@teamkeel/functions-runtime 0.458.0 → 0.460.0

package/dist/index.js

@@ -1,10 +1,336 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/File.ts
+var File_exports = {};
+__export(File_exports, {
+  File: () => File,
+  InlineFile: () => InlineFile,
+  buildContentDisposition: () => buildContentDisposition,
+  deleteStoredFile: () => deleteStoredFile,
+  rewriteFilesDomain: () => rewriteFilesDomain
+});
+import {
+  S3Client,
+  PutObjectCommand,
+  GetObjectCommand,
+  DeleteObjectCommand
+} from "@aws-sdk/client-s3";
+import { fromEnv } from "@aws-sdk/credential-providers";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import KSUID from "ksuid";
+function rewriteFilesDomain(url) {
+  const domain = process.env.KEEL_FILES_DOMAIN;
+  if (domain) {
+    const override = new URL(domain);
+    url.protocol = override.protocol;
+    url.hostname = override.hostname;
+    url.port = override.port;
+    const overridePath = override.pathname.replace(/\/+$/, "");
+    if (overridePath && overridePath !== "/") {
+      url.pathname = overridePath + url.pathname;
+    }
+  }
+  return url;
+}
+function encodeRFC5987(value) {
+  return encodeURIComponent(value).replace(
+    /['()*]/g,
+    (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase()
+  );
+}
+function buildContentDisposition(disposition, filename) {
+  const type = disposition === "attachment" ? "attachment" : "inline";
+  if (!filename || filename.trim() === "") {
+    return type;
+  }
+  const asciiFallback = filename.replace(/[^\x20-\x7e]|["\\]/g, "_");
+  return `${type}; filename="${asciiFallback}"; filename*=UTF-8''${encodeRFC5987(
+    filename
+  )}`;
+}
+async function storeFile(contents, key, filename, contentType, size, expires) {
+  if (!s3Client) {
+    throw new Error("S3 client is required");
+  }
+  const params = {
+    Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+    Key: "files/" + key,
+    Body: contents,
+    ContentType: contentType,
+    ContentDisposition: `attachment; filename="${encodeURIComponent(
+      filename
+    )}"`,
+    Metadata: {
+      filename
+    },
+    ACL: "private"
+  };
+  if (expires) {
+    if (expires instanceof Date) {
+      params.Expires = expires;
+    } else {
+      console.warn("Invalid expires value. Skipping Expires parameter.");
+    }
+  }
+  const command = new PutObjectCommand(params);
+  try {
+    await s3Client.send(command);
+  } catch (error) {
+    console.error("Error uploading file:", error);
+    throw error;
+  }
+}
+async function deleteStoredFile(key) {
+  if (!s3Client) {
+    throw new Error("S3 client is required");
+  }
+  await s3Client.send(
+    new DeleteObjectCommand({
+      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+      Key: "files/" + key
+    })
+  );
+}
+var s3Client, InlineFile, File;
+var init_File = __esm({
+  "src/File.ts"() {
+    "use strict";
+    s3Client = (() => {
+      if (!process.env.KEEL_FILES_BUCKET_NAME) {
+        return null;
+      }
+      const endpoint = process.env.KEEL_S3_ENDPOINT;
+      if (endpoint) {
+        return new S3Client({
+          region: process.env.KEEL_REGION,
+          credentials: {
+            accessKeyId: "keelstorage",
+            secretAccessKey: "keelstorage"
+          },
+          endpoint
+        });
+      }
+      const testEndpoint = process.env.TEST_AWS_ENDPOINT;
+      if (testEndpoint) {
+        return new S3Client({
+          region: process.env.KEEL_REGION,
+          credentials: {
+            accessKeyId: "test",
+            secretAccessKey: "test"
+          },
+          endpointProvider: /* @__PURE__ */ __name(() => {
+            return {
+              url: new URL(testEndpoint)
+            };
+          }, "endpointProvider")
+        });
+      }
+      return new S3Client({
+        region: process.env.KEEL_REGION,
+        credentials: fromEnv()
+      });
+    })();
+    __name(rewriteFilesDomain, "rewriteFilesDomain");
+    __name(encodeRFC5987, "encodeRFC5987");
+    __name(buildContentDisposition, "buildContentDisposition");
+    InlineFile = class _InlineFile {
+      static {
+        __name(this, "InlineFile");
+      }
+      constructor(input) {
+        this._filename = input.filename;
+        this._contentType = input.contentType;
+        this._contents = null;
+      }
+      static fromDataURL(dataURL) {
+        const info = dataURL.split(",")[0].split(":")[1];
+        const data = dataURL.split(",")[1];
+        const mimeType = info.split(";")[0];
+        const name = info.split(";")[1].split("=")[1] || "file";
+        const buffer = Buffer.from(data, "base64");
+        const file2 = new _InlineFile({ filename: name, contentType: mimeType });
+        file2.write(buffer);
+        return file2;
+      }
+      // Gets size of the file's contents in bytes
+      get size() {
+        if (this._contents) {
+          return this._contents.size;
+        }
+        return 0;
+      }
+      // Gets the media type of the file contents
+      get contentType() {
+        return this._contentType;
+      }
+      // Gets the name of the file
+      get filename() {
+        return this._filename;
+      }
+      // Write the files contents from a buffer
+      write(buffer) {
+        this._contents = new Blob([
+          new Uint8Array(
+            buffer.buffer,
+            buffer.byteOffset,
+            buffer.byteLength
+          )
+        ]);
+      }
+      // Reads the contents of the file as a buffer
+      async read() {
+        if (!this._contents) {
+          throw new Error("No contents to read");
+        }
+        const arrayBuffer = await this._contents.arrayBuffer();
+        return Buffer.from(arrayBuffer);
+      }
+      // Persists the file
+      async store(expires = null) {
+        const content = await this.read();
+        const key = KSUID.randomSync().string;
+        await storeFile(
+          content,
+          key,
+          this._filename,
+          this._contentType,
+          this.size,
+          expires
+        );
+        return new File({
+          key,
+          size: this.size,
+          filename: this.filename,
+          contentType: this.contentType
+        });
+      }
+    };
+    File = class _File extends InlineFile {
+      static {
+        __name(this, "File");
+      }
+      constructor(input) {
+        super({
+          filename: input.filename || "",
+          contentType: input.contentType || ""
+        });
+        this._key = input.key || "";
+        this._size = input.size || 0;
+      }
+      // Creates a new instance from the database record
+      static fromDbRecord(input) {
+        return new _File({
+          key: input.key,
+          filename: input.filename,
+          size: input.size,
+          contentType: input.contentType
+        });
+      }
+      get size() {
+        return this._size;
+      }
+      // Gets the stored key
+      get key() {
+        return this._key;
+      }
+      get isPublic() {
+        return false;
+      }
+      async read() {
+        if (this._contents) {
+          const arrayBuffer = await this._contents.arrayBuffer();
+          return Buffer.from(arrayBuffer);
+        }
+        if (!s3Client) {
+          throw new Error("S3 client is required");
+        }
+        const params = {
+          Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+          Key: "files/" + this.key
+        };
+        const command = new GetObjectCommand(params);
+        const response = await s3Client.send(command);
+        const blob = await response.Body.transformToByteArray();
+        return Buffer.from(blob);
+      }
+      async store(expires = null) {
+        if (this._contents) {
+          const contents = await this.read();
+          await storeFile(
+            contents,
+            this.key,
+            this.filename,
+            this.contentType,
+            this.size,
+            expires
+          );
+        }
+        return this;
+      }
+      // Generates a presigned download URL.
+      //
+      // By default the browser previews the file inline and, when saved, uses the
+      // file's own filename. Pass `contentDisposition: "attachment"` to force a
+      // download, or `filename` to override the suggested name.
+      async getPresignedUrl(options) {
+        if (!s3Client) {
+          throw new Error("S3 client is required");
+        }
+        const disposition = options?.contentDisposition ?? "inline";
+        const filename = options?.filename ?? this.filename;
+        const command = new GetObjectCommand({
+          Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+          Key: "files/" + this.key,
+          ResponseContentDisposition: buildContentDisposition(
+            disposition,
+            filename
+          )
+        });
+        const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
+        return rewriteFilesDomain(new URL(url));
+      }
+      // Generates a presigned upload URL. If the file doesn't have a key, a new one will be generated
+      async getPresignedUploadUrl() {
+        if (!s3Client) {
+          throw new Error("S3 client is required");
+        }
+        if (!this.key) {
+          this._key = KSUID.randomSync().string;
+        }
+        const command = new PutObjectCommand({
+          Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+          Key: "files/" + this.key
+        });
+        const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
+        return rewriteFilesDomain(new URL(url));
+      }
+      // Persists the file
+      toDbRecord() {
+        return {
+          key: this.key,
+          filename: this.filename,
+          contentType: this.contentType,
+          size: this.size
+        };
+      }
+      toJSON() {
+        return this.toDbRecord();
+      }
+    };
+    __name(storeFile, "storeFile");
+    __name(deleteStoredFile, "deleteStoredFile");
+  }
+});
+
 // src/ModelAPI.js
 import { sql as sql3 } from "kysely";
 
@@ -72,6 +398,9 @@ var AuditContextPlugin = class {
           const rawNode = sql`set_trace_id(${audit.traceId})`.as(this.traceIdAlias).toOperationNode();
           returning.selections.push(SelectionNode.create(rawNode));
         }
+        if (returning.selections.length === 0) {
+          return { ...args.node };
+        }
         return {
           ...args.node,
           returning
@@ -441,20 +770,44 @@ var KEEL_INTERNAL_CHILDREN = "includeChildrenSpans";
 import WebSocket from "ws";
 import { readFileSync } from "fs";
 var dbInstance = new AsyncLocalStorage2();
+var fileCleanupStore = new AsyncLocalStorage2();
+function deferFileDeletion(key) {
+  fileCleanupStore.getStore()?.add(key);
+}
+__name(deferFileDeletion, "deferFileDeletion");
+async function flushFileDeletions(keys) {
+  if (keys.size === 0) {
+    return;
+  }
+  const { deleteStoredFile: deleteStoredFile2 } = await Promise.resolve().then(() => (init_File(), File_exports));
+  for (const key of keys) {
+    try {
+      await deleteStoredFile2(key);
+    } catch (e) {
+      console.error("failed to delete orphaned file from storage", e);
+    }
+  }
+}
+__name(flushFileDeletions, "flushFileDeletions");
 var vitestDb = null;
 async function withDatabase(db, requiresTransaction, cb) {
+  const pending = /* @__PURE__ */ new Set();
   if (requiresTransaction) {
-    return db.transaction().execute(async (transaction) => {
-      return dbInstance.run(transaction, async () => {
-        return cb({ transaction });
+    const result2 = await db.transaction().execute(async (transaction) => {
+      return dbInstance.run(transaction, () => {
+        return fileCleanupStore.run(pending, () => cb({ transaction }));
       });
     });
+    await flushFileDeletions(pending);
+    return result2;
   }
-  return db.connection().execute(async (sDb) => {
-    return dbInstance.run(sDb, async () => {
-      return cb({ sDb });
+  const result = await db.connection().execute(async (sDb) => {
+    return dbInstance.run(sDb, () => {
+      return fileCleanupStore.run(pending, () => cb({ sDb }));
     });
   });
+  await flushFileDeletions(pending);
+  return result;
 }
 __name(withDatabase, "withDatabase");
 function useDatabase() {
@@ -533,9 +886,9 @@ var InstrumentedClient = class extends Client {
   }
   async query(...args) {
     const _super = super.query.bind(this);
-    const sql4 = args[0];
+    const sql5 = args[0];
     let sqlAttribute = false;
-    let spanName = txStatements[sql4.toLowerCase()];
+    let spanName = txStatements[sql5.toLowerCase()];
     if (!spanName) {
       spanName = "Database Query";
       sqlAttribute = true;
@@ -603,9 +956,9 @@ function getDialect(connString) {
       pool.on("connect", (client) => {
         const originalQuery = client.query;
         client.query = function(...args) {
-          const sql4 = args[0];
+          const sql5 = args[0];
           let sqlAttribute = false;
-          let spanName = txStatements[sql4.toLowerCase()];
+          let spanName = txStatements[sql5.toLowerCase()];
           if (!spanName) {
             spanName = "Database Query";
             sqlAttribute = true;
@@ -629,275 +982,8 @@ function getDialect(connString) {
 }
 __name(getDialect, "getDialect");
 
-// src/File.ts
-import {
-  S3Client,
-  PutObjectCommand,
-  GetObjectCommand
-} from "@aws-sdk/client-s3";
-import { fromEnv } from "@aws-sdk/credential-providers";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import KSUID from "ksuid";
-var s3Client = (() => {
-  if (!process.env.KEEL_FILES_BUCKET_NAME) {
-    return null;
-  }
-  const endpoint = process.env.KEEL_S3_ENDPOINT;
-  if (endpoint) {
-    return new S3Client({
-      region: process.env.KEEL_REGION,
-      credentials: {
-        accessKeyId: "keelstorage",
-        secretAccessKey: "keelstorage"
-      },
-      endpoint
-    });
-  }
-  const testEndpoint = process.env.TEST_AWS_ENDPOINT;
-  if (testEndpoint) {
-    return new S3Client({
-      region: process.env.KEEL_REGION,
-      credentials: {
-        accessKeyId: "test",
-        secretAccessKey: "test"
-      },
-      endpointProvider: /* @__PURE__ */ __name(() => {
-        return {
-          url: new URL(testEndpoint)
-        };
-      }, "endpointProvider")
-    });
-  }
-  return new S3Client({
-    region: process.env.KEEL_REGION,
-    credentials: fromEnv()
-  });
-})();
-function rewriteFilesDomain(url) {
-  const domain = process.env.KEEL_FILES_DOMAIN;
-  if (domain) {
-    const override = new URL(domain);
-    url.protocol = override.protocol;
-    url.hostname = override.hostname;
-    url.port = override.port;
-    const overridePath = override.pathname.replace(/\/+$/, "");
-    if (overridePath && overridePath !== "/") {
-      url.pathname = overridePath + url.pathname;
-    }
-  }
-  return url;
-}
-__name(rewriteFilesDomain, "rewriteFilesDomain");
-var InlineFile = class _InlineFile {
-  static {
-    __name(this, "InlineFile");
-  }
-  constructor(input) {
-    this._filename = input.filename;
-    this._contentType = input.contentType;
-    this._contents = null;
-  }
-  static fromDataURL(dataURL) {
-    const info = dataURL.split(",")[0].split(":")[1];
-    const data = dataURL.split(",")[1];
-    const mimeType = info.split(";")[0];
-    const name = info.split(";")[1].split("=")[1] || "file";
-    const buffer = Buffer.from(data, "base64");
-    const file2 = new _InlineFile({ filename: name, contentType: mimeType });
-    file2.write(buffer);
-    return file2;
-  }
-  // Gets size of the file's contents in bytes
-  get size() {
-    if (this._contents) {
-      return this._contents.size;
-    }
-    return 0;
-  }
-  // Gets the media type of the file contents
-  get contentType() {
-    return this._contentType;
-  }
-  // Gets the name of the file
-  get filename() {
-    return this._filename;
-  }
-  // Write the files contents from a buffer
-  write(buffer) {
-    this._contents = new Blob([
-      new Uint8Array(
-        buffer.buffer,
-        buffer.byteOffset,
-        buffer.byteLength
-      )
-    ]);
-  }
-  // Reads the contents of the file as a buffer
-  async read() {
-    if (!this._contents) {
-      throw new Error("No contents to read");
-    }
-    const arrayBuffer = await this._contents.arrayBuffer();
-    return Buffer.from(arrayBuffer);
-  }
-  // Persists the file
-  async store(expires = null) {
-    const content = await this.read();
-    const key = KSUID.randomSync().string;
-    await storeFile(
-      content,
-      key,
-      this._filename,
-      this._contentType,
-      this.size,
-      expires
-    );
-    return new File({
-      key,
-      size: this.size,
-      filename: this.filename,
-      contentType: this.contentType
-    });
-  }
-};
-var File = class _File extends InlineFile {
-  static {
-    __name(this, "File");
-  }
-  constructor(input) {
-    super({
-      filename: input.filename || "",
-      contentType: input.contentType || ""
-    });
-    this._key = input.key || "";
-    this._size = input.size || 0;
-  }
-  // Creates a new instance from the database record
-  static fromDbRecord(input) {
-    return new _File({
-      key: input.key,
-      filename: input.filename,
-      size: input.size,
-      contentType: input.contentType
-    });
-  }
-  get size() {
-    return this._size;
-  }
-  // Gets the stored key
-  get key() {
-    return this._key;
-  }
-  get isPublic() {
-    return false;
-  }
-  async read() {
-    if (this._contents) {
-      const arrayBuffer = await this._contents.arrayBuffer();
-      return Buffer.from(arrayBuffer);
-    }
-    if (!s3Client) {
-      throw new Error("S3 client is required");
-    }
-    const params = {
-      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-      Key: "files/" + this.key
-    };
-    const command = new GetObjectCommand(params);
-    const response = await s3Client.send(command);
-    const blob = await response.Body.transformToByteArray();
-    return Buffer.from(blob);
-  }
-  async store(expires = null) {
-    if (this._contents) {
-      const contents = await this.read();
-      await storeFile(
-        contents,
-        this.key,
-        this.filename,
-        this.contentType,
-        this.size,
-        expires
-      );
-    }
-    return this;
-  }
-  // Generates a presigned download URL
-  async getPresignedUrl() {
-    if (!s3Client) {
-      throw new Error("S3 client is required");
-    }
-    const command = new GetObjectCommand({
-      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-      Key: "files/" + this.key,
-      ResponseContentDisposition: "inline"
-    });
-    const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
-    return rewriteFilesDomain(new URL(url));
-  }
-  // Generates a presigned upload URL. If the file doesn't have a key, a new one will be generated
-  async getPresignedUploadUrl() {
-    if (!s3Client) {
-      throw new Error("S3 client is required");
-    }
-    if (!this.key) {
-      this._key = KSUID.randomSync().string;
-    }
-    const command = new PutObjectCommand({
-      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-      Key: "files/" + this.key
-    });
-    const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
-    return rewriteFilesDomain(new URL(url));
-  }
-  // Persists the file
-  toDbRecord() {
-    return {
-      key: this.key,
-      filename: this.filename,
-      contentType: this.contentType,
-      size: this.size
-    };
-  }
-  toJSON() {
-    return this.toDbRecord();
-  }
-};
-async function storeFile(contents, key, filename, contentType, size, expires) {
-  if (!s3Client) {
-    throw new Error("S3 client is required");
-  }
-  const params = {
-    Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-    Key: "files/" + key,
-    Body: contents,
-    ContentType: contentType,
-    ContentDisposition: `attachment; filename="${encodeURIComponent(
-      filename
-    )}"`,
-    Metadata: {
-      filename
-    },
-    ACL: "private"
-  };
-  if (expires) {
-    if (expires instanceof Date) {
-      params.Expires = expires;
-    } else {
-      console.warn("Invalid expires value. Skipping Expires parameter.");
-    }
-  }
-  const command = new PutObjectCommand(params);
-  try {
-    await s3Client.send(command);
-  } catch (error) {
-    console.error("Error uploading file:", error);
-    throw error;
-  }
-}
-__name(storeFile, "storeFile");
-
 // src/parsing.js
+init_File();
 var dateFormat = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
 function parseInputs(inputs) {
   if (inputs != null && typeof inputs === "object") {
@@ -1103,23 +1189,23 @@ var TimePeriod = class _TimePeriod {
     return new _TimePeriod(period, value, offset, complete2);
   }
   periodStartSQL() {
-    let sql4 = "NOW()";
+    let sql5 = "NOW()";
     if (this.offset !== 0) {
-      sql4 = `${sql4} + INTERVAL '${this.offset} ${this.period}'`;
+      sql5 = `${sql5} + INTERVAL '${this.offset} ${this.period}'`;
     }
     if (this.complete) {
-      sql4 = `DATE_TRUNC('${this.period}', ${sql4})`;
+      sql5 = `DATE_TRUNC('${this.period}', ${sql5})`;
     } else {
-      sql4 = `(${sql4})`;
+      sql5 = `(${sql5})`;
     }
-    return sql4;
+    return sql5;
   }
   periodEndSQL() {
-    let sql4 = this.periodStartSQL();
+    let sql5 = this.periodStartSQL();
     if (this.value != 0) {
-      sql4 = `(${sql4} + INTERVAL '${this.value} ${this.period}')`;
+      sql5 = `(${sql5} + INTERVAL '${this.value} ${this.period}')`;
     }
-    return sql4;
+    return sql5;
   }
 };
 
@@ -1833,6 +1919,7 @@ var QueryBuilder = class _QueryBuilder {
 };
 
 // src/ModelAPI.js
+init_File();
 var ModelAPI = class {
   static {
     __name(this, "ModelAPI");
@@ -1842,9 +1929,10 @@ var ModelAPI = class {
    * @param {Function} _ Used to be a function that returns the default values for a row in this table. No longer used.
    * @param {TableConfigMap} tableConfigMap
    */
-  constructor(tableName, _, tableConfigMap = {}) {
+  constructor(tableName, _, tableConfigMap = {}, fileFieldsMap = {}) {
     this._tableName = tableName;
     this._tableConfigMap = tableConfigMap;
+    this._fileFields = fileFieldsMap[tableName] || {};
     this._modelName = upperCamelCase(this._tableName);
   }
   async create(values) {
@@ -1914,6 +2002,10 @@ var ModelAPI = class {
     const name = spanNameForModelAPI(this._modelName, "update");
     const db = useDatabase();
     return withSpan(name, async (span) => {
+      const fileColumns = Object.keys(values || {}).filter(
+        (k) => k in this._fileFields
+      );
+      const existingFileRows = fileColumns.length > 0 ? await this._selectExistingFileValues(where, fileColumns) : [];
       let builder = db.updateTable(this._tableName).returningAll();
       const keys = values ? Object.keys(values) : [];
       const row = {};
@@ -1952,7 +2044,9 @@ var ModelAPI = class {
       span.setAttribute("sql", builder.compile().sql);
       try {
         const row2 = await builder.executeTakeFirstOrThrow();
-        return transformRichDataTypes(camelCaseObject(row2));
+        const result = transformRichDataTypes(camelCaseObject(row2));
+        this._deferReplacedFiles(existingFileRows, fileColumns, result);
+        return result;
       } catch (e) {
         throw new DatabaseError(e);
       }
@@ -1962,12 +2056,15 @@ var ModelAPI = class {
     const name = spanNameForModelAPI(this._modelName, "delete");
     const db = useDatabase();
     return withSpan(name, async (span) => {
+      const fileColumns = Object.keys(this._fileFields);
+      const existingFileRows = fileColumns.length > 0 ? await this._selectExistingFileValues(where, fileColumns) : [];
       let builder = db.deleteFrom(this._tableName).returning(["id"]);
       const context7 = new QueryContext([this._tableName], this._tableConfigMap);
       builder = applyWhereConditions(context7, builder, where);
       span.setAttribute("sql", builder.compile().sql);
       try {
         const row = await builder.executeTakeFirstOrThrow();
+        this._deferReplacedFiles(existingFileRows, fileColumns, null);
         return row.id;
       } catch (e) {
         throw new DatabaseError(e);
@@ -1982,6 +2079,30 @@ var ModelAPI = class {
     builder = applyWhereConditions(context7, builder, where);
     return new QueryBuilder(this._tableName, context7, builder);
   }
+  // Reads the current file-column values for rows matched by `where`.
+  async _selectExistingFileValues(where, fileColumns) {
+    if (fileColumns.length === 0) {
+      return [];
+    }
+    const db = useDatabase();
+    let builder = db.selectFrom(this._tableName).selectAll(this._tableName);
+    const context7 = new QueryContext([this._tableName], this._tableConfigMap);
+    builder = applyWhereConditions(context7, builder, where);
+    const rows = await builder.execute();
+    return rows.map((x) => transformRichDataTypes(camelCaseObject(x)));
+  }
+  // Defers deletion of every old file key in existingRows that is not still
+  // referenced by newRow.
+  _deferReplacedFiles(existingRows, fileColumns, newRow) {
+    const retained = new Set(
+      collectFileKeys(newRow ? [newRow] : [], fileColumns)
+    );
+    for (const key of collectFileKeys(existingRows, fileColumns)) {
+      if (!retained.has(key)) {
+        deferFileDeletion(key);
+      }
+    }
+  }
 };
 async function create(conn, tableName, tableConfigs, values) {
   try {
@@ -2091,6 +2212,23 @@ async function create(conn, tableName, tableConfigs, values) {
   }
 }
 __name(create, "create");
+function collectFileKeys(rows, fileColumns) {
+  const keys = [];
+  for (const row of rows || []) {
+    if (!row) continue;
+    for (const col of fileColumns) {
+      const v = row[col];
+      if (!v) continue;
+      if (Array.isArray(v)) {
+        for (const f of v) if (f?.key) keys.push(f.key);
+      } else if (v.key) {
+        keys.push(v.key);
+      }
+    }
+  }
+  return keys;
+}
+__name(collectFileKeys, "collectFileKeys");
 
 // src/TaskAPI.js
 import jwt from "jsonwebtoken";
@@ -2636,6 +2774,51 @@ var FlowsAPI = class _FlowsAPI {
       );
     });
   }
+  /**
+   * Mints a signed link that lets an external, unauthenticated actor execute this flow. The flow
+   * must be declared with @externalAccess. Each time the link is opened a fresh flow run is created;
+   * a reusable link can be opened many times, otherwise it permits exactly one run.
+   * @param {Object} [options] Signed link options
+   * @param {Object} [options.inputs] Default inputs applied to every run created from the link
+   * @param {Date} [options.expiresAt] When the link stops being valid
+   * @param {boolean} [options.reusable] Whether the link can be opened more than once
+   * @returns {Promise<{url: string, expiresAt: Date|null, flow: {name: string, runId: string|null}}>} The signed link
+   */
+  async signedLink(options = {}) {
+    const name = spanNameForModelAPI(this._flowName, "signedLink");
+    return withSpan(name, async () => {
+      const apiUrl = getApiUrl2();
+      const url = `${apiUrl}/flows/json/${encodeURIComponent(
+        this._flowName
+      )}/share`;
+      const body = {};
+      if (options.inputs !== void 0) body.inputs = options.inputs;
+      if (options.reusable !== void 0) body.reusable = options.reusable;
+      if (options.expiresAt !== void 0 && options.expiresAt !== null) {
+        body.expiresAt = options.expiresAt instanceof Date ? options.expiresAt.toISOString() : options.expiresAt;
+      }
+      const response = await fetch(url, {
+        method: "POST",
+        headers: buildHeaders2(this._identity, this._authToken),
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        const errorBody = await response.json().catch(() => ({}));
+        throw new Error(
+          `Failed to create signed link: ${response.status} ${response.statusText} - ${errorBody.message || JSON.stringify(errorBody)}`
+        );
+      }
+      const result = await response.json();
+      return {
+        url: result.url,
+        expiresAt: result.expiresAt ? new Date(result.expiresAt) : null,
+        flow: {
+          name: result.flow?.name ?? this._flowName,
+          runId: result.flow?.runId ?? null
+        }
+      };
+    });
+  }
   /**
    * Gets a flow run by ID.
    * @param {string} runId The flow run ID
@@ -2717,6 +2900,61 @@ var FlowsAPI = class _FlowsAPI {
   }
 };
 
+// src/integrationServer.js
+import jwt3 from "jsonwebtoken";
+function buildHeaders3(identity) {
+  const headers = { "Content-Type": "application/json" };
+  const base64pk = process.env.KEEL_PRIVATE_KEY;
+  if (!base64pk) {
+    throw new Error(
+      "KEEL_PRIVATE_KEY is not set; cannot sign the integration proxy token"
+    );
+  }
+  const privateKey = Buffer.from(base64pk, "base64").toString("utf8");
+  const subject = identity && identity.id ? identity.id : "integration-proxy";
+  headers["Authorization"] = "Bearer " + jwt3.sign({}, privateKey, {
+    algorithm: "RS256",
+    expiresIn: 60 * 60 * 24,
+    subject,
+    // Scope the token to the integration proxy so it can't be mistaken for an ordinary user
+    // access token; the runtime proxy verifies this audience before injecting credentials.
+    audience: "integration-proxy",
+    issuer: "https://keel.so"
+  });
+  return headers;
+}
+__name(buildHeaders3, "buildHeaders");
+function getApiUrl3() {
+  const apiUrl = process.env.KEEL_API_URL;
+  if (!apiUrl) {
+    throw new Error("KEEL_API_URL environment variable is not set");
+  }
+  return apiUrl;
+}
+__name(getApiUrl3, "getApiUrl");
+function createIntegrationServer(name, identity) {
+  return {
+    do: /* @__PURE__ */ __name(async (request) => {
+      const url = `${getApiUrl3()}/integrations/${encodeURIComponent(
+        name
+      )}/proxy`;
+      const response = await fetch(url, {
+        method: "POST",
+        headers: buildHeaders3(identity ?? null),
+        body: JSON.stringify(request ?? {})
+      });
+      if (!response.ok) {
+        const text = await response.text();
+        throw new Error(
+          `integration "${name}" proxy request failed (${response.status}): ${text}`
+        );
+      }
+      return await response.json();
+    }, "do")
+  };
+}
+__name(createIntegrationServer, "createIntegrationServer");
+
 // src/RequestHeaders.ts
 var RequestHeaders = class {
   /**
@@ -3917,6 +4155,7 @@ var datePickerInput = /* @__PURE__ */ __name((name, options) => {
 }, "datePickerInput");
 
 // src/flows/ui/elements/input/file.ts
+init_File();
 var fileInput = /* @__PURE__ */ __name((name, options) => {
   return {
     __type: "input",
@@ -3942,6 +4181,7 @@ var fileInput = /* @__PURE__ */ __name((name, options) => {
 }, "fileInput");
 
 // src/flows/ui/elements/input/imageCapture.ts
+init_File();
 var isMultiOptions = /* @__PURE__ */ __name((opts) => opts && opts.mode === "multi", "isMultiOptions");
 function validateEntry(entry, requireCaption, context7) {
   if (!entry?.file?.key) {
@@ -4174,6 +4414,233 @@ var file = /* @__PURE__ */ __name(async (options) => {
 }, "file");
 
 // src/flows/index.ts
+import { sql as sql4 } from "kysely";
+
+// src/agents/engine.ts
+var ENGINE = Symbol.for("keel.agents.engine");
+var ScriptedEngine = class {
+  constructor(script) {
+    this.script = script;
+    this._requests = [];
+    this.index = 0;
+  }
+  static {
+    __name(this, "ScriptedEngine");
+  }
+  get requests() {
+    return this._requests;
+  }
+  async turn(req) {
+    this._requests.push(req);
+    if (this.index >= this.script.length) {
+      throw new Error(
+        `ScriptedEngine: no scripted result for turn ${this.index + 1}`
+      );
+    }
+    const entry = this.script[this.index++];
+    return typeof entry === "function" ? entry(req) : entry;
+  }
+};
+var callCounter = 0;
+var scriptedTurn = {
+  text(text) {
+    return {
+      text,
+      toolCalls: [],
+      usage: { inputTokens: 0, outputTokens: 0 },
+      stopReason: "end_turn"
+    };
+  },
+  /** Auto-generated ids increment per process — pass an explicit `id` when asserting on ids in tests. */
+  toolCall(name, args, id) {
+    return {
+      text: "",
+      toolCalls: [
+        { id: id ?? `call_${name}_${++callCounter}`, name, arguments: args }
+      ],
+      usage: { inputTokens: 0, outputTokens: 0 },
+      stopReason: "tool_calls"
+    };
+  }
+};
+
+// src/agents/engineResolver.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// src/agents/aiSdkEngine.ts
+import {
+  generateText,
+  jsonSchema,
+  tool,
+  stepCountIs
+} from "ai";
+import { createAnthropic } from "@ai-sdk/anthropic";
+var AiSdkEngine = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  static {
+    __name(this, "AiSdkEngine");
+  }
+  // Exposed as a method (not arrow function) so tests can monkey-patch at the
+  // instance level: (engine as any).resolveModel = () => mockModel(...)
+  resolveModel(model) {
+    const slash = model.indexOf("/");
+    const provider = slash === -1 ? "anthropic" : model.slice(0, slash);
+    const id = slash === -1 ? model : model.slice(slash + 1);
+    if (provider !== "anthropic") {
+      throw new Error(
+        `Unsupported provider "${provider}" in model "${model}" \u2014 only anthropic/* is supported in this milestone`
+      );
+    }
+    const baseURL = this.opts.baseURL ?? "https://api.anthropic.com/v1";
+    if (this.opts.authToken) {
+      return createAnthropic({
+        apiKey: "unused",
+        baseURL,
+        headers: {
+          "x-api-key": "",
+          authorization: `Bearer ${this.opts.authToken}`,
+          "anthropic-beta": "oauth-2025-04-20"
+        }
+      })(id);
+    }
+    if (!this.opts.apiKey) {
+      throw new Error("AiSdkEngine requires an apiKey or authToken");
+    }
+    return createAnthropic({
+      apiKey: this.opts.apiKey,
+      baseURL
+    })(id);
+  }
+  async turn(req) {
+    const model = this.resolveModel(req.model);
+    const tools = {};
+    for (const spec of req.tools ?? []) {
+      tools[spec.name] = tool({
+        description: spec.description,
+        inputSchema: jsonSchema(
+          spec.parameters
+        )
+      });
+    }
+    let toolChoice;
+    if (req.toolChoice === "auto") {
+      toolChoice = "auto";
+    } else if (req.toolChoice && typeof req.toolChoice === "object") {
+      toolChoice = { type: "tool", toolName: req.toolChoice.name };
+    }
+    const messages = req.messages.map((msg) => {
+      if (msg.role === "user") {
+        return { role: "user", content: msg.content };
+      }
+      if (msg.role === "assistant") {
+        const content = [];
+        if (msg.content) {
+          content.push({ type: "text", text: msg.content });
+        }
+        for (const tc of msg.toolCalls ?? []) {
+          content.push({
+            type: "tool-call",
+            toolCallId: tc.id,
+            toolName: tc.name,
+            input: tc.arguments
+          });
+        }
+        return { role: "assistant", content };
+      }
+      return {
+        role: "tool",
+        content: [
+          {
+            type: "tool-result",
+            toolCallId: msg.toolCallId,
+            toolName: msg.toolName,
+            output: { type: "text", value: msg.result }
+          }
+        ]
+      };
+    });
+    let res;
+    try {
+      res = await generateText({
+        model,
+        system: req.system,
+        messages,
+        tools: Object.keys(tools).length > 0 ? tools : void 0,
+        toolChoice,
+        stopWhen: stepCountIs(1)
+      });
+    } catch (e) {
+      throw new Error(describeAiError(e));
+    }
+    const toolCalls = res.toolCalls.map((tc) => ({
+      id: tc.toolCallId,
+      name: tc.toolName,
+      arguments: tc.input
+    }));
+    return {
+      text: res.text,
+      toolCalls,
+      usage: {
+        inputTokens: res.usage.inputTokens ?? 0,
+        outputTokens: res.usage.outputTokens ?? 0
+      },
+      stopReason: toolCalls.length > 0 ? "tool_calls" : "end_turn"
+    };
+  }
+};
+function describeAiError(e) {
+  const errors = e?.errors;
+  const last = errors && errors.length > 0 ? errors[errors.length - 1] : e;
+  const err = last;
+  let msg = "LLM request failed";
+  if (err?.statusCode) msg += ` (HTTP ${err.statusCode})`;
+  const detail = err?.responseBody?.slice(0, 300) || (err?.message && err.message !== "Error" ? err.message : void 0);
+  if (detail) msg += `: ${detail}`;
+  if (err?.url) msg += ` [${err.url}]`;
+  return msg;
+}
+__name(describeAiError, "describeAiError");
+
+// src/agents/engineResolver.ts
+var _fileScriptedEngine;
+function resolveEngine(injected, secrets) {
+  if (injected) return injected;
+  const scriptPath = process.env.FAKE_LLM_SCRIPT;
+  if (scriptPath) {
+    if (!_fileScriptedEngine || _fileScriptedEngine.path !== scriptPath) {
+      const script = JSON.parse(readFileSync2(scriptPath, "utf8"));
+      _fileScriptedEngine = {
+        path: scriptPath,
+        engine: new ScriptedEngine(script)
+      };
+    }
+    return _fileScriptedEngine.engine;
+  }
+  const key = secrets?.["ANTHROPIC_API_KEY"];
+  if (!key) {
+    throw new Error(
+      "No LLM engine available \u2014 set the ANTHROPIC_API_KEY secret, or inject an engine in tests"
+    );
+  }
+  if (key.startsWith("sk-ant-oat")) {
+    return new AiSdkEngine({ authToken: key });
+  }
+  return new AiSdkEngine({ apiKey: key });
+}
+__name(resolveEngine, "resolveEngine");
+function resolveEngineForContext(context7) {
+  const get = context7?.[ENGINE];
+  if (typeof get !== "function") {
+    throw new Error("An LLM engine is only available within a flow context");
+  }
+  return get();
+}
+__name(resolveEngineForContext, "resolveEngineForContext");
+
+// src/flows/index.ts
+import KSUID2 from "ksuid";
 var STEP_STATUS = /* @__PURE__ */ ((STEP_STATUS2) => {
   STEP_STATUS2["NEW"] = "NEW";
   STEP_STATUS2["RUNNING"] = "RUNNING";
@@ -4210,28 +4677,30 @@ var defaultOpts = {
 async function insertNewStep(db, runId, name, stage) {
   await db.transaction().execute(async (trx) => {
     await trx.selectFrom("keel.flow_run").select("id").where("id", "=", runId).forUpdate().executeTakeFirst();
-    const existing = await trx.selectFrom("keel.flow_step").select("id").where("run_id", "=", runId).where("name", "=", name).where("status", "=", "NEW" /* NEW */).executeTakeFirst();
+    const existing = await trx.selectFrom("keel.flow_step").select("id").where("run_id", "=", runId).where("name", "=", name).where("status", "in", ["NEW" /* NEW */, "RUNNING" /* RUNNING */]).executeTakeFirst();
     if (existing) {
       return;
     }
     await trx.insertInto("keel.flow_step").values({
+      id: KSUID2.randomSync().string,
       run_id: runId,
       name,
       stage,
       status: "NEW" /* NEW */,
       type: "FUNCTION" /* FUNCTION */
-    }).execute();
+    }).returningAll().executeTakeFirst();
   });
 }
 __name(insertNewStep, "insertNewStep");
 function createFlowContext(runId, data, action, callback, element, spanId, ctx) {
   const usedNames = /* @__PURE__ */ new Set();
-  return {
+  const context7 = {
     identity: ctx.identity,
     env: ctx.env,
     now: ctx.now,
     secrets: ctx.secrets,
     trace: ctx.trace,
+    module: ctx.module,
     complete: /* @__PURE__ */ __name((options) => {
       return {
         __type: "ui.complete",
@@ -4251,6 +4720,7 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
           if (usedNames.has(name)) {
             span.setAttribute("step.status", "FAILED" /* FAILED */);
             await db.insertInto("keel.flow_step").values({
+              id: KSUID2.randomSync().string,
               run_id: runId,
               name,
               stage: options.stage,
@@ -4263,7 +4733,7 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             throw new Error(`Duplicate step name: ${name}`);
           }
           usedNames.add(name);
-          const past = await db.selectFrom("keel.flow_step").where("run_id", "=", runId).where("name", "=", name).selectAll().execute();
+          const past = await db.selectFrom("keel.flow_step").where("run_id", "=", runId).where("name", "=", name).selectAll().select(sql4`value::text`.as("valueRaw")).execute();
           const newSteps = past.filter(
             (step) => step.status === "NEW" /* NEW */
           );
@@ -4290,7 +4760,13 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
           if (completedSteps.length === 1) {
             span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
             span.setAttribute("step.status", "COMPLETED" /* COMPLETED */);
-            return completedSteps[0].value;
+            const raw = completedSteps[0].valueRaw;
+            return raw == null ? void 0 : JSON.parse(raw);
+          }
+          if (runningSteps.length >= 1) {
+            span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
+            span.setAttribute("step.status", "RUNNING" /* RUNNING */);
+            throw new StepCreatedDisrupt();
           }
           if (newSteps.length === 1) {
             let result = null;
@@ -4316,7 +4792,14 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
                 endTime: /* @__PURE__ */ new Date(),
                 error: e instanceof Error ? e.message : "An error occurred"
               }).where("id", "=", newSteps[0].id).returningAll().executeTakeFirst();
-              if (failedSteps.length >= options.retries || e instanceof NonRetriableError) {
+              if (e instanceof NonRetriableError) {
+                span.setAttribute("step.status", "FAILED" /* FAILED */);
+                if (options.onFailure) {
+                  await options.onFailure();
+                }
+                throw e;
+              }
+              if (failedSteps.length >= options.retries) {
                 span.setAttribute("step.status", "FAILED" /* FAILED */);
                 if (options.onFailure) {
                   await options.onFailure();
@@ -4340,11 +4823,6 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             span.setAttribute("step.status", "COMPLETED" /* COMPLETED */);
             return result;
           }
-          if (runningSteps.length >= 1) {
-            span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
-            span.setAttribute("step.status", "RUNNING" /* RUNNING */);
-            throw new StepCreatedDisrupt();
-          }
           await insertNewStep(db, runId, name, options.stage);
           span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
           span.setAttribute("step.status", "NEW" /* NEW */);
@@ -4363,6 +4841,7 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             if (usedNames.has(name)) {
               span.setAttribute("step.status", "FAILED" /* FAILED */);
               await db.insertInto("keel.flow_step").values({
+                id: KSUID2.randomSync().string,
                 run_id: runId,
                 name,
                 stage: options.stage,
@@ -4377,11 +4856,12 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             usedNames.add(name);
             const { step, inserted } = await db.transaction().execute(async (trx) => {
               await trx.selectFrom("keel.flow_run").select("id").where("id", "=", runId).forUpdate().executeTakeFirst();
-              const existing = await trx.selectFrom("keel.flow_step").where("run_id", "=", runId).where("name", "=", name).selectAll().executeTakeFirst();
+              const existing = await trx.selectFrom("keel.flow_step").where("run_id", "=", runId).where("name", "=", name).selectAll().select(sql4`value::text`.as("valueRaw")).executeTakeFirst();
               if (existing) {
                 return { step: existing, inserted: false };
               }
               const created = await trx.insertInto("keel.flow_step").values({
+                id: KSUID2.randomSync().string,
                 run_id: runId,
                 name,
                 stage: options.stage,
@@ -4394,9 +4874,11 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             if (step && step.status === "COMPLETED" /* COMPLETED */) {
               span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
               span.setAttribute("step.status", "COMPLETED" /* COMPLETED */);
+              const rawValue = step.valueRaw;
+              const storedData = rawValue == null ? null : JSON.parse(rawValue);
               const parsedData2 = await applyElementGetData(
                 options.content,
-                transformRichDataTypes(step.value)
+                transformRichDataTypes(storedData)
               );
               if (step.action) {
                 return { data: parsedData2, action: step.action };
@@ -4512,6 +4994,8 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
       }
     }
   };
+  context7[ENGINE] = () => resolveEngine(ctx.engine, ctx.secrets);
+  return context7;
 }
 __name(createFlowContext, "createFlowContext");
 function wait(milliseconds) {
@@ -4718,19 +5202,558 @@ async function handleFlow(request, config) {
 __name(handleFlow, "handleFlow");
 
 // src/index.ts
-import KSUID2 from "ksuid";
+import KSUID4 from "ksuid";
+init_File();
+
+// src/notifications/email-template.tsx
+import {
+  Html,
+  Head,
+  Body,
+  Container,
+  Heading,
+  Text,
+  Button,
+  Section
+} from "@react-email/components";
+import { render } from "@react-email/render";
+import { jsx, jsxs } from "react/jsx-runtime";
+function renderBody(text) {
+  return text.split("\n").flatMap((line, i) => i === 0 ? [line] : [/* @__PURE__ */ jsx("br", {}, `br-${i}`), line]);
+}
+__name(renderBody, "renderBody");
+var StockEmailTemplate = /* @__PURE__ */ __name(({ content }) => /* @__PURE__ */ jsxs(Html, { children: [
+  /* @__PURE__ */ jsx(Head, {}),
+  /* @__PURE__ */ jsx(
+    Body,
+    {
+      style: {
+        backgroundColor: "#f6f6f6",
+        fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif'
+      },
+      children: /* @__PURE__ */ jsxs(
+        Container,
+        {
+          style: {
+            backgroundColor: "#ffffff",
+            margin: "40px auto",
+            padding: "40px",
+            maxWidth: "560px",
+            borderRadius: "8px"
+          },
+          children: [
+            content.title && /* @__PURE__ */ jsx(
+              Heading,
+              {
+                style: {
+                  fontSize: "22px",
+                  fontWeight: 600,
+                  color: "#111827",
+                  margin: "0 0 16px"
+                },
+                children: content.title
+              }
+            ),
+            /* @__PURE__ */ jsx(
+              Text,
+              {
+                style: {
+                  fontSize: "15px",
+                  lineHeight: "1.6",
+                  color: "#374151",
+                  margin: "0 0 24px"
+                },
+                children: renderBody(content.body)
+              }
+            ),
+            (content.actions ?? []).length > 0 && /* @__PURE__ */ jsx(Section, { style: { margin: "0 0 12px" }, children: content.actions.map((action, i) => /* @__PURE__ */ jsx(
+              Button,
+              {
+                href: action.url,
+                style: {
+                  backgroundColor: "#111827",
+                  color: "#ffffff",
+                  padding: "12px 24px",
+                  borderRadius: "6px",
+                  fontSize: "14px",
+                  fontWeight: 600,
+                  textDecoration: "none",
+                  display: "inline-block",
+                  // Lay buttons out side by side; space between adjacent buttons.
+                  marginRight: i < content.actions.length - 1 ? "12px" : "0"
+                },
+                children: action.label
+              },
+              i
+            )) })
+          ]
+        }
+      )
+    }
+  )
+] }), "StockEmailTemplate");
+async function renderEmailHtml(content) {
+  return render(/* @__PURE__ */ jsx(StockEmailTemplate, { content }), { pretty: false });
+}
+__name(renderEmailHtml, "renderEmailHtml");
+
+// src/notifications/notify.ts
+import KSUID3 from "ksuid";
+function getApiUrl4() {
+  const apiUrl = process.env.KEEL_API_URL;
+  if (!apiUrl) {
+    throw new Error("KEEL_API_URL environment variable is not set");
+  }
+  return apiUrl;
+}
+__name(getApiUrl4, "getApiUrl");
+function toArray(v) {
+  if (v === void 0) return [];
+  return Array.isArray(v) ? v : [v];
+}
+__name(toArray, "toArray");
+function normaliseGroup(group) {
+  if (!group) return [];
+  const refs = [];
+  for (const email of toArray(group.emails)) {
+    refs.push({ kind: "email", value: email });
+  }
+  for (const user of toArray(group.users)) {
+    refs.push({
+      kind: "user",
+      value: typeof user === "string" ? user : user.id
+    });
+  }
+  for (const identity of toArray(group.identities)) {
+    refs.push({
+      kind: "identity",
+      value: typeof identity === "string" ? identity : identity.id
+    });
+  }
+  for (const team of toArray(group.teams)) {
+    refs.push({ kind: "team", value: team });
+  }
+  return refs;
+}
+__name(normaliseGroup, "normaliseGroup");
+async function notifyEmail(input) {
+  return withSpan("notify.email", async () => {
+    const id = KSUID3.randomSync().string;
+    let rendered;
+    let content;
+    if (typeof input.content === "string") {
+      rendered = input.content;
+      content = void 0;
+    } else {
+      rendered = await renderEmailHtml(input.content);
+      content = input.content;
+    }
+    const body = {
+      id,
+      subject: input.subject,
+      rendered,
+      content,
+      recipients: {
+        to: normaliseGroup(input.recipients.to),
+        cc: normaliseGroup(input.recipients.cc),
+        bcc: normaliseGroup(input.recipients.bcc)
+      }
+    };
+    const response = await fetch(`${getApiUrl4()}/notifications/json/email`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorBody = await response.json().catch(() => ({}));
+      throw new Error(
+        `Failed to send notification: ${response.status} ${response.statusText} - ${errorBody.message || JSON.stringify(errorBody)}`
+      );
+    }
+    await response.body?.cancel();
+    return id;
+  });
+}
+__name(notifyEmail, "notifyEmail");
+function createNotifier() {
+  return { email: notifyEmail };
+}
+__name(createNotifier, "createNotifier");
+
+// src/experimental.ts
+var experimental_exports = {};
+__export(experimental_exports, {
+  AiSdkEngine: () => AiSdkEngine,
+  LlmFlowStep: () => LlmFlowStep,
+  ScriptedEngine: () => ScriptedEngine,
+  defineAgent: () => defineAgent,
+  defineTool: () => defineTool,
+  scriptedTurn: () => scriptedTurn
+});
+
+// src/agents/schema.ts
+function canonicalStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map((v) => v === void 0 ? "null" : canonicalStringify(v)).join(",") + "]";
+  }
+  const sorted = Object.keys(value).sort().filter((k) => value[k] !== void 0).map((k) => JSON.stringify(k) + ":" + canonicalStringify(value[k])).join(",");
+  return "{" + sorted + "}";
+}
+__name(canonicalStringify, "canonicalStringify");
+function canonicalize(value) {
+  if (value === void 0) return value;
+  return JSON.parse(canonicalStringify(value));
+}
+__name(canonicalize, "canonicalize");
+async function validateSchema(schema, value) {
+  let result = schema["~standard"].validate(value);
+  if (result instanceof Promise) result = await result;
+  if (result.issues) {
+    const issues = result.issues.map((i) => {
+      const path = (i.path ?? []).map(
+        (p) => typeof p === "object" && p !== null && "key" in p ? String(p.key) : String(p)
+      ).join(".");
+      return path ? `${path}: ${i.message}` : i.message;
+    }).join("; ");
+    return { ok: false, issues };
+  }
+  return { ok: true, value: result.value };
+}
+__name(validateSchema, "validateSchema");
+async function toJsonSchema(schema) {
+  const vendor = schema["~standard"].vendor;
+  if (vendor === "zod") {
+    const zod = await import("zod");
+    const toJSONSchema = zod.toJSONSchema ?? zod.z?.toJSONSchema;
+    if (typeof toJSONSchema !== "function") {
+      throw new Error(
+        "Deriving a JSON schema from a zod schema requires zod v4"
+      );
+    }
+    return toJSONSchema(schema);
+  }
+  throw new Error(
+    `Unsupported schema vendor "${vendor}" \u2014 agent result/parameter schemas currently support Zod v4`
+  );
+}
+__name(toJsonSchema, "toJsonSchema");
+
+// src/agents/defineAgent.ts
+var AGENT_NAME_RE = /^[A-Za-z][A-Za-z0-9]*$/;
+var runCounters = /* @__PURE__ */ new WeakMap();
+function nextRunNumber(ctx, agentName) {
+  let byName = runCounters.get(ctx);
+  if (!byName) {
+    byName = /* @__PURE__ */ new Map();
+    runCounters.set(ctx, byName);
+  }
+  const n = (byName.get(agentName) ?? 0) + 1;
+  byName.set(agentName, n);
+  return n;
+}
+__name(nextRunNumber, "nextRunNumber");
+async function runAgent(config, ctx, inputs) {
+  const engine = resolveEngineForContext(ctx);
+  const runNumber = nextRunNumber(ctx, config.name);
+  const prefix = `${config.name}#${runNumber}`;
+  const promptContext = await config.beforeRun?.(ctx, { inputs }) ?? {};
+  let system = config.instructions;
+  if (config.result) {
+    system += "\n\nWhen the task is complete you MUST call complete_task with the final result.";
+  }
+  const userTools = config.tools ?? [];
+  const toolSpecs = await Promise.all(
+    userTools.map(async (t) => ({
+      name: t.name,
+      description: t.usage ? `${t.description}
+${t.usage}` : t.description,
+      parameters: await toJsonSchema(t.parameters)
+    }))
+  );
+  if (config.result) {
+    toolSpecs.push({
+      name: "complete_task",
+      description: "Call this when the task is complete, with the final result.",
+      parameters: await toJsonSchema(config.result)
+    });
+  }
+  const toolMap = new Map(
+    userTools.map((t) => [t.name, t])
+  );
+  const messages = [
+    {
+      role: "user",
+      content: config.prompt({ inputs, context: promptContext })
+    }
+  ];
+  const maxTurns = config.maxTurns ?? 10;
+  const maxCompletionNudges = 2;
+  let nudges = 0;
+  for (let turn = 1; turn <= maxTurns; turn++) {
+    const res = canonicalize(
+      await ctx.step(
+        `${prefix}/turn-${turn}/llm`,
+        { retries: 2, timeout: 3e5 },
+        () => engine.turn({
+          model: config.model,
+          system,
+          messages,
+          ...toolSpecs.length ? { tools: toolSpecs } : {}
+        })
+      )
+    );
+    messages.push({
+      role: "assistant",
+      content: res.text,
+      toolCalls: res.toolCalls
+    });
+    const toolCalls = res.toolCalls ?? [];
+    const completeCall = toolCalls.find((c) => c.name === "complete_task");
+    const otherCalls = toolCalls.filter((c) => c.name !== "complete_task");
+    if (completeCall && config.result && otherCalls.length === 0) {
+      const v = await validateSchema(config.result, completeCall.arguments);
+      if (v.ok) {
+        await config.afterRun?.(ctx, v.value);
+        return v.value;
+      }
+      messages.push({
+        role: "tool",
+        toolCallId: completeCall.id,
+        toolName: "complete_task",
+        result: `Validation failed: ${v.issues}. Call complete_task again with corrected arguments.`
+      });
+      continue;
+    }
+    if (res.stopReason === "end_turn") {
+      if (!config.result) {
+        await config.afterRun?.(ctx, res.text);
+        return res.text;
+      }
+      if (++nudges > maxCompletionNudges) {
+        throw new Error(
+          `Agent "${config.name}" finished without calling complete_task after ${maxCompletionNudges} reminders`
+        );
+      }
+      messages.push({
+        role: "user",
+        content: "You must call complete_task with the final result."
+      });
+      continue;
+    }
+    if (completeCall) {
+      messages.push({
+        role: "tool",
+        toolCallId: completeCall.id,
+        toolName: "complete_task",
+        result: config.result ? "complete_task must be the only tool call in a turn. The other tools you called this turn have been run \u2014 review their results, then call complete_task on its own." : `Unknown tool "complete_task" \u2014 available tools: ${userTools.map((t) => t.name).join(", ")}`
+      });
+    }
+    for (let i = 0; i < otherCalls.length; i++) {
+      const call = otherCalls[i];
+      const tool2 = toolMap.get(call.name);
+      if (!tool2) {
+        const available = userTools.map((t) => t.name).join(", ");
+        messages.push({
+          role: "tool",
+          toolCallId: call.id,
+          toolName: call.name,
+          result: `Unknown tool "${call.name}" \u2014 available tools: ${available}`
+        });
+        continue;
+      }
+      const approved = await checkApproval(
+        ctx,
+        prefix,
+        turn,
+        i + 1,
+        tool2,
+        call.arguments
+      );
+      if (!approved) {
+        messages.push({
+          role: "tool",
+          toolCallId: call.id,
+          toolName: call.name,
+          result: `The user rejected this tool call. Do not retry it; choose another course of action.`
+        });
+        continue;
+      }
+      const stepResult = canonicalize(
+        await ctx.step(
+          `${prefix}/turn-${turn}/tool-${i + 1}:${call.name}`,
+          { retries: 2, timeout: 6e4 },
+          async () => {
+            const v = await validateSchema(tool2.parameters, call.arguments);
+            if (!v.ok) {
+              return { ok: false, error: `Invalid arguments: ${v.issues}` };
+            }
+            return { ok: true, value: await tool2.execute(v.value) ?? null };
+          }
+        )
+      );
+      const resultText = stepResult.ok ? canonicalStringify(stepResult.value) : stepResult.error;
+      messages.push({
+        role: "tool",
+        toolCallId: call.id,
+        toolName: call.name,
+        result: resultText
+      });
+    }
+  }
+  throw new Error(`Agent "${config.name}" exceeded maxTurns (${maxTurns})`);
+}
+__name(runAgent, "runAgent");
+async function checkApproval(ctx, prefix, turn, index, tool2, args) {
+  const needsApproval = tool2.approval === true || typeof tool2.approval === "function" && tool2.approval(args);
+  if (!needsApproval) return true;
+  const result = await ctx.ui.page(
+    `${prefix}/turn-${turn}/approve-${index}:${tool2.name}`,
+    {
+      title: `Approve tool call: ${tool2.name}`,
+      content: [
+        ctx.ui.display.markdown({
+          content: `The agent wants to call **${tool2.name}** with:
+
+\`\`\`json
+${canonicalStringify(args)}
+\`\`\``
+        })
+      ],
+      actions: [
+        { label: "Approve", value: "approve" },
+        { label: "Reject", value: "reject" }
+      ]
+    }
+  );
+  return result.action === "approve";
+}
+__name(checkApproval, "checkApproval");
+function defineAgent(config) {
+  if (!AGENT_NAME_RE.test(config.name)) {
+    throw new Error(
+      `Invalid agent name "${config.name}" \u2014 must be alphanumeric PascalCase`
+    );
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const tool2 of config.tools ?? []) {
+    if (names.has(tool2.name)) {
+      throw new Error(
+        `Duplicate tool "${tool2.name}" on agent "${config.name}"`
+      );
+    }
+    names.add(tool2.name);
+  }
+  return Object.freeze({
+    name: config.name,
+    config,
+    run: /* @__PURE__ */ __name((ctx, inputs) => runAgent(config, ctx, inputs), "run")
+  });
+}
+__name(defineAgent, "defineAgent");
+
+// src/agents/defineTool.ts
+var NAME_RE = /^[a-z][a-z0-9_]*$/;
+var RESERVED = /* @__PURE__ */ new Set(["complete_task"]);
+function defineTool(config) {
+  if (!NAME_RE.test(config.name)) {
+    throw new Error(
+      `Invalid tool name "${config.name}" \u2014 must be snake_case ([a-z][a-z0-9_]*)`
+    );
+  }
+  if (RESERVED.has(config.name)) {
+    throw new Error(`Tool name "${config.name}" is reserved`);
+  }
+  return Object.freeze({ ...config });
+}
+__name(defineTool, "defineTool");
+
+// src/agents/llm.ts
+async function LlmFlowStep(ctx, name, options) {
+  const stepValue = await ctx.step(
+    name,
+    { retries: 2, timeout: options.timeout ?? 3e5 },
+    async () => {
+      const engine = resolveEngineForContext(ctx);
+      if (!options.result) {
+        const res = await engine.turn({
+          model: options.model,
+          system: options.system,
+          messages: [{ role: "user", content: options.prompt }]
+        });
+        return res.text;
+      }
+      const parameters = await toJsonSchema(options.result);
+      const messages = [
+        { role: "user", content: options.prompt }
+      ];
+      for (let attempt = 0; attempt < 3; attempt++) {
+        const res = await engine.turn({
+          model: options.model,
+          system: options.system,
+          messages,
+          tools: [
+            {
+              name: "complete_task",
+              description: "Return the final result of the task.",
+              parameters
+            }
+          ],
+          toolChoice: { name: "complete_task" }
+        });
+        const call = res.toolCalls.find((c) => c.name === "complete_task");
+        if (call) {
+          const v = await validateSchema(options.result, call.arguments);
+          if (v.ok) return v.value;
+          messages.push(
+            {
+              role: "assistant",
+              content: res.text,
+              toolCalls: res.toolCalls
+            },
+            {
+              role: "tool",
+              toolCallId: call.id,
+              toolName: "complete_task",
+              result: `Validation failed: ${v.issues}. Call complete_task again with corrected arguments.`
+            }
+          );
+          continue;
+        }
+        messages.push(
+          { role: "assistant", content: res.text },
+          {
+            role: "user",
+            content: "You must call complete_task with the final result."
+          }
+        );
+      }
+      throw new NonRetriableError(
+        `LlmFlowStep("${name}"): result failed validation after 3 attempts`
+      );
+    }
+  );
+  return canonicalize(stepValue);
+}
+__name(LlmFlowStep, "LlmFlowStep");
+
+// src/index.ts
+import { z } from "zod";
 var createTraceAPI2 = createTraceAPI;
 function ksuid() {
-  return KSUID2.randomSync().string;
+  return KSUID4.randomSync().string;
 }
 __name(ksuid, "ksuid");
+var notify = createNotifier();
 export {
   Duration,
   ErrorPresets,
   File,
   FlowsAPI,
   InlineFile,
-  KSUID2 as KSUID,
+  KSUID4 as KSUID,
   ModelAPI,
   NonRetriableError,
   PERMISSION_STATE,
@@ -4745,14 +5768,20 @@ export {
   TaskAPI,
   checkBuiltInPermissions,
   createFlowContext,
+  createIntegrationServer,
+  createNotifier,
   createTraceAPI2 as createTraceAPI,
+  experimental_exports as experimental,
   handleFlow,
   handleJob,
   handleRequest,
   handleRoute,
   handleSubscriber,
+  insertNewStep,
   ksuid,
+  notify,
   tracing_exports as tracing,
-  useDatabase
+  useDatabase,
+  z
 };
 //# sourceMappingURL=index.js.map