everyapp 0.3.0-rc.2 → 0.3.0-rc.3

package/skills/everyapp/setup/ai.md

@@ -0,0 +1,139 @@
+# The default model provider
+
+An app that says `ai: { chat: true }` in its manifest (Agentic Inbox,
+OpenCRM's research agent) takes whichever chat model the Gateway's
+operator made the default, through `/api/ai/default/…`; it never names a
+provider. One key, set once, makes every such app work. This file sets
+that one key and, when the person wants a particular provider or model,
+the choice. At the end the person has one model provider's key on the
+Gateway, `pnpm everyapp ai show` saying what the default resolves to,
+and every app that needs "a chat model" open.
+
+## Settings
+
+| NAME                                                     | Required or optional                         | What it holds                                                                                              |
+| -------------------------------------------------------- | -------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| one provider's key (`OPENROUTER_API_KEY` first in the order) | required by every app whose manifest says `ai.chat` | the provider's key as its file says ([openrouter.md](openrouter.md), [workers-ai.md](workers-ai.md), [openai.md](openai.md), or [providers.md](providers.md) under `anthropic`, `groq`, `mistral`, `gemini`) |
+| the choice (`pnpm everyapp ai default <provider>[/<model>]`) | optional                                     | which provider (and model) the default is; without it the order decides                                     |
+
+The order the Gateway resolves the default in, the first whose settings
+are set: `openrouter` (one key, many models, the price in every answer),
+`workers-ai` (no provider account: the Gateway's own Cloudflare token;
+weaker models), `openai`, `anthropic`, `groq`, `mistral`, `gemini`. The
+operator's choice wins over the order. Cloudflare AI Gateway is never
+the default: it fronts whichever provider resolves
+([ai-gateway.md](ai-gateway.md)).
+
+## Costs and plans
+
+The provider's: OpenRouter is prepaid in USD at the providers' own
+prices ([openrouter.md](openrouter.md)); Workers AI bills the Cloudflare
+account per token ([workers-ai.md](workers-ai.md)); the others each have
+a plan of their own, named in their section of
+[providers.md](providers.md). The model the Gateway fills in when an app
+names none is a cheap capable one per provider (OpenRouter
+`anthropic/claude-haiku-5.5`, Workers AI
+`@cf/meta/llama-4-scout-17b-16e-instruct`, OpenAI `gpt-6-luna`, Groq
+`openai/gpt-oss-20b`, Mistral `mistral-small-latest`, Gemini
+`gemini-3.1-flash-lite`); `pnpm everyapp ai default <provider>/<model>`
+picks another. Usage by provider and model is on Manage workspace →
+Usage and in `pnpm everyapp workspace usage --json` (`byModel`).
+
+## Only a person can
+
+- Open an account with the provider and buy credits or add a card.
+- Create the key there and paste it into the terminal (the value never
+  goes through the chat or the command line).
+- Decide the provider and model when the shipped order isn't what they
+  want (a model they trust, a region, a budget).
+
+## Before you start
+
+1. `pnpm everyapp status --json`: `data.installed` and `data.claimed`
+   true; otherwise [gateway.md](gateway.md) first.
+2. Whether this file applies: an app in `data.apps[]` whose `setup.unmet`
+   has a setting with `kind: "ai-default"` (label "A chat model (…)"),
+   or whose `setup.settings` lists one. Its `names` is the key the order
+   asks for first and its `hint` names the alternatives. No such app:
+   nothing to do here; an app that pins a provider is that provider's
+   file.
+3. `pnpm everyapp ai show --json`: `done.data.configured` false means no
+   provider is set yet; `done.data.provider` and `done.data.settings`
+   say which key the default would use; `done.data.candidates[]` lists
+   every provider with `configured`.
+
+## Steps
+
+1. **Pick the provider with the person.** Default to OpenRouter unless
+   they say otherwise: it is one key for every model and the only one
+   whose spend the Gateway counts in dollars. Workers AI when they want
+   no provider account at all. A single vendor when they already have a
+   key there.
+2. **Set that provider's key**, by its own file: [openrouter.md](openrouter.md)
+   (`OPENROUTER_API_KEY`), [workers-ai.md](workers-ai.md)
+   (`WORKERS_AI_API_TOKEN`), [openai.md](openai.md) (`OPENAI_API_KEY`),
+   or the provider's section of [providers.md](providers.md)
+   (`ANTHROPIC_API_KEY`, `GROQ_API_KEY`, `MISTRAL_API_KEY`,
+   `GEMINI_API_KEY`). Each ends with `pnpm everyapp secret set <NAME>`,
+   the value from the person's terminal, or `pnpm everyapp configure
+   <app id>`, which asks for exactly the one key the app's `ai-default`
+   setting names.
+3. **Store the choice when it isn't the order's.** The first configured
+   provider of the order is the default by itself; nothing to store when
+   it is OpenRouter and the person is happy with its model. Otherwise:
+   `pnpm everyapp ai default <provider>` (`groq`), or with a model,
+   `pnpm everyapp ai default openrouter/anthropic/claude-sonnet-5.5`
+   (the provider id up to the first slash, the model after it). `pnpm
+   everyapp ai default off` clears it. Each change queues the
+   `ai.default_changed` event.
+4. **Optionally put AI Gateway in front**: [ai-gateway.md](ai-gateway.md)
+   (`pnpm everyapp ai gateway on`), for logs, caching and limits on
+   every model call; it changes no app and no key.
+
+## Verify
+
+1. `pnpm everyapp ai show --json`: `done.data.configured` true,
+   `done.data.provider` the one the person picked (or the order's
+   first), `done.data.model` the model that will be filled in,
+   `done.data.via` `ai-gateway` once the gateway is on, else `direct`.
+2. `pnpm everyapp status --json`: every app that said `ai.chat` has
+   `setup.ready` true and no `ai-default` setting in `setup.unmet`.
+3. In the app: a chat answer arrives (Agentic Inbox: open a thread and
+   ask the agent; OpenCRM: run research on a company). Manage workspace
+   → Usage → By provider shows the provider and, under it, the model.
+
+## If it fails
+
+- `ai_default_not_configured` in an app's error (503): no provider's
+  key is set, or the chosen one's isn't. The message names the key;
+  step 2. `pnpm everyapp ai show` says the same with `configured: false`.
+- `AI_DEFAULT_INVALID` from `ai default`: the id isn't a provider the
+  Gateway knows, is an API provider (Stripe), has no OpenAI-shaped chat
+  route (Cohere: an app pins it under `providers`), or is `ai-gateway`
+  (turn it on with `ai gateway on` and pick a model provider). The
+  message names the candidates.
+- `ai_route_not_allowed` on the default route: the app called something
+  other than chat completions or embeddings; it lists the provider under
+  `providers` for that.
+- `model_not_allowed` never comes from the default route; an app seeing
+  it pinned a provider and limited `ai.models`.
+- A provider's own error (401, 429, a model name it doesn't serve): the
+  provider's file, "If it fails".
+
+## Rerun, rotate, remove
+
+- Rerunning any step is safe: `ai default` overwrites the choice, a key
+  set again replaces the old one on the next request.
+- Rotate a key as its provider's file says; the default resolves to the
+  same provider.
+- Remove the choice with `pnpm everyapp ai default off`; remove a key
+  with `pnpm everyapp secret unset <NAME>`, after which the order moves
+  to the next configured provider, or apps that need the default show
+  "Needs setup" again.
+
+## Sources
+
+- https://everyapp.com/docs/agent/ai (in the checkout
+  `landing-page/content/agent/ai.md`): the route, the order, the
+  commands and their `--json`, the event.
+- `packages/sdk/src/internal/aiDefault.ts`: the resolution rule.

package/skills/everyapp/setup/providers.md

@@ -4,7 +4,7 @@
 
 For a coding agent setting up a provider the Gateway's built-in catalog has. Each provider is a section under its id, so `setup/providers.md#<id>` points at it. Where the provider has a file of its own in this folder (its **Guide**), follow that file and read this section as its summary. Read [README.md](README.md) first: its rules hold here too, above all that a key never goes through the chat.
 
-A provider registered on one Gateway (`pnpm everyapp provider add`) is not in this file: `pnpm everyapp provider show <id>` prints its whole spec (its hint, settings, hosts, where the key comes from and its smoke request). The catalog has 73 providers: 47 API-key, 8 AI, 18 OAuth clients.
+A provider registered on one Gateway (`pnpm everyapp provider add`) is not in this file: `pnpm everyapp provider show <id>` prints its whole spec (its hint, settings, hosts, where the key comes from and its smoke request). The catalog has 74 providers: 47 API-key, 9 AI, 18 OAuth clients.
 
 The smoke request needs the key, so it runs where the key is: the person's terminal, with the variable they read in hidden, or through the app that uses it. It is one call that costs nothing (unless marked charged).
 
@@ -70,6 +70,7 @@ The three ways of [README.md](README.md), one line each (the rules, and the code
 | [`openai`](#openai) | OpenAI | AI | `OPENAI_API_KEY` | [openai.md](openai.md) |
 | [`openrouter`](#openrouter) | OpenRouter | AI | `OPENROUTER_API_KEY` | [openrouter.md](openrouter.md) |
 | [`workers-ai`](#workers-ai) | Workers AI | AI | `WORKERS_AI_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID` (set by `everyapp setup`) | [workers-ai.md](workers-ai.md) |
+| [`ai-gateway`](#ai-gateway) | Cloudflare AI Gateway | AI | `AI_GATEWAY_API_KEY`, `CLOUDFLARE_ACCOUNT_ID` (set by `everyapp setup`), `AI_GATEWAY_ID` | [ai-gateway.md](ai-gateway.md) |
 | [`anthropic`](#anthropic) | Anthropic | AI | `ANTHROPIC_API_KEY` |  |
 | [`gemini`](#gemini) | Google Gemini | AI | `GEMINI_API_KEY` |  |
 | [`mistral`](#mistral) | Mistral AI | AI | `MISTRAL_API_KEY` |  |
@@ -907,7 +908,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://platform.openai.com/api-keys
 - **API reference:** https://platform.openai.com/docs/api-reference
 - **How it is sent:** `Authorization: Bearer <OPENAI_API_KEY>`, to `api.openai.com` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/openai/…` with `createGatewayFetch()`: POST to `/v1/responses`, `/v1/chat/completions`, `/v1/embeddings`, `/v1/audio/speech`, `/v1/audio/transcriptions`, `/v1/audio/translations`, `/v1/images/generations`, `/v1/images/edits`, `/v1/images/variations`, and more only where both `AI_PROXY_EXTRA_ROUTES` and the app's `ai.routes` allow it
+- **What apps may do:** list it under `providers` and call `/api/ai/openai/…` with `createGatewayFetch()`: POST to `/v1/responses`, `/v1/chat/completions`, `/v1/embeddings`, `/v1/audio/speech`, `/v1/audio/transcriptions`, `/v1/audio/translations`, `/v1/images/generations`, `/v1/images/edits`, `/v1/images/variations`, and more only where both `AI_PROXY_EXTRA_ROUTES` and the app's `ai.routes` allow it; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/v1/chat/completions` with `gpt-6-luna` when the app names no model and `/v1/embeddings` with `text-embedding-3-small`; through AI Gateway as `openai` once it is on
 - **Smoke request:** none recorded
 - **Cost:** not recorded
 - **Rate:** not recorded
@@ -924,7 +925,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://openrouter.ai/settings/keys
 - **API reference:** https://openrouter.ai/docs
 - **How it is sent:** `Authorization: Bearer <OPENROUTER_API_KEY>`, to `openrouter.ai` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/openrouter/…` with `createGatewayFetch()`: POST to `/api/v1/chat/completions`, `/api/v1/completions`, `/api/v1/responses`, `/api/v1/embeddings`
+- **What apps may do:** list it under `providers` and call `/api/ai/openrouter/…` with `createGatewayFetch()`: POST to `/api/v1/chat/completions`, `/api/v1/completions`, `/api/v1/responses`, `/api/v1/embeddings`; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/api/v1/chat/completions` with `anthropic/claude-haiku-5.5` when the app names no model and `/api/v1/embeddings` with `openai/text-embedding-3-small`; through AI Gateway as `openrouter` once it is on
 - **Smoke request:** none recorded
 - **Cost:** per token. The answer's usage.cost is the call's price in USD, per model. The Gateway reads each answer's `usage.cost` field (US dollars) into the usage counters.
 - **Rate:** not recorded
@@ -941,7 +942,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://dash.cloudflare.com/profile/api-tokens
 - **API reference:** https://developers.cloudflare.com/workers-ai/
 - **How it is sent:** `Authorization: Bearer <WORKERS_AI_API_TOKEN>`, to `api.cloudflare.com/client/v4/accounts/{CLOUDFLARE_ACCOUNT_ID}/ai` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/workers-ai/…` with `createGatewayFetch()`: POST to `/v1/chat/completions`, `/v1/embeddings`, `/v1/responses`
+- **What apps may do:** list it under `providers` and call `/api/ai/workers-ai/…` with `createGatewayFetch()`: POST to `/v1/chat/completions`, `/v1/embeddings`, `/v1/responses`; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/v1/chat/completions` with `@cf/meta/llama-4-scout-17b-16e-instruct` when the app names no model and `/v1/embeddings` with `@cf/baai/bge-m3`; through AI Gateway as `workers-ai` once it is on
 - **Smoke request:** none recorded
 - **Cost:** not recorded
 - **Rate:** not recorded
@@ -949,6 +950,23 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Set it:** `pnpm everyapp secret set WORKERS_AI_API_TOKEN`, or `pnpm everyapp configure <app id>` for everything an app needs
 - **Guide:** [workers-ai.md](workers-ai.md)
 
+### ai-gateway
+
+**Cloudflare AI Gateway** (`ai`): Cloudflare's proxy in front of the other AI providers: logs, caching, rate limits and spend, with each provider's own key.
+
+- **Settings:** `AI_GATEWAY_API_KEY`, `CLOUDFLARE_ACCOUNT_ID` (set by `everyapp setup`), `AI_GATEWAY_ID`
+- **What the key is:** The gateway's id from the AI Gateway page (everyapp ai gateway on makes one named everyapp); AI_GATEWAY_API_KEY only for an authenticated gateway, sent as cf-aig-authorization. AI_GATEWAY_ID: The AI Gateway's id (its name in the dashboard), in the Gateway's own Cloudflare account. AI_GATEWAY_API_KEY: An AI Gateway token with Run permission, only when the gateway is authenticated; leave unset for an open gateway.
+- **Where the key comes from:** https://dash.cloudflare.com/?to=/:account/ai/ai-gateway
+- **API reference:** https://developers.cloudflare.com/ai-gateway/
+- **How it is sent:** `cf-aig-authorization: Bearer <AI_GATEWAY_API_KEY>`, to `gateway.ai.cloudflare.com/v1/{CLOUDFLARE_ACCOUNT_ID}/{AI_GATEWAY_ID}` only, over https
+- **What apps may do:** nothing by id. With `AI_GATEWAY_ID` set (`pnpm everyapp ai gateway on`), every call to an AI provider that has an AI Gateway slug goes through `gateway.ai.cloudflare.com/v1/{CLOUDFLARE_ACCOUNT_ID}/{AI_GATEWAY_ID}/<slug>/…` with the provider's own key still on it; a provider without a slug goes direct
+- **Smoke request:** none recorded
+- **Cost:** not recorded
+- **Rate:** not recorded
+- **Verified:** 2026-10-25, docs
+- **Set it:** `pnpm everyapp secret set AI_GATEWAY_API_KEY AI_GATEWAY_ID`, or `pnpm everyapp configure <app id>` for everything an app needs
+- **Guide:** [ai-gateway.md](ai-gateway.md)
+
 ### anthropic
 
 **Anthropic** (`ai`): Claude models through the Messages API.
@@ -958,7 +976,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://platform.claude.com/settings/keys
 - **API reference:** https://platform.claude.com/docs/en/api/overview
 - **How it is sent:** `Authorization: Bearer <ANTHROPIC_API_KEY>`, to `api.anthropic.com` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/anthropic/…` with `createGatewayFetch()`: POST to `/v1/messages`, `/v1/messages/count_tokens`
+- **What apps may do:** list it under `providers` and call `/api/ai/anthropic/…` with `createGatewayFetch()`: POST to `/v1/messages`, `/v1/messages/count_tokens`, `/v1/chat/completions`; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/v1/chat/completions` with `claude-haiku-5-5` when the app names no model; through AI Gateway as `anthropic` once it is on
 - **Smoke request:** `GET https://api.anthropic.com/v1/models`, expecting 200; free. Send an anthropic-version header, as every call does.
 - **Cost:** not recorded
 - **Rate:** Requests and tokens per minute by usage tier, on the Console's Rate limits page; token counting is free, with its own per-minute limit.
@@ -975,7 +993,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://aistudio.google.com/apikey
 - **API reference:** https://ai.google.dev/gemini-api/docs/openai
 - **How it is sent:** `Authorization: Bearer <GEMINI_API_KEY>`, to `generativelanguage.googleapis.com` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/gemini/…` with `createGatewayFetch()`: POST to `/v1beta/openai/chat/completions`, `/v1beta/openai/embeddings`, `/v1beta/openai/images/generations`
+- **What apps may do:** list it under `providers` and call `/api/ai/gemini/…` with `createGatewayFetch()`: POST to `/v1beta/openai/chat/completions`, `/v1beta/openai/embeddings`, `/v1beta/openai/images/generations`; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/v1beta/openai/chat/completions` with `gemini-3.1-flash-lite` when the app names no model and `/v1beta/openai/embeddings` with `gemini-embedding-001`
 - **Smoke request:** `GET https://generativelanguage.googleapis.com/v1beta/openai/models`, expecting 200; free
 - **Cost:** not recorded
 - **Rate:** Per project, not per key: requests and tokens per minute and requests per day, by tier (Free, then Tiers 1 to 3).
@@ -992,7 +1010,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://console.mistral.ai
 - **API reference:** https://docs.mistral.ai/api/
 - **How it is sent:** `Authorization: Bearer <MISTRAL_API_KEY>`, to `api.mistral.ai` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/mistral/…` with `createGatewayFetch()`: POST to `/v1/chat/completions`, `/v1/fim/completions`, `/v1/embeddings`, `/v1/moderations`, `/v1/chat/moderations`, `/v1/classifications`, `/v1/chat/classifications`, `/v1/ocr`, `/v1/audio/transcriptions`, `/v1/audio/speech`
+- **What apps may do:** list it under `providers` and call `/api/ai/mistral/…` with `createGatewayFetch()`: POST to `/v1/chat/completions`, `/v1/fim/completions`, `/v1/embeddings`, `/v1/moderations`, `/v1/chat/moderations`, `/v1/classifications`, `/v1/chat/classifications`, `/v1/ocr`, `/v1/audio/transcriptions`, `/v1/audio/speech`; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/v1/chat/completions` with `mistral-small-latest` when the app names no model and `/v1/embeddings` with `mistral-embed`; through AI Gateway as `mistral` once it is on
 - **Smoke request:** `GET https://api.mistral.ai/v1/models`, expecting 200; free
 - **Cost:** not recorded
 - **Rate:** not recorded
@@ -1009,7 +1027,7 @@ Gateway services have no key of this kind: `email`, `members` (sending mail is [
 - **Where the key comes from:** https://console.groq.com/keys
 - **API reference:** https://console.groq.com/docs/api-reference
 - **How it is sent:** `Authorization: Bearer <GROQ_API_KEY>`, to `api.groq.com` only, over https
-- **What apps may do:** list it under `providers` and call `/api/ai/groq/…` with `createGatewayFetch()`: POST to `/openai/v1/chat/completions`, `/openai/v1/responses`, `/openai/v1/audio/transcriptions`, `/openai/v1/audio/translations`, `/openai/v1/audio/speech`
+- **What apps may do:** list it under `providers` and call `/api/ai/groq/…` with `createGatewayFetch()`: POST to `/openai/v1/chat/completions`, `/openai/v1/responses`, `/openai/v1/audio/transcriptions`, `/openai/v1/audio/translations`, `/openai/v1/audio/speech`; as the Gateway's default (`ai: { chat: true }`, `/api/ai/default/v1/chat/completions`) it serves `/openai/v1/chat/completions` with `openai/gpt-oss-20b` when the app names no model; through AI Gateway as `groq` once it is on
 - **Smoke request:** `GET https://api.groq.com/openai/v1/models`, expecting 200; free
 - **Cost:** not recorded
 - **Rate:** Requests and tokens per minute and per day, per model and plan, for the whole organization; the console Limits page shows them.

package/dist/access-LGEN3ABJ.js

@@ -1 +0,0 @@
-import{a,b,c,d,e,f,g,h,i}from"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-TLRM3P7V.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";export{c as APPS_APPLICATION_NAME,b as GATEWAY_APPLICATION_NAME,a as POLICY_NAME,e as off,d as on,f as show,i as showAccess,h as turnAccessOff,g as turnAccessOn};

package/dist/activity-RSD4D66F.js

@@ -1,12 +0,0 @@
-import{a as $,c as b,d as C,e as A,f as g}from"./chunk-ELK7QZ2M.js";import{J as O,K as P,M as R,N as L,O as N,P as W,Q as M,g as E}from"./chunk-M2QQ2UD7.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{c as k,f,pc as v,wc as y}from"./chunk-LYNBZ7RV.js";import a from"chalk";var w="workspace.update";async function ee(e){await y(e,p=>j({flags:e,out:p}))}async function ae(e){await y(e,p=>B({flags:e,out:p}))}async function te(e){await y(e,p=>K({flags:e,out:p}))}async function se(e,p){await y(e,i=>H({flags:e,out:i},p))}async function oe(e){await y(e,p=>q({flags:e,out:p}))}async function ie(e,p){await y(e,i=>X({flags:e,out:i},p))}var m=e=>e.toLocaleString("en-US"),T=e=>e===0?a.dim("\u2013"):`$${(e/1e6).toFixed(4)}`;async function j(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.month??O(new Date(r.now)),o=await P(r,s),n=t=>{if(!t.callable)return a.dim("removed");if(t.capUnlimited)return a.dim("none (unlimited)");if(t.effectiveMonthlyCallCap===null)return a.dim("none");let h=m(t.effectiveMonthlyCallCap),I=t.capSource==="default"?`${h} ${a.dim("(default)")}`:h;return t.paused?`${I} ${a.yellow("paused")}`:I},u=v(["APP","CALLS","FAILED","TOOL CALLS","TOKENS IN/OUT","COST","CAP"],o.byApp.map(t=>[t.appSlug??t.appRowId,m(t.calls),t.failures>0?a.yellow(m(t.failures)):a.dim("0"),m(t.toolCalls),`${m(t.inputTokens)}/${m(t.outputTokens)}`,T(t.costMicros),n(t)])),l=v(["MEMBER","CALLS","FAILED","TOOL CALLS","TOKENS IN/OUT","COST"],o.byMember.map(t=>[t.userId===""?a.dim("the apps themselves"):t.email??a.dim(`${t.userId} (no longer a member)`),m(t.calls),t.failures>0?a.yellow(m(t.failures)):a.dim("0"),m(t.toolCalls),`${m(t.inputTokens)}/${m(t.outputTokens)}`,T(t.costMicros)])),c=v(["PROVIDER","KIND","CALLS","FAILED","TOKENS IN/OUT","COST"],o.byTarget.map(t=>[t.target,t.kind,m(t.calls),t.failures>0?a.yellow(m(t.failures)):a.dim("0"),`${m(t.inputTokens)}/${m(t.outputTokens)}`,T(t.costMicros)])),d=o.byApp.reduce((t,h)=>t+h.calls,0),D=o.byApp.reduce((t,h)=>t+h.toolCalls,0),x=o.byApp.filter(t=>t.paused).length,S=`${r.organization.name}, ${s}: ${f(d,"provider call")} and ${f(D,"tool call")} across ${f(o.byApp.length,"app")}${x>0?`, ${x} paused`:""}`,U=o.defaultMonthlyCallCap===null?"No workspace default cap.":`Workspace default cap: ${m(o.defaultMonthlyCallCap)} calls a month for every app without its own.`;p.emit({type:"done",message:S,display:[S,a.dim(U),"",a.bold("By app"),...o.byApp.length>0?u:[a.dim("no apps")],"",a.bold("By member"),...o.byMember.length>0?l:[a.dim("no calls")],"",a.bold("By provider"),...o.byTarget.length>0?c:[a.dim("no calls")],"",a.dim(`Cap an app: ${k} workspace app cap <app> <n|off|--unlimited>; the default: ${k} workspace cap default <n|off>`)].join(`
-`),data:{organization:r.organization,...o}})}async function B(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.app===void 0?void 0:await E(r,i.app,{callable:!0}),o=i.user===void 0?void 0:await b(r,i.user),n=await R(r,{limit:i.limit,before:i.before,appRowId:s?.id,userId:o?.id,decision:i.decision,risk:i.risk,since:i.since}),u=v(["WHEN (UTC)","WHO","APP","TOOL","RISK","DECISION","OUTCOME","MS","CLIENT"],n.calls.map(d=>[A(d.createdAt),d.user.email??a.dim(d.user.id),d.app.slug?`${d.app.slug}${d.app.removed?a.dim(" (removed)"):""}`:a.dim("gateway"),d.tool.via?`${d.tool.name} ${a.dim(`via ${d.tool.via}`)}`:d.tool.name,d.tool.risk??a.dim("\u2013"),d.decision==="allowed"?a.green("allowed"):a.red(`blocked${d.reason?a.dim(` (${d.reason})`):""}`),d.outcome,d.durationMs===null?a.dim("\u2013"):String(d.durationMs),d.credential.clientName??d.credential.clientInfo??a.dim(d.credential.kind)])),l=n.nextBefore?`${n.nextBefore.createdAt}:${n.nextBefore.id}`:null,c=`${f(n.calls.length,"tool call")} in ${r.organization.name}${n.nextBefore?" (more before this page)":""}`;p.emit({type:"done",message:c,display:[n.calls.length>0?u.join(`
-`):a.dim("No tool calls match."),...l?[a.dim(`Next page: ${k} workspace activity --before ${l}`)]:[]].join(`
-`),data:{organization:r.organization,calls:n.calls.map(d=>({...d,createdAt:g(d.createdAt)})),nextBefore:l,...l?{next:[{command:`${k} workspace activity --before ${l}`,note:"the next page"}]}:{}}})}var F=e=>({id:e.id,user:e.user,name:e.name,prefix:e.prefix,app:e.app.slug,scopes:e.scopes,active:e.active,createdAt:g(e.createdAt),expiresAt:g(e.expiresAt),lastUsedAt:g(e.lastUsedAt),revokedAt:g(e.revokedAt)});async function K(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.user===void 0?void 0:await b(r,i.user),o=await L(r,s?.id),n=i.all?o:o.filter(c=>c.active),u=v(["ID","MEMBER","NAME","PREFIX","APP","SCOPES","STATE","LAST USED","EXPIRES"],n.map(c=>[c.id,c.user.email,c.name,`${c.prefix}\u2026`,c.app.slug??a.dim("all apps"),c.scopes.join(","),c.revokedAt!==null?a.dim("revoked"):c.active?a.green("active"):a.yellow("expired"),A(c.lastUsedAt),A(c.expiresAt)])),l=`${f(n.length,i.all?"personal access token":"active personal access token")}${s?` of ${C(s)}`:""} in ${r.organization.name}${!i.all&&o.length>n.length?` (${o.length-n.length} revoked or expired: --all)`:""}`;p.emit({type:"done",message:l,display:[n.length>0?u.join(`
-`):a.dim(l),a.dim(`Revoke one: ${k} workspace token revoke <id>. Tokens are made in Admin \u2192 Tokens; a value is never shown again.`)].join(`
-`),data:{organization:r.organization,tokens:n.map(F)}})}async function H(e,p){let{out:i}=e,{ws:r}=await $(e);i.emit({type:"step",step:w,status:"start",message:`Revoking the token ${p}...`});let{token:s,already:o}=await N(r,p);i.emit({type:"step",step:w,status:"ok",message:`Revoked ${s.name}`,data:{tokenId:s.id,already:o}});let n=o?[`${s.user.email}'s token ${s.name} (${s.prefix}\u2026) was revoked already, on ${A(s.revokedAt)} UTC.`]:[`Revoked ${s.user.email}'s token ${s.name} (${s.prefix}\u2026).`,"It stops working on its next request."];i.emit({type:"done",message:n.join(`
-`),display:[n[0],...n.slice(1).map(u=>a.dim(u))].join(`
-`),data:{organization:r.organization,token:F(s),already:o}})}var z=e=>({id:e.id,user:e.user,clientName:e.clientName,clientDomain:e.clientDomain,redirectHost:e.redirectHost,apps:e.apps,access:e.access,createdAt:g(e.createdAt),lastUsedAt:g(e.lastUsedAt),revokedAt:g(e.revokedAt),revokedReason:e.revokedReason});async function q(e){let{out:p,flags:i}=e,{ws:r}=await $(e),s=i.user===void 0?void 0:await b(r,i.user),o=await W(r,s?.id),n=v(["ID","MEMBER","AI APP","APPS","ACCESS","LAST USED","SINCE"],o.map(l=>[l.id,l.user.email,`${l.clientName}${l.clientDomain?a.dim(` (${l.clientDomain})`):""}`,l.apps==="all"?"all":l.apps.join(", ")||a.dim("none"),l.access==="write"?"read & write":"read",A(l.lastUsedAt),A(l.createdAt)])),u=`${f(o.length,"AI connection")}${s?` of ${C(s)}`:""} in ${r.organization.name}`;p.emit({type:"done",message:u,display:[o.length>0?n.join(`
-`):a.dim(u),a.dim(`Revoke one: ${k} workspace connection revoke <id>`)].join(`
-`),data:{organization:r.organization,connections:o.map(z)}})}async function X(e,p){let{out:i}=e,{ws:r}=await $(e);i.emit({type:"step",step:w,status:"start",message:`Revoking the connection ${p}...`});let{connection:s,already:o}=await M(r,p);i.emit({type:"step",step:w,status:"ok",message:`Revoked ${s.clientName}`,data:{connectionId:s.id,already:o}});let n=o?[`${s.user.email}'s connection from ${s.clientName} was revoked already${s.revokedReason?` (${s.revokedReason})`:""}.`]:[`Revoked ${s.user.email}'s connection from ${s.clientName}.`,"The client is out on its next request; its grant in the Gateway's authorization server lapses on its own."];i.emit({type:"done",message:n.join(`
-`),display:[n[0],...n.slice(1).map(u=>a.dim(u))].join(`
-`),data:{organization:r.organization,connection:z(s),already:o}})}export{ae as activity,ie as connectionRevoke,oe as connections,B as listActivity,q as listConnections,K as listTokens,j as reportUsage,X as revokeConnection,H as revokeToken,se as tokenRevoke,te as tokens,ee as usage};

package/dist/apps-4RCFXT74.js

@@ -1,13 +0,0 @@
-import{a as w,g as _,h as k,j as D}from"./chunk-ELK7QZ2M.js";import{B as x,D as G,E as M,F as U,G as F,H as R,g as T}from"./chunk-M2QQ2UD7.js";import{a as O,d as j,e as E}from"./chunk-OM2HDWVP.js";import"./chunk-4JRIS6S6.js";import"./chunk-RMF4YGD6.js";import{a as W}from"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{Bb as C,Fb as N,c as v,f as u,pc as P,wc as f}from"./chunk-LYNBZ7RV.js";import d from"chalk";var g="workspace.update";async function ce(e){await f(e,a=>q({flags:e,out:a}))}async function le(e,a){await f(e,o=>B({flags:e,out:o},a))}async function me(e,a){await f(e,o=>Q({flags:e,out:o},a))}var L=e=>e==="off"?null:e;async function de(e,a,o){await f(e,s=>X({flags:e,out:s},a,o===void 0?void 0:L(o),e.unlimited??!1))}async function ue(e,a){await f(e,o=>Y({flags:e,out:o},L(a)))}function J(e){if(!e)return null;try{let a=JSON.parse(e);return a&&typeof a=="object"&&!Array.isArray(a)?a:null}catch{return null}}function K(e,a){let o=J(e.manifest);if(!o||e.tier==="dispatch"||e.status==="pending")return null;try{return E(o)?j({manifest:o,appId:e.appSlug,gatewayNames:a,secretNames:W(e.secretNames)}).setup:null}catch{return null}}var b=(e,a)=>({id:e.id,appId:e.appSlug,name:e.name,description:e.description,status:e.status,scope:e.scope,tier:e.tier,hostname:e.hostname,everyone:e.everyone,accessCount:e.accessCount,...a===void 0?{}:{setup:a}});async function q(e){let{out:a}=e,{gateway:o,ws:s}=await w(e),p=await x(s),i=null;try{i=await O(o.cf)}catch(n){a.emit({type:"warning",code:"SETTINGS_UNKNOWN",message:`Couldn't list the Gateway's settings, so what each app needs set is unknown
-${N(n)}`})}let t=p.map(n=>({app:n,setup:K(n,i)})),r=P(["APP","NAME","STATUS","WHO CAN OPEN","SETUP"],t.map(({app:n,setup:l})=>[n.appSlug,n.name,n.status==="active"?d.green(n.status):d.yellow(n.status),n.scope==="shared"?"everyone, every organization":n.everyone?`everyone ${d.dim(`(${n.accessCount})`)}`:u(n.accessCount,"member"),l===null?d.dim("\u2013"):l.ready?d.green("ready"):d.yellow(`needs ${l.unmet.map(y=>y.names.join(" or ")).join(", ")}`)])),c=t.filter(({setup:n})=>n&&!n.ready);a.emit({type:"done",message:`${u(p.length,"app")} in ${s.organization.name}${c.length>0?`, ${c.length} needing setup`:""}`,display:p.length>0?r.join(`
-`):d.dim(`No apps in ${s.organization.name} yet.`),data:{organization:s.organization,apps:t.map(({app:n,setup:l})=>b(n,l)),...c.length>0?{next:c.flatMap(({app:n,setup:l})=>l?.command?[{command:l.command.command,note:n.appSlug}]:[])}:{}}})}async function B(e,a){let{out:o,flags:s}=e,{ws:p}=await w(e);o.emit({type:"step",step:g,status:"start",message:`Updating ${a}...`});let{app:i,granted:t}=await G(p,a,{name:s.name,description:s.description,everyone:s.everyone===void 0?void 0:s.everyone==="on"});o.emit({type:"step",step:g,status:"ok",message:`Updated ${i.appSlug}`,data:{appRowId:i.id,granted:t}});let r=[`${i.appSlug} is "${i.name}"${i.description?`: ${i.description}`:""}.`,i.scope==="shared"?"A shared app: every member of every organization can open it.":i.everyone?`Available to everyone in ${p.organization.name}${t>0?` (${u(t,"member")} granted now)`:""}; new members get it on joining.`:`Private: ${u(i.accessCount,"member")} can open it (workspace app access ${i.appSlug}).`];o.emit({type:"done",message:r.join(`
-`),display:[r[0],d.dim(r[1])].join(`
-`),data:{organization:p.organization,app:b(i),granted:t}})}async function Q(e,a){let{out:o,flags:s}=e,{change:p}=D(s),{ws:i}=await w(e),t=await T(i,a),r=[],c=[],n;p?(o.emit({type:"step",step:g,status:"start",message:`Changing who can open ${t.appSlug}...`}),{granted:r,revoked:c,users:n}=await U(i,t,p),o.emit({type:"step",step:g,status:"ok",message:`${t.appSlug}: ${u(r.length,"grant")} added, ${c.length} revoked`,data:{appRowId:t.id,granted:r.length,revoked:c.length}})):n=await M(i,t);let l=n.filter(m=>m.direct||m.viaGroups.length>0),y=P(["EMAIL","ROLE","STATUS","DIRECT","VIA GROUPS"],n.map(m=>[m.email,m.primaryRole??m.role,_(m),m.direct?d.green("yes"):d.dim("no"),m.viaGroups.length>0?m.viaGroups.join(", "):d.dim("\u2013")])),h=p?`${t.appSlug}: granted ${r.length>0?r.map(m=>m.email).join(", "):"nobody"}, revoked ${c.length>0?c.map(m=>m.email).join(", "):"nobody"}; ${u(l.length,"member")} can open it now.`:`${u(l.length,"member")} of ${n.length} can open ${t.appSlug}${t.everyone?" (available to everyone)":""}.`;o.emit({type:"done",message:h,display:[h,y.join(`
-`)].join(`
-`),data:{organization:i.organization,app:b({...t,accessCount:l.length}),users:n.map(m=>({...k(m),direct:m.direct,viaGroups:m.viaGroups})),...p?{granted:r.map(k),revoked:c.map(k)}:{}}})}var I=e=>`${e.toLocaleString("en-US")} calls a month`;function S(e,a){return e!==null?I(e):a?"no cap at all":"no cap of its own"}function V(e){return e===null?null:{subscriptionId:e,message:`Owners and admins are emailed at 80% and at the cap (the built-in Cap alerts subscription; ${v} events list shows it).`}}var z="a provider tool answers a tool error naming the cap, and an app's brokered call gets 429 app_monthly_cap_exceeded until the next UTC month.";async function X(e,a,o,s=!1){let{out:p}=e;if(s&&o!==void 0)throw new C("INVALID_VALUE",`--unlimited takes no number and no off
-An app has a cap (a number), no cap whatever the workspace default (--unlimited), or neither (off).`,{fix:`give --unlimited alone: ${v} workspace app cap ${a} --unlimited`});if(!s&&o===void 0)throw new C("MISSING_ARGUMENT",`Missing the cap
-Give a number of calls per month, off for no cap of its own, or --unlimited.`,{data:{usage:`${v} workspace app cap <app> [<n|off>] [--unlimited] [flags]`}});let{ws:i}=await w(e);p.emit({type:"step",step:g,status:"start",message:`Setting ${a}'s cap...`});let t=await F(i,a,o??null,{unlimited:s}),{app:r,was:c,wasUnlimited:n,effective:l,before:y,capAlertsId:h}=t,m=t.cap===c&&s===n;p.emit({type:"step",step:g,status:"ok",message:`${r.appSlug}: ${S(t.cap,s)}`,data:{appRowId:r.id,cap:t.cap,unlimited:s,was:c,wasUnlimited:n,effectiveCap:l.cap,capSource:l.source}});let $=[m?`${r.appSlug} had ${S(t.cap,s)} already. Nothing changed.`:`${r.appSlug}: ${S(t.cap,s)} for ${i.organization.name} (was ${S(c,n)}).`,l.cap===null?y.cap===null?"Its provider calls are not capped.":"Its provider calls are no longer capped.":l.source==="default"?`The workspace default of ${I(l.cap)} binds it; past it, ${z}`:`Past it, ${z}`],A=V(h);A&&$.push(A.message),p.emit({type:"done",message:$.join(`
-`),display:[$[0],...$.slice(1).map(H=>d.dim(H))].join(`
-`),data:{organization:i.organization,app:b(r),cap:t.cap,unlimited:s,was:c,wasUnlimited:n,effectiveCap:l.cap,capSource:l.source,capAlerts:A}})}async function Y(e,a){let{out:o}=e,{ws:s}=await w(e);o.emit({type:"step",step:g,status:"start",message:"Setting the workspace default cap..."});let{was:p,capAlertsId:i}=await R(s,a),t=n=>n===null?"no default cap":`a default cap of ${I(n)}`;o.emit({type:"step",step:g,status:"ok",message:`${s.organization.name}: ${t(a)}`,data:{cap:a,was:p}});let r=[a===p?`${s.organization.name} had ${t(a)} already. Nothing changed.`:`${s.organization.name}: ${t(a)} (was ${t(p)}).`,a===null?"Every app without a cap of its own is uncapped on the Gateway within 30 seconds; an app's own cap or --unlimited stays.":`Every app without a cap or --unlimited of its own is held to it on the Gateway within 30 seconds; past it, ${z}`],c=V(i);c&&r.push(c.message),o.emit({type:"done",message:r.join(`
-`),display:[r[0],...r.slice(1).map(n=>d.dim(n))].join(`
-`),data:{organization:s.organization,cap:a,was:p,capAlerts:c}})}export{me as appAccess,Q as appAccessCommand,de as appCap,le as appSet,ce as apps,ue as capDefault,q as listApps,X as setCap,Y as setDefaultCap,B as updateApp};

package/dist/chunk-EGEWRFVY.js

@@ -1 +0,0 @@
-import{r as p,s as u,u as f,v as d}from"./chunk-JYKRUS5C.js";import{Hb as a,bc as i,cc as c}from"./chunk-LYNBZ7RV.js";var l=20,g=10;async function y(n){let r=new Map;for(let e=1;e<=g;e+=1){let o=await i(n,{plane:"account",args:["hyperdrive","list","--per-page",String(l),"--page",String(e)]},d),t=r.size;for(let s of o)r.set(s.id,s);if(o.length<l||r.size===t)break}return[...r.values()]}async function H(n,r){return(await y(n)).find(e=>e.name===r)??null}async function b(n,r,e,o="off"){return(await i(n,{plane:"account",files:{"hyperdrive.json":{name:r,origin:e,...o==="off"?{caching:{disabled:!0}}:{}}},args:s=>["hyperdrive","create","--body",`@${s["hyperdrive.json"]}`]},f)).id}async function P(n,r,e){let o={...e.origin?{origin:e.origin}:{},...e.caching?{caching:{disabled:e.caching==="off"}}:{}};await i(n,{plane:"account",files:{"hyperdrive.json":o},args:t=>["hyperdrive","update",r,"--body",`@${t["hyperdrive.json"]}`]},f)}async function k(n,r){await n.run({plane:"account",mode:"json",args:["hyperdrive","delete",r,"--force"]})}function x(n,r){return n.caching?.disabled===!0==(r==="off")}function R(n,r){let e=n.origin;return e?.host===r.host&&(e.port??null)===r.port&&e.database===r.database&&e.user===r.user}var v=100,w=50;async function S(n,r){try{return await i(n,{plane:"account",args:["workflows","get",r]},p)}catch(e){if(a(e,"not_found"))return null;throw e}}function j(n,r){return c(n,["workflows","list","--search",r],u,{perPage:v,maxPages:w})}async function C(n,r){await n.run({plane:"account",mode:"json",args:["workflows","delete",r,"--force"]})}async function _(n,r){try{return await C(n,r),!0}catch(e){if(a(e,"not_found"))return!1;throw e}}export{y as a,H as b,b as c,P as d,k as e,x as f,R as g,S as h,j as i,_ as j};

package/dist/chunk-FJJSSVET.js

@@ -1,33 +0,0 @@
-import{a as ir,b as or,c as sr,d as dr,f as be}from"./chunk-GKBPYVP3.js";import{b as cr,c as lr}from"./chunk-PNLU5U3P.js";import{a as rr,d as nr,e as he}from"./chunk-CZTEDWZ2.js";import{a as ar,b as pr}from"./chunk-BHMRY53V.js";import{b as Dt}from"./chunk-IFCPALVC.js";import{a as Ct}from"./chunk-WOVS3GV5.js";import{a as Et,b as At,d as me,e as It,m as St,q as Nt}from"./chunk-OM2HDWVP.js";import{a as zt,b as Bt,c as Kt,d as Ft,e as Ht}from"./chunk-J455FAEN.js";import{b as Zt,c as Qt,d as Xt,f as er,g as we,h as ye,j as tr}from"./chunk-EGEWRFVY.js";import{d as Mt,e as xt,f as Ut,g as Wt,m as jt}from"./chunk-H6QQMY7B.js";import{n as Gt}from"./chunk-6OGVO7QK.js";import{a as Vt,b as qt,c as Yt,d as Jt,g as ge}from"./chunk-PS7S74DG.js";import{P as ct}from"./chunk-TLRM3P7V.js";import{c as Ot,e as fe,f as $t}from"./chunk-ZFCUH5PK.js";import{a as _,b as F,e as de,f as T,g as kt,h as W}from"./chunk-ZECBN24L.js";import{c as $,d as _t,g as H,h as Tt}from"./chunk-ONLNJXVQ.js";import{b as Lt}from"./chunk-6PGUCTJ6.js";import{g as pt}from"./chunk-HOUHG236.js";import{$ as gt,ga as wt,ia as yt,ja as ht,m as lt,n as dt,o as mt,p as ft,qa as bt,sa as Rt,u as ut}from"./chunk-RMF4YGD6.js";import{f as le}from"./chunk-T2GD7RHS.js";import{a as Y,e as Pt,f as ue}from"./chunk-H7PDL3X5.js";import{a as ot,b as st,h as at}from"./chunk-CCWBPAKH.js";import{$b as rt,Bb as d,Cb as Je,Db as Ze,Eb as Qe,Fb as Xe,H as Ke,Hb as K,Sb as et,Wb as ce,Yb as tt,b as ae,c as N,d as O,dc as nt,fc as it,jb as Fe,k as pe,nb as He,ob as Ve,sb as qe,tb as Ye,wc as vt}from"./chunk-LYNBZ7RV.js";import Or from"node:path";import Wr from"chalk";async function mr({whoami:e,discovery:i,out:n,offer:t}){let{deps:s}=t,o=t.accountId?["--account-id",t.accountId]:[];if(!s.interactive){let f=await Gr(e,t).catch(()=>null),u=[N,"setup","--domain",f??"<hostname>",...o].join(" ");throw new Je("install_gateway",`Install a Gateway first: ${jr(i)}
-Apps deploy behind one. Setup needs a person once, to create the owner account.`,void 0,{rerun:u,data:{accounts:i.probed,...f?{domain:f}:{}}})}let r=await le({whoami:e,flag:t.accountId,interactive:!0}),a=r.name??r.id,l=await he(s.createCf(r.id),r.id),g=`apps.${l.length===1?l[0]:await s.prompts.pickZone(l)}`;if(t.yes)at(Wr.dim(`${a} has no Gateway yet, so --yes installs one at ${g} first.`));else if(!await(t.confirm??st)(`Install a Gateway at ${g}?`,[`${a} has no Gateway yet. Apps deploy behind one, so it's installed first.`]))throw new Ze(`Cancelled. Nothing deployed.
-Apps deploy behind a Gateway. To install one elsewhere: ${[N,"setup","--domain","<hostname>",...o].join(" ")}`);return await nr({whoami:e,discovery:i,flags:{domain:g,"account-id":r.id,"force-dns":t.forceDns,yes:t.yes,verbose:t.verbose},out:n,deps:s}),ut({whoami:e,createCf:s.createCf,accountId:r.id,interactive:!0})}async function Gr(e,i){let n=await le({whoami:e,flag:i.accountId,interactive:!1});return`apps.${(await he(i.deps.createCf(n.id),n.id))[0]}`}function jr(e){let i=e.probed.map(n=>n.name??n.id);return i.length===1?`${i[0]} has none yet`:`none of ${i.join(", ")} has one yet`}import zr from"node:fs/promises";var fr=64,Br=["d1","kv","hyperdrive","r2"];function Kr(e){return Br.includes(e)}function Fr(e,i){let n=structuredClone(e),t=n.name===$.workerName,s=n.env??{};for(let[l,m]of Object.entries(s))Hr(l,m,i);i.shared&&s.EVERY_APP_ORG_ID&&(delete s.EVERY_APP_ORG_ID,s.EVERYAPP_SHARED={type:"text",value:"1"});let o=JSON.stringify([$.publicKey]),r=Re(n,l=>l===o?JSON.stringify(i.identityPublicKeys):l.replaceAll($.gatewayUrl,()=>i.gatewayUrl).replaceAll($.organizationId,()=>i.organizationId).replaceAll($.workerName,()=>i.workerName));if(t&&i.deletedDurableObjects?.length){let l=r.exports??={};for(let m of i.deletedDurableObjects){if(l[m])throw new d("APP_POLICY",`Durable Object class ${m} is both exported by the build and being deleted; declare it in everyapp.config.ts, or stop exporting it.`);l[m]={type:"durable-object",state:"deleted"}}}let a=gr(r);if(a.length>0)throw new d("INSTALL_PLACEHOLDER_LEFT",`The build of ${String(r.name)} still holds a build placeholder after installing it, at ${a.join(", ")}. Build the Worker from everyAppWorker() in cloudflare.config.ts, and leave its names, keys and ids to the deploy.`);return Vr(r),r}async function ur({cwd:e,target:i}){for await(let{file:n,config:t}of Gt(e))await zr.writeFile(n,`${JSON.stringify(Fr(t,i),null,2)}
-`)}function Hr(e,i,n){let t=String(i.type);if(!Kr(t))return;let s=_t(e);if(i[t==="d1"||t==="r2"?"name":"id"]!==s)return;let r=n.resources[t]?.[e];if(!r)throw new d("INSTALL_INPUTS_MISSING",`The build binds ${_[t]} ${e}, which the deploy didn't provision`,{fix:"declare it in everyapp.config.ts's resources"});Object.assign(i,r)}function Re(e,i){return typeof e=="string"?i(e):Array.isArray(e)?e.map(n=>Re(n,i)):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([n,t])=>[n,Re(t,i)])):e}function gr(e,i=""){let n=[$.workerName,$.organizationId,$.gatewayUrl,$.publicKey].flatMap(s=>[s,JSON.stringify(s).slice(1,-1)]),t=s=>n.some(o=>s.includes(o));return typeof e=="string"?t(e)?[i||"(root)"]:[]:e&&typeof e=="object"?Object.entries(e).flatMap(([s,o])=>{let r=i?`${i}.${s}`:s;return t(s)?[r]:gr(o,r)}):[]}function Vr(e){let i=[...Object.entries(e.env??{}),...Object.entries(e.exports??{})].filter(([,n])=>n.type==="workflow");for(let[n,t]of i){let s=String(t.name);if(s.length>fr)throw new d("WORKFLOW_NAME_TOO_LONG",`${n} would be the Workflow "${s}", longer than Cloudflare's ${fr} characters`,{fix:"shorten its binding name in everyapp.config.ts"})}}import qr from"node:fs/promises";import wr from"node:path";import{parseEnv as Yr}from"node:util";var I=".everyapp/secrets.env",A="POSTGRES_DATABASE_URL";async function yr(e){let i;try{i=await qr.readFile(wr.join(e,I),"utf8")}catch(t){if(tt(t))return{};throw t}ir(e,`${wr.dirname(I)}/`);let n={};for(let[t,s]of Object.entries(Yr(i)))s?.trim()&&(n[t]=s.trim());return n}function ve(e){return`${e}_ORIGIN_URL`}function hr(e,i,n){let t=ve(n);return e[t]?{url:e[t],variable:t}:(i.resources?.hyperdrive??[]).length===1&&e[A]?{url:e[A],variable:A}:null}var Jr={postgres:5432,postgresql:5432,mysql:3306};function J(e,i){let n=l=>new d("DATABASE_URL_INVALID",`${i} in ${I} ${l}`,{fix:"write it as postgres://<user>:<password>@<host>:<port>/<database>"}),t;try{t=new URL(e)}catch{throw n("isn't a URL")}let s=t.protocol.replace(/:$/,"");if(s!=="postgres"&&s!=="postgresql"&&s!=="mysql")throw n("isn't a postgres:// or mysql:// URL");let o=decodeURIComponent(t.pathname.replace(/^\//,"")),r=decodeURIComponent(t.username),a=decodeURIComponent(t.password);if(!t.hostname||!o||!r||!a)throw n("needs a host, a database, a user and a password");return{scheme:s,host:t.hostname,port:t.port?Number(t.port):Jr[s],database:o,user:r,password:a}}function br(e,i){let n=e;for(let t of i)t&&(n=n.split(t).join("***"));return n}async function Rr({cf:e,names:i,appId:n,out:t}){let s=[];for(let o of[...new Set(i)].sort()){try{if(await cr(e,o))continue;await lr(e,o)}catch(r){if(K(r,"already_exists"))continue;throw K(r,"r2_not_enabled")?new d("R2_NOT_ENABLED",`R2 isn't enabled in this Cloudflare account, and ${n} needs an R2 bucket (${o})
-Enable it once in the dashboard: R2 Object Storage \u2192 Get started (free until something is stored).`,{fix:"enable R2 in the Cloudflare dashboard (R2 Object Storage)",rerun:O()}):r}s.push(o),t.emit({type:"progress",step:"app.build",message:`Created R2 bucket "${o}".`,data:{bucket:o}})}return s}async function Ee({cf:e,gatewayDb:i,registration:n},t){let s=t?.name??"",o=t?.workerName??n.workerName;if(!(await F(i,n.workerName)).some(a=>a.kind==="worker"&&a.binding===s)){if(await Ot(e,o)!==null)throw new d("WORKER_NAME_TAKEN",`A Worker named ${o} already exists in this Cloudflare account
-No deploy of this app created it; it may belong to another Gateway or project.`,{fix:"delete or rename it",rerun:O()});await T(i,n.workerName,{kind:"worker",binding:s,name:o,resourceId:o})}}async function vr(e){let{cf:i,registration:n,manifest:t}=e,s=await F(e.gatewayDb,n.workerName),o=(p,w)=>Xr({...e,owned:s,kind:p,binding:w,name:ke(n,p,w),find:p==="d1"?v=>lt(i,v):v=>mt(i,v),create:p==="d1"?v=>dt(i,v):v=>ft(i,v)}),r={};for(let p of t.resources?.d1??[])r[p]={name:ke(n,"d1",p),id:await o("d1",p)};let a={};for(let p of t.resources?.kv??[])a[p]={id:await o("kv",p)};let l=t.resources?.r2??[],m=l.length?{r2:Object.fromEntries(l.map(p=>[p,{name:ke(n,"r2",p)}]))}:{},g=t.resources?.hyperdrive??[];if(g.length===0)return{d1:r,kv:a,...m};let f=new Map(g.map(({name:p})=>{let w=hr(e.secrets??{},t,p);return[p,w?J(w.url,w.variable):null]})),u={};for(let{name:p,caching:w="off"}of g)u[p]={id:await Qr({...e,owned:s,binding:p,name:Zr(n.workerName,p),origin:f.get(p)??null,caching:w})};return{d1:r,kv:a,...m,hyperdrive:u}}function Zr(e,i){return`${e}${Ye}${i.toLowerCase().replaceAll("_","-")}`}async function Qr(e){let{cf:i,gatewayDb:n,registration:t,owned:s,binding:o,name:r,origin:a,caching:l}=e,{onRecreated:m,onChanged:g}=e,{workerName:f}=t,u={kind:"hyperdrive",binding:o,name:r},p=W(u),w=ve(o),v=s.find(k=>k.kind==="hyperdrive"&&k.binding===o&&k.name===r),R=await Zt(i,r),h=async k=>{let S=a!==null&&!we(k,a),D=!er(k,l);!S&&!D||(await Xt(i,k.id,{...S?{origin:a}:{},...D||l==="off"?{caching:l}:{}}),S&&g?.(`Pointed ${p} at the database in ${I}.`),D&&g?.(l==="off"?`Turned off query caching on ${p} (Hyperdrive never invalidates a cached read when the app writes; caching: "default" in everyapp.config.ts turns it on).`:`Turned on Hyperdrive's query caching on ${p} (caching: "default").`))};if(v?.resourceId){if(R?.id===v.resourceId)return await h(R),R.id;if(R)throw Er(u,v.resourceId);m?.(p,u.kind)}else if(v){if(R)return await T(n,f,{...u,resourceId:R.id}),await h(R),R.id}else if(R){if(a&&we(R,a))return await T(n,f,{...u,resourceId:R.id}),g?.(`Adopted ${p}, which connects to the database in ${I}.`),await h(R),R.id;throw new d("RESOURCE_NAME_TAKEN",`A Hyperdrive config named "${r}" already exists in this Cloudflare account
-No deploy of this app created it.`,{fix:`to use it, set ${w} in ${I} to the URL of the database it connects to; otherwise delete or rename it`,rerun:O()})}if(!a)throw new d("HYPERDRIVE_ORIGIN_MISSING",`${o} needs the database its Hyperdrive config connects to
-Creating the config needs its URL.`,{fix:`set ${w} (or POSTGRES_DATABASE_URL, when it is the app's only config) in ${I} to postgres://<user>:<password>@<host>:<port>/<database>`,rerun:O()});return kr(e,u,()=>Qt(i,r,a,l))}function ke(e,i,n){let t=e.resources[i][n];if(!t||qe(t))throw new d("RESOURCE_NAME_MISSING",`The Gateway assigned no usable ${_[i]} name for binding ${n}`,{rerun:`${N} setup`,rerunNote:"to upgrade the Gateway"});return t}async function Xr(e){let{gatewayDb:i,registration:n,owned:t,kind:s,binding:o,name:r,find:a,create:l,onRecreated:m}=e,{workerName:g}=n,f={kind:s,binding:o,name:r},u=t.find(w=>w.kind===s&&w.binding===o&&w.name===r),p=await a(r);if(u?.resourceId){if(p===u.resourceId)return p;if(p)throw Er(f,u.resourceId);m?.(W(f),s)}else if(u){if(p)return await T(i,g,{...f,resourceId:p}),p}else if(p)throw new d("RESOURCE_NAME_TAKEN",`A ${_[s]} named "${r}" already exists in this Cloudflare account
-No deploy of this app created it; it may belong to another Gateway, app or project.`,{fix:"delete or rename it",rerun:O()});return kr(e,f,()=>l(r))}async function kr({gatewayDb:e,registration:i,onCreated:n},t,s){let{workerName:o}=i;await T(e,o,{...t,resourceId:null});let r;try{r=await s()}catch(a){throw K(a,"already_exists")?(await kt(e,o,{kind:t.kind,binding:t.binding}),new d("RESOURCE_NAME_TAKEN",`${W(t)} was created by someone else while this deploy was creating it`,{fix:"delete or rename it",rerun:O()})):a}return await T(e,o,{...t,resourceId:r}),n?.(W(t),t.kind),r}function Er(e,i){return new d("RESOURCE_REPLACED",`${W(e)} isn't the one this app created
-That one (${i}) was deleted, and this one was created by someone else since.`,{fix:"delete or rename it",rerun:O()})}function Ae(e,i){return(i.resources?.workflows??[]).map(n=>({binding:n.name,className:n.className,name:Tt(e,n.name),worker:n.worker?H(e,n.worker):e}))}async function Ar({cf:e,workerName:i,names:n}){for(let t of n){let s=await ye(e,t);if(s&&s.script_name!==i)throw new d("WORKFLOW_NAME_TAKEN",`A Workflow named "${t}" already exists in this Cloudflare account
-It runs on Worker ${s.script_name??"(unknown)"}, not ${i}; deploying would take it over.`,{fix:"delete or rename it",rerun:O()})}}async function Ir({cf:e,workerName:i,previousManifest:n,names:t}){let s=Fe.safeParse(n);if(!s.success)return[];let o=[];for(let r of Ae(i,s.data))t.includes(r.name)||(await ye(e,r.name))?.script_name===r.worker&&o.push(r);return o}import{execa as en}from"execa";var tn=10*6e4;function Z({packageName:e,binName:i,env:n={},missing:t}){return async({args:s,cwd:o,env:r})=>{let a;try{a=(await et(o,e,i)).binPath}catch{throw t()}let l=await en(process.execPath,[a,...s],{cwd:o,env:{NODE_NO_WARNINGS:"1",...n,...r},stdin:"ignore",reject:!1,timeout:tn});return{exitCode:l.timedOut?124:l.exitCode??1,stdout:String(l.stdout??""),stderr:String(l.stderr??"")}}}async function Q({run:e,args:i,cwd:n,databaseUrl:t,reasonPatterns:s,failed:o}){let{password:r}=J(t,A),a=await e({args:i,cwd:n,env:{[A]:t}});if(a.exitCode===0)return a.stdout;let m=br(`${a.stderr}
-${a.stdout}`,[t,r,encodeURIComponent(r)]).split(`
-`).map(f=>f.trim()).filter(Boolean),g=s.map(f=>m.find(u=>f.test(u))).find(f=>f!==void 0);throw o(g??m.at(-1)??`exit ${a.exitCode}`)}function rn(){return Z({packageName:"drizzle-kit",binName:"drizzle-kit",missing:()=>new d("DRIZZLE_KIT_MISSING",`Postgres migrations need drizzle-kit, which isn't installed
-Nothing was migrated or uploaded.`,{fix:"add drizzle-kit to devDependencies, then deploy again"})})}async function Sr({cwd:e,databaseUrl:i,config:n,run:t=rn()}){await Q({run:t,args:["migrate",...n?["--config",n]:[]],cwd:e,databaseUrl:i,reasonPatterns:[/error/i],failed:s=>new d("MIGRATION_FAILED",`drizzle-kit couldn't migrate the Postgres database
-${s}. Nothing was uploaded.`,{fix:`check ${A} in ${I} and the migrations`})})}function nn(){return Z({packageName:"prisma",binName:"prisma",env:{PRISMA_HIDE_UPDATE_MESSAGE:"1"},missing:()=>new d("PRISMA_MISSING",`Prisma migrations need prisma, which isn't installed
-Nothing was migrated or uploaded.`,{fix:"add prisma to devDependencies, then deploy again"})})}async function Nr({cwd:e,databaseUrl:i,config:n,run:t=nn()}){return[...(await Q({run:t,args:["migrate","deploy",...n?["--config",n]:[]],cwd:e,databaseUrl:i,reasonPatterns:[/\bP\d{4}\b/,/error/i],failed:o=>new d("MIGRATION_FAILED",`prisma migrate deploy couldn't migrate the Postgres database
-${o}. Nothing was uploaded.`,{fix:`check ${A} in ${I}, prisma.config.ts (its datasource reads it) and the migrations`})})).matchAll(/^Applying migration `([^`]+)`/gm)].map(o=>o[1])}var on=new Set(["pending","binding"]);async function $r(e){let i={rollback:null};try{return await sn(e,i)}catch(n){throw Qe(n,i.rollback)}}async function sn(e,i){let{cwd:n,out:t}=e,s=e.interactive??ot(e.json??!1),o=e.release,r=o?.manifest??e.manifest??await Y(n),a=o?.dir??n;o&&cn(r);let l=r.migrations?.dialect==="postgresql",m=l||r.resources?.hyperdrive?.length?await yr(n):{};if(l&&!m[A])throw new d("POSTGRES_URL_MISSING",`${r.id} needs a Postgres URL to migrate its database
-Format: postgres://<user>:<password>@<host>:<port>/<database>`,{fix:`set ${A} in ${I}, then deploy again`});let g=o?null:await pr(n);if(!o&&!g)throw new d("MISSING_CLOUDFLARE_CONFIG",ar);g&&!g.usesEveryAppWorker&&t.emit({type:"warning",code:"NONSTANDARD_CLOUDFLARE_CONFIG",message:`cloudflare.config.ts doesn't use everyAppWorker()
-The deploy checks the Worker it builds against the app policy.`});let f=e.offerInstall,u=zt(e.reconcile,t,e.verbose);t.emit({type:"step",step:"app.connect",status:"start",message:"Finding your Gateway..."});let{cf:p,accountId:w,accountName:v,databaseId:R,db:h,install:k,gatewayUrl:S,deployer:D}=await Rt({gateway:e.gateway,accountId:e.accountId,interactive:s,login:{json:e.json,out:t,step:"app.login"},createCf:e.createCf,onNoGateway:f?({whoami:x,discovery:re})=>mr({whoami:x,discovery:re,out:t,offer:{accountId:e.accountId,yes:f.yes,confirm:f.confirm,forceDns:e.forceDns,verbose:e.verbose,deps:{...rr({gateway:u,interactive:s}),...e.createCf?{createCf:e.createCf}:{},...f.setup}}}):void 0});t.emit({type:"step",step:"app.connect",status:"ok",data:{gatewayUrl:S}});let Ie=await Ct(h,k);pn(r,Ie,S);let[Dr,Se]=await Promise.all([gt(h),yt(h,r.id)]),Ne=!Se||on.has(Se.status);t.emit({type:"step",step:"app.deploy",status:"ok",message:`Deploying ${r.id}${o?` ${o.release.version} from ${be(o.origin)}`:""} to ${S}.`,data:{appId:r.id,organizationName:Dr?.organization.name??v,firstDeploy:Ne,gatewayUrl:S,gatewayHost:new URL(S).host,...o?{version:o.release.version,origin:be(o.origin),release:{version:o.release.version,gitSha:o.release.gitSha,origin:o.origin,sha256:o.release.sha256}}:{}}}),await jt(k,u.source);let Oe=k.jwtPublicKey;if(!Oe)throw new d("IDENTITY_KEY_UNKNOWN",`The Gateway is missing its sign-in public key
-App Workers need it to check who is signed in.`,{fix:"restore JWT_PUBLIC_KEY as in https://github.com/every-app/every-app/blob/main/docs/runbooks/key-rotation.md"});let{plan:E,organization:L,hasOwner:Pr,deployerGranted:_r}=await Bt(h,{manifest:r,install:k,deployer:D,accountName:v}),C=E.app.hostname,y=E.app.workerName,$e=E.kind!=="existing",Ce=Ve(r,E.app.tier);if(Ce.length>0)throw new d("TIER_POLICY",`${r.id} can't be deployed as configured
-${Ce.join(`
-`)}`,{fix:"change everyapp.config.ts, then deploy again"});let X=nt(r),ee=it(r);t.emit({type:"step",step:"app.register",status:"ok",message:`${$e?"Registered":"Updating"} ${r.id} as ${y} at https://${C} (${E.app.status}).`,data:{appId:r.id,workerName:y,hostname:C,status:E.app.status,existingApp:!$e,firstDeploy:Ne,defaultAccess:E.app.isDefault,deployerAccess:_r,hasOwner:Pr,publicRoutes:X,mcp:ee,scope:E.app.scope,organizationId:L.id,organizationName:L.name,gatewayUrl:S}});let{outsideBase:G,newHost:De}=await Mt({cf:p,out:t,install:k,hostname:C,forceDns:e.forceDns,cfAsks:s&&t.verbose}),j=await pt({db:h,out:t},{workerName:y,appId:r.id,purpose:"app.deploy"}),z,te,V=[];try{let x=ln(E,r,e.allowDeleteDurableObjectData??!1),re=await dn({cf:p,plan:E,workerName:y,manifest:r,allowDelete:e.allowDeleteWorkflows??!1}),Te=!1,ne={cf:p,gatewayDb:h,registration:{workerName:y,resources:E.resources},onCreated:(c,b)=>{t.emit({type:"progress",step:"app.resources",message:`Created ${c}.`}),b==="hyperdrive"&&(Te=!0)},onRecreated:(c,b)=>t.emit({type:"warning",code:"RESOURCE_RECREATED",step:"app.resources",message:`The ${b==="d1"?"database":_[b]} ${r.id} used before is gone; creating a new, empty one
-${c} no longer exists in this Cloudflare account.`}),onChanged:c=>t.emit({type:"progress",step:"app.resources",message:c})},P=(r.workers??[]).map(c=>({name:c.name,workerName:H(y,c.name)}));t.emit({type:"step",step:"app.resources",status:"start",message:"Preparing the app's resources..."}),await Ee(ne);for(let c of P)await Ee(ne,c);let U=await ht(h,E.app.id),ie=ge(r).receives;!ie&&U.inbound.length>0&&t.emit({type:"warning",code:"EMAIL_INBOUND_UNDECLARED",step:"app.email",message:`everyapp.config.ts no longer declares inbound email; removing the app's mail routes
-Its addresses (${U.inbound.join(", ")}) stay on the Gateway until you clear them.`,data:{rerun:`${N} email unset inbound`}});let B=await Vt({cf:p,gatewayDb:h,accountId:w,workerName:y,addresses:ie?U.inbound:[],interactive:s,enableRouting:e.enableEmailRouting,confirm:e.confirm}),Le=await vr({...ne,manifest:r,secrets:m});if(t.emit({type:"step",step:"app.resources",status:"ok",message:"The app's resources are ready."}),Te){let c=r.resources?.hyperdrive?.some(b=>b.caching==="default")?"default":"off";t.emit({type:"step",step:"app.hyperdrive",status:"ok",message:"Created the app's Hyperdrive config.",data:{caching:c}})}!o&&r.install!==!1&&(t.emit({type:"step",step:"app.install",status:"start",message:"Installing dependencies..."}),await(e.installDeps??rt)({cwd:n,description:"Installing dependencies...",install:r.install,verbose:e.verbose??!1}),t.emit({type:"step",step:"app.install",status:"ok"}));let Me={workerName:y,organizationId:L.id,gatewayUrl:S,identityPublicKeys:[Oe],resources:Le,deletedDurableObjects:x,helperWorkers:P.map(c=>c.workerName),declared:r.resources};o||(t.emit({type:"step",step:"app.build",status:"start",message:"Building..."}),await sr({cwd:n,cf:p,buildCommand:r.build,verbose:e.verbose??!1})),await ur({cwd:a,target:Me});let{workflows:xe,helperWorkflows:Ue,r2Buckets:Tr}=await dr({cwd:a,inputs:Me});await Rr({cf:p,names:Tr,appId:r.id,out:t});for(let c of[{workerName:y,names:xe},...P.map(b=>({workerName:b.workerName,names:Ue[b.workerName]??[]}))])await Ar({cf:p,...c});t.emit({type:"step",step:"app.build",status:"ok",message:`${o?"Installed the release":"Built the app"} and checked its Worker${P.length?"s":""}.`,data:{release:o!==void 0,workflows:[...xe,...Object.values(Ue).flat()]}}),o?t.emit({type:"progress",step:"app.schema",message:`The release's publisher checked its migrations against its schema when it packed ${r.id} ${o.release.version}.`}):await or({cwd:n,manifest:r,out:t});let Lr=(await F(h,y)).filter(c=>c.kind==="worker"),We=c=>Lr.find(b=>b.binding===c)?.versionId,Mr={question:"Replace the version that's serving?",effect:"Migrations run first."};for(let c of[{workerName:y,shownAs:r.id,recordedVersionIds:[E.versionId,We("")]},...P.map(b=>({workerName:b.workerName,shownAs:`${r.id}'s ${b.name} Worker`,recordedVersionIds:[We(b.name)]}))])await $t({cf:p,...c,interactive:s,confirm:e.confirm,change:Mr});await j.check(),i.rollback=await mn({cf:p,out:t,cwd:a,manifest:r,resources:Le,accountId:w,registry:h,workerName:y,restoreCommand:`${N} db restore${o?` ${r.id}`:""}`,appSecrets:m,drizzleKit:e.drizzleKit,prisma:e.prisma});let Ge={GATEWAY_URL:S,EVERY_APP_ORG_ID:L.id};for(let c of P)await j.check(),t.emit({type:"step",step:"app.helper",status:"start",message:`Uploading ${c.workerName}...`,data:{name:c.name,workerName:c.workerName}}),await fe({cf:p,cwd:a,workerName:c.workerName,buildOutputWorker:c.workerName,accountId:w,message:`everyapp ${ae} ${r.id} ${c.name}`,secrets:Ge,interactive:s,attach:t.verbose,out:t,step:"app.helper",onUploaded:b=>de(h,y,b,c.name)}),t.emit({type:"step",step:"app.helper",status:"ok",message:`Uploaded ${c.workerName}.`,data:{name:c.name,workerName:c.workerName}});await j.check(),t.emit({type:"step",step:"app.upload",status:"start",message:`Uploading ${y}...`});let je=await fe({cf:p,cwd:a,workerName:y,accountId:w,message:`everyapp ${ae} ${r.id}`,secrets:Ge,interactive:s,attach:t.verbose,out:t,step:"app.upload",onUploaded:c=>de(h,y,c)});if(!je.versionId)throw new d("VERSION_UNKNOWN",`Cloudflare reports no version for ${r.id} after the upload`,{data:{workerName:y}});z=je.versionId,t.emit({type:"step",step:"app.upload",status:"ok",message:`Uploaded version ${z}.`,data:{versionId:z}});for(let c of re)await tr(p,c.name),t.emit({type:"step",step:"app.workflows",status:"ok",message:`Deleted the Workflow ${c.binding} (${c.name}) with its instances.`,data:{binding:c.binding,name:c.name}});let ze=ge(r).sends&&k.deploymentMode!=="hosted";if(B){await j.check(),t.emit({type:"step",step:"app.email",status:"start",message:`Routing ${r.id}'s mail...`,data:{removing:B.routes.length===0}});let{routed:c,removed:b}=await qt({cf:p,gatewayDb:h,plan:B,onProgress:se=>t.emit({type:"progress",step:"app.email",message:se})}),q={appId:r.id,workerName:y,senders:U.senders,routed:c,removed:b,sendersSettable:ze},Be=q.sendersSettable?Jt(q.routed,q.senders):[];t.emit({type:"step",step:"app.email",status:"ok",message:Yt(q),data:{addresses:c,removed:b,enabled:B.enable.map(({domain:se})=>se),...Be.length>0?{replyHint:`To reply from ${Be.join(", ")}, set up Email Sending, then: ${N} email set --sender`}:{}}})}!B&&ie&&U.inbound.length===0&&(t.emit({type:"step",step:"app.email",status:"skip",message:`${r.id} receives no mail yet.`}),V.push({command:`${N} email set --inbound <address>`,note:`routes mail to ${r.id}`})),ze&&U.senders.length===0&&V.push({command:`${N} email set --sender '*@<domain>'`,note:`lets ${r.id} send as your domain`});let xr=(E.previousManifest?.workers??[]).map(c=>String(c.name)).filter(c=>!P.some(b=>b.name===c));for(let c of xr)t.emit({type:"warning",code:"HELPER_WORKER_KEPT",step:"app.upload",message:`Helper Worker ${c} is no longer in everyapp.config.ts, but it still runs
-Its Worker is ${H(y,c)}.`,data:{fix:"delete that Worker in the Cloudflare dashboard"}});let oe=await At(p,y).catch(c=>(t.emit({type:"progress",step:"app.secrets",message:`Couldn't list ${y}'s secrets: ${Xe(c).split(`
-`)[0]}`}),null));te=await wt(h,E.app.id,{versionId:z,manifest:r,actor:D.actor,email:D.email,source:o?"release":"cli",...oe?{secretNames:oe}:{}});let Ur=await an({cf:p,manifest:r,appId:r.id,secretNames:oe,out:t,next:V,providers:Ie});await Dt(h,{appRowId:E.app.id,setup:Ur,deployer:D},t)}finally{await j.release()}await Kt({cf:p,db:h,databaseId:R,out:t,accountId:w,appId:r.id,workerName:y,publishHost:De,interactive:s,forceDns:e.forceDns,seams:{...e.reconcile,openRelease:u.openRelease,source:u.source},verb:"deploy"});let M=`https://${C}`,Pe=!G&&(e.waitForLive??!0),_e=await Ft({wait:Pe,db:h,appRowId:E.app.id,appId:r.id,hostname:C,out:t,seams:e.live,message:`${r.id} is live at ${M}.`,verb:"deploy"});if(!_e){let x=G?"outside-base":Pe?void 0:De?"certificate":"first-visit";t.emit(te==="active"&&!G?{type:"step",step:"app.live",status:"ok",message:`${r.id} is live at ${M}.`,data:{hostname:C,url:M}}:{type:"step",step:"app.live",status:"skip",message:`${r.id} isn't live yet: ${M}.`,data:{hostname:C,url:M,...x?{reason:x}:{}}})}return await ct({cf:p,db:h,install:k,out:t},{appId:r.id,surface:{publicRoutes:X.length>0,mcp:ee!==null}}),G&&t.emit({type:"warning",code:"APP_HOST_OUTSIDE_BASE",step:"app.domain",message:`${C} isn't one label below ${k.appBaseDomain}
-The Gateway only serves names directly under ${k.appBaseDomain}, so ${r.id} can't be reached.`}),{liveUrl:M,gatewayUrl:S,organizationId:L.id,organizationName:L.name,hostname:C,workerName:y,versionId:z,live:_e||te==="active"&&!G,publicRoutes:X,mcp:ee,next:V}}async function an({cf:e,manifest:i,appId:n,secretNames:t,out:s,next:o,providers:r}){if(!It(i,r))return me({manifest:i,appId:n,gatewayNames:[],secretNames:[],lookup:r}).setup;let a=await Et(e).catch(()=>null),{setup:l}=me({manifest:i,appId:n,gatewayNames:a,secretNames:t,lookup:r});if(l.ready||!l.command)return l;let m=Nt(l),g=l.unmet.find(f=>f.why);return s.emit({type:"warning",code:"APP_NEEDS_SETUP",step:"app.secrets",message:[`${n} won't open until ${pe(m)} ${m.length===1?"is":"are"} set`,...g?[St(g)[0]]:[]].join(`
-`),data:{setup:l}}),o.push({command:l.command.command,note:`asks for each; ${n} opens once they are set`}),l}function pn(e,i,n){let t=Object.keys(e.capabilities??{}).filter(s=>!i.get(s));if(t.length>0){let s=Ke(i);throw new d("CAPABILITY_UNKNOWN",[`${e.id} lists ${pe(t)} under capabilities, which ${n.replace(/^https:\/\//,"")} doesn't offer`,`Neither the built-in catalog nor the providers registered on this Gateway ${t.length===1?"has it":"have them"}. It offers: ${s.join(", ")}.`].join(`
-`),{fix:`register ${t.length===1?"it":"each"} with ${N} provider add <spec.json or https URL> (or fix the id in everyapp.config.ts), then deploy again`,data:{unknown:t,offered:s}})}He(e,{capabilities:i})}function cn(e){if(e.migrations?.dialect==="postgresql")throw new d("RELEASE_MIGRATIONS_UNSUPPORTED",`${e.id} can't deploy from a release: its Postgres migrations need the source`,{fix:`clone it, then run pnpm install in it and this checkout's ${N} deploy from its directory`})}function ln(e,i,n){let t=new Map((i.resources?.durableObjects??[]).map(o=>[o.className,o.worker]));for(let o of e.previousManifest?.resources?.durableObjects??[]){let r=String(o.className),a=o.worker?String(o.worker):void 0;if(t.has(r)&&t.get(r)!==a)throw new d("DURABLE_OBJECT_MOVED",`${r} can't move to another Worker
-A Durable Object's data can't follow it.`,{fix:"give the class a new name in everyapp.config.ts"});if(!t.has(r)&&a)throw new d("HELPER_DURABLE_OBJECT_REMOVED",`The helper Worker ${a} still defines ${r}
-Removing a helper Worker's Durable Object class isn't supported yet.`,{fix:`keep declaring ${r} in everyapp.config.ts`})}let s=(e.previousManifest?.resources?.durableObjects??[]).map(o=>String(o.className)).filter(o=>!t.has(o));if(s.length>0&&!n){let o=s.length===1;throw new d("DURABLE_OBJECT_REMOVED",`Deploying would delete ${o?`${s[0]}'s data`:`the data of ${s.join(", ")}`} for good
-everyapp.config.ts no longer declares the Durable Object class${o?"":"es"} ${s.join(", ")}.`)}return s}async function dn({cf:e,plan:i,workerName:n,manifest:t,allowDelete:s}){let o=await Ir({cf:e,workerName:n,previousManifest:i.previousManifest,names:Ae(n,t).map(r=>r.name)});if(o.length>0&&!s){let r=o.length===1;throw new d("WORKFLOW_REMOVED",`Deploying would delete the Workflow${r?"":"s"} ${o.map(a=>a.binding).join(", ")} and ${r?"its":"their"} instances
-everyapp.config.ts no longer declares ${r?"it":"them"}. Renaming a binding renames its Workflow.`)}return o}async function mn({cf:e,out:i,cwd:n,manifest:t,resources:s,accountId:o,registry:r,workerName:a,restoreCommand:l,appSecrets:m,drizzleKit:g,prisma:f}){if(t.migrations?.dialect==="postgresql")return await fn({out:i,cwd:n,manifest:t,appSecrets:m,drizzleKit:g,prisma:f}),null;let u=t.resources?.d1??[];if(u.length===0)return null;let p=Pt(u,t.migrations),w=s.d1?.[p]?.id,v=Or.resolve(n,ue(t));if(!w||!await ce(v))return Cr(i),null;i.emit({type:"step",step:"app.migrations",status:"start",message:"Migrating the database..."});let R=await xt({cf:e,databaseId:w,accountId:o,dir:v,registry:r,target:Lt(a),restoreCommand:l});return i.emit({type:"step",step:"app.migrations",status:"ok",message:R.applied.length>0?`Applied ${R.applied.join(", ")}.${Ut(R.rollback)}`:"The app's database is up to date.",data:Wt(R)}),R.rollback}async function fn({out:e,cwd:i,manifest:n,appSecrets:t,drizzleKit:s,prisma:o}){let r=n.migrations?.engine==="prisma"?"prisma":"drizzle",a=r==="drizzle"?ue(n):n.migrations?.dir;if(a!==void 0&&!await ce(Or.resolve(i,a))){Cr(e);return}e.emit({type:"step",step:"app.migrations",status:"start",message:"Migrating the Postgres database...",data:{dialect:"postgresql",engine:r}});let l={cwd:i,databaseUrl:t[A],config:n.migrations?.config},m;r==="prisma"?m=await Nr({...l,...o?{run:o}:{}}):await Sr({...l,...s?{run:s}:{}}),e.emit({type:"step",step:"app.migrations",status:"ok",message:`Migrated the app's Postgres database (${r==="prisma"?"prisma migrate deploy":"drizzle-kit migrate"}).`,data:{dialect:"postgresql",engine:r,...m?{applied:m}:{}}})}function Cr(e){e.emit({type:"step",step:"app.migrations",status:"skip",message:"No migrations to apply."})}async function uo(e){await vt(e,async i=>{let n=process.cwd(),t=await $r({cwd:n,manifest:await Y(n),gateway:bt(e.gateway),accountId:e["account-id"],out:i,json:e.json,verbose:e.verbose,allowDeleteDurableObjectData:e["allow-delete-durable-object-data"],allowDeleteWorkflows:e["allow-delete-workflows"],forceDns:e["force-dns"],enableEmailRouting:e["enable-email-routing"],waitForLive:!e["no-wait"],offerInstall:{yes:e.yes}});i.emit({type:"done",...un(t)})})}function un(e){return{data:{...Ht(e),organization:e.organizationName,publicRoutes:e.publicRoutes,mcp:e.mcp,...e.next.length>0?{next:e.next}:{}}}}export{$r as a,uo as b,un as c};

package/dist/chunk-GKBPYVP3.js

@@ -1,25 +0,0 @@
-import{b as ne,e as ie,g as se,i as oe,l as ae,m as D,n as pe,o as I,r as ce,s as le}from"./chunk-6OGVO7QK.js";import{d as te,e as re,f as C}from"./chunk-H7PDL3X5.js";import{Bb as l,Gb as q,Pb as J,Qb as X,Sb as Q,Yb as Z,Zb as _,_b as ee,b as N,c as W,j as G,lb as Y,nb as H,qb as K,tb as $}from"./chunk-LYNBZ7RV.js";import{spawn as Ce,spawnSync as Ue}from"node:child_process";import F from"node:fs";import k from"node:fs/promises";import{createRequire as Be}from"node:module";import h from"node:path";import{z as v}from"zod";import Ne from"node:fs";import We from"node:path";import Ie from"node:fs/promises";import ue from"node:path";var Le=200*1024*1024,Pe=5*6e4,Te=5,je=new Set([301,302,303,307,308]);function L(e){let t=/^([\w.-]+)\/([\w.-]+)$/.exec(e.trim());if(t)return`${t[1]}/${t[2].replace(/\.git$/,"")}`;let r;try{r=new URL(e.trim())}catch{return null}if(r.protocol!=="https:"||r.hostname!=="github.com")return null;let[n,i]=r.pathname.split("/").filter(Boolean);return!n||!i?null:`${n}/${i.replace(/\.git$/,"")}`}async function he({repo:e,asset:t,tag:r,...n}){let i=L(e);if(!i)throw new l("RELEASE_NOT_FOUND",`${e} isn't a GitHub repository (https://github.com/<owner>/<repo>).`);let o=r?`https://github.com/${i}/releases/download/${encodeURIComponent(r)}/${encodeURIComponent(t)}`:`https://github.com/${i}/releases/latest/download/${encodeURIComponent(t)}`,s=await U(o,{...n,notFound:`${i} has no ${r?`release ${r}`:"published release"} with ${t} that can be downloaded without signing in (https://github.com/${i}/releases).`});if(!s.tag)throw await s.cleanup(),new l("RELEASE_DOWNLOAD_FAILED",`GitHub didn't say which release of ${i} ${o} is.`);return{...s,tag:s.tag,repo:i}}async function U(e,{fetch:t=fetch,timeoutMs:r=Pe,maxBytes:n=Le,notFound:i}={}){let o=AbortSignal.timeout(r),{response:s,current:a,tag:c}=await xe(e,t,o).catch(p=>{throw me(p,e)});if(s.status===404)throw await s.body?.cancel(),new l("RELEASE_NOT_FOUND",i??`${e} doesn't exist (404).`);if(!s.ok||!s.body)throw await s.body?.cancel(),new l("RELEASE_DOWNLOAD_FAILED",`Couldn't download ${e}: HTTP ${s.status}.`,{retryable:s.status>=500});if(Number(s.headers.get("content-length"))>n)throw await s.body.cancel(),ge(e,n);let{dir:u,cleanup:w}=await _("release-download-"),g=ue.join(u,ue.posix.basename(a.pathname)||"release.tar.gz");try{let p=await Ie.open(g,"wx",384);try{let f=0;for await(let m of s.body){if(f+=m.byteLength,f>n)throw ge(e,n);await p.write(m)}}finally{await p.close()}}catch(p){throw await s.body.cancel().catch(()=>{}),await w(),me(p,e)}return{tarball:g,tag:c,url:e,cleanup:w}}async function xe(e,t,r){let n=de(e,e),i=fe(n);for(let o=0;;o+=1){let s=await t(n.href,{redirect:"manual",credentials:"omit",signal:r,headers:{accept:"application/octet-stream"}});if(!je.has(s.status))return{response:s,current:n,tag:i};let a=s.headers.get("location");if(await s.body?.cancel(),!a||o>=Te)throw new l("RELEASE_DOWNLOAD_FAILED",`${e} redirects ${a?"too many times":"nowhere"}.`);n=de(new URL(a,n).href,e),i??=fe(n)}}function de(e,t){let r;try{r=new URL(e)}catch{throw new l("RELEASE_DOWNLOAD_FAILED",`${e} isn't a URL.`)}if(r.protocol!=="https:")throw new l("RELEASE_DOWNLOAD_FAILED",`${t} ${e===t?"isn't":`redirects to ${e}, which isn't`} an HTTPS URL.`);return r}function fe(e){if(e.hostname!=="github.com")return null;let t=/^\/[^/]+\/[^/]+\/releases\/download\/([^/]+)\/[^/]+$/.exec(e.pathname);return t?decodeURIComponent(t[1]):null}function ge(e,t){return new l("RELEASE_TOO_LARGE",`${e} is over ${Math.round(t/1024/1024)} MB, too big for a release
-A release is a few MB. Check the URL.`)}function me(e,t){if(e instanceof l)return e;let r=e.name;return new l("RELEASE_DOWNLOAD_FAILED",r==="TimeoutError"||r==="AbortError"?`Downloading ${t} timed out.`:`Couldn't download ${t}: ${e.message}`,{retryable:!0})}function P(e){return/^[a-z][a-z0-9+.-]*:\/\//i.test(e)}async function we(e,{asset:t,what:r,step:n,missing:i,out:o,fetch:s}){if(!P(e)){let u=We.resolve(e);if(!Ne.existsSync(u))throw new l("RELEASE_NOT_FOUND",i);return{tarball:u,origin:{kind:"file",path:u},cleanup:async()=>{}}}let a=B(e);o.emit({type:"progress",step:n,message:`Downloading ${r} from ${a?`${a.repo}${a.tag?` release ${a.tag}`:"'s latest release"}`:e}...`,data:{url:e}});let c,d;if(a){let u=await he({repo:a.repo,asset:t,tag:a.tag,fetch:s});c=u,d={kind:"github",repo:u.repo,tag:u.tag}}else{c=await U(e,{fetch:s});let u=c.tag?L(e):null;d=u&&c.tag?{kind:"github",repo:u,tag:c.tag}:{kind:"url",url:e}}return{tarball:c.tarball,origin:d,cleanup:c.cleanup}}function B(e){let t=L(e);if(!t||!P(e))return null;let r=new URL(e).pathname.split("/").filter(Boolean).slice(2);return r.length===0||r.length===1&&r[0]==="releases"?{repo:t}:r.length===3&&r[0]==="releases"&&r[1]==="tag"?{repo:t,tag:decodeURIComponent(r[2])}:r.length===2&&r[0]==="releases"&&r[1]==="latest"?{repo:t}:null}var M="everyapp-release.tar.gz",O="migrations",ye=h.join(".cloudflare","output"),S="v0",Fe="0.3.0",Me="0.3.0",Ee=/^(\.DS_Store|\._.*)$/;function ze(e){try{return Be(h.join(e,"package.json"))("@every-app/sdk/package.json").version??null}catch{return null}}var Ve=ne.extend({kind:v.literal("app"),appId:v.string().min(1),cliVersion:v.string(),sdkVersion:v.string().nullable(),manifest:v.record(v.string(),v.unknown())});function xt(e){switch(e.kind){case"github":return`github.com/${e.repo} (release ${e.tag})`;case"url":return e.url;case"file":return e.path;case"checkout":return"this checkout"}}function Ge(e){if(e.migrations?.engine==="prisma")throw new l("RELEASE_MIGRATIONS_UNSUPPORTED",`${e.id} migrates with Prisma, which a release can't carry
-Prisma migrations (migrations.engine "prisma") need the app's source and its Prisma CLI.`,{rerun:`${W} deploy`,rerunNote:"from the app's checkout"});if(e.migrations?.dialect==="postgresql")return C(e);let t=e.resources?.d1??[];return t.length===0?null:(re(t,e.migrations),C(e))}async function Ye(e){return(await k.readdir(e,{recursive:!0,withFileTypes:!0})).filter(t=>!t.isDirectory()).map(t=>h.relative(e,h.join(t.parentPath,t.name)).split(h.sep).join("/")).sort()}async function He(e){let t=(await Ye(e)).filter(r=>{let n=h.posix.basename(r);return n.startsWith(".dev.vars")||n.startsWith(".env")||n.endsWith(".pem")||/(^|\/)\.cloudflare\/(state|types)(\/|$)/.test(r)||/(^|\/)\.(wrangler|everyapp)(\/|$)/.test(r)});if(t.length>0)throw new l("RELEASE_LOCAL_STATE",`Refusing to pack local state or secrets into the release:
-  ${t.join(`
-  `)}`)}async function Ke(e){let t;try{t=await k.readFile(h.join(e,"meta","_journal.json"),"utf8")}catch(n){if(Z(n))return[];throw n}return(JSON.parse(t).entries??[]).map(({tag:n,when:i})=>({tag:n,when:i}))}function be(e,t){let r=Ue("git",t,{cwd:e,encoding:"utf8"});return r.status===0?r.stdout.trim():null}function qe(e){return new Promise((t,r)=>{let n=Ce("tar",e,{stdio:["ignore","ignore","pipe"],env:{...process.env,COPYFILE_DISABLE:"1"}}),i="";n.stderr.on("data",o=>i+=o.toString()),n.once("error",r),n.once("close",o=>o===0?t():r(new l("RELEASE_PACK_FAILED",`tar couldn't pack the release (exit ${o}): ${i.trim()}`)))})}async function Nt({cwd:e,manifest:t,outFile:r,cfVersion:n,builtAt:i=new Date}){let o=h.join(e,ye),s=F.existsSync(o)?(await k.readdir(o)).filter(w=>!Ee.test(w)):[];if(s.length!==1||s[0]!==S)throw new l("RELEASE_PACK_FAILED",`Expected the Build Output ${S} alone in ${o}, found ${s.length?s.join(", "):"none"}.`);let a=h.join(o,S);if(!await I(a))throw new l("RELEASE_PACK_FAILED",`The app's Build Output isn't a production build
-A release ships only one.`,{fix:"build with `cf build` (production by default)"});let c=Ge(t),{dir:d,cleanup:u}=await _("app-release-stage-");try{let w=(E,x)=>k.cp(E,h.join(d,x),{recursive:!0,dereference:!0,filter:R=>!Ee.test(h.basename(R))});await w(a,h.join(ye,S));let g=c?h.resolve(e,c):null,p=g!==null&&F.existsSync(g)&&F.statSync(g).isDirectory();p&&await w(g,O),await He(d);let f=JSON.parse(await k.readFile(h.join(e,"package.json"),"utf8").catch(()=>"{}")),m=be(e,["rev-parse","HEAD"]),A=m!==null&&!!be(e,["status","--porcelain","--","."]),j={schema:1,kind:"app",appId:t.id,version:f.version??"0.0.0",gitSha:m?`${m}${A?"-dirty":""}`:"unknown",builtAt:i.toISOString(),cfVersion:n,cliVersion:N,sdkVersion:ze(e),buildOutputVersion:S,sha256:await ie(d),migrations:p?await Ke(h.join(d,O)):[],minCli:Fe,minSdk:Me,manifest:t.migrations||p?{...t,migrations:{engine:"drizzle",...t.migrations,dir:O}}:t};return await k.writeFile(h.join(d,"release.json"),`${JSON.stringify(j,null,2)}
-`),await k.mkdir(h.dirname(r),{recursive:!0}),await k.rm(r,{force:!0}),await qe(["-czf",r,"-C",d,"."]),j}finally{await u()}}async function Je(e,{origin:t={kind:"file",path:e},version:r=N}={}){let{dir:n,manifest:i,cleanup:o}=await se(e,"app",Ve);try{oe(i,r,`${i.appId} ${i.version}`);let s;try{s=H(i.manifest,te)}catch(c){throw c instanceof Y?new l("RELEASE_INVALID",`${e} carries a manifest this everyapp refuses: ${c.message}`):c}if(s.id!==i.appId)throw new l("RELEASE_INVALID",`${e} says it is ${i.appId}, but its manifest is ${s.id}'s.`);let a=s.migrations?.dir;if(a!==void 0&&a!==O)throw new l("RELEASE_INVALID",`${e}'s manifest keeps its migrations in ${a}; a release keeps them in ${O}/.`);return{dir:n,release:i,manifest:s,origin:t,cleanup:o}}catch(s){throw await o(),s}}async function Wt(e,{out:t,fetch:r,version:n}){let i=P(e)?B(e):null,o;try{o=await we(e,{asset:M,what:"the app",step:"app.release",missing:`${e} is neither a URL nor a file
-Pass a GitHub repository URL (https://github.com/<owner>/<repo>), a release tarball's URL, or a downloaded ${M}.`,out:t,fetch:r})}catch(s){throw i&&s instanceof l&&s.code==="RELEASE_NOT_FOUND"?new l("NO_RELEASE",`${i.repo} publishes no everyapp release${i.tag?` ${i.tag}`:""}
-Its GitHub releases have no ${M}.`,{fix:`clone it, then run pnpm install in it and this checkout's ${W} deploy from its directory`}):s}try{let s=await Je(o.tarball,{origin:o.origin,version:n});return{...s,cleanup:async()=>{await s.cleanup(),await o.cleanup()}}}catch(s){throw await o.cleanup(),s}}import{rmSync as Qe}from"node:fs";import b from"node:fs/promises";import y from"node:path";import{execa as Ze}from"execa";import T from"node:fs";import Xe from"node:path";function ke(e,t){let r=Xe.join(e,".gitignore");if(!T.existsSync(r)){T.writeFileSync(r,t+`
-`);return}let n=T.readFileSync(r,"utf-8");n.split(`
-`).some(o=>o.trim()===t||o.trim()===t.replace(/\/$/,""))||T.appendFileSync(r,(n.endsWith(`
-`)?"":`
-`)+t+`
-`)}var et=["drizzle.config.ts","drizzle.config.js"],ve=12e4;async function Jt({cwd:e,manifest:t,out:r}){let n=t.migrations?.engine??"drizzle",i=t.migrations?.dialect==="postgresql",o=(g,p={})=>r.emit({type:"warning",code:"SCHEMA_CHECK_SKIPPED",step:"app.schema",message:`Can't check the schema against the migrations: ${g}${p.detail?`
-${p.detail}`:""}`,...p.fix?{data:{fix:p.fix}}:{}});if(n==="prisma"){r.emit({type:"progress",step:"app.schema",message:"To check a Prisma schema against its migrations: prisma migrate diff --from-migrations <dir> --to-schema <schema> --exit-code, with datasource.shadowDatabaseUrl set in prisma.config.ts."}),r.emit({type:"step",step:"app.schema",status:"skip",message:"Schema not checked against migrations (Prisma needs a shadow database; --verbose shows how)",data:{engine:n}});return}if(!i&&!t.resources?.d1?.length||n!=="drizzle")return;let s;try{s=(await Q(e,"drizzle-kit","drizzle-kit")).binPath}catch{o("drizzle-kit isn't installed",{fix:"add drizzle-kit to devDependencies"});return}let a=t.migrations?.config,c=await tt(e,a?[a]:et);if(!c){o(a?`no ${a} (migrations.config)`:"no drizzle.config.ts",a?{}:{detail:'An app whose drizzle config lives elsewhere sets migrations.config to its path; an app that writes its SQL by hand sets migrations.engine to "d1-sql".'});return}r.emit({type:"step",step:"app.schema",status:"start",message:"Checking the schema..."});let d=y.resolve(e,t.migrations?.dir??"drizzle");ke(e,".everyapp/"),await b.mkdir(y.join(e,".everyapp"),{recursive:!0});let u=await b.mkdtemp(y.join(e,".everyapp","schema-check-")),w=J({sync:()=>Qe(u,{recursive:!0,force:!0})});try{let g=y.join(u,"migrations");await b.cp(d,g,{recursive:!0}).catch(async E=>{if(E.code!=="ENOENT")throw E;await b.mkdir(g)});let p=new Set(await Ae(g)),f=y.join(u,"drizzle.config.ts");await b.writeFile(f,[`import config from ${JSON.stringify(c)};`,`export default { ...config, out: ${JSON.stringify(y.relative(e,g).split(y.sep).join("/"))} };`,""].join(`
-`));let m=y.join(u,"report-failure.cjs");await b.writeFile(m,["const report = console.error;","console.error = (...args) => {","  if (args.some((arg) => arg instanceof Error)) process.exitCode = 1;","  report(...args);","};",""].join(`
-`));let A=await Ze(process.execPath,["--require",m,s,"generate","--config",f],{cwd:e,stdin:"ignore",reject:!1,timeout:ve,env:{NODE_NO_WARNINGS:"1"}});if((await Ae(g)).filter(E=>!p.has(E)).length>0)throw new l("SCHEMA_DRIFT",`The schema has changes no migration covers
-drizzle-kit would write a new migration for them. Nothing was migrated or uploaded.`,{rerun:"pnpm db:generate",rerunNote:"then run this again"});if(A.failed){let E=A.stderr.split(`
-`).map(R=>R.trim()).filter(Boolean),x=E.find(R=>/^\w*Error\b/.test(R))??E.at(-1)??(A.timedOut?`no answer in ${ve/1e3} s`:`exit ${A.exitCode}`);throw new l("SCHEMA_CHECK_FAILED",`drizzle-kit couldn't compare the schema with the migrations
-${x}. Nothing was migrated or uploaded.`,{rerun:"pnpm db:generate",rerunNote:"in a terminal; it asks about renamed columns and tables"})}r.emit({type:"step",step:"app.schema",status:"ok",message:"The schema matches the migrations."})}finally{await b.rm(u,{recursive:!0,force:!0}),w()}}async function tt(e,t){for(let r of t){let n=y.join(e,r);try{if((await b.stat(n)).isFile())return n}catch{}}return null}async function Ae(e){return(await b.readdir(e,{recursive:!0,withFileTypes:!0})).filter(r=>r.isFile()&&r.name.endsWith(".sql")).map(r=>y.relative(e,y.join(r.parentPath,r.name)))}var rt=6e5,Re={EVERYAPP_BUILD:"1"};async function nr({cwd:e,cf:t,buildCommand:r,verbose:n}){if(r){await ee(r,[],{cwd:e,env:{...process.env,...Re,NODE_OPTIONS:X(process.env.NODE_OPTIONS)},shell:!0,echo:n,what:"Build",code:"BUILD_FAILED"});return}await t.run({args:["build"],plane:"project",cwd:e,mode:"text",env:Re,timeoutMs:rt,...n?{onOutput:i=>void process.stderr.write(i)}:{}}).catch(i=>{throw i instanceof q?new l("BUILD_FAILED",["Build failed","cf build's last lines:",...G(i.stdout,i.stderr).map(o=>`  ${o}`)].join(`
-`)):i})}import nt from"node:fs/promises";import z from"node:path";var it=new Set(["text","json","secret","version-metadata","assets","d1","kv","r2","durable-object","workflow","worker","hyperdrive","ai"]);function Se(e,t){return e==="EVERY_APP_GATEWAY"&&t.worker===K&&t.exportName==="AppGateway"}function V(e,t){return e===t||e.startsWith(`${t}${$}`)}function st(e,t){let{workerName:r,helperWorkers:n=[]}=t,i=[];e.name!==r&&i.push(`its name is "${e.name}", not "${r}"`),i.push(...Oe(e));let o=e.env??{};for(let a of["EVERYAPP_IDENTITY_PUBLIC_KEYS","EVERYAPP_IDENTITY_ISSUER"])o[a]?.type!=="text"&&i.push(`${a} isn't built in`);let s=o.EVERYAPP_AUDIENCE;return(s?.type!=="text"||s.value!==r)&&i.push(`EVERYAPP_AUDIENCE isn't the Worker's name ("${r}")`),i.push(..._e(o,t,(a,c)=>Se(a,c)||n.includes(String(c.worker))),...De(e.exports??{},t.deletedDurableObjects??[],r)),i}function ot(e,t,r){let n=[];return e.name!==t&&n.push(`its name is "${e.name}", not "${t}"`),n.push(...Oe(e),..._e(e.env??{},r,Se),...De(e.exports??{},[],r.workerName)),n}function Oe(e){let t=[];e.workersDev!==!1&&t.push("workersDev isn't false"),e.previewUrls!==!1&&t.push("previewUrls isn't false"),e.domains?.length&&t.push("it declares domains (apps are served through the gateway)");for(let r of e.triggers??[])r.type!=="scheduled"&&t.push(r.type==="fetch"?"it declares routes (apps are served through the gateway)":`it declares a trigger of type "${String(r.type)}" (apps may only declare cron schedules)`);return e.env?.EVERYAPP_DEV&&t.push("EVERYAPP_DEV is set, which only `everyapp dev` may do"),t}function _e(e,{workerName:t,resources:r,helperWorkers:n=[],declared:i},o){let s=[],a=new Set([t,...n]),c=new Set(Object.values(r.d1??{}).map(p=>p.id)),d=new Set(Object.values(r.kv??{}).map(p=>p.id)),u=new Set(Object.values(r.hyperdrive??{}).map(p=>p.id)),w=Object.values(r.r2??{}).map(p=>p.name),g=i?.ai??[];for(let[p,f]of Object.entries(e)){if(!it.has(String(f.type))){s.push(`${p} is a ${String(f.type)} binding, which Every App apps can't use`);continue}switch(f.type){case"worker":o(p,f)||s.push(`${p} binds Worker "${String(f.worker)}"; apps may only bind the gateway's AppGateway and, from the app's own Worker, its helper Workers`);break;case"durable-object":a.has(String(f.worker))||s.push(`${p} binds another Worker's Durable Object ("${String(f.worker)}")`);break;case"d1":c.has(String(f.id))||s.push(`${p} isn't a D1 database the deploy provisioned`);break;case"kv":d.has(String(f.id))||s.push(`${p} isn't a KV namespace the deploy provisioned`);break;case"hyperdrive":u.has(String(f.id))||s.push(`${p} isn't a Hyperdrive config the deploy provisioned`);break;case"ai":g.includes(p)||s.push(g.length>0?`${p} is a Workers AI binding, which isn't one of the app's in resources.ai (${g.join(", ")})`:`${p} is a Workers AI binding, which everyapp.config.ts doesn't declare; list it in resources.ai`);break;case"r2":{let m=String(f.name??"");w.length>0?w.includes(m)||s.push(`${p} is bucket "${m}", which isn't one of the app's buckets in resources.r2 (${w.join(", ")})`):V(m,t)||s.push(`${p} is bucket "${m}"; an app's buckets are named after its Worker (${t} or ${t}${$}<name>)`);break}case"workflow":{let m=String(f.name??"");(!a.has(String(f.worker))||!V(m,t))&&s.push(`${p} binds Workflow "${m}" of Worker "${String(f.worker)}"; an app binds only its own Workflows, named after its Worker (${t}${$}<name>)`);break}}}return s}function De(e,t,r){let n=[];for(let[i,o]of Object.entries(e))if(o.type!=="worker"){if(o.type==="workflow"){let s=String(o.name??"");V(s,r)||n.push(`Workflow ${i} is named "${s}"; an app's Workflows are named after its Worker (${r}${$}<name>)`);continue}if(o.type!=="durable-object"){n.push(`export ${i} is a ${String(o.type)}, which Every App apps can't declare`);continue}switch(o.container!==void 0&&n.push(`Durable Object class ${i} is backed by a container, which Every App apps can't run`),o.state??"created"){case"created":case"renamed":break;case"deleted":t.includes(i)||n.push(`Durable Object class ${i} is marked deleted, which deletes its data; remove it from everyapp.config.ts and deploy with --allow-delete-durable-object-data instead`);break;case"transferred":n.push(`Durable Object class ${i} would move its data to Worker "${String(o.transferredTo)}"`);break;case"expecting-transfer":n.push(`Durable Object class ${i} would take the data of Worker "${String(o.transferFrom)}"'s class`);break;default:n.push(`Durable Object class ${i} has state "${o.state}", which everyapp doesn't deploy`)}}return n}async function ur({cwd:e,inputs:t}){if(!await I(z.join(e,ae)))throw new l("APP_POLICY","The app's Build Output isn't a production build. The manifest's build command must run `cf build` (production by default).");let r=await pt(e),n=t.helperWorkers??[],i=[],o=r.get(D);if(!o)throw new l("APP_POLICY","The app's Build Output has no default Worker. Build it from everyAppWorker() in cloudflare.config.ts.");i.push(...st(o.config,t));for(let[a,{config:c}]of r){if(a===D)continue;let d=String(c.name);if(!n.includes(d)){i.push(`the build has a Worker "${d}" that everyapp.config.ts doesn't declare in workers`);continue}i.push(...ot(c,d,t).map(u=>`${d}: ${u}`))}for(let a of n)[...r.values()].some(({config:c})=>c.name===a)||i.push(`the build has no Worker ${a}, which everyapp.config.ts declares; add it to the Vite plugin's auxiliaryWorkers with everyAppAuxiliaryWorker()`);if(i.length>0)throw new l("APP_POLICY",`The built Worker can't be deployed as an Every App app:
-  - ${i.join(`
-  - `)}
-Build it from everyAppWorker() in cloudflare.config.ts.`);let s={};for(let[a,{config:c,directory:d}]of r){if(a!==D){let u=String(c.name);s[u]=$e(c,u)}if(c.manifest){let u={...c.manifest.modules??{}};for(let w of await le(z.join(d,"bundle")))u[w]={type:"sourcemap"};c.manifest={...c.manifest,modules:u}}ce(c),await nt.writeFile(z.join(d,"worker.config.json"),`${JSON.stringify(c,null,2)}
-`)}return{workflows:$e(o.config,t.workerName),helperWorkflows:s,r2Buckets:[...new Set([...r.values()].flatMap(({config:a})=>at(a)))].sort()}}function at(e){let t=e.env??{};return Object.values(t).filter(r=>r?.type==="r2"&&typeof r.name=="string").map(r=>r.name)}function $e(e,t){let r=[...Object.values(e.exports??{}).filter(n=>n.type==="workflow").map(n=>String(n.name)),...Object.values(e.env??{}).filter(n=>n.type==="workflow"&&n.worker===t).map(n=>String(n.name))];return[...new Set(r)]}async function pt(e){let t=new Map;for await(let{name:r,config:n,directory:i}of pe(e))t.set(r,{config:n,directory:i});return t}export{ke as a,Jt as b,nr as c,ur as d,M as e,xt as f,Nt as g,Wt as h};

package/dist/chunk-JYKRUS5C.js

@@ -1 +0,0 @@
-import{z as t}from"zod";var a=t.array(t.looseObject({name:t.string(),status:t.string()})),c=t.looseObject({authenticated:t.boolean(),authSource:t.string().nullish(),tokenValid:t.boolean().nullish(),email:t.string().nullish(),accounts:t.array(t.looseObject({id:t.string(),name:t.string().nullish()})).nullish()}),o=t.looseObject({uuid:t.string(),name:t.string()}),p=t.array(o),g=t.array(t.looseObject({Name:t.string()})),e=t.looseObject({duration:t.number().nullish(),changes:t.number().nullish()}).nullish(),O=t.array(t.looseObject({results:t.array(t.record(t.string(),t.unknown())).nullish(),success:t.boolean().nullish(),meta:e})),h=t.looseObject({bookmark:t.string()}),y=t.looseObject({previous_bookmark:t.string().nullish()}),n=t.looseObject({id:t.string(),title:t.string()}),b=t.array(n),r=t.looseObject({id:t.string().nullish(),created_on:t.string().nullish(),versions:t.array(t.looseObject({version_id:t.string(),percentage:t.number()}))}),m=t.union([t.looseObject({deployments:t.array(r)}),t.array(r)]).transform(s=>Array.isArray(s)?s:s.deployments),d=t.array(t.looseObject({id:t.string().nullish(),name:t.string(),references:t.looseObject({domains:t.array(t.looseObject({id:t.string().nullish(),hostname:t.string(),zone_id:t.string().nullish(),zone_name:t.string().nullish()})).nullish()}).nullish()})),j=t.looseObject({buckets:t.array(t.looseObject({name:t.string()})).nullish()}).transform(s=>s.buckets??[]),x=t.union([t.looseObject({result:t.array(t.looseObject({name:t.string()}))}),t.array(t.looseObject({name:t.string()}))]).transform(s=>Array.isArray(s)?s:s.result),f=t.array(t.looseObject({id:t.string(),name:t.string(),status:t.string().nullish()})),k=t.array(t.looseObject({id:t.string(),name:t.string(),type:t.string(),content:t.string().nullish()})),D=t.array(t.looseObject({id:t.string(),type:t.string().nullish(),hosts:t.array(t.string()).nullish(),status:t.string().nullish()})),i=t.looseObject({name:t.string(),script_name:t.string().nullish(),class_name:t.string().nullish(),instances:t.record(t.string(),t.number()).nullish()}),L=t.array(i),W=t.array(t.looseObject({results:t.looseObject({columns:t.array(t.string()).nullish(),rows:t.array(t.array(t.unknown())).nullish()}).nullish(),meta:e})),l=t.looseObject({id:t.string(),name:t.string(),origin:t.looseObject({host:t.string().nullish(),port:t.number().nullish(),database:t.string().nullish(),user:t.string().nullish(),scheme:t.string().nullish()}).nullish(),caching:t.looseObject({disabled:t.boolean().nullish()}).nullish()}),w=t.array(l);export{a,c as b,o as c,p as d,g as e,O as f,h as g,y as h,n as i,b as j,m as k,d as l,j as m,x as n,f as o,k as p,D as q,i as r,L as s,W as t,l as u,w as v};