@awsmbiz/create-inbis-app 0.0.0-stage → 0.1.0

package/dist/cli.mjs

@@ -0,0 +1,850 @@
+#!/usr/bin/env node
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+import { execFileSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import * as p from "@clack/prompts";
+// src/ask.ts
+/** A wrong answer given as a flag (or a missing one without a terminal). */
+var AnswerError = class extends Error {};
+// src/auth-answers.ts
+const AUTH_MODULE = "auth";
+const AUTH_METHODS = [
+	"email-password",
+	"phone-otp",
+	"totp"
+];
+/** Same values as `@awsmbiz/inbis-auth`'s `REGISTRATION_MODES`. */
+const REGISTRATION_MODES = [
+	"open",
+	"invite-only",
+	"admin-only",
+	"closed"
+];
+const DEFAULT_METHODS = ["email-password", "totp"];
+const DEFAULT_REGISTRATION = "invite-only";
+const METHOD_LABELS = {
+	"email-password": "Email and password",
+	"phone-otp": "Phone number and SMS code",
+	totp: "Two-factor authentication (authenticator app)"
+};
+const MODE_HINTS = {
+	open: "anyone can sign up",
+	"invite-only": "administrators create accounts or send invitations",
+	"admin-only": "only administrators create accounts; no invitations",
+	closed: "no new accounts (except the first administrator)"
+};
+/** A calling-code prefix, as `@awsmbiz/inbis-auth` checks it: `+`, then 1-6 digits not starting with 0. */
+const CALLING_CODE = /^\+[1-9]\d{0,5}$/;
+/** A comma-separated list; `none` is the empty list. */
+function parseList(value) {
+	return value.trim() === "none" ? [] : value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function checkMethods(methods) {
+	for (const method of methods) if (!AUTH_METHODS.includes(method)) throw new AnswerError(`Unknown sign-in method "${method}". Methods: ${AUTH_METHODS.join(", ")}.`);
+	const chosen = methods;
+	if (!chosen.includes("email-password") && !chosen.includes("phone-otp")) throw new AnswerError("Choose at least one sign-in method: email-password and/or phone-otp.");
+	if (chosen.includes("totp") && !chosen.includes("email-password")) throw new AnswerError("totp (2FA) needs email-password: it completes password sign-ins.");
+	return AUTH_METHODS.filter((method) => chosen.includes(method));
+}
+function checkRegistration(mode, methods) {
+	if (!REGISTRATION_MODES.includes(mode)) throw new AnswerError(`Unknown registration mode "${mode}". Modes: ${REGISTRATION_MODES.join(", ")}.`);
+	if (mode !== "open" && !(methods.includes("email-password") && methods.includes("totp"))) throw new AnswerError(`Registration "${mode}" needs an administrator to create accounts, and administrators sign in with email-password and totp (2FA). Add both methods or choose "open".`);
+	return mode;
+}
+/** Why a phone country list is wrong, or `undefined`. */
+function listError(list) {
+	const bad = list.find((prefix) => !CALLING_CODE.test(prefix));
+	return bad === void 0 ? void 0 : `"${bad}" is not a calling-code prefix such as +44 or +1876.`;
+}
+function checkPhone(allowed, blocked) {
+	const error = listError(allowed) ?? listError(blocked);
+	if (error !== void 0) throw new AnswerError(error);
+	const both = allowed.find((prefix) => blocked.includes(prefix));
+	if (both !== void 0) throw new AnswerError(`"${both}" is both allowed and blocked.`);
+	return {
+		allowed,
+		blocked
+	};
+}
+/** Rejects auth flags given without the auth module (before anything is asked). */
+function checkAuthFlagsWithoutModule(given) {
+	if (given.methods !== void 0) throw new AnswerError("--auth-methods needs the auth module (--modules auth).");
+	if (given.registration !== void 0) throw new AnswerError("--registration needs the auth module (--modules auth).");
+	if (given.phoneAllow !== void 0 || given.phoneBlock !== void 0) throw new AnswerError("--phone-allow and --phone-block need the auth module (--modules auth).");
+}
+/**
+* Turns the auth flags into answers: flags are validated and used; missing
+* answers are asked for when `ask` is given, otherwise defaulted, except the
+* phone country lists, which have no default.
+*/
+async function resolveAuthAnswers(given, ask, modules = [AUTH_MODULE]) {
+	const methodsFor = (answer) => {
+		const methods = checkMethods(answer);
+		if (modules.includes("admin") && !(methods.includes("email-password") && methods.includes("totp"))) throw new AnswerError("The admin module needs administrators, who sign in with email-password and totp (2FA). Add both methods.");
+		return methods;
+	};
+	let methods;
+	if (given.methods !== void 0) methods = methodsFor(given.methods);
+	else if (ask === void 0) methods = DEFAULT_METHODS;
+	else methods = await askUntilValid(ask, () => ask.multiselect({
+		message: "Sign-in methods",
+		options: AUTH_METHODS.map((value) => ({
+			value,
+			label: METHOD_LABELS[value],
+			...DEFAULT_METHODS.includes(value) ? { hint: "default" } : {}
+		}))
+	}), methodsFor);
+	let registration;
+	if (given.registration !== void 0) registration = checkRegistration(given.registration, methods);
+	else if (ask === void 0) registration = checkRegistration(DEFAULT_REGISTRATION, methods);
+	else registration = await askUntilValid(ask, () => ask.select({
+		message: "Who may create an account? (registration mode)",
+		options: REGISTRATION_MODES.map((value) => ({
+			value,
+			label: value,
+			hint: MODE_HINTS[value]
+		})),
+		initialValue: methods.includes("totp") ? DEFAULT_REGISTRATION : "open"
+	}), (mode) => checkRegistration(mode, methods));
+	if (!methods.includes("phone-otp")) {
+		if (given.phoneAllow !== void 0 || given.phoneBlock !== void 0) throw new AnswerError("--phone-allow and --phone-block need phone-otp in --auth-methods.");
+		return {
+			methods,
+			registration
+		};
+	}
+	if (ask === void 0 && (given.phoneAllow === void 0 || given.phoneBlock === void 0)) throw new AnswerError("Phone OTP needs --phone-allow and --phone-block: the calling-code prefixes that may and may not receive codes (e.g. --phone-allow +44,+1 --phone-block none). There is no default.");
+	const askList = (message) => ask === void 0 ? Promise.resolve([]) : ask.text({
+		message,
+		initialValue: "",
+		validate: (value) => value.trim() === "" ? "Give a comma-separated list of prefixes, or \"none\"." : listError(parseList(value))
+	}).then(parseList);
+	const allowed = given.phoneAllow ?? await askList("Phone countries that may receive codes (calling-code prefixes, e.g. +44,+1; \"none\" = every country)");
+	const blocked = given.phoneBlock ?? await askList("Phone countries that never receive codes (e.g. +1876; \"none\" = nothing blocked)");
+	return {
+		methods,
+		registration,
+		phone: checkPhone(allowed, blocked)
+	};
+}
+/** Asks again after an answer the rules reject, showing why. */
+async function askUntilValid(ask, question, rule) {
+	for (;;) {
+		const answer = await question();
+		try {
+			return rule(answer);
+		} catch (error) {
+			if (!(error instanceof AnswerError)) throw error;
+			ask.info(error.message);
+		}
+	}
+}
+const list = (items) => `[${items.map((item) => JSON.stringify(item)).join(", ")}]`;
+/** The app's src/auth-choices.ts for these answers. */
+function renderAuthChoices(answers) {
+	const phone = answers.phone;
+	const phoneOtp = phone === void 0 ? "false" : `{ ${[...phone.allowed.length === 0 ? [] : [`allowedCountries: ${list(phone.allowed)}`], `blockedCountries: ${list(phone.blocked)}`].join(", ")} }`;
+	return `${AUTH_CHOICES_HEADER}
+export const AUTH_CHOICES: AuthChoices = {
+  emailPassword: ${String(answers.methods.includes("email-password"))},
+  phoneOtp: ${phoneOtp},
+  twoFactor: ${String(answers.methods.includes("totp"))},
+  registration: ${JSON.stringify(answers.registration)},
+};
+`;
+}
+/** Everything above the `AUTH_CHOICES` constant; the same text as the module's own file. */
+const AUTH_CHOICES_HEADER = `import type { RegistrationMode } from "@awsmbiz/inbis-auth";
+
+/**
+ * The sign-in choices made when this app was created (create-inbis-app). They are
+ * yours to change: src/auth-config.ts turns them into the auth config, and the
+ * tests read them to know which journeys apply.
+ */
+export interface AuthChoices {
+  /** Email + password sign-in (and password reset, email verification). */
+  emailPassword: boolean;
+  /**
+   * Sign-in with an SMS code, or \`false\`. Countries are calling-code prefixes
+   * (\`"+44"\`, \`"+1876"\`): absent \`allowedCountries\` means every country;
+   * \`blockedCountries\` wins over it. There is no platform default.
+   */
+  phoneOtp: false | { allowedCountries?: readonly string[]; blockedCountries: readonly string[] };
+  /** Two-factor authentication with an authenticator app (password sign-ins). Administrators need it. */
+  twoFactor: boolean;
+  /**
+   * Who may create an account: \`open\` (anyone signs up), \`invite-only\`
+   * (administrators create accounts or invite), \`admin-only\` (administrators
+   * create accounts; invitations are refused), \`closed\` (no new accounts but
+   * the first administrator).
+   */
+  registration: RegistrationMode;
+}
+`;
+/** Writes the answers into the generated app. */
+function writeAuthChoices(outDir, answers) {
+	writeFileSync(join(outDir, "src", "auth-choices.ts"), renderAuthChoices(answers));
+}
+// src/template-modules.ts
+/** A wiring marker: `inbis:wire <point> [key=value ...]` inside any comment. */
+const MARKER = /inbis:wire\s+([\w.-]+)((?:[ \t]+[\w-]+=[^\s*>]+)*)/;
+/** Reads `templateDir/template.json`. */
+function loadTemplate(templateDir) {
+	return JSON.parse(readFileSync(join(templateDir, "template.json"), "utf8"));
+}
+/**
+* Reads every `<name>/module.json` under `root` (the template's `modules/`),
+* checking that each module is ordered after the modules it requires (so
+* manifest order is a dependency order).
+*/
+function loadModules(root) {
+	if (!existsSync(root)) return [];
+	const manifests = readdirSync(root).filter((name) => existsSync(join(root, name, "module.json"))).map((name) => {
+		const manifest = JSON.parse(readFileSync(join(root, name, "module.json"), "utf8"));
+		if (manifest.name !== name) throw new Error(`modules/${name}/module.json is named "${manifest.name}"; it must match its directory.`);
+		return {
+			...manifest,
+			dir: join(root, name)
+		};
+	});
+	const byName = new Map(manifests.map((m) => [m.name, m]));
+	for (const m of manifests) for (const required of m.requires ?? []) {
+		const dep = byName.get(required);
+		if (dep === void 0) throw new Error(`Module "${m.name}" requires unknown module "${required}".`);
+		if (dep.order >= m.order) throw new Error(`Module "${m.name}" (order ${m.order}) requires "${required}" (order ${dep.order}); it must come later.`);
+	}
+	return manifests;
+}
+/**
+* Adds the modules the selection requires (transitively) and orders the result
+* by manifest `order`. `added` lists each module that was not asked for, with
+* the module that first required it.
+*/
+function resolveModules(manifests, selected) {
+	const byName = new Map(manifests.map((m) => [m.name, m]));
+	const chosen = /* @__PURE__ */ new Set();
+	const added = [];
+	const visit = (name, requiredBy) => {
+		const manifest = byName.get(name);
+		if (manifest === void 0) {
+			const known = [...byName.keys()].sort().join(", ");
+			throw new Error(`Unknown module "${name}". Known modules: ${known === "" ? "(none)" : known}.`);
+		}
+		if (chosen.has(name)) return;
+		chosen.add(name);
+		if (requiredBy !== void 0 && !selected.includes(name)) added.push({
+			name,
+			requiredBy
+		});
+		for (const required of manifest.requires ?? []) visit(required, name);
+	};
+	for (const name of selected) visit(name, void 0);
+	const order = (name) => byName.get(name)?.order ?? 0;
+	return {
+		modules: [...chosen].sort((a, b) => order(a) - order(b) || a.localeCompare(b)),
+		added
+	};
+}
+/**
+* Every file under `dir`, as paths relative to it with `/` separators. Paths in
+* `skip` (files or whole directories) are left out without being read.
+*/
+function listFiles(dir, skip = /* @__PURE__ */ new Set()) {
+	const files = [];
+	const walk = (current) => {
+		for (const entry of readdirSync(current)) {
+			const path = join(current, entry);
+			const rel = relative(dir, path).split(sep).join("/");
+			if (skip.has(rel)) continue;
+			if (statSync(path).isDirectory()) walk(path);
+			else files.push(rel);
+		}
+	};
+	if (existsSync(dir)) walk(dir);
+	return files.sort();
+}
+/** Copies `from/**` into `to`, refusing to overwrite (a module may only add files). */
+function addFiles(from, to, owner) {
+	for (const file of listFiles(from)) {
+		const target = join(to, file);
+		if (existsSync(target)) throw new Error(`Module "${owner}" adds ${file}, which already exists.`);
+		mkdirSync(dirname(target), { recursive: true });
+		cpSync(join(from, file), target);
+	}
+}
+/** Merges `extra` into `target`, refusing a key that is already set to a different value. */
+function mergeDeps(target, extra, field, owner) {
+	for (const [name, value] of Object.entries(extra)) {
+		const current = target[name];
+		if (current !== void 0 && current !== value) throw new Error(`Module "${owner}" conflicts on ${field} "${name}": already ${current}, the module wants ${value}.`);
+		target[name] = value;
+	}
+}
+const sortKeys = (object) => Object.fromEntries(Object.entries(object).sort(([a], [b]) => a.localeCompare(b)));
+/** Parses a marker's `key=value` arguments. */
+function markerArgs(text) {
+	return Object.fromEntries(text.trim().split(/\s+/).filter(Boolean).map((pair) => pair.split("=", 2)));
+}
+/** Snippet lines with their common indentation removed (trailing blank lines dropped). */
+function dedent(text) {
+	const lines = text.replace(/\s+$/, "").split("\n");
+	const indents = lines.filter((line) => line.trim() !== "").map((line) => /^[ \t]*/.exec(line)?.[0].length ?? 0);
+	const common = Math.min(...indents, Infinity);
+	return lines.map((line) => line.trim() === "" ? "" : line.slice(common === Infinity ? 0 : common));
+}
+/**
+* Copies the template's base to `outDir` and applies `modules` (plus the ones
+* they require). Throws on an unknown module or wiring point, a missing
+* marker, a file clash or a conflicting dependency (the output directory is
+* then incomplete: use a fresh one).
+*/
+function applyModules({ templateDir, outDir, modules: selected, modulesDir = join(templateDir, "modules"), standalone = false, stripMarkers = false }) {
+	const template = loadTemplate(templateDir);
+	const manifests = loadModules(modulesDir);
+	const { modules, added } = resolveModules(manifests, selected);
+	const byName = new Map(manifests.map((m) => [m.name, m]));
+	const parts = [];
+	const chosen = modules.flatMap((name) => byName.get(name) ?? []);
+	for (const manifest of chosen) {
+		const { name } = manifest;
+		const dir = manifest.dir ?? join(modulesDir, name);
+		parts.push({
+			owner: name,
+			dir,
+			part: {
+				...manifest,
+				files: manifest.files ?? "files"
+			}
+		});
+		for (const extra of manifest.when ?? []) if (extra.modules.every((m) => modules.includes(m))) parts.push({
+			owner: name,
+			dir,
+			part: extra
+		});
+	}
+	const points = { ...template.wiring };
+	for (const manifest of chosen) for (const [point, declaration] of Object.entries(manifest.points ?? {})) {
+		if (points[point] !== void 0) throw new Error(`Module "${manifest.name}" declares wiring point "${point}", which is already declared.`);
+		points[point] = declaration;
+	}
+	for (const { owner, part } of parts) for (const point of Object.keys(part.wiring ?? {})) if (points[point] === void 0) throw new Error(`Module "${owner}" contributes to unknown wiring point "${point}".`);
+	const exclude = /* @__PURE__ */ new Set([
+		...template.exclude ?? [],
+		"template.json",
+		"modules",
+		"node_modules"
+	]);
+	if (template.standalone !== void 0) exclude.add(template.standalone);
+	mkdirSync(outDir, { recursive: true });
+	for (const file of listFiles(templateDir, exclude)) {
+		mkdirSync(dirname(join(outDir, file)), { recursive: true });
+		cpSync(join(templateDir, file), join(outDir, file));
+	}
+	if (standalone && template.standalone !== void 0) addFiles(join(templateDir, template.standalone), outDir, "(standalone)");
+	const pkgPath = join(outDir, "package.json");
+	const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+	for (const { owner, dir, part } of parts) {
+		if (part.files !== void 0) addFiles(join(dir, part.files), outDir, owner);
+		for (const field of [
+			"dependencies",
+			"devDependencies",
+			"scripts"
+		]) {
+			const extra = part[field];
+			if (extra === void 0) continue;
+			const merged = { ...pkg[field] };
+			mergeDeps(merged, extra, field, owner);
+			pkg[field] = sortKeys(merged);
+		}
+	}
+	writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+	const files = new Set(Object.values(points).map((point) => point.file));
+	for (const file of files) {
+		const path = join(outDir, file);
+		if (!existsSync(path)) throw new Error(`Wiring file ${file} does not exist in the app.`);
+		const seen = /* @__PURE__ */ new Set();
+		const output = [];
+		for (const line of readFileSync(path, "utf8").split("\n")) {
+			const match = MARKER.exec(line);
+			if (match === null) {
+				output.push(line);
+				continue;
+			}
+			const point = match[1] ?? "";
+			if (points[point]?.file !== file) throw new Error(`${file} marks wiring point "${point}", which neither template.json nor a selected module declares for it.`);
+			seen.add(point);
+			const args = markerArgs(match[2] ?? "");
+			const indent = /^[ \t]*/.exec(line)?.[0] ?? "";
+			for (const { owner, dir, part } of parts) {
+				const contribution = part.wiring?.[point];
+				if (contribution === void 0) continue;
+				const snippet = typeof contribution === "string" ? contribution : contribution[args["env"] ?? ""];
+				if (snippet === void 0) continue;
+				const text = readFileSync(join(dir, snippet), "utf8").replace(/\{\{(\w+)\}\}/g, (placeholder, key) => {
+					const value = args[key];
+					if (value === void 0) throw new Error(`Module "${owner}" uses ${placeholder} in ${snippet}, which the "${point}" marker in ${file} does not supply.`);
+					return value;
+				});
+				for (const snippetLine of dedent(text)) output.push(snippetLine === "" ? "" : indent + snippetLine);
+			}
+			if (!stripMarkers) output.push(line);
+		}
+		for (const [point, { file: declared }] of Object.entries(points)) if (declared === file && !seen.has(point)) throw new Error(`Wiring point "${point}" has no marker in ${file}.`);
+		writeFileSync(path, output.join("\n"));
+	}
+	return {
+		modules,
+		added,
+		manifests: chosen
+	};
+}
+// src/answers.ts
+const WORKER_NAME_MAX = 52;
+const validate = {
+	directory: (value, cwd = process.cwd()) => {
+		if (value.trim() === "") return "Give the directory to create the app in.";
+		const path = resolve(cwd, value);
+		if (existsSync(path) && readdirSync(path).length > 0) return `${path} is not empty.`;
+	},
+	appName: (value) => {
+		if (value.length > 214 || !/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(value)) return `"${value}" is not a valid package name: use lowercase letters, digits, "-", "." or "_" (optionally @scope/name).`;
+	},
+	workerName: (value) => {
+		if (value.length > WORKER_NAME_MAX || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value)) return `"${value}" is not a valid Worker name: lowercase letters, digits and inner "-", at most ${WORKER_NAME_MAX} characters.`;
+	},
+	domain: (value) => {
+		if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/.test(value)) return `"${value}" is not a domain name (e.g. app.example.com).`;
+	},
+	binding: (value) => {
+		if (!/^[A-Z][A-Z0-9_]*$/.test(value)) return `"${value}" is not a binding name: uppercase letters, digits and "_", starting with a letter.`;
+	}
+};
+/** A Worker name derived from a package name (scope dropped, other characters replaced). */
+function workerNameFor(appName) {
+	const name = (appName.split("/").pop() ?? appName).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, WORKER_NAME_MAX).replace(/-+$/, "");
+	return name === "" ? "app" : name;
+}
+function check(error) {
+	if (error !== void 0) throw new AnswerError(error);
+}
+/**
+* Turns flags into answers: a flag is validated and used; a missing answer is
+* asked for when `ask` is given (with the default filled in), otherwise
+* defaulted, and the directory, which has no default, is an error. Paths are
+* relative to `cwd`.
+*/
+async function resolveAnswers(given, offer, ask, cwd = process.cwd()) {
+	const answer = async (value, fallback, message, rule) => {
+		if (value !== void 0) {
+			check(rule(value));
+			return value;
+		}
+		if (ask === void 0) {
+			check(rule(fallback));
+			return fallback;
+		}
+		return ask.text({
+			message,
+			initialValue: fallback,
+			validate: rule
+		});
+	};
+	if (given.directory === void 0 && ask === void 0) throw new AnswerError("Give the directory to create the app in: create-inbis-app <directory> (see --help).");
+	const inCwd = (value) => validate.directory(value, cwd);
+	const directory = resolve(cwd, await answer(given.directory, "my-inbis-app", "Directory for the new app", inCwd));
+	const appName = await answer(given.appName, basename(directory), "App name (package.json)", validate.appName);
+	const workerName = await answer(given.workerName, workerNameFor(appName), "Cloudflare Worker name", validate.workerName);
+	const staging = await answer(given.stagingDomain, `staging.${workerName}.example.com`, "Staging domain", validate.domain);
+	const production = await answer(given.productionDomain, `${workerName}.example.com`, "Production domain", validate.domain);
+	const modules = await chooseModules(given.modules, offer.modules, ask);
+	if (!modules.includes("auth")) checkAuthFlagsWithoutModule(given.auth ?? {});
+	const auth = modules.includes("auth") ? await resolveAuthAnswers(given.auth ?? {}, ask, modules) : void 0;
+	const bindings = await nameBindings(given.bindings ?? {}, offer, modules, ask);
+	const git = given.git ?? (ask === void 0 ? false : await ask.confirm({
+		message: "Initialise a git repository?",
+		initialValue: true
+	}));
+	return {
+		directory,
+		appName,
+		workerName,
+		domains: {
+			staging,
+			production
+		},
+		bindings,
+		modules,
+		...auth === void 0 ? {} : { auth },
+		git
+	};
+}
+async function chooseModules(given, offered, ask) {
+	let selected = given ?? [];
+	if (given === void 0 && ask !== void 0 && offered.length > 0) selected = await ask.multiselect({
+		message: "Modules (none gives the minimal app)",
+		options: offered.map((m) => ({
+			value: m.name,
+			label: m.name,
+			...m.description === void 0 ? {} : { hint: m.description }
+		}))
+	});
+	let resolved;
+	try {
+		resolved = resolveModules(offered, selected);
+	} catch (error) {
+		throw new AnswerError(error.message);
+	}
+	for (const { name, requiredBy } of resolved.added) {
+		const message = `Added module "${name}": "${requiredBy}" requires it.`;
+		if (ask === void 0) console.log(message);
+		else ask.info(message);
+	}
+	return resolved.modules;
+}
+async function nameBindings(given, offer, modules, ask) {
+	const declared = { ...offer.bindings };
+	for (const m of offer.modules) if (modules.includes(m.name)) Object.assign(declared, m.bindings);
+	for (const name of Object.keys(given)) if (declared[name] === void 0) {
+		const known = Object.keys(declared).sort().join(", ");
+		throw new AnswerError(`There is no binding "${name}" to rename. Renameable bindings: ${known === "" ? "(none)" : known}.`);
+	}
+	const bindings = {};
+	for (const [name, description] of Object.entries(declared)) {
+		const value = given[name];
+		if (value !== void 0) check(validate.binding(value));
+		bindings[name] = value ?? (ask === void 0 ? name : await ask.text({
+			message: `Binding name for ${description}`,
+			initialValue: name,
+			validate: validate.binding
+		}));
+	}
+	const names = Object.values(bindings);
+	const twice = names.find((name, index) => names.indexOf(name) !== index);
+	if (twice !== void 0) throw new AnswerError(`Two bindings would be named "${twice}".`);
+	return bindings;
+}
+// src/args.ts
+const USAGE = `Usage: pnpm create @awsmbiz/inbis-app [directory] [flags]
+
+Creates a new Inbis app. Every question has a flag; questions without one are
+asked in a terminal, or take their default with --yes (or without a terminal).
+
+  [directory]                 Directory to create (must be empty or missing)
+  --name <name>               App (package.json) name. Default: the directory name
+  --worker <name>             Cloudflare Worker name. Default: from the app name
+  --staging-domain <domain>   Staging custom domain. Default: staging.<worker>.example.com
+  --production-domain <dom>   Production custom domain. Default: <worker>.example.com
+  --binding <NAME=NEW>        Rename a binding (repeatable), e.g. --binding DB=APP_DB
+  --modules <a,b|none>        Modules to add; ones they require are added too
+  --auth-methods <a,b>        auth: sign-in methods among email-password, phone-otp,
+                              totp. Default: email-password,totp
+  --registration <mode>       auth: who may create an account: open, invite-only,
+                              admin-only, closed. Default: invite-only
+  --phone-allow <+44,..|none> auth with phone-otp: calling-code prefixes that may
+                              receive codes (none: every country). No default
+  --phone-block <+1876,..|none>
+                              auth with phone-otp: prefixes that never receive
+                              codes (none: nothing blocked). No default
+  --git / --no-git            Initialise a git repository. Default: ask; no with --yes
+  -y, --yes                   Do not prompt: use the defaults for missing answers
+  --platform-version <ver>    Version to pin @awsmbiz packages to. Default: this
+                              generator's version (the platform releases in lockstep)
+  --modules-dir <dir>         Take modules from <dir> instead of the template's own
+                              (platform tests)
+  -h, --help                  Show this help
+  -v, --version               Show the version`;
+/** Parses argv into flags; unknown flags and malformed values are an AnswerError. */
+function parseFlags(argv) {
+	let parsed;
+	try {
+		parsed = parse(argv);
+	} catch (error) {
+		throw new AnswerError(`${error.message}\n\n${USAGE}`);
+	}
+	const { values, positionals } = parsed;
+	if (positionals.length > 1) throw new AnswerError(`Give one directory, not ${positionals.length}: ${positionals.join(" ")}.`);
+	const given = {};
+	const set = (key, value) => {
+		if (value !== void 0) given[key] = value;
+	};
+	set("directory", positionals[0]);
+	set("appName", values.name);
+	set("workerName", values.worker);
+	set("stagingDomain", values["staging-domain"]?.toLowerCase());
+	set("productionDomain", values["production-domain"]?.toLowerCase());
+	set("git", values.git);
+	if (values.modules !== void 0) set("modules", values.modules.trim() === "none" ? [] : values.modules.split(",").map((m) => m.trim()).filter(Boolean));
+	const auth = {};
+	if (values["auth-methods"] !== void 0) auth.methods = parseList(values["auth-methods"]);
+	if (values.registration !== void 0) auth.registration = values.registration;
+	if (values["phone-allow"] !== void 0) auth.phoneAllow = parseList(values["phone-allow"]);
+	if (values["phone-block"] !== void 0) auth.phoneBlock = parseList(values["phone-block"]);
+	if (Object.keys(auth).length > 0) set("auth", auth);
+	if (values.binding !== void 0) {
+		const bindings = {};
+		for (const pair of values.binding) {
+			const at = pair.indexOf("=");
+			if (at < 1 || at === pair.length - 1) throw new AnswerError(`--binding takes NAME=NEW_NAME, got "${pair}".`);
+			bindings[pair.slice(0, at)] = pair.slice(at + 1);
+		}
+		set("bindings", bindings);
+	}
+	return {
+		given,
+		yes: values.yes,
+		help: values.help,
+		version: values.version,
+		...values["platform-version"] === void 0 ? {} : { platformVersion: values["platform-version"] },
+		...values["modules-dir"] === void 0 ? {} : { modulesDir: values["modules-dir"] }
+	};
+}
+function parse(argv) {
+	return parseArgs({
+		args: argv,
+		allowPositionals: true,
+		allowNegative: true,
+		strict: true,
+		options: {
+			name: { type: "string" },
+			worker: { type: "string" },
+			"staging-domain": { type: "string" },
+			"production-domain": { type: "string" },
+			binding: {
+				type: "string",
+				multiple: true
+			},
+			modules: { type: "string" },
+			"auth-methods": { type: "string" },
+			registration: { type: "string" },
+			"phone-allow": { type: "string" },
+			"phone-block": { type: "string" },
+			git: { type: "boolean" },
+			yes: {
+				type: "boolean",
+				short: "y",
+				default: false
+			},
+			"platform-version": { type: "string" },
+			"modules-dir": { type: "string" },
+			help: {
+				type: "boolean",
+				short: "h",
+				default: false
+			},
+			version: {
+				type: "boolean",
+				short: "v",
+				default: false
+			}
+		}
+	});
+}
+// src/generate.ts
+/** The template's own name, used for the app name, the Worker name and in resource names. */
+const PLACEHOLDER = "react-hono-app";
+function generate({ templateDir, modulesDir, answers, platformVersion }) {
+	const outDir = answers.directory;
+	const staged = stageTemplate(templateDir);
+	try {
+		applyModules({
+			templateDir: staged,
+			outDir,
+			modules: answers.modules,
+			...modulesDir === void 0 ? {} : { modulesDir },
+			standalone: true,
+			stripMarkers: true
+		});
+	} finally {
+		rmSync(staged, {
+			recursive: true,
+			force: true
+		});
+	}
+	if (answers.auth !== void 0) writeAuthChoices(outDir, answers.auth);
+	substitute(outDir, answers);
+	const pkgPath = join(outDir, "package.json");
+	const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+	pkg["name"] = answers.appName;
+	for (const field of ["dependencies", "devDependencies"]) {
+		const deps = pkg[field] ?? {};
+		for (const [name, range] of Object.entries(deps)) if (range.startsWith("workspace:")) deps[name] = platformVersion;
+	}
+	writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+	if (answers.git) execFileSync("git", [
+		"init",
+		"--quiet",
+		"--initial-branch=main"
+	], {
+		cwd: outDir,
+		stdio: "ignore"
+	});
+}
+/** Dotfiles that `pnpm pack` drops; the package stores them as `_gitignore`, `_npmrc`, `_npmignore`. */
+const STORED_DOTFILES = /* @__PURE__ */ new Set([
+	"_gitignore",
+	"_npmrc",
+	"_npmignore"
+]);
+/** Copies the shipped template to a temporary directory with its dotfiles' real names restored. */
+function stageTemplate(templateDir) {
+	const staged = mkdtempSync(join(tmpdir(), "inbis-template-"));
+	for (const file of listFiles(templateDir)) {
+		const name = basename(file);
+		const target = join(staged, dirname(file), STORED_DOTFILES.has(name) ? `.${name.slice(1)}` : name);
+		mkdirSync(dirname(target), { recursive: true });
+		cpSync(join(templateDir, file), target);
+	}
+	return staged;
+}
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* Replaces, in every text file and in one pass (so a replacement is never
+* replaced again): the template's staging and production domains, then its
+* name (the Worker name: wrangler `name`, D1 database names, README commands),
+* then each renamed binding as a whole word. The README's title becomes the app name.
+*/
+function substitute(outDir, answers) {
+	const replacements = /* @__PURE__ */ new Map([
+		[`staging.${PLACEHOLDER}.example.com`, answers.domains.staging],
+		[`${PLACEHOLDER}.example.com`, answers.domains.production],
+		[PLACEHOLDER, answers.workerName]
+	]);
+	const words = Object.entries(answers.bindings).filter(([from, to]) => from !== to);
+	const pattern = new RegExp([...[...replacements.keys()].map(escape), ...words.map(([from]) => `\\b${escape(from)}\\b`)].join("|"), "g");
+	const bindings = new Map(words);
+	for (const file of listFiles(outDir)) {
+		const path = join(outDir, file);
+		const buffer = readFileSync(path);
+		if (buffer.includes(0)) continue;
+		const before = buffer.toString("utf8");
+		let after = before.replace(pattern, (match) => replacements.get(match) ?? bindings.get(match) ?? match);
+		if (file === "README.md" && before.startsWith(`# react-hono-app\n`)) after = `# ${answers.appName}${after.slice(after.indexOf("\n"))}`;
+		if (after !== before) writeFileSync(path, after);
+	}
+}
+// src/paths.ts
+/** The package root: dist/cli.mjs lives one level below it, next to template/. */
+const packageRoot = join(import.meta.dirname, "..");
+/** The app template shipped in the package (copied there by `pnpm build`). */
+const templateDir = join(packageRoot, "template");
+/** This generator's version, which is also the platform's: every package is released in lockstep. */
+const ownVersion = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version;
+// src/prompts.ts
+var Cancelled = class extends Error {};
+function answered(value) {
+	if (p.isCancel(value) || typeof value === "symbol") throw new Cancelled("Cancelled: nothing was created.");
+	return value;
+}
+function clackAsk(io) {
+	return {
+		async text({ message, initialValue, validate }) {
+			return answered(await p.text({
+				...io,
+				message,
+				initialValue,
+				validate: (value) => validate(value ?? "")
+			}));
+		},
+		async multiselect({ message, options }) {
+			return answered(await p.multiselect({
+				...io,
+				message,
+				options,
+				required: false
+			}));
+		},
+		async select({ message, options, initialValue }) {
+			return answered(await p.select({
+				...io,
+				message,
+				options,
+				initialValue
+			}));
+		},
+		async confirm({ message, initialValue }) {
+			return answered(await p.confirm({
+				...io,
+				message,
+				initialValue
+			}));
+		},
+		info(message) {
+			p.log.info(message, io);
+		}
+	};
+}
+const intro = (title, io) => {
+	p.intro(title, io);
+};
+const outro = (message, io) => {
+	p.outro(message, io);
+};
+// src/main.ts
+const defaultIo = {
+	stdin: process.stdin,
+	stdout: process.stdout,
+	stderr: process.stderr,
+	env: process.env,
+	cwd: process.cwd()
+};
+/**
+* The CLI: parses flags, asks for what is missing (only in a terminal and
+* without --yes), writes the app. Returns the exit code.
+*/
+async function main(argv, io = defaultIo) {
+	const say = (text) => io.stdout.write(`${text}\n`);
+	try {
+		const flags = parseFlags(argv);
+		if (flags.help) {
+			say(USAGE);
+			return 0;
+		}
+		if (flags.version) {
+			say(ownVersion);
+			return 0;
+		}
+		const ci = io.env["CI"] !== void 0 && io.env["CI"] !== "" && io.env["CI"] !== "false";
+		const interactive = !flags.yes && io.stdin.isTTY === true && !ci;
+		const prompts = {
+			input: io.stdin,
+			output: io.stdout
+		};
+		const modulesDir = flags.modulesDir === void 0 ? void 0 : resolve(io.cwd, flags.modulesDir);
+		const offer = {
+			bindings: loadTemplate(templateDir).bindings ?? {},
+			modules: loadModules(modulesDir ?? join(templateDir, "modules"))
+		};
+		if (interactive) intro("create-inbis-app", prompts);
+		const answers = await resolveAnswers(flags.given, offer, interactive ? clackAsk(prompts) : void 0, io.cwd);
+		generate({
+			templateDir,
+			...modulesDir === void 0 ? {} : { modulesDir },
+			answers,
+			platformVersion: flags.platformVersion ?? ownVersion
+		});
+		const where = relative(io.cwd, answers.directory) || ".";
+		const what = answers.modules.length === 0 ? "the minimal app" : `the app with ${answers.modules.join(", ")}`;
+		const next = [
+			`cd ${where}`,
+			"pnpm install",
+			"pnpm dev"
+		].map((step) => `  ${step}`).join("\n");
+		const summary = `Created ${what} in ${where} (platform ${flags.platformVersion ?? ownVersion}).\nNext steps (see README.md):\n${next}`;
+		if (interactive) outro(summary, prompts);
+		else say(summary);
+		return 0;
+	} catch (error) {
+		if (error instanceof AnswerError || error instanceof Cancelled) {
+			io.stderr.write(`${error.message}\n`);
+			return 1;
+		}
+		throw error;
+	}
+}
+// src/cli.ts
+process.exitCode = await main(process.argv.slice(2));
+export {};
+
+//# sourceMappingURL=cli.mjs.map