@bytesbrains/cruise 0.0.0-stage → 0.12.1

package/dist/cruise.mjs

@@ -0,0 +1,693 @@
+#!/usr/bin/env node
+// Built by packages/cli/build.ts.
+import {
+  issueKey,
+  revokeKey
+} from "./chunk-2FB2T3UI.mjs";
+import {
+  provisionTenant
+} from "./chunk-GUZNI3NS.mjs";
+import "./chunk-N3YKWKOA.mjs";
+import "./chunk-2NVDAK5J.mjs";
+import "./chunk-FGLMW5IY.mjs";
+import "./chunk-4447IUTF.mjs";
+import "./chunk-XOH3XKM3.mjs";
+import "./chunk-42ERHAJD.mjs";
+import "./chunk-BNP63KB2.mjs";
+import "./chunk-ICJVJSTC.mjs";
+import "./chunk-UNXM6FSM.mjs";
+import "./chunk-SYTYOTO4.mjs";
+import "./chunk-O7TNRKSA.mjs";
+import "./chunk-T3ICD43U.mjs";
+import "./chunk-RT4R2W6H.mjs";
+import "./chunk-THEXUHQC.mjs";
+import "./chunk-LALZUKEC.mjs";
+import "./chunk-5TVD3ZAI.mjs";
+import {
+  HttpD1,
+  LocalD1
+} from "./chunk-JZPUTXM7.mjs";
+
+// selfhost/commands.ts
+var COMMANDS = {
+  "key:issue": { load: () => import("./keys-FWPQPMTW.mjs"), args: ["issue"] },
+  "key:revoke": { load: () => import("./keys-FWPQPMTW.mjs"), args: ["revoke"] },
+  "key:list": { load: () => import("./keys-FWPQPMTW.mjs"), args: ["list"] },
+  "budget:show": { load: () => import("./budget-FIRNSN67.mjs"), args: ["show"] },
+  "budget:set": { load: () => import("./budget-FIRNSN67.mjs"), args: ["set"] },
+  "budget:align": { load: () => import("./budget-FIRNSN67.mjs"), args: ["align"] },
+  "tenant:provision": { load: () => import("./tenant-4YDGI23Q.mjs"), args: ["provision"] },
+  "tenant:list": { load: () => import("./tenant-4YDGI23Q.mjs"), args: ["list"] },
+  "member:grant": { load: () => import("./member-ZBV4YG2M.mjs"), args: ["grant"] },
+  "member:revoke": { load: () => import("./member-ZBV4YG2M.mjs"), args: ["revoke"] },
+  "member:list": { load: () => import("./member-ZBV4YG2M.mjs"), args: ["list"] },
+  "service-key:issue": { load: () => import("./service-key-N2RZ7FMZ.mjs"), args: ["issue"] },
+  "fallback:show": { load: () => import("./fallback-P5KK55M4.mjs"), args: ["show"] },
+  "fallback:set": { load: () => import("./fallback-P5KK55M4.mjs"), args: ["set"] },
+  "tier:show": { load: () => import("./tier-4L3SPLFP.mjs"), args: ["show"] },
+  "tier:set": { load: () => import("./tier-4L3SPLFP.mjs"), args: ["set"] },
+  "compress:show": { load: () => import("./compress-3DWG35BY.mjs"), args: ["show"] },
+  "compress:set": { load: () => import("./compress-3DWG35BY.mjs"), args: ["set"] },
+  ledger: { load: () => import("./ledger-XBGWXY6C.mjs"), args: [] },
+  report: { load: () => import("./report-VRYJ3W5L.mjs"), args: [] },
+  conformance: { load: () => import("./conformance-NPFDYCQL.mjs"), args: [] },
+  sweep: { load: () => import("./sweep-SZX7OIDK.mjs"), args: [] },
+  smoke: { load: () => import("./smoke-ZNYX6RO5.mjs"), args: [] }
+};
+
+// selfhost/measure.ts
+import { spawn } from "node:child_process";
+
+// selfhost/measure-select.ts
+function credentialName(upstreamId) {
+  return `PROVIDER_KEY_${upstreamId.toUpperCase().replace(/-/g, "_")}`;
+}
+async function keyedModels(db, env) {
+  if (!Object.keys(env).some((name) => name.startsWith("PROVIDER_KEY_") && env[name])) return null;
+  const { results } = await db.prepare(
+    `SELECT m.id, m.upstream_id AS upstream, u.credential_required AS needsKey
+         FROM models m JOIN upstreams u ON u.id = m.upstream_id
+        WHERE m.enabled = 1 AND u.enabled = 1
+        ORDER BY m.id`
+  ).all();
+  return results.filter((m) => m.needsKey === 0 || Boolean(env[credentialName(m.upstream)])).map((m) => m.id);
+}
+
+// selfhost/measure.ts
+var ACTOR = "cruise-measure";
+function flag(argv, name) {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+async function operatorProject(db) {
+  const row = await db.prepare(
+    `SELECT p.id AS projectId, p.tenant_id AS tenantId
+         FROM projects p JOIN tenants t ON t.id = p.tenant_id
+        WHERE t.operator = 1
+        ORDER BY p.created_at, p.id LIMIT 1`
+  ).first();
+  if (!row) throw new Error("No operator tenant with a project. Has the server finished its first boot?");
+  return row;
+}
+async function projectById(db, projectId) {
+  const row = await db.prepare(`SELECT id AS projectId, tenant_id AS tenantId FROM projects WHERE id = ?`).bind(projectId).first();
+  if (!row) throw new Error(`No project ${projectId}`);
+  return row;
+}
+function localTarget() {
+  return {
+    db: new LocalD1(),
+    environment: "local",
+    base: `http://localhost:${process.env.CRUISE_PORT || 8787}`
+  };
+}
+async function measure(argv, target = localTarget()) {
+  const { db } = target;
+  const named = flag(argv, "project");
+  const { tenantId, projectId } = named ? await projectById(db, named) : await operatorProject(db);
+  const base = flag(argv, "base") ?? target.base;
+  const selection = [];
+  if (!argv.includes("--models")) {
+    const keyed = await keyedModels(db, process.env);
+    if (keyed !== null && keyed.length === 0) {
+      throw new Error("No enabled model has a provider key set. Add a PROVIDER_KEY_* to .env and restart.");
+    }
+    if (keyed !== null) {
+      console.log(`${keyed.length} model(s) from the providers you hold keys for`);
+      selection.push("--models", keyed.join(","));
+    }
+  }
+  const issued = await issueKey(db, {
+    tenantId,
+    projectId,
+    environment: "live",
+    actor: ACTOR,
+    name: "cruise measure (revoked after the run)",
+    conformance: true
+  });
+  console.log(`measuring through ${base} as ${projectId}, with a conformance key revoked afterwards`);
+  const passthrough = [...selection];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--project" || argv[i] === "--base") i++;
+    else passthrough.push(argv[i]);
+  }
+  const self = process.argv[1];
+  if (!self) throw new Error("cannot find the cruise CLI to run conformance with");
+  try {
+    const code = await new Promise((resolve, reject) => {
+      const child = spawn(
+        process.execPath,
+        [self, "conformance", "--env", target.environment, "--base", base, "--key", issued.key, ...passthrough],
+        { stdio: "inherit" }
+      );
+      child.on("error", reject);
+      child.on("exit", (exit) => resolve(exit ?? 1));
+    });
+    process.exitCode = code;
+  } finally {
+    await revokeKey(db, { tenantId, prefix: issued.prefix, actor: ACTOR, reason: "cruise measure finished" });
+  }
+}
+
+// packages/cli/src/cloudflare.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import path5 from "node:path";
+
+// selfhost/bootstrap.ts
+var DIRECT_BASE_URLS = {
+  openai: "https://api.openai.com/v1",
+  anthropic: "https://api.anthropic.com/v1",
+  "google-ai-studio": "https://generativelanguage.googleapis.com/v1beta/openai",
+  deepseek: "https://api.deepseek.com",
+  mistral: "https://api.mistral.ai/v1",
+  groq: "https://api.groq.com/openai/v1",
+  grok: "https://api.x.ai/v1",
+  openrouter: "https://openrouter.ai/api/v1"
+};
+var UNREACHABLE_UPSTREAMS = ["workers-ai"];
+var ACTOR2 = "selfhost-bootstrap";
+async function directUpstreams(db) {
+  const statements = [
+    ...Object.entries(DIRECT_BASE_URLS).map(
+      ([id, url]) => db.prepare(`UPDATE upstreams SET base_url = ? WHERE id = ? AND base_url IS NULL`).bind(url, id)
+    ),
+    ...UNREACHABLE_UPSTREAMS.map(
+      (id) => db.prepare(`UPDATE upstreams SET enabled = 0 WHERE id = ? AND enabled = 1`).bind(id)
+    )
+  ];
+  const results = await db.batch(statements);
+  return results.reduce((sum, r) => sum + (r.meta.changes ?? 0), 0);
+}
+async function firstTenant(db, request) {
+  const { tenantId, name, dailyCapMicros, operatorUid } = request;
+  const tenant = await db.prepare(
+    `SELECT t.operator, m.uid AS owner
+         FROM tenants t
+         LEFT JOIN memberships m ON m.tenant_id = t.id AND m.uid = ? AND m.role = 'owner'
+        WHERE t.id = ?`
+  ).bind(operatorUid, tenantId).first();
+  if (!tenant) {
+    const existing = await db.prepare(`SELECT COUNT(*) AS n FROM tenants`).first();
+    if ((existing?.n ?? 0) > 0) return null;
+    await provisionTenant(db, { id: tenantId, name, ownerUid: operatorUid, hardMicros: dailyCapMicros }, ACTOR2);
+  } else if (tenant.owner === null) {
+    return null;
+  }
+  if (!tenant || tenant.operator !== 1) {
+    await db.prepare(`UPDATE tenants SET operator = 1 WHERE id = ?`).bind(tenantId).run();
+  }
+  const project = await db.prepare(`SELECT id FROM projects WHERE tenant_id = ? ORDER BY created_at, id LIMIT 1`).bind(tenantId).first();
+  if (!project) throw new Error(`tenant ${tenantId} has no project to issue a key for`);
+  const issuedBefore = await db.prepare(`SELECT COUNT(*) AS n FROM virtual_keys WHERE project_id = ?`).bind(project.id).first();
+  if ((issuedBefore?.n ?? 0) > 0) return null;
+  const issued = await issueKey(db, {
+    projectId: project.id,
+    tenantId,
+    environment: "live",
+    actor: ACTOR2,
+    name: "first key"
+  });
+  return { tenantId, projectId: project.id, key: issued.key };
+}
+
+// selfhost/config.ts
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+var UNSET_PROJECT_ID = "unset_selfhosted";
+
+// packages/cli/src/paths.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import path2 from "node:path";
+function cruiseHome() {
+  return path2.resolve(process.env.CRUISE_HOME || path2.join(homedir(), ".cruise"));
+}
+function packageRoot() {
+  return path2.join(import.meta.dirname, "..");
+}
+function templatesDir() {
+  return path2.join(packageRoot(), "templates");
+}
+function workerPackageDir() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    return path2.dirname(require2.resolve("@bytesbrains/cruise-worker/package.json"));
+  } catch {
+    const sibling = path2.join(packageRoot(), "..", "worker");
+    if (existsSync2(path2.join(sibling, "package.json"))) return sibling;
+    throw new Error("@bytesbrains/cruise-worker is not installed; reinstall @bytesbrains/cruise.");
+  }
+}
+
+// packages/cli/src/wrangler-config.ts
+import path3 from "node:path";
+
+// selfhost/worker-config.ts
+var COMPATIBILITY_DATE = "2026-08-13";
+var COMPATIBILITY_FLAGS = ["nodejs_compat"];
+
+// packages/cli/src/wrangler-config.ts
+function wranglerConfig(d) {
+  const worker = path3.join(workerPackageDir(), "worker");
+  return {
+    name: d.name,
+    main: path3.join(worker, "index.js"),
+    base_dir: worker,
+    no_bundle: true,
+    find_additional_modules: true,
+    rules: [{ type: "Data", globs: ["**/*.png"], fallthrough: true }],
+    compatibility_date: COMPATIBILITY_DATE,
+    compatibility_flags: COMPATIBILITY_FLAGS,
+    account_id: d.accountId,
+    workers_dev: true,
+    observability: { enabled: true, redact_query_string: true },
+    d1_databases: [
+      {
+        binding: "DB",
+        database_name: d.databaseName,
+        database_id: d.databaseId,
+        migrations_dir: path3.join(workerPackageDir(), "migrations")
+      }
+    ],
+    kv_namespaces: [{ binding: "CACHE", id: d.kvId }],
+    r2_buckets: [{ binding: "BATCH_FILES", bucket_name: d.bucket }],
+    workflows: [{ name: `${d.name}-batch`, binding: "BATCH_WORKFLOW", class_name: "BatchWorkflow" }],
+    analytics_engine_datasets: [{ binding: "METRICS", dataset: `${d.name.replace(/-/g, "_")}_requests` }],
+    version_metadata: { binding: "CF_VERSION_METADATA" },
+    vars: {
+      ENVIRONMENT: "selfhosted",
+      CF_ACCOUNT_ID: d.accountId,
+      GATEWAY_SENSITIVE: "gw-sensitive",
+      GATEWAY_INTERNAL: "gw-internal",
+      DASHBOARD_ORIGIN: "http://localhost:5173",
+      CACHE_MODE: "lane",
+      COMPRESS_MODE: "on",
+      BATCH_MODE: "on"
+    }
+  };
+}
+
+// packages/cli/src/version.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import path4 from "node:path";
+var pkg = JSON.parse(readFileSync2(path4.join(packageRoot(), "package.json"), "utf8"));
+var VERSION = pkg.version;
+var WRANGLER_VERSION = pkg.cruise?.wrangler ?? "4";
+
+// packages/cli/src/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+function token() {
+  const value = process.env.CLOUDFLARE_API_TOKEN;
+  if (!value) {
+    throw new Error(
+      "Set CLOUDFLARE_API_TOKEN: a token with Workers Scripts, D1, Workers KV Storage and Workers R2 Storage edit, and Account Settings read (dash.cloudflare.com/profile/api-tokens)."
+    );
+  }
+  return value;
+}
+async function api(route, init2 = {}) {
+  const response = await fetch(`${API}${route}`, {
+    ...init2,
+    headers: { authorization: `Bearer ${token()}`, "content-type": "application/json", ...init2.headers }
+  });
+  const body = await response.json().catch(() => ({}));
+  return {
+    status: response.status,
+    result: response.ok ? body.result ?? null : null,
+    errors: (body.errors ?? []).map((e) => e.message).join("; ") || String(response.status)
+  };
+}
+async function must(route, init2 = {}) {
+  const { result, errors } = await api(route, init2);
+  if (result === null) throw new Error(`Cloudflare API ${init2.method ?? "GET"} ${route}: ${errors}`);
+  return result;
+}
+function deploymentDir(name) {
+  return path5.join(cruiseHome(), "cloudflare", name);
+}
+function loadDeployment(name) {
+  const file = path5.join(deploymentDir(name), "state.json");
+  if (!existsSync3(file)) throw new Error(`No deployment named ${name}: run \`cruise cloudflare deploy --name ${name}\` first.`);
+  return JSON.parse(readFileSync3(file, "utf8"));
+}
+function save(deployment) {
+  writeFileSync2(path5.join(deploymentDir(deployment.name), "state.json"), `${JSON.stringify(deployment, null, 2)}
+`);
+}
+async function account() {
+  if (process.env.CLOUDFLARE_ACCOUNT_ID) return process.env.CLOUDFLARE_ACCOUNT_ID;
+  const accounts = await must("/accounts?per_page=50");
+  if (accounts.length === 1) return accounts[0].id;
+  throw new Error(
+    `This token reaches ${accounts.length} accounts; set CLOUDFLARE_ACCOUNT_ID to one of: ` + accounts.map((a) => `${a.id} (${a.name})`).join(", ")
+  );
+}
+async function ensureDatabase(accountId, name) {
+  const found = await must(`/accounts/${accountId}/d1/database?name=${encodeURIComponent(name)}`);
+  const match = found.find((db) => db.name === name);
+  if (match) return match.uuid;
+  const created = await must(`/accounts/${accountId}/d1/database`, {
+    method: "POST",
+    body: JSON.stringify({ name })
+  });
+  return created.uuid;
+}
+async function ensureKv(accountId, title) {
+  const found = await must(`/accounts/${accountId}/storage/kv/namespaces?per_page=100`);
+  const match = found.find((ns) => ns.title === title);
+  if (match) return match.id;
+  const created = await must(`/accounts/${accountId}/storage/kv/namespaces`, {
+    method: "POST",
+    body: JSON.stringify({ title })
+  });
+  return created.id;
+}
+async function ensureBucket(accountId, name) {
+  const { status } = await api(`/accounts/${accountId}/r2/buckets/${name}`);
+  if (status === 200) return;
+  await must(`/accounts/${accountId}/r2/buckets`, { method: "POST", body: JSON.stringify({ name }) });
+}
+function wrangler(args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn2("npx", ["--yes", `wrangler@${WRANGLER_VERSION}`, ...args, "-c", path5.join(cwd, "wrangler.jsonc")], {
+      cwd,
+      stdio: "inherit",
+      // CI=true answers wrangler's confirmation prompts, which a migration apply asks.
+      env: { ...process.env, CI: "true", WRANGLER_SEND_METRICS: "false" }
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`wrangler ${args[0]} exited ${code}`)));
+  });
+}
+function readEnvFile(file) {
+  if (!file) return {};
+  const out = {};
+  for (const line of readFileSync3(file, "utf8").split("\n")) {
+    const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+    if (m && m[2]) out[m[1]] = m[2].replace(/^["']|["']$/g, "");
+  }
+  return out;
+}
+function secrets(dir, envFile) {
+  const file = path5.join(dir, "secrets.json");
+  const kept = existsSync3(file) ? JSON.parse(readFileSync3(file, "utf8")) : {};
+  const generated = {
+    ACCOUNT_ID_SALT: kept.ACCOUNT_ID_SALT ?? randomBytes2(32).toString("hex"),
+    WEBHOOK_SIGNING_KEY: kept.WEBHOOK_SIGNING_KEY ?? randomBytes2(32).toString("hex")
+  };
+  const operatorUid = kept.OPERATOR_UID ?? `selfhosted-${randomBytes2(16).toString("hex")}`;
+  writeFileSync2(file, `${JSON.stringify({ ...generated, OPERATOR_UID: operatorUid }, null, 2)}
+`, { mode: 384 });
+  chmodSync(file, 384);
+  const providers = Object.fromEntries(
+    Object.entries({ ...envFile, ...process.env }).filter(
+      (entry) => /^PROVIDER_(BILLING_)?KEY_/.test(entry[0]) && Boolean(entry[1])
+    )
+  );
+  return {
+    ...generated,
+    AI_GATEWAY_TOKEN: "unused-selfhosted",
+    FIREBASE_PROJECT_ID: process.env.FIREBASE_PROJECT_ID || envFile.FIREBASE_PROJECT_ID || UNSET_PROJECT_ID,
+    ...providers
+  };
+}
+function flag2(argv, name) {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+async function deploy(argv) {
+  const name = flag2(argv, "name") ?? "cruise";
+  if (!/^[a-z0-9][a-z0-9-]{0,40}$/.test(name)) throw new Error(`--name must be lowercase letters, digits and dashes: ${name}`);
+  const dir = deploymentDir(name);
+  mkdirSync2(dir, { recursive: true });
+  console.log(`\u203A account`);
+  const accountId = await account();
+  console.log(`\u203A database, cache and bucket for ${name}`);
+  const d = {
+    name,
+    accountId,
+    databaseName: name,
+    databaseId: await ensureDatabase(accountId, name),
+    kvId: await ensureKv(accountId, `${name}-cache`),
+    bucket: `${name}-batch-files`
+  };
+  await ensureBucket(accountId, d.bucket);
+  save(d);
+  writeFileSync2(path5.join(dir, "wrangler.jsonc"), `${JSON.stringify(wranglerConfig(d), null, 2)}
+`);
+  console.log(`\u203A migrations, before the Worker that reads them`);
+  await wrangler(["d1", "migrations", "apply", d.databaseName, "--remote"], dir);
+  console.log(`\u203A Worker`);
+  await wrangler(["deploy"], dir);
+  console.log(`\u203A secrets`);
+  const bulk = path5.join(dir, "secrets.upload.json");
+  writeFileSync2(bulk, JSON.stringify(secrets(dir, readEnvFile(flag2(argv, "env-file")))), { mode: 384 });
+  try {
+    await wrangler(["secret", "bulk", bulk], dir);
+  } finally {
+    rmSync(bulk, { force: true });
+  }
+  console.log(`\u203A bootstrap`);
+  const db = new HttpD1(accountId, d.databaseId, token());
+  await directUpstreams(db);
+  const { OPERATOR_UID: operatorUid } = JSON.parse(readFileSync3(path5.join(dir, "secrets.json"), "utf8"));
+  const first = await firstTenant(db, {
+    tenantId: flag2(argv, "tenant") ?? "local",
+    name: "Local",
+    dailyCapMicros: 5e6,
+    operatorUid
+  });
+  const sub = await api(`/accounts/${accountId}/workers/subdomain`);
+  if (sub.result?.subdomain) d.url = `https://${name}.${sub.result.subdomain}.workers.dev`;
+  save(d);
+  console.log(`
+Deployed ${name}${d.url ? ` at ${d.url}` : " (enable a workers.dev subdomain in the dashboard to reach it)"}.`);
+  if (first) {
+    console.log(`
+  key  ${first.key}
+
+This is the only time this key is shown. base_url: ${d.url ?? "<your url>"}/v1`);
+  }
+  console.log(`
+Next: cruise cloudflare measure --name ${name}`);
+}
+
+// packages/cli/src/docker.ts
+import { spawn as spawn3, spawnSync } from "node:child_process";
+import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import path6 from "node:path";
+import { createInterface } from "node:readline";
+function dockerDir() {
+  return path6.join(cruiseHome(), "docker");
+}
+function composeArgs() {
+  const dir = dockerDir();
+  return ["compose", "--project-directory", dir, "-f", path6.join(dir, "docker-compose.yml")];
+}
+function requireDocker() {
+  const probe = spawnSync("docker", ["compose", "version"], { stdio: "ignore" });
+  if (probe.status !== 0) {
+    throw new Error("Docker with the compose plugin is required: https://docs.docker.com/get-docker/");
+  }
+}
+function compose(args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn3("docker", [...composeArgs(), ...args], {
+      stdio: options.capture ? ["ignore", "pipe", "inherit"] : "inherit"
+    });
+    let out = "";
+    child.stdout?.on("data", (chunk) => out += chunk.toString());
+    child.on("error", reject);
+    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
+  });
+}
+async function must2(args) {
+  const { code } = await compose(args);
+  if (code !== 0) throw new Error(`docker ${["compose", ...args].join(" ")} exited ${code}`);
+}
+function askHidden(question) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    const write = rl._writeToOutput;
+    rl._writeToOutput = (s) => {
+      if (s.startsWith(question)) write.call(rl, s);
+    };
+    rl.question(question, (answer) => {
+      rl.close();
+      process.stdout.write("\n");
+      resolve(answer.trim());
+    });
+  });
+}
+var PROVIDERS = [
+  ["PROVIDER_KEY_OPENAI", "OpenAI"],
+  ["PROVIDER_KEY_ANTHROPIC", "Anthropic"],
+  ["PROVIDER_KEY_GOOGLE_AI_STUDIO", "Google AI Studio"],
+  ["PROVIDER_KEY_DEEPSEEK", "DeepSeek"],
+  ["PROVIDER_KEY_MISTRAL", "Mistral"],
+  ["PROVIDER_KEY_GROQ", "Groq"],
+  ["PROVIDER_KEY_GROK", "xAI"]
+];
+async function init(argv) {
+  const dir = dockerDir();
+  mkdirSync3(dir, { recursive: true });
+  const compose2 = readFileSync4(path6.join(templatesDir(), "docker-compose.yml"), "utf8");
+  writeFileSync3(path6.join(dir, "docker-compose.yml"), compose2);
+  const envFile = path6.join(dir, ".env");
+  if (existsSync4(envFile)) {
+    console.log(`${envFile} exists; keeping it.`);
+    return;
+  }
+  let env = readFileSync4(path6.join(templatesDir(), "env.example"), "utf8");
+  if (process.stdin.isTTY && !argv.includes("--yes")) {
+    console.log("Provider keys (input hidden; press enter to skip any). Add more later in", envFile);
+    for (const [name, label] of PROVIDERS) {
+      const value = await askHidden(`  ${label}: `);
+      if (value) env = env.replace(new RegExp(`^${name}=.*$`, "m"), `${name}=${value}`);
+    }
+  }
+  writeFileSync3(envFile, env, { mode: 384 });
+  chmodSync2(envFile, 384);
+  console.log(`Wrote ${dir}. Next: cruise up`);
+}
+async function waitHealthy() {
+  const { out } = await compose(["ps", "-q", "cruise"], { capture: true });
+  const id = out.trim();
+  if (!id) return false;
+  for (let i = 0; i < 60; i++) {
+    const probe = spawnSync("docker", ["inspect", "-f", "{{.State.Health.Status}}", id], { encoding: "utf8" });
+    if (probe.stdout.trim() === "healthy") return true;
+    await new Promise((r) => setTimeout(r, 2e3));
+  }
+  return false;
+}
+function firstBootBanner(logs) {
+  const lines = logs.split("\n");
+  const at = lines.findIndex((line) => line.includes("Cruise is set up."));
+  if (at < 0) return null;
+  const isRule = (line) => line?.trim().startsWith("\u2500\u2500\u2500\u2500") ?? false;
+  let from = at;
+  while (from > 0 && !isRule(lines[from])) from--;
+  let to = at;
+  while (to < lines.length - 1 && !isRule(lines[to])) to++;
+  return lines.slice(from, to + 1).join("\n");
+}
+async function up(argv) {
+  requireDocker();
+  if (!existsSync4(path6.join(dockerDir(), "docker-compose.yml"))) await init(argv);
+  await must2(["up", "-d"]);
+  process.stdout.write("waiting for Cruise to become healthy\u2026 ");
+  if (!await waitHealthy()) {
+    console.log("not yet.\nIt may still be starting; see `cruise logs`.");
+    process.exitCode = 1;
+    return;
+  }
+  console.log("healthy.");
+  const { out } = await compose(["logs", "--no-log-prefix", "cruise"], { capture: true });
+  const banner = firstBootBanner(out);
+  if (banner) {
+    console.log(banner);
+  } else {
+    console.log("Already set up. Your first key was printed on the first `cruise up`; issue more with `cruise key:issue`.");
+  }
+  console.log("Next: `cruise measure` once you have provider keys in .env (docs: docs/self-hosting.md).");
+}
+async function lifecycle(name, argv) {
+  requireDocker();
+  switch (name) {
+    case "status":
+      return must2(["ps"]);
+    case "logs":
+      return must2(["logs", ...argv.includes("-f") ? ["-f"] : [], "cruise"]);
+    case "down":
+      return must2(["down"]);
+    case "backup":
+      return must2(["exec", "cruise", "cruise-server", "backup"]);
+    case "upgrade":
+      await must2(["exec", "cruise", "cruise-server", "backup"]);
+      await must2(["pull"]);
+      await must2(["up", "-d"]);
+      console.log("Upgraded. The new image migrated the database before serving; a backup was taken first.");
+      return;
+  }
+}
+async function inContainer(argv) {
+  requireDocker();
+  const { code } = await compose(["exec", ...process.stdin.isTTY ? [] : ["-T"], "cruise", "cruise", ...argv]);
+  process.exitCode = code;
+}
+
+// packages/cli/src/main.ts
+var HELP = `cruise ${VERSION} \u2014 one OpenAI-compatible endpoint in front of every model provider
+
+Docker, on this machine:
+  cruise init                 write ~/.cruise/docker (compose file, .env) and ask for provider keys
+  cruise up                   start, wait until healthy, print the first key on first boot
+  cruise status | logs [-f] | down | backup | upgrade
+  cruise measure              measure every model you hold a key for (run weekly)
+  cruise <admin command>      key:issue, budget:set, ledger, report, tenant:provision, \u2026
+
+Your own Cloudflare account (needs CLOUDFLARE_API_TOKEN):
+  cruise cloudflare deploy [--name cruise] [--env-file .env]
+  cruise cloudflare measure [--name cruise]
+  cruise cloudflare <admin command> [--name cruise]
+
+Admin commands: ${Object.keys(COMMANDS).join(", ")}
+Manual: https://gitlab.com/bytesbrains-oss/cruise/-/blob/main/docs/self-hosting.md`;
+function takeFlag(argv, name) {
+  const i = argv.indexOf(`--${name}`);
+  if (i < 0) return { value: void 0, rest: argv };
+  return { value: argv[i + 1], rest: [...argv.slice(0, i), ...argv.slice(i + 2)] };
+}
+async function runScript(name, rest) {
+  const command = COMMANDS[name];
+  if (!command) throw new Error(`unknown command: ${name}
+
+${HELP}`);
+  process.argv = [process.argv[0] ?? "node", name, ...command.args, ...rest];
+  await command.load();
+}
+async function cloudflare(argv) {
+  const [sub, ...rest] = argv;
+  if (sub === "deploy") return deploy(rest);
+  if (!sub) throw new Error(HELP);
+  const { value: name, rest: args } = takeFlag(rest, "name");
+  const d = loadDeployment(name ?? "cruise");
+  process.env.CRUISE_D1_ACCOUNT_ID = d.accountId;
+  process.env.CRUISE_D1_DATABASE_ID = d.databaseId;
+  if (!process.env.CLOUDFLARE_API_TOKEN) throw new Error("Set CLOUDFLARE_API_TOKEN to administer a Cloudflare deployment.");
+  if (sub === "measure") {
+    if (!d.url) throw new Error("This deployment has no URL on record; pass --base https://\u2026");
+    const db = new HttpD1(d.accountId, d.databaseId, process.env.CLOUDFLARE_API_TOKEN);
+    return measure(args, { db, environment: "cloudflare", base: d.url });
+  }
+  return runScript(sub, ["--env", "cloudflare", ...args]);
+}
+async function main(argv) {
+  const [name, ...rest] = argv;
+  if (!name || name === "help" || name === "--help" || name === "-h") {
+    console.log(HELP);
+    return;
+  }
+  if (name === "--version" || name === "version") {
+    console.log(VERSION);
+    return;
+  }
+  if (rest.includes("--env") && rest[rest.indexOf("--env") + 1] === "cloudflare") return runScript(name, rest);
+  if (name === "cloudflare") return cloudflare(rest);
+  if (name === "init") return init(rest);
+  if (name === "up") return up(rest);
+  if (["status", "logs", "down", "backup", "upgrade"].includes(name)) return lifecycle(name, rest);
+  if (name === "measure" || name in COMMANDS) return inContainer(argv);
+  throw new Error(`unknown command: ${name}
+
+${HELP}`);
+}
+main(process.argv.slice(2)).catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exitCode = 1;
+});