@teamkeel/functions-runtime 0.459.0 → 0.460.0

package/dist/index.js

@@ -1,10 +1,336 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/File.ts
+var File_exports = {};
+__export(File_exports, {
+  File: () => File,
+  InlineFile: () => InlineFile,
+  buildContentDisposition: () => buildContentDisposition,
+  deleteStoredFile: () => deleteStoredFile,
+  rewriteFilesDomain: () => rewriteFilesDomain
+});
+import {
+  S3Client,
+  PutObjectCommand,
+  GetObjectCommand,
+  DeleteObjectCommand
+} from "@aws-sdk/client-s3";
+import { fromEnv } from "@aws-sdk/credential-providers";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import KSUID from "ksuid";
+function rewriteFilesDomain(url) {
+  const domain = process.env.KEEL_FILES_DOMAIN;
+  if (domain) {
+    const override = new URL(domain);
+    url.protocol = override.protocol;
+    url.hostname = override.hostname;
+    url.port = override.port;
+    const overridePath = override.pathname.replace(/\/+$/, "");
+    if (overridePath && overridePath !== "/") {
+      url.pathname = overridePath + url.pathname;
+    }
+  }
+  return url;
+}
+function encodeRFC5987(value) {
+  return encodeURIComponent(value).replace(
+    /['()*]/g,
+    (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase()
+  );
+}
+function buildContentDisposition(disposition, filename) {
+  const type = disposition === "attachment" ? "attachment" : "inline";
+  if (!filename || filename.trim() === "") {
+    return type;
+  }
+  const asciiFallback = filename.replace(/[^\x20-\x7e]|["\\]/g, "_");
+  return `${type}; filename="${asciiFallback}"; filename*=UTF-8''${encodeRFC5987(
+    filename
+  )}`;
+}
+async function storeFile(contents, key, filename, contentType, size, expires) {
+  if (!s3Client) {
+    throw new Error("S3 client is required");
+  }
+  const params = {
+    Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+    Key: "files/" + key,
+    Body: contents,
+    ContentType: contentType,
+    ContentDisposition: `attachment; filename="${encodeURIComponent(
+      filename
+    )}"`,
+    Metadata: {
+      filename
+    },
+    ACL: "private"
+  };
+  if (expires) {
+    if (expires instanceof Date) {
+      params.Expires = expires;
+    } else {
+      console.warn("Invalid expires value. Skipping Expires parameter.");
+    }
+  }
+  const command = new PutObjectCommand(params);
+  try {
+    await s3Client.send(command);
+  } catch (error) {
+    console.error("Error uploading file:", error);
+    throw error;
+  }
+}
+async function deleteStoredFile(key) {
+  if (!s3Client) {
+    throw new Error("S3 client is required");
+  }
+  await s3Client.send(
+    new DeleteObjectCommand({
+      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+      Key: "files/" + key
+    })
+  );
+}
+var s3Client, InlineFile, File;
+var init_File = __esm({
+  "src/File.ts"() {
+    "use strict";
+    s3Client = (() => {
+      if (!process.env.KEEL_FILES_BUCKET_NAME) {
+        return null;
+      }
+      const endpoint = process.env.KEEL_S3_ENDPOINT;
+      if (endpoint) {
+        return new S3Client({
+          region: process.env.KEEL_REGION,
+          credentials: {
+            accessKeyId: "keelstorage",
+            secretAccessKey: "keelstorage"
+          },
+          endpoint
+        });
+      }
+      const testEndpoint = process.env.TEST_AWS_ENDPOINT;
+      if (testEndpoint) {
+        return new S3Client({
+          region: process.env.KEEL_REGION,
+          credentials: {
+            accessKeyId: "test",
+            secretAccessKey: "test"
+          },
+          endpointProvider: /* @__PURE__ */ __name(() => {
+            return {
+              url: new URL(testEndpoint)
+            };
+          }, "endpointProvider")
+        });
+      }
+      return new S3Client({
+        region: process.env.KEEL_REGION,
+        credentials: fromEnv()
+      });
+    })();
+    __name(rewriteFilesDomain, "rewriteFilesDomain");
+    __name(encodeRFC5987, "encodeRFC5987");
+    __name(buildContentDisposition, "buildContentDisposition");
+    InlineFile = class _InlineFile {
+      static {
+        __name(this, "InlineFile");
+      }
+      constructor(input) {
+        this._filename = input.filename;
+        this._contentType = input.contentType;
+        this._contents = null;
+      }
+      static fromDataURL(dataURL) {
+        const info = dataURL.split(",")[0].split(":")[1];
+        const data = dataURL.split(",")[1];
+        const mimeType = info.split(";")[0];
+        const name = info.split(";")[1].split("=")[1] || "file";
+        const buffer = Buffer.from(data, "base64");
+        const file2 = new _InlineFile({ filename: name, contentType: mimeType });
+        file2.write(buffer);
+        return file2;
+      }
+      // Gets size of the file's contents in bytes
+      get size() {
+        if (this._contents) {
+          return this._contents.size;
+        }
+        return 0;
+      }
+      // Gets the media type of the file contents
+      get contentType() {
+        return this._contentType;
+      }
+      // Gets the name of the file
+      get filename() {
+        return this._filename;
+      }
+      // Write the files contents from a buffer
+      write(buffer) {
+        this._contents = new Blob([
+          new Uint8Array(
+            buffer.buffer,
+            buffer.byteOffset,
+            buffer.byteLength
+          )
+        ]);
+      }
+      // Reads the contents of the file as a buffer
+      async read() {
+        if (!this._contents) {
+          throw new Error("No contents to read");
+        }
+        const arrayBuffer = await this._contents.arrayBuffer();
+        return Buffer.from(arrayBuffer);
+      }
+      // Persists the file
+      async store(expires = null) {
+        const content = await this.read();
+        const key = KSUID.randomSync().string;
+        await storeFile(
+          content,
+          key,
+          this._filename,
+          this._contentType,
+          this.size,
+          expires
+        );
+        return new File({
+          key,
+          size: this.size,
+          filename: this.filename,
+          contentType: this.contentType
+        });
+      }
+    };
+    File = class _File extends InlineFile {
+      static {
+        __name(this, "File");
+      }
+      constructor(input) {
+        super({
+          filename: input.filename || "",
+          contentType: input.contentType || ""
+        });
+        this._key = input.key || "";
+        this._size = input.size || 0;
+      }
+      // Creates a new instance from the database record
+      static fromDbRecord(input) {
+        return new _File({
+          key: input.key,
+          filename: input.filename,
+          size: input.size,
+          contentType: input.contentType
+        });
+      }
+      get size() {
+        return this._size;
+      }
+      // Gets the stored key
+      get key() {
+        return this._key;
+      }
+      get isPublic() {
+        return false;
+      }
+      async read() {
+        if (this._contents) {
+          const arrayBuffer = await this._contents.arrayBuffer();
+          return Buffer.from(arrayBuffer);
+        }
+        if (!s3Client) {
+          throw new Error("S3 client is required");
+        }
+        const params = {
+          Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+          Key: "files/" + this.key
+        };
+        const command = new GetObjectCommand(params);
+        const response = await s3Client.send(command);
+        const blob = await response.Body.transformToByteArray();
+        return Buffer.from(blob);
+      }
+      async store(expires = null) {
+        if (this._contents) {
+          const contents = await this.read();
+          await storeFile(
+            contents,
+            this.key,
+            this.filename,
+            this.contentType,
+            this.size,
+            expires
+          );
+        }
+        return this;
+      }
+      // Generates a presigned download URL.
+      //
+      // By default the browser previews the file inline and, when saved, uses the
+      // file's own filename. Pass `contentDisposition: "attachment"` to force a
+      // download, or `filename` to override the suggested name.
+      async getPresignedUrl(options) {
+        if (!s3Client) {
+          throw new Error("S3 client is required");
+        }
+        const disposition = options?.contentDisposition ?? "inline";
+        const filename = options?.filename ?? this.filename;
+        const command = new GetObjectCommand({
+          Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+          Key: "files/" + this.key,
+          ResponseContentDisposition: buildContentDisposition(
+            disposition,
+            filename
+          )
+        });
+        const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
+        return rewriteFilesDomain(new URL(url));
+      }
+      // Generates a presigned upload URL. If the file doesn't have a key, a new one will be generated
+      async getPresignedUploadUrl() {
+        if (!s3Client) {
+          throw new Error("S3 client is required");
+        }
+        if (!this.key) {
+          this._key = KSUID.randomSync().string;
+        }
+        const command = new PutObjectCommand({
+          Bucket: process.env.KEEL_FILES_BUCKET_NAME,
+          Key: "files/" + this.key
+        });
+        const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
+        return rewriteFilesDomain(new URL(url));
+      }
+      // Persists the file
+      toDbRecord() {
+        return {
+          key: this.key,
+          filename: this.filename,
+          contentType: this.contentType,
+          size: this.size
+        };
+      }
+      toJSON() {
+        return this.toDbRecord();
+      }
+    };
+    __name(storeFile, "storeFile");
+    __name(deleteStoredFile, "deleteStoredFile");
+  }
+});
+
 // src/ModelAPI.js
 import { sql as sql3 } from "kysely";
 
@@ -72,6 +398,9 @@ var AuditContextPlugin = class {
           const rawNode = sql`set_trace_id(${audit.traceId})`.as(this.traceIdAlias).toOperationNode();
           returning.selections.push(SelectionNode.create(rawNode));
         }
+        if (returning.selections.length === 0) {
+          return { ...args.node };
+        }
         return {
           ...args.node,
           returning
@@ -441,20 +770,44 @@ var KEEL_INTERNAL_CHILDREN = "includeChildrenSpans";
 import WebSocket from "ws";
 import { readFileSync } from "fs";
 var dbInstance = new AsyncLocalStorage2();
+var fileCleanupStore = new AsyncLocalStorage2();
+function deferFileDeletion(key) {
+  fileCleanupStore.getStore()?.add(key);
+}
+__name(deferFileDeletion, "deferFileDeletion");
+async function flushFileDeletions(keys) {
+  if (keys.size === 0) {
+    return;
+  }
+  const { deleteStoredFile: deleteStoredFile2 } = await Promise.resolve().then(() => (init_File(), File_exports));
+  for (const key of keys) {
+    try {
+      await deleteStoredFile2(key);
+    } catch (e) {
+      console.error("failed to delete orphaned file from storage", e);
+    }
+  }
+}
+__name(flushFileDeletions, "flushFileDeletions");
 var vitestDb = null;
 async function withDatabase(db, requiresTransaction, cb) {
+  const pending = /* @__PURE__ */ new Set();
   if (requiresTransaction) {
-    return db.transaction().execute(async (transaction) => {
-      return dbInstance.run(transaction, async () => {
-        return cb({ transaction });
+    const result2 = await db.transaction().execute(async (transaction) => {
+      return dbInstance.run(transaction, () => {
+        return fileCleanupStore.run(pending, () => cb({ transaction }));
       });
     });
+    await flushFileDeletions(pending);
+    return result2;
   }
-  return db.connection().execute(async (sDb) => {
-    return dbInstance.run(sDb, async () => {
-      return cb({ sDb });
+  const result = await db.connection().execute(async (sDb) => {
+    return dbInstance.run(sDb, () => {
+      return fileCleanupStore.run(pending, () => cb({ sDb }));
     });
   });
+  await flushFileDeletions(pending);
+  return result;
 }
 __name(withDatabase, "withDatabase");
 function useDatabase() {
@@ -629,275 +982,8 @@ function getDialect(connString) {
 }
 __name(getDialect, "getDialect");
 
-// src/File.ts
-import {
-  S3Client,
-  PutObjectCommand,
-  GetObjectCommand
-} from "@aws-sdk/client-s3";
-import { fromEnv } from "@aws-sdk/credential-providers";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import KSUID from "ksuid";
-var s3Client = (() => {
-  if (!process.env.KEEL_FILES_BUCKET_NAME) {
-    return null;
-  }
-  const endpoint = process.env.KEEL_S3_ENDPOINT;
-  if (endpoint) {
-    return new S3Client({
-      region: process.env.KEEL_REGION,
-      credentials: {
-        accessKeyId: "keelstorage",
-        secretAccessKey: "keelstorage"
-      },
-      endpoint
-    });
-  }
-  const testEndpoint = process.env.TEST_AWS_ENDPOINT;
-  if (testEndpoint) {
-    return new S3Client({
-      region: process.env.KEEL_REGION,
-      credentials: {
-        accessKeyId: "test",
-        secretAccessKey: "test"
-      },
-      endpointProvider: /* @__PURE__ */ __name(() => {
-        return {
-          url: new URL(testEndpoint)
-        };
-      }, "endpointProvider")
-    });
-  }
-  return new S3Client({
-    region: process.env.KEEL_REGION,
-    credentials: fromEnv()
-  });
-})();
-function rewriteFilesDomain(url) {
-  const domain = process.env.KEEL_FILES_DOMAIN;
-  if (domain) {
-    const override = new URL(domain);
-    url.protocol = override.protocol;
-    url.hostname = override.hostname;
-    url.port = override.port;
-    const overridePath = override.pathname.replace(/\/+$/, "");
-    if (overridePath && overridePath !== "/") {
-      url.pathname = overridePath + url.pathname;
-    }
-  }
-  return url;
-}
-__name(rewriteFilesDomain, "rewriteFilesDomain");
-var InlineFile = class _InlineFile {
-  static {
-    __name(this, "InlineFile");
-  }
-  constructor(input) {
-    this._filename = input.filename;
-    this._contentType = input.contentType;
-    this._contents = null;
-  }
-  static fromDataURL(dataURL) {
-    const info = dataURL.split(",")[0].split(":")[1];
-    const data = dataURL.split(",")[1];
-    const mimeType = info.split(";")[0];
-    const name = info.split(";")[1].split("=")[1] || "file";
-    const buffer = Buffer.from(data, "base64");
-    const file2 = new _InlineFile({ filename: name, contentType: mimeType });
-    file2.write(buffer);
-    return file2;
-  }
-  // Gets size of the file's contents in bytes
-  get size() {
-    if (this._contents) {
-      return this._contents.size;
-    }
-    return 0;
-  }
-  // Gets the media type of the file contents
-  get contentType() {
-    return this._contentType;
-  }
-  // Gets the name of the file
-  get filename() {
-    return this._filename;
-  }
-  // Write the files contents from a buffer
-  write(buffer) {
-    this._contents = new Blob([
-      new Uint8Array(
-        buffer.buffer,
-        buffer.byteOffset,
-        buffer.byteLength
-      )
-    ]);
-  }
-  // Reads the contents of the file as a buffer
-  async read() {
-    if (!this._contents) {
-      throw new Error("No contents to read");
-    }
-    const arrayBuffer = await this._contents.arrayBuffer();
-    return Buffer.from(arrayBuffer);
-  }
-  // Persists the file
-  async store(expires = null) {
-    const content = await this.read();
-    const key = KSUID.randomSync().string;
-    await storeFile(
-      content,
-      key,
-      this._filename,
-      this._contentType,
-      this.size,
-      expires
-    );
-    return new File({
-      key,
-      size: this.size,
-      filename: this.filename,
-      contentType: this.contentType
-    });
-  }
-};
-var File = class _File extends InlineFile {
-  static {
-    __name(this, "File");
-  }
-  constructor(input) {
-    super({
-      filename: input.filename || "",
-      contentType: input.contentType || ""
-    });
-    this._key = input.key || "";
-    this._size = input.size || 0;
-  }
-  // Creates a new instance from the database record
-  static fromDbRecord(input) {
-    return new _File({
-      key: input.key,
-      filename: input.filename,
-      size: input.size,
-      contentType: input.contentType
-    });
-  }
-  get size() {
-    return this._size;
-  }
-  // Gets the stored key
-  get key() {
-    return this._key;
-  }
-  get isPublic() {
-    return false;
-  }
-  async read() {
-    if (this._contents) {
-      const arrayBuffer = await this._contents.arrayBuffer();
-      return Buffer.from(arrayBuffer);
-    }
-    if (!s3Client) {
-      throw new Error("S3 client is required");
-    }
-    const params = {
-      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-      Key: "files/" + this.key
-    };
-    const command = new GetObjectCommand(params);
-    const response = await s3Client.send(command);
-    const blob = await response.Body.transformToByteArray();
-    return Buffer.from(blob);
-  }
-  async store(expires = null) {
-    if (this._contents) {
-      const contents = await this.read();
-      await storeFile(
-        contents,
-        this.key,
-        this.filename,
-        this.contentType,
-        this.size,
-        expires
-      );
-    }
-    return this;
-  }
-  // Generates a presigned download URL
-  async getPresignedUrl() {
-    if (!s3Client) {
-      throw new Error("S3 client is required");
-    }
-    const command = new GetObjectCommand({
-      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-      Key: "files/" + this.key,
-      ResponseContentDisposition: "inline"
-    });
-    const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
-    return rewriteFilesDomain(new URL(url));
-  }
-  // Generates a presigned upload URL. If the file doesn't have a key, a new one will be generated
-  async getPresignedUploadUrl() {
-    if (!s3Client) {
-      throw new Error("S3 client is required");
-    }
-    if (!this.key) {
-      this._key = KSUID.randomSync().string;
-    }
-    const command = new PutObjectCommand({
-      Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-      Key: "files/" + this.key
-    });
-    const url = await getSignedUrl(s3Client, command, { expiresIn: 60 * 60 });
-    return rewriteFilesDomain(new URL(url));
-  }
-  // Persists the file
-  toDbRecord() {
-    return {
-      key: this.key,
-      filename: this.filename,
-      contentType: this.contentType,
-      size: this.size
-    };
-  }
-  toJSON() {
-    return this.toDbRecord();
-  }
-};
-async function storeFile(contents, key, filename, contentType, size, expires) {
-  if (!s3Client) {
-    throw new Error("S3 client is required");
-  }
-  const params = {
-    Bucket: process.env.KEEL_FILES_BUCKET_NAME,
-    Key: "files/" + key,
-    Body: contents,
-    ContentType: contentType,
-    ContentDisposition: `attachment; filename="${encodeURIComponent(
-      filename
-    )}"`,
-    Metadata: {
-      filename
-    },
-    ACL: "private"
-  };
-  if (expires) {
-    if (expires instanceof Date) {
-      params.Expires = expires;
-    } else {
-      console.warn("Invalid expires value. Skipping Expires parameter.");
-    }
-  }
-  const command = new PutObjectCommand(params);
-  try {
-    await s3Client.send(command);
-  } catch (error) {
-    console.error("Error uploading file:", error);
-    throw error;
-  }
-}
-__name(storeFile, "storeFile");
-
 // src/parsing.js
+init_File();
 var dateFormat = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
 function parseInputs(inputs) {
   if (inputs != null && typeof inputs === "object") {
@@ -1833,6 +1919,7 @@ var QueryBuilder = class _QueryBuilder {
 };
 
 // src/ModelAPI.js
+init_File();
 var ModelAPI = class {
   static {
     __name(this, "ModelAPI");
@@ -1842,9 +1929,10 @@ var ModelAPI = class {
    * @param {Function} _ Used to be a function that returns the default values for a row in this table. No longer used.
    * @param {TableConfigMap} tableConfigMap
    */
-  constructor(tableName, _, tableConfigMap = {}) {
+  constructor(tableName, _, tableConfigMap = {}, fileFieldsMap = {}) {
     this._tableName = tableName;
     this._tableConfigMap = tableConfigMap;
+    this._fileFields = fileFieldsMap[tableName] || {};
     this._modelName = upperCamelCase(this._tableName);
   }
   async create(values) {
@@ -1914,6 +2002,10 @@ var ModelAPI = class {
     const name = spanNameForModelAPI(this._modelName, "update");
     const db = useDatabase();
     return withSpan(name, async (span) => {
+      const fileColumns = Object.keys(values || {}).filter(
+        (k) => k in this._fileFields
+      );
+      const existingFileRows = fileColumns.length > 0 ? await this._selectExistingFileValues(where, fileColumns) : [];
       let builder = db.updateTable(this._tableName).returningAll();
       const keys = values ? Object.keys(values) : [];
       const row = {};
@@ -1952,7 +2044,9 @@ var ModelAPI = class {
       span.setAttribute("sql", builder.compile().sql);
       try {
         const row2 = await builder.executeTakeFirstOrThrow();
-        return transformRichDataTypes(camelCaseObject(row2));
+        const result = transformRichDataTypes(camelCaseObject(row2));
+        this._deferReplacedFiles(existingFileRows, fileColumns, result);
+        return result;
       } catch (e) {
         throw new DatabaseError(e);
       }
@@ -1962,12 +2056,15 @@ var ModelAPI = class {
     const name = spanNameForModelAPI(this._modelName, "delete");
     const db = useDatabase();
     return withSpan(name, async (span) => {
+      const fileColumns = Object.keys(this._fileFields);
+      const existingFileRows = fileColumns.length > 0 ? await this._selectExistingFileValues(where, fileColumns) : [];
       let builder = db.deleteFrom(this._tableName).returning(["id"]);
       const context7 = new QueryContext([this._tableName], this._tableConfigMap);
       builder = applyWhereConditions(context7, builder, where);
       span.setAttribute("sql", builder.compile().sql);
       try {
         const row = await builder.executeTakeFirstOrThrow();
+        this._deferReplacedFiles(existingFileRows, fileColumns, null);
         return row.id;
       } catch (e) {
         throw new DatabaseError(e);
@@ -1982,6 +2079,30 @@ var ModelAPI = class {
     builder = applyWhereConditions(context7, builder, where);
     return new QueryBuilder(this._tableName, context7, builder);
   }
+  // Reads the current file-column values for rows matched by `where`.
+  async _selectExistingFileValues(where, fileColumns) {
+    if (fileColumns.length === 0) {
+      return [];
+    }
+    const db = useDatabase();
+    let builder = db.selectFrom(this._tableName).selectAll(this._tableName);
+    const context7 = new QueryContext([this._tableName], this._tableConfigMap);
+    builder = applyWhereConditions(context7, builder, where);
+    const rows = await builder.execute();
+    return rows.map((x) => transformRichDataTypes(camelCaseObject(x)));
+  }
+  // Defers deletion of every old file key in existingRows that is not still
+  // referenced by newRow.
+  _deferReplacedFiles(existingRows, fileColumns, newRow) {
+    const retained = new Set(
+      collectFileKeys(newRow ? [newRow] : [], fileColumns)
+    );
+    for (const key of collectFileKeys(existingRows, fileColumns)) {
+      if (!retained.has(key)) {
+        deferFileDeletion(key);
+      }
+    }
+  }
 };
 async function create(conn, tableName, tableConfigs, values) {
   try {
@@ -2091,6 +2212,23 @@ async function create(conn, tableName, tableConfigs, values) {
   }
 }
 __name(create, "create");
+function collectFileKeys(rows, fileColumns) {
+  const keys = [];
+  for (const row of rows || []) {
+    if (!row) continue;
+    for (const col of fileColumns) {
+      const v = row[col];
+      if (!v) continue;
+      if (Array.isArray(v)) {
+        for (const f of v) if (f?.key) keys.push(f.key);
+      } else if (v.key) {
+        keys.push(v.key);
+      }
+    }
+  }
+  return keys;
+}
+__name(collectFileKeys, "collectFileKeys");
 
 // src/TaskAPI.js
 import jwt from "jsonwebtoken";
@@ -2762,6 +2900,61 @@ var FlowsAPI = class _FlowsAPI {
   }
 };
 
+// src/integrationServer.js
+import jwt3 from "jsonwebtoken";
+function buildHeaders3(identity) {
+  const headers = { "Content-Type": "application/json" };
+  const base64pk = process.env.KEEL_PRIVATE_KEY;
+  if (!base64pk) {
+    throw new Error(
+      "KEEL_PRIVATE_KEY is not set; cannot sign the integration proxy token"
+    );
+  }
+  const privateKey = Buffer.from(base64pk, "base64").toString("utf8");
+  const subject = identity && identity.id ? identity.id : "integration-proxy";
+  headers["Authorization"] = "Bearer " + jwt3.sign({}, privateKey, {
+    algorithm: "RS256",
+    expiresIn: 60 * 60 * 24,
+    subject,
+    // Scope the token to the integration proxy so it can't be mistaken for an ordinary user
+    // access token; the runtime proxy verifies this audience before injecting credentials.
+    audience: "integration-proxy",
+    issuer: "https://keel.so"
+  });
+  return headers;
+}
+__name(buildHeaders3, "buildHeaders");
+function getApiUrl3() {
+  const apiUrl = process.env.KEEL_API_URL;
+  if (!apiUrl) {
+    throw new Error("KEEL_API_URL environment variable is not set");
+  }
+  return apiUrl;
+}
+__name(getApiUrl3, "getApiUrl");
+function createIntegrationServer(name, identity) {
+  return {
+    do: /* @__PURE__ */ __name(async (request) => {
+      const url = `${getApiUrl3()}/integrations/${encodeURIComponent(
+        name
+      )}/proxy`;
+      const response = await fetch(url, {
+        method: "POST",
+        headers: buildHeaders3(identity ?? null),
+        body: JSON.stringify(request ?? {})
+      });
+      if (!response.ok) {
+        const text = await response.text();
+        throw new Error(
+          `integration "${name}" proxy request failed (${response.status}): ${text}`
+        );
+      }
+      return await response.json();
+    }, "do")
+  };
+}
+__name(createIntegrationServer, "createIntegrationServer");
+
 // src/RequestHeaders.ts
 var RequestHeaders = class {
   /**
@@ -3962,6 +4155,7 @@ var datePickerInput = /* @__PURE__ */ __name((name, options) => {
 }, "datePickerInput");
 
 // src/flows/ui/elements/input/file.ts
+init_File();
 var fileInput = /* @__PURE__ */ __name((name, options) => {
   return {
     __type: "input",
@@ -3987,6 +4181,7 @@ var fileInput = /* @__PURE__ */ __name((name, options) => {
 }, "fileInput");
 
 // src/flows/ui/elements/input/imageCapture.ts
+init_File();
 var isMultiOptions = /* @__PURE__ */ __name((opts) => opts && opts.mode === "multi", "isMultiOptions");
 function validateEntry(entry, requireCaption, context7) {
   if (!entry?.file?.key) {
@@ -4482,7 +4677,7 @@ var defaultOpts = {
 async function insertNewStep(db, runId, name, stage) {
   await db.transaction().execute(async (trx) => {
     await trx.selectFrom("keel.flow_run").select("id").where("id", "=", runId).forUpdate().executeTakeFirst();
-    const existing = await trx.selectFrom("keel.flow_step").select("id").where("run_id", "=", runId).where("name", "=", name).where("status", "=", "NEW" /* NEW */).executeTakeFirst();
+    const existing = await trx.selectFrom("keel.flow_step").select("id").where("run_id", "=", runId).where("name", "=", name).where("status", "in", ["NEW" /* NEW */, "RUNNING" /* RUNNING */]).executeTakeFirst();
     if (existing) {
       return;
     }
@@ -4505,6 +4700,7 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
     now: ctx.now,
     secrets: ctx.secrets,
     trace: ctx.trace,
+    module: ctx.module,
     complete: /* @__PURE__ */ __name((options) => {
       return {
         __type: "ui.complete",
@@ -4567,6 +4763,11 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             const raw = completedSteps[0].valueRaw;
             return raw == null ? void 0 : JSON.parse(raw);
           }
+          if (runningSteps.length >= 1) {
+            span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
+            span.setAttribute("step.status", "RUNNING" /* RUNNING */);
+            throw new StepCreatedDisrupt();
+          }
           if (newSteps.length === 1) {
             let result = null;
             const claimed = await db.updateTable("keel.flow_step").set({
@@ -4622,11 +4823,6 @@ function createFlowContext(runId, data, action, callback, element, spanId, ctx)
             span.setAttribute("step.status", "COMPLETED" /* COMPLETED */);
             return result;
           }
-          if (runningSteps.length >= 1) {
-            span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
-            span.setAttribute("step.status", "RUNNING" /* RUNNING */);
-            throw new StepCreatedDisrupt();
-          }
           await insertNewStep(db, runId, name, options.stage);
           span.setAttribute(KEEL_INTERNAL_ATTR, KEEL_INTERNAL_CHILDREN);
           span.setAttribute("step.status", "NEW" /* NEW */);
@@ -5006,7 +5202,183 @@ async function handleFlow(request, config) {
 __name(handleFlow, "handleFlow");
 
 // src/index.ts
+import KSUID4 from "ksuid";
+init_File();
+
+// src/notifications/email-template.tsx
+import {
+  Html,
+  Head,
+  Body,
+  Container,
+  Heading,
+  Text,
+  Button,
+  Section
+} from "@react-email/components";
+import { render } from "@react-email/render";
+import { jsx, jsxs } from "react/jsx-runtime";
+function renderBody(text) {
+  return text.split("\n").flatMap((line, i) => i === 0 ? [line] : [/* @__PURE__ */ jsx("br", {}, `br-${i}`), line]);
+}
+__name(renderBody, "renderBody");
+var StockEmailTemplate = /* @__PURE__ */ __name(({ content }) => /* @__PURE__ */ jsxs(Html, { children: [
+  /* @__PURE__ */ jsx(Head, {}),
+  /* @__PURE__ */ jsx(
+    Body,
+    {
+      style: {
+        backgroundColor: "#f6f6f6",
+        fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif'
+      },
+      children: /* @__PURE__ */ jsxs(
+        Container,
+        {
+          style: {
+            backgroundColor: "#ffffff",
+            margin: "40px auto",
+            padding: "40px",
+            maxWidth: "560px",
+            borderRadius: "8px"
+          },
+          children: [
+            content.title && /* @__PURE__ */ jsx(
+              Heading,
+              {
+                style: {
+                  fontSize: "22px",
+                  fontWeight: 600,
+                  color: "#111827",
+                  margin: "0 0 16px"
+                },
+                children: content.title
+              }
+            ),
+            /* @__PURE__ */ jsx(
+              Text,
+              {
+                style: {
+                  fontSize: "15px",
+                  lineHeight: "1.6",
+                  color: "#374151",
+                  margin: "0 0 24px"
+                },
+                children: renderBody(content.body)
+              }
+            ),
+            (content.actions ?? []).length > 0 && /* @__PURE__ */ jsx(Section, { style: { margin: "0 0 12px" }, children: content.actions.map((action, i) => /* @__PURE__ */ jsx(
+              Button,
+              {
+                href: action.url,
+                style: {
+                  backgroundColor: "#111827",
+                  color: "#ffffff",
+                  padding: "12px 24px",
+                  borderRadius: "6px",
+                  fontSize: "14px",
+                  fontWeight: 600,
+                  textDecoration: "none",
+                  display: "inline-block",
+                  // Lay buttons out side by side; space between adjacent buttons.
+                  marginRight: i < content.actions.length - 1 ? "12px" : "0"
+                },
+                children: action.label
+              },
+              i
+            )) })
+          ]
+        }
+      )
+    }
+  )
+] }), "StockEmailTemplate");
+async function renderEmailHtml(content) {
+  return render(/* @__PURE__ */ jsx(StockEmailTemplate, { content }), { pretty: false });
+}
+__name(renderEmailHtml, "renderEmailHtml");
+
+// src/notifications/notify.ts
 import KSUID3 from "ksuid";
+function getApiUrl4() {
+  const apiUrl = process.env.KEEL_API_URL;
+  if (!apiUrl) {
+    throw new Error("KEEL_API_URL environment variable is not set");
+  }
+  return apiUrl;
+}
+__name(getApiUrl4, "getApiUrl");
+function toArray(v) {
+  if (v === void 0) return [];
+  return Array.isArray(v) ? v : [v];
+}
+__name(toArray, "toArray");
+function normaliseGroup(group) {
+  if (!group) return [];
+  const refs = [];
+  for (const email of toArray(group.emails)) {
+    refs.push({ kind: "email", value: email });
+  }
+  for (const user of toArray(group.users)) {
+    refs.push({
+      kind: "user",
+      value: typeof user === "string" ? user : user.id
+    });
+  }
+  for (const identity of toArray(group.identities)) {
+    refs.push({
+      kind: "identity",
+      value: typeof identity === "string" ? identity : identity.id
+    });
+  }
+  for (const team of toArray(group.teams)) {
+    refs.push({ kind: "team", value: team });
+  }
+  return refs;
+}
+__name(normaliseGroup, "normaliseGroup");
+async function notifyEmail(input) {
+  return withSpan("notify.email", async () => {
+    const id = KSUID3.randomSync().string;
+    let rendered;
+    let content;
+    if (typeof input.content === "string") {
+      rendered = input.content;
+      content = void 0;
+    } else {
+      rendered = await renderEmailHtml(input.content);
+      content = input.content;
+    }
+    const body = {
+      id,
+      subject: input.subject,
+      rendered,
+      content,
+      recipients: {
+        to: normaliseGroup(input.recipients.to),
+        cc: normaliseGroup(input.recipients.cc),
+        bcc: normaliseGroup(input.recipients.bcc)
+      }
+    };
+    const response = await fetch(`${getApiUrl4()}/notifications/json/email`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorBody = await response.json().catch(() => ({}));
+      throw new Error(
+        `Failed to send notification: ${response.status} ${response.statusText} - ${errorBody.message || JSON.stringify(errorBody)}`
+      );
+    }
+    await response.body?.cancel();
+    return id;
+  });
+}
+__name(notifyEmail, "notifyEmail");
+function createNotifier() {
+  return { email: notifyEmail };
+}
+__name(createNotifier, "createNotifier");
 
 // src/experimental.ts
 var experimental_exports = {};
@@ -5371,16 +5743,17 @@ __name(LlmFlowStep, "LlmFlowStep");
 import { z } from "zod";
 var createTraceAPI2 = createTraceAPI;
 function ksuid() {
-  return KSUID3.randomSync().string;
+  return KSUID4.randomSync().string;
 }
 __name(ksuid, "ksuid");
+var notify = createNotifier();
 export {
   Duration,
   ErrorPresets,
   File,
   FlowsAPI,
   InlineFile,
-  KSUID3 as KSUID,
+  KSUID4 as KSUID,
   ModelAPI,
   NonRetriableError,
   PERMISSION_STATE,
@@ -5395,6 +5768,8 @@ export {
   TaskAPI,
   checkBuiltInPermissions,
   createFlowContext,
+  createIntegrationServer,
+  createNotifier,
   createTraceAPI2 as createTraceAPI,
   experimental_exports as experimental,
   handleFlow,
@@ -5402,7 +5777,9 @@ export {
   handleRequest,
   handleRoute,
   handleSubscriber,
+  insertNewStep,
   ksuid,
+  notify,
   tracing_exports as tracing,
   useDatabase,
   z