khal-os 1.260324.2

package/public/icons/dusk/zoom.svg

@@ -0,0 +1 @@
+<svg width="512" height="512" fill="none" xmlns="http://www.w3.org/2000/svg"><circle fill="#1E1E1E" cx="256" cy="256" r="256"/><path d="M151 191h107.35a50 50 0 0 1 50 50v70a10 10 0 0 1-10 10H191a50 50 0 0 1-50-50v-70a10 10 0 0 1 10-10zm162.9 40.12s50.86-40.2 52.94-40.12h.2a4 4 0 0 1 4 4v122a4 4 0 0 1-4 4l-53.14-40.12z" fill="#fff"/></svg>

package/public/icons/files.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48" fill="none">
+  <rect width="48" height="48" rx="10" fill="#111111" stroke="#222222" stroke-width="1"/>
+  <path d="M13 16h7l2.5 2.5H35a1.5 1.5 0 011.5 1.5v14a1.5 1.5 0 01-1.5 1.5H13a1.5 1.5 0 01-1.5-1.5V17.5A1.5 1.5 0 0113 16z" stroke="#ffffff" stroke-width="1.5" fill="none"/>
+  <path d="M11.5 21.5H36.5" stroke="#333333" stroke-width="1"/>
+</svg>

package/public/icons/settings.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48" fill="none">
+  <rect width="48" height="48" rx="10" fill="#111111" stroke="#222222" stroke-width="1"/>
+  <circle cx="24" cy="24" r="6" stroke="#ffffff" stroke-width="1.5" fill="none"/>
+  <g stroke="#ffffff" stroke-width="1.5" stroke-linecap="round">
+    <line x1="24" y1="10" x2="24" y2="14"/>
+    <line x1="24" y1="34" x2="24" y2="38"/>
+    <line x1="10" y1="24" x2="14" y2="24"/>
+    <line x1="34" y1="24" x2="38" y2="24"/>
+    <line x1="14.1" y1="14.1" x2="16.9" y2="16.9"/>
+    <line x1="31.1" y1="31.1" x2="33.9" y2="33.9"/>
+    <line x1="14.1" y1="33.9" x2="16.9" y2="31.1"/>
+    <line x1="31.1" y1="16.9" x2="33.9" y2="14.1"/>
+  </g>
+</svg>

package/public/icons/terminal.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48" fill="none">
+  <rect width="48" height="48" rx="10" fill="#111111" stroke="#222222" stroke-width="1"/>
+  <path d="M15 17l7 7-7 7" stroke="#ffffff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  <line x1="25" y1="31" x2="33" y2="31" stroke="#666666" stroke-width="2" stroke-linecap="round"/>
+</svg>

package/public/icons/text-editor.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48" fill="none">
+  <rect width="48" height="48" rx="10" fill="#111111" stroke="#222222" stroke-width="1"/>
+  <rect x="12" y="10" width="24" height="28" rx="2" stroke="#ffffff" stroke-width="1.5" fill="none"/>
+  <line x1="17" y1="18" x2="31" y2="18" stroke="#666666" stroke-width="1.5" stroke-linecap="round"/>
+  <line x1="17" y1="23" x2="28" y2="23" stroke="#666666" stroke-width="1.5" stroke-linecap="round"/>
+  <line x1="17" y1="28" x2="24" y2="28" stroke="#666666" stroke-width="1.5" stroke-linecap="round"/>
+</svg>

package/public/manifest.json

@@ -0,0 +1,38 @@
+{
+	"name": "Khal",
+	"short_name": "Khal",
+	"description": "Desktop-in-browser OS shell",
+	"start_url": "/desktop",
+	"scope": "/",
+	"display": "standalone",
+	"background_color": "#0a0f0a",
+	"theme_color": "#39ff14",
+	"orientation": "any",
+	"icons": [
+		{
+			"src": "/icons/pwa/icon-192.png",
+			"sizes": "192x192",
+			"type": "image/png"
+		},
+		{
+			"src": "/icons/pwa/icon-512.png",
+			"sizes": "512x512",
+			"type": "image/png",
+			"purpose": "any maskable"
+		}
+	],
+	"shortcuts": [
+		{
+			"name": "Terminal",
+			"short_name": "Terminal",
+			"url": "/desktop",
+			"description": "Open a terminal window"
+		},
+		{
+			"name": "Dashboard",
+			"short_name": "Dashboard",
+			"url": "/desktop",
+			"description": "Open the router dashboard"
+		}
+	]
+}

package/public/next.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>

package/public/sw.js

@@ -0,0 +1,41 @@
+const CACHE_NAME = 'khal-v1';
+const PRECACHE = ['/', '/desktop', '/offline'];
+
+self.addEventListener('install', (event) => {
+	event.waitUntil(caches.open(CACHE_NAME).then((cache) => cache.addAll(PRECACHE)));
+	self.skipWaiting();
+});
+
+self.addEventListener('activate', (event) => {
+	event.waitUntil(
+		caches
+			.keys()
+			.then((keys) => Promise.all(keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k))))
+			.then(() => self.clients.claim())
+	);
+});
+
+self.addEventListener('fetch', (event) => {
+	const { request } = event;
+	// Only handle GET
+	if (request.method !== 'GET') return;
+	// API routes: network only
+	const url = new URL(request.url);
+	if (url.pathname.startsWith('/api/')) return;
+
+	event.respondWith(
+		caches.match(request).then((cached) => {
+			if (cached) return cached;
+			return fetch(request)
+				.then((response) => {
+					// Only cache same-origin successful responses
+					if (response.ok && response.type === 'basic') {
+						const clone = response.clone();
+						caches.open(CACHE_NAME).then((cache) => cache.put(request, clone));
+					}
+					return response;
+				})
+				.catch(() => caches.match('/offline'));
+		})
+	);
+});

package/public/vercel.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1155 1000"><path d="m577.3 0 577.4 1000H0z" fill="#fff"/></svg>

package/public/wallpapers/default.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" viewBox="0 0 1920 1080">
+  <rect width="1920" height="1080" fill="#000000"/>
+  <defs>
+    <radialGradient id="g1" cx="30%" cy="40%" r="60%">
+      <stop offset="0%" stop-color="#111111"/>
+      <stop offset="100%" stop-color="#000000"/>
+    </radialGradient>
+  </defs>
+  <rect width="1920" height="1080" fill="url(#g1)"/>
+</svg>

package/public/window.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.5 2.5h13v10a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1zM0 1h16v11.5a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5zm3.75 4.5a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5M7 4.75a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0m1.75.75a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5" fill="#666"/></svg>

package/scripts/generate-pwa-icons.mjs

@@ -0,0 +1,33 @@
+import { mkdirSync } from 'fs';
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const _require = createRequire(import.meta.url);
+
+// Resolve sharp from the pnpm virtual store (bundled with Next.js)
+const sharpPath = join(__dirname, '../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/index.js');
+const sharp = (await import(sharpPath)).default;
+
+const outDir = join(__dirname, '../public/icons/pwa');
+mkdirSync(outDir, { recursive: true });
+
+function makeSvg(size) {
+	const pad = size * 0.2;
+	const iconSize = size - pad * 2;
+	return `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}">
+    <rect width="${size}" height="${size}" rx="${size * 0.2}" fill="#0a0f0a"/>
+    <g transform="translate(${pad}, ${pad}) scale(${iconSize / 24})">
+      <path d="M4 14a1 1 0 0 1-.78-1.63l9.9-10.2a.5.5 0 0 1 .86.46l-1.92 6.02A1 1 0 0 0 13 10h7a1 1 0 0 1 .78 1.63l-9.9 10.2a.5.5 0 0 1-.86-.46l1.92-6.02A1 1 0 0 0 11 14z"
+            fill="#39ff14" stroke="#39ff14" stroke-width="0.5"/>
+    </g>
+  </svg>`;
+}
+
+for (const size of [192, 512]) {
+	await sharp(Buffer.from(makeSvg(size)))
+		.png()
+		.toFile(join(outDir, `icon-${size}.png`));
+	console.log(`icon-${size}.png`);
+}

package/scripts/install-nats.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Install NATS server binary to ~/.local/bin/nats-server
+# Idempotent: skips download if correct version already installed.
+
+NATS_VERSION="v2.10.25"
+INSTALL_DIR="$HOME/.local/bin"
+INSTALL_PATH="$INSTALL_DIR/nats-server"
+
+# Check if already installed at correct version
+if [ -x "$INSTALL_PATH" ]; then
+  INSTALLED_VERSION=$("$INSTALL_PATH" --version 2>&1 | grep -oP 'v[\d.]+' || true)
+  if [ "$INSTALLED_VERSION" = "$NATS_VERSION" ]; then
+    echo "nats-server $NATS_VERSION already installed at $INSTALL_PATH"
+    exit 0
+  fi
+  echo "nats-server found but version mismatch (installed: $INSTALLED_VERSION, wanted: $NATS_VERSION). Upgrading..."
+fi
+
+mkdir -p "$INSTALL_DIR"
+
+ARCHIVE="nats-server-${NATS_VERSION}-linux-amd64.tar.gz"
+URL="https://github.com/nats-io/nats-server/releases/download/${NATS_VERSION}/${ARCHIVE}"
+
+echo "Downloading nats-server ${NATS_VERSION}..."
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+curl -fsSL "$URL" -o "$TMPDIR/$ARCHIVE"
+tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR"
+
+cp "$TMPDIR/nats-server-${NATS_VERSION}-linux-amd64/nats-server" "$INSTALL_PATH"
+chmod +x "$INSTALL_PATH"
+
+echo "Installed nats-server to $INSTALL_PATH"
+"$INSTALL_PATH" --version

package/sentry.client.config.ts

@@ -0,0 +1,21 @@
+import * as Sentry from '@sentry/nextjs';
+
+Sentry.init({
+	dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+	environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT || 'development',
+	tracesSampleRate: 1.0,
+	sendDefaultPii: true,
+	integrations: [
+		Sentry.replayIntegration({
+			maskAllText: false,
+			blockAllMedia: false,
+		}),
+	],
+	replaysSessionSampleRate: 0.1,
+	replaysOnErrorSampleRate: 1.0,
+	allowUrls: [/https?:\/\/(.*\.)?khal\.ai/],
+	beforeSend(event) {
+		if (event.request?.url?.includes('/health')) return null;
+		return event;
+	},
+});

package/sentry.edge.config.ts

@@ -0,0 +1,12 @@
+import * as Sentry from '@sentry/nextjs';
+
+Sentry.init({
+	dsn: process.env.SENTRY_DSN,
+	environment: process.env.SENTRY_ENVIRONMENT || 'development',
+	tracesSampleRate: 1.0,
+	sendDefaultPii: true,
+	beforeSend(event) {
+		if (event.request?.url?.includes('/health')) return null;
+		return event;
+	},
+});

package/sentry.server.config.ts

@@ -0,0 +1,12 @@
+import * as Sentry from '@sentry/nextjs';
+
+Sentry.init({
+	dsn: process.env.SENTRY_DSN,
+	environment: process.env.SENTRY_ENVIRONMENT || 'development',
+	tracesSampleRate: 1.0,
+	sendDefaultPii: true,
+	beforeSend(event) {
+		if (event.request?.url?.includes('/health')) return null;
+		return event;
+	},
+});

package/src/app/api/files/download/route.ts

@@ -0,0 +1,81 @@
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { basename, extname } from 'node:path';
+import { Readable } from 'node:stream';
+import { withAuth } from '@workos-inc/authkit-nextjs';
+import { escapeContentDisposition, getFilesRoot, resolveSafePath } from '@/lib/files/safe-path';
+
+const MIME_TYPES: Record<string, string> = {
+	'.html': 'text/html',
+	'.css': 'text/css',
+	'.js': 'application/javascript',
+	'.json': 'application/json',
+	'.png': 'image/png',
+	'.jpg': 'image/jpeg',
+	'.jpeg': 'image/jpeg',
+	'.gif': 'image/gif',
+	'.svg': 'image/svg+xml',
+	'.webp': 'image/webp',
+	'.pdf': 'application/pdf',
+	'.txt': 'text/plain',
+	'.md': 'text/markdown',
+	'.csv': 'text/csv',
+	'.xml': 'application/xml',
+	'.zip': 'application/zip',
+	'.mp3': 'audio/mpeg',
+	'.mp4': 'video/mp4',
+	'.webm': 'video/webm',
+	'.woff': 'font/woff',
+	'.woff2': 'font/woff2',
+};
+
+function getMimeType(filePath: string): string {
+	const ext = extname(filePath).toLowerCase();
+	return MIME_TYPES[ext] || 'application/octet-stream';
+}
+
+export async function GET(request: Request) {
+	const { user } = await withAuth();
+	if (!user) {
+		return new Response('Unauthorized', { status: 401 });
+	}
+
+	const url = new URL(request.url);
+	const filePath = url.searchParams.get('path');
+
+	if (!filePath) {
+		return Response.json({ error: 'Missing path parameter' }, { status: 400 });
+	}
+
+	const root = getFilesRoot();
+
+	let resolved: string;
+	try {
+		resolved = resolveSafePath(root, filePath);
+	} catch {
+		return new Response('Forbidden', { status: 403 });
+	}
+
+	let fileStat: Awaited<ReturnType<typeof stat>>;
+	try {
+		fileStat = await stat(resolved);
+	} catch {
+		return new Response('Not Found', { status: 404 });
+	}
+
+	if (!fileStat.isFile()) {
+		return new Response('Not Found', { status: 404 });
+	}
+
+	const name = basename(resolved);
+	const stream = createReadStream(resolved);
+	const webStream = Readable.toWeb(stream) as ReadableStream;
+
+	return new Response(webStream, {
+		headers: {
+			'Content-Type': getMimeType(resolved),
+			'Content-Disposition': escapeContentDisposition(name),
+			'Content-Length': String(fileStat.size),
+		},
+	});
+}

package/src/app/api/files/download-zip/route.ts

@@ -0,0 +1,102 @@
+import { readdirSync, realpathSync } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+import { PassThrough, Readable } from 'node:stream';
+import { withAuth } from '@workos-inc/authkit-nextjs';
+import archiver from 'archiver';
+import { getFilesRoot, MAX_ZIP_ENTRIES, resolveSafePath } from '@/lib/files/safe-path';
+
+/**
+ * Recursively add directory contents to archive, validating each entry's
+ * real path stays within root (prevents symlink escape).
+ */
+function addDirectorySafe(archive: archiver.Archiver, root: string, dirPath: string, archivePrefix: string) {
+	const dirents = readdirSync(dirPath, { withFileTypes: true });
+	for (const dirent of dirents) {
+		const fullPath = join(dirPath, dirent.name);
+		// Check symlink escape per entry
+		const real = realpathSync(fullPath);
+		if (real !== root && !real.startsWith(`${root}/`)) {
+			continue; // Skip symlinks that escape root
+		}
+		const entryName = archivePrefix ? `${archivePrefix}/${dirent.name}` : dirent.name;
+		if (dirent.isDirectory()) {
+			addDirectorySafe(archive, root, fullPath, entryName);
+		} else {
+			archive.file(fullPath, { name: entryName });
+		}
+	}
+}
+
+export async function POST(request: Request) {
+	const { user } = await withAuth();
+	if (!user) {
+		return new Response('Unauthorized', { status: 401 });
+	}
+
+	let body: { paths: string[] };
+	try {
+		body = await request.json();
+	} catch {
+		return Response.json({ error: 'Invalid JSON body' }, { status: 400 });
+	}
+
+	if (!Array.isArray(body.paths) || body.paths.length === 0) {
+		return Response.json({ error: 'Missing or empty paths array' }, { status: 400 });
+	}
+
+	if (body.paths.length > MAX_ZIP_ENTRIES) {
+		return Response.json({ error: `Too many entries (max ${MAX_ZIP_ENTRIES})` }, { status: 400 });
+	}
+
+	const root = getFilesRoot();
+
+	// Resolve and validate all paths up front
+	const resolvedPaths: { resolved: string; name: string; isDir: boolean }[] = [];
+	for (const p of body.paths) {
+		let resolved: string;
+		try {
+			resolved = resolveSafePath(root, p);
+		} catch {
+			return new Response('Forbidden', { status: 403 });
+		}
+
+		let entryStat: Awaited<ReturnType<typeof stat>>;
+		try {
+			entryStat = await stat(resolved);
+		} catch {
+			return Response.json({ error: `Not found: ${p}` }, { status: 404 });
+		}
+
+		resolvedPaths.push({
+			resolved,
+			name: basename(resolved),
+			isDir: entryStat.isDirectory(),
+		});
+	}
+
+	const passthrough = new PassThrough();
+	const archive = archiver('zip', { zlib: { level: 5 } });
+
+	archive.pipe(passthrough);
+
+	for (const entry of resolvedPaths) {
+		if (entry.isDir) {
+			addDirectorySafe(archive, root, entry.resolved, entry.name);
+		} else {
+			archive.file(entry.resolved, { name: entry.name });
+		}
+	}
+
+	// Finalize in background -- the stream will end when done
+	archive.finalize();
+
+	const webStream = Readable.toWeb(passthrough) as ReadableStream;
+
+	return new Response(webStream, {
+		headers: {
+			'Content-Type': 'application/zip',
+			'Content-Disposition': 'attachment; filename="download.zip"',
+		},
+	});
+}

package/src/app/api/files/upload/route.ts

@@ -0,0 +1,58 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { withAuth } from '@workos-inc/authkit-nextjs';
+import { getFilesRoot, MAX_UPLOAD_SIZE, resolveSafePath, sanitizeFilename } from '@/lib/files/safe-path';
+
+export async function POST(request: Request) {
+	const { user } = await withAuth();
+	if (!user) {
+		return new Response('Unauthorized', { status: 401 });
+	}
+
+	try {
+		const formData = await request.formData();
+		const file = formData.get('file');
+		const targetPath = formData.get('path');
+
+		if (!(file instanceof File)) {
+			return Response.json({ ok: false, error: 'Missing file field' }, { status: 400 });
+		}
+
+		if (file.size > MAX_UPLOAD_SIZE) {
+			return Response.json(
+				{ ok: false, error: `File too large (max ${MAX_UPLOAD_SIZE / 1024 / 1024} MB)` },
+				{ status: 413 }
+			);
+		}
+
+		const root = getFilesRoot();
+		const dirPath = typeof targetPath === 'string' && targetPath.length > 0 ? targetPath : '/';
+
+		let resolvedDir: string;
+		try {
+			resolvedDir = resolveSafePath(root, dirPath);
+		} catch {
+			return new Response('Forbidden', { status: 403 });
+		}
+
+		await mkdir(resolvedDir, { recursive: true });
+
+		const safeName = sanitizeFilename(file.name);
+		const bytes = new Uint8Array(await file.arrayBuffer());
+		const filePath = join(resolvedDir, safeName);
+
+		// Verify the final file path is also safe
+		try {
+			resolveSafePath(root, filePath.slice(root.length));
+		} catch {
+			return new Response('Forbidden', { status: 403 });
+		}
+
+		await writeFile(filePath, bytes);
+
+		return Response.json({ ok: true, name: safeName, size: bytes.byteLength });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : 'Unknown error';
+		return Response.json({ ok: false, error: message }, { status: 500 });
+	}
+}

package/src/app/api/webhooks/workos/route.ts

@@ -0,0 +1,98 @@
+/**
+ * WorkOS webhook endpoint.
+ *
+ * Receives signed webhook events from WorkOS and dispatches them to
+ * the appropriate handler for NATS broadcast.
+ *
+ * Signature verification uses the WorkOS SDK's `constructEvent()` method
+ * with the `WORKOS_WEBHOOK_SECRET` environment variable.
+ *
+ * This route is excluded from auth middleware via `unauthenticatedPaths`.
+ */
+
+import { getWorkOS } from '@workos-inc/authkit-nextjs';
+import { handleMembershipDeleted, handleMembershipUpdated, handleUserUpdated } from '@/lib/auth/webhook-handler';
+
+export async function POST(request: Request): Promise<Response> {
+	const secret = process.env.WORKOS_WEBHOOK_SECRET;
+	if (!secret) {
+		console.error('[webhook] WORKOS_WEBHOOK_SECRET is not configured');
+		return new Response('Webhook secret not configured', { status: 500 });
+	}
+
+	const sigHeader = request.headers.get('workos-signature');
+	if (!sigHeader) {
+		return new Response('Missing signature header', { status: 400 });
+	}
+
+	let body: string;
+	try {
+		body = await request.text();
+	} catch {
+		return new Response('Invalid request body', { status: 400 });
+	}
+
+	let payload: Record<string, unknown>;
+	try {
+		payload = JSON.parse(body) as Record<string, unknown>;
+	} catch {
+		return new Response('Invalid JSON', { status: 400 });
+	}
+
+	// Verify signature and construct typed event
+	const workos = getWorkOS();
+	const webhooks = workos.webhooks;
+
+	let event: Awaited<ReturnType<typeof webhooks.constructEvent>>;
+	try {
+		event = await webhooks.constructEvent({
+			payload,
+			sigHeader,
+			secret,
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : 'Signature verification failed';
+		console.error('[webhook] signature verification failed:', message);
+		return new Response('Invalid signature', { status: 400 });
+	}
+
+	console.log('[webhook] received event:', event.event);
+
+	try {
+		switch (event.event) {
+			case 'organization_membership.updated':
+				await handleMembershipUpdated(
+					event.data as {
+						userId: string;
+						organizationId: string;
+						id: string;
+						role: { slug: string };
+					}
+				);
+				break;
+
+			case 'organization_membership.deleted':
+				await handleMembershipDeleted(
+					event.data as {
+						userId: string;
+						organizationId: string;
+						id: string;
+					}
+				);
+				break;
+
+			case 'user.updated':
+				await handleUserUpdated(event.data as { id: string; email: string });
+				break;
+
+			default:
+				console.log('[webhook] unhandled event type:', event.event);
+		}
+	} catch (err) {
+		console.error('[webhook] error processing event:', err);
+		// Return 200 to prevent WorkOS from retrying — log the error for investigation
+		return Response.json({ received: true, error: 'Processing failed' });
+	}
+
+	return Response.json({ received: true });
+}

package/src/app/auth/callback/route.ts

@@ -0,0 +1,16 @@
+import { handleAuth } from '@workos-inc/authkit-nextjs';
+
+/**
+ * AuthKit OAuth callback handler.
+ *
+ * WorkOS redirects here after a successful login. The SDK exchanges the
+ * authorization code for tokens, sets the session cookie, and redirects
+ * the user to /desktop.
+ *
+ * baseURL is required because Next.js runs behind Caddy and sees
+ * request.nextUrl as localhost:8888 instead of the public domain.
+ */
+const redirectUri = process.env.NEXT_PUBLIC_WORKOS_REDIRECT_URI ?? '';
+const baseURL = redirectUri ? new URL(redirectUri).origin : undefined;
+
+export const GET = handleAuth({ returnPathname: '/desktop', baseURL });

package/src/app/auth/logout/route.ts

@@ -0,0 +1,15 @@
+import { signOut } from '@workos-inc/authkit-nextjs';
+
+/**
+ * Server-side logout route (POST only to prevent CSRF).
+ *
+ * Clears the AuthKit session cookie and redirects to the root page,
+ * which the middleware will then redirect to the AuthKit hosted login.
+ */
+export async function POST() {
+	await signOut({ returnTo: '/' });
+}
+
+export async function GET() {
+	return new Response('Method not allowed. Use POST.', { status: 405 });
+}