@cloudflare/workers-auth 0.4.1 → 0.5.0

package/dist/chunk-FX4KV7FS.mjs

@@ -0,0 +1,3702 @@
+import { __name } from './chunk-O6YSETKJ.mjs';
+import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
+import { spawnSync } from 'node:child_process';
+import { fetch } from 'undici';
+import { webcrypto, createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
+import { TextEncoder } from 'node:util';
+import assert2 from 'node:assert';
+import http from 'node:http';
+import url from 'node:url';
+import path4 from 'node:path';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+// src/state.ts
+var hasWarnedAboutDeprecatedV1ApiToken = false;
+function readStoredAuthState(options) {
+  const { configOverride, warningLogger, storage } = options;
+  const parsed = configOverride ?? storage.read() ?? {};
+  const { oauth_token, refresh_token, expiration_time, scopes, api_token } = parsed;
+  if (oauth_token) {
+    return {
+      accessToken: {
+        value: oauth_token,
+        // If there is no `expiration_time` field then set it to an old date, to cause it to expire immediately.
+        expiry: expiration_time ?? "2000-01-01:00:00:00+00:00"
+      },
+      refreshToken: { value: refresh_token ?? "" },
+      scopes
+    };
+  }
+  if (api_token) {
+    if (!hasWarnedAboutDeprecatedV1ApiToken && warningLogger) {
+      hasWarnedAboutDeprecatedV1ApiToken = true;
+      warningLogger.warn(
+        `It looks like you have used Wrangler v1's \`config\` command to login with an API token
+from ${configOverride === void 0 ? storage.path() : "in-memory config"}.
+This is no longer supported in the current version of Wrangler.
+If you wish to authenticate via an API token then please set the \`CLOUDFLARE_API_TOKEN\` environment variable.`
+      );
+    }
+    return { deprecatedApiToken: api_token };
+  }
+  return {};
+}
+__name(readStoredAuthState, "readStoredAuthState");
+var getCloudflareAPITokenFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_API_TOKEN",
+  deprecatedName: "CF_API_TOKEN"
+});
+var getCloudflareGlobalAuthKeyFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_API_KEY",
+  deprecatedName: "CF_API_KEY"
+});
+var getCloudflareGlobalAuthEmailFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_EMAIL",
+  deprecatedName: "CF_EMAIL"
+});
+function getAuthFromEnv(options) {
+  const allowGlobalAuthKey = options?.allowGlobalAuthKey ?? true;
+  if (allowGlobalAuthKey) {
+    const globalApiKey = getCloudflareGlobalAuthKeyFromEnv();
+    const globalApiEmail = getCloudflareGlobalAuthEmailFromEnv();
+    if (globalApiKey && globalApiEmail) {
+      return { authKey: globalApiKey, authEmail: globalApiEmail };
+    }
+  }
+  const apiToken = getCloudflareAPITokenFromEnv();
+  if (apiToken) {
+    return { apiToken };
+  }
+  return void 0;
+}
+__name(getAuthFromEnv, "getAuthFromEnv");
+function getAPIToken(options) {
+  const envAuth = getAuthFromEnv(options);
+  if (envAuth) {
+    return envAuth;
+  }
+  const stored = readStoredAuthState({
+    storage: options.storage,
+    warningLogger: options.warningLogger
+  });
+  if (stored.deprecatedApiToken) {
+    return { apiToken: stored.deprecatedApiToken };
+  }
+  if (stored.accessToken?.value) {
+    return { apiToken: stored.accessToken.value };
+  }
+  return void 0;
+}
+__name(getAPIToken, "getAPIToken");
+function requireApiToken(options) {
+  const credentials = getAPIToken(options);
+  if (!credentials) {
+    throw new UserError("No API token found.", {
+      telemetryMessage: "user auth missing api token"
+    });
+  }
+  return credentials;
+}
+__name(requireApiToken, "requireApiToken");
+var getAuthDomainFromEnv = getEnvironmentVariableFactory({
+  variableName: "WRANGLER_AUTH_DOMAIN",
+  defaultValue: /* @__PURE__ */ __name(() => getCloudflareApiEnvironmentFromEnv() === "staging" ? "dash.staging.cloudflare.com" : "dash.cloudflare.com", "defaultValue")
+});
+var getAuthUrlFromEnv = getEnvironmentVariableFactory({
+  variableName: "WRANGLER_AUTH_URL",
+  defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/auth`, "defaultValue")
+});
+var getTokenUrlFromEnv = getEnvironmentVariableFactory({
+  variableName: "WRANGLER_TOKEN_URL",
+  defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/token`, "defaultValue")
+});
+var getRevokeUrlFromEnv = getEnvironmentVariableFactory({
+  variableName: "WRANGLER_REVOKE_URL",
+  defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/revoke`, "defaultValue")
+});
+var getCloudflareAccountIdFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_ACCOUNT_ID",
+  deprecatedName: "CF_ACCOUNT_ID"
+});
+var getAccessClientIdFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_ACCESS_CLIENT_ID"
+});
+var getAccessClientSecretFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_ACCESS_CLIENT_SECRET"
+});
+var getCfAuthorizationTokenFromEnv = getEnvironmentVariableFactory({
+  variableName: "WRANGLER_CF_AUTHORIZATION_TOKEN"
+});
+var getCloudflareAuthUseKeyringFromEnv = getBooleanEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_AUTH_USE_KEYRING"
+});
+var headersCache = {};
+var usesAccessCache = /* @__PURE__ */ new Map();
+function clearAccessCaches() {
+  for (const key of Object.keys(headersCache)) {
+    delete headersCache[key];
+  }
+  usesAccessCache.clear();
+}
+__name(clearAccessCaches, "clearAccessCaches");
+async function domainUsesAccess(domain, logger) {
+  logger.debug("Checking if domain has Access enabled:", domain);
+  if (usesAccessCache.has(domain)) {
+    logger.debug(
+      "Using cached Access switch for:",
+      domain,
+      usesAccessCache.get(domain)
+    );
+    return usesAccessCache.get(domain) ?? false;
+  }
+  logger.debug("Access switch not cached for:", domain);
+  try {
+    const controller = new AbortController();
+    const cancel = setTimeout(() => {
+      controller.abort();
+    }, 1e3);
+    const output = await fetch(`https://${domain}`, {
+      redirect: "manual",
+      signal: controller.signal
+    });
+    clearTimeout(cancel);
+    const usesAccess = !!(output.status === 302 && output.headers.get("location")?.includes("cloudflareaccess.com"));
+    logger.debug("Caching access switch for:", domain);
+    usesAccessCache.set(domain, usesAccess);
+    return usesAccess;
+  } catch {
+    usesAccessCache.set(domain, false);
+    return false;
+  }
+}
+__name(domainUsesAccess, "domainUsesAccess");
+async function getAccessHeaders(domain, options) {
+  const logger = options.logger;
+  const isNonInteractiveOrCI = options.isNonInteractiveOrCI;
+  const clientId = getAccessClientIdFromEnv();
+  const clientSecret = getAccessClientSecretFromEnv();
+  if (clientId && clientSecret) {
+    logger.debug("Using Access Service Token headers for domain:", domain);
+    const headers = {
+      "CF-Access-Client-Id": clientId,
+      "CF-Access-Client-Secret": clientSecret
+    };
+    headersCache[domain] = headers;
+    return headers;
+  }
+  if (clientId !== void 0 || clientSecret !== void 0) {
+    logger.warn(
+      `Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${clientId !== void 0 ? "CLOUDFLARE_ACCESS_CLIENT_ID" : "CLOUDFLARE_ACCESS_CLIENT_SECRET"} was found.`
+    );
+  }
+  if (!await domainUsesAccess(domain, logger)) {
+    return {};
+  }
+  logger.debug("Getting Access headers for domain:", domain);
+  if (headersCache[domain]) {
+    logger.debug("Using cached Access headers for domain:", domain);
+    return headersCache[domain];
+  }
+  if (isNonInteractiveOrCI()) {
+    throw new UserError(
+      `The domain "${domain}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
+Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate with an Access Service Token.
+See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/`,
+      {
+        telemetryMessage: "user access missing service token non interactive"
+      }
+    );
+  }
+  logger.debug("Spawning cloudflared to get Access token for domain:");
+  const output = spawnSync("cloudflared", ["access", "login", domain]);
+  if (output.error) {
+    throw new UserError(
+      "To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",
+      { telemetryMessage: "user access missing cloudflared" }
+    );
+  }
+  const stringOutput = output.stdout.toString();
+  logger.debug("cloudflared output:", stringOutput);
+  const matches = stringOutput.match(/fetched your token:\n\n(.*)/m);
+  if (matches && matches.length >= 2) {
+    const headers = { Cookie: `CF_Authorization=${matches[1]}` };
+    headersCache[domain] = headers;
+    logger.debug("Caching Access headers for domain:", domain);
+    return headers;
+  }
+  throw new Error("Failed to authenticate with Cloudflare Access");
+}
+__name(getAccessHeaders, "getAccessHeaders");
+async function getCloudflareAccessHeaders(options) {
+  const cfAuthToken = getCfAuthorizationTokenFromEnv();
+  if (cfAuthToken !== void 0) {
+    options.logger.debug(
+      "Using WRANGLER_CF_AUTHORIZATION_TOKEN from environment"
+    );
+    return { Cookie: `CF_Authorization=${cfAuthToken}` };
+  }
+  return getAccessHeaders(getAuthDomainFromEnv(), options);
+}
+__name(getCloudflareAccessHeaders, "getCloudflareAccessHeaders");
+var RECOMMENDED_CODE_VERIFIER_LENGTH = 96;
+var RECOMMENDED_STATE_LENGTH = 32;
+var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+function base64urlEncode(value) {
+  let base64 = btoa(value);
+  base64 = base64.replace(/\+/g, "-");
+  base64 = base64.replace(/\//g, "_");
+  base64 = base64.replace(/=/g, "");
+  return base64;
+}
+__name(base64urlEncode, "base64urlEncode");
+async function generatePKCECodes() {
+  const output = new Uint32Array(RECOMMENDED_CODE_VERIFIER_LENGTH);
+  webcrypto.getRandomValues(output);
+  const codeVerifier = base64urlEncode(
+    Array.from(output).map((num) => PKCE_CHARSET[num % PKCE_CHARSET.length]).join("")
+  );
+  const buffer = await webcrypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(codeVerifier)
+  );
+  const hash = new Uint8Array(buffer);
+  let binary = "";
+  const hashLength = hash.byteLength;
+  for (let i = 0; i < hashLength; i++) {
+    binary += String.fromCharCode(hash[i]);
+  }
+  const codeChallenge = base64urlEncode(binary);
+  return { codeChallenge, codeVerifier };
+}
+__name(generatePKCECodes, "generatePKCECodes");
+
+// src/generate-auth-url.ts
+var generateAuthUrl = /* @__PURE__ */ __name(({
+  authUrl,
+  clientId,
+  scopes,
+  stateQueryParam,
+  codeChallenge,
+  redirectUri
+}) => {
+  return authUrl + `?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&scope=${encodeURIComponent([...scopes, "offline_access"].join(" "))}&state=${stateQueryParam}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256`;
+}, "generateAuthUrl");
+function generateRandomState(lengthOfState) {
+  const output = new Uint32Array(lengthOfState);
+  webcrypto.getRandomValues(output);
+  return Array.from(output).map((num) => PKCE_CHARSET[num % PKCE_CHARSET.length]).join("");
+}
+__name(generateRandomState, "generateRandomState");
+var POW_MAX_ITERATIONS = 64e6;
+function solvePow(seed, k, g) {
+  const checkpoints = new Array(k + 1);
+  let h = createHash("sha256").update(seed).digest();
+  checkpoints[0] = h;
+  for (let j = 0; j < k; j++) {
+    for (let i = 0; i < g; i++) {
+      h = createHash("sha256").update(h).digest();
+    }
+    checkpoints[j + 1] = h;
+  }
+  return checkpoints;
+}
+__name(solvePow, "solvePow");
+function encodeCheckpoints(checkpoints) {
+  return Buffer.concat(checkpoints).toString("base64");
+}
+__name(encodeCheckpoints, "encodeCheckpoints");
+function solveChallenge(challenge) {
+  const checkpoints = solvePow(
+    Buffer.from(challenge.seed, "base64url"),
+    challenge.k,
+    challenge.g
+  );
+  return {
+    challengeToken: challenge.challengeToken,
+    solution: { checkpoints: encodeCheckpoints(checkpoints) }
+  };
+}
+__name(solveChallenge, "solveChallenge");
+
+// src/temporary.ts
+var TEMPORARY_TERMS_URLS = {
+  termsOfService: "https://www.cloudflare.com/terms/",
+  privacyPolicy: "https://www.cloudflare.com/privacypolicy/"
+};
+var TEMPORARY_TERMS_PROMPT = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`;
+var TEMPORARY_TERMS_NOTICE = `Continuing means you accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}).`;
+var TEMPORARY_TERMS_ERROR = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) to use --temporary.`;
+function getTemporaryPreviewUrl() {
+  return `${getCloudflareApiBaseUrl(COMPLIANCE_REGION_CONFIG_PUBLIC)}/provisioning/previews`;
+}
+__name(getTemporaryPreviewUrl, "getTemporaryPreviewUrl");
+function getTemporaryPreviewChallengeUrl() {
+  return `${getTemporaryPreviewUrl()}/challenge`;
+}
+__name(getTemporaryPreviewChallengeUrl, "getTemporaryPreviewChallengeUrl");
+function isFutureTimestamp(timestamp) {
+  const parsed = Date.parse(timestamp);
+  return !Number.isNaN(parsed) && parsed > Date.now();
+}
+__name(isFutureTimestamp, "isFutureTimestamp");
+function getCachedTemporaryPreviewAccount(storage) {
+  const temporaryPreviewAccount = storage.read();
+  if (!temporaryPreviewAccount) {
+    return void 0;
+  }
+  if (!temporaryPreviewAccount.account?.id || !temporaryPreviewAccount.account?.apiToken || !temporaryPreviewAccount.account?.name || !temporaryPreviewAccount.claim?.url || !isFutureTimestamp(temporaryPreviewAccount.account?.expiresAt ?? "") || !isFutureTimestamp(temporaryPreviewAccount.claim?.expiresAt ?? "")) {
+    return void 0;
+  }
+  return temporaryPreviewAccount;
+}
+__name(getCachedTemporaryPreviewAccount, "getCachedTemporaryPreviewAccount");
+async function requestPowSolution(logger) {
+  const response = await fetch(getTemporaryPreviewChallengeUrl(), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: "{}"
+  });
+  if (!response.ok) {
+    throw new FatalError(
+      `Failed to request a proof-of-work challenge (${response.status} ${response.statusText}).`,
+      { telemetryMessage: "deploy temporary account challenge failed" }
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new FatalError(
+      `Failed to request a proof-of-work challenge. Received an invalid response (${response.status} ${response.statusText}).`,
+      {
+        telemetryMessage: "deploy temporary account challenge invalid response"
+      }
+    );
+  }
+  const { challengeToken, seed, k, g } = body.result ?? {};
+  if (challengeToken === void 0 || seed === void 0 || k === void 0 || g === void 0) {
+    throw new FatalError(
+      "Failed to request a proof-of-work challenge because the response was missing required fields.",
+      { telemetryMessage: "deploy temporary account challenge incomplete" }
+    );
+  }
+  if (!Number.isInteger(k) || !Number.isInteger(g) || k <= 0 || g <= 0 || k * g > POW_MAX_ITERATIONS || Buffer.from(seed, "base64url").length !== 32) {
+    throw new FatalError(
+      "The proof-of-work challenge is not supported by this version of Wrangler.",
+      {
+        telemetryMessage: "deploy temporary account challenge difficulty unsupported"
+      }
+    );
+  }
+  logger.log("Solving proof-of-work challenge\u2026");
+  return solveChallenge({ challengeToken, seed, k, g });
+}
+__name(requestPowSolution, "requestPowSolution");
+async function createTemporaryPreviewAccount(logger) {
+  const pow = await requestPowSolution(logger);
+  const response = await fetch(getTemporaryPreviewUrl(), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      termsOfService: TEMPORARY_TERMS_URLS.termsOfService,
+      privacyPolicy: TEMPORARY_TERMS_URLS.privacyPolicy,
+      acceptTermsOfService: "yes",
+      challengeToken: pow.challengeToken,
+      solution: pow.solution
+    })
+  });
+  if (!response.ok) {
+    throw new FatalError(
+      `Failed to create a temporary preview account (${response.status} ${response.statusText}).`,
+      { telemetryMessage: "deploy temporary account create failed" }
+    );
+  }
+  let responseBody;
+  try {
+    responseBody = await response.json();
+  } catch {
+    throw new FatalError(
+      `Failed to create a temporary preview account. Received an invalid response (${response.status} ${response.statusText}).`,
+      { telemetryMessage: "deploy temporary account invalid response" }
+    );
+  }
+  const previewAccount = responseBody.result;
+  const accountId = previewAccount?.account?.id;
+  const accountName = previewAccount?.account?.name;
+  const apiToken = previewAccount?.account?.apiToken;
+  const accountExpiresAt = previewAccount?.account?.expiresAt;
+  const claimUrl = previewAccount?.claim?.url;
+  const claimExpiresAt = previewAccount?.claim?.expiresAt;
+  if (accountId === void 0 || accountName === void 0 || apiToken === void 0 || accountExpiresAt === void 0 || claimUrl === void 0 || claimExpiresAt === void 0) {
+    throw new FatalError(
+      "Failed to create a temporary preview account because the response was missing required fields.",
+      { telemetryMessage: "deploy temporary account response incomplete" }
+    );
+  }
+  return {
+    account: {
+      id: accountId,
+      name: accountName,
+      apiToken,
+      expiresAt: accountExpiresAt
+    },
+    claim: {
+      url: claimUrl,
+      expiresAt: claimExpiresAt
+    }
+  };
+}
+__name(createTemporaryPreviewAccount, "createTemporaryPreviewAccount");
+async function getOrCreateTemporaryPreviewAccount(options) {
+  const cachedPreviewAccount = getCachedTemporaryPreviewAccount(
+    options.storage
+  );
+  if (cachedPreviewAccount) {
+    return { account: cachedPreviewAccount, cached: true };
+  }
+  const termsAccepted = await options.prompt(
+    TEMPORARY_TERMS_PROMPT,
+    TEMPORARY_TERMS_NOTICE
+  );
+  if (!termsAccepted) {
+    throw new UserError(TEMPORARY_TERMS_ERROR, {
+      telemetryMessage: "user temporary terms not accepted"
+    });
+  }
+  const temporaryPreviewAccount = await createTemporaryPreviewAccount(
+    options.logger
+  );
+  options.storage.write(temporaryPreviewAccount);
+  return { account: temporaryPreviewAccount, cached: false };
+}
+__name(getOrCreateTemporaryPreviewAccount, "getOrCreateTemporaryPreviewAccount");
+
+// ../../node_modules/.pnpm/ts-dedent@2.2.0/node_modules/ts-dedent/esm/index.js
+function dedent(templ) {
+  var values = [];
+  for (var _i = 1; _i < arguments.length; _i++) {
+    values[_i - 1] = arguments[_i];
+  }
+  var strings = Array.from(typeof templ === "string" ? [templ] : templ);
+  strings[strings.length - 1] = strings[strings.length - 1].replace(/\r?\n([\t ]*)$/, "");
+  var indentLengths = strings.reduce(function(arr, str) {
+    var matches = str.match(/\n([\t ]+|(?!\s).)/g);
+    if (matches) {
+      return arr.concat(matches.map(function(match) {
+        var _a, _b;
+        return (_b = (_a = match.match(/[\t ]/g)) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0;
+      }));
+    }
+    return arr;
+  }, []);
+  if (indentLengths.length) {
+    var pattern_1 = new RegExp("\n[	 ]{" + Math.min.apply(Math, indentLengths) + "}", "g");
+    strings = strings.map(function(str) {
+      return str.replace(pattern_1, "\n");
+    });
+  }
+  strings[0] = strings[0].replace(/^\r?\n/, "");
+  var string = strings[0];
+  values.forEach(function(value, i) {
+    var endentations = string.match(/(?:^|\n)( *)$/);
+    var endentation = endentations ? endentations[1] : "";
+    var indentedValue = value;
+    if (typeof value === "string" && value.includes("\n")) {
+      indentedValue = String(value).split("\n").map(function(str, i2) {
+        return i2 === 0 ? str : "" + endentation + str;
+      }).join("\n");
+    }
+    string += indentedValue + strings[i + 1];
+  });
+  return string;
+}
+__name(dedent, "dedent");
+var esm_default = dedent;
+var ErrorOAuth2 = class extends UserError {
+  static {
+    __name(this, "ErrorOAuth2");
+  }
+  /** The OAuth `error` code returned by the provider (e.g. `invalid_scope`). */
+  code;
+  /** The OAuth `error_description` returned by the provider, if any. */
+  description;
+  /** The OAuth `error_uri` returned by the provider, if any. */
+  uri;
+  toString() {
+    return "ErrorOAuth2";
+  }
+};
+var ErrorUnknown = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorUnknown");
+  }
+  toString() {
+    return "ErrorUnknown";
+  }
+};
+var ErrorNoAuthCode = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorNoAuthCode");
+  }
+  toString() {
+    return "ErrorNoAuthCode";
+  }
+};
+var ErrorInvalidReturnedStateParam = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorInvalidReturnedStateParam");
+  }
+  toString() {
+    return "ErrorInvalidReturnedStateParam";
+  }
+};
+var ErrorInvalidJson = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorInvalidJson");
+  }
+  toString() {
+    return "ErrorInvalidJson";
+  }
+};
+var ErrorInvalidScope = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorInvalidScope");
+  }
+  toString() {
+    return "ErrorInvalidScope";
+  }
+};
+var ErrorInvalidRequest = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorInvalidRequest");
+  }
+  toString() {
+    return "ErrorInvalidRequest";
+  }
+};
+var ErrorInvalidToken = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorInvalidToken");
+  }
+  toString() {
+    return "ErrorInvalidToken";
+  }
+};
+var ErrorAuthenticationGrant = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorAuthenticationGrant");
+  }
+  toString() {
+    return "ErrorAuthenticationGrant";
+  }
+};
+var ErrorUnauthorizedClient = class extends ErrorAuthenticationGrant {
+  static {
+    __name(this, "ErrorUnauthorizedClient");
+  }
+  toString() {
+    return "ErrorUnauthorizedClient";
+  }
+};
+var ErrorAccessDenied = class extends ErrorAuthenticationGrant {
+  static {
+    __name(this, "ErrorAccessDenied");
+  }
+  toString() {
+    return "ErrorAccessDenied";
+  }
+};
+var ErrorUnsupportedResponseType = class extends ErrorAuthenticationGrant {
+  static {
+    __name(this, "ErrorUnsupportedResponseType");
+  }
+  toString() {
+    return "ErrorUnsupportedResponseType";
+  }
+};
+var ErrorServerError = class extends ErrorAuthenticationGrant {
+  static {
+    __name(this, "ErrorServerError");
+  }
+  toString() {
+    return "ErrorServerError";
+  }
+};
+var ErrorTemporarilyUnavailable = class extends ErrorAuthenticationGrant {
+  static {
+    __name(this, "ErrorTemporarilyUnavailable");
+  }
+  toString() {
+    return "ErrorTemporarilyUnavailable";
+  }
+};
+var ErrorAccessTokenResponse = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorAccessTokenResponse");
+  }
+  toString() {
+    return "ErrorAccessTokenResponse";
+  }
+};
+var ErrorInvalidClient = class extends ErrorAccessTokenResponse {
+  static {
+    __name(this, "ErrorInvalidClient");
+  }
+  toString() {
+    return "ErrorInvalidClient";
+  }
+};
+var ErrorInvalidGrant = class extends ErrorAccessTokenResponse {
+  static {
+    __name(this, "ErrorInvalidGrant");
+  }
+  toString() {
+    return "ErrorInvalidGrant";
+  }
+};
+var ErrorUnsupportedGrantType = class extends ErrorAccessTokenResponse {
+  static {
+    __name(this, "ErrorUnsupportedGrantType");
+  }
+  toString() {
+    return "ErrorUnsupportedGrantType";
+  }
+};
+function formatOAuthErrorMessage(code, description, uri) {
+  let message = `OAuth error: ${code}`;
+  if (description) {
+    message += `
+  ${description}`;
+  }
+  if (uri) {
+    message += `
+  See: ${uri}`;
+  }
+  return message;
+}
+__name(formatOAuthErrorMessage, "formatOAuthErrorMessage");
+function toErrorClass(rawError, description, uri) {
+  const message = formatOAuthErrorMessage(rawError, description, uri);
+  let error;
+  switch (rawError) {
+    case "invalid_request":
+      error = new ErrorInvalidRequest(message, {
+        telemetryMessage: "user oauth invalid request"
+      });
+      break;
+    case "invalid_grant":
+      error = new ErrorInvalidGrant(message, {
+        telemetryMessage: "user oauth invalid grant"
+      });
+      break;
+    case "unauthorized_client":
+      error = new ErrorUnauthorizedClient(message, {
+        telemetryMessage: "user oauth unauthorized client"
+      });
+      break;
+    case "access_denied":
+      error = new ErrorAccessDenied(message, {
+        telemetryMessage: "user oauth access denied"
+      });
+      break;
+    case "unsupported_response_type":
+      error = new ErrorUnsupportedResponseType(message, {
+        telemetryMessage: "user oauth unsupported response type"
+      });
+      break;
+    case "invalid_scope":
+      error = new ErrorInvalidScope(message, {
+        telemetryMessage: "user oauth invalid scope"
+      });
+      break;
+    case "server_error":
+      error = new ErrorServerError(message, {
+        telemetryMessage: "user oauth server error"
+      });
+      break;
+    case "temporarily_unavailable":
+      error = new ErrorTemporarilyUnavailable(message, {
+        telemetryMessage: "user oauth temporarily unavailable"
+      });
+      break;
+    case "invalid_client":
+      error = new ErrorInvalidClient(message, {
+        telemetryMessage: "user oauth invalid client"
+      });
+      break;
+    case "unsupported_grant_type":
+      error = new ErrorUnsupportedGrantType(message, {
+        telemetryMessage: "user oauth unsupported grant type"
+      });
+      break;
+    case "invalid_json":
+      error = new ErrorInvalidJson(message, {
+        telemetryMessage: "user oauth invalid json"
+      });
+      break;
+    case "invalid_token":
+      error = new ErrorInvalidToken(message, {
+        telemetryMessage: "user oauth invalid token"
+      });
+      break;
+    default:
+      error = new ErrorUnknown(message, {
+        telemetryMessage: "user oauth unknown error"
+      });
+      break;
+  }
+  error.code = rawError;
+  error.description = description;
+  error.uri = uri;
+  return error;
+}
+__name(toErrorClass, "toErrorClass");
+function isReturningFromAuthServer(query, state, logger) {
+  if (query.error) {
+    const error = Array.isArray(query.error) ? query.error[0] : query.error;
+    const description = Array.isArray(query.error_description) ? query.error_description[0] : query.error_description;
+    const uri = Array.isArray(query.error_uri) ? query.error_uri[0] : query.error_uri;
+    throw toErrorClass(error, description, uri);
+  }
+  const code = query.code;
+  if (!code) {
+    return false;
+  }
+  const stateQueryParam = query.state;
+  if (stateQueryParam !== state.stateQueryParam) {
+    logger.warn(
+      "Received query string parameter doesn't match the one sent! Possible malicious activity somewhere."
+    );
+    throw new ErrorInvalidReturnedStateParam("", {
+      telemetryMessage: "user oauth invalid returned state"
+    });
+  }
+  assert2(!Array.isArray(code));
+  state.authorizationCode = code;
+  state.hasAuthCodeBeenExchangedForAccessToken = false;
+  return true;
+}
+__name(isReturningFromAuthServer, "isReturningFromAuthServer");
+async function getAuthURL(scopes, clientId, redirectUri, state, generators) {
+  const { codeChallenge, codeVerifier } = await generatePKCECodes();
+  const stateQueryParam = generators.generateRandomState(
+    RECOMMENDED_STATE_LENGTH
+  );
+  Object.assign(state, {
+    codeChallenge,
+    codeVerifier,
+    stateQueryParam
+  });
+  return generators.generateAuthUrl({
+    authUrl: getAuthUrlFromEnv(),
+    clientId,
+    scopes,
+    stateQueryParam,
+    codeChallenge,
+    redirectUri
+  });
+}
+__name(getAuthURL, "getAuthURL");
+async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI, clientId, storage) {
+  const storedRefreshToken = readStoredAuthState({
+    warningLogger: logger,
+    storage
+  }).refreshToken;
+  if (!storedRefreshToken) {
+    logger.warn("No refresh token is present.");
+  }
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: storedRefreshToken?.value ?? "",
+    client_id: clientId
+  });
+  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI);
+  if (response.status >= 400) {
+    let tokenExchangeResErr = void 0;
+    try {
+      tokenExchangeResErr = await getJSONFromResponse(response, logger);
+    } catch (e) {
+      logger.error(e);
+    }
+    if (tokenExchangeResErr !== void 0) {
+      throw typeof tokenExchangeResErr === "string" ? new Error(tokenExchangeResErr) : tokenExchangeResErr;
+    } else {
+      throw new ErrorUnknown(
+        "Failed to parse Error from exchangeRefreshTokenForAccessToken",
+        { telemetryMessage: "user oauth refresh token exchange parse error" }
+      );
+    }
+  } else {
+    try {
+      const json = await getJSONFromResponse(
+        response,
+        logger
+      );
+      if ("error" in json) {
+        throw json.error;
+      }
+      const { access_token, expires_in, refresh_token, scope } = json;
+      const accessToken = {
+        value: access_token,
+        expiry: new Date(Date.now() + expires_in * 1e3).toISOString()
+      };
+      const scopes = scope ? scope.split(" ") : [];
+      const accessContext = {
+        token: accessToken,
+        scopes,
+        refreshToken: refresh_token ? { value: refresh_token } : storedRefreshToken
+      };
+      return accessContext;
+    } catch (error) {
+      if (typeof error === "string") {
+        throw toErrorClass(error);
+      } else {
+        throw error;
+      }
+    }
+  }
+}
+__name(exchangeRefreshTokenForAccessToken, "exchangeRefreshTokenForAccessToken");
+async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrCI, clientId, redirectUri) {
+  const { authorizationCode, codeVerifier = "" } = state;
+  if (!codeVerifier) {
+    logger.warn("No code verifier is being sent.");
+  } else if (!authorizationCode) {
+    logger.warn("No authorization grant code is being passed.");
+  }
+  const params = new URLSearchParams({
+    grant_type: `authorization_code`,
+    code: authorizationCode ?? "",
+    redirect_uri: redirectUri,
+    client_id: clientId,
+    code_verifier: codeVerifier
+  });
+  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI);
+  if (!response.ok) {
+    const { error } = await getJSONFromResponse(response, logger);
+    if (error === "invalid_grant") {
+      logger.log("Expired! Auth code or refresh token needs to be renewed.");
+    }
+    throw toErrorClass(error);
+  }
+  const json = await getJSONFromResponse(response, logger);
+  if ("error" in json) {
+    throw toErrorClass(json.error);
+  }
+  const { access_token, expires_in, refresh_token, scope } = json;
+  state.hasAuthCodeBeenExchangedForAccessToken = true;
+  const expiryDate = new Date(Date.now() + expires_in * 1e3);
+  const accessToken = {
+    value: access_token,
+    expiry: expiryDate.toISOString()
+  };
+  const scopes = scope ? scope.split(" ") : [];
+  const accessContext = {
+    token: accessToken,
+    scopes,
+    refreshToken: refresh_token ? { value: refresh_token } : void 0
+  };
+  return accessContext;
+}
+__name(exchangeAuthCodeForAccessToken, "exchangeAuthCodeForAccessToken");
+async function fetchAuthToken(body, logger, isNonInteractiveOrCI) {
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  logger.debug(
+    "fetching auth token",
+    `grant_type=${body.get("grant_type") ?? "<unknown>"}`
+  );
+  if (await domainUsesAccess(getAuthDomainFromEnv(), logger)) {
+    logger.debug(
+      "Using Cloudflare Access to get an access token for the auth request"
+    );
+    const accessHeaders = await getCloudflareAccessHeaders({
+      logger,
+      isNonInteractiveOrCI
+    });
+    Object.assign(headers, accessHeaders);
+  }
+  logger.debug("Fetching auth token from", getTokenUrlFromEnv());
+  try {
+    const response = await fetch(getTokenUrlFromEnv(), {
+      method: "POST",
+      body: body.toString(),
+      headers
+    });
+    if (!response.ok) {
+      logger.debug(
+        "Failed to fetch auth token:",
+        response.status,
+        response.statusText
+      );
+    }
+    return response;
+  } catch (e) {
+    logger.debug("Failed to fetch auth token:", e);
+    throw e;
+  }
+}
+__name(fetchAuthToken, "fetchAuthToken");
+async function getJSONFromResponse(response, logger) {
+  const text = await response.text();
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    if (text.match(/<!DOCTYPE html>/)) {
+      logger.error(
+        "The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response."
+      );
+      if (text.match(/challenge-platform/)) {
+        logger.error(
+          `It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${response.headers.get(
+            "cf-ray"
+          )}`
+        );
+      }
+    }
+    logger.debug("Full body of response\n\n", text);
+    throw new Error(
+      `Invalid JSON in response: status: ${response.status} ${response.statusText}`,
+      { cause: e }
+    );
+  }
+}
+__name(getJSONFromResponse, "getJSONFromResponse");
+
+// src/callback-server.ts
+async function getOauthToken(options, state, ctx, generators) {
+  const urlToOpen = await getAuthURL(
+    options.scopes,
+    options.clientId,
+    options.redirectUri,
+    state,
+    generators
+  );
+  const callbackPath = new URL(options.redirectUri).pathname;
+  let server;
+  let loginTimeoutHandle;
+  const timerPromise = new Promise((_, reject) => {
+    loginTimeoutHandle = setTimeout(() => {
+      server.close();
+      clearTimeout(loginTimeoutHandle);
+      reject(
+        new UserError(
+          "Timed out waiting for authorization code, please try again.",
+          { telemetryMessage: "user oauth authorization timeout" }
+        )
+      );
+    }, 12e4);
+  });
+  const loginPromise = new Promise((resolve, reject) => {
+    server = http.createServer(async (req, res) => {
+      function finish(token, error) {
+        clearTimeout(loginTimeoutHandle);
+        if (!res.writableEnded) {
+          res.end();
+        }
+        server.close((closeErr) => {
+          if (error || closeErr) {
+            reject(error || closeErr);
+          } else {
+            assert2(token);
+            resolve(token);
+          }
+        });
+      }
+      __name(finish, "finish");
+      function renderErrorPage(detail) {
+        const escape = /* @__PURE__ */ __name((s) => s.replace(
+          /[&<>"']/g,
+          (c) => ({
+            "&": "&amp;",
+            "<": "&lt;",
+            ">": "&gt;",
+            '"': "&quot;",
+            "'": "&#39;"
+          })[c]
+        ), "escape");
+        const codeRow = detail.code ? `<p>Code: <code>${escape(detail.code)}</code></p>` : "";
+        const descriptionRow = detail.description ? `<p class="detail">${escape(detail.description)}</p>` : "";
+        const body = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Wrangler login failed</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 720px; margin: 4rem auto; padding: 0 1rem; color: #1f2933; line-height: 1.5; }
+    h1 { color: #c12d3f; }
+    code { background: #f5f7fa; padding: 0.15em 0.3em; border-radius: 3px; }
+    p.detail { background: #f5f7fa; padding: 1rem; border-radius: 4px; white-space: pre-wrap; }
+  </style>
+</head>
+<body>
+  <h1>Wrangler login failed</h1>
+  <p>The Cloudflare OAuth provider returned an error.</p>
+  ${codeRow}
+  ${descriptionRow}
+  <p>You can close this tab and return to your terminal for more details.</p>
+</body>
+</html>`;
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(body);
+      }
+      __name(renderErrorPage, "renderErrorPage");
+      assert2(req.url, "This request doesn't have a URL");
+      const { pathname, query } = url.parse(req.url, true);
+      if (req.method !== "GET") {
+        return res.end("OK");
+      }
+      switch (pathname) {
+        case callbackPath: {
+          let hasAuthCode = false;
+          try {
+            hasAuthCode = isReturningFromAuthServer(query, state, ctx.logger);
+          } catch (err) {
+            if (err instanceof ErrorAccessDenied) {
+              res.writeHead(307, {
+                Location: options.denied.url
+              });
+              res.end(() => {
+                finish(
+                  null,
+                  new UserError(options.denied.error, {
+                    telemetryMessage: "user oauth consent denied"
+                  })
+                );
+              });
+              return;
+            }
+            const oauthErr = err;
+            renderErrorPage({
+              code: oauthErr.code,
+              description: oauthErr.description ?? oauthErr.message
+            });
+            finish(null, oauthErr);
+            return;
+          }
+          if (!hasAuthCode) {
+            const noCodeMessage = "The Cloudflare OAuth provider did not return an authorisation code.";
+            renderErrorPage({ description: noCodeMessage });
+            finish(
+              null,
+              new ErrorNoAuthCode(noCodeMessage, {
+                telemetryMessage: "user oauth missing auth code"
+              })
+            );
+            return;
+          }
+          try {
+            const exchange = await exchangeAuthCodeForAccessToken(
+              state,
+              ctx.logger,
+              ctx.isNonInteractiveOrCI,
+              options.clientId,
+              options.redirectUri
+            );
+            res.writeHead(307, {
+              Location: options.granted.url
+            });
+            res.end(() => {
+              finish(exchange);
+            });
+          } catch (err) {
+            const exchangeErr = err;
+            const isOAuthError = exchangeErr instanceof ErrorOAuth2;
+            renderErrorPage({
+              code: isOAuthError ? exchangeErr.code : void 0,
+              description: (isOAuthError ? exchangeErr.description : void 0) ?? exchangeErr.message ?? "Failed to exchange the authorisation code for an access token."
+            });
+            finish(null, exchangeErr);
+          }
+          return;
+        }
+      }
+    });
+    const redirect = new URL(options.redirectUri);
+    const redirectPort = Number(
+      redirect.port || (redirect.protocol === "https:" ? 443 : 80)
+    );
+    if (redirect.hostname !== options.callbackHost || redirectPort !== options.callbackPort) {
+      ctx.logger.log(
+        `Temporary login server listening on ${options.callbackHost}:${options.callbackPort}`
+      );
+      ctx.logger.log(
+        `Note that the OAuth login page will always redirect to \`${options.redirectUri}\`.
+If you have changed the callback host or port because you are running in a container, then ensure that you have port forwarding set up correctly.`
+      );
+    }
+    server.once("error", (err) => {
+      clearTimeout(loginTimeoutHandle);
+      if (err.code === "EADDRINUSE") {
+        reject(
+          new UserError(
+            `The OAuth callback server could not bind to ${options.callbackHost}:${options.callbackPort} because the port is already in use. Stop the process using that port or pass a different \`--callback-port\`.`,
+            { telemetryMessage: "user oauth callback port in use" }
+          )
+        );
+      } else {
+        reject(err);
+      }
+    });
+    server.listen(options.callbackPort, options.callbackHost);
+  });
+  if (options.browser) {
+    ctx.logger.log(`Opening a link in your default browser: ${urlToOpen}`);
+    await ctx.openInBrowser(urlToOpen);
+  } else {
+    ctx.logger.log(`Visit this link to authenticate: ${urlToOpen}`);
+  }
+  return Promise.race([timerPromise, loginPromise]);
+}
+__name(getOauthToken, "getOauthToken");
+
+// src/flow.ts
+function createOAuthFlow(ctx) {
+  const oauthFlowState = {};
+  const generators = {
+    generateAuthUrl: ctx.generateAuthUrl ?? generateAuthUrl,
+    generateRandomState: ctx.generateRandomState ?? generateRandomState
+  };
+  let activeProfile = "default";
+  function getStorage(profile) {
+    return ctx.storageFactory(profile ?? activeProfile);
+  }
+  __name(getStorage, "getStorage");
+  const getClientId = /* @__PURE__ */ __name(() => typeof ctx.clientId === "function" ? ctx.clientId() : ctx.clientId, "getClientId");
+  const consent = ctx.consent;
+  let temporaryAllowed = false;
+  let activeTemporaryAccount;
+  const redirectUrl = new URL(ctx.redirectUri);
+  const defaultCallbackHost = redirectUrl.hostname;
+  const defaultCallbackPort = Number(redirectUrl.port);
+  async function login(props) {
+    if (ctx.hasEnvCredentials()) {
+      ctx.logger.error(
+        "You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth."
+      );
+      return false;
+    }
+    const complianceRegion = getCloudflareComplianceRegion(
+      props.complianceConfig
+    );
+    if (complianceRegion === "fedramp_high") {
+      const configurationSource = props.complianceConfig?.compliance_region ? "`compliance_region` configuration property" : "`CLOUDFLARE_API_ENVIRONMENT` environment variable";
+      throw new UserError(
+        esm_default`
+				OAuth login is not supported in the \`${complianceRegion}\` compliance region.
+				Please use a Cloudflare API token (\`CLOUDFLARE_API_TOKEN\` environment variable) or remove the ${configurationSource}.
+			`,
+        {
+          telemetryMessage: "user login unsupported compliance region"
+        }
+      );
+    }
+    ctx.logger.log("Attempting to login via OAuth...");
+    const oauth = await getOauthToken(
+      {
+        browser: props.browser ?? true,
+        scopes: props.scopes,
+        clientId: getClientId(),
+        redirectUri: ctx.redirectUri,
+        denied: consent.denied,
+        granted: consent.granted,
+        callbackHost: props.callbackHost ?? defaultCallbackHost,
+        callbackPort: props.callbackPort ?? defaultCallbackPort
+      },
+      oauthFlowState,
+      ctx,
+      generators
+    );
+    getStorage(props.profile).write({
+      oauth_token: oauth.token?.value ?? "",
+      expiration_time: oauth.token?.expiry,
+      refresh_token: oauth.refreshToken?.value,
+      scopes: oauth.scopes
+    });
+    ctx.logger.log(`Successfully logged in.`);
+    clearTemporaryAccount();
+    ctx.purgeOnLoginOrLogout?.();
+    return true;
+  }
+  __name(login, "login");
+  function isRefreshNeeded(profile) {
+    if (ctx.hasEnvCredentials()) {
+      return false;
+    }
+    const { accessToken } = readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage(profile)
+    });
+    return Boolean(accessToken && /* @__PURE__ */ new Date() >= new Date(accessToken.expiry));
+  }
+  __name(isRefreshNeeded, "isRefreshNeeded");
+  async function refreshToken(profile) {
+    const storage = getStorage(profile);
+    try {
+      const {
+        token: { value: oauth_token, expiry: expiration_time } = {
+          value: "",
+          expiry: ""
+        },
+        refreshToken: { value: refresh_token } = {},
+        scopes
+      } = await exchangeRefreshTokenForAccessToken(
+        ctx.logger,
+        ctx.isNonInteractiveOrCI,
+        getClientId(),
+        storage
+      );
+      storage.write({
+        oauth_token,
+        expiration_time,
+        refresh_token,
+        scopes
+      });
+      return true;
+    } catch (e) {
+      ctx.logger.debug(
+        `Token refresh failed: ${e instanceof Error ? e.message : String(e)}`
+      );
+      return false;
+    }
+  }
+  __name(refreshToken, "refreshToken");
+  async function loginOrRefreshIfRequired(props) {
+    if (ctx.hasEnvCredentials()) {
+      return { loggedIn: true };
+    }
+    const stored = readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage(props.profile)
+    });
+    if (!stored.accessToken && !stored.deprecatedApiToken) {
+      if (ctx.isNonInteractiveOrCI()) {
+        return {
+          loggedIn: false,
+          reason: "no-credentials-non-interactive"
+        };
+      }
+      if (await login(props)) {
+        return { loggedIn: true };
+      }
+      return { loggedIn: false, reason: "no-credentials-login-failed" };
+    } else if (isRefreshNeeded(props.profile)) {
+      const didRefresh = await refreshToken(props.profile);
+      if (didRefresh) {
+        return { loggedIn: true };
+      }
+      if (ctx.isNonInteractiveOrCI()) {
+        return {
+          loggedIn: false,
+          reason: "token-expired-non-interactive"
+        };
+      }
+      if (await login(props)) {
+        return { loggedIn: true };
+      }
+      return { loggedIn: false, reason: "token-expired-login-failed" };
+    } else {
+      return { loggedIn: true };
+    }
+  }
+  __name(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
+  async function logout(profile) {
+    const clearedTemporary = clearTemporaryAccount();
+    if (ctx.hasEnvCredentials()) {
+      ctx.logger.log(
+        "You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log out."
+      );
+      return;
+    }
+    const storedRefreshToken = readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage(profile)
+    }).refreshToken;
+    if (!storedRefreshToken) {
+      ctx.logger.log(
+        clearedTemporary ? "Cleared temporary preview account." : "Not logged in, exiting..."
+      );
+      return;
+    }
+    const body = `client_id=${encodeURIComponent(getClientId())}&token_type_hint=refresh_token&token=${encodeURIComponent(storedRefreshToken.value || "")}`;
+    const response = await fetch(getRevokeUrlFromEnv(), {
+      method: "POST",
+      body,
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      }
+    });
+    await response.text();
+    getStorage(profile).clear();
+    ctx.logger.log(`Successfully logged out.`);
+    ctx.purgeOnLoginOrLogout?.();
+  }
+  __name(logout, "logout");
+  async function getOAuthTokenFromLocalState() {
+    let stored = readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage()
+    });
+    if (!stored.accessToken) {
+      return void 0;
+    }
+    const expired = stored.accessToken && /* @__PURE__ */ new Date() >= new Date(stored.accessToken.expiry);
+    if (expired) {
+      const didRefresh = await refreshToken();
+      if (!didRefresh) {
+        return void 0;
+      }
+      stored = readStoredAuthState({
+        warningLogger: ctx.logger,
+        storage: getStorage()
+      });
+    }
+    return stored.accessToken?.value;
+  }
+  __name(getOAuthTokenFromLocalState, "getOAuthTokenFromLocalState");
+  function getAPITokenInternal() {
+    if (activeTemporaryAccount) {
+      return { apiToken: activeTemporaryAccount.account.apiToken };
+    }
+    return getAPIToken({
+      storage: getStorage(),
+      warningLogger: ctx.logger,
+      allowGlobalAuthKey: ctx.allowGlobalAuthKey
+    });
+  }
+  __name(getAPITokenInternal, "getAPITokenInternal");
+  function requireApiTokenInternal() {
+    if (activeTemporaryAccount) {
+      return { apiToken: activeTemporaryAccount.account.apiToken };
+    }
+    return requireApiToken({
+      storage: getStorage(),
+      warningLogger: ctx.logger,
+      allowGlobalAuthKey: ctx.allowGlobalAuthKey
+    });
+  }
+  __name(requireApiTokenInternal, "requireApiTokenInternal");
+  function setTemporaryAllowed(allowed) {
+    temporaryAllowed = allowed && ctx.temporary !== void 0;
+    activeTemporaryAccount = void 0;
+  }
+  __name(setTemporaryAllowed, "setTemporaryAllowed");
+  function isTemporaryAllowed() {
+    return temporaryAllowed;
+  }
+  __name(isTemporaryAllowed, "isTemporaryAllowed");
+  function getActiveTemporaryAccount() {
+    return activeTemporaryAccount;
+  }
+  __name(getActiveTemporaryAccount, "getActiveTemporaryAccount");
+  async function activateTemporaryAccount() {
+    if (!ctx.temporary) {
+      throw new UserError(
+        "Temporary preview accounts are not supported by this CLI.",
+        { telemetryMessage: "user temporary account unsupported" }
+      );
+    }
+    const result = await getOrCreateTemporaryPreviewAccount({
+      ...ctx.temporary,
+      logger: ctx.logger
+    });
+    activeTemporaryAccount = result.account;
+    return result;
+  }
+  __name(activateTemporaryAccount, "activateTemporaryAccount");
+  function clearTemporaryAccount() {
+    activeTemporaryAccount = void 0;
+    return ctx.temporary?.storage.clear() ?? false;
+  }
+  __name(clearTemporaryAccount, "clearTemporaryAccount");
+  function setProfile(profile) {
+    activeProfile = profile;
+  }
+  __name(setProfile, "setProfile");
+  function getActiveProfile() {
+    return activeProfile;
+  }
+  __name(getActiveProfile, "getActiveProfile");
+  function getScopes() {
+    return readStoredAuthState({
+      warningLogger: ctx.logger,
+      storage: getStorage()
+    }).scopes;
+  }
+  __name(getScopes, "getScopes");
+  return {
+    setProfile,
+    getActiveProfile,
+    login,
+    logout,
+    loginOrRefreshIfRequired,
+    getOAuthTokenFromLocalState,
+    getAPIToken: getAPITokenInternal,
+    requireApiToken: requireApiTokenInternal,
+    getScopes,
+    setTemporaryAllowed,
+    isTemporaryAllowed,
+    getActiveTemporaryAccount,
+    activateTemporaryAccount
+  };
+}
+__name(createOAuthFlow, "createOAuthFlow");
+var RESERVED_PROFILE_NAMES = ["default", "staging"];
+function createProfileStore(args) {
+  const bindings = {
+    read() {
+      return args.bindings.read();
+    },
+    write(currentBindings) {
+      args.bindings.write(currentBindings);
+    },
+    activate(profile, dir) {
+      const normalizedDir = path4.resolve(dir);
+      const currentBindings = args.bindings.read();
+      currentBindings[normalizedDir] = profile;
+      args.bindings.write(currentBindings);
+    },
+    deactivate(dir) {
+      const normalizedDir = path4.resolve(dir);
+      const currentBindings = args.bindings.read();
+      const boundProfile = currentBindings[normalizedDir];
+      if (boundProfile === void 0) {
+        const parentBinding = getProfileForDirectoryFromBindings(
+          normalizedDir,
+          currentBindings
+        );
+        if (parentBinding) {
+          throw new UserError(
+            `No profile is directly bound to "${formatDirectoryForUserError(normalizedDir)}". The active profile "${parentBinding.profile}" is bound at "${formatDirectoryForUserError(
+              parentBinding.dir
+            )}". Run \`wrangler auth deactivate\` from that directory instead.`,
+            { telemetryMessage: "auth deactivate wrong directory" }
+          );
+        }
+        throw new UserError(
+          `No profile is bound to "${formatDirectoryForUserError(normalizedDir)}". Nothing to deactivate.`,
+          { telemetryMessage: "auth deactivate no binding" }
+        );
+      }
+      delete currentBindings[normalizedDir];
+      args.bindings.write(currentBindings);
+      const fallbackProfile = getProfileForDirectoryFromBindings(
+        normalizedDir,
+        currentBindings
+      );
+      if (fallbackProfile) {
+        return {
+          removedProfile: boundProfile,
+          newResolution: {
+            profile: fallbackProfile.profile,
+            source: `inherited from ${fallbackProfile.dir}`
+          }
+        };
+      }
+      if (args.configs.exists("default")) {
+        return {
+          removedProfile: boundProfile,
+          newResolution: { profile: "default", source: "default profile" }
+        };
+      }
+      return {
+        removedProfile: boundProfile,
+        newResolution: { profile: void 0, source: "no profile" }
+      };
+    },
+    getProfileForDirectory(startDir) {
+      return getProfileForDirectoryFromBindings(startDir, args.bindings.read())?.profile;
+    },
+    getBindingsForProfile(profile) {
+      return Object.entries(args.bindings.read()).filter(([, p]) => p === profile).map(([dir]) => dir);
+    },
+    removeAllBindingsForProfile(profile) {
+      const currentBindings = args.bindings.read();
+      const removed = [];
+      for (const [dir, p] of Object.entries(currentBindings)) {
+        if (p === profile) {
+          removed.push(dir);
+          delete currentBindings[dir];
+        }
+      }
+      if (removed.length > 0) {
+        args.bindings.write(currentBindings);
+      }
+      return removed;
+    }
+  };
+  return {
+    configs: args.configs,
+    bindings,
+    resolve(resolveArgs) {
+      if (resolveArgs.profile) {
+        if (resolveArgs.profile === "default") {
+          return "default";
+        }
+        validateProfileName(resolveArgs.profile);
+        return resolveArgs.profile;
+      }
+      const dirProfile = bindings.getProfileForDirectory(resolveArgs.cwd);
+      if (dirProfile) {
+        return dirProfile;
+      }
+      return "default";
+    }
+  };
+}
+__name(createProfileStore, "createProfileStore");
+function validateProfileName(name) {
+  if (RESERVED_PROFILE_NAMES.includes(name.toLowerCase())) {
+    throw new UserError(
+      `"${name}" is a reserved profile name. Use \`wrangler login\` and \`wrangler logout\` to manage the default profile, which applies as a global fallback.`,
+      { telemetryMessage: "auth profile reserved name" }
+    );
+  }
+  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+    throw new UserError(
+      `Invalid profile name "${name}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,
+      { telemetryMessage: "auth profile invalid name" }
+    );
+  }
+}
+__name(validateProfileName, "validateProfileName");
+function formatDirectoryForUserError(dir) {
+  return path4.relative(process.cwd(), dir) || ".";
+}
+__name(formatDirectoryForUserError, "formatDirectoryForUserError");
+function getProfileForDirectoryFromBindings(startDir, bindings) {
+  const normalizedDir = path4.resolve(startDir);
+  const sortedEntries = Object.entries(bindings).sort(
+    ([a], [b]) => b.length - a.length
+  );
+  for (const [boundDir, profile] of sortedEntries) {
+    if (normalizedDir === boundDir) {
+      return { profile, dir: boundDir };
+    }
+    if (normalizedDir.startsWith(boundDir) && normalizedDir[boundDir.length] === path4.sep) {
+      return { profile, dir: boundDir };
+    }
+  }
+  return void 0;
+}
+__name(getProfileForDirectoryFromBindings, "getProfileForDirectoryFromBindings");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/error.js
+function getLineColFromPtr(string, ptr) {
+  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
+  return [lines.length, lines.pop().length + 1];
+}
+__name(getLineColFromPtr, "getLineColFromPtr");
+function makeCodeBlock(string, line, column) {
+  let lines = string.split(/\r\n|\n|\r/g);
+  let codeblock = "";
+  let numberLen = (Math.log10(line + 1) | 0) + 1;
+  for (let i = line - 1; i <= line + 1; i++) {
+    let l = lines[i - 1];
+    if (!l)
+      continue;
+    codeblock += i.toString().padEnd(numberLen, " ");
+    codeblock += ":  ";
+    codeblock += l;
+    codeblock += "\n";
+    if (i === line) {
+      codeblock += " ".repeat(numberLen + column + 2);
+      codeblock += "^\n";
+    }
+  }
+  return codeblock;
+}
+__name(makeCodeBlock, "makeCodeBlock");
+var TomlError = class extends Error {
+  static {
+    __name(this, "TomlError");
+  }
+  line;
+  column;
+  codeblock;
+  constructor(message, options) {
+    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+    const codeblock = makeCodeBlock(options.toml, line, column);
+    super(`Invalid TOML document: ${message}
+
+${codeblock}`, options);
+    this.line = line;
+    this.column = column;
+    this.codeblock = codeblock;
+  }
+};
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/util.js
+function isEscaped(str, ptr) {
+  let i = 0;
+  while (str[ptr - ++i] === "\\")
+    ;
+  return --i && i % 2;
+}
+__name(isEscaped, "isEscaped");
+function indexOfNewline(str, start = 0, end = str.length) {
+  let idx = str.indexOf("\n", start);
+  if (str[idx - 1] === "\r")
+    idx--;
+  return idx <= end ? idx : -1;
+}
+__name(indexOfNewline, "indexOfNewline");
+function skipComment(str, ptr) {
+  for (let i = ptr; i < str.length; i++) {
+    let c = str[i];
+    if (c === "\n")
+      return i;
+    if (c === "\r" && str[i + 1] === "\n")
+      return i + 1;
+    if (c < " " && c !== "	" || c === "\x7F") {
+      throw new TomlError("control characters are not allowed in comments", {
+        toml: str,
+        ptr
+      });
+    }
+  }
+  return str.length;
+}
+__name(skipComment, "skipComment");
+function skipVoid(str, ptr, banNewLines, banComments) {
+  let c;
+  while ((c = str[ptr]) === " " || c === "	" || !banNewLines && (c === "\n" || c === "\r" && str[ptr + 1] === "\n"))
+    ptr++;
+  return banComments || c !== "#" ? ptr : skipVoid(str, skipComment(str, ptr), banNewLines);
+}
+__name(skipVoid, "skipVoid");
+function skipUntil(str, ptr, sep, end, banNewLines = false) {
+  if (!end) {
+    ptr = indexOfNewline(str, ptr);
+    return ptr < 0 ? str.length : ptr;
+  }
+  for (let i = ptr; i < str.length; i++) {
+    let c = str[i];
+    if (c === "#") {
+      i = indexOfNewline(str, i);
+    } else if (c === sep) {
+      return i + 1;
+    } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i + 1] === "\n")) {
+      return i;
+    }
+  }
+  throw new TomlError("cannot find end of structure", {
+    toml: str,
+    ptr
+  });
+}
+__name(skipUntil, "skipUntil");
+function getStringEnd(str, seek) {
+  let first = str[seek];
+  let target = first === str[seek + 1] && str[seek + 1] === str[seek + 2] ? str.slice(seek, seek + 3) : first;
+  seek += target.length - 1;
+  do
+    seek = str.indexOf(target, ++seek);
+  while (seek > -1 && first !== "'" && isEscaped(str, seek));
+  if (seek > -1) {
+    seek += target.length;
+    if (target.length > 1) {
+      if (str[seek] === first)
+        seek++;
+      if (str[seek] === first)
+        seek++;
+    }
+  }
+  return seek;
+}
+__name(getStringEnd, "getStringEnd");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/date.js
+var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class _TomlDate extends Date {
+  static {
+    __name(this, "TomlDate");
+  }
+  #hasDate = false;
+  #hasTime = false;
+  #offset = null;
+  constructor(date) {
+    let hasDate = true;
+    let hasTime = true;
+    let offset = "Z";
+    if (typeof date === "string") {
+      let match = date.match(DATE_TIME_RE);
+      if (match) {
+        if (!match[1]) {
+          hasDate = false;
+          date = `0000-01-01T${date}`;
+        }
+        hasTime = !!match[2];
+        hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+        if (match[2] && +match[2] > 23) {
+          date = "";
+        } else {
+          offset = match[3] || null;
+          date = date.toUpperCase();
+          if (!offset && hasTime)
+            date += "Z";
+        }
+      } else {
+        date = "";
+      }
+    }
+    super(date);
+    if (!isNaN(this.getTime())) {
+      this.#hasDate = hasDate;
+      this.#hasTime = hasTime;
+      this.#offset = offset;
+    }
+  }
+  isDateTime() {
+    return this.#hasDate && this.#hasTime;
+  }
+  isLocal() {
+    return !this.#hasDate || !this.#hasTime || !this.#offset;
+  }
+  isDate() {
+    return this.#hasDate && !this.#hasTime;
+  }
+  isTime() {
+    return this.#hasTime && !this.#hasDate;
+  }
+  isValid() {
+    return this.#hasDate || this.#hasTime;
+  }
+  toISOString() {
+    let iso = super.toISOString();
+    if (this.isDate())
+      return iso.slice(0, 10);
+    if (this.isTime())
+      return iso.slice(11, 23);
+    if (this.#offset === null)
+      return iso.slice(0, -1);
+    if (this.#offset === "Z")
+      return iso;
+    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+    offset = this.#offset[0] === "-" ? offset : -offset;
+    let offsetDate = new Date(this.getTime() - offset * 6e4);
+    return offsetDate.toISOString().slice(0, -1) + this.#offset;
+  }
+  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+    let date = new _TomlDate(jsDate);
+    date.#offset = offset;
+    return date;
+  }
+  static wrapAsLocalDateTime(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalDate(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#hasTime = false;
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalTime(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#hasDate = false;
+    date.#offset = null;
+    return date;
+  }
+};
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/primitive.js
+var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
+var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
+var LEADING_ZERO = /^[+-]?0[0-9_]/;
+var ESCAPE_REGEX = /^[0-9a-f]{4,8}$/i;
+var ESC_MAP = {
+  b: "\b",
+  t: "	",
+  n: "\n",
+  f: "\f",
+  r: "\r",
+  '"': '"',
+  "\\": "\\"
+};
+function parseString(str, ptr = 0, endPtr = str.length) {
+  let isLiteral = str[ptr] === "'";
+  let isMultiline = str[ptr++] === str[ptr] && str[ptr] === str[ptr + 1];
+  if (isMultiline) {
+    endPtr -= 2;
+    if (str[ptr += 2] === "\r")
+      ptr++;
+    if (str[ptr] === "\n")
+      ptr++;
+  }
+  let tmp = 0;
+  let isEscape;
+  let parsed = "";
+  let sliceStart = ptr;
+  while (ptr < endPtr - 1) {
+    let c = str[ptr++];
+    if (c === "\n" || c === "\r" && str[ptr] === "\n") {
+      if (!isMultiline) {
+        throw new TomlError("newlines are not allowed in strings", {
+          toml: str,
+          ptr: ptr - 1
+        });
+      }
+    } else if (c < " " && c !== "	" || c === "\x7F") {
+      throw new TomlError("control characters are not allowed in strings", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    }
+    if (isEscape) {
+      isEscape = false;
+      if (c === "u" || c === "U") {
+        let code = str.slice(ptr, ptr += c === "u" ? 4 : 8);
+        if (!ESCAPE_REGEX.test(code)) {
+          throw new TomlError("invalid unicode escape", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+        try {
+          parsed += String.fromCodePoint(parseInt(code, 16));
+        } catch {
+          throw new TomlError("invalid unicode escape", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+      } else if (isMultiline && (c === "\n" || c === " " || c === "	" || c === "\r")) {
+        ptr = skipVoid(str, ptr - 1, true);
+        if (str[ptr] !== "\n" && str[ptr] !== "\r") {
+          throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+        ptr = skipVoid(str, ptr);
+      } else if (c in ESC_MAP) {
+        parsed += ESC_MAP[c];
+      } else {
+        throw new TomlError("unrecognized escape sequence", {
+          toml: str,
+          ptr: tmp
+        });
+      }
+      sliceStart = ptr;
+    } else if (!isLiteral && c === "\\") {
+      tmp = ptr - 1;
+      isEscape = true;
+      parsed += str.slice(sliceStart, tmp);
+    }
+  }
+  return parsed + str.slice(sliceStart, endPtr - 1);
+}
+__name(parseString, "parseString");
+function parseValue(value, toml, ptr, integersAsBigInt) {
+  if (value === "true")
+    return true;
+  if (value === "false")
+    return false;
+  if (value === "-inf")
+    return -Infinity;
+  if (value === "inf" || value === "+inf")
+    return Infinity;
+  if (value === "nan" || value === "+nan" || value === "-nan")
+    return NaN;
+  if (value === "-0")
+    return integersAsBigInt ? 0n : 0;
+  let isInt = INT_REGEX.test(value);
+  if (isInt || FLOAT_REGEX.test(value)) {
+    if (LEADING_ZERO.test(value)) {
+      throw new TomlError("leading zeroes are not allowed", {
+        toml,
+        ptr
+      });
+    }
+    value = value.replace(/_/g, "");
+    let numeric = +value;
+    if (isNaN(numeric)) {
+      throw new TomlError("invalid number", {
+        toml,
+        ptr
+      });
+    }
+    if (isInt) {
+      if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
+        throw new TomlError("integer value cannot be represented losslessly", {
+          toml,
+          ptr
+        });
+      }
+      if (isInt || integersAsBigInt === true)
+        numeric = BigInt(value);
+    }
+    return numeric;
+  }
+  const date = new TomlDate(value);
+  if (!date.isValid()) {
+    throw new TomlError("invalid value", {
+      toml,
+      ptr
+    });
+  }
+  return date;
+}
+__name(parseValue, "parseValue");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/extract.js
+function sliceAndTrimEndOf(str, startPtr, endPtr, allowNewLines) {
+  let value = str.slice(startPtr, endPtr);
+  let commentIdx = value.indexOf("#");
+  if (commentIdx > -1) {
+    skipComment(str, commentIdx);
+    value = value.slice(0, commentIdx);
+  }
+  let trimmed = value.trimEnd();
+  if (!allowNewLines) {
+    let newlineIdx = value.indexOf("\n", trimmed.length);
+    if (newlineIdx > -1) {
+      throw new TomlError("newlines are not allowed in inline tables", {
+        toml: str,
+        ptr: startPtr + newlineIdx
+      });
+    }
+  }
+  return [trimmed, commentIdx];
+}
+__name(sliceAndTrimEndOf, "sliceAndTrimEndOf");
+function extractValue(str, ptr, end, depth, integersAsBigInt) {
+  if (depth === 0) {
+    throw new TomlError("document contains excessively nested structures. aborting.", {
+      toml: str,
+      ptr
+    });
+  }
+  let c = str[ptr];
+  if (c === "[" || c === "{") {
+    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
+    let newPtr = end ? skipUntil(str, endPtr2, ",", end) : endPtr2;
+    if (endPtr2 - newPtr && end === "}") {
+      let nextNewLine = indexOfNewline(str, endPtr2, newPtr);
+      if (nextNewLine > -1) {
+        throw new TomlError("newlines are not allowed in inline tables", {
+          toml: str,
+          ptr: nextNewLine
+        });
+      }
+    }
+    return [value, newPtr];
+  }
+  let endPtr;
+  if (c === '"' || c === "'") {
+    endPtr = getStringEnd(str, ptr);
+    let parsed = parseString(str, ptr, endPtr);
+    if (end) {
+      endPtr = skipVoid(str, endPtr, end !== "]");
+      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== "\n" && str[endPtr] !== "\r") {
+        throw new TomlError("unexpected character encountered", {
+          toml: str,
+          ptr: endPtr
+        });
+      }
+      endPtr += +(str[endPtr] === ",");
+    }
+    return [parsed, endPtr];
+  }
+  endPtr = skipUntil(str, ptr, ",", end);
+  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","), end === "]");
+  if (!slice[0]) {
+    throw new TomlError("incomplete key-value declaration: no value specified", {
+      toml: str,
+      ptr
+    });
+  }
+  if (end && slice[1] > -1) {
+    endPtr = skipVoid(str, ptr + slice[1]);
+    endPtr += +(str[endPtr] === ",");
+  }
+  return [
+    parseValue(slice[0], str, ptr, integersAsBigInt),
+    endPtr
+  ];
+}
+__name(extractValue, "extractValue");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/struct.js
+var KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
+function parseKey(str, ptr, end = "=") {
+  let dot = ptr - 1;
+  let parsed = [];
+  let endPtr = str.indexOf(end, ptr);
+  if (endPtr < 0) {
+    throw new TomlError("incomplete key-value: cannot find end of key", {
+      toml: str,
+      ptr
+    });
+  }
+  do {
+    let c = str[ptr = ++dot];
+    if (c !== " " && c !== "	") {
+      if (c === '"' || c === "'") {
+        if (c === str[ptr + 1] && c === str[ptr + 2]) {
+          throw new TomlError("multiline strings are not allowed in keys", {
+            toml: str,
+            ptr
+          });
+        }
+        let eos = getStringEnd(str, ptr);
+        if (eos < 0) {
+          throw new TomlError("unfinished string encountered", {
+            toml: str,
+            ptr
+          });
+        }
+        dot = str.indexOf(".", eos);
+        let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
+        let newLine = indexOfNewline(strEnd);
+        if (newLine > -1) {
+          throw new TomlError("newlines are not allowed in keys", {
+            toml: str,
+            ptr: ptr + dot + newLine
+          });
+        }
+        if (strEnd.trimStart()) {
+          throw new TomlError("found extra tokens after the string part", {
+            toml: str,
+            ptr: eos
+          });
+        }
+        if (endPtr < eos) {
+          endPtr = str.indexOf(end, eos);
+          if (endPtr < 0) {
+            throw new TomlError("incomplete key-value: cannot find end of key", {
+              toml: str,
+              ptr
+            });
+          }
+        }
+        parsed.push(parseString(str, ptr, eos));
+      } else {
+        dot = str.indexOf(".", ptr);
+        let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
+        if (!KEY_PART_RE.test(part)) {
+          throw new TomlError("only letter, numbers, dashes and underscores are allowed in keys", {
+            toml: str,
+            ptr
+          });
+        }
+        parsed.push(part.trimEnd());
+      }
+    }
+  } while (dot + 1 && dot < endPtr);
+  return [parsed, skipVoid(str, endPtr + 1, true, true)];
+}
+__name(parseKey, "parseKey");
+function parseInlineTable(str, ptr, depth, integersAsBigInt) {
+  let res = {};
+  let seen = /* @__PURE__ */ new Set();
+  let c;
+  let comma = 0;
+  ptr++;
+  while ((c = str[ptr++]) !== "}" && c) {
+    let err = { toml: str, ptr: ptr - 1 };
+    if (c === "\n") {
+      throw new TomlError("newlines are not allowed in inline tables", err);
+    } else if (c === "#") {
+      throw new TomlError("inline tables cannot contain comments", err);
+    } else if (c === ",") {
+      throw new TomlError("expected key-value, found comma", err);
+    } else if (c !== " " && c !== "	") {
+      let k;
+      let t = res;
+      let hasOwn = false;
+      let [key, keyEndPtr] = parseKey(str, ptr - 1);
+      for (let i = 0; i < key.length; i++) {
+        if (i)
+          t = hasOwn ? t[k] : t[k] = {};
+        k = key[i];
+        if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
+          throw new TomlError("trying to redefine an already defined value", {
+            toml: str,
+            ptr
+          });
+        }
+        if (!hasOwn && k === "__proto__") {
+          Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        }
+      }
+      if (hasOwn) {
+        throw new TomlError("trying to redefine an already defined value", {
+          toml: str,
+          ptr
+        });
+      }
+      let [value, valueEndPtr] = extractValue(str, keyEndPtr, "}", depth - 1, integersAsBigInt);
+      seen.add(value);
+      t[k] = value;
+      ptr = valueEndPtr;
+      comma = str[ptr - 1] === "," ? ptr - 1 : 0;
+    }
+  }
+  if (comma) {
+    throw new TomlError("trailing commas are not allowed in inline tables", {
+      toml: str,
+      ptr: comma
+    });
+  }
+  if (!c) {
+    throw new TomlError("unfinished table encountered", {
+      toml: str,
+      ptr
+    });
+  }
+  return [res, ptr];
+}
+__name(parseInlineTable, "parseInlineTable");
+function parseArray(str, ptr, depth, integersAsBigInt) {
+  let res = [];
+  let c;
+  ptr++;
+  while ((c = str[ptr++]) !== "]" && c) {
+    if (c === ",") {
+      throw new TomlError("expected value, found comma", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    } else if (c === "#")
+      ptr = skipComment(str, ptr);
+    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
+      let e = extractValue(str, ptr - 1, "]", depth - 1, integersAsBigInt);
+      res.push(e[0]);
+      ptr = e[1];
+    }
+  }
+  if (!c) {
+    throw new TomlError("unfinished array encountered", {
+      toml: str,
+      ptr
+    });
+  }
+  return [res, ptr];
+}
+__name(parseArray, "parseArray");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/parse.js
+function peekTable(key, table, meta, type) {
+  let t = table;
+  let m = meta;
+  let k;
+  let hasOwn = false;
+  let state;
+  for (let i = 0; i < key.length; i++) {
+    if (i) {
+      t = hasOwn ? t[k] : t[k] = {};
+      m = (state = m[k]).c;
+      if (type === 0 && (state.t === 1 || state.t === 2)) {
+        return null;
+      }
+      if (state.t === 2) {
+        let l = t.length - 1;
+        t = t[l];
+        m = m[l].c;
+      }
+    }
+    k = key[i];
+    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
+      return null;
+    }
+    if (!hasOwn) {
+      if (k === "__proto__") {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
+      }
+      m[k] = {
+        t: i < key.length - 1 && type === 2 ? 3 : type,
+        d: false,
+        i: 0,
+        c: {}
+      };
+    }
+  }
+  state = m[k];
+  if (state.t !== type && !(type === 1 && state.t === 3)) {
+    return null;
+  }
+  if (type === 2) {
+    if (!state.d) {
+      state.d = true;
+      t[k] = [];
+    }
+    t[k].push(t = {});
+    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
+  }
+  if (state.d) {
+    return null;
+  }
+  state.d = true;
+  if (type === 1) {
+    t = hasOwn ? t[k] : t[k] = {};
+  } else if (type === 0 && hasOwn) {
+    return null;
+  }
+  return [k, t, state.c];
+}
+__name(peekTable, "peekTable");
+function parse(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
+  let res = {};
+  let meta = {};
+  let tbl = res;
+  let m = meta;
+  for (let ptr = skipVoid(toml, 0); ptr < toml.length; ) {
+    if (toml[ptr] === "[") {
+      let isTableArray = toml[++ptr] === "[";
+      let k = parseKey(toml, ptr += +isTableArray, "]");
+      if (isTableArray) {
+        if (toml[k[1] - 1] !== "]") {
+          throw new TomlError("expected end of table declaration", {
+            toml,
+            ptr: k[1] - 1
+          });
+        }
+        k[1]++;
+      }
+      let p = peekTable(
+        k[0],
+        res,
+        meta,
+        isTableArray ? 2 : 1
+        /* Type.EXPLICIT */
+      );
+      if (!p) {
+        throw new TomlError("trying to redefine an already defined table or value", {
+          toml,
+          ptr
+        });
+      }
+      m = p[2];
+      tbl = p[1];
+      ptr = k[1];
+    } else {
+      let k = parseKey(toml, ptr);
+      let p = peekTable(
+        k[0],
+        tbl,
+        m,
+        0
+        /* Type.DOTTED */
+      );
+      if (!p) {
+        throw new TomlError("trying to redefine an already defined table or value", {
+          toml,
+          ptr
+        });
+      }
+      let v = extractValue(toml, k[1], void 0, maxDepth, integersAsBigInt);
+      p[1][p[0]] = v[0];
+      ptr = v[1];
+    }
+    ptr = skipVoid(toml, ptr, true);
+    if (toml[ptr] && toml[ptr] !== "\n" && toml[ptr] !== "\r") {
+      throw new TomlError("each key-value declaration must be followed by an end-of-line", {
+        toml,
+        ptr
+      });
+    }
+    ptr = skipVoid(toml, ptr);
+  }
+  return res;
+}
+__name(parse, "parse");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/stringify.js
+var BARE_KEY = /^[a-z0-9-_]+$/i;
+function extendedTypeOf(obj) {
+  let type = typeof obj;
+  if (type === "object") {
+    if (Array.isArray(obj))
+      return "array";
+    if (obj instanceof Date)
+      return "date";
+  }
+  return type;
+}
+__name(extendedTypeOf, "extendedTypeOf");
+function isArrayOfTables(obj) {
+  for (let i = 0; i < obj.length; i++) {
+    if (extendedTypeOf(obj[i]) !== "object")
+      return false;
+  }
+  return obj.length != 0;
+}
+__name(isArrayOfTables, "isArrayOfTables");
+function formatString(s) {
+  return JSON.stringify(s).replace(/\x7f/g, "\\u007f");
+}
+__name(formatString, "formatString");
+function stringifyValue(val, type, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  if (type === "number") {
+    if (isNaN(val))
+      return "nan";
+    if (val === Infinity)
+      return "inf";
+    if (val === -Infinity)
+      return "-inf";
+    if (numberAsFloat && Number.isInteger(val))
+      return val.toFixed(1);
+    return val.toString();
+  }
+  if (type === "bigint" || type === "boolean") {
+    return val.toString();
+  }
+  if (type === "string") {
+    return formatString(val);
+  }
+  if (type === "date") {
+    if (isNaN(val.getTime())) {
+      throw new TypeError("cannot serialize invalid date");
+    }
+    return val.toISOString();
+  }
+  if (type === "object") {
+    return stringifyInlineTable(val, depth, numberAsFloat);
+  }
+  if (type === "array") {
+    return stringifyArray(val, depth, numberAsFloat);
+  }
+}
+__name(stringifyValue, "stringifyValue");
+function stringifyInlineTable(obj, depth, numberAsFloat) {
+  let keys = Object.keys(obj);
+  if (keys.length === 0)
+    return "{}";
+  let res = "{ ";
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (i)
+      res += ", ";
+    res += BARE_KEY.test(k) ? k : formatString(k);
+    res += " = ";
+    res += stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat);
+  }
+  return res + " }";
+}
+__name(stringifyInlineTable, "stringifyInlineTable");
+function stringifyArray(array, depth, numberAsFloat) {
+  if (array.length === 0)
+    return "[]";
+  let res = "[ ";
+  for (let i = 0; i < array.length; i++) {
+    if (i)
+      res += ", ";
+    if (array[i] === null || array[i] === void 0) {
+      throw new TypeError("arrays cannot contain null or undefined values");
+    }
+    res += stringifyValue(array[i], extendedTypeOf(array[i]), depth - 1, numberAsFloat);
+  }
+  return res + " ]";
+}
+__name(stringifyArray, "stringifyArray");
+function stringifyArrayTable(array, key, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let res = "";
+  for (let i = 0; i < array.length; i++) {
+    res += `${res && "\n"}[[${key}]]
+`;
+    res += stringifyTable(0, array[i], key, depth, numberAsFloat);
+  }
+  return res;
+}
+__name(stringifyArrayTable, "stringifyArrayTable");
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let preamble = "";
+  let tables = "";
+  let keys = Object.keys(obj);
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (obj[k] !== null && obj[k] !== void 0) {
+      let type = extendedTypeOf(obj[k]);
+      if (type === "symbol" || type === "function") {
+        throw new TypeError(`cannot serialize values of type '${type}'`);
+      }
+      let key = BARE_KEY.test(k) ? k : formatString(k);
+      if (type === "array" && isArrayOfTables(obj[k])) {
+        tables += (tables && "\n") + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+      } else if (type === "object") {
+        let tblKey = prefix ? `${prefix}.${key}` : key;
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat);
+      } else {
+        preamble += key;
+        preamble += " = ";
+        preamble += stringifyValue(obj[k], type, depth, numberAsFloat);
+        preamble += "\n";
+      }
+    }
+  }
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
+}
+__name(stringifyTable, "stringifyTable");
+function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
+  if (extendedTypeOf(obj) !== "object") {
+    throw new TypeError("stringify can only be called with an object");
+  }
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
+}
+__name(stringify, "stringify");
+
+// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/index.js
+var dist_default = { parse, stringify, TomlDate, TomlError };
+
+// src/core/file-format.ts
+var FILE_FORMATS = {
+  toml: {
+    parse: /* @__PURE__ */ __name((raw) => parseTOML(raw), "parse"),
+    stringify: /* @__PURE__ */ __name((value) => dist_default.stringify(value), "stringify")
+  },
+  json: {
+    parse: /* @__PURE__ */ __name((raw) => JSON.parse(raw), "parse"),
+    stringify: /* @__PURE__ */ __name((value) => JSON.stringify(value, null, "	"), "stringify")
+  }
+};
+function parseFile(format, raw) {
+  return FILE_FORMATS[format].parse(raw);
+}
+__name(parseFile, "parseFile");
+function stringifyFile(format, value) {
+  return FILE_FORMATS[format].stringify(value);
+}
+__name(stringifyFile, "stringifyFile");
+
+// src/credential-store/file-store.ts
+var USER_AUTH_CONFIG_PATH = "config";
+function resolveAuthProfileBaseName(profile) {
+  if (profile === void 0 || profile === "default") {
+    const environment = getCloudflareApiEnvironmentFromEnv();
+    return environment === "production" ? "default" : environment;
+  }
+  validateProfileName(profile);
+  return profile;
+}
+__name(resolveAuthProfileBaseName, "resolveAuthProfileBaseName");
+function getAuthConfigFilePath(configPath, profile, extension = "toml") {
+  return path4.join(
+    configPath,
+    USER_AUTH_CONFIG_PATH,
+    `${resolveAuthProfileBaseName(profile)}.${extension}`
+  );
+}
+__name(getAuthConfigFilePath, "getAuthConfigFilePath");
+var FileCredentialStore = class {
+  /**
+   * @param configPath consumer-provided global config directory (the CLI
+   * owns where its config lives, so workers-auth never resolves it itself).
+   * @param profile the auth profile (defaults to the active environment's
+   * default profile).
+   * @param format on-disk file format (defaults to TOML for wrangler's
+   * historical layout; cf and other CLIs pass JSON).
+   */
+  constructor(configPath, profile, format = "toml") {
+    this.configPath = configPath;
+    this.profile = profile;
+    this.format = format;
+  }
+  static {
+    __name(this, "FileCredentialStore");
+  }
+  kind = "file";
+  filePath() {
+    return getAuthConfigFilePath(this.configPath, this.profile, this.format);
+  }
+  read() {
+    const filePath = this.filePath();
+    if (!existsSync(filePath)) {
+      return void 0;
+    }
+    return parseFile(this.format, readFileSync(filePath));
+  }
+  write(config) {
+    const filePath = this.filePath();
+    mkdirSync(path4.dirname(filePath), { recursive: true });
+    writeFileSync(filePath, stringifyFile(this.format, config), {
+      encoding: "utf-8",
+      mode: 384
+    });
+    chmodSync(filePath, 384);
+  }
+  clear() {
+    const filePath = this.filePath();
+    const existed = existsSync(filePath);
+    if (existed) {
+      rmSync(filePath);
+    }
+    return existed;
+  }
+  path() {
+    return this.filePath();
+  }
+  describe() {
+    return this.filePath();
+  }
+};
+var KEY_LENGTH_BYTES = 32;
+var IV_LENGTH_BYTES = 12;
+var TAG_LENGTH_BYTES = 16;
+var ALGORITHM_LABEL = "AES-256-GCM";
+var CIPHER_NAME = "aes-256-gcm";
+function generateKey() {
+  return new Uint8Array(randomBytes(KEY_LENGTH_BYTES));
+}
+__name(generateKey, "generateKey");
+function encryptString(plaintext, key) {
+  if (key.length !== KEY_LENGTH_BYTES) {
+    throw new Error(
+      `AES-256-GCM requires a ${KEY_LENGTH_BYTES}-byte key (got ${key.length} bytes).`
+    );
+  }
+  const iv = randomBytes(IV_LENGTH_BYTES);
+  const cipher = createCipheriv(CIPHER_NAME, key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf-8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return {
+    v: 1,
+    alg: ALGORITHM_LABEL,
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    ciphertext: ciphertext.toString("base64")
+  };
+}
+__name(encryptString, "encryptString");
+function decryptString(envelope, key) {
+  if (key.length !== KEY_LENGTH_BYTES) {
+    throw new Error(
+      `AES-256-GCM requires a ${KEY_LENGTH_BYTES}-byte key (got ${key.length} bytes).`
+    );
+  }
+  if (envelope.v !== 1) {
+    throw new Error(
+      `Unsupported encrypted envelope version: ${envelope.v}.`
+    );
+  }
+  const iv = Buffer.from(envelope.iv, "base64");
+  const tag = Buffer.from(envelope.tag, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  if (iv.length !== IV_LENGTH_BYTES) {
+    throw new Error(
+      `Expected ${IV_LENGTH_BYTES}-byte IV in envelope (got ${iv.length} bytes).`
+    );
+  }
+  if (tag.length !== TAG_LENGTH_BYTES) {
+    throw new Error(
+      `Expected ${TAG_LENGTH_BYTES}-byte auth tag in envelope (got ${tag.length} bytes).`
+    );
+  }
+  const decipher = createDecipheriv(CIPHER_NAME, key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([
+    decipher.update(ciphertext),
+    // `final()` is where GCM verifies the auth tag and throws on
+    // mismatch. We let that error propagate so callers can decide
+    // whether to treat it as "not logged in" or surface it.
+    decipher.final()
+  ]);
+  return plaintext.toString("utf-8");
+}
+__name(decryptString, "decryptString");
+function parseEncryptedEnvelope(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return void 0;
+  }
+  const candidate = raw;
+  if (candidate.v !== 1 || candidate.alg !== ALGORITHM_LABEL || typeof candidate.iv !== "string" || typeof candidate.tag !== "string" || typeof candidate.ciphertext !== "string") {
+    return void 0;
+  }
+  return candidate;
+}
+__name(parseEncryptedEnvelope, "parseEncryptedEnvelope");
+function getEncryptedAuthConfigFilePath(configPath, profile) {
+  return path4.join(
+    configPath,
+    "config",
+    `${resolveAuthProfileBaseName(profile)}.enc`
+  );
+}
+__name(getEncryptedAuthConfigFilePath, "getEncryptedAuthConfigFilePath");
+var EncryptedFileCredentialStore = class {
+  /**
+   * @param configPath consumer-provided global config directory (the CLI
+   * owns where its config lives, so workers-auth never resolves it itself).
+   * @param keyProvider the OS-keyring backend holding the encryption key.
+   * @param onPlaintextMigration optional callback invoked when a plaintext
+   * file is migrated into the encrypted layout on first read.
+   * @param profile the auth profile (defaults to the active environment's
+   * default profile).
+   * @param format on-disk format of the plaintext sibling file and the
+   * encrypted payload (defaults to TOML for wrangler).
+   */
+  constructor(configPath, keyProvider, onPlaintextMigration, profile, format = "toml") {
+    this.configPath = configPath;
+    this.keyProvider = keyProvider;
+    this.onPlaintextMigration = onPlaintextMigration;
+    this.profile = profile;
+    this.format = format;
+  }
+  static {
+    __name(this, "EncryptedFileCredentialStore");
+  }
+  kind = "encrypted-file";
+  plaintextPath() {
+    return getAuthConfigFilePath(this.configPath, this.profile, this.format);
+  }
+  read() {
+    const encryptedPath = getEncryptedAuthConfigFilePath(
+      this.configPath,
+      this.profile
+    );
+    if (existsSync(encryptedPath)) {
+      return this.readEncryptedFile(encryptedPath);
+    }
+    const plaintextPath = this.plaintextPath();
+    if (existsSync(plaintextPath)) {
+      return this.migrateFromPlaintext(plaintextPath, encryptedPath);
+    }
+    return void 0;
+  }
+  write(config) {
+    const key = this.ensureKey();
+    const plaintext = stringifyFile(this.format, config);
+    const envelope = encryptString(plaintext, key);
+    const encryptedPath = getEncryptedAuthConfigFilePath(
+      this.configPath,
+      this.profile
+    );
+    mkdirSync(path4.dirname(encryptedPath), { recursive: true });
+    writeFileSync(encryptedPath, JSON.stringify(envelope, null, "	"), {
+      encoding: "utf-8",
+      mode: 384
+    });
+    chmodSync(encryptedPath, 384);
+    const plaintextPath = this.plaintextPath();
+    if (existsSync(plaintextPath)) {
+      rmSync(plaintextPath);
+    }
+  }
+  clear() {
+    const encryptedPath = getEncryptedAuthConfigFilePath(
+      this.configPath,
+      this.profile
+    );
+    const plaintextPath = this.plaintextPath();
+    let existed = false;
+    if (existsSync(encryptedPath)) {
+      rmSync(encryptedPath);
+      existed = true;
+    }
+    if (existsSync(plaintextPath)) {
+      rmSync(plaintextPath);
+      existed = true;
+    }
+    try {
+      this.keyProvider.deleteKey();
+    } catch {
+    }
+    return existed;
+  }
+  path() {
+    return getEncryptedAuthConfigFilePath(this.configPath, this.profile);
+  }
+  describe() {
+    return `Encrypted file (${getEncryptedAuthConfigFilePath(this.configPath, this.profile)}) with key in ${this.keyProvider.describe()}`;
+  }
+  /* ------------------------------------------------------------------ */
+  /* Internals                                                           */
+  /* ------------------------------------------------------------------ */
+  readEncryptedFile(encryptedPath) {
+    const key = this.keyProvider.getKey();
+    if (key === void 0) {
+      return void 0;
+    }
+    const raw = readFileSync(encryptedPath);
+    let envelope;
+    try {
+      envelope = parseEncryptedEnvelope(JSON.parse(raw));
+    } catch {
+      return void 0;
+    }
+    if (envelope === void 0) {
+      return void 0;
+    }
+    let plaintext;
+    try {
+      plaintext = decryptString(envelope, key);
+    } catch {
+      return void 0;
+    }
+    try {
+      return parseFile(this.format, plaintext);
+    } catch {
+      return void 0;
+    }
+  }
+  migrateFromPlaintext(plaintextPath, encryptedPath) {
+    const raw = readFileSync(plaintextPath);
+    let plaintext;
+    try {
+      plaintext = parseFile(this.format, raw);
+    } catch {
+      return void 0;
+    }
+    this.write(plaintext);
+    this.onPlaintextMigration?.({
+      plaintextPath,
+      encryptedPath,
+      keyProviderDescription: this.keyProvider.describe()
+    });
+    return plaintext;
+  }
+  /**
+   * Return the existing encryption key, or generate + persist a fresh
+   * one when none exists yet. Called from `write()` so the first
+   * `wrangler login --use-keyring` is fully bootstrapping.
+   */
+  ensureKey() {
+    const existing = this.keyProvider.getKey();
+    if (existing !== void 0) {
+      return existing;
+    }
+    const fresh = generateKey();
+    this.keyProvider.setKey(fresh);
+    return fresh;
+  }
+};
+var PINNED_KEYRING_VERSION = "1.3.0";
+function defaultNpmRunner(args) {
+  return spawnSync("npm", args, {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: process.platform === "win32"
+  });
+}
+__name(defaultNpmRunner, "defaultNpmRunner");
+var npmRunner = defaultNpmRunner;
+var cachedBindingPathByDir = /* @__PURE__ */ new Map();
+function setNpmRunner(fn) {
+  npmRunner = fn ?? defaultNpmRunner;
+  cachedBindingPathByDir.clear();
+}
+__name(setNpmRunner, "setNpmRunner");
+function getKeyringInstallDir(configPath) {
+  return path4.join(configPath, "native", "keyring");
+}
+__name(getKeyringInstallDir, "getKeyringInstallDir");
+function getInstalledBindingPath(installDir) {
+  return path4.join(installDir, "node_modules", "@napi-rs", "keyring");
+}
+__name(getInstalledBindingPath, "getInstalledBindingPath");
+function findKeyringBinding(installDir) {
+  const cached = cachedBindingPathByDir.get(installDir);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const lazy = getInstalledBindingPath(installDir);
+  if (existsSync(path4.join(lazy, "index.js"))) {
+    cachedBindingPathByDir.set(installDir, lazy);
+    return lazy;
+  }
+  try {
+    const r = npmRunner(["root", "-g"]);
+    if (r.status === 0) {
+      const global = path4.join(r.stdout.trim(), "@napi-rs", "keyring");
+      if (existsSync(path4.join(global, "index.js"))) {
+        cachedBindingPathByDir.set(installDir, global);
+        return global;
+      }
+    }
+  } catch {
+  }
+  cachedBindingPathByDir.set(installDir, null);
+  return null;
+}
+__name(findKeyringBinding, "findKeyringBinding");
+function installKeyringBindingSync(installDir) {
+  const dir = installDir;
+  mkdirSync(dir, { recursive: true });
+  const hostPkgJson = path4.join(dir, "package.json");
+  if (!existsSync(hostPkgJson)) {
+    writeFileSync(
+      hostPkgJson,
+      JSON.stringify(
+        { private: true, name: "cloudflare-auth-keyring-host" },
+        null,
+        "	"
+      ),
+      "utf-8"
+    );
+  }
+  let r;
+  try {
+    r = npmRunner([
+      "install",
+      `@napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      "--prefix",
+      dir,
+      "--no-save",
+      "--no-audit",
+      "--no-fund",
+      "--no-package-lock",
+      "--loglevel=error"
+    ]);
+  } catch (e) {
+    throw new UserError(
+      `Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error ? e.message : String(e)}
+
+Install \`npm\` and retry, or install the binding globally:
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      { telemetryMessage: "workers-auth keyring npm spawn failed" }
+    );
+  }
+  if (r.status !== 0) {
+    throw new UserError(
+      `Failed to install \`@napi-rs/keyring\` (npm exited ${r.status}):
+${r.stderr?.trim() ?? "(no stderr)"}
+
+Retry once the underlying issue is fixed, or install the binding globally:
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      { telemetryMessage: "workers-auth keyring npm install failed" }
+    );
+  }
+  cachedBindingPathByDir.delete(installDir);
+}
+__name(installKeyringBindingSync, "installKeyringBindingSync");
+var entryFactoryOverride;
+function setKeyringEntryFactory(factory) {
+  entryFactoryOverride = factory;
+}
+__name(setKeyringEntryFactory, "setKeyringEntryFactory");
+var dynamicRequire = createRequire(__filename);
+function resolveKeyringEntryFactory(installDir) {
+  if (entryFactoryOverride !== void 0) {
+    return entryFactoryOverride;
+  }
+  const bindingPath = findKeyringBinding(installDir);
+  if (bindingPath === null) {
+    throw new Error(
+      "`@napi-rs/keyring` binding not found. Call `installKeyringBindingSync()` first."
+    );
+  }
+  const mod = dynamicRequire(bindingPath);
+  return (service, account) => new mod.Entry(service, account);
+}
+__name(resolveKeyringEntryFactory, "resolveKeyringEntryFactory");
+
+// src/credential-store/key-providers/shared.ts
+function getKeyringAccountName(profile) {
+  return resolveAuthProfileBaseName(profile);
+}
+__name(getKeyringAccountName, "getKeyringAccountName");
+function encodeKeyEnvelope(key) {
+  const envelope = {
+    v: 1,
+    key: Buffer.from(key).toString("base64"),
+    created: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return JSON.stringify(envelope);
+}
+__name(encodeKeyEnvelope, "encodeKeyEnvelope");
+function decodeKeyEnvelope(raw) {
+  if (raw === "") {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.v !== 1 || typeof parsed.key !== "string") {
+    return void 0;
+  }
+  try {
+    const buf = Buffer.from(parsed.key, "base64");
+    if (buf.length !== 32) {
+      return void 0;
+    }
+    return new Uint8Array(buf);
+  } catch {
+    return void 0;
+  }
+}
+__name(decodeKeyEnvelope, "decodeKeyEnvelope");
+function defaultRunner(args, options = {}) {
+  return spawnSync("secret-tool", args, {
+    encoding: "utf-8",
+    input: options.input
+  });
+}
+__name(defaultRunner, "defaultRunner");
+var runner = defaultRunner;
+var cachedProbeResult = void 0;
+function setLinuxSecretToolRunner(fn) {
+  runner = fn ?? defaultRunner;
+  cachedProbeResult = void 0;
+}
+__name(setLinuxSecretToolRunner, "setLinuxSecretToolRunner");
+function probeSecretTool() {
+  if (cachedProbeResult !== void 0) {
+    return cachedProbeResult;
+  }
+  let result;
+  try {
+    const r = runner(["--version"]);
+    result = r.status === 0;
+  } catch {
+    result = false;
+  }
+  cachedProbeResult = result;
+  return result;
+}
+__name(probeSecretTool, "probeSecretTool");
+var LinuxSecretToolKeyProvider = class {
+  constructor(serviceName, profile) {
+    this.serviceName = serviceName;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "LinuxSecretToolKeyProvider");
+  }
+  getKey() {
+    const r = runner([
+      "lookup",
+      "service",
+      this.serviceName,
+      "account",
+      getKeyringAccountName(this.profile)
+    ]);
+    if (r.status === 1) {
+      return void 0;
+    }
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to read key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+    return decodeKeyEnvelope(r.stdout.trim());
+  }
+  setKey(key) {
+    const r = runner(
+      [
+        "store",
+        "--label=Cloudflare credentials key",
+        "service",
+        this.serviceName,
+        "account",
+        getKeyringAccountName(this.profile)
+      ],
+      { input: encodeKeyEnvelope(key) }
+    );
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to write key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+  }
+  deleteKey() {
+    const r = runner([
+      "clear",
+      "service",
+      this.serviceName,
+      "account",
+      getKeyringAccountName(this.profile)
+    ]);
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to delete key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+  }
+  describe() {
+    return `Linux secret-tool (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
+  }
+};
+var SECURITY_EXIT_ITEM_NOT_FOUND = 44;
+function defaultRunner2(args, options = {}) {
+  return spawnSync("/usr/bin/security", args, {
+    encoding: "utf-8",
+    input: options.input
+  });
+}
+__name(defaultRunner2, "defaultRunner");
+var runner2 = defaultRunner2;
+function setMacSecurityCommandRunner(fn) {
+  runner2 = fn ?? defaultRunner2;
+}
+__name(setMacSecurityCommandRunner, "setMacSecurityCommandRunner");
+var MacSecurityKeyProvider = class {
+  constructor(serviceName, profile) {
+    this.serviceName = serviceName;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "MacSecurityKeyProvider");
+  }
+  getKey() {
+    const r = runner2([
+      "find-generic-password",
+      "-s",
+      this.serviceName,
+      "-a",
+      getKeyringAccountName(this.profile),
+      "-w"
+    ]);
+    if (r.status === SECURITY_EXIT_ITEM_NOT_FOUND) {
+      return void 0;
+    }
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to read key from macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+    return decodeKeyEnvelope(r.stdout.trim());
+  }
+  setKey(key) {
+    const r = runner2([
+      "add-generic-password",
+      "-s",
+      this.serviceName,
+      "-a",
+      getKeyringAccountName(this.profile),
+      "-w",
+      encodeKeyEnvelope(key),
+      "-U"
+    ]);
+    if (r.status !== 0) {
+      throw new Error(
+        `Failed to write key to macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+      );
+    }
+  }
+  deleteKey() {
+    const r = runner2([
+      "delete-generic-password",
+      "-s",
+      this.serviceName,
+      "-a",
+      getKeyringAccountName(this.profile)
+    ]);
+    if (r.status === 0 || r.status === SECURITY_EXIT_ITEM_NOT_FOUND) {
+      return;
+    }
+    throw new Error(
+      `Failed to delete key from macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
+    );
+  }
+  describe() {
+    return `macOS Keychain (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
+  }
+};
+
+// src/credential-store/key-providers/napi-keyring.ts
+var NapiKeyringKeyProvider = class {
+  /**
+   * @param serviceName keyring service identifier (e.g. `"wrangler"`).
+   * @param installDir directory hosting the lazy-installed `@napi-rs/keyring`
+   * binding, derived from the consumer's config path.
+   * @param profile the auth profile (selects the keyring account name).
+   */
+  constructor(serviceName, installDir, profile) {
+    this.serviceName = serviceName;
+    this.installDir = installDir;
+    this.profile = profile;
+  }
+  static {
+    __name(this, "NapiKeyringKeyProvider");
+  }
+  // Resolve the entry factory (and account name) lazily on every call
+  // rather than caching them on construction: on Windows the native
+  // binding is installed *after* this provider is constructed (the
+  // resolver builds the provider, then runs the install), and tests
+  // swap the factory between operations via `setKeyringEntryFactory`.
+  // Caching on the instance would pin a stale/absent factory. The
+  // account-name lookup is a cheap env read, so recomputing is free.
+  entry() {
+    return resolveKeyringEntryFactory(this.installDir)(
+      this.serviceName,
+      getKeyringAccountName(this.profile)
+    );
+  }
+  getKey() {
+    const raw = this.entry().getPassword();
+    if (raw === null || raw === "") {
+      return void 0;
+    }
+    return decodeKeyEnvelope(raw);
+  }
+  setKey(key) {
+    this.entry().setPassword(encodeKeyEnvelope(key));
+  }
+  deleteKey() {
+    try {
+      this.entry().deletePassword();
+    } catch {
+    }
+  }
+  describe() {
+    const platformName = process.platform === "win32" ? "Windows Credential Manager" : "OS keyring";
+    return `${platformName} via @napi-rs/keyring (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
+  }
+};
+
+// src/credential-store/key-providers/factory.ts
+var testProviderFactory;
+function setKeyProviderFactoryForTesting(factory) {
+  testProviderFactory = factory;
+}
+__name(setKeyProviderFactoryForTesting, "setKeyProviderFactoryForTesting");
+function resolveKeyProvider(serviceName, profile, configPath) {
+  if (testProviderFactory !== void 0) {
+    return {
+      kind: "available",
+      provider: testProviderFactory(serviceName, profile)
+    };
+  }
+  switch (process.platform) {
+    case "darwin":
+      return {
+        kind: "available",
+        provider: new MacSecurityKeyProvider(serviceName, profile)
+      };
+    case "linux":
+      if (probeSecretTool()) {
+        return {
+          kind: "available",
+          provider: new LinuxSecretToolKeyProvider(serviceName, profile)
+        };
+      }
+      return { kind: "unsupported" };
+    case "win32": {
+      const installDir = getKeyringInstallDir(configPath);
+      if (findKeyringBinding(installDir) !== null) {
+        return {
+          kind: "available",
+          provider: new NapiKeyringKeyProvider(
+            serviceName,
+            installDir,
+            profile
+          )
+        };
+      }
+      return {
+        kind: "needs-install",
+        install: /* @__PURE__ */ __name(() => installKeyringBindingSync(installDir), "install"),
+        afterInstall: /* @__PURE__ */ __name(() => new NapiKeyringKeyProvider(serviceName, installDir, profile), "afterInstall")
+      };
+    }
+    default:
+      return { kind: "unsupported" };
+  }
+}
+__name(resolveKeyProvider, "resolveKeyProvider");
+
+// src/credential-store/state.ts
+var sessionFlags = {
+  installFailedThisSession: false,
+  hasWarnedAboutKeyringFallback: false,
+  hasWarnedAboutSecretToolMissing: false
+};
+function getResolverSessionFlags() {
+  return sessionFlags;
+}
+__name(getResolverSessionFlags, "getResolverSessionFlags");
+function resetCredentialStorageState() {
+  sessionFlags.installFailedThisSession = false;
+  sessionFlags.hasWarnedAboutKeyringFallback = false;
+  sessionFlags.hasWarnedAboutSecretToolMissing = false;
+}
+__name(resetCredentialStorageState, "resetCredentialStorageState");
+var clearCredentialStorageState = resetCredentialStorageState;
+function createCredentialStorageContext(context) {
+  const config = {
+    ...context,
+    loginCommand: context.loginCommand ?? "your CLI login",
+    format: context.format ?? "toml"
+  };
+  function getActiveStore(profile) {
+    return resolveActiveCredentialStore(config, profile);
+  }
+  __name(getActiveStore, "getActiveStore");
+  function storageFactory(profile) {
+    return {
+      read: /* @__PURE__ */ __name(() => getActiveStore(profile).read(), "read"),
+      write: /* @__PURE__ */ __name((value) => getActiveStore(profile).write(value), "write"),
+      clear: /* @__PURE__ */ __name(() => getActiveStore(profile).clear(), "clear"),
+      path: /* @__PURE__ */ __name(() => getActiveStore(profile).path(), "path")
+    };
+  }
+  __name(storageFactory, "storageFactory");
+  return { storageFactory, getActiveStore };
+}
+__name(createCredentialStorageContext, "createCredentialStorageContext");
+function resolveActiveCredentialStore(config, profile) {
+  const envOverride = getCloudflareAuthUseKeyringFromEnv();
+  const configPath = config.getConfigPath();
+  if (envOverride === false) {
+    return new FileCredentialStore(configPath, profile, config.format);
+  }
+  const forcedByEnvVar = envOverride === true;
+  const wantsKeyring = envOverride ?? config.isKeyringEnabled() ?? false;
+  if (!wantsKeyring) {
+    return new FileCredentialStore(configPath, profile, config.format);
+  }
+  const resolution = resolveKeyProvider(
+    config.serviceName,
+    profile,
+    configPath
+  );
+  switch (resolution.kind) {
+    case "available":
+      return new EncryptedFileCredentialStore(
+        configPath,
+        resolution.provider,
+        buildMigrationLogger(config),
+        profile,
+        config.format
+      );
+    case "needs-install":
+      return handleNeedsInstall(resolution, forcedByEnvVar, config, profile);
+    case "unsupported":
+      return handleUnsupported(forcedByEnvVar, config, profile);
+  }
+}
+__name(resolveActiveCredentialStore, "resolveActiveCredentialStore");
+function buildMigrationLogger(config) {
+  return (result) => {
+    config.logger.warn(
+      `Migrated credentials from ${result.plaintextPath} into ${result.encryptedPath} (key in ${result.keyProviderDescription}). The plaintext file has been deleted.`
+    );
+  };
+}
+__name(buildMigrationLogger, "buildMigrationLogger");
+function handleNeedsInstall(resolution, forcedByEnvVar, config, profile) {
+  const flags = getResolverSessionFlags();
+  if (flags.installFailedThisSession) {
+    if (forcedByEnvVar) {
+      throw new UserError(
+        `CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,
+        { telemetryMessage: "workers-auth keyring install previously failed" }
+      );
+    }
+    return fallbackToFileWithWarning(
+      `The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,
+      config,
+      profile
+    );
+  }
+  if (config.isNonInteractiveOrCI()) {
+    throw new UserError(windowsBindingMissingMessage(config.loginCommand), {
+      telemetryMessage: "workers-auth keyring binding not installed"
+    });
+  }
+  try {
+    config.logger.log(`\u{1F510} Installing keyring backend (one-time, ~2 MB)\u2026`);
+    resolution.install();
+  } catch (e) {
+    flags.installFailedThisSession = true;
+    if (forcedByEnvVar) {
+      throw e instanceof UserError ? e : new UserError(
+        `Failed to install the keyring backend: ${e instanceof Error ? e.message : String(e)}`,
+        { telemetryMessage: "workers-auth keyring install threw" }
+      );
+    }
+    return fallbackToFileWithWarning(
+      `Failed to install the keyring backend (${e instanceof Error ? e.message : String(e)}); falling back to the plaintext credentials file.`,
+      config,
+      profile
+    );
+  }
+  return new EncryptedFileCredentialStore(
+    config.getConfigPath(),
+    resolution.afterInstall(),
+    buildMigrationLogger(config),
+    profile,
+    config.format
+  );
+}
+__name(handleNeedsInstall, "handleNeedsInstall");
+function handleUnsupported(forcedByEnvVar, config, profile) {
+  const platform = process.platform;
+  const linuxMissingTool = platform === "linux";
+  const message = linuxMissingTool ? secretToolMissingMessage(config.loginCommand) : `OS keyring storage is not supported on \`${platform}\`; falling back to the plaintext credentials file.`;
+  if (forcedByEnvVar) {
+    throw new UserError(
+      linuxMissingTool ? `CLOUDFLARE_AUTH_USE_KEYRING is set but ${message}` : `CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${platform}\`.`,
+      {
+        telemetryMessage: linuxMissingTool ? "workers-auth keyring secret tool missing" : "workers-auth keyring unsupported platform"
+      }
+    );
+  }
+  if (linuxMissingTool && config.isNonInteractiveOrCI()) {
+    throw new UserError(message, {
+      telemetryMessage: "workers-auth keyring secret tool missing"
+    });
+  }
+  const flags = getResolverSessionFlags();
+  if (linuxMissingTool) {
+    if (!flags.hasWarnedAboutSecretToolMissing) {
+      flags.hasWarnedAboutSecretToolMissing = true;
+      config.logger.warn(
+        `${message}
+
+Falling back to the plaintext credentials file for this session.`
+      );
+    }
+    return new FileCredentialStore(
+      config.getConfigPath(),
+      profile,
+      config.format
+    );
+  }
+  return fallbackToFileWithWarning(message, config, profile);
+}
+__name(handleUnsupported, "handleUnsupported");
+function fallbackToFileWithWarning(message, config, profile) {
+  const flags = getResolverSessionFlags();
+  if (!flags.hasWarnedAboutKeyringFallback) {
+    flags.hasWarnedAboutKeyringFallback = true;
+    config.logger.warn(message);
+  }
+  return new FileCredentialStore(
+    config.getConfigPath(),
+    profile,
+    config.format
+  );
+}
+__name(fallbackToFileWithWarning, "fallbackToFileWithWarning");
+function secretToolMissingMessage(loginCommand) {
+  return `\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
+
+Install it via your package manager:
+  Debian/Ubuntu:  sudo apt-get install libsecret-tools
+  Fedora/RHEL:    sudo dnf install libsecret
+  Arch:           sudo pacman -S libsecret
+  Alpine:         apk add libsecret
+
+Or disable keyring storage: \`${loginCommand} --no-use-keyring\`.`;
+}
+__name(secretToolMissingMessage, "secretToolMissingMessage");
+function windowsBindingMissingMessage(loginCommand) {
+  return `\`@napi-rs/keyring\` is required for OS keyring storage on Windows but is not installed.
+
+Run \`${loginCommand} --use-keyring\` interactively to install it automatically, or install it globally for CI:
+
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}
+
+Or disable keyring storage: \`${loginCommand} --no-use-keyring\`.`;
+}
+__name(windowsBindingMissingMessage, "windowsBindingMissingMessage");
+function scrubEncryptedCredentials(options) {
+  const encryptedPath = getEncryptedAuthConfigFilePath(
+    options.configPath,
+    options.profile
+  );
+  const encryptedFileExisted = existsSync(encryptedPath);
+  const resolution = resolveKeyProvider(
+    options.serviceName,
+    options.profile,
+    options.configPath
+  );
+  if (resolution.kind === "available") {
+    new EncryptedFileCredentialStore(
+      options.configPath,
+      resolution.provider,
+      void 0,
+      options.profile,
+      options.format ?? "toml"
+    ).clear();
+    return { backendAvailable: true, encryptedFileExisted };
+  }
+  if (encryptedFileExisted) {
+    rmSync(encryptedPath);
+  }
+  return { backendAvailable: false, encryptedFileExisted };
+}
+__name(scrubEncryptedCredentials, "scrubEncryptedCredentials");
+/*! Bundled license information:
+
+smol-toml/dist/error.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/util.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/date.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/primitive.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/extract.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/struct.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/parse.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/stringify.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+
+smol-toml/dist/index.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+*/
+
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateProfileName };