@coffre/cli 0.1.4 → 0.1.6

package/dist/setup-D3SXt_P-.js

@@ -0,0 +1,3341 @@
+import { d as esm_default } from "./esm-Bts-esAl.js";
+import { C as yes, E as isEmpty, S as wrap, T as init, _ as select, b as truncate, c as Cancelled, d as listed, f as openTerminal, g as row, h as release, i as keyValues, l as edit, m as readKeys, n as jsonWarning, o as needsTerminal, p as paragraph, r as keyGuide, s as showSecrets, t as generateKeys, u as hiddenLine, v as style, w as KINDS, x as width, y as textLine } from "./keys-BCKUEb-Y.js";
+import { r as postgresConnection, t as engineOfUrl } from "./connect-BONR52al.js";
+import { parseArgs } from "node:util";
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash, createHmac, pbkdf2Sync, randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { createServer, get } from "node:http";
+//#region ../db/dist/migrate.js
+/**
+* Bring a database up to date with its engine's migration tree:
+* migrations/postgres or migrations/sqlite. Both trees
+* describe one schema; see schema-parity.test.ts.
+*
+* Applied history must be a prefix of the local journal, byte for byte,
+* before and after. Only one migrator runs at a time: Postgres takes an
+* advisory lock, and SQLite's own write lock covers the
+* whole run. Restricted runtime roles are Postgres-only (baseline/postgres.sql).
+*/
+const MIGRATION_LOCK_KEY = "7165058122361679213";
+/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
+async function restrictDatabase(client) {
+	await client.query(`DO $$ BEGIN
+    EXECUTE format(
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
+      current_database()
+    );
+  END $$`);
+}
+/**
+* Beside this module: src/migrations in the workspace, and dist/migrations
+* in the built package, where the build copies them.
+*/
+function migrationsFolder(engine) {
+	return fileURLToPath(new URL(`./migrations/${engine}`, import.meta.url));
+}
+async function expectedMigrations(engine) {
+	const folder = migrationsFolder(engine);
+	const journal = JSON.parse(await readFile(`${folder}/meta/_journal.json`, "utf8"));
+	if (!Array.isArray(journal.entries)) throw new Error("invalid Drizzle migration journal");
+	const expected = await Promise.all(journal.entries.map(async (entry, position) => {
+		if (entry.idx !== position || !Number.isSafeInteger(entry.when) || typeof entry.tag !== "string" || !/^[a-zA-Z0-9_-]+$/.test(entry.tag)) throw new Error(`invalid Drizzle migration journal entry at index ${position}`);
+		const sqlText = await readFile(`${folder}/${entry.tag}.sql`, "utf8");
+		return {
+			createdAt: String(entry.when),
+			hash: createHash("sha256").update(sqlText).digest("hex"),
+			tag: entry.tag
+		};
+	}));
+	for (let index = 1; index < expected.length; index += 1) if (BigInt(expected[index - 1].createdAt) >= BigInt(expected[index].createdAt)) throw new Error("Drizzle migration journal timestamps must be strictly increasing");
+	return expected;
+}
+function verifyHistory(expected, applied, requireComplete) {
+	const rows = applied ?? [];
+	if (rows.length > expected.length) throw new Error("database contains migrations that are absent from this image");
+	if (requireComplete && rows.length !== expected.length) throw new Error(`migration history is incomplete: expected ${expected.length}, found ${rows.length}`);
+	rows.forEach((row, index) => {
+		const local = expected[index];
+		if (row.created_at !== local.createdAt || row.hash !== local.hash) throw new Error(`migration history diverged at ${local.tag}; applied migrations must never be edited`);
+	});
+}
+async function postgresMigrator(url) {
+	const [{ default: pg }, { drizzle }, { migrate }] = await Promise.all([
+		import("./esm-B69mMLcR.js"),
+		import("./node-postgres-BlNvYfq_.js"),
+		import("./migrator-W1a-ooWi.js")
+	]);
+	const pool = new pg.Pool({
+		...postgresConnection(url),
+		application_name: "coffre-migrations",
+		max: 1
+	});
+	const client = await pool.connect();
+	return {
+		async applied() {
+			if (!(await client.query("SELECT to_regclass('drizzle.__drizzle_migrations')::text AS relation")).rows[0]?.relation) return null;
+			return (await client.query("SELECT hash, created_at::text FROM drizzle.__drizzle_migrations ORDER BY created_at, id")).rows;
+		},
+		async lock() {
+			await client.query("SET lock_timeout = '5min'");
+			await client.query("SELECT pg_advisory_lock($1::bigint)", [MIGRATION_LOCK_KEY]);
+		},
+		async unlock() {
+			await client.query("SELECT pg_advisory_unlock($1::bigint)", [MIGRATION_LOCK_KEY]);
+		},
+		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
+		restrict: () => restrictDatabase(client),
+		async close() {
+			client.release();
+			await pool.end();
+		}
+	};
+}
+async function sqliteMigrator(url) {
+	const [{ openDatabase }, { migrate }] = await Promise.all([import("./connect-BZdPYNbZ.js"), import("drizzle-orm/libsql/migrator")]);
+	const { db, close } = await openDatabase(url);
+	const sqlite = db;
+	return {
+		async applied() {
+			if ((await sqlite.all("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'")).length === 0) return null;
+			return sqlite.all("SELECT hash, CAST(created_at AS TEXT) AS created_at FROM __drizzle_migrations ORDER BY created_at, id");
+		},
+		async lock() {},
+		async unlock() {},
+		migrate: (migrationsFolder) => migrate(sqlite, { migrationsFolder }),
+		async restrict() {},
+		close
+	};
+}
+/**
+* Apply missing migrations, check their history and reassert database
+* privileges. `onPlan` hears how many there are to apply before they are:
+* all of them go in one call, with no word of each.
+*/
+async function migrateDatabase(url, onPlan) {
+	const engine = engineOfUrl(url);
+	const expected = await expectedMigrations(engine);
+	const migrator = await {
+		postgres: postgresMigrator,
+		sqlite: sqliteMigrator
+	}[engine](url);
+	let locked = false;
+	try {
+		await migrator.lock();
+		locked = true;
+		const applied = await migrator.applied();
+		verifyHistory(expected, applied, false);
+		onPlan?.({
+			applied: applied?.length ?? 0,
+			total: expected.length
+		});
+		await migrator.migrate(migrationsFolder(engine));
+		verifyHistory(expected, await migrator.applied(), true);
+		await migrator.restrict();
+	} finally {
+		try {
+			if (locked) await migrator.unlock();
+		} finally {
+			await migrator.close();
+		}
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
+/**
+* Creates a JSON scanner on the given text.
+* If ignoreTrivia is set, whitespaces or comments are ignored.
+*/
+function createScanner(text, ignoreTrivia = false) {
+	const len = text.length;
+	let pos = 0, value = "", tokenOffset = 0, token = 16, lineNumber = 0, lineStartOffset = 0, tokenLineStartOffset = 0, prevTokenLineStartOffset = 0, scanError = 0;
+	function scanHexDigits(count, exact) {
+		let digits = 0;
+		let value = 0;
+		while (digits < count || !exact) {
+			let ch = text.charCodeAt(pos);
+			if (ch >= 48 && ch <= 57) value = value * 16 + ch - 48;
+			else if (ch >= 65 && ch <= 70) value = value * 16 + ch - 65 + 10;
+			else if (ch >= 97 && ch <= 102) value = value * 16 + ch - 97 + 10;
+			else break;
+			pos++;
+			digits++;
+		}
+		if (digits < count) value = -1;
+		return value;
+	}
+	function setPosition(newPosition) {
+		pos = newPosition;
+		value = "";
+		tokenOffset = 0;
+		token = 16;
+		scanError = 0;
+	}
+	function scanNumber() {
+		let start = pos;
+		if (text.charCodeAt(pos) === 48) pos++;
+		else {
+			pos++;
+			while (pos < text.length && isDigit(text.charCodeAt(pos))) pos++;
+		}
+		if (pos < text.length && text.charCodeAt(pos) === 46) {
+			pos++;
+			if (pos < text.length && isDigit(text.charCodeAt(pos))) {
+				pos++;
+				while (pos < text.length && isDigit(text.charCodeAt(pos))) pos++;
+			} else {
+				scanError = 3;
+				return text.substring(start, pos);
+			}
+		}
+		let end = pos;
+		if (pos < text.length && (text.charCodeAt(pos) === 69 || text.charCodeAt(pos) === 101)) {
+			pos++;
+			if (pos < text.length && text.charCodeAt(pos) === 43 || text.charCodeAt(pos) === 45) pos++;
+			if (pos < text.length && isDigit(text.charCodeAt(pos))) {
+				pos++;
+				while (pos < text.length && isDigit(text.charCodeAt(pos))) pos++;
+				end = pos;
+			} else scanError = 3;
+		}
+		return text.substring(start, end);
+	}
+	function scanString() {
+		let result = "", start = pos;
+		while (true) {
+			if (pos >= len) {
+				result += text.substring(start, pos);
+				scanError = 2;
+				break;
+			}
+			const ch = text.charCodeAt(pos);
+			if (ch === 34) {
+				result += text.substring(start, pos);
+				pos++;
+				break;
+			}
+			if (ch === 92) {
+				result += text.substring(start, pos);
+				pos++;
+				if (pos >= len) {
+					scanError = 2;
+					break;
+				}
+				switch (text.charCodeAt(pos++)) {
+					case 34:
+						result += "\"";
+						break;
+					case 92:
+						result += "\\";
+						break;
+					case 47:
+						result += "/";
+						break;
+					case 98:
+						result += "\b";
+						break;
+					case 102:
+						result += "\f";
+						break;
+					case 110:
+						result += "\n";
+						break;
+					case 114:
+						result += "\r";
+						break;
+					case 116:
+						result += "	";
+						break;
+					case 117:
+						const ch3 = scanHexDigits(4, true);
+						if (ch3 >= 0) result += String.fromCharCode(ch3);
+						else scanError = 4;
+						break;
+					default: scanError = 5;
+				}
+				start = pos;
+				continue;
+			}
+			if (ch >= 0 && ch <= 31) {
+				if (isLineBreak(ch)) {
+					result += text.substring(start, pos);
+					scanError = 2;
+					break;
+				} else scanError = 6;
+			}
+			pos++;
+		}
+		return result;
+	}
+	function scanNext() {
+		value = "";
+		scanError = 0;
+		tokenOffset = pos;
+		lineStartOffset = lineNumber;
+		prevTokenLineStartOffset = tokenLineStartOffset;
+		if (pos >= len) {
+			tokenOffset = len;
+			return token = 17;
+		}
+		let code = text.charCodeAt(pos);
+		if (isWhiteSpace(code)) {
+			do {
+				pos++;
+				value += String.fromCharCode(code);
+				code = text.charCodeAt(pos);
+			} while (isWhiteSpace(code));
+			return token = 15;
+		}
+		if (isLineBreak(code)) {
+			pos++;
+			value += String.fromCharCode(code);
+			if (code === 13 && text.charCodeAt(pos) === 10) {
+				pos++;
+				value += "\n";
+			}
+			lineNumber++;
+			tokenLineStartOffset = pos;
+			return token = 14;
+		}
+		switch (code) {
+			case 123:
+				pos++;
+				return token = 1;
+			case 125:
+				pos++;
+				return token = 2;
+			case 91:
+				pos++;
+				return token = 3;
+			case 93:
+				pos++;
+				return token = 4;
+			case 58:
+				pos++;
+				return token = 6;
+			case 44:
+				pos++;
+				return token = 5;
+			case 34:
+				pos++;
+				value = scanString();
+				return token = 10;
+			case 47:
+				const start = pos - 1;
+				if (text.charCodeAt(pos + 1) === 47) {
+					pos += 2;
+					while (pos < len) {
+						if (isLineBreak(text.charCodeAt(pos))) break;
+						pos++;
+					}
+					value = text.substring(start, pos);
+					return token = 12;
+				}
+				if (text.charCodeAt(pos + 1) === 42) {
+					pos += 2;
+					const safeLength = len - 1;
+					let commentClosed = false;
+					while (pos < safeLength) {
+						const ch = text.charCodeAt(pos);
+						if (ch === 42 && text.charCodeAt(pos + 1) === 47) {
+							pos += 2;
+							commentClosed = true;
+							break;
+						}
+						pos++;
+						if (isLineBreak(ch)) {
+							if (ch === 13 && text.charCodeAt(pos) === 10) pos++;
+							lineNumber++;
+							tokenLineStartOffset = pos;
+						}
+					}
+					if (!commentClosed) {
+						pos++;
+						scanError = 1;
+					}
+					value = text.substring(start, pos);
+					return token = 13;
+				}
+				value += String.fromCharCode(code);
+				pos++;
+				return token = 16;
+			case 45:
+				value += String.fromCharCode(code);
+				pos++;
+				if (pos === len || !isDigit(text.charCodeAt(pos))) return token = 16;
+			case 48:
+			case 49:
+			case 50:
+			case 51:
+			case 52:
+			case 53:
+			case 54:
+			case 55:
+			case 56:
+			case 57:
+				value += scanNumber();
+				return token = 11;
+			default:
+				while (pos < len && isUnknownContentCharacter(code)) {
+					pos++;
+					code = text.charCodeAt(pos);
+				}
+				if (tokenOffset !== pos) {
+					value = text.substring(tokenOffset, pos);
+					switch (value) {
+						case "true": return token = 8;
+						case "false": return token = 9;
+						case "null": return token = 7;
+					}
+					return token = 16;
+				}
+				value += String.fromCharCode(code);
+				pos++;
+				return token = 16;
+		}
+	}
+	function isUnknownContentCharacter(code) {
+		if (isWhiteSpace(code) || isLineBreak(code)) return false;
+		switch (code) {
+			case 125:
+			case 93:
+			case 123:
+			case 91:
+			case 34:
+			case 58:
+			case 44:
+			case 47: return false;
+		}
+		return true;
+	}
+	function scanNextNonTrivia() {
+		let result;
+		do
+			result = scanNext();
+		while (result >= 12 && result <= 15);
+		return result;
+	}
+	return {
+		setPosition,
+		getPosition: () => pos,
+		scan: ignoreTrivia ? scanNextNonTrivia : scanNext,
+		getToken: () => token,
+		getTokenValue: () => value,
+		getTokenOffset: () => tokenOffset,
+		getTokenLength: () => pos - tokenOffset,
+		getTokenStartLine: () => lineStartOffset,
+		getTokenStartCharacter: () => tokenOffset - prevTokenLineStartOffset,
+		getTokenError: () => scanError
+	};
+}
+function isWhiteSpace(ch) {
+	return ch === 32 || ch === 9;
+}
+function isLineBreak(ch) {
+	return ch === 10 || ch === 13;
+}
+function isDigit(ch) {
+	return ch >= 48 && ch <= 57;
+}
+var CharacterCodes;
+(function(CharacterCodes) {
+	CharacterCodes[CharacterCodes["lineFeed"] = 10] = "lineFeed";
+	CharacterCodes[CharacterCodes["carriageReturn"] = 13] = "carriageReturn";
+	CharacterCodes[CharacterCodes["space"] = 32] = "space";
+	CharacterCodes[CharacterCodes["_0"] = 48] = "_0";
+	CharacterCodes[CharacterCodes["_1"] = 49] = "_1";
+	CharacterCodes[CharacterCodes["_2"] = 50] = "_2";
+	CharacterCodes[CharacterCodes["_3"] = 51] = "_3";
+	CharacterCodes[CharacterCodes["_4"] = 52] = "_4";
+	CharacterCodes[CharacterCodes["_5"] = 53] = "_5";
+	CharacterCodes[CharacterCodes["_6"] = 54] = "_6";
+	CharacterCodes[CharacterCodes["_7"] = 55] = "_7";
+	CharacterCodes[CharacterCodes["_8"] = 56] = "_8";
+	CharacterCodes[CharacterCodes["_9"] = 57] = "_9";
+	CharacterCodes[CharacterCodes["a"] = 97] = "a";
+	CharacterCodes[CharacterCodes["b"] = 98] = "b";
+	CharacterCodes[CharacterCodes["c"] = 99] = "c";
+	CharacterCodes[CharacterCodes["d"] = 100] = "d";
+	CharacterCodes[CharacterCodes["e"] = 101] = "e";
+	CharacterCodes[CharacterCodes["f"] = 102] = "f";
+	CharacterCodes[CharacterCodes["g"] = 103] = "g";
+	CharacterCodes[CharacterCodes["h"] = 104] = "h";
+	CharacterCodes[CharacterCodes["i"] = 105] = "i";
+	CharacterCodes[CharacterCodes["j"] = 106] = "j";
+	CharacterCodes[CharacterCodes["k"] = 107] = "k";
+	CharacterCodes[CharacterCodes["l"] = 108] = "l";
+	CharacterCodes[CharacterCodes["m"] = 109] = "m";
+	CharacterCodes[CharacterCodes["n"] = 110] = "n";
+	CharacterCodes[CharacterCodes["o"] = 111] = "o";
+	CharacterCodes[CharacterCodes["p"] = 112] = "p";
+	CharacterCodes[CharacterCodes["q"] = 113] = "q";
+	CharacterCodes[CharacterCodes["r"] = 114] = "r";
+	CharacterCodes[CharacterCodes["s"] = 115] = "s";
+	CharacterCodes[CharacterCodes["t"] = 116] = "t";
+	CharacterCodes[CharacterCodes["u"] = 117] = "u";
+	CharacterCodes[CharacterCodes["v"] = 118] = "v";
+	CharacterCodes[CharacterCodes["w"] = 119] = "w";
+	CharacterCodes[CharacterCodes["x"] = 120] = "x";
+	CharacterCodes[CharacterCodes["y"] = 121] = "y";
+	CharacterCodes[CharacterCodes["z"] = 122] = "z";
+	CharacterCodes[CharacterCodes["A"] = 65] = "A";
+	CharacterCodes[CharacterCodes["B"] = 66] = "B";
+	CharacterCodes[CharacterCodes["C"] = 67] = "C";
+	CharacterCodes[CharacterCodes["D"] = 68] = "D";
+	CharacterCodes[CharacterCodes["E"] = 69] = "E";
+	CharacterCodes[CharacterCodes["F"] = 70] = "F";
+	CharacterCodes[CharacterCodes["G"] = 71] = "G";
+	CharacterCodes[CharacterCodes["H"] = 72] = "H";
+	CharacterCodes[CharacterCodes["I"] = 73] = "I";
+	CharacterCodes[CharacterCodes["J"] = 74] = "J";
+	CharacterCodes[CharacterCodes["K"] = 75] = "K";
+	CharacterCodes[CharacterCodes["L"] = 76] = "L";
+	CharacterCodes[CharacterCodes["M"] = 77] = "M";
+	CharacterCodes[CharacterCodes["N"] = 78] = "N";
+	CharacterCodes[CharacterCodes["O"] = 79] = "O";
+	CharacterCodes[CharacterCodes["P"] = 80] = "P";
+	CharacterCodes[CharacterCodes["Q"] = 81] = "Q";
+	CharacterCodes[CharacterCodes["R"] = 82] = "R";
+	CharacterCodes[CharacterCodes["S"] = 83] = "S";
+	CharacterCodes[CharacterCodes["T"] = 84] = "T";
+	CharacterCodes[CharacterCodes["U"] = 85] = "U";
+	CharacterCodes[CharacterCodes["V"] = 86] = "V";
+	CharacterCodes[CharacterCodes["W"] = 87] = "W";
+	CharacterCodes[CharacterCodes["X"] = 88] = "X";
+	CharacterCodes[CharacterCodes["Y"] = 89] = "Y";
+	CharacterCodes[CharacterCodes["Z"] = 90] = "Z";
+	CharacterCodes[CharacterCodes["asterisk"] = 42] = "asterisk";
+	CharacterCodes[CharacterCodes["backslash"] = 92] = "backslash";
+	CharacterCodes[CharacterCodes["closeBrace"] = 125] = "closeBrace";
+	CharacterCodes[CharacterCodes["closeBracket"] = 93] = "closeBracket";
+	CharacterCodes[CharacterCodes["colon"] = 58] = "colon";
+	CharacterCodes[CharacterCodes["comma"] = 44] = "comma";
+	CharacterCodes[CharacterCodes["dot"] = 46] = "dot";
+	CharacterCodes[CharacterCodes["doubleQuote"] = 34] = "doubleQuote";
+	CharacterCodes[CharacterCodes["minus"] = 45] = "minus";
+	CharacterCodes[CharacterCodes["openBrace"] = 123] = "openBrace";
+	CharacterCodes[CharacterCodes["openBracket"] = 91] = "openBracket";
+	CharacterCodes[CharacterCodes["plus"] = 43] = "plus";
+	CharacterCodes[CharacterCodes["slash"] = 47] = "slash";
+	CharacterCodes[CharacterCodes["formFeed"] = 12] = "formFeed";
+	CharacterCodes[CharacterCodes["tab"] = 9] = "tab";
+})(CharacterCodes || (CharacterCodes = {}));
+//#endregion
+//#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/string-intern.js
+const cachedSpaces = new Array(20).fill(0).map((_, index) => {
+	return " ".repeat(index);
+});
+const maxCachedValues = 200;
+const cachedBreakLinesWithSpaces = {
+	" ": {
+		"\n": new Array(maxCachedValues).fill(0).map((_, index) => {
+			return "\n" + " ".repeat(index);
+		}),
+		"\r": new Array(maxCachedValues).fill(0).map((_, index) => {
+			return "\r" + " ".repeat(index);
+		}),
+		"\r\n": new Array(maxCachedValues).fill(0).map((_, index) => {
+			return "\r\n" + " ".repeat(index);
+		})
+	},
+	"	": {
+		"\n": new Array(maxCachedValues).fill(0).map((_, index) => {
+			return "\n" + "	".repeat(index);
+		}),
+		"\r": new Array(maxCachedValues).fill(0).map((_, index) => {
+			return "\r" + "	".repeat(index);
+		}),
+		"\r\n": new Array(maxCachedValues).fill(0).map((_, index) => {
+			return "\r\n" + "	".repeat(index);
+		})
+	}
+};
+const supportedEols = [
+	"\n",
+	"\r",
+	"\r\n"
+];
+//#endregion
+//#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/format.js
+function format(documentText, range, options) {
+	let initialIndentLevel;
+	let formatText;
+	let formatTextStart;
+	let rangeStart;
+	let rangeEnd;
+	if (range) {
+		rangeStart = range.offset;
+		rangeEnd = rangeStart + range.length;
+		formatTextStart = rangeStart;
+		while (formatTextStart > 0 && !isEOL(documentText, formatTextStart - 1)) formatTextStart--;
+		let endOffset = rangeEnd;
+		while (endOffset < documentText.length && !isEOL(documentText, endOffset)) endOffset++;
+		formatText = documentText.substring(formatTextStart, endOffset);
+		initialIndentLevel = computeIndentLevel(formatText, options);
+	} else {
+		formatText = documentText;
+		initialIndentLevel = 0;
+		formatTextStart = 0;
+		rangeStart = 0;
+		rangeEnd = documentText.length;
+	}
+	const eol = getEOL(options, documentText);
+	const eolFastPathSupported = supportedEols.includes(eol);
+	let numberLineBreaks = 0;
+	let indentLevel = 0;
+	let indentValue;
+	if (options.insertSpaces) indentValue = cachedSpaces[options.tabSize || 4] ?? repeat(cachedSpaces[1], options.tabSize || 4);
+	else indentValue = "	";
+	const indentType = indentValue === "	" ? "	" : " ";
+	let scanner = createScanner(formatText, false);
+	let hasError = false;
+	function newLinesAndIndent() {
+		if (numberLineBreaks > 1) return repeat(eol, numberLineBreaks) + repeat(indentValue, initialIndentLevel + indentLevel);
+		const amountOfSpaces = indentValue.length * (initialIndentLevel + indentLevel);
+		if (!eolFastPathSupported || amountOfSpaces > cachedBreakLinesWithSpaces[indentType][eol].length) return eol + repeat(indentValue, initialIndentLevel + indentLevel);
+		if (amountOfSpaces <= 0) return eol;
+		return cachedBreakLinesWithSpaces[indentType][eol][amountOfSpaces];
+	}
+	function scanNext() {
+		let token = scanner.scan();
+		numberLineBreaks = 0;
+		while (token === 15 || token === 14) {
+			if (token === 14 && options.keepLines) numberLineBreaks += 1;
+			else if (token === 14) numberLineBreaks = 1;
+			token = scanner.scan();
+		}
+		hasError = token === 16 || scanner.getTokenError() !== 0;
+		return token;
+	}
+	const editOperations = [];
+	function addEdit(text, startOffset, endOffset) {
+		if (!hasError && (!range || startOffset < rangeEnd && endOffset > rangeStart) && documentText.substring(startOffset, endOffset) !== text) editOperations.push({
+			offset: startOffset,
+			length: endOffset - startOffset,
+			content: text
+		});
+	}
+	let firstToken = scanNext();
+	if (options.keepLines && numberLineBreaks > 0) addEdit(repeat(eol, numberLineBreaks), 0, 0);
+	if (firstToken !== 17) {
+		let firstTokenStart = scanner.getTokenOffset() + formatTextStart;
+		addEdit(indentValue.length * initialIndentLevel < 20 && options.insertSpaces ? cachedSpaces[indentValue.length * initialIndentLevel] : repeat(indentValue, initialIndentLevel), formatTextStart, firstTokenStart);
+	}
+	while (firstToken !== 17) {
+		let firstTokenEnd = scanner.getTokenOffset() + scanner.getTokenLength() + formatTextStart;
+		let secondToken = scanNext();
+		let replaceContent = "";
+		let needsLineBreak = false;
+		while (numberLineBreaks === 0 && (secondToken === 12 || secondToken === 13)) {
+			let commentTokenStart = scanner.getTokenOffset() + formatTextStart;
+			addEdit(cachedSpaces[1], firstTokenEnd, commentTokenStart);
+			firstTokenEnd = scanner.getTokenOffset() + scanner.getTokenLength() + formatTextStart;
+			needsLineBreak = secondToken === 12;
+			replaceContent = needsLineBreak ? newLinesAndIndent() : "";
+			secondToken = scanNext();
+		}
+		if (secondToken === 2) {
+			if (firstToken !== 1) indentLevel--;
+			if (options.keepLines && numberLineBreaks > 0 || !options.keepLines && firstToken !== 1) replaceContent = newLinesAndIndent();
+			else if (options.keepLines) replaceContent = cachedSpaces[1];
+		} else if (secondToken === 4) {
+			if (firstToken !== 3) indentLevel--;
+			if (options.keepLines && numberLineBreaks > 0 || !options.keepLines && firstToken !== 3) replaceContent = newLinesAndIndent();
+			else if (options.keepLines) replaceContent = cachedSpaces[1];
+		} else {
+			switch (firstToken) {
+				case 3:
+				case 1:
+					indentLevel++;
+					if (options.keepLines && numberLineBreaks > 0 || !options.keepLines) replaceContent = newLinesAndIndent();
+					else replaceContent = cachedSpaces[1];
+					break;
+				case 5:
+					if (options.keepLines && numberLineBreaks > 0 || !options.keepLines) replaceContent = newLinesAndIndent();
+					else replaceContent = cachedSpaces[1];
+					break;
+				case 12:
+					replaceContent = newLinesAndIndent();
+					break;
+				case 13:
+					if (numberLineBreaks > 0) replaceContent = newLinesAndIndent();
+					else if (!needsLineBreak) replaceContent = cachedSpaces[1];
+					break;
+				case 6:
+					if (options.keepLines && numberLineBreaks > 0) replaceContent = newLinesAndIndent();
+					else if (!needsLineBreak) replaceContent = cachedSpaces[1];
+					break;
+				case 10:
+					if (options.keepLines && numberLineBreaks > 0) replaceContent = newLinesAndIndent();
+					else if (secondToken === 6 && !needsLineBreak) replaceContent = "";
+					break;
+				case 7:
+				case 8:
+				case 9:
+				case 11:
+				case 2:
+				case 4:
+					if (options.keepLines && numberLineBreaks > 0) replaceContent = newLinesAndIndent();
+					else if ((secondToken === 12 || secondToken === 13) && !needsLineBreak) replaceContent = cachedSpaces[1];
+					else if (secondToken !== 5 && secondToken !== 17) hasError = true;
+					break;
+				case 16: hasError = true;
+			}
+			if (numberLineBreaks > 0 && (secondToken === 12 || secondToken === 13)) replaceContent = newLinesAndIndent();
+		}
+		if (secondToken === 17) {
+			if (options.keepLines && numberLineBreaks > 0) replaceContent = newLinesAndIndent();
+			else replaceContent = options.insertFinalNewline ? eol : "";
+		}
+		const secondTokenStart = scanner.getTokenOffset() + formatTextStart;
+		addEdit(replaceContent, firstTokenEnd, secondTokenStart);
+		firstToken = secondToken;
+	}
+	return editOperations;
+}
+function repeat(s, count) {
+	let result = "";
+	for (let i = 0; i < count; i++) result += s;
+	return result;
+}
+function computeIndentLevel(content, options) {
+	let i = 0;
+	let nChars = 0;
+	const tabSize = options.tabSize || 4;
+	while (i < content.length) {
+		let ch = content.charAt(i);
+		if (ch === cachedSpaces[1]) nChars++;
+		else if (ch === "	") nChars += tabSize;
+		else break;
+		i++;
+	}
+	return Math.floor(nChars / tabSize);
+}
+function getEOL(options, text) {
+	for (let i = 0; i < text.length; i++) {
+		const ch = text.charAt(i);
+		if (ch === "\r") {
+			if (i + 1 < text.length && text.charAt(i + 1) === "\n") return "\r\n";
+			return "\r";
+		} else if (ch === "\n") return "\n";
+	}
+	return options && options.eol || "\n";
+}
+function isEOL(text, offset) {
+	return "\r\n".indexOf(text.charAt(offset)) !== -1;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/parser.js
+var ParseOptions;
+(function(ParseOptions) {
+	ParseOptions.DEFAULT = { allowTrailingComma: false };
+})(ParseOptions || (ParseOptions = {}));
+/**
+* Parses the given text and returns the object the JSON content represents. On invalid input, the parser tries to be as fault tolerant as possible, but still return a result.
+* Therefore always check the errors list to find out if the input was valid.
+*/
+function parse$1(text, errors = [], options = ParseOptions.DEFAULT) {
+	let currentProperty = null;
+	let currentParent = [];
+	const previousParents = [];
+	function onValue(value) {
+		if (Array.isArray(currentParent)) currentParent.push(value);
+		else if (currentProperty !== null) currentParent[currentProperty] = value;
+	}
+	visit(text, {
+		onObjectBegin: () => {
+			const object = {};
+			onValue(object);
+			previousParents.push(currentParent);
+			currentParent = object;
+			currentProperty = null;
+		},
+		onObjectProperty: (name) => {
+			currentProperty = name;
+		},
+		onObjectEnd: () => {
+			currentParent = previousParents.pop();
+		},
+		onArrayBegin: () => {
+			const array = [];
+			onValue(array);
+			previousParents.push(currentParent);
+			currentParent = array;
+			currentProperty = null;
+		},
+		onArrayEnd: () => {
+			currentParent = previousParents.pop();
+		},
+		onLiteralValue: onValue,
+		onError: (error, offset, length) => {
+			errors.push({
+				error,
+				offset,
+				length
+			});
+		}
+	}, options);
+	return currentParent[0];
+}
+/**
+* Parses the given text and returns a tree representation the JSON content. On invalid input, the parser tries to be as fault tolerant as possible, but still return a result.
+*/
+function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
+	let currentParent = {
+		type: "array",
+		offset: -1,
+		length: -1,
+		children: [],
+		parent: void 0
+	};
+	function ensurePropertyComplete(endOffset) {
+		if (currentParent.type === "property") {
+			currentParent.length = endOffset - currentParent.offset;
+			currentParent = currentParent.parent;
+		}
+	}
+	function onValue(valueNode) {
+		currentParent.children.push(valueNode);
+		return valueNode;
+	}
+	visit(text, {
+		onObjectBegin: (offset) => {
+			currentParent = onValue({
+				type: "object",
+				offset,
+				length: -1,
+				parent: currentParent,
+				children: []
+			});
+		},
+		onObjectProperty: (name, offset, length) => {
+			currentParent = onValue({
+				type: "property",
+				offset,
+				length: -1,
+				parent: currentParent,
+				children: []
+			});
+			currentParent.children.push({
+				type: "string",
+				value: name,
+				offset,
+				length,
+				parent: currentParent
+			});
+		},
+		onObjectEnd: (offset, length) => {
+			ensurePropertyComplete(offset + length);
+			currentParent.length = offset + length - currentParent.offset;
+			currentParent = currentParent.parent;
+			ensurePropertyComplete(offset + length);
+		},
+		onArrayBegin: (offset, length) => {
+			currentParent = onValue({
+				type: "array",
+				offset,
+				length: -1,
+				parent: currentParent,
+				children: []
+			});
+		},
+		onArrayEnd: (offset, length) => {
+			currentParent.length = offset + length - currentParent.offset;
+			currentParent = currentParent.parent;
+			ensurePropertyComplete(offset + length);
+		},
+		onLiteralValue: (value, offset, length) => {
+			onValue({
+				type: getNodeType(value),
+				offset,
+				length,
+				parent: currentParent,
+				value
+			});
+			ensurePropertyComplete(offset + length);
+		},
+		onSeparator: (sep, offset, length) => {
+			if (currentParent.type === "property") {
+				if (sep === ":") currentParent.colonOffset = offset;
+				else if (sep === ",") ensurePropertyComplete(offset);
+			}
+		},
+		onError: (error, offset, length) => {
+			errors.push({
+				error,
+				offset,
+				length
+			});
+		}
+	}, options);
+	const result = currentParent.children[0];
+	if (result) delete result.parent;
+	return result;
+}
+/**
+* Finds the node at the given path in a JSON DOM.
+*/
+function findNodeAtLocation(root, path) {
+	if (!root) return;
+	let node = root;
+	for (let segment of path) if (typeof segment === "string") {
+		if (node.type !== "object" || !Array.isArray(node.children)) return;
+		let found = false;
+		for (const propertyNode of node.children) if (Array.isArray(propertyNode.children) && propertyNode.children[0].value === segment && propertyNode.children.length === 2) {
+			node = propertyNode.children[1];
+			found = true;
+			break;
+		}
+		if (!found) return;
+	} else {
+		const index = segment;
+		if (node.type !== "array" || index < 0 || !Array.isArray(node.children) || index >= node.children.length) return;
+		node = node.children[index];
+	}
+	return node;
+}
+/**
+* Parses the given text and invokes the visitor functions for each object, array and literal reached.
+*/
+function visit(text, visitor, options = ParseOptions.DEFAULT) {
+	const _scanner = createScanner(text, false);
+	const _jsonPath = [];
+	let suppressedCallbacks = 0;
+	function toNoArgVisit(visitFunction) {
+		return visitFunction ? () => suppressedCallbacks === 0 && visitFunction(_scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter()) : () => true;
+	}
+	function toOneArgVisit(visitFunction) {
+		return visitFunction ? (arg) => suppressedCallbacks === 0 && visitFunction(arg, _scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter()) : () => true;
+	}
+	function toOneArgVisitWithPath(visitFunction) {
+		return visitFunction ? (arg) => suppressedCallbacks === 0 && visitFunction(arg, _scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter(), () => _jsonPath.slice()) : () => true;
+	}
+	function toBeginVisit(visitFunction) {
+		return visitFunction ? () => {
+			if (suppressedCallbacks > 0) suppressedCallbacks++;
+			else if (visitFunction(_scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter(), () => _jsonPath.slice()) === false) suppressedCallbacks = 1;
+		} : () => true;
+	}
+	function toEndVisit(visitFunction) {
+		return visitFunction ? () => {
+			if (suppressedCallbacks > 0) suppressedCallbacks--;
+			if (suppressedCallbacks === 0) visitFunction(_scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter());
+		} : () => true;
+	}
+	const onObjectBegin = toBeginVisit(visitor.onObjectBegin), onObjectProperty = toOneArgVisitWithPath(visitor.onObjectProperty), onObjectEnd = toEndVisit(visitor.onObjectEnd), onArrayBegin = toBeginVisit(visitor.onArrayBegin), onArrayEnd = toEndVisit(visitor.onArrayEnd), onLiteralValue = toOneArgVisitWithPath(visitor.onLiteralValue), onSeparator = toOneArgVisit(visitor.onSeparator), onComment = toNoArgVisit(visitor.onComment), onError = toOneArgVisit(visitor.onError);
+	const disallowComments = options && options.disallowComments;
+	const allowTrailingComma = options && options.allowTrailingComma;
+	function scanNext() {
+		while (true) {
+			const token = _scanner.scan();
+			switch (_scanner.getTokenError()) {
+				case 4:
+					handleError(14);
+					break;
+				case 5:
+					handleError(15);
+					break;
+				case 3:
+					handleError(13);
+					break;
+				case 1:
+					if (!disallowComments) handleError(11);
+					break;
+				case 2:
+					handleError(12);
+					break;
+				case 6: handleError(16);
+			}
+			switch (token) {
+				case 12:
+				case 13:
+					if (disallowComments) handleError(10);
+					else onComment();
+					break;
+				case 16:
+					handleError(1);
+					break;
+				case 15:
+				case 14: break;
+				default: return token;
+			}
+		}
+	}
+	function handleError(error, skipUntilAfter = [], skipUntil = []) {
+		onError(error);
+		if (skipUntilAfter.length + skipUntil.length > 0) {
+			let token = _scanner.getToken();
+			while (token !== 17) {
+				if (skipUntilAfter.indexOf(token) !== -1) {
+					scanNext();
+					break;
+				} else if (skipUntil.indexOf(token) !== -1) break;
+				token = scanNext();
+			}
+		}
+	}
+	function parseString(isValue) {
+		const value = _scanner.getTokenValue();
+		if (isValue) onLiteralValue(value);
+		else {
+			onObjectProperty(value);
+			_jsonPath.push(value);
+		}
+		scanNext();
+		return true;
+	}
+	function parseLiteral() {
+		switch (_scanner.getToken()) {
+			case 11:
+				const tokenValue = _scanner.getTokenValue();
+				let value = Number(tokenValue);
+				if (isNaN(value)) {
+					handleError(2);
+					value = 0;
+				}
+				onLiteralValue(value);
+				break;
+			case 7:
+				onLiteralValue(null);
+				break;
+			case 8:
+				onLiteralValue(true);
+				break;
+			case 9:
+				onLiteralValue(false);
+				break;
+			default: return false;
+		}
+		scanNext();
+		return true;
+	}
+	function parseProperty() {
+		if (_scanner.getToken() !== 10) {
+			handleError(3, [], [2, 5]);
+			return false;
+		}
+		parseString(false);
+		if (_scanner.getToken() === 6) {
+			onSeparator(":");
+			scanNext();
+			if (!parseValue()) handleError(4, [], [2, 5]);
+		} else handleError(5, [], [2, 5]);
+		_jsonPath.pop();
+		return true;
+	}
+	function parseObject() {
+		onObjectBegin();
+		scanNext();
+		let needsComma = false;
+		while (_scanner.getToken() !== 2 && _scanner.getToken() !== 17) {
+			if (_scanner.getToken() === 5) {
+				if (!needsComma) handleError(4, [], []);
+				onSeparator(",");
+				scanNext();
+				if (_scanner.getToken() === 2 && allowTrailingComma) break;
+			} else if (needsComma) handleError(6, [], []);
+			if (!parseProperty()) handleError(4, [], [2, 5]);
+			needsComma = true;
+		}
+		onObjectEnd();
+		if (_scanner.getToken() !== 2) handleError(7, [2], []);
+		else scanNext();
+		return true;
+	}
+	function parseArray() {
+		onArrayBegin();
+		scanNext();
+		let isFirstElement = true;
+		let needsComma = false;
+		while (_scanner.getToken() !== 4 && _scanner.getToken() !== 17) {
+			if (_scanner.getToken() === 5) {
+				if (!needsComma) handleError(4, [], []);
+				onSeparator(",");
+				scanNext();
+				if (_scanner.getToken() === 4 && allowTrailingComma) break;
+			} else if (needsComma) handleError(6, [], []);
+			if (isFirstElement) {
+				_jsonPath.push(0);
+				isFirstElement = false;
+			} else _jsonPath[_jsonPath.length - 1]++;
+			if (!parseValue()) handleError(4, [], [4, 5]);
+			needsComma = true;
+		}
+		onArrayEnd();
+		if (!isFirstElement) _jsonPath.pop();
+		if (_scanner.getToken() !== 4) handleError(8, [4], []);
+		else scanNext();
+		return true;
+	}
+	function parseValue() {
+		switch (_scanner.getToken()) {
+			case 3: return parseArray();
+			case 1: return parseObject();
+			case 10: return parseString(true);
+			default: return parseLiteral();
+		}
+	}
+	scanNext();
+	if (_scanner.getToken() === 17) {
+		if (options.allowEmptyContent) return true;
+		handleError(4, [], []);
+		return false;
+	}
+	if (!parseValue()) {
+		handleError(4, [], []);
+		return false;
+	}
+	if (_scanner.getToken() !== 17) handleError(9, [], []);
+	return true;
+}
+function getNodeType(value) {
+	switch (typeof value) {
+		case "boolean": return "boolean";
+		case "number": return "number";
+		case "string": return "string";
+		case "object":
+			if (!value) return "null";
+			else if (Array.isArray(value)) return "array";
+			return "object";
+		default: return "null";
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/edit.js
+function setProperty(text, originalPath, value, options) {
+	const path = originalPath.slice();
+	const root = parseTree(text, []);
+	let parent = void 0;
+	let lastSegment = void 0;
+	while (path.length > 0) {
+		lastSegment = path.pop();
+		parent = findNodeAtLocation(root, path);
+		if (parent === void 0 && value !== void 0) {
+			if (typeof lastSegment === "string") value = { [lastSegment]: value };
+			else value = [value];
+		} else break;
+	}
+	if (!parent) {
+		if (value === void 0) throw new Error("Can not delete in empty document");
+		return withFormatting(text, {
+			offset: root ? root.offset : 0,
+			length: root ? root.length : 0,
+			content: JSON.stringify(value)
+		}, options);
+	} else if (parent.type === "object" && typeof lastSegment === "string" && Array.isArray(parent.children)) {
+		const existing = findNodeAtLocation(parent, [lastSegment]);
+		if (existing !== void 0) {
+			if (value === void 0) {
+				if (!existing.parent) throw new Error("Malformed AST");
+				const propertyIndex = parent.children.indexOf(existing.parent);
+				let removeBegin;
+				let removeEnd = existing.parent.offset + existing.parent.length;
+				if (propertyIndex > 0) {
+					let previous = parent.children[propertyIndex - 1];
+					removeBegin = previous.offset + previous.length;
+				} else {
+					removeBegin = parent.offset + 1;
+					if (parent.children.length > 1) removeEnd = parent.children[1].offset;
+				}
+				return withFormatting(text, {
+					offset: removeBegin,
+					length: removeEnd - removeBegin,
+					content: ""
+				}, options);
+			} else return withFormatting(text, {
+				offset: existing.offset,
+				length: existing.length,
+				content: JSON.stringify(value)
+			}, options);
+		} else {
+			if (value === void 0) return [];
+			const newProperty = `${JSON.stringify(lastSegment)}: ${JSON.stringify(value)}`;
+			const index = options.getInsertionIndex ? options.getInsertionIndex(parent.children.map((p) => p.children[0].value)) : parent.children.length;
+			let edit;
+			if (index > 0) {
+				let previous = parent.children[index - 1];
+				edit = {
+					offset: previous.offset + previous.length,
+					length: 0,
+					content: "," + newProperty
+				};
+			} else if (parent.children.length === 0) edit = {
+				offset: parent.offset + 1,
+				length: 0,
+				content: newProperty
+			};
+			else edit = {
+				offset: parent.offset + 1,
+				length: 0,
+				content: newProperty + ","
+			};
+			return withFormatting(text, edit, options);
+		}
+	} else if (parent.type === "array" && typeof lastSegment === "number" && Array.isArray(parent.children)) {
+		const insertIndex = lastSegment;
+		if (insertIndex === -1) {
+			const newProperty = `${JSON.stringify(value)}`;
+			let edit;
+			if (parent.children.length === 0) edit = {
+				offset: parent.offset + 1,
+				length: 0,
+				content: newProperty
+			};
+			else {
+				const previous = parent.children[parent.children.length - 1];
+				edit = {
+					offset: previous.offset + previous.length,
+					length: 0,
+					content: "," + newProperty
+				};
+			}
+			return withFormatting(text, edit, options);
+		} else if (value === void 0 && parent.children.length >= 0) {
+			const removalIndex = lastSegment;
+			const toRemove = parent.children[removalIndex];
+			let edit;
+			if (parent.children.length === 1) edit = {
+				offset: parent.offset + 1,
+				length: parent.length - 2,
+				content: ""
+			};
+			else if (parent.children.length - 1 === removalIndex) {
+				let previous = parent.children[removalIndex - 1];
+				let offset = previous.offset + previous.length;
+				edit = {
+					offset,
+					length: parent.offset + parent.length - 2 - offset,
+					content: ""
+				};
+			} else edit = {
+				offset: toRemove.offset,
+				length: parent.children[removalIndex + 1].offset - toRemove.offset,
+				content: ""
+			};
+			return withFormatting(text, edit, options);
+		} else if (value !== void 0) {
+			let edit;
+			const newProperty = `${JSON.stringify(value)}`;
+			if (!options.isArrayInsertion && parent.children.length > lastSegment) {
+				const toModify = parent.children[lastSegment];
+				edit = {
+					offset: toModify.offset,
+					length: toModify.length,
+					content: newProperty
+				};
+			} else if (parent.children.length === 0 || lastSegment === 0) edit = {
+				offset: parent.offset + 1,
+				length: 0,
+				content: parent.children.length === 0 ? newProperty : newProperty + ","
+			};
+			else {
+				const index = lastSegment > parent.children.length ? parent.children.length : lastSegment;
+				const previous = parent.children[index - 1];
+				edit = {
+					offset: previous.offset + previous.length,
+					length: 0,
+					content: "," + newProperty
+				};
+			}
+			return withFormatting(text, edit, options);
+		} else throw new Error(`Can not ${value === void 0 ? "remove" : options.isArrayInsertion ? "insert" : "modify"} Array index ${insertIndex} as length is not sufficient`);
+	} else throw new Error(`Can not add ${typeof lastSegment !== "number" ? "index" : "property"} to parent of type ${parent.type}`);
+}
+function withFormatting(text, edit, options) {
+	if (!options.formattingOptions) return [edit];
+	let newText = applyEdit(text, edit);
+	let begin = edit.offset;
+	let end = edit.offset + edit.content.length;
+	if (edit.length === 0 || edit.content.length === 0) {
+		while (begin > 0 && !isEOL(newText, begin - 1)) begin--;
+		while (end < newText.length && !isEOL(newText, end)) end++;
+	}
+	const edits = format(newText, {
+		offset: begin,
+		length: end - begin
+	}, {
+		...options.formattingOptions,
+		keepLines: false
+	});
+	for (let i = edits.length - 1; i >= 0; i--) {
+		const edit = edits[i];
+		newText = applyEdit(newText, edit);
+		begin = Math.min(begin, edit.offset);
+		end = Math.max(end, edit.offset + edit.length);
+		end += edit.content.length - edit.length;
+	}
+	const editLength = text.length - (newText.length - end) - begin;
+	return [{
+		offset: begin,
+		length: editLength,
+		content: newText.substring(begin, end)
+	}];
+}
+function applyEdit(text, edit) {
+	return text.substring(0, edit.offset) + edit.content + text.substring(edit.offset + edit.length);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js
+var ScanError;
+(function(ScanError) {
+	ScanError[ScanError["None"] = 0] = "None";
+	ScanError[ScanError["UnexpectedEndOfComment"] = 1] = "UnexpectedEndOfComment";
+	ScanError[ScanError["UnexpectedEndOfString"] = 2] = "UnexpectedEndOfString";
+	ScanError[ScanError["UnexpectedEndOfNumber"] = 3] = "UnexpectedEndOfNumber";
+	ScanError[ScanError["InvalidUnicode"] = 4] = "InvalidUnicode";
+	ScanError[ScanError["InvalidEscapeCharacter"] = 5] = "InvalidEscapeCharacter";
+	ScanError[ScanError["InvalidCharacter"] = 6] = "InvalidCharacter";
+})(ScanError || (ScanError = {}));
+var SyntaxKind;
+(function(SyntaxKind) {
+	SyntaxKind[SyntaxKind["OpenBraceToken"] = 1] = "OpenBraceToken";
+	SyntaxKind[SyntaxKind["CloseBraceToken"] = 2] = "CloseBraceToken";
+	SyntaxKind[SyntaxKind["OpenBracketToken"] = 3] = "OpenBracketToken";
+	SyntaxKind[SyntaxKind["CloseBracketToken"] = 4] = "CloseBracketToken";
+	SyntaxKind[SyntaxKind["CommaToken"] = 5] = "CommaToken";
+	SyntaxKind[SyntaxKind["ColonToken"] = 6] = "ColonToken";
+	SyntaxKind[SyntaxKind["NullKeyword"] = 7] = "NullKeyword";
+	SyntaxKind[SyntaxKind["TrueKeyword"] = 8] = "TrueKeyword";
+	SyntaxKind[SyntaxKind["FalseKeyword"] = 9] = "FalseKeyword";
+	SyntaxKind[SyntaxKind["StringLiteral"] = 10] = "StringLiteral";
+	SyntaxKind[SyntaxKind["NumericLiteral"] = 11] = "NumericLiteral";
+	SyntaxKind[SyntaxKind["LineCommentTrivia"] = 12] = "LineCommentTrivia";
+	SyntaxKind[SyntaxKind["BlockCommentTrivia"] = 13] = "BlockCommentTrivia";
+	SyntaxKind[SyntaxKind["LineBreakTrivia"] = 14] = "LineBreakTrivia";
+	SyntaxKind[SyntaxKind["Trivia"] = 15] = "Trivia";
+	SyntaxKind[SyntaxKind["Unknown"] = 16] = "Unknown";
+	SyntaxKind[SyntaxKind["EOF"] = 17] = "EOF";
+})(SyntaxKind || (SyntaxKind = {}));
+/**
+* Parses the given text and returns the object the JSON content represents. On invalid input, the parser tries to be as fault tolerant as possible, but still return a result.
+* Therefore, always check the errors list to find out if the input was valid.
+*/
+const parse = parse$1;
+var ParseErrorCode;
+(function(ParseErrorCode) {
+	ParseErrorCode[ParseErrorCode["InvalidSymbol"] = 1] = "InvalidSymbol";
+	ParseErrorCode[ParseErrorCode["InvalidNumberFormat"] = 2] = "InvalidNumberFormat";
+	ParseErrorCode[ParseErrorCode["PropertyNameExpected"] = 3] = "PropertyNameExpected";
+	ParseErrorCode[ParseErrorCode["ValueExpected"] = 4] = "ValueExpected";
+	ParseErrorCode[ParseErrorCode["ColonExpected"] = 5] = "ColonExpected";
+	ParseErrorCode[ParseErrorCode["CommaExpected"] = 6] = "CommaExpected";
+	ParseErrorCode[ParseErrorCode["CloseBraceExpected"] = 7] = "CloseBraceExpected";
+	ParseErrorCode[ParseErrorCode["CloseBracketExpected"] = 8] = "CloseBracketExpected";
+	ParseErrorCode[ParseErrorCode["EndOfFileExpected"] = 9] = "EndOfFileExpected";
+	ParseErrorCode[ParseErrorCode["InvalidCommentToken"] = 10] = "InvalidCommentToken";
+	ParseErrorCode[ParseErrorCode["UnexpectedEndOfComment"] = 11] = "UnexpectedEndOfComment";
+	ParseErrorCode[ParseErrorCode["UnexpectedEndOfString"] = 12] = "UnexpectedEndOfString";
+	ParseErrorCode[ParseErrorCode["UnexpectedEndOfNumber"] = 13] = "UnexpectedEndOfNumber";
+	ParseErrorCode[ParseErrorCode["InvalidUnicode"] = 14] = "InvalidUnicode";
+	ParseErrorCode[ParseErrorCode["InvalidEscapeCharacter"] = 15] = "InvalidEscapeCharacter";
+	ParseErrorCode[ParseErrorCode["InvalidCharacter"] = 16] = "InvalidCharacter";
+})(ParseErrorCode || (ParseErrorCode = {}));
+function printParseErrorCode(code) {
+	switch (code) {
+		case 1: return "InvalidSymbol";
+		case 2: return "InvalidNumberFormat";
+		case 3: return "PropertyNameExpected";
+		case 4: return "ValueExpected";
+		case 5: return "ColonExpected";
+		case 6: return "CommaExpected";
+		case 7: return "CloseBraceExpected";
+		case 8: return "CloseBracketExpected";
+		case 9: return "EndOfFileExpected";
+		case 10: return "InvalidCommentToken";
+		case 11: return "UnexpectedEndOfComment";
+		case 12: return "UnexpectedEndOfString";
+		case 13: return "UnexpectedEndOfNumber";
+		case 14: return "InvalidUnicode";
+		case 15: return "InvalidEscapeCharacter";
+		case 16: return "InvalidCharacter";
+	}
+	return "<unknown ParseErrorCode>";
+}
+/**
+* Computes the edit operations needed to modify a value in the JSON document.
+*
+* @param documentText The input text
+* @param path The path of the value to change. The path represents either to the document root, a property or an array item.
+* If the path points to an non-existing property or item, it will be created.
+* @param value The new value for the specified property or item. If the value is undefined,
+* the property or item will be removed.
+* @param options Options
+* @returns The edit operations describing the changes to the original document, following the format described in {@linkcode EditResult}.
+* To apply the edit operations to the input, use {@linkcode applyEdits}.
+*/
+function modify(text, path, value, options) {
+	return setProperty(text, path, value, options);
+}
+/**
+* Applies edits to an input string.
+* @param text The input text
+* @param edits Edit operations following the format described in {@linkcode EditResult}.
+* @returns The text with the applied edits.
+* @throws An error if the edit operations are not well-formed as described in {@linkcode EditResult}.
+*/
+function applyEdits(text, edits) {
+	let sortedEdits = edits.slice(0).sort((a, b) => {
+		const diff = a.offset - b.offset;
+		if (diff === 0) return a.length - b.length;
+		return diff;
+	});
+	let lastModifiedOffset = text.length;
+	for (let i = sortedEdits.length - 1; i >= 0; i--) {
+		let e = sortedEdits[i];
+		if (e.offset + e.length <= lastModifiedOffset) text = applyEdit(text, e);
+		else throw new Error("Overlapping edit");
+		lastModifiedOffset = e.offset;
+	}
+	return text;
+}
+//#endregion
+//#region src/deployment.ts
+/** What a directory holds: a deployment of either kind, nothing yet (`isEmpty`), or something else. */
+function deploymentKind(dir) {
+	if (isEmpty(dir)) return "empty";
+	if (existsSync(join(dir, "app", "wrangler.jsonc")) && existsSync(join(dir, "vault", "wrangler.jsonc"))) return "workers";
+	if (existsSync(join(dir, "src", "vault.ts")) && existsSync(join(dir, "vault.env.example"))) return "node";
+	return "other";
+}
+/** Install a new deployment's packages, as its README says: pnpm, through corepack when pnpm itself is missing. */
+function install(dir) {
+	const attempt = (command, args) => new Promise((resolve) => {
+		const child = spawn(command, args, {
+			cwd: dir,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+			}
+		});
+		let output = "";
+		child.stdout.setEncoding("utf8").on("data", (chunk) => output += chunk);
+		child.stderr.setEncoding("utf8").on("data", (chunk) => output += chunk);
+		child.on("error", () => resolve(null));
+		child.on("close", (code) => resolve({
+			code,
+			output
+		}));
+	});
+	return (async () => {
+		const ran = await attempt("pnpm", ["install"]) ?? await attempt("corepack", ["pnpm", "install"]);
+		if (ran === null) throw new Error("pnpm is not installed: corepack enable, or npm install -g pnpm, then run setup again");
+		if (ran.code !== 0) {
+			const tail = ran.output.trim().split("\n").slice(-3).join(" ");
+			throw new Error(`pnpm install failed: ${tail}`);
+		}
+	})();
+}
+/** A value the examples ship, standing for the operator's own. */
+function placeholder(value) {
+	return value === void 0 || value === null || value === "" || /^replace-with-|example\.com\b/.test(value);
+}
+function readWorker(dir, path) {
+	const errors = [];
+	const config = parse(readFileSync(join(dir, path), "utf8"), errors, { allowTrailingComma: true });
+	if (errors.length > 0) throw new Error(`${path} is not valid: ${printParseErrorCode(errors[0].error)} at offset ${errors[0].offset}`);
+	if (typeof config.name !== "string") throw new Error(`${path} names no Worker`);
+	const route = config.routes?.[0];
+	return {
+		path,
+		name: config.name,
+		accountId: config.account_id ?? null,
+		vars: Object.fromEntries(Object.entries(config.vars ?? {}).filter((entry) => typeof entry[1] === "string")),
+		hyperdrive: placeholder(config.hyperdrive?.[0]?.id) ? null : config.hyperdrive[0].id,
+		route: typeof route === "string" ? route : route?.pattern ?? null
+	};
+}
+/** A value as the examples write one on a single line: `[{ "pattern": "…", "custom_domain": true }]`. */
+function inline(value) {
+	return JSON.stringify(value, null, 1).replace(/\n\s*/g, " ").replace(/\[ /g, "[").replace(/ \]/g, "]");
+}
+/** Make `changes` to the file at `path`, leaving the rest as it is, comments and all. Says which changed anything. */
+function editWorker(dir, path, changes) {
+	const MARK = "\0coffre\0";
+	let text = readFileSync(join(dir, path), "utf8");
+	const changed = changes.map((change) => {
+		const edits = modify(text, change.path, MARK, {
+			formattingOptions: {
+				insertSpaces: true,
+				tabSize: 2,
+				eol: "\n"
+			},
+			getInsertionIndex: change.after === void 0 ? void 0 : (properties) => properties.indexOf(change.after) + 1
+		});
+		const before = text;
+		text = applyEdits(text, edits.map((edit) => ({
+			...edit,
+			content: edit.content.replace(JSON.stringify(MARK), inline(change.value))
+		})));
+		return text !== before;
+	});
+	writeFileSync(join(dir, path), text);
+	return changed;
+}
+//#endregion
+//#region src/steps.ts
+const SPINNER = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+const FRAME_MS = 80;
+/** A step failed, and its line says why: nothing more to show. */
+var StepFailed = class extends Error {};
+var Steps = class {
+	#out;
+	#s;
+	#steps;
+	#keys;
+	#describe;
+	#frame = 0;
+	#drawn = 0;
+	/** The first step still redrawn: those above it have settled, and been printed for good. */
+	#from = 0;
+	#timer = null;
+	#restoreCursor = () => this.#out.write("\x1B[?25h");
+	/** Ctrl-C while a step runs, the terminal in its usual mode: the cursor back, then out, with nothing more to show. */
+	#interrupt = () => {
+		this.#stop();
+		this.end();
+		this.#out.write("\n");
+		process.exit(130);
+	};
+	/**
+	* `titles`, what each step does while it runs; `keys`, the keyboard for
+	* questions; `describe`, an error as it may be shown, a secret it quotes
+	* taken out.
+	*/
+	constructor(out, titles, keys, describe) {
+		this.#out = out;
+		this.#s = style(out);
+		this.#keys = keys;
+		this.#describe = describe;
+		this.#steps = titles.map((text) => ({
+			text,
+			status: "pending",
+			details: [],
+			under: [],
+			input: null,
+			choice: null
+		}));
+		if (this.#s.ansi) {
+			out.write("\x1B[?25l");
+			process.once("exit", this.#restoreCursor);
+			process.on("SIGINT", this.#interrupt);
+			this.#draw();
+		}
+	}
+	/**
+	* Run step `i`: its line is the outcome `work` returns, or the error it
+	* throws, which comes out as StepFailed, unless it is Cancelled.
+	*/
+	async run(i, work) {
+		const state = this.#steps[i];
+		state.status = "running";
+		this.#tick();
+		const step = {
+			note: (text) => {
+				state.text = text;
+				this.#draw();
+			},
+			under: (lines) => {
+				state.under = lines;
+				this.#draw();
+			},
+			ask: (question) => this.#ask(state, question),
+			choose: (question, options) => this.#choose(state, question, options),
+			paste: (prompt, accept, signal) => this.#paste(state, prompt, accept, signal)
+		};
+		try {
+			const outcome = await work(step);
+			Object.assign(state, typeof outcome === "string" ? {
+				text: outcome,
+				details: []
+			} : outcome, {
+				status: "done",
+				under: [],
+				input: null
+			});
+		} catch (error) {
+			Object.assign(state, {
+				under: [],
+				input: null,
+				choice: null
+			});
+			state.status = "failed";
+			state.details = error instanceof Cancelled ? [] : [this.#describe(error)];
+			if (error instanceof Cancelled) state.text = `${state.text}: cancelled`;
+			this.#stop();
+			throw error instanceof Cancelled ? error : new StepFailed(state.details[0]);
+		}
+		this.#stop();
+		if (!this.#s.ansi) this.#out.write(`✓ ${state.text}\n${state.details.map((line) => `  ${line}\n`).join("")}`);
+		else if (this.#steps.every((each) => each.status === "done")) this.end();
+	}
+	/**
+	* Lines that stay, such as an address to open, printed whole, so that a
+	* terminal can wrap them, and they can be copied or clicked. They go
+	* under the steps done, above the one running: those done are printed
+	* for good first, and only the rest is redrawn from then on.
+	*/
+	print(text) {
+		if (!this.#s.ansi) {
+			this.#out.write(`${text}\n`);
+			return;
+		}
+		const running = this.#steps.findIndex((each, i) => i >= this.#from && each.status !== "done");
+		const settled = this.#lines(this.#from, running === -1 ? this.#steps.length : running);
+		this.#from = running === -1 ? this.#steps.length : running;
+		const up = this.#drawn > 0 ? `\x1b[${this.#drawn}F` : "";
+		this.#out.write(`${up}\x1b[J${settled.map((line) => `${line}\n`).join("")}${text}\n`);
+		this.#drawn = 0;
+		this.#draw();
+	}
+	/** A remark that stays, dim, wrapped to the terminal's width. */
+	aside(text) {
+		this.print(this.#s.dim(wrap(text, Math.max(20, (this.#out.columns ?? 80) - 3)).map((line) => `  ${line}`).join("\n")));
+	}
+	/**
+	* An address to open, after what it is for: on one line when both fit;
+	* otherwise the address on a line of its own, from the first column, so
+	* that the terminal wraps it in one piece, to copy whole.
+	*/
+	link(label, address) {
+		const fits = width(`  ${label} ${address}`) < (this.#out.columns ?? 80);
+		this.print(fits ? `  ${this.#s.dim(label)} ${address}` : `  ${this.#s.dim(label)}\n${address}`);
+	}
+	/** Leave the list as it stands, the cursor below it. */
+	end() {
+		this.#stop();
+		this.#release();
+	}
+	/** The cursor back, and Ctrl-C the terminal's again. */
+	#release() {
+		if (this.#s.ansi) {
+			this.#restoreCursor();
+			process.off("exit", this.#restoreCursor);
+			process.off("SIGINT", this.#interrupt);
+		}
+	}
+	async #ask(state, question) {
+		const keys = this.#keys();
+		if (keys === null) return false;
+		this.#stop();
+		const before = state.text;
+		state.text = `${question} ${this.#s.dim("y/N")}`;
+		state.status = "asking";
+		this.#draw();
+		try {
+			return await yes(keys);
+		} finally {
+			state.text = before;
+			state.status = "running";
+			this.#tick();
+		}
+	}
+	async #choose(state, question, options) {
+		const keys = this.#keys();
+		if (keys === null) return 0;
+		this.#stop();
+		const before = state.text;
+		Object.assign(state, {
+			text: `${question} ${this.#s.dim("↑↓ then Enter")}`,
+			status: "asking",
+			choice: {
+				options,
+				at: 0
+			}
+		});
+		let cancelled = false;
+		try {
+			const chosen = readKeys(keys, (key) => {
+				const choice = state.choice;
+				if (key.ctrl && key.name === "c") cancelled = true;
+				else if (key.name === "return" || key.name === "enter") return true;
+				else if (key.name === "up" || key.name === "k") choice.at = (choice.at - 1 + options.length) % options.length;
+				else if (key.name === "down" || key.name === "j" || key.name === "tab") choice.at = (choice.at + 1) % options.length;
+				if (cancelled) return true;
+				this.#draw();
+				return false;
+			});
+			this.#draw();
+			await chosen;
+			if (cancelled) throw new Cancelled();
+			return state.choice.at;
+		} finally {
+			Object.assign(state, {
+				text: before,
+				status: "running",
+				choice: null
+			});
+			this.#tick();
+		}
+	}
+	async #paste(state, prompt, accept, signal) {
+		const keys = this.#keys();
+		if (keys === null) {
+			await new Promise((resolve) => signal.aborted ? resolve() : signal.addEventListener("abort", () => resolve()));
+			return null;
+		}
+		state.input = {
+			prompt,
+			typed: "",
+			error: null
+		};
+		let taken = null;
+		let cancelled = false;
+		try {
+			const pasted = readKeys(keys, async (key, sequence) => {
+				const input = state.input;
+				const next = edit(input.typed, key, sequence);
+				if (next === "cancel") cancelled = true;
+				else if (next === "submit" && input.typed.trim() !== "") {
+					const text = input.typed.trim();
+					input.typed = "";
+					input.error = await accept(text);
+					if (input.error === null) taken = text;
+				} else if (next !== "submit") {
+					input.typed = next;
+					input.error = null;
+				}
+				this.#draw();
+				return cancelled || taken !== null;
+			}, signal);
+			this.#draw();
+			await pasted;
+		} finally {
+			state.input = null;
+			this.#draw();
+		}
+		if (cancelled) throw new Cancelled();
+		return taken;
+	}
+	#tick() {
+		this.#draw();
+		if (this.#s.ansi && this.#timer === null) this.#timer = setInterval(() => {
+			this.#frame = (this.#frame + 1) % SPINNER.length;
+			this.#draw();
+		}, FRAME_MS).unref();
+	}
+	#stop() {
+		if (this.#timer !== null) clearInterval(this.#timer);
+		this.#timer = null;
+		this.#draw();
+		if (!this.#s.ansi) {
+			const failed = this.#steps.find((each) => each.status === "failed");
+			if (failed !== void 0) this.#out.write(`✗ ${failed.text}\n${failed.details.map((line) => `  ${line}\n`).join("")}`);
+		} else if (this.#steps.some((each) => each.status === "failed")) this.#release();
+	}
+	#draw() {
+		if (!this.#s.ansi) return;
+		const lines = this.#lines(this.#from, this.#steps.length);
+		const up = this.#drawn > 0 ? `\x1b[${this.#drawn}F` : "";
+		this.#out.write(`${up}${lines.map((line) => `${line}\x1b[K\n`).join("")}\x1b[J`);
+		this.#drawn = lines.length;
+	}
+	/** Steps `from` to `to`, as lines cut to the terminal's width. */
+	#lines(from, to) {
+		const s = this.#s;
+		const columns = Math.max(20, (this.#out.columns ?? 80) - 1);
+		return this.#steps.slice(from, to).flatMap(({ text, status, details, under, input, choice }) => {
+			const icon = {
+				pending: s.dim("·"),
+				running: s.accent(SPINNER[this.#frame]),
+				asking: s.accent("?"),
+				done: s.green("✓"),
+				failed: s.red("✗")
+			}[status];
+			const line = status === "pending" ? s.dim(text) : status === "failed" ? s.red(text) : text;
+			const below = status === "failed" ? details.flatMap((detail) => wrap(detail, columns - 4)) : details.map(s.dim);
+			const live = [
+				...under.map((text) => `    ${s.dim(text)}`),
+				...choice === null ? [] : choice.options.map((option, i) => i === choice.at ? `    ${s.accent("›")} ${s.accent(option)}` : `      ${option}`),
+				...input === null ? [] : [
+					`    ${input.prompt}`,
+					`    ${s.accent("›")} ${"•".repeat(input.typed.length)}`,
+					...input.error === null ? [] : [`    ${s.red(input.error)}`]
+				]
+			];
+			return [
+				`  ${icon} ${line}`,
+				...below.map((detail) => `    ${detail}`),
+				...live
+			];
+		}).map((line) => truncate(line, columns));
+	}
+};
+//#endregion
+//#region src/browser.ts
+/** Open `url` in this machine's browser, if it has one. Silent either way. */
+function openBrowser(url, platform = process.platform) {
+	const [command, ...args] = platform === "darwin" ? ["open", url] : platform === "win32" ? [
+		"cmd",
+		"/c",
+		"start",
+		"",
+		url
+	] : ["xdg-open", url];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+/**
+* `text` as a callback address on this machine, or why not: it must name
+* localhost or 127.0.0.1, `port` and `path`, and carry each of `params`.
+* Only such an address is ever fetched, so a paste can never send this
+* machine anywhere else.
+*/
+function localCallback(text, port, path, params) {
+	let url;
+	try {
+		url = new URL(text.trim());
+	} catch {
+		return "that is not an address: paste the whole one your browser shows";
+	}
+	if (url.protocol !== "http:" || url.hostname !== "localhost" && url.hostname !== "127.0.0.1") return `that is not a localhost address: paste the one that starts http://localhost:${port}`;
+	if (url.port !== String(port) || url.pathname !== path) return `that is not this step's address: it starts http://localhost:${port}${path}`;
+	const missing = params.filter((param) => !url.searchParams.get(param));
+	if (missing.length > 0) return `that address has no ${missing.join(" or ")}: paste it whole`;
+	return url;
+}
+//#endregion
+//#region src/cloudflare.ts
+/** Where wrangler's login listens for its callback, unless its link says otherwise. */
+const WRANGLER_CALLBACK = "http://localhost:8976/oauth/callback";
+/** Each wrangler running, by its process group: none outlives setup, nor holds on to a port after it. */
+const running = /* @__PURE__ */ new Set();
+let watching = false;
+/** Stop a wrangler, and all it started: its group, sh, cat and wrangler alike. */
+function stopGroup(pid) {
+	try {
+		process.kill(-pid, "SIGTERM");
+	} catch {}
+}
+/** Stop every wrangler still running: on any way out of setup, its exit included. */
+function stopWranglers() {
+	for (const pid of running) stopGroup(pid);
+	running.clear();
+}
+/**
+* From the first wrangler on, setup's ends stop them all: its exit, and the
+* signals that end it without one. A closed terminal or a SIGTERM reaches
+* setup alone, wrangler being in a session of its own.
+*/
+function watch() {
+	if (watching) return;
+	watching = true;
+	process.once("exit", stopWranglers);
+	for (const [signal, code] of [["SIGHUP", 129], ["SIGTERM", 143]]) process.once(signal, () => {
+		stopWranglers();
+		process.exit(code);
+	});
+}
+function deploymentWrangler(dir) {
+	const bin = join(dir, "node_modules", ".bin", process.platform === "win32" ? "wrangler.cmd" : "wrangler");
+	return (args, { input, env, onOutput, signal } = {}) => new Promise((resolve, reject) => {
+		const [command, argv] = input === void 0 ? [bin, args] : ["/bin/sh", [
+			"-c",
+			"cat | \"$0\" \"$@\"",
+			bin,
+			...args
+		]];
+		const child = spawn(command, argv, {
+			cwd: dir,
+			env: {
+				...process.env,
+				...env,
+				WRANGLER_SEND_METRICS: "false",
+				NO_COLOR: "1"
+			},
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: process.platform !== "win32"
+		});
+		const pid = child.pid;
+		if (pid !== void 0 && process.platform !== "win32") {
+			watch();
+			running.add(pid);
+			const stop = () => running.delete(pid) ? stopGroup(pid) : void 0;
+			if (signal?.aborted) stop();
+			else signal?.addEventListener("abort", stop, { once: true });
+			child.on("close", () => {
+				running.delete(pid);
+				signal?.removeEventListener("abort", stop);
+			});
+		} else if (signal !== void 0) signal.addEventListener("abort", () => child.kill(), { once: true });
+		let stdout = "";
+		let stderr = "";
+		child.stdout.setEncoding("utf8").on("data", (chunk) => {
+			stdout += chunk;
+			onOutput?.(chunk);
+		});
+		child.stderr.setEncoding("utf8").on("data", (chunk) => {
+			stderr += chunk;
+			onOutput?.(chunk);
+		});
+		child.on("error", reject);
+		child.on("close", (code) => resolve({
+			code,
+			stdout,
+			stderr
+		}));
+		child.stdin.on("error", () => {});
+		child.stdin.end(input ?? "");
+	});
+}
+/**
+* The tail of what a command said, for an error: its errors, which wrangler
+* writes to stderr, else what it printed; without its banner or log line,
+* nor the colours wrangler gives them even in a pipe.
+*/
+function said(run) {
+	return (run.stderr.trim() === "" ? run.stdout : run.stderr).replace(/\x1b\[[0-9;]*m/g, "").split("\n").filter((line) => line.trim() !== "" && !line.startsWith("🪵")).slice(-3).map((line) => line.trim()).join(" ");
+}
+/**
+* A token for Cloudflare's API: CLOUDFLARE_API_TOKEN when set, else
+* wrangler's own, after its browser login when there is none yet.
+*/
+async function cloudflareToken(wrangler, step, link) {
+	const read = async () => {
+		const run = await wrangler([
+			"auth",
+			"token",
+			"--json"
+		]);
+		if (run.code !== 0) return null;
+		try {
+			return JSON.parse(run.stdout).token ?? null;
+		} catch {
+			return null;
+		}
+	};
+	const ready = await read();
+	if (ready !== null) return ready;
+	await login(wrangler, step, link);
+	const token = await read();
+	if (token === null) throw new Error("signed in to Cloudflare, but wrangler gave no token");
+	return token;
+}
+/** Where a sign-in link sends the browser back to: its `redirect_uri`, when that is on this machine. */
+function callbackOf(link) {
+	try {
+		const redirect = new URL(new URL(link).searchParams.get("redirect_uri") ?? "");
+		if (redirect.protocol === "http:" && (redirect.hostname === "localhost" || redirect.hostname === "127.0.0.1")) return redirect;
+	} catch {}
+	return new URL(WRANGLER_CALLBACK);
+}
+/**
+* wrangler's browser login, finished by whichever comes first: its own
+* listener hearing the browser's callback, or the callback address pasted
+* here, which setup requests itself, on this machine, where the listener is.
+*/
+async function login(wrangler, step, link) {
+	step.note("Cloudflare: approve the sign-in in your browser");
+	let callback = null;
+	let output = "";
+	let ended = false;
+	let linked;
+	const linkPrinted = new Promise((resolve) => linked = resolve);
+	const done = new AbortController();
+	const stop = new AbortController();
+	const login = wrangler(["login", "--browser=false"], {
+		signal: stop.signal,
+		onOutput: (text) => {
+			output += text;
+			const address = /Visit this link to authenticate: (\S+)\r?\n/.exec(output)?.[1];
+			if (address === void 0 || callback !== null) return;
+			callback = callbackOf(address);
+			linked();
+			link("If no browser opened, sign in to Cloudflare at", address);
+			openBrowser(address);
+		}
+	}).finally(() => {
+		ended = true;
+		linked();
+		done.abort();
+	});
+	try {
+		await step.paste("If your browser shows an error at a localhost address, paste that address here:", async (text) => {
+			await linkPrinted;
+			const listening = callback ?? new URL(WRANGLER_CALLBACK);
+			const url = localCallback(text, Number(listening.port), listening.pathname, ["code", "state"]);
+			if (typeof url === "string") return url;
+			url.host = listening.host;
+			return replay(url, () => ended);
+		}, done.signal);
+		const run = await login;
+		if (run.code !== 0) throw new Error(`Cloudflare sign-in failed: ${said(run)}`);
+	} finally {
+		if (!ended) {
+			stop.abort();
+			await login.catch(() => {});
+		}
+	}
+}
+/** How long a pasted address is tried again while wrangler, still running, does not answer at it: it prints its link before it listens. */
+const REPLAY_FOR_MS = 2e3;
+/**
+* Request `url` here, for wrangler's listener, on a connection that closes
+* after it, so that wrangler, done, exits at once. Null once it answered;
+* else why not, for the person pasting to read, and paste again.
+*/
+async function replay(url, ended) {
+	for (const start = Date.now();;) try {
+		await new Promise((resolve, reject) => get(url, { agent: false }, (response) => response.resume().on("end", resolve)).on("error", reject));
+		return null;
+	} catch {
+		if (ended()) return "wrangler's sign-in has ended, and nothing waits at that address: run setup again";
+		if (Date.now() - start >= REPLAY_FOR_MS) return "wrangler is not answering at that address yet: paste it again in a moment";
+		await new Promise((resolve) => setTimeout(resolve, 100));
+	}
+}
+var CloudflareError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/** Cloudflare's API, under a token it never logs nor shows. */
+var CloudflareApi = class {
+	#token;
+	#base;
+	/** `base`, Cloudflare's, or what CLOUDFLARE_API_BASE_URL names, as wrangler reads it too. */
+	constructor(token, base = process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4") {
+		this.#token = token;
+		this.#base = base.replace(/\/$/, "");
+	}
+	async #send(method, path, body) {
+		const response = await fetch(`${this.#base}${path}`, {
+			method,
+			headers: {
+				authorization: `Bearer ${this.#token}`,
+				"content-type": "application/json"
+			},
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+		const answer = await response.json().catch(() => ({}));
+		if (!response.ok || answer.success === false) {
+			const why = (answer.errors ?? []).map((error) => `${error.message ?? "error"}${error.code === void 0 ? "" : ` (${error.code})`}`).join("; ");
+			throw new CloudflareError(`Cloudflare answered ${response.status} to ${method} ${path.replace(/\?.*$/, "")}${why === "" ? "" : `: ${why}`}`, response.status);
+		}
+		return {
+			result: answer.result,
+			pages: answer.result_info?.total_pages ?? 1
+		};
+	}
+	async #call(method, path, body) {
+		return (await this.#send(method, path, body)).result;
+	}
+	/** Every page of a list: Cloudflare gives 50 at most to a page. */
+	async #all(path) {
+		const all = [];
+		for (let page = 1;; page += 1) {
+			const { result, pages } = await this.#send("GET", `${path}${path.includes("?") ? "&" : "?"}per_page=50&page=${page}`);
+			all.push(...result);
+			if (page >= pages || result.length === 0) return all;
+		}
+	}
+	accounts() {
+		return this.#all("/accounts");
+	}
+	zones(account) {
+		return this.#all(`/zones?account.id=${account}`);
+	}
+	/** The signed-in person's email, when the token may read it. */
+	async email() {
+		try {
+			return (await this.#call("GET", "/user")).email ?? null;
+		} catch {
+			return null;
+		}
+	}
+	hyperdriveConfigs(account) {
+		return this.#call("GET", `/accounts/${account}/hyperdrive/configs`);
+	}
+	/** A Hyperdrive config with caching off: a revoked session must stop at once. The password goes in the body. */
+	async createHyperdrive(account, name, origin) {
+		return (await this.#call("POST", `/accounts/${account}/hyperdrive/configs`, {
+			name,
+			origin: {
+				scheme: "postgres",
+				...origin
+			},
+			caching: { disabled: true }
+		})).id;
+	}
+	async updateHyperdrive(account, id, name, origin) {
+		await this.#call("PUT", `/accounts/${account}/hyperdrive/configs/${id}`, {
+			name,
+			origin: {
+				scheme: "postgres",
+				...origin
+			},
+			caching: { disabled: true }
+		});
+	}
+	async disableCaching(account, id) {
+		await this.#call("PATCH", `/accounts/${account}/hyperdrive/configs/${id}`, { caching: { disabled: true } });
+	}
+	/** What a call answers, or null when what it names does not exist. */
+	async #found(path) {
+		try {
+			return await this.#call("GET", path);
+		} catch (error) {
+			if (error instanceof CloudflareError && error.status === 404) return null;
+			throw error;
+		}
+	}
+	/** The names of a Worker's secrets, never their values; null when the Worker does not exist yet. */
+	async secretNames(account, script) {
+		const listed = await this.#found(`/accounts/${account}/workers/scripts/${script}/secrets`);
+		return listed === null ? null : listed.map(({ name }) => name);
+	}
+	/** A Worker's bindings, which say whose it is; null when there is no such Worker. */
+	async bindings(account, script) {
+		const settings = await this.#found(`/accounts/${account}/workers/scripts/${script}/settings`);
+		return settings === null ? null : settings.bindings ?? [];
+	}
+};
+/** A login's URL as a Hyperdrive origin: Hyperdrive makes its own TLS connection, so the URL's parameters stay behind. */
+function originOf(url) {
+	const parsed = new URL(url);
+	return {
+		host: parsed.hostname,
+		port: Number(parsed.port || 5432),
+		database: decodeURIComponent(parsed.pathname.slice(1)),
+		user: decodeURIComponent(parsed.username),
+		password: decodeURIComponent(parsed.password)
+	};
+}
+/**
+* Deploy a Worker with wrangler, under the account chosen. `secrets`, when
+* given, go on wrangler's stdin, as its secrets file: never in a file, nor
+* in its arguments. A new Worker needs them at its first deploy.
+*/
+async function deployWorker(wrangler, config, account, secrets) {
+	const some = Object.keys(secrets).length > 0;
+	const run = await wrangler([
+		"deploy",
+		"-c",
+		config,
+		...some ? ["--secrets-file", "/dev/stdin"] : []
+	], {
+		input: some ? JSON.stringify(secrets) : void 0,
+		env: { CLOUDFLARE_ACCOUNT_ID: account }
+	});
+	if (run.code !== 0) throw new Error(`wrangler could not deploy ${config}: ${said(run)}`);
+}
+//#endregion
+//#region src/github-app.ts
+const GITHUB = {
+	web: "https://github.com",
+	api: "https://api.github.com"
+};
+/** GitHub's limit on an app's name. */
+const NAME_LIMIT = 34;
+/** `coffre-` and the address, its dots as dashes, as long as GitHub allows: unique, as GitHub needs, and editable on its page. */
+function appName(address) {
+	return `coffre-${address.replace(/\./g, "-")}`.slice(0, NAME_LIMIT).replace(/-+$/, "");
+}
+/**
+* The app coffre's sign-in needs: private, its callback coffre's, the one
+* permission to read a person's email addresses, and no webhook. A
+* manifest names that permission `emails`, as GitHub's form does, not
+* `email_addresses`, as its API does: GitHub refuses the latter here.
+*/
+function appManifest(publicUrl, redirect) {
+	return {
+		name: appName(new URL(publicUrl).host),
+		url: publicUrl,
+		redirect_url: redirect,
+		callback_urls: [`${publicUrl}/auth/callback/github`],
+		public: false,
+		default_permissions: { emails: "read" },
+		hook_attributes: {
+			url: publicUrl,
+			active: false
+		}
+	};
+}
+const escape = (text) => text.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+/** A page of a few words, in the browser's own type. */
+function page(title, body) {
+	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${title}</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:20vh auto;padding:0 1.5rem;color:#1f2328}h1{font-size:1.25rem;font-weight:600}p{color:#59636e}button{font:inherit;padding:.4rem 1rem}</style>
+${body}`;
+}
+/** The page that posts the manifest to GitHub, at once. */
+function manifestPage(github, manifest, state) {
+	const action = `${github.web}/settings/apps/new?state=${encodeURIComponent(state)}`;
+	return page("coffre: to GitHub", `<h1>Taking you to GitHub</h1><p>to create coffre's GitHub App.</p>
+<form method="post" action="${escape(action)}"><input type="hidden" name="manifest" value="${escape(JSON.stringify(manifest))}"><noscript><button>Continue to GitHub</button></noscript></form>
+<script>document.forms[0].submit()<\/script>`);
+}
+/**
+* The same form as an address, for a browser on another machine: as short
+* as it can be, and readable, so that it plainly goes to GitHub and nowhere
+* else. A browser takes it typed or pasted, never from a link.
+*/
+function manifestAddress(github, manifest, state) {
+	const action = `${github.web}/settings/apps/new?state=${encodeURIComponent(state)}`;
+	const value = JSON.stringify(manifest).replace(/&/g, "&amp;").replace(/'/g, "&#39;");
+	return `data:text/html,${`<form method=post action="${escape(action)}"><input type=hidden name=manifest value='${value}'></form><script>document.forms[0].submit()<\/script>`.replace(/[%#\s]/g, (c) => encodeURIComponent(c))}`;
+}
+/** GitHub's code for the app it made, as the app's client ID and secret. The code lasts an hour, and works once. */
+async function convert(github, code) {
+	const response = await fetch(`${github.api}/app-manifests/${encodeURIComponent(code)}/conversions`, {
+		method: "POST",
+		headers: {
+			accept: "application/vnd.github+json",
+			"user-agent": "coffre-setup",
+			"x-github-api-version": "2022-11-28"
+		}
+	});
+	const made = await response.json().catch(() => ({}));
+	if (!response.ok || made.client_id === void 0 || made.client_secret === void 0) throw new Error(`GitHub answered ${response.status}${made.message === void 0 ? "" : `: ${made.message}`}`);
+	return {
+		clientId: made.client_id,
+		clientSecret: made.client_secret,
+		slug: made.slug ?? "",
+		url: made.html_url ?? ""
+	};
+}
+function listen(server) {
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => resolve(server.address().port));
+	});
+}
+/**
+* coffre's GitHub App, made in the browser: on this machine, through
+* setup's page and its callback; on another, through the data: address,
+* and the callback's address pasted back. Whichever comes first.
+*/
+async function createGitHubApp(step, say, github, publicUrl) {
+	const state = randomBytes(16).toString("base64url");
+	const done = new AbortController();
+	let app = null;
+	let manifest = {};
+	/** The way back from GitHub, by either road: the app, or why not. */
+	const take = async (url) => {
+		if (app !== null) return null;
+		if (url.searchParams.get("state") !== state) return "that address is from another run of setup: create the app from this one";
+		try {
+			app = await convert(github, url.searchParams.get("code"));
+		} catch (error) {
+			return `GitHub did not take its code: ${error.message}`;
+		}
+		done.abort();
+		return null;
+	};
+	const server = createServer((request, response) => {
+		const url = new URL(request.url ?? "/", "http://127.0.0.1");
+		const send = (status, html) => response.writeHead(status, { "content-type": "text/html; charset=utf-8" }).end(html);
+		if (url.pathname === "/") return send(200, manifestPage(github, manifest, state));
+		if (url.pathname !== "/created") return send(404, page("coffre", "<h1>Not here</h1>"));
+		take(url).then((error) => error === null ? send(200, page("coffre's GitHub App", "<h1>coffre's GitHub App is made</h1><p>Back to your terminal: setup carries on there.</p>")) : send(400, page("coffre", `<h1>Not made</h1><p>${escape(error)}</p>`)));
+	});
+	const port = await listen(server);
+	try {
+		const here = `http://127.0.0.1:${port}/`;
+		manifest = appManifest(publicUrl, `${here}created`);
+		say.aside("coffre's GitHub App may read the email addresses of whoever signs in with it, and nothing else.");
+		say.link("If no browser opened, create it at", here);
+		say.link("From a browser on another machine, open this address instead:", manifestAddress(github, manifest, state));
+		openBrowser(here);
+		step.note("GitHub: create coffre's app in your browser; its name is yours to change");
+		await step.paste("If your browser shows an error at a localhost address, paste that address here:", async (text) => {
+			const url = localCallback(text, port, "/created", ["code", "state"]);
+			return typeof url === "string" ? url : take(url);
+		}, done.signal);
+		return app;
+	} finally {
+		server.closeAllConnections();
+		server.close();
+	}
+}
+//#endregion
+//#region src/workers.ts
+const COMPONENTS = ["app", "vault"];
+/** How long a new deployment has to answer, its domain's certificate perhaps still on its way. */
+const ANSWER_WITHIN_MS = 9e4;
+/** An address such as secrets.example.com, from what was typed: no scheme, no path, lower case. */
+function addressOf(answer) {
+	return answer.trim().replace(/^https?:\/\//i, "").replace(/[/?#].*$/, "").toLowerCase();
+}
+/** Why an address will not do: not a host name, or under none of the account's domains. Null when it will. */
+function addressProblem(address, zones) {
+	if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(address)) return "an address such as secrets.example.com";
+	if (!zones.some((zone) => address === zone || address.endsWith(`.${zone}`))) return `not under a domain of this account: ${listed(zones, "or")}`;
+	return null;
+}
+/** A vault ID as setup makes them, which names one vault; not the template's `vault-1`, which any deployment may keep. */
+const MADE_VAULT_ID = /^vault-\d{4}-\d{2}-\d{2}-[a-z2-7]{6}$/;
+function recordsOf(workers) {
+	const id = workers.vault.vars.VAULT_KEY_ID;
+	return {
+		hyperdrive: {
+			app: workers.app.hyperdrive,
+			vault: workers.vault.hyperdrive
+		},
+		vaultKeyId: id !== void 0 && MADE_VAULT_ID.test(id) ? id : null
+	};
+}
+/** Whether a Worker that exists is this deployment's: it binds a Hyperdrive config this directory records, or, the vault, its vault ID. */
+function isOurs(component, bindings, records) {
+	const config = records.hyperdrive[component];
+	if (config !== null && bindings.some(({ type, id }) => type === "hyperdrive" && id === config)) return true;
+	return component === "vault" && records.vaultKeyId !== null && bindings.some(({ type, name, text }) => type === "plain_text" && name === "VAULT_KEY_ID" && text === records.vaultKeyId);
+}
+/** Whether a Hyperdrive config points at this run's database: the same host, the same database. */
+function sameDatabase(origin, administrator) {
+	return origin.host === administrator.hostname && origin.database === decodeURIComponent(administrator.pathname.slice(1));
+}
+/**
+* A Worker's Hyperdrive config: the one this directory records; else one
+* named after the Worker that points at this run's database, made by a
+* run that stopped before recording it. One under the name that points
+* elsewhere is another deployment's.
+*/
+function ourConfig(configs, name, recorded, administrator) {
+	return configs.find(({ id }) => id === recorded) ?? configs.find((config) => config.name === name && sameDatabase(config.origin, administrator));
+}
+/**
+* A name for this deployment, from its address: `coffre-` and its first
+* label, `coffre-secrets` for secrets.example.com, the prefix not doubled:
+* `coffre-try` for coffre-try.example.com.
+*/
+function nameFrom(address) {
+	const label = address.split(".")[0].replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+	return (label === "coffre" || label.startsWith("coffre-") ? label : `coffre-${label}`.replace(/-$/, "")).slice(0, 57).replace(/-+$/, "");
+}
+/** Why a deployment's name will not do as a Worker's, with `-vault` after it for the vault's. Null when it will. */
+function nameProblem(name) {
+	return /^[a-z0-9]([a-z0-9-]{0,55}[a-z0-9])?$/.test(name) ? null : "lower-case letters, digits and dashes, at most 57";
+}
+/** Why a list of root admins will not do. Null when it will. */
+function adminsProblem(answer) {
+	const wrong = answer.split(",").map((email) => email.trim()).filter((email) => !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email));
+	return wrong.length === 0 ? null : `not an email: ${wrong.map((email) => email || "(empty)").join(", ")}`;
+}
+/** What under these names, on the account, is another deployment's: its Workers, and its Hyperdrive configs. */
+async function othersUnder(api, account, configs, names, records, administrator) {
+	const others = [];
+	for (const component of COMPONENTS) {
+		const bindings = await api.bindings(account, names[component]);
+		if (bindings !== null && !isOurs(component, bindings, records)) others.push(`the Worker ${names[component]}`);
+		const named = configs.find(({ name }) => name === names[component]);
+		if (named !== void 0 && named !== ourConfig(configs, names[component], records.hyperdrive[component], administrator)) others.push(`the Hyperdrive config ${names[component]}`);
+	}
+	return others;
+}
+var Cloudflare = class Cloudflare {
+	#dir;
+	#wrangler;
+	#found;
+	#administrator;
+	#github;
+	/** Each secret this run handles, to take out of any error shown. */
+	#secrets;
+	workers;
+	address;
+	rootAdmins;
+	/** The keys this run makes, for the Workers without theirs, once `checkKeys` has run. */
+	keys = null;
+	#missing = {
+		app: false,
+		vault: false
+	};
+	/** The GitHub App's client secret, when this run has it to install. */
+	#clientSecret = null;
+	/** What this run changed in each wrangler.jsonc, in a few words each. */
+	#wrote = {
+		app: /* @__PURE__ */ new Set(),
+		vault: /* @__PURE__ */ new Set()
+	};
+	constructor(dir, wrangler, workers, found, administrator, answers, secrets) {
+		this.#dir = dir;
+		this.#wrangler = wrangler;
+		this.workers = workers;
+		this.#found = found;
+		this.#administrator = administrator;
+		this.address = answers.address;
+		this.rootAdmins = answers.rootAdmins;
+		this.#secrets = secrets;
+		const vars = workers.app.vars;
+		this.#github = {
+			web: vars.GITHUB_URL ?? GITHUB.web,
+			api: vars.GITHUB_API_URL ?? GITHUB.api
+		};
+	}
+	/**
+	* Sign in to Cloudflare, choose the account, read what is there, and ask
+	* what setup cannot know: coffre's address, its root admins, and, when
+	* another deployment has its names, a name of its own.
+	*/
+	static async connect(dir, out, keys, describe, secrets, administrator) {
+		const s = style(out);
+		const workers = {
+			app: readWorker(dir, "app/wrangler.jsonc"),
+			vault: readWorker(dir, "vault/wrangler.jsonc")
+		};
+		const records = recordsOf(workers);
+		const wrangler = deploymentWrangler(dir);
+		const steps = new Steps(out, ["Sign in to Cloudflare"], () => keys, describe);
+		let found;
+		try {
+			await steps.run(0, async (step) => {
+				const token = await cloudflareToken(wrangler, step, (label, address) => steps.link(label, address));
+				secrets.push(token);
+				const api = new CloudflareApi(token);
+				step.note("Reading your Cloudflare account");
+				const accounts = await api.accounts();
+				if (accounts.length === 0) throw new Error("this Cloudflare login has no account");
+				const account = accounts.find(({ id }) => id === workers.app.accountId) ?? (accounts.length === 1 ? accounts[0] : accounts[await step.choose("Which Cloudflare account?", accounts.map(({ name }) => name))]);
+				const [zones, configs, email] = await Promise.all([
+					api.zones(account.id),
+					api.hyperdriveConfigs(account.id),
+					api.email()
+				]);
+				if (zones.length === 0) throw new Error(`the account ${account.name} has no domain, and coffre needs one for its address: add one to Cloudflare first`);
+				const names = {
+					app: workers.app.name,
+					vault: workers.vault.name
+				};
+				found = {
+					api,
+					account,
+					zones,
+					configs,
+					others: await othersUnder(api, account.id, configs, names, records, administrator),
+					secrets: {
+						app: /* @__PURE__ */ new Set(),
+						vault: /* @__PURE__ */ new Set()
+					},
+					email
+				};
+				return `Signed in to Cloudflare${email === null ? "" : ` as ${email}`}, account ${account.name}`;
+			});
+		} finally {
+			steps.end();
+		}
+		const zones = found.zones.map(({ name }) => name);
+		const url = workers.app.vars.PUBLIC_URL;
+		const address = addressOf(await textLine(keys, out, s, "coffre's address", zones.length === 1 ? `under ${zones[0]}` : `under ${listed(zones, "or")}`, {
+			initial: placeholder(url) ? "" : new URL(url).host,
+			check: (answer) => addressProblem(addressOf(answer), zones)
+		}));
+		if (found.others.length > 0) {
+			const one = found.others.length === 1;
+			out.write(`${s.dim(paragraph(out, `On this account, ${listed(found.others, "and")} ${one ? "is" : "are"} another deployment's. Setup leaves ${one ? "it as it is" : "them as they are"}.`, 2))}\n`);
+			const name = await textLine(keys, out, s, "This deployment's name", "its Workers are <name> and <name>-vault", {
+				initial: nameFrom(address),
+				check: async (answer) => {
+					const problem = nameProblem(answer);
+					if (problem !== null) return problem;
+					const others = await othersUnder(found.api, found.account.id, found.configs, {
+						app: answer,
+						vault: `${answer}-vault`
+					}, records, administrator);
+					return others.length === 0 ? null : `${listed(others, "and")}: another deployment's too`;
+				}
+			});
+			workers.app.name = name;
+			workers.vault.name = `${name}-vault`;
+		}
+		for (const component of COMPONENTS) found.secrets[component] = new Set(await found.api.secretNames(found.account.id, workers[component].name) ?? []);
+		const admins = workers.vault.vars.ROOT_ADMINS;
+		const prefilled = placeholder(admins) && found.email !== null;
+		const rootAdmins = (await textLine(keys, out, s, "Root admins", "their GitHub emails, comma-separated: the first people in", {
+			initial: placeholder(admins) ? found.email ?? "" : admins,
+			note: `${prefilled ? "That's your Cloudflare email. " : ""}Each must be an email on the GitHub account its admin will sign in with, or root is locked out.`,
+			check: adminsProblem
+		})).split(",").map((email) => email.trim()).join(",");
+		out.write("\n");
+		return new Cloudflare(dir, wrangler, workers, found, administrator, {
+			address,
+			rootAdmins
+		}, secrets);
+	}
+	/** A Worker's Hyperdrive config, when there is one of this deployment's (`ourConfig`). */
+	#config(component) {
+		const worker = this.workers[component];
+		return ourConfig(this.#found.configs, worker.name, worker.hyperdrive, this.#administrator);
+	}
+	/**
+	* Whether a login needs a new password: Hyperdrive must have it, and the
+	* database keeps only its verifier. So when its config is missing, or
+	* points elsewhere, or when asked.
+	*/
+	needsPassword(component, administrator, login) {
+		const origin = this.#config(component)?.origin;
+		return origin === void 0 || origin.host !== administrator.hostname || (origin.port ?? 5432) !== Number(administrator.port || 5432) || origin.database !== decodeURIComponent(administrator.pathname.slice(1)) || origin.user !== login;
+	}
+	/**
+	* Stop before a login that exists gets a new password, when it is also
+	* the login of another deployment's Hyperdrive config, on the same
+	* server: a login is the server's, not a database's, and that deployment
+	* would be cut off. On PlanetScale, a login names its branch, and never is.
+	*/
+	refuseShared(component, administrator, login) {
+		const ours = new Set(COMPONENTS.map((each) => this.#config(each)));
+		const other = this.#found.configs.find((config) => !ours.has(config) && config.origin.host === administrator.hostname && (config.origin.port ?? 5432) === Number(administrator.port || 5432) && config.origin.user === login);
+		if (other === void 0) return;
+		throw new Error(`${login} is also the login of the Hyperdrive config ${other.name}, another deployment's, on this database server: a new password for the ${component}'s config would cut that deployment off. Two deployments can't share a server's logins: give this one a server of its own. Nothing was changed.`);
+	}
+	/**
+	* The keys this run makes: one for each Worker without its own, for a
+	* database that holds no data yet. One that does has its keys already,
+	* and a new one would leave what it holds unreadable: setup stops, before
+	* changing anything.
+	*/
+	checkKeys(used) {
+		const missing = {
+			app: !this.#found.secrets.app.has("APP_KEY"),
+			vault: !this.#found.secrets.vault.has("VAULT_KEY")
+		};
+		for (const component of COMPONENTS) {
+			if (!used || !missing[component]) continue;
+			const { name, path } = this.workers[component];
+			const key = component === "app" ? "APP_KEY" : "VAULT_KEY";
+			throw new Error(`The ${component} Worker ${name} has no ${key}, but the database already holds data, which needs the key it was set up with. Put that key back, with pnpm exec wrangler secret put ${key} -c ${path}, then run setup again. Setup never makes a new key for a database in use.`);
+		}
+		this.#missing = missing;
+		if (missing.app || missing.vault) {
+			this.keys = generateKeys();
+			this.#secrets.push(this.keys.APP_KEY, this.keys.VAULT_KEY);
+		}
+	}
+	/** What each Cloudflare step does while it runs. */
+	static TITLES = [
+		"Point Hyperdrive at the database",
+		"Make coffre's GitHub App",
+		"Fill in app/ and vault/wrangler.jsonc"
+	];
+	/**
+	* Make `changes`, each named in a few words, to a Worker's wrangler.jsonc,
+	* and with them, what this deployment is: its account, its names, and, the
+	* app, the vault it binds.
+	*/
+	#edit(component, changes) {
+		const worker = this.workers[component];
+		const all = [
+			{
+				path: ["name"],
+				value: worker.name,
+				what: "its name"
+			},
+			{
+				path: ["account_id"],
+				value: this.#found.account.id,
+				after: "name",
+				what: "the account"
+			},
+			...component === "app" ? [{
+				path: [
+					"services",
+					0,
+					"service"
+				],
+				value: this.workers.vault.name,
+				what: "the vault's name"
+			}] : [],
+			...changes
+		];
+		const changed = editWorker(this.#dir, worker.path, all);
+		all.forEach(({ what }, i) => changed[i] && this.#wrote[component].add(what));
+		worker.accountId = this.#found.account.id;
+	}
+	/** A Hyperdrive config for each login, made, given its new password, or kept; with caching off, always. */
+	async hyperdrive(logins) {
+		const { api, account } = this.#found;
+		const width = Math.max(...COMPONENTS.map((component) => this.workers[component].name.length)) + 2;
+		const details = [];
+		for (const component of COMPONENTS) {
+			const { name } = this.workers[component];
+			const login = logins[component];
+			let config = this.#config(component);
+			let what;
+			if (login.url !== null) {
+				const origin = originOf(login.url);
+				if (config === void 0) {
+					config = {
+						id: await api.createHyperdrive(account.id, name, origin),
+						name,
+						origin
+					};
+					what = `made, for ${login.login}`;
+				} else {
+					await api.updateHyperdrive(account.id, config.id, name, origin);
+					what = `given ${login.login}'s new password`;
+				}
+			} else if (config.caching?.disabled !== true) {
+				await api.disableCaching(account.id, config.id);
+				what = "kept, its caching turned off";
+			} else what = "kept";
+			details.push(`${name.padEnd(width)}${what}`);
+			this.#edit(component, [{
+				path: [
+					"hyperdrive",
+					0,
+					"id"
+				],
+				value: config.id,
+				what: "Hyperdrive"
+			}]);
+			this.workers[component].hyperdrive = config.id;
+		}
+		return {
+			text: `Hyperdrive configs ${this.workers.app.name} and ${this.workers.vault.name}, caching off`,
+			details
+		};
+	}
+	/**
+	* The GitHub App people sign in with: kept when the app Worker has its
+	* secret; made, in the browser, when there is none yet. One made before
+	* whose secret never reached Cloudflare takes a new secret, from its page.
+	*/
+	async github(step, say) {
+		const id = this.workers.app.vars.GITHUB_CLIENT_ID;
+		const url = `https://${this.address}`;
+		const moved = !placeholder(this.workers.app.vars.PUBLIC_URL) && this.workers.app.vars.PUBLIC_URL !== url;
+		if (!placeholder(id) && this.#found.secrets.app.has("GITHUB_CLIENT_SECRET")) return {
+			text: `Kept coffre's GitHub App, client ID ${id}`,
+			details: moved ? [`On GitHub, change its callback URL to ${url}/auth/callback/github`] : []
+		};
+		if (!placeholder(id)) {
+			say.aside(`coffre's GitHub App, client ID ${id}, has no client secret on Cloudflare yet.`);
+			say.link("Generate a new one on its page, under", `${this.#github.web}/settings/apps`);
+			step.note("GitHub: a new client secret for coffre's app");
+			await step.paste("Paste the new client secret, hidden as you paste it:", async (text) => {
+				if (!/^\S{20,}$/.test(text)) return "that is not a client secret: copy it whole, from the app's page";
+				this.#clientSecret = text;
+				this.#secrets.push(text);
+				return null;
+			}, new AbortController().signal);
+			return {
+				text: `Took a new client secret for coffre's GitHub App, client ID ${id}`,
+				details: []
+			};
+		}
+		const app = await createGitHubApp(step, say, this.#github, url);
+		this.#clientSecret = app.clientSecret;
+		this.#secrets.push(app.clientSecret);
+		this.#edit("app", [{
+			path: ["vars", "GITHUB_CLIENT_ID"],
+			value: app.clientId,
+			what: "GitHub's client ID"
+		}]);
+		this.workers.app.vars.GITHUB_CLIENT_ID = app.clientId;
+		return {
+			text: `Made coffre's GitHub App, ${app.slug}`,
+			details: app.url === "" ? [] : [app.url]
+		};
+	}
+	/** The rest of each wrangler.jsonc: the address and its route, the root admins, and the vault ID of a new vault key. */
+	write() {
+		const url = `https://${this.address}`;
+		const app = this.workers.app;
+		const route = {
+			pattern: this.address,
+			custom_domain: true
+		};
+		this.#edit("app", [{
+			path: ["vars", "PUBLIC_URL"],
+			value: url,
+			what: "the address"
+		}, app.route === null ? {
+			path: ["routes"],
+			value: [route],
+			after: "workers_dev",
+			what: "its custom domain"
+		} : {
+			path: ["routes", 0],
+			value: route,
+			what: "its custom domain"
+		}]);
+		this.#edit("vault", [{
+			path: ["vars", "ROOT_ADMINS"],
+			value: this.rootAdmins,
+			what: "the root admins"
+		}, ...this.keys !== null && this.#missing.vault ? [{
+			path: ["vars", "VAULT_KEY_ID"],
+			value: this.keys.VAULT_KEY_ID,
+			what: "the vault ID"
+		}] : []]);
+		const changed = COMPONENTS.filter((component) => this.#wrote[component].size > 0);
+		const files = listed(changed.map((component) => this.workers[component].path), "and");
+		return changed.length === 0 ? "app/ and vault/wrangler.jsonc, as they were" : {
+			text: `Filled in ${files}`,
+			details: changed.map((component) => `${component.padEnd(7)}${listed([...this.#wrote[component]], "and")}`)
+		};
+	}
+	/**
+	* The keys to save, before they go to Cloudflare: only the ones this run
+	* made. A set half installed, or a vault ID setup wrote for a key the
+	* vault never got, says an earlier run showed keys that never reached
+	* Cloudflare: these replace them.
+	*/
+	screen() {
+		const values = keyValues(this.keys);
+		const app = this.#missing.app ? values.app : [];
+		const vault = this.#missing.vault ? values.vault : [];
+		const one = app.length + vault.length === 1;
+		const where = [...this.#missing.app ? ["APP_KEY goes in the app Worker"] : [], ...this.#missing.vault ? [`VAULT_KEY ${this.#missing.app ? "" : "goes "}in the vault Worker`] : []];
+		const before = this.#missing.app !== this.#missing.vault || this.#missing.vault && /^vault-\d{4}-\d{2}-\d{2}-[a-z2-7]{6}$/.test(this.workers.vault.vars.VAULT_KEY_ID ?? "");
+		return {
+			title: "coffre setup",
+			intro: `Save ${one ? "it" : "each one"} in your password manager now${before ? `, in place of ${one ? "the one" : "any"} an earlier run showed, which never reached Cloudflare` : ""}. Next, setup gives ${one ? "it" : "them"} to Cloudflare, which never shows ${one ? "it" : "them"} again.`,
+			sections: [...app.length > 0 ? [{
+				title: "App",
+				values: app
+			}] : [], ...vault.length > 0 ? [{
+				title: "Vault",
+				values: vault
+			}] : []],
+			guide: [{
+				title: "On Cloudflare",
+				lines: [
+					`${listed(where, "and")}, as ${where.length === 1 ? "a secret" : "secrets"}: setup puts ${where.length === 1 ? "it" : "them"} there as it deploys, next.`,
+					...this.#missing.vault ? ["VAULT_KEY_ID is in vault/wrangler.jsonc already."] : [],
+					"Cloudflare never shows a secret again: your password manager holds the only copy. A restored database can't be read without the vault key."
+				]
+			}]
+		};
+	}
+	/** Deploy the vault, then the app, which binds to it, each with the secrets it lacks; then wait for coffre to answer. */
+	async deploy(out, describe) {
+		const url = `https://${this.address}`;
+		const steps = new Steps(out, [
+			"Deploy the vault",
+			"Deploy the app",
+			`Wait for ${url} to answer`
+		], () => null, describe);
+		const account = this.#found.account.id;
+		let answered = false;
+		try {
+			await steps.run(0, async () => {
+				const secrets = this.#missing.vault ? { VAULT_KEY: this.keys.VAULT_KEY } : {};
+				await deployWorker(this.#wrangler, this.workers.vault.path, account, secrets);
+				return `Deployed the vault, ${this.workers.vault.name}${this.#missing.vault ? ", with its key" : ""}`;
+			});
+			await steps.run(1, async () => {
+				const secrets = {
+					...this.#missing.app ? { APP_KEY: this.keys.APP_KEY } : {},
+					...this.#clientSecret === null ? {} : { GITHUB_CLIENT_SECRET: this.#clientSecret }
+				};
+				await deployWorker(this.#wrangler, this.workers.app.path, account, secrets);
+				const what = [...this.#missing.app ? ["its key"] : [], ...this.#clientSecret === null ? [] : ["GitHub's secret"]];
+				return `Deployed the app, ${this.workers.app.name}${what.length === 0 ? "" : `, with ${listed(what, "and")}`}`;
+			});
+			await steps.run(2, async (step) => {
+				answered = await answers(`${url}/livez`, (seconds) => step.note(`Wait for ${url} to answer: its certificate can take a minute (${seconds}s)`));
+				return answered ? `coffre answers at ${url}` : {
+					text: `${url} does not answer yet`,
+					details: ["A new domain's certificate can take a few minutes more. Nothing else is left to do."]
+				};
+			});
+		} finally {
+			steps.end();
+		}
+		return url;
+	}
+};
+/** Whether `url` answers 200 within ANSWER_WITHIN_MS, asking every few seconds. */
+async function answers(url, waiting) {
+	const start = Date.now();
+	for (;;) {
+		try {
+			if ((await fetch(url, {
+				signal: AbortSignal.timeout(5e3),
+				redirect: "manual"
+			})).status === 200) return true;
+		} catch {}
+		const elapsed = Date.now() - start;
+		if (elapsed >= ANSWER_WITHIN_MS) return false;
+		waiting(Math.round(elapsed / 1e3));
+		await new Promise((resolve) => setTimeout(resolve, 3e3));
+	}
+}
+/** After the deploy: where coffre is, and what is left, with no secret in it. */
+function deployedSummary(cloudflare, out) {
+	const s = style(out);
+	const url = `https://${cloudflare.address}`;
+	const first = cloudflare.rootAdmins.split(",")[0];
+	return [
+		"",
+		`  ${s.green("✓")} ${s.bold(`coffre is at ${url}`)}`,
+		...cloudflare.keys === null ? [] : [s.dim(paragraph(out, "The keys shown are only in your password manager now, and in Cloudflare, which won't show them again.", 4))],
+		"",
+		`    ${s.bold("Next")}`,
+		row(out, s, "Sign in", `${url}, with GitHub, as ${first}.`),
+		row(out, s, "CLI", `coffre login ${url}`),
+		row(out, s, "Monitor", `${url}/readyz turns green at the first scheduled run, within 5 minutes.`),
+		s.dim(paragraph(out, "After every upgrade of coffre, pnpm migrate, then pnpm run deploy. docs/deploy.md has each step.", 4)),
+		"",
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/setup.ts
+/** Where the administrator's connection string comes from, when not from a hidden prompt. */
+const URL_VARIABLE = "COFFRE_SETUP_DATABASE_URL";
+/** The two runtime roles, as the migration names them, and the Hyperdrive config each gets on Workers. */
+const ROLES = {
+	app: "coffre_runtime",
+	vault: "coffre_vault_runtime"
+};
+const HYPERDRIVE = {
+	app: "coffre",
+	vault: "coffre-vault"
+};
+var SetupError = class extends Error {};
+/**
+* The name a role logs in as. On PlanetScale Postgres, a login names its
+* branch: the administrator connects as `postgres.<branch id>`, and every
+* role on that branch as `<role>.<branch id>`. Elsewhere, the role's name.
+*/
+function loginFor(role, administrator) {
+	const dot = administrator.indexOf(".");
+	return dot === -1 ? role : `${role}${administrator.slice(dot)}`;
+}
+/** The administrator's URL, as `login` with `password`: same host, database and TLS settings. */
+function loginUrl(administrator, login, password) {
+	const url = new URL(administrator.href);
+	url.username = encodeURIComponent(login);
+	url.password = password;
+	return url.href;
+}
+/**
+* A wrangler hyperdrive command that reads the URL at a silent prompt, so
+* that no password reaches the shell's history, and drops its parameters:
+* Hyperdrive connects over TLS itself, checking the certificate against
+* public CAs, and takes no `sslrootcert`. `${v%%[?]*}` holds in bash and
+* zsh alike.
+*/
+function hyperdriveCommand(target) {
+	return `read -rs COFFRE_DB_URL && pnpm exec wrangler hyperdrive ${target} --connection-string="\${COFFRE_DB_URL%%[?]*}"; unset COFFRE_DB_URL`;
+}
+/**
+* What Postgres keeps for a password under SCRAM-SHA-256 (RFC 5802 and
+* 7677), made here, so that the password itself never reaches the server,
+* nor its logs.
+*/
+function scramVerifier(password, salt = randomBytes(16), iterations = 4096) {
+	const salted = pbkdf2Sync(password, salt, iterations, 32, "sha256");
+	const stored = createHash("sha256").update(createHmac("sha256", salted).update("Client Key").digest()).digest();
+	const server = createHmac("sha256", salted).update("Server Key").digest();
+	return `SCRAM-SHA-256$${iterations}:${salt.toString("base64")}$${stored.toString("base64")}:${server.toString("base64")}`;
+}
+/** 24 random bytes, URL-safe: nothing to encode in a connection string. */
+function newPassword() {
+	return randomBytes(24).toString("base64url");
+}
+async function setup(args) {
+	const secrets = [];
+	const clean = (error) => redact(error instanceof Error ? error.message : String(error), secrets);
+	let options;
+	try {
+		options = parseOptions(args);
+	} catch (error) {
+		return fail(process.stderr, clean(error));
+	}
+	const terminal = options.json ? null : openTerminal();
+	if (!options.json && terminal === null) return fail(process.stderr, needsTerminal("coffre setup"));
+	const out = terminal?.out ?? process.stderr;
+	const s = style(out);
+	const questions = () => terminal?.keys ?? (process.stdin.isTTY ? process.stdin : null);
+	const dir = process.cwd();
+	let kind = deploymentKind(dir);
+	const offers = terminal !== null && process.platform !== "win32";
+	try {
+		const about = offers && (kind === "workers" || kind === "empty") ? "a deployment's database, keys and Cloudflare" : "a deployment's database logins, migrations and keys";
+		if (s.ansi) out.write(`\n  ${s.bold("coffre setup")}  ${s.dim(about)}\n\n`);
+		if (kind === "empty" && terminal !== null) kind = await scaffold(dir, terminal.keys, out, clean);
+		const text = await readAdministrator(out, s);
+		secrets.push(text);
+		const administrator = administratorUrl(text);
+		if (administrator.password !== "") secrets.push(administrator.password, decodeURIComponent(administrator.password));
+		let cloudflare = null;
+		if (offers && kind === "workers") {
+			if (await select(terminal.keys, out, s, "Set Cloudflare up too?", ["Yes: Hyperdrive, GitHub sign-in, the keys as secrets, and the deploy", "No, I'll do Cloudflare myself"]) === 0) cloudflare = await Cloudflare.connect(dir, out, terminal.keys, clean, secrets, administrator);
+		}
+		const result = await run(administrator, out, questions, {
+			resetPasswords: options.resetPasswords,
+			cloudflare
+		}, secrets, clean);
+		if (cloudflare !== null) {
+			if (cloudflare.keys !== null) await showSecrets(terminal, cloudflare.screen());
+			await cloudflare.deploy(out, clean);
+			out.write(deployedSummary(cloudflare, out));
+		} else if (options.json) {
+			jsonWarning(process.stderr, listed(shownNames(result), "and"));
+			process.stdout.write(`${JSON.stringify(asJson(result))}\n`);
+		} else if (result.keys === null && result.app.url === null && result.vault.url === null) out.write(nothingToSave(out));
+		else {
+			await showSecrets(terminal, setupScreen(result));
+			out.write(summary(result, out));
+		}
+	} catch (error) {
+		if (error instanceof Cancelled) return fail(out, "cancelled; nothing after the last step done was changed", 130);
+		if (!(error instanceof StepFailed)) return fail(out, clean(error));
+		process.exit(1);
+	} finally {
+		if (terminal !== null) release(terminal.keys);
+	}
+}
+function fail(out, message, code = 1) {
+	const s = style(out);
+	out.write(`${s.red("✗")} ${message}\n`);
+	process.exit(code);
+}
+function parseOptions(args) {
+	try {
+		const { values } = parseArgs({
+			args,
+			options: {
+				"reset-passwords": {
+					type: "boolean",
+					default: false
+				},
+				json: {
+					type: "boolean",
+					default: false
+				}
+			},
+			allowPositionals: false,
+			strict: true
+		});
+		return {
+			resetPasswords: values["reset-passwords"],
+			json: values.json
+		};
+	} catch {
+		const leaked = args.some((arg) => /postgres(ql)?:|@/i.test(arg));
+		throw new SetupError(`coffre setup takes only --reset-passwords and --json. It reads the administrator's connection string from a hidden prompt, ${URL_VARIABLE} or stdin, never from the command line, where the shell's history and other users can read it.` + (leaked ? " One of the arguments looks like one: change that password, which is in your shell history now." : ""));
+	}
+}
+/** The connection string: from the environment, from stdin when it is piped, or typed at a hidden prompt. */
+async function readAdministrator(out, s) {
+	const given = process.env[URL_VARIABLE];
+	delete process.env[URL_VARIABLE];
+	if (given !== void 0 && given.trim() !== "") return given.trim();
+	if (!process.stdin.isTTY) {
+		const line = readFileSync(0, "utf8").split("\n").find((candidate) => candidate.trim() !== "");
+		if (line === void 0) throw new SetupError(`no connection string: pipe it to stdin, or set ${URL_VARIABLE}`);
+		return line.trim();
+	}
+	const text = await hiddenLine(process.stdin, out, s, "The database administrator's connection string", "Hidden as you type. Your host's admin URL, such as PlanetScale's Connect page gives.");
+	if (text === "") throw new SetupError("no connection string given");
+	return text;
+}
+function administratorUrl(text) {
+	let url;
+	try {
+		url = new URL(text);
+	} catch {
+		throw new SetupError("that is not a connection string, such as postgresql://user:password@host:5432/database");
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") throw new SetupError("coffre setup needs a Postgres connection string, postgresql://…");
+	if (url.username === "" || url.hostname === "" || url.pathname.length <= 1) throw new SetupError("the connection string must name a user, a host and a database");
+	return url;
+}
+/** This CLI's version: the schema it migrates to, and the version of coffre a deployment it makes runs. */
+function cliVersion() {
+	return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+}
+/**
+* In an empty directory, a deployment of the kind chosen, its files written
+* as `coffre init` writes them and its packages installed; or none.
+*/
+async function scaffold(dir, keys, out, clean) {
+	const s = style(out);
+	const names = {
+		workers: "Cloudflare Workers",
+		node: "Node"
+	};
+	const empty = existsSync(join(dir, ".git")) ? "This directory holds only .git" : "This directory is empty";
+	const choice = await select(keys, out, s, `${empty}. Make a deployment of coffre here?`, [...KINDS.map((kind) => names[kind]), "No, only the database"]);
+	const kind = KINDS[choice];
+	if (kind === void 0) return "empty";
+	const steps = new Steps(out, [`Write a ${names[kind]} deployment`, "Install its packages"], () => null, clean);
+	try {
+		await steps.run(0, async () => `Wrote a ${names[kind]} deployment: ${init(kind, dir, cliVersion()).length} files`);
+		await steps.run(1, async () => {
+			await install(dir);
+			return "Installed its packages, with pnpm";
+		});
+	} finally {
+		steps.end();
+	}
+	out.write("\n");
+	return kind;
+}
+async function run(administrator, out, questions, options, secrets, clean) {
+	const { cloudflare } = options;
+	const user = decodeURIComponent(administrator.username);
+	const where = `${administrator.hostname}${decodeURIComponent(administrator.pathname)}`;
+	const version = cliVersion();
+	const steps = new Steps(out, [
+		`Connect to ${where}`,
+		`Check ${user} can create roles`,
+		"Make the two logins",
+		"Migrate the database",
+		"Check each login's rights",
+		...cloudflare === null ? [] : Cloudflare.TITLES
+	], questions, clean);
+	const step = (i, work) => steps.run(i, work);
+	const client = new esm_default.Client({
+		...postgresConnection(administrator.href),
+		application_name: "coffre-setup"
+	});
+	try {
+		await step(0, async () => {
+			await client.connect();
+			cloudflare?.checkKeys(await holdsData(client));
+			return `Connected to ${where} as ${user}`;
+		});
+		await step(1, async () => {
+			const [self] = (await client.query("SELECT rolsuper, rolcreaterole FROM pg_roles WHERE rolname = current_user")).rows;
+			if (!self?.rolsuper && !self?.rolcreaterole) throw new SetupError(`${user} cannot create roles: connect as the database's administrator, which has CREATEROLE`);
+			return `${user} can create roles`;
+		});
+		let logins;
+		await step(2, async (progress) => {
+			logins = await provision(client, administrator, user, cloudflare === null ? async (existing) => {
+				const all = options.resetPasswords || existing.size > 0 && await progress.ask(existing.size === 1 ? `${[...existing][0]} exists already. Set new passwords?` : "Both logins exist already. Set new passwords?");
+				return () => all;
+			} : async (existing) => {
+				const resets = {};
+				for (const component of ["app", "vault"]) {
+					const login = loginFor(ROLES[component], user);
+					resets[component] = options.resetPasswords || cloudflare.needsPassword(component, administrator, login);
+					if (resets[component] && existing.has(ROLES[component])) cloudflare.refuseShared(component, administrator, login);
+				}
+				return (component) => resets[component];
+			}, secrets);
+			return described(logins);
+		});
+		await step(3, async (progress) => {
+			let plan = {
+				applied: 0,
+				total: 0
+			};
+			await migrateDatabase(administrator.href, (planned) => {
+				plan = planned;
+				const pending = planned.total - planned.applied;
+				progress.note(pending === 0 ? "Checking the database is up to date" : `Migrating the database: ${count(pending, "migration")} to apply`);
+			});
+			const pending = plan.total - plan.applied;
+			return pending === 0 ? `The database is up to date, at coffre ${version}'s schema` : `Migrated the database to coffre ${version}'s schema: ${count(pending, "migration")} applied`;
+		});
+		let used = false;
+		await step(4, async () => {
+			const details = [];
+			for (const component of ["app", "vault"]) {
+				const login = logins[component];
+				const allowed = login.url === null ? await granted(client, login.role) : await probed(login.url);
+				details.push(checked(component, login, allowed));
+			}
+			const kept = [logins.app, logins.vault].filter((login) => login.url === null);
+			if (kept.length > 0) details.push(`${listed(kept.map(({ role }) => role), "and")}: from the catalog, with no new password to log in with`);
+			used = await holdsData(client);
+			return {
+				text: "Each login holds only its rights",
+				details
+			};
+		});
+		if (cloudflare !== null) {
+			await step(5, () => cloudflare.hyperdrive(logins));
+			await step(6, (progress) => cloudflare.github(progress, {
+				aside: (text) => steps.aside(text),
+				link: (label, address) => steps.link(label, address)
+			}));
+			await step(7, async () => cloudflare.write());
+			return {
+				keys: null,
+				...logins,
+				version
+			};
+		}
+		return {
+			keys: !used && (logins.app.url !== null || logins.vault.url !== null) ? generateKeys() : null,
+			...logins,
+			version
+		};
+	} finally {
+		steps.end();
+		await client.end().catch(() => {});
+	}
+}
+/** Whether the database holds data: coffre's log has an entry. Before the first migration, it holds none. */
+async function holdsData(client) {
+	const [migrated] = (await client.query("SELECT to_regclass('public.audit_log') IS NOT NULL AS migrated")).rows;
+	if (!migrated.migrated) return false;
+	return (await client.query("SELECT EXISTS (SELECT 1 FROM audit_log) AS used")).rows[0].used;
+}
+/**
+* Each runtime login, created with a fresh password, or, if it exists, its
+* password set again when `reset`, given the logins that exist, says so;
+* otherwise left as it is.
+*/
+async function provision(client, administrator, user, reset, secrets) {
+	const existing = new Set((await client.query("SELECT rolname FROM pg_roles WHERE rolname = ANY($1)", [Object.values(ROLES)])).rows.map((row) => row.rolname));
+	const resets = await reset(existing);
+	const logins = {};
+	for (const component of ["app", "vault"]) {
+		const role = ROLES[component];
+		const login = loginFor(role, user);
+		const create = !existing.has(role);
+		if (!create && !resets(component)) {
+			logins[component] = {
+				role,
+				login,
+				password: "kept",
+				url: null
+			};
+			continue;
+		}
+		const password = newPassword();
+		secrets.push(password);
+		const verifier = client.escapeLiteral(scramVerifier(password));
+		await client.query(create ? `CREATE ROLE ${client.escapeIdentifier(role)} LOGIN INHERIT NOCREATEDB NOCREATEROLE PASSWORD ${verifier}` : `ALTER ROLE ${client.escapeIdentifier(role)} LOGIN PASSWORD ${verifier}`);
+		logins[component] = {
+			role,
+			login,
+			password: create ? "created" : "reset",
+			url: loginUrl(administrator, login, password)
+		};
+	}
+	return logins;
+}
+/** The logins step's line: what happened to each, and what they log in as on PlanetScale. */
+function described(logins) {
+	const verbs = {
+		created: "Created",
+		reset: "Set new passwords for",
+		kept: "Kept"
+	};
+	return {
+		text: logins.app.password === logins.vault.password ? `${verbs[logins.app.password]} ${logins.app.role} and ${logins.vault.role}${logins.app.password === "kept" ? ", with their passwords" : ""}` : `${verbs[logins.app.password]} ${logins.app.role}; ${verbs[logins.vault.password].toLowerCase()} ${logins.vault.role}`,
+		details: logins.app.login !== logins.app.role ? [`They log in as ${logins.app.login} and ${logins.vault.login}`] : []
+	};
+}
+/** What each login may do that matters, and what it must answer. */
+const BOUNDARY = [
+	{
+		what: "write members",
+		expected: {
+			app: false,
+			vault: true
+		},
+		sql: `INSERT INTO vault_members (principal, status, owner, generation, created_at, created_by, status_changed_at, status_changed_by, access_seq, mac)
+          VALUES ('user:coffre-setup@probe.invalid', 'active', false, 0, 0, 'system:coffre-setup', 0, 'system:coffre-setup', 0, decode(repeat('00', 32), 'hex'))`,
+		privilege: "has_table_privilege($1, 'public.vault_members', 'INSERT')"
+	},
+	{
+		what: "delete log entries",
+		expected: {
+			app: false,
+			vault: false
+		},
+		sql: "DELETE FROM audit_log",
+		privilege: "has_table_privilege($1, 'public.audit_log', 'DELETE')"
+	},
+	{
+		what: "create tables",
+		expected: {
+			app: false,
+			vault: false
+		},
+		sql: "CREATE TABLE coffre_setup_probe (probe integer)",
+		privilege: "has_schema_privilege($1, 'public', 'CREATE') OR has_database_privilege($1, current_database(), 'CREATE')"
+	}
+];
+/** Each probe, tried as the login in a transaction rolled back: allowed, or refused for want of a privilege. */
+async function probed(url) {
+	const client = new esm_default.Client({
+		...postgresConnection(url),
+		application_name: "coffre-setup"
+	});
+	await client.connect();
+	try {
+		const allowed = [];
+		for (const { sql } of BOUNDARY) {
+			await client.query("BEGIN");
+			try {
+				await client.query(sql);
+				allowed.push(true);
+			} catch (error) {
+				if (error.code !== "42501") throw error;
+				allowed.push(false);
+			} finally {
+				await client.query("ROLLBACK");
+			}
+		}
+		return allowed;
+	} finally {
+		await client.end();
+	}
+}
+/** The same, from the catalog, for a login whose password this run did not set: the administrator asks for it. */
+async function granted(client, role) {
+	const allowed = [];
+	for (const { privilege } of BOUNDARY) allowed.push((await client.query(`SELECT ${privilege} AS allowed`, [role])).rows[0].allowed);
+	return allowed;
+}
+/** A login's line under the check, or the error that stops setup when its rights are wrong. */
+function checked(component, login, allowed) {
+	const wrong = BOUNDARY.flatMap(({ what, expected }, i) => allowed[i] === expected[component] ? [] : [`${allowed[i] ? "can" : "cannot"} ${what}`]);
+	if (wrong.length > 0) throw new SetupError(`${login.role} ${wrong.join(", and ")}: the database's privileges are not what coffre needs. Nothing is shown: fix them, then run coffre setup again with --reset-passwords.`);
+	const can = BOUNDARY.filter(({ expected }) => expected[component]).map(({ what }) => what);
+	const cannot = BOUNDARY.filter(({ expected }) => !expected[component]).map(({ what }) => what);
+	return `${login.role.padEnd(20)} ${can.length > 0 ? `can ${listed(can, "and")}; ` : ""}cannot ${listed(cannot, "or")}`;
+}
+/** The values to save, by component: the app's key and URL, the vault's ID, key and URL, as this run made them. */
+function setupValues({ keys, app, vault }) {
+	const made = keys === null ? {
+		app: [],
+		vault: []
+	} : keyValues(keys);
+	const database = (login, component) => login.url === null ? [] : [{
+		label: `${component === "app" ? "App" : "Vault"} database URL`,
+		value: login.url,
+		mask: "password",
+		about: `The ${component}'s own database login. Goes in the ${component}: its Hyperdrive config, or DATABASE_URL.`
+	}];
+	return {
+		app: [...made.app, ...database(app, "app")],
+		vault: [...made.vault, ...database(vault, "vault")]
+	};
+}
+/** The screen: the values, and where each goes, with the Hyperdrive commands to copy. */
+function setupScreen(result) {
+	const { app, vault } = setupValues(result);
+	const set = ["app", "vault"].filter((component) => result[component].url !== null);
+	const created = set.some((component) => result[component].password === "created");
+	const keys = keyGuide();
+	const hyperdrive = set.map((component) => {
+		return { command: hyperdriveCommand(result[component].password === "created" ? `create ${HYPERDRIVE[component]} --caching-disabled` : `update <the ${component}'s config id>`) };
+	});
+	const workers = [...set.length === 0 ? [] : [
+		`${created ? "A Hyperdrive config for each database URL, with caching off" : "Each Hyperdrive config, pointed at its new database URL"}. Run each command, then paste its URL at the silent prompt: it stays out of your shell's history, and the command drops the URL's parameters, since Hyperdrive connects over TLS itself.`,
+		...hyperdrive.flatMap((command, i) => [`The ${set[i]} database URL:`, command]),
+		"Or make them in the Cloudflare dashboard, under Hyperdrive.",
+		...created ? ["Their ids go under hyperdrive, in app/wrangler.jsonc and vault/wrangler.jsonc."] : []
+	], ...result.keys === null ? [] : keys.workers];
+	const node = [
+		...result.keys === null ? [] : keys.node,
+		...set.map((component) => `${component === "app" ? "server.env" : "vault.env"} takes the ${component} database URL, as DATABASE_URL.`),
+		"Keep each file readable only by its process (chmod 600)."
+	];
+	return {
+		title: "coffre setup",
+		sections: [...app.length > 0 ? [{
+			title: "App",
+			values: app
+		}] : [], ...vault.length > 0 ? [{
+			title: "Vault",
+			values: vault
+		}] : []],
+		guide: [{
+			title: "On Cloudflare Workers",
+			lines: workers
+		}, {
+			title: "On Node",
+			lines: node
+		}]
+	};
+}
+/** What the values were, by name, for the --json warning. */
+function shownNames(result) {
+	const { app, vault } = setupValues(result);
+	return [...app, ...vault].filter(({ mask }) => mask !== "none").map(({ label }) => `the ${label.replace(/^[A-Z]/, (c) => c.toLowerCase())}`);
+}
+/** The same values, for a script: each component's, under the examples' names, and what happened to each login. */
+function asJson({ keys, app, vault }) {
+	const database = (login) => login.url === null ? {} : { DATABASE_URL: login.url };
+	return {
+		app: {
+			...keys === null ? {} : { APP_KEY: keys.APP_KEY },
+			...database(app)
+		},
+		vault: {
+			...keys === null ? {} : {
+				VAULT_KEY_ID: keys.VAULT_KEY_ID,
+				VAULT_KEY: keys.VAULT_KEY
+			},
+			...database(vault)
+		},
+		logins: Object.fromEntries([app, vault].map(({ role, login, password }) => [role, {
+			login,
+			password
+		}]))
+	};
+}
+/** After the screen: what happened, and what comes next, with no secret in it. */
+function summary(result, out) {
+	const s = style(out);
+	const { app, vault } = setupValues(result);
+	const names = [...app, ...vault].filter(({ mask }) => mask !== "none").map(({ label }) => label.replace(/^[A-Z]/, (c) => c.toLowerCase()));
+	const created = result.app.password === "created" || result.vault.password === "created";
+	const reset = result.app.password === "reset" || result.vault.password === "reset";
+	const workers = [...created ? ["a Hyperdrive config for each database URL, with caching off"] : reset ? ["each Hyperdrive config updated with its new database URL"] : [], ...result.keys === null ? [] : ["VAULT_KEY_ID under vars", "APP_KEY and VAULT_KEY as secrets"]];
+	const fresh = created || result.keys !== null;
+	return [
+		"",
+		`  ${s.green("✓")} ${s.bold(`The ${listed(names, "and")} were shown once.`)}`,
+		s.dim(paragraph(out, "They aren't stored anywhere. A lost database URL comes back with coffre setup --reset-passwords; a lost key can't be recovered.", 4)),
+		"",
+		...result.keys === null ? [] : [row(out, s, "Vault ID", `${result.keys.VAULT_KEY_ID}, not a secret`), ""],
+		`    ${s.bold("Next")}`,
+		row(out, s, "Workers", `${workers.join("; ")}${fresh ? "; then pnpm run deploy" : ", which needs no redeploy"}.`),
+		row(out, s, "Node", fresh ? "server.env and vault.env, then pnpm vault and pnpm start." : "each DATABASE_URL updated, then both processes restarted."),
+		s.dim(paragraph(out, "After every upgrade of coffre, pnpm migrate. docs/deploy.md has each step.", 4)),
+		"",
+		""
+	].join("\n");
+}
+function nothingToSave(out) {
+	const s = style(out);
+	return [
+		"",
+		`  ${s.green("✓")} ${s.bold("Nothing new to save.")}`,
+		s.dim(paragraph(out, "The logins kept their passwords, and setup makes keys only with new ones, for a database that holds no data yet. coffre setup --reset-passwords sets new passwords.", 4)),
+		"",
+		""
+	].join("\n");
+}
+/** An error's text without any secret in it: a driver may quote what it was given. */
+function redact(text, secrets) {
+	return secrets.filter((secret) => secret.length >= 4).reduce((out, secret) => out.split(secret).join("…"), text);
+}
+function count(n, noun) {
+	return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+//#endregion
+export { setup };