@columnus/shared 0.1.54 → 0.1.56

package/dist/postLoginPath.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Where to send a session that has just signed in.
+ *
+ * Both front ends bounce an unauthenticated visitor to `/login?next=<where
+ * they were>` and follow `next` once the code checks out. That parameter
+ * arrives from the URL, so it is attacker-controllable through a crafted link
+ * — and it is obeyed at the exact moment the session becomes worth stealing.
+ * Anything that is not a path on this origin is refused.
+ *
+ * Shared rather than per-app on purpose: this existed in the control plane
+ * only, and Studio spent that time following `next` unchecked.
+ */
+/** Allow only same-app relative paths after login. */
+export declare function safePostLoginPath(raw: string | null | undefined, fallback?: string): string;
+/**
+ * The whole post-login decision, from the login page's own query string.
+ *
+ * Takes `window.location.search` rather than a pre-extracted `next` so that no
+ * call site is left holding a raw parameter it could forget to check.
+ */
+export declare function postLoginRedirectPath(search: string, fallback?: string): string;

package/dist/postLoginPath.js

@@ -0,0 +1,24 @@
+// packages/@columnus/shared/src/postLoginPath.ts
+var RESOLVE_BASE = "https://post-login.invalid";
+function safePostLoginPath(raw, fallback = "/") {
+  if (raw == null) return fallback;
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return fallback;
+  }
+  try {
+    const url = new URL(trimmed, RESOLVE_BASE);
+    if (url.origin !== RESOLVE_BASE) return fallback;
+    const path = `${url.pathname}${url.search}${url.hash}`;
+    return path.startsWith("/") ? path : fallback;
+  } catch {
+    return fallback;
+  }
+}
+function postLoginRedirectPath(search, fallback = "/") {
+  return safePostLoginPath(new URLSearchParams(search).get("next"), fallback);
+}
+
+export { postLoginRedirectPath, safePostLoginPath };
+//# sourceMappingURL=postLoginPath.js.map
+//# sourceMappingURL=postLoginPath.js.map

package/dist/postLoginPath.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/postLoginPath.ts"],"names":[],"mappings":";AAcA,IAAM,YAAA,GAAe,4BAAA;AAGd,SAAS,iBAAA,CAAkB,GAAA,EAAgC,QAAA,GAAW,GAAA,EAAa;AACxF,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,QAAA;AACxB,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAGzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,IAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,EAAG;AAClF,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,EAAS,YAAY,CAAA;AACzC,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,YAAA,EAAc,OAAO,QAAA;AACxC,IAAA,MAAM,IAAA,GAAO,GAAG,GAAA,CAAI,QAAQ,GAAG,GAAA,CAAI,MAAM,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AACpD,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,QAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB,MAAA,EAAgB,QAAA,GAAW,GAAA,EAAa;AAC5E,EAAA,OAAO,iBAAA,CAAkB,IAAI,eAAA,CAAgB,MAAM,EAAE,GAAA,CAAI,MAAM,GAAG,QAAQ,CAAA;AAC5E","file":"postLoginPath.js","sourcesContent":["/**\n * Where to send a session that has just signed in.\n *\n * Both front ends bounce an unauthenticated visitor to `/login?next=<where\n * they were>` and follow `next` once the code checks out. That parameter\n * arrives from the URL, so it is attacker-controllable through a crafted link\n * — and it is obeyed at the exact moment the session becomes worth stealing.\n * Anything that is not a path on this origin is refused.\n *\n * Shared rather than per-app on purpose: this existed in the control plane\n * only, and Studio spent that time following `next` unchecked.\n */\n\n/** A sentinel origin — only used to detect a path that escapes it. */\nconst RESOLVE_BASE = \"https://post-login.invalid\";\n\n/** Allow only same-app relative paths after login. */\nexport function safePostLoginPath(raw: string | null | undefined, fallback = \"/\"): string {\n  if (raw == null) return fallback;\n  const trimmed = raw.trim();\n  // `//evil` is protocol-relative and `\\` is normalised to `/` by some parsers;\n  // both reach another origin without ever looking absolute.\n  if (!trimmed.startsWith(\"/\") || trimmed.startsWith(\"//\") || trimmed.includes(\"\\\\\")) {\n    return fallback;\n  }\n\n  try {\n    const url = new URL(trimmed, RESOLVE_BASE);\n    if (url.origin !== RESOLVE_BASE) return fallback;\n    const path = `${url.pathname}${url.search}${url.hash}`;\n    return path.startsWith(\"/\") ? path : fallback;\n  } catch {\n    return fallback;\n  }\n}\n\n/**\n * The whole post-login decision, from the login page's own query string.\n *\n * Takes `window.location.search` rather than a pre-extracted `next` so that no\n * call site is left holding a raw parameter it could forget to check.\n */\nexport function postLoginRedirectPath(search: string, fallback = \"/\"): string {\n  return safePostLoginPath(new URLSearchParams(search).get(\"next\"), fallback);\n}\n"]}

package/dist/previewDeployName.d.ts

@@ -1,10 +1,3 @@
-/**
- * Sanitized Convex preview deployment name for CI / Coolify preview builds.
- * "/" breaks preview/<name> lookups in Convex deployment references.
- *
- * Coolify preview env vars: COOLIFY_BRANCH, COOLIFY_IS_PREVIEW, COOLIFY_FQDN,
- * COOLIFY_URL (BuildKit build secrets).
- */
 export declare function coolifyHostnameFromEnv(env?: NodeJS.ProcessEnv): string | null;
 /**
  * Browser origin Better Auth expects on server-side OTP probes.

package/dist/previewDeployName.js

@@ -1,9 +1,26 @@
 // packages/@columnus/shared/src/previewDeployName.ts
+function hostnameFromCoolifyToken(raw) {
+  const token = raw.trim();
+  if (!token || /^https?:?$/i.test(token)) return null;
+  try {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token)) {
+      return new URL(token).hostname || null;
+    }
+  } catch {
+    return null;
+  }
+  const host = token.split("/")[0]?.split(":")[0] ?? "";
+  if (!host || !host.includes(".") && host !== "localhost") return null;
+  return host;
+}
 function coolifyHostnameFromEnv(env = process.env) {
   const raw = env.COOLIFY_FQDN ?? env.COOLIFY_URL;
   if (!raw) return null;
-  const host = raw.replace(/^https?:\/\//, "").split("/")[0] ?? "";
-  return host || null;
+  for (const part of raw.split(",")) {
+    const host = hostnameFromCoolifyToken(part);
+    if (host) return host;
+  }
+  return null;
 }
 function resolveTrustedAuthOrigin(env = process.env) {
   const explicit = env.COLUMNUS_AUTH_ORIGIN?.trim();
@@ -21,10 +38,10 @@ function isCiPreviewBuild(env = process.env) {
     return true;
   }
   const host = coolifyHostnameFromEnv(env);
-  return Boolean(host && /^(?:manage-|deploy-)?preview-\d+\./.test(host));
+  return Boolean(host && /^(?:manage-|deploy-|renderer-)?preview-\d+\./.test(host));
 }
 var PULL_HEAD_BRANCH_RE = /^pull\/(\d+)\/head$/i;
-var PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-)?preview-(\d+)\./;
+var PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-|renderer-)?preview-(\d+)\./;
 function resolvePreviewPrId(env = process.env) {
   const host = coolifyHostnameFromEnv(env);
   if (host) {

package/dist/previewDeployName.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/previewDeployName.ts"],"names":[],"mappings":";AAOO,SAAS,sBAAA,CAAuB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AAC1F,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,YAAA,IAAgB,GAAA,CAAI,WAAA;AACpC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,cAAA,EAAgB,EAAE,EAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAC9D,EAAA,OAAO,IAAA,IAAQ,IAAA;AACjB;AAOO,SAAS,wBAAA,CAAyB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAyB;AACjG,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,oBAAA,EAAsB,IAAA,EAAK;AAChD,EAAA,IAAI,QAAA,EAAU,OAAO,QAAA,CAAS,OAAA,CAAQ,OAAO,EAAE,CAAA;AAE/C,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AACvC,EAAA,IAAI,IAAA,EAAM,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA;AAEhC,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,EAAU,IAAA,EAAK;AACnC,EAAA,IAAI,OAAA,IAAW,CAAC,yBAAA,CAA0B,IAAA,CAAK,OAAO,CAAA,EAAG;AACvD,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,gBAAA,CAAiB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAc;AAC9E,EAAA,IAAI,GAAA,CAAI,UAAA,KAAe,MAAA,IAAU,GAAA,CAAI,uBAAuB,MAAA,EAAQ;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AAEvC,EAAA,OAAO,OAAA,CAAQ,IAAA,IAAQ,oCAAA,CAAqC,IAAA,CAAK,IAAI,CAAC,CAAA;AACxE;AAEA,IAAM,mBAAA,GAAsB,sBAAA;AAC5B,IAAM,kBAAA,GAAqB,sCAAA;AAGpB,SAAS,kBAAA,CAAmB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACtF,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AACvC,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAClD,IAAA,IAAI,UAAU,OAAO,QAAA;AAAA,EACvB;AAEA,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,UAAA;AACzC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,aAAa,mBAAA,CAAoB,IAAA,CAAK,qBAAqB,MAAM,CAAC,IAAI,CAAC,CAAA;AAC7E,IAAA,IAAI,YAAY,OAAO,UAAA;AAAA,EACzB;AAEA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,oBAAA,CAAqB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACxF,EAAA,IAAI,GAAA,CAAI,eAAA,EAAiB,OAAO,oBAAA,CAAqB,IAAI,eAAe,CAAA;AAExE,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,UAAA;AACzC,EAAA,MAAM,IAAA,GAAO,mBAAmB,GAAG,CAAA;AACnC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA,GAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA,GAAK,IAAA;AAAA,EACpC;AAEA,EAAA,MAAM,QAAA,GAAW,qBAAqB,MAAM,CAAA;AAC5C,EAAA,IAAI,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,IAAI,IAAA,EAAM,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA;AAAA,EAClC;AAEA,EAAA,IAAA,CAAK,QAAA,KAAa,MAAA,IAAU,QAAA,KAAa,QAAA,KAAa,IAAA,EAAM;AAC1D,IAAA,OAAO,WAAW,IAAI,CAAA,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,qBAAqB,MAAA,EAAwB;AACpD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAChC,EAAA,OAAO,QAAQ,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,MAAA;AAC9C;AAEO,SAAS,0BAA0B,MAAA,EAAwB;AAChE,EAAA,OAAO,oBAAA,CAAqB,MAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AACxD;AAGO,SAAS,2BAA2B,IAAA,EAAsB;AAC/D,EAAA,OAAO,yBAAA,CAA0B,IAAA,CAAK,IAAA,EAAM,CAAA;AAC9C;AAEO,SAAS,mBAAA,CAAoB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACvF,EAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,OAAO,IAAA;AAEnC,EAAA,MAAM,MAAA,GAAS,qBAAqB,GAAG,CAAA;AACvC,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,OAAO,0BAA0B,MAAM,CAAA;AACzC;AAGO,IAAM,2BAAA,GACX;AAEK,SAAS,2BAA2B,KAAA,EAAoC;AAC7E,EAAA,OAAO,KAAA,IAAS,IAAA,IAAQ,2BAAA,CAA4B,IAAA,CAAK,KAAK,CAAA;AAChE;AAGO,SAAS,yBAAyB,KAAA,EAAoC;AAC3E,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,KAAA;AAC1B,EAAA,IAAI,0BAAA,CAA2B,KAAK,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,iBAAiB,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,6BAA6B,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,2BAA2B,CAAA,EAAG,OAAO,IAAA;AACxD,EAAA,OACE,KAAA,CAAM,QAAA,CAAS,oBAAoB,CAAA,IACnC,KAAA,CAAM,SAAS,yBAAyB,CAAA,IACxC,KAAA,CAAM,QAAA,CAAS,0BAA0B,CAAA;AAE7C","file":"previewDeployName.js","sourcesContent":["/**\n * Sanitized Convex preview deployment name for CI / Coolify preview builds.\n * \"/\" breaks preview/<name> lookups in Convex deployment references.\n *\n * Coolify preview env vars: COOLIFY_BRANCH, COOLIFY_IS_PREVIEW, COOLIFY_FQDN,\n * COOLIFY_URL (BuildKit build secrets).\n */\nexport function coolifyHostnameFromEnv(env: NodeJS.ProcessEnv = process.env): string | null {\n  const raw = env.COOLIFY_FQDN ?? env.COOLIFY_URL;\n  if (!raw) return null;\n  const host = raw.replace(/^https?:\\/\\//, \"\").split(\"/\")[0] ?? \"\";\n  return host || null;\n}\n\n/**\n * Browser origin Better Auth expects on server-side OTP probes.\n * Preview configure sets SITE_URL to `https://<coolify-host>`; Origin must match.\n * Coolify often injects `COOLIFY_URL=http://…` — do not use that scheme.\n */\nexport function resolveTrustedAuthOrigin(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  const explicit = env.COLUMNUS_AUTH_ORIGIN?.trim();\n  if (explicit) return explicit.replace(/\\/$/, \"\");\n\n  const host = coolifyHostnameFromEnv(env);\n  if (host) return `https://${host}`;\n\n  const siteUrl = env.SITE_URL?.trim();\n  if (siteUrl && !/\\.convex\\.site(?:\\/|$)/i.test(siteUrl)) {\n    return siteUrl.replace(/\\/$/, \"\");\n  }\n  return undefined;\n}\n\n/** True when Coolify (or CI_PREVIEW) indicates a PR preview Docker build. */\nexport function isCiPreviewBuild(env: NodeJS.ProcessEnv = process.env): boolean {\n  if (env.CI_PREVIEW === \"true\" || env.COOLIFY_IS_PREVIEW === \"true\") {\n    return true;\n  }\n  const host = coolifyHostnameFromEnv(env);\n  // preview-<pr>, manage-preview-<pr>, deploy-preview-<pr>\n  return Boolean(host && /^(?:manage-|deploy-)?preview-\\d+\\./.test(host));\n}\n\nconst PULL_HEAD_BRANCH_RE = /^pull\\/(\\d+)\\/head$/i;\nconst PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-)?preview-(\\d+)\\./;\n\n/** PR id from `preview-<n>.<domain>` / `manage-preview-<n>` hostname or `pull/<n>/head` branch. */\nexport function resolvePreviewPrId(env: NodeJS.ProcessEnv = process.env): string | null {\n  const host = coolifyHostnameFromEnv(env);\n  if (host) {\n    const fromHost = PREVIEW_HOST_PR_RE.exec(host)?.[1];\n    if (fromHost) return fromHost;\n  }\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  if (branch) {\n    const fromBranch = PULL_HEAD_BRANCH_RE.exec(stripQualifiedBranch(branch))?.[1];\n    if (fromBranch) return fromBranch;\n  }\n\n  return null;\n}\n\n/**\n * Resolve the git branch used for Convex `--preview-name`.\n * Coolify often sets COOLIFY_BRANCH to `pull/<n>/head` at runtime (see coollabsio/coolify#9572).\n */\nexport function resolvePreviewBranch(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (env.GITHUB_HEAD_REF) return stripQualifiedBranch(env.GITHUB_HEAD_REF);\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  const prId = resolvePreviewPrId(env);\n  if (!branch) {\n    return prId ? `preview-${prId}` : null;\n  }\n\n  const stripped = stripQualifiedBranch(branch);\n  if (PULL_HEAD_BRANCH_RE.test(stripped)) {\n    if (prId) return `preview-${prId}`;\n  }\n  // Coolify PR apps often leave COOLIFY_BRANCH=main while FQDN is *-preview-<n>.\n  if ((stripped === \"main\" || stripped === \"master\") && prId) {\n    return `preview-${prId}`;\n  }\n  return stripped;\n}\n\n/** Strip Coolify/Convex qualified suffixes (e.g. `pull-48-head:pr-48-coolify`). */\nfunction stripQualifiedBranch(branch: string): string {\n  const colon = branch.indexOf(\":\");\n  return colon > 0 ? branch.slice(0, colon) : branch;\n}\n\nexport function sanitizePreviewDeployName(branch: string): string {\n  return stripQualifiedBranch(branch).replace(/\\//g, \"-\");\n}\n\n/** Normalize a preview name from Convex env before `convex deploy --preview-name`. */\nexport function normalizePreviewDeployName(name: string): string {\n  return sanitizePreviewDeployName(name.trim());\n}\n\nexport function ciPreviewDeployName(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (!isCiPreviewBuild(env)) return null;\n\n  const branch = resolvePreviewBranch(env);\n  if (!branch) return null;\n  return sanitizePreviewDeployName(branch);\n}\n\n/** Stale failures from broken preview deploy before the bridge was live. */\nexport const STALE_ENDPOINT_DEPLOY_ERROR =\n  /^deploy endpoint returned (?:200(?: OK)?|500(?: Internal Server Error)?)$/;\n\nexport function isStaleEndpointDeployError(error: string | undefined): boolean {\n  return error != null && STALE_ENDPOINT_DEPLOY_ERROR.test(error);\n}\n\n/** Infra failures from a prior broken deploy that a fresh save can retry. */\nexport function isRecoverableDeployError(error: string | undefined): boolean {\n  if (error == null) return false;\n  if (isStaleEndpointDeployError(error)) return true;\n  if (error.includes(\"502 Bad Gateway\")) return true;\n  if (error.includes(\"deploy endpoint unreachable\")) return true;\n  if (error.includes(\"deploy endpoint timed out\")) return true;\n  return (\n    error.includes(\"convex/bin/main.js\") ||\n    error.includes(\"convex CLI (bin/main.js\") ||\n    error.includes(\"convex CLI not available\")\n  );\n}\n"]}
+{"version":3,"sources":["../src/previewDeployName.ts"],"names":[],"mappings":";AAWA,SAAS,yBAAyB,GAAA,EAA4B;AAC5D,EAAA,MAAM,KAAA,GAAQ,IAAI,IAAA,EAAK;AACvB,EAAA,IAAI,CAAC,KAAA,IAAS,aAAA,CAAc,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAEhD,EAAA,IAAI;AACF,IAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,KAAK,CAAA,EAAG;AAC1C,MAAA,OAAO,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,QAAA,IAAY,IAAA;AAAA,IACpC;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACnD,EAAA,IAAI,CAAC,QAAS,CAAC,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,IAAA,KAAS,WAAA,EAAc,OAAO,IAAA;AACnE,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,sBAAA,CAAuB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AAC1F,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,YAAA,IAAgB,GAAA,CAAI,WAAA;AACpC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AACjC,IAAA,MAAM,IAAA,GAAO,yBAAyB,IAAI,CAAA;AAC1C,IAAA,IAAI,MAAM,OAAO,IAAA;AAAA,EACnB;AACA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,wBAAA,CAAyB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAyB;AACjG,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,oBAAA,EAAsB,IAAA,EAAK;AAChD,EAAA,IAAI,QAAA,EAAU,OAAO,QAAA,CAAS,OAAA,CAAQ,OAAO,EAAE,CAAA;AAE/C,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AACvC,EAAA,IAAI,IAAA,EAAM,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA;AAEhC,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,EAAU,IAAA,EAAK;AACnC,EAAA,IAAI,OAAA,IAAW,CAAC,yBAAA,CAA0B,IAAA,CAAK,OAAO,CAAA,EAAG;AACvD,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,gBAAA,CAAiB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAc;AAC9E,EAAA,IAAI,GAAA,CAAI,UAAA,KAAe,MAAA,IAAU,GAAA,CAAI,uBAAuB,MAAA,EAAQ;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AAEvC,EAAA,OAAO,OAAA,CAAQ,IAAA,IAAQ,8CAAA,CAA+C,IAAA,CAAK,IAAI,CAAC,CAAA;AAClF;AAEA,IAAM,mBAAA,GAAsB,sBAAA;AAC5B,IAAM,kBAAA,GAAqB,gDAAA;AAGpB,SAAS,kBAAA,CAAmB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACtF,EAAA,MAAM,IAAA,GAAO,uBAAuB,GAAG,CAAA;AACvC,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,IAAA,CAAK,IAAI,IAAI,CAAC,CAAA;AAClD,IAAA,IAAI,UAAU,OAAO,QAAA;AAAA,EACvB;AAEA,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,UAAA;AACzC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,aAAa,mBAAA,CAAoB,IAAA,CAAK,qBAAqB,MAAM,CAAC,IAAI,CAAC,CAAA;AAC7E,IAAA,IAAI,YAAY,OAAO,UAAA;AAAA,EACzB;AAEA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,oBAAA,CAAqB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACxF,EAAA,IAAI,GAAA,CAAI,eAAA,EAAiB,OAAO,oBAAA,CAAqB,IAAI,eAAe,CAAA;AAExE,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,UAAA;AACzC,EAAA,MAAM,IAAA,GAAO,mBAAmB,GAAG,CAAA;AACnC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA,GAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA,GAAK,IAAA;AAAA,EACpC;AAEA,EAAA,MAAM,QAAA,GAAW,qBAAqB,MAAM,CAAA;AAC5C,EAAA,IAAI,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,IAAI,IAAA,EAAM,OAAO,CAAA,QAAA,EAAW,IAAI,CAAA,CAAA;AAAA,EAClC;AAEA,EAAA,IAAA,CAAK,QAAA,KAAa,MAAA,IAAU,QAAA,KAAa,QAAA,KAAa,IAAA,EAAM;AAC1D,IAAA,OAAO,WAAW,IAAI,CAAA,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,qBAAqB,MAAA,EAAwB;AACpD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAChC,EAAA,OAAO,QAAQ,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,MAAA;AAC9C;AAEO,SAAS,0BAA0B,MAAA,EAAwB;AAChE,EAAA,OAAO,oBAAA,CAAqB,MAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AACxD;AAGO,SAAS,2BAA2B,IAAA,EAAsB;AAC/D,EAAA,OAAO,yBAAA,CAA0B,IAAA,CAAK,IAAA,EAAM,CAAA;AAC9C;AAEO,SAAS,mBAAA,CAAoB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACvF,EAAA,IAAI,CAAC,gBAAA,CAAiB,GAAG,CAAA,EAAG,OAAO,IAAA;AAEnC,EAAA,MAAM,MAAA,GAAS,qBAAqB,GAAG,CAAA;AACvC,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,OAAO,0BAA0B,MAAM,CAAA;AACzC;AAGO,IAAM,2BAAA,GACX;AAEK,SAAS,2BAA2B,KAAA,EAAoC;AAC7E,EAAA,OAAO,KAAA,IAAS,IAAA,IAAQ,2BAAA,CAA4B,IAAA,CAAK,KAAK,CAAA;AAChE;AAGO,SAAS,yBAAyB,KAAA,EAAoC;AAC3E,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,KAAA;AAC1B,EAAA,IAAI,0BAAA,CAA2B,KAAK,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,iBAAiB,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,6BAA6B,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,2BAA2B,CAAA,EAAG,OAAO,IAAA;AACxD,EAAA,OACE,KAAA,CAAM,QAAA,CAAS,oBAAoB,CAAA,IACnC,KAAA,CAAM,SAAS,yBAAyB,CAAA,IACxC,KAAA,CAAM,QAAA,CAAS,0BAA0B,CAAA;AAE7C","file":"previewDeployName.js","sourcesContent":["/**\n * Sanitized Convex preview deployment name for CI / Coolify preview builds.\n * \"/\" breaks preview/<name> lookups in Convex deployment references.\n *\n * Coolify preview env vars: COOLIFY_BRANCH, COOLIFY_IS_PREVIEW, COOLIFY_FQDN,\n * COOLIFY_URL (BuildKit build secrets).\n *\n * Production Coolify often injects a comma-separated FQDN/URL list\n * (`app.columnus.app,bro.columnus.app,…`). Take the first valid hostname —\n * Better Auth Origin must be a single origin, not the whole list.\n */\nfunction hostnameFromCoolifyToken(raw: string): string | null {\n  const token = raw.trim();\n  if (!token || /^https?:?$/i.test(token)) return null;\n\n  try {\n    if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(token)) {\n      return new URL(token).hostname || null;\n    }\n  } catch {\n    return null;\n  }\n\n  const host = token.split(\"/\")[0]?.split(\":\")[0] ?? \"\";\n  if (!host || (!host.includes(\".\") && host !== \"localhost\")) return null;\n  return host;\n}\n\nexport function coolifyHostnameFromEnv(env: NodeJS.ProcessEnv = process.env): string | null {\n  const raw = env.COOLIFY_FQDN ?? env.COOLIFY_URL;\n  if (!raw) return null;\n  for (const part of raw.split(\",\")) {\n    const host = hostnameFromCoolifyToken(part);\n    if (host) return host;\n  }\n  return null;\n}\n\n/**\n * Browser origin Better Auth expects on server-side OTP probes.\n * Preview configure sets SITE_URL to `https://<coolify-host>`; Origin must match.\n * Coolify often injects `COOLIFY_URL=http://…` — do not use that scheme.\n */\nexport function resolveTrustedAuthOrigin(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  const explicit = env.COLUMNUS_AUTH_ORIGIN?.trim();\n  if (explicit) return explicit.replace(/\\/$/, \"\");\n\n  const host = coolifyHostnameFromEnv(env);\n  if (host) return `https://${host}`;\n\n  const siteUrl = env.SITE_URL?.trim();\n  if (siteUrl && !/\\.convex\\.site(?:\\/|$)/i.test(siteUrl)) {\n    return siteUrl.replace(/\\/$/, \"\");\n  }\n  return undefined;\n}\n\n/** True when Coolify (or CI_PREVIEW) indicates a PR preview Docker build. */\nexport function isCiPreviewBuild(env: NodeJS.ProcessEnv = process.env): boolean {\n  if (env.CI_PREVIEW === \"true\" || env.COOLIFY_IS_PREVIEW === \"true\") {\n    return true;\n  }\n  const host = coolifyHostnameFromEnv(env);\n  // preview-<pr>, manage-preview-<pr>, deploy-preview-<pr>, renderer-preview-<pr>\n  return Boolean(host && /^(?:manage-|deploy-|renderer-)?preview-\\d+\\./.test(host));\n}\n\nconst PULL_HEAD_BRANCH_RE = /^pull\\/(\\d+)\\/head$/i;\nconst PREVIEW_HOST_PR_RE = /^(?:manage-|deploy-|renderer-)?preview-(\\d+)\\./;\n\n/** PR id from `preview-<n>.<domain>` / `manage-preview-<n>` hostname or `pull/<n>/head` branch. */\nexport function resolvePreviewPrId(env: NodeJS.ProcessEnv = process.env): string | null {\n  const host = coolifyHostnameFromEnv(env);\n  if (host) {\n    const fromHost = PREVIEW_HOST_PR_RE.exec(host)?.[1];\n    if (fromHost) return fromHost;\n  }\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  if (branch) {\n    const fromBranch = PULL_HEAD_BRANCH_RE.exec(stripQualifiedBranch(branch))?.[1];\n    if (fromBranch) return fromBranch;\n  }\n\n  return null;\n}\n\n/**\n * Resolve the git branch used for Convex `--preview-name`.\n * Coolify often sets COOLIFY_BRANCH to `pull/<n>/head` at runtime (see coollabsio/coolify#9572).\n */\nexport function resolvePreviewBranch(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (env.GITHUB_HEAD_REF) return stripQualifiedBranch(env.GITHUB_HEAD_REF);\n\n  const branch = env.COOLIFY_BRANCH ?? env.GIT_BRANCH;\n  const prId = resolvePreviewPrId(env);\n  if (!branch) {\n    return prId ? `preview-${prId}` : null;\n  }\n\n  const stripped = stripQualifiedBranch(branch);\n  if (PULL_HEAD_BRANCH_RE.test(stripped)) {\n    if (prId) return `preview-${prId}`;\n  }\n  // Coolify PR apps often leave COOLIFY_BRANCH=main while FQDN is *-preview-<n>.\n  if ((stripped === \"main\" || stripped === \"master\") && prId) {\n    return `preview-${prId}`;\n  }\n  return stripped;\n}\n\n/** Strip Coolify/Convex qualified suffixes (e.g. `pull-48-head:pr-48-coolify`). */\nfunction stripQualifiedBranch(branch: string): string {\n  const colon = branch.indexOf(\":\");\n  return colon > 0 ? branch.slice(0, colon) : branch;\n}\n\nexport function sanitizePreviewDeployName(branch: string): string {\n  return stripQualifiedBranch(branch).replace(/\\//g, \"-\");\n}\n\n/** Normalize a preview name from Convex env before `convex deploy --preview-name`. */\nexport function normalizePreviewDeployName(name: string): string {\n  return sanitizePreviewDeployName(name.trim());\n}\n\nexport function ciPreviewDeployName(env: NodeJS.ProcessEnv = process.env): string | null {\n  if (!isCiPreviewBuild(env)) return null;\n\n  const branch = resolvePreviewBranch(env);\n  if (!branch) return null;\n  return sanitizePreviewDeployName(branch);\n}\n\n/** Stale failures from broken preview deploy before the bridge was live. */\nexport const STALE_ENDPOINT_DEPLOY_ERROR =\n  /^deploy endpoint returned (?:200(?: OK)?|500(?: Internal Server Error)?)$/;\n\nexport function isStaleEndpointDeployError(error: string | undefined): boolean {\n  return error != null && STALE_ENDPOINT_DEPLOY_ERROR.test(error);\n}\n\n/** Infra failures from a prior broken deploy that a fresh save can retry. */\nexport function isRecoverableDeployError(error: string | undefined): boolean {\n  if (error == null) return false;\n  if (isStaleEndpointDeployError(error)) return true;\n  if (error.includes(\"502 Bad Gateway\")) return true;\n  if (error.includes(\"deploy endpoint unreachable\")) return true;\n  if (error.includes(\"deploy endpoint timed out\")) return true;\n  return (\n    error.includes(\"convex/bin/main.js\") ||\n    error.includes(\"convex CLI (bin/main.js\") ||\n    error.includes(\"convex CLI not available\")\n  );\n}\n"]}

package/dist/recordTableColumns.js

@@ -4338,7 +4338,13 @@ var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set([
   "columnus_api_output_secrets",
   "columnus_api_sync_routes",
   "columnus_api_outbox",
-  "columnus_api_delivery"
+  "columnus_api_delivery",
+  "columnus_assets",
+  "columnus_asset_versions",
+  "columnus_asset_refs",
+  "columnus_asset_profiles",
+  "columnus_asset_settings",
+  "columnus_asset_jobs"
 ]);
 var displayTemplatesSchema = external_exports.object({
   id: external_exports.string().optional(),
@@ -4371,6 +4377,12 @@ var TABLE_COLORS = [
   "lavender"
 ];
 var tableColorSchema = external_exports.enum(TABLE_COLORS);
+var TABLE_KINDS = ["record", "asset"];
+var tableKindSchema = external_exports.enum(TABLE_KINDS);
+var assetBindingSchema = external_exports.object({
+  profile: external_exports.string().min(1),
+  enforced: external_exports.boolean().optional()
+});
 var fieldTypeSchema = external_exports.lazy(
   () => external_exports.discriminatedUnion("kind", [
     external_exports.object({ kind: external_exports.literal("string") }),
@@ -4398,7 +4410,9 @@ var fieldTypeSchema = external_exports.lazy(
           name: external_exports.string().regex(IDENT),
           label: external_exports.string().optional(),
           type: fieldTypeSchema,
-          optional: external_exports.boolean()
+          optional: external_exports.boolean(),
+          /** Nested image/file placements bind a Media profile like top-level ones. */
+          asset: assetBindingSchema.optional()
         })
       )
     }),
@@ -4412,7 +4426,9 @@ var fieldSchema = external_exports.object({
   name: external_exports.string().regex(IDENT, "must be a valid identifier"),
   label: external_exports.string().optional(),
   type: fieldTypeSchema,
-  optional: external_exports.boolean()
+  optional: external_exports.boolean(),
+  /** Image/file fields may pin a Media profile; existence is enforced at upload/pick. */
+  asset: assetBindingSchema.optional()
 });
 var indexSchema = external_exports.object({
   name: external_exports.string().regex(IDENT),
@@ -4429,6 +4445,8 @@ var tableSchema = external_exports.object({
   }),
   label: external_exports.string().optional(),
   color: tableColorSchema.optional(),
+  /** Asset metadata tables are typed root tables but never ordinary user records. */
+  kind: tableKindSchema.optional().default("record"),
   fields: external_exports.array(fieldSchema),
   indexes: external_exports.array(indexSchema).default([]),
   searchIndexes: external_exports.array(searchIndexSchema).default([]),
@@ -4438,6 +4456,7 @@ external_exports.object({
   tables: external_exports.array(tableSchema)
 }).superRefine((manifest, ctx) => {
   const tableNames = /* @__PURE__ */ new Set();
+  const tablesByName = /* @__PURE__ */ new Map();
   for (const t of manifest.tables) {
     if (tableNames.has(t.name)) {
       ctx.addIssue({
@@ -4447,6 +4466,37 @@ external_exports.object({
       });
     }
     tableNames.add(t.name);
+    tablesByName.set(t.name, t);
+    if (tableKind(t) === "asset") {
+      if (t.indexes.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define indexes`,
+          path: ["tables"]
+        });
+      }
+      if (t.searchIndexes.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define search indexes`,
+          path: ["tables"]
+        });
+      }
+      if (t.displayTemplates !== void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define display templates`,
+          path: ["tables"]
+        });
+      }
+      if (t.color !== void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `${t.name} is an asset metadata table and cannot define a color`,
+          path: ["tables"]
+        });
+      }
+    }
     const fieldNames = /* @__PURE__ */ new Set();
     for (const f of t.fields) {
       if (fieldNames.has(f.name)) {
@@ -4457,36 +4507,43 @@ external_exports.object({
         });
       }
       fieldNames.add(f.name);
+      assertAssetBindingAllowed(ctx, t, f);
     }
   }
   for (const t of manifest.tables) {
     for (const f of t.fields) {
-      const danglingRef = findDanglingRef(f.type, tableNames);
-      if (danglingRef) {
+      const invalidRef = findInvalidReference(f.type, tablesByName);
+      if (invalidRef) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          message: `${t.name}.${f.name} references unknown table: ${danglingRef}`,
+          message: `${t.name}.${f.name} ${invalidRef}`,
           path: ["tables"]
         });
       }
     }
   }
 });
-function findDanglingRef(t, known) {
+function findInvalidReference(t, tablesByName) {
   switch (t.kind) {
-    case "id":
-      return known.has(t.table) ? null : t.table;
+    case "id": {
+      const target = tablesByName.get(t.table);
+      if (!target) return `references unknown table: ${t.table}`;
+      if (tableKind(target) === "asset") {
+        return `cannot reference asset metadata table: ${t.table}`;
+      }
+      return null;
+    }
     case "array":
-      return findDanglingRef(t.element, known);
+      return findInvalidReference(t.element, tablesByName);
     case "object":
       for (const f of t.fields) {
-        const r = findDanglingRef(f.type, known);
+        const r = findInvalidReference(f.type, tablesByName);
         if (r) return r;
       }
       return null;
     case "union":
       for (const o of t.options) {
-        const r = findDanglingRef(o, known);
+        const r = findInvalidReference(o, tablesByName);
         if (r) return r;
       }
       return null;
@@ -4494,6 +4551,9 @@ function findDanglingRef(t, known) {
       return null;
   }
 }
+function tableKind(table) {
+  return table.kind ?? "record";
+}
 function trimmedLabel(label) {
   const t = label?.trim();
   return t ? t : void 0;
@@ -4501,6 +4561,46 @@ function trimmedLabel(label) {
 function fieldDisplayName(f) {
   return trimmedLabel(f.label) ?? f.name;
 }
+function isFileFieldType(t) {
+  return t.kind === "file" || t.kind === "image";
+}
+function isFileArrayFieldType(t) {
+  return t.kind === "array" && (t.element.kind === "file" || t.element.kind === "image");
+}
+function isStorageFieldType(t) {
+  return isFileFieldType(t) || isFileArrayFieldType(t);
+}
+function assertAssetBindingAllowed(ctx, table, field) {
+  if (field.asset && tableKind(table) === "asset") {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: `${table.name}.${field.name} asset metadata fields cannot define a Media profile`,
+      path: ["tables"]
+    });
+  } else if (field.asset && !isStorageFieldType(field.type)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: `${table.name}.${field.name} asset profile can only be set on image/file fields`,
+      path: ["tables"]
+    });
+  }
+  assertAssetBindingsInType(ctx, table, field.type);
+}
+function assertAssetBindingsInType(ctx, table, type) {
+  switch (type.kind) {
+    case "array":
+      assertAssetBindingsInType(ctx, table, type.element);
+      return;
+    case "object":
+      for (const field of type.fields) assertAssetBindingAllowed(ctx, table, field);
+      return;
+    case "union":
+      for (const option of type.options) assertAssetBindingsInType(ctx, table, option);
+      return;
+    default:
+      return;
+  }
+}
 
 // packages/@columnus/shared/src/recordTableColumns.ts
 var RECORD_TABLE_DEFAULT_FIELD_COUNT = 5;