@pithy-sh/cli 0.1.0

package/src/project/templateFiles.ts

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+/**
+ * The files git has committed under a directory. One question, asked by the packer and by `pithy init`.
+ *
+ * It lives in `src/` and nothing else does, because that is the only side of the boundary both programs
+ * can reach. `packages/cli/tsconfig.json` roots at `src`, so a module under `src` importing
+ * `scripts/templateManifest.ts` is `TS6059` — the file is outside the emit root. The other direction
+ * costs nothing: `scripts/tsconfig.json` roots one level higher and picks this file up through the
+ * import, and **this module imports nothing but `node:child_process` and `node:path`**, so it drags no
+ * graph behind it into a program that has no Workers types and must not acquire any.
+ *
+ * The alternative was two copies with a test asserting they agree, and a copy is what the last four
+ * fixes on this branch were each cleaning up.
+ */
+
+import { execFileSync } from "node:child_process";
+import { sep } from "node:path";
+
+/**
+ * The paths git has committed under `dir`, relative to it, sorted — or `null` when there is no index to
+ * read: `dir` is not in a checkout, or git is not installed, or nothing under it is tracked.
+ *
+ * **The allowlist, and it inverts the burden.** An exclusion filter has to predict the next artifact
+ * somebody drops in the directory, and nobody predicted `.dev.vars` — the file `pithy add` and
+ * `pithy token mint` write `CLOUDFLARE_API_TOKEN` and `SECRETS_ENCRYPTION_KEYS` into. It was published
+ * straight past `.gitignore` by `files`, and copied straight past it into an adopter's brand-new project
+ * by `pithy init`. Reading the index means a file ships because it was committed, reviewed and pushed;
+ * anything a working tree happens to hold is invisible.
+ *
+ * `--cached`, so an untracked or ignored file sitting beside a tracked one is not listed either.
+ *
+ * `null` rather than a throw, because "no index" is a normal answer to both callers and they answer it
+ * differently: a pack must refuse, and a scaffold from an installed package must carry on — the vendored
+ * template is a copy of this same allowlist, made when there was an index to read.
+ *
+ * git's own stderr is discarded. The failure is a value here, not a message: an installed CLI running
+ * `pithy init` outside a repository must not print `fatal: not a git repository` at the adopter.
+ */
+export function committedFiles(dir: string): string[] | null {
+  let listed: string;
+  try {
+    listed = execFileSync("git", ["-C", dir, "ls-files", "-z", "--cached"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+  } catch {
+    return null;
+  }
+  const files = listed.split("\0").filter(Boolean).sort();
+  return files.length === 0 ? null : files.map((path) => path.split("/").join(sep));
+}

package/src/project/verifyDeploy.ts

@@ -0,0 +1,230 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+/**
+ * Prove the Worker you just deployed is the one answering at the address this project claims.
+ *
+ * ## Why not compare the URL wrangler printed
+ *
+ * That is the obvious move and it is wrong twice over. Wrangler's last printed URL may be a
+ * **version-scoped preview URL** under versions and gradual deployments, so comparing it to the declared
+ * domain would fire falsely on every deploy. And it depends on an output format nobody controls.
+ *
+ * ## Why not a liveness probe
+ *
+ * `GET /health` answering `ok` at the declared domain proves *a* Worker is there — **not the one just
+ * deployed**. The old version answering happily would pass, and that is exactly the failure worth
+ * catching: a deploy that landed somewhere else (a different account, a different script name) while the
+ * declared domain kept serving what was already on it. That failure is silent, and it is the one that
+ * costs the most to discover late.
+ *
+ * ## So the check is a version correlation
+ *
+ * `parseDeployOutput` already captures the `versionId` wrangler reports. `GET /health` reports the
+ * running version from `CF_VERSION_METADATA`. This probes the **declared** domain and asserts the two
+ * match. That is an end-to-end assertion — *the Worker I deployed is answering at the address this
+ * project claims* — and it behaves identically from CI and a laptop, failing the pipeline rather than
+ * printing a line nobody reads.
+ *
+ * ## Two cases must not produce false failures
+ *
+ * **Propagation is not instant.** A custom domain can take seconds to route to a new version, so the
+ * probe retries with a short backoff before concluding anything.
+ *
+ * **A gradual deployment is not a failure.** Under one, the previous version is still legitimately
+ * serving a share of traffic, so hitting it is expected. The rule that distinguishes the two is
+ * *consistency*: if any probe sees the version just shipped, the deploy is verified. If every probe sees
+ * one single other version, that is a genuine mismatch. If probes see **more than one** version, the
+ * fleet is mixed — a rollout in progress — and the answer is `inconclusive`, said out loud, rather than a
+ * failure.
+ *
+ * ## And nothing answering is not "cannot tell"
+ *
+ * Those two were one branch until #264, and the conflation cost the whole check. A probe that received no
+ * response at all and a probe that received a 200 with no `version` field both landed in `inconclusive`,
+ * under a sentence blaming `CF_VERSION_METADATA` — so a Worker deployed with a declared domain and no
+ * route behind it, answering at no address, reported a deploy that "succeeded" and pointed the adopter at
+ * a binding that was already declared.
+ *
+ * They are different facts and they are established differently. *Something answered and could not say
+ * which version it is* is ordinary — an unadopted binding, a `/health` that is not mounted — and stays
+ * `inconclusive`. *Nothing answered* is transport-level: DNS, TLS, a timeout, no route. That is a failed
+ * deploy, and the address that did not answer is the fact worth printing.
+ */
+
+import { HEALTH_PATH } from "@pithy-sh/core/src/worker/health";
+
+/** What a probe concluded. */
+export type DeployVerification =
+  | "verified" // the version just shipped answered at the declared domain
+  | "mismatch" // something else is consistently answering there
+  | "inconclusive" // a gradual rollout, or the Worker answered without a version
+  | "unreachable"; // nothing answered at all
+
+/** The outcome of verifying one Worker's deploy. */
+export interface VerifyDeployResult {
+  /** The conclusion. */
+  status: DeployVerification;
+  /** Every distinct version observed, in the order first seen. Empty when nothing answered. */
+  observed: string[];
+  /** How many probes were made. */
+  attempts: number;
+  /** A one-line explanation, in brand voice, for the deploy summary. */
+  detail: string;
+}
+
+/** What the probe needs. Every dependency injected, so the whole thing is testable with no network. */
+export interface VerifyDeployOptions {
+  /** The declared base URL, e.g. `https://api.example.com`. `/health` is appended. */
+  url: string;
+  /** The version id wrangler reported for the deploy just made. */
+  expectedVersion: string;
+  /** How many times to probe before concluding. Defaults to 5. */
+  attempts?: number;
+  /** The backoff between probes, in ms. Defaults to 1000. */
+  delayMs?: number;
+  /**
+   * How long one probe may take before it is abandoned, in ms. Defaults to 5 seconds.
+   *
+   * Without a bound, a domain that accepts a connection and never answers stalls on undici's 300-second
+   * headers timeout — five attempts of that is twenty-five minutes of a `pithy deploy` that looks hung,
+   * in CI, after the deploy has already succeeded. A health probe that cannot answer in five seconds has
+   * answered: this attempt failed, try the next one.
+   */
+  timeoutMs?: number;
+  /** Injected so a test drives the probe with no network and no clock. */
+  fetchImpl?: typeof fetch;
+  /** Injected so a test does not actually wait. */
+  sleep?: (ms: number) => Promise<void>;
+}
+
+/** The `/health` body this reads. `version` is null on a Worker with no version-metadata binding. */
+interface HealthBody {
+  status?: unknown;
+  version?: unknown;
+}
+
+const DEFAULT_ATTEMPTS = 5;
+const DEFAULT_DELAY_MS = 1000;
+
+/** Five seconds per probe. A `/health` route that cannot answer in that has answered. */
+const DEFAULT_TIMEOUT_MS = 5000;
+
+/**
+ * What one probe learned, and the distinction the whole conclusion turns on.
+ *
+ * `reached` is whether an HTTP response came back at all — any status. A 404 or a 500 is a Worker (or a
+ * Cloudflare error page) at that address saying something, which is a different world from a DNS failure.
+ * `version` is what it reported, when it could.
+ */
+interface Probe {
+  reached: boolean;
+  version: string | null;
+}
+
+/** One probe. Reports whether anything answered, and the version it named. */
+async function probe(url: string, fetchImpl: typeof fetch, timeoutMs: number): Promise<Probe> {
+  try {
+    // `HEALTH_PATH` rather than a literal: `createBackend` mounts the route, and a probe that writes
+    // its own copy of the path is a deploy check that goes inconclusive the day the route moves (#400).
+    const response = await fetchImpl(`${url.replace(/\/+$/, "")}${HEALTH_PATH}`, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      // An abort lands in the same `catch` as a DNS or TLS failure, which is right: all three mean nothing
+      // answered, and the retry loop is what decides whether that is fatal.
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    // Answered, whatever it said. The body is only read on a 2xx — a 404's body is not JSON worth parsing.
+    if (!response.ok) return { reached: true, version: null };
+    const body = (await response.json().catch(() => ({}))) as HealthBody;
+    return {
+      reached: true,
+      version: typeof body.version === "string" && body.version.length > 0 ? body.version : null,
+    };
+  } catch {
+    // A DNS failure, a TLS failure, a timeout. Indistinguishable from "not routed yet" on the first
+    // attempt, which is exactly why this retries rather than concluding.
+    return { reached: false, version: null };
+  }
+}
+
+/**
+ * Probe the declared domain until the expected version answers, or until the attempts run out.
+ *
+ * Returns as soon as the expected version is seen — the common case costs one request. Only a deploy
+ * that has *not* propagated pays the full backoff.
+ */
+export async function verifyDeployedVersion(options: VerifyDeployOptions): Promise<VerifyDeployResult> {
+  const attempts = options.attempts ?? DEFAULT_ATTEMPTS;
+  const delayMs = options.delayMs ?? DEFAULT_DELAY_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const sleep = options.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+
+  const observed: string[] = [];
+  let reached = 0;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const { reached: answered, version } = await probe(options.url, fetchImpl, timeoutMs);
+    if (answered) reached += 1;
+    if (version !== null) {
+      if (version === options.expectedVersion) {
+        return {
+          status: "verified",
+          observed: observed.includes(version) ? observed : [...observed, version],
+          attempts: attempt,
+          detail: `${options.url} is serving the version just deployed.`,
+        };
+      }
+      if (!observed.includes(version)) observed.push(version);
+    }
+    if (attempt < attempts) await sleep(delayMs);
+  }
+
+  if (reached === 0) {
+    // Nothing answered — not once, over every attempt. The deploy went somewhere, and it is not here.
+    // The address is the whole diagnostic: a declared domain with no route behind it is what produces
+    // this, and naming a binding instead sends the adopter to the wrong file (#264).
+    return {
+      status: "unreachable",
+      observed,
+      attempts,
+      detail: `Nothing answered at ${options.url} in ${attempts} attempts. Check that a route in this environment serves that host.`,
+    };
+  }
+
+  if (observed.length === 0) {
+    // Something is there and cannot say which version it is. Ordinary: a project that has not adopted the
+    // `CF_VERSION_METADATA` binding genuinely cannot answer, and neither can a Worker with no `/health`.
+    return {
+      status: "inconclusive",
+      observed,
+      attempts,
+      detail: `${options.url} answered without a version. Check that it declares CF_VERSION_METADATA.`,
+    };
+  }
+
+  if (observed.length > 1) {
+    return {
+      status: "inconclusive",
+      observed,
+      attempts,
+      detail: `${options.url} is serving ${observed.length} versions — a gradual deployment is in progress.`,
+    };
+  }
+
+  return {
+    status: "mismatch",
+    observed,
+    attempts,
+    detail: `${options.url} is serving ${observed[0]}, not the version just deployed.`,
+  };
+}
+
+/** Whether a verification should fail the command. A consistent mismatch, and nothing answering at all. */
+export function isDeployFailure(status: DeployVerification): boolean {
+  // `inconclusive` is deliberately not a failure: a gradual rollout and an unadopted binding are both
+  // ordinary, and failing a deploy for either would train everyone to ignore the check. `unreachable` is
+  // the opposite of ordinary — the declared address answered nothing, over every attempt (#264).
+  return status === "mismatch" || status === "unreachable";
+}

package/src/project/versionMetadata.ts

@@ -0,0 +1,77 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { VERSION_METADATA_BINDING } from "@pithy-sh/core/src/worker/identity";
+import { readWranglerConfig, writeWranglerConfig } from "./wrangler";
+
+/**
+ * The `version_metadata` binding every Pithy Worker should declare, and the idempotent repair for one
+ * that does not.
+ *
+ * **This exists because the feature shipped without it and nobody noticed for a release.**
+ * `createBackend` has always read `env.CF_VERSION_METADATA` and stamped a `version` field onto every log
+ * record; `docs/LOGGING.md` documented it; a Workers-runtime test proved it worked. No template declared
+ * the binding, so the field was absent in every scaffolded project and nobody could correlate a log line
+ * to the deploy that produced it — the first question anyone asks when a deploy goes wrong. Correct code,
+ * never wired, nothing complaining.
+ *
+ * It is **not** a capability binding, so it does not travel through `pithy add`'s manifest path. No
+ * capability requires it, every Worker wants it, and it is populated by the platform rather than by
+ * anything Pithy provisions. That makes it a property of the scaffold — which is why the repair is its
+ * own step in `pithy upgrade` rather than a row in some capability's `requiredBindings`.
+ *
+ * **Top level, never per environment.** It is metadata about the build, and `env.<name>` stanzas replace
+ * rather than merge, so a per-environment copy would be three places for one fact to drift in. Cloudflare
+ * inherits the top-level declaration into every environment.
+ */
+
+/** The wrangler key that declares it. One word from the platform's own schema. */
+export const VERSION_METADATA_KEY = "version_metadata";
+
+/** The shape this module reads and writes. Only the key it owns — everything else is the adopter's. */
+interface WranglerVersionMetadata {
+  version_metadata?: { binding?: string };
+}
+
+/**
+ * Whether this config already declares the binding under the name the runtime reads.
+ *
+ * Keys on the **binding name**, not merely on the key's presence. A `version_metadata` block naming
+ * something else binds a value nothing in the tree consumes and leaves the logger exactly as blind as no
+ * declaration at all — so that is drift to report, not a declaration to respect.
+ */
+export function hasVersionMetadata(config: unknown): boolean {
+  if (typeof config !== "object" || config === null) return false;
+  return (config as WranglerVersionMetadata).version_metadata?.binding === VERSION_METADATA_BINDING;
+}
+
+/**
+ * Declare the binding on a Worker that lacks it. Returns whether anything changed.
+ *
+ * Idempotent, and **never overwrites an adopter's own value.** A config already naming a different
+ * binding is left alone: renaming it would silently repoint a binding they may be reading themselves,
+ * and the honest move is to report the drift and let them decide. Writing goes through
+ * `writeWranglerConfig`, so comments survive.
+ */
+export async function applyVersionMetadata(workerDir: string): Promise<boolean> {
+  // A Worker with no `wrangler.jsonc` is an ordinary member of the project — a Vite frontend joins the
+  // dev set through `pithy.worker.jsonc` with a `dev.command` and never deploys. It reaches the
+  // reconcile plan like any other, so this must decline rather than throw: the rest of the engine
+  // already tolerates it (`readStanzas` returns no stanzas for exactly this case), and an unguarded
+  // read here would abort the whole `pithy upgrade --apply` run, taking every Worker after it in
+  // discovery order with it. The same applies to a wrangler.jsonc with a syntax error, which the plan
+  // side already swallows — reporting drift it cannot repair is the honest outcome.
+  let config: WranglerVersionMetadata;
+  try {
+    config = (await readWranglerConfig(workerDir)) as WranglerVersionMetadata;
+  } catch {
+    return false;
+  }
+  if (config.version_metadata !== undefined) return false;
+
+  // Assign the whole block rather than mutating in place: the key is absent, so there is no existing
+  // object carrying comment-json's symbol-keyed comments to preserve.
+  config.version_metadata = { binding: VERSION_METADATA_BINDING };
+  await writeWranglerConfig(workerDir, config);
+  return true;
+}

package/src/project/workerAddress.ts

@@ -0,0 +1,176 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { resolveOrigin, type WorkerDomains } from "@pithy-sh/core/src/naming/domains";
+
+/**
+ * The one resolver for "where does this Worker answer".
+ *
+ * ## What it replaced
+ *
+ * Three derivations, none of which reconciled with the others:
+ *
+ * - `deriveBaseUrl` in `envInventory.ts` scraped the first `routes`/`route` pattern out of
+ *   `wrangler.jsonc`, returning the literal `"local"` for `dev` and `null` when no route was declared.
+ * - `pithy email provision` and `pithy turnstile` each read a hand-set `vars.BASE_URL` — with two
+ *   different parsers, two different error messages, and no validation in one of them.
+ * - `pithy dashboard connect` derived nothing at all and simply demanded `--worker-url`.
+ *
+ * `email provision` refused to run without `vars.BASE_URL` while `pithy env` printed a URL derived from
+ * the routes beside it, and nothing anywhere noticed when the two disagreed. That is a defect waiting to
+ * be hit; before the first customer it is a refactor, and after it is a migration for every project that
+ * guessed differently.
+ *
+ * ## The order, and why it is this order
+ *
+ * 1. **The `domains` declaration** for this Worker and environment — authoritative, because it is the
+ *    thing the `routes` entry and `BASE_URL` are *generated from*. If it is present, everything else is
+ *    downstream of it and cannot disagree without being stale.
+ * 2. **The first `routes`/`route` pattern**, for projects that predate the declaration or hand-edit
+ *    wrangler. This is what keeps the change non-breaking: an adopter who wrote their own route keeps
+ *    working and is never told to migrate.
+ * 3. **`vars.BASE_URL`**, for a project that set it by hand and declared no route. Last among the
+ *    config sources because it is the one an adopter can most easily leave stale — it used to be the
+ *    only input, so it is exactly where a contradiction lives.
+ *
+ * `workers.dev` is deliberately **not** in this list. It is resolved separately and only where an
+ * account is reachable and has the subdomain enabled, because it can be disabled per account and
+ * commonly is in production — a fallback that is weakest in the environment that counts is not a
+ * fallback worth silently depending on.
+ *
+ * ## Why the source is reported, not just the URL
+ *
+ * Every consumer either shows a human what it found (`pithy env`, `pithy dashboard connect` confirming
+ * an address before registering it) or needs to explain why it found nothing. "Where did this come
+ * from" is the first question in both cases, and reconstructing it after the fact is what produced
+ * three resolvers in the first place.
+ */
+
+/** Where a resolved address came from. Ordered by authority, most authoritative first. */
+export type WorkerAddressSource = "declaration" | "route" | "var" | "workers.dev";
+
+/** A resolved address, and the evidence for it. */
+export interface WorkerAddress {
+  /** The absolute base URL, e.g. `https://api.example.com`. Never a bare hostname. */
+  url: string;
+  /** Which input produced it. */
+  source: WorkerAddressSource;
+  /** The hostname alone — what Turnstile binds a widget to, and what a route pattern is. */
+  hostname: string;
+}
+
+/** The slice of a wrangler stanza an address can be read out of. */
+export interface AddressStanza {
+  route?: string | { pattern?: string };
+  routes?: (string | { pattern?: string })[];
+  vars?: Record<string, unknown>;
+}
+
+/** What the resolver reads. Every field optional — a project may have none of them. */
+export interface ResolveWorkerAddressInput {
+  /** The environment being resolved. `dev` never resolves to a public address. */
+  environment: string;
+  /** The Worker's declared `domains` block, when it has one. */
+  domains?: WorkerDomains | undefined;
+  /** The `wrangler.jsonc` stanza for this environment (the top-level doc is the `dev` stanza). */
+  stanza?: AddressStanza | undefined;
+}
+
+/** One route entry reduced to its pattern, in either form wrangler accepts. */
+function routePattern(route: string | { pattern?: string } | undefined): string | null {
+  if (typeof route === "string") return route.length > 0 ? route : null;
+  const pattern = route?.pattern;
+  return typeof pattern === "string" && pattern.length > 0 ? pattern : null;
+}
+
+/**
+ * Turn whatever an input held into an absolute URL and a hostname, or null.
+ *
+ * Accepts both shapes on purpose: a route pattern is a bare hostname (possibly with a path, which is
+ * dropped), while a hand-set `vars.BASE_URL` is usually a full URL and occasionally a bare hostname.
+ * Anything unparseable is null rather than a throw — the resolver's whole contract is that it reports
+ * what it found, and a malformed value found is the same as nothing found for the caller's purposes.
+ */
+function toAddress(value: string, source: WorkerAddressSource): WorkerAddress | null {
+  const candidate = /^https?:\/\//.test(value) ? value : `https://${value}`;
+  try {
+    const url = new URL(candidate);
+    if (!url.hostname) return null;
+    return { url: `https://${url.hostname}`, source, hostname: url.hostname };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve a Worker's public address for one environment from config alone — no network.
+ *
+ * Offline by construction, because `pithy env` is contractually read-only and always exits 0: a resolver
+ * that reached Cloudflare would turn it into a command that fails without credentials. The `workers.dev`
+ * tier is a separate, explicitly asynchronous step for the callers that can afford it.
+ *
+ * Returns null for `dev` always. There is no public address for a local run — the answer is
+ * `http://localhost:<port>` from the port the feature pinned, which lives in `.dev.config.json` and is
+ * not this function's business.
+ */
+export function resolveWorkerAddress(input: ResolveWorkerAddressInput): WorkerAddress | null {
+  if (input.environment === "dev") return null;
+
+  // Through the shared resolver, so the answer this reports and the answer an adopter's config composes
+  // are the same function (#256). `declared` is what keeps the fallback out of here: a `LOCAL_ORIGIN`
+  // returned as an address would stop the route and `BASE_URL` tiers below from ever being reached.
+  const declared = resolveOrigin(input.environment, input.domains);
+  if (declared.declared) {
+    return { url: declared.origin, source: "declaration", hostname: declared.hostname };
+  }
+
+  const stanza = input.stanza;
+  const pattern = routePattern(stanza?.routes?.[0]) ?? routePattern(stanza?.route);
+  if (pattern) {
+    const fromRoute = toAddress(pattern, "route");
+    if (fromRoute) return fromRoute;
+  }
+
+  const baseUrl = stanza?.vars?.BASE_URL;
+  if (typeof baseUrl === "string" && baseUrl.length > 0) {
+    const fromVar = toAddress(baseUrl, "var");
+    if (fromVar) return fromVar;
+  }
+
+  return null;
+}
+
+/**
+ * The `workers.dev` address for a script, when the account has a subdomain.
+ *
+ * Separate from {@link resolveWorkerAddress} and never folded into it, for two reasons. It needs the
+ * network, and the resolver must stay offline. And it is the weakest tier by a distance: `workers.dev`
+ * can be disabled per account and commonly is in production, where a live domain is the only intended
+ * entry point — so a caller has to opt into it deliberately rather than inherit it as a default that
+ * quietly stops working in exactly the environment that matters.
+ *
+ * `subdomain` is whatever `CloudflareWorkersManager.accountSubdomain()` returned, which is already null
+ * when the account has none.
+ */
+export function workersDevAddress(scriptName: string, subdomain: string | null): WorkerAddress | null {
+  if (!subdomain || !scriptName) return null;
+  return {
+    url: `https://${scriptName}.${subdomain}.workers.dev`,
+    source: "workers.dev",
+    hostname: `${scriptName}.${subdomain}.workers.dev`,
+  };
+}
+
+/** How a resolved address reads in CLI output — the URL, and where it came from. */
+export function describeAddressSource(source: WorkerAddressSource): string {
+  switch (source) {
+    case "declaration":
+      return "declared in pithy.config.ts";
+    case "route":
+      return "from the route in wrangler.jsonc";
+    case "var":
+      return "from vars.BASE_URL in wrangler.jsonc";
+    case "workers.dev":
+      return "your workers.dev subdomain";
+  }
+}