@cloudflare/workers-auth 0.4.2 → 0.5.1

package/dist/index.mjs

@@ -1,3666 +1,2 @@
-import { __name } from './chunk-O6YSETKJ.mjs';
-import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, parseTOML, readFileSync, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
-import { spawnSync } from 'node:child_process';
-import { fetch } from 'undici';
-import assert2 from 'node:assert';
-import http from 'node:http';
-import url from 'node:url';
-import { webcrypto, createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
-import { TextEncoder } from 'node:util';
-import path4 from 'node:path';
-import { existsSync, mkdirSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
-import { createRequire } from 'node:module';
-
-// src/state.ts
-var hasWarnedAboutDeprecatedV1ApiToken = false;
-function readStoredAuthState(options) {
-  const { configOverride, warningLogger, storage } = options;
-  const parsed = configOverride ?? storage.read() ?? {};
-  const { oauth_token, refresh_token, expiration_time, scopes, api_token } = parsed;
-  if (oauth_token) {
-    return {
-      accessToken: {
-        value: oauth_token,
-        // If there is no `expiration_time` field then set it to an old date, to cause it to expire immediately.
-        expiry: expiration_time ?? "2000-01-01:00:00:00+00:00"
-      },
-      refreshToken: { value: refresh_token ?? "" },
-      scopes
-    };
-  }
-  if (api_token) {
-    if (!hasWarnedAboutDeprecatedV1ApiToken && warningLogger) {
-      hasWarnedAboutDeprecatedV1ApiToken = true;
-      warningLogger.warn(
-        `It looks like you have used Wrangler v1's \`config\` command to login with an API token
-from ${configOverride === void 0 ? storage.path() : "in-memory config"}.
-This is no longer supported in the current version of Wrangler.
-If you wish to authenticate via an API token then please set the \`CLOUDFLARE_API_TOKEN\` environment variable.`
-      );
-    }
-    return { deprecatedApiToken: api_token };
-  }
-  return {};
-}
-__name(readStoredAuthState, "readStoredAuthState");
-
-// src/credentials.ts
-var getCloudflareAPITokenFromEnv = getEnvironmentVariableFactory({
-  variableName: "CLOUDFLARE_API_TOKEN",
-  deprecatedName: "CF_API_TOKEN"
-});
-var getCloudflareGlobalAuthKeyFromEnv = getEnvironmentVariableFactory({
-  variableName: "CLOUDFLARE_API_KEY",
-  deprecatedName: "CF_API_KEY"
-});
-var getCloudflareGlobalAuthEmailFromEnv = getEnvironmentVariableFactory({
-  variableName: "CLOUDFLARE_EMAIL",
-  deprecatedName: "CF_EMAIL"
-});
-function getAuthFromEnv(options) {
-  const allowGlobalAuthKey = options?.allowGlobalAuthKey ?? true;
-  if (allowGlobalAuthKey) {
-    const globalApiKey = getCloudflareGlobalAuthKeyFromEnv();
-    const globalApiEmail = getCloudflareGlobalAuthEmailFromEnv();
-    if (globalApiKey && globalApiEmail) {
-      return { authKey: globalApiKey, authEmail: globalApiEmail };
-    }
-  }
-  const apiToken = getCloudflareAPITokenFromEnv();
-  if (apiToken) {
-    return { apiToken };
-  }
-  return void 0;
-}
-__name(getAuthFromEnv, "getAuthFromEnv");
-function getAPIToken(options) {
-  const envAuth = getAuthFromEnv(options);
-  if (envAuth) {
-    return envAuth;
-  }
-  const stored = readStoredAuthState({
-    storage: options.storage,
-    warningLogger: options.warningLogger
-  });
-  if (stored.deprecatedApiToken) {
-    return { apiToken: stored.deprecatedApiToken };
-  }
-  if (stored.accessToken?.value) {
-    return { apiToken: stored.accessToken.value };
-  }
-  return void 0;
-}
-__name(getAPIToken, "getAPIToken");
-function requireApiToken(options) {
-  const credentials = getAPIToken(options);
-  if (!credentials) {
-    throw new UserError("No API token found.", {
-      telemetryMessage: "user auth missing api token"
-    });
-  }
-  return credentials;
-}
-__name(requireApiToken, "requireApiToken");
-var getAuthDomainFromEnv = getEnvironmentVariableFactory({
-  variableName: "WRANGLER_AUTH_DOMAIN",
-  defaultValue: /* @__PURE__ */ __name(() => getCloudflareApiEnvironmentFromEnv() === "staging" ? "dash.staging.cloudflare.com" : "dash.cloudflare.com", "defaultValue")
-});
-var getAuthUrlFromEnv = getEnvironmentVariableFactory({
-  variableName: "WRANGLER_AUTH_URL",
-  defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/auth`, "defaultValue")
-});
-var getTokenUrlFromEnv = getEnvironmentVariableFactory({
-  variableName: "WRANGLER_TOKEN_URL",
-  defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/token`, "defaultValue")
-});
-var getRevokeUrlFromEnv = getEnvironmentVariableFactory({
-  variableName: "WRANGLER_REVOKE_URL",
-  defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/revoke`, "defaultValue")
-});
-var getAccessClientIdFromEnv = getEnvironmentVariableFactory({
-  variableName: "CLOUDFLARE_ACCESS_CLIENT_ID"
-});
-var getAccessClientSecretFromEnv = getEnvironmentVariableFactory({
-  variableName: "CLOUDFLARE_ACCESS_CLIENT_SECRET"
-});
-var getCfAuthorizationTokenFromEnv = getEnvironmentVariableFactory({
-  variableName: "WRANGLER_CF_AUTHORIZATION_TOKEN"
-});
-var getCloudflareAuthUseKeyringFromEnv = getBooleanEnvironmentVariableFactory({
-  variableName: "CLOUDFLARE_AUTH_USE_KEYRING"
-});
-
-// src/access.ts
-var headersCache = {};
-var usesAccessCache = /* @__PURE__ */ new Map();
-function clearAccessCaches() {
-  for (const key of Object.keys(headersCache)) {
-    delete headersCache[key];
-  }
-  usesAccessCache.clear();
-}
-__name(clearAccessCaches, "clearAccessCaches");
-async function domainUsesAccess(domain, logger) {
-  logger.debug("Checking if domain has Access enabled:", domain);
-  if (usesAccessCache.has(domain)) {
-    logger.debug(
-      "Using cached Access switch for:",
-      domain,
-      usesAccessCache.get(domain)
-    );
-    return usesAccessCache.get(domain) ?? false;
-  }
-  logger.debug("Access switch not cached for:", domain);
-  try {
-    const controller = new AbortController();
-    const cancel = setTimeout(() => {
-      controller.abort();
-    }, 1e3);
-    const output = await fetch(`https://${domain}`, {
-      redirect: "manual",
-      signal: controller.signal
-    });
-    clearTimeout(cancel);
-    const usesAccess = !!(output.status === 302 && output.headers.get("location")?.includes("cloudflareaccess.com"));
-    logger.debug("Caching access switch for:", domain);
-    usesAccessCache.set(domain, usesAccess);
-    return usesAccess;
-  } catch {
-    usesAccessCache.set(domain, false);
-    return false;
-  }
-}
-__name(domainUsesAccess, "domainUsesAccess");
-async function getAccessHeaders(domain, options) {
-  const logger = options.logger;
-  const isNonInteractiveOrCI = options.isNonInteractiveOrCI;
-  const clientId = getAccessClientIdFromEnv();
-  const clientSecret = getAccessClientSecretFromEnv();
-  if (clientId && clientSecret) {
-    logger.debug("Using Access Service Token headers for domain:", domain);
-    const headers = {
-      "CF-Access-Client-Id": clientId,
-      "CF-Access-Client-Secret": clientSecret
-    };
-    headersCache[domain] = headers;
-    return headers;
-  }
-  if (clientId !== void 0 || clientSecret !== void 0) {
-    logger.warn(
-      `Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${clientId !== void 0 ? "CLOUDFLARE_ACCESS_CLIENT_ID" : "CLOUDFLARE_ACCESS_CLIENT_SECRET"} was found.`
-    );
-  }
-  if (!await domainUsesAccess(domain, logger)) {
-    return {};
-  }
-  logger.debug("Getting Access headers for domain:", domain);
-  if (headersCache[domain]) {
-    logger.debug("Using cached Access headers for domain:", domain);
-    return headersCache[domain];
-  }
-  if (isNonInteractiveOrCI()) {
-    throw new UserError(
-      `The domain "${domain}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
-Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate with an Access Service Token.
-See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/`,
-      {
-        telemetryMessage: "user access missing service token non interactive"
-      }
-    );
-  }
-  logger.debug("Spawning cloudflared to get Access token for domain:");
-  const output = spawnSync("cloudflared", ["access", "login", domain]);
-  if (output.error) {
-    throw new UserError(
-      "To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",
-      { telemetryMessage: "user access missing cloudflared" }
-    );
-  }
-  const stringOutput = output.stdout.toString();
-  logger.debug("cloudflared output:", stringOutput);
-  const matches = stringOutput.match(/fetched your token:\n\n(.*)/m);
-  if (matches && matches.length >= 2) {
-    const headers = { Cookie: `CF_Authorization=${matches[1]}` };
-    headersCache[domain] = headers;
-    logger.debug("Caching Access headers for domain:", domain);
-    return headers;
-  }
-  throw new Error("Failed to authenticate with Cloudflare Access");
-}
-__name(getAccessHeaders, "getAccessHeaders");
-async function getCloudflareAccessHeaders(options) {
-  const cfAuthToken = getCfAuthorizationTokenFromEnv();
-  if (cfAuthToken !== void 0) {
-    options.logger.debug(
-      "Using WRANGLER_CF_AUTHORIZATION_TOKEN from environment"
-    );
-    return { Cookie: `CF_Authorization=${cfAuthToken}` };
-  }
-  return getAccessHeaders(getAuthDomainFromEnv(), options);
-}
-__name(getCloudflareAccessHeaders, "getCloudflareAccessHeaders");
-
-// ../../node_modules/.pnpm/ts-dedent@2.2.0/node_modules/ts-dedent/esm/index.js
-function dedent(templ) {
-  var values = [];
-  for (var _i = 1; _i < arguments.length; _i++) {
-    values[_i - 1] = arguments[_i];
-  }
-  var strings = Array.from(typeof templ === "string" ? [templ] : templ);
-  strings[strings.length - 1] = strings[strings.length - 1].replace(/\r?\n([\t ]*)$/, "");
-  var indentLengths = strings.reduce(function(arr, str) {
-    var matches = str.match(/\n([\t ]+|(?!\s).)/g);
-    if (matches) {
-      return arr.concat(matches.map(function(match) {
-        var _a, _b;
-        return (_b = (_a = match.match(/[\t ]/g)) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0;
-      }));
-    }
-    return arr;
-  }, []);
-  if (indentLengths.length) {
-    var pattern_1 = new RegExp("\n[	 ]{" + Math.min.apply(Math, indentLengths) + "}", "g");
-    strings = strings.map(function(str) {
-      return str.replace(pattern_1, "\n");
-    });
-  }
-  strings[0] = strings[0].replace(/^\r?\n/, "");
-  var string = strings[0];
-  values.forEach(function(value, i) {
-    var endentations = string.match(/(?:^|\n)( *)$/);
-    var endentation = endentations ? endentations[1] : "";
-    var indentedValue = value;
-    if (typeof value === "string" && value.includes("\n")) {
-      indentedValue = String(value).split("\n").map(function(str, i2) {
-        return i2 === 0 ? str : "" + endentation + str;
-      }).join("\n");
-    }
-    string += indentedValue + strings[i + 1];
-  });
-  return string;
-}
-__name(dedent, "dedent");
-var esm_default = dedent;
-var ErrorOAuth2 = class extends UserError {
-  static {
-    __name(this, "ErrorOAuth2");
-  }
-  /** The OAuth `error` code returned by the provider (e.g. `invalid_scope`). */
-  code;
-  /** The OAuth `error_description` returned by the provider, if any. */
-  description;
-  /** The OAuth `error_uri` returned by the provider, if any. */
-  uri;
-  toString() {
-    return "ErrorOAuth2";
-  }
-};
-var ErrorUnknown = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorUnknown");
-  }
-  toString() {
-    return "ErrorUnknown";
-  }
-};
-var ErrorNoAuthCode = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorNoAuthCode");
-  }
-  toString() {
-    return "ErrorNoAuthCode";
-  }
-};
-var ErrorInvalidReturnedStateParam = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorInvalidReturnedStateParam");
-  }
-  toString() {
-    return "ErrorInvalidReturnedStateParam";
-  }
-};
-var ErrorInvalidJson = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorInvalidJson");
-  }
-  toString() {
-    return "ErrorInvalidJson";
-  }
-};
-var ErrorInvalidScope = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorInvalidScope");
-  }
-  toString() {
-    return "ErrorInvalidScope";
-  }
-};
-var ErrorInvalidRequest = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorInvalidRequest");
-  }
-  toString() {
-    return "ErrorInvalidRequest";
-  }
-};
-var ErrorInvalidToken = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorInvalidToken");
-  }
-  toString() {
-    return "ErrorInvalidToken";
-  }
-};
-var ErrorAuthenticationGrant = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorAuthenticationGrant");
-  }
-  toString() {
-    return "ErrorAuthenticationGrant";
-  }
-};
-var ErrorUnauthorizedClient = class extends ErrorAuthenticationGrant {
-  static {
-    __name(this, "ErrorUnauthorizedClient");
-  }
-  toString() {
-    return "ErrorUnauthorizedClient";
-  }
-};
-var ErrorAccessDenied = class extends ErrorAuthenticationGrant {
-  static {
-    __name(this, "ErrorAccessDenied");
-  }
-  toString() {
-    return "ErrorAccessDenied";
-  }
-};
-var ErrorUnsupportedResponseType = class extends ErrorAuthenticationGrant {
-  static {
-    __name(this, "ErrorUnsupportedResponseType");
-  }
-  toString() {
-    return "ErrorUnsupportedResponseType";
-  }
-};
-var ErrorServerError = class extends ErrorAuthenticationGrant {
-  static {
-    __name(this, "ErrorServerError");
-  }
-  toString() {
-    return "ErrorServerError";
-  }
-};
-var ErrorTemporarilyUnavailable = class extends ErrorAuthenticationGrant {
-  static {
-    __name(this, "ErrorTemporarilyUnavailable");
-  }
-  toString() {
-    return "ErrorTemporarilyUnavailable";
-  }
-};
-var ErrorAccessTokenResponse = class extends ErrorOAuth2 {
-  static {
-    __name(this, "ErrorAccessTokenResponse");
-  }
-  toString() {
-    return "ErrorAccessTokenResponse";
-  }
-};
-var ErrorInvalidClient = class extends ErrorAccessTokenResponse {
-  static {
-    __name(this, "ErrorInvalidClient");
-  }
-  toString() {
-    return "ErrorInvalidClient";
-  }
-};
-var ErrorInvalidGrant = class extends ErrorAccessTokenResponse {
-  static {
-    __name(this, "ErrorInvalidGrant");
-  }
-  toString() {
-    return "ErrorInvalidGrant";
-  }
-};
-var ErrorUnsupportedGrantType = class extends ErrorAccessTokenResponse {
-  static {
-    __name(this, "ErrorUnsupportedGrantType");
-  }
-  toString() {
-    return "ErrorUnsupportedGrantType";
-  }
-};
-function formatOAuthErrorMessage(code, description, uri) {
-  let message = `OAuth error: ${code}`;
-  if (description) {
-    message += `
-  ${description}`;
-  }
-  if (uri) {
-    message += `
-  See: ${uri}`;
-  }
-  return message;
-}
-__name(formatOAuthErrorMessage, "formatOAuthErrorMessage");
-function toErrorClass(rawError, description, uri) {
-  const message = formatOAuthErrorMessage(rawError, description, uri);
-  let error;
-  switch (rawError) {
-    case "invalid_request":
-      error = new ErrorInvalidRequest(message, {
-        telemetryMessage: "user oauth invalid request"
-      });
-      break;
-    case "invalid_grant":
-      error = new ErrorInvalidGrant(message, {
-        telemetryMessage: "user oauth invalid grant"
-      });
-      break;
-    case "unauthorized_client":
-      error = new ErrorUnauthorizedClient(message, {
-        telemetryMessage: "user oauth unauthorized client"
-      });
-      break;
-    case "access_denied":
-      error = new ErrorAccessDenied(message, {
-        telemetryMessage: "user oauth access denied"
-      });
-      break;
-    case "unsupported_response_type":
-      error = new ErrorUnsupportedResponseType(message, {
-        telemetryMessage: "user oauth unsupported response type"
-      });
-      break;
-    case "invalid_scope":
-      error = new ErrorInvalidScope(message, {
-        telemetryMessage: "user oauth invalid scope"
-      });
-      break;
-    case "server_error":
-      error = new ErrorServerError(message, {
-        telemetryMessage: "user oauth server error"
-      });
-      break;
-    case "temporarily_unavailable":
-      error = new ErrorTemporarilyUnavailable(message, {
-        telemetryMessage: "user oauth temporarily unavailable"
-      });
-      break;
-    case "invalid_client":
-      error = new ErrorInvalidClient(message, {
-        telemetryMessage: "user oauth invalid client"
-      });
-      break;
-    case "unsupported_grant_type":
-      error = new ErrorUnsupportedGrantType(message, {
-        telemetryMessage: "user oauth unsupported grant type"
-      });
-      break;
-    case "invalid_json":
-      error = new ErrorInvalidJson(message, {
-        telemetryMessage: "user oauth invalid json"
-      });
-      break;
-    case "invalid_token":
-      error = new ErrorInvalidToken(message, {
-        telemetryMessage: "user oauth invalid token"
-      });
-      break;
-    default:
-      error = new ErrorUnknown(message, {
-        telemetryMessage: "user oauth unknown error"
-      });
-      break;
-  }
-  error.code = rawError;
-  error.description = description;
-  error.uri = uri;
-  return error;
-}
-__name(toErrorClass, "toErrorClass");
-var RECOMMENDED_CODE_VERIFIER_LENGTH = 96;
-var RECOMMENDED_STATE_LENGTH = 32;
-var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
-function base64urlEncode(value) {
-  let base64 = btoa(value);
-  base64 = base64.replace(/\+/g, "-");
-  base64 = base64.replace(/\//g, "_");
-  base64 = base64.replace(/=/g, "");
-  return base64;
-}
-__name(base64urlEncode, "base64urlEncode");
-async function generatePKCECodes() {
-  const output = new Uint32Array(RECOMMENDED_CODE_VERIFIER_LENGTH);
-  webcrypto.getRandomValues(output);
-  const codeVerifier = base64urlEncode(
-    Array.from(output).map((num) => PKCE_CHARSET[num % PKCE_CHARSET.length]).join("")
-  );
-  const buffer = await webcrypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(codeVerifier)
-  );
-  const hash = new Uint8Array(buffer);
-  let binary = "";
-  const hashLength = hash.byteLength;
-  for (let i = 0; i < hashLength; i++) {
-    binary += String.fromCharCode(hash[i]);
-  }
-  const codeChallenge = base64urlEncode(binary);
-  return { codeChallenge, codeVerifier };
-}
-__name(generatePKCECodes, "generatePKCECodes");
-
-// src/token-exchange.ts
-function isReturningFromAuthServer(query, state, logger) {
-  if (query.error) {
-    const error = Array.isArray(query.error) ? query.error[0] : query.error;
-    const description = Array.isArray(query.error_description) ? query.error_description[0] : query.error_description;
-    const uri = Array.isArray(query.error_uri) ? query.error_uri[0] : query.error_uri;
-    throw toErrorClass(error, description, uri);
-  }
-  const code = query.code;
-  if (!code) {
-    return false;
-  }
-  const stateQueryParam = query.state;
-  if (stateQueryParam !== state.stateQueryParam) {
-    logger.warn(
-      "Received query string parameter doesn't match the one sent! Possible malicious activity somewhere."
-    );
-    throw new ErrorInvalidReturnedStateParam("", {
-      telemetryMessage: "user oauth invalid returned state"
-    });
-  }
-  assert2(!Array.isArray(code));
-  state.authorizationCode = code;
-  state.hasAuthCodeBeenExchangedForAccessToken = false;
-  return true;
-}
-__name(isReturningFromAuthServer, "isReturningFromAuthServer");
-async function getAuthURL(scopes, clientId, redirectUri, state, generators) {
-  const { codeChallenge, codeVerifier } = await generatePKCECodes();
-  const stateQueryParam = generators.generateRandomState(
-    RECOMMENDED_STATE_LENGTH
-  );
-  Object.assign(state, {
-    codeChallenge,
-    codeVerifier,
-    stateQueryParam
-  });
-  return generators.generateAuthUrl({
-    authUrl: getAuthUrlFromEnv(),
-    clientId,
-    scopes,
-    stateQueryParam,
-    codeChallenge,
-    redirectUri
-  });
-}
-__name(getAuthURL, "getAuthURL");
-async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI, clientId, storage) {
-  const storedRefreshToken = readStoredAuthState({
-    warningLogger: logger,
-    storage
-  }).refreshToken;
-  if (!storedRefreshToken) {
-    logger.warn("No refresh token is present.");
-  }
-  const params = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: storedRefreshToken?.value ?? "",
-    client_id: clientId
-  });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI);
-  if (response.status >= 400) {
-    let tokenExchangeResErr = void 0;
-    try {
-      tokenExchangeResErr = await getJSONFromResponse(response, logger);
-    } catch (e) {
-      logger.error(e);
-    }
-    if (tokenExchangeResErr !== void 0) {
-      throw typeof tokenExchangeResErr === "string" ? new Error(tokenExchangeResErr) : tokenExchangeResErr;
-    } else {
-      throw new ErrorUnknown(
-        "Failed to parse Error from exchangeRefreshTokenForAccessToken",
-        { telemetryMessage: "user oauth refresh token exchange parse error" }
-      );
-    }
-  } else {
-    try {
-      const json = await getJSONFromResponse(
-        response,
-        logger
-      );
-      if ("error" in json) {
-        throw json.error;
-      }
-      const { access_token, expires_in, refresh_token, scope } = json;
-      const accessToken = {
-        value: access_token,
-        expiry: new Date(Date.now() + expires_in * 1e3).toISOString()
-      };
-      const scopes = scope ? scope.split(" ") : [];
-      const accessContext = {
-        token: accessToken,
-        scopes,
-        refreshToken: refresh_token ? { value: refresh_token } : storedRefreshToken
-      };
-      return accessContext;
-    } catch (error) {
-      if (typeof error === "string") {
-        throw toErrorClass(error);
-      } else {
-        throw error;
-      }
-    }
-  }
-}
-__name(exchangeRefreshTokenForAccessToken, "exchangeRefreshTokenForAccessToken");
-async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrCI, clientId, redirectUri) {
-  const { authorizationCode, codeVerifier = "" } = state;
-  if (!codeVerifier) {
-    logger.warn("No code verifier is being sent.");
-  } else if (!authorizationCode) {
-    logger.warn("No authorization grant code is being passed.");
-  }
-  const params = new URLSearchParams({
-    grant_type: `authorization_code`,
-    code: authorizationCode ?? "",
-    redirect_uri: redirectUri,
-    client_id: clientId,
-    code_verifier: codeVerifier
-  });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI);
-  if (!response.ok) {
-    const { error } = await getJSONFromResponse(response, logger);
-    if (error === "invalid_grant") {
-      logger.log("Expired! Auth code or refresh token needs to be renewed.");
-    }
-    throw toErrorClass(error);
-  }
-  const json = await getJSONFromResponse(response, logger);
-  if ("error" in json) {
-    throw toErrorClass(json.error);
-  }
-  const { access_token, expires_in, refresh_token, scope } = json;
-  state.hasAuthCodeBeenExchangedForAccessToken = true;
-  const expiryDate = new Date(Date.now() + expires_in * 1e3);
-  const accessToken = {
-    value: access_token,
-    expiry: expiryDate.toISOString()
-  };
-  const scopes = scope ? scope.split(" ") : [];
-  const accessContext = {
-    token: accessToken,
-    scopes,
-    refreshToken: refresh_token ? { value: refresh_token } : void 0
-  };
-  return accessContext;
-}
-__name(exchangeAuthCodeForAccessToken, "exchangeAuthCodeForAccessToken");
-async function fetchAuthToken(body, logger, isNonInteractiveOrCI) {
-  const headers = {
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  logger.debug(
-    "fetching auth token",
-    `grant_type=${body.get("grant_type") ?? "<unknown>"}`
-  );
-  if (await domainUsesAccess(getAuthDomainFromEnv(), logger)) {
-    logger.debug(
-      "Using Cloudflare Access to get an access token for the auth request"
-    );
-    const accessHeaders = await getCloudflareAccessHeaders({
-      logger,
-      isNonInteractiveOrCI
-    });
-    Object.assign(headers, accessHeaders);
-  }
-  logger.debug("Fetching auth token from", getTokenUrlFromEnv());
-  try {
-    const response = await fetch(getTokenUrlFromEnv(), {
-      method: "POST",
-      body: body.toString(),
-      headers
-    });
-    if (!response.ok) {
-      logger.debug(
-        "Failed to fetch auth token:",
-        response.status,
-        response.statusText
-      );
-    }
-    return response;
-  } catch (e) {
-    logger.debug("Failed to fetch auth token:", e);
-    throw e;
-  }
-}
-__name(fetchAuthToken, "fetchAuthToken");
-async function getJSONFromResponse(response, logger) {
-  const text = await response.text();
-  try {
-    return JSON.parse(text);
-  } catch (e) {
-    if (text.match(/<!DOCTYPE html>/)) {
-      logger.error(
-        "The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response."
-      );
-      if (text.match(/challenge-platform/)) {
-        logger.error(
-          `It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${response.headers.get(
-            "cf-ray"
-          )}`
-        );
-      }
-    }
-    logger.debug("Full body of response\n\n", text);
-    throw new Error(
-      `Invalid JSON in response: status: ${response.status} ${response.statusText}`,
-      { cause: e }
-    );
-  }
-}
-__name(getJSONFromResponse, "getJSONFromResponse");
-
-// src/callback-server.ts
-async function getOauthToken(options, state, ctx, generators) {
-  const urlToOpen = await getAuthURL(
-    options.scopes,
-    options.clientId,
-    options.redirectUri,
-    state,
-    generators
-  );
-  const callbackPath = new URL(options.redirectUri).pathname;
-  let server;
-  let loginTimeoutHandle;
-  const timerPromise = new Promise((_, reject) => {
-    loginTimeoutHandle = setTimeout(() => {
-      server.close();
-      clearTimeout(loginTimeoutHandle);
-      reject(
-        new UserError(
-          "Timed out waiting for authorization code, please try again.",
-          { telemetryMessage: "user oauth authorization timeout" }
-        )
-      );
-    }, 12e4);
-  });
-  const loginPromise = new Promise((resolve, reject) => {
-    server = http.createServer(async (req, res) => {
-      function finish(token, error) {
-        clearTimeout(loginTimeoutHandle);
-        if (!res.writableEnded) {
-          res.end();
-        }
-        server.close((closeErr) => {
-          if (error || closeErr) {
-            reject(error || closeErr);
-          } else {
-            assert2(token);
-            resolve(token);
-          }
-        });
-      }
-      __name(finish, "finish");
-      function renderErrorPage(detail) {
-        const escape = /* @__PURE__ */ __name((s) => s.replace(
-          /[&<>"']/g,
-          (c) => ({
-            "&": "&amp;",
-            "<": "&lt;",
-            ">": "&gt;",
-            '"': "&quot;",
-            "'": "&#39;"
-          })[c]
-        ), "escape");
-        const codeRow = detail.code ? `<p>Code: <code>${escape(detail.code)}</code></p>` : "";
-        const descriptionRow = detail.description ? `<p class="detail">${escape(detail.description)}</p>` : "";
-        const body = `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <title>Wrangler login failed</title>
-  <style>
-    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 720px; margin: 4rem auto; padding: 0 1rem; color: #1f2933; line-height: 1.5; }
-    h1 { color: #c12d3f; }
-    code { background: #f5f7fa; padding: 0.15em 0.3em; border-radius: 3px; }
-    p.detail { background: #f5f7fa; padding: 1rem; border-radius: 4px; white-space: pre-wrap; }
-  </style>
-</head>
-<body>
-  <h1>Wrangler login failed</h1>
-  <p>The Cloudflare OAuth provider returned an error.</p>
-  ${codeRow}
-  ${descriptionRow}
-  <p>You can close this tab and return to your terminal for more details.</p>
-</body>
-</html>`;
-        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(body);
-      }
-      __name(renderErrorPage, "renderErrorPage");
-      assert2(req.url, "This request doesn't have a URL");
-      const { pathname, query } = url.parse(req.url, true);
-      if (req.method !== "GET") {
-        return res.end("OK");
-      }
-      switch (pathname) {
-        case callbackPath: {
-          let hasAuthCode = false;
-          try {
-            hasAuthCode = isReturningFromAuthServer(query, state, ctx.logger);
-          } catch (err) {
-            if (err instanceof ErrorAccessDenied) {
-              res.writeHead(307, {
-                Location: options.denied.url
-              });
-              res.end(() => {
-                finish(
-                  null,
-                  new UserError(options.denied.error, {
-                    telemetryMessage: "user oauth consent denied"
-                  })
-                );
-              });
-              return;
-            }
-            const oauthErr = err;
-            renderErrorPage({
-              code: oauthErr.code,
-              description: oauthErr.description ?? oauthErr.message
-            });
-            finish(null, oauthErr);
-            return;
-          }
-          if (!hasAuthCode) {
-            const noCodeMessage = "The Cloudflare OAuth provider did not return an authorisation code.";
-            renderErrorPage({ description: noCodeMessage });
-            finish(
-              null,
-              new ErrorNoAuthCode(noCodeMessage, {
-                telemetryMessage: "user oauth missing auth code"
-              })
-            );
-            return;
-          }
-          try {
-            const exchange = await exchangeAuthCodeForAccessToken(
-              state,
-              ctx.logger,
-              ctx.isNonInteractiveOrCI,
-              options.clientId,
-              options.redirectUri
-            );
-            res.writeHead(307, {
-              Location: options.granted.url
-            });
-            res.end(() => {
-              finish(exchange);
-            });
-          } catch (err) {
-            const exchangeErr = err;
-            const isOAuthError = exchangeErr instanceof ErrorOAuth2;
-            renderErrorPage({
-              code: isOAuthError ? exchangeErr.code : void 0,
-              description: (isOAuthError ? exchangeErr.description : void 0) ?? exchangeErr.message ?? "Failed to exchange the authorisation code for an access token."
-            });
-            finish(null, exchangeErr);
-          }
-          return;
-        }
-      }
-    });
-    const redirect = new URL(options.redirectUri);
-    const redirectPort = Number(
-      redirect.port || (redirect.protocol === "https:" ? 443 : 80)
-    );
-    if (redirect.hostname !== options.callbackHost || redirectPort !== options.callbackPort) {
-      ctx.logger.log(
-        `Temporary login server listening on ${options.callbackHost}:${options.callbackPort}`
-      );
-      ctx.logger.log(
-        `Note that the OAuth login page will always redirect to \`${options.redirectUri}\`.
-If you have changed the callback host or port because you are running in a container, then ensure that you have port forwarding set up correctly.`
-      );
-    }
-    server.once("error", (err) => {
-      clearTimeout(loginTimeoutHandle);
-      if (err.code === "EADDRINUSE") {
-        reject(
-          new UserError(
-            `The OAuth callback server could not bind to ${options.callbackHost}:${options.callbackPort} because the port is already in use. Stop the process using that port or pass a different \`--callback-port\`.`,
-            { telemetryMessage: "user oauth callback port in use" }
-          )
-        );
-      } else {
-        reject(err);
-      }
-    });
-    server.listen(options.callbackPort, options.callbackHost);
-  });
-  if (options.browser) {
-    ctx.logger.log(`Opening a link in your default browser: ${urlToOpen}`);
-    await ctx.openInBrowser(urlToOpen);
-  } else {
-    ctx.logger.log(`Visit this link to authenticate: ${urlToOpen}`);
-  }
-  return Promise.race([timerPromise, loginPromise]);
-}
-__name(getOauthToken, "getOauthToken");
-
-// src/generate-auth-url.ts
-var generateAuthUrl = /* @__PURE__ */ __name(({
-  authUrl,
-  clientId,
-  scopes,
-  stateQueryParam,
-  codeChallenge,
-  redirectUri
-}) => {
-  return authUrl + `?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&scope=${encodeURIComponent([...scopes, "offline_access"].join(" "))}&state=${stateQueryParam}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256`;
-}, "generateAuthUrl");
-function generateRandomState(lengthOfState) {
-  const output = new Uint32Array(lengthOfState);
-  webcrypto.getRandomValues(output);
-  return Array.from(output).map((num) => PKCE_CHARSET[num % PKCE_CHARSET.length]).join("");
-}
-__name(generateRandomState, "generateRandomState");
-var POW_MAX_ITERATIONS = 64e6;
-function solvePow(seed, k, g) {
-  const checkpoints = new Array(k + 1);
-  let h = createHash("sha256").update(seed).digest();
-  checkpoints[0] = h;
-  for (let j = 0; j < k; j++) {
-    for (let i = 0; i < g; i++) {
-      h = createHash("sha256").update(h).digest();
-    }
-    checkpoints[j + 1] = h;
-  }
-  return checkpoints;
-}
-__name(solvePow, "solvePow");
-function encodeCheckpoints(checkpoints) {
-  return Buffer.concat(checkpoints).toString("base64");
-}
-__name(encodeCheckpoints, "encodeCheckpoints");
-function solveChallenge(challenge) {
-  const checkpoints = solvePow(
-    Buffer.from(challenge.seed, "base64url"),
-    challenge.k,
-    challenge.g
-  );
-  return {
-    challengeToken: challenge.challengeToken,
-    solution: { checkpoints: encodeCheckpoints(checkpoints) }
-  };
-}
-__name(solveChallenge, "solveChallenge");
-
-// src/temporary.ts
-var TEMPORARY_TERMS_URLS = {
-  termsOfService: "https://www.cloudflare.com/terms/",
-  privacyPolicy: "https://www.cloudflare.com/privacypolicy/"
-};
-var TEMPORARY_TERMS_PROMPT = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`;
-var TEMPORARY_TERMS_NOTICE = `Continuing means you accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}).`;
-var TEMPORARY_TERMS_ERROR = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) to use --temporary.`;
-function getTemporaryPreviewUrl() {
-  return `${getCloudflareApiBaseUrl(COMPLIANCE_REGION_CONFIG_PUBLIC)}/provisioning/previews`;
-}
-__name(getTemporaryPreviewUrl, "getTemporaryPreviewUrl");
-function getTemporaryPreviewChallengeUrl() {
-  return `${getTemporaryPreviewUrl()}/challenge`;
-}
-__name(getTemporaryPreviewChallengeUrl, "getTemporaryPreviewChallengeUrl");
-function isFutureTimestamp(timestamp) {
-  const parsed = Date.parse(timestamp);
-  return !Number.isNaN(parsed) && parsed > Date.now();
-}
-__name(isFutureTimestamp, "isFutureTimestamp");
-function getCachedTemporaryPreviewAccount(storage) {
-  const temporaryPreviewAccount = storage.read();
-  if (!temporaryPreviewAccount) {
-    return void 0;
-  }
-  if (!temporaryPreviewAccount.account?.id || !temporaryPreviewAccount.account?.apiToken || !temporaryPreviewAccount.account?.name || !temporaryPreviewAccount.claim?.url || !isFutureTimestamp(temporaryPreviewAccount.account?.expiresAt ?? "") || !isFutureTimestamp(temporaryPreviewAccount.claim?.expiresAt ?? "")) {
-    return void 0;
-  }
-  return temporaryPreviewAccount;
-}
-__name(getCachedTemporaryPreviewAccount, "getCachedTemporaryPreviewAccount");
-async function requestPowSolution(logger) {
-  const response = await fetch(getTemporaryPreviewChallengeUrl(), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: "{}"
-  });
-  if (!response.ok) {
-    throw new FatalError(
-      `Failed to request a proof-of-work challenge (${response.status} ${response.statusText}).`,
-      { telemetryMessage: "deploy temporary account challenge failed" }
-    );
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch {
-    throw new FatalError(
-      `Failed to request a proof-of-work challenge. Received an invalid response (${response.status} ${response.statusText}).`,
-      {
-        telemetryMessage: "deploy temporary account challenge invalid response"
-      }
-    );
-  }
-  const { challengeToken, seed, k, g } = body.result ?? {};
-  if (challengeToken === void 0 || seed === void 0 || k === void 0 || g === void 0) {
-    throw new FatalError(
-      "Failed to request a proof-of-work challenge because the response was missing required fields.",
-      { telemetryMessage: "deploy temporary account challenge incomplete" }
-    );
-  }
-  if (!Number.isInteger(k) || !Number.isInteger(g) || k <= 0 || g <= 0 || k * g > POW_MAX_ITERATIONS || Buffer.from(seed, "base64url").length !== 32) {
-    throw new FatalError(
-      "The proof-of-work challenge is not supported by this version of Wrangler.",
-      {
-        telemetryMessage: "deploy temporary account challenge difficulty unsupported"
-      }
-    );
-  }
-  logger.log("Solving proof-of-work challenge\u2026");
-  return solveChallenge({ challengeToken, seed, k, g });
-}
-__name(requestPowSolution, "requestPowSolution");
-async function createTemporaryPreviewAccount(logger) {
-  const pow = await requestPowSolution(logger);
-  const response = await fetch(getTemporaryPreviewUrl(), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      termsOfService: TEMPORARY_TERMS_URLS.termsOfService,
-      privacyPolicy: TEMPORARY_TERMS_URLS.privacyPolicy,
-      acceptTermsOfService: "yes",
-      challengeToken: pow.challengeToken,
-      solution: pow.solution
-    })
-  });
-  if (!response.ok) {
-    throw new FatalError(
-      `Failed to create a temporary preview account (${response.status} ${response.statusText}).`,
-      { telemetryMessage: "deploy temporary account create failed" }
-    );
-  }
-  let responseBody;
-  try {
-    responseBody = await response.json();
-  } catch {
-    throw new FatalError(
-      `Failed to create a temporary preview account. Received an invalid response (${response.status} ${response.statusText}).`,
-      { telemetryMessage: "deploy temporary account invalid response" }
-    );
-  }
-  const previewAccount = responseBody.result;
-  const accountId = previewAccount?.account?.id;
-  const accountName = previewAccount?.account?.name;
-  const apiToken = previewAccount?.account?.apiToken;
-  const accountExpiresAt = previewAccount?.account?.expiresAt;
-  const claimUrl = previewAccount?.claim?.url;
-  const claimExpiresAt = previewAccount?.claim?.expiresAt;
-  if (accountId === void 0 || accountName === void 0 || apiToken === void 0 || accountExpiresAt === void 0 || claimUrl === void 0 || claimExpiresAt === void 0) {
-    throw new FatalError(
-      "Failed to create a temporary preview account because the response was missing required fields.",
-      { telemetryMessage: "deploy temporary account response incomplete" }
-    );
-  }
-  return {
-    account: {
-      id: accountId,
-      name: accountName,
-      apiToken,
-      expiresAt: accountExpiresAt
-    },
-    claim: {
-      url: claimUrl,
-      expiresAt: claimExpiresAt
-    }
-  };
-}
-__name(createTemporaryPreviewAccount, "createTemporaryPreviewAccount");
-async function getOrCreateTemporaryPreviewAccount(options) {
-  const cachedPreviewAccount = getCachedTemporaryPreviewAccount(
-    options.storage
-  );
-  if (cachedPreviewAccount) {
-    return { account: cachedPreviewAccount, cached: true };
-  }
-  const termsAccepted = await options.prompt(
-    TEMPORARY_TERMS_PROMPT,
-    TEMPORARY_TERMS_NOTICE
-  );
-  if (!termsAccepted) {
-    throw new UserError(TEMPORARY_TERMS_ERROR, {
-      telemetryMessage: "user temporary terms not accepted"
-    });
-  }
-  const temporaryPreviewAccount = await createTemporaryPreviewAccount(
-    options.logger
-  );
-  options.storage.write(temporaryPreviewAccount);
-  return { account: temporaryPreviewAccount, cached: false };
-}
-__name(getOrCreateTemporaryPreviewAccount, "getOrCreateTemporaryPreviewAccount");
-
-// src/flow.ts
-function createOAuthFlow(ctx) {
-  const oauthFlowState = {};
-  const generators = {
-    generateAuthUrl: ctx.generateAuthUrl ?? generateAuthUrl,
-    generateRandomState: ctx.generateRandomState ?? generateRandomState
-  };
-  let activeProfile = "default";
-  function getStorage(profile) {
-    return ctx.storageFactory(profile ?? activeProfile);
-  }
-  __name(getStorage, "getStorage");
-  const getClientId = /* @__PURE__ */ __name(() => typeof ctx.clientId === "function" ? ctx.clientId() : ctx.clientId, "getClientId");
-  const consent = ctx.consent;
-  let temporaryAllowed = false;
-  let activeTemporaryAccount;
-  const redirectUrl = new URL(ctx.redirectUri);
-  const defaultCallbackHost = redirectUrl.hostname;
-  const defaultCallbackPort = Number(redirectUrl.port);
-  async function login(props) {
-    if (ctx.hasEnvCredentials()) {
-      ctx.logger.error(
-        "You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth."
-      );
-      return false;
-    }
-    const complianceRegion = getCloudflareComplianceRegion(
-      props.complianceConfig
-    );
-    if (complianceRegion === "fedramp_high") {
-      const configurationSource = props.complianceConfig?.compliance_region ? "`compliance_region` configuration property" : "`CLOUDFLARE_API_ENVIRONMENT` environment variable";
-      throw new UserError(
-        esm_default`
-				OAuth login is not supported in the \`${complianceRegion}\` compliance region.
-				Please use a Cloudflare API token (\`CLOUDFLARE_API_TOKEN\` environment variable) or remove the ${configurationSource}.
-			`,
-        {
-          telemetryMessage: "user login unsupported compliance region"
-        }
-      );
-    }
-    ctx.logger.log("Attempting to login via OAuth...");
-    const oauth = await getOauthToken(
-      {
-        browser: props.browser ?? true,
-        scopes: props.scopes,
-        clientId: getClientId(),
-        redirectUri: ctx.redirectUri,
-        denied: consent.denied,
-        granted: consent.granted,
-        callbackHost: props.callbackHost ?? defaultCallbackHost,
-        callbackPort: props.callbackPort ?? defaultCallbackPort
-      },
-      oauthFlowState,
-      ctx,
-      generators
-    );
-    getStorage(props.profile).write({
-      oauth_token: oauth.token?.value ?? "",
-      expiration_time: oauth.token?.expiry,
-      refresh_token: oauth.refreshToken?.value,
-      scopes: oauth.scopes
-    });
-    ctx.logger.log(`Successfully logged in.`);
-    clearTemporaryAccount();
-    ctx.purgeOnLoginOrLogout?.();
-    return true;
-  }
-  __name(login, "login");
-  function isRefreshNeeded(profile) {
-    if (ctx.hasEnvCredentials()) {
-      return false;
-    }
-    const { accessToken } = readStoredAuthState({
-      warningLogger: ctx.logger,
-      storage: getStorage(profile)
-    });
-    return Boolean(accessToken && /* @__PURE__ */ new Date() >= new Date(accessToken.expiry));
-  }
-  __name(isRefreshNeeded, "isRefreshNeeded");
-  async function refreshToken(profile) {
-    const storage = getStorage(profile);
-    try {
-      const {
-        token: { value: oauth_token, expiry: expiration_time } = {
-          value: "",
-          expiry: ""
-        },
-        refreshToken: { value: refresh_token } = {},
-        scopes
-      } = await exchangeRefreshTokenForAccessToken(
-        ctx.logger,
-        ctx.isNonInteractiveOrCI,
-        getClientId(),
-        storage
-      );
-      storage.write({
-        oauth_token,
-        expiration_time,
-        refresh_token,
-        scopes
-      });
-      return true;
-    } catch (e) {
-      ctx.logger.debug(
-        `Token refresh failed: ${e instanceof Error ? e.message : String(e)}`
-      );
-      return false;
-    }
-  }
-  __name(refreshToken, "refreshToken");
-  async function loginOrRefreshIfRequired(props) {
-    if (ctx.hasEnvCredentials()) {
-      return { loggedIn: true };
-    }
-    const stored = readStoredAuthState({
-      warningLogger: ctx.logger,
-      storage: getStorage(props.profile)
-    });
-    if (!stored.accessToken && !stored.deprecatedApiToken) {
-      if (ctx.isNonInteractiveOrCI()) {
-        return {
-          loggedIn: false,
-          reason: "no-credentials-non-interactive"
-        };
-      }
-      if (await login(props)) {
-        return { loggedIn: true };
-      }
-      return { loggedIn: false, reason: "no-credentials-login-failed" };
-    } else if (isRefreshNeeded(props.profile)) {
-      const didRefresh = await refreshToken(props.profile);
-      if (didRefresh) {
-        return { loggedIn: true };
-      }
-      if (ctx.isNonInteractiveOrCI()) {
-        return {
-          loggedIn: false,
-          reason: "token-expired-non-interactive"
-        };
-      }
-      if (await login(props)) {
-        return { loggedIn: true };
-      }
-      return { loggedIn: false, reason: "token-expired-login-failed" };
-    } else {
-      return { loggedIn: true };
-    }
-  }
-  __name(loginOrRefreshIfRequired, "loginOrRefreshIfRequired");
-  async function logout(profile) {
-    const clearedTemporary = clearTemporaryAccount();
-    if (ctx.hasEnvCredentials()) {
-      ctx.logger.log(
-        "You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log out."
-      );
-      return;
-    }
-    const storedRefreshToken = readStoredAuthState({
-      warningLogger: ctx.logger,
-      storage: getStorage(profile)
-    }).refreshToken;
-    if (!storedRefreshToken) {
-      ctx.logger.log(
-        clearedTemporary ? "Cleared temporary preview account." : "Not logged in, exiting..."
-      );
-      return;
-    }
-    const body = `client_id=${encodeURIComponent(getClientId())}&token_type_hint=refresh_token&token=${encodeURIComponent(storedRefreshToken.value || "")}`;
-    const response = await fetch(getRevokeUrlFromEnv(), {
-      method: "POST",
-      body,
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      }
-    });
-    await response.text();
-    getStorage(profile).clear();
-    ctx.logger.log(`Successfully logged out.`);
-    ctx.purgeOnLoginOrLogout?.();
-  }
-  __name(logout, "logout");
-  async function getOAuthTokenFromLocalState() {
-    let stored = readStoredAuthState({
-      warningLogger: ctx.logger,
-      storage: getStorage()
-    });
-    if (!stored.accessToken) {
-      return void 0;
-    }
-    const expired = stored.accessToken && /* @__PURE__ */ new Date() >= new Date(stored.accessToken.expiry);
-    if (expired) {
-      const didRefresh = await refreshToken();
-      if (!didRefresh) {
-        return void 0;
-      }
-      stored = readStoredAuthState({
-        warningLogger: ctx.logger,
-        storage: getStorage()
-      });
-    }
-    return stored.accessToken?.value;
-  }
-  __name(getOAuthTokenFromLocalState, "getOAuthTokenFromLocalState");
-  function getAPITokenInternal() {
-    if (activeTemporaryAccount) {
-      return { apiToken: activeTemporaryAccount.account.apiToken };
-    }
-    return getAPIToken({
-      storage: getStorage(),
-      warningLogger: ctx.logger,
-      allowGlobalAuthKey: ctx.allowGlobalAuthKey
-    });
-  }
-  __name(getAPITokenInternal, "getAPITokenInternal");
-  function requireApiTokenInternal() {
-    if (activeTemporaryAccount) {
-      return { apiToken: activeTemporaryAccount.account.apiToken };
-    }
-    return requireApiToken({
-      storage: getStorage(),
-      warningLogger: ctx.logger,
-      allowGlobalAuthKey: ctx.allowGlobalAuthKey
-    });
-  }
-  __name(requireApiTokenInternal, "requireApiTokenInternal");
-  function setTemporaryAllowed(allowed) {
-    temporaryAllowed = allowed && ctx.temporary !== void 0;
-    activeTemporaryAccount = void 0;
-  }
-  __name(setTemporaryAllowed, "setTemporaryAllowed");
-  function isTemporaryAllowed() {
-    return temporaryAllowed;
-  }
-  __name(isTemporaryAllowed, "isTemporaryAllowed");
-  function getActiveTemporaryAccount() {
-    return activeTemporaryAccount;
-  }
-  __name(getActiveTemporaryAccount, "getActiveTemporaryAccount");
-  async function activateTemporaryAccount() {
-    if (!ctx.temporary) {
-      throw new UserError(
-        "Temporary preview accounts are not supported by this CLI.",
-        { telemetryMessage: "user temporary account unsupported" }
-      );
-    }
-    const result = await getOrCreateTemporaryPreviewAccount({
-      ...ctx.temporary,
-      logger: ctx.logger
-    });
-    activeTemporaryAccount = result.account;
-    return result;
-  }
-  __name(activateTemporaryAccount, "activateTemporaryAccount");
-  function clearTemporaryAccount() {
-    activeTemporaryAccount = void 0;
-    return ctx.temporary?.storage.clear() ?? false;
-  }
-  __name(clearTemporaryAccount, "clearTemporaryAccount");
-  function setProfile(profile) {
-    activeProfile = profile;
-  }
-  __name(setProfile, "setProfile");
-  function getActiveProfile() {
-    return activeProfile;
-  }
-  __name(getActiveProfile, "getActiveProfile");
-  function getScopes() {
-    return readStoredAuthState({
-      warningLogger: ctx.logger,
-      storage: getStorage()
-    }).scopes;
-  }
-  __name(getScopes, "getScopes");
-  return {
-    setProfile,
-    getActiveProfile,
-    login,
-    logout,
-    loginOrRefreshIfRequired,
-    getOAuthTokenFromLocalState,
-    getAPIToken: getAPITokenInternal,
-    requireApiToken: requireApiTokenInternal,
-    getScopes,
-    setTemporaryAllowed,
-    isTemporaryAllowed,
-    getActiveTemporaryAccount,
-    activateTemporaryAccount
-  };
-}
-__name(createOAuthFlow, "createOAuthFlow");
-var RESERVED_PROFILE_NAMES = ["default", "staging"];
-function createProfileStore(args) {
-  const bindings = {
-    read() {
-      return args.bindings.read();
-    },
-    write(currentBindings) {
-      args.bindings.write(currentBindings);
-    },
-    activate(profile, dir) {
-      const normalizedDir = path4.resolve(dir);
-      const currentBindings = args.bindings.read();
-      currentBindings[normalizedDir] = profile;
-      args.bindings.write(currentBindings);
-    },
-    deactivate(dir) {
-      const normalizedDir = path4.resolve(dir);
-      const currentBindings = args.bindings.read();
-      const boundProfile = currentBindings[normalizedDir];
-      if (boundProfile === void 0) {
-        const parentBinding = getProfileForDirectoryFromBindings(
-          normalizedDir,
-          currentBindings
-        );
-        if (parentBinding) {
-          throw new UserError(
-            `No profile is directly bound to "${formatDirectoryForUserError(normalizedDir)}". The active profile "${parentBinding.profile}" is bound at "${formatDirectoryForUserError(
-              parentBinding.dir
-            )}". Run \`wrangler auth deactivate\` from that directory instead.`,
-            { telemetryMessage: "auth deactivate wrong directory" }
-          );
-        }
-        throw new UserError(
-          `No profile is bound to "${formatDirectoryForUserError(normalizedDir)}". Nothing to deactivate.`,
-          { telemetryMessage: "auth deactivate no binding" }
-        );
-      }
-      delete currentBindings[normalizedDir];
-      args.bindings.write(currentBindings);
-      const fallbackProfile = getProfileForDirectoryFromBindings(
-        normalizedDir,
-        currentBindings
-      );
-      if (fallbackProfile) {
-        return {
-          removedProfile: boundProfile,
-          newResolution: {
-            profile: fallbackProfile.profile,
-            source: `inherited from ${fallbackProfile.dir}`
-          }
-        };
-      }
-      if (args.configs.exists("default")) {
-        return {
-          removedProfile: boundProfile,
-          newResolution: { profile: "default", source: "default profile" }
-        };
-      }
-      return {
-        removedProfile: boundProfile,
-        newResolution: { profile: void 0, source: "no profile" }
-      };
-    },
-    getProfileForDirectory(startDir) {
-      return getProfileForDirectoryFromBindings(startDir, args.bindings.read())?.profile;
-    },
-    getBindingsForProfile(profile) {
-      return Object.entries(args.bindings.read()).filter(([, p]) => p === profile).map(([dir]) => dir);
-    },
-    removeAllBindingsForProfile(profile) {
-      const currentBindings = args.bindings.read();
-      const removed = [];
-      for (const [dir, p] of Object.entries(currentBindings)) {
-        if (p === profile) {
-          removed.push(dir);
-          delete currentBindings[dir];
-        }
-      }
-      if (removed.length > 0) {
-        args.bindings.write(currentBindings);
-      }
-      return removed;
-    }
-  };
-  return {
-    configs: args.configs,
-    bindings,
-    resolve(resolveArgs) {
-      if (resolveArgs.profile) {
-        if (resolveArgs.profile === "default") {
-          return "default";
-        }
-        validateProfileName(resolveArgs.profile);
-        return resolveArgs.profile;
-      }
-      const dirProfile = bindings.getProfileForDirectory(resolveArgs.cwd);
-      if (dirProfile) {
-        return dirProfile;
-      }
-      return "default";
-    }
-  };
-}
-__name(createProfileStore, "createProfileStore");
-function validateProfileName(name) {
-  if (RESERVED_PROFILE_NAMES.includes(name.toLowerCase())) {
-    throw new UserError(
-      `"${name}" is a reserved profile name. Use \`wrangler login\` and \`wrangler logout\` to manage the default profile, which applies as a global fallback.`,
-      { telemetryMessage: "auth profile reserved name" }
-    );
-  }
-  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
-    throw new UserError(
-      `Invalid profile name "${name}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,
-      { telemetryMessage: "auth profile invalid name" }
-    );
-  }
-}
-__name(validateProfileName, "validateProfileName");
-function formatDirectoryForUserError(dir) {
-  return path4.relative(process.cwd(), dir) || ".";
-}
-__name(formatDirectoryForUserError, "formatDirectoryForUserError");
-function getProfileForDirectoryFromBindings(startDir, bindings) {
-  const normalizedDir = path4.resolve(startDir);
-  const sortedEntries = Object.entries(bindings).sort(
-    ([a], [b]) => b.length - a.length
-  );
-  for (const [boundDir, profile] of sortedEntries) {
-    if (normalizedDir === boundDir) {
-      return { profile, dir: boundDir };
-    }
-    if (normalizedDir.startsWith(boundDir) && normalizedDir[boundDir.length] === path4.sep) {
-      return { profile, dir: boundDir };
-    }
-  }
-  return void 0;
-}
-__name(getProfileForDirectoryFromBindings, "getProfileForDirectoryFromBindings");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/error.js
-function getLineColFromPtr(string, ptr) {
-  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
-  return [lines.length, lines.pop().length + 1];
-}
-__name(getLineColFromPtr, "getLineColFromPtr");
-function makeCodeBlock(string, line, column) {
-  let lines = string.split(/\r\n|\n|\r/g);
-  let codeblock = "";
-  let numberLen = (Math.log10(line + 1) | 0) + 1;
-  for (let i = line - 1; i <= line + 1; i++) {
-    let l = lines[i - 1];
-    if (!l)
-      continue;
-    codeblock += i.toString().padEnd(numberLen, " ");
-    codeblock += ":  ";
-    codeblock += l;
-    codeblock += "\n";
-    if (i === line) {
-      codeblock += " ".repeat(numberLen + column + 2);
-      codeblock += "^\n";
-    }
-  }
-  return codeblock;
-}
-__name(makeCodeBlock, "makeCodeBlock");
-var TomlError = class extends Error {
-  static {
-    __name(this, "TomlError");
-  }
-  line;
-  column;
-  codeblock;
-  constructor(message, options) {
-    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
-    const codeblock = makeCodeBlock(options.toml, line, column);
-    super(`Invalid TOML document: ${message}
-
-${codeblock}`, options);
-    this.line = line;
-    this.column = column;
-    this.codeblock = codeblock;
-  }
-};
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/util.js
-function isEscaped(str, ptr) {
-  let i = 0;
-  while (str[ptr - ++i] === "\\")
-    ;
-  return --i && i % 2;
-}
-__name(isEscaped, "isEscaped");
-function indexOfNewline(str, start = 0, end = str.length) {
-  let idx = str.indexOf("\n", start);
-  if (str[idx - 1] === "\r")
-    idx--;
-  return idx <= end ? idx : -1;
-}
-__name(indexOfNewline, "indexOfNewline");
-function skipComment(str, ptr) {
-  for (let i = ptr; i < str.length; i++) {
-    let c = str[i];
-    if (c === "\n")
-      return i;
-    if (c === "\r" && str[i + 1] === "\n")
-      return i + 1;
-    if (c < " " && c !== "	" || c === "\x7F") {
-      throw new TomlError("control characters are not allowed in comments", {
-        toml: str,
-        ptr
-      });
-    }
-  }
-  return str.length;
-}
-__name(skipComment, "skipComment");
-function skipVoid(str, ptr, banNewLines, banComments) {
-  let c;
-  while ((c = str[ptr]) === " " || c === "	" || !banNewLines && (c === "\n" || c === "\r" && str[ptr + 1] === "\n"))
-    ptr++;
-  return banComments || c !== "#" ? ptr : skipVoid(str, skipComment(str, ptr), banNewLines);
-}
-__name(skipVoid, "skipVoid");
-function skipUntil(str, ptr, sep, end, banNewLines = false) {
-  if (!end) {
-    ptr = indexOfNewline(str, ptr);
-    return ptr < 0 ? str.length : ptr;
-  }
-  for (let i = ptr; i < str.length; i++) {
-    let c = str[i];
-    if (c === "#") {
-      i = indexOfNewline(str, i);
-    } else if (c === sep) {
-      return i + 1;
-    } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i + 1] === "\n")) {
-      return i;
-    }
-  }
-  throw new TomlError("cannot find end of structure", {
-    toml: str,
-    ptr
-  });
-}
-__name(skipUntil, "skipUntil");
-function getStringEnd(str, seek) {
-  let first = str[seek];
-  let target = first === str[seek + 1] && str[seek + 1] === str[seek + 2] ? str.slice(seek, seek + 3) : first;
-  seek += target.length - 1;
-  do
-    seek = str.indexOf(target, ++seek);
-  while (seek > -1 && first !== "'" && isEscaped(str, seek));
-  if (seek > -1) {
-    seek += target.length;
-    if (target.length > 1) {
-      if (str[seek] === first)
-        seek++;
-      if (str[seek] === first)
-        seek++;
-    }
-  }
-  return seek;
-}
-__name(getStringEnd, "getStringEnd");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/date.js
-var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i;
-var TomlDate = class _TomlDate extends Date {
-  static {
-    __name(this, "TomlDate");
-  }
-  #hasDate = false;
-  #hasTime = false;
-  #offset = null;
-  constructor(date) {
-    let hasDate = true;
-    let hasTime = true;
-    let offset = "Z";
-    if (typeof date === "string") {
-      let match = date.match(DATE_TIME_RE);
-      if (match) {
-        if (!match[1]) {
-          hasDate = false;
-          date = `0000-01-01T${date}`;
-        }
-        hasTime = !!match[2];
-        hasTime && date[10] === " " && (date = date.replace(" ", "T"));
-        if (match[2] && +match[2] > 23) {
-          date = "";
-        } else {
-          offset = match[3] || null;
-          date = date.toUpperCase();
-          if (!offset && hasTime)
-            date += "Z";
-        }
-      } else {
-        date = "";
-      }
-    }
-    super(date);
-    if (!isNaN(this.getTime())) {
-      this.#hasDate = hasDate;
-      this.#hasTime = hasTime;
-      this.#offset = offset;
-    }
-  }
-  isDateTime() {
-    return this.#hasDate && this.#hasTime;
-  }
-  isLocal() {
-    return !this.#hasDate || !this.#hasTime || !this.#offset;
-  }
-  isDate() {
-    return this.#hasDate && !this.#hasTime;
-  }
-  isTime() {
-    return this.#hasTime && !this.#hasDate;
-  }
-  isValid() {
-    return this.#hasDate || this.#hasTime;
-  }
-  toISOString() {
-    let iso = super.toISOString();
-    if (this.isDate())
-      return iso.slice(0, 10);
-    if (this.isTime())
-      return iso.slice(11, 23);
-    if (this.#offset === null)
-      return iso.slice(0, -1);
-    if (this.#offset === "Z")
-      return iso;
-    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
-    offset = this.#offset[0] === "-" ? offset : -offset;
-    let offsetDate = new Date(this.getTime() - offset * 6e4);
-    return offsetDate.toISOString().slice(0, -1) + this.#offset;
-  }
-  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
-    let date = new _TomlDate(jsDate);
-    date.#offset = offset;
-    return date;
-  }
-  static wrapAsLocalDateTime(jsDate) {
-    let date = new _TomlDate(jsDate);
-    date.#offset = null;
-    return date;
-  }
-  static wrapAsLocalDate(jsDate) {
-    let date = new _TomlDate(jsDate);
-    date.#hasTime = false;
-    date.#offset = null;
-    return date;
-  }
-  static wrapAsLocalTime(jsDate) {
-    let date = new _TomlDate(jsDate);
-    date.#hasDate = false;
-    date.#offset = null;
-    return date;
-  }
-};
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/primitive.js
-var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
-var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
-var LEADING_ZERO = /^[+-]?0[0-9_]/;
-var ESCAPE_REGEX = /^[0-9a-f]{4,8}$/i;
-var ESC_MAP = {
-  b: "\b",
-  t: "	",
-  n: "\n",
-  f: "\f",
-  r: "\r",
-  '"': '"',
-  "\\": "\\"
-};
-function parseString(str, ptr = 0, endPtr = str.length) {
-  let isLiteral = str[ptr] === "'";
-  let isMultiline = str[ptr++] === str[ptr] && str[ptr] === str[ptr + 1];
-  if (isMultiline) {
-    endPtr -= 2;
-    if (str[ptr += 2] === "\r")
-      ptr++;
-    if (str[ptr] === "\n")
-      ptr++;
-  }
-  let tmp = 0;
-  let isEscape;
-  let parsed = "";
-  let sliceStart = ptr;
-  while (ptr < endPtr - 1) {
-    let c = str[ptr++];
-    if (c === "\n" || c === "\r" && str[ptr] === "\n") {
-      if (!isMultiline) {
-        throw new TomlError("newlines are not allowed in strings", {
-          toml: str,
-          ptr: ptr - 1
-        });
-      }
-    } else if (c < " " && c !== "	" || c === "\x7F") {
-      throw new TomlError("control characters are not allowed in strings", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    }
-    if (isEscape) {
-      isEscape = false;
-      if (c === "u" || c === "U") {
-        let code = str.slice(ptr, ptr += c === "u" ? 4 : 8);
-        if (!ESCAPE_REGEX.test(code)) {
-          throw new TomlError("invalid unicode escape", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-        try {
-          parsed += String.fromCodePoint(parseInt(code, 16));
-        } catch {
-          throw new TomlError("invalid unicode escape", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-      } else if (isMultiline && (c === "\n" || c === " " || c === "	" || c === "\r")) {
-        ptr = skipVoid(str, ptr - 1, true);
-        if (str[ptr] !== "\n" && str[ptr] !== "\r") {
-          throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-        ptr = skipVoid(str, ptr);
-      } else if (c in ESC_MAP) {
-        parsed += ESC_MAP[c];
-      } else {
-        throw new TomlError("unrecognized escape sequence", {
-          toml: str,
-          ptr: tmp
-        });
-      }
-      sliceStart = ptr;
-    } else if (!isLiteral && c === "\\") {
-      tmp = ptr - 1;
-      isEscape = true;
-      parsed += str.slice(sliceStart, tmp);
-    }
-  }
-  return parsed + str.slice(sliceStart, endPtr - 1);
-}
-__name(parseString, "parseString");
-function parseValue(value, toml, ptr, integersAsBigInt) {
-  if (value === "true")
-    return true;
-  if (value === "false")
-    return false;
-  if (value === "-inf")
-    return -Infinity;
-  if (value === "inf" || value === "+inf")
-    return Infinity;
-  if (value === "nan" || value === "+nan" || value === "-nan")
-    return NaN;
-  if (value === "-0")
-    return integersAsBigInt ? 0n : 0;
-  let isInt = INT_REGEX.test(value);
-  if (isInt || FLOAT_REGEX.test(value)) {
-    if (LEADING_ZERO.test(value)) {
-      throw new TomlError("leading zeroes are not allowed", {
-        toml,
-        ptr
-      });
-    }
-    value = value.replace(/_/g, "");
-    let numeric = +value;
-    if (isNaN(numeric)) {
-      throw new TomlError("invalid number", {
-        toml,
-        ptr
-      });
-    }
-    if (isInt) {
-      if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
-        throw new TomlError("integer value cannot be represented losslessly", {
-          toml,
-          ptr
-        });
-      }
-      if (isInt || integersAsBigInt === true)
-        numeric = BigInt(value);
-    }
-    return numeric;
-  }
-  const date = new TomlDate(value);
-  if (!date.isValid()) {
-    throw new TomlError("invalid value", {
-      toml,
-      ptr
-    });
-  }
-  return date;
-}
-__name(parseValue, "parseValue");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/extract.js
-function sliceAndTrimEndOf(str, startPtr, endPtr, allowNewLines) {
-  let value = str.slice(startPtr, endPtr);
-  let commentIdx = value.indexOf("#");
-  if (commentIdx > -1) {
-    skipComment(str, commentIdx);
-    value = value.slice(0, commentIdx);
-  }
-  let trimmed = value.trimEnd();
-  if (!allowNewLines) {
-    let newlineIdx = value.indexOf("\n", trimmed.length);
-    if (newlineIdx > -1) {
-      throw new TomlError("newlines are not allowed in inline tables", {
-        toml: str,
-        ptr: startPtr + newlineIdx
-      });
-    }
-  }
-  return [trimmed, commentIdx];
-}
-__name(sliceAndTrimEndOf, "sliceAndTrimEndOf");
-function extractValue(str, ptr, end, depth, integersAsBigInt) {
-  if (depth === 0) {
-    throw new TomlError("document contains excessively nested structures. aborting.", {
-      toml: str,
-      ptr
-    });
-  }
-  let c = str[ptr];
-  if (c === "[" || c === "{") {
-    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
-    let newPtr = end ? skipUntil(str, endPtr2, ",", end) : endPtr2;
-    if (endPtr2 - newPtr && end === "}") {
-      let nextNewLine = indexOfNewline(str, endPtr2, newPtr);
-      if (nextNewLine > -1) {
-        throw new TomlError("newlines are not allowed in inline tables", {
-          toml: str,
-          ptr: nextNewLine
-        });
-      }
-    }
-    return [value, newPtr];
-  }
-  let endPtr;
-  if (c === '"' || c === "'") {
-    endPtr = getStringEnd(str, ptr);
-    let parsed = parseString(str, ptr, endPtr);
-    if (end) {
-      endPtr = skipVoid(str, endPtr, end !== "]");
-      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== "\n" && str[endPtr] !== "\r") {
-        throw new TomlError("unexpected character encountered", {
-          toml: str,
-          ptr: endPtr
-        });
-      }
-      endPtr += +(str[endPtr] === ",");
-    }
-    return [parsed, endPtr];
-  }
-  endPtr = skipUntil(str, ptr, ",", end);
-  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","), end === "]");
-  if (!slice[0]) {
-    throw new TomlError("incomplete key-value declaration: no value specified", {
-      toml: str,
-      ptr
-    });
-  }
-  if (end && slice[1] > -1) {
-    endPtr = skipVoid(str, ptr + slice[1]);
-    endPtr += +(str[endPtr] === ",");
-  }
-  return [
-    parseValue(slice[0], str, ptr, integersAsBigInt),
-    endPtr
-  ];
-}
-__name(extractValue, "extractValue");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/struct.js
-var KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
-function parseKey(str, ptr, end = "=") {
-  let dot = ptr - 1;
-  let parsed = [];
-  let endPtr = str.indexOf(end, ptr);
-  if (endPtr < 0) {
-    throw new TomlError("incomplete key-value: cannot find end of key", {
-      toml: str,
-      ptr
-    });
-  }
-  do {
-    let c = str[ptr = ++dot];
-    if (c !== " " && c !== "	") {
-      if (c === '"' || c === "'") {
-        if (c === str[ptr + 1] && c === str[ptr + 2]) {
-          throw new TomlError("multiline strings are not allowed in keys", {
-            toml: str,
-            ptr
-          });
-        }
-        let eos = getStringEnd(str, ptr);
-        if (eos < 0) {
-          throw new TomlError("unfinished string encountered", {
-            toml: str,
-            ptr
-          });
-        }
-        dot = str.indexOf(".", eos);
-        let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
-        let newLine = indexOfNewline(strEnd);
-        if (newLine > -1) {
-          throw new TomlError("newlines are not allowed in keys", {
-            toml: str,
-            ptr: ptr + dot + newLine
-          });
-        }
-        if (strEnd.trimStart()) {
-          throw new TomlError("found extra tokens after the string part", {
-            toml: str,
-            ptr: eos
-          });
-        }
-        if (endPtr < eos) {
-          endPtr = str.indexOf(end, eos);
-          if (endPtr < 0) {
-            throw new TomlError("incomplete key-value: cannot find end of key", {
-              toml: str,
-              ptr
-            });
-          }
-        }
-        parsed.push(parseString(str, ptr, eos));
-      } else {
-        dot = str.indexOf(".", ptr);
-        let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
-        if (!KEY_PART_RE.test(part)) {
-          throw new TomlError("only letter, numbers, dashes and underscores are allowed in keys", {
-            toml: str,
-            ptr
-          });
-        }
-        parsed.push(part.trimEnd());
-      }
-    }
-  } while (dot + 1 && dot < endPtr);
-  return [parsed, skipVoid(str, endPtr + 1, true, true)];
-}
-__name(parseKey, "parseKey");
-function parseInlineTable(str, ptr, depth, integersAsBigInt) {
-  let res = {};
-  let seen = /* @__PURE__ */ new Set();
-  let c;
-  let comma = 0;
-  ptr++;
-  while ((c = str[ptr++]) !== "}" && c) {
-    let err = { toml: str, ptr: ptr - 1 };
-    if (c === "\n") {
-      throw new TomlError("newlines are not allowed in inline tables", err);
-    } else if (c === "#") {
-      throw new TomlError("inline tables cannot contain comments", err);
-    } else if (c === ",") {
-      throw new TomlError("expected key-value, found comma", err);
-    } else if (c !== " " && c !== "	") {
-      let k;
-      let t = res;
-      let hasOwn = false;
-      let [key, keyEndPtr] = parseKey(str, ptr - 1);
-      for (let i = 0; i < key.length; i++) {
-        if (i)
-          t = hasOwn ? t[k] : t[k] = {};
-        k = key[i];
-        if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
-          throw new TomlError("trying to redefine an already defined value", {
-            toml: str,
-            ptr
-          });
-        }
-        if (!hasOwn && k === "__proto__") {
-          Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
-        }
-      }
-      if (hasOwn) {
-        throw new TomlError("trying to redefine an already defined value", {
-          toml: str,
-          ptr
-        });
-      }
-      let [value, valueEndPtr] = extractValue(str, keyEndPtr, "}", depth - 1, integersAsBigInt);
-      seen.add(value);
-      t[k] = value;
-      ptr = valueEndPtr;
-      comma = str[ptr - 1] === "," ? ptr - 1 : 0;
-    }
-  }
-  if (comma) {
-    throw new TomlError("trailing commas are not allowed in inline tables", {
-      toml: str,
-      ptr: comma
-    });
-  }
-  if (!c) {
-    throw new TomlError("unfinished table encountered", {
-      toml: str,
-      ptr
-    });
-  }
-  return [res, ptr];
-}
-__name(parseInlineTable, "parseInlineTable");
-function parseArray(str, ptr, depth, integersAsBigInt) {
-  let res = [];
-  let c;
-  ptr++;
-  while ((c = str[ptr++]) !== "]" && c) {
-    if (c === ",") {
-      throw new TomlError("expected value, found comma", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    } else if (c === "#")
-      ptr = skipComment(str, ptr);
-    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
-      let e = extractValue(str, ptr - 1, "]", depth - 1, integersAsBigInt);
-      res.push(e[0]);
-      ptr = e[1];
-    }
-  }
-  if (!c) {
-    throw new TomlError("unfinished array encountered", {
-      toml: str,
-      ptr
-    });
-  }
-  return [res, ptr];
-}
-__name(parseArray, "parseArray");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/parse.js
-function peekTable(key, table, meta, type) {
-  let t = table;
-  let m = meta;
-  let k;
-  let hasOwn = false;
-  let state;
-  for (let i = 0; i < key.length; i++) {
-    if (i) {
-      t = hasOwn ? t[k] : t[k] = {};
-      m = (state = m[k]).c;
-      if (type === 0 && (state.t === 1 || state.t === 2)) {
-        return null;
-      }
-      if (state.t === 2) {
-        let l = t.length - 1;
-        t = t[l];
-        m = m[l].c;
-      }
-    }
-    k = key[i];
-    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
-      return null;
-    }
-    if (!hasOwn) {
-      if (k === "__proto__") {
-        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
-        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
-      }
-      m[k] = {
-        t: i < key.length - 1 && type === 2 ? 3 : type,
-        d: false,
-        i: 0,
-        c: {}
-      };
-    }
-  }
-  state = m[k];
-  if (state.t !== type && !(type === 1 && state.t === 3)) {
-    return null;
-  }
-  if (type === 2) {
-    if (!state.d) {
-      state.d = true;
-      t[k] = [];
-    }
-    t[k].push(t = {});
-    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
-  }
-  if (state.d) {
-    return null;
-  }
-  state.d = true;
-  if (type === 1) {
-    t = hasOwn ? t[k] : t[k] = {};
-  } else if (type === 0 && hasOwn) {
-    return null;
-  }
-  return [k, t, state.c];
-}
-__name(peekTable, "peekTable");
-function parse(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
-  let res = {};
-  let meta = {};
-  let tbl = res;
-  let m = meta;
-  for (let ptr = skipVoid(toml, 0); ptr < toml.length; ) {
-    if (toml[ptr] === "[") {
-      let isTableArray = toml[++ptr] === "[";
-      let k = parseKey(toml, ptr += +isTableArray, "]");
-      if (isTableArray) {
-        if (toml[k[1] - 1] !== "]") {
-          throw new TomlError("expected end of table declaration", {
-            toml,
-            ptr: k[1] - 1
-          });
-        }
-        k[1]++;
-      }
-      let p = peekTable(
-        k[0],
-        res,
-        meta,
-        isTableArray ? 2 : 1
-        /* Type.EXPLICIT */
-      );
-      if (!p) {
-        throw new TomlError("trying to redefine an already defined table or value", {
-          toml,
-          ptr
-        });
-      }
-      m = p[2];
-      tbl = p[1];
-      ptr = k[1];
-    } else {
-      let k = parseKey(toml, ptr);
-      let p = peekTable(
-        k[0],
-        tbl,
-        m,
-        0
-        /* Type.DOTTED */
-      );
-      if (!p) {
-        throw new TomlError("trying to redefine an already defined table or value", {
-          toml,
-          ptr
-        });
-      }
-      let v = extractValue(toml, k[1], void 0, maxDepth, integersAsBigInt);
-      p[1][p[0]] = v[0];
-      ptr = v[1];
-    }
-    ptr = skipVoid(toml, ptr, true);
-    if (toml[ptr] && toml[ptr] !== "\n" && toml[ptr] !== "\r") {
-      throw new TomlError("each key-value declaration must be followed by an end-of-line", {
-        toml,
-        ptr
-      });
-    }
-    ptr = skipVoid(toml, ptr);
-  }
-  return res;
-}
-__name(parse, "parse");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/stringify.js
-var BARE_KEY = /^[a-z0-9-_]+$/i;
-function extendedTypeOf(obj) {
-  let type = typeof obj;
-  if (type === "object") {
-    if (Array.isArray(obj))
-      return "array";
-    if (obj instanceof Date)
-      return "date";
-  }
-  return type;
-}
-__name(extendedTypeOf, "extendedTypeOf");
-function isArrayOfTables(obj) {
-  for (let i = 0; i < obj.length; i++) {
-    if (extendedTypeOf(obj[i]) !== "object")
-      return false;
-  }
-  return obj.length != 0;
-}
-__name(isArrayOfTables, "isArrayOfTables");
-function formatString(s) {
-  return JSON.stringify(s).replace(/\x7f/g, "\\u007f");
-}
-__name(formatString, "formatString");
-function stringifyValue(val, type, depth, numberAsFloat) {
-  if (depth === 0) {
-    throw new Error("Could not stringify the object: maximum object depth exceeded");
-  }
-  if (type === "number") {
-    if (isNaN(val))
-      return "nan";
-    if (val === Infinity)
-      return "inf";
-    if (val === -Infinity)
-      return "-inf";
-    if (numberAsFloat && Number.isInteger(val))
-      return val.toFixed(1);
-    return val.toString();
-  }
-  if (type === "bigint" || type === "boolean") {
-    return val.toString();
-  }
-  if (type === "string") {
-    return formatString(val);
-  }
-  if (type === "date") {
-    if (isNaN(val.getTime())) {
-      throw new TypeError("cannot serialize invalid date");
-    }
-    return val.toISOString();
-  }
-  if (type === "object") {
-    return stringifyInlineTable(val, depth, numberAsFloat);
-  }
-  if (type === "array") {
-    return stringifyArray(val, depth, numberAsFloat);
-  }
-}
-__name(stringifyValue, "stringifyValue");
-function stringifyInlineTable(obj, depth, numberAsFloat) {
-  let keys = Object.keys(obj);
-  if (keys.length === 0)
-    return "{}";
-  let res = "{ ";
-  for (let i = 0; i < keys.length; i++) {
-    let k = keys[i];
-    if (i)
-      res += ", ";
-    res += BARE_KEY.test(k) ? k : formatString(k);
-    res += " = ";
-    res += stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat);
-  }
-  return res + " }";
-}
-__name(stringifyInlineTable, "stringifyInlineTable");
-function stringifyArray(array, depth, numberAsFloat) {
-  if (array.length === 0)
-    return "[]";
-  let res = "[ ";
-  for (let i = 0; i < array.length; i++) {
-    if (i)
-      res += ", ";
-    if (array[i] === null || array[i] === void 0) {
-      throw new TypeError("arrays cannot contain null or undefined values");
-    }
-    res += stringifyValue(array[i], extendedTypeOf(array[i]), depth - 1, numberAsFloat);
-  }
-  return res + " ]";
-}
-__name(stringifyArray, "stringifyArray");
-function stringifyArrayTable(array, key, depth, numberAsFloat) {
-  if (depth === 0) {
-    throw new Error("Could not stringify the object: maximum object depth exceeded");
-  }
-  let res = "";
-  for (let i = 0; i < array.length; i++) {
-    res += `${res && "\n"}[[${key}]]
-`;
-    res += stringifyTable(0, array[i], key, depth, numberAsFloat);
-  }
-  return res;
-}
-__name(stringifyArrayTable, "stringifyArrayTable");
-function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
-  if (depth === 0) {
-    throw new Error("Could not stringify the object: maximum object depth exceeded");
-  }
-  let preamble = "";
-  let tables = "";
-  let keys = Object.keys(obj);
-  for (let i = 0; i < keys.length; i++) {
-    let k = keys[i];
-    if (obj[k] !== null && obj[k] !== void 0) {
-      let type = extendedTypeOf(obj[k]);
-      if (type === "symbol" || type === "function") {
-        throw new TypeError(`cannot serialize values of type '${type}'`);
-      }
-      let key = BARE_KEY.test(k) ? k : formatString(k);
-      if (type === "array" && isArrayOfTables(obj[k])) {
-        tables += (tables && "\n") + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
-      } else if (type === "object") {
-        let tblKey = prefix ? `${prefix}.${key}` : key;
-        tables += (tables && "\n") + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat);
-      } else {
-        preamble += key;
-        preamble += " = ";
-        preamble += stringifyValue(obj[k], type, depth, numberAsFloat);
-        preamble += "\n";
-      }
-    }
-  }
-  if (tableKey && (preamble || !tables))
-    preamble = preamble ? `[${tableKey}]
-${preamble}` : `[${tableKey}]`;
-  return preamble && tables ? `${preamble}
-${tables}` : preamble || tables;
-}
-__name(stringifyTable, "stringifyTable");
-function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
-  if (extendedTypeOf(obj) !== "object") {
-    throw new TypeError("stringify can only be called with an object");
-  }
-  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
-  if (str[str.length - 1] !== "\n")
-    return str + "\n";
-  return str;
-}
-__name(stringify, "stringify");
-
-// ../../node_modules/.pnpm/smol-toml@1.5.2/node_modules/smol-toml/dist/index.js
-var dist_default = { parse, stringify, TomlDate, TomlError };
-
-// src/credential-store/file-store.ts
-var USER_AUTH_CONFIG_PATH = "config";
-function resolveAuthProfileBaseName(profile) {
-  if (profile === void 0 || profile === "default") {
-    const environment = getCloudflareApiEnvironmentFromEnv();
-    return environment === "production" ? "default" : environment;
-  }
-  validateProfileName(profile);
-  return profile;
-}
-__name(resolveAuthProfileBaseName, "resolveAuthProfileBaseName");
-function getAuthConfigFilePath(configPath, profile) {
-  return path4.join(
-    configPath,
-    USER_AUTH_CONFIG_PATH,
-    `${resolveAuthProfileBaseName(profile)}.toml`
-  );
-}
-__name(getAuthConfigFilePath, "getAuthConfigFilePath");
-var FileCredentialStore = class {
-  /**
-   * @param configPath consumer-provided global config directory (the CLI
-   * owns where its config lives, so workers-auth never resolves it itself).
-   * @param profile the auth profile (defaults to the active environment's
-   * default profile).
-   */
-  constructor(configPath, profile) {
-    this.configPath = configPath;
-    this.profile = profile;
-  }
-  static {
-    __name(this, "FileCredentialStore");
-  }
-  kind = "file";
-  read() {
-    const filePath = getAuthConfigFilePath(this.configPath, this.profile);
-    if (!existsSync(filePath)) {
-      return void 0;
-    }
-    return parseTOML(readFileSync(filePath));
-  }
-  write(config) {
-    const filePath = getAuthConfigFilePath(this.configPath, this.profile);
-    mkdirSync(path4.dirname(filePath), { recursive: true });
-    writeFileSync(filePath, dist_default.stringify(config), {
-      encoding: "utf-8",
-      mode: 384
-    });
-    chmodSync(filePath, 384);
-  }
-  clear() {
-    const filePath = getAuthConfigFilePath(this.configPath, this.profile);
-    const existed = existsSync(filePath);
-    if (existed) {
-      rmSync(filePath);
-    }
-    return existed;
-  }
-  path() {
-    return getAuthConfigFilePath(this.configPath, this.profile);
-  }
-  describe() {
-    return getAuthConfigFilePath(this.configPath, this.profile);
-  }
-};
-var KEY_LENGTH_BYTES = 32;
-var IV_LENGTH_BYTES = 12;
-var TAG_LENGTH_BYTES = 16;
-var ALGORITHM_LABEL = "AES-256-GCM";
-var CIPHER_NAME = "aes-256-gcm";
-function generateKey() {
-  return new Uint8Array(randomBytes(KEY_LENGTH_BYTES));
-}
-__name(generateKey, "generateKey");
-function encryptString(plaintext, key) {
-  if (key.length !== KEY_LENGTH_BYTES) {
-    throw new Error(
-      `AES-256-GCM requires a ${KEY_LENGTH_BYTES}-byte key (got ${key.length} bytes).`
-    );
-  }
-  const iv = randomBytes(IV_LENGTH_BYTES);
-  const cipher = createCipheriv(CIPHER_NAME, key, iv);
-  const ciphertext = Buffer.concat([
-    cipher.update(plaintext, "utf-8"),
-    cipher.final()
-  ]);
-  const tag = cipher.getAuthTag();
-  return {
-    v: 1,
-    alg: ALGORITHM_LABEL,
-    iv: iv.toString("base64"),
-    tag: tag.toString("base64"),
-    ciphertext: ciphertext.toString("base64")
-  };
-}
-__name(encryptString, "encryptString");
-function decryptString(envelope, key) {
-  if (key.length !== KEY_LENGTH_BYTES) {
-    throw new Error(
-      `AES-256-GCM requires a ${KEY_LENGTH_BYTES}-byte key (got ${key.length} bytes).`
-    );
-  }
-  if (envelope.v !== 1) {
-    throw new Error(
-      `Unsupported encrypted envelope version: ${envelope.v}.`
-    );
-  }
-  const iv = Buffer.from(envelope.iv, "base64");
-  const tag = Buffer.from(envelope.tag, "base64");
-  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
-  if (iv.length !== IV_LENGTH_BYTES) {
-    throw new Error(
-      `Expected ${IV_LENGTH_BYTES}-byte IV in envelope (got ${iv.length} bytes).`
-    );
-  }
-  if (tag.length !== TAG_LENGTH_BYTES) {
-    throw new Error(
-      `Expected ${TAG_LENGTH_BYTES}-byte auth tag in envelope (got ${tag.length} bytes).`
-    );
-  }
-  const decipher = createDecipheriv(CIPHER_NAME, key, iv);
-  decipher.setAuthTag(tag);
-  const plaintext = Buffer.concat([
-    decipher.update(ciphertext),
-    // `final()` is where GCM verifies the auth tag and throws on
-    // mismatch. We let that error propagate so callers can decide
-    // whether to treat it as "not logged in" or surface it.
-    decipher.final()
-  ]);
-  return plaintext.toString("utf-8");
-}
-__name(decryptString, "decryptString");
-function parseEncryptedEnvelope(raw) {
-  if (typeof raw !== "object" || raw === null) {
-    return void 0;
-  }
-  const candidate = raw;
-  if (candidate.v !== 1 || candidate.alg !== ALGORITHM_LABEL || typeof candidate.iv !== "string" || typeof candidate.tag !== "string" || typeof candidate.ciphertext !== "string") {
-    return void 0;
-  }
-  return candidate;
-}
-__name(parseEncryptedEnvelope, "parseEncryptedEnvelope");
-
-// src/credential-store/encrypted-file-store.ts
-function getEncryptedAuthConfigFilePath(configPath, profile) {
-  return path4.join(
-    configPath,
-    "config",
-    `${resolveAuthProfileBaseName(profile)}.enc`
-  );
-}
-__name(getEncryptedAuthConfigFilePath, "getEncryptedAuthConfigFilePath");
-var EncryptedFileCredentialStore = class {
-  /**
-   * @param configPath consumer-provided global config directory (the CLI
-   * owns where its config lives, so workers-auth never resolves it itself).
-   * @param keyProvider the OS-keyring backend holding the encryption key.
-   * @param onPlaintextMigration optional callback invoked when a plaintext
-   * TOML file is migrated into the encrypted layout on first read.
-   * @param profile the auth profile (defaults to the active environment's
-   * default profile).
-   */
-  constructor(configPath, keyProvider, onPlaintextMigration, profile) {
-    this.configPath = configPath;
-    this.keyProvider = keyProvider;
-    this.onPlaintextMigration = onPlaintextMigration;
-    this.profile = profile;
-  }
-  static {
-    __name(this, "EncryptedFileCredentialStore");
-  }
-  kind = "encrypted-file";
-  read() {
-    const encryptedPath = getEncryptedAuthConfigFilePath(
-      this.configPath,
-      this.profile
-    );
-    if (existsSync(encryptedPath)) {
-      return this.readEncryptedFile(encryptedPath);
-    }
-    const plaintextPath = getAuthConfigFilePath(this.configPath, this.profile);
-    if (existsSync(plaintextPath)) {
-      return this.migrateFromPlaintext(plaintextPath, encryptedPath);
-    }
-    return void 0;
-  }
-  write(config) {
-    const key = this.ensureKey();
-    const plaintext = dist_default.stringify(config);
-    const envelope = encryptString(plaintext, key);
-    const encryptedPath = getEncryptedAuthConfigFilePath(
-      this.configPath,
-      this.profile
-    );
-    mkdirSync(path4.dirname(encryptedPath), { recursive: true });
-    writeFileSync(encryptedPath, JSON.stringify(envelope, null, "	"), {
-      encoding: "utf-8",
-      mode: 384
-    });
-    chmodSync(encryptedPath, 384);
-    const plaintextPath = getAuthConfigFilePath(this.configPath, this.profile);
-    if (existsSync(plaintextPath)) {
-      rmSync(plaintextPath);
-    }
-  }
-  clear() {
-    const encryptedPath = getEncryptedAuthConfigFilePath(
-      this.configPath,
-      this.profile
-    );
-    const plaintextPath = getAuthConfigFilePath(this.configPath, this.profile);
-    let existed = false;
-    if (existsSync(encryptedPath)) {
-      rmSync(encryptedPath);
-      existed = true;
-    }
-    if (existsSync(plaintextPath)) {
-      rmSync(plaintextPath);
-      existed = true;
-    }
-    try {
-      this.keyProvider.deleteKey();
-    } catch {
-    }
-    return existed;
-  }
-  path() {
-    return getEncryptedAuthConfigFilePath(this.configPath, this.profile);
-  }
-  describe() {
-    return `Encrypted file (${getEncryptedAuthConfigFilePath(this.configPath, this.profile)}) with key in ${this.keyProvider.describe()}`;
-  }
-  /* ------------------------------------------------------------------ */
-  /* Internals                                                           */
-  /* ------------------------------------------------------------------ */
-  readEncryptedFile(encryptedPath) {
-    const key = this.keyProvider.getKey();
-    if (key === void 0) {
-      return void 0;
-    }
-    const raw = readFileSync(encryptedPath);
-    let envelope;
-    try {
-      envelope = parseEncryptedEnvelope(JSON.parse(raw));
-    } catch {
-      return void 0;
-    }
-    if (envelope === void 0) {
-      return void 0;
-    }
-    let plaintext;
-    try {
-      plaintext = decryptString(envelope, key);
-    } catch {
-      return void 0;
-    }
-    try {
-      return dist_default.parse(plaintext);
-    } catch {
-      return void 0;
-    }
-  }
-  migrateFromPlaintext(plaintextPath, encryptedPath) {
-    const raw = readFileSync(plaintextPath);
-    let plaintext;
-    try {
-      plaintext = dist_default.parse(raw);
-    } catch {
-      return void 0;
-    }
-    this.write(plaintext);
-    this.onPlaintextMigration?.({
-      plaintextPath,
-      encryptedPath,
-      keyProviderDescription: this.keyProvider.describe()
-    });
-    return plaintext;
-  }
-  /**
-   * Return the existing encryption key, or generate + persist a fresh
-   * one when none exists yet. Called from `write()` so the first
-   * `wrangler login --use-keyring` is fully bootstrapping.
-   */
-  ensureKey() {
-    const existing = this.keyProvider.getKey();
-    if (existing !== void 0) {
-      return existing;
-    }
-    const fresh = generateKey();
-    this.keyProvider.setKey(fresh);
-    return fresh;
-  }
-};
-var PINNED_KEYRING_VERSION = "1.3.0";
-function defaultNpmRunner(args) {
-  return spawnSync("npm", args, {
-    encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"],
-    shell: process.platform === "win32"
-  });
-}
-__name(defaultNpmRunner, "defaultNpmRunner");
-var npmRunner = defaultNpmRunner;
-var cachedBindingPathByDir = /* @__PURE__ */ new Map();
-function setNpmRunner(fn) {
-  npmRunner = fn ?? defaultNpmRunner;
-  cachedBindingPathByDir.clear();
-}
-__name(setNpmRunner, "setNpmRunner");
-function getKeyringInstallDir(configPath) {
-  return path4.join(configPath, "native", "keyring");
-}
-__name(getKeyringInstallDir, "getKeyringInstallDir");
-function getInstalledBindingPath(installDir) {
-  return path4.join(installDir, "node_modules", "@napi-rs", "keyring");
-}
-__name(getInstalledBindingPath, "getInstalledBindingPath");
-function findKeyringBinding(installDir) {
-  const cached = cachedBindingPathByDir.get(installDir);
-  if (cached !== void 0) {
-    return cached;
-  }
-  const lazy = getInstalledBindingPath(installDir);
-  if (existsSync(path4.join(lazy, "index.js"))) {
-    cachedBindingPathByDir.set(installDir, lazy);
-    return lazy;
-  }
-  try {
-    const r = npmRunner(["root", "-g"]);
-    if (r.status === 0) {
-      const global = path4.join(r.stdout.trim(), "@napi-rs", "keyring");
-      if (existsSync(path4.join(global, "index.js"))) {
-        cachedBindingPathByDir.set(installDir, global);
-        return global;
-      }
-    }
-  } catch {
-  }
-  cachedBindingPathByDir.set(installDir, null);
-  return null;
-}
-__name(findKeyringBinding, "findKeyringBinding");
-function installKeyringBindingSync(installDir) {
-  const dir = installDir;
-  mkdirSync(dir, { recursive: true });
-  const hostPkgJson = path4.join(dir, "package.json");
-  if (!existsSync(hostPkgJson)) {
-    writeFileSync(
-      hostPkgJson,
-      JSON.stringify(
-        { private: true, name: "cloudflare-auth-keyring-host" },
-        null,
-        "	"
-      ),
-      "utf-8"
-    );
-  }
-  let r;
-  try {
-    r = npmRunner([
-      "install",
-      `@napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
-      "--prefix",
-      dir,
-      "--no-save",
-      "--no-audit",
-      "--no-fund",
-      "--no-package-lock",
-      "--loglevel=error"
-    ]);
-  } catch (e) {
-    throw new UserError(
-      `Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error ? e.message : String(e)}
-
-Install \`npm\` and retry, or install the binding globally:
-  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
-      { telemetryMessage: "workers-auth keyring npm spawn failed" }
-    );
-  }
-  if (r.status !== 0) {
-    throw new UserError(
-      `Failed to install \`@napi-rs/keyring\` (npm exited ${r.status}):
-${r.stderr?.trim() ?? "(no stderr)"}
-
-Retry once the underlying issue is fixed, or install the binding globally:
-  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
-      { telemetryMessage: "workers-auth keyring npm install failed" }
-    );
-  }
-  cachedBindingPathByDir.delete(installDir);
-}
-__name(installKeyringBindingSync, "installKeyringBindingSync");
-var entryFactoryOverride;
-function setKeyringEntryFactory(factory) {
-  entryFactoryOverride = factory;
-}
-__name(setKeyringEntryFactory, "setKeyringEntryFactory");
-var dynamicRequire = createRequire(__filename);
-function resolveKeyringEntryFactory(installDir) {
-  if (entryFactoryOverride !== void 0) {
-    return entryFactoryOverride;
-  }
-  const bindingPath = findKeyringBinding(installDir);
-  if (bindingPath === null) {
-    throw new Error(
-      "`@napi-rs/keyring` binding not found. Call `installKeyringBindingSync()` first."
-    );
-  }
-  const mod = dynamicRequire(bindingPath);
-  return (service, account) => new mod.Entry(service, account);
-}
-__name(resolveKeyringEntryFactory, "resolveKeyringEntryFactory");
-
-// src/credential-store/key-providers/shared.ts
-function getKeyringAccountName(profile) {
-  return resolveAuthProfileBaseName(profile);
-}
-__name(getKeyringAccountName, "getKeyringAccountName");
-function encodeKeyEnvelope(key) {
-  const envelope = {
-    v: 1,
-    key: Buffer.from(key).toString("base64"),
-    created: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  return JSON.stringify(envelope);
-}
-__name(encodeKeyEnvelope, "encodeKeyEnvelope");
-function decodeKeyEnvelope(raw) {
-  if (raw === "") {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-  if (typeof parsed !== "object" || parsed === null || parsed.v !== 1 || typeof parsed.key !== "string") {
-    return void 0;
-  }
-  try {
-    const buf = Buffer.from(parsed.key, "base64");
-    if (buf.length !== 32) {
-      return void 0;
-    }
-    return new Uint8Array(buf);
-  } catch {
-    return void 0;
-  }
-}
-__name(decodeKeyEnvelope, "decodeKeyEnvelope");
-
-// src/credential-store/key-providers/linux-secret-tool.ts
-function defaultRunner(args, options = {}) {
-  return spawnSync("secret-tool", args, {
-    encoding: "utf-8",
-    input: options.input
-  });
-}
-__name(defaultRunner, "defaultRunner");
-var runner = defaultRunner;
-var cachedProbeResult = void 0;
-function setLinuxSecretToolRunner(fn) {
-  runner = fn ?? defaultRunner;
-  cachedProbeResult = void 0;
-}
-__name(setLinuxSecretToolRunner, "setLinuxSecretToolRunner");
-function probeSecretTool() {
-  if (cachedProbeResult !== void 0) {
-    return cachedProbeResult;
-  }
-  let result;
-  try {
-    const r = runner(["--version"]);
-    result = r.status === 0;
-  } catch {
-    result = false;
-  }
-  cachedProbeResult = result;
-  return result;
-}
-__name(probeSecretTool, "probeSecretTool");
-var LinuxSecretToolKeyProvider = class {
-  constructor(serviceName, profile) {
-    this.serviceName = serviceName;
-    this.profile = profile;
-  }
-  static {
-    __name(this, "LinuxSecretToolKeyProvider");
-  }
-  getKey() {
-    const r = runner([
-      "lookup",
-      "service",
-      this.serviceName,
-      "account",
-      getKeyringAccountName(this.profile)
-    ]);
-    if (r.status === 1) {
-      return void 0;
-    }
-    if (r.status !== 0) {
-      throw new Error(
-        `Failed to read key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
-      );
-    }
-    return decodeKeyEnvelope(r.stdout.trim());
-  }
-  setKey(key) {
-    const r = runner(
-      [
-        "store",
-        "--label=Cloudflare credentials key",
-        "service",
-        this.serviceName,
-        "account",
-        getKeyringAccountName(this.profile)
-      ],
-      { input: encodeKeyEnvelope(key) }
-    );
-    if (r.status !== 0) {
-      throw new Error(
-        `Failed to write key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
-      );
-    }
-  }
-  deleteKey() {
-    const r = runner([
-      "clear",
-      "service",
-      this.serviceName,
-      "account",
-      getKeyringAccountName(this.profile)
-    ]);
-    if (r.status !== 0) {
-      throw new Error(
-        `Failed to delete key via secret-tool (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
-      );
-    }
-  }
-  describe() {
-    return `Linux secret-tool (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
-  }
-};
-var SECURITY_EXIT_ITEM_NOT_FOUND = 44;
-function defaultRunner2(args, options = {}) {
-  return spawnSync("/usr/bin/security", args, {
-    encoding: "utf-8",
-    input: options.input
-  });
-}
-__name(defaultRunner2, "defaultRunner");
-var runner2 = defaultRunner2;
-function setMacSecurityCommandRunner(fn) {
-  runner2 = fn ?? defaultRunner2;
-}
-__name(setMacSecurityCommandRunner, "setMacSecurityCommandRunner");
-var MacSecurityKeyProvider = class {
-  constructor(serviceName, profile) {
-    this.serviceName = serviceName;
-    this.profile = profile;
-  }
-  static {
-    __name(this, "MacSecurityKeyProvider");
-  }
-  getKey() {
-    const r = runner2([
-      "find-generic-password",
-      "-s",
-      this.serviceName,
-      "-a",
-      getKeyringAccountName(this.profile),
-      "-w"
-    ]);
-    if (r.status === SECURITY_EXIT_ITEM_NOT_FOUND) {
-      return void 0;
-    }
-    if (r.status !== 0) {
-      throw new Error(
-        `Failed to read key from macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
-      );
-    }
-    return decodeKeyEnvelope(r.stdout.trim());
-  }
-  setKey(key) {
-    const r = runner2([
-      "add-generic-password",
-      "-s",
-      this.serviceName,
-      "-a",
-      getKeyringAccountName(this.profile),
-      "-w",
-      encodeKeyEnvelope(key),
-      "-U"
-    ]);
-    if (r.status !== 0) {
-      throw new Error(
-        `Failed to write key to macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
-      );
-    }
-  }
-  deleteKey() {
-    const r = runner2([
-      "delete-generic-password",
-      "-s",
-      this.serviceName,
-      "-a",
-      getKeyringAccountName(this.profile)
-    ]);
-    if (r.status === 0 || r.status === SECURITY_EXIT_ITEM_NOT_FOUND) {
-      return;
-    }
-    throw new Error(
-      `Failed to delete key from macOS Keychain (exit ${r.status}): ${r.stderr?.trim() ?? "(no stderr)"}`
-    );
-  }
-  describe() {
-    return `macOS Keychain (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
-  }
-};
-
-// src/credential-store/key-providers/napi-keyring.ts
-var NapiKeyringKeyProvider = class {
-  /**
-   * @param serviceName keyring service identifier (e.g. `"wrangler"`).
-   * @param installDir directory hosting the lazy-installed `@napi-rs/keyring`
-   * binding, derived from the consumer's config path.
-   * @param profile the auth profile (selects the keyring account name).
-   */
-  constructor(serviceName, installDir, profile) {
-    this.serviceName = serviceName;
-    this.installDir = installDir;
-    this.profile = profile;
-  }
-  static {
-    __name(this, "NapiKeyringKeyProvider");
-  }
-  // Resolve the entry factory (and account name) lazily on every call
-  // rather than caching them on construction: on Windows the native
-  // binding is installed *after* this provider is constructed (the
-  // resolver builds the provider, then runs the install), and tests
-  // swap the factory between operations via `setKeyringEntryFactory`.
-  // Caching on the instance would pin a stale/absent factory. The
-  // account-name lookup is a cheap env read, so recomputing is free.
-  entry() {
-    return resolveKeyringEntryFactory(this.installDir)(
-      this.serviceName,
-      getKeyringAccountName(this.profile)
-    );
-  }
-  getKey() {
-    const raw = this.entry().getPassword();
-    if (raw === null || raw === "") {
-      return void 0;
-    }
-    return decodeKeyEnvelope(raw);
-  }
-  setKey(key) {
-    this.entry().setPassword(encodeKeyEnvelope(key));
-  }
-  deleteKey() {
-    try {
-      this.entry().deletePassword();
-    } catch {
-    }
-  }
-  describe() {
-    const platformName = process.platform === "win32" ? "Windows Credential Manager" : "OS keyring";
-    return `${platformName} via @napi-rs/keyring (service=${this.serviceName}, account=${getKeyringAccountName(this.profile)})`;
-  }
-};
-
-// src/credential-store/key-providers/factory.ts
-var testProviderFactory;
-function setKeyProviderFactoryForTesting(factory) {
-  testProviderFactory = factory;
-}
-__name(setKeyProviderFactoryForTesting, "setKeyProviderFactoryForTesting");
-function resolveKeyProvider(serviceName, profile, configPath) {
-  if (testProviderFactory !== void 0) {
-    return {
-      kind: "available",
-      provider: testProviderFactory(serviceName, profile)
-    };
-  }
-  switch (process.platform) {
-    case "darwin":
-      return {
-        kind: "available",
-        provider: new MacSecurityKeyProvider(serviceName, profile)
-      };
-    case "linux":
-      if (probeSecretTool()) {
-        return {
-          kind: "available",
-          provider: new LinuxSecretToolKeyProvider(serviceName, profile)
-        };
-      }
-      return { kind: "unsupported" };
-    case "win32": {
-      const installDir = getKeyringInstallDir(configPath);
-      if (findKeyringBinding(installDir) !== null) {
-        return {
-          kind: "available",
-          provider: new NapiKeyringKeyProvider(
-            serviceName,
-            installDir,
-            profile
-          )
-        };
-      }
-      return {
-        kind: "needs-install",
-        install: /* @__PURE__ */ __name(() => installKeyringBindingSync(installDir), "install"),
-        afterInstall: /* @__PURE__ */ __name(() => new NapiKeyringKeyProvider(serviceName, installDir, profile), "afterInstall")
-      };
-    }
-    default:
-      return { kind: "unsupported" };
-  }
-}
-__name(resolveKeyProvider, "resolveKeyProvider");
-
-// src/credential-store/state.ts
-var sessionFlags = {
-  installFailedThisSession: false,
-  hasWarnedAboutKeyringFallback: false,
-  hasWarnedAboutSecretToolMissing: false
-};
-function getResolverSessionFlags() {
-  return sessionFlags;
-}
-__name(getResolverSessionFlags, "getResolverSessionFlags");
-function resetCredentialStorageState() {
-  sessionFlags.installFailedThisSession = false;
-  sessionFlags.hasWarnedAboutKeyringFallback = false;
-  sessionFlags.hasWarnedAboutSecretToolMissing = false;
-}
-__name(resetCredentialStorageState, "resetCredentialStorageState");
-var clearCredentialStorageState = resetCredentialStorageState;
-
-// src/credential-store/resolver.ts
-function createCredentialStorageContext(context) {
-  const config = {
-    ...context,
-    cliName: context.cliName ?? "your CLI"
-  };
-  function getActiveStore(profile) {
-    return resolveActiveCredentialStore(config, profile);
-  }
-  __name(getActiveStore, "getActiveStore");
-  function storageFactory(profile) {
-    return {
-      read: /* @__PURE__ */ __name(() => getActiveStore(profile).read(), "read"),
-      write: /* @__PURE__ */ __name((value) => getActiveStore(profile).write(value), "write"),
-      clear: /* @__PURE__ */ __name(() => getActiveStore(profile).clear(), "clear"),
-      path: /* @__PURE__ */ __name(() => getActiveStore(profile).path(), "path")
-    };
-  }
-  __name(storageFactory, "storageFactory");
-  return { storageFactory, getActiveStore };
-}
-__name(createCredentialStorageContext, "createCredentialStorageContext");
-function resolveActiveCredentialStore(config, profile) {
-  const envOverride = getCloudflareAuthUseKeyringFromEnv();
-  const configPath = config.getConfigPath();
-  if (envOverride === false) {
-    return new FileCredentialStore(configPath, profile);
-  }
-  const forcedByEnvVar = envOverride === true;
-  const wantsKeyring = envOverride ?? config.isKeyringEnabled() ?? false;
-  if (!wantsKeyring) {
-    return new FileCredentialStore(configPath, profile);
-  }
-  const resolution = resolveKeyProvider(
-    config.serviceName,
-    profile,
-    configPath
-  );
-  switch (resolution.kind) {
-    case "available":
-      return new EncryptedFileCredentialStore(
-        configPath,
-        resolution.provider,
-        buildMigrationLogger(config),
-        profile
-      );
-    case "needs-install":
-      return handleNeedsInstall(resolution, forcedByEnvVar, config, profile);
-    case "unsupported":
-      return handleUnsupported(forcedByEnvVar, config, profile);
-  }
-}
-__name(resolveActiveCredentialStore, "resolveActiveCredentialStore");
-function buildMigrationLogger(config) {
-  return (result) => {
-    config.logger.warn(
-      `Migrated credentials from ${result.plaintextPath} into ${result.encryptedPath} (key in ${result.keyProviderDescription}). The plaintext file has been deleted.`
-    );
-  };
-}
-__name(buildMigrationLogger, "buildMigrationLogger");
-function handleNeedsInstall(resolution, forcedByEnvVar, config, profile) {
-  const flags = getResolverSessionFlags();
-  if (flags.installFailedThisSession) {
-    if (forcedByEnvVar) {
-      throw new UserError(
-        `CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,
-        { telemetryMessage: "workers-auth keyring install previously failed" }
-      );
-    }
-    return fallbackToFileWithWarning(
-      `The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,
-      config,
-      profile
-    );
-  }
-  if (config.isNonInteractiveOrCI()) {
-    throw new UserError(windowsBindingMissingMessage(config.cliName), {
-      telemetryMessage: "workers-auth keyring binding not installed"
-    });
-  }
-  try {
-    config.logger.log(`\u{1F510} Installing keyring backend (one-time, ~2 MB)\u2026`);
-    resolution.install();
-  } catch (e) {
-    flags.installFailedThisSession = true;
-    if (forcedByEnvVar) {
-      throw e instanceof UserError ? e : new UserError(
-        `Failed to install the keyring backend: ${e instanceof Error ? e.message : String(e)}`,
-        { telemetryMessage: "workers-auth keyring install threw" }
-      );
-    }
-    return fallbackToFileWithWarning(
-      `Failed to install the keyring backend (${e instanceof Error ? e.message : String(e)}); falling back to the plaintext credentials file.`,
-      config,
-      profile
-    );
-  }
-  return new EncryptedFileCredentialStore(
-    config.getConfigPath(),
-    resolution.afterInstall(),
-    buildMigrationLogger(config),
-    profile
-  );
-}
-__name(handleNeedsInstall, "handleNeedsInstall");
-function handleUnsupported(forcedByEnvVar, config, profile) {
-  const platform = process.platform;
-  const linuxMissingTool = platform === "linux";
-  const message = linuxMissingTool ? secretToolMissingMessage(config.cliName) : `OS keyring storage is not supported on \`${platform}\`; falling back to the plaintext credentials file.`;
-  if (forcedByEnvVar) {
-    throw new UserError(
-      linuxMissingTool ? `CLOUDFLARE_AUTH_USE_KEYRING is set but ${message}` : `CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${platform}\`.`,
-      {
-        telemetryMessage: linuxMissingTool ? "workers-auth keyring secret tool missing" : "workers-auth keyring unsupported platform"
-      }
-    );
-  }
-  if (linuxMissingTool && config.isNonInteractiveOrCI()) {
-    throw new UserError(message, {
-      telemetryMessage: "workers-auth keyring secret tool missing"
-    });
-  }
-  const flags = getResolverSessionFlags();
-  if (linuxMissingTool) {
-    if (!flags.hasWarnedAboutSecretToolMissing) {
-      flags.hasWarnedAboutSecretToolMissing = true;
-      config.logger.warn(
-        `${message}
-
-Falling back to the plaintext credentials file for this session.`
-      );
-    }
-    return new FileCredentialStore(config.getConfigPath(), profile);
-  }
-  return fallbackToFileWithWarning(message, config, profile);
-}
-__name(handleUnsupported, "handleUnsupported");
-function fallbackToFileWithWarning(message, config, profile) {
-  const flags = getResolverSessionFlags();
-  if (!flags.hasWarnedAboutKeyringFallback) {
-    flags.hasWarnedAboutKeyringFallback = true;
-    config.logger.warn(message);
-  }
-  return new FileCredentialStore(config.getConfigPath(), profile);
-}
-__name(fallbackToFileWithWarning, "fallbackToFileWithWarning");
-function secretToolMissingMessage(cliName) {
-  return `\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
-
-Install it via your package manager:
-  Debian/Ubuntu:  sudo apt-get install libsecret-tools
-  Fedora/RHEL:    sudo dnf install libsecret
-  Arch:           sudo pacman -S libsecret
-  Alpine:         apk add libsecret
-
-Or disable keyring storage: \`${cliName} login --no-use-keyring\`.`;
-}
-__name(secretToolMissingMessage, "secretToolMissingMessage");
-function windowsBindingMissingMessage(cliName) {
-  return `\`@napi-rs/keyring\` is required for OS keyring storage on Windows but is not installed.
-
-Run \`${cliName} login --use-keyring\` interactively to install it automatically, or install it globally for CI:
-
-  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}
-
-Or disable keyring storage: \`${cliName} login --no-use-keyring\`.`;
-}
-__name(windowsBindingMissingMessage, "windowsBindingMissingMessage");
-function scrubEncryptedCredentials(options) {
-  const encryptedPath = getEncryptedAuthConfigFilePath(
-    options.configPath,
-    options.profile
-  );
-  const encryptedFileExisted = existsSync(encryptedPath);
-  const resolution = resolveKeyProvider(
-    options.serviceName,
-    options.profile,
-    options.configPath
-  );
-  if (resolution.kind === "available") {
-    new EncryptedFileCredentialStore(
-      options.configPath,
-      resolution.provider,
-      void 0,
-      options.profile
-    ).clear();
-    return { backendAvailable: true, encryptedFileExisted };
-  }
-  if (encryptedFileExisted) {
-    rmSync(encryptedPath);
-  }
-  return { backendAvailable: false, encryptedFileExisted };
-}
-__name(scrubEncryptedCredentials, "scrubEncryptedCredentials");
-/*! Bundled license information:
-
-smol-toml/dist/error.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/util.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/date.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/primitive.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/extract.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/struct.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/parse.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/stringify.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-
-smol-toml/dist/index.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-*/
-
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName };
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-N7JTI7BC.mjs';
+import './chunk-O6YSETKJ.mjs';