@auersperg/flare 0.3.7 → 0.3.9

package/dist/cli/{chunk-r3ceakrn.js → chunk-0s0vrjtw.js}

@@ -1,6 +1,6 @@
 // @bun
 // packages/flare/src/cli/platform.mjs
-import { readFile as readFile3, mkdir as mkdir2, mkdtemp, writeFile as writeFile2, rm, cp } from "fs/promises";
+import { readFile as readFile4, mkdir as mkdir2, mkdtemp, writeFile as writeFile2, rm, cp } from "fs/promises";
 import { join as join3 } from "path";
 import { tmpdir } from "os";
 import { randomBytes, randomUUID as randomUUID2 } from "crypto";
@@ -17,7 +17,7 @@ import { join } from "path";
 import { fileURLToPath } from "url";
 import { createHash } from "crypto";
 var PLATFORM_FORMAT = 1;
-var WRANGLER_VERSION = "4.149.0";
+var WRANGLER_VERSION = "4.150.0";
 var sha256 = (value) => createHash("sha256").update(value).digest("hex");
 var manifestDigest = ({ digest: _digest, ...manifest }) => sha256(JSON.stringify(manifest));
 async function payloadFiles(directory, prefix = "") {
@@ -46,7 +46,7 @@ async function loadPlatformRelease(directory = fileURLToPath(new URL("../platfor
   } catch {
     throw Error("Platform payload missing or invalid. Install a complete Flare npm release.");
   }
-  if (manifest.format !== PLATFORM_FORMAT || !/^\d+\.\d+\.\d+$/.test(manifest.version ?? "") || manifest.protocol !== 1 || manifest.runtimeAbi !== 4 || manifest.stateFormat !== 1 || manifest.wranglerVersion !== WRANGLER_VERSION || !/^\d{4}-\d{2}-\d{2}$/.test(manifest.compatibilityDate ?? "") || !Array.isArray(manifest.upgradeFrom) || manifest.upgradeFrom.some((version) => !/^\d+\.\d+\.\d+$/.test(version) || Bun.semver.order(version, manifest.version) >= 0) || !Array.isArray(manifest.files) || !manifest.files.length || manifest.files.length > 1000 || !/^[a-f0-9]{64}$/.test(manifest.digest ?? "") || manifest.digest !== manifestDigest(manifest))
+  if (manifest.format !== PLATFORM_FORMAT || !/^\d+\.\d+\.\d+$/.test(manifest.version ?? "") || manifest.protocol !== 1 || manifest.runtimeAbi !== 4 || manifest.stateFormat !== 1 || ![WRANGLER_VERSION, "4.149.0"].includes(manifest.wranglerVersion) || !/^\d{4}-\d{2}-\d{2}$/.test(manifest.compatibilityDate ?? "") || !Array.isArray(manifest.upgradeFrom) || manifest.upgradeFrom.some((version) => !/^\d+\.\d+\.\d+$/.test(version) || Bun.semver.order(version, manifest.version) >= 0) || !Array.isArray(manifest.files) || !manifest.files.length || manifest.files.length > 1000 || !/^[a-f0-9]{64}$/.test(manifest.digest ?? "") || manifest.digest !== manifestDigest(manifest))
     throw Error("Unsupported or damaged platform manifest");
   const paths = new Set;
   let size = 0;
@@ -84,6 +84,16 @@ function assertUpgrade(installed, target) {
   if (installed.version === target.version && installed.digest !== target.digest)
     throw Error("Same platform version has different bytes. Publish a new version; refusing an in-place replacement.");
 }
+function configurationDigest(value) {
+  const canonical = (item) => {
+    if (Array.isArray(item))
+      return item.map(canonical);
+    if (item && typeof item === "object")
+      return Object.fromEntries(Object.keys(item).sort().map((key) => [key, canonical(item[key])]));
+    return item;
+  };
+  return sha256(JSON.stringify(canonical(value)));
+}
 
 // packages/flare/src/cli/cloudflare-account.mjs
 class CloudflareError extends Error {
@@ -271,10 +281,85 @@ class CloudflareAccount {
 }
 
 // packages/flare/src/cli/platform-state.mjs
-import { mkdir, readFile as readFile2, writeFile, rename, chmod } from "fs/promises";
+import { mkdir, readFile as readFile3, writeFile, rename, chmod } from "fs/promises";
 import { join as join2 } from "path";
 import { homedir } from "os";
 import { randomUUID } from "crypto";
+
+// packages/flare/src/cli/platform-config.mjs
+import { readFile as readFile2 } from "fs/promises";
+function validatePlatformConfig(value = {}) {
+  const object = (v) => v && typeof v === "object" && !Array.isArray(v);
+  if (!object(value) || Object.keys(value).some((k) => !["capabilities", "secrets"].includes(k)))
+    throw Error("Platform config accepts only capabilities and secrets references");
+  const capabilities = value.capabilities ?? {}, secrets = value.secrets ?? [];
+  if (!object(capabilities) || !Array.isArray(secrets) || secrets.length > 64)
+    throw Error("Invalid platform capabilities/secrets references");
+  const bindings = new Set;
+  const references = secrets.map((r) => {
+    if (!object(r) || Object.keys(r).sort().join() !== "binding,secret_name,store_id" || !/^APP_SECRET_[A-Z0-9_]{1,64}$/.test(r.binding) || !/^[a-f0-9]{32}$/.test(r.store_id) || typeof r.secret_name !== "string" || !/^[A-Za-z0-9_.-]{1,128}$/.test(r.secret_name) || bindings.has(r.binding))
+      throw Error("Invalid or duplicate native Secrets Store reference");
+    bindings.add(r.binding);
+    return {
+      binding: r.binding,
+      store_id: r.store_id,
+      secret_name: r.secret_name
+    };
+  }).sort((a, b) => a.binding.localeCompare(b.binding));
+  const result = {};
+  const used = new Set;
+  for (const scope of Object.keys(capabilities).sort()) {
+    const p = capabilities[scope];
+    if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\/(dev|prod)$/.test(scope) || !object(p) || Object.keys(p).some((k) => !["outbound", "secrets"].includes(k)))
+      throw Error("Invalid capability scope");
+    const hosts = p.outbound ?? [], mapping = p.secrets ?? {};
+    if (!Array.isArray(hosts) || hosts.length > 20 || !object(mapping) || Object.keys(mapping).length > 16)
+      throw Error("Capability limits exceeded");
+    for (const host of hosts)
+      if (typeof host !== "string" || host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,63}$/.test(host) || /\.(localhost|local|internal)$/.test(host))
+        throw Error("Only exact public HTTPS hostnames are allowed");
+    for (const [name, binding] of Object.entries(mapping)) {
+      if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(name) || !bindings.has(binding))
+        throw Error("Secret grant must reference an explicit APP_SECRET binding");
+      used.add(binding);
+    }
+    result[scope] = {
+      outbound: [...new Set(hosts)].sort(),
+      secrets: Object.fromEntries(Object.entries(mapping).sort())
+    };
+  }
+  if (references.some((r) => !used.has(r.binding)))
+    throw Error("Unused secret binding; grant it explicitly or remove it");
+  if (JSON.stringify(result).length > 16384)
+    throw Error("Capabilities exceed 16 KiB");
+  return { capabilities: result, secrets: references };
+}
+async function readPlatformConfig(path) {
+  const bytes = await readFile2(path);
+  if (bytes.length > 32768)
+    throw Error("Platform config exceeds 32 KiB");
+  return validatePlatformConfig(JSON.parse(bytes));
+}
+function accessConfiguration(app, policies) {
+  const {
+    created_at: _created,
+    updated_at: _updated,
+    policies: _embedded,
+    ...config
+  } = app;
+  const clean = policies.map(({ created_at: _c, updated_at: _u, ...p }) => p).sort((a, b) => String(a.id).localeCompare(String(b.id)));
+  return { app: config, policies: clean };
+}
+async function accessSnapshot(cf, id) {
+  const app = await cf.api(`access/apps/${id}`);
+  const policies = await cf.list(`access/apps/${id}/policies`);
+  return {
+    app,
+    digest: configurationDigest(accessConfiguration(app, policies))
+  };
+}
+
+// packages/flare/src/cli/platform-state.mjs
 var leaseMilliseconds = 15 * 60 * 1000;
 var identifier = /^[a-z][a-z0-9-]{0,19}$/;
 var resourceName = /^[a-z][a-z0-9-]{0,62}$/;
@@ -288,6 +373,8 @@ function hostname(value) {
 function validateState(state, account, name) {
   if (!state || state.format !== 1 || state.account !== account || state.name !== name || !uuid.test(state.id ?? "") || !validName(name) || typeof state.owner !== "string" || !/^\S+@\S+\.\S+$/.test(state.owner) || state.owner.length > 254)
     throw Error("Unsupported installation state or account/name mismatch");
+  if (state.config !== undefined)
+    validatePlatformConfig(state.config);
   const prefix = `flare-${name}-${state.id.replaceAll("-", "").slice(0, 12)}`;
   const operator = state.origin === "operator";
   if (state.origin !== undefined && !operator)
@@ -407,7 +494,7 @@ class InstallationStore {
     await chmod(this.file, 384);
   }
   async local() {
-    const source = await readFile2(this.file, "utf8").catch((error) => {
+    const source = await readFile3(this.file, "utf8").catch((error) => {
       if (error.code !== "ENOENT")
         throw error;
       return null;
@@ -505,15 +592,75 @@ function settingsDigest(settings) {
   stable.bindings = [...settings.bindings ?? []].sort((a, b) => a.name.localeCompare(b.name));
   return configurationDigest(stable);
 }
-function configurationDigest(value) {
-  const canonical = (item) => {
-    if (Array.isArray(item))
-      return item.map(canonical);
-    if (item && typeof item === "object")
-      return Object.fromEntries(Object.keys(item).sort().map((key) => [key, canonical(item[key])]));
-    return item;
+
+// packages/flare/src/cli/platform-health.mjs
+function runtimeReadinessFailures(data, state, release = state.installed) {
+  const expected = {
+    readiness: "control-plane-ready",
+    installationId: state.id,
+    platformPayload: release?.digest,
+    version: release?.version,
+    runtimeAbi: release?.runtimeAbi ?? 4,
+    protocol: release?.protocol ?? 1
+  };
+  return Object.keys(expected).filter((key) => expected[key] === undefined || data?.[key] !== expected[key]);
+}
+async function platformHealth(cf, state, fetcher) {
+  const checkedAt = Date.now();
+  const probe = async (fn) => {
+    try {
+      return await fn();
+    } catch {
+      return { status: "unavailable" };
+    }
+  };
+  const [runtime, dashboard, access] = await Promise.all([
+    probe(async () => {
+      const r = await fetcher(`https://${state.addresses.runtimeHost}/health?ready=1`, { redirect: "error", signal: AbortSignal.timeout(5000) });
+      if (!r.ok) {
+        await r.body?.cancel();
+        return { status: "unhealthy", httpStatus: r.status };
+      }
+      const d = await r.json();
+      const mismatches = runtimeReadinessFailures(d, state);
+      return {
+        status: mismatches.length ? "mismatch" : "healthy",
+        ...mismatches.length ? { mismatches } : {},
+        version: d.version,
+        installationId: d.installationId
+      };
+    }),
+    probe(async () => {
+      const r = await fetcher(`https://${state.addresses.adminHost}/api/session`, { redirect: "manual", signal: AbortSignal.timeout(5000) });
+      const location = r.headers.get("location");
+      await r.body?.cancel();
+      const closed = [401, 403].includes(r.status) || [301, 302, 303, 307, 308].includes(r.status) && location && new URL(location, `https://${state.addresses.adminHost}`).origin === state.access?.issuer;
+      return {
+        status: closed ? "access-protected" : "not-verified-closed",
+        httpStatus: r.status,
+        applicationHealth: "not-checked-without-owner-session"
+      };
+    }),
+    probe(async () => {
+      if (!state.access)
+        return { status: "not-configured" };
+      const { app, digest } = await accessSnapshot(cf, state.access.id);
+      const host = app.domain === state.addresses.adminHost || app.destinations?.some((d) => d.type === "public" && d.uri === state.addresses.adminHost);
+      const matches = !state.access.snapshot || (state.access.snapshotFormat === 2 ? digest : configurationDigest(app)) === state.access.snapshot;
+      return {
+        status: host && app.aud === state.access.aud && matches ? "verified" : "drift",
+        snapshot: digest,
+        snapshotFormat: 2
+      };
+    })
+  ]);
+  return {
+    status: state.operation ? "incomplete" : runtime.status === "healthy" && dashboard.status === "access-protected" && access.status === "verified" ? "ready" : "not-verified",
+    checkedAt,
+    runtime,
+    dashboard,
+    access
   };
-  return sha256(JSON.stringify(canonical(value)));
 }
 
 // packages/flare/src/cli/platform.mjs
@@ -681,6 +828,7 @@ function workerConfiguration(state, release, role, bootstrap = false) {
   return {
     ...common,
     worker_loaders: [{ binding: "LOADER" }],
+    ...state.config ? { secrets_store_secrets: validatePlatformConfig(state.config).secrets } : {},
     durable_objects: {
       bindings: [{ name: "SUPERVISORS", class_name: "EnvironmentSupervisor" }]
     },
@@ -720,7 +868,10 @@ function workerConfiguration(state, release, role, bootstrap = false) {
     ],
     vars: {
       ...common.vars,
-      DEV_TOKEN_ISSUER: "https://" + state.addresses.runtimeHost
+      DEV_TOKEN_ISSUER: "https://" + state.addresses.runtimeHost,
+      ...state.config ? {
+        APP_CAPABILITIES: JSON.stringify(validatePlatformConfig(state.config).capabilities)
+      } : {}
     }
   };
 }
@@ -731,10 +882,15 @@ async function confirm(options, state, plan, ask, log) {
     throw Error("Account confirmation required; no cloud changes were made");
 }
 async function assertAccess(cf, state) {
-  const app = await cf.api(`access/apps/${state.access.id}`);
+  const { app, digest } = await accessSnapshot(cf, state.access.id);
   const coversHost = app.domain === state.addresses.adminHost || app.destinations?.some((d) => d.type === "public" && d.uri === state.addresses.adminHost);
-  if (!coversHost || app.aud !== state.access.aud || state.access.snapshot && configurationDigest(app) !== state.access.snapshot)
-    throw Error("Access application drift; refusing to change policies or audiences");
+  if (!coversHost || app.aud !== state.access.aud)
+    throw Error("Access identity/host drift; explicit snapshot acceptance cannot change identities");
+  const expected = state.access.snapshot;
+  if (expected && (state.access.snapshotFormat === 2 ? digest : configurationDigest(app)) !== expected)
+    throw Error(`Access application/policy drift. Review Cloudflare settings, then explicitly accept snapshot ${digest} using --accept-access; no policies were changed.`);
+  state.access.snapshot = digest;
+  state.access.snapshotFormat = 2;
 }
 async function remoteWorker(cf, name) {
   try {
@@ -880,19 +1036,29 @@ async function verify(cf, state, release, fetcher, wait) {
   await assertAccess(cf, state);
   await supervisorNamespace(cf, state);
   let healthy = false;
+  let lastProbe = "unavailable";
   for (let attempt = 0;attempt < 5; attempt++) {
     try {
       const response = await fetcher(`https://${state.addresses.runtimeHost}/health?ready=1`, { redirect: "error", signal: AbortSignal.timeout(15000) });
-      const data = await response.json();
-      healthy = response.ok && data.readiness === "control-plane-ready" && data.version === release.manifest.version && data.installationId === state.id && data.platformPayload === release.manifest.digest && data.runtimeAbi === 4 && data.protocol === 1;
-    } catch {}
+      lastProbe = `HTTP ${response.status}`;
+      if (!response.ok)
+        await response.body?.cancel();
+      else {
+        const failures = runtimeReadinessFailures(await response.json(), state, release.manifest);
+        healthy = failures.length === 0;
+        if (failures.length)
+          lastProbe += "; mismatches: " + failures.join(",");
+      }
+    } catch {
+      lastProbe = "network/timeout or invalid health response";
+    }
     if (healthy)
       break;
     if (attempt < 4)
       await wait(2000);
   }
   if (!healthy)
-    throw Error("Runtime health does not match the installed platform payload; operation remains resumable");
+    throw Error("Runtime health does not match the installed platform payload; operation remains resumable. Last probe: " + lastProbe);
   for (const path of ["/", "/api/session"]) {
     const response = await fetcher(`https://${state.addresses.adminHost}${path}`, { redirect: "manual", signal: AbortSignal.timeout(15000) });
     if ([301, 302, 303, 307, 308].includes(response.status)) {
@@ -1140,12 +1306,16 @@ async function runPlatform(options, dependencies = {}) {
   const discovered = adoption ? await discoverOperator(cf, store, name) : await store.discover();
   let state = discovered.state;
   if (operation === "status")
-    return state ? publicState(state, release.manifest, discovered.row) : {
+    return state ? {
+      ...publicState(state, release.manifest, discovered.row),
+      health: await platformHealth(cf, state, dependencies.fetch ?? globalThis.fetch)
+    } : {
       account,
       installation: name,
       status: "not-installed",
       target: release.manifest.version
     };
+  const requestedConfig = options.config ? await readPlatformConfig(options.config) : null;
   const inventory = await preflight(cf);
   if (adoption && !state)
     state = await prepareOperator(cf, inventory, release, options, dependencies);
@@ -1164,6 +1334,20 @@ async function runPlatform(options, dependencies = {}) {
       runtimeHost: options["runtime-host"]
     });
   }
+  const configChanged = requestedConfig && configurationDigest(requestedConfig) !== configurationDigest(validatePlatformConfig(state.config));
+  if (state.operation && requestedConfig && configurationDigest(requestedConfig) !== state.operation.configDigest)
+    throw Error("Pending config differs; resume with the original config or omit --config");
+  let accessChanged = false;
+  if (options["accept-access"]) {
+    if (!/^[a-f0-9]{64}$/.test(options["accept-access"]) || operation !== "update" || state.operation)
+      throw Error("Access snapshot acceptance requires an idle managed update and exact SHA256");
+    const actual = await accessSnapshot(cf, state.access.id);
+    if (actual.digest !== options["accept-access"])
+      throw Error("Access changed since review; read platform status and review the new snapshot");
+    accessChanged = state.access.snapshotFormat !== 2 || state.access.snapshot !== actual.digest;
+    state.access.snapshot = actual.digest;
+    state.access.snapshotFormat = 2;
+  }
   if (state.operation && (state.operation.kind !== operation || state.operation.targetDigest !== release.manifest.digest))
     throw Error("A different platform operation is incomplete. Resume it with the original CLI release before changing versions.");
   if (state.installed) {
@@ -1172,7 +1356,7 @@ async function runPlatform(options, dependencies = {}) {
     if (!state.operation) {
       await assertResources(cf, state, inventory);
       await assertNoDrift(cf, state);
-      if (state.installed.digest === release.manifest.digest)
+      if (state.installed.digest === release.manifest.digest && !configChanged && !accessChanged)
         return { ...publicState(state, release.manifest), unchanged: true };
       if (operation === "install" || adoption)
         throw Error("Already installed. Use flare platform update to change the platform version");
@@ -1186,6 +1370,8 @@ async function runPlatform(options, dependencies = {}) {
     from: state.installed?.version ?? state.adoptedFrom?.version ?? null,
     to: release.manifest.version,
     digest: release.manifest.digest,
+    configuration: requestedConfig ?? state.config ?? null,
+    acceptedAccessSnapshot: accessChanged ? state.access.snapshot : null,
     dashboard: "https://" + state.addresses.adminHost,
     runtime: "https://" + state.addresses.runtimeHost,
     steps: state.installed || adoption ? ["migrations", "runtime", "admin", "verify"] : steps,
@@ -1208,10 +1394,13 @@ async function runPlatform(options, dependencies = {}) {
   if (options["dry-run"])
     return plan;
   await confirm(options, state, plan, ask, log);
+  if (!state.operation && requestedConfig)
+    state.config = requestedConfig;
   state.operation ??= {
     id: randomUUID2(),
     kind: operation,
     targetDigest: release.manifest.digest,
+    configDigest: configurationDigest(validatePlatformConfig(state.config)),
     completed: [],
     phase: "catalog",
     previousVersions: { ...state.versions },
@@ -1235,7 +1424,7 @@ async function runPlatform(options, dependencies = {}) {
       await assertResources(cf, state, inventory);
       await assertNoDrift(cf, state);
     }
-    await store.initialize(state, await readFile3(join3(release.directory, "migrations/0006_platform_installation.sql"), "utf8"));
+    await store.initialize(state, await readFile4(join3(release.directory, "migrations/0006_platform_installation.sql"), "utf8"));
   }
   await store.acquire(state, options.resume === true);
   const scratch = await mkdtemp(join3(tmpdir(), "flare-platform-"));

package/dist/cli/flare.js

@@ -3,7 +3,7 @@
 // packages/flare/package.json
 var package_default = {
   name: "@auersperg/flare",
-  version: "0.3.7",
+  version: "0.3.9",
   license: "MIT",
   type: "module",
   description: "Flare client, server declarations and development CLI",
@@ -107,6 +107,8 @@ else if (command === "platform") {
       console.log(`flare platform install|status|update|adopt [--account <ID>] [--name <name>]
 install: [--owner <email>] [--dashboard-host <host> --runtime-host <host>] [--subdomain <workers.dev prefix>]
 adopt: --owner <email> (existing standard flare-admin/flare-runtime/flare-catalog; default installation only)
+install/update: [--config <operator JSON>]
+update: [--accept-access <reviewed snapshot SHA256>]
 install/update/adopt: [--dry-run] [--confirm <account ID>] [--resume]
 Uses the platform payload bundled with this CLI release. Never updates applications or runs a local dashboard. Requires separate Cloudflare account permissions; FLARE_DEPLOY_TOKEN is not an account token.`);
     } else {
@@ -122,8 +124,17 @@ Uses the platform payload bundled with this CLI release. Never updates applicati
         "subdomain",
         "confirm",
         "dry-run",
-        "resume"
-      ] : operation === "update" ? ["account", "name", "confirm", "dry-run", "resume"] : ["account", "name"];
+        "resume",
+        "config"
+      ] : operation === "update" ? [
+        "account",
+        "name",
+        "confirm",
+        "dry-run",
+        "resume",
+        "config",
+        "accept-access"
+      ] : ["account", "name"];
       for (let i = 0;i < args.length; i++) {
         const key = args[i]?.slice(2);
         if (!args[i]?.startsWith("--") || !allowed.includes(key) || key in options)
@@ -136,7 +147,7 @@ Uses the platform payload bundled with this CLI release. Never updates applicati
           options[key] = args[++i];
         }
       }
-      const { platform } = await import("./chunk-r3ceakrn.js");
+      const { platform } = await import("./chunk-0s0vrjtw.js");
       console.log(JSON.stringify(await platform(options), null, 2));
     }
   } catch (error) {

package/dist/platform/admin.js

@@ -1,49 +1,3 @@
-// packages/core/src/retention.ts
-var jobRetentionMs = 30 * 86400000;
-var catalogDeadlines = new WeakMap;
-async function collectCatalog(database, now = Date.now()) {
-  if (now < (catalogDeadlines.get(database) ?? 0))
-    return;
-  const next = now + 86400000;
-  const claim = await database.prepare("UPDATE maintenance SET next=? WHERE id=1 AND next<=? RETURNING id").bind(next, now).first();
-  catalogDeadlines.set(database, claim ? next : now + 60000);
-  if (!claim)
-    return;
-  const statements = [
-    database.prepare("DELETE FROM audit WHERE id IN (SELECT id FROM audit WHERE at<? ORDER BY at LIMIT 1000)").bind(now - 90 * 86400000),
-    database.prepare("DELETE FROM credentials WHERE hash IN (SELECT hash FROM credentials WHERE expiresAt<? ORDER BY expiresAt LIMIT 1000)").bind(now - 14 * 86400000),
-    database.prepare("DELETE FROM cli_logins WHERE id IN (SELECT id FROM cli_logins WHERE expiresAt<? ORDER BY expiresAt LIMIT 1000)").bind(now)
-  ];
-  const result = await database.batch(statements);
-  if (result.some((value) => Number(value.meta.changes) >= 1000)) {
-    catalogDeadlines.set(database, now + 60000);
-    await database.prepare("UPDATE maintenance SET next=? WHERE id=1").bind(now + 60000).run();
-  }
-}
-// packages/core/package.json
-var package_default = {
-  name: "@flare/platform",
-  version: "0.3.7",
-  type: "module",
-  license: "MIT",
-  private: true,
-  files: [
-    "dist",
-    "src",
-    "bootstrap",
-    "migrations",
-    "README.md"
-  ],
-  dependencies: {
-    agents: "0.28.0"
-  },
-  repository: {
-    type: "git",
-    url: "https://github.com/auersperg/flare.git",
-    directory: "packages/core"
-  }
-};
-
 // packages/flare/src/sdk/protocol.ts
 var LIMITS = Object.freeze({
   inputBytes: 65536,
@@ -305,6 +259,69 @@ function projectCustomer(value) {
   return value.trim();
 }
 
+// packages/core/src/maintenance.ts
+function scopeForDeletion(value) {
+  if (typeof value !== "string")
+    fail("INVALID_INPUT");
+  const parts = value.split("/");
+  if (parts.length !== 2)
+    fail("INVALID_INPUT");
+  return `${uuid(parts[0])}/${environment(parts[1])}`;
+}
+
+// packages/core/src/dashboard-live.ts
+async function dashboardAllowed(catalog, scope, email) {
+  const project = scopeForDeletion(scope).split("/")[0];
+  const row = await catalog.prepare("SELECT m.role FROM members m JOIN projects p ON p.id=? JOIN environments e ON e.projectId=p.id AND e.env=? WHERE m.email=? AND NOT EXISTS (SELECT 1 FROM project_deletions d WHERE d.projectId=p.id)").bind(project, scope.split("/")[1], email).first();
+  return !!row && ["owner", "editor", "viewer"].includes(row.role);
+}
+
+// packages/core/src/retention.ts
+var jobRetentionMs = 30 * 86400000;
+var catalogDeadlines = new WeakMap;
+async function collectCatalog(database, now = Date.now()) {
+  if (now < (catalogDeadlines.get(database) ?? 0))
+    return;
+  const next = now + 86400000;
+  const claim = await database.prepare("UPDATE maintenance SET next=? WHERE id=1 AND next<=? RETURNING id").bind(next, now).first();
+  catalogDeadlines.set(database, claim ? next : now + 60000);
+  if (!claim)
+    return;
+  const statements = [
+    database.prepare("DELETE FROM audit WHERE id IN (SELECT id FROM audit WHERE at<? ORDER BY at LIMIT 1000)").bind(now - 90 * 86400000),
+    database.prepare("DELETE FROM credentials WHERE hash IN (SELECT hash FROM credentials WHERE expiresAt<? ORDER BY expiresAt LIMIT 1000)").bind(now - 14 * 86400000),
+    database.prepare("DELETE FROM cli_logins WHERE id IN (SELECT id FROM cli_logins WHERE expiresAt<? ORDER BY expiresAt LIMIT 1000)").bind(now)
+  ];
+  const result = await database.batch(statements);
+  if (result.some((value) => Number(value.meta.changes) >= 1000)) {
+    catalogDeadlines.set(database, now + 60000);
+    await database.prepare("UPDATE maintenance SET next=? WHERE id=1").bind(now + 60000).run();
+  }
+}
+// packages/core/package.json
+var package_default = {
+  name: "@flare/platform",
+  version: "0.3.9",
+  type: "module",
+  license: "MIT",
+  private: true,
+  files: [
+    "dist",
+    "src",
+    "bootstrap",
+    "migrations",
+    "README.md"
+  ],
+  dependencies: {
+    agents: "0.28.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/auersperg/flare.git",
+    directory: "packages/core"
+  }
+};
+
 // packages/core/src/project-deletion.ts
 function authorizeProjectDeletion(actor, project, input) {
   if (actor.role !== "owner" || actor.projectId)
@@ -599,6 +616,19 @@ async function api(request, env, a) {
     });
   const which = environment(match[2]), scope = `${projectId}/${which}`, op = match[3] ?? "health";
   if (request.method === "GET") {
+    if (op === "live") {
+      if (a.projectId || request.headers.get("origin") !== url.origin || request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        fail("FORBIDDEN");
+      return env.RUNTIME.fetch(new Request(`https://dashboard.internal/${scope}`, {
+        headers: {
+          upgrade: "websocket",
+          "x-flared-dashboard": JSON.stringify({
+            email: a.email,
+            expires: Date.now() + 600000
+          })
+        }
+      }));
+    }
     if (["release", "release-bundle"].includes(op)) {
       const hash = url.searchParams.get("hash");
       if (!hash || !/^[a-f0-9]{64}$/.test(hash))
@@ -749,6 +779,9 @@ async function api(request, env, a) {
 }
 
 class AdminControl extends WorkerEntrypoint {
+  dashboardAllowed(scope, email) {
+    return dashboardAllowed(this.env.CATALOG, scope, email);
+  }
   async readiness() {
     const row = await this.env.CATALOG.prepare("SELECT installation_id FROM flare_installation WHERE singleton=1").first();
     const owner = await this.env.CATALOG.prepare("SELECT email FROM members WHERE role='owner' LIMIT 1").first();
@@ -785,7 +818,7 @@ var admin_default = {
       if (u.pathname.startsWith("/bootstrap/") || u.pathname.startsWith("/starter/"))
         return new Response("Not found", { status: 404 });
       const response = await env.ASSETS.fetch(request), headers = new Headers(response.headers);
-      headers.set("content-security-policy", "default-src 'self'; script-src 'self' " + { scripts: ["'sha256-xIb/Pa7FUshAu4ihwjchYcQpyCI8eS8kt40GpOAYCz8='", "'sha256-1BvDVWLr3QCC20uHhUDi27eDFVJpk1uMQJGIWKUks2I='", "'sha256-kmZE/W8I1iuTnl1b3yqzv9/DQZenPngd3NjSKMQl7y0='", "'sha256-Y8t0ntteBwH+PqGKUyjWW3CAk+BNJKSoQc0xZ68FjhM='", "'sha256-0O7iB6zr9x0r6X6eWYITC9V5q+yWCGAoFvcysBGbY9Q='", "'sha256-tQIkdAw2vqfQ1PjgUE4ML2A4pIV8SByQ1Seeehy6UIc='", "'sha256-4f86GpVBksx63uHEB4f15jGyhnVEOKjwqYxwnfDVOik='"], styles: ["'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='", "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"] }.scripts.join(" ") + "; style-src 'self' " + { scripts: ["'sha256-xIb/Pa7FUshAu4ihwjchYcQpyCI8eS8kt40GpOAYCz8='", "'sha256-1BvDVWLr3QCC20uHhUDi27eDFVJpk1uMQJGIWKUks2I='", "'sha256-kmZE/W8I1iuTnl1b3yqzv9/DQZenPngd3NjSKMQl7y0='", "'sha256-Y8t0ntteBwH+PqGKUyjWW3CAk+BNJKSoQc0xZ68FjhM='", "'sha256-0O7iB6zr9x0r6X6eWYITC9V5q+yWCGAoFvcysBGbY9Q='", "'sha256-tQIkdAw2vqfQ1PjgUE4ML2A4pIV8SByQ1Seeehy6UIc='", "'sha256-4f86GpVBksx63uHEB4f15jGyhnVEOKjwqYxwnfDVOik='"], styles: ["'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='", "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"] }.styles.join(" ") + "; connect-src 'self' " + env.RUNTIME_URL + " " + env.RUNTIME_URL.replace("https:", "wss:") + "; object-src 'none'; base-uri 'none'; frame-ancestors 'none'");
+      headers.set("content-security-policy", "default-src 'self'; script-src 'self' " + { scripts: ["'sha256-xIb/Pa7FUshAu4ihwjchYcQpyCI8eS8kt40GpOAYCz8='", "'sha256-1BvDVWLr3QCC20uHhUDi27eDFVJpk1uMQJGIWKUks2I='", "'sha256-kmZE/W8I1iuTnl1b3yqzv9/DQZenPngd3NjSKMQl7y0='", "'sha256-Y8t0ntteBwH+PqGKUyjWW3CAk+BNJKSoQc0xZ68FjhM='", "'sha256-0O7iB6zr9x0r6X6eWYITC9V5q+yWCGAoFvcysBGbY9Q='", "'sha256-tQIkdAw2vqfQ1PjgUE4ML2A4pIV8SByQ1Seeehy6UIc='", "'sha256-4f86GpVBksx63uHEB4f15jGyhnVEOKjwqYxwnfDVOik='"], styles: ["'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='", "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"] }.scripts.join(" ") + "; style-src 'self' " + { scripts: ["'sha256-xIb/Pa7FUshAu4ihwjchYcQpyCI8eS8kt40GpOAYCz8='", "'sha256-1BvDVWLr3QCC20uHhUDi27eDFVJpk1uMQJGIWKUks2I='", "'sha256-kmZE/W8I1iuTnl1b3yqzv9/DQZenPngd3NjSKMQl7y0='", "'sha256-Y8t0ntteBwH+PqGKUyjWW3CAk+BNJKSoQc0xZ68FjhM='", "'sha256-0O7iB6zr9x0r6X6eWYITC9V5q+yWCGAoFvcysBGbY9Q='", "'sha256-tQIkdAw2vqfQ1PjgUE4ML2A4pIV8SByQ1Seeehy6UIc='", "'sha256-4f86GpVBksx63uHEB4f15jGyhnVEOKjwqYxwnfDVOik='"], styles: ["'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='", "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='"] }.styles.join(" ") + "; connect-src 'self' " + env.DASHBOARD_URL.replace("https:", "wss:") + " " + env.RUNTIME_URL + " " + env.RUNTIME_URL.replace("https:", "wss:") + "; object-src 'none'; base-uri 'none'; frame-ancestors 'none'");
       headers.set("referrer-policy", "no-referrer");
       headers.set("x-content-type-options", "nosniff");
       headers.set("cache-control", response.ok && u.pathname.startsWith("/_astro/") ? "private, max-age=31536000, immutable" : "private, no-store");

package/dist/platform/dashboard/_astro/auth-view.EASEF9BN.js

@@ -0,0 +1 @@
+import{a as e,r as t}from"./client.BeKNsjPN.js";import{At as n,S as r,_ as i,a,b as o,f as s,g as c,n as l,p as u,pt as d,s as f,u as p,v as m,x as h,y as g}from"./common.TAClb6G9.js";import{o as _}from"./index.astro_astro_type_script_index_0_lang.Blg5hU9g.js";var v=e(t(),1),y=n();function b(e){let t=c(e.project,e.env),[n,b]=(0,v.useState)(``),[x,S]=(0,v.useState)(),C=p(t+`/auth-users`+(n?`?cursor=`+encodeURIComponent(n):``)),w=p(t+`/auth-settings`),T=e.session.role===`owner`,E=(n,r,i,a=[])=>{S({title:r,description:`Passwords are never displayed. Changes revoke existing sessions.`,productionId:e.env===`prod`?e.project.id:void 0,fields:a,submit:async r=>{try{await u(t+`/`+n,{...i,...s(a,e=>new FormData(r).get(e)),confirm:e.project.id})}catch(e){throw e instanceof Error&&e.message===`INVALID_PASSWORD`?Error(`Password must contain 6–128 characters. Spaces are allowed; the password is not trimmed.`):e instanceof Error&&e.message===`REGISTRATION_UNAVAILABLE`?Error(`This login is already registered. Choose another login or manage the existing user.`):e}C.refresh(),w.refresh()}})},D={name:`password`,type:`password`,required:!0,description:`6–128 characters.`};return(0,y.jsxs)(`div`,{className:`space-y-4 p-4`,children:[(0,y.jsx)(`h1`,{className:`page-title`,children:`Auth`}),(0,y.jsx)(f,{loading:C.loading||w.loading,error:C.error||w.error}),w.data&&(0,y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-2`,children:[(0,y.jsx)(_,{status:w.data.enabled?`Enabled`:`Disabled`}),(0,y.jsx)(_,{status:w.data.registration?`Public registration`:`Registration closed`}),T&&(0,y.jsx)(d,{variant:`outline`,onClick:()=>E(`auth-configure`,`Configure authentication`,{},[{name:`enabled`,type:`boolean`,value:w.data.enabled},{name:`registration`,type:`boolean`,value:w.data.registration}]),children:`Configure`}),T&&(0,y.jsx)(d,{onClick:()=>E(`auth-create`,`Create user`,{},[{name:`login`,type:`string`,required:!0},D]),children:`Create user`})]}),C.data&&(0,y.jsxs)(y.Fragment,{children:[(0,y.jsxs)(i,{children:[(0,y.jsx)(h,{children:(0,y.jsxs)(r,{children:[(0,y.jsx)(o,{children:`Login`}),(0,y.jsx)(o,{children:`User ID`}),(0,y.jsx)(o,{children:`Status`}),(0,y.jsx)(o,{children:`Created`}),(0,y.jsx)(o,{children:`Actions`})]})}),(0,y.jsx)(m,{children:C.data.users.map(e=>(0,y.jsxs)(r,{children:[(0,y.jsx)(g,{children:e.login}),(0,y.jsx)(g,{children:(0,y.jsx)(`code`,{children:e.id})}),(0,y.jsx)(g,{children:(0,y.jsx)(_,{status:e.disabled?`Blocked`:`Active`})}),(0,y.jsx)(g,{children:new Date(e.createdAt).toLocaleString()}),(0,y.jsx)(g,{children:(0,y.jsx)(`div`,{className:`flex flex-wrap gap-2`,children:T&&(0,y.jsxs)(y.Fragment,{children:[(0,y.jsx)(d,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-password`,`Change user password`,{id:e.id},[D]),children:`Change password`}),(0,y.jsx)(d,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-revoke`,`Revoke all sessions`,{id:e.id}),children:`Revoke sessions`}),(0,y.jsx)(d,{variant:`outline`,size:`sm`,onClick:()=>E(`auth-disable`,e.disabled?`Unblock user`:`Block user`,{id:e.id,disabled:!e.disabled}),children:e.disabled?`Unblock`:`Block`})]})})})]},e.id))})]}),!C.data.users.length&&(0,y.jsx)(l,{title:`No users`}),(0,y.jsxs)(`div`,{className:`flex gap-2`,children:[(0,y.jsx)(d,{variant:`outline`,disabled:!n,onClick:()=>b(``),children:`First page`}),(0,y.jsx)(d,{variant:`outline`,disabled:!C.data.next,onClick:()=>b(C.data.next),children:`Next page`})]})]}),x&&(0,y.jsx)(a,{modal:x,onClose:()=>S(void 0)})]})}export{b as default};

package/dist/platform/dashboard/_astro/{cli-approval.C4-RBXQh.js → cli-approval.DwZVHdyo.js}

@@ -1 +1 @@
-import{a as e,r as t}from"./client.BeKNsjPN.js";import{A as n,O as r,k as i,m as a,mt as o,p as s,pt as c,q as l,r as u,t as d}from"./common.D6YHScsr.js";var f=e(t(),1),p=o();function m(){let e=new URLSearchParams(location.search).get(`cli`)??``,[t,o]=(0,f.useState)(``),[m,h]=(0,f.useState)([]),[g,_]=(0,f.useState)(`new`),[v,y]=(0,f.useState)(``),[b,x]=(0,f.useState)(``),[S,C]=(0,f.useState)(!1),[w,T]=(0,f.useState)(!1);(0,f.useEffect)(()=>{let t=new AbortController;return Promise.all([s(`cli/approval?id=`+encodeURIComponent(e),void 0,t.signal),s(`projects`,void 0,t.signal)]).then(([e,t])=>{o(e.code),h(t),_(`new`)}).catch(e=>{t.signal.aborted||x(a(e))}),()=>t.abort()},[e]);async function E(){C(!0),x(``);try{let t=g;if(t===`new`){let e=await s(`projects`,{name:v,customer:`Applications`,origins:[]});t=e.id,h(t=>[...t,{id:e.id,name:v,customer:`Applications`}]),_(t)}await s(`cli/approval`,{id:e,project:t}),T(!0)}catch(e){x(a(e))}finally{C(!1)}}return(0,p.jsxs)(`main`,{className:`mx-auto max-w-lg p-8`,children:[(0,p.jsx)(`h1`,{className:`mb-4 text-xl font-semibold`,children:`Connect Flare CLI`}),w?(0,p.jsx)(`p`,{children:`Connected. Return to your terminal. You can close this tab.`}):(0,p.jsxs)(i,{children:[(0,p.jsx)(`p`,{children:`Approve only a login you just started. Compare this code with your terminal:`}),(0,p.jsx)(`strong`,{className:`text-2xl font-mono`,children:t||`Loading…`}),(0,p.jsx)(`p`,{children:`Grants this computer deployment access to the selected project, including production. The credential expires in 30 days and can be revoked in Settings.`}),(0,p.jsxs)(r,{children:[(0,p.jsx)(n,{children:`Project`}),(0,p.jsx)(d,{label:`CLI project`,value:g,onChange:_,items:[...m.map(e=>({value:e.id,label:e.name})),{value:`new`,label:`Create new project`}]})]}),g===`new`&&(0,p.jsxs)(r,{children:[(0,p.jsx)(n,{children:`New project name`}),(0,p.jsx)(l,{value:v,onChange:e=>y(e.target.value),maxLength:100})]}),b&&(0,p.jsx)(u,{children:b}),(0,p.jsx)(c,{disabled:S||!t||!g||g===`new`&&!v.trim(),onClick:E,children:`Approve connection`})]})]})}export{m as default};
+import{a as e,r as t}from"./client.BeKNsjPN.js";import{A as n,At as r,O as i,k as a,m as o,p as s,pt as c,q as l,r as u,t as d}from"./common.TAClb6G9.js";var f=e(t(),1),p=r();function m(){let e=new URLSearchParams(location.search).get(`cli`)??``,[t,r]=(0,f.useState)(``),[m,h]=(0,f.useState)([]),[g,_]=(0,f.useState)(`new`),[v,y]=(0,f.useState)(``),[b,x]=(0,f.useState)(``),[S,C]=(0,f.useState)(!1),[w,T]=(0,f.useState)(!1);(0,f.useEffect)(()=>{let t=new AbortController;return Promise.all([s(`cli/approval?id=`+encodeURIComponent(e),void 0,t.signal),s(`projects`,void 0,t.signal)]).then(([e,t])=>{r(e.code),h(t),_(`new`)}).catch(e=>{t.signal.aborted||x(o(e))}),()=>t.abort()},[e]);async function E(){C(!0),x(``);try{let t=g;if(t===`new`){let e=await s(`projects`,{name:v,customer:`Applications`,origins:[]});t=e.id,h(t=>[...t,{id:e.id,name:v,customer:`Applications`}]),_(t)}await s(`cli/approval`,{id:e,project:t}),T(!0)}catch(e){x(o(e))}finally{C(!1)}}return(0,p.jsxs)(`main`,{className:`mx-auto max-w-lg p-8`,children:[(0,p.jsx)(`h1`,{className:`mb-4 text-xl font-semibold`,children:`Connect Flare CLI`}),w?(0,p.jsx)(`p`,{children:`Connected. Return to your terminal. You can close this tab.`}):(0,p.jsxs)(a,{children:[(0,p.jsx)(`p`,{children:`Approve only a login you just started. Compare this code with your terminal:`}),(0,p.jsx)(`strong`,{className:`text-2xl font-mono`,children:t||`Loading…`}),(0,p.jsx)(`p`,{children:`Grants this computer deployment access to the selected project, including production. The credential expires in 30 days and can be revoked in Settings.`}),(0,p.jsxs)(i,{children:[(0,p.jsx)(n,{children:`Project`}),(0,p.jsx)(d,{label:`CLI project`,value:g,onChange:_,items:[...m.map(e=>({value:e.id,label:e.name})),{value:`new`,label:`Create new project`}]})]}),g===`new`&&(0,p.jsxs)(i,{children:[(0,p.jsx)(n,{children:`New project name`}),(0,p.jsx)(l,{value:v,onChange:e=>y(e.target.value),maxLength:100})]}),b&&(0,p.jsx)(u,{children:b}),(0,p.jsx)(c,{disabled:S||!t||!g||g===`new`&&!v.trim(),onClick:E,children:`Approve connection`})]})]})}export{m as default};