everyapp 0.3.0-rc.1 → 0.3.0-rc.2

package/dist/chunk-GKBPYVP3.js

@@ -0,0 +1,25 @@
+import{b as ne,e as ie,g as se,i as oe,l as ae,m as D,n as pe,o as I,r as ce,s as le}from"./chunk-6OGVO7QK.js";import{d as te,e as re,f as C}from"./chunk-H7PDL3X5.js";import{Bb as l,Gb as q,Pb as J,Qb as X,Sb as Q,Yb as Z,Zb as _,_b as ee,b as N,c as W,j as G,lb as Y,nb as H,qb as K,tb as $}from"./chunk-LYNBZ7RV.js";import{spawn as Ce,spawnSync as Ue}from"node:child_process";import F from"node:fs";import k from"node:fs/promises";import{createRequire as Be}from"node:module";import h from"node:path";import{z as v}from"zod";import Ne from"node:fs";import We from"node:path";import Ie from"node:fs/promises";import ue from"node:path";var Le=200*1024*1024,Pe=5*6e4,Te=5,je=new Set([301,302,303,307,308]);function L(e){let t=/^([\w.-]+)\/([\w.-]+)$/.exec(e.trim());if(t)return`${t[1]}/${t[2].replace(/\.git$/,"")}`;let r;try{r=new URL(e.trim())}catch{return null}if(r.protocol!=="https:"||r.hostname!=="github.com")return null;let[n,i]=r.pathname.split("/").filter(Boolean);return!n||!i?null:`${n}/${i.replace(/\.git$/,"")}`}async function he({repo:e,asset:t,tag:r,...n}){let i=L(e);if(!i)throw new l("RELEASE_NOT_FOUND",`${e} isn't a GitHub repository (https://github.com/<owner>/<repo>).`);let o=r?`https://github.com/${i}/releases/download/${encodeURIComponent(r)}/${encodeURIComponent(t)}`:`https://github.com/${i}/releases/latest/download/${encodeURIComponent(t)}`,s=await U(o,{...n,notFound:`${i} has no ${r?`release ${r}`:"published release"} with ${t} that can be downloaded without signing in (https://github.com/${i}/releases).`});if(!s.tag)throw await s.cleanup(),new l("RELEASE_DOWNLOAD_FAILED",`GitHub didn't say which release of ${i} ${o} is.`);return{...s,tag:s.tag,repo:i}}async function U(e,{fetch:t=fetch,timeoutMs:r=Pe,maxBytes:n=Le,notFound:i}={}){let o=AbortSignal.timeout(r),{response:s,current:a,tag:c}=await xe(e,t,o).catch(p=>{throw me(p,e)});if(s.status===404)throw await s.body?.cancel(),new l("RELEASE_NOT_FOUND",i??`${e} doesn't exist (404).`);if(!s.ok||!s.body)throw await s.body?.cancel(),new l("RELEASE_DOWNLOAD_FAILED",`Couldn't download ${e}: HTTP ${s.status}.`,{retryable:s.status>=500});if(Number(s.headers.get("content-length"))>n)throw await s.body.cancel(),ge(e,n);let{dir:u,cleanup:w}=await _("release-download-"),g=ue.join(u,ue.posix.basename(a.pathname)||"release.tar.gz");try{let p=await Ie.open(g,"wx",384);try{let f=0;for await(let m of s.body){if(f+=m.byteLength,f>n)throw ge(e,n);await p.write(m)}}finally{await p.close()}}catch(p){throw await s.body.cancel().catch(()=>{}),await w(),me(p,e)}return{tarball:g,tag:c,url:e,cleanup:w}}async function xe(e,t,r){let n=de(e,e),i=fe(n);for(let o=0;;o+=1){let s=await t(n.href,{redirect:"manual",credentials:"omit",signal:r,headers:{accept:"application/octet-stream"}});if(!je.has(s.status))return{response:s,current:n,tag:i};let a=s.headers.get("location");if(await s.body?.cancel(),!a||o>=Te)throw new l("RELEASE_DOWNLOAD_FAILED",`${e} redirects ${a?"too many times":"nowhere"}.`);n=de(new URL(a,n).href,e),i??=fe(n)}}function de(e,t){let r;try{r=new URL(e)}catch{throw new l("RELEASE_DOWNLOAD_FAILED",`${e} isn't a URL.`)}if(r.protocol!=="https:")throw new l("RELEASE_DOWNLOAD_FAILED",`${t} ${e===t?"isn't":`redirects to ${e}, which isn't`} an HTTPS URL.`);return r}function fe(e){if(e.hostname!=="github.com")return null;let t=/^\/[^/]+\/[^/]+\/releases\/download\/([^/]+)\/[^/]+$/.exec(e.pathname);return t?decodeURIComponent(t[1]):null}function ge(e,t){return new l("RELEASE_TOO_LARGE",`${e} is over ${Math.round(t/1024/1024)} MB, too big for a release
+A release is a few MB. Check the URL.`)}function me(e,t){if(e instanceof l)return e;let r=e.name;return new l("RELEASE_DOWNLOAD_FAILED",r==="TimeoutError"||r==="AbortError"?`Downloading ${t} timed out.`:`Couldn't download ${t}: ${e.message}`,{retryable:!0})}function P(e){return/^[a-z][a-z0-9+.-]*:\/\//i.test(e)}async function we(e,{asset:t,what:r,step:n,missing:i,out:o,fetch:s}){if(!P(e)){let u=We.resolve(e);if(!Ne.existsSync(u))throw new l("RELEASE_NOT_FOUND",i);return{tarball:u,origin:{kind:"file",path:u},cleanup:async()=>{}}}let a=B(e);o.emit({type:"progress",step:n,message:`Downloading ${r} from ${a?`${a.repo}${a.tag?` release ${a.tag}`:"'s latest release"}`:e}...`,data:{url:e}});let c,d;if(a){let u=await he({repo:a.repo,asset:t,tag:a.tag,fetch:s});c=u,d={kind:"github",repo:u.repo,tag:u.tag}}else{c=await U(e,{fetch:s});let u=c.tag?L(e):null;d=u&&c.tag?{kind:"github",repo:u,tag:c.tag}:{kind:"url",url:e}}return{tarball:c.tarball,origin:d,cleanup:c.cleanup}}function B(e){let t=L(e);if(!t||!P(e))return null;let r=new URL(e).pathname.split("/").filter(Boolean).slice(2);return r.length===0||r.length===1&&r[0]==="releases"?{repo:t}:r.length===3&&r[0]==="releases"&&r[1]==="tag"?{repo:t,tag:decodeURIComponent(r[2])}:r.length===2&&r[0]==="releases"&&r[1]==="latest"?{repo:t}:null}var M="everyapp-release.tar.gz",O="migrations",ye=h.join(".cloudflare","output"),S="v0",Fe="0.3.0",Me="0.3.0",Ee=/^(\.DS_Store|\._.*)$/;function ze(e){try{return Be(h.join(e,"package.json"))("@every-app/sdk/package.json").version??null}catch{return null}}var Ve=ne.extend({kind:v.literal("app"),appId:v.string().min(1),cliVersion:v.string(),sdkVersion:v.string().nullable(),manifest:v.record(v.string(),v.unknown())});function xt(e){switch(e.kind){case"github":return`github.com/${e.repo} (release ${e.tag})`;case"url":return e.url;case"file":return e.path;case"checkout":return"this checkout"}}function Ge(e){if(e.migrations?.engine==="prisma")throw new l("RELEASE_MIGRATIONS_UNSUPPORTED",`${e.id} migrates with Prisma, which a release can't carry
+Prisma migrations (migrations.engine "prisma") need the app's source and its Prisma CLI.`,{rerun:`${W} deploy`,rerunNote:"from the app's checkout"});if(e.migrations?.dialect==="postgresql")return C(e);let t=e.resources?.d1??[];return t.length===0?null:(re(t,e.migrations),C(e))}async function Ye(e){return(await k.readdir(e,{recursive:!0,withFileTypes:!0})).filter(t=>!t.isDirectory()).map(t=>h.relative(e,h.join(t.parentPath,t.name)).split(h.sep).join("/")).sort()}async function He(e){let t=(await Ye(e)).filter(r=>{let n=h.posix.basename(r);return n.startsWith(".dev.vars")||n.startsWith(".env")||n.endsWith(".pem")||/(^|\/)\.cloudflare\/(state|types)(\/|$)/.test(r)||/(^|\/)\.(wrangler|everyapp)(\/|$)/.test(r)});if(t.length>0)throw new l("RELEASE_LOCAL_STATE",`Refusing to pack local state or secrets into the release:
+  ${t.join(`
+  `)}`)}async function Ke(e){let t;try{t=await k.readFile(h.join(e,"meta","_journal.json"),"utf8")}catch(n){if(Z(n))return[];throw n}return(JSON.parse(t).entries??[]).map(({tag:n,when:i})=>({tag:n,when:i}))}function be(e,t){let r=Ue("git",t,{cwd:e,encoding:"utf8"});return r.status===0?r.stdout.trim():null}function qe(e){return new Promise((t,r)=>{let n=Ce("tar",e,{stdio:["ignore","ignore","pipe"],env:{...process.env,COPYFILE_DISABLE:"1"}}),i="";n.stderr.on("data",o=>i+=o.toString()),n.once("error",r),n.once("close",o=>o===0?t():r(new l("RELEASE_PACK_FAILED",`tar couldn't pack the release (exit ${o}): ${i.trim()}`)))})}async function Nt({cwd:e,manifest:t,outFile:r,cfVersion:n,builtAt:i=new Date}){let o=h.join(e,ye),s=F.existsSync(o)?(await k.readdir(o)).filter(w=>!Ee.test(w)):[];if(s.length!==1||s[0]!==S)throw new l("RELEASE_PACK_FAILED",`Expected the Build Output ${S} alone in ${o}, found ${s.length?s.join(", "):"none"}.`);let a=h.join(o,S);if(!await I(a))throw new l("RELEASE_PACK_FAILED",`The app's Build Output isn't a production build
+A release ships only one.`,{fix:"build with `cf build` (production by default)"});let c=Ge(t),{dir:d,cleanup:u}=await _("app-release-stage-");try{let w=(E,x)=>k.cp(E,h.join(d,x),{recursive:!0,dereference:!0,filter:R=>!Ee.test(h.basename(R))});await w(a,h.join(ye,S));let g=c?h.resolve(e,c):null,p=g!==null&&F.existsSync(g)&&F.statSync(g).isDirectory();p&&await w(g,O),await He(d);let f=JSON.parse(await k.readFile(h.join(e,"package.json"),"utf8").catch(()=>"{}")),m=be(e,["rev-parse","HEAD"]),A=m!==null&&!!be(e,["status","--porcelain","--","."]),j={schema:1,kind:"app",appId:t.id,version:f.version??"0.0.0",gitSha:m?`${m}${A?"-dirty":""}`:"unknown",builtAt:i.toISOString(),cfVersion:n,cliVersion:N,sdkVersion:ze(e),buildOutputVersion:S,sha256:await ie(d),migrations:p?await Ke(h.join(d,O)):[],minCli:Fe,minSdk:Me,manifest:t.migrations||p?{...t,migrations:{engine:"drizzle",...t.migrations,dir:O}}:t};return await k.writeFile(h.join(d,"release.json"),`${JSON.stringify(j,null,2)}
+`),await k.mkdir(h.dirname(r),{recursive:!0}),await k.rm(r,{force:!0}),await qe(["-czf",r,"-C",d,"."]),j}finally{await u()}}async function Je(e,{origin:t={kind:"file",path:e},version:r=N}={}){let{dir:n,manifest:i,cleanup:o}=await se(e,"app",Ve);try{oe(i,r,`${i.appId} ${i.version}`);let s;try{s=H(i.manifest,te)}catch(c){throw c instanceof Y?new l("RELEASE_INVALID",`${e} carries a manifest this everyapp refuses: ${c.message}`):c}if(s.id!==i.appId)throw new l("RELEASE_INVALID",`${e} says it is ${i.appId}, but its manifest is ${s.id}'s.`);let a=s.migrations?.dir;if(a!==void 0&&a!==O)throw new l("RELEASE_INVALID",`${e}'s manifest keeps its migrations in ${a}; a release keeps them in ${O}/.`);return{dir:n,release:i,manifest:s,origin:t,cleanup:o}}catch(s){throw await o(),s}}async function Wt(e,{out:t,fetch:r,version:n}){let i=P(e)?B(e):null,o;try{o=await we(e,{asset:M,what:"the app",step:"app.release",missing:`${e} is neither a URL nor a file
+Pass a GitHub repository URL (https://github.com/<owner>/<repo>), a release tarball's URL, or a downloaded ${M}.`,out:t,fetch:r})}catch(s){throw i&&s instanceof l&&s.code==="RELEASE_NOT_FOUND"?new l("NO_RELEASE",`${i.repo} publishes no everyapp release${i.tag?` ${i.tag}`:""}
+Its GitHub releases have no ${M}.`,{fix:`clone it, then run pnpm install in it and this checkout's ${W} deploy from its directory`}):s}try{let s=await Je(o.tarball,{origin:o.origin,version:n});return{...s,cleanup:async()=>{await s.cleanup(),await o.cleanup()}}}catch(s){throw await o.cleanup(),s}}import{rmSync as Qe}from"node:fs";import b from"node:fs/promises";import y from"node:path";import{execa as Ze}from"execa";import T from"node:fs";import Xe from"node:path";function ke(e,t){let r=Xe.join(e,".gitignore");if(!T.existsSync(r)){T.writeFileSync(r,t+`
+`);return}let n=T.readFileSync(r,"utf-8");n.split(`
+`).some(o=>o.trim()===t||o.trim()===t.replace(/\/$/,""))||T.appendFileSync(r,(n.endsWith(`
+`)?"":`
+`)+t+`
+`)}var et=["drizzle.config.ts","drizzle.config.js"],ve=12e4;async function Jt({cwd:e,manifest:t,out:r}){let n=t.migrations?.engine??"drizzle",i=t.migrations?.dialect==="postgresql",o=(g,p={})=>r.emit({type:"warning",code:"SCHEMA_CHECK_SKIPPED",step:"app.schema",message:`Can't check the schema against the migrations: ${g}${p.detail?`
+${p.detail}`:""}`,...p.fix?{data:{fix:p.fix}}:{}});if(n==="prisma"){r.emit({type:"progress",step:"app.schema",message:"To check a Prisma schema against its migrations: prisma migrate diff --from-migrations <dir> --to-schema <schema> --exit-code, with datasource.shadowDatabaseUrl set in prisma.config.ts."}),r.emit({type:"step",step:"app.schema",status:"skip",message:"Schema not checked against migrations (Prisma needs a shadow database; --verbose shows how)",data:{engine:n}});return}if(!i&&!t.resources?.d1?.length||n!=="drizzle")return;let s;try{s=(await Q(e,"drizzle-kit","drizzle-kit")).binPath}catch{o("drizzle-kit isn't installed",{fix:"add drizzle-kit to devDependencies"});return}let a=t.migrations?.config,c=await tt(e,a?[a]:et);if(!c){o(a?`no ${a} (migrations.config)`:"no drizzle.config.ts",a?{}:{detail:'An app whose drizzle config lives elsewhere sets migrations.config to its path; an app that writes its SQL by hand sets migrations.engine to "d1-sql".'});return}r.emit({type:"step",step:"app.schema",status:"start",message:"Checking the schema..."});let d=y.resolve(e,t.migrations?.dir??"drizzle");ke(e,".everyapp/"),await b.mkdir(y.join(e,".everyapp"),{recursive:!0});let u=await b.mkdtemp(y.join(e,".everyapp","schema-check-")),w=J({sync:()=>Qe(u,{recursive:!0,force:!0})});try{let g=y.join(u,"migrations");await b.cp(d,g,{recursive:!0}).catch(async E=>{if(E.code!=="ENOENT")throw E;await b.mkdir(g)});let p=new Set(await Ae(g)),f=y.join(u,"drizzle.config.ts");await b.writeFile(f,[`import config from ${JSON.stringify(c)};`,`export default { ...config, out: ${JSON.stringify(y.relative(e,g).split(y.sep).join("/"))} };`,""].join(`
+`));let m=y.join(u,"report-failure.cjs");await b.writeFile(m,["const report = console.error;","console.error = (...args) => {","  if (args.some((arg) => arg instanceof Error)) process.exitCode = 1;","  report(...args);","};",""].join(`
+`));let A=await Ze(process.execPath,["--require",m,s,"generate","--config",f],{cwd:e,stdin:"ignore",reject:!1,timeout:ve,env:{NODE_NO_WARNINGS:"1"}});if((await Ae(g)).filter(E=>!p.has(E)).length>0)throw new l("SCHEMA_DRIFT",`The schema has changes no migration covers
+drizzle-kit would write a new migration for them. Nothing was migrated or uploaded.`,{rerun:"pnpm db:generate",rerunNote:"then run this again"});if(A.failed){let E=A.stderr.split(`
+`).map(R=>R.trim()).filter(Boolean),x=E.find(R=>/^\w*Error\b/.test(R))??E.at(-1)??(A.timedOut?`no answer in ${ve/1e3} s`:`exit ${A.exitCode}`);throw new l("SCHEMA_CHECK_FAILED",`drizzle-kit couldn't compare the schema with the migrations
+${x}. Nothing was migrated or uploaded.`,{rerun:"pnpm db:generate",rerunNote:"in a terminal; it asks about renamed columns and tables"})}r.emit({type:"step",step:"app.schema",status:"ok",message:"The schema matches the migrations."})}finally{await b.rm(u,{recursive:!0,force:!0}),w()}}async function tt(e,t){for(let r of t){let n=y.join(e,r);try{if((await b.stat(n)).isFile())return n}catch{}}return null}async function Ae(e){return(await b.readdir(e,{recursive:!0,withFileTypes:!0})).filter(r=>r.isFile()&&r.name.endsWith(".sql")).map(r=>y.relative(e,y.join(r.parentPath,r.name)))}var rt=6e5,Re={EVERYAPP_BUILD:"1"};async function nr({cwd:e,cf:t,buildCommand:r,verbose:n}){if(r){await ee(r,[],{cwd:e,env:{...process.env,...Re,NODE_OPTIONS:X(process.env.NODE_OPTIONS)},shell:!0,echo:n,what:"Build",code:"BUILD_FAILED"});return}await t.run({args:["build"],plane:"project",cwd:e,mode:"text",env:Re,timeoutMs:rt,...n?{onOutput:i=>void process.stderr.write(i)}:{}}).catch(i=>{throw i instanceof q?new l("BUILD_FAILED",["Build failed","cf build's last lines:",...G(i.stdout,i.stderr).map(o=>`  ${o}`)].join(`
+`)):i})}import nt from"node:fs/promises";import z from"node:path";var it=new Set(["text","json","secret","version-metadata","assets","d1","kv","r2","durable-object","workflow","worker","hyperdrive","ai"]);function Se(e,t){return e==="EVERY_APP_GATEWAY"&&t.worker===K&&t.exportName==="AppGateway"}function V(e,t){return e===t||e.startsWith(`${t}${$}`)}function st(e,t){let{workerName:r,helperWorkers:n=[]}=t,i=[];e.name!==r&&i.push(`its name is "${e.name}", not "${r}"`),i.push(...Oe(e));let o=e.env??{};for(let a of["EVERYAPP_IDENTITY_PUBLIC_KEYS","EVERYAPP_IDENTITY_ISSUER"])o[a]?.type!=="text"&&i.push(`${a} isn't built in`);let s=o.EVERYAPP_AUDIENCE;return(s?.type!=="text"||s.value!==r)&&i.push(`EVERYAPP_AUDIENCE isn't the Worker's name ("${r}")`),i.push(..._e(o,t,(a,c)=>Se(a,c)||n.includes(String(c.worker))),...De(e.exports??{},t.deletedDurableObjects??[],r)),i}function ot(e,t,r){let n=[];return e.name!==t&&n.push(`its name is "${e.name}", not "${t}"`),n.push(...Oe(e),..._e(e.env??{},r,Se),...De(e.exports??{},[],r.workerName)),n}function Oe(e){let t=[];e.workersDev!==!1&&t.push("workersDev isn't false"),e.previewUrls!==!1&&t.push("previewUrls isn't false"),e.domains?.length&&t.push("it declares domains (apps are served through the gateway)");for(let r of e.triggers??[])r.type!=="scheduled"&&t.push(r.type==="fetch"?"it declares routes (apps are served through the gateway)":`it declares a trigger of type "${String(r.type)}" (apps may only declare cron schedules)`);return e.env?.EVERYAPP_DEV&&t.push("EVERYAPP_DEV is set, which only `everyapp dev` may do"),t}function _e(e,{workerName:t,resources:r,helperWorkers:n=[],declared:i},o){let s=[],a=new Set([t,...n]),c=new Set(Object.values(r.d1??{}).map(p=>p.id)),d=new Set(Object.values(r.kv??{}).map(p=>p.id)),u=new Set(Object.values(r.hyperdrive??{}).map(p=>p.id)),w=Object.values(r.r2??{}).map(p=>p.name),g=i?.ai??[];for(let[p,f]of Object.entries(e)){if(!it.has(String(f.type))){s.push(`${p} is a ${String(f.type)} binding, which Every App apps can't use`);continue}switch(f.type){case"worker":o(p,f)||s.push(`${p} binds Worker "${String(f.worker)}"; apps may only bind the gateway's AppGateway and, from the app's own Worker, its helper Workers`);break;case"durable-object":a.has(String(f.worker))||s.push(`${p} binds another Worker's Durable Object ("${String(f.worker)}")`);break;case"d1":c.has(String(f.id))||s.push(`${p} isn't a D1 database the deploy provisioned`);break;case"kv":d.has(String(f.id))||s.push(`${p} isn't a KV namespace the deploy provisioned`);break;case"hyperdrive":u.has(String(f.id))||s.push(`${p} isn't a Hyperdrive config the deploy provisioned`);break;case"ai":g.includes(p)||s.push(g.length>0?`${p} is a Workers AI binding, which isn't one of the app's in resources.ai (${g.join(", ")})`:`${p} is a Workers AI binding, which everyapp.config.ts doesn't declare; list it in resources.ai`);break;case"r2":{let m=String(f.name??"");w.length>0?w.includes(m)||s.push(`${p} is bucket "${m}", which isn't one of the app's buckets in resources.r2 (${w.join(", ")})`):V(m,t)||s.push(`${p} is bucket "${m}"; an app's buckets are named after its Worker (${t} or ${t}${$}<name>)`);break}case"workflow":{let m=String(f.name??"");(!a.has(String(f.worker))||!V(m,t))&&s.push(`${p} binds Workflow "${m}" of Worker "${String(f.worker)}"; an app binds only its own Workflows, named after its Worker (${t}${$}<name>)`);break}}}return s}function De(e,t,r){let n=[];for(let[i,o]of Object.entries(e))if(o.type!=="worker"){if(o.type==="workflow"){let s=String(o.name??"");V(s,r)||n.push(`Workflow ${i} is named "${s}"; an app's Workflows are named after its Worker (${r}${$}<name>)`);continue}if(o.type!=="durable-object"){n.push(`export ${i} is a ${String(o.type)}, which Every App apps can't declare`);continue}switch(o.container!==void 0&&n.push(`Durable Object class ${i} is backed by a container, which Every App apps can't run`),o.state??"created"){case"created":case"renamed":break;case"deleted":t.includes(i)||n.push(`Durable Object class ${i} is marked deleted, which deletes its data; remove it from everyapp.config.ts and deploy with --allow-delete-durable-object-data instead`);break;case"transferred":n.push(`Durable Object class ${i} would move its data to Worker "${String(o.transferredTo)}"`);break;case"expecting-transfer":n.push(`Durable Object class ${i} would take the data of Worker "${String(o.transferFrom)}"'s class`);break;default:n.push(`Durable Object class ${i} has state "${o.state}", which everyapp doesn't deploy`)}}return n}async function ur({cwd:e,inputs:t}){if(!await I(z.join(e,ae)))throw new l("APP_POLICY","The app's Build Output isn't a production build. The manifest's build command must run `cf build` (production by default).");let r=await pt(e),n=t.helperWorkers??[],i=[],o=r.get(D);if(!o)throw new l("APP_POLICY","The app's Build Output has no default Worker. Build it from everyAppWorker() in cloudflare.config.ts.");i.push(...st(o.config,t));for(let[a,{config:c}]of r){if(a===D)continue;let d=String(c.name);if(!n.includes(d)){i.push(`the build has a Worker "${d}" that everyapp.config.ts doesn't declare in workers`);continue}i.push(...ot(c,d,t).map(u=>`${d}: ${u}`))}for(let a of n)[...r.values()].some(({config:c})=>c.name===a)||i.push(`the build has no Worker ${a}, which everyapp.config.ts declares; add it to the Vite plugin's auxiliaryWorkers with everyAppAuxiliaryWorker()`);if(i.length>0)throw new l("APP_POLICY",`The built Worker can't be deployed as an Every App app:
+  - ${i.join(`
+  - `)}
+Build it from everyAppWorker() in cloudflare.config.ts.`);let s={};for(let[a,{config:c,directory:d}]of r){if(a!==D){let u=String(c.name);s[u]=$e(c,u)}if(c.manifest){let u={...c.manifest.modules??{}};for(let w of await le(z.join(d,"bundle")))u[w]={type:"sourcemap"};c.manifest={...c.manifest,modules:u}}ce(c),await nt.writeFile(z.join(d,"worker.config.json"),`${JSON.stringify(c,null,2)}
+`)}return{workflows:$e(o.config,t.workerName),helperWorkflows:s,r2Buckets:[...new Set([...r.values()].flatMap(({config:a})=>at(a)))].sort()}}function at(e){let t=e.env??{};return Object.values(t).filter(r=>r?.type==="r2"&&typeof r.name=="string").map(r=>r.name)}function $e(e,t){let r=[...Object.values(e.exports??{}).filter(n=>n.type==="workflow").map(n=>String(n.name)),...Object.values(e.env??{}).filter(n=>n.type==="workflow"&&n.worker===t).map(n=>String(n.name))];return[...new Set(r)]}async function pt(e){let t=new Map;for await(let{name:r,config:n,directory:i}of pe(e))t.set(r,{config:n,directory:i});return t}export{ke as a,Jt as b,nr as c,ur as d,M as e,xt as f,Nt as g,Wt as h};

package/dist/{chunk-KMAOZRV4.js → chunk-H6QQMY7B.js}

@@ -1,4 +1,4 @@
-import{a as ue,d as fe,f as we,h as G,j as ge,k as he,p as ve,q as be}from"./chunk-PMPIMHKG.js";import{a as ke,c as De,d as M}from"./chunk-OVKVV6MK.js";import{b as ye,c as T}from"./chunk-RFVMR32Y.js";import{b as C,c as P,e as ie,f as le}from"./chunk-GRFPP4UW.js";import{b as ce}from"./chunk-R4CGF622.js";import{a as pe,c as de,e as me}from"./chunk-3AAHHUJC.js";import{h as Q}from"./chunk-EUNGJMJ6.js";import{V as se,d as ee,f as te,g as ae,h as re,i as oe,k as ne,l as _}from"./chunk-ZYL2ZHCF.js";import{a as X}from"./chunk-7LG3F4FF.js";import{Ib as Z,Pb as A,Rb as q,Sb as J,c as R,d as S,f as O,ib as D,nb as j,tb as h,wb as F,xb as V,yb as K,zb as Y}from"./chunk-SAT3PGZU.js";import{execFile as x}from"node:child_process";import y from"node:fs/promises";import k from"node:path";import{promisify as L}from"node:util";var N=["apps/every-app-gateway","packages/sdk","packages/perimeter","packages/toolbus","pnpm-workspace.yaml","pnpm-lock.yaml"],_e=3;function gt({out:e,verbose:t}){let a=ce();return{describe:()=>Me(a),open:()=>Le({root:a,out:e,verbose:t})}}function Ge(e){return k.join(e,"node_modules",".cache","everyapp")}async function W(e){let t;try{({stdout:t}=await L(x)("git",["ls-files","-z","--cached","--others","--exclude-standard","--",...N],{cwd:e,maxBuffer:64*1024*1024}))}catch{return null}let a=[...new Set(t.split("\0").filter(Boolean))];return a.length>0?we(e,a):null}async function Re(e){try{let{stdout:t}=await L(x)("git",["log","-1","--format=%ct","--",...N],{cwd:e}),a=Number.parseInt(t.trim(),10);return Number.isFinite(a)?a*1e3:null}catch{return null}}async function Te(e,t){let a=r=>L(x)("git",r,{cwd:e}),o=()=>a(["diff","--quiet",`gateway-v${t}`,"HEAD","--",...N]).then(()=>!1,()=>!0);try{let[r,l]=await Promise.all([a(["rev-parse","--short","HEAD"]),a(["status","--porcelain","--",...N])]),n=l.stdout.trim()!=="";return!n&&!await o()?null:{hash:r.stdout.trim(),uncommittedChanges:n}}catch{return null}}async function Me(e){let t=k.join(e,"apps","every-app-gateway"),a=async c=>JSON.parse(await y.readFile(k.join(t,c),"utf8")),[o,r,l,n]=await Promise.all([W(e),Re(e),a("drizzle/meta/_journal.json"),a("package.json")]),s=String(n.version??"unknown"),i=await Te(e,s);return{treeSha256:o,origin:{kind:"checkout"},...i?{commit:i}:{},version:s,order:{schema:ge(l.entries??[]),committedAt:r??Date.now()}}}async function We({root:e,out:t,build:a,keep:o=_e}){let[r,l]=await Promise.all([W(e),Re(e)]),n=Ge(e),s=r?k.join(n,`${r}.tar.gz`):null,i={origin:{kind:"checkout"},treeSha256:r,committedAt:l};if(s&&await A(s))try{let m=await G(s,i),d=new Date;return await y.utimes(s,d,d),t.emit({type:"step",step:"gateway.release",status:"ok",message:`Using the Gateway ${m.manifest.version} built from this checkout before (${r.slice(0,12)}).`,data:{cached:!0,treeSha256:r,release:m.manifest.version}}),m}catch{await y.rm(s,{force:!0})}let c=await a();s&&await W(e)===r&&await xe(c,s,o);let p=await G(c,{origin:{kind:"checkout"},treeSha256:s&&await A(s)?r:null,committedAt:l});return t.emit({type:"step",step:"gateway.release",status:"ok",message:`Built the Gateway ${p.manifest.version} from this checkout.`,data:{cached:!1,treeSha256:p.source.treeSha256,release:p.manifest.version}}),p}async function xe(e,t,a){let o=k.dirname(t);await y.mkdir(o,{recursive:!0});let r=`${t}.${process.pid}.partial`;await y.copyFile(e,r),await y.rename(r,t);let l=await Promise.all((await y.readdir(o)).filter(n=>n.endsWith(".tar.gz")).map(async n=>({file:k.join(o,n),usedAt:(await y.stat(k.join(o,n))).mtimeMs})));for(let{file:n}of l.sort((s,i)=>i.usedAt-s.usedAt).slice(a))n!==t&&await y.rm(n,{force:!0})}function Le({root:e,out:t,verbose:a}){return We({root:e,out:t,build:()=>ze(e,t,a??!1)})}async function ze(e,t,a,o=process.env){let r=k.join(e,"apps","every-app-gateway");t.emit({type:"step",step:"gateway.release",status:"start",message:"Building the Gateway from this checkout (usually 1\u20132m)",data:{dir:r}});let l=(n,s)=>J("pnpm",n,{cwd:s,env:{...o,NODE_OPTIONS:Z(o.NODE_OPTIONS)},echo:a,what:"Building the Gateway",code:"GATEWAY_BUILD_FAILED",fix:"fix the build error above, then run this again",logName:"gateway-build"});return await l(["--filter","@every-app/sdk","build"],e),await l(["run","build:release"],r),k.join(r,ue)}var Be=`SELECT apps.app_slug, apps.worker_name, apps.hostname, apps.status,
+import{a as ue,d as fe,f as we,h as G,j as ge,k as he,p as ve,q as be}from"./chunk-6OGVO7QK.js";import{a as ke,c as De,d as M}from"./chunk-N5GQLGEC.js";import{b as ye,c as T}from"./chunk-W3JCQHHU.js";import{b as C,c as P,e as ie,f as le}from"./chunk-ZFCUH5PK.js";import{b as ce}from"./chunk-23HJ5I2A.js";import{a as pe,c as de,e as me}from"./chunk-6PGUCTJ6.js";import{h as Q}from"./chunk-HOUHG236.js";import{V as se,d as ee,f as te,g as ae,h as re,i as oe,k as ne,l as _}from"./chunk-RMF4YGD6.js";import{a as X}from"./chunk-T2GD7RHS.js";import{Bb as h,Eb as F,Fb as V,Gb as K,Hb as Y,Qb as Z,Xb as A,Zb as q,_b as J,c as R,d as S,f as O,qb as D,vb as j}from"./chunk-LYNBZ7RV.js";import{execFile as x}from"node:child_process";import y from"node:fs/promises";import k from"node:path";import{promisify as L}from"node:util";var N=["apps/every-app-gateway","packages/sdk","packages/perimeter","packages/toolbus","pnpm-workspace.yaml","pnpm-lock.yaml"],_e=3;function gt({out:e,verbose:t}){let a=ce();return{describe:()=>Me(a),open:()=>Le({root:a,out:e,verbose:t})}}function Ge(e){return k.join(e,"node_modules",".cache","everyapp")}async function W(e){let t;try{({stdout:t}=await L(x)("git",["ls-files","-z","--cached","--others","--exclude-standard","--",...N],{cwd:e,maxBuffer:64*1024*1024}))}catch{return null}let a=[...new Set(t.split("\0").filter(Boolean))];return a.length>0?we(e,a):null}async function Re(e){try{let{stdout:t}=await L(x)("git",["log","-1","--format=%ct","--",...N],{cwd:e}),a=Number.parseInt(t.trim(),10);return Number.isFinite(a)?a*1e3:null}catch{return null}}async function Te(e,t){let a=r=>L(x)("git",r,{cwd:e}),o=()=>a(["diff","--quiet",`gateway-v${t}`,"HEAD","--",...N]).then(()=>!1,()=>!0);try{let[r,l]=await Promise.all([a(["rev-parse","--short","HEAD"]),a(["status","--porcelain","--",...N])]),n=l.stdout.trim()!=="";return!n&&!await o()?null:{hash:r.stdout.trim(),uncommittedChanges:n}}catch{return null}}async function Me(e){let t=k.join(e,"apps","every-app-gateway"),a=async c=>JSON.parse(await y.readFile(k.join(t,c),"utf8")),[o,r,l,n]=await Promise.all([W(e),Re(e),a("drizzle/meta/_journal.json"),a("package.json")]),s=String(n.version??"unknown"),i=await Te(e,s);return{treeSha256:o,origin:{kind:"checkout"},...i?{commit:i}:{},version:s,order:{schema:ge(l.entries??[]),committedAt:r??Date.now()}}}async function We({root:e,out:t,build:a,keep:o=_e}){let[r,l]=await Promise.all([W(e),Re(e)]),n=Ge(e),s=r?k.join(n,`${r}.tar.gz`):null,i={origin:{kind:"checkout"},treeSha256:r,committedAt:l};if(s&&await A(s))try{let m=await G(s,i),d=new Date;return await y.utimes(s,d,d),t.emit({type:"step",step:"gateway.release",status:"ok",message:`Using the Gateway ${m.manifest.version} built from this checkout before (${r.slice(0,12)}).`,data:{cached:!0,treeSha256:r,release:m.manifest.version}}),m}catch{await y.rm(s,{force:!0})}let c=await a();s&&await W(e)===r&&await xe(c,s,o);let p=await G(c,{origin:{kind:"checkout"},treeSha256:s&&await A(s)?r:null,committedAt:l});return t.emit({type:"step",step:"gateway.release",status:"ok",message:`Built the Gateway ${p.manifest.version} from this checkout.`,data:{cached:!1,treeSha256:p.source.treeSha256,release:p.manifest.version}}),p}async function xe(e,t,a){let o=k.dirname(t);await y.mkdir(o,{recursive:!0});let r=`${t}.${process.pid}.partial`;await y.copyFile(e,r),await y.rename(r,t);let l=await Promise.all((await y.readdir(o)).filter(n=>n.endsWith(".tar.gz")).map(async n=>({file:k.join(o,n),usedAt:(await y.stat(k.join(o,n))).mtimeMs})));for(let{file:n}of l.sort((s,i)=>i.usedAt-s.usedAt).slice(a))n!==t&&await y.rm(n,{force:!0})}function Le({root:e,out:t,verbose:a}){return We({root:e,out:t,build:()=>ze(e,t,a??!1)})}async function ze(e,t,a,o=process.env){let r=k.join(e,"apps","every-app-gateway");t.emit({type:"step",step:"gateway.release",status:"start",message:"Building the Gateway from this checkout (usually 1\u20132m)",data:{dir:r}});let l=(n,s)=>J("pnpm",n,{cwd:s,env:{...o,NODE_OPTIONS:Z(o.NODE_OPTIONS)},echo:a,what:"Building the Gateway",code:"GATEWAY_BUILD_FAILED",fix:"fix the build error above, then run this again",logName:"gateway-build"});return await l(["--filter","@every-app/sdk","build"],e),await l(["run","build:release"],r),k.join(r,ue)}var Be=`SELECT apps.app_slug, apps.worker_name, apps.hostname, apps.status,
   organization_keys.org_key
 FROM apps LEFT JOIN organization_keys
   ON organization_keys.organization_id = apps.organization_id

package/dist/{chunk-GD2JZMD3.js → chunk-H7PDL3X5.js}

@@ -1 +1 @@
-import{Qb as e,fb as o,tb as s}from"./chunk-SAT3PGZU.js";import p from"node:fs/promises";import a from"node:path";import{pathToFileURL as c}from"node:url";import{createJiti as m}from"jiti";async function y(r){return g(a.join(r,"everyapp.config.ts"),{message:"No everyapp.config.ts in this directory",fix:"run this from the app's directory"})}async function w(r){try{await p.access(a.join(r,"everyapp.config.ts"))}catch(i){if(e(i))return null;throw i}return y(r)}async function g(r,i={message:`No manifest at ${r}`}){try{await p.access(r)}catch(n){throw e(n)?new s("MANIFEST_NOT_FOUND",i.message,{fix:i.fix}):n}let f=await m(c(r).href).import(r,{default:!0});return o(f,l)}var l={unknownCapabilities:"accept"};function h(r,i){let t=i?.binding??r[0];if(!r.includes(t))throw new Error(`Manifest migrations binding "${t}" is not declared in resources.d1.`);return t}function N(r){return r.migrations?.dir??"drizzle"}export{y as a,w as b,g as c,l as d,h as e,N as f};
+import{Bb as s,Yb as e,nb as o}from"./chunk-LYNBZ7RV.js";import p from"node:fs/promises";import a from"node:path";import{pathToFileURL as c}from"node:url";import{createJiti as m}from"jiti";async function y(r){return g(a.join(r,"everyapp.config.ts"),{message:"No everyapp.config.ts in this directory",fix:"run this from the app's directory"})}async function w(r){try{await p.access(a.join(r,"everyapp.config.ts"))}catch(i){if(e(i))return null;throw i}return y(r)}async function g(r,i={message:`No manifest at ${r}`}){try{await p.access(r)}catch(n){throw e(n)?new s("MANIFEST_NOT_FOUND",i.message,{fix:i.fix}):n}let f=await m(c(r).href).import(r,{default:!0});return o(f,l)}var l={unknownCapabilities:"accept"};function h(r,i){let t=i?.binding??r[0];if(!r.includes(t))throw new Error(`Manifest migrations binding "${t}" is not declared in resources.d1.`);return t}function N(r){return r.migrations?.dir??"drizzle"}export{y as a,w as b,g as c,l as d,h as e,N as f};

package/dist/{chunk-EUNGJMJ6.js → chunk-HOUHG236.js}

@@ -1,4 +1,4 @@
-import{b as k}from"./chunk-7LG3F4FF.js";import{Bb as M,Hb as U,bc as p,c as q,g as H,i as h,tb as S,xb as C}from"./chunk-SAT3PGZU.js";import{randomBytes as J}from"node:crypto";import R from"node:os";var Z={["app.deploy"]:{noun:"deploy",of:e=>`a deploy${e?` of ${e}`:""}`},["app.register"]:{noun:"registration",of:e=>`a registration${e?` of ${e}`:""}`},["app.secrets"]:{noun:"secret change",of:e=>`a secret change${e?` on ${e}`:""}`},["app.email"]:{noun:"email change",of:e=>`an email change${e?` on ${e}`:""}`},["gateway.deploy"]:{noun:"Gateway install",of:()=>"a Gateway install"},["gateway.upgrade"]:{noun:"Gateway upgrade",of:()=>"a Gateway upgrade"},["gateway.reconcile"]:{noun:"Gateway update",of:()=>"an update of the Gateway's apps"},["gateway.secrets"]:{noun:"Gateway settings change",of:()=>"a change to the Gateway's settings"},["access.sync"]:{noun:"Cloudflare Access update",of:()=>"an update of Cloudflare Access"},["db.restore"]:{noun:"database restore",of:e=>`a restore of ${e?`${e}'s database`:"the Gateway's database"}`}},ee=`CREATE TABLE IF NOT EXISTS _everyapp_deploy_lease (
+import{b as k}from"./chunk-T2GD7RHS.js";import{Bb as S,Fb as C,Jb as M,Pb as U,c as q,g as H,i as h,jc as p}from"./chunk-LYNBZ7RV.js";import{randomBytes as J}from"node:crypto";import R from"node:os";var Z={["app.deploy"]:{noun:"deploy",of:e=>`a deploy${e?` of ${e}`:""}`},["app.register"]:{noun:"registration",of:e=>`a registration${e?` of ${e}`:""}`},["app.secrets"]:{noun:"secret change",of:e=>`a secret change${e?` on ${e}`:""}`},["app.email"]:{noun:"email change",of:e=>`an email change${e?` on ${e}`:""}`},["gateway.deploy"]:{noun:"Gateway install",of:()=>"a Gateway install"},["gateway.upgrade"]:{noun:"Gateway upgrade",of:()=>"a Gateway upgrade"},["gateway.reconcile"]:{noun:"Gateway update",of:()=>"an update of the Gateway's apps"},["gateway.secrets"]:{noun:"Gateway settings change",of:()=>"a change to the Gateway's settings"},["access.sync"]:{noun:"Cloudflare Access update",of:()=>"an update of Cloudflare Access"},["db.restore"]:{noun:"database restore",of:e=>`a restore of ${e?`${e}'s database`:"the Gateway's database"}`}},ee=`CREATE TABLE IF NOT EXISTS _everyapp_deploy_lease (
   id TEXT PRIMARY KEY,
   holder TEXT NOT NULL,
   purpose TEXT NOT NULL,

package/dist/chunk-IFCPALVC.js

@@ -0,0 +1,46 @@
+import{a as Pe,b as Ht,e as Bt}from"./chunk-WOVS3GV5.js";import{a as se,b as Oe,c as Me,d as j,e as Pt,f as ue,g as Lt,h as Ut,j as me,k as xt,l as Ce,p as Gt}from"./chunk-OM2HDWVP.js";import{c as zt,f as Ft}from"./chunk-ZFCUH5PK.js";import{a as ce,c as ut}from"./chunk-4JRIS6S6.js";import{b as Ct,e as ve}from"./chunk-ZECBN24L.js";import{g as wt,h as yt}from"./chunk-HOUHG236.js";import{$ as De,B as q,W as te,X as Ie,Y as ne,Z as D,_ as re,aa as $t,ca as Tt,da as kt,ea as be,ha as It,ia as le,k as St,l as ht,la as Dt,na as bt,qa as vt,sa as Ot,y as V,z as ke}from"./chunk-RMF4YGD6.js";import{a as Et,e as O,o as ee,p as W,q as Rt,r as At,s as _t,t as Nt}from"./chunk-NFU4YFXB.js";import{b as Le}from"./chunk-H7PDL3X5.js";import{a as B,f as mt,g as gt,i as ft}from"./chunk-CCWBPAKH.js";import{$ as _e,Aa as ot,Ba as it,Bb as S,C as Ye,Ca as pt,D as ie,Da as Te,Fb as C,Ga as ct,I as Ke,N as Se,P as he,R as Je,S as Ee,T as Xe,V as H,W as pe,X as Re,Y as J,Ya as lt,Z as Ze,_ as Ae,aa as Qe,ba as G,c as g,ca as M,da as et,ea as Ne,fa as $e,ga as tt,k as I,ma as nt,mb as dt,pc as Mt,qb as Q,sa as X,ua as rt,va as st,wc as de,ya as at,za as Z}from"./chunk-LYNBZ7RV.js";import{stripVTControlCharacters as Xn}from"node:util";import v from"chalk";function Wt(e){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e))throw new S("SECRET_NAME_INVALID",`"${e}" isn't a valid secret name`,{fix:"use letters, digits and underscores, starting with a letter, e.g. GITHUB_TOKEN"});if(G(e))throw new S("SECRET_NAME_RESERVED",`${e} is a reserved name
+everyapp manages ${Qe}.`,{fix:"pick another name"})}function _n(e){return e.ready?e.settings.some(n=>n.set===null&&n.names.length>0&&n.need.kind!=="optional")?null:"ready":"needs_setup"}function Nn(e){return[...new Set(e.unmet.flatMap(t=>t.names))]}var Vt="id, organization_id, app_slug, name, status, setup_state",qt=e=>({id:String(e.id),organizationId:String(e.organization_id),appSlug:String(e.app_slug),name:String(e.name),status:String(e.status),setupState:e.setup_state==null?null:String(e.setup_state)});async function jt(e,t){if(!await ke(e))return null;let n=_n(t.setup);if(!n)return null;let r=t.row??await $n(e,t.appRowId);if(!r||r.status===O)return null;let s=r.setupState==="ready"||r.setupState==="needs_setup"?r.setupState:null;if(s===n)return{state:n,previous:s,event:null};let a=n==="needs_setup"?"app.needs_setup":s==="needs_setup"?"app.ready":null,i={id:r.appSlug,rowId:r.id,name:r.name},o=a?await q(e,{organizationId:r.organizationId,type:a,actor:V(t.deployer),data:a==="app.needs_setup"?{app:i,unmet:Nn(t.setup)}:{app:i},appRowId:r.id,onlyIf:{sql:"changes() > 0",params:[]},now:t.now}):[];return await e.run([{sql:"UPDATE apps SET setup_state = ? WHERE id = ? AND setup_state IS ?",params:[n,r.id,s]},...o]),{state:n,previous:s,event:a}}async function $n(e,t){let[n=[]]=await e.run([{sql:`SELECT ${Vt} FROM apps WHERE id = ?`,params:[t]}]);return n[0]?qt(n[0]):null}async function Yt(e,t,n){try{let{cf:r,db:s,deployer:a}=e;if(t.gateway.length===0&&t.appRowId===null||!await ke(s))return;let[i=[]]=await s.run([{sql:`SELECT ${Vt}, tier, manifest, secret_names FROM apps
+WHERE status NOT IN ('${O}', 'pending') AND tier NOT IN ('${M}', 'dispatch')`}]),o=i.flatMap(c=>{let u=Tn(c.manifest);return!u||typeof u!="object"||c.id===t.except?[]:c.id===t.appRowId||ue(u).some(d=>t.gateway.includes(d))?[{row:qt(c),manifest:u,secretNames:Et(D(c.secret_names))}]:[]});if(o.length===0)return;let p=await se(r);for(let c of o){let{setup:u}=j({manifest:c.manifest,appId:c.row.appSlug,gatewayNames:p,secretNames:c.secretNames});await jt(s,{appRowId:c.row.id,setup:u,deployer:a,row:c.row})}}catch(r){n.emit({type:"progress",step:"app.setup_state",message:`Couldn't record whether the apps are set up (${C(r).split(`
+`)[0]}); the Gateway records it when it next lists them`})}}function Tn(e){if(typeof e!="string")return null;try{return JSON.parse(e)}catch{return null}}async function _r(e,t,n){try{await jt(e,t)}catch(r){n.emit({type:"progress",step:"app.setup_state",message:`Couldn't record whether the app is set up (${C(r).split(`
+`)[0]}); the Gateway records it when it next lists it`})}}var Kt=new WeakMap;function z(e){let t=Kt.get(e);return t||(t=e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('remote_mcp_credentials', 'remote_mcp_tools')"}]).then(([n=[]])=>{let r=new Set(n.map(s=>String(s.name)));return{credentials:r.has("remote_mcp_credentials"),tools:r.has("remote_mcp_tools")}}),Kt.set(e,t)),t}function Jt(e){return{app:{id:e.appSlug,rowId:e.id,name:e.name},kind:ee(e)?"remote":"builtin"}}function kn(e){return W(e)?.url??null}async function Xt(e,t,n){let[r=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[t,n]}]);return r[0]?re(r[0]):null}async function In(e,t){let[n=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND tier = ? AND status != '${O}' ORDER BY app_slug`,params:[t,M]}]);return n.map(re).filter(ee).map(r=>r.appSlug)}async function vr(e,t){let r=(await De(e))?.organization??null,s=r?await Xt(e,r.id,t):null;if($e(t))return{kind:"builtin",id:t,organization:r,app:s&&s.tier===M?s:null};if(s&&ee(s))return{kind:"remote",id:t,organization:r,app:s};if(s&&s.tier!==M&&s.status!==O)throw new S("PROVIDER_APP_UNKNOWN",`"${t}" is an app deployed to this Gateway, not an MCP app
+${g} delete ${t} removes a deployed app.`,{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"});let a=r?await In(e,r.id):[],i=/^[a-z][a-z0-9+.-]*:\/\//i.test(t);throw new S("PROVIDER_APP_UNKNOWN",[`"${t}" is not an MCP app on this Gateway`,`Built in: ${Ne.join(", ")}. Added: ${a.length>0?a.join(", "):"none yet"}.`].join(`
+`),i?{rerun:`${g} mcp add ${t}`,rerunNote:"adds the server at that address"}:{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"})}function Or(e){let t=e.app?kn(e.app):null;return new S("APP_NOT_FOUND",`${e.id} was removed from this Gateway
+Adding it again starts fresh: nobody's access or tools are kept.`,t?{rerun:`${g} mcp add ${t} --name ${e.id}`,rerunNote:"adds it again"}:{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"})}async function Zt(e){let[t=[]]=await e.run([{sql:`SELECT tier, manifest FROM apps WHERE tier = ? AND status != '${O}'`,params:[M]}]),n=new Map;for(let r of t){let s=W({tier:String(r.tier),manifest:D(r.manifest)}),a=s?X(s.auth):null;if(!s||!a)continue;let i;try{i=new URL(s.url).origin}catch{continue}let o=n.get(a)??new Set;o.add(i),n.set(a,o)}return n}function Dn(e,t,n){let{app:r}=e,s=e.grants.map(a=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
+VALUES (?, ?, ?, ?, NULL) ON CONFLICT DO NOTHING`,params:[a.id,a.userId,a.appRowId,a.organizationId]}));return e.kind==="new"?[{sql:`INSERT INTO apps (id, organization_id, app_slug, name, description, hostname,
+  worker_name, tier, manifest, status, version_id, deployed_at, deployed_by_actor,
+  is_default, created_at, updated_at, scope)
+VALUES (?1, ?2, ?3, ?4, ?5, NULL, NULL, ?6, ?7, ?8, NULL, ?9, ?10, 0, ?11, ?11, ?12)`,params:[r.id,r.organizationId,r.appSlug,r.name,r.description,r.tier,r.manifest,r.status,r.deployedAt,r.deployedByActor,t,r.scope]},...s]:[{sql:`UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, is_default = 0,
+  deployed_at = ?, deployed_by_actor = ?, updated_at = ?
+WHERE id = ? AND status = '${O}'`,params:[r.name,r.description,r.manifest,r.status,r.deployedAt,r.deployedByActor,t,r.id]},...be(r,t,{secretNames:n.secretNames}),...n.remoteTools?[Qt(r)]:[],...s]}function Qt(e){return{sql:"DELETE FROM remote_mcp_tools WHERE app_row_id = ? AND organization_id = ?",params:[e.id,e.organizationId]}}function Mr(e,t){return te(async()=>{let n=t.now??Date.now(),r=t.url.trim(),s=(t.id??"").trim()||nt(r)||"",{organization:a,hasOwner:i}=await $t(e,t.organizationName,n),[o=[],p=[],c=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[a.id,s]},...Tt(a.id,t.deployer.email)]),u=o[0]?re(o[0]):null,m=await Zt(e),d=D(c[0]?.id),h=Rt({organizationId:a.id,url:r,id:t.id,name:t.name,description:t.description,auth:t.auth,risk:t.risk,env:t.env,existingApp:R=>{if(R!==s)throw new Error(`The rules asked for "${R}", not "${s}".`);return u},secretUsedAt:R=>{let A=[...m.get(R)??[]],y=new URL(r).origin;return A.find(f=>f!==y)??A[0]??null},members:kt(p),actorUserId:d,actor:t.deployer.actor,now:n}),E=await z(e),w=await q(e,{organizationId:a.id,type:"mcp_app.added",actor:V(t.deployer),data:{app:{id:h.app.appSlug,rowId:h.app.id,name:h.app.name},kind:"remote"},appRowId:h.app.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[h.app.id,h.app.status,n]},now:n});return await e.run([...Dn(h,n,{secretNames:await Ie(e),remoteTools:E.tools}),...w]),{plan:h,organization:a,hasOwner:i,actorGranted:d!==null&&h.grants.some(R=>R.userId===d)}})}function Cr(e,t,n,r,s=Date.now()){return te(async()=>{let a=_t(t,n);if(!a)return{changed:!1};let i=await q(e,{organizationId:t.organizationId,type:a.status==="active"?"mcp_app.enabled":"mcp_app.disabled",actor:V(r),data:Jt(t),appRowId:t.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[t.id,a.status,s]},now:s}),[o=[]]=await e.run([{sql:"UPDATE apps SET status = ?, updated_at = ? WHERE id = ? AND status = ? RETURNING id",params:[a.status,s,t.id,t.status]},...i]);if(o.length===0)throw new S("APP_CHANGING",`${t.appSlug} changed while this ran
+Nothing was written; run it again.`,{retryable:!0});return{changed:!0}})}function Pr(e,t,n,r=Date.now()){return te(async()=>{let s=Nt(t);if(!t||!s)return{removed:!1};let a=await z(e);return await e.run([{sql:"UPDATE apps SET status = ?, is_default = ?, updated_at = ? WHERE id = ?",params:[s.status,s.isDefault?1:0,r,t.id]},...be(t,r,{secretNames:await Ie(e)}),...a.tools?[Qt(t)]:[],...await q(e,{organizationId:t.organizationId,type:"mcp_app.removed",actor:V(n),data:Jt(t),appRowId:t.id,now:r})]),{removed:!0}})}function Ue(e){return e?{status:String(e.status),toolCount:Number(e.tool_count??0),listedAt:e.fetched_at==null?null:Number(e.fetched_at),lastError:D(e.last_error)}:null}async function Lr(e,t){let n=[t.id,t.organizationId],[r=[]]=await e.run([{sql:"SELECT status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tools WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n}]);return Ue(r[0])}async function bn(e){if(!(await z(e)).credentials)return new Map;let[t=[]]=await e.run([{sql:"SELECT name, origin, bound_by, bound_at FROM remote_mcp_credentials ORDER BY name"}]);return new Map(t.map(n=>[String(n.name),{origin:String(n.origin),boundBy:D(n.bound_by),boundAt:n.bound_at==null?null:Number(n.bound_at)}]))}async function Ur(e){let t=await De(e),n=[],r=new Map;if(t){let[o=[],p=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND tier = ? AND status != '${O}' ORDER BY app_slug`,params:[t.organization.id,M]},{sql:"SELECT app_row_id, status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE organization_id = ?",params:[t.organization.id]}]);n.push(...o.map(re));for(let c of p)r.set(String(c.app_row_id),Ue(c))}let s=new Map(n.map(o=>[o.appSlug,o])),a=Ne.map(o=>{let p=s.get(o)??null;return{id:o,name:et[o].name,kind:"builtin",app:p,remote:null,keyName:tt(o),snapshot:p?r.get(p.id)??null:null}}),i=n.filter(o=>!$e(o.appSlug)&&ee(o)).map(o=>{let p=W(o);return{id:o.appSlug,name:o.name,kind:"remote",app:o,remote:p,keyName:p?X(p.auth):null,snapshot:r.get(o.id)??null}});return[...a,...i]}function xr(e,t,n){if(!e.app||e.app.status===O)return"not added";if(e.app.status!=="active")return"off";if(e.kind==="remote"&&!e.remote||e.keyName&&!t.includes(e.keyName))return"needs setup";if(e.kind==="remote"&&e.keyName&&e.remote){let r=n.get(e.keyName);if(r&&r.origin!==vn(e.remote.url))return"needs setup"}return"on"}function vn(e){try{return new URL(e).origin}catch{return""}}function On(e){return e==="read"?{readOnlyHint:!0}:e==="destructive"?{destructiveHint:!0}:{}}function Mn(e,t,n,r){return n.map(s=>{let a=String(s.upstream_name),i=String(s.risk_hint),o=D(s.local_name),p=rt(On(i),t,a),c=p.source==="default"&&i==="write"?"hint":p.source,u=o?r.get(o):void 0,m=st(t,a),d=!!Number(s.listed);return{name:o?`${e}_${o}`:null,serverName:a,title:D(s.title),risk:u??p.risk,source:c,on:m&&d,problem:m?d?null:D(s.problem)??"not listed":d?"turned off; leaves the catalog at the next listing":"turned off"}})}async function Gr(e,t,n){let r=[t.app.id,t.app.organizationId],s=await z(e),a=n?X(n.auth):null,[i=[],o=[],p=[],c=[]]=await e.run([{sql:"SELECT status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:r},{sql:"SELECT name, title, risk FROM app_tools WHERE app_row_id = ? AND organization_id = ? ORDER BY name",params:r},...s.tools&&n?[{sql:`SELECT upstream_name, local_name, title, risk_hint, listed, problem, listed_at FROM remote_mcp_tools
+WHERE app_row_id = ? AND organization_id = ? ORDER BY upstream_name`,params:r}]:[{sql:"SELECT 1 WHERE 0"}],...s.credentials&&a?[{sql:"SELECT origin, bound_by, bound_at FROM remote_mcp_credentials WHERE name = ?",params:[a]}]:[{sql:"SELECT 1 WHERE 0"}]]),u=new Map(o.map(d=>[String(d.name),String(d.risk)])),m=c[0];return{snapshot:Ue(i[0]),remoteTools:n?Mn(t.id,n,p,u):[],catalogTools:o.map(d=>({name:`${t.id}_${String(d.name)}`,title:D(d.title),risk:String(d.risk)})),binding:m?{origin:String(m.origin),boundBy:D(m.bound_by),boundAt:m.bound_at==null?null:Number(m.bound_at)}:null,listingKnown:s.tools}}var Cn=3;function zr(e,t,n,r,s=Date.now()){return te(async()=>{let a=await z(e),[i=[]]=await e.run([a.tools?{sql:`SELECT upstream_name, local_name FROM remote_mcp_tools
+WHERE app_row_id = ?1 AND (upstream_name = ?2 OR local_name = ?2 OR ?3 || local_name = ?2)
+ORDER BY (upstream_name = ?2) DESC, upstream_name LIMIT 1`,params:[t.app.id,n,`${t.id}_`]}:{sql:"SELECT 1 WHERE 0"}]),o=i[0],p=o?String(o.upstream_name):n,c=o?D(o.local_name):null,u={};r.risk==="annotations"?u.risk=void 0:r.risk&&(u.risk=r.risk),r.enabled!==void 0&&(u.enabled=r.enabled);let m=t.app;for(let d=1;;d+=1){let h=W(m)?.tools[p]??null,E=At(m,{tool:{name:p,override:u}}),[w=[]]=await e.run([{sql:`UPDATE apps SET manifest = ?, name = ?, description = ?, updated_at = ?
+WHERE id = ? AND manifest = ? AND status != '${O}' RETURNING id`,params:[E.manifest,E.name,E.description,s,m.id,m.manifest]}]);if(w.length>0)return{serverName:p,listedName:c?`${t.id}_${c}`:null,inListing:!!o,before:h,after:E.remote.tools[p]??null,rev:E.remote.rev};let R=await Xt(e,m.organizationId,m.appSlug);if(!R||d>=Cn)throw new S("APP_CHANGING",`${t.id} keeps changing while this writes its tool settings
+Nothing was written; run it again.`,{retryable:!0});m=R}})}async function en(e,t,n,r=Date.now()){let s={bound:[],undeclared:[],ambiguous:[]},a=t.filter(Re);if(a.length===0||!(await z(e)).credentials)return s;let i=await Zt(e),o=await bn(e),p=[];for(let c of a){let u=[...i.get(c)??[]].sort();u.length===0?s.undeclared.push({name:c,kept:o.get(c)?.origin??null}):u.length>1?s.ambiguous.push({name:c,origins:u}):(s.bound.push({name:c,origin:u[0]}),p.push({sql:`INSERT INTO remote_mcp_credentials (name, origin, bound_by, bound_at) VALUES (?, ?, ?, ?)
+ON CONFLICT(name) DO UPDATE SET origin = excluded.origin, bound_by = excluded.bound_by, bound_at = excluded.bound_at`,params:[c,u[0],n,r]}))}return p.length>0&&await e.run(p),s}async function tn(e,t){let n=t.filter(Re);if(n.length===0||!(await z(e)).credentials)return[];let[r=[]]=await e.run([{sql:`DELETE FROM remote_mcp_credentials WHERE name IN (${n.map(()=>"?").join(", ")}) RETURNING name`,params:n}]);return r.map(s=>String(s.name))}async function nn(e){let[t=[]]=await e.run([{sql:`SELECT app_slug, tier, manifest FROM apps WHERE tier = ? AND status != '${O}' ORDER BY app_slug`,params:[M]}]),n=new Map;for(let r of t){let s=W({tier:String(r.tier),manifest:D(r.manifest)}),a=s?X(s.auth):null;a&&n.set(a,[...n.get(a)??[],String(r.app_slug)])}return n}import{text as Gn}from"node:stream/consumers";var xe=40,Pn=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|common|organizations|consumers)$/i,Ln={issuer:"the issuer's https URL, which serves /.well-known/openid-configuration (no query, fragment or user:password@)",tenant:"the Directory (tenant) ID, a GUID like 72f988bf-86f1-41af-91ab-2d7cd011db47, or common, organizations or consumers",label:`the button text after "Continue with", at most ${xe} characters`};function Un(e,t){switch(e){case"issuer":{let n;try{n=new URL(t)}catch{return`"${t}" isn't a URL.`}if(n.protocol!=="https:")return`"${t}" isn't an https URL.`;if(n.username||n.password)return"It carries a user name or password; the issuer's URL has none.";if(n.search||n.hash)return"It has a query or a fragment; the issuer's URL has neither.";let r=n.hostname.toLowerCase();return r==="localhost"||r==="127.0.0.1"?"A deployed Gateway can't reach a loopback issuer.":null}case"tenant":return Pn.test(t)?null:`"${t}" isn't a Directory (tenant) ID, common, organizations or consumers.`;case"label":return t.length<=xe?null:`It is ${t.length} characters; the button takes ${xe} at most.`;default:return null}}function xn(e){return Ln[e]??null}function rn(e){let t=Xe(e)?.settings.find(r=>r.name===e),n=t?xn(t.role):null;if(!(!t||!n))return{takes:n,check:r=>Un(t.role,r)}}function on(e){return e?"env":process.stdin.isTTY?"prompt":"stdin"}function pn(e,t){let n=on(t);if(!(n==="prompt"||e.length<2))throw new S("SECRET_SEVERAL_NAMES",`${n==="env"?"--from-env":"A piped value"} sets one secret at a time, and you named ${e.length}`,{fix:`run it once per name, e.g. ${n==="env"?`${g} secret set ${e[0]} --from-env ${t}`:`echo "$${e[0]}" | ${g} secret set ${e[0]}`}`})}function cn(e){return e.length<2?e[0]??"":`${e.slice(0,-1).join(", ")} or ${e.at(-1)}`}function U(e,{exact:t=!1}={}){return n=>e.includes(t?n:n.toLowerCase())?null:`Not ${e.length>2?"one of ":""}${cn(e)}.`}function ae(e,t){return n=>{let r=n.split(/[\s,]+/).filter(Boolean),s=r.find(a=>!e(a));return s!==void 0?`"${s}" isn't ${t}.`:r.length>0?null:`Name ${t}.`}}var Ge=["true","false","1","0","on","off","yes","no"],zn=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/,Fn=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/,Hn=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,Bn=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.cloudflareaccess\.com$/,sn=/^[A-Za-z0-9._:-]{1,256}$/,Wn=/^\/v1(\/[a-z0-9_-]+)+$/,ze=3650,Vn=e=>Fn.test(e.toLowerCase().replace(/^@/,"")),qn=e=>Hn.test(e.toLowerCase().replace(/\.$/,""));function jn(e){try{let t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"?t:null}catch{return null}}function ln(e){let t;try{t=new URL(e)}catch{return null}return t.username||t.password||t.search||t.hash?null:t.protocol==="https:"&&Bn.test(t.hostname.toLowerCase())?t:null}function Yn(e){let t=ln(/^[a-z]+:\/\//i.test(e)?e:`https://${e}`);return t!==null&&(t.pathname==="/"||t.pathname==="")}var Kn={EMAIL_FROM:{takes:"an address, or Name <address> (with EMAIL_FROM_NAME set, unless the name is in it)",check:e=>{let t=ct(e,"sender");return t&&zn.test(t.address)?null:`"${e}" isn't an address or Name <address>.`}},EMAIL_FROM_NAME:{takes:"the sender's display name, e.g. Acme Support"},EMAIL_PROVIDER:{takes:`${cn(Te)}: which provider sends when both are set up`,check:U(Te)},EMAIL_PASSWORD_SIGN_IN:{takes:"true or false; false turns password sign-in off (only while Cloudflare Access sign-in is on)",check:U(Ge)},MASTODON_URL:{takes:"the Mastodon instance's https origin, e.g. https://mastodon.social",check:e=>Ke(Ye.mastodon,{MASTODON_URL:e})?null:`"${e}" isn't an https origin (no path).`},AI_PROXY_EXTRA_ROUTES:{takes:"/v1 paths beyond inference the AI proxy may forward, comma separated, e.g. /v1/files",check:ae(e=>Wn.test(e),"a /v1/... path")},MCP_OAUTH_ENABLED:{takes:"true or false; false turns the OAuth server for MCP clients off",check:U(Ge)},MCP_DCR_ENABLED:{takes:"true or false; false turns dynamic client registration off",check:U(Ge)},MCP_ALLOWED_ORIGINS:{takes:"browser origins allowed to call /mcp, comma separated, e.g. http://localhost:6274",check:ae(e=>jn(e)!==null,"an http or https URL")},MCP_AUDIT_RETENTION_DAYS:{takes:`days of MCP tool-call audit rows to keep: a whole number from 1 to ${ze}`,check:e=>/^\d+$/.test(e)&&Number(e)>=1&&Number(e)<=ze?null:`Not a whole number from 1 to ${ze}.`},CLOUDFLARE_ACCESS_OIDC_ISSUER:{takes:"https://<team>.cloudflareaccess.com/cdn-cgi/access/sso/oidc/<client id>",check:e=>{let t=ln(e);return t&&/^\/cdn-cgi\/access\/sso\/oidc\/[^/]+\/?$/.test(t.pathname)?null:`"${e}" isn't an Access for SaaS issuer URL.`}},CLOUDFLARE_ACCESS_OIDC_CLIENT_ID:{takes:"the Access for SaaS application's client id"},CLOUDFLARE_ACCESS_OIDC_LABEL:{takes:`the sign-in button's label ("Continue with <label>"), at most 40 characters`},CLOUDFLARE_ACCESS_TEAM_DOMAIN:{takes:"<team>.cloudflareaccess.com",check:e=>Yn(e)?null:`"${e}" isn't <team>.cloudflareaccess.com.`},CLOUDFLARE_ACCESS_AUD:{takes:"the AUD tag of the Access application on the Gateway's host (several: comma separated)",check:ae(e=>sn.test(e),"an AUD tag")},CLOUDFLARE_ACCESS_APPS_AUD:{takes:"the AUD tag of the Access application on the apps' hosts (several: comma separated)",check:ae(e=>sn.test(e),"an AUD tag")},CLOUDFLARE_ACCESS_AUTO_JOIN_DOMAINS:{takes:"email domains whose people join without an invitation, comma separated, e.g. example.com",check:ae(Vn,"a domain like example.com")},CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN:{takes:`everyone (anyone the outer ring admits joins); to turn it off: ${g} secret unset CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN`,check:U(["everyone"])},HOSTED_OPEN_SIGNUP:{takes:"true or false; false keeps a hosted Gateway's sign-up invite-only",check:U(["true","false"])},BROWSER_APP_INSTALLS:{takes:"on or off, in lowercase; off turns browser app installs off",check:U(["on","off"],{exact:!0})},EVENTS_ALLOW_PRIVATE_TARGETS:{takes:"true or false, in lowercase; true lets event webhooks reach http: URLs and private host names",check:U(["true","false"],{exact:!0})},DISPATCH_NAMESPACE:{takes:"the Workers for Platforms namespace third-party Workers go into (hosted Gateway only)"},THIRD_PARTY_DOMAIN:{takes:"the registrable domain third-party apps are named on (hosted Gateway only)",check:e=>qn(e)?null:`"${e}" isn't a domain like example.com.`}};function Fe(e){return Kn[e]??rn(e)}function Jn(e){let t=Fe(e);return t?[`Takes ${t.takes}`]:[]}function dn(e,t){return t.trim()?Fe(e)?.check?.(t.trim())??null:"Enter a value."}function an(e,t){let n=t.trim(),r=dn(e,n);if(r===null)return n;let s=Fe(e),a=n.replace(/\s+/g," ").slice(0,64);throw new S("SETTING_VALUE_INVALID",`${e} can't be "${a}"
+${r}`,{...s?{fix:`use ${s.takes}`}:{},data:{name:e}})}async function un(e,t){let n=Ze(e),r=t.fromEnv,s=on(r);if(s==="env"){let a=process.env[r],i=n?a?.trim():a;if(!i)throw new S("SECRET_EMPTY",`$${r} is empty or not set`,{fix:`export ${r} first, or name another variable with --from-env`});return n?an(e,i):i}if(s==="stdin"){let a=(await Gn(process.stdin)).replace(/\r?\n$/,""),i=n?a.trim():a;if(i)return n?an(e,i):i}if(s==="stdin"||!B(t.json??!1))throw new S("SECRET_VALUE_REQUIRED",`Can't ask for ${e}'s value without a terminal
+Or pipe it in: echo "$${e}" | ${g} secret set ${e}`,{rerun:`${g} secret set ${e} --from-env ${e}`});return n?(await mt(e,{context:Jn(e),validate:i=>dn(e,i)})).trim():(await gt(`Value for ${e}`)).trim()}async function _s(e,...t){await de(e,async n=>{pn(t,e["from-env"]),await Zn({flags:e,out:n,names:t,readValue:r=>un(r,{fromEnv:e["from-env"],json:e.json})})})}async function Ns(e,...t){await de(e,n=>nr({flags:e,out:n,names:t}))}async function $s(e,t){await de(e,n=>rr({flags:e,out:n,appId:t}))}async function Zn(e){let{applied:t,gatewayHost:n}=await Qn(e),r=(t.gateway?.pinned??[]).map(({name:s,origin:a})=>`${s} is sent to ${a} and nowhere else.`);e.out.emit({type:"done",message:[`Set ${Be(t,"on")}`,...r].join(`
+`),display:[...r,v.dim(t.app?"Live now. No deploy needed.":`Live now on ${n}. No deploy needed.`)].join(`
+`),data:Ve(t)})}async function Qn(e){let t=await yn(e.names,e,"set");tr(t.providers,e.names,e.out);let n={};for(let s of e.names)n[s]=await e.readValue(s);return{applied:await fe(t,n,e,"set"),gatewayHost:t.gatewayHost}}function er(e){return I([...e.hosts,...e.hostSetting?[`the host ${e.hostSetting} names`]:[]])}function tr(e,t,n){for(let r of e){let{capability:s}=r;for(let a of ie(s).filter(i=>t.includes(i))){let i=r.addedAt?` on ${new Date(r.addedAt).toISOString().slice(0,10)}`:"",o=r.addedBy?` by ${r.addedBy}`:"";n.emit({type:"step",step:"secrets.provider",status:"ok",message:`${a} is ${s.label}'s, registered${o}${i}; the key is sent to ${er(s)}.`,data:{name:a,provider:r.id,addedBy:r.addedBy,addedAt:r.addedAt,hosts:[...s.hosts],...s.hostSetting?{hostSetting:s.hostSetting}:{}}})}}}async function Ts(e,t,n){let r=Object.keys(t),s=Object.values(t).every(i=>i===null);for(let i of r)if(!J(i))throw new Error(`${i} isn't a Gateway setting`);let a={route:{gateway:r,app:null,undeclared:[]},cf:e.cf,db:e.db,deployer:e.deployer,accountName:e.accountName,gatewayHost:e.gatewayUrl.replace(/^https:\/\//,""),app:null,providers:[]};return fe(a,t,n,s?"unset":"set")}async function ks(e,t,n,r){let s=Object.keys(n),a=await He(s,t.manifest,e,"set"),i=ge(s,t.manifest,t.source,"set",a.names);if(i.app&&!t.app)throw new S("APP_NOT_FOUND",`${t.manifest.id} isn't deployed yet
+Its own ${I(i.app.names)} can be set after its first deploy. Nothing was changed.`,{rerun:`${g} deploy`});let o={route:i,cf:e.cf,db:e.db,deployer:e.deployer,accountName:e.accountName,gatewayHost:e.gatewayUrl.replace(/^https:\/\//,""),app:i.app&&t.app?{...i.app,...t.app}:null,providers:a.providers};return await fe(o,n,r,"set")}async function nr(e){let{names:t,out:n}=e,r=await yn(t,e,"unset"),{route:s}=r,a=()=>{let p=`${I(t)} ${t.length===1?"isn't":"aren't"} set on ${or(s).join(" or ")}. Nothing changed.`;n.emit({type:"done",message:p,display:v.dim(p),data:{removed:!1}})};if(!await lr(r)){a();return}await ft({yes:e.flags.yes,interactive:e.interactive??B(e.flags.json??!1),confirm:e.confirm,question:`Remove ${Be({...s.gateway.length>0?{gateway:{names:s.gateway,versions:{}}}:{},...s.app?{app:{id:s.app.manifest.id,workerName:"",names:s.app.names,versions:{}}}:{}},"from")}?`,unattended:"Removing secrets needs confirmation, and there's no terminal to ask in",context:s.undeclared.map(p=>s.app?.source==="registry"?`${p} isn't listed in ${s.app.manifest.id}'s deployed manifest.`:`${p} isn't listed in everyapp.config.ts.`)});let i=Object.fromEntries(t.map(p=>[p,null])),o=await fe(r,i,e,"unset");if(!o){a();return}n.emit({type:"done",message:`Removed ${Be(o,"from")}`,display:v.dim("Live now. No deploy needed."),data:Ve(o)})}async function rr(e){let{out:t}=e,n=e.appId?null:await Le(e.cwd??process.cwd()),{cf:r,db:s,gatewayUrl:a,install:i}=await gn(e),[o,p]=await Promise.all([se(r),Pe(s,i)]),c=[...pe,...p.rows().flatMap(N=>ie(N.capability))],u=(N,T)=>t.emit({type:"done",message:Xn(N),display:N,data:T});if(!e.appId&&!n){let N=o.filter(l=>!H(l)),T=o.filter(l=>H(l)),$=await bt(s),k=new Set($.flatMap(l=>l.manifest?ue(l.manifest,p):[])),x=i.deploymentMode==="hosted",F=c.filter(l=>x||!Ae(l)).filter(l=>!o.includes(l)),P=await nn(s),L=[...F.filter(l=>k.has(l)||x&&Ae(l)),...[...P.keys()].filter(l=>!o.includes(l))],qe=F.filter(l=>!L.includes(l)&&!Ee(l)).length,oe=[],ye=[];for(let l of $){if(!l.manifest||!Pt(l.manifest,p)||l.tier==="dispatch")continue;if(l.tier===M){let K=it(ot(l.manifest),(Rn,An)=>Rn==="gateway"?o.includes(An):null);if(K.ready)continue;let En=pt(K,{cli:g,appId:l.appSlug,provider:!0});oe.push({id:l.appSlug,setup:En,rows:me(l.appSlug,K.settings)});continue}let Y=l.status==="pending"?null:await Oe(r,l.workerName).catch(K=>(ye.push({id:l.appSlug,reason:C(K).split(`
+`)[0]}),null)),{report:Sn,setup:hn}=j({manifest:l.manifest,appId:l.appSlug,gatewayNames:o,secretNames:Y,lookup:p});oe.push({id:l.appSlug,setup:hn,rows:me(l.appSlug,Sn.settings)})}let je=oe.flatMap(l=>l.rows);u([v.dim(`Gateway secrets \xB7 ${a.replace(/^https:\/\//,"")}`),"",...Mt(["NAME","SET BY"],[...N.map(l=>[l,"you"]),...T.map(l=>[l,v.dim("setup")]),...L.map(l=>[l,v.dim("not set")])]),...qe>0?[v.dim(`${qe} more can be set; see docs/capabilities.md`)]:[],v.dim(`Sign-in providers (${Object.values(he).map(l=>l.label).join(", ")}): ${g} signin list`),...je.length>0?["",...Ce(je)]:[],...ye.length>0?[v.dim(sr(ye))]:[]].join(`
+`),{gateway:{workerName:Q,names:o,settable:c,mcpCredentials:[...P].map(([l,Y])=>({name:l,apps:Y,set:o.includes(l)}))},apps:oe.map(({id:l,setup:Y})=>({id:l,setup:Y}))});return}let m=e.appId?await It(s,e.appId):await le(s,n.id),d=e.appId?fn(m):n,h=m&&m.status!=="pending"?m.workerName:null,E=Z(d),w=[];if(h){let N=(await We(s,h)).filter(T=>T.binding!=="").map(T=>T.name);for(let T of[h,...N]){let $=await ce(r,T);w.push({workerName:T,names:$,missing:E.filter(k=>!$.includes(k))})}}let R=w[0]?w[0].names.filter(N=>!G(N)):null,{report:A,setup:y}=j({manifest:d,appId:d.id,gatewayNames:o,secretNames:R,lookup:p}),f=me(d.id,A.settings).map(N=>!h&&N.where===d.id?{...N,status:v.dim("after first deploy")}:N);for(let N of w.slice(1)){let T=N.names.filter(k=>!G(k)),{report:$}=j({manifest:d,appId:d.id,gatewayNames:o,secretNames:T,lookup:p});f.push(...xt(d.id,N.workerName.split("--").at(-1),$.settings))}let _=`${v.green("\u2713")} set`;if(e.flags.verbose&&w[0])for(let N of w[0].names.filter(G))f.push({app:d.id,setting:N,where:d.id,status:_});let b=h?y.command?[y.command.command]:[]:[...y.command?[{command:`${g} configure`,note:"in the app's directory"}]:[],`${g} deploy`];u(f.length>0?[...Ce(f,{app:!1}),...y.unmet.length>0?["",...Gt(y.unmet)]:[],...!h&&E.length>0?["",v.dim(`${d.id} isn't deployed yet; its own secrets can be set after that.`)]:[]].join(`
+`):v.dim(`${d.id} declares no secrets and needs no Gateway settings.`),{app:{id:d.id,deployed:h!==null,workerName:h,declared:E,workers:w,secretNames:R,settings:A.settings,setup:y},gateway:{workerName:Q,names:o,needed:Lt(A.settings,Me(o,p)),missing:Ut(A.settings,Me(o,p)),settable:c},...f.length>0&&b.length>0?{next:b}:{}})}function sr(e){return`Couldn't list ${I(e.map(n=>`${n.id}'s`))} secrets. Cloudflare said: ${e[0].reason}. They show as not recorded.`}var ar=(n=>(n.Directory="directory",n.Registry="registry",n))(ar||{});function or(e){return[...e.gateway.length>0?["the Gateway"]:[],...e.app?[e.app.manifest.id]:[]]}function ge(e,t,n,r,s=new Set){let a=u=>J(u)||s.has(u),i=e.filter(a),o=e.filter(u=>!a(u));if(o.length===0)return{gateway:i,app:null,undeclared:[]};let p=t?Z(t):[],c=[];for(let u of o){let m=ir(u,e,t,n,r);if(m)throw m;p.includes(u)||c.push(u)}return{gateway:i,app:{manifest:t,names:o,source:n},undeclared:c}}function ir(e,t,n,r,s){let a=n?Z(n):[];if(n&&a.includes(e))return null;let i=r==="registry"&&n?` --app ${n.id}`:"",o=mn(e,[...pe,...a]);return o?new S("SECRET_NOT_DECLARED",`${e} isn't a Gateway setting${n?` or one of ${n.id}'s secrets`:""}`,{rerun:`${g} secret ${s} ${t.map(p=>p===e?o:p).join(" ")}${i}`,data:{didYouMean:o}}):Ee(e)?cr(e,s):H(e)&&!n?new S("SECRET_NOT_SETTABLE",`${e} can't be changed with secret ${s}
+${e==="THIRD_PARTY_DEPLOYS"?"It's the hosted Gateway's launch gate, opened by hand.":"It's one of the Gateway's own keys, written once by setup."}`):_e(e)?new S("SECRET_NOT_SETTABLE",`${e} only works in local development
+A deployed Gateway doesn't read it.`,{fix:"set it in the Gateway's .dev.vars"}):(Wt(e),n?s==="unset"?null:new S("SECRET_NOT_DECLARED",[`${n.id} doesn't list ${e} as a secret`,r==="registry"?`Its deployed manifest (what --app ${n.id} reads) doesn't list it, and it isn't a Gateway setting either.`:H(e)?`It's one of the Gateway's own keys; listing it under secrets gives ${n.id} a secret of its own.`:"It isn't a Gateway setting either."].join(`
+`),{fix:`add it to secrets in everyapp.config.ts: ${pr(n,e)}${r==="registry"?` and deploy ${n.id} again`:""}`,rerun:`${g} secret set ${e}${i}`}):new S("SECRET_NOT_DECLARED",`${e} isn't a Gateway setting, and there's no app here
+An app's own secrets are ${s==="set"?"set":"removed"} from the app's directory (where everyapp.config.ts is), or from anywhere with --app <id>.
+Gateway settings: ${g} secret list`,{fix:"cd into the app's directory and run this again, or add --app <id>"}))}function pr(e,t){let n=e.secrets??[],r=a=>typeof a=="string"?JSON.stringify(a):`{ ${Object.entries(a).map(([i,o])=>`${i}: ${JSON.stringify(o)}`).join(", ")} }`,s=n.every(a=>typeof a=="string")?JSON.stringify(t):`{ name: ${JSON.stringify(t)} }`;return`secrets: [${[...n.map(r),s].join(", ")}],`}function cr(e,t){let n=(/^(.+)_SIGNIN_[A-Z_]+$/.exec(e)?.[1]??e).toLowerCase();if(Je(n)){let r=he[n],s=r.settings.map(a=>a.name);return new S("SECRET_NOT_SETTABLE",`${e} isn't a setting of Sign in with ${r.label}
+It reads ${I(s)}.`,{rerun:`${g} signin show ${n}`,data:{provider:n,names:s}})}return new S("SECRET_NOT_SETTABLE",`${n.toUpperCase()} isn't a sign-in provider (${Se.join(", ")}): ${g} signin list`,{fix:`${t} a provider's own settings, as ${g} signin show <id> names them`,data:{providers:[...Se]}})}function mn(e,t){let n=r=>r.toUpperCase().replace(/_/g,"");return t.find(r=>r!==e&&n(r)===n(e))}function gn({flags:e,out:t,createCf:n}){return Ot({gateway:vt(e.gateway),accountId:e["account-id"],interactive:B(e.json??!1),login:{json:e.json,out:t,step:"login"},createCf:n})}async function We(e,t){return(await Ct(e,t)).filter(n=>n.kind==="worker")}function fn(e){if(!e.manifest)throw new S("MANIFEST_NOT_FOUND",`${e.appSlug}'s registry row holds no manifest
+Deploying it again stores one.`,{rerun:`${g} deploy`,rerunNote:"in the app's directory"});try{return dt(e.manifest)}catch(t){throw new S("INVALID_MANIFEST",`${e.appSlug}'s deployed manifest can't be read
+${C(t)}`,{rerun:`${g} deploy`,rerunNote:"in the app's directory"})}}function wn(e,t){let n=t?Z(t):[];return e.filter(r=>!J(r)&&!n.includes(r)&&lt.test(r)&&!H(r)&&!_e(r)&&!G(r)&&!mn(r,[...pe,...n]))}async function He(e,t,n,r){let s=wn(e,t);if(s.length===0)return{names:new Set,providers:[]};let a=await Pe(n.db,n.install),i=Ht(a,s),o=new Set(i.flatMap(c=>ie(c.capability)).filter(c=>s.includes(c))),p=s.filter(c=>!o.has(c));if(r==="unset"&&p.length>0){let c=await se(n.cf);for(let u of p)c.includes(u)&&o.add(u)}return{names:o,providers:i}}async function yn(e,t,n){let r=e.every(E=>J(E)),s=t.flags.app,a,i=async()=>a??=await gn(t),o=(E,w,R,A=[])=>({route:w,cf:E.cf,db:E.db,deployer:E.deployer,accountName:E.accountName,gatewayHost:E.gatewayUrl.replace(/^https:\/\//,""),app:R,providers:A});if(r)return o(await i(),ge(e,null,"directory",n),null);if(s){let E=await i(),w=await le(E.db,s);if(!w)throw new S("APP_NOT_FOUND",`${s} isn't deployed to this Gateway
+An app's secrets can be set after its first deploy. Nothing was changed.`,{rerun:`${g} status`,rerunNote:"lists its apps"});let R=fn(w),A={id:R.id,secrets:at(R)},y=await He(e,A,E,n),f=ge(e,A,"registry",n,y.names);return o(E,f,f.app?{...f.app,workerName:w.workerName,rowId:w.id}:null,y.providers)}let p=await Le(t.cwd??process.cwd()),c=wn(e,p).length>0?await He(e,p,await i(),n):{names:new Set,providers:[]},u=ge(e,p,"directory",n,c.names);if(!u.app)return o(await i(),u,null,c.providers);let m=await i(),{id:d}=u.app.manifest,h=await le(m.db,d);if(!h)throw new S("APP_NOT_FOUND",`${d} isn't deployed yet
+Its secrets can be set after its first deploy. Nothing was changed.`,{rerun:`${g} deploy`});return o(m,u,{...u.app,workerName:h.workerName,rowId:h.id},c.providers)}async function lr({cf:e,db:t,route:n,app:r}){let s=[...n.gateway.length>0?[{workerName:Q,names:n.gateway}]:[],...r?(await We(t,r.workerName)).map(a=>({workerName:a.name,names:r.names})):[]];for(let{workerName:a,names:i}of s){let o=await ce(e,a);if(i.some(p=>o.includes(p)))return!0}return!1}async function fe(e,t,n,r){let{out:s}=n,{cf:a,db:i,route:o,app:p,deployer:c}=e,u=B(n.flags.json??!1),m=E=>Object.fromEntries(E.map(w=>[w,t[w]??null])),d=r==="unset",h=o.gateway.length>0?await yt({db:i,out:s},"gateway.secrets"):null;try{let E=p?await wt({db:i,out:s},{workerName:p.workerName,appId:p.manifest.id,purpose:"app.secrets"}):null;try{let w=[],R=null;if(h){let y=await St(i);if(R=y,!y)throw new S("GATEWAY_NOT_INSTALLED",`The Gateway${e.accountName?` in ${e.accountName}`:""} isn't fully installed`,{rerun:`${g} setup`});w.push({step:"secrets.gateway",shownAs:"the Gateway",names:o.gateway,targets:[{workerName:Q,changes:m(o.gateway),recordedVersionIds:[y.liveVersionId],record:f=>ht(i,{...y,liveVersionId:f,updatedAt:Date.now(),updatedBy:c.actor})}]})}if(p){let y=await We(i,p.workerName),f=y.map(_=>_.versionId);w.push({step:"secrets.app",shownAs:p.manifest.id,names:p.names,targets:[{workerName:p.workerName,changes:m(p.names),recordedVersionIds:f,record:_=>ve(i,p.workerName,_)},...y.filter(_=>_.binding!=="").map(_=>({workerName:_.name,changes:m(p.names),recordedVersionIds:f,record:b=>ve(i,p.workerName,b,_.binding)}))]})}for(let y of w)for(let f of y.names)s.emit({type:"progress",step:"secrets.route",message:`${f} is ${y.step==="secrets.gateway"?"a Gateway setting":`${y.shownAs}'s secret`} \u2192 Worker ${y.targets.map(_=>_.workerName).join(", ")}`});for(let y of w)for(let f of y.targets){let _=I(Object.keys(f.changes));await Ft({cf:a,workerName:f.workerName,shownAs:y.shownAs,recordedVersionIds:f.recordedVersionIds,interactive:u,change:d?{question:`Remove ${_} from it anyway?`,effect:`Removing ${_} creates a new version from it.`}:{question:`Set ${_} on it anyway?`,effect:`Setting ${_} creates a new version from it.`}})}if(d&&!await mr(a,w,s))return null;let A={};for(let[y,f]of w.entries()){let _=f.targets.filter($=>Object.keys($.changes).length>0);if(_.length===0)continue;let b=f.names.filter($=>_.some(k=>Object.hasOwn(k.changes,$))),N=`${d?"Removed":"Set"} ${I(b)} ${d?"from":"on"} ${f.shownAs}`;s.emit({type:"step",step:f.step,status:"start",message:d?"Removing...":`Updating ${f.shownAs}...`});let T={};for(let $ of _){try{await ut(a,$.workerName,$.changes)}catch(we){let F=Object.values(A).flatMap(L=>L.names);if(F.length===0)throw we;let P=w.slice(y).flatMap(L=>L.names);throw new S("SECRETS_PARTIALLY_APPLIED",[`Couldn't ${d?"remove":"set"} ${I(f.names)} ${d?"from":"on"} ${f.shownAs}`,`Cloudflare said: ${C(we).split(`
+`)[0]}`,`${I(F)} ${F.length===1?"is":"are"} ${d?"removed":"set"}; only ${I(P)} ${P.length===1?"is":"are"} left.`].join(`
+`),{rerun:`${g} secret ${r} ${P.join(" ")}${p&&o.app?.source==="registry"&&P.some(L=>p.names.includes(L))?` --app ${p.manifest.id}`:""}`,retryable:!0,data:{applied:Ve(A),left:P}})}let x=(await zt(a,$.workerName))?.versionId??null;x&&await $.record(x),T[$.workerName]=x,s.emit({type:"progress",step:"secrets.version",message:`${$.workerName} is now at version ${x??"unknown"}`})}if(f.step==="secrets.gateway"){let $=await dr(i,b,d,c.actor,s).catch(k=>(s.emit({type:"progress",step:"secrets.pin",message:`Couldn't record which origin ${I(b)} ${b.length===1?"is":"are"} pinned to (${C(k).split(`
+`)[0]}); the Gateway pins it on first use`}),[]));if(A.gateway={names:b,versions:T,...$.length>0?{pinned:$}:{}},!d&&e.providers.length>0&&R){let k=await Bt(i,R,b);k.length>0&&(A.gateway.bound=k,s.emit({type:"progress",step:"secrets.bind",message:`Bound ${I(k)}'s key to the hosts ${k.length===1?"its row names":"their rows name"}`,data:{providers:k}}))}}else A.app={id:p.manifest.id,workerName:p.workerName,names:b,versions:T},await ur(a,i,p,s);s.emit({type:"step",step:f.step,status:"ok",message:N,data:{action:r,names:b,versions:T}})}return await Yt({cf:a,db:i,deployer:c},{gateway:A.gateway?.names??[],appRowId:A.app&&p?p.rowId:null,except:n.setupRecordedBy},s),A}finally{await E?.release()}}finally{await h?.release()}}async function dr(e,t,n,r,s){if(n){for(let i of await tn(e,t))s.emit({type:"progress",step:"secrets.pin",message:`${i}'s pin to its MCP server's origin is gone`});return[]}let a=await en(e,t,r);for(let{name:i,origin:o}of a.bound)s.emit({type:"progress",step:"secrets.pin",message:`${i} is pinned to ${o}`});for(let{name:i,kept:o}of a.undeclared)s.emit({type:"warning",code:"REMOTE_MCP_SECRET_UNDECLARED",step:"secrets.gateway",message:o?`No MCP app declares ${i} now
+It stays pinned to ${o}, where it was set before; the Gateway sends it nowhere else.`:`No MCP app declares ${i}
+The Gateway pins it to the first MCP app that uses it.`,data:{name:i,pinnedTo:o,fix:`${g} mcp add <url> --secret ${i}`}});for(let{name:i,origins:o}of a.ambiguous)s.emit({type:"warning",code:"REMOTE_MCP_SECRET_AMBIGUOUS",step:"secrets.gateway",message:`MCP apps at ${I(o)} all declare ${i}
+It isn't pinned to any of them, so the Gateway sends it to none until one is removed.`,data:{name:i,origins:o,rerun:`${g} mcp list`,rerunNote:"names the apps"}});return a.bound}async function ur(e,t,n,r){try{await Dt(t,n.rowId,await Oe(e,n.workerName))}catch(s){r.emit({type:"progress",step:"secrets.record",message:`Couldn't record ${n.manifest.id}'s secret names (${C(s).split(`
+`)[0]}); ${g} status records them`})}}async function mr(e,t,n){let r=!1;for(let s of t.flatMap(a=>a.targets)){let a=await ce(e,s.workerName);for(let i of Object.keys(s.changes)){if(a.includes(i)){r=!0;continue}delete s.changes[i],n.emit({type:"progress",step:"secrets.held",message:`${i} isn't set on ${s.workerName}`})}}return r}function Be(e,t){return[...e.gateway?[`${I(e.gateway.names)} ${t} the Gateway`]:[],...e.app?[`${I(e.app.names)} ${t} ${e.app.id}`]:[]].join(", and ")}function Ve(e){return{...e.gateway?{gateway:e.gateway}:{},...e.app?{app:e.app}:{}}}export{Yt as a,_r as b,z as c,vr as d,Or as e,Mr as f,Cr as g,Pr as h,Lr as i,bn as j,Ur as k,xr as l,vn as m,Gr as n,zr as o,en as p,Un as q,xn as r,Jn as s,dn as t,an as u,un as v,_s as w,Ns as x,$s as y,Zn as z,Qn as A,Ts as B,ks as C,nr as D,rr as E,ar as F,fn as G,Ve as H};

package/dist/{chunk-TPWSGRNT.js → chunk-IUOBIB5M.js}

@@ -1,4 +1,4 @@
-import{c as ve,d as O,e as ke,f as Ae,g as K,h as Ee,i as Re,j as P,k as Oe,l as W,m as H,n as Me,o as Te,p as Pe,t as _e,z as Ie}from"./chunk-IG26HYRR.js";import{a as S}from"./chunk-Y3VIFPN5.js";import{B as de,W as le,X as pe,Y as me,Z as ue,_ as fe,aa as ge,ca as he,da as we,ea as ye,qa as $e,sa as be,y as ce}from"./chunk-ZYL2ZHCF.js";import{e as ae,m as se,n as re,p as ie}from"./chunk-SPPR6WCI.js";import{a as V,b as oe}from"./chunk-F6IH47GT.js";import{X as Z,_ as ee,b as Q,c as f,ca as te,ea as ne,f as z,gc as j,hc as G,ib as I,ka as D,oa as B,oc as k,tb as R}from"./chunk-SAT3PGZU.js";import{stripVTControlCharacters as Ge}from"node:util";import w from"chalk";function We(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,n.manifest,n.status,t,n.id]}];let o=e.grants.map(s=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
+import{B as Ie,c as ve,d as O,e as ke,f as Ae,g as K,h as Ee,i as Re,j as P,k as Oe,l as W,m as H,n as Me,o as Te,p as Pe,v as _e}from"./chunk-IFCPALVC.js";import{a as S}from"./chunk-4JRIS6S6.js";import{B as de,W as le,X as pe,Y as me,Z as ue,_ as fe,aa as ge,ca as he,da as we,ea as ye,qa as $e,sa as be,y as ce}from"./chunk-RMF4YGD6.js";import{e as ae,m as se,n as re,p as ie}from"./chunk-NFU4YFXB.js";import{a as V,b as oe}from"./chunk-CCWBPAKH.js";import{Bb as R,b as Q,c as f,da as Z,f as z,ga as ee,ka as te,ma as ne,oc as j,pc as G,qb as I,sa as D,wa as B,wc as k}from"./chunk-LYNBZ7RV.js";import{stripVTControlCharacters as Ge}from"node:util";import w from"chalk";function We(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,n.manifest,n.status,t,n.id]}];let o=e.grants.map(s=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
 VALUES (?, ?, ?, ?, NULL) ON CONFLICT DO NOTHING`,params:[s.id,s.userId,s.appRowId,s.organizationId]}));return e.kind==="new"?[{sql:`INSERT INTO apps (id, organization_id, app_slug, name, description, hostname,
   worker_name, tier, manifest, status, version_id, deployed_at, deployed_by_actor,
   is_default, created_at, updated_at, scope)

package/dist/{chunk-E7EUXUVD.js → chunk-J35DDCNU.js}

@@ -1 +1 @@
-import{Pb as e}from"./chunk-SAT3PGZU.js";import t from"node:path";var n=".cloudflare/types/index.d.ts";async function p(r,o){await r.run({args:["workers","types"],plane:"project",cwd:o,mode:"text"})}async function a(r){return e(t.join(r,n))}export{p as a,a as b};
+import{Xb as e}from"./chunk-LYNBZ7RV.js";import t from"node:path";var n=".cloudflare/types/index.d.ts";async function p(r,o){await r.run({args:["workers","types"],plane:"project",cwd:o,mode:"text"})}async function a(r){return e(t.join(r,n))}export{p as a,a as b};

package/dist/{chunk-MC56CUQI.js → chunk-J455FAEN.js}

@@ -1,4 +1,4 @@
-import{a as I,c as N,d as T,e as C}from"./chunk-IZEOAOKL.js";import{a as W}from"./chunk-KMAOZRV4.js";import{ba as _,fa as k,k as A}from"./chunk-ZYL2ZHCF.js";import{e as P}from"./chunk-SPPR6WCI.js";import{b as R,c as $,dc as D,sb as b,tb as f}from"./chunk-SAT3PGZU.js";var g="app.live",M=6e5,F=3e3,B=15e3;var V={["deploy"]:"uploaded and bound"};async function G({db:i,appRowId:a,appId:t,hostname:e,out:r,verb:l,fetch:c,localDns:m=c?void 0:T,sleep:v=o=>new Promise(n=>setTimeout(n,o)),maxWaitMs:y=M,intervalMs:d=F,now:u=Date.now}){let o=`https://${e}/`,n=u(),p=!1,s=null,E,h=async()=>(p&&m&&await C({host:e,lead:`${t} is live at https://${e}`,out:r,step:g,localDns:m}),{outcome:"live",waited:E});for(;;){let S=await x(i,a,t);if(S==="active")return h();if(S==="disabled")return r.emit({type:"warning",code:"APP_DISABLED",step:g,message:`${t} is switched off in Admin \u2192 Apps
+import{a as I,c as N,d as T,e as C}from"./chunk-2Y5Q6A5K.js";import{a as W}from"./chunk-H6QQMY7B.js";import{ba as _,fa as k,k as A}from"./chunk-RMF4YGD6.js";import{e as P}from"./chunk-NFU4YFXB.js";import{Ab as b,Bb as f,b as R,c as $,lc as D}from"./chunk-LYNBZ7RV.js";var g="app.live",M=6e5,F=3e3,B=15e3;var V={["deploy"]:"uploaded and bound"};async function G({db:i,appRowId:a,appId:t,hostname:e,out:r,verb:l,fetch:c,localDns:m=c?void 0:T,sleep:v=o=>new Promise(n=>setTimeout(n,o)),maxWaitMs:y=M,intervalMs:d=F,now:u=Date.now}){let o=`https://${e}/`,n=u(),p=!1,s=null,E,h=async()=>(p&&m&&await C({host:e,lead:`${t} is live at https://${e}`,out:r,step:g,localDns:m}),{outcome:"live",waited:E});for(;;){let S=await x(i,a,t);if(S==="active")return h();if(S==="disabled")return r.emit({type:"warning",code:"APP_DISABLED",step:g,message:`${t} is switched off in Admin \u2192 Apps
 It's ${V[l]}; the Gateway serves it once an admin turns it on.`}),{outcome:"disabled"};let L=await N(o,c);if(L.answered){if(p=!0,L.access)return r.emit({type:"warning",code:"ACCESS_IN_FRONT",step:g,message:`Cloudflare Access answers before the Gateway, so this run can't confirm ${t} is live
 It goes live on its first visit, once someone signs in through Access.`,data:{hostname:e}}),{outcome:"first_visit"};if(await x(i,a,t)==="active")return h()}let w=u()-n;if(w>=y){if(!p)return r.emit({type:"warning",code:"CERT_PENDING",step:g,message:`No certificate for ${e} after ${D(w)}
 It usually comes within 5 minutes; ${t} goes live on its first visit once it has one.`,data:{hostname:e,fix:"if it never comes, check the zone's CAA records allow Cloudflare's certificate authorities"}}),{outcome:"first_visit"};throw new f("APP_NOT_LIVE",`${t} isn't live after ${D(w)}: the Gateway can't reach its Worker yet

package/dist/{chunk-WEM3WLOC.js → chunk-LXYMDZER.js}

@@ -1 +1 @@
-import{f as i}from"./chunk-74EST4VW.js";async function o(a,e){let t=await i(a);t&&e.emit({type:"warning",code:"LEGACY_LOCAL_STATE",message:t})}function p(a,e,t){a.emit({type:"step",step:e,status:"ok",message:t.applied.length>0?`Applied ${t.applied.join(", ")}.`:"The local database is up to date.",data:{database:t.database,applied:t.applied}})}export{o as a,p as b};
+import{f as i}from"./chunk-CZXHKPRZ.js";async function o(a,e){let t=await i(a);t&&e.emit({type:"warning",code:"LEGACY_LOCAL_STATE",message:t})}function p(a,e,t){a.emit({type:"step",step:e,status:"ok",message:t.applied.length>0?`Applied ${t.applied.join(", ")}.`:"The local database is up to date.",data:{database:t.database,applied:t.applied}})}export{o as a,p as b};