@keystrokehq/platform 0.1.69 → 0.1.71

package/dist/{dist-QdAztAh3.mjs → dist-vqdQgBVK.mjs}

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
-import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failAgentSession, failWorkflowRun, getProjectScopeId, getServerTenantScopeId, inferDialect, isDatabaseInitialized, listCredentialAssignmentsByTarget, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstancesByIds, selectCredentialInstancesForScope, selectCredentialInstancesForScopes, selectTriggerBySlug, setTriggerScheduleEnabled, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
+import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failAgentSession, failWorkflowRun, getProjectScopeId, getServerTenantScopeId, inferDialect, isDatabaseInitialized, listCredentialAssignmentsByTarget, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstancesByIds, selectCredentialInstancesForScope, selectCredentialInstancesForScopes, selectTriggerBySlug, setTriggerScheduleEnabled, triggerTimezoneFromConfig, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
 import EventEmitter$1, { EventEmitter } from "node:events";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -11910,7 +11910,7 @@ const PresignUserAvatarResponseSchema = z.object({
 	uploadUrl: z.url(),
 	storageKey: z.string().min(1)
 });
-function isValidIanaTimezone(value) {
+function isValidIanaTimezone$1(value) {
 	try {
 		Intl.DateTimeFormat(void 0, { timeZone: value });
 		return true;
@@ -11945,7 +11945,7 @@ const UserSidebarPreferencesSchema = z.object({
 	topNavItemOrderIds: z.array(z.string()),
 	workspaceNavItemOrderIds: z.array(z.string())
 });
-const UserTimezoneSchema = z.string().refine(isValidIanaTimezone, { message: "Invalid IANA timezone" });
+const UserTimezoneSchema = z.string().refine(isValidIanaTimezone$1, { message: "Invalid IANA timezone" });
 const UserPreferencesSchema = z.object({
 	interfaceTheme: UserInterfaceThemeSchema,
 	surfaceContrast: UserSurfaceContrastSchema,
@@ -12058,7 +12058,7 @@ function normalizeOnboardingTabVisible(value) {
 }
 function normalizeTimezone(value) {
 	if (value === null || value === void 0) return null;
-	if (typeof value !== "string" || value.length === 0 || !isValidIanaTimezone(value)) return null;
+	if (typeof value !== "string" || value.length === 0 || !isValidIanaTimezone$1(value)) return null;
 	return value;
 }
 function normalizeUserPreferences(value) {
@@ -31484,6 +31484,34 @@ async function discoverMcpApp(url) {
 		}
 	};
 }
+/**
+* Prefer CIMD (URL client_id) when the AS advertises support and we have an
+* HTTPS metadata URL; otherwise DCR. Localhost HTTP cannot be a CIMD client_id
+* (Notion and other ASes must fetch it), so local/dev without a tunnel falls
+* back to DCR when available.
+*
+* Spec order: pre-registered → CIMD → DCR → manual.
+*/
+async function resolveMcpOAuthClientInformation(options) {
+	const supportsCimd = options.metadata.client_id_metadata_document_supported === true;
+	if (supportsCimd && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
+		client_id: options.clientMetadataUrl,
+		token_endpoint_auth_method: "none"
+	};
+	if (options.metadata.registration_endpoint) return registerClient(options.authorizationServerUrl, {
+		metadata: options.metadata,
+		clientMetadata: {
+			client_name: "Keystroke",
+			redirect_uris: [options.redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "client_secret_post"
+		},
+		scope: options.scope
+	});
+	if (supportsCimd) throw new Error("Authorization server requires Client ID Metadata Documents, but Keystroke has no HTTPS client metadata URL configured (set PUBLIC_PLATFORM_URL or PUBLIC_PLATFORM_PROXY_URL to an HTTPS origin)");
+	throw new Error("MCP authorization server does not support Client ID Metadata Documents or Dynamic Client Registration");
+}
 async function beginMcpOAuthConnect(options) {
 	const appUrl = options.app.url?.trim();
 	if (!appUrl || options.app.source !== "mcp" || options.app.authKind !== "oauth") throw new Error("App is not a direct MCP OAuth app");
@@ -31501,16 +31529,12 @@ async function beginMcpOAuthConnect(options) {
 	};
 	const defaultScopeNames = options.app.oauthScopes.flatMap((entry) => entry.defaultSelected !== false ? [entry.name] : []);
 	const scope = options.input.scopes?.join(" ") || (defaultScopeNames.length > 0 ? defaultScopeNames.join(" ") : oauth.scopes.join(" "));
-	const clientInformation = await registerClient(discovered.authorizationServerUrl, {
+	const clientInformation = await resolveMcpOAuthClientInformation({
+		authorizationServerUrl: discovered.authorizationServerUrl,
 		metadata,
-		clientMetadata: {
-			client_name: "Keystroke",
-			redirect_uris: [options.redirectUri],
-			grant_types: ["authorization_code", "refresh_token"],
-			response_types: ["code"],
-			token_endpoint_auth_method: "client_secret_post"
-		},
-		scope: scope || void 0
+		redirectUri: options.redirectUri,
+		scope: scope || void 0,
+		clientMetadataUrl: options.clientMetadataUrl
 	});
 	await ensureOAuthApp({
 		slug: options.app.slug,
@@ -31769,19 +31793,36 @@ function isMinuteLevelCron(schedule) {
 function resolveCronSchedule(attachmentId, schedule, options) {
 	return options.attachmentScheduleOverrides?.[attachmentId] ?? options.cronScheduleOverride ?? schedule;
 }
-/** The next time the schedule fires at or after `from`. */
-function nextTriggerRunAt(schedule, from = /* @__PURE__ */ new Date()) {
-	return parseCronExpression(schedule, from).next().toDate();
+/**
+* Validates and brands an IANA timezone (e.g. `America/New_York`). Uses
+* `Intl.DateTimeFormat` so we don't need a timezone database dependency.
+*/
+const timezoneSchema = z.string().trim().min(1, "timezone must be a non-empty IANA timezone").refine(isValidIanaTimezone, "must be a valid IANA timezone").brand();
+function isValidIanaTimezone(value) {
+	try {
+		new Intl.DateTimeFormat("en-US", { timeZone: value });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* The next time the schedule fires at or after `from`.
+*
+* Cron fields are wall-clock times in `timezone` (default UTC). Absolute
+* instants are computed here — do not convert the cron string to UTC at write time.
+*/
+function nextTriggerRunAt(schedule, from = /* @__PURE__ */ new Date(), timezone = "UTC") {
+	return parseCronExpression(schedule, from, timezone).next().toDate();
 }
-const UTC = "UTC";
 /**
 * Single touchpoint for the `cron-parser` library — every parse, validation,
 * and next-run calculation in this package goes through here.
 */
-function parseCronExpression(schedule, currentDate) {
+function parseCronExpression(schedule, currentDate, timezone = "UTC") {
 	return import_dist.CronExpressionParser.parse(schedule, {
 		currentDate: currentDate ?? /* @__PURE__ */ new Date(),
-		tz: UTC
+		tz: timezone
 	});
 }
 function isParseableCron(value) {
@@ -31836,6 +31877,7 @@ const cronSourceSchema = z.object({
 	kind: z.literal("cron"),
 	...baseSourceShape,
 	schedule: cronScheduleSchema,
+	timezone: timezoneSchema.optional(),
 	payload: cronPayloadSchema.optional()
 });
 const pollSourceSchema = z.object({
@@ -31843,6 +31885,7 @@ const pollSourceSchema = z.object({
 	...baseSourceShape,
 	id: z.string().optional(),
 	schedule: pollScheduleSchema,
+	timezone: timezoneSchema.optional(),
 	run: z.function(),
 	stateSchema: zodSchema.optional(),
 	filters: z.array(z.function()),
@@ -36237,7 +36280,7 @@ function createScheduleTicker(ctx) {
 	const pollIntervalMs = ctx.pollIntervalMs ?? 1e3;
 	const batchSize = ctx.batchSize ?? 10;
 	async function fireDueSchedules(asOf = /* @__PURE__ */ new Date()) {
-		const claimed = await claimDue(ctx.scope ?? "project", asOf, (schedule) => nextTriggerRunAt(schedule, asOf), batchSize);
+		const claimed = await claimDue(ctx.scope ?? "project", asOf, (schedule, timezone) => nextTriggerRunAt(schedule, asOf, timezone), batchSize);
 		for (const row of claimed) {
 			if (row.kind !== "cron" && row.kind !== "poll") continue;
 			await enqueueTriggerJob(ctx.jobQueue, {
@@ -36256,7 +36299,7 @@ function createScheduleTicker(ctx) {
 		const loop = async () => {
 			while (running) {
 				try {
-					const claimed = await claimDue(scope, /* @__PURE__ */ new Date(), (schedule) => nextTriggerRunAt(schedule, /* @__PURE__ */ new Date()), limit);
+					const claimed = await claimDue(scope, /* @__PURE__ */ new Date(), (schedule, timezone) => nextTriggerRunAt(schedule, /* @__PURE__ */ new Date(), timezone), limit);
 					for (const row of claimed) {
 						if (row.kind !== "cron" && row.kind !== "poll") continue;
 						await enqueueTriggerJob(ctx.jobQueue, {
@@ -36302,7 +36345,8 @@ async function syncTriggerSchedules(options) {
 		const schedule = resolveTriggerSchedule(spec.triggerSlug, spec.schedule, options.scheduleOverrides);
 		const existing = await selectTriggerBySlug(spec.triggerSlug);
 		if (!existing) continue;
-		const nextRunAt = !(existing.schedule !== schedule) && existing.enabled === 1 ? existing.nextRunAt : nextTriggerRunAt(schedule, now);
+		const existingTimezone = triggerTimezoneFromConfig(existing.config);
+		const nextRunAt = !(existing.schedule !== schedule || existingTimezone !== spec.timezone) && existing.enabled === 1 ? existing.nextRunAt : nextTriggerRunAt(schedule, now, spec.timezone);
 		const enabled = (await listExecutableAttachmentsByTriggerIds([existing.id])).length > 0;
 		await upsertTriggerScheduleFields({
 			triggerSlug: spec.triggerSlug,
@@ -36491,10 +36535,12 @@ function triggerJobData(spec) {
 function rowToSpec(row) {
 	if (row.kind !== "cron" && row.kind !== "poll") return;
 	if (!row.schedule) return;
+	const timezone = triggerTimezoneFromConfig(row.config ?? null);
 	return {
 		triggerSlug: row.slug,
 		kind: row.kind,
 		schedule: row.schedule,
+		...timezone ? { timezone } : {},
 		projectId: row.projectId
 	};
 }
@@ -36515,7 +36561,10 @@ function createPgBossTriggerScheduler(_ctx, queue) {
 		await queue.boss.schedule(queue.queueName, schedule, triggerJobData({
 			...spec,
 			schedule
-		}), { key });
+		}), {
+			key,
+			...spec.timezone ? { tz: spec.timezone } : {}
+		});
 	}
 	async function reconcileFromDatabase(overrides) {
 		const projectPrefix = pgBossTriggerScheduleKeyPrefix();
@@ -37085,4 +37134,4 @@ function minioStoragePlugin(options = {}) {
 //#endregion
 export { CreateCredentialsRequestSchema as $, WorkflowCanvasCredentialBindingsSchema as $n, OpenApiDiscoverResponseSchema as $t, discoverMcpApp as A, SubmitMarketingContactResponseSchema as An, mapUserOrganization as Ar, InviteProjectMembersResponseSchema as At, ActiveOrganizationResponseSchema as B, UpdateOrganizationMemberRequestSchema as Bn, validateCredentialValueAgainstFields as Br, ListOrganizationMembersPageQuerySchema as Bt, defaultSchedulerPlugin as C, SkillSummarySchema as Cn, mapOrganizationInvitation as Cr, HistoryRunCancelResponseSchema as Ct, decodeOAuthState as D, StartMcpOAuthConnectionResultSchema as Dn, mapProjectDeployment as Dr, InviteOrganizationMembersRequestSchema as Dt, completeMcpOAuthConnect as E, StartMcpOAuthConnectionInputSchema as En, mapProjectArtifact as Er, HistoryRunListResponseSchema as Et, deleteManagedServiceCredential$1 as F, TriggerInvokeRequestSchema as Fn, parseAppSlug as Fr, ListChannelPlatformsResponseSchema as Ft, AgentWorkspaceFileSummarySchema as G, UpdateProjectRequestSchema as Gn, __toESM as Gr, ListProjectMembersResponseSchema as Gt, AgentSummaryDetailResponseSchema as H, UpdateOrganizationRequestSchema as Hn, validationErrorResponse as Hr, ListOrganizationsResponseSchema as Ht, setCredentialInstanceSecret as I, TriggerInvokeResponseSchema as In, parseStoredRouteManifest as Ir, ListCredentialsPageQuerySchema as It, ChannelPlatformSchema as J, UploadProjectSourceResponseSchema as Jn, ManagedServiceCredentialSchema as Jt, AppSlugAvailabilityQuerySchema as K, UpdateProjectSettingsRequestSchema as Kn, ListProjectMetricsResponseSchema as Kt, setManagedServiceCredential as L, TriggerRunListQuerySchema as Ln, projectFileId as Lr, ListCredentialsPageResponseSchema as Lt, withCredentialAssignments as M, SubmitTeamRequestResponseSchema as Mn, normalizeUserPreferences as Mr, ListAgentWorkspaceFilesResponseSchema as Mt, PublicHttpUrlError as N, TriggerAttachmentUpdateRequestSchema as Nn, organizationInvitationAcceptPath as Nr, ListApiKeysResponseSchema as Nt, describeCredentialBindings as O, StoredProjectSourceManifestSchema as On, mapProjectMember as Or, InviteOrganizationMembersResponseSchema as Ot, deleteCredentialInstanceSecret as P, TriggerInvokeInputsSchema as Pn, organizationSlugErrorCodeFromMessage as Pr, ListAppsResponseSchema as Pt, CreateApiKeyResponseSchema as Q, UserPreferencesSchema as Qn, OpenApiDiscoverRequestSchema as Qt, ACTIVE_ORG_HEADER as R, UpdateCredentialRequestSchema as Rn, resolveExternalPlatformOrigin as Rr, ListManagedServiceCredentialsResponseSchema as Rt, createJobQueue as S, SkillSummaryListResponseSchema as Sn, listenPortFromPublicUrl as Sr, GraphqlDiscoverResponseSchema as St, beginMcpOAuthConnect as T, SlugAvailabilityResponseSchema as Tn, mapProject as Tr, HistoryRunListQuerySchema as Tt, AgentSummaryListResponseSchema as U, UpdateProjectMemberRequestSchema as Un, __commonJSMin as Ur, ListProjectDeploymentsResponseSchema as Ut, AgentMemoryFileSummarySchema as V, UpdateOrganizationMemberResponseSchema as Vn, validateWorkflowRunInputValues as Vr, ListOrganizationMembersPageResponseSchema as Vt, AgentSummarySchema as W, UpdateProjectMemberResponseSchema as Wn, __require as Wr, ListProjectFilesResponseSchema as Wt, ConnectManagedServiceCredentialRequestSchema as X, UserAvatarSchema as Xn, McpDiscoverRequestSchema as Xt, CompleteProjectArtifactResponseSchema as Y, UserAvatarPatchSchema as Yn, ManagedServiceKindSchema as Yt, CreateApiKeyRequestSchema as Z, UserPreferencesPatchSchema as Zn, McpDiscoverResponseSchema as Zt, orgLogoStorageKey as _, ProjectSourceResourcesSchema as _n, deriveCredentialInstanceSlug as _r, ErrorResponseSchema as _t, extractRouteManifestFromArtifact as a, PresignChatAttachmentResponseSchema as an, WorkflowSummaryListResponseSchema as ar, CreateProjectArtifactResponseSchema as at, publicKeystrokeAssetsObjectUrl as b, RecentResourceSchema as bn, isLlmProviderSlug as br, GetCustomAppResponseSchema as bt, isKeystrokeAssetsOrgLogoPublicUrl as c, PresignProjectSourceRequestSchema as cn, WorkspaceTriggerFileSchema as cr, DEFAULT_CLOUD_PLATFORM_ORIGIN as ct, isStorageNotFoundError as d, PresignUserAvatarResponseSchema as dn, WorkspaceTriggerRunListResponseSchema as dr, DEFAULT_WORKFLOW_OVERVIEW_MODEL as dt, OrganizationSidebarBrandingPatchSchema as en, WorkflowCanvasRunSchema as er, CreateCredentialsResponseSchema as et, isUserAvatarStorageKey as f, ProjectReachabilityResponseSchema as fn, WorkspaceWorkflowOverviewSchema as fr, DbProxyMigrateRequestSchema as ft, minioStoragePlugin as g, ProjectSlugAvailabilityResponseSchema as gn, chatAttachmentExtension as gr, DownloadActiveProjectSourceResponseSchema as gt, loadProjectSourceFiles as h, ProjectSlugAvailabilityQuerySchema as hn, buildCredentialInstanceLabel as hr, DownloadActiveProjectArtifactResponseSchema as ht, ensureKeystrokeAssetsBucket as i, PresignChatAttachmentRequestSchema as in, WorkflowSummaryDetailResponseSchema as ir, CreateOrganizationResponseSchema as it, discoverOpenApiApp as j, SubmitTeamRequestRequestSchema as jn, mergeUserPreferences as jr, ListAgentMemoryFilesResponseSchema as jt, discoverGraphqlApp as k, SubmitMarketingContactRequestSchema as kn, mapProjectSettings as kr, InviteProjectMembersRequestSchema as kt, isOrgLogoStorageKey as l, PresignProjectSourceResponseSchema as ln, WorkspaceTriggerListResponseSchema as lr, DEFAULT_TRIGGER_OVERVIEW_MODEL as lt, keystrokeAssetsOrgLogoKeyFromPublicUrl as m, ProjectSettingsResponseSchema as mn, agentWorkspaceFileId as mr, DeclineOrganizationInvitationResponseSchema as mt, chatAttachmentStorageKey as n, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as nn, WorkflowRunInputsPutBodySchema as nr, CreateCustomAppResponseSchema as nt, isChatAttachmentStorageKey as o, PresignOrgLogoRequestSchema as on, WorkflowSummarySchema as or, CreateProjectRequestSchema as ot, keystrokeAssetsAvatarKeyFromPublicUrl as p, ProjectResponseSchema as pn, agentMemoryFileId as pr, DbProxyQueryRequestSchema as pt, AppSlugAvailabilityResponseSchema as q, UploadProjectSourceManifestRequestSchema as qn, ListProjectsResponseSchema as qt, createAssetsStorageClient as r, PROJECT_SLUG_TAKEN_MESSAGE as rn, WorkflowRunInputsSchema as rr, CreateOrganizationRequestSchema as rt, isKeystrokeAssetsAvatarPublicUrl as s, PresignOrgLogoResponseSchema as sn, WorkspaceTriggerDetailSchema as sr, CreateProjectResponseSchema as st, RouteManifestNotFoundError as t, OrganizationSidebarBrandingSchema as tn, WorkflowCanvasSchema as tr, CreateCustomAppRequestSchema as tt, isStorageBucketNotFoundError as u, PresignUserAvatarRequestSchema as un, WorkspaceTriggerOverviewSchema as ur, DEFAULT_WORKFLOW_CANVAS_MODEL as ut, projectArtifactKey as v, PublicModelsResponseSchema as vn, displayCredentialAppName as vr, GetAppCatalogEntryResponseSchema as vt, cronPayloadSchema as w, SlugAvailabilityQuerySchema as wn, mapOrganizationMember as wr, HistoryRunDetailResponseSchema as wt, userAvatarStorageKey as x, SkillSummaryDetailResponseSchema as xn, jsonSchemaToWorkflowInputSchema as xr, GraphqlDiscoverRequestSchema as xt, projectSourceBlobKey as y, RecentResourceListResponseSchema as yn, isAllowedChatAttachmentMediaType as yr, GetCredentialResponseSchema as yt, AcceptOrganizationInvitationResponseSchema as z, UpdateManagedServiceCredentialRequestSchema as zn, resolveUniqueCredentialInstanceLabel as zr, ListOrganizationInvitationsResponseSchema as zt };
 
-//# sourceMappingURL=dist-QdAztAh3.mjs.map
+//# sourceMappingURL=dist-vqdQgBVK.mjs.map