everyapp 0.3.0-rc.1 → 0.3.0-rc.2

package/dist/chunk-M2QQ2UD7.js

@@ -0,0 +1,132 @@
+import{$ as L,B as J,C as V,W as ce,Z as l,y as Y}from"./chunk-RMF4YGD6.js";import{e as N}from"./chunk-NFU4YFXB.js";import{Bb as m,c as E,k as M}from"./chunk-LYNBZ7RV.js";var le=`SELECT users.id AS id, users.email AS email, users.name AS name, members.role AS role
+FROM members JOIN users ON users.id = members.user_id
+WHERE members.organization_id = ?1 AND lower(users.email) = ?2
+LIMIT 1`,v=(e,n,a)=>`EXISTS (
+      SELECT 1 FROM members owners JOIN users owner ON owner.id = owners.user_id
+      WHERE owners.organization_id = ${e} AND owners.role = 'owner' AND owners.user_id <> ${n}
+        AND (owner.banned IS NULL OR owner.banned = 0 OR (owner.ban_expires IS NOT NULL AND owner.ban_expires <= ${a}))
+    )`;async function ra(e,n,a,t){let r=a.trim().toLowerCase(),i=Date.now(),[d=[],,p=[]]=await e.run([{sql:le,params:[n,r]},{sql:`UPDATE members SET role = ?3
+WHERE organization_id = ?1
+  AND user_id = (SELECT id FROM users WHERE lower(email) = ?2 LIMIT 1)
+  AND role <> ?3
+  AND NOT (
+    role = 'owner' AND ?3 <> 'owner'
+    AND NOT ${v("?1","members.user_id","?4")}
+  )`,params:[n,r,t,i]},{sql:le,params:[n,r]}]),s=ue(d[0]);if(!s)return{kind:"not_found"};if(s.role===t)return{kind:"unchanged",member:s};let o=ue(p[0])??s;return o.role===t?{kind:"changed",member:o,previousRole:s.role}:{kind:"last_owner",member:s}}function ue(e){return e?{id:String(e.id),email:String(e.email),name:String(e.name??""),role:String(e.role)}:null}import{createHash as He,randomBytes as ae,randomUUID as D}from"node:crypto";async function qe(e){let n=await L(e);if(!n||!n.hasOwner)throw new m("WORKSPACE_NOT_CLAIMED",`The Gateway has no owner yet
+The setup claim makes the workspace, named after its owner; rename it after.`,{fix:"open the Gateway in a browser and claim it, then run this again"});return n.organization}function ga(e,n){return ce(async()=>{let a=await qe(e),t=a.name!==n;return t&&await e.run([{sql:"UPDATE organizations SET name = ? WHERE id = ?",params:[n,a.id]}]),{organization:{...a,name:n},previousName:a.name,changed:t}})}var Ge=72*60*60*1e3,Be=60*60*1e3,Re=1e9,me=60,ge=255,ne=90,Ye=19,Je=e=>He("sha256").update(e).digest("hex"),x=e=>`((',' || replace(${e}, ' ', '') || ',') LIKE '%,owner,%')`,Oe=e=>`(NOT ${x(e)} OR ${v("?2","?1","?3")})`,z=`EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2 AND ${Oe("m.role")})`,$=`EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2)
+  AND NOT EXISTS (SELECT 1 FROM members mine WHERE mine.user_id = ?1 AND ${x("mine.role")}
+    AND NOT ${v("mine.organization_id","?1","?3")})`,Ve=e=>`(banned = 1 AND (ban_expires IS NULL OR ban_expires > ${e}))`;function F(e,n){let a=[];for(let t=0;t<e.length;t+=n)a.push(e.slice(t,t+n));return a}function Xe(e){let n=(e??"").split(",").map(a=>a.trim());return n.includes("owner")?"owner":n.includes("admin")?"admin":n.includes("member")?"member":null}var g=e=>Number(e??0);function H(e,n){let a=Number(e.banned??0)===1,t=e.ban_expires==null?null:Number(e.ban_expires);return{id:String(e.id),name:String(e.name??""),email:String(e.email),role:String(e.role??"member"),primaryRole:Xe(l(e.role)),deactivated:a&&(t===null||t>n),createdAt:g(e.created_at)}}function te(e,n){let a=String(e.status),t=g(e.expires_at);return{id:String(e.id),email:String(e.email),role:String(e.role??"member"),status:a,expiresAt:t,createdAt:g(e.created_at),live:a==="pending"&&t>n}}function Se(e){return{id:String(e.id),name:String(e.name),description:l(e.description),createdAt:g(e.created_at),memberCount:g(e.member_count),appCount:g(e.app_count)}}function re(e){return{id:String(e.id),appSlug:String(e.app_slug),name:String(e.name),description:String(e.description??""),status:String(e.status),scope:String(e.scope),tier:String(e.tier),hostname:l(e.hostname),everyone:Number(e.is_default??0)===1,manifest:l(e.manifest),secretNames:l(e.secret_names),accessCount:g(e.access_count)}}var q="u.id, u.name, u.email, m.role, u.banned, u.ban_expires, u.created_at",ie=`a.id, a.app_slug, a.name, a.description, a.status, a.scope, a.tier, a.hostname, a.is_default, a.manifest, a.secret_names,
+  (SELECT COUNT(DISTINCT g.user_id) FROM (
+     SELECT ua.user_id FROM user_app_access ua WHERE ua.app_row_id = a.id AND ua.organization_id = a.organization_id
+     UNION ALL
+     SELECT gm.user_id FROM group_app_access ga JOIN group_members gm ON gm.group_id = ga.group_id
+       WHERE ga.app_row_id = a.id AND ga.organization_id = a.organization_id AND gm.organization_id = a.organization_id
+   ) g JOIN members mm ON mm.user_id = g.user_id AND mm.organization_id = a.organization_id) AS access_count`,U=e=>({id:String(e.id),name:String(e.name),slug:String(e.slug)});async function Te(e,n){let a=n.trim(),[t=[],r=[]]=await e.run([{sql:`SELECT id, name, slug FROM organizations
+WHERE id = ?1 OR slug = ?1 OR lower(name) = lower(?1)
+ORDER BY created_at, id`,params:[a]},{sql:"SELECT id, name, slug FROM organizations ORDER BY created_at, id"}]),i=t.map(U),d=i.find(s=>s.id===a)??i.find(s=>s.slug===a);if(d)return d;if(i.length===1)return i[0];if(i.length>1)throw new m("ORG_AMBIGUOUS",`${i.length} organizations are named ${a}: ${M(i.map(s=>`${s.slug} (${s.id})`))}
+A name isn't unique, and any owner or admin can rename their organization; a slug or id is one organization's.`,{fix:"name it by its slug or id with --org",data:{organizations:i}});let p=r.map(U);throw new m("ORGANIZATION_NOT_FOUND",`No organization named ${a} on this Gateway${p.length>0?`
+The Gateway has: ${M(p.map(s=>`${s.slug} (${s.name})`))}.`:""}`,{fix:"name one by its slug, id or name with --org",data:{organizations:p}})}async function Ke(e,n){if(n.email===null)return{actor:n.actor,email:null,userId:null};let[a=[]]=await e.run([{sql:"SELECT id FROM users WHERE lower(email) = lower(?) AND email_verified = 1",params:[n.email]}]);return{actor:n.actor,email:n.email,userId:l(a[0]?.id)}}var De=()=>new m("ORGANIZATION_NOT_FOUND",`The Gateway has no organization yet
+Its owner creates the first one by claiming it.`,{rerun:`${E} setup`,rerunNote:"prints the owner link"});async function _a(e,n){if(n!==void 0)return Te(e,n);let a=await L(e);if(!a)throw De();return a.organization}async function Ea(e,n,a={}){let[t,r]=await Promise.all([L(e),Ke(e,n)]);if(a.org===void 0&&!t)throw De();let i=a.org===void 0?t.organization:await Te(e,a.org);return{db:e,organization:i,installOrganizationId:t?.organization.id??null,operator:r,now:a.now??Date.now()}}async function k(e,n){let a=n.trim(),[t=[]]=await e.db.run([{sql:`SELECT ${q} FROM members m JOIN users u ON u.id = m.user_id
+WHERE m.organization_id = ?1 AND (lower(u.email) = lower(?2) OR u.id = ?2)
+ORDER BY (u.id = ?2) DESC LIMIT 1`,params:[e.organization.id,a]}]),r=t[0];if(!r)throw new m("USER_NOT_FOUND",`${a} isn't a member of ${e.organization.name}`,{rerun:`${E} workspace users`,rerunNote:"lists the members and invitations"});return H(r,e.now)}async function P(e,n,{callable:a=!1}={}){let t=n.trim(),[r=[]]=await e.db.run([{sql:`SELECT ${ie} FROM apps a
+WHERE (a.organization_id = ?1${a?" OR a.scope = 'shared'":""}) AND a.status != '${N}'
+  AND (a.app_slug = ?2 OR a.id = ?2)
+ORDER BY (a.organization_id = ?1) DESC, (a.id = ?2) DESC LIMIT 1`,params:[e.organization.id,t]}]),i=r[0];if(!i)throw new m("APP_NOT_FOUND",`No app named ${t} in ${e.organization.name}`,{rerun:`${E} workspace apps`,rerunNote:"lists them"});return re(i)}async function ke(e,n){let a=n.trim(),[t=[]]=await e.db.run([{sql:`${Ce} AND (g.id = ?2 OR lower(g.name) = lower(?2)) ORDER BY (g.id = ?2) DESC LIMIT 1`,params:[e.organization.id,a]}]),r=t[0];if(!r)throw new m("GROUP_NOT_FOUND",`No group named ${a} in ${e.organization.name}`,{rerun:`${E} workspace groups`,rerunNote:"lists them"});return Se(r)}async function he(e,n){let a=n.trim(),[t=[]]=await e.db.run([{sql:`SELECT id, email, role, status, expires_at, created_at FROM invitations
+WHERE organization_id = ?1 AND status = 'pending' AND (id = ?2 OR lower(email) = lower(?2))
+ORDER BY (id = ?2) DESC, created_at DESC LIMIT 1`,params:[e.organization.id,a]}]),r=t[0];if(!r)throw new m("INVITATION_NOT_PENDING",`No pending invitation for ${a} in ${e.organization.name}
+It was accepted, canceled or never made.`,{rerun:`${E} workspace users`,rerunNote:"lists the pending invitations"});return te(r,e.now)}async function Na(e){let n=e.organization.id,[a=[],t=[]]=await e.db.run([{sql:`SELECT u.email FROM members m JOIN users u ON u.id = m.user_id
+WHERE m.organization_id = ?1 AND ${x("m.role")} ORDER BY m.created_at, u.email`,params:[n]},{sql:`SELECT
+  (SELECT COUNT(*) FROM members WHERE organization_id = ?1) AS members,
+  (SELECT COUNT(*) FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?1 AND ${Ve("?2")}) AS deactivated,
+  (SELECT COUNT(*) FROM invitations WHERE organization_id = ?1 AND status = 'pending' AND expires_at > ?2) AS invitations,
+  (SELECT COUNT(*) FROM groups WHERE organization_id = ?1) AS groups,
+  (SELECT COUNT(*) FROM apps WHERE organization_id = ?1 AND status != '${N}') AS apps`,params:[n,e.now]}]),r=t[0]??{};return{organization:e.organization,owners:a.map(i=>String(i.email)),counts:{members:g(r.members),deactivated:g(r.deactivated),invitations:g(r.invitations),groups:g(r.groups),apps:g(r.apps)}}}async function ba(e){let[n=[],a=[]]=await e.db.run([{sql:`SELECT ${q} FROM members m JOIN users u ON u.id = m.user_id
+WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id]},{sql:`SELECT id, email, role, status, expires_at, created_at FROM invitations
+WHERE organization_id = ?1 AND status = 'pending' ORDER BY created_at DESC`,params:[e.organization.id]}]),t={owner:0,admin:1,member:2};return{members:n.map(r=>H(r,e.now)).sort((r,i)=>(t[r.primaryRole??"member"]??3)-(t[i.primaryRole??"member"]??3)||r.email.localeCompare(i.email)),invitations:a.map(r=>te(r,e.now))}}function Ie(){let e=`einv_${ae(32).toString("base64url")}`;return{token:e,hash:Je(e)}}var Aa=(e,n)=>`${e}/accept-invitation?token=${encodeURIComponent(n)}`,fa=(e,n)=>`${e}/reset-password?token=${encodeURIComponent(n)}`;async function Ra(e,n,a){let t=n.trim().toLowerCase(),r=await je(e,"invite");await _e(e,t);let i=D(),{token:d,hash:p}=Ie(),s=e.now+Ge,[,,o=[]]=await e.db.run([{sql:`INSERT INTO invitations (id, organization_id, email, role, status, expires_at, created_at, inviter_id)
+SELECT ?1, ?2, ?3, ?4, 'pending', ?5, ?6, ?7
+WHERE NOT EXISTS (SELECT 1 FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?2 AND lower(u.email) = ?3)
+  AND NOT EXISTS (SELECT 1 FROM invitations i WHERE i.organization_id = ?2 AND lower(i.email) = ?3 AND i.status = 'pending' AND i.expires_at > ?6)`,params:[i,e.organization.id,t,a,s,e.now,r]},{sql:`INSERT INTO invitation_link_tokens (id, invitation_id, token_hash, created_at)
+SELECT ?1, ?2, ?3, ?4 WHERE EXISTS (SELECT 1 FROM invitations WHERE id = ?2)`,params:[D(),i,p,e.now]},{sql:"SELECT id, email, role, status, expires_at, created_at FROM invitations WHERE id = ?",params:[i]}]),u=o[0];if(!u)throw await _e(e,t),new m("ALREADY_INVITED",`${t} was invited meanwhile`,{retryable:!0});return{invitation:te(u,e.now),token:d}}async function je(e,n){let{operator:a}=e;if(a.userId!==null){let[r=[]]=await e.db.run([{sql:"SELECT 1 AS member FROM members WHERE user_id = ? AND organization_id = ?",params:[a.userId,e.organization.id]}]);if(r.length>0)return a.userId}let t=a.email===null?"An API token has no account on the Gateway":a.userId===null?`${a.email} has no account on this Gateway (a verified one)`:`${a.email} isn't a member of ${e.organization.name}`;throw new m("WORKSPACE_NOT_A_MEMBER",`Only a member can ${n}: an invitation records who sent it
+${t}.`,{fix:a.email===null?`log in with your Cloudflare account (${E} login), claim the Gateway (${E} setup) or get invited, or invite from Admin \u2192 Users`:`claim the Gateway (${E} setup) or get invited to ${e.organization.name}, or invite from Admin \u2192 Users`})}async function _e(e,n){let[a=[],t=[]]=await e.db.run([{sql:"SELECT u.email FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?1 AND lower(u.email) = ?2",params:[e.organization.id,n]},{sql:"SELECT id FROM invitations WHERE organization_id = ?1 AND lower(email) = ?2 AND status = 'pending' AND expires_at > ?3",params:[e.organization.id,n,e.now]}]);if(a.length>0)throw new m("ALREADY_MEMBER",`${n} is a member of ${e.organization.name} already`,{rerun:`${E} workspace users`,rerunNote:"lists the members"});if(t.length>0)throw new m("ALREADY_INVITED",`${n} has a pending invitation to ${e.organization.name} already`,{rerun:`${E} workspace invite-link ${n}`,rerunNote:"prints a new link for it"})}async function Oa(e,n){let a=await he(e,n);if(!a.live)throw new m("INVITATION_NOT_PENDING",`The invitation for ${a.email} expired on ${new Date(a.expiresAt).toISOString()}`,{rerun:`${E} workspace invite ${a.email}`,rerunNote:"makes a new one"});let{token:t,hash:r}=Ie(),[i=[]]=await e.db.run([{sql:`INSERT INTO invitation_link_tokens (id, invitation_id, token_hash, created_at)
+SELECT ?1, ?2, ?3, ?4 WHERE EXISTS (SELECT 1 FROM invitations WHERE id = ?2 AND status = 'pending' AND expires_at > ?4)
+RETURNING id`,params:[D(),a.id,r,e.now]}]);if(i.length===0)throw new m("INVITATION_NOT_PENDING",`The invitation for ${a.email} was used or canceled meanwhile`);return{invitation:a,token:t}}async function Sa(e,n){let a=await he(e,n),[t=[]]=await e.db.run([{sql:"UPDATE invitations SET status = 'canceled' WHERE id = ? AND organization_id = ? AND status = 'pending' RETURNING id",params:[a.id,e.organization.id]}]);if(t.length===0)throw new m("INVITATION_NOT_PENDING",`The invitation for ${a.email} was used or canceled meanwhile`);return{...a,status:"canceled",live:!1}}function Ee(e,n,a,t){let i=t.id===e.organization.id?`${n.email} is the last owner of ${t.name} who can act, so they can't be ${a}`:`${n.email} is the last owner of ${t.name} who can act, and a deactivation is account-wide: it would leave ${t.name} without one`,d=t.id===e.installOrganizationId?{rerun:`${E} workspace role <email> owner`,rerunNote:"for someone else, then this command again"}:{fix:`an owner of ${t.name} makes someone else an owner under Manage workspace \u2192 Users, then run this again`};return new m("LAST_OWNER",`${i}
+Make someone else an owner of ${t.name} first, then try again.`,{...d,data:{organization:t,member:{id:n.id,email:n.email,name:n.name}}})}async function Ze(e,n,a){let[t=[]]=await e.db.run([{sql:`SELECT o.id, o.name, o.slug FROM members mine JOIN organizations o ON o.id = mine.organization_id
+WHERE mine.user_id = ?1 AND ${a?"1":"mine.organization_id = ?3"} AND ${x("mine.role")}
+  AND NOT ${v("mine.organization_id","?1","?2")}
+ORDER BY (mine.organization_id = ?3) DESC, o.created_at, o.id`,params:[n,e.now,e.organization.id]}]);return t.map(U)}async function C(e,n,a,t,{afterWrite:r=!1}={}){let i=r?await k(e,n.id):n,d=await Ze(e,i.id,t);if(d[0])throw Ee(e,i,a,d[0]);if(r)throw Ee(e,i,a,e.organization)}function ve(e,n,a){let t=[n.id,e.organization.id,e.now];return[{sql:`UPDATE users SET banned = 1, ban_reason = ?4, ban_expires = NULL, updated_at = ?3
+WHERE id = ?1 AND ${$} RETURNING id`,params:[...t,a]},{sql:`DELETE FROM sessions WHERE user_id = ?1 AND ${$}`,params:t},{sql:`UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3
+WHERE user_id = ?1 AND revoked_at IS NULL AND ${$}`,params:t},{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_reason = 'user_deactivated'
+WHERE user_id = ?1 AND revoked_at IS NULL AND ${$}`,params:t}]}async function Ta(e,n){let a=await k(e,n);await C(e,a,"deactivated",!0);let[t=[]]=await e.db.run(ve(e,a,`Deactivated by ${e.operator.actor} (${E} workspace deactivate)`));return t.length===0&&await C(e,a,"deactivated",!0,{afterWrite:!0}),{member:{...a,deactivated:!0},already:a.deactivated}}async function Da(e,n){let a=await k(e,n);return await e.db.run([{sql:`UPDATE users SET banned = 0, ban_reason = NULL, ban_expires = NULL, updated_at = ?3
+WHERE id = ?1 AND EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2)`,params:[a.id,e.organization.id,e.now]}]),{member:{...a,deactivated:!1},already:!a.deactivated}}async function ka(e,n,a){let t=await k(e,n);await C(e,t,"removed",!1);let[r=[]]=await e.db.run([{sql:"SELECT COUNT(*) AS n FROM members WHERE user_id = ? AND organization_id != ?",params:[t.id,e.organization.id]}]),i=g(r[0]?.n);if(i===0&&await a.accessMayLetBackIn(t)){let[o=[]]=await e.db.run(ve(e,t,`Removed by ${e.operator.actor} (${E} workspace remove); deactivated instead, as Cloudflare Access would let them back in`));return o.length===0&&await C(e,t,"removed",!0,{afterWrite:!0}),{member:{...t,deactivated:!0},deactivatedInstead:!0,accountDeleted:!1,otherOrganizations:i}}let d=[t.id,e.organization.id,e.now],[,,,,p=[],s=[]]=await e.db.run([{sql:`DELETE FROM user_app_access WHERE user_id = ?1 AND organization_id = ?2 AND ${z}`,params:d},{sql:`DELETE FROM group_members WHERE user_id = ?1 AND organization_id = ?2 AND ${z}`,params:d},{sql:`UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3
+WHERE user_id = ?1 AND organization_id = ?2 AND revoked_at IS NULL AND ${z}`,params:d},{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_reason = 'member_removed'
+WHERE user_id = ?1 AND organization_id = ?2 AND revoked_at IS NULL AND ${z}`,params:d},{sql:`DELETE FROM members WHERE user_id = ?1 AND organization_id = ?2 AND ${Oe("role")} RETURNING id`,params:d},a.deleteAccounts?{sql:"DELETE FROM users WHERE id = ?1 AND NOT EXISTS (SELECT 1 FROM members WHERE user_id = ?1) RETURNING id",params:[t.id]}:{sql:"SELECT NULL AS id WHERE 0"}]);return p.length===0&&await C(e,t,"removed",!1,{afterWrite:!0}),{member:t,deactivatedInstead:!1,accountDeleted:s.length>0,otherOrganizations:i}}async function ha(e,n){let a=await k(e,n);if(a.deactivated)throw new m("PASSWORD_RESET_REQUIRES_ACTIVE_USER",`${a.email} is deactivated, and a password-reset link is only for an active account`,{rerun:`${E} workspace reactivate ${a.email}`,rerunNote:"first, if they should be back"});let[t=[]]=await e.db.run([{sql:`SELECT o.id, o.name, o.slug FROM members m JOIN organizations o ON o.id = m.organization_id
+WHERE m.user_id = ?1 AND m.organization_id != ?2 ORDER BY o.created_at, o.id`,params:[a.id,e.organization.id]}]);if(t.length>0){let d=t.map(U);throw new m("USER_IN_OTHER_ORGANIZATION",`${a.email} also belongs to ${M(d.map(p=>p.name))}, and a password is account-wide
+The Gateway's own rule: a password-reset link is never made for someone in another organization, since it would reach that one too.`,{fix:"they reset it themselves with Forgot password (the Gateway's email must be configured), or they are removed from the other organization first",data:{member:{id:a.id,email:a.email,name:a.name},organizations:d}})}let r=ae(24).toString("base64url"),i=e.now+Be;return await e.db.run([{sql:`INSERT INTO verifications (id, identifier, value, expires_at, created_at, updated_at)
+VALUES (?1, ?2, ?3, ?4, ?5, ?5)`,params:[D(),`reset-password:${r}`,a.id,i,e.now]}]),{member:a,token:r,expiresAt:i}}var Ce=`SELECT g.id, g.name, g.description, g.created_at,
+  (SELECT COUNT(*) FROM group_members gm WHERE gm.group_id = g.id) AS member_count,
+  (SELECT COUNT(*) FROM group_app_access ga JOIN apps a ON a.id = ga.app_row_id AND a.status != '${N}' WHERE ga.group_id = g.id) AS app_count
+FROM groups g WHERE g.organization_id = ?1`;async function Ia(e){let[n=[]]=await e.db.run([{sql:`${Ce} ORDER BY g.name`,params:[e.organization.id]}]);return n.map(Se)}function we(e){let n=e.trim();if(n.length<1||n.length>me)throw new m("GROUP_NAME_INVALID",`A group name is 1 to ${me} characters${n?` (${n.length} given)`:""}`);return n}function ye(e){return new m("GROUP_NAME_TAKEN",`A group named "${e}" exists already in this organization`,{rerun:`${E} workspace groups`,rerunNote:"lists them"})}var Qe=()=>`grp_${ae(8).toString("hex")}`;async function va(e,n){let a=we(n.name),t=n.description?.trim()||null,r=Qe(),[i=[]]=await e.db.run([{sql:`INSERT INTO groups (id, organization_id, name, description, created_at, created_by)
+SELECT ?1, ?2, ?3, ?4, ?5, ?6
+WHERE NOT EXISTS (SELECT 1 FROM groups WHERE organization_id = ?2 AND lower(name) = lower(?3))
+RETURNING id`,params:[r,e.organization.id,a,t,e.now,e.operator.userId]}]);if(i.length===0)throw ye(a);return{id:r,name:a,description:t,createdAt:e.now,memberCount:0,appCount:0}}async function Ca(e,n,a){let t=await ke(e,n),r=a.name===void 0?t.name:we(a.name),i=a.description===void 0?t.description:a.description.trim()||null,[d=[]]=await e.db.run([{sql:`UPDATE groups SET name = ?3, description = ?4
+WHERE id = ?1 AND organization_id = ?2
+  AND NOT EXISTS (SELECT 1 FROM groups WHERE organization_id = ?2 AND lower(name) = lower(?3) AND id != ?1)
+RETURNING id`,params:[t.id,e.organization.id,r,i]}]);if(d.length===0)throw ye(r);return{...t,name:r,description:i}}async function wa(e,n){let a=await ke(e,n),t=[a.id,e.organization.id];return await e.db.run([{sql:"DELETE FROM group_app_access WHERE group_id = ?1 AND organization_id = ?2",params:t},{sql:"DELETE FROM group_members WHERE group_id = ?1 AND organization_id = ?2",params:t},{sql:"DELETE FROM groups WHERE id = ?1 AND organization_id = ?2",params:t}]),a}async function Ne(e,n){let[a=[]]=await e.db.run([{sql:`SELECT ${q}, (gm.user_id IS NOT NULL) AS in_group
+FROM members m JOIN users u ON u.id = m.user_id
+LEFT JOIN group_members gm ON gm.group_id = ?2 AND gm.user_id = u.id
+WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id,n.id]}]);return a.map(t=>({...H(t,e.now),inGroup:Number(t.in_group)===1}))}function oe(e,n){let a=new Set(e);if(n.set){let i=new Set(n.set);return{add:[...i].filter(d=>!a.has(d)),remove:[...a].filter(d=>!i.has(d))}}let t=[...new Set(n.add??[])].filter(i=>!a.has(i)),r=[...new Set(n.remove??[])].filter(i=>a.has(i));return{add:t,remove:r}}async function T(e,n){let a=[];for(let t of n){let r=await k(e,t);a.some(i=>i.id===r.id)||a.push(r)}return a}async function X(e,n){let a=[];for(let t of n){let r=await P(e,t);a.some(i=>i.id===r.id)||a.push(r)}return a}async function ya(e,n,a){let[t,r,i]=await Promise.all([a.set?T(e,a.set):void 0,T(e,a.add??[]),T(e,a.remove??[])]),d=await Ne(e,n),p=d.filter(u=>u.inGroup).map(u=>u.id),s=oe(p,{set:t?.map(u=>u.id),add:r.map(u=>u.id),remove:i.map(u=>u.id)}),o=new Map(d.map(u=>[u.id,u]));return await e.db.run([...F(s.remove,ne).map(u=>({sql:`DELETE FROM group_members WHERE group_id = ? AND organization_id = ? AND user_id IN (${u.map(()=>"?").join(", ")})`,params:[n.id,e.organization.id,...u]})),...s.add.map(u=>({sql:`INSERT INTO group_members (group_id, user_id, organization_id, added_at, added_by)
+SELECT ?1, ?2, ?3, ?4, ?5 WHERE EXISTS (SELECT 1 FROM members WHERE user_id = ?2 AND organization_id = ?3)
+ON CONFLICT DO NOTHING`,params:[n.id,u,e.organization.id,e.now,e.operator.userId]}))]),{added:s.add.map(u=>o.get(u)),removed:s.remove.map(u=>o.get(u)),members:await Ne(e,n)}}async function be(e,n){let[a=[]]=await e.db.run([{sql:`SELECT ${ie}, (ga.group_id IS NOT NULL) AS granted FROM apps a
+LEFT JOIN group_app_access ga ON ga.group_id = ?2 AND ga.app_row_id = a.id
+WHERE a.organization_id = ?1 AND a.scope != 'shared' AND a.status != '${N}' ORDER BY a.name`,params:[e.organization.id,n.id]}]);return a.map(t=>({...re(t),granted:Number(t.granted)===1}))}function G(e){return new m("SHARED_APP_ACCESS",`${e.appSlug} is a shared app: every member of every organization can open it, so its access can't be changed`)}async function Wa(e,n,a){let[t,r,i]=await Promise.all([a.set?X(e,a.set):void 0,X(e,a.add??[]),X(e,a.remove??[])]);for(let o of[...t??[],...r])if(o.scope==="shared")throw G(o);let d=await be(e,n),p=oe(d.filter(o=>o.granted).map(o=>o.id),{set:t?.map(o=>o.id),add:r.map(o=>o.id),remove:i.map(o=>o.id)}),s=new Map(d.map(o=>[o.id,o]));return await e.db.run([...F(p.remove,ne).map(o=>({sql:`DELETE FROM group_app_access WHERE group_id = ? AND organization_id = ? AND app_row_id IN (${o.map(()=>"?").join(", ")})`,params:[n.id,e.organization.id,...o]})),...p.add.map(o=>({sql:`INSERT INTO group_app_access (group_id, app_row_id, organization_id, granted_at, granted_by)
+SELECT ?1, ?2, ?3, ?4, ?5
+WHERE EXISTS (SELECT 1 FROM apps WHERE id = ?2 AND organization_id = ?3 AND scope != 'shared' AND status != '${N}')
+ON CONFLICT DO NOTHING`,params:[n.id,o,e.organization.id,e.now,e.operator.userId]}))]),{added:p.add.map(o=>s.get(o)),removed:p.remove.map(o=>s.get(o)),apps:await be(e,n)}}async function Ma(e){let[n=[]]=await e.db.run([{sql:`SELECT ${ie} FROM apps a WHERE a.organization_id = ?1 AND a.status != '${N}' ORDER BY a.name`,params:[e.organization.id]}]);return n.map(re)}function ea(e){let n=e.trim();if(n.length<1||n.length>ge)throw new m("APP_NAME_INVALID",`An app's name is 1 to ${ge} characters${n?` (${n.length} given)`:", not empty"}`,{fix:"give --name the name the app library should show, or leave --name off"});return n}async function La(e,n,a){let t=await P(e,n);if(a.name===void 0&&a.description===void 0&&a.everyone===void 0)throw new m("NOTHING_TO_SET","Nothing to set: give --name, --description or --everyone on|off");if(t.scope==="shared"&&a.everyone)throw G(t);let r=a.name===void 0?t.name:ea(a.name),i=a.description===void 0?t.description:a.description.trim(),d=a.everyone??t.everyone,p=[];if(d&&!t.everyone){let[o=[]]=await e.db.run([{sql:"SELECT user_id FROM members WHERE organization_id = ?",params:[e.organization.id]}]);for(let u of F(o,Ye))p.push({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by) VALUES ${u.map(()=>"(?, ?, ?, ?, ?)").join(", ")} ON CONFLICT DO NOTHING RETURNING id`,params:u.flatMap(R=>[D(),String(R.user_id),t.id,e.organization.id,e.operator.userId])})}let[,...s]=await e.db.run([{sql:`UPDATE apps SET name = ?3, description = ?4, is_default = ?5, updated_at = ?6
+WHERE id = ?1 AND organization_id = ?2 AND status != '${N}'`,params:[t.id,e.organization.id,r,i,d?1:0,e.now]},...p]);return{app:await P(e,t.id),granted:s.reduce((o,u)=>o+u.length,0)}}async function Ae(e,n){if(n.scope==="shared")throw G(n);let[a=[]]=await e.db.run([{sql:`SELECT ${q},
+  (ua.id IS NOT NULL) AS direct,
+  (SELECT group_concat(g.name, char(31)) FROM group_app_access ga
+     JOIN group_members gm ON gm.group_id = ga.group_id AND gm.user_id = u.id
+     JOIN groups g ON g.id = ga.group_id
+   WHERE ga.app_row_id = ?2 AND ga.organization_id = ?1) AS via_groups
+FROM members m JOIN users u ON u.id = m.user_id
+LEFT JOIN user_app_access ua ON ua.app_row_id = ?2 AND ua.organization_id = ?1 AND ua.user_id = u.id
+WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id,n.id]}]);return a.map(t=>({...H(t,e.now),direct:Number(t.direct)===1,viaGroups:l(t.via_groups)?.split("").sort()??[]}))}async function za(e,n,a){if(n.scope==="shared")throw G(n);let[t,r,i]=await Promise.all([a.set?T(e,a.set):void 0,T(e,a.add??[]),T(e,a.remove??[])]),d=await Ae(e,n),p=oe(d.filter(o=>o.direct).map(o=>o.id),{set:t?.map(o=>o.id),add:r.map(o=>o.id),remove:i.map(o=>o.id)}),s=new Map(d.map(o=>[o.id,o]));return await e.db.run([...F(p.remove,ne).map(o=>({sql:`DELETE FROM user_app_access WHERE app_row_id = ? AND organization_id = ? AND user_id IN (${o.map(()=>"?").join(", ")})`,params:[n.id,e.organization.id,...o]})),...p.add.map(o=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_at, granted_by)
+SELECT ?1, ?2, ?3, ?4, ?5, ?6 WHERE EXISTS (SELECT 1 FROM members WHERE user_id = ?2 AND organization_id = ?4)
+ON CONFLICT DO NOTHING`,params:[D(),o,n.id,e.organization.id,e.now,e.operator.userId]}))]),{granted:p.add.map(o=>s.get(o)),revoked:p.remove.map(o=>s.get(o)),users:await Ae(e,n)}}function ee(e){return e.appCap!==null?{cap:e.appCap,source:"app"}:e.unlimited?{cap:null,source:null}:e.defaultCap!==null?{cap:e.defaultCap,source:"default"}:{cap:null,source:null}}var We=(e,n)=>e===null?n!==null:n===null||e>n,fe=new WeakMap;function Me(e){let n=fe.get(e);return n||(n=e.run([{sql:"PRAGMA table_info(org_settings)"},{sql:"PRAGMA table_info(org_app_settings)"}]).then(([a=[],t=[]])=>a.length>0&&t.some(r=>r.name==="unlimited")),fe.set(e,n)),n}async function se(e){if(!await Me(e))throw new m("GATEWAY_PREDATES_DEFAULT_CAPS",`The Gateway predates default caps
+Its database has no workspace default cap and no no-cap override until the Gateway is updated to a release that has them.`,{rerun:`${E} update`,rerunNote:"then run this again"})}var Le=e=>e===null||Number.isInteger(e)&&e>=1&&e<=Re,ze=()=>new m("INVALID_CAP",`A monthly cap is a whole number from 1 to ${Re.toLocaleString("en-US")}, or off`);async function $a(e,n,a,t={}){let r=t.unlimited??!1,i=await P(e,n,{callable:!0});if(!Le(a))throw ze();if(a!==null&&r)throw new m("INVALID_CAP",`An app has a cap or no cap, not both
+Give a number, off, or --unlimited.`);let d=await Me(e.db);r&&await se(e.db);let p=e.organization.id,[s=[],o=[]]=await e.db.run([{sql:`SELECT monthly_call_cap${d?", unlimited":""} FROM org_app_settings WHERE organization_id = ? AND app_row_id = ?`,params:[p,i.id]},...d?[{sql:"SELECT default_monthly_call_cap AS cap FROM org_settings WHERE organization_id = ?",params:[p]}]:[]]),u=s[0]?.monthly_call_cap==null?null:Number(s[0].monthly_call_cap),R=Number(s[0]?.unlimited??0)===1,w=o[0]?.cap==null?null:Number(o[0].cap),h=ee({appCap:u,unlimited:R,defaultCap:w}),I=ee({appCap:a,unlimited:r,defaultCap:w}),O=a===null?null:await V(e.db,{organizationId:p,deployer:e.operator,now:e.now}),y=We(I.cap,h.cap)?await J(e.db,{organizationId:p,type:"cap.raised",actor:Y(e.operator),data:{app:{id:i.appSlug,rowId:i.id,name:i.name},cap:I.cap,previousCap:h.cap,source:"app"},appRowId:i.id,now:e.now}):[],b=a===null&&!r?{sql:"DELETE FROM org_app_settings WHERE organization_id = ? AND app_row_id = ?",params:[p,i.id]}:d?{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, unlimited, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4, ?5, ?6)
+ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, unlimited = ?4, updated_at = ?5, updated_by = ?6`,params:[p,i.id,a,r?1:0,e.now,e.operator.userId]}:{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4, ?5)
+ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, updated_at = ?4, updated_by = ?5`,params:[p,i.id,a,e.now,e.operator.userId]},B=await e.db.run([b,...O?[O]:[],...y]),S=O?l(B[1]?.[0]?.id):null;return{app:i,cap:a,unlimited:r,was:u,wasUnlimited:R,effective:I,before:h,capAlertsId:S}}async function Ua(e,n){if(!Le(n))throw ze();await se(e.db);let a=e.organization.id,[t=[]]=await e.db.run([{sql:"SELECT default_monthly_call_cap AS cap FROM org_settings WHERE organization_id = ?",params:[a]}]),r=t[0]?.cap==null?null:Number(t[0].cap),i=n===null?null:await V(e.db,{organizationId:a,deployer:e.operator,now:e.now}),d=We(n,r)?await J(e.db,{organizationId:a,type:"cap.raised",actor:Y(e.operator),data:{app:null,cap:n,previousCap:r,source:"default"},now:e.now}):[],p=await e.db.run([n===null?{sql:"DELETE FROM org_settings WHERE organization_id = ?",params:[a]}:{sql:`INSERT INTO org_settings (organization_id, default_monthly_call_cap, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4)
+ON CONFLICT (organization_id) DO UPDATE SET default_monthly_call_cap = ?2, updated_at = ?3, updated_by = ?4`,params:[a,n,e.now,e.operator.userId]},...i?[i]:[],...d]),s=i?l(p[1]?.[0]?.id):null;return{cap:n,was:r,capAlertsId:s}}var aa=/^\d{4}-(0[1-9]|1[0-2])$/;function $e(e){return`${e.getUTCFullYear()}-${String(e.getUTCMonth()+1).padStart(2,"0")}`}function na(e,n){let[a,t]=e.split("-").map(Number);return $e(new Date(Date.UTC(a,t-1+n,1)))}var K=`COALESCE(SUM(d.calls), 0) AS calls, COALESCE(SUM(d.failures), 0) AS failures,
+  COALESCE(SUM(d.input_tokens), 0) AS input_tokens, COALESCE(SUM(d.output_tokens), 0) AS output_tokens,
+  COALESCE(SUM(d.cost_micros), 0) AS cost_micros`,j=e=>({calls:g(e.calls),failures:g(e.failures),inputTokens:g(e.input_tokens),outputTokens:g(e.output_tokens),costMicros:g(e.cost_micros)}),Z={calls:0,failures:0,inputTokens:0,outputTokens:0,costMicros:0},Q={monthlyCallCap:null,capUnlimited:!1,effectiveMonthlyCallCap:null,capSource:null,paused:!1};async function Pa(e,n){if(!aa.test(n))throw new m("INVALID_MONTH",`--month ${n} isn't a month: use YYYY-MM`);await se(e.db);let a=e.organization.id,t=`${n}-01`,r=`${na(n,1)}-01`,i=Date.parse(`${t}T00:00:00.000Z`),d=Date.parse(`${r}T00:00:00.000Z`),p="d.organization_id = ?1 AND d.day >= ?2 AND d.day < ?3",s="c.organization_id = ?1 AND c.decision = 'allowed' AND c.created_at >= ?2 AND c.created_at < ?3",[o=[],u=[],R=[],w=[],h=[],I=[],O=[]]=await e.db.run([{sql:`SELECT d.app_row_id, a.name, a.app_slug, ${K} FROM usage_daily d LEFT JOIN apps a ON a.id = d.app_row_id
+WHERE ${p} GROUP BY d.app_row_id, a.name, a.app_slug`,params:[a,t,r]},{sql:`SELECT d.user_id, u.name, u.email, ${K} FROM usage_daily d
+LEFT JOIN members m ON m.user_id = d.user_id AND m.organization_id = d.organization_id
+LEFT JOIN users u ON u.id = m.user_id
+WHERE ${p} GROUP BY d.user_id, u.name, u.email`,params:[a,t,r]},{sql:`SELECT d.kind, d.target, ${K} FROM usage_daily d WHERE ${p} GROUP BY d.kind, d.target`,params:[a,t,r]},{sql:`SELECT c.app_row_id, a.name, a.app_slug, COUNT(*) AS tool_calls FROM mcp_tool_calls c
+LEFT JOIN apps a ON a.id = c.app_row_id WHERE ${s} GROUP BY c.app_row_id, a.name, a.app_slug`,params:[a,i,d]},{sql:`SELECT c.user_id, u.name, u.email, COUNT(*) AS tool_calls FROM mcp_tool_calls c
+LEFT JOIN members m ON m.user_id = c.user_id AND m.organization_id = c.organization_id
+LEFT JOIN users u ON u.id = m.user_id
+WHERE ${s} GROUP BY c.user_id, u.name, u.email`,params:[a,i,d]},{sql:`SELECT a.id AS app_row_id, a.name, a.app_slug, s.monthly_call_cap, s.unlimited FROM apps a
+LEFT JOIN org_app_settings s ON s.app_row_id = a.id AND s.organization_id = ?1
+WHERE (a.organization_id = ?1 OR a.scope = 'shared') AND a.status != '${N}'`,params:[a]},{sql:"SELECT default_monthly_call_cap AS cap FROM org_settings WHERE organization_id = ?",params:[a]}]),y=O[0]?.cap==null?null:Number(O[0].cap),b=new Map;for(let c of o)b.set(String(c.app_row_id),{appRowId:String(c.app_row_id),appSlug:l(c.app_slug),name:l(c.name),...j(c),toolCalls:0,...Q,callable:!1});for(let c of w){let _=l(c.app_row_id);if(!_)continue;let A=b.get(_);A?A.toolCalls=g(c.tool_calls):b.set(_,{appRowId:_,appSlug:l(c.app_slug),name:l(c.name),...Z,toolCalls:g(c.tool_calls),...Q,callable:!1})}let B=n===$e(new Date(e.now));for(let c of I){let _=String(c.app_row_id),A=c.monthly_call_cap==null?null:Number(c.monthly_call_cap),pe=Number(c.unlimited??0)===1,W=ee({appCap:A,unlimited:pe,defaultCap:y}),f=b.get(_)??{appRowId:_,appSlug:l(c.app_slug),name:l(c.name),...Z,toolCalls:0,...Q,callable:!0};f.callable=!0,f.monthlyCallCap=A,f.capUnlimited=pe,f.effectiveMonthlyCallCap=W.cap,f.capSource=W.source,f.paused=B&&W.cap!==null&&f.calls>=W.cap,b.set(_,f)}let S=new Map;for(let c of u)S.set(String(c.user_id),{userId:String(c.user_id),name:l(c.name),email:l(c.email),...j(c),toolCalls:0});for(let c of h){let _=String(c.user_id),A=S.get(_);A?A.toolCalls=g(c.tool_calls):S.set(_,{userId:_,name:l(c.name),email:l(c.email),...Z,toolCalls:g(c.tool_calls)})}let de=(c,_)=>_.calls-c.calls||_.toolCalls-c.toolCalls;return{month:n,defaultMonthlyCallCap:y,byApp:[...b.values()].sort((c,_)=>de(c,_)||(c.name??c.appRowId).localeCompare(_.name??_.appRowId)),byMember:[...S.values()].sort(de),byTarget:R.map(c=>({kind:String(c.kind),target:String(c.target),...j(c)})).sort((c,_)=>_.calls-c.calls)}}var ta=200;async function xa(e,n){let a=Math.min(Math.max(1,Math.trunc(n.limit??50)||1),ta),t=["c.organization_id = ?"],r=[e.organization.id];n.before&&(t.push("(c.created_at < ? OR (c.created_at = ? AND c.id < ?))"),r.push(n.before.createdAt,n.before.createdAt,n.before.id));for(let[s,o]of[["c.app_row_id",n.appRowId],["c.user_id",n.userId],["c.decision",n.decision],["c.risk",n.risk]])o!==void 0&&(t.push(`${s} = ?`),r.push(o));n.since!==void 0&&(t.push("c.created_at >= ?"),r.push(n.since)),r.push(a+1);let[i=[]]=await e.db.run([{sql:`SELECT c.id, c.created_at, c.user_id, u.name AS user_name, u.email AS user_email,
+  c.credential_kind, c.client_name, c.client_info, c.app_row_id, c.app_slug, a.name AS app_name, a.status AS app_status,
+  c.tool_name, c.via, c.risk, c.decision, c.reason, c.outcome, c.duration_ms, c.result_bytes
+FROM mcp_tool_calls c
+LEFT JOIN apps a ON a.id = c.app_row_id
+LEFT JOIN members m ON m.user_id = c.user_id AND m.organization_id = c.organization_id
+LEFT JOIN users u ON u.id = m.user_id
+WHERE ${t.join(" AND ")}
+ORDER BY c.created_at DESC, c.id DESC LIMIT ?`,params:r}]),d=i.slice(0,a),p=d.at(-1);return{calls:d.map(s=>{let o=l(s.app_row_id),u=l(s.app_status);return{id:String(s.id),createdAt:g(s.created_at),user:{id:String(s.user_id),name:l(s.user_name),email:l(s.user_email)},credential:{kind:String(s.credential_kind),clientName:l(s.client_name),clientInfo:l(s.client_info)},app:{rowId:o,slug:l(s.app_slug),name:l(s.app_name),removed:o!==null&&(u===null||u===N)},tool:{name:String(s.tool_name),risk:l(s.risk),via:l(s.via)},decision:s.decision==="allowed"?"allowed":"blocked",reason:l(s.reason),outcome:String(s.outcome),durationMs:s.duration_ms==null?null:Number(s.duration_ms),resultBytes:s.result_bytes==null?null:Number(s.result_bytes)}}),nextBefore:i.length>a&&p?{createdAt:g(p.created_at),id:String(p.id)}:null}}var Ue=`SELECT t.id, t.user_id, u.email, t.name, t.token_prefix, t.app_row_id, a.app_slug, a.name AS app_name,
+  t.scopes, t.created_at, t.expires_at, t.last_used_at, t.revoked_at
+FROM user_access_tokens t JOIN users u ON u.id = t.user_id
+LEFT JOIN apps a ON a.id = t.app_row_id AND a.organization_id = t.organization_id
+WHERE t.organization_id = ?1`;function Pe(e,n){let a=e.revoked_at==null?null:Number(e.revoked_at),t=g(e.expires_at),r=[];try{let i=JSON.parse(String(e.scopes??"[]"));r=Array.isArray(i)?i.map(String):[]}catch{r=[]}return{id:String(e.id),user:{id:String(e.user_id),email:String(e.email)},name:String(e.name),prefix:String(e.token_prefix),app:{rowId:l(e.app_row_id),slug:l(e.app_slug),name:l(e.app_name)},scopes:r,createdAt:g(e.created_at),expiresAt:t,lastUsedAt:e.last_used_at==null?null:Number(e.last_used_at),revokedAt:a,active:a===null&&t>n}}async function Fa(e,n){let[a=[]]=await e.db.run([{sql:`${Ue}${n?" AND t.user_id = ?2":""} ORDER BY t.created_at DESC`,params:n?[e.organization.id,n]:[e.organization.id]}]);return a.map(t=>Pe(t,e.now))}async function Ha(e,n){let[a=[]]=await e.db.run([{sql:`${Ue} AND t.id = ?2`,params:[e.organization.id,n.trim()]}]),t=a[0];if(!t)throw new m("TOKEN_NOT_FOUND",`No personal access token ${n.trim()} in ${e.organization.name}`,{rerun:`${E} workspace tokens`,rerunNote:"lists them by id"});let r=Pe(t,e.now);return r.revokedAt!==null?{token:r,already:!0}:(await e.db.run([{sql:"UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3 WHERE id = ?1 AND organization_id = ?2 AND revoked_at IS NULL",params:[r.id,e.organization.id,e.now]}]),{token:{...r,revokedAt:e.now,active:!1},already:!1})}var xe=`SELECT c.id, c.user_id, u.email, c.client_name, c.client_domain, c.redirect_host, c.app_scope, c.access,
+  c.created_at, c.last_used_at, c.revoked_at, c.revoked_reason,
+  (SELECT group_concat(a.app_slug, char(31)) FROM mcp_connection_apps ca JOIN apps a ON a.id = ca.app_row_id WHERE ca.connection_id = c.id) AS app_slugs
+FROM mcp_connections c JOIN users u ON u.id = c.user_id
+WHERE c.organization_id = ?1`;function Fe(e){return{id:String(e.id),user:{id:String(e.user_id),email:String(e.email)},clientName:String(e.client_name),clientDomain:l(e.client_domain),redirectHost:String(e.redirect_host),apps:e.app_scope==="all"?"all":l(e.app_slugs)?.split("").sort()??[],access:e.access==="write"?"write":"read",createdAt:g(e.created_at),lastUsedAt:e.last_used_at==null?null:Number(e.last_used_at),revokedAt:e.revoked_at==null?null:Number(e.revoked_at),revokedReason:l(e.revoked_reason)}}async function qa(e,n){let[a=[]]=await e.db.run([{sql:`${xe} AND c.revoked_at IS NULL${n?" AND c.user_id = ?2":""} ORDER BY c.created_at DESC`,params:n?[e.organization.id,n]:[e.organization.id]}]);return a.map(Fe)}async function Ga(e,n){let[a=[]]=await e.db.run([{sql:`${xe} AND c.id = ?2`,params:[e.organization.id,n.trim()]}]),t=a[0];if(!t)throw new m("CONNECTION_NOT_FOUND",`No AI connection ${n.trim()} in ${e.organization.name}`,{rerun:`${E} workspace connections`,rerunNote:"lists them by id"});let r=Fe(t);return r.revokedAt!==null?{connection:r,already:!0}:(await e.db.run([{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_by = ?4, revoked_reason = 'user'
+WHERE id = ?1 AND organization_id = ?2 AND revoked_at IS NULL`,params:[r.id,e.organization.id,e.now,e.operator.userId]}]),{connection:{...r,revokedAt:e.now,revokedReason:"user"},already:!1})}export{ra as a,ga as b,Re as c,_a as d,Ea as e,k as f,P as g,ke as h,Na as i,ba as j,Aa as k,fa as l,Ra as m,Oa as n,Sa as o,Ta as p,Da as q,ka as r,ha as s,Ia as t,va as u,Ca as v,wa as w,Ne as x,ya as y,be as z,Wa as A,Ma as B,ea as C,La as D,Ae as E,za as F,$a as G,Ua as H,aa as I,$e as J,Pa as K,ta as L,xa as M,Fa as N,Ha as O,qa as P,Ga as Q};

package/dist/{chunk-OVKVV6MK.js → chunk-N5GQLGEC.js}

@@ -1,2 +1,2 @@
-import{d}from"./chunk-RFVMR32Y.js";import{o as u,p as f}from"./chunk-JYKRUS5C.js";import{Vb as i,Wb as l,d as c,tb as a}from"./chunk-SAT3PGZU.js";function $(n,t,r){return i(n,{plane:"account",args:["dns","records","list","-z",t,"--name-exact",r,"--per-page","100"]},f)}async function v(n,t,r){await n.run({plane:"account",mode:"json",args:["dns","records","delete",r,"-z",t,"--force"]})}function y(n){return`*.${n.slice(n.indexOf(".")+1)}`}function z(n){return`${n.type}${n.content?` ${n.content}`:""}`}var p=50,g=20;function C(n){return`https://dash.cloudflare.com/${n}/domains/overview`}async function _(n,t,r){let o=d(t),e=await w(n,t,r);if(!e)throw new a("ZONE_NOT_FOUND",`No zone in this Cloudflare account holds ${t}
+import{d}from"./chunk-W3JCQHHU.js";import{o as u,p as f}from"./chunk-JYKRUS5C.js";import{Bb as a,bc as i,cc as l,d as c}from"./chunk-LYNBZ7RV.js";function $(n,t,r){return i(n,{plane:"account",args:["dns","records","list","-z",t,"--name-exact",r,"--per-page","100"]},f)}async function v(n,t,r){await n.run({plane:"account",mode:"json",args:["dns","records","delete",r,"-z",t,"--force"]})}function y(n){return`*.${n.slice(n.indexOf(".")+1)}`}function z(n){return`${n.type}${n.content?` ${n.content}`:""}`}var p=50,g=20;function C(n){return`https://dash.cloudflare.com/${n}/domains/overview`}async function _(n,t,r){let o=d(t),e=await w(n,t,r);if(!e)throw new a("ZONE_NOT_FOUND",`No zone in this Cloudflare account holds ${t}
 Looked for ${o.join(", ")}. Buy a domain in the dashboard (Domains, ${C(r)}), or add one you own and point its nameservers at Cloudflare.`,{fix:"use a domain that is on Cloudflare in this account"});if(e.status&&e.status!=="active")throw new a("ZONE_NOT_ACTIVE",`The Cloudflare zone ${e.name} is ${e.status}, not active`,{fix:`finish its nameserver setup (Cloudflare dashboard \u2192 ${e.name} \u2192 Overview)`,rerun:c()});return{id:e.id,name:e.name}}async function w(n,t,r){let e=(await Promise.all(d(t).map(async s=>(await i(n,{plane:"account",args:["zones","list","--name",s,"--account-id",r]},u)).find(m=>m.name.toLowerCase()===s)??null))).find(s=>s!==null);return e?{id:e.id,name:e.name.toLowerCase(),status:e.status??null}:null}function A(n,t){return`https://dash.cloudflare.com/${n}/${t}`}async function D(n,t){return(await l(n,["zones","list","--account-id",t],u,{perPage:p,maxPages:g})).map(o=>({id:o.id,name:o.name.toLowerCase(),status:o.status??null}))}export{$ as a,v as b,y as c,z as d,C as e,_ as f,w as g,A as h,D as i};

package/dist/chunk-NFU4YFXB.js

@@ -0,0 +1 @@
+import{B as S,ca as u,da as z,ea as L,fa as E,ha as N,ja as w,ka as B,kb as j,la as V,lb as X,ma as K,mb as M,na as F,oa as G,pa as H,qa as J,ra as W,rb as v,ta as O,tb as T,ub as Y,vb as q,wb as Q,xb as k,yb as Z}from"./chunk-LYNBZ7RV.js";function de(e){if(!e)return null;try{let t=JSON.parse(e);return Array.isArray(t)&&t.every(r=>typeof r=="string")?t:null}catch{return null}}function le(e){return JSON.stringify([...new Set(e)].sort())}var b=class extends Error{constructor(r,n){super(`App "${r}" can't be routed: ${n}`);this.appId=r;this.name="UnroutableAppError"}};var D=class{byHostname=new Map;byAppId=new Map;byOrgApp=new Map;constructor(t=[]){for(let r of t)this.add(r)}add(t){this.byHostname.set(t.hostname.toLowerCase(),t),this.byAppId.set(t.appId,t),this.byOrgApp.set(ee(t.organizationId,t.appId),t)}async findByHostname(t){return this.byHostname.get(t.toLowerCase())??null}async hasAnyActiveApp(){return Array.from(this.byAppId.values()).some(t=>t.status==="active")}async findByAppId(t){return this.byAppId.get(t)??null}async findByOrgApp(t,r){return this.byOrgApp.get(ee(t,r))??null}};function ee(e,t){return JSON.stringify([e,t])}var p="deleted",o=class extends Error{status;code;constructor({status:t,code:r,message:n}){super(n),this.name="RegistrationError",this.status=t,this.code=r}},ce=/^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/,re=12,ge=50;function ne(e){return e.toLowerCase().replace(/[^a-z0-9]/g,"").slice(0,re)||"org"}function ue(e){let t=ne(e);return Array.from({length:ge},(r,n)=>{let s=n===0?"":String(n+1);return`${t.slice(0,re-s.length)}${s}`})}function te(e,t){let r=e.trim().toLowerCase();if(!ce.test(r))throw new o({status:400,code:"INVALID_APP_HOSTNAME",message:`${t} must form a valid DNS label of at most 63 characters; received "${r}".`});return r}function se(e){let{appSlug:t,orgKey:r}=e;if(j(t))throw new o({status:400,code:"RESERVED_APP_ID",message:`The app id "${t}" is reserved for the platform.`});if(t.includes(T))throw new o({status:400,code:"INVALID_APP_ID",message:`App id "${t}" can't contain "${T}": it separates an app's Worker name from its resources' names. Choose another id.`});let n=e.existingApp?.workerName??Y({appId:t,orgKey:r}),s=e.appBaseDomain.trim().toLowerCase().replace(/\.$/,""),i=e.existingApp?.hostname??`${e.isInstallOrganization?te(t,"The app id"):te(`${t}-${r}`,"The app id and organization key")}.${s}`;if(!q({appId:t,orgKey:r,workerName:n}))throw new o({status:400,code:"INVALID_WORKER_NAME",message:n.length>v?`App id "${t}" is too long: its Worker name "${n}" would exceed ${v} characters.`:`App id "${t}" can't be registered: its Worker would be "${n}", which is reserved for the gateway or isn't the app's own.`});return{workerName:n,hostname:i}}function oe(e,t){let r;try{r=M(e)}catch(n){throw new o({status:400,code:"INVALID_MANIFEST",message:n instanceof X?n.message:"Invalid manifest"})}if(r.id!==t)throw new o({status:400,code:"INVALID_MANIFEST",message:`manifest.id "${r.id}" does not match appId "${t}"`});return r}function U(e){if(!e)return null;try{return M(JSON.parse(e))}catch{return null}}function ie(e,t){let r=(n,s=Q)=>Object.fromEntries((n??[]).map(i=>[i,s(e,i)]));return{d1:r(t?.resources?.d1),kv:r(t?.resources?.kv),r2:r(t?.resources?.r2,Z)}}function me(e){return e.workerName?ie(e.workerName,U(e.manifest)):{d1:{},kv:{},r2:{}}}var Ae={d1:"D1 database",kv:"KV namespace",r2:"R2 bucket"},fe=/^[a-z0-9][a-z0-9-]*[a-z0-9]$/;function Re(e){for(let[t,r]of Object.entries(e)){let n=new Map;for(let[s,i]of Object.entries(r)){let a=n.get(i);if(a!==void 0)throw new o({status:400,code:"RESOURCE_NAME_CONFLICT",message:`Bindings ${a} and ${s} would share the ${Ae[t]} "${i}". Rename one of them in everyapp.config.ts.`});if(t==="r2"&&(i.length>k||!fe.test(i)))throw new o({status:400,code:"INVALID_MANIFEST",message:`resources.r2: ${s} would be the R2 bucket "${i}", which Cloudflare refuses (at most ${k} lowercase letters, digits and hyphens, starting and ending with a letter or digit). Rename the binding in everyapp.config.ts.`});n.set(i,s)}}}function Ie(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function ye(e,t,r,n){if(t==="shared")return{isDefault:!1,grants:[]};let s=r.access==="everyone";return{isDefault:s,grants:e.members.filter(i=>s||i.id===e.deployerUserId||Ie(i.role)).map(i=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:i.id,appRowId:n,grantedBy:null}))}}function we(e){let{existingApp:t}=e,r=e.scope??(t?.scope==="shared"?"shared":"org");if(t&&(t.organizationId!==e.organizationId||t.appSlug!==e.appSlug))throw new Error("existingApp is another organization's or app's row.");if(r==="shared"&&!e.isInstallOrganization)throw new o({status:403,code:"SHARED_APP_NOT_PLATFORM",message:`Only the platform organization registers shared apps; "${e.appSlug}" can't be shared from another organization.`});if(t&&t.scope!==r)throw new o({status:409,code:"APP_SCOPE_MISMATCH",message:t.scope==="shared"?`App "${e.appSlug}" is a shared app, not this organization's own. Deploy it without asking for another scope, or give the organization's own app an id of its own.`:`App "${e.appSlug}" is this organization's own app, not a shared one. Shared apps need an app id of their own.`});let n=e.tier??"service_binding";if(n==="dispatch"&&r==="shared")throw new o({status:400,code:"APP_TIER_MISMATCH",message:`A shared app is reached over a service binding; "${e.appSlug}" can't be deployed through the hosted deploy API.`});if(t&&t.tier!==n)throw new o({status:409,code:"APP_TIER_MISMATCH",message:t.tier===u?`"${e.appSlug}" is the Gateway's MCP app of that name${t.status===p?" (turned off)":""}; give this app an id of its own.`:t.tier==="dispatch"?`App "${e.appSlug}" is deployed through the hosted deploy API; deploy it the same way, or give this app an id of its own.`:`App "${e.appSlug}" is reached over a service binding, not deployed through the hosted deploy API; give the third-party app an id of its own.`});let s=se(e),i=oe(e.manifest,e.appSlug),{workerName:a,hostname:d}=s;for(let[A,_,pe]of[[e.hostnameOwner,"hostname",d],[e.workerNameOwner,"workerName",a]])if(A&&A[_]!==pe)throw new Error(`The ${_} owner passed holds another ${_}.`);let m=A=>A!==null&&(A.organizationId!==e.organizationId||A.appSlug!==e.appSlug);if(m(e.hostnameOwner))throw new o({status:409,code:"HOSTNAME_TAKEN",message:`The hostname "${d}" is already registered to another app on this gateway.`});if(m(e.workerNameOwner))throw new o({status:409,code:"WORKER_NAME_TAKEN",message:`The worker name "${a}" is already registered to another app on this gateway. Choose a different app id.`});let f=ie(a,i);Re(f);let y={organizationId:e.organizationId,name:e.name,description:e.description,hostname:d,workerName:a},l={previousManifest:U(t?.manifest??null),versionId:t?.versionId??null,resources:f};if(t&&t.status!==p)return{kind:"existing",app:{...t,...y},grants:[],...l};let R=t?.id??crypto.randomUUID(),{isDefault:c,grants:h}=ye(e,r,i,R),g={...y,manifest:JSON.stringify(i),status:"pending",isDefault:c};return t?{kind:"revived",app:{...t,...g},grants:h,...l}:{kind:"new",app:{id:R,appSlug:e.appSlug,tier:n,scope:r,versionId:null,deployedAt:null,deployedByActor:null,...g},grants:h,...l}}function he(e){if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`No app "${e.appSlug}" is registered for this organization.`});if(!e.workerName||!e.hostname&&e.tier!=="dispatch")throw new o({status:409,code:"APP_NOT_REGISTERED",message:`App "${e.appSlug}" has no Worker or hostname yet; deploy it again.`})}function Ee(e,{versionId:t,manifest:r,actor:n,now:s=Date.now()}){return he(e),{manifest:JSON.stringify(oe(r,e.appSlug)),versionId:t,deployedAt:s,deployedByActor:n,status:e.status==="pending"?"binding":e.status}}function P(e){return e.status===p?null:{status:p,isDefault:!1,emailSenders:null,emailInbound:null,secretNames:null}}function Me(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function I(e,t){throw new o({status:400,code:e,message:t})}function Pe(e,t){let r=t&&typeof t=="object"&&!Array.isArray(t)?t:{kind:t??"none"},n=r.kind,s=(n==="bearer"||n==="header"||n==="basic")&&r.secret===void 0?{...r,secret:B(e)}:r,i=G(s);return i.ok||I("REMOTE_MCP_INVALID",i.problem),i.auth}function C(e){if(e.tier!==u||!e.manifest)return!1;try{return W(JSON.parse(e.manifest))}catch{return!1}}function $(e){return e.tier===u}function x(e){if(e.tier!==u||!e.manifest)return null;try{return J(JSON.parse(e.manifest))}catch{return null}}function _e(e,t,r){if(r&&(r.organizationId!==e||r.appSlug!==t))throw new Error("existingApp is another organization's or app's row.")}function Se(e,t){if(C(t))return;let r=t.tier===u?"the Gateway's built-in MCP app":`an app deployed to this Gateway${t.status===p?" (deleted, its names still its organization's)":""}`;throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e}" is ${r}; a remote MCP server can't take its id.`})}function Ne(e){let t=e.url.trim(),r=F(t,e.env);r&&I("REMOTE_MCP_URL_REFUSED",r);let n=(e.id??"").trim()||K(t);n||I("REMOTE_MCP_INVALID","no app id could be read from the URL's host; give one with --name");let s=V(n);s&&I("REMOTE_MCP_INVALID",s);let i=e.sharedApp?.(n);if(i&&i.status!==p)throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${n}" is a shared app every organization sees; a remote MCP server can't take its id.`});let a=e.existingApp(n);_e(e.organizationId,n,a);let d=(e.risk??"annotations").trim();w.includes(d)||I("REMOTE_MCP_INVALID",`risk must be one of ${w.join(", ")}`);let m=Pe(n,e.auth);if("secret"in m&&e.secretUsedAt){let g=e.secretUsedAt(m.secret),A=new URL(t).origin;if(g&&g!==A)throw new o({status:409,code:"REMOTE_MCP_SECRET_TAKEN",message:`${m.secret} is the credential of an MCP app at ${g}; a server at ${A} takes another name (--secret <NAME>_MCP_TOKEN).`})}let f=a?x(a)?.rev??0:0,y={url:t,auth:m,risk:d,tools:{},rev:f+1},l=O({id:n,name:e.name,description:e.description,remote:y});if(a&&((E(n)||!C(a))&&Se(n,a),a.status!==p))throw new o({status:409,code:"REMOTE_MCP_EXISTS",message:`"${n}" is an MCP app on this Gateway already (${a.status==="active"?"on":"off"}); remove it first, or change it in place.`});let R=a?.id??crypto.randomUUID(),c={id:R,organizationId:e.organizationId,appSlug:n,name:l.name,description:l.description,hostname:null,workerName:null,tier:u,scope:"org",manifest:JSON.stringify(l),status:"active",versionId:null,deployedAt:e.now,deployedByActor:e.actor,isDefault:!1},h=e.members.filter(g=>g.id===e.actorUserId||Me(g.role)).map(g=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:g.id,appRowId:R,grantedBy:null}));return{kind:a?"revived":"new",id:n,app:c,grants:h,remote:y}}function Oe(e,t){let r=x(e);if(!r)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" is not a remote MCP app.`});if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" was removed.`});let n=r.risk;t.risk!==void 0&&(w.includes(t.risk)||I("REMOTE_MCP_INVALID",`risk must be one of ${w.join(", ")}`),n=t.risk);let s={...r.tools};if(t.tools&&(s={...t.tools}),t.tool){let{name:l,override:R}=t.tool;if(l.trim()||I("REMOTE_MCP_INVALID","name the tool"),R===null)delete s[l];else{let c={...s[l],...R};c.risk===void 0&&delete c.risk,(c.enabled===void 0||c.enabled===!0)&&delete c.enabled,Object.keys(c).length===0?delete s[l]:s[l]=c}}let i=S({risk:n,tools:s})!==S({risk:r.risk,tools:r.tools}),a={...r,risk:n,tools:s,rev:i?r.rev+1:r.rev},d=H(a);d.ok||I("REMOTE_MCP_INVALID",d.problem);let m=JSON.parse(e.manifest??"{}"),f=O({id:e.appSlug,name:t.name===void 0?e.name:t.name,description:t.description===void 0?e.description:t.description,remote:a}),y={...m,...f};return{manifest:JSON.stringify(y),name:f.name,description:f.description,remote:a}}function ve(e,t){if(!$(e))throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e.appSlug}" is an app deployed to this Gateway, not an MCP app.`});if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" was removed; add it again.`});return e.status===t?null:{status:t}}function Te(e){return!e||!$(e)?null:P(e)}function ke(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function ae(e){if(E(e))return e;throw new o({status:400,code:"PROVIDER_APP_UNKNOWN",message:`"${e}" is not an MCP app. The Gateway offers: ${L.join(", ")}.`})}function be(e,t){if(t.tier!==u)throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e}" is an app deployed to this Gateway${t.status===p?" (deleted, its names still its organization's)":""}, not the MCP app; the MCP app can't take its id.`})}function De(e){let t=ae(e.id),{existingApp:r}=e;if(r&&(r.organizationId!==e.organizationId||r.appSlug!==t))throw new Error("existingApp is another organization's or app's row.");let n=z[t];if(r&&be(t,r),r&&r.status!==p)return{kind:"existing",app:{...r,name:n.name,description:n.description,manifest:JSON.stringify(N(t)),status:"active"},grants:[]};let s=r?.id??crypto.randomUUID(),i={id:s,organizationId:e.organizationId,appSlug:t,name:n.name,description:n.description,hostname:null,workerName:null,tier:u,scope:"org",manifest:JSON.stringify(N(t)),status:"active",versionId:null,deployedAt:e.now,deployedByActor:e.actor,isDefault:!1},a=e.members.filter(d=>d.id===e.actorUserId||ke(d.role)).map(d=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:d.id,appRowId:s,grantedBy:null}));return{kind:r?"revived":"new",app:i,grants:a}}export{de as a,le as b,b as c,D as d,p as e,o as f,ue as g,se as h,me as i,we as j,Ee as k,P as l,ae as m,De as n,C as o,x as p,Ne as q,Oe as r,ve as s,Te as t};

package/dist/chunk-OM2HDWVP.js

@@ -0,0 +1 @@
+import{a as d}from"./chunk-4JRIS6S6.js";import{Aa as u,Ba as g,Ca as S,G as p,ba as f,c as l,pc as c,qb as m}from"./chunk-LYNBZ7RV.js";import a from"chalk";function $(e){return d(e,m)}async function C(e,n){return(await d(e,n)).filter(t=>!f(t))}function w(e,n=p){let t=n.unboundSettings?.();return t&&t.size>0?e.filter(r=>!t.has(r)):[...e]}function I(e){let n=e.lookup??p,t=e.gatewayNames===null?null:w(e.gatewayNames,n),r=g(u(e.manifest,n),(o,i)=>{let s=o==="gateway"?t:e.secretNames;return s===null?null:s.includes(i)});return{report:r,setup:S(r,{cli:l,appId:e.appId})}}function M(e,n=p){return u(e,n).some(t=>t.names.length>0)}function P(e,n=p){let t=new Set;for(let r of u(e,n))if(r.holder==="gateway")for(let o of[...r.names,...r.alsoReads])t.add(o);return[...t]}function O(e,n){let t=new Map,r=(o,i)=>{let s=t.get(o);s?s.required||=i:t.set(o,{name:o,required:i,set:n.includes(o)})};for(let o of e)if(o.holder==="gateway"){for(let i of o.names)r(i,o.need.kind!=="optional");for(let i of o.alsoReads)r(i,!1)}return[...t.values()]}function W(e,n){return e.filter(t=>t.holder==="gateway"&&t.blocking).flatMap(t=>t.names).filter((t,r,o)=>!n.includes(t)&&o.indexOf(t)===r)}var y=`${a.yellow("!")} not set`;function k(e){if(e.set===!0)return`${a.green("\u2713")} set`;if(e.set===null)return e.holder==="app"?`${a.yellow("!")} not recorded`:`${a.yellow("!")} couldn't check`;switch(e.need.kind){case"required":return y;case"optional":return a.dim("not set (optional)");case"anyOf":return e.blocking?y:a.dim(`not set (one of: ${e.need.group})`)}}function h(e){return e.names.join("+")}function A(e,n){return n.filter(t=>t.names.length>0).map(t=>({app:e,setting:h(t),where:t.holder==="gateway"?"Gateway":e,status:k(t)}))}function U(e,n,t){return A(e,t.filter(r=>r.holder==="app")).map(r=>({...r,where:`${n} helper`}))}function _(e,{app:n=!0}={}){return n?c(["APP","SETTING","WHERE","STATUS"],e.map(t=>[t.app,t.setting,t.where,t.status])):c(["SETTING","WHERE","STATUS"],e.map(t=>[t.setting,t.where,t.status]))}function b(e){let n=e.names.join(" and "),t=e.why??(e.label===n?void 0:n);return[t?`${e.label}: ${t}`:e.label,...e.hint?[e.hint]:[],...e.docs?[`Get it at ${e.docs}`]:[]]}var R=".claude/skills/everyapp";function N(e){return e.setup?`Guide: ${R}/${e.setup}`:e.kind==="capability"||e.kind==="provider"?`Guide: ${l} provider show ${e.id}`:null}function q(e){let n=new Set;return e.flatMap(t=>{let r=b(t),o=N(t);return!o||n.has(o)?r:(n.add(o),[...r,o])})}function j(e){let n=[],t=r=>{for(let o of r.names)n.includes(o)||n.push(o)};for(let r of e.unmet)r.need.kind==="required"&&t(r);for(let r of e.groups){if(r.met)continue;let o=e.unmet.find(i=>i.id===r.members[0]);o&&t(o)}return n}export{$ as a,C as b,w as c,I as d,M as e,P as f,O as g,W as h,k as i,A as j,U as k,_ as l,b as m,R as n,N as o,q as p,j as q};

package/dist/{chunk-DQWOXSL3.js → chunk-ONLNJXVQ.js}

@@ -1,4 +1,4 @@
-import{createHash as d,createHmac as N}from"node:crypto";var l="https://gateway.dev.localhost";var I=`-----BEGIN PRIVATE KEY-----
+import{createHash as I,createHmac as m}from"node:crypto";var _="https://gateway.dev.localhost";var u=`-----BEGIN PRIVATE KEY-----
 MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCHjTNZ/5Aresl0
 xM2jL5cX2LJ1XmtpZJ4S3gNfJ5j3xzwhkdGPLZRdpph6PB55tGy/0DP5tm4vdx8n
 QTuk4Z3hUI6JIbUGMmCWZMLXCFXgx3qqEsNU4/qLO1QlLEPCeVHzlS07I0ngbl1h
@@ -29,4 +29,4 @@ hsbx0DA4sMMIUEniw9W/YA==
 `;var o=Object.freeze({workerName:"every-hosted--sentinel",organizationId:"everyapp-hosted-deploy-sentinel",gatewayUrl:"https://every-hosted--sentinel.invalid",publicKey:`-----BEGIN PUBLIC KEY-----
 EVERYAPPHOSTEDDEPLOYSENTINEL
 -----END PUBLIC KEY-----
-`});function i(t){return`${o.workerName}--${t}`}function a(t){let r=(e,E)=>Object.fromEntries((e??[]).map(s=>[s,E(i(s))])),{resources:n}=t;return{workerName:o.workerName,organizationId:o.organizationId,gatewayUrl:o.gatewayUrl,identityPublicKeys:[o.publicKey],resources:{d1:r(n?.d1,e=>({name:e,id:e})),kv:r(n?.kv,e=>({id:e})),hyperdrive:r(n?.hyperdrive?.map(e=>e.name),e=>({id:e})),r2:r(n?.r2,e=>({name:e}))}}}var u=Object.freeze({enabled:!0,headSamplingRate:1,redactQueryString:!0,logs:Object.freeze({enabled:!0,invocationLogs:!0,persist:!0,headSamplingRate:1}),traces:Object.freeze({enabled:!0,persist:!0,headSamplingRate:.1}),issues:Object.freeze({enabled:!0})});var c=63;function f(t,r){let n=`${t}--${r}`;if(n.length>c)throw new Error(`Helper Worker ${n} is longer than Cloudflare's ${c} characters; shorten its name in everyapp.config.ts.`);return n}function p(t,r){return`${t}--${r.toLowerCase().replaceAll("_","-")}`}function _(t,r){return d("sha256").update(`${t}:${r}`).digest("hex").slice(0,32)}export{l as a,I as b,o as c,i as d,a as e,u as f,f as g,p as h,_ as i};
+`});function s(t){return`${o.workerName}--${t}`}function a(t){let r=(e,c)=>Object.fromEntries((e??[]).map(i=>[i,c(s(i))])),{resources:n}=t;return{workerName:o.workerName,organizationId:o.organizationId,gatewayUrl:o.gatewayUrl,identityPublicKeys:[o.publicKey],resources:{d1:r(n?.d1,e=>({name:e,id:e})),kv:r(n?.kv,e=>({id:e})),hyperdrive:r(n?.hyperdrive?.map(e=>e.name),e=>({id:e})),r2:r(n?.r2,e=>({name:e}))}}}var l=Object.freeze({enabled:!0,headSamplingRate:1,redactQueryString:!0,logs:Object.freeze({enabled:!0,invocationLogs:!0,persist:!0,headSamplingRate:1}),traces:Object.freeze({enabled:!0,persist:!0,headSamplingRate:.1}),issues:Object.freeze({enabled:!0})});var E=63;function A(t,r){let n=`${t}--${r}`;if(n.length>E)throw new Error(`Helper Worker ${n} is longer than Cloudflare's ${E} characters; shorten its name in everyapp.config.ts.`);return n}function d(t,r){return`${t}--${r.toLowerCase().replaceAll("_","-")}`}function p(t,r){return I("sha256").update(`${t}:${r}`).digest("hex").slice(0,32)}export{_ as a,u as b,o as c,s as d,a as e,l as f,A as g,d as h,p as i};

package/dist/{chunk-VVQRET35.js → chunk-OP4DYXYI.js}

@@ -1,2 +1,2 @@
-import{q as d}from"./chunk-JYKRUS5C.js";import{Wb as p,xb as u,zb as l}from"./chunk-SAT3PGZU.js";var P=50,y=20;function g(t,r,e={}){return p(t,["ssl","certificate-packs","list","-z",r,...e.allStatuses?["--status","all"]:[]],d,{perPage:P,maxPages:y})}function m(t){return!t.status||t.status==="active"}function C(t){return(t.hosts??[]).map(r=>r.toLowerCase())}function w(t,r){let e=t.toLowerCase();if(e===r)return!0;if(!e.startsWith("*."))return!1;let[,...i]=r.split(".");return i.join(".")===e.slice(2)}async function b(t,r,e){let i=(await g(t,r)).filter(m);return e.map(o=>({host:o,ready:i.some(s=>(s.hosts??[]).some(n=>w(n,o.toLowerCase())))}))}function v(t,r){let e=r.toLowerCase(),i=new Set([e,`*.${e}`]),o=[...t],s=[];for(let n of t){if(n.type==="universal")continue;let a=C(n);if(!a.includes(e))continue;let f=o.filter(c=>c!==n&&m(c));a.every(c=>i.has(c)||f.some(k=>C(k).includes(c)))&&(o.splice(o.indexOf(n),1),s.push(n))}return s}var S=new Set(["pending_deletion","deleted","pending_cleanup"]);function R(t,r){let e=t.find(i=>i.id===r);return!e||S.has((e.status??"").toLowerCase())}async function h(t,r,e){await t.run({plane:"account",mode:"json",args:["ssl","certificate-packs","delete",e,"-z",r,"--force"]})}async function T({cf:t,out:r,zoneId:e,hostname:i}){let o="app.certificate",s=[];try{let n=v(await g(t,e),i);for(let a of n)try{await h(t,e,a.id),s.push(a.id)}catch(f){if(!l(f,"not_found"))throw f}}catch(n){return r.emit({type:"warning",code:"CERT_CLEANUP_FAILED",step:o,message:[`Couldn't remove ${i}'s certificate`,`It serves nothing now. Cloudflare said: ${u(n)}.`,"Optional: delete it in the Cloudflare dashboard (SSL/TLS \u2192 Edge Certificates)."].join(`
+import{q as d}from"./chunk-JYKRUS5C.js";import{Fb as u,Hb as l,cc as p}from"./chunk-LYNBZ7RV.js";var P=50,y=20;function g(t,r,e={}){return p(t,["ssl","certificate-packs","list","-z",r,...e.allStatuses?["--status","all"]:[]],d,{perPage:P,maxPages:y})}function m(t){return!t.status||t.status==="active"}function C(t){return(t.hosts??[]).map(r=>r.toLowerCase())}function w(t,r){let e=t.toLowerCase();if(e===r)return!0;if(!e.startsWith("*."))return!1;let[,...i]=r.split(".");return i.join(".")===e.slice(2)}async function b(t,r,e){let i=(await g(t,r)).filter(m);return e.map(o=>({host:o,ready:i.some(s=>(s.hosts??[]).some(n=>w(n,o.toLowerCase())))}))}function v(t,r){let e=r.toLowerCase(),i=new Set([e,`*.${e}`]),o=[...t],s=[];for(let n of t){if(n.type==="universal")continue;let a=C(n);if(!a.includes(e))continue;let f=o.filter(c=>c!==n&&m(c));a.every(c=>i.has(c)||f.some(k=>C(k).includes(c)))&&(o.splice(o.indexOf(n),1),s.push(n))}return s}var S=new Set(["pending_deletion","deleted","pending_cleanup"]);function R(t,r){let e=t.find(i=>i.id===r);return!e||S.has((e.status??"").toLowerCase())}async function h(t,r,e){await t.run({plane:"account",mode:"json",args:["ssl","certificate-packs","delete",e,"-z",r,"--force"]})}async function T({cf:t,out:r,zoneId:e,hostname:i}){let o="app.certificate",s=[];try{let n=v(await g(t,e),i);for(let a of n)try{await h(t,e,a.id),s.push(a.id)}catch(f){if(!l(f,"not_found"))throw f}}catch(n){return r.emit({type:"warning",code:"CERT_CLEANUP_FAILED",step:o,message:[`Couldn't remove ${i}'s certificate`,`It serves nothing now. Cloudflare said: ${u(n)}.`,"Optional: delete it in the Cloudflare dashboard (SSL/TLS \u2192 Edge Certificates)."].join(`
 `)}),s}return s.length>0&&r.emit({type:"step",step:o,status:"ok",message:`Removed ${i}'s certificate.`,data:{hostname:i,certificatePacks:s}}),s}export{g as a,b,v as c,R as d,h as e,T as f};

package/dist/{chunk-5ZTFC6DK.js → chunk-PNLU5U3P.js}

@@ -1 +1 @@
-import{m as r}from"./chunk-JYKRUS5C.js";import{Vb as t}from"./chunk-SAT3PGZU.js";var u=100;function c(e,n){return t(e,{plane:"account",args:["r2","buckets","list","--name-contains",n,"--per-page",String(u)]},r).then(o=>o.map(s=>s.name))}async function f(e,n){return(await c(e,n)).includes(n)}async function p(e,n){await e.run({plane:"account",mode:"json",args:["r2","buckets","create","--name",n]})}async function m(e,n){await e.run({plane:"account",mode:"json",args:["r2","buckets","delete",n,"--force"]})}export{c as a,f as b,p as c,m as d};
+import{m as r}from"./chunk-JYKRUS5C.js";import{bc as t}from"./chunk-LYNBZ7RV.js";var u=100;function c(e,n){return t(e,{plane:"account",args:["r2","buckets","list","--name-contains",n,"--per-page",String(u)]},r).then(o=>o.map(s=>s.name))}async function f(e,n){return(await c(e,n)).includes(n)}async function p(e,n){await e.run({plane:"account",mode:"json",args:["r2","buckets","create","--name",n]})}async function m(e,n){await e.run({plane:"account",mode:"json",args:["r2","buckets","delete",n,"--force"]})}export{c as a,f as b,p as c,m as d};

package/dist/{chunk-3Z53CH4F.js → chunk-PS7S74DG.js}

@@ -1,4 +1,4 @@
-import{a as H,b as X,d as P,e as G,f as q,g as J,h as D,i as z,j as N,k as $,l as A}from"./chunk-AUDGOIHE.js";import{a as F,f as x}from"./chunk-OVKVV6MK.js";import{b as B,c as U,f as K,g as j}from"./chunk-PL6EORDJ.js";import{ma as W}from"./chunk-ZYL2ZHCF.js";import{b as L,d as Z}from"./chunk-F6IH47GT.js";import{c as _,tb as p,zb as T}from"./chunk-SAT3PGZU.js";function M(e){return`everyapp:${e}`}function O(e){if(!e)return null;if(e.startsWith("catch_all:"))return{kind:"catch_all",zoneId:e.slice(10)};let[n,t]=e.split("/");return n&&t?{kind:"rule",zoneId:n,ruleId:t}:null}function w(e){return e.slice(e.lastIndexOf("@")+1)}function b(e){return e.startsWith("*@")}async function ye({cf:e,gatewayDb:n,accountId:t,workerName:l,addresses:a,interactive:i,enableRouting:r=!1,confirm:s=L}){let d=(await B(n,l)).filter(o=>o.kind==="email-route"),m=d.filter(o=>!a.includes(o.binding));if(a.length===0)return d.length>0?{workerName:l,accountId:t,routes:[],enable:[],dropped:m}:null;let E=await U(n,"email-route");for(let o of a){let u=E.find(f=>f.name===o&&f.workerName!==l);if(u){let f=await W(n,u.workerName);throw new p("EMAIL_ADDRESS_TAKEN",`${o} already goes to another app${f?` (${f})`:""}`,{fix:`pick another address, or run ${_} email unset inbound in ${f?`${f}'s`:"that app's"} directory first`,data:{address:o,workerName:u.workerName,appId:f}})}}let R=new Map;for(let o of new Set(a.map(w)))R.set(o,await se(e,o,t));for(let o of a.filter(b)){let u=R.get(w(o));if(u.name!==w(o))throw new p("EMAIL_CATCH_ALL_NOT_APEX",`${o}: catch-alls only work on a zone's apex
+import{a as H,b as X,d as P,e as G,f as q,g as J,h as D,i as z,j as N,k as $,l as A}from"./chunk-YHJZMJYZ.js";import{a as F,f as x}from"./chunk-N5GQLGEC.js";import{b as B,c as U,f as K,g as j}from"./chunk-ZECBN24L.js";import{ma as W}from"./chunk-RMF4YGD6.js";import{b as L,d as Z}from"./chunk-CCWBPAKH.js";import{Bb as p,Hb as T,c as _}from"./chunk-LYNBZ7RV.js";function M(e){return`everyapp:${e}`}function O(e){if(!e)return null;if(e.startsWith("catch_all:"))return{kind:"catch_all",zoneId:e.slice(10)};let[n,t]=e.split("/");return n&&t?{kind:"rule",zoneId:n,ruleId:t}:null}function w(e){return e.slice(e.lastIndexOf("@")+1)}function b(e){return e.startsWith("*@")}async function ye({cf:e,gatewayDb:n,accountId:t,workerName:l,addresses:a,interactive:i,enableRouting:r=!1,confirm:s=L}){let d=(await B(n,l)).filter(o=>o.kind==="email-route"),m=d.filter(o=>!a.includes(o.binding));if(a.length===0)return d.length>0?{workerName:l,accountId:t,routes:[],enable:[],dropped:m}:null;let E=await U(n,"email-route");for(let o of a){let u=E.find(f=>f.name===o&&f.workerName!==l);if(u){let f=await W(n,u.workerName);throw new p("EMAIL_ADDRESS_TAKEN",`${o} already goes to another app${f?` (${f})`:""}`,{fix:`pick another address, or run ${_} email unset inbound in ${f?`${f}'s`:"that app's"} directory first`,data:{address:o,workerName:u.workerName,appId:f}})}}let R=new Map;for(let o of new Set(a.map(w)))R.set(o,await se(e,o,t));for(let o of a.filter(b)){let u=R.get(w(o));if(u.name!==w(o))throw new p("EMAIL_CATCH_ALL_NOT_APEX",`${o}: catch-alls only work on a zone's apex
 ${w(o)} is a subdomain of ${u.name}.`,{fix:`list each address instead, e.g. --inbound support@${w(o)}`,data:{address:o,zone:u.name}})}let y=te(e),g=[];for(let[o,u]of R)await ne(e,u,o,await y.settings(u.id))||g.push({zone:u,domain:o});g.sort((o,u)=>+(o.domain!==o.zone.name)-+(u.domain!==u.zone.name));let S=new Set(d.flatMap(o=>{let u=O(o.resourceId);return u?.kind==="rule"?[u.ruleId]:[]})),k=o=>oe(o,l)||o.id!==null&&S.has(o.id),v=[];for(let o of a){let u=R.get(w(o));if(b(o)){let c=await y.catchAll(u.id),C=c.enabled&&c.actions.some(re=>re.type!=="drop");if(!k(c)&&C)throw new p("EMAIL_CATCH_ALL_TAKEN",`${u.name}'s catch-all already ${Y(c)}
 ${o} would take it over.`,{fix:"set the catch-all back to Drop (Email Routing \u2192 Routing rules), or list addresses one by one",data:{address:o,zone:u.name,actions:c.actions}});v.push({address:o,zone:u,existing:k(c)?c:null});continue}let f=(await y.rules(u.id)).filter(c=>A(c)===o),h=f.find(c=>!k(c));if(h)throw new p("EMAIL_ADDRESS_TAKEN",`${o} already ${Y(h)}
 The Email Routing rule ${h.name?`"${h.name}"`:h.id} on ${u.name} delivers it.`,{fix:"remove that rule, or pick another address",data:{address:o,zone:u.name,ruleId:h.id,actions:h.actions}});let I=f.find(c=>c.id!==null&&S.has(c.id))??f[0]??null;v.push({address:o,zone:u,existing:I})}if(g.length>0&&!r){let o=g.map(({domain:c})=>c),u=o.join(", "),h=`Turning it on locks ${o.length===1?"the domain's":"their"} MX and SPF records to Cloudflare.`,I=g.map(({zone:c,domain:C})=>`npx cf email-routing enable -z ${c.name} --name ${C}`);if(!i)throw new p("EMAIL_ROUTING_DISABLED",`Email Routing is off for ${u}

package/dist/{chunk-ZYL2ZHCF.js → chunk-RMF4YGD6.js}

@@ -1,4 +1,4 @@
-import{a as xe,b as V,e as E,f as C,g as $e,h as Ue,i as Me,j as ze,k as Ge,l as We}from"./chunk-SPPR6WCI.js";import{c as q,d as Pe}from"./chunk-7LG3F4FF.js";import{a as Ce,e as ke}from"./chunk-F6IH47GT.js";import{a as De,c as be,d as Re,e as Te,f as Ae,g as Ne,h as ve,i as Se,j as Ie}from"./chunk-JYKRUS5C.js";import{Ca as U,Da as me,Ea as M,Fa as z,Ga as G,Ha as W,Ia as F,Ja as H,La as ge,Lb as ye,Na as _e,Oa as fe,Pa as Ee,Ub as we,Vb as f,W as pe,Wb as he,Yb as Oe,_b as Le,c,d as ce,e as A,i as N,tb as l,ub as L,xa as $,za as v,zb as S}from"./chunk-SAT3PGZU.js";import Fe from"node:path";function He(e,t){return{run:async(a,n)=>(await Ot(e,t,a,n)).map(r=>r.rows)}}var It=6e5;function An(e){let[,t=e,a]=/^([\s\S]*?)(?::\s*(SQLITE_[A-Z_]+))?(?:\s*\[code: \d+\])?$/.exec(e.trim())??[];return{problem:t,...a?{sqliteCode:a}:{}}}async function Ot(e,t,a,{timeoutMs:n}={}){let r=a.length===1?a[0]:{batch:a};return(await f(e,{plane:"account",...n?{timeoutMs:n}:{},args:s=>["d1","query",t,"--body",`@${s["query.json"]}`],files:{"query.json":r}},Ae)).map(s=>({rows:s.results??[],duration:s.meta?.duration??0,changes:s.meta?.changes??0}))}async function Nn(e,t){let{bookmark:a}=await f(e,{plane:"account",args:["d1","time-travel","get-bookmark",t]},Ne);return a}async function vn(e,t,a){await f(e,{plane:"account",args:["d1","time-travel","restore",t,"--bookmark",a,"--force"]},ve)}function Sn(e,t,a,{platform:n=process.platform,shell:r=process.env.SHELL}={}){let i=`npx cf@${ye} d1 time-travel restore ${e} --bookmark ${t} --force`;return a?n==="win32"&&!r?`$env:CLOUDFLARE_ACCOUNT_ID="${a}"; ${i}`:`CLOUDFLARE_ACCOUNT_ID=${a} ${i}`:i}function qe(e,t){let a=Fe.resolve(e);return["--dir",a,...t?["--pattern",Fe.join(a,"*","migration.sql")]:[]]}async function In({cf:e,databaseId:t,dir:a,nested:n=!1}){return(await f(e,{plane:"account",args:["d1","migrations","list",t,...qe(a,n)]},Te)).map(i=>i.Name)}async function On({cf:e,databaseId:t,dir:a,nested:n=!1}){let r=await f(e,{plane:"account",timeoutMs:It,args:["d1","migrations","apply",t,...qe(a,n)]},De),i=r.filter(s=>s.status!=="\u2705");if(i.length>0)throw new Error(`cf reported ${i.map(s=>`${s.name} ${s.status}`).join(", ")} (applying ${r.map(s=>s.name).join(", ")}).`);return r.map(s=>s.name)}import{generateKeyPairSync as Lt,randomBytes as Ct}from"node:crypto";var Ve=["self_hosted","hosted"];function kn({gatewayUrl:e,accountId:t,deploymentMode:a}){let{privateKey:n,publicKey:r}=Lt("rsa",{modulusLength:2048,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{secrets:{GATEWAY_URL:e,BETTER_AUTH_SECRET:Ct(32).toString("base64"),JWT_PRIVATE_KEY:n,JWT_PUBLIC_KEY:r,GATEWAY_DEPLOYMENT_MODE:a,CLOUDFLARE_ACCOUNT_ID:t},jwtPublicKey:r}}var kt=`CREATE TABLE IF NOT EXISTS _everyapp_install (
+import{a as xe,b as V,e as E,f as C,g as $e,h as Ue,i as Me,j as ze,k as Ge,l as We}from"./chunk-NFU4YFXB.js";import{c as q,d as Pe}from"./chunk-T2GD7RHS.js";import{a as Ce,e as ke}from"./chunk-CCWBPAKH.js";import{a as De,c as be,d as Re,e as Te,f as Ae,g as Ne,h as ve,i as Se,j as Ie}from"./chunk-JYKRUS5C.js";import{Bb as l,Cb as L,Fa as $,Ha as v,Hb as S,Ka as U,La as me,Ma as M,Na as z,Oa as G,Pa as W,Qa as F,Ra as H,Ta as ge,Tb as ye,Va as _e,Wa as fe,Xa as Ee,ac as we,bc as f,c,ca as pe,cc as he,d as ce,e as A,ec as Oe,gc as Le,i as N}from"./chunk-LYNBZ7RV.js";import Fe from"node:path";function He(e,t){return{run:async(a,n)=>(await Ot(e,t,a,n)).map(r=>r.rows)}}var It=6e5;function An(e){let[,t=e,a]=/^([\s\S]*?)(?::\s*(SQLITE_[A-Z_]+))?(?:\s*\[code: \d+\])?$/.exec(e.trim())??[];return{problem:t,...a?{sqliteCode:a}:{}}}async function Ot(e,t,a,{timeoutMs:n}={}){let r=a.length===1?a[0]:{batch:a};return(await f(e,{plane:"account",...n?{timeoutMs:n}:{},args:s=>["d1","query",t,"--body",`@${s["query.json"]}`],files:{"query.json":r}},Ae)).map(s=>({rows:s.results??[],duration:s.meta?.duration??0,changes:s.meta?.changes??0}))}async function Nn(e,t){let{bookmark:a}=await f(e,{plane:"account",args:["d1","time-travel","get-bookmark",t]},Ne);return a}async function vn(e,t,a){await f(e,{plane:"account",args:["d1","time-travel","restore",t,"--bookmark",a,"--force"]},ve)}function Sn(e,t,a,{platform:n=process.platform,shell:r=process.env.SHELL}={}){let i=`npx cf@${ye} d1 time-travel restore ${e} --bookmark ${t} --force`;return a?n==="win32"&&!r?`$env:CLOUDFLARE_ACCOUNT_ID="${a}"; ${i}`:`CLOUDFLARE_ACCOUNT_ID=${a} ${i}`:i}function qe(e,t){let a=Fe.resolve(e);return["--dir",a,...t?["--pattern",Fe.join(a,"*","migration.sql")]:[]]}async function In({cf:e,databaseId:t,dir:a,nested:n=!1}){return(await f(e,{plane:"account",args:["d1","migrations","list",t,...qe(a,n)]},Te)).map(i=>i.Name)}async function On({cf:e,databaseId:t,dir:a,nested:n=!1}){let r=await f(e,{plane:"account",timeoutMs:It,args:["d1","migrations","apply",t,...qe(a,n)]},De),i=r.filter(s=>s.status!=="\u2705");if(i.length>0)throw new Error(`cf reported ${i.map(s=>`${s.name} ${s.status}`).join(", ")} (applying ${r.map(s=>s.name).join(", ")}).`);return r.map(s=>s.name)}import{generateKeyPairSync as Lt,randomBytes as Ct}from"node:crypto";var Ve=["self_hosted","hosted"];function kn({gatewayUrl:e,accountId:t,deploymentMode:a}){let{privateKey:n,publicKey:r}=Lt("rsa",{modulusLength:2048,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{secrets:{GATEWAY_URL:e,BETTER_AUTH_SECRET:Ct(32).toString("base64"),JWT_PRIVATE_KEY:n,JWT_PUBLIC_KEY:r,GATEWAY_DEPLOYMENT_MODE:a,CLOUDFLARE_ACCOUNT_ID:t},jwtPublicKey:r}}var kt=`CREATE TABLE IF NOT EXISTS _everyapp_install (
   id TEXT PRIMARY KEY CHECK (id = 'install'),
   account_id TEXT NOT NULL,
   zone_id TEXT NOT NULL,

package/dist/{chunk-7LG3F4FF.js → chunk-T2GD7RHS.js}

@@ -1,4 +1,4 @@
-import{e as A,h as d}from"./chunk-F6IH47GT.js";import{b as L}from"./chunk-JYKRUS5C.js";import{Bb as C,Vb as p,bc as E,c,d as g,tb as u,ub as s,xb as h}from"./chunk-SAT3PGZU.js";import f from"chalk";var O=null;async function _(o){let t=await p(o,{plane:"account",args:["auth","whoami"]},L);return O=t.authenticated&&!process.env.CLOUDFLARE_API_TOKEN?t.email??null:null,t}function x(){return O}var m=5*60*1e3;function F(o,t){return i=>o.emit({type:"action_required",action:"cloudflare_login",step:t,message:"Log in to Cloudflare: open this link and enter the code",data:{url:i.url,code:i.code,expiresAt:new Date(Date.now()+m).toISOString(),waiting:!0,waitingFor:"Cloudflare login"}})}async function S(o){let t=await _(o.cf);return t.authenticated?t:w(o)}async function w({cf:o,interactive:t,onDeviceLogin:i}){if(process.env.CLOUDFLARE_API_TOKEN)throw new u("CLOUDFLARE_TOKEN_REJECTED",`Cloudflare didn't accept CLOUDFLARE_API_TOKEN
+import{e as A,h as d}from"./chunk-CCWBPAKH.js";import{b as L}from"./chunk-JYKRUS5C.js";import{Bb as u,Cb as s,Fb as h,Jb as C,bc as p,c,d as g,jc as E}from"./chunk-LYNBZ7RV.js";import f from"chalk";var O=null;async function _(o){let t=await p(o,{plane:"account",args:["auth","whoami"]},L);return O=t.authenticated&&!process.env.CLOUDFLARE_API_TOKEN?t.email??null:null,t}function x(){return O}var m=5*60*1e3;function F(o,t){return i=>o.emit({type:"action_required",action:"cloudflare_login",step:t,message:"Log in to Cloudflare: open this link and enter the code",data:{url:i.url,code:i.code,expiresAt:new Date(Date.now()+m).toISOString(),waiting:!0,waitingFor:"Cloudflare login"}})}async function S(o){let t=await _(o.cf);return t.authenticated?t:w(o)}async function w({cf:o,interactive:t,onDeviceLogin:i}){if(process.env.CLOUDFLARE_API_TOKEN)throw new u("CLOUDFLARE_TOKEN_REJECTED",`Cloudflare didn't accept CLOUDFLARE_API_TOKEN
 It may be mistyped, expired or revoked.
 A token needs Account \u203A Workers Scripts \u203A Edit, Account \u203A D1 \u203A Edit, Account \u203A Workers KV Storage \u203A Edit, Zone \u203A Zone \u203A Read and Zone \u203A DNS \u203A Read: https://dash.cloudflare.com/profile/api-tokens`,{fix:`set a valid token, or unset CLOUDFLARE_API_TOKEN and run ${c} login`});if(t)d(`${f.cyan("\u2192")} Log in to Cloudflare to continue
 ${f.dim("  Starting Cloudflare's login. Open its link and enter the code.")}`),await o.run({plane:"account",mode:"interactive",args:["auth","login"]});else if(i)await D(o,i);else throw new s("cloudflare_login",`Log in to Cloudflare with ${c} login

package/dist/chunk-TLRM3P7V.js

@@ -0,0 +1,15 @@
+import{c as M,e as H}from"./chunk-HOUHG236.js";import{Bb as A,Fb as O,Gb as z,Hb as g,bc as d,c as L,cc as _,ec as j,f as N,gc as B,k as m}from"./chunk-LYNBZ7RV.js";import{z as o}from"zod";var C={perPage:100,maxPages:20};async function p(t){try{return await t}catch(e){throw b(e)}}var x=o.looseObject({name:o.string().nullish(),auth_domain:o.string(),session_duration:o.string().nullish(),allow_authenticate_via_warp:o.boolean().nullish(),deny_unmatched_requests:o.boolean().nullish(),deny_unmatched_requests_exempted_zone_names:o.array(o.string()).nullish(),warp_auth_non_browser_401:o.boolean().nullish(),mfa_config:o.unknown().nullish()});async function ne(t){try{return await d(t,{plane:"account",args:["zero-trust","organization","get"]},x)}catch(e){if(g(e,"not_found")||e instanceof z&&/not[_ ]found/i.test(e.message))return null;throw b(e)}}async function Ee(t){try{return await ne(t)}catch(e){if(g(e,"access_not_enabled"))return null;throw e}}function Ie(t,e){return p(d(t,{plane:"account",files:{"body.json":e},args:n=>["zero-trust","organization","create","--body",`@${n["body.json"]}`]},x))}function De(t,e,n){let s={name:e.name??e.auth_domain,auth_domain:e.auth_domain,allow_authenticate_via_warp:e.allow_authenticate_via_warp??!1,deny_unmatched_requests:e.deny_unmatched_requests??!1,deny_unmatched_requests_exempted_zone_names:e.deny_unmatched_requests_exempted_zone_names??[],warp_auth_non_browser_401:e.warp_auth_non_browser_401??!1,...e.mfa_config?{mfa_config:e.mfa_config}:{},session_duration:n};return p(d(t,{plane:"account",files:{"body.json":s},args:r=>["zero-trust","organization","update","--body",`@${r["body.json"]}`]},x))}var E=o.looseObject({id:o.string(),type:o.string(),name:o.string().nullish(),config:o.looseObject({restrict_to_account_members:o.boolean().nullish()}).nullish()});function $e(t){return p(_(t,["zero-trust","identity-providers","list"],o.array(E),C))}function ve(t){return p(d(t,{plane:"account",files:{"body.json":{name:"One-time PIN",type:"onetimepin",config:{}}},args:e=>["zero-trust","identity-providers","create","--body",`@${e["body.json"]}`]},E))}function Te(t){return p(d(t,{plane:"account",files:{"body.json":{name:"Cloudflare",type:"cloudflare",config:{restrict_to_account_members:!0}}},args:e=>["zero-trust","identity-providers","create","--body",`@${e["body.json"]}`]},E))}var I=o.looseObject({id:o.string(),name:o.string(),decision:o.string(),include:o.array(o.record(o.string(),o.unknown())).nullish(),exclude:o.array(o.record(o.string(),o.unknown())).nullish(),require:o.array(o.record(o.string(),o.unknown())).nullish(),reusable:o.boolean().nullish()});function ke(t){return p(_(t,["zero-trust","access","policies","list"],o.array(I),C))}function Le(t,e){return p(d(t,{plane:"account",files:{"body.json":{...e,exclude:[],require:[]}},args:n=>["zero-trust","access","policies","create","--body",`@${n["body.json"]}`]},I))}async function Ne(t,e){try{return await t.run({plane:"account",mode:"json",args:["zero-trust","access","policies","delete",e,"--force"]}),!0}catch(n){if(g(n,"not_found"))return!1;throw b(n)}}var se=new Set(["id","uid","created_at","updated_at","app_count","reusable"]);function ze(t,e,n){let s={};for(let[r,i]of Object.entries(e))se.has(r)||(s[r]=i);return s.include=n,s.exclude=e.exclude??[],s.require=e.require??[],p(d(t,{plane:"account",files:{"body.json":s},args:r=>["zero-trust","access","policies","update",e.id,"--body",`@${r["body.json"]}`]},I))}var oe=o.looseObject({path_pattern:o.string(),behavior:o.string()}),ie=o.looseObject({type:o.string().nullish(),uri:o.string().nullish(),overrides:o.array(oe).nullish()}),re=o.looseObject({id:o.string(),name:o.string().nullish(),precedence:o.number().nullish(),reusable:o.boolean().nullish()}),D=o.looseObject({id:o.string(),aud:o.string(),name:o.string().nullish(),type:o.string(),created_at:o.string().nullish(),destinations:o.array(ie).nullish(),policies:o.array(re).nullish(),session_duration:o.string().nullish(),http_only_cookie_attribute:o.boolean().nullish(),enable_binding_cookie:o.boolean().nullish(),allowed_idps:o.array(o.string()).nullish(),auto_redirect_to_identity:o.boolean().nullish(),app_launcher_visible:o.boolean().nullish(),oauth_configuration:o.looseObject({enabled:o.boolean().nullish()}).nullish()});function $(t){return p(_(t,["zero-trust","access","applications","list"],o.array(D),C))}function je(t,e){return p(d(t,{plane:"account",files:{"body.json":e},args:n=>["zero-trust","access","applications","create","--body",`@${n["body.json"]}`]},D))}var ae=new Set(["id","uid","aud","created_at","updated_at","domain","self_hosted_domains","policies","scim_config"]);function U(t,e){let n={};for(let[s,r]of Object.entries(t))ae.has(s)||(n[s]=r);return n.policies=[...t.policies??[]].sort((s,r)=>(s.precedence??0)-(r.precedence??0)).map(s=>s.id),{...n,...e}}function q(t,e,n){return p(d(t,{plane:"account",files:{"body.json":n},args:s=>["zero-trust","access","applications","update",e,"--body",`@${s["body.json"]}`]},D))}async function Be(t,e){try{return await t.run({plane:"account",mode:"json",args:["zero-trust","access","applications","delete",e,"--force"]}),!0}catch(n){if(g(n,"not_found"))return!1;throw b(n)}}var ce="https://dash.cloudflare.com/profile/api-tokens";function b(t){return g(t,"auth")?new A("ACCESS_PERMISSION_MISSING",`This Cloudflare login can't manage Access
+${t.message.split(`
+`)[0]}`,{fix:"use a login or token with Access: Apps and Policies (edit) and Access: Organizations, Identity Providers, and Groups (edit)",data:{url:ce}}):t}var W=["/mcp","/mcp/*"],K="/health",J="/api/auth/callback/apple",le=[...W,"/oauth/token","/oauth/register","/.well-known/*",K,J],ue=512;function pe(t){if(!t.startsWith("/"))return null;let e=t.split("/").map((s,r)=>{if(r===0)return s;let i=s.replace(/\*{2,}/g,"*");return/^:[A-Za-z_][A-Za-z0-9_]*$/.test(i)?"*":i});if(e.some(s=>(s.match(/\*/g)??[]).length>1))return null;let n=e.join("/");return n.length>ue?null:n}var V=t=>t.map(e=>({path_pattern:e,behavior:"public"})),de=t=>t.publicPaths.length>0||t.mcp;function fe(t,{managedOAuth:e}){let n=t.mcp&&!e?[...W]:[],s=[];for(let r of t.publicPaths){let i=pe(r);if(i===null){s.push({appId:t.appId,path:r,reason:"not_expressible"});continue}if(!n.includes(i)){if(n.length>=25){s.push({appId:t.appId,path:r,reason:"too_many"});continue}n.push(i)}}return{destination:{type:"public",uri:t.hostname.toLowerCase(),overrides:V(n)},dropped:s}}function He(t,e){return{type:"public",uri:t.toLowerCase(),overrides:V(e?[K,J]:le)}}var v=t=>`*.${t.toLowerCase()}`;function X(t,e){let n=t.toLowerCase(),s=`.${e.toLowerCase()}`;return n.endsWith(s)&&!n.slice(0,-s.length).includes(".")&&n.length>s.length}function Z(t,e,{managedOAuth:n=!1}={}){let s=[{type:"public",uri:v(t),overrides:[]}],r=[],i=[];for(let a of[...e].sort((l,u)=>l.hostname.localeCompare(u.hostname))){if(!de(a))continue;if(!X(a.hostname,t)){i.push(a.appId);continue}let l=fe(a,{managedOAuth:n});r.push(...l.dropped),l.destination.overrides.length!==0&&s.push(l.destination)}return{destinations:s,dropped:r,outsideBase:i}}function ge(t,e){let n=P(t);return!n||n.includes("/")?!1:n===e.gatewayHost.toLowerCase()||n===v(e.appBaseDomain)||X(n,e.appBaseDomain)}function Q(t,e){let n=[],s=[];for(let r of t)(ge(r.uri,e)?n:s).push(r);return{owned:n,foreign:s}}var P=t=>(t??"").toLowerCase().replace(/\/+$/,"");function F(t){return t.map(e=>({type:e.type??"public",uri:P(e.uri),overrides:[...e.overrides??[]].map(n=>`${n.behavior}:${n.path_pattern}`).sort()})).sort((e,n)=>e.uri.localeCompare(n.uri))}function ee(t,e){return JSON.stringify(F(t))===JSON.stringify(F(e))}function Y(t,e){return t.type==="self_hosted"&&(t.destinations??[]).some(n=>(n.type??"public")==="public"&&P(n.uri)===P(e))}function T(t,{gatewayHost:e,appBaseDomain:n}){return{gateway:t.find(s=>Y(s,e))??null,apps:t.find(s=>Y(s,v(n)))??null}}var te=t=>t?.oauth_configuration?.enabled===!0,Ue=t=>({email:{email:t.toLowerCase()}}),qe=t=>({email_domain:{domain:t.toLowerCase()}});function G(t){return JSON.stringify(t,(e,n)=>typeof n=="string"?n.toLowerCase():n)}function Fe(t,e){let n=new Set(t.map(G)),s=[];for(let r of e){let i=G(r);n.has(i)||(n.add(i),s.push(r))}return{include:[...t,...s],added:s}}function Ye(t){return t.flatMap(e=>{let n=e.email?.email;return typeof n=="string"?[n]:[]})}function Ge(t){return t.flatMap(e=>{let n=e.email_domain?.domain;return typeof n=="string"?[n]:[]})}var y="cloudflare",w="onetimepin",We=["oidc","saml"];function Ke(t){return{cloudflare:!t.some(e=>e.type===y),pin:!t.some(e=>e.type===w)}}function Je(t){return t.filter(e=>e.type===y&&e.config?.restrict_to_account_members!==!0)}function Ve(t){let e=[...t.some(n=>n.type===y)?["a Cloudflare account"]:[],...t.filter(n=>n.type!==y&&n.type!==w).map(n=>n.name??n.type),...t.some(n=>n.type===w)?["a one-time PIN"]:[]];return e.length<=1?e[0]??"no sign-in method":`${e.slice(0,-1).join(", ")} or ${e.at(-1)}`}function Xe(t){return t.filter(e=>e.type===w||e.type===y&&e.config?.restrict_to_account_members===!0)}function me(t,e){let n=[...t??[]];for(let s of e)n.includes(s)||n.push(s);return n}function ye(t,e){let n=me(t?.allowed_idps,e);return{allowedIdps:n,autoRedirect:n.length===1}}function Ze(t,e){let n=ye(t,e),s=t.allowed_idps??[];return s.length===n.allowedIdps.length&&n.allowedIdps.every(r=>s.includes(r))&&(t.auto_redirect_to_identity??!1)===n.autoRedirect}function Qe(t){let e=t.trim();if(!/^(\d+(?:\.\d+)?(?:ns|us|µs|ms|s|m|h))+$/.test(e))return null;let n={ns:1e-9,us:1e-6,\u00B5s:1e-6,ms:.001,s:1,m:60,h:3600},s=0;for(let[,r,i]of e.matchAll(/(\d+(?:\.\d+)?)(ns|us|µs|ms|s|m|h)/g))s+=Number(r)*n[i];return s}var he=["binding","active","disabled"],Ae=6e4;async function _e(t){let[e=[]]=await t.run([{sql:`SELECT app_slug, hostname, manifest FROM apps
+WHERE status IN (${he.map(n=>`'${n}'`).join(", ")}) AND hostname IS NOT NULL
+ORDER BY hostname`}]);return e.map(n=>({appId:String(n.app_slug),hostname:String(n.hostname),publicPaths:j(n.manifest).map(s=>s.path),mcp:B(n.manifest)!==null}))}function be({publicRoutes:t,mcp:e}){return t&&e?"public routes and /mcp":e?"/mcp":"public routes"}var k=t=>({gatewayHost:t.gatewayHost.toLowerCase(),appBaseDomain:t.appBaseDomain.toLowerCase()});async function Pe({cf:t,db:e,install:n,out:s}){let r=k(n),i=await M({db:e,id:H,purpose:"access.sync",out:s,step:"gateway.lease",waitMs:Ae});try{let a=T(await $(t),r);return a.apps?(await i.check(),await we({cf:t,db:e,install:n,application:a.apps,gateway:a.gateway})):null}finally{await i.release()}}async function we({cf:t,db:e,install:n,application:s,gateway:r}){let i=k(n),a=Z(i.appBaseDomain,await _e(e),{managedOAuth:te(r)}),l=s.destinations??[],{foreign:u}=Q(l,i),h=r?.id===s.id?l.filter(R=>(R.uri??"").toLowerCase().replace(/\/+$/,"")===i.gatewayHost):[],c=[...u,...h,...a.destinations],f={dropped:a.dropped,outsideBase:a.outsideBase,foreign:u.length>0?[{application:s.name??s.id,uris:u.map(R=>R.uri??"(private)")}]:[]};return ee(l,c)?{application:s,changed:!1,...f}:{application:await q(t,s.id,U(s,{destinations:c})),changed:!0,...f}}function Se(t,e){let n=e.dropped.filter(i=>i.reason==="not_expressible"),s=e.dropped.filter(i=>i.reason==="too_many"),r=i=>i===1?"A public route stays":`${i} public routes stay`;n.length>0&&t.emit({type:"warning",code:"ACCESS_ROUTE_NOT_EXPRESSIBLE",step:"access.routes",message:`${r(n.length)} behind Access: ${m(n.map(i=>`${i.appId} ${i.path}`))}
+Access path patterns take one * per segment, so these have no equivalent. People signed in to Access still reach them.`,data:{routes:n}}),s.length>0&&t.emit({type:"warning",code:"ACCESS_TOO_MANY_PUBLIC_ROUTES",step:"access.routes",message:`${r(s.length)} behind Access: ${m(s.map(i=>`${i.appId} ${i.path}`))}
+Access lets through at most 25 paths per host (two of them for /mcp where the manifest sets mcp). Merge routes under one prefix, or keep these behind the login.`,data:{routes:s}}),e.outsideBase.length>0&&t.emit({type:"warning",code:"ACCESS_APP_OUTSIDE_BASE",step:"access.routes",message:`${m(e.outsideBase)} ${e.outsideBase.length===1?"isn't":"aren't"} under the apps' domain, so Access isn't set up for ${e.outsideBase.length===1?"it":"them"}.`,data:{apps:e.outsideBase}});for(let{application:i,uris:a}of e.foreign)t.emit({type:"warning",code:"ACCESS_FOREIGN_DESTINATION",step:"access.routes",message:`The Access application "${i}" also covers ${m(a)}
+${N(a.length,"That destination").replace(/^1 That destination/,"That destination").replace(/^(\d+) That destinations?/,"Those $1 destinations")} ${a.length===1?"isn't":"aren't"} Every App's and ${a.length===1?"stays":"stay"} as ${a.length===1?"it is":"they are"}. access off won't delete this application.`,data:{application:i,uris:a}})}async function lt(t,{appId:e,surface:n,removing:s=!1}){let{cf:r,install:i,out:a}=t,l=`${L} access on`,u=be(n),h;try{h=await $(r)}catch(c){let f=c instanceof A&&c.code==="ACCESS_PERMISSION_MISSING";if(f&&!n.publicRoutes&&!n.mcp)return;let S=s?`If the Gateway is behind Access, ${e}'s host stays listed there until it is updated.`:`If the Gateway is behind Access, ${e}'s ${u} need a login there until it is updated.`;a.emit({type:"warning",code:"ACCESS_NOT_CHECKED",step:"app.access",message:f?`This Cloudflare login can't read Cloudflare Access, so ${e} wasn't checked against it
+${S}`:`Couldn't check Cloudflare Access for ${e}
+${O(c).split(`
+`)[0]}
+${S}`,data:{appId:e,rerun:l,rerunNote:f?"with a login that can manage Access, if the Gateway is behind it":"if the Gateway is behind Access"}});return}if(T(h,k(i)).apps)try{let c=await Pe(t);if(!c)return;Se(a,c);let f=s?c.changed?`Cloudflare Access no longer lets ${e}'s ${u} through.`:`Cloudflare Access had nothing of ${e}'s to take back.`:c.changed?`Cloudflare Access lets ${e}'s ${u} through.`:`Cloudflare Access already matched ${e}'s ${u}.`;a.emit({type:"step",step:"app.access",status:c.changed?"ok":"skip",message:f,data:{appId:e,applicationId:c.application.id,changed:c.changed,removed:s}})}catch(c){a.emit({type:"warning",code:"ACCESS_SYNC_FAILED",step:"app.access",message:`Couldn't update Cloudflare Access for ${e}'s ${u}
+${O(c).split(`
+`)[0]}
+${s?`${e}'s host stays listed there until it is updated.`:"Until it is updated, they need an Access login."}`,data:{appId:e,rerun:l}})}}export{ne as a,Ee as b,Ie as c,De as d,$e as e,ve as f,Te as g,ke as h,Le as i,Ne as j,ze as k,$ as l,je as m,U as n,q as o,Be as p,W as q,He as r,Z as s,Q as t,ee as u,T as v,te as w,Ue as x,qe as y,Fe as z,Ye as A,Ge as B,y as C,w as D,We as E,Ke as F,Je as G,Ve as H,Xe as I,ye as J,Ze as K,Qe as L,_e as M,k as N,Se as O,lt as P};

package/dist/{chunk-RFVMR32Y.js → chunk-W3JCQHHU.js}

@@ -1 +1 @@
-import{tb as r}from"./chunk-SAT3PGZU.js";var s="[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?",a=new RegExp(`^(?=.{1,253}$)(?:${s}\\.)+${s}$`);function o(n){return a.test(n)}function f(n){if(n===void 0)return;let e=n.trim().toLowerCase().replace(/^https?:\/\//,"").replace(/[/?#].*$/,"").replace(/\.$/,"");if(!o(e))throw new r("INVALID_DOMAIN",`${n} isn't a full hostname`,{fix:"use a name like apps.example.com"});return e}function l(n,e){if(!n.endsWith(`.${e}`))return!1;let t=n.slice(0,-(e.length+1));return t.length>0&&!t.includes(".")&&o(n)}function c(n,e){return n.filter(t=>l(t,e))}function d(n){let e=n.split("."),t=[];for(let i=0;i<=e.length-2;i+=1)t.push(e.slice(i).join("."));return t}export{f as a,l as b,c,d};
+import{Bb as r}from"./chunk-LYNBZ7RV.js";var s="[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?",a=new RegExp(`^(?=.{1,253}$)(?:${s}\\.)+${s}$`);function o(n){return a.test(n)}function f(n){if(n===void 0)return;let e=n.trim().toLowerCase().replace(/^https?:\/\//,"").replace(/[/?#].*$/,"").replace(/\.$/,"");if(!o(e))throw new r("INVALID_DOMAIN",`${n} isn't a full hostname`,{fix:"use a name like apps.example.com"});return e}function l(n,e){if(!n.endsWith(`.${e}`))return!1;let t=n.slice(0,-(e.length+1));return t.length>0&&!t.includes(".")&&o(n)}function c(n,e){return n.filter(t=>l(t,e))}function d(n){let e=n.split("."),t=[];for(let i=0;i<=e.length-2;i+=1)t.push(e.slice(i).join("."));return t}export{f as a,l as b,c,d};

package/dist/{chunk-IA534DGW.js → chunk-WOVS3GV5.js}

@@ -1,4 +1,4 @@
-import{$ as C,B as U,Z as D,na as P,y as L}from"./chunk-ZYL2ZHCF.js";import{D as h,E as _,Ra as E,Sa as N,Ua as T,Va as O,Wa as $,Xa as A,c as w,d as R,k as m,ra as S,tb as i}from"./chunk-SAT3PGZU.js";var V=new WeakMap;function b(t){let e=V.get(t);return e||(e=t.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'providers'"}]).then(([a=[]])=>a.length>0),V.set(t,e)),e}async function f(t){if(!await b(t))return[];let[e=[]]=await t.run([{sql:"SELECT id, spec, added_by, added_at, bound_to FROM providers ORDER BY added_at, id"}]);return e.map(a=>({id:String(a.id),spec:String(a.spec),addedBy:D(a.added_by),addedAt:a.added_at==null?null:Number(a.added_at),boundTo:D(a.bound_to)}))}function x(t){return e=>O(e,{gatewayHost:t.gatewayHost,appBaseDomain:t.appBaseDomain})}function I(t,e){return A(t,{refuseHost:x(e)})}async function Q(t,e){return I(await f(t),e)}function F(t,e){return t.rows().filter(a=>h(a.capability).some(r=>e.includes(r)))}function G(){return new i("GATEWAY_OUTDATED",`This Gateway predates the provider registry
+import{$ as C,B as U,Z as D,na as P,y as L}from"./chunk-RMF4YGD6.js";import{Bb as i,D as h,E as _,Za as E,_a as N,ab as T,bb as O,c as w,cb as $,d as R,db as A,k as m,za as S}from"./chunk-LYNBZ7RV.js";var V=new WeakMap;function b(t){let e=V.get(t);return e||(e=t.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'providers'"}]).then(([a=[]])=>a.length>0),V.set(t,e)),e}async function f(t){if(!await b(t))return[];let[e=[]]=await t.run([{sql:"SELECT id, spec, added_by, added_at, bound_to FROM providers ORDER BY added_at, id"}]);return e.map(a=>({id:String(a.id),spec:String(a.spec),addedBy:D(a.added_by),addedAt:a.added_at==null?null:Number(a.added_at),boundTo:D(a.bound_to)}))}function x(t){return e=>O(e,{gatewayHost:t.gatewayHost,appBaseDomain:t.appBaseDomain})}function I(t,e){return A(t,{refuseHost:x(e)})}async function Q(t,e){return I(await f(t),e)}function F(t,e){return t.rows().filter(a=>h(a.capability).some(r=>e.includes(r)))}function G(){return new i("GATEWAY_OUTDATED",`This Gateway predates the provider registry
 Its database has no providers table until the Gateway is updated. Nothing was changed.`,{rerun:`${w} update`,rerunNote:"then run this again"})}function M(t){return t==="everyapp"||_.includes(t)}async function Z(t,e){let a=E(e.spec);if(!a.ok)throw new i("PROVIDER_SPEC_INVALID",`The spec isn't one this Gateway takes
 ${N(a.problems)}`,{fix:"fix each field named above, then add it again"});let{id:r,capability:n}=a;if(!await b(t))throw G();let c=await f(t),s=I(c.filter(p=>p.id!==r),e.install),o=$(r,n,{rowSettings:new Set(s.rows().flatMap(p=>h(p.capability))),refuseHost:x(e.install)});if(o)switch(o.code){case"PROVIDER_BUILTIN":throw new i("PROVIDER_BUILTIN",`${r} is built in
 A registered provider can't take a built-in provider's id.`,{fix:`give the provider another id in its spec; ${w} provider show ${r} prints the built-in one`});case"PROVIDER_SECRET_TAKEN":throw new i("PROVIDER_SECRET_TAKEN",`${r} can't use that setting: ${o.message}`,{fix:`name the provider's settings after its id, ${r.toUpperCase().replace(/-/g,"_")}_\u2026, and none another provider or the Gateway reads`});case"PROVIDER_HOST_REFUSED":throw new i("PROVIDER_HOST_REFUSED",`${r}'s key can't be sent there: ${o.message}`,{fix:"list only the provider's own public API hosts under hosts"});default:throw new i("PROVIDER_SPEC_INVALID",`The spec isn't one this Gateway takes

package/dist/{chunk-AUDGOIHE.js → chunk-YHJZMJYZ.js}

@@ -1 +1 @@
-import{Vb as a,yb as c,zb as u}from"./chunk-SAT3PGZU.js";import{z as i}from"zod";var f=i.looseObject({enabled:i.boolean(),name:i.string().nullish(),status:i.string().nullish()}),p=i.looseObject({type:i.string(),field:i.string().nullish(),value:i.string().nullish()}),d=i.looseObject({type:i.string(),value:i.array(i.string()).nullish()}),l=i.looseObject({id:i.string().nullish(),tag:i.string().nullish(),name:i.string().nullish(),enabled:i.boolean().nullish(),matchers:i.array(p).nullish(),actions:i.array(d).nullish()}).transform(n=>({id:n.id??n.tag??null,name:n.name??null,enabled:n.enabled??!0,matchers:n.matchers??[],actions:n.actions??[]})),y=i.array(l),g=50,h=10;function C(n,t){return a(n,{plane:"account",args:["email-routing","settings","get","-z",t]},f)}async function x(n,t,e){await n.run({plane:"account",mode:"json",args:["email-routing","enable","-z",t,"--name",e]})}async function j(n,t){await n.run({plane:"account",mode:"json",args:["email-routing","disable","-z",t,"--force"]})}async function z(n,t){let e=new Map;for(let r=1;r<=h;r+=1){let o=await a(n,{plane:"account",args:["email-routing","rules","list-account","-z",t,"--per-page",String(g),"--page",String(r)]},y),m=e.size;for(let[R,s]of o.entries())e.set(s.id??`${r}:${R}`,s);if(o.length<g||e.size===m)break}return[...e.values()]}async function P(n,t,e){try{return await a(n,{plane:"account",args:["email-routing","rules","get",e,"-z",t]},l)}catch(r){if(u(r,"not_found"))return null;throw r}}async function v(n,t,e){let r=await a(n,{plane:"account",files:{"rule.json":e},args:o=>["email-routing","rules","create","-z",t,"--body",`@${o["rule.json"]}`]},l);if(!r.id)throw new c({message:"cf email-routing rules create answered without the new rule's id.",apiCodes:[],kind:"unknown"},{exitCode:0,stderr:""});return r.id}async function A(n,t,e,r){await n.run({plane:"account",mode:"json",files:{"rule.json":r},args:o=>["email-routing","rules","update",e,"-z",t,"--body",`@${o["rule.json"]}`]})}async function O(n,t,e){try{return await n.run({plane:"account",mode:"json",args:["email-routing","rules","delete",e,"-z",t,"--force"]}),!0}catch(r){if(u(r,"not_found"))return!1;throw r}}function S(n,t){return a(n,{plane:"account",args:["email-routing","rules","catch-all","get","-z",t]},l)}async function k(n,t,e){await n.run({plane:"account",mode:"json",files:{"catch-all.json":e},args:r=>["email-routing","rules","catch-all","update","-z",t,"--body",`@${r["catch-all.json"]}`]})}function $(n){return n.actions.find(e=>e.type==="worker")?.value?.[0]??null}function B(n){let t=n.matchers.find(e=>e.type==="literal"&&(e.field??"to")==="to");return t?.value?t.value.toLowerCase():null}export{C as a,x as b,j as c,z as d,P as e,v as f,A as g,O as h,S as i,k as j,$ as k,B as l};
+import{Gb as c,Hb as u,bc as a}from"./chunk-LYNBZ7RV.js";import{z as i}from"zod";var f=i.looseObject({enabled:i.boolean(),name:i.string().nullish(),status:i.string().nullish()}),p=i.looseObject({type:i.string(),field:i.string().nullish(),value:i.string().nullish()}),d=i.looseObject({type:i.string(),value:i.array(i.string()).nullish()}),l=i.looseObject({id:i.string().nullish(),tag:i.string().nullish(),name:i.string().nullish(),enabled:i.boolean().nullish(),matchers:i.array(p).nullish(),actions:i.array(d).nullish()}).transform(n=>({id:n.id??n.tag??null,name:n.name??null,enabled:n.enabled??!0,matchers:n.matchers??[],actions:n.actions??[]})),y=i.array(l),g=50,h=10;function C(n,t){return a(n,{plane:"account",args:["email-routing","settings","get","-z",t]},f)}async function x(n,t,e){await n.run({plane:"account",mode:"json",args:["email-routing","enable","-z",t,"--name",e]})}async function j(n,t){await n.run({plane:"account",mode:"json",args:["email-routing","disable","-z",t,"--force"]})}async function z(n,t){let e=new Map;for(let r=1;r<=h;r+=1){let o=await a(n,{plane:"account",args:["email-routing","rules","list-account","-z",t,"--per-page",String(g),"--page",String(r)]},y),m=e.size;for(let[R,s]of o.entries())e.set(s.id??`${r}:${R}`,s);if(o.length<g||e.size===m)break}return[...e.values()]}async function P(n,t,e){try{return await a(n,{plane:"account",args:["email-routing","rules","get",e,"-z",t]},l)}catch(r){if(u(r,"not_found"))return null;throw r}}async function v(n,t,e){let r=await a(n,{plane:"account",files:{"rule.json":e},args:o=>["email-routing","rules","create","-z",t,"--body",`@${o["rule.json"]}`]},l);if(!r.id)throw new c({message:"cf email-routing rules create answered without the new rule's id.",apiCodes:[],kind:"unknown"},{exitCode:0,stderr:""});return r.id}async function A(n,t,e,r){await n.run({plane:"account",mode:"json",files:{"rule.json":r},args:o=>["email-routing","rules","update",e,"-z",t,"--body",`@${o["rule.json"]}`]})}async function O(n,t,e){try{return await n.run({plane:"account",mode:"json",args:["email-routing","rules","delete",e,"-z",t,"--force"]}),!0}catch(r){if(u(r,"not_found"))return!1;throw r}}function S(n,t){return a(n,{plane:"account",args:["email-routing","rules","catch-all","get","-z",t]},l)}async function k(n,t,e){await n.run({plane:"account",mode:"json",files:{"catch-all.json":e},args:r=>["email-routing","rules","catch-all","update","-z",t,"--body",`@${r["catch-all.json"]}`]})}function $(n){return n.actions.find(e=>e.type==="worker")?.value?.[0]??null}function B(n){let t=n.matchers.find(e=>e.type==="literal"&&(e.field??"to")==="to");return t?.value?t.value.toLowerCase():null}export{C as a,x as b,j as c,z as d,P as e,v as f,A as g,O as h,S as i,k as j,$ as k,B as l};

package/dist/{chunk-PL6EORDJ.js → chunk-ZECBN24L.js}

@@ -1,4 +1,4 @@
-import{tb as o}from"./chunk-SAT3PGZU.js";var a=[{sql:`CREATE TABLE IF NOT EXISTS _everyapp_app_resources (
+import{Bb as o}from"./chunk-LYNBZ7RV.js";var a=[{sql:`CREATE TABLE IF NOT EXISTS _everyapp_app_resources (
   worker_name TEXT NOT NULL,
   kind TEXT NOT NULL,
   binding TEXT NOT NULL,

package/dist/{chunk-VXJQGJ7Y.js → chunk-ZEXVHB22.js}

@@ -1,2 +1,2 @@
-import{a as E,b as v}from"./chunk-YJBYZWSP.js";import{a as A}from"./chunk-KMAOZRV4.js";import{a as y}from"./chunk-F6IH47GT.js";import{c as a,cc as f,gc as w,oc as g}from"./chunk-SAT3PGZU.js";import I from"chalk";async function N(t){await S(t,(e,o)=>v(t,e,o))}async function S(t,e){let o=Date.now();await g(t,async n=>{let r=A({out:n,verbose:t.verbose}),i=await e(n,E({gateway:{openRelease:r.open,source:r.describe},interactive:y(t.json??!1)}));_(n,i,o)})}function _(t,e,o){let{gatewayUrl:n,organizationName:r,release:i,releaseName:p,owner:c,mode:d}=e,l=`${n}/admin`,s={gatewayUrl:n,adminUrl:l,organizationName:r,owner:c,release:i,mode:d,gateway:e.gateway,accessOn:e.accessOn},m={label:"Gateway",value:n},u=e.accessOn?[{label:"Access",value:"on",note:"everyone signs in through Cloudflare Access first"}]:[];if(e.gateway==="upgraded"&&!e.ownerCreated){t.emit({type:"done",message:`Upgraded to ${p}`,data:s,display:[...w([{label:"Gateway",value:I.cyan(n)}]),I.dim(`Upgraded to ${p} in ${f(Date.now()-o)}`)].join(`
+import{a as E,b as v}from"./chunk-CZTEDWZ2.js";import{a as A}from"./chunk-H6QQMY7B.js";import{a as y}from"./chunk-CCWBPAKH.js";import{c as a,kc as f,oc as w,wc as g}from"./chunk-LYNBZ7RV.js";import I from"chalk";async function N(t){await S(t,(e,o)=>v(t,e,o))}async function S(t,e){let o=Date.now();await g(t,async n=>{let r=A({out:n,verbose:t.verbose}),i=await e(n,E({gateway:{openRelease:r.open,source:r.describe},interactive:y(t.json??!1)}));_(n,i,o)})}function _(t,e,o){let{gatewayUrl:n,organizationName:r,release:i,releaseName:p,owner:c,mode:d}=e,l=`${n}/admin`,s={gatewayUrl:n,adminUrl:l,organizationName:r,owner:c,release:i,mode:d,gateway:e.gateway,accessOn:e.accessOn},m={label:"Gateway",value:n},u=e.accessOn?[{label:"Access",value:"on",note:"everyone signs in through Cloudflare Access first"}]:[];if(e.gateway==="upgraded"&&!e.ownerCreated){t.emit({type:"done",message:`Upgraded to ${p}`,data:s,display:[...w([{label:"Gateway",value:I.cyan(n)}]),I.dim(`Upgraded to ${p} in ${f(Date.now()-o)}`)].join(`
 `)});return}if(!c){t.emit({type:"done",data:{...s,facts:[m]}});return}if(e.gateway==="installed"||e.ownerCreated){t.emit({type:"done",data:{...s,facts:[m,{label:"Admin",value:l,note:"invite people, choose who opens which app"},...u],next:O(d,e.accessOn===!0)}});return}t.emit({type:"done",data:{...s,facts:[m,...u],...e.gateway==="up-to-date"?{next:[{command:`${a} status`,note:"see apps, domains and certificates"}]}:{}}})}function O(t,e){return t==="hosted"?[{command:`${a} create my-app`,note:"start your first app"},{command:`${a} secret set OPENAI_API_KEY`,note:"turn on AI for apps"},{command:`${a} secret set EMAIL_FROM EMAIL_FROM_NAME`,note:"email invites; needs Cloudflare Email Sending"}]:[{command:`${a} create my-app`,note:"start your first app"},...e?[]:[{command:`${a} access on`,note:"put Cloudflare Access in front of your Gateway (recommended)"}],{command:`${a} secret set OPENAI_API_KEY`,note:"AI for apps (or OPENROUTER_API_KEY, WORKERS_AI_API_TOKEN)"},{command:`${a} secret set EMAIL_FROM EMAIL_FROM_NAME`,note:"email invites and password resets; needs Cloudflare Email Sending"}]}export{N as a,S as b,_ as c};

package/dist/{chunk-GRFPP4UW.js → chunk-ZFCUH5PK.js}

@@ -1,4 +1,4 @@
-import{b as I,d as R}from"./chunk-F6IH47GT.js";import{k as C,l as b}from"./chunk-JYKRUS5C.js";import{Fb as w,Hb as v,Vb as h,Wb as k,d as f,tb as g,ub as d,xb as p,yb as y,zb as m}from"./chunk-SAT3PGZU.js";var P={perPage:100,maxPages:50};function O(e){return k(e,["workers","list"],b,P)}async function $(e,r){return((await O(e)).find(t=>t.name===r)?.references?.domains??[]).map(t=>t.hostname.toLowerCase())}async function l(e,r){let n;try{n=await h(e,{plane:"account",args:["workers","deployments","list","--worker",r,"--per-page","10"]},C)}catch(o){if(m(o,"not_found"))return null;throw o}let t=[...n].sort((o,i)=>(i.created_on??"").localeCompare(o.created_on??""))[0];return{versionId:[...t?.versions??[]].sort((o,i)=>i.percentage-o.percentage)[0]?.version_id??null,deployedAt:t?.created_on?Date.parse(t.created_on):null}}async function L(e,r,{withReferences:n=!1}={}){await e.run({plane:"account",mode:"json",args:["workers","delete",r,"--force",...n?["--delete-with-references"]:[]]})}var W=9e5;async function B(e){let r=e.secrets&&Object.keys(e.secrets).length>0?e.secrets:void 0,n=e.dryRun?null:await l(e.cf,e.workerName),t=!1,s=e.onUploaded&&!e.dryRun?v({async:()=>D(e,n,t)}):void 0;try{return await A(e,r,n,()=>{t=!0})}catch(o){throw s&&!w()&&await D(e,n,t).catch(i=>{e.out?.emit({type:"warning",code:"UPLOAD_UNRECORDED",step:e.step,message:`The version cf uploaded of ${e.workerName} couldn't be recorded
+import{b as I,d as R}from"./chunk-CCWBPAKH.js";import{k as C,l as b}from"./chunk-JYKRUS5C.js";import{Bb as g,Cb as d,Fb as p,Gb as y,Hb as m,Nb as w,Pb as v,bc as h,cc as k,d as f}from"./chunk-LYNBZ7RV.js";var P={perPage:100,maxPages:50};function O(e){return k(e,["workers","list"],b,P)}async function $(e,r){return((await O(e)).find(t=>t.name===r)?.references?.domains??[]).map(t=>t.hostname.toLowerCase())}async function l(e,r){let n;try{n=await h(e,{plane:"account",args:["workers","deployments","list","--worker",r,"--per-page","10"]},C)}catch(o){if(m(o,"not_found"))return null;throw o}let t=[...n].sort((o,i)=>(i.created_on??"").localeCompare(o.created_on??""))[0];return{versionId:[...t?.versions??[]].sort((o,i)=>i.percentage-o.percentage)[0]?.version_id??null,deployedAt:t?.created_on?Date.parse(t.created_on):null}}async function L(e,r,{withReferences:n=!1}={}){await e.run({plane:"account",mode:"json",args:["workers","delete",r,"--force",...n?["--delete-with-references"]:[]]})}var W=9e5;async function B(e){let r=e.secrets&&Object.keys(e.secrets).length>0?e.secrets:void 0,n=e.dryRun?null:await l(e.cf,e.workerName),t=!1,s=e.onUploaded&&!e.dryRun?v({async:()=>D(e,n,t)}):void 0;try{return await A(e,r,n,()=>{t=!0})}catch(o){throw s&&!w()&&await D(e,n,t).catch(i=>{e.out?.emit({type:"warning",code:"UPLOAD_UNRECORDED",step:e.step,message:`The version cf uploaded of ${e.workerName} couldn't be recorded
 ${p(i)}`,data:{workerName:e.workerName,error:p(i)}})}),o}finally{w()||s?.()}}async function D(e,r,n){let t=await l(e.cf,e.workerName);t?.versionId&&t.versionId!==r?.versionId&&await e.onUploaded?.(t.versionId,n)}async function A(e,r,n,t){let s=e.interactive&&e.attach&&!e.dryRun,o=u=>e.cf.run({plane:"project",cwd:e.cwd,cliCf:e.cliCf,mode:u,timeoutMs:W,...r?{files:{"secrets.json":r}}:{},args:c=>["deploy","--prebuilt","--mode","production","--message",e.message,...e.buildOutputWorker?["--worker",e.buildOutputWorker]:[],...r?["--secrets-file",c["secrets.json"]]:[],...e.dryRun?["--dry-run"]:[]]}),i;try{i=(await o(s?"interactive":"text").catch(c=>{if(e.interactive&&m(c,"strict_conflict"))return o("interactive");throw c})).stdout}catch(u){throw N(u,e)}if(t(),e.dryRun)return{versionId:null,output:i};let a=await l(e.cf,e.workerName);if(!a?.versionId||a.versionId===n?.versionId)throw new g("DEPLOY_NOT_UPLOADED",`cf finished without uploading a new version of ${e.workerName}
 Was one of its questions answered no? The version that was serving still is.`,{rerun:f(),rerunNote:"to deploy again"});return await e.onUploaded?.(a.versionId,!0),{versionId:a.versionId,output:i}}async function G({cf:e,workerName:r,shownAs:n,recordedVersionIds:t,interactive:s,confirm:o=I,change:i}){let a=await l(e,r);if(a&&!(a.versionId&&t.includes(a.versionId))){if(!s)throw new d("rerun_interactive",`${_(n)} was changed outside everyapp; confirm in a terminal
 Its live version wasn't deployed by everyapp, and Cloudflare won't replace it unattended. Nothing changed.`,void 0,{rerun:f([],{terminal:!0}),rerunNote:"in a terminal",data:{workerName:r,versionId:a.versionId,needsTerminal:!0}});await R(o,i.question,{context:[`${_(n)}'s live version wasn't deployed by everyapp (dashboard, API, or an interrupted deploy).`,[i.effect,"Cloudflare may ask to confirm again."].filter(Boolean).join(" ")]})}}function E(e){return`https://dash.cloudflare.com/${e}/workers/plans`}var _=e=>e.replace(/^the /,"The ");function N(e,{workerName:r,accountId:n}){return e instanceof y?e.kind==="strict_conflict"?new d("rerun_interactive",`${r} was changed outside everyapp; confirm in a terminal

package/dist/{configure-2KMHM22T.js → configure-F7UZCJUG.js}

@@ -1,4 +1,4 @@
-import{A as z,E as Q,F as B,a as j,b as V,q as P,r as Z,s as Y}from"./chunk-IG26HYRR.js";import{a as v}from"./chunk-IA534DGW.js";import{a as O,b as _,c as M,d as D,i as G,j as q,l as L,m as E,n as F,p as U}from"./chunk-MDORVBPD.js";import"./chunk-GRFPP4UW.js";import"./chunk-Y3VIFPN5.js";import"./chunk-PL6EORDJ.js";import"./chunk-EUNGJMJ6.js";import{ia as b,qa as k,sa as x}from"./chunk-ZYL2ZHCF.js";import"./chunk-SPPR6WCI.js";import"./chunk-7LG3F4FF.js";import{b as W}from"./chunk-GD2JZMD3.js";import{a as S,b as A,e as I,f as N,g as R,h as T}from"./chunk-F6IH47GT.js";import"./chunk-JYKRUS5C.js";import{R as $,c as m,k as y,oc as C,tb as g}from"./chunk-SAT3PGZU.js";import{text as ee}from"node:stream/consumers";import w from"chalk";var te={secret:(e,{context:i,optional:n})=>R(e,{context:i,optional:n}),text:(e,{context:i,optional:n,validate:o})=>N(e,{context:i,validate:s=>n&&!s.trim()?null:o(s)}),confirm:A,choose:(e,i,n)=>I(e,i,{context:n})};async function Oe(e,i){await C(e,n=>ne({flags:e,out:n,appId:i}))}async function ne(e){let{out:i,flags:n}=e,o=e.interactive??S(n.json??!1),s=e.prompter??te;ie(e.appId);let t=await re(e),r=await J(t),a=se(r,t);if(o){let h=e.tell??T;for(let X of ae(t,r))h(X)}let c=await ce(t,r,a,e),p=o?await ue(t,r,a,c,s):{},l=de({...c,...p},r),d=Object.keys(l);if(d.length===0&&!r.setup.ready&&!o)throw me(t,r,a);let f=d.length>0?await oe(t,l,e):null,u=f?await J({...t,registry:f.gateway?.bound?.length?await v(t.connection.db,t.connection.install):t.registry}):r;t.deployed&&t.source==="registry"?await V(t.connection.db,{appRowId:t.deployed.rowId,setup:u.setup,deployer:t.connection.deployer},i):t.deployed&&await j(t.connection,{gateway:[],appRowId:t.deployed.rowId},i),ge(t,u,a,d,f,i)}async function oe(e,i,n){try{return await z(e.connection,{manifest:e.manifest,source:e.source,app:e.deployed},i,{...n,...e.deployed&&e.source==="registry"?{setupRecordedBy:e.deployed.rowId}:{}})}catch(o){throw!(o instanceof g)||o.code!=="SECRETS_PARTIALLY_APPLIED"?o:new g(o.code,o.message,{...K(e,"to set what is left"),retryable:!0,data:o.data})}}function K(e,i,n=""){return e.deployed?{rerun:`${m} configure ${e.appId}${n}`,rerunNote:i}:{rerun:`${m} configure${n}`,rerunNote:`in the app's directory, ${i}`}}function ie(e){if(!e?.includes("="))return;let i=e.split("=")[0];throw new g("VALUE_ON_COMMAND_LINE",`${i}=\u2026 looks like a value on the command line, which configure never takes
+import{C as z,G as Q,H as B,a as j,b as V,s as P,t as Z,u as Y}from"./chunk-IFCPALVC.js";import{a as v}from"./chunk-WOVS3GV5.js";import{a as O,b as _,c as M,d as D,i as G,j as q,l as L,m as E,o as F,q as U}from"./chunk-OM2HDWVP.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import{ia as b,qa as k,sa as x}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import{b as W}from"./chunk-H7PDL3X5.js";import{a as S,b as A,e as I,f as N,g as R,h as T}from"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{Bb as g,Z as $,c as m,k as y,wc as C}from"./chunk-LYNBZ7RV.js";import{text as ee}from"node:stream/consumers";import w from"chalk";var te={secret:(e,{context:i,optional:n})=>R(e,{context:i,optional:n}),text:(e,{context:i,optional:n,validate:o})=>N(e,{context:i,validate:s=>n&&!s.trim()?null:o(s)}),confirm:A,choose:(e,i,n)=>I(e,i,{context:n})};async function Oe(e,i){await C(e,n=>ne({flags:e,out:n,appId:i}))}async function ne(e){let{out:i,flags:n}=e,o=e.interactive??S(n.json??!1),s=e.prompter??te;ie(e.appId);let t=await re(e),r=await J(t),a=se(r,t);if(o){let h=e.tell??T;for(let X of ae(t,r))h(X)}let c=await ce(t,r,a,e),p=o?await ue(t,r,a,c,s):{},l=de({...c,...p},r),d=Object.keys(l);if(d.length===0&&!r.setup.ready&&!o)throw me(t,r,a);let f=d.length>0?await oe(t,l,e):null,u=f?await J({...t,registry:f.gateway?.bound?.length?await v(t.connection.db,t.connection.install):t.registry}):r;t.deployed&&t.source==="registry"?await V(t.connection.db,{appRowId:t.deployed.rowId,setup:u.setup,deployer:t.connection.deployer},i):t.deployed&&await j(t.connection,{gateway:[],appRowId:t.deployed.rowId},i),ge(t,u,a,d,f,i)}async function oe(e,i,n){try{return await z(e.connection,{manifest:e.manifest,source:e.source,app:e.deployed},i,{...n,...e.deployed&&e.source==="registry"?{setupRecordedBy:e.deployed.rowId}:{}})}catch(o){throw!(o instanceof g)||o.code!=="SECRETS_PARTIALLY_APPLIED"?o:new g(o.code,o.message,{...K(e,"to set what is left"),retryable:!0,data:o.data})}}function K(e,i,n=""){return e.deployed?{rerun:`${m} configure ${e.appId}${n}`,rerunNote:i}:{rerun:`${m} configure${n}`,rerunNote:`in the app's directory, ${i}`}}function ie(e){if(!e?.includes("="))return;let i=e.split("=")[0];throw new g("VALUE_ON_COMMAND_LINE",`${i}=\u2026 looks like a value on the command line, which configure never takes
 It lands in the shell's history and the process list: rotate it if it was real. Nothing was set.`,{fix:`pipe NAME=value lines in (one per line), or export ${i} and add --from-env`})}async function re(e){let i=()=>x({gateway:k(e.flags.gateway),accountId:e.flags["account-id"],interactive:S(e.flags.json??!1),login:{json:e.flags.json,out:e.out,step:"login"},createCf:e.createCf});if(e.appId){let t=await i(),r=await b(t.db,e.appId);if(!r||r.status==="pending")throw new g("APP_NOT_FOUND",`${e.appId} isn't deployed to this Gateway
 An app is configured by name after its first deploy; in its directory, configure works before that too (for the Gateway's settings). Nothing was changed.`,{rerun:`${m} status`,rerunNote:"lists its apps"});let a=Q(r);return{appId:a.id,manifest:a,source:"registry",deployed:{workerName:r.workerName,rowId:r.id},connection:t,registry:await v(t.db,t.install)}}let n=await W(e.cwd??process.cwd());if(!n)throw new g("MANIFEST_NOT_FOUND","No everyapp.config.ts in this directory, and no app named",{fix:`name the app: ${m} configure <app> (${m} status lists them), or run this from its directory`});let o=await i(),s=await b(o.db,n.id);return{appId:n.id,manifest:n,source:"directory",deployed:s&&s.status!=="pending"?{workerName:s.workerName,rowId:s.id}:null,connection:o,registry:await v(o.db,o.install)}}async function J(e){let{cf:i}=e.connection,n=M(await O(i),e.registry),o=e.deployed?await _(i,e.deployed.workerName):null,{report:s,setup:t}=D({manifest:e.manifest,appId:e.appId,gatewayNames:n,secretNames:o,lookup:e.registry}),r=new Set;for(let a of s.settings){let c=a.holder==="gateway"?n:o??[];for(let p of[...a.names,...a.alsoReads])c.includes(p)&&r.add(p)}return{report:s,setup:t,held:r}}function se({report:e},i){let n=t=>t.names.length>0&&(t.holder==="gateway"||i.deployed!==null),o=t=>t.set===!1&&n(t),s=new Set(e.groups.filter(t=>t.met).map(t=>t.group));return{required:e.settings.filter(t=>t.need.kind==="required"&&o(t)),groups:e.groups.filter(t=>!t.met&&t.members.some(r=>r.blocking)).map(t=>({group:t.group,members:t.members.filter(o)})).filter(t=>t.members.length>0),optional:e.settings.filter(t=>o(t)&&!t.blocking&&(t.need.kind==="optional"||t.need.kind==="anyOf"&&s.has(t.need.group))),afterDeploy:e.settings.filter(t=>t.holder==="app"&&t.names.length>0&&i.deployed===null)}}function ae(e,{report:i}){let n=q(e.appId,i.settings).map(o=>!e.deployed&&o.where===e.appId?{...o,status:w.dim("after first deploy")}:o);return[w.dim(`${e.appId}'s settings are held as the Gateway's secrets: an AI key or a capability's client on the Gateway Worker, once for every app; ${e.appId}'s own secrets on its Worker. Changes are live at once, no deploy needed.`),"",...n.length>0?L(n,{app:!1}):[w.dim(`${e.appId} declares no secrets and needs no Gateway settings.`)],""]}function le({report:e},i){return e.settings.find(n=>n.names.includes(i))??e.settings.find(n=>n.alsoReads.includes(i))}function de(e,{report:i}){let n={};for(let o of i.settings)for(let s of[...o.names,...o.alsoReads])e[s]!==void 0&&n[s]===void 0&&(n[s]=e[s]);return n}async function ce(e,i,n,o){let s={},t=(a,c)=>$(a)?Y(a,c):c,r=o.flags["from-env"]?null:await(o.readStdin??pe)();if(r!==null)for(let{name:a,value:c,line:p}of fe(r)){let l=le(i,a);if(!l){let d=/^[A-Z][A-Z0-9_]*$/.test(a)?a:`line ${p} (not shown: it may be a value)`;throw new g("SECRET_NOT_DECLARED",`${e.appId} doesn't declare ${d}
 The piped lines set what its ${e.source==="registry"?"deployed manifest":"everyapp.config.ts"} lists (a provider, a capability or one of its secrets). Nothing was set.`,{fix:`leave it out, or declare it in everyapp.config.ts${e.source==="registry"?" and deploy again":""}; a bare value goes to ${m} secret set NAME`})}if(l.holder==="app"&&!e.deployed)throw new g("APP_NOT_FOUND",`${e.appId} isn't deployed yet

package/dist/{create-ELEJMZBS.js → create-2E5HVWYK.js}

@@ -1,4 +1,4 @@
-import{a as X}from"./chunk-E7EUXUVD.js";import{b as H}from"./chunk-74EST4VW.js";import{b as Q,c as j,d as h}from"./chunk-R4CGF622.js";import"./chunk-DQWOXSL3.js";import{a as q}from"./chunk-GD2JZMD3.js";import{a as B,f as Y}from"./chunk-F6IH47GT.js";import"./chunk-JYKRUS5C.js";import{Nb as W,Ob as J,Pb as K,Sb as U,Tb as G,Ub as z,c as x,cb as O,h as I,hb as R,ib as _,l as C,oc as V,tb as m,xb as M}from"./chunk-SAT3PGZU.js";import $ from"node:path";import w from"node:fs/promises";import E from"node:path";var ue=[".claude/skills",".agents/skills"],D={everyapp:"- Before running everyapp, read the everyapp skill: `.agents/skills/everyapp/SKILL.md` (also in `.claude/skills/`).","build-every-app":"- To build or change this app, read the build-every-app skill: `.agents/skills/build-every-app/SKILL.md` (patterns in patterns.md beside it)."};function N(e){return E.join(e,"packages","cli","skills")}async function he(e){let t=[];for(let r of await w.readdir(N(e),{withFileTypes:!0}))if(r.isDirectory())try{await w.access(E.join(N(e),r.name,"SKILL.md")),t.push(r.name)}catch{}let i=Object.keys(D).filter(r=>t.includes(r)),n=t.filter(r=>!(r in D)).sort();return[...i,...n]}function Z(e){return D[e]??`- Read the ${e} skill: \`.agents/skills/${e}/SKILL.md\` (also in \`.claude/skills/\`).`}async function ee({root:e,appDir:t}){let i=await he(e),n=[];for(let r of i)for(let a of ue){let o=`${a}/${r}`,l=E.join(t,o);await w.rm(l,{recursive:!0,force:!0}),await w.cp(E.join(N(e),r),l,{recursive:!0}),n.push(o)}return{skills:i,paths:n,agentsMd:await ye(t,i)}}async function ye(e,t){let i=E.join(e,"AGENTS.md"),n;try{n=await w.readFile(i,"utf8")}catch{return await w.writeFile(i,`# Agent instructions
+import{a as X}from"./chunk-J35DDCNU.js";import{b as H}from"./chunk-CZXHKPRZ.js";import{b as Q,c as j,d as h}from"./chunk-23HJ5I2A.js";import"./chunk-ONLNJXVQ.js";import{a as q}from"./chunk-H7PDL3X5.js";import{a as B,f as Y}from"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{$b as G,Bb as m,Fb as M,Vb as W,Wb as J,Xb as K,_b as U,ac as z,c as x,h as I,kb as O,l as C,pb as R,qb as _,wc as V}from"./chunk-LYNBZ7RV.js";import $ from"node:path";import w from"node:fs/promises";import E from"node:path";var ue=[".claude/skills",".agents/skills"],D={everyapp:"- Before running everyapp, read the everyapp skill: `.agents/skills/everyapp/SKILL.md` (also in `.claude/skills/`).","build-every-app":"- To build or change this app, read the build-every-app skill: `.agents/skills/build-every-app/SKILL.md` (patterns in patterns.md beside it)."};function N(e){return E.join(e,"packages","cli","skills")}async function he(e){let t=[];for(let r of await w.readdir(N(e),{withFileTypes:!0}))if(r.isDirectory())try{await w.access(E.join(N(e),r.name,"SKILL.md")),t.push(r.name)}catch{}let i=Object.keys(D).filter(r=>t.includes(r)),n=t.filter(r=>!(r in D)).sort();return[...i,...n]}function Z(e){return D[e]??`- Read the ${e} skill: \`.agents/skills/${e}/SKILL.md\` (also in \`.claude/skills/\`).`}async function ee({root:e,appDir:t}){let i=await he(e),n=[];for(let r of i)for(let a of ue){let o=`${a}/${r}`,l=E.join(t,o);await w.rm(l,{recursive:!0,force:!0}),await w.cp(E.join(N(e),r),l,{recursive:!0}),n.push(o)}return{skills:i,paths:n,agentsMd:await ye(t,i)}}async function ye(e,t){let i=E.join(e,"AGENTS.md"),n;try{n=await w.readFile(i,"utf8")}catch{return await w.writeFile(i,`# Agent instructions
 
 ${t.map(Z).join(`
 `)}

package/dist/{db-MZIAKGBN.js → db-HEQVTDTM.js}

@@ -1,4 +1,4 @@
-import{a as Y,b as K}from"./chunk-WEM3WLOC.js";import{b as B,d as W,e as J}from"./chunk-74EST4VW.js";import{b as _}from"./chunk-PL6EORDJ.js";import{i as G}from"./chunk-DQWOXSL3.js";import{b as C,c as F,ha as P,qa as q,sa as T}from"./chunk-ZYL2ZHCF.js";import"./chunk-SPPR6WCI.js";import"./chunk-7LG3F4FF.js";import{a as E,e as U,f as A}from"./chunk-GD2JZMD3.js";import{a as Q,i as x}from"./chunk-F6IH47GT.js";import{t as k}from"./chunk-JYKRUS5C.js";import{Qb as O,Ub as $,Vb as S,c as D,d as L,f as w,hb as M,hc as j,oc as R,tb as s,xb as N,yb as v}from"./chunk-SAT3PGZU.js";import ot from"node:fs/promises";import it from"node:path";import{text as at}from"node:stream/consumers";import u from"chalk";function V(t,e){let n=nt(t.reduce((r,o)=>r+o.duration,0));if(t.length===1){let[r]=t;if(z(r))return`${w(r.changes,"row")} changed ${u.green("\u2713")} ${u.dim(`${e} \xB7 ${n}`)}`;let o=u.dim(`${w(r.rows.length,"row")} \xB7 ${e} \xB7 ${n}`);return r.rows.length===0?o:[...H(r),"",o].join(`
+import{a as Y,b as K}from"./chunk-LXYMDZER.js";import{b as B,d as W,e as J}from"./chunk-CZXHKPRZ.js";import{b as _}from"./chunk-ZECBN24L.js";import{i as G}from"./chunk-ONLNJXVQ.js";import{b as C,c as F,ha as P,qa as q,sa as T}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import{a as E,e as U,f as A}from"./chunk-H7PDL3X5.js";import{a as Q,i as x}from"./chunk-CCWBPAKH.js";import{t as k}from"./chunk-JYKRUS5C.js";import{Bb as s,Fb as N,Gb as v,Yb as O,ac as $,bc as S,c as D,d as L,f as w,pb as M,pc as j,wc as R}from"./chunk-LYNBZ7RV.js";import ot from"node:fs/promises";import it from"node:path";import{text as at}from"node:stream/consumers";import u from"chalk";function V(t,e){let n=nt(t.reduce((r,o)=>r+o.duration,0));if(t.length===1){let[r]=t;if(z(r))return`${w(r.changes,"row")} changed ${u.green("\u2713")} ${u.dim(`${e} \xB7 ${n}`)}`;let o=u.dim(`${w(r.rows.length,"row")} \xB7 ${e} \xB7 ${n}`);return r.rows.length===0?o:[...H(r),"",o].join(`
 `)}return[...t.flatMap(r=>[...z(r)?[`${w(r.changes,"row")} changed`]:H(r),""]),u.dim(`${w(t.length,"statement")} \xB7 ${e} \xB7 ${n}`)].join(`
 `)}var z=t=>t.rows.length===0&&t.changes>0;function H({rows:t}){let e=Object.keys(t[0]??{});return e.length===0?[u.dim("0 rows")]:j(e,t.map(n=>e.map(r=>et(n[r]))))}function et(t){return t==null?u.dim("NULL"):typeof t=="string"?t.replaceAll(`
 `,"\\n"):typeof t=="object"?JSON.stringify(t):String(t)}var nt=t=>t<1?"<1ms":`${Math.round(t)}ms`,rt=[/^(select|explain|values)\b/i,/^with\b(?![\s\S]*\b(insert|update|delete|replace)\b)/i,/^pragma\b[^=]*$/i];function X(t){let e=t.split(";").map(n=>n.trim()).filter(Boolean);return e.length>0&&e.every(n=>rt.some(r=>r.test(n)))}var I="db.migrate";async function jt(t){await R(t,async e=>{await st({cwd:process.cwd(),out:e}),e.emit({type:"done"})})}async function st({cwd:t,out:e,cf:n=$()}){let r=await E(t);await Y(t,e);let o;try{o=await B({cwd:t,manifest:r,cf:n,onApply:()=>e.emit({type:"step",step:I,status:"start",message:"Applying migrations to the local database..."})})}catch(a){throw await ct({cwd:t,manifest:r,cf:n,error:a})}if(o.status==="skipped"){e.emit({type:"step",step:I,status:"skip",message:o.reason==="no_d1"?`${r.id} declares no D1 database, so there's nothing to migrate.`:`No migrations in ${A(r)}/ yet, so there's nothing to migrate.`,data:{reason:o.reason}});return}K(e,I,o)}async function ct({cwd:t,manifest:e,cf:n,error:r}){let{problem:o,sqliteCode:a}=C(N(r)),[i]=await W({cwd:t,manifest:e,cf:n}).catch(()=>[]);return new s("MIGRATIONS_FAILED",[i?`Migration ${i} failed`:"A local migration failed",a?`${o} (${a})`:o].join(`