@shaferllc/keel 0.83.2 → 0.83.4

package/README.md

@@ -161,6 +161,8 @@ src/db/              Database adapters (D1, Postgres, libSQL)
 src/api/             CRUD REST resources from a model
 src/openapi/         Generates an OpenAPI spec from the routes
 src/billing/         Subscription billing — Stripe + Paddle
+src/gates/           Signup gates — invite codes & email allowlist
+src/hosting/         Cloudflare / dump / secrets helpers for hosted apps
 src/watch/           The debug dashboard
 src/mcp/             The MCP server (docs + API for AI agents)
 src/vite/            The Vite plugin
@@ -203,7 +205,9 @@ See [docs/architecture.md](./docs/architecture.md) for the full picture.
 | [Lifecycle Hooks](./docs/hooks.md) | onReady/onShutdown, graceful shutdown, onRoute |
 | [Sessions](./docs/sessions.md) | Cookie-backed sessions, flash messages |
 | [Authentication](./docs/authentication.md) | Session auth, guards, user provider |
-| [Authorization](./docs/authorization.md) | Gates & policies, `can`/`authorize` |
+| [Gates](./docs/gates.md) | Signup gating — invite codes & email allowlist |
+| [Hosting](./docs/hosting.md) | Cloudflare, SQL dump, secrets for hosted Workers |
+| [Authorization](./docs/authorization.md) | Ability gates & policies, `can`/`authorize` |
 | [Database](./docs/database.md) | Driver-agnostic query builder |
 | [Models](./docs/models.md) | Active-record: find/create/save, casts, relations |
 | [Migrations](./docs/migrations.md) | Schema builder + migrator, dialect-aware |
@@ -266,29 +270,8 @@ lines / ~91% branches**.
 
 ## Roadmap
 
-Keel's first release is the **MVP core**: container, routing, middleware,
-config, and the console. On deck:
-
-- [x] View / templating layer (Hono JSX) — **v0.2.0**
-- [x] Cloudflare Workers–safe core — **v0.2.0**
-- [x] Global helpers: `config()`, `app()`, `view()` — **v0.3.0 / v0.4.0**
-- [x] Error & exception handling — **v0.5.0**
-- [x] Request/response + container helpers — **v0.6.0–v0.9.0**
-- [x] Validation (Zod-compatible) — **v0.10.0**
-- [x] First-class routing (groups, resources, named routes) — **v0.11.0**
-- [x] Domain routing, matchers, Inertia adapter — **v0.12.0**
-- [x] Test suite (~99% coverage)
-- [x] Query builder (driver-agnostic) — **v0.28.0**
-- [x] Active-record Model layer — **v0.29.0**
-- [x] Migrations (schema builder) — **v0.30.0**
-- [x] Model relationships (hasMany / belongsTo / belongsToMany) — **v0.31.0**
-- [x] Factories & seeders (built-in Faker) — **v0.32.0**
-- [x] Model attribute casts + mass-assignment guarding — **v0.33.0**
-- [x] Mail (fluent mailer, pluggable transports) — **v0.34.0**
-- [x] Queues / background jobs (pluggable drivers) — **v0.35.0**
-- [x] Notifications (multi-channel, queueable) — **v0.36.0**
-- [ ] Publish `src/core` as the `@keel/core` package
-
+The MVP core and the major subsystems are shipped. Recent focus is Keel Cloud
+support (gates, hosting, MCP Cloud tools, billing portal) and starter kits.
 See [CHANGELOG.md](./CHANGELOG.md) for release history.
 
 ## Contributing

package/dist/billing/billable.d.ts

@@ -67,6 +67,7 @@ export interface BillableInstance {
     checkout(prices: string | PriceRef | (string | PriceRef)[], options?: ProductCheckoutOptions): Promise<CheckoutSession>;
     createSetupIntent(): Promise<SetupIntent>;
     paymentMethods(): Promise<PaymentMethod[]>;
+    billingPortal(returnUrl: string): Promise<import("./gateway.js").BillingPortalSession>;
 }
 /**
  * The class a `Billable(Base)` call returns: billing instances plus all of

package/dist/billing/billable.js

@@ -171,6 +171,14 @@ export function Billable(Base) {
                 return [];
             return gateway.paymentMethods(this.billing_customer_id);
         }
+        /** Open the hosted customer portal (manage card / cancel). */
+        async billingPortal(returnUrl) {
+            const gateway = this.billingGateway();
+            if (!gateway.createBillingPortalSession) {
+                throw new BillingError(`The "${gateway.name}" gateway does not support a billing portal.`, gateway.name);
+            }
+            return gateway.createBillingPortalSession(await this.getCustomerId(), returnUrl);
+        }
     }
     return BillableModel;
 }

package/dist/billing/drivers/fake.d.ts

@@ -42,6 +42,10 @@ export declare class FakeGateway implements BillingGateway {
     refund(params: RefundParams): Promise<GatewayRefund>;
     listInvoices(customer: string): Promise<GatewayInvoice[]>;
     createCheckoutSession(params: CheckoutParams): Promise<CheckoutSession>;
+    createBillingPortalSession(customer: string, returnUrl: string): Promise<{
+        id: string;
+        url: string;
+    }>;
     createSetupIntent(customer: string): Promise<SetupIntent>;
     paymentMethods(customer: string): Promise<PaymentMethod[]>;
     verifyWebhook(rawBody: string, headers: HeaderBag, secret: string): Promise<import("../gateway.js").WebhookEvent | null>;

package/dist/billing/drivers/fake.js

@@ -129,6 +129,11 @@ export class FakeGateway {
         const id = this.id("cs");
         return { id, url: `https://fake.checkout/${id}`, clientToken: `ctok_${id}` };
     }
+    async createBillingPortalSession(customer, returnUrl) {
+        this.record("createBillingPortalSession", customer, returnUrl);
+        const id = this.id("bps");
+        return { id, url: `https://fake.portal/${id}?return=${encodeURIComponent(returnUrl)}` };
+    }
     async createSetupIntent(customer) {
         this.record("createSetupIntent", customer);
         const id = this.id("seti");

package/dist/billing/drivers/stripe.d.ts

@@ -28,6 +28,7 @@ export declare class StripeGateway implements BillingGateway {
     createCheckoutSession(params: CheckoutParams): Promise<CheckoutSession>;
     createSetupIntent(customer: string): Promise<SetupIntent>;
     paymentMethods(customer: string): Promise<PaymentMethod[]>;
+    createBillingPortalSession(customer: string, returnUrl: string): Promise<import("../gateway.js").BillingPortalSession>;
     verifyWebhook(rawBody: string, headers: HeaderBag, secret: string): Promise<WebhookEvent | null>;
     private normalize;
 }

package/dist/billing/drivers/stripe.js

@@ -219,6 +219,13 @@ export class StripeGateway {
             };
         });
     }
+    async createBillingPortalSession(customer, returnUrl) {
+        const session = await this.call("POST", "/billing_portal/sessions", {
+            customer,
+            return_url: returnUrl,
+        });
+        return { id: String(session.id), url: String(session.url ?? "") };
+    }
     /* ------------------------------ webhooks ------------------------------- */
     async verifyWebhook(rawBody, headers, secret) {
         const header = headers("stripe-signature");

package/dist/billing/gateway.d.ts

@@ -162,6 +162,13 @@ export interface BillingGateway {
     verifyWebhook(rawBody: string, headers: HeaderBag, secret: string): Promise<WebhookEvent | null>;
     createSetupIntent?(customer: string): Promise<SetupIntent>;
     paymentMethods?(customer: string): Promise<PaymentMethod[]>;
+    /** Hosted customer portal (manage card / cancel). Stripe-style. */
+    createBillingPortalSession?(customer: string, returnUrl: string): Promise<BillingPortalSession>;
+}
+/** A hosted billing-portal redirect. */
+export interface BillingPortalSession {
+    id: string;
+    url: string;
 }
 /** Raised for gateway/config problems and unsupported-capability calls. */
 export declare class BillingError extends Error {

package/dist/billing/index.d.ts

@@ -16,7 +16,7 @@ export type { BillableTarget, CheckoutOptions } from "./builder.js";
 export { BillingManager, billing, setBilling } from "./manager.js";
 export type { GatewayFactory } from "./manager.js";
 export { BillingError } from "./gateway.js";
-export type { BillingGateway, HeaderBag, CustomerDetails, GatewayCustomer, PriceRef, CreateSubscriptionParams, GatewaySubscription, GatewaySubscriptionItem, SwapParams, CancelParams, ChargeParams, GatewayCharge, RefundParams, GatewayRefund, GatewayInvoice, CheckoutParams, CheckoutSession, SetupIntent, PaymentMethod, WebhookEvent, } from "./gateway.js";
+export type { BillingGateway, HeaderBag, CustomerDetails, GatewayCustomer, PriceRef, CreateSubscriptionParams, GatewaySubscription, GatewaySubscriptionItem, SwapParams, CancelParams, ChargeParams, GatewayCharge, RefundParams, GatewayRefund, GatewayInvoice, CheckoutParams, CheckoutSession, SetupIntent, PaymentMethod, BillingPortalSession, WebhookEvent, } from "./gateway.js";
 export { registerDefaultGateways, StripeGateway, PaddleGateway, FakeGateway } from "./drivers/index.js";
 export type { FakeCall } from "./drivers/index.js";
 export { handleWebhook, resolveBillableUsing } from "./webhooks.js";

package/dist/core/index.d.ts

@@ -102,7 +102,7 @@ export { Session, session, sessionMiddleware } from "./session.js";
 export type { SessionOptions } from "./session.js";
 export { Auth, auth, authGuard, bearerAuth, basicAuth, tokenAuth, token, tokenCan, setUserProvider } from "./auth.js";
 export type { UserProvider, BasicVerifier } from "./auth.js";
-export { createToken, verifyToken, revokeToken, revokeTokens, listTokens, tokenAllows, tokenDenies, setTokensTable, } from "./tokens.js";
+export { createToken, verifyToken, revokeToken, revokeTokens, listTokens, tokenAllows, tokenDenies, setTokensTable, tokensMigration, } from "./tokens.js";
 export type { AccessToken, CreateTokenOptions, IssuedToken } from "./tokens.js";
 export { social, github, google, discord, oauthDriver, oauthState, OAuthDriver, OAuthError, twitter, oauth1Driver, oauth1Signature, OAuth1Driver, } from "./social.js";
 export type { SocialUser, OAuthToken, OAuthConfig, ProviderSpec, RedirectOptions, OAuth1Config, OAuth1Token, OAuth1ProviderSpec, } from "./social.js";

package/dist/core/index.js

@@ -54,7 +54,7 @@ export { HttpException, BadRequestException, UnauthorizedException, PaymentRequi
 export { validate, validateRequest, validated } from "./validation.js";
 export { Session, session, sessionMiddleware } from "./session.js";
 export { Auth, auth, authGuard, bearerAuth, basicAuth, tokenAuth, token, tokenCan, setUserProvider } from "./auth.js";
-export { createToken, verifyToken, revokeToken, revokeTokens, listTokens, tokenAllows, tokenDenies, setTokensTable, } from "./tokens.js";
+export { createToken, verifyToken, revokeToken, revokeTokens, listTokens, tokenAllows, tokenDenies, setTokensTable, tokensMigration, } from "./tokens.js";
 export { social, github, google, discord, oauthDriver, oauthState, OAuthDriver, OAuthError, twitter, oauth1Driver, oauth1Signature, OAuth1Driver, } from "./social.js";
 export { define, policy, gateBefore, gateAfter, setUserResolver, clearAuthorization, can, cannot, canFor, authorize, authorizeFor, } from "./authorization.js";
 export { Transformer } from "./transformer.js";

package/dist/core/tokens.d.ts

@@ -72,3 +72,5 @@ export declare function revokeToken(selector: string, connection?: string): Prom
 export declare function revokeTokens(tokenableId: string | number, connection?: string): Promise<void>;
 /** List an entity's tokens (metadata only — the secret is never stored). */
 export declare function listTokens(tokenableId: string | number, connection?: string): Promise<AccessToken[]>;
+/** Schema for personal access tokens (SQLite-friendly; works on Postgres with minor tweaks). */
+export declare function tokensMigration(tableName?: string): import("./migrations.js").Migration;

package/dist/core/tokens.js

@@ -153,3 +153,27 @@ function parseAbilities(value) {
         return ["*"];
     }
 }
+/** Schema for personal access tokens (SQLite-friendly; works on Postgres with minor tweaks). */
+export function tokensMigration(tableName = "personal_access_tokens") {
+    return {
+        name: `tokens_00_${tableName}`,
+        async up(schema) {
+            await schema.raw(`
+        CREATE TABLE IF NOT EXISTS ${tableName} (
+          selector TEXT NOT NULL UNIQUE,
+          hash TEXT NOT NULL,
+          tokenable_id TEXT NOT NULL,
+          name TEXT,
+          abilities TEXT,
+          last_used_at INTEGER,
+          expires_at INTEGER,
+          created_at INTEGER
+        )
+      `);
+            await schema.raw(`CREATE INDEX IF NOT EXISTS idx_${tableName}_tokenable ON ${tableName} (tokenable_id)`);
+        },
+        async down(schema) {
+            await schema.dropTable(tableName).catch(() => { });
+        },
+    };
+}

package/dist/gates/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Keel Gates — private-alpha / waitlist signup gating.
+ *
+ *   import { GatesServiceProvider, canRegister, redeemInvite } from "@shaferllc/keel/gates";
+ *
+ * Not the same as team invitations in `@shaferllc/keel/teams`.
+ */
+export { GatesServiceProvider } from "./provider.js";
+export { InviteCode, EmailAllowlist, canRegister, redeemInvite, gatesMigration, } from "./models.js";
+export type { GateCheck } from "./models.js";

package/dist/gates/index.js

@@ -0,0 +1,9 @@
+/**
+ * Keel Gates — private-alpha / waitlist signup gating.
+ *
+ *   import { GatesServiceProvider, canRegister, redeemInvite } from "@shaferllc/keel/gates";
+ *
+ * Not the same as team invitations in `@shaferllc/keel/teams`.
+ */
+export { GatesServiceProvider } from "./provider.js";
+export { InviteCode, EmailAllowlist, canRegister, redeemInvite, gatesMigration, } from "./models.js";

package/dist/gates/models.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Signup gates — invite codes + email allowlist for private alpha / waitlist.
+ * Distinct from team invitations (`@shaferllc/keel/teams`).
+ */
+import { Model } from "../core/model.js";
+import type { Migration } from "../core/migrations.js";
+export declare class InviteCode extends Model {
+    static table: string;
+    static fillable: string[];
+    static timestamps: boolean;
+    id: number;
+    code: string;
+    max_uses: number;
+    uses: number;
+    created_by: number | null;
+    expires_at: string | null;
+}
+export declare class EmailAllowlist extends Model {
+    static table: string;
+    static fillable: string[];
+    static timestamps: boolean;
+    id: number;
+    email: string;
+    created_by: number | null;
+}
+export type GateCheck = {
+    ok: true;
+    via: "allowlist" | "code";
+    invite?: InviteCode;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Private alpha: allowlisted email OR a valid invite code. */
+export declare function canRegister(email: string, inviteCode?: string): Promise<GateCheck>;
+export declare function redeemInvite(invite: InviteCode): Promise<void>;
+/**
+ * Schema for invite codes + allowlist.
+ * Uses IF NOT EXISTS so apps that already created these tables (e.g. early
+ * keel-cloud) can still register the provider safely.
+ */
+export declare function gatesMigration(): Migration;

package/dist/gates/models.js

@@ -0,0 +1,76 @@
+/**
+ * Signup gates — invite codes + email allowlist for private alpha / waitlist.
+ * Distinct from team invitations (`@shaferllc/keel/teams`).
+ */
+import { Model } from "../core/model.js";
+export class InviteCode extends Model {
+    static table = "invite_codes";
+    static fillable = ["code", "max_uses", "uses", "created_by", "expires_at"];
+    static timestamps = true;
+}
+export class EmailAllowlist extends Model {
+    static table = "email_allowlist";
+    static fillable = ["email", "created_by"];
+    static timestamps = true;
+}
+/** Private alpha: allowlisted email OR a valid invite code. */
+export async function canRegister(email, inviteCode) {
+    const normalized = email.toLowerCase().trim();
+    const allowed = await EmailAllowlist.newQuery().where("email", normalized).first();
+    if (allowed)
+        return { ok: true, via: "allowlist" };
+    const code = String(inviteCode ?? "").trim();
+    if (!code) {
+        return { ok: false, reason: "Registration requires an invite code or allowlisted email." };
+    }
+    const invite = await InviteCode.newQuery().where("code", code).first();
+    if (!invite)
+        return { ok: false, reason: "That invite code is invalid." };
+    if (invite.expires_at && new Date(invite.expires_at).getTime() < Date.now()) {
+        return { ok: false, reason: "That invite code has expired." };
+    }
+    if (invite.uses >= invite.max_uses) {
+        return { ok: false, reason: "That invite code has already been used up." };
+    }
+    return { ok: true, via: "code", invite };
+}
+export async function redeemInvite(invite) {
+    await invite.update({ uses: invite.uses + 1 });
+}
+/**
+ * Schema for invite codes + allowlist.
+ * Uses IF NOT EXISTS so apps that already created these tables (e.g. early
+ * keel-cloud) can still register the provider safely.
+ */
+export function gatesMigration() {
+    return {
+        name: "gates_00_invite_allowlist",
+        async up(schema) {
+            await schema.raw(`
+        CREATE TABLE IF NOT EXISTS invite_codes (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          code VARCHAR(255) NOT NULL UNIQUE,
+          max_uses INTEGER DEFAULT 1,
+          uses INTEGER DEFAULT 0,
+          created_by INTEGER,
+          expires_at TIMESTAMP,
+          created_at TIMESTAMP,
+          updated_at TIMESTAMP
+        )
+      `);
+            await schema.raw(`
+        CREATE TABLE IF NOT EXISTS email_allowlist (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          email VARCHAR(255) NOT NULL UNIQUE,
+          created_by INTEGER,
+          created_at TIMESTAMP,
+          updated_at TIMESTAMP
+        )
+      `);
+        },
+        async down(schema) {
+            await schema.dropTable("email_allowlist").catch(() => { });
+            await schema.dropTable("invite_codes").catch(() => { });
+        },
+    };
+}

package/dist/gates/provider.d.ts

@@ -0,0 +1,10 @@
+import { PackageProvider } from "../core/package.js";
+/**
+ * Signup gates — invite codes + email allowlist.
+ *
+ *   app.register(GatesServiceProvider)
+ */
+export declare class GatesServiceProvider extends PackageProvider {
+    readonly name = "gates";
+    register(): void;
+}

package/dist/gates/provider.js

@@ -0,0 +1,13 @@
+import { PackageProvider } from "../core/package.js";
+import { gatesMigration } from "./models.js";
+/**
+ * Signup gates — invite codes + email allowlist.
+ *
+ *   app.register(GatesServiceProvider)
+ */
+export class GatesServiceProvider extends PackageProvider {
+    name = "gates";
+    register() {
+        this.migrations([gatesMigration()]);
+    }
+}

package/dist/hosting/cloudflare.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Cloudflare REST client — D1 + Workers Custom Domains.
+ * Credentials are constructor args (no app config coupling).
+ */
+export type CloudflareCredentials = {
+    accountId: string;
+    apiToken: string;
+    /** Optional pin for a primary zone name (e.g. sites.example.com). */
+    pinnedZoneId?: string;
+    pinnedZoneName?: string;
+};
+export type WorkerDomain = {
+    id: string;
+    hostname: string;
+    service: string;
+    zone_id?: string;
+    zone_name?: string;
+};
+export declare function cloudflareConfigured(creds: Partial<CloudflareCredentials>): boolean;
+export declare class CloudflareClient {
+    private creds;
+    private baseUrl;
+    constructor(creds: CloudflareCredentials);
+    private accountId;
+    private apiToken;
+    private request;
+    createD1Database(name: string): Promise<{
+        uuid: string;
+        name: string;
+    }>;
+    resolveZoneId(zoneName: string): Promise<{
+        id: string;
+        name: string;
+    } | null>;
+    attachWorkerDomain(input: {
+        hostname: string;
+        service: string;
+        zoneId: string;
+        zoneName: string;
+    }): Promise<WorkerDomain>;
+    detachWorkerDomain(domainId: string): Promise<void>;
+    findWorkerDomain(hostname: string): Promise<WorkerDomain | null>;
+}

package/dist/hosting/cloudflare.js

@@ -0,0 +1,66 @@
+/**
+ * Cloudflare REST client — D1 + Workers Custom Domains.
+ * Credentials are constructor args (no app config coupling).
+ */
+export function cloudflareConfigured(creds) {
+    return Boolean(creds.accountId && creds.apiToken);
+}
+export class CloudflareClient {
+    creds;
+    baseUrl = "https://api.cloudflare.com/client/v4";
+    constructor(creds) {
+        this.creds = creds;
+    }
+    accountId() {
+        return this.creds.accountId;
+    }
+    apiToken() {
+        return this.creds.apiToken;
+    }
+    async request(method, path, body) {
+        const response = await fetch(`${this.baseUrl}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${this.apiToken()}`,
+                "content-type": "application/json",
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const payload = (await response.json());
+        if (!response.ok || !payload.success) {
+            const message = payload.errors?.map((e) => `${e.code}: ${e.message}`).join("; ") ??
+                `Cloudflare request failed (${response.status})`;
+            throw new Error(message);
+        }
+        return payload.result;
+    }
+    async createD1Database(name) {
+        return this.request("POST", `/accounts/${this.accountId()}/d1/database`, { name });
+    }
+    async resolveZoneId(zoneName) {
+        const pinned = this.creds.pinnedZoneId;
+        const pinnedName = this.creds.pinnedZoneName;
+        if (pinned && pinnedName && zoneName === pinnedName) {
+            return { id: pinned, name: zoneName };
+        }
+        const result = await this.request("GET", `/zones?name=${encodeURIComponent(zoneName)}&status=active&per_page=1`);
+        const zone = result?.[0];
+        return zone ? { id: zone.id, name: zone.name } : null;
+    }
+    async attachWorkerDomain(input) {
+        return this.request("PUT", `/accounts/${this.accountId()}/workers/domains`, {
+            hostname: input.hostname,
+            service: input.service,
+            environment: "production",
+            zone_id: input.zoneId,
+            zone_name: input.zoneName,
+        });
+    }
+    async detachWorkerDomain(domainId) {
+        await this.request("DELETE", `/accounts/${this.accountId()}/workers/domains/${domainId}`);
+    }
+    async findWorkerDomain(hostname) {
+        const result = await this.request("GET", `/accounts/${this.accountId()}/workers/domains?hostname=${encodeURIComponent(hostname)}`);
+        return result?.[0] ?? null;
+    }
+}

package/dist/hosting/dump.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Dump a SQLite-compatible connection to a portable .sql script.
+ */
+import type { Connection } from "../core/database.js";
+export declare function dumpConnection(conn: Connection, header: string, opts?: {
+    generatedBy?: string;
+}): Promise<string>;

package/dist/hosting/dump.js

@@ -0,0 +1,58 @@
+/**
+ * Dump a SQLite-compatible connection to a portable .sql script.
+ */
+function sqlLiteral(value) {
+    if (value === null || value === undefined)
+        return "NULL";
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    if (typeof value === "bigint")
+        return String(value);
+    if (typeof value === "boolean")
+        return value ? "1" : "0";
+    if (value instanceof Uint8Array) {
+        const hex = Array.from(value, (b) => b.toString(16).padStart(2, "0")).join("");
+        return `X'${hex}'`;
+    }
+    const str = String(value);
+    return `'${str.replace(/'/g, "''")}'`;
+}
+function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+export async function dumpConnection(conn, header, opts = {}) {
+    const by = opts.generatedBy ?? "Keel";
+    const lines = [
+        `-- ${header}`,
+        `-- Generated by ${by} at ${new Date().toISOString()}`,
+        "PRAGMA foreign_keys=OFF;",
+        "BEGIN TRANSACTION;",
+        "",
+    ];
+    const objects = await conn.select("SELECT type, name, sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' AND sql IS NOT NULL ORDER BY CASE type WHEN 'table' THEN 0 WHEN 'index' THEN 1 ELSE 2 END, name", []);
+    const tables = objects.filter((o) => o.type === "table" && typeof o.name === "string");
+    for (const table of tables) {
+        const name = String(table.name);
+        if (table.sql) {
+            lines.push(`DROP TABLE IF EXISTS ${quoteIdent(name)};`);
+            lines.push(`${String(table.sql)};`);
+            lines.push("");
+        }
+        const rows = await conn.select(`SELECT * FROM ${quoteIdent(name)}`, []);
+        if (rows.length === 0)
+            continue;
+        const columns = Object.keys(rows[0]);
+        for (const row of rows) {
+            const values = columns.map((col) => sqlLiteral(row[col]));
+            lines.push(`INSERT INTO ${quoteIdent(name)} (${columns.map(quoteIdent).join(", ")}) VALUES (${values.join(", ")});`);
+        }
+        lines.push("");
+    }
+    const indexes = objects.filter((o) => o.type === "index" && o.sql);
+    for (const index of indexes) {
+        lines.push(`${String(index.sql)};`);
+    }
+    lines.push("COMMIT;");
+    lines.push("");
+    return lines.join("\n");
+}

package/dist/hosting/hostname.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Hostname helpers for custom domains / Workers Custom Domains.
+ */
+export declare function normalizeHostname(raw: string): string;
+export declare function isValidHostname(hostname: string): boolean;
+/** Zone name candidates from most specific to apex (e.g. app.ex.com → app.ex.com, ex.com). */
+export declare function zoneCandidates(hostname: string): string[];

package/dist/hosting/hostname.js

@@ -0,0 +1,25 @@
+/**
+ * Hostname helpers for custom domains / Workers Custom Domains.
+ */
+const HOSTNAME_RE = /^(?=.{1,253}$)(?!-)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.(?!-)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+export function normalizeHostname(raw) {
+    return raw.trim().toLowerCase().replace(/\.$/, "").replace(/^https?:\/\//, "").split("/")[0];
+}
+export function isValidHostname(hostname) {
+    if (!HOSTNAME_RE.test(hostname))
+        return false;
+    if (hostname.includes(".."))
+        return false;
+    return true;
+}
+/** Zone name candidates from most specific to apex (e.g. app.ex.com → app.ex.com, ex.com). */
+export function zoneCandidates(hostname) {
+    const parts = hostname.split(".").filter(Boolean);
+    if (parts.length < 2)
+        return [];
+    const out = [];
+    for (let i = 0; i <= parts.length - 2; i++) {
+        out.push(parts.slice(i).join("."));
+    }
+    return out;
+}

package/dist/hosting/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Keel Hosting — Cloudflare client, hostname helpers, SQL dump, secrets vault.
+ *
+ *   import { CloudflareClient, dumpConnection, normalizeHostname } from "@shaferllc/keel/hosting";
+ *
+ * This is infrastructure for hosted Workers/D1 apps — not a full control plane.
+ * Product orchestration (sites, plans, deploy loops) stays in the app.
+ */
+export { CloudflareClient, cloudflareConfigured, } from "./cloudflare.js";
+export type { CloudflareCredentials, WorkerDomain } from "./cloudflare.js";
+export { normalizeHostname, isValidHostname, zoneCandidates } from "./hostname.js";
+export { dumpConnection } from "./dump.js";
+export { normalizeSecretKey, encryptSecretValue, decryptSecretValue, resolveSecretRows, } from "./secrets.js";
+export type { SecretRow } from "./secrets.js";

package/dist/hosting/index.js

@@ -0,0 +1,12 @@
+/**
+ * Keel Hosting — Cloudflare client, hostname helpers, SQL dump, secrets vault.
+ *
+ *   import { CloudflareClient, dumpConnection, normalizeHostname } from "@shaferllc/keel/hosting";
+ *
+ * This is infrastructure for hosted Workers/D1 apps — not a full control plane.
+ * Product orchestration (sites, plans, deploy loops) stays in the app.
+ */
+export { CloudflareClient, cloudflareConfigured, } from "./cloudflare.js";
+export { normalizeHostname, isValidHostname, zoneCandidates } from "./hostname.js";
+export { dumpConnection } from "./dump.js";
+export { normalizeSecretKey, encryptSecretValue, decryptSecretValue, resolveSecretRows, } from "./secrets.js";

package/dist/hosting/secrets.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Encrypted key/value secrets vault — purpose-scoped encryption via Keel core.
+ *
+ * Apps supply a table of rows with `owner_id`, `key`, `value_encrypted`.
+ * This helper doesn't own the model; it encrypts/decrypts values.
+ */
+export type SecretRow = {
+    key: string;
+    value_encrypted: string;
+};
+export declare function normalizeSecretKey(key: string): string;
+export declare function encryptSecretValue(value: string, purpose?: string): Promise<string>;
+export declare function decryptSecretValue(payload: string, purpose?: string): Promise<string | null>;
+/** Decrypt a list of encrypted rows into a plain key→value map. */
+export declare function resolveSecretRows(rows: SecretRow[], purpose?: string): Promise<Record<string, string>>;