npm - @dura-run/cli - Versions diffs - 0.2.1 → 0.3.0 - Mend

@dura-run/cli 0.2.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/dura.js CHANGED Viewed

@@ -2356,13 +2356,44 @@ var init_config_store = () => {};
 var exports_login = {};
 __export(exports_login, {
   startCallbackServer: () => startCallbackServer,
-  registerLoginCommand: () => registerLoginCommand
+  registerLoginCommand: () => registerLoginCommand,
+  isAllowedReferer: () => isAllowedReferer,
+  CLI_CALLBACK_PORT_MIN: () => CLI_CALLBACK_PORT_MIN,
+  CLI_CALLBACK_PORT_MAX: () => CLI_CALLBACK_PORT_MAX
 });
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import {
   createServer
 } from "node:http";
 import { URL as URL2 } from "node:url";
-function startCallbackServer() {
+function safeEqual(a, b) {
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length)
+    return false;
+  return timingSafeEqual(aBuf, bBuf);
+}
+function isAllowedReferer(referer, consoleUrl, apiUrl) {
+  if (!referer)
+    return true;
+  let refOrigin;
+  try {
+    refOrigin = new URL2(referer).origin;
+  } catch {
+    return false;
+  }
+  const allowed = new Set;
+  for (const u of [consoleUrl, apiUrl]) {
+    try {
+      allowed.add(new URL2(u).origin);
+    } catch {}
+  }
+  return allowed.has(refOrigin);
+}
+function startCallbackServer(opts) {
+  const consoleUrl = opts?.consoleUrl ?? getConsoleUrl();
+  const apiUrl = opts?.apiUrl ?? getApiUrl();
+  const state = randomBytes(32).toString("hex");
   return new Promise((resolveSetup, rejectSetup) => {
     let resolveCode;
     let rejectCode;
@@ -2377,14 +2408,29 @@ function startCallbackServer() {
         res.end("Not found");
         return;
       }
+      const referer = req.headers["referer"] || req.headers["referrer"];
+      const refererValue = Array.isArray(referer) ? referer[0] : referer;
+      if (!isAllowedReferer(refererValue, consoleUrl, apiUrl)) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h1>Invalid callback</h1><p>Unexpected referrer.</p></body></html>");
+        rejectCode(new Error("Invalid callback: referrer is not from the dura.run console"));
+        return;
+      }
       const code = url.searchParams.get("code");
       const error = url.searchParams.get("error");
+      const callbackState = url.searchParams.get("state");
       if (error) {
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Login failed</h1><p>You can close this window.</p></body></html>");
         rejectCode(new Error(`Login failed: ${error}`));
         return;
       }
+      if (!callbackState || !safeEqual(callbackState, state)) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h1>Invalid callback</h1><p>Missing or invalid state parameter.</p></body></html>");
+        rejectCode(new Error("Invalid callback: missing or invalid state parameter"));
+        return;
+      }
       if (!code) {
         res.writeHead(400, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Invalid callback</h1><p>Missing code parameter.</p></body></html>");
@@ -2395,15 +2441,24 @@ function startCallbackServer() {
       res.end("<html><body><h1>Login successful!</h1><p>You can close this window and return to your terminal.</p></body></html>");
       resolveCode(code);
     });
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      if (!addr || typeof addr === "string") {
-        rejectSetup(new Error("Failed to bind callback server"));
-        return;
-      }
-      resolveSetup({ server, port: addr.port, codePromise });
-    });
-    server.on("error", rejectSetup);
+    const tryPort = (p) => {
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && p < CLI_CALLBACK_PORT_MAX) {
+          tryPort(p + 1);
+        } else {
+          rejectSetup(err);
+        }
+      });
+      server.listen(p, "127.0.0.1", () => {
+        const addr = server.address();
+        if (!addr || typeof addr === "string") {
+          rejectSetup(new Error("Failed to bind callback server"));
+          return;
+        }
+        resolveSetup({ server, port: addr.port, state, codePromise });
+      });
+    };
+    tryPort(CLI_CALLBACK_PORT_MIN);
   });
 }
 async function openBrowser(url) {
@@ -2440,10 +2495,13 @@ function registerLoginCommand(program2) {
     const consoleUrl = getConsoleUrl();
     let server;
     try {
-      const callbackResult = await startCallbackServer();
+      const callbackResult = await startCallbackServer({
+        consoleUrl,
+        apiUrl
+      });
       server = callbackResult.server;
-      const { port } = callbackResult;
-      const loginUrl = `${consoleUrl}/cli-auth?port=${port}`;
+      const { port, state } = callbackResult;
+      const loginUrl = `${consoleUrl}/cli-auth?port=${port}&state=${state}`;
       output.info("Opening browser for login...");
       output.info(`If the browser doesn't open, visit: ${loginUrl}`);
       await openBrowser(loginUrl);
@@ -2491,6 +2549,7 @@ function registerLoginCommand(program2) {
     }
   });
 }
+var CLI_CALLBACK_PORT_MIN = 31180, CLI_CALLBACK_PORT_MAX = 31199;
 var init_login = __esm(() => {
   init_src3();
   init_config_store();
@@ -7187,7 +7246,7 @@ var init_marketplace = __esm(() => {
     entrypoint: exports_external.string().min(1, "Entrypoint is required"),
     configSchema: exports_external.record(exports_external.unknown()).optional(),
     readme: exports_external.string().max(50000).optional()
-  });
+  }).strict();
   installAdapterSchema = exports_external.object({
     adapterId: exports_external.string().min(1, "Adapter ID is required"),
     config: exports_external.record(exports_external.unknown()).optional()
@@ -7201,7 +7260,7 @@ var init_marketplace = __esm(() => {
   });
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/query.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/query.js
 function cachedError(xs) {
   if (originCache.has(xs))
     return originCache.get(xs);
@@ -7341,7 +7400,7 @@ var init_query = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/errors.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/errors.js
 function connection(x, options, socket) {
   const { host, port } = socket || options;
   const error = Object.assign(new Error("write " + x + " " + (options.path || host + ":" + port)), {
@@ -7387,7 +7446,7 @@ var init_errors2 = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/types.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/types.js
 class NotTagged {
   then() {
     notTagged();
@@ -7658,7 +7717,7 @@ var init_types2 = __esm(() => {
   kebab.column.to = fromKebab;
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/result.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/result.js
 var Result;
 var init_result = __esm(() => {
   Result = class Result extends Array {
@@ -7678,7 +7737,7 @@ var init_result = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/queue.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/queue.js
 function Queue(initial = []) {
   let xs = initial.slice();
   let index = 0;
@@ -7708,7 +7767,7 @@ var init_queue = __esm(() => {
   queue_default = Queue;
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/bytes.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/bytes.js
 function fit(x) {
   if (buffer.length - b.i < x) {
     const prev = buffer, length = prev.length;
@@ -7783,7 +7842,7 @@ var init_bytes = __esm(() => {
   bytes_default = b;
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/connection.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/connection.js
 import net from "net";
 import tls from "tls";
 import crypto from "crypto";
@@ -8518,7 +8577,7 @@ var init_connection = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/subscribe.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/subscribe.js
 function Subscribe(postgres2, options) {
   const subscribers = new Map, slot = "postgresjs_" + Math.random().toString(36).slice(2), state = {};
   let connection2, stream, ended = false;
@@ -8714,7 +8773,7 @@ function parseEvent(x) {
 }
 var noop2 = () => {};
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/large.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/large.js
 import Stream2 from "stream";
 function largeObject(sql, oid, mode = 131072 | 262144) {
   return new Promise(async (resolve2, reject) => {
@@ -8781,7 +8840,7 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
 }
 var init_large = () => {};
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/index.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/index.js
 import os from "os";
 import fs from "fs";
 function Postgres(a, b2) {
@@ -9185,7 +9244,7 @@ var init_src = __esm(() => {
   });
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/entity.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/entity.js
 function is(value, type) {
   if (!value || typeof value !== "object") {
     return false;
@@ -9213,10 +9272,10 @@ var init_entity = __esm(() => {
   hasOwnEntityKind = Symbol.for("drizzle:hasOwnEntityKind");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/logger.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/logger.js
 var init_logger = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/query-promise.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/query-promise.js
 var QueryPromise;
 var init_query_promise = __esm(() => {
   init_entity();
@@ -9241,7 +9300,7 @@ var init_query_promise = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/column.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/column.js
 var Column;
 var init_column = __esm(() => {
   init_entity();
@@ -9295,7 +9354,7 @@ var init_column = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/column-builder.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/column-builder.js
 var ColumnBuilder;
 var init_column_builder = __esm(() => {
   init_entity();
@@ -9355,13 +9414,13 @@ var init_column_builder = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/table.utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/table.utils.js
 var TableName;
 var init_table_utils = __esm(() => {
   TableName = Symbol.for("drizzle:Name");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/foreign-keys.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/foreign-keys.js
 var ForeignKeyBuilder, ForeignKey;
 var init_foreign_keys = __esm(() => {
   init_entity();
@@ -9419,13 +9478,13 @@ var init_foreign_keys = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/tracing-utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/tracing-utils.js
 function iife(fn, ...args) {
   return fn(...args);
 }
 var init_tracing_utils = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/unique-constraint.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/unique-constraint.js
 function uniqueKeyName(table, columns) {
   return `${table[TableName]}_${columns.join("_")}_unique`;
 }
@@ -9433,7 +9492,7 @@ var init_unique_constraint = __esm(() => {
   init_table_utils();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/utils/array.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/utils/array.js
 function parsePgArrayValue(arrayString, startFrom, inQuotes) {
   for (let i = startFrom;i < arrayString.length; i++) {
     const char = arrayString[i];
@@ -9510,7 +9569,7 @@ function makePgArray(array) {
 }
 var init_array = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/common.js
 var PgColumnBuilder, PgColumn, ExtraConfigColumn, IndexedColumn, PgArrayBuilder, PgArray;
 var init_common = __esm(() => {
   init_column_builder();
@@ -9663,7 +9722,7 @@ var init_common = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/enum.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/enum.js
 function isPgEnum(obj) {
   return !!obj && typeof obj === "function" && isPgEnumSym in obj && obj[isPgEnumSym] === true;
 }
@@ -9708,7 +9767,7 @@ var init_enum = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/subquery.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/subquery.js
 var Subquery;
 var init_subquery = __esm(() => {
   init_entity();
@@ -9726,11 +9785,11 @@ var init_subquery = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/version.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/version.js
 var version = "0.39.3";
 var init_version = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/tracing.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/tracing.js
 var otel, rawTracer, tracer;
 var init_tracing = __esm(() => {
   init_tracing_utils();
@@ -9760,13 +9819,13 @@ var init_tracing = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/view-common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/view-common.js
 var ViewBaseConfig;
 var init_view_common = __esm(() => {
   ViewBaseConfig = Symbol.for("drizzle:ViewBaseConfig");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/table.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/table.js
 function getTableName(table) {
   return table[TableName];
 }
@@ -9811,7 +9870,7 @@ var init_table = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/sql.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/sql.js
 function isSQLWrapper(value) {
   return value !== null && value !== undefined && typeof value.getSQL === "function";
 }
@@ -10168,7 +10227,7 @@ var init_sql = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/alias.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/alias.js
 var ColumnAliasProxyHandler, TableAliasProxyHandler;
 var init_alias = __esm(() => {
   init_column();
@@ -10230,7 +10289,7 @@ var init_alias = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/selection-proxy.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/selection-proxy.js
 var SelectionProxyHandler;
 var init_selection_proxy = __esm(() => {
   init_alias();
@@ -10291,7 +10350,7 @@ var init_selection_proxy = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/utils.js
 function orderSelectedFields(fields, pathPrefix) {
   return Object.entries(fields).reduce((result, [name, field]) => {
     if (typeof name !== "string") {
@@ -10348,13 +10407,13 @@ var init_utils = __esm(() => {
   init_view_common();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/delete.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/delete.js
 var init_delete = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/errors.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/errors.js
 var init_errors3 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/int.common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/int.common.js
 var PgIntColumnBaseBuilder;
 var init_int_common = __esm(() => {
   init_entity();
@@ -10398,7 +10457,7 @@ var init_int_common = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/bigint.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/bigint.js
 function bigint(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config.mode === "number") {
@@ -10453,7 +10512,7 @@ var init_bigint = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/bigserial.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/bigserial.js
 function bigserial(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config.mode === "number") {
@@ -10510,7 +10569,7 @@ var init_bigserial = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/boolean.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/boolean.js
 function boolean(name) {
   return new PgBooleanBuilder(name ?? "");
 }
@@ -10535,7 +10594,7 @@ var init_boolean = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/char.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/char.js
 function char(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgCharBuilder(name, config);
@@ -10566,7 +10625,7 @@ var init_char = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/cidr.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/cidr.js
 function cidr(name) {
   return new PgCidrBuilder(name ?? "");
 }
@@ -10591,7 +10650,7 @@ var init_cidr = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/custom.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/custom.js
 function customType(customTypeParams) {
   return (a, b2) => {
     const { name, config } = getColumnNameAndConfig(a, b2);
@@ -10637,7 +10696,7 @@ var init_custom = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/date.common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/date.common.js
 var PgDateColumnBaseBuilder;
 var init_date_common = __esm(() => {
   init_entity();
@@ -10651,7 +10710,7 @@ var init_date_common = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/date.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/date.js
 function date(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config?.mode === "date") {
@@ -10703,7 +10762,7 @@ var init_date = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/double-precision.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/double-precision.js
 function doublePrecision(name) {
   return new PgDoublePrecisionBuilder(name ?? "");
 }
@@ -10734,7 +10793,7 @@ var init_double_precision = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/inet.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/inet.js
 function inet(name) {
   return new PgInetBuilder(name ?? "");
 }
@@ -10759,7 +10818,7 @@ var init_inet = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/integer.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/integer.js
 function integer(name) {
   return new PgIntegerBuilder(name ?? "");
 }
@@ -10791,7 +10850,7 @@ var init_integer = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/interval.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/interval.js
 function interval(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgIntervalBuilder(name, config);
@@ -10823,7 +10882,7 @@ var init_interval = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/json.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/json.js
 function json(name) {
   return new PgJsonBuilder(name ?? "");
 }
@@ -10864,7 +10923,7 @@ var init_json = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/jsonb.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/jsonb.js
 function jsonb(name) {
   return new PgJsonbBuilder(name ?? "");
 }
@@ -10905,7 +10964,7 @@ var init_jsonb = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/line.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/line.js
 function line(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (!config?.mode || config.mode === "tuple") {
@@ -10964,7 +11023,7 @@ var init_line = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/macaddr.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/macaddr.js
 function macaddr(name) {
   return new PgMacaddrBuilder(name ?? "");
 }
@@ -10989,7 +11048,7 @@ var init_macaddr = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/macaddr8.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/macaddr8.js
 function macaddr8(name) {
   return new PgMacaddr8Builder(name ?? "");
 }
@@ -11014,7 +11073,7 @@ var init_macaddr8 = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/numeric.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/numeric.js
 function numeric(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgNumericBuilder(name, config?.precision, config?.scale);
@@ -11056,7 +11115,7 @@ var init_numeric = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/point.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/point.js
 function point(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (!config?.mode || config.mode === "tuple") {
@@ -11121,7 +11180,7 @@ var init_point = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/postgis_extension/utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/postgis_extension/utils.js
 function hexToBytes(hex) {
   const bytes = [];
   for (let c = 0;c < hex.length; c += 2) {
@@ -11161,7 +11220,7 @@ function parseEWKB(hex) {
 }
 var init_utils2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/postgis_extension/geometry.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/postgis_extension/geometry.js
 function geometry(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (!config?.mode || config.mode === "tuple") {
@@ -11220,7 +11279,7 @@ var init_geometry = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/real.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/real.js
 function real(name) {
   return new PgRealBuilder(name ?? "");
 }
@@ -11255,7 +11314,7 @@ var init_real = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/serial.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/serial.js
 function serial(name) {
   return new PgSerialBuilder(name ?? "");
 }
@@ -11282,7 +11341,7 @@ var init_serial = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/smallint.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/smallint.js
 function smallint(name) {
   return new PgSmallIntBuilder(name ?? "");
 }
@@ -11314,7 +11373,7 @@ var init_smallint = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/smallserial.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/smallserial.js
 function smallserial(name) {
   return new PgSmallSerialBuilder(name ?? "");
 }
@@ -11341,7 +11400,7 @@ var init_smallserial = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/text.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/text.js
 function text(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgTextBuilder(name, config);
@@ -11370,7 +11429,7 @@ var init_text = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/time.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/time.js
 function time(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgTimeBuilder(name, config.withTimezone ?? false, config.precision);
@@ -11410,7 +11469,7 @@ var init_time = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/timestamp.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/timestamp.js
 function timestamp(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config?.mode === "string") {
@@ -11482,7 +11541,7 @@ var init_timestamp = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/uuid.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/uuid.js
 function uuid(name) {
   return new PgUUIDBuilder(name ?? "");
 }
@@ -11511,7 +11570,7 @@ var init_uuid = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/varchar.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/varchar.js
 function varchar(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgVarcharBuilder(name, config);
@@ -11542,7 +11601,7 @@ var init_varchar = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/bit.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/bit.js
 function bit(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgBinaryVectorBuilder(name, config);
@@ -11571,7 +11630,7 @@ var init_bit = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/halfvec.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/halfvec.js
 function halfvec(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgHalfVectorBuilder(name, config);
@@ -11606,7 +11665,7 @@ var init_halfvec = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/sparsevec.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/sparsevec.js
 function sparsevec(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgSparseVectorBuilder(name, config);
@@ -11635,7 +11694,7 @@ var init_sparsevec = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/vector.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/vector.js
 function vector(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgVectorBuilder(name, config);
@@ -11670,7 +11729,7 @@ var init_vector = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/index.js
 var init_columns = __esm(() => {
   init_bigint();
   init_bigserial();
@@ -11709,7 +11768,7 @@ var init_columns = __esm(() => {
   init_vector();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/all.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/all.js
 function getPgColumnBuilders() {
   return {
     bigint,
@@ -11781,7 +11840,7 @@ var init_all = __esm(() => {
   init_vector();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/table.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/table.js
 function pgTableWithSchema(name, columns, extraConfig, schema, baseName = name) {
   const rawTable = new PgTable(name, schema, baseName);
   const parsedColumns = typeof columns === "function" ? columns(getPgColumnBuilders()) : columns;
@@ -11832,7 +11891,7 @@ var init_table2 = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/primary-keys.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/primary-keys.js
 function primaryKey(...config) {
   if (config[0].columns) {
     return new PrimaryKeyBuilder(config[0].columns, config[0].name);
@@ -11870,44 +11929,49 @@ var init_primary_keys = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/expressions/conditions.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/expressions/conditions.js
 var init_conditions = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/expressions/select.js
-var init_select = () => {};
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/expressions/select.js
+function desc(column) {
+  return sql`${column} desc`;
+}
+var init_select = __esm(() => {
+  init_sql();
+});
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/expressions/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/expressions/index.js
 var init_expressions = __esm(() => {
   init_conditions();
   init_select();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/relations.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/relations.js
 var init_relations = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/functions/aggregate.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/functions/aggregate.js
 var init_aggregate = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/functions/vector.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/functions/vector.js
 var init_vector2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/functions/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/functions/index.js
 var init_functions = __esm(() => {
   init_aggregate();
   init_vector2();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/index.js
 var init_sql2 = __esm(() => {
   init_expressions();
   init_functions();
   init_sql();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/dialect.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/dialect.js
 var init_dialect = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/query-builders/query-builder.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/query-builders/query-builder.js
 var TypedQueryBuilder;
 var init_query_builder = __esm(() => {
   init_entity();
@@ -11919,7 +11983,7 @@ var init_query_builder = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/select.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/select.js
 function createSetOperator(type, isAll) {
   return (leftSelect, rightSelect, ...restSelects) => {
     const setOperators = [rightSelect, ...restSelects].map((select3) => ({
@@ -12172,16 +12236,16 @@ var init_select2 = __esm(() => {
   exceptAll = createSetOperator("except", true);
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/query-builder.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/query-builder.js
 var init_query_builder2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/insert.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/insert.js
 var init_insert = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/refresh-materialized-view.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/refresh-materialized-view.js
 var init_refresh_materialized_view = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/update.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/update.js
 var PgUpdateBase;
 var init_update = __esm(() => {
   init_entity();
@@ -12325,7 +12389,7 @@ var init_update = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/index.js
 var init_query_builders = __esm(() => {
   init_delete();
   init_insert();
@@ -12335,13 +12399,13 @@ var init_query_builders = __esm(() => {
   init_update();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/db.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/db.js
 var init_db = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/alias.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/alias.js
 var init_alias2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/checks.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/checks.js
 function check(name, value) {
   return new CheckBuilder(name, value);
 }
@@ -12371,7 +12435,7 @@ var init_checks = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/indexes.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/indexes.js
 function index(name) {
   return new IndexBuilderOn(false, name);
 }
@@ -12460,42 +12524,42 @@ var init_indexes = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/policies.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/policies.js
 var init_policies = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/roles.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/roles.js
 var init_roles = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/sequence.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/sequence.js
 var init_sequence = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/view-common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/view-common.js
 var PgViewConfig;
 var init_view_common2 = __esm(() => {
   PgViewConfig = Symbol.for("drizzle:PgViewConfig");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/view.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/view.js
 var PgMaterializedViewConfig;
 var init_view = __esm(() => {
   PgMaterializedViewConfig = Symbol.for("drizzle:PgMaterializedViewConfig");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/schema.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/schema.js
 var init_schema = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/session.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/session.js
 var init_session = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/utils.js
 var init_utils3 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/utils/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/utils/index.js
 var init_utils4 = __esm(() => {
   init_array();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/index.js
 var init_pg_core = __esm(() => {
   init_alias2();
   init_checks();
@@ -12531,6 +12595,7 @@ var init_users = __esm(() => {
     emailVerified: boolean("email_verified").notNull().default(false),
     image: text("image"),
     twoFactorEnabled: boolean("two_factor_enabled").default(false),
+    isSuperadmin: boolean("is_superadmin").notNull().default(false),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   });
@@ -12647,9 +12712,33 @@ var init_triggers = __esm(() => {
   }, (table2) => [index("triggers_automation_idx").on(table2.automationId)]);
 });
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/expressions.js
+var init_expressions2 = __esm(() => {
+  init_expressions();
+});
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/index.js
+var init_drizzle_orm = __esm(() => {
+  init_alias();
+  init_column_builder();
+  init_column();
+  init_entity();
+  init_errors3();
+  init_expressions2();
+  init_logger();
+  init_query_promise();
+  init_relations();
+  init_sql2();
+  init_subquery();
+  init_table();
+  init_utils();
+  init_view_common();
+});
 // ../shared/src/db/schema/deployments.ts
 var deploymentStatusEnum, deployments;
 var init_deployments = __esm(() => {
+  init_drizzle_orm();
   init_pg_core();
   init_projects();
   deploymentStatusEnum = pgEnum("deployment_status", [
@@ -12672,10 +12761,11 @@ var init_deployments = __esm(() => {
     activatedAt: timestamp("activated_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("deployments_project_idx").on(table2.projectId),
-    index("deployments_project_status_idx").on(table2.projectId, table2.status),
-    index("deployments_environment_idx").on(table2.environmentId)
+  }, (table3) => [
+    index("deployments_project_idx").on(table3.projectId),
+    index("deployments_project_status_idx").on(table3.projectId, table3.status),
+    index("deployments_environment_idx").on(table3.environmentId),
+    index("deployments_project_created_idx").on(table3.projectId, desc(table3.createdAt))
   ]);
 });
@@ -12720,14 +12810,14 @@ var init_execution_records = __esm(() => {
     replayOverrides: jsonb("replay_overrides").$type(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     completedAt: timestamp("completed_at", { withTimezone: true })
-  }, (table2) => [
-    index("execution_records_automation_idx").on(table2.automationId),
-    index("execution_records_deployment_idx").on(table2.deploymentId),
-    index("execution_records_status_idx").on(table2.status),
-    index("execution_records_trace_idx").on(table2.traceId),
-    index("execution_records_created_idx").on(table2.createdAt),
-    index("execution_records_automation_created_idx").on(table2.automationId, table2.createdAt),
-    index("execution_records_replay_of_idx").on(table2.replayOf)
+  }, (table3) => [
+    index("execution_records_automation_idx").on(table3.automationId),
+    index("execution_records_deployment_idx").on(table3.deploymentId),
+    index("execution_records_status_idx").on(table3.status),
+    index("execution_records_trace_idx").on(table3.traceId),
+    index("execution_records_created_idx").on(table3.createdAt),
+    index("execution_records_automation_created_idx").on(table3.automationId, table3.createdAt),
+    index("execution_records_replay_of_idx").on(table3.replayOf)
   ]);
 });
@@ -12751,10 +12841,10 @@ var init_log_entries = __esm(() => {
     level: logLevelEnum("level").notNull(),
     message: text("message").notNull(),
     fields: jsonb("fields")
-  }, (table2) => [
-    index("log_entries_execution_idx").on(table2.executionId),
-    index("log_entries_project_idx").on(table2.projectId),
-    index("log_entries_timestamp_idx").on(table2.timestamp)
+  }, (table3) => [
+    index("log_entries_execution_idx").on(table3.executionId),
+    index("log_entries_project_idx").on(table3.projectId),
+    index("log_entries_timestamp_idx").on(table3.timestamp)
   ]);
 });
@@ -12772,11 +12862,11 @@ var init_metrics = __esm(() => {
     name: text("name").notNull(),
     value: doublePrecision("value").notNull(),
     tags: jsonb("tags")
-  }, (table2) => [
-    index("metrics_execution_idx").on(table2.executionId),
-    index("metrics_project_idx").on(table2.projectId),
-    index("metrics_name_idx").on(table2.name),
-    index("metrics_timestamp_idx").on(table2.timestamp)
+  }, (table3) => [
+    index("metrics_execution_idx").on(table3.executionId),
+    index("metrics_project_idx").on(table3.projectId),
+    index("metrics_name_idx").on(table3.name),
+    index("metrics_timestamp_idx").on(table3.timestamp)
   ]);
 });
@@ -12797,9 +12887,9 @@ var init_artifacts = __esm(() => {
     storageUrl: text("storage_url").notNull(),
     metadata: jsonb("metadata"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("artifacts_execution_idx").on(table2.executionId),
-    index("artifacts_project_idx").on(table2.projectId)
+  }, (table3) => [
+    index("artifacts_execution_idx").on(table3.executionId),
+    index("artifacts_project_idx").on(table3.projectId)
   ]);
 });
@@ -12822,10 +12912,10 @@ var init_secrets2 = __esm(() => {
     nonce: bytea("nonce").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    uniqueIndex("secrets_project_name_idx").on(table2.projectId, table2.name),
-    index("secrets_project_idx").on(table2.projectId),
-    index("secrets_environment_idx").on(table2.environmentId)
+  }, (table3) => [
+    uniqueIndex("secrets_project_name_idx").on(table3.projectId, table3.name),
+    index("secrets_project_idx").on(table3.projectId),
+    index("secrets_environment_idx").on(table3.environmentId)
   ]);
 });
@@ -12847,11 +12937,11 @@ var init_api_keys = __esm(() => {
     lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("api_keys_org_idx").on(table2.organizationId),
-    index("api_keys_user_idx").on(table2.userId),
-    index("api_keys_prefix_idx").on(table2.keyPrefix),
-    uniqueIndex("api_keys_hash_idx").on(table2.keyHash)
+  }, (table3) => [
+    index("api_keys_org_idx").on(table3.organizationId),
+    index("api_keys_user_idx").on(table3.userId),
+    index("api_keys_prefix_idx").on(table3.keyPrefix),
+    uniqueIndex("api_keys_hash_idx").on(table3.keyHash)
   ]);
 });
@@ -12876,10 +12966,10 @@ var init_endpoint_keys = __esm(() => {
     revokedAt: timestamp("revoked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("endpoint_keys_project_idx").on(table2.projectId),
-    index("endpoint_keys_prefix_idx").on(table2.keyPrefix),
-    uniqueIndex("endpoint_keys_hash_idx").on(table2.keyHash)
+  }, (table3) => [
+    index("endpoint_keys_project_idx").on(table3.projectId),
+    index("endpoint_keys_prefix_idx").on(table3.keyPrefix),
+    uniqueIndex("endpoint_keys_hash_idx").on(table3.keyHash)
   ]);
 });
@@ -12901,11 +12991,11 @@ var init_audit_log = __esm(() => {
     metadata: jsonb("metadata"),
     ipAddress: text("ip_address"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("audit_log_org_idx").on(table2.organizationId),
-    index("audit_log_user_idx").on(table2.userId),
-    index("audit_log_action_idx").on(table2.action),
-    index("audit_log_created_idx").on(table2.createdAt)
+  }, (table3) => [
+    index("audit_log_org_idx").on(table3.organizationId),
+    index("audit_log_user_idx").on(table3.userId),
+    index("audit_log_action_idx").on(table3.action),
+    index("audit_log_created_idx").on(table3.createdAt)
   ]);
 });
@@ -12942,40 +13032,17 @@ var init_metering_rollups = __esm(() => {
     }).notNull().default(0),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    uniqueIndex("metering_rollups_natural_key").on(table2.automationId, table2.granularity, table2.bucketStart),
-    index("metering_rollups_org_idx").on(table2.organizationId),
-    index("metering_rollups_project_idx").on(table2.projectId),
-    index("metering_rollups_automation_idx").on(table2.automationId),
-    index("metering_rollups_granularity_idx").on(table2.granularity),
-    index("metering_rollups_bucket_idx").on(table2.bucketStart),
-    index("metering_rollups_project_bucket_idx").on(table2.projectId, table2.granularity, table2.bucketStart)
+  }, (table3) => [
+    uniqueIndex("metering_rollups_natural_key").on(table3.automationId, table3.granularity, table3.bucketStart),
+    index("metering_rollups_org_idx").on(table3.organizationId),
+    index("metering_rollups_project_idx").on(table3.projectId),
+    index("metering_rollups_automation_idx").on(table3.automationId),
+    index("metering_rollups_granularity_idx").on(table3.granularity),
+    index("metering_rollups_bucket_idx").on(table3.bucketStart),
+    index("metering_rollups_project_bucket_idx").on(table3.projectId, table3.granularity, table3.bucketStart)
   ]);
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/expressions.js
-var init_expressions2 = __esm(() => {
-  init_expressions();
-});
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/index.js
-var init_drizzle_orm = __esm(() => {
-  init_alias();
-  init_column_builder();
-  init_column();
-  init_entity();
-  init_errors3();
-  init_expressions2();
-  init_logger();
-  init_query_promise();
-  init_relations();
-  init_sql2();
-  init_subquery();
-  init_table();
-  init_utils();
-  init_view_common();
-});
 // ../shared/src/db/schema/credit-ledger.ts
 var creditLedgerEntryTypeEnum, creditLedger;
 var init_credit_ledger = __esm(() => {
@@ -13591,6 +13658,56 @@ var init_auth = __esm(() => {
   });
 });
+// ../shared/src/db/schema/admin-sessions.ts
+var bytea2, adminSessions;
+var init_admin_sessions = __esm(() => {
+  init_pg_core();
+  init_users();
+  bytea2 = customType({
+    dataType() {
+      return "bytea";
+    }
+  });
+  adminSessions = pgTable("admin_sessions", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    sessionTokenHash: bytea2("session_token_hash").notNull(),
+    userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    issuedAt: timestamp("issued_at", { withTimezone: true }).notNull().defaultNow(),
+    lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().defaultNow(),
+    stepUpVerifiedAt: timestamp("step_up_verified_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [
+    uniqueIndex("admin_sessions_token_idx").on(table3.sessionTokenHash),
+    index("admin_sessions_user_idx").on(table3.userId)
+  ]);
+});
+// ../shared/src/db/schema/admin-audit-log.ts
+var adminAuditLog;
+var init_admin_audit_log = __esm(() => {
+  init_pg_core();
+  init_users();
+  adminAuditLog = pgTable("admin_audit_log", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    userId: uuid("user_id").references(() => users.id, {
+      onDelete: "set null"
+    }),
+    actorLabel: text("actor_label").notNull(),
+    route: text("route").notNull(),
+    method: text("method").notNull(),
+    queryParams: jsonb("query_params").$type(),
+    statusCode: integer("status_code").notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    actionPayload: jsonb("action_payload").$type(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [
+    index("admin_audit_log_user_idx").on(table3.userId),
+    index("admin_audit_log_created_idx").on(table3.createdAt),
+    index("admin_audit_log_route_idx").on(table3.route)
+  ]);
+});
 // ../shared/src/db/schema/index.ts
 var init_schema2 = __esm(() => {
   init_users();
@@ -13625,6 +13742,8 @@ var init_schema2 = __esm(() => {
   init_healing();
   init_playground();
   init_auth();
+  init_admin_sessions();
+  init_admin_audit_log();
 });
 // ../shared/src/db/index.ts
@@ -13639,6 +13758,22 @@ var init_url_validator = __esm(() => {
   BLOCKED_HOSTNAMES = new Set(["localhost", "metadata.google.internal"]);
 });
+// ../shared/src/crypto/session-token.ts
+var init_session_token = () => {};
+// ../shared/src/http/parse-body.ts
+function parseHttpBody(body, _headers) {
+  if (typeof body !== "string")
+    return body;
+  if (body === "")
+    return null;
+  try {
+    return JSON.parse(body);
+  } catch {
+    return body;
+  }
+}
 // ../shared/src/index.ts
 var init_src2 = __esm(() => {
   init_billing();
@@ -13650,6 +13785,7 @@ var init_src2 = __esm(() => {
   init_marketplace();
   init_db2();
   init_url_validator();
+  init_session_token();
 });
 // src/lib/manifest.ts
@@ -14601,6 +14737,114 @@ var init_schedule = __esm(() => {
   init_project_id();
 });
+// src/lib/dev-trust.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname, join as join7 } from "node:path";
+function hasStoredCredentials() {
+  try {
+    const cfg = readConfig();
+    const apiKey = typeof cfg.apiKey === "string" ? cfg.apiKey : "";
+    const authToken = typeof cfg.authToken === "string" ? cfg.authToken : "";
+    return apiKey.length > 0 || authToken.length > 0;
+  } catch {
+    return false;
+  }
+}
+function hasProjectTrustMarker(projectDir) {
+  return existsSync6(join7(projectDir, TRUST_MARKER_RELATIVE_PATH));
+}
+function grantProjectTrust(projectDir) {
+  const markerPath = join7(projectDir, TRUST_MARKER_RELATIVE_PATH);
+  const dir = dirname(markerPath);
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  const note = [
+    "# dura dev trust marker",
+    "#",
+    "# This file records that you accepted the risk of running `dura dev`",
+    "# in-process with access to your local credentials (see GH #118).",
+    "# Delete this file to revoke trust for this project.",
+    `# Granted: ${new Date().toISOString()}`,
+    ""
+  ].join(`
+`);
+  writeFileSync6(markerPath, note, { mode: 384 });
+}
+function isEnvTruthy(val) {
+  if (!val)
+    return false;
+  const v = val.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+function evaluateDevTrust(input) {
+  if (!hasStoredCredentials()) {
+    return { allow: true, warn: false, reason: "NO_CREDENTIALS" };
+  }
+  if (input.trustFlag) {
+    grantProjectTrust(input.projectDir);
+    return { allow: true, warn: true, reason: "TRUST_GRANTED_FLAG" };
+  }
+  if (isEnvTruthy(input.trustEnv)) {
+    grantProjectTrust(input.projectDir);
+    return { allow: true, warn: true, reason: "TRUST_GRANTED_ENV" };
+  }
+  if (hasProjectTrustMarker(input.projectDir)) {
+    return { allow: true, warn: true, reason: "MARKER_PRESENT" };
+  }
+  return { allow: false, warn: true, reason: "TRUST_REQUIRED" };
+}
+function renderTrustWarning(opts) {
+  const color = opts?.color ?? process.stderr.isTTY ?? false;
+  const red = color ? RED : "";
+  const yellow = color ? YELLOW : "";
+  const bold = color ? BOLD : "";
+  const reset2 = color ? RESET : "";
+  const lines = [
+    `${red}${bold}╔══════════════════════════════════════════════════════════════════════╗${reset2}`,
+    `${red}${bold}║  SECURITY WARNING — dura dev runs automation code with your local   ║${reset2}`,
+    `${red}${bold}║  filesystem privileges. A malicious npm dependency in your handler  ║${reset2}`,
+    `${red}${bold}║  graph can read ~/.dura/config (your API key), ~/.ssh, ~/.aws, etc. ║${reset2}`,
+    `${red}${bold}║  See https://github.com/dura-run/dura-run/issues/118 for details.   ║${reset2}`,
+    `${red}${bold}╚══════════════════════════════════════════════════════════════════════╝${reset2}`,
+    `${yellow}  Tip: audit your dependencies before trusting this project.${reset2}`,
+    ""
+  ];
+  return lines.join(`
+`);
+}
+function renderTrustRefusal() {
+  const color = process.stderr.isTTY ?? false;
+  const yellow = color ? YELLOW : "";
+  const bold = color ? BOLD : "";
+  const reset2 = color ? RESET : "";
+  return [
+    `${bold}${yellow}dura dev refuses to start.${reset2}`,
+    "",
+    "Your local machine has stored dura credentials, and `dura dev` currently",
+    "loads your handler code with full filesystem access. Until we ship an",
+    "isolated-vm sandbox for local dev, you must explicitly accept this risk.",
+    "",
+    "To proceed, pick ONE of:",
+    "",
+    "  1. Run with --trust (one-time; remembered via .dura/dev-trust):",
+    "       dura dev --trust",
+    "",
+    "  2. Set the env var (same effect):",
+    "       DURA_DEV_TRUST=1 dura dev",
+    "",
+    "  3. Log out first (removes the credentials being protected):",
+    "       dura logout",
+    ""
+  ].join(`
+`);
+}
+var TRUST_MARKER_RELATIVE_PATH, RED = "\x1B[31m", YELLOW = "\x1B[33m", BOLD = "\x1B[1m", RESET = "\x1B[0m";
+var init_dev_trust = __esm(() => {
+  init_config_store();
+  TRUST_MARKER_RELATIVE_PATH = join7(".dura", "dev-trust");
+});
 // src/dev/server.ts
 var exports_server = {};
 __export(exports_server, {
@@ -14680,7 +14924,7 @@ function createDevServer(options) {
       headers,
       query,
       params: match.params,
-      body
+      body: parseHttpBody(body, headers)
     });
     return options.onRequest(match.route, duraReq);
   }
@@ -14711,12 +14955,7 @@ function createDevServer(options) {
           resolve3(null);
           return;
         }
-        const raw = Buffer.concat(chunks).toString("utf-8");
-        try {
-          resolve3(JSON.parse(raw));
-        } catch {
-          resolve3(raw);
-        }
+        resolve3(Buffer.concat(chunks).toString("utf-8"));
       });
     });
   }
@@ -14788,6 +15027,7 @@ function createDevServer(options) {
 }
 var CORS_HEADERS;
 var init_server = __esm(() => {
+  init_src2();
   CORS_HEADERS = {
     "access-control-allow-origin": "*",
     "access-control-allow-methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
@@ -15131,8 +15371,8 @@ __export(exports_file_watcher, {
   resolveAffectedAutomation: () => resolveAffectedAutomation,
   createFileWatcher: () => createFileWatcher
 });
-import { watch, existsSync as existsSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { watch, existsSync as existsSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 function resolveAffectedAutomation(manifest, changedPath) {
   const normalized = changedPath.replace(/\\/g, "/");
   const directMatch = manifest.automations.filter((a) => a.entrypoint.replace(/\\/g, "/") === normalized);
@@ -15151,7 +15391,7 @@ function createFileWatcher(options) {
       return;
     if (!/\.(ts|tsx|js|jsx|mjs|mts)$/.test(filename))
       return;
-    const relativePath = join7(dir, filename).replace(/\\/g, "/");
+    const relativePath = join8(dir, filename).replace(/\\/g, "/");
     const existing = debounceTimers.get(relativePath);
     if (existing) {
       clearTimeout(existing);
@@ -15167,8 +15407,8 @@ function createFileWatcher(options) {
         return;
       watching = true;
       for (const dir of watchDirs) {
-        const fullDir = join7(projectDir, dir);
-        if (!existsSync6(fullDir))
+        const fullDir = join8(projectDir, dir);
+        if (!existsSync7(fullDir))
           continue;
         try {
           const fsWatcher = watch(fullDir, { recursive: true }, (_eventType, filename) => {
@@ -15249,9 +15489,22 @@ function extractCronTriggers(manifest) {
   return entries;
 }
 function registerDevCommand(program2) {
-  program2.command("dev").description("Start the local development server with hot-reload").option("--dir <path>", "Project directory", ".").option("--port <port>", "Dev server port", "3000").action(async (opts, cmd) => {
+  program2.command("dev").description("Start the local development server with hot-reload").option("--dir <path>", "Project directory", ".").option("--port <port>", "Dev server port", "3000").option("--trust", "Acknowledge that `dura dev` runs user code with your local filesystem privileges (see GH #118). Required when credentials are stored locally; remembered in .dura/dev-trust.").action(async (opts, cmd) => {
     const output = getOutput(cmd);
     const projectDir = opts.dir ?? ".";
+    const trustDecision = evaluateDevTrust({
+      projectDir,
+      trustFlag: opts.trust === true,
+      trustEnv: process.env["DURA_DEV_TRUST"]
+    });
+    if (trustDecision.warn) {
+      process.stderr.write(renderTrustWarning());
+    }
+    if (!trustDecision.allow) {
+      process.stderr.write(renderTrustRefusal());
+      output.error("DEV_TRUST_REQUIRED", "dura dev refused to start — credentials are stored locally and trust was not granted.", "Re-run with --trust or set DURA_DEV_TRUST=1 after reviewing the warning above.");
+      return;
+    }
     const port = parseInt(opts.port ?? "3000", 10);
     if (isNaN(port) || port < 1 || port > 65535) {
       output.error("INVALID_PORT", `Invalid port: "${opts.port}". Must be a number between 1 and 65535.`);
@@ -15267,11 +15520,11 @@ function registerDevCommand(program2) {
       }
       throw err;
     }
-    const { existsSync: existsSync7, readFileSync: readFileSync6 } = await import("node:fs");
-    const { join: join8 } = await import("node:path");
-    const envPath = join8(projectDir, ".env.local");
+    const { existsSync: existsSync8, readFileSync: readFileSync6 } = await import("node:fs");
+    const { join: join9 } = await import("node:path");
+    const envPath = join9(projectDir, ".env.local");
     let secrets2 = {};
-    if (existsSync7(envPath)) {
+    if (existsSync8(envPath)) {
       const content = readFileSync6(envPath, "utf-8");
       secrets2 = parseEnvFile(content);
       output.info(`Loaded ${Object.keys(secrets2).length} secret(s) from .env.local`);
@@ -15375,6 +15628,7 @@ Shutting down...`);
 var init_dev = __esm(() => {
   init_src3();
   init_manifest2();
+  init_dev_trust();
 });
 // src/snapshot/comparator.ts
 function getAtPath(obj, path) {
@@ -15622,14 +15876,14 @@ var init_comparator = __esm(() => {
 // src/snapshot/file-manager.ts
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync5,
   readFileSync as readFileSync6,
-  writeFileSync as writeFileSync6,
+  writeFileSync as writeFileSync7,
   readdirSync as readdirSync2,
   unlinkSync
 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function automationNameToFileName(automationName) {
   return automationName.replace(/\//g, "-") + ".snap.json";
 }
@@ -15640,19 +15894,19 @@ function fileNameToAutomationName(fileName) {
 class SnapshotFileManager {
   snapshotsDir;
   constructor(projectDir) {
-    this.snapshotsDir = join8(projectDir, SNAPSHOTS_DIR);
+    this.snapshotsDir = join9(projectDir, SNAPSHOTS_DIR);
   }
   filePath(automationName) {
-    return join8(this.snapshotsDir, automationNameToFileName(automationName));
+    return join9(this.snapshotsDir, automationNameToFileName(automationName));
   }
   ensureDir() {
-    if (!existsSync7(this.snapshotsDir)) {
-      mkdirSync4(this.snapshotsDir, { recursive: true });
+    if (!existsSync8(this.snapshotsDir)) {
+      mkdirSync5(this.snapshotsDir, { recursive: true });
     }
   }
   read(automationName) {
     const path = this.filePath(automationName);
-    if (!existsSync7(path))
+    if (!existsSync8(path))
       return null;
     try {
       const raw = readFileSync6(path, "utf-8");
@@ -15664,7 +15918,7 @@ class SnapshotFileManager {
   write(automationName, snapshotFile) {
     this.ensureDir();
     const path = this.filePath(automationName);
-    writeFileSync6(path, JSON.stringify(snapshotFile, null, 2) + `
+    writeFileSync7(path, JSON.stringify(snapshotFile, null, 2) + `
 `, "utf-8");
   }
   updateSnapshot(automationName, snapshot) {
@@ -15685,12 +15939,12 @@ class SnapshotFileManager {
     });
   }
   listAutomationNames() {
-    if (!existsSync7(this.snapshotsDir))
+    if (!existsSync8(this.snapshotsDir))
       return [];
     const files = readdirSync2(this.snapshotsDir).filter((f) => f.endsWith(".snap.json"));
     const names = [];
     for (const file of files) {
-      const path = join8(this.snapshotsDir, file);
+      const path = join9(this.snapshotsDir, file);
       try {
         const raw = readFileSync6(path, "utf-8");
         const parsed = JSON.parse(raw);
@@ -15703,7 +15957,7 @@ class SnapshotFileManager {
   }
   delete(automationName) {
     const path = this.filePath(automationName);
-    if (existsSync7(path)) {
+    if (existsSync8(path)) {
       unlinkSync(path);
     }
   }
@@ -15712,15 +15966,15 @@ var SNAPSHOTS_DIR = "__snapshots__";
 var init_file_manager = () => {};
 // src/snapshot/config-reader.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { join as join10 } from "node:path";
 function readSnapshotConfig(projectDir) {
-  const durajsonPath = join9(projectDir, "dura.json");
-  const testjsonPath = join9(projectDir, "dura.test.json");
+  const durajsonPath = join10(projectDir, "dura.json");
+  const testjsonPath = join10(projectDir, "dura.test.json");
   let fromDuraJson = {};
   let fromTestJson = {};
   let mocks;
-  if (existsSync8(durajsonPath)) {
+  if (existsSync9(durajsonPath)) {
     try {
       const raw = JSON.parse(readFileSync7(durajsonPath, "utf-8"));
       if (raw["snapshots"] && typeof raw["snapshots"] === "object" && !Array.isArray(raw["snapshots"])) {
@@ -15728,7 +15982,7 @@ function readSnapshotConfig(projectDir) {
       }
     } catch {}
   }
-  if (existsSync8(testjsonPath)) {
+  if (existsSync9(testjsonPath)) {
     try {
       const raw = JSON.parse(readFileSync7(testjsonPath, "utf-8"));
       if (raw["snapshots"] && typeof raw["snapshots"] === "object" && !Array.isArray(raw["snapshots"])) {
@@ -16730,19 +16984,19 @@ __export(exports_export, {
   collectExportFiles: () => collectExportFiles
 });
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   readFileSync as readFileSync8,
   readdirSync as readdirSync3,
   statSync,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
-import { join as join10, relative, resolve as resolve4 } from "node:path";
+import { join as join11, relative, resolve as resolve4 } from "node:path";
 function collectExportFiles(baseDir, currentDir) {
   const dir = currentDir ?? baseDir;
   const entries = [];
   const items = readdirSync3(dir);
   for (const item of items) {
-    const fullPath = join10(dir, item);
+    const fullPath = join11(dir, item);
     const relPath = relative(baseDir, fullPath);
     const stat = statSync(fullPath);
     if (stat.isDirectory()) {
@@ -16775,8 +17029,8 @@ function registerExportCommand(program2) {
   program2.command("export").description("Export project source + config into a portable archive").option("--dir <path>", "Project directory", ".").option("--output <path>", "Output file path").action(async (opts, cmd) => {
     const output = getOutput(cmd);
     const projectDir = resolve4(opts.dir ?? ".");
-    const manifestPath = join10(projectDir, "dura.json");
-    if (!existsSync9(manifestPath)) {
+    const manifestPath = join11(projectDir, "dura.json");
+    if (!existsSync10(manifestPath)) {
       output.error("EXPORT_NO_MANIFEST", "No dura.json found in project directory", "Run this command from a dura project directory or use --dir");
       return;
     }
@@ -16796,9 +17050,9 @@ function registerExportCommand(program2) {
       return;
     }
     const archive = createArchive(projectName, files);
-    const outputPath = opts.output ?? join10(projectDir, `${projectName}-export.json`);
+    const outputPath = opts.output ?? join11(projectDir, `${projectName}-export.json`);
     try {
-      writeFileSync7(outputPath, archive, "utf-8");
+      writeFileSync8(outputPath, archive, "utf-8");
     } catch (err) {
       output.error("EXPORT_FAILED", `Failed to write archive: ${err instanceof Error ? err.message : String(err)}`);
       return;
@@ -17725,27 +17979,27 @@ __export(exports_create, {
   registerAddCommand: () => registerAddCommand
 });
 import {
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync5,
-  writeFileSync as writeFileSync8,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync6,
+  writeFileSync as writeFileSync9,
   readFileSync as readFileSync9,
   readdirSync as readdirSync4
 } from "node:fs";
-import { join as join11, resolve as resolve5, dirname } from "node:path";
+import { join as join12, resolve as resolve5, dirname as dirname2 } from "node:path";
 function slugifyDescription(description) {
   return description.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30).replace(/-+$/, "");
 }
 function getExistingRoutes(projectDir) {
-  const routesDir = join11(projectDir, "routes");
-  const jobsDir = join11(projectDir, "jobs");
+  const routesDir = join12(projectDir, "routes");
+  const jobsDir = join12(projectDir, "jobs");
   const routes = [];
-  if (existsSync10(routesDir)) {
+  if (existsSync11(routesDir)) {
     try {
       const files = readdirSync4(routesDir);
       routes.push(...files.map((f) => `routes/${f}`));
     } catch {}
   }
-  if (existsSync10(jobsDir)) {
+  if (existsSync11(jobsDir)) {
     try {
       const files = readdirSync4(jobsDir);
       routes.push(...files.map((f) => `jobs/${f}`));
@@ -17755,12 +18009,12 @@ function getExistingRoutes(projectDir) {
 }
 function writeGeneratedFiles(projectDir, files) {
   for (const file of files) {
-    const filePath = join11(projectDir, file.path);
-    const dir = dirname(filePath);
-    if (!existsSync10(dir)) {
-      mkdirSync5(dir, { recursive: true });
+    const filePath = join12(projectDir, file.path);
+    const dir = dirname2(filePath);
+    if (!existsSync11(dir)) {
+      mkdirSync6(dir, { recursive: true });
     }
-    writeFileSync8(filePath, file.content, "utf-8");
+    writeFileSync9(filePath, file.content, "utf-8");
   }
 }
 async function confirm(question) {
@@ -17789,8 +18043,8 @@ function registerCreateCommand(program2) {
     }
     const projectName = opts.name || slugifyDescription(description);
     const parentDir = opts.dir ? resolve5(opts.dir) : process.cwd();
-    const projectDir = join11(parentDir, projectName);
-    if (existsSync10(projectDir)) {
+    const projectDir = join12(parentDir, projectName);
+    if (existsSync11(projectDir)) {
       output.error("DIRECTORY_EXISTS", `Directory "${projectName}" already exists`, "Choose a different name with --name or remove the existing directory");
       return;
     }
@@ -17819,8 +18073,8 @@ function registerCreateCommand(program2) {
         return;
       }
     }
-    mkdirSync5(join11(projectDir, "routes"), { recursive: true });
-    mkdirSync5(join11(projectDir, "jobs"), { recursive: true });
+    mkdirSync6(join12(projectDir, "routes"), { recursive: true });
+    mkdirSync6(join12(projectDir, "jobs"), { recursive: true });
     writeGeneratedFiles(projectDir, generateResult.files);
     output.info(`Files written to ${projectDir}`);
     if (opts.deploy !== false) {
@@ -17851,8 +18105,8 @@ function registerAddCommand(program2) {
       return;
     }
     const projectDir = opts.dir ? resolve5(opts.dir) : process.cwd();
-    const duraJsonPath = join11(projectDir, "dura.json");
-    if (!existsSync10(duraJsonPath)) {
+    const duraJsonPath = join12(projectDir, "dura.json");
+    if (!existsSync11(duraJsonPath)) {
       output.error("NOT_A_DURA_PROJECT", "No dura.json found in the current directory", "Run this command from a dura project directory or use --dir");
       return;
     }
@@ -19048,31 +19302,31 @@ var init_heal = __esm(() => {
 });
 // src/lib/skill-installer.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join12, dirname as dirname2 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join13, dirname as dirname3 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { fileURLToPath } from "node:url";
 function getSkillSourceDir() {
   const __filename2 = fileURLToPath(import.meta.url);
-  return join12(dirname2(dirname2(__filename2)), "skills");
+  return join13(dirname3(dirname3(__filename2)), "skills");
 }
 function getGlobalSkillsDir() {
-  return join12(homedir2(), ".claude", "skills", "dura");
+  return join13(homedir2(), ".claude", "skills", "dura");
 }
 function getLocalSkillsDir(projectDir) {
-  return join12(projectDir, ".claude", "skills", "dura");
+  return join13(projectDir, ".claude", "skills", "dura");
 }
 function installSkills(targetDir) {
   const sourceDir = getSkillSourceDir();
-  if (!existsSync11(targetDir)) {
-    mkdirSync6(targetDir, { recursive: true });
+  if (!existsSync12(targetDir)) {
+    mkdirSync7(targetDir, { recursive: true });
   }
   const installedFiles = [];
   for (const file of SKILL_FILES) {
-    const sourcePath = join12(sourceDir, file);
-    const targetPath = join12(targetDir, file);
+    const sourcePath = join13(sourceDir, file);
+    const targetPath = join13(targetDir, file);
     const content = readFileSync10(sourcePath, "utf-8");
-    writeFileSync9(targetPath, content, "utf-8");
+    writeFileSync10(targetPath, content, "utf-8");
     installedFiles.push(targetPath);
   }
   return {
@@ -19096,8 +19350,8 @@ var exports_init = {};
 __export(exports_init, {
   registerInitCommand: () => registerInitCommand
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join13, resolve as resolve6, basename } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join14, resolve as resolve6, basename } from "node:path";
 function registerInitCommand(program2) {
   program2.command("init").description("Initialize a dura project in the current directory and install AI agent skills").option("--dir <path>", "Project directory (defaults to current dir)").option("--name <name>", "Project name (defaults to directory name)").option("--global", "Install AI agent skills globally (~/.claude/skills/dura/)").option("--local", "Install AI agent skills locally (.claude/skills/dura/)").option("--skip-skills", "Skip AI agent skill installation").action(async (opts, cmd) => {
     const output = getOutput(cmd);
@@ -19107,24 +19361,24 @@ function registerInitCommand(program2) {
       output.error("INVALID_NAME", `Invalid project name "${projectName}"`, "Project name must start with a letter and contain only letters, numbers, hyphens, and underscores. Use --name to specify a valid name.");
       return;
     }
-    mkdirSync7(join13(projectDir, "routes"), { recursive: true });
-    mkdirSync7(join13(projectDir, "jobs"), { recursive: true });
-    const manifestPath = join13(projectDir, "dura.json");
-    const alreadyInitialized = existsSync12(manifestPath);
+    mkdirSync8(join14(projectDir, "routes"), { recursive: true });
+    mkdirSync8(join14(projectDir, "jobs"), { recursive: true });
+    const manifestPath = join14(projectDir, "dura.json");
+    const alreadyInitialized = existsSync13(manifestPath);
     if (!alreadyInitialized) {
-      writeFileSync10(manifestPath, duraJsonTemplate(projectName));
+      writeFileSync11(manifestPath, duraJsonTemplate(projectName));
     } else {
       output.info(`dura.json already exists in ${projectDir} — leaving it in place.`);
     }
-    const helloPath = join13(projectDir, "routes", "hello.ts");
-    if (existsSync12(helloPath)) {
+    const helloPath = join14(projectDir, "routes", "hello.ts");
+    if (existsSync13(helloPath)) {
       output.warn("routes/hello.ts already exists — skipping");
     } else {
-      writeFileSync10(helloPath, HELLO_TEMPLATE);
+      writeFileSync11(helloPath, HELLO_TEMPLATE);
     }
-    const gitignorePath = join13(projectDir, ".gitignore");
-    if (!existsSync12(gitignorePath)) {
-      writeFileSync10(gitignorePath, GITIGNORE_CONTENT2);
+    const gitignorePath = join14(projectDir, ".gitignore");
+    if (!existsSync13(gitignorePath)) {
+      writeFileSync11(gitignorePath, GITIGNORE_CONTENT2);
     }
     if (alreadyInitialized) {
       output.info(`Re-checked dura project "${projectName}" in ${projectDir}`);
@@ -19386,7 +19640,7 @@ async function registerAllCommands(program2) {
   registerOpenApiCommand2(program2);
   return program2;
 }
-var CLI_VERSION = "0.2.1";
+var CLI_VERSION = "0.3.0";
 var init_src3 = __esm(() => {
   init_esm();
   if (import.meta.url === `file://${realpathSync(process.argv[1] ?? "").replace(/\\/g, "/")}`) {
@@ -19403,4 +19657,4 @@ export {
   CLI_VERSION
 };
-//# debugId=25AB4373003CF5A164756E2164756E21
+//# debugId=4BAA174E1BA4BE2C64756E2164756E21