@auersperg/flare 0.3.4 → 0.3.5

package/README.md

@@ -63,7 +63,7 @@ flare deploy --env dev --release release
 
 Immutable output contains facet/action modules, `schema.json`, manifest, checksums, generated TypeScript API and OpenAPI 3.1. Only ABI 4 is accepted. No old `tables` declarations, `--migrations` flag or Drizzle pipeline.
 
-Browser approval is protected by online Access/owner authorization and same-origin CSRF. Project-scoped credentials stay outside source/frontend env. Dev publishes to an already provisioned platform. Source 0.3.4 includes `platform install|status|update` plus a checksummed Core/dashboard payload, with separate Cloudflare account authorization; see [platform lifecycle](../../docs/platform-lifecycle.md). Disposable install/recovery and a genuine 0.3.3 → 0.3.4 upgrade passed in the owner’s Cloudflare account. This remains a trusted-team preview; independent-account acceptance with a full-scope platform CLI token is not yet complete. Check the registry for exact-version availability rather than assuming a moving tag contains the platform commands. No npm publication or cloud provisioning occurs during local verification.
+Browser approval is protected by online Access/owner authorization and same-origin CSRF. Project-scoped credentials stay outside source/frontend env. Dev publishes to an already provisioned platform. Source 0.3.5 includes `platform install|status|update|adopt` plus a checksummed Core/dashboard payload, with separate Cloudflare account authorization; see [platform lifecycle](../../docs/platform-lifecycle.md). Disposable install/recovery and genuine 0.3.3 → 0.3.4 / 0.3.4 → 0.3.5 upgrades passed in the owner’s Cloudflare account. The existing personal panel also passed explicit external compiled-CLI adoption, preserving data/auth/files and namespace identities. This remains a trusted-team preview; independent-account acceptance with a full-scope platform CLI token is not yet complete. Check the registry for exact-version availability rather than assuming a moving tag contains the platform commands. No npm publication or cloud provisioning occurs during local verification.
 
 ## Immutable releases
 

package/dist/cli/{chunk-5tjevcsj.js → chunk-r3ceakrn.js}

@@ -289,13 +289,25 @@ function validateState(state, account, name) {
   if (!state || state.format !== 1 || state.account !== account || state.name !== name || !uuid.test(state.id ?? "") || !validName(name) || typeof state.owner !== "string" || !/^\S+@\S+\.\S+$/.test(state.owner) || state.owner.length > 254)
     throw Error("Unsupported installation state or account/name mismatch");
   const prefix = `flare-${name}-${state.id.replaceAll("-", "").slice(0, 12)}`;
+  const operator = state.origin === "operator";
+  if (state.origin !== undefined && !operator)
+    throw Error("Unsupported installation origin");
+  if (operator && (name !== "default" || !state.addresses?.custom || !/^\d{1,10}$/.test(state.rateLimitNamespace ?? "")))
+    throw Error("Unsupported operator installation identity");
+  const legacy = {
+    catalog: "flare-catalog",
+    bundles: "flare-builds",
+    files: "flare-files",
+    jobs: "flare-jobs",
+    dlq: "flare-jobs-dlq"
+  };
   for (const key of ["catalog", "bundles", "files", "jobs", "dlq"])
-    if (!resourceName.test(state.resources?.[key]?.name ?? "") || state.resources[key].name !== (key === "catalog" ? `flare-${name}-catalog` : `${prefix}-${key}`))
+    if (!resourceName.test(state.resources?.[key]?.name ?? "") || state.resources[key].name !== (operator ? legacy[key] : key === "catalog" ? `flare-${name}-catalog` : `${prefix}-${key}`))
       throw Error("Invalid installation resource identity");
   if (state.resources.catalog.id !== null && !uuid.test(state.resources.catalog.id))
     throw Error("Invalid catalogue identity");
   for (const key of ["admin", "runtime"])
-    if (!resourceName.test(state.workers?.[key]?.name ?? "") || state.workers[key].name !== `${prefix}-${key}`)
+    if (!resourceName.test(state.workers?.[key]?.name ?? "") || state.workers[key].name !== (operator ? `flare-${key}` : `${prefix}-${key}`))
       throw Error("Invalid Worker identity");
   if (typeof state.addresses?.custom !== "boolean" || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(state.addresses.subdomain ?? ""))
     throw Error("Invalid installation address configuration");
@@ -307,7 +319,7 @@ function validateState(state, account, name) {
     throw Error("Admin and Runtime hostnames must differ");
   if (state.access && (!/^[a-f0-9-]{36}$/.test(state.access.id ?? "") || !/^[a-f0-9]{64}$/.test(state.access.aud ?? "") || !/^https:\/\/[a-z0-9-]+\.cloudflareaccess\.com$/.test(state.access.issuer ?? "")))
     throw Error("Invalid installation Access identity");
-  if (state.operation && (!uuid.test(state.operation.id ?? "") || !["install", "update"].includes(state.operation.kind) || !/^[a-f0-9]{64}$/.test(state.operation.targetDigest ?? "") || !Array.isArray(state.operation.completed) || state.operation.completed.some((step) => ![
+  if (state.operation && (!uuid.test(state.operation.id ?? "") || !["install", "update", "adopt"].includes(state.operation.kind) || !/^[a-f0-9]{64}$/.test(state.operation.targetDigest ?? "") || !Array.isArray(state.operation.completed) || state.operation.completed.some((step) => ![
     "resources",
     "access",
     "migrations",
@@ -427,12 +439,14 @@ class InstallationStore {
         throw Error("Managed installation state is missing; refusing to recreate resources");
       return { state: local, row: null };
     }
-    const candidates = (await this.cf.list("d1/database")).filter((db) => db.name === `flare-${this.name}-catalog`);
+    const candidates = (await this.cf.list("d1/database")).filter((db) => db.name === `flare-${this.name}-catalog` || this.name === "default" && db.name === "flare-catalog");
     const found = [];
     for (const candidate of candidates) {
       const row = await this.row(candidate.uuid);
       if (row)
         found.push(row);
+      else if (candidate.name === "flare-catalog")
+        throw Error("Legacy operator installation found. Use explicit platform adopt; do not reinstall over existing data.");
       else if (candidate.name !== local?.resources.catalog.name)
         throw Error("Unmanaged catalogue found. Refusing implicit adoption; use a distinct installation name or an explicit migration.");
     }
@@ -442,8 +456,6 @@ class InstallationStore {
       this.revision = found[0].revision;
       return { state: found[0].state, row: found[0] };
     }
-    if (!local && this.name === "default" && (await this.cf.list("d1/database")).some((db) => db.name === "flare-catalog"))
-      throw Error("Legacy operator installation found. Automatic adoption is not supported yet; do not reinstall over existing data.");
     return { state: local, row: null };
   }
   async initialize(state, ddl) {
@@ -695,7 +707,7 @@ function workerConfiguration(state, release, role, bootstrap = false) {
     ratelimits: [
       {
         name: "RATE_LIMITER",
-        namespace_id: String(parseInt(state.id.replaceAll("-", "").slice(0, 7), 16)),
+        namespace_id: state.rateLimitNamespace ?? String(parseInt(state.id.replaceAll("-", "").slice(0, 7), 16)),
         simple: { limit: 600, period: 60 }
       }
     ],
@@ -720,7 +732,8 @@ async function confirm(options, state, plan, ask, log) {
 }
 async function assertAccess(cf, state) {
   const app = await cf.api(`access/apps/${state.access.id}`);
-  if (app.domain !== state.addresses.adminHost || app.aud !== state.access.aud)
+  const coversHost = app.domain === state.addresses.adminHost || app.destinations?.some((d) => d.type === "public" && d.uri === state.addresses.adminHost);
+  if (!coversHost || app.aud !== state.access.aud || state.access.snapshot && configurationDigest(app) !== state.access.snapshot)
     throw Error("Access application drift; refusing to change policies or audiences");
 }
 async function remoteWorker(cf, name) {
@@ -901,6 +914,177 @@ async function verify(cf, state, release, fetcher, wait) {
     }
   }
 }
+async function discoverOperator(cf, store, name) {
+  if (name !== "default")
+    throw Error("Operator adoption supports only --name default");
+  const databases = await cf.list("d1/database");
+  const matches = databases.filter((db) => db.name === "flare-catalog");
+  if (matches.length !== 1 || databases.some((db) => db.name === "flare-default-catalog"))
+    throw Error("Expected one legacy flare-catalog and no competing default catalogue");
+  const row = await store.row(matches[0].uuid);
+  const state = row?.state ?? await store.local();
+  if (state && (state.origin !== "operator" || state.resources.catalog.id !== matches[0].uuid))
+    throw Error("Catalogue/cache is owned by a different installation");
+  if (row)
+    store.revision = row.revision;
+  return { state, row };
+}
+async function prepareOperator(cf, inventory, release, options, dependencies) {
+  const owner = options.owner?.toLowerCase();
+  if (!owner || !/^\S+@\S+\.\S+$/.test(owner))
+    throw Error("Explicit --owner is required for adoption");
+  const database = inventory.databases.find((db) => db.name === "flare-catalog");
+  const member = (await cf.sql(database.uuid, "SELECT role FROM members WHERE email=?", [
+    owner
+  ])).results[0];
+  if (member?.role !== "owner")
+    throw Error("Existing owner membership does not match; roles are never rewritten");
+  const state = {
+    format: 1,
+    origin: "operator",
+    id: randomUUID2(),
+    account: cf.account,
+    name: "default",
+    owner,
+    resources: {
+      catalog: { name: "flare-catalog", id: database.uuid },
+      bundles: { name: "flare-builds", id: "flare-builds" },
+      files: { name: "flare-files", id: "flare-files" },
+      jobs: { name: "flare-jobs", id: null },
+      dlq: { name: "flare-jobs-dlq", id: null }
+    },
+    workers: {
+      runtime: { name: "flare-runtime" },
+      admin: { name: "flare-admin" }
+    },
+    addresses: { custom: true, subdomain: inventory.subdomain },
+    access: null,
+    installed: null,
+    operation: null,
+    snapshots: {},
+    versions: {},
+    domainSnapshots: {},
+    createdAt: Date.now()
+  };
+  const remote = {};
+  for (const role of ["runtime", "admin"]) {
+    remote[role] = await cf.api(`workers/scripts/flare-${role}/settings`);
+    state.versions[role] = await cf.currentVersion(`flare-${role}`);
+    state.snapshots[role] = settingsDigest(remote[role]);
+    state.domainSnapshots[role] = await domainSnapshot(cf, `flare-${role}`);
+    const endpoint = await cf.api(`workers/scripts/flare-${role}/subdomain`);
+    if (endpoint.enabled || endpoint.previews_enabled)
+      throw Error("Adoption requires custom domains with alternate endpoints disabled");
+    if (remote[role].logpush || remote[role].tail_consumers?.length || remote[role].tags?.length || Object.keys(remote[role].placement ?? {}).length || remote[role].limits?.cpu_ms !== 1000 || Object.keys(remote[role].limits ?? {}).some((key) => key !== "cpu_ms") || remote[role].observability?.enabled !== true || remote[role].observability?.head_sampling_rate !== 1 || remote[role].observability?.traces?.enabled === true || remote[role].observability?.logs?.enabled === false || remote[role].observability?.logs?.invocation_logs === false || remote[role].observability?.logs?.persist === false || remote[role].observability?.redact_query_string === true || remote[role].compatibility_flags?.join() !== "nodejs_compat")
+      throw Error("Unsupported operator Worker configuration; adoption does not silently reconcile custom settings");
+  }
+  const binding = (role, name, type) => {
+    const matches = remote[role].bindings?.filter((b) => b.name === name && b.type === type);
+    if (matches?.length !== 1)
+      throw Error(`Missing or ambiguous ${role} binding ${name}`);
+    return matches[0];
+  };
+  const allowed = {
+    runtime: [
+      "ADMIN_API",
+      "BUNDLES",
+      "FILES",
+      "JOBS",
+      "LOADER",
+      "RATE_LIMITER",
+      "SUPERVISORS",
+      "DEV_SIGNING_KEY",
+      "RUNTIME_URL",
+      "DASHBOARD_URL",
+      "DEV_TOKEN_ISSUER"
+    ],
+    admin: [
+      "RUNTIME",
+      "CATALOG",
+      "ASSETS",
+      "RUNTIME_URL",
+      "DASHBOARD_URL",
+      "ACCESS_ISSUER",
+      "ACCESS_AUD"
+    ]
+  };
+  for (const role of ["runtime", "admin"])
+    if (remote[role].bindings.length !== allowed[role].length || remote[role].bindings.some((b) => !allowed[role].includes(b.name)))
+      throw Error("Unsupported extra bindings; adoption must not remove operator capabilities");
+  const runtimeUrl = binding("runtime", "RUNTIME_URL", "plain_text").text;
+  const dashboardUrl = binding("admin", "DASHBOARD_URL", "plain_text").text;
+  for (const value of [runtimeUrl, dashboardUrl]) {
+    const url = new URL(value);
+    if (url.origin !== value || url.protocol !== "https:")
+      throw Error("Operator URL must be a plain HTTPS origin");
+  }
+  state.addresses.runtimeHost = new URL(runtimeUrl).hostname;
+  state.addresses.adminHost = new URL(dashboardUrl).hostname;
+  if (binding("admin", "RUNTIME_URL", "plain_text").text !== runtimeUrl || binding("runtime", "DASHBOARD_URL", "plain_text").text !== dashboardUrl || binding("runtime", "DEV_TOKEN_ISSUER", "plain_text").text !== runtimeUrl)
+    throw Error("Operator URLs/identity issuer do not match; refusing identity migration");
+  for (const role of ["runtime", "admin"]) {
+    const own = inventory.domains.filter((d) => d.service === `flare-${role}`);
+    if (own.length !== 1 || own[0].hostname !== state.addresses[role === "runtime" ? "runtimeHost" : "adminHost"] || !own[0].enabled || own[0].previews_enabled)
+      throw Error("Operator custom domain does not match binding URL");
+  }
+  if (binding("admin", "CATALOG", "d1").id !== database.uuid && binding("admin", "CATALOG", "d1").database_id !== database.uuid)
+    throw Error("Admin catalogue binding mismatch");
+  for (const [role, key, target, entrypoint] of [
+    ["admin", "RUNTIME", "flare-runtime", "RuntimeControl"],
+    ["runtime", "ADMIN_API", "flare-admin", "AdminControl"]
+  ]) {
+    const b = binding(role, key, "service");
+    if (b.service !== target || b.entrypoint !== entrypoint || b.environment && b.environment !== "production")
+      throw Error("Operator service binding mismatch");
+  }
+  for (const [key, bucket] of [
+    ["BUNDLES", "flare-builds"],
+    ["FILES", "flare-files"]
+  ])
+    if (binding("runtime", key, "r2_bucket").bucket_name !== bucket)
+      throw Error("Operator R2 binding mismatch");
+  if (binding("runtime", "JOBS", "queue").queue_name !== "flare-jobs")
+    throw Error("Operator Queue binding mismatch");
+  binding("runtime", "LOADER", "worker_loader");
+  binding("runtime", "DEV_SIGNING_KEY", "secret_text");
+  binding("admin", "ASSETS", "assets");
+  const supervisor = binding("runtime", "SUPERVISORS", "durable_object_namespace");
+  if (supervisor.class_name !== "EnvironmentSupervisor" || supervisor.script_name)
+    throw Error("Operator supervisor must be owned by Runtime");
+  state.supervisorNamespace = supervisor.namespace_id;
+  const rate = binding("runtime", "RATE_LIMITER", "ratelimit");
+  if (rate.simple?.limit !== 600 || rate.simple?.period !== 60)
+    throw Error("Unsupported operator rate-limit configuration");
+  state.rateLimitNamespace = String(rate.namespace_id);
+  const aud = binding("admin", "ACCESS_AUD", "plain_text").text;
+  const app = inventory.apps.find((a) => a.aud === aud);
+  if (!app || binding("admin", "ACCESS_ISSUER", "plain_text").text !== inventory.issuer)
+    throw Error("Access application/issuer mismatch");
+  const access = await cf.api(`access/apps/${app.id}`);
+  state.access = {
+    id: app.id,
+    aud,
+    issuer: inventory.issuer,
+    snapshot: configurationDigest(access)
+  };
+  for (const key of ["jobs", "dlq"]) {
+    const q = inventory.queues.find((q) => q.queue_name === state.resources[key].name);
+    if (!q)
+      throw Error("Operator queue is missing");
+    state.resources[key].id = q.queue_id;
+  }
+  validateState(state, cf.account, "default");
+  await assertResources(cf, state, inventory);
+  const migrations = (await cf.sql(database.uuid, "SELECT name FROM d1_migrations")).results;
+  if (migrations.some((m) => !migrationInventory(release.manifest).some((f) => f.name === m.name)))
+    throw Error("Operator has unknown migrations; an explicit compatibility review is required");
+  const response = await (dependencies.fetch ?? globalThis.fetch)(runtimeUrl + "/health", { redirect: "error", signal: AbortSignal.timeout(15000) });
+  const health = await response.json();
+  if (!response.ok || health.protocol !== release.manifest.protocol || health.runtimeAbi !== release.manifest.runtimeAbi || ![release.manifest.version, ...release.manifest.upgradeFrom].includes(health.version))
+    throw Error("Operator runtime version/ABI is not an admitted adoption source");
+  state.adoptedFrom = { version: health.version, at: Date.now() };
+  return state;
+}
 async function platform(options, dependencies = {}) {
   const source = dependencies.release ?? await loadPlatformRelease();
   const scratch = await mkdtemp(join3(tmpdir(), "flare-platform-payload-"));
@@ -918,8 +1102,8 @@ async function platform(options, dependencies = {}) {
 }
 async function runPlatform(options, dependencies = {}) {
   const operation = options.operation;
-  if (!["install", "status", "update"].includes(operation))
-    throw Error("Supported: flare platform install|status|update; no deployment has occurred.");
+  if (!["install", "status", "update", "adopt"].includes(operation))
+    throw Error("Supported: flare platform install|status|update|adopt; no deployment has occurred.");
   const name = options.name ?? "default";
   if (!validName(name))
     throw Error("Installation --name must be 1\u201320 lowercase letters, digits or hyphens, starting with a letter");
@@ -952,7 +1136,8 @@ async function runPlatform(options, dependencies = {}) {
   if (cf.account !== account)
     throw Error("Cloudflare account mismatch");
   const store = new InstallationStore(cf, name, dependencies.storeOptions);
-  const discovered = await store.discover();
+  const adoption = operation === "adopt";
+  const discovered = adoption ? await discoverOperator(cf, store, name) : await store.discover();
   let state = discovered.state;
   if (operation === "status")
     return state ? publicState(state, release.manifest, discovered.row) : {
@@ -962,6 +1147,8 @@ async function runPlatform(options, dependencies = {}) {
       target: release.manifest.version
     };
   const inventory = await preflight(cf);
+  if (adoption && !state)
+    state = await prepareOperator(cf, inventory, release, options, dependencies);
   if (state) {
     if (options.owner && options.owner.toLowerCase() !== state.owner || options["dashboard-host"] && options["dashboard-host"] !== state.addresses.adminHost || options["runtime-host"] && options["runtime-host"] !== state.addresses.runtimeHost || options.subdomain && options.subdomain !== state.addresses.subdomain)
       throw Error("Existing installation identity cannot be changed by install/update");
@@ -987,21 +1174,21 @@ async function runPlatform(options, dependencies = {}) {
       await assertNoDrift(cf, state);
       if (state.installed.digest === release.manifest.digest)
         return { ...publicState(state, release.manifest), unchanged: true };
-      if (operation === "install")
+      if (operation === "install" || adoption)
         throw Error("Already installed. Use flare platform update to change the platform version");
     }
-  } else if (operation !== "install")
+  } else if (operation !== "install" && !adoption)
     throw Error("Installation is incomplete; resume platform install with the original release");
   const plan = {
     account,
     installation: name,
     operation,
-    from: state.installed?.version ?? null,
+    from: state.installed?.version ?? state.adoptedFrom?.version ?? null,
     to: release.manifest.version,
     digest: release.manifest.digest,
     dashboard: "https://" + state.addresses.adminHost,
     runtime: "https://" + state.addresses.runtimeHost,
-    steps: state.installed ? ["migrations", "runtime", "admin", "verify"] : steps,
+    steps: state.installed || adoption ? ["migrations", "runtime", "admin", "verify"] : steps,
     preserve: [
       "Workers and DO namespace identities",
       "projects/dev/prod",
@@ -1040,9 +1227,14 @@ async function runPlatform(options, dependencies = {}) {
     await store.cache(state);
   }
   if (!discovered.row) {
-    const tables = (await cf.sql(state.resources.catalog.id, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '_cf_%' AND name NOT IN ('flare_installation','d1_migrations')")).results;
-    if (tables.length)
-      throw Error("Unmanaged catalogue contains tables; refusing to claim existing data");
+    if (!adoption) {
+      const tables = (await cf.sql(state.resources.catalog.id, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '_cf_%' AND name NOT IN ('flare_installation','d1_migrations')")).results;
+      if (tables.length)
+        throw Error("Unmanaged catalogue contains tables; refusing to claim existing data");
+    } else {
+      await assertResources(cf, state, inventory);
+      await assertNoDrift(cf, state);
+    }
     await store.initialize(state, await readFile3(join3(release.directory, "migrations/0006_platform_installation.sql"), "utf8"));
   }
   await store.acquire(state, options.resume === true);
@@ -1103,7 +1295,7 @@ async function runPlatform(options, dependencies = {}) {
       await supervisorNamespace(cf, state);
   };
   try {
-    if (!state.installed) {
+    if (!state.installed && !adoption) {
       await checkpoint("resources", () => ensureResources(cf, state, store, inventory));
       await checkpoint("access", () => ensureAccess(cf, state, store, inventory));
     }
@@ -1115,7 +1307,7 @@ async function runPlatform(options, dependencies = {}) {
       if (!await migrationsApplied(cf, state, release.manifest))
         throw Error("D1 migrations did not finish");
     });
-    if (!state.installed) {
+    if (!state.installed && !adoption) {
       await checkpoint("owner", async () => {
         await cf.sql(state.resources.catalog.id, "INSERT OR IGNORE INTO members(email,role) VALUES(?,?)", [state.owner, "owner"]);
         const row = (await cf.sql(state.resources.catalog.id, "SELECT role FROM members WHERE email=?", [state.owner])).results[0];

package/dist/cli/flare.js

@@ -3,7 +3,7 @@
 // packages/flare/package.json
 var package_default = {
   name: "@auersperg/flare",
-  version: "0.3.4",
+  version: "0.3.5",
   license: "MIT",
   type: "module",
   description: "Flare client, server declarations and development CLI",
@@ -83,6 +83,7 @@ flare deploy               Confirmed production build and deploy
 
 Platform lifecycle (Cloudflare account authorization):
 flare platform install
+flare platform adopt --owner <existing owner email>
 flare platform status
 flare platform update --dry-run
 flare platform update
@@ -103,15 +104,16 @@ else if (command === "platform") {
   try {
     const operation = args.shift();
     if (["help", "--help"].includes(operation)) {
-      console.log(`flare platform install|status|update [--account <ID>] [--name <name>]
+      console.log(`flare platform install|status|update|adopt [--account <ID>] [--name <name>]
 install: [--owner <email>] [--dashboard-host <host> --runtime-host <host>] [--subdomain <workers.dev prefix>]
-install/update: [--dry-run] [--confirm <account ID>] [--resume]
+adopt: --owner <email> (existing standard flare-admin/flare-runtime/flare-catalog; default installation only)
+install/update/adopt: [--dry-run] [--confirm <account ID>] [--resume]
 Uses the platform payload bundled with this CLI release. Never updates applications or runs a local dashboard. Requires separate Cloudflare account permissions; FLARE_DEPLOY_TOKEN is not an account token.`);
     } else {
-      if (!["install", "status", "update"].includes(operation))
-        throw Error("Supported: flare platform install|status|update; no deployment has occurred.");
+      if (!["install", "status", "update", "adopt"].includes(operation))
+        throw Error("Supported: flare platform install|status|update|adopt; no deployment has occurred.");
       const options = { operation };
-      const allowed = operation === "install" ? [
+      const allowed = operation === "adopt" ? ["account", "name", "owner", "confirm", "dry-run", "resume"] : operation === "install" ? [
         "account",
         "name",
         "owner",
@@ -134,7 +136,7 @@ Uses the platform payload bundled with this CLI release. Never updates applicati
           options[key] = args[++i];
         }
       }
-      const { platform } = await import("./chunk-5tjevcsj.js");
+      const { platform } = await import("./chunk-r3ceakrn.js");
       console.log(JSON.stringify(await platform(options), null, 2));
     }
   } catch (error) {

package/dist/platform/admin.js

@@ -23,7 +23,7 @@ async function collectCatalog(database, now = Date.now()) {
 // packages/core/package.json
 var package_default = {
   name: "@flare/platform",
-  version: "0.3.4",
+  version: "0.3.5",
   type: "module",
   license: "MIT",
   private: true,

package/dist/platform/dashboard/_astro/auth-view.UTGGCEHc.js

@@ -0,0 +1 @@
+import{a as e,r as t}from"./client.BeKNsjPN.js";import{S as n,_ as r,a as i,b as a,f as o,g as s,gt as c,ht as l,n as u,p as d,s as f,u as p,v as m,x as h,y as g}from"./common.DPoFQu44.js";import{s as _}from"./index.astro_astro_type_script_index_0_lang.BEuO3H0E.js";var v=e(t(),1),y=c();function b(e){let t=s(e.project,e.env),[c,b]=(0,v.useState)(``),[x,S]=(0,v.useState)(),C=p(t+`/auth-users`+(c?`?cursor=`+encodeURIComponent(c):``)),w=p(t+`/auth-settings`),T=e.session.role===`owner`,E=(n,r,i,a=[])=>{S({title:r,description:`Passwords are never displayed. Changes revoke existing sessions.`,productionId:e.env===`prod`?e.project.id:void 0,fields:a,submit:async r=>{try{await d(t+`/`+n,{...i,...o(a,e=>new FormData(r).get(e)),confirm:e.project.id})}catch(e){throw e instanceof Error&&e.message===`INVALID_PASSWORD`?Error(`Password must contain 6–128 characters. Spaces are allowed; the password is not trimmed.`):e instanceof Error&&e.message===`REGISTRATION_UNAVAILABLE`?Error(`This login is already registered. Choose another login or manage the existing user.`):e}C.refresh(),w.refresh()}})},D={name:`password`,type:`password`,required:!0,description:`6–128 characters.`};return(0,y.jsxs)(`div`,{className:`space-y-4 p-4`,children:[(0,y.jsx)(`h1`,{className:`page-title`,children:`Auth`}),(0,y.jsx)(f,{loading:C.loading||w.loading,error:C.error||w.error}),w.data&&(0,y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-2`,children:[(0,y.jsx)(_,{status:w.data.enabled?`Enabled`:`Disabled`}),(0,y.jsx)(_,{status:w.data.registration?`Public registration`:`Registration closed`}),T&&(0,y.jsx)(l,{variant:`outline`,onClick:()=>E(`auth-configure`,`Configure authentication`,{},[{name:`enabled`,type:`boolean`,value:w.data.enabled},{name:`registration`,type:`boolean`,value:w.data.registration}]),children:`Configure`}),T&&(0,y.jsx)(l,{onClick:()=>E(`auth-create`,`Create user`,{},[{name:`login`,type:`string`,required:!0},D]),children:`Create user`})]}),C.data&&(0,y.jsxs)(y.Fragment,{children:[(0,y.jsxs)(r,{children:[(0,y.jsx)(h,{children:(0,y.jsxs)(n,{children:[(0,y.jsx)(a,{children:`Login`}),(0,y.jsx)(a,{children:`User ID`}),(0,y.jsx)(a,{children:`Status`}),(0,y.jsx)(a,{children:`Created`}),(0,y.jsx)(a,{children:`Actions`})]})}),(0,y.jsx)(m,{children:C.data.users.map(e=>(0,y.jsxs)(n,{children:[(0,y.jsx)(g,{children:e.login}),(0,y.jsx)(g,{children:(0,y.jsx)(`code`,{children:e.id})}),(0,y.jsx)(g,{children:(0,y.jsx)(_,{status:e.disabled?`Blocked`:`Active`})}),(0,y.jsx)(g,{children:new Date(e.createdAt).toLocaleString()}),(0,y.jsx)(g,{children:(0,y.jsx)(`div`,{className:`flex flex-wrap gap-2`,children:T&&(0,y.jsxs)(y.Fragment,{children:[(0,y.jsx)(l,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-password`,`Change user password`,{id:e.id},[D]),children:`Change password`}),(0,y.jsx)(l,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-revoke`,`Revoke all sessions`,{id:e.id}),children:`Revoke sessions`}),(0,y.jsx)(l,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-disable`,e.disabled?`Unblock user`:`Block user`,{id:e.id,disabled:!e.disabled}),children:e.disabled?`Unblock`:`Block`})]})})})]},e.id))})]}),!C.data.users.length&&(0,y.jsx)(u,{title:`No users`}),(0,y.jsxs)(`div`,{className:`flex gap-2`,children:[(0,y.jsx)(l,{variant:`outline`,disabled:!c,onClick:()=>b(``),children:`First page`}),(0,y.jsx)(l,{variant:`outline`,disabled:!C.data.next,onClick:()=>b(C.data.next),children:`Next page`})]})]}),x&&(0,y.jsx)(i,{modal:x,onClose:()=>S(void 0)})]})}export{b as default};

package/dist/platform/dashboard/_astro/cli-approval.BZAWmpiR.js

@@ -0,0 +1 @@
+import{a as e,r as t}from"./client.BeKNsjPN.js";import{M as n,Y as r,gt as i,ht as a,j as o,k as s,m as c,p as l,r as u,t as d}from"./common.DPoFQu44.js";var f=e(t(),1),p=i();function m(){let e=new URLSearchParams(location.search).get(`cli`)??``,[t,i]=(0,f.useState)(``),[m,h]=(0,f.useState)([]),[g,_]=(0,f.useState)(`new`),[v,y]=(0,f.useState)(``),[b,x]=(0,f.useState)(``),[S,C]=(0,f.useState)(!1),[w,T]=(0,f.useState)(!1);(0,f.useEffect)(()=>{let t=new AbortController;return Promise.all([l(`cli/approval?id=`+encodeURIComponent(e),void 0,t.signal),l(`projects`,void 0,t.signal)]).then(([e,t])=>{i(e.code),h(t),_(`new`)}).catch(e=>{t.signal.aborted||x(c(e))}),()=>t.abort()},[e]);async function E(){C(!0),x(``);try{let t=g;if(t===`new`){let e=await l(`projects`,{name:v,customer:`Applications`,origins:[]});t=e.id,h(t=>[...t,{id:e.id,name:v,customer:`Applications`}]),_(t)}await l(`cli/approval`,{id:e,project:t}),T(!0)}catch(e){x(c(e))}finally{C(!1)}}return(0,p.jsxs)(`main`,{className:`mx-auto max-w-lg p-8`,children:[(0,p.jsx)(`h1`,{className:`mb-4 text-xl font-semibold`,children:`Connect Flare CLI`}),w?(0,p.jsx)(`p`,{children:`Connected. Return to your terminal. You can close this tab.`}):(0,p.jsxs)(o,{children:[(0,p.jsx)(`p`,{children:`Approve only a login you just started. Compare this code with your terminal:`}),(0,p.jsx)(`strong`,{className:`text-2xl font-mono`,children:t||`Loading…`}),(0,p.jsx)(`p`,{children:`Grants this computer deployment access to the selected project, including production. The credential expires in 30 days and can be revoked in Settings.`}),(0,p.jsxs)(s,{children:[(0,p.jsx)(n,{children:`Project`}),(0,p.jsx)(d,{label:`CLI project`,value:g,onChange:_,items:[...m.map(e=>({value:e.id,label:e.name})),{value:`new`,label:`Create new project`}]})]}),g===`new`&&(0,p.jsxs)(s,{children:[(0,p.jsx)(n,{children:`New project name`}),(0,p.jsx)(r,{value:v,onChange:e=>y(e.target.value),maxLength:100})]}),b&&(0,p.jsx)(u,{children:b}),(0,p.jsx)(a,{disabled:S||!t||!g||g===`new`&&!v.trim(),onClick:E,children:`Approve connection`})]})]})}export{m as default};

package/dist/platform/dashboard/_astro/client.Bcl1NrNO.js

@@ -0,0 +1 @@
+import{a as e,r as t,t as n}from"./client.BeKNsjPN.js";var r=n(),i=e(t(),1),a=(0,i.memo)(({value:e,name:t,hydrate:n=!0})=>e==null||e.trim()===``?null:(0,i.createElement)(n?`astro-slot`:`astro-static-slot`,{name:t,suppressHydrationWarning:!0,dangerouslySetInnerHTML:{__html:e}}),()=>!0);function o(e){for(let t in e)if(t.startsWith(`__reactContainer`))return t}var s={class:`className`,for:`htmlFor`},c=0;function l(e,t,n){t===void 0&&(c+=1,t=c,n=0);let r={};for(let t of e.attributes){let e=s[t.name]||t.name;r[e]=t.value}if(r.key=`${t}-${n}`,e.firstChild===null)return(0,i.createElement)(e.localName,r);let a=0;return(0,i.createElement)(e.localName,r,Array.from(e.childNodes).map(e=>{if(e.nodeType===Node.TEXT_NODE)return e.data;if(e.nodeType===Node.ELEMENT_NODE)return a+=1,l(e,t,a)}).filter(e=>!!e))}function u(e,t){if(t&&e){let t=[],n=document.createElement(`template`);n.innerHTML=e;for(let e of n.content.children)t.push(l(e));return t}if(e)return(0,i.createElement)(a,{value:e})}var d=new WeakMap,f=(e,t)=>{let n=d.get(e);return n||(n=t(),d.set(e,n)),n},p=e=>(t,n,{default:s,...c},{client:l})=>{if(!e.hasAttribute(`ssr`))return;let d=e.getAttribute(`data-action-key`),p=e.getAttribute(`data-action-name`),m=e.getAttribute(`data-action-result`),h=d&&p&&m?[JSON.parse(m),d,p]:void 0,g={identifierPrefix:e.getAttribute(`prefix`),formState:h};for(let[e,t]of Object.entries(c))n[e]=(0,i.createElement)(a,{value:t,name:e});let _=(0,i.createElement)(t,n,u(s,e.hasAttribute(`data-react-children`))),v=o(e);if(v&&delete e[v],l===`only`)return(0,i.startTransition)(()=>{f(e,()=>{let t=(0,r.createRoot)(e);return e.addEventListener(`astro:unmount`,()=>t.unmount(),{once:!0}),t}).render(_)});(0,i.startTransition)(()=>{f(e,()=>{let t=(0,r.hydrateRoot)(e,_,g);return e.addEventListener(`astro:unmount`,()=>t.unmount(),{once:!0}),t}).render(_)})};export{p as default};