@lunora/cli 1.0.0-alpha.41 → 1.0.0-alpha.411

package/dist/packem_chunks/runDeployCommand.mjs

@@ -1,594 +1,25 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { runCodegen, discoverMigrations } from '@lunora/codegen';
-import { readLinkedProject, writeLinkedProject, validateWranglerProject, inferLunoraBindings, reconcileWranglerBindings, DEV_VARS_FILE, parseDevVariableEntries, isMintableSecretKey, findWranglerFile, readWranglerJsonc, discoverContainerInfo, packageNamesFromBindings, requiredSecrets, generateSecretValue } from '@lunora/config';
-import { join } from '@visulima/path';
-import { Spinner } from '@visulima/spinner';
-import { Project } from 'ts-morph';
-import { p as parseApiSpec } from '../packem_shared/api-spec-CtA6ilu4.mjs';
-import { r as readWranglerName } from '../packem_shared/wrangler-name-cy4yhm9j.mjs';
-import { d as defineHandler } from '../packem_shared/command-D3lB_4Az.mjs';
-import { a as isRailpackAvailable, i as isDockerAvailable } from '../packem_shared/docker-hMQ97KSQ.mjs';
-import { v as validateOutputFormat, i as isJsonFormat, p as printJson, l as loggerForFormat } from '../packem_shared/output-format-wUvAN6AL.mjs';
-import { containerBuildTag } from '@lunora/container';
-import { defaultSpawner } from '../packem_shared/createRecordingSpawner-DxI3mebw.mjs';
-import { r as resolveWorkerUrl } from '../packem_shared/resolve-target-qbsJ_5sF.mjs';
-import { r as runSchemaDriftGate } from '../packem_shared/schema-drift-gate-BtBt0as0.mjs';
-import { c as createTuiConfirm } from '../packem_shared/tui-prompts-BjEN8XgP.mjs';
-import { l as listRemoteSecrets } from '../packem_shared/wrangler-secrets-P2_ZUR-k.mjs';
-import { runMigrateDataCommand } from './runMigrateGenerateCommand.mjs';
+import{dirname as L,join as w,resolve as q,relative as F,extname as Ne,sep as re}from"node:path";import{discoverMigrations as xe,runCodegen as Le,readServiceBindings as Oe}from"@lunora/codegen";import{readLinkedProject as he,resolveSchemaDirectory as P,startDevProcess as Me,acceptsConnection as Ue,COMPOSED_WORKER_ENTRY as te,discoverContainerInfo as pe,writeLinkedProject as Fe,discoverSchemaInfo as ve,DEV_VARS_FILE as S,parseDevVariableEntries as ye,isMintableSecretKey as ne,secretSourcesFromBindings as He,inferLunoraBindings as we,requiredSecrets as We,generateSecretValue as Be,upsertDevVariableLine as Ge,writeDevVariablesFileAtomically as Ve,resolveLazyFunctions as ke,createDiscoveryCache as ze,resolveDeployDriver as K,planToolchainInvocation as be,runPostCodegenHook as qe}from"@lunora/config";import{bindingsNeedingDatabase as Ke,findWranglerFile as O,readWranglerJsonc as A,mergeWranglerEnvironment as Y,applyModify as $e,HYPERDRIVE_PLACEHOLDER_ID as Ye,warnCloudflareCliConfigOnce as Je,validateWranglerProject as Xe,wranglerCodegenInputs as Qe,reconcileWranglerBindings as Ze,reconcileWranglerCompatibilityDate as er,reconcileWranglerCrons as rr,describePreservedCrons as tr}from"@lunora/config/cloudflare";import{Spinner as nr}from"@visulima/spinner";import{r as or,a as ar,e as ir}from"../packem_shared/platform-diagnostics-Cn2g6Jh-.mjs";import{p as sr}from"../packem_shared/api-spec-lYyq4vL6.mjs";import{mkdirSync as Se,writeFileSync as D,existsSync as v,readFileSync as k,rmSync as cr,mkdtempSync as dr,readdirSync as lr}from"node:fs";import{m as ur,e as gr,i as fr,b as mr,a as hr}from"../packem_shared/secret-key-8DPOH98z.mjs";import{w as pr}from"../packem_shared/binding-manifest-file-CQ1eQYy1.mjs";import{d as vr}from"../packem_shared/command-CB4JM-Jl.mjs";import{r as J}from"../packem_shared/wrangler-name-Dsk5K1f-.mjs";import{a as yr}from"../packem_shared/deploy-target-resolve-BTCW1Iv4.mjs";import{EXIT_CODE as y}from"../packem_shared/EXIT_CODE-D_XCixv8.mjs";import{spawn as wr}from"node:child_process";import{randomUUID as kr,createHash as br}from"node:crypto";import{setTimeout as $r}from"node:timers/promises";import{toolchainExecArgs as C,detectPackageManager as R,execArgsFor as Ee}from"@lunora/config/cli";import{f as Sr}from"../packem_shared/free-port-DjbFhaaT.mjs";import{containerBuildTag as Er}from"@lunora/container";import{i as Ar,a as Dr}from"../packem_shared/docker-AqLAkOyY.mjs";import{defaultSpawner as M}from"../packem_shared/createRecordingSpawner-Ch7zuQQE.mjs";import{r as Ae}from"../packem_shared/resolve-target-C_ZloTvd.mjs";import{p as Rr,H as Cr,a as _r,r as Pr}from"../packem_shared/health-probe-Bw9JFfIy.mjs";import{join as $}from"@visulima/path";import{r as Ir,c as Tr}from"../packem_shared/cloudflare-credentials-BVmZnDZk.mjs";import{Project as jr}from"ts-morph";import{runMigrateDataCommand as Nr}from"../packem_shared/runMigrateGenerateCommand-BwemPIOz.mjs";import{c as xr}from"../packem_shared/tui-prompts-B3YwUhGw.mjs";import{l as Lr}from"../packem_shared/wrangler-secrets-CTQPpalP.mjs";const Or=Object.freeze({edges:[],nodes:[],modules:[],unresolved:[],version:1}),Mr=20,oe=e=>`${e.from} -${e.kind}-> ${e.to}`,N=(e,r)=>{const n=new Set(e);return r.filter(t=>!n.has(t)).toSorted((t,o)=>t.localeCompare(o))},Ur=(e,r)=>{const n=e.modules.map(i=>i.name),t=r.modules.map(i=>i.name),o=e.edges.map(i=>oe(i)),a=r.edges.map(i=>oe(i));return{addedEdges:N(o,a),addedModules:N(n,t),removedEdges:N(a,o),removedModules:N(t,n)}},x=(e,r,n)=>{if(n.length===0)return[];const t=n.slice(0,Mr).map(a=>`  ${e} ${a}`),o=n.length-t.length;return[`${r}:`,...t,...o>0?[`  … and ${o.toString()} more`]:[]]},Fr=e=>{const r=[...x("+","modules added",e.addedModules),...x("-","modules removed",e.removedModules),...x("+","edges added",e.addedEdges),...x("-","edges removed",e.removedEdges)];return r.length===0?void 0:`architecture changes since the last deploy:
+${r.join(`
+`)}`},Hr=(e,r)=>w(e,".lunora",r===void 0?"architecture.json":`architecture.${r}.json`),Wr=e=>{if(v(e))try{const r=JSON.parse(k(e,"utf8"));return r.version===1&&Array.isArray(r.modules)&&Array.isArray(r.edges)?r:void 0}catch{return}},Br=e=>{const{cwd:r,environment:n,logger:t}=e,o=Hr(r,n),a=Wr(o),i=e.current??(a===void 0?void 0:Or);if(i===void 0)return;const s=a===void 0?void 0:Fr(Ur(a,i));return s!==void 0&&t.info(s),()=>{try{Se(L(o),{recursive:!0}),D(o,`${JSON.stringify(i,void 0,2)}
+`,"utf8")}catch(c){t.warn(`could not record the deployed architecture at ${o}: ${c instanceof Error?c.message:String(c)}`)}}},Gr=e=>{const{cwd:r,env:n,logger:t,mintedSecretsFile:o}=e;try{const a=he(r),i=a?.workerName??J(r),s=e.url??a?.workerUrl;t.success("deploy complete"),t.info(`  worker:  ${i??"(see wrangler output above)"}`),n!==void 0&&t.info(`  env:     ${n}`),s===void 0?t.info("  url:     run `lunora link --url <https://your-worker>` to record it"):t.info(`  url:     ${s}`),o!==void 0&&t.info(`  secrets: generated value(s) recorded in ${o}`),e.logsAvailable&&t.info("  logs:    lunora logs")}catch{}},Vr=/\/index$/u,zr=/[^\dA-Za-z]/gu,qr=e=>e.replace(Vr,"").split("/").map(r=>r.replaceAll(zr,"_")),Kr=e=>qr(e).join("_"),Yr=18787,ae=3,De=12e4,Jr=5e3,H=10,Xr=new Set([".js",".mjs",".mts",".ts",".tsx"]),Qr=/\(void 0\)|is not a function|before initialization|of undefined/u,Zr=e=>typeof e=="object"&&e!==null&&typeof e.functionPath=="string"&&typeof e.message=="string",et=e=>{const r=P(e),n=new Map;let t;try{t=lr(w(e,r),{recursive:!0,encoding:"utf8"})}catch{return n}for(const o of t){const a=Ne(o);Xr.has(a)&&!o.split(re).some(i=>i==="_generated"||i==="node_modules")&&n.set(Kr(o.slice(0,-a.length).split(re).join("/")),w(r,o))}return n},rt=(e,r)=>{const n=et(e),t=new Map;for(const{functionPath:o,message:a}of r){const i=o.lastIndexOf(":"),s=o.slice(0,i),c=`${s}\0${a}`,d=t.get(c)??{exports:[],message:a,namespace:s};d.exports.push(o.slice(i+1)),t.set(c,d)}return[...t.values()].map(({exports:o,message:a,namespace:i})=>{const s=Qr.test(a)?`
+      hint: if this module is part of a circular import, an import it reads is still undefined while it evaluates`:"";return`  ${n.get(i)??i} (${o.join(", ")}): ${a}${s}`})};class b extends Error{skipped;constructor(r,n=!1){super(r),this.skipped=n}}const tt=(e,r)=>{const n=O(e),t=n===void 0?void 0:A(n).parsed;if(t===void 0)return{hasContainers:!1,main:void 0};const{merged:o}=Y(t,r);return{hasContainers:(o.containers??[]).length>0,main:o.main}},nt=({composedEntry:e,configPath:r,cwd:n,environment:t,toolchain:o})=>{if(o.devServer!=="workerd")return{skip:"this deploy target does not run on workerd"};const{hasContainers:a,main:i}=tt(n,t),s=e??i;if(typeof s!="string"||s.startsWith("virtual:")||!v(q(n,s)))return{skip:"the Worker entry is not a file on disk"};if(a)return{skip:"the project declares containers, which `wrangler dev` would build locally before the real container build"};const c=Ke(n,process.env,t,r);return c.length===0?{main:s}:{skip:`the Hyperdrive binding ${c.join(", ")} has no local database for wrangler dev`}},ot=async(e,r,n)=>{const t=await fetch(`http://127.0.0.1:${String(e)}/_lunora/__smoke_load`,{signal:AbortSignal.timeout(Math.max(0,n-Date.now()))}).catch(g=>{throw g instanceof Error&&g.name==="TimeoutError"?new b(`the smoke Worker booted but did not finish evaluating the lazy modules within ${String(De/1e3)}s — a module may be awaiting something that never settles. Pass --no-smoke-load to ship anyway.`):g});if(t.status>=500)throw new b(`the smoke Worker booted but failed while evaluating the lazy modules (HTTP ${String(t.status)}). Pass --no-smoke-load to ship anyway.`);const o=await t.text().catch(()=>"");let a;try{a=JSON.parse(o)}catch{a=void 0}const{checked:i,failures:s,run:c}=a??{};if(typeof i=="number"&&Array.isArray(s)&&s.every(g=>Zr(g)))return c===r?{checked:i,failures:s}:void 0;const d=t.headers.get("content-type")??"no content type",l=o.replaceAll(/\s+/gu," ").trim().slice(0,120);throw new b(`the smoke Worker answered with something other than the probe's result (HTTP ${String(t.status)}, ${d}${l===""?"":`: ${l}`}). A route that does not send /_lunora/* to the Worker first answers with the app's assets, so check run_worker_first. Pass --no-smoke-load to ship anyway.`)},V=(e,r)=>{try{process.kill(-e,r)}catch{}},ie=e=>{try{return process.kill(-e,0),!0}catch{return!1}},at=e=>{const r=()=>{V(e,"SIGKILL")},n=o=>{r(),process.kill(process.pid,o)},t=()=>{process.removeListener("exit",r),process.removeListener("SIGINT",n),process.removeListener("SIGTERM",n)};return process.once("exit",r),process.once("SIGINT",n),process.once("SIGTERM",n),t},W=async e=>{if(e===void 0)return;e.dispose();const{pid:r}=e;V(r,"SIGTERM");const n=Date.now()+Jr;for(;ie(r)&&Date.now()<n;)await $r(50);ie(r)&&V(r,"SIGKILL")},it=e=>Me(e).catch(async r=>{if(!await Ue(e.port))throw r}),st=(e,{checked:r,failures:n},t)=>{if(n.length===0){t.success(`${String(r)} lazy function(s) evaluate cleanly`);return}const o=rt(e,n),a=o.length>H?[`  …and ${String(o.length-H)} more module(s)`]:[];throw new b([`${String(n.length)} of ${String(r)} lazy function(s) fail to load:`,...o.slice(0,H),...a,"Fix the module, or pass --no-smoke-load to ship anyway."].join(`
+`))},ct=(e,r,n)=>{if(e instanceof b&&!e.skipped)return n.error(e.message),e.message;if(e instanceof b){n.warn(`smoke-load skipped: ${e.message}`);return}const t=r.slice(-5).join(`
+`),o=`the smoke Worker did not start (${e instanceof Error?e.message:String(e)})${t===""?"":`
+${t}`}. Either the entry fails when it loads, or local wrangler cannot run the project (a remote-only binding or a missing assets directory). Fix whichever it is, or pass --no-smoke-load to ship anyway.`;return n.error(o),o},dt=e=>{try{return Se(w(e,".lunora"),{recursive:!0}),dr(w(e,".lunora","smoke-"))}catch(r){throw new b(`could not create a directory for the check (${r instanceof Error?r.message:String(r)})`,!0)}},lt=async e=>{const{configPath:r,cwd:n,directory:t,environment:o,functionsFile:a,main:i,preferred:s,toolchain:c}=e;try{const d=w(t,"entry.ts"),l=kr();D(d,`export * from ${JSON.stringify(q(n,i))};
+import { loadAllFunctions } from ${JSON.stringify(a)};
 
-const WORKERS_DEV_URL = /https?:\/\/[^\s"'<>]+\.workers\.dev[^\s"'<>]*/u;
-const ANY_HTTPS_URL = /https:\/\/[^\s"'<>]+/u;
-const parseDeployedUrl = (output) => {
-  const workersDev = WORKERS_DEV_URL.exec(output);
-  if (workersDev) {
-    return workersDev[0];
-  }
-  return ANY_HTTPS_URL.exec(output)?.[0];
-};
-const autoLinkFromDeployOutput = ({ cwd, env, logger, now, output }) => {
-  if (output === void 0 || readLinkedProject(cwd) !== void 0) {
-    return;
-  }
-  const url = parseDeployedUrl(output);
-  if (url === void 0) {
-    return;
-  }
-  try {
-    const stamp = (now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
-    writeLinkedProject(cwd, { env, linkedAt: stamp, workerName: readWranglerName(cwd), workerUrl: url });
-    logger.success(`link: recorded ${url} in .lunora/project.json (run \`lunora link\` to change)`);
-  } catch {
-  }
-};
-
-const renderDeploySummary = (inputs) => {
-  const { cwd, env, logger, migrated } = inputs;
-  try {
-    const link = readLinkedProject(cwd);
-    const workerName = link?.workerName ?? readWranglerName(cwd);
-    logger.success("deploy complete");
-    logger.info(`  worker:  ${workerName ?? "(see wrangler output above)"}`);
-    if (env !== void 0) {
-      logger.info(`  env:     ${env}`);
-    }
-    if (link?.workerUrl === void 0) {
-      logger.info("  url:     run `lunora link --url <https://your-worker>` to record it");
-    } else {
-      logger.info(`  url:     ${link.workerUrl}`);
-    }
-    if (migrated) {
-      logger.info("  migrations: applied");
-    }
-    logger.info("  studio:  lunora view --remote");
-    logger.info("  logs:    lunora logs");
-  } catch {
-  }
-};
-
-const buildRailpackImages = async (options) => {
-  if (options.targets.length === 0) {
-    return { builtTags: [], code: 0 };
-  }
-  if (!(options.railpackAvailable ?? isRailpackAvailable)()) {
-    const message = "deploy blocked: a container uses `image: { build }` (Railpack), but Railpack isn't ready. Install the `railpack` CLI and start a BuildKit instance, e.g. `docker run --rm --privileged -d --name buildkit moby/buildkit` then `export BUILDKIT_HOST=docker-container://buildkit`. Alternatively switch the container's `image` to a Dockerfile path or a pre-built registry reference.";
-    options.logger.error(message);
-    return { builtTags: [], code: 1, error: message };
-  }
-  const spawner = options.spawner ?? defaultSpawner;
-  const builtTags = [];
-  for (const target of options.targets) {
-    const tag = containerBuildTag(target.exportName);
-    const build = { args: ["build", target.buildDir, "--name", tag], command: "railpack", cwd: options.cwd };
-    const push = { args: ["exec", "wrangler", "containers", "push", tag], command: "pnpm", cwd: options.cwd };
-    options.logger.info(`railpack: building "${target.exportName}" → ${tag} from ${target.buildDir}`);
-    const buildResult = await spawner(build);
-    if (buildResult.code !== 0) {
-      const message = `railpack build failed for container "${target.exportName}" (${target.buildDir})`;
-      options.logger.error(message);
-      return { builtTags, code: buildResult.code, error: message };
-    }
-    options.logger.info(`railpack: pushing ${tag} to the Cloudflare Registry`);
-    const pushResult = await spawner(push);
-    if (pushResult.code !== 0) {
-      const message = `wrangler containers push failed for "${target.exportName}" (${tag})`;
-      options.logger.error(message);
-      return { builtTags, code: pushResult.code, error: message };
-    }
-    builtTags.push(tag);
-  }
-  return { builtTags, code: 0 };
-};
-
-const D1_PLACEHOLDER_ID = "<replace-with-d1-create-id>";
-const ORIGIN_VAR_NAMES = ["LUNORA_ORIGIN_URL", "LUNORA_WORKER_ORIGIN", "AUTH_URL"];
-const isLocalhostUrl = (value) => {
-  try {
-    const { hostname } = new URL(value);
-    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-  } catch {
-    return false;
-  }
-};
-const isLocalImagePath = (image) => image.startsWith("./") || image.startsWith("../") || image.startsWith("/") || image.includes("Dockerfile");
-const checkContainerDockerPreflight = (cwd, logger, dockerAvailable) => {
-  const wranglerPath = findWranglerFile(cwd);
-  if (!wranglerPath) {
-    return void 0;
-  }
-  const { parsed } = readWranglerJsonc(wranglerPath);
-  const localImages = (parsed?.containers ?? []).filter((entry) => typeof entry?.image === "string" && isLocalImagePath(entry.image));
-  if (localImages.length === 0 || dockerAvailable()) {
-    return void 0;
-  }
-  const message = `deploy blocked: wrangler.jsonc declares ${String(localImages.length)} container(s) built from a local Dockerfile, but no Docker-compatible engine is available. Start Docker (or Colima), or point the container's \`image\` at a pre-built registry reference. Note: container images must target linux/amd64.`;
-  logger.error(message);
-  return message;
-};
-const resolveComposedWorkerEntry = (cwd) => existsSync(join(cwd, "src", "worker.ts")) ? "src/worker.ts" : void 0;
-const checkContainerSourcesExist = (cwd, logger) => {
-  for (const container of discoverContainerInfo(cwd, "lunora").containers) {
-    const { image } = container;
-    if (image.kind === "dockerfile" && !existsSync(join(cwd, image.dockerfilePath))) {
-      const message = `deploy blocked: container "${container.exportName}" references a Dockerfile at "${image.dockerfilePath}" that does not exist. Create it or fix the \`image\` path in lunora/containers.ts.`;
-      logger.error(message);
-      return message;
-    }
-    if (image.kind === "build" && !existsSync(join(cwd, image.buildDir))) {
-      const message = `deploy blocked: container "${container.exportName}" references a Railpack build directory "${image.buildDir}" that does not exist. Create it or fix the \`image.build\` path in lunora/containers.ts.`;
-      logger.error(message);
-      return message;
-    }
-  }
-  return void 0;
-};
-const isInteractive = (options) => {
-  if (isJsonFormat(options.format)) {
-    return false;
-  }
-  if (options.interactive !== void 0) {
-    return options.interactive;
-  }
-  return process.stdout.isTTY && !process.env.CI;
-};
-const findD1PlaceholderBinding = (cwd) => {
-  const wranglerPath = findWranglerFile(cwd);
-  if (!wranglerPath) {
-    return void 0;
-  }
-  const { parsed } = readWranglerJsonc(wranglerPath);
-  if (!parsed) {
-    return void 0;
-  }
-  const placeholder = (parsed.d1_databases ?? []).find((entry) => entry.database_id === D1_PLACEHOLDER_ID);
-  return placeholder?.binding;
-};
-const buildContainerImages = async (cwd, options) => {
-  const targets = discoverContainerInfo(cwd, "lunora").containers.filter((container) => container.image.kind === "build").map((container) => {
-    return { buildDir: container.image.buildDir, exportName: container.exportName };
-  });
-  if (targets.length === 0) {
-    return void 0;
-  }
-  const result = await buildRailpackImages({
-    cwd,
-    logger: options.logger,
-    railpackAvailable: options.railpackAvailable,
-    spawner: options.spawner,
-    targets
-  });
-  return result.code === 0 ? void 0 : result.error ?? "railpack build failed";
-};
-const provisionBindings = async (cwd, logger) => {
-  try {
-    const inferred = await inferLunoraBindings({ projectRoot: cwd });
-    const reconciled = reconcileWranglerBindings(cwd, inferred);
-    if (reconciled.changed) {
-      logger.success(`provisioned bindings: ${reconciled.added.join(", ")} → ${reconciled.wranglerPath ?? "wrangler.jsonc"}`);
-    }
-    for (const warning of reconciled.warnings) {
-      logger.warn(warning);
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.warn(`binding inference skipped: ${message}`);
-  }
-};
-const warnDevVariablesNotPushed = (cwd, logger) => {
-  const devVariablesPath = join(cwd, DEV_VARS_FILE);
-  if (!existsSync(devVariablesPath)) {
-    return;
-  }
-  let keyCount;
-  try {
-    keyCount = parseDevVariableEntries(readFileSync(devVariablesPath, "utf8")).length;
-  } catch {
-    return;
-  }
-  if (keyCount === 0) {
-    return;
-  }
-  logger.warn(
-    `Note: \`lunora deploy\` does not push secrets. ${DEV_VARS_FILE} has ${String(keyCount)} key(s); if you changed them, run \`lunora env push --yes\` to update the deployed secrets.`
-  );
-};
-const SECRET_LIKE_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
-const resolveRequiredSecretKeys = async (cwd) => {
-  let packages = [];
-  try {
-    packages = packageNamesFromBindings(await inferLunoraBindings({ projectRoot: cwd }));
-  } catch {
-  }
-  const fromPackages = requiredSecrets(packages).map((entry) => entry.key);
-  let fromLocal = [];
-  try {
-    const devVariablesPath = join(cwd, DEV_VARS_FILE);
-    if (existsSync(devVariablesPath)) {
-      fromLocal = parseDevVariableEntries(readFileSync(devVariablesPath, "utf8")).map((entry) => entry.key).filter((key) => SECRET_LIKE_KEY.test(key));
-    }
-  } catch {
-  }
-  return [.../* @__PURE__ */ new Set([...fromPackages, ...fromLocal])];
-};
-const pushMintableSecrets = async (cwd, options, keys) => {
-  const { logger } = options;
-  const spawner = options.spawner ?? defaultSpawner;
-  const environmentFlag = options.env === void 0 ? "" : ` --env ${options.env}`;
-  for (const key of keys) {
-    const args = ["exec", "wrangler", "secret", "put", key];
-    if (options.env !== void 0) {
-      args.push("--env", options.env);
-    }
-    if (options.temporary === true) {
-      args.push("--temporary");
-    }
-    const pushResult = await spawner({ args, command: "pnpm", cwd, input: generateSecretValue() });
-    if (pushResult.code !== 0) {
-      logger.error(
-        `failed to push secret ${key} (exit ${String(pushResult.code)}); set it manually with \`wrangler secret put ${key}${environmentFlag}\`.`
-      );
-      return false;
-    }
-    logger.success(`generated + pushed ${key}`);
-  }
-  return true;
-};
-const offerMissingSecrets = async (cwd, options, interactive) => {
-  if (options.dryRun === true || options.preview === true) {
-    return void 0;
-  }
-  const { logger } = options;
-  const environmentFlag = options.env === void 0 ? "" : ` --env ${options.env}`;
-  let remote;
-  try {
-    remote = await (options.secretLister ?? listRemoteSecrets)({ cwd, env: options.env, temporary: options.temporary });
-  } catch {
-    return void 0;
-  }
-  if (!remote.ok) {
-    return void 0;
-  }
-  const remoteNames = new Set(remote.names);
-  const required = await resolveRequiredSecretKeys(cwd);
-  const missing = required.filter((key) => !remoteNames.has(key));
-  if (missing.length === 0) {
-    return void 0;
-  }
-  if (!interactive) {
-    return `missing required secret(s) on the deploy target: ${missing.join(", ")}. Set them with \`wrangler secret put <KEY>${environmentFlag}\` (or \`lunora env generate --set\` then \`lunora env push --yes${options.env === void 0 ? "" : " --prod"}\`), then re-deploy.`;
-  }
-  for (const key of missing.filter((name) => !isMintableSecretKey(name))) {
-    logger.warn(`required secret ${key} is not set on the target — set it with: wrangler secret put ${key}${environmentFlag}`);
-  }
-  const mintable = missing.filter((key) => isMintableSecretKey(key));
-  if (mintable.length === 0) {
-    return void 0;
-  }
-  const confirm = options.secretConfirm ?? createTuiConfirm();
-  if (await confirm(`${String(mintable.length)} required secret(s) not set on the target (${mintable.join(", ")}). Generate strong values and push them now?`)) {
-    await pushMintableSecrets(cwd, options, mintable);
-    return void 0;
-  }
-  logger.warn(
-    `${String(mintable.length)} required secret(s) not set on the target: ${mintable.join(", ")}. Generate + push with \`lunora env generate --set\` then \`lunora env push --yes${options.env === void 0 ? "" : " --prod"}\`.`
-  );
-  return void 0;
-};
-const runPostDeployMigrations = async (options, cwd) => {
-  const project = new Project({ skipAddingFilesFromTsConfig: true });
-  const lunoraDirectory = join(cwd, "lunora");
-  let migrations;
-  try {
-    migrations = discoverMigrations(project, lunoraDirectory);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    options.logger.warn(`--migrate: could not discover migrations (${message}); skipping`);
-    return 0;
-  }
-  if (migrations.length === 0) {
-    options.logger.info("--migrate: no data migrations declared in lunora/");
-    return 0;
-  }
-  options.logger.info(`--migrate: running ${String(migrations.length)} migration(s) against deployed worker`);
-  for (const migration of migrations) {
-    options.logger.info(`--migrate: up "${migration.id}" (table "${migration.table}")`);
-    const migrateOptions = {
-      cwd,
-      fetchImpl: options.fetchImpl,
-      id: migration.id,
-      logger: options.logger,
-      // A `--migrate-url` is always set by this point (guarded above), so this
-      // is a production migration — gate it behind the operator's explicit
-      // `--migrate-yes`/`--yes` rather than auto-confirming.
-      prod: true,
-      subcommand: "up",
-      token: options.migrateToken,
-      url: options.migrateUrl,
-      yes: options.migrateYes === true
-    };
-    const migrateResult = await runMigrateDataCommand(migrateOptions);
-    if (migrateResult.code !== 0) {
-      options.logger.error(`--migrate: migration "${migration.id}" failed — see output above`);
-      return migrateResult.code;
-    }
-    options.logger.success(`--migrate: "${migration.id}" applied`);
-  }
-  return 0;
-};
-const validateMigrateDeployPreflight = (options) => {
-  if (!options.migrate || options.dryRun || options.preview) {
-    return void 0;
-  }
-  if (options.migrateUrl === void 0) {
-    const message = "--migrate requires --migrate-url <https://your-worker> — the deploy target URL is not captured automatically, refusing to default to localhost";
-    options.logger.error(message);
-    return message;
-  }
-  if (options.migrateYes !== true) {
-    const message = "--migrate runs production data migrations after deploy. Re-run with --migrate-yes to confirm.";
-    options.logger.error(message);
-    return message;
-  }
-  if ((options.migrateToken ?? process.env.LUNORA_ADMIN_TOKEN) === void 0 || (options.migrateToken ?? process.env.LUNORA_ADMIN_TOKEN) === "") {
-    const message = "admin token required for --migrate — pass --migrate-token or set LUNORA_ADMIN_TOKEN";
-    options.logger.error(message);
-    return message;
-  }
-  return void 0;
-};
-const runCodegenStep = (cwd, interactive, logger, apiSpec) => {
-  let codegenSpinner;
-  if (interactive) {
-    codegenSpinner = new Spinner({ name: "dots" });
-    codegenSpinner.start("running codegen");
-  } else {
-    logger.info("running codegen");
-  }
-  try {
-    const result = runCodegen({ apiSpec, projectRoot: cwd });
-    codegenSpinner?.succeed("codegen complete");
-    if (!codegenSpinner) {
-      logger.success("codegen complete");
-    }
-    return { result };
-  } catch (error) {
-    codegenSpinner?.failed("codegen failed");
-    const message = error instanceof Error ? error.message : String(error);
-    logger.error(`codegen failed: ${message}`);
-    return { error: `codegen failed: ${message}` };
-  }
-};
-const checkD1Placeholder = (cwd, logger) => {
-  const placeholderBinding = findD1PlaceholderBinding(cwd);
-  if (placeholderBinding === void 0) {
-    return void 0;
-  }
-  const message = `deploy blocked: the "${placeholderBinding}" D1 binding has a placeholder database_id ("${D1_PLACEHOLDER_ID}"). Run \`wrangler d1 create <name>\` to create the database, then replace the placeholder in wrangler.jsonc with the real id before deploying.`;
-  logger.error(message);
-  return message;
-};
-const checkLocalhostOriginVariables = (cwd, logger) => {
-  const wranglerPath = findWranglerFile(cwd);
-  if (!wranglerPath) {
-    return void 0;
-  }
-  const { parsed } = readWranglerJsonc(wranglerPath);
-  const variables = parsed?.vars;
-  if (!variables) {
-    return void 0;
-  }
-  const offenders = ORIGIN_VAR_NAMES.filter((name) => typeof variables[name] === "string" && isLocalhostUrl(variables[name]));
-  if (offenders.length === 0) {
-    return void 0;
-  }
-  const message = `deploy blocked: ${offenders.join(", ")} in wrangler.jsonc point at localhost. A deployed Worker can't reach a loopback address, so this silently breaks scheduled-job dispatch / auth callbacks. Set each to the deployed worker's public URL (or move it to a secret with \`wrangler secret put\`) before deploying.`;
-  logger.error(message);
-  return message;
-};
-const finalizeSuccessfulDeploy = async (options, cwd, descriptor, validation, reblessSchemaBaseline) => {
-  if (options.migrate) {
-    const migrateCode = await runPostDeployMigrations(options, cwd);
-    if (migrateCode === 0) {
-      reblessSchemaBaseline?.();
-    }
-    return { code: migrateCode, descriptor, validation };
-  }
-  reblessSchemaBaseline?.();
-  return { code: 0, descriptor, validation };
-};
-const runPreDeployGates = async (cwd, options) => {
-  const d1Error = checkD1Placeholder(cwd, options.logger);
-  if (d1Error !== void 0) {
-    return d1Error;
-  }
-  const localhostOriginError = checkLocalhostOriginVariables(cwd, options.logger);
-  if (localhostOriginError !== void 0) {
-    return localhostOriginError;
-  }
-  const sourceError = checkContainerSourcesExist(cwd, options.logger);
-  if (sourceError !== void 0) {
-    return sourceError;
-  }
-  const dockerError = checkContainerDockerPreflight(cwd, options.logger, options.dockerAvailable ?? isDockerAvailable);
-  if (dockerError !== void 0) {
-    return dockerError;
-  }
-  return buildContainerImages(cwd, options);
-};
-const buildWranglerDeployArgs = (cwd, options) => {
-  const args = options.preview ? ["exec", "wrangler", "versions", "upload"] : ["exec", "wrangler", "deploy"];
-  const composedEntry = resolveComposedWorkerEntry(cwd);
-  if (composedEntry !== void 0) {
-    args.push(composedEntry);
-    options.logger.info(`class-B composition: deploying ${composedEntry} (overrides wrangler main)`);
-  }
-  if (options.env !== void 0) {
-    args.push("--env", options.env);
-  }
-  if (options.temporary) {
-    args.push("--temporary");
-    options.logger.info("temporary account: deploying to a short-lived Cloudflare account (~60min); wrangler will print a claim URL");
-  }
-  if (options.dryRun) {
-    args.push("--dry-run");
-    options.logger.info("dry run: validating + bundling without publishing");
-  }
-  if (options.outDir !== void 0) {
-    args.push("--outdir", options.outDir, "--metafile");
-    options.logger.info(`build artifact: emitting bundle to ${options.outDir}`);
-  }
-  return args;
-};
-const reportWranglerProblems = (validation, logger) => {
-  if (validation.problems.length === 0) {
-    return false;
-  }
-  logger.error("wrangler.jsonc validation failed:");
-  for (const problem of validation.problems) {
-    logger.error(`  - ${problem}`);
-  }
-  return true;
-};
-const executeDeploy = async (options) => {
-  const cwd = options.cwd ?? process.cwd();
-  const interactive = isInteractive(options);
-  let codegen;
-  if (!options.skipCodegen) {
-    const codegenStep = runCodegenStep(cwd, interactive, options.logger, options.apiSpec);
-    if (codegenStep.error !== void 0) {
-      return {
-        code: 1,
-        descriptor: void 0,
-        error: codegenStep.error,
-        validation: { problems: [], wranglerPath: void 0 }
-      };
-    }
-    codegen = codegenStep.result;
-  }
-  let reblessSchemaBaseline;
-  if (codegen !== void 0) {
-    const gate = runSchemaDriftGate({
-      allowDrift: options.allowSchemaDrift === true,
-      codegen,
-      logger: options.logger,
-      updateBaseline: options.updateSchemaBaseline === true
-    });
-    if (gate.blocked) {
-      return {
-        code: 1,
-        descriptor: void 0,
-        error: "schema drift gate blocked deploy",
-        schemaDrift: { blocked: true, reason: gate.reason },
-        validation: { problems: [], wranglerPath: void 0 }
-      };
-    }
-    reblessSchemaBaseline = gate.rebless;
-  }
-  await provisionBindings(cwd, options.logger);
-  const migratePreflightError = validateMigrateDeployPreflight(options);
-  if (migratePreflightError !== void 0) {
-    return { code: 1, descriptor: void 0, error: migratePreflightError, validation: { problems: [], wranglerPath: void 0 } };
-  }
-  const preflightError = await runPreDeployGates(cwd, options);
-  if (preflightError !== void 0) {
-    return { code: 1, descriptor: void 0, error: preflightError, validation: { problems: [], wranglerPath: void 0 } };
-  }
-  const validation = validateWranglerProject({ projectRoot: cwd });
-  if (reportWranglerProblems(validation, options.logger)) {
-    return { code: 1, descriptor: void 0, error: "wrangler validation failed", validation };
-  }
-  warnDevVariablesNotPushed(cwd, options.logger);
-  const secretAbort = await offerMissingSecrets(cwd, options, interactive);
-  if (secretAbort !== void 0) {
-    options.logger.error(secretAbort);
-    return { code: 1, descriptor: void 0, error: secretAbort, validation };
-  }
-  const shouldAutoLink = !isJsonFormat(options.format) && options.dryRun !== true && options.preview !== true && readLinkedProject(cwd) === void 0;
-  const descriptor = {
-    args: buildWranglerDeployArgs(cwd, options),
-    captureStdout: shouldAutoLink,
-    command: "pnpm",
-    cwd,
-    // In `--format json` mode stdout is reserved for the single JSON document,
-    // so route wrangler's progress + deployed-URL output to stderr instead.
-    stdoutToStderr: isJsonFormat(options.format)
-  };
-  options.logger.info(`deploying via ${descriptor.command} ${descriptor.args.join(" ")}`);
-  const spawner = options.spawner ?? defaultSpawner;
-  const result = await spawner(descriptor);
-  if (result.code !== 0) {
-    return { code: result.code, descriptor, validation };
-  }
-  if (options.dryRun) {
-    return { code: 0, descriptor, validation };
-  }
-  if (options.preview) {
-    return { code: 0, descriptor, validation };
-  }
-  autoLinkFromDeployOutput({ cwd, env: options.env, logger: options.logger, output: result.stdout });
-  return finalizeSuccessfulDeploy(options, cwd, descriptor, validation, reblessSchemaBaseline);
-};
-const runDeployCommand = async (options) => {
-  const formatError = validateOutputFormat("deploy", options.format);
-  if (formatError !== void 0) {
-    options.logger.error(formatError);
-    return { code: 1, descriptor: void 0, error: formatError, validation: { problems: [], wranglerPath: void 0 } };
-  }
-  const result = await executeDeploy({ ...options, logger: loggerForFormat(options.format, options.logger) });
-  if (isJsonFormat(options.format)) {
-    printJson(result);
-    return result;
-  }
-  if (result.code === 0 && options.dryRun !== true && options.preview !== true) {
-    renderDeploySummary({ cwd: options.cwd ?? process.cwd(), env: options.env, logger: options.logger, migrated: options.migrate === true });
-  } else if (result.code === 0 && options.preview === true) {
-    options.logger.success("preview version uploaded — see the preview URL in the wrangler output above");
-  }
-  return result;
-};
-const execute = defineHandler(async ({ cwd, logger, options }) => {
-  const result = await runDeployCommand({
-    allowSchemaDrift: options.allowSchemaDrift === true,
-    apiSpec: parseApiSpec(options.apiSpec),
-    cwd,
-    dryRun: options.dryRun === true,
-    env: options.env,
-    format: options.format,
-    logger,
-    migrate: options.migrate === true,
-    migrateToken: options.migrateToken,
-    // Fall back to the `.lunora/project.json` link so a linked checkout no
-    // longer needs --migrate-url repeated on every `deploy --migrate`.
-    migrateUrl: resolveWorkerUrl({ cwd, url: options.migrateUrl }),
-    migrateYes: options.migrateYes === true,
-    preview: options.preview === true,
-    // `--prebuilt` trusts a prior `lunora build`/`prepare`: skip codegen (and
-    // thus the drift gate, which has no fresh snapshot to measure).
-    skipCodegen: options.prebuilt === true,
-    temporary: options.temporary === true,
-    updateSchemaBaseline: options.updateSchemaBaseline === true
-  });
-  return { code: result.code };
-});
+const runId = ${JSON.stringify(l)};
 
-export { execute, runDeployCommand };
+export default {
+    async fetch() {
+        return Response.json({ ...(await loadAllFunctions()), run: runId });
+    },
+};
+`);const g=await Sr(s),{args:f,command:m}=C(R(n),c.dev({configPath:r===void 0?void 0:F(n,r),environment:o,extraArgs:[F(n,d),"--local","--local-protocol","http","--ip","127.0.0.1","--port",String(g),"--persist-to",F(n,w(t,"state"))]}));return{args:f,command:m,port:g,runId:l}}catch(d){throw new b(`could not prepare the check (${d instanceof Error?d.message:String(d)})`,!0)}},ut=async e=>{const{configPath:r,cwd:n,environment:t,launcher:o,logger:a,toolchain:i}=e,s=w(n,P(n),"_generated","functions.ts");if(!v(s)||!k(s,"utf8").includes("export const loadAllFunctions"))return;const c=nt(e);if("skip"in c){a.warn(`smoke-load skipped: ${c.skip}, so lazy modules are not evaluated before deploy`);return}const{main:d}=c,l=[];let g,f;const m=Date.now()+De,u=process.platform!=="win32",h=(p,I,T)=>{const E=wr(p,[...I],{cwd:T.cwd,detached:u,shell:T.shell,stdio:["ignore","pipe","pipe"]});return u&&E.pid!==void 0&&(f={dispose:at(E.pid),pid:E.pid}),E};try{g=dt(n),a.info("smoke-loading lazy function modules in workerd");let p=Yr;for(let I=0;I<ae;I+=1){const{args:T,command:E,port:U,runId:je}=await lt({configPath:r,cwd:n,directory:g,environment:t,functionsFile:s,main:d,preferred:p,toolchain:i});p=U+1;const ee=await it({args:T,command:E,cwd:n,spawn:o??h,label:"wrangler dev (smoke-load)",notFound:"`wrangler` was not found",onLine:j=>{l.push(j)},port:U,readyTimeoutMs:Math.max(0,m-Date.now()),shell:process.platform==="win32"});if(ee===void 0){await W(f),f=void 0;continue}try{const j=await ot(U,je,m);if(j!==void 0){st(n,j,a);return}}finally{await ee.stop(),await W(f),f=void 0}}throw new b(`the smoke port was answered by other runs on all ${String(ae)} attempts`,!0)}catch(p){return ct(p,l,a)}finally{if(await W(f),g!==void 0)try{cr(g,{force:!0,recursive:!0})}catch{}}},gt=async e=>{if(e.targets.length===0)return{builtTags:[],code:0};if(!(e.railpackAvailable??Ar)()){const t="deploy blocked: a container uses `image: { build }` (Railpack), but Railpack isn't ready. Install the `railpack` CLI and start a BuildKit instance, e.g. `docker run --rm --privileged -d --name buildkit moby/buildkit` then `export BUILDKIT_HOST=docker-container://buildkit`. Alternatively switch the container's `image` to a Dockerfile path or a pre-built registry reference.";return e.logger.error(t),{builtTags:[],code:1,error:t}}const r=e.spawner??M,n=[];for(const t of e.targets){const o=Er(t.exportName),a={args:["build",t.buildDir,"--name",o],command:"railpack",cwd:e.cwd},i=Ee(R(e.cwd),"wrangler",["containers","push",o]),s={args:i.args,command:i.command,cwd:e.cwd};e.logger.info(`railpack: building "${t.exportName}" → ${o} from ${t.buildDir}`);const c=await r(a);if(c.code!==0){const l=`railpack build failed for container "${t.exportName}" (${t.buildDir})`;return e.logger.error(l),{builtTags:n,code:c.code,error:l}}e.logger.info(`railpack: pushing ${o} to the Cloudflare Registry`);const d=await r(s);if(d.code!==0){const l=`wrangler containers push failed for "${t.exportName}" (${o})`;return e.logger.error(l),{builtTags:n,code:d.code,error:l}}n.push(o)}return{builtTags:n,code:0}},ft=e=>{const n=[O(e),w(e,"package.json")].filter(t=>t!==void 0&&v(t)).map(t=>[t,k(t,"utf8")]);return()=>{for(const[t,o]of n)k(t,"utf8")!==o&&D(t,o,"utf8")}},Re="<replace-with-d1-create-id>",se=e=>Array.isArray(e)?e.filter(r=>r!=null):void 0,X=(e,r)=>{const n=O(e);if(!n)return;const{parsed:t}=A(n);if(t===void 0)return;const{error:o,merged:a}=Y(t,r),i=o===void 0?a:t,{containers:s,d1_databases:c,vars:d}=i;return{containers:se(s),d1_databases:se(c),vars:typeof d=="object"&&d!==null&&!Array.isArray(d)?d:void 0}},mt=/^127(?:\.\d{1,3}){3}$/,ht=e=>{try{const{hostname:r}=new URL(e);return r==="localhost"||mt.test(r)||r==="::1"||r==="[::1]"}catch{return!1}},pt=e=>e.startsWith("./")||e.startsWith("../")||e.startsWith("/")||e.includes("Dockerfile"),vt=(e,r,n,t="deploy",o)=>{const a=(X(e,o)?.containers??[]).filter(s=>typeof s?.image=="string"&&pt(s.image));if(a.length===0||n())return;const i=`${t} blocked: wrangler.jsonc declares ${String(a.length)} container(s) built from a local Dockerfile, but no Docker-compatible engine is available. Start Docker (or Colima), or point the container's \`image\` at a pre-built registry reference. Note: container images must target linux/amd64.`;return r.error(i),i},Q=e=>v($(e,te))?te:void 0,yt=(e,r,n="deploy",t)=>{for(const o of pe(e,"lunora",t).containers){const a=o.schedulingPolicy===void 0?o.image:void 0,s=[...a?.kind==="dockerfile"?[{field:"image",path:a.dockerfilePath}]:[],...Object.entries(o.schedulingPolicy==="durable_object"?o.images??{}:{}).flatMap(([c,d])=>d.kind==="dockerfile"?[{field:`images["${c}"]`,path:d.dockerfilePath}]:[])].find(c=>!v($(e,c.path)));if(s!==void 0){const c=`${n} blocked: container "${o.exportName}" references a Dockerfile at "${s.path}" that does not exist. Create it or fix the \`${s.field}\` path in lunora/containers.ts.`;return r.error(c),c}if(a?.kind==="build"&&!v($(e,a.buildDir))){const c=`${n} blocked: container "${o.exportName}" references a Railpack build directory "${a.buildDir}" that does not exist. Create it or fix the \`image.build\` path in lunora/containers.ts.`;return r.error(c),c}}},wt=(e,r)=>(X(e,r)?.d1_databases??[]).find(n=>n.database_id===Re)?.binding,kt=e=>{if(!e.migrate||e.dryRun||e.preview)return;if(e.migrateUrl===void 0){const n="--migrate requires --migrate-url <https://your-worker> — the deploy target URL is only known after wrangler runs, and this gate runs before it; refusing to default to localhost";return e.logger.error(n),n}if(e.migrateYes!==!0){const n="--migrate runs production data migrations after deploy. Re-run with --migrate-yes to confirm.";return e.logger.error(n),n}const r=e.migrateToken??process.env.LUNORA_ADMIN_TOKEN;if(r===void 0||r===""){const n="admin token required for --migrate — pass --migrate-token or set LUNORA_ADMIN_TOKEN";return e.logger.error(n),n}},bt=(e,r,n="deploy",t)=>{const o=wt(e,t);if(o===void 0)return;const a=`${n} blocked: the "${o}" D1 binding has a placeholder database_id ("${Re}"). Run \`wrangler d1 create <name>\` to create the database, then replace the placeholder in wrangler.jsonc with the real id before deploying.`;return r.error(a),a},$t=(e,r,n="deploy",t)=>{const o=X(e,t)?.vars;if(!o)return;const a=Object.entries(o).filter(([,s])=>typeof s=="string"&&ht(s)).map(([s])=>s).toSorted((s,c)=>s.localeCompare(c));if(a.length===0)return;const i=`${n} blocked: ${a.join(", ")} in wrangler.jsonc point at localhost. A deployed Worker can't reach a loopback address, so this silently breaks scheduled-job dispatch, reverse cross-shard relations, and auth callbacks. Set each to the deployed worker's public URL (or move it to a secret with \`wrangler secret put\`) before deploying.`;return r.error(i),i},St=(e,r,n)=>{const t=bt(e,r.logger,n,r.env);if(t!==void 0)return{code:y.USAGE,error:t};const o=$t(e,r.logger,n,r.env);if(o!==void 0)return{code:y.USAGE,error:o};const a=yt(e,r.logger,n,r.discoveryCache);if(a!==void 0)return{code:y.USAGE,error:a};const i=vt(e,r.logger,r.dockerAvailable??Dr,n,r.env);return i===void 0?void 0:{code:y.MISSING_DEPENDENCY,error:i}},ce=32,Et=15e3,At=5432,Dt=3306,Rt=/[^a-z0-9-]/gu,Ct=/[^A-Za-z0-9]/gu,_t=/-$/u,_=e=>`LUNORA_${e.replaceAll(Ct,"_").toUpperCase()}_URL`,Pt=e=>{const r=new Map;for(const n of e){const t=_(n),o=r.get(t);if(o!==void 0)return{bindings:[o,n],variable:t};r.set(t,n)}},de=7,It=(e,r)=>{const n=`${e}-${r}`.toLowerCase(),t=n.replaceAll(Rt,"-");if(t===n&&t.length<=ce)return t;const o=br("sha256").update(n).digest("hex").slice(0,de-1);return`${t.slice(0,ce-de).replace(_t,"")}-${o}`},le=e=>e==="postgresql"?"postgres":e==="mariadb"?"mysql":e,Tt=e=>e==="mysql"?Dt:At,jt=e=>{try{const r=new URL(e),n=r.protocol.slice(0,-1),t=decodeURIComponent(r.pathname.slice(1));return!["mariadb","mysql","postgres","postgresql"].includes(n)||r.hostname===""||t===""?void 0:{database:t,host:r.hostname,password:decodeURIComponent(r.password),port:r.port===""?Tt(le(n)):Number(r.port),scheme:le(n),user:decodeURIComponent(r.username)}}catch{return}},Nt=(e,r)=>{const n=typeof r?.password=="string"?r.password:"",t=n===""?[]:[n,JSON.stringify(n).slice(1,-1),encodeURIComponent(n)];let o=e;for(const a of t)o=o.replaceAll(a,"<redacted>");return o.split(" ").map(a=>a.includes("://")?"<url>":a).join(" ")},Ce=e=>(Array.isArray(e)?e:[]).flatMap((r,n)=>{const{binding:t,id:o}=typeof r=="object"&&r!==null?r:{};return typeof t=="string"&&o===Ye?[{binding:t,index:n}]:[]}),z=e=>{let r="";try{const{errors:n}=JSON.parse(e.text);r=(n??[]).flatMap(t=>typeof t.message=="string"?[t.message]:[]).slice(0,2).join("; ")}catch{}return r===""?`HTTP ${String(e.status)}`:`HTTP ${String(e.status)}: ${r}`},xt=e=>typeof e=="string"||typeof e=="number"?e.toString():void 0,Lt=["scheme","host","port","database","user"],Ot=e=>e==="postgresql"?"postgres":e,ue=(e,r)=>{const n=xt(r);return e==="scheme"?Ot(n):n},ge=50,Mt=async(e,r)=>{for(let n=1;n<=ge;n+=1){const t=await e(n===1?"/hyperdrive/configs":`/hyperdrive/configs?page=${String(n)}`);if(!t.ok)throw new Error(`listing Hyperdrive configs failed (${z(t)})`);if(!Array.isArray(t.body.result))throw new TypeError("the listing of Hyperdrive configs had no result list");const o=t.body.result.find(i=>i.name===r),a=typeof t.body.result_info=="object"&&t.body.result_info!==null?t.body.result_info:{};if(o!==void 0||typeof a.total_pages!="number"||n>=a.total_pages)return o}throw new Error(`the listing of Hyperdrive configs has more than ${String(ge)} pages, so "${r}" can't be shown to be absent`)},Ut=async(e,r,n)=>{const t=await Mt(e,r);if(typeof t?.id=="string"){const i=Lt.filter(c=>ue(c,t.origin?.[c])!==ue(c,n[c]));if(i.length>0)throw new Error(`a Hyperdrive config named "${r}" already exists for a different origin, or one that can't be confirmed (${i.join(", ")}). Delete it, or rename the Worker, so the binding does not reach the wrong database.`);const s=await e(`/hyperdrive/configs/${encodeURIComponent(t.id)}`,{body:JSON.stringify({origin:n}),method:"PATCH"});if(!s.ok)throw new Error(`updating its credentials failed (${z(s)})`);return{id:t.id,reused:!0}}const o=await e("/hyperdrive/configs",{body:JSON.stringify({name:r,origin:n}),method:"POST"});if(!o.ok)throw new Error(`creating it failed (${z(o)})`);const{id:a}=typeof o.body.result=="object"&&o.body.result!==null?o.body.result:{};if(typeof a!="string")throw new TypeError("the response carried no id");return{id:a,reused:!1}},Ft=(e,r,n,t)=>r===void 0&&t?`${_(e)} is set but is not a usable connection string for the "${e}" Hyperdrive binding: it needs a postgres://, postgresql:// or mysql:// scheme, a host and a database name, with any special characters percent-encoded.`:r===void 0?`the "${e}" Hyperdrive binding has no config yet. Set ${_(e)} to its postgres:// or mysql:// connection string and Lunora creates the config, or run \`wrangler hyperdrive create\` and put its id in wrangler.jsonc.`:n?void 0:`creating the "${e}" Hyperdrive config needs CLOUDFLARE_API_TOKEN (Hyperdrive: Edit) and CLOUDFLARE_ACCOUNT_ID, or run \`wrangler hyperdrive create\` and put its id in wrangler.jsonc.`,Ht=async(e,r)=>{const n=It(e.workerName,e.binding),{id:t,reused:o}=await Ut(async(a,i)=>Tr({accountId:e.accountId,apiToken:e.token,...e.fetch===void 0?{}:{fetch:e.fetch},init:{...i,signal:AbortSignal.timeout(Et)},path:a}),n,e.origin);return e.logger.success(`${o?"reusing":"created"} Hyperdrive config "${n}" for ${e.binding} → ${e.wranglerPath}`),{id:t,text:$e(r,[...e.path,e.index,"id"],t)}},Wt=e=>e===void 0||e===""?void 0:e,Bt=e=>{const r=w(L(e),".wrangler","deploy","config.json");try{const{configPath:n}=JSON.parse(k(r,"utf8"));return typeof n=="string"?q(L(r),n):void 0}catch{return}},Gt=(e,r,n,t,o)=>{const a=Bt(e);if(a===void 0||a===e)return;if(t.built!==t.deployed){o.warn(`the build output ${a} was made for ${t.built===void 0?"the default environment":`"${t.built}"`}, not ${t.deployed===void 0?"the default environment":`"${t.deployed}"`}, so the "${r}" Hyperdrive id was not written there. Build with CLOUDFLARE_ENV set to the environment you deploy, then deploy again.`);return}let i;try{i=A(a)}catch{return}const s=Ce(i.parsed?.hyperdrive).find(c=>c.binding===r);s!==void 0&&D(a,$e(i.text,["hyperdrive",s.index,"id"],n),"utf8")},Vt=(e,r)=>{const n=typeof e.name=="string"&&e.name!==""?e.name:"lunora";if(r===void 0)return n;const t=e.env?.[r]?.name;return typeof t=="string"&&t!==""?t:`${n}-${r}`},Z=(e,r)=>{const n=O(e),t=n===void 0?void 0:A(n).parsed;if(n===void 0||t===void 0)return;const o=r===void 0?void 0:t.env?.[r],a=Ce(r===void 0?t.hyperdrive:o?.hyperdrive);return a.length===0?void 0:{accountId:o?.account_id??t.account_id,entries:a,path:r===void 0?["hyperdrive"]:["env",r,"hyperdrive"],workerName:Vt(t,r),wranglerPath:n}},zt=(e,r,n)=>{const t=Pt(e.map(({binding:o})=>o));if(t!==void 0){const o=`deploy blocked: the Hyperdrive bindings ${t.bindings.map(a=>`"${a}"`).join(" and ")} both read ${t.variable} and would share one config. Rename one so their names differ in letters or digits, not only in punctuation.`;return n.logger.error(o),o}for(const{binding:o,origin:a,supplied:i}of e){const s=Ft(o,a,r,i);if(s!==void 0&&n.dryRun===!0)n.logger.warn(`dry run: ${s} A real deploy stops here.`);else if(s!==void 0){const c=`deploy blocked: ${s}`;return n.logger.error(c),c}}},qt=async e=>{const r=Z(e.cwd,e.wranglerEnvironment);if(r===void 0)return;const{entries:n,path:t,wranglerPath:o}=r,a=e.environment??process.env,{accountId:i,token:s}=Ir(a,r.accountId),c=n.map(({binding:l})=>{const g=a[_(l)]??"";return{binding:l,origin:jt(g),supplied:g!==""}}),d=zt(c,s!==void 0&&i!==void 0,e);if(d!==void 0)return d;if(!(e.dryRun===!0||e.checkOnly===!0))for(const[l,{binding:g,index:f}]of n.entries()){const m=c[l]?.origin;if(!(m===void 0||s===void 0||i===void 0))try{const{id:u,text:h}=await Ht({accountId:i,binding:g,fetch:e.fetch,index:f,logger:e.logger,origin:m,path:t,token:s,workerName:r.workerName,wranglerPath:o},k(o,"utf8"));D(o,h,"utf8"),Gt(o,g,u,{built:Wt(a.CLOUDFLARE_ENV),deployed:e.wranglerEnvironment},e.logger)}catch(u){const h=u instanceof Error?u.message:String(u),p=`deploy blocked: the "${g}" Hyperdrive config could not be set up: ${Nt(h,c[l]?.origin)}`;return e.logger.error(p),p}}},Kt=(e,r)=>{const n=Z(e,r.env)?.entries[0]?.binding;if(n===void 0)return;const t=`prepare blocked: the "${n}" Hyperdrive binding still has its placeholder id. Run \`lunora deploy\` with ${_(n)} set to create the config, or put the id from \`wrangler hyperdrive create\` in wrangler.jsonc.`;return r.logger.error(t),t},Yt=(e,r)=>{const n=Z(e,r.env)?.entries[0]?.binding;if(n===void 0)return;const t=`deploy blocked: the "${n}" Hyperdrive binding has no config, and a --temporary deploy cannot create one: it would be made in your account while the Worker goes to a temporary one, which a temporary account has no database for. Deploy without --temporary.`;return r.logger.error(t),t},_e=async(e,r,n,t,o="create")=>{if(t==="cloudflare")return n==="prepare"?Kt(e,r):r.temporary===!0?Yt(e,r):qt({checkOnly:o==="check",cwd:e,dryRun:r.dryRun,logger:r.logger,wranglerEnvironment:r.env})},Jt=/https?:\/\/[^\s"'<>]+\.workers\.dev[^\s"'<>]*/u,Xt=/https:\/\/[^\s"'<>]+/u,Qt=e=>{if(e===void 0)return;const r=Jt.exec(e);return r?r[0]:Xt.exec(e)?.[0]},fe=e=>e===void 0?"":` (--env ${e})`,Zt=({cwd:e,env:r,logger:n,now:t,url:o})=>{if(o!==void 0)try{const a=he(e);if(a!==void 0){if(a.workerUrl===o&&a.env===r)return;n.warn(`link: .lunora/project.json records ${a.workerUrl??"(no url)"}${fe(a.env)}, but this deploy published ${o}${fe(r)}. Keeping the recorded value — run \`lunora link --url ${o}${r===void 0?"":` --env ${r}`}\` to update it.`);return}const i=(t??(()=>new Date().toISOString()))();Fe(e,{env:r,linkedAt:i,workerName:J(e),workerUrl:o}),n.success(`link: recorded ${o} in .lunora/project.json (run \`lunora link\` to change)`)}catch{}},en=async(e,r)=>{const n=new jr({skipAddingFilesFromTsConfig:!0}),t=$(r,"lunora");let o;try{o=xe(n,t)}catch(a){const i=a instanceof Error?a.message:String(a);return e.logger.warn(`--migrate: could not discover migrations (${i}); skipping`),0}if(o.length===0)return e.logger.info("--migrate: no data migrations declared in lunora/"),0;e.logger.info(`--migrate: running ${String(o.length)} migration(s) against deployed worker`);for(const a of o){e.logger.info(`--migrate: up "${a.id}" (table "${a.table}")`);const i={cwd:r,fetchImpl:e.fetchImpl,id:a.id,logger:e.logger,prod:!0,subcommand:"up",token:e.migrateToken,url:e.migrateUrl,yes:e.migrateYes===!0},s=await Nr(i);if(s.code!==0)return e.logger.error(`--migrate: migration "${a.id}" failed — see output above`),s.code;e.logger.success(`--migrate: "${a.id}" applied`)}return 0},rn=async(e,r)=>{const{info:n}=ve(r,"lunora",e.discoveryCache),t=n?.vectorMetadata??[];if(t.length===0)return;const o=[];for(const s of t){const c=ur(s.kind);if(c===void 0){e.logger.warn(`vector index "${s.index}" declares metadata "${s.property}", whose column type cannot be filtered on in Vectorize — it is stored with each vector but no filter will match it.`);continue}o.push({index:s.index,property:s.property,type:c})}if(o.length===0)return;const i=(await gr({cwd:r,entries:o,exec:Ee(R(r),"wrangler",[]),logger:e.logger,spawner:e.spawner??M})).filter(s=>s.status!=="failed").length;i>0&&e.logger.success(`vectorize metadata indexes ready: ${String(i)}/${String(o.length)}`)},me=5,tn=2e3,nn=async(e,r,n)=>{if(e.healthCheck!==!0)return;const t=n??Ae({cwd:r,env:e.env});if(t===void 0){const a="--health-check: the deploy succeeded, but no URL to probe could be resolved — wrangler's output carried none and this checkout has no link for this environment. Run `lunora link --url <https://your-worker>` and re-deploy, or drop --health-check.";return e.logger.error(a),{error:a,ok:!1,url:""}}const o=await Rr({attempts:me,baseUrl:t,delayMs:tn,fetchImpl:e.healthFetch,paths:[Cr,_r],sleep:e.healthSleep});return o.error===void 0?(e.logger.success(`health check ok (${o.url})`),{ok:!0,url:o.url}):(e.logger.error(`--health-check: the deploy succeeded, but the new version did not answer after ${String(me)} attempt(s) — ${o.error}`),{error:o.error,ok:!1,url:o.url})},on=async(e,r,n,t,o,a)=>{await rn(e,r);const i=e.migrate?await en(e,r):0;return i===0&&o?.(),{code:i,descriptor:n,mintedSecretsFile:a,validation:t}},an=async({cwd:e,descriptor:r,mintedSecretsFile:n,options:t,reblessSchemaBaseline:o,recordArchitecture:a,stdout:i,validation:s})=>{const c={deployedAt:new Date().toISOString(),dryRun:t.dryRun===!0,env:t.env,preview:t.preview===!0,url:t.dryRun===!0?void 0:Qt(i),workerName:J(e)};if(t.dryRun===!0||t.preview===!0)return t.healthCheck===!0&&t.logger.warn(`--health-check skipped: ${t.dryRun===!0?"a dry run publishes nothing":"a preview version serves no live traffic"}`),{code:0,deployment:c,descriptor:r,mintedSecretsFile:n,validation:s};t.temporary!==!0&&(a?.(),Zt({cwd:e,env:t.env,logger:t.logger,url:c.url}));const d=await nn(t,e,c.url);return d?.error!==void 0?{code:y.UNAVAILABLE,deployment:c,descriptor:r,healthCheck:d,mintedSecretsFile:n,validation:s}:{...await on(t,e,r,s,o,n),deployment:c,healthCheck:d}},sn=(e,r,n)=>{const t=$(e,S);if(!v(t))return;let o;try{o=ye(k(t,"utf8")).length}catch{return}if(o===0)return;const a=n.toolchain?.secretPut!==void 0;r.warn(a?`Note: \`lunora deploy\` does not push secrets. ${S} has ${String(o)} key(s); if you changed them, run \`lunora env push --yes\` to update the deployed secrets.`:`Note: ${n.name} deploys read no secrets. ${S} has ${String(o)} key(s) that only the dev server sees; put the values the deployed worker needs in wrangler \`vars\`.`)},cn=async(e,r)=>{let n=[];try{n=He(await we({cache:r,projectRoot:e,schemaDir:P(e)}))}catch{}const t=We(n).map(a=>a.key);let o=[];try{const a=$(e,S);v(a)&&(o=ye(k(a,"utf8")).map(i=>i.key).filter(i=>fr(i)))}catch{}return[...new Set([...t,...o])]},dn=async(e,r,n,t)=>{const{logger:o}=r,a=r.spawner??M,i=R(e),s=r.env===void 0?"":` --env ${r.env}`,c=t.toolchain?.secretPut;if(c===void 0)return o.error(`deploy target "${t.id}" has no secret store; cannot push secrets`),{minted:[],ok:!1};const d=n.map(f=>({key:f,value:Be()})),l=t.toolchain?.secretBulk;if(l!==void 0&&d.length>=2){const f=C(i,l({environment:r.env,temporary:r.temporary})),m=await a({args:f.args,command:f.command,cwd:e,input:JSON.stringify(Object.fromEntries(d.map(u=>[u.key,u.value])))});if(m.code===0){for(const{key:u}of d)o.success(`generated + pushed ${u}`);return{minted:d,ok:!0}}o.warn(`bulk secret push failed (exit ${String(m.code)}); retrying one key at a time`)}const g=[];for(const{key:f,value:m}of d){const u=c({environment:r.env,key:f,temporary:r.temporary}),h=C(i,u),p=await a({args:h.args,command:h.command,cwd:e,input:m});if(p.code!==0)return o.error(`failed to push secret ${f} (exit ${String(p.code)}); set it manually with \`wrangler secret put ${f}${s}\`.`),{minted:g,ok:!1};g.push({key:f,value:m}),o.success(`generated + pushed ${f}`)}return{minted:g,ok:!0}},ln=/^[\w-]+$/u,B=[".dev.vars",".dev.vars.*","!.dev.vars.example"],un=/\r?\n/u,gn=(e,r)=>{const n=$(e,".gitignore");try{const t=v(n)?k(n,"utf8"):"",o=new Set(t.split(un).map(c=>c.trim())),a=B.filter(c=>!o.has(c));if(a.length===0)return;const i=a.some(c=>!c.startsWith("!"))?[...a.filter(c=>!c.startsWith("!")),...B.filter(c=>c.startsWith("!"))]:a,s=t.length>0&&!t.endsWith(`
+`)?`
+`:"";D(n,`${t}${s}
+# Lunora — never commit a minted secret
+${i.join(`
+`)}
+`,"utf8"),r.info(`.gitignore: added ${a.join(", ")} so the recorded secret cannot be committed`)}catch(t){r.warn(`could not update .gitignore (${t instanceof Error?t.message:String(t)}) — add \`${B.join("` and `")}\` by hand before committing.`)}},fn=(e,r,n)=>{if(n.length===0)return;const t=n.map(s=>s.key).join(", ");if(r.env!==void 0&&!ln.test(r.env)){r.logger.warn(`${t}: minted and pushed for --env ${r.env}, but "${r.env}" isn't a safe filename fragment — the value could not be recorded. Capture it manually if you need it again.`);return}const o=r.env===void 0?S:`${S}.${r.env}`;gn(e,r.logger);const a=$(e,o);let i=v(a)?k(a,"utf8"):"";for(const s of n)i=Ge(i,s.key,s.value);return Ve(a,i),r.logger.success(r.env===void 0?`${t}: value(s) recorded in ${o}`:`${t}: value(s) recorded in ${o} (kept separate from ${S} so \`lunora dev\` and a plain \`lunora env push\` don't inherit the --env ${r.env} value)`),o},mn=async(e,r,n,t)=>{if(r.dryRun===!0||r.preview===!0)return{};const{logger:o}=r,a=r.env===void 0?"":` --env ${r.env}`;let i;try{i=await(r.secretLister??Lr)({cwd:e,env:r.env,temporary:r.temporary})}catch{return{}}if(!i.ok)return{};const s=new Set(i.names),d=(await cn(e,r.discoveryCache)).filter(f=>!s.has(f));if(d.length===0)return{};if(!n)return{error:`missing required secret(s) on the deploy target: ${d.join(", ")}. Set them with \`wrangler secret put <KEY>${a}\` (or \`lunora env generate --set\` then \`lunora env push --yes${a}\`), then re-deploy.`};for(const f of d.filter(m=>!ne(m)))o.warn(`required secret ${f} is not set on the target — set it with: wrangler secret put ${f}${a}`);const l=d.filter(f=>ne(f));if(l.length===0)return{};if(await(r.secretConfirm??xr())(`${String(l.length)} required secret(s) not set on the target (${l.join(", ")}). Generate strong values and push them now?`)){const{minted:f,ok:m}=await dn(e,r,l,t),u=fn(e,r,f);return m?{mintedSecretsFile:u}:{error:"failed to push required secret(s) — set them manually and re-deploy",mintedSecretsFile:u}}return o.warn(`${String(l.length)} required secret(s) not set on the target: ${l.join(", ")}. Generate + push with \`lunora env generate --set\` then \`lunora env push --yes${a}\`.`),{}},Pe=e=>e.format==="json"?!1:e.interactive!==void 0?e.interactive:process.stdout.isTTY&&!process.env.CI,hn=async(e,r)=>{if(r.dryRun===!0)return;const n=pe(e,"lunora",r.discoveryCache).containers.flatMap(o=>o.schedulingPolicy===void 0&&o.image.kind==="build"?[{buildDir:o.image.buildDir,exportName:o.exportName}]:[]);if(n.length===0)return;const t=await gt({cwd:e,logger:r.logger,railpackAvailable:r.railpackAvailable,spawner:r.spawner,targets:n});return t.code===0?void 0:t.error??"railpack build failed"},pn=(e,r,n)=>{if(n!==void 0)try{const t=rr(e,n);t.changed&&r.success(`synced ${String(n.length)} cron trigger(s) → ${t.wranglerPath??"wrangler.jsonc"}`);for(const a of t.warnings)r.warn(a);const o=tr(t.preserved);o!==void 0&&r.info(o)}catch(t){const o=t instanceof Error?t.message:String(t);r.warn(`cron trigger sync skipped: ${o}`)}},vn=async(e,r,n,t,o,a)=>{try{K(t);const i=await we({cache:a,projectRoot:e,schemaDir:P(e)}),s=Ze(e,i,{environment:o,target:t}),c=s.wranglerPath??"wrangler.jsonc";if(s.added.length>0&&r.success(`provisioned bindings: ${s.added.join(", ")} → ${c}`),s.updated.length>0&&r.success(`updated bindings: ${s.updated.join(", ")} → ${c}`),s.devConfig!==void 0){const{added:d,path:l,updated:g}=s.devConfig;r.success(`dev sidecar bindings: ${[...d,...g].join(", ")} → ${l}`)}for(const d of s.warnings)r.warn(d)}catch(i){const s=i instanceof Error?i.message:String(i);r.warn(`binding inference skipped: ${s}`)}try{const i=er(e);i.changed&&r.success(`bumped compatibility_date to ${i.date??"unknown"} (Workers Cache enabled) → ${i.wranglerPath??"wrangler.jsonc"}`)}catch(i){const s=i instanceof Error?i.message:String(i);r.warn(`compatibility date sync skipped: ${s}`)}pn(e,r,n)},yn=async(e,r,n,t,o,a,i,s,c)=>{let d;r?(d=new nr({name:"dots"}),d.start("running codegen")):n.info("running codegen");try{const l=Le({apiSpec:t,lazyFunctions:o,projectRoot:e,target:a,...Qe(e)});d?.succeed("codegen complete"),d||n.success("codegen complete");const g=ar(l.platformDiagnostics,n);if(g.errors.length>0)return{error:g.errors.join("; ")};const{errorAdvisories:f,names:m,shouldBlock:u}=ir(l.advisories,c);if(u){const p=`${f.length.toString()} ERROR-level ${f.length===1?"advisory":"advisories"} (${m.join(", ")}). Pass --no-strict-advisories to downgrade this to a warning and continue.`;return n.error(p),{error:p}}const h=await qe({cwd:e,logger:n,spawner:i,stdoutToStderr:s});return h.error!==void 0?{error:h.error}:{result:l}}catch(l){d?.failed("codegen failed");const g=l instanceof Error?l.message:String(l);return n.error(`codegen failed: ${g}`),{error:`codegen failed: ${g}`}}},wn=(e,r)=>({dryRun:r.dryRun,entry:Q(e),environment:r.env,outDir:r.outDir,preview:r.preview,temporary:r.temporary}),Ie=(e,r,n)=>{const{toolchain:t}=n;if(t===void 0)throw new Error(`deploy target "${n.id}" has no command-line toolchain`);const o=wn(e,r);return be(n,e,"deploy",a=>t.deploy({...o,configPath:a}))},kn=(e,r,n)=>{const t=Ie(e,r,n),o=Q(e);return o!==void 0&&r.logger.info(`class-B composition: deploying ${o} (overrides wrangler main)`),r.temporary&&r.logger.info("temporary account: deploying to a short-lived Cloudflare account (~60min); wrangler will print a claim URL"),r.dryRun&&r.logger.info("dry run: validating + bundling without publishing"),r.outDir!==void 0&&r.logger.info(`build artifact: emitting bundle to ${r.outDir}`),t.commit(),t.projection!==void 0&&t.projection.dropped.length>0&&r.logger.warn(`${n.name} ignores these wrangler keys, so they were left out of ${t.projection.configPath}: ${t.projection.dropped.join(", ")}`),t.command},G=(e,r)=>({code:y.USAGE,descriptor:void 0,error:e,validation:{problems:[],wranglerPath:void 0},...r}),bn=(e,r)=>{for(const n of e.report?.warnings??[])r.warn(`wrangler.jsonc: ${n}`);if(e.problems.length===0)return!1;r.error("wrangler.jsonc validation failed:");for(const n of e.problems)r.error(`  - ${n}`);return!0},$n=(e,r,n)=>{const t=r.format==="json",o=r.dryRun!==!0,a=kn(e,r,n),i=C(R(e),a);return{args:i.args,captureStdout:o&&!t,captureStdoutSilently:o&&t,command:i.command,cwd:e,stdoutToStderr:t&&!o}},Sn=async(e,r)=>{const n=e.cwd??process.cwd(),t=Pe(e),o=or(e),a={problems:[],wranglerPath:void 0},i=yr(n,e.target);if(i.target===void 0){const u=i.error??"unknown deploy target";return e.logger.error(u),{error:u,validation:a}}const{target:s}=i;try{Ie(n,e,K(s))}catch(u){const h=u instanceof Error?u.message:String(u);return e.logger.error(h),{error:h,target:s,validation:a}}let c;if(!e.skipCodegen){const u=await yn(n,t,e.logger,e.apiSpec,ke(e.lazyFunctions),s,e.spawner,e.format==="json",o);if(u.error!==void 0)return{error:u.error,target:s,validation:a};c=u.result,e.discoveryCache?.clear()}let d;if(c!==void 0){const u=Pr({allowDrift:e.allowSchemaDrift===!0,codegen:c,command:r,logger:e.logger,updateBaseline:e.updateSchemaBaseline===!0});if(u.blocked)return{error:`schema drift gate blocked ${r}`,schemaDrift:{blocked:!0,reason:u.reason},target:s,validation:a};d=u.rebless}const l=c&&Br({current:c.architecture,cwd:n,environment:e.env,logger:e.logger});await vn(n,e.logger,c?.cronTriggers,s,e.env,e.discoveryCache);const g=await _e(n,e,r,s,"check");if(g!==void 0)return{error:g,target:s,validation:a};const f=St(n,e,r);if(f!==void 0)return{code:f.code,error:f.error,target:s,validation:a};const m=Xe({environment:e.env,projectRoot:n});return bn(m,e.logger)?{error:"wrangler validation failed",target:s,validation:m}:{codegen:c,reblessSchemaBaseline:d,recordArchitecture:l,target:s,validation:m}},En=e=>{if(e.skipServices===!0)return"--skip-services";if(e.preview===!0)return"--preview uploads the app version only";if(e.temporary===!0)return"--temporary deploys the app to a throwaway account"},An=async(e,r,n,t)=>{const{error:o,services:a}=Oe(e);if(o!==void 0)return o;if(a.length===0)return;const{toolchain:i}=n,s=i===void 0?`target "${n.id}" has no deploy command`:En(r);if(s!==void 0||i===void 0){const l=a.map(g=>g.worker).join(", ");r.logger.warn(`services not deployed (${s??""}): ${l} — deploy them yourself if the app calls anything new`);return}const c=R(e),d=[...new Map(a.map(l=>[l.wranglerPath,l])).values()];for(const l of d){const g=L(l.wranglerPath);let f;try{f=be(n,g,"deploy",h=>i.deploy({configPath:h??l.wranglerPath,dryRun:r.dryRun===!0,environment:r.env}))}catch(h){return`service ${l.name} (${l.worker}): ${h instanceof Error?h.message:String(h)}`}f.commit();const m=C(c,f.command);r.logger.info(`deploying service ${l.name} (${l.worker}) via ${m.command} ${m.args.join(" ")}`);const u=await t({args:m.args,command:m.command,cwd:g,stdoutToStderr:r.format==="json"});if(u.code!==0)return`service ${l.name} (${l.worker}): ${m.command} ${m.args.join(" ")} exited ${String(u.code)} — stopping before the app`}},Dn=async(e,r,n,t)=>{if(r!=="cloudflare")return;const o=e===void 0?void 0:A(e).parsed,a=(n===void 0?void 0:o?.env?.[n]?.account_id)??o?.account_id,i=await hr({accountId:a});(i.verdict==="near"||i.verdict==="full")&&t.warn(i.fix===void 0?i.message:`${i.message} ${i.fix}`)},Rn=e=>e.dryRun!==!0&&e.temporary!==!0,Cn=e=>e.temporary===!0?"temporary":e.dryRun===!0?"preview":"defer",_n=e=>{const r=e.fix===void 0?e.message:`${e.message} ${e.fix}`;return e.verdict==="unchecked"?`${r} The deploy stops until it can be checked, as a namespace made by the first repo is unrestricted.`:r},Pn=(e,r,n)=>{const t=[];for(const o of e)if(o.verdict==="ok")o.changesAccount===!0&&r.info(o.message);else if(o.verdict==="unchecked"&&n==="preview")r.warn(`dry run: ${o.message}${o.fix===void 0?"":` ${o.fix}`} A real deploy stops here.`);else{const a=_n(o);r.error(a),t.push(a)}return t},Te=async(e,r,n,t,o,a,i)=>{const s=n==="cloudflare"&&r!==void 0?A(r).parsed:void 0;if(s===void 0)return;const c=(Y(s,t).merged.artifacts??[]).flatMap(u=>typeof u?.binding=="string"&&typeof u.namespace=="string"?[{binding:u.binding,namespace:u.namespace}]:[]),d=c.length===0?void 0:ve(e,P(e),a).info?.jurisdiction;if(d===void 0)return;const l=[...new Map(c.map(u=>[u.namespace,u])).values()];if(i==="temporary"){o.warn(`--temporary deploys to a throwaway account, so the jurisdiction ("${d}") of Artifacts namespace ${l.map(u=>`"${u.namespace}"`).join(", ")} was not checked: it is created there on first use, in no jurisdiction.`);return}const g=(t===void 0?void 0:s.env?.[t]?.account_id)??s.account_id,f=await Promise.all(l.map(async u=>mr({...u,accountId:g,create:i==="create",jurisdiction:d,missingOk:i==="defer"||i==="preview"}))),m=Pn(f,o,i);return m.length===0?void 0:m.join(`
+`)},In=async(e,r,n,t,o,a)=>(Rn(r)?await Te(e,a,o,r.env,r.logger,r.discoveryCache,"create"):void 0)??await _e(e,r,"deploy",o)??await An(e,r,n,t),Tn=async(e,r,n,t)=>{if(!(r.smokeLoad===!1||n.toolchain===void 0))return ut({composedEntry:Q(e),configPath:t,cwd:e,environment:r.env,launcher:r.smokeLauncher,logger:r.logger,toolchain:n.toolchain})},jn=async e=>{const r={...e,discoveryCache:e.discoveryCache??ze()},n=r.cwd??process.cwd(),t=Pe(r),o=await Sn(r,r.commandName??"deploy");if(o.error!==void 0){if(o.validation.problems.length>0)return{code:y.USAGE,descriptor:void 0,error:o.error,validation:o.validation};const p=o.schemaDrift===void 0?void 0:{schemaDrift:o.schemaDrift};return G(o.error,{...p,...o.code===void 0?{}:{code:o.code}})}const{validation:a}=o,i=K(o.target),s=kt(r)??await Te(n,a.wranglerPath,o.target,r.env,r.logger,r.discoveryCache,Cn(r))??await Tn(n,r,i,a.wranglerPath);if(s!==void 0)return G(s);const c=i.toolchain?.prebuildsContainerImages===!0?await hn(n,r):void 0;if(c!==void 0)return G(c);sn(n,r.logger,i),Je(n,p=>{r.logger.warn(p)}),await Dn(a.wranglerPath,o.target,r.env,r.logger);const{error:d,mintedSecretsFile:l}=await mn(n,r,t,i);if(d!==void 0)return r.logger.error(d),{code:y.USAGE,descriptor:void 0,error:d,mintedSecretsFile:l,validation:a};const g=r.spawner??M,f=await In(n,r,i,g,o.target,a.wranglerPath);if(f!==void 0)return{code:y.FAILURE,descriptor:void 0,error:f,mintedSecretsFile:l,validation:a};const m=$n(n,r,i);r.logger.info(`deploying via ${m.command} ${m.args.join(" ")}`);const u=await g(m);return m.captureStdoutSilently===!0&&u.stdout!==void 0&&u.stdout!==""&&process.stderr.write(u.stdout),u.code!==0?{code:u.code,descriptor:m,mintedSecretsFile:l,validation:a}:{...await an({...o,cwd:n,descriptor:m,mintedSecretsFile:l,options:r,stdout:u.stdout}),logsAvailable:i.toolchain?.tail!==void 0}},Nn=async e=>{const{logger:r}=e,n=e.dryRun===!0?ft(e.cwd??process.cwd()):void 0;let t;try{if(t=await jn({...e,logger:r}),t.code===0&&e.emitBindings!==void 0){const{error:o}=pr({destination:e.emitBindings,logger:r,projectRoot:e.cwd??process.cwd()});o!==void 0&&(r.error(o),t={...t,code:y.USAGE})}}finally{n?.()}if(e.format==="json")return t;if(t.code===0&&e.dryRun!==!0&&e.preview!==!0)Gr({cwd:e.cwd??process.cwd(),env:e.env,logger:e.logger,logsAvailable:t.logsAvailable===!0,mintedSecretsFile:t.mintedSecretsFile,url:t.deployment?.url});else if(t.code===0&&e.preview===!0){const o=t.deployment?.url;e.logger.success(o===void 0?"preview version uploaded":`preview version uploaded — ${o}`)}return t},go=vr(async({cwd:e,format:r,logger:n,options:t})=>{const o=await Nn({allowSchemaDrift:t.allowSchemaDrift===!0,apiSpec:sr(t.apiSpec),lazyFunctions:ke(t.lazyFunctions),cwd:e,dryRun:t.dryRun===!0,env:t.env,format:r,healthCheck:t.healthCheck===!0,logger:n,migrate:t.migrate===!0,migrateToken:t.migrateToken,migrateUrl:Ae({cwd:e,env:t.env,url:t.migrateUrl}),migrateYes:t.migrateYes===!0,preview:t.preview===!0,skipCodegen:t.prebuilt===!0,skipServices:t.skipServices===!0,smokeLoad:t.smokeLoad,strictAdvisories:t.strictAdvisories,target:t.target,temporary:t.temporary===!0,updateSchemaBaseline:t.updateSchemaBaseline===!0});return{code:o.code,data:{deployment:o.deployment,healthCheck:o.healthCheck,mintedSecretsFile:o.mintedSecretsFile,schemaDrift:o.schemaDrift,validation:o.validation},error:o.error}});export{go as execute,vn as provisionBindings,Nn as runDeployCommand,Sn as runPreDeployPipeline,Tn as smokeLoadLazyModules};