@base44-preview/cli 0.0.41-pr.398.f273a1e → 0.0.42-pr.404.ec1a1ee

package/dist/cli/index.js

@@ -16481,7 +16481,7 @@ var require_lodash = __commonJS((exports, module) => {
       function nth(array2, n2) {
         return array2 && array2.length ? baseNth(array2, toInteger(n2)) : undefined2;
       }
-      var pull = baseRest(pullAll);
+      var pull2 = baseRest(pullAll);
       function pullAll(array2, values2) {
         return array2 && array2.length && values2 && values2.length ? basePullAll(array2, values2) : array2;
       }
@@ -18246,7 +18246,7 @@ __p += '`;
       lodash.pickBy = pickBy;
       lodash.property = property;
       lodash.propertyOf = propertyOf;
-      lodash.pull = pull;
+      lodash.pull = pull2;
       lodash.pullAll = pullAll;
       lodash.pullAllBy = pullAllBy;
       lodash.pullAllWith = pullAllWith;
@@ -161575,7 +161575,7 @@ var require_is_promise = __commonJS((exports, module) => {
   }
 });
 
-// ../../node_modules/router/node_modules/path-to-regexp/dist/index.js
+// ../../node_modules/path-to-regexp/dist/index.js
 var require_dist = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.PathError = exports.TokenData = undefined;
@@ -237514,6 +237514,10 @@ var GoogleBigQueryConnectorSchema = exports_external.object({
   type: exports_external.literal("googlebigquery"),
   scopes: exports_external.array(exports_external.string()).default([])
 });
+var StripeConnectorSchema = exports_external.object({
+  type: exports_external.literal("stripe"),
+  scopes: exports_external.array(exports_external.string()).default([])
+});
 var CustomTypeSchema = exports_external.string().min(1).regex(/^[a-z0-9_-]+$/i);
 var GenericConnectorSchema = exports_external.object({
   type: CustomTypeSchema,
@@ -237533,6 +237537,7 @@ var ConnectorResourceSchema = exports_external.union([
   HubspotConnectorSchema,
   LinkedInConnectorSchema,
   TikTokConnectorSchema,
+  StripeConnectorSchema,
   GenericConnectorSchema
 ]);
 var KnownIntegrationTypes = [
@@ -237548,7 +237553,8 @@ var KnownIntegrationTypes = [
   "salesforce",
   "hubspot",
   "linkedin",
-  "tiktok"
+  "tiktok",
+  "stripe"
 ];
 var IntegrationTypeSchema = exports_external.union([
   exports_external.enum(KnownIntegrationTypes),
@@ -237601,6 +237607,24 @@ var RemoveConnectorResponseSchema = exports_external.object({
   status: data.status,
   integrationType: data.integration_type
 }));
+var STRIPE_CONNECTOR_TYPE = "stripe";
+var InstallStripeResponseSchema = exports_external.object({
+  already_installed: exports_external.boolean(),
+  claim_url: exports_external.string().nullable()
+}).transform((data) => ({
+  alreadyInstalled: data.already_installed,
+  claimUrl: data.claim_url
+}));
+var StripeStatusResponseSchema = exports_external.object({
+  stripe_mode: exports_external.enum(["sandbox", "live"]).nullable(),
+  sandbox_claim_url: exports_external.string().nullable().optional()
+}).transform((data) => ({
+  stripeMode: data.stripe_mode,
+  sandboxClaimUrl: data.sandbox_claim_url
+}));
+var RemoveStripeResponseSchema = exports_external.object({
+  success: exports_external.boolean()
+});
 var ConnectionConfigFieldSchema = exports_external.object({
   name: exports_external.string(),
   display_name: exports_external.string(),
@@ -237715,6 +237739,54 @@ async function removeConnector(integrationType) {
   }
   return result.data;
 }
+async function installStripe() {
+  const appClient = getAppClient();
+  let response;
+  try {
+    response = await appClient.post("payments/stripe/install", {
+      timeout: 60000
+    });
+  } catch (error48) {
+    throw await ApiError.fromHttpError(error48, "installing Stripe");
+  }
+  const result = InstallStripeResponseSchema.safeParse(await response.json());
+  if (!result.success) {
+    throw new SchemaValidationError("Invalid response from server", result.error);
+  }
+  return result.data;
+}
+async function getStripeStatus() {
+  const appClient = getAppClient();
+  let response;
+  try {
+    response = await appClient.get("payments/stripe/status", {
+      timeout: 60000
+    });
+  } catch (error48) {
+    throw await ApiError.fromHttpError(error48, "checking Stripe integration status");
+  }
+  const result = StripeStatusResponseSchema.safeParse(await response.json());
+  if (!result.success) {
+    throw new SchemaValidationError("Invalid response from server", result.error);
+  }
+  return result.data;
+}
+async function removeStripe() {
+  const appClient = getAppClient();
+  let response;
+  try {
+    response = await appClient.delete("payments/stripe", {
+      timeout: 60000
+    });
+  } catch (error48) {
+    throw await ApiError.fromHttpError(error48, "removing Stripe integration");
+  }
+  const result = RemoveStripeResponseSchema.safeParse(await response.json());
+  if (!result.success) {
+    throw new SchemaValidationError("Invalid response from server", result.error);
+  }
+  return result.data;
+}
 // src/core/resources/connector/config.ts
 import { join as join4 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
@@ -237763,7 +237835,7 @@ async function readAllConnectors(connectorsDir) {
 async function writeConnectors(connectorsDir, remoteConnectors) {
   const entries = await readConnectorFiles(connectorsDir);
   const typeToEntry = buildTypeToEntryMap(entries);
-  const newTypes = new Set(remoteConnectors.map((c) => c.integrationType));
+  const newTypes = new Set(remoteConnectors.map((c) => c.type));
   const deleted = [];
   for (const [type, entry] of typeToEntry) {
     if (!newTypes.has(type)) {
@@ -237773,22 +237845,105 @@ async function writeConnectors(connectorsDir, remoteConnectors) {
   }
   const written = [];
   for (const connector of remoteConnectors) {
-    const existing = typeToEntry.get(connector.integrationType);
-    const localConnector = {
-      type: connector.integrationType,
-      scopes: connector.scopes
-    };
-    if (existing && isDeepStrictEqual2(existing.data, localConnector)) {
+    const existing = typeToEntry.get(connector.type);
+    if (existing && isDeepStrictEqual2(existing.data, connector)) {
       continue;
     }
-    const filePath = existing?.filePath ?? join4(connectorsDir, `${connector.integrationType}.${CONFIG_FILE_EXTENSION}`);
-    await writeJsonFile(filePath, localConnector);
-    written.push(connector.integrationType);
+    const filePath = existing?.filePath ?? join4(connectorsDir, `${connector.type}.${CONFIG_FILE_EXTENSION}`);
+    await writeJsonFile(filePath, connector);
+    written.push(connector.type);
   }
   return { written, deleted };
 }
+// src/core/resources/connector/stripe.ts
+async function syncStripeConnector(localStripe) {
+  const remoteStatus = await fetchStripeRemoteStatus();
+  if (remoteStatus === "error") {
+    return localStripe ? stripeError("Failed to check Stripe integration status") : null;
+  }
+  const isRemoteInstalled = remoteStatus.stripeMode !== null;
+  const needsInstall = localStripe && !isRemoteInstalled;
+  const alreadySynced = localStripe && isRemoteInstalled;
+  const needsRemoval = !localStripe && isRemoteInstalled;
+  if (needsInstall) {
+    return handleStripeInstall();
+  }
+  if (alreadySynced) {
+    return stripeSynced();
+  }
+  if (needsRemoval) {
+    return handleStripeRemoval();
+  }
+  return null;
+}
+async function isStripeInstalled() {
+  const status = await getStripeStatus();
+  return status.stripeMode !== null;
+}
+async function fetchStripeRemoteStatus() {
+  try {
+    return await getStripeStatus();
+  } catch {
+    return "error";
+  }
+}
+async function handleStripeInstall() {
+  try {
+    const result = await installStripe();
+    return stripeProvisioned(result.claimUrl ?? undefined);
+  } catch (err) {
+    return stripeError(err instanceof Error ? err.message : String(err));
+  }
+}
+async function handleStripeRemoval() {
+  try {
+    await removeStripe();
+    return stripeRemoved();
+  } catch (err) {
+    return stripeError(err instanceof Error ? err.message : String(err));
+  }
+}
+function stripeSynced() {
+  return { type: STRIPE_CONNECTOR_TYPE, action: "synced" };
+}
+function stripeProvisioned(claimUrl) {
+  return { type: STRIPE_CONNECTOR_TYPE, action: "provisioned", claimUrl };
+}
+function stripeRemoved() {
+  return { type: STRIPE_CONNECTOR_TYPE, action: "removed" };
+}
+function stripeError(error48) {
+  return { type: STRIPE_CONNECTOR_TYPE, action: "error", error: error48 };
+}
+
+// src/core/resources/connector/pull.ts
+async function pullAllConnectors() {
+  const [oauthResponse, stripeInstalled] = await Promise.all([
+    listConnectors(),
+    isStripeInstalled()
+  ]);
+  const connectors = oauthResponse.integrations.map((i) => ({
+    type: i.integrationType,
+    scopes: i.scopes
+  }));
+  if (stripeInstalled) {
+    connectors.push({ type: STRIPE_CONNECTOR_TYPE, scopes: [] });
+  }
+  return connectors;
+}
 // src/core/resources/connector/push.ts
 async function pushConnectors(connectors) {
+  const stripeConnector = connectors.find((c) => c.type === STRIPE_CONNECTOR_TYPE);
+  const oauthConnectors = connectors.filter((c) => c.type !== STRIPE_CONNECTOR_TYPE);
+  const oauthResults = await syncOAuthConnectors(oauthConnectors);
+  const stripeResult = await syncStripeConnector(stripeConnector);
+  const results = [...oauthResults];
+  if (stripeResult) {
+    results.push(stripeResult);
+  }
+  return { results };
+}
+async function syncOAuthConnectors(connectors) {
   const results = [];
   const upstream = await listConnectors();
   const localTypes = new Set(connectors.map((c) => c.type));
@@ -237821,7 +237976,7 @@ async function pushConnectors(connectors) {
       }
     }
   }
-  return { results };
+  return results;
 }
 function getConnectorSyncResult(type, response) {
   if (response.error === "different_user") {
@@ -238402,7 +238557,7 @@ import { join as join7 } from "node:path";
 // package.json
 var package_default = {
   name: "base44",
-  version: "0.0.41",
+  version: "0.0.42",
   description: "Base44 CLI - Unified interface for managing Base44 applications",
   type: "module",
   bin: {
@@ -238421,6 +238576,8 @@ var package_default = {
     start: "./bin/run.js",
     clean: "rm -rf dist && mkdir -p dist",
     test: "vitest run",
+    "test:npm": "CLI_TEST_RUNNER=npm vitest run",
+    "test:binary": "CLI_TEST_RUNNER=binary vitest run",
     "test:watch": "vitest",
     lint: "cd ../.. && bun run lint",
     "lint:fix": "cd ../.. && bun run lint:fix",
@@ -238469,7 +238626,6 @@ var package_default = {
     json5: "^2.2.3",
     ky: "^1.14.2",
     lodash: "^4.17.23",
-    msw: "^2.12.10",
     multer: "^2.0.0",
     nanoid: "^5.1.6",
     open: "^11.0.0",
@@ -246336,6 +246492,10 @@ function getDashboardUrl(projectId) {
   const id = projectId ?? getAppConfig().id;
   return `${getBase44ApiUrl()}/apps/${id}/editor/workspace/overview`;
 }
+function getConnectorsUrl(projectId) {
+  const id = projectId ?? getAppConfig().id;
+  return `${getBase44ApiUrl()}/apps/${id}/editor/workspace/app-connections`;
+}
 // src/cli/utils/yaml.ts
 var import_lodash = __toESM(require_lodash(), 1);
 
@@ -246531,13 +246691,13 @@ async function pullConnectorsAction() {
   const configDir = dirname8(project2.configPath);
   const connectorsDir = join11(configDir, project2.connectorsDir);
   const remoteConnectors = await runTask("Fetching connectors from Base44", async () => {
-    return await listConnectors();
+    return await pullAllConnectors();
   }, {
     successMessage: "Connectors fetched successfully",
     errorMessage: "Failed to fetch connectors"
   });
   const { written, deleted } = await runTask("Syncing connector files", async () => {
-    return await writeConnectors(connectorsDir, remoteConnectors.integrations);
+    return await writeConnectors(connectorsDir, remoteConnectors);
   }, {
     successMessage: "Connector files synced successfully",
     errorMessage: "Failed to sync connector files"
@@ -246552,7 +246712,7 @@ async function pullConnectorsAction() {
     R2.info("All connectors are already up to date");
   }
   return {
-    outroMessage: `Pulled ${remoteConnectors.integrations.length} connectors to ${connectorsDir}`
+    outroMessage: `Pulled ${remoteConnectors.length} connectors to ${connectorsDir}`
   };
 }
 function getConnectorsPullCommand(context) {
@@ -247171,7 +247331,7 @@ var open_default = open;
 var POLL_INTERVAL_MS = 2000;
 var POLL_TIMEOUT_MS = 2 * 60 * 1000;
 function filterPendingOAuth(results) {
-  return results.filter((r) => r.action === "needs_oauth" && !!r.redirectUrl && !!r.connectionId);
+  return results.filter((r) => r.action === "needs_oauth" && !!r.connectionId);
 }
 async function runOAuthFlowWithSkip(connector2) {
   await open_default(connector2.redirectUrl);
@@ -247189,6 +247349,10 @@ async function runOAuthFlowWithSkip(connector2) {
         finalStatus = "SKIPPED";
         return true;
       }
+      if (!connector2.connectionId) {
+        finalStatus = "FAILED";
+        return true;
+      }
       const response = await getOAuthStatus(connector2.type, connector2.connectionId);
       finalStatus = response.status;
       return response.status !== "PENDING";
@@ -247251,32 +247415,49 @@ async function promptOAuthFlows(pending, options) {
 function printSummary(results, oauthOutcomes) {
   const synced = [];
   const added = [];
+  let provisioned;
   const removed = [];
   const skipped = [];
   const failed = [];
   for (const r of results) {
-    const oauthStatus = oauthOutcomes.get(r.type);
-    if (r.action === "synced") {
-      synced.push(r.type);
-    } else if (r.action === "removed") {
-      removed.push(r.type);
-    } else if (r.action === "error") {
-      failed.push({ type: r.type, error: r.error });
-    } else if (r.action === "needs_oauth") {
-      if (oauthStatus === "ACTIVE") {
-        added.push(r.type);
-      } else if (oauthStatus === "SKIPPED") {
-        skipped.push(r.type);
-      } else if (oauthStatus === "PENDING") {
-        failed.push({ type: r.type, error: "authorization timed out" });
-      } else if (oauthStatus === "FAILED") {
-        failed.push({ type: r.type, error: "authorization failed" });
-      } else {
-        failed.push({ type: r.type, error: "needs authorization" });
+    switch (r.action) {
+      case "provisioned":
+        provisioned = r;
+        break;
+      case "synced":
+        synced.push(r.type);
+        break;
+      case "removed":
+        removed.push(r.type);
+        break;
+      case "error":
+        failed.push({ type: r.type, error: r.error });
+        break;
+      case "needs_oauth": {
+        const oauthStatus = oauthOutcomes.get(r.type);
+        if (oauthStatus === "ACTIVE") {
+          added.push(r.type);
+        } else if (oauthStatus === "SKIPPED") {
+          skipped.push(r.type);
+        } else if (oauthStatus === "PENDING") {
+          failed.push({ type: r.type, error: "authorization timed out" });
+        } else if (oauthStatus === "FAILED") {
+          failed.push({ type: r.type, error: "authorization failed" });
+        } else {
+          failed.push({ type: r.type, error: "needs authorization" });
+        }
+        break;
       }
     }
   }
   R2.info(theme.styles.bold("Summary:"));
+  if (provisioned) {
+    R2.success("Stripe sandbox provisioned");
+    if (provisioned.claimUrl) {
+      R2.info(`  Claim your Stripe sandbox: ${theme.colors.links(provisioned.claimUrl)}`);
+    }
+    R2.info(`  Connectors dashboard: ${theme.colors.links(getConnectorsUrl())}`);
+  }
   if (synced.length > 0) {
     R2.success(`Synced: ${synced.join(", ")}`);
   }
@@ -247290,7 +247471,7 @@ function printSummary(results, oauthOutcomes) {
     R2.warn(`Skipped: ${skipped.join(", ")}`);
   }
   for (const r of failed) {
-    R2.error(`Failed: ${r.type}${r.error ? ` - ${r.error}` : ""}`);
+    R2.error(`Failed: ${r.type} - ${r.error}`);
   }
 }
 async function pushConnectorsAction(isNonInteractive) {
@@ -247638,15 +247819,11 @@ ${summaryLines.join(`
     successMessage: theme.colors.base44Orange("Deployment completed"),
     errorMessage: "Deployment failed"
   });
-  const needsOAuth = filterPendingOAuth(result.connectorResults ?? []);
-  if (needsOAuth.length > 0) {
-    const oauthOutcomes = await promptOAuthFlows(needsOAuth, {
-      skipPrompt: options.yes || options.isNonInteractive
-    });
-    const allAuthorized = oauthOutcomes.size > 0 && [...oauthOutcomes.values()].every((s) => s === "ACTIVE");
-    if (!allAuthorized) {
-      R2.info("Some connectors still require authorization. Run 'base44 connectors push' or open the links above in your browser.");
-    }
+  const connectorResults = result.connectorResults ?? [];
+  await handleOAuthConnectors(connectorResults, options);
+  const stripeResult = connectorResults.find((r) => r.type === "stripe");
+  if (stripeResult?.action === "provisioned") {
+    printStripeResult(stripeResult);
   }
   R2.message(`${theme.styles.header("Dashboard")}: ${theme.colors.links(getDashboardUrl())}`);
   if (result.appUrl) {
@@ -247662,6 +247839,25 @@ function getDeployCommand(context) {
     }), { requireAuth: true }, context);
   });
 }
+async function handleOAuthConnectors(connectorResults, options) {
+  const needsOAuth = filterPendingOAuth(connectorResults);
+  if (needsOAuth.length === 0)
+    return;
+  const oauthOutcomes = await promptOAuthFlows(needsOAuth, {
+    skipPrompt: options.yes || options.isNonInteractive
+  });
+  const allAuthorized = oauthOutcomes.size > 0 && [...oauthOutcomes.values()].every((s) => s === "ACTIVE");
+  if (!allAuthorized) {
+    R2.info("Some connectors still require authorization. Run 'base44 connectors push' or open the links above in your browser.");
+  }
+}
+function printStripeResult(r) {
+  R2.success("Stripe sandbox provisioned");
+  if (r.claimUrl) {
+    R2.info(`  Claim your Stripe sandbox: ${theme.colors.links(r.claimUrl)}`);
+  }
+  R2.info(`  Connectors dashboard: ${theme.colors.links(getConnectorsUrl())}`);
+}
 
 // src/cli/commands/project/link.ts
 function validateNonInteractiveFlags2(command) {
@@ -247900,7 +248096,16 @@ async function getAllFunctionNames() {
   const { functions } = await readProjectConfig();
   return functions.map((fn) => fn.name);
 }
+function validateLimit(limit) {
+  if (limit === undefined)
+    return;
+  const n2 = Number.parseInt(limit, 10);
+  if (Number.isNaN(n2) || n2 < 1 || n2 > 1000) {
+    throw new InvalidInputError(`Invalid limit: "${limit}". Must be a number between 1 and 1000.`);
+  }
+}
 async function logsAction(options) {
+  validateLimit(options.limit);
   const specifiedFunctions = parseFunctionNames(options.function);
   const allProjectFunctions = await getAllFunctionNames();
   const functionNames = specifiedFunctions.length > 0 ? specifiedFunctions : allProjectFunctions;
@@ -247917,13 +248122,7 @@ async function logsAction(options) {
   return { outroMessage: "Fetched logs", stdout: logsOutput };
 }
 function getLogsCommand(context) {
-  return new Command("logs").description("Fetch function logs for this app").option("--function <names>", "Filter by function name(s), comma-separated. If omitted, fetches logs for all project functions").option("--since <datetime>", "Show logs from this time (ISO format)", normalizeDatetime).option("--until <datetime>", "Show logs until this time (ISO format)", normalizeDatetime).addOption(new Option("--level <level>", "Filter by log level").choices([...LogLevelSchema.options]).hideHelp()).option("-n, --limit <n>", "Results per page (1-1000, default: 50)", (v) => {
-    const n2 = Number.parseInt(v, 10);
-    if (Number.isNaN(n2) || n2 < 1 || n2 > 1000) {
-      throw new InvalidInputError(`Invalid limit: "${v}". Must be a number between 1 and 1000.`);
-    }
-    return v;
-  }).addOption(new Option("--order <order>", "Sort order").choices(["asc", "desc"])).action(async (options) => {
+  return new Command("logs").description("Fetch function logs for this app").option("--function <names>", "Filter by function name(s), comma-separated. If omitted, fetches logs for all project functions").option("--since <datetime>", "Show logs from this time (ISO format)", normalizeDatetime).option("--until <datetime>", "Show logs until this time (ISO format)", normalizeDatetime).addOption(new Option("--level <level>", "Filter by log level").choices([...LogLevelSchema.options]).hideHelp()).option("-n, --limit <n>", "Results per page (1-1000, default: 50)").addOption(new Option("--order <order>", "Sort order").choices(["asc", "desc"])).action(async (options) => {
     await runCommand(() => logsAction(options), { requireAuth: true }, context);
   });
 }
@@ -247989,11 +248188,9 @@ function parseEntries(entries) {
   }
   return secrets;
 }
-function validateInput(command) {
-  const entries = command.args;
-  const { envFile } = command.opts();
+function validateInput(entries, options) {
   const hasEntries = entries.length > 0;
-  const hasEnvFile = Boolean(envFile);
+  const hasEnvFile = Boolean(options.envFile);
   if (!hasEntries && !hasEnvFile) {
     throw new InvalidInputError("Provide KEY=VALUE pairs or use --env-file. Example: base44 secrets set KEY1=VALUE1 KEY2=VALUE2");
   }
@@ -248002,6 +248199,7 @@ function validateInput(command) {
   }
 }
 async function setSecretsAction(entries, options) {
+  validateInput(entries, options);
   let secrets;
   if (options.envFile) {
     secrets = await parseEnvFile(resolve3(options.envFile));
@@ -248024,7 +248222,7 @@ async function setSecretsAction(entries, options) {
   };
 }
 function getSecretsSetCommand(context) {
-  return new Command("set").description("Set one or more secrets (KEY=VALUE format)").argument("[entries...]", "KEY=VALUE pairs (e.g. KEY1=VALUE1 KEY2=VALUE2)").option("--env-file <path>", "Path to .env file").hook("preAction", validateInput).action(async (entries, options) => {
+  return new Command("set").description("Set one or more secrets (KEY=VALUE format)").argument("[entries...]", "KEY=VALUE pairs (e.g. KEY1=VALUE1 KEY2=VALUE2)").option("--env-file <path>", "Path to .env file").action(async (entries, options) => {
     await runCommand(() => setSecretsAction(entries, options), { requireAuth: true }, context);
   });
 }
@@ -248885,13 +249083,19 @@ function createEntityRoutes(db2, logger, remoteProxy, broadcast) {
 // src/cli/dev/dev-server/routes/integrations.ts
 var import_express3 = __toESM(require_express(), 1);
 var import_multer = __toESM(require_multer(), 1);
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { createHash, randomUUID as randomUUID4 } from "node:crypto";
 import fs28 from "node:fs";
 import path18 from "node:path";
+function createFileToken(fileUri) {
+  return createHash("sha256").update(fileUri).digest("hex");
+}
 function createIntegrationRoutes(mediaFilesDir, baseUrl, remoteProxy, logger) {
   const router = import_express3.Router({ mergeParams: true });
   const parseBody = import_express3.json();
+  const privateFilesDir = path18.join(mediaFilesDir, "private");
   fs28.mkdirSync(mediaFilesDir, { recursive: true });
+  fs28.mkdirSync(privateFilesDir, { recursive: true });
+  const MAX_FILE_SIZE = 50 * 1024 * 1024;
   const storage = import_multer.default.diskStorage({
     destination: mediaFilesDir,
     filename: (_req, file2, cb2) => {
@@ -248899,8 +249103,18 @@ function createIntegrationRoutes(mediaFilesDir, baseUrl, remoteProxy, logger) {
       cb2(null, `${randomUUID4()}${ext}`);
     }
   });
-  const MAX_FILE_SIZE = 50 * 1024 * 1024;
+  const privateStorage = import_multer.default.diskStorage({
+    destination: privateFilesDir,
+    filename: (_req, file2, cb2) => {
+      const ext = path18.extname(file2.originalname);
+      cb2(null, `${randomUUID4()}${ext}`);
+    }
+  });
   const upload = import_multer.default({ storage, limits: { fileSize: MAX_FILE_SIZE } });
+  const privateUpload = import_multer.default({
+    storage: privateStorage,
+    limits: { fileSize: MAX_FILE_SIZE }
+  });
   router.post("/Core/UploadFile", upload.single("file"), (req, res) => {
     if (!req.file) {
       res.status(400).json({ error: "No file uploaded" });
@@ -248909,7 +249123,7 @@ function createIntegrationRoutes(mediaFilesDir, baseUrl, remoteProxy, logger) {
     const file_url = `${baseUrl}/media/${req.file.filename}`;
     res.json({ file_url });
   });
-  router.post("/Core/UploadPrivateFile", upload.single("file"), (req, res) => {
+  router.post("/Core/UploadPrivateFile", privateUpload.single("file"), (req, res) => {
     if (!req.file) {
       res.status(400).json({ error: "No file uploaded" });
       return;
@@ -248923,8 +249137,8 @@ function createIntegrationRoutes(mediaFilesDir, baseUrl, remoteProxy, logger) {
       res.status(400).json({ error: "file_uri is required" });
       return;
     }
-    const signature = randomUUID4();
-    const signed_url = `${baseUrl}/media/${file_uri}?signature=${signature}`;
+    const token2 = createFileToken(file_uri);
+    const signed_url = `${baseUrl}/media/private/${file_uri}?token=${token2}`;
     res.json({ signed_url });
   });
   router.post("/Core/:endpointName", (req, res, next) => {
@@ -250693,6 +250907,24 @@ async function createDevServer(options8) {
   const entityRoutes = createEntityRoutes(db2, devLogger, remoteProxy, (...args) => emitEntityEvent(...args));
   app.use("/api/apps/:appId/entities", entityRoutes);
   const { path: mediaFilesDir } = await $dir();
+  app.use("/media/private/:fileUri", (req, res, next) => {
+    const { fileUri } = req.params;
+    const token2 = req.query.token;
+    if (!token2) {
+      res.status(401).json({ error: "Missing token" });
+      return;
+    }
+    const expectedToken = createFileToken(fileUri);
+    if (token2 !== expectedToken) {
+      res.status(400).json({
+        error: "InvalidJWT",
+        message: "signature verification failed",
+        statusCode: "400"
+      });
+      return;
+    }
+    next();
+  });
   app.use("/media", import_express4.default.static(mediaFilesDir));
   const integrationRoutes = createIntegrationRoutes(mediaFilesDir, baseUrl, remoteProxy, devLogger);
   app.use("/api/apps/:appId/integration-endpoints", integrationRoutes);
@@ -255143,4 +255375,4 @@ export {
   CLIExitError
 };
 
-//# debugId=5197AF7DA9482FFF64756E2164756E21
+//# debugId=384DD458B8CE578E64756E2164756E21