@keystrokehq/cli 0.0.53 → 0.0.54

package/dist/index.mjs

@@ -12,6 +12,7 @@ import "@better-auth/drizzle-adapter";
 import "better-auth";
 import "better-auth/plugins/bearer";
 import "better-auth/plugins/device-authorization";
+import "better-auth/plugins/magic-link";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/client";
 import { access, copyFile, cp, mkdir, readFile, readdir, stat, symlink, unlink, writeFile } from "node:fs/promises";
@@ -19,6 +20,40 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { build, mergeConfig } from "tsdown";
 import "@aws-sdk/client-s3";
 import "@aws-sdk/s3-request-presigner";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+//#endregion
 //#region ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/KyError.js
 /**
 Base class for all Ky-specific errors. `HTTPError`, `NetworkError`, `TimeoutError`, and `ForceRetryError` extend this class.
@@ -2355,7 +2390,7 @@ var Doc = class {
 };
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/versions.js
-const version = {
+const version$1 = {
 	major: 4,
 	minor: 4,
 	patch: 3
@@ -2367,7 +2402,7 @@ const $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
 	inst ?? (inst = {});
 	inst._zod.def = def;
 	inst._zod.bag = inst._zod.bag || {};
-	inst._zod.version = version;
+	inst._zod.version = version$1;
 	const checks = [...inst._zod.def.checks ?? []];
 	if (inst._zod.traits.has("$ZodCheck")) checks.unshift(inst);
 	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);
@@ -12719,8 +12754,679 @@ const authVerifications = pgTable("verification", {
 	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
 }, (table) => [index("verification_identifier_idx").on(table.identifier)]);
+new TextEncoder();
+const base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const base64Lookup = new Uint8Array(256);
+for (let i = 0; i < 64; i++) base64Lookup[base64Chars.charCodeAt(i)] = i;
+function getDecoder(charset) {
+	charset = charset || "utf8";
+	let decoder;
+	try {
+		decoder = new TextDecoder(charset);
+	} catch (err) {
+		decoder = new TextDecoder("windows-1252");
+	}
+	return decoder;
+}
+getDecoder();
+//#endregion
+//#region ../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/timing_safe_equal.js
+var require_timing_safe_equal = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.timingSafeEqual = void 0;
+	function assert(expr, msg = "") {
+		if (!expr) throw new Error(msg);
+	}
+	function timingSafeEqual(a, b) {
+		if (a.byteLength !== b.byteLength) return false;
+		if (!(a instanceof DataView)) a = new DataView(ArrayBuffer.isView(a) ? a.buffer : a);
+		if (!(b instanceof DataView)) b = new DataView(ArrayBuffer.isView(b) ? b.buffer : b);
+		assert(a instanceof DataView);
+		assert(b instanceof DataView);
+		const length = a.byteLength;
+		let out = 0;
+		let i = -1;
+		while (++i < length) out |= a.getUint8(i) ^ b.getUint8(i);
+		return out === 0;
+	}
+	exports.timingSafeEqual = timingSafeEqual;
+}));
 //#endregion
-//#region ../../packages/auth/dist/server-DP_LlS2f.mjs
+//#region ../../node_modules/.pnpm/@stablelib+base64@1.0.1/node_modules/@stablelib/base64/lib/base64.js
+var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var __extends = exports && exports.__extends || (function() {
+		var extendStatics = function(d, b) {
+			extendStatics = Object.setPrototypeOf || { __proto__: [] } instanceof Array && function(d, b) {
+				d.__proto__ = b;
+			} || function(d, b) {
+				for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p];
+			};
+			return extendStatics(d, b);
+		};
+		return function(d, b) {
+			extendStatics(d, b);
+			function __() {
+				this.constructor = d;
+			}
+			d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+		};
+	})();
+	Object.defineProperty(exports, "__esModule", { value: true });
+	/**
+	* Package base64 implements Base64 encoding and decoding.
+	*/
+	var INVALID_BYTE = 256;
+	/**
+	* Implements standard Base64 encoding.
+	*
+	* Operates in constant time.
+	*/
+	var Coder = function() {
+		function Coder(_paddingCharacter) {
+			if (_paddingCharacter === void 0) _paddingCharacter = "=";
+			this._paddingCharacter = _paddingCharacter;
+		}
+		Coder.prototype.encodedLength = function(length) {
+			if (!this._paddingCharacter) return (length * 8 + 5) / 6 | 0;
+			return (length + 2) / 3 * 4 | 0;
+		};
+		Coder.prototype.encode = function(data) {
+			var out = "";
+			var i = 0;
+			for (; i < data.length - 2; i += 3) {
+				var c = data[i] << 16 | data[i + 1] << 8 | data[i + 2];
+				out += this._encodeByte(c >>> 18 & 63);
+				out += this._encodeByte(c >>> 12 & 63);
+				out += this._encodeByte(c >>> 6 & 63);
+				out += this._encodeByte(c >>> 0 & 63);
+			}
+			var left = data.length - i;
+			if (left > 0) {
+				var c = data[i] << 16 | (left === 2 ? data[i + 1] << 8 : 0);
+				out += this._encodeByte(c >>> 18 & 63);
+				out += this._encodeByte(c >>> 12 & 63);
+				if (left === 2) out += this._encodeByte(c >>> 6 & 63);
+				else out += this._paddingCharacter || "";
+				out += this._paddingCharacter || "";
+			}
+			return out;
+		};
+		Coder.prototype.maxDecodedLength = function(length) {
+			if (!this._paddingCharacter) return (length * 6 + 7) / 8 | 0;
+			return length / 4 * 3 | 0;
+		};
+		Coder.prototype.decodedLength = function(s) {
+			return this.maxDecodedLength(s.length - this._getPaddingLength(s));
+		};
+		Coder.prototype.decode = function(s) {
+			if (s.length === 0) return new Uint8Array(0);
+			var paddingLength = this._getPaddingLength(s);
+			var length = s.length - paddingLength;
+			var out = new Uint8Array(this.maxDecodedLength(length));
+			var op = 0;
+			var i = 0;
+			var haveBad = 0;
+			var v0 = 0, v1 = 0, v2 = 0, v3 = 0;
+			for (; i < length - 4; i += 4) {
+				v0 = this._decodeChar(s.charCodeAt(i + 0));
+				v1 = this._decodeChar(s.charCodeAt(i + 1));
+				v2 = this._decodeChar(s.charCodeAt(i + 2));
+				v3 = this._decodeChar(s.charCodeAt(i + 3));
+				out[op++] = v0 << 2 | v1 >>> 4;
+				out[op++] = v1 << 4 | v2 >>> 2;
+				out[op++] = v2 << 6 | v3;
+				haveBad |= v0 & INVALID_BYTE;
+				haveBad |= v1 & INVALID_BYTE;
+				haveBad |= v2 & INVALID_BYTE;
+				haveBad |= v3 & INVALID_BYTE;
+			}
+			if (i < length - 1) {
+				v0 = this._decodeChar(s.charCodeAt(i));
+				v1 = this._decodeChar(s.charCodeAt(i + 1));
+				out[op++] = v0 << 2 | v1 >>> 4;
+				haveBad |= v0 & INVALID_BYTE;
+				haveBad |= v1 & INVALID_BYTE;
+			}
+			if (i < length - 2) {
+				v2 = this._decodeChar(s.charCodeAt(i + 2));
+				out[op++] = v1 << 4 | v2 >>> 2;
+				haveBad |= v2 & INVALID_BYTE;
+			}
+			if (i < length - 3) {
+				v3 = this._decodeChar(s.charCodeAt(i + 3));
+				out[op++] = v2 << 6 | v3;
+				haveBad |= v3 & INVALID_BYTE;
+			}
+			if (haveBad !== 0) throw new Error("Base64Coder: incorrect characters for decoding");
+			return out;
+		};
+		Coder.prototype._encodeByte = function(b) {
+			var result = b;
+			result += 65;
+			result += 25 - b >>> 8 & 6;
+			result += 51 - b >>> 8 & -75;
+			result += 61 - b >>> 8 & -15;
+			result += 62 - b >>> 8 & 3;
+			return String.fromCharCode(result);
+		};
+		Coder.prototype._decodeChar = function(c) {
+			var result = INVALID_BYTE;
+			result += (42 - c & c - 44) >>> 8 & -INVALID_BYTE + c - 43 + 62;
+			result += (46 - c & c - 48) >>> 8 & -INVALID_BYTE + c - 47 + 63;
+			result += (47 - c & c - 58) >>> 8 & -INVALID_BYTE + c - 48 + 52;
+			result += (64 - c & c - 91) >>> 8 & -INVALID_BYTE + c - 65 + 0;
+			result += (96 - c & c - 123) >>> 8 & -INVALID_BYTE + c - 97 + 26;
+			return result;
+		};
+		Coder.prototype._getPaddingLength = function(s) {
+			var paddingLength = 0;
+			if (this._paddingCharacter) {
+				for (var i = s.length - 1; i >= 0; i--) {
+					if (s[i] !== this._paddingCharacter) break;
+					paddingLength++;
+				}
+				if (s.length < 4 || paddingLength > 2) throw new Error("Base64Coder: incorrect padding");
+			}
+			return paddingLength;
+		};
+		return Coder;
+	}();
+	exports.Coder = Coder;
+	var stdCoder = new Coder();
+	function encode(data) {
+		return stdCoder.encode(data);
+	}
+	exports.encode = encode;
+	function decode(s) {
+		return stdCoder.decode(s);
+	}
+	exports.decode = decode;
+	/**
+	* Implements URL-safe Base64 encoding.
+	* (Same as Base64, but '+' is replaced with '-', and '/' with '_').
+	*
+	* Operates in constant time.
+	*/
+	var URLSafeCoder = function(_super) {
+		__extends(URLSafeCoder, _super);
+		function URLSafeCoder() {
+			return _super !== null && _super.apply(this, arguments) || this;
+		}
+		URLSafeCoder.prototype._encodeByte = function(b) {
+			var result = b;
+			result += 65;
+			result += 25 - b >>> 8 & 6;
+			result += 51 - b >>> 8 & -75;
+			result += 61 - b >>> 8 & -13;
+			result += 62 - b >>> 8 & 49;
+			return String.fromCharCode(result);
+		};
+		URLSafeCoder.prototype._decodeChar = function(c) {
+			var result = INVALID_BYTE;
+			result += (44 - c & c - 46) >>> 8 & -INVALID_BYTE + c - 45 + 62;
+			result += (94 - c & c - 96) >>> 8 & -INVALID_BYTE + c - 95 + 63;
+			result += (47 - c & c - 58) >>> 8 & -INVALID_BYTE + c - 48 + 52;
+			result += (64 - c & c - 91) >>> 8 & -INVALID_BYTE + c - 65 + 0;
+			result += (96 - c & c - 123) >>> 8 & -INVALID_BYTE + c - 97 + 26;
+			return result;
+		};
+		return URLSafeCoder;
+	}(Coder);
+	exports.URLSafeCoder = URLSafeCoder;
+	var urlSafeCoder = new URLSafeCoder();
+	function encodeURLSafe(data) {
+		return urlSafeCoder.encode(data);
+	}
+	exports.encodeURLSafe = encodeURLSafe;
+	function decodeURLSafe(s) {
+		return urlSafeCoder.decode(s);
+	}
+	exports.decodeURLSafe = decodeURLSafe;
+	exports.encodedLength = function(length) {
+		return stdCoder.encodedLength(length);
+	};
+	exports.maxDecodedLength = function(length) {
+		return stdCoder.maxDecodedLength(length);
+	};
+	exports.decodedLength = function(s) {
+		return stdCoder.decodedLength(s);
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/fast-sha256@1.3.0/node_modules/fast-sha256/sha256.js
+var require_sha256 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	(function(root, factory) {
+		var exports$1 = {};
+		factory(exports$1);
+		var sha256 = exports$1["default"];
+		for (var k in exports$1) sha256[k] = exports$1[k];
+		if (typeof module === "object" && typeof module.exports === "object") module.exports = sha256;
+		else if (typeof define === "function" && define.amd) define(function() {
+			return sha256;
+		});
+		else root.sha256 = sha256;
+	})(exports, function(exports$2) {
+		"use strict";
+		exports$2.__esModule = true;
+		exports$2.digestLength = 32;
+		exports$2.blockSize = 64;
+		var K = new Uint32Array([
+			1116352408,
+			1899447441,
+			3049323471,
+			3921009573,
+			961987163,
+			1508970993,
+			2453635748,
+			2870763221,
+			3624381080,
+			310598401,
+			607225278,
+			1426881987,
+			1925078388,
+			2162078206,
+			2614888103,
+			3248222580,
+			3835390401,
+			4022224774,
+			264347078,
+			604807628,
+			770255983,
+			1249150122,
+			1555081692,
+			1996064986,
+			2554220882,
+			2821834349,
+			2952996808,
+			3210313671,
+			3336571891,
+			3584528711,
+			113926993,
+			338241895,
+			666307205,
+			773529912,
+			1294757372,
+			1396182291,
+			1695183700,
+			1986661051,
+			2177026350,
+			2456956037,
+			2730485921,
+			2820302411,
+			3259730800,
+			3345764771,
+			3516065817,
+			3600352804,
+			4094571909,
+			275423344,
+			430227734,
+			506948616,
+			659060556,
+			883997877,
+			958139571,
+			1322822218,
+			1537002063,
+			1747873779,
+			1955562222,
+			2024104815,
+			2227730452,
+			2361852424,
+			2428436474,
+			2756734187,
+			3204031479,
+			3329325298
+		]);
+		function hashBlocks(w, v, p, pos, len) {
+			var a, b, c, d, e, f, g, h, u, i, j, t1, t2;
+			while (len >= 64) {
+				a = v[0];
+				b = v[1];
+				c = v[2];
+				d = v[3];
+				e = v[4];
+				f = v[5];
+				g = v[6];
+				h = v[7];
+				for (i = 0; i < 16; i++) {
+					j = pos + i * 4;
+					w[i] = (p[j] & 255) << 24 | (p[j + 1] & 255) << 16 | (p[j + 2] & 255) << 8 | p[j + 3] & 255;
+				}
+				for (i = 16; i < 64; i++) {
+					u = w[i - 2];
+					t1 = (u >>> 17 | u << 15) ^ (u >>> 19 | u << 13) ^ u >>> 10;
+					u = w[i - 15];
+					t2 = (u >>> 7 | u << 25) ^ (u >>> 18 | u << 14) ^ u >>> 3;
+					w[i] = (t1 + w[i - 7] | 0) + (t2 + w[i - 16] | 0);
+				}
+				for (i = 0; i < 64; i++) {
+					t1 = (((e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7)) + (e & f ^ ~e & g) | 0) + (h + (K[i] + w[i] | 0) | 0) | 0;
+					t2 = ((a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10)) + (a & b ^ a & c ^ b & c) | 0;
+					h = g;
+					g = f;
+					f = e;
+					e = d + t1 | 0;
+					d = c;
+					c = b;
+					b = a;
+					a = t1 + t2 | 0;
+				}
+				v[0] += a;
+				v[1] += b;
+				v[2] += c;
+				v[3] += d;
+				v[4] += e;
+				v[5] += f;
+				v[6] += g;
+				v[7] += h;
+				pos += 64;
+				len -= 64;
+			}
+			return pos;
+		}
+		var Hash = function() {
+			function Hash() {
+				this.digestLength = exports$2.digestLength;
+				this.blockSize = exports$2.blockSize;
+				this.state = new Int32Array(8);
+				this.temp = new Int32Array(64);
+				this.buffer = new Uint8Array(128);
+				this.bufferLength = 0;
+				this.bytesHashed = 0;
+				this.finished = false;
+				this.reset();
+			}
+			Hash.prototype.reset = function() {
+				this.state[0] = 1779033703;
+				this.state[1] = 3144134277;
+				this.state[2] = 1013904242;
+				this.state[3] = 2773480762;
+				this.state[4] = 1359893119;
+				this.state[5] = 2600822924;
+				this.state[6] = 528734635;
+				this.state[7] = 1541459225;
+				this.bufferLength = 0;
+				this.bytesHashed = 0;
+				this.finished = false;
+				return this;
+			};
+			Hash.prototype.clean = function() {
+				for (var i = 0; i < this.buffer.length; i++) this.buffer[i] = 0;
+				for (var i = 0; i < this.temp.length; i++) this.temp[i] = 0;
+				this.reset();
+			};
+			Hash.prototype.update = function(data, dataLength) {
+				if (dataLength === void 0) dataLength = data.length;
+				if (this.finished) throw new Error("SHA256: can't update because hash was finished.");
+				var dataPos = 0;
+				this.bytesHashed += dataLength;
+				if (this.bufferLength > 0) {
+					while (this.bufferLength < 64 && dataLength > 0) {
+						this.buffer[this.bufferLength++] = data[dataPos++];
+						dataLength--;
+					}
+					if (this.bufferLength === 64) {
+						hashBlocks(this.temp, this.state, this.buffer, 0, 64);
+						this.bufferLength = 0;
+					}
+				}
+				if (dataLength >= 64) {
+					dataPos = hashBlocks(this.temp, this.state, data, dataPos, dataLength);
+					dataLength %= 64;
+				}
+				while (dataLength > 0) {
+					this.buffer[this.bufferLength++] = data[dataPos++];
+					dataLength--;
+				}
+				return this;
+			};
+			Hash.prototype.finish = function(out) {
+				if (!this.finished) {
+					var bytesHashed = this.bytesHashed;
+					var left = this.bufferLength;
+					var bitLenHi = bytesHashed / 536870912 | 0;
+					var bitLenLo = bytesHashed << 3;
+					var padLength = bytesHashed % 64 < 56 ? 64 : 128;
+					this.buffer[left] = 128;
+					for (var i = left + 1; i < padLength - 8; i++) this.buffer[i] = 0;
+					this.buffer[padLength - 8] = bitLenHi >>> 24 & 255;
+					this.buffer[padLength - 7] = bitLenHi >>> 16 & 255;
+					this.buffer[padLength - 6] = bitLenHi >>> 8 & 255;
+					this.buffer[padLength - 5] = bitLenHi >>> 0 & 255;
+					this.buffer[padLength - 4] = bitLenLo >>> 24 & 255;
+					this.buffer[padLength - 3] = bitLenLo >>> 16 & 255;
+					this.buffer[padLength - 2] = bitLenLo >>> 8 & 255;
+					this.buffer[padLength - 1] = bitLenLo >>> 0 & 255;
+					hashBlocks(this.temp, this.state, this.buffer, 0, padLength);
+					this.finished = true;
+				}
+				for (var i = 0; i < 8; i++) {
+					out[i * 4 + 0] = this.state[i] >>> 24 & 255;
+					out[i * 4 + 1] = this.state[i] >>> 16 & 255;
+					out[i * 4 + 2] = this.state[i] >>> 8 & 255;
+					out[i * 4 + 3] = this.state[i] >>> 0 & 255;
+				}
+				return this;
+			};
+			Hash.prototype.digest = function() {
+				var out = new Uint8Array(this.digestLength);
+				this.finish(out);
+				return out;
+			};
+			Hash.prototype._saveState = function(out) {
+				for (var i = 0; i < this.state.length; i++) out[i] = this.state[i];
+			};
+			Hash.prototype._restoreState = function(from, bytesHashed) {
+				for (var i = 0; i < this.state.length; i++) this.state[i] = from[i];
+				this.bytesHashed = bytesHashed;
+				this.finished = false;
+				this.bufferLength = 0;
+			};
+			return Hash;
+		}();
+		exports$2.Hash = Hash;
+		var HMAC = function() {
+			function HMAC(key) {
+				this.inner = new Hash();
+				this.outer = new Hash();
+				this.blockSize = this.inner.blockSize;
+				this.digestLength = this.inner.digestLength;
+				var pad = new Uint8Array(this.blockSize);
+				if (key.length > this.blockSize) new Hash().update(key).finish(pad).clean();
+				else for (var i = 0; i < key.length; i++) pad[i] = key[i];
+				for (var i = 0; i < pad.length; i++) pad[i] ^= 54;
+				this.inner.update(pad);
+				for (var i = 0; i < pad.length; i++) pad[i] ^= 106;
+				this.outer.update(pad);
+				this.istate = new Uint32Array(8);
+				this.ostate = new Uint32Array(8);
+				this.inner._saveState(this.istate);
+				this.outer._saveState(this.ostate);
+				for (var i = 0; i < pad.length; i++) pad[i] = 0;
+			}
+			HMAC.prototype.reset = function() {
+				this.inner._restoreState(this.istate, this.inner.blockSize);
+				this.outer._restoreState(this.ostate, this.outer.blockSize);
+				return this;
+			};
+			HMAC.prototype.clean = function() {
+				for (var i = 0; i < this.istate.length; i++) this.ostate[i] = this.istate[i] = 0;
+				this.inner.clean();
+				this.outer.clean();
+			};
+			HMAC.prototype.update = function(data) {
+				this.inner.update(data);
+				return this;
+			};
+			HMAC.prototype.finish = function(out) {
+				if (this.outer.finished) this.outer.finish(out);
+				else {
+					this.inner.finish(out);
+					this.outer.update(out, this.digestLength).finish(out);
+				}
+				return this;
+			};
+			HMAC.prototype.digest = function() {
+				var out = new Uint8Array(this.digestLength);
+				this.finish(out);
+				return out;
+			};
+			return HMAC;
+		}();
+		exports$2.HMAC = HMAC;
+		function hash(data) {
+			var h = new Hash().update(data);
+			var digest = h.digest();
+			h.clean();
+			return digest;
+		}
+		exports$2.hash = hash;
+		exports$2["default"] = hash;
+		function hmac(key, data) {
+			var h = new HMAC(key).update(data);
+			var digest = h.digest();
+			h.clean();
+			return digest;
+		}
+		exports$2.hmac = hmac;
+		function fillBuffer(buffer, hmac, info, counter) {
+			var num = counter[0];
+			if (num === 0) throw new Error("hkdf: cannot expand more");
+			hmac.reset();
+			if (num > 1) hmac.update(buffer);
+			if (info) hmac.update(info);
+			hmac.update(counter);
+			hmac.finish(buffer);
+			counter[0]++;
+		}
+		var hkdfSalt = new Uint8Array(exports$2.digestLength);
+		function hkdf(key, salt, info, length) {
+			if (salt === void 0) salt = hkdfSalt;
+			if (length === void 0) length = 32;
+			var counter = new Uint8Array([1]);
+			var hmac_ = new HMAC(hmac(salt, key));
+			var buffer = new Uint8Array(hmac_.digestLength);
+			var bufpos = buffer.length;
+			var out = new Uint8Array(length);
+			for (var i = 0; i < length; i++) {
+				if (bufpos === buffer.length) {
+					fillBuffer(buffer, hmac_, info, counter);
+					bufpos = 0;
+				}
+				out[i] = buffer[bufpos++];
+			}
+			hmac_.clean();
+			buffer.fill(0);
+			counter.fill(0);
+			return out;
+		}
+		exports$2.hkdf = hkdf;
+		function pbkdf2(password, salt, iterations, dkLen) {
+			var prf = new HMAC(password);
+			var len = prf.digestLength;
+			var ctr = new Uint8Array(4);
+			var t = new Uint8Array(len);
+			var u = new Uint8Array(len);
+			var dk = new Uint8Array(dkLen);
+			for (var i = 0; i * len < dkLen; i++) {
+				var c = i + 1;
+				ctr[0] = c >>> 24 & 255;
+				ctr[1] = c >>> 16 & 255;
+				ctr[2] = c >>> 8 & 255;
+				ctr[3] = c >>> 0 & 255;
+				prf.reset();
+				prf.update(salt);
+				prf.update(ctr);
+				prf.finish(u);
+				for (var j = 0; j < len; j++) t[j] = u[j];
+				for (var j = 2; j <= iterations; j++) {
+					prf.reset();
+					prf.update(u).finish(u);
+					for (var k = 0; k < len; k++) t[k] ^= u[k];
+				}
+				for (var j = 0; j < len && i * len + j < dkLen; j++) dk[i * len + j] = t[j];
+			}
+			for (var i = 0; i < len; i++) t[i] = u[i] = 0;
+			for (var i = 0; i < 4; i++) ctr[i] = 0;
+			prf.clean();
+			return dk;
+		}
+		exports$2.pbkdf2 = pbkdf2;
+	});
+}));
+(/* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.Webhook = exports.WebhookVerificationError = void 0;
+	const timing_safe_equal_1 = require_timing_safe_equal();
+	const base64 = require_base64();
+	const sha256 = require_sha256();
+	const WEBHOOK_TOLERANCE_IN_SECONDS = 300;
+	var ExtendableError = class ExtendableError extends Error {
+		constructor(message) {
+			super(message);
+			Object.setPrototypeOf(this, ExtendableError.prototype);
+			this.name = "ExtendableError";
+			this.stack = new Error(message).stack;
+		}
+	};
+	var WebhookVerificationError = class WebhookVerificationError extends ExtendableError {
+		constructor(message) {
+			super(message);
+			Object.setPrototypeOf(this, WebhookVerificationError.prototype);
+			this.name = "WebhookVerificationError";
+		}
+	};
+	exports.WebhookVerificationError = WebhookVerificationError;
+	var Webhook = class Webhook {
+		constructor(secret, options) {
+			if (!secret) throw new Error("Secret can't be empty.");
+			if ((options === null || options === void 0 ? void 0 : options.format) === "raw") if (secret instanceof Uint8Array) this.key = secret;
+			else this.key = Uint8Array.from(secret, (c) => c.charCodeAt(0));
+			else {
+				if (typeof secret !== "string") throw new Error("Expected secret to be of type string");
+				if (secret.startsWith(Webhook.prefix)) secret = secret.substring(Webhook.prefix.length);
+				this.key = base64.decode(secret);
+			}
+		}
+		verify(payload, headers_) {
+			const headers = {};
+			for (const key of Object.keys(headers_)) headers[key.toLowerCase()] = headers_[key];
+			const msgId = headers["webhook-id"];
+			const msgSignature = headers["webhook-signature"];
+			const msgTimestamp = headers["webhook-timestamp"];
+			if (!msgSignature || !msgId || !msgTimestamp) throw new WebhookVerificationError("Missing required headers");
+			const timestamp = this.verifyTimestamp(msgTimestamp);
+			const expectedSignature = this.sign(msgId, timestamp, payload).split(",")[1];
+			const passedSignatures = msgSignature.split(" ");
+			const encoder = new globalThis.TextEncoder();
+			for (const versionedSignature of passedSignatures) {
+				const [version, signature] = versionedSignature.split(",");
+				if (version !== "v1") continue;
+				if ((0, timing_safe_equal_1.timingSafeEqual)(encoder.encode(signature), encoder.encode(expectedSignature))) return JSON.parse(payload.toString());
+			}
+			throw new WebhookVerificationError("No matching signature found");
+		}
+		sign(msgId, timestamp, payload) {
+			if (typeof payload === "string") {} else if (payload.constructor.name === "Buffer") payload = payload.toString();
+			else throw new Error("Expected payload to be of type string or Buffer.");
+			const encoder = new TextEncoder();
+			const timestampNumber = Math.floor(timestamp.getTime() / 1e3);
+			const toSign = encoder.encode(`${msgId}.${timestampNumber}.${payload}`);
+			return `v1,${base64.encode(sha256.hmac(this.key, toSign))}`;
+		}
+		verifyTimestamp(timestampHeader) {
+			const now = Math.floor(Date.now() / 1e3);
+			const timestamp = parseInt(timestampHeader, 10);
+			if (isNaN(timestamp)) throw new WebhookVerificationError("Invalid Signature Headers");
+			if (now - timestamp > WEBHOOK_TOLERANCE_IN_SECONDS) throw new WebhookVerificationError("Message timestamp too old");
+			if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) throw new WebhookVerificationError("Message timestamp too new");
+			return /* @__PURE__ */ new Date(timestamp * 1e3);
+		}
+	};
+	exports.Webhook = Webhook;
+	Webhook.prefix = "whsec_";
+})))();
+//#endregion
+//#region ../../packages/auth/dist/server-CHoi4Eug.mjs
 const CLI_CLIENT_ID = "keystroke-cli";
 //#endregion
 //#region ../../packages/auth/dist/cli.mjs
@@ -13209,7 +13915,7 @@ async function buildApp(options = {}) {
 			...options,
 			root
 		}));
-		const { emitRouteManifest } = await import("./emit-route-manifest-DRcNXHCP-CSOVo0UZ.mjs");
+		const { emitRouteManifest } = await import("./emit-route-manifest-DRcNXHCP-CuH5IaKl.mjs");
 		await emitRouteManifest(root);
 	} finally {
 		process.chdir(previous);
@@ -13222,7 +13928,7 @@ async function buildApp(options = {}) {
 * restart the API server in `onRebuild` so discovery picks up new/changed modules.
 */
 async function watchApp(options = {}) {
-	const { runWatchApp } = await import("./watch-app-DTIeKrbl-BdEadl4m.mjs");
+	const { runWatchApp } = await import("./watch-app-DTIeKrbl-C-BThJEO.mjs");
 	await runWatchApp(buildApp, options);
 }
 //#endregion
@@ -14156,6 +14862,6 @@ function runCli(argv) {
 //#region src/index.ts
 runCli(process.argv);
 //#endregion
-export { getTableUniqueName as $, _enum as $t, applyMixins as A, TriggerListResponseSchema as At, Param as B, WorkflowSubscriptionListResponseSchema as Bt, PgJsonb as C, url as Cn, PollRunRequestSchema as Ct, PgDate as D, $ZodError as Dn, QueuedAgentPromptResponseSchema as Dt, integer as E, toJSONSchema as En, PromptResponseSchema as Et, isConfig as F, UpsertGatewayAttachmentBodySchema as Ft, fillPlaceholders as G, parsePollRunRequest as Gt, SQL as H, credentialInputSchema as Ht, mapResultRow as I, UpsertWorkflowSubscriptionBodySchema as It, sql as J, parseWorkflowRunDetailInclude as Jt, isDriverValueEncoder as K, parsePromptInput as Kt, mapUpdateSet as L, WorkflowRunDetailResponseSchema as Lt, getTableColumns as M, TriggerRunListQuerySchema as Mt, getTableLikeName as N, TriggerRunListResponseSchema as Nt, PgDateString as O, prettifyError as On, SkipResponseSchema as Ot, haveSameKeys as P, UpdateCredentialInstanceBodySchema as Pt, getTableName as Q, ZodType as Qt, orderSelectedFields as R, WorkflowRunListQuerySchema as Rt, PgNumeric as S, unknown as Sn, GatewayAttachmentRecordSchema as St, PgJson as T, datetime as Tn, PromptInputSchema as Tt, StringChunk as U, normalizeCredentialList as Ut, Placeholder as V, WorkflowSubscriptionRecordSchema as Vt, View as W, parseAgentSessionDetailInclude as Wt, Schema as X, boolean$1 as Xt, Columns as Y, validationErrorResponse as Yt, Table as Z, number as Zt, PgTimestamp as _, optional as _n, CredentialInstanceListResponseSchema as _t, entryIdFromFile as a, boolean$2 as an, PgColumn as at, PgTime as b, string as bn, ErrorResponseSchema as bt, authSessions as c, discriminatedUnion as cn, Column as ct, users as d, lazy as dn, AgentListResponseSchema as dt, _function as en, ViewBaseConfig as et, index as f, literal as fn, AgentSessionDetailResponseSchema as ft, PgUUID as g, object as gn, CreateCredentialInstanceBodySchema as gt, pgTable as h, number$1 as hn, CREDENTIAL_SCOPE_LEVEL_TO_SCOPE_TYPE as ht, resolveSandboxRoot as i, array as in, pgEnum as it, getColumnNameAndConfig as j, TriggerRunDetailResponseSchema as jt, boolean as k, NEVER as kn, TriggerDetailResponseSchema as kt, authVerifications as l, int as ln, entityKind as lt, PgTable as m, nullable as mn, AgentSessionListResponseSchema as mt, ensureWorkspaceDir as n, _void as nn, Subquery as nt, authAccounts as o, custom as on, TableName as ot, uniqueIndex as p, looseObject as pn, AgentSessionListQuerySchema as pt, isSQLWrapper as q, parseTriggerRunDetailInclude as qt, materializeSandbox as r, any as rn, WithSubquery as rt, authDeviceCodes as s, date$1 as sn, ColumnBuilder as st, SandboxDefinitionSchema as t, _null as tn, tracer as tt, getDbFromContext as u, intersection as un, is as ut, PgTimestampString as v, preprocess as vn, CredentialInstanceRecordSchema as vt, jsonb as w, ZodError as wn, PollRunResponseSchema as wt, text as x, union as xn, GatewayAttachmentListResponseSchema as xt, timestamp as y, record as yn, DISCOVERY_CONVENTIONS as yt, textDecoder as z, WorkflowRunListResponseSchema as zt };
+export { getTableUniqueName as $, _enum as $t, applyMixins as A, __commonJSMin as An, TriggerListResponseSchema as At, Param as B, WorkflowSubscriptionListResponseSchema as Bt, PgJsonb as C, url as Cn, PollRunRequestSchema as Ct, PgDate as D, $ZodError as Dn, QueuedAgentPromptResponseSchema as Dt, integer as E, toJSONSchema as En, PromptResponseSchema as Et, isConfig as F, UpsertGatewayAttachmentBodySchema as Ft, fillPlaceholders as G, parsePollRunRequest as Gt, SQL as H, credentialInputSchema as Ht, mapResultRow as I, UpsertWorkflowSubscriptionBodySchema as It, sql as J, parseWorkflowRunDetailInclude as Jt, isDriverValueEncoder as K, parsePromptInput as Kt, mapUpdateSet as L, WorkflowRunDetailResponseSchema as Lt, getTableColumns as M, __exportAll as Mn, TriggerRunListQuerySchema as Mt, getTableLikeName as N, __require as Nn, TriggerRunListResponseSchema as Nt, PgDateString as O, prettifyError as On, SkipResponseSchema as Ot, haveSameKeys as P, __toESM as Pn, UpdateCredentialInstanceBodySchema as Pt, getTableName as Q, ZodType as Qt, orderSelectedFields as R, WorkflowRunListQuerySchema as Rt, PgNumeric as S, unknown as Sn, GatewayAttachmentRecordSchema as St, PgJson as T, datetime as Tn, PromptInputSchema as Tt, StringChunk as U, normalizeCredentialList as Ut, Placeholder as V, WorkflowSubscriptionRecordSchema as Vt, View as W, parseAgentSessionDetailInclude as Wt, Schema as X, boolean$1 as Xt, Columns as Y, validationErrorResponse as Yt, Table as Z, number as Zt, PgTimestamp as _, optional as _n, CredentialInstanceListResponseSchema as _t, entryIdFromFile as a, boolean$2 as an, PgColumn as at, PgTime as b, string as bn, ErrorResponseSchema as bt, authSessions as c, discriminatedUnion as cn, Column as ct, users as d, lazy as dn, AgentListResponseSchema as dt, _function as en, ViewBaseConfig as et, index as f, literal as fn, AgentSessionDetailResponseSchema as ft, PgUUID as g, object as gn, CreateCredentialInstanceBodySchema as gt, pgTable as h, number$1 as hn, CREDENTIAL_SCOPE_LEVEL_TO_SCOPE_TYPE as ht, resolveSandboxRoot as i, array as in, pgEnum as it, getColumnNameAndConfig as j, __esmMin as jn, TriggerRunDetailResponseSchema as jt, boolean as k, NEVER as kn, TriggerDetailResponseSchema as kt, authVerifications as l, int as ln, entityKind as lt, PgTable as m, nullable as mn, AgentSessionListResponseSchema as mt, ensureWorkspaceDir as n, _void as nn, Subquery as nt, authAccounts as o, custom as on, TableName as ot, uniqueIndex as p, looseObject as pn, AgentSessionListQuerySchema as pt, isSQLWrapper as q, parseTriggerRunDetailInclude as qt, materializeSandbox as r, any as rn, WithSubquery as rt, authDeviceCodes as s, date$1 as sn, ColumnBuilder as st, SandboxDefinitionSchema as t, _null as tn, tracer as tt, getDbFromContext as u, intersection as un, is as ut, PgTimestampString as v, preprocess as vn, CredentialInstanceRecordSchema as vt, jsonb as w, ZodError as wn, PollRunResponseSchema as wt, text as x, union as xn, GatewayAttachmentListResponseSchema as xt, timestamp as y, record as yn, DISCOVERY_CONVENTIONS as yt, textDecoder as z, WorkflowRunListResponseSchema as zt };
 
 //# sourceMappingURL=index.mjs.map