@cloudflare/workers-auth 0.3.2 → 0.4.0

package/dist/index.mjs

@@ -1,23 +1,21 @@
 import { __name } from './chunk-O6YSETKJ.mjs';
-import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, UserError, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
+import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, parseTOML, readFileSync, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
 import { spawnSync } from 'node:child_process';
 import { fetch } from 'undici';
 import assert2 from 'node:assert';
 import http from 'node:http';
 import url from 'node:url';
-import { webcrypto, createHash } from 'node:crypto';
+import { webcrypto, createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
 import { TextEncoder } from 'node:util';
+import path4 from 'node:path';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
 
 // src/state.ts
 var hasWarnedAboutDeprecatedV1ApiToken = false;
 function readStoredAuthState(options) {
   const { configOverride, warningLogger, storage } = options;
-  let parsed;
-  try {
-    parsed = configOverride ?? storage.read();
-  } catch {
-    return {};
-  }
+  const parsed = configOverride ?? storage.read() ?? {};
   const { oauth_token, refresh_token, expiration_time, scopes, api_token } = parsed;
   if (oauth_token) {
     return {
@@ -128,6 +126,9 @@ var getAccessClientSecretFromEnv = getEnvironmentVariableFactory({
 var getCfAuthorizationTokenFromEnv = getEnvironmentVariableFactory({
   variableName: "WRANGLER_CF_AUTHORIZATION_TOKEN"
 });
+var getCloudflareAuthUseKeyringFromEnv = getBooleanEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_AUTH_USE_KEYRING"
+});
 
 // src/access.ts
 var headersCache = {};
@@ -1022,12 +1023,7 @@ function isFutureTimestamp(timestamp) {
 }
 __name(isFutureTimestamp, "isFutureTimestamp");
 function getCachedTemporaryPreviewAccount(storage) {
-  let temporaryPreviewAccount;
-  try {
-    temporaryPreviewAccount = storage.read();
-  } catch {
-    return void 0;
-  }
+  const temporaryPreviewAccount = storage.read();
   if (!temporaryPreviewAccount) {
     return void 0;
   }
@@ -1165,7 +1161,11 @@ function createOAuthFlow(ctx) {
     generateAuthUrl: ctx.generateAuthUrl ?? generateAuthUrl,
     generateRandomState: ctx.generateRandomState ?? generateRandomState
   };
-  const storage = ctx.storage;
+  let activeProfile = "default";
+  function getStorage(profile) {
+    return ctx.storageFactory(profile ?? activeProfile);
+  }
+  __name(getStorage, "getStorage");
   const getClientId = /* @__PURE__ */ __name(() => typeof ctx.clientId === "function" ? ctx.clientId() : ctx.clientId, "getClientId");
   const consent = ctx.consent;
   let temporaryAllowed = false;
@@ -1211,7 +1211,7 @@ function createOAuthFlow(ctx) {
       ctx,
       generators
     );
-    storage.write({
+    getStorage(props.profile).write({
       oauth_token: oauth.token?.value ?? "",
       expiration_time: oauth.token?.expiry,
       refresh_token: oauth.refreshToken?.value,
@@ -1223,18 +1223,19 @@ function createOAuthFlow(ctx) {
     return true;
   }
   __name(login, "login");
-  function isRefreshNeeded() {
+  function isRefreshNeeded(profile) {
     if (ctx.hasEnvCredentials()) {
       return false;
     }
     const { accessToken } = readStoredAuthState({
       warningLogger: ctx.logger,
-      storage
+      storage: getStorage(profile)
     });
     return Boolean(accessToken && /* @__PURE__ */ new Date() >= new Date(accessToken.expiry));
   }
   __name(isRefreshNeeded, "isRefreshNeeded");
-  async function refreshToken() {
+  async function refreshToken(profile) {
+    const storage = getStorage(profile);
     try {
       const {
         token: { value: oauth_token, expiry: expiration_time } = {
@@ -1270,7 +1271,7 @@ function createOAuthFlow(ctx) {
     }
     const stored = readStoredAuthState({
       warningLogger: ctx.logger,
-      storage
+      storage: getStorage(props.profile)
     });
     if (!stored.accessToken && !stored.deprecatedApiToken) {
       if (ctx.isNonInteractiveOrCI()) {
@@ -1283,8 +1284,8 @@ function createOAuthFlow(ctx) {
         return { loggedIn: true };
       }
       return { loggedIn: false, reason: "no-credentials-login-failed" };
-    } else if (isRefreshNeeded()) {
-      const didRefresh = await refreshToken();
+    } else if (isRefreshNeeded(props.profile)) {
+      const didRefresh = await refreshToken(props.profile);
       if (didRefresh) {
         return { loggedIn: true };
       }
@@ -1303,7 +1304,7 @@ function createOAuthFlow(ctx) {
     }
   }
   __name(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
-  async function logout() {
+  async function logout(profile) {
     const clearedTemporary = clearTemporaryAccount();
     if (ctx.hasEnvCredentials()) {
       ctx.logger.log(
@@ -1313,7 +1314,7 @@ function createOAuthFlow(ctx) {
     }
     const storedRefreshToken = readStoredAuthState({
       warningLogger: ctx.logger,
-      storage
+      storage: getStorage(profile)
     }).refreshToken;
     if (!storedRefreshToken) {
       ctx.logger.log(
@@ -1330,13 +1331,16 @@ function createOAuthFlow(ctx) {
       }
     });
     await response.text();
-    storage.clear();
+    getStorage(profile).clear();
     ctx.logger.log(`Successfully logged out.`);
     ctx.purgeOnLoginOrLogout?.();
   }
   __name(logout, "logout");
   async function getOAuthTokenFromLocalState() {
-    let stored = readStoredAuthState({ warningLogger: ctx.logger, storage });
+    let stored = readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage()
+    });
     if (!stored.accessToken) {
       return void 0;
     }
@@ -1346,7 +1350,10 @@ function createOAuthFlow(ctx) {
       if (!didRefresh) {
         return void 0;
       }
-      stored = readStoredAuthState({ warningLogger: ctx.logger, storage });
+      stored = readStoredAuthState({
+        warningLogger: ctx.logger,
+        storage: getStorage()
+      });
     }
     return stored.accessToken?.value;
   }
@@ -1356,7 +1363,7 @@ function createOAuthFlow(ctx) {
       return { apiToken: activeTemporaryAccount.account.apiToken };
     }
     return getAPIToken({
-      storage,
+      storage: getStorage(),
       warningLogger: ctx.logger,
       allowGlobalAuthKey: ctx.allowGlobalAuthKey
     });
@@ -1367,7 +1374,7 @@ function createOAuthFlow(ctx) {
       return { apiToken: activeTemporaryAccount.account.apiToken };
     }
     return requireApiToken({
-      storage,
+      storage: getStorage(),
       warningLogger: ctx.logger,
       allowGlobalAuthKey: ctx.allowGlobalAuthKey
     });
@@ -1406,13 +1413,31 @@ function createOAuthFlow(ctx) {
     return ctx.temporary?.storage.clear() ?? false;
   }
   __name(clearTemporaryAccount, "clearTemporaryAccount");
+  function setProfile(profile) {
+    activeProfile = profile;
+  }
+  __name(setProfile, "setProfile");
+  function getActiveProfile() {
+    return activeProfile;
+  }
+  __name(getActiveProfile, "getActiveProfile");
+  function getScopes() {
+    return readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage()
+    }).scopes;
+  }
+  __name(getScopes, "getScopes");
   return {
+    setProfile,
+    getActiveProfile,
     login,
     logout,
     loginOrRefreshIfRequired,
     getOAuthTokenFromLocalState,
     getAPIToken: getAPITokenInternal,
     requireApiToken: requireApiTokenInternal,
+    getScopes,
     setTemporaryAllowed,
     isTemporaryAllowed,
     getActiveTemporaryAccount,
@@ -1420,5 +1445,2222 @@ function createOAuthFlow(ctx) {
   };
 }
 __name(createOAuthFlow, "createOAuthFlow");
+var RESERVED_PROFILE_NAMES = ["default", "staging"];
+function createProfileStore(args) {
+  const bindings = {
+    read() {
+      return args.bindings.read();
+    },
+    write(currentBindings) {
+      args.bindings.write(currentBindings);
+    },
+    activate(profile, dir) {
+      const normalizedDir = path4.resolve(dir);
+      const currentBindings = args.bindings.read();
+      currentBindings[normalizedDir] = profile;
+      args.bindings.write(currentBindings);
+    },
+    deactivate(dir) {
+      const normalizedDir = path4.resolve(dir);
+      const currentBindings = args.bindings.read();
+      const boundProfile = currentBindings[normalizedDir];
+      if (boundProfile === void 0) {
+        const parentBinding = getProfileForDirectoryFromBindings(
+          normalizedDir,
+          currentBindings
+        );
+        if (parentBinding) {
+          throw new UserError(
+            `No profile is directly bound to "${formatDirectoryForUserError(normalizedDir)}". The active profile "${parentBinding.profile}" is bound at "${formatDirectoryForUserError(
+              parentBinding.dir
+            )}". Run \`wrangler auth deactivate\` from that directory instead.`,
+            { telemetryMessage: "auth deactivate wrong directory" }
+          );
+        }
+        throw new UserError(
+          `No profile is bound to "${formatDirectoryForUserError(normalizedDir)}". Nothing to deactivate.`,
+          { telemetryMessage: "auth deactivate no binding" }
+        );
+      }
+      delete currentBindings[normalizedDir];
+      args.bindings.write(currentBindings);
+      const fallbackProfile = getProfileForDirectoryFromBindings(
+        normalizedDir,
+        currentBindings
+      );
+      if (fallbackProfile) {
+        return {
+          removedProfile: boundProfile,
+          newResolution: {
+            profile: fallbackProfile.profile,
+            source: `inherited from ${fallbackProfile.dir}`
+          }
+        };
+      }
+      if (args.configs.exists("default")) {
+        return {
+          removedProfile: boundProfile,
+          newResolution: { profile: "default", source: "default profile" }
+        };
+      }
+      return {
+        removedProfile: boundProfile,
+        newResolution: { profile: void 0, source: "no profile" }
+      };
+    },
+    getProfileForDirectory(startDir) {
+      return getProfileForDirectoryFromBindings(startDir, args.bindings.read())?.profile;
+    },
+    getBindingsForProfile(profile) {
+      return Object.entries(args.bindings.read()).filter(([, p]) => p === profile).map(([dir]) => dir);
+    },
+    removeAllBindingsForProfile(profile) {
+      const currentBindings = args.bindings.read();
+      const removed = [];
+      for (const [dir, p] of Object.entries(currentBindings)) {
+        if (p === profile) {
+          removed.push(dir);
+          delete currentBindings[dir];
+        }
+      }
+      if (removed.length > 0) {
+        args.bindings.write(currentBindings);
+      }
+      return removed;
+    }
+  };
+  return {
+    configs: args.configs,
+    bindings,
+    resolve(resolveArgs) {
+      if (resolveArgs.profile) {
+        if (resolveArgs.profile === "default") {
+          return "default";
+        }
+        validateProfileName(resolveArgs.profile);
+        return resolveArgs.profile;
+      }
+      const dirProfile = bindings.getProfileForDirectory(resolveArgs.cwd);
+      if (dirProfile) {
+        return dirProfile;
+      }
+      return "default";
+    }
+  };
+}
+__name(createProfileStore, "createProfileStore");
+function validateProfileName(name) {
+  if (RESERVED_PROFILE_NAMES.includes(name.toLowerCase())) {
+    throw new UserError(
+      `"${name}" is a reserved profile name. Use \`wrangler login\` and \`wrangler logout\` to manage the default profile, which applies as a global fallback.`,
+      { telemetryMessage: "auth profile reserved name" }
+    );
+  }
+  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+    throw new UserError(
+      `Invalid profile name "${name}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,
+      { telemetryMessage: "auth profile invalid name" }
+    );
+  }
+}
+__name(validateProfileName, "validateProfileName");
+function formatDirectoryForUserError(dir) {
+  return path4.relative(process.cwd(), dir) || ".";
+}
+__name(formatDirectoryForUserError, "formatDirectoryForUserError");
+function getProfileForDirectoryFromBindings(startDir, bindings) {
+  const normalizedDir = path4.resolve(startDir);
+  const sortedEntries = Object.entries(bindings).sort(
+    ([a], [b]) => b.length - a.length
+  );
+  for (const [boundDir, profile] of sortedEntries) {
+    if (normalizedDir === boundDir) {
+      return { profile, dir: boundDir };
+    }
+    if (normalizedDir.startsWith(boundDir) && normalizedDir[boundDir.length] === path4.sep) {
+      return { profile, dir: boundDir };
+    }
+  }
+  return void 0;
+}
+__name(getProfileForDirectoryFromBindings, "getProfileForDirectoryFromBindings");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/error.js
+function getLineColFromPtr(string, ptr) {
+  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
+  return [lines.length, lines.pop().length + 1];
+}
+__name(getLineColFromPtr, "getLineColFromPtr");
+function makeCodeBlock(string, line, column) {
+  let lines = string.split(/\r\n|\n|\r/g);
+  let codeblock = "";
+  let numberLen = (Math.log10(line + 1) | 0) + 1;
+  for (let i = line - 1; i <= line + 1; i++) {
+    let l = lines[i - 1];
+    if (!l)
+      continue;
+    codeblock += i.toString().padEnd(numberLen, " ");
+    codeblock += ":  ";
+    codeblock += l;
+    codeblock += "\n";
+    if (i === line) {
+      codeblock += " ".repeat(numberLen + column + 2);
+      codeblock += "^\n";
+    }
+  }
+  return codeblock;
+}
+__name(makeCodeBlock, "makeCodeBlock");
+var TomlError = class extends Error {
+  static {
+    __name(this, "TomlError");
+  }
+  line;
+  column;
+  codeblock;
+  constructor(message, options) {
+    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+    const codeblock = makeCodeBlock(options.toml, line, column);
+    super(`Invalid TOML document: ${message}
+
+${codeblock}`, options);
+    this.line = line;
+    this.column = column;
+    this.codeblock = codeblock;
+  }
+};
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/util.js
+function isEscaped(str, ptr) {
+  let i = 0;
+  while (str[ptr - ++i] === "\\")
+    ;
+  return --i && i % 2;
+}
+__name(isEscaped, "isEscaped");
+function indexOfNewline(str, start = 0, end = str.length) {
+  let idx = str.indexOf("\n", start);
+  if (str[idx - 1] === "\r")
+    idx--;
+  return idx <= end ? idx : -1;
+}
+__name(indexOfNewline, "indexOfNewline");
+function skipComment(str, ptr) {
+  for (let i = ptr; i < str.length; i++) {
+    let c = str[i];
+    if (c === "\n")
+      return i;
+    if (c === "\r" && str[i + 1] === "\n")
+      return i + 1;
+    if (c < " " && c !== "	" || c === "\x7F") {
+      throw new TomlError("control characters are not allowed in comments", {
+        toml: str,
+        ptr
+      });
+    }
+  }
+  return str.length;
+}
+__name(skipComment, "skipComment");
+function skipVoid(str, ptr, banNewLines, banComments) {
+  let c;
+  while ((c = str[ptr]) === " " || c === "	" || !banNewLines && (c === "\n" || c === "\r" && str[ptr + 1] === "\n"))
+    ptr++;
+  return banComments || c !== "#" ? ptr : skipVoid(str, skipComment(str, ptr), banNewLines);
+}
+__name(skipVoid, "skipVoid");
+function skipUntil(str, ptr, sep, end, banNewLines = false) {
+  if (!end) {
+    ptr = indexOfNewline(str, ptr);
+    return ptr < 0 ? str.length : ptr;
+  }
+  for (let i = ptr; i < str.length; i++) {
+    let c = str[i];
+    if (c === "#") {
+      i = indexOfNewline(str, i);
+    } else if (c === sep) {
+      return i + 1;
+    } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i + 1] === "\n")) {
+      return i;
+    }
+  }
+  throw new TomlError("cannot find end of structure", {
+    toml: str,
+    ptr
+  });
+}
+__name(skipUntil, "skipUntil");
+function getStringEnd(str, seek) {
+  let first = str[seek];
+  let target = first === str[seek + 1] && str[seek + 1] === str[seek + 2] ? str.slice(seek, seek + 3) : first;
+  seek += target.length - 1;
+  do
+    seek = str.indexOf(target, ++seek);
+  while (seek > -1 && first !== "'" && isEscaped(str, seek));
+  if (seek > -1) {
+    seek += target.length;
+    if (target.length > 1) {
+      if (str[seek] === first)
+        seek++;
+      if (str[seek] === first)
+        seek++;
+    }
+  }
+  return seek;
+}
+__name(getStringEnd, "getStringEnd");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/date.js
+var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class _TomlDate extends Date {
+  static {
+    __name(this, "TomlDate");
+  }
+  #hasDate = false;
+  #hasTime = false;
+  #offset = null;
+  constructor(date) {
+    let hasDate = true;
+    let hasTime = true;
+    let offset = "Z";
+    if (typeof date === "string") {
+      let match = date.match(DATE_TIME_RE);
+      if (match) {
+        if (!match[1]) {
+          hasDate = false;
+          date = `0000-01-01T${date}`;
+        }
+        hasTime = !!match[2];
+        hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+        if (match[2] && +match[2] > 23) {
+          date = "";
+        } else {
+          offset = match[3] || null;
+          date = date.toUpperCase();
+          if (!offset && hasTime)
+            date += "Z";
+        }
+      } else {
+        date = "";
+      }
+    }
+    super(date);
+    if (!isNaN(this.getTime())) {
+      this.#hasDate = hasDate;
+      this.#hasTime = hasTime;
+      this.#offset = offset;
+    }
+  }
+  isDateTime() {
+    return this.#hasDate && this.#hasTime;
+  }
+  isLocal() {
+    return !this.#hasDate || !this.#hasTime || !this.#offset;
+  }
+  isDate() {
+    return this.#hasDate && !this.#hasTime;
+  }
+  isTime() {
+    return this.#hasTime && !this.#hasDate;
+  }
+  isValid() {
+    return this.#hasDate || this.#hasTime;
+  }
+  toISOString() {
+    let iso = super.toISOString();
+    if (this.isDate())
+      return iso.slice(0, 10);
+    if (this.isTime())
+      return iso.slice(11, 23);
+    if (this.#offset === null)
+      return iso.slice(0, -1);
+    if (this.#offset === "Z")
+      return iso;
+    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+    offset = this.#offset[0] === "-" ? offset : -offset;
+    let offsetDate = new Date(this.getTime() - offset * 6e4);
+    return offsetDate.toISOString().slice(0, -1) + this.#offset;
+  }
+  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+    let date = new _TomlDate(jsDate);
+    date.#offset = offset;
+    return date;
+  }
+  static wrapAsLocalDateTime(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalDate(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#hasTime = false;
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalTime(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#hasDate = false;
+    date.#offset = null;
+    return date;
+  }
+};
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/primitive.js
+var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
+var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
+var LEADING_ZERO = /^[+-]?0[0-9_]/;
+var ESCAPE_REGEX = /^[0-9a-f]{4,8}$/i;
+var ESC_MAP = {
+  b: "\b",
+  t: "	",
+  n: "\n",
+  f: "\f",
+  r: "\r",
+  '"': '"',
+  "\\": "\\"
+};
+function parseString(str, ptr = 0, endPtr = str.length) {
+  let isLiteral = str[ptr] === "'";
+  let isMultiline = str[ptr++] === str[ptr] && str[ptr] === str[ptr + 1];
+  if (isMultiline) {
+    endPtr -= 2;
+    if (str[ptr += 2] === "\r")
+      ptr++;
+    if (str[ptr] === "\n")
+      ptr++;
+  }
+  let tmp = 0;
+  let isEscape;
+  let parsed = "";
+  let sliceStart = ptr;
+  while (ptr < endPtr - 1) {
+    let c = str[ptr++];
+    if (c === "\n" || c === "\r" && str[ptr] === "\n") {
+      if (!isMultiline) {
+        throw new TomlError("newlines are not allowed in strings", {
+          toml: str,
+          ptr: ptr - 1
+        });
+      }
+    } else if (c < " " && c !== "	" || c === "\x7F") {
+      throw new TomlError("control characters are not allowed in strings", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    }
+    if (isEscape) {
+      isEscape = false;
+      if (c === "u" || c === "U") {
+        let code = str.slice(ptr, ptr += c === "u" ? 4 : 8);
+        if (!ESCAPE_REGEX.test(code)) {
+          throw new TomlError("invalid unicode escape", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+        try {
+          parsed += String.fromCodePoint(parseInt(code, 16));
+        } catch {
+          throw new TomlError("invalid unicode escape", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+      } else if (isMultiline && (c === "\n" || c === " " || c === "	" || c === "\r")) {
+        ptr = skipVoid(str, ptr - 1, true);
+        if (str[ptr] !== "\n" && str[ptr] !== "\r") {
+          throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+        ptr = skipVoid(str, ptr);
+      } else if (c in ESC_MAP) {
+        parsed += ESC_MAP[c];
+      } else {
+        throw new TomlError("unrecognized escape sequence", {
+          toml: str,
+          ptr: tmp
+        });
+      }
+      sliceStart = ptr;
+    } else if (!isLiteral && c === "\\") {
+      tmp = ptr - 1;
+      isEscape = true;
+      parsed += str.slice(sliceStart, tmp);
+    }
+  }
+  return parsed + str.slice(sliceStart, endPtr - 1);
+}
+__name(parseString, "parseString");
+function parseValue(value, toml, ptr, integersAsBigInt) {
+  if (value === "true")
+    return true;
+  if (value === "false")
+    return false;
+  if (value === "-inf")
+    return -Infinity;
+  if (value === "inf" || value === "+inf")
+    return Infinity;
+  if (value === "nan" || value === "+nan" || value === "-nan")
+    return NaN;
+  if (value === "-0")
+    return integersAsBigInt ? 0n : 0;
+  let isInt = INT_REGEX.test(value);
+  if (isInt || FLOAT_REGEX.test(value)) {
+    if (LEADING_ZERO.test(value)) {
+      throw new TomlError("leading zeroes are not allowed", {
+        toml,
+        ptr
+      });
+    }
+    value = value.replace(/_/g, "");
+    let numeric = +value;
+    if (isNaN(numeric)) {
+      throw new TomlError("invalid number", {
+        toml,
+        ptr
+      });
+    }
+    if (isInt) {
+      if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
+        throw new TomlError("integer value cannot be represented losslessly", {
+          toml,
+          ptr
+        });
+      }
+      if (isInt || integersAsBigInt === true)
+        numeric = BigInt(value);
+    }
+    return numeric;
+  }
+  const date = new TomlDate(value);
+  if (!date.isValid()) {
+    throw new TomlError("invalid value", {
+      toml,
+      ptr
+    });
+  }
+  return date;
+}
+__name(parseValue, "parseValue");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/extract.js
+function sliceAndTrimEndOf(str, startPtr, endPtr, allowNewLines) {
+  let value = str.slice(startPtr, endPtr);
+  let commentIdx = value.indexOf("#");
+  if (commentIdx > -1) {
+    skipComment(str, commentIdx);
+    value = value.slice(0, commentIdx);
+  }
+  let trimmed = value.trimEnd();
+  if (!allowNewLines) {
+    let newlineIdx = value.indexOf("\n", trimmed.length);
+    if (newlineIdx > -1) {
+      throw new TomlError("newlines are not allowed in inline tables", {
+        toml: str,
+        ptr: startPtr + newlineIdx
+      });
+    }
+  }
+  return [trimmed, commentIdx];
+}
+__name(sliceAndTrimEndOf, "sliceAndTrimEndOf");
+function extractValue(str, ptr, end, depth, integersAsBigInt) {
+  if (depth === 0) {
+    throw new TomlError("document contains excessively nested structures. aborting.", {
+      toml: str,
+      ptr
+    });
+  }
+  let c = str[ptr];
+  if (c === "[" || c === "{") {
+    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
+    let newPtr = end ? skipUntil(str, endPtr2, ",", end) : endPtr2;
+    if (endPtr2 - newPtr && end === "}") {
+      let nextNewLine = indexOfNewline(str, endPtr2, newPtr);
+      if (nextNewLine > -1) {
+        throw new TomlError("newlines are not allowed in inline tables", {
+          toml: str,
+          ptr: nextNewLine
+        });
+      }
+    }
+    return [value, newPtr];
+  }
+  let endPtr;
+  if (c === '"' || c === "'") {
+    endPtr = getStringEnd(str, ptr);
+    let parsed = parseString(str, ptr, endPtr);
+    if (end) {
+      endPtr = skipVoid(str, endPtr, end !== "]");
+      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== "\n" && str[endPtr] !== "\r") {
+        throw new TomlError("unexpected character encountered", {
+          toml: str,
+          ptr: endPtr
+        });
+      }
+      endPtr += +(str[endPtr] === ",");
+    }
+    return [parsed, endPtr];
+  }
+  endPtr = skipUntil(str, ptr, ",", end);
+  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","), end === "]");
+  if (!slice[0]) {
+    throw new TomlError("incomplete key-value declaration: no value specified", {
+      toml: str,
+      ptr
+    });
+  }
+  if (end && slice[1] > -1) {
+    endPtr = skipVoid(str, ptr + slice[1]);
+    endPtr += +(str[endPtr] === ",");
+  }
+  return [
+    parseValue(slice[0], str, ptr, integersAsBigInt),
+    endPtr
+  ];
+}
+__name(extractValue, "extractValue");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/struct.js
+var KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
+function parseKey(str, ptr, end = "=") {
+  let dot = ptr - 1;
+  let parsed = [];
+  let endPtr = str.indexOf(end, ptr);
+  if (endPtr < 0) {
+    throw new TomlError("incomplete key-value: cannot find end of key", {
+      toml: str,
+      ptr
+    });
+  }
+  do {
+    let c = str[ptr = ++dot];
+    if (c !== " " && c !== "	") {
+      if (c === '"' || c === "'") {
+        if (c === str[ptr + 1] && c === str[ptr + 2]) {
+          throw new TomlError("multiline strings are not allowed in keys", {
+            toml: str,
+            ptr
+          });
+        }
+        let eos = getStringEnd(str, ptr);
+        if (eos < 0) {
+          throw new TomlError("unfinished string encountered", {
+            toml: str,
+            ptr
+          });
+        }
+        dot = str.indexOf(".", eos);
+        let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
+        let newLine = indexOfNewline(strEnd);
+        if (newLine > -1) {
+          throw new TomlError("newlines are not allowed in keys", {
+            toml: str,
+            ptr: ptr + dot + newLine
+          });
+        }
+        if (strEnd.trimStart()) {
+          throw new TomlError("found extra tokens after the string part", {
+            toml: str,
+            ptr: eos
+          });
+        }
+        if (endPtr < eos) {
+          endPtr = str.indexOf(end, eos);
+          if (endPtr < 0) {
+            throw new TomlError("incomplete key-value: cannot find end of key", {
+              toml: str,
+              ptr
+            });
+          }
+        }
+        parsed.push(parseString(str, ptr, eos));
+      } else {
+        dot = str.indexOf(".", ptr);
+        let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
+        if (!KEY_PART_RE.test(part)) {
+          throw new TomlError("only letter, numbers, dashes and underscores are allowed in keys", {
+            toml: str,
+            ptr
+          });
+        }
+        parsed.push(part.trimEnd());
+      }
+    }
+  } while (dot + 1 && dot < endPtr);
+  return [parsed, skipVoid(str, endPtr + 1, true, true)];
+}
+__name(parseKey, "parseKey");
+function parseInlineTable(str, ptr, depth, integersAsBigInt) {
+  let res = {};
+  let seen = /* @__PURE__ */ new Set();
+  let c;
+  let comma = 0;
+  ptr++;
+  while ((c = str[ptr++]) !== "}" && c) {
+    let err = { toml: str, ptr: ptr - 1 };
+    if (c === "\n") {
+      throw new TomlError("newlines are not allowed in inline tables", err);
+    } else if (c === "#") {
+      throw new TomlError("inline tables cannot contain comments", err);
+    } else if (c === ",") {
+      throw new TomlError("expected key-value, found comma", err);
+    } else if (c !== " " && c !== "	") {
+      let k;
+      let t = res;
+      let hasOwn = false;
+      let [key, keyEndPtr] = parseKey(str, ptr - 1);
+      for (let i = 0; i < key.length; i++) {
+        if (i)
+          t = hasOwn ? t[k] : t[k] = {};
+        k = key[i];
+        if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
+          throw new TomlError("trying to redefine an already defined value", {
+            toml: str,
+            ptr
+          });
+        }
+        if (!hasOwn && k === "__proto__") {
+          Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        }
+      }
+      if (hasOwn) {
+        throw new TomlError("trying to redefine an already defined value", {
+          toml: str,
+          ptr
+        });
+      }
+      let [value, valueEndPtr] = extractValue(str, keyEndPtr, "}", depth - 1, integersAsBigInt);
+      seen.add(value);
+      t[k] = value;
+      ptr = valueEndPtr;
+      comma = str[ptr - 1] === "," ? ptr - 1 : 0;
+    }
+  }
+  if (comma) {
+    throw new TomlError("trailing commas are not allowed in inline tables", {
+      toml: str,
+      ptr: comma
+    });
+  }
+  if (!c) {
+    throw new TomlError("unfinished table encountered", {
+      toml: str,
+      ptr
+    });
+  }
+  return [res, ptr];
+}
+__name(parseInlineTable, "parseInlineTable");
+function parseArray(str, ptr, depth, integersAsBigInt) {
+  let res = [];
+  let c;
+  ptr++;
+  while ((c = str[ptr++]) !== "]" && c) {
+    if (c === ",") {
+      throw new TomlError("expected value, found comma", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    } else if (c === "#")
+      ptr = skipComment(str, ptr);
+    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
+      let e = extractValue(str, ptr - 1, "]", depth - 1, integersAsBigInt);
+      res.push(e[0]);
+      ptr = e[1];
+    }
+  }
+  if (!c) {
+    throw new TomlError("unfinished array encountered", {
+      toml: str,
+      ptr
+    });
+  }
+  return [res, ptr];
+}
+__name(parseArray, "parseArray");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/parse.js
+function peekTable(key, table, meta, type) {
+  let t = table;
+  let m = meta;
+  let k;
+  let hasOwn = false;
+  let state;
+  for (let i = 0; i < key.length; i++) {
+    if (i) {
+      t = hasOwn ? t[k] : t[k] = {};
+      m = (state = m[k]).c;
+      if (type === 0 && (state.t === 1 || state.t === 2)) {
+        return null;
+      }
+      if (state.t === 2) {
+        let l = t.length - 1;
+        t = t[l];
+        m = m[l].c;
+      }
+    }
+    k = key[i];
+    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
+      return null;
+    }
+    if (!hasOwn) {
+      if (k === "__proto__") {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
+      }
+      m[k] = {
+        t: i < key.length - 1 && type === 2 ? 3 : type,
+        d: false,
+        i: 0,
+        c: {}
+      };
+    }
+  }
+  state = m[k];
+  if (state.t !== type && !(type === 1 && state.t === 3)) {
+    return null;
+  }
+  if (type === 2) {
+    if (!state.d) {
+      state.d = true;
+      t[k] = [];
+    }
+    t[k].push(t = {});
+    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
+  }
+  if (state.d) {
+    return null;
+  }
+  state.d = true;
+  if (type === 1) {
+    t = hasOwn ? t[k] : t[k] = {};
+  } else if (type === 0 && hasOwn) {
+    return null;
+  }
+  return [k, t, state.c];
+}
+__name(peekTable, "peekTable");
+function parse(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
+  let res = {};
+  let meta = {};
+  let tbl = res;
+  let m = meta;
+  for (let ptr = skipVoid(toml, 0); ptr < toml.length; ) {
+    if (toml[ptr] === "[") {
+      let isTableArray = toml[++ptr] === "[";
+      let k = parseKey(toml, ptr += +isTableArray, "]");
+      if (isTableArray) {
+        if (toml[k[1] - 1] !== "]") {
+          throw new TomlError("expected end of table declaration", {
+            toml,
+            ptr: k[1] - 1
+          });
+        }
+        k[1]++;
+      }
+      let p = peekTable(
+        k[0],
+        res,
+        meta,
+        isTableArray ? 2 : 1
+        /* Type.EXPLICIT */
+      );
+      if (!p) {
+        throw new TomlError("trying to redefine an already defined table or value", {
+          toml,
+          ptr
+        });
+      }
+      m = p[2];
+      tbl = p[1];
+      ptr = k[1];
+    } else {
+      let k = parseKey(toml, ptr);
+      let p = peekTable(
+        k[0],
+        tbl,
+        m,
+        0
+        /* Type.DOTTED */
+      );
+      if (!p) {
+        throw new TomlError("trying to redefine an already defined table or value", {
+          toml,
+          ptr
+        });
+      }
+      let v = extractValue(toml, k[1], void 0, maxDepth, integersAsBigInt);
+      p[1][p[0]] = v[0];
+      ptr = v[1];
+    }
+    ptr = skipVoid(toml, ptr, true);
+    if (toml[ptr] && toml[ptr] !== "\n" && toml[ptr] !== "\r") {
+      throw new TomlError("each key-value declaration must be followed by an end-of-line", {
+        toml,
+        ptr
+      });
+    }
+    ptr = skipVoid(toml, ptr);
+  }
+  return res;
+}
+__name(parse, "parse");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/stringify.js
+var BARE_KEY = /^[a-z0-9-_]+$/i;
+function extendedTypeOf(obj) {
+  let type = typeof obj;
+  if (type === "object") {
+    if (Array.isArray(obj))
+      return "array";
+    if (obj instanceof Date)
+      return "date";
+  }
+  return type;
+}
+__name(extendedTypeOf, "extendedTypeOf");
+function isArrayOfTables(obj) {
+  for (let i = 0; i < obj.length; i++) {
+    if (extendedTypeOf(obj[i]) !== "object")
+      return false;
+  }
+  return obj.length != 0;
+}
+__name(isArrayOfTables, "isArrayOfTables");
+function formatString(s) {
+  return JSON.stringify(s).replace(/\x7f/g, "\\u007f");
+}
+__name(formatString, "formatString");
+function stringifyValue(val, type, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  if (type === "number") {
+    if (isNaN(val))
+      return "nan";
+    if (val === Infinity)
+      return "inf";
+    if (val === -Infinity)
+      return "-inf";
+    if (numberAsFloat && Number.isInteger(val))
+      return val.toFixed(1);
+    return val.toString();
+  }
+  if (type === "bigint" || type === "boolean") {
+    return val.toString();
+  }
+  if (type === "string") {
+    return formatString(val);
+  }
+  if (type === "date") {
+    if (isNaN(val.getTime())) {
+      throw new TypeError("cannot serialize invalid date");
+    }
+    return val.toISOString();
+  }
+  if (type === "object") {
+    return stringifyInlineTable(val, depth, numberAsFloat);
+  }
+  if (type === "array") {
+    return stringifyArray(val, depth, numberAsFloat);
+  }
+}
+__name(stringifyValue, "stringifyValue");
+function stringifyInlineTable(obj, depth, numberAsFloat) {
+  let keys = Object.keys(obj);
+  if (keys.length === 0)
+    return "{}";
+  let res = "{ ";
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (i)
+      res += ", ";
+    res += BARE_KEY.test(k) ? k : formatString(k);
+    res += " = ";
+    res += stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat);
+  }
+  return res + " }";
+}
+__name(stringifyInlineTable, "stringifyInlineTable");
+function stringifyArray(array, depth, numberAsFloat) {
+  if (array.length === 0)
+    return "[]";
+  let res = "[ ";
+  for (let i = 0; i < array.length; i++) {
+    if (i)
+      res += ", ";
+    if (array[i] === null || array[i] === void 0) {
+      throw new TypeError("arrays cannot contain null or undefined values");
+    }
+    res += stringifyValue(array[i], extendedTypeOf(array[i]), depth - 1, numberAsFloat);
+  }
+  return res + " ]";
+}
+__name(stringifyArray, "stringifyArray");
+function stringifyArrayTable(array, key, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let res = "";
+  for (let i = 0; i < array.length; i++) {
+    res += `${res && "\n"}[[${key}]]
+`;
+    res += stringifyTable(0, array[i], key, depth, numberAsFloat);
+  }
+  return res;
+}
+__name(stringifyArrayTable, "stringifyArrayTable");
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let preamble = "";
+  let tables = "";
+  let keys = Object.keys(obj);
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (obj[k] !== null && obj[k] !== void 0) {
+      let type = extendedTypeOf(obj[k]);
+      if (type === "symbol" || type === "function") {
+        throw new TypeError(`cannot serialize values of type '${type}'`);
+      }
+      let key = BARE_KEY.test(k) ? k : formatString(k);
+      if (type === "array" && isArrayOfTables(obj[k])) {
+        tables += (tables && "\n") + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+      } else if (type === "object") {
+        let tblKey = prefix ? `${prefix}.${key}` : key;
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat);
+      } else {
+        preamble += key;
+        preamble += " = ";
+        preamble += stringifyValue(obj[k], type, depth, numberAsFloat);
+        preamble += "\n";
+      }
+    }
+  }
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
+}
+__name(stringifyTable, "stringifyTable");
+function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
+  if (extendedTypeOf(obj) !== "object") {
+    throw new TypeError("stringify can only be called with an object");
+  }
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
+}
+__name(stringify, "stringify");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/index.js
+var dist_default = { parse, stringify, TomlDate, TomlError };
+
+// src/credential-store/file-store.ts
+var USER_AUTH_CONFIG_PATH = "config";
+function resolveAuthProfileBaseName(profile) {
+  if (profile === void 0 || profile === "default") {
+    const environment = getCloudflareApiEnvironmentFromEnv();
+    return environment === "production" ? "default" : environment;
+  }
+  validateProfileName(profile);
+  return profile;
+}
+__name(resolveAuthProfileBaseName, "resolveAuthProfileBaseName");
+function getAuthConfigFilePath(configPath, profile) {
+  return path4.join(
+    configPath,
+    USER_AUTH_CONFIG_PATH,
+    `${resolveAuthProfileBaseName(profile)}.toml`
+  );
+}
+__name(getAuthConfigFilePath, "getAuthConfigFilePath");
+var FileCredentialStore = class {
+  /**
+   * @param configPath consumer-provided global config directory (the CLI
+   * owns where its config lives, so workers-auth never resolves it itself).
+   * @param profile the auth profile (defaults to the active environment's
+   * default profile).
+   */
+  constructor(configPath, profile) {
+    this.configPath = configPath;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "FileCredentialStore");
+  }
+  kind = "file";
+  read() {
+    const filePath = getAuthConfigFilePath(this.configPath, this.profile);
+    if (!existsSync(filePath)) {
+      return void 0;
+    }
+    return parseTOML(readFileSync(filePath));
+  }
+  write(config) {
+    const filePath = getAuthConfigFilePath(this.configPath, this.profile);
+    mkdirSync(path4.dirname(filePath), { recursive: true });
+    writeFileSync(filePath, dist_default.stringify(config), {
+      encoding: "utf-8",
+      mode: 384
+    });
+    chmodSync(filePath, 384);
+  }
+  clear() {
+    const filePath = getAuthConfigFilePath(this.configPath, this.profile);
+    const existed = existsSync(filePath);
+    if (existed) {
+      rmSync(filePath);
+    }
+    return existed;
+  }
+  path() {
+    return getAuthConfigFilePath(this.configPath, this.profile);
+  }
+  describe() {
+    return getAuthConfigFilePath(this.configPath, this.profile);
+  }
+};
+var KEY_LENGTH_BYTES = 32;
+var IV_LENGTH_BYTES = 12;
+var TAG_LENGTH_BYTES = 16;
+var ALGORITHM_LABEL = "AES-256-GCM";
+var CIPHER_NAME = "aes-256-gcm";
+function generateKey() {
+  return new Uint8Array(randomBytes(KEY_LENGTH_BYTES));
+}
+__name(generateKey, "generateKey");
+function encryptString(plaintext, key) {
+  if (key.length !== KEY_LENGTH_BYTES) {
+    throw new Error(
+      `AES-256-GCM requires a ${KEY_LENGTH_BYTES}-byte key (got ${key.length} bytes).`
+    );
+  }
+  const iv = randomBytes(IV_LENGTH_BYTES);
+  const cipher = createCipheriv(CIPHER_NAME, key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf-8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return {
+    v: 1,
+    alg: ALGORITHM_LABEL,
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    ciphertext: ciphertext.toString("base64")
+  };
+}
+__name(encryptString, "encryptString");
+function decryptString(envelope, key) {
+  if (key.length !== KEY_LENGTH_BYTES) {
+    throw new Error(
+      `AES-256-GCM requires a ${KEY_LENGTH_BYTES}-byte key (got ${key.length} bytes).`
+    );
+  }
+  if (envelope.v !== 1) {
+    throw new Error(
+      `Unsupported encrypted envelope version: ${envelope.v}.`
+    );
+  }
+  const iv = Buffer.from(envelope.iv, "base64");
+  const tag = Buffer.from(envelope.tag, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  if (iv.length !== IV_LENGTH_BYTES) {
+    throw new Error(
+      `Expected ${IV_LENGTH_BYTES}-byte IV in envelope (got ${iv.length} bytes).`
+    );
+  }
+  if (tag.length !== TAG_LENGTH_BYTES) {
+    throw new Error(
+      `Expected ${TAG_LENGTH_BYTES}-byte auth tag in envelope (got ${tag.length} bytes).`
+    );
+  }
+  const decipher = createDecipheriv(CIPHER_NAME, key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([
+    decipher.update(ciphertext),
+    // `final()` is where GCM verifies the auth tag and throws on
+    // mismatch. We let that error propagate so callers can decide
+    // whether to treat it as "not logged in" or surface it.
+    decipher.final()
+  ]);
+  return plaintext.toString("utf-8");
+}
+__name(decryptString, "decryptString");
+function parseEncryptedEnvelope(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return void 0;
+  }
+  const candidate = raw;
+  if (candidate.v !== 1 || candidate.alg !== ALGORITHM_LABEL || typeof candidate.iv !== "string" || typeof candidate.tag !== "string" || typeof candidate.ciphertext !== "string") {
+    return void 0;
+  }
+  return candidate;
+}
+__name(parseEncryptedEnvelope, "parseEncryptedEnvelope");
+
+// src/credential-store/encrypted-file-store.ts
+function getEncryptedAuthConfigFilePath(configPath, profile) {
+  return path4.join(
+    configPath,
+    "config",
+    `${resolveAuthProfileBaseName(profile)}.enc`
+  );
+}
+__name(getEncryptedAuthConfigFilePath, "getEncryptedAuthConfigFilePath");
+var EncryptedFileCredentialStore = class {
+  /**
+   * @param configPath consumer-provided global config directory (the CLI
+   * owns where its config lives, so workers-auth never resolves it itself).
+   * @param keyProvider the OS-keyring backend holding the encryption key.
+   * @param onPlaintextMigration optional callback invoked when a plaintext
+   * TOML file is migrated into the encrypted layout on first read.
+   * @param profile the auth profile (defaults to the active environment's
+   * default profile).
+   */
+  constructor(configPath, keyProvider, onPlaintextMigration, profile) {
+    this.configPath = configPath;
+    this.keyProvider = keyProvider;
+    this.onPlaintextMigration = onPlaintextMigration;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "EncryptedFileCredentialStore");
+  }
+  kind = "encrypted-file";
+  read() {
+    const encryptedPath = getEncryptedAuthConfigFilePath(
+      this.configPath,
+      this.profile
+    );
+    if (existsSync(encryptedPath)) {
+      return this.readEncryptedFile(encryptedPath);
+    }
+    const plaintextPath = getAuthConfigFilePath(this.configPath, this.profile);
+    if (existsSync(plaintextPath)) {
+      return this.migrateFromPlaintext(plaintextPath, encryptedPath);
+    }
+    return void 0;
+  }
+  write(config) {
+    const key = this.ensureKey();
+    const plaintext = dist_default.stringify(config);
+    const envelope = encryptString(plaintext, key);
+    const encryptedPath = getEncryptedAuthConfigFilePath(
+      this.configPath,
+      this.profile
+    );
+    mkdirSync(path4.dirname(encryptedPath), { recursive: true });
+    writeFileSync(encryptedPath, JSON.stringify(envelope, null, "	"), {
+      encoding: "utf-8",
+      mode: 384
+    });
+    chmodSync(encryptedPath, 384);
+    const plaintextPath = getAuthConfigFilePath(this.configPath, this.profile);
+    if (existsSync(plaintextPath)) {
+      rmSync(plaintextPath);
+    }
+  }
+  clear() {
+    const encryptedPath = getEncryptedAuthConfigFilePath(
+      this.configPath,
+      this.profile
+    );
+    const plaintextPath = getAuthConfigFilePath(this.configPath, this.profile);
+    let existed = false;
+    if (existsSync(encryptedPath)) {
+      rmSync(encryptedPath);
+      existed = true;
+    }
+    if (existsSync(plaintextPath)) {
+      rmSync(plaintextPath);
+      existed = true;
+    }
+    try {
+      this.keyProvider.deleteKey();
+    } catch {
+    }
+    return existed;
+  }
+  path() {
+    return getEncryptedAuthConfigFilePath(this.configPath, this.profile);
+  }
+  describe() {
+    return `Encrypted file (${getEncryptedAuthConfigFilePath(this.configPath, this.profile)}) with key in ${this.keyProvider.describe()}`;
+  }
+  /* ------------------------------------------------------------------ */
+  /* Internals                                                           */
+  /* ------------------------------------------------------------------ */
+  readEncryptedFile(encryptedPath) {
+    const key = this.keyProvider.getKey();
+    if (key === void 0) {
+      return void 0;
+    }
+    const raw = readFileSync(encryptedPath);
+    let envelope;
+    try {
+      envelope = parseEncryptedEnvelope(JSON.parse(raw));
+    } catch {
+      return void 0;
+    }
+    if (envelope === void 0) {
+      return void 0;
+    }
+    let plaintext;
+    try {
+      plaintext = decryptString(envelope, key);
+    } catch {
+      return void 0;
+    }
+    try {
+      return dist_default.parse(plaintext);
+    } catch {
+      return void 0;
+    }
+  }
+  migrateFromPlaintext(plaintextPath, encryptedPath) {
+    const raw = readFileSync(plaintextPath);
+    let plaintext;
+    try {
+      plaintext = dist_default.parse(raw);
+    } catch {
+      return void 0;
+    }
+    this.write(plaintext);
+    this.onPlaintextMigration?.({
+      plaintextPath,
+      encryptedPath,
+      keyProviderDescription: this.keyProvider.describe()
+    });
+    return plaintext;
+  }
+  /**
+   * Return the existing encryption key, or generate + persist a fresh
+   * one when none exists yet. Called from `write()` so the first
+   * `wrangler login --use-keyring` is fully bootstrapping.
+   */
+  ensureKey() {
+    const existing = this.keyProvider.getKey();
+    if (existing !== void 0) {
+      return existing;
+    }
+    const fresh = generateKey();
+    this.keyProvider.setKey(fresh);
+    return fresh;
+  }
+};
+var PINNED_KEYRING_VERSION = "1.3.0";
+function defaultNpmRunner(args) {
+  return spawnSync("npm", args, {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: process.platform === "win32"
+  });
+}
+__name(defaultNpmRunner, "defaultNpmRunner");
+var npmRunner = defaultNpmRunner;
+var cachedBindingPathByDir = /* @__PURE__ */ new Map();
+function setNpmRunner(fn) {
+  npmRunner = fn ?? defaultNpmRunner;
+  cachedBindingPathByDir.clear();
+}
+__name(setNpmRunner, "setNpmRunner");
+function getKeyringInstallDir(configPath) {
+  return path4.join(configPath, "native", "keyring");
+}
+__name(getKeyringInstallDir, "getKeyringInstallDir");
+function getInstalledBindingPath(installDir) {
+  return path4.join(installDir, "node_modules", "@napi-rs", "keyring");
+}
+__name(getInstalledBindingPath, "getInstalledBindingPath");
+function findKeyringBinding(installDir) {
+  const cached = cachedBindingPathByDir.get(installDir);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const lazy = getInstalledBindingPath(installDir);
+  if (existsSync(path4.join(lazy, "index.js"))) {
+    cachedBindingPathByDir.set(installDir, lazy);
+    return lazy;
+  }
+  try {
+    const r = npmRunner(["root", "-g"]);
+    if (r.status === 0) {
+      const global = path4.join(r.stdout.trim(), "@napi-rs", "keyring");
+      if (existsSync(path4.join(global, "index.js"))) {
+        cachedBindingPathByDir.set(installDir, global);
+        return global;
+      }
+    }
+  } catch {
+  }
+  cachedBindingPathByDir.set(installDir, null);
+  return null;
+}
+__name(findKeyringBinding, "findKeyringBinding");
+function installKeyringBindingSync(installDir) {
+  const dir = installDir;
+  mkdirSync(dir, { recursive: true });
+  const hostPkgJson = path4.join(dir, "package.json");
+  if (!existsSync(hostPkgJson)) {
+    writeFileSync(
+      hostPkgJson,
+      JSON.stringify(
+        { private: true, name: "cloudflare-auth-keyring-host" },
+        null,
+        "	"
+      ),
+      "utf-8"
+    );
+  }
+  let r;
+  try {
+    r = npmRunner([
+      "install",
+      `@napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      "--prefix",
+      dir,
+      "--no-save",
+      "--no-audit",
+      "--no-fund",
+      "--no-package-lock",
+      "--loglevel=error"
+    ]);
+  } catch (e) {
+    throw new UserError(
+      `Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error ? e.message : String(e)}
+
+Install \`npm\` and retry, or install the binding globally:
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      { telemetryMessage: "workers-auth keyring npm spawn failed" }
+    );
+  }
+  if (r.status !== 0) {
+    throw new UserError(
+      `Failed to install \`@napi-rs/keyring\` (npm exited ${r.status}):
+${r.stderr?.trim() ?? "(no stderr)"}
+
+Retry once the underlying issue is fixed, or install the binding globally:
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      { telemetryMessage: "workers-auth keyring npm install failed" }
+    );
+  }
+  cachedBindingPathByDir.delete(installDir);
+}
+__name(installKeyringBindingSync, "installKeyringBindingSync");
+var entryFactoryOverride;
+function setKeyringEntryFactory(factory) {
+  entryFactoryOverride = factory;
+}
+__name(setKeyringEntryFactory, "setKeyringEntryFactory");
+var dynamicRequire = createRequire(__filename);
+function resolveKeyringEntryFactory(installDir) {
+  if (entryFactoryOverride !== void 0) {
+    return entryFactoryOverride;
+  }
+  const bindingPath = findKeyringBinding(installDir);
+  if (bindingPath === null) {
+    throw new Error(
+      "`@napi-rs/keyring` binding not found. Call `installKeyringBindingSync()` first."
+    );
+  }
+  const mod = dynamicRequire(bindingPath);
+  return (service, account) => new mod.Entry(service, account);
+}
+__name(resolveKeyringEntryFactory, "resolveKeyringEntryFactory");
+
+// src/credential-store/key-providers/shared.ts
+function getKeyringAccountName(profile) {
+  return resolveAuthProfileBaseName(profile);
+}
+__name(getKeyringAccountName, "getKeyringAccountName");
+function encodeKeyEnvelope(key) {
+  const envelope = {
+    v: 1,
+    key: Buffer.from(key).toString("base64"),
+    created: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return JSON.stringify(envelope);
+}
+__name(encodeKeyEnvelope, "encodeKeyEnvelope");
+function decodeKeyEnvelope(raw) {
+  if (raw === "") {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.v !== 1 || typeof parsed.key !== "string") {
+    return void 0;
+  }
+  try {
+    const buf = Buffer.from(parsed.key, "base64");
+    if (buf.length !== 32) {
+      return void 0;
+    }
+    return new Uint8Array(buf);
+  } catch {
+    return void 0;
+  }
+}
+__name(decodeKeyEnvelope, "decodeKeyEnvelope");
+
+// src/credential-store/key-providers/linux-secret-tool.ts
+function defaultRunner(args, options = {}) {
+  return spawnSync("secret-tool", args, {
+    encoding: "utf-8",
+    input: options.input
+  });
+}
+__name(defaultRunner, "defaultRunner");
+var runner = defaultRunner;
+var cachedProbeResult = void 0;
+function setLinuxSecretToolRunner(fn) {
+  runner = fn ?? defaultRunner;
+  cachedProbeResult = void 0;
+}
+__name(setLinuxSecretToolRunner, "setLinuxSecretToolRunner");
+function probeSecretTool() {
+  if (cachedProbeResult !== void 0) {
+    return cachedProbeResult;
+  }
+  let result;
+  try {
+    const r = runner(["--version"]);
+    result = r.status === 0;
+  } catch {
+    result = false;
+  }
+  cachedProbeResult = result;
+  return result;
+}
+__name(probeSecretTool, "probeSecretTool");
+var LinuxSecretToolKeyProvider = class {
+  constructor(serviceName, profile) {
+    this.serviceName = serviceName;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "LinuxSecretToolKeyProvider");
+  }
+  getKey() {
+    const r = runner([
+      "lookup",
+      "service",
+      this.serviceName,
+      "account",
+      getKeyringAccountName(this.profile)
+    ]);
+    if (r.status === 1) {
+      return void 0;
+    }
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to read key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+    return decodeKeyEnvelope(r.stdout.trim());
+  }
+  setKey(key) {
+    const r = runner(
+      [
+        "store",
+        "--label=Cloudflare credentials key",
+        "service",
+        this.serviceName,
+        "account",
+        getKeyringAccountName(this.profile)
+      ],
+      { input: encodeKeyEnvelope(key) }
+    );
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to write key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+  }
+  deleteKey() {
+    const r = runner([
+      "clear",
+      "service",
+      this.serviceName,
+      "account",
+      getKeyringAccountName(this.profile)
+    ]);
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to delete key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+  }
+  describe() {
+    return `Linux secret-tool (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
+  }
+};
+var SECURITY_EXIT_ITEM_NOT_FOUND = 44;
+function defaultRunner2(args, options = {}) {
+  return spawnSync("/usr/bin/security", args, {
+    encoding: "utf-8",
+    input: options.input
+  });
+}
+__name(defaultRunner2, "defaultRunner");
+var runner2 = defaultRunner2;
+function setMacSecurityCommandRunner(fn) {
+  runner2 = fn ?? defaultRunner2;
+}
+__name(setMacSecurityCommandRunner, "setMacSecurityCommandRunner");
+var MacSecurityKeyProvider = class {
+  constructor(serviceName, profile) {
+    this.serviceName = serviceName;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "MacSecurityKeyProvider");
+  }
+  getKey() {
+    const r = runner2([
+      "find-generic-password",
+      "-s",
+      this.serviceName,
+      "-a",
+      getKeyringAccountName(this.profile),
+      "-w"
+    ]);
+    if (r.status === SECURITY_EXIT_ITEM_NOT_FOUND) {
+      return void 0;
+    }
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to read key from macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+    return decodeKeyEnvelope(r.stdout.trim());
+  }
+  setKey(key) {
+    const r = runner2([
+      "add-generic-password",
+      "-s",
+      this.serviceName,
+      "-a",
+      getKeyringAccountName(this.profile),
+      "-w",
+      encodeKeyEnvelope(key),
+      "-U"
+    ]);
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to write key to macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+  }
+  deleteKey() {
+    const r = runner2([
+      "delete-generic-password",
+      "-s",
+      this.serviceName,
+      "-a",
+      getKeyringAccountName(this.profile)
+    ]);
+    if (r.status === 0 || r.status === SECURITY_EXIT_ITEM_NOT_FOUND) {
+      return;
+    }
+    throw new Error(
+      `Failed to delete key from macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+    );
+  }
+  describe() {
+    return `macOS Keychain (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
+  }
+};
+
+// src/credential-store/key-providers/napi-keyring.ts
+var NapiKeyringKeyProvider = class {
+  /**
+   * @param serviceName keyring service identifier (e.g. `"wrangler"`).
+   * @param installDir directory hosting the lazy-installed `@napi-rs/keyring`
+   * binding, derived from the consumer's config path.
+   * @param profile the auth profile (selects the keyring account name).
+   */
+  constructor(serviceName, installDir, profile) {
+    this.serviceName = serviceName;
+    this.installDir = installDir;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "NapiKeyringKeyProvider");
+  }
+  // Resolve the entry factory (and account name) lazily on every call
+  // rather than caching them on construction: on Windows the native
+  // binding is installed *after* this provider is constructed (the
+  // resolver builds the provider, then runs the install), and tests
+  // swap the factory between operations via `setKeyringEntryFactory`.
+  // Caching on the instance would pin a stale/absent factory. The
+  // account-name lookup is a cheap env read, so recomputing is free.
+  entry() {
+    return resolveKeyringEntryFactory(this.installDir)(
+      this.serviceName,
+      getKeyringAccountName(this.profile)
+    );
+  }
+  getKey() {
+    const raw = this.entry().getPassword();
+    if (raw === null || raw === "") {
+      return void 0;
+    }
+    return decodeKeyEnvelope(raw);
+  }
+  setKey(key) {
+    this.entry().setPassword(encodeKeyEnvelope(key));
+  }
+  deleteKey() {
+    try {
+      this.entry().deletePassword();
+    } catch {
+    }
+  }
+  describe() {
+    const platformName = process.platform === "win32" ? "Windows Credential Manager" : "OS keyring";
+    return `${platformName} via @napi-rs/keyring (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
+  }
+};
+
+// src/credential-store/key-providers/factory.ts
+var testProviderFactory;
+function setKeyProviderFactoryForTesting(factory) {
+  testProviderFactory = factory;
+}
+__name(setKeyProviderFactoryForTesting, "setKeyProviderFactoryForTesting");
+function resolveKeyProvider(serviceName, profile, configPath) {
+  if (testProviderFactory !== void 0) {
+    return {
+      kind: "available",
+      provider: testProviderFactory(serviceName, profile)
+    };
+  }
+  switch (process.platform) {
+    case "darwin":
+      return {
+        kind: "available",
+        provider: new MacSecurityKeyProvider(serviceName, profile)
+      };
+    case "linux":
+      if (probeSecretTool()) {
+        return {
+          kind: "available",
+          provider: new LinuxSecretToolKeyProvider(serviceName, profile)
+        };
+      }
+      return { kind: "unsupported" };
+    case "win32": {
+      const installDir = getKeyringInstallDir(configPath);
+      if (findKeyringBinding(installDir) !== null) {
+        return {
+          kind: "available",
+          provider: new NapiKeyringKeyProvider(
+            serviceName,
+            installDir,
+            profile
+          )
+        };
+      }
+      return {
+        kind: "needs-install",
+        install: /* @__PURE__ */ __name(() => installKeyringBindingSync(installDir), "install"),
+        afterInstall: /* @__PURE__ */ __name(() => new NapiKeyringKeyProvider(serviceName, installDir, profile), "afterInstall")
+      };
+    }
+    default:
+      return { kind: "unsupported" };
+  }
+}
+__name(resolveKeyProvider, "resolveKeyProvider");
+
+// src/credential-store/state.ts
+var sessionFlags = {
+  installFailedThisSession: false,
+  hasWarnedAboutKeyringFallback: false,
+  hasWarnedAboutSecretToolMissing: false
+};
+function getResolverSessionFlags() {
+  return sessionFlags;
+}
+__name(getResolverSessionFlags, "getResolverSessionFlags");
+function resetCredentialStorageState() {
+  sessionFlags.installFailedThisSession = false;
+  sessionFlags.hasWarnedAboutKeyringFallback = false;
+  sessionFlags.hasWarnedAboutSecretToolMissing = false;
+}
+__name(resetCredentialStorageState, "resetCredentialStorageState");
+var clearCredentialStorageState = resetCredentialStorageState;
+
+// src/credential-store/resolver.ts
+function createCredentialStorageContext(context) {
+  const config = {
+    ...context,
+    cliName: context.cliName ?? "your CLI"
+  };
+  function getActiveStore(profile) {
+    return resolveActiveCredentialStore(config, profile);
+  }
+  __name(getActiveStore, "getActiveStore");
+  function storageFactory(profile) {
+    return {
+      read: /* @__PURE__ */ __name(() => getActiveStore(profile).read(), "read"),
+      write: /* @__PURE__ */ __name((value) => getActiveStore(profile).write(value), "write"),
+      clear: /* @__PURE__ */ __name(() => getActiveStore(profile).clear(), "clear"),
+      path: /* @__PURE__ */ __name(() => getActiveStore(profile).path(), "path")
+    };
+  }
+  __name(storageFactory, "storageFactory");
+  return { storageFactory, getActiveStore };
+}
+__name(createCredentialStorageContext, "createCredentialStorageContext");
+function resolveActiveCredentialStore(config, profile) {
+  const envOverride = getCloudflareAuthUseKeyringFromEnv();
+  const configPath = config.getConfigPath();
+  if (envOverride === false) {
+    return new FileCredentialStore(configPath, profile);
+  }
+  const forcedByEnvVar = envOverride === true;
+  const wantsKeyring = envOverride ?? config.isKeyringEnabled() ?? false;
+  if (!wantsKeyring) {
+    return new FileCredentialStore(configPath, profile);
+  }
+  const resolution = resolveKeyProvider(
+    config.serviceName,
+    profile,
+    configPath
+  );
+  switch (resolution.kind) {
+    case "available":
+      return new EncryptedFileCredentialStore(
+        configPath,
+        resolution.provider,
+        buildMigrationLogger(config),
+        profile
+      );
+    case "needs-install":
+      return handleNeedsInstall(resolution, forcedByEnvVar, config, profile);
+    case "unsupported":
+      return handleUnsupported(forcedByEnvVar, config, profile);
+  }
+}
+__name(resolveActiveCredentialStore, "resolveActiveCredentialStore");
+function buildMigrationLogger(config) {
+  return (result) => {
+    config.logger.warn(
+      `Migrated credentials from ${result.plaintextPath} into ${result.encryptedPath} (key in ${result.keyProviderDescription}). The plaintext file has been deleted.`
+    );
+  };
+}
+__name(buildMigrationLogger, "buildMigrationLogger");
+function handleNeedsInstall(resolution, forcedByEnvVar, config, profile) {
+  const flags = getResolverSessionFlags();
+  if (flags.installFailedThisSession) {
+    if (forcedByEnvVar) {
+      throw new UserError(
+        `CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,
+        { telemetryMessage: "workers-auth keyring install previously failed" }
+      );
+    }
+    return fallbackToFileWithWarning(
+      `The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,
+      config,
+      profile
+    );
+  }
+  if (config.isNonInteractiveOrCI()) {
+    throw new UserError(windowsBindingMissingMessage(config.cliName), {
+      telemetryMessage: "workers-auth keyring binding not installed"
+    });
+  }
+  try {
+    config.logger.log(`\u{1F510} Installing keyring backend (one-time, ~2 MB)\u2026`);
+    resolution.install();
+  } catch (e) {
+    flags.installFailedThisSession = true;
+    if (forcedByEnvVar) {
+      throw e instanceof UserError ? e : new UserError(
+        `Failed to install the keyring backend: ${e instanceof Error ? e.message : String(e)}`,
+        { telemetryMessage: "workers-auth keyring install threw" }
+      );
+    }
+    return fallbackToFileWithWarning(
+      `Failed to install the keyring backend (${e instanceof Error ? e.message : String(e)}); falling back to the plaintext credentials file.`,
+      config,
+      profile
+    );
+  }
+  return new EncryptedFileCredentialStore(
+    config.getConfigPath(),
+    resolution.afterInstall(),
+    buildMigrationLogger(config),
+    profile
+  );
+}
+__name(handleNeedsInstall, "handleNeedsInstall");
+function handleUnsupported(forcedByEnvVar, config, profile) {
+  const platform = process.platform;
+  const linuxMissingTool = platform === "linux";
+  const message = linuxMissingTool ? secretToolMissingMessage(config.cliName) : `OS keyring storage is not supported on \`${platform}\`; falling back to the plaintext credentials file.`;
+  if (forcedByEnvVar) {
+    throw new UserError(
+      linuxMissingTool ? `CLOUDFLARE_AUTH_USE_KEYRING is set but ${message}` : `CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${platform}\`.`,
+      {
+        telemetryMessage: linuxMissingTool ? "workers-auth keyring secret tool missing" : "workers-auth keyring unsupported platform"
+      }
+    );
+  }
+  if (linuxMissingTool && config.isNonInteractiveOrCI()) {
+    throw new UserError(message, {
+      telemetryMessage: "workers-auth keyring secret tool missing"
+    });
+  }
+  const flags = getResolverSessionFlags();
+  if (linuxMissingTool) {
+    if (!flags.hasWarnedAboutSecretToolMissing) {
+      flags.hasWarnedAboutSecretToolMissing = true;
+      config.logger.warn(
+        `${message}
+
+Falling back to the plaintext credentials file for this session.`
+      );
+    }
+    return new FileCredentialStore(config.getConfigPath(), profile);
+  }
+  return fallbackToFileWithWarning(message, config, profile);
+}
+__name(handleUnsupported, "handleUnsupported");
+function fallbackToFileWithWarning(message, config, profile) {
+  const flags = getResolverSessionFlags();
+  if (!flags.hasWarnedAboutKeyringFallback) {
+    flags.hasWarnedAboutKeyringFallback = true;
+    config.logger.warn(message);
+  }
+  return new FileCredentialStore(config.getConfigPath(), profile);
+}
+__name(fallbackToFileWithWarning, "fallbackToFileWithWarning");
+function secretToolMissingMessage(cliName) {
+  return `\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
+
+Install it via your package manager:
+  Debian/Ubuntu:  sudo apt-get install libsecret-tools
+  Fedora/RHEL:    sudo dnf install libsecret
+  Arch:           sudo pacman -S libsecret
+  Alpine:         apk add libsecret
+
+Or disable keyring storage: \`${cliName} login --no-use-keyring\`.`;
+}
+__name(secretToolMissingMessage, "secretToolMissingMessage");
+function windowsBindingMissingMessage(cliName) {
+  return `\`@napi-rs/keyring\` is required for OS keyring storage on Windows but is not installed.
+
+Run \`${cliName} login --use-keyring\` interactively to install it automatically, or install it globally for CI:
+
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}
+
+Or disable keyring storage: \`${cliName} login --no-use-keyring\`.`;
+}
+__name(windowsBindingMissingMessage, "windowsBindingMissingMessage");
+function scrubEncryptedCredentials(options) {
+  const encryptedPath = getEncryptedAuthConfigFilePath(
+    options.configPath,
+    options.profile
+  );
+  const encryptedFileExisted = existsSync(encryptedPath);
+  const resolution = resolveKeyProvider(
+    options.serviceName,
+    options.profile,
+    options.configPath
+  );
+  if (resolution.kind === "available") {
+    new EncryptedFileCredentialStore(
+      options.configPath,
+      resolution.provider,
+      void 0,
+      options.profile
+    ).clear();
+    return { backendAvailable: true, encryptedFileExisted };
+  }
+  if (encryptedFileExisted) {
+    rmSync(encryptedPath);
+  }
+  return { backendAvailable: false, encryptedFileExisted };
+}
+__name(scrubEncryptedCredentials, "scrubEncryptedCredentials");
+/*! Bundled license information:
+
+smol-toml/dist/error.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/util.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/date.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/primitive.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/extract.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/struct.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/parse.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/stringify.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/index.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+*/
 
-export { PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, createOAuthFlow, domainUsesAccess, generateAuthUrl, generateRandomState, getAccessHeaders, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, readStoredAuthState };
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName };