everyapp 0.3.0-rc.1 → 0.3.0-rc.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Every App, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/access-LGEN3ABJ.js

@@ -0,0 +1 @@
+import{a,b,c,d,e,f,g,h,i}from"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-TLRM3P7V.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";export{c as APPS_APPLICATION_NAME,b as GATEWAY_APPLICATION_NAME,a as POLICY_NAME,e as off,d as on,f as show,i as showAccess,h as turnAccessOff,g as turnAccessOn};

package/dist/activity-RSD4D66F.js

@@ -0,0 +1,12 @@
+import{a as $,c as b,d as C,e as A,f as g}from"./chunk-ELK7QZ2M.js";import{J as O,K as P,M as R,N as L,O as N,P as W,Q as M,g as E}from"./chunk-M2QQ2UD7.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{c as k,f,pc as v,wc as y}from"./chunk-LYNBZ7RV.js";import a from"chalk";var w="workspace.update";async function ee(e){await y(e,p=>j({flags:e,out:p}))}async function ae(e){await y(e,p=>B({flags:e,out:p}))}async function te(e){await y(e,p=>K({flags:e,out:p}))}async function se(e,p){await y(e,i=>H({flags:e,out:i},p))}async function oe(e){await y(e,p=>q({flags:e,out:p}))}async function ie(e,p){await y(e,i=>X({flags:e,out:i},p))}var m=e=>e.toLocaleString("en-US"),T=e=>e===0?a.dim("\u2013"):`$${(e/1e6).toFixed(4)}`;async function j(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.month??O(new Date(r.now)),o=await P(r,s),n=t=>{if(!t.callable)return a.dim("removed");if(t.capUnlimited)return a.dim("none (unlimited)");if(t.effectiveMonthlyCallCap===null)return a.dim("none");let h=m(t.effectiveMonthlyCallCap),I=t.capSource==="default"?`${h} ${a.dim("(default)")}`:h;return t.paused?`${I} ${a.yellow("paused")}`:I},u=v(["APP","CALLS","FAILED","TOOL CALLS","TOKENS IN/OUT","COST","CAP"],o.byApp.map(t=>[t.appSlug??t.appRowId,m(t.calls),t.failures>0?a.yellow(m(t.failures)):a.dim("0"),m(t.toolCalls),`${m(t.inputTokens)}/${m(t.outputTokens)}`,T(t.costMicros),n(t)])),l=v(["MEMBER","CALLS","FAILED","TOOL CALLS","TOKENS IN/OUT","COST"],o.byMember.map(t=>[t.userId===""?a.dim("the apps themselves"):t.email??a.dim(`${t.userId} (no longer a member)`),m(t.calls),t.failures>0?a.yellow(m(t.failures)):a.dim("0"),m(t.toolCalls),`${m(t.inputTokens)}/${m(t.outputTokens)}`,T(t.costMicros)])),c=v(["PROVIDER","KIND","CALLS","FAILED","TOKENS IN/OUT","COST"],o.byTarget.map(t=>[t.target,t.kind,m(t.calls),t.failures>0?a.yellow(m(t.failures)):a.dim("0"),`${m(t.inputTokens)}/${m(t.outputTokens)}`,T(t.costMicros)])),d=o.byApp.reduce((t,h)=>t+h.calls,0),D=o.byApp.reduce((t,h)=>t+h.toolCalls,0),x=o.byApp.filter(t=>t.paused).length,S=`${r.organization.name}, ${s}: ${f(d,"provider call")} and ${f(D,"tool call")} across ${f(o.byApp.length,"app")}${x>0?`, ${x} paused`:""}`,U=o.defaultMonthlyCallCap===null?"No workspace default cap.":`Workspace default cap: ${m(o.defaultMonthlyCallCap)} calls a month for every app without its own.`;p.emit({type:"done",message:S,display:[S,a.dim(U),"",a.bold("By app"),...o.byApp.length>0?u:[a.dim("no apps")],"",a.bold("By member"),...o.byMember.length>0?l:[a.dim("no calls")],"",a.bold("By provider"),...o.byTarget.length>0?c:[a.dim("no calls")],"",a.dim(`Cap an app: ${k} workspace app cap <app> <n|off|--unlimited>; the default: ${k} workspace cap default <n|off>`)].join(`
+`),data:{organization:r.organization,...o}})}async function B(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.app===void 0?void 0:await E(r,i.app,{callable:!0}),o=i.user===void 0?void 0:await b(r,i.user),n=await R(r,{limit:i.limit,before:i.before,appRowId:s?.id,userId:o?.id,decision:i.decision,risk:i.risk,since:i.since}),u=v(["WHEN (UTC)","WHO","APP","TOOL","RISK","DECISION","OUTCOME","MS","CLIENT"],n.calls.map(d=>[A(d.createdAt),d.user.email??a.dim(d.user.id),d.app.slug?`${d.app.slug}${d.app.removed?a.dim(" (removed)"):""}`:a.dim("gateway"),d.tool.via?`${d.tool.name} ${a.dim(`via ${d.tool.via}`)}`:d.tool.name,d.tool.risk??a.dim("\u2013"),d.decision==="allowed"?a.green("allowed"):a.red(`blocked${d.reason?a.dim(` (${d.reason})`):""}`),d.outcome,d.durationMs===null?a.dim("\u2013"):String(d.durationMs),d.credential.clientName??d.credential.clientInfo??a.dim(d.credential.kind)])),l=n.nextBefore?`${n.nextBefore.createdAt}:${n.nextBefore.id}`:null,c=`${f(n.calls.length,"tool call")} in ${r.organization.name}${n.nextBefore?" (more before this page)":""}`;p.emit({type:"done",message:c,display:[n.calls.length>0?u.join(`
+`):a.dim("No tool calls match."),...l?[a.dim(`Next page: ${k} workspace activity --before ${l}`)]:[]].join(`
+`),data:{organization:r.organization,calls:n.calls.map(d=>({...d,createdAt:g(d.createdAt)})),nextBefore:l,...l?{next:[{command:`${k} workspace activity --before ${l}`,note:"the next page"}]}:{}}})}var F=e=>({id:e.id,user:e.user,name:e.name,prefix:e.prefix,app:e.app.slug,scopes:e.scopes,active:e.active,createdAt:g(e.createdAt),expiresAt:g(e.expiresAt),lastUsedAt:g(e.lastUsedAt),revokedAt:g(e.revokedAt)});async function K(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.user===void 0?void 0:await b(r,i.user),o=await L(r,s?.id),n=i.all?o:o.filter(c=>c.active),u=v(["ID","MEMBER","NAME","PREFIX","APP","SCOPES","STATE","LAST USED","EXPIRES"],n.map(c=>[c.id,c.user.email,c.name,`${c.prefix}\u2026`,c.app.slug??a.dim("all apps"),c.scopes.join(","),c.revokedAt!==null?a.dim("revoked"):c.active?a.green("active"):a.yellow("expired"),A(c.lastUsedAt),A(c.expiresAt)])),l=`${f(n.length,i.all?"personal access token":"active personal access token")}${s?` of ${C(s)}`:""} in ${r.organization.name}${!i.all&&o.length>n.length?` (${o.length-n.length} revoked or expired: --all)`:""}`;p.emit({type:"done",message:l,display:[n.length>0?u.join(`
+`):a.dim(l),a.dim(`Revoke one: ${k} workspace token revoke <id>. Tokens are made in Admin \u2192 Tokens; a value is never shown again.`)].join(`
+`),data:{organization:r.organization,tokens:n.map(F)}})}async function H(e,p){let{out:i}=e,{ws:r}=await $(e);i.emit({type:"step",step:w,status:"start",message:`Revoking the token ${p}...`});let{token:s,already:o}=await N(r,p);i.emit({type:"step",step:w,status:"ok",message:`Revoked ${s.name}`,data:{tokenId:s.id,already:o}});let n=o?[`${s.user.email}'s token ${s.name} (${s.prefix}\u2026) was revoked already, on ${A(s.revokedAt)} UTC.`]:[`Revoked ${s.user.email}'s token ${s.name} (${s.prefix}\u2026).`,"It stops working on its next request."];i.emit({type:"done",message:n.join(`
+`),display:[n[0],...n.slice(1).map(u=>a.dim(u))].join(`
+`),data:{organization:r.organization,token:F(s),already:o}})}var z=e=>({id:e.id,user:e.user,clientName:e.clientName,clientDomain:e.clientDomain,redirectHost:e.redirectHost,apps:e.apps,access:e.access,createdAt:g(e.createdAt),lastUsedAt:g(e.lastUsedAt),revokedAt:g(e.revokedAt),revokedReason:e.revokedReason});async function q(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.user===void 0?void 0:await b(r,i.user),o=await W(r,s?.id),n=v(["ID","MEMBER","AI APP","APPS","ACCESS","LAST USED","SINCE"],o.map(l=>[l.id,l.user.email,`${l.clientName}${l.clientDomain?a.dim(` (${l.clientDomain})`):""}`,l.apps==="all"?"all":l.apps.join(", ")||a.dim("none"),l.access==="write"?"read & write":"read",A(l.lastUsedAt),A(l.createdAt)])),u=`${f(o.length,"AI connection")}${s?` of ${C(s)}`:""} in ${r.organization.name}`;p.emit({type:"done",message:u,display:[o.length>0?n.join(`
+`):a.dim(u),a.dim(`Revoke one: ${k} workspace connection revoke <id>`)].join(`
+`),data:{organization:r.organization,connections:o.map(z)}})}async function X(e,p){let{out:i}=e,{ws:r}=await $(e);i.emit({type:"step",step:w,status:"start",message:`Revoking the connection ${p}...`});let{connection:s,already:o}=await M(r,p);i.emit({type:"step",step:w,status:"ok",message:`Revoked ${s.clientName}`,data:{connectionId:s.id,already:o}});let n=o?[`${s.user.email}'s connection from ${s.clientName} was revoked already${s.revokedReason?` (${s.revokedReason})`:""}.`]:[`Revoked ${s.user.email}'s connection from ${s.clientName}.`,"The client is out on its next request; its grant in the Gateway's authorization server lapses on its own."];i.emit({type:"done",message:n.join(`
+`),display:[n[0],...n.slice(1).map(u=>a.dim(u))].join(`
+`),data:{organization:r.organization,connection:z(s),already:o}})}export{ae as activity,ie as connectionRevoke,oe as connections,B as listActivity,q as listConnections,K as listTokens,j as reportUsage,X as revokeConnection,H as revokeToken,se as tokenRevoke,te as tokens,ee as usage};

package/dist/apps-4RCFXT74.js

@@ -0,0 +1,13 @@
+import{a as w,g as _,h as k,j as D}from"./chunk-ELK7QZ2M.js";import{B as x,D as G,E as M,F as U,G as F,H as R,g as T}from"./chunk-M2QQ2UD7.js";import{a as O,d as j,e as E}from"./chunk-OM2HDWVP.js";import"./chunk-4JRIS6S6.js";import"./chunk-RMF4YGD6.js";import{a as W}from"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{Bb as C,Fb as N,c as v,f as u,pc as P,wc as f}from"./chunk-LYNBZ7RV.js";import d from"chalk";var g="workspace.update";async function ce(e){await f(e,a=>q({flags:e,out:a}))}async function le(e,a){await f(e,o=>B({flags:e,out:o},a))}async function me(e,a){await f(e,o=>Q({flags:e,out:o},a))}var L=e=>e==="off"?null:e;async function de(e,a,o){await f(e,s=>X({flags:e,out:s},a,o===void 0?void 0:L(o),e.unlimited??!1))}async function ue(e,a){await f(e,o=>Y({flags:e,out:o},L(a)))}function J(e){if(!e)return null;try{let a=JSON.parse(e);return a&&typeof a=="object"&&!Array.isArray(a)?a:null}catch{return null}}function K(e,a){let o=J(e.manifest);if(!o||e.tier==="dispatch"||e.status==="pending")return null;try{return E(o)?j({manifest:o,appId:e.appSlug,gatewayNames:a,secretNames:W(e.secretNames)}).setup:null}catch{return null}}var b=(e,a)=>({id:e.id,appId:e.appSlug,name:e.name,description:e.description,status:e.status,scope:e.scope,tier:e.tier,hostname:e.hostname,everyone:e.everyone,accessCount:e.accessCount,...a===void 0?{}:{setup:a}});async function q(e){let{out:a}=e,{gateway:o,ws:s}=await w(e),p=await x(s),i=null;try{i=await O(o.cf)}catch(n){a.emit({type:"warning",code:"SETTINGS_UNKNOWN",message:`Couldn't list the Gateway's settings, so what each app needs set is unknown
+${N(n)}`})}let t=p.map(n=>({app:n,setup:K(n,i)})),r=P(["APP","NAME","STATUS","WHO CAN OPEN","SETUP"],t.map(({app:n,setup:l})=>[n.appSlug,n.name,n.status==="active"?d.green(n.status):d.yellow(n.status),n.scope==="shared"?"everyone, every organization":n.everyone?`everyone ${d.dim(`(${n.accessCount})`)}`:u(n.accessCount,"member"),l===null?d.dim("\u2013"):l.ready?d.green("ready"):d.yellow(`needs ${l.unmet.map(y=>y.names.join(" or ")).join(", ")}`)])),c=t.filter(({setup:n})=>n&&!n.ready);a.emit({type:"done",message:`${u(p.length,"app")} in ${s.organization.name}${c.length>0?`, ${c.length} needing setup`:""}`,display:p.length>0?r.join(`
+`):d.dim(`No apps in ${s.organization.name} yet.`),data:{organization:s.organization,apps:t.map(({app:n,setup:l})=>b(n,l)),...c.length>0?{next:c.flatMap(({app:n,setup:l})=>l?.command?[{command:l.command.command,note:n.appSlug}]:[])}:{}}})}async function B(e,a){let{out:o,flags:s}=e,{ws:p}=await w(e);o.emit({type:"step",step:g,status:"start",message:`Updating ${a}...`});let{app:i,granted:t}=await G(p,a,{name:s.name,description:s.description,everyone:s.everyone===void 0?void 0:s.everyone==="on"});o.emit({type:"step",step:g,status:"ok",message:`Updated ${i.appSlug}`,data:{appRowId:i.id,granted:t}});let r=[`${i.appSlug} is "${i.name}"${i.description?`: ${i.description}`:""}.`,i.scope==="shared"?"A shared app: every member of every organization can open it.":i.everyone?`Available to everyone in ${p.organization.name}${t>0?` (${u(t,"member")} granted now)`:""}; new members get it on joining.`:`Private: ${u(i.accessCount,"member")} can open it (workspace app access ${i.appSlug}).`];o.emit({type:"done",message:r.join(`
+`),display:[r[0],d.dim(r[1])].join(`
+`),data:{organization:p.organization,app:b(i),granted:t}})}async function Q(e,a){let{out:o,flags:s}=e,{change:p}=D(s),{ws:i}=await w(e),t=await T(i,a),r=[],c=[],n;p?(o.emit({type:"step",step:g,status:"start",message:`Changing who can open ${t.appSlug}...`}),{granted:r,revoked:c,users:n}=await U(i,t,p),o.emit({type:"step",step:g,status:"ok",message:`${t.appSlug}: ${u(r.length,"grant")} added, ${c.length} revoked`,data:{appRowId:t.id,granted:r.length,revoked:c.length}})):n=await M(i,t);let l=n.filter(m=>m.direct||m.viaGroups.length>0),y=P(["EMAIL","ROLE","STATUS","DIRECT","VIA GROUPS"],n.map(m=>[m.email,m.primaryRole??m.role,_(m),m.direct?d.green("yes"):d.dim("no"),m.viaGroups.length>0?m.viaGroups.join(", "):d.dim("\u2013")])),h=p?`${t.appSlug}: granted ${r.length>0?r.map(m=>m.email).join(", "):"nobody"}, revoked ${c.length>0?c.map(m=>m.email).join(", "):"nobody"}; ${u(l.length,"member")} can open it now.`:`${u(l.length,"member")} of ${n.length} can open ${t.appSlug}${t.everyone?" (available to everyone)":""}.`;o.emit({type:"done",message:h,display:[h,y.join(`
+`)].join(`
+`),data:{organization:i.organization,app:b({...t,accessCount:l.length}),users:n.map(m=>({...k(m),direct:m.direct,viaGroups:m.viaGroups})),...p?{granted:r.map(k),revoked:c.map(k)}:{}}})}var I=e=>`${e.toLocaleString("en-US")} calls a month`;function S(e,a){return e!==null?I(e):a?"no cap at all":"no cap of its own"}function V(e){return e===null?null:{subscriptionId:e,message:`Owners and admins are emailed at 80% and at the cap (the built-in Cap alerts subscription; ${v} events list shows it).`}}var z="a provider tool answers a tool error naming the cap, and an app's brokered call gets 429 app_monthly_cap_exceeded until the next UTC month.";async function X(e,a,o,s=!1){let{out:p}=e;if(s&&o!==void 0)throw new C("INVALID_VALUE",`--unlimited takes no number and no off
+An app has a cap (a number), no cap whatever the workspace default (--unlimited), or neither (off).`,{fix:`give --unlimited alone: ${v} workspace app cap ${a} --unlimited`});if(!s&&o===void 0)throw new C("MISSING_ARGUMENT",`Missing the cap
+Give a number of calls per month, off for no cap of its own, or --unlimited.`,{data:{usage:`${v} workspace app cap <app> [<n|off>] [--unlimited] [flags]`}});let{ws:i}=await w(e);p.emit({type:"step",step:g,status:"start",message:`Setting ${a}'s cap...`});let t=await F(i,a,o??null,{unlimited:s}),{app:r,was:c,wasUnlimited:n,effective:l,before:y,capAlertsId:h}=t,m=t.cap===c&&s===n;p.emit({type:"step",step:g,status:"ok",message:`${r.appSlug}: ${S(t.cap,s)}`,data:{appRowId:r.id,cap:t.cap,unlimited:s,was:c,wasUnlimited:n,effectiveCap:l.cap,capSource:l.source}});let $=[m?`${r.appSlug} had ${S(t.cap,s)} already. Nothing changed.`:`${r.appSlug}: ${S(t.cap,s)} for ${i.organization.name} (was ${S(c,n)}).`,l.cap===null?y.cap===null?"Its provider calls are not capped.":"Its provider calls are no longer capped.":l.source==="default"?`The workspace default of ${I(l.cap)} binds it; past it, ${z}`:`Past it, ${z}`],A=V(h);A&&$.push(A.message),p.emit({type:"done",message:$.join(`
+`),display:[$[0],...$.slice(1).map(H=>d.dim(H))].join(`
+`),data:{organization:i.organization,app:b(r),cap:t.cap,unlimited:s,was:c,wasUnlimited:n,effectiveCap:l.cap,capSource:l.source,capAlerts:A}})}async function Y(e,a){let{out:o}=e,{ws:s}=await w(e);o.emit({type:"step",step:g,status:"start",message:"Setting the workspace default cap..."});let{was:p,capAlertsId:i}=await R(s,a),t=n=>n===null?"no default cap":`a default cap of ${I(n)}`;o.emit({type:"step",step:g,status:"ok",message:`${s.organization.name}: ${t(a)}`,data:{cap:a,was:p}});let r=[a===p?`${s.organization.name} had ${t(a)} already. Nothing changed.`:`${s.organization.name}: ${t(a)} (was ${t(p)}).`,a===null?"Every app without a cap of its own is uncapped on the Gateway within 30 seconds; an app's own cap or --unlimited stays.":`Every app without a cap or --unlimited of its own is held to it on the Gateway within 30 seconds; past it, ${z}`],c=V(i);c&&r.push(c.message),o.emit({type:"done",message:r.join(`
+`),display:[r[0],...r.slice(1).map(n=>d.dim(n))].join(`
+`),data:{organization:s.organization,cap:a,was:p,capAlerts:c}})}export{me as appAccess,Q as appAccessCommand,de as appCap,le as appSet,ce as apps,ue as capDefault,q as listApps,X as setCap,Y as setDefaultCap,B as updateApp};

package/dist/{chunk-R4CGF622.js → chunk-23HJ5I2A.js}

@@ -1,2 +1,2 @@
-import{tb as o}from"./chunk-SAT3PGZU.js";import i from"node:fs";import t from"node:path";import{fileURLToPath as a}from"node:url";function p(e=import.meta.url){let r=t.dirname(a(e));for(let n=r;;n=t.dirname(n)){if(i.existsSync(t.join(n,"apps","every-app-gateway","scripts","build-release.ts"))&&i.existsSync(t.join(n,"packages","cli","package.json")))return n;if(t.dirname(n)===n)return null}}function c(e=import.meta.url){let r=p(e);if(r)return r;throw new o("CHECKOUT_MISSING",`everyapp has to run from a checkout of the Every App repository
+import{Bb as o}from"./chunk-LYNBZ7RV.js";import i from"node:fs";import t from"node:path";import{fileURLToPath as a}from"node:url";function p(e=import.meta.url){let r=t.dirname(a(e));for(let n=r;;n=t.dirname(n)){if(i.existsSync(t.join(n,"apps","every-app-gateway","scripts","build-release.ts"))&&i.existsSync(t.join(n,"packages","cli","package.json")))return n;if(t.dirname(n)===n)return null}}function c(e=import.meta.url){let r=p(e);if(r)return r;throw new o("CHECKOUT_MISSING",`everyapp has to run from a checkout of the Every App repository
 This copy is installed in ${u(t.dirname(a(e)))}, outside any checkout.`,{fix:`in your checkout, run pnpm everyapp ${process.argv.slice(2).join(" ")}`.trimEnd()})}function u(e){for(let r=e;t.dirname(r)!==r;r=t.dirname(r))if(i.existsSync(t.join(r,"package.json")))return r;return e}function s(e){try{return i.realpathSync(e)}catch{return t.resolve(e)}}function h(e,r=c()){let n=t.relative(s(r),s(e));return n===""||n!==".."&&!n.startsWith(`..${t.sep}`)&&!t.isAbsolute(n)}export{p as a,c as b,s as c,h as d};

package/dist/{chunk-IZEOAOKL.js → chunk-2Y5Q6A5K.js}

@@ -1,4 +1,4 @@
-import{h as M,i as G,o as z}from"./chunk-KMAOZRV4.js";import{i as _}from"./chunk-PMPIMHKG.js";import{c as x,d as W}from"./chunk-RFVMR32Y.js";import{c as S}from"./chunk-GRFPP4UW.js";import{b as I}from"./chunk-Y3VIFPN5.js";import{h as O}from"./chunk-EUNGJMJ6.js";import{a as L,j as P,k,l as C}from"./chunk-ZYL2ZHCF.js";import{ib as y,xb as v}from"./chunk-SAT3PGZU.js";async function Oe(e){let{cf:n,out:r,databaseId:a}=e,s=L(n,a),d=await k(s);if(!d)throw P();if(!e.force&&!e.stagedSecrets&&!e.unsetSecrets){let{inSync:g,desired:f}=await Z(n,s,d);if(g)return r.emit({type:"step",step:"gateway.reconcile",status:"skip",message:`The gateway already binds ${f.appWorkers.length===1?"the 1 app":`all ${f.appWorkers.length} apps`} its registry lists.`}),{versionId:d.liveVersionId,firstDeploy:!1,appWorkers:f.appWorkers,domains:d.liveDomains,newHosts:[],changed:!1}}let w=await e.openRelease();try{_(w.manifest,e.cliVersion);let g=await O({db:s,out:r,leaseWaitMs:e.leaseWaitMs,sleep:e.sleep},"gateway.reconcile");try{let f=await k(s)??d;return e.unsetSecrets?.length&&(await g.check(),f=await ee(n,s,f,e.unsetSecrets)),{...await z({cf:n,out:r,reason:"reconcile",release:w,accountId:e.accountId,gatewayHost:f.gatewayHost,zone:{id:f.zoneId,name:f.zoneName},appBaseDomain:f.appBaseDomain,forceDns:e.forceDns,resources:{d1Id:a,oauthKvId:f.oauthKvId,created:[]},db:s,interactive:e.interactive,confirm:e.confirm,cliVersion:e.cliVersion,stagedSecrets:e.stagedSecrets,heldLease:g,sleep:e.sleep}),changed:!0}}finally{await g.release()}}finally{await w.cleanup()}}async function Z(e,n,r){let a=await G(n,M(e));if(!([...r.liveAppWorkers].sort().join(`
+import{h as M,i as G,o as z}from"./chunk-H6QQMY7B.js";import{i as _}from"./chunk-6OGVO7QK.js";import{c as x,d as W}from"./chunk-W3JCQHHU.js";import{c as S}from"./chunk-ZFCUH5PK.js";import{b as I}from"./chunk-4JRIS6S6.js";import{h as O}from"./chunk-HOUHG236.js";import{a as L,j as P,k,l as C}from"./chunk-RMF4YGD6.js";import{Fb as v,qb as y}from"./chunk-LYNBZ7RV.js";async function Oe(e){let{cf:n,out:r,databaseId:a}=e,s=L(n,a),d=await k(s);if(!d)throw P();if(!e.force&&!e.stagedSecrets&&!e.unsetSecrets){let{inSync:g,desired:f}=await Z(n,s,d);if(g)return r.emit({type:"step",step:"gateway.reconcile",status:"skip",message:`The gateway already binds ${f.appWorkers.length===1?"the 1 app":`all ${f.appWorkers.length} apps`} its registry lists.`}),{versionId:d.liveVersionId,firstDeploy:!1,appWorkers:f.appWorkers,domains:d.liveDomains,newHosts:[],changed:!1}}let w=await e.openRelease();try{_(w.manifest,e.cliVersion);let g=await O({db:s,out:r,leaseWaitMs:e.leaseWaitMs,sleep:e.sleep},"gateway.reconcile");try{let f=await k(s)??d;return e.unsetSecrets?.length&&(await g.check(),f=await ee(n,s,f,e.unsetSecrets)),{...await z({cf:n,out:r,reason:"reconcile",release:w,accountId:e.accountId,gatewayHost:f.gatewayHost,zone:{id:f.zoneId,name:f.zoneName},appBaseDomain:f.appBaseDomain,forceDns:e.forceDns,resources:{d1Id:a,oauthKvId:f.oauthKvId,created:[]},db:s,interactive:e.interactive,confirm:e.confirm,cliVersion:e.cliVersion,stagedSecrets:e.stagedSecrets,heldLease:g,sleep:e.sleep}),changed:!0}}finally{await g.release()}}finally{await w.cleanup()}}async function Z(e,n,r){let a=await G(n,M(e));if(!([...r.liveAppWorkers].sort().join(`
 `)===a.appWorkers.join(`
 `))||!X(r,a.appHosts))return{inSync:!1,desired:a};let d=await S(e,y);return{inSync:!!d?.versionId&&d?.versionId===r.liveVersionId,desired:a}}function X(e,n){if(!e.liveDomains.includes(e.gatewayHost))return!1;let r=e.liveDomains.filter(s=>s!==e.gatewayHost),a=x(n,e.appBaseDomain);return[...r].sort().join(`
 `)===[...a].sort().join(`

package/dist/{chunk-Y3VIFPN5.js → chunk-4JRIS6S6.js}

@@ -1 +1 @@
-import{n as a}from"./chunk-JYKRUS5C.js";import{Vb as i,yb as c}from"./chunk-SAT3PGZU.js";async function m(e,t){return(await i(e,{plane:"account",args:["workers","secrets","list","--worker",t]},a)).map(r=>r.name).sort()}async function p(e,t,n){try{return await e.run({plane:"account",mode:"json",args:["workers","secrets","delete",n,"--worker",t,"--force"]}),!0}catch(r){if(r instanceof c&&(r.kind==="not_found"||/not[_ ]found/i.test(r.message)))return!1;throw r}}async function d(e,t,n){let r={secrets:Object.fromEntries(Object.entries(n).map(([s,o])=>[s,o===null?null:{name:s,type:"secret_text",text:o}]))};await e.run({plane:"account",mode:"json",files:{"secrets.json":r},args:s=>["workers","secrets","bulk","--worker",t,"--body",`@${s["secrets.json"]}`]})}export{m as a,p as b,d as c};
+import{n as a}from"./chunk-JYKRUS5C.js";import{Gb as c,bc as i}from"./chunk-LYNBZ7RV.js";async function m(e,t){return(await i(e,{plane:"account",args:["workers","secrets","list","--worker",t]},a)).map(r=>r.name).sort()}async function p(e,t,n){try{return await e.run({plane:"account",mode:"json",args:["workers","secrets","delete",n,"--worker",t,"--force"]}),!0}catch(r){if(r instanceof c&&(r.kind==="not_found"||/not[_ ]found/i.test(r.message)))return!1;throw r}}async function d(e,t,n){let r={secrets:Object.fromEntries(Object.entries(n).map(([s,o])=>[s,o===null?null:{name:s,type:"secret_text",text:o}]))};await e.run({plane:"account",mode:"json",files:{"secrets.json":r},args:s=>["workers","secrets","bulk","--worker",t,"--body",`@${s["secrets.json"]}`]})}export{m as a,p as b,d as c};

package/dist/{chunk-2UFJRKEE.js → chunk-5PTNYZK6.js}

@@ -1,4 +1,4 @@
-import{c as e}from"./chunk-SAT3PGZU.js";import{buildCommand as n,buildRouteMap as c}from"@stricli/core";var r={kind:"parsed",parse:String,brief:"The Gateway's URL, checked against the Gateway in your Cloudflare account (default: EVERYAPP_GATEWAY_URL)",optional:!0},i={kind:"parsed",parse:String,brief:"The Cloudflare account of the Gateway, when your login sees several (default: CLOUDFLARE_ACCOUNT_ID)",optional:!0},g={kind:"parsed",parse:String,brief:"The organization to act on, by slug, id or name (default: the install organization; a name two organizations share is refused, ORG_AMBIGUOUS: give the slug)",placeholder:"slug",optional:!0},l={kind:"boolean",brief:"Print NDJSON events on stdout and never prompt (exit 0 done, 1 error, 2 action required, 251/252 bad command or arguments)",optional:!0},f={kind:"boolean",brief:"Print the result as an NDJSON event",optional:!0},d={kind:"boolean",brief:"Show every step and progress line, the output of what everyapp runs, and an unexpected error's stack trace",optional:!0},w={kind:"boolean",brief:"Skip everyapp's own confirmations (never cf's questions, or the one before replacing a Worker changed outside everyapp)",optional:!0},u={kind:"boolean",brief:"Publish new hostnames even where a DNS record answers them (one at a hostname is replaced)",optional:!0},y={"allow-delete-durable-object-data":{kind:"boolean",brief:"Deploy even though Durable Object classes were removed, deleting their data",optional:!0},"allow-delete-workflows":{kind:"boolean",brief:"Deploy even though Workflows were removed, deleting them and their instances",optional:!0},"force-dns":{...u,brief:"Publish the app's new hostname even where a DNS record answers it (one at the hostname is replaced)"},"enable-email-routing":{kind:"boolean",brief:"Turn on Email Routing for the domains the app's inbound addresses (everyapp email set --inbound) name that don't route mail yet (locks their MX and SPF records to Cloudflare)",optional:!0}};var p=(o=>(o.Senders="senders",o.Inbound="inbound",o))(p||{}),t={manifest:{kind:"parsed",parse:String,brief:"Path to everyapp.config.ts, if it isn't in this directory",placeholder:"path",optional:!0},gateway:r,"account-id":i,json:l,verbose:d},m=n({loader:async()=>{let{set:a}=await import("./email-NNFD3VVB.js");return a},parameters:{positional:{kind:"tuple",parameters:[]},flags:{sender:{kind:"parsed",parse:String,variadic:!0,optional:!0,placeholder:"pattern",brief:"Address the app may send as: '*@<domain>' or one address (repeat, up to 20)"},inbound:{kind:"parsed",parse:String,variadic:!0,optional:!0,placeholder:"address",brief:"Address whose mail goes to the app: '*@<apex>' or one address (repeat, up to 50)"},"enable-email-routing":{kind:"boolean",optional:!0,brief:"Turn on Email Routing for inbound domains without asking"},...t}},docs:{brief:"Set senders or inbound addresses, without a deploy",fullDescription:["Each flag replaces its whole list; a list you don't name is kept. The Gateway","picks up a change within 30 seconds, without a deploy. Addresses set before","the app's first upload are routed by its next deploy.","","Requirements:","  --sender   everyapp.config.ts lists capabilities.email; each domain is set up for Email Sending","  --inbound  everyapp.config.ts declares email: { inbound: true }; the domain is on Cloudflare DNS","","Examples:",`  ${e} email set --sender '*@mail.example.com'`,`  ${e} email set --inbound reports@mail.example.com`,`  ${e} email set --inbound '*@example.com' --enable-email-routing`].join(`
-`)}}),b=n({loader:async()=>{let{unset:a}=await import("./email-NNFD3VVB.js");return a},parameters:{positional:{kind:"array",minimum:1,parameter:{brief:"List to clear: senders or inbound",placeholder:"senders|inbound",parse:a=>{let s=Object.values(p).find(o=>o===a);if(!s)throw new Error("Use senders, inbound, or both.");return s}}},flags:t},docs:{brief:"Clear senders or inbound addresses, without a deploy",fullDescription:["Clearing inbound addresses removes their Email Routing rules; a catch-all goes","back to dropping mail. Nothing is built or deployed.","","Examples:",`  ${e} email unset inbound`,`  ${e} email unset senders inbound`].join(`
-`)}}),h=n({loader:async()=>{let{show:a}=await import("./email-NNFD3VVB.js");return a},parameters:{positional:{kind:"tuple",parameters:[]},flags:t},docs:{brief:"Show the app's senders and inbound addresses",fullDescription:["Lists the app's senders and inbound addresses on the Gateway, and whether each","inbound address is routed.","","Examples:",`  ${e} email show`,`  ${e} email show --manifest ../analytics/everyapp.config.ts`].join(`
+import{c as e}from"./chunk-LYNBZ7RV.js";import{buildCommand as n,buildRouteMap as c}from"@stricli/core";var r={kind:"parsed",parse:String,brief:"The Gateway's URL, checked against the Gateway in your Cloudflare account (default: EVERYAPP_GATEWAY_URL)",optional:!0},i={kind:"parsed",parse:String,brief:"The Cloudflare account of the Gateway, when your login sees several (default: CLOUDFLARE_ACCOUNT_ID)",optional:!0},g={kind:"parsed",parse:String,brief:"The organization to act on, by slug, id or name (default: the install organization; a name two organizations share is refused, ORG_AMBIGUOUS: give the slug)",placeholder:"slug",optional:!0},l={kind:"boolean",brief:"Print NDJSON events on stdout and never prompt (exit 0 done, 1 error, 2 action required, 251/252 bad command or arguments)",optional:!0},f={kind:"boolean",brief:"Print the result as an NDJSON event",optional:!0},d={kind:"boolean",brief:"Show every step and progress line, the output of what everyapp runs, and an unexpected error's stack trace",optional:!0},w={kind:"boolean",brief:"Skip everyapp's own confirmations (never cf's questions, or the one before replacing a Worker changed outside everyapp)",optional:!0},u={kind:"boolean",brief:"Publish new hostnames even where a DNS record answers them (one at a hostname is replaced)",optional:!0},y={"allow-delete-durable-object-data":{kind:"boolean",brief:"Deploy even though Durable Object classes were removed, deleting their data",optional:!0},"allow-delete-workflows":{kind:"boolean",brief:"Deploy even though Workflows were removed, deleting them and their instances",optional:!0},"force-dns":{...u,brief:"Publish the app's new hostname even where a DNS record answers it (one at the hostname is replaced)"},"enable-email-routing":{kind:"boolean",brief:"Turn on Email Routing for the domains the app's inbound addresses (everyapp email set --inbound) name that don't route mail yet (locks their MX and SPF records to Cloudflare)",optional:!0}};var p=(o=>(o.Senders="senders",o.Inbound="inbound",o))(p||{}),t={manifest:{kind:"parsed",parse:String,brief:"Path to everyapp.config.ts, if it isn't in this directory",placeholder:"path",optional:!0},gateway:r,"account-id":i,json:l,verbose:d},m=n({loader:async()=>{let{set:a}=await import("./email-RLZFUFUN.js");return a},parameters:{positional:{kind:"tuple",parameters:[]},flags:{sender:{kind:"parsed",parse:String,variadic:!0,optional:!0,placeholder:"pattern",brief:"Address the app may send as: '*@<domain>' or one address (repeat, up to 20)"},inbound:{kind:"parsed",parse:String,variadic:!0,optional:!0,placeholder:"address",brief:"Address whose mail goes to the app: '*@<apex>' or one address (repeat, up to 50)"},"enable-email-routing":{kind:"boolean",optional:!0,brief:"Turn on Email Routing for inbound domains without asking"},...t}},docs:{brief:"Set senders or inbound addresses, without a deploy",fullDescription:["Each flag replaces its whole list; a list you don't name is kept. The Gateway","picks up a change within 30 seconds, without a deploy. Addresses set before","the app's first upload are routed by its next deploy.","","Requirements:","  --sender   everyapp.config.ts lists capabilities.email; each domain is set up for Email Sending","  --inbound  everyapp.config.ts declares email: { inbound: true }; the domain is on Cloudflare DNS","","Examples:",`  ${e} email set --sender '*@mail.example.com'`,`  ${e} email set --inbound reports@mail.example.com`,`  ${e} email set --inbound '*@example.com' --enable-email-routing`].join(`
+`)}}),b=n({loader:async()=>{let{unset:a}=await import("./email-RLZFUFUN.js");return a},parameters:{positional:{kind:"array",minimum:1,parameter:{brief:"List to clear: senders or inbound",placeholder:"senders|inbound",parse:a=>{let s=Object.values(p).find(o=>o===a);if(!s)throw new Error("Use senders, inbound, or both.");return s}}},flags:t},docs:{brief:"Clear senders or inbound addresses, without a deploy",fullDescription:["Clearing inbound addresses removes their Email Routing rules; a catch-all goes","back to dropping mail. Nothing is built or deployed.","","Examples:",`  ${e} email unset inbound`,`  ${e} email unset senders inbound`].join(`
+`)}}),h=n({loader:async()=>{let{show:a}=await import("./email-RLZFUFUN.js");return a},parameters:{positional:{kind:"tuple",parameters:[]},flags:t},docs:{brief:"Show the app's senders and inbound addresses",fullDescription:["Lists the app's senders and inbound addresses on the Gateway, and whether each","inbound address is routed.","","Examples:",`  ${e} email show`,`  ${e} email show --manifest ../analytics/everyapp.config.ts`].join(`
 `)}}),S=c({routes:{show:h,set:m,unset:b},docs:{brief:"Manage the addresses an app sends as and receives at"}});export{r as a,i as b,g as c,l as d,f as e,d as f,w as g,u as h,y as i,S as j};

package/dist/{chunk-PMPIMHKG.js → chunk-6OGVO7QK.js}

@@ -1,4 +1,4 @@
-import{b as v}from"./chunk-RFVMR32Y.js";import{f as _}from"./chunk-DQWOXSL3.js";import{Qb as h,Rb as S,rb as k,sb as O,tb as c}from"./chunk-SAT3PGZU.js";import E from"node:fs/promises";import d from"node:path";import{OutputWorkerSchema as b}from"@cloudflare/config";import R from"node:fs/promises";import g from"node:path";var L=g.join(".cloudflare","output","v0"),A=g.join(L,"workers"),D="default";async function*ie(e){let t=g.join(e,A);for(let n of await R.readdir(t,{withFileTypes:!0})){if(!n.isDirectory())continue;let r=g.join(t,n.name),i=g.join(r,"worker.config.json"),o=JSON.parse(await R.readFile(i,"utf8"));yield{name:n.name,directory:r,file:i,config:o}}}async function oe(e){let t=JSON.parse(await R.readFile(g.join(e,"config.json"),"utf8"));return t.buildContext?.mode==="production"&&!t.buildContext.isPreview}var I=d.join(A,D),j=d.join(I,"worker.config.json"),C=d.join(I,"bundle"),N="__EVERYAPP_PATCH__",B="every-app-gateway";function U(e){return[e.gatewayHost,...[...new Set(e.appHosts)].filter(t=>t!==e.gatewayHost).sort()]}async function ge(e,t){let n=d.join(e,j),r=JSON.parse(await E.readFile(n,"utf8")),i={...r.env??{}};for(let a of Object.keys(i))a.startsWith(k)&&delete i[a];delete i.KV,i.DB={type:"d1",name:B,id:t.d1Id},i.OAUTH_KV={type:"kv",id:t.oauthKvId},i.EVERYAPP_RELEASE={type:"json",value:t.release},i.CF_VERSION_METADATA={type:"version-metadata"};for(let a of[...new Set(t.appWorkers)].sort())i[O(a)]={type:"worker",worker:a};if(r.env=i,t.gatewayHost!==t.appBaseDomain)throw new c("INVALID_APP_BASE_DOMAIN",`Apps live one label below the gateway host ${t.gatewayHost}, so APP_BASE_DOMAIN must be ${t.gatewayHost}, not ${t.appBaseDomain}.`);let o=t.appHosts.filter(a=>!v(a,t.appBaseDomain));if(o.length>0)throw new c("INVALID_APP_HOST",`Refusing to publish ${o.join(", ")} on the gateway: app hosts are one label below ${t.appBaseDomain}.`);i.APP_BASE_DOMAIN={type:"text",value:t.appBaseDomain},r.domains=U(t);let s=(r.triggers??[]).filter(a=>a.type!=="fetch");if(s.length>0?r.triggers=s:delete r.triggers,r.workersDev=!1,r.previewUrls=!1,r.observability??=structuredClone(_),r.manifest){let a={...r.manifest.modules??{}};for(let w of await F(d.join(e,C)))a[w]={type:"sourcemap"};r.manifest={...r.manifest,modules:a}}return V(r,{requireDomain:!0}),await E.writeFile(n,`${JSON.stringify(r,null,2)}
+import{b as v}from"./chunk-W3JCQHHU.js";import{f as _}from"./chunk-ONLNJXVQ.js";import{Ab as O,Bb as c,Yb as h,Zb as S,zb as k}from"./chunk-LYNBZ7RV.js";import E from"node:fs/promises";import d from"node:path";import{OutputWorkerSchema as b}from"@cloudflare/config";import R from"node:fs/promises";import g from"node:path";var L=g.join(".cloudflare","output","v0"),A=g.join(L,"workers"),D="default";async function*ie(e){let t=g.join(e,A);for(let n of await R.readdir(t,{withFileTypes:!0})){if(!n.isDirectory())continue;let r=g.join(t,n.name),i=g.join(r,"worker.config.json"),o=JSON.parse(await R.readFile(i,"utf8"));yield{name:n.name,directory:r,file:i,config:o}}}async function oe(e){let t=JSON.parse(await R.readFile(g.join(e,"config.json"),"utf8"));return t.buildContext?.mode==="production"&&!t.buildContext.isPreview}var I=d.join(A,D),j=d.join(I,"worker.config.json"),C=d.join(I,"bundle"),N="__EVERYAPP_PATCH__",B="every-app-gateway";function U(e){return[e.gatewayHost,...[...new Set(e.appHosts)].filter(t=>t!==e.gatewayHost).sort()]}async function ge(e,t){let n=d.join(e,j),r=JSON.parse(await E.readFile(n,"utf8")),i={...r.env??{}};for(let a of Object.keys(i))a.startsWith(k)&&delete i[a];delete i.KV,i.DB={type:"d1",name:B,id:t.d1Id},i.OAUTH_KV={type:"kv",id:t.oauthKvId},i.EVERYAPP_RELEASE={type:"json",value:t.release},i.CF_VERSION_METADATA={type:"version-metadata"};for(let a of[...new Set(t.appWorkers)].sort())i[O(a)]={type:"worker",worker:a};if(r.env=i,t.gatewayHost!==t.appBaseDomain)throw new c("INVALID_APP_BASE_DOMAIN",`Apps live one label below the gateway host ${t.gatewayHost}, so APP_BASE_DOMAIN must be ${t.gatewayHost}, not ${t.appBaseDomain}.`);let o=t.appHosts.filter(a=>!v(a,t.appBaseDomain));if(o.length>0)throw new c("INVALID_APP_HOST",`Refusing to publish ${o.join(", ")} on the gateway: app hosts are one label below ${t.appBaseDomain}.`);i.APP_BASE_DOMAIN={type:"text",value:t.appBaseDomain},r.domains=U(t);let s=(r.triggers??[]).filter(a=>a.type!=="fetch");if(s.length>0?r.triggers=s:delete r.triggers,r.workersDev=!1,r.previewUrls=!1,r.observability??=structuredClone(_),r.manifest){let a={...r.manifest.modules??{}};for(let w of await F(d.join(e,C)))a[w]={type:"sourcemap"};r.manifest={...r.manifest,modules:a}}return V(r,{requireDomain:!0}),await E.writeFile(n,`${JSON.stringify(r,null,2)}
 `),r}function V(e,{requireDomain:t=!1}={}){let n=b.safeParse(e);if(!n.success)throw new c("INVALID_BUILD_OUTPUT",`The patched Worker config isn't valid Build Output: ${n.error.issues.map(r=>`${r.path.join(".")||"(root)"}: ${r.message}`).join("; ")}`);if(JSON.stringify(e).includes(N))throw new c("INVALID_BUILD_OUTPUT","The Worker config still has a deploy-time placeholder.");if(t&&!n.data.domains?.length)throw new c("INVALID_BUILD_OUTPUT","The gateway has no domain to deploy to.")}async function F(e){let t;try{t=await E.readdir(e,{recursive:!0,withFileTypes:!0})}catch{return[]}return t.filter(n=>n.isFile()&&n.name.endsWith(".map")).map(n=>d.relative(e,d.join(n.parentPath,n.name)).split(d.sep).join("/")).sort()}import{spawn as W}from"node:child_process";import{createHash as $}from"node:crypto";import m from"node:fs/promises";import p from"node:path";import{z as l}from"zod";var Se="every-app-gateway-release.tar.gz",x="v0",M={gateway:new Set([".cloudflare","drizzle","release.json"]),app:new Set([".cloudflare","migrations","release.json"])},H=l.looseObject({schema:l.literal(1),kind:l.string().optional(),version:l.string(),gitSha:l.string(),builtAt:l.string(),cfVersion:l.string(),buildOutputVersion:l.string(),sha256:l.string().regex(/^[0-9a-f]{64}$/),migrations:l.array(l.object({tag:l.string(),when:l.number()})),minCli:l.string(),minSdk:l.string()}),G=H.extend({committedAt:l.string().optional(),pluginVersion:l.string(),configVersion:l.string()});function _e({version:e,commit:t}){return t?`commit ${t.hash}${t.uncommittedChanges?" with uncommitted changes":""}`:e}function ve(e){switch(e.kind){case"checkout":return"this checkout";case"github":return`${e.repo} release ${e.tag}`;case"url":return e.url;case"file":return e.path}}async function K(e){let t=(await m.readdir(e,{recursive:!0,withFileTypes:!0})).filter(n=>n.isFile()).map(n=>p.relative(e,p.join(n.parentPath,n.name)).split(p.sep).join("/")).filter(n=>n!=="release.json");return z(e,t)}async function z(e,t){let n=$("sha256");for(let r of[...t].sort()){let i;try{i=await m.readFile(p.join(e,r))}catch(o){if(!h(o))throw o;n.update(`${r}\0-
 `);continue}n.update(`${r}\0${$("sha256").update(i).digest("hex")}
 `)}return n.digest("hex")}function J(e,t){return new Promise((n,r)=>{let i=W("tar",["-xzf",e,"-C",t],{stdio:"ignore"});i.once("error",r),i.once("close",o=>o===0?n():r(new Error(`tar couldn't extract ${e} (exit ${o})`)))})}async function Y(e,t,n){let r=await m.readdir(e,{recursive:!0,withFileTypes:!0});for(let i of r){let o=p.join(i.parentPath,i.name),s=p.relative(e,o).split(p.sep).join("/");if(i.isSymbolicLink()||!(i.isFile()||i.isDirectory()))throw new c("RELEASE_INVALID",`${t} isn't ${n}: ${s} is a link or a special file, not a regular file.`);if(i.isFile()&&(await m.lstat(o)).nlink>1)throw new c("RELEASE_INVALID",`${t} isn't ${n}: ${s} is a hard link, not a regular file.`)}}function q(e){return typeof e=="string"&&e.length>0&&!p.isAbsolute(e)&&!/[\\\0-\x1f]/.test(e)&&e.split("/").every(t=>t!==""&&t!=="."&&t!=="..")}async function X(e,t,n){let r=p.join(e,".cloudflare","output","v0","workers"),i;try{i=await m.readdir(r)}catch(o){if(h(o))return;throw o}for(let o of i){let s;try{s=JSON.parse(await m.readFile(p.join(r,o,"worker.config.json"),"utf8"))}catch(u){if(h(u))continue;throw u}let a=s?.manifest,f=[a?.mainModule,...Object.keys(a?.modules&&typeof a.modules=="object"?a.modules:{})].filter(u=>u!==void 0).find(u=>!q(u));if(f!==void 0)throw new c("RELEASE_INVALID",`${t} isn't ${n}: its ${o} Worker lists a module outside its bundle: ${String(f)}.`)}}var T={gateway:{a:"a gateway release",the:"Gateway release"},app:{a:"an app release",the:"App release"}};async function Z(e,t,n){let r=T[t],{dir:i,cleanup:o}=await S(`${t}-release-`);try{await J(e,i),await Y(i,e,r.a),await X(i,e,r.a);let s=JSON.parse(await m.readFile(p.join(i,"release.json"),"utf8")),a=s?.kind??"gateway";if(a!==t){let y=a==="app"||a==="gateway"?T[a].a:`a ${String(a)} release`;throw new c("RELEASE_INVALID",`${e} is ${y}, not ${t==="gateway"?"a Gateway release":r.a}.`)}let w=(await m.readdir(i)).filter(y=>!M[t].has(y));if(w.length>0)throw new c("RELEASE_INVALID",`${e} holds more than ${r.a}: ${w.join(", ")}.`);let f=n.safeParse(s);if(!f.success)throw new c("RELEASE_INVALID",`${e} isn't a valid ${r.the.toLowerCase()}

package/dist/{chunk-3AAHHUJC.js → chunk-6PGUCTJ6.js}

@@ -1,4 +1,4 @@
-import{d as o,f as s}from"./chunk-EUNGJMJ6.js";var r={sql:`CREATE TABLE IF NOT EXISTS _everyapp_restore_points (
+import{d as o,f as s}from"./chunk-HOUHG236.js";var r={sql:`CREATE TABLE IF NOT EXISTS _everyapp_restore_points (
   target TEXT PRIMARY KEY,
   database_id TEXT NOT NULL,
   bookmark TEXT NOT NULL,

package/dist/{chunk-QZWSSWMP.js → chunk-AGTCKFRB.js}

@@ -1,4 +1,4 @@
-import{a as Te,b as tt,c as nt,d as Le,e as q}from"./chunk-E3EPK27P.js";import{z as Me}from"./chunk-IG26HYRR.js";import{A as Q,B as Z,C as Xe,D as Ke,E as Qe,F as Ce,G as Ee,H as ve,I as De,J as Oe,K as ke,L as et,M as Pe,N as me,O as ct,b as Ae,c as We,d as je,e as we,f as Be,g as He,h as $e,i as Ve,k as Ye,l as ie,m as Ze,n as be,o as Se,p as qe,q as xe,r as ce,s as Ie,t as K,u as le,v as re,w as Y,x as de,y as Je,z as _e}from"./chunk-6O3GJS5H.js";import{a as oe}from"./chunk-Y3VIFPN5.js";import{c as it,e as ot}from"./chunk-EUNGJMJ6.js";import{$ as dt,B as rt,qa as pt,sa as mt,y as lt}from"./chunk-ZYL2ZHCF.js";import{a as pe,f as st,i as at}from"./chunk-F6IH47GT.js";import{c as H,f as V,gc as Re,ib as ae,jc as ne,k as A,oc as ue,tb as z,yb as Fe}from"./chunk-SAT3PGZU.js";import u from"chalk";var x="Every App gateway members",ut="Every App gateway",It="Every App apps",_t="720h",tn=24*3600,D="access.update";async function nn(t){await ue(t,e=>Dt({flags:t,out:e,emails:t.email,emailDomains:t["email-domain"],team:t.team,session:t.session,teamSession:t["team-session"],writeSettings:t["write-settings"]}))}async function sn(t){await ue(t,e=>Tt({flags:t,out:e,keepApplications:t["keep-applications"]}))}async function an(t){await ue(t,e=>Lt({flags:t,out:e}))}var Ct=/^[^\s@]+@[^\s@]+\.[^\s@]+$/,Et=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/,ht=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;function Ge({flags:t,out:e,createCf:s}){return mt({gateway:pt(t.gateway),accountId:t["account-id"],interactive:pe(t.json??!1),login:{json:t.json,out:e,step:"login"},createCf:s})}function ft(t){if(t.deploymentMode==="hosted")throw new z("ACCESS_HOSTED",`This Gateway can't be put behind Cloudflare Access
+import{a as Te,b as tt,c as nt,d as Le,e as q}from"./chunk-E3EPK27P.js";import{B as Me}from"./chunk-IFCPALVC.js";import{A as Q,B as Z,C as Xe,D as Ke,E as Qe,F as Ce,G as Ee,H as ve,I as De,J as Oe,K as ke,L as et,M as Pe,N as me,O as ct,b as Ae,c as We,d as je,e as we,f as Be,g as He,h as $e,i as Ve,k as Ye,l as ie,m as Ze,n as be,o as Se,p as qe,q as xe,r as ce,s as Ie,t as K,u as le,v as re,w as Y,x as de,y as Je,z as _e}from"./chunk-TLRM3P7V.js";import{a as oe}from"./chunk-4JRIS6S6.js";import{c as it,e as ot}from"./chunk-HOUHG236.js";import{$ as dt,B as rt,qa as pt,sa as mt,y as lt}from"./chunk-RMF4YGD6.js";import{a as pe,f as st,i as at}from"./chunk-CCWBPAKH.js";import{Bb as z,Gb as Fe,c as H,f as V,k as A,oc as Re,qb as ae,rc as ne,wc as ue}from"./chunk-LYNBZ7RV.js";import u from"chalk";var x="Every App gateway members",ut="Every App gateway",It="Every App apps",_t="720h",tn=24*3600,D="access.update";async function nn(t){await ue(t,e=>Dt({flags:t,out:e,emails:t.email,emailDomains:t["email-domain"],team:t.team,session:t.session,teamSession:t["team-session"],writeSettings:t["write-settings"]}))}async function sn(t){await ue(t,e=>Tt({flags:t,out:e,keepApplications:t["keep-applications"]}))}async function an(t){await ue(t,e=>Lt({flags:t,out:e}))}var Ct=/^[^\s@]+@[^\s@]+\.[^\s@]+$/,Et=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/,ht=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;function Ge({flags:t,out:e,createCf:s}){return mt({gateway:pt(t.gateway),accountId:t["account-id"],interactive:pe(t.json??!1),login:{json:t.json,out:e,step:"login"},createCf:s})}function ft(t){if(t.deploymentMode==="hosted")throw new z("ACCESS_HOSTED",`This Gateway can't be put behind Cloudflare Access
 Hosted Gateways ignore the Access settings.`)}function gt(t,e){let s=e.trim(),n=et(s);if(n===null||n<=0)throw new z("ACCESS_SESSION_INVALID",`${t} ${e} isn't a duration Access takes
 Use hours and minutes, like 720h or 2h30m.`);return s}async function yt(t,e){let s="(u.banned IS NULL OR u.banned = 0 OR (u.ban_expires IS NOT NULL AND u.ban_expires <= ?1))",[n=[],m=[],f=[]]=await t.run([{sql:`SELECT u.email FROM users u WHERE ${s} ORDER BY u.email`,params:[e]},{sql:"SELECT DISTINCT email FROM invitations WHERE status = 'pending' AND expires_at > ?1 ORDER BY email",params:[e]},{sql:`SELECT u.email FROM users u
 WHERE ${s}

package/dist/{chunk-EQX4GKJ2.js → chunk-CB4U7H2G.js}

@@ -1,4 +1,4 @@
-import{d as L}from"./chunk-ECLJ5IAL.js";import{A as x,E as T,O as y,P as h,Q as O,R as F,qa as k,sa as z,w as I}from"./chunk-ZYL2ZHCF.js";import{a as D}from"./chunk-F6IH47GT.js";import{c as v,f as A,hc as C}from"./chunk-SAT3PGZU.js";import u from"chalk";import f from"chalk";async function E(t){let{flags:e,out:l,createCf:i}=t,r=await z({gateway:k(e.gateway),accountId:e["account-id"],interactive:D(e.json??!1),login:{json:e.json,out:l,step:"login"},createCf:i});await x(r.db);let o=await L(r.db,e.org);return{gateway:r,organization:o}}function $(t){return t===null?f.dim("never"):new Date(t).toISOString().slice(0,16).replace("T"," ")}var d=t=>t===null?null:new Date(t).toISOString();function R(t){return t.sink==="email"?t.recipients==="owners"?"email \u2192 owners":"email \u2192 owners and admins":t.url?I(t.url):"(no URL)"}function B(t){return t.includes("*")?"everything":t.join(", ")}function X(t){return{id:t.id,name:t.name,sink:t.sink,target:R(t),recipients:t.recipients,events:t.events,enabled:t.enabled,builtin:t.builtin,createdAt:d(t.createdAt),createdBy:t.createdBy,lastDeliveryAt:d(t.lastDeliveryAt),lastDeliveryStatus:t.lastDeliveryStatus,consecutiveFailures:t.consecutiveFailures}}var H=t=>`${t.name} (${t.id})`;function N(t,e){let l=y(t,e),i=t.lastStatusCode!==null&&t.lastStatusCode>0?t.lastStatusCode:null,r=i===null?"":t.sink==="email"?`, ${i} mailed`:` ${i}`;switch(l){case"delivered":return f.green(`delivered${r}`);case"dead":return f.red("dead");case"failed":return f.yellow(`failed${r}, retrying`);default:return f.dim(t.attempts>0?"sending":"queued")}}function b(t,e){return{id:t.id,eventId:t.eventId,type:t.type,subscriptionId:t.subscriptionId,subscriptionName:t.subscriptionName,sink:t.sink,status:t.status,state:y(t,e),attempts:t.attempts,lastStatusCode:t.lastStatusCode,lastError:t.lastError,nextAttemptAt:d(t.nextAttemptAt),lastAttemptAt:d(t.lastAttemptAt),deliveredAt:d(t.deliveredAt),redeliveredAt:d(t.redeliveredAt),createdAt:d(t.createdAt)}}var S=t=>({id:t.id,name:t.name,slug:t.slug});var j=20;function et(t){let e=Number(t);if(!Number.isInteger(e)||e<1||e>h)throw new Error(`Use a whole number from 1 to ${h}.`);return e}var G=t=>{let e=t.lastError?.split(`
+import{d as L}from"./chunk-M2QQ2UD7.js";import{A as x,E as T,O as y,P as h,Q as O,R as F,qa as k,sa as z,w as I}from"./chunk-RMF4YGD6.js";import{a as D}from"./chunk-CCWBPAKH.js";import{c as v,f as A,pc as C}from"./chunk-LYNBZ7RV.js";import u from"chalk";import f from"chalk";async function E(t){let{flags:e,out:l,createCf:i}=t,r=await z({gateway:k(e.gateway),accountId:e["account-id"],interactive:D(e.json??!1),login:{json:e.json,out:l,step:"login"},createCf:i});await x(r.db);let o=await L(r.db,e.org);return{gateway:r,organization:o}}function $(t){return t===null?f.dim("never"):new Date(t).toISOString().slice(0,16).replace("T"," ")}var d=t=>t===null?null:new Date(t).toISOString();function R(t){return t.sink==="email"?t.recipients==="owners"?"email \u2192 owners":"email \u2192 owners and admins":t.url?I(t.url):"(no URL)"}function B(t){return t.includes("*")?"everything":t.join(", ")}function X(t){return{id:t.id,name:t.name,sink:t.sink,target:R(t),recipients:t.recipients,events:t.events,enabled:t.enabled,builtin:t.builtin,createdAt:d(t.createdAt),createdBy:t.createdBy,lastDeliveryAt:d(t.lastDeliveryAt),lastDeliveryStatus:t.lastDeliveryStatus,consecutiveFailures:t.consecutiveFailures}}var H=t=>`${t.name} (${t.id})`;function N(t,e){let l=y(t,e),i=t.lastStatusCode!==null&&t.lastStatusCode>0?t.lastStatusCode:null,r=i===null?"":t.sink==="email"?`, ${i} mailed`:` ${i}`;switch(l){case"delivered":return f.green(`delivered${r}`);case"dead":return f.red("dead");case"failed":return f.yellow(`failed${r}, retrying`);default:return f.dim(t.attempts>0?"sending":"queued")}}function b(t,e){return{id:t.id,eventId:t.eventId,type:t.type,subscriptionId:t.subscriptionId,subscriptionName:t.subscriptionName,sink:t.sink,status:t.status,state:y(t,e),attempts:t.attempts,lastStatusCode:t.lastStatusCode,lastError:t.lastError,nextAttemptAt:d(t.nextAttemptAt),lastAttemptAt:d(t.lastAttemptAt),deliveredAt:d(t.deliveredAt),redeliveredAt:d(t.redeliveredAt),createdAt:d(t.createdAt)}}var S=t=>({id:t.id,name:t.name,slug:t.slug});var j=20;function et(t){let e=Number(t);if(!Number.isInteger(e)||e<1||e>h)throw new Error(`Use a whole number from 1 to ${h}.`);return e}var G=t=>{let e=t.lastError?.split(`
 `)[0];return e?u.dim(e.length>60?`${e.slice(0,59)}\u2026`:e):""};async function nt(t,e){let{out:l,flags:i}=t,{gateway:r,organization:o}=await E(t),c=t.now?.()??Date.now(),n=e?await T(r.db,o,e):null,s=await O(r.db,{organizationId:o.id,...n?{subscriptionId:n.id}:{},dead:i.dead??!1,limit:i.limit??j,now:c}),m=n?` to ${n.name}`:"",p=i.dead?"dead ":"",g=s.length===0?`No ${p}deliveries${m} in the last 30 days`:s.length===1?`The last ${p}delivery${m}`:`The last ${s.length} ${p}deliveries${m}`,w=s.filter(a=>a.status==="dead");l.emit({type:"done",message:g,display:[...s.length===0?[u.dim(`${g}.`)]:[...C(["WHEN","DELIVERY","EVENT","TO","STATUS","TRIES","NEXT","LAST ERROR"],s.map(a=>[$(a.createdAt),a.id,a.type??u.dim("(expired)"),a.subscriptionName??u.dim(a.subscriptionId),N(a,c),String(a.attempts),a.status==="pending"&&a.nextAttemptAt!==null?$(a.nextAttemptAt):"",G(a)])),...w.length>0?["",u.dim(`Send a dead one again: ${v} events redeliver <delivery>`)]:[]]].join(`
 `),data:{organization:S(o),subscriptionId:n?.id??null,dead:i.dead??!1,deliveries:s.map(a=>b(a,c))}})}async function at(t,e){let{out:l}=t,{gateway:i,organization:r}=await E(t),o=t.now?.()??Date.now(),{delivery:c,previous:n,outcome:s}=await F(i.db,r,e,o),m=`${n.type??"the event"} to ${n.subscriptionName??n.subscriptionId}`,p=n.status==="dead"?`it was dead after ${A(n.attempts,"attempt")}`:`it was ${n.attempts>0?"failing":"queued"}`,g=s==="attempting"?`${n.id} is being sent right now. Nothing changed.`:s==="delivered"?`${n.id} was already delivered (${m}). Nothing changed.`:`Queued ${n.id} again (${m}; ${p}).`,w=s==="queued"?"The Gateway sends it within a minute, with the full retry schedule.":`See how it went: ${v} events deliveries ${n.subscriptionId}`;l.emit({type:"done",message:`${g} ${w}`,display:[g,u.dim(w)].join(`
 `),data:{outcome:s,delivery:b(c,o),previousStatus:n.status,organization:S(r)}})}export{E as a,$ as b,R as c,B as d,X as e,H as f,b as g,S as h,et as i,nt as j,at as k};

package/dist/{chunk-F6IH47GT.js → chunk-CCWBPAKH.js}

@@ -1,4 +1,4 @@
-import{Db as d,tb as g,vb as m}from"./chunk-SAT3PGZU.js";import{confirm as f,input as u,password as h,select as y}from"@inquirer/prompts";import t from"chalk";function A(e){return!!(process.stdin.isTTY&&process.stderr.isTTY)&&!e&&!process.env.CI}var a={prefix:{idle:t.cyan("?"),done:t.green("\u2714")},style:{message:(e,r)=>r==="done"?`${e} ${t.dim("\xB7")}`:t.bold(e),answer:e=>t.cyan(e),defaultAnswer:e=>t.dim(`(${e})`),highlight:e=>t.cyan(e),help:e=>t.dim(e),error:e=>t.red(`> ${e}`),description:e=>t.dim(e),keysHelpTip:()=>{}}};async function l({context:e=[]},r){d(),e.length>0&&process.stderr.write(`${e.map(n=>t.dim(n)).join(`
+import{Bb as g,Db as m,Lb as d}from"./chunk-LYNBZ7RV.js";import{confirm as f,input as u,password as h,select as y}from"@inquirer/prompts";import t from"chalk";function A(e){return!!(process.stdin.isTTY&&process.stderr.isTTY)&&!e&&!process.env.CI}var a={prefix:{idle:t.cyan("?"),done:t.green("\u2714")},style:{message:(e,r)=>r==="done"?`${e} ${t.dim("\xB7")}`:t.bold(e),answer:e=>t.cyan(e),defaultAnswer:e=>t.dim(`(${e})`),highlight:e=>t.cyan(e),help:e=>t.dim(e),error:e=>t.red(`> ${e}`),description:e=>t.dim(e),keysHelpTip:()=>{}}};async function l({context:e=[]},r){d(),e.length>0&&process.stderr.write(`${e.map(n=>t.dim(n)).join(`
 `)}
 `);try{return await r({output:process.stderr})}catch(n){throw n instanceof Error&&n.name==="ExitPromptError"?new m:n}}var T=(e,r)=>l({context:r},n=>f({message:e,default:!1,theme:a},n)),C=(e,r)=>l({context:r},n=>f({message:e,default:!0,theme:a},n));async function w(e,r,{context:n,cancelled:s}={}){if(!await e(r,n))throw new m(s)}function P(e,r,n={}){let s=Math.max(...r.map(i=>i.label.length));return l(n,i=>y({message:e,choices:r.map(o=>({name:o.hint?`${o.label.padEnd(s)}  ${t.dim(o.hint)}`:o.label,short:o.label,value:o.value})),theme:a},i))}function E(e,r={}){let{validate:n}=r;return l(r,s=>u({message:e,...r.initial?{default:r.initial}:{},...n?{validate:i=>n(i)??!0}:{},theme:a},s))}function $(e,r={}){let n="";return l(r,s=>h({message:e,mask:!1,toggleMask:!1,validate:i=>(n=i,i.trim()||r.optional?!0:"Enter a value."),theme:{...a,style:{...a.style,maskedText:"(hidden)",answer:()=>n.trim()?t.dim("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"):t.dim("skipped")}}},s))}function I(e){d(),process.stderr.write(`${e}
 `)}async function R({yes:e,interactive:r,confirm:n=T,question:s,unattended:i,context:o,cancelled:p,data:c}){if(!e){if(!r)throw new g("CONFIRMATION_REQUIRED",i,c?{data:c}:{});await w(n,s,{context:o,cancelled:p})}}export{A as a,T as b,C as c,w as d,P as e,E as f,$ as g,I as h,R as i};

package/dist/{chunk-YJBYZWSP.js → chunk-CZTEDWZ2.js}

@@ -1,4 +1,4 @@
-import{b as O,c as Ce,d as Se,e as $e,f as Ae}from"./chunk-N4E5YE4X.js";import{g as de}from"./chunk-QZWSSWMP.js";import{e as q}from"./chunk-E3EPK27P.js";import{y as me}from"./chunk-IG26HYRR.js";import{a as he,b as ve,c as T,d as ke,e as De}from"./chunk-IZEOAOKL.js";import{c as we,j as fe,k as ge,n as M,o as ye}from"./chunk-KMAOZRV4.js";import{c as P,i as L}from"./chunk-PMPIMHKG.js";import{e as I,g as be,h as N,i as _}from"./chunk-OVKVV6MK.js";import{a as G}from"./chunk-RFVMR32Y.js";import{g as ue}from"./chunk-GRFPP4UW.js";import{a as Y}from"./chunk-Y3VIFPN5.js";import{a as R,j as oe,s as ie,u as le,v as ce}from"./chunk-ZYL2ZHCF.js";import{c as ne,d as se,f as re}from"./chunk-7LG3F4FF.js";import{b as X,c as J,e as Q,f as ee,g as te}from"./chunk-F6IH47GT.js";import{Lb as x,Ub as Z,Vb as K,b as E,bc as U,c as S,d as W,dc as ae,e as H,ib as V,ic as pe,tb as C,ub as D,vb as B,xb as z}from"./chunk-SAT3PGZU.js";import{z as b}from"zod";var Fe=b.array(b.looseObject({state:b.string().nullish(),rate_plan:b.looseObject({id:b.string().nullish(),public_name:b.string().nullish()}).nullish(),product:b.looseObject({name:b.string().nullish()}).nullish()}));var We=/cancel|expired|failed/i;async function Ee(t){let n;try{n=await K(t,{plane:"account",args:["accounts","subscriptions","get"]},Fe)}catch{return"unreadable"}let a=n.filter(e=>!We.test(e.state??"")).map(e=>[e.rate_plan?.id,e.rate_plan?.public_name,e.product?.name].filter(Boolean).join(" ")).filter(e=>/workers/i.test(e));return a.some(e=>/paid|standard|bundled|unbound/i.test(e))?"paid":a.some(e=>/free/i.test(e))?"free":"unknown"}import{setTimeout as xe}from"node:timers/promises";var Ue=6e5,Le=3e3,Me=15e3;function je(t){let n=o=>[...t].filter(([,l])=>l===o).map(([l])=>l),a=[],e=n("tls");e.length>0&&a.push(`Waiting for ${e.length===1?"a certificate":"certificates"}: ${e.join(", ")}`);let s=n("dns");s.length>0&&a.push(`Waiting for DNS: ${s.join(", ")} ${s.length===1?"has":"have"} no record at the zone's nameservers yet`);let r=n("other");return r.length>0&&a.push(`Waiting for ${r.map(o=>`https://${o}`).join(", ")} to answer`),a.join("; ")}async function F({hosts:t,out:n,step:a,maxWaitMs:e=Ue,pollMs:s=Le,progressEveryMs:r=Me,probe:o,localDns:l=o?void 0:ke,sleep:m=xe,now:p=Date.now}){let u=p(),w=[],c=[],i=[...new Set(t)],y=null,f=o??(h=>T(h));for(;i.length>0;){let h=await Promise.all(i.map(v=>f(`https://${v}/`))),d=new Map;for(let[v,k]of i.entries()){let $=h[v];if(!$.answered){d.set(k,$.kind);continue}w.push(k),n.emit({type:"progress",step:a,message:`https://${k} has its certificate.`,data:{host:k}}),l&&await De({host:k,lead:`https://${k} has its certificate and the gateway serves it`,out:n,step:a,localDns:l})&&c.push(k)}if(i=[...d.keys()],i.length===0)break;let g=p()-u;if(g>=e){n.emit({type:"warning",code:"CERT_PENDING",step:a,message:`${i.map(v=>`https://${v}`).join(", ")} ${i.length===1?"has":"have"} no certificate after ${ae(g)}. It usually comes within five minutes; the gateway serves ${i.length===1?"it":"them"} as soon as it does. If it never comes, check the zone's CAA records allow Cloudflare's certificate authorities. Check later with \`${S} status\`.`,data:{hosts:i}});break}(y===null||p()-y>=r)&&(n.emit({type:"progress",step:a,message:`${je(d)} (usually under five minutes)...`,data:{hosts:i,waitedMs:g,waitingFor:Object.fromEntries(d)}}),y=p()),await m(s)}return{ready:w,pending:i,staleLocally:c}}async function Re({cf:t,accountId:n,install:a,domain:e,out:s}){if(a&&(a.liveVersionId!==null||a.gatewayHost===e)){if(a.gatewayHost!==e)throw new C("DOMAIN_CHANGE_UNSUPPORTED",`The Gateway can't move to ${e}
+import{b as O,c as Ce,d as Se,e as $e,f as Ae}from"./chunk-N4E5YE4X.js";import{g as de}from"./chunk-AGTCKFRB.js";import{e as q}from"./chunk-E3EPK27P.js";import{A as me}from"./chunk-IFCPALVC.js";import{a as he,b as ve,c as T,d as ke,e as De}from"./chunk-2Y5Q6A5K.js";import{c as we,j as fe,k as ge,n as M,o as ye}from"./chunk-H6QQMY7B.js";import{c as P,i as L}from"./chunk-6OGVO7QK.js";import{e as I,g as be,h as N,i as _}from"./chunk-N5GQLGEC.js";import{a as G}from"./chunk-W3JCQHHU.js";import{g as ue}from"./chunk-ZFCUH5PK.js";import{a as Y}from"./chunk-4JRIS6S6.js";import{a as R,j as oe,s as ie,u as le,v as ce}from"./chunk-RMF4YGD6.js";import{c as ne,d as se,f as re}from"./chunk-T2GD7RHS.js";import{b as X,c as J,e as Q,f as ee,g as te}from"./chunk-CCWBPAKH.js";import{Bb as C,Cb as D,Db as B,Fb as z,Tb as x,ac as Z,b as E,bc as K,c as S,d as W,e as H,jc as U,lc as ae,qb as V,qc as pe}from"./chunk-LYNBZ7RV.js";import{z as b}from"zod";var Fe=b.array(b.looseObject({state:b.string().nullish(),rate_plan:b.looseObject({id:b.string().nullish(),public_name:b.string().nullish()}).nullish(),product:b.looseObject({name:b.string().nullish()}).nullish()}));var We=/cancel|expired|failed/i;async function Ee(t){let n;try{n=await K(t,{plane:"account",args:["accounts","subscriptions","get"]},Fe)}catch{return"unreadable"}let a=n.filter(e=>!We.test(e.state??"")).map(e=>[e.rate_plan?.id,e.rate_plan?.public_name,e.product?.name].filter(Boolean).join(" ")).filter(e=>/workers/i.test(e));return a.some(e=>/paid|standard|bundled|unbound/i.test(e))?"paid":a.some(e=>/free/i.test(e))?"free":"unknown"}import{setTimeout as xe}from"node:timers/promises";var Ue=6e5,Le=3e3,Me=15e3;function je(t){let n=o=>[...t].filter(([,l])=>l===o).map(([l])=>l),a=[],e=n("tls");e.length>0&&a.push(`Waiting for ${e.length===1?"a certificate":"certificates"}: ${e.join(", ")}`);let s=n("dns");s.length>0&&a.push(`Waiting for DNS: ${s.join(", ")} ${s.length===1?"has":"have"} no record at the zone's nameservers yet`);let r=n("other");return r.length>0&&a.push(`Waiting for ${r.map(o=>`https://${o}`).join(", ")} to answer`),a.join("; ")}async function F({hosts:t,out:n,step:a,maxWaitMs:e=Ue,pollMs:s=Le,progressEveryMs:r=Me,probe:o,localDns:l=o?void 0:ke,sleep:m=xe,now:p=Date.now}){let u=p(),w=[],c=[],i=[...new Set(t)],y=null,f=o??(h=>T(h));for(;i.length>0;){let h=await Promise.all(i.map(v=>f(`https://${v}/`))),d=new Map;for(let[v,k]of i.entries()){let $=h[v];if(!$.answered){d.set(k,$.kind);continue}w.push(k),n.emit({type:"progress",step:a,message:`https://${k} has its certificate.`,data:{host:k}}),l&&await De({host:k,lead:`https://${k} has its certificate and the gateway serves it`,out:n,step:a,localDns:l})&&c.push(k)}if(i=[...d.keys()],i.length===0)break;let g=p()-u;if(g>=e){n.emit({type:"warning",code:"CERT_PENDING",step:a,message:`${i.map(v=>`https://${v}`).join(", ")} ${i.length===1?"has":"have"} no certificate after ${ae(g)}. It usually comes within five minutes; the gateway serves ${i.length===1?"it":"them"} as soon as it does. If it never comes, check the zone's CAA records allow Cloudflare's certificate authorities. Check later with \`${S} status\`.`,data:{hosts:i}});break}(y===null||p()-y>=r)&&(n.emit({type:"progress",step:a,message:`${je(d)} (usually under five minutes)...`,data:{hosts:i,waitedMs:g,waitingFor:Object.fromEntries(d)}}),y=p()),await m(s)}return{ready:w,pending:i,staleLocally:c}}async function Re({cf:t,accountId:n,install:a,domain:e,out:s}){if(a&&(a.liveVersionId!==null||a.gatewayHost===e)){if(a.gatewayHost!==e)throw new C("DOMAIN_CHANGE_UNSUPPORTED",`The Gateway can't move to ${e}
 It's installed at ${a.gatewayHost}, and moving an installed Gateway isn't supported.`,{rerun:H("--domain"),rerunNote:"(without --domain) to update it where it is"});return{domain:e,zone:{id:a.zoneId,name:a.zoneName},appBaseDomain:a.appBaseDomain}}let r=await He(t,e,n);return Ve(e,r,s),{domain:e,zone:r,appBaseDomain:e}}async function He(t,n,a){let e=await be(t,n,a);if(!e){let s=(await _(t,a)).filter(r=>!r.status||r.status==="active").map(r=>r.name);throw new C("ZONE_NOT_FOUND",`${n} isn't under a domain in this Cloudflare account${s.length>0?`
 This account's domains: ${s.join(", ")}`:""}`,{fix:s.length>0?`use a name under one of them, or add ${n}'s domain to Cloudflare`:`add ${n}'s domain to Cloudflare`,data:{url:I(a),zones:s}})}if(e.status&&e.status!=="active")throw new D("add_domain",`Finish activating ${e.name} on Cloudflare
 Its nameservers don't point at Cloudflare yet.`,N(a,e.name),{data:{zone:e.name,status:e.status}});return{id:e.id,name:e.name}}async function Pe({cf:t,out:n,reason:a,release:e,accountId:s,target:r,interactive:o,...l}){let{certificates:m,...p}=l,u=await ie(t);n.emit({type:"step",step:"gateway.resources",status:"ok",message:u.created.length?`Created ${u.created.join(", ")}`:"The Gateway's database and KV namespace are there"});let w=R(t,u.d1Id),c=await ye({cf:t,out:n,reason:a,release:e,accountId:s,gatewayHost:r.domain,zone:r.zone,appBaseDomain:r.appBaseDomain,resources:u,db:w,interactive:o,cliVersion:E,...p});return await F({hosts:c.newHosts,out:n,step:"gateway.tls",...m}),{result:c,db:w}}function Ve(t,n,a){t===n.name&&a.emit({type:"warning",code:"GATEWAY_AT_ZONE_APEX",message:`The Gateway's sign-in cookie will cover every subdomain of ${n.name}

package/dist/{chunk-74EST4VW.js → chunk-CZXHKPRZ.js}

@@ -1,2 +1,2 @@
-import{i as d}from"./chunk-DQWOXSL3.js";import{e as g,f as c}from"./chunk-GD2JZMD3.js";import{a as m,e as y}from"./chunk-JYKRUS5C.js";import{Ob as a,Vb as l,hb as p}from"./chunk-SAT3PGZU.js";import e from"node:path";var u=".cloudflare/state",A=6e5;async function L(i,t){let r=t.resources?.d1??[];if(r.length===0)return{status:"skipped",reason:"no_d1"};let o=g(r,t.migrations),n=c(t);return await a(e.resolve(i,n))?{status:"found",binding:o,dir:n}:{status:"skipped",reason:"no_migrations_dir"}}async function b({cwd:i,manifest:t,cf:r,onApply:o}){let n=await L(i,t);return n.status==="skipped"?n:(o?.(),{status:"applied",...await R({cwd:i,manifest:t,cf:r,...n})})}async function R({cwd:i,manifest:t,cf:r,binding:o,dir:n}){let s=d(p(t.id),o);return{applied:(await l(r,{plane:"project",cwd:i,local:!0,timeoutMs:A,env:f(i),args:["d1","migrations","apply",s,"--local","--persist-to",u,"--dir",n]},m)).map(M=>M.name),database:s}}async function k({cwd:i,manifest:t,cf:r}){let o=g(t.resources?.d1??[],t.migrations);return(await l(r,{plane:"project",cwd:i,local:!0,env:f(i),args:["d1","migrations","list",d(p(t.id),o),"--local","--persist-to",u,"--dir",c(t)]},y)).map(s=>s.Name)}function f(i){let t=e.join(i,".everyapp","registry");return{CLOUDFLARE_REGISTRY_PATH:t,MINIFLARE_REGISTRY_PATH:t}}async function I(i){let t=await a(e.join(i,".wrangler","state")),r=await a(e.join(i,u));return!t||r?null:`Local data now lives in .cloudflare/state
+import{i as d}from"./chunk-ONLNJXVQ.js";import{e as g,f as c}from"./chunk-H7PDL3X5.js";import{a as m,e as y}from"./chunk-JYKRUS5C.js";import{Wb as a,bc as l,pb as p}from"./chunk-LYNBZ7RV.js";import e from"node:path";var u=".cloudflare/state",A=6e5;async function L(i,t){let r=t.resources?.d1??[];if(r.length===0)return{status:"skipped",reason:"no_d1"};let o=g(r,t.migrations),n=c(t);return await a(e.resolve(i,n))?{status:"found",binding:o,dir:n}:{status:"skipped",reason:"no_migrations_dir"}}async function b({cwd:i,manifest:t,cf:r,onApply:o}){let n=await L(i,t);return n.status==="skipped"?n:(o?.(),{status:"applied",...await R({cwd:i,manifest:t,cf:r,...n})})}async function R({cwd:i,manifest:t,cf:r,binding:o,dir:n}){let s=d(p(t.id),o);return{applied:(await l(r,{plane:"project",cwd:i,local:!0,timeoutMs:A,env:f(i),args:["d1","migrations","apply",s,"--local","--persist-to",u,"--dir",n]},m)).map(M=>M.name),database:s}}async function k({cwd:i,manifest:t,cf:r}){let o=g(t.resources?.d1??[],t.migrations);return(await l(r,{plane:"project",cwd:i,local:!0,env:f(i),args:["d1","migrations","list",d(p(t.id),o),"--local","--persist-to",u,"--dir",c(t)]},y)).map(s=>s.Name)}function f(i){let t=e.join(i,".everyapp","registry");return{CLOUDFLARE_REGISTRY_PATH:t,MINIFLARE_REGISTRY_PATH:t}}async function I(i){let t=await a(e.join(i,".wrangler","state")),r=await a(e.join(i,u));return!t||r?null:`Local data now lives in .cloudflare/state
 Rows in the old .wrangler/state database weren't copied over.`}export{L as a,b,R as c,k as d,f as e,I as f};

package/dist/{chunk-NJFWEYX7.js → chunk-EGEWRFVY.js}

@@ -1 +1 @@
-import{r as p,s as u,u as f,v as d}from"./chunk-JYKRUS5C.js";import{Vb as i,Wb as c,zb as a}from"./chunk-SAT3PGZU.js";var l=20,g=10;async function y(n){let r=new Map;for(let e=1;e<=g;e+=1){let o=await i(n,{plane:"account",args:["hyperdrive","list","--per-page",String(l),"--page",String(e)]},d),t=r.size;for(let s of o)r.set(s.id,s);if(o.length<l||r.size===t)break}return[...r.values()]}async function H(n,r){return(await y(n)).find(e=>e.name===r)??null}async function b(n,r,e,o="off"){return(await i(n,{plane:"account",files:{"hyperdrive.json":{name:r,origin:e,...o==="off"?{caching:{disabled:!0}}:{}}},args:s=>["hyperdrive","create","--body",`@${s["hyperdrive.json"]}`]},f)).id}async function P(n,r,e){let o={...e.origin?{origin:e.origin}:{},...e.caching?{caching:{disabled:e.caching==="off"}}:{}};await i(n,{plane:"account",files:{"hyperdrive.json":o},args:t=>["hyperdrive","update",r,"--body",`@${t["hyperdrive.json"]}`]},f)}async function k(n,r){await n.run({plane:"account",mode:"json",args:["hyperdrive","delete",r,"--force"]})}function x(n,r){return n.caching?.disabled===!0==(r==="off")}function R(n,r){let e=n.origin;return e?.host===r.host&&(e.port??null)===r.port&&e.database===r.database&&e.user===r.user}var v=100,w=50;async function S(n,r){try{return await i(n,{plane:"account",args:["workflows","get",r]},p)}catch(e){if(a(e,"not_found"))return null;throw e}}function j(n,r){return c(n,["workflows","list","--search",r],u,{perPage:v,maxPages:w})}async function C(n,r){await n.run({plane:"account",mode:"json",args:["workflows","delete",r,"--force"]})}async function _(n,r){try{return await C(n,r),!0}catch(e){if(a(e,"not_found"))return!1;throw e}}export{y as a,H as b,b as c,P as d,k as e,x as f,R as g,S as h,j as i,_ as j};
+import{r as p,s as u,u as f,v as d}from"./chunk-JYKRUS5C.js";import{Hb as a,bc as i,cc as c}from"./chunk-LYNBZ7RV.js";var l=20,g=10;async function y(n){let r=new Map;for(let e=1;e<=g;e+=1){let o=await i(n,{plane:"account",args:["hyperdrive","list","--per-page",String(l),"--page",String(e)]},d),t=r.size;for(let s of o)r.set(s.id,s);if(o.length<l||r.size===t)break}return[...r.values()]}async function H(n,r){return(await y(n)).find(e=>e.name===r)??null}async function b(n,r,e,o="off"){return(await i(n,{plane:"account",files:{"hyperdrive.json":{name:r,origin:e,...o==="off"?{caching:{disabled:!0}}:{}}},args:s=>["hyperdrive","create","--body",`@${s["hyperdrive.json"]}`]},f)).id}async function P(n,r,e){let o={...e.origin?{origin:e.origin}:{},...e.caching?{caching:{disabled:e.caching==="off"}}:{}};await i(n,{plane:"account",files:{"hyperdrive.json":o},args:t=>["hyperdrive","update",r,"--body",`@${t["hyperdrive.json"]}`]},f)}async function k(n,r){await n.run({plane:"account",mode:"json",args:["hyperdrive","delete",r,"--force"]})}function x(n,r){return n.caching?.disabled===!0==(r==="off")}function R(n,r){let e=n.origin;return e?.host===r.host&&(e.port??null)===r.port&&e.database===r.database&&e.user===r.user}var v=100,w=50;async function S(n,r){try{return await i(n,{plane:"account",args:["workflows","get",r]},p)}catch(e){if(a(e,"not_found"))return null;throw e}}function j(n,r){return c(n,["workflows","list","--search",r],u,{perPage:v,maxPages:w})}async function C(n,r){await n.run({plane:"account",mode:"json",args:["workflows","delete",r,"--force"]})}async function _(n,r){try{return await C(n,r),!0}catch(e){if(a(e,"not_found"))return!1;throw e}}export{y as a,H as b,b as c,P as d,k as e,x as f,R as g,S as h,j as i,_ as j};

package/dist/{chunk-OEOVNJAN.js → chunk-ELK7QZ2M.js}

@@ -1 +1 @@
-import{e as m,f as d}from"./chunk-ECLJ5IAL.js";import{qa as l,sa as p}from"./chunk-ZYL2ZHCF.js";import{a as i}from"./chunk-F6IH47GT.js";import{tb as o}from"./chunk-SAT3PGZU.js";import s from"chalk";async function b(e){let{flags:t,out:r,createCf:n}=e,a=await p({gateway:l(t.gateway),accountId:t["account-id"],interactive:i(t.json??!1),login:{json:t.json,out:r,step:"login"},createCf:n}),g=await m(a.db,a.deployer,{org:t.org,now:e.now?.()});return{gateway:a,ws:g,gatewayUrl:a.gatewayUrl}}function x(e){return e.interactive??i(e.flags.json??!1)}async function W(e,t){try{let r=await d(e,t);return{id:r.id,email:r.email,member:!0}}catch(r){if(!(r instanceof o)||r.code!=="USER_NOT_FOUND"||t.includes("@"))throw r;return{id:t.trim(),email:null,member:!1}}}var v=e=>e.member?e.email??e.id:`${e.id} (no longer a member)`;function F(e){return e===null?s.dim("never"):new Date(e).toISOString().slice(0,16).replace("T"," ")}var c=e=>e===null?null:new Date(e).toISOString();function C(e){return e.deactivated?s.yellow("deactivated"):s.green("active")}function h(e){return{id:e.id,email:e.email,name:e.name,role:e.primaryRole??e.role,deactivated:e.deactivated,createdAt:c(e.createdAt)}}function O(e){return{id:e.id,email:e.email,role:e.role,status:e.status,expiresAt:c(e.expiresAt),expired:!e.live&&e.status==="pending",createdAt:c(e.createdAt)}}function A(e){let{add:t,remove:r,set:n}=e;if(n&&(t||r))throw new o("FLAGS_CONFLICT","--set replaces the whole list: give it alone, or --add and --remove without it");return!t&&!r&&!n?{change:null}:{change:{add:t,remove:r,set:n}}}export{b as a,x as b,W as c,v as d,F as e,c as f,C as g,h,O as i,A as j};
+import{e as m,f as d}from"./chunk-M2QQ2UD7.js";import{qa as l,sa as p}from"./chunk-RMF4YGD6.js";import{a as i}from"./chunk-CCWBPAKH.js";import{Bb as o}from"./chunk-LYNBZ7RV.js";import s from"chalk";async function b(e){let{flags:t,out:r,createCf:n}=e,a=await p({gateway:l(t.gateway),accountId:t["account-id"],interactive:i(t.json??!1),login:{json:t.json,out:r,step:"login"},createCf:n}),g=await m(a.db,a.deployer,{org:t.org,now:e.now?.()});return{gateway:a,ws:g,gatewayUrl:a.gatewayUrl}}function x(e){return e.interactive??i(e.flags.json??!1)}async function W(e,t){try{let r=await d(e,t);return{id:r.id,email:r.email,member:!0}}catch(r){if(!(r instanceof o)||r.code!=="USER_NOT_FOUND"||t.includes("@"))throw r;return{id:t.trim(),email:null,member:!1}}}var v=e=>e.member?e.email??e.id:`${e.id} (no longer a member)`;function F(e){return e===null?s.dim("never"):new Date(e).toISOString().slice(0,16).replace("T"," ")}var c=e=>e===null?null:new Date(e).toISOString();function C(e){return e.deactivated?s.yellow("deactivated"):s.green("active")}function h(e){return{id:e.id,email:e.email,name:e.name,role:e.primaryRole??e.role,deactivated:e.deactivated,createdAt:c(e.createdAt)}}function O(e){return{id:e.id,email:e.email,role:e.role,status:e.status,expiresAt:c(e.expiresAt),expired:!e.live&&e.status==="pending",createdAt:c(e.createdAt)}}function A(e){let{add:t,remove:r,set:n}=e;if(n&&(t||r))throw new o("FLAGS_CONFLICT","--set replaces the whole list: give it alone, or --add and --remove without it");return!t&&!r&&!n?{change:null}:{change:{add:t,remove:r,set:n}}}export{b as a,x as b,W as c,v as d,F as e,c as f,C as g,h,O as i,A as j};

package/dist/{chunk-G64S77GC.js → chunk-FJJSSVET.js}

@@ -1,33 +1,33 @@
-import{a as ir,b as or,c as ar,d as dr,f as be}from"./chunk-RQFHVU3Y.js";import{b as cr,c as lr}from"./chunk-5ZTFC6DK.js";import{a as rr,d as nr,e as he}from"./chunk-YJBYZWSP.js";import{a as sr,b as pr}from"./chunk-BHMRY53V.js";import{b as Dt}from"./chunk-IG26HYRR.js";import{a as Ct}from"./chunk-IA534DGW.js";import{a as Et,b as At,d as me,e as It,m as St,p as Nt}from"./chunk-MDORVBPD.js";import{a as zt,b as Bt,c as Kt,d as Ft,e as Ht}from"./chunk-MC56CUQI.js";import{b as Zt,c as Qt,d as Xt,f as er,g as we,h as ye,j as tr}from"./chunk-NJFWEYX7.js";import{d as Mt,e as xt,f as Ut,g as Wt,m as jt}from"./chunk-KMAOZRV4.js";import{n as Gt}from"./chunk-PMPIMHKG.js";import{a as Vt,b as qt,c as Yt,d as Jt,g as ge}from"./chunk-3Z53CH4F.js";import{P as ct}from"./chunk-6O3GJS5H.js";import{c as Ot,e as fe,f as $t}from"./chunk-GRFPP4UW.js";import{a as _,b as F,e as de,f as T,g as kt,h as W}from"./chunk-PL6EORDJ.js";import{c as $,d as _t,g as H,h as Tt}from"./chunk-DQWOXSL3.js";import{b as Lt}from"./chunk-3AAHHUJC.js";import{g as pt}from"./chunk-EUNGJMJ6.js";import{$ as gt,ga as wt,ia as yt,ja as ht,m as lt,n as dt,o as mt,p as ft,qa as bt,sa as Rt,u as ut}from"./chunk-ZYL2ZHCF.js";import{f as le}from"./chunk-7LG3F4FF.js";import{a as Y,e as Pt,f as ue}from"./chunk-GD2JZMD3.js";import{a as ot,b as at,h as st}from"./chunk-F6IH47GT.js";import{H as Ke,Kb as et,Ob as ce,Qb as tt,Tb as rt,Xb as nt,Zb as it,b as se,bb as Fe,c as N,d as O,fb as He,gb as Ve,k as pe,kb as qe,lb as Ye,oc as vt,tb as d,ub as Je,vb as Ze,wb as Qe,xb as Xe,zb as K}from"./chunk-SAT3PGZU.js";import Or from"node:path";import Wr from"chalk";async function mr({whoami:e,discovery:i,out:n,offer:t}){let{deps:a}=t,o=t.accountId?["--account-id",t.accountId]:[];if(!a.interactive){let f=await Gr(e,t).catch(()=>null),u=[N,"setup","--domain",f??"<hostname>",...o].join(" ");throw new Je("install_gateway",`Install a Gateway first: ${jr(i)}
-Apps deploy behind one. Setup needs a person once, to create the owner account.`,void 0,{rerun:u,data:{accounts:i.probed,...f?{domain:f}:{}}})}let r=await le({whoami:e,flag:t.accountId,interactive:!0}),s=r.name??r.id,l=await he(a.createCf(r.id),r.id),g=`apps.${l.length===1?l[0]:await a.prompts.pickZone(l)}`;if(t.yes)st(Wr.dim(`${s} has no Gateway yet, so --yes installs one at ${g} first.`));else if(!await(t.confirm??at)(`Install a Gateway at ${g}?`,[`${s} has no Gateway yet. Apps deploy behind one, so it's installed first.`]))throw new Ze(`Cancelled. Nothing deployed.
-Apps deploy behind a Gateway. To install one elsewhere: ${[N,"setup","--domain","<hostname>",...o].join(" ")}`);return await nr({whoami:e,discovery:i,flags:{domain:g,"account-id":r.id,"force-dns":t.forceDns,yes:t.yes,verbose:t.verbose},out:n,deps:a}),ut({whoami:e,createCf:a.createCf,accountId:r.id,interactive:!0})}async function Gr(e,i){let n=await le({whoami:e,flag:i.accountId,interactive:!1});return`apps.${(await he(i.deps.createCf(n.id),n.id))[0]}`}function jr(e){let i=e.probed.map(n=>n.name??n.id);return i.length===1?`${i[0]} has none yet`:`none of ${i.join(", ")} has one yet`}import zr from"node:fs/promises";var fr=64,Br=["d1","kv","hyperdrive","r2"];function Kr(e){return Br.includes(e)}function Fr(e,i){let n=structuredClone(e),t=n.name===$.workerName,a=n.env??{};for(let[l,m]of Object.entries(a))Hr(l,m,i);i.shared&&a.EVERY_APP_ORG_ID&&(delete a.EVERY_APP_ORG_ID,a.EVERYAPP_SHARED={type:"text",value:"1"});let o=JSON.stringify([$.publicKey]),r=Re(n,l=>l===o?JSON.stringify(i.identityPublicKeys):l.replaceAll($.gatewayUrl,()=>i.gatewayUrl).replaceAll($.organizationId,()=>i.organizationId).replaceAll($.workerName,()=>i.workerName));if(t&&i.deletedDurableObjects?.length){let l=r.exports??={};for(let m of i.deletedDurableObjects){if(l[m])throw new d("APP_POLICY",`Durable Object class ${m} is both exported by the build and being deleted; declare it in everyapp.config.ts, or stop exporting it.`);l[m]={type:"durable-object",state:"deleted"}}}let s=gr(r);if(s.length>0)throw new d("INSTALL_PLACEHOLDER_LEFT",`The build of ${String(r.name)} still holds a build placeholder after installing it, at ${s.join(", ")}. Build the Worker from everyAppWorker() in cloudflare.config.ts, and leave its names, keys and ids to the deploy.`);return Vr(r),r}async function ur({cwd:e,target:i}){for await(let{file:n,config:t}of Gt(e))await zr.writeFile(n,`${JSON.stringify(Fr(t,i),null,2)}
-`)}function Hr(e,i,n){let t=String(i.type);if(!Kr(t))return;let a=_t(e);if(i[t==="d1"||t==="r2"?"name":"id"]!==a)return;let r=n.resources[t]?.[e];if(!r)throw new d("INSTALL_INPUTS_MISSING",`The build binds ${_[t]} ${e}, which the deploy didn't provision`,{fix:"declare it in everyapp.config.ts's resources"});Object.assign(i,r)}function Re(e,i){return typeof e=="string"?i(e):Array.isArray(e)?e.map(n=>Re(n,i)):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([n,t])=>[n,Re(t,i)])):e}function gr(e,i=""){let n=[$.workerName,$.organizationId,$.gatewayUrl,$.publicKey].flatMap(a=>[a,JSON.stringify(a).slice(1,-1)]),t=a=>n.some(o=>a.includes(o));return typeof e=="string"?t(e)?[i||"(root)"]:[]:e&&typeof e=="object"?Object.entries(e).flatMap(([a,o])=>{let r=i?`${i}.${a}`:a;return t(a)?[r]:gr(o,r)}):[]}function Vr(e){let i=[...Object.entries(e.env??{}),...Object.entries(e.exports??{})].filter(([,n])=>n.type==="workflow");for(let[n,t]of i){let a=String(t.name);if(a.length>fr)throw new d("WORKFLOW_NAME_TOO_LONG",`${n} would be the Workflow "${a}", longer than Cloudflare's ${fr} characters`,{fix:"shorten its binding name in everyapp.config.ts"})}}import qr from"node:fs/promises";import wr from"node:path";import{parseEnv as Yr}from"node:util";var I=".everyapp/secrets.env",A="POSTGRES_DATABASE_URL";async function yr(e){let i;try{i=await qr.readFile(wr.join(e,I),"utf8")}catch(t){if(tt(t))return{};throw t}ir(e,`${wr.dirname(I)}/`);let n={};for(let[t,a]of Object.entries(Yr(i)))a?.trim()&&(n[t]=a.trim());return n}function ve(e){return`${e}_ORIGIN_URL`}function hr(e,i,n){let t=ve(n);return e[t]?{url:e[t],variable:t}:(i.resources?.hyperdrive??[]).length===1&&e[A]?{url:e[A],variable:A}:null}var Jr={postgres:5432,postgresql:5432,mysql:3306};function J(e,i){let n=l=>new d("DATABASE_URL_INVALID",`${i} in ${I} ${l}`,{fix:"write it as postgres://<user>:<password>@<host>:<port>/<database>"}),t;try{t=new URL(e)}catch{throw n("isn't a URL")}let a=t.protocol.replace(/:$/,"");if(a!=="postgres"&&a!=="postgresql"&&a!=="mysql")throw n("isn't a postgres:// or mysql:// URL");let o=decodeURIComponent(t.pathname.replace(/^\//,"")),r=decodeURIComponent(t.username),s=decodeURIComponent(t.password);if(!t.hostname||!o||!r||!s)throw n("needs a host, a database, a user and a password");return{scheme:a,host:t.hostname,port:t.port?Number(t.port):Jr[a],database:o,user:r,password:s}}function br(e,i){let n=e;for(let t of i)t&&(n=n.split(t).join("***"));return n}async function Rr({cf:e,names:i,appId:n,out:t}){let a=[];for(let o of[...new Set(i)].sort()){try{if(await cr(e,o))continue;await lr(e,o)}catch(r){if(K(r,"already_exists"))continue;throw K(r,"r2_not_enabled")?new d("R2_NOT_ENABLED",`R2 isn't enabled in this Cloudflare account, and ${n} needs an R2 bucket (${o})
-Enable it once in the dashboard: R2 Object Storage \u2192 Get started (free until something is stored).`,{fix:"enable R2 in the Cloudflare dashboard (R2 Object Storage)",rerun:O()}):r}a.push(o),t.emit({type:"progress",step:"app.build",message:`Created R2 bucket "${o}".`,data:{bucket:o}})}return a}async function Ee({cf:e,gatewayDb:i,registration:n},t){let a=t?.name??"",o=t?.workerName??n.workerName;if(!(await F(i,n.workerName)).some(s=>s.kind==="worker"&&s.binding===a)){if(await Ot(e,o)!==null)throw new d("WORKER_NAME_TAKEN",`A Worker named ${o} already exists in this Cloudflare account
-No deploy of this app created it; it may belong to another Gateway or project.`,{fix:"delete or rename it",rerun:O()});await T(i,n.workerName,{kind:"worker",binding:a,name:o,resourceId:o})}}async function vr(e){let{cf:i,registration:n,manifest:t}=e,a=await F(e.gatewayDb,n.workerName),o=(p,w)=>Xr({...e,owned:a,kind:p,binding:w,name:ke(n,p,w),find:p==="d1"?v=>lt(i,v):v=>mt(i,v),create:p==="d1"?v=>dt(i,v):v=>ft(i,v)}),r={};for(let p of t.resources?.d1??[])r[p]={name:ke(n,"d1",p),id:await o("d1",p)};let s={};for(let p of t.resources?.kv??[])s[p]={id:await o("kv",p)};let l=t.resources?.r2??[],m=l.length?{r2:Object.fromEntries(l.map(p=>[p,{name:ke(n,"r2",p)}]))}:{},g=t.resources?.hyperdrive??[];if(g.length===0)return{d1:r,kv:s,...m};let f=new Map(g.map(({name:p})=>{let w=hr(e.secrets??{},t,p);return[p,w?J(w.url,w.variable):null]})),u={};for(let{name:p,caching:w="off"}of g)u[p]={id:await Qr({...e,owned:a,binding:p,name:Zr(n.workerName,p),origin:f.get(p)??null,caching:w})};return{d1:r,kv:s,...m,hyperdrive:u}}function Zr(e,i){return`${e}${Ye}${i.toLowerCase().replaceAll("_","-")}`}async function Qr(e){let{cf:i,gatewayDb:n,registration:t,owned:a,binding:o,name:r,origin:s,caching:l}=e,{onRecreated:m,onChanged:g}=e,{workerName:f}=t,u={kind:"hyperdrive",binding:o,name:r},p=W(u),w=ve(o),v=a.find(k=>k.kind==="hyperdrive"&&k.binding===o&&k.name===r),R=await Zt(i,r),h=async k=>{let S=s!==null&&!we(k,s),D=!er(k,l);!S&&!D||(await Xt(i,k.id,{...S?{origin:s}:{},...D||l==="off"?{caching:l}:{}}),S&&g?.(`Pointed ${p} at the database in ${I}.`),D&&g?.(l==="off"?`Turned off query caching on ${p} (Hyperdrive never invalidates a cached read when the app writes; caching: "default" in everyapp.config.ts turns it on).`:`Turned on Hyperdrive's query caching on ${p} (caching: "default").`))};if(v?.resourceId){if(R?.id===v.resourceId)return await h(R),R.id;if(R)throw Er(u,v.resourceId);m?.(p,u.kind)}else if(v){if(R)return await T(n,f,{...u,resourceId:R.id}),await h(R),R.id}else if(R){if(s&&we(R,s))return await T(n,f,{...u,resourceId:R.id}),g?.(`Adopted ${p}, which connects to the database in ${I}.`),await h(R),R.id;throw new d("RESOURCE_NAME_TAKEN",`A Hyperdrive config named "${r}" already exists in this Cloudflare account
-No deploy of this app created it.`,{fix:`to use it, set ${w} in ${I} to the URL of the database it connects to; otherwise delete or rename it`,rerun:O()})}if(!s)throw new d("HYPERDRIVE_ORIGIN_MISSING",`${o} needs the database its Hyperdrive config connects to
-Creating the config needs its URL.`,{fix:`set ${w} (or POSTGRES_DATABASE_URL, when it is the app's only config) in ${I} to postgres://<user>:<password>@<host>:<port>/<database>`,rerun:O()});return kr(e,u,()=>Qt(i,r,s,l))}function ke(e,i,n){let t=e.resources[i][n];if(!t||qe(t))throw new d("RESOURCE_NAME_MISSING",`The Gateway assigned no usable ${_[i]} name for binding ${n}`,{rerun:`${N} setup`,rerunNote:"to upgrade the Gateway"});return t}async function Xr(e){let{gatewayDb:i,registration:n,owned:t,kind:a,binding:o,name:r,find:s,create:l,onRecreated:m}=e,{workerName:g}=n,f={kind:a,binding:o,name:r},u=t.find(w=>w.kind===a&&w.binding===o&&w.name===r),p=await s(r);if(u?.resourceId){if(p===u.resourceId)return p;if(p)throw Er(f,u.resourceId);m?.(W(f),a)}else if(u){if(p)return await T(i,g,{...f,resourceId:p}),p}else if(p)throw new d("RESOURCE_NAME_TAKEN",`A ${_[a]} named "${r}" already exists in this Cloudflare account
-No deploy of this app created it; it may belong to another Gateway, app or project.`,{fix:"delete or rename it",rerun:O()});return kr(e,f,()=>l(r))}async function kr({gatewayDb:e,registration:i,onCreated:n},t,a){let{workerName:o}=i;await T(e,o,{...t,resourceId:null});let r;try{r=await a()}catch(s){throw K(s,"already_exists")?(await kt(e,o,{kind:t.kind,binding:t.binding}),new d("RESOURCE_NAME_TAKEN",`${W(t)} was created by someone else while this deploy was creating it`,{fix:"delete or rename it",rerun:O()})):s}return await T(e,o,{...t,resourceId:r}),n?.(W(t),t.kind),r}function Er(e,i){return new d("RESOURCE_REPLACED",`${W(e)} isn't the one this app created
-That one (${i}) was deleted, and this one was created by someone else since.`,{fix:"delete or rename it",rerun:O()})}function Ae(e,i){return(i.resources?.workflows??[]).map(n=>({binding:n.name,className:n.className,name:Tt(e,n.name),worker:n.worker?H(e,n.worker):e}))}async function Ar({cf:e,workerName:i,names:n}){for(let t of n){let a=await ye(e,t);if(a&&a.script_name!==i)throw new d("WORKFLOW_NAME_TAKEN",`A Workflow named "${t}" already exists in this Cloudflare account
-It runs on Worker ${a.script_name??"(unknown)"}, not ${i}; deploying would take it over.`,{fix:"delete or rename it",rerun:O()})}}async function Ir({cf:e,workerName:i,previousManifest:n,names:t}){let a=Fe.safeParse(n);if(!a.success)return[];let o=[];for(let r of Ae(i,a.data))t.includes(r.name)||(await ye(e,r.name))?.script_name===r.worker&&o.push(r);return o}import{execa as en}from"execa";var tn=10*6e4;function Z({packageName:e,binName:i,env:n={},missing:t}){return async({args:a,cwd:o,env:r})=>{let s;try{s=(await et(o,e,i)).binPath}catch{throw t()}let l=await en(process.execPath,[s,...a],{cwd:o,env:{NODE_NO_WARNINGS:"1",...n,...r},stdin:"ignore",reject:!1,timeout:tn});return{exitCode:l.timedOut?124:l.exitCode??1,stdout:String(l.stdout??""),stderr:String(l.stderr??"")}}}async function Q({run:e,args:i,cwd:n,databaseUrl:t,reasonPatterns:a,failed:o}){let{password:r}=J(t,A),s=await e({args:i,cwd:n,env:{[A]:t}});if(s.exitCode===0)return s.stdout;let m=br(`${s.stderr}
-${s.stdout}`,[t,r,encodeURIComponent(r)]).split(`
-`).map(f=>f.trim()).filter(Boolean),g=a.map(f=>m.find(u=>f.test(u))).find(f=>f!==void 0);throw o(g??m.at(-1)??`exit ${s.exitCode}`)}function rn(){return Z({packageName:"drizzle-kit",binName:"drizzle-kit",missing:()=>new d("DRIZZLE_KIT_MISSING",`Postgres migrations need drizzle-kit, which isn't installed
-Nothing was migrated or uploaded.`,{fix:"add drizzle-kit to devDependencies, then deploy again"})})}async function Sr({cwd:e,databaseUrl:i,config:n,run:t=rn()}){await Q({run:t,args:["migrate",...n?["--config",n]:[]],cwd:e,databaseUrl:i,reasonPatterns:[/error/i],failed:a=>new d("MIGRATION_FAILED",`drizzle-kit couldn't migrate the Postgres database
-${a}. Nothing was uploaded.`,{fix:`check ${A} in ${I} and the migrations`})})}function nn(){return Z({packageName:"prisma",binName:"prisma",env:{PRISMA_HIDE_UPDATE_MESSAGE:"1"},missing:()=>new d("PRISMA_MISSING",`Prisma migrations need prisma, which isn't installed
+import{a as ir,b as or,c as sr,d as dr,f as be}from"./chunk-GKBPYVP3.js";import{b as cr,c as lr}from"./chunk-PNLU5U3P.js";import{a as rr,d as nr,e as he}from"./chunk-CZTEDWZ2.js";import{a as ar,b as pr}from"./chunk-BHMRY53V.js";import{b as Dt}from"./chunk-IFCPALVC.js";import{a as Ct}from"./chunk-WOVS3GV5.js";import{a as Et,b as At,d as me,e as It,m as St,q as Nt}from"./chunk-OM2HDWVP.js";import{a as zt,b as Bt,c as Kt,d as Ft,e as Ht}from"./chunk-J455FAEN.js";import{b as Zt,c as Qt,d as Xt,f as er,g as we,h as ye,j as tr}from"./chunk-EGEWRFVY.js";import{d as Mt,e as xt,f as Ut,g as Wt,m as jt}from"./chunk-H6QQMY7B.js";import{n as Gt}from"./chunk-6OGVO7QK.js";import{a as Vt,b as qt,c as Yt,d as Jt,g as ge}from"./chunk-PS7S74DG.js";import{P as ct}from"./chunk-TLRM3P7V.js";import{c as Ot,e as fe,f as $t}from"./chunk-ZFCUH5PK.js";import{a as _,b as F,e as de,f as T,g as kt,h as W}from"./chunk-ZECBN24L.js";import{c as $,d as _t,g as H,h as Tt}from"./chunk-ONLNJXVQ.js";import{b as Lt}from"./chunk-6PGUCTJ6.js";import{g as pt}from"./chunk-HOUHG236.js";import{$ as gt,ga as wt,ia as yt,ja as ht,m as lt,n as dt,o as mt,p as ft,qa as bt,sa as Rt,u as ut}from"./chunk-RMF4YGD6.js";import{f as le}from"./chunk-T2GD7RHS.js";import{a as Y,e as Pt,f as ue}from"./chunk-H7PDL3X5.js";import{a as ot,b as st,h as at}from"./chunk-CCWBPAKH.js";import{$b as rt,Bb as d,Cb as Je,Db as Ze,Eb as Qe,Fb as Xe,H as Ke,Hb as K,Sb as et,Wb as ce,Yb as tt,b as ae,c as N,d as O,dc as nt,fc as it,jb as Fe,k as pe,nb as He,ob as Ve,sb as qe,tb as Ye,wc as vt}from"./chunk-LYNBZ7RV.js";import Or from"node:path";import Wr from"chalk";async function mr({whoami:e,discovery:i,out:n,offer:t}){let{deps:s}=t,o=t.accountId?["--account-id",t.accountId]:[];if(!s.interactive){let f=await Gr(e,t).catch(()=>null),u=[N,"setup","--domain",f??"<hostname>",...o].join(" ");throw new Je("install_gateway",`Install a Gateway first: ${jr(i)}
+Apps deploy behind one. Setup needs a person once, to create the owner account.`,void 0,{rerun:u,data:{accounts:i.probed,...f?{domain:f}:{}}})}let r=await le({whoami:e,flag:t.accountId,interactive:!0}),a=r.name??r.id,l=await he(s.createCf(r.id),r.id),g=`apps.${l.length===1?l[0]:await s.prompts.pickZone(l)}`;if(t.yes)at(Wr.dim(`${a} has no Gateway yet, so --yes installs one at ${g} first.`));else if(!await(t.confirm??st)(`Install a Gateway at ${g}?`,[`${a} has no Gateway yet. Apps deploy behind one, so it's installed first.`]))throw new Ze(`Cancelled. Nothing deployed.
+Apps deploy behind a Gateway. To install one elsewhere: ${[N,"setup","--domain","<hostname>",...o].join(" ")}`);return await nr({whoami:e,discovery:i,flags:{domain:g,"account-id":r.id,"force-dns":t.forceDns,yes:t.yes,verbose:t.verbose},out:n,deps:s}),ut({whoami:e,createCf:s.createCf,accountId:r.id,interactive:!0})}async function Gr(e,i){let n=await le({whoami:e,flag:i.accountId,interactive:!1});return`apps.${(await he(i.deps.createCf(n.id),n.id))[0]}`}function jr(e){let i=e.probed.map(n=>n.name??n.id);return i.length===1?`${i[0]} has none yet`:`none of ${i.join(", ")} has one yet`}import zr from"node:fs/promises";var fr=64,Br=["d1","kv","hyperdrive","r2"];function Kr(e){return Br.includes(e)}function Fr(e,i){let n=structuredClone(e),t=n.name===$.workerName,s=n.env??{};for(let[l,m]of Object.entries(s))Hr(l,m,i);i.shared&&s.EVERY_APP_ORG_ID&&(delete s.EVERY_APP_ORG_ID,s.EVERYAPP_SHARED={type:"text",value:"1"});let o=JSON.stringify([$.publicKey]),r=Re(n,l=>l===o?JSON.stringify(i.identityPublicKeys):l.replaceAll($.gatewayUrl,()=>i.gatewayUrl).replaceAll($.organizationId,()=>i.organizationId).replaceAll($.workerName,()=>i.workerName));if(t&&i.deletedDurableObjects?.length){let l=r.exports??={};for(let m of i.deletedDurableObjects){if(l[m])throw new d("APP_POLICY",`Durable Object class ${m} is both exported by the build and being deleted; declare it in everyapp.config.ts, or stop exporting it.`);l[m]={type:"durable-object",state:"deleted"}}}let a=gr(r);if(a.length>0)throw new d("INSTALL_PLACEHOLDER_LEFT",`The build of ${String(r.name)} still holds a build placeholder after installing it, at ${a.join(", ")}. Build the Worker from everyAppWorker() in cloudflare.config.ts, and leave its names, keys and ids to the deploy.`);return Vr(r),r}async function ur({cwd:e,target:i}){for await(let{file:n,config:t}of Gt(e))await zr.writeFile(n,`${JSON.stringify(Fr(t,i),null,2)}
+`)}function Hr(e,i,n){let t=String(i.type);if(!Kr(t))return;let s=_t(e);if(i[t==="d1"||t==="r2"?"name":"id"]!==s)return;let r=n.resources[t]?.[e];if(!r)throw new d("INSTALL_INPUTS_MISSING",`The build binds ${_[t]} ${e}, which the deploy didn't provision`,{fix:"declare it in everyapp.config.ts's resources"});Object.assign(i,r)}function Re(e,i){return typeof e=="string"?i(e):Array.isArray(e)?e.map(n=>Re(n,i)):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([n,t])=>[n,Re(t,i)])):e}function gr(e,i=""){let n=[$.workerName,$.organizationId,$.gatewayUrl,$.publicKey].flatMap(s=>[s,JSON.stringify(s).slice(1,-1)]),t=s=>n.some(o=>s.includes(o));return typeof e=="string"?t(e)?[i||"(root)"]:[]:e&&typeof e=="object"?Object.entries(e).flatMap(([s,o])=>{let r=i?`${i}.${s}`:s;return t(s)?[r]:gr(o,r)}):[]}function Vr(e){let i=[...Object.entries(e.env??{}),...Object.entries(e.exports??{})].filter(([,n])=>n.type==="workflow");for(let[n,t]of i){let s=String(t.name);if(s.length>fr)throw new d("WORKFLOW_NAME_TOO_LONG",`${n} would be the Workflow "${s}", longer than Cloudflare's ${fr} characters`,{fix:"shorten its binding name in everyapp.config.ts"})}}import qr from"node:fs/promises";import wr from"node:path";import{parseEnv as Yr}from"node:util";var I=".everyapp/secrets.env",A="POSTGRES_DATABASE_URL";async function yr(e){let i;try{i=await qr.readFile(wr.join(e,I),"utf8")}catch(t){if(tt(t))return{};throw t}ir(e,`${wr.dirname(I)}/`);let n={};for(let[t,s]of Object.entries(Yr(i)))s?.trim()&&(n[t]=s.trim());return n}function ve(e){return`${e}_ORIGIN_URL`}function hr(e,i,n){let t=ve(n);return e[t]?{url:e[t],variable:t}:(i.resources?.hyperdrive??[]).length===1&&e[A]?{url:e[A],variable:A}:null}var Jr={postgres:5432,postgresql:5432,mysql:3306};function J(e,i){let n=l=>new d("DATABASE_URL_INVALID",`${i} in ${I} ${l}`,{fix:"write it as postgres://<user>:<password>@<host>:<port>/<database>"}),t;try{t=new URL(e)}catch{throw n("isn't a URL")}let s=t.protocol.replace(/:$/,"");if(s!=="postgres"&&s!=="postgresql"&&s!=="mysql")throw n("isn't a postgres:// or mysql:// URL");let o=decodeURIComponent(t.pathname.replace(/^\//,"")),r=decodeURIComponent(t.username),a=decodeURIComponent(t.password);if(!t.hostname||!o||!r||!a)throw n("needs a host, a database, a user and a password");return{scheme:s,host:t.hostname,port:t.port?Number(t.port):Jr[s],database:o,user:r,password:a}}function br(e,i){let n=e;for(let t of i)t&&(n=n.split(t).join("***"));return n}async function Rr({cf:e,names:i,appId:n,out:t}){let s=[];for(let o of[...new Set(i)].sort()){try{if(await cr(e,o))continue;await lr(e,o)}catch(r){if(K(r,"already_exists"))continue;throw K(r,"r2_not_enabled")?new d("R2_NOT_ENABLED",`R2 isn't enabled in this Cloudflare account, and ${n} needs an R2 bucket (${o})
+Enable it once in the dashboard: R2 Object Storage \u2192 Get started (free until something is stored).`,{fix:"enable R2 in the Cloudflare dashboard (R2 Object Storage)",rerun:O()}):r}s.push(o),t.emit({type:"progress",step:"app.build",message:`Created R2 bucket "${o}".`,data:{bucket:o}})}return s}async function Ee({cf:e,gatewayDb:i,registration:n},t){let s=t?.name??"",o=t?.workerName??n.workerName;if(!(await F(i,n.workerName)).some(a=>a.kind==="worker"&&a.binding===s)){if(await Ot(e,o)!==null)throw new d("WORKER_NAME_TAKEN",`A Worker named ${o} already exists in this Cloudflare account
+No deploy of this app created it; it may belong to another Gateway or project.`,{fix:"delete or rename it",rerun:O()});await T(i,n.workerName,{kind:"worker",binding:s,name:o,resourceId:o})}}async function vr(e){let{cf:i,registration:n,manifest:t}=e,s=await F(e.gatewayDb,n.workerName),o=(p,w)=>Xr({...e,owned:s,kind:p,binding:w,name:ke(n,p,w),find:p==="d1"?v=>lt(i,v):v=>mt(i,v),create:p==="d1"?v=>dt(i,v):v=>ft(i,v)}),r={};for(let p of t.resources?.d1??[])r[p]={name:ke(n,"d1",p),id:await o("d1",p)};let a={};for(let p of t.resources?.kv??[])a[p]={id:await o("kv",p)};let l=t.resources?.r2??[],m=l.length?{r2:Object.fromEntries(l.map(p=>[p,{name:ke(n,"r2",p)}]))}:{},g=t.resources?.hyperdrive??[];if(g.length===0)return{d1:r,kv:a,...m};let f=new Map(g.map(({name:p})=>{let w=hr(e.secrets??{},t,p);return[p,w?J(w.url,w.variable):null]})),u={};for(let{name:p,caching:w="off"}of g)u[p]={id:await Qr({...e,owned:s,binding:p,name:Zr(n.workerName,p),origin:f.get(p)??null,caching:w})};return{d1:r,kv:a,...m,hyperdrive:u}}function Zr(e,i){return`${e}${Ye}${i.toLowerCase().replaceAll("_","-")}`}async function Qr(e){let{cf:i,gatewayDb:n,registration:t,owned:s,binding:o,name:r,origin:a,caching:l}=e,{onRecreated:m,onChanged:g}=e,{workerName:f}=t,u={kind:"hyperdrive",binding:o,name:r},p=W(u),w=ve(o),v=s.find(k=>k.kind==="hyperdrive"&&k.binding===o&&k.name===r),R=await Zt(i,r),h=async k=>{let S=a!==null&&!we(k,a),D=!er(k,l);!S&&!D||(await Xt(i,k.id,{...S?{origin:a}:{},...D||l==="off"?{caching:l}:{}}),S&&g?.(`Pointed ${p} at the database in ${I}.`),D&&g?.(l==="off"?`Turned off query caching on ${p} (Hyperdrive never invalidates a cached read when the app writes; caching: "default" in everyapp.config.ts turns it on).`:`Turned on Hyperdrive's query caching on ${p} (caching: "default").`))};if(v?.resourceId){if(R?.id===v.resourceId)return await h(R),R.id;if(R)throw Er(u,v.resourceId);m?.(p,u.kind)}else if(v){if(R)return await T(n,f,{...u,resourceId:R.id}),await h(R),R.id}else if(R){if(a&&we(R,a))return await T(n,f,{...u,resourceId:R.id}),g?.(`Adopted ${p}, which connects to the database in ${I}.`),await h(R),R.id;throw new d("RESOURCE_NAME_TAKEN",`A Hyperdrive config named "${r}" already exists in this Cloudflare account
+No deploy of this app created it.`,{fix:`to use it, set ${w} in ${I} to the URL of the database it connects to; otherwise delete or rename it`,rerun:O()})}if(!a)throw new d("HYPERDRIVE_ORIGIN_MISSING",`${o} needs the database its Hyperdrive config connects to
+Creating the config needs its URL.`,{fix:`set ${w} (or POSTGRES_DATABASE_URL, when it is the app's only config) in ${I} to postgres://<user>:<password>@<host>:<port>/<database>`,rerun:O()});return kr(e,u,()=>Qt(i,r,a,l))}function ke(e,i,n){let t=e.resources[i][n];if(!t||qe(t))throw new d("RESOURCE_NAME_MISSING",`The Gateway assigned no usable ${_[i]} name for binding ${n}`,{rerun:`${N} setup`,rerunNote:"to upgrade the Gateway"});return t}async function Xr(e){let{gatewayDb:i,registration:n,owned:t,kind:s,binding:o,name:r,find:a,create:l,onRecreated:m}=e,{workerName:g}=n,f={kind:s,binding:o,name:r},u=t.find(w=>w.kind===s&&w.binding===o&&w.name===r),p=await a(r);if(u?.resourceId){if(p===u.resourceId)return p;if(p)throw Er(f,u.resourceId);m?.(W(f),s)}else if(u){if(p)return await T(i,g,{...f,resourceId:p}),p}else if(p)throw new d("RESOURCE_NAME_TAKEN",`A ${_[s]} named "${r}" already exists in this Cloudflare account
+No deploy of this app created it; it may belong to another Gateway, app or project.`,{fix:"delete or rename it",rerun:O()});return kr(e,f,()=>l(r))}async function kr({gatewayDb:e,registration:i,onCreated:n},t,s){let{workerName:o}=i;await T(e,o,{...t,resourceId:null});let r;try{r=await s()}catch(a){throw K(a,"already_exists")?(await kt(e,o,{kind:t.kind,binding:t.binding}),new d("RESOURCE_NAME_TAKEN",`${W(t)} was created by someone else while this deploy was creating it`,{fix:"delete or rename it",rerun:O()})):a}return await T(e,o,{...t,resourceId:r}),n?.(W(t),t.kind),r}function Er(e,i){return new d("RESOURCE_REPLACED",`${W(e)} isn't the one this app created
+That one (${i}) was deleted, and this one was created by someone else since.`,{fix:"delete or rename it",rerun:O()})}function Ae(e,i){return(i.resources?.workflows??[]).map(n=>({binding:n.name,className:n.className,name:Tt(e,n.name),worker:n.worker?H(e,n.worker):e}))}async function Ar({cf:e,workerName:i,names:n}){for(let t of n){let s=await ye(e,t);if(s&&s.script_name!==i)throw new d("WORKFLOW_NAME_TAKEN",`A Workflow named "${t}" already exists in this Cloudflare account
+It runs on Worker ${s.script_name??"(unknown)"}, not ${i}; deploying would take it over.`,{fix:"delete or rename it",rerun:O()})}}async function Ir({cf:e,workerName:i,previousManifest:n,names:t}){let s=Fe.safeParse(n);if(!s.success)return[];let o=[];for(let r of Ae(i,s.data))t.includes(r.name)||(await ye(e,r.name))?.script_name===r.worker&&o.push(r);return o}import{execa as en}from"execa";var tn=10*6e4;function Z({packageName:e,binName:i,env:n={},missing:t}){return async({args:s,cwd:o,env:r})=>{let a;try{a=(await et(o,e,i)).binPath}catch{throw t()}let l=await en(process.execPath,[a,...s],{cwd:o,env:{NODE_NO_WARNINGS:"1",...n,...r},stdin:"ignore",reject:!1,timeout:tn});return{exitCode:l.timedOut?124:l.exitCode??1,stdout:String(l.stdout??""),stderr:String(l.stderr??"")}}}async function Q({run:e,args:i,cwd:n,databaseUrl:t,reasonPatterns:s,failed:o}){let{password:r}=J(t,A),a=await e({args:i,cwd:n,env:{[A]:t}});if(a.exitCode===0)return a.stdout;let m=br(`${a.stderr}
+${a.stdout}`,[t,r,encodeURIComponent(r)]).split(`
+`).map(f=>f.trim()).filter(Boolean),g=s.map(f=>m.find(u=>f.test(u))).find(f=>f!==void 0);throw o(g??m.at(-1)??`exit ${a.exitCode}`)}function rn(){return Z({packageName:"drizzle-kit",binName:"drizzle-kit",missing:()=>new d("DRIZZLE_KIT_MISSING",`Postgres migrations need drizzle-kit, which isn't installed
+Nothing was migrated or uploaded.`,{fix:"add drizzle-kit to devDependencies, then deploy again"})})}async function Sr({cwd:e,databaseUrl:i,config:n,run:t=rn()}){await Q({run:t,args:["migrate",...n?["--config",n]:[]],cwd:e,databaseUrl:i,reasonPatterns:[/error/i],failed:s=>new d("MIGRATION_FAILED",`drizzle-kit couldn't migrate the Postgres database
+${s}. Nothing was uploaded.`,{fix:`check ${A} in ${I} and the migrations`})})}function nn(){return Z({packageName:"prisma",binName:"prisma",env:{PRISMA_HIDE_UPDATE_MESSAGE:"1"},missing:()=>new d("PRISMA_MISSING",`Prisma migrations need prisma, which isn't installed
 Nothing was migrated or uploaded.`,{fix:"add prisma to devDependencies, then deploy again"})})}async function Nr({cwd:e,databaseUrl:i,config:n,run:t=nn()}){return[...(await Q({run:t,args:["migrate","deploy",...n?["--config",n]:[]],cwd:e,databaseUrl:i,reasonPatterns:[/\bP\d{4}\b/,/error/i],failed:o=>new d("MIGRATION_FAILED",`prisma migrate deploy couldn't migrate the Postgres database
-${o}. Nothing was uploaded.`,{fix:`check ${A} in ${I}, prisma.config.ts (its datasource reads it) and the migrations`})})).matchAll(/^Applying migration `([^`]+)`/gm)].map(o=>o[1])}var on=new Set(["pending","binding"]);async function $r(e){let i={rollback:null};try{return await an(e,i)}catch(n){throw Qe(n,i.rollback)}}async function an(e,i){let{cwd:n,out:t}=e,a=e.interactive??ot(e.json??!1),o=e.release,r=o?.manifest??e.manifest??await Y(n),s=o?.dir??n;o&&cn(r);let l=r.migrations?.dialect==="postgresql",m=l||r.resources?.hyperdrive?.length?await yr(n):{};if(l&&!m[A])throw new d("POSTGRES_URL_MISSING",`${r.id} needs a Postgres URL to migrate its database
-Format: postgres://<user>:<password>@<host>:<port>/<database>`,{fix:`set ${A} in ${I}, then deploy again`});let g=o?null:await pr(n);if(!o&&!g)throw new d("MISSING_CLOUDFLARE_CONFIG",sr);g&&!g.usesEveryAppWorker&&t.emit({type:"warning",code:"NONSTANDARD_CLOUDFLARE_CONFIG",message:`cloudflare.config.ts doesn't use everyAppWorker()
-The deploy checks the Worker it builds against the app policy.`});let f=e.offerInstall,u=zt(e.reconcile,t,e.verbose);t.emit({type:"step",step:"app.connect",status:"start",message:"Finding your Gateway..."});let{cf:p,accountId:w,accountName:v,databaseId:R,db:h,install:k,gatewayUrl:S,deployer:D}=await Rt({gateway:e.gateway,accountId:e.accountId,interactive:a,login:{json:e.json,out:t,step:"app.login"},createCf:e.createCf,onNoGateway:f?({whoami:x,discovery:re})=>mr({whoami:x,discovery:re,out:t,offer:{accountId:e.accountId,yes:f.yes,confirm:f.confirm,forceDns:e.forceDns,verbose:e.verbose,deps:{...rr({gateway:u,interactive:a}),...e.createCf?{createCf:e.createCf}:{},...f.setup}}}):void 0});t.emit({type:"step",step:"app.connect",status:"ok",data:{gatewayUrl:S}});let Ie=await Ct(h,k);pn(r,Ie,S);let[Dr,Se]=await Promise.all([gt(h),yt(h,r.id)]),Ne=!Se||on.has(Se.status);t.emit({type:"step",step:"app.deploy",status:"ok",message:`Deploying ${r.id}${o?` ${o.release.version} from ${be(o.origin)}`:""} to ${S}.`,data:{appId:r.id,organizationName:Dr?.organization.name??v,firstDeploy:Ne,gatewayUrl:S,gatewayHost:new URL(S).host,...o?{version:o.release.version,origin:be(o.origin),release:{version:o.release.version,gitSha:o.release.gitSha,origin:o.origin,sha256:o.release.sha256}}:{}}}),await jt(k,u.source);let Oe=k.jwtPublicKey;if(!Oe)throw new d("IDENTITY_KEY_UNKNOWN",`The Gateway is missing its sign-in public key
+${o}. Nothing was uploaded.`,{fix:`check ${A} in ${I}, prisma.config.ts (its datasource reads it) and the migrations`})})).matchAll(/^Applying migration `([^`]+)`/gm)].map(o=>o[1])}var on=new Set(["pending","binding"]);async function $r(e){let i={rollback:null};try{return await sn(e,i)}catch(n){throw Qe(n,i.rollback)}}async function sn(e,i){let{cwd:n,out:t}=e,s=e.interactive??ot(e.json??!1),o=e.release,r=o?.manifest??e.manifest??await Y(n),a=o?.dir??n;o&&cn(r);let l=r.migrations?.dialect==="postgresql",m=l||r.resources?.hyperdrive?.length?await yr(n):{};if(l&&!m[A])throw new d("POSTGRES_URL_MISSING",`${r.id} needs a Postgres URL to migrate its database
+Format: postgres://<user>:<password>@<host>:<port>/<database>`,{fix:`set ${A} in ${I}, then deploy again`});let g=o?null:await pr(n);if(!o&&!g)throw new d("MISSING_CLOUDFLARE_CONFIG",ar);g&&!g.usesEveryAppWorker&&t.emit({type:"warning",code:"NONSTANDARD_CLOUDFLARE_CONFIG",message:`cloudflare.config.ts doesn't use everyAppWorker()
+The deploy checks the Worker it builds against the app policy.`});let f=e.offerInstall,u=zt(e.reconcile,t,e.verbose);t.emit({type:"step",step:"app.connect",status:"start",message:"Finding your Gateway..."});let{cf:p,accountId:w,accountName:v,databaseId:R,db:h,install:k,gatewayUrl:S,deployer:D}=await Rt({gateway:e.gateway,accountId:e.accountId,interactive:s,login:{json:e.json,out:t,step:"app.login"},createCf:e.createCf,onNoGateway:f?({whoami:x,discovery:re})=>mr({whoami:x,discovery:re,out:t,offer:{accountId:e.accountId,yes:f.yes,confirm:f.confirm,forceDns:e.forceDns,verbose:e.verbose,deps:{...rr({gateway:u,interactive:s}),...e.createCf?{createCf:e.createCf}:{},...f.setup}}}):void 0});t.emit({type:"step",step:"app.connect",status:"ok",data:{gatewayUrl:S}});let Ie=await Ct(h,k);pn(r,Ie,S);let[Dr,Se]=await Promise.all([gt(h),yt(h,r.id)]),Ne=!Se||on.has(Se.status);t.emit({type:"step",step:"app.deploy",status:"ok",message:`Deploying ${r.id}${o?` ${o.release.version} from ${be(o.origin)}`:""} to ${S}.`,data:{appId:r.id,organizationName:Dr?.organization.name??v,firstDeploy:Ne,gatewayUrl:S,gatewayHost:new URL(S).host,...o?{version:o.release.version,origin:be(o.origin),release:{version:o.release.version,gitSha:o.release.gitSha,origin:o.origin,sha256:o.release.sha256}}:{}}}),await jt(k,u.source);let Oe=k.jwtPublicKey;if(!Oe)throw new d("IDENTITY_KEY_UNKNOWN",`The Gateway is missing its sign-in public key
 App Workers need it to check who is signed in.`,{fix:"restore JWT_PUBLIC_KEY as in https://github.com/every-app/every-app/blob/main/docs/runbooks/key-rotation.md"});let{plan:E,organization:L,hasOwner:Pr,deployerGranted:_r}=await Bt(h,{manifest:r,install:k,deployer:D,accountName:v}),C=E.app.hostname,y=E.app.workerName,$e=E.kind!=="existing",Ce=Ve(r,E.app.tier);if(Ce.length>0)throw new d("TIER_POLICY",`${r.id} can't be deployed as configured
 ${Ce.join(`
-`)}`,{fix:"change everyapp.config.ts, then deploy again"});let X=nt(r),ee=it(r);t.emit({type:"step",step:"app.register",status:"ok",message:`${$e?"Registered":"Updating"} ${r.id} as ${y} at https://${C} (${E.app.status}).`,data:{appId:r.id,workerName:y,hostname:C,status:E.app.status,existingApp:!$e,firstDeploy:Ne,defaultAccess:E.app.isDefault,deployerAccess:_r,hasOwner:Pr,publicRoutes:X,mcp:ee,scope:E.app.scope,organizationId:L.id,organizationName:L.name,gatewayUrl:S}});let{outsideBase:G,newHost:De}=await Mt({cf:p,out:t,install:k,hostname:C,forceDns:e.forceDns,cfAsks:a&&t.verbose}),j=await pt({db:h,out:t},{workerName:y,appId:r.id,purpose:"app.deploy"}),z,te,V=[];try{let x=ln(E,r,e.allowDeleteDurableObjectData??!1),re=await dn({cf:p,plan:E,workerName:y,manifest:r,allowDelete:e.allowDeleteWorkflows??!1}),Te=!1,ne={cf:p,gatewayDb:h,registration:{workerName:y,resources:E.resources},onCreated:(c,b)=>{t.emit({type:"progress",step:"app.resources",message:`Created ${c}.`}),b==="hyperdrive"&&(Te=!0)},onRecreated:(c,b)=>t.emit({type:"warning",code:"RESOURCE_RECREATED",step:"app.resources",message:`The ${b==="d1"?"database":_[b]} ${r.id} used before is gone; creating a new, empty one
+`)}`,{fix:"change everyapp.config.ts, then deploy again"});let X=nt(r),ee=it(r);t.emit({type:"step",step:"app.register",status:"ok",message:`${$e?"Registered":"Updating"} ${r.id} as ${y} at https://${C} (${E.app.status}).`,data:{appId:r.id,workerName:y,hostname:C,status:E.app.status,existingApp:!$e,firstDeploy:Ne,defaultAccess:E.app.isDefault,deployerAccess:_r,hasOwner:Pr,publicRoutes:X,mcp:ee,scope:E.app.scope,organizationId:L.id,organizationName:L.name,gatewayUrl:S}});let{outsideBase:G,newHost:De}=await Mt({cf:p,out:t,install:k,hostname:C,forceDns:e.forceDns,cfAsks:s&&t.verbose}),j=await pt({db:h,out:t},{workerName:y,appId:r.id,purpose:"app.deploy"}),z,te,V=[];try{let x=ln(E,r,e.allowDeleteDurableObjectData??!1),re=await dn({cf:p,plan:E,workerName:y,manifest:r,allowDelete:e.allowDeleteWorkflows??!1}),Te=!1,ne={cf:p,gatewayDb:h,registration:{workerName:y,resources:E.resources},onCreated:(c,b)=>{t.emit({type:"progress",step:"app.resources",message:`Created ${c}.`}),b==="hyperdrive"&&(Te=!0)},onRecreated:(c,b)=>t.emit({type:"warning",code:"RESOURCE_RECREATED",step:"app.resources",message:`The ${b==="d1"?"database":_[b]} ${r.id} used before is gone; creating a new, empty one
 ${c} no longer exists in this Cloudflare account.`}),onChanged:c=>t.emit({type:"progress",step:"app.resources",message:c})},P=(r.workers??[]).map(c=>({name:c.name,workerName:H(y,c.name)}));t.emit({type:"step",step:"app.resources",status:"start",message:"Preparing the app's resources..."}),await Ee(ne);for(let c of P)await Ee(ne,c);let U=await ht(h,E.app.id),ie=ge(r).receives;!ie&&U.inbound.length>0&&t.emit({type:"warning",code:"EMAIL_INBOUND_UNDECLARED",step:"app.email",message:`everyapp.config.ts no longer declares inbound email; removing the app's mail routes
-Its addresses (${U.inbound.join(", ")}) stay on the Gateway until you clear them.`,data:{rerun:`${N} email unset inbound`}});let B=await Vt({cf:p,gatewayDb:h,accountId:w,workerName:y,addresses:ie?U.inbound:[],interactive:a,enableRouting:e.enableEmailRouting,confirm:e.confirm}),Le=await vr({...ne,manifest:r,secrets:m});if(t.emit({type:"step",step:"app.resources",status:"ok",message:"The app's resources are ready."}),Te){let c=r.resources?.hyperdrive?.some(b=>b.caching==="default")?"default":"off";t.emit({type:"step",step:"app.hyperdrive",status:"ok",message:"Created the app's Hyperdrive config.",data:{caching:c}})}!o&&r.install!==!1&&(t.emit({type:"step",step:"app.install",status:"start",message:"Installing dependencies..."}),await(e.installDeps??rt)({cwd:n,description:"Installing dependencies...",install:r.install,verbose:e.verbose??!1}),t.emit({type:"step",step:"app.install",status:"ok"}));let Me={workerName:y,organizationId:L.id,gatewayUrl:S,identityPublicKeys:[Oe],resources:Le,deletedDurableObjects:x,helperWorkers:P.map(c=>c.workerName)};o||(t.emit({type:"step",step:"app.build",status:"start",message:"Building..."}),await ar({cwd:n,cf:p,buildCommand:r.build,verbose:e.verbose??!1})),await ur({cwd:s,target:Me});let{workflows:xe,helperWorkflows:Ue,r2Buckets:Tr}=await dr({cwd:s,inputs:Me});await Rr({cf:p,names:Tr,appId:r.id,out:t});for(let c of[{workerName:y,names:xe},...P.map(b=>({workerName:b.workerName,names:Ue[b.workerName]??[]}))])await Ar({cf:p,...c});t.emit({type:"step",step:"app.build",status:"ok",message:`${o?"Installed the release":"Built the app"} and checked its Worker${P.length?"s":""}.`,data:{release:o!==void 0,workflows:[...xe,...Object.values(Ue).flat()]}}),o?t.emit({type:"progress",step:"app.schema",message:`The release's publisher checked its migrations against its schema when it packed ${r.id} ${o.release.version}.`}):await or({cwd:n,manifest:r,out:t});let Lr=(await F(h,y)).filter(c=>c.kind==="worker"),We=c=>Lr.find(b=>b.binding===c)?.versionId,Mr={question:"Replace the version that's serving?",effect:"Migrations run first."};for(let c of[{workerName:y,shownAs:r.id,recordedVersionIds:[E.versionId,We("")]},...P.map(b=>({workerName:b.workerName,shownAs:`${r.id}'s ${b.name} Worker`,recordedVersionIds:[We(b.name)]}))])await $t({cf:p,...c,interactive:a,confirm:e.confirm,change:Mr});await j.check(),i.rollback=await mn({cf:p,out:t,cwd:s,manifest:r,resources:Le,accountId:w,registry:h,workerName:y,restoreCommand:`${N} db restore${o?` ${r.id}`:""}`,appSecrets:m,drizzleKit:e.drizzleKit,prisma:e.prisma});let Ge={GATEWAY_URL:S,EVERY_APP_ORG_ID:L.id};for(let c of P)await j.check(),t.emit({type:"step",step:"app.helper",status:"start",message:`Uploading ${c.workerName}...`,data:{name:c.name,workerName:c.workerName}}),await fe({cf:p,cwd:s,workerName:c.workerName,buildOutputWorker:c.workerName,accountId:w,message:`everyapp ${se} ${r.id} ${c.name}`,secrets:Ge,interactive:a,attach:t.verbose,out:t,step:"app.helper",onUploaded:b=>de(h,y,b,c.name)}),t.emit({type:"step",step:"app.helper",status:"ok",message:`Uploaded ${c.workerName}.`,data:{name:c.name,workerName:c.workerName}});await j.check(),t.emit({type:"step",step:"app.upload",status:"start",message:`Uploading ${y}...`});let je=await fe({cf:p,cwd:s,workerName:y,accountId:w,message:`everyapp ${se} ${r.id}`,secrets:Ge,interactive:a,attach:t.verbose,out:t,step:"app.upload",onUploaded:c=>de(h,y,c)});if(!je.versionId)throw new d("VERSION_UNKNOWN",`Cloudflare reports no version for ${r.id} after the upload`,{data:{workerName:y}});z=je.versionId,t.emit({type:"step",step:"app.upload",status:"ok",message:`Uploaded version ${z}.`,data:{versionId:z}});for(let c of re)await tr(p,c.name),t.emit({type:"step",step:"app.workflows",status:"ok",message:`Deleted the Workflow ${c.binding} (${c.name}) with its instances.`,data:{binding:c.binding,name:c.name}});let ze=ge(r).sends&&k.deploymentMode!=="hosted";if(B){await j.check(),t.emit({type:"step",step:"app.email",status:"start",message:`Routing ${r.id}'s mail...`,data:{removing:B.routes.length===0}});let{routed:c,removed:b}=await qt({cf:p,gatewayDb:h,plan:B,onProgress:ae=>t.emit({type:"progress",step:"app.email",message:ae})}),q={appId:r.id,workerName:y,senders:U.senders,routed:c,removed:b,sendersSettable:ze},Be=q.sendersSettable?Jt(q.routed,q.senders):[];t.emit({type:"step",step:"app.email",status:"ok",message:Yt(q),data:{addresses:c,removed:b,enabled:B.enable.map(({domain:ae})=>ae),...Be.length>0?{replyHint:`To reply from ${Be.join(", ")}, set up Email Sending, then: ${N} email set --sender`}:{}}})}!B&&ie&&U.inbound.length===0&&(t.emit({type:"step",step:"app.email",status:"skip",message:`${r.id} receives no mail yet.`}),V.push({command:`${N} email set --inbound <address>`,note:`routes mail to ${r.id}`})),ze&&U.senders.length===0&&V.push({command:`${N} email set --sender '*@<domain>'`,note:`lets ${r.id} send as your domain`});let xr=(E.previousManifest?.workers??[]).map(c=>String(c.name)).filter(c=>!P.some(b=>b.name===c));for(let c of xr)t.emit({type:"warning",code:"HELPER_WORKER_KEPT",step:"app.upload",message:`Helper Worker ${c} is no longer in everyapp.config.ts, but it still runs
+Its addresses (${U.inbound.join(", ")}) stay on the Gateway until you clear them.`,data:{rerun:`${N} email unset inbound`}});let B=await Vt({cf:p,gatewayDb:h,accountId:w,workerName:y,addresses:ie?U.inbound:[],interactive:s,enableRouting:e.enableEmailRouting,confirm:e.confirm}),Le=await vr({...ne,manifest:r,secrets:m});if(t.emit({type:"step",step:"app.resources",status:"ok",message:"The app's resources are ready."}),Te){let c=r.resources?.hyperdrive?.some(b=>b.caching==="default")?"default":"off";t.emit({type:"step",step:"app.hyperdrive",status:"ok",message:"Created the app's Hyperdrive config.",data:{caching:c}})}!o&&r.install!==!1&&(t.emit({type:"step",step:"app.install",status:"start",message:"Installing dependencies..."}),await(e.installDeps??rt)({cwd:n,description:"Installing dependencies...",install:r.install,verbose:e.verbose??!1}),t.emit({type:"step",step:"app.install",status:"ok"}));let Me={workerName:y,organizationId:L.id,gatewayUrl:S,identityPublicKeys:[Oe],resources:Le,deletedDurableObjects:x,helperWorkers:P.map(c=>c.workerName),declared:r.resources};o||(t.emit({type:"step",step:"app.build",status:"start",message:"Building..."}),await sr({cwd:n,cf:p,buildCommand:r.build,verbose:e.verbose??!1})),await ur({cwd:a,target:Me});let{workflows:xe,helperWorkflows:Ue,r2Buckets:Tr}=await dr({cwd:a,inputs:Me});await Rr({cf:p,names:Tr,appId:r.id,out:t});for(let c of[{workerName:y,names:xe},...P.map(b=>({workerName:b.workerName,names:Ue[b.workerName]??[]}))])await Ar({cf:p,...c});t.emit({type:"step",step:"app.build",status:"ok",message:`${o?"Installed the release":"Built the app"} and checked its Worker${P.length?"s":""}.`,data:{release:o!==void 0,workflows:[...xe,...Object.values(Ue).flat()]}}),o?t.emit({type:"progress",step:"app.schema",message:`The release's publisher checked its migrations against its schema when it packed ${r.id} ${o.release.version}.`}):await or({cwd:n,manifest:r,out:t});let Lr=(await F(h,y)).filter(c=>c.kind==="worker"),We=c=>Lr.find(b=>b.binding===c)?.versionId,Mr={question:"Replace the version that's serving?",effect:"Migrations run first."};for(let c of[{workerName:y,shownAs:r.id,recordedVersionIds:[E.versionId,We("")]},...P.map(b=>({workerName:b.workerName,shownAs:`${r.id}'s ${b.name} Worker`,recordedVersionIds:[We(b.name)]}))])await $t({cf:p,...c,interactive:s,confirm:e.confirm,change:Mr});await j.check(),i.rollback=await mn({cf:p,out:t,cwd:a,manifest:r,resources:Le,accountId:w,registry:h,workerName:y,restoreCommand:`${N} db restore${o?` ${r.id}`:""}`,appSecrets:m,drizzleKit:e.drizzleKit,prisma:e.prisma});let Ge={GATEWAY_URL:S,EVERY_APP_ORG_ID:L.id};for(let c of P)await j.check(),t.emit({type:"step",step:"app.helper",status:"start",message:`Uploading ${c.workerName}...`,data:{name:c.name,workerName:c.workerName}}),await fe({cf:p,cwd:a,workerName:c.workerName,buildOutputWorker:c.workerName,accountId:w,message:`everyapp ${ae} ${r.id} ${c.name}`,secrets:Ge,interactive:s,attach:t.verbose,out:t,step:"app.helper",onUploaded:b=>de(h,y,b,c.name)}),t.emit({type:"step",step:"app.helper",status:"ok",message:`Uploaded ${c.workerName}.`,data:{name:c.name,workerName:c.workerName}});await j.check(),t.emit({type:"step",step:"app.upload",status:"start",message:`Uploading ${y}...`});let je=await fe({cf:p,cwd:a,workerName:y,accountId:w,message:`everyapp ${ae} ${r.id}`,secrets:Ge,interactive:s,attach:t.verbose,out:t,step:"app.upload",onUploaded:c=>de(h,y,c)});if(!je.versionId)throw new d("VERSION_UNKNOWN",`Cloudflare reports no version for ${r.id} after the upload`,{data:{workerName:y}});z=je.versionId,t.emit({type:"step",step:"app.upload",status:"ok",message:`Uploaded version ${z}.`,data:{versionId:z}});for(let c of re)await tr(p,c.name),t.emit({type:"step",step:"app.workflows",status:"ok",message:`Deleted the Workflow ${c.binding} (${c.name}) with its instances.`,data:{binding:c.binding,name:c.name}});let ze=ge(r).sends&&k.deploymentMode!=="hosted";if(B){await j.check(),t.emit({type:"step",step:"app.email",status:"start",message:`Routing ${r.id}'s mail...`,data:{removing:B.routes.length===0}});let{routed:c,removed:b}=await qt({cf:p,gatewayDb:h,plan:B,onProgress:se=>t.emit({type:"progress",step:"app.email",message:se})}),q={appId:r.id,workerName:y,senders:U.senders,routed:c,removed:b,sendersSettable:ze},Be=q.sendersSettable?Jt(q.routed,q.senders):[];t.emit({type:"step",step:"app.email",status:"ok",message:Yt(q),data:{addresses:c,removed:b,enabled:B.enable.map(({domain:se})=>se),...Be.length>0?{replyHint:`To reply from ${Be.join(", ")}, set up Email Sending, then: ${N} email set --sender`}:{}}})}!B&&ie&&U.inbound.length===0&&(t.emit({type:"step",step:"app.email",status:"skip",message:`${r.id} receives no mail yet.`}),V.push({command:`${N} email set --inbound <address>`,note:`routes mail to ${r.id}`})),ze&&U.senders.length===0&&V.push({command:`${N} email set --sender '*@<domain>'`,note:`lets ${r.id} send as your domain`});let xr=(E.previousManifest?.workers??[]).map(c=>String(c.name)).filter(c=>!P.some(b=>b.name===c));for(let c of xr)t.emit({type:"warning",code:"HELPER_WORKER_KEPT",step:"app.upload",message:`Helper Worker ${c} is no longer in everyapp.config.ts, but it still runs
 Its Worker is ${H(y,c)}.`,data:{fix:"delete that Worker in the Cloudflare dashboard"}});let oe=await At(p,y).catch(c=>(t.emit({type:"progress",step:"app.secrets",message:`Couldn't list ${y}'s secrets: ${Xe(c).split(`
-`)[0]}`}),null));te=await wt(h,E.app.id,{versionId:z,manifest:r,actor:D.actor,email:D.email,source:o?"release":"cli",...oe?{secretNames:oe}:{}});let Ur=await sn({cf:p,manifest:r,appId:r.id,secretNames:oe,out:t,next:V,providers:Ie});await Dt(h,{appRowId:E.app.id,setup:Ur,deployer:D},t)}finally{await j.release()}await Kt({cf:p,db:h,databaseId:R,out:t,accountId:w,appId:r.id,workerName:y,publishHost:De,interactive:a,forceDns:e.forceDns,seams:{...e.reconcile,openRelease:u.openRelease,source:u.source},verb:"deploy"});let M=`https://${C}`,Pe=!G&&(e.waitForLive??!0),_e=await Ft({wait:Pe,db:h,appRowId:E.app.id,appId:r.id,hostname:C,out:t,seams:e.live,message:`${r.id} is live at ${M}.`,verb:"deploy"});if(!_e){let x=G?"outside-base":Pe?void 0:De?"certificate":"first-visit";t.emit(te==="active"&&!G?{type:"step",step:"app.live",status:"ok",message:`${r.id} is live at ${M}.`,data:{hostname:C,url:M}}:{type:"step",step:"app.live",status:"skip",message:`${r.id} isn't live yet: ${M}.`,data:{hostname:C,url:M,...x?{reason:x}:{}}})}return await ct({cf:p,db:h,install:k,out:t},{appId:r.id,surface:{publicRoutes:X.length>0,mcp:ee!==null}}),G&&t.emit({type:"warning",code:"APP_HOST_OUTSIDE_BASE",step:"app.domain",message:`${C} isn't one label below ${k.appBaseDomain}
-The Gateway only serves names directly under ${k.appBaseDomain}, so ${r.id} can't be reached.`}),{liveUrl:M,gatewayUrl:S,organizationId:L.id,organizationName:L.name,hostname:C,workerName:y,versionId:z,live:_e||te==="active"&&!G,publicRoutes:X,mcp:ee,next:V}}async function sn({cf:e,manifest:i,appId:n,secretNames:t,out:a,next:o,providers:r}){if(!It(i,r))return me({manifest:i,appId:n,gatewayNames:[],secretNames:[],lookup:r}).setup;let s=await Et(e).catch(()=>null),{setup:l}=me({manifest:i,appId:n,gatewayNames:s,secretNames:t,lookup:r});if(l.ready||!l.command)return l;let m=Nt(l),g=l.unmet.find(f=>f.why);return a.emit({type:"warning",code:"APP_NEEDS_SETUP",step:"app.secrets",message:[`${n} won't open until ${pe(m)} ${m.length===1?"is":"are"} set`,...g?[St(g)[0]]:[]].join(`
-`),data:{setup:l}}),o.push({command:l.command.command,note:`asks for each; ${n} opens once they are set`}),l}function pn(e,i,n){let t=Object.keys(e.capabilities??{}).filter(a=>!i.get(a));if(t.length>0){let a=Ke(i);throw new d("CAPABILITY_UNKNOWN",[`${e.id} lists ${pe(t)} under capabilities, which ${n.replace(/^https:\/\//,"")} doesn't offer`,`Neither the built-in catalog nor the providers registered on this Gateway ${t.length===1?"has it":"have them"}. It offers: ${a.join(", ")}.`].join(`
-`),{fix:`register ${t.length===1?"it":"each"} with ${N} provider add <spec.json or https URL> (or fix the id in everyapp.config.ts), then deploy again`,data:{unknown:t,offered:a}})}He(e,{capabilities:i})}function cn(e){if(e.migrations?.dialect==="postgresql")throw new d("RELEASE_MIGRATIONS_UNSUPPORTED",`${e.id} can't deploy from a release: its Postgres migrations need the source`,{fix:`clone it, then run pnpm install in it and this checkout's ${N} deploy from its directory`})}function ln(e,i,n){let t=new Map((i.resources?.durableObjects??[]).map(o=>[o.className,o.worker]));for(let o of e.previousManifest?.resources?.durableObjects??[]){let r=String(o.className),s=o.worker?String(o.worker):void 0;if(t.has(r)&&t.get(r)!==s)throw new d("DURABLE_OBJECT_MOVED",`${r} can't move to another Worker
-A Durable Object's data can't follow it.`,{fix:"give the class a new name in everyapp.config.ts"});if(!t.has(r)&&s)throw new d("HELPER_DURABLE_OBJECT_REMOVED",`The helper Worker ${s} still defines ${r}
-Removing a helper Worker's Durable Object class isn't supported yet.`,{fix:`keep declaring ${r} in everyapp.config.ts`})}let a=(e.previousManifest?.resources?.durableObjects??[]).map(o=>String(o.className)).filter(o=>!t.has(o));if(a.length>0&&!n){let o=a.length===1;throw new d("DURABLE_OBJECT_REMOVED",`Deploying would delete ${o?`${a[0]}'s data`:`the data of ${a.join(", ")}`} for good
-everyapp.config.ts no longer declares the Durable Object class${o?"":"es"} ${a.join(", ")}.`)}return a}async function dn({cf:e,plan:i,workerName:n,manifest:t,allowDelete:a}){let o=await Ir({cf:e,workerName:n,previousManifest:i.previousManifest,names:Ae(n,t).map(r=>r.name)});if(o.length>0&&!a){let r=o.length===1;throw new d("WORKFLOW_REMOVED",`Deploying would delete the Workflow${r?"":"s"} ${o.map(s=>s.binding).join(", ")} and ${r?"its":"their"} instances
-everyapp.config.ts no longer declares ${r?"it":"them"}. Renaming a binding renames its Workflow.`)}return o}async function mn({cf:e,out:i,cwd:n,manifest:t,resources:a,accountId:o,registry:r,workerName:s,restoreCommand:l,appSecrets:m,drizzleKit:g,prisma:f}){if(t.migrations?.dialect==="postgresql")return await fn({out:i,cwd:n,manifest:t,appSecrets:m,drizzleKit:g,prisma:f}),null;let u=t.resources?.d1??[];if(u.length===0)return null;let p=Pt(u,t.migrations),w=a.d1?.[p]?.id,v=Or.resolve(n,ue(t));if(!w||!await ce(v))return Cr(i),null;i.emit({type:"step",step:"app.migrations",status:"start",message:"Migrating the database..."});let R=await xt({cf:e,databaseId:w,accountId:o,dir:v,registry:r,target:Lt(s),restoreCommand:l});return i.emit({type:"step",step:"app.migrations",status:"ok",message:R.applied.length>0?`Applied ${R.applied.join(", ")}.${Ut(R.rollback)}`:"The app's database is up to date.",data:Wt(R)}),R.rollback}async function fn({out:e,cwd:i,manifest:n,appSecrets:t,drizzleKit:a,prisma:o}){let r=n.migrations?.engine==="prisma"?"prisma":"drizzle",s=r==="drizzle"?ue(n):n.migrations?.dir;if(s!==void 0&&!await ce(Or.resolve(i,s))){Cr(e);return}e.emit({type:"step",step:"app.migrations",status:"start",message:"Migrating the Postgres database...",data:{dialect:"postgresql",engine:r}});let l={cwd:i,databaseUrl:t[A],config:n.migrations?.config},m;r==="prisma"?m=await Nr({...l,...o?{run:o}:{}}):await Sr({...l,...a?{run:a}:{}}),e.emit({type:"step",step:"app.migrations",status:"ok",message:`Migrated the app's Postgres database (${r==="prisma"?"prisma migrate deploy":"drizzle-kit migrate"}).`,data:{dialect:"postgresql",engine:r,...m?{applied:m}:{}}})}function Cr(e){e.emit({type:"step",step:"app.migrations",status:"skip",message:"No migrations to apply."})}async function uo(e){await vt(e,async i=>{let n=process.cwd(),t=await $r({cwd:n,manifest:await Y(n),gateway:bt(e.gateway),accountId:e["account-id"],out:i,json:e.json,verbose:e.verbose,allowDeleteDurableObjectData:e["allow-delete-durable-object-data"],allowDeleteWorkflows:e["allow-delete-workflows"],forceDns:e["force-dns"],enableEmailRouting:e["enable-email-routing"],waitForLive:!e["no-wait"],offerInstall:{yes:e.yes}});i.emit({type:"done",...un(t)})})}function un(e){return{data:{...Ht(e),organization:e.organizationName,publicRoutes:e.publicRoutes,mcp:e.mcp,...e.next.length>0?{next:e.next}:{}}}}export{$r as a,uo as b,un as c};
+`)[0]}`}),null));te=await wt(h,E.app.id,{versionId:z,manifest:r,actor:D.actor,email:D.email,source:o?"release":"cli",...oe?{secretNames:oe}:{}});let Ur=await an({cf:p,manifest:r,appId:r.id,secretNames:oe,out:t,next:V,providers:Ie});await Dt(h,{appRowId:E.app.id,setup:Ur,deployer:D},t)}finally{await j.release()}await Kt({cf:p,db:h,databaseId:R,out:t,accountId:w,appId:r.id,workerName:y,publishHost:De,interactive:s,forceDns:e.forceDns,seams:{...e.reconcile,openRelease:u.openRelease,source:u.source},verb:"deploy"});let M=`https://${C}`,Pe=!G&&(e.waitForLive??!0),_e=await Ft({wait:Pe,db:h,appRowId:E.app.id,appId:r.id,hostname:C,out:t,seams:e.live,message:`${r.id} is live at ${M}.`,verb:"deploy"});if(!_e){let x=G?"outside-base":Pe?void 0:De?"certificate":"first-visit";t.emit(te==="active"&&!G?{type:"step",step:"app.live",status:"ok",message:`${r.id} is live at ${M}.`,data:{hostname:C,url:M}}:{type:"step",step:"app.live",status:"skip",message:`${r.id} isn't live yet: ${M}.`,data:{hostname:C,url:M,...x?{reason:x}:{}}})}return await ct({cf:p,db:h,install:k,out:t},{appId:r.id,surface:{publicRoutes:X.length>0,mcp:ee!==null}}),G&&t.emit({type:"warning",code:"APP_HOST_OUTSIDE_BASE",step:"app.domain",message:`${C} isn't one label below ${k.appBaseDomain}
+The Gateway only serves names directly under ${k.appBaseDomain}, so ${r.id} can't be reached.`}),{liveUrl:M,gatewayUrl:S,organizationId:L.id,organizationName:L.name,hostname:C,workerName:y,versionId:z,live:_e||te==="active"&&!G,publicRoutes:X,mcp:ee,next:V}}async function an({cf:e,manifest:i,appId:n,secretNames:t,out:s,next:o,providers:r}){if(!It(i,r))return me({manifest:i,appId:n,gatewayNames:[],secretNames:[],lookup:r}).setup;let a=await Et(e).catch(()=>null),{setup:l}=me({manifest:i,appId:n,gatewayNames:a,secretNames:t,lookup:r});if(l.ready||!l.command)return l;let m=Nt(l),g=l.unmet.find(f=>f.why);return s.emit({type:"warning",code:"APP_NEEDS_SETUP",step:"app.secrets",message:[`${n} won't open until ${pe(m)} ${m.length===1?"is":"are"} set`,...g?[St(g)[0]]:[]].join(`
+`),data:{setup:l}}),o.push({command:l.command.command,note:`asks for each; ${n} opens once they are set`}),l}function pn(e,i,n){let t=Object.keys(e.capabilities??{}).filter(s=>!i.get(s));if(t.length>0){let s=Ke(i);throw new d("CAPABILITY_UNKNOWN",[`${e.id} lists ${pe(t)} under capabilities, which ${n.replace(/^https:\/\//,"")} doesn't offer`,`Neither the built-in catalog nor the providers registered on this Gateway ${t.length===1?"has it":"have them"}. It offers: ${s.join(", ")}.`].join(`
+`),{fix:`register ${t.length===1?"it":"each"} with ${N} provider add <spec.json or https URL> (or fix the id in everyapp.config.ts), then deploy again`,data:{unknown:t,offered:s}})}He(e,{capabilities:i})}function cn(e){if(e.migrations?.dialect==="postgresql")throw new d("RELEASE_MIGRATIONS_UNSUPPORTED",`${e.id} can't deploy from a release: its Postgres migrations need the source`,{fix:`clone it, then run pnpm install in it and this checkout's ${N} deploy from its directory`})}function ln(e,i,n){let t=new Map((i.resources?.durableObjects??[]).map(o=>[o.className,o.worker]));for(let o of e.previousManifest?.resources?.durableObjects??[]){let r=String(o.className),a=o.worker?String(o.worker):void 0;if(t.has(r)&&t.get(r)!==a)throw new d("DURABLE_OBJECT_MOVED",`${r} can't move to another Worker
+A Durable Object's data can't follow it.`,{fix:"give the class a new name in everyapp.config.ts"});if(!t.has(r)&&a)throw new d("HELPER_DURABLE_OBJECT_REMOVED",`The helper Worker ${a} still defines ${r}
+Removing a helper Worker's Durable Object class isn't supported yet.`,{fix:`keep declaring ${r} in everyapp.config.ts`})}let s=(e.previousManifest?.resources?.durableObjects??[]).map(o=>String(o.className)).filter(o=>!t.has(o));if(s.length>0&&!n){let o=s.length===1;throw new d("DURABLE_OBJECT_REMOVED",`Deploying would delete ${o?`${s[0]}'s data`:`the data of ${s.join(", ")}`} for good
+everyapp.config.ts no longer declares the Durable Object class${o?"":"es"} ${s.join(", ")}.`)}return s}async function dn({cf:e,plan:i,workerName:n,manifest:t,allowDelete:s}){let o=await Ir({cf:e,workerName:n,previousManifest:i.previousManifest,names:Ae(n,t).map(r=>r.name)});if(o.length>0&&!s){let r=o.length===1;throw new d("WORKFLOW_REMOVED",`Deploying would delete the Workflow${r?"":"s"} ${o.map(a=>a.binding).join(", ")} and ${r?"its":"their"} instances
+everyapp.config.ts no longer declares ${r?"it":"them"}. Renaming a binding renames its Workflow.`)}return o}async function mn({cf:e,out:i,cwd:n,manifest:t,resources:s,accountId:o,registry:r,workerName:a,restoreCommand:l,appSecrets:m,drizzleKit:g,prisma:f}){if(t.migrations?.dialect==="postgresql")return await fn({out:i,cwd:n,manifest:t,appSecrets:m,drizzleKit:g,prisma:f}),null;let u=t.resources?.d1??[];if(u.length===0)return null;let p=Pt(u,t.migrations),w=s.d1?.[p]?.id,v=Or.resolve(n,ue(t));if(!w||!await ce(v))return Cr(i),null;i.emit({type:"step",step:"app.migrations",status:"start",message:"Migrating the database..."});let R=await xt({cf:e,databaseId:w,accountId:o,dir:v,registry:r,target:Lt(a),restoreCommand:l});return i.emit({type:"step",step:"app.migrations",status:"ok",message:R.applied.length>0?`Applied ${R.applied.join(", ")}.${Ut(R.rollback)}`:"The app's database is up to date.",data:Wt(R)}),R.rollback}async function fn({out:e,cwd:i,manifest:n,appSecrets:t,drizzleKit:s,prisma:o}){let r=n.migrations?.engine==="prisma"?"prisma":"drizzle",a=r==="drizzle"?ue(n):n.migrations?.dir;if(a!==void 0&&!await ce(Or.resolve(i,a))){Cr(e);return}e.emit({type:"step",step:"app.migrations",status:"start",message:"Migrating the Postgres database...",data:{dialect:"postgresql",engine:r}});let l={cwd:i,databaseUrl:t[A],config:n.migrations?.config},m;r==="prisma"?m=await Nr({...l,...o?{run:o}:{}}):await Sr({...l,...s?{run:s}:{}}),e.emit({type:"step",step:"app.migrations",status:"ok",message:`Migrated the app's Postgres database (${r==="prisma"?"prisma migrate deploy":"drizzle-kit migrate"}).`,data:{dialect:"postgresql",engine:r,...m?{applied:m}:{}}})}function Cr(e){e.emit({type:"step",step:"app.migrations",status:"skip",message:"No migrations to apply."})}async function uo(e){await vt(e,async i=>{let n=process.cwd(),t=await $r({cwd:n,manifest:await Y(n),gateway:bt(e.gateway),accountId:e["account-id"],out:i,json:e.json,verbose:e.verbose,allowDeleteDurableObjectData:e["allow-delete-durable-object-data"],allowDeleteWorkflows:e["allow-delete-workflows"],forceDns:e["force-dns"],enableEmailRouting:e["enable-email-routing"],waitForLive:!e["no-wait"],offerInstall:{yes:e.yes}});i.emit({type:"done",...un(t)})})}function un(e){return{data:{...Ht(e),organization:e.organizationName,publicRoutes:e.publicRoutes,mcp:e.mcp,...e.next.length>0?{next:e.next}:{}}}}export{$r as a,uo as b,un as c};