, SdkError, bindFeishuBot, bindFeishuUser, blank, checkAgentConfigs, checkClientConfig, checkDatabase, checkDocker, checkNodeVersion, checkServerConfig, checkServerHealth, checkServerReachable, checkWebSocket, createOwner, ensureFreshAccessToken, ensureFreshAdminToken, ensurePostgres, formatCheckReport, getClientServiceStatus, handleClientOrgMismatch, hasUser, installClientService, isDockerAvailable, isInteractive, isServiceSupported, onboardCheck, onboardCreate, printResults, promptAddAgent, promptMissingFields, resolveAccessToken, resolveCliInvocation, resolveServerUrl, rotateClientIdWithBackup, runHomeMigration, runMigrations, startServer, status, stopPostgres, uninstallClientService };
+import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-Ca5Fiqz6.mjs";
+import "./dist-CLiN7cVS.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-FTWnoOsc.mjs";
+import "./invitation-C_zAhB8x-8Khychlu.mjs";
+export { ClientRuntime, FirstTreeHubSDK, HubUrlDerivationError, SdkError, bindFeishuBot, bindFeishuUser, blank, checkAgentConfigs, checkClientConfig, checkDatabase, checkDocker, checkNodeVersion, checkServerConfig, checkServerHealth, checkServerReachable, checkWebSocket, createOwner, deriveHubUrlFromToken, ensureFreshAccessToken, ensureFreshAdminToken, ensurePostgres, formatCheckReport, getClientServiceStatus, handleClientOrgMismatch, hasUser, installClientService, isDockerAvailable, isInteractive, isServiceSupported, onboardCheck, onboardCreate, printResults, promptAddAgent, promptMissingFields, resolveAccessToken, resolveCliInvocation, resolveServerUrl, rotateClientIdWithBackup, runHomeMigration, runMigrations, startServer, status, stopPostgres, uninstallClientService };

package/dist/invitation-BTlGMy0o-dIoR8JRj.mjs

@@ -0,0 +1,3 @@
+import "./dist-CLiN7cVS.mjs";
+import { _ as rotateInvitation, h as previewInvitation } from "./invitation-C_zAhB8x-8Khychlu.mjs";
+export { previewInvitation, rotateInvitation };