handoff-app 2.0.0-9 → 2.0.0

package/dist/types/config.d.ts

@@ -115,6 +115,100 @@ export interface ConfigCatalog {
 export type RuntimeMode = 'workspace' | 'registry';
 /** Format used when synthesizing local workspace declarations. */
 export type DeclarationFormat = 'ts' | 'js' | 'cjs';
+/** How a connection's credential is supplied. Declared, never inferred from a missing key. */
+export type AiCredentialKind = 'service' | 'user' | 'none';
+/**
+ * An email option: a literal, baked into the build, or an environment reference, read by the deployed
+ * app at request time.
+ */
+export type HandoffEmailOption<T> = T | RuntimeEnvReference<T>;
+interface HandoffEmailBase {
+    /** Sender address, such as `Handoff <no-reply@example.com>`. Use a profile for per-environment values. */
+    from?: string;
+}
+/** Send through an SMTP server, such as Amazon SES, SendGrid, Postmark, Mailgun or Microsoft 365. */
+export interface HandoffSmtpEmail extends HandoffEmailBase {
+    provider: 'smtp';
+    options: {
+        host: HandoffEmailOption<string>;
+        /** @default 465, or 587 when `secure` is false */
+        port?: HandoffEmailOption<number>;
+        /**
+         * Use TLS from the start of the connection. When false, the connection upgrades with STARTTLS if
+         * the server offers it. @default true, or false when `port` is set to a port other than 465
+         */
+        secure?: HandoffEmailOption<boolean>;
+        user?: HandoffEmailOption<string>;
+        /** Environment reference to the SMTP password. */
+        password?: RuntimeEnvReference<string>;
+    };
+}
+/** Send through a server-only module that default-exports a `defineEmailProvider()` result. */
+export interface HandoffCustomEmail extends HandoffEmailBase {
+    provider: 'custom';
+    /** Server-only module path. It must be its own file so the build can trace it into the deployed registry. */
+    module: string;
+    /**
+     * Options passed to the provider factory. Literals are baked. Environment references are resolved
+     * at request time. `apiKey` and `password` must be environment references.
+     */
+    options?: Record<string, unknown>;
+}
+/** Registry email settings. `provider` selects the shape of `options`. */
+export type HandoffEmailConfig = HandoffSmtpEmail | HandoffCustomEmail;
+/**
+ * One AI connection the deployment declares. Connections are the whole surface: a reader can add a
+ * key for a declared connection and nothing else, so the server never calls a URL a reader chose.
+ *
+ * Every connection speaks the OpenAI-compatible `/chat/completions` API. A provider that fits
+ * nothing else names a server-only `module` instead of a `baseUrl`.
+ */
+export interface HandoffAiConnection {
+    /** Stable id. A model is addressed as `<id>/<model>`. */
+    id: string;
+    /** Name shown to a reader in the model picker and on the account page. */
+    label: string;
+    /** OpenAI-compatible base URL, such as `https://api.openai.com/v1`. Omit only when `module` is set. */
+    baseUrl?: string;
+    /**
+     * Server-only module path default-exporting a `defineAiProvider()` result, for a provider that is
+     * not OpenAI-compatible. It must be its own file so the build can trace it into the deployed
+     * registry.
+     */
+    module?: string;
+    /**
+     * Environment reference to the deployment's own key. Its presence makes the connection a service
+     * key: the deployment pays and every reader can use it. The name is baked; the value is read at
+     * request time and never leaves the server.
+     */
+    apiKey?: RuntimeEnvReference<string>;
+    /**
+     * Set to `'user'` when each reader supplies their own key. Without it, a connection that needs a
+     * reader's key looks like one that needs none, and the reader gets a raw 401 instead of an
+     * instruction.
+     */
+    credential?: 'user';
+    /** The models this connection offers. A reader cannot use a model that is not listed. */
+    models?: string[];
+    /**
+     * Options passed to a `module` provider factory. Literals are baked. Environment references are
+     * resolved at request time, so secrets must be environment references.
+     */
+    options?: Record<string, unknown>;
+}
+/**
+ * The AI assistant block. Presence of the block opts the build in, and `enabled: false` turns it
+ * off. Like `mcp`, `enabled` is config-only and baked at build time, so a build without it leaves
+ * out both the chat route and the header control rather than showing a control that fails.
+ */
+export interface HandoffAiConfig {
+    /** @default true when the `ai` block is present */
+    enabled?: boolean;
+    /** Declared connections. Merged by `id` with any supplied through `HANDOFF_AI_CONNECTIONS`. */
+    connections?: HandoffAiConnection[];
+    /** The `<connectionId>/<model>` used when a reader has not picked one. */
+    defaultModel?: string;
+}
 /**
  * User-facing `runtime` configuration block. A single optional block that selects the runtime
  * mode and carries mode-specific host/connection settings.
@@ -135,6 +229,8 @@ export interface HandoffRuntimeConfig {
      * @default true
      */
     mcp?: boolean;
+    /** The docs AI assistant. Omit the block to leave it out of the build. See {@link HandoffAiConfig}. */
+    ai?: HandoffAiConfig;
     /** Workspace-mode settings. */
     workspace?: {
         entries?: ConfigEntries;
@@ -142,9 +238,9 @@ export interface HandoffRuntimeConfig {
     };
     /** Registry-mode host settings. Env-var values are stored as names, never as secrets. */
     registry?: {
-        /** Environment reference to the database URL. @default fromEnv('DATABASE_URL') */
-        databaseUrl?: RuntimeEnvReference<string>;
         database?: {
+            /** Environment reference to the database URL. @default fromEnv('DATABASE_URL') */
+            url?: RuntimeEnvReference<string>;
             /**
              * PostgreSQL is the supported database. `driver` selects the built-in connection driver — how
              * to connect, not which engine — over the same package-owned Postgres schema and migrations.
@@ -159,20 +255,26 @@ export interface HandoffRuntimeConfig {
          */
         assetStorage?: {
             /**
-             * Active storage provider for new uploads. `database` keeps bytes inline in Postgres; use the
-             * pre-packaged `vercel-blob` adapter or a `custom` module for object storage.
+             * Active storage provider for new uploads. `database` keeps bytes inline in Postgres; use a
+             * `custom` module for object storage.
              * @default "database"
              */
-            adapter?: 'database' | 'vercel-blob' | 'custom';
-            /** For `adapter: "custom"` - server-only module path default-exporting a `defineAssetStorage` adapter. */
+            provider?: 'database' | 'custom';
+            /** For `provider: "custom"` - server-only module path default-exporting a `defineStorageProvider()` result. */
             module?: string;
-            /** For `adapter: "vercel-blob"` - environment reference to the Blob read/write token. @default fromEnv('BLOB_READ_WRITE_TOKEN') */
-            token?: RuntimeEnvReference<string>;
             /** Max bytes kept inline in the database `bytea` column (larger uploads are rejected). @default 4194304 */
             maxInlineBytes?: number;
-            /** Non-secret options, JSON-encoded into the bundle. Environment references are rejected. Pass variable names instead. */
+            /**
+             * Options passed to the provider factory. Literals are baked. Environment references are resolved
+             * at request time, so secrets must be environment references.
+             */
             options?: Record<string, unknown>;
         };
+        /**
+         * Invitation and password-reset email. Email stays off until `from` is set and the required
+         * options of the provider have values. Until then, invitation links are shown to an administrator.
+         */
+        email?: HandoffEmailConfig;
     };
     /**
      * Connected-workspace settings pointing at a remote registry. A connected workspace is
@@ -185,11 +287,18 @@ export interface HandoffRuntimeConfig {
         accessToken?: EnvSecret<string>;
     };
 }
+/** Connections to external services. */
+export interface ConfigIntegrations {
+    /** The Figma file that `fetch` reads foundations from. In a terminal, `fetch` asks for an empty value. */
+    figma?: {
+        /** The Figma file ID. @default fromEnv('HANDOFF_FIGMA_PROJECT_ID', { default: null }) */
+        projectId?: EnvValue<string | null>;
+        /** A Figma personal access token. Accepts only an environment reference. @default fromEnv('HANDOFF_DEV_ACCESS_TOKEN', { default: null }) */
+        accessToken?: EnvSecret<string | null>;
+    };
+}
 export interface Config {
-    dev_access_token?: EnvSecret<string | null>;
-    devAccessToken?: EnvSecret<string | null>;
-    figma_project_id?: EnvValue<string | null>;
-    figmaProjectId?: EnvValue<string | null>;
+    integrations?: ConfigIntegrations;
     exportsOutputDirectory?: EnvValue<string>;
     sitesOutputDirectory?: EnvValue<string>;
     useVariables?: EnvValue<boolean>;
@@ -391,11 +500,13 @@ export interface ClientRuntimeConfig {
     connected: boolean;
 }
 /** Values available after config loading. Deferred references retain their names. */
-export type ResolvedConfig = Omit<Config, 'dev_access_token' | 'devAccessToken' | 'figma_project_id' | 'figmaProjectId' | 'exportsOutputDirectory' | 'sitesOutputDirectory' | 'useVariables' | 'app' | 'runtime'> & {
-    dev_access_token?: string | null;
-    devAccessToken?: string | null;
-    figma_project_id?: string | null;
-    figmaProjectId?: string | null;
+export type ResolvedConfig = Omit<Config, 'integrations' | 'exportsOutputDirectory' | 'sitesOutputDirectory' | 'useVariables' | 'app' | 'runtime'> & {
+    integrations?: {
+        figma?: {
+            projectId?: string | null;
+            accessToken?: string | null;
+        };
+    };
     exportsOutputDirectory?: string;
     sitesOutputDirectory?: string;
     useVariables?: boolean;

package/dist/utils/path.d.ts

@@ -1,8 +1,4 @@
-/**
- * Generates a filesystem-safe directory name from an absolute path
- * @param workingPath - The absolute working path to transform
- * @returns A filesystem-safe string suitable for use as a directory name
- */
+/** `<base name>-<path hash>`; the hash keeps directories with the same base name apart. */
 export declare function generateFilesystemSafeId(workingPath: string): string;
 /**
  * Normalize a filesystem path for cross-platform string comparison.

package/dist/utils/path.js

@@ -8,31 +8,14 @@ exports.normalizePathForCompare = normalizePathForCompare;
 exports.arePathsEqual = arePathsEqual;
 exports.resolveWorkingPath = resolveWorkingPath;
 exports.isPathInside = isPathInside;
+const crypto_1 = require("crypto");
 const path_1 = __importDefault(require("path"));
-/**
- * Generates a filesystem-safe directory name from an absolute path
- * @param workingPath - The absolute working path to transform
- * @returns A filesystem-safe string suitable for use as a directory name
- */
+/** `<base name>-<path hash>`; the hash keeps directories with the same base name apart. */
 function generateFilesystemSafeId(workingPath) {
-    // Normalize path separators to forward slashes for consistent processing
-    let safeId = workingPath.replace(/\\/g, '/');
-    // Replace forward slashes with dashes
-    safeId = safeId.replace(/\//g, '-');
-    // Remove or replace invalid filesystem characters
-    safeId = safeId.replace(/[<>:"|?*\x00]/g, '-');
-    // Remove leading/trailing dashes and spaces
-    safeId = safeId.replace(/^[\s-]+|[\s-]+$/g, '');
-    // Handle Windows reserved names (case-insensitive)
-    const reservedNames = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\.|$)/i;
-    if (reservedNames.test(safeId)) {
-        safeId = `project-${safeId}`;
-    }
-    // Ensure we have at least one character
-    if (!safeId) {
-        safeId = 'default-project';
-    }
-    return safeId;
+    const baseName = path_1.default.basename(path_1.default.resolve(workingPath));
+    const name = baseName.replace(/[^A-Za-z0-9._-]/g, '-').replace(/^[.-]+|[.-]+$/g, '') || 'project';
+    const hash = (0, crypto_1.createHash)('sha256').update(normalizePathForCompare(workingPath)).digest('hex').slice(0, 8);
+    return `${name}-${hash}`;
 }
 /**
  * Normalize a filesystem path for cross-platform string comparison.

package/docs/api.md

@@ -80,10 +80,12 @@ class constructor
 handoff.fetch();
 ```
 
-Fetch will connect to the defined Figma file id provided in the
-`env`. If no env or file is found, it will interactively request one. Then it
-will export all of the tokens and generated data into an `exported` directory
-in the local working root.
+Fetch reads the Figma file ID and access token from `integrations.figma`. By
+default, they come from `HANDOFF_FIGMA_PROJECT_ID` and
+`HANDOFF_DEV_ACCESS_TOKEN`. In a terminal, fetch asks for an empty value.
+Without a terminal, it throws `HandoffConfigError`. Then it exports all of the
+tokens and generated data into an `exported` directory in the local working
+root.
 
 ### build
 

package/docs/cli.md

@@ -1,78 +1,299 @@
 # Handoff CLI
 
-The Handoff cli allows you to interact with your Figma file and Handoff app
-via the command line. It allows you to run handoff in any folder with
-no other configuration or setup.  
+The `handoff-app` CLI fetches Figma foundations, builds and serves the
+documentation, and transfers content between a workspace and a registry. The
+[README](../README.md) explains the concepts and the configuration. This page
+lists every command and option.
 
-## Interacting with Figma
-The CLI will allow you to fetch all data from Figma, build the documentation
-app and run a local dev site. For these use the build, fetch, and serve commands
-documented below.  
+## Run the CLI
 
-## Configuring a handoff project
-The CLI will allow you to build the various kinds of configurations that you
-will need for interacting with Figma. Handoff has sane configuration defaults
-but the various kinds of configurations can be tailored or extended.
+`init` installs `handoff-app` in the project and adds npm scripts for the
+common commands. Use the npm scripts, so that local development and CI use the
+project version:
 
-Handoff has 4 configuration areas - 
+```bash
+npm run build -- --target registry
+```
 
-`handoff.config.*` - Defines the general handoff configuration. Supported files are `handoff.config.ts`, `handoff.config.js`, `handoff.config.cjs`, and `handoff.config.json` (resolved in that precedence order). Pass `-c, --config <file>` to load one specific file instead, resolved from the working directory (`HANDOFF_WORKING_PATH`, or the directory the command runs in).
-`pages` - Markdown files that will create or customize pages in the documentation
-app
-`exportables` - JSON schemas for each component in your figma file that you
-want to pull into handoff.
-`integration` - scss mappings and html templates for making it easy to map
-handoff tokens to your frontend framework.
+npm forwards the arguments after `--` to the CLI. For a command without an npm
+script, use `npx`:
 
-The CLI exposes two ways to manage the config - `make` and `eject`. 
+```bash
+npx handoff-app validate:components
+```
 
-__Eject__ commands will take the default configuration and eject them into
-the current working directory. If you customize these configurations, then run 
-handoff commands in that directory, these configs will be executed. `eject:config` now prompts for TypeScript or JavaScript config format.
-__Make__ commands will generate a boilerplate configuration in the current
-working directory. This is useful for extending handoff for different components
-or integrations.
+Show the help of the CLI or of one command:
 
-## Requirements
-Node 16+
+```bash
+npx handoff-app --help
+npx handoff-app publish --help
+```
 
-## Install the CLI 
+Each command runs against the working directory. The working directory is the
+directory that holds `handoff.config.ts`. It is the current directory, or the
+directory that `HANDOFF_WORKING_PATH` sets.
 
-`npm install -g handoff-app`
+## Shared options
 
-## Run the CLI
+Every command except `init` accepts these options:
+
+| Option | Description |
+| --- | --- |
+| `-c, --config <file>` | Load this config file, relative to the working directory, instead of `handoff.config.*` |
+| `--profile <name>` | Merge `handoff.config.<name>.*` onto the base config, and use the registry login of this profile. Has priority over `HANDOFF_PROFILE`. |
+| `-d, --debug` | Show debug logs |
+| `-f, --force` | Force the action. The effect depends on the command. |
+| `--help` | Show the help of the command |
+
+`handoff-app --version` shows the CLI version.
+
+`HANDOFF_LOG_LEVEL` (`debug`, `info`, `warn`, `error`, or `silent`) and
+`HANDOFF_LOG_SCOPES` (`handoff`, `vite`, `next`) control the log output of
+every command. The README lists all
+[environment variables](../README.md#environment-variables).
+
+## Project
+
+### init
+
+```bash
+npx handoff-app init
+```
+
+Creates a project with an interactive wizard. The wizard asks for the project
+name, sample content, JavaScript or TypeScript, an optional Vercel setup, and
+optional Figma credentials. It installs `handoff-app` and adds these npm
+scripts: `start`, `dev`, `fetch`, `build`, `login`, `logout`, `publish`,
+`checkout`, and `db:migrate`.
+
+### fetch
+
+```bash
+handoff-app fetch
+```
+
+Fetches tokens and assets from the Figma file and writes them to `exported/`.
+It reads `HANDOFF_FIGMA_PROJECT_ID` and `HANDOFF_DEV_ACCESS_TOKEN`. If a value
+is empty, `fetch` asks for it in the terminal. Without a terminal, `fetch`
+stops with an error that names the missing variable.
+
+### start
+
+```bash
+handoff-app start
+```
+
+Starts the workspace documentation server and the Handoff file watchers. While
+the command runs, Handoff rebuilds changed files and updates the
+documentation.
+
+### dev
+
+```bash
+handoff-app dev
+```
+
+Starts the workspace documentation server without the Handoff file watchers.
+
+### build
+
+```bash
+handoff-app build [--target static|registry] [--package standalone|vercel] [--skip-components]
+```
+
+Builds the documentation.
+
+| Option | Description |
+| --- | --- |
+| `--target static` | Default. Builds a static site in `out/static`. |
+| `--target registry` | Builds a standalone registry server in `out/registry`. The application is always in registry mode. |
+| `--package vercel` | Writes a Vercel Build Output bundle to `.vercel/output` for the selected target |
+| `--package standalone` | Writes the default output of the target |
+| `--skip-components` | Builds the application without a component build first |
+| `-f, --force` | Builds every component again, and ignores the build cache |
+
+`--package` never changes the target.
+
+### build:app
+
+```bash
+handoff-app build:app [--skip-components]
+```
+
+Builds the static site. It is the same as `build --target static`.
+
+### build:components
+
+```bash
+handoff-app build:components [component]
+```
+
+Builds the catalog items without the documentation application. A name builds
+only that item.
+
+### validate:components
+
+```bash
+handoff-app validate:components [--skip-build]
+```
+
+Validates the catalog items. `--skip-build` validates the existing build
+output without a build first.
+
+## Content
+
+### make:component
+
+```bash
+handoff-app make:component <name>
+```
+
+Creates a Handlebars catalog item: a template, a CommonJS declaration, and,
+if you select them, a JavaScript file and a Sass file. The item goes into the
+first directory in `catalog.include`, or into `components/`. If that directory
+is not registered, Handoff adds it to `catalog.include`. The name can contain
+letters, numbers, hyphens, and underscores. `--force` overwrites an existing
+template.
+
+### make:page
+
+```bash
+handoff-app make:page <name> [parent]
+```
+
+Creates a Markdown page in `pages/`, or in `pages/<parent>/`. If a default page
+has the same name, the new page starts with its content. `--force` overwrites
+an existing page.
+
+### scaffold
+
+```bash
+handoff-app scaffold
+```
+
+Creates catalog item stubs for the components in the fetched Figma data. The
+command asks which components to create and how.
+
+### eject:config
+
+```bash
+handoff-app eject:config
+```
+
+Writes the default config to the working directory. The command asks for
+TypeScript or JavaScript. `--force` overwrites an existing config file.
+
+### eject:pages
+
+```bash
+handoff-app eject:pages
+```
+
+Copies the default documentation pages to `pages/`, so that you can change
+them. `--force` adds the default pages that you did not change.
+
+### eject:theme
+
+```bash
+handoff-app eject:theme
+```
+
+Copies the Sass file of the selected theme to `theme/default.scss`, so that
+you can change it.
+
+## Registry
+
+### db:migrate
+
+```bash
+DATABASE_URL="postgresql://…" handoff-app db:migrate
+```
+
+Applies the registry database migrations. The command reads the project config
+and the database variables, and uses the same database driver as the registry
+build. Run it before the first deployment and before each upgrade. The build,
+the server start, and the installer never run migrations.
+
+### login
+
+```bash
+handoff-app login [--url <registry-url>] [--profile <name>] [--no-browser]
+```
+
+Authorizes the CLI through the device flow of the registry. The CLI saves the
+token in `.handoff/cli-auth.json`, under the selected profile.
+
+| Option | Description |
+| --- | --- |
+| `--url <registry-url>` | Registry URL, with its base path when the registry has one. Without it, the CLI uses the configured registry URL. |
+| `--profile <name>` | Saves the login under this profile. The profile needs no config file. |
+| `--no-browser` | Shows the approval URL, but does not open the browser. `HANDOFF_LOGIN_NO_BROWSER=true` does the same. |
+
+### logout
+
+```bash
+handoff-app logout [--profile <name>] [--url <registry-url>] [--all]
+```
+
+Revokes the saved token when possible. Then it removes the saved login of the
+selected profile.
+
+| Option | Description |
+| --- | --- |
+| `--url <registry-url>` | Revokes the login only if it belongs to this exact registry URL |
+| `--all` | Revokes and removes the logins of every profile |
+
+### publish
+
+```bash
+handoff-app publish <catalog|pages|tokens|assets|all> [id...] [--dry-run] [--no-build]
+```
+
+Builds the content and publishes it to the connected registry. `all` publishes
+every kind in dependency order. One or more ids limit the publish to those
+entities: catalog item ids, page ids, token set ids, or asset collections.
+`tokens` and `assets` run the Figma pipeline first.
 
-`handoff-app --help`
+| Option | Description |
+| --- | --- |
+| `--dry-run` | Lists the content that a real publish uploads. Does not connect to a registry. The build still runs. |
+| `--no-build` | Publishes the existing build output without a build first |
 
-## Commands and Flags
+### checkout
 
-Usage: handoff-app <cmd> <opts>
+```bash
+handoff-app checkout <catalog|pages|tokens|assets|all> [id...] [--dry-run]
+```
 
-Commands:
-  fetch [opts] - Fetches the design tokens from the design system
+Writes content from the connected registry into the workspace. Checkout writes
+declarations in the format that `runtime.workspace.declarationFormat` sets.
 
-  build [--target static|registry] [opts] - Builds the design system for the target (default: static export)
-    build:app [opts] - Builds the design system static application (alias of `build --target static`)
+| Option | Description |
+| --- | --- |
+| `--dry-run` | Lists the files that a real checkout creates or overwrites. Writes nothing. |
 
-  start [opts] - Starts the design system in development mode
+### Registry connection
 
-  db:migrate [opts] - Runs registry database migrations (Drizzle / PostgreSQL). Reads the project config and database env vars, applies the package-owned migration set, and runs independently of `build`.
+`publish` and `checkout` find the registry URL and the token in this order:
 
-  login [--profile <name>] --url <registry-url> - Authorizes this workspace in the browser and stores a revocable token in `.handoff/cli-auth.json`, under the selected profile.
+1. `HANDOFF_REGISTRY_URL` and `HANDOFF_REGISTRY_ACCESS_TOKEN`, or
+   `runtime.registryConnection` in the config.
+2. The saved login of the selected profile, if it belongs to the same registry
+   URL. A profile without a login uses the default login.
+3. `HANDOFF_SYNC_SECRET`, when no token and no login is available.
 
-  logout [--profile <name>] [--url <registry-url>] [--all] - Revokes the saved token when possible, then removes the local credential of the selected profile, or of every profile with `--all`.
+## Deprecated commands
 
-  make
-    make:component <name> [opts] - Creates a new catalog item with a declaration
-    make:page <component> <state> [opts] - Creates a new page
+These commands still work. Each shows a deprecation warning.
 
-  eject - Ejects the default entire configuration to the current directory
-    eject:config [opts] - Ejects the default configuration to the current directory
-    eject:integration [opts] - Ejects the default integration to the current directory
-    eject:pages [opts] - Ejects the default pages to the current directory
+| Command | Replacement |
+| --- | --- |
+| `push [type] [id...]` | `publish` |
+| `push:all` | `publish all` |
+| `push:tokens [setId...]` | `publish tokens` |
+| `push:assets [collection]` | `publish assets` |
+| `pull [type] [id...]` | `checkout` |
 
-Options:
-  -c, --config [file]      Define the path to the config file
-  -d, --debug              Show debug logs
-  -h, --help               Show this help message
-  -v, --version            Show the handoff version number
+The `push` and `pull` commands also accept `components` and `patterns` as the
+type. They accept the options for features that Handoff 2 does not have, and
+show a warning for each one.

package/drizzle/0007_add_ai_keys.sql

@@ -0,0 +1,11 @@
+CREATE TABLE "registry_ai_keys" (
+	"user_id" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"encrypted_key" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_ai_keys_user_id_connection_id_pk" PRIMARY KEY("user_id","connection_id"),
+	CONSTRAINT "registry_ai_keys_connection_not_blank" CHECK (length(btrim("registry_ai_keys"."connection_id")) > 0)
+);
+--> statement-breakpoint
+ALTER TABLE "registry_ai_keys" ADD CONSTRAINT "registry_ai_keys_user_id_registry_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."registry_users"("id") ON DELETE cascade ON UPDATE no action;

package/drizzle/0008_add_source_dir.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "components" ADD COLUMN "source_dir" text;--> statement-breakpoint
+ALTER TABLE "patterns" ADD COLUMN "source_dir" text;