@adrianhall/cloudflare-toolkit 0.0.1

package/dist/silent-CWpHE65X.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"silent-CWpHE65X.js","names":["LEVEL_METHOD"],"sources":["../src/lib/logging/levels.ts","../src/lib/logging/internal/optional-field.ts","../src/lib/logging/serialize.ts","../src/lib/logging/logger.ts","../src/lib/logging/internal/console.ts","../src/lib/logging/transports/browser.ts","../src/lib/logging/transports/capture.ts","../src/lib/logging/internal/safe-json.ts","../src/lib/logging/internal/sanitize.ts","../src/lib/logging/transports/console.ts","../src/lib/logging/transports/structured.ts","../src/lib/logging/resolve.ts","../src/lib/logging/transports/silent.ts"],"sourcesContent":["/**\n * @file Numeric level weights for the logging subpath.\n *\n * `LOG_LEVELS` and `levelValue()` are internal implementation details, not exported from\n * `src/lib/logging/index.ts`. Numeric values are stable for the emitted `LogRecord.levelValue`\n * field.\n */\nimport type { LogLevel } from \"./types.js\";\n\n/**\n * Stable numeric weights for each log level.\n *\n * A record is emitted when: `LOG_LEVELS[record.level] >= LOG_LEVELS[logger.level]`\n */\nexport const LOG_LEVELS: Readonly<Record<LogLevel, number>> = {\n  trace: 10,\n  debug: 20,\n  info: 30,\n  warn: 40,\n  error: 50,\n  fatal: 60\n};\n\n/**\n * Return the numeric weight for `level`.\n *\n * Throws a `TypeError` for any value that is not a recognized `LogLevel`. TypeScript consumers\n * should rely on the `LogLevel` union type and never reach this error path under normal usage.\n * Deliberately not implemented with `throwIfNull`: this throws a `TypeError` for an unrecognized\n * string, not a `null`/`undefined` guard, so using that helper would change the thrown error\n * type.\n *\n * @param level - The level to look up.\n * @returns The numeric weight for `level`.\n * @throws {TypeError} If `level` is not one of the six recognized `LogLevel` values.\n */\nexport function levelValue(level: LogLevel): number {\n  const value = LOG_LEVELS[level];\n  if (value === undefined) {\n    throw new TypeError(\n      `Unknown log level: ${String(level)}. Expected one of: ${Object.keys(LOG_LEVELS).join(\", \")}`\n    );\n  }\n  return value;\n}\n","/**\n * @file An internal helper for the logging subpath — not one of the toolkit's public defensive\n * guards (`src/lib/guards`) and not exported from `src/lib/logging/index.ts`.\n */\n\n/**\n * Returns `{ [prop]: o[prop] }` when `prop` is an own property of `o` with a non-`undefined`\n * value, otherwise returns `{}`.\n *\n * Intended for safely spreading optional fields onto plain objects without introducing\n * `undefined`-valued keys:\n *\n * ```ts\n * const result = {\n *   name: err.name,\n *   ...optionalField(err, \"stack\"),\n * };\n * ```\n *\n * @param o - The object to read `prop` from.\n * @param prop - The property to conditionally include.\n * @returns `{ [prop]: o[prop] }` when defined, otherwise `{}`.\n */\nexport function optionalField<T extends object>(\n  o: T,\n  prop: keyof T\n): Partial<Pick<T, typeof prop>> {\n  return o[prop] !== undefined ? ({ [prop]: o[prop] } as Partial<Pick<T, typeof prop>>) : {};\n}\n","/**\n * @file Error serialization for the logging subpath.\n *\n * `serializeError()` converts `Error` instances to plain objects so transports can safely\n * forward structured context without raw `Error` values escaping into JSON serialization or\n * console methods. Only top-level context values are serialized by the logger (`logger.ts`);\n * nested errors are left as-is unless they appear as a direct `cause` of a top-level error.\n */\nimport { optionalField } from \"./internal/optional-field.js\";\n\n/**\n * Serialize `value` if it is an `Error`; return it unchanged otherwise.\n *\n * - Non-`Error` values are returned as-is.\n * - `Error` instances become plain objects with `name`, `message`, and optionally `stack` and\n *   `cause`.\n * - `cause` is shallowly serialized when it is itself an `Error`.\n *\n * @param value - The value to serialize, if it is an `Error`.\n * @returns A plain-object serialization of `value` when it is an `Error`, otherwise `value`\n *   unchanged.\n */\nexport function serializeError(value: unknown): unknown {\n  if (!(value instanceof Error)) {\n    return value;\n  }\n\n  const serialized: Record<string, unknown> = {\n    name: value.name,\n    message: value.message,\n    ...optionalField(value, \"stack\")\n  };\n\n  if (value.cause !== undefined) {\n    serialized.cause =\n      value.cause instanceof Error ?\n        {\n          name: value.cause.name,\n          message: value.cause.message,\n          ...optionalField(value.cause, \"stack\")\n        }\n      : value.cause;\n  }\n\n  return serialized;\n}\n","/**\n * @file The core logger implementation. This is the framework-agnostic core that the\n * `cloudflareLogger` Hono middleware wraps — it must never import `hono`.\n *\n * `createLogger()` constructs a `Logger` that:\n *   - Filters records below the configured level before touching context.\n *   - Merges bindings and per-call context into a new object (never mutates input).\n *   - Serializes top-level `Error` values in context before delivering to transport.\n *   - Wraps transport delivery in try/catch so transport failures never escape.\n *   - Supports child loggers that inherit transport, level, clock, and error handler.\n */\nimport { levelValue } from \"./levels.js\";\nimport { serializeError } from \"./serialize.js\";\nimport type {\n  CreateLoggerOptions,\n  LogContext,\n  LogLevel,\n  LogRecord,\n  Logger,\n  TransportErrorHandler,\n  Transport\n} from \"./types.js\";\n\n/**\n * Internal factory used by both `createLogger` and child loggers.\n *\n * All logger state is captured in the closure; no class is used. Both root loggers and child\n * loggers are created through this function, which keeps the child creation path identical to\n * the root path.\n *\n * @param level - Minimum level to emit.\n * @param transport - Destination for emitted records.\n * @param bindings - Key-value pairs merged into every record's context.\n * @param clock - Produces the timestamp for each record.\n * @param onTransportError - Optional callback for transport failures.\n * @returns A `Logger` bound to the supplied state.\n */\nfunction makeLogger(\n  level: LogLevel,\n  transport: Transport,\n  bindings: LogContext,\n  clock: () => Date,\n  onTransportError: TransportErrorHandler | undefined\n): Logger {\n  const currentLevelValue = levelValue(level);\n\n  /**\n   * Returns `true` when records at `candidate` severity will be emitted. Used both for the\n   * public `isLevelEnabled` method and internally before constructing a record.\n   *\n   * @param candidate - The level to test against the configured minimum level.\n   * @returns `true` when `candidate` is at or above the configured minimum level.\n   */\n  function isLevelEnabled(candidate: LogLevel): boolean {\n    return levelValue(candidate) >= currentLevelValue;\n  }\n\n  /**\n   * Core emit path shared by all six level methods.\n   *\n   * Exits immediately when `logLevel` is below the configured minimum so that disabled calls\n   * never access the `context` argument. When enabled, merges bindings with per-call context,\n   * serializes top-level `Error` values, builds the `LogRecord`, and delivers it to the\n   * transport inside a try/catch.\n   *\n   * @param logLevel - Severity of this record.\n   * @param message - Human-readable description of the event.\n   * @param context - Optional per-call structured context.\n   */\n  function emit(logLevel: LogLevel, message: string, context?: LogContext): void {\n    if (!isLevelEnabled(logLevel)) {\n      return;\n    }\n\n    // Merge bindings + call context into a new object. Per-call context wins.\n    const merged: LogContext =\n      context !== undefined ? { ...bindings, ...context } : { ...bindings };\n\n    // Serialize top-level Error values before delivering to transport.\n    const serializedContext: LogContext = {};\n    for (const key of Object.keys(merged)) {\n      serializedContext[key] = serializeError(merged[key]);\n    }\n\n    const record: LogRecord = {\n      time: clock().toISOString(),\n      level: logLevel,\n      levelValue: levelValue(logLevel),\n      message,\n      context: serializedContext\n    };\n\n    try {\n      transport.log(record);\n    } catch (error) {\n      try {\n        onTransportError?.(error, record);\n      } catch {\n        // Logging must not throw into application code.\n      }\n    }\n  }\n\n  return {\n    get level(): LogLevel {\n      return level;\n    },\n\n    isLevelEnabled,\n\n    trace(message: string, context?: LogContext): void {\n      emit(\"trace\", message, context);\n    },\n\n    debug(message: string, context?: LogContext): void {\n      emit(\"debug\", message, context);\n    },\n\n    info(message: string, context?: LogContext): void {\n      emit(\"info\", message, context);\n    },\n\n    warn(message: string, context?: LogContext): void {\n      emit(\"warn\", message, context);\n    },\n\n    error(message: string, context?: LogContext): void {\n      emit(\"error\", message, context);\n    },\n\n    fatal(message: string, context?: LogContext): void {\n      emit(\"fatal\", message, context);\n    },\n\n    child(childBindings: LogContext): Logger {\n      // Child inherits parent's transport, level, clock, and error handler.\n      // Child bindings are merged: parent bindings + child bindings.\n      return makeLogger(\n        level,\n        transport,\n        { ...bindings, ...childBindings },\n        clock,\n        onTransportError\n      );\n    }\n  };\n}\n\n/**\n * Create a new `Logger` with the provided options.\n *\n * - `options.transport` is required.\n * - `options.level` defaults to `\"info\"`.\n * - `options.clock` defaults to `() => new Date()`.\n * - `options.bindings` are merged into every emitted record.\n * - `options.onTransportError` receives transport errors without crashing the app.\n *\n * @param options - Logger construction options.\n * @returns A new `Logger`.\n */\nexport function createLogger(options: CreateLoggerOptions): Logger {\n  const {\n    transport,\n    level = \"info\",\n    bindings = {},\n    clock = () => new Date(),\n    onTransportError\n  } = options;\n\n  return makeLogger(level, transport, bindings, clock, onTransportError);\n}\n","/**\n * @file Internal console-method fallback helpers for the logging subpath. Not exported from\n * `src/lib/logging/index.ts`.\n *\n * Transports use specific `console` methods (`debug`, `info`, `warn`, `error`, `log`) to route\n * records to the appropriate DevTools channel or log level in the host environment. Some\n * environments (notably older Workers runtimes and custom test harnesses) may not expose every\n * console method.\n *\n * `getConsoleMethod()` returns the requested console method when available and falls back to\n * `console.log` otherwise, preventing a missing-method crash from surfacing into application\n * code.\n */\n\n/** The subset of `console` method names used by built-in transports. */\nexport type ConsoleMethodName = \"debug\" | \"info\" | \"log\" | \"warn\" | \"error\";\n\n/**\n * Minimal console interface used internally by transports.\n *\n * Typed as `(...args: unknown[]) => void` so that both the real `console` object and\n * test-injected spies satisfy the shape without needing to reference DOM or Workers globals.\n */\nexport type ConsoleMethod = (...args: unknown[]) => void;\n\n/**\n * A minimal console-like object that transports write to.\n *\n * Transports accept an optional `console` parameter (defaulting to the global `console`) so\n * that tests can inject a spy without patching the global.\n */\nexport type ConsoleLike = Partial<Record<ConsoleMethodName, ConsoleMethod>> & {\n  log: ConsoleMethod;\n};\n\n/**\n * Return the named console method from `c`, falling back to `c.log` if the method is absent or\n * not a function.\n *\n * Rationale: logging must not crash because a host environment is missing a specific console\n * method. `console.log` is the safest baseline and is present in every JS environment that\n * supports `console` at all.\n *\n * @param c - The console-like object to query.\n * @param method - The preferred method name.\n * @returns The requested method if callable, otherwise `c.log`.\n */\nexport function getConsoleMethod(c: ConsoleLike, method: ConsoleMethodName): ConsoleMethod {\n  const candidate = c[method];\n  if (typeof candidate === \"function\") {\n    return candidate.bind(c);\n  }\n  return c.log.bind(c);\n}\n","/**\n * @file A transport that formats records for browser DevTools using `%c` styled level badges.\n *\n * `createBrowserTransport()` maps severity levels to appropriate console methods and passes the\n * context object as a separate argument when non-empty, so DevTools can expand it interactively.\n *\n * Level-to-method mapping:\n *   trace, debug → console.debug\n *   info          → console.info\n *   warn          → console.warn\n *   error, fatal  → console.error\n */\nimport { getConsoleMethod } from \"../internal/console.js\";\nimport type { ConsoleLike, ConsoleMethodName } from \"../internal/console.js\";\nimport type { BrowserTransportOptions, LogLevel, LogRecord, Transport } from \"../types.js\";\n\n/** Default CSS badge styles keyed by level. */\nconst DEFAULT_STYLES: Readonly<Record<LogLevel, string>> = {\n  trace: \"color: #9ca3af; font-weight: bold\",\n  debug: \"color: #6b7280; font-weight: bold\",\n  info: \"color: #3b82f6; font-weight: bold\",\n  warn: \"color: #f59e0b; font-weight: bold\",\n  error: \"color: #ef4444; font-weight: bold\",\n  fatal: \"color: #dc2626; font-weight: bold; text-decoration: underline\"\n};\n\n/** Map each log level to the preferred console method name. */\nconst LEVEL_METHOD: Readonly<Record<LogLevel, ConsoleMethodName>> = {\n  trace: \"debug\",\n  debug: \"debug\",\n  info: \"info\",\n  warn: \"warn\",\n  error: \"error\",\n  fatal: \"error\"\n};\n\n/**\n * Create a browser transport optimized for DevTools output.\n *\n * @param options - Optional level style overrides.\n * @param _console - Injected console-like object (defaults to global `console`). Used in tests.\n * @returns A `Transport` that writes styled records to the browser console.\n */\nexport function createBrowserTransport(\n  options?: BrowserTransportOptions,\n  _console: ConsoleLike = console\n): Transport {\n  const levelStyles: Readonly<Record<LogLevel, string>> = {\n    ...DEFAULT_STYLES,\n    ...options?.levelStyles\n  };\n\n  return {\n    log(record: LogRecord): void {\n      const methodName = LEVEL_METHOD[record.level];\n      const method = getConsoleMethod(_console, methodName);\n      const style = levelStyles[record.level];\n      const badge = record.level.toUpperCase();\n\n      const hasContext = Object.keys(record.context).length > 0;\n\n      if (hasContext) {\n        method(`%c${badge}`, style, record.message, record.context);\n      } else {\n        method(`%c${badge}`, style, record.message);\n      }\n    }\n  };\n}\n","/**\n * @file A transport that accumulates log records in memory without writing to the console.\n *\n * `createCaptureTransport()` is intended for use in Vitest tests where assertions need to\n * inspect emitted records deterministically. Use `.find(level)` as the preferred assertion\n * helper for level-specific record checks rather than filtering `.records` manually.\n */\nimport type { CaptureTransport, LogLevel, LogRecord } from \"../types.js\";\n\n/**\n * Create a capture transport that stores records in memory.\n *\n * @returns A `CaptureTransport` with `.records`, `.clear()`, and `.find()`.\n */\nexport function createCaptureTransport(): CaptureTransport {\n  let internal: LogRecord[] = [];\n\n  return {\n    log(record: LogRecord): void {\n      internal.push(record);\n    },\n\n    get records(): readonly LogRecord[] {\n      // Return a shallow copy so callers cannot mutate internal storage.\n      return internal.slice();\n    },\n\n    clear(): void {\n      internal = [];\n    },\n\n    find(level: LogLevel): readonly LogRecord[] {\n      return internal.filter((r) => r.level === level);\n    }\n  };\n}\n","/**\n * @file Internal safe JSON/string formatting for the logging subpath. Not exported from\n * `src/lib/logging/index.ts`; used by `createConsoleTransport` and `createStructuredTransport`.\n *\n * `safeStringify()` serializes arbitrary values to a compact JSON string while handling the\n * common non-JSON types that appear in structured log context:\n *   - Circular references  → `\"[Circular]\"` (a shared/diamond reference reachable via two\n *     non-nested paths — e.g. `{ a: shared, b: shared }` — is NOT a circular reference and is\n *     serialized in full at both locations; only true ancestor cycles are replaced)\n *   - `bigint`             → `\"<n>n\"` (e.g. `42n` → `\"42n\"`)\n *   - `symbol`             → `\"Symbol(description)\"`\n *   - `function`           → `\"[Function name]\"` or `\"[Function (anonymous)]\"`\n *   - `undefined`          → omitted from objects, `\"undefined\"` at top level\n */\n\n/**\n * A stable placeholder emitted when `JSON.stringify` itself throws unexpectedly (e.g. a getter\n * that throws mid-serialization after the circular-reference check has passed).\n */\nconst FALLBACK = \"[FormattingError]\";\n\n/**\n * Convert a single value to a JSON-safe replacement.\n *\n * Called from the `JSON.stringify` replacer for every value encountered during serialization.\n * Non-JSON-safe primitives (`bigint`, `symbol`, `function`) are converted to descriptive\n * strings. All other values are returned unchanged so that `JSON.stringify` handles them\n * normally.\n *\n * Exported for direct unit testing so the default return path is reachable without going\n * through the full replacer loop.\n *\n * @param value - The raw value at the current key.\n * @returns A JSON-safe replacement value.\n */\nexport function replaceNonJsonValue(value: unknown): unknown {\n  if (typeof value === \"bigint\") {\n    return `${value.toString()}n`;\n  }\n  if (typeof value === \"symbol\") {\n    // Symbol.prototype.toString() returns \"Symbol(description)\"\n    return value.toString();\n  }\n  if (typeof value === \"function\") {\n    const name = value.name;\n    return name ? `[Function ${name}]` : \"[Function (anonymous)]\";\n  }\n  return value;\n}\n\n/**\n * Serialize `value` to a compact JSON string.\n *\n * Handles:\n * - Circular references (replaced with `\"[Circular]\"`); shared/diamond references (the same\n *   object reachable via two different, non-nested paths) are NOT treated as circular and are\n *   serialized in full at every location\n * - `bigint` (serialized as `\"<n>n\"`)\n * - `symbol` (serialized as `\"Symbol(description)\"`)\n * - `function` (serialized as `\"[Function name]\"`)\n * - `undefined` at the top level (returns `\"undefined\"`)\n * - Unexpected formatter errors (returns `\"[FormattingError]\"`)\n *\n * @param value - The value to serialize.\n * @returns A JSON string representation.\n */\nexport function safeStringify(value: unknown): string {\n  if (value === undefined) {\n    return \"undefined\";\n  }\n\n  // Track only the current ancestor path — not every object seen across the whole graph — so\n  // that a shared/diamond reference isn't mistaken for a true circular reference. `JSON.stringify`\n  // invokes the replacer depth-first with `this` bound to the holder (the object/array whose\n  // property is currently being visited). Comparing `this` against the top of `stack` lets us\n  // detect ascent: once we've finished a subtree and moved to the next sibling (or back up to a\n  // grandparent), the holder no longer matches the stack's current top, and we trim the stack\n  // back down to that holder's depth — discarding the finished subtree's entries — before\n  // continuing. This mirrors the well-known \"delete on the way back up\" technique used by\n  // reference circular-JSON implementations, applied here via `JSON.stringify`'s own recursion.\n  const stack: unknown[] = [];\n\n  try {\n    return JSON.stringify(\n      value,\n      function replacer(this: unknown, _key: string, val: unknown): unknown {\n        // Handle non-JSON primitives before the circular-ref check so that symbols and functions\n        // (which are objects in some host environments) are caught early.\n        if (typeof val === \"bigint\" || typeof val === \"symbol\" || typeof val === \"function\") {\n          return replaceNonJsonValue(val);\n        }\n\n        // Circular reference detection applies to objects and arrays only.\n        if (val !== null && typeof val === \"object\") {\n          const holderIndex = stack.indexOf(this);\n          if (holderIndex === -1) {\n            // First descent into this holder's subtree.\n            stack.push(this);\n          } else {\n            // Ascended back to (or sideways from) this holder: drop everything below it that was\n            // pushed while processing a previously-visited sibling subtree.\n            stack.length = holderIndex + 1;\n          }\n\n          if (stack.includes(val)) {\n            return \"[Circular]\";\n          }\n          stack.push(val);\n        }\n\n        return val;\n      }\n    );\n  } catch {\n    // Last-resort fallback: JSON.stringify threw despite the replacer.\n    // This can happen when a getter throws during property enumeration.\n    return FALLBACK;\n  }\n}\n","/**\n * @file An internal helper for the logging subpath — not exported from\n * `src/lib/logging/index.ts`.\n *\n * `sanitizeTerminalText()` neutralizes terminal-injection risk (SEC-007) in strings that are\n * about to be written to a real terminal by `createConsoleTransport()`. `record.message` is\n * caller-supplied and may embed attacker-controlled data (e.g. an email address or path). Left\n * unescaped, it could contain newlines that forge fake log lines, or ANSI escape sequences\n * (`\\x1b...`) that manipulate the terminal (colors, cursor movement, title changes) when the\n * output is later viewed through a real terminal such as `wrangler tail`.\n *\n * `record.context` does not need the same treatment: `createConsoleTransport()` always renders\n * it via `safeStringify()` (`JSON.stringify` under the hood), which already escapes every C0\n * control character — including `\\x1b` — as `\\uXXXX` per the JSON spec.\n */\n\n/**\n * Control characters (C0: `\\x00`-`\\x1f`, plus DEL `\\x7f`) that could forge terminal output or\n * trigger ANSI escape sequences. Every terminal escape sequence begins with `\\x1b` (ESC), so\n * escaping it alone is sufficient to neutralize ANSI injection; the rest of the range is\n * escaped defensively for the same reason.\n */\nconst CONTROL_CHAR_PATTERN = /[\\x00-\\x1f\\x7f]/g;\n\n/** Readable escape sequences for the most common control characters. */\nconst NAMED_ESCAPES: Readonly<Record<string, string>> = {\n  \"\\n\": \"\\\\n\",\n  \"\\r\": \"\\\\r\",\n  \"\\t\": \"\\\\t\"\n};\n\n/**\n * Replace every C0 control character and DEL in `value` with a visible, non-executable escape\n * sequence.\n *\n * Common whitespace controls (`\\n`, `\\r`, `\\t`) are rendered as their familiar backslash\n * escapes; every other control character (including ESC, `\\x1b`) is rendered as a two-digit hex\n * escape (`\\xHH`). This preserves the original information for debugging while preventing the\n * string from forging additional log lines or executing terminal escape sequences.\n *\n * @param value - The raw string to sanitize before writing it to a terminal.\n * @returns `value` with every control character replaced by a visible escape sequence.\n */\nexport function sanitizeTerminalText(value: string): string {\n  return value.replace(CONTROL_CHAR_PATTERN, (char) => {\n    const named = NAMED_ESCAPES[char];\n    if (named !== undefined) {\n      return named;\n    }\n    return `\\\\x${char.charCodeAt(0).toString(16).padStart(2, \"0\")}`;\n  });\n}\n","/**\n * @file A transport that formats records as human-readable single-line output intended for\n * terminal environments including `wrangler dev`.\n *\n * `createConsoleTransport()` supports optional ANSI color codes and configurable timestamp\n * formats.\n *\n * `record.message` is sanitized via `sanitizeTerminalText()` (SEC-007) before it is written,\n * escaping control/ANSI characters so caller-supplied data cannot forge additional log lines or\n * inject terminal escape sequences when the output is later viewed in a real terminal (e.g.\n * `wrangler tail`).\n *\n * Level-to-method mapping:\n *   trace, debug, info  → console.log\n *   warn, error, fatal  → console.error\n *\n * Output format:\n *   [timestamp] LEVEL  message [{\"key\":\"value\"}]\n */\nimport { getConsoleMethod } from \"../internal/console.js\";\nimport type { ConsoleLike } from \"../internal/console.js\";\nimport { safeStringify } from \"../internal/safe-json.js\";\nimport { sanitizeTerminalText } from \"../internal/sanitize.js\";\nimport { valueOrDefault } from \"../../guards/index.js\";\nimport type { ConsoleTransportOptions, LogLevel, LogRecord, Transport } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// ANSI color codes\n// ---------------------------------------------------------------------------\n\nconst RESET = \"\\x1b[0m\";\n\n/** Map each level to its ANSI color code. */\nconst LEVEL_COLOR: Readonly<Record<LogLevel, string>> = {\n  trace: \"\\x1b[90m\", // dark gray\n  debug: \"\\x1b[37m\", // white\n  info: \"\\x1b[36m\", // cyan\n  warn: \"\\x1b[33m\", // yellow\n  error: \"\\x1b[31m\", // red\n  fatal: \"\\x1b[35m\" // magenta\n};\n\n// ---------------------------------------------------------------------------\n// Timestamp helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Extract an `HH:MM:SS` time string from an ISO 8601 timestamp. Falls back to the first 8\n * characters if the expected `T` separator is absent.\n *\n * Exported for direct unit testing of the fallback branch.\n *\n * @param isoString - An ISO 8601 timestamp string.\n * @returns The `HH:MM:SS` portion, or the first 8 characters if no `T` separator is found.\n */\nexport function extractTime(isoString: string): string {\n  const tIndex = isoString.indexOf(\"T\");\n  if (tIndex === -1) {\n    return isoString.slice(0, 8);\n  }\n  return isoString.slice(tIndex + 1, tIndex + 9);\n}\n\n// ---------------------------------------------------------------------------\n// Level label helpers\n// ---------------------------------------------------------------------------\n\n/** Fixed-width (5 chars) uppercase level labels. */\nconst LEVEL_LABEL: Readonly<Record<LogLevel, string>> = {\n  trace: \"TRACE\",\n  debug: \"DEBUG\",\n  info: \"INFO \",\n  warn: \"WARN \",\n  error: \"ERROR\",\n  fatal: \"FATAL\"\n};\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Create a console transport for terminal/wrangler dev output.\n *\n * @param options - Timestamp and color options.\n * @param _console - Injected console-like object (defaults to global `console`). Used in tests.\n * @returns A `Transport` that writes formatted lines to the terminal.\n */\nexport function createConsoleTransport(\n  options?: ConsoleTransportOptions,\n  _console: ConsoleLike = console\n): Transport {\n  const colors = valueOrDefault(options?.colors, true);\n  const timestamp = valueOrDefault(options?.timestamp, \"time\");\n\n  return {\n    log(record: LogRecord): void {\n      // Choose sink: warn/error/fatal → stderr, rest → stdout.\n      const isError =\n        record.level === \"warn\" || record.level === \"error\" || record.level === \"fatal\";\n      const method = getConsoleMethod(_console, isError ? \"error\" : \"log\");\n\n      // Build the line parts.\n      const parts: string[] = [];\n\n      // Timestamp prefix.\n      if (timestamp === \"time\") {\n        const ts = extractTime(record.time);\n        parts.push(colors ? `\\x1b[90m${ts}${RESET}` : ts);\n      } else if (timestamp === \"iso\") {\n        parts.push(colors ? `\\x1b[90m${record.time}${RESET}` : record.time);\n      }\n\n      // Level label.\n      const label = LEVEL_LABEL[record.level];\n      if (colors) {\n        const color = LEVEL_COLOR[record.level];\n        parts.push(`${color}${label}${RESET}`);\n      } else {\n        parts.push(label);\n      }\n\n      // Message (sanitized — see SEC-007 note in the file header above).\n      parts.push(sanitizeTerminalText(record.message));\n\n      // Context (compact safe JSON, omitted when empty). `safeStringify` delegates to\n      // `JSON.stringify`, which already escapes every C0 control character (including ESC) per\n      // the JSON spec, so no additional sanitization is needed here.\n      const hasContext = Object.keys(record.context).length > 0;\n      if (hasContext) {\n        parts.push(safeStringify(record.context));\n      }\n\n      method(parts.join(\" \"));\n    }\n  };\n}\n","/**\n * @file A transport that emits records as structured payloads intended for Cloudflare Workers\n * Logs.\n *\n * Workers Logs automatically extracts and indexes fields from JSON object logs, so\n * `createStructuredTransport()` defaults to object logging (`stringify: false`) rather than\n * string logging.\n *\n * Payload shape: `{ time, level, message, ...context }`\n * Reserved keys (`time`, `level`, `message`) from the record take precedence over identically\n * named context keys.\n *\n * Level-to-method mapping:\n *   trace, debug → console.debug\n *   info          → console.log\n *   warn          → console.warn\n *   error, fatal  → console.error\n */\nimport { getConsoleMethod } from \"../internal/console.js\";\nimport type { ConsoleLike, ConsoleMethodName } from \"../internal/console.js\";\nimport { safeStringify } from \"../internal/safe-json.js\";\nimport { valueOrDefault } from \"../../guards/index.js\";\nimport type { LogLevel, LogRecord, StructuredTransportOptions, Transport } from \"../types.js\";\n\n/** Map each log level to the preferred console method name. */\nconst LEVEL_METHOD: Readonly<Record<LogLevel, ConsoleMethodName>> = {\n  trace: \"debug\",\n  debug: \"debug\",\n  info: \"log\",\n  warn: \"warn\",\n  error: \"error\",\n  fatal: \"error\"\n};\n\n/**\n * Create a structured transport for Cloudflare Workers Logs.\n *\n * @param options - Optional stringify flag.\n * @param _console - Injected console-like object (defaults to global `console`). Used in tests.\n * @returns A `Transport` that writes structured payloads to the console.\n */\nexport function createStructuredTransport(\n  options?: StructuredTransportOptions,\n  _console: ConsoleLike = console\n): Transport {\n  const stringify = valueOrDefault(options?.stringify, false);\n\n  return {\n    log(record: LogRecord): void {\n      const methodName = LEVEL_METHOD[record.level];\n      const method = getConsoleMethod(_console, methodName);\n\n      // Build payload: context spread first, then reserved keys override.\n      const payload: Record<string, unknown> = {\n        ...record.context,\n        time: record.time,\n        level: record.level,\n        message: record.message\n      };\n\n      if (stringify) {\n        method(safeStringify(payload));\n      } else {\n        method(payload);\n      }\n    }\n  };\n}\n","/**\n * @file A default-config helper that maps an environment + runtime pair to a ready-to-use\n * `{ level, transport }` pair.\n *\n * `resolveLoggerConfig()` is optional policy — `createLogger` does not require it. Applications\n * that need environment-specific configuration without hand-wiring transports can call this\n * helper and pass the result directly to `createLogger`.\n *\n * Policy table:\n *\n * | Environment   | Runtime   | Level   | Transport  |\n * |---------------|-----------|---------|------------|\n * | test          | browser   | trace   | capture    |\n * | test          | worker    | trace   | capture    |\n * | development   | browser   | info    | browser    |\n * | development   | worker    | debug   | console    |\n * | production    | browser   | warn    | browser    |\n * | production    | worker    | warn    | structured |\n * | unknown       | browser   | warn    | browser    |\n * | unknown       | worker    | warn    | structured |\n *\n * There is no `detectRuntime()` helper in the public API. Applications are expected to know\n * whether they are constructing a browser logger or a Worker logger.\n */\nimport { createBrowserTransport } from \"./transports/browser.js\";\nimport { createCaptureTransport } from \"./transports/capture.js\";\nimport { createConsoleTransport } from \"./transports/console.js\";\nimport { createStructuredTransport } from \"./transports/structured.js\";\nimport type { Environment, ResolvedLoggerConfig, Runtime } from \"./types.js\";\n\n/**\n * Resolve a `{ level, transport }` configuration for the given environment and runtime.\n *\n * Each call creates a **fresh** transport instance. If you call this helper more than once with\n * the same arguments you will receive independent transport instances, which is intentional for\n * test isolation.\n *\n * Unknown or `undefined` environments are treated as `\"production\"`.\n *\n * @param environment - One of `\"test\"`, `\"development\"`, `\"production\"`, or any other string.\n *   `undefined` maps to production behavior.\n * @param runtime - Either `\"browser\"` or `\"worker\"`.\n * @returns A fresh `ResolvedLoggerConfig` ready to pass to `createLogger`.\n */\nexport function resolveLoggerConfig(\n  environment: Environment | undefined,\n  runtime: Runtime\n): ResolvedLoggerConfig {\n  // Normalise: anything that is not a recognised well-known string falls through to the\n  // production defaults.\n  const env = environment === \"test\" || environment === \"development\" ? environment : \"production\";\n\n  if (env === \"test\") {\n    return { level: \"trace\", transport: createCaptureTransport() };\n  }\n\n  if (env === \"development\") {\n    if (runtime === \"browser\") {\n      return { level: \"info\", transport: createBrowserTransport() };\n    }\n    // runtime === \"worker\"\n    return { level: \"debug\", transport: createConsoleTransport() };\n  }\n\n  // production (and all unknown / undefined environments)\n  if (runtime === \"browser\") {\n    return { level: \"warn\", transport: createBrowserTransport() };\n  }\n  // runtime === \"worker\"\n  return { level: \"warn\", transport: createStructuredTransport() };\n}\n","/**\n * @file A no-op transport that discards every record without emitting anything to the console\n * and without throwing. Use it in contexts where logging should be fully suppressed.\n */\nimport type { Transport } from \"../types.js\";\n\n/**\n * Create a silent transport that discards all records.\n *\n * @returns A `Transport` that does nothing.\n */\nexport function createSilentTransport(): Transport {\n  return {\n    log(): void {\n      // Intentionally empty — records are dropped without side effects.\n    }\n  };\n}\n"],"mappings":";;;;;;;AAcA,MAAa,aAAiD;CAC5D,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,WAAW,OAAyB;CAClD,MAAM,QAAQ,WAAW;CACzB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,UACR,sBAAsB,OAAO,KAAK,EAAE,qBAAqB,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,IAAI,GAC5F;CAEF,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;ACrBA,SAAgB,cACd,GACA,MAC+B;CAC/B,OAAO,EAAE,UAAU,KAAA,IAAa,GAAG,OAAO,EAAE,MAAM,IAAsC,CAAC;AAC3F;;;;;;;;;;;;;;;;;;;;;;;ACNA,SAAgB,eAAe,OAAyB;CACtD,IAAI,EAAE,iBAAiB,QACrB,OAAO;CAGT,MAAM,aAAsC;EAC1C,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,GAAG,cAAc,OAAO,OAAO;CACjC;CAEA,IAAI,MAAM,UAAU,KAAA,GAClB,WAAW,QACT,MAAM,iBAAiB,QACrB;EACE,MAAM,MAAM,MAAM;EAClB,SAAS,MAAM,MAAM;EACrB,GAAG,cAAc,MAAM,OAAO,OAAO;CACvC,IACA,MAAM;CAGZ,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACRA,SAAS,WACP,OACA,WACA,UACA,OACA,kBACQ;CACR,MAAM,oBAAoB,WAAW,KAAK;;;;;;;;CAS1C,SAAS,eAAe,WAA8B;EACpD,OAAO,WAAW,SAAS,KAAK;CAClC;;;;;;;;;;;;;CAcA,SAAS,KAAK,UAAoB,SAAiB,SAA4B;EAC7E,IAAI,CAAC,eAAe,QAAQ,GAC1B;EAIF,MAAM,SACJ,YAAY,KAAA,IAAY;GAAE,GAAG;GAAU,GAAG;EAAQ,IAAI,EAAE,GAAG,SAAS;EAGtE,MAAM,oBAAgC,CAAC;EACvC,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAClC,kBAAkB,OAAO,eAAe,OAAO,IAAI;EAGrD,MAAM,SAAoB;GACxB,MAAM,MAAM,CAAC,CAAC,YAAY;GAC1B,OAAO;GACP,YAAY,WAAW,QAAQ;GAC/B;GACA,SAAS;EACX;EAEA,IAAI;GACF,UAAU,IAAI,MAAM;EACtB,SAAS,OAAO;GACd,IAAI;IACF,mBAAmB,OAAO,MAAM;GAClC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL,IAAI,QAAkB;GACpB,OAAO;EACT;EAEA;EAEA,MAAM,SAAiB,SAA4B;GACjD,KAAK,SAAS,SAAS,OAAO;EAChC;EAEA,MAAM,SAAiB,SAA4B;GACjD,KAAK,SAAS,SAAS,OAAO;EAChC;EAEA,KAAK,SAAiB,SAA4B;GAChD,KAAK,QAAQ,SAAS,OAAO;EAC/B;EAEA,KAAK,SAAiB,SAA4B;GAChD,KAAK,QAAQ,SAAS,OAAO;EAC/B;EAEA,MAAM,SAAiB,SAA4B;GACjD,KAAK,SAAS,SAAS,OAAO;EAChC;EAEA,MAAM,SAAiB,SAA4B;GACjD,KAAK,SAAS,SAAS,OAAO;EAChC;EAEA,MAAM,eAAmC;GAGvC,OAAO,WACL,OACA,WACA;IAAE,GAAG;IAAU,GAAG;GAAc,GAChC,OACA,gBACF;EACF;CACF;AACF;;;;;;;;;;;;;AAcA,SAAgB,aAAa,SAAsC;CACjE,MAAM,EACJ,WACA,QAAQ,QACR,WAAW,CAAC,GACZ,8BAAc,IAAI,KAAK,GACvB,qBACE;CAEJ,OAAO,WAAW,OAAO,WAAW,UAAU,OAAO,gBAAgB;AACvE;;;;;;;;;;;;;;;AC3HA,SAAgB,iBAAiB,GAAgB,QAA0C;CACzF,MAAM,YAAY,EAAE;CACpB,IAAI,OAAO,cAAc,YACvB,OAAO,UAAU,KAAK,CAAC;CAEzB,OAAO,EAAE,IAAI,KAAK,CAAC;AACrB;;;;;;;;;;;;;;;;ACpCA,MAAM,iBAAqD;CACzD,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,OAAO;AACT;;AAGA,MAAMA,iBAA8D;CAClE,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,OAAO;AACT;;;;;;;;AASA,SAAgB,uBACd,SACA,WAAwB,SACb;CACX,MAAM,cAAkD;EACtD,GAAG;EACH,GAAG,SAAS;CACd;CAEA,OAAO,EACL,IAAI,QAAyB;EAC3B,MAAM,aAAaA,eAAa,OAAO;EACvC,MAAM,SAAS,iBAAiB,UAAU,UAAU;EACpD,MAAM,QAAQ,YAAY,OAAO;EACjC,MAAM,QAAQ,OAAO,MAAM,YAAY;EAIvC,IAFmB,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,GAGtD,OAAO,KAAK,SAAS,OAAO,OAAO,SAAS,OAAO,OAAO;OAE1D,OAAO,KAAK,SAAS,OAAO,OAAO,OAAO;CAE9C,EACF;AACF;;;;;;;;ACtDA,SAAgB,yBAA2C;CACzD,IAAI,WAAwB,CAAC;CAE7B,OAAO;EACL,IAAI,QAAyB;GAC3B,SAAS,KAAK,MAAM;EACtB;EAEA,IAAI,UAAgC;GAElC,OAAO,SAAS,MAAM;EACxB;EAEA,QAAc;GACZ,WAAW,CAAC;EACd;EAEA,KAAK,OAAuC;GAC1C,OAAO,SAAS,QAAQ,MAAM,EAAE,UAAU,KAAK;EACjD;CACF;AACF;;;;;;;;;;;;;;;;;;;;;AChBA,MAAM,WAAW;;;;;;;;;;;;;;;AAgBjB,SAAgB,oBAAoB,OAAyB;CAC3D,IAAI,OAAO,UAAU,UACnB,OAAO,GAAG,MAAM,SAAS,EAAE;CAE7B,IAAI,OAAO,UAAU,UAEnB,OAAO,MAAM,SAAS;CAExB,IAAI,OAAO,UAAU,YAAY;EAC/B,MAAM,OAAO,MAAM;EACnB,OAAO,OAAO,aAAa,KAAK,KAAK;CACvC;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,OAAwB;CACpD,IAAI,UAAU,KAAA,GACZ,OAAO;CAYT,MAAM,QAAmB,CAAC;CAE1B,IAAI;EACF,OAAO,KAAK,UACV,OACA,SAAS,SAAwB,MAAc,KAAuB;GAGpE,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,YACvE,OAAO,oBAAoB,GAAG;GAIhC,IAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;IAC3C,MAAM,cAAc,MAAM,QAAQ,IAAI;IACtC,IAAI,gBAAgB,IAElB,MAAM,KAAK,IAAI;SAIf,MAAM,SAAS,cAAc;IAG/B,IAAI,MAAM,SAAS,GAAG,GACpB,OAAO;IAET,MAAM,KAAK,GAAG;GAChB;GAEA,OAAO;EACT,CACF;CACF,QAAQ;EAGN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;;;AChGA,MAAM,uBAAuB;;AAG7B,MAAM,gBAAkD;CACtD,MAAM;CACN,MAAM;CACN,KAAM;AACR;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAuB;CAC1D,OAAO,MAAM,QAAQ,uBAAuB,SAAS;EACnD,MAAM,QAAQ,cAAc;EAC5B,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAC9D,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;ACrBA,MAAM,QAAQ;;AAGd,MAAM,cAAkD;CACtD,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,OAAO;AACT;;;;;;;;;;AAeA,SAAgB,YAAY,WAA2B;CACrD,MAAM,SAAS,UAAU,QAAQ,GAAG;CACpC,IAAI,WAAW,IACb,OAAO,UAAU,MAAM,GAAG,CAAC;CAE7B,OAAO,UAAU,MAAM,SAAS,GAAG,SAAS,CAAC;AAC/C;;AAOA,MAAM,cAAkD;CACtD,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,OAAO;AACT;;;;;;;;AAaA,SAAgB,uBACd,SACA,WAAwB,SACb;CACX,MAAM,SAAS,eAAe,SAAS,QAAQ,IAAI;CACnD,MAAM,YAAY,eAAe,SAAS,WAAW,MAAM;CAE3D,OAAO,EACL,IAAI,QAAyB;EAI3B,MAAM,SAAS,iBAAiB,UAD9B,OAAO,UAAU,UAAU,OAAO,UAAU,WAAW,OAAO,UAAU,UACtB,UAAU,KAAK;EAGnE,MAAM,QAAkB,CAAC;EAGzB,IAAI,cAAc,QAAQ;GACxB,MAAM,KAAK,YAAY,OAAO,IAAI;GAClC,MAAM,KAAK,SAAS,WAAW,KAAK,UAAU,EAAE;EAClD,OAAO,IAAI,cAAc,OACvB,MAAM,KAAK,SAAS,WAAW,OAAO,OAAO,UAAU,OAAO,IAAI;EAIpE,MAAM,QAAQ,YAAY,OAAO;EACjC,IAAI,QAAQ;GACV,MAAM,QAAQ,YAAY,OAAO;GACjC,MAAM,KAAK,GAAG,QAAQ,QAAQ,OAAO;EACvC,OACE,MAAM,KAAK,KAAK;EAIlB,MAAM,KAAK,qBAAqB,OAAO,OAAO,CAAC;EAM/C,IADmB,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,GAEtD,MAAM,KAAK,cAAc,OAAO,OAAO,CAAC;EAG1C,OAAO,MAAM,KAAK,GAAG,CAAC;CACxB,EACF;AACF;;;;;;;;;;;;;;;;;;;;;;AC/GA,MAAM,eAA8D;CAClE,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,OAAO;AACT;;;;;;;;AASA,SAAgB,0BACd,SACA,WAAwB,SACb;CACX,MAAM,YAAY,eAAe,SAAS,WAAW,KAAK;CAE1D,OAAO,EACL,IAAI,QAAyB;EAC3B,MAAM,aAAa,aAAa,OAAO;EACvC,MAAM,SAAS,iBAAiB,UAAU,UAAU;EAGpD,MAAM,UAAmC;GACvC,GAAG,OAAO;GACV,MAAM,OAAO;GACb,OAAO,OAAO;GACd,SAAS,OAAO;EAClB;EAEA,IAAI,WACF,OAAO,cAAc,OAAO,CAAC;OAE7B,OAAO,OAAO;CAElB,EACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvBA,SAAgB,oBACd,aACA,SACsB;CAGtB,MAAM,MAAM,gBAAgB,UAAU,gBAAgB,gBAAgB,cAAc;CAEpF,IAAI,QAAQ,QACV,OAAO;EAAE,OAAO;EAAS,WAAW,uBAAuB;CAAE;CAG/D,IAAI,QAAQ,eAAe;EACzB,IAAI,YAAY,WACd,OAAO;GAAE,OAAO;GAAQ,WAAW,uBAAuB;EAAE;EAG9D,OAAO;GAAE,OAAO;GAAS,WAAW,uBAAuB;EAAE;CAC/D;CAGA,IAAI,YAAY,WACd,OAAO;EAAE,OAAO;EAAQ,WAAW,uBAAuB;CAAE;CAG9D,OAAO;EAAE,OAAO;EAAQ,WAAW,0BAA0B;CAAE;AACjE;;;;;;;;AC3DA,SAAgB,wBAAmC;CACjD,OAAO,EACL,MAAY,CAEZ,EACF;AACF"}

package/dist/testing/index.d.ts

@@ -0,0 +1,44 @@
+import "jose";
+//#region src/lib/auth-internal/jwt.d.ts
+/** Name of the cookie that stores the JWT. */
+declare const COOKIE_NAME = "CF_Authorization";
+/** Header containing the JWT (set by Cloudflare Access). */
+declare const JWT_HEADER = "cf-access-jwt-assertion";
+/**
+ * Create a signed JWT that mimics a Cloudflare Access token.
+ *
+ * The `type` claim is set to `"dev"` so that the verification layer can distinguish
+ * locally-issued tokens from real Access tokens.
+ *
+ * @param email - The user's email address (becomes the `email` claim).
+ * @param options - Optional overrides.
+ * @param options.secret - HMAC signing secret (default {@link DEFAULT_DEV_SECRET}).
+ * @param options.lifetime - Token lifetime in seconds (default `86400` / 24 h).
+ * @param options.sub - Subject claim. When provided it is used **verbatim**; when omitted a
+ *   random UUID is generated (matching the shape of a real Cloudflare Access `sub`) instead of
+ *   an email-derived value.
+ */
+declare function signDevJwt(email: string, options?: {
+  secret?: string;
+  lifetime?: number;
+  sub?: string;
+}): Promise<string>;
+/**
+ * Build a `Set-Cookie` header value for the authorisation cookie.
+ *
+ * Mirrors the attributes used by Cloudflare Access: `HttpOnly; Secure; SameSite=Lax; Path=/`
+ *
+ * For local dev over plain HTTP the `Secure` flag is omitted when the request was made to
+ * `localhost` or `127.0.0.1`.
+ */
+declare function buildCookieHeader(token: string, isSecure: boolean): string;
+/**
+ * Build a `Set-Cookie` header that clears the `CF_Authorization` cookie by setting it to an
+ * empty value with `Max-Age=0`.
+ *
+ * Use this when a stale or invalid cookie needs to be removed so the user can re-authenticate.
+ */
+declare function clearCookieHeader(): string;
+//#endregion
+export { COOKIE_NAME, JWT_HEADER, buildCookieHeader, clearCookieHeader, signDevJwt };
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.js

@@ -0,0 +1,2 @@
+import { a as buildCookieHeader, c as signDevJwt, i as JWT_HEADER, o as clearCookieHeader, t as COOKIE_NAME } from "../jwt-BvuKtvby.js";
+export { COOKIE_NAME, JWT_HEADER, buildCookieHeader, clearCookieHeader, signDevJwt };

package/dist/types-Cx6NNILW.d.ts

@@ -0,0 +1,44 @@
+//#region src/lib/problem-details/types.d.ts
+/**
+ * @file Core RFC 9457 Problem Details types: the `ProblemDetails` object shape and the
+ * `ProblemDetailsInput` accepted by the `problemDetails()` factory.
+ */
+/**
+ * RFC 9457 Problem Details object.
+ * Supports 5 standard fields + extension members.
+ */
+interface ProblemDetails<T extends Record<string, unknown> = Record<string, unknown>> {
+  /** Problem type URI. Default: "about:blank" */
+  type: string;
+  /** HTTP status code */
+  status: number;
+  /** Short summary of the problem type */
+  title: string;
+  /** Human-readable explanation specific to this occurrence */
+  detail?: string;
+  /** URI that identifies the specific occurrence */
+  instance?: string;
+  /** RFC 9457 extension members (flattened to top level on serialization) */
+  extensions?: T;
+}
+/**
+ * Input for the {@link problemDetails} factory.
+ * `type` and `title` are optional (auto-derived from `status`).
+ */
+interface ProblemDetailsInput<T extends Record<string, unknown> = Record<string, unknown>> {
+  /** HTTP status code */
+  status: number;
+  /** Problem type URI. Defaults to "about:blank" when omitted */
+  type?: string;
+  /** Short summary of the problem type. Derived from `status` when omitted */
+  title?: string;
+  /** Human-readable explanation specific to this occurrence */
+  detail?: string;
+  /** URI that identifies the specific occurrence */
+  instance?: string;
+  /** RFC 9457 extension members (flattened to top level on serialization) */
+  extensions?: T;
+}
+//#endregion
+export { ProblemDetailsInput as n, ProblemDetails as t };
+//# sourceMappingURL=types-Cx6NNILW.d.ts.map

package/dist/types-DCSMb1cp.d.ts

@@ -0,0 +1,195 @@
+//#region src/lib/logging/types.d.ts
+/**
+ * @file Core public types for the logging subpath.
+ *
+ * These types form the stable public contract for the logging core. Numeric level values are
+ * fixed once released; the string `LogLevel` union is the primary API surface for TypeScript
+ * consumers.
+ *
+ * Note: `src/cli/generate-wrangler-types/logger.ts` defines its own, deliberately separate
+ * `Logger`/`LogLevel` pair for colored stderr CLI output — it is not a consumer of this
+ * `Transport`-based contract. See that file's header for why the split is intentional
+ * (ARCH-003, `docs/specs/SPECv2.md` §12.3).
+ */
+/**
+ * The six severity levels supported by the logger, ordered from lowest to highest: `trace <
+ * debug < info < warn < error < fatal`.
+ *
+ * Numeric weights are exposed on `LogRecord.levelValue`.
+ */
+type LogLevel = "trace" | "debug" | "info" | "warn" | "error" | "fatal";
+/**
+ * Arbitrary structured key-value pairs attached to a log record.
+ *
+ * Values may be any JSON-compatible type. Top-level `Error` values are serialized to plain
+ * objects by the logger before transport delivery.
+ */
+type LogContext = Record<string, unknown>;
+/**
+ * An immutable, fully-resolved log record delivered to transports.
+ *
+ * The logger creates exactly one record per enabled log call. Transports receive the record
+ * after level filtering and context serialization.
+ */
+interface LogRecord {
+  /** ISO 8601 timestamp produced by the logger's clock at emit time. */
+  readonly time: string;
+  /** String severity level of this record. */
+  readonly level: LogLevel;
+  /** Numeric weight of `level`. */
+  readonly levelValue: number;
+  /** Human-readable description of the event. */
+  readonly message: string;
+  /** Merged bindings and per-call context. Top-level `Error` values have been serialized. */
+  readonly context: LogContext;
+}
+/**
+ * The minimum interface a transport must implement.
+ *
+ * `log` is called synchronously for every record that passes level filtering. Built-in
+ * transports must not throw; the logger wraps all transport calls in try/catch and routes
+ * failures through `onTransportError`.
+ */
+interface Transport {
+  /** Deliver `record` to the transport's destination. */
+  log(record: LogRecord): void;
+}
+/**
+ * Optional callback invoked when a transport's `log` method throws.
+ *
+ * Receives the thrown value and the record that triggered the failure. Any exception thrown by
+ * this callback is silently swallowed by the logger.
+ */
+type TransportErrorHandler = (error: unknown, record: LogRecord) => void;
+/**
+ * Options accepted by `createLogger`.
+ */
+interface CreateLoggerOptions {
+  /**
+   * Minimum severity level to emit. Records below this level are dropped before context is
+   * accessed. Defaults to `"info"`.
+   */
+  readonly level?: LogLevel;
+  /** Transport to receive emitted records. Required. */
+  readonly transport: Transport;
+  /**
+   * Key-value pairs merged into every record's context. Per-call context wins on key collision.
+   * Defaults to `{}`.
+   */
+  readonly bindings?: LogContext;
+  /**
+   * Clock used to produce `record.time`. Defaults to `() => new Date()`. Override in tests for
+   * deterministic timestamps.
+   */
+  readonly clock?: () => Date;
+  /**
+   * Called when the transport throws. Receives the error and the record that triggered it.
+   * Exceptions thrown by this callback are swallowed.
+   */
+  readonly onTransportError?: TransportErrorHandler;
+}
+/**
+ * The public logging interface returned by `createLogger` and `child`.
+ *
+ * Each level method checks `isLevelEnabled` before touching the context argument, so disabled
+ * calls impose no observable side effects.
+ */
+interface Logger {
+  /** Emit a `trace`-level record. No-op when `trace` is below the configured level. */
+  trace(message: string, context?: LogContext): void;
+  /** Emit a `debug`-level record. No-op when `debug` is below the configured level. */
+  debug(message: string, context?: LogContext): void;
+  /** Emit an `info`-level record. No-op when `info` is below the configured level. */
+  info(message: string, context?: LogContext): void;
+  /** Emit a `warn`-level record. No-op when `warn` is below the configured level. */
+  warn(message: string, context?: LogContext): void;
+  /** Emit an `error`-level record. No-op when `error` is below the configured level. */
+  error(message: string, context?: LogContext): void;
+  /** Emit a `fatal`-level record. No-op when `fatal` is below the configured level. */
+  fatal(message: string, context?: LogContext): void;
+  /**
+   * Return a new logger that inherits this logger's transport, level, clock, and error handler,
+   * with `bindings` merged on top of the parent's bindings. The parent logger is not affected.
+   */
+  child(bindings: LogContext): Logger;
+  /** The minimum severity level this logger will emit. */
+  readonly level: LogLevel;
+  /** Returns `true` when records at `level` will be emitted by this logger. */
+  isLevelEnabled(level: LogLevel): boolean;
+}
+/**
+ * Environment hint for `resolveLoggerConfig`.
+ * The `(string & {})` tail keeps the type open for custom environment names while preserving
+ * autocomplete for the well-known values.
+ */
+type Environment = "test" | "development" | "production" | (string & {});
+/** Runtime hint for `resolveLoggerConfig`. */
+type Runtime = "browser" | "worker";
+/** Output of `resolveLoggerConfig`. */
+interface ResolvedLoggerConfig {
+  /** Minimum severity level selected for the environment and runtime. */
+  readonly level: LogLevel;
+  /** Transport selected for the environment and runtime. */
+  readonly transport: Transport;
+}
+/**
+ * Options for `createBrowserTransport`.
+ * `levelStyles` allows overriding the CSS style string applied to the level badge for any subset
+ * of levels.
+ */
+interface BrowserTransportOptions {
+  /**
+   * CSS style strings applied to the level badge via `%c` in `console` calls. Provide only the
+   * levels you want to override; unspecified levels use the transport's built-in defaults.
+   */
+  readonly levelStyles?: Partial<Record<LogLevel, string>>;
+}
+/** Options for `createConsoleTransport`. */
+interface ConsoleTransportOptions {
+  /**
+   * Whether to emit ANSI color codes in the output. Defaults to `true`. Set to `false` for CI
+   * environments or when piping output to a file.
+   */
+  readonly colors?: boolean;
+  /**
+   * Controls the timestamp prefix on each line.
+   *
+   * - `"time"` — concise `HH:MM:SS` derived from `record.time` (default).
+   * - `"iso"` — full ISO 8601 string from `record.time`.
+   * - `false` — no timestamp.
+   */
+  readonly timestamp?: "time" | "iso" | false;
+}
+/** Options for `createStructuredTransport`. */
+interface StructuredTransportOptions {
+  /**
+   * When `true`, serializes the payload to a JSON string before passing it to the console
+   * method. When `false` (default), passes a plain object so that Cloudflare Workers Logs can
+   * extract and index individual fields.
+   */
+  readonly stringify?: boolean;
+}
+/**
+ * `CaptureTransport` extends `Transport` with test-ergonomic helpers.
+ *
+ * `.find(level)` is the preferred way to assert on records at a specific level in tests; it
+ * avoids iterating `.records` manually.
+ */
+interface CaptureTransport extends Transport {
+  /**
+   * Read-only ordered list of all records received since the last `clear()`. Returns an
+   * immutable snapshot; mutating the returned value does not affect internal storage.
+   */
+  readonly records: readonly LogRecord[];
+  /** Remove all stored records. */
+  clear(): void;
+  /**
+   * Return all stored records whose `level` matches `level`.
+   *
+   * Preferred over filtering `.records` manually in test assertions.
+   */
+  find(level: LogLevel): readonly LogRecord[];
+}
+//#endregion
+export { Environment as a, LogRecord as c, Runtime as d, StructuredTransportOptions as f, CreateLoggerOptions as i, Logger as l, TransportErrorHandler as m, CaptureTransport as n, LogContext as o, Transport as p, ConsoleTransportOptions as r, LogLevel as s, BrowserTransportOptions as t, ResolvedLoggerConfig as u };
+//# sourceMappingURL=types-DCSMb1cp.d.ts.map

package/dist/types-DXboaWOT.d.ts

@@ -0,0 +1,29 @@
+//#region src/lib/auth-internal/types.d.ts
+/**
+ * A single path-matching rule used to decide whether a request requires authentication.
+ *
+ * Policies are evaluated in order; the **first match wins**.
+ */
+interface PathPolicy {
+  /** Regular expression tested against the request pathname. */
+  pattern: RegExp;
+  /**
+   * `true`  - the matching path requires authentication.
+   * `false` - the matching path is public / anonymous.
+   */
+  authenticate: boolean;
+  /**
+   * Controls the response when an unauthenticated request hits this path in a consuming
+   * dev-emulation layer (e.g. `cloudflareAccessPlugin`):
+   *
+   * - `true` *(default)* — redirect to a login form. Appropriate for page routes where the
+   *   browser should navigate to a login UI.
+   * - `false` — return 401 instead of redirecting. Appropriate for API routes.
+   *
+   * Only meaningful when `authenticate` is `true`.
+   */
+  redirect?: boolean;
+}
+//#endregion
+export { PathPolicy as t };
+//# sourceMappingURL=types-DXboaWOT.d.ts.map

package/dist/vite/index.d.ts

@@ -0,0 +1,79 @@
+import { t as PathPolicy } from "../types-DXboaWOT.js";
+import { Plugin } from "vite";
+//#region src/lib/vite/login-page.d.ts
+/**
+ * @file The HTML template for the Vite dev-server login page rendered by `cloudflareAccessPlugin`
+ * (./plugin.ts). A pure HTML-string builder with no dependency on `auth-internal` or any other
+ * runtime module.
+ */
+/** A selectable identity rendered on the dev login form. */
+interface DevLoginUser {
+  /** Email address used as the JWT `email` claim. */
+  email: string;
+  /** Optional human-friendly display name. */
+  name?: string;
+  /**
+   * Optional subject claim to pin for this identity.
+   *
+   * When provided it is used **verbatim** as the JWT `sub` so the identity has a stable,
+   * realistic subject across logins. When omitted a random UUID is generated each time the user
+   * signs in (matching the shape of a real Cloudflare Access `sub`).
+   */
+  sub?: string;
+}
+//#endregion
+//#region src/lib/vite/plugin.d.ts
+/** Configuration for {@link cloudflareAccessPlugin}. */
+interface CloudflareAccessPluginOptions {
+  /**
+   * Path policies evaluated in order (first match wins).
+   *
+   * Pass the **same array** you give to `cloudflareAccess` in the Worker
+   * (../hono/cloudflare-access.ts) so dev and prod agree on which paths are protected.
+   *
+   * - `authenticate: false` — public (no gating, no header injection).
+   * - `authenticate: true` — protected. Unauthenticated navigations are redirected to the login
+   *   form; API routes with `redirect: false` receive a 401.
+   *
+   * When omitted, **all** non-internal paths are treated as protected.
+   */
+  policies?: PathPolicy[];
+  /**
+   * HMAC secret used to sign the dev JWT.
+   *
+   * Must match the `devSecret` passed to `cloudflareAccess` in the Worker (if overridden there).
+   * Defaults to the same well-known development key.
+   */
+  devSecret?: string;
+  /**
+   * Selectable identities rendered on the dev login form. When omitted the form shows a single
+   * free-text email input.
+   */
+  users?: DevLoginUser[];
+  /** Pathname for the login form (default `"/cdn-cgi/access/login"`). */
+  loginPath?: string;
+  /** Dev JWT lifetime in seconds (default `86400` / 24 h). */
+  tokenLifetime?: number;
+}
+/**
+ * Create the dev-only Cloudflare Access emulation plugin.
+ *
+ * Register it **before** `@cloudflare/vite-plugin` (and any framework plugin) so its connect
+ * middleware runs first:
+ *
+ * ```ts
+ * plugins: [cloudflareAccessPlugin(), cloudflare(), react()]
+ * ```
+ *
+ * The middleware is registered synchronously in the `configureServer` hook body (combined with
+ * `enforce: "pre"`) so that it sits ahead of the request → `workerd` dispatch handler that
+ * `@cloudflare/vite-plugin` registers from its post hook.
+ *
+ * @param options - Configuration for path policies, the dev secret, selectable login identities,
+ *   the login form path, and the dev token lifetime.
+ * @returns A Vite `Plugin`.
+ */
+declare function cloudflareAccessPlugin(options?: CloudflareAccessPluginOptions): Plugin;
+//#endregion
+export { type CloudflareAccessPluginOptions, cloudflareAccessPlugin };
+//# sourceMappingURL=index.d.ts.map