@kalphq/cli 0.0.0-dev-20260512203604 → 0.0.0-dev-20260513001041

package/dist/chunk-YMEEYCMI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/secret.ts","../src/utils/project-state.ts","../src/utils/runtime.ts","../src/utils/ai.ts","../src/utils/project-config.ts","../src/utils/runtime-identity.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { readFile, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport const SECRET_KEY = \"KALP_SECRET_KEY\";\nexport const STUDIO_PASSWORD = \"KALP_STUDIO_PASSWORD\";\nexport const STUDIO_ADMIN_USER = \"KALP_STUDIO_ADMIN_USER\";\nexport const SERVICE_KEY = \"KALP_SERVICE_KEY\";\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nfunction parseEnv(content: string): Record<string, string> {\n  const result: Record<string, string> = {};\n  for (const line of content.split(/\\r?\\n/g)) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex <= 0) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    const value = trimmed.slice(eqIndex + 1).trim();\n    result[key] = value;\n  }\n  return result;\n}\n\nfunction applyEnvUpdates(content: string, updates: Record<string, string>): string {\n  let next = content;\n  for (const [key, value] of Object.entries(updates)) {\n    const line = `${key}=${value}`;\n    const pattern = new RegExp(`^${escapeRegExp(key)}=.*$`, \"m\");\n    if (pattern.test(next)) {\n      next = next.replace(pattern, line);\n      continue;\n    }\n    const trimmed = next.trimEnd();\n    next = trimmed.length > 0 ? `${trimmed}\\n${line}\\n` : `${line}\\n`;\n  }\n\n  return next.trimEnd() + \"\\n\";\n}\n\nasync function readEnvFile(cwd: string): Promise<string> {\n  const envPath = join(cwd, \".env\");\n  try {\n    return await readFile(envPath, \"utf-8\");\n  } catch {\n    return \"\";\n  }\n}\n\nasync function readDevVarsFile(cwd: string): Promise<string> {\n  const devVarsPath = join(cwd, \".dev.vars\");\n  try {\n    return await readFile(devVarsPath, \"utf-8\");\n  } catch {\n    return \"\";\n  }\n}\n\nfunction generateStudioPassword(): string {\n  return randomBytes(24).toString(\"base64url\");\n}\n\nfunction generateServiceKey(): string {\n  return `kalp_sk_live_${randomBytes(32).toString(\"base64url\")}`;\n}\n\nexport interface StudioSecrets {\n  key: string;\n  studioPassword: string;\n  studioAdminUser: string;\n  serviceKey: string;\n  isNew: boolean;\n}\n\nexport async function ensureStudioSecrets(cwd: string): Promise<StudioSecrets> {\n  const envPath = join(cwd, \".env\");\n  const devVarsPath = join(cwd, \".dev.vars\");\n  const content = await readEnvFile(cwd);\n  const parsed = parseEnv(content);\n\n  const key = parsed[SECRET_KEY]?.trim() || randomBytes(32).toString(\"hex\");\n  const studioPassword = parsed[STUDIO_PASSWORD]?.trim() || generateStudioPassword();\n  const studioAdminUser = parsed[STUDIO_ADMIN_USER]?.trim() || \"admin\";\n  const serviceKey = parsed[SERVICE_KEY]?.trim() || generateServiceKey();\n\n  const isNew =\n    !parsed[SECRET_KEY]?.trim() ||\n    !parsed[STUDIO_PASSWORD]?.trim() ||\n    !parsed[STUDIO_ADMIN_USER]?.trim() ||\n    !parsed[SERVICE_KEY]?.trim();\n\n  const next = applyEnvUpdates(content, {\n    [SECRET_KEY]: key,\n    [STUDIO_PASSWORD]: studioPassword,\n    [STUDIO_ADMIN_USER]: studioAdminUser,\n    [SERVICE_KEY]: serviceKey,\n  });\n  await writeFile(envPath, next, \"utf-8\");\n\n  const devVarsContent = await readDevVarsFile(cwd);\n  const nextDevVars = applyEnvUpdates(devVarsContent, {\n    [SECRET_KEY]: key,\n    [STUDIO_PASSWORD]: studioPassword,\n    [STUDIO_ADMIN_USER]: studioAdminUser,\n    [SERVICE_KEY]: serviceKey,\n  });\n  await writeFile(devVarsPath, nextDevVars, \"utf-8\");\n\n  return { key, studioPassword, studioAdminUser, serviceKey, isNew };\n}\n\nexport async function ensureSecretKey(\n  cwd: string,\n): Promise<{ key: string; isNew: boolean }> {\n  const secrets = await ensureStudioSecrets(cwd);\n  return { key: secrets.key, isNew: secrets.isNew };\n}\n\nexport async function readSecretKey(cwd: string): Promise<string | null> {\n  try {\n    const envContent = await readEnvFile(cwd);\n    const parsed = parseEnv(envContent);\n    return parsed[SECRET_KEY] ?? null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function readStudioSecrets(cwd: string): Promise<{\n  key: string;\n  studioPassword: string;\n  studioAdminUser: string;\n  serviceKey: string;\n} | null> {\n  try {\n    const envContent = await readEnvFile(cwd);\n    const parsed = parseEnv(envContent);\n    const key = parsed[SECRET_KEY]?.trim();\n    const studioPassword = parsed[STUDIO_PASSWORD]?.trim();\n    const studioAdminUser = parsed[STUDIO_ADMIN_USER]?.trim() || \"admin\";\n    const serviceKey = parsed[SERVICE_KEY]?.trim();\n    if (!key || !studioPassword || !serviceKey) return null;\n    return { key, studioPassword, studioAdminUser, serviceKey };\n  } catch {\n    return null;\n  }\n}\n","import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport interface ProjectAgentState {\n  currentHash: string | null;\n  currentVersion: number;\n  lastLocalHash: string | null;\n  lastRemoteHash: string | null;\n  lastPushedAt: string | null;\n  localPath: string;\n  workerUrl: string | null;\n}\n\nexport interface ProjectState {\n  workerUrl: string | null;\n  deployedAt: string | null;\n  accountId: string | null;\n  studioCredentialsFingerprint?: string | null;\n  serviceKeyFingerprint?: string | null;\n  agents: Record<string, ProjectAgentState>;\n}\n\nconst KALP_DIR = \".kalp\";\nconst STATE_FILE = \"state.json\";\n\nfunction normalizeProjectState(raw: unknown): ProjectState | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const value = raw as Record<string, unknown>;\n  const workerUrl =\n    typeof value.workerUrl === \"string\" && value.workerUrl.length > 0\n      ? value.workerUrl\n      : null;\n  const deployedAt =\n    typeof value.deployedAt === \"string\" && value.deployedAt.length > 0\n      ? value.deployedAt\n      : null;\n  const accountId =\n    typeof value.accountId === \"string\" && value.accountId.length > 0\n      ? value.accountId\n      : null;\n  const studioCredentialsFingerprint =\n    typeof value.studioCredentialsFingerprint === \"string\" &&\n    value.studioCredentialsFingerprint.length > 0\n      ? value.studioCredentialsFingerprint\n      : null;\n  const serviceKeyFingerprint =\n    typeof value.serviceKeyFingerprint === \"string\" &&\n    value.serviceKeyFingerprint.length > 0\n      ? value.serviceKeyFingerprint\n      : null;\n\n  const agents: Record<string, ProjectAgentState> = {};\n  const rawAgents =\n    value.agents && typeof value.agents === \"object\"\n      ? (value.agents as Record<string, unknown>)\n      : {};\n\n  for (const [name, entry] of Object.entries(rawAgents)) {\n    if (!entry || typeof entry !== \"object\") continue;\n    const item = entry as Record<string, unknown>;\n    if (typeof item.localPath !== \"string\" || item.localPath.length === 0) {\n      continue;\n    }\n\n    const currentVersion =\n      typeof item.currentVersion === \"number\" && Number.isFinite(item.currentVersion)\n        ? Math.max(0, Math.floor(item.currentVersion))\n        : 0;\n\n    agents[name] = {\n      currentHash: typeof item.currentHash === \"string\" ? item.currentHash : null,\n      currentVersion,\n      lastLocalHash: typeof item.lastLocalHash === \"string\" ? item.lastLocalHash : null,\n      lastRemoteHash:\n        typeof item.lastRemoteHash === \"string\" ? item.lastRemoteHash : null,\n      lastPushedAt: typeof item.lastPushedAt === \"string\" ? item.lastPushedAt : null,\n      localPath: item.localPath,\n      workerUrl: typeof item.workerUrl === \"string\" ? item.workerUrl : null,\n    };\n  }\n\n  return {\n    workerUrl,\n    deployedAt,\n    accountId,\n    studioCredentialsFingerprint,\n    serviceKeyFingerprint,\n    agents,\n  };\n}\n\nexport async function readProjectState(cwd: string): Promise<ProjectState | null> {\n  try {\n    const statePath = join(cwd, KALP_DIR, STATE_FILE);\n    const content = await readFile(statePath, \"utf-8\");\n    return normalizeProjectState(JSON.parse(content));\n  } catch {\n    return null;\n  }\n}\n\nexport async function writeProjectState(\n  cwd: string,\n  state: ProjectState,\n): Promise<void> {\n  const dir = join(cwd, KALP_DIR);\n  await mkdir(dir, { recursive: true });\n  await writeFile(join(dir, STATE_FILE), `${JSON.stringify(state, null, 2)}\\n`, \"utf-8\");\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  access,\n  cp,\n  mkdir,\n  readdir,\n  readFile,\n  rm,\n  stat,\n  writeFile,\n} from \"node:fs/promises\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { deriveLabelFromName } from \"@kalphq/project\";\nimport { getRequiredSecretForProvider, resolveProviderFromConfig } from \"@/utils/ai\";\nimport {\n  resolveIdentityAuthRequirements,\n} from \"@/utils/project-config\";\nimport { readProjectState } from \"@/utils/project-state\";\nimport { materializeRuntimeIdentity } from \"@/utils/runtime-identity\";\n\nconst RUNTIME_ROOT = \".kalp\";\nconst RUNTIME_DIR = \"runtime\";\nconst STUDIO_DIR = \"studio\";\nconst WRANGLER_CONFIG_FILE = \"wrangler.jsonc\";\nconst WORKER_ENTRY_FILE = \"worker-entry.js\";\nconst COMPATIBILITY_DATE = \"2026-05-10\";\n\nexport interface RuntimePaths {\n  runtimeDir: string;\n  studioDir: string;\n  workerEntrypointPath: string;\n  wranglerConfigPath: string;\n  workerName: string;\n}\n\ninterface RuntimeAgentRecord {\n  name: string;\n  label?: string;\n  tags?: string[];\n  environment: \"local\" | \"remote\" | \"both\";\n  status: \"online\" | \"offline\";\n  hash: string | null;\n  version: string | null;\n  versionNumber: number | null;\n  lastRemoteHash: string | null;\n  lastLocalHash: string | null;\n  workerUrl: string | null;\n  localPath: string | null;\n  updatedAt: string | null;\n}\n\ninterface RuntimeAgentsSnapshot {\n  generatedAt: string;\n  projectPath: string;\n  workerUrl: string | null;\n  mode: \"local\" | \"remote\";\n  agents: RuntimeAgentRecord[];\n}\n\nexport interface MaterializeRuntimeOptions {\n  mode?: \"local\" | \"remote\";\n}\n\ninterface WranglerConfig {\n  $schema: string;\n  name: string;\n  main: string;\n  compatibility_date: string;\n  compatibility_flags: string[];\n  migrations: Array<{ tag: string; new_sqlite_classes: string[] }>;\n  durable_objects: {\n    bindings: Array<{ name: string; class_name: string }>;\n  };\n  kv_namespaces: Array<{ binding: string }>;\n  assets: {\n    directory: string;\n    binding: string;\n    run_worker_first: boolean;\n  };\n  observability: { enabled: boolean };\n  upload_source_maps: boolean;\n  vars: {\n    KALP_ENV: \"local\" | \"remote\";\n  };\n  secrets: { required: string[] };\n}\n\ninterface RuntimeTemplatePaths {\n  studioTemplateDir: string;\n  workerEntryPath: string;\n}\n\nfunction sanitizeSegment(input: string): string {\n  return input\n    .toLowerCase()\n    .replace(/^@/, \"\")\n    .replace(/\\//g, \"-\")\n    .replace(/[^a-z0-9-]/g, \"-\")\n    .replace(/-+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n}\n\nasync function resolveProjectSlug(cwd: string): Promise<string> {\n  const fallback = sanitizeSegment(basename(cwd)) || \"agent\";\n  const packageJsonPath = join(cwd, \"package.json\");\n\n  try {\n    const content = await readFile(packageJsonPath, \"utf-8\");\n    const pkg = JSON.parse(content) as { name?: string };\n    const name = typeof pkg.name === \"string\" ? pkg.name : \"\";\n    const sanitized = sanitizeSegment(name);\n    return sanitized || fallback;\n  } catch {\n    return fallback;\n  }\n}\n\nfunction buildWorkerName(slug: string, cwd: string): string {\n  const cwdHash = createHash(\"sha1\").update(cwd).digest(\"hex\").slice(0, 8);\n  const withPrefix = `kalp-${slug}-${cwdHash}`;\n  const maxLen = 63;\n  if (withPrefix.length <= maxLen) {\n    return withPrefix;\n  }\n\n  const clipped = withPrefix.slice(0, maxLen).replace(/-+$/g, \"\");\n  return clipped || `kalp-${cwdHash}`;\n}\n\nfunction createRuntimeConfig(\n  workerName: string,\n  mode: \"local\" | \"remote\",\n  requiredSecrets: string[],\n): WranglerConfig {\n  return {\n    $schema: \"node_modules/wrangler/config-schema.json\",\n    name: workerName,\n    main: `./${WORKER_ENTRY_FILE}`,\n    compatibility_date: COMPATIBILITY_DATE,\n    compatibility_flags: [\"nodejs_compat\"],\n    migrations: [\n      {\n        tag: \"v1\",\n        new_sqlite_classes: [\"AgentDurableObject\"],\n      },\n    ],\n    durable_objects: {\n      bindings: [\n        {\n          name: \"KALP_RUNTIME_CLOUDFLARE\",\n          class_name: \"AgentDurableObject\",\n        },\n      ],\n    },\n    kv_namespaces: [\n      {\n        binding: \"KALP_MANIFESTS\",\n      },\n    ],\n    assets: {\n      directory: `./${STUDIO_DIR}`,\n      binding: \"ASSETS\",\n      run_worker_first: true,\n    },\n    observability: { enabled: true },\n    upload_source_maps: true,\n    vars: {\n      KALP_ENV: mode,\n    },\n    secrets: {\n      required: requiredSecrets,\n    },\n  };\n}\n\nfunction runtimeTemplateCandidates(): Array<{\n  studioTemplateDir: string;\n  workerEntryPath: string;\n}> {\n  const here = dirname(fileURLToPath(import.meta.url));\n  const distTemplateRoot = resolve(here, \"runtime-template\");\n  const packageRootTemplate = resolve(here, \"..\", \"runtime-template\");\n  const sourceTemplateRoot = resolve(here, \"..\", \"..\", \"runtime-template\");\n  const monorepoStudioDist = resolve(\n    here,\n    \"..\",\n    \"..\",\n    \"..\",\n    \"..\",\n    \"apps\",\n    \"studio\",\n    \"dist\",\n    \"client\",\n  );\n\n  return [\n    {\n      studioTemplateDir: join(distTemplateRoot, STUDIO_DIR),\n      workerEntryPath: join(distTemplateRoot, WORKER_ENTRY_FILE),\n    },\n    {\n      studioTemplateDir: join(packageRootTemplate, STUDIO_DIR),\n      workerEntryPath: join(packageRootTemplate, WORKER_ENTRY_FILE),\n    },\n    {\n      studioTemplateDir: join(sourceTemplateRoot, STUDIO_DIR),\n      workerEntryPath: join(sourceTemplateRoot, WORKER_ENTRY_FILE),\n    },\n    {\n      studioTemplateDir: monorepoStudioDist,\n      workerEntryPath: join(sourceTemplateRoot, WORKER_ENTRY_FILE),\n    },\n  ];\n}\n\nasync function resolveRuntimeTemplate(): Promise<RuntimeTemplatePaths> {\n  for (const candidate of runtimeTemplateCandidates()) {\n    try {\n      await access(candidate.studioTemplateDir);\n      await access(candidate.workerEntryPath);\n      return candidate;\n    } catch {\n      // continue\n    }\n  }\n\n  throw new Error(\n    \"Kalp runtime template not found in CLI package. Reinstall @kalphq/cli.\",\n  );\n}\n\nfunction createStudioShell(entryScript: string, cssFiles: string[]): string {\n  const cssLinks = cssFiles\n    .map((file) => `    <link rel=\"stylesheet\" href=\"/studio/assets/${file}\" />`)\n    .join(\"\\n\");\n\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"UTF-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n    <title>Kalp Studio</title>\n${cssLinks}\n  </head>\n  <body>\n    <div id=\"root\"></div>\n    <script type=\"module\" src=\"/studio/assets/${entryScript}\"></script>\n  </body>\n</html>\n`;\n}\n\nasync function ensureStudioIndex(studioDir: string): Promise<void> {\n  const indexPath = join(studioDir, \"index.html\");\n  try {\n    await access(indexPath);\n    return;\n  } catch {\n    // index.html is missing on some TanStack Start static builds.\n  }\n\n  const assetsDir = join(studioDir, \"assets\");\n  const assetFiles = await readdir(assetsDir);\n  const entryScript =\n    assetFiles.find((file) => /^index-.*\\.js$/i.test(file)) ??\n    assetFiles.find((file) => file.endsWith(\".js\"));\n\n  if (!entryScript) {\n    throw new Error(\n      \"Studio runtime template is missing an entry JS bundle in studio/assets.\",\n    );\n  }\n\n  const cssFiles = assetFiles.filter((file) => file.endsWith(\".css\")).sort();\n  const html = createStudioShell(entryScript, cssFiles);\n  await writeFile(indexPath, html, \"utf-8\");\n}\n\nexport async function readLocalAgentNames(cwd: string): Promise<string[]> {\n  const agentsDir = join(cwd, \"agents\");\n  try {\n    const entries = await readdir(agentsDir, { withFileTypes: true });\n    const names: string[] = [];\n    for (const entry of entries) {\n      if (!entry.isDirectory()) continue;\n      const indexPath = join(agentsDir, entry.name, \"index.ts\");\n      const exists = await stat(indexPath)\n        .then(() => true)\n        .catch(() => false);\n      if (exists) names.push(entry.name);\n    }\n    return names.sort((a, b) => a.localeCompare(b));\n  } catch {\n    return [];\n  }\n}\n\nasync function createAgentsSnapshot(\n  cwd: string,\n  mode: \"local\" | \"remote\",\n): Promise<RuntimeAgentsSnapshot> {\n  const localAgentNames = await readLocalAgentNames(cwd);\n  const state = await readProjectState(cwd);\n\n  const byName = new Map<string, RuntimeAgentRecord>();\n  const stateAgents = state?.agents ?? {};\n\n  for (const name of localAgentNames) {\n    const localPath = join(cwd, \"agents\", name, \"index.ts\");\n    const saved = stateAgents[name];\n    const hasRemoteVersion = !!saved?.lastRemoteHash && (saved?.currentVersion ?? 0) > 0;\n\n    if (mode === \"remote\" && !hasRemoteVersion) {\n      continue;\n    }\n\n    const resolvedWorkerUrl =\n      saved?.workerUrl ??\n      (state?.workerUrl ? `${state.workerUrl.replace(/\\/$/, \"\")}/a/${name}` : null);\n    const versionNumber =\n      typeof saved?.currentVersion === \"number\" && saved.currentVersion > 0\n        ? saved.currentVersion\n        : null;\n\n    byName.set(name, {\n      name,\n      label: deriveLabelFromName(name),\n      tags: [],\n      environment:\n        mode === \"remote\"\n          ? \"remote\"\n          : hasRemoteVersion\n            ? \"both\"\n            : \"local\",\n      status: resolvedWorkerUrl ? \"online\" : \"offline\",\n      hash: saved?.currentHash ?? null,\n      version: versionNumber ? `v${versionNumber}` : null,\n      versionNumber,\n      lastRemoteHash: saved?.lastRemoteHash ?? null,\n      lastLocalHash: saved?.lastLocalHash ?? null,\n      workerUrl: resolvedWorkerUrl,\n      localPath,\n      updatedAt: saved?.lastPushedAt ?? state?.deployedAt ?? null,\n    });\n  }\n\n  if (mode === \"remote\") {\n    for (const [name, saved] of Object.entries(stateAgents)) {\n      const hasRemoteVersion =\n        !!saved.lastRemoteHash && (saved.currentVersion ?? 0) > 0;\n      if (!hasRemoteVersion || byName.has(name)) continue;\n\n      const localPath = saved.localPath ?? join(cwd, \"agents\", name, \"index.ts\");\n      const workerUrl =\n        saved.workerUrl ??\n        (state?.workerUrl ? `${state.workerUrl.replace(/\\/$/, \"\")}/a/${name}` : null);\n      const versionNumber = saved.currentVersion > 0 ? saved.currentVersion : null;\n\n      byName.set(name, {\n        name,\n        label: deriveLabelFromName(name),\n        tags: [],\n        environment: \"remote\",\n        status: workerUrl ? \"online\" : \"offline\",\n        hash: saved.currentHash ?? null,\n        version: versionNumber ? `v${versionNumber}` : null,\n        versionNumber,\n        lastRemoteHash: saved.lastRemoteHash ?? null,\n        lastLocalHash: saved.lastLocalHash ?? null,\n        workerUrl,\n        localPath,\n        updatedAt: saved.lastPushedAt ?? state?.deployedAt ?? null,\n      });\n    }\n  }\n\n  return {\n    generatedAt: new Date().toISOString(),\n    projectPath: cwd,\n    workerUrl: state?.workerUrl ?? null,\n    mode,\n    agents: Array.from(byName.values()).sort((a, b) => a.name.localeCompare(b.name)),\n  };\n}\n\nexport async function writeRuntimeAgentsSnapshot(params: {\n  cwd: string;\n  runtimeDir: string;\n  mode: \"local\" | \"remote\";\n}): Promise<void> {\n  const snapshot = await createAgentsSnapshot(params.cwd, params.mode);\n  await writeFile(\n    join(params.runtimeDir, \"agents.snapshot.json\"),\n    `${JSON.stringify(snapshot, null, 2)}\\n`,\n    \"utf-8\",\n  );\n}\n\nexport async function materializeRuntime(\n  cwd: string,\n  options: MaterializeRuntimeOptions = {},\n): Promise<RuntimePaths> {\n  const mode = options.mode ?? \"remote\";\n  const runtimeDir = join(cwd, RUNTIME_ROOT, RUNTIME_DIR);\n  const studioDir = join(runtimeDir, STUDIO_DIR);\n  const workerEntrypointPath = join(runtimeDir, WORKER_ENTRY_FILE);\n  const wranglerConfigPath = join(runtimeDir, WRANGLER_CONFIG_FILE);\n\n  const template = await resolveRuntimeTemplate();\n  await rm(runtimeDir, { recursive: true, force: true });\n  await mkdir(runtimeDir, { recursive: true });\n\n  await cp(template.studioTemplateDir, studioDir, { recursive: true });\n  await cp(template.workerEntryPath, workerEntrypointPath);\n  await ensureStudioIndex(studioDir);\n  await writeRuntimeAgentsSnapshot({ cwd, runtimeDir, mode });\n  const identity = await materializeRuntimeIdentity({ cwd, runtimeDir });\n\n  const projectSlug = await resolveProjectSlug(cwd);\n  const workerName = buildWorkerName(projectSlug, cwd);\n  const requiredSecrets = new Set<string>([\n    \"KALP_SECRET_KEY\",\n    \"KALP_STUDIO_PASSWORD\",\n    \"KALP_STUDIO_ADMIN_USER\",\n    \"KALP_SERVICE_KEY\",\n  ]);\n\n  try {\n    const provider = await resolveProviderFromConfig(cwd);\n    requiredSecrets.add(getRequiredSecretForProvider(provider));\n  } catch {\n    // Ignore provider resolution errors here; deploy preflight handles strict checks.\n  }\n\n  const identityRequirements = resolveIdentityAuthRequirements(identity.identityConfig);\n  for (const requirement of identityRequirements) {\n    requiredSecrets.add(requirement.envKey);\n  }\n\n  const wranglerConfig = createRuntimeConfig(\n    workerName,\n    mode,\n    [...requiredSecrets].sort((a, b) => a.localeCompare(b)),\n  );\n  await writeFile(\n    wranglerConfigPath,\n    `${JSON.stringify(wranglerConfig, null, 2)}\\n`,\n    \"utf-8\",\n  );\n\n  return {\n    runtimeDir,\n    studioDir,\n    workerEntrypointPath,\n    wranglerConfigPath,\n    workerName,\n  };\n}\n","import { access, readFile } from \"node:fs/promises\";\nimport { constants } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { createJiti } from \"jiti\";\n\nexport type AIProvider = \"openai\" | \"anthropic\" | \"openrouter\" | \"custom\";\n\nconst PROVIDER_SECRET_MAP: Record<AIProvider, string> = {\n  openai: \"OPENAI_API_KEY\",\n  anthropic: \"ANTHROPIC_API_KEY\",\n  openrouter: \"OPENROUTER_API_KEY\",\n  custom: \"CUSTOM_AI_API_KEY\",\n};\n\nfunction parseEnv(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const raw of content.split(/\\r?\\n/g)) {\n    const line = raw.trim();\n    if (!line || line.startsWith(\"#\")) continue;\n    const idx = line.indexOf(\"=\");\n    if (idx <= 0) continue;\n    env[line.slice(0, idx).trim()] = line.slice(idx + 1);\n  }\n  return env;\n}\n\nexport async function resolveProviderFromConfig(cwd: string): Promise<AIProvider> {\n  const configPath = join(cwd, \"kalp.config.ts\");\n  await access(configPath, constants.F_OK);\n  const jiti = createJiti(cwd, { interopDefault: true });\n  const config = (await jiti.import(configPath)) as\n    | { default?: { ai?: { provider?: AIProvider } }; ai?: { provider?: AIProvider } }\n    | undefined;\n  const provider = config?.default?.ai?.provider ?? config?.ai?.provider ?? \"openai\";\n  return provider;\n}\n\nexport async function readDotEnv(cwd: string): Promise<Record<string, string>> {\n  const envPath = join(cwd, \".env\");\n  const content = await readFile(envPath, \"utf-8\").catch(() => \"\");\n  return parseEnv(content);\n}\n\nexport function getRequiredSecretForProvider(provider: AIProvider): string {\n  return PROVIDER_SECRET_MAP[provider];\n}\n","import { createJiti } from \"jiti\";\nimport { access } from \"node:fs/promises\";\nimport { constants } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport type { AuthStrategy, IdentityConfig } from \"@kalphq/sdk\";\n\nexport interface LoadedProjectConfig {\n  path: string;\n  raw: Record<string, unknown>;\n}\n\nexport interface RuntimeIdentityStrategyConfig {\n  type: \"jwks\" | \"symmetric\" | \"apiKey\";\n  jwksUrl?: string;\n  issuer?: string;\n  audience?: string;\n  secretEnvKey?: string;\n  headerName?: string;\n  envKey?: string;\n}\n\nexport interface RuntimeIdentityConfig {\n  enforceGlobalAuth: boolean;\n  identityId: string | null;\n  strategy: RuntimeIdentityStrategyConfig | null;\n}\n\nexport interface ProjectConfigAuthRequirement {\n  envKey: string;\n  reason: string;\n}\n\nfunction normalizeStrategy(\n  strategy: AuthStrategy | undefined,\n): RuntimeIdentityStrategyConfig | null {\n  if (!strategy) return null;\n  if (strategy.type === \"jwks\") {\n    return {\n      type: \"jwks\",\n      jwksUrl: strategy.jwksUrl,\n      issuer: strategy.issuer,\n      audience: strategy.audience,\n    };\n  }\n  if (strategy.type === \"symmetric\") {\n    return {\n      type: \"symmetric\",\n      secretEnvKey: strategy.secretEnvKey,\n    };\n  }\n  return {\n    type: \"apiKey\",\n    headerName: strategy.headerName,\n    envKey: strategy.envKey,\n  };\n}\n\nexport async function loadProjectConfig(cwd: string): Promise<LoadedProjectConfig> {\n  const configPath = resolve(join(cwd, \"kalp.config.ts\"));\n  await access(configPath, constants.F_OK);\n  const jiti = createJiti(cwd, { interopDefault: true });\n  const moduleValue = (await jiti.import(configPath)) as\n    | { default?: Record<string, unknown> }\n    | Record<string, unknown>;\n  const raw =\n    moduleValue && typeof moduleValue === \"object\" && \"default\" in moduleValue\n      ? ((moduleValue.default ?? moduleValue) as Record<string, unknown>)\n      : (moduleValue as Record<string, unknown>);\n  return { path: configPath, raw };\n}\n\nexport function resolveRuntimeIdentityConfig(\n  rawConfig: Record<string, unknown>,\n): RuntimeIdentityConfig {\n  const identity =\n    rawConfig.identity && typeof rawConfig.identity === \"object\"\n      ? (rawConfig.identity as IdentityConfig)\n      : undefined;\n  const enforceGlobalAuth =\n    typeof rawConfig.enforceGlobalAuth === \"boolean\"\n      ? rawConfig.enforceGlobalAuth\n      : true;\n\n  return {\n    enforceGlobalAuth,\n    identityId:\n      identity && typeof identity.id === \"string\" && identity.id.length > 0\n        ? identity.id\n        : null,\n    strategy: normalizeStrategy(identity?.strategy),\n  };\n}\n\nexport function resolveIdentityAuthRequirements(\n  identity: RuntimeIdentityConfig,\n): ProjectConfigAuthRequirement[] {\n  if (!identity.strategy) return [];\n\n  if (identity.strategy.type === \"symmetric\") {\n    return [\n      {\n        envKey: identity.strategy.secretEnvKey?.trim() || \"JWT_SIGNING_SECRET\",\n        reason: \"symmetric JWT validation\",\n      },\n    ];\n  }\n\n  if (identity.strategy.type === \"apiKey\") {\n    const envKey = identity.strategy.envKey?.trim();\n    if (!envKey) {\n      return [\n        {\n          envKey: \"KALP_API_KEY\",\n          reason: \"apiKey strategy (default env key)\",\n        },\n      ];\n    }\n    return [{ envKey, reason: \"apiKey strategy\" }];\n  }\n\n  return [];\n}\n","import { build } from \"esbuild\";\nimport { writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport {\n  loadProjectConfig,\n  resolveRuntimeIdentityConfig,\n  type RuntimeIdentityConfig,\n} from \"@/utils/project-config\";\n\nconst NODE_BUILTIN_IMPORTS = new Set([\n  \"fs\",\n  \"path\",\n  \"crypto\",\n  \"os\",\n  \"child_process\",\n  \"worker_threads\",\n  \"net\",\n  \"tls\",\n  \"http\",\n  \"https\",\n  \"zlib\",\n  \"stream\",\n  \"url\",\n  \"process\",\n  \"buffer\",\n]);\n\nexport interface MaterializeRuntimeIdentityResult {\n  identityConfig: RuntimeIdentityConfig;\n  identityConfigPath: string;\n  identityMapPath: string;\n}\n\nconst DEFAULT_IDENTITY_MAP_SOURCE = `export default function mapIdentity(payload) {\n  const sub =\n    payload && typeof payload === \"object\" && typeof payload.sub === \"string\"\n      ? payload.sub\n      : \"anonymous\";\n  return { userId: sub, claims: {} };\n}\n`;\n\nfunction readIdentityMapCandidate(rawConfig: Record<string, unknown>): unknown {\n  if (!rawConfig.identity || typeof rawConfig.identity !== \"object\") return null;\n  return (rawConfig.identity as Record<string, unknown>).mapIdentity;\n}\n\nasync function writeDefaultIdentityMap(identityMapPath: string): Promise<void> {\n  await writeFile(identityMapPath, DEFAULT_IDENTITY_MAP_SOURCE, \"utf-8\");\n}\n\nasync function bundleIdentityMap(params: {\n  cwd: string;\n  configPath: string;\n  identityMapPath: string;\n}): Promise<void> {\n  const { cwd, configPath, identityMapPath } = params;\n  const configSpecifier = pathToFileURL(configPath).href;\n  const entrySource = `\nimport configModule from ${JSON.stringify(configSpecifier)};\nconst config = (configModule && typeof configModule === \"object\" && \"default\" in configModule)\n  ? (configModule.default ?? configModule)\n  : configModule;\n\nconst mapper = config?.identity?.mapIdentity;\nif (typeof mapper !== \"function\") {\n  throw new Error(\"identity.mapIdentity must be a function.\");\n}\n\nexport default mapper;\n`;\n\n  try {\n    await build({\n      absWorkingDir: cwd,\n      bundle: true,\n      format: \"esm\",\n      platform: \"browser\",\n      target: [\"es2022\"],\n      write: true,\n      outfile: identityMapPath,\n      logLevel: \"silent\",\n      plugins: [\n        {\n          name: \"kalp-edge-identity-guard\",\n          setup(buildContext) {\n            buildContext.onResolve({ filter: /.*/ }, (args) => {\n              const raw = args.path.startsWith(\"node:\")\n                ? args.path.slice(5)\n                : args.path;\n              if (NODE_BUILTIN_IMPORTS.has(raw)) {\n                return {\n                  errors: [\n                    {\n                      text: `Node builtin \"${args.path}\" is not supported in identity.mapIdentity for edge runtime.`,\n                    },\n                  ],\n                };\n              }\n              return null;\n            });\n          },\n        },\n      ],\n      stdin: {\n        contents: entrySource,\n        resolveDir: cwd,\n        sourcefile: \"kalp-identity-map-entry.mjs\",\n        loader: \"js\",\n      },\n    });\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `Could not bundle identity.mapIdentity for runtime. Ensure mapIdentity is edge-safe (no Node built-ins). ${message}`,\n    );\n  }\n}\n\nexport async function materializeRuntimeIdentity(params: {\n  cwd: string;\n  runtimeDir: string;\n}): Promise<MaterializeRuntimeIdentityResult> {\n  const { cwd, runtimeDir } = params;\n  const identityConfigPath = join(runtimeDir, \"identity.config.json\");\n  const identityMapPath = join(runtimeDir, \"identity.map.mjs\");\n\n  let rawConfig: Record<string, unknown> = {};\n  let configPath: string | null = null;\n  try {\n    const loaded = await loadProjectConfig(cwd);\n    rawConfig = loaded.raw;\n    configPath = loaded.path;\n  } catch {\n    rawConfig = {};\n    configPath = null;\n  }\n\n  const identityConfig = resolveRuntimeIdentityConfig(rawConfig);\n  await writeFile(identityConfigPath, `${JSON.stringify(identityConfig, null, 2)}\\n`, \"utf-8\");\n\n  const mapIdentity = readIdentityMapCandidate(rawConfig);\n  if (typeof mapIdentity === \"function\" && configPath) {\n    await bundleIdentityMap({\n      cwd,\n      configPath,\n      identityMapPath,\n    });\n  } else {\n    await writeDefaultIdentityMap(identityMapPath);\n  }\n\n  return { identityConfig, identityConfigPath, identityMapPath };\n}\n"],"mappings":";;;AAAA,SAAS,mBAAmB;AAC5B,SAAS,UAAU,iBAAiB;AACpC,SAAS,YAAY;AAEd,IAAM,aAAa;AACnB,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAC1B,IAAM,cAAc;AAE3B,SAAS,aAAa,OAAuB;AAC3C,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,SAAS,SAAyC;AACzD,QAAM,SAAiC,CAAC;AACxC,aAAW,QAAQ,QAAQ,MAAM,QAAQ,GAAG;AAC1C,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,UAAM,UAAU,QAAQ,QAAQ,GAAG;AACnC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAM,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAC3C,UAAM,QAAQ,QAAQ,MAAM,UAAU,CAAC,EAAE,KAAK;AAC9C,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAiB,SAAyC;AACjF,MAAI,OAAO;AACX,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAM,OAAO,GAAG,GAAG,IAAI,KAAK;AAC5B,UAAM,UAAU,IAAI,OAAO,IAAI,aAAa,GAAG,CAAC,QAAQ,GAAG;AAC3D,QAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,aAAO,KAAK,QAAQ,SAAS,IAAI;AACjC;AAAA,IACF;AACA,UAAM,UAAU,KAAK,QAAQ;AAC7B,WAAO,QAAQ,SAAS,IAAI,GAAG,OAAO;AAAA,EAAK,IAAI;AAAA,IAAO,GAAG,IAAI;AAAA;AAAA,EAC/D;AAEA,SAAO,KAAK,QAAQ,IAAI;AAC1B;AAEA,eAAe,YAAY,KAA8B;AACvD,QAAM,UAAU,KAAK,KAAK,MAAM;AAChC,MAAI;AACF,WAAO,MAAM,SAAS,SAAS,OAAO;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBAAgB,KAA8B;AAC3D,QAAM,cAAc,KAAK,KAAK,WAAW;AACzC,MAAI;AACF,WAAO,MAAM,SAAS,aAAa,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBAAiC;AACxC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,qBAA6B;AACpC,SAAO,gBAAgB,YAAY,EAAE,EAAE,SAAS,WAAW,CAAC;AAC9D;AAUA,eAAsB,oBAAoB,KAAqC;AAC7E,QAAM,UAAU,KAAK,KAAK,MAAM;AAChC,QAAM,cAAc,KAAK,KAAK,WAAW;AACzC,QAAM,UAAU,MAAM,YAAY,GAAG;AACrC,QAAM,SAAS,SAAS,OAAO;AAE/B,QAAM,MAAM,OAAO,UAAU,GAAG,KAAK,KAAK,YAAY,EAAE,EAAE,SAAS,KAAK;AACxE,QAAM,iBAAiB,OAAO,eAAe,GAAG,KAAK,KAAK,uBAAuB;AACjF,QAAM,kBAAkB,OAAO,iBAAiB,GAAG,KAAK,KAAK;AAC7D,QAAM,aAAa,OAAO,WAAW,GAAG,KAAK,KAAK,mBAAmB;AAErE,QAAM,QACJ,CAAC,OAAO,UAAU,GAAG,KAAK,KAC1B,CAAC,OAAO,eAAe,GAAG,KAAK,KAC/B,CAAC,OAAO,iBAAiB,GAAG,KAAK,KACjC,CAAC,OAAO,WAAW,GAAG,KAAK;AAE7B,QAAM,OAAO,gBAAgB,SAAS;AAAA,IACpC,CAAC,UAAU,GAAG;AAAA,IACd,CAAC,eAAe,GAAG;AAAA,IACnB,CAAC,iBAAiB,GAAG;AAAA,IACrB,CAAC,WAAW,GAAG;AAAA,EACjB,CAAC;AACD,QAAM,UAAU,SAAS,MAAM,OAAO;AAEtC,QAAM,iBAAiB,MAAM,gBAAgB,GAAG;AAChD,QAAM,cAAc,gBAAgB,gBAAgB;AAAA,IAClD,CAAC,UAAU,GAAG;AAAA,IACd,CAAC,eAAe,GAAG;AAAA,IACnB,CAAC,iBAAiB,GAAG;AAAA,IACrB,CAAC,WAAW,GAAG;AAAA,EACjB,CAAC;AACD,QAAM,UAAU,aAAa,aAAa,OAAO;AAEjD,SAAO,EAAE,KAAK,gBAAgB,iBAAiB,YAAY,MAAM;AACnE;AAEA,eAAsB,gBACpB,KAC0C;AAC1C,QAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,SAAO,EAAE,KAAK,QAAQ,KAAK,OAAO,QAAQ,MAAM;AAClD;;;ACvHA,SAAS,OAAO,YAAAA,WAAU,aAAAC,kBAAiB;AAC3C,SAAS,QAAAC,aAAY;AAqBrB,IAAM,WAAW;AACjB,IAAM,aAAa;AAEnB,SAAS,sBAAsB,KAAmC;AAChE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,QAAQ;AACd,QAAM,YACJ,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAC5D,MAAM,YACN;AACN,QAAM,aACJ,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,SAAS,IAC9D,MAAM,aACN;AACN,QAAM,YACJ,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAC5D,MAAM,YACN;AACN,QAAM,+BACJ,OAAO,MAAM,iCAAiC,YAC9C,MAAM,6BAA6B,SAAS,IACxC,MAAM,+BACN;AACN,QAAM,wBACJ,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS,IACjC,MAAM,wBACN;AAEN,QAAM,SAA4C,CAAC;AACnD,QAAM,YACJ,MAAM,UAAU,OAAO,MAAM,WAAW,WACnC,MAAM,SACP,CAAC;AAEP,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACrD,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,UAAM,OAAO;AACb,QAAI,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,WAAW,GAAG;AACrE;AAAA,IACF;AAEA,UAAM,iBACJ,OAAO,KAAK,mBAAmB,YAAY,OAAO,SAAS,KAAK,cAAc,IAC1E,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,cAAc,CAAC,IAC3C;AAEN,WAAO,IAAI,IAAI;AAAA,MACb,aAAa,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,MACvE;AAAA,MACA,eAAe,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,MAC7E,gBACE,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAAA,MAClE,cAAc,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAAA,MAC1E,WAAW,KAAK;AAAA,MAChB,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,iBAAiB,KAA2C;AAChF,MAAI;AACF,UAAM,YAAYA,MAAK,KAAK,UAAU,UAAU;AAChD,UAAM,UAAU,MAAMF,UAAS,WAAW,OAAO;AACjD,WAAO,sBAAsB,KAAK,MAAM,OAAO,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,KACA,OACe;AACf,QAAM,MAAME,MAAK,KAAK,QAAQ;AAC9B,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAMD,WAAUC,MAAK,KAAK,UAAU,GAAG,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,OAAO;AACvF;;;AC5GA,SAAS,kBAAkB;AAC3B;AAAA,EACE,UAAAC;AAAA,EACA;AAAA,EACA,SAAAC;AAAA,EACA;AAAA,EACA,YAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAAC;AAAA,OACK;AACP,SAAS,UAAU,SAAS,QAAAC,OAAM,WAAAC,gBAAe;AACjD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;;;ACbpC,SAAS,QAAQ,YAAAC,iBAAgB;AACjC,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AACrB,SAAS,kBAAkB;AAI3B,IAAM,sBAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,QAAQ;AACV;AAEA,SAASC,UAAS,SAAyC;AACzD,QAAM,MAA8B,CAAC;AACrC,aAAW,OAAO,QAAQ,MAAM,QAAQ,GAAG;AACzC,UAAM,OAAO,IAAI,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AACnC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,EAAG;AACd,QAAI,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEA,eAAsB,0BAA0B,KAAkC;AAChF,QAAM,aAAaD,MAAK,KAAK,gBAAgB;AAC7C,QAAM,OAAO,YAAY,UAAU,IAAI;AACvC,QAAM,OAAO,WAAW,KAAK,EAAE,gBAAgB,KAAK,CAAC;AACrD,QAAM,SAAU,MAAM,KAAK,OAAO,UAAU;AAG5C,QAAM,WAAW,QAAQ,SAAS,IAAI,YAAY,QAAQ,IAAI,YAAY;AAC1E,SAAO;AACT;AAEA,eAAsB,WAAW,KAA8C;AAC7E,QAAM,UAAUA,MAAK,KAAK,MAAM;AAChC,QAAM,UAAU,MAAMD,UAAS,SAAS,OAAO,EAAE,MAAM,MAAM,EAAE;AAC/D,SAAOE,UAAS,OAAO;AACzB;AAEO,SAAS,6BAA6B,UAA8B;AACzE,SAAO,oBAAoB,QAAQ;AACrC;;;AC7CA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,UAAAC,eAAc;AACvB,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,QAAAC,OAAM,eAAe;AA6B9B,SAAS,kBACP,UACsC;AACtC,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,SAAS,QAAQ;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,SAAS;AAAA,MAClB,QAAQ,SAAS;AAAA,MACjB,UAAU,SAAS;AAAA,IACrB;AAAA,EACF;AACA,MAAI,SAAS,SAAS,aAAa;AACjC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,SAAS;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY,SAAS;AAAA,IACrB,QAAQ,SAAS;AAAA,EACnB;AACF;AAEA,eAAsB,kBAAkB,KAA2C;AACjF,QAAM,aAAa,QAAQA,MAAK,KAAK,gBAAgB,CAAC;AACtD,QAAMF,QAAO,YAAYC,WAAU,IAAI;AACvC,QAAM,OAAOF,YAAW,KAAK,EAAE,gBAAgB,KAAK,CAAC;AACrD,QAAM,cAAe,MAAM,KAAK,OAAO,UAAU;AAGjD,QAAM,MACJ,eAAe,OAAO,gBAAgB,YAAY,aAAa,cACzD,YAAY,WAAW,cACxB;AACP,SAAO,EAAE,MAAM,YAAY,IAAI;AACjC;AAEO,SAAS,6BACd,WACuB;AACvB,QAAM,WACJ,UAAU,YAAY,OAAO,UAAU,aAAa,WAC/C,UAAU,WACX;AACN,QAAM,oBACJ,OAAO,UAAU,sBAAsB,YACnC,UAAU,oBACV;AAEN,SAAO;AAAA,IACL;AAAA,IACA,YACE,YAAY,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,SAAS,IAChE,SAAS,KACT;AAAA,IACN,UAAU,kBAAkB,UAAU,QAAQ;AAAA,EAChD;AACF;AAEO,SAAS,gCACd,UACgC;AAChC,MAAI,CAAC,SAAS,SAAU,QAAO,CAAC;AAEhC,MAAI,SAAS,SAAS,SAAS,aAAa;AAC1C,WAAO;AAAA,MACL;AAAA,QACE,QAAQ,SAAS,SAAS,cAAc,KAAK,KAAK;AAAA,QAClD,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,SAAS,SAAS,UAAU;AACvC,UAAM,SAAS,SAAS,SAAS,QAAQ,KAAK;AAC9C,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,WAAO,CAAC,EAAE,QAAQ,QAAQ,kBAAkB,CAAC;AAAA,EAC/C;AAEA,SAAO,CAAC;AACV;;;ACzHA,SAAS,aAAa;AACtB,SAAS,aAAAI,kBAAiB;AAC1B,SAAS,QAAAC,aAAY;AACrB,SAAS,qBAAqB;AAO9B,IAAM,uBAAuB,oBAAI,IAAI;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQD,IAAM,8BAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASpC,SAAS,yBAAyB,WAA6C;AAC7E,MAAI,CAAC,UAAU,YAAY,OAAO,UAAU,aAAa,SAAU,QAAO;AAC1E,SAAQ,UAAU,SAAqC;AACzD;AAEA,eAAe,wBAAwB,iBAAwC;AAC7E,QAAMC,WAAU,iBAAiB,6BAA6B,OAAO;AACvE;AAEA,eAAe,kBAAkB,QAIf;AAChB,QAAM,EAAE,KAAK,YAAY,gBAAgB,IAAI;AAC7C,QAAM,kBAAkB,cAAc,UAAU,EAAE;AAClD,QAAM,cAAc;AAAA,2BACK,KAAK,UAAU,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaxD,MAAI;AACF,UAAM,MAAM;AAAA,MACV,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ,CAAC,QAAQ;AAAA,MACjB,OAAO;AAAA,MACP,SAAS;AAAA,MACT,UAAU;AAAA,MACV,SAAS;AAAA,QACP;AAAA,UACE,MAAM;AAAA,UACN,MAAM,cAAc;AAClB,yBAAa,UAAU,EAAE,QAAQ,KAAK,GAAG,CAAC,SAAS;AACjD,oBAAM,MAAM,KAAK,KAAK,WAAW,OAAO,IACpC,KAAK,KAAK,MAAM,CAAC,IACjB,KAAK;AACT,kBAAI,qBAAqB,IAAI,GAAG,GAAG;AACjC,uBAAO;AAAA,kBACL,QAAQ;AAAA,oBACN;AAAA,sBACE,MAAM,iBAAiB,KAAK,IAAI;AAAA,oBAClC;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AACA,qBAAO;AAAA,YACT,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI;AAAA,MACR,2GAA2G,OAAO;AAAA,IACpH;AAAA,EACF;AACF;AAEA,eAAsB,2BAA2B,QAGH;AAC5C,QAAM,EAAE,KAAK,WAAW,IAAI;AAC5B,QAAM,qBAAqBC,MAAK,YAAY,sBAAsB;AAClE,QAAM,kBAAkBA,MAAK,YAAY,kBAAkB;AAE3D,MAAI,YAAqC,CAAC;AAC1C,MAAI,aAA4B;AAChC,MAAI;AACF,UAAM,SAAS,MAAM,kBAAkB,GAAG;AAC1C,gBAAY,OAAO;AACnB,iBAAa,OAAO;AAAA,EACtB,QAAQ;AACN,gBAAY,CAAC;AACb,iBAAa;AAAA,EACf;AAEA,QAAM,iBAAiB,6BAA6B,SAAS;AAC7D,QAAMD,WAAU,oBAAoB,GAAG,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC;AAAA,GAAM,OAAO;AAE3F,QAAM,cAAc,yBAAyB,SAAS;AACtD,MAAI,OAAO,gBAAgB,cAAc,YAAY;AACnD,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,OAAO;AACL,UAAM,wBAAwB,eAAe;AAAA,EAC/C;AAEA,SAAO,EAAE,gBAAgB,oBAAoB,gBAAgB;AAC/D;;;AHrIA,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,aAAa;AACnB,IAAM,uBAAuB;AAC7B,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAmE3B,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MACJ,YAAY,EACZ,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,eAAe,GAAG,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,YAAY,EAAE;AAC3B;AAEA,eAAe,mBAAmB,KAA8B;AAC9D,QAAM,WAAW,gBAAgB,SAAS,GAAG,CAAC,KAAK;AACnD,QAAM,kBAAkBE,MAAK,KAAK,cAAc;AAEhD,MAAI;AACF,UAAM,UAAU,MAAMC,UAAS,iBAAiB,OAAO;AACvD,UAAM,MAAM,KAAK,MAAM,OAAO;AAC9B,UAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AACvD,UAAM,YAAY,gBAAgB,IAAI;AACtC,WAAO,aAAa;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,MAAc,KAAqB;AAC1D,QAAM,UAAU,WAAW,MAAM,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC;AACvE,QAAM,aAAa,QAAQ,IAAI,IAAI,OAAO;AAC1C,QAAM,SAAS;AACf,MAAI,WAAW,UAAU,QAAQ;AAC/B,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,WAAW,MAAM,GAAG,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9D,SAAO,WAAW,QAAQ,OAAO;AACnC;AAEA,SAAS,oBACP,YACA,MACA,iBACgB;AAChB,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK,iBAAiB;AAAA,IAC5B,oBAAoB;AAAA,IACpB,qBAAqB,CAAC,eAAe;AAAA,IACrC,YAAY;AAAA,MACV;AAAA,QACE,KAAK;AAAA,QACL,oBAAoB,CAAC,oBAAoB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,iBAAiB;AAAA,MACf,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,YAAY;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb;AAAA,QACE,SAAS;AAAA,MACX;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,MACT,kBAAkB;AAAA,IACpB;AAAA,IACA,eAAe,EAAE,SAAS,KAAK;AAAA,IAC/B,oBAAoB;AAAA,IACpB,MAAM;AAAA,MACJ,UAAU;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,SAAS,4BAGN;AACD,QAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,QAAM,mBAAmBC,SAAQ,MAAM,kBAAkB;AACzD,QAAM,sBAAsBA,SAAQ,MAAM,MAAM,kBAAkB;AAClE,QAAM,qBAAqBA,SAAQ,MAAM,MAAM,MAAM,kBAAkB;AACvE,QAAM,qBAAqBA;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,MACE,mBAAmBF,MAAK,kBAAkB,UAAU;AAAA,MACpD,iBAAiBA,MAAK,kBAAkB,iBAAiB;AAAA,IAC3D;AAAA,IACA;AAAA,MACE,mBAAmBA,MAAK,qBAAqB,UAAU;AAAA,MACvD,iBAAiBA,MAAK,qBAAqB,iBAAiB;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,mBAAmBA,MAAK,oBAAoB,UAAU;AAAA,MACtD,iBAAiBA,MAAK,oBAAoB,iBAAiB;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,mBAAmB;AAAA,MACnB,iBAAiBA,MAAK,oBAAoB,iBAAiB;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,eAAe,yBAAwD;AACrE,aAAW,aAAa,0BAA0B,GAAG;AACnD,QAAI;AACF,YAAMG,QAAO,UAAU,iBAAiB;AACxC,YAAMA,QAAO,UAAU,eAAe;AACtC,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,aAAqB,UAA4B;AAC1E,QAAM,WAAW,SACd,IAAI,CAAC,SAAS,mDAAmD,IAAI,MAAM,EAC3E,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMP,QAAQ;AAAA;AAAA;AAAA;AAAA,gDAIsC,WAAW;AAAA;AAAA;AAAA;AAI3D;AAEA,eAAe,kBAAkB,WAAkC;AACjE,QAAM,YAAYH,MAAK,WAAW,YAAY;AAC9C,MAAI;AACF,UAAMG,QAAO,SAAS;AACtB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,YAAYH,MAAK,WAAW,QAAQ;AAC1C,QAAM,aAAa,MAAM,QAAQ,SAAS;AAC1C,QAAM,cACJ,WAAW,KAAK,CAAC,SAAS,kBAAkB,KAAK,IAAI,CAAC,KACtD,WAAW,KAAK,CAAC,SAAS,KAAK,SAAS,KAAK,CAAC;AAEhD,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,WAAW,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AACzE,QAAM,OAAO,kBAAkB,aAAa,QAAQ;AACpD,QAAMI,WAAU,WAAW,MAAM,OAAO;AAC1C;AAEA,eAAsB,oBAAoB,KAAgC;AACxE,QAAM,YAAYJ,MAAK,KAAK,QAAQ;AACpC,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;AAChE,UAAM,QAAkB,CAAC;AACzB,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,YAAYA,MAAK,WAAW,MAAM,MAAM,UAAU;AACxD,YAAM,SAAS,MAAM,KAAK,SAAS,EAChC,KAAK,MAAM,IAAI,EACf,MAAM,MAAM,KAAK;AACpB,UAAI,OAAQ,OAAM,KAAK,MAAM,IAAI;AAAA,IACnC;AACA,WAAO,MAAM,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA,EAChD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,qBACb,KACA,MACgC;AAChC,QAAM,kBAAkB,MAAM,oBAAoB,GAAG;AACrD,QAAM,QAAQ,MAAM,iBAAiB,GAAG;AAExC,QAAM,SAAS,oBAAI,IAAgC;AACnD,QAAM,cAAc,OAAO,UAAU,CAAC;AAEtC,aAAW,QAAQ,iBAAiB;AAClC,UAAM,YAAYA,MAAK,KAAK,UAAU,MAAM,UAAU;AACtD,UAAM,QAAQ,YAAY,IAAI;AAC9B,UAAM,mBAAmB,CAAC,CAAC,OAAO,mBAAmB,OAAO,kBAAkB,KAAK;AAEnF,QAAI,SAAS,YAAY,CAAC,kBAAkB;AAC1C;AAAA,IACF;AAEA,UAAM,oBACJ,OAAO,cACN,OAAO,YAAY,GAAG,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC,MAAM,IAAI,KAAK;AAC1E,UAAM,gBACJ,OAAO,OAAO,mBAAmB,YAAY,MAAM,iBAAiB,IAChE,MAAM,iBACN;AAEN,WAAO,IAAI,MAAM;AAAA,MACf;AAAA,MACA,OAAO,oBAAoB,IAAI;AAAA,MAC/B,MAAM,CAAC;AAAA,MACP,aACE,SAAS,WACL,WACA,mBACE,SACA;AAAA,MACR,QAAQ,oBAAoB,WAAW;AAAA,MACvC,MAAM,OAAO,eAAe;AAAA,MAC5B,SAAS,gBAAgB,IAAI,aAAa,KAAK;AAAA,MAC/C;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,eAAe,OAAO,iBAAiB;AAAA,MACvC,WAAW;AAAA,MACX;AAAA,MACA,WAAW,OAAO,gBAAgB,OAAO,cAAc;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,UAAU;AACrB,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACvD,YAAM,mBACJ,CAAC,CAAC,MAAM,mBAAmB,MAAM,kBAAkB,KAAK;AAC1D,UAAI,CAAC,oBAAoB,OAAO,IAAI,IAAI,EAAG;AAE3C,YAAM,YAAY,MAAM,aAAaA,MAAK,KAAK,UAAU,MAAM,UAAU;AACzE,YAAM,YACJ,MAAM,cACL,OAAO,YAAY,GAAG,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC,MAAM,IAAI,KAAK;AAC1E,YAAM,gBAAgB,MAAM,iBAAiB,IAAI,MAAM,iBAAiB;AAExE,aAAO,IAAI,MAAM;AAAA,QACf;AAAA,QACA,OAAO,oBAAoB,IAAI;AAAA,QAC/B,MAAM,CAAC;AAAA,QACP,aAAa;AAAA,QACb,QAAQ,YAAY,WAAW;AAAA,QAC/B,MAAM,MAAM,eAAe;AAAA,QAC3B,SAAS,gBAAgB,IAAI,aAAa,KAAK;AAAA,QAC/C;AAAA,QACA,gBAAgB,MAAM,kBAAkB;AAAA,QACxC,eAAe,MAAM,iBAAiB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,WAAW,MAAM,gBAAgB,OAAO,cAAc;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,aAAa;AAAA,IACb,WAAW,OAAO,aAAa;AAAA,IAC/B;AAAA,IACA,QAAQ,MAAM,KAAK,OAAO,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,EACjF;AACF;AAEA,eAAsB,2BAA2B,QAI/B;AAChB,QAAM,WAAW,MAAM,qBAAqB,OAAO,KAAK,OAAO,IAAI;AACnE,QAAMI;AAAA,IACJJ,MAAK,OAAO,YAAY,sBAAsB;AAAA,IAC9C,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AAAA,IACpC;AAAA,EACF;AACF;AAEA,eAAsB,mBACpB,KACA,UAAqC,CAAC,GACf;AACvB,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,aAAaA,MAAK,KAAK,cAAc,WAAW;AACtD,QAAM,YAAYA,MAAK,YAAY,UAAU;AAC7C,QAAM,uBAAuBA,MAAK,YAAY,iBAAiB;AAC/D,QAAM,qBAAqBA,MAAK,YAAY,oBAAoB;AAEhE,QAAM,WAAW,MAAM,uBAAuB;AAC9C,QAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACrD,QAAMK,OAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAE3C,QAAM,GAAG,SAAS,mBAAmB,WAAW,EAAE,WAAW,KAAK,CAAC;AACnE,QAAM,GAAG,SAAS,iBAAiB,oBAAoB;AACvD,QAAM,kBAAkB,SAAS;AACjC,QAAM,2BAA2B,EAAE,KAAK,YAAY,KAAK,CAAC;AAC1D,QAAM,WAAW,MAAM,2BAA2B,EAAE,KAAK,WAAW,CAAC;AAErE,QAAM,cAAc,MAAM,mBAAmB,GAAG;AAChD,QAAM,aAAa,gBAAgB,aAAa,GAAG;AACnD,QAAM,kBAAkB,oBAAI,IAAY;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI;AACF,UAAM,WAAW,MAAM,0BAA0B,GAAG;AACpD,oBAAgB,IAAI,6BAA6B,QAAQ,CAAC;AAAA,EAC5D,QAAQ;AAAA,EAER;AAEA,QAAM,uBAAuB,gCAAgC,SAAS,cAAc;AACpF,aAAW,eAAe,sBAAsB;AAC9C,oBAAgB,IAAI,YAAY,MAAM;AAAA,EACxC;AAEA,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA,CAAC,GAAG,eAAe,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA,EACxD;AACA,QAAMD;AAAA,IACJ;AAAA,IACA,GAAG,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC;AAAA;AAAA,IAC1C;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["readFile","writeFile","join","access","mkdir","readFile","writeFile","join","resolve","readFile","join","parseEnv","createJiti","access","constants","join","writeFile","join","writeFile","join","join","readFile","resolve","access","writeFile","mkdir"]}

package/dist/{deploy-ABYREUMX.js → deploy-IKLEF4GU.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   runInitialDeploy
-} from "./chunk-6WQW3UVW.js";
+} from "./chunk-YG64BYWB.js";
 import "./chunk-TNKYKA7N.js";
-import "./chunk-WMQSBT64.js";
+import "./chunk-YMEEYCMI.js";
 import {
   requireAuth
 } from "./chunk-5RODADXW.js";
@@ -44,12 +44,15 @@ var deploy_default = defineCommand({
         );
       }
       const preferredStudioBase = result.customDomains.length > 0 ? `https://${result.customDomains[0]}` : result.workerUrl;
-      if (result.credentialsChanged) {
+      if (result.credentialsChanged || result.serviceKeyChanged) {
         p.note(
           [
             `${pc.bold("Studio credentials")}`,
             `${pc.dim("Username:")} ${pc.cyan(result.studioAdminUser)}`,
             `${pc.dim("Password:")} ${pc.cyan(result.studioPassword)}`,
+            "",
+            `${pc.bold("Service key")}`,
+            `${pc.dim("Authorization:")} ${pc.cyan(`Bearer ${result.serviceKey}`)}`,
             `${pc.dim("Studio:")} ${pc.cyan(`${preferredStudioBase.replace(/\/$/, "")}/studio/login`)}`
           ].join("\n"),
           "Admin access"
@@ -57,7 +60,7 @@ var deploy_default = defineCommand({
       } else {
         p.log.info(
           pc.dim(
-            "Studio credentials unchanged. Check your local .env if you need to recover them."
+            "Credentials unchanged. Check your local .env if you need to recover them."
           )
         );
       }
@@ -74,4 +77,4 @@ var deploy_default = defineCommand({
 export {
   deploy_default as default
 };
-//# sourceMappingURL=deploy-ABYREUMX.js.map
+//# sourceMappingURL=deploy-IKLEF4GU.js.map

package/dist/deploy-IKLEF4GU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/deploy.ts"],"sourcesContent":["import { defineCommand } from \"citty\";\nimport * as p from \"@clack/prompts\";\nimport pc from \"picocolors\";\nimport { requireAuth } from \"@/utils/auth\";\nimport { runInitialDeploy } from \"@/utils/deploy\";\n\nconst LOGO = \"🦋\";\n\nexport default defineCommand({\n  meta: { name: \"deploy\", description: \"Deploy your agents runtime\" },\n  async run() {\n    const cwd = process.cwd();\n\n    p.intro(`${LOGO} ${pc.bold(\"kalp deploy\")}`);\n\n    await requireAuth().catch(() => {\n      p.log.error(\"Not authenticated. Run `kalp login` first.\");\n      process.exit(1);\n    });\n\n    const proceed = await p.confirm({\n      message: \"Deploy your runtime now?\",\n      initialValue: true,\n    });\n    if (p.isCancel(proceed) || !proceed) {\n      p.outro(\"Cancelled\");\n      return;\n    }\n\n    const s = p.spinner();\n    s.start(\"Deploying your agents runtime\");\n\n    try {\n      const result = await runInitialDeploy(cwd);\n      s.stop(\"Deployment completed\");\n      p.log.success(`Runtime URL: ${pc.cyan(result.workerUrl)}`);\n      if (result.customDomains.length > 0) {\n        p.note(\n          result.customDomains.map((domain) => pc.cyan(`https://${domain}`)).join(\"\\n\"),\n          \"Custom domains detected\",\n        );\n      }\n\n      const preferredStudioBase =\n        result.customDomains.length > 0\n          ? `https://${result.customDomains[0]}`\n          : result.workerUrl;\n\n      if (result.credentialsChanged || result.serviceKeyChanged) {\n        p.note(\n          [\n            `${pc.bold(\"Studio credentials\")}`,\n            `${pc.dim(\"Username:\")} ${pc.cyan(result.studioAdminUser)}`,\n            `${pc.dim(\"Password:\")} ${pc.cyan(result.studioPassword)}`,\n            \"\",\n            `${pc.bold(\"Service key\")}`,\n            `${pc.dim(\"Authorization:\")} ${pc.cyan(`Bearer ${result.serviceKey}`)}`,\n            `${pc.dim(\"Studio:\")} ${pc.cyan(`${preferredStudioBase.replace(/\\/$/, \"\")}/studio/login`)}`,\n          ].join(\"\\n\"),\n          \"Admin access\",\n        );\n      } else {\n        p.log.info(\n          pc.dim(\n            \"Credentials unchanged. Check your local .env if you need to recover them.\",\n          ),\n        );\n      }\n      p.outro(pc.green(\"Your runtime is ready\"));\n    } catch (error) {\n      s.stop(\"Deployment failed\");\n      p.log.error(\n        error instanceof Error ? error.message : \"Unknown deployment error\",\n      );\n      process.exit(1);\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,YAAY,OAAO;AACnB,OAAO,QAAQ;AAIf,IAAM,OAAO;AAEb,IAAO,iBAAQ,cAAc;AAAA,EAC3B,MAAM,EAAE,MAAM,UAAU,aAAa,6BAA6B;AAAA,EAClE,MAAM,MAAM;AACV,UAAM,MAAM,QAAQ,IAAI;AAExB,IAAE,QAAM,GAAG,IAAI,IAAI,GAAG,KAAK,aAAa,CAAC,EAAE;AAE3C,UAAM,YAAY,EAAE,MAAM,MAAM;AAC9B,MAAE,MAAI,MAAM,4CAA4C;AACxD,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAED,UAAM,UAAU,MAAQ,UAAQ;AAAA,MAC9B,SAAS;AAAA,MACT,cAAc;AAAA,IAChB,CAAC;AACD,QAAM,WAAS,OAAO,KAAK,CAAC,SAAS;AACnC,MAAE,QAAM,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,IAAM,UAAQ;AACpB,MAAE,MAAM,+BAA+B;AAEvC,QAAI;AACF,YAAM,SAAS,MAAM,iBAAiB,GAAG;AACzC,QAAE,KAAK,sBAAsB;AAC7B,MAAE,MAAI,QAAQ,gBAAgB,GAAG,KAAK,OAAO,SAAS,CAAC,EAAE;AACzD,UAAI,OAAO,cAAc,SAAS,GAAG;AACnC,QAAE;AAAA,UACA,OAAO,cAAc,IAAI,CAAC,WAAW,GAAG,KAAK,WAAW,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI;AAAA,UAC5E;AAAA,QACF;AAAA,MACF;AAEA,YAAM,sBACJ,OAAO,cAAc,SAAS,IAC1B,WAAW,OAAO,cAAc,CAAC,CAAC,KAClC,OAAO;AAEb,UAAI,OAAO,sBAAsB,OAAO,mBAAmB;AACzD,QAAE;AAAA,UACA;AAAA,YACE,GAAG,GAAG,KAAK,oBAAoB,CAAC;AAAA,YAChC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,KAAK,OAAO,eAAe,CAAC;AAAA,YACzD,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,KAAK,OAAO,cAAc,CAAC;AAAA,YACxD;AAAA,YACA,GAAG,GAAG,KAAK,aAAa,CAAC;AAAA,YACzB,GAAG,GAAG,IAAI,gBAAgB,CAAC,IAAI,GAAG,KAAK,UAAU,OAAO,UAAU,EAAE,CAAC;AAAA,YACrE,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,GAAG,KAAK,GAAG,oBAAoB,QAAQ,OAAO,EAAE,CAAC,eAAe,CAAC;AAAA,UAC3F,EAAE,KAAK,IAAI;AAAA,UACX;AAAA,QACF;AAAA,MACF,OAAO;AACL,QAAE,MAAI;AAAA,UACJ,GAAG;AAAA,YACD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,MAAE,QAAM,GAAG,MAAM,uBAAuB,CAAC;AAAA,IAC3C,SAAS,OAAO;AACd,QAAE,KAAK,mBAAmB;AAC1B,MAAE,MAAI;AAAA,QACJ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAC3C;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF,CAAC;","names":[]}

package/dist/{dev-Q3UX3HY2.js → dev-7T5MQVJD.js}

@@ -9,7 +9,7 @@ import {
   materializeRuntime,
   readLocalAgentNames,
   writeRuntimeAgentsSnapshot
-} from "./chunk-WMQSBT64.js";
+} from "./chunk-YMEEYCMI.js";
 
 // src/commands/dev.ts
 import { watch } from "fs";
@@ -233,4 +233,4 @@ KALP_RUNTIME_MODE=local
 export {
   dev_default as default
 };
-//# sourceMappingURL=dev-Q3UX3HY2.js.map
+//# sourceMappingURL=dev-7T5MQVJD.js.map

package/dist/index.js

@@ -8,7 +8,7 @@ import pc from "picocolors";
 // package.json
 var package_default = {
   name: "@kalphq/cli",
-  version: "0.0.0-dev-20260512203604",
+  version: "0.0.0-dev-20260513001041",
   description: "Zero-config CLI for deploying Kalp agents",
   type: "module",
   license: "MIT",
@@ -93,13 +93,13 @@ var main = defineCommand({
   },
   subCommands: {
     create: () => import("./create-XC55BUCS.js").then((r) => r.default),
-    deploy: () => import("./deploy-ABYREUMX.js").then((r) => r.default),
-    push: () => import("./push-EXOBRO5V.js").then((r) => r.default),
+    deploy: () => import("./deploy-IKLEF4GU.js").then((r) => r.default),
+    push: () => import("./push-3ZLFVIPP.js").then((r) => r.default),
     link: () => import("./link-WZQSR2TM.js").then((r) => r.default),
     secrets: () => import("./secrets-P7ADVLOS.js").then((r) => r.default),
     login: () => import("./login-DGX55YZ6.js").then((r) => r.default),
     logout: () => import("./logout-U5V5K775.js").then((r) => r.default),
-    dev: () => import("./dev-Q3UX3HY2.js").then((r) => r.default)
+    dev: () => import("./dev-7T5MQVJD.js").then((r) => r.default)
   },
   run({ args }) {
     const firstArg = process.argv[2];

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../package.json"],"sourcesContent":["import { defineCommand, runMain } from \"citty\";\nimport * as p from \"@clack/prompts\";\nimport pc from \"picocolors\";\nimport pkg from \"../package.json\";\n\nconst LOGO = \"🦋\";\n\nconst COMMANDS = [\n  [\"create\", \"Add a new agent\"],\n  [\"deploy\", \"Deploy your agents runtime\"],\n  [\"push\", \"Publish agent runtime version\"],\n  [\"link\", \"Link project to Kalp cloud\"],\n  [\"secrets\", \"Manage secrets\"],\n  [\"login\", \"Sign in to remote runtime\"],\n  [\"logout\", \"Sign out from Kalp\"],\n  [\"dev\", \"Run Worker + Studio locally\"],\n] as const;\n\nfunction printHelp(): void {\n  p.log.info(`${pc.bold(\"Usage\")}: kalp <command> [options]`);\n  console.log(\"\");\n  p.log.info(pc.bold(\"Commands\"));\n\n  for (const [name, desc] of COMMANDS) {\n    console.log(`  ${pc.cyan(name.padEnd(10))}${desc}`);\n  }\n\n  console.log(\"\");\n  p.log.info(`Run ${pc.cyan(\"kalp <command> --help\")} for more info.`);\n}\n\nconst main = defineCommand({\n  meta: {\n    name: \"kalp\",\n    version: pkg.version,\n    description: \"🦋 Zero-config agent infrastructure\",\n  },\n  args: {\n    help: {\n      type: \"boolean\",\n      alias: \"h\",\n      description: \"Show help\",\n      default: false,\n    },\n  },\n  subCommands: {\n    create: () => import(\"./commands/create\").then((r) => r.default),\n    deploy: () => import(\"./commands/deploy\").then((r) => r.default),\n    push: () => import(\"./commands/push\").then((r) => r.default),\n    link: () => import(\"./commands/link\").then((r) => r.default),\n    secrets: () => import(\"./commands/secrets\").then((r) => r.default),\n    login: () => import(\"./commands/login\").then((r) => r.default),\n    logout: () => import(\"./commands/logout\").then((r) => r.default),\n    dev: () => import(\"./commands/dev\").then((r) => r.default),\n  },\n  run({ args }) {\n    const firstArg = process.argv[2];\n\n    if (args.help) {\n      p.intro(`${LOGO} ${pc.bold(\"kalp\")}`);\n      printHelp();\n      p.outro(\"Happy coding 🦋\");\n      return;\n    }\n\n    if (firstArg) {\n      return;\n    }\n\n    p.intro(`${LOGO} ${pc.bold(\"kalp\")}`);\n    printHelp();\n    p.outro(\"Happy coding 🦋\");\n  },\n});\n\nrunMain(main);\n","{\n  \"name\": \"@kalphq/cli\",\n  \"version\": \"0.0.0-dev-20260512203604\",\n  \"description\": \"Zero-config CLI for deploying Kalp agents\",\n  \"type\": \"module\",\n  \"license\": \"MIT\",\n  \"author\": \"Kalp HQ\",\n  \"bin\": {\n    \"kalp\": \"./dist/index.js\"\n  },\n  \"main\": \"./dist/index.js\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"publishConfig\": {\n    \"access\": \"public\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup && pnpm run build:studio && pnpm run build:runtime-template\",\n    \"build:studio\": \"pnpm --filter=@kalphq/studio build\",\n    \"build:runtime-template\": \"node ./scripts/prepare-runtime-template.mjs\",\n    \"dev\": \"tsup --watch\",\n    \"lint\": \"tsc --noEmit\",\n    \"prepublishOnly\": \"pnpm build\"\n  },\n  \"dependencies\": {\n    \"@antfu/ni\": \"24.4.0\",\n    \"@clack/prompts\": \"0.9.1\",\n    \"@kalphq/compiler\": \"workspace:*\",\n    \"@kalphq/project\": \"workspace:*\",\n    \"@kalphq/sdk\": \"workspace:*\",\n    \"citty\": \"0.1.6\",\n    \"esbuild\": \"0.25.0\",\n    \"execa\": \"^9.6.1\",\n    \"jiti\": \"^2.6.1\",\n    \"jose\": \"^5.10.0\",\n    \"json-stable-stringify\": \"1.3.0\",\n    \"open\": \"^11.0.0\",\n    \"picocolors\": \"1.1.1\",\n    \"zod\": \"3.25.76\"\n  },\n  \"devDependencies\": {\n    \"@types/json-stable-stringify\": \"1.2.0\",\n    \"@types/node\": \"^22.15.3\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.0.0\"\n  }\n}\n"],"mappings":";;;AAAA,SAAS,eAAe,eAAe;AACvC,YAAY,OAAO;AACnB,OAAO,QAAQ;;;ACFf;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,QAAU;AAAA,EACV,KAAO;AAAA,IACL,MAAQ;AAAA,EACV;AAAA,EACA,MAAQ;AAAA,EACR,OAAS;AAAA,IACP;AAAA,EACF;AAAA,EACA,eAAiB;AAAA,IACf,QAAU;AAAA,EACZ;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,IAC1B,KAAO;AAAA,IACP,MAAQ;AAAA,IACR,gBAAkB;AAAA,EACpB;AAAA,EACA,cAAgB;AAAA,IACd,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,oBAAoB;AAAA,IACpB,mBAAmB;AAAA,IACnB,eAAe;AAAA,IACf,OAAS;AAAA,IACT,SAAW;AAAA,IACX,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,MAAQ;AAAA,IACR,yBAAyB;AAAA,IACzB,MAAQ;AAAA,IACR,YAAc;AAAA,IACd,KAAO;AAAA,EACT;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AACF;;;AD1CA,IAAM,OAAO;AAEb,IAAM,WAAW;AAAA,EACf,CAAC,UAAU,iBAAiB;AAAA,EAC5B,CAAC,UAAU,4BAA4B;AAAA,EACvC,CAAC,QAAQ,+BAA+B;AAAA,EACxC,CAAC,QAAQ,4BAA4B;AAAA,EACrC,CAAC,WAAW,gBAAgB;AAAA,EAC5B,CAAC,SAAS,2BAA2B;AAAA,EACrC,CAAC,UAAU,oBAAoB;AAAA,EAC/B,CAAC,OAAO,6BAA6B;AACvC;AAEA,SAAS,YAAkB;AACzB,EAAE,MAAI,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,4BAA4B;AAC1D,UAAQ,IAAI,EAAE;AACd,EAAE,MAAI,KAAK,GAAG,KAAK,UAAU,CAAC;AAE9B,aAAW,CAAC,MAAM,IAAI,KAAK,UAAU;AACnC,YAAQ,IAAI,KAAK,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;AAAA,EACpD;AAEA,UAAQ,IAAI,EAAE;AACd,EAAE,MAAI,KAAK,OAAO,GAAG,KAAK,uBAAuB,CAAC,iBAAiB;AACrE;AAEA,IAAM,OAAO,cAAc;AAAA,EACzB,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,SAAS,gBAAI;AAAA,IACb,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,MACb,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ,MAAM,OAAO,sBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC/D,QAAQ,MAAM,OAAO,sBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC/D,MAAM,MAAM,OAAO,oBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC3D,MAAM,MAAM,OAAO,oBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC3D,SAAS,MAAM,OAAO,uBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IACjE,OAAO,MAAM,OAAO,qBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC7D,QAAQ,MAAM,OAAO,sBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC/D,KAAK,MAAM,OAAO,mBAAgB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,EAC3D;AAAA,EACA,IAAI,EAAE,KAAK,GAAG;AACZ,UAAM,WAAW,QAAQ,KAAK,CAAC;AAE/B,QAAI,KAAK,MAAM;AACb,MAAE,QAAM,GAAG,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE;AACpC,gBAAU;AACV,MAAE,QAAM,wBAAiB;AACzB;AAAA,IACF;AAEA,QAAI,UAAU;AACZ;AAAA,IACF;AAEA,IAAE,QAAM,GAAG,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE;AACpC,cAAU;AACV,IAAE,QAAM,wBAAiB;AAAA,EAC3B;AACF,CAAC;AAED,QAAQ,IAAI;","names":[]}
+{"version":3,"sources":["../src/index.ts","../package.json"],"sourcesContent":["import { defineCommand, runMain } from \"citty\";\nimport * as p from \"@clack/prompts\";\nimport pc from \"picocolors\";\nimport pkg from \"../package.json\";\n\nconst LOGO = \"🦋\";\n\nconst COMMANDS = [\n  [\"create\", \"Add a new agent\"],\n  [\"deploy\", \"Deploy your agents runtime\"],\n  [\"push\", \"Publish agent runtime version\"],\n  [\"link\", \"Link project to Kalp cloud\"],\n  [\"secrets\", \"Manage secrets\"],\n  [\"login\", \"Sign in to remote runtime\"],\n  [\"logout\", \"Sign out from Kalp\"],\n  [\"dev\", \"Run Worker + Studio locally\"],\n] as const;\n\nfunction printHelp(): void {\n  p.log.info(`${pc.bold(\"Usage\")}: kalp <command> [options]`);\n  console.log(\"\");\n  p.log.info(pc.bold(\"Commands\"));\n\n  for (const [name, desc] of COMMANDS) {\n    console.log(`  ${pc.cyan(name.padEnd(10))}${desc}`);\n  }\n\n  console.log(\"\");\n  p.log.info(`Run ${pc.cyan(\"kalp <command> --help\")} for more info.`);\n}\n\nconst main = defineCommand({\n  meta: {\n    name: \"kalp\",\n    version: pkg.version,\n    description: \"🦋 Zero-config agent infrastructure\",\n  },\n  args: {\n    help: {\n      type: \"boolean\",\n      alias: \"h\",\n      description: \"Show help\",\n      default: false,\n    },\n  },\n  subCommands: {\n    create: () => import(\"./commands/create\").then((r) => r.default),\n    deploy: () => import(\"./commands/deploy\").then((r) => r.default),\n    push: () => import(\"./commands/push\").then((r) => r.default),\n    link: () => import(\"./commands/link\").then((r) => r.default),\n    secrets: () => import(\"./commands/secrets\").then((r) => r.default),\n    login: () => import(\"./commands/login\").then((r) => r.default),\n    logout: () => import(\"./commands/logout\").then((r) => r.default),\n    dev: () => import(\"./commands/dev\").then((r) => r.default),\n  },\n  run({ args }) {\n    const firstArg = process.argv[2];\n\n    if (args.help) {\n      p.intro(`${LOGO} ${pc.bold(\"kalp\")}`);\n      printHelp();\n      p.outro(\"Happy coding 🦋\");\n      return;\n    }\n\n    if (firstArg) {\n      return;\n    }\n\n    p.intro(`${LOGO} ${pc.bold(\"kalp\")}`);\n    printHelp();\n    p.outro(\"Happy coding 🦋\");\n  },\n});\n\nrunMain(main);\n","{\n  \"name\": \"@kalphq/cli\",\n  \"version\": \"0.0.0-dev-20260513001041\",\n  \"description\": \"Zero-config CLI for deploying Kalp agents\",\n  \"type\": \"module\",\n  \"license\": \"MIT\",\n  \"author\": \"Kalp HQ\",\n  \"bin\": {\n    \"kalp\": \"./dist/index.js\"\n  },\n  \"main\": \"./dist/index.js\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"publishConfig\": {\n    \"access\": \"public\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup && pnpm run build:studio && pnpm run build:runtime-template\",\n    \"build:studio\": \"pnpm --filter=@kalphq/studio build\",\n    \"build:runtime-template\": \"node ./scripts/prepare-runtime-template.mjs\",\n    \"dev\": \"tsup --watch\",\n    \"lint\": \"tsc --noEmit\",\n    \"prepublishOnly\": \"pnpm build\"\n  },\n  \"dependencies\": {\n    \"@antfu/ni\": \"24.4.0\",\n    \"@clack/prompts\": \"0.9.1\",\n    \"@kalphq/compiler\": \"workspace:*\",\n    \"@kalphq/project\": \"workspace:*\",\n    \"@kalphq/sdk\": \"workspace:*\",\n    \"citty\": \"0.1.6\",\n    \"esbuild\": \"0.25.0\",\n    \"execa\": \"^9.6.1\",\n    \"jiti\": \"^2.6.1\",\n    \"jose\": \"^5.10.0\",\n    \"json-stable-stringify\": \"1.3.0\",\n    \"open\": \"^11.0.0\",\n    \"picocolors\": \"1.1.1\",\n    \"zod\": \"3.25.76\"\n  },\n  \"devDependencies\": {\n    \"@types/json-stable-stringify\": \"1.2.0\",\n    \"@types/node\": \"^22.15.3\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.0.0\"\n  }\n}\n"],"mappings":";;;AAAA,SAAS,eAAe,eAAe;AACvC,YAAY,OAAO;AACnB,OAAO,QAAQ;;;ACFf;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,QAAU;AAAA,EACV,KAAO;AAAA,IACL,MAAQ;AAAA,EACV;AAAA,EACA,MAAQ;AAAA,EACR,OAAS;AAAA,IACP;AAAA,EACF;AAAA,EACA,eAAiB;AAAA,IACf,QAAU;AAAA,EACZ;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,IAC1B,KAAO;AAAA,IACP,MAAQ;AAAA,IACR,gBAAkB;AAAA,EACpB;AAAA,EACA,cAAgB;AAAA,IACd,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,oBAAoB;AAAA,IACpB,mBAAmB;AAAA,IACnB,eAAe;AAAA,IACf,OAAS;AAAA,IACT,SAAW;AAAA,IACX,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,MAAQ;AAAA,IACR,yBAAyB;AAAA,IACzB,MAAQ;AAAA,IACR,YAAc;AAAA,IACd,KAAO;AAAA,EACT;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AACF;;;AD1CA,IAAM,OAAO;AAEb,IAAM,WAAW;AAAA,EACf,CAAC,UAAU,iBAAiB;AAAA,EAC5B,CAAC,UAAU,4BAA4B;AAAA,EACvC,CAAC,QAAQ,+BAA+B;AAAA,EACxC,CAAC,QAAQ,4BAA4B;AAAA,EACrC,CAAC,WAAW,gBAAgB;AAAA,EAC5B,CAAC,SAAS,2BAA2B;AAAA,EACrC,CAAC,UAAU,oBAAoB;AAAA,EAC/B,CAAC,OAAO,6BAA6B;AACvC;AAEA,SAAS,YAAkB;AACzB,EAAE,MAAI,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,4BAA4B;AAC1D,UAAQ,IAAI,EAAE;AACd,EAAE,MAAI,KAAK,GAAG,KAAK,UAAU,CAAC;AAE9B,aAAW,CAAC,MAAM,IAAI,KAAK,UAAU;AACnC,YAAQ,IAAI,KAAK,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;AAAA,EACpD;AAEA,UAAQ,IAAI,EAAE;AACd,EAAE,MAAI,KAAK,OAAO,GAAG,KAAK,uBAAuB,CAAC,iBAAiB;AACrE;AAEA,IAAM,OAAO,cAAc;AAAA,EACzB,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,SAAS,gBAAI;AAAA,IACb,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,MACb,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ,MAAM,OAAO,sBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC/D,QAAQ,MAAM,OAAO,sBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC/D,MAAM,MAAM,OAAO,oBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC3D,MAAM,MAAM,OAAO,oBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC3D,SAAS,MAAM,OAAO,uBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IACjE,OAAO,MAAM,OAAO,qBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC7D,QAAQ,MAAM,OAAO,sBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,IAC/D,KAAK,MAAM,OAAO,mBAAgB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;AAAA,EAC3D;AAAA,EACA,IAAI,EAAE,KAAK,GAAG;AACZ,UAAM,WAAW,QAAQ,KAAK,CAAC;AAE/B,QAAI,KAAK,MAAM;AACb,MAAE,QAAM,GAAG,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE;AACpC,gBAAU;AACV,MAAE,QAAM,wBAAiB;AACzB;AAAA,IACF;AAEA,QAAI,UAAU;AACZ;AAAA,IACF;AAEA,IAAE,QAAM,GAAG,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE;AACpC,cAAU;AACV,IAAE,QAAM,wBAAiB;AAAA,EAC3B;AACF,CAAC;AAED,QAAQ,IAAI;","names":[]}

package/dist/{push-EXOBRO5V.js → push-3ZLFVIPP.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-INB3LG6O.js";
 import {
   runInitialDeploy
-} from "./chunk-6WQW3UVW.js";
+} from "./chunk-YG64BYWB.js";
 import {
   resolveProvider
 } from "./chunk-TNKYKA7N.js";
@@ -18,7 +18,7 @@ import {
   readLocalAgentNames,
   readProjectState,
   writeProjectState
-} from "./chunk-WMQSBT64.js";
+} from "./chunk-YMEEYCMI.js";
 import {
   requireAuth
 } from "./chunk-5RODADXW.js";
@@ -56,6 +56,7 @@ function createInitialState() {
     deployedAt: null,
     accountId: null,
     studioCredentialsFingerprint: null,
+    serviceKeyFingerprint: null,
     agents: {}
   };
 }
@@ -372,4 +373,4 @@ var push_default = defineCommand({
 export {
   push_default as default
 };
-//# sourceMappingURL=push-EXOBRO5V.js.map
+//# sourceMappingURL=push-3ZLFVIPP.js.map

package/dist/push-3ZLFVIPP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/push.ts","../src/utils/ir/export.ts"],"sourcesContent":["import { access, mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { defineCommand } from \"citty\";\nimport * as p from \"@clack/prompts\";\nimport pc from \"picocolors\";\nimport { ensureConfig } from \"@/utils/fs\";\nimport { readAgentManifest, computePushHash } from \"@/utils/manifest\";\nimport { requireAuth } from \"@/utils/auth\";\nimport { runInitialDeploy } from \"@/utils/deploy\";\nimport {\n  type ProjectAgentState,\n  type ProjectState,\n  readProjectState,\n  writeProjectState,\n} from \"@/utils/project-state\";\nimport { validateCompiledIR } from \"@/utils/validate\";\nimport { materializeRuntime, readLocalAgentNames } from \"@/utils/runtime\";\nimport { resolveProvider } from \"@/utils/providers\";\nimport { exportCompiledIrForDebug } from \"@/utils/ir/export\";\n\nconst LOGO = \"🦋\";\n\nfunction formatBytes(bytes: number): string {\n  if (bytes < 1024) return `${bytes} B`;\n  return `${(bytes / 1024).toFixed(1)} KB`;\n}\n\nfunction createInitialState(): ProjectState {\n  return {\n    workerUrl: null,\n    deployedAt: null,\n    accountId: null,\n    studioCredentialsFingerprint: null,\n    serviceKeyFingerprint: null,\n    agents: {},\n  };\n}\n\nfunction ensureAgentState(\n  state: ProjectState,\n  agentName: string,\n  localPath: string,\n): ProjectAgentState {\n  const existing = state.agents[agentName];\n  if (existing) {\n    existing.localPath = localPath;\n    return existing;\n  }\n\n  const created: ProjectAgentState = {\n    currentHash: null,\n    currentVersion: 0,\n    lastLocalHash: null,\n    lastRemoteHash: null,\n    lastPushedAt: null,\n    localPath,\n    workerUrl:\n      state.workerUrl ? `${state.workerUrl.replace(/\\/$/, \"\")}/a/${agentName}` : null,\n  };\n  state.agents[agentName] = created;\n  return created;\n}\n\ntype PushTarget = \"local\" | \"remote\";\n\ninterface PushResult {\n  pushed: number;\n  skipped: number;\n  failed: number;\n}\n\ninterface RemoteAgentIndexEntry {\n  name: string;\n  hash: string;\n  version: string | null;\n  versionNumber: number | null;\n  updatedAt: string;\n  workerUrl: string | null;\n  label?: string;\n  tags?: string[];\n}\n\ninterface PruneResult {\n  removedAgents: string[];\n  deletedKeys: number;\n}\n\nasync function readRemoteAgentsIndex(\n  cwd: string,\n  wranglerConfigPath: string,\n): Promise<RemoteAgentIndexEntry[]> {\n  const provider = resolveProvider();\n  const output = await provider\n    .getValue({\n      cwd,\n      configPath: wranglerConfigPath,\n      key: \"agents:index\",\n    })\n    .catch(() => null);\n  if (!output) return [];\n  try {\n    const parsed = JSON.parse(output) as unknown;\n    if (!Array.isArray(parsed)) return [];\n    return parsed as RemoteAgentIndexEntry[];\n  } catch {\n    return [];\n  }\n}\n\nasync function writeRemoteAgentsIndex(\n  cwd: string,\n  wranglerConfigPath: string,\n  entries: RemoteAgentIndexEntry[],\n): Promise<void> {\n  const path = join(cwd, \".kalp\", \"agents-index.json\");\n  await writeFile(path, JSON.stringify(entries, null, 2), \"utf-8\");\n  const provider = resolveProvider();\n  try {\n    await provider.putManifest({\n      cwd,\n      configPath: wranglerConfigPath,\n      key: \"agents:index\",\n      jsonPath: path,\n    });\n  } finally {\n    await rm(path, { force: true });\n  }\n}\n\nasync function pruneStaleRemoteAgents(params: {\n  cwd: string;\n  wranglerConfigPath: string;\n  remoteEntries: RemoteAgentIndexEntry[];\n  localAgentNames: string[];\n}): Promise<PruneResult> {\n  const { cwd, wranglerConfigPath, remoteEntries, localAgentNames } = params;\n  const localSet = new Set(localAgentNames);\n  const staleEntries = remoteEntries.filter((entry) => !localSet.has(entry.name));\n\n  if (staleEntries.length === 0) {\n    return { removedAgents: [], deletedKeys: 0 };\n  }\n\n  const preview = staleEntries.slice(0, 3).map((entry) => entry.name).join(\", \");\n  const suffix =\n    staleEntries.length > 3 ? ` and ${staleEntries.length - 3} more` : \"\";\n  const confirmation = await p.confirm({\n    message: `Found ${staleEntries.length} stale remote agents that no longer exist locally (e.g., ${pc.cyan(preview)}${suffix}). Do you want to prune them from the remote runtime?`,\n    initialValue: true,\n  });\n\n  if (p.isCancel(confirmation)) {\n    p.outro(\"Cancelled\");\n    process.exit(0);\n  }\n\n  if (!confirmation) {\n    return { removedAgents: [], deletedKeys: 0 };\n  }\n\n  const provider = resolveProvider();\n  let deletedKeys = 0;\n\n  for (const entry of staleEntries) {\n    const latestKey = `${entry.name}:latest`;\n    const latestHash = await provider\n      .getValue({ cwd, configPath: wranglerConfigPath, key: latestKey })\n      .catch(() => null);\n\n    const hashes = new Set<string>();\n    if (entry.hash) hashes.add(entry.hash);\n    if (latestHash) hashes.add(latestHash);\n\n    const latestDeleted = await provider\n      .deleteValue({\n        cwd,\n        configPath: wranglerConfigPath,\n        key: latestKey,\n      })\n      .then(() => true)\n      .catch(() => false);\n    if (latestDeleted) deletedKeys += 1;\n\n    for (const hash of hashes) {\n      const deleted = await provider\n        .deleteValue({\n          cwd,\n          configPath: wranglerConfigPath,\n          key: `${entry.name}:${hash}`,\n        })\n        .then(() => true)\n        .catch(() => false);\n      if (deleted) deletedKeys += 1;\n    }\n  }\n\n  const filtered = remoteEntries.filter((entry) => localSet.has(entry.name));\n  await writeRemoteAgentsIndex(cwd, wranglerConfigPath, filtered);\n\n  return {\n    removedAgents: staleEntries.map((entry) => entry.name).sort((a, b) => a.localeCompare(b)),\n    deletedKeys,\n  };\n}\n\nasync function mergeRemoteAgentIndexEntry(params: {\n  cwd: string;\n  wranglerConfigPath: string;\n  entry: RemoteAgentIndexEntry;\n}): Promise<void> {\n  const { cwd, wranglerConfigPath, entry } = params;\n  const currentIndex = await readRemoteAgentsIndex(cwd, wranglerConfigPath);\n  const merged = [\n    ...currentIndex.filter((existing) => existing.name !== entry.name),\n    entry,\n  ].sort((a, b) => a.name.localeCompare(b.name));\n\n  await writeRemoteAgentsIndex(cwd, wranglerConfigPath, merged);\n}\n\nasync function pushRemoteManifest(params: {\n  cwd: string;\n  wranglerConfigPath: string;\n  agentName: string;\n  hash: string;\n  ir: unknown;\n}): Promise<void> {\n  const { cwd, wranglerConfigPath, agentName, hash, ir } = params;\n  const manifestKey = `${agentName}:${hash}`;\n  const latestKey = `${agentName}:latest`;\n  const manifestPath = join(cwd, \".kalp\", `${agentName}-${hash}.json`);\n  await mkdir(join(cwd, \".kalp\"), { recursive: true });\n  await writeFile(manifestPath, JSON.stringify(ir), \"utf-8\");\n\n  const provider = resolveProvider();\n  try {\n    await provider.putManifest({\n      cwd,\n      configPath: wranglerConfigPath,\n      key: manifestKey,\n      jsonPath: manifestPath,\n    });\n    await provider.putValue({\n      cwd,\n      configPath: wranglerConfigPath,\n      key: latestKey,\n      value: hash,\n    });\n  } finally {\n    await rm(manifestPath, { force: true });\n  }\n}\n\nexport default defineCommand({\n  meta: { name: \"push\", description: \"Publish agent runtime version\" },\n  args: {\n    agent: {\n      type: \"string\",\n      alias: \"a\",\n      description: \"Agent name to push\",\n      required: false,\n    },\n    local: {\n      type: \"boolean\",\n      description: \"Update only local runtime snapshot and state\",\n      required: false,\n      default: false,\n    },\n  },\n  async run({ args }) {\n    const cwd = process.cwd();\n    const target: PushTarget = args.local ? \"local\" : \"remote\";\n    const isBulkPush = !args.agent;\n\n    p.intro(`${LOGO} ${pc.bold(\"kalp push\")}`);\n\n    await ensureConfig(cwd).catch(() => {\n      p.log.error(`${pc.cyan(\"kalp.config.ts\")} not found`);\n      process.exit(1);\n    });\n\n    const availableAgents = await readLocalAgentNames(cwd);\n    if (availableAgents.length === 0) {\n      p.log.error(\"No local agents found in ./agents\");\n      process.exit(1);\n    }\n\n    let selectedAgents: string[] = [];\n    if (args.agent) {\n      if (!availableAgents.includes(args.agent)) {\n        p.log.error(`Agent ${pc.cyan(args.agent)} not found`);\n        process.exit(1);\n      }\n      selectedAgents = [args.agent];\n    } else {\n      selectedAgents = availableAgents;\n    }\n\n    let state = (await readProjectState(cwd)) ?? createInitialState();\n    let runtime = await materializeRuntime(cwd, { mode: target });\n\n    if (target === \"remote\") {\n      await requireAuth().catch(() => {\n        p.log.error(\"Not authenticated. Run `kalp login` first.\");\n        process.exit(1);\n      });\n\n      if (!state.workerUrl) {\n        p.log.warn(\"No .kalp/state.json found. Running initial deploy first...\");\n        const deploy = await runInitialDeploy(cwd);\n        state = (await readProjectState(cwd)) ?? createInitialState();\n        state.workerUrl = deploy.workerUrl;\n        state.accountId = deploy.accountId;\n        state.deployedAt = new Date().toISOString();\n      }\n\n      runtime = await materializeRuntime(cwd, { mode: \"remote\" });\n\n      if (isBulkPush) {\n        const currentIndex = await readRemoteAgentsIndex(cwd, runtime.wranglerConfigPath);\n        const prune = await pruneStaleRemoteAgents({\n          cwd,\n          wranglerConfigPath: runtime.wranglerConfigPath,\n          remoteEntries: currentIndex,\n          localAgentNames: availableAgents,\n        });\n\n        if (prune.removedAgents.length > 0) {\n          p.log.info(\n            `Pruned stale remote agents: ${pc.cyan(prune.removedAgents.join(\", \"))} ${pc.dim(`(${prune.deletedKeys} keys cleaned)`)}`,\n          );\n        }\n      }\n    }\n\n    const spinner = p.spinner();\n    const result: PushResult = { pushed: 0, skipped: 0, failed: 0 };\n    const failures: string[] = [];\n\n    for (const agentName of selectedAgents) {\n      const agentPath = join(cwd, \"agents\", agentName, \"index.ts\");\n      await access(agentPath).catch(() => {\n        failures.push(`${agentName}: missing ${agentPath}`);\n      });\n\n      try {\n        spinner.start(`Compiling ${pc.cyan(agentName)}`);\n        const manifest = await readAgentManifest({ cwd, agentName });\n        const hash = computePushHash(manifest.ir);\n        const validation = validateCompiledIR({ agentName, ir: manifest.ir, hash });\n        if (!validation.ok) {\n          const details = (validation.errors ?? []).join(\" | \");\n          throw new Error(\n            `validation failed (${validation.phase})${details ? `: ${details}` : \"\"}`,\n          );\n        }\n\n        const agentState = ensureAgentState(state, agentName, agentPath);\n        const previousHash =\n          target === \"local\" ? agentState.lastLocalHash : agentState.lastRemoteHash;\n\n        if (previousHash === hash) {\n          result.skipped += 1;\n          spinner.stop(`Skipped ${pc.cyan(agentName)} (no changes)`);\n          continue;\n        }\n\n        if (target === \"remote\") {\n          spinner.message(\"Publishing runtime version\");\n          await pushRemoteManifest({\n            cwd,\n            wranglerConfigPath: runtime.wranglerConfigPath,\n            agentName,\n            hash,\n            ir: manifest.ir,\n          });\n        }\n\n        agentState.currentVersion = Math.max(0, agentState.currentVersion) + 1;\n        agentState.currentHash = hash;\n        agentState.lastPushedAt = new Date().toISOString();\n        agentState.workerUrl =\n          state.workerUrl && target === \"remote\"\n            ? `${state.workerUrl.replace(/\\/$/, \"\")}/a/${agentName}`\n            : agentState.workerUrl;\n\n        if (target === \"local\") {\n          agentState.lastLocalHash = hash;\n        } else {\n          agentState.lastRemoteHash = hash;\n          agentState.lastLocalHash = hash;\n\n          const nextEntry: RemoteAgentIndexEntry = {\n            name: agentName,\n            hash,\n            version: `v${agentState.currentVersion}`,\n            versionNumber: agentState.currentVersion,\n            updatedAt: agentState.lastPushedAt,\n            workerUrl: agentState.workerUrl,\n            label: manifest.ir.metadata?.label,\n            tags: manifest.ir.metadata?.tags,\n          };\n          await mergeRemoteAgentIndexEntry({\n            cwd,\n            wranglerConfigPath: runtime.wranglerConfigPath,\n            entry: nextEntry,\n          });\n        }\n\n        const bundles = manifest.ir.bundles || {};\n        await exportCompiledIrForDebug({\n          cwd,\n          agentName,\n          ir: manifest.ir,\n        });\n        const totalSize = Object.values(bundles).reduce(\n          (sum, bundle) => sum + Buffer.byteLength(bundle.code),\n          0,\n        );\n        const handlerCount = Object.keys(bundles).length;\n        spinner.stop(\n          `${pc.bold(agentName)} pushed ${pc.dim(`(v${agentState.currentVersion})`)} · ${handlerCount} handlers · ${formatBytes(totalSize)}`,\n        );\n        result.pushed += 1;\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        failures.push(`${agentName}: ${message}`);\n        spinner.stop(`Failed ${pc.cyan(agentName)}`);\n        result.failed += 1;\n      }\n    }\n\n    await writeProjectState(cwd, state);\n    await materializeRuntime(cwd, { mode: target });\n\n    p.note(\n      `Successfully pushed ${result.pushed} agents. ${result.skipped} omitted (no changes). ${result.failed} failed.`,\n      target === \"local\" ? \"Local push\" : \"Remote push\",\n    );\n    if (target === \"remote\" && result.pushed > 0) {\n      p.log.info(\n        pc.dim(\n          \"Changes propagating to remote Studio (eventual consistency, up to ~60s).\",\n        ),\n      );\n    }\n\n    if (failures.length > 0) {\n      for (const failure of failures) {\n        p.log.error(failure);\n      }\n      p.outro(`${LOGO} ${pc.red(\"Push completed with failures\")}`);\n      process.exit(1);\n    }\n\n    p.outro(`${LOGO} ${pc.green(\"Push complete\")}`);\n  },\n});\n","import { mkdir, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\n/**\n * TODO remove after SaaS observability: debug IR export for local inspection.\n */\nexport async function exportCompiledIrForDebug(params: {\n  cwd: string;\n  agentName: string;\n  ir: unknown;\n}): Promise<string> {\n  const { cwd, agentName, ir } = params;\n  const outDir = join(cwd, \".kalp\", \"exports\", agentName);\n  await mkdir(outDir, { recursive: true });\n  const outputPath = join(outDir, \"ir.json\");\n  await writeFile(outputPath, `${JSON.stringify(ir, null, 2)}\\n`, \"utf-8\");\n  return outputPath;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,QAAQ,SAAAA,QAAO,IAAI,aAAAC,kBAAiB;AAC7C,SAAS,QAAAC,aAAY;AACrB,SAAS,qBAAqB;AAC9B,YAAY,OAAO;AACnB,OAAO,QAAQ;;;ACJf,SAAS,OAAO,iBAAiB;AACjC,SAAS,YAAY;AAKrB,eAAsB,yBAAyB,QAI3B;AAClB,QAAM,EAAE,KAAK,WAAW,GAAG,IAAI;AAC/B,QAAM,SAAS,KAAK,KAAK,SAAS,WAAW,SAAS;AACtD,QAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,aAAa,KAAK,QAAQ,SAAS;AACzC,QAAM,UAAU,YAAY,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,CAAC;AAAA,GAAM,OAAO;AACvE,SAAO;AACT;;;ADGA,IAAM,OAAO;AAEb,SAAS,YAAY,OAAuB;AAC1C,MAAI,QAAQ,KAAM,QAAO,GAAG,KAAK;AACjC,SAAO,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC;AACrC;AAEA,SAAS,qBAAmC;AAC1C,SAAO;AAAA,IACL,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,8BAA8B;AAAA,IAC9B,uBAAuB;AAAA,IACvB,QAAQ,CAAC;AAAA,EACX;AACF;AAEA,SAAS,iBACP,OACA,WACA,WACmB;AACnB,QAAM,WAAW,MAAM,OAAO,SAAS;AACvC,MAAI,UAAU;AACZ,aAAS,YAAY;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,UAA6B;AAAA,IACjC,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,cAAc;AAAA,IACd;AAAA,IACA,WACE,MAAM,YAAY,GAAG,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC,MAAM,SAAS,KAAK;AAAA,EAC/E;AACA,QAAM,OAAO,SAAS,IAAI;AAC1B,SAAO;AACT;AA0BA,eAAe,sBACb,KACA,oBACkC;AAClC,QAAM,WAAW,gBAAgB;AACjC,QAAM,SAAS,MAAM,SAClB,SAAS;AAAA,IACR;AAAA,IACA,YAAY;AAAA,IACZ,KAAK;AAAA,EACP,CAAC,EACA,MAAM,MAAM,IAAI;AACnB,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,MAAM;AAChC,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,uBACb,KACA,oBACA,SACe;AACf,QAAM,OAAOC,MAAK,KAAK,SAAS,mBAAmB;AACnD,QAAMC,WAAU,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,GAAG,OAAO;AAC/D,QAAM,WAAW,gBAAgB;AACjC,MAAI;AACF,UAAM,SAAS,YAAY;AAAA,MACzB;AAAA,MACA,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,UAAE;AACA,UAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAEA,eAAe,uBAAuB,QAKb;AACvB,QAAM,EAAE,KAAK,oBAAoB,eAAe,gBAAgB,IAAI;AACpE,QAAM,WAAW,IAAI,IAAI,eAAe;AACxC,QAAM,eAAe,cAAc,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,MAAM,IAAI,CAAC;AAE9E,MAAI,aAAa,WAAW,GAAG;AAC7B,WAAO,EAAE,eAAe,CAAC,GAAG,aAAa,EAAE;AAAA,EAC7C;AAEA,QAAM,UAAU,aAAa,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,IAAI;AAC7E,QAAM,SACJ,aAAa,SAAS,IAAI,QAAQ,aAAa,SAAS,CAAC,UAAU;AACrE,QAAM,eAAe,MAAQ,UAAQ;AAAA,IACnC,SAAS,SAAS,aAAa,MAAM,4DAA4D,GAAG,KAAK,OAAO,CAAC,GAAG,MAAM;AAAA,IAC1H,cAAc;AAAA,EAChB,CAAC;AAED,MAAM,WAAS,YAAY,GAAG;AAC5B,IAAE,QAAM,WAAW;AACnB,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,CAAC,cAAc;AACjB,WAAO,EAAE,eAAe,CAAC,GAAG,aAAa,EAAE;AAAA,EAC7C;AAEA,QAAM,WAAW,gBAAgB;AACjC,MAAI,cAAc;AAElB,aAAW,SAAS,cAAc;AAChC,UAAM,YAAY,GAAG,MAAM,IAAI;AAC/B,UAAM,aAAa,MAAM,SACtB,SAAS,EAAE,KAAK,YAAY,oBAAoB,KAAK,UAAU,CAAC,EAChE,MAAM,MAAM,IAAI;AAEnB,UAAM,SAAS,oBAAI,IAAY;AAC/B,QAAI,MAAM,KAAM,QAAO,IAAI,MAAM,IAAI;AACrC,QAAI,WAAY,QAAO,IAAI,UAAU;AAErC,UAAM,gBAAgB,MAAM,SACzB,YAAY;AAAA,MACX;AAAA,MACA,YAAY;AAAA,MACZ,KAAK;AAAA,IACP,CAAC,EACA,KAAK,MAAM,IAAI,EACf,MAAM,MAAM,KAAK;AACpB,QAAI,cAAe,gBAAe;AAElC,eAAW,QAAQ,QAAQ;AACzB,YAAM,UAAU,MAAM,SACnB,YAAY;AAAA,QACX;AAAA,QACA,YAAY;AAAA,QACZ,KAAK,GAAG,MAAM,IAAI,IAAI,IAAI;AAAA,MAC5B,CAAC,EACA,KAAK,MAAM,IAAI,EACf,MAAM,MAAM,KAAK;AACpB,UAAI,QAAS,gBAAe;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,WAAW,cAAc,OAAO,CAAC,UAAU,SAAS,IAAI,MAAM,IAAI,CAAC;AACzE,QAAM,uBAAuB,KAAK,oBAAoB,QAAQ;AAE9D,SAAO;AAAA,IACL,eAAe,aAAa,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA,IACxF;AAAA,EACF;AACF;AAEA,eAAe,2BAA2B,QAIxB;AAChB,QAAM,EAAE,KAAK,oBAAoB,MAAM,IAAI;AAC3C,QAAM,eAAe,MAAM,sBAAsB,KAAK,kBAAkB;AACxE,QAAM,SAAS;AAAA,IACb,GAAG,aAAa,OAAO,CAAC,aAAa,SAAS,SAAS,MAAM,IAAI;AAAA,IACjE;AAAA,EACF,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAE7C,QAAM,uBAAuB,KAAK,oBAAoB,MAAM;AAC9D;AAEA,eAAe,mBAAmB,QAMhB;AAChB,QAAM,EAAE,KAAK,oBAAoB,WAAW,MAAM,GAAG,IAAI;AACzD,QAAM,cAAc,GAAG,SAAS,IAAI,IAAI;AACxC,QAAM,YAAY,GAAG,SAAS;AAC9B,QAAM,eAAeD,MAAK,KAAK,SAAS,GAAG,SAAS,IAAI,IAAI,OAAO;AACnE,QAAME,OAAMF,MAAK,KAAK,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACnD,QAAMC,WAAU,cAAc,KAAK,UAAU,EAAE,GAAG,OAAO;AAEzD,QAAM,WAAW,gBAAgB;AACjC,MAAI;AACF,UAAM,SAAS,YAAY;AAAA,MACzB;AAAA,MACA,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,SAAS,SAAS;AAAA,MACtB;AAAA,MACA,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,OAAO;AAAA,IACT,CAAC;AAAA,EACH,UAAE;AACA,UAAM,GAAG,cAAc,EAAE,OAAO,KAAK,CAAC;AAAA,EACxC;AACF;AAEA,IAAO,eAAQ,cAAc;AAAA,EAC3B,MAAM,EAAE,MAAM,QAAQ,aAAa,gCAAgC;AAAA,EACnE,MAAM;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,MAAM,IAAI,EAAE,KAAK,GAAG;AAClB,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAqB,KAAK,QAAQ,UAAU;AAClD,UAAM,aAAa,CAAC,KAAK;AAEzB,IAAE,QAAM,GAAG,IAAI,IAAI,GAAG,KAAK,WAAW,CAAC,EAAE;AAEzC,UAAM,aAAa,GAAG,EAAE,MAAM,MAAM;AAClC,MAAE,MAAI,MAAM,GAAG,GAAG,KAAK,gBAAgB,CAAC,YAAY;AACpD,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAED,UAAM,kBAAkB,MAAM,oBAAoB,GAAG;AACrD,QAAI,gBAAgB,WAAW,GAAG;AAChC,MAAE,MAAI,MAAM,mCAAmC;AAC/C,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,iBAA2B,CAAC;AAChC,QAAI,KAAK,OAAO;AACd,UAAI,CAAC,gBAAgB,SAAS,KAAK,KAAK,GAAG;AACzC,QAAE,MAAI,MAAM,SAAS,GAAG,KAAK,KAAK,KAAK,CAAC,YAAY;AACpD,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,uBAAiB,CAAC,KAAK,KAAK;AAAA,IAC9B,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,QAAI,QAAS,MAAM,iBAAiB,GAAG,KAAM,mBAAmB;AAChE,QAAI,UAAU,MAAM,mBAAmB,KAAK,EAAE,MAAM,OAAO,CAAC;AAE5D,QAAI,WAAW,UAAU;AACvB,YAAM,YAAY,EAAE,MAAM,MAAM;AAC9B,QAAE,MAAI,MAAM,4CAA4C;AACxD,gBAAQ,KAAK,CAAC;AAAA,MAChB,CAAC;AAED,UAAI,CAAC,MAAM,WAAW;AACpB,QAAE,MAAI,KAAK,4DAA4D;AACvE,cAAM,SAAS,MAAM,iBAAiB,GAAG;AACzC,gBAAS,MAAM,iBAAiB,GAAG,KAAM,mBAAmB;AAC5D,cAAM,YAAY,OAAO;AACzB,cAAM,YAAY,OAAO;AACzB,cAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5C;AAEA,gBAAU,MAAM,mBAAmB,KAAK,EAAE,MAAM,SAAS,CAAC;AAE1D,UAAI,YAAY;AACd,cAAM,eAAe,MAAM,sBAAsB,KAAK,QAAQ,kBAAkB;AAChF,cAAM,QAAQ,MAAM,uBAAuB;AAAA,UACzC;AAAA,UACA,oBAAoB,QAAQ;AAAA,UAC5B,eAAe;AAAA,UACf,iBAAiB;AAAA,QACnB,CAAC;AAED,YAAI,MAAM,cAAc,SAAS,GAAG;AAClC,UAAE,MAAI;AAAA,YACJ,+BAA+B,GAAG,KAAK,MAAM,cAAc,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,IAAI,MAAM,WAAW,gBAAgB,CAAC;AAAA,UACzH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAME,WAAY,UAAQ;AAC1B,UAAM,SAAqB,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EAAE;AAC9D,UAAM,WAAqB,CAAC;AAE5B,eAAW,aAAa,gBAAgB;AACtC,YAAM,YAAYH,MAAK,KAAK,UAAU,WAAW,UAAU;AAC3D,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM;AAClC,iBAAS,KAAK,GAAG,SAAS,aAAa,SAAS,EAAE;AAAA,MACpD,CAAC;AAED,UAAI;AACF,QAAAG,SAAQ,MAAM,aAAa,GAAG,KAAK,SAAS,CAAC,EAAE;AAC/C,cAAM,WAAW,MAAM,kBAAkB,EAAE,KAAK,UAAU,CAAC;AAC3D,cAAM,OAAO,gBAAgB,SAAS,EAAE;AACxC,cAAM,aAAa,mBAAmB,EAAE,WAAW,IAAI,SAAS,IAAI,KAAK,CAAC;AAC1E,YAAI,CAAC,WAAW,IAAI;AAClB,gBAAM,WAAW,WAAW,UAAU,CAAC,GAAG,KAAK,KAAK;AACpD,gBAAM,IAAI;AAAA,YACR,sBAAsB,WAAW,KAAK,IAAI,UAAU,KAAK,OAAO,KAAK,EAAE;AAAA,UACzE;AAAA,QACF;AAEA,cAAM,aAAa,iBAAiB,OAAO,WAAW,SAAS;AAC/D,cAAM,eACJ,WAAW,UAAU,WAAW,gBAAgB,WAAW;AAE7D,YAAI,iBAAiB,MAAM;AACzB,iBAAO,WAAW;AAClB,UAAAA,SAAQ,KAAK,WAAW,GAAG,KAAK,SAAS,CAAC,eAAe;AACzD;AAAA,QACF;AAEA,YAAI,WAAW,UAAU;AACvB,UAAAA,SAAQ,QAAQ,4BAA4B;AAC5C,gBAAM,mBAAmB;AAAA,YACvB;AAAA,YACA,oBAAoB,QAAQ;AAAA,YAC5B;AAAA,YACA;AAAA,YACA,IAAI,SAAS;AAAA,UACf,CAAC;AAAA,QACH;AAEA,mBAAW,iBAAiB,KAAK,IAAI,GAAG,WAAW,cAAc,IAAI;AACrE,mBAAW,cAAc;AACzB,mBAAW,gBAAe,oBAAI,KAAK,GAAE,YAAY;AACjD,mBAAW,YACT,MAAM,aAAa,WAAW,WAC1B,GAAG,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC,MAAM,SAAS,KACpD,WAAW;AAEjB,YAAI,WAAW,SAAS;AACtB,qBAAW,gBAAgB;AAAA,QAC7B,OAAO;AACL,qBAAW,iBAAiB;AAC5B,qBAAW,gBAAgB;AAE3B,gBAAM,YAAmC;AAAA,YACvC,MAAM;AAAA,YACN;AAAA,YACA,SAAS,IAAI,WAAW,cAAc;AAAA,YACtC,eAAe,WAAW;AAAA,YAC1B,WAAW,WAAW;AAAA,YACtB,WAAW,WAAW;AAAA,YACtB,OAAO,SAAS,GAAG,UAAU;AAAA,YAC7B,MAAM,SAAS,GAAG,UAAU;AAAA,UAC9B;AACA,gBAAM,2BAA2B;AAAA,YAC/B;AAAA,YACA,oBAAoB,QAAQ;AAAA,YAC5B,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAEA,cAAM,UAAU,SAAS,GAAG,WAAW,CAAC;AACxC,cAAM,yBAAyB;AAAA,UAC7B;AAAA,UACA;AAAA,UACA,IAAI,SAAS;AAAA,QACf,CAAC;AACD,cAAM,YAAY,OAAO,OAAO,OAAO,EAAE;AAAA,UACvC,CAAC,KAAK,WAAW,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA,UACpD;AAAA,QACF;AACA,cAAM,eAAe,OAAO,KAAK,OAAO,EAAE;AAC1C,QAAAA,SAAQ;AAAA,UACN,GAAG,GAAG,KAAK,SAAS,CAAC,WAAW,GAAG,IAAI,KAAK,WAAW,cAAc,GAAG,CAAC,SAAM,YAAY,kBAAe,YAAY,SAAS,CAAC;AAAA,QAClI;AACA,eAAO,UAAU;AAAA,MACnB,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,iBAAS,KAAK,GAAG,SAAS,KAAK,OAAO,EAAE;AACxC,QAAAA,SAAQ,KAAK,UAAU,GAAG,KAAK,SAAS,CAAC,EAAE;AAC3C,eAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,kBAAkB,KAAK,KAAK;AAClC,UAAM,mBAAmB,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9C,IAAE;AAAA,MACA,uBAAuB,OAAO,MAAM,YAAY,OAAO,OAAO,0BAA0B,OAAO,MAAM;AAAA,MACrG,WAAW,UAAU,eAAe;AAAA,IACtC;AACA,QAAI,WAAW,YAAY,OAAO,SAAS,GAAG;AAC5C,MAAE,MAAI;AAAA,QACJ,GAAG;AAAA,UACD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,SAAS,GAAG;AACvB,iBAAW,WAAW,UAAU;AAC9B,QAAE,MAAI,MAAM,OAAO;AAAA,MACrB;AACA,MAAE,QAAM,GAAG,IAAI,IAAI,GAAG,IAAI,8BAA8B,CAAC,EAAE;AAC3D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,IAAE,QAAM,GAAG,IAAI,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE;AAAA,EAChD;AACF,CAAC;","names":["mkdir","writeFile","join","join","writeFile","mkdir","spinner"]}

package/dist/runtime-template/worker-entry.js

@@ -1,7 +1,10 @@
 import { DurableObject } from "cloudflare:workers";
 import { Hono } from "hono";
 import { deleteCookie, getSignedCookie, setSignedCookie } from "hono/cookie";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 import agentsSnapshot from "./agents.snapshot.json";
+import identityConfig from "./identity.config.json";
+import mapIdentity from "./identity.map.mjs";
 
 const SESSION_COOKIE_NAME = "kalp_studio_session";
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 8;
@@ -10,6 +13,71 @@ const CORS_HEADERS = {
   "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type, Authorization",
 };
+const JWKS_RESOLVER_CACHE = new Map();
+
+function extractBearerToken(authorization) {
+  if (!authorization) return null;
+  const value = authorization.trim();
+  if (!value) return null;
+  const match = value.match(/^Bearer\s+(.+)$/i);
+  if (!match || !match[1]) return null;
+  const token = match[1].trim();
+  return token || null;
+}
+
+function normalizeHeaderRecord(request) {
+  const headers = {};
+  for (const [key, value] of request.headers.entries()) {
+    headers[key.toLowerCase()] = value;
+  }
+  return headers;
+}
+
+function toMappedIdentity(payload, request) {
+  const rawHeaders = normalizeHeaderRecord(request);
+  try {
+    const mapped = mapIdentity(payload, rawHeaders);
+    if (
+      mapped &&
+      typeof mapped === "object" &&
+      typeof mapped.userId === "string" &&
+      mapped.userId.length > 0
+    ) {
+      return {
+        userId: mapped.userId,
+        email: mapped.email,
+        name: mapped.name,
+        claims:
+          mapped.claims && typeof mapped.claims === "object" ? mapped.claims : {},
+      };
+    }
+  } catch {}
+
+  const sub =
+    payload && typeof payload === "object" && typeof payload.sub === "string"
+      ? payload.sub
+      : "anonymous";
+  return { userId: sub, claims: {} };
+}
+
+function resolveSymmetricSecret(env, secretEnvKey) {
+  const key = secretEnvKey && secretEnvKey.trim() ? secretEnvKey.trim() : "JWT_SIGNING_SECRET";
+  const selected = env[key];
+  if (typeof selected === "string" && selected.trim()) return selected.trim();
+  if (key !== "JWT_SIGNING_SECRET") {
+    const fallback = env.JWT_SIGNING_SECRET;
+    if (typeof fallback === "string" && fallback.trim()) return fallback.trim();
+  }
+  return null;
+}
+
+function getJwksResolver(jwksUrl) {
+  const cached = JWKS_RESOLVER_CACHE.get(jwksUrl);
+  if (cached) return cached;
+  const resolver = createRemoteJWKSet(new URL(jwksUrl));
+  JWKS_RESOLVER_CACHE.set(jwksUrl, resolver);
+  return resolver;
+}
 
 function withCors(response) {
   if (response.status === 101) return response;
@@ -92,6 +160,78 @@ async function requireSession(c, next) {
   return next();
 }
 
+async function verifyGatewayAuth(c) {
+  const enforce = identityConfig?.enforceGlobalAuth !== false;
+  if (!enforce) {
+    return { userId: "anonymous", claims: {}, providerId: "none" };
+  }
+
+  const token = extractBearerToken(c.req.header("Authorization"));
+
+  const serviceKey = c.env.KALP_SERVICE_KEY?.trim();
+  if (serviceKey && token && token === serviceKey) {
+    return {
+      userId: "service-admin",
+      providerId: "service-key",
+      claims: { role: "service_admin", service: true },
+    };
+  }
+
+  const strategy = identityConfig?.strategy;
+  if (!strategy) return null;
+
+  try {
+    if (strategy.type === "jwks") {
+      if (!token) return null;
+      if (!strategy.jwksUrl) return null;
+      const resolver = getJwksResolver(strategy.jwksUrl);
+      const options = {};
+      if (strategy.issuer) options.issuer = strategy.issuer;
+      if (strategy.audience) options.audience = strategy.audience;
+      const { payload } = await jwtVerify(token, resolver, options);
+      return {
+        ...toMappedIdentity(payload, c.req.raw),
+        providerId: identityConfig.identityId ?? "identity",
+      };
+    }
+
+    if (strategy.type === "symmetric") {
+      if (!token) return null;
+      const secret = resolveSymmetricSecret(c.env, strategy.secretEnvKey);
+      if (!secret) return null;
+      const encoded = new TextEncoder().encode(secret);
+      const { payload } = await jwtVerify(token, encoded, {
+        algorithms: ["HS256"],
+      });
+      return {
+        ...toMappedIdentity(payload, c.req.raw),
+        providerId: identityConfig.identityId ?? "identity",
+      };
+    }
+
+    if (strategy.type === "apiKey") {
+      const headerName = (strategy.headerName || "x-api-key").toLowerCase();
+      const envKey = strategy.envKey || "KALP_API_KEY";
+      const expected =
+        typeof c.env[envKey] === "string" ? c.env[envKey].trim() : "";
+      if (!expected) return null;
+      const provided =
+        c.req.header(headerName)?.trim() ??
+        (headerName === "authorization" ? token : null);
+      if (!provided || provided !== expected) return null;
+      return {
+        userId: "api-key-client",
+        providerId: identityConfig.identityId ?? "identity",
+        claims: { role: "api_key" },
+      };
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
 function mapIndexToStudioAgents(entries) {
   return entries.map((entry) => ({
     name: entry.name,
@@ -124,6 +264,16 @@ async function readLatestManifest(env, agentName) {
   }
 }
 
+async function resolveAgentAccess(env, agentName, routeKey) {
+  const manifest = await readLatestManifest(env, agentName);
+  const metadata = manifest?.metadata || {};
+  const routePublic = metadata.routesPublic
+    ? metadata.routesPublic[routeKey]
+    : undefined;
+  const agentPublic = metadata.public ?? false;
+  return { isPublic: routePublic !== undefined ? routePublic : agentPublic };
+}
+
 export class AgentDurableObject extends DurableObject {
   constructor(ctx, env) {
     super(ctx, env);
@@ -216,9 +366,19 @@ function getAgentRouting(url) {
   };
 }
 
-async function forwardToAgentDO(request, env) {
+async function forwardToAgentDO(c, request, env) {
   const url = new URL(request.url);
   const { agentName, passthroughPath } = getAgentRouting(url);
+  const routeKey = `${request.method.toUpperCase()}:${passthroughPath === "/" ? "/" : passthroughPath}`;
+  const access = await resolveAgentAccess(env, agentName, routeKey);
+  let identity = null;
+  if (!access.isPublic) {
+    identity = await verifyGatewayAuth(c);
+    if (!identity) {
+      return c.json({ ok: false, error: "Unauthorized" }, 401);
+    }
+  }
+
   const id = env.KALP_RUNTIME_CLOUDFLARE.idFromName(agentName);
   const stub = env.KALP_RUNTIME_CLOUDFLARE.get(id);
 
@@ -226,6 +386,12 @@ async function forwardToAgentDO(request, env) {
   proxiedUrl.pathname = passthroughPath === "/" ? "/" : passthroughPath;
   const headers = new Headers(request.headers);
   headers.set("x-kalp-agent-name", agentName);
+  headers.set("x-kalp-route-public", String(access.isPublic));
+  if (identity && identity.userId) {
+    headers.set("x-kalp-auth-user-id", identity.userId);
+    headers.set("x-kalp-auth-provider-id", identity.providerId ?? "identity");
+    headers.set("x-kalp-auth-claims", JSON.stringify(identity.claims ?? {}));
+  }
 
   const proxyRequest = new Request(proxiedUrl.toString(), {
     method: request.method,
@@ -376,11 +542,11 @@ app.get("/api/internal/events/:executionId", (c) => {
 });
 
 app.all("/a/:agentName/*", async (c) => {
-  return forwardToAgentDO(c.req.raw, c.env);
+  return forwardToAgentDO(c, c.req.raw, c.env);
 });
 
 app.all("/a/:agentName", async (c) => {
-  return forwardToAgentDO(c.req.raw, c.env);
+  return forwardToAgentDO(c, c.req.raw, c.env);
 });
 
 app.get("/studio", (c) => c.redirect("/studio/", 308));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kalphq/cli",
-  "version": "0.0.0-dev-20260512203604",
+  "version": "0.0.0-dev-20260513001041",
   "description": "Zero-config CLI for deploying Kalp agents",
   "type": "module",
   "license": "MIT",
@@ -27,9 +27,9 @@
     "open": "^11.0.0",
     "picocolors": "1.1.1",
     "zod": "3.25.76",
-    "@kalphq/compiler": "0.0.0-dev-20260512203604",
-    "@kalphq/project": "0.0.0-dev-20260512203604",
-    "@kalphq/sdk": "0.0.0-dev-20260512203604"
+    "@kalphq/compiler": "0.0.0-dev-20260513001041",
+    "@kalphq/project": "0.0.0-dev-20260513001041",
+    "@kalphq/sdk": "0.0.0-dev-20260513001041"
   },
   "devDependencies": {
     "@types/json-stable-stringify": "1.2.0",

package/dist/chunk-6WQW3UVW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/deploy.ts","../src/utils/ai.ts"],"sourcesContent":["import { readFile, writeFile } from \"node:fs/promises\";\nimport { createHash } from \"node:crypto\";\nimport { execa } from \"execa\";\nimport { requireAuth } from \"@/utils/auth\";\nimport { ensureStudioSecrets } from \"@/utils/secret\";\nimport { readProjectState, writeProjectState } from \"@/utils/project-state\";\nimport { materializeRuntime } from \"@/utils/runtime\";\nimport {\n  getRequiredSecretForProvider,\n  readDotEnv,\n  resolveProviderFromConfig,\n} from \"@/utils/ai\";\nimport { resolveProvider } from \"@/utils/providers\";\n\nfunction findWorkersUrl(output: string): string | null {\n  const match = output.match(/https:\\/\\/[^\\s]+\\.workers\\.dev/);\n  return match?.[0] ?? null;\n}\n\ninterface RuntimeWranglerConfig {\n  name?: string;\n  kv_namespaces?: Array<{ binding: string; id?: string }>;\n}\n\ninterface KvNamespaceInfo {\n  id: string;\n  title: string;\n}\n\nasync function readWranglerConfig(\n  configPath: string,\n): Promise<RuntimeWranglerConfig> {\n  const text = await readFile(configPath, \"utf-8\");\n  return JSON.parse(text) as RuntimeWranglerConfig;\n}\n\nasync function writeWranglerConfig(\n  configPath: string,\n  config: RuntimeWranglerConfig,\n): Promise<void> {\n  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\\n`, \"utf-8\");\n}\n\nfunction deriveKvNamespaceTitle(workerName: string, binding: string): string {\n  return `${workerName}-${binding.toLowerCase().replace(/_/g, \"-\")}`;\n}\n\nfunction parseKvListOutput(stdout: string): KvNamespaceInfo[] {\n  const trimmed = stdout.trim();\n  if (!trimmed) return [];\n\n  try {\n    const parsed = JSON.parse(trimmed);\n    if (Array.isArray(parsed)) {\n      return parsed\n        .map((item) => ({\n          id: String((item as { id?: string }).id ?? \"\"),\n          title: String((item as { title?: string }).title ?? \"\"),\n        }))\n        .filter((item) => !!item.id && !!item.title);\n    }\n  } catch {\n    // fallback to text parsing below\n  }\n\n  const matches = trimmed.match(/[a-f0-9]{32}\\s+[^\\r\\n]+/gi) ?? [];\n  return matches\n    .map((line) => {\n      const [id, ...rest] = line.trim().split(/\\s+/g);\n      return { id: id ?? \"\", title: rest.join(\" \") };\n    })\n    .filter((item) => !!item.id && !!item.title);\n}\n\nasync function listKvNamespaces(\n  cwd: string,\n  configPath: string,\n): Promise<KvNamespaceInfo[]> {\n  const provider = resolveProvider();\n  const namespaces = await provider.listNamespaces({ cwd, configPath });\n  return namespaces.map((item) => ({\n    id: item.id,\n    title: item.title,\n  }));\n}\n\nasync function ensureKvNamespaceBindingId(\n  cwd: string,\n  configPath: string,\n): Promise<string | null> {\n  const config = await readWranglerConfig(configPath);\n  const binding = config.kv_namespaces?.find(\n    (item) => item.binding === \"KALP_MANIFESTS\",\n  );\n\n  if (!binding || !config.name) return null;\n  if (binding.id) return binding.id;\n\n  const expectedTitle = deriveKvNamespaceTitle(config.name, binding.binding);\n  const namespaces = await listKvNamespaces(cwd, configPath);\n  const existing = namespaces.find((item) => item.title === expectedTitle);\n  if (!existing) return null;\n\n  binding.id = existing.id;\n  await writeWranglerConfig(configPath, config);\n  return existing.id;\n}\n\nfunction isNamespaceAlreadyExistsError(output: string): boolean {\n  return output.includes(\"[code: 10014]\") && output.includes(\"already exists\");\n}\n\nasync function resolveWorkerUrl(\n  configPath: string,\n  deployOutput: string,\n): Promise<string> {\n  const fromOutput = findWorkersUrl(deployOutput);\n  if (fromOutput) return fromOutput;\n\n  const configText = await readFile(configPath, \"utf-8\").catch(\n    () => null as string | null,\n  );\n  const workerName = configText?.match(/\"name\"\\s*:\\s*\"([^\"]+)\"/)?.[1];\n\n  if (workerName) {\n    return `https://${workerName}.workers.dev`;\n  }\n\n  throw new Error(\"Could not resolve worker URL from wrangler deploy output.\");\n}\n\nexport async function runInitialDeploy(cwd: string): Promise<{\n  workerUrl: string;\n  customDomains: string[];\n  accountId: string;\n  studioAdminUser: string;\n  studioPassword: string;\n  credentialsChanged: boolean;\n}> {\n  const auth = await requireAuth();\n  const aiProvider = await resolveProviderFromConfig(cwd);\n  const requiredProviderSecret = getRequiredSecretForProvider(aiProvider);\n  const envMap = await readDotEnv(cwd);\n  const providerSecretValue = envMap[requiredProviderSecret]?.trim();\n  if (!providerSecretValue) {\n    throw new Error(\n      `Missing required secret ${requiredProviderSecret} for provider \"${aiProvider}\". Add it to .env before deploy.`,\n    );\n  }\n\n  const secrets = await ensureStudioSecrets(cwd);\n  const runtimeProvider = resolveProvider();\n  const runtime = await materializeRuntime(cwd);\n  let secretSyncFailed = false;\n  const secretEntries = [\n    [\"KALP_SECRET_KEY\", secrets.key],\n    [\"KALP_STUDIO_PASSWORD\", secrets.studioPassword],\n    [\"KALP_STUDIO_ADMIN_USER\", secrets.studioAdminUser],\n    [requiredProviderSecret, providerSecretValue],\n  ] as const;\n\n  for (const [name, value] of secretEntries) {\n    try {\n      await runtimeProvider.putSecret({\n        cwd,\n        configPath: runtime.wranglerConfigPath,\n        name,\n        value,\n      });\n    } catch {\n      secretSyncFailed = true;\n      break;\n    }\n  }\n\n  await ensureKvNamespaceBindingId(cwd, runtime.wranglerConfigPath).catch(\n    () => null,\n  );\n\n  const deployArgs = secretSyncFailed\n    ? [\n        \"wrangler\",\n        \"deploy\",\n        \"--config\",\n        runtime.wranglerConfigPath,\n        \"--secrets-file\",\n        \".env\",\n      ]\n    : [\"wrangler\", \"deploy\", \"--config\", runtime.wranglerConfigPath];\n\n  let deploy = await runtimeProvider\n    .deployRuntime({\n      cwd,\n      configPath: runtime.wranglerConfigPath,\n      useSecretsFile: secretSyncFailed,\n    })\n    .catch((error) => error);\n  if (deploy instanceof Error) {\n    const combined = deploy.message;\n    if (isNamespaceAlreadyExistsError(combined)) {\n      await ensureKvNamespaceBindingId(cwd, runtime.wranglerConfigPath);\n      deploy = await runtimeProvider.deployRuntime({\n        cwd,\n        configPath: runtime.wranglerConfigPath,\n        useSecretsFile: secretSyncFailed,\n      });\n    } else {\n      throw deploy;\n    }\n  }\n\n  const workerUrl = deploy.workerUrl;\n  const customDomains = deploy.customDomains ?? [];\n\n  const existingState = await readProjectState(cwd);\n\n  const credentialsFingerprint = createHash(\"sha256\")\n    .update(`${secrets.studioAdminUser}:${secrets.studioPassword}`)\n    .digest(\"hex\");\n  const credentialsChanged =\n    existingState?.studioCredentialsFingerprint !== credentialsFingerprint;\n\n  await writeProjectState(cwd, {\n    workerUrl,\n    deployedAt: new Date().toISOString(),\n    accountId: auth.accountId,\n    studioCredentialsFingerprint: credentialsFingerprint,\n    agents: existingState?.agents ?? {},\n  });\n\n  return {\n    workerUrl,\n    customDomains,\n    accountId: auth.accountId,\n    studioAdminUser: secrets.studioAdminUser,\n    studioPassword: secrets.studioPassword,\n    credentialsChanged,\n  };\n}\n","import { access, readFile } from \"node:fs/promises\";\nimport { constants } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { createJiti } from \"jiti\";\n\nexport type AIProvider = \"openai\" | \"anthropic\" | \"openrouter\" | \"custom\";\n\nconst PROVIDER_SECRET_MAP: Record<AIProvider, string> = {\n  openai: \"OPENAI_API_KEY\",\n  anthropic: \"ANTHROPIC_API_KEY\",\n  openrouter: \"OPENROUTER_API_KEY\",\n  custom: \"CUSTOM_AI_API_KEY\",\n};\n\nfunction parseEnv(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const raw of content.split(/\\r?\\n/g)) {\n    const line = raw.trim();\n    if (!line || line.startsWith(\"#\")) continue;\n    const idx = line.indexOf(\"=\");\n    if (idx <= 0) continue;\n    env[line.slice(0, idx).trim()] = line.slice(idx + 1);\n  }\n  return env;\n}\n\nexport async function resolveProviderFromConfig(cwd: string): Promise<AIProvider> {\n  const configPath = join(cwd, \"kalp.config.ts\");\n  await access(configPath, constants.F_OK);\n  const jiti = createJiti(cwd, { interopDefault: true });\n  const config = (await jiti.import(configPath)) as\n    | { default?: { ai?: { provider?: AIProvider } }; ai?: { provider?: AIProvider } }\n    | undefined;\n  const provider = config?.default?.ai?.provider ?? config?.ai?.provider ?? \"openai\";\n  return provider;\n}\n\nexport async function readDotEnv(cwd: string): Promise<Record<string, string>> {\n  const envPath = join(cwd, \".env\");\n  const content = await readFile(envPath, \"utf-8\").catch(() => \"\");\n  return parseEnv(content);\n}\n\nexport function getRequiredSecretForProvider(provider: AIProvider): string {\n  return PROVIDER_SECRET_MAP[provider];\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,YAAAA,WAAU,iBAAiB;AACpC,SAAS,kBAAkB;;;ACD3B,SAAS,QAAQ,gBAAgB;AACjC,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AACrB,SAAS,kBAAkB;AAI3B,IAAM,sBAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,QAAQ;AACV;AAEA,SAAS,SAAS,SAAyC;AACzD,QAAM,MAA8B,CAAC;AACrC,aAAW,OAAO,QAAQ,MAAM,QAAQ,GAAG;AACzC,UAAM,OAAO,IAAI,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AACnC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,EAAG;AACd,QAAI,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEA,eAAsB,0BAA0B,KAAkC;AAChF,QAAM,aAAa,KAAK,KAAK,gBAAgB;AAC7C,QAAM,OAAO,YAAY,UAAU,IAAI;AACvC,QAAM,OAAO,WAAW,KAAK,EAAE,gBAAgB,KAAK,CAAC;AACrD,QAAM,SAAU,MAAM,KAAK,OAAO,UAAU;AAG5C,QAAM,WAAW,QAAQ,SAAS,IAAI,YAAY,QAAQ,IAAI,YAAY;AAC1E,SAAO;AACT;AAEA,eAAsB,WAAW,KAA8C;AAC7E,QAAM,UAAU,KAAK,KAAK,MAAM;AAChC,QAAM,UAAU,MAAM,SAAS,SAAS,OAAO,EAAE,MAAM,MAAM,EAAE;AAC/D,SAAO,SAAS,OAAO;AACzB;AAEO,SAAS,6BAA6B,UAA8B;AACzE,SAAO,oBAAoB,QAAQ;AACrC;;;ADhBA,eAAe,mBACb,YACgC;AAChC,QAAM,OAAO,MAAMC,UAAS,YAAY,OAAO;AAC/C,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,eAAe,oBACb,YACA,QACe;AACf,QAAM,UAAU,YAAY,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,OAAO;AAC7E;AAEA,SAAS,uBAAuB,YAAoB,SAAyB;AAC3E,SAAO,GAAG,UAAU,IAAI,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG,CAAC;AAClE;AA6BA,eAAe,iBACb,KACA,YAC4B;AAC5B,QAAM,WAAW,gBAAgB;AACjC,QAAM,aAAa,MAAM,SAAS,eAAe,EAAE,KAAK,WAAW,CAAC;AACpE,SAAO,WAAW,IAAI,CAAC,UAAU;AAAA,IAC/B,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,EACd,EAAE;AACJ;AAEA,eAAe,2BACb,KACA,YACwB;AACxB,QAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,QAAM,UAAU,OAAO,eAAe;AAAA,IACpC,CAAC,SAAS,KAAK,YAAY;AAAA,EAC7B;AAEA,MAAI,CAAC,WAAW,CAAC,OAAO,KAAM,QAAO;AACrC,MAAI,QAAQ,GAAI,QAAO,QAAQ;AAE/B,QAAM,gBAAgB,uBAAuB,OAAO,MAAM,QAAQ,OAAO;AACzE,QAAM,aAAa,MAAM,iBAAiB,KAAK,UAAU;AACzD,QAAM,WAAW,WAAW,KAAK,CAAC,SAAS,KAAK,UAAU,aAAa;AACvE,MAAI,CAAC,SAAU,QAAO;AAEtB,UAAQ,KAAK,SAAS;AACtB,QAAM,oBAAoB,YAAY,MAAM;AAC5C,SAAO,SAAS;AAClB;AAEA,SAAS,8BAA8B,QAAyB;AAC9D,SAAO,OAAO,SAAS,eAAe,KAAK,OAAO,SAAS,gBAAgB;AAC7E;AAqBA,eAAsB,iBAAiB,KAOpC;AACD,QAAM,OAAO,MAAM,YAAY;AAC/B,QAAM,aAAa,MAAM,0BAA0B,GAAG;AACtD,QAAM,yBAAyB,6BAA6B,UAAU;AACtE,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,QAAM,sBAAsB,OAAO,sBAAsB,GAAG,KAAK;AACjE,MAAI,CAAC,qBAAqB;AACxB,UAAM,IAAI;AAAA,MACR,2BAA2B,sBAAsB,kBAAkB,UAAU;AAAA,IAC/E;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,QAAM,kBAAkB,gBAAgB;AACxC,QAAM,UAAU,MAAM,mBAAmB,GAAG;AAC5C,MAAI,mBAAmB;AACvB,QAAM,gBAAgB;AAAA,IACpB,CAAC,mBAAmB,QAAQ,GAAG;AAAA,IAC/B,CAAC,wBAAwB,QAAQ,cAAc;AAAA,IAC/C,CAAC,0BAA0B,QAAQ,eAAe;AAAA,IAClD,CAAC,wBAAwB,mBAAmB;AAAA,EAC9C;AAEA,aAAW,CAAC,MAAM,KAAK,KAAK,eAAe;AACzC,QAAI;AACF,YAAM,gBAAgB,UAAU;AAAA,QAC9B;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,yBAAmB;AACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,2BAA2B,KAAK,QAAQ,kBAAkB,EAAE;AAAA,IAChE,MAAM;AAAA,EACR;AAEA,QAAM,aAAa,mBACf;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF,IACA,CAAC,YAAY,UAAU,YAAY,QAAQ,kBAAkB;AAEjE,MAAI,SAAS,MAAM,gBAChB,cAAc;AAAA,IACb;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB,gBAAgB;AAAA,EAClB,CAAC,EACA,MAAM,CAAC,UAAU,KAAK;AACzB,MAAI,kBAAkB,OAAO;AAC3B,UAAM,WAAW,OAAO;AACxB,QAAI,8BAA8B,QAAQ,GAAG;AAC3C,YAAM,2BAA2B,KAAK,QAAQ,kBAAkB;AAChE,eAAS,MAAM,gBAAgB,cAAc;AAAA,QAC3C;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,YAAY,OAAO;AACzB,QAAM,gBAAgB,OAAO,iBAAiB,CAAC;AAE/C,QAAM,gBAAgB,MAAM,iBAAiB,GAAG;AAEhD,QAAM,yBAAyB,WAAW,QAAQ,EAC/C,OAAO,GAAG,QAAQ,eAAe,IAAI,QAAQ,cAAc,EAAE,EAC7D,OAAO,KAAK;AACf,QAAM,qBACJ,eAAe,iCAAiC;AAElD,QAAM,kBAAkB,KAAK;AAAA,IAC3B;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,WAAW,KAAK;AAAA,IAChB,8BAA8B;AAAA,IAC9B,QAAQ,eAAe,UAAU,CAAC;AAAA,EACpC,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,iBAAiB,QAAQ;AAAA,IACzB,gBAAgB,QAAQ;AAAA,IACxB;AAAA,EACF;AACF;","names":["readFile","readFile"]}