everyapp 0.3.0-rc.2 → 0.3.0-rc.3

package/dist/chunk-EJE6K5GO.js

@@ -0,0 +1,146 @@
+import{a as Le}from"./chunk-CGFABBZA.js";import{A as we,C as x,D as oe,X as Me,_ as p,aa as Y,y as P}from"./chunk-OHDR7JWQ.js";import{e as T}from"./chunk-HT76NR3O.js";import{N as Te,O as ie,P as re,Q as Oe,R as he,Ua as Ce,Ub as m,_a as De,c as g,hb as ye,jb as Ie,k as B,kb as ve,mb as ke}from"./chunk-NXO2BC3M.js";var We=.01,ze=1e6,$e=new WeakMap;function v(e){let a=$e.get(e);return a||(a=e.run([{sql:"PRAGMA table_info(org_app_settings)"},{sql:"PRAGMA table_info(org_settings)"}]).then(([n=[],t=[]])=>n.some(i=>i.name==="monthly_cost_cap_micros")&&t.some(i=>i.name==="default_monthly_cost_cap_micros")),$e.set(e,a)),a}async function se(e){if(!await v(e))throw new m("GATEWAY_PREDATES_COST_CAPS",`The Gateway predates dollar caps
+Its database has no monthly cap in dollars until the Gateway is updated to a release that has it.`,{rerun:`${g} update`,rerunNote:"then run this again"})}function de(e){if(e==null)return e;let a=Math.round(e*100);if(!Number.isFinite(e)||Math.abs(e*100-a)>1e-6||e<We||e>ze)throw new m("INVALID_CAP",`A monthly dollar cap is from $${We} to $${ze.toLocaleString("en-US")} in whole cents, or off`);return a*1e4}var le=e=>e===null?null:Math.round(e/1e4)/100;function J(e){return["default_monthly_call_cap IS NULL",...e.cost?["default_monthly_cost_cap_micros IS NULL"]:[],...e.ai?["ai_default IS NULL"]:[]].join(" AND ")}var Ue=new WeakMap;function V(e){let a=Ue.get(e);return a||(a=e.run([{sql:"PRAGMA table_info(org_settings)"}]).then(([n=[]])=>n.some(t=>t.name==="ai_default")),Ue.set(e,a)),a}async function Aa(e){if(!await V(e))throw new m("GATEWAY_PREDATES_AI_DEFAULT",`The Gateway predates the default model provider
+Its database has no ai_default column until the Gateway is updated to a release that has it.`,{rerun:`${g} update`,rerunNote:"then run this again"})}async function xe(e,a){if(!await V(e))return null;let[n=[]]=await e.run([{sql:"SELECT ai_default FROM org_settings WHERE organization_id = ?",params:[a]}]),t=n[0]?.ai_default;return ie(typeof t=="string"?t:null)}var Pe=e=>e===null?null:{provider:e.provider,model:e.model??null};async function Ja(e,a){if(a){let l=Oe(a);if(l)throw new m("AI_DEFAULT_INVALID",`${a.provider} can't be the default model provider: ${l}`,{fix:`pick one of the providers ${g} ai list shows, as <provider> or <provider>/<model>`})}await Aa(e.db);let n=e.organization.id,t=await xe(e.db,n),i=a===null?null:re(a),r=(t===null?null:re(t))!==i,d=r?await x(e.db,{organizationId:n,type:"ai.default_changed",actor:P(e.operator),data:{aiDefault:Pe(a),previous:Pe(t)},now:e.now}):[];return await e.db.run([{sql:`INSERT INTO org_settings (organization_id, ai_default, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4)
+ON CONFLICT (organization_id) DO UPDATE SET ai_default = ?2, updated_at = ?3, updated_by = ?4`,params:[n,i,e.now,e.operator.userId]},{sql:`DELETE FROM org_settings WHERE organization_id = ? AND ${J({cost:await v(e.db),ai:!0})}`,params:[n]},...d]),{choice:a,was:t,changed:r}}async function Va(e,a){let[n,t]=await Promise.all([Le(e),xe(a.db,a.organization.id)]),i=d=>n.includes(d);return{resolution:he({choice:t,isSet:i}),names:n,aiGateway:{on:Te.every(i)}}}function Xa(e){let a=e.trim();if(a==="off"||a==="none")return null;let n=ie(a);if(!n)throw new m("AI_DEFAULT_INVALID",`${e} isn't a provider: write the provider's id (openrouter), or the id and a model (openrouter/anthropic/claude-haiku-5.5), or off`,{fix:`${g} ai list names the providers the default can be`});return n}var Fe=`SELECT users.id AS id, users.email AS email, users.name AS name, members.role AS role
+FROM members JOIN users ON users.id = members.user_id
+WHERE members.organization_id = ?1 AND lower(users.email) = ?2
+LIMIT 1`,F=(e,a,n)=>`EXISTS (
+      SELECT 1 FROM members owners JOIN users owner ON owner.id = owners.user_id
+      WHERE owners.organization_id = ${e} AND owners.role = 'owner' AND owners.user_id <> ${a}
+        AND (owner.banned IS NULL OR owner.banned = 0 OR (owner.ban_expires IS NOT NULL AND owner.ban_expires <= ${n}))
+    )`;async function Ka(e,a,n,t){let i=n.trim().toLowerCase(),r=Date.now(),[d=[],,l=[]]=await e.run([{sql:Fe,params:[a,i]},{sql:`UPDATE members SET role = ?3
+WHERE organization_id = ?1
+  AND user_id = (SELECT id FROM users WHERE lower(email) = ?2 LIMIT 1)
+  AND role <> ?3
+  AND NOT (
+    role = 'owner' AND ?3 <> 'owner'
+    AND NOT ${F("?1","members.user_id","?4")}
+  )`,params:[a,i,t,r]},{sql:Fe,params:[a,i]}]),s=He(d[0]);if(!s)return{kind:"not_found"};if(s.role===t)return{kind:"unchanged",member:s};let o=He(l[0])??s;return o.role===t?{kind:"changed",member:o,previousRole:s.role}:{kind:"last_owner",member:s}}function He(e){return e?{id:String(e.id),email:String(e.email),name:String(e.name??""),role:String(e.role)}:null}import{createHash as Na,randomBytes as ge,randomUUID as W}from"node:crypto";async function Sa(e){let a=await Y(e);if(!a||!a.hasOwner)throw new m("WORKSPACE_NOT_CLAIMED",`The Gateway has no owner yet
+The setup claim makes the workspace, named after its owner; rename it after.`,{fix:"open the Gateway in a browser and claim it, then run this again"});return a.organization}function un(e,a){return Me(async()=>{let n=await Sa(e),t=n.name!==a;return t&&await e.run([{sql:"UPDATE organizations SET name = ? WHERE id = ?",params:[a,n.id]}]),{organization:{...n,name:a},previousName:n.name,changed:t}})}var Ra=72*60*60*1e3,Ta=60*60*1e3,Ze=1e9,qe=60,Ge=255,Ee=90,Oa=19,ha=e=>Na("sha256").update(e).digest("hex"),Q=e=>`((',' || replace(${e}, ' ', '') || ',') LIKE '%,owner,%')`,Qe=e=>`(NOT ${Q(e)} OR ${F("?2","?1","?3")})`,X=`EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2 AND ${Qe("m.role")})`,j=`EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2)
+  AND NOT EXISTS (SELECT 1 FROM members mine WHERE mine.user_id = ?1 AND ${Q("mine.role")}
+    AND NOT ${F("mine.organization_id","?1","?3")})`,Ca=e=>`(banned = 1 AND (ban_expires IS NULL OR ban_expires > ${e}))`;function ee(e,a){let n=[];for(let t=0;t<e.length;t+=a)n.push(e.slice(t,t+a));return n}function Da(e){let a=(e??"").split(",").map(n=>n.trim());return a.includes("owner")?"owner":a.includes("admin")?"admin":a.includes("member")?"member":null}var _=e=>Number(e??0);function ae(e,a){let n=Number(e.banned??0)===1,t=e.ban_expires==null?null:Number(e.ban_expires);return{id:String(e.id),name:String(e.name??""),email:String(e.email),role:String(e.role??"member"),primaryRole:Da(p(e.role)),deactivated:n&&(t===null||t>a),createdAt:_(e.created_at)}}function fe(e,a){let n=String(e.status),t=_(e.expires_at);return{id:String(e.id),email:String(e.email),role:String(e.role??"member"),status:n,expiresAt:t,createdAt:_(e.created_at),live:n==="pending"&&t>a}}function ea(e){return{id:String(e.id),name:String(e.name),description:p(e.description),createdAt:_(e.created_at),memberCount:_(e.member_count),appCount:_(e.app_count)}}function be(e){return{id:String(e.id),appSlug:String(e.app_slug),name:String(e.name),description:String(e.description??""),status:String(e.status),scope:String(e.scope),tier:String(e.tier),hostname:p(e.hostname),everyone:Number(e.is_default??0)===1,manifest:p(e.manifest),secretNames:p(e.secret_names),accessCount:_(e.access_count)}}var ne="u.id, u.name, u.email, m.role, u.banned, u.ban_expires, u.created_at",Ae=`a.id, a.app_slug, a.name, a.description, a.status, a.scope, a.tier, a.hostname, a.is_default, a.manifest, a.secret_names,
+  (SELECT COUNT(DISTINCT g.user_id) FROM (
+     SELECT ua.user_id FROM user_app_access ua WHERE ua.app_row_id = a.id AND ua.organization_id = a.organization_id
+     UNION ALL
+     SELECT gm.user_id FROM group_app_access ga JOIN group_members gm ON gm.group_id = ga.group_id
+       WHERE ga.app_row_id = a.id AND ga.organization_id = a.organization_id AND gm.organization_id = a.organization_id
+   ) g JOIN members mm ON mm.user_id = g.user_id AND mm.organization_id = a.organization_id) AS access_count`,K=e=>({id:String(e.id),name:String(e.name),slug:String(e.slug)});async function aa(e,a){let n=a.trim(),[t=[],i=[]]=await e.run([{sql:`SELECT id, name, slug FROM organizations
+WHERE id = ?1 OR slug = ?1 OR lower(name) = lower(?1)
+ORDER BY created_at, id`,params:[n]},{sql:"SELECT id, name, slug FROM organizations ORDER BY created_at, id"}]),r=t.map(K),d=r.find(s=>s.id===n)??r.find(s=>s.slug===n);if(d)return d;if(r.length===1)return r[0];if(r.length>1)throw new m("ORG_AMBIGUOUS",`${r.length} organizations are named ${n}: ${B(r.map(s=>`${s.slug} (${s.id})`))}
+A name isn't unique, and any owner or admin can rename their organization; a slug or id is one organization's.`,{fix:"name it by its slug or id with --org",data:{organizations:r}});let l=i.map(K);throw new m("ORGANIZATION_NOT_FOUND",`No organization named ${n} on this Gateway${l.length>0?`
+The Gateway has: ${B(l.map(s=>`${s.slug} (${s.name})`))}.`:""}`,{fix:"name one by its slug, id or name with --org",data:{organizations:l}})}async function ya(e,a){if(a.email===null)return{actor:a.actor,email:null,userId:null};let[n=[]]=await e.run([{sql:"SELECT id FROM users WHERE lower(email) = lower(?) AND email_verified = 1",params:[a.email]}]);return{actor:a.actor,email:a.email,userId:p(n[0]?.id)}}var na=()=>new m("ORGANIZATION_NOT_FOUND",`The Gateway has no organization yet
+Its owner creates the first one by claiming it.`,{rerun:`${g} setup`,rerunNote:"prints the owner link"});async function pn(e,a){if(a!==void 0)return aa(e,a);let n=await Y(e);if(!n)throw na();return n.organization}async function mn(e,a,n={}){let[t,i]=await Promise.all([Y(e),ya(e,a)]);if(n.org===void 0&&!t)throw na();let r=n.org===void 0?t.organization:await aa(e,n.org);return{db:e,organization:r,installOrganizationId:t?.organization.id??null,operator:i,now:n.now??Date.now()}}async function z(e,a){let n=a.trim(),[t=[]]=await e.db.run([{sql:`SELECT ${ne} FROM members m JOIN users u ON u.id = m.user_id
+WHERE m.organization_id = ?1 AND (lower(u.email) = lower(?2) OR u.id = ?2)
+ORDER BY (u.id = ?2) DESC LIMIT 1`,params:[e.organization.id,n]}]),i=t[0];if(!i)throw new m("USER_NOT_FOUND",`${n} isn't a member of ${e.organization.name}`,{rerun:`${g} workspace users`,rerunNote:"lists the members and invitations"});return ae(i,e.now)}async function Z(e,a,{callable:n=!1}={}){let t=a.trim(),[i=[]]=await e.db.run([{sql:`SELECT ${Ae} FROM apps a
+WHERE (a.organization_id = ?1${n?" OR a.scope = 'shared'":""}) AND a.status != '${T}'
+  AND (a.app_slug = ?2 OR a.id = ?2)
+ORDER BY (a.organization_id = ?1) DESC, (a.id = ?2) DESC LIMIT 1`,params:[e.organization.id,t]}]),r=i[0];if(!r)throw new m("APP_NOT_FOUND",`No app named ${t} in ${e.organization.name}`,{rerun:`${g} workspace apps`,rerunNote:"lists them"});return be(r)}async function ta(e,a){let n=a.trim(),[t=[]]=await e.db.run([{sql:`${sa} AND (g.id = ?2 OR lower(g.name) = lower(?2)) ORDER BY (g.id = ?2) DESC LIMIT 1`,params:[e.organization.id,n]}]),i=t[0];if(!i)throw new m("GROUP_NOT_FOUND",`No group named ${n} in ${e.organization.name}`,{rerun:`${g} workspace groups`,rerunNote:"lists them"});return ea(i)}async function ia(e,a){let n=a.trim(),[t=[]]=await e.db.run([{sql:`SELECT id, email, role, status, expires_at, created_at FROM invitations
+WHERE organization_id = ?1 AND status = 'pending' AND (id = ?2 OR lower(email) = lower(?2))
+ORDER BY (id = ?2) DESC, created_at DESC LIMIT 1`,params:[e.organization.id,n]}]),i=t[0];if(!i)throw new m("INVITATION_NOT_PENDING",`No pending invitation for ${n} in ${e.organization.name}
+It was accepted, canceled or never made.`,{rerun:`${g} workspace users`,rerunNote:"lists the pending invitations"});return fe(i,e.now)}async function _n(e){let a=e.organization.id,[n=[],t=[]]=await e.db.run([{sql:`SELECT u.email FROM members m JOIN users u ON u.id = m.user_id
+WHERE m.organization_id = ?1 AND ${Q("m.role")} ORDER BY m.created_at, u.email`,params:[a]},{sql:`SELECT
+  (SELECT COUNT(*) FROM members WHERE organization_id = ?1) AS members,
+  (SELECT COUNT(*) FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?1 AND ${Ca("?2")}) AS deactivated,
+  (SELECT COUNT(*) FROM invitations WHERE organization_id = ?1 AND status = 'pending' AND expires_at > ?2) AS invitations,
+  (SELECT COUNT(*) FROM groups WHERE organization_id = ?1) AS groups,
+  (SELECT COUNT(*) FROM apps WHERE organization_id = ?1 AND status != '${T}') AS apps`,params:[a,e.now]}]),i=t[0]??{};return{organization:e.organization,owners:n.map(r=>String(r.email)),counts:{members:_(i.members),deactivated:_(i.deactivated),invitations:_(i.invitations),groups:_(i.groups),apps:_(i.apps)}}}async function gn(e){let[a=[],n=[]]=await e.db.run([{sql:`SELECT ${ne} FROM members m JOIN users u ON u.id = m.user_id
+WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id]},{sql:`SELECT id, email, role, status, expires_at, created_at FROM invitations
+WHERE organization_id = ?1 AND status = 'pending' ORDER BY created_at DESC`,params:[e.organization.id]}]),t={owner:0,admin:1,member:2};return{members:a.map(i=>ae(i,e.now)).sort((i,r)=>(t[i.primaryRole??"member"]??3)-(t[r.primaryRole??"member"]??3)||i.email.localeCompare(r.email)),invitations:n.map(i=>fe(i,e.now))}}function ra(){let e=`einv_${ge(32).toString("base64url")}`;return{token:e,hash:ha(e)}}var En=(e,a)=>`${e}/accept-invitation?token=${encodeURIComponent(a)}`,fn=(e,a)=>`${e}/reset-password?token=${encodeURIComponent(a)}`;async function bn(e,a,n){let t=a.trim().toLowerCase(),i=await Ia(e,"invite");await Be(e,t);let r=W(),{token:d,hash:l}=ra(),s=e.now+Ra,[,,o=[]]=await e.db.run([{sql:`INSERT INTO invitations (id, organization_id, email, role, status, expires_at, created_at, inviter_id)
+SELECT ?1, ?2, ?3, ?4, 'pending', ?5, ?6, ?7
+WHERE NOT EXISTS (SELECT 1 FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?2 AND lower(u.email) = ?3)
+  AND NOT EXISTS (SELECT 1 FROM invitations i WHERE i.organization_id = ?2 AND lower(i.email) = ?3 AND i.status = 'pending' AND i.expires_at > ?6)`,params:[r,e.organization.id,t,n,s,e.now,i]},{sql:`INSERT INTO invitation_link_tokens (id, invitation_id, token_hash, created_at)
+SELECT ?1, ?2, ?3, ?4 WHERE EXISTS (SELECT 1 FROM invitations WHERE id = ?2)`,params:[W(),r,l,e.now]},{sql:"SELECT id, email, role, status, expires_at, created_at FROM invitations WHERE id = ?",params:[r]}]),u=o[0];if(!u)throw await Be(e,t),new m("ALREADY_INVITED",`${t} was invited meanwhile`,{retryable:!0});return{invitation:fe(u,e.now),token:d}}async function Ia(e,a){let{operator:n}=e;if(n.userId!==null){let[i=[]]=await e.db.run([{sql:"SELECT 1 AS member FROM members WHERE user_id = ? AND organization_id = ?",params:[n.userId,e.organization.id]}]);if(i.length>0)return n.userId}let t=n.email===null?"An API token has no account on the Gateway":n.userId===null?`${n.email} has no account on this Gateway (a verified one)`:`${n.email} isn't a member of ${e.organization.name}`;throw new m("WORKSPACE_NOT_A_MEMBER",`Only a member can ${a}: an invitation records who sent it
+${t}.`,{fix:n.email===null?`log in with your Cloudflare account (${g} login), claim the Gateway (${g} setup) or get invited, or invite from Admin \u2192 Users`:`claim the Gateway (${g} setup) or get invited to ${e.organization.name}, or invite from Admin \u2192 Users`})}async function Be(e,a){let[n=[],t=[]]=await e.db.run([{sql:"SELECT u.email FROM members m JOIN users u ON u.id = m.user_id WHERE m.organization_id = ?1 AND lower(u.email) = ?2",params:[e.organization.id,a]},{sql:"SELECT id FROM invitations WHERE organization_id = ?1 AND lower(email) = ?2 AND status = 'pending' AND expires_at > ?3",params:[e.organization.id,a,e.now]}]);if(n.length>0)throw new m("ALREADY_MEMBER",`${a} is a member of ${e.organization.name} already`,{rerun:`${g} workspace users`,rerunNote:"lists the members"});if(t.length>0)throw new m("ALREADY_INVITED",`${a} has a pending invitation to ${e.organization.name} already`,{rerun:`${g} workspace invite-link ${a}`,rerunNote:"prints a new link for it"})}async function An(e,a){let n=await ia(e,a);if(!n.live)throw new m("INVITATION_NOT_PENDING",`The invitation for ${n.email} expired on ${new Date(n.expiresAt).toISOString()}`,{rerun:`${g} workspace invite ${n.email}`,rerunNote:"makes a new one"});let{token:t,hash:i}=ra(),[r=[]]=await e.db.run([{sql:`INSERT INTO invitation_link_tokens (id, invitation_id, token_hash, created_at)
+SELECT ?1, ?2, ?3, ?4 WHERE EXISTS (SELECT 1 FROM invitations WHERE id = ?2 AND status = 'pending' AND expires_at > ?4)
+RETURNING id`,params:[W(),n.id,i,e.now]}]);if(r.length===0)throw new m("INVITATION_NOT_PENDING",`The invitation for ${n.email} was used or canceled meanwhile`);return{invitation:n,token:t}}async function Nn(e,a){let n=await ia(e,a),[t=[]]=await e.db.run([{sql:"UPDATE invitations SET status = 'canceled' WHERE id = ? AND organization_id = ? AND status = 'pending' RETURNING id",params:[n.id,e.organization.id]}]);if(t.length===0)throw new m("INVITATION_NOT_PENDING",`The invitation for ${n.email} was used or canceled meanwhile`);return{...n,status:"canceled",live:!1}}function Ye(e,a,n,t){let r=t.id===e.organization.id?`${a.email} is the last owner of ${t.name} who can act, so they can't be ${n}`:`${a.email} is the last owner of ${t.name} who can act, and a deactivation is account-wide: it would leave ${t.name} without one`,d=t.id===e.installOrganizationId?{rerun:`${g} workspace role <email> owner`,rerunNote:"for someone else, then this command again"}:{fix:`an owner of ${t.name} makes someone else an owner under Manage workspace \u2192 Users, then run this again`};return new m("LAST_OWNER",`${r}
+Make someone else an owner of ${t.name} first, then try again.`,{...d,data:{organization:t,member:{id:a.id,email:a.email,name:a.name}}})}async function va(e,a,n){let[t=[]]=await e.db.run([{sql:`SELECT o.id, o.name, o.slug FROM members mine JOIN organizations o ON o.id = mine.organization_id
+WHERE mine.user_id = ?1 AND ${n?"1":"mine.organization_id = ?3"} AND ${Q("mine.role")}
+  AND NOT ${F("mine.organization_id","?1","?2")}
+ORDER BY (mine.organization_id = ?3) DESC, o.created_at, o.id`,params:[a,e.now,e.organization.id]}]);return t.map(K)}async function H(e,a,n,t,{afterWrite:i=!1}={}){let r=i?await z(e,a.id):a,d=await va(e,r.id,t);if(d[0])throw Ye(e,r,n,d[0]);if(i)throw Ye(e,r,n,e.organization)}function oa(e,a,n){let t=[a.id,e.organization.id,e.now];return[{sql:`UPDATE users SET banned = 1, ban_reason = ?4, ban_expires = NULL, updated_at = ?3
+WHERE id = ?1 AND ${j} RETURNING id`,params:[...t,n]},{sql:`DELETE FROM sessions WHERE user_id = ?1 AND ${j}`,params:t},{sql:`UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3
+WHERE user_id = ?1 AND revoked_at IS NULL AND ${j}`,params:t},{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_reason = 'user_deactivated'
+WHERE user_id = ?1 AND revoked_at IS NULL AND ${j}`,params:t}]}async function Sn(e,a){let n=await z(e,a);await H(e,n,"deactivated",!0);let[t=[]]=await e.db.run(oa(e,n,`Deactivated by ${e.operator.actor} (${g} workspace deactivate)`));return t.length===0&&await H(e,n,"deactivated",!0,{afterWrite:!0}),{member:{...n,deactivated:!0},already:n.deactivated}}async function Rn(e,a){let n=await z(e,a);return await e.db.run([{sql:`UPDATE users SET banned = 0, ban_reason = NULL, ban_expires = NULL, updated_at = ?3
+WHERE id = ?1 AND EXISTS (SELECT 1 FROM members m WHERE m.user_id = ?1 AND m.organization_id = ?2)`,params:[n.id,e.organization.id,e.now]}]),{member:{...n,deactivated:!1},already:!n.deactivated}}async function Tn(e,a,n){let t=await z(e,a);await H(e,t,"removed",!1);let[i=[]]=await e.db.run([{sql:"SELECT COUNT(*) AS n FROM members WHERE user_id = ? AND organization_id != ?",params:[t.id,e.organization.id]}]),r=_(i[0]?.n);if(r===0&&await n.accessMayLetBackIn(t)){let[o=[]]=await e.db.run(oa(e,t,`Removed by ${e.operator.actor} (${g} workspace remove); deactivated instead, as Cloudflare Access would let them back in`));return o.length===0&&await H(e,t,"removed",!0,{afterWrite:!0}),{member:{...t,deactivated:!0},deactivatedInstead:!0,accountDeleted:!1,otherOrganizations:r}}let d=[t.id,e.organization.id,e.now],[,,,,l=[],s=[]]=await e.db.run([{sql:`DELETE FROM user_app_access WHERE user_id = ?1 AND organization_id = ?2 AND ${X}`,params:d},{sql:`DELETE FROM group_members WHERE user_id = ?1 AND organization_id = ?2 AND ${X}`,params:d},{sql:`UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3
+WHERE user_id = ?1 AND organization_id = ?2 AND revoked_at IS NULL AND ${X}`,params:d},{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_reason = 'member_removed'
+WHERE user_id = ?1 AND organization_id = ?2 AND revoked_at IS NULL AND ${X}`,params:d},{sql:`DELETE FROM members WHERE user_id = ?1 AND organization_id = ?2 AND ${Qe("role")} RETURNING id`,params:d},n.deleteAccounts?{sql:"DELETE FROM users WHERE id = ?1 AND NOT EXISTS (SELECT 1 FROM members WHERE user_id = ?1) RETURNING id",params:[t.id]}:{sql:"SELECT NULL AS id WHERE 0"}]);return l.length===0&&await H(e,t,"removed",!1,{afterWrite:!0}),{member:t,deactivatedInstead:!1,accountDeleted:s.length>0,otherOrganizations:r}}async function On(e,a){let n=await z(e,a);if(n.deactivated)throw new m("PASSWORD_RESET_REQUIRES_ACTIVE_USER",`${n.email} is deactivated, and a password-reset link is only for an active account`,{rerun:`${g} workspace reactivate ${n.email}`,rerunNote:"first, if they should be back"});let[t=[]]=await e.db.run([{sql:`SELECT o.id, o.name, o.slug FROM members m JOIN organizations o ON o.id = m.organization_id
+WHERE m.user_id = ?1 AND m.organization_id != ?2 ORDER BY o.created_at, o.id`,params:[n.id,e.organization.id]}]);if(t.length>0){let d=t.map(K);throw new m("USER_IN_OTHER_ORGANIZATION",`${n.email} also belongs to ${B(d.map(l=>l.name))}, and a password is account-wide
+The Gateway's own rule: a password-reset link is never made for someone in another organization, since it would reach that one too.`,{fix:"they reset it themselves with Forgot password (the Gateway's email must be configured), or they are removed from the other organization first",data:{member:{id:n.id,email:n.email,name:n.name},organizations:d}})}let i=ge(24).toString("base64url"),r=e.now+Ta;return await e.db.run([{sql:`INSERT INTO verifications (id, identifier, value, expires_at, created_at, updated_at)
+VALUES (?1, ?2, ?3, ?4, ?5, ?5)`,params:[W(),`reset-password:${i}`,n.id,r,e.now]}]),{member:n,token:i,expiresAt:r}}var sa=`SELECT g.id, g.name, g.description, g.created_at,
+  (SELECT COUNT(*) FROM group_members gm WHERE gm.group_id = g.id) AS member_count,
+  (SELECT COUNT(*) FROM group_app_access ga JOIN apps a ON a.id = ga.app_row_id AND a.status != '${T}' WHERE ga.group_id = g.id) AS app_count
+FROM groups g WHERE g.organization_id = ?1`;async function hn(e){let[a=[]]=await e.db.run([{sql:`${sa} ORDER BY g.name`,params:[e.organization.id]}]);return a.map(ea)}function da(e){let a=e.trim();if(a.length<1||a.length>qe)throw new m("GROUP_NAME_INVALID",`A group name is 1 to ${qe} characters${a?` (${a.length} given)`:""}`);return a}function la(e){return new m("GROUP_NAME_TAKEN",`A group named "${e}" exists already in this organization`,{rerun:`${g} workspace groups`,rerunNote:"lists them"})}var ka=()=>`grp_${ge(8).toString("hex")}`;async function Cn(e,a){let n=da(a.name),t=a.description?.trim()||null,i=ka(),[r=[]]=await e.db.run([{sql:`INSERT INTO groups (id, organization_id, name, description, created_at, created_by)
+SELECT ?1, ?2, ?3, ?4, ?5, ?6
+WHERE NOT EXISTS (SELECT 1 FROM groups WHERE organization_id = ?2 AND lower(name) = lower(?3))
+RETURNING id`,params:[i,e.organization.id,n,t,e.now,e.operator.userId]}]);if(r.length===0)throw la(n);return{id:i,name:n,description:t,createdAt:e.now,memberCount:0,appCount:0}}async function Dn(e,a,n){let t=await ta(e,a),i=n.name===void 0?t.name:da(n.name),r=n.description===void 0?t.description:n.description.trim()||null,[d=[]]=await e.db.run([{sql:`UPDATE groups SET name = ?3, description = ?4
+WHERE id = ?1 AND organization_id = ?2
+  AND NOT EXISTS (SELECT 1 FROM groups WHERE organization_id = ?2 AND lower(name) = lower(?3) AND id != ?1)
+RETURNING id`,params:[t.id,e.organization.id,i,r]}]);if(d.length===0)throw la(i);return{...t,name:i,description:r}}async function yn(e,a){let n=await ta(e,a),t=[n.id,e.organization.id];return await e.db.run([{sql:"DELETE FROM group_app_access WHERE group_id = ?1 AND organization_id = ?2",params:t},{sql:"DELETE FROM group_members WHERE group_id = ?1 AND organization_id = ?2",params:t},{sql:"DELETE FROM groups WHERE id = ?1 AND organization_id = ?2",params:t}]),n}async function Je(e,a){let[n=[]]=await e.db.run([{sql:`SELECT ${ne}, (gm.user_id IS NOT NULL) AS in_group
+FROM members m JOIN users u ON u.id = m.user_id
+LEFT JOIN group_members gm ON gm.group_id = ?2 AND gm.user_id = u.id
+WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id,a.id]}]);return n.map(t=>({...ae(t,e.now),inGroup:Number(t.in_group)===1}))}function Ne(e,a){let n=new Set(e);if(a.set){let r=new Set(a.set);return{add:[...r].filter(d=>!n.has(d)),remove:[...n].filter(d=>!r.has(d))}}let t=[...new Set(a.add??[])].filter(r=>!n.has(r)),i=[...new Set(a.remove??[])].filter(r=>n.has(r));return{add:t,remove:i}}async function L(e,a){let n=[];for(let t of a){let i=await z(e,t);n.some(r=>r.id===i.id)||n.push(i)}return n}async function ce(e,a){let n=[];for(let t of a){let i=await Z(e,t);n.some(r=>r.id===i.id)||n.push(i)}return n}async function In(e,a,n){let[t,i,r]=await Promise.all([n.set?L(e,n.set):void 0,L(e,n.add??[]),L(e,n.remove??[])]),d=await Je(e,a),l=d.filter(u=>u.inGroup).map(u=>u.id),s=Ne(l,{set:t?.map(u=>u.id),add:i.map(u=>u.id),remove:r.map(u=>u.id)}),o=new Map(d.map(u=>[u.id,u]));return await e.db.run([...ee(s.remove,Ee).map(u=>({sql:`DELETE FROM group_members WHERE group_id = ? AND organization_id = ? AND user_id IN (${u.map(()=>"?").join(", ")})`,params:[a.id,e.organization.id,...u]})),...s.add.map(u=>({sql:`INSERT INTO group_members (group_id, user_id, organization_id, added_at, added_by)
+SELECT ?1, ?2, ?3, ?4, ?5 WHERE EXISTS (SELECT 1 FROM members WHERE user_id = ?2 AND organization_id = ?3)
+ON CONFLICT DO NOTHING`,params:[a.id,u,e.organization.id,e.now,e.operator.userId]}))]),{added:s.add.map(u=>o.get(u)),removed:s.remove.map(u=>o.get(u)),members:await Je(e,a)}}async function Ve(e,a){let[n=[]]=await e.db.run([{sql:`SELECT ${Ae}, (ga.group_id IS NOT NULL) AS granted FROM apps a
+LEFT JOIN group_app_access ga ON ga.group_id = ?2 AND ga.app_row_id = a.id
+WHERE a.organization_id = ?1 AND a.scope != 'shared' AND a.status != '${T}' ORDER BY a.name`,params:[e.organization.id,a.id]}]);return n.map(t=>({...be(t),granted:Number(t.granted)===1}))}function te(e){return new m("SHARED_APP_ACCESS",`${e.appSlug} is a shared app: every member of every organization can open it, so its access can't be changed`)}async function vn(e,a,n){let[t,i,r]=await Promise.all([n.set?ce(e,n.set):void 0,ce(e,n.add??[]),ce(e,n.remove??[])]);for(let o of[...t??[],...i])if(o.scope==="shared")throw te(o);let d=await Ve(e,a),l=Ne(d.filter(o=>o.granted).map(o=>o.id),{set:t?.map(o=>o.id),add:i.map(o=>o.id),remove:r.map(o=>o.id)}),s=new Map(d.map(o=>[o.id,o]));return await e.db.run([...ee(l.remove,Ee).map(o=>({sql:`DELETE FROM group_app_access WHERE group_id = ? AND organization_id = ? AND app_row_id IN (${o.map(()=>"?").join(", ")})`,params:[a.id,e.organization.id,...o]})),...l.add.map(o=>({sql:`INSERT INTO group_app_access (group_id, app_row_id, organization_id, granted_at, granted_by)
+SELECT ?1, ?2, ?3, ?4, ?5
+WHERE EXISTS (SELECT 1 FROM apps WHERE id = ?2 AND organization_id = ?3 AND scope != 'shared' AND status != '${T}')
+ON CONFLICT DO NOTHING`,params:[a.id,o,e.organization.id,e.now,e.operator.userId]}))]),{added:l.add.map(o=>s.get(o)),removed:l.remove.map(o=>s.get(o)),apps:await Ve(e,a)}}async function kn(e){let[a=[]]=await e.db.run([{sql:`SELECT ${Ae} FROM apps a WHERE a.organization_id = ?1 AND a.status != '${T}' ORDER BY a.name`,params:[e.organization.id]}]);return a.map(be)}function wa(e){let a=e.trim();if(a.length<1||a.length>Ge)throw new m("APP_NAME_INVALID",`An app's name is 1 to ${Ge} characters${a?` (${a.length} given)`:", not empty"}`,{fix:"give --name the name the app library should show, or leave --name off"});return a}async function wn(e,a,n){let t=await Z(e,a);if(n.name===void 0&&n.description===void 0&&n.everyone===void 0)throw new m("NOTHING_TO_SET","Nothing to set: give --name, --description or --everyone on|off");if(t.scope==="shared"&&n.everyone)throw te(t);let i=n.name===void 0?t.name:wa(n.name),r=n.description===void 0?t.description:n.description.trim(),d=n.everyone??t.everyone,l=[];if(d&&!t.everyone){let[o=[]]=await e.db.run([{sql:"SELECT user_id FROM members WHERE organization_id = ?",params:[e.organization.id]}]);for(let u of ee(o,Oa))l.push({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by) VALUES ${u.map(()=>"(?, ?, ?, ?, ?)").join(", ")} ON CONFLICT DO NOTHING RETURNING id`,params:u.flatMap(b=>[W(),String(b.user_id),t.id,e.organization.id,e.operator.userId])})}let[,...s]=await e.db.run([{sql:`UPDATE apps SET name = ?3, description = ?4, is_default = ?5, updated_at = ?6
+WHERE id = ?1 AND organization_id = ?2 AND status != '${T}'`,params:[t.id,e.organization.id,i,r,d?1:0,e.now]},...l]);return{app:await Z(e,t.id),granted:s.reduce((o,u)=>o+u.length,0)}}async function Xe(e,a){if(a.scope==="shared")throw te(a);let[n=[]]=await e.db.run([{sql:`SELECT ${ne},
+  (ua.id IS NOT NULL) AS direct,
+  (SELECT group_concat(g.name, char(31)) FROM group_app_access ga
+     JOIN group_members gm ON gm.group_id = ga.group_id AND gm.user_id = u.id
+     JOIN groups g ON g.id = ga.group_id
+   WHERE ga.app_row_id = ?2 AND ga.organization_id = ?1) AS via_groups
+FROM members m JOIN users u ON u.id = m.user_id
+LEFT JOIN user_app_access ua ON ua.app_row_id = ?2 AND ua.organization_id = ?1 AND ua.user_id = u.id
+WHERE m.organization_id = ?1 ORDER BY u.email`,params:[e.organization.id,a.id]}]);return n.map(t=>({...ae(t,e.now),direct:Number(t.direct)===1,viaGroups:p(t.via_groups)?.split("").sort()??[]}))}async function Mn(e,a,n){if(a.scope==="shared")throw te(a);let[t,i,r]=await Promise.all([n.set?L(e,n.set):void 0,L(e,n.add??[]),L(e,n.remove??[])]),d=await Xe(e,a),l=Ne(d.filter(o=>o.direct).map(o=>o.id),{set:t?.map(o=>o.id),add:i.map(o=>o.id),remove:r.map(o=>o.id)}),s=new Map(d.map(o=>[o.id,o]));return await e.db.run([...ee(l.remove,Ee).map(o=>({sql:`DELETE FROM user_app_access WHERE app_row_id = ? AND organization_id = ? AND user_id IN (${o.map(()=>"?").join(", ")})`,params:[a.id,e.organization.id,...o]})),...l.add.map(o=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_at, granted_by)
+SELECT ?1, ?2, ?3, ?4, ?5, ?6 WHERE EXISTS (SELECT 1 FROM members WHERE user_id = ?2 AND organization_id = ?4)
+ON CONFLICT DO NOTHING`,params:[W(),o,a.id,e.organization.id,e.now,e.operator.userId]}))]),{granted:l.add.map(o=>s.get(o)),revoked:l.remove.map(o=>s.get(o)),users:await Xe(e,a)}}function M(e){return e.appCap!==null?{cap:e.appCap,source:"app"}:e.unlimited?{cap:null,source:null}:e.defaultCap!==null?{cap:e.defaultCap,source:"default"}:{cap:null,source:null}}var je=(e,a)=>e===null?a!==null:a===null||e>a,Ke=new WeakMap;function ca(e){let a=Ke.get(e);return a||(a=e.run([{sql:"PRAGMA table_info(org_settings)"},{sql:"PRAGMA table_info(org_app_settings)"}]).then(([n=[],t=[]])=>n.length>0&&t.some(i=>i.name==="unlimited")),Ke.set(e,a)),a}async function Se(e){if(!await ca(e))throw new m("GATEWAY_PREDATES_DEFAULT_CAPS",`The Gateway predates default caps
+Its database has no workspace default cap and no no-cap override until the Gateway is updated to a release that has them.`,{rerun:`${g} update`,rerunNote:"then run this again"})}var ua=e=>e===null||Number.isInteger(e)&&e>=1&&e<=Ze,pa=()=>new m("INVALID_CAP",`A monthly cap is a whole number from 1 to ${Ze.toLocaleString("en-US")}, or off`),C=e=>e==null?null:Number(e);function ma(e,a){return!je(e.calls,a.calls)&&!je(e.cost,a.cost)?null:{cap:e.calls,previousCap:a.calls,...e.cost!==a.cost&&{costCap:le(e.cost),previousCostCap:le(a.cost)}}}async function Ln(e,a,n,t={}){let i=t.unlimited??!1,r=await Z(e,a,{callable:!0});if(n!==void 0&&!ua(n))throw pa();let d=de(t.costUsd);if(i&&(n!=null||d!=null))throw new m("INVALID_CAP",`An app has a cap or no cap, not both
+Give a number, --usd, off, or --unlimited.`);if(!i&&n===void 0&&d===void 0)throw new m("INVALID_CAP",`Missing the cap
+Give a number of calls, --usd, off, or --unlimited.`);let l=await ca(e.db);i&&await Se(e.db),d!==void 0&&await se(e.db);let s=l&&await v(e.db),o=e.organization.id,[u=[],b=[]]=await e.db.run([{sql:`SELECT monthly_call_cap${l?", unlimited":""}${s?", monthly_cost_cap_micros":""} FROM org_app_settings WHERE organization_id = ? AND app_row_id = ?`,params:[o,r.id]},...l?[{sql:`SELECT default_monthly_call_cap AS cap${s?", default_monthly_cost_cap_micros AS cost_cap":""} FROM org_settings WHERE organization_id = ?`,params:[o]}]:[]]),S=C(u[0]?.monthly_call_cap),N=C(u[0]?.monthly_cost_cap_micros),A=Number(u[0]?.unlimited??0)===1,k=C(b[0]?.cap),D=C(b[0]?.cost_cap),O=i?null:n===void 0?S:n,y=i?null:d===void 0?N:d,h=M({appCap:S,unlimited:A,defaultCap:k}),q=M({appCap:N,unlimited:A,defaultCap:D}),I=M({appCap:O,unlimited:i,defaultCap:k}),$=M({appCap:y,unlimited:i,defaultCap:D}),c=n==null&&d==null?null:await oe(e.db,{organizationId:o,deployer:e.operator,now:e.now}),E=ma({calls:I.cap,cost:$.cap},{calls:h.cap,cost:q.cap}),R=E?await x(e.db,{organizationId:o,type:"cap.raised",actor:P(e.operator),data:{app:{id:r.appSlug,rowId:r.id,name:r.name},...E,source:"app"},appRowId:r.id,now:e.now}):[],U=O===null&&y===null&&!i?{sql:"DELETE FROM org_app_settings WHERE organization_id = ? AND app_row_id = ?",params:[o,r.id]}:s?{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, monthly_cost_cap_micros, unlimited, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, monthly_cost_cap_micros = ?4, unlimited = ?5, updated_at = ?6, updated_by = ?7`,params:[o,r.id,O,y,i?1:0,e.now,e.operator.userId]}:l?{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, unlimited, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4, ?5, ?6)
+ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, unlimited = ?4, updated_at = ?5, updated_by = ?6`,params:[o,r.id,O,i?1:0,e.now,e.operator.userId]}:{sql:`INSERT INTO org_app_settings (organization_id, app_row_id, monthly_call_cap, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4, ?5)
+ON CONFLICT (organization_id, app_row_id) DO UPDATE SET monthly_call_cap = ?3, updated_at = ?4, updated_by = ?5`,params:[o,r.id,O,e.now,e.operator.userId]},w=await e.db.run([U,...c?[c]:[],...R]),f=c?p(w[1]?.[0]?.id):null;return{app:r,cap:O,costCapMicros:y,unlimited:i,was:S,wasCostCapMicros:N,wasUnlimited:A,effective:I,before:h,effectiveCost:$,beforeCost:q,capAlertsId:f}}async function Wn(e,a,n){if(a!==void 0&&!ua(a))throw pa();let t=de(n);if(a===void 0&&t===void 0)throw new m("INVALID_CAP",`Missing the default
+Give a number of calls, --usd, or off.`);await Se(e.db),t!==void 0&&await se(e.db);let i=await v(e.db),r=e.organization.id,[d=[]]=await e.db.run([{sql:`SELECT default_monthly_call_cap AS cap${i?", default_monthly_cost_cap_micros AS cost_cap":""} FROM org_settings WHERE organization_id = ?`,params:[r]}]),l=C(d[0]?.cap),s=C(d[0]?.cost_cap),o=a===void 0?l:a,u=t===void 0?s:t,b=a==null&&t==null?null:await oe(e.db,{organizationId:r,deployer:e.operator,now:e.now}),S=ma({calls:o,cost:u},{calls:l,cost:s}),N=S?await x(e.db,{organizationId:r,type:"cap.raised",actor:P(e.operator),data:{app:null,...S,source:"default"},now:e.now}):[],A=[i?{sql:`INSERT INTO org_settings (organization_id, default_monthly_call_cap, default_monthly_cost_cap_micros, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4, ?5)
+ON CONFLICT (organization_id) DO UPDATE SET default_monthly_call_cap = ?2, default_monthly_cost_cap_micros = ?3, updated_at = ?4, updated_by = ?5`,params:[r,o,u,e.now,e.operator.userId]}:{sql:`INSERT INTO org_settings (organization_id, default_monthly_call_cap, updated_at, updated_by)
+VALUES (?1, ?2, ?3, ?4)
+ON CONFLICT (organization_id) DO UPDATE SET default_monthly_call_cap = ?2, updated_at = ?3, updated_by = ?4`,params:[r,o,e.now,e.operator.userId]},...a===null||t===null?[{sql:`DELETE FROM org_settings WHERE organization_id = ? AND ${J({cost:i,ai:await V(e.db)})}`,params:[r]}]:[]],k=await e.db.run([...A,...b?[b]:[],...N]),D=b?p(k[A.length]?.[0]?.id):null;return{cap:o,was:l,costCapMicros:u,wasCostCapMicros:s,capAlertsId:D}}var Ma=/^\d{4}-(0[1-9]|1[0-2])$/;function _a(e){return`${e.getUTCFullYear()}-${String(e.getUTCMonth()+1).padStart(2,"0")}`}function La(e,a){let[n,t]=e.split("-").map(Number);return _a(new Date(Date.UTC(n,t-1+a,1)))}var ue=`COALESCE(SUM(d.calls), 0) AS calls, COALESCE(SUM(d.failures), 0) AS failures,
+  COALESCE(SUM(d.input_tokens), 0) AS input_tokens, COALESCE(SUM(d.output_tokens), 0) AS output_tokens,
+  COALESCE(SUM(d.cost_micros), 0) AS cost_micros`,pe=e=>({calls:_(e.calls),failures:_(e.failures),inputTokens:_(e.input_tokens),outputTokens:_(e.output_tokens),costMicros:_(e.cost_micros)}),me={calls:0,failures:0,inputTokens:0,outputTokens:0,costMicros:0},_e={monthlyCallCap:null,capUnlimited:!1,effectiveMonthlyCallCap:null,capSource:null,monthlyCostCapMicros:null,effectiveMonthlyCostCapMicros:null,costCapSource:null,paused:!1,pausedBy:null};async function zn(e,a){if(!Ma.test(a))throw new m("INVALID_MONTH",`--month ${a} isn't a month: use YYYY-MM`);await Se(e.db);let n=await v(e.db),t=e.organization.id,i=`${a}-01`,r=`${La(a,1)}-01`,d=Date.parse(`${i}T00:00:00.000Z`),l=Date.parse(`${r}T00:00:00.000Z`),s="d.organization_id = ?1 AND d.day >= ?2 AND d.day < ?3",o="c.organization_id = ?1 AND c.decision = 'allowed' AND c.created_at >= ?2 AND c.created_at < ?3",[u=[],b=[],S=[],N=[],A=[],k=[],D=[]]=await e.db.run([{sql:`SELECT d.app_row_id, a.name, a.app_slug, ${ue} FROM usage_daily d LEFT JOIN apps a ON a.id = d.app_row_id
+WHERE ${s} GROUP BY d.app_row_id, a.name, a.app_slug`,params:[t,i,r]},{sql:`SELECT d.user_id, u.name, u.email, ${ue} FROM usage_daily d
+LEFT JOIN members m ON m.user_id = d.user_id AND m.organization_id = d.organization_id
+LEFT JOIN users u ON u.id = m.user_id
+WHERE ${s} GROUP BY d.user_id, u.name, u.email`,params:[t,i,r]},{sql:`SELECT d.kind, d.target, ${ue} FROM usage_daily d WHERE ${s} GROUP BY d.kind, d.target`,params:[t,i,r]},{sql:`SELECT c.app_row_id, a.name, a.app_slug, COUNT(*) AS tool_calls FROM mcp_tool_calls c
+LEFT JOIN apps a ON a.id = c.app_row_id WHERE ${o} GROUP BY c.app_row_id, a.name, a.app_slug`,params:[t,d,l]},{sql:`SELECT c.user_id, u.name, u.email, COUNT(*) AS tool_calls FROM mcp_tool_calls c
+LEFT JOIN members m ON m.user_id = c.user_id AND m.organization_id = c.organization_id
+LEFT JOIN users u ON u.id = m.user_id
+WHERE ${o} GROUP BY c.user_id, u.name, u.email`,params:[t,d,l]},{sql:`SELECT a.id AS app_row_id, a.name, a.app_slug, s.monthly_call_cap, s.unlimited${n?", s.monthly_cost_cap_micros":""} FROM apps a
+LEFT JOIN org_app_settings s ON s.app_row_id = a.id AND s.organization_id = ?1
+WHERE (a.organization_id = ?1 OR a.scope = 'shared') AND a.status != '${T}'`,params:[t]},{sql:`SELECT default_monthly_call_cap AS cap${n?", default_monthly_cost_cap_micros AS cost_cap":""} FROM org_settings WHERE organization_id = ?`,params:[t]}]),O=C(D[0]?.cap),y=C(D[0]?.cost_cap),h=new Map;for(let c of u)h.set(String(c.app_row_id),{appRowId:String(c.app_row_id),appSlug:p(c.app_slug),name:p(c.name),...pe(c),toolCalls:0,..._e,callable:!1});for(let c of N){let E=p(c.app_row_id);if(!E)continue;let R=h.get(E);R?R.toolCalls=_(c.tool_calls):h.set(E,{appRowId:E,appSlug:p(c.app_slug),name:p(c.name),...me,toolCalls:_(c.tool_calls),..._e,callable:!1})}let q=a===_a(new Date(e.now));for(let c of k){let E=String(c.app_row_id),R=c.monthly_call_cap==null?null:Number(c.monthly_call_cap),U=Number(c.unlimited??0)===1,w=M({appCap:R,unlimited:U,defaultCap:O}),f=h.get(E)??{appRowId:E,appSlug:p(c.app_slug),name:p(c.name),...me,toolCalls:0,..._e,callable:!0};f.callable=!0,f.monthlyCallCap=R,f.capUnlimited=U,f.effectiveMonthlyCallCap=w.cap,f.capSource=w.source;let Re=C(c.monthly_cost_cap_micros),G=M({appCap:Re,unlimited:U,defaultCap:y});f.monthlyCostCapMicros=Re,f.effectiveMonthlyCostCapMicros=G.cap,f.costCapSource=G.source,f.pausedBy=q?w.cap!==null&&f.calls>=w.cap?"calls":G.cap!==null&&f.costMicros>=G.cap?"cost":null:null,f.paused=f.pausedBy!==null,h.set(E,f)}let I=new Map;for(let c of b)I.set(String(c.user_id),{userId:String(c.user_id),name:p(c.name),email:p(c.email),...pe(c),toolCalls:0});for(let c of A){let E=String(c.user_id),R=I.get(E);R?R.toolCalls=_(c.tool_calls):I.set(E,{userId:E,name:p(c.name),email:p(c.email),...me,toolCalls:_(c.tool_calls)})}let $=(c,E)=>E.calls-c.calls||E.toolCalls-c.toolCalls;return{month:a,defaultMonthlyCallCap:O,defaultMonthlyCostCapMicros:y,byApp:[...h.values()].sort((c,E)=>$(c,E)||(c.name??c.appRowId).localeCompare(E.name??E.appRowId)),byMember:[...I.values()].sort($),byTarget:S.map(c=>({kind:String(c.kind),target:String(c.target),...pe(c)})).sort((c,E)=>E.calls-c.calls)}}var Wa=200;async function $n(e,a){let n=Math.min(Math.max(1,Math.trunc(a.limit??50)||1),Wa),t=["c.organization_id = ?"],i=[e.organization.id];a.before&&(t.push("(c.created_at < ? OR (c.created_at = ? AND c.id < ?))"),i.push(a.before.createdAt,a.before.createdAt,a.before.id));for(let[s,o]of[["c.app_row_id",a.appRowId],["c.user_id",a.userId],["c.decision",a.decision],["c.risk",a.risk]])o!==void 0&&(t.push(`${s} = ?`),i.push(o));a.since!==void 0&&(t.push("c.created_at >= ?"),i.push(a.since)),i.push(n+1);let[r=[]]=await e.db.run([{sql:`SELECT c.id, c.created_at, c.user_id, u.name AS user_name, u.email AS user_email,
+  c.credential_kind, c.client_name, c.client_info, c.app_row_id, c.app_slug, a.name AS app_name, a.status AS app_status,
+  c.tool_name, c.via, c.risk, c.decision, c.reason, c.outcome, c.duration_ms, c.result_bytes
+FROM mcp_tool_calls c
+LEFT JOIN apps a ON a.id = c.app_row_id
+LEFT JOIN members m ON m.user_id = c.user_id AND m.organization_id = c.organization_id
+LEFT JOIN users u ON u.id = m.user_id
+WHERE ${t.join(" AND ")}
+ORDER BY c.created_at DESC, c.id DESC LIMIT ?`,params:i}]),d=r.slice(0,n),l=d.at(-1);return{calls:d.map(s=>{let o=p(s.app_row_id),u=p(s.app_status);return{id:String(s.id),createdAt:_(s.created_at),user:{id:String(s.user_id),name:p(s.user_name),email:p(s.user_email)},credential:{kind:String(s.credential_kind),clientName:p(s.client_name),clientInfo:p(s.client_info)},app:{rowId:o,slug:p(s.app_slug),name:p(s.app_name),removed:o!==null&&(u===null||u===T)},tool:{name:String(s.tool_name),risk:p(s.risk),via:p(s.via)},decision:s.decision==="allowed"?"allowed":"blocked",reason:p(s.reason),outcome:String(s.outcome),durationMs:s.duration_ms==null?null:Number(s.duration_ms),resultBytes:s.result_bytes==null?null:Number(s.result_bytes)}}),nextBefore:r.length>n&&l?{createdAt:_(l.created_at),id:String(l.id)}:null}}var za=/^(\*|[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*(\.\*)?)$/,$a=80;async function Un(e,a){await we(e.db);let n=Math.min(Math.max(1,Math.trunc(a.limit??50)||1),De),t=["e.organization_id = ?"],i=[e.organization.id];if(a.before&&(t.push("(e.time < ? OR (e.time = ? AND e.id < ?))"),i.push(a.before.time,a.before.time,a.before.id)),a.actorId!==void 0&&(t.push("e.actor_id = ?"),i.push(a.actorId)),a.type===void 0)t.push("e.type <> 'ping' AND e.type NOT LIKE 'tool.%'");else{let s=a.type.trim();if(s.length===0||s.length>$a||!za.test(s))throw new m("INVALID_EVENT_TYPE",`--type is an event type (member.joined), a prefix (member.*, app.crm.*) or *${s?` (not ${s})`:""}`);let o=ke(s);o?.op==="eq"?(t.push("e.type = ?"),i.push(o.value)):o&&(t.push("substr(e.type, 1, ?) = ?"),i.push(o.value.length,o.value))}a.since!==void 0&&(t.push("e.time >= ?"),i.push(a.since)),i.push(n+1);let[r=[]]=await e.db.run([{sql:`SELECT e.id, e.time, e.type, e.actor, e.actor_kind, e.actor_id, e.data, u.email AS user_email, u.name AS user_name
+FROM events e
+LEFT JOIN users u ON e.actor_kind = 'user' AND u.id = e.actor_id
+WHERE ${t.join(" AND ")}
+ORDER BY e.time DESC, e.id DESC LIMIT ?`,params:i}]),d=r.slice(0,n),l=d.at(-1);return{events:d.map(s=>{let o=ye(s.actor),u=p(s.actor_kind)??o.kind,b=p(s.actor_id)??o.id,S=u==="user"?{kind:u,id:b,email:p(s.user_email)??o.email,name:p(s.user_name)??o.name}:{kind:u,id:b,email:o.email,name:o.name},N={};try{N=JSON.parse(String(s.data))}catch{N={}}let A=String(s.type);return{id:String(s.id),time:_(s.time),type:A,label:Ie(A),actor:S,subject:ve(A,N),appEvent:Ce(A)}}),nextBefore:r.length>n&&l?{time:_(l.time),id:String(l.id)}:null}}var ga=`SELECT t.id, t.user_id, u.email, t.name, t.token_prefix, t.app_row_id, a.app_slug, a.name AS app_name,
+  t.scopes, t.created_at, t.expires_at, t.last_used_at, t.revoked_at
+FROM user_access_tokens t JOIN users u ON u.id = t.user_id
+LEFT JOIN apps a ON a.id = t.app_row_id AND a.organization_id = t.organization_id
+WHERE t.organization_id = ?1`;function Ea(e,a){let n=e.revoked_at==null?null:Number(e.revoked_at),t=_(e.expires_at),i=[];try{let r=JSON.parse(String(e.scopes??"[]"));i=Array.isArray(r)?r.map(String):[]}catch{i=[]}return{id:String(e.id),user:{id:String(e.user_id),email:String(e.email)},name:String(e.name),prefix:String(e.token_prefix),app:{rowId:p(e.app_row_id),slug:p(e.app_slug),name:p(e.app_name)},scopes:i,createdAt:_(e.created_at),expiresAt:t,lastUsedAt:e.last_used_at==null?null:Number(e.last_used_at),revokedAt:n,active:n===null&&t>a}}async function Pn(e,a){let[n=[]]=await e.db.run([{sql:`${ga}${a?" AND t.user_id = ?2":""} ORDER BY t.created_at DESC`,params:a?[e.organization.id,a]:[e.organization.id]}]);return n.map(t=>Ea(t,e.now))}async function xn(e,a){let[n=[]]=await e.db.run([{sql:`${ga} AND t.id = ?2`,params:[e.organization.id,a.trim()]}]),t=n[0];if(!t)throw new m("TOKEN_NOT_FOUND",`No personal access token ${a.trim()} in ${e.organization.name}`,{rerun:`${g} workspace tokens`,rerunNote:"lists them by id"});let i=Ea(t,e.now);return i.revokedAt!==null?{token:i,already:!0}:(await e.db.run([{sql:"UPDATE user_access_tokens SET revoked_at = ?3, updated_at = ?3 WHERE id = ?1 AND organization_id = ?2 AND revoked_at IS NULL",params:[i.id,e.organization.id,e.now]}]),{token:{...i,revokedAt:e.now,active:!1},already:!1})}var fa=`SELECT c.id, c.user_id, u.email, c.client_name, c.client_domain, c.redirect_host, c.app_scope, c.access,
+  c.created_at, c.last_used_at, c.revoked_at, c.revoked_reason,
+  (SELECT group_concat(a.app_slug, char(31)) FROM mcp_connection_apps ca JOIN apps a ON a.id = ca.app_row_id WHERE ca.connection_id = c.id) AS app_slugs
+FROM mcp_connections c JOIN users u ON u.id = c.user_id
+WHERE c.organization_id = ?1`;function ba(e){return{id:String(e.id),user:{id:String(e.user_id),email:String(e.email)},clientName:String(e.client_name),clientDomain:p(e.client_domain),redirectHost:String(e.redirect_host),apps:e.app_scope==="all"?"all":p(e.app_slugs)?.split("").sort()??[],access:e.access==="write"?"write":"read",createdAt:_(e.created_at),lastUsedAt:e.last_used_at==null?null:Number(e.last_used_at),revokedAt:e.revoked_at==null?null:Number(e.revoked_at),revokedReason:p(e.revoked_reason)}}async function Fn(e,a){let[n=[]]=await e.db.run([{sql:`${fa} AND c.revoked_at IS NULL${a?" AND c.user_id = ?2":""} ORDER BY c.created_at DESC`,params:a?[e.organization.id,a]:[e.organization.id]}]);return n.map(ba)}async function Hn(e,a){let[n=[]]=await e.db.run([{sql:`${fa} AND c.id = ?2`,params:[e.organization.id,a.trim()]}]),t=n[0];if(!t)throw new m("CONNECTION_NOT_FOUND",`No AI connection ${a.trim()} in ${e.organization.name}`,{rerun:`${g} workspace connections`,rerunNote:"lists them by id"});let i=ba(t);return i.revokedAt!==null?{connection:i,already:!0}:(await e.db.run([{sql:`UPDATE mcp_connections SET revoked_at = ?3, revoked_by = ?4, revoked_reason = 'user'
+WHERE id = ?1 AND organization_id = ?2 AND revoked_at IS NULL`,params:[i.id,e.organization.id,e.now,e.operator.userId]}]),{connection:{...i,revokedAt:e.now,revokedReason:"user"},already:!1})}export{We as a,ze as b,Ja as c,Va as d,Xa as e,Ka as f,un as g,Ze as h,pn as i,mn as j,z as k,Z as l,ta as m,_n as n,gn as o,En as p,fn as q,bn as r,An as s,Nn as t,Sn as u,Rn as v,Tn as w,On as x,hn as y,Cn as z,Dn as A,yn as B,Je as C,In as D,Ve as E,vn as F,kn as G,wa as H,wn as I,Xe as J,Mn as K,Ln as L,Wn as M,Ma as N,_a as O,zn as P,Wa as Q,$n as R,za as S,$a as T,Un as U,Pn as V,xn as W,Fn as X,Hn as Y};

package/dist/chunk-HHVABFYD.js

@@ -0,0 +1 @@
+import{a as d}from"./chunk-U4ATZJEU.js";import{Ub as g,pc as l}from"./chunk-NXO2BC3M.js";import y from"node:fs/promises";import u from"node:path";import{parseEnv as h}from"node:util";var i=".everyapp/secrets.env",o="POSTGRES_DATABASE_URL";async function U(e){let n;try{n=await y.readFile(u.join(e,i),"utf8")}catch(r){if(l(r))return{};throw r}d(e,`${u.dirname(i)}/`);let t={};for(let[r,s]of Object.entries(h(n)))s?.trim()&&(t[r]=s.trim());return t}function m(e){return`${e}_ORIGIN_URL`}function x(e,n){let t=m(e);return n===1?[o,t]:[t]}function L([e,...n]){return n.length>0?`${e} (or ${n.join(", ")})`:`${e}`}function O(e,n,t){let r=m(t);return e[r]?{url:e[r],variable:r}:(n.resources?.hyperdrive??[]).length===1&&e[o]?{url:e[o],variable:o}:null}var R={postgres:5432,postgresql:5432,mysql:3306};function _(e,n){let t=f=>new g("DATABASE_URL_INVALID",`${n} in ${i} ${f}`,{fix:"write it as postgres://<user>:<password>@<host>:<port>/<database>"}),r;try{r=new URL(e)}catch{throw t("isn't a URL")}let s=r.protocol.replace(/:$/,"");if(s!=="postgres"&&s!=="postgresql"&&s!=="mysql")throw t("isn't a postgres:// or mysql:// URL");let p=decodeURIComponent(r.pathname.replace(/^\//,"")),a=decodeURIComponent(r.username),c=decodeURIComponent(r.password);if(!r.hostname||!p||!a||!c)throw t("needs a host, a database, a user and a password");return{scheme:s,host:r.hostname,port:r.port?Number(r.port):R[s],database:p,user:a,password:c}}function I(e,n){let t=e;for(let r of n)r&&(t=t.split(r).join("***"));return t}export{i as a,o as b,U as c,m as d,x as e,L as f,O as g,_ as h,I as i};

package/dist/chunk-HT76NR3O.js

@@ -0,0 +1 @@
+import{B as S,Eb as v,Gb as T,Hb as q,Ib as Q,Jb as Z,Kb as k,Lb as ee,Pb as b,ha as u,ia as L,ja as B,ka as E,ma as N,oa as w,pa as K,qa as V,ra as G,sa as F,ta as H,ua as J,va as W,wa as j,xb as X,ya as O,yb as Y,zb as M}from"./chunk-NXO2BC3M.js";function de(e){if(!e)return null;try{let t=JSON.parse(e);return Array.isArray(t)&&t.every(r=>typeof r=="string")?t:null}catch{return null}}function le(e){return JSON.stringify([...new Set(e)].sort())}var D=class extends Error{constructor(r,n){super(`App "${r}" can't be routed: ${n}`);this.appId=r;this.name="UnroutableAppError"}};var U=class{byHostname=new Map;byAppId=new Map;byOrgApp=new Map;constructor(t=[]){for(let r of t)this.add(r)}add(t){this.byHostname.set(t.hostname.toLowerCase(),t),this.byAppId.set(t.appId,t),this.byOrgApp.set(te(t.organizationId,t.appId),t)}async findByHostname(t){return this.byHostname.get(t.toLowerCase())??null}async hasAnyActiveApp(){return Array.from(this.byAppId.values()).some(t=>t.status==="active")}async findByAppId(t){return this.byAppId.get(t)??null}async findByOrgApp(t,r){return this.byOrgApp.get(te(t,r))??null}};function te(e,t){return JSON.stringify([e,t])}var p="deleted",o=class extends Error{status;code;constructor({status:t,code:r,message:n}){super(n),this.name="RegistrationError",this.status=t,this.code=r}},ce=/^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/,ge=50;function ne(e){return e.toLowerCase().replace(/[^a-z0-9]/g,"").slice(0,b)||"org"}function ue(e){let t=ne(e);return Array.from({length:ge},(r,n)=>{let s=n===0?"":String(n+1);return`${t.slice(0,b-s.length)}${s}`})}function re(e,t){let r=e.trim().toLowerCase();if(!ce.test(r))throw new o({status:400,code:"INVALID_APP_HOSTNAME",message:`${t} must form a valid DNS label of at most 63 characters; received "${r}".`});return r}function se(e){let{appSlug:t,orgKey:r}=e;if(X(t))throw new o({status:400,code:"RESERVED_APP_ID",message:`The app id "${t}" is reserved for the platform.`});if(t.includes(T))throw new o({status:400,code:"INVALID_APP_ID",message:`App id "${t}" can't contain "${T}": it separates an app's Worker name from its resources' names. Choose another id.`});let n=e.existingApp?.workerName??q({appId:t,orgKey:r}),s=e.appBaseDomain.trim().toLowerCase().replace(/\.$/,""),i=e.existingApp?.hostname??`${e.isInstallOrganization?re(t,"The app id"):re(`${t}-${r}`,"The app id and organization key")}.${s}`;if(!Q({appId:t,orgKey:r,workerName:n}))throw new o({status:400,code:"INVALID_WORKER_NAME",message:n.length>v?`App id "${t}" is too long: its Worker name "${n}" would exceed ${v} characters.`:`App id "${t}" can't be registered: its Worker would be "${n}", which is reserved for the gateway or isn't the app's own.`});return{workerName:n,hostname:i}}function oe(e,t){let r;try{r=M(e)}catch(n){throw new o({status:400,code:"INVALID_MANIFEST",message:n instanceof Y?n.message:"Invalid manifest"})}if(r.id!==t)throw new o({status:400,code:"INVALID_MANIFEST",message:`manifest.id "${r.id}" does not match appId "${t}"`});return r}function C(e){if(!e)return null;try{return M(JSON.parse(e))}catch{return null}}function ie(e,t){let r=(n,s=Z)=>Object.fromEntries((n??[]).map(i=>[i,s(e,i)]));return{d1:r(t?.resources?.d1),kv:r(t?.resources?.kv),r2:r(t?.resources?.r2,ee)}}function me(e){return e.workerName?ie(e.workerName,C(e.manifest)):{d1:{},kv:{},r2:{}}}var Ae={d1:"D1 database",kv:"KV namespace",r2:"R2 bucket"},fe=/^[a-z0-9][a-z0-9-]*[a-z0-9]$/;function Re(e){for(let[t,r]of Object.entries(e)){let n=new Map;for(let[s,i]of Object.entries(r)){let a=n.get(i);if(a!==void 0)throw new o({status:400,code:"RESOURCE_NAME_CONFLICT",message:`Bindings ${a} and ${s} would share the ${Ae[t]} "${i}". Rename one of them in everyapp.config.ts.`});if(t==="r2"&&(i.length>k||!fe.test(i)))throw new o({status:400,code:"INVALID_MANIFEST",message:`resources.r2: ${s} would be the R2 bucket "${i}", which Cloudflare refuses (at most ${k} lowercase letters, digits and hyphens, starting and ending with a letter or digit). Rename the binding in everyapp.config.ts.`});n.set(i,s)}}}function Ie(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function ye(e,t,r,n){if(t==="shared")return{isDefault:!1,grants:[]};let s=r.access==="everyone";return{isDefault:s,grants:e.members.filter(i=>s||i.id===e.deployerUserId||Ie(i.role)).map(i=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:i.id,appRowId:n,grantedBy:null}))}}function we(e){let{existingApp:t}=e,r=e.scope??(t?.scope==="shared"?"shared":"org");if(t&&(t.organizationId!==e.organizationId||t.appSlug!==e.appSlug))throw new Error("existingApp is another organization's or app's row.");if(r==="shared"&&!e.isInstallOrganization)throw new o({status:403,code:"SHARED_APP_NOT_PLATFORM",message:`Only the platform organization registers shared apps; "${e.appSlug}" can't be shared from another organization.`});if(t&&t.scope!==r)throw new o({status:409,code:"APP_SCOPE_MISMATCH",message:t.scope==="shared"?`App "${e.appSlug}" is a shared app, not this organization's own. Deploy it without asking for another scope, or give the organization's own app an id of its own.`:`App "${e.appSlug}" is this organization's own app, not a shared one. Shared apps need an app id of their own.`});let n=e.tier??"service_binding";if(n==="dispatch"&&r==="shared")throw new o({status:400,code:"APP_TIER_MISMATCH",message:`A shared app is reached over a service binding; "${e.appSlug}" can't be deployed through the hosted deploy API.`});if(t&&t.tier!==n)throw new o({status:409,code:"APP_TIER_MISMATCH",message:t.tier===u?`"${e.appSlug}" is the Gateway's MCP app of that name${t.status===p?" (turned off)":""}; give this app an id of its own.`:t.tier==="dispatch"?`App "${e.appSlug}" is deployed through the hosted deploy API; deploy it the same way, or give this app an id of its own.`:`App "${e.appSlug}" is reached over a service binding, not deployed through the hosted deploy API; give the third-party app an id of its own.`});let s=se(e),i=oe(e.manifest,e.appSlug),{workerName:a,hostname:d}=s;for(let[A,_,pe]of[[e.hostnameOwner,"hostname",d],[e.workerNameOwner,"workerName",a]])if(A&&A[_]!==pe)throw new Error(`The ${_} owner passed holds another ${_}.`);let m=A=>A!==null&&(A.organizationId!==e.organizationId||A.appSlug!==e.appSlug);if(m(e.hostnameOwner))throw new o({status:409,code:"HOSTNAME_TAKEN",message:`The hostname "${d}" is already registered to another app on this gateway.`});if(m(e.workerNameOwner))throw new o({status:409,code:"WORKER_NAME_TAKEN",message:`The worker name "${a}" is already registered to another app on this gateway. Choose a different app id.`});let f=ie(a,i);Re(f);let y={organizationId:e.organizationId,name:e.name,description:e.description,hostname:d,workerName:a},l={previousManifest:C(t?.manifest??null),versionId:t?.versionId??null,resources:f};if(t&&t.status!==p)return{kind:"existing",app:{...t,...y},grants:[],...l};let R=t?.id??crypto.randomUUID(),{isDefault:c,grants:h}=ye(e,r,i,R),g={...y,manifest:JSON.stringify(i),status:"pending",isDefault:c};return t?{kind:"revived",app:{...t,...g},grants:h,...l}:{kind:"new",app:{id:R,appSlug:e.appSlug,tier:n,scope:r,versionId:null,deployedAt:null,deployedByActor:null,...g},grants:h,...l}}function he(e){if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`No app "${e.appSlug}" is registered for this organization.`});if(!e.workerName||!e.hostname&&e.tier!=="dispatch")throw new o({status:409,code:"APP_NOT_REGISTERED",message:`App "${e.appSlug}" has no Worker or hostname yet; deploy it again.`})}function Ee(e,{versionId:t,manifest:r,actor:n,now:s=Date.now()}){return he(e),{manifest:JSON.stringify(oe(r,e.appSlug)),versionId:t,deployedAt:s,deployedByActor:n,status:e.status==="pending"?"binding":e.status}}function P(e){return e.status===p?null:{status:p,isDefault:!1,emailSenders:null,emailInbound:null,secretNames:null}}function Me(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function I(e,t){throw new o({status:400,code:e,message:t})}function Pe(e,t){let r=t&&typeof t=="object"&&!Array.isArray(t)?t:{kind:t??"none"},n=r.kind,s=(n==="bearer"||n==="header"||n==="basic")&&r.secret===void 0?{...r,secret:K(e)}:r,i=H(s);return i.ok||I("REMOTE_MCP_INVALID",i.problem),i.auth}function $(e){if(e.tier!==u||!e.manifest)return!1;try{return j(JSON.parse(e.manifest))}catch{return!1}}function x(e){return e.tier===u}function z(e){if(e.tier!==u||!e.manifest)return null;try{return W(JSON.parse(e.manifest))}catch{return null}}function _e(e,t,r){if(r&&(r.organizationId!==e||r.appSlug!==t))throw new Error("existingApp is another organization's or app's row.")}function Se(e,t){if($(t))return;let r=t.tier===u?"the Gateway's built-in MCP app":`an app deployed to this Gateway${t.status===p?" (deleted, its names still its organization's)":""}`;throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e}" is ${r}; a remote MCP server can't take its id.`})}function Ne(e){let t=e.url.trim(),r=F(t,e.env);r&&I("REMOTE_MCP_URL_REFUSED",r);let n=(e.id??"").trim()||G(t);n||I("REMOTE_MCP_INVALID","no app id could be read from the URL's host; give one with --name");let s=V(n);s&&I("REMOTE_MCP_INVALID",s);let i=e.sharedApp?.(n);if(i&&i.status!==p)throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${n}" is a shared app every organization sees; a remote MCP server can't take its id.`});let a=e.existingApp(n);_e(e.organizationId,n,a);let d=(e.risk??"annotations").trim();w.includes(d)||I("REMOTE_MCP_INVALID",`risk must be one of ${w.join(", ")}`);let m=Pe(n,e.auth);if("secret"in m&&e.secretUsedAt){let g=e.secretUsedAt(m.secret),A=new URL(t).origin;if(g&&g!==A)throw new o({status:409,code:"REMOTE_MCP_SECRET_TAKEN",message:`${m.secret} is the credential of an MCP app at ${g}; a server at ${A} takes another name (--secret <NAME>_MCP_TOKEN).`})}let f=a?z(a)?.rev??0:0,y={url:t,auth:m,risk:d,tools:{},rev:f+1},l=O({id:n,name:e.name,description:e.description,remote:y});if(a&&((E(n)||!$(a))&&Se(n,a),a.status!==p))throw new o({status:409,code:"REMOTE_MCP_EXISTS",message:`"${n}" is an MCP app on this Gateway already (${a.status==="active"?"on":"off"}); remove it first, or change it in place.`});let R=a?.id??crypto.randomUUID(),c={id:R,organizationId:e.organizationId,appSlug:n,name:l.name,description:l.description,hostname:null,workerName:null,tier:u,scope:"org",manifest:JSON.stringify(l),status:"active",versionId:null,deployedAt:e.now,deployedByActor:e.actor,isDefault:!1},h=e.members.filter(g=>g.id===e.actorUserId||Me(g.role)).map(g=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:g.id,appRowId:R,grantedBy:null}));return{kind:a?"revived":"new",id:n,app:c,grants:h,remote:y}}function Oe(e,t){let r=z(e);if(!r)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" is not a remote MCP app.`});if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" was removed.`});let n=r.risk;t.risk!==void 0&&(w.includes(t.risk)||I("REMOTE_MCP_INVALID",`risk must be one of ${w.join(", ")}`),n=t.risk);let s={...r.tools};if(t.tools&&(s={...t.tools}),t.tool){let{name:l,override:R}=t.tool;if(l.trim()||I("REMOTE_MCP_INVALID","name the tool"),R===null)delete s[l];else{let c={...s[l],...R};c.risk===void 0&&delete c.risk,(c.enabled===void 0||c.enabled===!0)&&delete c.enabled,Object.keys(c).length===0?delete s[l]:s[l]=c}}let i=S({risk:n,tools:s})!==S({risk:r.risk,tools:r.tools}),a={...r,risk:n,tools:s,rev:i?r.rev+1:r.rev},d=J(a);d.ok||I("REMOTE_MCP_INVALID",d.problem);let m=JSON.parse(e.manifest??"{}"),f=O({id:e.appSlug,name:t.name===void 0?e.name:t.name,description:t.description===void 0?e.description:t.description,remote:a}),y={...m,...f};return{manifest:JSON.stringify(y),name:f.name,description:f.description,remote:a}}function ve(e,t){if(!x(e))throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e.appSlug}" is an app deployed to this Gateway, not an MCP app.`});if(e.status===p)throw new o({status:404,code:"APP_NOT_FOUND",message:`"${e.appSlug}" was removed; add it again.`});return e.status===t?null:{status:t}}function Te(e){return!e||!x(e)?null:P(e)}function ke(e){return(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()))}function ae(e){if(E(e))return e;throw new o({status:400,code:"PROVIDER_APP_UNKNOWN",message:`"${e}" is not an MCP app. The Gateway offers: ${B.join(", ")}.`})}function be(e,t){if(t.tier!==u)throw new o({status:409,code:"APP_TIER_MISMATCH",message:`"${e}" is an app deployed to this Gateway${t.status===p?" (deleted, its names still its organization's)":""}, not the MCP app; the MCP app can't take its id.`})}function De(e){let t=ae(e.id),{existingApp:r}=e;if(r&&(r.organizationId!==e.organizationId||r.appSlug!==t))throw new Error("existingApp is another organization's or app's row.");let n=L[t];if(r&&be(t,r),r&&r.status!==p)return{kind:"existing",app:{...r,name:n.name,description:n.description,manifest:JSON.stringify(N(t)),status:"active"},grants:[]};let s=r?.id??crypto.randomUUID(),i={id:s,organizationId:e.organizationId,appSlug:t,name:n.name,description:n.description,hostname:null,workerName:null,tier:u,scope:"org",manifest:JSON.stringify(N(t)),status:"active",versionId:null,deployedAt:e.now,deployedByActor:e.actor,isDefault:!1},a=e.members.filter(d=>d.id===e.actorUserId||ke(d.role)).map(d=>({id:crypto.randomUUID(),organizationId:e.organizationId,userId:d.id,appRowId:s,grantedBy:null}));return{kind:r?"revived":"new",app:i,grants:a}}export{de as a,le as b,D as c,U as d,p as e,o as f,ue as g,se as h,me as i,we as j,Ee as k,P as l,ae as m,De as n,$ as o,z as p,Ne as q,Oe as r,ve as s,Te as t};

package/dist/chunk-IWP4Q3KV.js

@@ -0,0 +1,15 @@
+import{Ub as o}from"./chunk-NXO2BC3M.js";var a=[{sql:`CREATE TABLE IF NOT EXISTS _everyapp_app_resources (
+  worker_name TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  binding TEXT NOT NULL,
+  name TEXT NOT NULL,
+  resource_id TEXT,
+  created_at INTEGER NOT NULL,
+  -- The Worker's row: the last version a deploy uploaded.
+  version_id TEXT,
+  PRIMARY KEY (worker_name, kind, binding)
+)`},{sql:"CREATE UNIQUE INDEX IF NOT EXISTS _everyapp_app_resources_id ON _everyapp_app_resources (kind, resource_id)"},{sql:"CREATE UNIQUE INDEX IF NOT EXISTS _everyapp_app_resources_name ON _everyapp_app_resources (kind, name)"}],t={worker:"Worker",d1:"D1 database",kv:"KV namespace",hyperdrive:"Hyperdrive config",vectorize:"Vectorize index","ai-gateway":"AI Gateway",r2:"R2 bucket","email-route":"Email Routing route for"};async function u(e,r){return((await e.run([...a,{sql:"SELECT kind, binding, name, resource_id, version_id FROM _everyapp_app_resources WHERE worker_name = ? ORDER BY kind, binding",params:[r]}])).at(-1)??[]).map(i=>({...s(i),versionId:i.version_id==null?null:String(i.version_id)}))}function s(e){return{kind:String(e.kind),binding:String(e.binding),name:String(e.name),resourceId:e.resource_id===null?null:String(e.resource_id)}}async function _(e,r){return((await e.run([...a,{sql:"SELECT worker_name, binding, name, resource_id FROM _everyapp_app_resources WHERE kind = ? ORDER BY worker_name, binding",params:[r]}])).at(-1)??[]).map(i=>({workerName:String(i.worker_name),...s({...i,kind:r})}))}async function E(e){let[r=[]]=await e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = '_everyapp_app_resources'"}]);if(r.length===0)return[];let[n=[]]=await e.run([{sql:"SELECT worker_name, kind, binding, name, resource_id FROM _everyapp_app_resources ORDER BY worker_name, kind, binding"}]);return n.map(i=>({workerName:String(i.worker_name),...s(i)}))}async function m(e,r,n,i=""){await e.run([...a,{sql:"UPDATE _everyapp_app_resources SET version_id = ? WHERE worker_name = ? AND kind = 'worker' AND binding = ?",params:[n,r,i]}])}async function R(e,r,n){try{await e.run([...a,{sql:`INSERT INTO _everyapp_app_resources (worker_name, kind, binding, name, resource_id, created_at)
+VALUES (?1, ?2, ?3, ?4, ?5, ?6)
+ON CONFLICT (worker_name, kind, binding) DO UPDATE SET name = excluded.name,
+  resource_id = excluded.resource_id`,params:[r,n.kind,n.binding,n.name,n.resourceId,Date.now()]}])}catch(i){throw c(i)?new o("RESOURCE_OWNED",`${d(n)} is recorded as another app's
+${r} can't use it.`,{fix:"rename the binding in everyapp.config.ts"}):i}}async function g(e,r,n){await e.run([...a,n?{sql:"DELETE FROM _everyapp_app_resources WHERE worker_name = ? AND kind = ? AND binding = ?",params:[r,n.kind,n.binding]}:{sql:"DELETE FROM _everyapp_app_resources WHERE worker_name = ?",params:[r]}])}function d({kind:e,name:r}){return`${t[e]} "${r}"`}function c(e){let r=e instanceof Error?e.message:"";return/UNIQUE constraint failed/i.test(r)}export{t as a,u as b,_ as c,E as d,m as e,R as f,g,d as h};

package/dist/{chunk-ZFCUH5PK.js → chunk-J2XKGQO7.js}

@@ -1,4 +1,4 @@
-import{b as I,d as R}from"./chunk-CCWBPAKH.js";import{k as C,l as b}from"./chunk-JYKRUS5C.js";import{Bb as g,Cb as d,Fb as p,Gb as y,Hb as m,Nb as w,Pb as v,bc as h,cc as k,d as f}from"./chunk-LYNBZ7RV.js";var P={perPage:100,maxPages:50};function O(e){return k(e,["workers","list"],b,P)}async function $(e,r){return((await O(e)).find(t=>t.name===r)?.references?.domains??[]).map(t=>t.hostname.toLowerCase())}async function l(e,r){let n;try{n=await h(e,{plane:"account",args:["workers","deployments","list","--worker",r,"--per-page","10"]},C)}catch(o){if(m(o,"not_found"))return null;throw o}let t=[...n].sort((o,i)=>(i.created_on??"").localeCompare(o.created_on??""))[0];return{versionId:[...t?.versions??[]].sort((o,i)=>i.percentage-o.percentage)[0]?.version_id??null,deployedAt:t?.created_on?Date.parse(t.created_on):null}}async function L(e,r,{withReferences:n=!1}={}){await e.run({plane:"account",mode:"json",args:["workers","delete",r,"--force",...n?["--delete-with-references"]:[]]})}var W=9e5;async function B(e){let r=e.secrets&&Object.keys(e.secrets).length>0?e.secrets:void 0,n=e.dryRun?null:await l(e.cf,e.workerName),t=!1,s=e.onUploaded&&!e.dryRun?v({async:()=>D(e,n,t)}):void 0;try{return await A(e,r,n,()=>{t=!0})}catch(o){throw s&&!w()&&await D(e,n,t).catch(i=>{e.out?.emit({type:"warning",code:"UPLOAD_UNRECORDED",step:e.step,message:`The version cf uploaded of ${e.workerName} couldn't be recorded
+import{b as I,d as R}from"./chunk-MLZJBYSY.js";import{k as C,l as b}from"./chunk-JT3R24Y7.js";import{Ub as g,Vb as d,Yb as p,Zb as y,_b as m,d as f,ec as w,gc as v,uc as h,vc as k}from"./chunk-NXO2BC3M.js";var P={perPage:100,maxPages:50};function O(e){return k(e,["workers","list"],b,P)}async function $(e,r){return((await O(e)).find(t=>t.name===r)?.references?.domains??[]).map(t=>t.hostname.toLowerCase())}async function l(e,r){let n;try{n=await h(e,{plane:"account",args:["workers","deployments","list","--worker",r,"--per-page","10"]},C)}catch(o){if(m(o,"not_found"))return null;throw o}let t=[...n].sort((o,i)=>(i.created_on??"").localeCompare(o.created_on??""))[0];return{versionId:[...t?.versions??[]].sort((o,i)=>i.percentage-o.percentage)[0]?.version_id??null,deployedAt:t?.created_on?Date.parse(t.created_on):null}}async function L(e,r,{withReferences:n=!1}={}){await e.run({plane:"account",mode:"json",args:["workers","delete",r,"--force",...n?["--delete-with-references"]:[]]})}var W=9e5;async function B(e){let r=e.secrets&&Object.keys(e.secrets).length>0?e.secrets:void 0,n=e.dryRun?null:await l(e.cf,e.workerName),t=!1,s=e.onUploaded&&!e.dryRun?v({async:()=>D(e,n,t)}):void 0;try{return await A(e,r,n,()=>{t=!0})}catch(o){throw s&&!w()&&await D(e,n,t).catch(i=>{e.out?.emit({type:"warning",code:"UPLOAD_UNRECORDED",step:e.step,message:`The version cf uploaded of ${e.workerName} couldn't be recorded
 ${p(i)}`,data:{workerName:e.workerName,error:p(i)}})}),o}finally{w()||s?.()}}async function D(e,r,n){let t=await l(e.cf,e.workerName);t?.versionId&&t.versionId!==r?.versionId&&await e.onUploaded?.(t.versionId,n)}async function A(e,r,n,t){let s=e.interactive&&e.attach&&!e.dryRun,o=u=>e.cf.run({plane:"project",cwd:e.cwd,cliCf:e.cliCf,mode:u,timeoutMs:W,...r?{files:{"secrets.json":r}}:{},args:c=>["deploy","--prebuilt","--mode","production","--message",e.message,...e.buildOutputWorker?["--worker",e.buildOutputWorker]:[],...r?["--secrets-file",c["secrets.json"]]:[],...e.dryRun?["--dry-run"]:[]]}),i;try{i=(await o(s?"interactive":"text").catch(c=>{if(e.interactive&&m(c,"strict_conflict"))return o("interactive");throw c})).stdout}catch(u){throw N(u,e)}if(t(),e.dryRun)return{versionId:null,output:i};let a=await l(e.cf,e.workerName);if(!a?.versionId||a.versionId===n?.versionId)throw new g("DEPLOY_NOT_UPLOADED",`cf finished without uploading a new version of ${e.workerName}
 Was one of its questions answered no? The version that was serving still is.`,{rerun:f(),rerunNote:"to deploy again"});return await e.onUploaded?.(a.versionId,!0),{versionId:a.versionId,output:i}}async function G({cf:e,workerName:r,shownAs:n,recordedVersionIds:t,interactive:s,confirm:o=I,change:i}){let a=await l(e,r);if(a&&!(a.versionId&&t.includes(a.versionId))){if(!s)throw new d("rerun_interactive",`${_(n)} was changed outside everyapp; confirm in a terminal
 Its live version wasn't deployed by everyapp, and Cloudflare won't replace it unattended. Nothing changed.`,void 0,{rerun:f([],{terminal:!0}),rerunNote:"in a terminal",data:{workerName:r,versionId:a.versionId,needsTerminal:!0}});await R(o,i.question,{context:[`${_(n)}'s live version wasn't deployed by everyapp (dashboard, API, or an interrupted deploy).`,[i.effect,"Cloudflare may ask to confirm again."].filter(Boolean).join(" ")]})}}function E(e){return`https://dash.cloudflare.com/${e}/workers/plans`}var _=e=>e.replace(/^the /,"The ");function N(e,{workerName:r,accountId:n}){return e instanceof y?e.kind==="strict_conflict"?new d("rerun_interactive",`${r} was changed outside everyapp; confirm in a terminal

package/dist/{chunk-OP4DYXYI.js → chunk-JBTV62V7.js}

@@ -1,2 +1,2 @@
-import{q as d}from"./chunk-JYKRUS5C.js";import{Fb as u,Hb as l,cc as p}from"./chunk-LYNBZ7RV.js";var P=50,y=20;function g(t,r,e={}){return p(t,["ssl","certificate-packs","list","-z",r,...e.allStatuses?["--status","all"]:[]],d,{perPage:P,maxPages:y})}function m(t){return!t.status||t.status==="active"}function C(t){return(t.hosts??[]).map(r=>r.toLowerCase())}function w(t,r){let e=t.toLowerCase();if(e===r)return!0;if(!e.startsWith("*."))return!1;let[,...i]=r.split(".");return i.join(".")===e.slice(2)}async function b(t,r,e){let i=(await g(t,r)).filter(m);return e.map(o=>({host:o,ready:i.some(s=>(s.hosts??[]).some(n=>w(n,o.toLowerCase())))}))}function v(t,r){let e=r.toLowerCase(),i=new Set([e,`*.${e}`]),o=[...t],s=[];for(let n of t){if(n.type==="universal")continue;let a=C(n);if(!a.includes(e))continue;let f=o.filter(c=>c!==n&&m(c));a.every(c=>i.has(c)||f.some(k=>C(k).includes(c)))&&(o.splice(o.indexOf(n),1),s.push(n))}return s}var S=new Set(["pending_deletion","deleted","pending_cleanup"]);function R(t,r){let e=t.find(i=>i.id===r);return!e||S.has((e.status??"").toLowerCase())}async function h(t,r,e){await t.run({plane:"account",mode:"json",args:["ssl","certificate-packs","delete",e,"-z",r,"--force"]})}async function T({cf:t,out:r,zoneId:e,hostname:i}){let o="app.certificate",s=[];try{let n=v(await g(t,e),i);for(let a of n)try{await h(t,e,a.id),s.push(a.id)}catch(f){if(!l(f,"not_found"))throw f}}catch(n){return r.emit({type:"warning",code:"CERT_CLEANUP_FAILED",step:o,message:[`Couldn't remove ${i}'s certificate`,`It serves nothing now. Cloudflare said: ${u(n)}.`,"Optional: delete it in the Cloudflare dashboard (SSL/TLS \u2192 Edge Certificates)."].join(`
+import{q as d}from"./chunk-JT3R24Y7.js";import{Yb as u,_b as l,vc as p}from"./chunk-NXO2BC3M.js";var P=50,y=20;function g(t,r,e={}){return p(t,["ssl","certificate-packs","list","-z",r,...e.allStatuses?["--status","all"]:[]],d,{perPage:P,maxPages:y})}function m(t){return!t.status||t.status==="active"}function C(t){return(t.hosts??[]).map(r=>r.toLowerCase())}function w(t,r){let e=t.toLowerCase();if(e===r)return!0;if(!e.startsWith("*."))return!1;let[,...i]=r.split(".");return i.join(".")===e.slice(2)}async function b(t,r,e){let i=(await g(t,r)).filter(m);return e.map(o=>({host:o,ready:i.some(s=>(s.hosts??[]).some(n=>w(n,o.toLowerCase())))}))}function v(t,r){let e=r.toLowerCase(),i=new Set([e,`*.${e}`]),o=[...t],s=[];for(let n of t){if(n.type==="universal")continue;let a=C(n);if(!a.includes(e))continue;let f=o.filter(c=>c!==n&&m(c));a.every(c=>i.has(c)||f.some(k=>C(k).includes(c)))&&(o.splice(o.indexOf(n),1),s.push(n))}return s}var S=new Set(["pending_deletion","deleted","pending_cleanup"]);function R(t,r){let e=t.find(i=>i.id===r);return!e||S.has((e.status??"").toLowerCase())}async function h(t,r,e){await t.run({plane:"account",mode:"json",args:["ssl","certificate-packs","delete",e,"-z",r,"--force"]})}async function T({cf:t,out:r,zoneId:e,hostname:i}){let o="app.certificate",s=[];try{let n=v(await g(t,e),i);for(let a of n)try{await h(t,e,a.id),s.push(a.id)}catch(f){if(!l(f,"not_found"))throw f}}catch(n){return r.emit({type:"warning",code:"CERT_CLEANUP_FAILED",step:o,message:[`Couldn't remove ${i}'s certificate`,`It serves nothing now. Cloudflare said: ${u(n)}.`,"Optional: delete it in the Cloudflare dashboard (SSL/TLS \u2192 Edge Certificates)."].join(`
 `)}),s}return s.length>0&&r.emit({type:"step",step:o,status:"ok",message:`Removed ${i}'s certificate.`,data:{hostname:i,certificatePacks:s}}),s}export{g as a,b,v as c,R as d,h as e,T as f};

package/dist/chunk-JT3R24Y7.js

@@ -0,0 +1 @@
+import{z as t}from"zod";var p=t.array(t.looseObject({name:t.string(),status:t.string()})),g=t.looseObject({authenticated:t.boolean(),authSource:t.string().nullish(),tokenValid:t.boolean().nullish(),email:t.string().nullish(),accounts:t.array(t.looseObject({id:t.string(),name:t.string().nullish()})).nullish()}),n=t.looseObject({uuid:t.string(),name:t.string()}),O=t.array(n),h=t.array(t.looseObject({Name:t.string()})),r=t.looseObject({duration:t.number().nullish(),changes:t.number().nullish()}).nullish(),y=t.array(t.looseObject({results:t.array(t.record(t.string(),t.unknown())).nullish(),success:t.boolean().nullish(),meta:r})),b=t.looseObject({bookmark:t.string()}),m=t.looseObject({previous_bookmark:t.string().nullish()}),o=t.looseObject({id:t.string(),title:t.string()}),d=t.array(o),s=t.looseObject({id:t.string().nullish(),created_on:t.string().nullish(),versions:t.array(t.looseObject({version_id:t.string(),percentage:t.number()}))}),x=t.union([t.looseObject({deployments:t.array(s)}),t.array(s)]).transform(e=>Array.isArray(e)?e:e.deployments),j=t.array(t.looseObject({id:t.string().nullish(),name:t.string(),references:t.looseObject({domains:t.array(t.looseObject({id:t.string().nullish(),hostname:t.string(),zone_id:t.string().nullish(),zone_name:t.string().nullish()})).nullish()}).nullish()})),f=t.looseObject({buckets:t.array(t.looseObject({name:t.string()})).nullish()}).transform(e=>e.buckets??[]),k=t.union([t.looseObject({result:t.array(t.looseObject({name:t.string()}))}),t.array(t.looseObject({name:t.string()}))]).transform(e=>Array.isArray(e)?e:e.result),L=t.array(t.looseObject({id:t.string(),name:t.string(),status:t.string().nullish()})),D=t.array(t.looseObject({id:t.string(),name:t.string(),type:t.string(),content:t.string().nullish()})),z=t.array(t.looseObject({id:t.string(),type:t.string().nullish(),hosts:t.array(t.string()).nullish(),status:t.string().nullish()})),i=t.looseObject({name:t.string(),script_name:t.string().nullish(),class_name:t.string().nullish(),instances:t.record(t.string(),t.number()).nullish()}),w=t.array(i),W=t.array(t.looseObject({results:t.looseObject({columns:t.array(t.string()).nullish(),rows:t.array(t.array(t.unknown())).nullish()}).nullish(),meta:r})),l=t.looseObject({id:t.string(),name:t.string(),origin:t.looseObject({host:t.string().nullish(),port:t.number().nullish(),database:t.string().nullish(),user:t.string().nullish(),scheme:t.string().nullish()}).nullish(),caching:t.looseObject({disabled:t.boolean().nullish()}).nullish()}),_=t.array(l),u=t.looseObject({name:t.string(),config:t.looseObject({dimensions:t.number().nullish(),metric:t.string().nullish(),preset:t.string().nullish()}).nullish(),created_on:t.string().nullish()}),A=t.array(u),a=t.looseObject({id:t.string(),collect_logs:t.boolean().nullish(),cache_ttl:t.number().nullish(),authentication:t.boolean().nullish()}),C=t.array(a);export{p as a,g as b,n as c,O as d,h as e,y as f,b as g,m as h,o as i,d as j,x as k,j as l,f as m,k as n,L as o,D as p,z as q,i as r,w as s,W as t,l as u,_ as v,u as w,A as x,a as y,C as z};

package/dist/{chunk-ZEXVHB22.js → chunk-KS7DIYIJ.js}

@@ -1,2 +1,2 @@
-import{a as E,b as v}from"./chunk-CZTEDWZ2.js";import{a as A}from"./chunk-H6QQMY7B.js";import{a as y}from"./chunk-CCWBPAKH.js";import{c as a,kc as f,oc as w,wc as g}from"./chunk-LYNBZ7RV.js";import I from"chalk";async function N(t){await S(t,(e,o)=>v(t,e,o))}async function S(t,e){let o=Date.now();await g(t,async n=>{let r=A({out:n,verbose:t.verbose}),i=await e(n,E({gateway:{openRelease:r.open,source:r.describe},interactive:y(t.json??!1)}));_(n,i,o)})}function _(t,e,o){let{gatewayUrl:n,organizationName:r,release:i,releaseName:p,owner:c,mode:d}=e,l=`${n}/admin`,s={gatewayUrl:n,adminUrl:l,organizationName:r,owner:c,release:i,mode:d,gateway:e.gateway,accessOn:e.accessOn},m={label:"Gateway",value:n},u=e.accessOn?[{label:"Access",value:"on",note:"everyone signs in through Cloudflare Access first"}]:[];if(e.gateway==="upgraded"&&!e.ownerCreated){t.emit({type:"done",message:`Upgraded to ${p}`,data:s,display:[...w([{label:"Gateway",value:I.cyan(n)}]),I.dim(`Upgraded to ${p} in ${f(Date.now()-o)}`)].join(`
+import{a as E,b as v}from"./chunk-SMCUCFS4.js";import{a as A}from"./chunk-ZH6IAPVK.js";import{a as y}from"./chunk-MLZJBYSY.js";import{Dc as f,Hc as w,Pc as g,c as a}from"./chunk-NXO2BC3M.js";import I from"chalk";async function N(t){await S(t,(e,o)=>v(t,e,o))}async function S(t,e){let o=Date.now();await g(t,async n=>{let r=A({out:n,verbose:t.verbose}),i=await e(n,E({gateway:{openRelease:r.open,source:r.describe},interactive:y(t.json??!1)}));_(n,i,o)})}function _(t,e,o){let{gatewayUrl:n,organizationName:r,release:i,releaseName:p,owner:c,mode:d}=e,l=`${n}/admin`,s={gatewayUrl:n,adminUrl:l,organizationName:r,owner:c,release:i,mode:d,gateway:e.gateway,accessOn:e.accessOn},m={label:"Gateway",value:n},u=e.accessOn?[{label:"Access",value:"on",note:"everyone signs in through Cloudflare Access first"}]:[];if(e.gateway==="upgraded"&&!e.ownerCreated){t.emit({type:"done",message:`Upgraded to ${p}`,data:s,display:[...w([{label:"Gateway",value:I.cyan(n)}]),I.dim(`Upgraded to ${p} in ${f(Date.now()-o)}`)].join(`
 `)});return}if(!c){t.emit({type:"done",data:{...s,facts:[m]}});return}if(e.gateway==="installed"||e.ownerCreated){t.emit({type:"done",data:{...s,facts:[m,{label:"Admin",value:l,note:"invite people, choose who opens which app"},...u],next:O(d,e.accessOn===!0)}});return}t.emit({type:"done",data:{...s,facts:[m,...u],...e.gateway==="up-to-date"?{next:[{command:`${a} status`,note:"see apps, domains and certificates"}]}:{}}})}function O(t,e){return t==="hosted"?[{command:`${a} create my-app`,note:"start your first app"},{command:`${a} secret set OPENAI_API_KEY`,note:"turn on AI for apps"},{command:`${a} secret set EMAIL_FROM EMAIL_FROM_NAME`,note:"email invites; needs Cloudflare Email Sending"}]:[{command:`${a} create my-app`,note:"start your first app"},...e?[]:[{command:`${a} access on`,note:"put Cloudflare Access in front of your Gateway (recommended)"}],{command:`${a} secret set OPENAI_API_KEY`,note:"AI for apps (or OPENROUTER_API_KEY, WORKERS_AI_API_TOKEN)"},{command:`${a} secret set EMAIL_FROM EMAIL_FROM_NAME`,note:"email invites and password resets; needs Cloudflare Email Sending"}]}export{N as a,S as b,_ as c};

package/dist/{chunk-H7PDL3X5.js → chunk-KTX5YGBL.js}

@@ -1 +1 @@
-import{Bb as s,Yb as e,nb as o}from"./chunk-LYNBZ7RV.js";import p from"node:fs/promises";import a from"node:path";import{pathToFileURL as c}from"node:url";import{createJiti as m}from"jiti";async function y(r){return g(a.join(r,"everyapp.config.ts"),{message:"No everyapp.config.ts in this directory",fix:"run this from the app's directory"})}async function w(r){try{await p.access(a.join(r,"everyapp.config.ts"))}catch(i){if(e(i))return null;throw i}return y(r)}async function g(r,i={message:`No manifest at ${r}`}){try{await p.access(r)}catch(n){throw e(n)?new s("MANIFEST_NOT_FOUND",i.message,{fix:i.fix}):n}let f=await m(c(r).href).import(r,{default:!0});return o(f,l)}var l={unknownCapabilities:"accept"};function h(r,i){let t=i?.binding??r[0];if(!r.includes(t))throw new Error(`Manifest migrations binding "${t}" is not declared in resources.d1.`);return t}function N(r){return r.migrations?.dir??"drizzle"}export{y as a,w as b,g as c,l as d,h as e,N as f};
+import{Ab as o,Ub as s,pc as e}from"./chunk-NXO2BC3M.js";import p from"node:fs/promises";import a from"node:path";import{pathToFileURL as c}from"node:url";import{createJiti as m}from"jiti";async function y(r){return g(a.join(r,"everyapp.config.ts"),{message:"No everyapp.config.ts in this directory",fix:"run this from the app's directory"})}async function w(r){try{await p.access(a.join(r,"everyapp.config.ts"))}catch(i){if(e(i))return null;throw i}return y(r)}async function g(r,i={message:`No manifest at ${r}`}){try{await p.access(r)}catch(n){throw e(n)?new s("MANIFEST_NOT_FOUND",i.message,{fix:i.fix}):n}let f=await m(c(r).href).import(r,{default:!0});return o(f,l)}var l={unknownCapabilities:"accept"};function h(r,i){let t=i?.binding??r[0];if(!r.includes(t))throw new Error(`Manifest migrations binding "${t}" is not declared in resources.d1.`);return t}function N(r){return r.migrations?.dir??"drizzle"}export{y as a,w as b,g as c,l as d,h as e,N as f};

package/dist/{chunk-J35DDCNU.js → chunk-LKI3XV7I.js}

@@ -1 +1 @@
-import{Xb as e}from"./chunk-LYNBZ7RV.js";import t from"node:path";var n=".cloudflare/types/index.d.ts";async function p(r,o){await r.run({args:["workers","types"],plane:"project",cwd:o,mode:"text"})}async function a(r){return e(t.join(r,n))}export{p as a,a as b};
+import{oc as e}from"./chunk-NXO2BC3M.js";import t from"node:path";var n=".cloudflare/types/index.d.ts";async function p(r,o){await r.run({args:["workers","types"],plane:"project",cwd:o,mode:"text"})}async function a(r){return e(t.join(r,n))}export{p as a,a as b};

package/dist/{chunk-T2GD7RHS.js → chunk-LTMQP62I.js}

@@ -1,4 +1,4 @@
-import{e as A,h as d}from"./chunk-CCWBPAKH.js";import{b as L}from"./chunk-JYKRUS5C.js";import{Bb as u,Cb as s,Fb as h,Jb as C,bc as p,c,d as g,jc as E}from"./chunk-LYNBZ7RV.js";import f from"chalk";var O=null;async function _(o){let t=await p(o,{plane:"account",args:["auth","whoami"]},L);return O=t.authenticated&&!process.env.CLOUDFLARE_API_TOKEN?t.email??null:null,t}function x(){return O}var m=5*60*1e3;function F(o,t){return i=>o.emit({type:"action_required",action:"cloudflare_login",step:t,message:"Log in to Cloudflare: open this link and enter the code",data:{url:i.url,code:i.code,expiresAt:new Date(Date.now()+m).toISOString(),waiting:!0,waitingFor:"Cloudflare login"}})}async function S(o){let t=await _(o.cf);return t.authenticated?t:w(o)}async function w({cf:o,interactive:t,onDeviceLogin:i}){if(process.env.CLOUDFLARE_API_TOKEN)throw new u("CLOUDFLARE_TOKEN_REJECTED",`Cloudflare didn't accept CLOUDFLARE_API_TOKEN
+import{e as A,h as d}from"./chunk-MLZJBYSY.js";import{b as L}from"./chunk-JT3R24Y7.js";import{Cc as E,Ub as u,Vb as s,Yb as h,ac as C,c,d as g,uc as p}from"./chunk-NXO2BC3M.js";import f from"chalk";var O=null;async function _(o){let t=await p(o,{plane:"account",args:["auth","whoami"]},L);return O=t.authenticated&&!process.env.CLOUDFLARE_API_TOKEN?t.email??null:null,t}function x(){return O}var m=5*60*1e3;function F(o,t){return i=>o.emit({type:"action_required",action:"cloudflare_login",step:t,message:"Log in to Cloudflare: open this link and enter the code",data:{url:i.url,code:i.code,expiresAt:new Date(Date.now()+m).toISOString(),waiting:!0,waitingFor:"Cloudflare login"}})}async function S(o){let t=await _(o.cf);return t.authenticated?t:w(o)}async function w({cf:o,interactive:t,onDeviceLogin:i}){if(process.env.CLOUDFLARE_API_TOKEN)throw new u("CLOUDFLARE_TOKEN_REJECTED",`Cloudflare didn't accept CLOUDFLARE_API_TOKEN
 It may be mistyped, expired or revoked.
 A token needs Account \u203A Workers Scripts \u203A Edit, Account \u203A D1 \u203A Edit, Account \u203A Workers KV Storage \u203A Edit, Zone \u203A Zone \u203A Read and Zone \u203A DNS \u203A Read: https://dash.cloudflare.com/profile/api-tokens`,{fix:`set a valid token, or unset CLOUDFLARE_API_TOKEN and run ${c} login`});if(t)d(`${f.cyan("\u2192")} Log in to Cloudflare to continue
 ${f.dim("  Starting Cloudflare's login. Open its link and enter the code.")}`),await o.run({plane:"account",mode:"interactive",args:["auth","login"]});else if(i)await D(o,i);else throw new s("cloudflare_login",`Log in to Cloudflare with ${c} login

package/dist/{chunk-WOVS3GV5.js → chunk-LTYAIGEB.js}

@@ -1,10 +1,10 @@
-import{$ as C,B as U,Z as D,na as P,y as L}from"./chunk-RMF4YGD6.js";import{Bb as i,D as h,E as _,Za as E,_a as N,ab as T,bb as O,c as w,cb as $,d as R,db as A,k as m,za as S}from"./chunk-LYNBZ7RV.js";var V=new WeakMap;function b(t){let e=V.get(t);return e||(e=t.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'providers'"}]).then(([a=[]])=>a.length>0),V.set(t,e)),e}async function f(t){if(!await b(t))return[];let[e=[]]=await t.run([{sql:"SELECT id, spec, added_by, added_at, bound_to FROM providers ORDER BY added_at, id"}]);return e.map(a=>({id:String(a.id),spec:String(a.spec),addedBy:D(a.added_by),addedAt:a.added_at==null?null:Number(a.added_at),boundTo:D(a.bound_to)}))}function x(t){return e=>O(e,{gatewayHost:t.gatewayHost,appBaseDomain:t.appBaseDomain})}function I(t,e){return A(t,{refuseHost:x(e)})}async function Q(t,e){return I(await f(t),e)}function F(t,e){return t.rows().filter(a=>h(a.capability).some(r=>e.includes(r)))}function G(){return new i("GATEWAY_OUTDATED",`This Gateway predates the provider registry
+import{C as U,_ as D,aa as C,oa as P,y as L}from"./chunk-OHDR7JWQ.js";import{D as h,E as _,Ea as S,Pa as E,Qa as N,Ub as i,c as w,d as R,k as m,nb as T,ob as O,pb as $,qb as A}from"./chunk-NXO2BC3M.js";var V=new WeakMap;function b(t){let e=V.get(t);return e||(e=t.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'providers'"}]).then(([a=[]])=>a.length>0),V.set(t,e)),e}async function f(t){if(!await b(t))return[];let[e=[]]=await t.run([{sql:"SELECT id, spec, added_by, added_at, bound_to FROM providers ORDER BY added_at, id"}]);return e.map(a=>({id:String(a.id),spec:String(a.spec),addedBy:D(a.added_by),addedAt:a.added_at==null?null:Number(a.added_at),boundTo:D(a.bound_to)}))}function x(t){return e=>O(e,{gatewayHost:t.gatewayHost,appBaseDomain:t.appBaseDomain})}function I(t,e){return A(t,{refuseHost:x(e)})}async function Q(t,e){return I(await f(t),e)}function F(t,e){return t.rows().filter(a=>h(a.capability).some(r=>e.includes(r)))}function G(){return new i("GATEWAY_OUTDATED",`This Gateway predates the provider registry
 Its database has no providers table until the Gateway is updated. Nothing was changed.`,{rerun:`${w} update`,rerunNote:"then run this again"})}function M(t){return t==="everyapp"||_.includes(t)}async function Z(t,e){let a=E(e.spec);if(!a.ok)throw new i("PROVIDER_SPEC_INVALID",`The spec isn't one this Gateway takes
 ${N(a.problems)}`,{fix:"fix each field named above, then add it again"});let{id:r,capability:n}=a;if(!await b(t))throw G();let c=await f(t),s=I(c.filter(p=>p.id!==r),e.install),o=$(r,n,{rowSettings:new Set(s.rows().flatMap(p=>h(p.capability))),refuseHost:x(e.install)});if(o)switch(o.code){case"PROVIDER_BUILTIN":throw new i("PROVIDER_BUILTIN",`${r} is built in
 A registered provider can't take a built-in provider's id.`,{fix:`give the provider another id in its spec; ${w} provider show ${r} prints the built-in one`});case"PROVIDER_SECRET_TAKEN":throw new i("PROVIDER_SECRET_TAKEN",`${r} can't use that setting: ${o.message}`,{fix:`name the provider's settings after its id, ${r.toUpperCase().replace(/-/g,"_")}_\u2026, and none another provider or the Gateway reads`});case"PROVIDER_HOST_REFUSED":throw new i("PROVIDER_HOST_REFUSED",`${r}'s key can't be sent there: ${o.message}`,{fix:"list only the provider's own public API hosts under hosts"});default:throw new i("PROVIDER_SPEC_INVALID",`The spec isn't one this Gateway takes
-${o.message}`,{fix:"fix the spec, then add it again"})}let l=h(n);for(let p of await P(t)){if(!p.manifest)continue;let q=S(p.manifest).map(v=>v.toUpperCase()),g=l.filter(v=>q.includes(v));if(g.length>0)throw new i("PROVIDER_SECRET_TAKEN",`${m(g)} ${g.length===1?"is":"are"} ${p.appSlug}'s own secret
+${o.message}`,{fix:"fix the spec, then add it again"})}let l=h(n);for(let p of await P(t)){if(!p.manifest)continue;let q=S(p.manifest).map(y=>y.toUpperCase()),g=l.filter(y=>q.includes(y));if(g.length>0)throw new i("PROVIDER_SECRET_TAKEN",`${m(g)} ${g.length===1?"is":"are"} ${p.appSlug}'s own secret
 ${p.appSlug}'s deployed manifest lists ${g.length===1?"it":"them"} under secrets, so a provider can't read ${g.length===1?"it":"them"} from the Gateway.`,{fix:`name the provider's settings otherwise, or drop ${m(g)} from ${p.appSlug}'s secrets and deploy it again`})}let u=c.find(p=>p.id===r);if(u&&!e.replace)throw new i("PROVIDER_EXISTS",`${r} is registered on this Gateway already
-Replacing it writes the new spec; its key must then be set again before the Gateway sends it.`,{rerun:R(["--replace"]),rerunNote:"replaces it",authorize:!0});let d=e.now??Date.now(),y=JSON.stringify(e.spec),k=await H(t,"provider.added",{id:r,name:n.label},e.deployer,d,{sql:"EXISTS (SELECT 1 FROM providers WHERE id = ? AND spec = ? AND updated_at = ?)",params:[r,y,d]}),[B=[]]=await t.run([u?{sql:"UPDATE providers SET spec = ?, updated_at = ?, bound_to = NULL, bound_at = NULL WHERE id = ? RETURNING id",params:[y,d,r]}:{sql:`INSERT INTO providers (id, spec, added_by, added_at, updated_at, bound_to, bound_at)
-VALUES (?1, ?2, ?3, ?4, ?4, NULL, NULL) ON CONFLICT(id) DO NOTHING RETURNING id`,params:[r,y,e.deployer.actor,d]},...k]);if(B.length===0)throw new i("PROVIDER_EXISTS",`${r} changed on this Gateway while this ran`,{rerun:`${w} provider list`,rerunNote:"shows it as it is now"});return{id:r,capability:n,replaced:!!u}}async function ee(t,e,a,{force:r=!1,now:n=Date.now()}={}){if(M(e))throw new i("PROVIDER_BUILTIN",`${e} is built in
+Replacing it writes the new spec; its key must then be set again before the Gateway sends it.`,{rerun:R(["--replace"]),rerunNote:"replaces it",authorize:!0});let d=e.now??Date.now(),v=JSON.stringify(e.spec),k=await H(t,"provider.added",{id:r,name:n.label},e.deployer,d,{sql:"EXISTS (SELECT 1 FROM providers WHERE id = ? AND spec = ? AND updated_at = ?)",params:[r,v,d]}),[B=[]]=await t.run([u?{sql:"UPDATE providers SET spec = ?, updated_at = ?, bound_to = NULL, bound_at = NULL WHERE id = ? RETURNING id",params:[v,d,r]}:{sql:`INSERT INTO providers (id, spec, added_by, added_at, updated_at, bound_to, bound_at)
+VALUES (?1, ?2, ?3, ?4, ?4, NULL, NULL) ON CONFLICT(id) DO NOTHING RETURNING id`,params:[r,v,e.deployer.actor,d]},...k]);if(B.length===0)throw new i("PROVIDER_EXISTS",`${r} changed on this Gateway while this ran`,{rerun:`${w} provider list`,rerunNote:"shows it as it is now"});return{id:r,capability:n,replaced:!!u}}async function ee(t,e,a,{force:r=!1,now:n=Date.now()}={}){if(M(e))throw new i("PROVIDER_BUILTIN",`${e} is built in
 Only a provider registered with ${w} provider add can be removed.`,{rerun:`${w} provider list`,rerunNote:"shows which are registered"});if(!await b(t))throw G();let c=(await f(t)).find(d=>d.id===e);if(!c)throw new i("PROVIDER_NOT_FOUND",`No provider ${e} is registered on this Gateway`,{rerun:`${w} provider list`,rerunNote:"shows which are"});let s=E(W(c.spec)),o=(await P(t)).filter(d=>d.manifest?.capabilities&&Object.hasOwn(d.manifest.capabilities,e)).map(d=>d.appSlug);if(o.length>0&&!r)throw new i("PROVIDER_IN_USE",`${m(o)} ${o.length===1?"lists":"list"} ${e} under capabilities
 Removing it stops ${o.length===1?"its":"their"} calls to it at once: the Gateway answers that it doesn't offer ${e}.`,{rerun:R(["--force"]),rerunNote:"removes it anyway",authorize:!0});let l=s.ok?s.capability.label:e,u=await H(t,"provider.removed",{id:e,name:l},a,n,{sql:"EXISTS (SELECT 1 FROM providers WHERE id = ?)",params:[e]});return await t.run([...u,{sql:"DELETE FROM providers WHERE id = ?",params:[e]}]),{id:e,name:l,settings:s.ok?[...h(s.capability)]:[],apps:o}}async function H(t,e,a,r,n,c){let s=await C(t);return s?U(t,{organizationId:s.organization.id,type:e,actor:L(r),data:{provider:{id:a.id,name:a.name}},onlyIf:c,now:n}):[]}function W(t){try{return JSON.parse(t)}catch{return null}}async function te(t,e,a,r=Date.now()){let n=await f(t);if(n.length===0)return[];let c=I(n,e),s=F(c,a);return s.length===0?[]:(await t.run(s.map(l=>({sql:"UPDATE providers SET bound_to = ?, bound_at = ? WHERE id = ? AND spec = ? RETURNING id",params:[T(l.capability),r,l.id,n.find(u=>u.id===l.id).spec]})))).flatMap(l=>l.map(u=>String(u.id)))}export{Q as a,F as b,Z as c,ee as d,te as e};

package/dist/{chunk-CCWBPAKH.js → chunk-MLZJBYSY.js}

@@ -1,4 +1,4 @@
-import{Bb as g,Db as m,Lb as d}from"./chunk-LYNBZ7RV.js";import{confirm as f,input as u,password as h,select as y}from"@inquirer/prompts";import t from"chalk";function A(e){return!!(process.stdin.isTTY&&process.stderr.isTTY)&&!e&&!process.env.CI}var a={prefix:{idle:t.cyan("?"),done:t.green("\u2714")},style:{message:(e,r)=>r==="done"?`${e} ${t.dim("\xB7")}`:t.bold(e),answer:e=>t.cyan(e),defaultAnswer:e=>t.dim(`(${e})`),highlight:e=>t.cyan(e),help:e=>t.dim(e),error:e=>t.red(`> ${e}`),description:e=>t.dim(e),keysHelpTip:()=>{}}};async function l({context:e=[]},r){d(),e.length>0&&process.stderr.write(`${e.map(n=>t.dim(n)).join(`
+import{Ub as g,Wb as m,cc as d}from"./chunk-NXO2BC3M.js";import{confirm as f,input as u,password as h,select as y}from"@inquirer/prompts";import t from"chalk";function A(e){return!!(process.stdin.isTTY&&process.stderr.isTTY)&&!e&&!process.env.CI}var a={prefix:{idle:t.cyan("?"),done:t.green("\u2714")},style:{message:(e,r)=>r==="done"?`${e} ${t.dim("\xB7")}`:t.bold(e),answer:e=>t.cyan(e),defaultAnswer:e=>t.dim(`(${e})`),highlight:e=>t.cyan(e),help:e=>t.dim(e),error:e=>t.red(`> ${e}`),description:e=>t.dim(e),keysHelpTip:()=>{}}};async function l({context:e=[]},r){d(),e.length>0&&process.stderr.write(`${e.map(n=>t.dim(n)).join(`
 `)}
 `);try{return await r({output:process.stderr})}catch(n){throw n instanceof Error&&n.name==="ExitPromptError"?new m:n}}var T=(e,r)=>l({context:r},n=>f({message:e,default:!1,theme:a},n)),C=(e,r)=>l({context:r},n=>f({message:e,default:!0,theme:a},n));async function w(e,r,{context:n,cancelled:s}={}){if(!await e(r,n))throw new m(s)}function P(e,r,n={}){let s=Math.max(...r.map(i=>i.label.length));return l(n,i=>y({message:e,choices:r.map(o=>({name:o.hint?`${o.label.padEnd(s)}  ${t.dim(o.hint)}`:o.label,short:o.label,value:o.value})),theme:a},i))}function E(e,r={}){let{validate:n}=r;return l(r,s=>u({message:e,...r.initial?{default:r.initial}:{},...n?{validate:i=>n(i)??!0}:{},theme:a},s))}function $(e,r={}){let n="";return l(r,s=>h({message:e,mask:!1,toggleMask:!1,validate:i=>(n=i,i.trim()||r.optional?!0:"Enter a value."),theme:{...a,style:{...a.style,maskedText:"(hidden)",answer:()=>n.trim()?t.dim("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"):t.dim("skipped")}}},s))}function I(e){d(),process.stderr.write(`${e}
 `)}async function R({yes:e,interactive:r,confirm:n=T,question:s,unattended:i,context:o,cancelled:p,data:c}){if(!e){if(!r)throw new g("CONFIRMATION_REQUIRED",i,c?{data:c}:{});await w(n,s,{context:o,cancelled:p})}}export{A as a,T as b,C as c,w as d,P as e,E as f,$ as g,I as h,R as i};