@keystrokehq/cli 0.1.182 → 0.1.184

package/dist/{dist-D14gxQto.mjs → dist-aGL2P8SI.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as __require, r as __toESM, t as __commonJSMin } from "./chunk-DiodbrVj.mjs";
-import { $a as number, Ba as ZodType, Ga as array, Ha as _function, Ja as discriminatedUnion, Ka as boolean$1, Mn as PROJECT_MANIFEST_REL_PATH, Qa as looseObject, Qt as ListBrainDocumentsQuerySchema, Ra as number$1, Ta as PublicModelsResponseSchema, Ua as _null, Va as _enum, Wa as any, Xa as lazy, Ya as intersection, Za as literal, _a as normalizeCredentialList, ao as union, co as datetime, eo as object, fr as PromptResponseSchema, g as BrainDocumentIdSchema, ga as getOpenApiJsonSchema, ha as credentialInputSchema, io as string, lo as safeParse$1, no as preprocess, nr as ProjectArtifactIndexSchema, oo as unknown, qa as custom, ra as parseStoredRouteManifest, ro as record, sa as zodToStoredJsonSchema, so as url, ta as parseProjectManifest, to as optional, uo as NEVER, va as requiredDisplayTextSchema, ya as DEFAULT_CLOUD_PLATFORM_ORIGIN, za as ZodIssueCode } from "./dist-TgqInfge.mjs";
+import { $a as number, Ba as ZodType, Ga as array, Ha as _function, Ja as discriminatedUnion, Ka as boolean$1, Mn as PROJECT_MANIFEST_REL_PATH, Qa as looseObject, Qt as ListBrainDocumentsQuerySchema, Ra as number$1, Ta as PublicModelsResponseSchema, Ua as _null, Va as _enum, Wa as any, Xa as lazy, Ya as intersection, Za as literal, _a as normalizeCredentialList, ao as union, co as datetime, eo as object, fr as PromptResponseSchema, g as BrainDocumentIdSchema, ga as getOpenApiJsonSchema, ha as credentialInputSchema, io as string, lo as safeParse$1, no as preprocess, nr as ProjectArtifactIndexSchema, oo as unknown, qa as custom, ra as parseStoredRouteManifest, ro as record, sa as zodToStoredJsonSchema, so as url, ta as parseProjectManifest, to as optional, uo as NEVER, va as requiredDisplayTextSchema, ya as DEFAULT_CLOUD_PLATFORM_ORIGIN, za as ZodIssueCode } from "./dist-BHaxjUlc.mjs";
 import "./chunk-4RUAZWKT-D60fyWAB.mjs";
 import "./chunk-SAI2SPQQ-CVRoDNs9.mjs";
 import "./chunk-WNH3HOQA-BCZUOjCJ.mjs";
@@ -15246,7 +15246,7 @@ var PrimaryKey = class {
 	}
 };
 //#endregion
-//#region ../../packages/platform-database/dist/mcp-oauth-BkKV9WA_.mjs
+//#region ../../packages/platform-database/dist/mcp-oauth-BRKArKbL.mjs
 const users = pgTable("users", {
 	id: text$1("id").primaryKey(),
 	name: text$1("name").notNull(),
@@ -15346,7 +15346,9 @@ const authJwksSqlite = sqliteTable("jwks", {
 const authSessions = pgTable("sessions", {
 	id: text$1("id").primaryKey(),
 	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
-	token: text$1("token").notNull().unique(),
+	token: text$1("token_hash").unique(),
+	tokenCiphertext: text$1("token_ciphertext"),
+	legacyToken: text$1("token").unique(),
 	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull(),
 	ipAddress: text$1("ip_address"),
@@ -15357,7 +15359,9 @@ const authSessions = pgTable("sessions", {
 const authSessionsSqlite = sqliteTable("sessions", {
 	id: text("id").primaryKey(),
 	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
-	token: text("token").notNull().unique(),
+	token: text("token_hash").unique(),
+	tokenCiphertext: text("token_ciphertext"),
+	legacyToken: text("token").unique(),
 	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
 	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull(),
 	ipAddress: text("ip_address"),
@@ -15395,10 +15399,9 @@ const authVerificationsSqlite = sqliteTable("verification", {
 * `oauthAccessToken`, `oauthConsent`) and by field name (the JS property keys
 * below); the physical table/column names are ours to choose.
 *
-* Note: access/refresh tokens are stored as opaque plaintext bearer strings
-* (the Better Auth mcp plugin looks them up directly and cannot hash them),
-* consistent with how the `sessions` table stores session tokens. They are
-* short-lived; rely on DB access controls + at-rest encryption.
+* Access and refresh tokens are HMAC-SHA-256 hashed by the auth adapter. The
+* plugin only looks them up, so their plaintext is returned once at issuance
+* and never needs to be recovered from the database.
 */
 const mcpOauthClient = pgTable("mcp_oauth_client", {
 	id: text$1("id").primaryKey(),
@@ -47736,4 +47739,4 @@ async function emitStoredRouteManifestForProject(projectRoot) {
 //#endregion
 export { withMcpReadClient as $, serializeRouteManifest as A, validatePollGroups as B, isModularManifestEmitCacheHit as C, stopBrowserUseSession as Ct, pollRouteFromSourceSlug as D, event as Dt, pollGroupRouteFromId as E, configureTelemetry as Et, triggerManifestAttachments as F, webhookManifestAttachmentSchemasFromBindings as G, validateTriggerAttachments as H, tryReadProjectManifest as I, workflowKeyForAttachment as J, webhookMatchSchemaForBindings as K, validateAttachmentTargets as L, sha256File as M, splitStoredRouteManifest as N, projectActionsFingerprint as O, flushTelemetry as Ot, toStoredRouteManifest as P, assertPublicHttpUrl as Q, validateImportedTriggerAttachment as R, integrationPackagesFingerprint as S, runAgentBrowser as St, pollGroupId as T, captureException as Tt, validateUniqueAttachmentSlugs as U, validateProjectModules as V, validateUniqueTriggerSourceSlugs as W, attachmentSlugFromRecord as X, workflowRouteFromKey as Y, PublicHttpUrlError as Z, emitStoredRouteManifestForProject as _, defaultBrowserProfilesRoot as _t, buildPollGroups as a, classifyCall as at, importTriggerAttachments as b, resolveBrowserContext as bt, collectAgentAppSlugs as c, locateWorkflow as ct, countAgentCredentials as d, entryIdFromFile as dt, artifactIndexFromModules as et, discoverAgentEntries as f, readKeystrokeIgnoreDirective as ft, discoverWorkflows as g, agentBrowserProfilePath as gt, discoverWorkflowEntries as h, walkTypeScriptFiles as ht, agentRouteFromKey as i, packDirFromDisk as it, sha256Bytes as j, schemaToJson as k, shutdownTelemetry as kt, collectAgentToolSlugs as l, discoverEntries as lt, discoverTriggerAttachments as m, validateUniqueModuleKeys as mt, agentKeyForAttachment as n, moduleBlobRefsFromModules as nt, buildStoredRouteManifestForProject as o, computeCallSiteIds as ot, discoverSkillManifestEntries as p, shouldSkipKeystrokeModuleFile as pt, webhookRouteFromEndpoint as q, agentManifestEntry as r, mapInParallelBatches as rt, buildStoredRouteManifestFromContext as s, diagnoseWorkflowSource as st, actionsCatalogFingerprint as t, collectArtifactModules as tt, contentHashForModule as u, discoverModuleFileEntries as ut, hashDirectoryContents as v, deleteBrowserUseProfile as vt, persistModularRouteManifest as w, alias as wt, importWorkflowDefinition as x, resolveBrowserProvider as xt, importAgentDefinition as y, openCloudBrowserLogin as yt, validateImportedWorkflowDefinition as z };
 
-//# sourceMappingURL=dist-D14gxQto.mjs.map
+//# sourceMappingURL=dist-aGL2P8SI.mjs.map