@cloudflare/workers-auth 0.4.2 → 0.5.0

package/dist/chunk-WJE5I5WS.mjs

@@ -0,0 +1,1356 @@
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-FX4KV7FS.mjs';
+import { __name } from './chunk-O6YSETKJ.mjs';
+import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
+import path3 from 'node:path';
+import { URLSearchParams } from 'node:url';
+import { readFileSync, isNonInteractiveOrCI, createConfigCache, openInBrowser, UserError, fetchInternalBase, hasMorePages, throwFetchError, isCI, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
+
+function createPreferences(getConfigPath) {
+  function getUserPreferencesPath() {
+    return path3.resolve(getConfigPath(), "preferences.json");
+  }
+  __name(getUserPreferencesPath, "getUserPreferencesPath");
+  function readUserPreferences() {
+    try {
+      const raw = readFileSync$1(getUserPreferencesPath(), "utf8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed === "object" && parsed !== null) {
+        return parsed;
+      }
+      return {};
+    } catch {
+      return {};
+    }
+  }
+  __name(readUserPreferences, "readUserPreferences");
+  function updateUserPreferences(update) {
+    const current = readUserPreferences();
+    const next = { ...current, ...update };
+    const filePath = getUserPreferencesPath();
+    mkdirSync(path3.dirname(filePath), { recursive: true });
+    writeFileSync(filePath, JSON.stringify(next, null, "	"), {
+      encoding: "utf-8"
+    });
+  }
+  __name(updateUserPreferences, "updateUserPreferences");
+  return { readUserPreferences, updateUserPreferences };
+}
+__name(createPreferences, "createPreferences");
+var millisecondsInMinute = 6e4;
+var minutesInYear = 525600;
+var minutesInMonth = 43200;
+var minutesInDay = 1440;
+var constructFromSymbol = Symbol.for("constructDateFrom");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/constructFrom.js
+function constructFrom(date, value) {
+  if (typeof date === "function") return date(value);
+  if (date && typeof date === "object" && constructFromSymbol in date)
+    return date[constructFromSymbol](value);
+  if (date instanceof Date) return new date.constructor(value);
+  return new Date(value);
+}
+__name(constructFrom, "constructFrom");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/toDate.js
+function toDate(argument, context) {
+  return constructFrom(context || argument, argument);
+}
+__name(toDate, "toDate");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/_lib/defaultOptions.js
+var defaultOptions = {};
+function getDefaultOptions() {
+  return defaultOptions;
+}
+__name(getDefaultOptions, "getDefaultOptions");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/_lib/getTimezoneOffsetInMilliseconds.js
+function getTimezoneOffsetInMilliseconds(date) {
+  const _date = toDate(date);
+  const utcDate = new Date(
+    Date.UTC(
+      _date.getFullYear(),
+      _date.getMonth(),
+      _date.getDate(),
+      _date.getHours(),
+      _date.getMinutes(),
+      _date.getSeconds(),
+      _date.getMilliseconds()
+    )
+  );
+  utcDate.setUTCFullYear(_date.getFullYear());
+  return +date - +utcDate;
+}
+__name(getTimezoneOffsetInMilliseconds, "getTimezoneOffsetInMilliseconds");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/_lib/normalizeDates.js
+function normalizeDates(context, ...dates) {
+  const normalize = constructFrom.bind(
+    null,
+    context || dates.find((date) => typeof date === "object")
+  );
+  return dates.map(normalize);
+}
+__name(normalizeDates, "normalizeDates");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/compareAsc.js
+function compareAsc(dateLeft, dateRight) {
+  const diff = +toDate(dateLeft) - +toDate(dateRight);
+  if (diff < 0) return -1;
+  else if (diff > 0) return 1;
+  return diff;
+}
+__name(compareAsc, "compareAsc");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/constructNow.js
+function constructNow(date) {
+  return constructFrom(date, Date.now());
+}
+__name(constructNow, "constructNow");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/_lib/getRoundingMethod.js
+function getRoundingMethod(method) {
+  return (number) => {
+    const round = method ? Math[method] : Math.trunc;
+    const result = round(number);
+    return result === 0 ? 0 : result;
+  };
+}
+__name(getRoundingMethod, "getRoundingMethod");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/en-US/_lib/formatDistance.js
+var formatDistanceLocale = {
+  lessThanXSeconds: {
+    one: "less than a second",
+    other: "less than {{count}} seconds"
+  },
+  xSeconds: {
+    one: "1 second",
+    other: "{{count}} seconds"
+  },
+  halfAMinute: "half a minute",
+  lessThanXMinutes: {
+    one: "less than a minute",
+    other: "less than {{count}} minutes"
+  },
+  xMinutes: {
+    one: "1 minute",
+    other: "{{count}} minutes"
+  },
+  aboutXHours: {
+    one: "about 1 hour",
+    other: "about {{count}} hours"
+  },
+  xHours: {
+    one: "1 hour",
+    other: "{{count}} hours"
+  },
+  xDays: {
+    one: "1 day",
+    other: "{{count}} days"
+  },
+  aboutXWeeks: {
+    one: "about 1 week",
+    other: "about {{count}} weeks"
+  },
+  xWeeks: {
+    one: "1 week",
+    other: "{{count}} weeks"
+  },
+  aboutXMonths: {
+    one: "about 1 month",
+    other: "about {{count}} months"
+  },
+  xMonths: {
+    one: "1 month",
+    other: "{{count}} months"
+  },
+  aboutXYears: {
+    one: "about 1 year",
+    other: "about {{count}} years"
+  },
+  xYears: {
+    one: "1 year",
+    other: "{{count}} years"
+  },
+  overXYears: {
+    one: "over 1 year",
+    other: "over {{count}} years"
+  },
+  almostXYears: {
+    one: "almost 1 year",
+    other: "almost {{count}} years"
+  }
+};
+var formatDistance = /* @__PURE__ */ __name((token, count, options) => {
+  let result;
+  const tokenValue = formatDistanceLocale[token];
+  if (typeof tokenValue === "string") {
+    result = tokenValue;
+  } else if (count === 1) {
+    result = tokenValue.one;
+  } else {
+    result = tokenValue.other.replace("{{count}}", count.toString());
+  }
+  if (options?.addSuffix) {
+    if (options.comparison && options.comparison > 0) {
+      return "in " + result;
+    } else {
+      return result + " ago";
+    }
+  }
+  return result;
+}, "formatDistance");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildFormatLongFn.js
+function buildFormatLongFn(args) {
+  return (options = {}) => {
+    const width = options.width ? String(options.width) : args.defaultWidth;
+    const format = args.formats[width] || args.formats[args.defaultWidth];
+    return format;
+  };
+}
+__name(buildFormatLongFn, "buildFormatLongFn");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/en-US/_lib/formatLong.js
+var dateFormats = {
+  full: "EEEE, MMMM do, y",
+  long: "MMMM do, y",
+  medium: "MMM d, y",
+  short: "MM/dd/yyyy"
+};
+var timeFormats = {
+  full: "h:mm:ss a zzzz",
+  long: "h:mm:ss a z",
+  medium: "h:mm:ss a",
+  short: "h:mm a"
+};
+var dateTimeFormats = {
+  full: "{{date}} 'at' {{time}}",
+  long: "{{date}} 'at' {{time}}",
+  medium: "{{date}}, {{time}}",
+  short: "{{date}}, {{time}}"
+};
+var formatLong = {
+  date: buildFormatLongFn({
+    formats: dateFormats,
+    defaultWidth: "full"
+  }),
+  time: buildFormatLongFn({
+    formats: timeFormats,
+    defaultWidth: "full"
+  }),
+  dateTime: buildFormatLongFn({
+    formats: dateTimeFormats,
+    defaultWidth: "full"
+  })
+};
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/en-US/_lib/formatRelative.js
+var formatRelativeLocale = {
+  lastWeek: "'last' eeee 'at' p",
+  yesterday: "'yesterday at' p",
+  today: "'today at' p",
+  tomorrow: "'tomorrow at' p",
+  nextWeek: "eeee 'at' p",
+  other: "P"
+};
+var formatRelative = /* @__PURE__ */ __name((token, _date, _baseDate, _options) => formatRelativeLocale[token], "formatRelative");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildLocalizeFn.js
+function buildLocalizeFn(args) {
+  return (value, options) => {
+    const context = options?.context ? String(options.context) : "standalone";
+    let valuesArray;
+    if (context === "formatting" && args.formattingValues) {
+      const defaultWidth = args.defaultFormattingWidth || args.defaultWidth;
+      const width = options?.width ? String(options.width) : defaultWidth;
+      valuesArray = args.formattingValues[width] || args.formattingValues[defaultWidth];
+    } else {
+      const defaultWidth = args.defaultWidth;
+      const width = options?.width ? String(options.width) : args.defaultWidth;
+      valuesArray = args.values[width] || args.values[defaultWidth];
+    }
+    const index = args.argumentCallback ? args.argumentCallback(value) : value;
+    return valuesArray[index];
+  };
+}
+__name(buildLocalizeFn, "buildLocalizeFn");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/en-US/_lib/localize.js
+var eraValues = {
+  narrow: ["B", "A"],
+  abbreviated: ["BC", "AD"],
+  wide: ["Before Christ", "Anno Domini"]
+};
+var quarterValues = {
+  narrow: ["1", "2", "3", "4"],
+  abbreviated: ["Q1", "Q2", "Q3", "Q4"],
+  wide: ["1st quarter", "2nd quarter", "3rd quarter", "4th quarter"]
+};
+var monthValues = {
+  narrow: ["J", "F", "M", "A", "M", "J", "J", "A", "S", "O", "N", "D"],
+  abbreviated: [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec"
+  ],
+  wide: [
+    "January",
+    "February",
+    "March",
+    "April",
+    "May",
+    "June",
+    "July",
+    "August",
+    "September",
+    "October",
+    "November",
+    "December"
+  ]
+};
+var dayValues = {
+  narrow: ["S", "M", "T", "W", "T", "F", "S"],
+  short: ["Su", "Mo", "Tu", "We", "Th", "Fr", "Sa"],
+  abbreviated: ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"],
+  wide: [
+    "Sunday",
+    "Monday",
+    "Tuesday",
+    "Wednesday",
+    "Thursday",
+    "Friday",
+    "Saturday"
+  ]
+};
+var dayPeriodValues = {
+  narrow: {
+    am: "a",
+    pm: "p",
+    midnight: "mi",
+    noon: "n",
+    morning: "morning",
+    afternoon: "afternoon",
+    evening: "evening",
+    night: "night"
+  },
+  abbreviated: {
+    am: "AM",
+    pm: "PM",
+    midnight: "midnight",
+    noon: "noon",
+    morning: "morning",
+    afternoon: "afternoon",
+    evening: "evening",
+    night: "night"
+  },
+  wide: {
+    am: "a.m.",
+    pm: "p.m.",
+    midnight: "midnight",
+    noon: "noon",
+    morning: "morning",
+    afternoon: "afternoon",
+    evening: "evening",
+    night: "night"
+  }
+};
+var formattingDayPeriodValues = {
+  narrow: {
+    am: "a",
+    pm: "p",
+    midnight: "mi",
+    noon: "n",
+    morning: "in the morning",
+    afternoon: "in the afternoon",
+    evening: "in the evening",
+    night: "at night"
+  },
+  abbreviated: {
+    am: "AM",
+    pm: "PM",
+    midnight: "midnight",
+    noon: "noon",
+    morning: "in the morning",
+    afternoon: "in the afternoon",
+    evening: "in the evening",
+    night: "at night"
+  },
+  wide: {
+    am: "a.m.",
+    pm: "p.m.",
+    midnight: "midnight",
+    noon: "noon",
+    morning: "in the morning",
+    afternoon: "in the afternoon",
+    evening: "in the evening",
+    night: "at night"
+  }
+};
+var ordinalNumber = /* @__PURE__ */ __name((dirtyNumber, _options) => {
+  const number = Number(dirtyNumber);
+  const rem100 = number % 100;
+  if (rem100 > 20 || rem100 < 10) {
+    switch (rem100 % 10) {
+      case 1:
+        return number + "st";
+      case 2:
+        return number + "nd";
+      case 3:
+        return number + "rd";
+    }
+  }
+  return number + "th";
+}, "ordinalNumber");
+var localize = {
+  ordinalNumber,
+  era: buildLocalizeFn({
+    values: eraValues,
+    defaultWidth: "wide"
+  }),
+  quarter: buildLocalizeFn({
+    values: quarterValues,
+    defaultWidth: "wide",
+    argumentCallback: /* @__PURE__ */ __name((quarter) => quarter - 1, "argumentCallback")
+  }),
+  month: buildLocalizeFn({
+    values: monthValues,
+    defaultWidth: "wide"
+  }),
+  day: buildLocalizeFn({
+    values: dayValues,
+    defaultWidth: "wide"
+  }),
+  dayPeriod: buildLocalizeFn({
+    values: dayPeriodValues,
+    defaultWidth: "wide",
+    formattingValues: formattingDayPeriodValues,
+    defaultFormattingWidth: "wide"
+  })
+};
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildMatchFn.js
+function buildMatchFn(args) {
+  return (string, options = {}) => {
+    const width = options.width;
+    const matchPattern = width && args.matchPatterns[width] || args.matchPatterns[args.defaultMatchWidth];
+    const matchResult = string.match(matchPattern);
+    if (!matchResult) {
+      return null;
+    }
+    const matchedString = matchResult[0];
+    const parsePatterns = width && args.parsePatterns[width] || args.parsePatterns[args.defaultParseWidth];
+    const key = Array.isArray(parsePatterns) ? findIndex(parsePatterns, (pattern) => pattern.test(matchedString)) : (
+      // [TODO] -- I challenge you to fix the type
+      findKey(parsePatterns, (pattern) => pattern.test(matchedString))
+    );
+    let value;
+    value = args.valueCallback ? args.valueCallback(key) : key;
+    value = options.valueCallback ? (
+      // [TODO] -- I challenge you to fix the type
+      options.valueCallback(value)
+    ) : value;
+    const rest = string.slice(matchedString.length);
+    return { value, rest };
+  };
+}
+__name(buildMatchFn, "buildMatchFn");
+function findKey(object, predicate) {
+  for (const key in object) {
+    if (Object.prototype.hasOwnProperty.call(object, key) && predicate(object[key])) {
+      return key;
+    }
+  }
+  return void 0;
+}
+__name(findKey, "findKey");
+function findIndex(array, predicate) {
+  for (let key = 0; key < array.length; key++) {
+    if (predicate(array[key])) {
+      return key;
+    }
+  }
+  return void 0;
+}
+__name(findIndex, "findIndex");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/_lib/buildMatchPatternFn.js
+function buildMatchPatternFn(args) {
+  return (string, options = {}) => {
+    const matchResult = string.match(args.matchPattern);
+    if (!matchResult) return null;
+    const matchedString = matchResult[0];
+    const parseResult = string.match(args.parsePattern);
+    if (!parseResult) return null;
+    let value = args.valueCallback ? args.valueCallback(parseResult[0]) : parseResult[0];
+    value = options.valueCallback ? options.valueCallback(value) : value;
+    const rest = string.slice(matchedString.length);
+    return { value, rest };
+  };
+}
+__name(buildMatchPatternFn, "buildMatchPatternFn");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/en-US/_lib/match.js
+var matchOrdinalNumberPattern = /^(\d+)(th|st|nd|rd)?/i;
+var parseOrdinalNumberPattern = /\d+/i;
+var matchEraPatterns = {
+  narrow: /^(b|a)/i,
+  abbreviated: /^(b\.?\s?c\.?|b\.?\s?c\.?\s?e\.?|a\.?\s?d\.?|c\.?\s?e\.?)/i,
+  wide: /^(before christ|before common era|anno domini|common era)/i
+};
+var parseEraPatterns = {
+  any: [/^b/i, /^(a|c)/i]
+};
+var matchQuarterPatterns = {
+  narrow: /^[1234]/i,
+  abbreviated: /^q[1234]/i,
+  wide: /^[1234](th|st|nd|rd)? quarter/i
+};
+var parseQuarterPatterns = {
+  any: [/1/i, /2/i, /3/i, /4/i]
+};
+var matchMonthPatterns = {
+  narrow: /^[jfmasond]/i,
+  abbreviated: /^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)/i,
+  wide: /^(january|february|march|april|may|june|july|august|september|october|november|december)/i
+};
+var parseMonthPatterns = {
+  narrow: [
+    /^j/i,
+    /^f/i,
+    /^m/i,
+    /^a/i,
+    /^m/i,
+    /^j/i,
+    /^j/i,
+    /^a/i,
+    /^s/i,
+    /^o/i,
+    /^n/i,
+    /^d/i
+  ],
+  any: [
+    /^ja/i,
+    /^f/i,
+    /^mar/i,
+    /^ap/i,
+    /^may/i,
+    /^jun/i,
+    /^jul/i,
+    /^au/i,
+    /^s/i,
+    /^o/i,
+    /^n/i,
+    /^d/i
+  ]
+};
+var matchDayPatterns = {
+  narrow: /^[smtwf]/i,
+  short: /^(su|mo|tu|we|th|fr|sa)/i,
+  abbreviated: /^(sun|mon|tue|wed|thu|fri|sat)/i,
+  wide: /^(sunday|monday|tuesday|wednesday|thursday|friday|saturday)/i
+};
+var parseDayPatterns = {
+  narrow: [/^s/i, /^m/i, /^t/i, /^w/i, /^t/i, /^f/i, /^s/i],
+  any: [/^su/i, /^m/i, /^tu/i, /^w/i, /^th/i, /^f/i, /^sa/i]
+};
+var matchDayPeriodPatterns = {
+  narrow: /^(a|p|mi|n|(in the|at) (morning|afternoon|evening|night))/i,
+  any: /^([ap]\.?\s?m\.?|midnight|noon|(in the|at) (morning|afternoon|evening|night))/i
+};
+var parseDayPeriodPatterns = {
+  any: {
+    am: /^a/i,
+    pm: /^p/i,
+    midnight: /^mi/i,
+    noon: /^no/i,
+    morning: /morning/i,
+    afternoon: /afternoon/i,
+    evening: /evening/i,
+    night: /night/i
+  }
+};
+var match = {
+  ordinalNumber: buildMatchPatternFn({
+    matchPattern: matchOrdinalNumberPattern,
+    parsePattern: parseOrdinalNumberPattern,
+    valueCallback: /* @__PURE__ */ __name((value) => parseInt(value, 10), "valueCallback")
+  }),
+  era: buildMatchFn({
+    matchPatterns: matchEraPatterns,
+    defaultMatchWidth: "wide",
+    parsePatterns: parseEraPatterns,
+    defaultParseWidth: "any"
+  }),
+  quarter: buildMatchFn({
+    matchPatterns: matchQuarterPatterns,
+    defaultMatchWidth: "wide",
+    parsePatterns: parseQuarterPatterns,
+    defaultParseWidth: "any",
+    valueCallback: /* @__PURE__ */ __name((index) => index + 1, "valueCallback")
+  }),
+  month: buildMatchFn({
+    matchPatterns: matchMonthPatterns,
+    defaultMatchWidth: "wide",
+    parsePatterns: parseMonthPatterns,
+    defaultParseWidth: "any"
+  }),
+  day: buildMatchFn({
+    matchPatterns: matchDayPatterns,
+    defaultMatchWidth: "wide",
+    parsePatterns: parseDayPatterns,
+    defaultParseWidth: "any"
+  }),
+  dayPeriod: buildMatchFn({
+    matchPatterns: matchDayPeriodPatterns,
+    defaultMatchWidth: "any",
+    parsePatterns: parseDayPeriodPatterns,
+    defaultParseWidth: "any"
+  })
+};
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/locale/en-US.js
+var enUS = {
+  code: "en-US",
+  formatDistance,
+  formatLong,
+  formatRelative,
+  localize,
+  match,
+  options: {
+    weekStartsOn: 0,
+    firstWeekContainsDate: 1
+  }
+};
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/formatDistanceStrict.js
+function formatDistanceStrict(laterDate, earlierDate, options) {
+  const defaultOptions2 = getDefaultOptions();
+  const locale = options?.locale ?? defaultOptions2.locale ?? enUS;
+  const comparison = compareAsc(laterDate, earlierDate);
+  if (isNaN(comparison)) {
+    throw new RangeError("Invalid time value");
+  }
+  const localizeOptions = Object.assign({}, options, {
+    addSuffix: options?.addSuffix,
+    comparison
+  });
+  const [laterDate_, earlierDate_] = normalizeDates(
+    options?.in,
+    ...comparison > 0 ? [earlierDate, laterDate] : [laterDate, earlierDate]
+  );
+  const roundingMethod = getRoundingMethod(options?.roundingMethod ?? "round");
+  const milliseconds = earlierDate_.getTime() - laterDate_.getTime();
+  const minutes = milliseconds / millisecondsInMinute;
+  const timezoneOffset = getTimezoneOffsetInMilliseconds(earlierDate_) - getTimezoneOffsetInMilliseconds(laterDate_);
+  const dstNormalizedMinutes = (milliseconds - timezoneOffset) / millisecondsInMinute;
+  const defaultUnit = options?.unit;
+  let unit;
+  if (!defaultUnit) {
+    if (minutes < 1) {
+      unit = "second";
+    } else if (minutes < 60) {
+      unit = "minute";
+    } else if (minutes < minutesInDay) {
+      unit = "hour";
+    } else if (dstNormalizedMinutes < minutesInMonth) {
+      unit = "day";
+    } else if (dstNormalizedMinutes < minutesInYear) {
+      unit = "month";
+    } else {
+      unit = "year";
+    }
+  } else {
+    unit = defaultUnit;
+  }
+  if (unit === "second") {
+    const seconds = roundingMethod(milliseconds / 1e3);
+    return locale.formatDistance("xSeconds", seconds, localizeOptions);
+  } else if (unit === "minute") {
+    const roundedMinutes = roundingMethod(minutes);
+    return locale.formatDistance("xMinutes", roundedMinutes, localizeOptions);
+  } else if (unit === "hour") {
+    const hours = roundingMethod(minutes / 60);
+    return locale.formatDistance("xHours", hours, localizeOptions);
+  } else if (unit === "day") {
+    const days = roundingMethod(dstNormalizedMinutes / minutesInDay);
+    return locale.formatDistance("xDays", days, localizeOptions);
+  } else if (unit === "month") {
+    const months = roundingMethod(dstNormalizedMinutes / minutesInMonth);
+    return months === 12 && defaultUnit !== "month" ? locale.formatDistance("xYears", 1, localizeOptions) : locale.formatDistance("xMonths", months, localizeOptions);
+  } else {
+    const years = roundingMethod(dstNormalizedMinutes / minutesInYear);
+    return locale.formatDistance("xYears", years, localizeOptions);
+  }
+}
+__name(formatDistanceStrict, "formatDistanceStrict");
+
+// ../../node_modules/.pnpm/date-fns@4.1.0/node_modules/date-fns/formatDistanceToNowStrict.js
+function formatDistanceToNowStrict(date, options) {
+  return formatDistanceStrict(date, constructNow(date), options);
+}
+__name(formatDistanceToNowStrict, "formatDistanceToNowStrict");
+function createFileStorage(format, getPath) {
+  return {
+    read: /* @__PURE__ */ __name(() => {
+      const filePath = getPath();
+      if (!existsSync(filePath)) {
+        return void 0;
+      }
+      const contents = readFileSync(filePath);
+      try {
+        return parseFile(format, contents);
+      } catch {
+        return void 0;
+      }
+    }, "read"),
+    write(config) {
+      const configPath = getPath();
+      mkdirSync(path3.dirname(configPath), { recursive: true });
+      writeFileSync(configPath, stringifyFile(format, config), {
+        encoding: "utf-8",
+        mode: 384
+      });
+      chmodSync(configPath, 384);
+    },
+    clear() {
+      const configPath = getPath();
+      const existed = existsSync(configPath);
+      rmSync(configPath, { force: true });
+      return existed;
+    },
+    path: getPath
+  };
+}
+__name(createFileStorage, "createFileStorage");
+function createTemporaryTermsPrompt(deps) {
+  const { logger, prompt } = deps;
+  return /* @__PURE__ */ __name(async function ensureTemporaryTermsAccepted(question, notice) {
+    if (isNonInteractiveOrCI()) {
+      logger.log(notice);
+      return true;
+    }
+    const answer = await prompt(question);
+    return typeof answer === "string" && answer.trim().toLowerCase() === "yes";
+  }, "ensureTemporaryTermsAccepted");
+}
+__name(createTemporaryTermsPrompt, "createTemporaryTermsPrompt");
+
+// src/core/factory.ts
+var MEMBERSHIPS_INACCESSIBLE_CODES = [9106, 1e4];
+function getErrorCode(err) {
+  return err?.code;
+}
+__name(getErrorCode, "getErrorCode");
+function isMembershipsInaccessible(err) {
+  const code = getErrorCode(err);
+  return code !== void 0 && MEMBERSHIPS_INACCESSIBLE_CODES.includes(code);
+}
+__name(isMembershipsInaccessible, "isMembershipsInaccessible");
+function notLoggedInErrorBodies(loginCommand) {
+  return {
+    "no-credentials-non-interactive": `Could not authenticate because no credentials were found and the environment is non-interactive. Set a CLOUDFLARE_API_TOKEN environment variable or run \`${loginCommand}\` in an interactive terminal first.`,
+    "no-credentials-login-failed": `No credentials were found and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`,
+    "token-expired-non-interactive": `Your auth token has expired and could not be refreshed, and the environment is non-interactive. Run \`${loginCommand}\` in an interactive terminal or set a CLOUDFLARE_API_TOKEN.`,
+    "token-expired-login-failed": `Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`
+  };
+}
+__name(notLoggedInErrorBodies, "notLoggedInErrorBodies");
+function logTemporaryPreviewAccount(logger, temporaryPreviewAccount, cached) {
+  const claimExpiresAt = new Date(temporaryPreviewAccount.claim.expiresAt);
+  logger.log(
+    dedent`
+			Temporary account ready:
+				Account: ${temporaryPreviewAccount.account.name} (${cached ? "reused" : "created"})
+				Claim within: ${formatDistanceToNowStrict(claimExpiresAt)}
+				Claim URL: ${temporaryPreviewAccount.claim.url}
+		`
+  );
+}
+__name(logTemporaryPreviewAccount, "logTemporaryPreviewAccount");
+function createCloudflareAuth(descriptor, ctx) {
+  const { logger } = ctx;
+  const cliName = descriptor.cliName;
+  const NOT_LOGGED_IN_ERROR_BODIES = notLoggedInErrorBodies(
+    descriptor.commands.login
+  );
+  const NOT_LOGGED_IN_WHOAMI_TIP = `
+Run \`${descriptor.commands.whoami}\` to check your current authentication status.`;
+  const preferences = createPreferences(descriptor.getConfigPath);
+  const configCache = createConfigCache(
+    logger,
+    descriptor.cacheNamespace ? { namespace: descriptor.cacheNamespace } : void 0
+  );
+  const credentialStorage = createCredentialStorageContext({
+    serviceName: descriptor.keyringServiceName,
+    getConfigPath: descriptor.getConfigPath,
+    isKeyringEnabled: /* @__PURE__ */ __name(() => preferences.readUserPreferences().keyring_enabled === true, "isKeyringEnabled"),
+    logger,
+    isNonInteractiveOrCI: isNonInteractiveOrCI,
+    loginCommand: descriptor.commands.login,
+    format: descriptor.fileFormat
+  });
+  const allowGlobalAuthKey = descriptor.allowGlobalAuthKey ?? true;
+  const oauthFlow = createOAuthFlow({
+    logger,
+    isNonInteractiveOrCI: isNonInteractiveOrCI,
+    openInBrowser: /* @__PURE__ */ __name((url) => openInBrowser(url, logger), "openInBrowser"),
+    hasEnvCredentials: /* @__PURE__ */ __name(() => getAuthFromEnv({ allowGlobalAuthKey }) !== void 0, "hasEnvCredentials"),
+    purgeOnLoginOrLogout: configCache.purgeConfigCaches,
+    clientId: descriptor.clientId,
+    consent: descriptor.consent,
+    redirectUri: descriptor.redirectUri,
+    storageFactory: credentialStorage.storageFactory,
+    allowGlobalAuthKey,
+    temporary: {
+      // The temporary-preview-account cache is CLI-owned storage (a
+      // file under the global config dir, scoped to the Cloudflare API
+      // environment), so it's built here rather than injected.
+      storage: createFileStorage(
+        descriptor.fileFormat,
+        descriptor.getTemporaryAccountConfigPath
+      ),
+      prompt: createTemporaryTermsPrompt({ logger, prompt: ctx.prompt })
+    }
+  });
+  function setProfile(profile) {
+    oauthFlow.setProfile(profile);
+  }
+  __name(setProfile, "setProfile");
+  function getActiveProfile() {
+    return oauthFlow.getActiveProfile();
+  }
+  __name(getActiveProfile, "getActiveProfile");
+  function getCredentialStore() {
+    return credentialStorage.getActiveStore(oauthFlow.getActiveProfile());
+  }
+  __name(getCredentialStore, "getCredentialStore");
+  function setTemporaryAllowed(allowed) {
+    oauthFlow.setTemporaryAllowed(allowed);
+  }
+  __name(setTemporaryAllowed, "setTemporaryAllowed");
+  function getAPIToken() {
+    return oauthFlow.getAPIToken();
+  }
+  __name(getAPIToken, "getAPIToken");
+  function requireApiToken() {
+    return oauthFlow.requireApiToken();
+  }
+  __name(requireApiToken, "requireApiToken");
+  function withDefaultScopes(complianceConfig, props) {
+    return {
+      complianceConfig,
+      scopes: props?.scopes ?? descriptor.getDefaultScopeKeys(),
+      browser: props?.browser ?? true,
+      callbackHost: props?.callbackHost,
+      callbackPort: props?.callbackPort,
+      profile: props?.profile
+    };
+  }
+  __name(withDefaultScopes, "withDefaultScopes");
+  async function login(complianceConfig, props) {
+    return oauthFlow.login(withDefaultScopes(complianceConfig, props));
+  }
+  __name(login, "login");
+  async function logout(profile) {
+    return oauthFlow.logout(profile);
+  }
+  __name(logout, "logout");
+  async function loginOrRefreshIfRequired(complianceConfig, props) {
+    if (oauthFlow.getActiveTemporaryAccount()) {
+      return { loggedIn: true };
+    }
+    return oauthFlow.loginOrRefreshIfRequired(
+      withDefaultScopes(complianceConfig, props)
+    );
+  }
+  __name(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
+  async function getOAuthTokenFromLocalState() {
+    return oauthFlow.getOAuthTokenFromLocalState();
+  }
+  __name(getOAuthTokenFromLocalState, "getOAuthTokenFromLocalState");
+  function getScopes() {
+    return oauthFlow.getScopes();
+  }
+  __name(getScopes, "getScopes");
+  function readAuthCredentials() {
+    return credentialStorage.storageFactory(getActiveProfile()).read();
+  }
+  __name(readAuthCredentials, "readAuthCredentials");
+  function writeAuthCredentials(config) {
+    credentialStorage.storageFactory(getActiveProfile()).write(config);
+  }
+  __name(writeAuthCredentials, "writeAuthCredentials");
+  function getAccountCacheFileName() {
+    const profile = oauthFlow.getActiveProfile();
+    if (profile === "default") {
+      return `${descriptor.accountCachePrefix}.json`;
+    }
+    return `${descriptor.accountCachePrefix}-${profile}.json`;
+  }
+  __name(getAccountCacheFileName, "getAccountCacheFileName");
+  function saveAccountToCache(account) {
+    configCache.saveToConfigCache(
+      getAccountCacheFileName(),
+      { account }
+    );
+  }
+  __name(saveAccountToCache, "saveAccountToCache");
+  function getAccountFromCache() {
+    return configCache.getConfigCache(
+      getAccountCacheFileName()
+    ).account;
+  }
+  __name(getAccountFromCache, "getAccountFromCache");
+  async function fetchAccountsPaged(complianceConfig, resource) {
+    const result = await loginOrRefreshIfRequired(complianceConfig);
+    if (!result.loggedIn) {
+      throw new UserError(
+        `Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[result.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`,
+        { telemetryMessage: "cfetch auth login required" }
+      );
+    }
+    const credentials = requireApiToken();
+    const results = [];
+    let getMoreResults = true;
+    let page = 1;
+    let queryParams;
+    while (getMoreResults) {
+      queryParams = new URLSearchParams(queryParams);
+      queryParams.set("page", String(page));
+      const { response: json, status } = await fetchInternalBase(
+        complianceConfig,
+        resource,
+        {},
+        ctx.userAgent,
+        logger,
+        queryParams,
+        void 0,
+        credentials
+      );
+      if (json.success) {
+        results.push(...json.result);
+        if (hasMorePages(json.result_info)) {
+          page = page + 1;
+        } else {
+          getMoreResults = false;
+        }
+      } else {
+        throwFetchError(resource, json, status);
+      }
+    }
+    return results;
+  }
+  __name(fetchAccountsPaged, "fetchAccountsPaged");
+  async function fetchAllAccounts(complianceConfig, options = {}) {
+    const { throwOnEmpty = true } = options;
+    const [accountsRes, membershipsRes] = await Promise.allSettled([
+      fetchAccountsPaged(complianceConfig, `/accounts`),
+      fetchAccountsPaged(
+        complianceConfig,
+        `/memberships`
+      )
+    ]);
+    if (accountsRes.status === "rejected") {
+      throw accountsRes.reason;
+    }
+    if (membershipsRes.status === "rejected") {
+      if (isMembershipsInaccessible(membershipsRes.reason)) {
+        if (accountsRes.status === "fulfilled" && accountsRes.value.length > 0) {
+          return accountsRes.value;
+        }
+        const errCode = getErrorCode(membershipsRes.reason);
+        if (errCode === 9106) {
+          throw new UserError(
+            `Failed to automatically retrieve account IDs for the logged in user.
+You may have incorrect permissions on your API token, or an environment variable such as CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL may be set to an invalid value.
+Check your environment and unset or correct any Cloudflare credential variables, or run \`${descriptor.commands.login}\` to re-authenticate.
+You can also skip this account check by adding an \`account_id\` in your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
+            { telemetryMessage: "user account fetch permission denied" }
+          );
+        }
+        throw new UserError(
+          `Failed to automatically retrieve account IDs for the logged in user.
+You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${descriptor.commands.login}\` to re-authenticate. You can also skip this account check by adding an \`account_id\` in your ${descriptor.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,
+          { telemetryMessage: "user account fetch permission denied" }
+        );
+      } else {
+        throw membershipsRes.reason;
+      }
+    }
+    const membershipIds = new Set(
+      membershipsRes.value.map((m) => m.account.id)
+    );
+    const usableAccounts = accountsRes.value.filter(
+      (a) => membershipIds.has(a.id)
+    );
+    if (usableAccounts.length === 0 && throwOnEmpty) {
+      throw new UserError(
+        `Failed to automatically retrieve account IDs for the logged in user.
+In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or as \`account_id\` in your ${descriptor.getConfigFileLabel()} file.
+Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`,
+        { telemetryMessage: "user account fetch empty" }
+      );
+    }
+    return usableAccounts;
+  }
+  __name(fetchAllAccounts, "fetchAllAccounts");
+  function getActiveAccountId(config) {
+    const temporaryAccount = oauthFlow.getActiveTemporaryAccount();
+    if (temporaryAccount) {
+      return temporaryAccount.account.id;
+    }
+    if (config.account_id) {
+      return config.account_id;
+    }
+    const envAccountId = getCloudflareAccountIdFromEnv();
+    if (envAccountId) {
+      return envAccountId;
+    }
+    return getAccountFromCache()?.id;
+  }
+  __name(getActiveAccountId, "getActiveAccountId");
+  async function getOrSelectAccountId(config) {
+    const activeAccountId = getActiveAccountId(config);
+    if (activeAccountId) {
+      return activeAccountId;
+    }
+    const accounts = await fetchAllAccounts(config);
+    if (accounts.length === 1) {
+      saveAccountToCache({ id: accounts[0].id, name: accounts[0].name });
+      return accounts[0].id;
+    }
+    try {
+      const accountID = await ctx.select("Select an account", {
+        choices: accounts.map((account2) => ({
+          title: account2.name,
+          value: account2.id
+        }))
+      });
+      const account = accounts.find((a) => a.id === accountID);
+      if (!account) {
+        throw new Error("Selected account not found in accounts list");
+      }
+      saveAccountToCache({ id: account.id, name: account.name });
+      return accountID;
+    } catch (e) {
+      if (ctx.isNoDefaultValueProvidedError(e)) {
+        const redactAccountName = isCI();
+        throw new UserError(
+          `More than one account available but unable to select one in non-interactive mode.
+Please set the appropriate \`account_id\` in your ${descriptor.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
+Available accounts are (\`<name>\`: \`<account_id>\`):
+${accounts.map(
+            (account) => `  \`${redactAccountName ? "(redacted)" : account.name}\`: \`${account.id}\``
+          ).join("\n")}`,
+          { telemetryMessage: "user account selection unavailable" }
+        );
+      }
+      throw e;
+    }
+  }
+  __name(getOrSelectAccountId, "getOrSelectAccountId");
+  async function requireAuth(config) {
+    if (oauthFlow.isTemporaryAllowed()) {
+      if (getCloudflareComplianceRegion(config) !== "public") {
+        throw new UserError(
+          "Temporary accounts aren't available when the compliance region is not set to public.",
+          {
+            telemetryMessage: "user temporary account unavailable in compliance region"
+          }
+        );
+      }
+      if (getAPIToken()) {
+        throw new UserError(
+          "You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.",
+          {
+            telemetryMessage: "user temporary account already authenticated"
+          }
+        );
+      }
+      const { account: temporaryPreviewAccount, cached } = await oauthFlow.activateTemporaryAccount();
+      logTemporaryPreviewAccount(logger, temporaryPreviewAccount, cached);
+      return temporaryPreviewAccount.account.id;
+    }
+    const result = await loginOrRefreshIfRequired(config);
+    if (!result.loggedIn) {
+      if (result.reason === "no-credentials-non-interactive" || result.reason === "token-expired-non-interactive") {
+        throw new UserError(
+          `In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for ${cliName} to work. Please go to https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN.`,
+          { telemetryMessage: "user auth missing api token non interactive" }
+        );
+      } else {
+        throw new UserError("Did not login, quitting...", {
+          telemetryMessage: "user login cancelled"
+        });
+      }
+    }
+    const accountId = await getOrSelectAccountId(config);
+    if (!accountId) {
+      throw new UserError("No account id found, quitting...", {
+        telemetryMessage: "user auth missing account id"
+      });
+    }
+    return accountId;
+  }
+  __name(requireAuth, "requireAuth");
+  return {
+    setProfile,
+    getActiveProfile,
+    getCredentialStore,
+    setTemporaryAllowed,
+    getAPIToken,
+    requireApiToken,
+    login,
+    logout,
+    loginOrRefreshIfRequired,
+    getOAuthTokenFromLocalState,
+    getScopes,
+    readAuthCredentials,
+    writeAuthCredentials,
+    getActiveAccountId,
+    getOrSelectAccountId,
+    getAccountFromCache,
+    fetchAllAccounts,
+    requireAuth
+  };
+}
+__name(createCloudflareAuth, "createCloudflareAuth");
+var DIRECTORY_BINDINGS_FILE = "profiles/directory-bindings.json";
+var ENCRYPTED_PROFILE_CONFIG_EXTENSION = ".enc";
+function createCloudflareProfileStore(ctx) {
+  const { logger, getConfigPath, keyringServiceName, format } = ctx;
+  const plaintextExtension = `.${format}`;
+  function plaintextPath(profile) {
+    return getAuthConfigFilePath(getConfigPath(), profile, format);
+  }
+  __name(plaintextPath, "plaintextPath");
+  function encryptedPath(profile) {
+    return getEncryptedAuthConfigFilePath(getConfigPath(), profile);
+  }
+  __name(encryptedPath, "encryptedPath");
+  function getProfileConfigDirectory() {
+    return path3.dirname(plaintextPath("default"));
+  }
+  __name(getProfileConfigDirectory, "getProfileConfigDirectory");
+  const configs = {
+    exists(profile) {
+      return existsSync(plaintextPath(profile)) || existsSync(encryptedPath(profile));
+    },
+    list() {
+      const profilesDir = getProfileConfigDirectory();
+      if (!existsSync(profilesDir)) {
+        return [];
+      }
+      const names = /* @__PURE__ */ new Set();
+      for (const file of readdirSync(profilesDir)) {
+        if (file.endsWith(plaintextExtension)) {
+          names.add(file.slice(0, -plaintextExtension.length));
+        } else if (file.endsWith(ENCRYPTED_PROFILE_CONFIG_EXTENSION)) {
+          names.add(file.slice(0, -ENCRYPTED_PROFILE_CONFIG_EXTENSION.length));
+        }
+      }
+      return [...names];
+    },
+    delete(profile) {
+      const { backendAvailable, encryptedFileExisted } = scrubEncryptedCredentials({
+        serviceName: keyringServiceName,
+        configPath: getConfigPath(),
+        profile,
+        format
+      });
+      createFileStorage(
+        format,
+        () => plaintextPath(profile)
+      ).clear();
+      if (encryptedFileExisted && !backendAvailable) {
+        logger.warn(
+          `Removed the credential files for profile "${profile}", but the keyring backend was not reachable on this host so its keyring entry could not be cleared. Clear it manually if it persists.`
+        );
+      }
+    }
+  };
+  function getDirectoryBindingsPath() {
+    return path3.join(getConfigPath(), DIRECTORY_BINDINGS_FILE);
+  }
+  __name(getDirectoryBindingsPath, "getDirectoryBindingsPath");
+  const bindings = {
+    read() {
+      try {
+        const raw = readFileSync$1(getDirectoryBindingsPath(), "utf-8");
+        return JSON.parse(raw);
+      } catch {
+        return {};
+      }
+    },
+    write(dirBindings) {
+      const bindingsPath = getDirectoryBindingsPath();
+      mkdirSync(path3.dirname(bindingsPath), { recursive: true });
+      writeFileSync(
+        bindingsPath,
+        JSON.stringify(dirBindings, null, "	"),
+        "utf-8"
+      );
+    }
+  };
+  return createProfileStore({ configs, bindings });
+}
+__name(createCloudflareProfileStore, "createCloudflareProfileStore");
+function createKeyringPreference(deps) {
+  const {
+    loginCommand,
+    createProfileCommand,
+    keyringServiceName,
+    getConfigPath,
+    format,
+    preferences
+  } = deps;
+  const { readUserPreferences, updateUserPreferences } = preferences;
+  function describeProfile(profile) {
+    return profile ?? "default";
+  }
+  __name(describeProfile, "describeProfile");
+  function listEncryptedProfiles(logger) {
+    const encrypted = [];
+    if (existsSync(getEncryptedAuthConfigFilePath(getConfigPath()))) {
+      encrypted.push(void 0);
+    }
+    const profileStore = createCloudflareProfileStore({
+      logger,
+      getConfigPath,
+      keyringServiceName,
+      format
+    });
+    for (const name of profileStore.configs.list()) {
+      try {
+        validateProfileName(name);
+      } catch {
+        continue;
+      }
+      if (existsSync(getEncryptedAuthConfigFilePath(getConfigPath(), name))) {
+        encrypted.push(name);
+      }
+    }
+    return encrypted;
+  }
+  __name(listEncryptedProfiles, "listEncryptedProfiles");
+  function scrubAllEncryptedProfiles(logger) {
+    const encryptedProfiles = listEncryptedProfiles(logger);
+    if (encryptedProfiles.length === 0) {
+      return;
+    }
+    const cleared = [];
+    const unreachable = [];
+    for (const profile of encryptedProfiles) {
+      try {
+        const { backendAvailable } = scrubEncryptedCredentials({
+          serviceName: keyringServiceName,
+          configPath: getConfigPath(),
+          profile,
+          format
+        });
+        cleared.push(describeProfile(profile));
+        if (!backendAvailable) {
+          unreachable.push(describeProfile(profile));
+        }
+      } catch (e) {
+        logger.warn(
+          `Failed to remove encrypted credentials for profile "${describeProfile(profile)}": ${e instanceof Error ? e.message : String(e)}. You may need to clear them manually.`
+        );
+      }
+    }
+    if (cleared.length > 0) {
+      const reauthenticate = createProfileCommand ? `Re-authenticate with \`${loginCommand}\` (default profile) or \`${createProfileCommand} <name>\` (named profiles).` : `Re-authenticate with \`${loginCommand}\`.`;
+      logger.log(
+        `Removed encrypted credentials for ${cleared.map((p) => `"${p}"`).join(", ")}. ${reauthenticate}`
+      );
+    }
+    if (unreachable.length > 0) {
+      logger.warn(
+        `The keyring backend was not reachable on this host, so the keyring entry for ${unreachable.map((p) => `"${p}"`).join(", ")} could not be cleared. Clear it manually if it persists.`
+      );
+    }
+  }
+  __name(scrubAllEncryptedProfiles, "scrubAllEncryptedProfiles");
+  function setKeyringPreference(enabled, ctx) {
+    const { logger, getCredentialStore } = ctx;
+    const previouslyEnabled = readUserPreferences().keyring_enabled === true;
+    const envOverride = getCloudflareAuthUseKeyringFromEnv();
+    if (envOverride !== void 0 && envOverride !== enabled) {
+      logger.warn(
+        `CLOUDFLARE_AUTH_USE_KEYRING=${envOverride} overrides ${enabled ? "enabling" : "disabling"} keyring storage for this command.`
+      );
+    }
+    if (!enabled && envOverride !== true) {
+      scrubAllEncryptedProfiles(logger);
+    }
+    updateUserPreferences({ keyring_enabled: enabled });
+    if (enabled && envOverride !== false) {
+      try {
+        const store = getCredentialStore();
+        if (store.kind !== "encrypted-file") {
+          updateUserPreferences({ keyring_enabled: previouslyEnabled });
+          logger.warn(
+            "Keyring storage isn't available on this host (see warning above), so it was not enabled. Try again once the keyring backend is reachable."
+          );
+        }
+      } catch (e) {
+        updateUserPreferences({ keyring_enabled: previouslyEnabled });
+        throw e;
+      }
+    }
+    return { enabled: readUserPreferences().keyring_enabled === true };
+  }
+  __name(setKeyringPreference, "setKeyringPreference");
+  return { setKeyringPreference };
+}
+__name(createKeyringPreference, "createKeyringPreference");
+
+// src/core/auth-config-file.ts
+function createAuthConfigFileHelpers(deps) {
+  const { getConfigPath, format } = deps;
+  function getAuthConfigFilePath2(profile) {
+    return getAuthConfigFilePath(getConfigPath(), profile, format);
+  }
+  __name(getAuthConfigFilePath2, "getAuthConfigFilePath");
+  function getEncryptedAuthConfigFilePath2(profile) {
+    return getEncryptedAuthConfigFilePath(getConfigPath(), profile);
+  }
+  __name(getEncryptedAuthConfigFilePath2, "getEncryptedAuthConfigFilePath");
+  function defaultAuthConfigStorage(profile) {
+    return createFileStorage(
+      format,
+      () => getAuthConfigFilePath2(profile)
+    );
+  }
+  __name(defaultAuthConfigStorage, "defaultAuthConfigStorage");
+  function writeAuthConfigFile(config, profile) {
+    defaultAuthConfigStorage(profile).write(config);
+  }
+  __name(writeAuthConfigFile, "writeAuthConfigFile");
+  function readAuthConfigFile(profile) {
+    return defaultAuthConfigStorage(profile).read();
+  }
+  __name(readAuthConfigFile, "readAuthConfigFile");
+  return {
+    getAuthConfigFilePath: getAuthConfigFilePath2,
+    getEncryptedAuthConfigFilePath: getEncryptedAuthConfigFilePath2,
+    defaultAuthConfigStorage,
+    readAuthConfigFile,
+    writeAuthConfigFile
+  };
+}
+__name(createAuthConfigFileHelpers, "createAuthConfigFileHelpers");
+
+export { createAuthConfigFileHelpers, createCloudflareAuth, createCloudflareProfileStore, createFileStorage, createKeyringPreference, createPreferences };