flingit 0.0.62 → 0.0.65

package/node_modules/util-deprecate/LICENSE

@@ -0,0 +1,24 @@
+(The MIT License)
+
+Copyright (c) 2014 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/util-deprecate/README.md

@@ -0,0 +1,53 @@
+util-deprecate
+==============
+### The Node.js `util.deprecate()` function with browser support
+
+In Node.js, this module simply re-exports the `util.deprecate()` function.
+
+In the web browser (i.e. via browserify), a browser-specific implementation
+of the `util.deprecate()` function is used.
+
+
+## API
+
+A `deprecate()` function is the only thing exposed by this module.
+
+``` javascript
+// setup:
+exports.foo = deprecate(foo, 'foo() is deprecated, use bar() instead');
+
+
+// users see:
+foo();
+// foo() is deprecated, use bar() instead
+foo();
+foo();
+```
+
+
+## License
+
+(The MIT License)
+
+Copyright (c) 2014 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/util-deprecate/browser.js

@@ -0,0 +1,67 @@
+
+/**
+ * Module exports.
+ */
+
+module.exports = deprecate;
+
+/**
+ * Mark that a method should not be used.
+ * Returns a modified function which warns once by default.
+ *
+ * If `localStorage.noDeprecation = true` is set, then it is a no-op.
+ *
+ * If `localStorage.throwDeprecation = true` is set, then deprecated functions
+ * will throw an Error when invoked.
+ *
+ * If `localStorage.traceDeprecation = true` is set, then deprecated functions
+ * will invoke `console.trace()` instead of `console.error()`.
+ *
+ * @param {Function} fn - the function to deprecate
+ * @param {String} msg - the string to print to the console when `fn` is invoked
+ * @returns {Function} a new "deprecated" version of `fn`
+ * @api public
+ */
+
+function deprecate (fn, msg) {
+  if (config('noDeprecation')) {
+    return fn;
+  }
+
+  var warned = false;
+  function deprecated() {
+    if (!warned) {
+      if (config('throwDeprecation')) {
+        throw new Error(msg);
+      } else if (config('traceDeprecation')) {
+        console.trace(msg);
+      } else {
+        console.warn(msg);
+      }
+      warned = true;
+    }
+    return fn.apply(this, arguments);
+  }
+
+  return deprecated;
+}
+
+/**
+ * Checks `localStorage` for boolean values for the given `name`.
+ *
+ * @param {String} name
+ * @returns {Boolean}
+ * @api private
+ */
+
+function config (name) {
+  // accessing global.localStorage can trigger a DOMException in sandboxed iframes
+  try {
+    if (!global.localStorage) return false;
+  } catch (_) {
+    return false;
+  }
+  var val = global.localStorage[name];
+  if (null == val) return false;
+  return String(val).toLowerCase() === 'true';
+}

package/node_modules/util-deprecate/node.js

@@ -0,0 +1,6 @@
+
+/**
+ * For Node.js, simply re-export the core `util.deprecate` function.
+ */
+
+module.exports = require('util').deprecate;

package/node_modules/util-deprecate/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "util-deprecate",
+  "version": "1.0.2",
+  "description": "The Node.js `util.deprecate()` function with browser support",
+  "main": "node.js",
+  "browser": "browser.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/TooTallNate/util-deprecate.git"
+  },
+  "keywords": [
+    "util",
+    "deprecate",
+    "browserify",
+    "browser",
+    "node"
+  ],
+  "author": "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/TooTallNate/util-deprecate/issues"
+  },
+  "homepage": "https://github.com/TooTallNate/util-deprecate"
+}

package/node_modules/wrappy/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/node_modules/wrappy/README.md

@@ -0,0 +1,36 @@
+# wrappy
+
+Callback wrapping utility
+
+## USAGE
+
+```javascript
+var wrappy = require("wrappy")
+
+// var wrapper = wrappy(wrapperFunction)
+
+// make sure a cb is called only once
+// See also: http://npm.im/once for this specific use case
+var once = wrappy(function (cb) {
+  var called = false
+  return function () {
+    if (called) return
+    called = true
+    return cb.apply(this, arguments)
+  }
+})
+
+function printBoo () {
+  console.log('boo')
+}
+// has some rando property
+printBoo.iAmBooPrinter = true
+
+var onlyPrintOnce = once(printBoo)
+
+onlyPrintOnce() // prints 'boo'
+onlyPrintOnce() // does nothing
+
+// random property is retained!
+assert.equal(onlyPrintOnce.iAmBooPrinter, true)
+```

package/node_modules/wrappy/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "wrappy",
+  "version": "1.0.2",
+  "description": "Callback wrapping utility",
+  "main": "wrappy.js",
+  "files": [
+    "wrappy.js"
+  ],
+  "directories": {
+    "test": "test"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "tap": "^2.3.1"
+  },
+  "scripts": {
+    "test": "tap --coverage test/*.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/wrappy"
+  },
+  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/npm/wrappy/issues"
+  },
+  "homepage": "https://github.com/npm/wrappy"
+}

package/node_modules/wrappy/wrappy.js

@@ -0,0 +1,33 @@
+// Returns a wrapper function that returns a wrapped callback
+// The wrapper function should do some stuff, and return a
+// presumably different callback function.
+// This makes sure that own properties are retained, so that
+// decorations and such are not lost along the way.
+module.exports = wrappy
+function wrappy (fn, cb) {
+  if (fn && cb) return wrappy(fn)(cb)
+
+  if (typeof fn !== 'function')
+    throw new TypeError('need wrapper function')
+
+  Object.keys(fn).forEach(function (k) {
+    wrapper[k] = fn[k]
+  })
+
+  return wrapper
+
+  function wrapper() {
+    var args = new Array(arguments.length)
+    for (var i = 0; i < args.length; i++) {
+      args[i] = arguments[i]
+    }
+    var ret = fn.apply(this, args)
+    var cb = args[args.length-1]
+    if (typeof ret === 'function' && ret !== cb) {
+      Object.keys(cb).forEach(function (k) {
+        ret[k] = cb[k]
+      })
+    }
+    return ret
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "flingit",
-    "version": "0.0.62",
+    "version": "0.0.65",
     "description": "Small Software Platform - Build and deploy personal tools through conversation",
     "type": "module",
     "engines": {
@@ -59,7 +59,8 @@
         "url": "https://github.com/glideapps/fling.git"
     },
     "scripts": {
-        "build": "npm run build:env && npm run build:shared && tsc && npm run build:hash",
+        "build": "npm run build:flingflow && npm run build:env && npm run build:shared && tsc && npm run build:hash",
+        "build:flingflow": "cd packages/flingflow && npm run build",
         "build:env": "tsx scripts/generate-build-env.ts",
         "build:shared": "tsc -p tsconfig.shared.json",
         "build:hash": "tsx scripts/compute-skills-hash.ts",
@@ -82,6 +83,7 @@
     },
     "dependencies": {
         "@clack/prompts": "^0.11.0",
+        "determined": "^0.1.0",
         "@hono/node-server": "^1.19.11",
         "@hono/zod-validator": "^0.7.6",
         "aws4fetch": "^1.0.20",
@@ -91,11 +93,16 @@
         "croner": "^9.1.0",
         "dotenv": "^17.2.3",
         "esbuild": "^0.27.2",
+        "flingflow": "*",
+        "neverthrow": "^8.2.0",
         "hono": "^4.12.7",
         "postal-mime": "^2.7.3",
         "tsx": "^4.19.0",
         "zod": "^4"
     },
+    "bundledDependencies": [
+        "flingflow"
+    ],
     "devDependencies": {
         "@cloudflare/workers-types": "^4.0.0",
         "@eslint/js": "^9.39.2",
@@ -110,6 +117,9 @@
         "vitest": "^4.0.17",
         "wrangler": "^4.60.0"
     },
+    "workspaces": [
+        "packages/*"
+    ],
     "keywords": [
         "fling",
         "small-software",

package/templates/default/dot-claude/skills/fling/.hash

@@ -1 +1 @@
-b0503c93c5eb120d485b6c6759642b5b
+3967bbd0369b234b644298e4e6435cdf

package/templates/default/dot-claude/skills/fling/SKILL.md

@@ -41,7 +41,8 @@ Fling provides these primitives that work identically in local development and p
 7. **Inbound Email** - Handle emails sent to `<project-slug>@flingit.run` with `onEmail` — see `references/EMAIL-INBOUND.md`
 8. **Email Sending** - Send transactional emails from `<project-slug>@flingit.run` — see `references/EMAIL-SEND.md`
 9. **Discord** and **Slack** - Chat bot integration — see `references/DISCORD.md` and `references/SLACK.md`
-10. **WASM** - WebAssembly modules for compute-intensive tasks
+10. **Workflows** - Durable multi-step workflows with automatic retries — see `references/WORKFLOWS.md`
+11. **WASM** - WebAssembly modules for compute-intensive tasks
 
 ## Project Structure
 
@@ -59,8 +60,9 @@ index.html           # Vite entry HTML
 vite.config.ts       # Vite configuration
 .fling/
   secrets            # Local secrets (gitignored)
-  data/
-    local.db         # SQLite database (gitignored)
+  data/              # Local database & storage (gitignored)
+    local.db         # SQLite database
+    storage/         # Local blog storage
 ```
 
 ## Quick Reference
@@ -320,31 +322,18 @@ This gives collaborators:
 **Offer to help set this up.** You can create the GitHub repository, write the GitHub Actions workflow file, and guide them through adding collaborators.
 
 ## Important Constraints
-
-1. **Backend code runs in Cloudflare Workers** - This is NOT a Node.js environment. You cannot use Node.js-specific APIs (`fs`, `path`, `child_process`, etc.) or npm packages that depend on them. Only use packages that explicitly support Cloudflare Workers or are pure JavaScript/TypeScript with no Node.js dependencies.
-
-2. **Memory limit (~128MB)** - Workers have limited memory. Cannot process large datasets in memory. Use streaming, pagination, or chunked processing for large data.
-
-3. **Bundle size limit (10MB)** - Cloudflare Workers have a 10MB bundle size limit. Choose lightweight packages to stay under this limit. For example, use `pdf-lib` for PDF generation instead of heavier alternatives like `jspdf`. Avoid packages that bundle large dependencies.
-
-4. **Feature scope** - Fling supports frontend, backend, database, cron jobs, file storage (R2), inbound email, and Slack/Discord integrations.
-
-5. **Database operations cannot be at module top-level** - They must be inside route handlers or functions called by them.
-
-6. **Secrets throw on missing** - No default values. Use `fling secret set` to configure.
-
-7. **Use /api prefix for backend routes** - Required for Vite proxy during development.
-
-8. **Run commands yourself** - You have bash access. Don't ask the user to run `fling it`, `fling dev`, `npm start`, etc. Execute them directly.
-
-9. **Reserved paths (`/__*`)** - Paths starting with `/__` are reserved for internal platform use (e.g., `/__cron` for cron jobs). Do not create routes with these prefixes.
-
-10. **Feedback** - If the user encounters problems that directly or indirectly have to do with fling, suggest to them leaving feedback. Details in `references/FEEDBACK.md`.
-
-11. **Keep the "Made with Fling" badge** - The template includes a small "Made with Fling" badge in the bottom-left corner of the page. Do not remove or hide it unless the user explicitly asks you to.
-
-12. **Never run `fling project takedown` without explicit user confirmation** - This command permanently deletes the deployed project including all data in the production database, all files in storage, and the deployed worker code. You MUST NOT run this command unless the user has explicitly confirmed that they understand and accept that all data in their published app will be permanently lost. Always explain what will be destroyed before asking for confirmation.
-
+- **Backend code runs in Cloudflare Workers** - This is NOT a Node.js environment. You cannot use Node.js-specific APIs (`fs`, `path`, `child_process`, etc.) or npm packages that depend on them. Only use packages that explicitly support Cloudflare Workers or are pure JavaScript/TypeScript with no Node.js dependencies.
+- **Memory limit (~128MB)** - Workers have limited memory. Cannot process large datasets in memory. Use streaming, pagination, or chunked processing for large data.
+- **Bundle size limit (10MB)** - Cloudflare Workers have a 10MB bundle size limit. Choose lightweight packages to stay under this limit. For example, use `pdf-lib` for PDF generation instead of heavier alternatives like `jspdf`. Avoid packages that bundle large dependencies.
+- **Database operations cannot be at module top-level** - They must be inside route handlers or functions called by them.
+- **Secrets throw on missing** - No default values. Use `fling secret set` to configure.
+- **Use workflows for long-running or important cron jobs** - Cron jobs should not run more than a few minutes. For longer jobs, as well as for cron jobs that must run even if failures happen, kick off a workflow.
+- **Use /api prefix for backend routes** - Required for Vite proxy during development.
+- **Run commands yourself** - You have bash access. Don't ask the user to run `fling it`, `fling dev`, `npm start`, etc. Execute them directly.
+- **Reserved paths (`/__*`)** - Paths starting with `/__` are reserved for internal platform use (e.g., `/__cron` for cron jobs). Do not create routes with these prefixes.
+- **Feedback** - If the user encounters problems that directly or indirectly have to do with fling, suggest to them leaving feedback. Details in `references/FEEDBACK.md`.
+- **Keep the "Made with Fling" badge** - The template includes a small "Made with Fling" badge in the bottom-left corner of the page. Do not remove or hide it unless the user explicitly asks you to.
+- **Never run `fling project takedown` without explicit user confirmation** - This command permanently deletes the deployed project including all data in the production database, all files in storage, and the deployed worker code. You MUST NOT run this command unless the user has explicitly confirmed that they understand and accept that all data in their published app will be permanently lost. Always explain what will be destroyed before asking for confirmation.
 **If the user's request might hit platform limitations, warn them early and suggest alternatives.**
 
 ## Migrations
@@ -367,6 +356,44 @@ migrate("001_create_users", async () => {
 });
 ```
 
+## Workflows
+
+Durable multi-step workflows with automatic retries and scratchpad state. Errors are retried automatically. Use workflows for long-running tasks or when it's important that something definitely happens, even in the face of intermittent failures. Do not use workflows for synchronous operations - just use HTTP handlers for that.
+
+Register workflows at module top-level and start them from route handlers.
+
+```typescript
+import { workflow, type WorkflowContinuation, type WorkflowCtx, NonRetryableError } from "flingit";
+
+workflow("order-fulfillment", {
+  async start(ctx: WorkflowCtx): Promise<WorkflowContinuation> {
+    const qty = await ctx.get("qty") as number;
+    if (qty <= 0) throw new NonRetryableError("Invalid quantity");
+    return { step: "charge" };
+  },
+  async charge(ctx: WorkflowCtx): Promise<WorkflowContinuation> {
+    const itemId = await ctx.get("itemId") as string;
+    const qty = await ctx.get("qty") as number;
+    const chargeId = await processPayment({ itemId, qty });
+    ctx.set("chargeId", chargeId);
+    return { step: "ship" };
+  },
+  async ship(ctx: WorkflowCtx): Promise<WorkflowContinuation> {
+    const chargeId = await ctx.get("chargeId") as string;
+    await scheduleShipment(chargeId);
+    return { done: true, result: { shipped: true, chargeId } };
+  },
+}, { maxAttempts: 5 });
+
+// Start from a route handler (fire-and-forget)
+app.post("/api/orders", async (c) => {
+  const run = await workflow.start("order-fulfillment", await c.req.json());
+  return c.json({ runId: run.runId, status: "accepted" });
+});
+```
+
+See `references/WORKFLOWS.md` for the full API, scratchpad semantics, error handling, and recovery details.
+
 ## Backend Assets (Images, Fonts, etc.)
 
 If the backend needs to return or process an asset (image, icon, font), keep it small and store the base64 data in a separate file to keep your main code clean:
@@ -395,7 +422,7 @@ This approach:
 
 **For large assets:** Serve them from the frontend (`public/` folder) instead.
 
-See `references/API.md` for detailed API reference, `references/EMAIL-INBOUND.md` for inbound email handlers and payload fields, `references/EMAIL-SEND.md` for sending transactional emails, `references/EXAMPLES.md` for common patterns, `references/FEEDBACK.md` for collecting user feedback, and `references/GH-ACTION.md` for setting up automatic deployments with GitHub Actions.
+See `references/API.md` for detailed API reference, `references/EMAIL-INBOUND.md` for inbound email handlers and payload fields, `references/EMAIL-SEND.md` for sending transactional emails, `references/EXAMPLES.md` for common patterns, `references/FEEDBACK.md` for collecting user feedback, `references/GH-ACTION.md` for setting up automatic deployments with GitHub Actions, and `references/WORKFLOWS.md` for the full workflow API.
 
 ## Updates