@we8/cloudflare 0.1.1 → 0.2.0

package/dist/skill-command.js

@@ -0,0 +1,122 @@
+/**
+ * `we8-cloudflare skill`: write or refresh the project skill in place.
+ *
+ * The scaffolder writes the skill once, at `npm create we8`. Everything after
+ * that is this command's job: a project that predates the skill adopts one, a
+ * project whose auth registration changed refreshes it, and CI checks that the
+ * file in the repository is the one this version of the pack would write.
+ *
+ * The state it generates from is derived from the project itself, never asked
+ * for. The mode comes out of the worker entry with its comments stripped (the
+ * same read the doctor does, for the same reason: the generated entries
+ * explain the modes they are not in), the site workspace is a directory that
+ * either exists or does not, and the perimeter acknowledgement is a fact about
+ * one line of code. Nothing here can produce a skill that describes a project
+ * other than this one.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { findD1Binding, readAdminAuthMode, readPerimeterAcknowledged, } from './doctor.js';
+import { findConfigPath, readWorkerEntry } from './project.js';
+import { parseJsonc } from './jsonc.js';
+import { generateSkill, SKILL_RELATIVE_PATH } from './skill.js';
+/** Whether a directory carries the Astro starter the template scaffolds. */
+export function hasSiteWorkspace(projectDir) {
+    return existsSync(join(projectDir, 'site', 'package.json'));
+}
+/**
+ * The project's own wrangler config, parsed, or null when this is not a we8
+ * project. "Not a we8 project" is a config that is absent, unparseable, or
+ * carries no D1 binding named DB: that binding is the shape every command in
+ * this pack reads, so a directory without one is somewhere the skill would be
+ * a guess rather than a description.
+ */
+function readProjectConfig(projectDir) {
+    const configPath = findConfigPath(projectDir);
+    if (!configPath) {
+        return {
+            refusal: 'this is not a we8 project: no wrangler.jsonc, wrangler.json, or wrangler.toml here',
+            fix: 'Run this from the project root, or scaffold one with: npm create we8',
+        };
+    }
+    if (configPath.endsWith('.toml')) {
+        return {
+            refusal: `${configPath} is TOML; this pack generates and reads wrangler.jsonc`,
+            fix: 'Convert the config to wrangler.jsonc, which is what npm create we8 writes',
+        };
+    }
+    let config;
+    try {
+        config = parseJsonc(readFileSync(configPath, 'utf8'));
+    }
+    catch (error) {
+        return {
+            refusal: `${configPath} could not be parsed: ${error instanceof Error ? error.message : String(error)}`,
+            fix: 'Fix the JSON in the config, then run this again',
+        };
+    }
+    if (!findD1Binding(config)) {
+        return {
+            refusal: 'this is not a we8 project: the wrangler config has no D1 binding named DB',
+            fix: 'Run this from a we8 project root, or scaffold one with: npm create we8',
+        };
+    }
+    return { config };
+}
+/**
+ * Writes the skill, or checks it. `check` never touches the filesystem beyond
+ * reading, so it is safe to run anywhere, CI included.
+ */
+export function runSkillCommand(projectDir, options) {
+    const dir = resolve(projectDir);
+    const path = join(dir, SKILL_RELATIVE_PATH);
+    const project = readProjectConfig(dir);
+    if ('refusal' in project) {
+        return { status: 'not-a-project', path, mode: null, message: project.refusal, fix: project.fix };
+    }
+    const entry = readWorkerEntry(dir, project.config);
+    const mode = readAdminAuthMode(entry);
+    const wanted = generateSkill({
+        mode,
+        site: hasSiteWorkspace(dir),
+        ...(mode === 'perimeter' ? { acknowledged: readPerimeterAcknowledged(entry) } : {}),
+    });
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
+    if (options.check) {
+        if (existing === null) {
+            return {
+                status: 'missing',
+                path,
+                mode,
+                message: `no skill at ${SKILL_RELATIVE_PATH}`,
+                fix: 'we8-cloudflare skill',
+            };
+        }
+        if (existing !== wanted) {
+            return {
+                status: 'stale',
+                path,
+                mode,
+                message: `${SKILL_RELATIVE_PATH} is not what this project would generate (admin auth: ${mode})`,
+                fix: 'we8-cloudflare skill',
+            };
+        }
+        return { status: 'current', path, mode, message: `${SKILL_RELATIVE_PATH} is current (admin auth: ${mode})` };
+    }
+    if (existing === wanted) {
+        return { status: 'unchanged', path, mode, message: `${SKILL_RELATIVE_PATH} is already current (admin auth: ${mode})` };
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, wanted, 'utf8');
+    return {
+        status: 'written',
+        path,
+        mode,
+        message: `${existing === null ? 'Wrote' : 'Refreshed'} ${SKILL_RELATIVE_PATH} (admin auth: ${mode})`,
+    };
+}
+/** Zero when the project is in the state the command asked for, one otherwise. */
+export function skillExitCode(status) {
+    return status === 'written' || status === 'unchanged' || status === 'current' ? 0 : 1;
+}
+//# sourceMappingURL=skill-command.js.map

package/dist/skill-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-command.js","sourceRoot":"","sources":["../src/skill-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA6BhE,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,oFAAoF;YAC7F,GAAG,EAAE,sEAAsE;SAC5E,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,GAAG,UAAU,wDAAwD;YAC9E,GAAG,EAAE,2EAA2E;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,GAAG,UAAU,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACvG,GAAG,EAAE,iDAAiD;SACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,2EAA2E;YACpF,GAAG,EAAE,wEAAwE;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAA2B;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,IAAI;QACJ,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC3B,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,IAAI;gBACJ,IAAI;gBACJ,OAAO,EAAE,eAAe,mBAAmB,EAAE;gBAC7C,GAAG,EAAE,sBAAsB;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,IAAI;gBACJ,IAAI;gBACJ,OAAO,EAAE,GAAG,mBAAmB,yDAAyD,IAAI,GAAG;gBAC/F,GAAG,EAAE,sBAAsB;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,mBAAmB,4BAA4B,IAAI,GAAG,EAAE,CAAC;IAC/G,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,mBAAmB,oCAAoC,IAAI,GAAG,EAAE,CAAC;IACzH,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,mBAAmB,iBAAiB,IAAI,GAAG;KACrG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/skill.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The project skill, generated.
+ *
+ * Claude Code and its kin discover a skill at `.claude/skills/<name>/SKILL.md`
+ * automatically, so a we8 project can arrive with an agent that already knows
+ * how to drive it instead of rediscovering it from the file tree. The file is
+ * an operating manual rather than a description: dense, imperative, and true
+ * of THIS project, which is why it is generated from the project's own state
+ * rather than copied from a fixture.
+ *
+ * It lives here rather than in `create-we8` because two commands write it:
+ * the scaffolder, at `npm create we8`, and `we8-cloudflare skill`, which
+ * adopts or refreshes it in a project that already exists. `create-we8`
+ * already depends on this package, so one generator serves both with no cycle
+ * and no second copy to drift.
+ *
+ * Everything below is a pure function of the options. The filesystem half is
+ * in skill-command.ts.
+ */
+import type { AdminAuthMode } from './doctor.js';
+/** Where the skill goes inside a project. Claude Code looks here by itself. */
+export declare const SKILL_RELATIVE_PATH = ".claude/skills/we8/SKILL.md";
+/**
+ * Which auth mode the skill teaches. The same vocabulary the doctor reads out
+ * of a worker entry, so the skill a project gets and the mode the doctor
+ * reports can never disagree: both come from `readAdminAuthMode`.
+ *
+ * Note that `none` here means what it means everywhere else in this pack, a
+ * worker with NO provider registered, and not the scaffolder's `--auth none`,
+ * which composes perimeter mode. `create-we8` maps its own answer across.
+ */
+export type SkillAuthMode = AdminAuthMode;
+/** What the skill is generated from: the project's state, and nothing else. */
+export interface SkillOptions {
+    /** The composed admin auth mode. */
+    mode: SkillAuthMode;
+    /** True when the project carries the Astro starter under `site/`. */
+    site: boolean;
+    /**
+     * Perimeter mode only: whether the registration says `{ acknowledged: true }`.
+     * An unacknowledged perimeter fails `doctor --remote`, so the skill says so.
+     */
+    acknowledged?: boolean;
+}
+/**
+ * The skill, as a string. One argument set in, one file out; no filesystem, no
+ * project name, nothing that would make two projects in the same mode disagree
+ * about how a we8 site is operated.
+ */
+export declare function generateSkill(options: SkillOptions): string;
+//# sourceMappingURL=skill.d.ts.map

package/dist/skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,IAAI,EAAE,aAAa,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AA+FD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CA+G3D"}

package/dist/skill.js

@@ -0,0 +1,229 @@
+/**
+ * The project skill, generated.
+ *
+ * Claude Code and its kin discover a skill at `.claude/skills/<name>/SKILL.md`
+ * automatically, so a we8 project can arrive with an agent that already knows
+ * how to drive it instead of rediscovering it from the file tree. The file is
+ * an operating manual rather than a description: dense, imperative, and true
+ * of THIS project, which is why it is generated from the project's own state
+ * rather than copied from a fixture.
+ *
+ * It lives here rather than in `create-we8` because two commands write it:
+ * the scaffolder, at `npm create we8`, and `we8-cloudflare skill`, which
+ * adopts or refreshes it in a project that already exists. `create-we8`
+ * already depends on this package, so one generator serves both with no cycle
+ * and no second copy to drift.
+ *
+ * Everything below is a pure function of the options. The filesystem half is
+ * in skill-command.ts.
+ */
+/** Where the skill goes inside a project. Claude Code looks here by itself. */
+export const SKILL_RELATIVE_PATH = '.claude/skills/we8/SKILL.md';
+/** How the auth section heads itself, per mode. */
+const MODE_HEADING = {
+    embedded: 'Auth: embedded mode',
+    access: 'Auth: access mode',
+    perimeter: 'Auth: perimeter mode',
+    external: 'Auth: an external provider',
+    none: 'Auth: no provider registered',
+    unknown: 'Auth: mode unverified',
+};
+/** The mode-specific half of the auth section. */
+function authSection(options, p) {
+    switch (options.mode) {
+        case 'embedded':
+            p('- @we8/auth is registered: Better Auth over this site\'s own D1, mounted at');
+            p('  /api/auth/*, email and password.');
+            p('- The FIRST sign-up becomes the owner and public sign-up closes behind it.');
+            p('  Every account after that is created BY the owner, in the portal under');
+            p('  Setup or at POST /v1/admin/users. Never reopen public sign-up to make a');
+            p('  second account.');
+            p('- BETTER_AUTH_SECRET is required: .dev.vars locally, wrangler secret put for');
+            p('  the deployment. Without it sign-in is refused rather than validated.');
+            p('- Password reset sends through the CMS email seam, so it does nothing until');
+            p('  EMAIL_MODE, EMAIL_FROM, and the EMAIL binding are configured.');
+            return;
+        case 'access':
+            p('- Cloudflare Access signs people in; this worker only verifies what Access');
+            p('  forwards. Every admin request carries a signed assertion in');
+            p('  Cf-Access-Jwt-Assertion (or the CF_Authorization cookie behind it),');
+            p('  checked for signature, issuer, audience, and expiry before it is anybody.');
+            p('- There is NO user table here: no sign-up, no password, no password reset,');
+            p('  and no /v1/admin/users route. Who may sign in is the Access policy.');
+            p('- ACCESS_TEAM_DOMAIN, ACCESS_AUD, and the owner mapping are the whole');
+            p('  configuration, as vars in wrangler.jsonc. Owners are the addresses in');
+            p('  ACCESS_OWNER_EMAILS, or everyone when ACCESS_OWNER_DEFAULT is "true";');
+            p('  everyone else Access admits is a member. A REPLACE_WITH_ placeholder');
+            p('  reads as not configured, and npm run doctor names it.');
+            p('- wrangler dev has no Access in front of it, so /v1/admin is refused');
+            p('  locally. Do admin work through a deployed preview behind the Access');
+            p('  application.');
+            p('- NEVER fake or bypass an assertion: no hand-written Cf-Access-Jwt-Assertion');
+            p('  header, no test bypass in the provider, no swap to perimeter mode to get');
+            p('  past a local 401. The verification IS the auth.');
+            return;
+        case 'perimeter':
+            p('- PERIMETER MODE. This worker authenticates nobody: EVERY request that');
+            p('  reaches /v1/admin/* is the owner. That is content, settings, API keys,');
+            p('  and the form inbox, which is other people\'s personal data.');
+            p('- There is no user table, no sign-in screen, no sign-out, and no');
+            p('  /v1/admin/users route. Whatever sits in front of the deployment is the');
+            p('  only gate there is.');
+            p('- Never expose a route to this Worker that the perimeter does not cover,');
+            p('  the workers.dev subdomain included; disable that subdomain if it is');
+            p('  unused.');
+            p('- Never delete { acknowledged: true } from the registration to quiet the');
+            p('  doctor. It is how this project says it read the paragraph above, and');
+            p('  npm run doctor:remote fails a deployment without it.');
+            if (options.acknowledged === false) {
+                p('- The registration does NOT carry { acknowledged: true } today, so');
+                p('  npm run doctor:remote fails. Add it once perimeter mode is what this');
+                p('  site means, rather than deleting the check.');
+            }
+            return;
+        case 'external':
+            p('- The worker registers an admin auth provider of its own. Read src/index.ts');
+            p('  for which: a registration is a line of code and lives nowhere else.');
+            p('- The provider says WHO a request is; @we8/cms still decides WHAT that');
+            p('  identity may do, so the role split below is unchanged by it.');
+            p('- @we8/cms exports what a provider needs: adminAuth, requireOwner,');
+            p('  corsMiddleware, HttpError, errorBoundary, ok, parseOrThrow, and Bindings.');
+            p('  A provider claiming a path under /v1/admin/ mounts those gates itself.');
+            return;
+        case 'none':
+            p('- NO provider is registered, so every /v1/admin request is refused with 403');
+            p('  forbidden and the admin portal cannot be used. The public API is');
+            p('  unaffected and still serves.');
+            p('- That is the secure default, not a broken state. To open the admin,');
+            p('  register exactly one provider in src/index.ts:');
+            p('    npm install @we8/auth, then registerAdminAuth(embeddedAdminAuth)');
+            p('    or registerAdminAuth(cloudflareAccessAdminAuth()) from @we8/cloudflare');
+            p('    or registerAdminAuth(perimeterAdminAuth({ acknowledged: true })), which');
+            p('    makes EVERY request that reaches the worker the owner');
+            p('- Then npm run db:migrate (a provider brings its own tables) and');
+            p('  npx we8-cloudflare skill, to rewrite this file for the mode you chose.');
+            return;
+        default:
+            p('- The worker entry named by "main" in wrangler.jsonc could not be read, so');
+            p('  the mode is unverified. Read src/index.ts: the registerAdminAuth line is');
+            p('  the whole answer, and npm run doctor reports the same.');
+            p('- Rerun npx we8-cloudflare skill once that file is readable.');
+    }
+}
+/**
+ * The skill, as a string. One argument set in, one file out; no filesystem, no
+ * project name, nothing that would make two projects in the same mode disagree
+ * about how a we8 site is operated.
+ */
+export function generateSkill(options) {
+    const lines = [];
+    const p = (line = '') => {
+        lines.push(line);
+    };
+    p('---');
+    p('name: we8');
+    p('description: Operate this we8 site. Use when working on the CMS, the admin');
+    p('  portal, content, forms, media, API keys, admin auth, AEO, wrangler, D1,');
+    p('  R2, local development, or a deploy in this project.');
+    p('---');
+    p();
+    p('# Operating this we8 project');
+    p();
+    p('This project IS a we8 CMS: one Cloudflare Worker, composed in src/index.ts');
+    p('from @we8/cms, configured by wrangler.jsonc, over its own D1 (bound DB) and');
+    p('R2 (bound MEDIA). The same worker serves the admin portal at / out of');
+    p('public/.');
+    if (options.site) {
+        p('The site/ workspace is an Astro frontend that reads this CMS over /v1.');
+    }
+    else {
+        p('The project is headless: any frontend reads this CMS over /v1.');
+    }
+    p();
+    p('The core is authless. registerAdminAuth(...) in src/index.ts is the WHOLE');
+    p('auth configuration: one line names the provider that says WHO a request is,');
+    p('and @we8/cms decides WHAT that identity may do. A worker registering no');
+    p('provider refuses every /v1/admin request with 403 forbidden and keeps');
+    p('serving the public API. That refusal is the secure default: fix the');
+    p('registration, never route around it.');
+    p();
+    p('## Commands');
+    p();
+    p('- npm run dev: the CMS and the bundled portal on http://localhost:8787');
+    p('- npm run db:migrate, db:migrate:remote: the schema. TWO directories apply');
+    p('  in order, the @we8/cms core migrations and then every installed');
+    p('  provider\'s (today node_modules/@we8/auth/migrations), and one command does');
+    p('  both. Running wrangler d1 migrations apply by hand applies only the first.');
+    p('- npm run db:seed: development data. LOCAL ONLY, it carries plaintext API');
+    p('  keys, and the command refuses every remote flag by design.');
+    p('- npm run doctor, doctor:remote: what is missing, plus the exact fix.');
+    p('- npm run admin:bundle: copies the built @we8/admin-app into public/, which');
+    p('  is how the worker serves the portal at /. Rerun it after upgrading the');
+    p('  portal package; an empty public/ means an API-only install.');
+    p('- npm run typecheck: compiles the registration against both packages, which');
+    p('  is what proves the auth seam still lines up.');
+    p('- npm run deploy: wrangler deploy to the Cloudflare account.');
+    if (options.site) {
+        p('- npm run site:dev, site:build: the Astro site. It builds from fixtures');
+        p('  until WE8_API_URL and WE8_PUBLISHABLE_KEY are set in site/.env.');
+    }
+    p('- npx we8-cloudflare skill: rewrite this file from the project\'s current');
+    p('  state. Run it after changing the auth registration; --check verifies it is');
+    p('  current and fails instead of writing, which is what belongs in CI.');
+    p();
+    p(`## ${MODE_HEADING[options.mode]}`);
+    p();
+    authSection(options, p);
+    p();
+    p('Whichever provider is registered:');
+    p();
+    p('- Roles are owner and member, and the split lives in @we8/cms: settings');
+    p('  mutation, the submissions inbox, API keys, and users are owner only.');
+    p('- No API key ever reaches /v1/admin/*. Presenting one there is refused');
+    p('  outright, because a publishable key travels in browser code by design.');
+    p('- GET /v1/auth/mode is keyless and reports the composed mode. That is the');
+    p('  way to learn the mode at runtime, and what the portal reads to decide');
+    p('  whether to show a sign-in screen at all.');
+    p();
+    p('## The API');
+    p();
+    p('- Everything public is under /v1 with one envelope, discriminated on ok.');
+    p('  Branch on the code field, never on the message.');
+    p('- Before writing API code, fetch GET /v1/openapi.json from the running');
+    p('  worker: it is this install\'s live contract and always matches the code.');
+    p('- Two key kinds: pk_ publishable in X-We8-Key, safe in browser code, and sk_');
+    p('  secret in Authorization: Bearer, for servers and build steps only. Both are');
+    p('  minted in the portal under Setup or at POST /v1/admin/keys; the secret is');
+    p('  shown exactly once, and a revoke takes effect on the next request.');
+    p('- Keyless routes: GET /v1/health, /v1/openapi.json, /v1/auth/mode,');
+    p('  /v1/sitemap.xml, GET /v1/media/*, and /llms.txt. Everything else public');
+    p('  needs a key.');
+    p('- Browser writes (form submissions, the visit and consent beacons) also need');
+    p('  the calling origin on settings.allowedOrigins, edited in the portal under');
+    p('  Setup, Integrations. A request with no Origin header passes.');
+    p('- A switched-off module answers 404, not 403.');
+    p();
+    p('## AEO');
+    p();
+    p('- Posts and site documents carry answerSummary (the answer, written to be');
+    p('  quoted verbatim) and questionHeading (the question it answers). Neither is');
+    p('  the excerpt, and an excerpt is not a substitute for either.');
+    p('- An authored answer becomes FAQPage JSON-LD on the post read and feeds');
+    p('  /llms.txt; render the jsonld object into a script tag exactly as it comes.');
+    p('- GET /v1/admin/aeo/checks lists the concrete gaps per post, and the portal');
+    p('  shows the same under Website. Fix findings in the post editor.');
+    p();
+    p('## Guardrails');
+    p();
+    p('- Never run the seed against a remote database and never weaken its');
+    p('  guardrails; never copy a seeded key into real content.');
+    p('- Never print, log, or commit an sk_ key, and never commit .dev.vars.');
+    p('- Set vars.SITE_URL to the real public origin before a production deploy:');
+    p('  the sitemap, llms.txt, and the JSON-LD are all built from it, and');
+    p('  doctor:remote fails a deployment still advertising localhost.');
+    p('- Form submissions are other people\'s personal data. Query them in place;');
+    p('  do not export, paste, or forward them.');
+    p('- When something fails, run npm run doctor before guessing.');
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=skill.js.map

package/dist/skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AA0BjE,mDAAmD;AACnD,MAAM,YAAY,GAAkC;IAClD,QAAQ,EAAE,qBAAqB;IAC/B,MAAM,EAAE,mBAAmB;IAC3B,SAAS,EAAE,sBAAsB;IACjC,QAAQ,EAAE,4BAA4B;IACtC,IAAI,EAAE,8BAA8B;IACpC,OAAO,EAAE,uBAAuB;CACjC,CAAC;AAEF,kDAAkD;AAClD,SAAS,WAAW,CAAC,OAAqB,EAAE,CAA0B;IACpE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,UAAU;YACb,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,oCAAoC,CAAC,CAAC;YACxC,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,yEAAyE,CAAC,CAAC;YAC7E,CAAC,CAAC,2EAA2E,CAAC,CAAC;YAC/E,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACvB,CAAC,CAAC,8EAA8E,CAAC,CAAC;YAClF,CAAC,CAAC,wEAAwE,CAAC,CAAC;YAC5E,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,iEAAiE,CAAC,CAAC;YACrE,OAAO;QACT,KAAK,QAAQ;YACX,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,+DAA+D,CAAC,CAAC;YACnE,CAAC,CAAC,uEAAuE,CAAC,CAAC;YAC3E,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,uEAAuE,CAAC,CAAC;YAC3E,CAAC,CAAC,uEAAuE,CAAC,CAAC;YAC3E,CAAC,CAAC,yEAAyE,CAAC,CAAC;YAC7E,CAAC,CAAC,yEAAyE,CAAC,CAAC;YAC7E,CAAC,CAAC,wEAAwE,CAAC,CAAC;YAC5E,CAAC,CAAC,yDAAyD,CAAC,CAAC;YAC7D,CAAC,CAAC,sEAAsE,CAAC,CAAC;YAC1E,CAAC,CAAC,uEAAuE,CAAC,CAAC;YAC3E,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACpB,CAAC,CAAC,8EAA8E,CAAC,CAAC;YAClF,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,mDAAmD,CAAC,CAAC;YACvD,OAAO;QACT,KAAK,WAAW;YACd,CAAC,CAAC,wEAAwE,CAAC,CAAC;YAC5E,CAAC,CAAC,0EAA0E,CAAC,CAAC;YAC9E,CAAC,CAAC,+DAA+D,CAAC,CAAC;YACnE,CAAC,CAAC,kEAAkE,CAAC,CAAC;YACtE,CAAC,CAAC,0EAA0E,CAAC,CAAC;YAC9E,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC3B,CAAC,CAAC,0EAA0E,CAAC,CAAC;YAC9E,CAAC,CAAC,uEAAuE,CAAC,CAAC;YAC3E,CAAC,CAAC,WAAW,CAAC,CAAC;YACf,CAAC,CAAC,0EAA0E,CAAC,CAAC;YAC9E,CAAC,CAAC,wEAAwE,CAAC,CAAC;YAC5E,CAAC,CAAC,wDAAwD,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnC,CAAC,CAAC,oEAAoE,CAAC,CAAC;gBACxE,CAAC,CAAC,wEAAwE,CAAC,CAAC;gBAC5E,CAAC,CAAC,+CAA+C,CAAC,CAAC;YACrD,CAAC;YACD,OAAO;QACT,KAAK,UAAU;YACb,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,uEAAuE,CAAC,CAAC;YAC3E,CAAC,CAAC,wEAAwE,CAAC,CAAC;YAC5E,CAAC,CAAC,gEAAgE,CAAC,CAAC;YACpE,CAAC,CAAC,oEAAoE,CAAC,CAAC;YACxE,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,0EAA0E,CAAC,CAAC;YAC9E,OAAO;QACT,KAAK,MAAM;YACT,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,oEAAoE,CAAC,CAAC;YACxE,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACpC,CAAC,CAAC,sEAAsE,CAAC,CAAC;YAC1E,CAAC,CAAC,kDAAkD,CAAC,CAAC;YACtD,CAAC,CAAC,sEAAsE,CAAC,CAAC;YAC1E,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,6EAA6E,CAAC,CAAC;YACjF,CAAC,CAAC,2DAA2D,CAAC,CAAC;YAC/D,CAAC,CAAC,kEAAkE,CAAC,CAAC;YACtE,CAAC,CAAC,0EAA0E,CAAC,CAAC;YAC9E,OAAO;QACT;YACE,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,4EAA4E,CAAC,CAAC;YAChF,CAAC,CAAC,0DAA0D,CAAC,CAAC;YAC9D,CAAC,CAAC,8DAA8D,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,EAAQ,EAAE;QAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,CAAC,CAAC,KAAK,CAAC,CAAC;IACT,CAAC,CAAC,WAAW,CAAC,CAAC;IACf,CAAC,CAAC,4EAA4E,CAAC,CAAC;IAChF,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,uDAAuD,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,CAAC;IACT,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAClC,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,4EAA4E,CAAC,CAAC;IAChF,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,uEAAuE,CAAC,CAAC;IAC3E,CAAC,CAAC,UAAU,CAAC,CAAC;IACd,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,wEAAwE,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,gEAAgE,CAAC,CAAC;IACtE,CAAC;IACD,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,yEAAyE,CAAC,CAAC;IAC7E,CAAC,CAAC,uEAAuE,CAAC,CAAC;IAC3E,CAAC,CAAC,qEAAqE,CAAC,CAAC;IACzE,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAC1C,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,aAAa,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,wEAAwE,CAAC,CAAC;IAC5E,CAAC,CAAC,4EAA4E,CAAC,CAAC;IAChF,CAAC,CAAC,mEAAmE,CAAC,CAAC;IACvE,CAAC,CAAC,+EAA+E,CAAC,CAAC;IACnF,CAAC,CAAC,8EAA8E,CAAC,CAAC;IAClF,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,8DAA8D,CAAC,CAAC;IAClE,CAAC,CAAC,uEAAuE,CAAC,CAAC;IAC3E,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,0EAA0E,CAAC,CAAC;IAC9E,CAAC,CAAC,+DAA+D,CAAC,CAAC;IACnE,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,gDAAgD,CAAC,CAAC;IACpD,CAAC,CAAC,8DAA8D,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,yEAAyE,CAAC,CAAC;QAC7E,CAAC,CAAC,mEAAmE,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,8EAA8E,CAAC,CAAC;IAClF,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAC1E,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,EAAE,CAAC;IACJ,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,mCAAmC,CAAC,CAAC;IACvC,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,yEAAyE,CAAC,CAAC;IAC7E,CAAC,CAAC,wEAAwE,CAAC,CAAC;IAC5E,CAAC,CAAC,wEAAwE,CAAC,CAAC;IAC5E,CAAC,CAAC,0EAA0E,CAAC,CAAC;IAC9E,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,yEAAyE,CAAC,CAAC;IAC7E,CAAC,CAAC,4CAA4C,CAAC,CAAC;IAChD,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,YAAY,CAAC,CAAC;IAChB,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,0EAA0E,CAAC,CAAC;IAC9E,CAAC,CAAC,mDAAmD,CAAC,CAAC;IACvD,CAAC,CAAC,wEAAwE,CAAC,CAAC;IAC5E,CAAC,CAAC,4EAA4E,CAAC,CAAC;IAChF,CAAC,CAAC,8EAA8E,CAAC,CAAC;IAClF,CAAC,CAAC,+EAA+E,CAAC,CAAC;IACnF,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAC1E,CAAC,CAAC,oEAAoE,CAAC,CAAC;IACxE,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpB,CAAC,CAAC,8EAA8E,CAAC,CAAC;IAClF,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,gEAAgE,CAAC,CAAC;IACpE,CAAC,CAAC,+CAA+C,CAAC,CAAC;IACnD,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,QAAQ,CAAC,CAAC;IACZ,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,8EAA8E,CAAC,CAAC;IAClF,CAAC,CAAC,+DAA+D,CAAC,CAAC;IACnE,CAAC,CAAC,yEAAyE,CAAC,CAAC;IAC7E,CAAC,CAAC,8EAA8E,CAAC,CAAC;IAClF,CAAC,CAAC,6EAA6E,CAAC,CAAC;IACjF,CAAC,CAAC,kEAAkE,CAAC,CAAC;IACtE,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,eAAe,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC;IACJ,CAAC,CAAC,qEAAqE,CAAC,CAAC;IACzE,CAAC,CAAC,0DAA0D,CAAC,CAAC;IAC9D,CAAC,CAAC,uEAAuE,CAAC,CAAC;IAC3E,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAC/E,CAAC,CAAC,qEAAqE,CAAC,CAAC;IACzE,CAAC,CAAC,iEAAiE,CAAC,CAAC;IACrE,CAAC,CAAC,4EAA4E,CAAC,CAAC;IAChF,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAC9C,CAAC,CAAC,6DAA6D,CAAC,CAAC;IAEjE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/wrangler-config.d.ts

@@ -10,18 +10,73 @@
  */
 /** The placeholder id a project carries until its D1 database exists. */
 export declare const D1_ID_PLACEHOLDER = "REPLACE_WITH_YOUR_D1_DATABASE_ID";
+/**
+ * The placeholders an access-mode project carries until the Access application
+ * exists. They are written by the scaffolder, checked by the doctor, and read
+ * as "not configured" by the provider itself, so one convention covers all
+ * three rather than three near-misses.
+ */
+export declare const ACCESS_TEAM_DOMAIN_PLACEHOLDER = "REPLACE_WITH_YOUR_ACCESS_TEAM_DOMAIN";
+export declare const ACCESS_AUD_PLACEHOLDER = "REPLACE_WITH_YOUR_ACCESS_AUD_TAG";
+export declare const ACCESS_OWNER_PLACEHOLDER = "REPLACE_WITH_YOUR_OWNER_EMAIL";
+/** True for any value the scaffolder left for somebody to fill in. */
+export declare function isPlaceholder(value: string): boolean;
+/**
+ * The vars the Cloudflare Access provider reads.
+ *
+ * Named here, next to the generator that writes them, because three separate
+ * files depend on the spelling being identical: the provider that reads them at
+ * runtime, this generator that puts them in a project's config, and the doctor
+ * that checks they are filled in.
+ */
+export declare const ACCESS_TEAM_DOMAIN_VAR = "ACCESS_TEAM_DOMAIN";
+export declare const ACCESS_AUD_VAR = "ACCESS_AUD";
+export declare const ACCESS_OWNER_EMAILS_VAR = "ACCESS_OWNER_EMAILS";
+export declare const ACCESS_OWNER_DEFAULT_VAR = "ACCESS_OWNER_DEFAULT";
 /**
  * The compatibility date the CMS is written against. Pinned here rather than
  * set to today's date at scaffold time: a date the code has never run under is
  * a guess, and a guess in a compatibility date is a runtime surprise.
  */
 export declare const COMPATIBILITY_DATE = "2026-07-05";
-/** Where the migrations live in an installed project. */
+/** Where the core migrations live in an installed project. */
 export declare const DEFAULT_MIGRATIONS_DIR = "node_modules/@we8/cms/migrations";
+/**
+ * Where the embedded auth provider's migrations live, when it is installed.
+ *
+ * The schema of a we8 site comes from as many packages as it composes: the CMS
+ * owns its tables and `@we8/auth` owns the four Better Auth ones. Each ships
+ * its own numbered sequence with names that cannot collide, and
+ * `we8-cloudflare migrate` applies the core directory first and then this one.
+ */
+export declare const AUTH_MIGRATIONS_DIR = "node_modules/@we8/auth/migrations";
+/**
+ * The config `we8-cloudflare migrate` writes to apply a second migrations
+ * directory into the same database.
+ *
+ * `wrangler d1 migrations apply` reads exactly one `migrations_dir` from
+ * exactly one config, so applying two directories means running it twice with
+ * two configs. Everything that identifies the database is copied verbatim from
+ * the project's own config, because two runs against two different databases
+ * would be the bug this generates a file to avoid.
+ */
+export declare function generateMigrationsConfig(source: {
+    name?: unknown;
+    compatibilityDate?: unknown;
+    databaseName?: unknown;
+    databaseId?: unknown;
+}, migrationsDir: string): string;
 /** The daily retention sweep, matching the CMS package config. */
 export declare const RETENTION_CRON = "0 3 * * *";
 /** How a project sends mail. `off` is the default and drops every message. */
 export type EmailMode = 'off' | 'console' | 'cloudflare';
+/**
+ * Which admin auth provider the project's worker entry composes. The generator
+ * only needs it for the configuration each mode implies: the session secret is
+ * an embedded-only obligation, the Access vars are an access-only one, and
+ * perimeter mode has no configuration at all, only a warning.
+ */
+export type AdminAuthChoice = 'embedded' | 'access' | 'perimeter';
 /** Everything the generator needs. Everything else it decides. */
 export interface WranglerConfigAnswers {
     /** The Worker name, which is also its workers.dev subdomain. */
@@ -44,6 +99,14 @@ export interface WranglerConfigAnswers {
     emailMode?: EmailMode | undefined;
     /** The from-address, required when emailMode is `cloudflare`. */
     emailFrom?: string | undefined;
+    /** Defaults to `embedded`, which is what the scaffolder composes by default. */
+    adminAuth?: AdminAuthChoice | undefined;
+    /** The Access team domain, with `adminAuth: 'access'`. Placeholder when absent. */
+    accessTeamDomain?: string | undefined;
+    /** The Access application's AUD tag, with `adminAuth: 'access'`. */
+    accessAudience?: string | undefined;
+    /** The addresses that hold the owner role, with `adminAuth: 'access'`. */
+    accessOwnerEmails?: string | undefined;
     /** Defaults to node_modules/@we8/cms/migrations. */
     migrationsDir?: string | undefined;
     /** Defaults to the pinned COMPATIBILITY_DATE. */

package/dist/wrangler-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrangler-config.d.ts","sourceRoot":"","sources":["../src/wrangler-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,qCAAqC,CAAC;AAEzE,kEAAkE;AAClE,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAEzD,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhE;AA2BD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CA6H7E"}
+{"version":3,"file":"wrangler-config.d.ts","sourceRoot":"","sources":["../src/wrangler-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,yCAAyC,CAAC;AACrF,eAAO,MAAM,sBAAsB,qCAAqC,CAAC;AACzE,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAExE,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,qCAAqC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,sCAAsC,CAAC;AAEvE;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE;IACN,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,EACD,aAAa,EAAE,MAAM,GACpB,MAAM,CAkBR;AAED,kEAAkE;AAClE,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;AAElE,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gFAAgF;IAChF,SAAS,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACxC,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhE;AA2BD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAsL7E"}