@auersperg/flare 0.3.2 → 0.3.4

package/dist/platform/admin.js

@@ -0,0 +1,790 @@
+// packages/core/src/retention.ts
+var jobRetentionMs = 30 * 86400000;
+var catalogDeadlines = new WeakMap;
+async function collectCatalog(database, now = Date.now()) {
+  if (now < (catalogDeadlines.get(database) ?? 0))
+    return;
+  const next = now + 86400000;
+  const claim = await database.prepare("UPDATE maintenance SET next=? WHERE id=1 AND next<=? RETURNING id").bind(next, now).first();
+  catalogDeadlines.set(database, claim ? next : now + 60000);
+  if (!claim)
+    return;
+  const statements = [
+    database.prepare("DELETE FROM audit WHERE id IN (SELECT id FROM audit WHERE at<? ORDER BY at LIMIT 1000)").bind(now - 90 * 86400000),
+    database.prepare("DELETE FROM credentials WHERE hash IN (SELECT hash FROM credentials WHERE expiresAt<? ORDER BY expiresAt LIMIT 1000)").bind(now - 14 * 86400000),
+    database.prepare("DELETE FROM cli_logins WHERE id IN (SELECT id FROM cli_logins WHERE expiresAt<? ORDER BY expiresAt LIMIT 1000)").bind(now)
+  ];
+  const result = await database.batch(statements);
+  if (result.some((value) => Number(value.meta.changes) >= 1000)) {
+    catalogDeadlines.set(database, now + 60000);
+    await database.prepare("UPDATE maintenance SET next=? WHERE id=1").bind(now + 60000).run();
+  }
+}
+// packages/core/package.json
+var package_default = {
+  name: "@flare/platform",
+  version: "0.3.4",
+  type: "module",
+  license: "MIT",
+  private: true,
+  files: [
+    "dist",
+    "src",
+    "bootstrap",
+    "migrations",
+    "README.md"
+  ],
+  dependencies: {
+    agents: "0.28.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/auersperg/flare.git",
+    directory: "packages/core"
+  }
+};
+
+// packages/flare/src/sdk/protocol.ts
+var LIMITS = Object.freeze({
+  inputBytes: 65536,
+  outputBytes: 262144,
+  frameBytes: 8192,
+  subscriptions: 64,
+  fileBytes: 10485760
+});
+
+class FlareError extends Error {
+  code;
+  ambiguous;
+  constructor(code, message, ambiguous = false) {
+    super(message);
+    this.code = code;
+    this.ambiguous = ambiguous;
+    this.name = "FlareError";
+  }
+}
+function stableJson(value) {
+  const ancestors = new Set;
+  function visit(v, depth) {
+    if (depth > 40)
+      throw new FlareError("INVALID_JSON", "JSON nesting limit exceeded");
+    if (v === null || typeof v === "string" || typeof v === "boolean")
+      return v;
+    if (typeof v === "number" && Number.isFinite(v))
+      return v;
+    if (typeof v !== "object" || v === null || ancestors.has(v))
+      throw new FlareError("INVALID_JSON", "Expected lossless JSON");
+    if (!Array.isArray(v) && Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null) {
+      throw new FlareError("INVALID_JSON", "Expected plain JSON object");
+    }
+    if (Object.getOwnPropertySymbols(v).length)
+      throw new FlareError("INVALID_JSON", "Symbol keys are unsupported");
+    ancestors.add(v);
+    let result;
+    if (Array.isArray(v)) {
+      result = Array.from(v, (item) => visit(item, depth + 1));
+    } else {
+      const out = Object.create(null);
+      for (const key of Object.keys(v).sort()) {
+        const descriptor = Object.getOwnPropertyDescriptor(v, key);
+        if (!("value" in descriptor))
+          throw new FlareError("INVALID_JSON", "Getters are unsupported");
+        out[key] = visit(descriptor.value, depth + 1);
+      }
+      result = out;
+    }
+    ancestors.delete(v);
+    return result;
+  }
+  return JSON.stringify(visit(value, 0));
+}
+function boundedJson(value, maxBytes) {
+  const json = stableJson(value);
+  if (new TextEncoder().encode(json).byteLength > maxBytes)
+    throw new FlareError("TOO_LARGE", "JSON payload exceeds limit");
+  return json;
+}
+
+// packages/core/src/security.ts
+function fail(code) {
+  throw new FlareError(code, code);
+}
+var uuid = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value) ? value : fail("INVALID_ID");
+var environment = (value) => value === "dev" || value === "prod" ? value : fail("INVALID_ENV");
+async function digest(value) {
+  return [
+    ...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)))
+  ].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+async function jsonBody(request, limit = LIMITS.inputBytes) {
+  if (!request.headers.get("content-type")?.startsWith("application/json"))
+    fail("INVALID_CONTENT_TYPE");
+  if (!request.body)
+    fail("INVALID_INPUT");
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > limit)
+        fail("TOO_LARGE");
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const c of chunks) {
+    bytes.set(c, offset);
+    offset += c.byteLength;
+  }
+  try {
+    const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    boundedJson(parsed, limit);
+    return parsed;
+  } catch {
+    fail("INVALID_INPUT");
+  }
+}
+var decode = (s) => Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+var encoder = new TextEncoder;
+var jwksCache = new Map;
+var jwksPending = new Map;
+function loadJwks(url, rotation) {
+  const existing = jwksPending.get(url);
+  if (existing)
+    return existing;
+  const pending = (async () => {
+    const response = await fetch(url, {
+      redirect: "manual",
+      signal: AbortSignal.timeout(5000)
+    });
+    if (!response.ok)
+      fail("AUTH_UNAVAILABLE");
+    const raw = await jsonBody(response, 65536);
+    if (!Array.isArray(raw.keys) || raw.keys.length > 16)
+      fail("AUTH_UNAVAILABLE");
+    const cached = {
+      until: Date.now() + 300000,
+      refreshAfter: rotation ? Date.now() + 60000 : 0,
+      keys: raw.keys,
+      imported: new Map
+    };
+    if (jwksCache.size >= 32 && !jwksCache.has(url))
+      jwksCache.delete(jwksCache.keys().next().value);
+    jwksCache.set(url, cached);
+    return cached;
+  })();
+  jwksPending.set(url, pending);
+  pending.finally(() => jwksPending.delete(url)).catch(() => {
+    return;
+  });
+  return pending;
+}
+function validateOidc(value) {
+  if (!value || typeof value.issuer !== "string" || typeof value.audience !== "string" || value.audience.length < 1 || value.audience.length > 256)
+    fail("INVALID_AUTH_CONFIG");
+  for (const field of ["issuer", "jwks"]) {
+    const u = new URL(value[field]);
+    if (u.protocol !== "https:" || u.username || u.password || u.port || u.hash || u.search || u.hostname === "localhost" || !u.hostname.includes(".") || /^(\d+\.){3}\d+$/.test(u.hostname) || u.hostname.includes(":"))
+      fail("INVALID_AUTH_CONFIG");
+  }
+  if (new URL(value.issuer).origin !== new URL(value.jwks).origin)
+    fail("INVALID_AUTH_CONFIG");
+  return value;
+}
+function claimsAuth(claims, issuer, audience) {
+  const now = Date.now() / 1000;
+  if (claims.iss !== issuer || !(claims.aud === audience || Array.isArray(claims.aud) && claims.aud.includes(audience)) || typeof claims.sub !== "string" || !claims.sub || !Number.isFinite(claims.exp) || claims.exp <= now || claims.nbf !== undefined && (!Number.isFinite(claims.nbf) || claims.nbf > now))
+    fail("UNAUTHORIZED");
+  const auth = {
+    subject: claims.sub,
+    issuer,
+    expiresAt: claims.exp * 1000,
+    claims
+  };
+  boundedJson(auth, 1536);
+  return auth;
+}
+async function verifyJwt(token, config) {
+  validateOidc(config);
+  if (token.length > 8192)
+    fail("UNAUTHORIZED");
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+      fail("UNAUTHORIZED");
+    const header = JSON.parse(new TextDecoder().decode(decode(parts[0])));
+    if (header.alg !== "RS256" || typeof header.kid !== "string" || header.crit)
+      fail("UNAUTHORIZED");
+    let cached = jwksCache.get(config.jwks);
+    if (!cached || cached.until < Date.now())
+      cached = await loadJwks(config.jwks, false);
+    const match = () => cached.keys.find((k) => k.kid === header.kid && k.kty === "RSA" && (!k.alg || k.alg === "RS256") && (!k.use || k.use === "sig"));
+    let jwk = match();
+    if (!jwk && cached.refreshAfter <= Date.now()) {
+      cached.refreshAfter = Date.now() + 60000;
+      cached = await loadJwks(config.jwks, true);
+      jwk = match();
+    }
+    if (!jwk)
+      fail("UNAUTHORIZED");
+    let imported = cached.imported.get(header.kid);
+    if (!imported) {
+      imported = crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+      cached.imported.set(header.kid, imported);
+    }
+    const key = await imported;
+    if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, decode(parts[2]), encoder.encode(parts[0] + "." + parts[1])))
+      fail("UNAUTHORIZED");
+    return claimsAuth(JSON.parse(new TextDecoder().decode(decode(parts[1]))), config.issuer, config.audience);
+  } catch (e) {
+    if (e instanceof FlareError)
+      throw e;
+    fail("UNAUTHORIZED");
+  }
+}
+function origins(value) {
+  if (!Array.isArray(value) || value.length > 10)
+    fail("INVALID_ORIGIN");
+  return value.map((x) => {
+    if (typeof x !== "string")
+      fail("INVALID_ORIGIN");
+    const u = new URL(x);
+    if (u.origin !== x || u.username || u.password || !(u.protocol === "https:" || u.protocol === "http:" && ["localhost", "127.0.0.1"].includes(u.hostname)))
+      fail("INVALID_ORIGIN");
+    return x;
+  });
+}
+function status(error) {
+  const code = error instanceof FlareError ? error.code : "OPERATION_FAILED";
+  return {
+    code,
+    status: code === "RATE_LIMITED" ? 429 : ["AUTH_DISABLED", "REGISTRATION_DISABLED"].includes(code) ? 403 : code === "REGISTRATION_UNAVAILABLE" ? 409 : code === "UNAUTHORIZED" || code === "AUTH_EXPIRED" ? 401 : code === "FORBIDDEN" ? 403 : code === "NOT_FOUND" || code === "FUNCTION_NOT_FOUND" ? 404 : ["TOO_LARGE", "BACKUP_TOO_LARGE"].includes(code) ? 413 : ["CONFLICT", "BACKUP_BUSY", "RESTORE_NOT_EMPTY"].includes(code) ? 409 : code.startsWith("INVALID") || code === "READ_ONLY" ? 400 : [
+      "NOT_READY",
+      "UNSUPPORTED",
+      "RESTORE_IN_PROGRESS"
+    ].includes(code) ? 503 : 500
+  };
+}
+function unwrap(result) {
+  if (!result.ok)
+    fail(result.code);
+  return result.value;
+}
+function accessAssertion(request) {
+  const assertion = request.headers.get("CF-Access-Jwt-Assertion");
+  if (assertion)
+    return assertion;
+  const matches = (request.headers.get("cookie") ?? "").split(";").map((x) => x.trim()).filter((x) => x.startsWith("CF_Authorization="));
+  if (matches.length !== 1)
+    fail("UNAUTHORIZED");
+  const token = matches[0].slice("CF_Authorization=".length);
+  if (!token)
+    fail("UNAUTHORIZED");
+  return token;
+}
+async function accessEmail(access, audience) {
+  if (!access || !audience || access.aud !== audience)
+    fail("UNAUTHORIZED");
+  const identity = await access.getIdentity();
+  if (!identity || typeof identity.email !== "string" || !identity.email)
+    fail("UNAUTHORIZED");
+  return identity.email.toLowerCase();
+}
+
+// packages/core/src/project-deletion.ts
+function authorizeProjectDeletion(actor, project, input) {
+  if (actor.role !== "owner" || actor.projectId)
+    fail("FORBIDDEN");
+  if (input.confirm !== uuid(project.id) || input.name !== project.name)
+    fail("INVALID_CONFIRMATION");
+}
+async function deleteProject(catalog, runtime, projectId) {
+  const id = uuid(projectId);
+  await catalog.batch([
+    catalog.prepare("INSERT OR IGNORE INTO project_deletions VALUES (?,?)").bind(id, Date.now()),
+    catalog.prepare("UPDATE credentials SET revoked=1 WHERE projectId=?").bind(id)
+  ]);
+  for (const env of ["dev", "prod"])
+    await runtime.prepareDestroy(`${id}/${env}`);
+  for (const env of ["dev", "prod"])
+    await runtime.destroy(`${id}/${env}`);
+  await catalog.batch([
+    catalog.prepare("DELETE FROM credentials WHERE projectId=?").bind(id),
+    catalog.prepare("DELETE FROM environments WHERE projectId=?").bind(id),
+    catalog.prepare("UPDATE project_aliases SET published=0 WHERE projectId=?").bind(id),
+    catalog.prepare("DELETE FROM projects WHERE id=?").bind(id)
+  ]);
+  return { deleted: true, id };
+}
+
+// packages/core/src/cli-login.ts
+var json = (value, status = 200) => Response.json(value, { status, headers: { "cache-control": "no-store" } });
+async function publicLogin(request, env) {
+  if (request.method !== "POST")
+    return json({ error: "METHOD_NOT_ALLOWED" }, 405);
+  const input = await jsonBody(request, 8192), path = new URL(request.url).pathname;
+  if (path === "/api/cli/start") {
+    if (!/^[a-f0-9]{64}$/.test(input.secretHash) || typeof input.publicKey !== "object" || input.publicKey?.kty !== "RSA")
+      fail("INVALID_INPUT");
+    await crypto.subtle.importKey("jwk", input.publicKey, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);
+    await env.CATALOG.prepare("DELETE FROM cli_logins WHERE expiresAt<?").bind(Date.now()).run();
+    const id = crypto.randomUUID(), code = crypto.randomUUID().slice(0, 8).toUpperCase();
+    await env.CATALOG.prepare("INSERT INTO cli_logins (id,secretHash,publicKey,code,expiresAt) VALUES (?,?,?,?,?)").bind(id, input.secretHash, JSON.stringify(input.publicKey), code, Date.now() + 600000).run();
+    return json({
+      id,
+      code,
+      dashboard: env.DASHBOARD_URL,
+      expiresIn: 600,
+      interval: 3
+    });
+  }
+  if (path !== "/api/cli/poll")
+    fail("NOT_FOUND");
+  const id = uuid(input.id);
+  if (typeof input.secret !== "string" || !/^[a-f0-9]{64}$/.test(input.secret))
+    fail("UNAUTHORIZED");
+  const hash = await digest(input.secret);
+  const result = await env.CATALOG.prepare("DELETE FROM cli_logins WHERE id=? AND secretHash=? AND expiresAt>? AND payload IS NOT NULL RETURNING payload").bind(id, hash, Date.now()).first();
+  if (result)
+    return json(JSON.parse(result.payload));
+  const pending = await env.CATALOG.prepare("SELECT id FROM cli_logins WHERE id=? AND secretHash=? AND expiresAt>?").bind(id, hash, Date.now()).first();
+  if (!pending)
+    fail("UNAUTHORIZED");
+  return json({ pending: true }, 202);
+}
+async function loginInfo(env, id) {
+  const row = await env.CATALOG.prepare("SELECT code,expiresAt,payload FROM cli_logins WHERE id=? AND expiresAt>?").bind(uuid(id), Date.now()).first();
+  if (!row || row.payload)
+    fail("NOT_FOUND");
+  return { code: row.code, expiresAt: row.expiresAt };
+}
+async function approveLogin(env, id, project, email, platform) {
+  const row = await env.CATALOG.prepare("SELECT publicKey FROM cli_logins WHERE id=? AND expiresAt>? AND payload IS NULL").bind(uuid(id), Date.now()).first();
+  if (!row)
+    fail("NOT_FOUND");
+  const token = crypto.randomUUID() + crypto.randomUUID(), expiresAt = Date.now() + 30 * 86400000;
+  const key = await crypto.subtle.importKey("jwk", JSON.parse(row.publicKey), { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);
+  const cipher = await crypto.subtle.encrypt({ name: "RSA-OAEP" }, key, new TextEncoder().encode(token));
+  const encrypted = btoa(String.fromCharCode(...new Uint8Array(cipher)));
+  const results = await env.CATALOG.batch([
+    env.CATALOG.prepare("INSERT INTO credentials (hash,projectId,actor,expiresAt,revoked) SELECT ?,?,?,?,0 WHERE EXISTS (SELECT 1 FROM cli_logins WHERE id=? AND expiresAt>? AND payload IS NULL)").bind(await digest(token), uuid(project), email, expiresAt, id, Date.now()),
+    env.CATALOG.prepare("UPDATE cli_logins SET payload=? WHERE id=? AND expiresAt>? AND payload IS NULL").bind(JSON.stringify({ encrypted, platform, project, expiresAt }), id, Date.now())
+  ]);
+  if (!results[1].meta.changes)
+    fail("CONFLICT");
+  return { ok: true };
+}
+
+// packages/core/src/admin.ts
+import { WorkerEntrypoint } from "cloudflare:workers";
+
+// packages/core/src/routing.ts
+var reserved = new Set(["p", "api", "control", "health", "v1", "cdn-cgi"]);
+function projectAlias(value) {
+  if (typeof value !== "string" || !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(value) || value.length > 48 || reserved.has(value))
+    fail("INVALID_ALIAS");
+  return value;
+}
+function defaultAlias(name, id) {
+  const stem = name.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32).replace(/-+$/g, "");
+  return projectAlias((/^[a-z]/.test(stem) ? stem : "app") + "-" + uuid(id).slice(0, 8));
+}
+function applicationUrl(base, id, env, alias) {
+  return base.replace(/\/$/, "") + (alias ? "/" + projectAlias(alias) : "/p/" + uuid(id)) + "/" + environment(env);
+}
+
+// packages/core/src/admin.ts
+function runtime(env) {
+  return new Proxy({}, {
+    get: (_target, key) => (...args) => env.RUNTIME.command(String(key), args).then(unwrap)
+  });
+}
+var json2 = (data, status = 200) => Response.json(data, {
+  status,
+  headers: {
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff"
+  }
+});
+async function actor(request, env, credentialsOnly = false, ctx) {
+  if (credentialsOnly) {
+    const bearer = request.headers.get("authorization");
+    if (!bearer?.startsWith("Bearer ") || bearer.length > 256)
+      fail("UNAUTHORIZED");
+    const row = await env.CATALOG.prepare("SELECT c.actor,c.projectId,m.role FROM credentials c JOIN members m ON m.email=c.actor WHERE c.hash=? AND c.revoked=0 AND c.expiresAt>? AND NOT EXISTS (SELECT 1 FROM project_deletions d WHERE d.projectId=c.projectId)").bind(await digest(bearer.slice(7)), Date.now()).first();
+    if (!row || row.role === "viewer")
+      fail("UNAUTHORIZED");
+    return { email: row.actor, role: row.role, projectId: row.projectId };
+  }
+  const email = ctx?.access ? await accessEmail(ctx.access, env.ACCESS_AUD) : String((await verifyJwt(accessAssertion(request), {
+    issuer: env.ACCESS_ISSUER,
+    audience: env.ACCESS_AUD,
+    jwks: env.ACCESS_ISSUER + "/cdn-cgi/access/certs"
+  })).claims.email ?? "").toLowerCase();
+  if (!email || email.length > 254)
+    fail("UNAUTHORIZED");
+  const member = await env.CATALOG.prepare("SELECT role FROM members WHERE email=?").bind(email).first();
+  if (!member)
+    fail("FORBIDDEN");
+  return { email: email.toLowerCase(), role: member.role, projectId: null };
+}
+var writable = (a) => {
+  if (a.role === "viewer")
+    fail("FORBIDDEN");
+};
+async function audit(env, a, projectId, which, operation, work) {
+  await collectCatalog(env.CATALOG).catch((error) => console.warn({
+    source: "flare-catalog-retention",
+    code: status(error).code
+  }));
+  const id = crypto.randomUUID();
+  await env.CATALOG.prepare("INSERT INTO audit VALUES (?,?,?,?,?,?,?,?)").bind(id, Date.now(), a.email, projectId, which, operation, "pending", "{}").run();
+  try {
+    const result = await work();
+    await env.CATALOG.prepare("UPDATE audit SET status='ok' WHERE id=?").bind(id).run().catch((error) => console.warn({
+      source: "flare-audit-finalize",
+      code: status(error).code
+    }));
+    return result;
+  } catch (e) {
+    await env.CATALOG.prepare("UPDATE audit SET status='error',detail=? WHERE id=?").bind(JSON.stringify({ code: status(e).code }), id).run().catch((error) => console.warn({
+      source: "flare-audit-finalize",
+      code: status(error).code
+    }));
+    throw e;
+  }
+}
+async function bootstrap(env) {
+  const get = async (path) => (await env.ASSETS.fetch(new Request("https://assets.internal/bootstrap/" + path))).text();
+  return {
+    release: JSON.parse(await get("release.json")),
+    manifest: JSON.parse(await get("manifest.json")),
+    schema: JSON.parse(await get("schema.json")),
+    facet: await get("facet.js"),
+    action: await get("action.js")
+  };
+}
+async function publishAlias(env, id, alias) {
+  projectAlias(alias);
+  await env.CATALOG.prepare("INSERT INTO project_aliases (projectId,alias) VALUES (?,?) ON CONFLICT DO NOTHING").bind(id, alias).run();
+  const reserved = await env.CATALOG.prepare("SELECT alias FROM project_aliases WHERE projectId=?").bind(id).first();
+  if (reserved?.alias !== alias)
+    fail("CONFLICT");
+  await runtime(env).publishAlias(alias, id);
+  await env.CATALOG.prepare("UPDATE project_aliases SET published=1 WHERE projectId=? AND alias=?").bind(id, alias).run();
+  return { alias };
+}
+async function api(request, env, a) {
+  const url = new URL(request.url), path = url.pathname;
+  if (path === "/api/cli/approval") {
+    if (a.projectId || a.role !== "owner")
+      fail("FORBIDDEN");
+    if (request.method === "GET")
+      return json2(await loginInfo(env, url.searchParams.get("id") ?? ""));
+    if (request.method !== "POST")
+      return json2({ error: "METHOD_NOT_ALLOWED" }, 405);
+    const input = await jsonBody(request);
+    const selected = uuid(input.project);
+    if (!await env.CATALOG.prepare("SELECT id FROM projects WHERE id=? AND NOT EXISTS (SELECT 1 FROM project_deletions WHERE projectId=projects.id)").bind(selected).first())
+      fail("NOT_FOUND");
+    return json2(await audit(env, a, selected, "dev", "cli.login", () => approveLogin(env, input.id, selected, a.email, env.RUNTIME_URL + "/control")));
+  }
+  if (path === "/api/session" && request.method === "GET")
+    return json2({
+      email: a.email,
+      role: a.role,
+      projectId: a.projectId,
+      runtime: env.RUNTIME_URL,
+      version: package_default.version,
+      stage: "trusted-team-preview"
+    });
+  if (path === "/api/projects" && request.method === "GET") {
+    const rows = await env.CATALOG.prepare("SELECT p.*,c.name customer,r.alias,EXISTS(SELECT 1 FROM project_deletions d WHERE d.projectId=p.id) deleting FROM projects p JOIN customers c ON c.id=p.customerId LEFT JOIN project_aliases r ON r.projectId=p.id AND r.published=1 WHERE (? IS NULL OR p.id=?) ORDER BY p.createdAt DESC LIMIT 100").bind(a.projectId, a.projectId).all();
+    return json2(rows.results);
+  }
+  if (path === "/api/projects" && request.method === "POST") {
+    if (a.projectId)
+      fail("FORBIDDEN");
+    writable(a);
+    const input = await jsonBody(request);
+    for (const field of ["name", "customer"])
+      if (typeof input[field] !== "string" || input[field].trim().length < 1 || input[field].length > 100)
+        fail("INVALID_INPUT");
+    const customer = await env.CATALOG.prepare("SELECT id FROM customers WHERE name=? COLLATE NOCASE LIMIT 1").bind(input.customer.trim()).first();
+    const id = crypto.randomUUID(), customerId = customer?.id ?? crypto.randomUUID(), at = Date.now();
+    const alias = input.alias ? projectAlias(input.alias) : defaultAlias(input.name, id);
+    if (await env.CATALOG.prepare("SELECT projectId FROM project_aliases WHERE alias=?").bind(alias).first())
+      fail("CONFLICT");
+    const allowed = origins(input.origins ?? []);
+    const result = await audit(env, a, id, null, "project.create", async () => {
+      await env.CATALOG.batch([
+        ...customer ? [] : [
+          env.CATALOG.prepare("INSERT INTO customers VALUES (?,?,?)").bind(customerId, input.customer.trim(), at)
+        ],
+        env.CATALOG.prepare("INSERT INTO projects VALUES (?,?,?,?)").bind(id, customerId, input.name.trim(), at),
+        env.CATALOG.prepare("INSERT INTO project_aliases (projectId,alias) VALUES (?,?)").bind(id, alias),
+        ...["dev", "prod"].map((e) => env.CATALOG.prepare("INSERT INTO environments (projectId,env,origins) VALUES (?,?,?)").bind(id, e, JSON.stringify(allowed)))
+      ]);
+      const bundle = await bootstrap(env);
+      for (const e of ["dev", "prod"]) {
+        await runtime(env).configure({
+          scope: `${id}/${e}`,
+          origins: allowed,
+          oidc: null
+        });
+        await runtime(env).deploy(`${id}/${e}`, bundle);
+      }
+      await publishAlias(env, id, alias);
+      return { id, alias };
+    });
+    return json2(result, 201);
+  }
+  const match = path.match(/^\/api\/projects\/([^/]+)(?:\/(alias|delete|dev|prod)(?:\/([a-z-]+))?)?$/);
+  if (!match)
+    fail("NOT_FOUND");
+  const projectId = uuid(match[1]);
+  if (a.projectId && a.projectId !== projectId)
+    fail("FORBIDDEN");
+  const project = await env.CATALOG.prepare("SELECT p.*,r.alias,EXISTS(SELECT 1 FROM project_deletions d WHERE d.projectId=p.id) deleting FROM projects p LEFT JOIN project_aliases r ON r.projectId=p.id AND r.published=1 WHERE p.id=?").bind(projectId).first();
+  if (!project)
+    fail("NOT_FOUND");
+  if (match[2] === "delete" && !match[3]) {
+    if (request.method !== "POST")
+      return json2({ error: "METHOD_NOT_ALLOWED" }, 405);
+    const input = await jsonBody(request);
+    authorizeProjectDeletion(a, project, input);
+    return json2(await audit(env, a, projectId, null, "project.delete", () => deleteProject(env.CATALOG, runtime(env), projectId)));
+  }
+  if (project.deleting && match[2])
+    fail("NOT_READY");
+  if (match[2] === "alias") {
+    if (request.method !== "POST")
+      return json2({ error: "METHOD_NOT_ALLOWED" }, 405);
+    if (a.role !== "owner" || a.projectId)
+      fail("FORBIDDEN");
+    const input = await jsonBody(request);
+    const alias = projectAlias(input.alias);
+    return json2(await audit(env, a, projectId, null, "project.alias", () => publishAlias(env, projectId, alias)));
+  }
+  if (!match[2])
+    return json2({
+      project,
+      environments: (await env.CATALOG.prepare("SELECT * FROM environments WHERE projectId=?").bind(projectId).all()).results,
+      runtime: env.RUNTIME_URL,
+      urls: Object.fromEntries(["dev", "prod"].map((e) => [
+        e,
+        applicationUrl(env.RUNTIME_URL, projectId, e, project.alias)
+      ]))
+    });
+  const which = environment(match[2]), scope = `${projectId}/${which}`, op = match[3] ?? "health";
+  if (request.method === "GET") {
+    if (["release", "release-bundle"].includes(op)) {
+      const hash = url.searchParams.get("hash");
+      if (!hash || !/^[a-f0-9]{64}$/.test(hash))
+        fail("INVALID_INPUT");
+      if (op === "release-bundle" && a.role === "viewer")
+        fail("FORBIDDEN");
+      return json2(await runtime(env).admin(scope, op === "release" ? "release-details" : "release-export", { hash }));
+    }
+    if (op === "settings") {
+      const row = await env.CATALOG.prepare("SELECT * FROM environments WHERE projectId=? AND env=?").bind(projectId, which).first();
+      return json2({
+        ...row,
+        origins: JSON.parse(row.origins),
+        oidc: row.oidc ? JSON.parse(row.oidc) : null,
+        url: applicationUrl(env.RUNTIME_URL, projectId, which, project.alias),
+        alias: project.alias
+      });
+    }
+    if (op === "file-download")
+      return json2(await runtime(env).admin(scope, "file-download", {
+        id: url.searchParams.get("id")
+      }));
+    if (op === "audit")
+      return json2((await env.CATALOG.prepare("SELECT * FROM audit WHERE projectId=? ORDER BY at DESC LIMIT 100").bind(projectId).all()).results);
+    if (![
+      "auth-users",
+      "auth-settings",
+      "health",
+      "schema",
+      "data",
+      "functions",
+      "logs",
+      "history",
+      "jobs",
+      "files",
+      "crons",
+      "backups",
+      "backup-status"
+    ].includes(op))
+      fail("INVALID_OPERATION");
+    const input = {};
+    if (url.searchParams.has("table"))
+      input.table = url.searchParams.get("table");
+    if (url.searchParams.has("cursor")) {
+      input.cursor = url.searchParams.get("cursor");
+      if (!input.cursor || input.cursor.length > 8192)
+        fail("INVALID_CURSOR");
+    }
+    if (url.searchParams.has("limit")) {
+      const value = url.searchParams.get("limit");
+      if (!/^\d{1,3}$/.test(value) || Number(value) < 1 || Number(value) > 100)
+        fail("INVALID_INPUT");
+      input.limit = Number(value);
+    }
+    return json2(await runtime(env).admin(scope, op === "backups" ? "backup-list" : op, input));
+  }
+  if (request.method !== "POST")
+    return json2({ error: "METHOD_NOT_ALLOWED" }, 405);
+  writable(a);
+  const input = await jsonBody(request, op === "deploy" ? 4 * 1048576 : 65536);
+  if (which === "prod" && input.confirm !== projectId)
+    fail("INVALID_CONFIRMATION");
+  if ([
+    "auth-create",
+    "auth-password",
+    "auth-disable",
+    "auth-revoke",
+    "auth-configure"
+  ].includes(op)) {
+    if (a.role !== "owner" || a.projectId)
+      fail("FORBIDDEN");
+    return json2(await audit(env, a, projectId, which, op, () => runtime(env).admin(scope, op, input)));
+  }
+  if (op === "deploy") {
+    if (input.expected !== undefined && !/^[a-f0-9]{64}$/.test(input.expected))
+      fail("INVALID_INPUT");
+    const result = await audit(env, a, projectId, which, "release.deploy", () => runtime(env).deploy(scope, input.bundle, input.expected));
+    return json2({
+      ...result,
+      url: applicationUrl(env.RUNTIME_URL, projectId, which, project.alias)
+    });
+  }
+  if (["release-promote", "release-rollback"].includes(op)) {
+    if (!/^[a-f0-9]{64}$/.test(input.hash ?? "") || !/^[a-f0-9]{64}$/.test(input.expected ?? ""))
+      fail("INVALID_INPUT");
+    if (op === "release-promote" && which !== "prod")
+      fail("FORBIDDEN");
+    return json2(await audit(env, a, projectId, which, op, () => runtime(env).admin(scope, op, input)));
+  }
+  if (["backup-create", "backup-delete", "backup-restore"].includes(op)) {
+    if (a.role !== "owner")
+      fail("FORBIDDEN");
+    uuid(input.id);
+    if (op === "backup-restore")
+      input.source = `${projectId}/${environment(input.sourceEnv)}`;
+    return json2(await audit(env, a, projectId, which, op, () => runtime(env).admin(scope, op, input)));
+  }
+  if (op === "edit")
+    return json2(await audit(env, a, projectId, which, "data." + input.operation, () => runtime(env).admin(scope, "edit", input)));
+  if ([
+    "file-upload",
+    "file-delete",
+    "job-cancel",
+    "cron-set",
+    "cron-cancel"
+  ].includes(op))
+    return json2(await audit(env, a, projectId, which, op, () => runtime(env).admin(scope, op, input)));
+  if (op === "settings") {
+    const allowed = origins(input.origins), oidc = input.oidc ? validateOidc(input.oidc) : null;
+    return json2(await audit(env, a, projectId, which, "settings.update", async () => {
+      await runtime(env).configure({ scope, origins: allowed, oidc });
+      await env.CATALOG.prepare("UPDATE environments SET origins=?,oidc=? WHERE projectId=? AND env=?").bind(JSON.stringify(allowed), oidc ? JSON.stringify(oidc) : null, projectId, which).run();
+      return { ok: true };
+    }));
+  }
+  if (op === "dev-token") {
+    if (which !== "dev" || a.projectId)
+      fail("FORBIDDEN");
+    return json2({
+      token: await runtime(env).devIdentity(scope, a.email),
+      expiresIn: 900,
+      url: applicationUrl(env.RUNTIME_URL, projectId, which, project.alias)
+    });
+  }
+  if (op === "credential") {
+    if (a.role !== "owner" || a.projectId)
+      fail("FORBIDDEN");
+    const token = crypto.randomUUID() + crypto.randomUUID();
+    await audit(env, a, projectId, which, "credential.issue", async () => {
+      await env.CATALOG.prepare("INSERT INTO credentials VALUES (?,?,?,?,0)").bind(await digest(token), projectId, a.email, Date.now() + 30 * 86400000).run();
+      return { ok: true };
+    });
+    return json2({
+      token,
+      expiresIn: 30 * 86400,
+      platform: env.RUNTIME_URL + "/control"
+    });
+  }
+  if (op === "revoke-credentials") {
+    if (a.role !== "owner")
+      fail("FORBIDDEN");
+    return json2(await audit(env, a, projectId, which, "credential.revoke", async () => {
+      await env.CATALOG.prepare("UPDATE credentials SET revoked=1 WHERE projectId=?").bind(projectId).run();
+      return { ok: true };
+    }));
+  }
+  fail("INVALID_OPERATION");
+}
+
+class AdminControl extends WorkerEntrypoint {
+  async readiness() {
+    const row = await this.env.CATALOG.prepare("SELECT installation_id FROM flare_installation WHERE singleton=1").first();
+    const owner = await this.env.CATALOG.prepare("SELECT email FROM members WHERE role='owner' LIMIT 1").first();
+    if (!row || row.installation_id !== this.env.FLARE_INSTALLATION_ID || !owner)
+      fail("NOT_READY");
+    return {
+      version: package_default.version,
+      installationId: this.env.FLARE_INSTALLATION_ID,
+      platformPayload: this.env.FLARE_PLATFORM_PAYLOAD,
+      runtime: await this.env.RUNTIME.command("readiness", []).then(unwrap)
+    };
+  }
+  async request(request) {
+    try {
+      if (["/api/cli/start", "/api/cli/poll"].includes(new URL(request.url).pathname))
+        return await publicLogin(request, this.env);
+      return await api(request, this.env, await actor(request, this.env, true));
+    } catch (e) {
+      const out = status(e);
+      return json2({ error: out.code }, out.status);
+    }
+  }
+}
+var admin_default = {
+  async fetch(request, env, ctx) {
+    try {
+      const a = await actor(request, env, false, ctx);
+      const u = new URL(request.url);
+      if (u.pathname.startsWith("/api/")) {
+        if (!["GET", "HEAD", "OPTIONS"].includes(request.method) && request.headers.get("origin") !== u.origin)
+          fail("FORBIDDEN");
+        return await api(request, env, a);
+      }
+      if (u.pathname.startsWith("/bootstrap/") || u.pathname.startsWith("/starter/"))
+        return new Response("Not found", { status: 404 });
+      const response = await env.ASSETS.fetch(request), headers = new Headers(response.headers);
+      headers.set("content-security-policy", "default-src 'self'; script-src 'self' " + { scripts: ["'sha256-xIb/Pa7FUshAu4ihwjchYcQpyCI8eS8kt40GpOAYCz8='", "'sha256-1BvDVWLr3QCC20uHhUDi27eDFVJpk1uMQJGIWKUks2I='", "'sha256-kmZE/W8I1iuTnl1b3yqzv9/DQZenPngd3NjSKMQl7y0='", "'sha256-Y8t0ntteBwH+PqGKUyjWW3CAk+BNJKSoQc0xZ68FjhM='", "'sha256-0O7iB6zr9x0r6X6eWYITC9V5q+yWCGAoFvcysBGbY9Q='", "'sha256-tQIkdAw2vqfQ1PjgUE4ML2A4pIV8SByQ1Seeehy6UIc='", "'sha256-4f86GpVBksx63uHEB4f15jGyhnVEOKjwqYxwnfDVOik='"], styles: ["'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='", "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"] }.scripts.join(" ") + "; style-src 'self' " + { scripts: ["'sha256-xIb/Pa7FUshAu4ihwjchYcQpyCI8eS8kt40GpOAYCz8='", "'sha256-1BvDVWLr3QCC20uHhUDi27eDFVJpk1uMQJGIWKUks2I='", "'sha256-kmZE/W8I1iuTnl1b3yqzv9/DQZenPngd3NjSKMQl7y0='", "'sha256-Y8t0ntteBwH+PqGKUyjWW3CAk+BNJKSoQc0xZ68FjhM='", "'sha256-0O7iB6zr9x0r6X6eWYITC9V5q+yWCGAoFvcysBGbY9Q='", "'sha256-tQIkdAw2vqfQ1PjgUE4ML2A4pIV8SByQ1Seeehy6UIc='", "'sha256-4f86GpVBksx63uHEB4f15jGyhnVEOKjwqYxwnfDVOik='"], styles: ["'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='", "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"] }.styles.join(" ") + "; connect-src 'self' " + env.RUNTIME_URL + " " + env.RUNTIME_URL.replace("https:", "wss:") + "; object-src 'none'; base-uri 'none'; frame-ancestors 'none'");
+      headers.set("referrer-policy", "no-referrer");
+      headers.set("x-content-type-options", "nosniff");
+      headers.set("cache-control", response.ok && u.pathname.startsWith("/_astro/") ? "private, max-age=31536000, immutable" : "private, no-store");
+      return new Response(response.body, { status: response.status, headers });
+    } catch (e) {
+      const out = status(e);
+      if (out.status >= 500)
+        console.error({ source: "flare-admin", code: out.code });
+      return json2({ error: out.code }, out.status);
+    }
+  }
+};
+export {
+  AdminControl,
+  admin_default as default
+};