@ninemind/agentgem 0.1.0

package/dist/gem/registry.js

@@ -0,0 +1,233 @@
+import { readGemArchive, computeLock, verifyLock, writeGemArchive, readGemMeta } from "./archive.js";
+import { materialize } from "./targets.js";
+export const REGISTRY_FORMAT_VERSION = 1;
+const SEG = /^[a-z0-9-]+$/;
+export function parseRef(input) {
+    const at = input.indexOf("@", 1); // a version "@" can only appear after the leading "@scope/name"
+    const body = at > 0 ? input.slice(0, at) : input;
+    const range = at > 0 ? input.slice(at + 1) : "latest";
+    if (!body.startsWith("@"))
+        throw new Error(`invalid ref '${input}': must start with a scope, e.g. @scope/name`);
+    const slash = body.indexOf("/");
+    if (slash < 0)
+        throw new Error(`invalid ref '${input}': missing scope separator '/'`);
+    const scope = body.slice(1, slash);
+    const name = body.slice(slash + 1);
+    if (!SEG.test(scope) || !SEG.test(name))
+        throw new Error(`invalid ref '${input}': scope/name must match [a-z0-9-]`);
+    if (range !== "latest" && !/^\^?\d+\.\d+\.\d+$/.test(range))
+        throw new Error(`invalid ref '${input}': bad version range '${range}'`);
+    return { key: `@${scope}/${name}`, scope, name, range };
+}
+// ── minimal semver (exact + caret only; no external dep) ──
+function parseSemver(v) {
+    const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v);
+    if (!m)
+        throw new Error(`invalid semver '${v}'`);
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function cmpSemver(a, b) {
+    const x = parseSemver(a), y = parseSemver(b);
+    for (let i = 0; i < 3; i++)
+        if (x[i] !== y[i])
+            return x[i] - y[i];
+    return 0;
+}
+function satisfies(version, range) {
+    if (!range.startsWith("^"))
+        return cmpSemver(version, range) === 0;
+    const base = range.slice(1);
+    const [bMaj, bMin] = parseSemver(base);
+    const [vMaj, vMin] = parseSemver(version);
+    if (cmpSemver(version, base) < 0)
+        return false; // must be >= base
+    if (bMaj > 0)
+        return vMaj === bMaj; // ^1.2.3 := >=1.2.3 <2.0.0
+    if (bMin > 0)
+        return vMaj === 0 && vMin === bMin; // ^0.2.3 := >=0.2.3 <0.3.0
+    return cmpSemver(version, base) === 0; // ^0.0.3 := exact
+}
+export function selectVersion(item, range) {
+    if (range === "latest") {
+        if (item.versions[item.latest] === undefined)
+            throw new Error(`latest version '${item.latest}' is not present in the item's versions`);
+        return item.latest;
+    }
+    const matches = Object.keys(item.versions).filter((v) => satisfies(v, range));
+    if (matches.length === 0)
+        throw new Error(`no version of item satisfies '${range}'`);
+    return matches.sort(cmpSemver)[matches.length - 1];
+}
+export function resolveGraph(rootRefs, index) {
+    const chosen = new Map(); // key -> selection
+    const choose = (ref, requestedBy) => {
+        const { key, range } = parseRef(ref);
+        const item = index.items[key];
+        if (!item)
+            throw new Error(`unknown item '${key}' (requested by ${requestedBy})`);
+        const version = selectVersion(item, range);
+        const prev = chosen.get(key);
+        if (prev && prev.version !== version) {
+            throw new Error(`version conflict for ${key}: ${prev.by} wants ${prev.version}, ${requestedBy} wants ${version}`);
+        }
+        if (!prev)
+            chosen.set(key, { version, by: requestedBy });
+        return { key, version };
+    };
+    const order = [];
+    const state = new Map();
+    const visit = (key, version, trail) => {
+        const s = state.get(key);
+        if (s === "done")
+            return;
+        if (s === "visiting")
+            throw new Error(`dependency cycle: ${[...trail, key].join(" -> ")}`);
+        state.set(key, "visiting");
+        const v = index.items[key].versions[version];
+        if (v === undefined)
+            throw new Error(`resolved version ${key}@${version} not found in the index`);
+        const depKeys = [];
+        for (const depRef of v.dependencies) {
+            const { key: dKey, version: dVer } = choose(depRef, `${key}@${version}`);
+            depKeys.push(dKey);
+            visit(dKey, dVer, [...trail, key]);
+        }
+        order.push({ key, version, path: v.path, gemDigest: v.gemDigest, deps: depKeys });
+        state.set(key, "done");
+    };
+    for (const ref of rootRefs) {
+        const { key, version } = choose(ref, "(root)");
+        visit(key, version, []);
+    }
+    return order;
+}
+const artifactContentKey = (a) => JSON.stringify(a);
+export async function mergeGems(graph, source) {
+    // ancestor sets: which keys is `key` (transitively) built on? deps appear before dependents in `graph`.
+    const directDeps = new Map(graph.map((n) => [n.key, n.deps]));
+    const ancestorsOf = (key) => {
+        const out = new Set();
+        const stack = [...(directDeps.get(key) ?? [])];
+        while (stack.length) {
+            const k = stack.pop();
+            if (!out.has(k)) {
+                out.add(k);
+                stack.push(...(directDeps.get(k) ?? []));
+            }
+        }
+        return out;
+    };
+    const byName = new Map();
+    const secrets = new Map();
+    const byCheckName = new Map();
+    const provenance = { items: [], overrides: [] };
+    for (const node of graph) {
+        const files = await source.fetchItem(node.path);
+        if (files["gem.lock"] === undefined)
+            throw new Error(`archive for ${node.key}@${node.version} is missing gem.lock`);
+        const v = verifyLock(files, JSON.parse(files["gem.lock"]));
+        if (!v.ok)
+            throw new Error(`integrity failure for ${node.key}@${node.version}: lock mismatch [${v.mismatches.join(",")}]`);
+        if (computeLock(files).gemDigest !== node.gemDigest) {
+            throw new Error(`integrity failure for ${node.key}@${node.version}: digest disagrees with the registry index`);
+        }
+        const gem = readGemArchive(files);
+        provenance.items.push({ key: node.key, version: node.version });
+        for (const artifact of gem.artifacts) {
+            const contentKey = artifactContentKey(artifact);
+            const prev = byName.get(artifact.name);
+            if (!prev) {
+                byName.set(artifact.name, { artifact, owner: node.key, contentKey });
+                continue;
+            }
+            if (prev.contentKey === contentKey)
+                continue; // identical via two paths → dedup
+            if (ancestorsOf(node.key).has(prev.owner)) { // dependent overrides ancestor
+                byName.set(artifact.name, { artifact, owner: node.key, contentKey });
+                provenance.overrides.push({ artifact: artifact.name, winner: node.key, loser: prev.owner });
+                continue;
+            }
+            throw new Error(`artifact name collision: '${artifact.name}' defined by unrelated items ${prev.owner} and ${node.key}`);
+        }
+        for (const s of gem.requiredSecrets)
+            secrets.set(`${s.name}:${s.location}`, s);
+        for (const c of gem.checks) {
+            const contentKey = JSON.stringify(c);
+            const prev = byCheckName.get(c.name);
+            if (!prev) {
+                byCheckName.set(c.name, { check: c, owner: node.key, contentKey });
+                continue;
+            }
+            if (prev.contentKey === contentKey)
+                continue; // identical via two paths → dedup
+            if (ancestorsOf(node.key).has(prev.owner)) { // dependent overrides ancestor
+                byCheckName.set(c.name, { check: c, owner: node.key, contentKey });
+                continue;
+            }
+            throw new Error(`check name collision: '${c.name}' defined by unrelated items ${prev.owner} and ${node.key}`);
+        }
+    }
+    const rootKey = graph.length ? graph[graph.length - 1].key : "(empty)";
+    const rootVer = graph.length ? graph[graph.length - 1].version : "0.0.0";
+    const merged = {
+        name: rootKey.split("/").pop() ?? "gem",
+        createdFrom: `registry:${rootKey}@${rootVer}`,
+        artifacts: [...byName.values()].map((e) => e.artifact),
+        checks: [...byCheckName.values()].map((e) => e.check),
+        requiredSecrets: [...secrets.values()],
+    };
+    return { gem: merged, provenance };
+}
+export function updateIndex(index, e) {
+    const items = { ...index.items };
+    const existing = items[e.key];
+    const versions = { ...(existing?.versions ?? {}) };
+    const existingVersion = existing?.versions[e.version];
+    if (existingVersion && existingVersion.gemDigest !== e.gemDigest) {
+        throw new Error(`${e.key}@${e.version} is immutable (published ${existingVersion.gemDigest}, attempted ${e.gemDigest})`);
+    }
+    versions[e.version] = { path: e.path, gemDigest: e.gemDigest, dependencies: e.dependencies };
+    const latest = existing && cmpSemver(existing.latest, e.version) >= 0 ? existing.latest : e.version;
+    items[e.key] = { latest, versions };
+    return { formatVersion: REGISTRY_FORMAT_VERSION, items };
+}
+export async function publishGem(args) {
+    const name = args.name ?? args.gem.name;
+    if (!SEG.test(args.scope) || !SEG.test(name))
+        throw new Error(`invalid scope/name '@${args.scope}/${name}': must match [a-z0-9-]`);
+    parseSemver(args.version); // validate
+    const key = `@${args.scope}/${name}`;
+    const path = `items/${args.scope}/${name}/${args.version}`;
+    const { files } = writeGemArchive(args.gem, { version: args.version, dependencies: args.dependencies });
+    const { gemDigest, dependencies } = readGemMeta(files);
+    const prior = args.index.items[key]?.versions[args.version];
+    if (prior && prior.gemDigest !== gemDigest) {
+        throw new Error(`${key}@${args.version} is already published and immutable (published ${prior.gemDigest}, attempted ${gemDigest})`);
+    }
+    if (prior && prior.gemDigest === gemDigest) {
+        return { ref: key, version: args.version, gemDigest, commit: "", path };
+    }
+    const nextIndex = updateIndex(args.index, { key, version: args.version, path, gemDigest, dependencies });
+    const commitFiles = { "registry.json": JSON.stringify(nextIndex, null, 2) };
+    for (const [rel, content] of Object.entries(files))
+        commitFiles[`${path}/${rel}`] = content;
+    const { commit } = await args.publisher.putCommit(commitFiles, `publish ${key}@${args.version}`);
+    return { ref: key, version: args.version, gemDigest, commit, path };
+}
+export async function resolveInstall(args) {
+    const index = await args.source.getIndex();
+    const graph = resolveGraph(args.refs, index);
+    const { gem, provenance } = await mergeGems(graph, args.source);
+    const plan = {
+        items: provenance.items,
+        totalArtifacts: gem.artifacts.length,
+        requiredSecrets: gem.requiredSecrets,
+        overrides: provenance.overrides,
+    };
+    if (args.mode === "materialize") {
+        if (!args.target)
+            throw new Error("materialize mode requires a target harness id");
+        plan.materialize = materialize(gem, args.target);
+    }
+    return { plan, gem };
+}

package/dist/gem/registryGithub.js

@@ -0,0 +1,74 @@
+const API = "https://api.github.com";
+const defaultHttp = async (url, init) => {
+    const res = await fetch(url, init);
+    return { status: res.status, text: () => res.text() };
+};
+function headers(cfg) {
+    const h = { Accept: "application/vnd.github+json", "User-Agent": "agentgem" };
+    if (cfg.token)
+        h.Authorization = `Bearer ${cfg.token}`;
+    return h;
+}
+async function ghJson(http, cfg, path, init) {
+    const res = await http(`${API}/repos/${cfg.repo}/${path}`, { ...init, headers: headers(cfg) });
+    const body = await res.text();
+    if (res.status >= 300)
+        throw new Error(`GitHub ${init?.method ?? "GET"} ${path} → ${res.status}: ${body}`);
+    return body ? JSON.parse(body) : null;
+}
+export function githubRegistrySource(cfg, http = defaultHttp) {
+    const contents = (p) => ghJson(http, cfg, `contents/${encodeURIComponent(p).replace(/%2F/g, "/")}?ref=${encodeURIComponent(cfg.ref)}`);
+    return {
+        id: "github", label: `GitHub ${cfg.repo}`,
+        ready: () => cfg.repo.length > 0,
+        async getIndex() {
+            const node = (await contents("registry.json"));
+            return JSON.parse(Buffer.from(node.content, "base64").toString("utf8"));
+        },
+        async fetchItem(itemPath) {
+            const files = {};
+            const walk = async (p) => {
+                const node = await contents(p);
+                if (Array.isArray(node)) {
+                    for (const e of node)
+                        await walk(e.path);
+                }
+                else {
+                    const f = node;
+                    files[p.slice(itemPath.length + 1)] = Buffer.from(f.content, "base64").toString("utf8");
+                }
+            };
+            await walk(itemPath);
+            return files;
+        },
+    };
+}
+export function githubRegistryPublisher(cfg, http = defaultHttp) {
+    if (!cfg.token)
+        throw new Error("publishing requires GITHUB_TOKEN");
+    return {
+        async putCommit(files, message) {
+            // GitHub API asymmetry: GET a single ref is singular "git/ref/...", PATCH update is plural "git/refs/..." (below). Do not "fix" to plural — plural GET returns an array.
+            const ref = (await ghJson(http, cfg, `git/ref/heads/${cfg.ref}`));
+            const base = ref.object.sha;
+            const baseCommit = (await ghJson(http, cfg, `git/commits/${base}`));
+            const tree = await Promise.all(Object.entries(files).map(async ([path, content]) => {
+                const blob = (await ghJson(http, cfg, "git/blobs", { method: "POST", body: JSON.stringify({ content, encoding: "utf-8" }) }));
+                return { path, mode: "100644", type: "blob", sha: blob.sha };
+            }));
+            const newTree = (await ghJson(http, cfg, "git/trees", { method: "POST", body: JSON.stringify({ base_tree: baseCommit.tree.sha, tree }) }));
+            const commit = (await ghJson(http, cfg, "git/commits", { method: "POST", body: JSON.stringify({ message, tree: newTree.sha, parents: [base] }) }));
+            await ghJson(http, cfg, `git/refs/heads/${cfg.ref}`, { method: "PATCH", body: JSON.stringify({ sha: commit.sha }) });
+            return { commit: commit.sha };
+        },
+    };
+}
+export function registryConfigFromEnv() {
+    const repo = process.env.AGENTGEM_REGISTRY_REPO;
+    if (!repo)
+        return null;
+    return { repo, ref: process.env.AGENTGEM_REGISTRY_REF ?? "main", token: process.env.GITHUB_TOKEN };
+}
+export function registryReady() {
+    return registryConfigFromEnv() !== null;
+}

package/dist/gem/run.js

@@ -0,0 +1,322 @@
+// src/gem/run.ts
+// Run/deploy the rendered eve project. Side-effecting orchestration (peer of workspaces.ts).
+// Process spawning is injected via ProcessRunner so command/env/state logic is unit-testable.
+import { spawn as nodeSpawn } from "node:child_process";
+import { existsSync, mkdirSync, rmSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { workspaceDir } from "./workspaces.js";
+import { readGemArchive } from "./archive.js";
+import { readArchiveDir, writeArchiveDir } from "./archiveFs.js";
+import { materialize, flueWorkerName } from "./targets.js";
+import { writeDeployRecord, readDeployRecord, clearDeployRecord } from "./deployRecord.js";
+const LOG_CAP = 200;
+export function pushLog(buf, line) {
+    buf.push(line);
+    if (buf.length > LOG_CAP)
+        buf.splice(0, buf.length - LOG_CAP);
+    return buf;
+}
+export function nodeMajor(version) {
+    const m = /^v?(\d+)/.exec(version);
+    return m ? Number(m[1]) : 0;
+}
+export function runReadiness() {
+    return { local: nodeMajor(process.version) >= 24, vercel: !!process.env.VERCEL_TOKEN, cloudflare: !!process.env.CLOUDFLARE_API_TOKEN };
+}
+// eve start prints a localhost URL once listening; grab the first http(s) URL.
+export function parseEveUrl(lines) {
+    for (const l of lines) {
+        const m = /(https?:\/\/[^\s]+)/.exec(l);
+        if (m)
+            return m[1];
+    }
+    return undefined;
+}
+// vercel deploy prints the deployment URL (a bare https://<id>.vercel.app line).
+export function parseVercelUrl(lines) {
+    for (const l of lines) {
+        const m = /(https:\/\/[^\s]+\.vercel\.app[^\s]*)/.exec(l);
+        if (m)
+            return m[1];
+    }
+    return undefined;
+}
+// When `vercel deploy` runs non-interactively under a token whose account has teams, the CLI
+// refuses with a structured "missing_scope" response listing the available teams. If there is
+// exactly ONE team, return its name so we can retry with --scope; otherwise undefined (ambiguous).
+export function parseSingleTeamScope(lines) {
+    const text = lines.join("\n");
+    if (!/missing_scope|action_required/.test(text))
+        return undefined;
+    const start = text.indexOf("{"), end = text.lastIndexOf("}");
+    if (start < 0 || end <= start)
+        return undefined;
+    try {
+        const obj = JSON.parse(text.slice(start, end + 1));
+        const choices = Array.isArray(obj.choices) ? obj.choices : [];
+        if (choices.length === 1 && typeof choices[0].name === "string")
+            return choices[0].name;
+    }
+    catch { /* not the structured response */ }
+    return undefined;
+}
+// wrangler prints the deployed Worker URL (https://<name>.<acct>.workers.dev).
+export function parseWorkersUrl(lines) {
+    for (const l of lines) {
+        const m = /(https:\/\/[^\s]+\.workers\.dev[^\s]*)/.exec(l);
+        if (m)
+            return m[1];
+    }
+    return undefined;
+}
+// Real runner: line-buffer stdout/stderr; deliver whole lines.
+export const realRunner = {
+    spawn(cmd, args, opts) {
+        const child = nodeSpawn(cmd, args, { cwd: opts.cwd, env: opts.env });
+        const lineCbs = [];
+        const exitCbs = [];
+        const wire = (stream, which) => {
+            if (!stream)
+                return;
+            let buf = "";
+            stream.on("data", (d) => {
+                buf += d.toString();
+                let i;
+                while ((i = buf.indexOf("\n")) >= 0) {
+                    const line = buf.slice(0, i);
+                    buf = buf.slice(i + 1);
+                    lineCbs.forEach((cb) => cb(line, which));
+                }
+            });
+        };
+        wire(child.stdout, "out");
+        wire(child.stderr, "err");
+        child.on("exit", (code) => exitCbs.forEach((cb) => cb(code)));
+        child.on("error", () => exitCbs.forEach((cb) => cb(1)));
+        return {
+            onLine: (cb) => { lineCbs.push(cb); },
+            onExit: (cb) => { exitCbs.push(cb); },
+            kill: () => { child.kill(); },
+        };
+    },
+};
+// Run one command to completion; pipe its lines into `log`; resolve with the exit code.
+export function runToEnd(runner, cmd, args, cwd, env, log) {
+    return new Promise((resolve) => {
+        const h = runner.spawn(cmd, args, { cwd, env });
+        h.onLine((line) => pushLog(log, line));
+        h.onExit((code) => resolve(code ?? 0));
+    });
+}
+// Re-render <target> into a stable .run/<target> dir (preserving node_modules) and npm-install when needed.
+export async function ensureRunProject(name, target, runner, log, opts = {}) {
+    const dir = workspaceDir(name);
+    if (!existsSync(join(dir, "gem.json")))
+        throw new Error(`no workspace '${name}'`);
+    const gem = readGemArchive(readArchiveDir(dir));
+    const { files } = materialize(gem, target, opts);
+    const runDir = target === "eve" ? join(dir, ".run", vercelProject(name)) : join(dir, ".run", target);
+    mkdirSync(runDir, { recursive: true });
+    // Drop stale rendered sources + build caches; keep node_modules + the install marker.
+    for (const entry of readdirSync(runDir)) {
+        if (entry === "node_modules" || entry === ".installed-package.json")
+            continue;
+        rmSync(join(runDir, entry), { recursive: true, force: true });
+    }
+    writeArchiveDir(runDir, files);
+    const pkg = readFileSync(join(runDir, "package.json"), "utf8");
+    const marker = join(runDir, ".installed-package.json");
+    const installed = existsSync(marker) ? readFileSync(marker, "utf8") : "";
+    if (!existsSync(join(runDir, "node_modules")) || installed !== pkg) {
+        const code = await runToEnd(runner, "npm", ["install", "--no-audit", "--no-fund"], runDir, process.env, log);
+        if (code !== 0)
+            throw new Error("npm install failed");
+        writeFileSync(marker, pkg, "utf8");
+    }
+    return runDir;
+}
+// Per-gem Vercel project name: eve-<slug(name)>. Slug = lowercase, non-alnum→'-', trimmed.
+// Vercel derives the project name from the deploy directory's basename, so we name the runDir accordingly.
+export const vercelProject = (name) => "eve-" + (name.normalize("NFKC").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "agent");
+const registry = new Map();
+const EVE_BIN = (runDir) => join(runDir, "node_modules", ".bin", "eve");
+export async function startLocal(name, runner = realRunner) {
+    for (const e of registry.values()) {
+        if (e.state.mode === "local" && e.state.state === "running")
+            throw new Error("a local run is already active");
+    }
+    const state = { mode: "local", state: "installing", logTail: [] };
+    registry.set(`${name}:eve`, { state });
+    try {
+        const runDir = await ensureRunProject(name, "eve", runner, state.logTail);
+        state.state = "building";
+        const buildCode = await runToEnd(runner, EVE_BIN(runDir), ["build"], runDir, process.env, state.logTail);
+        if (buildCode !== 0) {
+            state.state = "failed";
+            return state;
+        }
+        const handle = runner.spawn(EVE_BIN(runDir), ["start"], { cwd: runDir, env: process.env });
+        registry.set(`${name}:eve`, { state, handle });
+        state.state = "running";
+        handle.onLine((line) => {
+            pushLog(state.logTail, line);
+            if (!state.url) {
+                const u = parseEveUrl([line]);
+                if (u)
+                    state.url = u;
+            }
+        });
+        handle.onExit((code) => { if (state.state === "running")
+            state.state = code === 0 ? "idle" : "failed"; });
+        return state;
+    }
+    catch (err) {
+        state.state = "failed";
+        pushLog(state.logTail, err instanceof Error ? err.message : String(err));
+        return state;
+    }
+}
+export function stopLocal(name, target) {
+    const e = registry.get(`${name}:${target}`);
+    if (!e?.handle)
+        return { stopped: false };
+    e.handle.kill();
+    e.state.state = "idle";
+    return { stopped: true };
+}
+export function getRunStatus(name, target) {
+    return registry.get(`${name}:${target}`)?.state ?? { mode: "local", state: "idle", logTail: [] };
+}
+const binIn = (runDir, name) => join(runDir, "node_modules", ".bin", name);
+// agentgem's own pinned vercel CLI (installed as a dependency), run with cwd = the eve run dir.
+const VERCEL_BIN = join(process.cwd(), "node_modules", ".bin", "vercel");
+// Deploy the eve project to Vercel from SOURCE (not --prebuilt): eve warns that a local prebuilt
+// build skips Vercel sandbox-template prewarm, so Vercel must build it. Scope: use VERCEL_SCOPE if
+// set, else deploy without scope and — when the CLI refuses with a single available team — retry
+// with --scope <that team>.
+export async function deployVercel(name, runner = realRunner, opts = {}) {
+    const token = process.env.VERCEL_TOKEN;
+    if (!token)
+        throw new Error("VERCEL_TOKEN is not set on the server — cannot deploy to Vercel.");
+    const state = { mode: "vercel", state: "installing", logTail: [] };
+    registry.set(`${name}:eve`, { state });
+    const vercelDeploy = (runDir, scope) => {
+        const args = ["deploy", "--yes", `--token=${token}`, ...(scope ? [`--scope=${scope}`] : [])];
+        const lines = [];
+        return new Promise((resolve) => {
+            const h = runner.spawn(VERCEL_BIN, args, { cwd: runDir, env: process.env });
+            h.onLine((line) => { pushLog(state.logTail, line); lines.push(line); });
+            h.onExit((c) => resolve({ code: c ?? 0, lines }));
+        });
+    };
+    try {
+        const runDir = await ensureRunProject(name, "eve", runner, state.logTail, opts);
+        state.state = "deploying";
+        const explicitScope = process.env.VERCEL_SCOPE;
+        let { code, lines } = await vercelDeploy(runDir, explicitScope);
+        if (code !== 0 && !explicitScope) {
+            const team = parseSingleTeamScope(lines);
+            if (team) {
+                pushLog(state.logTail, `↻ retrying with --scope ${team}`);
+                ({ code, lines } = await vercelDeploy(runDir, team));
+            }
+        }
+        if (code !== 0) {
+            state.state = "failed";
+            return state;
+        }
+        state.url = parseVercelUrl(lines);
+        state.state = "idle";
+        writeDeployRecord(name, { backend: "eve", at: new Date().toISOString(), url: state.url, project: vercelProject(name) });
+        return state;
+    }
+    catch (err) {
+        state.state = "failed";
+        pushLog(state.logTail, err instanceof Error ? err.message : String(err));
+        return state;
+    }
+}
+export async function undeployVercel(name, runner = realRunner) {
+    const token = process.env.VERCEL_TOKEN;
+    if (!token)
+        throw new Error("VERCEL_TOKEN is not set on the server — cannot undeploy from Vercel.");
+    const rec = readDeployRecord(name, "eve");
+    if (!rec?.project)
+        throw new Error(`no recorded eve/Vercel deploy for '${name}'`);
+    const logTail = [];
+    const scope = process.env.VERCEL_SCOPE;
+    const run = (s) => new Promise((resolve) => {
+        const lines = [];
+        const args = ["remove", rec.project, "--yes", `--token=${token}`, ...(s ? [`--scope=${s}`] : [])];
+        const h = runner.spawn(VERCEL_BIN, args, { cwd: workspaceDir(name), env: process.env });
+        h.onLine((l) => { pushLog(logTail, l); lines.push(l); });
+        h.onExit((c) => resolve({ code: c ?? 0, lines }));
+    });
+    let { code, lines } = await run(scope);
+    if (code !== 0 && !scope) {
+        const team = parseSingleTeamScope(lines);
+        if (team)
+            ({ code } = await run(team));
+    }
+    if (code !== 0)
+        return { removed: false, logTail };
+    clearDeployRecord(name, "eve");
+    return { removed: true, logTail };
+}
+export async function deployCloudflare(name, runner = realRunner) {
+    const token = process.env.CLOUDFLARE_API_TOKEN;
+    if (!token)
+        throw new Error("CLOUDFLARE_API_TOKEN is not set on the server — cannot deploy to Cloudflare.");
+    const state = { mode: "cloudflare", state: "installing", logTail: [] };
+    registry.set(`${name}:flue`, { state });
+    try {
+        const runDir = await ensureRunProject(name, "flue", runner, state.logTail);
+        state.state = "building";
+        const buildCode = await runToEnd(runner, binIn(runDir, "flue"), ["build", "--target", "cloudflare"], runDir, process.env, state.logTail);
+        if (buildCode !== 0) {
+            state.state = "failed";
+            return state;
+        }
+        state.state = "deploying";
+        const lines = [];
+        const env = { ...process.env, CLOUDFLARE_API_TOKEN: token };
+        const code = await new Promise((resolve) => {
+            const h = runner.spawn(binIn(runDir, "wrangler"), ["deploy"], { cwd: runDir, env });
+            h.onLine((line) => { pushLog(state.logTail, line); lines.push(line); });
+            h.onExit((c) => resolve(c ?? 0));
+        });
+        if (code !== 0) {
+            state.state = "failed";
+            return state;
+        }
+        state.url = parseWorkersUrl(lines);
+        writeDeployRecord(name, { backend: "flue", at: new Date().toISOString(), url: state.url, worker: flueWorkerName(name) });
+        state.state = "idle";
+        return state;
+    }
+    catch (err) {
+        state.state = "failed";
+        pushLog(state.logTail, err instanceof Error ? err.message : String(err));
+        return state;
+    }
+}
+export async function undeployCloudflare(name, runner = realRunner) {
+    const token = process.env.CLOUDFLARE_API_TOKEN;
+    if (!token)
+        throw new Error("CLOUDFLARE_API_TOKEN is not set on the server — cannot undeploy from Cloudflare.");
+    const rec = readDeployRecord(name, "flue");
+    if (!rec?.worker)
+        throw new Error(`no recorded flue/Cloudflare deploy for '${name}'`);
+    const runDir = join(workspaceDir(name), ".run", "flue");
+    const logTail = [];
+    const env = { ...process.env, CLOUDFLARE_API_TOKEN: token };
+    const code = await new Promise((resolve) => {
+        const h = runner.spawn(binIn(runDir, "wrangler"), ["delete", "--name", rec.worker, "--force"], { cwd: runDir, env });
+        h.onLine((l) => pushLog(logTail, l));
+        h.onExit((c) => resolve(c ?? 0));
+    });
+    if (code !== 0)
+        return { removed: false, logTail };
+    clearDeployRecord(name, "flue");
+    return { removed: true, logTail };
+}