dopus 0.0.0-stage → 0.2.0

package/dist/cli.js

@@ -0,0 +1,977 @@
+#!/usr/bin/env node
+import { n as PROVIDERS, t as VERSION } from "./version-DOEBWDfi.js";
+import { execFileSync, spawn } from "node:child_process";
+import { parseArgs } from "node:util";
+import * as p from "@clack/prompts";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { fileURLToPath } from "node:url";
+// src/init/detect.ts
+var InitError = class extends Error {
+	name = "InitError";
+};
+function readPackageJson(root) {
+	const file = join(root, "package.json");
+	if (!existsSync(file)) throw new InitError("No package.json here. Run `dopus init` in the root of your Next.js app.");
+	return JSON.parse(readFileSync(file, "utf8"));
+}
+const LOCKFILES = [
+	["pnpm-lock.yaml", "pnpm"],
+	["yarn.lock", "yarn"],
+	["bun.lock", "bun"],
+	["bun.lockb", "bun"],
+	["package-lock.json", "npm"]
+];
+function fromPackageManagerField(value) {
+	const name = typeof value === "string" ? value.split("@")[0] : void 0;
+	return name === "pnpm" || name === "npm" || name === "yarn" || name === "bun" ? name : void 0;
+}
+/**
+* `packageManager` field or lockfile, searching upward so apps inside a monorepo
+* use the workspace's package manager. Stops at the repository root (.git).
+*/
+function detectPackageManager(root, declared) {
+	const own = fromPackageManagerField(declared);
+	if (own) return own;
+	let dir = resolve(root);
+	while (true) {
+		for (const [file, manager] of LOCKFILES) if (existsSync(join(dir, file))) return manager;
+		if (dir !== resolve(root) && existsSync(join(dir, "package.json"))) try {
+			const field = fromPackageManagerField(JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).packageManager);
+			if (field) return field;
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir || existsSync(join(dir, ".git"))) return "npm";
+		dir = parent;
+	}
+}
+function detectProject(root) {
+	const pkg = readPackageJson(root);
+	const dependencies = {
+		...pkg.devDependencies,
+		...pkg.dependencies
+	};
+	const nextVersion = dependencies.next;
+	if (!nextVersion) throw new InitError("This does not look like a Next.js app (no `next` dependency in package.json).");
+	const appDir = existsSync(join(root, "src", "app")) ? "src/app" : existsSync(join(root, "app")) ? "app" : void 0;
+	if (!appDir) throw new InitError("No `app/` or `src/app/` directory found. dopus needs the App Router.");
+	if (!existsSync(join(root, "tsconfig.json"))) throw new InitError("No tsconfig.json found. dopus generates TypeScript files.");
+	return {
+		root,
+		appDir,
+		configDir: appDir === "src/app" ? "src" : ".",
+		packageManager: detectPackageManager(root, pkg.packageManager),
+		dependencies,
+		nextVersion
+	};
+}
+// src/init/env.ts
+/** Files Next.js loads in development, in the order it gives them precedence. */
+const ENV_FILES = [
+	".env.development.local",
+	".env.local",
+	".env.development",
+	".env"
+];
+const LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)?$/;
+function parseEnvKeys(content) {
+	const keys = /* @__PURE__ */ new Map();
+	for (const line of content.split(/\r?\n/)) {
+		const match = LINE.exec(line);
+		if (match?.[1]) keys.set(match[1], (match[2] ?? "").trim().replace(/^(['"])(.*)\1$/, "$2"));
+	}
+	return keys;
+}
+/** Which env files already define `key` with a non-empty value. Values are never returned. */
+function findDefinitions(root, key) {
+	return ENV_FILES.filter((file) => {
+		const path = join(root, file);
+		return existsSync(path) && Boolean(parseEnvKeys(readFileSync(path, "utf8")).get(key));
+	});
+}
+function quote(value) {
+	return /^[A-Za-z0-9_\-.:/+=]*$/.test(value) ? value : JSON.stringify(value);
+}
+/**
+* Sets `vars` in dotenv content. Existing non-empty values are kept unless `replace` lists the key;
+* empty placeholders (`KEY=`) are filled in place. New keys are appended under a `# dopus` header.
+*/
+function upsertEnv(content, vars, replace = []) {
+	const lines = content === "" ? [] : content.replace(/\n$/, "").split("\n");
+	const pending = new Map(Object.entries(vars));
+	const changed = [];
+	for (let i = 0; i < lines.length; i++) {
+		const match = LINE.exec(lines[i] ?? "");
+		const key = match?.[1];
+		if (!key || !pending.has(key)) continue;
+		if ((match?.[2] ?? "").trim() === "" || replace.includes(key)) {
+			lines[i] = `${key}=${quote(pending.get(key) ?? "")}`;
+			changed.push(key);
+		}
+		pending.delete(key);
+	}
+	if (pending.size > 0) {
+		if (lines.length > 0 && lines.at(-1) !== "") lines.push("");
+		lines.push("# dopus");
+		for (const [key, value] of pending) {
+			lines.push(`${key}=${quote(value)}`);
+			changed.push(key);
+		}
+	}
+	return {
+		content: `${lines.join("\n")}\n`,
+		changed
+	};
+}
+/** True if git (or, without git, .gitignore patterns) keeps `.env.local` out of the repo. */
+function isEnvLocalIgnored(root) {
+	return isGitIgnored(root, ".env.local", [
+		".env.local",
+		".env*.local",
+		".env*",
+		"*.local",
+		".env.*"
+	]);
+}
+/** True if git ignores `path`; outside a repo, falls back to exact lines in .gitignore. */
+function isGitIgnored(root, path, patterns = [
+	path,
+	`${path}/`,
+	`/${path}`
+]) {
+	try {
+		execFileSync("git", [
+			"check-ignore",
+			"-q",
+			path
+		], {
+			cwd: root,
+			stdio: "ignore"
+		});
+		return true;
+	} catch (error) {
+		if (error.status === 1) return false;
+	}
+	const gitignore = join(root, ".gitignore");
+	if (!existsSync(gitignore)) return false;
+	return readFileSync(gitignore, "utf8").split(/\r?\n/).map((l) => l.trim()).some((line) => patterns.includes(line));
+}
+// src/init/templates.ts
+const PRESETS = [
+	{
+		id: "general",
+		label: "General assistant"
+	},
+	{
+		id: "customer-support",
+		label: "Customer support"
+	},
+	{
+		id: "internal-ops",
+		label: "Internal operations / admin"
+	}
+];
+/** Finds the package's `templates/` directory from either `src/` (tests) or `dist/` (published). */
+function templatesDir() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 4; i++) {
+		const candidate = join(dir, "templates");
+		if (existsSync(join(candidate, "ui", "agent-chat.tsx"))) return candidate;
+		dir = dirname(dir);
+	}
+	throw new Error("dopus: templates directory not found (broken install?)");
+}
+function readTemplate(path) {
+	return readFileSync(join(templatesDir(), path), "utf8");
+}
+function agentConfigTemplate(provider, model) {
+	const info = PROVIDERS[provider];
+	return `import { ${info.importName} } from '${info.packageName}'
+import { defineAgent, defineTool } from 'dopus'
+import { z } from 'zod'
+import app, { locales } from './agent/prompts/app'
+import preset from './agent/prompts/preset'
+
+/**
+ * Register your existing server functions as tools. They run inside the agent request,
+ * so cookies() / headers() see the signed-in user and your own permission checks apply.
+ *
+ *   import { getOrders } from '@/app/actions/orders'
+ *
+ *   getOrders: defineTool((input) => getOrders(input.status), {
+ *     description: "Lists the signed-in user's orders.",
+ *     usage: 'When the user asks about their orders.',
+ *     input: z.object({ status: z.enum(['open', 'closed']).optional() }),
+ *   }),
+ *
+ * Add \`confirm: true\` to anything that changes data; the user approves each call in the chat.
+ */
+export default defineAgent({
+  model: ${info.importName}('${model}'),
+  tools: {
+    currentTime: defineTool(async () => new Date().toISOString(), {
+      description: 'Returns the current date and time (ISO 8601, server time).',
+      usage: 'When the answer depends on today’s date or the current time.',
+      input: z.object({}),
+    }),
+  },
+  // Prompt layers, stable → volatile: dopus core rules → preset → app context → per-request runtime.
+  prompt: { preset, app, locales },
+  // Per-request facts from the server (never from the browser), e.g. the user's role:
+  // runtime: async () => ({ role: (await getSession())?.role }),
+})
+`;
+}
+function routeTemplate(configImport) {
+	return `import { createAgentHandler } from 'dopus'
+import agent from '${configImport}'
+
+// Agent replies stream for a while; raise this if your platform cuts requests short.
+export const maxDuration = 60
+
+export const POST = createAgentHandler(agent)
+`;
+}
+// src/init/run.ts
+const APPROVAL_SECRET_ENV = "DOPUS_APPROVAL_SECRET";
+const ADD_COMMAND = {
+	pnpm: ["add"],
+	npm: ["install"],
+	yarn: ["add"],
+	bun: ["add"]
+};
+function installArgs(packageManager, packages, dev = false) {
+	return [
+		...ADD_COMMAND[packageManager],
+		...dev ? ["-D"] : [],
+		...packages
+	];
+}
+function toImportPath(fromFile, toFileWithoutExt) {
+	const path = relative(dirname(fromFile), toFileWithoutExt).split("\\").join("/");
+	return path.startsWith(".") ? path : `./${path}`;
+}
+async function runInit(options, io) {
+	const project = detectProject(options.cwd);
+	const { root } = project;
+	const ask = async (message, initial) => options.yes ? initial : io.confirm(message, initial);
+	if (options.provider && !(options.provider in PROVIDERS)) throw new InitError(`Unknown provider "${options.provider}". Use one of: ${Object.keys(PROVIDERS).join(", ")}`);
+	if (options.yes && !options.provider) throw new InitError("--yes needs --provider (openai, anthropic or google).");
+	if (options.preset && !PRESETS.some((p) => p.id === options.preset)) throw new InitError(`Unknown preset "${options.preset}". Use one of: ${PRESETS.map((p) => p.id).join(", ")}`);
+	const provider = options.provider ?? await io.selectProvider();
+	const info = PROVIDERS[provider];
+	const model = options.model ?? info.defaultModel;
+	const preset = options.preset ?? (options.yes ? "general" : await io.selectPreset());
+	const at = (path) => join(project.configDir, path);
+	const layoutFile = join(project.appDir, "layout.tsx");
+	const chatFile = at("components/agent/agent-chat.tsx");
+	const result = {
+		provider,
+		preset,
+		widgetImport: toImportPath(layoutFile, chatFile.replace(/\.tsx$/, "")),
+		layoutFile,
+		created: [],
+		skipped: [],
+		overwritten: [],
+		envChanged: [],
+		installed: [],
+		apiKeyMissing: false
+	};
+	const envVars = {};
+	const replace = [];
+	const keyDefinedIn = findDefinitions(root, info.envVar);
+	if (keyDefinedIn.length > 0) {
+		io.info(`${info.envVar} is already set in ${keyDefinedIn.join(", ")}.`);
+		if (keyDefinedIn.includes(".env.local")) {
+			if (await ask(`Replace ${info.envVar} in .env.local?`, false)) {
+				const key = await io.askApiKey(info);
+				if (key) {
+					envVars[info.envVar] = key;
+					replace.push(info.envVar);
+				}
+			}
+		}
+	} else {
+		const key = options.yes ? void 0 : await io.askApiKey(info);
+		if (key) envVars[info.envVar] = key;
+		else result.apiKeyMissing = true;
+	}
+	if (findDefinitions(root, "DOPUS_APPROVAL_SECRET").length === 0) envVars[APPROVAL_SECRET_ENV] = randomBytes(32).toString("base64url");
+	if (Object.keys(envVars).length > 0) {
+		const envPath = join(root, ".env.local");
+		const existed = existsSync(envPath);
+		const { content, changed } = upsertEnv(existed ? readFileSync(envPath, "utf8") : "", envVars, replace);
+		if (changed.length > 0) {
+			writeFileSync(envPath, content, existed ? void 0 : { mode: 384 });
+			result.envChanged = changed;
+			io.success(`.env.local: set ${changed.join(", ")}`);
+		}
+	}
+	if (!isEnvLocalIgnored(root)) {
+		const gitignore = join(root, ".gitignore");
+		const prefix = existsSync(gitignore) && !readFileSync(gitignore, "utf8").endsWith("\n") ? "\n" : "";
+		appendFileSync(gitignore, `${prefix}\n# local env files (dopus)\n.env*.local\n`);
+		io.warn(".env.local was not git-ignored. Added `.env*.local` to .gitignore.");
+	}
+	const routeFile = join(project.appDir, "api", "agent", "route.ts");
+	const files = [
+		[
+			at("agent.config.ts"),
+			() => agentConfigTemplate(provider, model),
+			[at("agent.config.js"), at("agent.config.mjs")]
+		],
+		[
+			at("agent/prompts/preset.ts"),
+			() => readTemplate(`prompts/presets/${preset}.ts`),
+			[]
+		],
+		[
+			at("agent/prompts/app.ts"),
+			() => readTemplate("prompts/app.ts"),
+			[]
+		],
+		[
+			routeFile,
+			() => routeTemplate(toImportPath(routeFile, at("agent.config"))),
+			[routeFile.replace(/\.ts$/, ".js")]
+		],
+		[
+			chatFile,
+			() => readTemplate("ui/agent-chat.tsx"),
+			[]
+		],
+		[
+			at("components/agent/agent-chat.module.css"),
+			() => readTemplate("ui/agent-chat.module.css"),
+			[]
+		]
+	];
+	for (const [file, content, alternatives] of files) {
+		const existing = [file, ...alternatives].find((f) => existsSync(join(root, f)));
+		if (existing) {
+			if (!(options.force && existing === file && await ask(`Overwrite ${file}? Your changes will be lost.`, true))) {
+				result.skipped.push(existing);
+				io.info(`${existing} exists — left unchanged.`);
+				continue;
+			}
+			result.overwritten.push(file);
+		} else result.created.push(file);
+		mkdirSync(dirname(join(root, file)), { recursive: true });
+		writeFileSync(join(root, file), content());
+		io.success(`${result.overwritten.includes(file) ? "Overwrote" : "Created"} ${file}`);
+	}
+	const missing = [
+		["dopus", "dopus"],
+		["ai", "ai@^7"],
+		["zod", "zod@^4"],
+		[info.packageName, `${info.packageName}@^4`],
+		["@ai-sdk/react", "@ai-sdk/react@^4"]
+	].filter(([name]) => !project.dependencies[name]).map(([, spec]) => spec);
+	if (missing.length > 0) {
+		if (options.install === false) io.warn(`Install these yourself: ${project.packageManager} ${installArgs(project.packageManager, missing).join(" ")}`);
+		else if (await ask(`Install ${missing.join(", ")} with ${project.packageManager}?`, true)) {
+			await io.install(project.packageManager, missing, root);
+			result.installed = missing;
+		}
+	}
+	return result;
+}
+// src/infra/aws.ts
+const OPEN_NEXT_CONFIG = `import type { OpenNextConfig } from '@opennextjs/aws/types/open-next.js'
+
+/**
+ * Generated by \`dopus infra aws\`.
+ *
+ * Lambda response streaming lets /api/agent stream replies instead of buffering them. OpenNext marks the
+ * server as streaming in its build output; SST (sst.aws.Nextjs) reads that and sets the Function URL
+ * invoke mode to RESPONSE_STREAM. With your own CDK/Terraform, set InvokeMode RESPONSE_STREAM yourself.
+ */
+const config = {
+  default: {
+    override: {
+      wrapper: 'aws-lambda-streaming',
+    },
+  },
+} satisfies OpenNextConfig
+
+export default config
+`;
+/** Which provider agent.config.ts uses, so the deploy snippet names the right env var. */
+function detectConfiguredProvider(source) {
+	if (!source) return void 0;
+	return Object.values(PROVIDERS).find((info) => source.includes(`'${info.packageName}'`));
+}
+function secretName(envVar) {
+	return envVar.toLowerCase().split("_").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+}
+function sstSnippet(provider) {
+	const keyEnv = provider?.envVar ?? "OPENAI_API_KEY";
+	const keySecret = secretName(keyEnv);
+	const approval = secretName(APPROVAL_SECRET_ENV);
+	return `// sst.config.ts → run()
+const ${keySecret[0]?.toLowerCase()}${keySecret.slice(1)} = new sst.Secret('${keySecret}')
+const ${approval[0]?.toLowerCase()}${approval.slice(1)} = new sst.Secret('${approval}')
+
+new sst.aws.Nextjs('Web', {
+  server: {
+    // Lambda timeout; SST also uses it as the CloudFront read
+    // timeout (max 60 s, or up to 180 s with a quota increase).
+    timeout: '60 seconds',
+  },
+  environment: {
+    ${keyEnv}: ${keySecret[0]?.toLowerCase()}${keySecret.slice(1)}.value,
+    ${APPROVAL_SECRET_ENV}: ${approval[0]?.toLowerCase()}${approval.slice(1)}.value,
+  },
+})
+
+// then, once per stage:
+//   npx sst secret set ${keySecret} <your key>
+//   npx sst secret set ${approval} "$(openssl rand -base64 32)"`;
+}
+async function runInfraAws(options, io) {
+	const project = detectProject(options.cwd);
+	const { root } = project;
+	const ask = async (message, initial) => options.yes ? initial : io.confirm(message, initial);
+	const configFile = [
+		"open-next.config.ts",
+		"open-next.config.js",
+		"open-next.config.mjs"
+	].find((f) => existsSync(join(root, f)));
+	const agentConfig = [join(project.configDir, "agent.config.ts"), "agent.config.ts"].map((f) => join(root, f)).find((f) => existsSync(f));
+	const provider = detectConfiguredProvider(agentConfig ? readFileSync(agentConfig, "utf8") : void 0);
+	const result = {
+		configFile: configFile ?? "open-next.config.ts",
+		created: false,
+		streaming: false,
+		provider,
+		installed: []
+	};
+	if (configFile) {
+		result.streaming = readFileSync(join(root, configFile), "utf8").includes("aws-lambda-streaming");
+		if (result.streaming) io.info(`${configFile} already enables Lambda streaming — left unchanged.`);
+		else io.warn(`${configFile} exists and does not enable streaming. Add \`override: { wrapper: 'aws-lambda-streaming' }\` to the function that serves /api/agent (or to \`default\`).`);
+	} else {
+		writeFileSync(join(root, "open-next.config.ts"), OPEN_NEXT_CONFIG);
+		result.created = true;
+		result.streaming = true;
+		io.success("Created open-next.config.ts (Lambda response streaming)");
+	}
+	if (!project.dependencies["@opennextjs/aws"]) {
+		const spec = "@opennextjs/aws@^4";
+		if (options.install === false) io.warn(`Install it yourself: ${project.packageManager} ${installArgs(project.packageManager, [spec], true).join(" ")}`);
+		else if (await ask(`Install ${spec} (dev dependency) with ${project.packageManager}?`, true)) {
+			await io.install(project.packageManager, [spec], root, true);
+			result.installed = [spec];
+		}
+	}
+	if (!provider) io.warn("Could not tell the provider from agent.config.ts; the snippet below assumes OpenAI.");
+	io.note(sstSnippet(provider), "Deploy with SST");
+	io.note([
+		"Build: npx @opennextjs/aws build (SST runs it for you).",
+		"Keep-alive: dopus sends an SSE comment every 15 s while a tool",
+		"  runs. CloudFront times out on gaps between packets, not on",
+		"  total time, so long tool calls keep the stream open.",
+		"Limit: a turn must finish within the Lambda timeout: 60 s",
+		"  behind CloudFront by default, up to 15 min on a bare",
+		"  Function URL.",
+		"Avoid API Gateway HTTP APIs for /api/agent (30 s cap)."
+	].join("\n"), "AWS notes");
+	return result;
+}
+// src/infra/cloudflare.ts
+const CLOUDFLARE_OPEN_NEXT_CONFIG = `import { defineCloudflareConfig } from '@opennextjs/cloudflare'
+
+// Generated by \`dopus infra cloudflare\`. Add an incremental cache (R2/KV) here if your pages use ISR.
+export default defineCloudflareConfig({})
+`;
+/** Worker names: lowercase letters, digits and dashes, at most 63 characters. */
+function workerName(packageName) {
+	return (packageName ?? "next-app").replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63) || "next-app";
+}
+/** A month back, so the installed workerd always supports it. */
+function compatibilityDate(now = /* @__PURE__ */ new Date()) {
+	return (/* @__PURE__ */ new Date(now.getTime() - 2592e6)).toISOString().slice(0, 10);
+}
+function wranglerConfig(name, date) {
+	return `{
+  // Generated by \`dopus infra cloudflare\` for @opennextjs/cloudflare.
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "${name}",
+  "main": ".open-next/worker.js",
+  "compatibility_date": "${date}",
+  "compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"],
+  "assets": { "directory": ".open-next/assets", "binding": "ASSETS" },
+  "services": [{ "binding": "WORKER_SELF_REFERENCE", "service": "${name}" }],
+  // Waiting on the LLM does not count as CPU time, but rendering and tool code do (paid plans: 30 s default).
+  // "limits": { "cpu_ms": 60000 },
+  "observability": { "enabled": true }
+}
+`;
+}
+const SCRIPTS = {
+	"cf:preview": "opennextjs-cloudflare build && opennextjs-cloudflare preview",
+	"cf:deploy": "opennextjs-cloudflare build && opennextjs-cloudflare deploy"
+};
+async function runInfraCloudflare(options, io) {
+	const project = detectProject(options.cwd);
+	const { root } = project;
+	const ask = async (message, initial) => options.yes ? initial : io.confirm(message, initial);
+	const result = {
+		created: [],
+		skipped: [],
+		scripts: [],
+		installed: []
+	};
+	const openNext = [
+		"open-next.config.ts",
+		"open-next.config.js",
+		"open-next.config.mjs"
+	].find((f) => existsSync(join(root, f)));
+	if (openNext && !readFileSync(join(root, openNext), "utf8").includes("@opennextjs/cloudflare")) throw new InitError(`${openNext} is set up for another target (AWS?). OpenNext uses one config per app: move it away and rerun.`);
+	const pkgPath = join(root, "package.json");
+	const pkgSource = readFileSync(pkgPath, "utf8");
+	const pkg = JSON.parse(pkgSource);
+	const name = workerName(pkg.name);
+	const agentConfig = [join(project.configDir, "agent.config.ts"), "agent.config.ts"].map((f) => join(root, f)).find((f) => existsSync(f));
+	const keyEnv = detectConfiguredProvider(agentConfig ? readFileSync(agentConfig, "utf8") : void 0)?.envVar ?? "OPENAI_API_KEY";
+	const files = [
+		[
+			"open-next.config.ts",
+			CLOUDFLARE_OPEN_NEXT_CONFIG,
+			["open-next.config.js", "open-next.config.mjs"]
+		],
+		[
+			"wrangler.jsonc",
+			wranglerConfig(name, compatibilityDate()),
+			["wrangler.json", "wrangler.toml"]
+		],
+		[
+			".dev.vars",
+			"NEXTJS_ENV=development\n",
+			[]
+		]
+	];
+	for (const [file, content, alternatives] of files) {
+		const existing = [file, ...alternatives].find((f) => existsSync(join(root, f)));
+		if (existing) {
+			result.skipped.push(existing);
+			io.info(`${existing} exists — left unchanged.`);
+			continue;
+		}
+		writeFileSync(join(root, file), content, file === ".dev.vars" ? { mode: 384 } : void 0);
+		result.created.push(file);
+		io.success(`Created ${file}`);
+	}
+	const envLocal = join(root, ".env.local");
+	const devVars = join(root, ".dev.vars");
+	const local = existsSync(envLocal) ? parseEnvKeys(readFileSync(envLocal, "utf8")) : /* @__PURE__ */ new Map();
+	const present = existsSync(devVars) ? parseEnvKeys(readFileSync(devVars, "utf8")) : /* @__PURE__ */ new Map();
+	const copy = [keyEnv, APPROVAL_SECRET_ENV].filter((key) => local.get(key) && !present.get(key));
+	if (copy.length > 0 && await ask(`Copy ${copy.join(" and ")} from .env.local into .dev.vars for the local preview?`, true)) {
+		const vars = Object.fromEntries(copy.map((key) => [key, local.get(key) ?? ""]));
+		writeFileSync(devVars, upsertEnv(readFileSync(devVars, "utf8"), vars).content, { mode: 384 });
+		io.success(`.dev.vars: set ${copy.join(", ")}`);
+	}
+	if (result.skipped.some((f) => f.startsWith("wrangler."))) io.warn("Check that your wrangler config has main \".open-next/worker.js\" and the \"nodejs_compat\" flag.");
+	const scripts = { ...pkg.scripts };
+	for (const [key, command] of Object.entries(SCRIPTS)) if (!scripts[key]) {
+		scripts[key] = command;
+		result.scripts.push(key);
+	}
+	if (result.scripts.length > 0) {
+		const indent = /^(\s+)"/m.exec(pkgSource)?.[1] ?? "  ";
+		writeFileSync(pkgPath, `${JSON.stringify({
+			...pkg,
+			scripts
+		}, null, indent)}\n`);
+		io.success(`package.json: added ${result.scripts.join(", ")}`);
+	}
+	const ignore = [
+		".open-next",
+		".dev.vars",
+		".wrangler"
+	].filter((path) => !isGitIgnored(root, path));
+	if (ignore.length > 0) {
+		const gitignore = join(root, ".gitignore");
+		const prefix = existsSync(gitignore) && !readFileSync(gitignore, "utf8").endsWith("\n") ? "\n" : "";
+		appendFileSync(gitignore, `${prefix}\n# Cloudflare (dopus)\n${ignore.map((p) => `${p}\n`).join("")}`);
+		io.success(`.gitignore: added ${ignore.join(", ")}`);
+	}
+	const deps = [[
+		"@opennextjs/cloudflare",
+		"@opennextjs/cloudflare@^1",
+		false
+	], [
+		"wrangler",
+		"wrangler@^4",
+		true
+	]];
+	for (const dev of [false, true]) {
+		const missing = deps.filter(([n, , d]) => d === dev && !project.dependencies[n]).map(([, spec]) => spec);
+		if (missing.length === 0) continue;
+		if (options.install === false) io.warn(`Install yourself: ${project.packageManager} ${installArgs(project.packageManager, missing, dev).join(" ")}`);
+		else if (await ask(`Install ${missing.join(", ")}${dev ? " (dev)" : ""} with ${project.packageManager}?`, true)) {
+			await io.install(project.packageManager, missing, root, dev);
+			result.installed.push(...missing);
+		}
+	}
+	const run = project.packageManager === "npm" ? "npm run" : project.packageManager;
+	io.note([
+		`Local Workers runtime:  ${run} cf:preview`,
+		"  Wrangler reads .dev.vars (not .env.local): keep your key there too.",
+		"",
+		"Production secrets, once per Worker:",
+		`  npx wrangler secret put ${keyEnv}`,
+		`  npx wrangler secret put ${APPROVAL_SECRET_ENV}`,
+		`Deploy:  ${run} cf:deploy`
+	].join("\n"), "Deploy to Cloudflare Workers");
+	io.note([
+		"Duration: no wall-clock limit while the client is connected, and",
+		"  waiting on the LLM is not CPU time. CPU limit: 30 s by default on",
+		"  paid plans (limits.cpu_ms, max 5 min); the free plan allows 10 ms,",
+		"  which a Next.js app usually exceeds.",
+		"Keep-alive SSE comments (15 s) keep long tool calls open.",
+		"Remove `export const runtime = \"edge\"`: OpenNext runs the Node runtime."
+	].join("\n"), "Cloudflare notes");
+	return result;
+}
+// src/infra/gcp.ts
+const LOCKFILE = {
+	pnpm: "pnpm-lock.yaml",
+	npm: "package-lock.json",
+	yarn: "yarn.lock"
+};
+/**
+* The install line. pnpm/yarn come from corepack; without a `packageManager` field corepack would fetch the
+* newest release, whose policies (e.g. pnpm's minimumReleaseAge) can reject a lockfile your version accepted,
+* so pin the version the project uses.
+*/
+function installCommand(packageManager, pinned) {
+	if (packageManager === "npm") return "npm ci";
+	return `${pinned ? `corepack enable ${packageManager} && corepack prepare ${packageManager}@${pinned} --activate` : `corepack enable ${packageManager}`} && ${packageManager} install --frozen-lockfile`;
+}
+/** Version to pin when package.json has no `packageManager` field: the one installed here. */
+function localVersion(packageManager, cwd) {
+	try {
+		const version = execFileSync(packageManager, ["--version"], {
+			cwd,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		return /^\d+\.\d+\.\d+/.test(version) ? version : void 0;
+	} catch {
+		return;
+	}
+}
+/** `pin`: version to activate with corepack; leave undefined when package.json declares `packageManager`. */
+function dockerfile(packageManager, pin) {
+	if (packageManager === "bun") throw new InitError("Bun projects: write your own Dockerfile (dopus generates npm, pnpm and yarn ones).");
+	return `# Generated by \`dopus infra gcp\`: Next.js standalone server for Cloud Run.
+# Secrets are not baked in: .dockerignore excludes .env files; Cloud Run injects them at runtime.
+FROM node:24-slim AS base
+ENV NEXT_TELEMETRY_DISABLED=1
+
+FROM base AS deps
+WORKDIR /app
+COPY package.json ${LOCKFILE[packageManager]} ./
+RUN ${installCommand(packageManager, pin)}
+
+FROM base AS build
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN node_modules/.bin/next build && mkdir -p public
+
+FROM base AS run
+WORKDIR /app
+ENV NODE_ENV=production PORT=8080 HOSTNAME=0.0.0.0
+RUN groupadd --system --gid 1001 nodejs && useradd --system --uid 1001 --gid nodejs nextjs
+COPY --from=build --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=build --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=build --chown=nextjs:nodejs /app/public ./public
+USER nextjs
+EXPOSE 8080
+CMD ["node", "server.js"]
+`;
+}
+const DOCKERIGNORE = `# Generated by \`dopus infra gcp\`. Keep secrets and build output out of the image.
+node_modules
+.next
+.open-next
+.wrangler
+.git
+.env
+.env.*
+.dev.vars*
+npm-debug.log*
+Dockerfile
+.dockerignore
+`;
+const STANDALONE = /output\s*:\s*['"]standalone['"]/;
+/**
+* Adds `output: 'standalone'` to the usual `const nextConfig = {…}` / `export default {…}` shapes.
+* Returns undefined when the file does not match a shape it can edit safely.
+*/
+function addStandalone(source) {
+	if (STANDALONE.test(source)) return source;
+	if (/\boutput\s*:/.test(source)) return void 0;
+	for (const pattern of [
+		/(const\s+nextConfig(?:\s*:\s*NextConfig)?\s*=\s*)\{\s*\}/,
+		/(const\s+nextConfig(?:\s*:\s*NextConfig)?\s*=\s*)\{/,
+		/(export\s+default\s*)\{\s*\}/,
+		/(module\.exports\s*=\s*)\{\s*\}/
+	]) {
+		if (!pattern.test(source)) continue;
+		return source.replace(pattern, (match, head) => match.trimEnd().endsWith("}") ? `${head}{\n  output: 'standalone',\n}` : `${head}{\n  output: 'standalone',`);
+	}
+}
+function secretId(envVar) {
+	return envVar.toLowerCase().replaceAll("_", "-");
+}
+async function runInfraGcp(options, io) {
+	const project = detectProject(options.cwd);
+	const { root } = project;
+	const ask = async (message, initial) => options.yes ? initial : io.confirm(message, initial);
+	const result = {
+		created: [],
+		skipped: [],
+		standalone: false
+	};
+	const nextConfig = [
+		"next.config.ts",
+		"next.config.mjs",
+		"next.config.js"
+	].find((f) => existsSync(join(root, f)));
+	if (!nextConfig) {
+		writeFileSync(join(root, "next.config.mjs"), "/** @type {import('next').NextConfig} */\nexport default { output: 'standalone' }\n");
+		result.created.push("next.config.mjs");
+		result.standalone = true;
+		io.success("Created next.config.mjs with output: 'standalone'");
+	} else {
+		const source = readFileSync(join(root, nextConfig), "utf8");
+		const patched = addStandalone(source);
+		if (patched === source) result.standalone = true;
+		else if (patched && await ask(`Set output: 'standalone' in ${nextConfig}? (needed for the container)`, true)) {
+			writeFileSync(join(root, nextConfig), patched);
+			result.standalone = true;
+			io.success(`${nextConfig}: set output: 'standalone'`);
+		} else io.warn(`Set \`output: 'standalone'\` in ${nextConfig} yourself; the Dockerfile copies .next/standalone.`);
+	}
+	const files = [["Dockerfile", () => {
+		const declared = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).packageManager;
+		return dockerfile(project.packageManager, declared ? void 0 : localVersion(project.packageManager, root));
+	}], [".dockerignore", () => DOCKERIGNORE]];
+	for (const [file, content] of files) {
+		if (existsSync(join(root, file))) {
+			result.skipped.push(file);
+			io.info(`${file} exists — left unchanged.`);
+			continue;
+		}
+		writeFileSync(join(root, file), content());
+		result.created.push(file);
+		io.success(`Created ${file}`);
+	}
+	if (result.skipped.includes(".dockerignore")) {
+		const ignore = readFileSync(join(root, ".dockerignore"), "utf8");
+		if (!/^\.env/m.test(ignore)) io.warn(".dockerignore does not exclude .env files: your secrets would end up in the image.");
+	}
+	const agentConfig = [join(project.configDir, "agent.config.ts"), "agent.config.ts"].map((f) => join(root, f)).find((f) => existsSync(f));
+	const keyEnv = detectConfiguredProvider(agentConfig ? readFileSync(agentConfig, "utf8") : void 0)?.envVar ?? "OPENAI_API_KEY";
+	const service = workerName(JSON.parse(readFileSync(join(root, "package.json"), "utf8")).name);
+	io.note([
+		"Secrets (Secret Manager), once per project:",
+		`  printf %s "$KEY" | gcloud secrets create ${secretId(keyEnv)} --data-file=-`,
+		`  openssl rand -base64 32 | tr -d '\\n' | gcloud secrets create ${secretId(APPROVAL_SECRET_ENV)} --data-file=-`,
+		"  (the Cloud Run service account needs roles/secretmanager.secretAccessor)",
+		"",
+		"Deploy (Cloud Build uses the Dockerfile):",
+		`  gcloud run deploy ${service} --source . --region <region> --timeout 3600 \\`,
+		`    --set-secrets ${keyEnv}=${secretId(keyEnv)}:latest,${APPROVAL_SECRET_ENV}=${secretId(APPROVAL_SECRET_ENV)}:latest`,
+		"",
+		"Local check:",
+		`  docker build -t ${service} . && docker run --rm -p 8080:8080 --env-file .env.local ${service}`
+	].join("\n"), "Deploy to Cloud Run");
+	io.note([
+		"Timeout: a request (the whole streamed reply) may last up to 60 min",
+		"  (--timeout 3600; default 5 min). For longer work use Cloud Run Jobs",
+		"  and pass the user explicitly (identify → ctx.user): no cookies there.",
+		"Instances are billed while a stream is open; keep-alive comments (15 s)",
+		"  keep load balancers and proxies from dropping long tool calls."
+	].join("\n"), "Cloud Run notes");
+	return result;
+}
+// src/cli.ts
+const HELP = `dopus ${VERSION}
+
+Usage:
+  dopus init [options]        Add an AI agent to this Next.js app
+  dopus infra aws [options]   Prepare the agent route for AWS Lambda (OpenNext streaming + SST snippet)
+  dopus infra cloudflare      Prepare the app for Cloudflare Workers (@opennextjs/cloudflare)
+  dopus infra gcp             Prepare the app for Cloud Run (standalone build + Dockerfile)
+
+Options for init:
+  --provider <id>        openai | anthropic | google
+  --model <id>           Model id (default depends on the provider)
+  --preset <id>          general | customer-support | internal-ops (default with --yes: general)
+  -y, --yes              Non-interactive; skips the API key prompt (needs --provider)
+  --no-install           Do not install dependencies
+  --force                Overwrite generated files that already exist
+  --cwd <dir>            Project root (default: current directory)
+
+Options for infra:
+  -y, --yes              Do not ask before installing @opennextjs/aws
+  --no-install           Print the install command instead
+  --cwd <dir>            Project root
+
+  -h, --help             Show this help
+  -v, --version          Show the version
+`;
+function cancelled(value) {
+	if (p.isCancel(value)) {
+		p.cancel("Cancelled. Files written before this step are kept.");
+		process.exit(130);
+	}
+	return value;
+}
+const io = {
+	async selectProvider() {
+		return cancelled(await p.select({
+			message: "Which LLM provider?",
+			options: Object.values(PROVIDERS).map((info) => ({
+				value: info.id,
+				label: info.label
+			}))
+		}));
+	},
+	async selectPreset() {
+		return cancelled(await p.select({
+			message: "Which prompt preset? (copied into your project; edit freely)",
+			options: PRESETS.map((preset) => ({
+				value: preset.id,
+				label: preset.label
+			}))
+		}));
+	},
+	async askApiKey(info) {
+		return cancelled(await p.password({
+			message: `${info.envVar} (saved to .env.local; leave empty to add it later)`,
+			mask: "•"
+		}))?.trim() || void 0;
+	},
+	async confirm(message, initial) {
+		return cancelled(await p.confirm({
+			message,
+			initialValue: initial
+		}));
+	},
+	info: (message) => p.log.info(message),
+	warn: (message) => p.log.warn(message),
+	success: (message) => p.log.success(message),
+	install(packageManager, packages, cwd, dev) {
+		return new Promise((resolve, reject) => {
+			const child = spawn(packageManager, installArgs(packageManager, packages, dev), {
+				cwd,
+				stdio: "inherit",
+				shell: process.platform === "win32"
+			});
+			child.on("error", reject);
+			child.on("exit", (code) => code === 0 ? resolve() : reject(new InitError(`${packageManager} exited with code ${code}`)));
+		});
+	}
+};
+async function init(args) {
+	const { values } = parseArgs({
+		args,
+		options: {
+			provider: { type: "string" },
+			model: { type: "string" },
+			preset: { type: "string" },
+			yes: {
+				type: "boolean",
+				short: "y"
+			},
+			install: {
+				type: "boolean",
+				default: true
+			},
+			"no-install": { type: "boolean" },
+			force: { type: "boolean" },
+			cwd: { type: "string" }
+		},
+		allowNegative: true
+	});
+	p.intro(`dopus ${VERSION}`);
+	const result = await runInit({
+		cwd: values.cwd ?? process.cwd(),
+		provider: values.provider,
+		model: values.model,
+		preset: values.preset,
+		yes: values.yes,
+		install: values["no-install"] ? false : values.install,
+		force: values.force
+	}, io);
+	const info = PROVIDERS[result.provider];
+	const steps = [
+		result.apiKeyMissing ? `Add ${info.envVar}=... to .env.local` : void 0,
+		"Register your server functions as tools in agent.config.ts",
+		"Describe your service in agent/prompts/app.ts",
+		`Show the chat: in ${result.layoutFile} add\n   import { AgentWidget } from '${result.widgetImport}'\n   and render <AgentWidget /> inside <body>`
+	].filter(Boolean);
+	p.note(steps.map((s, i) => `${i + 1}. ${s}`).join("\n"), "Next steps");
+	p.outro("Done.");
+}
+async function infra(args) {
+	const [target, ...rest] = args;
+	const runners = {
+		aws: runInfraAws,
+		cloudflare: runInfraCloudflare,
+		gcp: runInfraGcp
+	};
+	if (!target || !(target in runners)) throw new InitError("Usage: dopus infra aws | cloudflare | gcp");
+	const { values } = parseArgs({
+		args: rest,
+		options: {
+			yes: {
+				type: "boolean",
+				short: "y"
+			},
+			install: {
+				type: "boolean",
+				default: true
+			},
+			"no-install": { type: "boolean" },
+			cwd: { type: "string" }
+		},
+		allowNegative: true
+	});
+	p.intro(`dopus ${VERSION} · infra ${target}`);
+	const run = runners[target];
+	await run({
+		cwd: values.cwd ?? process.cwd(),
+		yes: values.yes,
+		install: values["no-install"] ? false : values.install
+	}, {
+		...io,
+		note: (message, title) => p.note(message, title)
+	});
+	p.outro("Done. Nothing was deployed.");
+}
+async function main() {
+	const [command, ...rest] = process.argv.slice(2);
+	if (command === "--version" || command === "-v") return console.log(VERSION);
+	if (command === "init") return init(rest);
+	if (command === "infra") return infra(rest);
+	console.log(HELP);
+	if (command && command !== "--help" && command !== "-h") process.exitCode = 1;
+}
+main().catch((error) => {
+	if (error instanceof InitError || error.code?.startsWith("ERR_PARSE_ARGS")) p.log.error(error.message);
+	else console.error(error);
+	process.exit(1);
+});
+export {};