@coreframe/scripts 0.1.34 → 0.1.36

package/dist/coreframe.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{addAsset as e,buildAssets as t,checkAssets as n,printAssetResult as r,publishAssets as i}from"./assets.js";import{runDrizzleKitCommand as a}from"./db/drizzle-kit.js";import{seedLocalDb as o}from"./db/seed.js";import{migrateLocalDb as s}from"./db/migrate.js";import{resetLocalDb as c}from"./db/reset.js";import{setupLocalDb as l}from"./db/setup.js";import{ensureLocalDb as u}from"./db/ensure.js";import{migrateHeldMigrations as d}from"./db/migrate-held.js";import{checkSchemaPush as f}from"./db/schema-check.js";import{deployEnvironments as p,tauriReleasePlatforms as m}from"./deploy/config.js";import{discoverStagingUrl as h,reassignStagingHostname as g}from"./staging.js";import{discardPendingWorkerSecret as _,inspectWorkerEnvironment as v,queueWorkerSecret as y}from"./worker-environment.js";import{deployProject as b}from"./deploy.js";import{checkDeployMigrations as x}from"./deploy/check-migrations.js";import{devPlatforms as S,runDevServer as C}from"./dev.js";import{validateRecipeName as w}from"./recipes/manifest.js";import{ensureTemplateRemote as T}from"./upgrade/ensure-template-remote.js";import{applyRecipe as E,printAppliedRecipe as D}from"./recipes/apply.js";import{listRecipes as O,printRecipeCatalog as k}from"./recipes/list.js";import{run as A}from"./runner.js";import{typecheckProject as j}from"./typecheck.js";import{checkUpgradeSkillCurrent as M}from"./upgrade/check-skill-current.js";import{fastForwardTemplateFiles as N}from"./upgrade/fast-forward-template-files.js";import{syncCoreframePackages as P}from"./upgrade/sync-coreframe-packages.js";import*as F from"@clack/prompts";import{array as I,command as L,extendType as R,flag as z,multioption as B,number as V,oneOf as H,option as U,optional as W,positional as G,rest as K,string as q,subcommands as J}from"cmd-ts";const Y=[`Cookies and sessions are origin-scoped.`,`Exact-host passkeys may require re-registration unless a stable eligible parent RP ID was configured in advance.`,`External OAuth callbacks such as Google may need updating.`,`Database data and private backend resources are unchanged.`],X=R(q,{displayName:`widths`,description:`Comma-separated responsive variant widths.`,async from(e){let t=e.split(`,`).map(e=>Number(e));if(t.length===0||t.some(e=>!Number.isInteger(e)||e<=0)||t.some((e,n)=>n>0&&e<=t[n-1]))throw Error(`Widths must be positive, unique, strictly ascending integers.`);return t}}),Z=R(q,{displayName:`recipe`,description:`Coreframe recipe name, such as yam-db.`,async from(e){return w(e)}}),Q=J({name:`coreframe`,cmds:{assets:J({name:`assets`,cmds:{add:L({name:`add`,args:{file:G({type:q,displayName:`file`,description:`Source image to add to the asset library.`}),id:U({long:`id`,type:q,description:`Logical asset ID, such as blog/my-post/hero.`}),alt:U({long:`alt`,type:q,description:`Required alt text for the asset.`}),variantWidths:U({long:`widths`,type:W(X),description:`Generate exactly these comma-separated widths instead of the default ladder.`}),json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({alt:t,file:n,id:i,json:a,variantWidths:o})=>r(await e({alt:t,file:n,id:i,json:a,variantWidths:o}),a)}),build:L({name:`build`,args:{id:U({long:`id`,type:W(q),description:`Build only one logical asset ID.`}),noPull:z({long:`no-pull`,description:`Do not perform targeted Git LFS pulls for missing source objects.`,defaultValue:()=>!1}),json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({id:e,json:n,noPull:i})=>r(await t({id:e,json:n,pull:!i}),n)}),check:L({name:`check`,args:{fix:z({long:`fix`,description:`Build missing generated variants when possible.`,defaultValue:()=>!1}),json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({fix:e,json:t})=>{let i=await n({fix:e,json:t});r(i,t),i.ok||(process.exitCode=1)}}),publish:L({name:`publish`,args:{outputDir:U({long:`output-dir`,type:W(q),description:`Root directory for additive local publish output. Defaults to COREFRAME_ASSETS_PUBLISH_DIR or release-upload.`}),json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e,outputDir:t})=>{let n=await i({json:e,outputDir:t});r(n,e),n.ok||(process.exitCode=1)}}),status:L({name:`status`,args:{json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await n({json:e});r(t,e),t.ok||(process.exitCode=1)}})}}),deploy:L({name:`deploy`,args:{environment:G({type:H(p),displayName:`environment`,description:`Deploy to the staging or production environment.`}),runMigrations:z({long:`run-migrations`,description:`Run pending deploy-safe database migrations before deploying.`,defaultValue:()=>!1}),skipMigrations:z({long:`skip-migrations`,description:`Deploy without running pending deploy-safe database migrations.`,defaultValue:()=>!1}),skipPostDeployChecks:z({long:`skip-post-deploy-checks`,description:`Skip post-deploy checks after Cloudflare deployment.`,defaultValue:()=>!1}),tauriLocalPlatforms:B({long:`tauri-local-platform`,type:I(H(m)),description:`Build one Tauri release platform locally. Repeat for multiple platforms.`,defaultValue:()=>[]}),tauriWorkflowName:U({long:`tauri-workflow-name`,type:W(q),description:`GitHub Actions workflow file or name for remote Tauri release builds.`}),tauriWorkflowPlatforms:B({long:`tauri-workflow-platform`,type:I(H(m)),description:`Build one Tauri release platform with GitHub Actions. Repeat for multiple platforms.`,defaultValue:()=>[]}),tauriWorkflowRef:U({long:`tauri-workflow-ref`,type:W(q),description:`Git ref used when dispatching remote Tauri release builds.`}),yes:z({long:`yes`,short:`y`,description:`Approve the production deployment confirmation.`,defaultValue:()=>!1})},handler:({environment:e,runMigrations:t,skipMigrations:n,skipPostDeployChecks:r,tauriLocalPlatforms:i,tauriWorkflowName:a,tauriWorkflowPlatforms:o,tauriWorkflowRef:s,yes:c})=>b([e,...t?[`--run-migrations`]:[],...n?[`--skip-migrations`]:[],...r?[`--skip-post-deploy-checks`]:[],...i.flatMap(e=>[`--tauri-local-platform`,e]),...a?[`--tauri-workflow-name`,a]:[],...o.flatMap(e=>[`--tauri-workflow-platform`,e]),...s?[`--tauri-workflow-ref`,s]:[],...c?[`--yes`]:[]])}),staging:J({name:`staging`,cmds:{reassign:L({name:`reassign`,args:{json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await g();if(e){console.log(JSON.stringify({...t,notices:Y}));return}console.log(t.url),console.error(`Staging hostname reassigned. ${Y.join(` `)}`)}}),url:L({name:`url`,args:{json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await h();console.log(e?JSON.stringify({url:t}):t)}})}}),secrets:J({name:`secrets`,cmds:{status:L({name:`status`,args:{environment:G({type:W(H(p)),displayName:`environment`,description:`Inspect staging, production, or both when omitted.`}),json:z({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({environment:e,json:t})=>{let n=await v({environment:e});console.log(t?JSON.stringify(n):$(n))}}),set:L({name:`set`,args:{environment:G({type:H(p),displayName:`environment`,description:`Worker environment to update on its next deploy.`}),name:G({type:q,displayName:`name`,description:`Declared Worker secret name.`})},handler:async({environment:e,name:t})=>{await y({environment:e,name:t,value:await ee(t)}),console.log(`Queued ${t} for ${e}. Run coreframe deploy ${e} to apply.`)}}),discard:L({name:`discard`,args:{environment:G({type:H(p),displayName:`environment`,description:`Worker environment with a queued secret update.`}),name:G({type:q,displayName:`name`,description:`Declared Worker secret name.`})},handler:async({environment:e,name:t})=>{let n=await _({environment:e,name:t});console.log(n?`Discarded the queued ${t} update for ${e}.`:`No ${t} update is queued for ${e}.`)}})}}),typecheck:L({name:`typecheck`,args:{},handler:j}),dev:L({name:`dev`,args:{https:z({long:`https`,description:`Serve the web app over locally trusted HTTPS.`,defaultValue:()=>!1}),host:U({long:`host`,type:W(q),description:`Host address for the web development server.`}),managed:z({long:`managed`,description:`Run managed checkout synchronization even without an interactive terminal.`,defaultValue:()=>!1}),noManaged:z({long:`no-managed`,description:`Run without managed checkout synchronization for this invocation.`,defaultValue:()=>!1}),platform:G({type:W(H(S)),displayName:`platform`,description:`Development target platform. Defaults to web.`}),device:G({type:W(q),displayName:`device`,description:`Device name or ID for iOS or Android development.`}),port:U({long:`port`,type:W(V),description:`Port for the web development server.`}),verbose:z({long:`verbose`,description:`Show the full native development output.`,defaultValue:()=>!1})},handler:({device:e,host:t,https:n,managed:r,noManaged:i,platform:a,port:o,verbose:s})=>C({device:e,host:t,https:n,managed:r,noManaged:i,platform:a??`web`,verbose:s,webPort:o})}),upgrade:J({name:`upgrade`,cmds:{"ensure-template-remote":L({name:`ensure-template-remote`,args:{remote:U({long:`remote`,type:q,defaultValue:()=>`template`,description:`Remote name to ensure.`}),noFetch:z({long:`no-fetch`,description:`Do not fetch the remote after ensuring it exists.`,defaultValue:()=>!1})},handler:({noFetch:e,remote:t})=>T({fetch:!e,remote:t})}),"check-skill-current":L({name:`check-skill-current`,args:{target:U({long:`target`,type:q,description:`Target Coreframe template git ref.`}),apply:z({long:`apply`,description:`Replace the local upgrade skill with the target version when it differs.`,defaultValue:()=>!1})},handler:({apply:e,target:t})=>{process.exitCode=M({apply:e,target:t})}}),"fast-forward-template-files":L({name:`fast-forward-template-files`,args:{target:U({long:`target`,type:q,description:`Target Coreframe template git ref.`}),base:U({long:`base`,type:W(q),description:`Previous Coreframe template git ref. Defaults to package.json engines.coreframe.`}),apply:z({long:`apply`,description:`Write clean fast-forwards to the worktree.`,defaultValue:()=>!1})},handler:({apply:e,base:t,target:n})=>N({apply:e,base:t,target:n})}),"sync-coreframe-packages":L({name:`sync-coreframe-packages`,args:{target:U({long:`target`,type:q,description:`Target Coreframe template git ref.`}),apply:z({long:`apply`,description:`Update existing published Coreframe dependency specifications.`,defaultValue:()=>!1})},handler:({apply:e,target:t})=>P({apply:e,target:t})})}}),recipes:J({name:`recipes`,cmds:{apply:L({name:`apply`,args:{recipe:G({type:Z,displayName:`recipe`,description:`Recipe to prepare and apply.`}),target:U({long:`target`,type:W(q),description:`Coreframe Git ref. Defaults to package.json engines.coreframe.`}),remote:U({long:`remote`,type:q,defaultValue:()=>`template`,description:`Coreframe Git remote name.`}),noFetch:z({long:`no-fetch`,description:`Use already-fetched recipe refs without fetching the remote.`,defaultValue:()=>!1})},handler:({noFetch:e,recipe:t,remote:n,target:r})=>D(E({fetch:!e,name:t,remote:n,target:r}))}),list:L({name:`list`,args:{target:U({long:`target`,type:W(q),description:`Coreframe Git ref. Defaults to package.json engines.coreframe.`}),remote:U({long:`remote`,type:q,defaultValue:()=>`template`,description:`Coreframe Git remote name.`}),noFetch:z({long:`no-fetch`,description:`Use already-fetched recipe refs without fetching the remote.`,defaultValue:()=>!1})},handler:({noFetch:e,remote:t,target:n})=>k(O({fetch:!e,remote:t,target:n}))})}}),db:J({name:`db`,cmds:{ensure:L({name:`ensure`,args:{},handler:u}),generate:L({name:`generate`,args:{args:K({displayName:`drizzle-kit args`,description:`Additional arguments passed to drizzle-kit generate.`})},handler:({args:e})=>a(`generate`,e)}),migrate:L({name:`migrate`,args:{args:K({displayName:`drizzle-kit args`,description:`Additional arguments passed to drizzle-kit migrate.`})},handler:({args:e})=>a(`migrate`,e)}),"migrate-held":L({name:`migrate-held`,args:{confirm:U({long:`confirm`,type:W(H([`run-held-migrations`])),description:`Required confirmation value for held migrations.`})},handler:({confirm:e})=>d({argv:e?[`--confirm=${e}`]:[]})}),"migrate-local":L({name:`migrate-local`,args:{},handler:s}),"migrations-check":L({name:`migrations-check`,args:{},handler:x}),reset:L({name:`reset`,args:{},handler:c}),seed:L({name:`seed`,args:{},handler:()=>o()}),"schema-check":L({name:`schema-check`,args:{seed:z({long:`seed`,description:`Run the configured project seed against the throwaway database.`,defaultValue:()=>!1})},handler:({seed:e})=>f({seed:e})}),setup:L({name:`setup`,args:{},handler:()=>l()}),studio:L({name:`studio`,args:{args:K({displayName:`drizzle-kit args`,description:`Additional arguments passed to drizzle-kit studio.`})},handler:({args:e})=>a(`studio`,e)})}})}});import.meta.main&&A(Q);function $(e){if(e.entries.length===0)return`No Worker environment values are declared in coreframe.config.ts.`;let t=e.entries.map(e=>[e.name,e.kind,e.local===`override`?`override`:`built-in default`,e.deployed.staging.replaceAll(`_`,` `),e.deployed.production.replaceAll(`_`,` `)]),n=[`Name`,`Kind`,`Local`,`Staging`,`Production`],r=n.map((e,n)=>Math.max(e.length,...t.map(e=>e[n].length))),i=e=>e.map((e,t)=>e.padEnd(r[t])).join(`  `).trimEnd();return[i(n),i(r.map(e=>`-`.repeat(e))),...t].join(`
-`)}async function ee(e){if(!process.stdin.isTTY){let e=``;for await(let t of process.stdin)e+=t.toString();return e.replace(/\r?\n$/,``)}let t=await F.password({message:`Enter the new value for ${e}`});if(F.isCancel(t))throw F.cancel(`Secret update cancelled.`),Error(`Secret update cancelled.`);return t}export{Q as coreframeCli};
+import{assertAssetCredentialProfile as e,configureAssetCredentials as t}from"./assets/credentials.js";import{addAsset as n,buildAssets as r,checkAssets as i,printAssetResult as a,publishAssets as o}from"./assets/workflows.js";import"./assets.js";import{runDrizzleKitCommand as s}from"./db/drizzle-kit.js";import{seedLocalDb as c}from"./db/seed.js";import{migrateLocalDb as l}from"./db/migrate.js";import{resetLocalDb as u}from"./db/reset.js";import{setupLocalDb as d}from"./db/setup.js";import{ensureLocalDb as f}from"./db/ensure.js";import{formatDbErrorMessage as p}from"./db/error.js";import{migrateHeldMigrations as m}from"./db/migrate-held.js";import{checkSchemaPush as h}from"./db/schema-check.js";import{rotateAccessTokenSigningSecret as g}from"./deploy/access-token-secret.js";import{deployEnvironments as _,tauriReleasePlatforms as v}from"./deploy/config.js";import{discoverStagingUrl as y,reassignStagingHostname as b}from"./staging.js";import{discardPendingWorkerSecret as x,inspectWorkerEnvironment as S,queueWorkerSecret as C}from"./worker-environment.js";import{deployProject as w}from"./deploy.js";import{checkDeployMigrations as T}from"./deploy/check-migrations.js";import{devPlatforms as E,runDevServer as ee}from"./dev.js";import{validateRecipeName as D}from"./recipes/manifest.js";import{ensureTemplateRemote as O}from"./upgrade/ensure-template-remote.js";import{applyRecipe as k,printAppliedRecipe as A}from"./recipes/apply.js";import{listRecipes as j,printRecipeCatalog as M}from"./recipes/list.js";import{run as N}from"./runner.js";import{typecheckProject as P}from"./typecheck.js";import{checkUpgradeSkillCurrent as F}from"./upgrade/check-skill-current.js";import{fastForwardTemplateFiles as I}from"./upgrade/fast-forward-template-files.js";import{syncCoreframePackages as L}from"./upgrade/sync-coreframe-packages.js";import*as R from"@clack/prompts";import{array as z,command as B,extendType as V,flag as H,multioption as U,number as W,oneOf as G,option as K,optional as q,positional as J,rest as Y,string as X,subcommands as Z}from"cmd-ts";const Q=[`Cookies and sessions are origin-scoped.`,`Exact-host passkeys may require re-registration unless a stable eligible parent RP ID was configured in advance.`,`External OAuth callbacks such as Google may need updating.`,`Database data and private backend resources are unchanged.`],te=V(X,{displayName:`widths`,description:`Comma-separated responsive variant widths.`,async from(e){let t=e.split(`,`).map(e=>Number(e));if(t.length===0||t.some(e=>!Number.isInteger(e)||e<=0)||t.some((e,n)=>n>0&&e<=t[n-1]))throw Error(`Widths must be positive, unique, strictly ascending integers.`);return t}}),ne=V(X,{displayName:`recipe`,description:`Coreframe recipe name, such as yam-db.`,async from(e){return D(e)}}),$=Z({name:`coreframe`,cmds:{assets:Z({name:`assets`,cmds:{configure:B({name:`configure`,description:`Store a Backblaze B2 asset key in the operating system credential store.`,args:{profile:J({type:V(X,{displayName:`profile`,async from(t){return e(t)}}),displayName:`profile`,description:`Credential profile named by coreframe.config.ts.`})},handler:async({profile:e})=>{let n=await R.text({message:`Backblaze B2 application key ID`,validate:e=>e?.trim()?void 0:`The application key ID is required.`});if(R.isCancel(n))throw Error(`Asset credential configuration was cancelled.`);let r=await R.password({message:`Backblaze B2 application key`,validate:e=>e?void 0:`The application key is required.`});if(R.isCancel(r))throw Error(`Asset credential configuration was cancelled.`);await t({applicationKey:r,applicationKeyId:n.trim(),profile:e}),console.log(`Stored Coreframe asset credential profile "${e}".`)}}),add:B({name:`add`,args:{file:J({type:X,displayName:`file`,description:`Source image to add to the asset library.`}),id:K({long:`id`,type:X,description:`Logical asset ID, such as blog/my-post/hero.`}),alt:K({long:`alt`,type:X,description:`Required alt text for the asset.`}),variantWidths:K({long:`widths`,type:q(te),description:`Generate exactly these comma-separated widths instead of the default ladder.`}),json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({alt:e,file:t,id:r,json:i,variantWidths:o})=>a(await n({alt:e,file:t,id:r,variantWidths:o}),i)}),build:B({name:`build`,args:{id:K({long:`id`,type:q(X),description:`Build only one logical asset ID.`}),json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({id:e,json:t})=>a(await r({id:e}),t)}),check:B({name:`check`,args:{fix:H({long:`fix`,description:`Build missing generated variants when possible.`,defaultValue:()=>!1}),json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({fix:e,json:t})=>{let n=await i({fix:e});a(n,t),n.ok||(process.exitCode=1)}}),publish:B({name:`publish`,args:{json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await o();a(t,e),t.ok||(process.exitCode=1)}}),status:B({name:`status`,args:{json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await i();a(t,e),t.ok||(process.exitCode=1)}})}}),deploy:B({name:`deploy`,args:{environment:J({type:G(_),displayName:`environment`,description:`Deploy to the staging or production environment.`}),runMigrations:H({long:`run-migrations`,description:`Run pending deploy-safe database migrations before deploying.`,defaultValue:()=>!1}),skipMigrations:H({long:`skip-migrations`,description:`Deploy without running pending deploy-safe database migrations.`,defaultValue:()=>!1}),skipPostDeployChecks:H({long:`skip-post-deploy-checks`,description:`Skip post-deploy checks after Cloudflare deployment.`,defaultValue:()=>!1}),tauriLocalPlatforms:U({long:`tauri-local-platform`,type:z(G(v)),description:`Build one Tauri release platform locally. Repeat for multiple platforms.`,defaultValue:()=>[]}),tauriWorkflowName:K({long:`tauri-workflow-name`,type:q(X),description:`GitHub Actions workflow file or name for remote Tauri release builds.`}),tauriWorkflowPlatforms:U({long:`tauri-workflow-platform`,type:z(G(v)),description:`Build one Tauri release platform with GitHub Actions. Repeat for multiple platforms.`,defaultValue:()=>[]}),tauriWorkflowRef:K({long:`tauri-workflow-ref`,type:q(X),description:`Git ref used when dispatching remote Tauri release builds.`}),yes:H({long:`yes`,short:`y`,description:`Approve the production deployment confirmation.`,defaultValue:()=>!1})},handler:({environment:e,runMigrations:t,skipMigrations:n,skipPostDeployChecks:r,tauriLocalPlatforms:i,tauriWorkflowName:a,tauriWorkflowPlatforms:o,tauriWorkflowRef:s,yes:c})=>w([e,...t?[`--run-migrations`]:[],...n?[`--skip-migrations`]:[],...r?[`--skip-post-deploy-checks`]:[],...i.flatMap(e=>[`--tauri-local-platform`,e]),...a?[`--tauri-workflow-name`,a]:[],...o.flatMap(e=>[`--tauri-workflow-platform`,e]),...s?[`--tauri-workflow-ref`,s]:[],...c?[`--yes`]:[]])}),staging:Z({name:`staging`,cmds:{reassign:B({name:`reassign`,args:{json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await b();if(e){console.log(JSON.stringify({...t,notices:Q}));return}console.log(t.url),console.error(`Staging hostname reassigned. ${Q.join(` `)}`)}}),url:B({name:`url`,args:{json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({json:e})=>{let t=await y();console.log(e?JSON.stringify({url:t}):t)}})}}),secrets:Z({name:`secrets`,cmds:{"rotate-access-token":B({name:`rotate-access-token`,args:{environment:J({type:G(_),displayName:`environment`,description:`Worker environment whose access JWTs should be invalidated.`}),yes:H({long:`yes`,short:`y`,description:`Confirm immediate signing-secret replacement and invalidation of outstanding access JWTs.`,defaultValue:()=>!1})},handler:async({environment:e,yes:t})=>{if(!t)throw Error(`Access-token signing-secret rotation requires --yes because it immediately invalidates outstanding access JWTs.`);await g({environment:e}),console.log(`Rotated Coreframe access-token signing material for ${e}. Clients must remint outstanding access JWTs.`)}}),status:B({name:`status`,args:{environment:J({type:q(G(_)),displayName:`environment`,description:`Inspect staging, production, or both when omitted.`}),json:H({long:`json`,description:`Print machine-readable JSON.`,defaultValue:()=>!1})},handler:async({environment:e,json:t})=>{let n=await S({environment:e});console.log(t?JSON.stringify(n):re(n))}}),set:B({name:`set`,args:{environment:J({type:G(_),displayName:`environment`,description:`Worker environment to update on its next deploy.`}),name:J({type:X,displayName:`name`,description:`Declared Worker secret name.`})},handler:async({environment:e,name:t})=>{await C({environment:e,name:t,value:await ie(t)}),console.log(`Queued ${t} for ${e}. Run coreframe deploy ${e} to apply.`)}}),discard:B({name:`discard`,args:{environment:J({type:G(_),displayName:`environment`,description:`Worker environment with a queued secret update.`}),name:J({type:X,displayName:`name`,description:`Declared Worker secret name.`})},handler:async({environment:e,name:t})=>{let n=await x({environment:e,name:t});console.log(n?`Discarded the queued ${t} update for ${e}.`:`No ${t} update is queued for ${e}.`)}})}}),typecheck:B({name:`typecheck`,args:{},handler:P}),dev:B({name:`dev`,args:{https:H({long:`https`,description:`Serve the web app over locally trusted HTTPS.`,defaultValue:()=>!1}),host:K({long:`host`,type:q(X),description:`Host address for the web development server.`}),managed:H({long:`managed`,description:`Run managed checkout synchronization even without an interactive terminal.`,defaultValue:()=>!1}),noManaged:H({long:`no-managed`,description:`Run without managed checkout synchronization for this invocation.`,defaultValue:()=>!1}),platform:J({type:q(G(E)),displayName:`platform`,description:`Development target platform. Defaults to web.`}),device:J({type:q(X),displayName:`device`,description:`Device name or ID for iOS or Android development.`}),port:K({long:`port`,type:q(W),description:`Port for the web development server.`}),verbose:H({long:`verbose`,description:`Show the full native development output.`,defaultValue:()=>!1})},handler:({device:e,host:t,https:n,managed:r,noManaged:i,platform:a,port:o,verbose:s})=>ee({device:e,host:t,https:n,managed:r,noManaged:i,platform:a??`web`,verbose:s,webPort:o})}),upgrade:Z({name:`upgrade`,cmds:{"ensure-template-remote":B({name:`ensure-template-remote`,args:{remote:K({long:`remote`,type:X,defaultValue:()=>`template`,description:`Remote name to ensure.`}),noFetch:H({long:`no-fetch`,description:`Do not fetch the remote after ensuring it exists.`,defaultValue:()=>!1})},handler:({noFetch:e,remote:t})=>O({fetch:!e,remote:t})}),"check-skill-current":B({name:`check-skill-current`,args:{target:K({long:`target`,type:X,description:`Target Coreframe template git ref.`}),apply:H({long:`apply`,description:`Replace the local upgrade skill with the target version when it differs.`,defaultValue:()=>!1})},handler:({apply:e,target:t})=>{process.exitCode=F({apply:e,target:t})}}),"fast-forward-template-files":B({name:`fast-forward-template-files`,args:{target:K({long:`target`,type:X,description:`Target Coreframe template git ref.`}),base:K({long:`base`,type:q(X),description:`Previous Coreframe template git ref. Defaults to package.json engines.coreframe.`}),apply:H({long:`apply`,description:`Write clean fast-forwards to the worktree.`,defaultValue:()=>!1})},handler:({apply:e,base:t,target:n})=>I({apply:e,base:t,target:n})}),"sync-coreframe-packages":B({name:`sync-coreframe-packages`,args:{target:K({long:`target`,type:X,description:`Target Coreframe template git ref.`}),apply:H({long:`apply`,description:`Update existing published Coreframe dependency specifications.`,defaultValue:()=>!1})},handler:({apply:e,target:t})=>L({apply:e,target:t})})}}),recipes:Z({name:`recipes`,cmds:{apply:B({name:`apply`,args:{recipe:J({type:ne,displayName:`recipe`,description:`Recipe to prepare and apply.`}),target:K({long:`target`,type:q(X),description:`Coreframe Git ref. Defaults to package.json engines.coreframe.`}),remote:K({long:`remote`,type:X,defaultValue:()=>`template`,description:`Coreframe Git remote name.`}),noFetch:H({long:`no-fetch`,description:`Use already-fetched recipe refs without fetching the remote.`,defaultValue:()=>!1})},handler:({noFetch:e,recipe:t,remote:n,target:r})=>A(k({fetch:!e,name:t,remote:n,target:r}))}),list:B({name:`list`,args:{target:K({long:`target`,type:q(X),description:`Coreframe Git ref. Defaults to package.json engines.coreframe.`}),remote:K({long:`remote`,type:X,defaultValue:()=>`template`,description:`Coreframe Git remote name.`}),noFetch:H({long:`no-fetch`,description:`Use already-fetched recipe refs without fetching the remote.`,defaultValue:()=>!1})},handler:({noFetch:e,remote:t,target:n})=>M(j({fetch:!e,remote:t,target:n}))})}}),db:Z({name:`db`,cmds:{ensure:B({name:`ensure`,args:{},handler:f}),generate:B({name:`generate`,args:{args:Y({displayName:`drizzle-kit args`,description:`Additional arguments passed to drizzle-kit generate.`})},handler:({args:e})=>s(`generate`,e)}),migrate:B({name:`migrate`,args:{args:Y({displayName:`drizzle-kit args`,description:`Additional arguments passed to drizzle-kit migrate.`})},handler:({args:e})=>s(`migrate`,e)}),"migrate-held":B({name:`migrate-held`,args:{confirm:K({long:`confirm`,type:q(G([`run-held-migrations`])),description:`Required confirmation value for held migrations.`})},handler:({confirm:e})=>m({argv:e?[`--confirm=${e}`]:[]})}),"migrate-local":B({name:`migrate-local`,args:{},handler:l}),"migrations-check":B({name:`migrations-check`,args:{},handler:T}),reset:B({name:`reset`,args:{},handler:u}),seed:B({name:`seed`,args:{},handler:()=>c()}),"schema-check":B({name:`schema-check`,args:{seed:H({long:`seed`,description:`Run the configured project seed against the throwaway database.`,defaultValue:()=>!1})},handler:({seed:e})=>h({seed:e})}),setup:B({name:`setup`,args:{},handler:()=>d()}),studio:B({name:`studio`,args:{args:Y({displayName:`drizzle-kit args`,description:`Additional arguments passed to drizzle-kit studio.`})},handler:({args:e})=>s(`studio`,e)})}})}});import.meta.main&&N($,{formatMessage:process.argv[2]===`db`?p:void 0});function re(e){if(e.entries.length===0)return`No Worker environment values are declared in coreframe.config.ts.`;let t=e.entries.map(e=>[e.name,e.kind,e.local===`override`?`override`:`built-in default`,e.deployed.staging.replaceAll(`_`,` `),e.deployed.production.replaceAll(`_`,` `)]),n=[`Name`,`Kind`,`Local`,`Staging`,`Production`],r=n.map((e,n)=>Math.max(e.length,...t.map(e=>e[n].length))),i=e=>e.map((e,t)=>e.padEnd(r[t])).join(`  `).trimEnd();return[i(n),i(r.map(e=>`-`.repeat(e))),...t].join(`
+`)}async function ie(e){if(!process.stdin.isTTY){let e=``;for await(let t of process.stdin)e+=t.toString();return e.replace(/\r?\n$/,``)}let t=await R.password({message:`Enter the new value for ${e}`});if(R.isCancel(t))throw R.cancel(`Secret update cancelled.`),Error(`Secret update cancelled.`);return t}export{$ as coreframeCli};

package/dist/db/error.d.ts

@@ -0,0 +1,4 @@
+//#region db/error.d.ts
+declare function formatDbErrorMessage(error: unknown): string | undefined;
+//#endregion
+export { formatDbErrorMessage };

package/dist/db/error.js

@@ -0,0 +1 @@
+import{DrizzleQueryError as e}from"drizzle-orm/errors";function t(t){if(!(!(t instanceof e)||!t.cause?.message))return`${n(t.message)}\nCause: ${n(t.cause.message)}`}function n(e){return e.split(/\r?\n/,1)[0]||`Unknown error`}export{t as formatDbErrorMessage};

package/dist/db/migrate-held.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{createProjectDeployDatabase as e}from"./project.js";import{collectHeldMigrationFiles as t,formatMigrationList as n}from"../deploy/migrations.js";import{createHash as r}from"node:crypto";import{readFile as i}from"node:fs/promises";const a=`--confirm=run-held-migrations`,o=[`-- Held migration:`,`-- Safe after:`,`-- Verification:`];async function s({argv:r=process.argv.slice(2),env:o=process.env}={}){let s=await t();if(console.log(`Held migration files:`),console.log(n(s)),!r.includes(a))throw Error(`Held migrations require explicit confirmation. Re-run with ${a}.`);if(s.length===0){console.log(`No held migrations to run.`);return}let d=await e({env:o});try{await u(d);for(let e of s){let t=await i(e.path,`utf8`);c(t,e.relativePath);let n=l(t),r=await d.execute(f(d.dialect,e.id));if(r.rows.length===1){if(r.rows[0]?.sha256!==n)throw Error(`Held migration ${e.relativePath} changed after it was applied.`);console.log(`Skipping already-applied held migration ${e.relativePath}`);continue}console.log(`Applying held migration ${e.relativePath}`),await h(d,async r=>{await r.execute(t),await r.execute(p(d.dialect,e.id,n))})}}finally{await d.close?.()}}function c(e,t){let n=o.filter(t=>!e.includes(t));if(n.length>0)throw Error(`${t} is missing held migration header fields: ${n.join(`, `)}`)}function l(e){return r(`sha256`).update(e).digest(`hex`)}async function u(e){for(let t of d(e.dialect))await e.execute(t)}function d(e){switch(e){case`postgres`:return[`create schema if not exists drizzle`,`create table if not exists drizzle.__held_migrations (
+import{createProjectDeployDatabase as e}from"./project.js";import{collectHeldMigrationFiles as t,formatMigrationList as n}from"../deploy/migrations.js";import{readFile as r}from"node:fs/promises";import{createHash as i}from"node:crypto";const a=`--confirm=run-held-migrations`,o=[`-- Held migration:`,`-- Safe after:`,`-- Verification:`];async function s({argv:i=process.argv.slice(2),env:o=process.env}={}){let s=await t();if(console.log(`Held migration files:`),console.log(n(s)),!i.includes(a))throw Error(`Held migrations require explicit confirmation. Re-run with ${a}.`);if(s.length===0){console.log(`No held migrations to run.`);return}let d=await e({env:o});try{await u(d);for(let e of s){let t=await r(e.path,`utf8`);c(t,e.relativePath);let n=l(t),i=await d.execute(f(d.dialect,e.id));if(i.rows.length===1){if(i.rows[0]?.sha256!==n)throw Error(`Held migration ${e.relativePath} changed after it was applied.`);console.log(`Skipping already-applied held migration ${e.relativePath}`);continue}console.log(`Applying held migration ${e.relativePath}`),await h(d,async r=>{await r.execute(t),await r.execute(p(d.dialect,e.id,n))})}}finally{await d.close?.()}}function c(e,t){let n=o.filter(t=>!e.includes(t));if(n.length>0)throw Error(`${t} is missing held migration header fields: ${n.join(`, `)}`)}function l(e){return i(`sha256`).update(e).digest(`hex`)}async function u(e){for(let t of d(e.dialect))await e.execute(t)}function d(e){switch(e){case`postgres`:return[`create schema if not exists drizzle`,`create table if not exists drizzle.__held_migrations (
           id text primary key,
           sha256 text not null,
           applied_at timestamptz not null default now()

package/dist/deploy/access-token-secret.d.ts

@@ -0,0 +1,39 @@
+import { DeployEnvironment } from "./config.js";
+
+//#region deploy/access-token-secret.d.ts
+declare const accessTokenSigningSecretName = "COREFRAME_ACCESS_TOKEN_SECRET";
+type SecretNamesReader = (environment: DeployEnvironment, cwd: string) => Promise<readonly string[]>;
+type SecretWriter = (environment: DeployEnvironment, name: string, value: string, cwd: string) => Promise<void>;
+type AccessTokenSigningSecretOptions = {
+  cwd?: string;
+  environment: DeployEnvironment;
+  generateSecret?: () => string;
+  listSecretNames?: SecretNamesReader;
+};
+type PreparedAccessTokenSigningSecret = {
+  provisioned: boolean;
+  value?: string;
+};
+declare function prepareAccessTokenSigningSecret({
+  cwd,
+  environment,
+  generateSecret,
+  listSecretNames
+}: AccessTokenSigningSecretOptions): Promise<PreparedAccessTokenSigningSecret>;
+declare function verifyAccessTokenSigningSecret({
+  cwd,
+  environment,
+  listSecretNames
+}: Omit<AccessTokenSigningSecretOptions, "generateSecret">): Promise<void>;
+declare function rotateAccessTokenSigningSecret({
+  cwd,
+  environment,
+  generateSecret,
+  listSecretNames,
+  writeSecret
+}: AccessTokenSigningSecretOptions & {
+  writeSecret?: SecretWriter;
+}): Promise<void>;
+declare function generateAccessTokenSigningSecret(): string;
+//#endregion
+export { PreparedAccessTokenSigningSecret, accessTokenSigningSecretName, generateAccessTokenSigningSecret, prepareAccessTokenSigningSecret, rotateAccessTokenSigningSecret, verifyAccessTokenSigningSecret };

package/dist/deploy/access-token-secret.js

@@ -0,0 +1 @@
+import e,{SubprocessError as t}from"nano-spawn";import{randomBytes as n}from"node:crypto";const r=`COREFRAME_ACCESS_TOKEN_SECRET`;async function i({cwd:e=process.cwd(),environment:t,generateSecret:n=s,listSecretNames:i=c}){try{if((await i(t,e)).includes(`COREFRAME_ACCESS_TOKEN_SECRET`))return{provisioned:!1}}catch(e){if(!u(e))throw Error(`Could not inspect the ${t} Worker before provisioning ${r}. Refusing to risk replacing an existing signing secret.`,{cause:e})}return{provisioned:!0,value:n()}}async function a({cwd:e=process.cwd(),environment:t,listSecretNames:n=c}){if(!(await n(t,e)).includes(`COREFRAME_ACCESS_TOKEN_SECRET`))throw Error(`Cloudflare deployed the ${t} Worker without ${r}.`)}async function o({cwd:e=process.cwd(),environment:t,generateSecret:n=s,listSecretNames:i=c,writeSecret:o=l}){await o(t,r,n(),e),await a({cwd:e,environment:t,listSecretNames:i})}function s(){return n(32).toString(`base64url`)}async function c(t,n){let{stdout:r}=await e(`pnpm`,[`exec`,`wrangler`,`secret`,`list`,`--env`,t,`--format`,`json`],{cwd:n,stdin:`ignore`}),i=JSON.parse(r);if(!Array.isArray(i))throw Error(`Wrangler returned an invalid Worker secret list.`);return i.flatMap(e=>e&&typeof e==`object`&&`name`in e&&typeof e.name==`string`?[e.name]:[])}async function l(t,n,r,i){await e(`pnpm`,[`exec`,`wrangler`,`secret`,`put`,n,`--env`,t],{cwd:i,stdin:{string:r},stdout:`inherit`,stderr:`inherit`})}function u(e){return e instanceof t&&e.stderr.includes(`not found`)&&e.stderr.includes("If this is a new Worker, run `wrangler deploy` first")}export{r as accessTokenSigningSecretName,s as generateAccessTokenSigningSecret,i as prepareAccessTokenSigningSecret,o as rotateAccessTokenSigningSecret,a as verifyAccessTokenSigningSecret};

package/dist/deploy/checks.d.ts

@@ -1,7 +1,8 @@
 import { DeployContext, ResolvedDeployConfig } from "./config.js";
 
 //#region deploy/checks.d.ts
+declare function runAfterWorkerDeploy(config: ResolvedDeployConfig, context: DeployContext): Promise<void>;
 declare function runPostDeployChecks(config: ResolvedDeployConfig, context: DeployContext): Promise<void>;
 declare function runDeploySmokeChecks(config: ResolvedDeployConfig, context: DeployContext, request?: typeof fetch, log?: (message: string) => void): Promise<void>;
 //#endregion
-export { runDeploySmokeChecks, runPostDeployChecks };
+export { runAfterWorkerDeploy, runDeploySmokeChecks, runPostDeployChecks };

package/dist/deploy/checks.js

@@ -1 +1 @@
-async function e(e,n){await t(e,n),await e.afterDeploy?.(n)}async function t(e,t,r=fetch,i=console.log){for(let a of e.smokeChecks){let e=a.url??new URL(a.path??`/`,t.url).toString(),o=await r(e);if(!n(o.status,a.expectedStatus??`2xx`))throw Error(`${a.name} smoke check failed: ${e} returned ${o.status}.`);i(`${a.name} smoke check passed: ${o.status} ${e}`)}}function n(e,t){return t===`2xx`?e>=200&&e<300:Array.isArray(t)?t.includes(e):e===t}export{t as runDeploySmokeChecks,e as runPostDeployChecks};
+async function e(e,t){try{await e.afterWorkerDeploy?.(t)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`Worker deployment succeeded, but deploy.afterWorkerDeploy failed: ${t}`,{cause:e})}}async function t(e,t){await n(e,t),await e.afterDeploy?.(t)}async function n(e,t,n=fetch,i=console.log){for(let a of e.smokeChecks){let e=a.url??new URL(a.path??`/`,t.url).toString(),o=await n(e);if(!r(o.status,a.expectedStatus??`2xx`))throw Error(`${a.name} smoke check failed: ${e} returned ${o.status}.`);i(`${a.name} smoke check passed: ${o.status} ${e}`)}}function r(e,t){return t===`2xx`?e>=200&&e<300:Array.isArray(t)?t.includes(e):e===t}export{e as runAfterWorkerDeploy,n as runDeploySmokeChecks,t as runPostDeployChecks};

package/dist/deploy/config.d.ts

@@ -48,6 +48,7 @@ type StagingHostnameConfig = {
 };
 type DeployConfig = {
   afterDeploy?: (context: DeployContext) => Promise<void> | void;
+  afterWorkerDeploy?: (context: DeployContext) => Promise<void> | void;
   environments?: Partial<Record<DeployEnvironment, DeployEnvironmentConfig>>;
   smokeChecks?: DeploySmokeCheck[];
   stagingHostname?: StagingHostnameConfig;
@@ -55,6 +56,7 @@ type DeployConfig = {
 };
 type ResolvedDeployConfig = {
   afterDeploy?: (context: DeployContext) => Promise<void> | void;
+  afterWorkerDeploy?: (context: DeployContext) => Promise<void> | void;
   environment: DeployEnvironment;
   smokeChecks: DeploySmokeCheck[];
   stagingHostname?: StagingHostnameConfig;

package/dist/deploy/config.js

@@ -1 +1 @@
-const e=[`staging`,`production`],t=[`macos`,`windows`,`linux`,`ios`,`android`];function n(e,t,n=process.env){return{afterDeploy:e.afterDeploy,environment:t,smokeChecks:e.smokeChecks??[{name:`home`,path:`/`}],stagingHostname:e.stagingHostname,tauriRelease:e.tauriRelease??{},url:n.DEPLOY_URL||(t===`staging`&&e.stagingHostname?void 0:e.environments?.[t]?.url)}}export{e as deployEnvironments,n as resolveDeployConfig,t as tauriReleasePlatforms};
+const e=[`staging`,`production`],t=[`macos`,`windows`,`linux`,`ios`,`android`];function n(e,t,n=process.env){return{afterDeploy:e.afterDeploy,afterWorkerDeploy:e.afterWorkerDeploy,environment:t,smokeChecks:e.smokeChecks??[{name:`home`,path:`/`}],stagingHostname:e.stagingHostname,tauriRelease:e.tauriRelease??{},url:n.DEPLOY_URL||(t===`staging`&&e.stagingHostname?void 0:e.environments?.[t]?.url)}}export{e as deployEnvironments,n as resolveDeployConfig,t as tauriReleasePlatforms};

package/dist/deploy/tauri-release.js

@@ -1 +1 @@
-import{tauriReleasePlatforms as e}from"./config.js";import{randomUUID as t}from"node:crypto";import{access as n,cp as r,mkdir as i,readFile as a,rm as o,stat as s,writeFile as c}from"node:fs/promises";import{basename as l,dirname as u,join as d,relative as f,resolve as p,sep as m}from"node:path";import h from"nano-spawn";import{constants as g}from"node:fs";import{setTimeout as _}from"node:timers/promises";import{glob as v}from"tinyglobby";const y={android:{artifactGlobs:[`src-tauri/target/**/*.sig`,`src-tauri/gen/android/**/*.sig`],buildArgs:[`tauri`,`android`,`build`,`--target`,`aarch64-linux-android`],targetTriple:`aarch64-linux-android`,updatePlatform:`android-aarch64`},ios:{artifactGlobs:[`src-tauri/target/**/*.sig`,`src-tauri/gen/apple/**/*.sig`],buildArgs:[`tauri`,`ios`,`build`,`--target`,`aarch64-apple-ios`],targetTriple:`aarch64-apple-ios`,updatePlatform:`ios-aarch64`},linux:{artifactGlobs:[`src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/**/*.sig`,`src-tauri/target/release/bundle/**/*.sig`,`src-tauri/target/**/release/bundle/**/*.sig`],buildArgs:[`tauri`,`build`,`--target`,`x86_64-unknown-linux-gnu`,`--`,`--locked`],targetTriple:`x86_64-unknown-linux-gnu`,updatePlatform:`linux-x86_64`},macos:{artifactGlobs:[`src-tauri/target/aarch64-apple-darwin/release/bundle/**/*.sig`,`src-tauri/target/release/bundle/**/*.sig`,`src-tauri/target/**/release/bundle/**/*.sig`],buildArgs:[`tauri`,`build`,`--target`,`aarch64-apple-darwin`,`--`,`--locked`],targetTriple:`aarch64-apple-darwin`,updatePlatform:`darwin-aarch64`},windows:{artifactGlobs:[`src-tauri/target/x86_64-pc-windows-msvc/release/bundle/**/*.sig`,`src-tauri/target/release/bundle/**/*.sig`,`src-tauri/target/**/release/bundle/**/*.sig`],buildArgs:[`tauri`,`build`,`--target`,`x86_64-pc-windows-msvc`,`--`,`--locked`],targetTriple:`x86_64-pc-windows-msvc`,updatePlatform:`windows-x86_64`}};function b(e){return e?e.split(/[,\s]+/u).filter(Boolean).map(e=>x(e)):[]}function x(t){if(X(t))return t;throw Error(`Invalid Tauri release platform "${t}". Expected one of: ${e.join(`, `)}.`)}function S({args:e,config:t={},env:n}){let r=Y([...t.localPlatforms??[],...b(n.TAURI_RELEASE_LOCAL_PLATFORMS),...e.tauriLocalPlatforms]),i=Y([...t.workflowPlatforms??[],...b(n.TAURI_RELEASE_WORKFLOW_PLATFORMS),...e.tauriWorkflowPlatforms]),a=r.filter(e=>i.includes(e));if(a.length>0)throw Error(`Build each Tauri release platform either locally or through the workflow, not both: ${a.join(`, `)}.`);return{artifactDownloadDir:n.TAURI_RELEASE_ARTIFACT_DOWNLOAD_DIR??t.artifactDownloadDir??`.coreframe/tauri-artifacts`,b2ApplicationKey:n.B2_APPLICATION_KEY??n.B2_SECRET_ACCESS_KEY,b2ApplicationKeyId:n.B2_APPLICATION_KEY_ID??n.B2_KEY_ID??n.B2_ACCESS_KEY_ID,b2Bucket:t.b2Bucket??n.B2_BUCKET,enabled:r.length>0||i.length>0,latestManifestPath:n.TAURI_RELEASE_LATEST_MANIFEST_PATH??t.latestManifestPath??`latest.json`,localPlatforms:r,platform:L(t.platform,n),publicBaseUrl:t.publicBaseUrl??n.TAURI_RELEASE_PUBLIC_BASE_URL??n.UPDATE_PUBLIC_BASE_URL,publicPathPrefix:n.TAURI_RELEASE_PUBLIC_PATH_PREFIX??t.publicPathPrefix??n.UPDATE_PUBLIC_PATH_PREFIX??``,releaseNotesPath:n.TAURI_RELEASE_NOTES_FILE??t.releaseNotesPath,releasePath:n.TAURI_RELEASE_PATH??t.releasePath??"releases/${version}",releaseUploadDir:n.TAURI_RELEASE_UPLOAD_DIR??t.releaseUploadDir??`release-upload`,signingPrivateKey:n.TAURI_SIGNING_PRIVATE_KEY,workflowName:e.tauriWorkflowName??n.TAURI_RELEASE_WORKFLOW_NAME??t.workflowName??`tauri-release-artifacts.yml`,workflowPlatforms:i,workflowPollIntervalMs:J(n.TAURI_RELEASE_WORKFLOW_POLL_SECONDS,`TAURI_RELEASE_WORKFLOW_POLL_SECONDS`)*1e3||t.workflowPollIntervalMs||15e3,workflowRef:e.tauriWorkflowRef??n.TAURI_RELEASE_WORKFLOW_REF??t.workflowRef,workflowTimeoutMs:J(n.TAURI_RELEASE_WORKFLOW_TIMEOUT_MINUTES,`TAURI_RELEASE_WORKFLOW_TIMEOUT_MINUTES`)*6e4||t.workflowTimeoutMs||36e5}}async function C(e,t=process.cwd()){if(!e.enabled)return;let n=[[`TAURI_RELEASE_PUBLIC_BASE_URL`,e.publicBaseUrl],[`B2_APPLICATION_KEY_ID`,e.b2ApplicationKeyId],[`B2_APPLICATION_KEY`,e.b2ApplicationKey],[`B2_BUCKET`,e.b2Bucket]].flatMap(([e,t])=>t?[]:[e]);if(n.length>0)throw Error(`Missing required Tauri release configuration: ${n.join(`, `)}`);try{new URL(e.publicBaseUrl)}catch{throw Error(`Invalid TAURI_RELEASE_PUBLIC_BASE_URL: ${e.publicBaseUrl}`)}let r=d(t,`src-tauri/tauri.conf.json`);if(!await Z(r))throw Error(`Tauri release platforms were requested, but src-tauri/tauri.conf.json does not exist.`);if(w(await a(r,`utf8`),r),e.localPlatforms.length>0&&!e.signingPrivateKey)throw Error(`TAURI_SIGNING_PRIVATE_KEY is required for local Tauri release builds.`);e.workflowPlatforms.length>0&&await h(`gh`,[`workflow`,`view`,e.workflowName,`--ref`,e.workflowRef??await H()],{stdin:`ignore`}),await h(`b2`,[`version`],{stdin:`ignore`})}function w(e,t=`src-tauri/tauri.conf.json`){let n=JSON.parse(e).identifier;if(typeof n!=`string`||n===`com.example`||n.startsWith(`com.example.`))throw Error(`${t} must use an organization-owned reverse-domain identifier before building release artifacts.`);return n}async function T(e,t,n=process.cwd()){if(!e.enabled)return{files:[]};let r=d(n,`src-tauri/tauri.conf.json`),i=d(n,`src-tauri/Cargo.toml`),o=d(n,`src-tauri/Cargo.lock`),s=await a(r,`utf8`),l=await a(i,`utf8`),u=z(l,i),f=[{path:r,source:s},{path:i,source:l}],p=[],m=JSON.parse(s);if(m.version=t,m.bundle={...m.bundle??{},createUpdaterArtifacts:!0},p.push({path:r,source:`${JSON.stringify(m,null,2)}\n`}),p.push({path:i,source:B(l,u,t,i)}),await Z(o)){let e=await a(o,`utf8`);f.push({path:o,source:e}),p.push({path:o,source:V(e,u,t,o)})}for(let e of p)await c(e.path,e.source);return{files:f}}async function E(e){for(let t of e.files)await c(t.path,t.source)}async function D({env:e,plan:t,releaseName:n,version:r}){if(!t.enabled)return;await U(t.artifactDownloadDir),await U(t.releaseUploadDir);let i=t.workflowPlatforms.length>0?await j({plan:t,releaseName:n,version:r}):void 0;for(let n of t.localPlatforms)await P(n,t,e);if(i){let e=await M(t,i.runNameMarker);await h(`gh`,[`run`,`download`,String(e),`--dir`,t.artifactDownloadDir],{stdio:`inherit`})}return A({plan:t,version:r})}async function O(e,t){await h(`b2`,[`account`,`authorize`,e.b2ApplicationKeyId,e.b2ApplicationKey],{stdin:`ignore`});let n=(await v(`**/*`,{cwd:t.uploadDir,onlyFiles:!0})).sort((e,n)=>e===t.manifestPath?1:n===t.manifestPath?-1:e.localeCompare(n));for(let r of n)await h(`b2`,[`file`,`upload`,e.b2Bucket,d(t.uploadDir,r),r],{stdin:`ignore`}),console.log(`Uploaded ${r}`)}function k({artifacts:e,notes:t,pubDate:n=new Date,version:r}){return{...t?{notes:t}:{},platforms:Object.fromEntries(e.map(e=>[e.updatePlatform,{signature:e.signature,url:e.url}])),pub_date:n.toISOString(),version:r}}async function A({plan:e,version:t}){let n=q(e.publicPathPrefix,G(e.releasePath,t)),o=q(e.publicPathPrefix,e.latestManifestPath),s=[...e.localPlatforms,...e.workflowPlatforms],f=[];for(let o of s){let s=e.platform[o],c=e.localPlatforms.includes(o)?`.`:d(e.artifactDownloadDir,`tauri-${o}-${t}`),p=await F({globs:e.localPlatforms.includes(o)?s.artifactGlobs:[`**/*.sig`],sourceRoot:c,version:t}),m=q(n,s.updatePlatform),h=q(m,l(p.artifactPath)),g=q(m,l(p.signaturePath)),_=d(e.releaseUploadDir,...h.split(`/`)),v=d(e.releaseUploadDir,...g.split(`/`)),y=(await a(p.signaturePath,`utf8`)).trim();await i(u(_),{recursive:!0}),await r(p.artifactPath,_),await r(p.signaturePath,v),f.push({signature:y,updatePlatform:s.updatePlatform,url:K(e.publicBaseUrl,h)})}let p=k({artifacts:f,notes:e.releaseNotesPath?await a(e.releaseNotesPath,`utf8`):void 0,version:t}),m=d(e.releaseUploadDir,...o.split(`/`));return await i(u(m),{recursive:!0}),await c(m,`${JSON.stringify(p,null,2)}\n`),{manifestPath:o,uploadDir:e.releaseUploadDir}}async function j({plan:n,releaseName:r,version:i}){let a=n.workflowRef??await H(),o=`coreframe-${Date.now()}-${t().slice(0,8)}`;return await h(`gh`,[`workflow`,`run`,n.workflowName,`--ref`,a,`-f`,`release_name=${r}`,`-f`,`run_id=${o}`,`-f`,`version=${i}`,...e.flatMap(e=>[`-f`,`${e}=${n.workflowPlatforms.includes(e)?`true`:`false`}`])],{stdin:`ignore`}),{runNameMarker:o}}async function M(e,t){let n=Date.now()+e.workflowTimeoutMs;for(;Date.now()<n;){let n=await N(e,t);if(n?.status===`completed`){if(n.conclusion===`success`)return n.databaseId;throw Error(`Tauri release workflow ${n.databaseId} finished with ${n.conclusion}.`)}await _(e.workflowPollIntervalMs)}throw Error(`Timed out waiting for Tauri release workflow after ${Math.round(e.workflowTimeoutMs/6e4)} minutes.`)}async function N(e,t){let{stdout:n}=await h(`gh`,[`run`,`list`,`--workflow`,e.workflowName,`--event`,`workflow_dispatch`,`--json`,`conclusion,databaseId,displayTitle,status`,`--limit`,`50`],{stdin:`ignore`});return JSON.parse(n).find(e=>e.displayTitle.includes(t))}async function P(e,t,n){await h(`pnpm`,t.platform[e].buildArgs,{env:n,stdio:`inherit`})}async function F({globs:e,sourceRoot:t,version:n}){let r=await v(e,{cwd:t,absolute:!0,onlyFiles:!0}),i=[];for(let e of r){let t=e.replace(/\.sig$/u,``);await Q(t)&&i.push({artifactPath:t,signaturePath:e})}if(i.length===0)throw Error(`Could not find a Tauri updater artifact and .sig pair under ${t}.`);return i.sort((e,t)=>{let r=I(e.artifactPath,n);return I(t.artifactPath,n)-r||e.artifactPath.localeCompare(t.artifactPath)})[0]}function I(e,t){let n=0;return e.includes(t)&&(n+=100),/\.(app\.tar\.gz|AppImage\.tar\.gz|zip)$/u.test(e)&&(n+=10),/\.(exe|msi|dmg|AppImage|deb|rpm|apk|aab|ipa)$/u.test(e)&&(n+=5),n}function L(t={},n){return Object.fromEntries(e.map(e=>{let r=t[e]??{},i={...y[e],...r},a=n[`TAURI_RELEASE_${e.toUpperCase()}_TARGET_TRIPLE`],o=n[`TAURI_RELEASE_${e.toUpperCase()}_UPDATE_PLATFORM`],s=a??i.targetTriple,c=r.buildArgs?r.buildArgs:R(e,s);return[e,{...i,artifactGlobs:i.artifactGlobs??y[e].artifactGlobs,buildArgs:c,targetTriple:s,updatePlatform:o??i.updatePlatform}]}))}function R(e,t){return e===`android`?[`tauri`,`android`,`build`,`--target`,t]:e===`ios`?[`tauri`,`ios`,`build`,`--target`,t]:[`tauri`,`build`,`--target`,t,`--`,`--locked`]}function z(e,t){let n=/^\[package\][\s\S]*?^name = "(?<name>[^"]+)"/mu.exec(e);if(!n?.groups?.name)throw Error(`${t} is missing a [package] name.`);return n.groups.name}function B(e,t,n,r){let i=RegExp(`(^\\[package\\][\\s\\S]*?^name = "${$(t)}"[\\s\\S]*?^version = ")[^"]+(")`,`mu`),a=e.replace(i,`$1${n}$2`);if(a===e)throw Error(`${r} is missing a package version for ${t}.`);return a}function V(e,t,n,r){let i=RegExp(`(\\[\\[package\\]\\]\\nname = "${$(t)}"\\nversion = ")[^"]+(")`,`u`),a=e.replace(i,`$1${n}$2`);if(a===e)throw Error(`${r} is missing a package lock entry for ${t}.`);return a}async function H(){let{stdout:e}=await h(`git`,[`rev-parse`,`--abbrev-ref`,`HEAD`],{stdin:`ignore`}),t=e.trim();if(t!==`HEAD`)return t;let{stdout:n}=await h(`git`,[`rev-parse`,`HEAD`],{stdin:`ignore`});return n.trim()}async function U(e){W(e),await o(e,{force:!0,recursive:!0}),await i(e,{recursive:!0})}function W(e){let t=p(e),n=f(process.cwd(),t).split(m).join(`/`);if(n===``||n===`.`||n.startsWith(`../`)||n===`src-tauri`||n.startsWith(`src-tauri/`)||n===`tauri`||n.startsWith(`tauri/`))throw Error(`Refusing to reset unsafe Tauri release directory: ${e}`)}function G(e,t){return e.replaceAll("${version}",t)}function K(e,t){let n=new URL(e),r=q(n.pathname.replace(/\/+$/u,``),t);return n.pathname=r.startsWith(`/`)?r:`/${r}`,n.toString()}function q(...e){return e.flatMap(e=>e.split(`/`)).map(e=>e.trim()).filter(Boolean).join(`/`)}function J(e,t){if(!e)return 0;let n=Number(e);if(!Number.isInteger(n)||n<=0)throw Error(`${t} must be a positive integer.`);return n}function Y(e){return[...new Set(e)]}function X(t){return e.includes(t)}async function Z(e){try{return await n(e,g.F_OK),!0}catch{return!1}}async function Q(e){try{return(await s(e)).isFile()}catch{return!1}}function $(e){return e.replace(/[.*+?^${}()|[\]\\]/gu,`\\$&`)}export{A as createTauriReleaseUpload,k as createTauriUpdateManifest,x as parseTauriReleasePlatform,b as parseTauriReleasePlatformList,D as prepareTauriRelease,S as resolveTauriReleasePlan,E as restoreTauriReleaseMetadata,O as uploadTauriReleaseToB2,w as validateTauriReleaseIdentifier,C as validateTauriReleasePlan,T as writeTauriReleaseMetadata};
+import{tauriReleasePlatforms as e}from"./config.js";import{access as t,cp as n,mkdir as r,readFile as i,rm as a,stat as o,writeFile as s}from"node:fs/promises";import{basename as c,dirname as l,join as u,relative as d,resolve as f,sep as p}from"node:path";import m from"nano-spawn";import{randomUUID as h}from"node:crypto";import{constants as g}from"node:fs";import{setTimeout as _}from"node:timers/promises";import{glob as v}from"tinyglobby";const y={android:{artifactGlobs:[`src-tauri/target/**/*.sig`,`src-tauri/gen/android/**/*.sig`],buildArgs:[`tauri`,`android`,`build`,`--target`,`aarch64-linux-android`],targetTriple:`aarch64-linux-android`,updatePlatform:`android-aarch64`},ios:{artifactGlobs:[`src-tauri/target/**/*.sig`,`src-tauri/gen/apple/**/*.sig`],buildArgs:[`tauri`,`ios`,`build`,`--target`,`aarch64-apple-ios`],targetTriple:`aarch64-apple-ios`,updatePlatform:`ios-aarch64`},linux:{artifactGlobs:[`src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/**/*.sig`,`src-tauri/target/release/bundle/**/*.sig`,`src-tauri/target/**/release/bundle/**/*.sig`],buildArgs:[`tauri`,`build`,`--target`,`x86_64-unknown-linux-gnu`,`--`,`--locked`],targetTriple:`x86_64-unknown-linux-gnu`,updatePlatform:`linux-x86_64`},macos:{artifactGlobs:[`src-tauri/target/aarch64-apple-darwin/release/bundle/**/*.sig`,`src-tauri/target/release/bundle/**/*.sig`,`src-tauri/target/**/release/bundle/**/*.sig`],buildArgs:[`tauri`,`build`,`--target`,`aarch64-apple-darwin`,`--`,`--locked`],targetTriple:`aarch64-apple-darwin`,updatePlatform:`darwin-aarch64`},windows:{artifactGlobs:[`src-tauri/target/x86_64-pc-windows-msvc/release/bundle/**/*.sig`,`src-tauri/target/release/bundle/**/*.sig`,`src-tauri/target/**/release/bundle/**/*.sig`],buildArgs:[`tauri`,`build`,`--target`,`x86_64-pc-windows-msvc`,`--`,`--locked`],targetTriple:`x86_64-pc-windows-msvc`,updatePlatform:`windows-x86_64`}};function b(e){return e?e.split(/[,\s]+/u).filter(Boolean).map(e=>x(e)):[]}function x(t){if(X(t))return t;throw Error(`Invalid Tauri release platform "${t}". Expected one of: ${e.join(`, `)}.`)}function S({args:e,config:t={},env:n}){let r=Y([...t.localPlatforms??[],...b(n.TAURI_RELEASE_LOCAL_PLATFORMS),...e.tauriLocalPlatforms]),i=Y([...t.workflowPlatforms??[],...b(n.TAURI_RELEASE_WORKFLOW_PLATFORMS),...e.tauriWorkflowPlatforms]),a=r.filter(e=>i.includes(e));if(a.length>0)throw Error(`Build each Tauri release platform either locally or through the workflow, not both: ${a.join(`, `)}.`);return{artifactDownloadDir:n.TAURI_RELEASE_ARTIFACT_DOWNLOAD_DIR??t.artifactDownloadDir??`.coreframe/tauri-artifacts`,b2ApplicationKey:n.B2_APPLICATION_KEY??n.B2_SECRET_ACCESS_KEY,b2ApplicationKeyId:n.B2_APPLICATION_KEY_ID??n.B2_KEY_ID??n.B2_ACCESS_KEY_ID,b2Bucket:t.b2Bucket??n.B2_BUCKET,enabled:r.length>0||i.length>0,latestManifestPath:n.TAURI_RELEASE_LATEST_MANIFEST_PATH??t.latestManifestPath??`latest.json`,localPlatforms:r,platform:L(t.platform,n),publicBaseUrl:t.publicBaseUrl??n.TAURI_RELEASE_PUBLIC_BASE_URL??n.UPDATE_PUBLIC_BASE_URL,publicPathPrefix:n.TAURI_RELEASE_PUBLIC_PATH_PREFIX??t.publicPathPrefix??n.UPDATE_PUBLIC_PATH_PREFIX??``,releaseNotesPath:n.TAURI_RELEASE_NOTES_FILE??t.releaseNotesPath,releasePath:n.TAURI_RELEASE_PATH??t.releasePath??"releases/${version}",releaseUploadDir:n.TAURI_RELEASE_UPLOAD_DIR??t.releaseUploadDir??`release-upload`,signingPrivateKey:n.TAURI_SIGNING_PRIVATE_KEY,workflowName:e.tauriWorkflowName??n.TAURI_RELEASE_WORKFLOW_NAME??t.workflowName??`tauri-release-artifacts.yml`,workflowPlatforms:i,workflowPollIntervalMs:J(n.TAURI_RELEASE_WORKFLOW_POLL_SECONDS,`TAURI_RELEASE_WORKFLOW_POLL_SECONDS`)*1e3||t.workflowPollIntervalMs||15e3,workflowRef:e.tauriWorkflowRef??n.TAURI_RELEASE_WORKFLOW_REF??t.workflowRef,workflowTimeoutMs:J(n.TAURI_RELEASE_WORKFLOW_TIMEOUT_MINUTES,`TAURI_RELEASE_WORKFLOW_TIMEOUT_MINUTES`)*6e4||t.workflowTimeoutMs||36e5}}async function C(e,t=process.cwd()){if(!e.enabled)return;let n=[[`TAURI_RELEASE_PUBLIC_BASE_URL`,e.publicBaseUrl],[`B2_APPLICATION_KEY_ID`,e.b2ApplicationKeyId],[`B2_APPLICATION_KEY`,e.b2ApplicationKey],[`B2_BUCKET`,e.b2Bucket]].flatMap(([e,t])=>t?[]:[e]);if(n.length>0)throw Error(`Missing required Tauri release configuration: ${n.join(`, `)}`);try{new URL(e.publicBaseUrl)}catch{throw Error(`Invalid TAURI_RELEASE_PUBLIC_BASE_URL: ${e.publicBaseUrl}`)}let r=u(t,`src-tauri/tauri.conf.json`);if(!await Z(r))throw Error(`Tauri release platforms were requested, but src-tauri/tauri.conf.json does not exist.`);if(w(await i(r,`utf8`),r),e.localPlatforms.length>0&&!e.signingPrivateKey)throw Error(`TAURI_SIGNING_PRIVATE_KEY is required for local Tauri release builds.`);e.workflowPlatforms.length>0&&await m(`gh`,[`workflow`,`view`,e.workflowName,`--ref`,e.workflowRef??await H()],{stdin:`ignore`}),await m(`b2`,[`version`],{stdin:`ignore`})}function w(e,t=`src-tauri/tauri.conf.json`){let n=JSON.parse(e).identifier;if(typeof n!=`string`||n===`com.example`||n.startsWith(`com.example.`))throw Error(`${t} must use an organization-owned reverse-domain identifier before building release artifacts.`);return n}async function T(e,t,n=process.cwd()){if(!e.enabled)return{files:[]};let r=u(n,`src-tauri/tauri.conf.json`),a=u(n,`src-tauri/Cargo.toml`),o=u(n,`src-tauri/Cargo.lock`),c=await i(r,`utf8`),l=await i(a,`utf8`),d=z(l,a),f=[{path:r,source:c},{path:a,source:l}],p=[],m=JSON.parse(c);if(m.version=t,m.bundle={...m.bundle??{},createUpdaterArtifacts:!0},p.push({path:r,source:`${JSON.stringify(m,null,2)}\n`}),p.push({path:a,source:B(l,d,t,a)}),await Z(o)){let e=await i(o,`utf8`);f.push({path:o,source:e}),p.push({path:o,source:V(e,d,t,o)})}for(let e of p)await s(e.path,e.source);return{files:f}}async function E(e){for(let t of e.files)await s(t.path,t.source)}async function D({env:e,plan:t,releaseName:n,version:r}){if(!t.enabled)return;await U(t.artifactDownloadDir),await U(t.releaseUploadDir);let i=t.workflowPlatforms.length>0?await j({plan:t,releaseName:n,version:r}):void 0;for(let n of t.localPlatforms)await P(n,t,e);if(i){let e=await M(t,i.runNameMarker);await m(`gh`,[`run`,`download`,String(e),`--dir`,t.artifactDownloadDir],{stdio:`inherit`})}return A({plan:t,version:r})}async function O(e,t){await m(`b2`,[`account`,`authorize`,e.b2ApplicationKeyId,e.b2ApplicationKey],{stdin:`ignore`});let n=(await v(`**/*`,{cwd:t.uploadDir,onlyFiles:!0})).sort((e,n)=>e===t.manifestPath?1:n===t.manifestPath?-1:e.localeCompare(n));for(let r of n)await m(`b2`,[`file`,`upload`,e.b2Bucket,u(t.uploadDir,r),r],{stdin:`ignore`}),console.log(`Uploaded ${r}`)}function k({artifacts:e,notes:t,pubDate:n=new Date,version:r}){return{...t?{notes:t}:{},platforms:Object.fromEntries(e.map(e=>[e.updatePlatform,{signature:e.signature,url:e.url}])),pub_date:n.toISOString(),version:r}}async function A({plan:e,version:t}){let a=q(e.publicPathPrefix,G(e.releasePath,t)),o=q(e.publicPathPrefix,e.latestManifestPath),d=[...e.localPlatforms,...e.workflowPlatforms],f=[];for(let o of d){let s=e.platform[o],d=e.localPlatforms.includes(o)?`.`:u(e.artifactDownloadDir,`tauri-${o}-${t}`),p=await F({globs:e.localPlatforms.includes(o)?s.artifactGlobs:[`**/*.sig`],sourceRoot:d,version:t}),m=q(a,s.updatePlatform),h=q(m,c(p.artifactPath)),g=q(m,c(p.signaturePath)),_=u(e.releaseUploadDir,...h.split(`/`)),v=u(e.releaseUploadDir,...g.split(`/`)),y=(await i(p.signaturePath,`utf8`)).trim();await r(l(_),{recursive:!0}),await n(p.artifactPath,_),await n(p.signaturePath,v),f.push({signature:y,updatePlatform:s.updatePlatform,url:K(e.publicBaseUrl,h)})}let p=k({artifacts:f,notes:e.releaseNotesPath?await i(e.releaseNotesPath,`utf8`):void 0,version:t}),m=u(e.releaseUploadDir,...o.split(`/`));return await r(l(m),{recursive:!0}),await s(m,`${JSON.stringify(p,null,2)}\n`),{manifestPath:o,uploadDir:e.releaseUploadDir}}async function j({plan:t,releaseName:n,version:r}){let i=t.workflowRef??await H(),a=`coreframe-${Date.now()}-${h().slice(0,8)}`;return await m(`gh`,[`workflow`,`run`,t.workflowName,`--ref`,i,`-f`,`release_name=${n}`,`-f`,`run_id=${a}`,`-f`,`version=${r}`,...e.flatMap(e=>[`-f`,`${e}=${t.workflowPlatforms.includes(e)?`true`:`false`}`])],{stdin:`ignore`}),{runNameMarker:a}}async function M(e,t){let n=Date.now()+e.workflowTimeoutMs;for(;Date.now()<n;){let n=await N(e,t);if(n?.status===`completed`){if(n.conclusion===`success`)return n.databaseId;throw Error(`Tauri release workflow ${n.databaseId} finished with ${n.conclusion}.`)}await _(e.workflowPollIntervalMs)}throw Error(`Timed out waiting for Tauri release workflow after ${Math.round(e.workflowTimeoutMs/6e4)} minutes.`)}async function N(e,t){let{stdout:n}=await m(`gh`,[`run`,`list`,`--workflow`,e.workflowName,`--event`,`workflow_dispatch`,`--json`,`conclusion,databaseId,displayTitle,status`,`--limit`,`50`],{stdin:`ignore`});return JSON.parse(n).find(e=>e.displayTitle.includes(t))}async function P(e,t,n){await m(`pnpm`,t.platform[e].buildArgs,{env:n,stdio:`inherit`})}async function F({globs:e,sourceRoot:t,version:n}){let r=await v(e,{cwd:t,absolute:!0,onlyFiles:!0}),i=[];for(let e of r){let t=e.replace(/\.sig$/u,``);await Q(t)&&i.push({artifactPath:t,signaturePath:e})}if(i.length===0)throw Error(`Could not find a Tauri updater artifact and .sig pair under ${t}.`);return i.sort((e,t)=>{let r=I(e.artifactPath,n);return I(t.artifactPath,n)-r||e.artifactPath.localeCompare(t.artifactPath)})[0]}function I(e,t){let n=0;return e.includes(t)&&(n+=100),/\.(app\.tar\.gz|AppImage\.tar\.gz|zip)$/u.test(e)&&(n+=10),/\.(exe|msi|dmg|AppImage|deb|rpm|apk|aab|ipa)$/u.test(e)&&(n+=5),n}function L(t={},n){return Object.fromEntries(e.map(e=>{let r=t[e]??{},i={...y[e],...r},a=n[`TAURI_RELEASE_${e.toUpperCase()}_TARGET_TRIPLE`],o=n[`TAURI_RELEASE_${e.toUpperCase()}_UPDATE_PLATFORM`],s=a??i.targetTriple,c=r.buildArgs?r.buildArgs:R(e,s);return[e,{...i,artifactGlobs:i.artifactGlobs??y[e].artifactGlobs,buildArgs:c,targetTriple:s,updatePlatform:o??i.updatePlatform}]}))}function R(e,t){return e===`android`?[`tauri`,`android`,`build`,`--target`,t]:e===`ios`?[`tauri`,`ios`,`build`,`--target`,t]:[`tauri`,`build`,`--target`,t,`--`,`--locked`]}function z(e,t){let n=/^\[package\][\s\S]*?^name = "(?<name>[^"]+)"/mu.exec(e);if(!n?.groups?.name)throw Error(`${t} is missing a [package] name.`);return n.groups.name}function B(e,t,n,r){let i=RegExp(`(^\\[package\\][\\s\\S]*?^name = "${$(t)}"[\\s\\S]*?^version = ")[^"]+(")`,`mu`),a=e.replace(i,`$1${n}$2`);if(a===e)throw Error(`${r} is missing a package version for ${t}.`);return a}function V(e,t,n,r){let i=RegExp(`(\\[\\[package\\]\\]\\nname = "${$(t)}"\\nversion = ")[^"]+(")`,`u`),a=e.replace(i,`$1${n}$2`);if(a===e)throw Error(`${r} is missing a package lock entry for ${t}.`);return a}async function H(){let{stdout:e}=await m(`git`,[`rev-parse`,`--abbrev-ref`,`HEAD`],{stdin:`ignore`}),t=e.trim();if(t!==`HEAD`)return t;let{stdout:n}=await m(`git`,[`rev-parse`,`HEAD`],{stdin:`ignore`});return n.trim()}async function U(e){W(e),await a(e,{force:!0,recursive:!0}),await r(e,{recursive:!0})}function W(e){let t=f(e),n=d(process.cwd(),t).split(p).join(`/`);if(n===``||n===`.`||n.startsWith(`../`)||n===`src-tauri`||n.startsWith(`src-tauri/`)||n===`tauri`||n.startsWith(`tauri/`))throw Error(`Refusing to reset unsafe Tauri release directory: ${e}`)}function G(e,t){return e.replaceAll("${version}",t)}function K(e,t){let n=new URL(e),r=q(n.pathname.replace(/\/+$/u,``),t);return n.pathname=r.startsWith(`/`)?r:`/${r}`,n.toString()}function q(...e){return e.flatMap(e=>e.split(`/`)).map(e=>e.trim()).filter(Boolean).join(`/`)}function J(e,t){if(!e)return 0;let n=Number(e);if(!Number.isInteger(n)||n<=0)throw Error(`${t} must be a positive integer.`);return n}function Y(e){return[...new Set(e)]}function X(t){return e.includes(t)}async function Z(e){try{return await t(e,g.F_OK),!0}catch{return!1}}async function Q(e){try{return(await o(e)).isFile()}catch{return!1}}function $(e){return e.replace(/[.*+?^${}()|[\]\\]/gu,`\\$&`)}export{A as createTauriReleaseUpload,k as createTauriUpdateManifest,x as parseTauriReleasePlatform,b as parseTauriReleasePlatformList,D as prepareTauriRelease,S as resolveTauriReleasePlan,E as restoreTauriReleaseMetadata,O as uploadTauriReleaseToB2,w as validateTauriReleaseIdentifier,C as validateTauriReleasePlan,T as writeTauriReleaseMetadata};

package/dist/deploy.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{readProjectConfig as e}from"./config.js";import{createProjectDeployDatabase as t}from"./db/project.js";import{collectDeployMigrationFiles as n,formatMigrationList as r,formatMigrationScanFailures as i,scanDeployMigrationFiles as a}from"./deploy/migrations.js";import{runPostDeployChecks as ee}from"./deploy/checks.js";import{deployEnvironments as o,resolveDeployConfig as s}from"./deploy/config.js";import{filterPendingMigrations as c,readAppliedMigrationNames as l}from"./deploy/pending-migrations.js";import{parseTauriReleasePlatform as u,prepareTauriRelease as d,resolveTauriReleasePlan as f,restoreTauriReleaseMetadata as te,uploadTauriReleaseToB2 as ne,validateTauriReleasePlan as p,writeTauriReleaseMetadata as m}from"./deploy/tauri-release.js";import{readPackageJson as h,releaseName as g,resolveReleaseVersion as _,writePackageVersion as v}from"./deploy/version.js";import{discoverStagingUrl as y}from"./staging.js";import{clearAppliedPendingWorkerSecrets as b,readPendingWorkerSecretSnapshot as x}from"./worker-environment.js";import{mkdtemp as S,readFile as C,rm as w,writeFile as T}from"node:fs/promises";import{join as E}from"node:path";import D from"nano-spawn";import*as O from"@clack/prompts";import{tmpdir as k}from"node:os";import{parseEnv as A}from"node:util";const j=`package.json`;async function M(n=process.argv.slice(2),r=process.env){let o=N(n);V(o);let{packageJson:c,source:l}=await h(j),u=await e(),S=s(u.deploy??{},o.environment,r);K(r,[`POSTHOG_API_KEY`,`POSTHOG_PROJECT_ID`]);let C=await H(S,o.environment,()=>y({env:r})),w=f({args:o,config:o.environment===`production`?S.tauriRelease:{},env:r});G(o.environment,w.enabled),await p(w);let E=await x({environment:o.environment}),k=E.values.DASHBOARD_PASSWORD??await q(r,o.environment),A=await B(),M=_(o.environment,c.version,A),P=g(c.name,M),F=X(r,o.environment,P,c.name,M),I=o.environment===`production`,R=!1,U={files:[]};O.intro(`Deploy ${P} to ${o.environment}`);let Y=Object.keys(E.values).sort();Y.length>0&&O.note(Y.join(`
-`),`Pending Worker secret updates`),await W(o);let Q=await L(await t({config:u.database,env:r})),$=await a(Q);if($.length>0)throw Error(`Pending deploy migrations contain unsafe SQL. Move unsafe statements to held migrations.\n${i($)}`);let re=await z(o,Q);try{I&&(await v(j,c,M),U=await m(w,M)),O.log.step(`Running pre-deploy build`),await D(`pnpm`,[`build`],{env:Z(F),stdio:`inherit`});let e=w.enabled?await d({env:Z(F),plan:w,releaseName:P,version:M}):void 0;O.log.step(`Running release build and uploading PostHog source maps`),R=!0,await D(`pnpm`,[`build`],{env:F,stdio:`inherit`}),re&&(O.log.step(`Running deploy-safe database migrations`),await D(`pnpm`,[`db`,`migrate`],{env:F,stdio:`inherit`})),O.log.step(`Deploying Worker and static assets to Cloudflare`);let t={...k?{DASHBOARD_PASSWORD:k}:{},...E.values},n=Object.keys(t).length>0?await J(t):void 0;try{await D(`pnpm`,[`exec`,`wrangler`,`deploy`,`--env`,o.environment,`--strict`,`--keep-vars`,`--tag`,P,`--message`,`Deploy ${P}`,`--var`,`DEPLOY_ENV:${o.environment}`,`--var`,`POSTHOG_RELEASE:${P}`,...n?[`--secrets-file`,n.path]:[]],{env:F,stdio:`inherit`}),await b(E)}finally{await n?.dispose()}o.skipPostDeployChecks||(O.log.step(`Running post-deploy checks`),await ee(S,{environment:o.environment,releaseName:P,url:C,version:M})),e&&(O.log.step(`Uploading Tauri release artifacts to Backblaze B2`),await ne(w,e)),O.outro(`Deployed ${P} to ${o.environment}`)}catch(e){throw!R&&I&&(await T(j,l),await te(U)),e}}function N(e){return{environment:P(e[0]),runMigrations:e.includes(`--run-migrations`),skipMigrations:e.includes(`--skip-migrations`),skipPostDeployChecks:e.includes(`--skip-post-deploy-checks`),tauriLocalPlatforms:F(e,`--tauri-local-platform`).map(e=>u(e)),tauriWorkflowName:I(e,`--tauri-workflow-name`),tauriWorkflowPlatforms:F(e,`--tauri-workflow-platform`).map(e=>u(e)),tauriWorkflowRef:I(e,`--tauri-workflow-ref`),yes:e.includes(`--yes`)}}function P(e){if(e&&o.includes(e))return e;throw Error(`Deploy environment must be one of: ${o.join(`, `)}.`)}function F(e,t){let n=[];for(let r=0;r<e.length;r+=1){let i=e[r];if(i===t){let i=e[r+1];if(!i||i.startsWith(`--`))throw Error(`${t} requires a value.`);n.push(...i.split(`,`).filter(Boolean)),r+=1;continue}i.startsWith(`${t}=`)&&n.push(...i.slice(t.length+1).split(`,`).filter(Boolean))}return n}function I(e,t){let n=F(e,t);if(n.length>1)throw Error(`${t} can only be provided once.`);return n[0]}async function L(e){try{return await R(e)}finally{await e.close?.()}}async function R(e){return c(await n(),await l(e))}async function z(e,t){if(t.length===0)return O.log.info(`No pending deploy migrations.`),!1;if(O.note(r(t),`Pending deploy migrations`),e.runMigrations)return!0;if(e.skipMigrations)return!1;if(!process.stdout.isTTY)throw Error(`Pending migrations require --run-migrations or --skip-migrations in noninteractive deploys.`);let n=await O.confirm({initialValue:!0,message:`Run these deploy-safe database migrations before Cloudflare deploy?`});if(O.isCancel(n))throw O.cancel(`Deploy cancelled.`),Error(`Deploy cancelled.`);return n}async function B(){let{stdout:e}=await D(`git`,[`status`,`--porcelain`],{stdin:`ignore`});if(e.trim().length>0)throw Error(`Deploy requires a clean git tree.`);let{stdout:t}=await D(`git`,[`rev-parse`,`--short=12`,`HEAD`],{stdin:`ignore`});return t.trim()}function V(e){if(e.runMigrations&&e.skipMigrations)throw Error(`Use only one of --run-migrations or --skip-migrations.`)}async function H(e,t,n=y){return e.url?U(e.url,t):t===`staging`&&e.stagingHostname?U(await n(),t):U(void 0,t)}function U(e,t){if(!e)throw Error(`Missing ${t} deploy URL. Set DEPLOY_URL or deploy.environments.${t}.url in coreframe.config.ts.`);let n;try{n=new URL(e)}catch{throw Error(`Invalid ${t} deploy URL "${e}". Expected an HTTP(S) URL.`)}if(n.protocol!==`http:`&&n.protocol!==`https:`)throw Error(`Invalid ${t} deploy URL "${e}". Expected an HTTP(S) URL.`);return n.toString()}async function W(e){if(e.environment!==`production`||e.yes)return;if(!process.stdout.isTTY)throw Error(`Production deploys require --yes in noninteractive environments.`);let t=await O.confirm({initialValue:!1,message:`Deploy to production?`});if(O.isCancel(t)||!t)throw O.cancel(`Deploy cancelled.`),Error(`Deploy cancelled.`)}function G(e,t){if(e===`staging`&&t)throw Error(`Tauri releases can only be published from production deploys.`)}function K(e,t){let n=t.filter(t=>!e[t]);if(n.length>0)throw Error(`Missing required deploy environment variables: ${n.join(`, `)}`);return Object.fromEntries(t.map(t=>[t,e[t]]))}async function q(e,t){let n=e.DASHBOARD_PASSWORD?.trim();if(n)return n;let r;try{r=A(await C(`.env`,`utf8`))}catch(e){throw Y(e)&&e.code===`ENOENT`?Error(`Missing ${t} dashboard password. Set DASHBOARD_PASSWORD in ".env".`):e}let i=r.DASHBOARD_PASSWORD?.trim();if(!i)throw Error(`Missing ${t} dashboard password. Set DASHBOARD_PASSWORD in ".env".`);return i}async function J(e){let t=await S(E(k(),`coreframe-deploy-secrets-`)),n=E(t,`secrets.json`);return await T(n,JSON.stringify(e),{mode:384}),{path:n,dispose:()=>w(t,{force:!0,recursive:!0})}}function Y(e){return e instanceof Error&&`code`in e}function X(e,t,n,r,i){return{...e,CLOUDFLARE_ENV:t,DEPLOY_ENV:t,POSTHOG_RELEASE:n,POSTHOG_RELEASE_NAME:e.POSTHOG_RELEASE_NAME??r,POSTHOG_RELEASE_VERSION:e.POSTHOG_RELEASE_VERSION??i}}function Z(e){let{POSTHOG_API_KEY:t,POSTHOG_PROJECT_ID:n,...r}=e;return r}export{M as deployProject,N as parseDeployArgs,e as readProjectConfig,q as resolveDashboardPassword,H as resolveDeployUrl};
+import{readProjectConfig as e}from"./config.js";import{createProjectDeployDatabase as t}from"./db/project.js";import{collectDeployMigrationFiles as n,formatMigrationList as r,formatMigrationScanFailures as i,scanDeployMigrationFiles as ee}from"./deploy/migrations.js";import{accessTokenSigningSecretName as a,prepareAccessTokenSigningSecret as o,verifyAccessTokenSigningSecret as s}from"./deploy/access-token-secret.js";import{runAfterWorkerDeploy as te,runPostDeployChecks as ne}from"./deploy/checks.js";import{deployEnvironments as c,resolveDeployConfig as re}from"./deploy/config.js";import{filterPendingMigrations as l,readAppliedMigrationNames as u}from"./deploy/pending-migrations.js";import{parseTauriReleasePlatform as d,prepareTauriRelease as f,resolveTauriReleasePlan as p,restoreTauriReleaseMetadata as m,uploadTauriReleaseToB2 as h,validateTauriReleasePlan as g,writeTauriReleaseMetadata as _}from"./deploy/tauri-release.js";import{readPackageJson as ie,releaseName as v,resolveReleaseVersion as y,writePackageVersion as b}from"./deploy/version.js";import{discoverStagingUrl as x}from"./staging.js";import{clearAppliedPendingWorkerSecrets as ae,readPendingWorkerSecretSnapshot as S}from"./worker-environment.js";import{mkdtemp as C,readFile as w,rm as T,writeFile as E}from"node:fs/promises";import{join as D}from"node:path";import O from"nano-spawn";import{tmpdir as k}from"node:os";import*as A from"@clack/prompts";import{parseEnv as j}from"node:util";const M=`package.json`;async function N(n=process.argv.slice(2),r=process.env){let c=P(n);H(c);let{packageJson:l,source:u}=await ie(M),d=await e(),C=re(d.deploy??{},c.environment,r);q(r,[`POSTHOG_API_KEY`,`POSTHOG_PROJECT_ID`]);let w=await U(C,c.environment,()=>x({env:r})),T=p({args:c,config:c.environment===`production`?C.tauriRelease:{},env:r});K(c.environment,T.enabled),await g(T);let D=await S({environment:c.environment}),k=D.values.DASHBOARD_PASSWORD??await J(r,c.environment),j=await o({environment:c.environment}),N=await V(),F=y(c.environment,l.version,N),I=v(l.name,F),L=se(r,c.environment,I,l.name,F),z=c.environment===`production`,W=!1,Y={files:[]};A.intro(`Deploy ${I} to ${c.environment}`);let Z=Object.keys(D.values).sort();Z.length>0&&A.note(Z.join(`
+`),`Pending Worker secret updates`),j.provisioned&&A.log.info(`Provisioning Coreframe-managed access-token signing material.`),await G(c);let Q=await R(await t({config:d.database,env:r})),$=await ee(Q);if($.length>0)throw Error(`Pending deploy migrations contain unsafe SQL. Move unsafe statements to held migrations.\n${i($)}`);let ce=await B(c,Q);try{z&&(await b(M,l,F),Y=await _(T,F)),A.log.step(`Running pre-deploy build`),await O(`pnpm`,[`build`],{env:X(L),stdio:`inherit`});let e=T.enabled?await f({env:X(L),plan:T,releaseName:I,version:F}):void 0;A.log.step(`Running release build and uploading PostHog source maps`),W=!0,await O(`pnpm`,[`build`],{env:L,stdio:`inherit`}),ce&&(A.log.step(`Running deploy-safe database migrations`),await O(`pnpm`,[`db`,`migrate`],{env:L,stdio:`inherit`})),A.log.step(`Deploying Worker and static assets to Cloudflare`);let t={...k?{DASHBOARD_PASSWORD:k}:{},...j.value?{[a]:j.value}:{},...D.values},n=Object.keys(t).length>0?await oe(t):void 0;try{await O(`pnpm`,[`exec`,`wrangler`,`deploy`,`--env`,c.environment,`--strict`,`--keep-vars`,`--tag`,I,`--message`,`Deploy ${I}`,`--var`,`DEPLOY_ENV:${c.environment}`,`--var`,`POSTHOG_RELEASE:${I}`,...n?[`--secrets-file`,n.path]:[]],{env:L,stdio:`inherit`}),await ae(D),await s({environment:c.environment})}finally{await n?.dispose()}let r={environment:c.environment,releaseName:I,url:w,version:F};C.afterWorkerDeploy&&(A.log.step(`Running required after-Worker deploy hook`),await te(C,r)),c.skipPostDeployChecks||(A.log.step(`Running post-deploy checks`),await ne(C,r)),e&&(A.log.step(`Uploading Tauri release artifacts to Backblaze B2`),await h(T,e)),A.outro(`Deployed ${I} to ${c.environment}`)}catch(e){throw!W&&z&&(await E(M,u),await m(Y)),e}}function P(e){return{environment:F(e[0]),runMigrations:e.includes(`--run-migrations`),skipMigrations:e.includes(`--skip-migrations`),skipPostDeployChecks:e.includes(`--skip-post-deploy-checks`),tauriLocalPlatforms:I(e,`--tauri-local-platform`).map(e=>d(e)),tauriWorkflowName:L(e,`--tauri-workflow-name`),tauriWorkflowPlatforms:I(e,`--tauri-workflow-platform`).map(e=>d(e)),tauriWorkflowRef:L(e,`--tauri-workflow-ref`),yes:e.includes(`--yes`)}}function F(e){if(e&&c.includes(e))return e;throw Error(`Deploy environment must be one of: ${c.join(`, `)}.`)}function I(e,t){let n=[];for(let r=0;r<e.length;r+=1){let i=e[r];if(i===t){let i=e[r+1];if(!i||i.startsWith(`--`))throw Error(`${t} requires a value.`);n.push(...i.split(`,`).filter(Boolean)),r+=1;continue}i.startsWith(`${t}=`)&&n.push(...i.slice(t.length+1).split(`,`).filter(Boolean))}return n}function L(e,t){let n=I(e,t);if(n.length>1)throw Error(`${t} can only be provided once.`);return n[0]}async function R(e){try{return await z(e)}finally{await e.close?.()}}async function z(e){return l(await n(),await u(e))}async function B(e,t){if(t.length===0)return A.log.info(`No pending deploy migrations.`),!1;if(A.note(r(t),`Pending deploy migrations`),e.runMigrations)return!0;if(e.skipMigrations)return!1;if(!process.stdout.isTTY)throw Error(`Pending migrations require --run-migrations or --skip-migrations in noninteractive deploys.`);let n=await A.confirm({initialValue:!0,message:`Run these deploy-safe database migrations before Cloudflare deploy?`});if(A.isCancel(n))throw A.cancel(`Deploy cancelled.`),Error(`Deploy cancelled.`);return n}async function V(){let{stdout:e}=await O(`git`,[`status`,`--porcelain`],{stdin:`ignore`});if(e.trim().length>0)throw Error(`Deploy requires a clean git tree.`);let{stdout:t}=await O(`git`,[`rev-parse`,`--short=12`,`HEAD`],{stdin:`ignore`});return t.trim()}function H(e){if(e.runMigrations&&e.skipMigrations)throw Error(`Use only one of --run-migrations or --skip-migrations.`)}async function U(e,t,n=x){return e.url?W(e.url,t):t===`staging`&&e.stagingHostname?W(await n(),t):W(void 0,t)}function W(e,t){if(!e)throw Error(`Missing ${t} deploy URL. Set DEPLOY_URL or deploy.environments.${t}.url in coreframe.config.ts.`);let n;try{n=new URL(e)}catch{throw Error(`Invalid ${t} deploy URL "${e}". Expected an HTTP(S) URL.`)}if(n.protocol!==`http:`&&n.protocol!==`https:`)throw Error(`Invalid ${t} deploy URL "${e}". Expected an HTTP(S) URL.`);return n.toString()}async function G(e){if(e.environment!==`production`||e.yes)return;if(!process.stdout.isTTY)throw Error(`Production deploys require --yes in noninteractive environments.`);let t=await A.confirm({initialValue:!1,message:`Deploy to production?`});if(A.isCancel(t)||!t)throw A.cancel(`Deploy cancelled.`),Error(`Deploy cancelled.`)}function K(e,t){if(e===`staging`&&t)throw Error(`Tauri releases can only be published from production deploys.`)}function q(e,t){let n=t.filter(t=>!e[t]);if(n.length>0)throw Error(`Missing required deploy environment variables: ${n.join(`, `)}`);return Object.fromEntries(t.map(t=>[t,e[t]]))}async function J(e,t){let n=e.DASHBOARD_PASSWORD?.trim();if(n)return n;let r;try{r=j(await w(`.env`,`utf8`))}catch(e){throw Y(e)&&e.code===`ENOENT`?Error(`Missing ${t} dashboard password. Set DASHBOARD_PASSWORD in ".env".`):e}let i=r.DASHBOARD_PASSWORD?.trim();if(!i)throw Error(`Missing ${t} dashboard password. Set DASHBOARD_PASSWORD in ".env".`);return i}async function oe(e){let t=await C(D(k(),`coreframe-deploy-secrets-`)),n=D(t,`secrets.json`);return await E(n,JSON.stringify(e),{mode:384}),{path:n,dispose:()=>T(t,{force:!0,recursive:!0})}}function Y(e){return e instanceof Error&&`code`in e}function se(e,t,n,r,i){return{...e,CLOUDFLARE_ENV:t,DEPLOY_ENV:t,POSTHOG_RELEASE:n,POSTHOG_RELEASE_NAME:e.POSTHOG_RELEASE_NAME??r,POSTHOG_RELEASE_VERSION:e.POSTHOG_RELEASE_VERSION??i}}function X(e){let{POSTHOG_API_KEY:t,POSTHOG_PROJECT_ID:n,...r}=e;return r}export{N as deployProject,P as parseDeployArgs,e as readProjectConfig,J as resolveDashboardPassword,U as resolveDeployUrl};

package/dist/dev-lock.js

@@ -1 +1 @@
-import{randomUUID as e}from"node:crypto";import{link as t,mkdir as n,readFile as r,unlink as i,writeFile as a}from"node:fs/promises";import o from"node:path";import*as s from"@clack/prompts";import c from"node:process";const l={isRunning:h,stop(e){try{c.kill(e,`SIGTERM`)}catch(e){if(!v(e))throw e}},waitForExit:g};async function u({confirmStop:r=f,cwd:s=c.cwd(),interactive:u=c.stdin.isTTY===!0,pid:p=c.pid,processes:h=l}={}){let g=o.resolve(s,`.coreframe/dev.lock`),v={pid:p,token:e()},y=`${JSON.stringify(v)}\n`,b=`${g}.${v.token}.tmp`,x=!1;await n(o.dirname(g),{recursive:!0}),await a(b,y,{flag:`wx`,mode:384});try{for(;;){try{return await t(b,g),{async release(){await m(g,y)},takeoverApproved:x}}catch(e){if(!_(e))throw e}let e=await d({confirmStop:r,file:g,interactive:u,processes:h});if(e===void 0)return;x||=e}}finally{await i(b).catch(()=>void 0)}}async function d({confirmStop:e,file:t,interactive:n,processes:r}){let i=await p(t);if(!i||!r.isRunning(i.owner.pid))return await m(t,i?.source),!1;if(!n)throw Error(`Coreframe dev is already running for this project (PID ${i.owner.pid}). Stop it before starting another.`);if(await e(i.owner.pid))return r.stop(i.owner.pid),await r.waitForExit(i.owner.pid),await m(t,i.source),!0}async function f(e){let t=await s.confirm({initialValue:!1,message:`Coreframe dev is already running for this project (PID ${e}). Stop it and start here?`});return s.isCancel(t)||!t?(s.cancel(`Keeping the existing Coreframe dev process.`),!1):!0}async function p(e){try{let t=await r(e,`utf8`),n=JSON.parse(t);return!Number.isSafeInteger(n.pid)||Number(n.pid)<=0||!n.token?void 0:{owner:n,source:t}}catch{return}}async function m(e,t){let n=await r(e,`utf8`).catch(()=>void 0);(t===void 0||n===t)&&await i(e).catch(()=>void 0)}function h(e){try{return c.kill(e,0),!0}catch(e){return!v(e)}}async function g(e){let t=Date.now()+1e4;for(;h(e);){if(Date.now()>=t)throw Error(`Coreframe dev process ${e} did not stop within 10 seconds.`);await new Promise(e=>setTimeout(e,50))}}function _(e){return y(e)&&e.code===`EEXIST`}function v(e){return y(e)&&e.code===`ESRCH`}function y(e){return e instanceof Error}export{u as acquireDevLock};
+import{link as e,mkdir as t,readFile as n,unlink as r,writeFile as i}from"node:fs/promises";import a from"node:path";import{randomUUID as o}from"node:crypto";import*as s from"@clack/prompts";import c from"node:process";const l={isRunning:h,stop(e){try{c.kill(e,`SIGTERM`)}catch(e){if(!v(e))throw e}},waitForExit:g};async function u({confirmStop:n=f,cwd:s=c.cwd(),interactive:u=c.stdin.isTTY===!0,pid:p=c.pid,processes:h=l}={}){let g=a.resolve(s,`.coreframe/dev.lock`),v={pid:p,token:o()},y=`${JSON.stringify(v)}\n`,b=`${g}.${v.token}.tmp`,x=!1;await t(a.dirname(g),{recursive:!0}),await i(b,y,{flag:`wx`,mode:384});try{for(;;){try{return await e(b,g),{async release(){await m(g,y)},takeoverApproved:x}}catch(e){if(!_(e))throw e}let t=await d({confirmStop:n,file:g,interactive:u,processes:h});if(t===void 0)return;x||=t}}finally{await r(b).catch(()=>void 0)}}async function d({confirmStop:e,file:t,interactive:n,processes:r}){let i=await p(t);if(!i||!r.isRunning(i.owner.pid))return await m(t,i?.source),!1;if(!n)throw Error(`Coreframe dev is already running for this project (PID ${i.owner.pid}). Stop it before starting another.`);if(await e(i.owner.pid))return r.stop(i.owner.pid),await r.waitForExit(i.owner.pid),await m(t,i.source),!0}async function f(e){let t=await s.confirm({initialValue:!1,message:`Coreframe dev is already running for this project (PID ${e}). Stop it and start here?`});return s.isCancel(t)||!t?(s.cancel(`Keeping the existing Coreframe dev process.`),!1):!0}async function p(e){try{let t=await n(e,`utf8`),r=JSON.parse(t);return!Number.isSafeInteger(r.pid)||Number(r.pid)<=0||!r.token?void 0:{owner:r,source:t}}catch{return}}async function m(e,t){let i=await n(e,`utf8`).catch(()=>void 0);(t===void 0||i===t)&&await r(e).catch(()=>void 0)}function h(e){try{return c.kill(e,0),!0}catch(e){return!v(e)}}async function g(e){let t=Date.now()+1e4;for(;h(e);){if(Date.now()>=t)throw Error(`Coreframe dev process ${e} did not stop within 10 seconds.`);await new Promise(e=>setTimeout(e,50))}}function _(e){return y(e)&&e.code===`EEXIST`}function v(e){return y(e)&&e.code===`ESRCH`}function y(e){return e instanceof Error}export{u as acquireDevLock};

package/dist/environment.d.ts

@@ -1,6 +1,6 @@
 import { access, chmod, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { readFileSync } from "node:fs";
 import { homedir, networkInterfaces, tmpdir } from "node:os";
+import { readFileSync } from "node:fs";
 
 //#region environment.d.ts
 declare const fs: {

package/dist/environment.js

@@ -1 +1 @@
-import{access as e,chmod as t,mkdir as n,mkdtemp as r,readFile as i,rm as a,writeFile as o}from"node:fs/promises";import s from"node:process";import{readFileSync as c}from"node:fs";import{createServer as l}from"node:net";import{homedir as u,networkInterfaces as d,tmpdir as f}from"node:os";const p={access:e,chmod:t,mkdir:n,mkdtemp:r,readFile:i,readFileSync:c,rm:a,writeFile:o},m={getAvailablePort:g},h={homedir:u,kill:s.kill,networkInterfaces:d,tmpdir:f};async function g(){let e=l();try{await new Promise((t,n)=>{e.once(`error`,n),e.listen(0,`127.0.0.1`,t)});let t=e.address();if(!t||typeof t==`string`)throw Error(`Could not allocate an available TCP port.`);return t.port}finally{e.listening&&await new Promise((t,n)=>{e.close(e=>e?n(e):t())})}}export{p as fs,m as net,h as os};
+import{access as e,chmod as t,mkdir as n,mkdtemp as r,readFile as i,rm as a,writeFile as o}from"node:fs/promises";import{homedir as s,networkInterfaces as c,tmpdir as l}from"node:os";import u from"node:process";import{readFileSync as d}from"node:fs";import{createServer as f}from"node:net";const p={access:e,chmod:t,mkdir:n,mkdtemp:r,readFile:i,readFileSync:d,rm:a,writeFile:o},m={getAvailablePort:g},h={homedir:s,kill:u.kill,networkInterfaces:c,tmpdir:l};async function g(){let e=f();try{await new Promise((t,n)=>{e.once(`error`,n),e.listen(0,`127.0.0.1`,t)});let t=e.address();if(!t||typeof t==`string`)throw Error(`Could not allocate an available TCP port.`);return t.port}finally{e.listening&&await new Promise((t,n)=>{e.close(e=>e?n(e):t())})}}export{p as fs,m as net,h as os};

package/dist/managed-dev.js

@@ -1,4 +1,4 @@
-import{createHash as e,randomBytes as t}from"node:crypto";import{access as n,copyFile as r,mkdir as i,mkdtemp as a,open as o,readFile as s,realpath as c,rm as l,unlink as u,writeFile as d}from"node:fs/promises";import f from"node:path";import p,{SubprocessError as m}from"nano-spawn";import{pathToFileURL as h}from"node:url";import g from"node:process";import{constants as _,watch as v}from"node:fs";import{resolve as y}from"import-meta-resolve";const b=`refs/heads/main`,x=`refs/heads/dev`,ee=`refs/remotes/origin/main`,S=/^[a-z][a-z0-9-]*(?:\([^)]+\))?!?:\s+\S/i,C=`coreframe-managed-dev-setup-failure.json`;async function w(e=g.cwd()){let t=await k(e);return t.primary&&t.branch===`main`&&t.head===t.main}async function T(e=g.cwd()){try{let{commonDir:t,gitDir:n}=await E(e);return n===t}catch{return!1}}async function E(e){let t=await c(await K(e,[`rev-parse`,`--show-toplevel`])),n=await c(e),r=f.resolve(n,await K(e,[`rev-parse`,`--git-dir`])),i=f.resolve(n,await K(e,[`rev-parse`,`--git-common-dir`]));return{commonDir:i,gitDir:r,primary:t===n&&r===i}}async function D({config:e,cwd:t=g.cwd(),env:n=g.env,onRestart:r=()=>void 0,onStatusChange:i=()=>void 0,remoteCheckInterval:a=6e4,runCheck:o=e=>se(t,n,e),watchState:s=ne}){let c=n,l={mode:`waiting`,warnings:[]},m=!1,h=!1,_=!1,v=!1,y,w,T,E,D,O=[],A,N,P=Promise.resolve(),F=()=>{m||i(l)},I=async({fetch:e=!1}={})=>{if(!(!h||m||!w)){if(_){v=!0;return}try{let[n,r,i]=await Promise.all([K(t,[`rev-parse`,`--abbrev-ref`,`HEAD`]),K(t,[`rev-parse`,`HEAD`]),K(t,[`rev-parse`,b])]);if(n!==`main`||r!==i){l={message:`Managed synchronization is paused until the primary checkout is back on local main.`,mode:`waiting`,warnings:[]};return}r!==y&&(y=r,A=void 0);let a=await j(t);if(a.tracked||a.untracked.length>0){l={...l,currentCommit:y,draft:a,message:void 0,mode:`managed`,proposal:B(a.fingerprint),target:void 0};return}e&&await q(t,[`remote`,`get-url`,`origin`])&&await G(t,[`fetch`,`origin`,`+refs/heads/main:${ee}`]);let o=await q(t,[`rev-parse`,x]),s=await q(t,[`rev-parse`,ee]),c=[...s?[{commit:s,source:`upstream`}]:[],...o?[{commit:o,source:`dev`}]:[]],u;for(let e of c)if(!await _e(t,e.commit,y)){u=e;break}l={...l,currentCommit:y,draft:void 0,message:void 0,mode:`managed`,proposal:void 0,target:u===void 0?void 0:await me(t,u.commit,u.source)}}catch(e){l={...l,message:Z(e),warnings:[Z(e)]}}finally{F()}}},L=()=>{clearTimeout(D),D=setTimeout(()=>void I(),50),D.unref()},R=e=>{let t=async()=>{let t=[{command:`pnpm typecheck`,status:`running`},{command:`pnpm test`,status:`pending`}],n=()=>{l={...l,checks:{commit:e,commands:structuredClone(t)}},F()};n();for(let[e,r]of[`typecheck`,`test`].entries()){e>0&&(t[e].status=`running`,n());try{await o(r),t[e].status=`passed`}catch(n){t[e].status=`failed`,t[e].output=ce(n)}n()}};P=P.then(t,t)},ue=async()=>{if(h||m)return;let e=await k(t);if(!e.primary){l={message:`Managed development only runs from the primary checkout.`,mode:`unmanaged`,warnings:[]},F();return}if(e.branch!==`main`||e.head!==e.main){let t=`Managed development requires the primary checkout on local main; current branch is ${e.branch??`detached HEAD`}.`;console.warn(`Coreframe managed development disabled: ${t}`),l={message:t,mode:`unmanaged`,warnings:[]},F();return}T=f.join(e.commonDir,`coreframe-managed-dev.lock`),await he(T),await q(t,[`rev-parse`,`--verify`,x])||await G(t,[`branch`,`dev`,e.head]),w=e,y=e.head,h=!0,l={currentCommit:e.head,mode:`managed`,setupFailure:await te(e.commonDir,e.head),warnings:[]},F(),O=await s(e,L),E=setInterval(()=>void I({fetch:!0}),a),E.unref(),await I(),I({fetch:!0})},de=async(e,{onCodexEvent:n=()=>void 0}={})=>{if(!h||l.mode!==`managed`)throw Error(`Managed development is not active.`);if(_)throw Error(`Another managed development action is already running.`);_=!0,l={...l,busy:ye(e),message:void 0},F();try{if(e.type===`reject`)l={...l,draft:void 0,proposal:void 0};else if(e.type===`prepare`){let r=z(e.target),i=await j(t);i.tracked||i.untracked.length>0?l={...l,draft:i,proposal:B(i.fingerprint)}:await U({onCodexEvent:n,source:r.source,target:e.target})}else if(e.type===`message`){let n=await V(e.fingerprint,e.untracked),r=B(n.fingerprint);if(r===void 0){try{if(N??=ie(`codex`,c),!await N)throw Error("Codex CLI is not installed or is unavailable on PATH. Install it with `npm install -g @openai/codex`, then restart the dev server.");r=await re(t,c,n.context)}catch(e){r=``,l={...l,warnings:[...l.warnings,`Codex could not generate a commit message: ${Z(e)}`]}}A={fingerprint:n.fingerprint,message:r}}l={...l,draft:n,proposal:r}}else if(e.type===`commit`){let t=await H(e);l={...l,currentCommit:t,draft:void 0,message:void 0,proposal:void 0,target:void 0},L()}else if(e.type===`retry-install`)await be();else if(e.type===`reset-database`)await xe();else{let r=z(e.target),i=await j(t);if(i.tracked||i.untracked.length>0){if(!e.fingerprint||!e.untracked)throw Error(`Refresh requires the current working-tree confirmation.`);if(await V(e.fingerprint,e.untracked),!e.message||!S.test(Y(e.message)))throw Error(`Enter a commit message with a valid Conventional Commits header.`)}await U({fingerprint:e.fingerprint,message:e.message,onCodexEvent:n,source:r.source,target:e.target,untracked:e.untracked})}}finally{_=!1,l={...l,busy:void 0},F(),v&&(v=!1,L())}return{status:l}},z=e=>{if(!l.target||l.target.commit!==e)throw Error(`The offered update changed. Review the latest target before refreshing.`);return l.target},B=e=>A?.fingerprint===e?A.message:void 0,V=async(e,n)=>{let r=await j(t);if(r.fingerprint!==e)throw A=void 0,Error(`Working-tree changes changed; generate a new commit message.`);if(!ve(r.untracked,n))throw Error(`Include every untracked file or remove it before refreshing.`);return r},H=async({fingerprint:e,message:n,untracked:r})=>{let i=await V(e,r);if(!n||!S.test(Y(n)))throw Error(`Enter a commit message with a valid Conventional Commits header.`);await G(t,[`add`,`--update`]),i.untracked.length>0&&await G(t,[`add`,`--`,...r]),await G(t,[`commit`,`--message`,n],{env:{GIT_EDITOR:`true`}});let a=await K(t,[`rev-parse`,`HEAD`]);return y=a,A=void 0,a},U=async({fingerprint:e,message:n,onCodexEvent:r=()=>void 0,source:i,target:a,untracked:o=[]})=>{z(a);let s=await K(t,[`rev-parse`,`HEAD`]),u,d,f=await j(t);if(f.tracked||f.untracked.length>0){if(!e||f.fingerprint!==e||!ve(f.untracked,o))throw Error(`Working-tree changes changed; review them before refreshing.`);await G(t,[`add`,`--update`]),o.length>0&&await G(t,[`add`,`--`,...o]),await G(t,[`commit`,`--message`,n],{env:{GIT_EDITOR:`true`}}),u=await K(t,[`rev-parse`,`HEAD`]),y=u,d=`refs/coreframe/recovery/${Date.now()}-${u.slice(0,12)}`,await G(t,[`update-ref`,d,u])}let p=u??s,m;try{if(m=await ae({cwd:t,env:c,localMain:p,onCodexEvent:r,source:i,target:a}),await K(t,[`rev-parse`,`HEAD`])!==p)throw Error(`HEAD changed while the accepted update was being prepared.`);if(await K(t,[`rev-parse`,b])!==p)throw Error(`Local main changed while the accepted update was being prepared.`);await oe(t,m,p),y=m.commit,await G(t,[`reset`,`--hard`,m.commit]);let e=J(await K(t,[`diff`,`--name-only`,`-z`,s,m.commit]));A=void 0,d&&await G(t,[`update-ref`,`-d`,d]),l={...l,currentCommit:m.commit,draft:void 0,proposal:void 0,setupFailure:void 0,target:void 0},await W({installDependencies:fe(e),restartRequired:pe(e)})}catch(e){e instanceof M&&(v=!0);let t=d?` Recovery commit: ${d}.`:``;throw l={...l,currentCommit:y,message:`${Z(e)}${t}`},e}},W=async({installDependencies:n,restartRequired:i})=>{let a=y;if(n)try{await Ce([`install`,`--frozen-lockfile`])}catch(e){await Q({command:`pnpm install --frozen-lockfile`,commit:a,error:e,message:`The project was synchronized, but dependency installation failed. Fix the package or lockfile issue, then retry the install.`,restartRequired:i,stage:`dependencies`});return}try{await le({config:e,cwd:t,env:c})}catch(e){await Q({command:`pnpm db migrate`,commit:a,error:e,message:`The project was synchronized, but its database migration failed. The previous database was restored. Reset the database to recreate it, apply migrations, and rerun seed scripts.`,restartRequired:i,stage:`migration`});return}await $(),R(a),i&&r()},be=async()=>{let e=Se(`dependencies`);await $(),await W({installDependencies:!0,restartRequired:e.restartRequired})},xe=async()=>{let e=Se(`migration`);try{await Ce([`db`,`setup`])}catch(t){await Q({command:`pnpm db setup`,commit:e.commit,error:t,message:`The project remains synchronized, but the database reset failed. Review the diagnostics, fix the reported problem, and try the reset again.`,restartRequired:e.restartRequired,stage:`migration`});return}await $(),R(e.commit),e.restartRequired&&r()},Se=e=>{if(!l.setupFailure||l.setupFailure.stage!==e)throw Error(`There is no failed ${e} setup step to recover.`);return l.setupFailure},Ce=async e=>{await p(X(),e,{cwd:t,env:c})},Q=async({command:e,commit:t,error:n,message:r,restartRequired:i,stage:a})=>{let o=ce(n).slice(-1e5),s={command:e,commit:t,message:r,output:o,restartRequired:i,stage:a};l={...l,setupFailure:s,target:void 0},console.error(`Coreframe managed development setup failed (${e}): ${r}\n${o}`);let c=we();c&&await d(c,`${JSON.stringify(s)}\n`,{mode:384}).catch(e=>{console.warn(`Could not persist the managed-development setup failure: ${Z(e)}`)})},$=async()=>{l={...l,setupFailure:void 0};let e=we();e&&await u(e).catch(e=>{e instanceof Error&&`code`in e&&e.code===`ENOENT`||console.warn(`Could not clear the managed-development setup failure: ${Z(e)}`)})},we=()=>w?f.join(w.commonDir,C):void 0;return{action:de,activate:ue,getStatus:()=>l,async close(){if(!m){m=!0,clearInterval(E),clearTimeout(D);for(let e of O)e.close();await ge(T)}}}}async function te(e,t){let n=f.join(e,C);try{let e=JSON.parse(await s(n,`utf8`));if(O(e)&&e.commit===t)return e}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;console.warn(`Could not read the managed-development setup failure: ${Z(e)}`)}await u(n).catch(()=>void 0)}function O(e){if(!e||typeof e!=`object`)return!1;let t=e;return(t.command===`pnpm db migrate`||t.command===`pnpm db setup`||t.command===`pnpm install --frozen-lockfile`)&&typeof t.commit==`string`&&typeof t.message==`string`&&typeof t.output==`string`&&typeof t.restartRequired==`boolean`&&(t.stage===`dependencies`||t.stage===`migration`)}async function k(e){let t=await E(e);return{branch:A(await K(e,[`rev-parse`,`--abbrev-ref`,`HEAD`])),commonDir:t.commonDir,gitDir:t.gitDir,head:await K(e,[`rev-parse`,`HEAD`]),main:await K(e,[`rev-parse`,b]),primary:t.primary}}function A(e){return e===`HEAD`?void 0:e}async function ne(e,t){let n=[e.gitDir,f.join(e.commonDir,`refs`,`heads`)],r=[];for(let e of n)try{r.push(v(e,{persistent:!1},t))}catch{}return r}async function j(t){let[n,r,i]=await Promise.all([K(t,[`status`,`--porcelain`,`--untracked-files=no`]),K(t,[`diff`,`HEAD`,`--binary`]),K(t,[`ls-files`,`--others`,`--exclude-standard`,`-z`])]),a=J(i).sort(),o=e(`sha256`).update(r),c=[`Tracked changes:`,r];for(let e of a){let n=await s(f.join(t,e));o.update(e).update(n),c.push(`\nUntracked file: ${e}\n`,n.toString(`utf8`))}return{context:c.join(`
-`),fingerprint:o.digest(`hex`),tracked:n.length>0,untracked:a}}async function re(e,t,n){let{stdout:r}=await p(`codex`,[`exec`,`--ephemeral`,`--ignore-user-config`,`--sandbox`,`read-only`,`--cd`,e,`Return only a concise Conventional Commits message for the supplied working-tree changes. Use a body only when it adds material context.`],{cwd:e,env:t,stderr:`ignore`,stdin:{string:n}});return r.trim().replace(/^```(?:text)?\s*|\s*```$/g,``)}async function ie(e,t){let r=t.PATH??t.Path??t.path??``,i=g.platform===`win32`?(t.PATHEXT??`.COM;.EXE;.BAT;.CMD`).split(`;`):[``];for(let t of r.split(f.delimiter))for(let r of i)try{return await n(f.join(t||`.`,`${e}${r}`),_.X_OK),!0}catch{}return!1}var M=class extends Error{constructor(){super(`Local dev advanced while this update was being prepared. Nothing was changed. Review the latest update and try again.`)}};async function ae({cwd:e,env:n,localMain:r,onCodexEvent:a,source:o,target:s}){if(o===`dev`&&await _e(e,r,s))return{commit:s,devTarget:s};let c=f.resolve(e,await K(e,[`rev-parse`,`--git-common-dir`])),u=f.join(c,`coreframe-managed-dev`);await i(u,{recursive:!0});let d=t(8).toString(`hex`),p=f.join(u,`integration-${d}`);try{let t=o===`dev`?s:r,i=o===`dev`?r:s;if(await G(e,[`worktree`,`add`,`--detach`,p,t]),r!==s){let e=await q(p,[`merge-base`,r,s]);await N(p,n,e?[`rebase`,`--onto`,i,e]:[`rebase`,`--root`,`--onto`,i],`rebase`,a)}return{commit:await K(p,[`rev-parse`,`HEAD`]),devTarget:o===`dev`?s:void 0}}finally{await G(e,[`worktree`,`remove`,`--force`,p]).catch(()=>void 0),await l(p,{force:!0,recursive:!0})}}async function oe(e,t,n){let r=[`start`,`update ${b} ${t.commit} ${n}`];t.devTarget&&r.push(t.devTarget===t.commit?`verify ${x} ${t.devTarget}`:`update ${x} ${t.commit} ${t.devTarget}`),r.push(`prepare`,`commit`);try{await p(`git`,[`update-ref`,`--stdin`],{cwd:e,stdin:{string:`${r.join(`
-`)}\n`}})}catch(r){if(t.devTarget)try{let[r,i]=await Promise.all([K(e,[`rev-parse`,b]),q(e,[`rev-parse`,x])]);if(r===n&&i!==t.devTarget)throw new M}catch(e){if(e instanceof M)throw e}throw r}}async function N(e,t,n,r,i){try{await G(e,n,{env:{GIT_EDITOR:`true`}});return}catch(n){let a=await I(e);if(a.length===0)throw n;try{for(;a.length>0;){await P(e,t,r,a,i),await G(e,[`diff`,`--check`]),await G(e,[`add`,`--all`]);let n=await I(e);if(n.length>0)throw Error(`Codex left unresolved paths: ${n.join(`, `)}`);try{await G(e,[r,`--continue`],{env:{GIT_EDITOR:`true`}})}catch(t){if(a=await I(e),a.length===0)throw t;continue}a=await I(e)}return}catch(t){throw await G(e,[r,`--abort`]).catch(()=>void 0),Error(`Codex could not resolve ${r} conflicts: ${Z(t)}`)}}}async function P(e,t,n,r,i){i({phase:`start`});let a=p(`codex`,[`exec`,`--ephemeral`,`--ignore-user-config`,`--sandbox`,`workspace-write`,`--cd`,e,`Resolve the current Git ${n} conflicts cleanly. Edit only files needed for the resolution, preserve intended behavior from both sides, remove all conflict markers, and do not stage files or run Git continuation commands. Conflicted paths: ${r.join(`, `)}`],{cwd:e,env:t,stdin:`ignore`}),o=[];try{await Promise.all([F(a.stdout,e=>o.push(e)),F(a.stderr,e=>i({phase:`stderr`,text:`${e}\n`}))])}catch(e){throw i({phase:`error`}),e}i({message:o.join(`
-`).trim(),phase:`complete`})}async function F(e,t){for await(let n of e)t(n)}async function I(e){return J(await K(e,[`diff`,`--name-only`,`--diff-filter=U`,`-z`]))}async function se(e,t,n){await p(X(),[n],{cwd:e,env:t})}function ce(e){if(e instanceof m){let t=e.output.trim();if(t)return t}return Z(e)}async function le({config:e,cwd:t,env:n}){if(!e.database)return;let r=await L({config:e,cwd:t,env:n});try{await p(X(),[`db`,`migrate`],{cwd:t,env:n})}catch(e){throw await r.restore(),e}await r.discard().catch(e=>{console.warn(`Could not remove the managed-development database snapshot: ${Z(e)}`)}),await l(r.directory,{force:!0,recursive:!0})}async function L({config:e,cwd:t,env:n}){let o=f.join(t,`.coreframe`,`managed-dev-backups`);await i(o,{recursive:!0});let s=await a(f.join(o,`refresh-`));if(e.database?.dialect===`sqlite`){let e=[`turso.db`,`turso.db-wal`,`turso.db-shm`],n=new Set;for(let r of e)await R(f.join(t,`.coreframe`,r),f.join(s,r))&&n.add(r);return{directory:s,async discard(){},async restore(){for(let i of e){let e=f.join(t,`.coreframe`,i);n.has(i)?await r(f.join(s,i),e):await l(e,{force:!0})}}}}if(!n.DATABASE_URL)throw Error(`DATABASE_URL is required to snapshot local PostgreSQL.`);let c=await ue(t);if(c)return de({directory:s,connectionString:n.DATABASE_URL,postgres:c});let u=f.join(s,`database.dump`),d=U(n,n.DATABASE_URL);return await p(`pg_dump`,[`--format=custom`,`--file`,u],{cwd:t,env:d,stdin:`ignore`}),{directory:s,async discard(){},async restore(){await p(`pg_restore`,[`--clean`,`--if-exists`,`--no-owner`,`--dbname`,d.PGDATABASE,u],{cwd:t,env:d,stdin:`ignore`})}}}async function R(e,t){try{return await r(e,t),!0}catch(e){if(!(e instanceof Error&&`code`in e&&e.code===`ENOENT`))throw e;return!1}}async function ue(e){let t=JSON.parse(await s(f.join(e,`package.json`),`utf8`));if(!(!t.dependencies?.pg&&!t.devDependencies?.pg&&!t.optionalDependencies?.pg))try{return await import(y(`pg`,h(f.join(e,`package.json`)).href))}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ERR_MODULE_NOT_FOUND`)return;throw e}}async function de({directory:e,connectionString:n,postgres:r}){let i=new URL(n),a=decodeURIComponent(i.pathname.slice(1));if(!a)throw Error(`DATABASE_URL must name a PostgreSQL database to snapshot.`);let o=`coreframe_backup_${t(6).toString(`hex`)}`,s=`${o}_failed`,c=new URL(i);c.pathname=a===`postgres`?`/template1`:`/postgres`;let l=new r.Client({connectionString:c.href});await l.connect();try{await B(l,a,!1),await V(l,a),await l.query(`CREATE DATABASE ${H(o)} WITH TEMPLATE ${H(a)}`),await B(l,o,!0)}finally{await B(l,a,!0).catch(()=>void 0),await l.end()}return{directory:e,async discard(){await z(r,c.href,async e=>{await V(e,o),await e.query(`DROP DATABASE ${H(o)}`)})},async restore(){await z(r,c.href,async e=>{await B(e,a,!1),await V(e,a),await e.query(`ALTER DATABASE ${H(a)} RENAME TO ${H(s)}`);try{await e.query(`ALTER DATABASE ${H(o)} RENAME TO ${H(a)}`)}catch(t){throw await e.query(`ALTER DATABASE ${H(s)} RENAME TO ${H(a)}`).catch(()=>void 0),await B(e,a,!0).catch(()=>void 0),t}await V(e,s),await e.query(`DROP DATABASE ${H(s)}`)})}}}async function z(e,t,n){let r=new e.Client({connectionString:t});await r.connect();try{return await n(r)}finally{await r.end()}}async function B(e,t,n){await e.query(`ALTER DATABASE ${H(t)} ALLOW_CONNECTIONS ${n?`true`:`false`}`)}async function V(e,t){await e.query(`SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1 AND pid <> pg_backend_pid()`,[t])}function H(e){return`"${e.replaceAll(`"`,`""`)}"`}function U(e,t){let n=new URL(t);return{...e,PGDATABASE:decodeURIComponent(n.pathname.slice(1)),PGHOST:n.hostname,PGPASSWORD:decodeURIComponent(n.password),PGPORT:n.port||`5432`,PGUSER:decodeURIComponent(n.username)}}function fe(e){return e.some(e=>f.basename(e)===`package.json`||f.basename(e).endsWith(`lock.yaml`)||f.basename(e)===`pnpm-workspace.yaml`)}function pe(e){return e.some(e=>fe([e])||/(^|\/)(vite|coreframe|tsconfig|drizzle)\.[^/]+$/.test(e)||/(^|\/)(drizzle|scripts|src\/api|tauri)(\/|$)/.test(e))}async function me(e,t,n){return{commit:t,shortCommit:t.slice(0,12),source:n,subject:await K(e,[`show`,`-s`,`--format=%s`,t])}}async function he(e){try{let t=await o(e,`wx`);await t.writeFile(`${g.pid}\n`),await t.close()}catch(t){if(!(t instanceof Error&&`code`in t&&t.code===`EEXIST`))throw t;let n=(await s(e,`utf8`).catch(()=>`unknown`)).trim(),r=Number(n);if(Number.isInteger(r)&&!W(r)){await u(e).catch(()=>void 0),await he(e);return}throw Error(`Managed development is already owned by PID ${n}.`)}}function W(e){try{return g.kill(e,0),!0}catch(e){return!(e instanceof Error&&`code`in e&&e.code===`ESRCH`)}}async function ge(e){e&&(await s(e,`utf8`).catch(()=>void 0))?.trim()===String(g.pid)&&await u(e).catch(()=>void 0)}async function G(e,t,{env:n}={}){return p(`git`,t,{cwd:e,env:n,stdin:`ignore`})}async function K(e,t){return(await G(e,t)).stdout.trim()}async function q(e,t){try{return await K(e,t)||void 0}catch(e){if(e instanceof m&&e.exitCode&&e.exitCode>0)return;throw e}}async function _e(e,t,n){try{return await G(e,[`merge-base`,`--is-ancestor`,t,n]),!0}catch(e){if(e instanceof m&&e.exitCode===1)return!1;throw e}}function ve(e,t){return e.length===t.length&&[...e].sort().every((e,n)=>e===[...t].sort()[n])}function J(e){return e.split(`\0`).filter(Boolean)}function Y(e){return e.split(/\r?\n/,1)[0]??``}function ye(e){return e.type===`message`?`Generating commit message`:e.type===`commit`?`Committing local changes`:e.type===`apply`?`Integrating accepted update`:e.type===`prepare`?`Reviewing working tree`:e.type===`retry-install`?`Retrying dependency installation`:e.type===`reset-database`?`Resetting local database`:`Aborting refresh`}function X(){return g.platform===`win32`?`pnpm.cmd`:`pnpm`}function Z(e){return e instanceof Error?e.message:String(e)}export{w as isManagedDevCheckout,T as isPrimaryCheckout,D as startManagedDevSession};
+import{access as e,copyFile as t,mkdir as n,mkdtemp as r,open as i,readFile as a,realpath as o,rm as s,unlink as c,writeFile as l}from"node:fs/promises";import u from"node:path";import d,{SubprocessError as f}from"nano-spawn";import{pathToFileURL as p}from"node:url";import{createHash as m,randomBytes as h}from"node:crypto";import g from"node:process";import{constants as _,watch as v}from"node:fs";import{resolve as y}from"import-meta-resolve";const b=`refs/heads/main`,x=`refs/heads/dev`,ee=`refs/remotes/origin/main`,S=/^[a-z][a-z0-9-]*(?:\([^)]+\))?!?:\s+\S/i,C=`coreframe-managed-dev-setup-failure.json`;async function w(e=g.cwd()){let t=await k(e);return t.primary&&t.branch===`main`&&t.head===t.main}async function T(e=g.cwd()){try{let{commonDir:t,gitDir:n}=await E(e);return n===t}catch{return!1}}async function E(e){let t=await o(await K(e,[`rev-parse`,`--show-toplevel`])),n=await o(e),r=u.resolve(n,await K(e,[`rev-parse`,`--git-dir`])),i=u.resolve(n,await K(e,[`rev-parse`,`--git-common-dir`]));return{commonDir:i,gitDir:r,primary:t===n&&r===i}}async function D({config:e,cwd:t=g.cwd(),env:n=g.env,onRestart:r=()=>void 0,onStatusChange:i=()=>void 0,remoteCheckInterval:a=6e4,runCheck:o=e=>se(t,n,e),watchState:s=ne}){let f=n,p={mode:`waiting`,warnings:[]},m=!1,h=!1,_=!1,v=!1,y,w,T,E,D,O=[],A,N,P=Promise.resolve(),F=()=>{m||i(p)},I=async({fetch:e=!1}={})=>{if(!(!h||m||!w)){if(_){v=!0;return}try{let[n,r,i]=await Promise.all([K(t,[`rev-parse`,`--abbrev-ref`,`HEAD`]),K(t,[`rev-parse`,`HEAD`]),K(t,[`rev-parse`,b])]);if(n!==`main`||r!==i){p={message:`Managed synchronization is paused until the primary checkout is back on local main.`,mode:`waiting`,warnings:[]};return}r!==y&&(y=r,A=void 0);let a=await j(t);if(a.tracked||a.untracked.length>0){p={...p,currentCommit:y,draft:a,message:void 0,mode:`managed`,proposal:B(a.fingerprint),target:void 0};return}e&&await q(t,[`remote`,`get-url`,`origin`])&&await G(t,[`fetch`,`origin`,`+refs/heads/main:${ee}`]);let o=await q(t,[`rev-parse`,x]),s=await q(t,[`rev-parse`,ee]),c=[...s?[{commit:s,source:`upstream`}]:[],...o?[{commit:o,source:`dev`}]:[]],l;for(let e of c)if(!await _e(t,e.commit,y)){l=e;break}p={...p,currentCommit:y,draft:void 0,message:void 0,mode:`managed`,proposal:void 0,target:l===void 0?void 0:await me(t,l.commit,l.source)}}catch(e){p={...p,message:Z(e),warnings:[Z(e)]}}finally{F()}}},L=()=>{clearTimeout(D),D=setTimeout(()=>void I(),50),D.unref()},R=e=>{let t=async()=>{let t=[{command:`pnpm typecheck`,status:`running`},{command:`pnpm test`,status:`pending`}],n=()=>{p={...p,checks:{commit:e,commands:structuredClone(t)}},F()};n();for(let[e,r]of[`typecheck`,`test`].entries()){e>0&&(t[e].status=`running`,n());try{await o(r),t[e].status=`passed`}catch(n){t[e].status=`failed`,t[e].output=ce(n)}n()}};P=P.then(t,t)},ue=async()=>{if(h||m)return;let e=await k(t);if(!e.primary){p={message:`Managed development only runs from the primary checkout.`,mode:`unmanaged`,warnings:[]},F();return}if(e.branch!==`main`||e.head!==e.main){let t=`Managed development requires the primary checkout on local main; current branch is ${e.branch??`detached HEAD`}.`;console.warn(`Coreframe managed development disabled: ${t}`),p={message:t,mode:`unmanaged`,warnings:[]},F();return}T=u.join(e.commonDir,`coreframe-managed-dev.lock`),await he(T),await q(t,[`rev-parse`,`--verify`,x])||await G(t,[`branch`,`dev`,e.head]),w=e,y=e.head,h=!0,p={currentCommit:e.head,mode:`managed`,setupFailure:await te(e.commonDir,e.head),warnings:[]},F(),O=await s(e,L),E=setInterval(()=>void I({fetch:!0}),a),E.unref(),await I(),I({fetch:!0})},de=async(e,{onCodexEvent:n=()=>void 0}={})=>{if(!h||p.mode!==`managed`)throw Error(`Managed development is not active.`);if(_)throw Error(`Another managed development action is already running.`);_=!0,p={...p,busy:ye(e),message:void 0},F();try{if(e.type===`reject`)p={...p,draft:void 0,proposal:void 0};else if(e.type===`prepare`){let r=z(e.target),i=await j(t);i.tracked||i.untracked.length>0?p={...p,draft:i,proposal:B(i.fingerprint)}:await U({onCodexEvent:n,source:r.source,target:e.target})}else if(e.type===`message`){let n=await V(e.fingerprint,e.untracked),r=B(n.fingerprint);if(r===void 0){try{if(N??=ie(`codex`,f),!await N)throw Error("Codex CLI is not installed or is unavailable on PATH. Install it with `npm install -g @openai/codex`, then restart the dev server.");r=await re(t,f,n.context)}catch(e){r=``,p={...p,warnings:[...p.warnings,`Codex could not generate a commit message: ${Z(e)}`]}}A={fingerprint:n.fingerprint,message:r}}p={...p,draft:n,proposal:r}}else if(e.type===`commit`){let t=await H(e);p={...p,currentCommit:t,draft:void 0,message:void 0,proposal:void 0,target:void 0},L()}else if(e.type===`retry-install`)await be();else if(e.type===`reset-database`)await xe();else{let r=z(e.target),i=await j(t);if(i.tracked||i.untracked.length>0){if(!e.fingerprint||!e.untracked)throw Error(`Refresh requires the current working-tree confirmation.`);if(await V(e.fingerprint,e.untracked),!e.message||!S.test(Y(e.message)))throw Error(`Enter a commit message with a valid Conventional Commits header.`)}await U({fingerprint:e.fingerprint,message:e.message,onCodexEvent:n,source:r.source,target:e.target,untracked:e.untracked})}}finally{_=!1,p={...p,busy:void 0},F(),v&&(v=!1,L())}return{status:p}},z=e=>{if(!p.target||p.target.commit!==e)throw Error(`The offered update changed. Review the latest target before refreshing.`);return p.target},B=e=>A?.fingerprint===e?A.message:void 0,V=async(e,n)=>{let r=await j(t);if(r.fingerprint!==e)throw A=void 0,Error(`Working-tree changes changed; generate a new commit message.`);if(!ve(r.untracked,n))throw Error(`Include every untracked file or remove it before refreshing.`);return r},H=async({fingerprint:e,message:n,untracked:r})=>{let i=await V(e,r);if(!n||!S.test(Y(n)))throw Error(`Enter a commit message with a valid Conventional Commits header.`);await G(t,[`add`,`--update`]),i.untracked.length>0&&await G(t,[`add`,`--`,...r]),await G(t,[`commit`,`--message`,n],{env:{GIT_EDITOR:`true`}});let a=await K(t,[`rev-parse`,`HEAD`]);return y=a,A=void 0,a},U=async({fingerprint:e,message:n,onCodexEvent:r=()=>void 0,source:i,target:a,untracked:o=[]})=>{z(a);let s=await K(t,[`rev-parse`,`HEAD`]),c,l,u=await j(t);if(u.tracked||u.untracked.length>0){if(!e||u.fingerprint!==e||!ve(u.untracked,o))throw Error(`Working-tree changes changed; review them before refreshing.`);await G(t,[`add`,`--update`]),o.length>0&&await G(t,[`add`,`--`,...o]),await G(t,[`commit`,`--message`,n],{env:{GIT_EDITOR:`true`}}),c=await K(t,[`rev-parse`,`HEAD`]),y=c,l=`refs/coreframe/recovery/${Date.now()}-${c.slice(0,12)}`,await G(t,[`update-ref`,l,c])}let d=c??s,m;try{if(m=await ae({cwd:t,env:f,localMain:d,onCodexEvent:r,source:i,target:a}),await K(t,[`rev-parse`,`HEAD`])!==d)throw Error(`HEAD changed while the accepted update was being prepared.`);if(await K(t,[`rev-parse`,b])!==d)throw Error(`Local main changed while the accepted update was being prepared.`);await oe(t,m,d),y=m.commit,await G(t,[`reset`,`--hard`,m.commit]);let e=J(await K(t,[`diff`,`--name-only`,`-z`,s,m.commit]));A=void 0,l&&await G(t,[`update-ref`,`-d`,l]),p={...p,currentCommit:m.commit,draft:void 0,proposal:void 0,setupFailure:void 0,target:void 0},await W({installDependencies:fe(e),restartRequired:pe(e)})}catch(e){e instanceof M&&(v=!0);let t=l?` Recovery commit: ${l}.`:``;throw p={...p,currentCommit:y,message:`${Z(e)}${t}`},e}},W=async({installDependencies:n,restartRequired:i})=>{let a=y;if(n)try{await Ce([`install`,`--frozen-lockfile`])}catch(e){await Q({command:`pnpm install --frozen-lockfile`,commit:a,error:e,message:`The project was synchronized, but dependency installation failed. Fix the package or lockfile issue, then retry the install.`,restartRequired:i,stage:`dependencies`});return}try{await le({config:e,cwd:t,env:f})}catch(e){await Q({command:`pnpm db migrate`,commit:a,error:e,message:`The project was synchronized, but its database migration failed. The previous database was restored. Reset the database to recreate it, apply migrations, and rerun seed scripts.`,restartRequired:i,stage:`migration`});return}await $(),R(a),i&&r()},be=async()=>{let e=Se(`dependencies`);await $(),await W({installDependencies:!0,restartRequired:e.restartRequired})},xe=async()=>{let e=Se(`migration`);try{await Ce([`db`,`setup`])}catch(t){await Q({command:`pnpm db setup`,commit:e.commit,error:t,message:`The project remains synchronized, but the database reset failed. Review the diagnostics, fix the reported problem, and try the reset again.`,restartRequired:e.restartRequired,stage:`migration`});return}await $(),R(e.commit),e.restartRequired&&r()},Se=e=>{if(!p.setupFailure||p.setupFailure.stage!==e)throw Error(`There is no failed ${e} setup step to recover.`);return p.setupFailure},Ce=async e=>{await d(X(),e,{cwd:t,env:f})},Q=async({command:e,commit:t,error:n,message:r,restartRequired:i,stage:a})=>{let o=ce(n).slice(-1e5),s={command:e,commit:t,message:r,output:o,restartRequired:i,stage:a};p={...p,setupFailure:s,target:void 0},console.error(`Coreframe managed development setup failed (${e}): ${r}\n${o}`);let c=we();c&&await l(c,`${JSON.stringify(s)}\n`,{mode:384}).catch(e=>{console.warn(`Could not persist the managed-development setup failure: ${Z(e)}`)})},$=async()=>{p={...p,setupFailure:void 0};let e=we();e&&await c(e).catch(e=>{e instanceof Error&&`code`in e&&e.code===`ENOENT`||console.warn(`Could not clear the managed-development setup failure: ${Z(e)}`)})},we=()=>w?u.join(w.commonDir,C):void 0;return{action:de,activate:ue,getStatus:()=>p,async close(){if(!m){m=!0,clearInterval(E),clearTimeout(D);for(let e of O)e.close();await ge(T)}}}}async function te(e,t){let n=u.join(e,C);try{let e=JSON.parse(await a(n,`utf8`));if(O(e)&&e.commit===t)return e}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return;console.warn(`Could not read the managed-development setup failure: ${Z(e)}`)}await c(n).catch(()=>void 0)}function O(e){if(!e||typeof e!=`object`)return!1;let t=e;return(t.command===`pnpm db migrate`||t.command===`pnpm db setup`||t.command===`pnpm install --frozen-lockfile`)&&typeof t.commit==`string`&&typeof t.message==`string`&&typeof t.output==`string`&&typeof t.restartRequired==`boolean`&&(t.stage===`dependencies`||t.stage===`migration`)}async function k(e){let t=await E(e);return{branch:A(await K(e,[`rev-parse`,`--abbrev-ref`,`HEAD`])),commonDir:t.commonDir,gitDir:t.gitDir,head:await K(e,[`rev-parse`,`HEAD`]),main:await K(e,[`rev-parse`,b]),primary:t.primary}}function A(e){return e===`HEAD`?void 0:e}async function ne(e,t){let n=[e.gitDir,u.join(e.commonDir,`refs`,`heads`)],r=[];for(let e of n)try{r.push(v(e,{persistent:!1},t))}catch{}return r}async function j(e){let[t,n,r]=await Promise.all([K(e,[`status`,`--porcelain`,`--untracked-files=no`]),K(e,[`diff`,`HEAD`,`--binary`]),K(e,[`ls-files`,`--others`,`--exclude-standard`,`-z`])]),i=J(r).sort(),o=m(`sha256`).update(n),s=[`Tracked changes:`,n];for(let t of i){let n=await a(u.join(e,t));o.update(t).update(n),s.push(`\nUntracked file: ${t}\n`,n.toString(`utf8`))}return{context:s.join(`
+`),fingerprint:o.digest(`hex`),tracked:t.length>0,untracked:i}}async function re(e,t,n){let{stdout:r}=await d(`codex`,[`exec`,`--ephemeral`,`--ignore-user-config`,`--sandbox`,`read-only`,`--cd`,e,`Return only a concise Conventional Commits message for the supplied working-tree changes. Use a body only when it adds material context.`],{cwd:e,env:t,stderr:`ignore`,stdin:{string:n}});return r.trim().replace(/^```(?:text)?\s*|\s*```$/g,``)}async function ie(t,n){let r=n.PATH??n.Path??n.path??``,i=g.platform===`win32`?(n.PATHEXT??`.COM;.EXE;.BAT;.CMD`).split(`;`):[``];for(let n of r.split(u.delimiter))for(let r of i)try{return await e(u.join(n||`.`,`${t}${r}`),_.X_OK),!0}catch{}return!1}var M=class extends Error{constructor(){super(`Local dev advanced while this update was being prepared. Nothing was changed. Review the latest update and try again.`)}};async function ae({cwd:e,env:t,localMain:r,onCodexEvent:i,source:a,target:o}){if(a===`dev`&&await _e(e,r,o))return{commit:o,devTarget:o};let c=u.resolve(e,await K(e,[`rev-parse`,`--git-common-dir`])),l=u.join(c,`coreframe-managed-dev`);await n(l,{recursive:!0});let d=h(8).toString(`hex`),f=u.join(l,`integration-${d}`);try{let n=a===`dev`?o:r,s=a===`dev`?r:o;if(await G(e,[`worktree`,`add`,`--detach`,f,n]),r!==o){let e=await q(f,[`merge-base`,r,o]);await N(f,t,e?[`rebase`,`--onto`,s,e]:[`rebase`,`--root`,`--onto`,s],`rebase`,i)}return{commit:await K(f,[`rev-parse`,`HEAD`]),devTarget:a===`dev`?o:void 0}}finally{await G(e,[`worktree`,`remove`,`--force`,f]).catch(()=>void 0),await s(f,{force:!0,recursive:!0})}}async function oe(e,t,n){let r=[`start`,`update ${b} ${t.commit} ${n}`];t.devTarget&&r.push(t.devTarget===t.commit?`verify ${x} ${t.devTarget}`:`update ${x} ${t.commit} ${t.devTarget}`),r.push(`prepare`,`commit`);try{await d(`git`,[`update-ref`,`--stdin`],{cwd:e,stdin:{string:`${r.join(`
+`)}\n`}})}catch(r){if(t.devTarget)try{let[r,i]=await Promise.all([K(e,[`rev-parse`,b]),q(e,[`rev-parse`,x])]);if(r===n&&i!==t.devTarget)throw new M}catch(e){if(e instanceof M)throw e}throw r}}async function N(e,t,n,r,i){try{await G(e,n,{env:{GIT_EDITOR:`true`}});return}catch(n){let a=await I(e);if(a.length===0)throw n;try{for(;a.length>0;){await P(e,t,r,a,i),await G(e,[`diff`,`--check`]),await G(e,[`add`,`--all`]);let n=await I(e);if(n.length>0)throw Error(`Codex left unresolved paths: ${n.join(`, `)}`);try{await G(e,[r,`--continue`],{env:{GIT_EDITOR:`true`}})}catch(t){if(a=await I(e),a.length===0)throw t;continue}a=await I(e)}return}catch(t){throw await G(e,[r,`--abort`]).catch(()=>void 0),Error(`Codex could not resolve ${r} conflicts: ${Z(t)}`)}}}async function P(e,t,n,r,i){i({phase:`start`});let a=d(`codex`,[`exec`,`--ephemeral`,`--ignore-user-config`,`--sandbox`,`workspace-write`,`--cd`,e,`Resolve the current Git ${n} conflicts cleanly. Edit only files needed for the resolution, preserve intended behavior from both sides, remove all conflict markers, and do not stage files or run Git continuation commands. Conflicted paths: ${r.join(`, `)}`],{cwd:e,env:t,stdin:`ignore`}),o=[];try{await Promise.all([F(a.stdout,e=>o.push(e)),F(a.stderr,e=>i({phase:`stderr`,text:`${e}\n`}))])}catch(e){throw i({phase:`error`}),e}i({message:o.join(`
+`).trim(),phase:`complete`})}async function F(e,t){for await(let n of e)t(n)}async function I(e){return J(await K(e,[`diff`,`--name-only`,`--diff-filter=U`,`-z`]))}async function se(e,t,n){await d(X(),[n],{cwd:e,env:t})}function ce(e){if(e instanceof f){let t=e.output.trim();if(t)return t}return Z(e)}async function le({config:e,cwd:t,env:n}){if(!e.database)return;let r=await L({config:e,cwd:t,env:n});try{await d(X(),[`db`,`migrate`],{cwd:t,env:n})}catch(e){throw await r.restore(),e}await r.discard().catch(e=>{console.warn(`Could not remove the managed-development database snapshot: ${Z(e)}`)}),await s(r.directory,{force:!0,recursive:!0})}async function L({config:e,cwd:i,env:a}){let o=u.join(i,`.coreframe`,`managed-dev-backups`);await n(o,{recursive:!0});let c=await r(u.join(o,`refresh-`));if(e.database?.dialect===`sqlite`){let e=[`turso.db`,`turso.db-wal`,`turso.db-shm`],n=new Set;for(let t of e)await R(u.join(i,`.coreframe`,t),u.join(c,t))&&n.add(t);return{directory:c,async discard(){},async restore(){for(let r of e){let e=u.join(i,`.coreframe`,r);n.has(r)?await t(u.join(c,r),e):await s(e,{force:!0})}}}}if(!a.DATABASE_URL)throw Error(`DATABASE_URL is required to snapshot local PostgreSQL.`);let l=await ue(i);if(l)return de({directory:c,connectionString:a.DATABASE_URL,postgres:l});let f=u.join(c,`database.dump`),p=U(a,a.DATABASE_URL);return await d(`pg_dump`,[`--format=custom`,`--file`,f],{cwd:i,env:p,stdin:`ignore`}),{directory:c,async discard(){},async restore(){await d(`pg_restore`,[`--clean`,`--if-exists`,`--no-owner`,`--dbname`,p.PGDATABASE,f],{cwd:i,env:p,stdin:`ignore`})}}}async function R(e,n){try{return await t(e,n),!0}catch(e){if(!(e instanceof Error&&`code`in e&&e.code===`ENOENT`))throw e;return!1}}async function ue(e){let t=JSON.parse(await a(u.join(e,`package.json`),`utf8`));if(!(!t.dependencies?.pg&&!t.devDependencies?.pg&&!t.optionalDependencies?.pg))try{return await import(y(`pg`,p(u.join(e,`package.json`)).href))}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ERR_MODULE_NOT_FOUND`)return;throw e}}async function de({directory:e,connectionString:t,postgres:n}){let r=new URL(t),i=decodeURIComponent(r.pathname.slice(1));if(!i)throw Error(`DATABASE_URL must name a PostgreSQL database to snapshot.`);let a=`coreframe_backup_${h(6).toString(`hex`)}`,o=`${a}_failed`,s=new URL(r);s.pathname=i===`postgres`?`/template1`:`/postgres`;let c=new n.Client({connectionString:s.href});await c.connect();try{await B(c,i,!1),await V(c,i),await c.query(`CREATE DATABASE ${H(a)} WITH TEMPLATE ${H(i)}`),await B(c,a,!0)}finally{await B(c,i,!0).catch(()=>void 0),await c.end()}return{directory:e,async discard(){await z(n,s.href,async e=>{await V(e,a),await e.query(`DROP DATABASE ${H(a)}`)})},async restore(){await z(n,s.href,async e=>{await B(e,i,!1),await V(e,i),await e.query(`ALTER DATABASE ${H(i)} RENAME TO ${H(o)}`);try{await e.query(`ALTER DATABASE ${H(a)} RENAME TO ${H(i)}`)}catch(t){throw await e.query(`ALTER DATABASE ${H(o)} RENAME TO ${H(i)}`).catch(()=>void 0),await B(e,i,!0).catch(()=>void 0),t}await V(e,o),await e.query(`DROP DATABASE ${H(o)}`)})}}}async function z(e,t,n){let r=new e.Client({connectionString:t});await r.connect();try{return await n(r)}finally{await r.end()}}async function B(e,t,n){await e.query(`ALTER DATABASE ${H(t)} ALLOW_CONNECTIONS ${n?`true`:`false`}`)}async function V(e,t){await e.query(`SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1 AND pid <> pg_backend_pid()`,[t])}function H(e){return`"${e.replaceAll(`"`,`""`)}"`}function U(e,t){let n=new URL(t);return{...e,PGDATABASE:decodeURIComponent(n.pathname.slice(1)),PGHOST:n.hostname,PGPASSWORD:decodeURIComponent(n.password),PGPORT:n.port||`5432`,PGUSER:decodeURIComponent(n.username)}}function fe(e){return e.some(e=>u.basename(e)===`package.json`||u.basename(e).endsWith(`lock.yaml`)||u.basename(e)===`pnpm-workspace.yaml`)}function pe(e){return e.some(e=>fe([e])||/(^|\/)(vite|coreframe|tsconfig|drizzle)\.[^/]+$/.test(e)||/(^|\/)(drizzle|scripts|src\/api|tauri)(\/|$)/.test(e))}async function me(e,t,n){return{commit:t,shortCommit:t.slice(0,12),source:n,subject:await K(e,[`show`,`-s`,`--format=%s`,t])}}async function he(e){try{let t=await i(e,`wx`);await t.writeFile(`${g.pid}\n`),await t.close()}catch(t){if(!(t instanceof Error&&`code`in t&&t.code===`EEXIST`))throw t;let n=(await a(e,`utf8`).catch(()=>`unknown`)).trim(),r=Number(n);if(Number.isInteger(r)&&!W(r)){await c(e).catch(()=>void 0),await he(e);return}throw Error(`Managed development is already owned by PID ${n}.`)}}function W(e){try{return g.kill(e,0),!0}catch(e){return!(e instanceof Error&&`code`in e&&e.code===`ESRCH`)}}async function ge(e){e&&(await a(e,`utf8`).catch(()=>void 0))?.trim()===String(g.pid)&&await c(e).catch(()=>void 0)}async function G(e,t,{env:n}={}){return d(`git`,t,{cwd:e,env:n,stdin:`ignore`})}async function K(e,t){return(await G(e,t)).stdout.trim()}async function q(e,t){try{return await K(e,t)||void 0}catch(e){if(e instanceof f&&e.exitCode&&e.exitCode>0)return;throw e}}async function _e(e,t,n){try{return await G(e,[`merge-base`,`--is-ancestor`,t,n]),!0}catch(e){if(e instanceof f&&e.exitCode===1)return!1;throw e}}function ve(e,t){return e.length===t.length&&[...e].sort().every((e,n)=>e===[...t].sort()[n])}function J(e){return e.split(`\0`).filter(Boolean)}function Y(e){return e.split(/\r?\n/,1)[0]??``}function ye(e){return e.type===`message`?`Generating commit message`:e.type===`commit`?`Committing local changes`:e.type===`apply`?`Integrating accepted update`:e.type===`prepare`?`Reviewing working tree`:e.type===`retry-install`?`Retrying dependency installation`:e.type===`reset-database`?`Resetting local database`:`Aborting refresh`}function X(){return g.platform===`win32`?`pnpm.cmd`:`pnpm`}function Z(e){return e instanceof Error?e.message:String(e)}export{w as isManagedDevCheckout,T as isPrimaryCheckout,D as startManagedDevSession};

package/dist/runner.d.ts

@@ -2,16 +2,19 @@ import * as cmdts from "cmd-ts";
 
 //#region runner.d.ts
 type CliErrorReporterOptions = {
+  formatMessage?: (error: unknown) => string | undefined;
   temporaryDirectory?: string;
   write?: (message: string) => void;
 };
 type Command = Parameters<typeof cmdts.binary>[0];
 type RunFunction = () => unknown | PromiseLike<unknown>;
+type RunOptions = Pick<CliErrorReporterOptions, "formatMessage">;
 declare function reportCliError(error: unknown, {
+  formatMessage,
   temporaryDirectory,
   write
 }?: CliErrorReporterOptions): string | undefined;
-declare function run(command: Command): void;
-declare function run(fn: RunFunction): void;
+declare function run(command: Command, options?: RunOptions): void;
+declare function run(fn: RunFunction, options?: RunOptions): void;
 //#endregion
 export { reportCliError, run };

package/dist/runner.js

@@ -1 +1 @@
-import{join as e}from"node:path";import*as t from"cmd-ts";import{mkdtempSync as n,writeFileSync as r}from"node:fs";import{tmpdir as i}from"node:os";import{inspect as a}from"node:util";function o(t,{temporaryDirectory:a=i(),write:o=e=>console.error(e)}={}){let s=c(t);try{let i=e(n(e(a,`coreframe-error-`)),`error.log`);return r(i,`${l(t)}\n`,{mode:384}),o(`Error: ${s}\nFull diagnostic: ${i}`),i}catch{o(`Error: ${s}\nThe full diagnostic could not be written to the temporary directory.`);return}}function s(e){let n=typeof e==`function`?e:()=>t.run(t.binary(e),process.argv),r=!1,i=e=>{r||(r=!0,o(e),process.exit(1))};process.once(`uncaughtException`,i),process.once(`unhandledRejection`,i),Promise.resolve().then(n).catch(i)}function c(e){try{return(e instanceof Error?e.message:String(e)).split(/\r?\n/,1)[0]||`Unknown error`}catch{return`Unknown error`}}function l(e){try{return a(e,{customInspect:!1,depth:10})}catch{return`The thrown value could not be inspected.`}}export{o as reportCliError,s as run};
+import{join as e}from"node:path";import{tmpdir as t}from"node:os";import*as n from"cmd-ts";import{mkdtempSync as r,writeFileSync as i}from"node:fs";import{inspect as a}from"node:util";function o(n,{formatMessage:a,temporaryDirectory:o=t(),write:s=e=>console.error(e)}={}){let u=c(n,a);try{let t=e(r(e(o,`coreframe-error-`)),`error.log`);return i(t,`${l(n)}\n`,{mode:384}),s(`Error: ${u}\nFull diagnostic: ${t}`),t}catch{s(`Error: ${u}\nThe full diagnostic could not be written to the temporary directory.`);return}}function s(e,t={}){let r=typeof e==`function`?e:()=>n.run(n.binary(e),process.argv),i=!1,a=e=>{i||(i=!0,o(e,t),process.exit(1))};process.once(`uncaughtException`,a),process.once(`unhandledRejection`,a),Promise.resolve().then(r).catch(a)}function c(e,t){try{return t?.(e)||(e instanceof Error?e.message:String(e)).split(/\r?\n/,1)[0]||`Unknown error`}catch{return`Unknown error`}}function l(e){try{return a(e,{customInspect:!1,depth:10})}catch{return`The thrown value could not be inspected.`}}export{o as reportCliError,s as run};

package/dist/tauri-dev-output.js

@@ -1,2 +1,2 @@
-import{mkdtemp as e}from"node:fs/promises";import t from"node:path";import{createWriteStream as n}from"node:fs";import{tmpdir as r}from"node:os";import{stripVTControlCharacters as i}from"node:util";import{once as a}from"node:events";import{finished as o}from"node:stream/promises";async function s({output:i,temporaryDirectory:o=r()}){let s=await e(t.join(o,`coreframe-ios-dev-`)),l=t.join(s,`tauri.log`),u=n(l,{flags:`wx`,mode:384});return await a(u,`open`),new c(l,u,i)}var c=class{logFile;closed=!1;failureLines=[];log;output;runtime=!1;showInstalledBundleId=!1;constructor(e,t,n){this.logFile=e,this.log=t,this.output=n}async consume(e){try{for await(let t of e)await d(this.log,`${t}\n`),this.rememberFailureLine(t),this.shouldShow(t)&&await d(this.output,`${t}\n`)}catch{}}async reportFailure(){await d(this.output,`iOS development failed. Recent diagnostic output:
+import{mkdtemp as e}from"node:fs/promises";import t from"node:path";import{tmpdir as n}from"node:os";import{createWriteStream as r}from"node:fs";import{stripVTControlCharacters as i}from"node:util";import{once as a}from"node:events";import{finished as o}from"node:stream/promises";async function s({output:i,temporaryDirectory:o=n()}){let s=await e(t.join(o,`coreframe-ios-dev-`)),l=t.join(s,`tauri.log`),u=r(l,{flags:`wx`,mode:384});return await a(u,`open`),new c(l,u,i)}var c=class{logFile;closed=!1;failureLines=[];log;output;runtime=!1;showInstalledBundleId=!1;constructor(e,t,n){this.logFile=e,this.log=t,this.output=n}async consume(e){try{for await(let t of e)await d(this.log,`${t}\n`),this.rememberFailureLine(t),this.shouldShow(t)&&await d(this.output,`${t}\n`)}catch{}}async reportFailure(){await d(this.output,`iOS development failed. Recent diagnostic output:
 `);for(let e of this.failureLines)await d(this.output,`${e}\n`);await d(this.output,`Full iOS log: ${this.logFile}\n`)}async close(){this.closed||(this.closed=!0,this.log.end(),await o(this.log))}shouldShow(e){let t=i(e).trim();if(t===`Building app...`)return this.runtime=!1,!0;if(l(t))return!1;if(t.startsWith(`Launched application with `))return this.runtime=!0,!0;if(this.runtime)return!0;if(t===`App installed:`)return this.showInstalledBundleId=!0,!0;if(this.showInstalledBundleId){if(t.length===0)return!1;if(this.showInstalledBundleId=!1,t.startsWith(`• bundleID:`))return!0}return/^(Archiving app|Exporting app|Extracting IPA|Deploying app to device|Pairing with device)\.\.\.$/u.test(t)||/^\*\* BUILD (?:SUCCEEDED|FAILED) \*\*$/u.test(t)||/^(?:Compiling|Checking|Finished)\b/u.test(t)||/^(?:Warn|Error)\b/u.test(t)||/(?:^|:\d+:\d+: )(?:warning|error)(?:\[[^\]]+\])?:/iu.test(t)||/^(?:fatal:|thread .+ panicked|Failed to |No device found\.|The following build commands failed:|command \[.+\] exited)/iu.test(t)||/^Info Watching\b/u.test(t)||/^note: run with RUST_BACKTRACE=/u.test(t)}rememberFailureLine(e){u(i(e).trim())||(this.failureLines.push(e),this.failureLines.length>40&&this.failureLines.shift())}};function l(e){return e.startsWith(`--- xcodebuild: WARNING: Using the first of multiple matching destinations:`)||/^Failed to load provisioning param(?:e)?ter list due to error:/u.test(e)||e==="`devicectl manage create` may support a reduced set of arguments."||/(?:^|\/)idevicesyslog$/u.test(e)}function u(e){return e.length===0||e.startsWith(`export `)||e.startsWith(`inflating:`)||e.startsWith(`Archive:`)||e.startsWith(`cd `)||e.startsWith(`/bin/sh -c `)||e.startsWith(`Command line invocation:`)||e.startsWith(`Build settings from command line:`)}async function d(e,t){e.write(t)||await a(e,`drain`)}export{s as createTauriDevOutput};

package/dist/upgrade/check-skill-current.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{coreframeGitRef as e,coreframeTemplateFile as t}from"./template-ref.js";import{join as n}from"node:path";import{existsSync as r,mkdtempSync as i,readFileSync as a,rmSync as o,writeFileSync as s}from"node:fs";import{tmpdir as c}from"node:os";import{spawnSync as l}from"node:child_process";const u=`.agents/skills/coreframe-upgrade/SKILL.md`;function d(e,t={}){return l(`git`,e,t)}function f(e){return e.stderr.toString(`utf8`).trim()||e.stdout.toString(`utf8`).trim()}function p(e,n){let r=t(e,n),i=d([`show`,r],{encoding:`utf8`});if(i.status!==0){let e=f(i);throw Error(`Could not read ${r}.${e?` ${e}`:``}`)}return i.stdout.toString()}function m(){let e=d([`rev-parse`,`--show-toplevel`],{encoding:`utf8`});if(e.status!==0){let t=f(e);throw Error(`Could not find git repository root.${t?` ${t}`:``}`)}return e.stdout.toString().trim()}function h(e,t){let r=i(n(c(),`coreframe-upgrade-skill-`)),a=n(r,`SKILL.md`);try{s(a,t);let n=f(d([`--no-pager`,`diff`,`--no-index`,`--color=never`,`--`,e,a]));n&&console.log(n)}finally{o(r,{force:!0,recursive:!0})}}function g({apply:t,target:i}){let o=n(m(),u),c=e(i);if(!r(o))throw Error(`Local ${u} does not exist.`);let l=a(o,`utf8`),d=p(i,u);return l===d?(console.log(`Coreframe upgrade skill matches ${c}:template/${u}.`),0):t?(s(o,d),console.error(`Updated ${u} from ${c}:template. Reread it before continuing the upgrade.`),20):(console.error(`Coreframe upgrade skill differs from ${c}:template/${u}.`),console.error(`Run again with --apply to update it, then reread ${u} before continuing.`),h(o,d),20)}export{g as checkUpgradeSkillCurrent};
+import{coreframeGitRef as e,coreframeTemplateFile as t}from"./template-ref.js";import{join as n}from"node:path";import{tmpdir as r}from"node:os";import{existsSync as i,mkdtempSync as a,readFileSync as o,rmSync as s,writeFileSync as c}from"node:fs";import{spawnSync as l}from"node:child_process";const u=`.agents/skills/coreframe-upgrade/SKILL.md`;function d(e,t={}){return l(`git`,e,t)}function f(e){return e.stderr.toString(`utf8`).trim()||e.stdout.toString(`utf8`).trim()}function p(e,n){let r=t(e,n),i=d([`show`,r],{encoding:`utf8`});if(i.status!==0){let e=f(i);throw Error(`Could not read ${r}.${e?` ${e}`:``}`)}return i.stdout.toString()}function m(){let e=d([`rev-parse`,`--show-toplevel`],{encoding:`utf8`});if(e.status!==0){let t=f(e);throw Error(`Could not find git repository root.${t?` ${t}`:``}`)}return e.stdout.toString().trim()}function h(e,t){let i=a(n(r(),`coreframe-upgrade-skill-`)),o=n(i,`SKILL.md`);try{c(o,t);let n=f(d([`--no-pager`,`diff`,`--no-index`,`--color=never`,`--`,e,o]));n&&console.log(n)}finally{s(i,{force:!0,recursive:!0})}}function g({apply:t,target:r}){let a=n(m(),u),s=e(r);if(!i(a))throw Error(`Local ${u} does not exist.`);let l=o(a,`utf8`),d=p(r,u);return l===d?(console.log(`Coreframe upgrade skill matches ${s}:template/${u}.`),0):t?(c(a,d),console.error(`Updated ${u} from ${s}:template. Reread it before continuing the upgrade.`),20):(console.error(`Coreframe upgrade skill differs from ${s}:template/${u}.`),console.error(`Run again with --apply to update it, then reread ${u} before continuing.`),h(a,d),20)}export{g as checkUpgradeSkillCurrent};

package/dist/worker-environment.js

@@ -1 +1 @@
-import{readProjectConfig as e}from"./config.js";import{deployEnvironments as t}from"./deploy/config.js";import{randomUUID as n}from"node:crypto";import{chmod as r,mkdir as i,readFile as a,rename as o,rm as s,stat as c,writeFile as l}from"node:fs/promises";import{resolve as u}from"node:path";import d from"nano-spawn";import{parseEnv as f}from"node:util";const p=[`secret`,`variable`,`generated`],m=/^[A-Z][A-Z0-9_]*$/,h=`.coreframe/deploy-secrets`;async function g({cwd:n=process.cwd(),environment:r,listSecrets:i=A}={}){let a=x((await e({cwd:n})).worker?.environment),o=await C(n),s=r?[r]:t,c=new Map,l=new Map,u=Object.fromEntries(t.map(e=>[e,{state:`not_checked`}]));await Promise.all(s.map(async e=>{if(l.set(e,new Set(Object.keys((await y({cwd:n,environment:e})).values))),a.some(e=>e.kind===`secret`))try{c.set(e,new Set(await i(e,n))),u[e]={state:`available`}}catch{u[e]={state:`unavailable`,message:`Could not read ${e} Worker secrets. Check Wrangler authentication and whether the Worker exists.`}}}));let d=new Set(a.filter(e=>e.kind===`secret`).map(e=>e.name)),f=Object.fromEntries(t.map(e=>[e,[...c.get(e)??[]].filter(e=>!d.has(e)).sort()]));return{entries:a.map(e=>({...e,local:o.has(e.name)?`override`:`default`,deployed:Object.fromEntries(t.map(t=>[t,w(e,t,u[t],c.get(t),l.get(t))]))})),providers:u,undeclaredSecrets:f}}async function _({cwd:e=process.cwd(),environment:t,name:n,value:r,ensureIgnored:i=D}){if(await S(e,n),!r.trim())throw Error(`Worker secret values cannot be empty.`);await i(t,e),await E(e,t,{...(await y({cwd:e,environment:t})).values,[n]:r})}async function v({cwd:e=process.cwd(),environment:t,name:n}){await S(e,n);let r=await y({cwd:e,environment:t});if(!(n in r.values))return!1;let i={...r.values};return delete i[n],await E(e,t,i),!0}async function y({cwd:t=process.cwd(),environment:n}){let r=await T(t,n),i=x((await e({cwd:t})).worker?.environment),a=new Set(i.filter(e=>e.kind===`secret`).map(e=>e.name)),o=Object.keys(r).filter(e=>!a.has(e));if(o.length>0)throw Error(`Pending ${n} Worker secrets are not declared as secrets in coreframe.config.ts: ${o.join(`, `)}.`);return{environment:n,values:r}}async function b(e,t=process.cwd()){let n=await T(t,e.environment),r=Object.fromEntries(Object.entries(n).filter(([t,n])=>e.values[t]!==n));await E(t,e.environment,r)}function x(e){return Object.entries(e??{}).map(([e,t])=>{if(!m.test(e))throw Error(`Invalid Worker environment name ${JSON.stringify(e)} in coreframe.config.ts. Use uppercase letters, numbers, and underscores.`);return{...t,name:e,requiredIn:[...new Set(t.requiredIn??[])]}}).sort((e,t)=>e.name.localeCompare(t.name))}async function S(t,n){let r=x((await e({cwd:t})).worker?.environment).find(e=>e.name===n);if(!r)throw Error(`${n} is not declared in coreframe.config.ts.`);if(r.kind!==`secret`)throw Error(`${n} is declared as ${r.kind}, not a Worker secret.`)}async function C(e){try{let t=f(await a(u(e,`.env`),`utf8`));return new Set(Object.entries(t).filter(([,e])=>!!e?.trim()).map(([e])=>e))}catch(e){if(j(e)&&e.code===`ENOENT`)return new Set;throw e}}function w(e,t,n,r,i){return e.kind===`generated`?`generated`:e.kind===`variable`?`declared`:i?.has(e.name)?n.state!==`available`||!r?`pending_update`:r.has(e.name)?`pending_replacement`:`pending_addition`:n.state!==`available`||!r?`unknown`:r.has(e.name)?`configured`:e.requiredIn.includes(t)?`missing`:`not_configured`}async function T(e,t){let n=O(e,t);try{let e=await c(n);if(process.platform!==`win32`&&e.mode&63)throw Error(`Pending Worker secret file ${n} must use mode 0600.`);let t=JSON.parse(await a(n,`utf8`));if(!k(t))throw Error(`Pending Worker secret file ${n} must contain a JSON object of strings.`);return t}catch(e){if(j(e)&&e.code===`ENOENT`)return{};throw e}}async function E(e,t,a){let c=O(e,t);if(Object.keys(a).length===0){await s(c,{force:!0});return}let d=u(e,h);await i(d,{mode:448,recursive:!0}),process.platform!==`win32`&&await r(d,448);let f=`${c}.${process.pid}.${n()}.tmp`;try{await l(f,`${JSON.stringify(a,null,2)}\n`,{flag:`wx`,mode:384}),await o(f,c)}finally{await s(f,{force:!0})}process.platform!==`win32`&&await r(c,384)}async function D(e,t){let n=`${h}/${e}.json`,r=`${h}/.coreframe-ignore-check`;try{await d(`git`,[`check-ignore`,`--quiet`,r],{cwd:t,stdin:`ignore`,stdout:`ignore`,stderr:`ignore`})}catch{throw Error(`Refusing to store plaintext Worker secrets because ${n} is not git-ignored. Add .coreframe/ to .gitignore.`)}}function O(e,t){return u(e,h,`${t}.json`)}function k(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.entries(e).every(([e,t])=>m.test(e)&&typeof t==`string`&&t.length>0)}async function A(e,t){let{stdout:n}=await d(`pnpm`,[`exec`,`wrangler`,`secret`,`list`,`--env`,e,`--format`,`json`],{cwd:t,env:{CI:`true`},stdin:`ignore`,timeout:5e3}),r=JSON.parse(n);if(!Array.isArray(r))throw Error(`Wrangler returned an invalid secret list.`);return r.flatMap(e=>e&&typeof e==`object`&&`name`in e&&typeof e.name==`string`?[e.name]:[])}function j(e){return e instanceof Error&&`code`in e}export{b as clearAppliedPendingWorkerSecrets,v as discardPendingWorkerSecret,g as inspectWorkerEnvironment,_ as queueWorkerSecret,y as readPendingWorkerSecretSnapshot,p as workerEnvironmentKinds};
+import{readProjectConfig as e}from"./config.js";import{accessTokenSigningSecretName as t}from"./deploy/access-token-secret.js";import{deployEnvironments as n}from"./deploy/config.js";import{chmod as r,mkdir as i,readFile as a,rename as o,rm as s,stat as c,writeFile as l}from"node:fs/promises";import{resolve as u}from"node:path";import d from"nano-spawn";import{randomUUID as f}from"node:crypto";import{parseEnv as p}from"node:util";const m=[`secret`,`variable`,`generated`],h=/^[A-Z][A-Z0-9_]*$/,g=`.coreframe/deploy-secrets`;async function _({cwd:r=process.cwd(),environment:i,listSecrets:a=j}={}){let o=S((await e({cwd:r})).worker?.environment),s=await w(r),c=i?[i]:n,l=new Map,u=new Map,d=Object.fromEntries(n.map(e=>[e,{state:`not_checked`}]));await Promise.all(c.map(async e=>{if(u.set(e,new Set(Object.keys((await b({cwd:r,environment:e})).values))),o.some(e=>e.kind===`secret`))try{l.set(e,new Set(await a(e,r))),d[e]={state:`available`}}catch{d[e]={state:`unavailable`,message:`Could not read ${e} Worker secrets. Check Wrangler authentication and whether the Worker exists.`}}}));let f=new Set([t,...o.filter(e=>e.kind===`secret`).map(e=>e.name)]),p=Object.fromEntries(n.map(e=>[e,[...l.get(e)??[]].filter(e=>!f.has(e)).sort()]));return{entries:o.map(e=>({...e,local:s.has(e.name)?`override`:`default`,deployed:Object.fromEntries(n.map(t=>[t,T(e,t,d[t],l.get(t),u.get(t))]))})),providers:d,undeclaredSecrets:p}}async function v({cwd:e=process.cwd(),environment:t,name:n,value:r,ensureIgnored:i=O}){if(await C(e,n),!r.trim())throw Error(`Worker secret values cannot be empty.`);await i(t,e),await D(e,t,{...(await b({cwd:e,environment:t})).values,[n]:r})}async function y({cwd:e=process.cwd(),environment:t,name:n}){await C(e,n);let r=await b({cwd:e,environment:t});if(!(n in r.values))return!1;let i={...r.values};return delete i[n],await D(e,t,i),!0}async function b({cwd:t=process.cwd(),environment:n}){let r=await E(t,n),i=S((await e({cwd:t})).worker?.environment),a=new Set(i.filter(e=>e.kind===`secret`).map(e=>e.name)),o=Object.keys(r).filter(e=>!a.has(e));if(o.length>0)throw Error(`Pending ${n} Worker secrets are not declared as secrets in coreframe.config.ts: ${o.join(`, `)}.`);return{environment:n,values:r}}async function x(e,t=process.cwd()){let n=await E(t,e.environment),r=Object.fromEntries(Object.entries(n).filter(([t,n])=>e.values[t]!==n));await D(t,e.environment,r)}function S(e){return Object.entries(e??{}).map(([e,t])=>{if(!h.test(e))throw Error(`Invalid Worker environment name ${JSON.stringify(e)} in coreframe.config.ts. Use uppercase letters, numbers, and underscores.`);return{...t,name:e,requiredIn:[...new Set(t.requiredIn??[])]}}).sort((e,t)=>e.name.localeCompare(t.name))}async function C(t,n){let r=S((await e({cwd:t})).worker?.environment).find(e=>e.name===n);if(!r)throw Error(`${n} is not declared in coreframe.config.ts.`);if(r.kind!==`secret`)throw Error(`${n} is declared as ${r.kind}, not a Worker secret.`)}async function w(e){try{let t=p(await a(u(e,`.env`),`utf8`));return new Set(Object.entries(t).filter(([,e])=>!!e?.trim()).map(([e])=>e))}catch(e){if(M(e)&&e.code===`ENOENT`)return new Set;throw e}}function T(e,t,n,r,i){return e.kind===`generated`?`generated`:e.kind===`variable`?`declared`:i?.has(e.name)?n.state!==`available`||!r?`pending_update`:r.has(e.name)?`pending_replacement`:`pending_addition`:n.state!==`available`||!r?`unknown`:r.has(e.name)?`configured`:e.requiredIn.includes(t)?`missing`:`not_configured`}async function E(e,t){let n=k(e,t);try{let e=await c(n);if(process.platform!==`win32`&&e.mode&63)throw Error(`Pending Worker secret file ${n} must use mode 0600.`);let t=JSON.parse(await a(n,`utf8`));if(!A(t))throw Error(`Pending Worker secret file ${n} must contain a JSON object of strings.`);return t}catch(e){if(M(e)&&e.code===`ENOENT`)return{};throw e}}async function D(e,t,n){let a=k(e,t);if(Object.keys(n).length===0){await s(a,{force:!0});return}let c=u(e,g);await i(c,{mode:448,recursive:!0}),process.platform!==`win32`&&await r(c,448);let d=`${a}.${process.pid}.${f()}.tmp`;try{await l(d,`${JSON.stringify(n,null,2)}\n`,{flag:`wx`,mode:384}),await o(d,a)}finally{await s(d,{force:!0})}process.platform!==`win32`&&await r(a,384)}async function O(e,t){let n=`${g}/${e}.json`,r=`${g}/.coreframe-ignore-check`;try{await d(`git`,[`check-ignore`,`--quiet`,r],{cwd:t,stdin:`ignore`,stdout:`ignore`,stderr:`ignore`})}catch{throw Error(`Refusing to store plaintext Worker secrets because ${n} is not git-ignored. Add .coreframe/ to .gitignore.`)}}function k(e,t){return u(e,g,`${t}.json`)}function A(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.entries(e).every(([e,t])=>h.test(e)&&typeof t==`string`&&t.length>0)}async function j(e,t){let{stdout:n}=await d(`pnpm`,[`exec`,`wrangler`,`secret`,`list`,`--env`,e,`--format`,`json`],{cwd:t,env:{CI:`true`},stdin:`ignore`,timeout:5e3}),r=JSON.parse(n);if(!Array.isArray(r))throw Error(`Wrangler returned an invalid secret list.`);return r.flatMap(e=>e&&typeof e==`object`&&`name`in e&&typeof e.name==`string`?[e.name]:[])}function M(e){return e instanceof Error&&`code`in e}export{x as clearAppliedPendingWorkerSecrets,y as discardPendingWorkerSecret,_ as inspectWorkerEnvironment,v as queueWorkerSecret,b as readPendingWorkerSecretSnapshot,m as workerEnvironmentKinds};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreframe/scripts",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/airlock-labs/coreframe.git",
@@ -21,8 +21,10 @@
     }
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1090.0",
     "@clack/prompts": "^1.6.0",
     "cmd-ts": "0.15.0",
+    "cross-keychain": "1.1.0",
     "drizzle-orm": "1.0.0-rc.4",
     "import-meta-resolve": "^4.2.0",
     "local-postgres": "0.3.0",