everyapp 0.3.0-rc.2 → 0.3.0-rc.3

package/dist/{chunk-IFCPALVC.js → chunk-WTKBB5HE.js}

@@ -1,46 +1,46 @@
-import{a as Pe,b as Ht,e as Bt}from"./chunk-WOVS3GV5.js";import{a as se,b as Oe,c as Me,d as j,e as Pt,f as ue,g as Lt,h as Ut,j as me,k as xt,l as Ce,p as Gt}from"./chunk-OM2HDWVP.js";import{c as zt,f as Ft}from"./chunk-ZFCUH5PK.js";import{a as ce,c as ut}from"./chunk-4JRIS6S6.js";import{b as Ct,e as ve}from"./chunk-ZECBN24L.js";import{g as wt,h as yt}from"./chunk-HOUHG236.js";import{$ as De,B as q,W as te,X as Ie,Y as ne,Z as D,_ as re,aa as $t,ca as Tt,da as kt,ea as be,ha as It,ia as le,k as St,l as ht,la as Dt,na as bt,qa as vt,sa as Ot,y as V,z as ke}from"./chunk-RMF4YGD6.js";import{a as Et,e as O,o as ee,p as W,q as Rt,r as At,s as _t,t as Nt}from"./chunk-NFU4YFXB.js";import{b as Le}from"./chunk-H7PDL3X5.js";import{a as B,f as mt,g as gt,i as ft}from"./chunk-CCWBPAKH.js";import{$ as _e,Aa as ot,Ba as it,Bb as S,C as Ye,Ca as pt,D as ie,Da as Te,Fb as C,Ga as ct,I as Ke,N as Se,P as he,R as Je,S as Ee,T as Xe,V as H,W as pe,X as Re,Y as J,Ya as lt,Z as Ze,_ as Ae,aa as Qe,ba as G,c as g,ca as M,da as et,ea as Ne,fa as $e,ga as tt,k as I,ma as nt,mb as dt,pc as Mt,qb as Q,sa as X,ua as rt,va as st,wc as de,ya as at,za as Z}from"./chunk-LYNBZ7RV.js";import{stripVTControlCharacters as Xn}from"node:util";import v from"chalk";function Wt(e){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e))throw new S("SECRET_NAME_INVALID",`"${e}" isn't a valid secret name`,{fix:"use letters, digits and underscores, starting with a letter, e.g. GITHUB_TOKEN"});if(G(e))throw new S("SECRET_NAME_RESERVED",`${e} is a reserved name
+import{a as Pe,b as Ht,e as Bt}from"./chunk-LTYAIGEB.js";import{a as se,b as Oe,c as Me,d as j,e as Pt,f as ue,g as Lt,h as Ut,j as me,k as xt,l as Ce,p as Gt}from"./chunk-CGFABBZA.js";import{c as zt,f as Ft}from"./chunk-J2XKGQO7.js";import{a as ce,c as ut}from"./chunk-36VCEEIH.js";import{b as Ct,e as ve}from"./chunk-IWP4Q3KV.js";import{g as wt,h as yt}from"./chunk-ZCJTJDAI.js";import{$ as re,C as q,X as te,Y as Ie,Z as ne,_ as D,aa as De,ba as $t,da as Tt,ea as kt,fa as be,ia as It,ja as le,k as St,l as ht,ma as Dt,oa as bt,ra as vt,ta as Ot,y as V,z as ke}from"./chunk-OHDR7JWQ.js";import{a as Et,e as O,o as ee,p as W,q as Rt,r as At,s as _t,t as Nt}from"./chunk-HT76NR3O.js";import{b as Le}from"./chunk-KTX5YGBL.js";import{a as B,f as mt,g as gt,i as ft}from"./chunk-MLZJBYSY.js";import{$ as pe,Aa as st,C as Ye,D as ie,Da as at,Db as Q,Ea as Z,Fa as ot,Ga as it,Ha as pt,I as Ke,Ia as Te,Ic as Mt,La as ct,Oa as lt,Pc as de,S as Se,U as he,Ub as S,W as Je,X as Ee,Y as Xe,Yb as C,_ as H,aa as Re,ba as J,c as g,ca as Ze,da as Ae,ea as _e,fa as Qe,ga as G,ha as M,ia as et,ja as Ne,k,ka as $e,la as tt,ra as nt,xa as X,za as rt,zb as dt}from"./chunk-NXO2BC3M.js";import{stripVTControlCharacters as Xn}from"node:util";import v from"chalk";function Wt(e){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e))throw new S("SECRET_NAME_INVALID",`"${e}" isn't a valid secret name`,{fix:"use letters, digits and underscores, starting with a letter, e.g. GITHUB_TOKEN"});if(G(e))throw new S("SECRET_NAME_RESERVED",`${e} is a reserved name
 everyapp manages ${Qe}.`,{fix:"pick another name"})}function _n(e){return e.ready?e.settings.some(n=>n.set===null&&n.names.length>0&&n.need.kind!=="optional")?null:"ready":"needs_setup"}function Nn(e){return[...new Set(e.unmet.flatMap(t=>t.names))]}var Vt="id, organization_id, app_slug, name, status, setup_state",qt=e=>({id:String(e.id),organizationId:String(e.organization_id),appSlug:String(e.app_slug),name:String(e.name),status:String(e.status),setupState:e.setup_state==null?null:String(e.setup_state)});async function jt(e,t){if(!await ke(e))return null;let n=_n(t.setup);if(!n)return null;let r=t.row??await $n(e,t.appRowId);if(!r||r.status===O)return null;let s=r.setupState==="ready"||r.setupState==="needs_setup"?r.setupState:null;if(s===n)return{state:n,previous:s,event:null};let a=n==="needs_setup"?"app.needs_setup":s==="needs_setup"?"app.ready":null,i={id:r.appSlug,rowId:r.id,name:r.name},o=a?await q(e,{organizationId:r.organizationId,type:a,actor:V(t.deployer),data:a==="app.needs_setup"?{app:i,unmet:Nn(t.setup)}:{app:i},appRowId:r.id,onlyIf:{sql:"changes() > 0",params:[]},now:t.now}):[];return await e.run([{sql:"UPDATE apps SET setup_state = ? WHERE id = ? AND setup_state IS ?",params:[n,r.id,s]},...o]),{state:n,previous:s,event:a}}async function $n(e,t){let[n=[]]=await e.run([{sql:`SELECT ${Vt} FROM apps WHERE id = ?`,params:[t]}]);return n[0]?qt(n[0]):null}async function Yt(e,t,n){try{let{cf:r,db:s,deployer:a}=e;if(t.gateway.length===0&&t.appRowId===null||!await ke(s))return;let[i=[]]=await s.run([{sql:`SELECT ${Vt}, tier, manifest, secret_names FROM apps
 WHERE status NOT IN ('${O}', 'pending') AND tier NOT IN ('${M}', 'dispatch')`}]),o=i.flatMap(c=>{let u=Tn(c.manifest);return!u||typeof u!="object"||c.id===t.except?[]:c.id===t.appRowId||ue(u).some(d=>t.gateway.includes(d))?[{row:qt(c),manifest:u,secretNames:Et(D(c.secret_names))}]:[]});if(o.length===0)return;let p=await se(r);for(let c of o){let{setup:u}=j({manifest:c.manifest,appId:c.row.appSlug,gatewayNames:p,secretNames:c.secretNames});await jt(s,{appRowId:c.row.id,setup:u,deployer:a,row:c.row})}}catch(r){n.emit({type:"progress",step:"app.setup_state",message:`Couldn't record whether the apps are set up (${C(r).split(`
-`)[0]}); the Gateway records it when it next lists them`})}}function Tn(e){if(typeof e!="string")return null;try{return JSON.parse(e)}catch{return null}}async function _r(e,t,n){try{await jt(e,t)}catch(r){n.emit({type:"progress",step:"app.setup_state",message:`Couldn't record whether the app is set up (${C(r).split(`
-`)[0]}); the Gateway records it when it next lists it`})}}var Kt=new WeakMap;function z(e){let t=Kt.get(e);return t||(t=e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('remote_mcp_credentials', 'remote_mcp_tools')"}]).then(([n=[]])=>{let r=new Set(n.map(s=>String(s.name)));return{credentials:r.has("remote_mcp_credentials"),tools:r.has("remote_mcp_tools")}}),Kt.set(e,t)),t}function Jt(e){return{app:{id:e.appSlug,rowId:e.id,name:e.name},kind:ee(e)?"remote":"builtin"}}function kn(e){return W(e)?.url??null}async function Xt(e,t,n){let[r=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[t,n]}]);return r[0]?re(r[0]):null}async function In(e,t){let[n=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND tier = ? AND status != '${O}' ORDER BY app_slug`,params:[t,M]}]);return n.map(re).filter(ee).map(r=>r.appSlug)}async function vr(e,t){let r=(await De(e))?.organization??null,s=r?await Xt(e,r.id,t):null;if($e(t))return{kind:"builtin",id:t,organization:r,app:s&&s.tier===M?s:null};if(s&&ee(s))return{kind:"remote",id:t,organization:r,app:s};if(s&&s.tier!==M&&s.status!==O)throw new S("PROVIDER_APP_UNKNOWN",`"${t}" is an app deployed to this Gateway, not an MCP app
+`)[0]}); the Gateway records it when it next lists them`})}}function Tn(e){if(typeof e!="string")return null;try{return JSON.parse(e)}catch{return null}}async function Nr(e,t,n){try{await jt(e,t)}catch(r){n.emit({type:"progress",step:"app.setup_state",message:`Couldn't record whether the app is set up (${C(r).split(`
+`)[0]}); the Gateway records it when it next lists it`})}}var Kt=new WeakMap;function z(e){let t=Kt.get(e);return t||(t=e.run([{sql:"SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('remote_mcp_credentials', 'remote_mcp_tools')"}]).then(([n=[]])=>{let r=new Set(n.map(s=>String(s.name)));return{credentials:r.has("remote_mcp_credentials"),tools:r.has("remote_mcp_tools")}}),Kt.set(e,t)),t}function Jt(e){return{app:{id:e.appSlug,rowId:e.id,name:e.name},kind:ee(e)?"remote":"builtin"}}function kn(e){return W(e)?.url??null}async function Xt(e,t,n){let[r=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[t,n]}]);return r[0]?re(r[0]):null}async function In(e,t){let[n=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND tier = ? AND status != '${O}' ORDER BY app_slug`,params:[t,M]}]);return n.map(re).filter(ee).map(r=>r.appSlug)}async function Or(e,t){let r=(await De(e))?.organization??null,s=r?await Xt(e,r.id,t):null;if($e(t))return{kind:"builtin",id:t,organization:r,app:s&&s.tier===M?s:null};if(s&&ee(s))return{kind:"remote",id:t,organization:r,app:s};if(s&&s.tier!==M&&s.status!==O)throw new S("PROVIDER_APP_UNKNOWN",`"${t}" is an app deployed to this Gateway, not an MCP app
 ${g} delete ${t} removes a deployed app.`,{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"});let a=r?await In(e,r.id):[],i=/^[a-z][a-z0-9+.-]*:\/\//i.test(t);throw new S("PROVIDER_APP_UNKNOWN",[`"${t}" is not an MCP app on this Gateway`,`Built in: ${Ne.join(", ")}. Added: ${a.length>0?a.join(", "):"none yet"}.`].join(`
-`),i?{rerun:`${g} mcp add ${t}`,rerunNote:"adds the server at that address"}:{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"})}function Or(e){let t=e.app?kn(e.app):null;return new S("APP_NOT_FOUND",`${e.id} was removed from this Gateway
+`),i?{rerun:`${g} mcp add ${t}`,rerunNote:"adds the server at that address"}:{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"})}function Mr(e){let t=e.app?kn(e.app):null;return new S("APP_NOT_FOUND",`${e.id} was removed from this Gateway
 Adding it again starts fresh: nobody's access or tools are kept.`,t?{rerun:`${g} mcp add ${t} --name ${e.id}`,rerunNote:"adds it again"}:{rerun:`${g} mcp list`,rerunNote:"lists the MCP apps"})}async function Zt(e){let[t=[]]=await e.run([{sql:`SELECT tier, manifest FROM apps WHERE tier = ? AND status != '${O}'`,params:[M]}]),n=new Map;for(let r of t){let s=W({tier:String(r.tier),manifest:D(r.manifest)}),a=s?X(s.auth):null;if(!s||!a)continue;let i;try{i=new URL(s.url).origin}catch{continue}let o=n.get(a)??new Set;o.add(i),n.set(a,o)}return n}function Dn(e,t,n){let{app:r}=e,s=e.grants.map(a=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
 VALUES (?, ?, ?, ?, NULL) ON CONFLICT DO NOTHING`,params:[a.id,a.userId,a.appRowId,a.organizationId]}));return e.kind==="new"?[{sql:`INSERT INTO apps (id, organization_id, app_slug, name, description, hostname,
   worker_name, tier, manifest, status, version_id, deployed_at, deployed_by_actor,
   is_default, created_at, updated_at, scope)
 VALUES (?1, ?2, ?3, ?4, ?5, NULL, NULL, ?6, ?7, ?8, NULL, ?9, ?10, 0, ?11, ?11, ?12)`,params:[r.id,r.organizationId,r.appSlug,r.name,r.description,r.tier,r.manifest,r.status,r.deployedAt,r.deployedByActor,t,r.scope]},...s]:[{sql:`UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, is_default = 0,
   deployed_at = ?, deployed_by_actor = ?, updated_at = ?
-WHERE id = ? AND status = '${O}'`,params:[r.name,r.description,r.manifest,r.status,r.deployedAt,r.deployedByActor,t,r.id]},...be(r,t,{secretNames:n.secretNames}),...n.remoteTools?[Qt(r)]:[],...s]}function Qt(e){return{sql:"DELETE FROM remote_mcp_tools WHERE app_row_id = ? AND organization_id = ?",params:[e.id,e.organizationId]}}function Mr(e,t){return te(async()=>{let n=t.now??Date.now(),r=t.url.trim(),s=(t.id??"").trim()||nt(r)||"",{organization:a,hasOwner:i}=await $t(e,t.organizationName,n),[o=[],p=[],c=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[a.id,s]},...Tt(a.id,t.deployer.email)]),u=o[0]?re(o[0]):null,m=await Zt(e),d=D(c[0]?.id),h=Rt({organizationId:a.id,url:r,id:t.id,name:t.name,description:t.description,auth:t.auth,risk:t.risk,env:t.env,existingApp:R=>{if(R!==s)throw new Error(`The rules asked for "${R}", not "${s}".`);return u},secretUsedAt:R=>{let A=[...m.get(R)??[]],y=new URL(r).origin;return A.find(f=>f!==y)??A[0]??null},members:kt(p),actorUserId:d,actor:t.deployer.actor,now:n}),E=await z(e),w=await q(e,{organizationId:a.id,type:"mcp_app.added",actor:V(t.deployer),data:{app:{id:h.app.appSlug,rowId:h.app.id,name:h.app.name},kind:"remote"},appRowId:h.app.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[h.app.id,h.app.status,n]},now:n});return await e.run([...Dn(h,n,{secretNames:await Ie(e),remoteTools:E.tools}),...w]),{plan:h,organization:a,hasOwner:i,actorGranted:d!==null&&h.grants.some(R=>R.userId===d)}})}function Cr(e,t,n,r,s=Date.now()){return te(async()=>{let a=_t(t,n);if(!a)return{changed:!1};let i=await q(e,{organizationId:t.organizationId,type:a.status==="active"?"mcp_app.enabled":"mcp_app.disabled",actor:V(r),data:Jt(t),appRowId:t.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[t.id,a.status,s]},now:s}),[o=[]]=await e.run([{sql:"UPDATE apps SET status = ?, updated_at = ? WHERE id = ? AND status = ? RETURNING id",params:[a.status,s,t.id,t.status]},...i]);if(o.length===0)throw new S("APP_CHANGING",`${t.appSlug} changed while this ran
-Nothing was written; run it again.`,{retryable:!0});return{changed:!0}})}function Pr(e,t,n,r=Date.now()){return te(async()=>{let s=Nt(t);if(!t||!s)return{removed:!1};let a=await z(e);return await e.run([{sql:"UPDATE apps SET status = ?, is_default = ?, updated_at = ? WHERE id = ?",params:[s.status,s.isDefault?1:0,r,t.id]},...be(t,r,{secretNames:await Ie(e)}),...a.tools?[Qt(t)]:[],...await q(e,{organizationId:t.organizationId,type:"mcp_app.removed",actor:V(n),data:Jt(t),appRowId:t.id,now:r})]),{removed:!0}})}function Ue(e){return e?{status:String(e.status),toolCount:Number(e.tool_count??0),listedAt:e.fetched_at==null?null:Number(e.fetched_at),lastError:D(e.last_error)}:null}async function Lr(e,t){let n=[t.id,t.organizationId],[r=[]]=await e.run([{sql:"SELECT status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tools WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n}]);return Ue(r[0])}async function bn(e){if(!(await z(e)).credentials)return new Map;let[t=[]]=await e.run([{sql:"SELECT name, origin, bound_by, bound_at FROM remote_mcp_credentials ORDER BY name"}]);return new Map(t.map(n=>[String(n.name),{origin:String(n.origin),boundBy:D(n.bound_by),boundAt:n.bound_at==null?null:Number(n.bound_at)}]))}async function Ur(e){let t=await De(e),n=[],r=new Map;if(t){let[o=[],p=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND tier = ? AND status != '${O}' ORDER BY app_slug`,params:[t.organization.id,M]},{sql:"SELECT app_row_id, status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE organization_id = ?",params:[t.organization.id]}]);n.push(...o.map(re));for(let c of p)r.set(String(c.app_row_id),Ue(c))}let s=new Map(n.map(o=>[o.appSlug,o])),a=Ne.map(o=>{let p=s.get(o)??null;return{id:o,name:et[o].name,kind:"builtin",app:p,remote:null,keyName:tt(o),snapshot:p?r.get(p.id)??null:null}}),i=n.filter(o=>!$e(o.appSlug)&&ee(o)).map(o=>{let p=W(o);return{id:o.appSlug,name:o.name,kind:"remote",app:o,remote:p,keyName:p?X(p.auth):null,snapshot:r.get(o.id)??null}});return[...a,...i]}function xr(e,t,n){if(!e.app||e.app.status===O)return"not added";if(e.app.status!=="active")return"off";if(e.kind==="remote"&&!e.remote||e.keyName&&!t.includes(e.keyName))return"needs setup";if(e.kind==="remote"&&e.keyName&&e.remote){let r=n.get(e.keyName);if(r&&r.origin!==vn(e.remote.url))return"needs setup"}return"on"}function vn(e){try{return new URL(e).origin}catch{return""}}function On(e){return e==="read"?{readOnlyHint:!0}:e==="destructive"?{destructiveHint:!0}:{}}function Mn(e,t,n,r){return n.map(s=>{let a=String(s.upstream_name),i=String(s.risk_hint),o=D(s.local_name),p=rt(On(i),t,a),c=p.source==="default"&&i==="write"?"hint":p.source,u=o?r.get(o):void 0,m=st(t,a),d=!!Number(s.listed);return{name:o?`${e}_${o}`:null,serverName:a,title:D(s.title),risk:u??p.risk,source:c,on:m&&d,problem:m?d?null:D(s.problem)??"not listed":d?"turned off; leaves the catalog at the next listing":"turned off"}})}async function Gr(e,t,n){let r=[t.app.id,t.app.organizationId],s=await z(e),a=n?X(n.auth):null,[i=[],o=[],p=[],c=[]]=await e.run([{sql:"SELECT status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:r},{sql:"SELECT name, title, risk FROM app_tools WHERE app_row_id = ? AND organization_id = ? ORDER BY name",params:r},...s.tools&&n?[{sql:`SELECT upstream_name, local_name, title, risk_hint, listed, problem, listed_at FROM remote_mcp_tools
-WHERE app_row_id = ? AND organization_id = ? ORDER BY upstream_name`,params:r}]:[{sql:"SELECT 1 WHERE 0"}],...s.credentials&&a?[{sql:"SELECT origin, bound_by, bound_at FROM remote_mcp_credentials WHERE name = ?",params:[a]}]:[{sql:"SELECT 1 WHERE 0"}]]),u=new Map(o.map(d=>[String(d.name),String(d.risk)])),m=c[0];return{snapshot:Ue(i[0]),remoteTools:n?Mn(t.id,n,p,u):[],catalogTools:o.map(d=>({name:`${t.id}_${String(d.name)}`,title:D(d.title),risk:String(d.risk)})),binding:m?{origin:String(m.origin),boundBy:D(m.bound_by),boundAt:m.bound_at==null?null:Number(m.bound_at)}:null,listingKnown:s.tools}}var Cn=3;function zr(e,t,n,r,s=Date.now()){return te(async()=>{let a=await z(e),[i=[]]=await e.run([a.tools?{sql:`SELECT upstream_name, local_name FROM remote_mcp_tools
+WHERE id = ? AND status = '${O}'`,params:[r.name,r.description,r.manifest,r.status,r.deployedAt,r.deployedByActor,t,r.id]},...be(r,t,{secretNames:n.secretNames}),...n.remoteTools?[Qt(r)]:[],...s]}function Qt(e){return{sql:"DELETE FROM remote_mcp_tools WHERE app_row_id = ? AND organization_id = ?",params:[e.id,e.organizationId]}}function Cr(e,t){return te(async()=>{let n=t.now??Date.now(),r=t.url.trim(),s=(t.id??"").trim()||nt(r)||"",{organization:a,hasOwner:i}=await $t(e,t.organizationName,n),[o=[],p=[],c=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND app_slug = ?`,params:[a.id,s]},...Tt(a.id,t.deployer.email)]),u=o[0]?re(o[0]):null,m=await Zt(e),d=D(c[0]?.id),h=Rt({organizationId:a.id,url:r,id:t.id,name:t.name,description:t.description,auth:t.auth,risk:t.risk,env:t.env,existingApp:R=>{if(R!==s)throw new Error(`The rules asked for "${R}", not "${s}".`);return u},secretUsedAt:R=>{let A=[...m.get(R)??[]],y=new URL(r).origin;return A.find(f=>f!==y)??A[0]??null},members:kt(p),actorUserId:d,actor:t.deployer.actor,now:n}),E=await z(e),w=await q(e,{organizationId:a.id,type:"mcp_app.added",actor:V(t.deployer),data:{app:{id:h.app.appSlug,rowId:h.app.id,name:h.app.name},kind:"remote"},appRowId:h.app.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[h.app.id,h.app.status,n]},now:n});return await e.run([...Dn(h,n,{secretNames:await Ie(e),remoteTools:E.tools}),...w]),{plan:h,organization:a,hasOwner:i,actorGranted:d!==null&&h.grants.some(R=>R.userId===d)}})}function Pr(e,t,n,r,s=Date.now()){return te(async()=>{let a=_t(t,n);if(!a)return{changed:!1};let i=await q(e,{organizationId:t.organizationId,type:a.status==="active"?"mcp_app.enabled":"mcp_app.disabled",actor:V(r),data:Jt(t),appRowId:t.id,onlyIf:{sql:"EXISTS (SELECT 1 FROM apps WHERE id = ? AND status = ? AND updated_at = ?)",params:[t.id,a.status,s]},now:s}),[o=[]]=await e.run([{sql:"UPDATE apps SET status = ?, updated_at = ? WHERE id = ? AND status = ? RETURNING id",params:[a.status,s,t.id,t.status]},...i]);if(o.length===0)throw new S("APP_CHANGING",`${t.appSlug} changed while this ran
+Nothing was written; run it again.`,{retryable:!0});return{changed:!0}})}function Lr(e,t,n,r=Date.now()){return te(async()=>{let s=Nt(t);if(!t||!s)return{removed:!1};let a=await z(e);return await e.run([{sql:"UPDATE apps SET status = ?, is_default = ?, updated_at = ? WHERE id = ?",params:[s.status,s.isDefault?1:0,r,t.id]},...be(t,r,{secretNames:await Ie(e)}),...a.tools?[Qt(t)]:[],...await q(e,{organizationId:t.organizationId,type:"mcp_app.removed",actor:V(n),data:Jt(t),appRowId:t.id,now:r})]),{removed:!0}})}function Ue(e){return e?{status:String(e.status),toolCount:Number(e.tool_count??0),listedAt:e.fetched_at==null?null:Number(e.fetched_at),lastError:D(e.last_error)}:null}async function Ur(e,t){let n=[t.id,t.organizationId],[r=[]]=await e.run([{sql:"SELECT status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tools WHERE app_row_id = ? AND organization_id = ?",params:n},{sql:"DELETE FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:n}]);return Ue(r[0])}async function bn(e){if(!(await z(e)).credentials)return new Map;let[t=[]]=await e.run([{sql:"SELECT name, origin, bound_by, bound_at FROM remote_mcp_credentials ORDER BY name"}]);return new Map(t.map(n=>[String(n.name),{origin:String(n.origin),boundBy:D(n.bound_by),boundAt:n.bound_at==null?null:Number(n.bound_at)}]))}async function xr(e){let t=await De(e),n=[],r=new Map;if(t){let[o=[],p=[]]=await e.run([{sql:`SELECT ${await ne(e)} FROM apps WHERE organization_id = ? AND tier = ? AND status != '${O}' ORDER BY app_slug`,params:[t.organization.id,M]},{sql:"SELECT app_row_id, status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE organization_id = ?",params:[t.organization.id]}]);n.push(...o.map(re));for(let c of p)r.set(String(c.app_row_id),Ue(c))}let s=new Map(n.map(o=>[o.appSlug,o])),a=Ne.map(o=>{let p=s.get(o)??null;return{id:o,name:et[o].name,kind:"builtin",app:p,remote:null,keyName:tt(o),snapshot:p?r.get(p.id)??null:null}}),i=n.filter(o=>!$e(o.appSlug)&&ee(o)).map(o=>{let p=W(o);return{id:o.appSlug,name:o.name,kind:"remote",app:o,remote:p,keyName:p?X(p.auth):null,snapshot:r.get(o.id)??null}});return[...a,...i]}function Gr(e,t,n){if(!e.app||e.app.status===O)return"not added";if(e.app.status!=="active")return"off";if(e.kind==="remote"&&!e.remote||e.keyName&&!t.includes(e.keyName))return"needs setup";if(e.kind==="remote"&&e.keyName&&e.remote){let r=n.get(e.keyName);if(r&&r.origin!==vn(e.remote.url))return"needs setup"}return"on"}function vn(e){try{return new URL(e).origin}catch{return""}}function On(e){return e==="read"?{readOnlyHint:!0}:e==="destructive"?{destructiveHint:!0}:{}}function Mn(e,t,n,r){return n.map(s=>{let a=String(s.upstream_name),i=String(s.risk_hint),o=D(s.local_name),p=rt(On(i),t,a),c=p.source==="default"&&i==="write"?"hint":p.source,u=o?r.get(o):void 0,m=st(t,a),d=!!Number(s.listed);return{name:o?`${e}_${o}`:null,serverName:a,title:D(s.title),risk:u??p.risk,source:c,on:m&&d,problem:m?d?null:D(s.problem)??"not listed":d?"turned off; leaves the catalog at the next listing":"turned off"}})}async function zr(e,t,n){let r=[t.app.id,t.app.organizationId],s=await z(e),a=n?X(n.auth):null,[i=[],o=[],p=[],c=[]]=await e.run([{sql:"SELECT status, tool_count, fetched_at, last_error FROM app_tool_catalogs WHERE app_row_id = ? AND organization_id = ?",params:r},{sql:"SELECT name, title, risk FROM app_tools WHERE app_row_id = ? AND organization_id = ? ORDER BY name",params:r},...s.tools&&n?[{sql:`SELECT upstream_name, local_name, title, risk_hint, listed, problem, listed_at FROM remote_mcp_tools
+WHERE app_row_id = ? AND organization_id = ? ORDER BY upstream_name`,params:r}]:[{sql:"SELECT 1 WHERE 0"}],...s.credentials&&a?[{sql:"SELECT origin, bound_by, bound_at FROM remote_mcp_credentials WHERE name = ?",params:[a]}]:[{sql:"SELECT 1 WHERE 0"}]]),u=new Map(o.map(d=>[String(d.name),String(d.risk)])),m=c[0];return{snapshot:Ue(i[0]),remoteTools:n?Mn(t.id,n,p,u):[],catalogTools:o.map(d=>({name:`${t.id}_${String(d.name)}`,title:D(d.title),risk:String(d.risk)})),binding:m?{origin:String(m.origin),boundBy:D(m.bound_by),boundAt:m.bound_at==null?null:Number(m.bound_at)}:null,listingKnown:s.tools}}var Cn=3;function Fr(e,t,n,r,s=Date.now()){return te(async()=>{let a=await z(e),[i=[]]=await e.run([a.tools?{sql:`SELECT upstream_name, local_name FROM remote_mcp_tools
 WHERE app_row_id = ?1 AND (upstream_name = ?2 OR local_name = ?2 OR ?3 || local_name = ?2)
 ORDER BY (upstream_name = ?2) DESC, upstream_name LIMIT 1`,params:[t.app.id,n,`${t.id}_`]}:{sql:"SELECT 1 WHERE 0"}]),o=i[0],p=o?String(o.upstream_name):n,c=o?D(o.local_name):null,u={};r.risk==="annotations"?u.risk=void 0:r.risk&&(u.risk=r.risk),r.enabled!==void 0&&(u.enabled=r.enabled);let m=t.app;for(let d=1;;d+=1){let h=W(m)?.tools[p]??null,E=At(m,{tool:{name:p,override:u}}),[w=[]]=await e.run([{sql:`UPDATE apps SET manifest = ?, name = ?, description = ?, updated_at = ?
 WHERE id = ? AND manifest = ? AND status != '${O}' RETURNING id`,params:[E.manifest,E.name,E.description,s,m.id,m.manifest]}]);if(w.length>0)return{serverName:p,listedName:c?`${t.id}_${c}`:null,inListing:!!o,before:h,after:E.remote.tools[p]??null,rev:E.remote.rev};let R=await Xt(e,m.organizationId,m.appSlug);if(!R||d>=Cn)throw new S("APP_CHANGING",`${t.id} keeps changing while this writes its tool settings
 Nothing was written; run it again.`,{retryable:!0});m=R}})}async function en(e,t,n,r=Date.now()){let s={bound:[],undeclared:[],ambiguous:[]},a=t.filter(Re);if(a.length===0||!(await z(e)).credentials)return s;let i=await Zt(e),o=await bn(e),p=[];for(let c of a){let u=[...i.get(c)??[]].sort();u.length===0?s.undeclared.push({name:c,kept:o.get(c)?.origin??null}):u.length>1?s.ambiguous.push({name:c,origins:u}):(s.bound.push({name:c,origin:u[0]}),p.push({sql:`INSERT INTO remote_mcp_credentials (name, origin, bound_by, bound_at) VALUES (?, ?, ?, ?)
 ON CONFLICT(name) DO UPDATE SET origin = excluded.origin, bound_by = excluded.bound_by, bound_at = excluded.bound_at`,params:[c,u[0],n,r]}))}return p.length>0&&await e.run(p),s}async function tn(e,t){let n=t.filter(Re);if(n.length===0||!(await z(e)).credentials)return[];let[r=[]]=await e.run([{sql:`DELETE FROM remote_mcp_credentials WHERE name IN (${n.map(()=>"?").join(", ")}) RETURNING name`,params:n}]);return r.map(s=>String(s.name))}async function nn(e){let[t=[]]=await e.run([{sql:`SELECT app_slug, tier, manifest FROM apps WHERE tier = ? AND status != '${O}' ORDER BY app_slug`,params:[M]}]),n=new Map;for(let r of t){let s=W({tier:String(r.tier),manifest:D(r.manifest)}),a=s?X(s.auth):null;a&&n.set(a,[...n.get(a)??[],String(r.app_slug)])}return n}import{text as Gn}from"node:stream/consumers";var xe=40,Pn=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|common|organizations|consumers)$/i,Ln={issuer:"the issuer's https URL, which serves /.well-known/openid-configuration (no query, fragment or user:password@)",tenant:"the Directory (tenant) ID, a GUID like 72f988bf-86f1-41af-91ab-2d7cd011db47, or common, organizations or consumers",label:`the button text after "Continue with", at most ${xe} characters`};function Un(e,t){switch(e){case"issuer":{let n;try{n=new URL(t)}catch{return`"${t}" isn't a URL.`}if(n.protocol!=="https:")return`"${t}" isn't an https URL.`;if(n.username||n.password)return"It carries a user name or password; the issuer's URL has none.";if(n.search||n.hash)return"It has a query or a fragment; the issuer's URL has neither.";let r=n.hostname.toLowerCase();return r==="localhost"||r==="127.0.0.1"?"A deployed Gateway can't reach a loopback issuer.":null}case"tenant":return Pn.test(t)?null:`"${t}" isn't a Directory (tenant) ID, common, organizations or consumers.`;case"label":return t.length<=xe?null:`It is ${t.length} characters; the button takes ${xe} at most.`;default:return null}}function xn(e){return Ln[e]??null}function rn(e){let t=Xe(e)?.settings.find(r=>r.name===e),n=t?xn(t.role):null;if(!(!t||!n))return{takes:n,check:r=>Un(t.role,r)}}function on(e){return e?"env":process.stdin.isTTY?"prompt":"stdin"}function pn(e,t){let n=on(t);if(!(n==="prompt"||e.length<2))throw new S("SECRET_SEVERAL_NAMES",`${n==="env"?"--from-env":"A piped value"} sets one secret at a time, and you named ${e.length}`,{fix:`run it once per name, e.g. ${n==="env"?`${g} secret set ${e[0]} --from-env ${t}`:`echo "$${e[0]}" | ${g} secret set ${e[0]}`}`})}function cn(e){return e.length<2?e[0]??"":`${e.slice(0,-1).join(", ")} or ${e.at(-1)}`}function U(e,{exact:t=!1}={}){return n=>e.includes(t?n:n.toLowerCase())?null:`Not ${e.length>2?"one of ":""}${cn(e)}.`}function ae(e,t){return n=>{let r=n.split(/[\s,]+/).filter(Boolean),s=r.find(a=>!e(a));return s!==void 0?`"${s}" isn't ${t}.`:r.length>0?null:`Name ${t}.`}}var Ge=["true","false","1","0","on","off","yes","no"],zn=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/,Fn=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/,Hn=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,Bn=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.cloudflareaccess\.com$/,sn=/^[A-Za-z0-9._:-]{1,256}$/,Wn=/^\/v1(\/[a-z0-9_-]+)+$/,ze=3650,Vn=e=>Fn.test(e.toLowerCase().replace(/^@/,"")),qn=e=>Hn.test(e.toLowerCase().replace(/\.$/,""));function jn(e){try{let t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"?t:null}catch{return null}}function ln(e){let t;try{t=new URL(e)}catch{return null}return t.username||t.password||t.search||t.hash?null:t.protocol==="https:"&&Bn.test(t.hostname.toLowerCase())?t:null}function Yn(e){let t=ln(/^[a-z]+:\/\//i.test(e)?e:`https://${e}`);return t!==null&&(t.pathname==="/"||t.pathname==="")}var Kn={EMAIL_FROM:{takes:"an address, or Name <address> (with EMAIL_FROM_NAME set, unless the name is in it)",check:e=>{let t=ct(e,"sender");return t&&zn.test(t.address)?null:`"${e}" isn't an address or Name <address>.`}},EMAIL_FROM_NAME:{takes:"the sender's display name, e.g. Acme Support"},EMAIL_PROVIDER:{takes:`${cn(Te)}: which provider sends when both are set up`,check:U(Te)},EMAIL_PASSWORD_SIGN_IN:{takes:"true or false; false turns password sign-in off (only while Cloudflare Access sign-in is on)",check:U(Ge)},MASTODON_URL:{takes:"the Mastodon instance's https origin, e.g. https://mastodon.social",check:e=>Ke(Ye.mastodon,{MASTODON_URL:e})?null:`"${e}" isn't an https origin (no path).`},AI_PROXY_EXTRA_ROUTES:{takes:"/v1 paths beyond inference the AI proxy may forward, comma separated, e.g. /v1/files",check:ae(e=>Wn.test(e),"a /v1/... path")},MCP_OAUTH_ENABLED:{takes:"true or false; false turns the OAuth server for MCP clients off",check:U(Ge)},MCP_DCR_ENABLED:{takes:"true or false; false turns dynamic client registration off",check:U(Ge)},MCP_ALLOWED_ORIGINS:{takes:"browser origins allowed to call /mcp, comma separated, e.g. http://localhost:6274",check:ae(e=>jn(e)!==null,"an http or https URL")},MCP_AUDIT_RETENTION_DAYS:{takes:`days of MCP tool-call audit rows to keep: a whole number from 1 to ${ze}`,check:e=>/^\d+$/.test(e)&&Number(e)>=1&&Number(e)<=ze?null:`Not a whole number from 1 to ${ze}.`},CLOUDFLARE_ACCESS_OIDC_ISSUER:{takes:"https://<team>.cloudflareaccess.com/cdn-cgi/access/sso/oidc/<client id>",check:e=>{let t=ln(e);return t&&/^\/cdn-cgi\/access\/sso\/oidc\/[^/]+\/?$/.test(t.pathname)?null:`"${e}" isn't an Access for SaaS issuer URL.`}},CLOUDFLARE_ACCESS_OIDC_CLIENT_ID:{takes:"the Access for SaaS application's client id"},CLOUDFLARE_ACCESS_OIDC_LABEL:{takes:`the sign-in button's label ("Continue with <label>"), at most 40 characters`},CLOUDFLARE_ACCESS_TEAM_DOMAIN:{takes:"<team>.cloudflareaccess.com",check:e=>Yn(e)?null:`"${e}" isn't <team>.cloudflareaccess.com.`},CLOUDFLARE_ACCESS_AUD:{takes:"the AUD tag of the Access application on the Gateway's host (several: comma separated)",check:ae(e=>sn.test(e),"an AUD tag")},CLOUDFLARE_ACCESS_APPS_AUD:{takes:"the AUD tag of the Access application on the apps' hosts (several: comma separated)",check:ae(e=>sn.test(e),"an AUD tag")},CLOUDFLARE_ACCESS_AUTO_JOIN_DOMAINS:{takes:"email domains whose people join without an invitation, comma separated, e.g. example.com",check:ae(Vn,"a domain like example.com")},CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN:{takes:`everyone (anyone the outer ring admits joins); to turn it off: ${g} secret unset CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN`,check:U(["everyone"])},HOSTED_OPEN_SIGNUP:{takes:"true or false; false keeps a hosted Gateway's sign-up invite-only",check:U(["true","false"])},BROWSER_APP_INSTALLS:{takes:"on or off, in lowercase; off turns browser app installs off",check:U(["on","off"],{exact:!0})},EVENTS_ALLOW_PRIVATE_TARGETS:{takes:"true or false, in lowercase; true lets event webhooks reach http: URLs and private host names",check:U(["true","false"],{exact:!0})},DISPATCH_NAMESPACE:{takes:"the Workers for Platforms namespace third-party Workers go into (hosted Gateway only)"},THIRD_PARTY_DOMAIN:{takes:"the registrable domain third-party apps are named on (hosted Gateway only)",check:e=>qn(e)?null:`"${e}" isn't a domain like example.com.`}};function Fe(e){return Kn[e]??rn(e)}function Jn(e){let t=Fe(e);return t?[`Takes ${t.takes}`]:[]}function dn(e,t){return t.trim()?Fe(e)?.check?.(t.trim())??null:"Enter a value."}function an(e,t){let n=t.trim(),r=dn(e,n);if(r===null)return n;let s=Fe(e),a=n.replace(/\s+/g," ").slice(0,64);throw new S("SETTING_VALUE_INVALID",`${e} can't be "${a}"
 ${r}`,{...s?{fix:`use ${s.takes}`}:{},data:{name:e}})}async function un(e,t){let n=Ze(e),r=t.fromEnv,s=on(r);if(s==="env"){let a=process.env[r],i=n?a?.trim():a;if(!i)throw new S("SECRET_EMPTY",`$${r} is empty or not set`,{fix:`export ${r} first, or name another variable with --from-env`});return n?an(e,i):i}if(s==="stdin"){let a=(await Gn(process.stdin)).replace(/\r?\n$/,""),i=n?a.trim():a;if(i)return n?an(e,i):i}if(s==="stdin"||!B(t.json??!1))throw new S("SECRET_VALUE_REQUIRED",`Can't ask for ${e}'s value without a terminal
-Or pipe it in: echo "$${e}" | ${g} secret set ${e}`,{rerun:`${g} secret set ${e} --from-env ${e}`});return n?(await mt(e,{context:Jn(e),validate:i=>dn(e,i)})).trim():(await gt(`Value for ${e}`)).trim()}async function _s(e,...t){await de(e,async n=>{pn(t,e["from-env"]),await Zn({flags:e,out:n,names:t,readValue:r=>un(r,{fromEnv:e["from-env"],json:e.json})})})}async function Ns(e,...t){await de(e,n=>nr({flags:e,out:n,names:t}))}async function $s(e,t){await de(e,n=>rr({flags:e,out:n,appId:t}))}async function Zn(e){let{applied:t,gatewayHost:n}=await Qn(e),r=(t.gateway?.pinned??[]).map(({name:s,origin:a})=>`${s} is sent to ${a} and nowhere else.`);e.out.emit({type:"done",message:[`Set ${Be(t,"on")}`,...r].join(`
+Or pipe it in: echo "$${e}" | ${g} secret set ${e}`,{rerun:`${g} secret set ${e} --from-env ${e}`});return n?(await mt(e,{context:Jn(e),validate:i=>dn(e,i)})).trim():(await gt(`Value for ${e}`)).trim()}async function Ns(e,...t){await de(e,async n=>{pn(t,e["from-env"]),await Zn({flags:e,out:n,names:t,readValue:r=>un(r,{fromEnv:e["from-env"],json:e.json})})})}async function $s(e,...t){await de(e,n=>rr({flags:e,out:n,names:t}))}async function Ts(e,t){await de(e,n=>sr({flags:e,out:n,appId:t}))}async function Zn(e){let{applied:t,gatewayHost:n}=await Qn(e),r=(t.gateway?.pinned??[]).map(({name:s,origin:a})=>`${s} is sent to ${a} and nowhere else.`);e.out.emit({type:"done",message:[`Set ${Be(t,"on")}`,...r].join(`
 `),display:[...r,v.dim(t.app?"Live now. No deploy needed.":`Live now on ${n}. No deploy needed.`)].join(`
-`),data:Ve(t)})}async function Qn(e){let t=await yn(e.names,e,"set");tr(t.providers,e.names,e.out);let n={};for(let s of e.names)n[s]=await e.readValue(s);return{applied:await fe(t,n,e,"set"),gatewayHost:t.gatewayHost}}function er(e){return I([...e.hosts,...e.hostSetting?[`the host ${e.hostSetting} names`]:[]])}function tr(e,t,n){for(let r of e){let{capability:s}=r;for(let a of ie(s).filter(i=>t.includes(i))){let i=r.addedAt?` on ${new Date(r.addedAt).toISOString().slice(0,10)}`:"",o=r.addedBy?` by ${r.addedBy}`:"";n.emit({type:"step",step:"secrets.provider",status:"ok",message:`${a} is ${s.label}'s, registered${o}${i}; the key is sent to ${er(s)}.`,data:{name:a,provider:r.id,addedBy:r.addedBy,addedAt:r.addedAt,hosts:[...s.hosts],...s.hostSetting?{hostSetting:s.hostSetting}:{}}})}}}async function Ts(e,t,n){let r=Object.keys(t),s=Object.values(t).every(i=>i===null);for(let i of r)if(!J(i))throw new Error(`${i} isn't a Gateway setting`);let a={route:{gateway:r,app:null,undeclared:[]},cf:e.cf,db:e.db,deployer:e.deployer,accountName:e.accountName,gatewayHost:e.gatewayUrl.replace(/^https:\/\//,""),app:null,providers:[]};return fe(a,t,n,s?"unset":"set")}async function ks(e,t,n,r){let s=Object.keys(n),a=await He(s,t.manifest,e,"set"),i=ge(s,t.manifest,t.source,"set",a.names);if(i.app&&!t.app)throw new S("APP_NOT_FOUND",`${t.manifest.id} isn't deployed yet
-Its own ${I(i.app.names)} can be set after its first deploy. Nothing was changed.`,{rerun:`${g} deploy`});let o={route:i,cf:e.cf,db:e.db,deployer:e.deployer,accountName:e.accountName,gatewayHost:e.gatewayUrl.replace(/^https:\/\//,""),app:i.app&&t.app?{...i.app,...t.app}:null,providers:a.providers};return await fe(o,n,r,"set")}async function nr(e){let{names:t,out:n}=e,r=await yn(t,e,"unset"),{route:s}=r,a=()=>{let p=`${I(t)} ${t.length===1?"isn't":"aren't"} set on ${or(s).join(" or ")}. Nothing changed.`;n.emit({type:"done",message:p,display:v.dim(p),data:{removed:!1}})};if(!await lr(r)){a();return}await ft({yes:e.flags.yes,interactive:e.interactive??B(e.flags.json??!1),confirm:e.confirm,question:`Remove ${Be({...s.gateway.length>0?{gateway:{names:s.gateway,versions:{}}}:{},...s.app?{app:{id:s.app.manifest.id,workerName:"",names:s.app.names,versions:{}}}:{}},"from")}?`,unattended:"Removing secrets needs confirmation, and there's no terminal to ask in",context:s.undeclared.map(p=>s.app?.source==="registry"?`${p} isn't listed in ${s.app.manifest.id}'s deployed manifest.`:`${p} isn't listed in everyapp.config.ts.`)});let i=Object.fromEntries(t.map(p=>[p,null])),o=await fe(r,i,e,"unset");if(!o){a();return}n.emit({type:"done",message:`Removed ${Be(o,"from")}`,display:v.dim("Live now. No deploy needed."),data:Ve(o)})}async function rr(e){let{out:t}=e,n=e.appId?null:await Le(e.cwd??process.cwd()),{cf:r,db:s,gatewayUrl:a,install:i}=await gn(e),[o,p]=await Promise.all([se(r),Pe(s,i)]),c=[...pe,...p.rows().flatMap(N=>ie(N.capability))],u=(N,T)=>t.emit({type:"done",message:Xn(N),display:N,data:T});if(!e.appId&&!n){let N=o.filter(l=>!H(l)),T=o.filter(l=>H(l)),$=await bt(s),k=new Set($.flatMap(l=>l.manifest?ue(l.manifest,p):[])),x=i.deploymentMode==="hosted",F=c.filter(l=>x||!Ae(l)).filter(l=>!o.includes(l)),P=await nn(s),L=[...F.filter(l=>k.has(l)||x&&Ae(l)),...[...P.keys()].filter(l=>!o.includes(l))],qe=F.filter(l=>!L.includes(l)&&!Ee(l)).length,oe=[],ye=[];for(let l of $){if(!l.manifest||!Pt(l.manifest,p)||l.tier==="dispatch")continue;if(l.tier===M){let K=it(ot(l.manifest),(Rn,An)=>Rn==="gateway"?o.includes(An):null);if(K.ready)continue;let En=pt(K,{cli:g,appId:l.appSlug,provider:!0});oe.push({id:l.appSlug,setup:En,rows:me(l.appSlug,K.settings)});continue}let Y=l.status==="pending"?null:await Oe(r,l.workerName).catch(K=>(ye.push({id:l.appSlug,reason:C(K).split(`
-`)[0]}),null)),{report:Sn,setup:hn}=j({manifest:l.manifest,appId:l.appSlug,gatewayNames:o,secretNames:Y,lookup:p});oe.push({id:l.appSlug,setup:hn,rows:me(l.appSlug,Sn.settings)})}let je=oe.flatMap(l=>l.rows);u([v.dim(`Gateway secrets \xB7 ${a.replace(/^https:\/\//,"")}`),"",...Mt(["NAME","SET BY"],[...N.map(l=>[l,"you"]),...T.map(l=>[l,v.dim("setup")]),...L.map(l=>[l,v.dim("not set")])]),...qe>0?[v.dim(`${qe} more can be set; see docs/capabilities.md`)]:[],v.dim(`Sign-in providers (${Object.values(he).map(l=>l.label).join(", ")}): ${g} signin list`),...je.length>0?["",...Ce(je)]:[],...ye.length>0?[v.dim(sr(ye))]:[]].join(`
-`),{gateway:{workerName:Q,names:o,settable:c,mcpCredentials:[...P].map(([l,Y])=>({name:l,apps:Y,set:o.includes(l)}))},apps:oe.map(({id:l,setup:Y})=>({id:l,setup:Y}))});return}let m=e.appId?await It(s,e.appId):await le(s,n.id),d=e.appId?fn(m):n,h=m&&m.status!=="pending"?m.workerName:null,E=Z(d),w=[];if(h){let N=(await We(s,h)).filter(T=>T.binding!=="").map(T=>T.name);for(let T of[h,...N]){let $=await ce(r,T);w.push({workerName:T,names:$,missing:E.filter(k=>!$.includes(k))})}}let R=w[0]?w[0].names.filter(N=>!G(N)):null,{report:A,setup:y}=j({manifest:d,appId:d.id,gatewayNames:o,secretNames:R,lookup:p}),f=me(d.id,A.settings).map(N=>!h&&N.where===d.id?{...N,status:v.dim("after first deploy")}:N);for(let N of w.slice(1)){let T=N.names.filter(k=>!G(k)),{report:$}=j({manifest:d,appId:d.id,gatewayNames:o,secretNames:T,lookup:p});f.push(...xt(d.id,N.workerName.split("--").at(-1),$.settings))}let _=`${v.green("\u2713")} set`;if(e.flags.verbose&&w[0])for(let N of w[0].names.filter(G))f.push({app:d.id,setting:N,where:d.id,status:_});let b=h?y.command?[y.command.command]:[]:[...y.command?[{command:`${g} configure`,note:"in the app's directory"}]:[],`${g} deploy`];u(f.length>0?[...Ce(f,{app:!1}),...y.unmet.length>0?["",...Gt(y.unmet)]:[],...!h&&E.length>0?["",v.dim(`${d.id} isn't deployed yet; its own secrets can be set after that.`)]:[]].join(`
-`):v.dim(`${d.id} declares no secrets and needs no Gateway settings.`),{app:{id:d.id,deployed:h!==null,workerName:h,declared:E,workers:w,secretNames:R,settings:A.settings,setup:y},gateway:{workerName:Q,names:o,needed:Lt(A.settings,Me(o,p)),missing:Ut(A.settings,Me(o,p)),settable:c},...f.length>0&&b.length>0?{next:b}:{}})}function sr(e){return`Couldn't list ${I(e.map(n=>`${n.id}'s`))} secrets. Cloudflare said: ${e[0].reason}. They show as not recorded.`}var ar=(n=>(n.Directory="directory",n.Registry="registry",n))(ar||{});function or(e){return[...e.gateway.length>0?["the Gateway"]:[],...e.app?[e.app.manifest.id]:[]]}function ge(e,t,n,r,s=new Set){let a=u=>J(u)||s.has(u),i=e.filter(a),o=e.filter(u=>!a(u));if(o.length===0)return{gateway:i,app:null,undeclared:[]};let p=t?Z(t):[],c=[];for(let u of o){let m=ir(u,e,t,n,r);if(m)throw m;p.includes(u)||c.push(u)}return{gateway:i,app:{manifest:t,names:o,source:n},undeclared:c}}function ir(e,t,n,r,s){let a=n?Z(n):[];if(n&&a.includes(e))return null;let i=r==="registry"&&n?` --app ${n.id}`:"",o=mn(e,[...pe,...a]);return o?new S("SECRET_NOT_DECLARED",`${e} isn't a Gateway setting${n?` or one of ${n.id}'s secrets`:""}`,{rerun:`${g} secret ${s} ${t.map(p=>p===e?o:p).join(" ")}${i}`,data:{didYouMean:o}}):Ee(e)?cr(e,s):H(e)&&!n?new S("SECRET_NOT_SETTABLE",`${e} can't be changed with secret ${s}
+`),data:Ve(t)})}async function Qn(e){let t=await yn(e.names,e,"set");nr(t.providers,e.names,e.out);let n={};for(let s of e.names)n[s]=await e.readValue(s);return{applied:await fe(t,n,e,"set"),gatewayHost:t.gatewayHost}}function er(e){return e.mode==="oauth_client"?k([...e.token.map(t=>t.host??"the provider's origin"),...e.api]):k([...e.hosts,...e.hostSetting?[`the host ${e.hostSetting} names`]:[]])}function tr(e){return e.mode==="oauth_client"?[...e.token.flatMap(t=>t.host?[t.host]:[]),...e.api]:[...e.hosts]}function nr(e,t,n){for(let r of e){let{capability:s}=r;for(let a of ie(s).filter(i=>t.includes(i))){let i=r.addedAt?` on ${new Date(r.addedAt).toISOString().slice(0,10)}`:"",o=r.addedBy?` by ${r.addedBy}`:"";n.emit({type:"step",step:"secrets.provider",status:"ok",message:`${a} is ${s.label}'s, registered${o}${i}; the key is sent to ${er(s)}.`,data:{name:a,provider:r.id,addedBy:r.addedBy,addedAt:r.addedAt,hosts:tr(s),...s.mode==="api_key"&&s.hostSetting?{hostSetting:s.hostSetting}:{}}})}}}async function ks(e,t,n){let r=Object.keys(t),s=Object.values(t).every(i=>i===null);for(let i of r)if(!J(i))throw new Error(`${i} isn't a Gateway setting`);let a={route:{gateway:r,app:null,undeclared:[]},cf:e.cf,db:e.db,deployer:e.deployer,accountName:e.accountName,gatewayHost:e.gatewayUrl.replace(/^https:\/\//,""),app:null,providers:[]};return fe(a,t,n,s?"unset":"set")}async function Is(e,t,n,r){let s=Object.keys(n),a=await He(s,t.manifest,e,"set"),i=ge(s,t.manifest,t.source,"set",a.names);if(i.app&&!t.app)throw new S("APP_NOT_FOUND",`${t.manifest.id} isn't deployed yet
+Its own ${k(i.app.names)} can be set after its first deploy. Nothing was changed.`,{rerun:`${g} deploy`});let o={route:i,cf:e.cf,db:e.db,deployer:e.deployer,accountName:e.accountName,gatewayHost:e.gatewayUrl.replace(/^https:\/\//,""),app:i.app&&t.app?{...i.app,...t.app}:null,providers:a.providers};return await fe(o,n,r,"set")}async function rr(e){let{names:t,out:n}=e,r=await yn(t,e,"unset"),{route:s}=r,a=()=>{let p=`${k(t)} ${t.length===1?"isn't":"aren't"} set on ${ir(s).join(" or ")}. Nothing changed.`;n.emit({type:"done",message:p,display:v.dim(p),data:{removed:!1}})};if(!await dr(r)){a();return}await ft({yes:e.flags.yes,interactive:e.interactive??B(e.flags.json??!1),confirm:e.confirm,question:`Remove ${Be({...s.gateway.length>0?{gateway:{names:s.gateway,versions:{}}}:{},...s.app?{app:{id:s.app.manifest.id,workerName:"",names:s.app.names,versions:{}}}:{}},"from")}?`,unattended:"Removing secrets needs confirmation, and there's no terminal to ask in",context:s.undeclared.map(p=>s.app?.source==="registry"?`${p} isn't listed in ${s.app.manifest.id}'s deployed manifest.`:`${p} isn't listed in everyapp.config.ts.`)});let i=Object.fromEntries(t.map(p=>[p,null])),o=await fe(r,i,e,"unset");if(!o){a();return}n.emit({type:"done",message:`Removed ${Be(o,"from")}`,display:v.dim("Live now. No deploy needed."),data:Ve(o)})}async function sr(e){let{out:t}=e,n=e.appId?null:await Le(e.cwd??process.cwd()),{cf:r,db:s,gatewayUrl:a,install:i}=await gn(e),[o,p]=await Promise.all([se(r),Pe(s,i)]),c=[...pe,...p.rows().flatMap(N=>ie(N.capability))],u=(N,T)=>t.emit({type:"done",message:Xn(N),display:N,data:T});if(!e.appId&&!n){let N=o.filter(l=>!H(l)),T=o.filter(l=>H(l)),$=await bt(s),I=new Set($.flatMap(l=>l.manifest?ue(l.manifest,p):[])),x=i.deploymentMode==="hosted",F=c.filter(l=>x||!Ae(l)).filter(l=>!o.includes(l)),P=await nn(s),L=[...F.filter(l=>I.has(l)||x&&Ae(l)),...[...P.keys()].filter(l=>!o.includes(l))],qe=F.filter(l=>!L.includes(l)&&!Ee(l)).length,oe=[],ye=[];for(let l of $){if(!l.manifest||!Pt(l.manifest,p)||l.tier==="dispatch")continue;if(l.tier===M){let K=it(ot(l.manifest),(Rn,An)=>Rn==="gateway"?o.includes(An):null);if(K.ready)continue;let En=pt(K,{cli:g,appId:l.appSlug,provider:!0});oe.push({id:l.appSlug,setup:En,rows:me(l.appSlug,K.settings)});continue}let Y=l.status==="pending"?null:await Oe(r,l.workerName).catch(K=>(ye.push({id:l.appSlug,reason:C(K).split(`
+`)[0]}),null)),{report:Sn,setup:hn}=j({manifest:l.manifest,appId:l.appSlug,gatewayNames:o,secretNames:Y,lookup:p});oe.push({id:l.appSlug,setup:hn,rows:me(l.appSlug,Sn.settings)})}let je=oe.flatMap(l=>l.rows);u([v.dim(`Gateway secrets \xB7 ${a.replace(/^https:\/\//,"")}`),"",...Mt(["NAME","SET BY"],[...N.map(l=>[l,"you"]),...T.map(l=>[l,v.dim("setup")]),...L.map(l=>[l,v.dim("not set")])]),...qe>0?[v.dim(`${qe} more can be set; see docs/capabilities.md`)]:[],v.dim(`Sign-in providers (${Object.values(he).map(l=>l.label).join(", ")}): ${g} signin list`),...je.length>0?["",...Ce(je)]:[],...ye.length>0?[v.dim(ar(ye))]:[]].join(`
+`),{gateway:{workerName:Q,names:o,settable:c,mcpCredentials:[...P].map(([l,Y])=>({name:l,apps:Y,set:o.includes(l)}))},apps:oe.map(({id:l,setup:Y})=>({id:l,setup:Y}))});return}let m=e.appId?await It(s,e.appId):await le(s,n.id),d=e.appId?fn(m):n,h=m&&m.status!=="pending"?m.workerName:null,E=Z(d),w=[];if(h){let N=(await We(s,h)).filter(T=>T.binding!=="").map(T=>T.name);for(let T of[h,...N]){let $=await ce(r,T);w.push({workerName:T,names:$,missing:E.filter(I=>!$.includes(I))})}}let R=w[0]?w[0].names.filter(N=>!G(N)):null,{report:A,setup:y}=j({manifest:d,appId:d.id,gatewayNames:o,secretNames:R,lookup:p}),f=me(d.id,A.settings).map(N=>!h&&N.where===d.id?{...N,status:v.dim("after first deploy")}:N);for(let N of w.slice(1)){let T=N.names.filter(I=>!G(I)),{report:$}=j({manifest:d,appId:d.id,gatewayNames:o,secretNames:T,lookup:p});f.push(...xt(d.id,N.workerName.split("--").at(-1),$.settings))}let _=`${v.green("\u2713")} set`;if(e.flags.verbose&&w[0])for(let N of w[0].names.filter(G))f.push({app:d.id,setting:N,where:d.id,status:_});let b=h?y.command?[y.command.command]:[]:[...y.command?[{command:`${g} configure`,note:"in the app's directory"}]:[],`${g} deploy`];u(f.length>0?[...Ce(f,{app:!1}),...y.unmet.length>0?["",...Gt(y.unmet)]:[],...!h&&E.length>0?["",v.dim(`${d.id} isn't deployed yet; its own secrets can be set after that.`)]:[]].join(`
+`):v.dim(`${d.id} declares no secrets and needs no Gateway settings.`),{app:{id:d.id,deployed:h!==null,workerName:h,declared:E,workers:w,secretNames:R,settings:A.settings,setup:y},gateway:{workerName:Q,names:o,needed:Lt(A.settings,Me(o,p)),missing:Ut(A.settings,Me(o,p)),settable:c},...f.length>0&&b.length>0?{next:b}:{}})}function ar(e){return`Couldn't list ${k(e.map(n=>`${n.id}'s`))} secrets. Cloudflare said: ${e[0].reason}. They show as not recorded.`}var or=(n=>(n.Directory="directory",n.Registry="registry",n))(or||{});function ir(e){return[...e.gateway.length>0?["the Gateway"]:[],...e.app?[e.app.manifest.id]:[]]}function ge(e,t,n,r,s=new Set){let a=u=>J(u)||s.has(u),i=e.filter(a),o=e.filter(u=>!a(u));if(o.length===0)return{gateway:i,app:null,undeclared:[]};let p=t?Z(t):[],c=[];for(let u of o){let m=pr(u,e,t,n,r);if(m)throw m;p.includes(u)||c.push(u)}return{gateway:i,app:{manifest:t,names:o,source:n},undeclared:c}}function pr(e,t,n,r,s){let a=n?Z(n):[];if(n&&a.includes(e))return null;let i=r==="registry"&&n?` --app ${n.id}`:"",o=mn(e,[...pe,...a]);return o?new S("SECRET_NOT_DECLARED",`${e} isn't a Gateway setting${n?` or one of ${n.id}'s secrets`:""}`,{rerun:`${g} secret ${s} ${t.map(p=>p===e?o:p).join(" ")}${i}`,data:{didYouMean:o}}):Ee(e)?lr(e,s):H(e)&&!n?new S("SECRET_NOT_SETTABLE",`${e} can't be changed with secret ${s}
 ${e==="THIRD_PARTY_DEPLOYS"?"It's the hosted Gateway's launch gate, opened by hand.":"It's one of the Gateway's own keys, written once by setup."}`):_e(e)?new S("SECRET_NOT_SETTABLE",`${e} only works in local development
 A deployed Gateway doesn't read it.`,{fix:"set it in the Gateway's .dev.vars"}):(Wt(e),n?s==="unset"?null:new S("SECRET_NOT_DECLARED",[`${n.id} doesn't list ${e} as a secret`,r==="registry"?`Its deployed manifest (what --app ${n.id} reads) doesn't list it, and it isn't a Gateway setting either.`:H(e)?`It's one of the Gateway's own keys; listing it under secrets gives ${n.id} a secret of its own.`:"It isn't a Gateway setting either."].join(`
-`),{fix:`add it to secrets in everyapp.config.ts: ${pr(n,e)}${r==="registry"?` and deploy ${n.id} again`:""}`,rerun:`${g} secret set ${e}${i}`}):new S("SECRET_NOT_DECLARED",`${e} isn't a Gateway setting, and there's no app here
+`),{fix:`add it to secrets in everyapp.config.ts: ${cr(n,e)}${r==="registry"?` and deploy ${n.id} again`:""}`,rerun:`${g} secret set ${e}${i}`}):new S("SECRET_NOT_DECLARED",`${e} isn't a Gateway setting, and there's no app here
 An app's own secrets are ${s==="set"?"set":"removed"} from the app's directory (where everyapp.config.ts is), or from anywhere with --app <id>.
-Gateway settings: ${g} secret list`,{fix:"cd into the app's directory and run this again, or add --app <id>"}))}function pr(e,t){let n=e.secrets??[],r=a=>typeof a=="string"?JSON.stringify(a):`{ ${Object.entries(a).map(([i,o])=>`${i}: ${JSON.stringify(o)}`).join(", ")} }`,s=n.every(a=>typeof a=="string")?JSON.stringify(t):`{ name: ${JSON.stringify(t)} }`;return`secrets: [${[...n.map(r),s].join(", ")}],`}function cr(e,t){let n=(/^(.+)_SIGNIN_[A-Z_]+$/.exec(e)?.[1]??e).toLowerCase();if(Je(n)){let r=he[n],s=r.settings.map(a=>a.name);return new S("SECRET_NOT_SETTABLE",`${e} isn't a setting of Sign in with ${r.label}
-It reads ${I(s)}.`,{rerun:`${g} signin show ${n}`,data:{provider:n,names:s}})}return new S("SECRET_NOT_SETTABLE",`${n.toUpperCase()} isn't a sign-in provider (${Se.join(", ")}): ${g} signin list`,{fix:`${t} a provider's own settings, as ${g} signin show <id> names them`,data:{providers:[...Se]}})}function mn(e,t){let n=r=>r.toUpperCase().replace(/_/g,"");return t.find(r=>r!==e&&n(r)===n(e))}function gn({flags:e,out:t,createCf:n}){return Ot({gateway:vt(e.gateway),accountId:e["account-id"],interactive:B(e.json??!1),login:{json:e.json,out:t,step:"login"},createCf:n})}async function We(e,t){return(await Ct(e,t)).filter(n=>n.kind==="worker")}function fn(e){if(!e.manifest)throw new S("MANIFEST_NOT_FOUND",`${e.appSlug}'s registry row holds no manifest
+Gateway settings: ${g} secret list`,{fix:"cd into the app's directory and run this again, or add --app <id>"}))}function cr(e,t){let n=e.secrets??[],r=a=>typeof a=="string"?JSON.stringify(a):`{ ${Object.entries(a).map(([i,o])=>`${i}: ${JSON.stringify(o)}`).join(", ")} }`,s=n.every(a=>typeof a=="string")?JSON.stringify(t):`{ name: ${JSON.stringify(t)} }`;return`secrets: [${[...n.map(r),s].join(", ")}],`}function lr(e,t){let n=(/^(.+)_SIGNIN_[A-Z_]+$/.exec(e)?.[1]??e).toLowerCase();if(Je(n)){let r=he[n],s=r.settings.map(a=>a.name);return new S("SECRET_NOT_SETTABLE",`${e} isn't a setting of Sign in with ${r.label}
+It reads ${k(s)}.`,{rerun:`${g} signin show ${n}`,data:{provider:n,names:s}})}return new S("SECRET_NOT_SETTABLE",`${n.toUpperCase()} isn't a sign-in provider (${Se.join(", ")}): ${g} signin list`,{fix:`${t} a provider's own settings, as ${g} signin show <id> names them`,data:{providers:[...Se]}})}function mn(e,t){let n=r=>r.toUpperCase().replace(/_/g,"");return t.find(r=>r!==e&&n(r)===n(e))}function gn({flags:e,out:t,createCf:n}){return Ot({gateway:vt(e.gateway),accountId:e["account-id"],interactive:B(e.json??!1),login:{json:e.json,out:t,step:"login"},createCf:n})}async function We(e,t){return(await Ct(e,t)).filter(n=>n.kind==="worker")}function fn(e){if(!e.manifest)throw new S("MANIFEST_NOT_FOUND",`${e.appSlug}'s registry row holds no manifest
 Deploying it again stores one.`,{rerun:`${g} deploy`,rerunNote:"in the app's directory"});try{return dt(e.manifest)}catch(t){throw new S("INVALID_MANIFEST",`${e.appSlug}'s deployed manifest can't be read
 ${C(t)}`,{rerun:`${g} deploy`,rerunNote:"in the app's directory"})}}function wn(e,t){let n=t?Z(t):[];return e.filter(r=>!J(r)&&!n.includes(r)&&lt.test(r)&&!H(r)&&!_e(r)&&!G(r)&&!mn(r,[...pe,...n]))}async function He(e,t,n,r){let s=wn(e,t);if(s.length===0)return{names:new Set,providers:[]};let a=await Pe(n.db,n.install),i=Ht(a,s),o=new Set(i.flatMap(c=>ie(c.capability)).filter(c=>s.includes(c))),p=s.filter(c=>!o.has(c));if(r==="unset"&&p.length>0){let c=await se(n.cf);for(let u of p)c.includes(u)&&o.add(u)}return{names:o,providers:i}}async function yn(e,t,n){let r=e.every(E=>J(E)),s=t.flags.app,a,i=async()=>a??=await gn(t),o=(E,w,R,A=[])=>({route:w,cf:E.cf,db:E.db,deployer:E.deployer,accountName:E.accountName,gatewayHost:E.gatewayUrl.replace(/^https:\/\//,""),app:R,providers:A});if(r)return o(await i(),ge(e,null,"directory",n),null);if(s){let E=await i(),w=await le(E.db,s);if(!w)throw new S("APP_NOT_FOUND",`${s} isn't deployed to this Gateway
 An app's secrets can be set after its first deploy. Nothing was changed.`,{rerun:`${g} status`,rerunNote:"lists its apps"});let R=fn(w),A={id:R.id,secrets:at(R)},y=await He(e,A,E,n),f=ge(e,A,"registry",n,y.names);return o(E,f,f.app?{...f.app,workerName:w.workerName,rowId:w.id}:null,y.providers)}let p=await Le(t.cwd??process.cwd()),c=wn(e,p).length>0?await He(e,p,await i(),n):{names:new Set,providers:[]},u=ge(e,p,"directory",n,c.names);if(!u.app)return o(await i(),u,null,c.providers);let m=await i(),{id:d}=u.app.manifest,h=await le(m.db,d);if(!h)throw new S("APP_NOT_FOUND",`${d} isn't deployed yet
-Its secrets can be set after its first deploy. Nothing was changed.`,{rerun:`${g} deploy`});return o(m,u,{...u.app,workerName:h.workerName,rowId:h.id},c.providers)}async function lr({cf:e,db:t,route:n,app:r}){let s=[...n.gateway.length>0?[{workerName:Q,names:n.gateway}]:[],...r?(await We(t,r.workerName)).map(a=>({workerName:a.name,names:r.names})):[]];for(let{workerName:a,names:i}of s){let o=await ce(e,a);if(i.some(p=>o.includes(p)))return!0}return!1}async function fe(e,t,n,r){let{out:s}=n,{cf:a,db:i,route:o,app:p,deployer:c}=e,u=B(n.flags.json??!1),m=E=>Object.fromEntries(E.map(w=>[w,t[w]??null])),d=r==="unset",h=o.gateway.length>0?await yt({db:i,out:s},"gateway.secrets"):null;try{let E=p?await wt({db:i,out:s},{workerName:p.workerName,appId:p.manifest.id,purpose:"app.secrets"}):null;try{let w=[],R=null;if(h){let y=await St(i);if(R=y,!y)throw new S("GATEWAY_NOT_INSTALLED",`The Gateway${e.accountName?` in ${e.accountName}`:""} isn't fully installed`,{rerun:`${g} setup`});w.push({step:"secrets.gateway",shownAs:"the Gateway",names:o.gateway,targets:[{workerName:Q,changes:m(o.gateway),recordedVersionIds:[y.liveVersionId],record:f=>ht(i,{...y,liveVersionId:f,updatedAt:Date.now(),updatedBy:c.actor})}]})}if(p){let y=await We(i,p.workerName),f=y.map(_=>_.versionId);w.push({step:"secrets.app",shownAs:p.manifest.id,names:p.names,targets:[{workerName:p.workerName,changes:m(p.names),recordedVersionIds:f,record:_=>ve(i,p.workerName,_)},...y.filter(_=>_.binding!=="").map(_=>({workerName:_.name,changes:m(p.names),recordedVersionIds:f,record:b=>ve(i,p.workerName,b,_.binding)}))]})}for(let y of w)for(let f of y.names)s.emit({type:"progress",step:"secrets.route",message:`${f} is ${y.step==="secrets.gateway"?"a Gateway setting":`${y.shownAs}'s secret`} \u2192 Worker ${y.targets.map(_=>_.workerName).join(", ")}`});for(let y of w)for(let f of y.targets){let _=I(Object.keys(f.changes));await Ft({cf:a,workerName:f.workerName,shownAs:y.shownAs,recordedVersionIds:f.recordedVersionIds,interactive:u,change:d?{question:`Remove ${_} from it anyway?`,effect:`Removing ${_} creates a new version from it.`}:{question:`Set ${_} on it anyway?`,effect:`Setting ${_} creates a new version from it.`}})}if(d&&!await mr(a,w,s))return null;let A={};for(let[y,f]of w.entries()){let _=f.targets.filter($=>Object.keys($.changes).length>0);if(_.length===0)continue;let b=f.names.filter($=>_.some(k=>Object.hasOwn(k.changes,$))),N=`${d?"Removed":"Set"} ${I(b)} ${d?"from":"on"} ${f.shownAs}`;s.emit({type:"step",step:f.step,status:"start",message:d?"Removing...":`Updating ${f.shownAs}...`});let T={};for(let $ of _){try{await ut(a,$.workerName,$.changes)}catch(we){let F=Object.values(A).flatMap(L=>L.names);if(F.length===0)throw we;let P=w.slice(y).flatMap(L=>L.names);throw new S("SECRETS_PARTIALLY_APPLIED",[`Couldn't ${d?"remove":"set"} ${I(f.names)} ${d?"from":"on"} ${f.shownAs}`,`Cloudflare said: ${C(we).split(`
-`)[0]}`,`${I(F)} ${F.length===1?"is":"are"} ${d?"removed":"set"}; only ${I(P)} ${P.length===1?"is":"are"} left.`].join(`
-`),{rerun:`${g} secret ${r} ${P.join(" ")}${p&&o.app?.source==="registry"&&P.some(L=>p.names.includes(L))?` --app ${p.manifest.id}`:""}`,retryable:!0,data:{applied:Ve(A),left:P}})}let x=(await zt(a,$.workerName))?.versionId??null;x&&await $.record(x),T[$.workerName]=x,s.emit({type:"progress",step:"secrets.version",message:`${$.workerName} is now at version ${x??"unknown"}`})}if(f.step==="secrets.gateway"){let $=await dr(i,b,d,c.actor,s).catch(k=>(s.emit({type:"progress",step:"secrets.pin",message:`Couldn't record which origin ${I(b)} ${b.length===1?"is":"are"} pinned to (${C(k).split(`
-`)[0]}); the Gateway pins it on first use`}),[]));if(A.gateway={names:b,versions:T,...$.length>0?{pinned:$}:{}},!d&&e.providers.length>0&&R){let k=await Bt(i,R,b);k.length>0&&(A.gateway.bound=k,s.emit({type:"progress",step:"secrets.bind",message:`Bound ${I(k)}'s key to the hosts ${k.length===1?"its row names":"their rows name"}`,data:{providers:k}}))}}else A.app={id:p.manifest.id,workerName:p.workerName,names:b,versions:T},await ur(a,i,p,s);s.emit({type:"step",step:f.step,status:"ok",message:N,data:{action:r,names:b,versions:T}})}return await Yt({cf:a,db:i,deployer:c},{gateway:A.gateway?.names??[],appRowId:A.app&&p?p.rowId:null,except:n.setupRecordedBy},s),A}finally{await E?.release()}}finally{await h?.release()}}async function dr(e,t,n,r,s){if(n){for(let i of await tn(e,t))s.emit({type:"progress",step:"secrets.pin",message:`${i}'s pin to its MCP server's origin is gone`});return[]}let a=await en(e,t,r);for(let{name:i,origin:o}of a.bound)s.emit({type:"progress",step:"secrets.pin",message:`${i} is pinned to ${o}`});for(let{name:i,kept:o}of a.undeclared)s.emit({type:"warning",code:"REMOTE_MCP_SECRET_UNDECLARED",step:"secrets.gateway",message:o?`No MCP app declares ${i} now
+Its secrets can be set after its first deploy. Nothing was changed.`,{rerun:`${g} deploy`});return o(m,u,{...u.app,workerName:h.workerName,rowId:h.id},c.providers)}async function dr({cf:e,db:t,route:n,app:r}){let s=[...n.gateway.length>0?[{workerName:Q,names:n.gateway}]:[],...r?(await We(t,r.workerName)).map(a=>({workerName:a.name,names:r.names})):[]];for(let{workerName:a,names:i}of s){let o=await ce(e,a);if(i.some(p=>o.includes(p)))return!0}return!1}async function fe(e,t,n,r){let{out:s}=n,{cf:a,db:i,route:o,app:p,deployer:c}=e,u=B(n.flags.json??!1),m=E=>Object.fromEntries(E.map(w=>[w,t[w]??null])),d=r==="unset",h=o.gateway.length>0?await yt({db:i,out:s},"gateway.secrets"):null;try{let E=p?await wt({db:i,out:s},{workerName:p.workerName,appId:p.manifest.id,purpose:"app.secrets"}):null;try{let w=[],R=null;if(h){let y=await St(i);if(R=y,!y)throw new S("GATEWAY_NOT_INSTALLED",`The Gateway${e.accountName?` in ${e.accountName}`:""} isn't fully installed`,{rerun:`${g} setup`});w.push({step:"secrets.gateway",shownAs:"the Gateway",names:o.gateway,targets:[{workerName:Q,changes:m(o.gateway),recordedVersionIds:[y.liveVersionId],record:f=>ht(i,{...y,liveVersionId:f,updatedAt:Date.now(),updatedBy:c.actor})}]})}if(p){let y=await We(i,p.workerName),f=y.map(_=>_.versionId);w.push({step:"secrets.app",shownAs:p.manifest.id,names:p.names,targets:[{workerName:p.workerName,changes:m(p.names),recordedVersionIds:f,record:_=>ve(i,p.workerName,_)},...y.filter(_=>_.binding!=="").map(_=>({workerName:_.name,changes:m(p.names),recordedVersionIds:f,record:b=>ve(i,p.workerName,b,_.binding)}))]})}for(let y of w)for(let f of y.names)s.emit({type:"progress",step:"secrets.route",message:`${f} is ${y.step==="secrets.gateway"?"a Gateway setting":`${y.shownAs}'s secret`} \u2192 Worker ${y.targets.map(_=>_.workerName).join(", ")}`});for(let y of w)for(let f of y.targets){let _=k(Object.keys(f.changes));await Ft({cf:a,workerName:f.workerName,shownAs:y.shownAs,recordedVersionIds:f.recordedVersionIds,interactive:u,change:d?{question:`Remove ${_} from it anyway?`,effect:`Removing ${_} creates a new version from it.`}:{question:`Set ${_} on it anyway?`,effect:`Setting ${_} creates a new version from it.`}})}if(d&&!await gr(a,w,s))return null;let A={};for(let[y,f]of w.entries()){let _=f.targets.filter($=>Object.keys($.changes).length>0);if(_.length===0)continue;let b=f.names.filter($=>_.some(I=>Object.hasOwn(I.changes,$))),N=`${d?"Removed":"Set"} ${k(b)} ${d?"from":"on"} ${f.shownAs}`;s.emit({type:"step",step:f.step,status:"start",message:d?"Removing...":`Updating ${f.shownAs}...`});let T={};for(let $ of _){try{await ut(a,$.workerName,$.changes)}catch(we){let F=Object.values(A).flatMap(L=>L.names);if(F.length===0)throw we;let P=w.slice(y).flatMap(L=>L.names);throw new S("SECRETS_PARTIALLY_APPLIED",[`Couldn't ${d?"remove":"set"} ${k(f.names)} ${d?"from":"on"} ${f.shownAs}`,`Cloudflare said: ${C(we).split(`
+`)[0]}`,`${k(F)} ${F.length===1?"is":"are"} ${d?"removed":"set"}; only ${k(P)} ${P.length===1?"is":"are"} left.`].join(`
+`),{rerun:`${g} secret ${r} ${P.join(" ")}${p&&o.app?.source==="registry"&&P.some(L=>p.names.includes(L))?` --app ${p.manifest.id}`:""}`,retryable:!0,data:{applied:Ve(A),left:P}})}let x=(await zt(a,$.workerName))?.versionId??null;x&&await $.record(x),T[$.workerName]=x,s.emit({type:"progress",step:"secrets.version",message:`${$.workerName} is now at version ${x??"unknown"}`})}if(f.step==="secrets.gateway"){let $=await ur(i,b,d,c.actor,s).catch(I=>(s.emit({type:"progress",step:"secrets.pin",message:`Couldn't record which origin ${k(b)} ${b.length===1?"is":"are"} pinned to (${C(I).split(`
+`)[0]}); the Gateway pins it on first use`}),[]));if(A.gateway={names:b,versions:T,...$.length>0?{pinned:$}:{}},!d&&e.providers.length>0&&R){let I=await Bt(i,R,b);I.length>0&&(A.gateway.bound=I,s.emit({type:"progress",step:"secrets.bind",message:`Bound ${k(I)}'s key to the hosts ${I.length===1?"its row names":"their rows name"}`,data:{providers:I}}))}}else A.app={id:p.manifest.id,workerName:p.workerName,names:b,versions:T},await mr(a,i,p,s);s.emit({type:"step",step:f.step,status:"ok",message:N,data:{action:r,names:b,versions:T}})}return await Yt({cf:a,db:i,deployer:c},{gateway:A.gateway?.names??[],appRowId:A.app&&p?p.rowId:null,except:n.setupRecordedBy},s),A}finally{await E?.release()}}finally{await h?.release()}}async function ur(e,t,n,r,s){if(n){for(let i of await tn(e,t))s.emit({type:"progress",step:"secrets.pin",message:`${i}'s pin to its MCP server's origin is gone`});return[]}let a=await en(e,t,r);for(let{name:i,origin:o}of a.bound)s.emit({type:"progress",step:"secrets.pin",message:`${i} is pinned to ${o}`});for(let{name:i,kept:o}of a.undeclared)s.emit({type:"warning",code:"REMOTE_MCP_SECRET_UNDECLARED",step:"secrets.gateway",message:o?`No MCP app declares ${i} now
 It stays pinned to ${o}, where it was set before; the Gateway sends it nowhere else.`:`No MCP app declares ${i}
-The Gateway pins it to the first MCP app that uses it.`,data:{name:i,pinnedTo:o,fix:`${g} mcp add <url> --secret ${i}`}});for(let{name:i,origins:o}of a.ambiguous)s.emit({type:"warning",code:"REMOTE_MCP_SECRET_AMBIGUOUS",step:"secrets.gateway",message:`MCP apps at ${I(o)} all declare ${i}
-It isn't pinned to any of them, so the Gateway sends it to none until one is removed.`,data:{name:i,origins:o,rerun:`${g} mcp list`,rerunNote:"names the apps"}});return a.bound}async function ur(e,t,n,r){try{await Dt(t,n.rowId,await Oe(e,n.workerName))}catch(s){r.emit({type:"progress",step:"secrets.record",message:`Couldn't record ${n.manifest.id}'s secret names (${C(s).split(`
-`)[0]}); ${g} status records them`})}}async function mr(e,t,n){let r=!1;for(let s of t.flatMap(a=>a.targets)){let a=await ce(e,s.workerName);for(let i of Object.keys(s.changes)){if(a.includes(i)){r=!0;continue}delete s.changes[i],n.emit({type:"progress",step:"secrets.held",message:`${i} isn't set on ${s.workerName}`})}}return r}function Be(e,t){return[...e.gateway?[`${I(e.gateway.names)} ${t} the Gateway`]:[],...e.app?[`${I(e.app.names)} ${t} ${e.app.id}`]:[]].join(", and ")}function Ve(e){return{...e.gateway?{gateway:e.gateway}:{},...e.app?{app:e.app}:{}}}export{Yt as a,_r as b,z as c,vr as d,Or as e,Mr as f,Cr as g,Pr as h,Lr as i,bn as j,Ur as k,xr as l,vn as m,Gr as n,zr as o,en as p,Un as q,xn as r,Jn as s,dn as t,an as u,un as v,_s as w,Ns as x,$s as y,Zn as z,Qn as A,Ts as B,ks as C,nr as D,rr as E,ar as F,fn as G,Ve as H};
+The Gateway pins it to the first MCP app that uses it.`,data:{name:i,pinnedTo:o,fix:`${g} mcp add <url> --secret ${i}`}});for(let{name:i,origins:o}of a.ambiguous)s.emit({type:"warning",code:"REMOTE_MCP_SECRET_AMBIGUOUS",step:"secrets.gateway",message:`MCP apps at ${k(o)} all declare ${i}
+It isn't pinned to any of them, so the Gateway sends it to none until one is removed.`,data:{name:i,origins:o,rerun:`${g} mcp list`,rerunNote:"names the apps"}});return a.bound}async function mr(e,t,n,r){try{await Dt(t,n.rowId,await Oe(e,n.workerName))}catch(s){r.emit({type:"progress",step:"secrets.record",message:`Couldn't record ${n.manifest.id}'s secret names (${C(s).split(`
+`)[0]}); ${g} status records them`})}}async function gr(e,t,n){let r=!1;for(let s of t.flatMap(a=>a.targets)){let a=await ce(e,s.workerName);for(let i of Object.keys(s.changes)){if(a.includes(i)){r=!0;continue}delete s.changes[i],n.emit({type:"progress",step:"secrets.held",message:`${i} isn't set on ${s.workerName}`})}}return r}function Be(e,t){return[...e.gateway?[`${k(e.gateway.names)} ${t} the Gateway`]:[],...e.app?[`${k(e.app.names)} ${t} ${e.app.id}`]:[]].join(", and ")}function Ve(e){return{...e.gateway?{gateway:e.gateway}:{},...e.app?{app:e.app}:{}}}export{Yt as a,Nr as b,z as c,Or as d,Mr as e,Cr as f,Pr as g,Lr as h,Ur as i,bn as j,xr as k,Gr as l,vn as m,zr as n,Fr as o,en as p,Un as q,xn as r,Jn as s,dn as t,an as u,un as v,Ns as w,$s as x,Ts as y,Zn as z,Qn as A,ks as B,Is as C,rr as D,sr as E,or as F,fn as G,Ve as H};

package/dist/{chunk-PS7S74DG.js → chunk-WV4G6E4T.js}

@@ -1,4 +1,4 @@
-import{a as H,b as X,d as P,e as G,f as q,g as J,h as D,i as z,j as N,k as $,l as A}from"./chunk-YHJZMJYZ.js";import{a as F,f as x}from"./chunk-N5GQLGEC.js";import{b as B,c as U,f as K,g as j}from"./chunk-ZECBN24L.js";import{ma as W}from"./chunk-RMF4YGD6.js";import{b as L,d as Z}from"./chunk-CCWBPAKH.js";import{Bb as p,Hb as T,c as _}from"./chunk-LYNBZ7RV.js";function M(e){return`everyapp:${e}`}function O(e){if(!e)return null;if(e.startsWith("catch_all:"))return{kind:"catch_all",zoneId:e.slice(10)};let[n,t]=e.split("/");return n&&t?{kind:"rule",zoneId:n,ruleId:t}:null}function w(e){return e.slice(e.lastIndexOf("@")+1)}function b(e){return e.startsWith("*@")}async function ye({cf:e,gatewayDb:n,accountId:t,workerName:l,addresses:a,interactive:i,enableRouting:r=!1,confirm:s=L}){let d=(await B(n,l)).filter(o=>o.kind==="email-route"),m=d.filter(o=>!a.includes(o.binding));if(a.length===0)return d.length>0?{workerName:l,accountId:t,routes:[],enable:[],dropped:m}:null;let E=await U(n,"email-route");for(let o of a){let u=E.find(f=>f.name===o&&f.workerName!==l);if(u){let f=await W(n,u.workerName);throw new p("EMAIL_ADDRESS_TAKEN",`${o} already goes to another app${f?` (${f})`:""}`,{fix:`pick another address, or run ${_} email unset inbound in ${f?`${f}'s`:"that app's"} directory first`,data:{address:o,workerName:u.workerName,appId:f}})}}let R=new Map;for(let o of new Set(a.map(w)))R.set(o,await se(e,o,t));for(let o of a.filter(b)){let u=R.get(w(o));if(u.name!==w(o))throw new p("EMAIL_CATCH_ALL_NOT_APEX",`${o}: catch-alls only work on a zone's apex
+import{a as H,b as X,d as P,e as G,f as q,g as J,h as D,i as z,j as N,k as $,l as A}from"./chunk-UEQMNXMZ.js";import{a as F,f as x}from"./chunk-3GZA6EEZ.js";import{b as B,c as U,f as K,g as j}from"./chunk-IWP4Q3KV.js";import{na as W}from"./chunk-OHDR7JWQ.js";import{b as L,d as Z}from"./chunk-MLZJBYSY.js";import{Ub as p,_b as T,c as _}from"./chunk-NXO2BC3M.js";function M(e){return`everyapp:${e}`}function O(e){if(!e)return null;if(e.startsWith("catch_all:"))return{kind:"catch_all",zoneId:e.slice(10)};let[n,t]=e.split("/");return n&&t?{kind:"rule",zoneId:n,ruleId:t}:null}function w(e){return e.slice(e.lastIndexOf("@")+1)}function b(e){return e.startsWith("*@")}async function ye({cf:e,gatewayDb:n,accountId:t,workerName:l,addresses:a,interactive:i,enableRouting:r=!1,confirm:s=L}){let d=(await B(n,l)).filter(o=>o.kind==="email-route"),m=d.filter(o=>!a.includes(o.binding));if(a.length===0)return d.length>0?{workerName:l,accountId:t,routes:[],enable:[],dropped:m}:null;let E=await U(n,"email-route");for(let o of a){let u=E.find(f=>f.name===o&&f.workerName!==l);if(u){let f=await W(n,u.workerName);throw new p("EMAIL_ADDRESS_TAKEN",`${o} already goes to another app${f?` (${f})`:""}`,{fix:`pick another address, or run ${_} email unset inbound in ${f?`${f}'s`:"that app's"} directory first`,data:{address:o,workerName:u.workerName,appId:f}})}}let R=new Map;for(let o of new Set(a.map(w)))R.set(o,await se(e,o,t));for(let o of a.filter(b)){let u=R.get(w(o));if(u.name!==w(o))throw new p("EMAIL_CATCH_ALL_NOT_APEX",`${o}: catch-alls only work on a zone's apex
 ${w(o)} is a subdomain of ${u.name}.`,{fix:`list each address instead, e.g. --inbound support@${w(o)}`,data:{address:o,zone:u.name}})}let y=te(e),g=[];for(let[o,u]of R)await ne(e,u,o,await y.settings(u.id))||g.push({zone:u,domain:o});g.sort((o,u)=>+(o.domain!==o.zone.name)-+(u.domain!==u.zone.name));let S=new Set(d.flatMap(o=>{let u=O(o.resourceId);return u?.kind==="rule"?[u.ruleId]:[]})),k=o=>oe(o,l)||o.id!==null&&S.has(o.id),v=[];for(let o of a){let u=R.get(w(o));if(b(o)){let c=await y.catchAll(u.id),C=c.enabled&&c.actions.some(re=>re.type!=="drop");if(!k(c)&&C)throw new p("EMAIL_CATCH_ALL_TAKEN",`${u.name}'s catch-all already ${Y(c)}
 ${o} would take it over.`,{fix:"set the catch-all back to Drop (Email Routing \u2192 Routing rules), or list addresses one by one",data:{address:o,zone:u.name,actions:c.actions}});v.push({address:o,zone:u,existing:k(c)?c:null});continue}let f=(await y.rules(u.id)).filter(c=>A(c)===o),h=f.find(c=>!k(c));if(h)throw new p("EMAIL_ADDRESS_TAKEN",`${o} already ${Y(h)}
 The Email Routing rule ${h.name?`"${h.name}"`:h.id} on ${u.name} delivers it.`,{fix:"remove that rule, or pick another address",data:{address:o,zone:u.name,ruleId:h.id,actions:h.actions}});let I=f.find(c=>c.id!==null&&S.has(c.id))??f[0]??null;v.push({address:o,zone:u,existing:I})}if(g.length>0&&!r){let o=g.map(({domain:c})=>c),u=o.join(", "),h=`Turning it on locks ${o.length===1?"the domain's":"their"} MX and SPF records to Cloudflare.`,I=g.map(({zone:c,domain:C})=>`npx cf email-routing enable -z ${c.name} --name ${C}`);if(!i)throw new p("EMAIL_ROUTING_DISABLED",`Email Routing is off for ${u}

package/dist/{chunk-IUOBIB5M.js → chunk-WY2V27RK.js}

@@ -1,4 +1,4 @@
-import{B as Ie,c as ve,d as O,e as ke,f as Ae,g as K,h as Ee,i as Re,j as P,k as Oe,l as W,m as H,n as Me,o as Te,p as Pe,v as _e}from"./chunk-IFCPALVC.js";import{a as S}from"./chunk-4JRIS6S6.js";import{B as de,W as le,X as pe,Y as me,Z as ue,_ as fe,aa as ge,ca as he,da as we,ea as ye,qa as $e,sa as be,y as ce}from"./chunk-RMF4YGD6.js";import{e as ae,m as se,n as re,p as ie}from"./chunk-NFU4YFXB.js";import{a as V,b as oe}from"./chunk-CCWBPAKH.js";import{Bb as R,b as Q,c as f,da as Z,f as z,ga as ee,ka as te,ma as ne,oc as j,pc as G,qb as I,sa as D,wa as B,wc as k}from"./chunk-LYNBZ7RV.js";import{stripVTControlCharacters as Ge}from"node:util";import w from"chalk";function We(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,n.manifest,n.status,t,n.id]}];let o=e.grants.map(s=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
+import{B as Ie,c as ve,d as O,e as ke,f as Ae,g as K,h as Ee,i as Re,j as P,k as Oe,l as W,m as H,n as Me,o as Te,p as Pe,v as _e}from"./chunk-WTKBB5HE.js";import{a as S}from"./chunk-36VCEEIH.js";import{$ as fe,C as de,X as le,Y as pe,Z as me,_ as ue,ba as ge,da as he,ea as we,fa as ye,ra as $e,ta as be,y as ce}from"./chunk-OHDR7JWQ.js";import{e as ae,m as se,n as re,p as ie}from"./chunk-HT76NR3O.js";import{a as V,b as oe}from"./chunk-MLZJBYSY.js";import{Ba as B,Db as I,Hc as j,Ic as G,Pc as k,Ub as R,b as Q,c as f,f as z,ia as Z,la as ee,pa as te,ra as ne,xa as D}from"./chunk-NXO2BC3M.js";import{stripVTControlCharacters as Ge}from"node:util";import w from"chalk";function We(e,t,a){let{app:n}=e;if(e.kind==="existing")return[{sql:"UPDATE apps SET name = ?, description = ?, manifest = ?, status = ?, updated_at = ? WHERE id = ?",params:[n.name,n.description,n.manifest,n.status,t,n.id]}];let o=e.grants.map(s=>({sql:`INSERT INTO user_app_access (id, user_id, app_row_id, organization_id, granted_by)
 VALUES (?, ?, ?, ?, NULL) ON CONFLICT DO NOTHING`,params:[s.id,s.userId,s.appRowId,s.organizationId]}));return e.kind==="new"?[{sql:`INSERT INTO apps (id, organization_id, app_slug, name, description, hostname,
   worker_name, tier, manifest, status, version_id, deployed_at, deployed_by_actor,
   is_default, created_at, updated_at, scope)

package/dist/{chunk-TLRM3P7V.js → chunk-XEPXX3AI.js}

@@ -1,4 +1,4 @@
-import{c as M,e as H}from"./chunk-HOUHG236.js";import{Bb as A,Fb as O,Gb as z,Hb as g,bc as d,c as L,cc as _,ec as j,f as N,gc as B,k as m}from"./chunk-LYNBZ7RV.js";import{z as o}from"zod";var C={perPage:100,maxPages:20};async function p(t){try{return await t}catch(e){throw b(e)}}var x=o.looseObject({name:o.string().nullish(),auth_domain:o.string(),session_duration:o.string().nullish(),allow_authenticate_via_warp:o.boolean().nullish(),deny_unmatched_requests:o.boolean().nullish(),deny_unmatched_requests_exempted_zone_names:o.array(o.string()).nullish(),warp_auth_non_browser_401:o.boolean().nullish(),mfa_config:o.unknown().nullish()});async function ne(t){try{return await d(t,{plane:"account",args:["zero-trust","organization","get"]},x)}catch(e){if(g(e,"not_found")||e instanceof z&&/not[_ ]found/i.test(e.message))return null;throw b(e)}}async function Ee(t){try{return await ne(t)}catch(e){if(g(e,"access_not_enabled"))return null;throw e}}function Ie(t,e){return p(d(t,{plane:"account",files:{"body.json":e},args:n=>["zero-trust","organization","create","--body",`@${n["body.json"]}`]},x))}function De(t,e,n){let s={name:e.name??e.auth_domain,auth_domain:e.auth_domain,allow_authenticate_via_warp:e.allow_authenticate_via_warp??!1,deny_unmatched_requests:e.deny_unmatched_requests??!1,deny_unmatched_requests_exempted_zone_names:e.deny_unmatched_requests_exempted_zone_names??[],warp_auth_non_browser_401:e.warp_auth_non_browser_401??!1,...e.mfa_config?{mfa_config:e.mfa_config}:{},session_duration:n};return p(d(t,{plane:"account",files:{"body.json":s},args:r=>["zero-trust","organization","update","--body",`@${r["body.json"]}`]},x))}var E=o.looseObject({id:o.string(),type:o.string(),name:o.string().nullish(),config:o.looseObject({restrict_to_account_members:o.boolean().nullish()}).nullish()});function $e(t){return p(_(t,["zero-trust","identity-providers","list"],o.array(E),C))}function ve(t){return p(d(t,{plane:"account",files:{"body.json":{name:"One-time PIN",type:"onetimepin",config:{}}},args:e=>["zero-trust","identity-providers","create","--body",`@${e["body.json"]}`]},E))}function Te(t){return p(d(t,{plane:"account",files:{"body.json":{name:"Cloudflare",type:"cloudflare",config:{restrict_to_account_members:!0}}},args:e=>["zero-trust","identity-providers","create","--body",`@${e["body.json"]}`]},E))}var I=o.looseObject({id:o.string(),name:o.string(),decision:o.string(),include:o.array(o.record(o.string(),o.unknown())).nullish(),exclude:o.array(o.record(o.string(),o.unknown())).nullish(),require:o.array(o.record(o.string(),o.unknown())).nullish(),reusable:o.boolean().nullish()});function ke(t){return p(_(t,["zero-trust","access","policies","list"],o.array(I),C))}function Le(t,e){return p(d(t,{plane:"account",files:{"body.json":{...e,exclude:[],require:[]}},args:n=>["zero-trust","access","policies","create","--body",`@${n["body.json"]}`]},I))}async function Ne(t,e){try{return await t.run({plane:"account",mode:"json",args:["zero-trust","access","policies","delete",e,"--force"]}),!0}catch(n){if(g(n,"not_found"))return!1;throw b(n)}}var se=new Set(["id","uid","created_at","updated_at","app_count","reusable"]);function ze(t,e,n){let s={};for(let[r,i]of Object.entries(e))se.has(r)||(s[r]=i);return s.include=n,s.exclude=e.exclude??[],s.require=e.require??[],p(d(t,{plane:"account",files:{"body.json":s},args:r=>["zero-trust","access","policies","update",e.id,"--body",`@${r["body.json"]}`]},I))}var oe=o.looseObject({path_pattern:o.string(),behavior:o.string()}),ie=o.looseObject({type:o.string().nullish(),uri:o.string().nullish(),overrides:o.array(oe).nullish()}),re=o.looseObject({id:o.string(),name:o.string().nullish(),precedence:o.number().nullish(),reusable:o.boolean().nullish()}),D=o.looseObject({id:o.string(),aud:o.string(),name:o.string().nullish(),type:o.string(),created_at:o.string().nullish(),destinations:o.array(ie).nullish(),policies:o.array(re).nullish(),session_duration:o.string().nullish(),http_only_cookie_attribute:o.boolean().nullish(),enable_binding_cookie:o.boolean().nullish(),allowed_idps:o.array(o.string()).nullish(),auto_redirect_to_identity:o.boolean().nullish(),app_launcher_visible:o.boolean().nullish(),oauth_configuration:o.looseObject({enabled:o.boolean().nullish()}).nullish()});function $(t){return p(_(t,["zero-trust","access","applications","list"],o.array(D),C))}function je(t,e){return p(d(t,{plane:"account",files:{"body.json":e},args:n=>["zero-trust","access","applications","create","--body",`@${n["body.json"]}`]},D))}var ae=new Set(["id","uid","aud","created_at","updated_at","domain","self_hosted_domains","policies","scim_config"]);function U(t,e){let n={};for(let[s,r]of Object.entries(t))ae.has(s)||(n[s]=r);return n.policies=[...t.policies??[]].sort((s,r)=>(s.precedence??0)-(r.precedence??0)).map(s=>s.id),{...n,...e}}function q(t,e,n){return p(d(t,{plane:"account",files:{"body.json":n},args:s=>["zero-trust","access","applications","update",e,"--body",`@${s["body.json"]}`]},D))}async function Be(t,e){try{return await t.run({plane:"account",mode:"json",args:["zero-trust","access","applications","delete",e,"--force"]}),!0}catch(n){if(g(n,"not_found"))return!1;throw b(n)}}var ce="https://dash.cloudflare.com/profile/api-tokens";function b(t){return g(t,"auth")?new A("ACCESS_PERMISSION_MISSING",`This Cloudflare login can't manage Access
+import{c as M,e as H}from"./chunk-ZCJTJDAI.js";import{Ub as A,Yb as O,Zb as z,_b as g,c as L,f as N,k as m,uc as d,vc as _,xc as j,zc as B}from"./chunk-NXO2BC3M.js";import{z as o}from"zod";var C={perPage:100,maxPages:20};async function p(t){try{return await t}catch(e){throw b(e)}}var x=o.looseObject({name:o.string().nullish(),auth_domain:o.string(),session_duration:o.string().nullish(),allow_authenticate_via_warp:o.boolean().nullish(),deny_unmatched_requests:o.boolean().nullish(),deny_unmatched_requests_exempted_zone_names:o.array(o.string()).nullish(),warp_auth_non_browser_401:o.boolean().nullish(),mfa_config:o.unknown().nullish()});async function ne(t){try{return await d(t,{plane:"account",args:["zero-trust","organization","get"]},x)}catch(e){if(g(e,"not_found")||e instanceof z&&/not[_ ]found/i.test(e.message))return null;throw b(e)}}async function Ee(t){try{return await ne(t)}catch(e){if(g(e,"access_not_enabled"))return null;throw e}}function Ie(t,e){return p(d(t,{plane:"account",files:{"body.json":e},args:n=>["zero-trust","organization","create","--body",`@${n["body.json"]}`]},x))}function De(t,e,n){let s={name:e.name??e.auth_domain,auth_domain:e.auth_domain,allow_authenticate_via_warp:e.allow_authenticate_via_warp??!1,deny_unmatched_requests:e.deny_unmatched_requests??!1,deny_unmatched_requests_exempted_zone_names:e.deny_unmatched_requests_exempted_zone_names??[],warp_auth_non_browser_401:e.warp_auth_non_browser_401??!1,...e.mfa_config?{mfa_config:e.mfa_config}:{},session_duration:n};return p(d(t,{plane:"account",files:{"body.json":s},args:r=>["zero-trust","organization","update","--body",`@${r["body.json"]}`]},x))}var E=o.looseObject({id:o.string(),type:o.string(),name:o.string().nullish(),config:o.looseObject({restrict_to_account_members:o.boolean().nullish()}).nullish()});function $e(t){return p(_(t,["zero-trust","identity-providers","list"],o.array(E),C))}function ve(t){return p(d(t,{plane:"account",files:{"body.json":{name:"One-time PIN",type:"onetimepin",config:{}}},args:e=>["zero-trust","identity-providers","create","--body",`@${e["body.json"]}`]},E))}function Te(t){return p(d(t,{plane:"account",files:{"body.json":{name:"Cloudflare",type:"cloudflare",config:{restrict_to_account_members:!0}}},args:e=>["zero-trust","identity-providers","create","--body",`@${e["body.json"]}`]},E))}var I=o.looseObject({id:o.string(),name:o.string(),decision:o.string(),include:o.array(o.record(o.string(),o.unknown())).nullish(),exclude:o.array(o.record(o.string(),o.unknown())).nullish(),require:o.array(o.record(o.string(),o.unknown())).nullish(),reusable:o.boolean().nullish()});function ke(t){return p(_(t,["zero-trust","access","policies","list"],o.array(I),C))}function Le(t,e){return p(d(t,{plane:"account",files:{"body.json":{...e,exclude:[],require:[]}},args:n=>["zero-trust","access","policies","create","--body",`@${n["body.json"]}`]},I))}async function Ne(t,e){try{return await t.run({plane:"account",mode:"json",args:["zero-trust","access","policies","delete",e,"--force"]}),!0}catch(n){if(g(n,"not_found"))return!1;throw b(n)}}var se=new Set(["id","uid","created_at","updated_at","app_count","reusable"]);function ze(t,e,n){let s={};for(let[r,i]of Object.entries(e))se.has(r)||(s[r]=i);return s.include=n,s.exclude=e.exclude??[],s.require=e.require??[],p(d(t,{plane:"account",files:{"body.json":s},args:r=>["zero-trust","access","policies","update",e.id,"--body",`@${r["body.json"]}`]},I))}var oe=o.looseObject({path_pattern:o.string(),behavior:o.string()}),ie=o.looseObject({type:o.string().nullish(),uri:o.string().nullish(),overrides:o.array(oe).nullish()}),re=o.looseObject({id:o.string(),name:o.string().nullish(),precedence:o.number().nullish(),reusable:o.boolean().nullish()}),D=o.looseObject({id:o.string(),aud:o.string(),name:o.string().nullish(),type:o.string(),created_at:o.string().nullish(),destinations:o.array(ie).nullish(),policies:o.array(re).nullish(),session_duration:o.string().nullish(),http_only_cookie_attribute:o.boolean().nullish(),enable_binding_cookie:o.boolean().nullish(),allowed_idps:o.array(o.string()).nullish(),auto_redirect_to_identity:o.boolean().nullish(),app_launcher_visible:o.boolean().nullish(),oauth_configuration:o.looseObject({enabled:o.boolean().nullish()}).nullish()});function $(t){return p(_(t,["zero-trust","access","applications","list"],o.array(D),C))}function je(t,e){return p(d(t,{plane:"account",files:{"body.json":e},args:n=>["zero-trust","access","applications","create","--body",`@${n["body.json"]}`]},D))}var ae=new Set(["id","uid","aud","created_at","updated_at","domain","self_hosted_domains","policies","scim_config"]);function U(t,e){let n={};for(let[s,r]of Object.entries(t))ae.has(s)||(n[s]=r);return n.policies=[...t.policies??[]].sort((s,r)=>(s.precedence??0)-(r.precedence??0)).map(s=>s.id),{...n,...e}}function q(t,e,n){return p(d(t,{plane:"account",files:{"body.json":n},args:s=>["zero-trust","access","applications","update",e,"--body",`@${s["body.json"]}`]},D))}async function Be(t,e){try{return await t.run({plane:"account",mode:"json",args:["zero-trust","access","applications","delete",e,"--force"]}),!0}catch(n){if(g(n,"not_found"))return!1;throw b(n)}}var ce="https://dash.cloudflare.com/profile/api-tokens";function b(t){return g(t,"auth")?new A("ACCESS_PERMISSION_MISSING",`This Cloudflare login can't manage Access
 ${t.message.split(`
 `)[0]}`,{fix:"use a login or token with Access: Apps and Policies (edit) and Access: Organizations, Identity Providers, and Groups (edit)",data:{url:ce}}):t}var W=["/mcp","/mcp/*"],K="/health",J="/api/auth/callback/apple",le=[...W,"/oauth/token","/oauth/register","/.well-known/*",K,J],ue=512;function pe(t){if(!t.startsWith("/"))return null;let e=t.split("/").map((s,r)=>{if(r===0)return s;let i=s.replace(/\*{2,}/g,"*");return/^:[A-Za-z_][A-Za-z0-9_]*$/.test(i)?"*":i});if(e.some(s=>(s.match(/\*/g)??[]).length>1))return null;let n=e.join("/");return n.length>ue?null:n}var V=t=>t.map(e=>({path_pattern:e,behavior:"public"})),de=t=>t.publicPaths.length>0||t.mcp;function fe(t,{managedOAuth:e}){let n=t.mcp&&!e?[...W]:[],s=[];for(let r of t.publicPaths){let i=pe(r);if(i===null){s.push({appId:t.appId,path:r,reason:"not_expressible"});continue}if(!n.includes(i)){if(n.length>=25){s.push({appId:t.appId,path:r,reason:"too_many"});continue}n.push(i)}}return{destination:{type:"public",uri:t.hostname.toLowerCase(),overrides:V(n)},dropped:s}}function He(t,e){return{type:"public",uri:t.toLowerCase(),overrides:V(e?[K,J]:le)}}var v=t=>`*.${t.toLowerCase()}`;function X(t,e){let n=t.toLowerCase(),s=`.${e.toLowerCase()}`;return n.endsWith(s)&&!n.slice(0,-s.length).includes(".")&&n.length>s.length}function Z(t,e,{managedOAuth:n=!1}={}){let s=[{type:"public",uri:v(t),overrides:[]}],r=[],i=[];for(let a of[...e].sort((l,u)=>l.hostname.localeCompare(u.hostname))){if(!de(a))continue;if(!X(a.hostname,t)){i.push(a.appId);continue}let l=fe(a,{managedOAuth:n});r.push(...l.dropped),l.destination.overrides.length!==0&&s.push(l.destination)}return{destinations:s,dropped:r,outsideBase:i}}function ge(t,e){let n=P(t);return!n||n.includes("/")?!1:n===e.gatewayHost.toLowerCase()||n===v(e.appBaseDomain)||X(n,e.appBaseDomain)}function Q(t,e){let n=[],s=[];for(let r of t)(ge(r.uri,e)?n:s).push(r);return{owned:n,foreign:s}}var P=t=>(t??"").toLowerCase().replace(/\/+$/,"");function F(t){return t.map(e=>({type:e.type??"public",uri:P(e.uri),overrides:[...e.overrides??[]].map(n=>`${n.behavior}:${n.path_pattern}`).sort()})).sort((e,n)=>e.uri.localeCompare(n.uri))}function ee(t,e){return JSON.stringify(F(t))===JSON.stringify(F(e))}function Y(t,e){return t.type==="self_hosted"&&(t.destinations??[]).some(n=>(n.type??"public")==="public"&&P(n.uri)===P(e))}function T(t,{gatewayHost:e,appBaseDomain:n}){return{gateway:t.find(s=>Y(s,e))??null,apps:t.find(s=>Y(s,v(n)))??null}}var te=t=>t?.oauth_configuration?.enabled===!0,Ue=t=>({email:{email:t.toLowerCase()}}),qe=t=>({email_domain:{domain:t.toLowerCase()}});function G(t){return JSON.stringify(t,(e,n)=>typeof n=="string"?n.toLowerCase():n)}function Fe(t,e){let n=new Set(t.map(G)),s=[];for(let r of e){let i=G(r);n.has(i)||(n.add(i),s.push(r))}return{include:[...t,...s],added:s}}function Ye(t){return t.flatMap(e=>{let n=e.email?.email;return typeof n=="string"?[n]:[]})}function Ge(t){return t.flatMap(e=>{let n=e.email_domain?.domain;return typeof n=="string"?[n]:[]})}var y="cloudflare",w="onetimepin",We=["oidc","saml"];function Ke(t){return{cloudflare:!t.some(e=>e.type===y),pin:!t.some(e=>e.type===w)}}function Je(t){return t.filter(e=>e.type===y&&e.config?.restrict_to_account_members!==!0)}function Ve(t){let e=[...t.some(n=>n.type===y)?["a Cloudflare account"]:[],...t.filter(n=>n.type!==y&&n.type!==w).map(n=>n.name??n.type),...t.some(n=>n.type===w)?["a one-time PIN"]:[]];return e.length<=1?e[0]??"no sign-in method":`${e.slice(0,-1).join(", ")} or ${e.at(-1)}`}function Xe(t){return t.filter(e=>e.type===w||e.type===y&&e.config?.restrict_to_account_members===!0)}function me(t,e){let n=[...t??[]];for(let s of e)n.includes(s)||n.push(s);return n}function ye(t,e){let n=me(t?.allowed_idps,e);return{allowedIdps:n,autoRedirect:n.length===1}}function Ze(t,e){let n=ye(t,e),s=t.allowed_idps??[];return s.length===n.allowedIdps.length&&n.allowedIdps.every(r=>s.includes(r))&&(t.auto_redirect_to_identity??!1)===n.autoRedirect}function Qe(t){let e=t.trim();if(!/^(\d+(?:\.\d+)?(?:ns|us|µs|ms|s|m|h))+$/.test(e))return null;let n={ns:1e-9,us:1e-6,\u00B5s:1e-6,ms:.001,s:1,m:60,h:3600},s=0;for(let[,r,i]of e.matchAll(/(\d+(?:\.\d+)?)(ns|us|µs|ms|s|m|h)/g))s+=Number(r)*n[i];return s}var he=["binding","active","disabled"],Ae=6e4;async function _e(t){let[e=[]]=await t.run([{sql:`SELECT app_slug, hostname, manifest FROM apps
 WHERE status IN (${he.map(n=>`'${n}'`).join(", ")}) AND hostname IS NOT NULL

package/dist/chunk-Y6CGMZEB.js

@@ -0,0 +1 @@
+import{r as p,s as d,u as f,v as l,w as u,x as g}from"./chunk-JT3R24Y7.js";import{_b as i,uc as t,vc as a}from"./chunk-NXO2BC3M.js";var y=20,m=10;async function v(r){let e=new Map;for(let n=1;n<=m;n+=1){let o=await t(r,{plane:"account",args:["hyperdrive","list","--per-page",String(y),"--page",String(n)]},l),s=e.size;for(let c of o)e.set(c.id,c);if(o.length<y||e.size===s)break}return[...e.values()]}async function H(r,e){return(await v(r)).find(n=>n.name===e)??null}async function b(r,e,n,o="off"){return(await t(r,{plane:"account",files:{"hyperdrive.json":{name:e,origin:n,...o==="off"?{caching:{disabled:!0}}:{}}},args:c=>["hyperdrive","create","--body",`@${c["hyperdrive.json"]}`]},f)).id}async function P(r,e,n){let o={...n.origin?{origin:n.origin}:{},...n.caching?{caching:{disabled:n.caching==="off"}}:{}};await t(r,{plane:"account",files:{"hyperdrive.json":o},args:s=>["hyperdrive","update",e,"--body",`@${s["hyperdrive.json"]}`]},f)}async function V(r,e){await r.run({plane:"account",mode:"json",args:["hyperdrive","delete",e,"--force"]})}function R(r,e){return r.caching?.disabled===!0==(e==="off")}function I(r,e){let n=r.origin;return n?.host===e.host&&(n.port??null)===e.port&&n.database===e.database&&n.user===e.user}async function E(r,e){try{return await t(r,{plane:"account",args:["vectorize","get",e]},u)}catch(n){if(i(n,"not_found"))return null;throw n}}function W(r){return t(r,{plane:"account",args:["vectorize","list"]},g)}async function A(r,e,n){return t(r,{plane:"account",files:{"vectorize.json":{name:e,config:n}},args:o=>["vectorize","create","--body",`@${o["vectorize.json"]}`]},u)}async function _(r,e){await r.run({plane:"account",mode:"json",args:["vectorize","delete",e,"--force"]})}function $(r,e){let n=r.config??{};return"preset"in e?n.preset===e.preset:n.dimensions===e.dimensions&&n.metric===e.metric}function G(r){if("preset"in r&&r.preset)return`the preset ${r.preset}`;let e="dimensions"in r?r.dimensions:void 0,n="metric"in r?r.metric:void 0;return`${e??"?"} dimensions, ${n??"no metric"}`}var C=100,x=50;async function Z(r,e){try{return await t(r,{plane:"account",args:["workflows","get",e]},p)}catch(n){if(i(n,"not_found"))return null;throw n}}function T(r,e){return a(r,["workflows","list","--search",e],d,{perPage:C,maxPages:x})}async function w(r,e){await r.run({plane:"account",mode:"json",args:["workflows","delete",e,"--force"]})}async function q(r,e){try{return await w(r,e),!0}catch(n){if(i(n,"not_found"))return!1;throw n}}export{v as a,H as b,b as c,P as d,V as e,R as f,I as g,E as h,W as i,A as j,_ as k,$ as l,G as m,Z as n,T as o,q as p};

package/dist/{chunk-J455FAEN.js → chunk-YCADEJVJ.js}

@@ -1,7 +1,7 @@
-import{a as I,c as N,d as T,e as C}from"./chunk-2Y5Q6A5K.js";import{a as W}from"./chunk-H6QQMY7B.js";import{ba as _,fa as k,k as A}from"./chunk-RMF4YGD6.js";import{e as P}from"./chunk-NFU4YFXB.js";import{Ab as b,Bb as f,b as R,c as $,lc as D}from"./chunk-LYNBZ7RV.js";var g="app.live",M=6e5,F=3e3,B=15e3;var V={["deploy"]:"uploaded and bound"};async function G({db:i,appRowId:a,appId:t,hostname:e,out:r,verb:l,fetch:c,localDns:m=c?void 0:T,sleep:v=o=>new Promise(n=>setTimeout(n,o)),maxWaitMs:y=M,intervalMs:d=F,now:u=Date.now}){let o=`https://${e}/`,n=u(),p=!1,s=null,E,h=async()=>(p&&m&&await C({host:e,lead:`${t} is live at https://${e}`,out:r,step:g,localDns:m}),{outcome:"live",waited:E});for(;;){let S=await x(i,a,t);if(S==="active")return h();if(S==="disabled")return r.emit({type:"warning",code:"APP_DISABLED",step:g,message:`${t} is switched off in Admin \u2192 Apps
+import{a as I,c as N,d as T,e as C}from"./chunk-TQWCYF2T.js";import{a as W}from"./chunk-ZH6IAPVK.js";import{ca as _,ga as k,k as A}from"./chunk-OHDR7JWQ.js";import{e as P}from"./chunk-HT76NR3O.js";import{Ec as D,Tb as b,Ub as f,b as R,c as $}from"./chunk-NXO2BC3M.js";var g="app.live",M=6e5,F=3e3,B=15e3;var V={["deploy"]:"uploaded and bound"};async function x({db:i,appRowId:a,appId:t,hostname:e,out:r,verb:l,fetch:c,localDns:d=c?void 0:T,sleep:v=o=>new Promise(n=>setTimeout(n,o)),maxWaitMs:y=M,intervalMs:m=F,now:u=Date.now}){let o=`https://${e}/`,n=u(),p=!1,s=null,h,E=async()=>(p&&d&&await C({host:e,lead:`${t} is live at https://${e}`,out:r,step:g,localDns:d}),{outcome:"live",waited:h});for(;;){let S=await G(i,a,t);if(S==="active")return E();if(S==="disabled")return r.emit({type:"warning",code:"APP_DISABLED",step:g,message:`${t} is switched off in Admin \u2192 Apps
 It's ${V[l]}; the Gateway serves it once an admin turns it on.`}),{outcome:"disabled"};let L=await N(o,c);if(L.answered){if(p=!0,L.access)return r.emit({type:"warning",code:"ACCESS_IN_FRONT",step:g,message:`Cloudflare Access answers before the Gateway, so this run can't confirm ${t} is live
-It goes live on its first visit, once someone signs in through Access.`,data:{hostname:e}}),{outcome:"first_visit"};if(await x(i,a,t)==="active")return h()}let w=u()-n;if(w>=y){if(!p)return r.emit({type:"warning",code:"CERT_PENDING",step:g,message:`No certificate for ${e} after ${D(w)}
+It goes live on its first visit: open https://${e}, or the Gateway's home page, signed in through Access.`,data:{hostname:e}}),{outcome:"first_visit"};if(await G(i,a,t)==="active")return E()}let w=u()-n;if(w>=y){if(!p)return r.emit({type:"warning",code:"CERT_PENDING",step:g,message:`No certificate for ${e} after ${D(w)}
 It usually comes within 5 minutes; ${t} goes live on its first visit once it has one.`,data:{hostname:e,fix:"if it never comes, check the zone's CAA records allow Cloudflare's certificate authorities"}}),{outcome:"first_visit"};throw new f("APP_NOT_LIVE",`${t} isn't live after ${D(w)}: the Gateway can't reach its Worker yet
-${t} stays ${V[l]}.`,{retryable:!0,rerun:`${$} status`,rerunNote:`then ${l} again`})}(s===null||u()-s>=B)&&(E=p?"live":"certificate",r.emit({type:"progress",step:g,message:p?`Waiting for ${t} to go live`:`Waiting for the certificate for ${e} (usually under 5m)`,data:{hostname:e,waitedMs:w,answered:p}}),s=u()),await v(d)}}async function x(i,a,t){let e=await k(i,a);if(!e||e.status===P)throw new f("APP_NOT_FOUND",`${t} was deleted during this run
-Someone removed it from the Gateway while this run waited for it to go live.`,{retryable:!0,rerunNote:"to put it back"});return e.status}function oe(i,a,t){let e=W({out:a,verbose:t});return{openRelease:i?.openRelease??e.open,source:i?.source??e.describe}}function ne(i,{manifest:a,install:t,deployer:e,accountName:r}){return _(i,{appSlug:a.id,name:a.name??a.id,description:a.description??a.id,manifest:a,appBaseDomain:t.appBaseDomain,deployer:e,organizationName:r??""})}var O={["deploy"]:"This app's upload is kept; deploying again binds it and makes it live."};async function pe({cf:i,db:a,databaseId:t,out:e,accountId:r,appId:l,workerName:c,publishHost:m,interactive:v,forceDns:y,seams:d,verb:u}){let o=await A(a);if(o?.liveAppWorkers.includes(c)&&!m)return;e.emit({type:"step",step:"app.bind",status:"start",message:`Binding ${b(c)} on the gateway${m?" and publishing its hostname":""}...`,data:{appId:l}});let n=(await d.source?.())?.version,p=n!==void 0&&o!==null&&n!==o.releaseVersion;p&&e.emit({type:"step",step:"gateway.upgrade",status:"start",message:`Upgrading the Gateway ${o.releaseVersion} \u2192 ${n}...`,data:{from:o.releaseVersion,to:n}});try{let s=await I({cf:i,out:e,accountId:r,databaseId:t,interactive:v,cliVersion:R,force:!0,forceDns:y,...d});p&&e.emit({type:"step",step:"gateway.upgrade",status:"ok",data:{to:n}}),e.emit({type:"step",step:"app.bind",status:"ok",message:`The gateway binds ${b(c)} (gateway version ${s.versionId??"unknown"}).`,data:{versionId:s.versionId,newHosts:s.newHosts}})}catch(s){throw s instanceof f&&s.code==="LEASE_HELD"?new f("LEASE_HELD",`${s.message}
-${O[u]}`,{retryable:!0,rerunNote:"once the other deploy finishes",data:s.data}):s}}async function le({wait:i,db:a,appRowId:t,appId:e,hostname:r,out:l,seams:c,message:m,verb:v}){if(!i)return!1;let{outcome:y,waited:d}=await G({db:a,appRowId:t,appId:e,hostname:r,out:l,verb:v,...c});return y!=="live"?!1:(l.emit({type:"step",step:"app.live",status:"ok",message:m,data:{hostname:r,url:`https://${r}`,...d?{waited:d}:{}}}),!0)}function ce(i){return{url:i.liveUrl,workerName:i.workerName,versionId:i.versionId,live:i.live}}export{oe as a,ne as b,pe as c,le as d,ce as e};
+${t} stays ${V[l]}.`,{retryable:!0,rerun:`${$} status`,rerunNote:`then ${l} again`})}(s===null||u()-s>=B)&&(h=p?"live":"certificate",r.emit({type:"progress",step:g,message:p?`Waiting for ${t} to go live`:`Waiting for the certificate for ${e} (usually under 5m)`,data:{hostname:e,waitedMs:w,answered:p}}),s=u()),await v(m)}}async function G(i,a,t){let e=await k(i,a);if(!e||e.status===P)throw new f("APP_NOT_FOUND",`${t} was deleted during this run
+Someone removed it from the Gateway while this run waited for it to go live.`,{retryable:!0,rerunNote:"to put it back"});return e.status}function oe(i,a,t){let e=W({out:a,verbose:t});return{openRelease:i?.openRelease??e.open,source:i?.source??e.describe}}function ne(i,{manifest:a,install:t,deployer:e,accountName:r}){return _(i,{appSlug:a.id,name:a.name??a.id,description:a.description??a.id,manifest:a,appBaseDomain:t.appBaseDomain,deployer:e,organizationName:r??""})}var O={["deploy"]:"This app's upload is kept; deploying again binds it and makes it live."};async function pe({cf:i,db:a,databaseId:t,out:e,accountId:r,appId:l,workerName:c,publishHost:d,interactive:v,forceDns:y,seams:m,verb:u}){let o=await A(a);if(o?.liveAppWorkers.includes(c)&&!d)return;e.emit({type:"step",step:"app.bind",status:"start",message:`Binding ${b(c)} on the gateway${d?" and publishing its hostname":""}...`,data:{appId:l}});let n=(await m.source?.())?.version,p=n!==void 0&&o!==null&&n!==o.releaseVersion;p&&e.emit({type:"step",step:"gateway.upgrade",status:"start",message:`Upgrading the Gateway ${o.releaseVersion} \u2192 ${n}...`,data:{from:o.releaseVersion,to:n}});try{let s=await I({cf:i,out:e,accountId:r,databaseId:t,interactive:v,cliVersion:R,force:!0,forceDns:y,...m});p&&e.emit({type:"step",step:"gateway.upgrade",status:"ok",data:{to:n}}),e.emit({type:"step",step:"app.bind",status:"ok",message:`The gateway binds ${b(c)} (gateway version ${s.versionId??"unknown"}).`,data:{versionId:s.versionId,newHosts:s.newHosts}})}catch(s){throw s instanceof f&&s.code==="LEASE_HELD"?new f("LEASE_HELD",`${s.message}
+${O[u]}`,{retryable:!0,rerunNote:"once the other deploy finishes",data:s.data}):s}}async function le({wait:i,db:a,appRowId:t,appId:e,hostname:r,out:l,seams:c,message:d,verb:v}){if(!i)return!1;let{outcome:y,waited:m}=await x({db:a,appRowId:t,appId:e,hostname:r,out:l,verb:v,...c});return y!=="live"?!1:(l.emit({type:"step",step:"app.live",status:"ok",message:d,data:{hostname:r,url:`https://${r}`,...m?{waited:m}:{}}}),!0)}function ce(i){return{url:i.liveUrl,workerName:i.workerName,versionId:i.versionId,live:i.live}}export{oe as a,ne as b,pe as c,le as d,ce as e};

package/dist/{chunk-HOUHG236.js → chunk-ZCJTJDAI.js}

@@ -1,4 +1,4 @@
-import{b as k}from"./chunk-T2GD7RHS.js";import{Bb as S,Fb as C,Jb as M,Pb as U,c as q,g as H,i as h,jc as p}from"./chunk-LYNBZ7RV.js";import{randomBytes as J}from"node:crypto";import R from"node:os";var Z={["app.deploy"]:{noun:"deploy",of:e=>`a deploy${e?` of ${e}`:""}`},["app.register"]:{noun:"registration",of:e=>`a registration${e?` of ${e}`:""}`},["app.secrets"]:{noun:"secret change",of:e=>`a secret change${e?` on ${e}`:""}`},["app.email"]:{noun:"email change",of:e=>`an email change${e?` on ${e}`:""}`},["gateway.deploy"]:{noun:"Gateway install",of:()=>"a Gateway install"},["gateway.upgrade"]:{noun:"Gateway upgrade",of:()=>"a Gateway upgrade"},["gateway.reconcile"]:{noun:"Gateway update",of:()=>"an update of the Gateway's apps"},["gateway.secrets"]:{noun:"Gateway settings change",of:()=>"a change to the Gateway's settings"},["access.sync"]:{noun:"Cloudflare Access update",of:()=>"an update of Cloudflare Access"},["db.restore"]:{noun:"database restore",of:e=>`a restore of ${e?`${e}'s database`:"the Gateway's database"}`}},ee=`CREATE TABLE IF NOT EXISTS _everyapp_deploy_lease (
+import{b as k}from"./chunk-LTMQP62I.js";import{Cc as p,Ub as S,Yb as C,ac as M,c as q,g as H,gc as U,i as h}from"./chunk-NXO2BC3M.js";import{randomBytes as J}from"node:crypto";import R from"node:os";var Z={["app.deploy"]:{noun:"deploy",of:e=>`a deploy${e?` of ${e}`:""}`},["app.register"]:{noun:"registration",of:e=>`a registration${e?` of ${e}`:""}`},["app.secrets"]:{noun:"secret change",of:e=>`a secret change${e?` on ${e}`:""}`},["app.email"]:{noun:"email change",of:e=>`an email change${e?` on ${e}`:""}`},["gateway.deploy"]:{noun:"Gateway install",of:()=>"a Gateway install"},["gateway.upgrade"]:{noun:"Gateway upgrade",of:()=>"a Gateway upgrade"},["gateway.reconcile"]:{noun:"Gateway update",of:()=>"an update of the Gateway's apps"},["gateway.secrets"]:{noun:"Gateway settings change",of:()=>"a change to the Gateway's settings"},["access.sync"]:{noun:"Cloudflare Access update",of:()=>"an update of Cloudflare Access"},["db.restore"]:{noun:"database restore",of:e=>`a restore of ${e?`${e}'s database`:"the Gateway's database"}`}},ee=`CREATE TABLE IF NOT EXISTS _everyapp_deploy_lease (
   id TEXT PRIMARY KEY,
   holder TEXT NOT NULL,
   purpose TEXT NOT NULL,

package/dist/{chunk-H6QQMY7B.js → chunk-ZH6IAPVK.js}

@@ -1,4 +1,4 @@
-import{a as ue,d as fe,f as we,h as G,j as ge,k as he,p as ve,q as be}from"./chunk-6OGVO7QK.js";import{a as ke,c as De,d as M}from"./chunk-N5GQLGEC.js";import{b as ye,c as T}from"./chunk-W3JCQHHU.js";import{b as C,c as P,e as ie,f as le}from"./chunk-ZFCUH5PK.js";import{b as ce}from"./chunk-23HJ5I2A.js";import{a as pe,c as de,e as me}from"./chunk-6PGUCTJ6.js";import{h as Q}from"./chunk-HOUHG236.js";import{V as se,d as ee,f as te,g as ae,h as re,i as oe,k as ne,l as _}from"./chunk-RMF4YGD6.js";import{a as X}from"./chunk-T2GD7RHS.js";import{Bb as h,Eb as F,Fb as V,Gb as K,Hb as Y,Qb as Z,Xb as A,Zb as q,_b as J,c as R,d as S,f as O,qb as D,vb as j}from"./chunk-LYNBZ7RV.js";import{execFile as x}from"node:child_process";import y from"node:fs/promises";import k from"node:path";import{promisify as L}from"node:util";var N=["apps/every-app-gateway","packages/sdk","packages/perimeter","packages/toolbus","pnpm-workspace.yaml","pnpm-lock.yaml"],_e=3;function gt({out:e,verbose:t}){let a=ce();return{describe:()=>Me(a),open:()=>Le({root:a,out:e,verbose:t})}}function Ge(e){return k.join(e,"node_modules",".cache","everyapp")}async function W(e){let t;try{({stdout:t}=await L(x)("git",["ls-files","-z","--cached","--others","--exclude-standard","--",...N],{cwd:e,maxBuffer:64*1024*1024}))}catch{return null}let a=[...new Set(t.split("\0").filter(Boolean))];return a.length>0?we(e,a):null}async function Re(e){try{let{stdout:t}=await L(x)("git",["log","-1","--format=%ct","--",...N],{cwd:e}),a=Number.parseInt(t.trim(),10);return Number.isFinite(a)?a*1e3:null}catch{return null}}async function Te(e,t){let a=r=>L(x)("git",r,{cwd:e}),o=()=>a(["diff","--quiet",`gateway-v${t}`,"HEAD","--",...N]).then(()=>!1,()=>!0);try{let[r,l]=await Promise.all([a(["rev-parse","--short","HEAD"]),a(["status","--porcelain","--",...N])]),n=l.stdout.trim()!=="";return!n&&!await o()?null:{hash:r.stdout.trim(),uncommittedChanges:n}}catch{return null}}async function Me(e){let t=k.join(e,"apps","every-app-gateway"),a=async c=>JSON.parse(await y.readFile(k.join(t,c),"utf8")),[o,r,l,n]=await Promise.all([W(e),Re(e),a("drizzle/meta/_journal.json"),a("package.json")]),s=String(n.version??"unknown"),i=await Te(e,s);return{treeSha256:o,origin:{kind:"checkout"},...i?{commit:i}:{},version:s,order:{schema:ge(l.entries??[]),committedAt:r??Date.now()}}}async function We({root:e,out:t,build:a,keep:o=_e}){let[r,l]=await Promise.all([W(e),Re(e)]),n=Ge(e),s=r?k.join(n,`${r}.tar.gz`):null,i={origin:{kind:"checkout"},treeSha256:r,committedAt:l};if(s&&await A(s))try{let m=await G(s,i),d=new Date;return await y.utimes(s,d,d),t.emit({type:"step",step:"gateway.release",status:"ok",message:`Using the Gateway ${m.manifest.version} built from this checkout before (${r.slice(0,12)}).`,data:{cached:!0,treeSha256:r,release:m.manifest.version}}),m}catch{await y.rm(s,{force:!0})}let c=await a();s&&await W(e)===r&&await xe(c,s,o);let p=await G(c,{origin:{kind:"checkout"},treeSha256:s&&await A(s)?r:null,committedAt:l});return t.emit({type:"step",step:"gateway.release",status:"ok",message:`Built the Gateway ${p.manifest.version} from this checkout.`,data:{cached:!1,treeSha256:p.source.treeSha256,release:p.manifest.version}}),p}async function xe(e,t,a){let o=k.dirname(t);await y.mkdir(o,{recursive:!0});let r=`${t}.${process.pid}.partial`;await y.copyFile(e,r),await y.rename(r,t);let l=await Promise.all((await y.readdir(o)).filter(n=>n.endsWith(".tar.gz")).map(async n=>({file:k.join(o,n),usedAt:(await y.stat(k.join(o,n))).mtimeMs})));for(let{file:n}of l.sort((s,i)=>i.usedAt-s.usedAt).slice(a))n!==t&&await y.rm(n,{force:!0})}function Le({root:e,out:t,verbose:a}){return We({root:e,out:t,build:()=>ze(e,t,a??!1)})}async function ze(e,t,a,o=process.env){let r=k.join(e,"apps","every-app-gateway");t.emit({type:"step",step:"gateway.release",status:"start",message:"Building the Gateway from this checkout (usually 1\u20132m)",data:{dir:r}});let l=(n,s)=>J("pnpm",n,{cwd:s,env:{...o,NODE_OPTIONS:Z(o.NODE_OPTIONS)},echo:a,what:"Building the Gateway",code:"GATEWAY_BUILD_FAILED",fix:"fix the build error above, then run this again",logName:"gateway-build"});return await l(["--filter","@every-app/sdk","build"],e),await l(["run","build:release"],r),k.join(r,ue)}var Be=`SELECT apps.app_slug, apps.worker_name, apps.hostname, apps.status,
+import{a as ue,d as fe,f as we,h as G,j as ge,k as he,p as ve,q as be}from"./chunk-ONGI463M.js";import{a as ke,c as De,d as M}from"./chunk-3GZA6EEZ.js";import{b as ye,c as T}from"./chunk-52NQ23OH.js";import{b as C,c as P,e as ie,f as le}from"./chunk-J2XKGQO7.js";import{b as ce}from"./chunk-AIDX5IYA.js";import{a as pe,c as de,e as me}from"./chunk-RXSJENSN.js";import{h as Q}from"./chunk-ZCJTJDAI.js";import{W as se,d as ee,f as te,g as ae,h as re,i as oe,k as ne,l as _}from"./chunk-OHDR7JWQ.js";import{a as X}from"./chunk-LTMQP62I.js";import{Db as D,Ib as j,Ub as h,Xb as F,Yb as V,Zb as K,_b as Y,c as R,d as S,f as O,hc as Z,oc as A,qc as q,rc as J}from"./chunk-NXO2BC3M.js";import{execFile as x}from"node:child_process";import y from"node:fs/promises";import k from"node:path";import{promisify as L}from"node:util";var N=["apps/every-app-gateway","packages/sdk","packages/perimeter","packages/toolbus","pnpm-workspace.yaml","pnpm-lock.yaml"],_e=3;function gt({out:e,verbose:t}){let a=ce();return{describe:()=>Me(a),open:()=>Le({root:a,out:e,verbose:t})}}function Ge(e){return k.join(e,"node_modules",".cache","everyapp")}async function W(e){let t;try{({stdout:t}=await L(x)("git",["ls-files","-z","--cached","--others","--exclude-standard","--",...N],{cwd:e,maxBuffer:64*1024*1024}))}catch{return null}let a=[...new Set(t.split("\0").filter(Boolean))];return a.length>0?we(e,a):null}async function Re(e){try{let{stdout:t}=await L(x)("git",["log","-1","--format=%ct","--",...N],{cwd:e}),a=Number.parseInt(t.trim(),10);return Number.isFinite(a)?a*1e3:null}catch{return null}}async function Te(e,t){let a=r=>L(x)("git",r,{cwd:e}),o=()=>a(["diff","--quiet",`gateway-v${t}`,"HEAD","--",...N]).then(()=>!1,()=>!0);try{let[r,l]=await Promise.all([a(["rev-parse","--short","HEAD"]),a(["status","--porcelain","--",...N])]),n=l.stdout.trim()!=="";return!n&&!await o()?null:{hash:r.stdout.trim(),uncommittedChanges:n}}catch{return null}}async function Me(e){let t=k.join(e,"apps","every-app-gateway"),a=async c=>JSON.parse(await y.readFile(k.join(t,c),"utf8")),[o,r,l,n]=await Promise.all([W(e),Re(e),a("drizzle/meta/_journal.json"),a("package.json")]),s=String(n.version??"unknown"),i=await Te(e,s);return{treeSha256:o,origin:{kind:"checkout"},...i?{commit:i}:{},version:s,order:{schema:ge(l.entries??[]),committedAt:r??Date.now()}}}async function We({root:e,out:t,build:a,keep:o=_e}){let[r,l]=await Promise.all([W(e),Re(e)]),n=Ge(e),s=r?k.join(n,`${r}.tar.gz`):null,i={origin:{kind:"checkout"},treeSha256:r,committedAt:l};if(s&&await A(s))try{let m=await G(s,i),d=new Date;return await y.utimes(s,d,d),t.emit({type:"step",step:"gateway.release",status:"ok",message:`Using the Gateway ${m.manifest.version} built from this checkout before (${r.slice(0,12)}).`,data:{cached:!0,treeSha256:r,release:m.manifest.version}}),m}catch{await y.rm(s,{force:!0})}let c=await a();s&&await W(e)===r&&await xe(c,s,o);let p=await G(c,{origin:{kind:"checkout"},treeSha256:s&&await A(s)?r:null,committedAt:l});return t.emit({type:"step",step:"gateway.release",status:"ok",message:`Built the Gateway ${p.manifest.version} from this checkout.`,data:{cached:!1,treeSha256:p.source.treeSha256,release:p.manifest.version}}),p}async function xe(e,t,a){let o=k.dirname(t);await y.mkdir(o,{recursive:!0});let r=`${t}.${process.pid}.partial`;await y.copyFile(e,r),await y.rename(r,t);let l=await Promise.all((await y.readdir(o)).filter(n=>n.endsWith(".tar.gz")).map(async n=>({file:k.join(o,n),usedAt:(await y.stat(k.join(o,n))).mtimeMs})));for(let{file:n}of l.sort((s,i)=>i.usedAt-s.usedAt).slice(a))n!==t&&await y.rm(n,{force:!0})}function Le({root:e,out:t,verbose:a}){return We({root:e,out:t,build:()=>ze(e,t,a??!1)})}async function ze(e,t,a,o=process.env){let r=k.join(e,"apps","every-app-gateway");t.emit({type:"step",step:"gateway.release",status:"start",message:"Building the Gateway from this checkout (usually 1\u20132m)",data:{dir:r}});let l=(n,s)=>J("pnpm",n,{cwd:s,env:{...o,NODE_OPTIONS:Z(o.NODE_OPTIONS)},echo:a,what:"Building the Gateway",code:"GATEWAY_BUILD_FAILED",fix:"fix the build error above, then run this again",logName:"gateway-build"});return await l(["--filter","@every-app/sdk","build"],e),await l(["run","build:release"],r),k.join(r,ue)}var Be=`SELECT apps.app_slug, apps.worker_name, apps.hostname, apps.status,
   organization_keys.org_key
 FROM apps LEFT JOIN organization_keys
   ON organization_keys.organization_id = apps.organization_id

package/dist/{configure-F7UZCJUG.js → configure-EJKUEVYS.js}

@@ -1,4 +1,4 @@
-import{C as z,G as Q,H as B,a as j,b as V,s as P,t as Z,u as Y}from"./chunk-IFCPALVC.js";import{a as v}from"./chunk-WOVS3GV5.js";import{a as O,b as _,c as M,d as D,i as G,j as q,l as L,m as E,o as F,q as U}from"./chunk-OM2HDWVP.js";import"./chunk-ZFCUH5PK.js";import"./chunk-4JRIS6S6.js";import"./chunk-ZECBN24L.js";import"./chunk-HOUHG236.js";import{ia as b,qa as k,sa as x}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import{b as W}from"./chunk-H7PDL3X5.js";import{a as S,b as A,e as I,f as N,g as R,h as T}from"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{Bb as g,Z as $,c as m,k as y,wc as C}from"./chunk-LYNBZ7RV.js";import{text as ee}from"node:stream/consumers";import w from"chalk";var te={secret:(e,{context:i,optional:n})=>R(e,{context:i,optional:n}),text:(e,{context:i,optional:n,validate:o})=>N(e,{context:i,validate:s=>n&&!s.trim()?null:o(s)}),confirm:A,choose:(e,i,n)=>I(e,i,{context:n})};async function Oe(e,i){await C(e,n=>ne({flags:e,out:n,appId:i}))}async function ne(e){let{out:i,flags:n}=e,o=e.interactive??S(n.json??!1),s=e.prompter??te;ie(e.appId);let t=await re(e),r=await J(t),a=se(r,t);if(o){let h=e.tell??T;for(let X of ae(t,r))h(X)}let c=await ce(t,r,a,e),p=o?await ue(t,r,a,c,s):{},l=de({...c,...p},r),d=Object.keys(l);if(d.length===0&&!r.setup.ready&&!o)throw me(t,r,a);let f=d.length>0?await oe(t,l,e):null,u=f?await J({...t,registry:f.gateway?.bound?.length?await v(t.connection.db,t.connection.install):t.registry}):r;t.deployed&&t.source==="registry"?await V(t.connection.db,{appRowId:t.deployed.rowId,setup:u.setup,deployer:t.connection.deployer},i):t.deployed&&await j(t.connection,{gateway:[],appRowId:t.deployed.rowId},i),ge(t,u,a,d,f,i)}async function oe(e,i,n){try{return await z(e.connection,{manifest:e.manifest,source:e.source,app:e.deployed},i,{...n,...e.deployed&&e.source==="registry"?{setupRecordedBy:e.deployed.rowId}:{}})}catch(o){throw!(o instanceof g)||o.code!=="SECRETS_PARTIALLY_APPLIED"?o:new g(o.code,o.message,{...K(e,"to set what is left"),retryable:!0,data:o.data})}}function K(e,i,n=""){return e.deployed?{rerun:`${m} configure ${e.appId}${n}`,rerunNote:i}:{rerun:`${m} configure${n}`,rerunNote:`in the app's directory, ${i}`}}function ie(e){if(!e?.includes("="))return;let i=e.split("=")[0];throw new g("VALUE_ON_COMMAND_LINE",`${i}=\u2026 looks like a value on the command line, which configure never takes
+import{C as z,G as Q,H as B,a as j,b as V,s as P,t as Z,u as Y}from"./chunk-WTKBB5HE.js";import{a as v}from"./chunk-LTYAIGEB.js";import{a as O,b as _,c as M,d as D,i as G,j as q,l as L,m as E,o as F,q as U}from"./chunk-CGFABBZA.js";import"./chunk-J2XKGQO7.js";import"./chunk-36VCEEIH.js";import"./chunk-IWP4Q3KV.js";import"./chunk-ZCJTJDAI.js";import{ja as b,ra as k,ta as x}from"./chunk-OHDR7JWQ.js";import"./chunk-HT76NR3O.js";import"./chunk-LTMQP62I.js";import{b as W}from"./chunk-KTX5YGBL.js";import{a as S,b as A,e as I,f as N,g as R,h as T}from"./chunk-MLZJBYSY.js";import"./chunk-JT3R24Y7.js";import{Pc as C,Ub as g,c as m,ca as $,k as y}from"./chunk-NXO2BC3M.js";import{text as ee}from"node:stream/consumers";import w from"chalk";var te={secret:(e,{context:i,optional:n})=>R(e,{context:i,optional:n}),text:(e,{context:i,optional:n,validate:o})=>N(e,{context:i,validate:s=>n&&!s.trim()?null:o(s)}),confirm:A,choose:(e,i,n)=>I(e,i,{context:n})};async function Oe(e,i){await C(e,n=>ne({flags:e,out:n,appId:i}))}async function ne(e){let{out:i,flags:n}=e,o=e.interactive??S(n.json??!1),s=e.prompter??te;ie(e.appId);let t=await re(e),r=await J(t),a=se(r,t);if(o){let h=e.tell??T;for(let X of ae(t,r))h(X)}let c=await ce(t,r,a,e),p=o?await ue(t,r,a,c,s):{},l=de({...c,...p},r),d=Object.keys(l);if(d.length===0&&!r.setup.ready&&!o)throw me(t,r,a);let f=d.length>0?await oe(t,l,e):null,u=f?await J({...t,registry:f.gateway?.bound?.length?await v(t.connection.db,t.connection.install):t.registry}):r;t.deployed&&t.source==="registry"?await V(t.connection.db,{appRowId:t.deployed.rowId,setup:u.setup,deployer:t.connection.deployer},i):t.deployed&&await j(t.connection,{gateway:[],appRowId:t.deployed.rowId},i),ge(t,u,a,d,f,i)}async function oe(e,i,n){try{return await z(e.connection,{manifest:e.manifest,source:e.source,app:e.deployed},i,{...n,...e.deployed&&e.source==="registry"?{setupRecordedBy:e.deployed.rowId}:{}})}catch(o){throw!(o instanceof g)||o.code!=="SECRETS_PARTIALLY_APPLIED"?o:new g(o.code,o.message,{...K(e,"to set what is left"),retryable:!0,data:o.data})}}function K(e,i,n=""){return e.deployed?{rerun:`${m} configure ${e.appId}${n}`,rerunNote:i}:{rerun:`${m} configure${n}`,rerunNote:`in the app's directory, ${i}`}}function ie(e){if(!e?.includes("="))return;let i=e.split("=")[0];throw new g("VALUE_ON_COMMAND_LINE",`${i}=\u2026 looks like a value on the command line, which configure never takes
 It lands in the shell's history and the process list: rotate it if it was real. Nothing was set.`,{fix:`pipe NAME=value lines in (one per line), or export ${i} and add --from-env`})}async function re(e){let i=()=>x({gateway:k(e.flags.gateway),accountId:e.flags["account-id"],interactive:S(e.flags.json??!1),login:{json:e.flags.json,out:e.out,step:"login"},createCf:e.createCf});if(e.appId){let t=await i(),r=await b(t.db,e.appId);if(!r||r.status==="pending")throw new g("APP_NOT_FOUND",`${e.appId} isn't deployed to this Gateway
 An app is configured by name after its first deploy; in its directory, configure works before that too (for the Gateway's settings). Nothing was changed.`,{rerun:`${m} status`,rerunNote:"lists its apps"});let a=Q(r);return{appId:a.id,manifest:a,source:"registry",deployed:{workerName:r.workerName,rowId:r.id},connection:t,registry:await v(t.db,t.install)}}let n=await W(e.cwd??process.cwd());if(!n)throw new g("MANIFEST_NOT_FOUND","No everyapp.config.ts in this directory, and no app named",{fix:`name the app: ${m} configure <app> (${m} status lists them), or run this from its directory`});let o=await i(),s=await b(o.db,n.id);return{appId:n.id,manifest:n,source:"directory",deployed:s&&s.status!=="pending"?{workerName:s.workerName,rowId:s.id}:null,connection:o,registry:await v(o.db,o.install)}}async function J(e){let{cf:i}=e.connection,n=M(await O(i),e.registry),o=e.deployed?await _(i,e.deployed.workerName):null,{report:s,setup:t}=D({manifest:e.manifest,appId:e.appId,gatewayNames:n,secretNames:o,lookup:e.registry}),r=new Set;for(let a of s.settings){let c=a.holder==="gateway"?n:o??[];for(let p of[...a.names,...a.alsoReads])c.includes(p)&&r.add(p)}return{report:s,setup:t,held:r}}function se({report:e},i){let n=t=>t.names.length>0&&(t.holder==="gateway"||i.deployed!==null),o=t=>t.set===!1&&n(t),s=new Set(e.groups.filter(t=>t.met).map(t=>t.group));return{required:e.settings.filter(t=>t.need.kind==="required"&&o(t)),groups:e.groups.filter(t=>!t.met&&t.members.some(r=>r.blocking)).map(t=>({group:t.group,members:t.members.filter(o)})).filter(t=>t.members.length>0),optional:e.settings.filter(t=>o(t)&&!t.blocking&&(t.need.kind==="optional"||t.need.kind==="anyOf"&&s.has(t.need.group))),afterDeploy:e.settings.filter(t=>t.holder==="app"&&t.names.length>0&&i.deployed===null)}}function ae(e,{report:i}){let n=q(e.appId,i.settings).map(o=>!e.deployed&&o.where===e.appId?{...o,status:w.dim("after first deploy")}:o);return[w.dim(`${e.appId}'s settings are held as the Gateway's secrets: an AI key or a capability's client on the Gateway Worker, once for every app; ${e.appId}'s own secrets on its Worker. Changes are live at once, no deploy needed.`),"",...n.length>0?L(n,{app:!1}):[w.dim(`${e.appId} declares no secrets and needs no Gateway settings.`)],""]}function le({report:e},i){return e.settings.find(n=>n.names.includes(i))??e.settings.find(n=>n.alsoReads.includes(i))}function de(e,{report:i}){let n={};for(let o of i.settings)for(let s of[...o.names,...o.alsoReads])e[s]!==void 0&&n[s]===void 0&&(n[s]=e[s]);return n}async function ce(e,i,n,o){let s={},t=(a,c)=>$(a)?Y(a,c):c,r=o.flags["from-env"]?null:await(o.readStdin??pe)();if(r!==null)for(let{name:a,value:c,line:p}of fe(r)){let l=le(i,a);if(!l){let d=/^[A-Z][A-Z0-9_]*$/.test(a)?a:`line ${p} (not shown: it may be a value)`;throw new g("SECRET_NOT_DECLARED",`${e.appId} doesn't declare ${d}
 The piped lines set what its ${e.source==="registry"?"deployed manifest":"everyapp.config.ts"} lists (a provider, a capability or one of its secrets). Nothing was set.`,{fix:`leave it out, or declare it in everyapp.config.ts${e.source==="registry"?" and deploy again":""}; a bare value goes to ${m} secret set NAME`})}if(l.holder==="app"&&!e.deployed)throw new g("APP_NOT_FOUND",`${e.appId} isn't deployed yet

package/dist/{create-2E5HVWYK.js → create-BKEFXQ5N.js}

@@ -1,4 +1,4 @@
-import{a as X}from"./chunk-J35DDCNU.js";import{b as H}from"./chunk-CZXHKPRZ.js";import{b as Q,c as j,d as h}from"./chunk-23HJ5I2A.js";import"./chunk-ONLNJXVQ.js";import{a as q}from"./chunk-H7PDL3X5.js";import{a as B,f as Y}from"./chunk-CCWBPAKH.js";import"./chunk-JYKRUS5C.js";import{$b as G,Bb as m,Fb as M,Vb as W,Wb as J,Xb as K,_b as U,ac as z,c as x,h as I,kb as O,l as C,pb as R,qb as _,wc as V}from"./chunk-LYNBZ7RV.js";import $ from"node:path";import w from"node:fs/promises";import E from"node:path";var ue=[".claude/skills",".agents/skills"],D={everyapp:"- Before running everyapp, read the everyapp skill: `.agents/skills/everyapp/SKILL.md` (also in `.claude/skills/`).","build-every-app":"- To build or change this app, read the build-every-app skill: `.agents/skills/build-every-app/SKILL.md` (patterns in patterns.md beside it)."};function N(e){return E.join(e,"packages","cli","skills")}async function he(e){let t=[];for(let r of await w.readdir(N(e),{withFileTypes:!0}))if(r.isDirectory())try{await w.access(E.join(N(e),r.name,"SKILL.md")),t.push(r.name)}catch{}let i=Object.keys(D).filter(r=>t.includes(r)),n=t.filter(r=>!(r in D)).sort();return[...i,...n]}function Z(e){return D[e]??`- Read the ${e} skill: \`.agents/skills/${e}/SKILL.md\` (also in \`.claude/skills/\`).`}async function ee({root:e,appDir:t}){let i=await he(e),n=[];for(let r of i)for(let a of ue){let o=`${a}/${r}`,l=E.join(t,o);await w.rm(l,{recursive:!0,force:!0}),await w.cp(E.join(N(e),r),l,{recursive:!0}),n.push(o)}return{skills:i,paths:n,agentsMd:await ye(t,i)}}async function ye(e,t){let i=E.join(e,"AGENTS.md"),n;try{n=await w.readFile(i,"utf8")}catch{return await w.writeFile(i,`# Agent instructions
+import{a as X}from"./chunk-LKI3XV7I.js";import{b as H}from"./chunk-7BC42ZUS.js";import{b as Q,c as j,d as h}from"./chunk-AIDX5IYA.js";import"./chunk-475IB5UG.js";import{a as q}from"./chunk-KTX5YGBL.js";import{a as B,f as Y}from"./chunk-MLZJBYSY.js";import"./chunk-JT3R24Y7.js";import{Cb as R,Db as _,Pc as V,Ub as m,Yb as M,c as x,h as I,l as C,mc as W,nc as J,oc as K,rc as U,sc as G,tc as z,xb as O}from"./chunk-NXO2BC3M.js";import $ from"node:path";import w from"node:fs/promises";import E from"node:path";var ue=[".claude/skills",".agents/skills"],D={everyapp:"- Before running everyapp, read the everyapp skill: `.agents/skills/everyapp/SKILL.md` (also in `.claude/skills/`).","build-every-app":"- To build or change this app, read the build-every-app skill: `.agents/skills/build-every-app/SKILL.md` (patterns in patterns.md beside it)."};function N(e){return E.join(e,"packages","cli","skills")}async function he(e){let t=[];for(let r of await w.readdir(N(e),{withFileTypes:!0}))if(r.isDirectory())try{await w.access(E.join(N(e),r.name,"SKILL.md")),t.push(r.name)}catch{}let i=Object.keys(D).filter(r=>t.includes(r)),n=t.filter(r=>!(r in D)).sort();return[...i,...n]}function Z(e){return D[e]??`- Read the ${e} skill: \`.agents/skills/${e}/SKILL.md\` (also in \`.claude/skills/\`).`}async function ee({root:e,appDir:t}){let i=await he(e),n=[];for(let r of i)for(let a of ue){let o=`${a}/${r}`,l=E.join(t,o);await w.rm(l,{recursive:!0,force:!0}),await w.cp(E.join(N(e),r),l,{recursive:!0}),n.push(o)}return{skills:i,paths:n,agentsMd:await ye(t,i)}}async function ye(e,t){let i=E.join(e,"AGENTS.md"),n;try{n=await w.readFile(i,"utf8")}catch{return await w.writeFile(i,`# Agent instructions
 
 ${t.map(Z).join(`
 `)}

package/dist/{db-HEQVTDTM.js → db-66QZCKMG.js}

@@ -1,4 +1,4 @@
-import{a as Y,b as K}from"./chunk-LXYMDZER.js";import{b as B,d as W,e as J}from"./chunk-CZXHKPRZ.js";import{b as _}from"./chunk-ZECBN24L.js";import{i as G}from"./chunk-ONLNJXVQ.js";import{b as C,c as F,ha as P,qa as q,sa as T}from"./chunk-RMF4YGD6.js";import"./chunk-NFU4YFXB.js";import"./chunk-T2GD7RHS.js";import{a as E,e as U,f as A}from"./chunk-H7PDL3X5.js";import{a as Q,i as x}from"./chunk-CCWBPAKH.js";import{t as k}from"./chunk-JYKRUS5C.js";import{Bb as s,Fb as N,Gb as v,Yb as O,ac as $,bc as S,c as D,d as L,f as w,pb as M,pc as j,wc as R}from"./chunk-LYNBZ7RV.js";import ot from"node:fs/promises";import it from"node:path";import{text as at}from"node:stream/consumers";import u from"chalk";function V(t,e){let n=nt(t.reduce((r,o)=>r+o.duration,0));if(t.length===1){let[r]=t;if(z(r))return`${w(r.changes,"row")} changed ${u.green("\u2713")} ${u.dim(`${e} \xB7 ${n}`)}`;let o=u.dim(`${w(r.rows.length,"row")} \xB7 ${e} \xB7 ${n}`);return r.rows.length===0?o:[...H(r),"",o].join(`
+import{a as Y,b as K}from"./chunk-VX4Z3D7A.js";import{b as B,d as W,e as J}from"./chunk-7BC42ZUS.js";import{b as _}from"./chunk-IWP4Q3KV.js";import{j as G}from"./chunk-475IB5UG.js";import{b as C,c as F,ia as P,ra as q,ta as T}from"./chunk-OHDR7JWQ.js";import"./chunk-HT76NR3O.js";import"./chunk-LTMQP62I.js";import{a as E,e as U,f as A}from"./chunk-KTX5YGBL.js";import{a as Q,i as x}from"./chunk-MLZJBYSY.js";import{t as k}from"./chunk-JT3R24Y7.js";import{Cb as M,Ic as j,Pc as R,Ub as s,Yb as N,Zb as v,c as D,d as L,f as w,pc as O,tc as $,uc as S}from"./chunk-NXO2BC3M.js";import ot from"node:fs/promises";import it from"node:path";import{text as at}from"node:stream/consumers";import u from"chalk";function V(t,e){let n=nt(t.reduce((r,o)=>r+o.duration,0));if(t.length===1){let[r]=t;if(z(r))return`${w(r.changes,"row")} changed ${u.green("\u2713")} ${u.dim(`${e} \xB7 ${n}`)}`;let o=u.dim(`${w(r.rows.length,"row")} \xB7 ${e} \xB7 ${n}`);return r.rows.length===0?o:[...H(r),"",o].join(`
 `)}return[...t.flatMap(r=>[...z(r)?[`${w(r.changes,"row")} changed`]:H(r),""]),u.dim(`${w(t.length,"statement")} \xB7 ${e} \xB7 ${n}`)].join(`
 `)}var z=t=>t.rows.length===0&&t.changes>0;function H({rows:t}){let e=Object.keys(t[0]??{});return e.length===0?[u.dim("0 rows")]:j(e,t.map(n=>e.map(r=>et(n[r]))))}function et(t){return t==null?u.dim("NULL"):typeof t=="string"?t.replaceAll(`
 `,"\\n"):typeof t=="object"?JSON.stringify(t):String(t)}var nt=t=>t<1?"<1ms":`${Math.round(t)}ms`,rt=[/^(select|explain|values)\b/i,/^with\b(?![\s\S]*\b(insert|update|delete|replace)\b)/i,/^pragma\b[^=]*$/i];function X(t){let e=t.split(";").map(n=>n.trim()).filter(Boolean);return e.length>0&&e.every(n=>rt.some(r=>r.test(n)))}var I="db.migrate";async function jt(t){await R(t,async e=>{await st({cwd:process.cwd(),out:e}),e.emit({type:"done"})})}async function st({cwd:t,out:e,cf:n=$()}){let r=await E(t);await Y(t,e);let o;try{o=await B({cwd:t,manifest:r,cf:n,onApply:()=>e.emit({type:"step",step:I,status:"start",message:"Applying migrations to the local database..."})})}catch(a){throw await ct({cwd:t,manifest:r,cf:n,error:a})}if(o.status==="skipped"){e.emit({type:"step",step:I,status:"skip",message:o.reason==="no_d1"?`${r.id} declares no D1 database, so there's nothing to migrate.`:`No migrations in ${A(r)}/ yet, so there's nothing to migrate.`,data:{reason:o.reason}});return}K(e,I,o)}async function ct({cwd:t,manifest:e,cf:n,error:r}){let{problem:o,sqliteCode:a}=C(N(r)),[i]=await W({cwd:t,manifest:e,cf:n}).catch(()=>[]);return new s("MIGRATIONS_FAILED",[i?`Migration ${i} failed`:"A local migration failed",a?`${o} (${a})`:o].join(`

package/dist/delete-JR5R2OHE.js

@@ -0,0 +1,3 @@
+import{f as ne}from"./chunk-JBTV62V7.js";import{a as J}from"./chunk-YCADEJVJ.js";import{e as Z,h as ee,k as te,o as oe,p as re}from"./chunk-Y6CGMZEB.js";import{h as X}from"./chunk-Q44H7KLY.js";import{a as Y}from"./chunk-TQWCYF2T.js";import{m as q}from"./chunk-ZH6IAPVK.js";import"./chunk-ONGI463M.js";import{e as Q}from"./chunk-WV4G6E4T.js";import"./chunk-UEQMNXMZ.js";import"./chunk-3GZA6EEZ.js";import{b as H}from"./chunk-52NQ23OH.js";import{M as K,P as E}from"./chunk-XEPXX3AI.js";import{c as b,d as B}from"./chunk-J2XKGQO7.js";import"./chunk-36VCEEIH.js";import"./chunk-AIDX5IYA.js";import{a as v,b as M,g as _,h as $}from"./chunk-IWP4Q3KV.js";import"./chunk-475IB5UG.js";import"./chunk-RXSJENSN.js";import"./chunk-ZCJTJDAI.js";import{k as P,m as x,o as j,q as G,qa as F,r as T,ra as V,ta as O}from"./chunk-OHDR7JWQ.js";import"./chunk-HT76NR3O.js";import"./chunk-LTMQP62I.js";import{c as U}from"./chunk-KTX5YGBL.js";import{a as S,f as N,i as z}from"./chunk-MLZJBYSY.js";import"./chunk-JT3R24Y7.js";import{Nb as C,Pc as L,Wb as A,_b as I,b as R,c as h,f as D,k as W}from"./chunk-NXO2BC3M.js";import ce from"node:path";import ae from"chalk";async function Be(t,n){await L(t,async l=>{let o=n??(await U(ce.join(process.cwd(),"everyapp.config.ts"),{message:"Which app? There's no everyapp.config.ts here",fix:`run this from the app's directory, or name it: ${h} delete <id>`})).id,a=S(t.json??!1);await ge({appId:o,flags:t,interactive:a});let i=await le({appId:o,gateway:V(t.gateway),accountId:t["account-id"],out:l,json:t.json,interactive:a,purge:t.purge??!1});l.emit({type:"done",...de(o,i)})})}async function le({appId:t,gateway:n,accountId:l,out:o,json:a,interactive:i,purge:r,createCf:m,reconcile:g}){let c=await O({gateway:n,accountId:l,interactive:i,login:{json:a,out:o,step:"app.login"},createCf:m}),{cf:p,db:f}=c,k=J(g,o);await q(c.install,k.source),o.emit({type:"step",step:"app.delete",status:"start",message:`Removing ${t} from the Gateway...`,data:{appId:t}});let y=(await K(f)).find(me=>me.appId===t),u={publicRoutes:(y?.publicPaths.length??0)>0,mcp:y?.mcp??!1},d=await F(f,t,c.deployer,Date.now(),{purge:r}),e=c.install,s=e.liveAppWorkers.includes(d.workerName)||e.liveDomains.includes(d.hostname);(!d.alreadyDeleted||s)&&await Y({cf:p,out:o,accountId:c.accountId,databaseId:c.databaseId,interactive:i,cliVersion:R,...g,openRelease:k.openRelease}),await E({cf:p,db:f,install:c.install,out:o},{appId:t,surface:u,removing:!0}),o.emit({type:"step",step:"app.delete",status:"ok",message:`${t} is deleted on the gateway; ${d.hostname} stops serving it.`,data:{appId:t,hostname:d.hostname,workerName:d.workerName,alreadyDeleted:d.alreadyDeleted&&!s}});let w=await P(f);if(w&&H(d.hostname,w.appBaseDomain)&&!w.liveDomains.includes(d.hostname)&&await ne({cf:p,out:o,zoneId:w.zoneId,hostname:d.hostname}),!r)return d;let ie=await fe(p,f,c.accountId,o,t,d);return{...d,purged:ie}}function de(t,{workerName:n,alreadyDeleted:l,purged:o}){let a=`${h} delete ${t} --purge`,i=o?o.kept.length>0?`Deleted ${t}${o.removed.length>0?` and ${o.removed.join(", ")}`:""}; kept ${o.kept.join(", ")}.`:o.removed.length>0?`Deleted ${t} and ${o.removed.join(", ")}.`:`Deleted ${t}; nothing of it was left in Cloudflare.`:`${l?`${t} was already deleted`:`Deleted ${t}`}; its Worker and data are kept, and any cron triggers, Workflows and mail routes keep running.`,r=o?"":l?ae.dim(`Its Worker and data are kept. To delete them: ${a}`):["Its Worker and data are kept, and any cron triggers, Workflows and mail routes keep running.",`To delete those too: ${a}`].map(m=>ae.dim(m)).join(`
+`);return{message:i,display:r,data:{appId:t,workerName:n,alreadyDeleted:l,purged:o?o.kept.length===0:!1,removed:o?.removed??[],kept:o?.kept??[]}}}var pe=["Worker","Workflow","D1 database","KV namespace","Hyperdrive config","Vectorize index","AI Gateway","mail route"],se={worker:"Compute (Workers) \u2192 Workers & Pages",d1:"Storage & Databases \u2192 D1",kv:"Storage & Databases \u2192 KV",workflow:"Compute (Workers) \u2192 Workflows",vectorize:"AI \u2192 Vectorize"};async function fe(t,n,l,o,a,i){o.emit({type:"step",step:"app.purge",status:"start",message:`Deleting ${a}'s Worker and data...`,data:{appId:a}});let r=new Map,m=e=>r.set(e,(r.get(e)??0)+1),g=await M(n,i.workerName),c=await Q({cf:t,gatewayDb:n,accountId:l,workerName:i.workerName,routes:g.filter(e=>e.kind==="email-route")});c.length>0&&r.set("mail route",c.length);let p=g.filter(e=>e.kind!=="email-route"),f=[],k=new Set(p.flatMap(e=>e.kind==="worker"&&e.resourceId?[e.resourceId]:[]));if(k.size>0)for(let e of await oe(t,i.workerName)){if(!k.has(e.script_name??"")){if(e.name.startsWith(`${i.workerName}--`)){let s=e.script_name??"unknown";f.push({described:`Workflow "${e.name}" (Worker ${s}'s)`,shown:`the Workflow ${e.name}, which Worker ${s} runs`,place:se.workflow})}continue}await re(t,e.name)&&(c.push(`Workflow "${e.name}"`),m("Workflow"))}let y=e=>e.kind!=="worker"?2:e.binding===""?0:1;for(let e of p.sort((s,w)=>y(s)-y(w)))if(e.resourceId)try{if(e.kind==="worker"){if(!await b(t,e.resourceId))continue;await B(t,e.resourceId)}else e.kind==="d1"?await G(t,e.resourceId):e.kind==="hyperdrive"?await Z(t,e.resourceId):e.kind==="vectorize"?await te(t,e.resourceId):e.kind==="ai-gateway"?await X(t,e.resourceId):await T(t,e.resourceId);c.push($(e)),m(v[e.kind])}catch(s){if(!I(s,"not_found"))throw s}await _(n,i.workerName);let u=[...await ue(t,i,p),...f],d=pe.flatMap(e=>{let s=r.get(e)??0;return s===0?[]:[s===1?e:D(s,e)]});if(o.emit({type:"step",step:"app.purge",status:"ok",message:c.length?`Deleted ${c.join(", ")}.`:"Nothing deleted in Cloudflare.",data:{appId:a,removed:c,kinds:d}}),u.length>0){let e=u.length===1;o.emit({type:"warning",code:"RESOURCES_KEPT",step:"app.purge",message:[`Kept ${W(u.map(s=>s.shown))}`,e?`It has ${a}'s name, but no deploy recorded creating it, so it may belong to something else.`:`They have ${a}'s names, but no deploy recorded creating them, so they may belong to something else.`].join(`
+`),data:{kept:u.map(s=>s.described),fix:e?`if it is ${a}'s, delete it in the Cloudflare dashboard (${u[0].place})`:`if they are ${a}'s, delete them in the Cloudflare dashboard`}})}return{removed:c,kept:u.map(e=>e.described)}}async function ue(t,n,l){let o=new Set(l.filter(r=>r.resourceId).map(r=>`${r.kind}:${r.name}`)),a=[],i=(r,m)=>a.push({described:$({kind:r,name:m}),shown:`the ${v[r]} ${m}`,place:se[r]});!o.has(`worker:${n.workerName}`)&&await b(t,n.workerName)&&i("worker",n.workerName);for(let r of["d1","kv"])for(let m of new Set(Object.values(n.resources[r])))o.has(`${r}:${m}`)||await(r==="d1"?x:j)(t,m)&&i(r,m);for(let r of we(n.manifest)){let m=C(n.workerName,r);o.has(`vectorize:${m}`)||await ee(t,m)&&i("vectorize",m)}return a}function we(t){let n=t?.resources;return(Array.isArray(n?.vectorize)?n.vectorize:[]).flatMap(o=>{let a=o?.name;return typeof a=="string"?[a]:[]})}async function ge({appId:t,flags:n,interactive:l}){if(n.purge&&l&&!n.yes){let o=(await N(`Type ${t} to confirm`,{context:[`This deletes ${t}'s Worker and all its data for good.`]})).trim();if(o!==t)throw new A(o?`"${o}" doesn't match ${t}. Nothing deleted.`:"Cancelled. Nothing deleted.");return}await z({yes:n.yes,interactive:l,question:`Delete ${t} from the Gateway?`,unattended:"Deleting an app needs confirmation at a terminal, or --yes",context:["Its Worker and data stay; --purge deletes them too."],cancelled:"Cancelled. Nothing deleted."})}export{Be as deleteApp,de as deletionSummary,le as removeApp};

package/dist/deploy-G4NB5R2P.js

@@ -0,0 +1 @@
+import{b as a,c as b}from"./chunk-6ILATTGU.js";import"./chunk-4MMHVIHT.js";import"./chunk-HHVABFYD.js";import"./chunk-U4ATZJEU.js";import"./chunk-DB5CMXEV.js";import"./chunk-SMCUCFS4.js";import"./chunk-N4E5YE4X.js";import"./chunk-BHMRY53V.js";import"./chunk-EEF4FY26.js";import"./chunk-E3EPK27P.js";import"./chunk-WTKBB5HE.js";import"./chunk-LTYAIGEB.js";import"./chunk-CGFABBZA.js";import"./chunk-YCADEJVJ.js";import"./chunk-Y6CGMZEB.js";import"./chunk-Q44H7KLY.js";import"./chunk-TQWCYF2T.js";import"./chunk-ZH6IAPVK.js";import"./chunk-ONGI463M.js";import"./chunk-WV4G6E4T.js";import"./chunk-UEQMNXMZ.js";import"./chunk-3GZA6EEZ.js";import"./chunk-52NQ23OH.js";import"./chunk-XEPXX3AI.js";import"./chunk-J2XKGQO7.js";import"./chunk-36VCEEIH.js";import"./chunk-AIDX5IYA.js";import"./chunk-IWP4Q3KV.js";import"./chunk-475IB5UG.js";import"./chunk-RXSJENSN.js";import"./chunk-ZCJTJDAI.js";import"./chunk-OHDR7JWQ.js";import"./chunk-HT76NR3O.js";import"./chunk-LTMQP62I.js";import"./chunk-KTX5YGBL.js";import"./chunk-MLZJBYSY.js";import"./chunk-JT3R24Y7.js";import"./chunk-NXO2BC3M.js";export{a as deploy,b as deployDone};