everyapp 0.3.0-rc.2 → 0.3.0-rc.3

package/dist/chunk-M2QQ2UD7.js

@@ -1,132 +0,0 @@
-import{$ as L,B as J,C as V,W as ce,Z as l,y as Y}from"./chunk-RMF4YGD6.js";import{e as N}from"./chunk-NFU4YFXB.js";import{Bb as m,c as E,k as M}from"./chunk-LYNBZ7RV.js";var le=`SELECT users.id AS id, users.email AS email, users.name AS name, members.role AS role
-FROM members JOIN users ON users.id = members.user_id
-WHERE members.organization_id = ?1 AND lower(users.email) = ?2
-LIMIT 1`,v=(e,n,a)=>`EXISTS (
-      SELECT 1 FROM members owners JOIN users owner ON owner.id = owners.user_id
-      WHERE owners.organization_id = ${e} AND owners.role = 'owner' AND owners.user_id <> ${n}
-        AND (owner.banned IS NULL OR owner.banned = 0 OR (owner.ban_expires IS NOT NULL AND owner.ban_expires <= ${a}))
-    )`;async function ra(e,n,a,t){let r=a.trim().toLowerCase(),i=Date.now(),[d=[],,p=[]]=await e.run([{sql:le,params:[n,r]},{sql:`UPDATE members SET role = ?3
-WHERE organization_id = ?1
-  AND user_id = (SELECT id FROM users WHERE lower(email) = ?2 LIMIT 1)
-  AND role <> ?3
-  AND NOT (
-    role = 'owner' AND ?3 <> 'owner'
-    AND NOT ${v("?1","members.user_id","?4")}
-  )`,params:[n,r,t,i]},{sql:le,params:[n,r]}]),s=ue(d[0]);if(!s)return{kind:"not_found"};if(s.role===t)return{kind:"unchanged",member:s};let o=ue(p[0])??s;return o.role===t?{kind:"changed",member:o,previousRole:s.role}:{kind:"last_owner",member:s}}function ue(e){return e?{id:String(e.id),email:String(e.email),name:String(e.name??""),role:String(e.role)}:null}import{createHash as He,randomBytes as ae,randomUUID as D}from"node:crypto";async function qe(e){let n=await L(e);if(!n||!n.hasOwner)throw new m("WORKSPACE_NOT_CLAIMED",`The Gateway has no owner yet
-The setup claim makes the workspace, named after its owner; rename it after.`,{fix:"open the Gateway in a browser and claim it, then run this again"});return n.organization}function ga(e,n){return ce(async()=>{let a=await qe(e),t=a.name!==n;return t&&await e.run([{sql:"UPDATE organizations SET name = ? WHERE id = ?",params:[n,a.id]}]),{organization:{...a,name:n},previousName:a.name,changed:t}})}var Ge=72*60*60*1e3,Be=60*60*1e3,Re=1e9,me=60,ge=255,ne=90,Ye=19,Je=e=>He("sha256").update(e).digest("hex"),x=e=>`((',' || replace(${e}, ' ', '') || ',') LIKE '%,owner,%')`,Oe=e=>`(NOT ${x(e)} OR ${v("?2","?1","?3")})`,z=`EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2 AND ${Oe("m.role")})`,$=`EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2)
-  AND NOT EXISTS (SELECT 1 FROM members mine WHERE mine.user_id = ?1 AND ${x("mine.role")}
-    AND NOT ${v("mine.organization_id","?1","?3")})`,Ve=e=>`(banned = 1 AND (ban_expires IS NULL OR ban_expires > ${e}))`;function F(e,n){let a=[];for(let t=0;t<e.length;t+=n)a.push(e.slice(t,t+n));return a}function Xe(e){let n=(e??"").split(",").map(a=>a.trim());return n.includes("owner")?"owner":n.includes("admin")?"admin":n.includes("member")?"member":null}var g=e=>Number(e??0);function H(e,n){let a=Number(e.banned??0)===1,t=e.ban_expires==null?null:Number(e.ban_expires);return{id:String(e.id),name:String(e.name??""),email:String(e.email),role:String(e.role??"member"),primaryRole:Xe(l(e.role)),deactivated:a&&(t===null||t>n),createdAt:g(e.created_at)}}function te(e,n){let a=String(e.status),t=g(e.expires_at);return{id:String(e.id),email:String(e.email),role:String(e.role??"member"),status:a,expiresAt:t,createdAt:g(e.created_at),live:a==="pending"&&t>n}}function Se(e){return{id:String(e.id),name:String(e.name),description:l(e.description),createdAt:g(e.created_at),memberCount:g(e.member_count),appCount:g(e.app_count)}}function re(e){return{id:String(e.id),appSlug:String(e.app_slug),name:String(e.name),description:String(e.description??""),status:String(e.status),scope:String(e.scope),tier:String(e.tier),hostname:l(e.hostname),everyone:Number(e.is_default??0)===1,manifest:l(e.manifest),secretNames:l(e.secret_names),accessCount:g(e.access_count)}}var q="u.id, u.name, u.email, m.role, u.banned, u.ban_expires, u.created_at",ie=`a.id, a.app_slug, a.name, a.description, a.status, a.scope, a.tier, a.hostname, a.is_default, a.manifest, a.secret_names,
-  (SELECT COUNT(DISTINCT g.user_id) FROM (
-     SELECT ua.user_id FROM user_app_access ua WHERE ua.app_row_id = a.id AND ua.organization_id = a.organization_id
-     UNION ALL
-     SELECT gm.user_id FROM group_app_access ga JOIN group_members gm ON gm.group_id = ga.group_id
-       WHERE ga.app_row_id = a.id AND ga.organization_id = a.organization_id AND gm.organization_id = a.organization_id
-   ) g JOIN members mm ON mm.user_id = g.user_id AND mm.organization_id = a.organization_id) AS access_count`,U=e=>({id:String(e.id),name:String(e.name),slug:String(e.slug)});async function Te(e,n){let a=n.trim(),[t=[],r=[]]=await e.run([{sql:`SELECT id, name, slug FROM organizations
-WHERE id = ?1 OR slug = ?1 OR lower(name) = lower(?1)
-ORDER BY created_at, id`,params:[a]},{sql:"SELECT id, name, slug FROM organizations ORDER BY created_at, id"}]),i=t.map(U),d=i.find(s=>s.id===a)??i.find(s=>s.slug===a);if(d)return d;if(i.length===1)return i[0];if(i.length>1)throw new m("ORG_AMBIGUOUS",`${i.length} organizations are named ${a}: ${M(i.map(s=>`${s.slug} (${s.id})`))}
-A name isn't unique, and any owner or admin can rename their organization; a slug or id is one organization's.`,{fix:"name it by its slug or id with --org",data:{organizations:i}});let p=r.map(U);throw new m("ORGANIZATION_NOT_FOUND",`No organization named ${a} on this Gateway${p.length>0?`
-The Gateway has: ${M(p.map(s=>`${s.slug} (${s.name})`))}.`:""}`,{fix:"name one by its slug, id or name with --org",data:{organizations:p}})}async function Ke(e,n){if(n.email===null)return{actor:n.actor,email:null,userId:null};let[a=[]]=await e.run([{sql:"SELECT id FROM users WHERE lower(email) = lower(?) AND email_verified = 1",params:[n.email]}]);return{actor:n.actor,email:n.email,userId:l(a[0]?.id)}}var De=()=>new m("ORGANIZATION_NOT_FOUND",`The Gateway has no organization yet
-Its owner creates the first one by claiming it.`,{rerun:`${E} setup`,rerunNote:"prints the owner link"});async function _a(e,n){if(n!==void 0)return Te(e,n);let a=await L(e);if(!a)throw De();return a.organization}async function Ea(e,n,a={}){let[t,r]=await Promise.all([L(e),Ke(e,n)]);if(a.org===void 0&&!t)throw De();let i=a.org===void 0?t.organization:await Te(e,a.org);return{db:e,organization:i,installOrganizationId:t?.organization.id??null,operator:r,now:a.now??Date.now()}}async function k(e,n){let a=n.trim(),[t=[]]=await e.db.run([{sql:`SELECT ${q} FROM members m JOIN users u ON u.id = m.user_id
-WHERE m.organization_id = ?1 AND (lower(u.email) = lower(?2) OR u.id = ?2)
-ORDER BY (u.id = ?2) DESC LIMIT 1`,params:[e.organization.id,a]}]),r=t[0];if(!r)throw new m("USER_NOT_FOUND",`${a} isn't a member of ${e.organization.name}`,{rerun:`${E} workspace users`,rerunNote:"lists the members and invitations"});return H(r,e.now)}async function P(e,n,{callable:a=!1}={}){let t=n.trim(),[r=[]]=await e.db.run([{sql:`SELECT ${ie} FROM apps a
-WHERE (a.organization_id = ?1${a?" OR a.scope = 'shared'":""}) AND a.status != '${N}'
-  AND (a.app_slug = ?2 OR a.id = ?2)
-ORDER BY (a.organization_id = ?1) DESC, (a.id = ?2) DESC LIMIT 1`,params:[e.organization.id,t]}]),i=r[0];if(!i)throw new m("APP_NOT_FOUND",`No app named ${t} in ${e.organization.name}`,{rerun:`${E} workspace apps`,rerunNote:"lists them"});return re(i)}async function ke(e,n){let a=n.trim(),[t=[]]=await e.db.run([{sql:`${Ce} AND (g.id = ?2 OR lower(g.name) = lower(?2)) ORDER BY (g.id = ?2) DESC LIMIT 1`,params:[e.organization.id,a]}]),r=t[0];if(!r)throw new m("GROUP_NOT_FOUND",`No group named ${a} in ${e.organization.name}`,{rerun:`${E} workspace groups`,rerunNote:"lists them"});return Se(r)}async function he(e,n){let a=n.trim(),[t=[]]=await e.db.run([{sql:`SELECT id, email, role, status, expires_at, created_at FROM invitations
-WHERE organization_id = ?1 AND status = 'pending' AND (id = ?2 OR lower(email) = lower(?2))
-ORDER BY (id = ?2) DESC, created_at DESC LIMIT 1`,params:[e.organization.id,a]}]),r=t[0];if(!r)throw new m("INVITATION_NOT_PENDING",`No pending invitation for ${a} in ${e.organization.name}
-It was accepted, canceled or never made.`,{rerun:`${E} workspace users`,rerunNote:"lists the pending invitations"});return te(r,e.now)}async function Na(e){let n=e.organization.id,[a=[],t=[]]=await e.db.run([{sql:`SELECT u.email FROM members m JOIN users u ON u.id = m.user_id
-WHERE m.organization_id = ?1 AND ${x("m.role")} ORDER BY m.created_at, u.email`,params:[n]},{sql:`SELECT
-  (SELECT COUNT(*) FROM members WHERE organization_id = ?1) AS members,
-  (SELECT COUNT(*) FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?1 AND ${Ve("?2")}) AS deactivated,
-  (SELECT COUNT(*) FROM invitations WHERE organization_id = ?1 AND status = 'pending' AND expires_at > ?2) AS invitations,
-  (SELECT COUNT(*) FROM groups WHERE organization_id = ?1) AS groups,
-  (SELECT COUNT(*) FROM apps WHERE organization_id = ?1 AND status != '${N}') AS apps`,params:[n,e.now]}]),r=t[0]??{};return{organization:e.organization,owners:a.map(i=>String(i.email)),counts:{members:g(r.members),deactivated:g(r.deactivated),invitations:g(r.invitations),groups:g(r.groups),apps:g(r.apps)}}}async function ba(e){let[n=[],a=[]]=await e.db.run([{sql:`SELECT ${q} FROM members m JOIN users u ON u.id = m.user_id
-WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id]},{sql:`SELECT id, email, role, status, expires_at, created_at FROM invitations
-WHERE organization_id = ?1 AND status = 'pending' ORDER BY created_at DESC`,params:[e.organization.id]}]),t={owner:0,admin:1,member:2};return{members:n.map(r=>H(r,e.now)).sort((r,i)=>(t[r.primaryRole??"member"]??3)-(t[i.primaryRole??"member"]??3)||r.email.localeCompare(i.email)),invitations:a.map(r=>te(r,e.now))}}function Ie(){let e=`einv_${ae(32).toString("base64url")}`;return{token:e,hash:Je(e)}}var Aa=(e,n)=>`${e}/accept-invitation?token=${encodeURIComponent(n)}`,fa=(e,n)=>`${e}/reset-password?token=${encodeURIComponent(n)}`;async function Ra(e,n,a){let t=n.trim().toLowerCase(),r=await je(e,"invite");await _e(e,t);let i=D(),{token:d,hash:p}=Ie(),s=e.now+Ge,[,,o=[]]=await e.db.run([{sql:`INSERT INTO invitations (id, organization_id, email, role, status, expires_at, created_at, inviter_id)
-SELECT ?1, ?2, ?3, ?4, 'pending', ?5, ?6, ?7
-WHERE NOT EXISTS (SELECT 1 FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?2 AND lower(u.email) = ?3)
-  AND NOT EXISTS (SELECT 1 FROM invitations i WHERE i.organization_id = ?2 AND lower(i.email) = ?3 AND i.status = 'pending' AND i.expires_at > ?6)`,params:[i,e.organization.id,t,a,s,e.now,r]},{sql:`INSERT INTO invitation_link_tokens (id, invitation_id, token_hash, created_at)
-SELECT ?1, ?2, ?3, ?4 WHERE EXISTS (SELECT 1 FROM invitations WHERE id = ?2)`,params:[D(),i,p,e.now]},{sql:"SELECT id, email, role, status, expires_at, created_at FROM invitations WHERE id = ?",params:[i]}]),u=o[0];if(!u)throw await _e(e,t),new m("ALREADY_INVITED",`${t} was invited meanwhile`,{retryable:!0});return{invitation:te(u,e.now),token:d}}async function je(e,n){let{operator:a}=e;if(a.userId!==null){let[r=[]]=await e.db.run([{sql:"SELECT 1 AS member FROM members WHERE user_id = ? AND organization_id = ?",params:[a.userId,e.organization.id]}]);if(r.length>0)return a.userId}let t=a.email===null?"An API token has no account on the Gateway":a.userId===null?`${a.email} has no account on this Gateway (a verified one)`:`${a.email} isn't a member of ${e.organization.name}`;throw new m("WORKSPACE_NOT_A_MEMBER",`Only a member can ${n}: an invitation records who sent it
-${t}.`,{fix:a.email===null?`log in with your Cloudflare account (${E} login), claim the Gateway (${E} setup) or get invited, or invite from Admin \u2192 Users`:`claim the Gateway (${E} setup) or get invited to ${e.organization.name}, or invite from Admin \u2192 Users`})}async function _e(e,n){let[a=[],t=[]]=await e.db.run([{sql:"SELECT u.email FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?1 AND lower(u.email) = ?2",params:[e.organization.id,n]},{sql:"SELECT id FROM invitations WHERE organization_id = ?1 AND lower(email) = ?2 AND status = 'pending' AND expires_at > ?3",params:[e.organization.id,n,e.now]}]);if(a.length>0)throw new m("ALREADY_MEMBER",`${n} is a member of ${e.organization.name} already`,{rerun:`${E} workspace users`,rerunNote:"lists the members"});if(t.length>0)throw new m("ALREADY_INVITED",`${n} has a pending invitation to ${e.organization.name} already`,{rerun:`${E} workspace invite-link ${n}`,rerunNote:"prints a new link for it"})}async function Oa(e,n){let a=await he(e,n);if(!a.live)throw new m("INVITATION_NOT_PENDING",`The invitation for ${a.email} expired on ${new Date(a.expiresAt).toISOString()}`,{rerun:`${E} workspace invite ${a.email}`,rerunNote:"makes a new one"});let{token:t,hash:r}=Ie(),[i=[]]=await e.db.run([{sql:`INSERT INTO invitation_link_tokens (id, invitation_id, token_hash, created_at)
-SELECT ?1, ?2, ?3, ?4 WHERE EXISTS (SELECT 1 FROM invitations WHERE id = ?2 AND status = 'pending' AND expires_at > ?4)
-RETURNING id`,params:[D(),a.id,r,e.now]}]);if(i.length===0)throw new m("INVITATION_NOT_PENDING",`The invitation for ${a.email} was used or canceled meanwhile`);return{invitation:a,token:t}}async function Sa(e,n){let a=await he(e,n),[t=[]]=await e.db.run([{sql:"UPDATE invitations SET status = 'canceled' WHERE id = ? AND organization_id = ? AND status = 'pending' RETURNING id",params:[a.id,e.organization.id]}]);if(t.length===0)throw new m("INVITATION_NOT_PENDING",`The invitation for ${a.email} was used or canceled meanwhile`);return{...a,status:"canceled",live:!1}}function Ee(e,n,a,t){let i=t.id===e.organization.id?`${n.email} is the last owner of ${t.name} who can act, so they can't be ${a}`:`${n.email} is the last owner of ${t.name} who can act, and a deactivation is account-wide: it would leave ${t.name} without one`,d=t.id===e.installOrganizationId?{rerun:`${E} workspace role <email> owner`,rerunNote:"for someone else, then this command again"}:{fix:`an owner of ${t.name} makes someone else an owner under Manage workspace \u2192 Users, then run this again`};return new m("LAST_OWNER",`${i}
-Make someone else an owner of ${t.name} first, then try again.`,{...d,data:{organization:t,member:{id:n.id,email:n.email,name:n.name}}})}async function Ze(e,n,a){let[t=[]]=await e.db.run([{sql:`SELECT o.id, o.name, o.slug FROM members mine JOIN organizations o ON o.id = mine.organization_id
-WHERE mine.user_id = ?1 AND ${a?"1":"mine.organization_id = ?3"} AND ${x("mine.role")}
-  AND NOT ${v("mine.organization_id","?1","?2")}
-ORDER BY (mine.organization_id = ?3) DESC, o.created_at, o.id`,params:[n,e.now,e.organization.id]}]);return t.map(U)}async function C(e,n,a,t,{afterWrite:r=!1}={}){let i=r?await k(e,n.id):n,d=await Ze(e,i.id,t);if(d[0])throw Ee(e,i,a,d[0]);if(r)throw Ee(e,i,a,e.organization)}function ve(e,n,a){let t=[n.id,e.organization.id,e.now];return[{sql:`UPDATE users SET banned = 1, ban_reason = ?4, ban_expires = NULL, updated_at = ?3
-WHERE id = ?1 AND ${$} RETURNING id`,params:[...t,a]},{sql:`DELETE FROM sessions WHERE user_id = ?1 AND ${$}`,params:t},{sql:`UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3
-WHERE user_id = ?1 AND revoked_at IS NULL AND ${$}`,params:t},{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_reason = 'user_deactivated'
-WHERE user_id = ?1 AND revoked_at IS NULL AND ${$}`,params:t}]}async function Ta(e,n){let a=await k(e,n);await C(e,a,"deactivated",!0);let[t=[]]=await e.db.run(ve(e,a,`Deactivated by ${e.operator.actor} (${E} workspace deactivate)`));return t.length===0&&await C(e,a,"deactivated",!0,{afterWrite:!0}),{member:{...a,deactivated:!0},already:a.deactivated}}async function Da(e,n){let a=await k(e,n);return await e.db.run([{sql:`UPDATE users SET banned = 0, ban_reason = NULL, ban_expires = NULL, updated_at = ?3
-WHERE id = ?1 AND EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2)`,params:[a.id,e.organization.id,e.now]}]),{member:{...a,deactivated:!1},already:!a.deactivated}}async function ka(e,n,a){let t=await k(e,n);await C(e,t,"removed",!1);let[r=[]]=await e.db.run([{sql:"SELECT COUNT(*) AS n FROM members WHERE user_id = ? AND organization_id != ?",params:[t.id,e.organization.id]}]),i=g(r[0]?.n);if(i===0&&await a.accessMayLetBackIn(t)){let[o=[]]=await e.db.run(ve(e,t,`Removed by ${e.operator.actor} (${E} workspace remove); deactivated instead, as Cloudflare Access would let them back in`));return o.length===0&&await C(e,t,"removed",!0,{afterWrite:!0}),{member:{...t,deactivated:!0},deactivatedInstead:!0,accountDeleted:!1,otherOrganizations:i}}let d=[t.id,e.organization.id,e.now],[,,,,p=[],s=[]]=await e.db.run([{sql:`DELETE FROM user_app_access WHERE user_id = ?1 AND organization_id = ?2 AND ${z}`,params:d},{sql:`DELETE FROM group_members WHERE user_id = ?1 AND organization_id = ?2 AND ${z}`,params:d},{sql:`UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3
-WHERE user_id = ?1 AND organization_id = ?2 AND revoked_at IS NULL AND ${z}`,params:d},{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_reason = 'member_removed'
-WHERE user_id = ?1 AND organization_id = ?2 AND revoked_at IS NULL AND ${z}`,params:d},{sql:`DELETE FROM members WHERE user_id = ?1 AND organization_id = ?2 AND ${Oe("role")} RETURNING id`,params:d},a.deleteAccounts?{sql:"DELETE FROM users WHERE id = ?1 AND NOT EXISTS (SELECT 1 FROM members WHERE user_id = ?1) RETURNING id",params:[t.id]}:{sql:"SELECT NULL AS id WHERE 0"}]);return p.length===0&&await C(e,t,"removed",!1,{afterWrite:!0}),{member:t,deactivatedInstead:!1,accountDeleted:s.length>0,otherOrganizations:i}}async function ha(e,n){let a=await k(e,n);if(a.deactivated)throw new m("PASSWORD_RESET_REQUIRES_ACTIVE_USER",`${a.email} is deactivated, and a password-reset link is only for an active account`,{rerun:`${E} workspace reactivate ${a.email}`,rerunNote:"first, if they should be back"});let[t=[]]=await e.db.run([{sql:`SELECT o.id, o.name, o.slug FROM members m JOIN organizations o ON o.id = m.organization_id
-WHERE m.user_id = ?1 AND m.organization_id != ?2 ORDER BY o.created_at, o.id`,params:[a.id,e.organization.id]}]);if(t.length>0){let d=t.map(U);throw new m("USER_IN_OTHER_ORGANIZATION",`${a.email} also belongs to ${M(d.map(p=>p.name))}, and a password is account-wide
-The Gateway's own rule: a password-reset link is never made for someone in another organization, since it would reach that one too.`,{fix:"they reset it themselves with Forgot password (the Gateway's email must be configured), or they are removed from the other organization first",data:{member:{id:a.id,email:a.email,name:a.name},organizations:d}})}let r=ae(24).toString("base64url"),i=e.now+Be;return await e.db.run([{sql:`INSERT INTO verifications (id, identifier, value, expires_at, created_at, updated_at)
-VALUES (?1, ?2, ?3, ?4, ?5, ?5)`,params:[D(),`reset-password:${r}`,a.id,i,e.now]}]),{member:a,token:r,expiresAt:i}}var Ce=`SELECT g.id, g.name, g.description, g.created_at,
-  (SELECT COUNT(*) FROM group_members gm WHERE gm.group_id = g.id) AS member_count,
-  (SELECT COUNT(*) FROM group_app_access ga JOIN apps a ON a.id = ga.app_row_id AND a.status != '${N}' WHERE ga.group_id = g.id) AS app_count
-FROM groups g WHERE g.organization_id = ?1`;async function Ia(e){let[n=[]]=await e.db.run([{sql:`${Ce} ORDER BY g.name`,params:[e.organization.id]}]);return n.map(Se)}function we(e){let n=e.trim();if(n.length<1||n.length>me)throw new m("GROUP_NAME_INVALID",`A group name is 1 to ${me} characters${n?` (${n.length} given)`:""}`);return n}function ye(e){return new m("GROUP_NAME_TAKEN",`A group named "${e}" exists already in this organization`,{rerun:`${E} workspace groups`,rerunNote:"lists them"})}var Qe=()=>`grp_${ae(8).toString("hex")}`;async function va(e,n){let a=we(n.name),t=n.description?.trim()||null,r=Qe(),[i=[]]=await e.db.run([{sql:`INSERT INTO groups (id, organization_id, name, description, created_at, created_by)
-SELECT ?1, ?2, ?3, ?4, ?5, ?6
-WHERE NOT EXISTS (SELECT 1 FROM groups WHERE organization_id = ?2 AND lower(name) = lower(?3))
-RETURNING id`,params:[r,e.organization.id,a,t,e.now,e.operator.userId]}]);if(i.length===0)throw ye(a);return{id:r,name:a,description:t,createdAt:e.now,memberCount:0,appCount:0}}async function Ca(e,n,a){let t=await ke(e,n),r=a.name===void 0?t.name:we(a.name),i=a.description===void 0?t.description:a.description.trim()||null,[d=[]]=await e.db.run([{sql:`UPDATE groups SET name = ?3, description = ?4
-WHERE id = ?1 AND organization_id = ?2
-  AND NOT EXISTS (SELECT 1 FROM groups WHERE organization_id = ?2 AND lower(name) = lower(?3) AND id != ?1)
-RETURNING id`,params:[t.id,e.organization.id,r,i]}]);if(d.length===0)throw ye(r);return{...t,name:r,description:i}}async function wa(e,n){let a=await ke(e,n),t=[a.id,e.organization.id];return await e.db.run([{sql:"DELETE FROM group_app_access WHERE group_id = ?1 AND organization_id = ?2",params:t},{sql:"DELETE FROM group_members WHERE group_id = ?1 AND organization_id = ?2",params:t},{sql:"DELETE FROM groups WHERE id = ?1 AND organization_id = ?2",params:t}]),a}async function Ne(e,n){let[a=[]]=await e.db.run([{sql:`SELECT ${q}, (gm.user_id IS NOT NULL) AS in_group
-FROM members m JOIN users u ON u.id = m.user_id
-LEFT JOIN group_members gm ON gm.group_id = ?2 AND gm.user_id = u.id
-WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id,n.id]}]);return a.map(t=>({...H(t,e.now),inGroup:Number(t.in_group)===1}))}function oe(e,n){let a=new Set(e);if(n.set){let i=new Set(n.set);return{add:[...i].filter(d=>!a.has(d)),remove:[...a].filter(d=>!i.has(d))}}let t=[...new Set(n.add??[])].filter(i=>!a.has(i)),r=[...new Set(n.remove??[])].filter(i=>a.has(i));return{add:t,remove:r}}async function T(e,n){let a=[];for(let t of n){let r=await k(e,t);a.some(i=>i.id===r.id)||a.push(r)}return a}async function X(e,n){let a=[];for(let t of n){let r=await P(e,t);a.some(i=>i.id===r.id)||a.push(r)}return a}async function ya(e,n,a){let[t,r,i]=await Promise.all([a.set?T(e,a.set):void 0,T(e,a.add??[]),T(e,a.remove??[])]),d=await Ne(e,n),p=d.filter(u=>u.inGroup).map(u=>u.id),s=oe(p,{set:t?.map(u=>u.id),add:r.map(u=>u.id),remove:i.map(u=>u.id)}),o=new Map(d.map(u=>[u.id,u]));return await e.db.run([...F(s.remove,ne).map(u=>({sql:`DELETE FROM group_members WHERE group_id = ? AND organization_id = ? AND user_id IN (${u.map(()=>"?").join(", ")})`,params:[n.id,e.organization.id,...u]})),...s.add.map(u=>({sql:`INSERT INTO group_members (group_id, user_id, organization_id, added_at, added_by)
-SELECT ?1, ?2, ?3, ?4, ?5 WHERE EXISTS (SELECT 1 FROM members WHERE user_id = ?2 AND organization_id = ?3)
-ON CONFLICT DO NOTHING`,params:[n.id,u,e.organization.id,e.now,e.operator.userId]}))]),{added:s.add.map(u=>o.get(u)),removed:s.remove.map(u=>o.get(u)),members:await Ne(e,n)}}async function be(e,n){let[a=[]]=await e.db.run([{sql:`SELECT ${ie}, (ga.group_id IS NOT NULL) AS granted FROM apps a
-LEFT JOIN group_app_access ga ON ga.group_id = ?2 AND ga.app_row_id = a.id
-WHERE a.organization_id = ?1 AND a.scope != 'shared' AND a.status != '${N}' ORDER BY a.name`,params:[e.organization.id,n.id]}]);return a.map(t=>({...re(t),granted:Number(t.granted)===1}))}function G(e){return new m("SHARED_APP_ACCESS",`${e.appSlug} is a shared app: every member of every organization can open it, so its access can't be changed`)}async function Wa(e,n,a){let[t,r,i]=await Promise.all([a.set?X(e,a.set):void 0,X(e,a.add??[]),X(e,a.remove??[])]);for(let o of[...t??[],...r])if(o.scope==="shared")throw G(o);let d=await be(e,n),p=oe(d.filter(o=>o.granted).map(o=>o.id),{set:t?.map(o=>o.id),add:r.map(o=>o.id),remove:i.map(o=>o.id)}),s=new Map(d.map(o=>[o.id,o]));return await e.db.run([...F(p.remove,ne).map(o=>({sql:`DELETE FROM group_app_access WHERE group_id = ? AND organization_id = ? AND app_row_id IN (${o.map(()=>"?").join(", ")})`,params:[n.id,e.organization.id,...o]})),...p.add.map(o=>({sql:`INSERT INTO group_app_access (group_id, app_row_id, organization_id, granted_at, granted_by)
-SELECT ?1, ?2, ?3, ?4, ?5
-WHERE EXISTS (SELECT 1 FROM apps WHERE id = ?2 AND organization_id = ?3 AND scope != 'shared' AND status != '${N}')
-ON CONFLICT DO NOTHING`,params:[n.id,o,e.organization.id,e.now,e.operator.userId]}))]),{added:p.add.map(o=>s.get(o)),removed:p.remove.map(o=>s.get(o)),apps:await be(e,n)}}async function Ma(e){let[n=[]]=await e.db.run([{sql:`SELECT ${ie} FROM apps a WHERE a.organization_id = ?1 AND a.status != '${N}' ORDER BY a.name`,params:[e.organization.id]}]);return n.map(re)}function ea(e){let n=e.trim();if(n.length<1||n.length>ge)throw new m("APP_NAME_INVALID",`An app's name is 1 to ${ge} characters${n?` (${n.length} given)`:", not empty"}`,{fix:"give --name the name the app library should show, or leave --name off"});return n}async function La(e,n,a){let t=await P(e,n);if(a.name===void 0&&a.description===void 0&&a.everyone===void 0)throw new m("NOTHING_TO_SET","Nothing to set: give --name, --description or --everyone on|off");if(t.scope==="shared"&&a.everyone)throw G(t);let r=a.name===void 0?t.name:ea(a.name),i=a.description===void 0?t.description:a.description.trim(),d=a.everyone??t.everyone,p=[];if(d&&!t.everyone){let[o=[]]=await e.db.run([{sql:"SELECT user_id FROM members WHERE organization_id = ?",params:[e.organization.id]}]);for(let u of F(o,Ye))p.push({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by) VALUES ${u.map(()=>"(?, ?, ?, ?, ?)").join(", ")} ON CONFLICT DO NOTHING RETURNING id`,params:u.flatMap(R=>[D(),String(R.user_id),t.id,e.organization.id,e.operator.userId])})}let[,...s]=await e.db.run([{sql:`UPDATE apps SET name = ?3, description = ?4, is_default = ?5, updated_at = ?6
-WHERE id = ?1 AND organization_id = ?2 AND status != '${N}'`,params:[t.id,e.organization.id,r,i,d?1:0,e.now]},...p]);return{app:await P(e,t.id),granted:s.reduce((o,u)=>o+u.length,0)}}async function Ae(e,n){if(n.scope==="shared")throw G(n);let[a=[]]=await e.db.run([{sql:`SELECT ${q},
-  (ua.id IS NOT NULL) AS direct,
-  (SELECT group_concat(g.name, char(31)) FROM group_app_access ga
-     JOIN group_members gm ON gm.group_id = ga.group_id AND gm.user_id = u.id
-     JOIN groups g ON g.id = ga.group_id
-   WHERE ga.app_row_id = ?2 AND ga.organization_id = ?1) AS via_groups
-FROM members m JOIN users u ON u.id = m.user_id
-LEFT JOIN user_app_access ua ON ua.app_row_id = ?2 AND ua.organization_id = ?1 AND ua.user_id = u.id
-WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id,n.id]}]);return a.map(t=>({...H(t,e.now),direct:Number(t.direct)===1,viaGroups:l(t.via_groups)?.split("").sort()??[]}))}async function za(e,n,a){if(n.scope==="shared")throw G(n);let[t,r,i]=await Promise.all([a.set?T(e,a.set):void 0,T(e,a.add??[]),T(e,a.remove??[])]),d=await Ae(e,n),p=oe(d.filter(o=>o.direct).map(o=>o.id),{set:t?.map(o=>o.id),add:r.map(o=>o.id),remove:i.map(o=>o.id)}),s=new Map(d.map(o=>[o.id,o]));return await e.db.run([...F(p.remove,ne).map(o=>({sql:`DELETE FROM user_app_access WHERE app_row_id = ? AND organization_id = ? AND user_id IN (${o.map(()=>"?").join(", ")})`,params:[n.id,e.organization.id,...o]})),...p.add.map(o=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_at, granted_by)
-SELECT ?1, ?2, ?3, ?4, ?5, ?6 WHERE EXISTS (SELECT 1 FROM members WHERE user_id = ?2 AND organization_id = ?4)
-ON CONFLICT DO NOTHING`,params:[D(),o,n.id,e.organization.id,e.now,e.operator.userId]}))]),{granted:p.add.map(o=>s.get(o)),revoked:p.remove.map(o=>s.get(o)),users:await Ae(e,n)}}function ee(e){return e.appCap!==null?{cap:e.appCap,source:"app"}:e.unlimited?{cap:null,source:null}:e.defaultCap!==null?{cap:e.defaultCap,source:"default"}:{cap:null,source:null}}var We=(e,n)=>e===null?n!==null:n===null||e>n,fe=new WeakMap;function Me(e){let n=fe.get(e);return n||(n=e.run([{sql:"PRAGMA table_info(org_settings)"},{sql:"PRAGMA table_info(org_app_settings)"}]).then(([a=[],t=[]])=>a.length>0&&t.some(r=>r.name==="unlimited")),fe.set(e,n)),n}async function se(e){if(!await Me(e))throw new m("GATEWAY_PREDATES_DEFAULT_CAPS",`The Gateway predates default caps
-Its database has no workspace default cap and no no-cap override until the Gateway is updated to a release that has them.`,{rerun:`${E} update`,rerunNote:"then run this again"})}var Le=e=>e===null||Number.isInteger(e)&&e>=1&&e<=Re,ze=()=>new m("INVALID_CAP",`A monthly cap is a whole number from 1 to ${Re.toLocaleString("en-US")}, or off`);async function $a(e,n,a,t={}){let r=t.unlimited??!1,i=await P(e,n,{callable:!0});if(!Le(a))throw ze();if(a!==null&&r)throw new m("INVALID_CAP",`An app has a cap or no cap, not both
-Give a number, off, or --unlimited.`);let d=await Me(e.db);r&&await se(e.db);let p=e.organization.id,[s=[],o=[]]=await e.db.run([{sql:`SELECT monthly_call_cap${d?", unlimited":""} FROM org_app_settings WHERE organization_id = ? AND app_row_id = ?`,params:[p,i.id]},...d?[{sql:"SELECT default_monthly_call_cap AS cap FROM org_settings WHERE organization_id = ?",params:[p]}]:[]]),u=s[0]?.monthly_call_cap==null?null:Number(s[0].monthly_call_cap),R=Number(s[0]?.unlimited??0)===1,w=o[0]?.cap==null?null:Number(o[0].cap),h=ee({appCap:u,unlimited:R,defaultCap:w}),I=ee({appCap:a,unlimited:r,defaultCap:w}),O=a===null?null:await V(e.db,{organizationId:p,deployer:e.operator,now:e.now}),y=We(I.cap,h.cap)?await J(e.db,{organizationId:p,type:"cap.raised",actor:Y(e.operator),data:{app:{id:i.appSlug,rowId:i.id,name:i.name},cap:I.cap,previousCap:h.cap,source:"app"},appRowId:i.id,now:e.now}):[],b=a===null&&!r?{sql:"DELETE FROM org_app_settings WHERE organization_id = ? AND app_row_id = ?",params:[p,i.id]}:d?{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, unlimited, updated_at, updated_by)
-VALUES (?1, ?2, ?3, ?4, ?5, ?6)
-ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, unlimited = ?4, updated_at = ?5, updated_by = ?6`,params:[p,i.id,a,r?1:0,e.now,e.operator.userId]}:{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, updated_at, updated_by)
-VALUES (?1, ?2, ?3, ?4, ?5)
-ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, updated_at = ?4, updated_by = ?5`,params:[p,i.id,a,e.now,e.operator.userId]},B=await e.db.run([b,...O?[O]:[],...y]),S=O?l(B[1]?.[0]?.id):null;return{app:i,cap:a,unlimited:r,was:u,wasUnlimited:R,effective:I,before:h,capAlertsId:S}}async function Ua(e,n){if(!Le(n))throw ze();await se(e.db);let a=e.organization.id,[t=[]]=await e.db.run([{sql:"SELECT default_monthly_call_cap AS cap FROM org_settings WHERE organization_id = ?",params:[a]}]),r=t[0]?.cap==null?null:Number(t[0].cap),i=n===null?null:await V(e.db,{organizationId:a,deployer:e.operator,now:e.now}),d=We(n,r)?await J(e.db,{organizationId:a,type:"cap.raised",actor:Y(e.operator),data:{app:null,cap:n,previousCap:r,source:"default"},now:e.now}):[],p=await e.db.run([n===null?{sql:"DELETE FROM org_settings WHERE organization_id = ?",params:[a]}:{sql:`INSERT INTO org_settings (organization_id, default_monthly_call_cap, updated_at, updated_by)
-VALUES (?1, ?2, ?3, ?4)
-ON CONFLICT (organization_id) DO UPDATE SET default_monthly_call_cap = ?2, updated_at = ?3, updated_by = ?4`,params:[a,n,e.now,e.operator.userId]},...i?[i]:[],...d]),s=i?l(p[1]?.[0]?.id):null;return{cap:n,was:r,capAlertsId:s}}var aa=/^\d{4}-(0[1-9]|1[0-2])$/;function $e(e){return`${e.getUTCFullYear()}-${String(e.getUTCMonth()+1).padStart(2,"0")}`}function na(e,n){let[a,t]=e.split("-").map(Number);return $e(new Date(Date.UTC(a,t-1+n,1)))}var K=`COALESCE(SUM(d.calls), 0) AS calls, COALESCE(SUM(d.failures), 0) AS failures,
-  COALESCE(SUM(d.input_tokens), 0) AS input_tokens, COALESCE(SUM(d.output_tokens), 0) AS output_tokens,
-  COALESCE(SUM(d.cost_micros), 0) AS cost_micros`,j=e=>({calls:g(e.calls),failures:g(e.failures),inputTokens:g(e.input_tokens),outputTokens:g(e.output_tokens),costMicros:g(e.cost_micros)}),Z={calls:0,failures:0,inputTokens:0,outputTokens:0,costMicros:0},Q={monthlyCallCap:null,capUnlimited:!1,effectiveMonthlyCallCap:null,capSource:null,paused:!1};async function Pa(e,n){if(!aa.test(n))throw new m("INVALID_MONTH",`--month ${n} isn't a month: use YYYY-MM`);await se(e.db);let a=e.organization.id,t=`${n}-01`,r=`${na(n,1)}-01`,i=Date.parse(`${t}T00:00:00.000Z`),d=Date.parse(`${r}T00:00:00.000Z`),p="d.organization_id = ?1 AND d.day >= ?2 AND d.day < ?3",s="c.organization_id = ?1 AND c.decision = 'allowed' AND c.created_at >= ?2 AND c.created_at < ?3",[o=[],u=[],R=[],w=[],h=[],I=[],O=[]]=await e.db.run([{sql:`SELECT d.app_row_id, a.name, a.app_slug, ${K} FROM usage_daily d LEFT JOIN apps a ON a.id = d.app_row_id
-WHERE ${p} GROUP BY d.app_row_id, a.name, a.app_slug`,params:[a,t,r]},{sql:`SELECT d.user_id, u.name, u.email, ${K} FROM usage_daily d
-LEFT JOIN members m ON m.user_id = d.user_id AND m.organization_id = d.organization_id
-LEFT JOIN users u ON u.id = m.user_id
-WHERE ${p} GROUP BY d.user_id, u.name, u.email`,params:[a,t,r]},{sql:`SELECT d.kind, d.target, ${K} FROM usage_daily d WHERE ${p} GROUP BY d.kind, d.target`,params:[a,t,r]},{sql:`SELECT c.app_row_id, a.name, a.app_slug, COUNT(*) AS tool_calls FROM mcp_tool_calls c
-LEFT JOIN apps a ON a.id = c.app_row_id WHERE ${s} GROUP BY c.app_row_id, a.name, a.app_slug`,params:[a,i,d]},{sql:`SELECT c.user_id, u.name, u.email, COUNT(*) AS tool_calls FROM mcp_tool_calls c
-LEFT JOIN members m ON m.user_id = c.user_id AND m.organization_id = c.organization_id
-LEFT JOIN users u ON u.id = m.user_id
-WHERE ${s} GROUP BY c.user_id, u.name, u.email`,params:[a,i,d]},{sql:`SELECT a.id AS app_row_id, a.name, a.app_slug, s.monthly_call_cap, s.unlimited FROM apps a
-LEFT JOIN org_app_settings s ON s.app_row_id = a.id AND s.organization_id = ?1
-WHERE (a.organization_id = ?1 OR a.scope = 'shared') AND a.status != '${N}'`,params:[a]},{sql:"SELECT default_monthly_call_cap AS cap FROM org_settings WHERE organization_id = ?",params:[a]}]),y=O[0]?.cap==null?null:Number(O[0].cap),b=new Map;for(let c of o)b.set(String(c.app_row_id),{appRowId:String(c.app_row_id),appSlug:l(c.app_slug),name:l(c.name),...j(c),toolCalls:0,...Q,callable:!1});for(let c of w){let _=l(c.app_row_id);if(!_)continue;let A=b.get(_);A?A.toolCalls=g(c.tool_calls):b.set(_,{appRowId:_,appSlug:l(c.app_slug),name:l(c.name),...Z,toolCalls:g(c.tool_calls),...Q,callable:!1})}let B=n===$e(new Date(e.now));for(let c of I){let _=String(c.app_row_id),A=c.monthly_call_cap==null?null:Number(c.monthly_call_cap),pe=Number(c.unlimited??0)===1,W=ee({appCap:A,unlimited:pe,defaultCap:y}),f=b.get(_)??{appRowId:_,appSlug:l(c.app_slug),name:l(c.name),...Z,toolCalls:0,...Q,callable:!0};f.callable=!0,f.monthlyCallCap=A,f.capUnlimited=pe,f.effectiveMonthlyCallCap=W.cap,f.capSource=W.source,f.paused=B&&W.cap!==null&&f.calls>=W.cap,b.set(_,f)}let S=new Map;for(let c of u)S.set(String(c.user_id),{userId:String(c.user_id),name:l(c.name),email:l(c.email),...j(c),toolCalls:0});for(let c of h){let _=String(c.user_id),A=S.get(_);A?A.toolCalls=g(c.tool_calls):S.set(_,{userId:_,name:l(c.name),email:l(c.email),...Z,toolCalls:g(c.tool_calls)})}let de=(c,_)=>_.calls-c.calls||_.toolCalls-c.toolCalls;return{month:n,defaultMonthlyCallCap:y,byApp:[...b.values()].sort((c,_)=>de(c,_)||(c.name??c.appRowId).localeCompare(_.name??_.appRowId)),byMember:[...S.values()].sort(de),byTarget:R.map(c=>({kind:String(c.kind),target:String(c.target),...j(c)})).sort((c,_)=>_.calls-c.calls)}}var ta=200;async function xa(e,n){let a=Math.min(Math.max(1,Math.trunc(n.limit??50)||1),ta),t=["c.organization_id = ?"],r=[e.organization.id];n.before&&(t.push("(c.created_at < ? OR (c.created_at = ? AND c.id < ?))"),r.push(n.before.createdAt,n.before.createdAt,n.before.id));for(let[s,o]of[["c.app_row_id",n.appRowId],["c.user_id",n.userId],["c.decision",n.decision],["c.risk",n.risk]])o!==void 0&&(t.push(`${s} = ?`),r.push(o));n.since!==void 0&&(t.push("c.created_at >= ?"),r.push(n.since)),r.push(a+1);let[i=[]]=await e.db.run([{sql:`SELECT c.id, c.created_at, c.user_id, u.name AS user_name, u.email AS user_email,
-  c.credential_kind, c.client_name, c.client_info, c.app_row_id, c.app_slug, a.name AS app_name, a.status AS app_status,
-  c.tool_name, c.via, c.risk, c.decision, c.reason, c.outcome, c.duration_ms, c.result_bytes
-FROM mcp_tool_calls c
-LEFT JOIN apps a ON a.id = c.app_row_id
-LEFT JOIN members m ON m.user_id = c.user_id AND m.organization_id = c.organization_id
-LEFT JOIN users u ON u.id = m.user_id
-WHERE ${t.join(" AND ")}
-ORDER BY c.created_at DESC, c.id DESC LIMIT ?`,params:r}]),d=i.slice(0,a),p=d.at(-1);return{calls:d.map(s=>{let o=l(s.app_row_id),u=l(s.app_status);return{id:String(s.id),createdAt:g(s.created_at),user:{id:String(s.user_id),name:l(s.user_name),email:l(s.user_email)},credential:{kind:String(s.credential_kind),clientName:l(s.client_name),clientInfo:l(s.client_info)},app:{rowId:o,slug:l(s.app_slug),name:l(s.app_name),removed:o!==null&&(u===null||u===N)},tool:{name:String(s.tool_name),risk:l(s.risk),via:l(s.via)},decision:s.decision==="allowed"?"allowed":"blocked",reason:l(s.reason),outcome:String(s.outcome),durationMs:s.duration_ms==null?null:Number(s.duration_ms),resultBytes:s.result_bytes==null?null:Number(s.result_bytes)}}),nextBefore:i.length>a&&p?{createdAt:g(p.created_at),id:String(p.id)}:null}}var Ue=`SELECT t.id, t.user_id, u.email, t.name, t.token_prefix, t.app_row_id, a.app_slug, a.name AS app_name,
-  t.scopes, t.created_at, t.expires_at, t.last_used_at, t.revoked_at
-FROM user_access_tokens t JOIN users u ON u.id = t.user_id
-LEFT JOIN apps a ON a.id = t.app_row_id AND a.organization_id = t.organization_id
-WHERE t.organization_id = ?1`;function Pe(e,n){let a=e.revoked_at==null?null:Number(e.revoked_at),t=g(e.expires_at),r=[];try{let i=JSON.parse(String(e.scopes??"[]"));r=Array.isArray(i)?i.map(String):[]}catch{r=[]}return{id:String(e.id),user:{id:String(e.user_id),email:String(e.email)},name:String(e.name),prefix:String(e.token_prefix),app:{rowId:l(e.app_row_id),slug:l(e.app_slug),name:l(e.app_name)},scopes:r,createdAt:g(e.created_at),expiresAt:t,lastUsedAt:e.last_used_at==null?null:Number(e.last_used_at),revokedAt:a,active:a===null&&t>n}}async function Fa(e,n){let[a=[]]=await e.db.run([{sql:`${Ue}${n?" AND t.user_id = ?2":""} ORDER BY t.created_at DESC`,params:n?[e.organization.id,n]:[e.organization.id]}]);return a.map(t=>Pe(t,e.now))}async function Ha(e,n){let[a=[]]=await e.db.run([{sql:`${Ue} AND t.id = ?2`,params:[e.organization.id,n.trim()]}]),t=a[0];if(!t)throw new m("TOKEN_NOT_FOUND",`No personal access token ${n.trim()} in ${e.organization.name}`,{rerun:`${E} workspace tokens`,rerunNote:"lists them by id"});let r=Pe(t,e.now);return r.revokedAt!==null?{token:r,already:!0}:(await e.db.run([{sql:"UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3 WHERE id = ?1 AND organization_id = ?2 AND revoked_at IS NULL",params:[r.id,e.organization.id,e.now]}]),{token:{...r,revokedAt:e.now,active:!1},already:!1})}var xe=`SELECT c.id, c.user_id, u.email, c.client_name, c.client_domain, c.redirect_host, c.app_scope, c.access,
-  c.created_at, c.last_used_at, c.revoked_at, c.revoked_reason,
-  (SELECT group_concat(a.app_slug, char(31)) FROM mcp_connection_apps ca JOIN apps a ON a.id = ca.app_row_id WHERE ca.connection_id = c.id) AS app_slugs
-FROM mcp_connections c JOIN users u ON u.id = c.user_id
-WHERE c.organization_id = ?1`;function Fe(e){return{id:String(e.id),user:{id:String(e.user_id),email:String(e.email)},clientName:String(e.client_name),clientDomain:l(e.client_domain),redirectHost:String(e.redirect_host),apps:e.app_scope==="all"?"all":l(e.app_slugs)?.split("").sort()??[],access:e.access==="write"?"write":"read",createdAt:g(e.created_at),lastUsedAt:e.last_used_at==null?null:Number(e.last_used_at),revokedAt:e.revoked_at==null?null:Number(e.revoked_at),revokedReason:l(e.revoked_reason)}}async function qa(e,n){let[a=[]]=await e.db.run([{sql:`${xe} AND c.revoked_at IS NULL${n?" AND c.user_id = ?2":""} ORDER BY c.created_at DESC`,params:n?[e.organization.id,n]:[e.organization.id]}]);return a.map(Fe)}async function Ga(e,n){let[a=[]]=await e.db.run([{sql:`${xe} AND c.id = ?2`,params:[e.organization.id,n.trim()]}]),t=a[0];if(!t)throw new m("CONNECTION_NOT_FOUND",`No AI connection ${n.trim()} in ${e.organization.name}`,{rerun:`${E} workspace connections`,rerunNote:"lists them by id"});let r=Fe(t);return r.revokedAt!==null?{connection:r,already:!0}:(await e.db.run([{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_by = ?4, revoked_reason = 'user'
-WHERE id = ?1 AND organization_id = ?2 AND revoked_at IS NULL`,params:[r.id,e.organization.id,e.now,e.operator.userId]}]),{connection:{...r,revokedAt:e.now,revokedReason:"user"},already:!1})}export{ra as a,ga as b,Re as c,_a as d,Ea as e,k as f,P as g,ke as h,Na as i,ba as j,Aa as k,fa as l,Ra as m,Oa as n,Sa as o,Ta as p,Da as q,ka as r,ha as s,Ia as t,va as u,Ca as v,wa as w,Ne as x,ya as y,be as z,Wa as A,Ma as B,ea as C,La as D,Ae as E,za as F,$a as G,Ua as H,aa as I,$e as J,Pa as K,ta as L,xa as M,Fa as N,Ha as O,qa as P,Ga as Q};

package/dist/chunk-NFU4YFXB.js

@@ -1 +0,0 @@
-import{B as S,ca as u,da as z,ea as L,fa as E,ha as N,ja as w,ka as B,kb as j,la as V,lb as X,ma as K,mb as M,na as F,oa as G,pa as H,qa as J,ra as W,rb as v,ta as O,tb as T,ub as Y,vb as q,wb as Q,xb as k,yb as Z}from"./chunk-LYNBZ7RV.js";function de(e){if(!e)return null;try{let t=JSON.parse(e);return Array.isArray(t)&&t.every(r=>typeof r=="string")?t:null}catch{return null}}function le(e){return JSON.stringify([...new Set(e)].sort())}var b=class extends Error{constructor(r,n){super(`App "${r}" can't be routed: ${n}`);this.appId=r;this.name="UnroutableAppError"}};var D=class{byHostname=new Map;byAppId=new Map;byOrgApp=new Map;constructor(t=[]){for(let r of t)this.add(r)}add(t){this.byHostname.set(t.hostname.toLowerCase(),t),this.byAppId.set(t.appId,t),this.byOrgApp.set(ee(t.organizationId,t.appId),t)}async findByHostname(t){return this.byHostname.get(t.toLowerCase())??null}async hasAnyActiveApp(){return Array.from(this.byAppId.values()).some(t=>t.status==="active")}async findByAppId(t){return this.byAppId.get(t)??null}async findByOrgApp(t,r){return this.byOrgApp.get(ee(t,r))??null}};function ee(e,t){return JSON.stringify([e,t])}var p="deleted",o=class extends Error{status;code;constructor({status:t,code:r,message:n}){super(n),this.name="RegistrationError",this.status=t,this.code=r}},ce=/^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/,re=12,ge=50;function ne(e){return e.toLowerCase().replace(/[^a-z0-9]/g,"").slice(0,re)||"org"}function ue(e){let t=ne(e);return Array.from({length:ge},(r,n)=>{let s=n===0?"":String(n+1);return`${t.slice(0,re-s.length)}${s}`})}function te(e,t){let r=e.trim().toLowerCase();if(!ce.test(r))throw new o({status:400,code:"INVALID_APP_HOSTNAME",message:`${t} must form a valid DNS label of at most 63 characters; received "${r}".`});return r}function se(e){let{appSlug:t,orgKey:r}=e;if(j(t))throw new o({status:400,code:"RESERVED_APP_ID",message:`The app id "${t}" is reserved for the platform.`});if(t.includes(T))throw new o({status:400,code:"INVALID_APP_ID",message:`App id "${t}" can't contain "${T}": it separates an app's Worker name from its resources' names. Choose another id.`});let n=e.existingApp?.workerName??Y({appId:t,orgKey:r}),s=e.appBaseDomain.trim().toLowerCase().replace(/\.$/,""),i=e.existingApp?.hostname??`${e.isInstallOrganization?te(t,"The app id"):te(`${t}-${r}`,"The app id and organization key")}.${s}`;if(!q({appId:t,orgKey:r,workerName:n}))throw new o({status:400,code:"INVALID_WORKER_NAME",message:n.length>v?`App id "${t}" is too long: its Worker name "${n}" would exceed ${v} characters.`:`App id "${t}" can't be registered: its Worker would be "${n}", which is reserved for the gateway or isn't the app's own.`});return{workerName:n,hostname:i}}function oe(e,t){let r;try{r=M(e)}catch(n){throw new o({status:400,code:"INVALID_MANIFEST",message:n instanceof X?n.message:"Invalid manifest"})}if(r.id!==t)throw new o({status:400,code:"INVALID_MANIFEST",message:`manifest.id "${r.id}" does not match appId "${t}"`});return r}function U(e){if(!e)return null;try{return M(JSON.parse(e))}catch{return null}}function ie(e,t){let r=(n,s=Q)=>Object.fromEntries((n??[]).map(i=>[i,s(e,i)]));return{d1:r(t?.resources?.d1),kv:r(t?.resources?.kv),r2:r(t?.resources?.r2,Z)}}function me(e){return e.workerName?ie(e.workerName,U(e.manifest)):{d1:{},kv:{},r2:{}}}var Ae={d1:"D1 database",kv:"KV namespace",r2:"R2 bucket"},fe=/^[a-z0-9][a-z0-9-]*[a-z0-9]$/;function Re(e){for(let[t,r]of Object.entries(e)){let n=new Map;for(let[s,i]of Object.entries(r)){let a=n.get(i);if(a!==void 0)throw new o({status:400,code:"RESOURCE_NAME_CONFLICT",message:`Bindings ${a} and ${s} would share the ${Ae[t]} "${i}". Rename one of them in everyapp.config.ts.`});if(t==="r2"&&(i.length>k||!fe.test(i)))throw new o({status:400,code:"INVALID_MANIFEST",message:`resources.r2: ${s} would be the R2 bucket "${i}", which Cloudflare refuses (at most ${k} lowercase letters, digits and hyphens, starting and ending with a letter or digit). Rename the binding in everyapp.config.ts.`});n.set(i,s)}}}function Ie(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function ye(e,t,r,n){if(t==="shared")return{isDefault:!1,grants:[]};let s=r.access==="everyone";return{isDefault:s,grants:e.members.filter(i=>s||i.id===e.deployerUserId||Ie(i.role)).map(i=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:i.id,appRowId:n,grantedBy:null}))}}function we(e){let{existingApp:t}=e,r=e.scope??(t?.scope==="shared"?"shared":"org");if(t&&(t.organizationId!==e.organizationId||t.appSlug!==e.appSlug))throw new Error("existingApp is another organization's or app's row.");if(r==="shared"&&!e.isInstallOrganization)throw new o({status:403,code:"SHARED_APP_NOT_PLATFORM",message:`Only the platform organization registers shared apps; "${e.appSlug}" can't be shared from another organization.`});if(t&&t.scope!==r)throw new o({status:409,code:"APP_SCOPE_MISMATCH",message:t.scope==="shared"?`App "${e.appSlug}" is a shared app, not this organization's own. Deploy it without asking for another scope, or give the organization's own app an id of its own.`:`App "${e.appSlug}" is this organization's own app, not a shared one. Shared apps need an app id of their own.`});let n=e.tier??"service_binding";if(n==="dispatch"&&r==="shared")throw new o({status:400,code:"APP_TIER_MISMATCH",message:`A shared app is reached over a service binding; "${e.appSlug}" can't be deployed through the hosted deploy API.`});if(t&&t.tier!==n)throw new o({status:409,code:"APP_TIER_MISMATCH",message:t.tier===u?`"${e.appSlug}" is the Gateway's MCP app of that name${t.status===p?" (turned off)":""}; give this app an id of its own.`:t.tier==="dispatch"?`App "${e.appSlug}" is deployed through the hosted deploy API; deploy it the same way, or give this app an id of its own.`:`App "${e.appSlug}" is reached over a service binding, not deployed through the hosted deploy API; give the third-party app an id of its own.`});let s=se(e),i=oe(e.manifest,e.appSlug),{workerName:a,hostname:d}=s;for(let[A,_,pe]of[[e.hostnameOwner,"hostname",d],[e.workerNameOwner,"workerName",a]])if(A&&A[_]!==pe)throw new Error(`The ${_} owner passed holds another ${_}.`);let m=A=>A!==null&&(A.organizationId!==e.organizationId||A.appSlug!==e.appSlug);if(m(e.hostnameOwner))throw new o({status:409,code:"HOSTNAME_TAKEN",message:`The hostname "${d}" is already registered to another app on this gateway.`});if(m(e.workerNameOwner))throw new o({status:409,code:"WORKER_NAME_TAKEN",message:`The worker name "${a}" is already registered to another app on this gateway. Choose a different app id.`});let f=ie(a,i);Re(f);let y={organizationId:e.organizationId,name:e.name,description:e.description,hostname:d,workerName:a},l={previousManifest:U(t?.manifest??null),versionId:t?.versionId??null,resources:f};if(t&&t.status!==p)return{kind:"existing",app:{...t,...y},grants:[],...l};let R=t?.id??crypto.randomUUID(),{isDefault:c,grants:h}=ye(e,r,i,R),g={...y,manifest:JSON.stringify(i),status:"pending",isDefault:c};return t?{kind:"revived",app:{...t,...g},grants:h,...l}:{kind:"new",app:{id:R,appSlug:e.appSlug,tier:n,scope:r,versionId:null,deployedAt:null,deployedByActor:null,...g},grants:h,...l}}function he(e){if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`No app "${e.appSlug}" is registered for this organization.`});if(!e.workerName||!e.hostname&&e.tier!=="dispatch")throw new o({status:409,code:"APP_NOT_REGISTERED",message:`App "${e.appSlug}" has no Worker or hostname yet; deploy it again.`})}function Ee(e,{versionId:t,manifest:r,actor:n,now:s=Date.now()}){return he(e),{manifest:JSON.stringify(oe(r,e.appSlug)),versionId:t,deployedAt:s,deployedByActor:n,status:e.status==="pending"?"binding":e.status}}function P(e){return e.status===p?null:{status:p,isDefault:!1,emailSenders:null,emailInbound:null,secretNames:null}}function Me(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function I(e,t){throw new o({status:400,code:e,message:t})}function Pe(e,t){let r=t&&typeof t=="object"&&!Array.isArray(t)?t:{kind:t??"none"},n=r.kind,s=(n==="bearer"||n==="header"||n==="basic")&&r.secret===void 0?{...r,secret:B(e)}:r,i=G(s);return i.ok||I("REMOTE_MCP_INVALID",i.problem),i.auth}function C(e){if(e.tier!==u||!e.manifest)return!1;try{return W(JSON.parse(e.manifest))}catch{return!1}}function $(e){return e.tier===u}function x(e){if(e.tier!==u||!e.manifest)return null;try{return J(JSON.parse(e.manifest))}catch{return null}}function _e(e,t,r){if(r&&(r.organizationId!==e||r.appSlug!==t))throw new Error("existingApp is another organization's or app's row.")}function Se(e,t){if(C(t))return;let r=t.tier===u?"the Gateway's built-in MCP app":`an app deployed to this Gateway${t.status===p?" (deleted, its names still its organization's)":""}`;throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e}" is ${r}; a remote MCP server can't take its id.`})}function Ne(e){let t=e.url.trim(),r=F(t,e.env);r&&I("REMOTE_MCP_URL_REFUSED",r);let n=(e.id??"").trim()||K(t);n||I("REMOTE_MCP_INVALID","no app id could be read from the URL's host; give one with --name");let s=V(n);s&&I("REMOTE_MCP_INVALID",s);let i=e.sharedApp?.(n);if(i&&i.status!==p)throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${n}" is a shared app every organization sees; a remote MCP server can't take its id.`});let a=e.existingApp(n);_e(e.organizationId,n,a);let d=(e.risk??"annotations").trim();w.includes(d)||I("REMOTE_MCP_INVALID",`risk must be one of ${w.join(", ")}`);let m=Pe(n,e.auth);if("secret"in m&&e.secretUsedAt){let g=e.secretUsedAt(m.secret),A=new URL(t).origin;if(g&&g!==A)throw new o({status:409,code:"REMOTE_MCP_SECRET_TAKEN",message:`${m.secret} is the credential of an MCP app at ${g}; a server at ${A} takes another name (--secret <NAME>_MCP_TOKEN).`})}let f=a?x(a)?.rev??0:0,y={url:t,auth:m,risk:d,tools:{},rev:f+1},l=O({id:n,name:e.name,description:e.description,remote:y});if(a&&((E(n)||!C(a))&&Se(n,a),a.status!==p))throw new o({status:409,code:"REMOTE_MCP_EXISTS",message:`"${n}" is an MCP app on this Gateway already (${a.status==="active"?"on":"off"}); remove it first, or change it in place.`});let R=a?.id??crypto.randomUUID(),c={id:R,organizationId:e.organizationId,appSlug:n,name:l.name,description:l.description,hostname:null,workerName:null,tier:u,scope:"org",manifest:JSON.stringify(l),status:"active",versionId:null,deployedAt:e.now,deployedByActor:e.actor,isDefault:!1},h=e.members.filter(g=>g.id===e.actorUserId||Me(g.role)).map(g=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:g.id,appRowId:R,grantedBy:null}));return{kind:a?"revived":"new",id:n,app:c,grants:h,remote:y}}function Oe(e,t){let r=x(e);if(!r)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" is not a remote MCP app.`});if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" was removed.`});let n=r.risk;t.risk!==void 0&&(w.includes(t.risk)||I("REMOTE_MCP_INVALID",`risk must be one of ${w.join(", ")}`),n=t.risk);let s={...r.tools};if(t.tools&&(s={...t.tools}),t.tool){let{name:l,override:R}=t.tool;if(l.trim()||I("REMOTE_MCP_INVALID","name the tool"),R===null)delete s[l];else{let c={...s[l],...R};c.risk===void 0&&delete c.risk,(c.enabled===void 0||c.enabled===!0)&&delete c.enabled,Object.keys(c).length===0?delete s[l]:s[l]=c}}let i=S({risk:n,tools:s})!==S({risk:r.risk,tools:r.tools}),a={...r,risk:n,tools:s,rev:i?r.rev+1:r.rev},d=H(a);d.ok||I("REMOTE_MCP_INVALID",d.problem);let m=JSON.parse(e.manifest??"{}"),f=O({id:e.appSlug,name:t.name===void 0?e.name:t.name,description:t.description===void 0?e.description:t.description,remote:a}),y={...m,...f};return{manifest:JSON.stringify(y),name:f.name,description:f.description,remote:a}}function ve(e,t){if(!$(e))throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e.appSlug}" is an app deployed to this Gateway, not an MCP app.`});if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" was removed; add it again.`});return e.status===t?null:{status:t}}function Te(e){return!e||!$(e)?null:P(e)}function ke(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function ae(e){if(E(e))return e;throw new o({status:400,code:"PROVIDER_APP_UNKNOWN",message:`"${e}" is not an MCP app. The Gateway offers: ${L.join(", ")}.`})}function be(e,t){if(t.tier!==u)throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e}" is an app deployed to this Gateway${t.status===p?" (deleted, its names still its organization's)":""}, not the MCP app; the MCP app can't take its id.`})}function De(e){let t=ae(e.id),{existingApp:r}=e;if(r&&(r.organizationId!==e.organizationId||r.appSlug!==t))throw new Error("existingApp is another organization's or app's row.");let n=z[t];if(r&&be(t,r),r&&r.status!==p)return{kind:"existing",app:{...r,name:n.name,description:n.description,manifest:JSON.stringify(N(t)),status:"active"},grants:[]};let s=r?.id??crypto.randomUUID(),i={id:s,organizationId:e.organizationId,appSlug:t,name:n.name,description:n.description,hostname:null,workerName:null,tier:u,scope:"org",manifest:JSON.stringify(N(t)),status:"active",versionId:null,deployedAt:e.now,deployedByActor:e.actor,isDefault:!1},a=e.members.filter(d=>d.id===e.actorUserId||ke(d.role)).map(d=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:d.id,appRowId:s,grantedBy:null}));return{kind:r?"revived":"new",app:i,grants:a}}export{de as a,le as b,b as c,D as d,p as e,o as f,ue as g,se as h,me as i,we as j,Ee as k,P as l,ae as m,De as n,C as o,x as p,Ne as q,Oe as r,ve as s,Te as t};

package/dist/chunk-ZECBN24L.js

@@ -1,15 +0,0 @@
-import{Bb as o}from"./chunk-LYNBZ7RV.js";var a=[{sql:`CREATE TABLE IF NOT EXISTS _everyapp_app_resources (
-  worker_name TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  binding TEXT NOT NULL,
-  name TEXT NOT NULL,
-  resource_id TEXT,
-  created_at INTEGER NOT NULL,
-  -- The Worker's row: the last version a deploy uploaded.
-  version_id TEXT,
-  PRIMARY KEY (worker_name, kind, binding)
-)`},{sql:"CREATE UNIQUE INDEX IF NOT EXISTS _everyapp_app_resources_id ON _everyapp_app_resources (kind, resource_id)"},{sql:"CREATE UNIQUE INDEX IF NOT EXISTS _everyapp_app_resources_name ON _everyapp_app_resources (kind, name)"}],t={worker:"Worker",d1:"D1 database",kv:"KV namespace",hyperdrive:"Hyperdrive config",r2:"R2 bucket","email-route":"Email Routing route for"};async function u(e,r){return((await e.run([...a,{sql:"SELECT kind, binding, name, resource_id, version_id FROM _everyapp_app_resources WHERE worker_name = ? ORDER BY kind, binding",params:[r]}])).at(-1)??[]).map(i=>({...s(i),versionId:i.version_id==null?null:String(i.version_id)}))}function s(e){return{kind:String(e.kind),binding:String(e.binding),name:String(e.name),resourceId:e.resource_id===null?null:String(e.resource_id)}}async function _(e,r){return((await e.run([...a,{sql:"SELECT worker_name, binding, name, resource_id FROM _everyapp_app_resources WHERE kind = ? ORDER BY worker_name, binding",params:[r]}])).at(-1)??[]).map(i=>({workerName:String(i.worker_name),...s({...i,kind:r})}))}async function E(e){let[r=[]]=await e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = '_everyapp_app_resources'"}]);if(r.length===0)return[];let[n=[]]=await e.run([{sql:"SELECT worker_name, kind, binding, name, resource_id FROM _everyapp_app_resources ORDER BY worker_name, kind, binding"}]);return n.map(i=>({workerName:String(i.worker_name),...s(i)}))}async function m(e,r,n,i=""){await e.run([...a,{sql:"UPDATE _everyapp_app_resources SET version_id = ? WHERE worker_name = ? AND kind = 'worker' AND binding = ?",params:[n,r,i]}])}async function R(e,r,n){try{await e.run([...a,{sql:`INSERT INTO _everyapp_app_resources (worker_name, kind, binding, name, resource_id, created_at)
-VALUES (?1, ?2, ?3, ?4, ?5, ?6)
-ON CONFLICT (worker_name, kind, binding) DO UPDATE SET name = excluded.name,
-  resource_id = excluded.resource_id`,params:[r,n.kind,n.binding,n.name,n.resourceId,Date.now()]}])}catch(i){throw c(i)?new o("RESOURCE_OWNED",`${d(n)} is recorded as another app's
-${r} can't use it.`,{fix:"rename the binding in everyapp.config.ts"}):i}}async function g(e,r,n){await e.run([...a,n?{sql:"DELETE FROM _everyapp_app_resources WHERE worker_name = ? AND kind = ? AND binding = ?",params:[r,n.kind,n.binding]}:{sql:"DELETE FROM _everyapp_app_resources WHERE worker_name = ?",params:[r]}])}function d({kind:e,name:r}){return`${t[e]} "${r}"`}function c(e){let r=e instanceof Error?e.message:"";return/UNIQUE constraint failed/i.test(r)}export{t as a,u as b,_ as c,E as d,m as e,R as f,g,d as h};

package/dist/delete-XCSIQIRS.js

@@ -1,3 +0,0 @@
-import{f as ee}from"./chunk-OP4DYXYI.js";import{a as Y}from"./chunk-J455FAEN.js";import{e as Q,i as X,j as Z}from"./chunk-EGEWRFVY.js";import{a as q}from"./chunk-2Y5Q6A5K.js";import{m as V}from"./chunk-H6QQMY7B.js";import"./chunk-6OGVO7QK.js";import{e as J}from"./chunk-PS7S74DG.js";import"./chunk-YHJZMJYZ.js";import"./chunk-N5GQLGEC.js";import{b as H}from"./chunk-W3JCQHHU.js";import{M as E,P as I}from"./chunk-TLRM3P7V.js";import{c as b,d as z}from"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-23HJ5I2A.js";import{a as $,b as M,g as U,h as v}from"./chunk-ZECBN24L.js";import"./chunk-ONLNJXVQ.js";import"./chunk-6PGUCTJ6.js";import"./chunk-HOUHG236.js";import{k as P,m as j,o as x,pa as G,q as T,qa as O,r as F,sa as L}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import{c as B}from"./chunk-H7PDL3X5.js";import{a as A,f as N,i as K}from"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{Db as C,Hb as S,b as D,c as y,f as R,k as W,wc as _}from"./chunk-LYNBZ7RV.js";import ae from"node:path";import te from"chalk";async function Fe(t,n){await _(t,async l=>{let o=n??(await B(ae.join(process.cwd(),"everyapp.config.ts"),{message:"Which app? There's no everyapp.config.ts here",fix:`run this from the app's directory, or name it: ${y} delete <id>`})).id,a=A(t.json??!1);await ce({appId:o,flags:t,interactive:a});let m=await se({appId:o,gateway:O(t.gateway),accountId:t["account-id"],out:l,json:t.json,interactive:a,purge:t.purge??!1});l.emit({type:"done",...ie(o,m)})})}async function se({appId:t,gateway:n,accountId:l,out:o,json:a,interactive:m,purge:r,createCf:c,reconcile:g}){let i=await L({gateway:n,accountId:l,interactive:m,login:{json:a,out:o,step:"app.login"},createCf:c}),{cf:p,db:f}=i,k=Y(g,o);await V(i.install,k.source),o.emit({type:"step",step:"app.delete",status:"start",message:`Removing ${t} from the Gateway...`,data:{appId:t}});let h=(await E(f)).find(ne=>ne.appId===t),u={publicRoutes:(h?.publicPaths.length??0)>0,mcp:h?.mcp??!1},d=await G(f,t,i.deployer,Date.now(),{purge:r}),e=i.install,s=e.liveAppWorkers.includes(d.workerName)||e.liveDomains.includes(d.hostname);(!d.alreadyDeleted||s)&&await q({cf:p,out:o,accountId:i.accountId,databaseId:i.databaseId,interactive:m,cliVersion:D,...g,openRelease:k.openRelease}),await I({cf:p,db:f,install:i.install,out:o},{appId:t,surface:u,removing:!0}),o.emit({type:"step",step:"app.delete",status:"ok",message:`${t} is deleted on the gateway; ${d.hostname} stops serving it.`,data:{appId:t,hostname:d.hostname,workerName:d.workerName,alreadyDeleted:d.alreadyDeleted&&!s}});let w=await P(f);if(w&&H(d.hostname,w.appBaseDomain)&&!w.liveDomains.includes(d.hostname)&&await ee({cf:p,out:o,zoneId:w.zoneId,hostname:d.hostname}),!r)return d;let re=await le(p,f,i.accountId,o,t,d);return{...d,purged:re}}function ie(t,{workerName:n,alreadyDeleted:l,purged:o}){let a=`${y} delete ${t} --purge`,m=o?o.kept.length>0?`Deleted ${t}${o.removed.length>0?` and ${o.removed.join(", ")}`:""}; kept ${o.kept.join(", ")}.`:o.removed.length>0?`Deleted ${t} and ${o.removed.join(", ")}.`:`Deleted ${t}; nothing of it was left in Cloudflare.`:`${l?`${t} was already deleted`:`Deleted ${t}`}; its Worker and data are kept, and any cron triggers, Workflows and mail routes keep running.`,r=o?"":l?te.dim(`Its Worker and data are kept. To delete them: ${a}`):["Its Worker and data are kept, and any cron triggers, Workflows and mail routes keep running.",`To delete those too: ${a}`].map(c=>te.dim(c)).join(`
-`);return{message:m,display:r,data:{appId:t,workerName:n,alreadyDeleted:l,purged:o?o.kept.length===0:!1,removed:o?.removed??[],kept:o?.kept??[]}}}var me=["Worker","Workflow","D1 database","KV namespace","Hyperdrive config","mail route"],oe={worker:"Compute (Workers) \u2192 Workers & Pages",d1:"Storage & Databases \u2192 D1",kv:"Storage & Databases \u2192 KV",workflow:"Compute (Workers) \u2192 Workflows"};async function le(t,n,l,o,a,m){o.emit({type:"step",step:"app.purge",status:"start",message:`Deleting ${a}'s Worker and data...`,data:{appId:a}});let r=new Map,c=e=>r.set(e,(r.get(e)??0)+1),g=await M(n,m.workerName),i=await J({cf:t,gatewayDb:n,accountId:l,workerName:m.workerName,routes:g.filter(e=>e.kind==="email-route")});i.length>0&&r.set("mail route",i.length);let p=g.filter(e=>e.kind!=="email-route"),f=[],k=new Set(p.flatMap(e=>e.kind==="worker"&&e.resourceId?[e.resourceId]:[]));if(k.size>0)for(let e of await X(t,m.workerName)){if(!k.has(e.script_name??"")){if(e.name.startsWith(`${m.workerName}--`)){let s=e.script_name??"unknown";f.push({described:`Workflow "${e.name}" (Worker ${s}'s)`,shown:`the Workflow ${e.name}, which Worker ${s} runs`,place:oe.workflow})}continue}await Z(t,e.name)&&(i.push(`Workflow "${e.name}"`),c("Workflow"))}let h=e=>e.kind!=="worker"?2:e.binding===""?0:1;for(let e of p.sort((s,w)=>h(s)-h(w)))if(e.resourceId)try{if(e.kind==="worker"){if(!await b(t,e.resourceId))continue;await z(t,e.resourceId)}else e.kind==="d1"?await T(t,e.resourceId):e.kind==="hyperdrive"?await Q(t,e.resourceId):await F(t,e.resourceId);i.push(v(e)),c($[e.kind])}catch(s){if(!S(s,"not_found"))throw s}await U(n,m.workerName);let u=[...await de(t,m,p),...f],d=me.flatMap(e=>{let s=r.get(e)??0;return s===0?[]:[s===1?e:R(s,e)]});if(o.emit({type:"step",step:"app.purge",status:"ok",message:i.length?`Deleted ${i.join(", ")}.`:"Nothing deleted in Cloudflare.",data:{appId:a,removed:i,kinds:d}}),u.length>0){let e=u.length===1;o.emit({type:"warning",code:"RESOURCES_KEPT",step:"app.purge",message:[`Kept ${W(u.map(s=>s.shown))}`,e?`It has ${a}'s name, but no deploy recorded creating it, so it may belong to something else.`:`They have ${a}'s names, but no deploy recorded creating them, so they may belong to something else.`].join(`
-`),data:{kept:u.map(s=>s.described),fix:e?`if it is ${a}'s, delete it in the Cloudflare dashboard (${u[0].place})`:`if they are ${a}'s, delete them in the Cloudflare dashboard`}})}return{removed:i,kept:u.map(e=>e.described)}}async function de(t,n,l){let o=new Set(l.filter(r=>r.resourceId).map(r=>`${r.kind}:${r.name}`)),a=[],m=(r,c)=>a.push({described:v({kind:r,name:c}),shown:`the ${$[r]} ${c}`,place:oe[r]});!o.has(`worker:${n.workerName}`)&&await b(t,n.workerName)&&m("worker",n.workerName);for(let r of["d1","kv"])for(let c of new Set(Object.values(n.resources[r])))o.has(`${r}:${c}`)||await(r==="d1"?j:x)(t,c)&&m(r,c);return a}async function ce({appId:t,flags:n,interactive:l}){if(n.purge&&l&&!n.yes){let o=(await N(`Type ${t} to confirm`,{context:[`This deletes ${t}'s Worker and all its data for good.`]})).trim();if(o!==t)throw new C(o?`"${o}" doesn't match ${t}. Nothing deleted.`:"Cancelled. Nothing deleted.");return}await K({yes:n.yes,interactive:l,question:`Delete ${t} from the Gateway?`,unattended:"Deleting an app needs confirmation at a terminal, or --yes",context:["Its Worker and data stay; --purge deletes them too."],cancelled:"Cancelled. Nothing deleted."})}export{Fe as deleteApp,ie as deletionSummary,se as removeApp};

package/dist/deploy-3QOZEZHC.js

@@ -1 +0,0 @@
-import{b as a,c as b}from"./chunk-FJJSSVET.js";import"./chunk-GKBPYVP3.js";import"./chunk-PNLU5U3P.js";import"./chunk-CZTEDWZ2.js";import"./chunk-N4E5YE4X.js";import"./chunk-BHMRY53V.js";import"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-J455FAEN.js";import"./chunk-EGEWRFVY.js";import"./chunk-2Y5Q6A5K.js";import"./chunk-H6QQMY7B.js";import"./chunk-6OGVO7QK.js";import"./chunk-PS7S74DG.js";import"./chunk-YHJZMJYZ.js";import"./chunk-N5GQLGEC.js";import"./chunk-W3JCQHHU.js";import"./chunk-TLRM3P7V.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-23HJ5I2A.js";import"./chunk-ZECBN24L.js";import"./chunk-ONLNJXVQ.js";import"./chunk-6PGUCTJ6.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";export{a as deploy,b as deployDone};

package/dist/install-Z5FYXUYM.js

@@ -1 +0,0 @@
-import{a as l,c as i}from"./chunk-FJJSSVET.js";import{h as n}from"./chunk-GKBPYVP3.js";import"./chunk-PNLU5U3P.js";import"./chunk-CZTEDWZ2.js";import"./chunk-N4E5YE4X.js";import"./chunk-BHMRY53V.js";import"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-J455FAEN.js";import"./chunk-EGEWRFVY.js";import"./chunk-2Y5Q6A5K.js";import"./chunk-H6QQMY7B.js";import"./chunk-6OGVO7QK.js";import"./chunk-PS7S74DG.js";import"./chunk-YHJZMJYZ.js";import"./chunk-N5GQLGEC.js";import"./chunk-W3JCQHHU.js";import"./chunk-TLRM3P7V.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-23HJ5I2A.js";import"./chunk-ZECBN24L.js";import"./chunk-ONLNJXVQ.js";import"./chunk-6PGUCTJ6.js";import"./chunk-HOUHG236.js";import{qa as a}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{wc as r}from"./chunk-LYNBZ7RV.js";async function b(e,p){await r(e,async o=>{let m=a(e.gateway),t=await n(p,{out:o});try{let s=await l({cwd:process.cwd(),manifest:t.manifest,release:t,gateway:m,accountId:e["account-id"],out:o,json:e.json,verbose:e.verbose,allowDeleteDurableObjectData:e["allow-delete-durable-object-data"],allowDeleteWorkflows:e["allow-delete-workflows"],forceDns:e["force-dns"],enableEmailRouting:e["enable-email-routing"],waitForLive:!e["no-wait"],offerInstall:{yes:e.yes}});o.emit({type:"done",...i(s)})}finally{await t.cleanup()}})}export{b as install};

package/dist/mcp-EFDUKJ5V.js

@@ -1 +0,0 @@
-import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p}from"./chunk-IUOBIB5M.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";export{a as add,i as addServer,p as changeTool,e as list,m as listMcp,d as off,c as on,g as refresh,o as refreshApp,b as remove,l as removeApp,f as show,n as showApp,h as tool,k as turnOff,j as turnOn};

package/dist/provider-EOI5PTFH.js

@@ -1,13 +0,0 @@
-import{j as z,k as V}from"./chunk-IUOBIB5M.js";import"./chunk-IFCPALVC.js";import{a as G,c as M,d as J}from"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-ZFCUH5PK.js";import{a as T}from"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import{na as x,qa as B,sa as D}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import{a as L}from"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{$a as C,Bb as S,D as $,Fb as E,J as U,Yb as F,c as f,eb as _,fb as N,k as y,pc as K,qb as j,wc as v,xa as I}from"./chunk-LYNBZ7RV.js";import R from"node:fs/promises";import k from"node:path";import{stripVTControlCharacters as H}from"node:util";import m from"chalk";var P=64*1024;async function Ce(e,t){await v(e,n=>ne({flags:e,out:n},t))}async function Ne(e){await v(e,t=>ie({flags:e,out:t}))}async function je(e,t){await v(e,n=>de({flags:e,out:n},t))}async function Ee(e,t){await v(e,n=>ce({flags:e,out:n},t))}async function Te(e,t){await v(e,n=>q({flags:e,out:n},"on",t))}async function xe(e,t){await v(e,n=>q({flags:e,out:n},"off",t))}async function q(e,t,n){e.out.emit({type:"step",step:"provider.alias",status:"ok",message:`everyapp provider ${t} is now everyapp mcp ${t}; this alias goes after launch week.`,data:{command:`${f} mcp ${t} ${n}`}}),await(t==="on"?z:V)(e,n)}function b({flags:e,out:t,createCf:n}){return D({gateway:B(e.gateway),accountId:e["account-id"],interactive:L(e.json??!1),login:{json:e.json,out:t,step:"login"},createCf:n})}async function Y(e){try{return await R.access(k.join(e,"everyapp.config.ts")),!0}catch{return!1}}function u(e,t){return new S("PROVIDER_SPEC_INVALID",e,{fix:t})}async function ee(e,{cwd:t,fetcher:n=fetch}){let a;if(/^[a-z][a-z0-9+.-]*:\/\//i.test(e)){let c;try{c=new URL(e)}catch{throw u(`${e} isn't a URL`,"give the spec's https URL, or a path to the file")}if(c.protocol!=="https:")throw u(`${e} isn't https`,"fetch specs over https only, or save the file and give its path");let o;try{o=await n(c,{headers:{accept:"application/json"},redirect:"follow"})}catch(i){throw u(`Couldn't fetch ${e}: ${E(i).split(`
-`)[0]}`,"check the URL, or save the file and give its path")}if(o.url&&!o.url.startsWith("https://"))throw u(`${e} redirected to a URL that isn't https`,"give the spec's final https URL");if(!o.ok)throw u(`${e} answered ${o.status}`,"check the URL, or save the file and give its path");a=await te(o,e)}else{let c=k.resolve(t,e),o;try{if((await R.stat(c)).size>P)throw u(`${e} is over ${P/1024} KiB`,"a spec is a short JSON file");o=await R.readFile(c)}catch(i){throw i instanceof S?i:F(i)?u(`No file at ${e}`,"give the path to the spec's JSON file, or its https URL"):i}a=o.toString("utf8")}try{return JSON.parse(a)}catch(c){throw u(`${e} isn't JSON: ${E(c).split(`
-`)[0]}`,"fix the file, then add it again")}}async function te(e,t){let n=Number(e.headers.get("content-length")),a=()=>u(`${t} is over ${P/1024} KiB`,"a spec is a short JSON file");if(Number.isFinite(n)&&n>P)throw a();if(!e.body)return"";let c=e.body.getReader(),o=[],i=0;for(;;){let{done:l,value:r}=await c.read();if(l)break;if(i+=r.byteLength,i>P)throw await c.cancel(),a();o.push(r)}return Buffer.concat(o).toString("utf8")}function W(e){return y([...e.hosts,...e.hostSetting?[`the host ${e.hostSetting} names`]:[]])}function se(e){let{auth:t}=e;switch(t.kind){case"bearer":return`as ${t.scheme??"a bearer"} token`;case"header":return`in the ${t.header} header`;case"query":return`as the ${t.param} query parameter`;case"basic":return"as HTTP Basic"}}async function ne(e,t){let{out:n,flags:a}=e,c=e.cwd??process.cwd(),o=await ee(t,{cwd:c,fetcher:e.fetch}),i=await b(e),l=o&&typeof o=="object"&&typeof o.id=="string"?o.id:"the provider";n.emit({type:"step",step:"provider.add",status:"start",message:`Registering ${l}...`});let r=await M(i.db,{spec:o,deployer:i.deployer,replace:a.replace??!1,install:i.install,now:e.now?.()}),{id:d,capability:s}=r,p=[...$(s)],w=i.gatewayUrl.replace(/^https:\/\//,"");n.emit({type:"step",step:"provider.add",status:"ok",message:`${r.replaced?"Replaced":"Registered"} ${s.label} (${d}) on ${w}`,data:{id:d,replaced:r.replaced}});let g=null;await Y(c)&&(g=N(d),await X(c,d,s));let O=p.join(" "),h=[`${r.replaced?"Replaced":"Registered"} ${s.label} (${d}) on ${w}.`,`Its key goes to ${W(s)} only, ${se(s)}.`,...r.replaced?["The key set before was for the old spec: set it again before the Gateway sends it."]:[],...g?[`Wrote ${g} for everyapp dev (your key goes in .dev.vars).`]:[],`Apps list it as capabilities: { ${JSON.stringify(d)}: { access: "${s.access[0]}", why: "..." } }.`];n.emit({type:"done",message:H(h.join(`
-`)),display:[h[0],...h.slice(1).map(A=>m.dim(A))].join(`
-`),data:{id:d,name:s.label,hosts:[...s.hosts],...s.hostSetting?{hostSetting:s.hostSetting}:{},settings:p,source:"row",replaced:r.replaced,...g?{devFile:g}:{},next:[{command:`${f} secret set ${O}`,note:`${s.label}'s key, from ${s.docs}; the Gateway sends it only to ${W(s)}`}]}})}async function X(e,t,n){let a=k.join(e,_,`${t}.json`);return await R.mkdir(k.dirname(a),{recursive:!0}),await R.writeFile(a,`${JSON.stringify(C(t,n),null,2)}
-`),a}function oe(e){switch(e.mode){case"api_key":return"api key";case"ai":return"ai";case"oauth_client":return"oauth client";case"service":return null}}function Q(e){switch(e.mode){case"api_key":return{hosts:[...e.hosts],...e.hostSetting?{hostSetting:e.hostSetting}:{}};case"ai":return{hosts:[new URL(e.origin).host]};case"oauth_client":return{hosts:[...new Set(e.token.flatMap(t=>t.host?[t.host]:[]))],...e.hostSetting?{hostSetting:e.hostSetting}:{}};case"service":return{hosts:[]}}}function Z(e,t,n){return e.filter(a=>a.manifest?n.mode==="ai"?I(a.manifest).includes(t):!!(a.manifest.capabilities&&Object.hasOwn(a.manifest.capabilities,t)):!1).map(a=>a.appSlug)}function re(e,t,n){let a=new Map(e.rows().map(o=>[o.id,o])),c=[];for(let[o,i]of e.entries()){let l=oe(i);if(!l)continue;let r=a.get(o);c.push({id:o,name:i.label,kind:l,...Q(i),settings:$(i).map(d=>({name:d,set:t.includes(d)})),bound:e.bound(o),source:r?"row":"catalog",...r?{addedBy:r.addedBy,addedAt:r.addedAt}:{},apps:Z(n,o,i)})}return c}async function ie(e){let{out:t}=e,n=await b(e),[a,c,o]=await Promise.all([G(n.db,n.install),T(n.cf,j),x(n.db)]),i=re(a,c,o),l=K(["ID","NAME","KIND","HOSTS","SETTINGS","SOURCE","APPS"],i.map(s=>[s.id,s.name,s.kind,[...s.hosts,...s.hostSetting?[`<${s.hostSetting}>`]:[]].join(", ")||m.dim("-"),[s.settings.map(p=>`${p.name} ${p.set?m.green("set"):m.yellow("not set")}`).join(", "),...s.source==="row"?[s.bound?m.green("bound"):m.yellow("not bound")]:[]].join(", "),s.source==="row"?`registered by ${s.addedBy??"someone"}`:m.dim("catalog"),s.apps.join(", ")||m.dim("-")])),r=i.filter(s=>s.source==="row").length,d=a.rejected.map(({id:s,code:p,message:w})=>({id:s,code:p,message:w}));t.emit({type:"done",message:`${i.length} providers: ${i.length-r} built in, ${r} registered`,display:[...l,...d.length>0?["",m.yellow(`The Gateway doesn't serve ${y(d.map(s=>s.id))}:`),...d.map(s=>m.dim(`  ${s.id}: ${s.message} (${s.code})`))]:[],"",m.dim(`MCP apps: ${f} mcp list`)].join(`
-`),data:{providers:i,...d.length>0?{rejected:d}:{},mcp:`${f} mcp list`}})}function ae(e,t){let n=[...$(t)];switch(t.mode){case"api_key":return C(e,t);case"ai":return{id:e,kind:"ai",name:t.label,...t.description?{description:t.description}:{},docs:t.docs,...t.api?{api:t.api}:{},...t.hint?{hint:t.hint}:{},settings:n,hosts:[new URL(t.origin).host],routes:[...t.inferenceRoutes],...t.setup?{setup:t.setup}:{}};case"oauth_client":return{id:e,kind:"oauth client",name:t.label,docs:t.console,settings:n,tokenEndpoints:U(t).split(", "),authorize:{url:t.authorize.url,scopes:[...t.authorize.scopes]},redirectPaths:[...t.redirectPaths],...t.hostSetting?{hostSetting:t.hostSetting}:{},...t.setup?{setup:t.setup}:{}};case"service":return{id:e,name:t.label}}}async function de(e,t){let{out:n,flags:a}=e,c=e.cwd??process.cwd();if(a.save&&!await Y(c))throw new S("MANIFEST_NOT_FOUND",`No everyapp.config.ts in this directory
---save writes the spec where everyapp dev reads it, in an app's directory. Nothing was written.`,{fix:"run this from the app's directory"});let o=await b(e),[i,l]=await Promise.all([G(o.db,o.install),x(o.db)]),r=i.get(t);if(!r||r.mode==="service"){let h=i.rejected.find(A=>A.id===t);throw new S("PROVIDER_NOT_FOUND",r?`${t} is a Gateway service, not a provider
-Apps call it with its own helper (sendEmail(), listMembers()).`:h?`The Gateway doesn't serve ${t}: ${h.message}`:`${t} isn't a provider this Gateway offers`,{rerun:`${f} provider list`,rerunNote:"names every one"})}let d=i.rows().find(h=>h.id===t),s=ae(t,r),p=null;if(a.save){if(!d||r.mode!=="api_key")throw new S("PROVIDER_BUILTIN",`${t} is built in
-everyapp dev reaches it without a file. Nothing was written.`,{fix:`put its key in .dev.vars: ${$(r).join(", ")}`});await X(c,t,r),p=N(t)}let w=Z(l,t,r),g=i.bound(t),O=[d?`Registered by ${d.addedBy??"someone"}${d.addedAt?` on ${new Date(d.addedAt).toISOString().slice(0,10)}`:""}; ${g?"its key is bound to these hosts":"its key isn't set for these hosts yet"}.`:"Built in.",w.length>0?`Used by ${y(w)}.`:"No app lists it yet.",...p?[`Wrote ${p} for everyapp dev.`]:[]];n.emit({type:"done",message:`${r.label} (${t})`,display:[JSON.stringify(s,null,2),"",...O.map(h=>m.dim(h))].join(`
-`),data:{provider:s,source:d?"row":"catalog",bound:g,addedBy:d?.addedBy??null,addedAt:d?.addedAt??null,apps:w,...p?{saved:p}:{},...d&&!g?{next:[{command:`${f} secret set ${$(r).join(" ")}`,note:`${r.label}'s key; the Gateway sends it only to ${y(Q(r).hosts)}`}]}:{}}})}async function ce(e,t){let{out:n,flags:a}=e,c=await b(e);n.emit({type:"step",step:"provider.remove",status:"start",message:`Removing ${t}...`});let o=await J(c.db,t,c.deployer,{force:a.force??!1,now:e.now?.()}),i=await T(c.cf,j),l=o.settings.map(p=>({name:p,set:i.includes(p)})),r=l.filter(p=>p.set).map(p=>p.name),d=c.gatewayUrl.replace(/^https:\/\//,"");n.emit({type:"step",step:"provider.remove",status:"ok",message:`Removed ${o.name} (${t}) from ${d}`,data:{id:t}});let s=[`Removed ${o.name} (${t}) from ${d}.`,"The Gateway stops serving it within 30 seconds.",...o.apps.length>0?[`${y(o.apps)} ${o.apps.length===1?"lists":"list"} it: ${o.apps.length===1?"its":"their"} calls to it fail until it is registered again.`]:[],...r.length>0?[`${y(r)} ${r.length===1?"stays":"stay"} on the Gateway, read by nothing: ${f} secret unset ${r.join(" ")} removes ${r.length===1?"it":"them"}.`]:[]];n.emit({type:"done",message:H(s.join(`
-`)),display:[s[0],...s.slice(1).map(p=>m.dim(p))].join(`
-`),data:{id:t,name:o.name,removed:!0,settings:l,apps:o.apps,...r.length>0?{next:[{command:`${f} secret unset ${r.join(" ")}`,note:"the key nothing reads any more"}]}:{}}})}export{P as MAX_SPEC_BYTES,Ce as add,ne as addFromSpec,Ne as list,ie as listProviders,xe as off,Te as on,ee as readSpecSource,Ee as remove,ce as removeRegistered,q as runMcpAlias,je as show,de as showProvider};

package/dist/release-74J5ZIL3.js

@@ -1 +0,0 @@
-import{b as v,c as g,d as k,e as w,g as A}from"./chunk-GKBPYVP3.js";import"./chunk-6OGVO7QK.js";import"./chunk-W3JCQHHU.js";import{e as h,g as b}from"./chunk-ONLNJXVQ.js";import{a as y}from"./chunk-H7PDL3X5.js";import{$b as d,Ub as c,ac as u,c as o,wc as f}from"./chunk-LYNBZ7RV.js";import C from"node:path";async function E({cwd:t,manifest:e,outFile:a,out:s,verbose:p=!1,createCf:R=()=>u(),installDeps:$=d}){e.install!==!1&&(s.emit({type:"step",step:"app.install",status:"start",message:"Installing dependencies..."}),await $({cwd:t,description:"Installing dependencies...",install:e.install,verbose:p}),s.emit({type:"step",step:"app.install",status:"ok"})),s.emit({type:"step",step:"app.build",status:"start",message:"Building..."}),await g({cwd:t,cf:R(),buildCommand:e.build,verbose:p});let l=h(e);await k({cwd:t,inputs:{...l,helperWorkers:(e.workers??[]).map(n=>b(l.workerName,n.name)),declared:e.resources}}),s.emit({type:"step",step:"app.build",status:"ok",message:"Built the app and checked its Build Output."}),await v({cwd:t,manifest:e,out:s});let i=C.resolve(t,a),m=C.isAbsolute(a)||a.startsWith(".")?a:`./${a}`,B=await c(t).then(n=>n.version,()=>"unknown"),r=await A({cwd:t,manifest:e,outFile:i,cfVersion:B});return s.emit({type:"step",step:"app.release",status:"ok",message:`Packed ${e.id} ${r.version} (${r.sha256.slice(0,12)}) into ${i}.`,data:{tarball:i,shown:m,appId:e.id,version:r.version,sha256:r.sha256}}),{tarball:i,shown:m,version:r.version,sha256:r.sha256}}async function H(t){await f(t,async e=>{let a=process.cwd(),s=await E({cwd:a,manifest:await y(a),outFile:t.out??w,out:e,verbose:t.verbose});e.emit({type:"done",data:{...s,next:[{command:`${o} install ${s.shown}`,note:"installs it on your Gateway"},{command:`${o} install <repository url>`,note:"installs it on any Gateway, once the tarball is attached to a GitHub release of the app's repository"}]}})})}export{H as release};

package/dist/secret-7FKKTLHB.js

@@ -1 +0,0 @@
-import{A as e,B as f,C as g,D as h,E as i,F as j,G as k,H as l,w as a,x as b,y as c,z as d}from"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";export{j as ManifestSource,g as applyAppSettings,f as applyGatewaySettings,e as applySecretValues,l as doneData,c as list,i as listSecrets,a as set,d as setSecrets,k as storedManifestOf,b as unset,h as unsetSecrets};

package/dist/setup-PAKRCAFO.js

@@ -1 +0,0 @@
-import{a,b,c}from"./chunk-ZEXVHB22.js";import"./chunk-CZTEDWZ2.js";import"./chunk-N4E5YE4X.js";import"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-2Y5Q6A5K.js";import"./chunk-H6QQMY7B.js";import"./chunk-6OGVO7QK.js";import"./chunk-N5GQLGEC.js";import"./chunk-W3JCQHHU.js";import"./chunk-TLRM3P7V.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-23HJ5I2A.js";import"./chunk-ZECBN24L.js";import"./chunk-ONLNJXVQ.js";import"./chunk-6PGUCTJ6.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";export{c as reportGatewayResult,b as runGatewayCommand,a as setup};

package/dist/status-RMWNHOEK.js

@@ -1,4 +0,0 @@
-import{a as Ge}from"./chunk-N4E5YE4X.js";import{a as ce,f as me}from"./chunk-E3EPK27P.js";import{a as Pe}from"./chunk-WOVS3GV5.js";import{a as J,b as be,d as Ae,e as $e,j as Ne,l as ke,p as Ee}from"./chunk-OM2HDWVP.js";import{b as We}from"./chunk-OP4DYXYI.js";import{b as xe,h as De,i as Oe,l as Te}from"./chunk-H6QQMY7B.js";import{p as _e}from"./chunk-6OGVO7QK.js";import{f as Ue}from"./chunk-PS7S74DG.js";import"./chunk-YHJZMJYZ.js";import"./chunk-N5GQLGEC.js";import{b as Ce}from"./chunk-W3JCQHHU.js";import{c as Ie}from"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import{a as Re}from"./chunk-23HJ5I2A.js";import{c as ve}from"./chunk-ZECBN24L.js";import"./chunk-ONLNJXVQ.js";import"./chunk-6PGUCTJ6.js";import{a as ge,b as L}from"./chunk-HOUHG236.js";import{la as ye,na as he,ra as we}from"./chunk-RMF4YGD6.js";import{b as j}from"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{Fb as ue,K as se,c as S,ca as z,da as Y,ea as ae,f as k,g as _,ga as le,hc as pe,ic as fe,k as A,oc as q,pc as X,qb as de,wc as Se}from"./chunk-LYNBZ7RV.js";var T=e=>Number(e?.[0]?.n??0);async function Fe(e,t,n=Date.now()){let[r,o,i,s,u]=await e.run([{sql:"SELECT count(*) AS n FROM members WHERE organization_id = ?",params:[t]},{sql:"SELECT count(*) AS n FROM invitations WHERE organization_id = ? AND status = 'pending' AND expires_at > ?",params:[t,n]},{sql:"SELECT count(*) AS n FROM mcp_connections WHERE organization_id = ? AND revoked_at IS NULL",params:[t]},{sql:"SELECT count(*) AS n FROM user_access_tokens WHERE organization_id = ? AND revoked_at IS NULL AND expires_at > ?",params:[t,n]},{sql:"SELECT count(*) AS n FROM app_tool_catalogs WHERE organization_id = ? AND status = 'ok' AND tool_count > 0",params:[t]}]);return{members:T(r),invitations:T(o),connections:T(i),tokens:T(s),toolApps:T(u)}}import nt from"chalk";function Me(e){return e.severity==="error"||e.severity==="warning"}function v(e,...t){return{text:e.reduce((n,r,o)=>n+r+(t[o]??""),""),human:e.reduce((n,r,o)=>n+r+(o<t.length?nt.bold(t[o]):""),"")}}function Q(e){return e.bound&&(e.status==="active"||e.status==="binding")}function R(e){return Q(e)&&e.setup!==null&&!e.setup.ready}var P=`${S} setup`,B=`${S} deploy`,rt=`${S} update`;function Le(){return{code:"GATEWAY_NOT_INSTALLED",severity:"warning",headline:"Setup stopped before it recorded the Gateway's install",detail:["The Gateway's database exists, but nothing else was recorded."],run:v`${P}`,runNote:"asks for the hostname again"}}function Be({install:e,desired:t,apps:n,unboundApps:r,owner:o,servingVersionId:i,inSync:s,waitingCertificates:u,certificates:h,access:y,leases:p,checkout:f,emailProblems:m,settings:w}){let g=[],N=e.releaseVersion;if(f.behind){let d=f.checkout?.version;g.push({code:"CHECKOUT_BEHIND",severity:"warning",headline:"This checkout is behind the live Gateway",detail:[...d&&d!==N?[`This checkout has ${d}; ${N} is live.`]:[],"Deploys from here are refused until it catches up."],run:v`${"git pull"}`})}else f.upToDate===!1&&e.liveVersionId!==null&&g.push({code:"GATEWAY_OUTDATED",severity:"info",headline:"Your every-app folder has a newer Gateway than the one online",detail:["Run update now, or leave it: the next new app's deploy updates it too."],run:v`${rt}`,runNote:"updates it now"});e.liveVersionId===null?g.push({code:"GATEWAY_NOT_UPLOADED",severity:"warning",headline:"The Gateway's install stopped before its first upload",detail:["Setup finishes it, then prints the link that creates the owner account."],run:v`${P}`}):(i!==e.liveVersionId?g.push({code:"GATEWAY_CHANGED",severity:"warning",headline:"The Gateway Worker was changed outside everyapp",detail:["It serves a version from the dashboard or API, not the one setup uploaded."],run:v`${P}`,runNote:`redeploys ${N}, asking first`}):s||g.push(it(r)),o||g.push({code:"NO_OWNER",severity:"warning",headline:"No owner yet, so nobody can sign in",detail:["Apps still deploy. Setup prints a one-time link that creates the owner account."],run:v`${P}`}));for(let d of t.missing)g.push({code:"APP_WORKER_MISSING",severity:"error",headline:`${d.appId}'s Worker no longer exists`,detail:[],run:v`${B} from ${d.appId}'s directory, or ${`${S} delete ${d.appId}`}`});for(let d of t.skipped)g.push({code:"APP_NOT_BOUND",severity:"error",headline:`The Gateway can't bind ${d.appId}`,detail:[`Its Worker isn't named the way the Gateway names ${d.appId}'s.`],run:v`${`${S} delete ${d.appId}`}`});let b=new Set(t.missing.map(d=>d.workerName));for(let d of n)b.has(d.workerName)||(d.status==="pending"?g.push({code:"APP_NOT_UPLOADED",severity:"warning",headline:`${d.id} was registered, but none of its deploys finished`,detail:[],run:v`${B} from the app's directory, or ${`${S} delete ${d.id}`}`}):d.status==="binding"&&d.bound&&g.push({code:"APP_BINDING",severity:"settling",headline:`${d.id} goes live on its first visit to https://${d.hostname}`,detail:[]}));w&&g.push({code:"SETTINGS_UNKNOWN",severity:"warning",headline:"Couldn't list the Workers' secrets",detail:[`Cloudflare said: ${w.error}. Whether the apps' settings are set isn't known.`]});for(let d of n)R(d)&&g.push(ot(d.id,d.setup));"error"in m&&g.push({code:"EMAIL_ROUTES_UNKNOWN",severity:"warning",headline:"Couldn't check the apps' Email Routing rules",detail:[`Cloudflare said: ${m.error}. Deleted rules won't show above.`]});for(let d of n){let $=st(d,"error"in m?[]:m);$&&g.push($)}h&&g.push({code:"CERTIFICATES_UNKNOWN",severity:"warning",headline:`Couldn't list ${e.zoneName}'s certificates`,detail:[`Cloudflare said: ${h.error}.`]}),u.length>0&&g.push({code:"CERT_PENDING",severity:"settling",headline:`No certificate yet for ${u.join(", ")}`,detail:["It usually comes within minutes."]}),y&&g.push({code:"ACCESS_UNKNOWN",severity:"warning",headline:"Couldn't check whether Cloudflare Access is on",detail:[`Cloudflare said: ${y.error}.`]});for(let d of p)g.push({code:"DEPLOY_RUNNING",severity:"settling",headline:`${_(L(d))} is running`,detail:[]});return[...g.filter(d=>d.severity!=="info"),...g.filter(d=>d.severity==="info")]}function ot(e,t){return{code:"APP_NEEDS_SETUP",severity:"warning",headline:`${e} needs setup`,detail:Ee(t.unmet),...t.command?{run:v`${t.command.command}`}:{}}}function it(e){if(e.length===0)return{code:"BINDINGS_DIFFER",severity:"warning",headline:"The live Gateway's apps or hostnames are out of date",detail:["It still serves something that was removed, or not yet what was added."],run:v`${P}`};let t=A(e);return{code:"BINDINGS_DIFFER",severity:"warning",headline:`The live Gateway doesn't serve ${t}`,detail:[e.length===1?`${t} is uploaded, but the live Gateway doesn't bind it.`:`${t} are uploaded, but the live Gateway doesn't bind them.`],run:v`${P}`}}function st(e,t){let{inbound:n,routed:r,declaresInbound:o}=e.email;if(n.length>0&&!o){let f=A(n);return{code:"EMAIL_INBOUND_UNDECLARED",severity:"warning",headline:`${e.id} has ${n.length===1?"an inbound address":"inbound addresses"}, but its config doesn't turn inbound mail on`,detail:[`${e.id} was deployed without email: { inbound: true }, so nothing routes ${f}.`],fix:v`declare it in everyapp.config.ts and run ${B}, or drop ${n.length===1?"the address":"the addresses"}: ${`${S} email unset inbound`}`,where:`Run either from ${e.id}'s directory.`}}let i=n.filter(f=>!r.includes(f)),s=r.filter(f=>!n.includes(f)),u=t.filter(f=>f.workerName===e.workerName);if(i.length+s.length+u.length===0)return null;let h=[...i.length>0?[`${A(i)} ${i.length===1?"isn't":"aren't"} routed yet`]:[],...u.map(f=>`${f.address} gets no mail: ${f.problem}`),...s.length>0?[`${A(s)} ${s.length===1?"is":"are"} still routed, though no longer listed`]:[]],y=i.length+u.length,p=s.length>0?`${e.id}'s mail routes don't match its addresses`:u.length===0?`${e.id} doesn't get mail at ${A(i)} yet`:y===1?`${e.id} doesn't get mail at ${u[0].address}`:`${e.id} doesn't get mail at ${y} of its addresses`;return{code:u.length>0?"EMAIL_ROUTE_MISSING":"EMAIL_ROUTE_PENDING",severity:"warning",headline:p,detail:s.length===0&&u.length===0?[]:s.length===0&&y===1?[`${_(u[0].problem)}.`]:[`${h.join("; ")}.`],run:v`${B} from ${e.id}'s directory`}}var at=4,lt="https://everyapp.com/docs/connect-ai",He=Object.values(se).map(e=>e.keyEnv);function Z(e,t){return e.some(n=>R(n)&&n.setup.unmet.some(r=>r.names.includes(t)))}function Ve(e,t){return e.filter(n=>n.setup?.settings.some(r=>r.kind==="capability"&&r.id===t)).map(n=>n.id)}function dt(e){let{apps:t,gatewayNames:n}=e;if(!n||He.some(i=>n.includes(i)))return null;let r=[],o=[];for(let i of t){let s=(i.setup?.settings??[]).filter(u=>u.kind==="provider"&&u.set===!1).flatMap(u=>u.names.filter(h=>He.includes(h))).filter(u=>!Z(t,u));if(s.length!==0){o.push(i.id);for(let u of s)r.includes(u)||r.push(u)}}return r.length===0?null:{code:"AI_KEY",command:`${S} secret set ${r.join(" ")}`,note:`AI for ${A(o)}`,why:`${A(o)} ${o.length===1?"uses":"use"} AI once ${A(r)} ${r.length===1?"is":"are"} set; no AI key is set on the Gateway.`}}function ut(e){let{gatewayNames:t,providers:n,uploaded:r,apps:o}=e;return!t||!r?[]:n.filter(i=>!i.on&&t.includes(i.keySetting)&&Ve(o,i.capability).length===0).map(i=>({code:"PROVIDER_OFFER",command:`${S} mcp on ${i.id}`,note:`offer ${i.name}'s tools to AI clients (each call spends ${i.name} credit)`,why:`${i.keySetting} is set and ${i.name} is off.`}))}function ct(e){let{gatewayNames:t,providers:n,apps:r}=e;return t?n.filter(o=>o.on&&!t.includes(o.keySetting)&&!Z(r,o.keySetting)).map(o=>({code:"PROVIDER_KEY",command:`${S} secret set ${o.keySetting}`,note:`${o.name} is on and needs its key`,why:`${o.name} shows "needs setup" and serves no tools until ${o.keySetting} is set.`})):[]}function mt(e){let{mode:t,uploaded:n,owner:r,access:o}=e;return t==="hosted"||!n||!r||!o||o.on?null:{code:"ACCESS_OFF",command:`${S} access on`,note:"put Cloudflare Access in front (recommended)",why:"Cloudflare Access is off; the Gateway's own sign-in is the only check in front of your apps."}}function pt(e){let{counts:t,owner:n,apps:r,gatewayUrl:o}=e;return!t||!n||t.members!==1||t.invitations>0||!r.some(Q)?null:{code:"INVITE",url:`${o}/admin/users`,note:"invite people",why:`${n.email} is the only member.`}}function ft(e){let{counts:t,gatewayUrl:n}=e;return!t||t.connections>0||t.tokens>0||t.toolApps===0?null:{code:"CONNECT_AI",url:lt,note:`connect an AI client to ${n}/mcp`,why:`No AI client is connected; ${k(t.toolApps,"app")} ${t.toolApps===1?"serves":"serve"} tools.`}}function gt(e){return!e.uploaded||e.apps.length>0?null:{code:"CREATE_APP",command:`${S} create my-app`,note:"start your first app",why:"No apps yet."}}function yt(e){let{gatewayNames:t,counts:n,apps:r}=e;if(!t||t.includes("EMAIL_FROM")||Z(r,"EMAIL_FROM"))return null;let o=Ve(r,"email").filter(s=>!r.some(u=>u.id===s&&R(u)));return!((n?.members??0)>1)&&o.length===0?null:{code:"EMAIL_UNSET",command:`${S} secret set EMAIL_FROM EMAIL_FROM_NAME`,note:"email invites and password resets; needs Cloudflare Email Sending",why:`No sender is set: invites and resets go out by link${o.length>0?`, and ${A(o)} ${o.length===1?"sends":"send"} mail once there is one`:""}.`}}function Ke(e){return[dt(e),...ut(e),...ct(e),mt(e),pt(e),ft(e),gt(e),yt(e)].filter(n=>n!==null).filter(n=>!n.command||!e.problems.some(r=>r.run?.text===n.command)).slice(0,at)}import l from"chalk";var ht={["error"]:l.red("\u2717"),["warning"]:l.yellow("!"),["info"]:l.dim("i")};function ze(e,t){return[...q([{label:"Cloudflare",value:e},{label:"Gateway",value:l.yellow("install not finished")}]),...je([t])].join(`
-`)}function Ye({install:e,accountName:t,owner:n,servingRecorded:r,checkout:o,certificates:i,waitingCertificates:s,access:u,leases:h,apps:y,missingWorkers:p,skippedWorkers:f,emailProblems:m,problems:w}){let g=e.liveVersionId!==null,N=[{label:"Gateway",value:`${l.cyan(`https://${e.gatewayHost}`)}${e.deploymentMode?l.dim(` \xB7 ${e.deploymentMode.replace("_","-")}`):""}`},{label:"Cloudflare",value:t},{label:"Owner",value:n?`${n.email}${n.organizationName?l.dim(` \xB7 ${n.organizationName}`):""}`:l.yellow("none yet")},...u?[{label:"Access",value:St(u)}]:[],{label:"Release",value:wt(e,r,o)},{label:"TLS",value:vt(i,s)},...h.map((c,D)=>({label:D===0?"Deploys":"",value:_(L(c))}))],b=new Set(h.flatMap(c=>c.app?[c.app]:[])),d=new Set(s),$=c=>Nt(c,{missing:p.has(c.workerName),skipped:f.has(c.workerName),waitingCertificate:d.has(c.hostname),deploying:b.has(c.id)}),C=y.filter(c=>c.email.senders.length>0||c.email.inbound.length>0||c.email.routed.length>0),U=y.flatMap(c=>c.setup?Ne(c.id,c.setup.settings):[]);return[...q(N),"",...y.length>0?X(["APP","STATUS","URL","DEPLOYED BY","PUBLIC"],y.map(c=>[c.id,$(c),l.cyan(`https://${c.hostname}`),bt(c.deployedBy),$t(c)])).map(c=>c.trimEnd()):[l.dim("No apps yet.")],...C.length>0?["",...kt(C,m)]:[],...U.length>0?["",...ke(U)]:[],...je(w)].join(`
-`)}function wt(e,t,n){let r=e.releaseVersion,o=i=>`${r} ${l.dim("\xB7")} ${l.yellow(i)}`;return e.liveVersionId===null?l.yellow(`${r}, never uploaded`):t?n.behind?o("this checkout is behind"):n.upToDate===!1?`${r}${l.dim(" \xB7 this checkout has newer Gateway changes")}`:n.upToDate===!0?`${r}${l.dim(" \xB7 matches this checkout")}`:r:o("changed outside everyapp")}function St(e){return"error"in e?l.yellow("! couldn't check"):e.on?`${l.green("on")}${l.dim(" \xB7 everyone signs in through Cloudflare Access first")}`:l.dim("off")}function vt(e,t){return e===null?l.yellow("! couldn't check"):e.length===0?l.dim("no hostnames yet"):t.length>0?`waiting for ${t.join(", ")}${l.dim(" \xB7 usually a few minutes")}`:`ready on ${k(e.length,"hostname")}`}function bt(e){return e?e.startsWith("api-token:")?"API token":e:""}var At=3;function $t(e){let t=[];if(e.publicRoutes.length>0){let{shown:n,more:r}=fe(e.publicRoutes,At);t.push(`${n}${r>0?l.dim(` +${r} more`):""}`)}return e.mcp&&t.push(pe(e.mcp)),t.join(l.dim(" \xB7 "))}function Nt(e,{missing:t,skipped:n,waitingCertificate:r,deploying:o}){let i=t?`${l.red("\u2717")} Worker missing`:n?`${l.red("\u2717")} can't be bound`:e.status==="pending"?`${l.yellow("!")} never deployed`:e.bound?R(e)?`${l.yellow("!")} needs setup`:e.status==="active"?`${l.green("\u2713")} live`:e.status==="binding"?`${l.dim("\u25CB")} ${r?"waiting for certificate":"live on first visit"}`:l.dim(e.status==="disabled"?"switched off":e.status):`${l.yellow("!")} not bound`;return o?`${i} \xB7 deploying`:i}function kt(e,t){let n=e.flatMap(r=>{let{senders:o,inbound:i,routed:s,declaresInbound:u}=r.email,h=new Set(t.filter(m=>m.workerName===r.workerName).map(m=>m.address)),y=i.length>0&&!u?i.map(m=>`${l.yellow("!")} ${m} ${l.dim("(inbound off)")}`):[...i.map(m=>h.has(m)?`${m} ${l.yellow("! not delivered")}`:s.includes(m)?m:`${m} ${l.yellow("! not routed yet")}`),...s.filter(m=>!i.includes(m)).map(m=>`${m} ${l.yellow("! still routed, no longer listed")}`)],p=o.length>0?o:[l.dim("the Gateway's sender")],f=Math.max(p.length,y.length,1);return Array.from({length:f},(m,w)=>[w===0?r.id:"",p[w]??"",y[w]??(w===0?l.dim("nothing"):"")])});return X(["EMAIL","SENDS AS","RECEIVES"],n)}function je(e){let t=[];for(let n of e){if(n.severity==="settling")continue;let r=n.run?t.find(o=>o[0].run?.text===n.run.text):void 0;r?r.push(n):t.push([n])}return t.length===0?[]:["",...t.flatMap(Et)]}function Et([e,...t]){let n=e,r=[n,...t].map(i=>i.severity),o=r.includes("error")?"error":r.includes("warning")?"warning":"info";return[`${ht[o]} ${n.headline}`,...[...n.detail,...t.map(i=>`${i.headline}.`)].map(i=>l.dim(`  ${i}`)),...n.fix?[`  Fix: ${n.fix.human}`]:[],...n.run?[`  Run: ${n.run.human}${n.runNote?`  ${l.dim(n.runNote)}`:""}`]:[],...n.where?[l.dim(`  ${n.where}`)]:[]]}async function Pn(e){await Se(e,async t=>{let n=await we({json:e.json,out:t,accountId:e["account-id"]}),r=Re();await It({gateway:n,out:t,checkout:r?()=>xe(r):null})})}function qe(e){return{code:e.code,severity:e.severity,message:[e.headline,...e.detail].join(`
-`),run:e.run?.text??null,...e.runNote?{note:e.runNote}:{},...e.fix?{fix:e.fix.text}:{}}}async function It({gateway:e,out:t,checkout:n}){let{cf:r,account:o,db:i,install:s}=e,u=o.name??o.id;if(!s){let a=Le();t.emit({type:"done",message:`${u} has the Gateway's database, but its install didn't finish`,display:ze(u,a),data:{deployed:!0,installed:!1,accountId:o.id,fixes:[qe(a)]}});return}let h=s.liveVersionId!==null,y=s.deploymentMode!=="hosted"&&h,[p,f,m,w,g,N,b,d]=await Promise.all([Oe(i,De(r)),he(i),ge(i),Ge(i),Ie(r,de),ve(i,"email-route"),h?x(()=>J(r)):null,y?x(()=>ce(i)):null]),$=w?.owner??null,C=f.filter(a=>a.tier!==z),U=ae.map(a=>({id:a,name:Y[a].name,capability:Y[a].capability,keySetting:le(a),on:f.some(I=>I.tier===z&&I.appSlug===a)})),c=y?b&&"error"in b?b:d&&"error"in d?d:{value:me(b.value,d.value)}:null,D=c&&"value"in c?c.value:null,ee=c&&"error"in c?c:null,te=new Set(p.missing.map(a=>a.workerName)),[W,O,ne,Xe]=await Promise.all([x(()=>We(r,s.zoneId,s.liveDomains)),x(async()=>N.length===0?[]:Ue(r,N)),Pe(i,s).then(a=>xt(r,i,C,te,b,a)),w?Fe(i,w.organizationId).catch(()=>null):null]),H=`https://${s.gatewayHost}`,V=_e({gatewayHost:s.gatewayHost,appHosts:p.appHosts.filter(a=>Ce(a,s.appBaseDomain))}),Je=V.filter(a=>!s.liveDomains.includes(a)),Qe=s.liveDomains.filter(a=>!V.includes(a)),re=p.appWorkers.filter(a=>!s.liveAppWorkers.includes(a)),Ze=s.liveAppWorkers.filter(a=>!p.appWorkers.includes(a)),oe=!!g?.versionId&&g?.versionId===s.liveVersionId,ie=oe&&re.length===0&&Ze.length===0&&Je.length===0&&Qe.length===0,E=C.map(a=>({id:a.appSlug,hostname:a.hostname,workerName:a.workerName,status:a.status,bound:s.liveAppWorkers.includes(a.workerName),deployedBy:a.deployedBy,email:{senders:a.email.senders,inbound:a.email.inbound,routed:N.filter(I=>I.workerName===a.workerName).map(I=>I.name),declaresInbound:a.declaresInbound},publicRoutes:a.publicRoutes,mcp:a.mcp,setup:ne.setups.get(a.appSlug)??null})),G="error"in W?null:W.value,K=(G??[]).filter(a=>!a.ready).map(a=>a.host),F=await Ct(s,n),M=Be({install:s,desired:p,apps:E,unboundApps:E.filter(a=>re.includes(a.workerName)).map(a=>a.id),owner:$,servingVersionId:g?.versionId??null,inSync:ie,waitingCertificates:K,certificates:"error"in W?W:null,access:ee,leases:m,checkout:F,emailProblems:"error"in O?O:O.value,settings:ne.unread}),et=Ke({mode:s.deploymentMode,uploaded:h,gatewayUrl:H,owner:$,apps:E,gatewayNames:b&&"value"in b?b.value:null,access:D,providers:U,counts:Xe,problems:M}),tt=Ye({install:s,accountName:u,owner:$,servingRecorded:oe,checkout:F,certificates:G,waitingCertificates:K,access:ee??D,leases:m,apps:E,missingWorkers:te,skippedWorkers:new Set(p.skipped.map(a=>a.workerName)),emailProblems:"error"in O?[]:O.value,problems:M});t.emit({type:"done",message:Rt(H,E,M),display:tt,data:{deployed:!0,installed:!0,gatewayUrl:H,accountId:o.id,mode:s.deploymentMode,release:{version:s.releaseVersion,sha256:s.releaseSha256},versionId:g?.versionId??null,recordedVersionId:s.liveVersionId,owner:$,claimed:$!==null,apps:E,desiredApps:p.appWorkers,liveApps:s.liveAppWorkers,appBaseDomain:s.appBaseDomain,domains:V,liveDomains:s.liveDomains,inSync:ie,upToDate:F.upToDate,checkout:F.checkout,tls:G===null?null:!K.includes(s.gatewayHost),certificates:G,access:D,leases:m,fixes:M.map(qe),next:et.map(Pt)}})}function Pt(e){return{code:e.code,...e.command?{command:e.command}:{},...e.url?{url:e.url}:{},note:e.note,why:e.why}}function Rt(e,t,n){let r=t.filter(i=>i.status==="active"&&i.bound).length,o=n.filter(Me).length;return`Gateway ${e}: ${k(r,"app")} live, ${o===0?"nothing to fix":`${k(o,"problem")} to fix`}`}async function xt(e,t,n,r,o,i){let s=new Map,u=n.filter(p=>p.manifest&&$e(p.manifest,i)&&p.tier!=="dispatch"&&p.status!=="pending"&&!r.has(p.workerName));if(u.length===0)return{setups:s,unread:null};let h=null,y=o??await x(()=>J(e));"error"in y&&(h=y);for(let p of u){let f=await x(()=>be(e,p.workerName));"error"in f&&(h??=f);let m="error"in f?null:f.value;m&&(p.secretNames===null||j(m)!==j(p.secretNames))&&await ye(t,p.id,m);let{setup:w}=Ae({manifest:p.manifest,appId:p.appSlug,gatewayNames:"error"in y?null:y.value,secretNames:m,lookup:i});s.set(p.appSlug,w)}return{setups:s,unread:h}}async function x(e){try{return{value:await e()}}catch(t){return{error:ue(t)}}}async function Ct(e,t){let n=t?await t().catch(()=>null):null;if(!n)return{upToDate:null,behind:!1,checkout:null};let r=n.treeSha256&&e.sourceTreeSha256?n.treeSha256===e.sourceTreeSha256:null;return{upToDate:r,behind:r===!1&&Te(n,e),checkout:{version:n.version,treeSha256:n.treeSha256}}}export{It as reportStatus,Pn as status};

package/dist/teardown-E4JNKAZJ.js

@@ -1,22 +0,0 @@
-import{a as it,d as ct}from"./chunk-PNLU5U3P.js";import{a as Ze,b as He,c as je}from"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import{a as ee,c as st,d as de,e as at}from"./chunk-OP4DYXYI.js";import{a as tt,e as ot,i as nt,j as rt}from"./chunk-EGEWRFVY.js";import{a as Ve,c as Ge,d as Ye,h as Je,i as Xe,j as qe,k as Q,l as Qe}from"./chunk-YHJZMJYZ.js";import{a as q,b as Be,i as et}from"./chunk-N5GQLGEC.js";import"./chunk-W3JCQHHU.js";import{a as ve,h as $e,j as Ce,l as Re,p as Te,v as Pe}from"./chunk-TLRM3P7V.js";import{a as Me,d as Ue}from"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import{a as W,d as Fe}from"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import{a as Oe,k as Se,oa as We,q as le,r as Le,t as xe}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import{a as _e}from"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import{a as De,f as Ie}from"./chunk-CCWBPAKH.js";import{d as be,j as Ne}from"./chunk-JYKRUS5C.js";import{Bb as $,Db as ke,Fb as x,Hb as U,Ib as Ae,ac as Ee,cc as ce,d as ye,f as E,k as D,oc as ze,qb as ie,wc as Ke}from"./chunk-LYNBZ7RV.js";import F from"chalk";import $t from"node:fs";import Ct from"node:os";import lt from"node:path";var mt=["23bc28f0b638fbfc1c7f838573c17ee3"];var Rt=/^[0-9a-f]{32}$/,pt=e=>Rt.test(e),me="EVERYAPP_TEST_ACCOUNTS";function Tt(e=process.env){let o=e.XDG_CONFIG_HOME||lt.join(Ct.homedir(),".config");return lt.join(o,"everyapp","test-accounts")}function dt(e){let o=new Set,a=[];for(let n of e.split(/\r?\n/)){let c=n.replace(/#.*$/,"");for(let i of c.split(/[\s,]+/)){if(!i)continue;let m=i.toLowerCase();pt(m)?o.add(m):a.push(i)}}return{ids:[...o],ignored:a}}function bt(e=process.env){let o=Tt(e),a="";try{a=$t.readFileSync(o,"utf8")}catch(i){if(i.code!=="ENOENT")throw i}let n=dt(e[me]??""),c=dt(a);return{ids:[...new Set([...n.ids,...c.ids])],ignored:[...n.ignored,...c.ignored],file:o}}function Nt(e,o){return["only for a dedicated test account that holds nothing else (docs/runbooks/onboarding-loop-test-accounts.md):",`set ${me}=${e} for this one command, or add a line ${e} to ${o}`].join(" ")}function ft({accountId:e,out:o,env:a=process.env}){let n=e.trim().toLowerCase();if(!pt(n))throw new $("TEARDOWN_INVALID_ACCOUNT_ID",`"${e.trim()}" isn't a Cloudflare account id
-An account id is 32 hex characters (Compute (Workers) \u2192 Overview, or any dashboard URL dash.cloudflare.com/<account id>/...).`,{fix:"pass the test account's id from the dashboard as --account-id",data:{accountId:e.trim()}});if(mt.includes(n))throw new $("TEARDOWN_ACCOUNT_FORBIDDEN",`Cloudflare account ${n} can never be torn down
-It is a live account, refused by id before any allowlist is read.`,{data:{accountId:n}});let c=bt(a);if(c.ignored.length>0&&o.emit({type:"warning",code:"TEARDOWN_ALLOWLIST_IGNORED",message:`Ignored ${E(c.ignored.length,"entry")} of the teardown allowlist that ${c.ignored.length===1?"isn't":"aren't"} account ids: ${D(c.ignored)}
-An account id is 32 hex characters (${me}, ${c.file}).`,data:{ignored:c.ignored,file:c.file}}),!c.ids.includes(n))throw new $("TEARDOWN_NOT_ALLOWLISTED",`Cloudflare account ${n} isn't on the teardown allowlist
-teardown deletes everything Every App made in an account, so it runs only against accounts listed as dedicated test accounts.`,{fix:Nt(n,c.file),data:{accountId:n,file:c.file}});if(!a.CLOUDFLARE_API_TOKEN)throw new $("TEARDOWN_NEEDS_TOKEN",`teardown needs CLOUDFLARE_API_TOKEN
-A Cloudflare login is a person, who sees every account they belong to; teardown runs only with an API token scoped to the test account (runbook step 5).`,{fix:"set CLOUDFLARE_API_TOKEN to the test account's token for this one command, and run it again",data:{accountId:n}});return{accountId:n,allowlist:c.ids}}function ut({accountId:e,allowlist:o,whoami:a}){if(!a.authenticated||a.tokenValid===!1)throw new $("CLOUDFLARE_TOKEN_REJECTED",`Cloudflare didn't accept CLOUDFLARE_API_TOKEN
-It may be mistyped, expired or revoked.`,{fix:"set the test account's token (runbook step 5)"});if(a.authSource&&!/CLOUDFLARE_API_TOKEN/.test(a.authSource))throw new $("TEARDOWN_NEEDS_TOKEN",`teardown needs CLOUDFLARE_API_TOKEN, but cf authenticated with ${a.authSource}
-A Cloudflare login is a person, who sees every account they belong to; teardown runs only with an API token scoped to the test account (runbook step 5).`,{fix:"set CLOUDFLARE_API_TOKEN to the test account's token for this one command, and run it again",data:{accountId:e,authSource:a.authSource}});let n=(a.accounts??[]).map(i=>({id:i.id.toLowerCase(),name:i.name??null})),c=n.filter(i=>mt.includes(i.id)||!o.includes(i.id));if(c.length>0)throw new $("TEARDOWN_TOKEN_TOO_BROAD",[`CLOUDFLARE_API_TOKEN sees ${E(c.length,"account")} that ${c.length===1?"isn't a":"aren't"} test account${c.length===1?"":"s"}: ${D(c.map(i=>i.name?`${i.name} (${i.id})`:i.id))}`,"A teardown token must be scoped to the test account alone (Account Resources \u2192 Include \u2192 that account), so there is no path from here to a live account."].join(`
-`),{fix:"mint a token for the test account only (runbook step 5)",data:{accountId:e,accounts:c}});if(!n.some(i=>i.id===e))throw new $("TEARDOWN_ACCOUNT_NOT_VISIBLE",`CLOUDFLARE_API_TOKEN doesn't list Cloudflare account ${e}
-${n.length===0?"It lists no accounts.":`It lists ${D(n.map(i=>i.id))}.`}`,{fix:"use that account's token, with Account Settings: Read on it (runbook step 5)",data:{accountId:e,accounts:n}})}import gt from"chalk";var te="every-",I=e=>e.startsWith(te),oe=e=>e.type==="MX"&&/\.mx\.cloudflare\.net\.?$/i.test(e.content??"")||e.type==="TXT"&&/_spf\.mx\.cloudflare\.net/i.test(e.content??""),Pt=new Set(["A","AAAA","CNAME"]),Z=e=>Pt.has(e.type.toUpperCase()),z=[["access","Access application or policy","Access applications and policy"],["email","Email Routing change","Email Routing changes"],["workflows","Workflow","Workflows"],["workers","Worker","Workers"],["certificates","certificate pack","certificate packs"],["d1","D1 database","D1 databases"],["kv","KV namespace","KV namespaces"],["r2","R2 bucket","R2 buckets"],["hyperdrive","Hyperdrive config","Hyperdrive configs"],["dns","DNS record","DNS records"]],H={access:"Zero Trust \u2192 Access \u2192 Applications and Policies",email:"the zone \u2192 Email \u2192 Email Routing",workflows:"Compute (Workers) \u2192 Workflows",workers:"Compute (Workers) \u2192 Workers & Pages",certificates:"the zone \u2192 SSL/TLS \u2192 Edge Certificates",d1:"Storage & Databases \u2192 D1",kv:"Storage & Databases \u2192 KV",r2:"Storage & Databases \u2192 R2 Object Storage",hyperdrive:"Storage & Databases \u2192 Hyperdrive",dns:"the zone \u2192 DNS \u2192 Records"},j=e=>e.reduce((o,a)=>o+a.rules.length+(a.catchAllWorker?1:0)+(a.disable?1:0),0),pe=e=>e.reduce((o,a)=>o+a.records.length,0);function K(e){return{access:e.access.applications.length+(e.access.policy?1:0),email:j(e.email),workflows:e.workflows.length,workers:e.workers.length,certificates:e.certificates.length,d1:e.d1.length,kv:e.kv.length,r2:e.r2.length,hyperdrive:e.hyperdrive.length,dns:pe(e.dns)}}function _(e){return Object.values(K(e)).reduce((o,a)=>o+a,0)}var k={worker:e=>`${W.worker} "${e}"`,workflow:e=>`Workflow "${e}"`,d1:e=>`${W.d1} "${e}"`,kv:e=>`${W.kv} "${e}"`,r2:e=>`${W.r2} "${e}"`,hyperdrive:e=>`${W.hyperdrive} "${e}"`,application:e=>`Access application "${e}"`,policy:e=>`Access policy "${e}"`,rule:(e,o)=>`Email Routing rule for ${e??"(no address)"} on ${o}`,catchAll:e=>`catch-all of ${e}`,routing:e=>`Email Routing on ${e}`,pack:(e,o)=>`certificate pack ${e} for ${o}`,record:(e,o)=>`DNS ${e} record at ${o}`};function Dt(e){let o=K(e),a={access:[...e.access.applications.map(n=>`application "${n.name}"`),...e.access.policy?[`policy "${e.access.policy.name}"`]:[]],email:e.email.flatMap(n=>[...n.rules.map(c=>`rule for ${c.address??"(no address)"} on ${n.zoneName}`),...n.catchAllWorker?[`${n.zoneName}'s catch-all back to dropping mail`]:[],...n.disable?[`Email Routing off for ${n.zoneName}`]:[]]),workflows:e.workflows,workers:e.workers.map(n=>n.domains.length>0?`${n.name} (${n.domains.join(", ")})`:n.name),certificates:e.certificates.map(n=>`${n.packId} (${n.hostname})`),d1:e.d1.map(n=>n.name),kv:e.kv.map(n=>n.title),r2:e.r2,hyperdrive:e.hyperdrive.map(n=>n.name),dns:e.dns.flatMap(n=>n.records.map(c=>`${c.type} at ${n.name}`))};return z.flatMap(([n,,c])=>o[n]===0?[]:[{label:`${c} (${o[n]})`,items:a[n]}])}function ht(e){let o=Dt(e).map(({label:a,items:n})=>({label:a,value:n.join(", ")}));return[...o.length>0?ze(o):[gt.dim("Nothing of Every App's to delete.")],...e.kept.length>0?["",gt.dim(`Kept: ${e.kept.join("; ")}.`)]:[]]}function ne(e){let o=K(e),a=z.flatMap(([n,c,i])=>o[n]===0?[]:[o[n]===1?`1 ${c}`:`${o[n]} ${i}`]);return`${E(_(e),"resource")}${a.length>0?`: ${a.join(", ")}`:""}`}function B(e){return{accountId:e.accountId,gateway:e.gateway,counts:K(e),total:_(e),workers:e.workers,workflows:e.workflows,d1:e.d1,kv:e.kv,r2:e.r2,hyperdrive:e.hyperdrive,access:e.access,email:e.email,certificates:e.certificates,dns:e.dns,kept:e.kept}}var It=e=>typeof e=="object"&&e!==null&&"removedAs"in e,_t={name:"",enabled:!1,matchers:[{type:"all"}],actions:[{type:"drop"}]},re="teardown.delete",Ot=5e3;async function yt({cf:e,plan:o,out:a,sleep:n=c=>new Promise(i=>setTimeout(i,c))}){let c=[],i=[],m=async(r,d,A)=>{try{let w=await A();if(w===!1)return;c.push(It(w)?w.removedAs:d)}catch(w){if(U(w,"not_found"))return;let f=x(w).split(`
-`)[0]??"";i.push({kind:r,described:d,place:H[r],reason:f}),a.emit({type:"warning",code:"TEARDOWN_DELETE_FAILED",step:re,message:`Couldn't delete the ${d}
-${f}`,data:{kind:r,described:d,reason:f,fix:`delete it in the Cloudflare dashboard (${H[r]})`}})}},l=async(r,d,A)=>{if(d===0)return;let[,w,f]=z.find(([C])=>C===r),v=d===1?w:f,O=c.length,S=i.length;a.emit({type:"step",step:re,status:"start",message:`Deleting ${d} ${v}...`,data:{kind:r,count:d}}),await A();let N=c.length-O,L=i.length-S;a.emit({type:"step",step:re,status:"ok",message:L===0?`Deleted ${N} ${N===1?w:f}`:`Deleted ${N} ${N===1?w:f}; kept ${L}`,data:{kind:r,removed:c.slice(O),kept:i.slice(S).map(C=>C.described)}})};await l("access",o.access.applications.length+(o.access.policy?1:0),async()=>{for(let r of o.access.applications)await m("access",k.application(r.name),()=>Te(e,r.id));if(o.access.policy){let{id:r,name:d}=o.access.policy;await m("access",k.policy(d),()=>Ce(e,r))}}),await l("email",j(o.email),async()=>{for(let r of o.email){for(let d of r.rules)await m("email",k.rule(d.address,r.zoneName),()=>Je(e,r.zoneId,d.id));r.catchAllWorker&&await m("email",k.catchAll(r.zoneName),()=>qe(e,r.zoneId,_t)),r.disable&&await m("email",k.routing(r.zoneName),()=>Ge(e,r.zoneId))}}),await l("workflows",o.workflows.length,async()=>{for(let r of o.workflows)await m("workflows",k.workflow(r),()=>rt(e,r))}),await l("workers",o.workers.length,async()=>{for(let r of o.workers)await m("workers",k.worker(r.name),()=>Ue(e,r.name,{withReferences:!0}))}),await l("certificates",o.certificates.length,async()=>{for(let r of o.certificates){let d=k.pack(r.packId,r.hostname);await m("certificates",d,async()=>{try{await at(e,r.zoneId,r.packId);return}catch(A){if(U(A,"not_found"))throw A;let w=x(A).split(`
-`)[0]??"",f=()=>ee(e,r.zoneId,{allStatuses:!0}),v=await f().catch(()=>null);if(v&&!de(v,r.packId)&&(await n(Ot),v=await f().catch(()=>v)),v&&de(v,r.packId))return{removedAs:`${d} (gone with its Custom Domain)`};throw new Error(`${w}. Cloudflare removes a hostname's pack with its Custom Domain, so it is likely on its way out; if the zone still lists it, finish it in the dashboard`)}})}});let h=o.d1.find(r=>r.id===o.gateway?.databaseId)??null,T=o.d1.filter(r=>r!==h);await l("d1",T.length,async()=>{for(let r of T)await m("d1",k.d1(r.name),()=>le(e,r.id))}),await l("kv",o.kv.length,async()=>{for(let r of o.kv)await m("kv",k.kv(r.title),()=>Le(e,r.id))}),await l("r2",o.r2.length,async()=>{for(let r of o.r2)await m("r2",k.r2(r),()=>ct(e,r))}),await l("hyperdrive",o.hyperdrive.length,async()=>{for(let r of o.hyperdrive)await m("hyperdrive",k.hyperdrive(r.name),()=>ot(e,r.id))});let b=[];for(let r of o.dns)try{for(let d of await q(e,r.zoneId,r.name))Z(d)&&(oe({type:d.type,content:d.content??null})||b.push({zoneId:r.zoneId,name:r.name,id:d.id,type:d.type}))}catch(d){a.emit({type:"warning",code:"TEARDOWN_DELETE_FAILED",step:re,message:`Couldn't read the DNS records at ${r.name}
-${x(d).split(`
-`)[0]}`,data:{kind:"dns",name:r.name,fix:`check them in the Cloudflare dashboard (${H.dns})`}})}return await l("dns",b.length,async()=>{for(let r of b)await m("dns",k.record(r.type,r.name),()=>Be(e,r.zoneId,r.id))}),await l("d1",h?1:0,async()=>{if(!h)return;let r=i.filter(d=>d.kind==="dns");if(r.length>0){i.push({kind:"d1",described:k.d1(h.name),place:H.d1,reason:`kept on purpose: the next run reads the hostnames of the ${E(r.length,"kept DNS record")} above from it`});return}await m("d1",k.d1(h.name),()=>le(e,h.id))}),{removed:c,kept:i}}var fe="teardown.inventory";function St(e,o){return e===ie?1:o===ie?-1:e.localeCompare(o)}var Lt=(e,o)=>e===o.name||e.endsWith(`.${o.name}`);async function kt({cf:e,accountId:o,out:a}){a.emit({type:"step",step:fe,status:"start",message:`Looking for what Every App created in ${o}...`,data:{accountId:o}});let n=(t,s,p)=>a.emit({type:"step",step:"teardown.found",status:"ok",message:`${s} ${z.find(([u])=>u===t)[s===1?1:2]}`,data:{kind:t,count:s,items:p}}),c=[],i=async(t,s,p)=>{try{return await p()}catch(u){let g=x(u).split(`
-`)[0]??"";if(Ae(u)){let R=U(u,"r2_not_enabled")?"R2":"Cloudflare Access";return a.emit({type:"step",step:"teardown.found",status:"skip",message:`${R} isn't enabled in this account: nothing of its to delete`,data:{what:t,service:R,reason:g}}),s}return c.push(`${t} (couldn't be listed: ${g})`),a.emit({type:"warning",code:"TEARDOWN_READ_FAILED",step:fe,message:`Couldn't list ${t}; whatever is there is kept
-${g}`,data:{what:t,reason:g,fix:"check the token's permissions (runbook step 5), then run again"}}),s}},m=await i("the Gateway's database",null,()=>xe(e)),l=m?Oe(e,m):null,h=l?await i("the Gateway's install row",null,()=>Se(l)):null,T=l?await i("the Gateway's apps",[],()=>We(l)):[],b=l?await i("the apps' recorded resources",[],()=>Fe(l)):[],r=t=>new Set(b.filter(s=>s.kind===t).map(s=>s.name)),d=(t,s)=>I(s)||r(t).has(s),A=new Set(T.flatMap(t=>t.workerName?[t.workerName]:[])),w=await i("the Workers",[],()=>Me(e)),f=w.filter(t=>d("worker",t.name)||A.has(t.name)).sort((t,s)=>St(t.name,s.name)).map(t=>({name:t.name,domains:(t.references?.domains??[]).map(s=>s.hostname.toLowerCase()).sort()}));n("workers",f.length,f.map(t=>t.name));let v=(await i("the Workflows",[],()=>nt(e,te))).filter(t=>I(t.script_name??"")||I(t.name)).map(t=>t.name).sort();n("workflows",v.length,v);let O=(await i("the D1 databases",[],()=>ce(e,["d1","list"],be,{perPage:100,maxPages:10}))).filter(t=>d("d1",t.name)).map(t=>({name:t.name,id:t.uuid})).sort((t,s)=>t.id===m?1:s.id===m?-1:t.name.localeCompare(s.name));n("d1",O.length,O.map(t=>t.name));let S=(await i("the KV namespaces",[],()=>ce(e,["kv","namespaces","list"],Ne,{perPage:100,maxPages:50}))).filter(t=>d("kv",t.title)).map(t=>({title:t.title,id:t.id})).sort((t,s)=>t.title.localeCompare(s.title));n("kv",S.length,S.map(t=>t.title));let N=(await i("the R2 buckets",[],()=>it(e,te))).filter(I).sort();n("r2",N.length,N);let L=(await i("the Hyperdrive configs",[],()=>tt(e))).filter(t=>d("hyperdrive",t.name)).map(t=>({name:t.name,id:t.id})).sort((t,s)=>t.name.localeCompare(s.name));n("hyperdrive",L.length,L.map(t=>t.name));let C={applications:[],policy:null},ue=await i("the Zero Trust team",null,()=>ve(e));if(ue){let t=h?{gatewayHost:h.gatewayHost.toLowerCase(),appBaseDomain:h.appBaseDomain.toLowerCase()}:null,s=await i("the Access applications",[],()=>Re(e)),p=t?Pe(s,t):{gateway:null,apps:null},u=s.filter(y=>y.name===He||y.name===je),g=new Map;for(let y of[p.gateway,p.apps,...u])y&&g.set(y.id,y);C.applications=[...g.values()].map(y=>({id:y.id,name:y.name??y.id}));let R=(await i("the Access policies",[],()=>$e(e))).find(y=>y.name===Ze);C.policy=R?{id:R.id,name:R.name}:null,c.push(`the Zero Trust team ${ue.auth_domain} and its identity providers`)}n("access",C.applications.length+(C.policy?1:0),{applications:C.applications.map(t=>t.name),policy:C.policy?.name??null});let M=new Set;if(h){M.add(h.gatewayHost.toLowerCase());for(let t of h.liveDomains)M.add(t.toLowerCase())}for(let t of T)t.hostname&&M.add(t.hostname.toLowerCase());for(let t of f)for(let s of t.domains)M.add(s);let ge=new Map((await i("the account's zones",[],()=>et(e,o))).map(t=>[t.id,{id:t.id,name:t.name}])),V=new Map,he=(t,s)=>{let p=ge.get(t);p?V.set(p.id,p):c.push(`the zone ${s.toLowerCase()} (${t}), which isn't in account ${o}`)};h&&he(h.zoneId,h.zoneName);for(let t of w)if(f.some(s=>s.name===t.name))for(let s of t.references?.domains??[])s.zone_id&&s.zone_name&&he(s.zone_id,s.zone_name);let Et=t=>{let s=[...ge.values()].filter(p=>Lt(t,p)).sort((p,u)=>u.name.length-p.name.length)[0];return s&&V.set(s.id,s),s??null},se=new Map;for(let t of[...M].sort()){let s=Et(t);s&&se.set(t,s)}for(let t of V.values())c.push(`the zone ${t.name}`);c.push("the Workers Paid subscription","the workers.dev subdomain");let G=[];for(let t of[...V.values()].sort((s,p)=>s.name.localeCompare(p.name))){let s=await i(`Email Routing on ${t.name}`,null,async()=>({settings:await Ve(e,t.id),rules:await Ye(e,t.id),catchAll:await Xe(e,t.id)}));if(!s)continue;let{settings:p,rules:u,catchAll:g}=s,R=u.filter(P=>P.id!==null&&I(Q(P)??"")),y=Q(g),ae=y!==null&&I(y);if(R.length===0&&!ae)continue;let vt=!g.enabled||g.actions.every(P=>P.type==="drop");G.push({zoneId:t.id,zoneName:t.name,rules:R.map(P=>({id:P.id,address:Qe(P),worker:Q(P)})),catchAllWorker:ae?y:null,disable:p.enabled&&R.length===u.length&&(ae||vt)})}n("email",j(G),G);let Y=[],we=new Map;for(let[t,s]of se){let p=we.get(s.id);p||(p=await i(`the certificate packs of ${s.name}`,[],()=>ee(e,s.id)),we.set(s.id,p));for(let u of st(p,t))p.splice(p.indexOf(u),1),Y.push({zoneId:s.id,zoneName:s.name,hostname:t,packId:u.id})}n("certificates",Y.length,Y.map(t=>`${t.packId} (${t.hostname})`));let J=[];for(let[t,s]of[...se].sort(([p],[u])=>p.localeCompare(u))){let p=await i(`the DNS records at ${t}`,[],()=>q(e,s.id,t)),u=[...new Set(p.filter(g=>!Z(g)&&!oe({type:g.type,content:g.content??null})).map(g=>g.type.toUpperCase()))].sort();u.length>0&&c.push(`the ${D(u)} ${u.length===1?"record":"records"} at ${t}, which Every App never created`),J.push({zoneId:s.id,zoneName:s.name,name:t,records:p.filter(Z).map(g=>({id:g.id,type:g.type,content:g.content??null}))})}n("dns",pe(J),J.filter(t=>t.records.length>0));let X={accountId:o,gateway:m?{databaseId:m,gatewayHost:h?.gatewayHost??null}:null,workers:f,workflows:v,d1:O,kv:S,r2:N,hyperdrive:L,access:C,email:G,certificates:Y,dns:J,kept:c};return a.emit({type:"step",step:fe,status:"ok",message:`Found ${E(_(X),"resource")} of Every App's in ${o}.`,data:{accountId:o,counts:K(X),total:_(X)}}),X}var At="teardown.check";async function Yo(e){await Ke(e,o=>xt({flags:e,out:o}))}async function xt(e){let{flags:o,out:a}=e,n=e.env??process.env,c=e.createCf??(f=>Ee({accountId:f,env:n})),i=e.interactive??De(o.json??!1),m=o["dry-run"]??!1;a.emit({type:"step",step:At,status:"start",message:"Checking the account may be torn down..."});let{accountId:l,allowlist:h}=ft({accountId:o["account-id"],out:a,env:n}),T=o.confirm?.trim().toLowerCase();if(T!==void 0&&T!==l)throw new $("TEARDOWN_CONFIRM_MISMATCH",`--confirm ${o.confirm} isn't the account id
-It must repeat --account-id ${l} exactly. Nothing was read or changed.`,{fix:`pass --confirm ${l}`,data:{accountId:l,confirm:o.confirm}});ut({accountId:l,allowlist:h,whoami:await _e(c())}),a.emit({type:"step",step:At,status:"ok",message:`${l} is a test account, and the token sees it alone`,data:{accountId:l}});let b=c(l),r=await kt({cf:b,accountId:l,out:a}),d=_(r),A=ht(r);if(m){let f=d===0?`Nothing of Every App is left in ${l}.`:`Dry run: ${ne(r)} would be removed from ${l}. Nothing was changed.`;a.emit({type:"done",message:f,display:[F.bold(d===0?f:`Would remove ${ne(r)} from ${l}`),...d===0?A.slice(1):A,...d===0?[]:["",F.dim("Nothing was changed (--dry-run).")]].join(`
-`),data:{accountId:l,dryRun:!0,removed:[],kept:[],plan:B(r)}});return}if(d===0){let f=`Nothing of Every App is left in ${l}.`;a.emit({type:"done",message:f,display:[F.green(f),...A.slice(1)].join(`
-`),data:{accountId:l,dryRun:!1,removed:[],kept:[],plan:B(r)}});return}if(T===void 0){if(!i)throw new $("TEARDOWN_CONFIRMATION_REQUIRED",`Tearing down ${l} needs its id typed at a terminal, or --confirm ${l}
-${ne(r)} would be deleted for good. Nothing was changed.`,{rerun:ye(["--confirm",l]),rerunNote:"only for a dedicated test account",authorize:!0,data:{accountId:l,plan:B(r)}});let f=(await(e.askConfirmation??Wt)(l,A)).trim().toLowerCase();if(f!==l)throw new ke(f?`"${f}" doesn't match ${l}. Nothing deleted.`:"Cancelled. Nothing deleted.")}else i&&a.emit({type:"step",step:"teardown.plan",status:"ok",message:`Deleting everything Every App created in ${l}:`,data:{accountId:l,lines:A}});let w=await yt({cf:b,plan:r,out:a,...e.sleep?{sleep:e.sleep}:{}});a.emit({type:"done",...zt(l,r,w)})}function Wt(e,o){return Ie(`Type ${e} to delete all of this`,{context:[`This deletes everything Every App created in Cloudflare account ${e}, for good:`,"",...o,""]})}function zt(e,o,{removed:a,kept:n}){let c=n.length===0?`Removed ${E(a.length,"resource")} from ${e}.`:`Removed ${E(a.length,"resource")} from ${e}; kept ${n.length} (${D(n.map(m=>`${m.described}: ${m.reason}`))}).`,i=[F.green(`Removed ${E(a.length,"resource")} from ${e}`),...n.length>0?["",`Kept ${E(n.length,"resource")}:`,...n.map(m=>`  ${m.described} ${F.dim(`\xB7 ${m.reason} \xB7 ${m.place}`)}`)]:[],...o.kept.length>0?["",F.dim(`Left as they were: ${o.kept.join("; ")}.`)]:[]].join(`
-`);return{message:c,display:i,data:{accountId:e,dryRun:!1,removed:a,kept:n,plan:B(o)}}}export{Yo as teardown,xt as teardownAccount};

package/dist/update-DWVZFNPS.js

@@ -1 +0,0 @@
-import{b as e}from"./chunk-ZEXVHB22.js";import{c as o}from"./chunk-CZTEDWZ2.js";import"./chunk-N4E5YE4X.js";import"./chunk-AGTCKFRB.js";import"./chunk-E3EPK27P.js";import"./chunk-IFCPALVC.js";import"./chunk-WOVS3GV5.js";import"./chunk-OM2HDWVP.js";import"./chunk-2Y5Q6A5K.js";import"./chunk-H6QQMY7B.js";import"./chunk-6OGVO7QK.js";import"./chunk-N5GQLGEC.js";import"./chunk-W3JCQHHU.js";import"./chunk-TLRM3P7V.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-23HJ5I2A.js";import"./chunk-ZECBN24L.js";import"./chunk-ONLNJXVQ.js";import"./chunk-6PGUCTJ6.js";import"./chunk-HOUHG236.js";import"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import"./chunk-H7PDL3X5.js";import"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import"./chunk-LYNBZ7RV.js";async function m(a){await e(a,(t,y)=>o(a,t,y))}export{m as update};