everyapp 0.3.0-rc.2 → 0.3.0-rc.3

package/dist/{chunk-RMF4YGD6.js → chunk-OHDR7JWQ.js}

@@ -1,4 +1,4 @@
-import{a as xe,b as V,e as E,f as C,g as $e,h as Ue,i as Me,j as ze,k as Ge,l as We}from"./chunk-NFU4YFXB.js";import{c as q,d as Pe}from"./chunk-T2GD7RHS.js";import{a as Ce,e as ke}from"./chunk-CCWBPAKH.js";import{a as De,c as be,d as Re,e as Te,f as Ae,g as Ne,h as ve,i as Se,j as Ie}from"./chunk-JYKRUS5C.js";import{Bb as l,Cb as L,Fa as $,Ha as v,Hb as S,Ka as U,La as me,Ma as M,Na as z,Oa as G,Pa as W,Qa as F,Ra as H,Ta as ge,Tb as ye,Va as _e,Wa as fe,Xa as Ee,ac as we,bc as f,c,ca as pe,cc as he,d as ce,e as A,ec as Oe,gc as Le,i as N}from"./chunk-LYNBZ7RV.js";import Fe from"node:path";function He(e,t){return{run:async(a,n)=>(await Ot(e,t,a,n)).map(r=>r.rows)}}var It=6e5;function An(e){let[,t=e,a]=/^([\s\S]*?)(?::\s*(SQLITE_[A-Z_]+))?(?:\s*\[code: \d+\])?$/.exec(e.trim())??[];return{problem:t,...a?{sqliteCode:a}:{}}}async function Ot(e,t,a,{timeoutMs:n}={}){let r=a.length===1?a[0]:{batch:a};return(await f(e,{plane:"account",...n?{timeoutMs:n}:{},args:s=>["d1","query",t,"--body",`@${s["query.json"]}`],files:{"query.json":r}},Ae)).map(s=>({rows:s.results??[],duration:s.meta?.duration??0,changes:s.meta?.changes??0}))}async function Nn(e,t){let{bookmark:a}=await f(e,{plane:"account",args:["d1","time-travel","get-bookmark",t]},Ne);return a}async function vn(e,t,a){await f(e,{plane:"account",args:["d1","time-travel","restore",t,"--bookmark",a,"--force"]},ve)}function Sn(e,t,a,{platform:n=process.platform,shell:r=process.env.SHELL}={}){let i=`npx cf@${ye} d1 time-travel restore ${e} --bookmark ${t} --force`;return a?n==="win32"&&!r?`$env:CLOUDFLARE_ACCOUNT_ID="${a}"; ${i}`:`CLOUDFLARE_ACCOUNT_ID=${a} ${i}`:i}function qe(e,t){let a=Fe.resolve(e);return["--dir",a,...t?["--pattern",Fe.join(a,"*","migration.sql")]:[]]}async function In({cf:e,databaseId:t,dir:a,nested:n=!1}){return(await f(e,{plane:"account",args:["d1","migrations","list",t,...qe(a,n)]},Te)).map(i=>i.Name)}async function On({cf:e,databaseId:t,dir:a,nested:n=!1}){let r=await f(e,{plane:"account",timeoutMs:It,args:["d1","migrations","apply",t,...qe(a,n)]},De),i=r.filter(s=>s.status!=="\u2705");if(i.length>0)throw new Error(`cf reported ${i.map(s=>`${s.name} ${s.status}`).join(", ")} (applying ${r.map(s=>s.name).join(", ")}).`);return r.map(s=>s.name)}import{generateKeyPairSync as Lt,randomBytes as Ct}from"node:crypto";var Ve=["self_hosted","hosted"];function kn({gatewayUrl:e,accountId:t,deploymentMode:a}){let{privateKey:n,publicKey:r}=Lt("rsa",{modulusLength:2048,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{secrets:{GATEWAY_URL:e,BETTER_AUTH_SECRET:Ct(32).toString("base64"),JWT_PRIVATE_KEY:n,JWT_PUBLIC_KEY:r,GATEWAY_DEPLOYMENT_MODE:a,CLOUDFLARE_ACCOUNT_ID:t},jwtPublicKey:r}}var kt=`CREATE TABLE IF NOT EXISTS _everyapp_install (
+import{a as xe,b as V,e as E,f as C,g as $e,h as Ue,i as Me,j as ze,k as Ge,l as We}from"./chunk-HT76NR3O.js";import{c as q,d as Pe}from"./chunk-LTMQP62I.js";import{a as Ce,e as ke}from"./chunk-MLZJBYSY.js";import{a as De,c as be,d as Re,e as Te,f as Ae,g as Ne,h as ve,i as Se,j as Ie}from"./chunk-JT3R24Y7.js";import{$a as F,Ka as $,Ma as v,Ta as U,Ub as l,Va as me,Vb as L,Wa as M,Xa as z,Ya as G,Za as W,_b as S,ab as H,c,cb as ge,d as ce,e as A,eb as _e,fb as fe,gb as Ee,ha as pe,i as N,kc as ye,tc as we,uc as f,vc as he,xc as Oe,zc as Le}from"./chunk-NXO2BC3M.js";import Fe from"node:path";function He(e,t){return{run:async(a,n)=>(await Ct(e,t,a,n)).map(r=>r.rows)}}var Lt=6e5;function vn(e){let[,t=e,a]=/^([\s\S]*?)(?::\s*(SQLITE_[A-Z_]+))?(?:\s*\[code: \d+\])?$/.exec(e.trim())??[];return{problem:t,...a?{sqliteCode:a}:{}}}async function Ct(e,t,a,{timeoutMs:n}={}){let r=a.length===1?a[0]:{batch:a};return(await f(e,{plane:"account",...n?{timeoutMs:n}:{},args:s=>["d1","query",t,"--body",`@${s["query.json"]}`],files:{"query.json":r}},Ae)).map(s=>({rows:s.results??[],duration:s.meta?.duration??0,changes:s.meta?.changes??0}))}async function Sn(e,t){let{bookmark:a}=await f(e,{plane:"account",args:["d1","time-travel","get-bookmark",t]},Ne);return a}async function In(e,t,a){await f(e,{plane:"account",args:["d1","time-travel","restore",t,"--bookmark",a,"--force"]},ve)}function On(e,t,a,{platform:n=process.platform,shell:r=process.env.SHELL}={}){let i=`npx cf@${ye} d1 time-travel restore ${e} --bookmark ${t} --force`;return a?n==="win32"&&!r?`$env:CLOUDFLARE_ACCOUNT_ID="${a}"; ${i}`:`CLOUDFLARE_ACCOUNT_ID=${a} ${i}`:i}function qe(e,t){let a=Fe.resolve(e);return["--dir",a,...t?["--pattern",Fe.join(a,"*","migration.sql")]:[]]}async function Ln({cf:e,databaseId:t,dir:a,nested:n=!1}){return(await f(e,{plane:"account",args:["d1","migrations","list",t,...qe(a,n)]},Te)).map(i=>i.Name)}async function Cn({cf:e,databaseId:t,dir:a,nested:n=!1}){let r=await f(e,{plane:"account",timeoutMs:Lt,args:["d1","migrations","apply",t,...qe(a,n)]},De),i=r.filter(s=>s.status!=="\u2705");if(i.length>0)throw new Error(`cf reported ${i.map(s=>`${s.name} ${s.status}`).join(", ")} (applying ${r.map(s=>s.name).join(", ")}).`);return r.map(s=>s.name)}import{generateKeyPairSync as kt,randomBytes as Pt}from"node:crypto";var Ve=["self_hosted","hosted"];function xn({gatewayUrl:e,accountId:t,deploymentMode:a}){let{privateKey:n,publicKey:r}=kt("rsa",{modulusLength:2048,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{secrets:{GATEWAY_URL:e,BETTER_AUTH_SECRET:Pt(32).toString("base64"),JWT_PRIVATE_KEY:n,JWT_PUBLIC_KEY:r,GATEWAY_DEPLOYMENT_MODE:a,CLOUDFLARE_ACCOUNT_ID:t},jwtPublicKey:r}}var xt=`CREATE TABLE IF NOT EXISTS _everyapp_install (
   id TEXT PRIMARY KEY CHECK (id = 'install'),
   account_id TEXT NOT NULL,
   zone_id TEXT NOT NULL,
@@ -18,8 +18,8 @@ import{a as xe,b as V,e as E,f as C,g as $e,h as Ue,i as Me,j as ze,k as Ge,l as
   updated_by TEXT,
   jwt_public_key TEXT,
   deployment_mode TEXT
-)`;function Be(e){try{let t=JSON.parse(String(e??"[]"));return Array.isArray(t)?t.map(String):[]}catch{return[]}}var Pt=e=>Ve.includes(e)?e:null;function Ye(){return new l("GATEWAY_NOT_INSTALLED",`The Gateway's install didn't finish
-Setup stopped before it recorded the install.`,{rerun:`${c} setup`,rerunNote:"asks for the hostname again"})}async function Ke(e){let[t=[]]=await e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = '_everyapp_install'"}]);if(t.length===0)return null;let[a=[]]=await e.run([{sql:"SELECT * FROM _everyapp_install WHERE id = 'install'"}]),n=a[0];return n?{accountId:String(n.account_id),zoneId:String(n.zone_id),zoneName:String(n.zone_name),gatewayHost:String(n.gateway_host),appBaseDomain:String(n.app_base_domain),oauthKvId:String(n.oauth_kv_id),releaseVersion:String(n.release_version),releaseSha256:String(n.release_sha256),releaseOrder:{schema:Number(n.release_schema),committedAt:Number(n.release_committed_at)},sourceTreeSha256:N(n.source_tree_sha256),liveVersionId:N(n.live_version_id),liveDomains:Be(n.live_domains),liveAppWorkers:Be(n.live_app_workers),updatedAt:Number(n.updated_at),updatedBy:N(n.updated_by),jwtPublicKey:N(n.jwt_public_key),deploymentMode:Pt(n.deployment_mode)}:null}async function zn(e,t){let a=[t.accountId,t.zoneId,t.zoneName,t.gatewayHost,t.appBaseDomain,t.oauthKvId,t.releaseVersion,t.releaseSha256,t.releaseOrder.schema,t.releaseOrder.committedAt,t.sourceTreeSha256,t.liveVersionId,JSON.stringify(t.liveDomains),JSON.stringify(t.liveAppWorkers),t.updatedAt,t.updatedBy,t.jwtPublicKey,t.deploymentMode];await e.run([{sql:kt},{sql:`INSERT INTO _everyapp_install (id, account_id, zone_id, zone_name, gateway_host,
+)`;function Be(e){try{let t=JSON.parse(String(e??"[]"));return Array.isArray(t)?t.map(String):[]}catch{return[]}}var $t=e=>Ve.includes(e)?e:null;function Ye(){return new l("GATEWAY_NOT_INSTALLED",`The Gateway's install didn't finish
+Setup stopped before it recorded the install.`,{rerun:`${c} setup`,rerunNote:"asks for the hostname again"})}async function Ke(e){let[t=[]]=await e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = '_everyapp_install'"}]);if(t.length===0)return null;let[a=[]]=await e.run([{sql:"SELECT * FROM _everyapp_install WHERE id = 'install'"}]),n=a[0];return n?{accountId:String(n.account_id),zoneId:String(n.zone_id),zoneName:String(n.zone_name),gatewayHost:String(n.gateway_host),appBaseDomain:String(n.app_base_domain),oauthKvId:String(n.oauth_kv_id),releaseVersion:String(n.release_version),releaseSha256:String(n.release_sha256),releaseOrder:{schema:Number(n.release_schema),committedAt:Number(n.release_committed_at)},sourceTreeSha256:N(n.source_tree_sha256),liveVersionId:N(n.live_version_id),liveDomains:Be(n.live_domains),liveAppWorkers:Be(n.live_app_workers),updatedAt:Number(n.updated_at),updatedBy:N(n.updated_by),jwtPublicKey:N(n.jwt_public_key),deploymentMode:$t(n.deployment_mode)}:null}async function Wn(e,t){let a=[t.accountId,t.zoneId,t.zoneName,t.gatewayHost,t.appBaseDomain,t.oauthKvId,t.releaseVersion,t.releaseSha256,t.releaseOrder.schema,t.releaseOrder.committedAt,t.sourceTreeSha256,t.liveVersionId,JSON.stringify(t.liveDomains),JSON.stringify(t.liveAppWorkers),t.updatedAt,t.updatedBy,t.jwtPublicKey,t.deploymentMode];await e.run([{sql:xt},{sql:`INSERT INTO _everyapp_install (id, account_id, zone_id, zone_name, gateway_host,
   app_base_domain, oauth_kv_id, release_version, release_sha256, release_schema,
   release_committed_at, source_tree_sha256, live_version_id, live_domains,
   live_app_workers, updated_at, updated_by, jwt_public_key, deployment_mode)
@@ -35,64 +35,65 @@ ON CONFLICT(id) DO UPDATE SET account_id = excluded.account_id,
   live_app_workers = excluded.live_app_workers, updated_at = excluded.updated_at,
   updated_by = excluded.updated_by,
   jwt_public_key = COALESCE(excluded.jwt_public_key, _everyapp_install.jwt_public_key),
-  deployment_mode = COALESCE(excluded.deployment_mode, _everyapp_install.deployment_mode)`,params:a}])}var xt=100,$t=50;async function je(e,t){let a=await e();if(a)return{id:a,created:!1};try{return{id:await t(),created:!0}}catch(n){let r=S(n,"already_exists")?await e():null;if(r)return{id:r,created:!1};throw n}}async function B(e,t){return(await f(e,{plane:"account",args:["d1","list","--name",t,"--per-page","100"]},Re)).find(n=>n.name===t)?.uuid??null}async function Ut(e,t){return(await f(e,{plane:"account",args:["d1","create","--name",t]},be)).uuid}function Xe(e,t){return je(()=>B(e,t),()=>Ut(e,t))}async function Mt(e,t){return(await he(e,["kv","namespaces","list"],Ie,{perPage:xt,maxPages:$t})).find(n=>n.title===t)?.id??null}async function zt(e,t){return(await f(e,{plane:"account",args:["kv","namespaces","create","--title",t]},Se)).id}function Je(e,t){return je(()=>Mt(e,t),()=>zt(e,t))}async function qn(e,t){await e.run({plane:"account",mode:"json",args:["d1","delete",t,"--force"]})}async function Vn(e,t){await e.run({plane:"account",mode:"json",args:["kv","namespaces","delete",t,"--force"]})}import{randomBytes as qt}from"node:crypto";import{randomBytes as Y}from"node:crypto";var Ze="0123456789ABCDEFGHJKMNPQRSTVWXYZ",Gt=10,Wt=16;function Ft(e=Date.now()){let t="",a=Math.max(0,Math.floor(e));for(let r=0;r<Gt;r+=1)t=Ze[a%32]+t,a=Math.floor(a/32);let n=[...Y(Wt)].map(r=>Ze[r%32]).join("");return`${t}${n}`}var K=e=>`evt_${Ft(e)}`,j=()=>`sub_${Y(12).toString("hex")}`,X=()=>`dlv_${Y(12).toString("hex")}`;var Ht=/^\d{1,3}(\.\d{1,3}){3}$/,J=e=>e.trim().toLowerCase().replace(/\.$/,""),Qe=(e,t)=>t!==""&&(e===t||e.endsWith(`.${t}`)),y=(e,t=!1)=>({ok:!1,reason:e,private:t});function et(e,t){let a=e.trim();if(a.length>F)return y(`A webhook URL is at most ${F.toLocaleString("en-US")} characters.`);let n;try{n=new URL(a)}catch{return y("It isn't a URL: give the whole address, like https://hooks.example.com/everyapp.")}if(n.protocol==="http:"){if(!t.allowPrivate)return y("A webhook URL starts with https://: the event and its signature would cross the internet in the clear.",!0)}else if(n.protocol!=="https:")return y(`A webhook URL starts with https://, not ${n.protocol}//.`);if(n.username||n.password)return y("A webhook URL carries no user name or password: the subscription's secret signs each delivery instead.");if(n.hash||a.includes("#"))return y("A webhook URL has no fragment (#\u2026): it is never sent to the receiver.");let r=J(n.hostname),i=J(t.gatewayHost),s=J(t.appBaseDomain);return Qe(r,i)||Qe(r,s)?y(`${r} is the Gateway's own host, or under its apps' domain ${s}: a delivery there would loop back into the Gateway.`):r.startsWith("[")||Ht.test(r)?t.allowPrivate?{ok:!0,url:n.toString()}:y("A webhook URL names its host, not an IP address.",!0):ge(r)&&!t.allowPrivate?y(`${r} is a local or internal name, which the Gateway's Worker can't reach.`,!0):{ok:!0,url:n.toString()}}function Xn(e){try{let t=new URL(e),a=t.pathname==="/"?"":t.pathname;return`${t.protocol==="http:"?"http://":""}${t.host}${a}`}catch{return"(unreadable URL)"}}function Jn(e){try{return new URL(e).hostname}catch{return"Webhook"}}function Q(e){return{kind:"operator",id:e.actor,...e.email?{email:e.email}:{}}}var tt=new WeakMap;function ee(e){let t=tt.get(e);return t||(t=e.run([{sql:"PRAGMA table_info(events)"}]).then(([a=[]])=>a.length>0),tt.set(e,t)),t}async function R(e){if(!await ee(e))throw new l("GATEWAY_OUTDATED",`The Gateway predates events
-Its database has no event tables until the Gateway is updated to a release that has them.`,{rerun:`${c} update`,rerunNote:"then run this again"})}async function te(e,t){if(!await ee(e))return[];let a=U(t.type);if(!a)throw new Error(`${t.type} isn't in the event catalogue`);let n=Ee(t.data,me);if(!n.ok)throw new Error(`${t.type}'s data: ${n.message}`);let r=t.now??Date.now(),i=K(r),[s=[]]=await e.run([{sql:"SELECT id, events FROM event_subscriptions WHERE organization_id = ? AND enabled = 1",params:[t.organizationId]}]),o=s.filter(u=>_e(nt(u.events),t.type)).map(u=>String(u.id));return[{sql:`INSERT INTO events (id, organization_id, type, version, time, actor, data, app_row_id, dedupe_key, created_at)
-SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE 1${t.onlyIf?` AND (${t.onlyIf.sql})`:""}
-ON CONFLICT DO NOTHING`,params:[i,t.organizationId,t.type,a.version,r,JSON.stringify(t.actor),JSON.stringify(t.data),t.appRowId??null,t.dedupeKey??null,r,...t.onlyIf?.params??[]]},...o.map(u=>Vt(i,u,t.organizationId,r))]}function Vt(e,t,a,n){return{sql:`INSERT INTO event_deliveries (id, event_id, subscription_id, organization_id, status, attempts, next_attempt_at, created_at)
+  deployment_mode = COALESCE(excluded.deployment_mode, _everyapp_install.deployment_mode)`,params:a}])}var Ut=100,Mt=50;async function je(e,t){let a=await e();if(a)return{id:a,created:!1};try{return{id:await t(),created:!0}}catch(n){let r=S(n,"already_exists")?await e():null;if(r)return{id:r,created:!1};throw n}}async function B(e,t){return(await f(e,{plane:"account",args:["d1","list","--name",t,"--per-page","100"]},Re)).find(n=>n.name===t)?.uuid??null}async function zt(e,t){return(await f(e,{plane:"account",args:["d1","create","--name",t]},be)).uuid}function Xe(e,t){return je(()=>B(e,t),()=>zt(e,t))}async function Gt(e,t){return(await he(e,["kv","namespaces","list"],Ie,{perPage:Ut,maxPages:Mt})).find(n=>n.title===t)?.id??null}async function Wt(e,t){return(await f(e,{plane:"account",args:["kv","namespaces","create","--title",t]},Se)).id}function Je(e,t){return je(()=>Gt(e,t),()=>Wt(e,t))}async function Bn(e,t){await e.run({plane:"account",mode:"json",args:["d1","delete",t,"--force"]})}async function Yn(e,t){await e.run({plane:"account",mode:"json",args:["kv","namespaces","delete",t,"--force"]})}import{randomBytes as Bt}from"node:crypto";import{randomBytes as Y}from"node:crypto";var Ze="0123456789ABCDEFGHJKMNPQRSTVWXYZ",Ft=10,Ht=16;function qt(e=Date.now()){let t="",a=Math.max(0,Math.floor(e));for(let r=0;r<Ft;r+=1)t=Ze[a%32]+t,a=Math.floor(a/32);let n=[...Y(Ht)].map(r=>Ze[r%32]).join("");return`${t}${n}`}var K=e=>`evt_${qt(e)}`,j=()=>`sub_${Y(12).toString("hex")}`,X=()=>`dlv_${Y(12).toString("hex")}`;var Vt=/^\d{1,3}(\.\d{1,3}){3}$/,J=e=>e.trim().toLowerCase().replace(/\.$/,""),Qe=(e,t)=>t!==""&&(e===t||e.endsWith(`.${t}`)),y=(e,t=!1)=>({ok:!1,reason:e,private:t});function et(e,t){let a=e.trim();if(a.length>F)return y(`A webhook URL is at most ${F.toLocaleString("en-US")} characters.`);let n;try{n=new URL(a)}catch{return y("It isn't a URL: give the whole address, like https://hooks.example.com/everyapp.")}if(n.protocol==="http:"){if(!t.allowPrivate)return y("A webhook URL starts with https://: the event and its signature would cross the internet in the clear.",!0)}else if(n.protocol!=="https:")return y(`A webhook URL starts with https://, not ${n.protocol}//.`);if(n.username||n.password)return y("A webhook URL carries no user name or password: the subscription's secret signs each delivery instead.");if(n.hash||a.includes("#"))return y("A webhook URL has no fragment (#\u2026): it is never sent to the receiver.");let r=J(n.hostname),i=J(t.gatewayHost),s=J(t.appBaseDomain);return Qe(r,i)||Qe(r,s)?y(`${r} is the Gateway's own host, or under its apps' domain ${s}: a delivery there would loop back into the Gateway.`):r.startsWith("[")||Vt.test(r)?t.allowPrivate?{ok:!0,url:n.toString()}:y("A webhook URL names its host, not an IP address.",!0):ge(r)&&!t.allowPrivate?y(`${r} is a local or internal name, which the Gateway's Worker can't reach.`,!0):{ok:!0,url:n.toString()}}function Zn(e){try{let t=new URL(e),a=t.pathname==="/"?"":t.pathname;return`${t.protocol==="http:"?"http://":""}${t.host}${a}`}catch{return"(unreadable URL)"}}function Qn(e){try{return new URL(e).hostname}catch{return"Webhook"}}function Q(e){return{kind:"operator",id:e.actor,...e.email?{email:e.email}:{}}}var tt=new WeakMap;function nt(e){let t=tt.get(e);return t||(t=e.run([{sql:"PRAGMA table_info(events)"}]).then(([a=[]])=>new Set(a.map(n=>String(n.name)))),tt.set(e,t)),t}async function ee(e){return(await nt(e)).size>0}async function at(e){return(await nt(e)).has("actor_id")}async function oa(e){if(!await at(e))throw new l("GATEWAY_OUTDATED",`The Gateway predates the audit log
+Its events table has no actor columns until the Gateway is updated to a release that has them.`,{rerun:`${c} update`,rerunNote:"then run this again"})}async function R(e){if(!await ee(e))throw new l("GATEWAY_OUTDATED",`The Gateway predates events
+Its database has no event tables until the Gateway is updated to a release that has them.`,{rerun:`${c} update`,rerunNote:"then run this again"})}async function te(e,t){if(!await ee(e))return[];let a=U(t.type);if(!a)throw new Error(`${t.type} isn't in the event catalogue`);let n=Ee(t.data,me);if(!n.ok)throw new Error(`${t.type}'s data: ${n.message}`);let r=t.now??Date.now(),i=K(r),[s=[]]=await e.run([{sql:"SELECT id, events FROM event_subscriptions WHERE organization_id = ? AND enabled = 1",params:[t.organizationId]}]),o=s.filter(m=>_e(rt(m.events),t.type)).map(m=>String(m.id)),u=t.onlyIf?` AND (${t.onlyIf.sql})`:"",d=await at(e);return[{sql:`INSERT INTO events (id, organization_id, type, version, time, actor, ${d?"actor_kind, actor_id, ":""}data, app_row_id, dedupe_key, created_at)
+SELECT ?, ?, ?, ?, ?, ?, ${d?"?, ?, ":""}?, ?, ?, ? WHERE 1${u}
+ON CONFLICT DO NOTHING`,params:[i,t.organizationId,t.type,a.version,r,JSON.stringify(t.actor),...d?[t.actor.kind,t.actor.id]:[],JSON.stringify(t.data),t.appRowId??null,t.dedupeKey??null,r,...t.onlyIf?.params??[]]},...o.map(m=>Yt(i,m,t.organizationId,r))]}function Yt(e,t,a,n){return{sql:`INSERT INTO event_deliveries (id, event_id, subscription_id, organization_id, status, attempts, next_attempt_at, created_at)
 SELECT ?1, ?2, ?3, ?4, 'pending', 0, ?5, ?5
 WHERE EXISTS (SELECT 1 FROM events WHERE id = ?2)
-  AND EXISTS (SELECT 1 FROM event_subscriptions WHERE id = ?3 AND organization_id = ?4 AND enabled = 1)`,params:[X(),e,t,a,n]}}var Bt="cap_alerts",Yt="Cap alerts",Kt=["cap.warning","cap.reached"];async function ia(e,t){return await ee(e)?{sql:`INSERT INTO event_subscriptions (id, organization_id, name, sink, url, secret, recipients, events, enabled,
+  AND EXISTS (SELECT 1 FROM event_subscriptions WHERE id = ?3 AND organization_id = ?4 AND enabled = 1)`,params:[X(),e,t,a,n]}}var Kt="cap_alerts",jt="Cap alerts",Xt=["cap.warning","cap.reached"];async function la(e,t){return await ee(e)?{sql:`INSERT INTO event_subscriptions (id, organization_id, name, sink, url, secret, recipients, events, enabled,
   builtin, description, created_at, updated_at, created_by, consecutive_failures)
 SELECT ?1, ?2, ?3, 'email', NULL, NULL, 'admins', ?4, 1, ?5, ?6, ?7, ?7, ?8, 0
 WHERE NOT EXISTS (SELECT 1 FROM event_subscriptions WHERE organization_id = ?2 AND builtin = ?5)
-RETURNING id`,params:[j(),t.organizationId,Yt,JSON.stringify(Kt),Bt,"Owners and admins get an email at 80% and at the cap.",t.now,`operator:${t.deployer.actor}`]}:null}function nt(e){try{let t=JSON.parse(String(e));if(Array.isArray(t)&&t.every(a=>typeof a=="string"))return t}catch{}return[]}var ne="id, name, sink, url, recipients, events, enabled, builtin, description, created_at, created_by, last_delivery_at, last_delivery_status, consecutive_failures",b=e=>e==null?null:Number(e),h=e=>e==null?null:String(e);function ae(e){return{id:String(e.id),name:String(e.name),sink:e.sink==="email"?"email":"webhook",url:h(e.url),recipients:e.recipients==="owners"||e.recipients==="admins"?e.recipients:null,events:nt(e.events),enabled:Number(e.enabled)===1,builtin:h(e.builtin),description:h(e.description),createdAt:Number(e.created_at),createdBy:h(e.created_by),lastDeliveryAt:b(e.last_delivery_at),lastDeliveryStatus:h(e.last_delivery_status),consecutiveFailures:Number(e.consecutive_failures??0)}}async function sa(e,t){await R(e);let[a=[]]=await e.run([{sql:`SELECT ${ne} FROM event_subscriptions WHERE organization_id = ? ORDER BY created_at, id`,params:[t]}]);return a.map(ae)}function jt(e,t){return new l("EVENT_SUBSCRIPTION_NOT_FOUND",`No subscription ${e} in ${t}
-Subscriptions belong to one organization; --org names another.`,{rerun:`${c} events list`,rerunNote:"lists them"})}async function re(e,t,a){await R(e);let[n=[]]=await e.run([{sql:`SELECT ${ne} FROM event_subscriptions WHERE id = ? AND organization_id = ?`,params:[a.trim(),t.id]}]);if(!n[0])throw jt(a.trim(),t.name);return ae(n[0])}function oa(e){let t=[...new Set((e??[]).flatMap(n=>n.split(",")).map(n=>n.trim()).filter(Boolean))];if(t.length===0)return["*"];let a=t.flatMap(n=>{let r=fe(n);return r?[{pattern:n,problem:r}]:[]});if(a.length>0)throw new l("EVENT_TYPE_UNKNOWN",[a.length===1?`${a[0].pattern} isn't an event type`:`${a.length} of --events aren't event types`,...a.map(n=>n.problem)].join(`
-`),{fix:"name types (member.joined), prefixes (member.*), an app's own events (app.crm.*) or * for everything",rerun:`${c} events types`,rerunNote:"lists the types",data:{patterns:a.map(n=>n.pattern)}});return t.includes("*")?["*"]:t}function la(e,t){let a=et(e,t);if(a.ok)return a.url;throw new l("EVENT_TARGET_REFUSED",`The Gateway won't deliver to that URL
-${a.reason}`,{...a.private?{fix:`use a public https:// receiver; for one on a private network, set EVENTS_ALLOW_PRIVATE_TARGETS on the Gateway (${c} secret set EVENTS_ALLOW_PRIVATE_TARGETS, value true; self-host only)`}:{fix:"give the receiver's full https:// URL (Slack's, Zapier's, n8n's, your own)"}})}var Xt=/^[\x21-\x7e]+$/;function ua(e){let t=e.length<z||e.length>G?`A signing secret is ${z} to ${G} characters (this one is ${e.length}).`:Xt.test(e)?null:"A signing secret is printable ASCII with no spaces, so every receiver's HMAC reads the same bytes.";if(!t)return e;throw new l("EVENT_SECRET_INVALID",`That signing secret won't do
-${t}`,{fix:"leave --secret out and the CLI makes one, or give one of 16 to 128 printable characters"})}var da=()=>`whsec_${qt(32).toString("base64url")}`;function ca(e){let t=e?.replace(/\s+/g," ").trim()??"";return t===""?null:t.length>H?t.slice(0,H):t}async function pa(e,t){await R(e);let a=t.now??Date.now(),n=j(),{target:r}=t,[i=[]]=await e.run([{sql:`INSERT INTO event_subscriptions (id, organization_id, name, sink, url, secret, recipients, events, enabled,
+RETURNING id`,params:[j(),t.organizationId,jt,JSON.stringify(Xt),Kt,"Owners and admins get an email at 80% and at the cap.",t.now,`operator:${t.deployer.actor}`]}:null}function rt(e){try{let t=JSON.parse(String(e));if(Array.isArray(t)&&t.every(a=>typeof a=="string"))return t}catch{}return[]}var ne="id, name, sink, url, recipients, events, enabled, builtin, description, created_at, created_by, last_delivery_at, last_delivery_status, consecutive_failures",b=e=>e==null?null:Number(e),h=e=>e==null?null:String(e);function ae(e){return{id:String(e.id),name:String(e.name),sink:e.sink==="email"?"email":"webhook",url:h(e.url),recipients:e.recipients==="owners"||e.recipients==="admins"?e.recipients:null,events:rt(e.events),enabled:Number(e.enabled)===1,builtin:h(e.builtin),description:h(e.description),createdAt:Number(e.created_at),createdBy:h(e.created_by),lastDeliveryAt:b(e.last_delivery_at),lastDeliveryStatus:h(e.last_delivery_status),consecutiveFailures:Number(e.consecutive_failures??0)}}async function ua(e,t){await R(e);let[a=[]]=await e.run([{sql:`SELECT ${ne} FROM event_subscriptions WHERE organization_id = ? ORDER BY created_at, id`,params:[t]}]);return a.map(ae)}function Jt(e,t){return new l("EVENT_SUBSCRIPTION_NOT_FOUND",`No subscription ${e} in ${t}
+Subscriptions belong to one organization; --org names another.`,{rerun:`${c} events list`,rerunNote:"lists them"})}async function re(e,t,a){await R(e);let[n=[]]=await e.run([{sql:`SELECT ${ne} FROM event_subscriptions WHERE id = ? AND organization_id = ?`,params:[a.trim(),t.id]}]);if(!n[0])throw Jt(a.trim(),t.name);return ae(n[0])}function da(e){let t=[...new Set((e??[]).flatMap(n=>n.split(",")).map(n=>n.trim()).filter(Boolean))];if(t.length===0)return["*"];let a=t.flatMap(n=>{let r=fe(n);return r?[{pattern:n,problem:r}]:[]});if(a.length>0)throw new l("EVENT_TYPE_UNKNOWN",[a.length===1?`${a[0].pattern} isn't an event type`:`${a.length} of --events aren't event types`,...a.map(n=>n.problem)].join(`
+`),{fix:"name types (member.joined), prefixes (member.*), an app's own events (app.crm.*) or * for everything",rerun:`${c} events types`,rerunNote:"lists the types",data:{patterns:a.map(n=>n.pattern)}});return t.includes("*")?["*"]:t}function ca(e,t){let a=et(e,t);if(a.ok)return a.url;throw new l("EVENT_TARGET_REFUSED",`The Gateway won't deliver to that URL
+${a.reason}`,{...a.private?{fix:`use a public https:// receiver; for one on a private network, set EVENTS_ALLOW_PRIVATE_TARGETS on the Gateway (${c} secret set EVENTS_ALLOW_PRIVATE_TARGETS, value true; self-host only)`}:{fix:"give the receiver's full https:// URL (Slack's, Zapier's, n8n's, your own)"}})}var Zt=/^[\x21-\x7e]+$/;function pa(e){let t=e.length<z||e.length>G?`A signing secret is ${z} to ${G} characters (this one is ${e.length}).`:Zt.test(e)?null:"A signing secret is printable ASCII with no spaces, so every receiver's HMAC reads the same bytes.";if(!t)return e;throw new l("EVENT_SECRET_INVALID",`That signing secret won't do
+${t}`,{fix:"leave --secret out and the CLI makes one, or give one of 16 to 128 printable characters"})}var ma=()=>`whsec_${Bt(32).toString("base64url")}`;function ga(e){let t=e?.replace(/\s+/g," ").trim()??"";return t===""?null:t.length>H?t.slice(0,H):t}async function _a(e,t){await R(e);let a=t.now??Date.now(),n=j(),{target:r}=t,[i=[]]=await e.run([{sql:`INSERT INTO event_subscriptions (id, organization_id, name, sink, url, secret, recipients, events, enabled,
   builtin, description, created_at, updated_at, created_by, consecutive_failures)
 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1, NULL, NULL, ?9, ?9, ?10, 0
 WHERE (SELECT COUNT(*) FROM event_subscriptions WHERE organization_id = ?2) < ?11
 RETURNING ${ne}`,params:[n,t.organization.id,t.name,r.sink,r.sink==="webhook"?r.url:null,r.sink==="webhook"?r.secret:null,r.sink==="email"?r.recipients:null,JSON.stringify(t.events),a,`operator:${t.deployer.actor}`,M]}]);if(!i[0])throw new l("EVENT_SUBSCRIPTIONS_LIMIT",`${t.organization.name} has ${M} subscriptions, the most an organization may have
-Nothing was added.`,{fix:`remove one you no longer need (${c} events remove <id>), or widen one's --events instead of adding another`,rerun:`${c} events list`,rerunNote:"lists them"});return ae(i[0])}async function ma(e,t,a,n=Date.now()){let r=await re(e,t,a);return r.builtin?(await e.run([{sql:"UPDATE event_subscriptions SET enabled = 0, updated_at = ? WHERE id = ? AND organization_id = ?",params:[n,r.id,t.id]}]),{subscription:{...r,enabled:!1},outcome:"disabled"}):(await e.run([{sql:"DELETE FROM event_subscriptions WHERE id = ? AND organization_id = ?",params:[r.id,t.id]}]),{subscription:r,outcome:"removed"})}async function ga(e,t,a,n,r=Date.now()){let i=await re(e,t,a);return i.enabled===n?{subscription:i,changed:!1}:(await e.run([{sql:"UPDATE event_subscriptions SET enabled = ?, updated_at = ? WHERE id = ? AND organization_id = ?",params:[n?1:0,r,i.id,t.id]}]),{subscription:{...i,enabled:n},changed:!0})}function Jt(e,t){return new l("EVENT_SUBSCRIPTION_DISABLED",`${e.name} (${e.id}) is disabled
-The Gateway drops what is queued for a disabled subscription, so ${t} would go nowhere.`,{rerun:`${c} events enable ${e.id}`,rerunNote:"then run this again"})}var at=`d.id, d.event_id, e.type, d.subscription_id, s.name AS subscription_name, s.sink, d.status, d.attempts,
+Nothing was added.`,{fix:`remove one you no longer need (${c} events remove <id>), or widen one's --events instead of adding another`,rerun:`${c} events list`,rerunNote:"lists them"});return ae(i[0])}async function fa(e,t,a,n=Date.now()){let r=await re(e,t,a);return r.builtin?(await e.run([{sql:"UPDATE event_subscriptions SET enabled = 0, updated_at = ? WHERE id = ? AND organization_id = ?",params:[n,r.id,t.id]}]),{subscription:{...r,enabled:!1},outcome:"disabled"}):(await e.run([{sql:"DELETE FROM event_subscriptions WHERE id = ? AND organization_id = ?",params:[r.id,t.id]}]),{subscription:r,outcome:"removed"})}async function Ea(e,t,a,n,r=Date.now()){let i=await re(e,t,a);return i.enabled===n?{subscription:i,changed:!1}:(await e.run([{sql:"UPDATE event_subscriptions SET enabled = ?, updated_at = ? WHERE id = ? AND organization_id = ?",params:[n?1:0,r,i.id,t.id]}]),{subscription:{...i,enabled:n},changed:!0})}function Qt(e,t){return new l("EVENT_SUBSCRIPTION_DISABLED",`${e.name} (${e.id}) is disabled
+The Gateway drops what is queued for a disabled subscription, so ${t} would go nowhere.`,{rerun:`${c} events enable ${e.id}`,rerunNote:"then run this again"})}var it=`d.id, d.event_id, e.type, d.subscription_id, s.name AS subscription_name, s.sink, d.status, d.attempts,
   d.next_attempt_at, d.claimed_until, d.last_attempt_at, d.last_status_code, d.last_error, d.delivered_at,
-  d.redelivered_at, d.created_at`,rt=`FROM event_deliveries d
+  d.redelivered_at, d.created_at`,st=`FROM event_deliveries d
 LEFT JOIN events e ON e.id = d.event_id
-LEFT JOIN event_subscriptions s ON s.id = d.subscription_id AND s.organization_id = d.organization_id`;function it(e){let t=String(e.status);return{id:String(e.id),eventId:String(e.event_id),type:h(e.type),subscriptionId:String(e.subscription_id),subscriptionName:h(e.subscription_name),sink:e.sink==="email"?"email":e.sink==="webhook"?"webhook":null,status:t==="delivered"||t==="dead"?t:"pending",attempts:Number(e.attempts??0),nextAttemptAt:b(e.next_attempt_at),claimedUntil:b(e.claimed_until),lastAttemptAt:b(e.last_attempt_at),lastStatusCode:b(e.last_status_code),lastError:h(e.last_error),deliveredAt:b(e.delivered_at),redeliveredAt:b(e.redelivered_at),createdAt:Number(e.created_at)}}function Zt(e,t=Date.now()){if(e.status!=="pending")return e.status;let a=e.claimedUntil!==null&&e.claimedUntil>t;return e.attempts>0&&e.lastError!==null&&!a?"failed":"pending"}var Qt=200;async function _a(e,t){await R(e);let a=(t.now??Date.now())-W*24*60*60*1e3,n=["d.organization_id = ?","d.created_at >= ?",...t.subscriptionId?["d.subscription_id = ?"]:[],...t.dead?["d.status = 'dead'"]:[]],[r=[]]=await e.run([{sql:`SELECT ${at} ${rt} WHERE ${n.join(" AND ")} ORDER BY d.created_at DESC, d.id DESC LIMIT ?`,params:[t.organizationId,a,...t.subscriptionId?[t.subscriptionId]:[],Math.min(Math.max(1,Math.floor(t.limit)),Qt)]}]);return r.map(it)}async function Z(e,t,a){let[n=[]]=await e.run([{sql:`SELECT ${at} ${rt} WHERE d.id = ? AND d.organization_id = ?`,params:[a,t]}]);return n[0]?it(n[0]):null}async function fa(e,t,a,n=Date.now()){await R(e);let r=await Z(e,t.id,a.trim());if(!r)throw new l("EVENT_DELIVERY_NOT_FOUND",`No delivery ${a.trim()} in ${t.name}
-Deliveries are kept ${W} days, under the organization of their subscription.`,{rerun:`${c} events deliveries`,rerunNote:"lists the last ones"});let i=await re(e,t,r.subscriptionId).catch(u=>{throw u instanceof l&&u.code==="EVENT_SUBSCRIPTION_NOT_FOUND"?new l("EVENT_SUBSCRIPTION_NOT_FOUND",`${r.id} was for ${r.subscriptionId}, which is removed
-There is nowhere to send it again.`,{rerun:`${c} events list`,rerunNote:"lists the subscriptions there are"}):u});if(!i.enabled)throw Jt(i,"sending it again");let[s=[]]=await e.run([{sql:`UPDATE event_deliveries SET status = 'pending', attempts = 0, next_attempt_at = ?1, redelivered_at = ?1, claimed_until = NULL
+LEFT JOIN event_subscriptions s ON s.id = d.subscription_id AND s.organization_id = d.organization_id`;function ot(e){let t=String(e.status);return{id:String(e.id),eventId:String(e.event_id),type:h(e.type),subscriptionId:String(e.subscription_id),subscriptionName:h(e.subscription_name),sink:e.sink==="email"?"email":e.sink==="webhook"?"webhook":null,status:t==="delivered"||t==="dead"?t:"pending",attempts:Number(e.attempts??0),nextAttemptAt:b(e.next_attempt_at),claimedUntil:b(e.claimed_until),lastAttemptAt:b(e.last_attempt_at),lastStatusCode:b(e.last_status_code),lastError:h(e.last_error),deliveredAt:b(e.delivered_at),redeliveredAt:b(e.redelivered_at),createdAt:Number(e.created_at)}}function en(e,t=Date.now()){if(e.status!=="pending")return e.status;let a=e.claimedUntil!==null&&e.claimedUntil>t;return e.attempts>0&&e.lastError!==null&&!a?"failed":"pending"}var tn=200;async function ya(e,t){await R(e);let a=(t.now??Date.now())-W*24*60*60*1e3,n=["d.organization_id = ?","d.created_at >= ?",...t.subscriptionId?["d.subscription_id = ?"]:[],...t.dead?["d.status = 'dead'"]:[]],[r=[]]=await e.run([{sql:`SELECT ${it} ${st} WHERE ${n.join(" AND ")} ORDER BY d.created_at DESC, d.id DESC LIMIT ?`,params:[t.organizationId,a,...t.subscriptionId?[t.subscriptionId]:[],Math.min(Math.max(1,Math.floor(t.limit)),tn)]}]);return r.map(ot)}async function Z(e,t,a){let[n=[]]=await e.run([{sql:`SELECT ${it} ${st} WHERE d.id = ? AND d.organization_id = ?`,params:[a,t]}]);return n[0]?ot(n[0]):null}async function wa(e,t,a,n=Date.now()){await R(e);let r=await Z(e,t.id,a.trim());if(!r)throw new l("EVENT_DELIVERY_NOT_FOUND",`No delivery ${a.trim()} in ${t.name}
+Deliveries are kept ${W} days, under the organization of their subscription.`,{rerun:`${c} events deliveries`,rerunNote:"lists the last ones"});let i=await re(e,t,r.subscriptionId).catch(d=>{throw d instanceof l&&d.code==="EVENT_SUBSCRIPTION_NOT_FOUND"?new l("EVENT_SUBSCRIPTION_NOT_FOUND",`${r.id} was for ${r.subscriptionId}, which is removed
+There is nowhere to send it again.`,{rerun:`${c} events list`,rerunNote:"lists the subscriptions there are"}):d});if(!i.enabled)throw Qt(i,"sending it again");let[s=[]]=await e.run([{sql:`UPDATE event_deliveries SET status = 'pending', attempts = 0, next_attempt_at = ?1, redelivered_at = ?1, claimed_until = NULL
 WHERE id = ?2 AND organization_id = ?3 AND status IN ('pending', 'dead') AND (claimed_until IS NULL OR claimed_until <= ?1)
-RETURNING id`,params:[n,r.id,t.id]}]),o=await Z(e,t.id,r.id)??r,d=s.length>0?"queued":o.status==="delivered"?"delivered":"attempting";return{delivery:o,previous:r,outcome:d}}async function Ea(e,t){await R(e);let a=t.now??Date.now(),n=K(a),r=X(),i={subscription:{id:t.subscription.id,name:t.subscription.name},message:"A test event from everyapp events test. A signed delivery like this one means the subscription works."};return await e.run([{sql:`INSERT INTO events (id, organization_id, type, version, time, actor, data, app_row_id, dedupe_key, created_at)
+RETURNING id`,params:[n,r.id,t.id]}]),o=await Z(e,t.id,r.id)??r,u=s.length>0?"queued":o.status==="delivered"?"delivered":"attempting";return{delivery:o,previous:r,outcome:u}}async function ha(e,t){await R(e);let a=t.now??Date.now(),n=K(a),r=X(),i={subscription:{id:t.subscription.id,name:t.subscription.name},message:"A test event from everyapp events test. A signed delivery like this one means the subscription works."};return await e.run([{sql:`INSERT INTO events (id, organization_id, type, version, time, actor, data, app_row_id, dedupe_key, created_at)
 VALUES (?1, ?2, 'ping', ?3, ?4, ?5, ?6, NULL, NULL, ?4)`,params:[n,t.organizationId,U("ping").version,a,JSON.stringify(t.actor),JSON.stringify(i)]},{sql:`INSERT INTO event_deliveries (id, event_id, subscription_id, organization_id, status, attempts, next_attempt_at, created_at)
-VALUES (?1, ?2, ?3, ?4, 'pending', 0, ?5, ?5)`,params:[r,n,t.subscription.id,t.organizationId,a]}]),{eventId:n,deliveryId:r}}var en=9e4;async function ya(e,t,a,n={}){let r=n.sleep??(o=>new Promise(d=>setTimeout(d,o))),i=n.now??Date.now,s=i()+(n.timeoutMs??en);for(;;){let o=await Z(e,t,a);if(o&&Zt(o,i())!=="pending")return o;if(i()>=s)return null;await r(Math.min(n.intervalMs??3e3,Math.max(0,s-i())))}}import{randomUUID as tn}from"node:crypto";function ut(e,t,a=process.env){return a.CLOUDFLARE_API_TOKEN||!e?{actor:`api-token:${t}`,email:null}:{actor:e,email:e}}function nn(e){return e instanceof C?new l(e.code,e.message,{retryable:e.status>=500}):e}async function oe(e){try{return await e()}catch(t){throw nn(t)}}var dt="id, organization_id, app_slug, name, description, hostname, worker_name, tier, scope, manifest, status, version_id, deployed_at, deployed_by_actor, is_default, email_senders, email_inbound",an=`${dt}, secret_names`,st=new WeakMap;function I(e){let t=st.get(e);return t||(t=e.run([{sql:"PRAGMA table_info(apps)"}]).then(([a=[]])=>a.some(n=>n.name==="secret_names")),st.set(e,t)),t}async function k(e){return await I(e)?an:dt}var m=e=>e==null?null:String(e);function P(e){return{id:String(e.id),organizationId:String(e.organization_id),appSlug:String(e.app_slug),name:String(e.name),description:String(e.description),hostname:m(e.hostname),workerName:m(e.worker_name),tier:String(e.tier),scope:String(e.scope),manifest:m(e.manifest),status:String(e.status),versionId:m(e.version_id),deployedAt:e.deployed_at==null?null:Number(e.deployed_at),deployedByActor:m(e.deployed_by_actor),isDefault:!!Number(e.is_default),emailSenders:m(e.email_senders),emailInbound:m(e.email_inbound),secretNames:m(e.secret_names)}}function ot(e){return e?{organizationId:String(e.organization_id),appSlug:String(e.app_slug),hostname:m(e.hostname),workerName:m(e.worker_name)}:null}function lt(e){return e?{id:String(e.id),name:String(e.name),slug:String(e.slug)}:null}var ct={sql:`SELECT id, name, slug FROM organizations
+VALUES (?1, ?2, ?3, ?4, 'pending', 0, ?5, ?5)`,params:[r,n,t.subscription.id,t.organizationId,a]}]),{eventId:n,deliveryId:r}}var nn=9e4;async function Da(e,t,a,n={}){let r=n.sleep??(o=>new Promise(u=>setTimeout(u,o))),i=n.now??Date.now,s=i()+(n.timeoutMs??nn);for(;;){let o=await Z(e,t,a);if(o&&en(o,i())!=="pending")return o;if(i()>=s)return null;await r(Math.min(n.intervalMs??3e3,Math.max(0,s-i())))}}import{randomUUID as an}from"node:crypto";function ct(e,t,a=process.env){return a.CLOUDFLARE_API_TOKEN||!e?{actor:`api-token:${t}`,email:null}:{actor:e,email:e}}function rn(e){return e instanceof C?new l(e.code,e.message,{retryable:e.status>=500}):e}async function oe(e){try{return await e()}catch(t){throw rn(t)}}var pt="id, organization_id, app_slug, name, description, hostname, worker_name, tier, scope, manifest, status, version_id, deployed_at, deployed_by_actor, is_default, email_senders, email_inbound",sn=`${pt}, secret_names`,lt=new WeakMap;function I(e){let t=lt.get(e);return t||(t=e.run([{sql:"PRAGMA table_info(apps)"}]).then(([a=[]])=>a.some(n=>n.name==="secret_names")),lt.set(e,t)),t}async function k(e){return await I(e)?sn:pt}var g=e=>e==null?null:String(e);function P(e){return{id:String(e.id),organizationId:String(e.organization_id),appSlug:String(e.app_slug),name:String(e.name),description:String(e.description),hostname:g(e.hostname),workerName:g(e.worker_name),tier:String(e.tier),scope:String(e.scope),manifest:g(e.manifest),status:String(e.status),versionId:g(e.version_id),deployedAt:e.deployed_at==null?null:Number(e.deployed_at),deployedByActor:g(e.deployed_by_actor),isDefault:!!Number(e.is_default),emailSenders:g(e.email_senders),emailInbound:g(e.email_inbound),secretNames:g(e.secret_names)}}function ut(e){return e?{organizationId:String(e.organization_id),appSlug:String(e.app_slug),hostname:g(e.hostname),workerName:g(e.worker_name)}:null}function dt(e){return e?{id:String(e.id),name:String(e.name),slug:String(e.slug)}:null}var mt={sql:`SELECT id, name, slug FROM organizations
 WHERE EXISTS (SELECT 1 FROM members WHERE members.organization_id = organizations.id AND members.role = 'owner')
-ORDER BY created_at, id LIMIT 1`},pt={sql:"SELECT id, name, slug FROM organizations ORDER BY created_at, id LIMIT 1"};async function mt(e){let[t=[],a=[]]=await e.run([ct,pt]);return gt(t,a)}function gt(e,t){let a=lt(e[0]);if(a)return{organization:a,hasOwner:!0};let n=lt(t[0]);return n?{organization:n,hasOwner:!1}:null}function rn(e){return e.trim().toLowerCase().replace(/[^a-z0-9\s-]/g,"").replace(/\s+/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"").slice(0,48)}async function sn(e,t,a){let n=await mt(e);if(n)return n;let r=t.trim()||"My Organization",[,i=[],s=[]]=await e.run([{sql:`INSERT INTO organizations (id, name, slug, created_at)
-SELECT ?1, ?2, ?3, ?4 WHERE NOT EXISTS (SELECT 1 FROM organizations)`,params:[tn(),r,rn(r)||"default",a]},ct,pt]),o=gt(i,s);if(!o)throw new Error("The gateway's database has no organization.");return o}function on(e,t){let a=$e(t);return{sql:`WITH candidates(rank, candidate) AS (VALUES ${a.map((r,i)=>`(${i}, ?${i+2})`).join(", ")})
+ORDER BY created_at, id LIMIT 1`},gt={sql:"SELECT id, name, slug FROM organizations ORDER BY created_at, id LIMIT 1"};async function _t(e){let[t=[],a=[]]=await e.run([mt,gt]);return ft(t,a)}function ft(e,t){let a=dt(e[0]);if(a)return{organization:a,hasOwner:!0};let n=dt(t[0]);return n?{organization:n,hasOwner:!1}:null}function on(e){return e.trim().toLowerCase().replace(/[^a-z0-9\s-]/g,"").replace(/\s+/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"").slice(0,48)}async function ln(e,t,a){let n=await _t(e);if(n)return n;let r=t.trim()||"My Organization",[,i=[],s=[]]=await e.run([{sql:`INSERT INTO organizations (id, name, slug, created_at)
+SELECT ?1, ?2, ?3, ?4 WHERE NOT EXISTS (SELECT 1 FROM organizations)`,params:[an(),r,on(r)||"default",a]},mt,gt]),o=ft(i,s);if(!o)throw new Error("The gateway's database has no organization.");return o}function un(e,t){let a=$e(t);return{sql:`WITH candidates(rank, candidate) AS (VALUES ${a.map((r,i)=>`(${i}, ?${i+2})`).join(", ")})
 INSERT OR IGNORE INTO organization_keys (organization_id, org_key)
 SELECT ?1, candidate FROM candidates
 WHERE NOT EXISTS (SELECT 1 FROM organization_keys WHERE organization_id = ?1)
   AND candidate NOT IN (SELECT org_key FROM organization_keys)
-ORDER BY rank LIMIT 1`,params:[e,...a]}}function va(e,t){return oe(()=>ln(e,t))}async function ln(e,t){let a=t.now??Date.now(),{organization:n,hasOwner:r}=await sn(e,t.organizationName,a),[,i=[],s=[],o=[],d=[]]=await e.run([on(n.id,n.slug),{sql:"SELECT org_key FROM organization_keys WHERE organization_id = ?",params:[n.id]},{sql:`SELECT ${await k(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[n.id,t.appSlug]},..._t(n.id,t.deployer.email)]),u=m(i[0]?.org_key);if(!u)throw new C({status:409,code:"ORG_KEY_UNAVAILABLE",message:`Every key for organization "${n.slug}" is taken by another organization on this gateway.`});let g=s[0]?P(s[0]):null,D=Ue({appSlug:t.appSlug,orgKey:u,isInstallOrganization:!0,appBaseDomain:t.appBaseDomain,existingApp:g}),[O=[],p=[]]=await e.run([{sql:"SELECT organization_id, app_slug, hostname, worker_name FROM apps WHERE hostname = ?",params:[D.hostname]},{sql:"SELECT organization_id, app_slug, hostname, worker_name FROM apps WHERE worker_name = ?",params:[D.workerName]}]),_=m(d[0]?.id),T=ft(o),w=ze({organizationId:n.id,isInstallOrganization:!0,scope:t.scope,appSlug:t.appSlug,name:t.name,description:t.description,manifest:t.manifest,appBaseDomain:t.appBaseDomain,orgKey:u,existingApp:g,hostnameOwner:ot(O[0]),workerNameOwner:ot(p[0]),members:T,deployerUserId:_});if(w.app.scope==="shared"&&Et(t.deployer,_,T,n,t.expectedWorkerName===void 0?"deploy":"register"),t.expectedWorkerName!==void 0&&w.app.workerName!==t.expectedWorkerName)throw new l("WORKER_NAME_MISMATCH",`${t.appSlug}'s Worker must be named ${w.app.workerName}, not ${t.expectedWorkerName}
-The Gateway binds each app's Worker by that name only.`,{fix:`deploy the Worker as ${w.app.workerName}`,rerun:`${A("--worker")} --worker ${w.app.workerName}`});return await e.run(dn(w,a,{secretNames:await I(e)})),{plan:w,organization:n,hasOwner:r,deployerGranted:_!==null&&w.grants.some(St=>St.userId===_)}}function _t(e,t){return[{sql:"SELECT user_id, role FROM members WHERE organization_id = ?",params:[e]},{sql:"SELECT id FROM users WHERE lower(email) = lower(?) AND email_verified = 1",params:[t]}]}function ft(e){return e.map(t=>({id:String(t.user_id),role:m(t.role)}))}var un=e=>(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()));function Et(e,t,a,n,r){if(e.email===null)return;let i=a.find(s=>s.id===t);if(!(i&&un(i.role)))throw new l("SHARED_APP_FORBIDDEN",`Only ${n.name} owners and admins can ${r} shared apps
-${e.email} isn't an owner or admin of ${n.name}, the platform organization.`,{fix:`ask an owner of ${n.name} to make you an admin, or to do it for you`})}function dn(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,t,n.id]}];let r=e.grants.map(i=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
+ORDER BY rank LIMIT 1`,params:[e,...a]}}function Oa(e,t){return oe(()=>dn(e,t))}async function dn(e,t){let a=t.now??Date.now(),{organization:n,hasOwner:r}=await ln(e,t.organizationName,a),[,i=[],s=[],o=[],u=[]]=await e.run([un(n.id,n.slug),{sql:"SELECT org_key FROM organization_keys WHERE organization_id = ?",params:[n.id]},{sql:`SELECT ${await k(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[n.id,t.appSlug]},...Et(n.id,t.deployer.email)]),d=g(i[0]?.org_key);if(!d)throw new C({status:409,code:"ORG_KEY_UNAVAILABLE",message:`Every key for organization "${n.slug}" is taken by another organization on this gateway.`});let m=s[0]?P(s[0]):null,D=Ue({appSlug:t.appSlug,orgKey:d,isInstallOrganization:!0,appBaseDomain:t.appBaseDomain,existingApp:m}),[O=[],p=[]]=await e.run([{sql:"SELECT organization_id, app_slug, hostname, worker_name FROM apps WHERE hostname = ?",params:[D.hostname]},{sql:"SELECT organization_id, app_slug, hostname, worker_name FROM apps WHERE worker_name = ?",params:[D.workerName]}]),_=g(u[0]?.id),T=yt(o),w=ze({organizationId:n.id,isInstallOrganization:!0,scope:t.scope,appSlug:t.appSlug,name:t.name,description:t.description,manifest:t.manifest,appBaseDomain:t.appBaseDomain,orgKey:d,existingApp:m,hostnameOwner:ut(O[0]),workerNameOwner:ut(p[0]),members:T,deployerUserId:_});if(w.app.scope==="shared"&&wt(t.deployer,_,T,n,t.expectedWorkerName===void 0?"deploy":"register"),t.expectedWorkerName!==void 0&&w.app.workerName!==t.expectedWorkerName)throw new l("WORKER_NAME_MISMATCH",`${t.appSlug}'s Worker must be named ${w.app.workerName}, not ${t.expectedWorkerName}
+The Gateway binds each app's Worker by that name only.`,{fix:`deploy the Worker as ${w.app.workerName}`,rerun:`${A("--worker")} --worker ${w.app.workerName}`});return await e.run(pn(w,a,{secretNames:await I(e)})),{plan:w,organization:n,hasOwner:r,deployerGranted:_!==null&&w.grants.some(Ot=>Ot.userId===_)}}function Et(e,t){return[{sql:"SELECT user_id, role FROM members WHERE organization_id = ?",params:[e]},{sql:"SELECT id FROM users WHERE lower(email) = lower(?) AND email_verified = 1",params:[t]}]}function yt(e){return e.map(t=>({id:String(t.user_id),role:g(t.role)}))}var cn=e=>(e??"").split(",").some(t=>["owner","admin"].includes(t.trim()));function wt(e,t,a,n,r){if(e.email===null)return;let i=a.find(s=>s.id===t);if(!(i&&cn(i.role)))throw new l("SHARED_APP_FORBIDDEN",`Only ${n.name} owners and admins can ${r} shared apps
+${e.email} isn't an owner or admin of ${n.name}, the platform organization.`,{fix:`ask an owner of ${n.name} to make you an admin, or to do it for you`})}function pn(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,t,n.id]}];let r=e.grants.map(i=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
 VALUES (?, ?, ?, ?, NULL) ON CONFLICT DO NOTHING`,params:[i.id,i.userId,i.appRowId,i.organizationId]}));return e.kind==="new"?[{sql:`INSERT INTO apps (id, organization_id, app_slug, name, description, hostname,
   worker_name, tier, manifest, status, version_id, deployed_at, deployed_by_actor,
   is_default, created_at, updated_at, scope)
 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?15, ?16)`,params:[n.id,n.organizationId,n.appSlug,n.name,n.description,n.hostname,n.workerName,n.tier,n.manifest,n.status,n.versionId,n.deployedAt,n.deployedByActor,n.isDefault?1:0,t,n.scope]},...r]:[{sql:`UPDATE apps SET name = ?, description = ?, hostname = ?, worker_name = ?,
   manifest = ?, status = ?, is_default = ?, updated_at = ?
-WHERE id = ? AND status = '${E}'`,params:[n.name,n.description,n.hostname,n.workerName,n.manifest,n.status,n.isDefault?1:0,t,n.id]},...yt(n,t,a),...r]}function yt(e,t,{secretNames:a=!0}={}){let n=[e.id,e.organizationId];return[{sql:`UPDATE apps SET email_senders = NULL, email_inbound = NULL${a?", secret_names = NULL":""} WHERE id = ? AND organization_id = ?`,params:n},{sql:"DELETE FROM user_app_access WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM group_app_access WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:`UPDATE user_access_tokens SET revoked_at = ?1, updated_at = ?1
-WHERE app_row_id = ?2 AND organization_id = ?3 AND revoked_at IS NULL`,params:[t,...n]},{sql:"DELETE FROM app_tools WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM mcp_connection_apps WHERE app_row_id = ?",params:[e.id]},{sql:"DELETE FROM org_app_settings WHERE app_row_id = ?",params:[e.id]}]}async function cn(e,t){let[a=[]]=await e.run([{sql:`SELECT ${await k(e)} FROM apps WHERE id = ?`,params:[t]}]);return a[0]?P(a[0]):null}var pn=3,ie=e=>({id:e.appSlug,rowId:e.id,name:e.name});async function mn(e,t,a,n){let r=t.status==="pending";return!r&&t.versionId===a.versionId?[]:te(e,{organizationId:t.organizationId,type:r?"app.installed":"app.updated",actor:Q({actor:a.actor,email:a.email??null}),data:r?{app:ie(t),version:a.versionId,...t.hostname?{hostname:t.hostname}:{},scope:t.scope==="shared"?"shared":"org",source:a.source??"cli"}:{app:ie(t),version:a.versionId,...t.versionId?{previousVersion:t.versionId}:{}},appRowId:t.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND version_id = ?)",params:[t.id,a.versionId]},now:n})}function Sa(e,t,a){return oe(async()=>{let n=await I(e);for(let r=1;;r+=1){let i=await cn(e,t);if(!i)throw new C({status:404,code:"APP_NOT_FOUND",message:"The app's registry row is gone; deploy it again."});let s=Ge(i,a),o=await mn(e,i,a,s.deployedAt),[d=[]]=await e.run([{sql:`UPDATE apps SET manifest = ?, version_id = ?, deployed_at = ?, deployed_by_actor = ?,
+WHERE id = ? AND status = '${E}'`,params:[n.name,n.description,n.hostname,n.workerName,n.manifest,n.status,n.isDefault?1:0,t,n.id]},...ht(n,t,a),...r]}function ht(e,t,{secretNames:a=!0}={}){let n=[e.id,e.organizationId];return[{sql:`UPDATE apps SET email_senders = NULL, email_inbound = NULL${a?", secret_names = NULL":""} WHERE id = ? AND organization_id = ?`,params:n},{sql:"DELETE FROM user_app_access WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM group_app_access WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:`UPDATE user_access_tokens SET revoked_at = ?1, updated_at = ?1
+WHERE app_row_id = ?2 AND organization_id = ?3 AND revoked_at IS NULL`,params:[t,...n]},{sql:"DELETE FROM app_tools WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM mcp_connection_apps WHERE app_row_id = ?",params:[e.id]},{sql:"DELETE FROM org_app_settings WHERE app_row_id = ?",params:[e.id]}]}async function mn(e,t){let[a=[]]=await e.run([{sql:`SELECT ${await k(e)} FROM apps WHERE id = ?`,params:[t]}]);return a[0]?P(a[0]):null}var gn=3,ie=e=>({id:e.appSlug,rowId:e.id,name:e.name});async function _n(e,t,a,n){let r=t.status==="pending";return!r&&t.versionId===a.versionId?[]:te(e,{organizationId:t.organizationId,type:r?"app.installed":"app.updated",actor:Q({actor:a.actor,email:a.email??null}),data:r?{app:ie(t),version:a.versionId,...t.hostname?{hostname:t.hostname}:{},scope:t.scope==="shared"?"shared":"org",source:a.source??"cli"}:{app:ie(t),version:a.versionId,...t.versionId?{previousVersion:t.versionId}:{}},appRowId:t.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND version_id = ?)",params:[t.id,a.versionId]},now:n})}function La(e,t,a){return oe(async()=>{let n=await I(e);for(let r=1;;r+=1){let i=await mn(e,t);if(!i)throw new C({status:404,code:"APP_NOT_FOUND",message:"The app's registry row is gone; deploy it again."});let s=Ge(i,a),o=await _n(e,i,a,s.deployedAt),[u=[]]=await e.run([{sql:`UPDATE apps SET manifest = ?, version_id = ?, deployed_at = ?, deployed_by_actor = ?,
   status = ?, updated_at = ?${n?", secret_names = COALESCE(?, secret_names)":""}
-WHERE id = ? AND status = ? RETURNING status`,params:[s.manifest,s.versionId,s.deployedAt,s.deployedByActor,s.status,s.deployedAt,...n?[a.secretNames?V(a.secretNames):null]:[],t,i.status]},...o]);if(d.length>0)return s.status;if(r>=pn)throw new l("APP_CHANGING",`The app's registry row keeps changing while this deploy records its upload
-The upload is kept.`,{retryable:!0})}})}function x(e){return{id:e.id,appSlug:e.appSlug,organizationId:e.organizationId,status:e.status,workerName:e.workerName??"",hostname:e.hostname??"",resources:Me(e),email:{senders:v(e.emailSenders),inbound:v(e.emailInbound)},declaresInbound:_n(e.manifest),publicRoutes:Oe(e.manifest),mcp:Le(e.manifest),manifest:gn(e.manifest),secretNames:xe(e.secretNames),tier:e.tier}}function gn(e){if(!e)return null;try{let t=JSON.parse(e);return t&&typeof t=="object"&&!Array.isArray(t)?t:null}catch{return null}}function _n(e){if(!e)return!1;try{let a=JSON.parse(e)?.email?.inbound;return a===!0||Array.isArray(a)}catch{return!1}}async function le(e,t){let a=await mt(e);if(!a)return null;let[n=[]]=await e.run([{sql:`SELECT ${await k(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[a.organization.id,t]}]);return n[0]?{app:P(n[0]),organization:a.organization}:null}async function wt(e,t,a,n){if(t.email===null)return;let[r=[],i=[]]=await e.run(_t(a.id,t.email));Et(t,m(i[0]?.id),ft(r),a,n)}function se(e){return new l("APP_NOT_FOUND",`${e} isn't deployed to this Gateway yet`,{rerun:`${c} deploy`,rerunNote:"in the app's directory"})}async function Ia(e,t){let a=await fn(e,t);if(!a)throw se(t);return a}async function fn(e,t){let a=(await le(e,t))?.app;return a&&ht(a)?x(a):null}function ht(e){return e.status!==E&&!!e.workerName}async function Oa(e,t){let[a=[]]=await e.run([{sql:"SELECT email_senders, email_inbound FROM apps WHERE id = ?",params:[t]}]),n=a[0];if(!n)throw new l("APP_NOT_FOUND","The app is no longer registered on this Gateway",{rerun:`${c} deploy`,rerunNote:"in the app's directory"});return{senders:v(n.email_senders),inbound:v(n.email_inbound)}}async function La(e,t,a,n,r=Date.now()){return oe(async()=>{let i=await le(e,t);if(!i||!ht(i.app))throw se(t);let{app:s,organization:o}=i;s.scope==="shared"&&await wt(e,n,o,"change the email of");let d=$(a.senders),u=$(a.inbound),[g=[]]=await e.run([{sql:`UPDATE apps SET email_senders = ?, email_inbound = ?, updated_at = ?
-WHERE id = ? AND status != '${E}' RETURNING id`,params:[d,u,r,s.id]}]);if(g.length===0)throw se(t);return x({...s,emailSenders:d,emailInbound:u})})}async function Ca(e,t,a,n=Date.now()){await I(e)&&await e.run([{sql:`UPDATE apps SET secret_names = ?, updated_at = ?
-WHERE id = ? AND status != '${E}'`,params:[V(a),n,t]}])}async function ka(e,t){let[a=[]]=await e.run([{sql:`SELECT app_slug FROM apps WHERE status != '${E}' AND (worker_name = ? OR substr(?, 1, length(worker_name) + 2) = worker_name || '--')`,params:[t,t]}]);return m(a[0]?.app_slug)}async function Pa(e){let[t=[]]=await e.run([{sql:`SELECT ${await k(e)} FROM apps WHERE status != '${E}' ORDER BY app_slug, organization_id`}]);return t.map(P).map(a=>({...x(a),deployedBy:a.deployedByActor,deployedAt:a.deployedAt}))}async function xa(e){let[t=[]]=await e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'apps'"}]);if(t.length===0)return[];let[a=[]]=await e.run([{sql:"SELECT app_slug, hostname, worker_name, status FROM apps ORDER BY app_slug"}]);return a.map(n=>({appSlug:String(n.app_slug),hostname:m(n.hostname),workerName:m(n.worker_name),status:String(n.status)}))}async function $a(e,t,a,n=Date.now(),{purge:r=!1}={}){let i=await le(e,t);if(i&&i.app.tier===pe&&i.app.status!==E)throw new l("APP_NOT_FOUND",`${t} is an MCP app, not an app deployed to this Gateway`,{rerun:`${c} mcp remove ${t}`,rerunNote:"removes an MCP app"});if(!i||!i.app.workerName)throw new l("APP_NOT_FOUND",`No app named ${t} on this Gateway`,{rerun:`${c} status`,rerunNote:"lists its apps"});let{app:s,organization:o}=i;s.scope==="shared"&&await wt(e,a,o,"delete");let d=We(s);return d&&await e.run([{sql:"UPDATE apps SET status = ?, is_default = ?, updated_at = ? WHERE id = ?",params:[d.status,d.isDefault?1:0,n,s.id]},...yt(s,n,{secretNames:await I(e)}),...await te(e,{organizationId:s.organizationId,type:"app.removed",actor:Q(a),data:{app:ie(s),purged:r},appRowId:s.id,now:n})]),{...x(s),status:E,alreadyDeleted:d===null}}var ue="every-app-gateway",Dt="every-app-gateway-OAUTH_KV";async function za(e){let t=await Xe(e,ue),a=await Je(e,Dt);return{d1Id:t.id,oauthKvId:a.id,created:[...t.created?[`D1 ${ue}`]:[],...a.created?[`KV ${Dt}`]:[]]}}function bt(e){return B(e,ue)}async function Rt({whoami:e,createCf:t,accountId:a,host:n,hostFlag:r,interactive:i,pick:s=wn}){let o=a||process.env.CLOUDFLARE_ACCOUNT_ID||void 0,d=(e.accounts??[]).map(p=>({id:p.id,name:p.name??null})),u=o&&!d.some(p=>p.id===o)?[...d,{id:o,name:null}]:d,g=(await Promise.all(u.map(p=>En(p,t)))).filter(p=>p!==null),D={probed:u,found:g,...o?{requestedAccountId:o}:{}};if(o)return{...D,gateway:g.find(p=>p.account.id===o)??null};if(g.length<=1)return{...D,gateway:g[0]??null};let O=n?g.filter(p=>p.install?.gatewayHost.toLowerCase()===n.toLowerCase()):[];if(O.length===1)return{...D,gateway:O[0]};if(i)return{...D,gateway:await s(g,e)};throw new L("choose_account",`Choose which Gateway to use
-${e.email??"This login"} sees a Gateway in ${g.length} Cloudflare accounts. Run one of:`,void 0,{rerun:null,data:{choices:g.map(p=>{let _=p.install?.gatewayHost,T=r&&_;return{accountId:p.account.id,accountName:p.account.name,gatewayUrl:_?`https://${_}`:null,label:T?p.account.name??p.account.id:[p.account.name,_].filter(Boolean).join(" \xB7 "),rerun:T?`${A(r)} ${r} ${_}`:ce(["--account-id",p.account.id])}})}})}async function En(e,t){let a=t(e.id);try{let n=await bt(a);if(!n)return null;let r=He(a,n);return{account:e,cf:a,databaseId:n,db:r,install:await Ke(r)}}catch(n){if(S(n,"auth")||S(n,"not_found"))return null;throw n}}function de(e,t){if(e.gateway)return e.gateway;let a=t.email?[`Logged in to Cloudflare as ${t.email}.`]:[],n={accounts:e.probed};if(e.requestedAccountId&&e.found.length>0)throw new l("GATEWAY_NOT_FOUND",[`Cloudflare account ${e.requestedAccountId} has no Gateway`,`This login's Gateway${e.found.length===1?" is":"s are"} in ${e.found.map(yn).join("; ")}.`].join(`
+WHERE id = ? AND status = ? RETURNING status`,params:[s.manifest,s.versionId,s.deployedAt,s.deployedByActor,s.status,s.deployedAt,...n?[a.secretNames?V(a.secretNames):null]:[],t,i.status]},...o]);if(u.length>0)return s.status;if(r>=gn)throw new l("APP_CHANGING",`The app's registry row keeps changing while this deploy records its upload
+The upload is kept.`,{retryable:!0})}})}function x(e){return{id:e.id,appSlug:e.appSlug,organizationId:e.organizationId,status:e.status,workerName:e.workerName??"",hostname:e.hostname??"",resources:Me(e),email:{senders:v(e.emailSenders),inbound:v(e.emailInbound)},declaresInbound:En(e.manifest),publicRoutes:Oe(e.manifest),mcp:Le(e.manifest),manifest:fn(e.manifest),secretNames:xe(e.secretNames),tier:e.tier}}function fn(e){if(!e)return null;try{let t=JSON.parse(e);return t&&typeof t=="object"&&!Array.isArray(t)?t:null}catch{return null}}function En(e){if(!e)return!1;try{let a=JSON.parse(e)?.email?.inbound;return a===!0||Array.isArray(a)}catch{return!1}}async function le(e,t){let a=await _t(e);if(!a)return null;let[n=[]]=await e.run([{sql:`SELECT ${await k(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[a.organization.id,t]}]);return n[0]?{app:P(n[0]),organization:a.organization}:null}async function Dt(e,t,a,n){if(t.email===null)return;let[r=[],i=[]]=await e.run(Et(a.id,t.email));wt(t,g(i[0]?.id),yt(r),a,n)}function se(e){return new l("APP_NOT_FOUND",`${e} isn't deployed to this Gateway yet`,{rerun:`${c} deploy`,rerunNote:"in the app's directory"})}async function Ca(e,t){let a=await yn(e,t);if(!a)throw se(t);return a}async function yn(e,t){let a=(await le(e,t))?.app;return a&&bt(a)?x(a):null}function bt(e){return e.status!==E&&!!e.workerName}async function ka(e,t){let[a=[]]=await e.run([{sql:"SELECT email_senders, email_inbound FROM apps WHERE id = ?",params:[t]}]),n=a[0];if(!n)throw new l("APP_NOT_FOUND","The app is no longer registered on this Gateway",{rerun:`${c} deploy`,rerunNote:"in the app's directory"});return{senders:v(n.email_senders),inbound:v(n.email_inbound)}}async function Pa(e,t,a,n,r=Date.now()){return oe(async()=>{let i=await le(e,t);if(!i||!bt(i.app))throw se(t);let{app:s,organization:o}=i;s.scope==="shared"&&await Dt(e,n,o,"change the email of");let u=$(a.senders),d=$(a.inbound),[m=[]]=await e.run([{sql:`UPDATE apps SET email_senders = ?, email_inbound = ?, updated_at = ?
+WHERE id = ? AND status != '${E}' RETURNING id`,params:[u,d,r,s.id]}]);if(m.length===0)throw se(t);return x({...s,emailSenders:u,emailInbound:d})})}async function xa(e,t,a,n=Date.now()){await I(e)&&await e.run([{sql:`UPDATE apps SET secret_names = ?, updated_at = ?
+WHERE id = ? AND status != '${E}'`,params:[V(a),n,t]}])}async function $a(e,t){let[a=[]]=await e.run([{sql:`SELECT app_slug FROM apps WHERE status != '${E}' AND (worker_name = ? OR substr(?, 1, length(worker_name) + 2) = worker_name || '--')`,params:[t,t]}]);return g(a[0]?.app_slug)}async function Ua(e){let[t=[]]=await e.run([{sql:`SELECT ${await k(e)} FROM apps WHERE status != '${E}' ORDER BY app_slug, organization_id`}]);return t.map(P).map(a=>({...x(a),deployedBy:a.deployedByActor,deployedAt:a.deployedAt}))}async function Ma(e){let[t=[]]=await e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'apps'"}]);if(t.length===0)return[];let[a=[]]=await e.run([{sql:"SELECT app_slug, hostname, worker_name, status FROM apps ORDER BY app_slug"}]);return a.map(n=>({appSlug:String(n.app_slug),hostname:g(n.hostname),workerName:g(n.worker_name),status:String(n.status)}))}async function za(e,t,a,n=Date.now(),{purge:r=!1}={}){let i=await le(e,t);if(i&&i.app.tier===pe&&i.app.status!==E)throw new l("APP_NOT_FOUND",`${t} is an MCP app, not an app deployed to this Gateway`,{rerun:`${c} mcp remove ${t}`,rerunNote:"removes an MCP app"});if(!i||!i.app.workerName)throw new l("APP_NOT_FOUND",`No app named ${t} on this Gateway`,{rerun:`${c} status`,rerunNote:"lists its apps"});let{app:s,organization:o}=i;s.scope==="shared"&&await Dt(e,a,o,"delete");let u=We(s);return u&&await e.run([{sql:"UPDATE apps SET status = ?, is_default = ?, updated_at = ? WHERE id = ?",params:[u.status,u.isDefault?1:0,n,s.id]},...ht(s,n,{secretNames:await I(e)}),...await te(e,{organizationId:s.organizationId,type:"app.removed",actor:Q(a),data:{app:ie(s),purged:r},appRowId:s.id,now:n})]),{...x(s),status:E,alreadyDeleted:u===null}}var ue="every-app-gateway",Rt="every-app-gateway-OAUTH_KV";async function Fa(e){let t=await Xe(e,ue),a=await Je(e,Rt);return{d1Id:t.id,oauthKvId:a.id,created:[...t.created?[`D1 ${ue}`]:[],...a.created?[`KV ${Rt}`]:[]]}}function Tt(e){return B(e,ue)}async function At({whoami:e,createCf:t,accountId:a,host:n,hostFlag:r,interactive:i,pick:s=Dn}){let o=a||process.env.CLOUDFLARE_ACCOUNT_ID||void 0,u=(e.accounts??[]).map(p=>({id:p.id,name:p.name??null})),d=o&&!u.some(p=>p.id===o)?[...u,{id:o,name:null}]:u,m=(await Promise.all(d.map(p=>wn(p,t)))).filter(p=>p!==null),D={probed:d,found:m,...o?{requestedAccountId:o}:{}};if(o)return{...D,gateway:m.find(p=>p.account.id===o)??null};if(m.length<=1)return{...D,gateway:m[0]??null};let O=n?m.filter(p=>p.install?.gatewayHost.toLowerCase()===n.toLowerCase()):[];if(O.length===1)return{...D,gateway:O[0]};if(i)return{...D,gateway:await s(m,e)};throw new L("choose_account",`Choose which Gateway to use
+${e.email??"This login"} sees a Gateway in ${m.length} Cloudflare accounts. Run one of:`,void 0,{rerun:null,data:{choices:m.map(p=>{let _=p.install?.gatewayHost,T=r&&_;return{accountId:p.account.id,accountName:p.account.name,gatewayUrl:_?`https://${_}`:null,label:T?p.account.name??p.account.id:[p.account.name,_].filter(Boolean).join(" \xB7 "),rerun:T?`${A(r)} ${r} ${_}`:ce(["--account-id",p.account.id])}})}})}async function wn(e,t){let a=t(e.id);try{let n=await Tt(a);if(!n)return null;let r=He(a,n);return{account:e,cf:a,databaseId:n,db:r,install:await Ke(r)}}catch(n){if(S(n,"auth")||S(n,"not_found"))return null;throw n}}function de(e,t){if(e.gateway)return e.gateway;let a=t.email?[`Logged in to Cloudflare as ${t.email}.`]:[],n={accounts:e.probed};if(e.requestedAccountId&&e.found.length>0)throw new l("GATEWAY_NOT_FOUND",[`Cloudflare account ${e.requestedAccountId} has no Gateway`,`This login's Gateway${e.found.length===1?" is":"s are"} in ${e.found.map(hn).join("; ")}.`].join(`
 `),{fix:"pass that account's id to --account-id (or CLOUDFLARE_ACCOUNT_ID), or drop it",data:n});if(e.probed.length===0)throw new l("GATEWAY_NOT_FOUND",["This Cloudflare login lists no accounts",...a].join(`
 `),{fix:"pass the Gateway's account with --account-id, or set CLOUDFLARE_ACCOUNT_ID",data:n});let r=e.probed.map(i=>i.name??i.id);throw new l("GATEWAY_NOT_FOUND",[r.length===1?`No Gateway in ${r[0]}, the only account this login sees`:`No Gateway in the ${r.length} accounts this login sees`,...r.length===1?[]:[`${r.join(", ")}.`],...a,`Or log in to the Gateway's account: ${c} login`].join(`
-`),{rerun:`${c} setup --domain <hostname>`,rerunNote:"to install one",data:n})}function Tt(e,t,a=process.argv.slice(2)){if(!t)return;let n=new URL(t).host.toLowerCase(),r=e.install.gatewayHost.toLowerCase();if(n===r)return;let i=a.some(o=>o==="--gateway"||o.startsWith("--gateway=")),s=e.account.name??e.account.id;throw new l("GATEWAY_URL_MISMATCH",`The Gateway here is ${r}, not ${n}
-Found in ${s}. For ${n}, pass its account with --account-id.`,i?{rerun:A("--gateway",a),rerunNote:`to use ${r}`}:{fix:`unset EVERYAPP_GATEWAY_URL to use ${r}`})}function yn(e){return`${e.account.name??e.account.id}${e.install?` at https://${e.install.gatewayHost}`:""}`}function wn(e,t){return ke("Which Gateway?",e.map(a=>{let n=a.account.name??a.account.id;return a.install?{label:a.install.gatewayHost,hint:n,value:a}:{label:n,value:a}}),{context:[`${t.email??"This login"} sees a Gateway in ${e.length} Cloudflare accounts`]})}var Nt=e=>we({accountId:e});function At(e,t){let a;try{a=new URL(e)}catch{throw new l("INVALID_GATEWAY_URL",t==="--gateway"?`--gateway must be a full URL, not "${e}"
-For example https://apps.example.com.`:`EVERYAPP_GATEWAY_URL must be a full URL, not "${e}"`,t==="--gateway"?{}:{fix:`set it to https://${e.replace(/^\w+:\/\//,"")}, or unset it`})}return a.pathname=a.pathname.replace(/\/+$/,""),a.search="",a.hash="",a.toString().replace(/\/+$/,"")}function ar(e){if(e)return At(e,"--gateway");let t=process.env.EVERYAPP_GATEWAY_URL;return t?At(t,"EVERYAPP_GATEWAY_URL"):void 0}async function vt({createCf:e=Nt,accountId:t,host:a,interactive:n,onDeviceLogin:r}){let i=await Pe({cf:e(),interactive:n,onDeviceLogin:r}),s=await Rt({whoami:i,createCf:e,accountId:t,host:a,interactive:n});return{whoami:i,discovery:s}}function hn(e){let{install:t}=e;if(!t)throw Ye();if(t.liveVersionId===null)throw new l("GATEWAY_NOT_INSTALLED",`The Gateway at https://${t.gatewayHost} isn't finished installing
-Setup stopped before its first upload.`,{rerun:`${c} setup`});return{...e,install:t}}async function rr({json:e,out:t,accountId:a,createCf:n}){let{whoami:r,discovery:i}=await vt({createCf:n,accountId:a,interactive:Ce(e??!1),onDeviceLogin:e?q(t,"gateway.login"):void 0});if(i.found.length===0&&i.probed.length>0&&!i.requestedAccountId){let s=i.probed.map(o=>o.name??o.id);throw new L("install_gateway",[`No Gateway in ${s.length===1?`${s[0]}'s Cloudflare account`:`the ${s.length} Cloudflare accounts this login sees`}${r.email?` (logged in as ${r.email})`:""}`,`Gateway in another account? Log in to it: ${c} login`].join(`
-`),void 0,{rerun:`${c} setup`,rerunNote:"installs one",data:{accounts:i.probed}})}return de(i,r)}async function ir({gateway:e,accountId:t,interactive:a,createCf:n=Nt,onNoGateway:r,login:i}){let s=await vt({createCf:n,accountId:t,host:e?new URL(e).host.toLowerCase():void 0,interactive:a,onDeviceLogin:i?.json?q(i.out,i.step):void 0}),{whoami:o}=s,{discovery:d}=s;r&&d.gateway===null&&d.found.length===0&&d.probed.length>0&&(d=await r({whoami:o,discovery:d}));let u=hn(de(d,o));return Tt(u,e),{cf:u.cf,accountId:u.account.id,accountName:u.account.name,databaseId:u.databaseId,db:u.db,install:u.install,gatewayUrl:`https://${u.install.gatewayHost}`,deployer:ut(o.email,u.account.id)}}export{He as a,An as b,Ot as c,Nn as d,vn as e,Sn as f,In as g,On as h,kn as i,Ye as j,Ke as k,zn as l,B as m,Ut as n,Mt as o,zt as p,qn as q,Vn as r,za as s,bt as t,Rt as u,de as v,Xn as w,Jn as x,Q as y,ee as z,R as A,te as B,ia as C,sa as D,re as E,oa as F,la as G,ua as H,da as I,ca as J,pa as K,ma as L,ga as M,Jt as N,Zt as O,Qt as P,_a as Q,fa as R,Ea as S,en as T,ya as U,ut as V,oe as W,I as X,k as Y,m as Z,P as _,mt as $,sn as aa,va as ba,_t as ca,ft as da,yt as ea,cn as fa,Sa as ga,Ia as ha,fn as ia,Oa as ja,La as ka,Ca as la,ka as ma,Pa as na,xa as oa,$a as pa,ar as qa,rr as ra,ir as sa};
+`),{rerun:`${c} setup --domain <hostname>`,rerunNote:"to install one",data:n})}function Nt(e,t,a=process.argv.slice(2)){if(!t)return;let n=new URL(t).host.toLowerCase(),r=e.install.gatewayHost.toLowerCase();if(n===r)return;let i=a.some(o=>o==="--gateway"||o.startsWith("--gateway=")),s=e.account.name??e.account.id;throw new l("GATEWAY_URL_MISMATCH",`The Gateway here is ${r}, not ${n}
+Found in ${s}. For ${n}, pass its account with --account-id.`,i?{rerun:A("--gateway",a),rerunNote:`to use ${r}`}:{fix:`unset EVERYAPP_GATEWAY_URL to use ${r}`})}function hn(e){return`${e.account.name??e.account.id}${e.install?` at https://${e.install.gatewayHost}`:""}`}function Dn(e,t){return ke("Which Gateway?",e.map(a=>{let n=a.account.name??a.account.id;return a.install?{label:a.install.gatewayHost,hint:n,value:a}:{label:n,value:a}}),{context:[`${t.email??"This login"} sees a Gateway in ${e.length} Cloudflare accounts`]})}var St=e=>we({accountId:e});function vt(e,t){let a;try{a=new URL(e)}catch{throw new l("INVALID_GATEWAY_URL",t==="--gateway"?`--gateway must be a full URL, not "${e}"
+For example https://apps.example.com.`:`EVERYAPP_GATEWAY_URL must be a full URL, not "${e}"`,t==="--gateway"?{}:{fix:`set it to https://${e.replace(/^\w+:\/\//,"")}, or unset it`})}return a.pathname=a.pathname.replace(/\/+$/,""),a.search="",a.hash="",a.toString().replace(/\/+$/,"")}function sr(e){if(e)return vt(e,"--gateway");let t=process.env.EVERYAPP_GATEWAY_URL;return t?vt(t,"EVERYAPP_GATEWAY_URL"):void 0}async function It({createCf:e=St,accountId:t,host:a,interactive:n,onDeviceLogin:r}){let i=await Pe({cf:e(),interactive:n,onDeviceLogin:r}),s=await At({whoami:i,createCf:e,accountId:t,host:a,interactive:n});return{whoami:i,discovery:s}}function bn(e){let{install:t}=e;if(!t)throw Ye();if(t.liveVersionId===null)throw new l("GATEWAY_NOT_INSTALLED",`The Gateway at https://${t.gatewayHost} isn't finished installing
+Setup stopped before its first upload.`,{rerun:`${c} setup`});return{...e,install:t}}async function or({json:e,out:t,accountId:a,createCf:n}){let{whoami:r,discovery:i}=await It({createCf:n,accountId:a,interactive:Ce(e??!1),onDeviceLogin:e?q(t,"gateway.login"):void 0});if(i.found.length===0&&i.probed.length>0&&!i.requestedAccountId){let s=i.probed.map(o=>o.name??o.id);throw new L("install_gateway",[`No Gateway in ${s.length===1?`${s[0]}'s Cloudflare account`:`the ${s.length} Cloudflare accounts this login sees`}${r.email?` (logged in as ${r.email})`:""}`,`Gateway in another account? Log in to it: ${c} login`].join(`
+`),void 0,{rerun:`${c} setup`,rerunNote:"installs one",data:{accounts:i.probed}})}return de(i,r)}async function lr({gateway:e,accountId:t,interactive:a,createCf:n=St,onNoGateway:r,login:i}){let s=await It({createCf:n,accountId:t,host:e?new URL(e).host.toLowerCase():void 0,interactive:a,onDeviceLogin:i?.json?q(i.out,i.step):void 0}),{whoami:o}=s,{discovery:u}=s;r&&u.gateway===null&&u.found.length===0&&u.probed.length>0&&(u=await r({whoami:o,discovery:u}));let d=bn(de(u,o));return Nt(d,e),{cf:d.cf,accountId:d.account.id,accountName:d.account.name,databaseId:d.databaseId,db:d.db,install:d.install,gatewayUrl:`https://${d.install.gatewayHost}`,deployer:ct(o.email,d.account.id)}}export{He as a,vn as b,Ct as c,Sn as d,In as e,On as f,Ln as g,Cn as h,xn as i,Ye as j,Ke as k,Wn as l,B as m,zt as n,Gt as o,Wt as p,Bn as q,Yn as r,Fa as s,Tt as t,At as u,de as v,Zn as w,Qn as x,Q as y,ee as z,oa as A,R as B,te as C,la as D,ua as E,re as F,da as G,ca as H,pa as I,ma as J,ga as K,_a as L,fa as M,Ea as N,Qt as O,en as P,tn as Q,ya as R,wa as S,ha as T,nn as U,Da as V,ct as W,oe as X,I as Y,k as Z,g as _,P as $,_t as aa,ln as ba,Oa as ca,Et as da,yt as ea,ht as fa,mn as ga,La as ha,Ca as ia,yn as ja,ka,Pa as la,xa as ma,$a as na,Ua as oa,Ma as pa,za as qa,sr as ra,or as sa,lr as ta};

package/dist/{chunk-6OGVO7QK.js → chunk-ONGI463M.js}

@@ -1,4 +1,4 @@
-import{b as v}from"./chunk-W3JCQHHU.js";import{f as _}from"./chunk-ONLNJXVQ.js";import{Ab as O,Bb as c,Yb as h,Zb as S,zb as k}from"./chunk-LYNBZ7RV.js";import E from"node:fs/promises";import d from"node:path";import{OutputWorkerSchema as b}from"@cloudflare/config";import R from"node:fs/promises";import g from"node:path";var L=g.join(".cloudflare","output","v0"),A=g.join(L,"workers"),D="default";async function*ie(e){let t=g.join(e,A);for(let n of await R.readdir(t,{withFileTypes:!0})){if(!n.isDirectory())continue;let r=g.join(t,n.name),i=g.join(r,"worker.config.json"),o=JSON.parse(await R.readFile(i,"utf8"));yield{name:n.name,directory:r,file:i,config:o}}}async function oe(e){let t=JSON.parse(await R.readFile(g.join(e,"config.json"),"utf8"));return t.buildContext?.mode==="production"&&!t.buildContext.isPreview}var I=d.join(A,D),j=d.join(I,"worker.config.json"),C=d.join(I,"bundle"),N="__EVERYAPP_PATCH__",B="every-app-gateway";function U(e){return[e.gatewayHost,...[...new Set(e.appHosts)].filter(t=>t!==e.gatewayHost).sort()]}async function ge(e,t){let n=d.join(e,j),r=JSON.parse(await E.readFile(n,"utf8")),i={...r.env??{}};for(let a of Object.keys(i))a.startsWith(k)&&delete i[a];delete i.KV,i.DB={type:"d1",name:B,id:t.d1Id},i.OAUTH_KV={type:"kv",id:t.oauthKvId},i.EVERYAPP_RELEASE={type:"json",value:t.release},i.CF_VERSION_METADATA={type:"version-metadata"};for(let a of[...new Set(t.appWorkers)].sort())i[O(a)]={type:"worker",worker:a};if(r.env=i,t.gatewayHost!==t.appBaseDomain)throw new c("INVALID_APP_BASE_DOMAIN",`Apps live one label below the gateway host ${t.gatewayHost}, so APP_BASE_DOMAIN must be ${t.gatewayHost}, not ${t.appBaseDomain}.`);let o=t.appHosts.filter(a=>!v(a,t.appBaseDomain));if(o.length>0)throw new c("INVALID_APP_HOST",`Refusing to publish ${o.join(", ")} on the gateway: app hosts are one label below ${t.appBaseDomain}.`);i.APP_BASE_DOMAIN={type:"text",value:t.appBaseDomain},r.domains=U(t);let s=(r.triggers??[]).filter(a=>a.type!=="fetch");if(s.length>0?r.triggers=s:delete r.triggers,r.workersDev=!1,r.previewUrls=!1,r.observability??=structuredClone(_),r.manifest){let a={...r.manifest.modules??{}};for(let w of await F(d.join(e,C)))a[w]={type:"sourcemap"};r.manifest={...r.manifest,modules:a}}return V(r,{requireDomain:!0}),await E.writeFile(n,`${JSON.stringify(r,null,2)}
+import{b as v}from"./chunk-52NQ23OH.js";import{g as _}from"./chunk-475IB5UG.js";import{Sb as k,Tb as O,Ub as c,pc as h,qc as S}from"./chunk-NXO2BC3M.js";import E from"node:fs/promises";import d from"node:path";import{OutputWorkerSchema as b}from"@cloudflare/config";import R from"node:fs/promises";import g from"node:path";var L=g.join(".cloudflare","output","v0"),A=g.join(L,"workers"),D="default";async function*ie(e){let t=g.join(e,A);for(let n of await R.readdir(t,{withFileTypes:!0})){if(!n.isDirectory())continue;let r=g.join(t,n.name),i=g.join(r,"worker.config.json"),o=JSON.parse(await R.readFile(i,"utf8"));yield{name:n.name,directory:r,file:i,config:o}}}async function oe(e){let t=JSON.parse(await R.readFile(g.join(e,"config.json"),"utf8"));return t.buildContext?.mode==="production"&&!t.buildContext.isPreview}var I=d.join(A,D),j=d.join(I,"worker.config.json"),C=d.join(I,"bundle"),N="__EVERYAPP_PATCH__",B="every-app-gateway";function U(e){return[e.gatewayHost,...[...new Set(e.appHosts)].filter(t=>t!==e.gatewayHost).sort()]}async function ge(e,t){let n=d.join(e,j),r=JSON.parse(await E.readFile(n,"utf8")),i={...r.env??{}};for(let a of Object.keys(i))a.startsWith(k)&&delete i[a];delete i.KV,i.DB={type:"d1",name:B,id:t.d1Id},i.OAUTH_KV={type:"kv",id:t.oauthKvId},i.EVERYAPP_RELEASE={type:"json",value:t.release},i.CF_VERSION_METADATA={type:"version-metadata"};for(let a of[...new Set(t.appWorkers)].sort())i[O(a)]={type:"worker",worker:a};if(r.env=i,t.gatewayHost!==t.appBaseDomain)throw new c("INVALID_APP_BASE_DOMAIN",`Apps live one label below the gateway host ${t.gatewayHost}, so APP_BASE_DOMAIN must be ${t.gatewayHost}, not ${t.appBaseDomain}.`);let o=t.appHosts.filter(a=>!v(a,t.appBaseDomain));if(o.length>0)throw new c("INVALID_APP_HOST",`Refusing to publish ${o.join(", ")} on the gateway: app hosts are one label below ${t.appBaseDomain}.`);i.APP_BASE_DOMAIN={type:"text",value:t.appBaseDomain},r.domains=U(t);let s=(r.triggers??[]).filter(a=>a.type!=="fetch");if(s.length>0?r.triggers=s:delete r.triggers,r.workersDev=!1,r.previewUrls=!1,r.observability??=structuredClone(_),r.manifest){let a={...r.manifest.modules??{}};for(let w of await F(d.join(e,C)))a[w]={type:"sourcemap"};r.manifest={...r.manifest,modules:a}}return V(r,{requireDomain:!0}),await E.writeFile(n,`${JSON.stringify(r,null,2)}
 `),r}function V(e,{requireDomain:t=!1}={}){let n=b.safeParse(e);if(!n.success)throw new c("INVALID_BUILD_OUTPUT",`The patched Worker config isn't valid Build Output: ${n.error.issues.map(r=>`${r.path.join(".")||"(root)"}: ${r.message}`).join("; ")}`);if(JSON.stringify(e).includes(N))throw new c("INVALID_BUILD_OUTPUT","The Worker config still has a deploy-time placeholder.");if(t&&!n.data.domains?.length)throw new c("INVALID_BUILD_OUTPUT","The gateway has no domain to deploy to.")}async function F(e){let t;try{t=await E.readdir(e,{recursive:!0,withFileTypes:!0})}catch{return[]}return t.filter(n=>n.isFile()&&n.name.endsWith(".map")).map(n=>d.relative(e,d.join(n.parentPath,n.name)).split(d.sep).join("/")).sort()}import{spawn as W}from"node:child_process";import{createHash as $}from"node:crypto";import m from"node:fs/promises";import p from"node:path";import{z as l}from"zod";var Se="every-app-gateway-release.tar.gz",x="v0",M={gateway:new Set([".cloudflare","drizzle","release.json"]),app:new Set([".cloudflare","migrations","release.json"])},H=l.looseObject({schema:l.literal(1),kind:l.string().optional(),version:l.string(),gitSha:l.string(),builtAt:l.string(),cfVersion:l.string(),buildOutputVersion:l.string(),sha256:l.string().regex(/^[0-9a-f]{64}$/),migrations:l.array(l.object({tag:l.string(),when:l.number()})),minCli:l.string(),minSdk:l.string()}),G=H.extend({committedAt:l.string().optional(),pluginVersion:l.string(),configVersion:l.string()});function _e({version:e,commit:t}){return t?`commit ${t.hash}${t.uncommittedChanges?" with uncommitted changes":""}`:e}function ve(e){switch(e.kind){case"checkout":return"this checkout";case"github":return`${e.repo} release ${e.tag}`;case"url":return e.url;case"file":return e.path}}async function K(e){let t=(await m.readdir(e,{recursive:!0,withFileTypes:!0})).filter(n=>n.isFile()).map(n=>p.relative(e,p.join(n.parentPath,n.name)).split(p.sep).join("/")).filter(n=>n!=="release.json");return z(e,t)}async function z(e,t){let n=$("sha256");for(let r of[...t].sort()){let i;try{i=await m.readFile(p.join(e,r))}catch(o){if(!h(o))throw o;n.update(`${r}\0-
 `);continue}n.update(`${r}\0${$("sha256").update(i).digest("hex")}
 `)}return n.digest("hex")}function J(e,t){return new Promise((n,r)=>{let i=W("tar",["-xzf",e,"-C",t],{stdio:"ignore"});i.once("error",r),i.once("close",o=>o===0?n():r(new Error(`tar couldn't extract ${e} (exit ${o})`)))})}async function Y(e,t,n){let r=await m.readdir(e,{recursive:!0,withFileTypes:!0});for(let i of r){let o=p.join(i.parentPath,i.name),s=p.relative(e,o).split(p.sep).join("/");if(i.isSymbolicLink()||!(i.isFile()||i.isDirectory()))throw new c("RELEASE_INVALID",`${t} isn't ${n}: ${s} is a link or a special file, not a regular file.`);if(i.isFile()&&(await m.lstat(o)).nlink>1)throw new c("RELEASE_INVALID",`${t} isn't ${n}: ${s} is a hard link, not a regular file.`)}}function q(e){return typeof e=="string"&&e.length>0&&!p.isAbsolute(e)&&!/[\\\0-\x1f]/.test(e)&&e.split("/").every(t=>t!==""&&t!=="."&&t!=="..")}async function X(e,t,n){let r=p.join(e,".cloudflare","output","v0","workers"),i;try{i=await m.readdir(r)}catch(o){if(h(o))return;throw o}for(let o of i){let s;try{s=JSON.parse(await m.readFile(p.join(r,o,"worker.config.json"),"utf8"))}catch(u){if(h(u))continue;throw u}let a=s?.manifest,f=[a?.mainModule,...Object.keys(a?.modules&&typeof a.modules=="object"?a.modules:{})].filter(u=>u!==void 0).find(u=>!q(u));if(f!==void 0)throw new c("RELEASE_INVALID",`${t} isn't ${n}: its ${o} Worker lists a module outside its bundle: ${String(f)}.`)}}var T={gateway:{a:"a gateway release",the:"Gateway release"},app:{a:"an app release",the:"App release"}};async function Z(e,t,n){let r=T[t],{dir:i,cleanup:o}=await S(`${t}-release-`);try{await J(e,i),await Y(i,e,r.a),await X(i,e,r.a);let s=JSON.parse(await m.readFile(p.join(i,"release.json"),"utf8")),a=s?.kind??"gateway";if(a!==t){let y=a==="app"||a==="gateway"?T[a].a:`a ${String(a)} release`;throw new c("RELEASE_INVALID",`${e} is ${y}, not ${t==="gateway"?"a Gateway release":r.a}.`)}let w=(await m.readdir(i)).filter(y=>!M[t].has(y));if(w.length>0)throw new c("RELEASE_INVALID",`${e} holds more than ${r.a}: ${w.join(", ")}.`);let f=n.safeParse(s);if(!f.success)throw new c("RELEASE_INVALID",`${e} isn't a valid ${r.the.toLowerCase()}

package/dist/chunk-Q44H7KLY.js

@@ -0,0 +1 @@
+import{e as w}from"./chunk-475IB5UG.js";import{y as c,z as y}from"./chunk-JT3R24Y7.js";import{Qb as u,_b as l,uc as s}from"./chunk-NXO2BC3M.js";function p(t){return u(t)}function g(t){return{collectLogs:t.collectLogs??!0,cacheTtl:t.cacheTtl??0}}function C(t,a){let e=g(a);return(t.collect_logs??!1)===e.collectLogs&&(t.cache_ttl??0)===e.cacheTtl}var m=["authentication","byok_only","cache_invalidate_on_update","log_classification","log_management","log_management_strategy","logpush","logpush_public_key","rate_limiting_interval","rate_limiting_limit","rate_limiting_technique","retry_backoff","retry_delay","retry_max_attempts","store_id","workers_ai_billing_mode","zdr"];function f(t){if(!p(t))throw new Error(`"${t}" isn't an AI Gateway id Cloudflare takes: lowercase letters and digits joined by single hyphens, at most 64 characters.`)}async function _(t,a){try{return await s(t,{plane:"account",args:["ai-gateway","gateways","get",a]},c)}catch(e){if(l(e,"not_found"))return null;throw e}}async function A(t,a,e={}){f(a);let{collectLogs:n,cacheTtl:r}=g(e);return s(t,{plane:"account",files:{"ai-gateway.json":{id:a,collect_logs:n,cache_ttl:r,cache_invalidate_on_update:!1,rate_limiting_interval:0,rate_limiting_limit:0,authentication:!1}},args:i=>["ai-gateway","gateways","create","--body",`@${i["ai-gateway.json"]}`]},c)}async function P(t,a){let{id:e,accountId:n,...r}=a;f(e);let i=o=>({id:e,url:w(n,e),created:o});if(await _(t,e))return i(!1);try{return await A(t,e,r),i(!0)}catch(o){if(l(o,"already_exists")&&await _(t,e))return i(!1);throw o}}async function v(t,a,e){let n=Object.fromEntries(m.flatMap(i=>a[i]===void 0||a[i]===null?[]:[[i,a[i]]])),r=g(e);return s(t,{plane:"account",files:{"ai-gateway.json":{cache_invalidate_on_update:!1,rate_limiting_interval:0,rate_limiting_limit:0,...n,collect_logs:r.collectLogs,cache_ttl:r.cacheTtl}},args:i=>["ai-gateway","gateways","update",a.id,"--body",`@${i["ai-gateway.json"]}`]},c)}async function E(t,a){await t.run({plane:"account",mode:"json",args:["ai-gateway","gateways","delete",a,"--force"]})}var d=20,G=50;async function T(t,a){let e=new Map;for(let n=1;n<=G;n+=1){let r=await s(t,{plane:"account",args:["ai-gateway","gateways","list","--search",a,"--per-page",String(d),"--page",String(n)]},y),i=e.size;for(let o of r)e.set(o.id,o);if(r.length<d||e.size===i)break}return[...e.values()]}export{p as a,g as b,C as c,_ as d,A as e,P as f,v as g,E as h,T as i};

package/dist/{chunk-6PGUCTJ6.js → chunk-RXSJENSN.js}

@@ -1,4 +1,4 @@
-import{d as o,f as s}from"./chunk-HOUHG236.js";var r={sql:`CREATE TABLE IF NOT EXISTS _everyapp_restore_points (
+import{d as o,f as s}from"./chunk-ZCJTJDAI.js";var r={sql:`CREATE TABLE IF NOT EXISTS _everyapp_restore_points (
   target TEXT PRIMARY KEY,
   database_id TEXT NOT NULL,
   bookmark TEXT NOT NULL,

package/dist/{chunk-CZTEDWZ2.js → chunk-SMCUCFS4.js}

@@ -1,4 +1,4 @@
-import{b as O,c as Ce,d as Se,e as $e,f as Ae}from"./chunk-N4E5YE4X.js";import{g as de}from"./chunk-AGTCKFRB.js";import{e as q}from"./chunk-E3EPK27P.js";import{A as me}from"./chunk-IFCPALVC.js";import{a as he,b as ve,c as T,d as ke,e as De}from"./chunk-2Y5Q6A5K.js";import{c as we,j as fe,k as ge,n as M,o as ye}from"./chunk-H6QQMY7B.js";import{c as P,i as L}from"./chunk-6OGVO7QK.js";import{e as I,g as be,h as N,i as _}from"./chunk-N5GQLGEC.js";import{a as G}from"./chunk-W3JCQHHU.js";import{g as ue}from"./chunk-ZFCUH5PK.js";import{a as Y}from"./chunk-4JRIS6S6.js";import{a as R,j as oe,s as ie,u as le,v as ce}from"./chunk-RMF4YGD6.js";import{c as ne,d as se,f as re}from"./chunk-T2GD7RHS.js";import{b as X,c as J,e as Q,f as ee,g as te}from"./chunk-CCWBPAKH.js";import{Bb as C,Cb as D,Db as B,Fb as z,Tb as x,ac as Z,b as E,bc as K,c as S,d as W,e as H,jc as U,lc as ae,qb as V,qc as pe}from"./chunk-LYNBZ7RV.js";import{z as b}from"zod";var Fe=b.array(b.looseObject({state:b.string().nullish(),rate_plan:b.looseObject({id:b.string().nullish(),public_name:b.string().nullish()}).nullish(),product:b.looseObject({name:b.string().nullish()}).nullish()}));var We=/cancel|expired|failed/i;async function Ee(t){let n;try{n=await K(t,{plane:"account",args:["accounts","subscriptions","get"]},Fe)}catch{return"unreadable"}let a=n.filter(e=>!We.test(e.state??"")).map(e=>[e.rate_plan?.id,e.rate_plan?.public_name,e.product?.name].filter(Boolean).join(" ")).filter(e=>/workers/i.test(e));return a.some(e=>/paid|standard|bundled|unbound/i.test(e))?"paid":a.some(e=>/free/i.test(e))?"free":"unknown"}import{setTimeout as xe}from"node:timers/promises";var Ue=6e5,Le=3e3,Me=15e3;function je(t){let n=o=>[...t].filter(([,l])=>l===o).map(([l])=>l),a=[],e=n("tls");e.length>0&&a.push(`Waiting for ${e.length===1?"a certificate":"certificates"}: ${e.join(", ")}`);let s=n("dns");s.length>0&&a.push(`Waiting for DNS: ${s.join(", ")} ${s.length===1?"has":"have"} no record at the zone's nameservers yet`);let r=n("other");return r.length>0&&a.push(`Waiting for ${r.map(o=>`https://${o}`).join(", ")} to answer`),a.join("; ")}async function F({hosts:t,out:n,step:a,maxWaitMs:e=Ue,pollMs:s=Le,progressEveryMs:r=Me,probe:o,localDns:l=o?void 0:ke,sleep:m=xe,now:p=Date.now}){let u=p(),w=[],c=[],i=[...new Set(t)],y=null,f=o??(h=>T(h));for(;i.length>0;){let h=await Promise.all(i.map(v=>f(`https://${v}/`))),d=new Map;for(let[v,k]of i.entries()){let $=h[v];if(!$.answered){d.set(k,$.kind);continue}w.push(k),n.emit({type:"progress",step:a,message:`https://${k} has its certificate.`,data:{host:k}}),l&&await De({host:k,lead:`https://${k} has its certificate and the gateway serves it`,out:n,step:a,localDns:l})&&c.push(k)}if(i=[...d.keys()],i.length===0)break;let g=p()-u;if(g>=e){n.emit({type:"warning",code:"CERT_PENDING",step:a,message:`${i.map(v=>`https://${v}`).join(", ")} ${i.length===1?"has":"have"} no certificate after ${ae(g)}. It usually comes within five minutes; the gateway serves ${i.length===1?"it":"them"} as soon as it does. If it never comes, check the zone's CAA records allow Cloudflare's certificate authorities. Check later with \`${S} status\`.`,data:{hosts:i}});break}(y===null||p()-y>=r)&&(n.emit({type:"progress",step:a,message:`${je(d)} (usually under five minutes)...`,data:{hosts:i,waitedMs:g,waitingFor:Object.fromEntries(d)}}),y=p()),await m(s)}return{ready:w,pending:i,staleLocally:c}}async function Re({cf:t,accountId:n,install:a,domain:e,out:s}){if(a&&(a.liveVersionId!==null||a.gatewayHost===e)){if(a.gatewayHost!==e)throw new C("DOMAIN_CHANGE_UNSUPPORTED",`The Gateway can't move to ${e}
+import{b as O,c as Ce,d as Se,e as $e,f as Ae}from"./chunk-N4E5YE4X.js";import{g as de}from"./chunk-EEF4FY26.js";import{e as q}from"./chunk-E3EPK27P.js";import{A as me}from"./chunk-WTKBB5HE.js";import{a as he,b as ve,c as T,d as ke,e as De}from"./chunk-TQWCYF2T.js";import{c as we,j as fe,k as ge,n as M,o as ye}from"./chunk-ZH6IAPVK.js";import{c as P,i as L}from"./chunk-ONGI463M.js";import{e as I,g as be,h as N,i as _}from"./chunk-3GZA6EEZ.js";import{a as G}from"./chunk-52NQ23OH.js";import{g as ue}from"./chunk-J2XKGQO7.js";import{a as Y}from"./chunk-36VCEEIH.js";import{a as R,j as oe,s as ie,u as le,v as ce}from"./chunk-OHDR7JWQ.js";import{c as ne,d as se,f as re}from"./chunk-LTMQP62I.js";import{b as X,c as J,e as Q,f as ee,g as te}from"./chunk-MLZJBYSY.js";import{Cc as U,Db as V,Ec as ae,Jc as pe,Ub as C,Vb as D,Wb as B,Yb as z,b as E,c as S,d as W,e as H,kc as x,tc as Z,uc as K}from"./chunk-NXO2BC3M.js";import{z as b}from"zod";var Fe=b.array(b.looseObject({state:b.string().nullish(),rate_plan:b.looseObject({id:b.string().nullish(),public_name:b.string().nullish()}).nullish(),product:b.looseObject({name:b.string().nullish()}).nullish()}));var We=/cancel|expired|failed/i;async function Ee(t){let n;try{n=await K(t,{plane:"account",args:["accounts","subscriptions","get"]},Fe)}catch{return"unreadable"}let a=n.filter(e=>!We.test(e.state??"")).map(e=>[e.rate_plan?.id,e.rate_plan?.public_name,e.product?.name].filter(Boolean).join(" ")).filter(e=>/workers/i.test(e));return a.some(e=>/paid|standard|bundled|unbound/i.test(e))?"paid":a.some(e=>/free/i.test(e))?"free":"unknown"}import{setTimeout as xe}from"node:timers/promises";var Ue=6e5,Le=3e3,Me=15e3;function je(t){let n=o=>[...t].filter(([,l])=>l===o).map(([l])=>l),a=[],e=n("tls");e.length>0&&a.push(`Waiting for ${e.length===1?"a certificate":"certificates"}: ${e.join(", ")}`);let s=n("dns");s.length>0&&a.push(`Waiting for DNS: ${s.join(", ")} ${s.length===1?"has":"have"} no record at the zone's nameservers yet`);let r=n("other");return r.length>0&&a.push(`Waiting for ${r.map(o=>`https://${o}`).join(", ")} to answer`),a.join("; ")}async function F({hosts:t,out:n,step:a,maxWaitMs:e=Ue,pollMs:s=Le,progressEveryMs:r=Me,probe:o,localDns:l=o?void 0:ke,sleep:m=xe,now:p=Date.now}){let u=p(),w=[],c=[],i=[...new Set(t)],y=null,f=o??(h=>T(h));for(;i.length>0;){let h=await Promise.all(i.map(v=>f(`https://${v}/`))),d=new Map;for(let[v,k]of i.entries()){let $=h[v];if(!$.answered){d.set(k,$.kind);continue}w.push(k),n.emit({type:"progress",step:a,message:`https://${k} has its certificate.`,data:{host:k}}),l&&await De({host:k,lead:`https://${k} has its certificate and the gateway serves it`,out:n,step:a,localDns:l})&&c.push(k)}if(i=[...d.keys()],i.length===0)break;let g=p()-u;if(g>=e){n.emit({type:"warning",code:"CERT_PENDING",step:a,message:`${i.map(v=>`https://${v}`).join(", ")} ${i.length===1?"has":"have"} no certificate after ${ae(g)}. It usually comes within five minutes; the gateway serves ${i.length===1?"it":"them"} as soon as it does. If it never comes, check the zone's CAA records allow Cloudflare's certificate authorities. Check later with \`${S} status\`.`,data:{hosts:i}});break}(y===null||p()-y>=r)&&(n.emit({type:"progress",step:a,message:`${je(d)} (usually under five minutes)...`,data:{hosts:i,waitedMs:g,waitingFor:Object.fromEntries(d)}}),y=p()),await m(s)}return{ready:w,pending:i,staleLocally:c}}async function Re({cf:t,accountId:n,install:a,domain:e,out:s}){if(a&&(a.liveVersionId!==null||a.gatewayHost===e)){if(a.gatewayHost!==e)throw new C("DOMAIN_CHANGE_UNSUPPORTED",`The Gateway can't move to ${e}
 It's installed at ${a.gatewayHost}, and moving an installed Gateway isn't supported.`,{rerun:H("--domain"),rerunNote:"(without --domain) to update it where it is"});return{domain:e,zone:{id:a.zoneId,name:a.zoneName},appBaseDomain:a.appBaseDomain}}let r=await He(t,e,n);return Ve(e,r,s),{domain:e,zone:r,appBaseDomain:e}}async function He(t,n,a){let e=await be(t,n,a);if(!e){let s=(await _(t,a)).filter(r=>!r.status||r.status==="active").map(r=>r.name);throw new C("ZONE_NOT_FOUND",`${n} isn't under a domain in this Cloudflare account${s.length>0?`
 This account's domains: ${s.join(", ")}`:""}`,{fix:s.length>0?`use a name under one of them, or add ${n}'s domain to Cloudflare`:`add ${n}'s domain to Cloudflare`,data:{url:I(a),zones:s}})}if(e.status&&e.status!=="active")throw new D("add_domain",`Finish activating ${e.name} on Cloudflare
 Its nameservers don't point at Cloudflare yet.`,N(a,e.name),{data:{zone:e.name,status:e.status}});return{id:e.id,name:e.name}}async function Pe({cf:t,out:n,reason:a,release:e,accountId:s,target:r,interactive:o,...l}){let{certificates:m,...p}=l,u=await ie(t);n.emit({type:"step",step:"gateway.resources",status:"ok",message:u.created.length?`Created ${u.created.join(", ")}`:"The Gateway's database and KV namespace are there"});let w=R(t,u.d1Id),c=await ye({cf:t,out:n,reason:a,release:e,accountId:s,gatewayHost:r.domain,zone:r.zone,appBaseDomain:r.appBaseDomain,resources:u,db:w,interactive:o,cliVersion:E,...p});return await F({hosts:c.newHosts,out:n,step:"gateway.tls",...m}),{result:c,db:w}}function Ve(t,n,a){t===n.name&&a.emit({type:"warning",code:"GATEWAY_AT_ZONE_APEX",message:`The Gateway's sign-in cookie will cover every subdomain of ${n.name}

package/dist/{chunk-2Y5Q6A5K.js → chunk-TQWCYF2T.js}

@@ -1,4 +1,4 @@
-import{h as M,i as G,o as z}from"./chunk-H6QQMY7B.js";import{i as _}from"./chunk-6OGVO7QK.js";import{c as x,d as W}from"./chunk-W3JCQHHU.js";import{c as S}from"./chunk-ZFCUH5PK.js";import{b as I}from"./chunk-4JRIS6S6.js";import{h as O}from"./chunk-HOUHG236.js";import{a as L,j as P,k,l as C}from"./chunk-RMF4YGD6.js";import{Fb as v,qb as y}from"./chunk-LYNBZ7RV.js";async function Oe(e){let{cf:n,out:r,databaseId:a}=e,s=L(n,a),d=await k(s);if(!d)throw P();if(!e.force&&!e.stagedSecrets&&!e.unsetSecrets){let{inSync:g,desired:f}=await Z(n,s,d);if(g)return r.emit({type:"step",step:"gateway.reconcile",status:"skip",message:`The gateway already binds ${f.appWorkers.length===1?"the 1 app":`all ${f.appWorkers.length} apps`} its registry lists.`}),{versionId:d.liveVersionId,firstDeploy:!1,appWorkers:f.appWorkers,domains:d.liveDomains,newHosts:[],changed:!1}}let w=await e.openRelease();try{_(w.manifest,e.cliVersion);let g=await O({db:s,out:r,leaseWaitMs:e.leaseWaitMs,sleep:e.sleep},"gateway.reconcile");try{let f=await k(s)??d;return e.unsetSecrets?.length&&(await g.check(),f=await ee(n,s,f,e.unsetSecrets)),{...await z({cf:n,out:r,reason:"reconcile",release:w,accountId:e.accountId,gatewayHost:f.gatewayHost,zone:{id:f.zoneId,name:f.zoneName},appBaseDomain:f.appBaseDomain,forceDns:e.forceDns,resources:{d1Id:a,oauthKvId:f.oauthKvId,created:[]},db:s,interactive:e.interactive,confirm:e.confirm,cliVersion:e.cliVersion,stagedSecrets:e.stagedSecrets,heldLease:g,sleep:e.sleep}),changed:!0}}finally{await g.release()}}finally{await w.cleanup()}}async function Z(e,n,r){let a=await G(n,M(e));if(!([...r.liveAppWorkers].sort().join(`
+import{h as M,i as G,o as z}from"./chunk-ZH6IAPVK.js";import{i as _}from"./chunk-ONGI463M.js";import{c as x,d as W}from"./chunk-52NQ23OH.js";import{c as S}from"./chunk-J2XKGQO7.js";import{b as I}from"./chunk-36VCEEIH.js";import{h as O}from"./chunk-ZCJTJDAI.js";import{a as L,j as P,k,l as C}from"./chunk-OHDR7JWQ.js";import{Db as y,Yb as v}from"./chunk-NXO2BC3M.js";async function Oe(e){let{cf:n,out:r,databaseId:a}=e,s=L(n,a),d=await k(s);if(!d)throw P();if(!e.force&&!e.stagedSecrets&&!e.unsetSecrets){let{inSync:g,desired:f}=await Z(n,s,d);if(g)return r.emit({type:"step",step:"gateway.reconcile",status:"skip",message:`The gateway already binds ${f.appWorkers.length===1?"the 1 app":`all ${f.appWorkers.length} apps`} its registry lists.`}),{versionId:d.liveVersionId,firstDeploy:!1,appWorkers:f.appWorkers,domains:d.liveDomains,newHosts:[],changed:!1}}let w=await e.openRelease();try{_(w.manifest,e.cliVersion);let g=await O({db:s,out:r,leaseWaitMs:e.leaseWaitMs,sleep:e.sleep},"gateway.reconcile");try{let f=await k(s)??d;return e.unsetSecrets?.length&&(await g.check(),f=await ee(n,s,f,e.unsetSecrets)),{...await z({cf:n,out:r,reason:"reconcile",release:w,accountId:e.accountId,gatewayHost:f.gatewayHost,zone:{id:f.zoneId,name:f.zoneName},appBaseDomain:f.appBaseDomain,forceDns:e.forceDns,resources:{d1Id:a,oauthKvId:f.oauthKvId,created:[]},db:s,interactive:e.interactive,confirm:e.confirm,cliVersion:e.cliVersion,stagedSecrets:e.stagedSecrets,heldLease:g,sleep:e.sleep}),changed:!0}}finally{await g.release()}}finally{await w.cleanup()}}async function Z(e,n,r){let a=await G(n,M(e));if(!([...r.liveAppWorkers].sort().join(`
 `)===a.appWorkers.join(`
 `))||!X(r,a.appHosts))return{inSync:!1,desired:a};let d=await S(e,y);return{inSync:!!d?.versionId&&d?.versionId===r.liveVersionId,desired:a}}function X(e,n){if(!e.liveDomains.includes(e.gatewayHost))return!1;let r=e.liveDomains.filter(s=>s!==e.gatewayHost),a=x(n,e.appBaseDomain);return[...r].sort().join(`
 `)===[...a].sort().join(`

package/dist/chunk-U4ATZJEU.js

@@ -0,0 +1,6 @@
+import t from"node:fs";import s from"node:path";function m(o,n){let i=s.join(o,".gitignore");if(!t.existsSync(i)){t.writeFileSync(i,n+`
+`);return}let e=t.readFileSync(i,"utf-8");e.split(`
+`).some(r=>r.trim()===n||r.trim()===n.replace(/\/$/,""))||t.appendFileSync(i,(e.endsWith(`
+`)?"":`
+`)+n+`
+`)}export{m as a};

package/dist/{chunk-YHJZMJYZ.js → chunk-UEQMNXMZ.js}

@@ -1 +1 @@
-import{Gb as c,Hb as u,bc as a}from"./chunk-LYNBZ7RV.js";import{z as i}from"zod";var f=i.looseObject({enabled:i.boolean(),name:i.string().nullish(),status:i.string().nullish()}),p=i.looseObject({type:i.string(),field:i.string().nullish(),value:i.string().nullish()}),d=i.looseObject({type:i.string(),value:i.array(i.string()).nullish()}),l=i.looseObject({id:i.string().nullish(),tag:i.string().nullish(),name:i.string().nullish(),enabled:i.boolean().nullish(),matchers:i.array(p).nullish(),actions:i.array(d).nullish()}).transform(n=>({id:n.id??n.tag??null,name:n.name??null,enabled:n.enabled??!0,matchers:n.matchers??[],actions:n.actions??[]})),y=i.array(l),g=50,h=10;function C(n,t){return a(n,{plane:"account",args:["email-routing","settings","get","-z",t]},f)}async function x(n,t,e){await n.run({plane:"account",mode:"json",args:["email-routing","enable","-z",t,"--name",e]})}async function j(n,t){await n.run({plane:"account",mode:"json",args:["email-routing","disable","-z",t,"--force"]})}async function z(n,t){let e=new Map;for(let r=1;r<=h;r+=1){let o=await a(n,{plane:"account",args:["email-routing","rules","list-account","-z",t,"--per-page",String(g),"--page",String(r)]},y),m=e.size;for(let[R,s]of o.entries())e.set(s.id??`${r}:${R}`,s);if(o.length<g||e.size===m)break}return[...e.values()]}async function P(n,t,e){try{return await a(n,{plane:"account",args:["email-routing","rules","get",e,"-z",t]},l)}catch(r){if(u(r,"not_found"))return null;throw r}}async function v(n,t,e){let r=await a(n,{plane:"account",files:{"rule.json":e},args:o=>["email-routing","rules","create","-z",t,"--body",`@${o["rule.json"]}`]},l);if(!r.id)throw new c({message:"cf email-routing rules create answered without the new rule's id.",apiCodes:[],kind:"unknown"},{exitCode:0,stderr:""});return r.id}async function A(n,t,e,r){await n.run({plane:"account",mode:"json",files:{"rule.json":r},args:o=>["email-routing","rules","update",e,"-z",t,"--body",`@${o["rule.json"]}`]})}async function O(n,t,e){try{return await n.run({plane:"account",mode:"json",args:["email-routing","rules","delete",e,"-z",t,"--force"]}),!0}catch(r){if(u(r,"not_found"))return!1;throw r}}function S(n,t){return a(n,{plane:"account",args:["email-routing","rules","catch-all","get","-z",t]},l)}async function k(n,t,e){await n.run({plane:"account",mode:"json",files:{"catch-all.json":e},args:r=>["email-routing","rules","catch-all","update","-z",t,"--body",`@${r["catch-all.json"]}`]})}function $(n){return n.actions.find(e=>e.type==="worker")?.value?.[0]??null}function B(n){let t=n.matchers.find(e=>e.type==="literal"&&(e.field??"to")==="to");return t?.value?t.value.toLowerCase():null}export{C as a,x as b,j as c,z as d,P as e,v as f,A as g,O as h,S as i,k as j,$ as k,B as l};
+import{Zb as c,_b as u,uc as a}from"./chunk-NXO2BC3M.js";import{z as i}from"zod";var f=i.looseObject({enabled:i.boolean(),name:i.string().nullish(),status:i.string().nullish()}),p=i.looseObject({type:i.string(),field:i.string().nullish(),value:i.string().nullish()}),d=i.looseObject({type:i.string(),value:i.array(i.string()).nullish()}),l=i.looseObject({id:i.string().nullish(),tag:i.string().nullish(),name:i.string().nullish(),enabled:i.boolean().nullish(),matchers:i.array(p).nullish(),actions:i.array(d).nullish()}).transform(n=>({id:n.id??n.tag??null,name:n.name??null,enabled:n.enabled??!0,matchers:n.matchers??[],actions:n.actions??[]})),y=i.array(l),g=50,h=10;function C(n,t){return a(n,{plane:"account",args:["email-routing","settings","get","-z",t]},f)}async function x(n,t,e){await n.run({plane:"account",mode:"json",args:["email-routing","enable","-z",t,"--name",e]})}async function j(n,t){await n.run({plane:"account",mode:"json",args:["email-routing","disable","-z",t,"--force"]})}async function z(n,t){let e=new Map;for(let r=1;r<=h;r+=1){let o=await a(n,{plane:"account",args:["email-routing","rules","list-account","-z",t,"--per-page",String(g),"--page",String(r)]},y),m=e.size;for(let[R,s]of o.entries())e.set(s.id??`${r}:${R}`,s);if(o.length<g||e.size===m)break}return[...e.values()]}async function P(n,t,e){try{return await a(n,{plane:"account",args:["email-routing","rules","get",e,"-z",t]},l)}catch(r){if(u(r,"not_found"))return null;throw r}}async function v(n,t,e){let r=await a(n,{plane:"account",files:{"rule.json":e},args:o=>["email-routing","rules","create","-z",t,"--body",`@${o["rule.json"]}`]},l);if(!r.id)throw new c({message:"cf email-routing rules create answered without the new rule's id.",apiCodes:[],kind:"unknown"},{exitCode:0,stderr:""});return r.id}async function A(n,t,e,r){await n.run({plane:"account",mode:"json",files:{"rule.json":r},args:o=>["email-routing","rules","update",e,"-z",t,"--body",`@${o["rule.json"]}`]})}async function O(n,t,e){try{return await n.run({plane:"account",mode:"json",args:["email-routing","rules","delete",e,"-z",t,"--force"]}),!0}catch(r){if(u(r,"not_found"))return!1;throw r}}function S(n,t){return a(n,{plane:"account",args:["email-routing","rules","catch-all","get","-z",t]},l)}async function k(n,t,e){await n.run({plane:"account",mode:"json",files:{"catch-all.json":e},args:r=>["email-routing","rules","catch-all","update","-z",t,"--body",`@${r["catch-all.json"]}`]})}function $(n){return n.actions.find(e=>e.type==="worker")?.value?.[0]??null}function B(n){let t=n.matchers.find(e=>e.type==="literal"&&(e.field??"to")==="to");return t?.value?t.value.toLowerCase():null}export{C as a,x as b,j as c,z as d,P as e,v as f,A as g,O as h,S as i,k as j,$ as k,B as l};

package/dist/{chunk-LXYMDZER.js → chunk-VX4Z3D7A.js}

@@ -1 +1 @@
-import{f as i}from"./chunk-CZXHKPRZ.js";async function o(a,e){let t=await i(a);t&&e.emit({type:"warning",code:"LEGACY_LOCAL_STATE",message:t})}function p(a,e,t){a.emit({type:"step",step:e,status:"ok",message:t.applied.length>0?`Applied ${t.applied.join(", ")}.`:"The local database is up to date.",data:{database:t.database,applied:t.applied}})}export{o as a,p as b};
+import{f as i}from"./chunk-7BC42ZUS.js";async function o(a,e){let t=await i(a);t&&e.emit({type:"warning",code:"LEGACY_LOCAL_STATE",message:t})}function p(a,e,t){a.emit({type:"step",step:e,status:"ok",message:t.applied.length>0?`Applied ${t.applied.join(", ")}.`:"The local database is up to date.",data:{database:t.database,applied:t.applied}})}export{o as a,p as b};