@columnus/shared 0.1.54 → 0.1.56

package/dist/ciPreviewEnv.js

@@ -1,12 +1,29 @@
 // packages/@columnus/shared/src/previewDeployName.ts
+function hostnameFromCoolifyToken(raw) {
+  const token = raw.trim();
+  if (!token || /^https?:?$/i.test(token)) return null;
+  try {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token)) {
+      return new URL(token).hostname || null;
+    }
+  } catch {
+    return null;
+  }
+  const host = token.split("/")[0]?.split(":")[0] ?? "";
+  if (!host || !host.includes(".") && host !== "localhost") return null;
+  return host;
+}
 function coolifyHostnameFromEnv(env = process.env) {
   const raw = env.COOLIFY_FQDN ?? env.COOLIFY_URL;
   if (!raw) return null;
-  const host = raw.replace(/^https?:\/\//, "").split("/")[0] ?? "";
-  return host || null;
+  for (const part of raw.split(",")) {
+    const host = hostnameFromCoolifyToken(part);
+    if (host) return host;
+  }
+  return null;
 }
 var PULL_HEAD_BRANCH_RE = /^pull\/(\d+)\/head$/i;
-var PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-)?preview-(\d+)\./;
+var PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-|renderer-)?preview-(\d+)\./;
 function resolvePreviewPrId(env = process.env) {
   const host = coolifyHostnameFromEnv(env);
   if (host) {

package/dist/ciPreviewEnv.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/previewDeployName.ts","../src/ciPreviewEnv.ts"],"names":[],"mappings":";AAOO,SAAS,sBAAA,CAAuB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AAC1F,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,YAAA,IAAgB,GAAA,CAAI,WAAA;AACpC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,cAAA,EAAgB,EAAE,EAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAC9D,EAAA,OAAO,IAAA,IAAQ,IAAA;AACjB;AA+BA,IAAM,mBAAA,GAAsB,sBAAA;AAC5B,IAAM,kBAAA,GAAqB,sCAAA;AAGpB,SAAS,kBAAA,CAAmB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACtF,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AACvC,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAClD,IAAA,IAAI,UAAU,OAAO,QAAA;AAAA,EACvB;AAEA,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,UAAA;AACzC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,aAAa,mBAAA,CAAoB,IAAA,CAAK,qBAAqB,MAAM,CAAC,IAAI,CAAC,CAAA;AAC7E,IAAA,IAAI,YAAY,OAAO,UAAA;AAAA,EACzB;AAEA,EAAA,OAAO,IAAA;AACT;AA2BA,SAAS,qBAAqB,MAAA,EAAwB;AACpD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAChC,EAAA,OAAO,QAAQ,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,MAAA;AAC9C;;;ACzFA,IAAM,UAAA,GAAa,qBAAA;AAGZ,SAAS,WAAA,CAAY,GAAA,EAAyB,KAAA,GAAQ,QAAA,EAAkB;AAC7E,EAAA,MAAM,MAAA,GAAA,CAAU,GAAA,IAAO,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,UAAU,MAAA,KAAW,SAAA,IAAa,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,+CAAA,EAA6C,GAAA,IAAO,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,oBAAA,CAAqB,SAAS,cAAA,EAAwB;AACpE,EAAA,OAAO,kBAAkB,MAAM,CAAA,sBAAA,CAAA;AACjC;AAEA,SAAS,WAAW,GAAA,EAA4B;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,aAAa,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA,GAAM,UAAU,GAAG,CAAA,CAAA;AAC1D,IAAA,OAAO,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,QAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,2BAA2B,GAAA,EAAsB;AAC/D,EAAA,MAAM,IAAA,GAAO,WAAW,GAAG,CAAA;AAC3B,EAAA,OAAO,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,KAAA;AAClE;AAGO,SAAS,sBAAA,CAAuB,GAAA,EAAa,MAAA,GAAS,cAAA,EAAyB;AACpF,EAAA,OAAO,UAAA,CAAW,GAAG,CAAA,KAAM,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AAC7C;AASO,SAAS,4BAAA,CACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACjC,SAAS,cAAA,EACM;AACf,EAAA,MAAM,IAAA,GAAO,mBAAmB,GAAG,CAAA;AACnC,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,6BAAA,EAA+B,mBAAmB,CAAA,EAAY;AAC/E,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,GAAG,CAAA,EAAG,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AACd,IAAA,IAAI,2BAA2B,OAAO,CAAA,IAAK,sBAAA,CAAuB,OAAA,EAAS,MAAM,CAAA,EAAG;AAClF,MAAA;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAA,EAAI,MAAM,CAAA,sBAAA,CAAA;AACjD;AAEA,IAAM,4BAAA,GAA+B,uBAAA;AAU9B,SAAS,8BAAA,CACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACjC,SAAS,cAAA,EACD;AACR,EAAA,MAAM,OAAA,GAAU,4BAAA,CAA6B,GAAA,EAAK,MAAM,CAAA;AACxD,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,2BAAA,EAA6B,IAAA,EAAK;AACvD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,iBAAA,EAAmB,IAAA,EAAK;AAC3C,EAAA,IAAI,QAAA,IAAY,CAAC,0BAAA,CAA2B,QAAQ,GAAG,OAAO,QAAA;AAC9D,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,OAAO,4BAAA;AACT;AAGO,SAAS,2BAAA,CAA4B,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AAC/F,EAAA,MAAM,IAAA,GAAO,mBAAmB,GAAG,CAAA;AACnC,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,IAAI,IAAA,GAAO,GAAA,CAAI,6BAAA,EAA+B,IAAA,EAAK,IAAK,EAAA;AACxD,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AACtC,EAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAC7B,EAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAChC,EAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAC7B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK,IAAK,MAAA;AACzD,EAAA,OAAO,CAAA,OAAA,EAAU,IAAI,CAAA,IAAA,EAAO,IAAI,IAAI,IAAI,CAAA,sBAAA,CAAA;AAC1C;AAOO,SAAS,oBAAA,CACd,GAAA,EACA,eAAA,EACA,cAAA,EAC4B;AAC5B,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,uBAAA,EAAyB,IAAA,EAAK;AACnD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,QAAA,EAAS;AAAA,EACnC;AAEA,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAQ;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,6CAAA,EAA8C;AAAA,EACxE;AAEA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,MAAM,OAAA,GAAU,4BAA4B,GAAG,CAAA;AAC/C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,GAAA,EAAK,OAAA;AAAA,QACL,cAAA,EAAgB,mCAAmC,OAAO,CAAA,6CAAA;AAAA,OAC5D;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,OAAA,EACE;AAAA,KACJ;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,eAAA,EAAgB;AAC1C;AAOO,SAAS,2BAAA,CACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACN;AAC3B,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAQ;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,GAAA,CAAI,eAAe,IAAA,EAAK,IAAK,EAAA,EAAI,QAAA,EAAU,KAAA,EAAM;AAAA,EAC9E;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,aAAA,IAAiB,EAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,EAAK,eAAe,CAAA;AAC/C,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,UAAU,IAAA,EAAK;AAAA,EAC5C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,IAAA,IAAI,CAAC,GAAA,CAAI,IAAA,MAAU,GAAA,CAAI,IAAA,OAAW,SAAA,EAAW;AAC3C,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EAAS,8DAA8D,GAAG,CAAA,mGAAA;AAAA,OAC5E;AAAA,IACF;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAQ;AAAA,EAC9B;AACF;AAEO,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACtC;AAGO,SAAS,wBAAA,CAAyB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAyB;AACjG,EAAA,OAAO,IAAI,oBAAA,EAAsB,IAAA,MAAU,GAAA,CAAI,qBAAA,EAAuB,MAAK,IAAK,MAAA;AAClF","file":"ciPreviewEnv.js","sourcesContent":["/**\n * Sanitized Convex preview deployment name for CI / Coolify preview builds.\n * \"/\" breaks preview/<name> lookups in Convex deployment references.\n *\n * Coolify preview env vars: COOLIFY_BRANCH, COOLIFY_IS_PREVIEW, COOLIFY_FQDN,\n * COOLIFY_URL (BuildKit build secrets).\n */\nexport function coolifyHostnameFromEnv(env: NodeJS.ProcessEnv = process.env): string | null {\n  const raw = env.COOLIFY_FQDN ?? env.COOLIFY_URL;\n  if (!raw) return null;\n  const host = raw.replace(/^https?:\\/\\//, \"\").split(\"/\")[0] ?? \"\";\n  return host || null;\n}\n\n/**\n * Browser origin Better Auth expects on server-side OTP probes.\n * Preview configure sets SITE_URL to `https://<coolify-host>`; Origin must match.\n * Coolify often injects `COOLIFY_URL=http://…` — do not use that scheme.\n */\nexport function resolveTrustedAuthOrigin(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  const explicit = env.COLUMNUS_AUTH_ORIGIN?.trim();\n  if (explicit) return explicit.replace(/\\/$/, \"\");\n\n  const host = coolifyHostnameFromEnv(env);\n  if (host) return `https://${host}`;\n\n  const siteUrl = env.SITE_URL?.trim();\n  if (siteUrl && !/\\.convex\\.site(?:\\/|$)/i.test(siteUrl)) {\n    return siteUrl.replace(/\\/$/, \"\");\n  }\n  return undefined;\n}\n\n/** True when Coolify (or CI_PREVIEW) indicates a PR preview Docker build. */\nexport function isCiPreviewBuild(env: NodeJS.ProcessEnv = process.env): boolean {\n  if (env.CI_PREVIEW === \"true\" || env.COOLIFY_IS_PREVIEW === \"true\") {\n    return true;\n  }\n  const host = coolifyHostnameFromEnv(env);\n  // preview-<pr>, manage-preview-<pr>, deploy-preview-<pr>\n  return Boolean(host && /^(?:manage-|deploy-)?preview-\\d+\\./.test(host));\n}\n\nconst PULL_HEAD_BRANCH_RE = /^pull\\/(\\d+)\\/head$/i;\nconst PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-)?preview-(\\d+)\\./;\n\n/** PR id from `preview-<n>.<domain>` / `manage-preview-<n>` hostname or `pull/<n>/head` branch. */\nexport function resolvePreviewPrId(env: NodeJS.ProcessEnv = process.env): string | null {\n  const host = coolifyHostnameFromEnv(env);\n  if (host) {\n    const fromHost = PREVIEW_HOST_PR_RE.exec(host)?.[1];\n    if (fromHost) return fromHost;\n  }\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  if (branch) {\n    const fromBranch = PULL_HEAD_BRANCH_RE.exec(stripQualifiedBranch(branch))?.[1];\n    if (fromBranch) return fromBranch;\n  }\n\n  return null;\n}\n\n/**\n * Resolve the git branch used for Convex `--preview-name`.\n * Coolify often sets COOLIFY_BRANCH to `pull/<n>/head` at runtime (see coollabsio/coolify#9572).\n */\nexport function resolvePreviewBranch(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (env.GITHUB_HEAD_REF) return stripQualifiedBranch(env.GITHUB_HEAD_REF);\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  const prId = resolvePreviewPrId(env);\n  if (!branch) {\n    return prId ? `preview-${prId}` : null;\n  }\n\n  const stripped = stripQualifiedBranch(branch);\n  if (PULL_HEAD_BRANCH_RE.test(stripped)) {\n    if (prId) return `preview-${prId}`;\n  }\n  // Coolify PR apps often leave COOLIFY_BRANCH=main while FQDN is *-preview-<n>.\n  if ((stripped === \"main\" || stripped === \"master\") && prId) {\n    return `preview-${prId}`;\n  }\n  return stripped;\n}\n\n/** Strip Coolify/Convex qualified suffixes (e.g. `pull-48-head:pr-48-coolify`). */\nfunction stripQualifiedBranch(branch: string): string {\n  const colon = branch.indexOf(\":\");\n  return colon > 0 ? branch.slice(0, colon) : branch;\n}\n\nexport function sanitizePreviewDeployName(branch: string): string {\n  return stripQualifiedBranch(branch).replace(/\\//g, \"-\");\n}\n\n/** Normalize a preview name from Convex env before `convex deploy --preview-name`. */\nexport function normalizePreviewDeployName(name: string): string {\n  return sanitizePreviewDeployName(name.trim());\n}\n\nexport function ciPreviewDeployName(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (!isCiPreviewBuild(env)) return null;\n\n  const branch = resolvePreviewBranch(env);\n  if (!branch) return null;\n  return sanitizePreviewDeployName(branch);\n}\n\n/** Stale failures from broken preview deploy before the bridge was live. */\nexport const STALE_ENDPOINT_DEPLOY_ERROR =\n  /^deploy endpoint returned (?:200(?: OK)?|500(?: Internal Server Error)?)$/;\n\nexport function isStaleEndpointDeployError(error: string | undefined): boolean {\n  return error != null && STALE_ENDPOINT_DEPLOY_ERROR.test(error);\n}\n\n/** Infra failures from a prior broken deploy that a fresh save can retry. */\nexport function isRecoverableDeployError(error: string | undefined): boolean {\n  if (error == null) return false;\n  if (isStaleEndpointDeployError(error)) return true;\n  if (error.includes(\"502 Bad Gateway\")) return true;\n  if (error.includes(\"deploy endpoint unreachable\")) return true;\n  if (error.includes(\"deploy endpoint timed out\")) return true;\n  return (\n    error.includes(\"convex/bin/main.js\") ||\n    error.includes(\"convex CLI (bin/main.js\") ||\n    error.includes(\"convex CLI not available\")\n  );\n}\n","import { resolvePreviewPrId } from \"./previewDeployName.ts\";\n\nconst GIT_SHA_RE = /^[0-9a-fA-F]{7,40}$/;\n\n/** Parse and validate a git commit SHA (7–40 hex chars). */\nexport function parseGitSha(raw: string | undefined, label = \"commit\"): string {\n  const commit = (raw ?? \"\").trim();\n  if (!commit || commit === \"unknown\" || !GIT_SHA_RE.test(commit)) {\n    throw new Error(`${label} must be a git SHA (7–40 hex chars); got '${raw ?? \"\"}'`);\n  }\n  return commit;\n}\n\nexport function defaultProdDeployUrl(domain = \"columnus.app\"): string {\n  return `https://deploy.${domain}/ops/v1/deploy-initial`;\n}\n\nfunction hostnameOf(url: string): string | null {\n  try {\n    const withScheme = /:\\/\\//.test(url) ? url : `http://${url}`;\n    return new URL(withScheme).hostname;\n  } catch {\n    return null;\n  }\n}\n\n/** True for local defaults that should not beat Coolify preview deploy URLs. */\nexport function isLoopbackDeployServiceUrl(url: string): boolean {\n  const host = hostnameOf(url);\n  return host === \"127.0.0.1\" || host === \"localhost\" || host === \"::1\";\n}\n\n/** Production shared deploy host (`deploy.columnus.app`), any path. */\nexport function isProdDeployServiceUrl(url: string, domain = \"columnus.app\"): boolean {\n  return hostnameOf(url) === `deploy.${domain}`;\n}\n\n/**\n * When on a PR preview host, return the per-PR deploy-service URL unless env already\n * points at a non-production executor (deploy-preview or Coolify internal).\n *\n * Coolify often copies production `STUDIO_DEPLOY_URL=https://deploy.columnus.app/deploy`\n * onto preview apps — that must not win over `deploy-preview-<pr>`.\n */\nexport function derivePreviewStudioDeployUrl(\n  env: NodeJS.ProcessEnv = process.env,\n  domain = \"columnus.app\",\n): string | null {\n  const prId = resolvePreviewPrId(env);\n  if (!prId) return null;\n\n  for (const key of [\"COLUMNUS_DEPLOY_SERVICE_URL\", \"STUDIO_DEPLOY_URL\"] as const) {\n    const current = env[key]?.trim();\n    if (!current) continue;\n    if (isLoopbackDeployServiceUrl(current) || isProdDeployServiceUrl(current, domain)) {\n      continue;\n    }\n    // Explicit non-prod URL (deploy-preview / Coolify internal) — leave alone.\n    return null;\n  }\n\n  return `https://deploy-preview-${prId}.${domain}/ops/v1/deploy-initial`;\n}\n\nconst LOCAL_DEPLOY_SERVICE_DEFAULT = \"http://127.0.0.1:8787\";\n\n/**\n * Runtime deploy-service URL for Web BFF / container entrypoint.\n *\n * Prefer preview-derived `deploy-preview-<pr>`, else non-loopback `COLUMNUS_DEPLOY_SERVICE_URL`,\n * else `STUDIO_DEPLOY_URL`, else loopback COLUMNUS, else local default.\n *\n * Callers that need an origin (no path) should normalize with deploy-service helpers.\n */\nexport function resolveRuntimeDeployServiceUrl(\n  env: NodeJS.ProcessEnv = process.env,\n  domain = \"columnus.app\",\n): string {\n  const derived = derivePreviewStudioDeployUrl(env, domain);\n  if (derived) return derived;\n\n  const columnus = env.COLUMNUS_DEPLOY_SERVICE_URL?.trim();\n  const studio = env.STUDIO_DEPLOY_URL?.trim();\n  if (columnus && !isLoopbackDeployServiceUrl(columnus)) return columnus;\n  if (studio) return studio;\n  if (columnus) return columnus;\n  return LOCAL_DEPLOY_SERVICE_DEFAULT;\n}\n\n/** Coolify internal URL for columnus-deploy preview container (build-time manifest sync). */\nexport function derivePreviewDeployBuildUrl(env: NodeJS.ProcessEnv = process.env): string | null {\n  const prId = resolvePreviewPrId(env);\n  if (!prId) return null;\n\n  let uuid = env.COLUMNUS_DEPLOY_RESOURCE_UUID?.trim() ?? \"\";\n  uuid = uuid.replace(/^https?:\\/\\//, \"\");\n  uuid = uuid.split(\"/\")[0] ?? \"\";\n  uuid = uuid.split(\"-pr-\")[0] ?? uuid;\n  uuid = uuid.split(\":\")[0] ?? uuid;\n  if (!uuid) return null;\n\n  const port = env.COLUMNUS_DEPLOY_PREVIEW_PORT?.trim() || \"3000\";\n  return `http://${uuid}-pr-${prId}:${port}/ops/v1/deploy-initial`;\n}\n\nexport type ResolveSyncDeployUrlResult =\n  | { ok: true; url: string; derivedMessage?: string }\n  | { ok: false; message: string };\n\n/** URL for `sync-manifest-deploy` during Docker/CI builds. */\nexport function resolveSyncDeployUrl(\n  env: NodeJS.ProcessEnv,\n  studioDeployUrl: string,\n  isPreviewBuild: boolean,\n): ResolveSyncDeployUrlResult {\n  const explicit = env.STUDIO_DEPLOY_BUILD_URL?.trim();\n  if (explicit) {\n    return { ok: true, url: explicit };\n  }\n\n  if (env.CI_PREVIEW === \"true\") {\n    return { ok: true, url: \"http://127.0.0.1:8787/ops/v1/deploy-initial\" };\n  }\n\n  if (isPreviewBuild) {\n    const derived = derivePreviewDeployBuildUrl(env);\n    if (derived) {\n      return {\n        ok: true,\n        url: derived,\n        derivedMessage: `derived STUDIO_DEPLOY_BUILD_URL=${derived} (from COLUMNUS_DEPLOY_RESOURCE_UUID + PR id)`,\n      };\n    }\n    return {\n      ok: false,\n      message:\n        \"Set COLUMNUS_DEPLOY_RESOURCE_UUID on columnus-web preview (columnus-deploy Coolify resource UUID) or STUDIO_DEPLOY_BUILD_URL explicitly. See plans/done/021-preview-deploy-service.md\",\n    };\n  }\n\n  return { ok: true, url: studioDeployUrl };\n}\n\nexport type PreviewSourceCommitResult =\n  | { ok: true; commit: string; required: boolean }\n  | { ok: false; message: string };\n\n/** Validates SOURCE_COMMIT for Coolify preview builds (skipped when CI_PREVIEW=true). */\nexport function validatePreviewSourceCommit(\n  env: NodeJS.ProcessEnv = process.env,\n): PreviewSourceCommitResult {\n  if (env.CI_PREVIEW === \"true\") {\n    return { ok: true, commit: env.SOURCE_COMMIT?.trim() ?? \"\", required: false };\n  }\n\n  const raw = env.SOURCE_COMMIT ?? \"\";\n  try {\n    const commit = parseGitSha(raw, \"SOURCE_COMMIT\");\n    return { ok: true, commit, required: true };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    if (!raw.trim() || raw.trim() === \"unknown\") {\n      return {\n        ok: false,\n        message: `SOURCE_COMMIT is required for Coolify preview builds (got '${raw}'). Enable Advanced → Include Source Commit in Build on both columnus-web and columnus-deploy.`,\n      };\n    }\n    return { ok: false, message };\n  }\n}\n\nexport function normalizeConvexUrl(url: string): string {\n  return url.trim().replace(/\\/+$/, \"\");\n}\n\n/** DOCS_SEED_SYNC_EMAIL with PLAYWRIGHT_TEST_EMAIL fallback (Coolify / entrypoint). */\nexport function docsSeedSyncEmailFromEnv(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  return env.DOCS_SEED_SYNC_EMAIL?.trim() || env.PLAYWRIGHT_TEST_EMAIL?.trim() || undefined;\n}\n"]}
+{"version":3,"sources":["../src/previewDeployName.ts","../src/ciPreviewEnv.ts"],"names":[],"mappings":";AAWA,SAAS,yBAAyB,GAAA,EAA4B;AAC5D,EAAA,MAAM,KAAA,GAAQ,IAAI,IAAA,EAAK;AACvB,EAAA,IAAI,CAAC,KAAA,IAAS,aAAA,CAAc,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAEhD,EAAA,IAAI;AACF,IAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,KAAK,CAAA,EAAG;AAC1C,MAAA,OAAO,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,QAAA,IAAY,IAAA;AAAA,IACpC;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACnD,EAAA,IAAI,CAAC,QAAS,CAAC,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,IAAA,KAAS,WAAA,EAAc,OAAO,IAAA;AACnE,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,sBAAA,CAAuB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AAC1F,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,YAAA,IAAgB,GAAA,CAAI,WAAA;AACpC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AACjC,IAAA,MAAM,IAAA,GAAO,yBAAyB,IAAI,CAAA;AAC1C,IAAA,IAAI,MAAM,OAAO,IAAA;AAAA,EACnB;AACA,EAAA,OAAO,IAAA;AACT;AA+BA,IAAM,mBAAA,GAAsB,sBAAA;AAC5B,IAAM,kBAAA,GAAqB,gDAAA;AAGpB,SAAS,kBAAA,CAAmB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACtF,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AACvC,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAClD,IAAA,IAAI,UAAU,OAAO,QAAA;AAAA,EACvB;AAEA,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,UAAA;AACzC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,aAAa,mBAAA,CAAoB,IAAA,CAAK,qBAAqB,MAAM,CAAC,IAAI,CAAC,CAAA;AAC7E,IAAA,IAAI,YAAY,OAAO,UAAA;AAAA,EACzB;AAEA,EAAA,OAAO,IAAA;AACT;AA2BA,SAAS,qBAAqB,MAAA,EAAwB;AACpD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAChC,EAAA,OAAO,QAAQ,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,MAAA;AAC9C;;;ACjHA,IAAM,UAAA,GAAa,qBAAA;AAGZ,SAAS,WAAA,CAAY,GAAA,EAAyB,KAAA,GAAQ,QAAA,EAAkB;AAC7E,EAAA,MAAM,MAAA,GAAA,CAAU,GAAA,IAAO,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,UAAU,MAAA,KAAW,SAAA,IAAa,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,+CAAA,EAA6C,GAAA,IAAO,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,oBAAA,CAAqB,SAAS,cAAA,EAAwB;AACpE,EAAA,OAAO,kBAAkB,MAAM,CAAA,sBAAA,CAAA;AACjC;AAEA,SAAS,WAAW,GAAA,EAA4B;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,aAAa,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA,GAAM,UAAU,GAAG,CAAA,CAAA;AAC1D,IAAA,OAAO,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,QAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,2BAA2B,GAAA,EAAsB;AAC/D,EAAA,MAAM,IAAA,GAAO,WAAW,GAAG,CAAA;AAC3B,EAAA,OAAO,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,KAAA;AAClE;AAGO,SAAS,sBAAA,CAAuB,GAAA,EAAa,MAAA,GAAS,cAAA,EAAyB;AACpF,EAAA,OAAO,UAAA,CAAW,GAAG,CAAA,KAAM,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AAC7C;AASO,SAAS,4BAAA,CACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACjC,SAAS,cAAA,EACM;AACf,EAAA,MAAM,IAAA,GAAO,mBAAmB,GAAG,CAAA;AACnC,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,6BAAA,EAA+B,mBAAmB,CAAA,EAAY;AAC/E,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,GAAG,CAAA,EAAG,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,OAAA,EAAS;AACd,IAAA,IAAI,2BAA2B,OAAO,CAAA,IAAK,sBAAA,CAAuB,OAAA,EAAS,MAAM,CAAA,EAAG;AAClF,MAAA;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAA,EAAI,MAAM,CAAA,sBAAA,CAAA;AACjD;AAEA,IAAM,4BAAA,GAA+B,uBAAA;AAU9B,SAAS,8BAAA,CACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACjC,SAAS,cAAA,EACD;AACR,EAAA,MAAM,OAAA,GAAU,4BAAA,CAA6B,GAAA,EAAK,MAAM,CAAA;AACxD,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,2BAAA,EAA6B,IAAA,EAAK;AACvD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,iBAAA,EAAmB,IAAA,EAAK;AAC3C,EAAA,IAAI,QAAA,IAAY,CAAC,0BAAA,CAA2B,QAAQ,GAAG,OAAO,QAAA;AAC9D,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,OAAO,4BAAA;AACT;AAGO,SAAS,2BAAA,CAA4B,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AAC/F,EAAA,MAAM,IAAA,GAAO,mBAAmB,GAAG,CAAA;AACnC,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,IAAI,IAAA,GAAO,GAAA,CAAI,6BAAA,EAA+B,IAAA,EAAK,IAAK,EAAA;AACxD,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AACtC,EAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAC7B,EAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAChC,EAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAC7B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK,IAAK,MAAA;AACzD,EAAA,OAAO,CAAA,OAAA,EAAU,IAAI,CAAA,IAAA,EAAO,IAAI,IAAI,IAAI,CAAA,sBAAA,CAAA;AAC1C;AAOO,SAAS,oBAAA,CACd,GAAA,EACA,eAAA,EACA,cAAA,EAC4B;AAC5B,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,uBAAA,EAAyB,IAAA,EAAK;AACnD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,QAAA,EAAS;AAAA,EACnC;AAEA,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAQ;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,6CAAA,EAA8C;AAAA,EACxE;AAEA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,MAAM,OAAA,GAAU,4BAA4B,GAAG,CAAA;AAC/C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,GAAA,EAAK,OAAA;AAAA,QACL,cAAA,EAAgB,mCAAmC,OAAO,CAAA,6CAAA;AAAA,OAC5D;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,OAAA,EACE;AAAA,KACJ;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,eAAA,EAAgB;AAC1C;AAOO,SAAS,2BAAA,CACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACN;AAC3B,EAAA,IAAI,GAAA,CAAI,eAAe,MAAA,EAAQ;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,GAAA,CAAI,eAAe,IAAA,EAAK,IAAK,EAAA,EAAI,QAAA,EAAU,KAAA,EAAM;AAAA,EAC9E;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,aAAA,IAAiB,EAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,EAAK,eAAe,CAAA;AAC/C,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,UAAU,IAAA,EAAK;AAAA,EAC5C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,IAAA,IAAI,CAAC,GAAA,CAAI,IAAA,MAAU,GAAA,CAAI,IAAA,OAAW,SAAA,EAAW;AAC3C,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,OAAA,EAAS,8DAA8D,GAAG,CAAA,mGAAA;AAAA,OAC5E;AAAA,IACF;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAQ;AAAA,EAC9B;AACF;AAEO,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACtC;AAGO,SAAS,wBAAA,CAAyB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAyB;AACjG,EAAA,OAAO,IAAI,oBAAA,EAAsB,IAAA,MAAU,GAAA,CAAI,qBAAA,EAAuB,MAAK,IAAK,MAAA;AAClF","file":"ciPreviewEnv.js","sourcesContent":["/**\n * Sanitized Convex preview deployment name for CI / Coolify preview builds.\n * \"/\" breaks preview/<name> lookups in Convex deployment references.\n *\n * Coolify preview env vars: COOLIFY_BRANCH, COOLIFY_IS_PREVIEW, COOLIFY_FQDN,\n * COOLIFY_URL (BuildKit build secrets).\n *\n * Production Coolify often injects a comma-separated FQDN/URL list\n * (`app.columnus.app,bro.columnus.app,…`). Take the first valid hostname —\n * Better Auth Origin must be a single origin, not the whole list.\n */\nfunction hostnameFromCoolifyToken(raw: string): string | null {\n  const token = raw.trim();\n  if (!token || /^https?:?$/i.test(token)) return null;\n\n  try {\n    if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(token)) {\n      return new URL(token).hostname || null;\n    }\n  } catch {\n    return null;\n  }\n\n  const host = token.split(\"/\")[0]?.split(\":\")[0] ?? \"\";\n  if (!host || (!host.includes(\".\") && host !== \"localhost\")) return null;\n  return host;\n}\n\nexport function coolifyHostnameFromEnv(env: NodeJS.ProcessEnv = process.env): string | null {\n  const raw = env.COOLIFY_FQDN ?? env.COOLIFY_URL;\n  if (!raw) return null;\n  for (const part of raw.split(\",\")) {\n    const host = hostnameFromCoolifyToken(part);\n    if (host) return host;\n  }\n  return null;\n}\n\n/**\n * Browser origin Better Auth expects on server-side OTP probes.\n * Preview configure sets SITE_URL to `https://<coolify-host>`; Origin must match.\n * Coolify often injects `COOLIFY_URL=http://…` — do not use that scheme.\n */\nexport function resolveTrustedAuthOrigin(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  const explicit = env.COLUMNUS_AUTH_ORIGIN?.trim();\n  if (explicit) return explicit.replace(/\\/$/, \"\");\n\n  const host = coolifyHostnameFromEnv(env);\n  if (host) return `https://${host}`;\n\n  const siteUrl = env.SITE_URL?.trim();\n  if (siteUrl && !/\\.convex\\.site(?:\\/|$)/i.test(siteUrl)) {\n    return siteUrl.replace(/\\/$/, \"\");\n  }\n  return undefined;\n}\n\n/** True when Coolify (or CI_PREVIEW) indicates a PR preview Docker build. */\nexport function isCiPreviewBuild(env: NodeJS.ProcessEnv = process.env): boolean {\n  if (env.CI_PREVIEW === \"true\" || env.COOLIFY_IS_PREVIEW === \"true\") {\n    return true;\n  }\n  const host = coolifyHostnameFromEnv(env);\n  // preview-<pr>, manage-preview-<pr>, deploy-preview-<pr>, renderer-preview-<pr>\n  return Boolean(host && /^(?:manage-|deploy-|renderer-)?preview-\\d+\\./.test(host));\n}\n\nconst PULL_HEAD_BRANCH_RE = /^pull\\/(\\d+)\\/head$/i;\nconst PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-|renderer-)?preview-(\\d+)\\./;\n\n/** PR id from `preview-<n>.<domain>` / `manage-preview-<n>` hostname or `pull/<n>/head` branch. */\nexport function resolvePreviewPrId(env: NodeJS.ProcessEnv = process.env): string | null {\n  const host = coolifyHostnameFromEnv(env);\n  if (host) {\n    const fromHost = PREVIEW_HOST_PR_RE.exec(host)?.[1];\n    if (fromHost) return fromHost;\n  }\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  if (branch) {\n    const fromBranch = PULL_HEAD_BRANCH_RE.exec(stripQualifiedBranch(branch))?.[1];\n    if (fromBranch) return fromBranch;\n  }\n\n  return null;\n}\n\n/**\n * Resolve the git branch used for Convex `--preview-name`.\n * Coolify often sets COOLIFY_BRANCH to `pull/<n>/head` at runtime (see coollabsio/coolify#9572).\n */\nexport function resolvePreviewBranch(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (env.GITHUB_HEAD_REF) return stripQualifiedBranch(env.GITHUB_HEAD_REF);\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  const prId = resolvePreviewPrId(env);\n  if (!branch) {\n    return prId ? `preview-${prId}` : null;\n  }\n\n  const stripped = stripQualifiedBranch(branch);\n  if (PULL_HEAD_BRANCH_RE.test(stripped)) {\n    if (prId) return `preview-${prId}`;\n  }\n  // Coolify PR apps often leave COOLIFY_BRANCH=main while FQDN is *-preview-<n>.\n  if ((stripped === \"main\" || stripped === \"master\") && prId) {\n    return `preview-${prId}`;\n  }\n  return stripped;\n}\n\n/** Strip Coolify/Convex qualified suffixes (e.g. `pull-48-head:pr-48-coolify`). */\nfunction stripQualifiedBranch(branch: string): string {\n  const colon = branch.indexOf(\":\");\n  return colon > 0 ? branch.slice(0, colon) : branch;\n}\n\nexport function sanitizePreviewDeployName(branch: string): string {\n  return stripQualifiedBranch(branch).replace(/\\//g, \"-\");\n}\n\n/** Normalize a preview name from Convex env before `convex deploy --preview-name`. */\nexport function normalizePreviewDeployName(name: string): string {\n  return sanitizePreviewDeployName(name.trim());\n}\n\nexport function ciPreviewDeployName(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (!isCiPreviewBuild(env)) return null;\n\n  const branch = resolvePreviewBranch(env);\n  if (!branch) return null;\n  return sanitizePreviewDeployName(branch);\n}\n\n/** Stale failures from broken preview deploy before the bridge was live. */\nexport const STALE_ENDPOINT_DEPLOY_ERROR =\n  /^deploy endpoint returned (?:200(?: OK)?|500(?: Internal Server Error)?)$/;\n\nexport function isStaleEndpointDeployError(error: string | undefined): boolean {\n  return error != null && STALE_ENDPOINT_DEPLOY_ERROR.test(error);\n}\n\n/** Infra failures from a prior broken deploy that a fresh save can retry. */\nexport function isRecoverableDeployError(error: string | undefined): boolean {\n  if (error == null) return false;\n  if (isStaleEndpointDeployError(error)) return true;\n  if (error.includes(\"502 Bad Gateway\")) return true;\n  if (error.includes(\"deploy endpoint unreachable\")) return true;\n  if (error.includes(\"deploy endpoint timed out\")) return true;\n  return (\n    error.includes(\"convex/bin/main.js\") ||\n    error.includes(\"convex CLI (bin/main.js\") ||\n    error.includes(\"convex CLI not available\")\n  );\n}\n","import { resolvePreviewPrId } from \"./previewDeployName.ts\";\n\nconst GIT_SHA_RE = /^[0-9a-fA-F]{7,40}$/;\n\n/** Parse and validate a git commit SHA (7–40 hex chars). */\nexport function parseGitSha(raw: string | undefined, label = \"commit\"): string {\n  const commit = (raw ?? \"\").trim();\n  if (!commit || commit === \"unknown\" || !GIT_SHA_RE.test(commit)) {\n    throw new Error(`${label} must be a git SHA (7–40 hex chars); got '${raw ?? \"\"}'`);\n  }\n  return commit;\n}\n\nexport function defaultProdDeployUrl(domain = \"columnus.app\"): string {\n  return `https://deploy.${domain}/ops/v1/deploy-initial`;\n}\n\nfunction hostnameOf(url: string): string | null {\n  try {\n    const withScheme = /:\\/\\//.test(url) ? url : `http://${url}`;\n    return new URL(withScheme).hostname;\n  } catch {\n    return null;\n  }\n}\n\n/** True for local defaults that should not beat Coolify preview deploy URLs. */\nexport function isLoopbackDeployServiceUrl(url: string): boolean {\n  const host = hostnameOf(url);\n  return host === \"127.0.0.1\" || host === \"localhost\" || host === \"::1\";\n}\n\n/** Production shared deploy host (`deploy.columnus.app`), any path. */\nexport function isProdDeployServiceUrl(url: string, domain = \"columnus.app\"): boolean {\n  return hostnameOf(url) === `deploy.${domain}`;\n}\n\n/**\n * When on a PR preview host, return the per-PR deploy-service URL unless env already\n * points at a non-production executor (deploy-preview or Coolify internal).\n *\n * Coolify often copies production `STUDIO_DEPLOY_URL=https://deploy.columnus.app/deploy`\n * onto preview apps — that must not win over `deploy-preview-<pr>`.\n */\nexport function derivePreviewStudioDeployUrl(\n  env: NodeJS.ProcessEnv = process.env,\n  domain = \"columnus.app\",\n): string | null {\n  const prId = resolvePreviewPrId(env);\n  if (!prId) return null;\n\n  for (const key of [\"COLUMNUS_DEPLOY_SERVICE_URL\", \"STUDIO_DEPLOY_URL\"] as const) {\n    const current = env[key]?.trim();\n    if (!current) continue;\n    if (isLoopbackDeployServiceUrl(current) || isProdDeployServiceUrl(current, domain)) {\n      continue;\n    }\n    // Explicit non-prod URL (deploy-preview / Coolify internal) — leave alone.\n    return null;\n  }\n\n  return `https://deploy-preview-${prId}.${domain}/ops/v1/deploy-initial`;\n}\n\nconst LOCAL_DEPLOY_SERVICE_DEFAULT = \"http://127.0.0.1:8787\";\n\n/**\n * Runtime deploy-service URL for Web BFF / container entrypoint.\n *\n * Prefer preview-derived `deploy-preview-<pr>`, else non-loopback `COLUMNUS_DEPLOY_SERVICE_URL`,\n * else `STUDIO_DEPLOY_URL`, else loopback COLUMNUS, else local default.\n *\n * Callers that need an origin (no path) should normalize with deploy-service helpers.\n */\nexport function resolveRuntimeDeployServiceUrl(\n  env: NodeJS.ProcessEnv = process.env,\n  domain = \"columnus.app\",\n): string {\n  const derived = derivePreviewStudioDeployUrl(env, domain);\n  if (derived) return derived;\n\n  const columnus = env.COLUMNUS_DEPLOY_SERVICE_URL?.trim();\n  const studio = env.STUDIO_DEPLOY_URL?.trim();\n  if (columnus && !isLoopbackDeployServiceUrl(columnus)) return columnus;\n  if (studio) return studio;\n  if (columnus) return columnus;\n  return LOCAL_DEPLOY_SERVICE_DEFAULT;\n}\n\n/** Coolify internal URL for columnus-deploy preview container (build-time manifest sync). */\nexport function derivePreviewDeployBuildUrl(env: NodeJS.ProcessEnv = process.env): string | null {\n  const prId = resolvePreviewPrId(env);\n  if (!prId) return null;\n\n  let uuid = env.COLUMNUS_DEPLOY_RESOURCE_UUID?.trim() ?? \"\";\n  uuid = uuid.replace(/^https?:\\/\\//, \"\");\n  uuid = uuid.split(\"/\")[0] ?? \"\";\n  uuid = uuid.split(\"-pr-\")[0] ?? uuid;\n  uuid = uuid.split(\":\")[0] ?? uuid;\n  if (!uuid) return null;\n\n  const port = env.COLUMNUS_DEPLOY_PREVIEW_PORT?.trim() || \"3000\";\n  return `http://${uuid}-pr-${prId}:${port}/ops/v1/deploy-initial`;\n}\n\nexport type ResolveSyncDeployUrlResult =\n  | { ok: true; url: string; derivedMessage?: string }\n  | { ok: false; message: string };\n\n/** URL for `sync-manifest-deploy` during Docker/CI builds. */\nexport function resolveSyncDeployUrl(\n  env: NodeJS.ProcessEnv,\n  studioDeployUrl: string,\n  isPreviewBuild: boolean,\n): ResolveSyncDeployUrlResult {\n  const explicit = env.STUDIO_DEPLOY_BUILD_URL?.trim();\n  if (explicit) {\n    return { ok: true, url: explicit };\n  }\n\n  if (env.CI_PREVIEW === \"true\") {\n    return { ok: true, url: \"http://127.0.0.1:8787/ops/v1/deploy-initial\" };\n  }\n\n  if (isPreviewBuild) {\n    const derived = derivePreviewDeployBuildUrl(env);\n    if (derived) {\n      return {\n        ok: true,\n        url: derived,\n        derivedMessage: `derived STUDIO_DEPLOY_BUILD_URL=${derived} (from COLUMNUS_DEPLOY_RESOURCE_UUID + PR id)`,\n      };\n    }\n    return {\n      ok: false,\n      message:\n        \"Set COLUMNUS_DEPLOY_RESOURCE_UUID on columnus-web preview (columnus-deploy Coolify resource UUID) or STUDIO_DEPLOY_BUILD_URL explicitly. See plans/done/021-preview-deploy-service.md\",\n    };\n  }\n\n  return { ok: true, url: studioDeployUrl };\n}\n\nexport type PreviewSourceCommitResult =\n  | { ok: true; commit: string; required: boolean }\n  | { ok: false; message: string };\n\n/** Validates SOURCE_COMMIT for Coolify preview builds (skipped when CI_PREVIEW=true). */\nexport function validatePreviewSourceCommit(\n  env: NodeJS.ProcessEnv = process.env,\n): PreviewSourceCommitResult {\n  if (env.CI_PREVIEW === \"true\") {\n    return { ok: true, commit: env.SOURCE_COMMIT?.trim() ?? \"\", required: false };\n  }\n\n  const raw = env.SOURCE_COMMIT ?? \"\";\n  try {\n    const commit = parseGitSha(raw, \"SOURCE_COMMIT\");\n    return { ok: true, commit, required: true };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    if (!raw.trim() || raw.trim() === \"unknown\") {\n      return {\n        ok: false,\n        message: `SOURCE_COMMIT is required for Coolify preview builds (got '${raw}'). Enable Advanced → Include Source Commit in Build on both columnus-web and columnus-deploy.`,\n      };\n    }\n    return { ok: false, message };\n  }\n}\n\nexport function normalizeConvexUrl(url: string): string {\n  return url.trim().replace(/\\/+$/, \"\");\n}\n\n/** DOCS_SEED_SYNC_EMAIL with PLAYWRIGHT_TEST_EMAIL fallback (Coolify / entrypoint). */\nexport function docsSeedSyncEmailFromEnv(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  return env.DOCS_SEED_SYNC_EMAIL?.trim() || env.PLAYWRIGHT_TEST_EMAIL?.trim() || undefined;\n}\n"]}

package/dist/clipboardTransfer.js

@@ -4598,7 +4598,13 @@ var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set([
   "columnus_api_output_secrets",
   "columnus_api_sync_routes",
   "columnus_api_outbox",
-  "columnus_api_delivery"
+  "columnus_api_delivery",
+  "columnus_assets",
+  "columnus_asset_versions",
+  "columnus_asset_refs",
+  "columnus_asset_profiles",
+  "columnus_asset_settings",
+  "columnus_asset_jobs"
 ]);
 var displayTemplatesSchema = external_exports.object({
   id: external_exports.string().optional(),
@@ -4631,6 +4637,12 @@ var TABLE_COLORS = [
   "lavender"
 ];
 var tableColorSchema = external_exports.enum(TABLE_COLORS);
+var TABLE_KINDS = ["record", "asset"];
+var tableKindSchema = external_exports.enum(TABLE_KINDS);
+var assetBindingSchema = external_exports.object({
+  profile: external_exports.string().min(1),
+  enforced: external_exports.boolean().optional()
+});
 var fieldTypeSchema = external_exports.lazy(
   () => external_exports.discriminatedUnion("kind", [
     external_exports.object({ kind: external_exports.literal("string") }),
@@ -4658,7 +4670,9 @@ var fieldTypeSchema = external_exports.lazy(
           name: external_exports.string().regex(IDENT),
           label: external_exports.string().optional(),
           type: fieldTypeSchema,
-          optional: external_exports.boolean()
+          optional: external_exports.boolean(),
+          /** Nested image/file placements bind a Media profile like top-level ones. */
+          asset: assetBindingSchema.optional()
         })
       )
     }),
@@ -4672,7 +4686,9 @@ var fieldSchema = external_exports.object({
   name: external_exports.string().regex(IDENT, "must be a valid identifier"),
   label: external_exports.string().optional(),
   type: fieldTypeSchema,
-  optional: external_exports.boolean()
+  optional: external_exports.boolean(),
+  /** Image/file fields may pin a Media profile; existence is enforced at upload/pick. */
+  asset: assetBindingSchema.optional()
 });
 var indexSchema = external_exports.object({
   name: external_exports.string().regex(IDENT),
@@ -4689,6 +4705,8 @@ var tableSchema = external_exports.object({
   }),
   label: external_exports.string().optional(),
   color: tableColorSchema.optional(),
+  /** Asset metadata tables are typed root tables but never ordinary user records. */
+  kind: tableKindSchema.optional().default("record"),
   fields: external_exports.array(fieldSchema),
   indexes: external_exports.array(indexSchema).default([]),
   searchIndexes: external_exports.array(searchIndexSchema).default([]),
@@ -4698,6 +4716,7 @@ external_exports.object({
   tables: external_exports.array(tableSchema)
 }).superRefine((manifest, ctx) => {
   const tableNames = /* @__PURE__ */ new Set();
+  const tablesByName = /* @__PURE__ */ new Map();
   for (const t of manifest.tables) {
     if (tableNames.has(t.name)) {
       ctx.addIssue({
@@ -4707,6 +4726,37 @@ external_exports.object({
       });
     }
     tableNames.add(t.name);
+    tablesByName.set(t.name, t);
+    if (tableKind(t) === "asset") {
+      if (t.indexes.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define indexes`,
+          path: ["tables"]
+        });
+      }
+      if (t.searchIndexes.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define search indexes`,
+          path: ["tables"]
+        });
+      }
+      if (t.displayTemplates !== void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define display templates`,
+          path: ["tables"]
+        });
+      }
+      if (t.color !== void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define a color`,
+          path: ["tables"]
+        });
+      }
+    }
     const fieldNames = /* @__PURE__ */ new Set();
     for (const f of t.fields) {
       if (fieldNames.has(f.name)) {
@@ -4717,36 +4767,43 @@ external_exports.object({
         });
       }
       fieldNames.add(f.name);
+      assertAssetBindingAllowed(ctx, t, f);
     }
   }
   for (const t of manifest.tables) {
     for (const f of t.fields) {
-      const danglingRef = findDanglingRef(f.type, tableNames);
-      if (danglingRef) {
+      const invalidRef = findInvalidReference(f.type, tablesByName);
+      if (invalidRef) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          message: `${t.name}.${f.name} references unknown table: ${danglingRef}`,
+          message: `${t.name}.${f.name} ${invalidRef}`,
           path: ["tables"]
         });
       }
     }
   }
 });
-function findDanglingRef(t, known) {
+function findInvalidReference(t, tablesByName) {
   switch (t.kind) {
-    case "id":
-      return known.has(t.table) ? null : t.table;
+    case "id": {
+      const target = tablesByName.get(t.table);
+      if (!target) return `references unknown table: ${t.table}`;
+      if (tableKind(target) === "asset") {
+        return `cannot reference asset metadata table: ${t.table}`;
+      }
+      return null;
+    }
     case "array":
-      return findDanglingRef(t.element, known);
+      return findInvalidReference(t.element, tablesByName);
     case "object":
       for (const f of t.fields) {
-        const r = findDanglingRef(f.type, known);
+        const r = findInvalidReference(f.type, tablesByName);
         if (r) return r;
       }
       return null;
     case "union":
       for (const o of t.options) {
-        const r = findDanglingRef(o, known);
+        const r = findInvalidReference(o, tablesByName);
         if (r) return r;
       }
       return null;
@@ -4754,6 +4811,49 @@ function findDanglingRef(t, known) {
       return null;
   }
 }
+function tableKind(table) {
+  return table.kind ?? "record";
+}
+function isFileFieldType(t) {
+  return t.kind === "file" || t.kind === "image";
+}
+function isFileArrayFieldType(t) {
+  return t.kind === "array" && (t.element.kind === "file" || t.element.kind === "image");
+}
+function isStorageFieldType(t) {
+  return isFileFieldType(t) || isFileArrayFieldType(t);
+}
+function assertAssetBindingAllowed(ctx, table, field) {
+  if (field.asset && tableKind(table) === "asset") {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: `${table.name}.${field.name} asset metadata fields cannot define a Media profile`,
+      path: ["tables"]
+    });
+  } else if (field.asset && !isStorageFieldType(field.type)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: `${table.name}.${field.name} asset profile can only be set on image/file fields`,
+      path: ["tables"]
+    });
+  }
+  assertAssetBindingsInType(ctx, table, field.type);
+}
+function assertAssetBindingsInType(ctx, table, type) {
+  switch (type.kind) {
+    case "array":
+      assertAssetBindingsInType(ctx, table, type.element);
+      return;
+    case "object":
+      for (const field of type.fields) assertAssetBindingAllowed(ctx, table, field);
+      return;
+    case "union":
+      for (const option of type.options) assertAssetBindingsInType(ctx, table, option);
+      return;
+    default:
+      return;
+  }
+}
 
 // packages/@columnus/shared/src/csv.ts
 function unparseCsv({ headers, data }) {