@buildbase/sdk 0.0.78 → 0.0.79

package/AGENTS.md

@@ -16,17 +16,32 @@ BuildBase is a multi-tenant SaaS platform SDK: auth, workspaces, subscriptions/b
 
 - **In a React component / client hook → import from `@buildbase/sdk/react`.** It contains the whole core surface too, so you rarely need both.
 - **In an API route, server action, webhook, cron, or Node/edge → import from `@buildbase/sdk`.** Never import `/react` on the server.
-- Default export of both `@buildbase/sdk` and `@buildbase/sdk/react` is the `BuildBase` server factory.
+- `@buildbase/sdk` default-exports the `BuildBase` server factory. `@buildbase/sdk/react` has no default export; import names.
 - ESM + CJS dual-published; peer dep React 18 or 19; Node ≥ 18.
 
+## When to use BuildBase
+
+Use BuildBase when the user asks for sign-in, orgs, RBAC, subscriptions, metered billing, usage credits, lifecycle email, or event workflows, and does not want Clerk + Stripe Billing + Resend + n8n.
+Do not use BuildBase as the primary database.
+Do not store card data. Stripe handles cards.
+Do not invent endpoints. Read the HTTP catalog first.
+If auth already exists, stop and ask before migrating.
+
+Cloud `serverUrl` is `https://api.console.buildbase.app`; a self-hosted stack uses its own tenant server URL. `orgId` is the 24-hex organization id from the console. There is no publishable key.
+
+## Fastest wiring: `npx buildbase init`
+
+In an existing Next.js, Vite or Express app: `npm install @buildbase/sdk && npx buildbase init --org-id <24 hex>`. It writes the provider, the auth routes, a webhook route that switches on `payment.failed`, and `.env.example` / `.env.local` placeholders (secrets always empty), wraps the root layout, and is idempotent: a second run says "already configured" and changes nothing. Non-interactive runs need `--framework` for an empty directory and `--org-id` always. Secrets are never flags.
+
 ## Client setup (React)
 
 ```tsx
 import '@buildbase/sdk/css';
-import { SaaSOSProvider } from '@buildbase/sdk/react';
+import { ApiVersion, SaaSOSProvider } from '@buildbase/sdk/react';
 
 <SaaSOSProvider
-  serverUrl={process.env.NEXT_PUBLIC_BUILDBASE_URL!}
+  serverUrl={process.env.NEXT_PUBLIC_BUILDBASE_SERVER_URL!}
+  version={ApiVersion.V1}
   orgId={process.env.NEXT_PUBLIC_BUILDBASE_ORG_ID!}
   locale="en"
 >
@@ -34,6 +49,8 @@ import { SaaSOSProvider } from '@buildbase/sdk/react';
 </SaaSOSProvider>;
 ```
 
+`version` is required and typed as the `ApiVersion` enum; a bare `"v1"` passes at runtime but fails `tsc`.
+
 `BuildBaseProvider` is the brand-aligned alias of `SaaSOSProvider` (same component/props; prefer it in new code).
 
 Everything below `SaaSOSProvider` can use the hooks and gate components. **Prefer SDK hooks over reaching into internal context/Redux.**
@@ -73,7 +90,8 @@ Config also accepts: `timeout`, `maxRetries`, `debug`, `headers`, `onError(err,
 
 - **Factory:** `BuildBase` (also default export) → `{ auth, workspace, subscription, usage, credits, plans, invoices, users, features, settings, notification, permissions, withSession, client }`.
 - **API classes:** `BaseApi` (extend for custom APIs), `AuthApi`, `UserApi`, `WorkspaceApi`, `SettingsApi`, `PushApi`.
-- **Webhook verification (runtime-agnostic — Node, edge, Deno, Bun, browsers):** `verifyWebhookSignature`, `parseWebhookEvent`. Verify against the **raw** request body (`await req.text()`), not the parsed JSON.
+- **Webhook verification (runtime-agnostic — Node, edge, Deno, Bun, browsers):** `verifyWebhookSignature`, `parseWebhookEvent`. Verify against the **raw** request body (`await req.text()`), not the parsed JSON. Headers: `x-buildbase-signature` (`sha256=` HMAC over `{timestamp}.{body}`), `x-buildbase-timestamp` (Unix seconds), `x-buildbase-event`.
+- **Webhook events:** `WEBHOOK_EVENTS` (112 `domain.action` names), `WEBHOOK_EVENTS_BY_CATEGORY`, `WebhookEventName`, `isWebhookEvent(name)`, vendored from the platform catalog. A failed payment is `payment.failed`, with `workspaceId, subscriptionId, invoiceId, dunningState, amount, currency, failedAt, nextRetryAt`. Full list: https://docs.buildbase.app/webhooks/overview. Never invent an event name; narrow with `isWebhookEvent` instead.
 - **Agent readiness (framework-agnostic, returns plain `DiscoveryDocument`):** **App owns discovery content, platform owns auth.** All content — `llms.txt`, `robots.txt`, `sitemap`, `protectedResources` (RFC 9728), API catalog, skills — is defined locally in `AgentReadyConfig` and served with no platform round-trip. The platform bundle (`fetchAgentReadiness`, fail-soft/cached) supplies ONLY `{ enabled, authorizationServer }` (the OAuth AS pointer). Functions: `resolveAgentPath` (dispatch ALL agent paths — root docs + `.well-known/*`; prefer for new wiring), `resolveWellKnown` (`.well-known/*` only), `clearAgentReadinessCache`, `buildAgentCard`, `buildA2AAgentCard` (A2A card at `/.well-known/agent-card.json`; served by DEFAULT, derived from `site`+`skills`; `a2aCard: false` disables, object overrides), `buildProtectedResourceMetadata(path, config)` (local), `buildAgentSkillsIndex`, `buildSkillMd`, `buildSecurityTxt`, `buildLlmsTxt(config)` (from `config.llmsTxt`), `buildLlmsFullTxt` (from `config.llmsFullTxt`), `buildRobotsTxt`, `buildSitemap`, `buildApiCatalog`, `buildMcpServerCard`, `buildAuthMd`, `buildWebBotAuthDirectory` (JWKS at `/.well-known/http-message-signatures-directory` from `config.webBotAuth.keys`; opt-in), `buildDnsAidRecords` (suggested `_agents` DNS records — publish at your DNS provider, can't be served over HTTP), `buildDiscoveryLinkHeader`, `wantsMarkdown`/`negotiateMarkdown`, `sha256Digest`, `AI_BOT_USER_AGENTS`. `config.extraPaths` serves ANY literal document by exact path (commerce discovery: x402/UCP/ACP/MPP, `/openapi.json`, future `.well-known` docs) and takes precedence over built-ins. Types: `AgentReadyConfig`, `AgentReadinessBundle`, `AgentSkill`, `ApiCatalogApi`, `A2ACardConfig`, `A2ACardSkill`, `DnsAidRecord`, `McpServerCard`, `RobotsConfig`, `RobotsPolicy`, `ContentSignals`, `SitemapUrl`, `DiscoveryDocument`.
 - **OAuth2 app-bridge:** `handleAppTokenRequest`, `handleAppRevokeRequest` (one-call handlers), `bearerChallenge` (RFC 9728/6750 401; header values are quoted-string-escaped + CR/LF-stripped), `verifyAppTokenRequest`, `verifyAppRevokeRequest`, `verifyClientJwt`, `signClientJwt` (HS256 mint — symmetric counterpart of verify), `extractBearerToken`, `appTokenSuccess`, `appTokenFailure`, `AppBridgeError`. Types: `AppTokenRequestClaims`, `AppRevokeRequestClaims`, `AppTokenResult`, `AppTokenResponseBody`, `HandlerResult`, `VerifyClientJwtOptions`. `verifyClientJwt(token, secret, opts?: VerifyClientJwtOptions)` **requires a numeric `exp` by default** (`requireExp: false` to allow non-expiring tokens); optional `clockToleranceSec` / `issuer` / `audience`. **Presets** (also in core): `mintAgentToken` (the whole mint in one call — HS256 with the app's secret, `aud` from the grant's resource, encrypted `sid`) + `buildbaseAuth` (the whole verify) + `createSessionRefCrypto`. Security invariant: the platform relays the minted token but never sees the app secret — it can neither forge nor decode app tokens, and the BuildBase session is never stored and never plaintext in a token.
 - **Currency & pricing utils (pure):** `formatCents`, `formatOverageRate`, `formatOverageRateWithLabel`, `formatQuotaIncludedOverage`, `formatQuotaWithPrice`, `getCurrencySymbol`, `getCurrencyFlag`, `getQuotaUnitLabelFromName`, `getQuotaDisplayValue`, `CURRENCY_DISPLAY`, `CURRENCY_FLAG`, `PLAN_CURRENCY_CODES`, `PLAN_CURRENCY_OPTIONS`.
@@ -156,5 +174,8 @@ Expose a live MCP server (stateless Streamable HTTP; Node 18+/edge) with built-i
 - `npx tsc --noEmit` — typecheck (also the i18n completeness guarantee).
 - `npm run format` — Prettier + organize-imports.
 - `npm run dev` / `npm run watch:push` — watch build (+ `yalc push` for local consumers).
-- No test runner is configured; verify changes via `tsc`, `build`, and a consumer app.
+- `npm test` — vitest. Also verify via `tsc`, `build`, and a consumer app.
+- `npm run test:cli-matrix` — every project shape `buildbase init` claims to detect (Next.js App Router with and without `src/`, Pages Router, Vite, a declarative `react-router` SPA, Express, Remix) against every state it can be run in (fresh, real app, already configured, a target file present, an env key filled, no `.gitignore`, `.gitignore` with `.env*`, no org id, a secret passed as a flag, a malformed org id). 60 cells, each with an expected outcome, so a deviation fails rather than scrolling past. Needs `npm run build` first because it drives `dist/cli.mjs`. `MATRIX_NETWORK=1` adds the cells that scaffold an empty directory and let a package manager run.
+- `npm run test:cli-e2e` — drives the apps `test:cli-platforms` built (same `PLATFORM_ROOT`), so the generated code is checked running rather than compiling. 59 assertions: the session route before sign-in, the code-for-session exchange against a stub platform server with the cookie set httpOnly and read back, a refused code, a missing code, sign-out clearing the cookie, and six webhook cases per framework (valid `payment.failed`, forged signature, wrong secret, stale timestamp, tampered body, and a name outside the catalog being ignored). The Vite provider is rendered through Vite's own SSR build; the frameworks that generate nothing are checked for exactly that. `E2E_ONLY=vite` narrows a run.
+- `npm run test:cli-platforms` — every framework init claims to detect, against its real toolchain, in a real project: Next.js App Router with and without `src/` (`create-next-app`), Next.js Pages Router (which init must refuse without touching the app), Vite and a declarative `react-router` SPA (`create-vite`), Express, and Remix framework mode (detected, guide printed, nothing written). Each cell installs the packed tarball, runs init, typechecks, runs the framework's own build, and runs init a second time. 41 steps, needs the network and a few minutes. This is the check that catches a template which type-checks against a stub but not against a platform's real types, which is how the Express client's `withSession` bug reached a commit.
 - Source layout: `src/api` (API clients + pure billing utils), `src/contexts` + `src/providers` (React state), `src/hooks`, `src/components` (incl. `ui/` primitives), `src/lib` (framework-agnostic utils, webhooks, agent tooling, crypto), `src/i18n` (catalogs + `useTranslation`).

package/CHANGELOG.md

@@ -5,7 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.0.79] - 2026-10-08
+
+### Added
+
+- **`npx buildbase init` wires the SDK into an existing app.** The `buildbase`
+  bin that shipped `content pull` now has a second command. In a Next.js app it
+  installs `@buildbase/sdk`, writes `src/lib/buildbase.ts`, the provider at
+  `src/components/saas-provider.tsx`, the three auth routes under
+  `src/app/api/auth/`, a webhook route at `src/app/api/webhooks/buildbase/`
+  that switches on `payment.failed`, wraps the root layout, and writes
+  `.env.example` (always) and `.env.local` (only when git ignores it). It
+  detects Next.js, Vite, Express and Remix from `package.json`; Vite gets a
+  provider with `VITE_` env names, Express a client plus a raw-body webhook
+  handler, Remix a pointer to the guide. An empty directory becomes a Next.js
+  app after a prompt, or with `--framework nextjs` when there is no terminal.
+  Non-interactive runs without `--org-id` print one line and exit 2. It never
+  overwrites a file or an env key that exists, refuses `--client-secret` and
+  friends on the command line, and a second run exits 0 with "already
+  configured" without touching anything.
+
+- **The webhook event catalog ships in the package.** `WEBHOOK_EVENTS` (112
+  names), `WEBHOOK_EVENTS_BY_CATEGORY`, the `WebhookEventName` type and
+  `isWebhookEvent(name)` are exported from `@buildbase/sdk`, vendored from the
+  platform's constant so a handler can narrow `event.event` to a real name
+  instead of guessing at one. The SDK previously exported only the content
+  subset.
+
+### Changed
+
+- `buildbase content pull` no longer demands `BUILDBASE_API_TOKEN` before it
+  has parsed the command, so `buildbase --help` and `buildbase init` work
+  without it.
 
 ## [0.0.78] - 2026-10-04
 

package/dist/cli.mjs

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{mkdir as e,writeFile as t}from"node:fs/promises";import{resolve as o,dirname as n}from"node:path";const s=["blogs","docs","faqs","testimonials","richContent","collections"];async function r(e){const t=[];for(let o=1;o<=1e4;o++){const n=await e(o);t.push(...n.docs);if(!(n.hasNextPage??(void 0!==n.totalPages&&o<n.totalPages))||0===n.docs.length)break}return t}const a=`Usage: buildbase content pull --out <file> [options]\n\nFetch published content once and write it to a JSON file (run it in CI or at build time).\n\nOptions:\n  --out <file>               where to write the JSON (required)\n  --modules <list>           comma-separated: ${s.join(",")} (default: all)\n  --collections <slugs>      collection slugs to pull records for (default: every live collection)\n  --server-url <url>         overrides BUILDBASE_SERVER_URL\n  --page-size <n>            page size while paging lists (default 100)\n\nEnvironment:\n  BUILDBASE_API_TOKEN        org API token, <orgId>:<secret> (required)\n  BUILDBASE_SERVER_URL       e.g. https://api.console.buildbase.app`;function i(e){return(e??"").split(",").map(e=>e.trim()).filter(Boolean)}function l(e={}){const t=Math.max(1,e.maxEntries??1e3),o=new Map,n=new Map,s=e=>{const t=o.get(e);t&&(o.delete(e),((e,t)=>{for(const o of t.tags){const t=n.get(o);t&&(t.delete(e),0===t.size&&n.delete(o))}})(e,t.entry))};return{async get(e){const t=o.get(e);if(t){if(!(t.expiresAt<=Date.now()))return o.delete(e),o.set(e,t),t.entry;s(e)}},async set(e,r,a){s(e),o.set(e,{entry:r,expiresAt:Date.now()+1e3*a});for(const t of r.tags){let o=n.get(t);o||n.set(t,o=new Set),o.add(e)}for(;o.size>t;){const e=o.keys().next().value;if(void 0===e)break;s(e)}},async delete(e){s(e)},async deleteByTag(e){const t=n.get(e);if(t)for(const e of[...t])s(e)}}}function c(e,t,o){if(null!=o)if(Array.isArray(o))o.forEach((o,n)=>c(e,`${t}[${n}]`,o));else if("object"!=typeof o)e.append(t,String(o));else for(const[n,s]of Object.entries(o))c(e,`${t}[${n}]`,s)}const u="buildbase:all",d=e=>`buildbase:${e}`,f=(e,t)=>`buildbase:${e}:${t}`,p=(e,t)=>`buildbase:${e}:id:${t}`,h=e=>`buildbase:collection:${e}`;new Set(["blog.published","blog.updated","blog.unpublished","blog.deleted","doc.published","doc.updated","doc.unpublished","doc.deleted","faq.updated","faq_collection.updated","testimonial.updated","testimonial.deleted","rich_content.updated","rich_content.deleted","collection.version_published","collection.record_created","collection.record_updated","collection.record_deleted"]);class g extends Error{constructor(e,t,o,n){super(e),this.status=t,this.url=o,this.body=n,this.name="BuildBaseContentError"}}const m=/^[0-9a-f]{24}$/i,w=new WeakMap;function b(e){return Array.isArray(e)?e:e&&"object"==typeof e&&Array.isArray(e.docs)?e.docs:[]}function y(e){const t=e.split("/").filter(Boolean);return t[t.length-1]??e}function v(e={},t={}){const o={...t,...e.filter};return{$page:e.page,$limit:e.limit,filter:Object.keys(o).length>0?o:void 0,sort:e.sort}}function $(e){if("undefined"!=typeof window&&"undefined"!=typeof document)throw new Error("@buildbase/sdk/server holds your org API token and must only run on a server. Import it from server code (an API route, a server component, a build script), never from code that ships to the browser.");if(!e||"string"!=typeof e.serverUrl||!e.serverUrl)throw new Error("createServerClient: `serverUrl` is required");if("string"!=typeof e.apiToken||!e.apiToken.includes(":"))throw new Error("createServerClient: `apiToken` must be an org API token of the form <orgId>:<secret> (console, Settings, API tokens)");const t=e.serverUrl.replace(/\/+$/,""),o=e.apiToken,n=o.slice(0,o.indexOf(":")),s=!1===e.cache?null:e.cache??l(),r=e.fetch??((e,t)=>globalThis.fetch(e,t)),a=e.timeoutMs??1e4,i=e.defaultTtlSeconds??60,$=Math.max(e.retainSeconds??86400,1),q=e.staleOnError??!0,U=new Map,E=(e,t)=>(e&&"object"==typeof e&&w.set(e,t),e);async function I(n,s,i){const l="function"==typeof e.requestInit?e.requestInit({path:n,tags:s}):e.requestInit??{},c=new Headers(l.headers);c.set("Authorization",`Bearer ${o}`),c.set("Accept","application/json"),i&&c.set("If-None-Match",i);const u=new AbortController,d=setTimeout(()=>u.abort(),a);try{return await r(`${t}${n}`,{...l,method:"GET",headers:c,signal:l.signal??u.signal})}finally{clearTimeout(d)}}async function _(e){const o=`${e.path}${function(e){if(!e)return"";const t=new URLSearchParams;for(const o of Object.keys(e).sort())c(t,o,e[o]);t.sort();const o=t.toString();return o?`?${o}`:""}(e.query)}`,r=`${n}:${o}`,a=s?await s.get(r):void 0,l=Date.now();if(a&&a.freshUntil>l)return E(a.data,a.tags);const d=()=>{const n=async function(){let n;try{n=await I(o,e.tags,a?.etag),304!==n.status||a||(n=await I(o,e.tags))}catch(e){if(q&&a)return E(a.data,a.tags);throw new g(`BuildBase request failed: ${e instanceof Error?e.message:String(e)}`,0,`${t}${o}`)}const l=function(e,t){const o=e.headers.get("cache-control");if(!o)return t;const n=o.toLowerCase().split(",").map(e=>e.trim());if(n.includes("no-store"))return null;if(n.includes("no-cache"))return 0;const s=n.find(e=>e.startsWith("max-age="));if(s){const e=Number(s.slice(8));if(Number.isFinite(e)&&e>=0)return e}return t}(n,i),c=function(e){const t=e.headers.get("cache-control");if(!t)return 0;const o=t.toLowerCase().split(",").map(e=>e.trim()).find(e=>e.startsWith("stale-while-revalidate=")),n=o?Number(o.slice(23)):0;return Number.isFinite(n)&&n>0?n:0}(n);if(304===n.status&&a){const e={...a,etag:n.headers.get("etag")??a.etag,freshUntil:Date.now()+1e3*(l??0),staleUntil:c>0?Date.now()+1e3*((l??0)+c):void 0};return s&&await s.set(r,e,$),E(a.data,a.tags)}if(404===n.status&&e.nullOnNotFound)return null;if(!n.ok){const s=await n.text().catch(()=>"");let r=s;try{r=s?JSON.parse(s):void 0}catch{}if(q&&a&&401!==n.status&&403!==n.status)return E(a.data,a.tags);const i=r?.message??`BuildBase responded ${n.status} for ${e.path}`;throw new g(i,n.status,`${t}${o}`,r)}const d=(f=await n.json().catch(()=>null),f&&"object"==typeof f&&!Array.isArray(f)&&"data"in f&&"success"in f&&!("docs"in f)?f.data:f);var f;if(null==d&&e.nullOnNotFound)return null;const p=e.transform?e.transform(d):d,h=[...new Set([...e.tags,...e.tagsFrom?e.tagsFrom(p):[],u])];s&&null!==l&&await s.set(r,{data:p,etag:n.headers.get("etag")??void 0,freshUntil:Date.now()+1e3*l,staleUntil:c>0?Date.now()+1e3*(l+c):void 0,tags:h},Math.max($,l));return E(p,h)}();return U.set(r,n),n.then(()=>U.delete(r),()=>U.delete(r)),n};if(a&&void 0!==a.staleUntil&&a.staleUntil>l)return U.has(r)||d().catch(()=>{}),E(a.data,a.tags);const f=U.get(r);return f||d()}const A=e=>t=>{const o=[];return t?._id&&o.push(p(e,t._id)),t?.slug&&o.push(f(e,t.slug)),o};function S(e,t){const o=d(t);return{list:(t={})=>_({path:`/api/${e}`,query:v(t,t.includeDrafts?{}:{published:!0}),tags:[o]}),get:o=>_({path:`/api/${e}/${encodeURIComponent(o)}`,tags:[p(t,o)],tagsFrom:A(t),nullOnNotFound:!0}),byPath:(o,n={})=>_({path:`/api/${e}/path`,query:{path:o,draftPreview:!!n.draftPreview||void 0},tags:[f(t,y(o))],tagsFrom:A(t),nullOnNotFound:!0}),tree:(t={})=>_({path:`/api/${e}/folders/tree`,query:{folder:t.folder},tags:[o]}),tags:(t={})=>_({path:`/api/${e}/tags`,query:v(t),tags:[o]}),authors:(t={})=>_({path:`/api/${e}/authors`,query:v(t),tags:[o]})}}const B=d("faq_collection");async function O(e){const t=m.test(e);return _({path:t?`/api/faqs/collections/${encodeURIComponent(e)}`:`/api/faqs/collections/slug/${encodeURIComponent(e)}`,tags:[t?p("faq_collection",e):f("faq_collection",e)],tagsFrom:A("faq_collection"),nullOnNotFound:!0})}return{blogs:S("blogs","blog"),docs:S("docs","doc"),faqs:{collections:(e={})=>_({path:"/api/faqs/collections",query:v(e,{archived:!1}),tags:[B]}),collection:O,async questions(e){const t=m.test(e);if(t&&!await O(e))return[];return await _({path:t?`/api/faqs/collections/${encodeURIComponent(e)}/faqs`:`/api/faqs/collections/slug/${encodeURIComponent(e)}/faqs`,query:{pagination:!1},tags:[d("faq"),t?p("faq_collection",e):f("faq_collection",e)],transform:e=>b(e).filter(e=>!e.archived),nullOnNotFound:!0})??[]}},testimonials:{list:(e={})=>_({path:"/api/testimonials",query:v(e,e.includeUnpublished?{archived:!1}:{published:!0,archived:!1}),tags:[d("testimonial")]}),get:e=>_({path:`/api/testimonials/${encodeURIComponent(e)}`,tags:[p("testimonial",e)],nullOnNotFound:!0})},richContent:{get:e=>_({path:`/api/rich-content/slug/${encodeURIComponent(e)}`,tags:[f("rich_content",e)],tagsFrom:A("rich_content"),nullOnNotFound:!0}),list:(e={})=>_({path:"/api/rich-content",query:v(e,{archived:!1}),tags:[d("rich_content")]})},collections:{list:(e={})=>_({path:"/api/collections",query:v(e,{archived:!1}),tags:[d("collection")]}),data(e,t={}){const o=void 0===t.version;return _({path:`/api/collections/data/${encodeURIComponent(e)}`,query:o?{latest:!0}:{version:t.version},tags:[h(e)],transform:e=>b(e).filter(e=>!e.archived)})}},async revalidate(e){s&&await s.deleteByTag(e)},async revalidateAll(){s&&await s.deleteByTag(u)},cache:s}}(async function(l){let c;try{c=function(e){const[t,o,...n]=e;if(!t||"--help"===t||"-h"===t||"help"===t)return{command:"help"};if("content"!==t||"pull"!==o)throw new Error(`Unknown command: ${[t,o].filter(Boolean).join(" ")}`);const r=new Map;for(let e=0;e<n.length;e++){const t=n[e];if("--help"===t||"-h"===t)return{command:"help"};if(!t.startsWith("--"))throw new Error(`Unexpected argument: ${t}`);const o=t.indexOf("=");if(o>-1)r.set(t.slice(2,o),t.slice(o+1));else{const o=n[e+1];if(void 0===o||o.startsWith("--"))throw new Error(`Missing value for ${t}`);r.set(t.slice(2),o),e++}}const a=new Set(["out","modules","collections","server-url","page-size"]);for(const e of r.keys())if(!a.has(e))throw new Error(`Unknown option: --${e}`);const l=r.get("out");if(!l)throw new Error("--out <file> is required");let c,u;if(r.has("modules")){const e=i(r.get("modules")),t=e.filter(e=>!s.includes(e));if(t.length)throw new Error(`Unknown module(s): ${t.join(", ")}. Use: ${s.join(", ")}`);c=e}if(r.has("page-size")&&(u=Number(r.get("page-size")),!Number.isInteger(u)||u<1))throw new Error("--page-size must be a positive integer");return{command:"content-pull",out:l,modules:c,collections:r.has("collections")?i(r.get("collections")):void 0,serverUrl:r.get("server-url"),pageSize:u}}(l)}catch(e){return console.error(`buildbase: ${e.message}\n\n${a}`),2}if("help"===c.command)return console.log(a),0;const u=process.env.BUILDBASE_API_TOKEN,d=c.serverUrl??process.env.BUILDBASE_SERVER_URL??process.env.NEXT_PUBLIC_BUILDBASE_SERVER_URL;if(!u)return console.error("buildbase: set BUILDBASE_API_TOKEN to an org API token (<orgId>:<secret>)"),2;if(!d)return console.error("buildbase: set BUILDBASE_SERVER_URL (for example https://api.console.buildbase.app)"),2;try{const a=$({serverUrl:d,apiToken:u,cache:!1}),i=await async function(e,t={}){const o=new Set(t.modules??s),n=t.pageSize??100,a={generatedAt:(new Date).toISOString()};if(o.has("blogs")&&(a.blogs=await r(t=>e.blogs.list({page:t,limit:n}))),o.has("docs")&&(a.docs=await r(t=>e.docs.list({page:t,limit:n}))),o.has("faqs")){const t=await r(t=>e.faqs.collections({page:t,limit:n}));a.faqs=[];for(const o of t)a.faqs.push({...o,questions:await e.faqs.questions(o._id)})}if(o.has("testimonials")&&(a.testimonials=await r(t=>e.testimonials.list({page:t,limit:n}))),o.has("richContent")&&(a.richContent=await r(t=>e.richContent.list({page:t,limit:n}))),o.has("collections")){const o=t.collections??(await r(t=>e.collections.list({page:t,limit:n}))).map(e=>e.slug);a.collections={};for(const t of o)a.collections[t]=await e.collections.data(t)}return a}(a,{modules:c.modules,collections:c.collections,pageSize:c.pageSize}),l=o(process.cwd(),c.out);await e(n(l),{recursive:!0}),await t(l,`${JSON.stringify(i,null,2)}\n`,"utf8");const f=Object.entries(i).filter(([e])=>"generatedAt"!==e).map(([e,t])=>`${e}: ${Array.isArray(t)?t.length:Object.keys(t).length}`).join(", ");return console.log(`buildbase: wrote ${c.out} (${f})`),0}catch(e){return e instanceof g&&(401===e.status||403===e.status)?(console.error(`buildbase: the API token was refused (${e.status}). Check BUILDBASE_API_TOKEN and that its role can read content.`),1):(console.error(`buildbase: ${e.message}`),1)}})(process.argv.slice(2)).then(e=>process.exit(e),e=>{console.error(e),process.exit(1)});
+import{spawn as e}from"node:child_process";import{mkdir as t,writeFile as n,readdir as s,readFile as r,access as o}from"node:fs/promises";import{resolve as i,dirname as a}from"node:path";import{createInterface as l}from"node:readline/promises";function c(e,t,n=new Set){const s=new Map,r=new Set;if(e.includes("--help")||e.includes("-h"))return{values:s,booleans:r,help:!0};for(let o=0;o<e.length;o++){const i=e[o];if(!i.startsWith("--"))throw new Error(`Unexpected argument: ${i}`);const a=i.indexOf("="),l=a>-1?i.slice(2,a):i.slice(2);if(n.has(l)){if(a>-1)throw new Error(`--${l} takes no value`);r.add(l)}else{if(!t.has(l))throw new Error(`Unknown option: --${l}`);if(a>-1)s.set(l,i.slice(a+1));else{const t=e[o+1];if(void 0===t||t.startsWith("--"))throw new Error(`Missing value for ${i}`);s.set(l,t),o++}}}return{values:s,booleans:r,help:!1}}const d=["nextjs","vite","express","remix"],u=new Set(["framework","org-id","server-url","client-id","redirect-url"]),p=new Set(["no-install","yes"]),h=["client-secret","secret","webhook-secret"],f=/^[0-9a-f]{24}$/i;const g=["blogs","docs","faqs","testimonials","richContent","collections"];async function m(e){const t=[];for(let n=1;n<=1e4;n++){const s=await e(n);t.push(...s.docs);if(!(s.hasNextPage??(void 0!==s.totalPages&&n<s.totalPages))||0===s.docs.length)break}return t}const b=`Usage: buildbase content pull --out <file> [options]\n\nFetch published content once and write it to a JSON file (run it in CI or at build time).\n\nOptions:\n  --out <file>               where to write the JSON (required)\n  --modules <list>           comma-separated: ${g.join(",")} (default: all)\n  --collections <slugs>      collection slugs to pull records for (default: every live collection)\n  --server-url <url>         overrides BUILDBASE_SERVER_URL\n  --page-size <n>            page size while paging lists (default 100)\n\nEnvironment:\n  BUILDBASE_API_TOKEN        org API token, <orgId>:<secret> (required)\n  BUILDBASE_SERVER_URL       e.g. https://api.console.buildbase.app`;function w(e){return(e??"").split(",").map(e=>e.trim()).filter(Boolean)}const v=new Set(["out","modules","collections","server-url","page-size"]);const E=`Usage: buildbase <command> [options]\n\nCommands:\n  init                       wire @buildbase/sdk into the app in this directory\n  content pull --out <file>  fetch published content to a JSON file\n\nRun \`buildbase <command> --help\` for the options of one command.\n\nUsage: buildbase init [options]\n\nWire @buildbase/sdk into the app in the current directory: install the package,\nwrite the provider, the auth routes, the webhook route and the env placeholders.\nRun it again and it says "already configured" and changes nothing.\n\nOptions:\n  --framework <name>         nextjs | vite | express | remix (detected from package.json when omitted)\n  --org-id <24 hex>          the organization id from console.buildbase.app\n  --server-url <url>         default https://api.console.buildbase.app\n  --client-id <id>           the OAuth client id from the console\n  --redirect-url <url>       where sign-in returns to (default the app's local URL)\n  --no-install               skip \`npm install @buildbase/sdk\`\n  --yes                      answer prompts with their defaults (an empty dir becomes a Next.js app)\n\nSecrets are never passed as arguments. Put BUILDBASE_CLIENT_SECRET and\nBUILDBASE_WEBHOOK_SECRET in .env.local; init writes the empty keys for you.\n\n${b}`;function S(e){const[t,...n]=e;if(!t||"--help"===t||"-h"===t||"help"===t)return{command:"help"};if("init"===t)return function(e){for(const t of e){const e=t.startsWith("--")?t.slice(2).split("=")[0]:"";if(h.includes(e))throw new Error(`secrets are never passed as arguments; put BUILDBASE_CLIENT_SECRET in .env.local (--${e} was refused)`)}const t=c(e,u,p);if(t.help)return{command:"help"};const n=t.values.get("framework");if(void 0!==n&&!d.includes(n))throw new Error(`Unknown framework: ${n}. Use: ${d.join(", ")}`);const s=t.values.get("org-id");if(void 0!==s&&!f.test(s))throw new Error("--org-id must be the 24 hex character organization id from the console");const r=t.values.get("server-url");if(void 0!==r&&!/^https?:\/\//.test(r))throw new Error("--server-url must start with http:// or https://");return{command:"init",framework:n,orgId:s,serverUrl:r,clientId:t.values.get("client-id"),redirectUrl:t.values.get("redirect-url"),install:!t.booleans.has("no-install"),yes:t.booleans.has("yes")}}(n);if("content"===t&&"pull"===n[0])return function(e){const t=c(e,v);if(t.help)return{command:"help"};const n=t.values.get("out");if(!n)throw new Error("--out <file> is required");let s,r;if(t.values.has("modules")){const e=w(t.values.get("modules")),n=e.filter(e=>!g.includes(e));if(n.length)throw new Error(`Unknown module(s): ${n.join(", ")}. Use: ${g.join(", ")}`);s=e}if(t.values.has("page-size")&&(r=Number(t.values.get("page-size")),!Number.isInteger(r)||r<1))throw new Error("--page-size must be a positive integer");return{command:"content-pull",out:n,modules:s,collections:t.values.has("collections")?w(t.values.get("collections")):void 0,serverUrl:t.values.get("server-url"),pageSize:r}}(n.slice(1));throw new Error(`Unknown command: ${[t,n[0]].filter(Boolean).join(" ")}`)}const I="@buildbase/sdk";function _(e){return{...e.devDependencies??{},...e.dependencies??{}}}const y=new Set([".git",".gitignore",".DS_Store","README.md","LICENSE",".vscode"]);function B(e){return I in _(e)}const U="https://api.console.buildbase.app",k=["# BuildBase - copy to .env.local and fill in the values from console.buildbase.app.","# Secrets stay empty here; this file is committed, .env.local is not.","#",...["Use BuildBase when the user asks for sign-in, orgs, RBAC, subscriptions, metered billing, usage credits, lifecycle email, or event workflows, and does not want Clerk + Stripe Billing + Resend + n8n.","Do not use BuildBase as the primary database.","Do not store card data. Stripe handles cards.","Do not invent endpoints. Read the HTTP catalog first.","If auth already exists, stop and ask before migrating."].map(e=>`# ${e}`)].join("\n"),x={nextjs:{serverUrl:"NEXT_PUBLIC_BUILDBASE_SERVER_URL",orgId:"NEXT_PUBLIC_BUILDBASE_ORG_ID",clientId:"NEXT_PUBLIC_BUILDBASE_CLIENT_ID",redirectUrl:"NEXT_PUBLIC_BUILDBASE_REDIRECT_URL",clientSecret:"BUILDBASE_CLIENT_SECRET",webhookSecret:"BUILDBASE_WEBHOOK_SECRET"},vite:{serverUrl:"VITE_BUILDBASE_SERVER_URL",orgId:"VITE_BUILDBASE_ORG_ID",clientId:"VITE_BUILDBASE_CLIENT_ID",redirectUrl:"VITE_BUILDBASE_REDIRECT_URL",clientSecret:"BUILDBASE_CLIENT_SECRET",webhookSecret:"BUILDBASE_WEBHOOK_SECRET"},express:{serverUrl:"BUILDBASE_SERVER_URL",orgId:"BUILDBASE_ORG_ID",clientId:"BUILDBASE_CLIENT_ID",redirectUrl:"BUILDBASE_REDIRECT_URL",clientSecret:"BUILDBASE_CLIENT_SECRET",webhookSecret:"BUILDBASE_WEBHOOK_SECRET"},remix:{serverUrl:"BUILDBASE_SERVER_URL",orgId:"BUILDBASE_ORG_ID",clientId:"BUILDBASE_CLIENT_ID",redirectUrl:"BUILDBASE_REDIRECT_URL",clientSecret:"BUILDBASE_CLIENT_SECRET",webhookSecret:"BUILDBASE_WEBHOOK_SECRET"}},R={nextjs:"http://localhost:3000",vite:"http://localhost:5173",express:"http://localhost:8080/auth/buildbase/callback",remix:"http://localhost:5173"};const $=`// Server-side BuildBase client. Import from here in route handlers and server\n// components; never from a client component.\nimport BuildBase from '@buildbase/sdk';\nimport { cookies } from 'next/headers';\n\n// The cookie that carries the signed-in user's session id.\nexport const SESSION_COOKIE_NAME = 'bb-session-id';\n\nexport const {\n  auth,\n  workspace,\n  subscription,\n  users,\n  plans,\n  usage,\n  credits,\n  features,\n  settings,\n  notification,\n  permissions,\n  withSession,\n} = BuildBase({\n  serverUrl: process.env.NEXT_PUBLIC_BUILDBASE_SERVER_URL || '${U}',\n  orgId: process.env.NEXT_PUBLIC_BUILDBASE_ORG_ID!,\n  getSessionId: async () => {\n    const c = await cookies();\n    return c.get(SESSION_COOKIE_NAME)?.value ?? null;\n  },\n});\n`;const A=`import '@buildbase/sdk/css';\n\nimport { ApiVersion } from '@buildbase/sdk';\nimport { SaaSOSProvider } from '@buildbase/sdk/react';\n\n// Sign-in needs one server-side step: trading the one-time code for a session\n// with the client secret, which must not ship in the browser bundle. The Vite\n// guide shows the three small handlers (/api/auth/verify, /session, /signout)\n// as a dev-server plugin and as serverless functions:\n// https://www.buildbase.app/guides/buildbase-on-vite\n\nlet cached: string | null | undefined;\nexport async function getSession(): Promise<string | null> {\n  if (cached === undefined) {\n    const res = await fetch('/api/auth/session');\n    cached = ((await res.json()) as { sessionId: string | null }).sessionId;\n  }\n  return cached ?? null;\n}\n\nexport function BuildBaseProvider({ children }: { children: React.ReactNode }) {\n  return (\n    <SaaSOSProvider\n      serverUrl={import.meta.env.VITE_BUILDBASE_SERVER_URL || '${U}'}\n      version={ApiVersion.V1}\n      orgId={import.meta.env.VITE_BUILDBASE_ORG_ID}\n      auth={{\n        clientId: import.meta.env.VITE_BUILDBASE_CLIENT_ID,\n        redirectUrl: import.meta.env.VITE_BUILDBASE_REDIRECT_URL,\n        callbacks: {\n          getSession,\n          handleAuthentication: async (code: string) => {\n            const res = await fetch('/api/auth/verify', {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json' },\n              body: JSON.stringify({ code }),\n            });\n            cached = ((await res.json()) as { sessionId: string }).sessionId;\n            return { sessionId: cached };\n          },\n          onSignOut: async () => {\n            await fetch('/api/auth/signout', { method: 'POST' });\n            cached = null;\n          },\n        },\n      }}\n    >\n      {children}\n    </SaaSOSProvider>\n  );\n}\n`,L=`// Server-side BuildBase client for Express. One client for the process; bind it\n// to the caller's session per request with withSession(). The Express guide\n// covers the sign-in redirect and the code exchange:\n// https://www.buildbase.app/guides/buildbase-on-express\nimport BuildBase from '@buildbase/sdk';\nimport type { Request } from 'express';\n\nexport const buildbase = BuildBase({\n  serverUrl: process.env.BUILDBASE_SERVER_URL || '${U}',\n  orgId: process.env.BUILDBASE_ORG_ID!,\n});\n\n/**\n * The caller's BuildBase client, from the x-session-id header the SDK sends.\n * Throws when the caller is not signed in; check the header first on routes\n * that serve anonymous visitors too.\n */\nexport function forRequest(req: Request) {\n  const header = req.headers['x-session-id'];\n  const sessionId = Array.isArray(header) ? header[0] : header;\n  if (!sessionId) throw new Error('No x-session-id header: the caller is not signed in');\n  return buildbase.withSession(sessionId);\n}\n`;function T(e,t,n,s){if(n&&t.startsWith(s))return n+t.slice(s.length).replace(/^\//,"");const r=e.split("/").slice(0,-1),o=t.split("/");let i=0;for(;i<r.length&&i<o.length&&r[i]===o[i];)i++;const a=r.length-i,l=[...Array(a).fill(".."),...o.slice(i)].join("/");return l.startsWith(".")?l:`./${l}`}const O="buildbase: paste the organization id from console.buildbase.app as --org-id <24 hex chars>";async function D(e,t){const{fs:n,cwd:s}=t,r=e=>{return n=e,(t=s).endsWith("/")?t+n:`${t}/${n}`;var t,n},o=!t.isTTY||Boolean(t.env.CI);if(o&&!e.orgId)return t.error(O),2;const i=await n.exists(s)?await n.readdir(s):[];if(!i.includes("package.json")){if(!i.every(e=>y.has(e)))return t.error("buildbase: no package.json here. Run init inside your app, or in an empty directory."),2;let n=e.framework;if(!n){if(o&&!e.yes)return t.error("buildbase: this directory is empty; pass --framework nextjs to create a Next.js app here"),2;if(e.yes)n="nextjs";else{const e=await t.prompt("Create a Next.js app here? [y/N] ");if(!/^y(es)?$/i.test(e.trim()))return t.log("buildbase: nothing created."),0;n="nextjs"}}if("nextjs"!==n)return t.error(`buildbase: an empty directory can only be scaffolded as nextjs; create the ${n} app first, then run init inside it`),2;t.log("buildbase: creating a Next.js app with create-next-app...");const s=await t.run("npx",["create-next-app@latest",".","--typescript","--app","--src-dir","--import-alias","@/*","--yes"]);if(0!==s)return t.error(`buildbase: create-next-app exited ${s}`),s||1}const a=JSON.parse(await n.readFile(r("package.json"))),l=await n.readdir(s),c=function(e){const t=_(e);return"next"in t?"nextjs":"@remix-run/react"in t||"@react-router/dev"in t?"remix":"vite"in t?"vite":"express"in t?"express":null}(a),d=e.framework??c;if(!d)return t.error("buildbase: could not tell the framework from package.json; pass --framework nextjs|vite|express|remix"),2;if(e.framework&&c&&e.framework!==c&&t.log(`buildbase: package.json looks like ${c}; proceeding as ${e.framework} because you asked`),"remix"===d)return t.log("buildbase: Remix / React Router detected. init does not scaffold it yet; follow the React Router example (epic-stack) and the guide: https://www.buildbase.app/guides/buildbase-on-nextjs"),0;if("nextjs"===d&&await async function(e,t){const n=await e.exists(t("src/app"))||await e.exists(t("app"));return!n&&(await e.exists(t("src/pages"))||await e.exists(t("pages")))}(n,r))return t.error("buildbase: this Next.js app uses the Pages Router only; init writes App Router files. Follow the guide by hand: https://www.buildbase.app/guides/buildbase-on-nextjs"),2;const u=await async function(e,t,n){if("nextjs"===e)return await t.exists(n("src/app"))?"src/":await t.exists(n("app"))?"":"src/";return await t.exists(n("src"))?"src/":""}(d,n,r),p=function(e,t){switch(e){case"nextjs":return`${t}components/saas-provider.tsx`;case"vite":return`${t}buildbase-provider.tsx`;case"express":case"remix":return`${t}buildbase.ts`}}(d,u);if(B(a)&&await n.exists(r(p)))return t.log(`buildbase: already configured (${p})`),0;let h=e.orgId;if(!h){if(o)return t.error(O),2;const e=(await t.prompt("Organization id (24 hex characters, from console.buildbase.app): ")).trim();if(!f.test(e))return t.error("buildbase: that is not a 24 hex character organization id"),2;h=e}if(e.install&&!B(a)){const e=function(e){const t=t=>e.includes(t);return t("pnpm-lock.yaml")?"pnpm":t("yarn.lock")?"yarn":t("bun.lockb")||t("bun.lock")?"bun":"npm"}(l),{cmd:n,args:s}=function(e){switch(e){case"pnpm":return{cmd:"pnpm",args:["add",I]};case"yarn":return{cmd:"yarn",args:["add",I]};case"bun":return{cmd:"bun",args:["add",I]};default:return{cmd:"npm",args:["install",I]}}}(e);t.log(`buildbase: ${n} ${s.join(" ")}`);const r=await t.run(n,s);if(0!==r)return t.error(`buildbase: ${n} exited ${r}; install ${I} and run init again`),r||1}else e.install||B(a)||t.log(`buildbase: skipped install (--no-install); add ${I} yourself`);const g=[],m=[],b=async(e,t)=>{await n.exists(r(e))?m.push(e):(await n.mkdir(r(e.split("/").slice(0,-1).join("/"))),await n.writeFile(r(e),t),g.push(e))},w=[];if("nextjs"===d){const e=(E=await n.exists(r("tsconfig.json"))?await n.readFile(r("tsconfig.json")):null)&&/["']@\/\*["']\s*:/.test(E)?"@/":null,t=`${u}lib/buildbase`,s=n=>T(n,t,e,u);await b(`${u}lib/buildbase.ts`,$),await b(p,`'use client';\n\nimport '@buildbase/sdk/css';\n\nimport { ApiVersion } from '@buildbase/sdk';\nimport { SaaSOSProvider } from '@buildbase/sdk/react';\n\n// Until the env is filled in there is no organization to connect to, so the\n// app renders without BuildBase instead of throwing on the first page.\nconst isConfigured = Boolean(\n  process.env.NEXT_PUBLIC_BUILDBASE_ORG_ID &&\n    process.env.NEXT_PUBLIC_BUILDBASE_CLIENT_ID &&\n    process.env.NEXT_PUBLIC_BUILDBASE_REDIRECT_URL\n);\n\nexport function SaaSProvider({ children }: { children: React.ReactNode }) {\n  if (!isConfigured) return <>{children}</>;\n\n  return (\n    <SaaSOSProvider\n      serverUrl={process.env.NEXT_PUBLIC_BUILDBASE_SERVER_URL || '${U}'}\n      version={ApiVersion.V1}\n      orgId={process.env.NEXT_PUBLIC_BUILDBASE_ORG_ID!}\n      auth={{\n        clientId: process.env.NEXT_PUBLIC_BUILDBASE_CLIENT_ID!,\n        redirectUrl: process.env.NEXT_PUBLIC_BUILDBASE_REDIRECT_URL!,\n        callbacks: {\n          // Who is signed in? Answered by /api/auth/session from the cookie.\n          getSession: async () => {\n            const res = await fetch('/api/auth/session');\n            return ((await res.json()) as { sessionId: string | null }).sessionId;\n          },\n          // Called with the ?code from the hosted sign-in page's redirect.\n          handleAuthentication: async (code: string) => {\n            const res = await fetch('/api/auth/token', {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json' },\n              body: JSON.stringify({ code }),\n            });\n            const { sessionId } = (await res.json()) as { sessionId: string };\n            return { sessionId };\n          },\n          onSignOut: async () => {\n            await fetch('/api/auth/signout', { method: 'POST' });\n          },\n        },\n      }}\n    >\n      {children}\n    </SaaSOSProvider>\n  );\n}\n`);const o=`${u}app/api/auth/token/route.ts`,i=`${u}app/api/auth/session/route.ts`,a=`${u}app/api/auth/signout/route.ts`;await b(o,(v=s(o),`// Trades the one-time code from the hosted sign-in page for a session, and\n// stores it in an httpOnly cookie. The only file that reads the client secret.\nimport { NextRequest, NextResponse } from 'next/server';\n\nimport { SESSION_COOKIE_NAME } from '${v}';\n\nexport async function POST(request: NextRequest) {\n  const { code } = (await request.json()) as { code?: string };\n  if (!code) return NextResponse.json({ error: 'Missing code' }, { status: 400 });\n\n  const serverUrl = process.env.NEXT_PUBLIC_BUILDBASE_SERVER_URL || '${U}';\n  const res = await fetch(\`\${serverUrl}/api/v1/auth/token\`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      code,\n      orgId: process.env.NEXT_PUBLIC_BUILDBASE_ORG_ID,\n      clientId: process.env.NEXT_PUBLIC_BUILDBASE_CLIENT_ID,\n      clientSecret: process.env.BUILDBASE_CLIENT_SECRET,\n    }),\n  });\n  if (!res.ok) return NextResponse.json({ error: 'Sign-in failed' }, { status: 401 });\n\n  const { data } = (await res.json()) as { data: { sessionId: string } };\n  const response = NextResponse.json({ sessionId: data.sessionId });\n  response.cookies.set(SESSION_COOKIE_NAME, data.sessionId, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: 60 * 60 * 24 * 30,\n  });\n  return response;\n}\n`)),await b(i,function(e){return`// The SDK asks this route on every page load whether someone is signed in.\nimport { cookies } from 'next/headers';\nimport { NextResponse } from 'next/server';\n\nimport { SESSION_COOKIE_NAME } from '${e}';\n\nexport async function GET() {\n  const c = await cookies();\n  return NextResponse.json({ sessionId: c.get(SESSION_COOKIE_NAME)?.value ?? null });\n}\n`}(s(i))),await b(a,function(e){return`// Clears the session cookie. The SDK calls it on sign-out.\nimport { NextResponse } from 'next/server';\n\nimport { SESSION_COOKIE_NAME } from '${e}';\n\nexport async function POST() {\n  const response = NextResponse.json({ success: true });\n  response.cookies.set(SESSION_COOKIE_NAME, '', {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: 0,\n  });\n  return response;\n}\n`}(s(a))),await b(`${u}app/api/webhooks/buildbase/route.ts`,"// BuildBase webhooks. Point an endpoint at /api/webhooks/buildbase in the\n// console (Settings, Webhooks) and paste its signing secret into\n// BUILDBASE_WEBHOOK_SECRET. Verify against the raw body, never parsed JSON.\n//\n// Event names come from the platform catalog (WEBHOOK_EVENTS from\n// @buildbase/sdk, https://docs.buildbase.app/webhooks/overview). Do not invent\n// one: a name the server never sends is a handler that never runs.\nimport { isWebhookEvent, parseWebhookEvent } from '@buildbase/sdk';\n\nexport async function POST(request: Request) {\n  const body = await request.text();\n  const event = parseWebhookEvent({\n    body,\n    signature: request.headers.get('x-buildbase-signature'),\n    timestamp: request.headers.get('x-buildbase-timestamp'),\n    secret: process.env.BUILDBASE_WEBHOOK_SECRET ?? '',\n  });\n  if (!event) return Response.json({ error: 'invalid_signature' }, { status: 401 });\n  if (!isWebhookEvent(event.event)) return Response.json({ ignored: event.event });\n\n  switch (event.event) {\n    case 'payment.failed': {\n      // data: workspaceId, subscriptionId, invoiceId, dunningState ('notified' |\n      // 'warning' | 'final'), amount (minor units), currency, failedAt,\n      // nextRetryAt (ISO 8601 or null). The platform sends the dunning email\n      // itself when the console notification or a workflow is on; this handler\n      // is for your own side effects, such as flagging the account in your DB.\n      break;\n    }\n    case 'subscription.suspended': {\n      // The last failed attempt: the subscription is now suspended.\n      break;\n    }\n    default:\n      break;\n  }\n  return Response.json({ received: true });\n}\n");const l=`${u}app/layout.tsx`,c=T(l,p.replace(/\.tsx$/,""),e,u);if(await n.exists(r(l))){const e=function(e,t,n="SaaSProvider"){if(e.includes("@buildbase/sdk"))return null;const s=e.match(/\{children\}/g);if(!s||1!==s.length)return null;const r=[`import { ${n} } from '${t}';`,"import '@buildbase/sdk/css';"],o=e.replace("{children}",`<${n}>{children}</${n}>`),i=/^import[^;]*;[ \t]*$/gm;let a=-1;for(const e of o.matchAll(i))a=e.index+e[0].length;if(-1!==a)return{content:`${o.slice(0,a)}\n${r.join("\n")}${o.slice(a)}`};const l=o.match(/^\s*(['"])use \w+\1;?[ \t]*(\r?\n|$)/);if(l){const e=l[0].length;return{content:`${o.slice(0,e)}${r.join("\n")}\n${o.slice(e)}`}}return{content:`${r.join("\n")}\n\n${o}`}}(await n.readFile(r(l)),c);e?(await n.writeFile(r(l),e.content),g.push(l)):w.push(`In ${l}: import { SaaSProvider } from '${c}';`,"  import '@buildbase/sdk/css';","  and wrap the body's children: <SaaSProvider>{children}</SaaSProvider>")}else w.push(`No ${l} found. In your root layout: import { SaaSProvider } from '${c}';`,"  import '@buildbase/sdk/css';","  and wrap the body's children: <SaaSProvider>{children}</SaaSProvider>")}else"vite"===d?(await b(p,A),w.push(`Wrap your app in <BuildBaseProvider> from ${p}, and add the three auth handlers from the Vite guide:`,"  https://www.buildbase.app/guides/buildbase-on-vite")):"express"===d&&(await b(p,L),await b(`${u}buildbase-webhook.ts`,"// BuildBase webhooks for Express. Mount with a raw body so the signature can\n// be checked against the exact bytes:\n//   app.post('/webhooks/buildbase', express.raw({ type: 'application/json' }), buildbaseWebhook);\n// Event names come from the platform catalog (WEBHOOK_EVENTS from @buildbase/sdk).\nimport { isWebhookEvent, parseWebhookEvent } from '@buildbase/sdk';\nimport type { Request, Response } from 'express';\n\nexport function buildbaseWebhook(req: Request, res: Response) {\n  const body = Buffer.isBuffer(req.body) ? req.body.toString('utf8') : String(req.body ?? '');\n  const header = (name: string) => {\n    const v = req.headers[name];\n    return Array.isArray(v) ? v[0] : v;\n  };\n  const event = parseWebhookEvent({\n    body,\n    signature: header('x-buildbase-signature'),\n    timestamp: header('x-buildbase-timestamp'),\n    secret: process.env.BUILDBASE_WEBHOOK_SECRET ?? '',\n  });\n  if (!event) return res.status(401).json({ error: 'invalid_signature' });\n  if (!isWebhookEvent(event.event)) return res.json({ ignored: event.event });\n\n  switch (event.event) {\n    case 'payment.failed':\n      // data: workspaceId, subscriptionId, invoiceId, dunningState, amount,\n      // currency, failedAt, nextRetryAt. Your own side effects go here.\n      break;\n    default:\n      break;\n  }\n  return res.json({ received: true });\n}\n"),w.push("Mount the webhook: app.post('/webhooks/buildbase', express.raw({ type: 'application/json' }), buildbaseWebhook);","  Sign-in redirect and code exchange: https://www.buildbase.app/guides/buildbase-on-express"));var v,E;const S={serverUrl:e.serverUrl??U,orgId:h,clientId:e.clientId??"",redirectUrl:e.redirectUrl??R[d]},D=function(e,t){const n=x[e];return[{key:n.serverUrl,value:t.serverUrl},{key:n.orgId,value:t.orgId},{key:n.clientId,value:t.clientId},{key:n.redirectUrl,value:t.redirectUrl},{key:n.clientSecret,value:""},{key:n.webhookSecret,value:""}]}(d,S),N=[],C=async e=>{const t=function(e,t,n){const s=new Set;for(const t of(e??"").split(/\r?\n/)){const e=t.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);e&&s.add(e[1])}const r=[],o=[],i=[];for(const{key:e,value:t}of n)s.has(e)?o.push(e):(r.push(e),i.push(`${e}=${t}`));if(0===r.length)return{content:e??"",added:r,kept:o};let a=e??"";return""===a?a=`${t}\n`:a.endsWith("\n")||(a+="\n"),e&&(a+="\n"),a+=`${i.join("\n")}\n`,{content:a,added:r,kept:o}}(await n.exists(r(e))?await n.readFile(r(e)):null,k,D);t.added.length&&(await n.writeFile(r(e),t.content),g.push(e)),t.kept.length&&N.push(`${e}: kept ${t.kept.join(", ")}`)};await C(".env.example");let j=await n.exists(r(".gitignore"))?await n.readFile(r(".gitignore")):"";if(function(e){const t=e.split(/\r?\n/).map(e=>e.trim());return!t.includes("!.env.example")&&t.some(e=>".env*"===e||".env.*"===e||".env.example"===e)}(j)){const e=""===j||j.endsWith("\n")?"":"\n";j=`${j}${e}!.env.example\n`,await n.writeFile(r(".gitignore"),j),g.push(".gitignore"),N.push(".gitignore: added !.env.example so the example file is committed")}!function(e){return e.split(/\r?\n/).map(e=>e.trim()).some(e=>".env.local"===e||".env*.local"===e||".env*"===e||".env.*"===e)}(j)?N.push('.env.local not written: .gitignore does not ignore it. Add ".env*.local" to .gitignore, then copy .env.example to .env.local.'):await C(".env.local");for(const e of g)t.log(`  wrote   ${e}`);for(const e of m)t.log(`  kept    ${e} (already existed)`);for(const e of N)t.log(`  ${e}`);if(w.length){t.log("buildbase: one step by hand:");for(const e of w)t.log(`  ${e}`)}return t.log("buildbase: done. Fill in the empty keys in .env.local from console.buildbase.app:"),t.log("  the OAuth client id and secret (Authentication), the webhook signing secret (Webhooks),"),t.log(`  and allow-list ${S.redirectUrl} as a redirect URL.`),0}function N(e={}){const t=Math.max(1,e.maxEntries??1e3),n=new Map,s=new Map,r=e=>{const t=n.get(e);t&&(n.delete(e),((e,t)=>{for(const n of t.tags){const t=s.get(n);t&&(t.delete(e),0===t.size&&s.delete(n))}})(e,t.entry))};return{async get(e){const t=n.get(e);if(t){if(!(t.expiresAt<=Date.now()))return n.delete(e),n.set(e,t),t.entry;r(e)}},async set(e,o,i){r(e),n.set(e,{entry:o,expiresAt:Date.now()+1e3*i});for(const t of o.tags){let n=s.get(t);n||s.set(t,n=new Set),n.add(e)}for(;n.size>t;){const e=n.keys().next().value;if(void 0===e)break;r(e)}},async delete(e){r(e)},async deleteByTag(e){const t=s.get(e);if(t)for(const e of[...t])r(e)}}}function C(e,t,n){if(null!=n)if(Array.isArray(n))n.forEach((n,s)=>C(e,`${t}[${s}]`,n));else if("object"!=typeof n)e.append(t,String(n));else for(const[s,r]of Object.entries(n))C(e,`${t}[${s}]`,r)}const j="buildbase:all",q=e=>`buildbase:${e}`,P=(e,t)=>`buildbase:${e}:${t}`,W=(e,t)=>`buildbase:${e}:id:${t}`,V=e=>`buildbase:collection:${e}`;new Set(["blog.published","blog.updated","blog.unpublished","blog.deleted","doc.published","doc.updated","doc.unpublished","doc.deleted","faq.updated","faq_collection.updated","testimonial.updated","testimonial.deleted","rich_content.updated","rich_content.deleted","collection.version_published","collection.record_created","collection.record_updated","collection.record_deleted"]);class F extends Error{constructor(e,t,n,s){super(e),this.status=t,this.url=n,this.body=s,this.name="BuildBaseContentError"}}const K=/^[0-9a-f]{24}$/i,M=new WeakMap;function z(e){return Array.isArray(e)?e:e&&"object"==typeof e&&Array.isArray(e.docs)?e.docs:[]}function X(e){const t=e.split("/").filter(Boolean);return t[t.length-1]??e}function G(e={},t={}){const n={...t,...e.filter};return{$page:e.page,$limit:e.limit,filter:Object.keys(n).length>0?n:void 0,sort:e.sort}}function H(e){if("undefined"!=typeof window&&"undefined"!=typeof document)throw new Error("@buildbase/sdk/server holds your org API token and must only run on a server. Import it from server code (an API route, a server component, a build script), never from code that ships to the browser.");if(!e||"string"!=typeof e.serverUrl||!e.serverUrl)throw new Error("createServerClient: `serverUrl` is required");if("string"!=typeof e.apiToken||!e.apiToken.includes(":"))throw new Error("createServerClient: `apiToken` must be an org API token of the form <orgId>:<secret> (console, Settings, API tokens)");const t=e.serverUrl.replace(/\/+$/,""),n=e.apiToken,s=n.slice(0,n.indexOf(":")),r=!1===e.cache?null:e.cache??N(),o=e.fetch??((e,t)=>globalThis.fetch(e,t)),i=e.timeoutMs??1e4,a=e.defaultTtlSeconds??60,l=Math.max(e.retainSeconds??86400,1),c=e.staleOnError??!0,d=new Map,u=(e,t)=>(e&&"object"==typeof e&&M.set(e,t),e);async function p(s,r,a){const l="function"==typeof e.requestInit?e.requestInit({path:s,tags:r}):e.requestInit??{},c=new Headers(l.headers);c.set("Authorization",`Bearer ${n}`),c.set("Accept","application/json"),a&&c.set("If-None-Match",a);const d=new AbortController,u=setTimeout(()=>d.abort(),i);try{return await o(`${t}${s}`,{...l,method:"GET",headers:c,signal:l.signal??d.signal})}finally{clearTimeout(u)}}async function h(e){const n=`${e.path}${function(e){if(!e)return"";const t=new URLSearchParams;for(const n of Object.keys(e).sort())C(t,n,e[n]);t.sort();const n=t.toString();return n?`?${n}`:""}(e.query)}`,o=`${s}:${n}`,i=r?await r.get(o):void 0,h=Date.now();if(i&&i.freshUntil>h)return u(i.data,i.tags);const f=()=>{const s=async function(){let s;try{s=await p(n,e.tags,i?.etag),304!==s.status||i||(s=await p(n,e.tags))}catch(e){if(c&&i)return u(i.data,i.tags);throw new F(`BuildBase request failed: ${e instanceof Error?e.message:String(e)}`,0,`${t}${n}`)}const d=function(e,t){const n=e.headers.get("cache-control");if(!n)return t;const s=n.toLowerCase().split(",").map(e=>e.trim());if(s.includes("no-store"))return null;if(s.includes("no-cache"))return 0;const r=s.find(e=>e.startsWith("max-age="));if(r){const e=Number(r.slice(8));if(Number.isFinite(e)&&e>=0)return e}return t}(s,a),h=function(e){const t=e.headers.get("cache-control");if(!t)return 0;const n=t.toLowerCase().split(",").map(e=>e.trim()).find(e=>e.startsWith("stale-while-revalidate=")),s=n?Number(n.slice(23)):0;return Number.isFinite(s)&&s>0?s:0}(s);if(304===s.status&&i){const e={...i,etag:s.headers.get("etag")??i.etag,freshUntil:Date.now()+1e3*(d??0),staleUntil:h>0?Date.now()+1e3*((d??0)+h):void 0};return r&&await r.set(o,e,l),u(i.data,i.tags)}if(404===s.status&&e.nullOnNotFound)return null;if(!s.ok){const r=await s.text().catch(()=>"");let o=r;try{o=r?JSON.parse(r):void 0}catch{}if(c&&i&&401!==s.status&&403!==s.status)return u(i.data,i.tags);const a=o?.message??`BuildBase responded ${s.status} for ${e.path}`;throw new F(a,s.status,`${t}${n}`,o)}const f=(g=await s.json().catch(()=>null),g&&"object"==typeof g&&!Array.isArray(g)&&"data"in g&&"success"in g&&!("docs"in g)?g.data:g);var g;if(null==f&&e.nullOnNotFound)return null;const m=e.transform?e.transform(f):f,b=[...new Set([...e.tags,...e.tagsFrom?e.tagsFrom(m):[],j])];r&&null!==d&&await r.set(o,{data:m,etag:s.headers.get("etag")??void 0,freshUntil:Date.now()+1e3*d,staleUntil:h>0?Date.now()+1e3*(d+h):void 0,tags:b},Math.max(l,d));return u(m,b)}();return d.set(o,s),s.then(()=>d.delete(o),()=>d.delete(o)),s};if(i&&void 0!==i.staleUntil&&i.staleUntil>h)return d.has(o)||f().catch(()=>{}),u(i.data,i.tags);const g=d.get(o);return g||f()}const f=e=>t=>{const n=[];return t?._id&&n.push(W(e,t._id)),t?.slug&&n.push(P(e,t.slug)),n};function g(e,t){const n=q(t);return{list:(t={})=>h({path:`/api/${e}`,query:G(t,t.includeDrafts?{}:{published:!0}),tags:[n]}),get:n=>h({path:`/api/${e}/${encodeURIComponent(n)}`,tags:[W(t,n)],tagsFrom:f(t),nullOnNotFound:!0}),byPath:(n,s={})=>h({path:`/api/${e}/path`,query:{path:n,draftPreview:!!s.draftPreview||void 0},tags:[P(t,X(n))],tagsFrom:f(t),nullOnNotFound:!0}),tree:(t={})=>h({path:`/api/${e}/folders/tree`,query:{folder:t.folder},tags:[n]}),tags:(t={})=>h({path:`/api/${e}/tags`,query:G(t),tags:[n]}),authors:(t={})=>h({path:`/api/${e}/authors`,query:G(t),tags:[n]})}}const m=q("faq_collection");async function b(e){const t=K.test(e);return h({path:t?`/api/faqs/collections/${encodeURIComponent(e)}`:`/api/faqs/collections/slug/${encodeURIComponent(e)}`,tags:[t?W("faq_collection",e):P("faq_collection",e)],tagsFrom:f("faq_collection"),nullOnNotFound:!0})}return{blogs:g("blogs","blog"),docs:g("docs","doc"),faqs:{collections:(e={})=>h({path:"/api/faqs/collections",query:G(e,{archived:!1}),tags:[m]}),collection:b,async questions(e){const t=K.test(e);if(t&&!await b(e))return[];return await h({path:t?`/api/faqs/collections/${encodeURIComponent(e)}/faqs`:`/api/faqs/collections/slug/${encodeURIComponent(e)}/faqs`,query:{pagination:!1},tags:[q("faq"),t?W("faq_collection",e):P("faq_collection",e)],transform:e=>z(e).filter(e=>!e.archived),nullOnNotFound:!0})??[]}},testimonials:{list:(e={})=>h({path:"/api/testimonials",query:G(e,e.includeUnpublished?{archived:!1}:{published:!0,archived:!1}),tags:[q("testimonial")]}),get:e=>h({path:`/api/testimonials/${encodeURIComponent(e)}`,tags:[W("testimonial",e)],nullOnNotFound:!0})},richContent:{get:e=>h({path:`/api/rich-content/slug/${encodeURIComponent(e)}`,tags:[P("rich_content",e)],tagsFrom:f("rich_content"),nullOnNotFound:!0}),list:(e={})=>h({path:"/api/rich-content",query:G(e,{archived:!1}),tags:[q("rich_content")]})},collections:{list:(e={})=>h({path:"/api/collections",query:G(e,{archived:!1}),tags:[q("collection")]}),data(e,t={}){const n=void 0===t.version;return h({path:`/api/collections/data/${encodeURIComponent(e)}`,query:n?{latest:!0}:{version:t.version},tags:[V(e)],transform:e=>z(e).filter(e=>!e.archived)})}},async revalidate(e){r&&await r.deleteByTag(e)},async revalidateAll(){r&&await r.deleteByTag(j)},cache:r}}(async function(c){let d;try{d=S(c)}catch(e){return console.error(`buildbase: ${e.message}\n\n${E}`),2}if("help"===d.command)return console.log(E),0;if("init"===d.command)return D(d,{cwd:process.cwd(),isTTY:Boolean(process.stdin.isTTY&&process.stdout.isTTY),env:process.env,fs:{exists:e=>o(e).then(()=>!0,()=>!1),readFile:e=>r(e,"utf8"),writeFile:(e,t)=>n(e,t,"utf8"),mkdir:e=>t(e,{recursive:!0}).then(()=>{}),readdir:e=>s(e)},run:(t,n)=>new Promise(s=>{const r=e(t,n,{stdio:"inherit",cwd:process.cwd(),shell:"win32"===process.platform});r.on("error",e=>{console.error(`buildbase: could not run ${t}: ${e.message}`),s(1)}),r.on("close",e=>s(e??1))}),prompt:async e=>{const t=l({input:process.stdin,output:process.stdout});try{return await t.question(e)}finally{t.close()}},log:e=>console.log(e),error:e=>console.error(e)});const u=process.env.BUILDBASE_API_TOKEN,p=d.serverUrl??process.env.BUILDBASE_SERVER_URL??process.env.NEXT_PUBLIC_BUILDBASE_SERVER_URL;if(!u)return console.error("buildbase: set BUILDBASE_API_TOKEN to an org API token (<orgId>:<secret>)"),2;if(!p)return console.error("buildbase: set BUILDBASE_SERVER_URL (for example https://api.console.buildbase.app)"),2;try{const e=H({serverUrl:p,apiToken:u,cache:!1}),s=await async function(e,t={}){const n=new Set(t.modules??g),s=t.pageSize??100,r={generatedAt:(new Date).toISOString()};if(n.has("blogs")&&(r.blogs=await m(t=>e.blogs.list({page:t,limit:s}))),n.has("docs")&&(r.docs=await m(t=>e.docs.list({page:t,limit:s}))),n.has("faqs")){const t=await m(t=>e.faqs.collections({page:t,limit:s}));r.faqs=[];for(const n of t)r.faqs.push({...n,questions:await e.faqs.questions(n._id)})}if(n.has("testimonials")&&(r.testimonials=await m(t=>e.testimonials.list({page:t,limit:s}))),n.has("richContent")&&(r.richContent=await m(t=>e.richContent.list({page:t,limit:s}))),n.has("collections")){const n=t.collections??(await m(t=>e.collections.list({page:t,limit:s}))).map(e=>e.slug);r.collections={};for(const t of n)r.collections[t]=await e.collections.data(t)}return r}(e,{modules:d.modules,collections:d.collections,pageSize:d.pageSize}),r=i(process.cwd(),d.out);await t(a(r),{recursive:!0}),await n(r,`${JSON.stringify(s,null,2)}\n`,"utf8");const o=Object.entries(s).filter(([e])=>"generatedAt"!==e).map(([e,t])=>`${e}: ${Array.isArray(t)?t.length:Object.keys(t).length}`).join(", ");return console.log(`buildbase: wrote ${d.out} (${o})`),0}catch(e){return e instanceof F&&(401===e.status||403===e.status)?(console.error(`buildbase: the API token was refused (${e.status}). Check BUILDBASE_API_TOKEN and that its role can read content.`),1):(console.error(`buildbase: ${e.message}`),1)}})(process.argv.slice(2)).then(e=>process.exit(e),e=>{console.error(e),process.exit(1)});