madarx 2.18.0 → 2.21.0

package/lib/tools/adapters/higgsfield.js

@@ -0,0 +1,329 @@
+/**
+ * Higgsfield AI generation tool adapters.
+ *
+ * Implements two tools:
+ *   - higgsfieldGenerateImage(input, options) — text-to-image (Soul) generation
+ *   - higgsfieldGenerateVideo(input, options) — image-to-video (DoP) generation
+ *
+ * Both are async on Higgsfield's side: submit returns a job-set id, then we poll
+ * until a terminal status and read the resulting media URL. The poll loop is
+ * bounded; a timeout returns the job-set id so the caller can retry the lookup.
+ *
+ * Credential resolution: vault first (getSecret), env fallback during migration.
+ *   - HIGGSFIELD_KEY_ID  + HIGGSFIELD_KEY_SECRET  →  Authorization: Key <id>:<secret>
+ *     (matches the official higgsfield-js SDK credential format)
+ *
+ * Security model:
+ *   - Credentials are never logged, echoed, or included in returned errors.
+ *   - Generation spends paid Higgsfield credits — risk_level 'high' in the
+ *     registry, so it gates under the default approval_required trust mode.
+ *   - Host is fixed (platform.higgsfield.ai); no caller-supplied destination,
+ *     so no per-tool allowlist is needed.
+ *   - wrapFetch records every outbound call to tool_egress for observability.
+ *
+ * API shapes are parsed defensively (multiple candidate field names) because the
+ * public REST surface is thinner than the SDK. Endpoints are the documented
+ * stable paths; adjust HF_* constants if a live key reveals a drift.
+ */
+
+import { getSecret } from '../../secrets.js';
+import { wrapFetch } from '../../egress.js';
+
+const HF_API_BASE = 'https://platform.higgsfield.ai';
+const HF_IMAGE_PATH = '/v1/text2image/soul';
+const HF_VIDEO_PATH = '/v1/image2video/dop';
+// Job-set status endpoint. The SDK polls /requests/{id}/status; we try that
+// first and fall back to /v1/job-sets/{id} for older request ids.
+const HF_STATUS_PATHS = (id) => [
+  `/requests/${encodeURIComponent(id)}/status`,
+  `/v1/job-sets/${encodeURIComponent(id)}`,
+];
+
+const TERMINAL_STATUSES = new Set(['completed', 'failed', 'nsfw', 'canceled', 'cancelled']);
+const POLL_INTERVAL_MS = 2500;
+const DEFAULT_MAX_POLLS = 48; // ~2 min
+
+function resolveCredential(name, options = {}) {
+  try {
+    const secret = getSecret(name, {
+      agent_id: options.agent_id,
+      project_id: options.project_id,
+    });
+    if (secret) return secret;
+  } catch {
+    // Vault not ready — fall through to process.env.
+  }
+  return process.env[name] || null;
+}
+
+/**
+ * Build the Authorization header value from the id/secret pair, supporting the
+ * combined HF_CREDENTIALS form as a fallback.
+ *
+ * @returns {string} e.g. "Key keyId:keySecret"
+ */
+function requireAuthHeader(options = {}) {
+  const combined = resolveCredential('HIGGSFIELD_CREDENTIALS', options);
+  if (combined && combined.includes(':')) return `Key ${combined.trim()}`;
+
+  const keyId = resolveCredential('HIGGSFIELD_KEY_ID', options);
+  const keySecret = resolveCredential('HIGGSFIELD_KEY_SECRET', options);
+  if (!keyId || !keySecret) {
+    throw new Error(
+      'Higgsfield is not connected. Add your HIGGSFIELD_KEY_ID and HIGGSFIELD_KEY_SECRET ' +
+      'in the Higgsfield connection (marketplace → Connections).'
+    );
+  }
+  return `Key ${keyId.trim()}:${keySecret.trim()}`;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** Extract a safe error message from a Higgsfield error response.
+ * Handles FastAPI shapes: { detail: "string" } and { detail: [{ msg, loc }] }. */
+async function hfErrorMessage(res) {
+  try {
+    const body = await res.json();
+    const d = body?.detail;
+    if (typeof d === 'string') return d;
+    if (Array.isArray(d)) {
+      return d
+        .map((e) => {
+          const field = Array.isArray(e?.loc) ? e.loc.filter((p) => p !== 'body').join('.') : '';
+          return [field, e?.msg].filter(Boolean).join(': ');
+        })
+        .filter(Boolean)
+        .join('; ') || `HTTP ${res.status}`;
+    }
+    return body?.message || body?.error || `HTTP ${res.status}`;
+  } catch {
+    return `HTTP ${res.status}`;
+  }
+}
+
+/** Pull a job-set / request id from a submit response, trying known shapes. */
+function extractJobSetId(data) {
+  return (
+    data?.id ||
+    data?.request_id ||
+    data?.jobset_id ||
+    data?.job_set_id ||
+    data?.jobSetId ||
+    data?.requestId ||
+    null
+  );
+}
+
+/** Read status + result URL from a poll response, trying known shapes. */
+function readJobSet(data) {
+  const job = Array.isArray(data?.jobs) ? data.jobs[0] : null;
+  const status = String(
+    data?.status || job?.status || data?.state || 'in_progress'
+  ).toLowerCase();
+  const results = job?.results || data?.results || null;
+  const url =
+    results?.raw?.url ||
+    results?.min?.url ||
+    job?.url ||
+    data?.url ||
+    (Array.isArray(data?.images) ? data.images[0]?.url : null) ||
+    data?.video?.url ||
+    null;
+  const thumbnail = results?.min?.url || null;
+  return { status, url, thumbnail };
+}
+
+/**
+ * Submit a generation job, then poll until terminal or timeout.
+ *
+ * @returns {{ ok: boolean, status: string, job_set_id: string|null,
+ *             url: string|null, thumbnail: string|null, timed_out?: boolean }}
+ */
+async function submitAndPoll({ toolName, path, body, options, maxPolls }) {
+  const authHeader = requireAuthHeader(options);
+  const agentId = options.agent_id ?? null;
+  const wrappedFetch = wrapFetch(toolName, agentId);
+
+  const submitRes = await wrappedFetch(`${HF_API_BASE}${path}`, {
+    method: 'POST',
+    headers: {
+      Authorization: authHeader,
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (!submitRes.ok) {
+    if (submitRes.status === 401) {
+      throw new Error('Higgsfield rejected the credentials (401). Re-check the key in the Higgsfield connection.');
+    }
+    const message = await hfErrorMessage(submitRes);
+    // 403 is most often "Not enough credits" — surface the provider message verbatim.
+    throw new Error(`Higgsfield API error (${submitRes.status}): ${message}`);
+  }
+
+  const submitData = await submitRes.json().catch(() => ({}));
+
+  // Some endpoints may return the finished result inline.
+  const inline = readJobSet(submitData);
+  if (inline.url) {
+    return { ok: true, status: 'completed', job_set_id: extractJobSetId(submitData), url: inline.url, thumbnail: inline.thumbnail };
+  }
+
+  const jobSetId = extractJobSetId(submitData);
+  if (!jobSetId) {
+    throw new Error('Higgsfield did not return a job id; cannot poll for the result.');
+  }
+
+  const limit = Number.isFinite(maxPolls) ? maxPolls : DEFAULT_MAX_POLLS;
+  for (let attempt = 0; attempt < limit; attempt++) {
+    await sleep(POLL_INTERVAL_MS);
+
+    let statusData = null;
+    for (const sp of HF_STATUS_PATHS(jobSetId)) {
+      const statusRes = await wrappedFetch(`${HF_API_BASE}${sp}`, {
+        method: 'GET',
+        headers: { Authorization: authHeader, Accept: 'application/json' },
+      });
+      if (statusRes.ok) {
+        statusData = await statusRes.json().catch(() => null);
+        break;
+      }
+      if (statusRes.status !== 404) {
+        const message = await hfErrorMessage(statusRes);
+        throw new Error(`Higgsfield status error (${statusRes.status}): ${message}`);
+      }
+    }
+    if (!statusData) continue;
+
+    const { status, url, thumbnail } = readJobSet(statusData);
+    if (TERMINAL_STATUSES.has(status)) {
+      if (status === 'completed' && url) {
+        return { ok: true, status, job_set_id: jobSetId, url, thumbnail };
+      }
+      if (status === 'nsfw') {
+        return { ok: false, status, job_set_id: jobSetId, url: null, thumbnail: null, error: 'Generation flagged NSFW by Higgsfield.' };
+      }
+      return { ok: false, status, job_set_id: jobSetId, url: url || null, thumbnail: thumbnail || null, error: `Generation ${status}.` };
+    }
+  }
+
+  return { ok: false, status: 'in_progress', job_set_id: jobSetId, url: null, thumbnail: null, timed_out: true };
+}
+
+/**
+ * Text-to-image generation via the Higgsfield Soul model.
+ *
+ * Input: { prompt (required), width_and_height?, quality?, batch_size?,
+ *          style_id?, style_strength?, seed?, model?, max_polls? }
+ * Returns: { ok, status, url, thumbnail, job_set_id }
+ */
+export async function higgsfieldGenerateImage(input = {}, options = {}) {
+  const prompt = String(input.prompt || '').trim();
+  if (!prompt) throw new Error('"prompt" is required');
+
+  // Higgsfield wraps generation fields in a `params` object.
+  const params = {
+    prompt,
+    width_and_height: input.width_and_height || '1536x1536',
+    quality: input.quality || '720p',
+    batch_size: input.batch_size || 1,
+    ...(input.style_id ? { style_id: String(input.style_id) } : {}),
+    ...(input.style_strength != null ? { style_strength: Number(input.style_strength) } : {}),
+    ...(input.seed != null ? { seed: Number(input.seed) } : {}),
+    ...(input.model ? { model: String(input.model) } : {}),
+  };
+
+  const result = await submitAndPoll({
+    toolName: 'higgsfield_generate_image',
+    path: HF_IMAGE_PATH,
+    body: { params },
+    options,
+    maxPolls: input.max_polls,
+  });
+
+  if (!result.ok && !result.timed_out) {
+    throw new Error(result.error || `Higgsfield image generation ${result.status}.`);
+  }
+  return result;
+}
+
+/**
+ * Product photoshoot: image-conditioned generation via the Higgsfield Soul model.
+ * Takes a source product image and a scene/style prompt, returning brand-quality
+ * product imagery (studio, lifestyle, hero banner, etc.). Implemented as the soul
+ * text2image endpoint with the product passed as a reference in `input_images`.
+ *
+ * Input: { image_url (required), prompt (required), width_and_height?, quality?,
+ *          batch_size?, style_id?, seed?, max_polls? }
+ * Returns: { ok, status, url, thumbnail, job_set_id }
+ */
+export async function higgsfieldProductPhotoshoot(input = {}, options = {}) {
+  const imageUrl = String(input.image_url || '').trim();
+  if (!imageUrl) throw new Error('"image_url" is required (the source product image)');
+  if (!/^https?:\/\//i.test(imageUrl)) {
+    throw new Error('"image_url" must be a public http(s) URL');
+  }
+  const prompt = String(input.prompt || '').trim();
+  if (!prompt) throw new Error('"prompt" is required (the scene/style, e.g. "on a marble podium, studio lighting")');
+
+  const params = {
+    prompt,
+    width_and_height: input.width_and_height || '1536x1536',
+    quality: input.quality || '720p',
+    batch_size: input.batch_size || 1,
+    input_images: [{ type: 'image_url', image_url: imageUrl }],
+    ...(input.style_id ? { style_id: String(input.style_id) } : {}),
+    ...(input.seed != null ? { seed: Number(input.seed) } : {}),
+  };
+
+  const result = await submitAndPoll({
+    toolName: 'higgsfield_product_photoshoot',
+    path: HF_IMAGE_PATH,
+    body: { params },
+    options,
+    maxPolls: input.max_polls,
+  });
+
+  if (!result.ok && !result.timed_out) {
+    throw new Error(result.error || `Higgsfield product photoshoot ${result.status}.`);
+  }
+  return result;
+}
+
+/**
+ * Image-to-video generation via the Higgsfield DoP model.
+ *
+ * Input: { image_url (required), prompt?, model?, motions?, seed?, max_polls? }
+ * Returns: { ok, status, url, thumbnail, job_set_id }
+ */
+export async function higgsfieldGenerateVideo(input = {}, options = {}) {
+  const imageUrl = String(input.image_url || '').trim();
+  if (!imageUrl) throw new Error('"image_url" is required (the source image to animate)');
+  if (!/^https?:\/\//i.test(imageUrl)) {
+    throw new Error('"image_url" must be a public http(s) URL');
+  }
+
+  const params = {
+    model: input.model ? String(input.model) : 'dop-turbo',
+    ...(input.prompt ? { prompt: String(input.prompt) } : {}),
+    input_images: [{ type: 'image_url', image_url: imageUrl }],
+    ...(input.motions ? { motions: input.motions } : {}),
+    ...(input.seed != null ? { seed: Number(input.seed) } : {}),
+  };
+
+  // Video takes longer — allow a larger default poll budget.
+  const result = await submitAndPoll({
+    toolName: 'higgsfield_generate_video',
+    path: HF_VIDEO_PATH,
+    body: { params },
+    options,
+    maxPolls: input.max_polls != null ? input.max_polls : 90,
+  });
+
+  if (!result.ok && !result.timed_out) {
+    throw new Error(result.error || `Higgsfield video generation ${result.status}.`);
+  }
+  return result;
+}

package/lib/tools/registry.js

@@ -10,6 +10,7 @@ import { requireFreshMembership } from '../auth.js';
 import { appendComplianceAudit } from '../compliance-audit.js';
 import { webExtract, webFetch, webSearch } from './adapters/web.js';
 import { emailSend, emailStatusLookup } from './adapters/resend.js';
+import { higgsfieldGenerateImage, higgsfieldGenerateVideo, higgsfieldProductPhotoshoot } from './adapters/higgsfield.js';
 import {
   supabaseListProjects,
   supabaseRestSelect,
@@ -1721,6 +1722,89 @@ const MARKETPLACE_TOOLS = [
     allowlist_required: false,
     input_schema: { type: 'object', properties: { slug: { type: 'string', description: 'snake_case tool name' }, summary: { type: 'string' }, risk: { type: 'string', enum: ['low', 'medium', 'high', 'irreversible_external'] }, approval_id: { type: 'string' } }, required: ['slug'] },
   },
+  {
+    name: 'higgsfield_generate_image',
+    title: 'Generate image (Higgsfield)',
+    description: 'Generate an image from a text prompt via the Higgsfield AI Soul model. Spends Higgsfield credits — gated by default. Returns the resulting image URL.',
+    category: 'media',
+    risk_level: 'high',
+    approval_required: true,
+    approval_mode: 'approval_required',
+    required_env: ['HIGGSFIELD_KEY_ID', 'HIGGSFIELD_KEY_SECRET'],
+    enabled_default: false,
+    allowlist_required: false,
+    rate_limit: { window_seconds: 3600, max: 60 },
+    input_schema: {
+      type: 'object',
+      properties: {
+        prompt: { type: 'string', description: 'Text description of the image to generate.' },
+        width_and_height: { type: 'string', description: 'Output size, e.g. "1536x1536". Defaults to "1536x1536".' },
+        quality: { type: 'string', description: 'Render quality, e.g. "720p" or "1080p". Defaults to "720p".' },
+        batch_size: { type: 'number', description: 'Number of images to generate (default 1).' },
+        style_id: { type: 'string', description: 'Optional Higgsfield style/identity reference id (e.g. a trained Soul ID).' },
+        style_strength: { type: 'number', description: 'Optional style strength 0–1.' },
+        seed: { type: 'number', description: 'Optional seed for reproducibility.' },
+        model: { type: 'string', description: 'Optional model override.' },
+        max_polls: { type: 'number', description: 'Optional cap on status polls before returning the job id (default ~48).' },
+        approval_id: { type: 'string', description: 'Approval request ID to consume for one-shot execution.' },
+      },
+      required: ['prompt'],
+    },
+  },
+  {
+    name: 'higgsfield_product_photoshoot',
+    title: 'Product photoshoot (Higgsfield)',
+    description: 'Turn a source product image into brand-quality product imagery (studio, lifestyle, hero banner, etc.) via the Higgsfield Soul model. Spends Higgsfield credits — gated by default. Returns the resulting image URL.',
+    category: 'media',
+    risk_level: 'high',
+    approval_required: true,
+    approval_mode: 'approval_required',
+    required_env: ['HIGGSFIELD_KEY_ID', 'HIGGSFIELD_KEY_SECRET'],
+    enabled_default: false,
+    allowlist_required: false,
+    rate_limit: { window_seconds: 3600, max: 60 },
+    input_schema: {
+      type: 'object',
+      properties: {
+        image_url: { type: 'string', description: 'Public http(s) URL of the source product image to feature.' },
+        prompt: { type: 'string', description: 'Scene / style direction, e.g. "on a marble podium, soft studio lighting, minimal background".' },
+        width_and_height: { type: 'string', description: 'Output size, e.g. "1536x1536". Defaults to "1536x1536".' },
+        quality: { type: 'string', description: 'Render quality, e.g. "720p" or "1080p". Defaults to "720p".' },
+        batch_size: { type: 'number', description: 'Number of variations to generate (default 1).' },
+        style_id: { type: 'string', description: 'Optional Higgsfield style/identity reference id.' },
+        seed: { type: 'number', description: 'Optional seed for reproducibility.' },
+        max_polls: { type: 'number', description: 'Optional cap on status polls before returning the job id (default ~48).' },
+        approval_id: { type: 'string', description: 'Approval request ID to consume for one-shot execution.' },
+      },
+      required: ['image_url', 'prompt'],
+    },
+  },
+  {
+    name: 'higgsfield_generate_video',
+    title: 'Generate video (Higgsfield)',
+    description: 'Animate a source image into a video via the Higgsfield AI DoP model. Spends Higgsfield credits — gated by default. Returns the resulting video URL.',
+    category: 'media',
+    risk_level: 'high',
+    approval_required: true,
+    approval_mode: 'approval_required',
+    required_env: ['HIGGSFIELD_KEY_ID', 'HIGGSFIELD_KEY_SECRET'],
+    enabled_default: false,
+    allowlist_required: false,
+    rate_limit: { window_seconds: 3600, max: 30 },
+    input_schema: {
+      type: 'object',
+      properties: {
+        image_url: { type: 'string', description: 'Public http(s) URL of the source image to animate.' },
+        prompt: { type: 'string', description: 'Optional motion/scene prompt.' },
+        model: { type: 'string', description: 'Optional DoP model variant. Defaults to "dop-turbo".' },
+        motions: { description: 'Optional Higgsfield motion descriptors.' },
+        seed: { type: 'number', description: 'Optional seed for reproducibility.' },
+        max_polls: { type: 'number', description: 'Optional cap on status polls before returning the job id (default ~90).' },
+        approval_id: { type: 'string', description: 'Approval request ID to consume for one-shot execution.' },
+      },
+      required: ['image_url'],
+    },
+  },
 ];
 
 const ADAPTERS = {
@@ -1729,6 +1813,9 @@ const ADAPTERS = {
   web_extract: webExtract,
   email_send: emailSend,
   email_status_lookup: emailStatusLookup,
+  higgsfield_generate_image: higgsfieldGenerateImage,
+  higgsfield_generate_video: higgsfieldGenerateVideo,
+  higgsfield_product_photoshoot: higgsfieldProductPhotoshoot,
   supabase_list_projects: supabaseListProjects,
   supabase_rest_select: supabaseRestSelect,
   supabase_rest_insert: supabaseRestInsert,

package/middleware.js

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { createServerClient } from '@supabase/ssr';
+import { resolveEnvAuthConfig } from './lib/auth-env-fastpath.js';
 
 const PUBLIC_PREFIXES = [
   '/login',
@@ -59,18 +60,14 @@ function safeNext(pathname, search) {
 
 // Runs in the Edge runtime — cannot read node:sqlite. Resolves the UI-driven
 // auth config via the public /api/auth/config route, cached briefly in module
-// scope. An explicit MADARX_AUTH_MODE env value is the fast-path backstop.
+// scope. An explicit MADARX_AUTH_MODE env value WITH resolvable creds is the
+// fast-path backstop (resolveEnvAuthConfig); mode-without-creds defers to the
+// fetch so vault-stored keys still resolve.
 let _cfgCache = { at: 0, data: null };
 
 async function resolveAuthConfig(request) {
-  const envRaw = (process.env.MADARX_AUTH_MODE || '').trim().toLowerCase();
-  if (envRaw === 'local' || envRaw === 'supabase') {
-    return {
-      authMode: envRaw,
-      supabaseUrl: process.env.NEXT_PUBLIC_SUPABASE_URL || null,
-      supabaseAnonKey: process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || null,
-    };
-  }
+  const fromEnv = resolveEnvAuthConfig(process.env);
+  if (fromEnv) return fromEnv;
   const now = Date.now();
   if (_cfgCache.data && now - _cfgCache.at < 10_000) return _cfgCache.data;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madarx",
-  "version": "2.18.0",
+  "version": "2.21.0",
   "type": "module",
   "description": "Madarx OS — Next.js product with SQLite-backed runtime, scheduled cron daemon, and approval-gated local runners.",
   "license": "MIT",
@@ -44,6 +44,8 @@
     "prepublishOnly": "npm run build && node --no-warnings scripts/prepack-guard.mjs",
     "prepack": "node --no-warnings scripts/prepack-guard.mjs",
     "clean:dist-data": "node --no-warnings scripts/prepack-guard.mjs",
+    "build:cloud-schema": "node --no-warnings scripts/build-cloud-schema.mjs",
+    "prebuild": "node --no-warnings scripts/build-cloud-schema.mjs",
     "build": "NODE_OPTIONS=--no-warnings next build",
     "postbuild": "node --no-warnings scripts/postbuild-standalone.mjs",
     "postinstall": "node --no-warnings scripts/postinstall-splash.mjs",

package/scripts/build-cloud-schema.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * scripts/build-cloud-schema.mjs — generate the shipped cloud-schema bundle.
+ *
+ * WHY THIS EXISTS
+ *   The onboarding wizard needs to (a) show the operator the exact SQL that
+ *   stands up the Supabase shared layer, and (b) apply it one-click via the
+ *   Management API. The canonical SQL lives in supabase/migrations/*.sql — but
+ *   `supabase/` is NOT in package.json `files`, so a global install never ships
+ *   those files. This script concatenates the migrations (in deterministic
+ *   order) into lib/cloud-schema.generated.js, which DOES ship (lib/ is
+ *   whitelisted). The migrations stay the single source of truth; this is a
+ *   build artifact, regenerated on every `prebuild`.
+ *
+ * OUTPUT
+ *   lib/cloud-schema.generated.js exporting:
+ *     - CLOUD_SCHEMA_SQL  : one idempotent SQL script (all migrations, ordered)
+ *     - REQUIRED_TABLES   : the public.* tables the script creates
+ *     - SCHEMA_VERSION    : short content hash (changes when the SQL changes)
+ *     - MIGRATION_FILES   : the source filenames, in applied order
+ *
+ * Run: node scripts/build-cloud-schema.mjs   (also wired into `prebuild`)
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(here, '..');
+const MIGRATIONS_DIR = path.join(ROOT, 'supabase', 'migrations');
+const OUT_FILE = path.join(ROOT, 'lib', 'cloud-schema.generated.js');
+
+function main() {
+  if (!fs.existsSync(MIGRATIONS_DIR)) {
+    console.error(`[build-cloud-schema] migrations dir not found: ${MIGRATIONS_DIR}`);
+    process.exit(1);
+  }
+
+  // Deterministic order: lexical filename sort. The migrations are numbered and
+  // every statement is idempotent (CREATE … IF NOT EXISTS, drop-then-create
+  // policies), so concatenation in this order is safe to run as one script.
+  const files = fs
+    .readdirSync(MIGRATIONS_DIR)
+    .filter((f) => f.endsWith('.sql'))
+    .sort((a, b) => a.localeCompare(b));
+
+  if (!files.length) {
+    console.error('[build-cloud-schema] no .sql migrations found');
+    process.exit(1);
+  }
+
+  const parts = [];
+  parts.push('-- MadarX OS — Supabase shared-layer schema (generated bundle).');
+  parts.push('-- Generated from supabase/migrations/*.sql — DO NOT EDIT THE BUNDLE.');
+  parts.push('-- Idempotent: safe to run repeatedly in the Supabase SQL editor.');
+  parts.push('');
+
+  for (const file of files) {
+    const sql = fs.readFileSync(path.join(MIGRATIONS_DIR, file), 'utf8').trim();
+    parts.push(`-- ════════════════════════════════════════════════════════════════════`);
+    parts.push(`-- ▶ ${file}`);
+    parts.push(`-- ════════════════════════════════════════════════════════════════════`);
+    parts.push(sql);
+    parts.push('');
+  }
+
+  // Ask PostgREST to reload its schema cache so freshly-created tables are
+  // queryable immediately (the readiness probe hits PostgREST). Supabase also
+  // reloads via DDL event triggers, but this makes manual SQL-editor runs and
+  // Management-API applies verifiable without a wait.
+  parts.push('-- Refresh the PostgREST schema cache so new tables are visible now.');
+  parts.push("notify pgrst, 'reload schema';");
+  parts.push('');
+
+  const bundle = parts.join('\n');
+
+  // Parse the public.* tables the bundle creates so REQUIRED_TABLES stays in
+  // sync with the SQL automatically.
+  const tableRe = /create\s+table\s+(?:if\s+not\s+exists\s+)?public\.([a-z_][a-z0-9_]*)/gi;
+  const tables = new Set();
+  let m;
+  while ((m = tableRe.exec(bundle)) !== null) tables.add(m[1]);
+  const requiredTables = [...tables].sort();
+
+  const version = createHash('sha256').update(bundle).digest('hex').slice(0, 12);
+
+  const out =
+`/**
+ * lib/cloud-schema.generated.js — GENERATED. DO NOT EDIT BY HAND.
+ *
+ * Produced by scripts/build-cloud-schema.mjs from supabase/migrations/*.sql.
+ * Regenerate with: node scripts/build-cloud-schema.mjs  (runs on \`prebuild\`).
+ */
+
+/** The full idempotent SQL that stands up the Supabase shared layer. */
+export const CLOUD_SCHEMA_SQL = ${JSON.stringify(bundle)};
+
+/** Tables the bundle creates — used to probe whether the schema is applied. */
+export const REQUIRED_TABLES = ${JSON.stringify(requiredTables)};
+
+/** Source migration filenames, in applied order. */
+export const MIGRATION_FILES = ${JSON.stringify(files)};
+
+/** Short content hash; changes whenever the bundled SQL changes. */
+export const SCHEMA_VERSION = ${JSON.stringify(version)};
+`;
+
+  fs.writeFileSync(OUT_FILE, out, 'utf8');
+  console.log(
+    `[build-cloud-schema] wrote ${path.relative(ROOT, OUT_FILE)} ` +
+    `(${files.length} migrations, ${requiredTables.length} tables, ` +
+    `${bundle.length} bytes SQL, version ${version})`
+  );
+}
+
+main();

package/scripts/inspect-cloud-orgs.mjs

@@ -0,0 +1,30 @@
+// READ-ONLY: dump the shared-layer org tables so we can see current cloud state.
+// Never prints secrets. Run: node --env-file=.env.local scripts/inspect-cloud-orgs.mjs
+import { isSharedCloudReady, getSharedCloudAdmin } from '../lib/shared-cloud.js';
+
+if (!isSharedCloudReady()) {
+  console.error('shared cloud not configured (SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY missing).');
+  process.exit(1);
+}
+
+const admin = getSharedCloudAdmin();
+
+async function dump(table, opts = {}) {
+  try {
+    const rows = await admin.select(table, { limit: 500, ...opts });
+    console.log(`\n=== ${table} (${rows.length}) ===`);
+    for (const r of rows) console.log(JSON.stringify(r));
+    return rows;
+  } catch (err) {
+    console.log(`\n=== ${table} — ERROR: ${err.message} ===`);
+    return [];
+  }
+}
+
+await dump('organizations');
+await dump('org_memberships');
+await dump('shared_spaces');
+await dump('shared_artifacts');
+await dump('share_links');
+await dump('org_invites');
+await dump('shared_artifact_acl');

package/.next/standalone/.next/server/chunks/3379.js

@@ -1 +0,0 @@
-exports.id=3379,exports.ids=[3379],exports.modules={6974:(a,b,c)=>{Promise.resolve().then(c.bind(c,35271))},30021:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{"4026ce6c45a5dc9e3b2ec16c999fd4346780ba2018":()=>e.$$RSC_SERVER_ACTION_0});var e=c(91845),f=a([e]);e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},35271:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/admin/project-switcher.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/admin/project-switcher.jsx","default")},86893:(a,b,c)=>{"use strict";c.d(b,{hI:()=>g,iN:()=>f,pp:()=>i,qs:()=>h});var d=c(75338),e=c(35271);function f({kicker:a="madarX OS v1.0",title:b,description:c,actions:f,hideProjectSwitcher:g,children:h}){return(0,d.jsxs)("main",{className:"admin-shell",children:[(0,d.jsxs)("header",{className:"admin-header",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("span",{className:"admin-kicker",children:a}),(0,d.jsx)("h1",{children:b}),c?(0,d.jsx)("p",{children:c}):null]}),(0,d.jsxs)("div",{className:"admin-header-actions",children:[g?null:(0,d.jsx)(e.default,{}),f]})]}),h]})}function g({label:a,value:b,tone:c}){return(0,d.jsxs)("div",{className:`admin-stat ${c||""}`,children:[(0,d.jsx)("b",{children:b}),(0,d.jsx)("span",{children:a})]})}function h({children:a,tone:b="neutral"}){return(0,d.jsx)("span",{className:`admin-pill ${b}`,children:a})}function i({title:a,children:b}){return(0,d.jsxs)("div",{className:"admin-empty",children:[(0,d.jsx)("b",{children:a}),(0,d.jsx)("p",{children:b})]})}},89670:(a,b,c)=>{Promise.resolve().then(c.bind(c,94657))},91845:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{$$RSC_SERVER_ACTION_0:()=>u,default:()=>p,dynamic:()=>q,runtime:()=>r});var e=c(75338),f=c(75879);c(68633);var g=c(16780),h=c(82161),i=c(86893),j=c(83963),k=c(60105),l=a([j,k]);[j,k]=l.then?(await l)():l;let q="force-dynamic",r="nodejs",s={executive:"Executive",manager:"Manager",team_lead:"Team Lead",individual_contributor:"Contributor"},t={executive:"mars",manager:"ready",team_lead:"warn",individual_contributor:"neutral"};function m(a=""){return a.split(/\s+/).map(a=>a[0]).filter(Boolean).slice(0,2).join("").toUpperCase()||"\xb7"}let u=async function(a){let b=String(a.get("agent_id")||"").trim();if(!b)return;let c=String(a.get("reports_to")||"").trim(),d={reports_to:""===c?null:c},e=String(a.get("role")||"").trim();e&&(d.role=e);let f=String(a.get("title")||"").trim();(f||a.has("title"))&&(d.title=f||null);try{(0,j.jN)(b,d)}catch(a){console.warn("updateAgentOrg failed",a?.message)}(0,g.revalidatePath)("/org"),(0,g.revalidatePath)("/agents"),(0,h.redirect)("/org")};function n({node:a,workloadById:b}){let c=function(a){if(a.role&&s[a.role])return a.role;let b=a.reports?.length||0;return b>=4?"executive":b>=2?"manager":1===b?"team_lead":"individual_contributor"}(a),d=s[c],f=t[c],g=a.reports?.length||0,h=b.get(a.id),j=Number(h?.active_tasks||0),k=Number(h?.blocked_tasks||0),l=Number(h?.completed_tasks||0),n=a.status||"created";return(0,e.jsxs)("article",{className:`org-card org-card--${c}`,"data-reports":g>0?"has":"none",children:[(0,e.jsxs)("div",{className:"org-card-head",children:[(0,e.jsx)("div",{className:"org-card-avatar","aria-hidden":"true",children:m(a.name)}),(0,e.jsxs)("div",{className:"org-card-identity",children:[(0,e.jsx)("div",{className:"org-card-name",children:a.name}),(0,e.jsx)("div",{className:"org-card-title",children:a.title||a.mission?.slice(0,64)||"No title set"})]})]}),(0,e.jsxs)("div",{className:"org-card-meta",children:[(0,e.jsx)(i.qs,{tone:f,children:d}),(0,e.jsx)(i.qs,{tone:"heartbeat ok"===n?"ready":"terminated"===n?"danger":"neutral",children:n}),g>0?(0,e.jsxs)(i.qs,{tone:"neutral",children:[g," report",1===g?"":"s"]}):null]}),(0,e.jsxs)("dl",{className:"org-card-stats",children:[(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Active"}),(0,e.jsx)("dd",{children:j})]}),(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Blocked"}),(0,e.jsx)("dd",{className:k?"is-warn":"",children:k})]}),(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Done"}),(0,e.jsx)("dd",{children:l})]})]})]})}function o({node:a,workloadById:b}){let c=(a.reports||[]).length>0;return(0,e.jsxs)("li",{className:"org-branch",children:[(0,e.jsx)(n,{node:a,workloadById:b}),c?(0,e.jsx)("ul",{className:"org-children",children:a.reports.map(a=>(0,e.jsx)(o,{node:a,workloadById:b},a.id))}):null]})}function p(){let a=(0,j.zP)(),b=(0,j.hC)(),c=(0,k.vc)(),d=new Map((b.workload||[]).map(a=>[a.agent_id,a])),f=c.filter(a=>c.some(b=>b.reports_to===a.id)).length,g=c.filter(a=>!a.reports_to&&a.id).length;return(0,e.jsxs)(i.iN,{title:"Agent chart",description:"Company-style structure for your agent workforce. Set managers, define roles, and see workload at a glance.",children:[(0,e.jsxs)("section",{className:"admin-stats",children:[(0,e.jsx)(i.hI,{label:"Headcount",value:b.totals.active_agents}),(0,e.jsx)(i.hI,{label:"Leaders",value:f}),(0,e.jsx)(i.hI,{label:"Root nodes",value:g}),(0,e.jsx)(i.hI,{label:"Active tasks",value:b.totals.active_tasks})]}),(0,e.jsxs)("section",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Agent chart"}),(0,e.jsx)("small",{children:"Top-down hierarchy. Each card shows role, status, and current workload."})]}),a.length?(0,e.jsx)("div",{className:"org-chart-scroll",children:(0,e.jsx)("ul",{className:"org-chart",children:a.map(a=>(0,e.jsx)(o,{node:a,workloadById:d},a.id))})}):(0,e.jsx)(i.pp,{title:"No agents yet",children:"Create an agent on the Agents page, then come back here to assign managers."})]}),(0,e.jsxs)("section",{className:"admin-grid reports-layout",children:[(0,e.jsxs)("div",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Reporting lines"}),(0,e.jsx)("small",{children:"Re-parent any agent. Cycles are blocked automatically."})]}),c.length?(0,e.jsx)("div",{className:"admin-card-list compact",children:c.map(a=>{let b=a.reports_to?c.find(b=>b.id===a.reports_to):null,d=c.filter(b=>b.id!==a.id),f=a.role&&s[a.role]?a.role:"individual_contributor";return(0,e.jsxs)("form",{action:u,className:"org-reporting-row",children:[(0,e.jsx)("input",{type:"hidden",name:"agent_id",value:a.id}),(0,e.jsxs)("div",{className:"org-reporting-identity",children:[(0,e.jsx)("div",{className:"org-card-avatar small","aria-hidden":"true",children:m(a.name)}),(0,e.jsxs)("div",{children:[(0,e.jsx)("div",{className:"org-reporting-name",children:a.name}),(0,e.jsx)("div",{className:"org-reporting-sub",children:b?`Reports to ${b.name}`:"Top of chain"})]})]}),(0,e.jsxs)("div",{className:"org-reporting-fields",children:[(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Title"}),(0,e.jsx)("input",{type:"text",name:"title",defaultValue:a.title||"",placeholder:"e.g. Marketing Manager"})]}),(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Role"}),(0,e.jsx)("select",{name:"role",defaultValue:f,children:Object.entries(s).map(([a,b])=>(0,e.jsx)("option",{value:a,children:b},a))})]}),(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Manager"}),(0,e.jsxs)("select",{name:"reports_to",defaultValue:a.reports_to||"",children:[(0,e.jsx)("option",{value:"",children:"— None (top of chain)"}),d.map(a=>(0,e.jsx)("option",{value:a.id,children:a.name},a.id))]})]}),(0,e.jsx)("button",{className:"admin-button",type:"submit",children:"Save"})]})]},a.id)})}):(0,e.jsx)(i.pp,{title:"No agents yet",children:"Create agents to start building your org."})]}),(0,e.jsxs)("div",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Workload by agent"}),(0,e.jsx)("small",{children:"Derived from active tasks."})]}),b.workload.length?(0,e.jsx)("div",{className:"admin-card-list compact",children:b.workload.map(a=>(0,e.jsxs)("div",{className:"admin-record compact",children:[(0,e.jsxs)("div",{className:"admin-record-top",children:[(0,e.jsx)("b",{children:a.agent_name||a.agent_id}),(0,e.jsxs)(i.qs,{tone:a.blocked_tasks?"danger":a.active_tasks?"ready":"neutral",children:[a.active_tasks," active"]})]}),(0,e.jsxs)("p",{children:[a.total_tasks," total \xb7 ",a.blocked_tasks," blocked \xb7 ",a.completed_tasks," complete"]})]},a.agent_id))}):(0,e.jsx)(i.pp,{title:"No workload data",children:"Assign tasks to see workload distribution."})]})]})]})}(0,f.A)(u,"4026ce6c45a5dc9e3b2ec16c999fd4346780ba2018",null),d()}catch(a){d(a)}})},94657:(a,b,c)=>{"use strict";c.d(b,{default:()=>f});var d=c(21124),e=c(38301);function f(){let[a,b]=(0,e.useState)([]),[c,f]=(0,e.useState)("");return(0,d.jsx)("div",{className:"project-switcher","data-project-switcher":!0,children:(0,d.jsxs)("select",{value:c,onChange:a=>{var b;f(b=a.target.value),b?localStorage.setItem("madarx.activeProjectId",b):localStorage.removeItem("madarx.activeProjectId"),window.dispatchEvent(new CustomEvent("madarx:project-change",{detail:{project_id:b||null}}))},"aria-label":"Active project",children:[(0,d.jsx)("option",{value:"",children:"All projects"}),a.map(a=>(0,d.jsx)("option",{value:a.id,children:a.name},a.id))]})})}}};