@keystrokehq/platform 0.0.136 → 0.0.137

package/dist/{start-pFr_c6SD.mjs → start-yehsjk2a.mjs}

@@ -1,6 +1,7 @@
 import { n as pingProjectTarget } from "./dist-CkPv4pkS.mjs";
 import { $t as mapProjectDeployment, A as CreateOrganizationRequestSchema, At as UpdateOrganizationMemberResponseSchema, C as AgentSummaryDetailResponseSchema, Ct as StoredProjectSourceManifestSchema, G as ListOrganizationsResponseSchema, Gt as WorkflowSummarySchema, H as InviteOrganizationMembersResponseSchema, J as ListProjectMetricsResponseSchema, Jt as listenPortFromPublicUrl, K as ListProjectDeploymentsResponseSchema, L as DeclineOrganizationInvitationResponseSchema, Lt as UserAvatarPatchSchema, M as CreateProjectArtifactResponseSchema, Mt as UpdateProjectRequestSchema, N as CreateProjectRequestSchema, Nt as UploadProjectSourceManifestRequestSchema, O as CompleteProjectArtifactResponseSchema, P as CreateProjectResponseSchema, Pt as UploadProjectSourceResponseSchema, Q as OrganizationSidebarBrandingSchema, Qt as mapProjectArtifact, R as ErrorResponseSchema, Rt as UserAvatarSchema, St as SlugAvailabilityResponseSchema, T as AgentSummarySchema, U as ListOrganizationInvitationsResponseSchema, Ut as WorkflowSummaryDetailResponseSchema, V as InviteOrganizationMembersRequestSchema, W as ListOrganizationMembersResponseSchema, Wt as WorkflowSummaryListResponseSchema, Xt as mapOrganizationMember, Y as ListProjectsResponseSchema, Yt as mapOrganizationInvitation, Z as OrganizationSidebarBrandingPatchSchema, Zt as mapProject, _ as ACTIVE_ORG_HEADER, _t as RecentResourceSchema, a as isKeystrokeAssetsAvatarPublicUrl, at as PresignProjectSourceResponseSchema, bt as SkillSummarySchema, c as isUserAvatarStorageKey, ct as ProjectReachabilityResponseSchema, dt as ProjectSlugAvailabilityResponseSchema, en as mapUserOrganization, et as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, f as orgLogoStorageKey, fn as validationErrorResponse, g as userAvatarStorageKey, gt as RecentResourceListResponseSchema, h as publicKeystrokeAssetsObjectUrl, i as ensureKeystrokeAssetsBucket, in as organizationSlugErrorCodeFromMessage, it as PresignProjectSourceRequestSchema, j as CreateOrganizationResponseSchema, jt as UpdateOrganizationRequestSchema, kt as UpdateOrganizationMemberRequestSchema, l as keystrokeAssetsAvatarKeyFromPublicUrl, ln as projectFileId, lt as ProjectResponseSchema, m as projectSourceBlobKey, nt as PresignOrgLogoRequestSchema, o as isKeystrokeAssetsOrgLogoPublicUrl, on as parseStoredRouteManifest, ot as PresignUserAvatarRequestSchema, p as projectArtifactKey, pt as PromptInputSchema, q as ListProjectFilesResponseSchema, rn as organizationInvitationAcceptPath, rt as PresignOrgLogoResponseSchema, s as isOrgLogoStorageKey, st as PresignUserAvatarResponseSchema, t as createAssetsStorageClient, tt as PROJECT_SLUG_TAKEN_MESSAGE, u as keystrokeAssetsOrgLogoKeyFromPublicUrl, ut as ProjectSlugAvailabilityQuerySchema, v as AcceptOrganizationInvitationResponseSchema, vt as SkillSummaryDetailResponseSchema, w as AgentSummaryListResponseSchema, xt as SlugAvailabilityQuerySchema, y as ActiveOrganizationResponseSchema, yt as SkillSummaryListResponseSchema } from "./dist-DQNiucMJ.mjs";
 import { $n as updateProjectArtifactSourceManifest, $t as ProjectSlugTakenError, A as webhookRouteFromEndpoint, An as runWithWorkspaceContext, Ar as authDeviceCodes, B as verifySlackSignature, Bn as selectProjectDeployments, Cn as organizationRowToSidebarBranding, Cr as selectAgentLastRunAtByIds, Ct as createOAuthTokenAdapterFromBackend, D as syncRegistryFromStoredManifest, Dn as resolveOrgDatabaseUrl, Dr as syncSkillRegistry, E as seedOAuthAppsFromEnvForOrganization, En as resolveNewOrganizationIdentity, Er as selectWorkflowLastRunAtBySlugs, F as createSlackGatewayIngress, Fn as selectOrganizationMembers, Fr as users, Gn as selectUserOrganizationMembership, Hn as selectProjectsByOrganizationId, I as isSlackMentionEventPayload, In as selectPendingInvitationsForUser, Jn as updateOrganizationName, Jt as OrganizationInvitationExpiredError, Kn as selectUserOrganizations, L as postSlackChannelMessage, Ln as selectProjectArtifactById, M as workflowRunsListHandler, Mn as selectActiveArtifactSourceManifestForProject, Mr as authSessions, N as buildSlackGatewaySetupUrl, Nn as selectLastDeploymentAtByProject, Nr as authVerifications, O as triggerRunDetailHandler, On as resolveProjectRuntimeDatabase, Or as touchResourceActivity, P as channelIdFromSlackEventPayload, Pn as selectOrganizationById, Pr as getDatabaseHandle, Qn as updateProjectArtifactManifest, Qt as OrganizationSlugTakenError, R as slackSignatureHeaders, Rn as selectProjectArtifactForProject, S as mountWorkflowCredentialRoutes, Sn as normalizeUserEmail, Sr as selectAgentBySlug, St as createLocalCredentialBackend, T as seedOAuthAppsFromEnvForAllOrganizations, Tn as removeOrganizationMember, Tr as selectProjectResourceCounts, Un as selectUserById, Vn as selectProjectForOrganization, Wn as selectUserByNormalizedEmail, Xn as updateOrganizationSlug, Xt as OrganizationInvitationNotFoundError, Yn as updateOrganizationSidebarBranding, Yt as OrganizationInvitationForbiddenError, Zn as updateProjectActive, Zt as OrganizationMemberNotFoundError, _n as insertProjectArtifact, _r as selectActiveSkillById, a as createAgentsListHandler, an as createOrgStorageClient, ar as getActiveOrgGatewayAttachmentByTeamAndChannel, at as configureSharedScheduler, b as mountCredentialInstanceRoutes, bn as listOAuthInstallationsByAppSlugAndExternalId, br as selectActiveWorkflowBySlug, c as createTriggerGetHandler, cn as declineInvitation, cr as listActiveAgents, ct as resolveSchedulerPluginFromEnv, d as enqueueWebhookIngress, dn as ensureProjectPgBossGrants, dr as listRecentResourceActivity, dt as prepareAgentSession, en as acceptInvitation, er as updateProjectFailed, f as enqueueWorkflowRunByKey, fn as ensureWebhookApiKeyForRoute, fr as runWithProjectDatabase, gn as initDatabase, gr as selectActiveAgentsByIds, h as findWorkflowManifestEntry, hn as getOAuthAppSigningSecretBySlugGlobal, hr as selectActiveAgentById, i as connectProvidersFromManifest, in as createOrgContainerPresign, ir as createPgConnection, j as workflowRunDetailHandler, jn as selectActiveArtifactManifestForProject, jr as authJwks, k as triggerRunsListHandler, kn as runWithOrganizationScope, kr as authAccounts, l as createTriggersListHandler, ln as deleteProjectForOrganization, lr as listActiveSkills, lt as startPgBoss, m as fetchStoredRouteManifest, mn as getGlobalOAuthAccessTokenByAppSlugAndExternalId, mr as runWithTenantScope, n as agentSessionsListHandler, nn as checkProjectSlugAvailability, nr as updateUserById, o as createCredentialMaterializeHandler, on as createOrganizationForUser, or as getOrCreateGatewayThreadSession, ot as createScheduler, p as extractWebhookRoutesFromManifest, pn as ensureWebhookApiKeys, pr as runWithProjectScope, qn as updateOrganizationMemberRole, qt as CannotModifyOwnerError, r as buildWebhookUrl, rn as completeProjectArtifact, rr as verifyWebhookApiKeyForRoute, s as createGatewayAttachmentHandlers, sn as createProjectForOrganization, sr as getProjectScopeId, st as getPgBoss, t as agentSessionDetailHandler, tn as checkOrganizationSlugAvailability, tr as updateProjectForOrganization, u as enqueueAgentPrompt, un as encryptCredentialPayload, ur as listActiveWorkflows, ut as matchWebhookPayload, v as listKnownIntegrationKeys, vn as inviteOrganizationMembers, vr as selectActiveSkillsByIds, w as resumeWorkflowHook, wn as promoteProjectArtifact, wr as selectEphemeralTriggerAttachments, wt as createOAuthTokenRefreshRegistry, x as mountProjectIntegrations, xn as listWebhookApiKeysForProject, xr as selectActiveWorkflowsByIds, y as loadWebhookAttachmentSchemasForRoute, yn as isOrganizationStorageBucketInUse, yr as selectActiveWorkflowById, z as teamIdFromSlackEventPayload, zn as selectProjectById } from "./dist-Bwp-8Ffx.mjs";
+import * as z$1 from "zod";
 import { ZodError, z } from "zod";
 import { serve } from "@hono/node-server";
 import { drizzleAdapter } from "@better-auth/drizzle-adapter";
@@ -8,9 +9,10 @@ import { betterAuth } from "better-auth";
 import { bearer } from "better-auth/plugins/bearer";
 import { deviceAuthorization } from "better-auth/plugins/device-authorization";
 import { jwt, lastLoginMethod } from "better-auth/plugins";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
 import { magicLink } from "better-auth/plugins/magic-link";
 import { Resend } from "resend";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 //#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -1295,6 +1297,78 @@ function createAuthDatabaseAdapter() {
 }
 //#endregion
 //#region ../../packages/auth/dist/index.mjs
+function normalizeUserCode(userCode) {
+	return userCode.replace(/-/g, "");
+}
+function createCliDeviceOrganizationPlugin() {
+	return {
+		id: "cli-device-organization",
+		endpoints: { attachOrganization: createAuthEndpoint("/device/attach-organization", {
+			method: "POST",
+			body: z$1.object({
+				userCode: z$1.string(),
+				organizationId: z$1.string()
+			}),
+			requireHeaders: true
+		}, async (ctx) => {
+			const session = await getSessionFromCtx(ctx);
+			if (!session) throw new APIError("UNAUTHORIZED", {
+				error: "unauthorized",
+				error_description: "Authentication required"
+			});
+			const organizationId = ctx.body.organizationId.trim();
+			if (!organizationId) throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Organization id is required"
+			});
+			if (!await selectUserOrganizationMembership(session.user.id, organizationId)) throw new APIError("FORBIDDEN", {
+				error: "access_denied",
+				error_description: "You are not a member of this organization"
+			});
+			const cleanUserCode = normalizeUserCode(ctx.body.userCode);
+			const deviceCodeRecord = await ctx.context.adapter.findOne({
+				model: "deviceCode",
+				where: [{
+					field: "userCode",
+					value: cleanUserCode
+				}]
+			});
+			if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Invalid device user code"
+			});
+			if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
+				error: "expired_token",
+				error_description: "Device user code has expired"
+			});
+			if (deviceCodeRecord.status !== "pending") throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Device authorization has already been processed"
+			});
+			if (deviceCodeRecord.clientId && deviceCodeRecord.clientId !== "keystroke-cli") throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Invalid device client"
+			});
+			if (!deviceCodeRecord.userId) throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Device authorization has not been claimed yet"
+			});
+			if (deviceCodeRecord.userId !== session.user.id) throw new APIError("FORBIDDEN", {
+				error: "access_denied",
+				error_description: "You are not authorized to update this device authorization"
+			});
+			await ctx.context.adapter.update({
+				model: "deviceCode",
+				where: [{
+					field: "id",
+					value: deviceCodeRecord.id
+				}],
+				update: { scope: organizationId }
+			});
+			return ctx.json({ success: true });
+		}) }
+	};
+}
 function envValue$1(name) {
 	return process.env[name]?.trim() || void 0;
 }
@@ -1430,6 +1504,7 @@ function createAuthInstance(options) {
 				interval: "1s",
 				schema: {}
 			}),
+			createCliDeviceOrganizationPlugin(),
 			bearer(),
 			jwt({ jwt: { definePayload: ({ user }) => ({
 				id: user.id,
@@ -3663,4 +3738,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { startPlatformServer as t };
 
-//# sourceMappingURL=start-pFr_c6SD.mjs.map
+//# sourceMappingURL=start-yehsjk2a.mjs.map