everyapp 0.2.2 → 0.3.0-rc.2

package/dist/chunk-IUOBIB5M.js

@@ -0,0 +1,30 @@
+import{B as Ie,c as ve,d as O,e as ke,f as Ae,g as K,h as Ee,i as Re,j as P,k as Oe,l as W,m as H,n as Me,o as Te,p as Pe,v as _e}from"./chunk-IFCPALVC.js";import{a as S}from"./chunk-4JRIS6S6.js";import{B as de,W as le,X as pe,Y as me,Z as ue,_ as fe,aa as ge,ca as he,da as we,ea as ye,qa as $e,sa as be,y as ce}from"./chunk-RMF4YGD6.js";import{e as ae,m as se,n as re,p as ie}from"./chunk-NFU4YFXB.js";import{a as V,b as oe}from"./chunk-CCWBPAKH.js";import{Bb as R,b as Q,c as f,da as Z,f as z,ga as ee,ka as te,ma as ne,oc as j,pc as G,qb as I,sa as D,wa as B,wc as k}from"./chunk-LYNBZ7RV.js";import{stripVTControlCharacters as Ge}from"node:util";import w from"chalk";function We(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,n.manifest,n.status,t,n.id]}];let o=e.grants.map(s=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
+VALUES (?, ?, ?, ?, NULL) ON CONFLICT DO NOTHING`,params:[s.id,s.userId,s.appRowId,s.organizationId]}));return e.kind==="new"?[{sql:`INSERT INTO apps (id, organization_id, app_slug, name, description, hostname,
+  worker_name, tier, manifest, status, version_id, deployed_at, deployed_by_actor,
+  is_default, created_at, updated_at, scope)
+VALUES (?1, ?2, ?3, ?4, ?5, NULL, NULL, ?6, ?7, ?8, NULL, ?9, ?10, 0, ?11, ?11, ?12)`,params:[n.id,n.organizationId,n.appSlug,n.name,n.description,n.tier,n.manifest,n.status,n.deployedAt,n.deployedByActor,t,n.scope]},...o]:[{sql:`UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, is_default = 0,
+  deployed_at = ?, deployed_by_actor = ?, updated_at = ?
+WHERE id = ? AND status = '${ae}'`,params:[n.name,n.description,n.manifest,n.status,n.deployedAt,n.deployedByActor,t,n.id]},...ye(n,t,a),...o]}function Se(e,t){return le(async()=>{let a=t.now??Date.now(),n=se(t.id),{organization:o,hasOwner:s}=await ge(e,t.organizationName,a),[c=[],l=[],p=[]]=await e.run([{sql:`SELECT ${await me(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[o.id,n]},...he(o.id,t.deployer.email)]),i=c[0]?fe(c[0]):null,d=ue(p[0]?.id),m=re({organizationId:o.id,id:n,existingApp:i,members:we(l),actorUserId:d,actor:t.deployer.actor,now:a}),r=m.kind==="existing"?i?.status==="active"?"existing":"off":m.kind,u=r==="existing"?[]:await de(e,{organizationId:o.id,type:r==="off"?"mcp_app.enabled":"mcp_app.added",actor:ce(t.deployer),data:{app:{id:m.app.appSlug,rowId:m.app.id,name:m.app.name},kind:"builtin"},appRowId:m.app.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[m.app.id,m.app.status,a]},now:a});await e.run([...We(m,a,{secretNames:await pe(e)}),...u]);let g=d!==null&&(m.grants.some(b=>b.userId===d)||m.kind==="existing"&&await He(e,m.app.id,d));return{plan:m,was:r,organization:o,hasOwner:s,actorGranted:g}})}async function He(e,t,a){let[n=[]]=await e.run([{sql:"SELECT 1 AS granted FROM user_app_access WHERE app_row_id = ? AND user_id = ? LIMIT 1",params:[t,a]}]);return n.length>0}var Y="2026-07-28",Ye="2025-11-25";async function Ne(e,t){let a=t.fetch??fetch,n=AbortSignal.timeout(t.timeoutMs??1e4),o={name:"everyapp-cli",version:t.version};try{let s=await Ce(a,e,n,{headers:{"mcp-protocol-version":Y,"mcp-method":"tools/list"},body:{jsonrpc:"2.0",id:1,method:"tools/list",params:{_meta:{"io.modelcontextprotocol/protocolVersion":Y,"io.modelcontextprotocol/clientInfo":o,"io.modelcontextprotocol/clientCapabilities":{}}}}});if(s.kind==="final")return s.probe;let c=s.message?xe(s.message):null;if(c&&Array.isArray(c.tools)){let i=A(c._meta),d=A(i?.["io.modelcontextprotocol/serverInfo"]);return{outcome:"reachable",era:Y,tools:c.tools.length,server:typeof d?.name=="string"?d.name:null}}let l=await Ce(a,e,n,{headers:{},body:{jsonrpc:"2.0",id:2,method:"initialize",params:{protocolVersion:Ye,capabilities:{},clientInfo:o}}});if(l.kind==="final")return l.probe;let p=l.message?xe(l.message):null;if(p&&typeof p.protocolVersion=="string"){let i=A(p.serverInfo);return{outcome:"reachable",era:p.protocolVersion,tools:null,server:typeof i?.name=="string"?i.name:null}}return{outcome:"unreachable",reason:Ze(s.status,l.status)}}catch(s){return{outcome:"unreachable",reason:tt(s,n)}}}async function Ce(e,t,a,n){let o=await e(t,{method:"POST",redirect:"manual",signal:a,headers:{"content-type":"application/json",accept:"application/json, text/event-stream",...n.headers},body:JSON.stringify(n.body)});if(o.status>=300&&o.status<400)return await o.body?.cancel().catch(()=>{}),{kind:"final",probe:{outcome:"redirected",status:o.status,location:o.headers.get("location")}};if(o.status===401||o.status===403){await o.body?.cancel().catch(()=>{});let i=o.headers.get("www-authenticate")??"";return{kind:"final",probe:{outcome:"needs-credential",status:o.status,oauth:/resource_metadata\s*=/i.test(i)}}}let s=n.body.id,c=await qe(o),p=(o.headers.get("content-type")??"").toLowerCase().includes("text/event-stream")?Qe(c,s):Je(c);return{kind:"message",status:o.status,message:p}}async function qe(e){if(!e.body)return"";let t=e.body.getReader(),a=new TextDecoder,n="",o=0;for(;;){let{done:s,value:c}=await t.read();if(s)break;if(o+=c.byteLength,n+=a.decode(c,{stream:!0}),o>=1048576){await t.cancel().catch(()=>{});break}if(/\n\n/.test(n)&&Xe(n)){await t.cancel().catch(()=>{});break}}return n+a.decode()}function Je(e){try{let t=JSON.parse(e);return Array.isArray(t)?A(t.find(a=>A(a)&&"id"in a)):A(t)}catch{return null}}function De(e){let t=[];for(let a of e.replace(/\r\n?/g,`
+`).split(`
+
+`)){let n=a.split(`
+`).filter(o=>o.startsWith("data:")).map(o=>o.slice(5).replace(/^ /,"")).join(`
+`);if(n)try{let o=A(JSON.parse(n));o&&t.push(o)}catch{}}return t}function Xe(e){return De(e).some(t=>"id"in t&&("result"in t||"error"in t))}function Qe(e,t){let a=De(e);return a.find(n=>n.id===t&&("result"in n||"error"in n))??a.find(n=>"result"in n||"error"in n)??null}function xe(e){return e.jsonrpc==="2.0"?A(e.result):null}function A(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:null}function Ze(e,t){let a=n=>n>=200&&n<300;return a(e)||a(t)?"it answered, but not as an MCP server":e===t?`it answered ${e}`:`it answered ${e} to tools/list and ${t} to initialize`}var et=[[/^(ENOTFOUND|EAI_AGAIN)$/,"its host name doesn't resolve from here"],[/^ECONNREFUSED$/,"it refused the connection"],[/^(ERR_TLS|CERT_|DEPTH_ZERO|SELF_SIGNED|UNABLE_TO_VERIFY)/,"its TLS certificate wasn't accepted"]];function tt(e,t){if(t.aborted)return"it didn't answer within 10 seconds";let a=e?.cause,n=typeof a?.code=="string"?a.code:null;if(!n)return"it couldn't be reached";let o=et.find(([s])=>s.test(n));return o?o[1]:`it couldn't be reached (${n})`}async function zt(e,t){await k(e,a=>rt({flags:e,out:a},t))}async function Bt(e,t){await k(e,a=>dt({flags:e,out:a},t))}async function Vt(e,t){await k(e,a=>it({flags:e,out:a},t))}async function jt(e,t){await k(e,a=>ct({flags:e,out:a},t))}async function Kt(e){await k(e,t=>lt({flags:e,out:t}))}async function Wt(e,t){await k(e,a=>mt({flags:e,out:a},t))}async function Ht(e,t){await k(e,a=>ut({flags:e,out:a},t))}async function Yt(e,t,a){await k(e,n=>ft({flags:e,out:n},t,a))}function E({flags:e,out:t,createCf:a}){return be({gateway:$e(e.gateway),accountId:e["account-id"],interactive:V(e.json??!1),login:{json:e.json,out:t,step:"login"},createCf:a})}var C="provider.update";function M(e,t,a,n=[]){e.emit({type:"done",message:Ge(t.join(`
+`)),display:[t[0],...t.slice(1).map(o=>w.dim(o)),...n].join(`
+`),data:a})}function Le(e,t){return`${e?"You, the owners and the admins can use it":t?"The owners and the admins can use it":"The owner gets it when they claim the Gateway"}; an admin grants others in Admin \u2192 Apps \u2192 Manage access.`}function q(e){return{kind:e.kind,..."secret"in e?{secret:e.secret}:{},...e.kind==="header"?{header:e.header}:{}}}function L(e,t,a,n){if(!e)return null;let o=t.includes(e);if(!a)return{name:e,set:o};let s=n.get(e)?.origin??null;return{name:e,set:o,bound:s!==null&&s===H(a.url),boundOrigin:s}}function nt(e){let t=e.header?.trim(),a=e.secret?.trim(),n=e.auth??(t?"header":a?"bearer":"none");if(t&&n!=="header")throw new R("REMOTE_MCP_INVALID",`--header names the header of --auth header
+With --auth ${n} the Gateway sends ${n==="none"||n==="oauth"?"no credential":"Authorization"}.`,{fix:"drop --header, or use --auth header"});if(n==="header"&&!t)throw new R("REMOTE_MCP_INVALID","--auth header needs --header <name>: the header the server reads the credential from",{fix:"add --header X-Api-Key (the name the server's docs give)"});if((a||e["from-env"])&&(n==="none"||n==="oauth")){let o=a?"--secret":"--from-env";throw new R("REMOTE_MCP_INVALID",`${o} names a credential, and --auth ${n} sends none`,{fix:`drop ${o}, or use --auth bearer, header or basic`})}return{kind:n,...a?{secret:a}:{},...t?{header:t}:{}}}function ot(e,t){switch(t.outcome){case"reachable":{let a=[t.era,...t.tools!==null?[z(t.tools,"tool")]:[],...t.server?[`server ${t.server}`]:[]];return`${e} answers MCP (${a.join(", ")})`}case"needs-credential":return`${e} asks for a credential (${t.status}${t.oauth?", OAuth":""})`;case"redirected":return`${e} redirects (${t.status}${t.location?` to ${t.location}`:""})`;case"unreachable":return`${e} didn't answer from here: ${t.reason}`}}function at(e,t,a,n,o){let s=`${f} mcp remove ${t}, then ${f} mcp add ${a} --name ${t} --auth bearer`,c={probe:o};if(o.outcome==="needs-credential"&&o.oauth){let l=D(n);e.emit({type:"warning",code:"REMOTE_MCP_WANTS_OAUTH",step:"mcp.probe",message:l?`${a} asks for OAuth
+The Gateway doesn't sign in to MCP servers with OAuth yet; it sends ${l} as you set it, which works only if the server also takes an API key.`:`${a} wants OAuth
+The Gateway doesn't sign in to MCP servers with OAuth yet. If the server also takes an API key, add it with --auth bearer and set the key.`,data:l?c:{...c,fix:s}});return}if(o.outcome==="needs-credential"&&n.kind==="none"){e.emit({type:"warning",code:"REMOTE_MCP_PROBE_FAILED",step:"mcp.probe",message:`${a} asks for a credential, and ${t} sends none
+The Gateway's listing of its tools will fail the same way until it has one.`,data:{...c,fix:s}});return}if(o.outcome==="redirected"){e.emit({type:"warning",code:"REMOTE_MCP_PROBE_FAILED",step:"mcp.probe",message:`${a} redirects${o.location?` to ${o.location}`:""}
+The Gateway follows no redirects; register the address it redirects to.`,data:{...c,fix:`${f} mcp remove ${t}, then ${f} mcp add <the address it redirects to> --name ${t}`}});return}o.outcome==="unreachable"&&e.emit({type:"warning",code:"REMOTE_MCP_PROBE_FAILED",step:"mcp.probe",message:`Couldn't reach ${a} from here: ${o.reason}
+The Gateway may still reach it; ${f} mcp show ${t} says whether its tools listed.`,data:c})}async function st(e,t,a){(await ve(t.db)).tools||e.emit({type:"warning",code:"REMOTE_MCP_GATEWAY_OUTDATED",step:a,message:`This Gateway predates MCP apps by URL
+It serves a remote MCP server's tools once it is updated to this checkout.`,data:{rerun:`${f} update`}})}async function rt(e,t){let{out:a,flags:n}=e,o=nt(n),s=e.readValue??(v=>_e(v,{fromEnv:n["from-env"],json:n.json})),c=n["from-env"]?await s(n.secret?.trim()||te(n.name?.trim()||ne(t.trim())||"remote")):null,l=await E(e);a.emit({type:"step",step:"mcp.add",status:"start",message:`Adding ${t}...`});let p=await Ae(l.db,{url:t,id:n.name,description:n.description,auth:o,risk:n.risk,env:{gatewayUrl:l.gatewayUrl,appBaseDomain:l.install.appBaseDomain},deployer:l.deployer,organizationName:l.accountName??"My Organization",now:e.now?.()}),{plan:i,organization:d}=p,{app:m,remote:r}=i,u=m.appSlug;a.emit({type:"step",step:"mcp.add",status:"ok",message:`${m.name} is on for ${d.name}`,data:{id:u,was:i.kind}}),await st(a,l,"mcp.add"),a.emit({type:"step",step:"mcp.probe",status:"start",message:`Looking at ${r.url}...`});let g=await Ne(r.url,{version:Q,fetch:e.fetch});a.emit({type:"step",step:"mcp.probe",status:"ok",message:ot(r.url,g),data:{probe:g}}),at(a,u,r.url,r.auth,g);let b=H(r.url),y=D(r.auth),h=null;if(y){let v=(await S(l.cf,I)).includes(y),N=c,Ke=e.interactive??V(n.json??!1);N===null&&!v&&Ke&&await(e.confirm??oe)(`Set ${y} now?`,[`${m.name}'s credential (${B(r.auth)}${r.auth.kind==="basic"?", entered as user:password":""}) is a Gateway setting.`,`The Gateway sends it to ${b} and nowhere else. Later: ${f} secret set ${y}`])&&(N=await s(y)),N!==null&&(await Ie(l,{[y]:N},{flags:n,out:a}),v=!0);let U=await P(l.db);v&&!U.has(y)&&(await Pe(l.db,[y],l.deployer.actor,e.now?.()),U=await P(l.db)),h=L(y,v?[y]:[],r,U),v?h?.boundOrigin&&!h.bound&&a.emit({type:"warning",code:"REMOTE_MCP_SECRET_BOUND_ELSEWHERE",step:"mcp.add",message:`${y} was set for ${h.boundOrigin}, not ${b}
+The Gateway sends a credential only to the origin it was set for; set it again for ${m.name}.`,data:{fix:`${f} secret set ${y}`,name:y,boundOrigin:h.boundOrigin}}):a.emit({type:"warning",code:"PROVIDER_KEY_UNSET",step:"mcp.add",message:`${y} isn't set on the Gateway
+${m.name}'s tools stay out of /mcp until it is.`,data:{fix:`${f} secret set ${y}`,name:y}})}let T={url:`${l.gatewayUrl}/mcp`,toolPrefix:`${u}_`},x=r.auth.kind==="oauth"?"It serves no tools yet: the Gateway doesn't sign in to MCP servers with OAuth this week.":h?h.set?h.bound?`${h.name} is set on the Gateway and pinned to ${b}.`:`${h.name} is set, but for ${h.boundOrigin}: ${f} secret set ${h.name}`:`${h.name} isn't set: ${f} secret set ${h.name}`:"It takes no credential.",$=[`${m.name} is on for ${d.name}${i.kind==="revived"?" (added again, from scratch)":""}.`,Le(p.actorGranted,p.hasOwner),`Its tools are on ${T.url} as ${T.toolPrefix}<tool>; the Gateway lists them on first use.`,x],je=[...h&&(!h.set||!h.bound)?[{command:`${f} secret set ${h.name}`,note:`${m.name}'s credential`}]:[],{command:`${f} mcp show ${u}`,note:"its tools, once the Gateway lists them"}];M(a,$,{id:u,name:m.name,url:r.url,auth:q(r.auth),risk:r.risk,on:!0,was:i.kind,organization:{id:d.id,name:d.name},probe:g,key:h,mcp:T,granted:i.grants.map(v=>v.userId),next:je})}function F(e){if(!e.app||e.app.status==="deleted")throw ke(e);return e.app}function _(e){return e.kind==="builtin"?Z[e.id].name:e.app?.name??e.id}function J(e){if(e.kind==="builtin")return{name:ee(e.id),remote:null};let t=e.app?ie(e.app):null;return{name:t?D(t.auth):null,remote:t}}async function X(e,t){let{name:a,remote:n}=J(t);if(!a)return null;let[o,s]=await Promise.all([S(e.cf,I),n?P(e.db):Promise.resolve(new Map)]);return L(a,o,n,s)}async function it(e,t){let{out:a}=e,n=await E(e),o=await O(n.db,t);a.emit({type:"step",step:C,status:"start",message:`Turning ${t} on...`});let s,c,l=null,p=[];if(o.kind==="builtin"){let u=await Se(n.db,{id:t,deployer:n.deployer,organizationName:n.accountName??"My Organization",now:e.now?.()});s=u.was,c=u.organization,p=u.plan.grants.map(g=>g.userId),(s==="new"||s==="revived")&&(l=Le(u.actorGranted,u.hasOwner))}else{let u=F(o),{changed:g}=await K(n.db,u,"active",n.deployer,e.now?.());s=g?"off":"existing",c=o.organization}let i=_(o);a.emit({type:"step",step:C,status:"ok",message:s==="existing"?`${i} was on already`:`${i} is on for ${c.name}`,data:{id:t,was:s}});let d=await X(n,o),m={url:`${n.gatewayUrl}/mcp`,toolPrefix:`${t}_`};d&&!d.set&&a.emit({type:"warning",code:"PROVIDER_KEY_UNSET",step:C,message:`${d.name} isn't set on the Gateway
+${i}'s tools ${o.kind==="builtin"?'answer "not set up"':"stay out of /mcp"} until it is.`,data:{fix:`${f} secret set ${d.name}`,name:d.name}});let r=[`${i} is on for ${c.name}${s==="existing"?" (it was already)":s==="off"?" (it was off; everyone's access was kept)":""}.`,...l?[l]:[],`Its tools are on ${m.url} as ${m.toolPrefix}<tool>.`,...d?[d.set?`${d.name} is set on the Gateway.`:`${d.name} isn't set: ${f} secret set ${d.name}`]:[]];M(a,r,{id:t,name:i,kind:o.kind,on:!0,was:s,organization:{id:c.id,name:c.name},key:d,mcp:m,granted:p,...d&&!d.set?{next:[{command:`${f} secret set ${d.name}`,note:o.kind==="builtin"?"the provider's key":`${i}'s credential`}]}:{}})}async function ct(e,t){let{out:a}=e,n=await E(e),o=await O(n.db,t);a.emit({type:"step",step:C,status:"start",message:`Turning ${t} off...`});let s=_(o),c=o.app&&o.app.status!=="deleted"?o.app:null,l=c?(await K(n.db,c,"disabled",n.deployer,e.now?.())).changed:!1,p=o.organization?` for ${o.organization.name}`:"",i=l?`${s} is off${p}`:c?`${s} was off already${p}`:o.kind==="remote"?`${s} was removed${p}`:`${s} isn't on${p}`;a.emit({type:"step",step:C,status:"ok",message:i,data:{id:t}});let d=await X(n,o),m=[`${i}.`,l?`Its tools leave /mcp within 30 seconds. Everyone's access, its tokens and its tools snapshot are kept: ${f} mcp on ${t} serves it again at once.`:"Nothing changed.",...c?[`${f} mcp remove ${t} removes it for good.`]:[]];M(a,m,{id:t,name:s,kind:o.kind,on:!1,wasOn:l,key:d})}async function dt(e,t){let{out:a}=e,n=await E(e),o=await O(n.db,t);a.emit({type:"step",step:"mcp.remove",status:"start",message:`Removing ${t}...`});let s=_(o),{removed:c}=await Ee(n.db,o.app,n.deployer,e.now?.()),l=o.organization?` from ${o.organization.name}`:"",p=c?`${s} is removed${l}`:o.app?`${s} was removed already${l}`:`${s} isn't added${l}`;a.emit({type:"step",step:"mcp.remove",status:"ok",message:p,data:{id:t,removed:c}});let i=await X(n,o),d=J(o).remote,m=[`${p}.`,c?"Its tools left /mcp, and everyone's access to it, its tokens, its tools snapshot and its place in AI connections went with it.":"Nothing changed.",...i&&i.set?[i.boundOrigin?`${i.name} stays on the Gateway, pinned to ${i.boundOrigin}: ${f} secret unset ${i.name} removes both.`:`${i.name} stays on the Gateway${o.kind==="builtin"?" (an app may use it too)":""}: ${f} secret unset ${i.name} removes it.`]:[],...o.kind==="builtin"?[`${f} mcp on ${t} adds it again, from scratch.`]:d?[`${f} mcp add ${d.url} --name ${t} adds it again, from scratch.`]:[]];M(a,m,{id:t,name:s,kind:o.kind,removed:c,key:i})}function Fe(e){if(!e)return"not listed yet";let t=e.listedAt?` ${Ue(e.listedAt)}`:"";return e.status==="error"?`listing failed${t}${e.lastError?`: ${e.lastError}`:""}`:`${z(e.toolCount,"tool")}, listed${t}`}function Ue(e){return`${new Date(e).toISOString().slice(0,16).replace("T"," ")} UTC`}function ze(e){return e?{status:e.status,tools:e.status==="error"?null:e.toolCount,listedAt:e.listedAt===null?null:new Date(e.listedAt).toISOString(),lastError:e.lastError}:null}function Be(e,t){return e?.kind==="oauth"?w.yellow("OAuth: not supported yet"):t?t.set?t.boundOrigin&&!t.bound?`${t.name} ${w.yellow(`set for ${t.boundOrigin}`)}`:`${t.name} ${w.green("set")}`:`${t.name} ${w.yellow("not set")}`:w.dim("none")}function Ve(e){switch(e){case"on":return w.green("on");case"needs setup":return w.yellow("needs setup");default:return w.dim(e)}}async function lt(e){let{out:t}=e,a=await E(e),[n,o,s]=await Promise.all([Oe(a.db),S(a.cf,I),P(a.db)]),c=n.map(r=>{let u=W(r,o,s),g=L(r.keyName,o,r.remote,s),b=r.snapshot&&r.snapshot.status!=="error"?r.snapshot.toolCount:null;return{entry:r,state:u,key:g,tools:b}}),l=G(["APP","KIND","STATUS","TOOLS","KEY"],c.map(({entry:r,state:u,key:g})=>[`${r.id}  ${w.dim(r.name)}`,r.kind==="builtin"?"built-in":"remote",Ve(u),r.snapshot?r.snapshot.status==="error"?w.yellow("listing failed"):String(r.snapshot.toolCount):w.dim("not listed yet"),Be(r.remote?.auth??null,g)])),p=c.flatMap(({entry:r,state:u,key:g})=>[...u==="not added"?[{command:`${f} mcp on ${r.id}`,note:`offer ${r.name}`}]:[],...g&&r.app&&(!g.set||g.boundOrigin&&!g.bound)?[{command:`${f} secret set ${g.name}`,note:`${r.name}'s ${r.kind==="builtin"?"key":"credential"}`}]:[]]),d=`${c.filter(r=>r.entry.app?.status==="active").length} of ${c.length} MCP ${c.length===1?"app":"apps"} on`,m=c.some(r=>r.entry.kind==="remote");t.emit({type:"done",message:d,display:[...l,"",w.dim(`Tools are on ${a.gatewayUrl}/mcp as <id>_<tool>.`),...m?[]:[w.dim(`Add any MCP server by its URL: ${f} mcp add <url>`)]].join(`
+`),data:{apps:c.map(({entry:r,state:u,key:g,tools:b})=>({id:r.id,name:r.name,kind:r.kind,status:u,on:r.app?.status==="active",...r.remote?{url:r.remote.url,auth:q(r.remote.auth),supported:r.remote.auth.kind!=="oauth"}:{},tools:b,key:g,...r.snapshot?.listedAt?{lastListedAt:new Date(r.snapshot.listedAt).toISOString()}:{},...r.snapshot?.lastError?{lastError:r.snapshot.lastError}:{}})),mcp:`${a.gatewayUrl}/mcp`,...p.length>0?{next:p}:{}}})}function pt(e){switch(e){case"annotations":return"annotations (the server's hints; a tool without one is write)";case"read":return"read (every tool)";case"write":return"write (every tool)"}}async function mt(e,t){let{out:a}=e,n=await E(e),o=await O(n.db,t);o.kind==="remote"&&F(o);let s=_(o),[c,l]=await Promise.all([S(n.cf,I),P(n.db)]),{name:p,remote:i}=J(o),d=o.app&&o.app.status!=="deleted"?o.app:null,m=W({kind:o.kind,app:d,remote:i,keyName:p},c,l),r=L(p,c,i,l),u=d?await Me(n.db,{...o,app:d},i):null,g={url:`${n.gatewayUrl}/mcp`,toolPrefix:`${t}_`},b=d?.deployedAt?`${d.deployedByActor?`by ${d.deployedByActor}, `:""}${Ue(d.deployedAt)}`:null,y=[{label:"Kind",value:o.kind==="builtin"?"built-in (the Gateway's own)":"remote"},{label:"Status",value:Ve(m)},...i?[{label:"URL",value:i.url},{label:"Auth",value:B(i.auth)},{label:"Risk",value:pt(i.risk)},{label:"Revision",value:String(i.rev)}]:[],...b?[{label:"Added",value:b}]:[],...r||i?.auth.kind==="oauth"?[{label:o.kind==="builtin"?"Key":"Credential",value:Be(i?.auth??null,r)+(r?.bound?w.dim(`, pinned to ${r.boundOrigin}`):"")}]:[],...d?[{label:"Tools",value:Fe(u.snapshot)}]:[]],h=u?i?G(["NAME","SERVER NAME","RISK","ON"],u.remoteTools.map($=>[$.name??w.dim("(none)"),$.serverName,`${$.risk} ${w.dim($.source)}`,$.on?w.green("on"):w.yellow($.problem??"off")])):G(["NAME","RISK"],u.catalogTools.map($=>[$.name,$.risk])):[],T=u?i?u.remoteTools.length>0:u.catalogTools.length>0:!1,x=[`${s} (${t})`];a.emit({type:"done",message:Ge([x[0],...j(y)].join(`
+`)),display:[w.bold(x[0]),...j(y),...T?["",...h]:[],...d&&!T?["",w.dim(`No tools listed yet: the Gateway lists them on the next request to ${g.url}.`)]:[]].join(`
+`),data:{id:t,name:s,kind:o.kind,status:m,on:d?.status==="active",...i?{url:i.url,auth:q(i.auth),supported:i.auth.kind!=="oauth",risk:i.risk,rev:i.rev,overrides:i.tools}:{},addedBy:d?.deployedByActor??null,addedAt:d?.deployedAt?new Date(d.deployedAt).toISOString():null,key:r,snapshot:ze(u?.snapshot??null),tools:u?i?u.remoteTools:u.catalogTools.map($=>({...$,source:"registry",on:!0})):[],mcp:g,...r&&d&&(!r.set||r.boundOrigin&&!r.bound)?{next:[{command:`${f} secret set ${r.name}`,note:`${s}'s ${o.kind==="builtin"?"key":"credential"}`}]}:m==="not added"?{next:[{command:`${f} mcp on ${t}`,note:`offer ${s}`}]}:{}}})}async function ut(e,t){let{out:a}=e,n=await E(e),o=await O(n.db,t);o.kind==="remote"&&F(o);let s=_(o),c=o.app&&o.app.status!=="deleted"?o.app:null;if(!c){let i=`${s} isn't on, so it has no tools to list again`;M(a,[`${i}.`,"Nothing changed."],{id:t,name:s,kind:o.kind,refreshed:!1},[]);return}a.emit({type:"step",step:"mcp.refresh",status:"start",message:`Dropping ${s}'s tools snapshot...`});let l=await Re(n.db,c);a.emit({type:"step",step:"mcp.refresh",status:"ok",message:`Dropped ${s}'s tools snapshot`,data:{id:t}});let p=[l?`Dropped ${s}'s tools snapshot (${Fe(l)}).`:`${s} had no tools snapshot to drop.`,c.status==="active"?`The Gateway lists its tools again on the next request to ${n.gatewayUrl}/mcp, or within the hour.`:`It's off: the Gateway lists its tools again once it's on (${f} mcp on ${t}).`];M(a,p,{id:t,name:s,kind:o.kind,refreshed:!0,dropped:ze(l)})}async function ft(e,t,a){let{out:n,flags:o}=e;if(o.on&&o.off)throw new R("MCP_TOOL_CHANGE_INVALID","--on and --off say opposite things; give one",{fix:"drop one of them"});if(!o.risk&&!o.on&&!o.off)throw new R("MCP_TOOL_CHANGE_INVALID",`Nothing to change about ${a}
+Give --risk read|write|destructive|annotations, --on or --off.`,{rerun:`${f} mcp show ${t}`,rerunNote:"lists its tools with their risks"});let s=await E(e),c=await O(s.db,t);if(c.kind==="builtin")throw new R("MCP_APP_BUILTIN",`${_(c)} is the Gateway's built-in MCP app
+Its tools and their risks are the Gateway's own, and can't be changed here. ${f} mcp off ${t} stops serving it.`);let l=F(c);n.emit({type:"step",step:"mcp.tool",status:"start",message:`Changing ${a} on ${t}...`});let p=await Te(s.db,{...c,app:l},a,{...o.risk?{risk:o.risk}:{},...o.on?{enabled:!0}:o.off?{enabled:!1}:{}},e.now?.());n.emit({type:"step",step:"mcp.tool",status:"ok",message:`Changed ${p.serverName} on ${t}`,data:{id:t}}),p.inListing||n.emit({type:"warning",code:"REMOTE_MCP_TOOL_NOT_LISTED",step:"mcp.tool",message:`${a} isn't in ${t}'s last tool listing
+The override is kept under the server's name ${p.serverName} and applies once the server lists a tool by that name.`,data:{rerun:`${f} mcp show ${t}`,rerunNote:"lists its tools by both names"}});let i=p.after??{},d=i.risk?`risk ${i.risk} (your override)`:"risk from the app's default and the server's hints",m=i.enabled===!1?"left out of the catalog":"listed",r=[`${p.serverName}${p.listedName?` (${p.listedName})`:""} on ${t}: ${d}, ${m}.`,`The Gateway lists ${t}'s tools again on first use (revision ${p.rev}).`];M(n,r,{id:t,tool:{serverName:p.serverName,name:p.listedName,inListing:p.inListing},before:p.before,override:p.after,rev:p.rev})}export{zt as a,Bt as b,Vt as c,jt as d,Kt as e,Wt as f,Ht as g,Yt as h,rt as i,it as j,ct as k,dt as l,lt as m,mt as n,ut as o,ft as p};

package/dist/chunk-J35DDCNU.js

@@ -0,0 +1 @@
+import{Xb as e}from"./chunk-LYNBZ7RV.js";import t from"node:path";var n=".cloudflare/types/index.d.ts";async function p(r,o){await r.run({args:["workers","types"],plane:"project",cwd:o,mode:"text"})}async function a(r){return e(t.join(r,n))}export{p as a,a as b};

package/dist/chunk-J455FAEN.js

@@ -0,0 +1,7 @@
+import{a as I,c as N,d as T,e as C}from"./chunk-2Y5Q6A5K.js";import{a as W}from"./chunk-H6QQMY7B.js";import{ba as _,fa as k,k as A}from"./chunk-RMF4YGD6.js";import{e as P}from"./chunk-NFU4YFXB.js";import{Ab as b,Bb as f,b as R,c as $,lc as D}from"./chunk-LYNBZ7RV.js";var g="app.live",M=6e5,F=3e3,B=15e3;var V={["deploy"]:"uploaded and bound"};async function G({db:i,appRowId:a,appId:t,hostname:e,out:r,verb:l,fetch:c,localDns:m=c?void 0:T,sleep:v=o=>new Promise(n=>setTimeout(n,o)),maxWaitMs:y=M,intervalMs:d=F,now:u=Date.now}){let o=`https://${e}/`,n=u(),p=!1,s=null,E,h=async()=>(p&&m&&await C({host:e,lead:`${t} is live at https://${e}`,out:r,step:g,localDns:m}),{outcome:"live",waited:E});for(;;){let S=await x(i,a,t);if(S==="active")return h();if(S==="disabled")return r.emit({type:"warning",code:"APP_DISABLED",step:g,message:`${t} is switched off in Admin \u2192 Apps
+It's ${V[l]}; the Gateway serves it once an admin turns it on.`}),{outcome:"disabled"};let L=await N(o,c);if(L.answered){if(p=!0,L.access)return r.emit({type:"warning",code:"ACCESS_IN_FRONT",step:g,message:`Cloudflare Access answers before the Gateway, so this run can't confirm ${t} is live
+It goes live on its first visit, once someone signs in through Access.`,data:{hostname:e}}),{outcome:"first_visit"};if(await x(i,a,t)==="active")return h()}let w=u()-n;if(w>=y){if(!p)return r.emit({type:"warning",code:"CERT_PENDING",step:g,message:`No certificate for ${e} after ${D(w)}
+It usually comes within 5 minutes; ${t} goes live on its first visit once it has one.`,data:{hostname:e,fix:"if it never comes, check the zone's CAA records allow Cloudflare's certificate authorities"}}),{outcome:"first_visit"};throw new f("APP_NOT_LIVE",`${t} isn't live after ${D(w)}: the Gateway can't reach its Worker yet
+${t} stays ${V[l]}.`,{retryable:!0,rerun:`${$} status`,rerunNote:`then ${l} again`})}(s===null||u()-s>=B)&&(E=p?"live":"certificate",r.emit({type:"progress",step:g,message:p?`Waiting for ${t} to go live`:`Waiting for the certificate for ${e} (usually under 5m)`,data:{hostname:e,waitedMs:w,answered:p}}),s=u()),await v(d)}}async function x(i,a,t){let e=await k(i,a);if(!e||e.status===P)throw new f("APP_NOT_FOUND",`${t} was deleted during this run
+Someone removed it from the Gateway while this run waited for it to go live.`,{retryable:!0,rerunNote:"to put it back"});return e.status}function oe(i,a,t){let e=W({out:a,verbose:t});return{openRelease:i?.openRelease??e.open,source:i?.source??e.describe}}function ne(i,{manifest:a,install:t,deployer:e,accountName:r}){return _(i,{appSlug:a.id,name:a.name??a.id,description:a.description??a.id,manifest:a,appBaseDomain:t.appBaseDomain,deployer:e,organizationName:r??""})}var O={["deploy"]:"This app's upload is kept; deploying again binds it and makes it live."};async function pe({cf:i,db:a,databaseId:t,out:e,accountId:r,appId:l,workerName:c,publishHost:m,interactive:v,forceDns:y,seams:d,verb:u}){let o=await A(a);if(o?.liveAppWorkers.includes(c)&&!m)return;e.emit({type:"step",step:"app.bind",status:"start",message:`Binding ${b(c)} on the gateway${m?" and publishing its hostname":""}...`,data:{appId:l}});let n=(await d.source?.())?.version,p=n!==void 0&&o!==null&&n!==o.releaseVersion;p&&e.emit({type:"step",step:"gateway.upgrade",status:"start",message:`Upgrading the Gateway ${o.releaseVersion} \u2192 ${n}...`,data:{from:o.releaseVersion,to:n}});try{let s=await I({cf:i,out:e,accountId:r,databaseId:t,interactive:v,cliVersion:R,force:!0,forceDns:y,...d});p&&e.emit({type:"step",step:"gateway.upgrade",status:"ok",data:{to:n}}),e.emit({type:"step",step:"app.bind",status:"ok",message:`The gateway binds ${b(c)} (gateway version ${s.versionId??"unknown"}).`,data:{versionId:s.versionId,newHosts:s.newHosts}})}catch(s){throw s instanceof f&&s.code==="LEASE_HELD"?new f("LEASE_HELD",`${s.message}
+${O[u]}`,{retryable:!0,rerunNote:"once the other deploy finishes",data:s.data}):s}}async function le({wait:i,db:a,appRowId:t,appId:e,hostname:r,out:l,seams:c,message:m,verb:v}){if(!i)return!1;let{outcome:y,waited:d}=await G({db:a,appRowId:t,appId:e,hostname:r,out:l,verb:v,...c});return y!=="live"?!1:(l.emit({type:"step",step:"app.live",status:"ok",message:m,data:{hostname:r,url:`https://${r}`,...d?{waited:d}:{}}}),!0)}function ce(i){return{url:i.liveUrl,workerName:i.workerName,versionId:i.versionId,live:i.live}}export{oe as a,ne as b,pe as c,le as d,ce as e};

package/dist/chunk-JYKRUS5C.js

@@ -0,0 +1 @@
+import{z as t}from"zod";var a=t.array(t.looseObject({name:t.string(),status:t.string()})),c=t.looseObject({authenticated:t.boolean(),authSource:t.string().nullish(),tokenValid:t.boolean().nullish(),email:t.string().nullish(),accounts:t.array(t.looseObject({id:t.string(),name:t.string().nullish()})).nullish()}),o=t.looseObject({uuid:t.string(),name:t.string()}),p=t.array(o),g=t.array(t.looseObject({Name:t.string()})),e=t.looseObject({duration:t.number().nullish(),changes:t.number().nullish()}).nullish(),O=t.array(t.looseObject({results:t.array(t.record(t.string(),t.unknown())).nullish(),success:t.boolean().nullish(),meta:e})),h=t.looseObject({bookmark:t.string()}),y=t.looseObject({previous_bookmark:t.string().nullish()}),n=t.looseObject({id:t.string(),title:t.string()}),b=t.array(n),r=t.looseObject({id:t.string().nullish(),created_on:t.string().nullish(),versions:t.array(t.looseObject({version_id:t.string(),percentage:t.number()}))}),m=t.union([t.looseObject({deployments:t.array(r)}),t.array(r)]).transform(s=>Array.isArray(s)?s:s.deployments),d=t.array(t.looseObject({id:t.string().nullish(),name:t.string(),references:t.looseObject({domains:t.array(t.looseObject({id:t.string().nullish(),hostname:t.string(),zone_id:t.string().nullish(),zone_name:t.string().nullish()})).nullish()}).nullish()})),j=t.looseObject({buckets:t.array(t.looseObject({name:t.string()})).nullish()}).transform(s=>s.buckets??[]),x=t.union([t.looseObject({result:t.array(t.looseObject({name:t.string()}))}),t.array(t.looseObject({name:t.string()}))]).transform(s=>Array.isArray(s)?s:s.result),f=t.array(t.looseObject({id:t.string(),name:t.string(),status:t.string().nullish()})),k=t.array(t.looseObject({id:t.string(),name:t.string(),type:t.string(),content:t.string().nullish()})),D=t.array(t.looseObject({id:t.string(),type:t.string().nullish(),hosts:t.array(t.string()).nullish(),status:t.string().nullish()})),i=t.looseObject({name:t.string(),script_name:t.string().nullish(),class_name:t.string().nullish(),instances:t.record(t.string(),t.number()).nullish()}),L=t.array(i),W=t.array(t.looseObject({results:t.looseObject({columns:t.array(t.string()).nullish(),rows:t.array(t.array(t.unknown())).nullish()}).nullish(),meta:e})),l=t.looseObject({id:t.string(),name:t.string(),origin:t.looseObject({host:t.string().nullish(),port:t.number().nullish(),database:t.string().nullish(),user:t.string().nullish(),scheme:t.string().nullish()}).nullish(),caching:t.looseObject({disabled:t.boolean().nullish()}).nullish()}),w=t.array(l);export{a,c as b,o as c,p as d,g as e,O as f,h as g,y as h,n as i,b as j,m as k,d as l,j as m,x as n,f as o,k as p,D as q,i as r,L as s,W as t,l as u,w as v};

package/dist/chunk-LXYMDZER.js

@@ -0,0 +1 @@
+import{f as i}from"./chunk-CZXHKPRZ.js";async function o(a,e){let t=await i(a);t&&e.emit({type:"warning",code:"LEGACY_LOCAL_STATE",message:t})}function p(a,e,t){a.emit({type:"step",step:e,status:"ok",message:t.applied.length>0?`Applied ${t.applied.join(", ")}.`:"The local database is up to date.",data:{database:t.database,applied:t.applied}})}export{o as a,p as b};