npm - @adrianhall/cloudflare-toolkit - Versions diffs - 0.0.1 - Mend

@adrianhall/cloudflare-toolkit 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (51) hide show

package/LICENSE +21 -0
package/README.md +59 -0
package/THIRD-PARTY-NOTICES.md +75 -0
package/dist/cli/generate-wrangler-types/index.d.ts +1 -0
package/dist/cli/generate-wrangler-types/index.js +329 -0
package/dist/cli/generate-wrangler-types/index.js.map +1 -0
package/dist/error-CLYcAvBM.d.ts +28 -0
package/dist/errors/index.d.ts +2 -0
package/dist/errors/index.js +3 -0
package/dist/errors-Ciipq_zr.js +58 -0
package/dist/errors-Ciipq_zr.js.map +1 -0
package/dist/factory-BI5gVL_P.js +220 -0
package/dist/factory-BI5gVL_P.js.map +1 -0
package/dist/generators-D8WWEHa1.js +165 -0
package/dist/generators-D8WWEHa1.js.map +1 -0
package/dist/guards/index.d.ts +2 -0
package/dist/guards/index.js +2 -0
package/dist/guards-6K1CVAr5.js +61 -0
package/dist/guards-6K1CVAr5.js.map +1 -0
package/dist/hono/index.d.ts +347 -0
package/dist/hono/index.js +307 -0
package/dist/hono/index.js.map +1 -0
package/dist/index-434HN8jN.d.ts +43 -0
package/dist/index-Byl-ZrCy.d.ts +138 -0
package/dist/index-CUICemFw.d.ts +129 -0
package/dist/index-DRIhR-Xn.d.ts +81 -0
package/dist/index.d.ts +8 -0
package/dist/index.js +8 -0
package/dist/jwt-BvuKtvby.js +328 -0
package/dist/jwt-BvuKtvby.js.map +1 -0
package/dist/logging/index.d.ts +3 -0
package/dist/logging/index.js +3 -0
package/dist/logging-CGHjOVLM.js +24 -0
package/dist/logging-CGHjOVLM.js.map +1 -0
package/dist/policy-CvS6AvvD.js +20 -0
package/dist/policy-CvS6AvvD.js.map +1 -0
package/dist/problem-details/index.d.ts +4 -0
package/dist/problem-details/index.js +3 -0
package/dist/problem-details-CuRsLy3Q.js +37 -0
package/dist/problem-details-CuRsLy3Q.js.map +1 -0
package/dist/silent-CWpHE65X.js +652 -0
package/dist/silent-CWpHE65X.js.map +1 -0
package/dist/testing/index.d.ts +44 -0
package/dist/testing/index.js +2 -0
package/dist/types-Cx6NNILW.d.ts +44 -0
package/dist/types-DCSMb1cp.d.ts +195 -0
package/dist/types-DXboaWOT.d.ts +29 -0
package/dist/vite/index.d.ts +79 -0
package/dist/vite/index.js +417 -0
package/dist/vite/index.js.map +1 -0
package/package.json +137 -0

package/dist/vite/index.js ADDED Viewed

@@ -0,0 +1,417 @@
+import { n as ProblemDetailsError } from "../factory-BI5gVL_P.js";
+import { n as contentTooLarge } from "../generators-D8WWEHa1.js";
+import { a as buildCookieHeader, c as signDevJwt, i as JWT_HEADER, o as clearCookieHeader, r as EMAIL_HEADER, s as parseCookie, u as verifyDevJwt } from "../jwt-BvuKtvby.js";
+import { t as matchPolicy } from "../policy-CvS6AvvD.js";
+//#region src/lib/vite/login-page.ts
+/**
+* Render a self-contained HTML page with a dev login form.
+*
+* @param loginPath - The path the form submits to (handled by the plugin).
+* @param redirectTo - The URL the user is returned to after login.
+* @param users - Optional selectable identities. When provided the form shows a radio list plus
+*   a "custom email" option; when empty it falls back to a single email input.
+* @param error - Optional error message to display.
+* @returns A complete `<!DOCTYPE html>` document as a string.
+*/
+function renderViteLoginPage(loginPath, redirectTo, users = [], error) {
+	const errorHtml = error ? `<div class="error" role="alert">${escapeHtml(error)}</div>` : "";
+	const usersHtml = users.length > 0 ? renderUserChoices(users) : renderEmailInput();
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Developer Login</title>
+  <style>
+    *,*::before,*::after{box-sizing:border-box}
+    body{
+      margin:0;font-family:system-ui,-apple-system,sans-serif;
+      display:flex;align-items:center;justify-content:center;
+      min-height:100vh;background:#f4f4f5;color:#18181b;
+    }
+    .card{
+      background:#fff;border-radius:12px;box-shadow:0 1px 3px rgba(0,0,0,.1);
+      padding:2.5rem;width:100%;max-width:420px;
+    }
+    h1{margin:0 0 .25rem;font-size:1.5rem}
+    p.subtitle{margin:0 0 1.5rem;color:#52525b;font-size:.875rem}
+    fieldset{border:none;margin:0;padding:0}
+    legend{font-size:.875rem;font-weight:500;margin-bottom:.5rem;padding:0}
+    label{display:block;font-size:.875rem;font-weight:500;margin-bottom:.375rem}
+    .user-option{
+      display:flex;align-items:center;gap:.625rem;
+      padding:.625rem .75rem;border:1px solid #71717a;border-radius:8px;
+      margin-bottom:.5rem;cursor:pointer;
+    }
+    .user-option:focus-within{border-color:#1d4ed8;box-shadow:0 0 0 3px rgba(29,78,216,.4)}
+    .user-option input{margin:0}
+    .user-option .meta{display:flex;flex-direction:column}
+    .user-option .name{font-weight:500}
+    .user-option .email{color:#52525b;font-size:.8125rem}
+    input[type="email"]{
+      width:100%;padding:.625rem .75rem;border:1px solid #71717a;
+      border-radius:8px;font-size:1rem;outline:none;
+      transition:border-color .15s;
+    }
+    input[type="email"]:focus{border-color:#1d4ed8;box-shadow:0 0 0 3px rgba(29,78,216,.4)}
+    button{
+      margin-top:1rem;width:100%;padding:.625rem;border:none;
+      border-radius:8px;background:#1d4ed8;color:#fff;
+      font-size:1rem;font-weight:500;cursor:pointer;
+      transition:background .15s;
+    }
+    button:hover{background:#1e40af}
+    .error{
+      background:#fef2f2;color:#991b1b;border:1px solid #fecaca;
+      padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.875rem;
+    }
+    .badge{
+      display:inline-block;background:#fef3c7;color:#92400e;
+      font-size:.75rem;font-weight:600;padding:.125rem .5rem;
+      border-radius:9999px;margin-bottom:1rem;
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <span class="badge">LOCAL DEV</span>
+    <h1>Developer Login</h1>
+    <p class="subtitle">Simulates Cloudflare Access in front of your Vite dev server.</p>
+    ${errorHtml}
+    <form method="POST" action="${escapeHtml(loginPath)}">
+      <input type="hidden" name="redirect" value="${escapeHtml(redirectTo)}" />
+      ${usersHtml}
+      <button type="submit">Sign in</button>
+    </form>
+  </main>
+</body>
+</html>`;
+}
+/** Single email input (no pre-configured users). */
+function renderEmailInput() {
+	return `<label for="email">Email address</label>
+      <input
+        id="email"
+        name="email"
+        type="email"
+        required
+        autocomplete="email"
+        placeholder="you@example.com"
+        autofocus
+      />`;
+}
+/** Radio list of selectable identities plus a custom-email field. */
+function renderUserChoices(users) {
+	return `<fieldset>
+      <legend>Choose an identity</legend>
+      ${users.map((user, index) => {
+		const id = `user-${index}`;
+		const nameHtml = user.name ? `<span class="name">${escapeHtml(user.name)}</span>` : `<span class="name">${escapeHtml(user.email)}</span>`;
+		const emailHtml = user.name ? `<span class="email">${escapeHtml(user.email)}</span>` : "";
+		const checked = index === 0 ? " checked" : "";
+		return `<label class="user-option" for="${id}">
+        <input type="radio" id="${id}" name="email" value="${escapeHtml(user.email)}"${checked} />
+        <span class="meta">${nameHtml}${emailHtml}</span>
+      </label>`;
+	}).join("\n      ")}
+    </fieldset>
+    <label for="custom-email">Or enter a custom email address</label>
+    <input
+      id="custom-email"
+      name="custom-email"
+      type="email"
+      autocomplete="email"
+      placeholder="you@example.com"
+    />`;
+}
+/** Minimal HTML-entity escaping for untrusted values injected into HTML. */
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+//#endregion
+//#region src/lib/vite/plugin.ts
+const DEFAULT_LOGIN_PATH = "/cdn-cgi/access/login";
+const LOGOUT_PATH = "/cdn-cgi/access/logout";
+const GET_IDENTITY_PATH = "/cdn-cgi/access/get-identity";
+/**
+* Path prefixes that belong to Vite's own internals (or asset requests) and must always pass
+* through untouched.
+*/
+const VITE_INTERNAL_PREFIXES = [
+	"/@vite",
+	"/@fs",
+	"/@id",
+	"/@react-refresh",
+	"/node_modules/",
+	"/__vite",
+	"/src/"
+];
+/**
+* Create the dev-only Cloudflare Access emulation plugin.
+*
+* Register it **before** `@cloudflare/vite-plugin` (and any framework plugin) so its connect
+* middleware runs first:
+*
+* ```ts
+* plugins: [cloudflareAccessPlugin(), cloudflare(), react()]
+* ```
+*
+* The middleware is registered synchronously in the `configureServer` hook body (combined with
+* `enforce: "pre"`) so that it sits ahead of the request → `workerd` dispatch handler that
+* `@cloudflare/vite-plugin` registers from its post hook.
+*
+* @param options - Configuration for path policies, the dev secret, selectable login identities,
+*   the login form path, and the dev token lifetime.
+* @returns A Vite `Plugin`.
+*/
+function cloudflareAccessPlugin(options = {}) {
+	return {
+		name: "cloudflare-access-dev",
+		apply: "serve",
+		enforce: "pre",
+		configureServer(server) {
+			server.middlewares.use(createAccessDevMiddleware(options));
+		}
+	};
+}
+/**
+* Build the connect middleware that emulates Cloudflare Access.
+*
+* Exported separately so it can be unit-tested with mock `req`/`res` objects without booting a
+* real Vite server.
+*
+* @param options - Same options accepted by {@link cloudflareAccessPlugin}.
+* @returns A Vite `Connect.NextHandleFunction`.
+*/
+function createAccessDevMiddleware(options = {}) {
+	const policies = options.policies;
+	const devSecret = options.devSecret ?? "cloudflare-access-dev-secret-do-not-use-in-production";
+	const users = options.users ?? [];
+	const loginPath = options.loginPath ?? DEFAULT_LOGIN_PATH;
+	const tokenLifetime = options.tokenLifetime;
+	return (req, res, next) => {
+		handle(req, res, next).catch((err) => next(err));
+	};
+	async function handle(req, res, next) {
+		const pathname = getPathname(req);
+		if (isViteInternal(pathname)) return next();
+		if (pathname === loginPath) {
+			if (req.method === "POST") return handleLoginSubmit(req, res);
+			return serveLoginForm(req, res);
+		}
+		if (pathname === LOGOUT_PATH) return handleLogout(res);
+		if (pathname === GET_IDENTITY_PATH) return handleGetIdentity(req, res);
+		const token = parseCookie(req.headers.cookie);
+		const verified = token ? await verifyDevJwt(token, devSecret) : null;
+		if (token && verified) {
+			injectAccessHeaders(req, token, verified.email);
+			return next();
+		}
+		const policyMatch = policies ? matchPolicy(pathname, policies) : void 0;
+		if (policyMatch?.authenticate === false) return next();
+		if (policyMatch?.authenticate === true && policyMatch.redirect === false) return sendJson(res, 401, { error: "Authentication required" });
+		if (isNavigation(req)) return redirectToLogin(res, loginPath, pathname);
+		return next();
+	}
+	function serveLoginForm(req, res) {
+		const redirect = sanitizeRedirectTarget(getQueryParam(req, "redirect") ?? "/");
+		sendHtml(res, 200, renderViteLoginPage(loginPath, redirect, users));
+	}
+	async function handleLoginSubmit(req, res) {
+		let body;
+		try {
+			body = await readFormBody(req);
+		} catch (err) {
+			if (err instanceof ProblemDetailsError) {
+				await sendProblemDetails(res, err);
+				return;
+			}
+			throw err;
+		}
+		const custom = typeof body["custom-email"] === "string" ? body["custom-email"].trim() : "";
+		const selected = typeof body.email === "string" ? body.email.trim() : "";
+		const email = custom || selected;
+		const redirect = sanitizeRedirectTarget(typeof body.redirect === "string" && body.redirect ? body.redirect : "/");
+		if (!email) {
+			sendHtml(res, 400, renderViteLoginPage(loginPath, redirect, users, "A valid email address is required."));
+			return;
+		}
+		const sub = users.find((u) => u.email === email)?.sub;
+		const token = await signDevJwt(email, {
+			secret: devSecret,
+			lifetime: tokenLifetime,
+			sub
+		});
+		res.setHeader("Set-Cookie", buildCookieHeader(token, isSecure(req)));
+		redirectTo(res, redirect);
+	}
+	function handleLogout(res) {
+		res.setHeader("Set-Cookie", clearCookieHeader());
+		redirectTo(res, "/");
+	}
+	async function handleGetIdentity(req, res) {
+		const token = parseCookie(req.headers.cookie);
+		const verified = token ? await verifyDevJwt(token, devSecret) : null;
+		if (!verified) {
+			sendJson(res, 401, { error: "Authentication required" });
+			return;
+		}
+		const display = users.find((u) => u.email === verified.email)?.name;
+		sendJson(res, 200, buildIdentity(verified.email, verified.sub, display));
+	}
+	/**
+	* Inject the Cloudflare Access headers so the request reaches the Worker authenticated.
+	*
+	* `@cloudflare/vite-plugin` builds the `Request` it dispatches into `workerd` from
+	* `req.rawHeaders` (not the parsed `req.headers` object), so the JWT **must** be pushed onto
+	* `rawHeaders`. We also mirror it onto `req.headers` so other connect middleware observe a
+	* consistent view.
+	*/
+	function injectAccessHeaders(req, token, email) {
+		req.rawHeaders.push(JWT_HEADER, token, EMAIL_HEADER, email);
+		req.headers[JWT_HEADER] = token;
+		req.headers[EMAIL_HEADER] = email;
+	}
+}
+/**
+* Build a Cloudflare-Access-shaped identity object for the `get-identity` endpoint. Mirrors the
+* real response closely enough for client code that reads `email`, `name`, `groups`, etc.
+*
+* @param email - Authenticated user's email.
+* @param sub - Authenticated user's subject identifier.
+* @param name - Optional display name; falls back to `email` when omitted.
+* @returns A Cloudflare-Access-shaped identity object.
+*/
+function buildIdentity(email, sub, name) {
+	return {
+		id: sub,
+		name: name ?? email,
+		email,
+		user_uuid: sub,
+		account_id: "dev-account",
+		iat: Math.floor(Date.now() / 1e3),
+		groups: [],
+		idp: {
+			id: "dev",
+			type: "dev-authentication"
+		},
+		geo: { country: "US" },
+		type: "dev"
+	};
+}
+function getPathname(req) {
+	const raw = req.url ?? "/";
+	const queryIndex = raw.indexOf("?");
+	return queryIndex === -1 ? raw : raw.slice(0, queryIndex);
+}
+function getQueryParam(req, key) {
+	const path = req.url ?? "/";
+	return new URL(path, "http://localhost").searchParams.get(key) ?? void 0;
+}
+/**
+* Restrict a client-supplied `redirect` target (the dev login form's query string / POST body
+* field) to a same-origin, root-relative path — SEC-005
+* (https://github.com/adrianhall/cloudflare-toolkit/issues/50).
+*
+* Only a value starting with a single `/` — not `//` or `/\`, both of which a browser can
+* interpret as protocol-relative / scheme-relative and resolve against an attacker-controlled
+* host — is considered safe. Anything else (an absolute URL, a protocol-relative URL, or any
+* other unexpected value) falls back to `"/"`. Applied at both points a client-supplied
+* `redirect` value is read (the login form's query string and the login submission's POST body)
+* so the sanitized value is what flows into both the login form's hidden field and the actual
+* redirect `Location` header.
+*/
+function sanitizeRedirectTarget(value) {
+	return /^\/(?!\/|\\)/.test(value) ? value : "/";
+}
+function isViteInternal(pathname) {
+	return VITE_INTERNAL_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+}
+/**
+* A request is treated as an HTML navigation when the browser flags it as such
+* (`Sec-Fetch-Mode: navigate`) or it accepts `text/html`.
+*/
+function isNavigation(req) {
+	if (req.method !== "GET" && req.method !== "HEAD") return false;
+	const fetchMode = headerValue(req, "sec-fetch-mode");
+	if (fetchMode) return fetchMode === "navigate";
+	return headerValue(req, "accept")?.includes("text/html") ?? false;
+}
+function isSecure(req) {
+	return headerValue(req, "x-forwarded-proto") === "https";
+}
+function headerValue(req, name) {
+	const value = req.headers[name];
+	if (Array.isArray(value)) return value[0];
+	return value ?? void 0;
+}
+/**
+* Maximum accumulated size, in bytes, accepted for the dev login form's
+* `application/x-www-form-urlencoded` POST body by {@link readFormBody}. The form only ever
+* posts a handful of small fields (`email`, `custom-email`, `redirect`), so 64 KiB is a generous
+* safety cap against an unbounded read — not a real-world limit — see CODE-008.
+*/
+const MAX_FORM_BODY_BYTES = 64 * 1024;
+/**
+* Read and parse an `application/x-www-form-urlencoded` request body, capped at
+* {@link MAX_FORM_BODY_BYTES}. Rejects with a `413 Content Too Large`
+* {@link ProblemDetailsError} (via `contentTooLarge`) once the cap is exceeded, after destroying
+* the underlying stream so no further data is buffered.
+*/
+function readFormBody(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let receivedBytes = 0;
+		req.on("data", (chunk) => {
+			receivedBytes += chunk.length;
+			if (receivedBytes > MAX_FORM_BODY_BYTES) {
+				req.destroy();
+				reject(contentTooLarge({ detail: `The request body exceeded the maximum allowed size of ${MAX_FORM_BODY_BYTES} bytes.` }));
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("error", reject);
+		req.on("end", () => {
+			const raw = Buffer.concat(chunks).toString("utf8");
+			const params = new URLSearchParams(raw);
+			const out = {};
+			for (const [key, value] of params) out[key] = value;
+			resolve(out);
+		});
+	});
+}
+function sendHtml(res, status, html) {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "text/html; charset=utf-8");
+	res.end(html);
+}
+function sendJson(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "application/json; charset=utf-8");
+	res.end(JSON.stringify(body));
+}
+function redirectTo(res, location) {
+	res.statusCode = 302;
+	res.setHeader("Location", location);
+	res.end();
+}
+/**
+* Write a {@link ProblemDetailsError}'s standalone `application/problem+json` {@link Response}
+* (`error.getResponse()`) onto a raw Node `ServerResponse`. This connect middleware has no Hono
+* `Context` to hand the error to, so the Web `Response` it produces is adapted by hand here
+* rather than reusing `problemDetailsErrorHandler` (`@adrianhall/cloudflare-toolkit/hono`).
+*/
+async function sendProblemDetails(res, error) {
+	const response = error.getResponse();
+	res.statusCode = response.status;
+	response.headers.forEach((value, key) => res.setHeader(key, value));
+	res.end(await response.text());
+}
+function redirectToLogin(res, loginPath, pathname) {
+	redirectTo(res, `${loginPath}?redirect=${encodeURIComponent(pathname)}`);
+}
+//#endregion
+export { cloudflareAccessPlugin };
+//# sourceMappingURL=index.js.map

package/dist/vite/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","names":[],"sources":["../../src/lib/vite/login-page.ts","../../src/lib/vite/plugin.ts"],"sourcesContent":["/**\n * @file The HTML template for the Vite dev-server login page rendered by `cloudflareAccessPlugin`\n * (./plugin.ts). A pure HTML-string builder with no dependency on `auth-internal` or any other\n * runtime module.\n */\n\n/** A selectable identity rendered on the dev login form. */\nexport interface DevLoginUser {\n /** Email address used as the JWT `email` claim. */\n email: string;\n /** Optional human-friendly display name. */\n name?: string;\n /**\n * Optional subject claim to pin for this identity.\n *\n * When provided it is used **verbatim** as the JWT `sub` so the identity has a stable,\n * realistic subject across logins. When omitted a random UUID is generated each time the user\n * signs in (matching the shape of a real Cloudflare Access `sub`).\n */\n sub?: string;\n}\n\n/**\n * Render a self-contained HTML page with a dev login form.\n *\n * @param loginPath - The path the form submits to (handled by the plugin).\n * @param redirectTo - The URL the user is returned to after login.\n * @param users - Optional selectable identities. When provided the form shows a radio list plus\n * a \"custom email\" option; when empty it falls back to a single email input.\n * @param error - Optional error message to display.\n * @returns A complete `<!DOCTYPE html>` document as a string.\n */\nexport function renderViteLoginPage(\n loginPath: string,\n redirectTo: string,\n users: DevLoginUser[] = [],\n error?: string\n): string {\n const errorHtml = error ? `<div class=\"error\" role=\"alert\">${escapeHtml(error)}</div>` : \"\";\n\n const hasUsers = users.length > 0;\n const usersHtml = hasUsers ? renderUserChoices(users) : renderEmailInput();\n\n return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n <title>Developer Login</title>\n <style>\n *,*::before,*::after{box-sizing:border-box}\n body{\n margin:0;font-family:system-ui,-apple-system,sans-serif;\n display:flex;align-items:center;justify-content:center;\n min-height:100vh;background:#f4f4f5;color:#18181b;\n }\n .card{\n background:#fff;border-radius:12px;box-shadow:0 1px 3px rgba(0,0,0,.1);\n padding:2.5rem;width:100%;max-width:420px;\n }\n h1{margin:0 0 .25rem;font-size:1.5rem}\n p.subtitle{margin:0 0 1.5rem;color:#52525b;font-size:.875rem}\n fieldset{border:none;margin:0;padding:0}\n legend{font-size:.875rem;font-weight:500;margin-bottom:.5rem;padding:0}\n label{display:block;font-size:.875rem;font-weight:500;margin-bottom:.375rem}\n .user-option{\n display:flex;align-items:center;gap:.625rem;\n padding:.625rem .75rem;border:1px solid #71717a;border-radius:8px;\n margin-bottom:.5rem;cursor:pointer;\n }\n .user-option:focus-within{border-color:#1d4ed8;box-shadow:0 0 0 3px rgba(29,78,216,.4)}\n .user-option input{margin:0}\n .user-option .meta{display:flex;flex-direction:column}\n .user-option .name{font-weight:500}\n .user-option .email{color:#52525b;font-size:.8125rem}\n input[type=\"email\"]{\n width:100%;padding:.625rem .75rem;border:1px solid #71717a;\n border-radius:8px;font-size:1rem;outline:none;\n transition:border-color .15s;\n }\n input[type=\"email\"]:focus{border-color:#1d4ed8;box-shadow:0 0 0 3px rgba(29,78,216,.4)}\n button{\n margin-top:1rem;width:100%;padding:.625rem;border:none;\n border-radius:8px;background:#1d4ed8;color:#fff;\n font-size:1rem;font-weight:500;cursor:pointer;\n transition:background .15s;\n }\n button:hover{background:#1e40af}\n .error{\n background:#fef2f2;color:#991b1b;border:1px solid #fecaca;\n padding:.75rem 1rem;border-radius:8px;margin-bottom:1rem;font-size:.875rem;\n }\n .badge{\n display:inline-block;background:#fef3c7;color:#92400e;\n font-size:.75rem;font-weight:600;padding:.125rem .5rem;\n border-radius:9999px;margin-bottom:1rem;\n }\n </style>\n</head>\n<body>\n <main class=\"card\">\n <span class=\"badge\">LOCAL DEV</span>\n <h1>Developer Login</h1>\n <p class=\"subtitle\">Simulates Cloudflare Access in front of your Vite dev server.</p>\n ${errorHtml}\n <form method=\"POST\" action=\"${escapeHtml(loginPath)}\">\n <input type=\"hidden\" name=\"redirect\" value=\"${escapeHtml(redirectTo)}\" />\n ${usersHtml}\n <button type=\"submit\">Sign in</button>\n </form>\n </main>\n</body>\n</html>`;\n}\n\n// ---------------------------------------------------------------------------\n// Fragments\n// ---------------------------------------------------------------------------\n\n/** Single email input (no pre-configured users). */\nfunction renderEmailInput(): string {\n return `<label for=\"email\">Email address</label>\n <input\n id=\"email\"\n name=\"email\"\n type=\"email\"\n required\n autocomplete=\"email\"\n placeholder=\"you@example.com\"\n autofocus\n />`;\n}\n\n/** Radio list of selectable identities plus a custom-email field. */\nfunction renderUserChoices(users: DevLoginUser[]): string {\n const options = users\n .map((user, index) => {\n const id = `user-${index}`;\n const nameHtml =\n user.name ?\n `<span class=\"name\">${escapeHtml(user.name)}</span>`\n : `<span class=\"name\">${escapeHtml(user.email)}</span>`;\n const emailHtml = user.name ? `<span class=\"email\">${escapeHtml(user.email)}</span>` : \"\";\n const checked = index === 0 ? \" checked\" : \"\";\n return `<label class=\"user-option\" for=\"${id}\">\n <input type=\"radio\" id=\"${id}\" name=\"email\" value=\"${escapeHtml(user.email)}\"${checked} />\n <span class=\"meta\">${nameHtml}${emailHtml}</span>\n </label>`;\n })\n .join(\"\\n \");\n\n return `<fieldset>\n <legend>Choose an identity</legend>\n ${options}\n </fieldset>\n <label for=\"custom-email\">Or enter a custom email address</label>\n <input\n id=\"custom-email\"\n name=\"custom-email\"\n type=\"email\"\n autocomplete=\"email\"\n placeholder=\"you@example.com\"\n />`;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Minimal HTML-entity escaping for untrusted values injected into HTML. */\nfunction escapeHtml(value: string): string {\n return value\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n","/**\n * @file `cloudflareAccessPlugin` — a dev-only Vite plugin that emulates the Cloudflare Access\n * edge in front of `@cloudflare/vite-plugin`. In production, Cloudflare Access sits at the edge\n * and injects the `Cf-Access-Jwt-Assertion` header (and friends) into every request before it\n * reaches the Worker; during `vite dev` there is no Access in the loop. This plugin reproduces\n * that behavior at the Vite connect layer so the Worker can keep only the production\n * `cloudflareAccess` middleware (../hono/cloudflare-access.ts) — no separate dev-authentication\n * middleware, no `run_worker_first`.\n *\n * Built on this toolkit's own `auth-internal` module for the shared JWT/JWKS/policy primitives\n * — the same `matchPolicy`/`signDevJwt`/`verifyDevJwt`/`parseCookie`/`buildCookieHeader`/\n * `clearCookieHeader`/`DEFAULT_DEV_SECRET`/`JWT_HEADER`/`EMAIL_HEADER` that\n * `hono/cloudflare-access.ts` also consumes — so a session created here is accepted there\n * without any duplicated verification logic (proved end-to-end in\n * `test/node/vite/handshake.test.ts`).\n *\n * Also depends on `../errors/generators.js` (`contentTooLarge`) and\n * `../problem-details/error.js` (`ProblemDetailsError`) so an oversized login-form POST body\n * (see `readFormBody`) is rejected with a standard `application/problem+json` response, the same\n * shape every other error in this toolkit produces — CODE-008.\n */\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { Connect, Plugin } from \"vite\";\nimport {\n buildCookieHeader,\n clearCookieHeader,\n DEFAULT_DEV_SECRET,\n EMAIL_HEADER,\n JWT_HEADER,\n parseCookie,\n signDevJwt,\n verifyDevJwt\n} from \"../auth-internal/jwt.js\";\nimport { matchPolicy } from \"../auth-internal/policy.js\";\nimport type { PathPolicy } from \"../auth-internal/types.js\";\nimport { contentTooLarge } from \"../errors/generators.js\";\nimport { ProblemDetailsError } from \"../problem-details/error.js\";\nimport { renderViteLoginPage, type DevLoginUser } from \"./login-page.js\";\n\n// ---------------------------------------------------------------------------\n// Defaults\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_LOGIN_PATH = \"/cdn-cgi/access/login\";\nconst LOGOUT_PATH = \"/cdn-cgi/access/logout\";\nconst GET_IDENTITY_PATH = \"/cdn-cgi/access/get-identity\";\n\n/**\n * Path prefixes that belong to Vite's own internals (or asset requests) and must always pass\n * through untouched.\n */\nconst VITE_INTERNAL_PREFIXES = [\n \"/@vite\",\n \"/@fs\",\n \"/@id\",\n \"/@react-refresh\",\n \"/node_modules/\",\n \"/__vite\",\n \"/src/\"\n];\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Configuration for {@link cloudflareAccessPlugin}. */\nexport interface CloudflareAccessPluginOptions {\n /**\n * Path policies evaluated in order (first match wins).\n *\n * Pass the **same array** you give to `cloudflareAccess` in the Worker\n * (../hono/cloudflare-access.ts) so dev and prod agree on which paths are protected.\n *\n * - `authenticate: false` — public (no gating, no header injection).\n * - `authenticate: true` — protected. Unauthenticated navigations are redirected to the login\n * form; API routes with `redirect: false` receive a 401.\n *\n * When omitted, **all** non-internal paths are treated as protected.\n */\n policies?: PathPolicy[];\n\n /**\n * HMAC secret used to sign the dev JWT.\n *\n * Must match the `devSecret` passed to `cloudflareAccess` in the Worker (if overridden there).\n * Defaults to the same well-known development key.\n */\n devSecret?: string;\n\n /**\n * Selectable identities rendered on the dev login form. When omitted the form shows a single\n * free-text email input.\n */\n users?: DevLoginUser[];\n\n /** Pathname for the login form (default `\"/cdn-cgi/access/login\"`). */\n loginPath?: string;\n\n /** Dev JWT lifetime in seconds (default `86400` / 24 h). */\n tokenLifetime?: number;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\n/**\n * Create the dev-only Cloudflare Access emulation plugin.\n *\n * Register it **before** `@cloudflare/vite-plugin` (and any framework plugin) so its connect\n * middleware runs first:\n *\n * ```ts\n * plugins: [cloudflareAccessPlugin(), cloudflare(), react()]\n * ```\n *\n * The middleware is registered synchronously in the `configureServer` hook body (combined with\n * `enforce: \"pre\"`) so that it sits ahead of the request → `workerd` dispatch handler that\n * `@cloudflare/vite-plugin` registers from its post hook.\n *\n * @param options - Configuration for path policies, the dev secret, selectable login identities,\n * the login form path, and the dev token lifetime.\n * @returns A Vite `Plugin`.\n */\nexport function cloudflareAccessPlugin(options: CloudflareAccessPluginOptions = {}): Plugin {\n return {\n name: \"cloudflare-access-dev\",\n apply: \"serve\",\n enforce: \"pre\",\n configureServer(server) {\n server.middlewares.use(createAccessDevMiddleware(options));\n }\n };\n}\n\n// ---------------------------------------------------------------------------\n// Connect middleware\n// ---------------------------------------------------------------------------\n\n/**\n * Build the connect middleware that emulates Cloudflare Access.\n *\n * Exported separately so it can be unit-tested with mock `req`/`res` objects without booting a\n * real Vite server.\n *\n * @param options - Same options accepted by {@link cloudflareAccessPlugin}.\n * @returns A Vite `Connect.NextHandleFunction`.\n */\nexport function createAccessDevMiddleware(\n options: CloudflareAccessPluginOptions = {}\n): Connect.NextHandleFunction {\n const policies = options.policies;\n const devSecret = options.devSecret ?? DEFAULT_DEV_SECRET;\n const users = options.users ?? [];\n const loginPath = options.loginPath ?? DEFAULT_LOGIN_PATH;\n const tokenLifetime = options.tokenLifetime;\n\n return (req: IncomingMessage, res: ServerResponse, next: Connect.NextFunction): void => {\n void handle(req, res, next).catch((err) => next(err as Error));\n };\n\n async function handle(\n req: IncomingMessage,\n res: ServerResponse,\n next: Connect.NextFunction\n ): Promise<void> {\n const pathname = getPathname(req);\n\n // 1. Vite internals / asset requests → always pass through.\n if (isViteInternal(pathname)) {\n return next();\n }\n\n // 2. Own the Cloudflare Access edge endpoints.\n if (pathname === loginPath) {\n if (req.method === \"POST\") {\n return handleLoginSubmit(req, res);\n }\n return serveLoginForm(req, res);\n }\n if (pathname === LOGOUT_PATH) {\n return handleLogout(res);\n }\n if (pathname === GET_IDENTITY_PATH) {\n return handleGetIdentity(req, res);\n }\n\n // 3. Authenticated session → inject Access headers and hand off.\n const token = parseCookie(req.headers.cookie);\n const verified = token ? await verifyDevJwt(token, devSecret) : null;\n if (token && verified) {\n injectAccessHeaders(req, token, verified.email);\n return next();\n }\n\n // 4. Unauthenticated. Decide based on policy + request type.\n const policyMatch = policies ? matchPolicy(pathname, policies) : undefined;\n\n // Explicitly public → pass through (no gating, no injection).\n if (policyMatch?.authenticate === false) {\n return next();\n }\n\n // API-style protected route (redirect: false) → 401 JSON.\n if (policyMatch?.authenticate === true && policyMatch.redirect === false) {\n return sendJson(res, 401, { error: \"Authentication required\" });\n }\n\n // HTML navigations to protected paths → redirect to the login form.\n if (isNavigation(req)) {\n return redirectToLogin(res, loginPath, pathname);\n }\n\n // Anything else (e.g. an unauthenticated fetch to a protected API that did not opt into\n // `redirect: false`) → let it through; the Worker's own cloudflareAccess() will reject it\n // with a 401.\n return next();\n }\n\n // -------------------------------------------------------------------------\n // Endpoint handlers\n // -------------------------------------------------------------------------\n\n function serveLoginForm(req: IncomingMessage, res: ServerResponse): void {\n const redirect = sanitizeRedirectTarget(getQueryParam(req, \"redirect\") ?? \"/\");\n sendHtml(res, 200, renderViteLoginPage(loginPath, redirect, users));\n }\n\n async function handleLoginSubmit(req: IncomingMessage, res: ServerResponse): Promise<void> {\n let body: Record<string, string>;\n try {\n body = await readFormBody(req);\n } catch (err) {\n if (err instanceof ProblemDetailsError) {\n await sendProblemDetails(res, err);\n return;\n }\n throw err;\n }\n const custom = typeof body[\"custom-email\"] === \"string\" ? body[\"custom-email\"].trim() : \"\";\n const selected = typeof body.email === \"string\" ? body.email.trim() : \"\";\n const email = custom || selected;\n const redirect = sanitizeRedirectTarget(\n typeof body.redirect === \"string\" && body.redirect ? body.redirect : \"/\"\n );\n\n if (!email) {\n sendHtml(\n res,\n 400,\n renderViteLoginPage(loginPath, redirect, users, \"A valid email address is required.\")\n );\n return;\n }\n\n // Pin the subject for a configured identity (stable, realistic sub); free-text / unknown\n // emails fall back to a generated UUID.\n const sub = users.find((u) => u.email === email)?.sub;\n const token = await signDevJwt(email, { secret: devSecret, lifetime: tokenLifetime, sub });\n res.setHeader(\"Set-Cookie\", buildCookieHeader(token, isSecure(req)));\n redirectTo(res, redirect);\n }\n\n function handleLogout(res: ServerResponse): void {\n res.setHeader(\"Set-Cookie\", clearCookieHeader());\n redirectTo(res, \"/\");\n }\n\n async function handleGetIdentity(req: IncomingMessage, res: ServerResponse): Promise<void> {\n const token = parseCookie(req.headers.cookie);\n const verified = token ? await verifyDevJwt(token, devSecret) : null;\n if (!verified) {\n sendJson(res, 401, { error: \"Authentication required\" });\n return;\n }\n const display = users.find((u) => u.email === verified.email)?.name;\n sendJson(res, 200, buildIdentity(verified.email, verified.sub, display));\n }\n\n // -------------------------------------------------------------------------\n // Header injection\n // -------------------------------------------------------------------------\n\n /**\n * Inject the Cloudflare Access headers so the request reaches the Worker authenticated.\n *\n * `@cloudflare/vite-plugin` builds the `Request` it dispatches into `workerd` from\n * `req.rawHeaders` (not the parsed `req.headers` object), so the JWT **must** be pushed onto\n * `rawHeaders`. We also mirror it onto `req.headers` so other connect middleware observe a\n * consistent view.\n */\n function injectAccessHeaders(req: IncomingMessage, token: string, email: string): void {\n req.rawHeaders.push(JWT_HEADER, token, EMAIL_HEADER, email);\n req.headers[JWT_HEADER] = token;\n req.headers[EMAIL_HEADER] = email;\n }\n}\n\n// ---------------------------------------------------------------------------\n// Identity payload\n// ---------------------------------------------------------------------------\n\n/**\n * Build a Cloudflare-Access-shaped identity object for the `get-identity` endpoint. Mirrors the\n * real response closely enough for client code that reads `email`, `name`, `groups`, etc.\n *\n * @param email - Authenticated user's email.\n * @param sub - Authenticated user's subject identifier.\n * @param name - Optional display name; falls back to `email` when omitted.\n * @returns A Cloudflare-Access-shaped identity object.\n */\nfunction buildIdentity(email: string, sub: string, name?: string): Record<string, unknown> {\n return {\n id: sub,\n name: name ?? email,\n email,\n user_uuid: sub,\n account_id: \"dev-account\",\n iat: Math.floor(Date.now() / 1000),\n groups: [],\n idp: { id: \"dev\", type: \"dev-authentication\" },\n geo: { country: \"US\" },\n type: \"dev\"\n };\n}\n\n// ---------------------------------------------------------------------------\n// Request helpers\n// ---------------------------------------------------------------------------\n\nfunction getPathname(req: IncomingMessage): string {\n const raw = req.url ?? \"/\";\n const queryIndex = raw.indexOf(\"?\");\n return queryIndex === -1 ? raw : raw.slice(0, queryIndex);\n}\n\nfunction getQueryParam(req: IncomingMessage, key: string): string | undefined {\n const path = req.url ?? \"/\";\n const url = new URL(path, \"http://localhost\");\n return url.searchParams.get(key) ?? undefined;\n}\n\n/**\n * Restrict a client-supplied `redirect` target (the dev login form's query string / POST body\n * field) to a same-origin, root-relative path — SEC-005\n * (https://github.com/adrianhall/cloudflare-toolkit/issues/50).\n *\n * Only a value starting with a single `/` — not `//` or `/\\`, both of which a browser can\n * interpret as protocol-relative / scheme-relative and resolve against an attacker-controlled\n * host — is considered safe. Anything else (an absolute URL, a protocol-relative URL, or any\n * other unexpected value) falls back to `\"/\"`. Applied at both points a client-supplied\n * `redirect` value is read (the login form's query string and the login submission's POST body)\n * so the sanitized value is what flows into both the login form's hidden field and the actual\n * redirect `Location` header.\n */\nfunction sanitizeRedirectTarget(value: string): string {\n return /^\\/(?!\\/|\\\\)/.test(value) ? value : \"/\";\n}\n\nfunction isViteInternal(pathname: string): boolean {\n return VITE_INTERNAL_PREFIXES.some((prefix) => pathname.startsWith(prefix));\n}\n\n/**\n * A request is treated as an HTML navigation when the browser flags it as such\n * (`Sec-Fetch-Mode: navigate`) or it accepts `text/html`.\n */\nfunction isNavigation(req: IncomingMessage): boolean {\n if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n return false;\n }\n const fetchMode = headerValue(req, \"sec-fetch-mode\");\n if (fetchMode) {\n return fetchMode === \"navigate\";\n }\n const accept = headerValue(req, \"accept\");\n return accept?.includes(\"text/html\") ?? false;\n}\n\nfunction isSecure(req: IncomingMessage): boolean {\n // The Vite dev server runs over plain HTTP on localhost; treat HTTPS forwarding hints as\n // secure so the cookie's Secure flag is correct.\n return headerValue(req, \"x-forwarded-proto\") === \"https\";\n}\n\nfunction headerValue(req: IncomingMessage, name: string): string | undefined {\n const value = req.headers[name];\n if (Array.isArray(value)) {\n return value[0];\n }\n return value ?? undefined;\n}\n\n/**\n * Maximum accumulated size, in bytes, accepted for the dev login form's\n * `application/x-www-form-urlencoded` POST body by {@link readFormBody}. The form only ever\n * posts a handful of small fields (`email`, `custom-email`, `redirect`), so 64 KiB is a generous\n * safety cap against an unbounded read — not a real-world limit — see CODE-008.\n */\nconst MAX_FORM_BODY_BYTES = 64 * 1024;\n\n/**\n * Read and parse an `application/x-www-form-urlencoded` request body, capped at\n * {@link MAX_FORM_BODY_BYTES}. Rejects with a `413 Content Too Large`\n * {@link ProblemDetailsError} (via `contentTooLarge`) once the cap is exceeded, after destroying\n * the underlying stream so no further data is buffered.\n */\nfunction readFormBody(req: IncomingMessage): Promise<Record<string, string>> {\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n let receivedBytes = 0;\n req.on(\"data\", (chunk: Buffer) => {\n receivedBytes += chunk.length;\n if (receivedBytes > MAX_FORM_BODY_BYTES) {\n req.destroy();\n reject(\n contentTooLarge({\n detail: `The request body exceeded the maximum allowed size of ${MAX_FORM_BODY_BYTES} bytes.`\n })\n );\n return;\n }\n chunks.push(chunk);\n });\n req.on(\"error\", reject);\n req.on(\"end\", () => {\n const raw = Buffer.concat(chunks).toString(\"utf8\");\n const params = new URLSearchParams(raw);\n const out: Record<string, string> = {};\n for (const [key, value] of params) {\n out[key] = value;\n }\n resolve(out);\n });\n });\n}\n\n// ---------------------------------------------------------------------------\n// Response helpers\n// ---------------------------------------------------------------------------\n\nfunction sendHtml(res: ServerResponse, status: number, html: string): void {\n res.statusCode = status;\n res.setHeader(\"Content-Type\", \"text/html; charset=utf-8\");\n res.end(html);\n}\n\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n res.statusCode = status;\n res.setHeader(\"Content-Type\", \"application/json; charset=utf-8\");\n res.end(JSON.stringify(body));\n}\n\nfunction redirectTo(res: ServerResponse, location: string): void {\n res.statusCode = 302;\n res.setHeader(\"Location\", location);\n res.end();\n}\n\n/**\n * Write a {@link ProblemDetailsError}'s standalone `application/problem+json` {@link Response}\n * (`error.getResponse()`) onto a raw Node `ServerResponse`. This connect middleware has no Hono\n * `Context` to hand the error to, so the Web `Response` it produces is adapted by hand here\n * rather than reusing `problemDetailsErrorHandler` (`@adrianhall/cloudflare-toolkit/hono`).\n */\nasync function sendProblemDetails(res: ServerResponse, error: ProblemDetailsError): Promise<void> {\n const response = error.getResponse();\n res.statusCode = response.status;\n response.headers.forEach((value, key) => res.setHeader(key, value));\n res.end(await response.text());\n}\n\nfunction redirectToLogin(res: ServerResponse, loginPath: string, pathname: string): void {\n redirectTo(res, `${loginPath}?redirect=${encodeURIComponent(pathname)}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgCA,SAAgB,oBACd,WACA,YACA,QAAwB,CAAC,GACzB,OACQ;CACR,MAAM,YAAY,QAAQ,mCAAmC,WAAW,KAAK,EAAE,UAAU;CAGzF,MAAM,YADW,MAAM,SAAS,IACH,kBAAkB,KAAK,IAAI,iBAAiB;CAEzE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA6DH,UAAU;kCACkB,WAAW,SAAS,EAAE;oDACJ,WAAW,UAAU,EAAE;QACnE,UAAU;;;;;;AAMlB;;AAOA,SAAS,mBAA2B;CAClC,OAAO;;;;;;;;;;AAUT;;AAGA,SAAS,kBAAkB,OAA+B;CAiBxD,OAAO;;QAhBS,MACb,KAAK,MAAM,UAAU;EACpB,MAAM,KAAK,QAAQ;EACnB,MAAM,WACJ,KAAK,OACH,sBAAsB,WAAW,KAAK,IAAI,EAAE,WAC5C,sBAAsB,WAAW,KAAK,KAAK,EAAE;EACjD,MAAM,YAAY,KAAK,OAAO,uBAAuB,WAAW,KAAK,KAAK,EAAE,WAAW;EACvF,MAAM,UAAU,UAAU,IAAI,aAAa;EAC3C,OAAO,mCAAmC,GAAG;kCACjB,GAAG,wBAAwB,WAAW,KAAK,KAAK,EAAE,GAAG,QAAQ;6BAClE,WAAW,UAAU;;CAE9C,CAAC,CAAC,CACD,KAAK,UAII,EAAE;;;;;;;;;;AAUhB;;AAOA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ,CAAC,CACvB,QAAQ,MAAM,OAAO;AAC1B;;;ACtIA,MAAM,qBAAqB;AAC3B,MAAM,cAAc;AACpB,MAAM,oBAAoB;;;;;AAM1B,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;;AAiEA,SAAgB,uBAAuB,UAAyC,CAAC,GAAW;CAC1F,OAAO;EACL,MAAM;EACN,OAAO;EACP,SAAS;EACT,gBAAgB,QAAQ;GACtB,OAAO,YAAY,IAAI,0BAA0B,OAAO,CAAC;EAC3D;CACF;AACF;;;;;;;;;;AAeA,SAAgB,0BACd,UAAyC,CAAC,GACd;CAC5B,MAAM,WAAW,QAAQ;CACzB,MAAM,YAAY,QAAQ,aAAA;CAC1B,MAAM,QAAQ,QAAQ,SAAS,CAAC;CAChC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,gBAAgB,QAAQ;CAE9B,QAAQ,KAAsB,KAAqB,SAAqC;EACtF,OAAY,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,QAAQ,KAAK,GAAY,CAAC;CAC/D;CAEA,eAAe,OACb,KACA,KACA,MACe;EACf,MAAM,WAAW,YAAY,GAAG;EAGhC,IAAI,eAAe,QAAQ,GACzB,OAAO,KAAK;EAId,IAAI,aAAa,WAAW;GAC1B,IAAI,IAAI,WAAW,QACjB,OAAO,kBAAkB,KAAK,GAAG;GAEnC,OAAO,eAAe,KAAK,GAAG;EAChC;EACA,IAAI,aAAa,aACf,OAAO,aAAa,GAAG;EAEzB,IAAI,aAAa,mBACf,OAAO,kBAAkB,KAAK,GAAG;EAInC,MAAM,QAAQ,YAAY,IAAI,QAAQ,MAAM;EAC5C,MAAM,WAAW,QAAQ,MAAM,aAAa,OAAO,SAAS,IAAI;EAChE,IAAI,SAAS,UAAU;GACrB,oBAAoB,KAAK,OAAO,SAAS,KAAK;GAC9C,OAAO,KAAK;EACd;EAGA,MAAM,cAAc,WAAW,YAAY,UAAU,QAAQ,IAAI,KAAA;EAGjE,IAAI,aAAa,iBAAiB,OAChC,OAAO,KAAK;EAId,IAAI,aAAa,iBAAiB,QAAQ,YAAY,aAAa,OACjE,OAAO,SAAS,KAAK,KAAK,EAAE,OAAO,0BAA0B,CAAC;EAIhE,IAAI,aAAa,GAAG,GAClB,OAAO,gBAAgB,KAAK,WAAW,QAAQ;EAMjD,OAAO,KAAK;CACd;CAMA,SAAS,eAAe,KAAsB,KAA2B;EACvE,MAAM,WAAW,uBAAuB,cAAc,KAAK,UAAU,KAAK,GAAG;EAC7E,SAAS,KAAK,KAAK,oBAAoB,WAAW,UAAU,KAAK,CAAC;CACpE;CAEA,eAAe,kBAAkB,KAAsB,KAAoC;EACzF,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,aAAa,GAAG;EAC/B,SAAS,KAAK;GACZ,IAAI,eAAe,qBAAqB;IACtC,MAAM,mBAAmB,KAAK,GAAG;IACjC;GACF;GACA,MAAM;EACR;EACA,MAAM,SAAS,OAAO,KAAK,oBAAoB,WAAW,KAAK,eAAe,CAAC,KAAK,IAAI;EACxF,MAAM,WAAW,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;EACtE,MAAM,QAAQ,UAAU;EACxB,MAAM,WAAW,uBACf,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW,KAAK,WAAW,GACvE;EAEA,IAAI,CAAC,OAAO;GACV,SACE,KACA,KACA,oBAAoB,WAAW,UAAU,OAAO,oCAAoC,CACtF;GACA;EACF;EAIA,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,UAAU,KAAK,CAAC,EAAE;EAClD,MAAM,QAAQ,MAAM,WAAW,OAAO;GAAE,QAAQ;GAAW,UAAU;GAAe;EAAI,CAAC;EACzF,IAAI,UAAU,cAAc,kBAAkB,OAAO,SAAS,GAAG,CAAC,CAAC;EACnE,WAAW,KAAK,QAAQ;CAC1B;CAEA,SAAS,aAAa,KAA2B;EAC/C,IAAI,UAAU,cAAc,kBAAkB,CAAC;EAC/C,WAAW,KAAK,GAAG;CACrB;CAEA,eAAe,kBAAkB,KAAsB,KAAoC;EACzF,MAAM,QAAQ,YAAY,IAAI,QAAQ,MAAM;EAC5C,MAAM,WAAW,QAAQ,MAAM,aAAa,OAAO,SAAS,IAAI;EAChE,IAAI,CAAC,UAAU;GACb,SAAS,KAAK,KAAK,EAAE,OAAO,0BAA0B,CAAC;GACvD;EACF;EACA,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE,UAAU,SAAS,KAAK,CAAC,EAAE;EAC/D,SAAS,KAAK,KAAK,cAAc,SAAS,OAAO,SAAS,KAAK,OAAO,CAAC;CACzE;;;;;;;;;CAcA,SAAS,oBAAoB,KAAsB,OAAe,OAAqB;EACrF,IAAI,WAAW,KAAK,YAAY,OAAO,cAAc,KAAK;EAC1D,IAAI,QAAQ,cAAc;EAC1B,IAAI,QAAQ,gBAAgB;CAC9B;AACF;;;;;;;;;;AAeA,SAAS,cAAc,OAAe,KAAa,MAAwC;CACzF,OAAO;EACL,IAAI;EACJ,MAAM,QAAQ;EACd;EACA,WAAW;EACX,YAAY;EACZ,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACjC,QAAQ,CAAC;EACT,KAAK;GAAE,IAAI;GAAO,MAAM;EAAqB;EAC7C,KAAK,EAAE,SAAS,KAAK;EACrB,MAAM;CACR;AACF;AAMA,SAAS,YAAY,KAA8B;CACjD,MAAM,MAAM,IAAI,OAAO;CACvB,MAAM,aAAa,IAAI,QAAQ,GAAG;CAClC,OAAO,eAAe,KAAK,MAAM,IAAI,MAAM,GAAG,UAAU;AAC1D;AAEA,SAAS,cAAc,KAAsB,KAAiC;CAC5E,MAAM,OAAO,IAAI,OAAO;CAExB,OAAO,IADS,IAAI,MAAM,kBACjB,CAAC,CAAC,aAAa,IAAI,GAAG,KAAK,KAAA;AACtC;;;;;;;;;;;;;;AAeA,SAAS,uBAAuB,OAAuB;CACrD,OAAO,eAAe,KAAK,KAAK,IAAI,QAAQ;AAC9C;AAEA,SAAS,eAAe,UAA2B;CACjD,OAAO,uBAAuB,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAC5E;;;;;AAMA,SAAS,aAAa,KAA+B;CACnD,IAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QACzC,OAAO;CAET,MAAM,YAAY,YAAY,KAAK,gBAAgB;CACnD,IAAI,WACF,OAAO,cAAc;CAGvB,OADe,YAAY,KAAK,QACpB,CAAC,EAAE,SAAS,WAAW,KAAK;AAC1C;AAEA,SAAS,SAAS,KAA+B;CAG/C,OAAO,YAAY,KAAK,mBAAmB,MAAM;AACnD;AAEA,SAAS,YAAY,KAAsB,MAAkC;CAC3E,MAAM,QAAQ,IAAI,QAAQ;CAC1B,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM;CAEf,OAAO,SAAS,KAAA;AAClB;;;;;;;AAQA,MAAM,sBAAsB,KAAK;;;;;;;AAQjC,SAAS,aAAa,KAAuD;CAC3E,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAmB,CAAC;EAC1B,IAAI,gBAAgB;EACpB,IAAI,GAAG,SAAS,UAAkB;GAChC,iBAAiB,MAAM;GACvB,IAAI,gBAAgB,qBAAqB;IACvC,IAAI,QAAQ;IACZ,OACE,gBAAgB,EACd,QAAQ,yDAAyD,oBAAoB,SACvF,CAAC,CACH;IACA;GACF;GACA,OAAO,KAAK,KAAK;EACnB,CAAC;EACD,IAAI,GAAG,SAAS,MAAM;EACtB,IAAI,GAAG,aAAa;GAClB,MAAM,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM;GACjD,MAAM,SAAS,IAAI,gBAAgB,GAAG;GACtC,MAAM,MAA8B,CAAC;GACrC,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,OAAO;GAEb,QAAQ,GAAG;EACb,CAAC;CACH,CAAC;AACH;AAMA,SAAS,SAAS,KAAqB,QAAgB,MAAoB;CACzE,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,0BAA0B;CACxD,IAAI,IAAI,IAAI;AACd;AAEA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;CAC1E,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,iCAAiC;CAC/D,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,SAAS,WAAW,KAAqB,UAAwB;CAC/D,IAAI,aAAa;CACjB,IAAI,UAAU,YAAY,QAAQ;CAClC,IAAI,IAAI;AACV;;;;;;;AAQA,eAAe,mBAAmB,KAAqB,OAA2C;CAChG,MAAM,WAAW,MAAM,YAAY;CACnC,IAAI,aAAa,SAAS;CAC1B,SAAS,QAAQ,SAAS,OAAO,QAAQ,IAAI,UAAU,KAAK,KAAK,CAAC;CAClE,IAAI,IAAI,MAAM,SAAS,KAAK,CAAC;AAC/B;AAEA,SAAS,gBAAgB,KAAqB,WAAmB,UAAwB;CACvF,WAAW,KAAK,GAAG,UAAU,YAAY,mBAAmB,QAAQ,GAAG;AACzE"}

package/package.json ADDED Viewed

@@ -0,0 +1,137 @@
+{
+  "name": "@adrianhall/cloudflare-toolkit",
+  "version": "0.0.1",
+  "description": "A toolkit of utilities and skills for developing Workers on the Cloudflare Dev Platform",
+  "keywords": [
+    "cloudflare",
+    "cloudflare-workers",
+    "workers",
+    "wrangler",
+    "hono",
+    "vite",
+    "typescript",
+    "problem-details",
+    "logging",
+    "cloudflare-access"
+  ],
+  "homepage": "https://adrianhall.github.io/cloudflare-toolkit",
+  "bugs": {
+    "url": "https://github.com/adrianhall/cloudflare-toolkit/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adrianhall/cloudflare-toolkit.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "license": "MIT",
+  "private": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./guards": {
+      "types": "./dist/guards/index.d.ts",
+      "import": "./dist/guards/index.js"
+    },
+    "./errors": {
+      "types": "./dist/errors/index.d.ts",
+      "import": "./dist/errors/index.js"
+    },
+    "./problem-details": {
+      "types": "./dist/problem-details/index.d.ts",
+      "import": "./dist/problem-details/index.js"
+    },
+    "./logging": {
+      "types": "./dist/logging/index.d.ts",
+      "import": "./dist/logging/index.js"
+    },
+    "./hono": {
+      "types": "./dist/hono/index.d.ts",
+      "import": "./dist/hono/index.js"
+    },
+    "./vite": {
+      "types": "./dist/vite/index.d.ts",
+      "import": "./dist/vite/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js"
+    }
+  },
+  "bin": {
+    "generate-wrangler-types": "./dist/cli/generate-wrangler-types/index.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "THIRD-PARTY-NOTICES.md"
+  ],
+  "engines": {
+    "node": ">=24",
+    "npm": ">=11"
+  },
+  "peerDependencies": {
+    "hono": "^4.12.28",
+    "vite": "^8.1.4"
+  },
+  "peerDependenciesMeta": {
+    "vite": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "chalk": "^5.6.2",
+    "commander": "^15.0.0",
+    "cross-spawn": "^7.0.6",
+    "jose": "^6.2.3"
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.18.3",
+    "@cloudflare/workers-types": "5.20260708.1",
+    "@types/cross-spawn": "^6.0.6",
+    "@types/node": "^26.1.1",
+    "@vitest/coverage-istanbul": "^4.1.10",
+    "eslint": "^10.6.0",
+    "eslint-plugin-jsdoc": "^63.0.12",
+    "hono": "^4.12.28",
+    "husky": "^9.1.7",
+    "npm-run-all2": "^9.0.2",
+    "prettier": "^3.9.5",
+    "shx": "^0.4.0",
+    "tsdown": "^0.22.4",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.63.0",
+    "vite": "^8.1.4",
+    "vitest": "^4.1.10",
+    "wrangler": "^4.109.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "check": "run-s check:types check:lint check:format check:pack",
+    "check:format": "prettier --check .",
+    "check:lint": "eslint .",
+    "check:pack": "npm pack --ignore-scripts --dry-run",
+    "check:types": "tsc --noEmit",
+    "docs:build": "npm --prefix docs run build",
+    "docs:clean": "shx rm -rf docs/reference docs/.vitepress/cache docs/.vitepress/dist",
+    "docs:dev": "npm --prefix docs run dev",
+    "prepare": "husky",
+    "pretest": "npm run build",
+    "pretest:coverage": "npm run build",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  },
+  "allowScripts": {
+    "esbuild@0.28.1": true,
+    "fsevents@2.3.3": true,
+    "sharp@0.34.5": true,
+    "workerd@1.20260708.1": true
+  }
+}