@mugwork/mug 0.1.0

package/dist/src/commands/deploy.js

@@ -0,0 +1,1052 @@
+import { checkCliVersion } from "../version-check.js";
+import { existsSync, readFileSync, readdirSync, writeFileSync, statSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as esbuild from "esbuild";
+import { readSecrets } from "./secret.js";
+import { getAccountToken } from "./login.js";
+import { syncLocalFiles, syncLocalDatabases, syncFrameworkFiles } from "./sync.js";
+import { migrateConfig } from "../connector-migration.js";
+import { generateMugIconSvg } from "../mug-icon.js";
+import { generateSlackManifest, generateManifestUrl, legacyToSlackJson } from "../slack-manifest.js";
+import { parseWorkflowSteps } from "../workflow-parser.js";
+import { exec } from "node:child_process";
+const DEPLOY_URL = "https://api.mug.work/deploy";
+const API_BASE = "https://api.mug.work";
+function resolveDir(cwd, newPath, oldPath) {
+    return existsSync(join(cwd, newPath)) ? join(cwd, newPath) : join(cwd, oldPath);
+}
+function detectNotifyChannels(cwd) {
+    const channels = new Set();
+    const srcDir = join(cwd, "src");
+    if (!existsSync(srcDir))
+        return channels;
+    function scanDir(dir) {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                scanDir(join(dir, entry.name));
+            }
+            else if (entry.name.endsWith(".ts") || entry.name.endsWith(".js")) {
+                const content = readFileSync(join(dir, entry.name), "utf-8");
+                if (content.includes("ctx.notify.sms(") || content.includes('notify.sms('))
+                    channels.add("sms");
+                if (content.includes("ctx.notify.email(") || content.includes('notify.email('))
+                    channels.add("email");
+            }
+        }
+    }
+    scanDir(srcDir);
+    try {
+        const mugJson = JSON.parse(readFileSync(join(cwd, "mug.json"), "utf-8"));
+        if (mugJson.sms || mugJson.notifications?.sms)
+            channels.add("sms");
+        if (mugJson.email || mugJson.notifications?.email)
+            channels.add("email");
+    }
+    catch { }
+    return channels;
+}
+function openBrowser(url) {
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    exec(`${cmd} "${url}"`);
+}
+async function ensureConsent(workspace, channel, token) {
+    const checkRes = await fetch(`${API_BASE}/api/consent/check?workspace=${workspace}&channel=${channel}`);
+    if (checkRes.ok) {
+        const { consented } = await checkRes.json();
+        if (consented)
+            return;
+    }
+    const createRes = await fetch(`${API_BASE}/api/consent`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ workspace, channel }),
+    });
+    if (!createRes.ok) {
+        console.error(`Failed to create ${channel} consent request.`);
+        process.exit(1);
+    }
+    const { id, status } = await createRes.json();
+    if (status === "completed")
+        return;
+    const url = `https://mug.work/consent/${channel}?id=${id}`;
+    console.log(`\n${channel.toUpperCase()} consent required for this workspace.`);
+    console.log(`Opening consent form: ${url}`);
+    openBrowser(url);
+    console.log("Waiting for consent...");
+    while (true) {
+        await new Promise((r) => setTimeout(r, 2000));
+        const pollRes = await fetch(`${API_BASE}/api/consent/${id}`);
+        if (pollRes.ok) {
+            const { status: s } = await pollRes.json();
+            if (s === "completed") {
+                console.log(`${channel.toUpperCase()} consent recorded.\n`);
+                return;
+            }
+        }
+    }
+}
+export async function deploy() {
+    checkCliVersion();
+    const cwd = process.cwd();
+    const mugJsonPath = join(cwd, "mug.json");
+    if (!existsSync(mugJsonPath)) {
+        console.error("No mug.json found. Run `mug init` first.");
+        process.exit(1);
+    }
+    const config = JSON.parse(readFileSync(mugJsonPath, "utf-8"));
+    const name = config.name;
+    const token = getAccountToken();
+    const frameworkUpdated = syncFrameworkFiles(cwd);
+    if (frameworkUpdated > 0) {
+        console.log(`Updated ${frameworkUpdated} framework file${frameworkUpdated !== 1 ? "s" : ""}.`);
+    }
+    const { mkdirSync } = await import("node:fs");
+    mkdirSync(join(cwd, ".mug"), { recursive: true });
+    console.log(`Bundling "${name}"...`);
+    const entrypoint = generateEntrypoint(cwd);
+    writeFileSync(join(cwd, ".mug", "_entrypoint.ts"), entrypoint);
+    // Resolve @mugwork/mug → CLI package's bundled runtime
+    const cliDir = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    const cliRuntimePath = join(cliDir, "runtime", "runtime.js");
+    const result = await esbuild.build({
+        entryPoints: [join(cwd, ".mug", "_entrypoint.ts")],
+        bundle: true,
+        format: "esm",
+        target: "es2022",
+        platform: "neutral",
+        outfile: join(cwd, ".mug", "bundle.js"),
+        external: ["cloudflare:workers"],
+        minify: true,
+        sourcemap: false,
+        alias: {
+            "@mugwork/mug": cliRuntimePath,
+        },
+        nodePaths: [join(cwd, "node_modules")],
+    });
+    if (result.errors.length > 0) {
+        console.error("Bundle failed:");
+        for (const err of result.errors)
+            console.error(`  ${err.text}`);
+        process.exit(1);
+    }
+    const bundlePath = join(cwd, ".mug", "bundle.js");
+    const bundleContent = readFileSync(bundlePath, "utf-8");
+    const bundleSize = Buffer.byteLength(bundleContent);
+    console.log(`Bundle: ${(bundleSize / 1024).toFixed(1)} KB`);
+    const notifyChannels = detectNotifyChannels(cwd);
+    for (const channel of notifyChannels) {
+        await ensureConsent(name, channel, token);
+    }
+    console.log(`Deploying "${name}"...`);
+    const sources = migrateConfig(config);
+    const secrets = readSecrets(cwd);
+    const rawBrandingConfig = config.branding;
+    if (rawBrandingConfig) {
+        const prodBranding = {};
+        const subdomainForUrl = config.subdomain ?? name;
+        if (rawBrandingConfig.accentColor)
+            prodBranding.accentColor = rawBrandingConfig.accentColor;
+        prodBranding.ogImage = `https://${subdomainForUrl}.mug.work/_og-image.png`;
+        for (const key of ["logo", "logoSquare"]) {
+            const localPath = rawBrandingConfig[key];
+            if (!localPath)
+                continue;
+            if (localPath.startsWith("http://") || localPath.startsWith("https://")) {
+                prodBranding[key] = localPath;
+            }
+            else {
+                const ext = localPath.split(".").pop() ?? "png";
+                const serveName = `${key === "logoSquare" ? "logo-square" : "logo"}.${ext}`;
+                prodBranding[key] = `https://${subdomainForUrl}.mug.work/_branding/${serveName}`;
+            }
+        }
+        secrets.MUG_BRANDING = JSON.stringify(prodBranding);
+    }
+    const aiConfig = config.ai;
+    if (aiConfig?.routing) {
+        const validTiers = ["fast", "balanced", "powerful"];
+        const validProviders = ["openai", "anthropic", "workers-ai"];
+        for (const [tier, spec] of Object.entries(aiConfig.routing)) {
+            if (!validTiers.includes(tier)) {
+                console.error(`Invalid AI routing tier "${tier}". Must be one of: ${validTiers.join(", ")}`);
+                process.exit(1);
+            }
+            const provider = spec.startsWith("@cf/") ? "workers-ai" : spec.split("/")[0];
+            if (!spec.includes("/") && !spec.startsWith("@cf/")) {
+                console.error(`Invalid AI routing model "${spec}" for tier "${tier}". Use provider/model format (e.g., "openai/gpt-4.1-mini").`);
+                process.exit(1);
+            }
+            if (!validProviders.includes(provider)) {
+                console.error(`Unknown AI provider "${provider}" in tier "${tier}". Supported: ${validProviders.join(", ")}`);
+                process.exit(1);
+            }
+        }
+        secrets.MUG_AI_ROUTING = JSON.stringify(aiConfig.routing);
+    }
+    if (aiConfig?.billing) {
+        const validKeys = ["default", "fast", "balanced", "powerful"];
+        const localSecrets = readSecrets(cwd);
+        for (const [tier, value] of Object.entries(aiConfig.billing)) {
+            if (!validKeys.includes(tier)) {
+                console.error(`Invalid AI billing key "${tier}". Must be one of: ${validKeys.join(", ")}`);
+                process.exit(1);
+            }
+            if (value !== "mug-metered" && !localSecrets[value]) {
+                console.error(`AI billing key "${value}" for tier "${tier}" not found in secrets. Run: mug secret set ${value}=<your-api-key>`);
+                process.exit(1);
+            }
+        }
+        secrets.MUG_AI_BILLING = JSON.stringify(aiConfig.billing);
+    }
+    const agentConfigs = await scanAgents(cwd);
+    const workflows = config.workflows ?? {};
+    if (Object.keys(workflows).length > 0) {
+        console.log(`  ⚠ mug.json "workflows" section is deprecated — move schedule/trigger config to workflow .ts options`);
+    }
+    // Schedules built after TS source scan (below)
+    let schedules = [];
+    const subdomain = config.subdomain ?? name;
+    const metadata = JSON.stringify({
+        name,
+        subdomain,
+        compatibility_date: "2025-05-08",
+        compatibility_flags: ["nodejs_compat"],
+        sources: Object.keys(sources).length > 0 ? sources : undefined,
+        secrets: Object.keys(secrets).length > 0 ? secrets : undefined,
+        schedules: schedules.length > 0 ? schedules : undefined,
+        accentColor: rawBrandingConfig?.accentColor ?? null,
+        aiRouting: aiConfig?.routing,
+        plan: config.plan ?? "starter",
+        agents: Object.keys(agentConfigs).length > 0 ? agentConfigs : undefined,
+    });
+    const connectorSpecs = collectConnectorSpecs(cwd);
+    const form = new FormData();
+    form.append("script", new Blob([bundleContent], { type: "application/javascript+module" }), "index.js");
+    form.append("metadata", metadata);
+    if (connectorSpecs.length > 0) {
+        form.append("specs", JSON.stringify(connectorSpecs));
+        console.log(`Bundling ${connectorSpecs.length} connector spec(s) for catalog.`);
+    }
+    const res = await fetch(DEPLOY_URL, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` },
+        body: form,
+    });
+    const data = (await res.json());
+    if (!res.ok || data.error) {
+        console.error(`Deploy failed: ${data.error ?? res.statusText}`);
+        process.exit(1);
+    }
+    console.log(`\nDeployed.`);
+    console.log(`  ${data.url}`);
+    if (Object.keys(secrets).length > 0) {
+        console.log(`  Secrets: ${Object.keys(secrets).join(", ")}`);
+    }
+    if (data.schedules) {
+        const s = data.schedules;
+        const parts = [];
+        if (s.created > 0)
+            parts.push(`${s.created} created`);
+        if (s.updated > 0)
+            parts.push(`${s.updated} updated`);
+        if (s.deleted > 0)
+            parts.push(`${s.deleted} removed`);
+        if (parts.length > 0)
+            console.log(`  Schedules: ${parts.join(", ")}`);
+    }
+    if (data.aiRoute) {
+        console.log(`  AI route: dynamic/${data.aiRoute}`);
+    }
+    if (Object.keys(agentConfigs).length > 0) {
+        console.log(`\nProvisioning ${Object.keys(agentConfigs).length} agent(s)...`);
+        const agentRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-agents`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+                "X-Workspace": name,
+            },
+            body: JSON.stringify(agentConfigs),
+        });
+        if (agentRes.ok) {
+            const result = (await agentRes.json());
+            for (const agentName of result.agents) {
+                console.log(`  ${agentName}: provisioned`);
+            }
+        }
+        else {
+            console.error(`  Agent provisioning failed: ${await agentRes.text()}`);
+        }
+    }
+    const workflowDir = join(cwd, "src", "workflows");
+    if (existsSync(workflowDir)) {
+        const workflowFiles = readdirSync(workflowDir).filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
+        if (workflowFiles.length > 0) {
+            console.log(`\nBundling ${workflowFiles.length} workflow(s)...`);
+            const workflowEntry = join(cwd, ".mug", "_workflow-entry.ts");
+            const imports = workflowFiles.map((f) => `import "${join(workflowDir, f)}";`).join("\n");
+            const entrypointPath = join(cwd, "src", "workflow-entrypoint.ts");
+            const entryContent = `${imports}\nexport { MugWorkflow } from "${entrypointPath}";\nexport { default } from "${entrypointPath}";\n`;
+            const { writeFileSync } = await import("node:fs");
+            writeFileSync(workflowEntry, entryContent);
+            const wfResult = await esbuild.build({
+                entryPoints: [workflowEntry],
+                bundle: true,
+                format: "esm",
+                target: "es2022",
+                platform: "neutral",
+                outfile: join(cwd, ".mug", "workflow-bundle.js"),
+                external: ["cloudflare:workers"],
+                minify: true,
+                sourcemap: false,
+            });
+            if (wfResult.errors.length > 0) {
+                console.error("Workflow bundle failed:");
+                for (const err of wfResult.errors)
+                    console.error(`  ${err.text}`);
+            }
+            else {
+                const wfBundle = readFileSync(join(cwd, ".mug", "workflow-bundle.js"), "utf-8");
+                console.log(`Workflow bundle: ${(Buffer.byteLength(wfBundle) / 1024).toFixed(1)} KB`);
+                const uploadRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-workflows`, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        "Content-Type": "application/javascript",
+                        "X-Workspace": name,
+                    },
+                    body: wfBundle,
+                });
+                if (uploadRes.ok) {
+                    console.log(`  Workflows deployed.`);
+                }
+                else {
+                    const err = await uploadRes.text();
+                    console.error(`  Workflow deploy failed: ${err}`);
+                }
+                if (Object.keys(secrets).length > 0) {
+                    const secretsRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-workflow-secrets`, {
+                        method: "POST",
+                        headers: {
+                            Authorization: `Bearer ${token}`,
+                            "Content-Type": "application/json",
+                            "X-Workspace": name,
+                        },
+                        body: JSON.stringify(secrets),
+                    });
+                    if (secretsRes.ok) {
+                        console.log(`  Workflow secrets synced.`);
+                    }
+                    else {
+                        console.error(`  Workflow secrets sync failed: ${await secretsRes.text()}`);
+                    }
+                }
+            }
+        }
+    }
+    // Scan workflow TS source for schedule, webhook, inbound, and trigger config
+    const parsedWebhookConfig = {};
+    const parsedInboundConfig = {};
+    const parsedSchedules = {};
+    const parsedSlackTriggers = {};
+    const wfDir = existsSync(join(cwd, "workflows")) ? join(cwd, "workflows") : join(cwd, "src", "workflows");
+    if (existsSync(wfDir)) {
+        for (const f of readdirSync(wfDir).filter((f) => f.endsWith(".ts") || f.endsWith(".js"))) {
+            try {
+                const source = readFileSync(join(wfDir, f), "utf-8");
+                const wfName = f.replace(/\.(ts|js)$/, "");
+                const parsed = parseWorkflowSteps(source, wfName, f);
+                if (parsed.schedule) {
+                    parsedSchedules[parsed.name] = parsed.schedule;
+                }
+                if (parsed.webhook) {
+                    if (typeof parsed.webhook === "object") {
+                        parsedWebhookConfig[parsed.name] = { mode: parsed.webhook.auth, secret: parsed.webhook.secret };
+                    }
+                    else {
+                        parsedWebhookConfig[parsed.name] = { mode: "none" };
+                    }
+                }
+                if (parsed.inbound) {
+                    parsedInboundConfig[parsed.inbound] = parsed.name;
+                }
+                if (parsed.trigger?.type?.startsWith("slack_")) {
+                    parsedSlackTriggers[parsed.name] = parsed.trigger;
+                }
+            }
+            catch { }
+        }
+    }
+    // Build schedules: TS source wins over mug.json
+    schedules = [];
+    for (const [wfName, cronExpr] of Object.entries(parsedSchedules)) {
+        schedules.push({ itemType: "workflow", itemName: wfName, cronExpr });
+    }
+    for (const [wfName, wf] of Object.entries(workflows)) {
+        if (wf.schedule) {
+            if (parsedSchedules[wfName]) {
+                console.log(`  ⚠ ${wfName}: schedule in both mug.json and TS source — using TS source (mug.json is deprecated)`);
+            }
+            else {
+                schedules.push({ itemType: "workflow", itemName: wfName, cronExpr: wf.schedule });
+                console.log(`  ⚠ ${wfName}: schedule in mug.json is deprecated — move to workflow options: { schedule: "${wf.schedule}" }`);
+            }
+        }
+    }
+    // Source sync schedules: TS source wins over mug.json
+    const parsedConnectorSchedules = {};
+    const connDir = resolveDir(cwd, "connectors", "src/sources");
+    if (existsSync(connDir)) {
+        for (const f of readdirSync(connDir).filter((f) => (f.endsWith(".ts") || f.endsWith(".js")) && !f.startsWith("."))) {
+            try {
+                const connSource = readFileSync(join(connDir, f), "utf-8");
+                const meta = parseConnectorMeta(connSource);
+                if (meta?.syncSchedule) {
+                    parsedConnectorSchedules[meta.name] = meta.syncSchedule;
+                    schedules.push({ itemType: "source", itemName: meta.name, cronExpr: meta.syncSchedule });
+                }
+            }
+            catch { }
+        }
+    }
+    for (const [srcName, src] of Object.entries(sources)) {
+        for (const [syncName, sync] of Object.entries(src.syncs)) {
+            if (sync.schedule) {
+                if (parsedConnectorSchedules[syncName]) {
+                    console.log(`  ⚠ ${syncName}: sync schedule in both mug.json and TS source — using TS source (mug.json is deprecated)`);
+                }
+                else {
+                    schedules.push({ itemType: "source", itemName: syncName, cronExpr: sync.schedule });
+                    console.log(`  ⚠ ${syncName}: sync schedule in mug.json is deprecated — move to source def: { syncSchedule: "${sync.schedule}" }`);
+                }
+            }
+        }
+    }
+    // Merge webhook config: TS source wins over mug.json
+    const webhookConfig = { ...parsedWebhookConfig };
+    const webhookWorkflows = Object.keys(webhookConfig);
+    const mjWebhooks = Object.entries(workflows).filter(([, wf]) => wf.webhook);
+    for (const [wfName, wf] of mjWebhooks) {
+        if (!webhookConfig[wfName]) {
+            const auth = typeof wf.webhook === "object" ? wf.webhook : { auth: "none" };
+            webhookConfig[wfName] = { mode: auth.auth, secret: auth.secret };
+            webhookWorkflows.push(wfName);
+            console.log(`  ⚠ ${wfName}: webhook config in mug.json is deprecated — move to workflow options: { webhook: { auth: "${auth.auth}" } }`);
+        }
+        else if (wf.webhook) {
+            console.log(`  ⚠ ${wfName}: webhook config in both mug.json and TS source — using TS source (mug.json is deprecated)`);
+        }
+    }
+    if (webhookWorkflows.length > 0) {
+        const webhookRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-webhook-config`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+                "X-Workspace": name,
+            },
+            body: JSON.stringify(webhookConfig),
+        });
+        if (webhookRes.ok) {
+            console.log(`\nWebhooks:`);
+            for (const wfName of webhookWorkflows) {
+                console.log(`  ${wfName}: https://api.mug.work/hook/${name}/${wfName}`);
+            }
+        }
+        else {
+            console.error(`  Webhook config deploy failed: ${await webhookRes.text()}`);
+        }
+    }
+    // Inbound message routing config — TS source wins over mug.json
+    const inbound = { ...parsedInboundConfig };
+    const mjInbound = config.inbound;
+    if (mjInbound) {
+        for (const [channel, wfName] of Object.entries(mjInbound)) {
+            if (!inbound[channel]) {
+                inbound[channel] = wfName;
+                console.log(`  ⚠ ${channel}: inbound config in mug.json is deprecated — add \`inbound: "${channel}"\` to workflow options`);
+            }
+        }
+    }
+    if (Object.keys(inbound).length > 0) {
+        const inboundRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-inbound-config`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+                "X-Workspace": name,
+            },
+            body: JSON.stringify(inbound),
+        });
+        if (inboundRes.ok) {
+            console.log(`\nInbound webhooks:`);
+            if (inbound.sms)
+                console.log(`  SMS:   https://api.mug.work/inbound/sms/${name}`);
+            if (inbound.email)
+                console.log(`  Email: https://api.mug.work/inbound/email/${name}`);
+            if (inbound.slack)
+                console.log(`  Slack: https://api.mug.work/inbound/slack/${name}`);
+        }
+        else {
+            console.error(`  Inbound config deploy failed: ${await inboundRes.text()}`);
+        }
+    }
+    // Slack app lifecycle — read from slack.json, fall back to mug.json
+    let slackConfig;
+    const slackJsonPath = join(cwd, "slack.json");
+    if (existsSync(slackJsonPath)) {
+        slackConfig = JSON.parse(readFileSync(slackJsonPath, "utf-8"));
+    }
+    else if (config.slack) {
+        slackConfig = legacyToSlackJson(config.slack);
+        console.log(`  ⚠ Slack config in mug.json is deprecated — migrate to slack.json`);
+    }
+    if (slackConfig?.enabled) {
+        console.log(`\nSlack app:`);
+        // Merge Slack triggers: TS source + mug.json (TS wins)
+        const slackTriggers = { ...parsedSlackTriggers };
+        for (const [wfName, wf] of Object.entries(workflows)) {
+            const trigger = wf.trigger;
+            if (trigger?.type?.startsWith("slack_") && !slackTriggers[wfName]) {
+                slackTriggers[wfName] = trigger;
+            }
+        }
+        if (Object.keys(slackTriggers).length > 0) {
+            console.log(`  Triggers: ${Object.entries(slackTriggers).map(([wf, t]) => `${wf} (${t.type})`).join(", ")}`);
+        }
+        const manifest = generateSlackManifest(name, slackConfig, inbound, slackTriggers);
+        // Scope change detection
+        const lastManifestPath = join(cwd, ".mug", "last-slack-manifest.json");
+        if (existsSync(lastManifestPath)) {
+            try {
+                const lastManifest = JSON.parse(readFileSync(lastManifestPath, "utf-8"));
+                const lastScopes = new Set(lastManifest?.oauth_config?.scopes?.bot ?? []);
+                const newScopes = manifest.oauth_config.scopes.bot;
+                const addedScopes = newScopes.filter((s) => !lastScopes.has(s));
+                if (addedScopes.length > 0) {
+                    console.log(`  ⚠ New OAuth scopes: ${addedScopes.join(", ")} — workspace admin may need to re-authorize`);
+                }
+            }
+            catch { }
+        }
+        writeFileSync(lastManifestPath, JSON.stringify(manifest, null, 2));
+        const configToken = secrets.SLACK_CONFIG_TOKEN;
+        const refreshToken = secrets.SLACK_CONFIG_REFRESH_TOKEN;
+        const slackRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-slack-app`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+                "X-Workspace": name,
+            },
+            body: JSON.stringify({
+                manifest,
+                config_token: configToken,
+                refresh_token: refreshToken,
+                triggers: Object.keys(slackTriggers).length > 0 ? slackTriggers : undefined,
+                homeTab: slackConfig.homeTab ?? undefined,
+                shortcuts: slackConfig.shortcuts ?? undefined,
+            }),
+        });
+        if (slackRes.ok) {
+            const result = (await slackRes.json());
+            if (result.status === "created") {
+                console.log(`  App created: ${result.app_id}`);
+                console.log(`  Install URL: ${result.install_url}`);
+            }
+            else if (result.status === "updated") {
+                console.log(`  App updated: ${result.app_id}`);
+                console.log(`  Install URL: https://api.mug.work/slack/install/${name}`);
+            }
+            else if (result.status === "manifest_saved") {
+                console.log(`  Manifest saved (no config token for auto-deploy).`);
+                console.log(`  Create app manually: ${generateManifestUrl(manifest)}`);
+                console.log(`  After creating, run: mug secrets set SLACK_APP_ID=<app_id>`);
+                console.log(`                       mug secrets set SLACK_CLIENT_ID=<client_id>`);
+                console.log(`                       mug secrets set SLACK_CLIENT_SECRET=<client_secret>`);
+                console.log(`                       mug secrets set SLACK_SIGNING_SECRET=<signing_secret>`);
+            }
+        }
+        else {
+            const err = await slackRes.text().catch(() => slackRes.statusText);
+            console.error(`  Slack deploy failed: ${err}`);
+        }
+        if (secrets.SLACK_APP_ID && secrets.SLACK_CLIENT_ID && secrets.SLACK_CLIENT_SECRET && !configToken) {
+            const credRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-slack-credentials`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "Content-Type": "application/json",
+                    "X-Workspace": name,
+                },
+                body: JSON.stringify({
+                    app_id: secrets.SLACK_APP_ID,
+                    client_id: secrets.SLACK_CLIENT_ID,
+                    client_secret: secrets.SLACK_CLIENT_SECRET,
+                    signing_secret: secrets.SLACK_SIGNING_SECRET ?? "",
+                }),
+            });
+            if (credRes.ok) {
+                const result = (await credRes.json());
+                console.log(`  Credentials synced.`);
+                if (result.install_url) {
+                    console.log(`  Install URL: ${result.install_url}`);
+                }
+            }
+        }
+    }
+    await syncLocalFiles(cwd, config);
+    await syncLocalDatabases(cwd, config);
+    if (rawBrandingConfig) {
+        const hasLocalFiles = ["logo", "logoSquare", "ogImage"].some((k) => {
+            const v = rawBrandingConfig[k];
+            return v && !String(v).startsWith("http://") && !String(v).startsWith("https://");
+        });
+        if (hasLocalFiles) {
+            console.log(`\nUploading branding...`);
+            for (const key of ["logo", "logoSquare"]) {
+                const localPath = rawBrandingConfig[key];
+                if (!localPath || localPath.startsWith("http://") || localPath.startsWith("https://"))
+                    continue;
+                const fullPath = join(cwd, localPath);
+                if (!existsSync(fullPath)) {
+                    console.error(`  ${key}: file not found: ${localPath}`);
+                    continue;
+                }
+                const fileContent = readFileSync(fullPath);
+                const ext = localPath.split(".").pop() ?? "png";
+                const r2Key = `workspaces/${name}/branding/${key === "logoSquare" ? "logo-square" : "logo"}.${ext}`;
+                const uploadRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-branding`, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        "X-Workspace": name,
+                        "X-R2-Key": r2Key,
+                        "Content-Type": "application/octet-stream",
+                    },
+                    body: fileContent,
+                });
+                if (uploadRes.ok) {
+                    console.log(`  ${key}: uploaded`);
+                }
+                else {
+                    console.error(`  ${key}: upload failed`);
+                }
+            }
+            const ogImagePath = rawBrandingConfig.ogImage;
+            if (ogImagePath && !ogImagePath.startsWith("http://") && !ogImagePath.startsWith("https://")) {
+                const fullPath = join(cwd, ogImagePath);
+                if (!existsSync(fullPath)) {
+                    console.error(`  ogImage: file not found: ${ogImagePath}`);
+                }
+                else {
+                    const fileContent = readFileSync(fullPath);
+                    const r2Key = `workspaces/${name}/branding/og-image.png`;
+                    const uploadRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-branding`, {
+                        method: "POST",
+                        headers: {
+                            Authorization: `Bearer ${token}`,
+                            "X-Workspace": name,
+                            "X-R2-Key": r2Key,
+                            "Content-Type": "application/octet-stream",
+                        },
+                        body: fileContent,
+                    });
+                    if (uploadRes.ok) {
+                        console.log(`  ogImage: uploaded`);
+                    }
+                    else {
+                        console.error(`  ogImage: upload failed`);
+                    }
+                }
+            }
+        }
+    }
+    await generatePwaIcons(cwd, name, rawBrandingConfig, token);
+    const resolvedBranding = secrets.MUG_BRANDING ? JSON.parse(secrets.MUG_BRANDING) : undefined;
+    const surfDir = resolveDir(cwd, "surfaces", "src/surfaces");
+    const homeScreenPath = join(surfDir, "_home.json");
+    if (existsSync(homeScreenPath)) {
+        console.log(`\nDeploying home screen config...`);
+        const homeScreenConfig = JSON.parse(readFileSync(homeScreenPath, "utf-8"));
+        const surfaceFiles = existsSync(surfDir)
+            ? readdirSync(surfDir).filter((f) => f.endsWith(".json") && f !== "_home.json").map((f) => f.replace(/\.json$/, ""))
+            : [];
+        const invalidSurfaces = [];
+        for (const group of (homeScreenConfig.groups ?? [])) {
+            for (const btn of group.buttons ?? []) {
+                if (!surfaceFiles.includes(btn.surface))
+                    invalidSurfaces.push(btn.surface);
+            }
+            for (const card of group.cards ?? []) {
+                if (!surfaceFiles.includes(card.surface))
+                    invalidSurfaces.push(card.surface);
+            }
+        }
+        if (invalidSurfaces.length > 0) {
+            console.error(`  Warning: _home.json references unknown surfaces: ${invalidSurfaces.join(", ")}`);
+        }
+        const r2Key = `workspaces/${name}/home-screen.json`;
+        const hsRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-branding`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "X-Workspace": name,
+                "X-R2-Key": r2Key,
+                "Content-Type": "application/octet-stream",
+            },
+            body: JSON.stringify(homeScreenConfig),
+        });
+        if (hsRes.ok) {
+            console.log(`  Home screen config deployed.`);
+        }
+        else {
+            console.error(`  Home screen deploy failed: ${await hsRes.text()}`);
+        }
+    }
+    if (existsSync(surfDir)) {
+        const surfaceFiles = readdirSync(surfDir).filter((f) => f.endsWith(".json") && f !== "_home.json");
+        if (surfaceFiles.length > 0) {
+            console.log(`\nDeploying ${surfaceFiles.length} surface(s)...`);
+            for (const file of surfaceFiles) {
+                const surfaceConfig = JSON.parse(readFileSync(join(surfDir, file), "utf-8"));
+                const surfaceId = file.replace(/\.json$/, "");
+                surfaceConfig.workspace = name;
+                surfaceConfig.surfaceId = surfaceId;
+                surfaceConfig.timezone = surfaceConfig.timezone ?? config.settings?.timezone;
+                const surfaceBranding = surfaceConfig.branding;
+                surfaceConfig.branding = surfaceBranding || resolvedBranding ? { ...resolvedBranding, ...surfaceBranding } : undefined;
+                const configErrors = [];
+                const validId = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+                const checkId = (val, field) => {
+                    if (!validId.test(val) && !/^"[^"]*"$/.test(val))
+                        configErrors.push(`${field}: invalid SQL identifier "${val}"`);
+                };
+                if (surfaceConfig.access?.table)
+                    checkId(surfaceConfig.access.table, "access.table");
+                if (surfaceConfig.access?.matchColumn)
+                    checkId(surfaceConfig.access.matchColumn, "access.matchColumn");
+                if (surfaceConfig.editMode?.table)
+                    checkId(surfaceConfig.editMode.table, "editMode.table");
+                if (surfaceConfig.editMode?.matchColumn)
+                    checkId(surfaceConfig.editMode.matchColumn, "editMode.matchColumn");
+                if (surfaceConfig.type === "portal") {
+                    const allSections = [...(surfaceConfig.sections ?? []), ...(surfaceConfig.tabs ?? []).flatMap((t) => t.sections ?? [])];
+                    for (const section of allSections) {
+                        if (section.primaryKey)
+                            checkId(section.primaryKey, "section.primaryKey");
+                        if (section.query) {
+                            const q = section.query.trim().toUpperCase();
+                            if (!q.startsWith("SELECT") && !q.startsWith("WITH"))
+                                configErrors.push("section query must start with SELECT or WITH");
+                            if (section.query.includes(";"))
+                                configErrors.push("section query must not contain multiple statements");
+                        }
+                        for (const col of section.columns ?? []) {
+                            if (col.key)
+                                checkId(col.key, "column.key");
+                        }
+                    }
+                }
+                if (surfaceConfig.embedAllowOrigins) {
+                    for (const origin of surfaceConfig.embedAllowOrigins) {
+                        try {
+                            const u = new URL(origin);
+                            if (u.pathname !== "/" || u.search || u.hash)
+                                configErrors.push(`embedAllowOrigins: "${origin}" must be origin only (no path/query)`);
+                        }
+                        catch {
+                            configErrors.push(`embedAllowOrigins: "${origin}" is not a valid URL`);
+                        }
+                    }
+                }
+                if (configErrors.length > 0) {
+                    console.error(`  ${surfaceId}: validation failed`);
+                    for (const err of configErrors)
+                        console.error(`    - ${err}`);
+                    continue;
+                }
+                if (surfaceBranding) {
+                    for (const key of ["logo", "logoSquare"]) {
+                        const localPath = surfaceBranding[key];
+                        if (!localPath || localPath.startsWith("http://") || localPath.startsWith("https://") || localPath.startsWith("/"))
+                            continue;
+                        const fullPath = join(cwd, localPath);
+                        if (!existsSync(fullPath))
+                            continue;
+                        const fileContent = readFileSync(fullPath);
+                        const ext = localPath.split(".").pop() ?? "png";
+                        const r2Key = `workspaces/${name}/branding/${localPath.replace(/\//g, "-")}`;
+                        const uploadRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-branding`, {
+                            method: "POST",
+                            headers: { Authorization: `Bearer ${token}`, "X-Workspace": name, "X-R2-Key": r2Key, "Content-Type": "application/octet-stream" },
+                            body: fileContent,
+                        });
+                        if (uploadRes.ok) {
+                            surfaceConfig.branding[key] = `/_branding/${localPath.replace(/\//g, "-")}`;
+                        }
+                    }
+                }
+                const surfaceRes = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-surface`, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${token}`,
+                    },
+                    body: JSON.stringify(surfaceConfig),
+                });
+                if (surfaceRes.ok) {
+                    console.log(`  ${surfaceId}: https://${subdomain}.mug.work/${surfaceId}`);
+                }
+                else {
+                    console.error(`  ${surfaceId}: deploy failed — ${await surfaceRes.text()}`);
+                }
+            }
+        }
+    }
+}
+function collectConnectorSpecs(cwd) {
+    const specsDir = join(resolveDir(cwd, "connectors", "src/connectors"), ".specs");
+    if (!existsSync(specsDir))
+        return [];
+    const specs = [];
+    try {
+        for (const slug of readdirSync(specsDir)) {
+            const slugDir = join(specsDir, slug);
+            const metaPath = join(slugDir, "meta.yaml");
+            const specPath = join(slugDir, "openapi.yaml");
+            if (!existsSync(metaPath) || !existsSync(specPath))
+                continue;
+            try {
+                const metaRaw = readFileSync(metaPath, "utf-8");
+                const specRaw = readFileSync(specPath, "utf-8");
+                specs.push({ slug, meta: { _raw: metaRaw }, spec: { _raw: specRaw } });
+            }
+            catch { }
+        }
+    }
+    catch { }
+    return specs;
+}
+async function generatePwaIcons(cwd, name, branding, token) {
+    let sharp;
+    try {
+        sharp = (await import("sharp")).default;
+    }
+    catch {
+        return;
+    }
+    let sourceBuffer;
+    const logoSquare = branding?.logoSquare;
+    if (logoSquare && !logoSquare.startsWith("http://") && !logoSquare.startsWith("https://")) {
+        const fullPath = join(cwd, logoSquare);
+        if (existsSync(fullPath)) {
+            sourceBuffer = readFileSync(fullPath);
+        }
+        else {
+            sourceBuffer = Buffer.from(generateMugIconSvg(branding?.accentColor));
+        }
+    }
+    else {
+        sourceBuffer = Buffer.from(generateMugIconSvg(branding?.accentColor));
+    }
+    console.log(`\nGenerating PWA icons...`);
+    for (const size of [192, 512]) {
+        const png = await sharp(sourceBuffer)
+            .resize(size, size, { fit: "contain", background: { r: 0, g: 0, b: 0, alpha: 0 } })
+            .png()
+            .toBuffer();
+        const r2Key = `workspaces/${name}/branding/icon-${size}.png`;
+        const res = await fetch(`${DEPLOY_URL.replace("/deploy", "")}/deploy-branding`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "X-Workspace": name,
+                "X-R2-Key": r2Key,
+                "Content-Type": "application/octet-stream",
+            },
+            body: new Uint8Array(png),
+        });
+        if (!res.ok) {
+            console.error(`  icon-${size}.png: upload failed`);
+            return;
+        }
+    }
+    console.log(`  PWA icons: uploaded (192px, 512px)`);
+}
+const VALID_MODELS = [
+    "claude-sonnet", "claude-haiku", "claude-opus",
+    "gpt-4o", "gpt-4o-mini", "gpt-4.1-nano", "gpt-4.1-mini", "gpt-4.1",
+];
+const VALID_TOOLS = ["query", "search", "ask", "notify", "http", "workspace", "ai"];
+async function scanAgents(cwd) {
+    const agentsDir = resolveDir(cwd, "agents", "src/agents");
+    if (!existsSync(agentsDir))
+        return {};
+    const entries = readdirSync(agentsDir);
+    const configs = {};
+    const agentFolders = entries.filter((f) => {
+        if (f === "shared-skills")
+            return false;
+        const p = join(agentsDir, f);
+        return statSync(p).isDirectory() && existsSync(join(p, "agent.json"));
+    });
+    if (agentFolders.length === 0) {
+        const legacyFiles = entries.filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
+        if (legacyFiles.length > 0) {
+            console.warn(`  Warning: found legacy agent files (${legacyFiles.join(", ")}). Migrate to folder structure: src/agents/<name>/agent.json + soul.md`);
+        }
+        return {};
+    }
+    const sharedSkillsDir = join(agentsDir, "shared-skills");
+    const sharedSkills = [];
+    if (existsSync(sharedSkillsDir)) {
+        for (const skillDir of readdirSync(sharedSkillsDir)) {
+            const skillFile = join(sharedSkillsDir, skillDir, "SKILL.md");
+            if (existsSync(skillFile)) {
+                sharedSkills.push({ name: skillDir, content: readFileSync(skillFile, "utf-8") });
+            }
+        }
+    }
+    for (const folder of agentFolders) {
+        const agentDir = join(agentsDir, folder);
+        const configPath = join(agentDir, "agent.json");
+        try {
+            const config = JSON.parse(readFileSync(configPath, "utf-8"));
+            if (!config.name) {
+                config.name = folder;
+            }
+            if (!config.model) {
+                console.error(`  ${folder}: missing model in agent.json`);
+                process.exit(1);
+            }
+            if (typeof config.model === "string") {
+                if (!VALID_MODELS.includes(config.model) && !config.model.includes("/")) {
+                    console.warn(`  ${folder}: model "${config.model}" not in standard list — will use as-is via AI Gateway`);
+                }
+            }
+            else if (typeof config.model === "object") {
+                for (const [tier, model] of Object.entries(config.model)) {
+                    if (!["fast", "balanced", "powerful"].includes(tier)) {
+                        console.error(`  ${folder}: invalid routing tier "${tier}" — must be fast, balanced, or powerful`);
+                        process.exit(1);
+                    }
+                    if (typeof model === "string" && !VALID_MODELS.includes(model) && !model.includes("/")) {
+                        console.warn(`  ${folder}: model "${model}" for tier "${tier}" not in standard list`);
+                    }
+                }
+            }
+            const soulPath = join(agentDir, config.instructions ?? "soul.md");
+            if (!existsSync(soulPath)) {
+                console.error(`  ${folder}: instruction file not found: ${config.instructions ?? "soul.md"}`);
+                process.exit(1);
+            }
+            if (config.tools) {
+                for (const tool of config.tools) {
+                    if (!VALID_TOOLS.includes(tool) && !tool.startsWith("custom:")) {
+                        console.warn(`  ${folder}: tool "${tool}" is not a standard grant — treating as custom`);
+                    }
+                }
+            }
+            if (config.caps) {
+                if (config.caps.maxTurns && (config.caps.maxTurns < 1 || config.caps.maxTurns > 500)) {
+                    console.error(`  ${folder}: maxTurns must be 1-500`);
+                    process.exit(1);
+                }
+                if (config.caps.maxCredits && config.caps.maxCredits < 1) {
+                    console.error(`  ${folder}: maxCredits must be positive`);
+                    process.exit(1);
+                }
+            }
+            const deployConfig = { ...config };
+            deployConfig.instructionContent = readFileSync(soulPath, "utf-8");
+            const skillsDir = join(agentDir, "skills");
+            if (existsSync(skillsDir)) {
+                deployConfig.skills = [];
+                for (const skillDir of readdirSync(skillsDir)) {
+                    const skillFile = join(skillsDir, skillDir, "SKILL.md");
+                    if (existsSync(skillFile)) {
+                        deployConfig.skills.push({ name: skillDir, content: readFileSync(skillFile, "utf-8") });
+                    }
+                }
+            }
+            if (sharedSkills.length > 0) {
+                deployConfig.sharedSkills = sharedSkills;
+            }
+            const modelLabel = typeof config.model === "string" ? config.model : "dynamic";
+            configs[config.name] = deployConfig;
+            console.log(`  ${config.name} (${modelLabel})`);
+        }
+        catch (err) {
+            if (err instanceof SyntaxError) {
+                console.error(`  ${folder}: invalid JSON in agent.json — ${err.message}`);
+            }
+            else {
+                console.error(`  ${folder}: failed to parse — ${err instanceof Error ? err.message : err}`);
+            }
+            process.exit(1);
+        }
+    }
+    return configs;
+}
+function parseConnectorMeta(source) {
+    try {
+        const { transformSync } = require("esbuild");
+        const acorn = require("acorn");
+        const walk = require("acorn-walk");
+        const js = transformSync(source, { loader: "ts", target: "es2022" }).code;
+        const ast = acorn.parse(js, { ecmaVersion: 2022, sourceType: "module" });
+        let result = null;
+        walk.simple(ast, {
+            CallExpression(node) {
+                const callee = node.callee?.name;
+                if (callee !== "source" && callee !== "connector")
+                    return;
+                const arg = node.arguments?.[0];
+                if (!arg || arg.type !== "ObjectExpression")
+                    return;
+                const meta = { name: "" };
+                for (const prop of arg.properties ?? []) {
+                    if (prop.key?.name === "name" && prop.value?.type === "Literal") {
+                        meta.name = prop.value.value;
+                    }
+                    if (prop.key?.name === "database" && prop.value?.type === "Literal") {
+                        meta.database = prop.value.value;
+                    }
+                    if (prop.key?.name === "syncSchedule" && prop.value?.type === "Literal") {
+                        meta.syncSchedule = prop.value.value;
+                    }
+                }
+                if (meta.name)
+                    result = meta;
+            },
+        });
+        return result;
+    }
+    catch {
+        return null;
+    }
+}
+function generateEntrypoint(cwd) {
+    const lines = [];
+    // Auto-discover connectors
+    const connDir = resolveDir(cwd, "connectors", "src/sources");
+    if (existsSync(connDir)) {
+        const connBase = existsSync(join(cwd, "connectors")) ? "../connectors" : "../src/sources";
+        for (const f of readdirSync(connDir).filter((f) => (f.endsWith(".ts") || f.endsWith(".js")) && !f.startsWith("."))) {
+            lines.push(`import "${connBase}/${f.replace(/\.ts$/, ".js")}";`);
+        }
+    }
+    // Auto-discover workflows
+    const wfDirPath = resolveDir(cwd, "workflows", "src/workflows");
+    if (existsSync(wfDirPath)) {
+        const wfBase = existsSync(join(cwd, "workflows")) ? "../workflows" : "../src/workflows";
+        for (const f of readdirSync(wfDirPath).filter((f) => (f.endsWith(".ts") || f.endsWith(".js")) && !f.startsWith("."))) {
+            lines.push(`import "${wfBase}/${f.replace(/\.ts$/, ".js")}";`);
+        }
+    }
+    // Framework exports — resolved via @mugwork/mug alias (points to CLI package runtime)
+    lines.push(`export { WorkspaceDatabase, default } from "@mugwork/mug";`);
+    return lines.join("\n") + "\n";
+}