everyapp 0.2.2 → 0.3.0-rc.2

package/skills/everyapp/setup/workers-ai.md

@@ -0,0 +1,138 @@
+# Workers AI for the Gateway
+
+Workers AI runs Meta's Llama and other open models inside the Gateway's own
+Cloudflare account, behind the Gateway's AI proxy. agentic-inbox lists it as
+`optional: true` beside a required `openrouter`, so `secret list` shows the
+token in `settings` with `set: false`, never in `unmet`: the inbox opens
+without it. Its Worker calls Workers AI (the Email Agent, the draft verifier
+and the prompt-injection scanner, on `/api/ai/workers-ai/v1/chat/completions`)
+only when built with `AI_PROVIDER=workers-ai`, which is still the build
+default until the inbox's PR #6 flips it to OpenRouter; a Worker built with
+it and no token says so in the chat. Only the token is missing: the account is
+`CLOUDFLARE_ACCOUNT_ID`, which `everyapp setup` set. At the end the person
+has one Cloudflare API token limited to Workers AI on that account, held by
+the Gateway, and a Workers AI model answering through it.
+
+## Settings
+
+| Name                    | Required                                                                                                                                               | What it holds                                                                                                                                                                                                                                                    |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `WORKERS_AI_API_TOKEN`  | optional for agentic-inbox (`{ id: "workers-ai", optional: true }`); needed only by a Worker built with `AI_PROVIDER=workers-ai`                        | A Cloudflare API token with Workers AI Read on the Gateway's account (and Edit when made by hand: Cloudflare's REST guide asks for both on a custom token): the token string alone, one line, no `Bearer`. New user tokens start `cfut_`, account tokens `cfat_`. |
+| `CLOUDFLARE_ACCOUNT_ID` | set once by `everyapp setup`; `secret set` refuses it (`SECRET_NOT_SETTABLE` from the every-app checkout, `SECRET_NOT_DECLARED` from an app directory) | The account inference runs and bills in: `data.accountId` in `pnpm everyapp status --json`, written `<account id>` below. The token must include this account.                                                                                                   |
+
+`OPENROUTER_API_KEY` stays: the inbox's manifest requires it, and OpenSEO and Open CRM use it. This file adds a provider; it removes none.
+
+## Costs and plans
+
+As of October 2026 (Cloudflare's pricing page, updated 2026-10-20):
+
+- The Gateway's account is on Workers Paid already ($5 a month; everyapp needs it). Workers AI adds no fixed fee, and an API token is free.
+- 10,000 neurons a day are included. Beyond that, Workers Paid bills $0.011 per 1,000 neurons on the monthly invoice; Workers Free stops for the day instead (error 3036).
+- The Workers AI path's default agent model (and its draft verifier), `@cf/meta/llama-4-scout-17b-16e-instruct`: $0.27 per million input tokens, $0.85 per million output; 300 requests a minute.
+- `@cf/moonshotai/kimi-k2.6` (the inbox's optional `AGENT_MODEL`): paid-only; $0.95 in and $4.00 out per million tokens; 20 requests a minute per account and model on Workers Paid (Cloudflare's 50-a-minute tier is for calls through an AI Gateway on prepaid credits, which the Gateway doesn't use), shared by every organization on the Gateway.
+
+## Only a person can
+
+- Sign in to the Cloudflare dashboard and create the token. `cf`'s OAuth login cannot mint one: `cf auth whoami` lists no API-token scope, and the token endpoints answer it 403 code 9109. So neither `cf accounts tokens create` nor the API works from the login; it needs a token to make a token.
+- Copy the token off the screen (shown once) and type or export it in their own terminal.
+- Choose a user token (tied to their login) or an account token (a team's choice; needs API Token Provisioning or Super Administrator on the account), and whether it expires.
+
+## Before you start
+
+1. `pnpm everyapp secret list agentic-inbox --json`, from any directory: the `WORKERS_AI_API_TOKEN` entry in `data.app.setup.settings` (`names` `["WORKERS_AI_API_TOKEN"]`, `need.kind` `optional`, `holder` `gateway`, `setup` `setup/workers-ai.md`) with `"set": false` means this file applies. It is never in `unmet` (`command`, `pnpm everyapp configure agentic-inbox`, offers it after the inbox's required settings) and the inbox opens without it; what keeps the inbox closed is `OPENROUTER_API_KEY` ([openrouter.md](openrouter.md)) and its email sender ([email.md](email.md)); `data.app.setup.groups` is `[]`. `"set": true`: ask before replacing (a value can't be read back; replacing means a new token). In the older fields `data.gateway.needed` has it with `"required": false`, never in `data.gateway.missing`. `status` prints no `Guide:` line for it (only unmet settings get one): `secret list --json`, carrying the path as the entry's `setup`, is how an agent lands here (in the checkout: `packages/cli/skills/everyapp/setup/workers-ai.md`). `APP_NOT_FOUND` ("agentic-inbox isn't deployed to this Gateway yet"): deploy the app first, from its directory (the token can be set before that all the same, from anywhere).
+2. `pnpm everyapp status --json`: `data.installed` and `data.claimed` true; `data.accountId` is the account the token must include (tell the person; it is not a secret); `data.apps[]` has `"id": "agentic-inbox"` with `"status": "active"`, `"bound": true` and the same `setup`; while a required setting is missing `data.fixes` has `APP_NEEDS_SETUP` for it (severity `warning`, headline "agentic-inbox needs setup", `run` the same command). `action_required cloudflare_login` with `waiting: true` (`status` logs in by itself): show `data.url` and `data.code` to the person and keep reading; `pnpm everyapp login --json` is only for logging in ahead of time.
+3. In 1's output (or `pnpm everyapp secret list --json` from any directory), `data.gateway.names` has `CLOUDFLARE_ACCOUNT_ID`. Missing: stop and tell the person. It is written once, at install, from the account the Gateway lives in (`data.accountId` is what it should be); `secret set` refuses it and `setup` adds nothing to a Gateway that already has a version, so there is no everyapp repair today. The settings model leaves it out (an install-owned setting), so the setup gate doesn't notice it missing: the proxy's 503 (If it fails) is where it shows.
+4. Ask, together with 5 in one message, and wait for both answers before Steps (they change the steps): was the inbox's Worker deployed with `AI_PROVIDER=workers-ai` (a variable of its own deploy; `status` doesn't show it)? It decides whether the inbox needs this token at all: the manifest marks it optional, so the inbox opens either way. The build default is still `workers-ai` (the inbox's PR #6 flips it to OpenRouter; open): a Worker deployed without the variable uses this token; one deployed with `AI_PROVIDER=openrouter` never does, until its own Worker is deployed again without it, from its repository (its `cloudflare.config.ts` reads it), not from here: say so, and never redeploy the inbox from this file.
+5. Ask whether the person already holds a Cloudflare API token with Workers AI on this account (a token from another project is fine if it includes this account). Yes: skip to step 3.
+
+## Steps
+
+One step per message, and wait between them: step 1 once the two answers from Before you start are in; step 2, then "copied"; step 3, then "done". The curl line comes in Verify, after that.
+
+1. **You:** Say which token to make. A user token (My Profile) is the quick path for a solo operator; an account token keeps working after that person leaves and is the better fit for a team. Both reach Workers AI the same way: the Gateway sends either as a Bearer token to `api.cloudflare.com/client/v4/accounts/<account id>/ai/v1/…`, and Cloudflare's compatibility matrix lists Workers AI as supporting account tokens (not tried live here). Give them `data.accountId` to check against the token's account resources.
+
+2. **Person:** Create the token. Done when the screen shows the token once, with a copy button and a `curl … /user/tokens/verify` test under it. Wait for "copied".
+   - Prefilled user token: open https://dash.cloudflare.com/?to=/:account/ai/workers-ai (the Workers AI page; pick the Gateway's account if asked), select **Use REST API**, then **Create a Workers AI API Token**. A token form opens prefilled (Cloudflare's guide says it grants Workers AI Read on this account, which is what the `/ai/*` endpoints need; one permission row is expected): check that **Account Resources** names the Gateway's account (`data.accountId`), leave **TTL (time to live)** empty unless they want an expiry (the Gateway stops the day it expires), select **Create API Token**, then **Copy API Token**.
+   - Custom user token: https://dash.cloudflare.com/profile/api-tokens, **Create Token**, the custom token at the bottom (label unverified), name it `every-app-gateway workers-ai`, permissions **Account** | **Workers AI** | **Read** and a second row **Account** | **Workers AI** | **Edit** (Cloudflare's REST guide asks for both on a token made by hand), account resources: Include, the Gateway's account (`data.accountId`), no client IP filter (the Gateway's egress addresses vary), **Continue to summary**, **Create Token**.
+   - Account token: in the dashboard pick the Gateway's account, **Manage account** > **Account API tokens**, **Create Token**, the same name and permissions, optional expiration, **Continue to summary**, **Create Token**.
+
+3. **Person:** Hand it to the Gateway (README's third way, the hidden read, in their own terminal, in the `every-app` folder; bash or zsh):
+   ```sh
+   read -rs WORKERS_AI_API_TOKEN; export WORKERS_AI_API_TOKEN
+   pnpm everyapp secret set WORKERS_AI_API_TOKEN --from-env WORKERS_AI_API_TOKEN --json
+   ```
+   After the first line the terminal shows nothing, not even a prompt: paste the token, press Enter, then run the second line. `SECRET_EMPTY` means the paste didn't land: redo the first line in the same terminal. fish: `read -s -x WORKERS_AI_API_TOKEN` (it does show `read> `), then the same `pnpm everyapp secret set … --from-env …` line; `set -e WORKERS_AI_API_TOKEN` clears it afterwards.
+   The last line is `"type": "done"`; the change is live at once (one new Gateway version, no deploy). `pnpm everyapp configure agentic-inbox --from-env --json` sets it from the same variable (and every other unset setting of the inbox whose variable is exported; its `done` event's `data.set` names them). Keep the variable until the smoke check below is done, then `unset WORKERS_AI_API_TOKEN`. Without the smoke check, README's first way is simpler: in a second terminal, `pnpm everyapp configure agentic-inbox` (it asks for the token after the inbox's required settings, as an optional one: Yes to `Set the N optional settings too?` (`Set the optional setting too?` for one), Enter skips the others; once the inbox is ready its menu lists `WORKERS_AI_API_TOKEN`) or `pnpm everyapp secret set WORKERS_AI_API_TOKEN` for just this one; paste at the hidden prompt. Wait for "done".
+
+4. **You:** Run the Verify section. The person runs its curl line in the terminal that still has the variable.
+
+## Verify
+
+1. `pnpm everyapp secret list agentic-inbox --json`, from anywhere: the `WORKERS_AI_API_TOKEN` entry in `data.app.setup.settings` has `"set": true` (it was never in `data.app.setup.unmet`: optional); `data.app.setup.ready` doesn't depend on it (`OPENROUTER_API_KEY`, required by the same manifest, and its email sender do: until then `command` and `data.next` name what is left). In the older fields, its `data.gateway.needed` entry has `"set": true`, `data.gateway.missing` never listed it, and `data.gateway.names` does (for an inbox not deployed yet, the root `pnpm everyapp secret list --json` shows `data.gateway.names` and that is the check). Then `pnpm everyapp status --json`: the `agentic-inbox` entry's `setup.ready` is true and `data.fixes` has no `APP_NEEDS_SETUP` for it, once everything required is set.
+2. Smoke check, in the person's terminal with `WORKERS_AI_API_TOKEN` exported. The header goes in on stdin (`-H @-`) so the token never sits in curl's argument list, which the process list shows. The token reaches Workers AI on the Gateway's account (a few neurons):
+   ```sh
+   printf 'Authorization: Bearer %s\n' "$WORKERS_AI_API_TOKEN" | curl -s -H @- -H "Content-Type: application/json" https://api.cloudflare.com/client/v4/accounts/<account id>/ai/v1/chat/completions -d '{"model":"@cf/meta/llama-4-scout-17b-16e-instruct","messages":[{"role":"user","content":"Say ok."}],"max_tokens":5}'
+   ```
+   expects a JSON body with `choices[0].message.content`. Any `"success":false` body is read in If it fails; a 401 starts with the verify curl there. Then `unset WORKERS_AI_API_TOKEN`.
+3. The app, only when the inbox's Worker was built with `AI_PROVIDER=workers-ai` (the build default until the inbox's PR #6; Before you start, 4); one built with `AI_PROVIDER=openrouter` never sends this token and the curl line above is the whole proof. Either way the inbox opens only once every required setting is set (Verify 1): a browser sent to `https://<gateway host>/?setup=agentic-inbox` means something still isn't. Open `https://agentic-inbox.<app base domain>/`, open a mailbox, **Show agent panel** (the header button), type in "Ask your email agent..." and send. A reply streams in, and the Gateway's `ai.proxy.usage` line (step 4) says `"provider":"workers-ai"`. A missing token shows up in the panel as "AI isn't set up on this gateway yet, so I can't help with this inbox. An admin sets WORKERS_AI_API_TOKEN with `pnpm everyapp secret set WORKERS_AI_API_TOKEN`."; any other refusal as the Gateway's message.
+4. The Gateway's logs, when a refusal isn't clear: `cf` has no terminal tail (`cf workers` lists none; `cf o11y telemetry live-tail` only prepares a websocket, not tried here; `cf o11y telemetry query` is the raw query API). Cloudflare's CLI for it is `npx wrangler tail every-app-gateway --format json` (after its own `wrangler login`; wrangler isn't in this checkout). Dashboard, README's path: https://dash.cloudflare.com/?to=/:account/workers-and-pages, then **Workers & Pages** → `every-app-gateway` → **Observability** (**Logs** on older accounts) → **Live**. The proxy writes one JSON line per call: `"evt":"ai.proxy.usage"` with `provider`, `model`, `status` and `usage`; `"evt":"ai.proxy.upstream_failed"` with the message when the request to Cloudflare failed. The Gateway's config turns these logs on; Workers Paid keeps 7 days.
+
+## If it fails
+
+A 401 from the chat call: first, in the same terminal, Cloudflare's verify route says whether the string itself is good. A user token (`cfut_`):
+
+```sh
+printf 'Authorization: Bearer %s\n' "$WORKERS_AI_API_TOKEN" | curl -s -H @- https://api.cloudflare.com/client/v4/user/tokens/verify
+```
+
+An account token (`cfat_`): the same header on `https://api.cloudflare.com/client/v4/accounts/<account id>/tokens/verify`; on the user route it answers 401 code 1000 "Invalid API Token", like any token that route doesn't know. `"success":true` with `"status":"active"`: the string is good, and the rows for code 10000 and 9109 say what is (the permission or the account). 401 code 1000 on its own route: the string (its row).
+
+| Error or symptom                                                                                                        | Meaning                                                                                                                                                                                 | What to do                                                                                                                                      |
+| ----------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| a browser opening the inbox is sent to `https://<gateway host>/?setup=agentic-inbox`; any other request gets 503 with the body `{"error":"app_needs_setup","app":"agentic-inbox"}` | the Gateway's setup gate: a required setting of the inbox is still unset (`OPENROUTER_API_KEY` or its email sender; this token is optional and never closes the inbox)   | `data.app.setup.command`, `pnpm everyapp configure agentic-inbox`, then Verify 1                                                                |
+| 503 `ai_provider_not_configured`, "needs WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID"                                | the Gateway holds no token (the inbox opens anyway: its manifest marks the provider optional; a Worker built with `AI_PROVIDER=workers-ai` shows it in the chat as "AI isn't set up on this gateway yet, so I can't help with this inbox. An admin sets WORKERS_AI_API_TOKEN with `pnpm everyapp secret set WORKERS_AI_API_TOKEN`."), or no account id (which the gate doesn't check) | `secret list --json`; set the token; `CLOUDFLARE_ACCOUNT_ID` missing: no everyapp repair today, tell the person (Before you start, 3)           |
+| `provider_not_allowed`                                                                                                  | the app's manifest doesn't list `workers-ai` under `providers`                                                                                                                          | agentic-inbox lists it; another app adds it to `everyapp.config.ts` and deploys                                                                 |
+| `model_not_allowed`                                                                                                     | a model id outside the app's `ai.models`                                                                                                                                                | use one from the manifest, or add it and deploy                                                                                                 |
+| `ai_route_not_allowed`                                                                                                  | a path other than `/v1/chat/completions`, `/v1/embeddings`, `/v1/responses` (the native run route is closed)                                                                            | call the OpenAI-compatible routes                                                                                                               |
+| 502 `ai_upstream_failed`                                                                                                | the request to `api.cloudflare.com` failed before an answer                                                                                                                             | retry; the Gateway log line `ai.proxy.upstream_failed` has the message                                                                          |
+| 401, code 1000 "Invalid API Token" (the verify routes)                                                                  | the string is wrong, expired, rolled or deleted; or a `cfat_` token on the user route                                                                                                   | verify a `cfat_` token on `/accounts/<account id>/tokens/verify`; otherwise make a new token and set it again                                   |
+| 401, code 10000 "Authentication error" (the `/ai/v1` route: curl's chat completion, or passed through by the Gateway)   | token invalid, expired, rolled, deleted, IP-filtered, or without Workers AI on this account; or `$WORKERS_AI_API_TOKEN` empty in that terminal                                          | the verify curl above; make a new token with Workers AI Read including `data.accountId`; set it again                                          |
+| 403, code 9109 "Unauthorized to access requested resource" or "Invalid access token"                                    | the token's resources don't include this account                                                                                                                                        | a token whose account resources include the Gateway's account                                                                                   |
+| 403, code 5035 "This model requires a Workers Paid plan."                                                               | a paid-only model (`kimi-k2.6`) on an account without Workers Paid                                                                                                                      | the Gateway's account must be on Workers Paid (everyapp needs it anyway)                                                                        |
+| 429, code 3036 "You have used up your daily free allocation of 10,000 neurons."                                         | Workers Free's daily cap                                                                                                                                                                | Workers Paid; it doesn't occur there                                                                                                            |
+| 429, code 3040 "Capacity temporarily exceeded", or a bare 429                                                           | Cloudflare capacity, or a rate limit (kimi: 20 a minute per account; the limit's own code unverified)                                                                                   | retry later; on kimi expect it, or use `@cf/meta/llama-4-scout-17b-16e-instruct`                                                                |
+| 400 code 5007 "No such model", or 404 code 3042 "The model name is invalid"                                             | the model id isn't in the catalog                                                                                                                                                       | `cf ai models list --search llama` (read-only) for a current id; change the app's manifest and code                                             |
+| `SECRET_EMPTY`                                                                                                          | `$WORKERS_AI_API_TOKEN` is empty in the terminal that ran `secret set`                                                                                                                  | redo the `read -rs …; export …` line in that same terminal, then rerun                                                                          |
+| `SECRET_VALUE_REQUIRED`                                                                                                 | nothing was piped and there is no terminal                                                                                                                                              | one of README's three ways                                                                                                                      |
+| `SECRET_VALUE_REQUIRED` from `pnpm everyapp configure agentic-inbox --json`                                             | nothing was piped (with `--from-env`, stdin isn't read), no variable of a missing name was found, and there is no terminal; the message names what the inbox still needs (this token is optional, so never among them) | the person's terminal (step 3), `NAME=value` lines on stdin, or the hidden read then its `data.rerun`, `pnpm everyapp configure agentic-inbox --from-env` |
+| `SECRET_SEVERAL_NAMES`                                                                                                  | `--from-env` or a pipe with several names                                                                                                                                               | one name per call                                                                                                                               |
+| `SECRET_NOT_SETTABLE` (from the every-app checkout) or `SECRET_NOT_DECLARED` (from an app directory)                    | the name is one setup writes (`CLOUDFLARE_ACCOUNT_ID`)                                                                                                                                  | set only `WORKERS_AI_API_TOKEN`; never add it to the manifest's `secrets`; a wrong account id has no everyapp repair today (tell the person)     |
+| 400, code 6003 "Invalid request headers" / 6111 "Invalid format for Authorization header" (the verify routes)           | `$WORKERS_AI_API_TOKEN` is empty in that terminal (not exported, or a new terminal); the chat route shows the same as 401 code 10000                                                      | redo step 3 in one terminal, in order; an HTML page instead means a mistyped URL                                                                |
+
+## Rerun, rotate, remove
+
+- Rerun: every step is safe to repeat. `configure` and `secret set` replace the value in one new Gateway version; a second token on Cloudflare's side is harmless until you delete it. Interrupted or back later: start at Verify and continue at the first step that isn't done.
+- Rotate: on the token's row in the dashboard (user tokens at https://dash.cloudflare.com/profile/api-tokens, account tokens under **Manage account** > **Account API tokens**) the three-dot menu, **Roll**, **Confirm**. The new secret keeps the permissions and the old one stops at once, so run step 3 again straight away. The API's roll: `cf user tokens roll <token-id>` for a user token, `cf accounts tokens roll <token-id>` for an account token; both need an API token with the matching API Tokens Edit permission, not the login.
+- Remove: `pnpm everyapp secret unset WORKERS_AI_API_TOKEN --json` (add `--yes` only when the person said so). The inbox keeps opening (its manifest marks the provider optional); a Worker built with `AI_PROVIDER=workers-ai` then loses its agent, verifier and scanner to `ai_provider_not_configured`, one built with `AI_PROVIDER=openrouter` is unaffected. Then delete the token in the same row menu (label unverified): a token the Gateway no longer holds is still a token.
+
+## Sources
+
+Verified 2026-10-23:
+
+- https://developers.cloudflare.com/workers-ai/get-started/rest-api/ (Use REST API, Create a Workers AI API Token; the prefilled token grants Workers AI Read, a token made by hand needs Read and Edit)
+- https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ (dashboard flow, TTL, verify command, `cfut_`)
+- https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/ (Manage account > Account API tokens, roles, Workers AI supported, `cfat_`)
+- https://developers.cloudflare.com/fundamentals/api/how-to/create-via-api/ (token creation needs a token with API Tokens Edit)
+- https://developers.cloudflare.com/fundamentals/api/how-to/roll-token/ (Roll, Confirm)
+- https://developers.cloudflare.com/fundamentals/api/reference/permissions/ (Workers AI Read, Workers AI Edit)
+- https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/verify/ and https://developers.cloudflare.com/api/resources/accounts/subresources/tokens/methods/verify/; probed with a bogus token and an empty header: both verify routes answer 401 code 1000 and 400 code 6003/6111, `/ai/v1/chat/completions` 401 code 10000 for either
+- https://developers.cloudflare.com/workers-ai/configuration/open-ai-compatibility/ (`/accounts/<account id>/ai/v1/chat/completions`, embeddings, responses for gpt-oss only)
+- https://developers.cloudflare.com/workers-ai/platform/pricing/ (neurons, per-model prices, paid-only list)
+- https://developers.cloudflare.com/workers-ai/platform/limits/ (300 a minute; 20 for paid-only models, 50 only through an AI Gateway on prepaid credits with Unified billing)
+- https://developers.cloudflare.com/workers-ai/platform/errors/ (3036, 3040, 3042, 5007, 5035)
+- https://developers.cloudflare.com/ai-gateway/usage/rest-api/ (`/accounts/<account id>/ai/*` needs Workers AI Read; code 10000 without it)
+- https://developers.cloudflare.com/workers-ai/models/llama-4-scout-17b-16e-instruct/ and https://developers.cloudflare.com/workers-ai/models/kimi-k2.6/
+- the live catalog via `cf ai models list` (`--search`, from its `--help`)
+- https://developers.cloudflare.com/workers/observability/logs/real-time-logs/ (`npx wrangler tail`, no storage) and https://developers.cloudflare.com/workers/observability/logs/workers-logs/ (Observability, retention); https://developers.cloudflare.com/workers/wrangler/commands/workers/ (`wrangler tail [WORKER]`, `--format json`)
+- `cf` 1.0.0-beta.14: `cf workers --help`, `cf o11y telemetry live-tail --help`, `cf user tokens --help`, `cf accounts tokens --help`
+- In this repository: `apps/every-app-gateway/src/server/ai-proxy.ts`, `apps/every-app-gateway/src/server/app-needs-setup.ts` (the setup gate: the redirect to `/?setup=<app id>` and 503 `app_needs_setup`), `packages/sdk/src/internal/aiProviders.ts` (`setup/workers-ai.md`; `CLOUDFLARE_ACCOUNT_ID` under `alsoNeeds`), `packages/sdk/src/internal/appSettings.ts` (`AppSetup`: `unmet`, `settings`, `groups`, `command`; `needOf`: a plain provider id is required, `anyOf` makes a group; `providerNames` leaves install-owned settings out), `packages/sdk/src/internal/gatewaySettings.ts`, `packages/cli/src/lib/gateway/apply.ts` (install-owned secrets go with the first deploy only), `packages/cli/src/commands/secret/index.ts` (`secret list <app>` from anywhere, `data.app.setup`, the kept `data.gateway.needed` and `missing`, `APP_NOT_FOUND`), `packages/cli/src/commands/configure/index.ts` (`configure <app>`: the optional settings' prompts and the menu, `--from-env`), `packages/cli/src/lib/app/settings.ts` (the `Guide:` line), `packages/cli/src/commands/status/problems.ts` (`APP_NEEDS_SETUP`), `packages/cli/src/lib/secretValue.ts`, `docs/capabilities.md`; in agentic-inbox: `everyapp.config.ts` (`openrouter` required, `workers-ai` `optional: true`; no any-of group), `cloudflare.config.ts` (`AI_PROVIDER` defaults to `workers-ai` until its PR #6) and `workers/everyapp/gateway.ts` (each provider's models)

package/bin/__everyapp_bash_complete.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-// Committed launcher so package managers can link the bin at install time,
-// before dist/ exists (fresh CI checkouts install with --ignore-scripts).
-import("../dist/bash-complete.js").catch((error) => {
-  if (error?.code === "ERR_MODULE_NOT_FOUND") {
-    console.error(
-      "everyapp CLI is not built. In the monorepo, run: pnpm -C packages/cli build",
-    );
-    process.exit(1);
-  }
-  throw error;
-});

package/dist/bash-complete.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import{a as o,b as s}from"./chunk-POSDLD3G.js";import"./chunk-RB5D2R45.js";import"./chunk-YJ2DKIZS.js";import{proposeCompletions as r}from"@stricli/core";var t=process.argv.slice(3);process.env.COMP_LINE?.endsWith(" ")&&t.push("");await r(s,t,o(process));try{for(let{completion:p}of await r(s,t,o(process)))process.stdout.write(`${p}
-`)}catch{}

package/dist/chunk-7BOQJFI5.js

@@ -1,8 +0,0 @@
-import{c as l,d as m,e as f,m as g,n as w,o as y}from"./chunk-DLGPLHBH.js";import{c as d}from"./chunk-U4LIQ5VR.js";import{c as h,d as k}from"./chunk-WO3NE7ZU.js";import I from"enquirer";import p from"chalk";async function x(){if(process.env.CLOUDFLARE_API_TOKEN){let r=process.env.CLOUDFLARE_ACCOUNT_ID;return r?f(r):(console.log(p.yellow(`
-CLOUDFLARE_ACCOUNT_ID is required when using CLOUDFLARE_API_TOKEN
-`)),d(1))}let e=await g(),{account:t,otherAccounts:o}=await y(e);return w(t,o),{id:t.account.id,name:t.account.name}}async function C(e="this",t=!1){let o=await x();if(process.env.CLOUDFLARE_API_TOKEN&&(console.log(p.dim(`  ${o.name} (${o.id})`)),console.log()),t)return console.log(p.dim(`Skipping deployment confirmation due to -y flag.
-`)),!0;let{confirm:r}=await I.prompt({type:"confirm",name:"confirm",message:`Do you want to deploy ${e} to ${o.name}?`,initial:!1});return r}function v({domain:e,accountId:t,mode:o,hostname:r}){let n=t?`https://dash.cloudflare.com/${t}/${e}/dns/records`:`https://dash.cloudflare.com -> ${e} -> DNS`,i=r??`todo.${e}`,s=o==="app-blocking"?[`Each app you deploy will live at [app].${e} - this app at`,`${i} - but that address does not resolve yet. To support`,"this, you must add the DNS record below:"]:[`Each app you deploy will live at [app].${e} - for example`,`todo.${e}. To support this, you must add the DNS record`,"below (the login this CLI uses isn't allowed to add it for you):"],a=o==="app-blocking"?["After DNS propagates, re-run everyapp app deploy.","If you know DNS is ready and this check is blocked locally, re-run with --skip-dns-check."]:["Continuing the deploy - once you add that record, apps at",`*.${e} will work properly. You only do this once.`];return["",...s,"",`  Add record at: ${n}`,"    Type:    CNAME","    Name:    *",`    Target:  ${e}`,"    Proxy:   ON (orange cloud)","","Here are the docs explaining how this works:","  https://developers.cloudflare.com/workers/configuration/routing/routes/","  https://github.com/cloudflare/workers-sdk/issues/5568","",...a,""].join(`
-`)}import c from"chalk";async function u(e,t){let o=await m();if(t)return{accountId:o,workerName:t};let r=await k(e),n=h(r.id);return{accountId:o,workerName:n}}async function N(e){return await l(`/accounts/${e.accountId}/workers/scripts/${e.workerName}/secrets`)}async function W({cwd:e,workerName:t}){let o=await u(e,t);return(await N(o)).map(n=>n.name)}async function F({secretName:e,cwd:t,workerName:o,verbose:r=!1}){r&&console.log(c.dim(`   Checking secret: ${e}`));let n=await u(t,o),s=(await N(n)).some(a=>a.name===e);return s&&r&&console.log(c.dim(`   Secret already exists
-`)),s}async function R({secretName:e,secretValue:t,cwd:o,workerName:r,verbose:n=!1,description:i}){n&&i&&console.log(c.dim(`   ${i}
-`));let s=await u(o,r);await l(`/accounts/${s.accountId}/workers/scripts/${s.workerName}/secrets`,{method:"PUT",body:JSON.stringify({name:e,text:t,type:"secret_text"})}),n&&console.log(c.green(`Created secret: ${e}
-`))}export{C as a,W as b,F as c,R as d,v as e};

package/dist/chunk-7YVJFS4A.js

@@ -1 +0,0 @@
-import{b as i,d,g as D}from"./chunk-DLGPLHBH.js";import{f}from"./chunk-WO3NE7ZU.js";import{execa as A}from"execa";async function E(s){let{config:t}=await f(s);if(!t.d1_databases||t.d1_databases.length===0)throw new Error("No D1 databases found in everyapp.config.ts. Please add a D1 resource declaration.");let a=t.d1_databases[0];if(!a)throw new Error("No D1 database configuration found.");let e=a.database_name;if(!e)throw new Error("No database_name found in generated D1 database configuration.");let[n,r]=await Promise.all([d(),i()]),o=(await D(n)).find(u=>u.name===e);if(!o)throw new Error(`Database "${e}" not found in your Cloudflare account. Have you run deployment to create the database?`);return{CLOUDFLARE_ACCOUNT_ID:n,CLOUDFLARE_DATABASE_ID:o.uuid,CLOUDFLARE_API_TOKEN:r}}async function O(s,t,a){let{cwd:e,env:n={},verbose:r=!1}=a,c=a.d1DatabaseId?{CLOUDFLARE_ACCOUNT_ID:await d(),CLOUDFLARE_DATABASE_ID:a.d1DatabaseId,CLOUDFLARE_API_TOKEN:await i()}:await E(e),o={cwd:e,stdio:r?"inherit":"pipe",env:{...process.env,...n,...c}};await A(s,t,o)}export{E as a,O as b};

package/dist/chunk-BIXKPCDH.js

@@ -1,2 +0,0 @@
-import{b as w,c as y}from"./chunk-VEYSNPDH.js";var h=15e3,c="INTERNAL_APIS_DISABLED",a=class extends Error{status;code;constructor({message:e,status:r,code:o}){super(e),this.name="GatewayApiError",this.status=r,this.code=o}},i=class extends a{constructor(e="OUTDATED_GATEWAY"){super({message:e,status:404}),this.name="OutdatedGatewayError"}},u=class extends a{constructor(e="GATEWAY_INTERNAL_APIS_DISABLED"){super({message:e,status:404,code:c}),this.name="GatewayInternalApisDisabledError"}},p=class extends a{constructor(e,r="GATEWAY_INTERNAL_AUTH"){super({message:r,status:e}),this.name="GatewayAuthError"}};function A(s){return s instanceof i}function f(s){return s instanceof u}function G(s){return s instanceof p}var l=class{gatewayUrl;getAuthToken;constructor({gatewayUrl:e,getAuthToken:r}){this.gatewayUrl=e.replace(/\/+$/,""),this.getAuthToken=r??(()=>y(this.gatewayUrl))}getIdentityKeys(){return this.request("/api/deploy/identity-keys",{method:"GET"})}registerApp(e){return this.request("/api/deploy/register",{method:"POST",body:e})}async hasOwner(){let e=await this.request("/api/admin/has-owner",{method:"GET",auth:!1});if(typeof e.hasOwner!="boolean")throw new a({message:"Gateway returned an invalid owner response",status:200});return e.hasOwner}whoami(){return this.request("/api/deploy/whoami",{method:"GET"})}async request(e,r){let o={"content-type":"application/json"};if(r.auth!==!1){let g=await this.getAuthToken();o.authorization=`Bearer ${g}`}let t=await fetch(`${this.gatewayUrl}${e}`,{method:r.method,signal:AbortSignal.timeout(h),headers:o,body:r.body?JSON.stringify(r.body):void 0}),d=await t.text(),n=null;if(d.trim())try{n=JSON.parse(d)}catch{throw t.ok?new a({message:"Gateway returned an invalid JSON response",status:t.status}):new a({message:`Gateway request failed (${t.status})`,status:t.status})}if(t.status===404)throw n?.code===c?new u:new i;if(!t.ok)throw t.status===401||t.status===403?new p(t.status,[n?.error||"Gateway deploy-token authorization failed.",w(this.gatewayUrl)].join(`
-`)):new a({message:n?.error||`Gateway request failed (${t.status})`,status:t.status,code:n?.code});return n??{}}};export{A as a,f as b,G as c,l as d};

package/dist/chunk-DLGPLHBH.js

@@ -1,47 +0,0 @@
-import{c as y}from"./chunk-U4LIQ5VR.js";import R from"node:fs/promises";import g from"node:path";import _ from"node:os";import*as A from"smol-toml";import c from"chalk";var l=class extends Error{status;codes;endpoint;constructor({message:t,status:n,codes:r,endpoint:o}){super(t),this.name="CloudflareAPIError",this.status=n,this.codes=r,this.endpoint=o}};function C(e){return e instanceof l&&(e.status===401||e.status===403||e.codes.includes(1e4))}function x(){let e=_.homedir(),t=_.platform(),n;return t==="win32"?n=g.join(process.env.LOCALAPPDATA||g.join(e,"AppData","Local"),".wrangler"):t==="darwin"?n=g.join(e,"Library","Preferences",".wrangler"):n=g.join(e,".wrangler"),g.join(n,"config","default.toml")}async function B(){let e=x();try{let t=await R.readFile(e,"utf-8"),n=A.parse(t);if(!n.oauth_token||!n.refresh_token)throw new Error("OAuth tokens not found in wrangler config");return n}catch(t){throw t.code==="ENOENT"?new Error("Wrangler config not found. Please run 'npx wrangler login' first."):t}}async function F(e){let t=x(),n=g.dirname(t);await R.mkdir(n,{recursive:!0});let r=A.stringify(e);await R.writeFile(t,r,"utf-8")}function M(e){let t=new Date(e).getTime(),n=Date.now(),r=1*60*1e3;return t-n<r}async function W(e){let t=await fetch("https://dash.cloudflare.com/oauth2/token",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:"54d11594-84e4-41aa-b438-e81b8fa78ee7"})});if(!t.ok)throw new Error(`Failed to refresh OAuth token: ${t.status} ${t.statusText}`);let n=await t.json();return{oauth_token:n.access_token,expiration_time:new Date(Date.now()+n.expires_in*1e3).toISOString(),refresh_token:n.refresh_token||e,scopes:n.scope?n.scope.split(" "):[]}}async function q(e={}){let{showNewUserHelp:t=!1}=e,n=!!process.env.CLOUDFLARE_API_TOKEN,r=!!process.env.CLOUDFLARE_ACCOUNT_ID;if(n&&!r&&(console.log(c.yellow(`
-Missing CLOUDFLARE_ACCOUNT_ID
-`)),console.log(`When using CLOUDFLARE_API_TOKEN, you must also set CLOUDFLARE_ACCOUNT_ID.
-`),console.log(c.dim(`  export CLOUDFLARE_ACCOUNT_ID=<your_account_id>
-`)),await y(1)),!(n&&r))try{await I()}catch{console.log(t?c.yellow(`
-Already have a Cloudflare account?
-`):c.yellow(`
-Please log in to Cloudflare.
-`)),console.log(c.dim("  1. Cloudflare CLI (recommended): npx wrangler login")),console.log(c.dim(`  2. Environment variables: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
-`)),t&&(console.log(c.yellow(`Don't have a Cloudflare account?
-`)),console.log("Every App uses Cloudflare so that you can inexpensively host your applications"),console.log("on a secure and powerful platform without needing to think about the machines"),console.log(`your code runs on.
-`),console.log(`Here are the steps to get started:
-`),console.log(c.dim("  1. Create a Cloudflare account (free, no credit card required):")),console.log(c.cyan(`     https://dash.cloudflare.com/sign-up
-`)),console.log(c.dim(`     - Skip any Cloudflare onboarding like configuring a domain, this is unnecessary for Every App.
-`)),console.log(c.dim(`  2. Check your email to verify your email address
-`)),console.log(c.dim("  3. Log in to Cloudflare via the CLI:")),console.log(c.cyan(`     npx wrangler login
-`)),console.log(c.dim("     - Learn more: ")+c.cyan(`https://developers.cloudflare.com/workers/wrangler/commands/#login
-`))),await y(1)}}async function I(){let e=process.env.CLOUDFLARE_API_TOKEN;if(e)return e;let t=await B();if(M(t.expiration_time)){let n=await W(t.refresh_token);return await F(n),n.oauth_token}return t.oauth_token}async function i(e,t={}){let n=await I(),r=typeof FormData<"u"&&t.body instanceof FormData,o=await fetch(`https://api.cloudflare.com/client/v4${e}`,{...t,headers:{Authorization:`Bearer ${n}`,...r?{}:{"Content-Type":"application/json"},...t.headers}}),a;try{a=await o.json()}catch(f){throw o.ok?f:new l({message:`Cloudflare API request failed: ${o.status} ${o.statusText||"Invalid JSON response"}`,status:o.status,codes:[],endpoint:e})}let s=Array.isArray(a.errors)?a.errors:[],m=s.map(f=>f.code).filter(f=>typeof f=="number");if(!o.ok){let f=s.length?s.map(w=>`[${w.code}] ${w.message}`).join(", "):o.statusText;throw new l({message:`Cloudflare API request failed: ${o.status} ${f}`,status:o.status,codes:m,endpoint:e})}if(!a.success){let f=s.map(w=>`[${w.code}] ${w.message}`).join(", ");throw new l({message:`Cloudflare API error: ${f}`,status:o.status,codes:m,endpoint:e})}return a.result}async function u(){let e=process.env.CLOUDFLARE_ACCOUNT_ID;if(e)return e;let t=await i("/accounts");if(!t||t.length===0)throw new Error("No Cloudflare accounts found");let n=t[0];if(!n)throw new Error("No Cloudflare accounts found");return n.id}async function V(e){let t=await i(`/accounts/${e}`);if(!t||!t.id)throw new Error(`Account ${e} not found`);return t}async function E(e){try{let t=await i(`/accounts/${e}/workers/subdomain`);if(!t||!t.subdomain)throw new Error("No workers.dev subdomain found for this account");return t.subdomain}catch(t){throw new Error(`Failed to get workers.dev subdomain: ${t instanceof Error?t.message:"Unknown error"}`)}}async function P(e,t){let n=t||await u(),r=await E(n);return`https://${e}.${r}.workers.dev`}var v="every-app-gateway";async function K(e){let t=e||await u();try{let o=(await i(`/accounts/${t}/workers/domains?service=${encodeURIComponent(v)}&per_page=100`)).filter(a=>a.service===v&&typeof a.hostname=="string"&&a.hostname.length>0).map(a=>a.hostname).sort((a,s)=>a.length-s.length||a.localeCompare(s))[0];if(o)return`https://${o}`}catch(n){if(!C(n))throw n}return P(v,t)}import k from"chalk";var T={EMAIL_NOT_VERIFIED:10034,R2_NOT_ENABLED:10042},G={[T.EMAIL_NOT_VERIFIED]:{userMessage:"Almost there! Your Cloudflare account email needs to be verified first.",action:`To verify your email address:
-
-  1. Check your inbox for a verification email from Cloudflare
-  2. Click the verification link in the email
-  3. Or visit ${k.cyan("https://dash.cloudflare.com/profile")} to resend the verification email
-
-Then run this command again.`},[T.R2_NOT_ENABLED]:{userMessage:"R2 not enabled",action:`R2 is Cloudflare's file storage service, used for storing images and files.
-
-  ${k.cyan("https://dash.cloudflare.com/{accountId}/r2/plans")}
-
-${k.dim("  Visit the URL above to enable R2, then run this command again.")}`}};function z(e){let t=e.match(/\[code:\s*(\d+)\]/);if(t?.[1])return parseInt(t[1],10);let n=e.match(/"code"\s*:\s*(\d+)/);if(n?.[1])return parseInt(n[1],10);let r=e.match(/\[(\d{5})\]/);if(r?.[1])return parseInt(r[1],10)}function $(e){let t=G[e];if(t)return{code:e,...t}}function j(e){let t="";return e instanceof Error?(t=e.message,"stdout"in e&&typeof e.stdout=="string"&&(t+=`
-`+e.stdout),"stderr"in e&&typeof e.stderr=="string"&&(t+=`
-`+e.stderr),"all"in e&&typeof e.all=="string"&&(t+=`
-`+e.all)):typeof e=="string"&&(t=e),t}async function H(e,t){let n=e.action,r=t.accountId;if(!r&&n.includes("{accountId}"))try{r=await u()}catch{}return r&&(n=n.replace(/{accountId}/g,r)),`
-${k.yellow(e.userMessage)}
-
-${n}
-`}async function J(e,t={}){let n=j(e),r=e instanceof l?e.codes.find(s=>$(s)):z(n);if(r===void 0)return;let o=$(r);return o?{formatted:await H(o,t),code:r}:void 0}import d from"chalk";import Z from"enquirer";async function Y(e,t){try{let n=t?{subdomain:t}:{},r=await i(`/accounts/${e}/workers/subdomain`,{method:"PUT",body:JSON.stringify(n)});if(!r||!r.subdomain)throw new Error("Failed to initialize workers.dev subdomain");return r.subdomain}catch(n){throw new Error(`Failed to initialize workers.dev subdomain: ${n instanceof Error?n.message:"Unknown error"}`)}}async function Q(){return(await Z.prompt({type:"input",name:"subdomain",message:"  Choose a subdomain name:",validate:t=>!t||t.trim()===""?"Subdomain cannot be empty":/^[a-z0-9-]+$/.test(t)?t.startsWith("-")||t.endsWith("-")?"Subdomain cannot start or end with a hyphen":!0:"Subdomain must contain only lowercase letters, numbers, and hyphens"})).subdomain.trim()}async function X(){let e=await u();try{return await E(e)}catch{console.log(),console.log(d.yellow(`  Cloudflare Workers needs an account subdomain.
-`)),console.log(d.dim("  Cloudflare requires this one-time account setup before its first Worker upload.")),console.log(d.dim("  Every App keeps private app workers.dev routes disabled; your apps still use")),console.log(d.dim(`  the Gateway's custom domain.
-`)),console.log(d.dim("  Choose a unique account subdomain, such as your name.")),console.log(d.dim(`  Example: "janedoe.workers.dev"
-`));let t=await Q();console.log(d.dim(`
-  Creating subdomain: ${t}...
-`));try{let n=await Y(e,t);return console.log(d.green(`  Successfully created subdomain: ${d.cyan(n)}
-`)),n}catch(n){throw console.error(d.red(`
-  Failed to create subdomain`),d.dim(`
-  ${n instanceof Error?n.message:"Unknown error"}`)),n}}}import{z as p}from"zod";var ee=p.object({uuid:p.string(),name:p.string(),created_at:p.string().optional(),version:p.string().optional()}),S=p.array(ee);async function b(e){let t=await i(`/accounts/${e}/d1/database?per_page=1000`);return S.parse(t)}async function te(e,t){let n=await i(`/accounts/${t}/d1/database`,{method:"POST",body:JSON.stringify({name:e})});if(!n||!n.uuid)throw new Error("Failed to create D1 database: no UUID returned");return n.uuid}async function ne(e,t){let r=(await b(t)).find(a=>a.name===e);return r?{id:r.uuid,name:e,wasCreated:!1}:{id:await te(e,t),name:e,wasCreated:!0}}var N="every-app-gateway",re="every-app-gateway",D="APP__";async function L(e){let t=e??await u(),r=(await b(t)).find(s=>s.name===re);if(!r)return[];let o;try{o=await ce(t,r.uuid)}catch(s){let m=s instanceof Error?s.message:String(s);if(s instanceof l&&(m.includes("no such table")||m.includes("no such column")||m.includes("D1_ERROR")))return[];throw s}let a=o.map(s=>s.worker_name).filter(s=>typeof s=="string"&&s.length>0);return[...new Set(a)].sort().map(s=>({binding:`${D}${s}`,service:s}))}async function oe(e){let t=e??await u(),r=(await se(t)).flatMap(s=>(ie(s),s.type==="service"&&s.name.startsWith(D)?[]:[{type:"inherit",name:s.name}])),o=await L(t),a=[...r,...o.map(s=>({type:"service",name:s.binding,service:s.service}))];return await ae(t,a),o}async function se(e){return(await i(`/accounts/${e}/workers/scripts/${N}/settings`)).bindings??[]}async function ae(e,t){let n=new FormData;n.set("settings",JSON.stringify({bindings:t})),await i(`/accounts/${e}/workers/scripts/${N}/settings`,{method:"PATCH",body:n})}function ie(e){if(e.name.startsWith(D)&&e.type!=="service")throw new Error(`Gateway binding "${e.name}" uses the reserved ${D} namespace but is not a service binding.`)}async function ce(e,t){let n=await i(`/accounts/${e}/d1/database/${t}/query`,{method:"POST",body:JSON.stringify({sql:"SELECT worker_name FROM apps WHERE status = 'active' AND worker_name IS NOT NULL AND hostname IS NOT NULL"})}),r=Array.isArray(n)?n[0]:n;return r?.results??r?.result??[]}import ue from"chalk";async function de({accountId:e,domain:t}){let r=(await i(`/zones?name=${encodeURIComponent(t)}&account.id=${encodeURIComponent(e)}&per_page=50`)).find(o=>o.name===t);if(!r)throw new Error(`Cloudflare zone "${t}" was not found on the authenticated account. Add the zone to this account or pass a different --domain.`);return r}async function le({zoneId:e,domain:t}){let n=`*.${t}`;try{return(await i(`/zones/${e}/dns_records?name=${encodeURIComponent(n)}&per_page=100`)).find(a=>a.name===n&&["A","AAAA","CNAME"].includes(a.type)&&a.proxied===!0)?"exists":(await i(`/zones/${e}/dns_records`,{method:"POST",body:JSON.stringify({type:"CNAME",name:"*",content:t,proxied:!0,ttl:1})}),"created")}catch(r){if(C(r))return await U(`everyapp-wildcard-check.${t}`)?"exists":"unauthorized";throw r}}async function U(e){let t=new URL("https://cloudflare-dns.com/dns-query");t.searchParams.set("name",e),t.searchParams.set("type","A");try{let n=await fetch(t,{headers:{accept:"application/dns-json"}});if(!n.ok)throw new Error(`Cloudflare DoH returned HTTP ${n.status}`);let r=await n.json();return r.Status===0&&Array.isArray(r.Answer)&&r.Answer.length>0}catch(n){return console.log(ue.dim(`  Could not verify DNS through Cloudflare DoH (${n instanceof Error?n.message:String(n)}).`)),!1}}async function fe(e){return(await i(`/accounts/${e}/storage/kv/namespaces?per_page=1000`)).map(n=>({id:n.id,title:n.title}))}async function me(e,t){let n=await i(`/accounts/${t}/storage/kv/namespaces`,{method:"POST",body:JSON.stringify({title:e})});if(!n||!n.id)throw new Error("Failed to create KV namespace: no ID returned");return n.id}async function ge(e,t){let r=(await fe(t)).find(a=>a.title===e);return r?{id:r.id,name:e,wasCreated:!1}:{id:await me(e,t),name:e,wasCreated:!0}}async function pe(e){return(await i(`/accounts/${e}/r2/buckets?per_page=1000`)).buckets.map(n=>({name:n.name,creation_date:n.creation_date}))}async function he(e,t){let n=await i(`/accounts/${t}/r2/buckets`,{method:"POST",body:JSON.stringify({name:e})});if(!n||!n.name)throw new Error("Failed to create R2 bucket: no name returned");return n.name}async function we(e,t){return(await pe(t)).find(o=>o.name===e)?{name:e,wasCreated:!1}:(await he(e,t),{name:e,wasCreated:!0})}import h from"chalk";async function ye(){return await i("/memberships")}function O(e){return e.status==="pending"?" (pending)":""}function Ae(e,t){let n=O(e);console.log(h.dim(`  ${e.account.name} (${e.account.id})${n}`)),t.length>0&&(console.log(),console.log(h.dim("  Other accounts (set CLOUDFLARE_ACCOUNT_ID to switch):")),t.forEach(r=>{let o=O(r);console.log(h.dim(`    - ${r.account.name}: ${r.account.id}${o}`))})),console.log()}async function Ce(e){return console.log(h.yellow(`Multiple Cloudflare accounts found.
-`)),console.log(`Please set the CLOUDFLARE_ACCOUNT_ID environment variable:
-`),e.forEach(t=>{let n=O(t);console.log(h.dim(`  ${t.account.name}: ${t.account.id}${n}`))}),console.log(h.dim(`
-  export CLOUDFLARE_ACCOUNT_ID=<account_id>
-`)),y(1)}async function ke(e){if(e.length===0)throw new Error("No Cloudflare accounts found");let t=process.env.CLOUDFLARE_ACCOUNT_ID;!t&&e.length>1&&await Ce(e);let n=t?e.find(o=>o.account.id===t):e[0];if(!n)throw new Error(`Account ${t} not found in your Cloudflare memberships`);let r=e.filter(o=>o.account.id!==n.account.id);return{account:n,otherAccounts:r}}export{q as a,I as b,i as c,u as d,V as e,P as f,b as g,ne as h,ge as i,we as j,K as k,J as l,ye as m,Ae as n,ke as o,X as p,L as q,oe as r,de as s,le as t,U as u};

package/dist/chunk-FD6K2YA7.js

@@ -1,9 +0,0 @@
-import{k as g}from"./chunk-DLGPLHBH.js";import a from"node:fs/promises";import p from"node:path";import h from"node:os";import y from"chalk";async function C(t,e,o={}){let n=o.exclude||[];await a.mkdir(e,{recursive:!0});let i=await a.readdir(t,{withFileTypes:!0});for(let s of i){let r=p.join(t,s.name),c=p.join(e,s.name);n.some(l=>s.name===l)||(s.isDirectory()?await C(r,c,o):await a.copyFile(r,c))}}async function T(t){try{return(await a.stat(t)).isDirectory()}catch{return!1}}async function D({targetDir:t,appId:e,gatewayUrl:o}){let n=o??await g(),i=`# Vite client-side secrets
-VITE_APP_ID=${e}
-VITE_GATEWAY_URL=${n}
-# Set Cloudflare secrets locally
-GATEWAY_URL=${n}
-`;await Promise.all([a.writeFile(p.join(t,".env.local"),i)])}async function $(t){return await a.mkdtemp(p.join(h.tmpdir(),t))}async function O({tmpDir:t,verbose:e=!1}){try{await a.rm(t,{recursive:!0,force:!0}),e&&console.log(y.dim(`  Removed: ${t}`))}catch{console.warn(y.yellow("\u26A0\uFE0F  Warning: Failed to clean up temporary directory:"),t)}}import{execa as f}from"execa";import m from"chalk";async function A(t,e,o){let{env:n,cwd:i,verbose:s=!1,description:r,logCommandToConsole:c=!0}=o;return s?v(t,e,o):c?(console.log(`Running: ${w(t,e)}`),r&&console.log(m.dim(`  ${r}`)),await f(t,e,{cwd:i,env:n,shell:o.shell,stdio:"pipe"})):await f(t,e,{cwd:i,env:n,shell:o.shell,stdio:"pipe"})}async function v(t,e,{description:o,cwd:n,env:i,shell:s}){console.log(m.dim(`  \u250C\u2500 Running: ${w(t,e)}`)),o&&console.log(m.dim(`  \u2502 ${o}`));let r=f(t,e,{cwd:n,env:i,shell:s,stdio:void 0,all:!0});r.stdout&&r.stdout.on("data",l=>{l.toString().split(`
-`).forEach(u=>{u.trim()&&console.log(m.dim(`  \u2502 ${u}`))})}),r.stderr&&r.stderr.on("data",l=>{l.toString().split(`
-`).forEach(u=>{u.trim()&&console.error(m.dim(`  \u2502 ${u}`))})});let c=await r;return console.log(m.dim(`  \u2514\u2500 Complete
-`)),c}function w(t,e){return[t,...e].join(" ")}export{C as a,T as b,D as c,$ as d,O as e,A as f};

package/dist/chunk-GAJEQYJH.js

@@ -1,39 +0,0 @@
-import{c as I,d as k,e as M}from"./chunk-7BOQJFI5.js";import{c as j,d as F}from"./chunk-XTO2VTPY.js";import{f as Y}from"./chunk-O2KDOP5R.js";import{f as v}from"./chunk-FD6K2YA7.js";import{a as B,b as U,c as O,d as w}from"./chunk-BIXKPCDH.js";import{d as h,h as N,i as $,j as _,k as x,l as A,p as V,r as W,u as T}from"./chunk-DLGPLHBH.js";import{c as d}from"./chunk-U4LIQ5VR.js";import{c as K,d as z,e as E,f as L}from"./chunk-WO3NE7ZU.js";import u from"chalk";import p from"chalk";async function H({appId:e,d1Bindings:o=["DB"],kvBindings:t=["KV"],needsR2Bucket:n=!1,verbose:i=!1}){let a=[o.length>0?"D1 Database":null,t.length>0?"KV Store":null,n?"R2 Bucket":null].filter(Boolean);a.length>0&&console.log(`
-Setting up your Cloudflare ${a.join(", ")}...
-`);let s=await h(),l=E(e),r;n&&(r=await ge(l,s,i));let g={};for(let c of o){let y=E(e,c);g[c]=await le(y,s,i)}let m={};for(let c of t){let y=E(e,c);m[c]=await ce(y,s,i)}return{d1DatabaseId:g.DB,kvNamespaceId:m.KV,d1DatabaseIds:g,kvNamespaceIds:m,r2BucketName:r,resourceName:l}}async function le(e,o,t){t&&(console.log(p.bold(`Processing D1 database...
-`)),console.log(`  Checking D1 database: ${e}`));let n=await N(e,o);return t?n.wasCreated?console.log(p.green(`  Created D1 database: ${e} (${n.id})
-`)):console.log(p.dim(`  Linking to existing D1 database: ${e} (${n.id})
-`)):n.wasCreated?console.log(p.green("  D1 successfully created.")):console.log("  D1 already set up."),n.id}async function ce(e,o,t){t&&(console.log(p.bold(`Processing KV namespace...
-`)),console.log(`  Checking KV namespace: ${e}`));let n=await $(e,o);return t?n.wasCreated?console.log(p.green(`  Created KV namespace: ${e} (${n.id})
-`)):console.log(p.dim(`  Linking to existing KV namespace: ${e} (${n.id})
-`)):n.wasCreated?console.log(p.green("  KV successfully created.")):console.log("  KV already set up."),n.id}async function ge(e,o,t){t&&(console.log(p.bold(`Processing R2 bucket...
-`)),console.log(`  Checking R2 bucket: ${e}`));let n;try{n=await _(e,o)}catch(i){let a=await A(i,{accountId:o});throw a&&(console.log(a.formatted),await d(1)),i}return t?n.wasCreated?console.log(p.green(`  Created R2 bucket: ${e}
-`)):console.log(p.dim(`  Linking to existing R2 bucket: ${e}
-`)):n.wasCreated?console.log(p.green("  R2 successfully created.")):console.log("  R2 already set up."),n.name}import D from"chalk";import R from"node:fs/promises";import b from"node:path";import{parse as pe}from"jsonc-parser";async function q({cwd:e,buildCommand:o,gatewayUrl:t,appId:n,generatedWranglerConfigPath:i,verbose:a}){let s={...process.env,VITE_GATEWAY_URL:t,VITE_APP_ID:n,EVERYAPP_GATEWAY_URL:t,EVERYAPP_APP_ID:n};try{await ue(e),o?await v(o,[],{cwd:e,description:`Building your application...
-`,env:s,shell:!0,verbose:a}):await me(e)?await v("npx",["vite","build"],{cwd:e,description:`Building your application...
-`,env:s,verbose:a}):a&&console.log(D.dim("No Vite config found; deploying generated worker config."));let l=await de({cwd:e,generatedWranglerConfigPath:i,verbose:a}),{command:r,argsPrefix:g}=await j(e,"wrangler","wrangler");await v(r,[...g,"deploy","-c",l],{cwd:e,description:`Deploying your private application worker to Cloudflare...
-
-  This could take up to a minute.`,env:s,verbose:a})}catch(l){let r=await A(l);throw r&&(console.log(r.formatted),await d(1)),console.error(D.red(`
-Failed to build or deploy`)),l}}async function de({cwd:e,generatedWranglerConfigPath:o,verbose:t}){let n=b.join(e,"dist","server","wrangler.json");return await Q(n)?(await fe(n,o),t&&console.log(D.dim(`Using Vite-built deploy config: ${b.relative(e,n)}`)),n):(t&&console.log(D.dim("No Vite-built wrangler config found; using generated wrangler config.")),o)}async function fe(e,o){let t=await J(e),n=await J(o);delete t.configPath,delete t.userConfigPath,delete t.routes,delete t.route;let i=n.name;if(typeof i!="string"||i.length===0)throw new Error(`Generated config ${o} has no worker name; aborting deploy.`);let a=n.vars;for(let l of["EVERYAPP_IDENTITY_PUBLIC_KEYS","EVERYAPP_IDENTITY_ISSUER"]){let r=a?.[l];if(typeof r!="string"||r.length===0)throw new Error(`Generated config ${o} is missing ${l}; aborting deploy.`)}t.name=i,"topLevelName"in t&&(t.topLevelName=i),t.workers_dev=!1,t.preview_urls=!1,t.vars={...t.vars,...a};let s=n.services;if(Array.isArray(s)&&s.length>0){let l=new Set(s.map(g=>g.binding)),r=Array.isArray(t.services)?t.services:[];t.services=[...r.filter(g=>!l.has(g.binding)),...s]}await R.writeFile(e,JSON.stringify(t,null,2)+`
-`,"utf-8")}async function J(e){let o=await R.readFile(e,"utf-8"),t=[],n=pe(o,t,{allowTrailingComma:!0});if(t.length>0||n===void 0)throw new Error(`Failed to parse ${e} as JSONC.`);return n}async function ue(e){await R.rm(b.join(e,"dist","server","wrangler.json"),{force:!0})}async function Q(e){try{return await R.access(e),!0}catch(o){if(o instanceof Error&&"code"in o&&o.code==="ENOENT")return!1;throw o}}async function me(e){let o=["vite.config.ts","vite.config.mts","vite.config.js","vite.config.mjs","vite.config.cjs","vite.config.cts"];return(await Promise.all(o.map(n=>Q(b.join(e,n))))).some(Boolean)}import f from"chalk";async function X(e){return new w({gatewayUrl:e}).getIdentityKeys()}async function Z(e){try{let t=await new w({gatewayUrl:e}).whoami();return t.capabilities?.appGateway===!0?{organizationId:t.organizationId,gatewayBinding:{organizationId:t.organizationId}}:(console.log(f.yellow("Upgrade your gateway to enable the AI proxy binding: npx everyapp gateway deploy")),{organizationId:t.organizationId})}catch(o){throw await te(o),o}}async function ee(e){let{appId:o,workerName:t,manifest:n,gatewayUrl:i,verbose:a=!1,appName:s,appDescription:l}=e;try{console.log(""),a&&console.log("Registering app with gateway control plane...");let r=new w({gatewayUrl:i}),g=s||o,m=l||o,c=await r.registerApp({appId:o,name:g,description:m,workerName:t,manifest:n});return a&&(console.log(f.dim(`  Gateway app: ${c.appSlug} (${c.existingApp?"updated":"created"})`)),console.log(f.dim(`  Default access: ${c.defaultAccess?"enabled":"disabled"}`)),console.log(f.dim(`  Access granted to ${c.grantedUserCount} users
-`))),{hostname:c.hostname}}catch(r){throw await te(r),r}}async function te(e){B(e)&&(console.log(f.yellow(`
-Gateway out of date
-`)),console.log(f.dim("  Run: `npx everyapp gateway deploy` to update.\n")),await d(1)),O(e)&&(console.log(f.yellow(`
-Gateway authorization failed
-`)),console.log(f.dim(`${e.message}
-`)),await d(1)),U(e)&&(console.log(f.yellow(`
-Gateway internal APIs are disabled
-`)),console.log(f.dim(`  This gateway is running in hosted mode (or has invalid deployment mode config), so /api/deploy/* is intentionally unavailable.
-`)),await d(1)),console.error(f.red(`
-Failed to register app with gateway`),e instanceof Error?`
-   ${e.message}
-`:"")}var ne="GATEWAY_URL",oe="EVERY_APP_ORG_ID";async function ie({gatewayUrl:e,appPath:o,workerName:t,verbose:n=!1}){n&&console.log("Configuring Secrets...");try{if(await I({secretName:ne,cwd:o,workerName:t,verbose:n})||await k({secretName:ne,secretValue:e,cwd:o,workerName:t,verbose:n,description:`Setting GATEWAY_URL to: ${e}`}),!await I({secretName:oe,cwd:o,workerName:t,verbose:n})){let l=await new w({gatewayUrl:e}).whoami();await k({secretName:oe,secretValue:l.organizationId,cwd:o,workerName:t,verbose:n,description:`Setting EVERY_APP_ORG_ID to: ${l.organizationId}`})}n&&console.log(`Secret setup complete!
-`)}catch(i){throw console.error(`
-Failed to setup secrets`,i instanceof Error?`
-   ${i.message}`:""),i}}async function Qe(e){let{cwd:o,verbose:t}=e,n=e.manifest??await z(o),i=n.id,a=K(i),s=n.resources?.d1??[],l=n.resources?.kv??[],r=await x(),g=await Z(r),{organizationId:m}=g,c=await X(r),y=c.issuer??"",C=we(i,c.issuer);C&&await ye({...C,skipDnsCheck:e.skipDnsCheck??!1}),await V();let{d1DatabaseIds:P,kvNamespaceIds:ae}=await H({appId:i,d1Bindings:s,kvBindings:l,verbose:t});console.log(),await Y({cwd:o,description:"Installing dependencies for Cloudflare deployment...",install:n.install,verbose:t}),s.length>0?await F({cwd:o,workerName:a,d1Bindings:s,d1DatabaseIds:P,migrations:n.migrations,verbose:t}):t&&console.log(u.dim(`No D1 resources declared; skipping migrations.
-`));let{configPath:re}=await L(o,{manifest:n,d1DatabaseIds:P,kvNamespaceIds:ae,identityPublicKeys:c.keys,vars:{EVERYAPP_IDENTITY_ISSUER:y},gatewayBinding:g.gatewayBinding});await q({cwd:o,buildCommand:n.build,gatewayUrl:r,appId:i,generatedWranglerConfigPath:re,verbose:t});let{hostname:S}=await ee({appId:i,workerName:a,manifest:n,gatewayUrl:r,verbose:t,appName:n.name,appDescription:n.description});await ie({gatewayUrl:r,appPath:o,workerName:a,verbose:t});let se=await h(),G=await W(se);return t&&console.log(u.dim(`  Reconciled ${G.length} gateway app service binding${G.length===1?"":"s"}`)),{liveUrl:`https://${S}`,gatewayUrl:r,organizationId:m,hostname:S}}function we(e,o){if(!o)return null;let t=new URL(o).hostname;return{hostname:`${e}.${t}`,apex:t,issuerHost:t,isWorkersDev:t.endsWith(".workers.dev")}}async function ye({hostname:e,apex:o,issuerHost:t,isWorkersDev:n,skipDnsCheck:i}){if(n&&(console.log(u.red(`
-Gateway custom domain required
-`)),console.log([`  The gateway is currently configured at ${u.cyan(t)}.`,"  App subdomains cannot work on workers.dev domains.","",`  Run ${u.cyan("everyapp gateway deploy --domain <apex-domain>")} first, then deploy the app again.`,""].join(`
-`)),await d(1)),i||await T(e))return;console.log(u.red(`
-App subdomain DNS is not ready
-`));let a=await h().catch(()=>null);console.log(u.yellow(M({domain:o,accountId:a,mode:"app-blocking",hostname:u.cyan(e)}))),await d(1)}export{Qe as a};

package/dist/chunk-O2KDOP5R.js

@@ -1,13 +0,0 @@
-import{f as u}from"./chunk-FD6K2YA7.js";import{d}from"./chunk-BIXKPCDH.js";import{c as y,d as f,k as w}from"./chunk-DLGPLHBH.js";import{c as i}from"./chunk-U4LIQ5VR.js";import t from"chalk";var P="every-app-gateway",o=class extends Error{url;cause;constructor(n,a){super(`Could not reach your Gateway at ${n} (${k(a)})`),this.name="GatewayUnreachableError",this.url=n,this.cause=a}};function b(e){return`Could not reach your Gateway at ${e.url} (${k(e.cause)})`}async function R(e){try{return await fetch(e,{method:"HEAD",signal:AbortSignal.timeout(5e3)}),!0}catch(n){let a=n instanceof Error?n.message.toLowerCase():"",r=n instanceof Error&&"cause"in n&&n.cause?.code?.toLowerCase()||"";if(["ssl","tls","certificate","cert","cipher","handshake","secure"].some(s=>a.includes(s)||r.includes(s)))return!1;throw new o(e,n)}}async function G(e){let n=new d({gatewayUrl:e,getAuthToken:async()=>""});try{return await n.hasOwner()}catch(a){throw new o(e,a)}}async function x(){try{let e=await f();return await y(`/accounts/${e}/workers/scripts/${P}/settings`),!0}catch{return!1}}async function h(){return w()}async function U(){if(!await x())return{isDeployed:!1,hasOwner:!1,gatewayUrl:await h()};let n=await h(),a;try{a=await G(n)}catch(r){throw r instanceof o&&(console.log(t.yellow(`
-Gateway unreachable
-`)),console.log(b(r)),console.log(t.dim(`  Confirm the gateway URL is correct and reachable, then run this command again.
-`)),await i(1)),r}return{isDeployed:!0,hasOwner:a,gatewayUrl:n}}async function W(){let{isDeployed:e,hasOwner:n,gatewayUrl:a}=await U();if(e||(console.log(t.yellow(`
-Gateway not deployed
-`)),console.log(`You need to deploy the Every App Gateway before creating or deploying apps.
-`),console.log(t.dim(`  Run: npx everyapp gateway deploy
-`)),await i(1)),!n){let r=`${a}/sign-up`;console.log(t.yellow(`
-Owner account required
-`)),console.log(`You need to create an owner account on your Gateway before deploying apps.
-`),console.log(`  ${t.cyan(r)}
-`),console.log(t.dim(`  Visit the URL above to create your owner account, then run this command again.
-`)),await i(1)}return a}function k(e){return e instanceof Error?e.message:String(e)}import E from"node:fs/promises";import c from"node:path";import C from"chalk";import{execa as O}from"execa";async function D(){try{return await O("pnpm",["--version"],{stdio:"pipe"}),!0}catch{return!1}}async function Y({cwd:e,description:n,install:a,verbose:r=!1}){if(a===!1){console.log(C.dim("  Skipping dependency install (manifest install=false)."));return}if(typeof a=="string"){await u(a,[],{cwd:e,verbose:r,description:n,shell:!0});return}let l=await I(e),{command:g,args:s}=await S(l);try{await u(g,s,{cwd:e,verbose:r,description:n})}catch(m){throw new Error(`Failed to install dependencies with ${l}: ${m instanceof Error?m.message:"Unknown error"}`)}}async function I(e){let n=await M(e);return n||(await p(c.join(e,"pnpm-lock.yaml"))?"pnpm":await p(c.join(e,"yarn.lock"))?"yarn":await p(c.join(e,"package-lock.json"))?"npm":"pnpm")}async function M(e){let n=c.join(e,"package.json");try{let r=JSON.parse(await E.readFile(n,"utf-8")).packageManager;return typeof r!="string"?null:r.startsWith("pnpm")?"pnpm":r.startsWith("yarn")?"yarn":r.startsWith("npm")?"npm":null}catch(a){if(a instanceof Error&&"code"in a&&a.code==="ENOENT")return null;throw a}}async function S(e){return e==="yarn"?{command:"yarn",args:["install"]}:e==="npm"?{command:"npm",args:["install"]}:await D()?{command:"pnpm",args:["install"]}:{command:"npx",args:["pnpm","install"]}}async function p(e){try{return await E.access(e),!0}catch(n){if(n instanceof Error&&"code"in n&&n.code==="ENOENT")return!1;throw n}}export{o as a,b,R as c,G as d,W as e,Y as f};

package/dist/chunk-OI2MBGBG.js

@@ -1,4 +0,0 @@
-import{c as e}from"./chunk-U4LIQ5VR.js";import n from"node:fs/promises";import p from"node:path";import o from"chalk";var i=["everyapp.config.ts"];async function l(){let t=process.cwd();for(let c of i){let r=p.join(t,c);try{await n.access(r);return}catch{}}console.log(o.yellow(`
-Not inside an Every App project`)),console.log(o.dim(`  No everyapp.config.ts found
-`)),console.log("To create a new app, run the below command from the directory where you store your projects:"),console.log(o.dim(`  npx everyapp app create
-`)),await e(1)}export{l as a};

package/dist/chunk-POSDLD3G.js

@@ -1,8 +0,0 @@
-import{a as t,b as a,c as r}from"./chunk-RB5D2R45.js";import l from"node:fs";import d from"node:os";import u from"node:path";function O(e){return{process:e,os:d,fs:l,path:u}}import{buildApplication as D,buildCommand as p,buildRouteMap as R}from"@stricli/core";import{buildInstallCommand as S,buildUninstallCommand as x}from"@stricli/auto-complete";import{buildCommand as o,buildRouteMap as m}from"@stricli/core";var c=o({loader:async()=>import("./create-DYQ3NBWJ.js"),parameters:{positional:{kind:"tuple",parameters:[{brief:"App ID (kebab-case format)",parse:String,optional:!0}]},flags:{verbose:{kind:"boolean",brief:"Show detailed output during creation",optional:!0},yes:{kind:"boolean",brief:"Skip deployment confirmation",optional:!0}},aliases:{y:"yes"}},docs:{brief:"Create a new app from the starter template",fullDescription:["Copies the simple-todo starter template, deploys to Cloudflare, and configures local development.","","Usage: every app create [name]","","The command will:","  1. Prompt for app ID (or use provided name)","  2. Deploy a private Cloudflare Worker from everyapp.config.ts","  3. Configure package.json and local .env files","  4. Install dependencies and run local migrations for the starter app","","After creation, run 'pnpm run dev' to start developing."].join(`
-`)}}),f=o({loader:async()=>{let{deploy:e}=await import("./deploy-PYTCMDGV.js");return e},parameters:{positional:{kind:"tuple",parameters:[]},flags:{verbose:{kind:"boolean",brief:"Show detailed output during deployment",optional:!0},yes:{kind:"boolean",brief:"Skip deployment confirmation",optional:!0},"skip-dns-check":{kind:"boolean",brief:"Skip app subdomain DNS preflight check",optional:!0},domain:{kind:"parsed",parse:String,brief:"Not for this command; configure the gateway domain instead",optional:!0,hidden:!0}},aliases:{y:"yes"}},docs:{brief:"Deploy an app to Cloudflare",fullDescription:["Deploys the current app as a private Cloudflare Worker from everyapp.config.ts.","The deployment process:","  1. Loads and validates everyapp.config.ts","  2. Verifies the app subdomain can resolve through Cloudflare DNS","  3. Ensures the Cloudflare Workers account is initialized","  4. Creates or links declared D1 databases and KV namespaces","  5. Generates .everyapp/wrangler.json","  6. Installs dependencies using the manifest install setting or package-manager auto-detection","  7. Runs the configured database migration strategy against production D1","  8. Runs the configured build, deploys, registers with the gateway, and ensures the service binding"].join(`
-`)}}),g=o({loader:async()=>{let{generateConfig:e}=await import("./generateConfig-46Z3ERF3.js");return e},parameters:{positional:{kind:"tuple",parameters:[]},flags:{verbose:{kind:"boolean",brief:"Show generated config details",optional:!0}}},docs:{brief:"Generate .everyapp/wrangler.json from everyapp.config.ts",fullDescription:["Loads everyapp.config.ts, validates it, and writes the generated Wrangler config consumed by Vite and Wrangler.","","Run this before invoking vite directly."].join(`
-`)}}),y=o({loader:async()=>{let{setupLocal:e}=await import("./setupLocal-TZJUW5ES.js");return e},parameters:{positional:{kind:"tuple",parameters:[]},flags:{verbose:{kind:"boolean",brief:"Show detailed output during local setup",optional:!0}}},docs:{brief:"Set up local development in an existing app",fullDescription:["Configures local development for an existing Every App project in the current directory.","","Usage: every app setup-local","","The command will:","  1. Verify the current directory is an Every App project","  2. Verify Cloudflare and gateway setup","  3. Install dependencies using package-manager auto-detection","  4. Create or refresh .env.local","  5. Run local setup scripts for template-style apps","","This is useful after cloning an existing Every App repository."].join(`
-`)}}),h=o({loader:async()=>{let{remoteD1Shell:e}=await import("./remoteD1Shell-A67JMO3H.js");return e},parameters:{flags:{},positional:{kind:"array",parameter:{brief:"Command and arguments to run with environment variables",parse:String}}},docs:{brief:"Run a command with Cloudflare D1 connection environment variables",fullDescription:["Sets environment variables needed to connect to remote Cloudflare D1 and runs any command that requires D1 access.","","The command will:","  1. Get the Cloudflare account ID","  2. Look up the database ID from the generated Wrangler database name","  3. Get a valid OAuth token","  4. Run the provided command with CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_DATABASE_ID, CLOUDFLARE_API_TOKEN, and MIGRATE_REMOTE set","","Common use cases:","  - Running Drizzle migrations: npx everyapp app remote-d1-shell -- npx drizzle-kit migrate","  - Opening Drizzle Studio: npx everyapp app remote-d1-shell -- npx drizzle-kit studio","  - Pushing schema changes: npx everyapp app remote-d1-shell -- npx drizzle-kit push","","This command is useful for any operation that needs direct access to your production D1 database."].join(`
-`)}}),n=m({routes:{create:c,deploy:f,"generate-config":g,"setup-local":y,"remote-d1-shell":h},docs:{brief:"App management commands"}});import{buildCommand as b,buildRouteMap as v}from"@stricli/core";var w=b({loader:async()=>{let{deploy:e}=await import("./deploy-RMAHOA4Z.js");return e},parameters:{positional:{kind:"tuple",parameters:[]},flags:{verbose:{kind:"boolean",brief:"Show detailed output during deployment",optional:!0},localGateway:{kind:"parsed",parse:String,brief:"Path to local gateway tarball (for testing)",optional:!0},domain:{kind:"parsed",parse:String,brief:"Custom apex domain for the gateway and app subdomains",optional:!0},yes:{kind:"boolean",brief:"Skip deployment confirmation",optional:!0}},aliases:{y:"yes"}},docs:{brief:"Deploy the gateway application to Cloudflare",fullDescription:["Downloads the gateway release, links Cloudflare resources, reconstructs app service bindings, and deploys to Cloudflare Workers.","The deployment process:","  1. Downloads the gateway release to a temporary directory","  2. Creates or links gateway D1/KV resources","  3. Reconstructs service bindings from the registry","  4. Optionally configures custom-domain routes with --domain","  5. Runs wrangler deploy","  6. Runs database migrations against production D1","  7. Cleans up temporary files"].join(`
-`)}}),i=v({routes:{deploy:w},docs:{brief:"Gateway management commands"}});import{buildCommand as C}from"@stricli/core";import{numberParser as k}from"@stricli/core";var s=C({loader:async()=>import("./dev-SAE237FS.js"),parameters:{flags:{port:{kind:"parsed",parse:k,brief:"Gateway port (defaults to $PORT, then 8787)",optional:!0},mode:{kind:"parsed",parse:String,brief:"stub (seeded dev user, default) | mirror (real login via local gateway)",optional:!0},gateway:{kind:"parsed",parse:String,brief:"mirror mode: URL of the separately-run local gateway (default http://localhost:3000)",optional:!0},baseHost:{kind:"parsed",parse:String,brief:"mirror mode: two-label base host for cookie scope (default everyapp.localhost)",optional:!0},"skip-migrations":{kind:"boolean",brief:"Start without applying local database migrations",optional:!0}}},docs:{brief:"Run the app behind a local gateway with the real perimeter",fullDescription:["Runs the app's configured dev server on an internal port and a gateway-lite","in front of it on $PORT (default 8787) \u2014 the REAL perimeter: public-route","policy, header strip/inject, a real RS256 identity JWT, and a seeded dev","user. Open http://<app-id>.localhost:8787 \u2014 the first Host label selects","the app, so portless per-worktree hosts work with no configuration.","","--mode stub (default): seeded dev user, zero setup.","--mode mirror: authenticate against a SEPARATELY-running local gateway","  (run `pnpm dev` in apps/every-app-gateway first). Real login/launcher","  are forwarded to it. Requires a two-label base host (e.g.","  everyapp.localhost) so the session cookie crosses the subdomain","  boundary; the CLI prints setup guidance if the host is unusable.","  Also settable via EVERYAPP_DEV_MODE; the flag wins."].join(`
-`)}});var A=p({loader:async()=>{let{login:e}=await import("./login-B6EF3SMX.js");return e},parameters:{positional:{kind:"tuple",parameters:[]},flags:{}},docs:{brief:"Store a gateway deploy token"}}),E=p({loader:async()=>{let{logout:e}=await import("./logout-XMKZBLNV.js");return e},parameters:{positional:{kind:"tuple",parameters:[]},flags:{}},docs:{brief:"Remove a stored gateway deploy token"}}),L=R({routes:{app:n,dev:s,gateway:i,login:A,logout:E,install:S("everyapp",{bash:"__everyapp_bash_complete"}),uninstall:x("everyapp",{bash:!0})},docs:{brief:a,hideRoute:{install:!0,uninstall:!0}}}),Y=D(L,{name:t,versionInfo:{currentVersion:r},scanner:{allowArgumentEscapeSequence:!0}});export{O as a,Y as b};

package/dist/chunk-RB5D2R45.js

@@ -1 +0,0 @@
-var s="everyapp";var t="Every App CLI - Deploy and manage apps.";var i="0.2.2";export{s as a,t as b,i as c};

package/dist/chunk-U4LIQ5VR.js

@@ -1 +0,0 @@
-import{c as n}from"./chunk-RB5D2R45.js";import a from"chalk";var p="https://registry.npmjs.org/everyapp?fields=dist-tags",f=2e3,i=null;function y(){i||(i=d().then(t=>t&&t!==n&&g(n,t)?{updateAvailable:!0,latestVersion:t,currentVersion:n}:{updateAvailable:!1,currentVersion:n}))}var u=!1;async function m(){if(u||!i)return;u=!0;let t=await i;h(t)}async function V(t){await m(),process.exit(t)}async function d(){try{let t=new AbortController,o=setTimeout(()=>t.abort(),f),e=await fetch(p,{signal:t.signal});return clearTimeout(o),e.ok?(await e.json())["dist-tags"].latest:null}catch{return null}}function g(t,o){let e=t.split(".").map(Number),s=o.split(".").map(Number);for(let r=0;r<Math.max(e.length,s.length);r++){let l=e[r]??0,c=s[r]??0;if(l<c)return!0;if(l>c)return!1}return!1}function h(t){t.updateAvailable&&t.latestVersion&&(console.log(),console.log(a.yellow(`  Update available: ${t.currentVersion} \u2192 ${t.latestVersion}`)),console.log(a.dim(`  Run latest: ${a.cyan("npx -y everyapp@latest")}`)))}export{y as a,m as b,V as c};

package/dist/chunk-VEYSNPDH.js

@@ -1,3 +0,0 @@
-import r from"node:fs/promises";import d from"node:os";import l from"node:path";var n=class extends Error{gatewayUrl;constructor(e){super(y(e)),this.name="GatewayCredentialMissingError",this.gatewayUrl=e}};function i(t){let e=new URL(t);return e.pathname=e.pathname.replace(/\/+$/,""),e.search="",e.hash="",e.toString().replace(/\/+$/,"")}function o(t){return new URL(i(t)).host.toLowerCase()}function c(){return l.join(d.homedir(),".everyapp","credentials.json")}function y(t){let e=i(t);return[`No deploy token is configured for ${e}.`,`Open ${e}/admin/tokens, create a Deploy Token, then run:`,"  everyapp login"].join(`
-`)}async function s(){let t=c();try{let e=await r.readFile(t,"utf-8"),a=JSON.parse(e);return{gateways:a.gateways&&typeof a.gateways=="object"?a.gateways:{}}}catch(e){if(e.code==="ENOENT")return{gateways:{}};throw e}}async function w(t){let e=c();await r.mkdir(l.dirname(e),{recursive:!0}),await r.writeFile(e,`${JSON.stringify(t,null,2)}
-`,{encoding:"utf-8",mode:384}),await r.chmod(e,384)}async function g(t){return(await s()).gateways[o(t)]??null}async function m(t){let e=await g(t);if(!e?.token)throw new n(t);return e.token}async function h(t){let e=i(t.gatewayUrl),a=await s();a.gateways[o(e)]={...t,gatewayUrl:e},await w(a)}async function C(t){let e=await s(),a=o(t);return e.gateways[a]?(delete e.gateways[a],await w(e),!0):!1}export{i as a,y as b,m as c,h as d,C as e};

package/dist/chunk-VP6SKW44.js

@@ -1,7 +0,0 @@
-import{f as r}from"./chunk-O2KDOP5R.js";import{c as l,f as i}from"./chunk-FD6K2YA7.js";import c from"chalk";import a from"chalk";async function s({targetDir:n,verbose:o=!1}){try{o||console.log(`
-Setting up Cloudflare for local dev...`),await i("pnpm",["run","cf-typegen"],{cwd:n,verbose:o,logCommandToConsole:!1}),await i("pnpm",["run","build"],{cwd:n,verbose:o,logCommandToConsole:!1}),o||console.log(a.dim(`  Finished.
-`)),await i("pnpm",["run","db:migrate:local"],{cwd:n,verbose:o}),console.log(`
-Local database migrations complete.
-`)}catch{console.warn(a.yellow(`
-Failed to run local migrations. You can run them manually with:`)),console.warn(a.dim(`   pnpm run db:migrate:local
-`))}}async function v({targetDir:n,appId:o,gatewayUrl:e,verbose:t=!1,installDeps:m=!1,migrations:p}){if(m&&await r({cwd:n,description:"Installing dependencies for local development...",verbose:t}),await l({targetDir:n,appId:o,gatewayUrl:e}),p?.engine==="d1-sql"){console.log(c.dim("Skipping local migration scripts for d1-sql app; manage local D1 state with Wrangler migrations."));return}await s({targetDir:n,verbose:t})}export{v as a};

package/dist/chunk-WO3NE7ZU.js

@@ -1,7 +0,0 @@
-import{z as t}from"zod";var b=t.object({path:t.string(),methods:t.array(t.string()).optional()}),v=t.object({d1:t.array(t.string()).optional(),kv:t.array(t.string()).optional(),durableObjects:t.array(t.object({name:t.string(),className:t.string()})).optional()}).passthrough(),A=t.string().regex(/^\d{4}-\d{2}-\d{2}$/,"must be YYYY-MM-DD"),x=t.string().regex(/^[a-z0-9][a-z0-9:_-]{0,63}$/,"invalid scope id"),w=t.record(x,t.string().min(1).max(200)).superRefine((e,r)=>{for(let i of Object.keys(e))(i==="*"||i.startsWith("provider:"))&&r.addIssue({code:t.ZodIssueCode.custom,path:[i],message:"reserved scope id"})}),S=w,I=t.object({engine:t.enum(["drizzle","d1-sql"]),dir:t.string().optional(),binding:t.string().min(1).optional()}).strict().superRefine((e,r)=>{if(e.engine==="d1-sql"&&!e.dir?.trim()){r.addIssue({code:t.ZodIssueCode.custom,path:["dir"],message:'dir is required when migrations.engine is "d1-sql"'});return}e.dir&&!k(e.dir)&&r.addIssue({code:t.ZodIssueCode.custom,path:["dir"],message:"dir must be a relative path without .. segments"})}),R=t.union([t.literal(!1),t.string().min(1)]),M=t.string().regex(/^[a-z][a-z0-9-]*$/,"provider must start with a lowercase letter and contain only lowercase letters, digits, and hyphens"),N=t.array(M).refine(e=>new Set(e).size===e.length,"duplicate provider"),$=t.object({id:t.string().min(1).regex(/^[a-z]([a-z0-9-]*[a-z0-9])?$/,"id must be kebab-case (lowercase, digits, hyphens)"),name:t.string().min(1).optional(),description:t.string().optional(),main:t.string().optional(),compatibilityDate:A.optional(),resources:v.optional(),public:t.array(b).optional(),providers:N.optional(),scopes:w.optional(),build:t.string().min(1).optional(),dev:t.string().min(1).optional(),devPort:t.number().int().positive().optional(),install:R.optional(),migrations:I.optional()}).passthrough(),C=b.strict(),j=v.extend({durableObjects:t.array(t.object({name:t.string(),className:t.string()}).strict()).optional()}).strict(),z=$.extend({resources:j.optional(),public:t.array(C).optional(),scopes:S.optional()}).strict(),l="/__everyapp",a=class extends Error{constructor(r){super(r),this.name="ManifestError"}};function E(e){let r=z.safeParse(e);if(!r.success)throw new a(`Invalid everyapp.config: ${r.error.issues.map(n=>`${n.path.join(".")||"(root)"}: ${n.message}`).join("; ")}`);let i=r.data;for(let n of i.public??[])W(n.path);return i}function f(e){return e.startsWith("every-")?e:`every-${e}`}function W(e){if(!e.startsWith("/"))throw new a(`Public route path must be absolute (start with "/"): ${JSON.stringify(e)}`);if(e==="/*"||e==="/**"||e==="*"||e==="/")throw new a(`Public route "${e}" exposes the entire app. A catch-all public route is not allowed.`);if(e.includes("%"))throw new a(`Public route "${e}" must not contain percent-encoding; declare the decoded path.`);if(e.includes("\\"))throw new a(`Public route "${e}" must not contain backslashes.`);let r=e.split("/");if(r.some(n=>n==="."||n===".."))throw new a(`Public route "${e}" must not contain "." or ".." segments.`);for(let n of r)if(n.startsWith(":")&&!/^:[A-Za-z_][A-Za-z0-9_]*$/.test(n))throw new a(`Public route "${e}" has an invalid named segment "${n}".`);let i="/"+(r[1]??"");if(e===l||e.startsWith(l+"/")||i===l)throw new a(`Public route "${e}" targets the reserved ${l} namespace, which can never be public.`)}function k(e){return!e.trim()||e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e)?!1:!e.split(/[\\/]+/).some(r=>r==="..")}import g from"node:fs/promises";import p from"node:path";import{pathToFileURL as D}from"node:url";import{createJiti as G}from"jiti";var u=".everyapp",O="wrangler.json",T="src/entry.worker.ts",Y="2026-06-01",F=["nodejs_compat"],L="generated from everyapp.config.ts \u2014 do not edit";async function B(e){let r=p.join(e,"everyapp.config.ts");try{await g.access(r)}catch(s){throw s instanceof Error&&"code"in s&&s.code==="ENOENT"?new a("No everyapp.config.ts found in the current directory \u2014 run this command from an app root."):s}let n=await G(D(r).href).import(r,{default:!0});return V(n)}function V(e){return E(e)}function _(e,r){let i=f(e);return!r||r==="DB"||r==="KV"?i:`${i}-${r.toLowerCase()}`}function q(e,r={}){let i=P(e.main??T),n=K(i)?i:p.posix.join("..",i),s={$schema:"../node_modules/wrangler/config-schema.json",name:f(e.id),main:n,compatibility_date:e.compatibilityDate??Y,compatibility_flags:[...F],workers_dev:!1,preview_urls:!1,observability:{enabled:!0}};e.devPort&&(s.dev={port:e.devPort});let c={...r.vars,EVERYAPP_APP_ID:e.id};if(r.identityPublicKeys&&(c.EVERYAPP_IDENTITY_PUBLIC_KEYS=JSON.stringify(r.identityPublicKeys)),s.vars=c,r.gatewayBinding){let o=r.gatewayBinding.organizationId.trim();if(!o)throw new Error("Cannot generate EVERY_APP_GATEWAY binding without an organization id.");s.services=[{binding:"EVERY_APP_GATEWAY",service:"every-app-gateway",entrypoint:"AppGateway",props:{organizationId:o,appId:e.id,workerName:f(e.id)}}]}let y=e.resources?.d1??[];if(y.length>0){let o=P(e.migrations?.dir??"drizzle");s.d1_databases=y.map(d=>({binding:d,database_name:_(e.id,d),database_id:r.d1DatabaseIds?.[d]??_(e.id,d),migrations_dir:p.posix.join("..",o)}))}let h=e.resources?.kv??[];h.length>0&&(s.kv_namespaces=h.map(o=>({binding:o,...r.kvNamespaceIds?.[o]?{id:r.kvNamespaceIds[o]}:{}})));let m=e.resources?.durableObjects??[];return m.length>0&&(s.durable_objects={bindings:m.map(o=>({name:o.name,class_name:o.className}))},s.migrations=[{tag:"v1",new_sqlite_classes:m.map(o=>o.className)}]),s}function K(e){return!e.startsWith(".")&&!e.startsWith("/")&&!e.startsWith("src/")&&!/\.[cm]?[jt]sx?$/.test(e)}async function se(e,r={}){let i=r.manifest??await B(e),n=q(i,r),s=p.join(e,u,O);return await g.mkdir(p.dirname(s),{recursive:!0}),await g.writeFile(s,Z(n),"utf-8"),await J(e),{manifest:i,config:n,configPath:s}}function Z(e){return`// ${L}
-${JSON.stringify(e,null,2)}
-`}async function J(e){let r=p.join(e,".gitignore"),i="";try{i=await g.readFile(r,"utf-8")}catch(c){if(!(c instanceof Error&&"code"in c&&c.code==="ENOENT"))throw c}let n=i.split(/\r?\n/).map(c=>c.trim());if(n.includes(u)||n.includes(`${u}/`))return;let s=i.length>0?i.endsWith(`
-`)?"":`
-`:"";await g.writeFile(r,`${i}${s}# every app generated config
-${u}/
-`,"utf-8")}function P(e){return e.split(p.sep).join(p.posix.sep)}export{l as a,a as b,f as c,B as d,_ as e,se as f};

package/dist/chunk-XTO2VTPY.js

@@ -1,6 +0,0 @@
-import{b as u,d as w,e as y,f as p}from"./chunk-FD6K2YA7.js";import{b}from"./chunk-7YVJFS4A.js";import z from"node:fs/promises";import m from"node:path";import l from"chalk";import h from"chalk";function O(n,i){n&&console.log(h.dim(i))}function v(n,...i){n&&i.forEach(r=>console.log(h.dim(r)))}import{execFileSync as j}from"node:child_process";import P from"node:fs/promises";import{createRequire as k}from"node:module";import c from"node:path";async function d(n,i,r){let t=c.resolve(n),e=M();try{let o=await x(t,i),a=JSON.parse(await P.readFile(o,"utf-8")),s=typeof a.bin=="string"?a.bin:a.bin?.[r];if(!s)throw new Error(`Package does not declare the "${r}" binary.`);return{command:e,argsPrefix:[c.resolve(c.dirname(o),s)]}}catch(o){throw new Error(`Could not resolve the project-local "${r}" binary from project root "${t}". Install the project's declared ${i} dependency and try again. (If the install skipped devDependencies, include them; Yarn Plug'n'Play projects are not supported \u2014 use nodeLinker: node-modules.)`,{cause:o})}}function M(){if(!process.versions.bun)return process.execPath;try{return j("node",["--version"],{stdio:"ignore"}),"node"}catch{throw new Error("Every App CLI must run project binaries under Node.js because Wrangler deploys silently no-op under Bun. Install Node.js and ensure `node` is available on PATH.")}}async function x(n,i){let r=n;for(;;){let e=c.join(r,"node_modules",...i.split("/"),"package.json");try{return await P.realpath(e)}catch{}let o=c.dirname(r);if(o===r)break;r=o}return k(c.join(n,"package.json")).resolve(`${i}/package.json`)}var D=["migrate","--config=drizzle-prod.config.ts"],E="drizzle";function R(n,i){let r=i?.binding??n[0];if(!n.includes(r))throw new Error(`Manifest migrations binding "${r}" is not declared in resources.d1.`);return r}async function Q({cwd:n,workerName:i,d1Bindings:r,d1DatabaseIds:t,migrations:e,verbose:o=!1}){if(r.length===0){o&&console.log(l.dim(`No D1 resources declared; skipping migrations.
-`));return}let a=R(r,e),s=t[a];if(!s)throw new Error(`No provisioned D1 database ID found for binding "${a}".`);if(!e||e.engine==="drizzle"){await L({cwd:n,d1DatabaseId:s,verbose:o});return}if(!e.dir)throw new Error('migrations.dir is required when migrations.engine is "d1-sql".');await A({cwd:n,binding:a,databaseName:C(i,a),databaseId:s,migrationsDir:m.resolve(n,e.dir),verbose:o})}async function L({cwd:n,d1DatabaseId:i,verbose:r=!1}){let{command:t,argsPrefix:e}=await d(n,"drizzle-kit","drizzle-kit");console.log(`
-Running: project-local drizzle-kit ${D.join(" ")}`),console.log(l.dim("  Running database migrations...")),v(r,"  Running any pending migrations against your remote D1 Database..."),await b(t,[...e,...D],{cwd:n,d1DatabaseId:i,verbose:r}),console.log(l.dim(`  Migrations completed.
-`))}async function V({cwd:n,d1Bindings:i,migrations:r,configPath:t,verbose:e=!1}){if(i.length===0)return;let o=R(i,r),a=m.resolve(n,r?.dir??E);if(!await u(a))return;if(console.log(l.dim("  Applying local database migrations...")),r?.engine==="d1-sql"){let{command:g,argsPrefix:f}=await d(n,"wrangler","wrangler");await p(g,[...f,"d1","migrations","apply",o,"--local","--persist-to",m.join(n,".wrangler","state"),"-c",t],{cwd:n,verbose:e,logCommandToConsole:!1}),console.log(l.dim("  Local migrations applied."));return}if(!await I(m.join(n,".wrangler","state","v3","d1"))){let g=await d(n,"wrangler","wrangler");await p(g.command,[...g.argsPrefix,"d1","execute",o,"--local","--persist-to",m.join(n,".wrangler","state"),"-c",t,"--command","SELECT 1;"],{cwd:n,verbose:e,logCommandToConsole:!1})}let s=await d(n,"drizzle-kit","drizzle-kit");await p(s.command,[...s.argsPrefix,"migrate"],{cwd:n,verbose:e,logCommandToConsole:!1}),console.log(l.dim("  Local migrations applied."))}async function A({cwd:n,binding:i,databaseName:r,databaseId:t,migrationsDir:e,verbose:o=!1}){let{command:a,argsPrefix:s}=await d(n,"wrangler","wrangler");console.log(`
-Running: project-local wrangler d1 migrations apply ${i} --remote -c <temp-config>`),console.log(l.dim("  Running database migrations..."));let g=await w("everyapp-d1-migrations-"),f=m.join(g,"wrangler.d1-migrations.json");try{await z.writeFile(f,JSON.stringify({d1_databases:[{binding:i,database_name:r,database_id:t,migrations_dir:e}]},null,2),"utf-8"),await p(a,[...s,"d1","migrations","apply",i,"--remote","-c",f],{cwd:n,verbose:o,logCommandToConsole:!1})}finally{await y({tmpDir:g,verbose:o})}console.log(l.dim(`  Migrations completed.
-`))}function C(n,i){return i==="DB"?n:`${n}-${i.toLowerCase()}`}async function I(n){try{return(await z.readdir(n,{recursive:!0})).some(r=>r.endsWith(".sqlite"))}catch(i){if(i instanceof Error&&"code"in i&&i.code==="ENOENT")return!1;throw i}}export{O as a,v as b,d as c,Q as d,L as e,V as f};

package/dist/chunk-YJ2DKIZS.js

@@ -1 +0,0 @@
-var d=Object.defineProperty;var e=(b,a,c)=>a in b?d(b,a,{enumerable:!0,configurable:!0,writable:!0,value:c}):b[a]=c;var f=(b,a,c)=>(e(b,typeof a!="symbol"?a+"":a,c),c);export{f as a};

package/dist/create-DYQ3NBWJ.js

@@ -1,22 +0,0 @@
-import{a as x}from"./chunk-GAJEQYJH.js";import{a as C}from"./chunk-VP6SKW44.js";import{a as P}from"./chunk-7BOQJFI5.js";import"./chunk-XTO2VTPY.js";import{e as k}from"./chunk-O2KDOP5R.js";import{a as w,b as h,d as v,e as b,f as c}from"./chunk-FD6K2YA7.js";import"./chunk-BIXKPCDH.js";import"./chunk-VEYSNPDH.js";import"./chunk-7YVJFS4A.js";import{a as u}from"./chunk-DLGPLHBH.js";import{c as l}from"./chunk-U4LIQ5VR.js";import"./chunk-RB5D2R45.js";import"./chunk-WO3NE7ZU.js";import"./chunk-YJ2DKIZS.js";import g from"chalk";async function E({url:e,targetDir:o,verbose:t=!1}){try{await c("git",["clone",e,o],{verbose:t,logCommandToConsole:!1})}catch(r){throw new Error(`Failed to clone repository from ${e}: ${r instanceof Error?r.message:"Unknown error"}`)}}async function I({targetDir:e,verbose:o=!1}){try{await c("git",["init"],{verbose:o,logCommandToConsole:!1,cwd:e}),await c("git",["add","."],{verbose:o,logCommandToConsole:!1,cwd:e}),await c("git",["commit","-m","Starter template"],{verbose:o,logCommandToConsole:!1,cwd:e})}catch(t){throw new Error(`Failed to initialize git repository: ${t instanceof Error?t.message:"Unknown error"}`)}}import J from"node:fs/promises";import L from"node:path";import f from"chalk";var _=["everyapp.config.ts"];async function T(){let e=process.cwd();for(let o of _){let t=L.join(e,o);try{await J.access(t),console.log(f.yellow(`
-Already inside an Every App project`)),console.log(f.dim(`  Found ${o}
-`)),console.log(`To create a new app, run app create from the directory where you store your projects.
-`),console.log("If you meant to deploy this app, run:"),console.log(f.dim(`  npx everyapp app deploy
-`)),await l(1)}catch{}}}import D from"chalk";import{execa as q}from"execa";async function $(){try{await q("pnpm",["--version"],{stdio:"pipe"})}catch{console.error(D.red(`
-Error: pnpm is required but not installed. Please install it first:`)),console.error(D.cyan(`  npm i -g pnpm
-`)),await l(1)}}import z from"enquirer";function W(e){return!e||e.trim().length===0?"App ID cannot be empty":e.length>64?"App ID must be 64 characters or less":/^[a-z]([a-z0-9-]*[a-z0-9])?$/.test(e)?!0:"App ID must be in kebab-case format (lowercase letters, numbers, and hyphens only, starting with a letter)"}async function R(e){console.log(`Project Configuration
-`);let o=await z.prompt({type:"input",name:"appId",message:"Enter your app ID (kebab-case format)",initial:e,validate:W});return console.log(),{appId:o.appId}}import A from"node:path";import G from"chalk";var M="https://github.com/every-app/every-app.git",V="templates/simple-todo";async function O({appId:e,verbose:o=!1}){o&&console.log(`Cloning template repository...
-`);let t=await v("every-app-create-");await E({url:M,targetDir:t,verbose:o}),o&&console.log(`Extracting template...
-`);let r=A.join(t,V),n=A.join(process.cwd(),e);if(await h(n))throw new Error(`Directory "${e}" already exists in the current location`);return await w(r,n,{exclude:["node_modules",".git","pnpm-lock.yaml","package-lock.json",".env.local",".env.production",".dev.vars","manual-steps.md"]}),o&&console.log(G.dim(`  Template copied to ${n}
-`)),{tempDir:t,targetDir:n}}import m from"node:fs/promises";import N from"node:path";async function U({targetDir:e,appId:o}){let t=N.join(e,"package.json"),r=JSON.parse(await m.readFile(t,"utf-8"));r.name=o;for(let n of["dependencies","devDependencies"]){let d=r[n];if(d){for(let[s,a]of Object.entries(d))if(!(typeof a!="string"||!a.startsWith("workspace:")))throw new Error(`Template dependency "${s}" uses an unresolvable workspace spec ("${a}"). Pin it to a published version in the template.`)}}await m.writeFile(t,JSON.stringify(r,null,2)+`
-`,"utf-8")}async function F({targetDir:e,appId:o}){let t=N.join(e,"everyapp.config.ts");try{let r=await m.readFile(t,"utf-8"),n=r.replace(/(\bid\s*:\s*)["'][^"']+["']/,`$1"${o}"`);if(n===r)throw new Error("Could not find an id field in everyapp.config.ts");await m.writeFile(t,n,"utf-8")}catch(r){throw r instanceof Error&&"code"in r&&r.code==="ENOENT"?new Error("Starter template does not include everyapp.config.ts, which is required for deployments."):r}}import i from"chalk";function j({appId:e,targetDir:o,gatewayUrl:t,liveUrl:r}){console.log(i.green(`Project created and deployed successfully!
-`)),console.log(i.dim(`  Location: ${o}`)),console.log(i.dim(`  App URL:  ${i.cyan(r)}`)),console.log(i.dim(`  Gateway:  ${i.cyan(t)}`)),console.log(i.dim("  Routed through the gateway service binding.")),console.log(),console.log(`For local development:
-`),console.log(i.dim(`  ${i.bold(`cd ${e}`)}`)),console.log(i.dim(`  ${i.bold("pnpm run dev")}`)),console.log(i.dim(`  ${i.bold(`
-  Then, open the local dev URL printed by everyapp dev.`)}`)),console.log(),console.log(`To deploy updates after changes:
-`),console.log(i.dim(`  ${i.bold("npx everyapp app deploy")}`)),console.log()}async function Re(e,o){let t=e.verbose||!1,r=e.yes||!1;await T(),await $(),await u(),await k(),console.log(`
-Create a new Every App project
-`);let{appId:n}=await R(o);if(console.log(g.dim(`.
-`)),!await P("this app",r)){console.log(g.yellow(`
-App creation cancelled.
-`));return}let s=null;try{let{tempDir:a,targetDir:p}=await O({appId:n,verbose:t});s=a,await U({targetDir:p,appId:n}),await F({targetDir:p,appId:n});let{liveUrl:S,gatewayUrl:y}=await x({cwd:p,verbose:t});await C({targetDir:p,appId:n,verbose:t,gatewayUrl:y}),await I({targetDir:p,verbose:t}),j({appId:n,targetDir:p,gatewayUrl:y,liveUrl:S})}catch(a){throw console.error(g.red(`
-Failed to create project:`),a instanceof Error?a.message:"Unknown error"),a}finally{s&&await b({tmpDir:s})}}export{Re as default};

package/dist/deploy-PYTCMDGV.js

@@ -1,7 +0,0 @@
-import{a as c}from"./chunk-GAJEQYJH.js";import{a as p}from"./chunk-OI2MBGBG.js";import{a as r}from"./chunk-7BOQJFI5.js";import"./chunk-XTO2VTPY.js";import{e as i}from"./chunk-O2KDOP5R.js";import"./chunk-FD6K2YA7.js";import"./chunk-BIXKPCDH.js";import"./chunk-VEYSNPDH.js";import"./chunk-7YVJFS4A.js";import{a}from"./chunk-DLGPLHBH.js";import"./chunk-U4LIQ5VR.js";import"./chunk-RB5D2R45.js";import{d as s}from"./chunk-WO3NE7ZU.js";import"./chunk-YJ2DKIZS.js";import o from"chalk";async function x(e){if(e.domain!==void 0)throw new Error("apps derive their address from the gateway's domain automatically; configure the domain with `everyapp gateway deploy --domain <apex-domain>`.");await a(),await i();let n=process.cwd(),l=e.verbose||!1,m=e.yes||!1,d=e["skip-dns-check"]||!1;await p();let t=await s(n),y=t.id;if(console.log(o.bold(`
-Project: ${y}
-`)),!await r("this app",m)){console.log(o.red(`
-Deployment cancelled by user
-`));return}let{liveUrl:f,gatewayUrl:w}=await c({cwd:n,manifest:t,verbose:l,skipDnsCheck:d});console.log(o.green(`
-Deployment successful!`)),console.log(`  App live at: ${o.cyan(f)}`),console.log(o.dim("  Gateway routes this app through a service binding.")),console.log(`  Gateway: ${o.cyan(w)}
-`)}export{x as deploy};