@cloudflare/workers-auth 0.6.4 → 0.6.6

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, b as OAuthFlowContext, k as ProfileStore } from '../file-format-Dbmn5hhd.mjs';
-import { C as CliDescriptor, U as UserPreferences, A as AuthContext, a as CloudflareAuth, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-CeP6MLyb.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-CeP6MLyb.mjs';
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Bpmgm2Po.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-CdaCHp2c.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-CdaCHp2c.mjs';
 import '@cloudflare/workers-utils';
 
 /**

package/dist/cf/index.mjs

@@ -1,5 +1,5 @@
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-5EWNHNLD.mjs';
-import '../chunk-LXNXA7SZ.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-YCVYA5LL.mjs';
+import '../chunk-LQW53VED.mjs';
 import { __name } from '../chunk-O6YSETKJ.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';

package/dist/{chunk-LXNXA7SZ.mjs → chunk-LQW53VED.mjs}

@@ -3218,13 +3218,22 @@ function getInstalledBindingPath(installDir) {
   return path4.join(installDir, "node_modules", "@napi-rs", "keyring");
 }
 __name(getInstalledBindingPath, "getInstalledBindingPath");
+function canLoadKeyringBinding(candidate) {
+  try {
+    createRequire(candidate)(candidate);
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(canLoadKeyringBinding, "canLoadKeyringBinding");
 function findKeyringBinding(installDir) {
   const cached = cachedBindingPathByDir.get(installDir);
   if (cached !== void 0) {
     return cached;
   }
   const lazy = getInstalledBindingPath(installDir);
-  if (existsSync(path4.join(lazy, "index.js"))) {
+  if (existsSync(path4.join(lazy, "index.js")) && canLoadKeyringBinding(lazy)) {
     cachedBindingPathByDir.set(installDir, lazy);
     return lazy;
   }
@@ -3232,7 +3241,7 @@ function findKeyringBinding(installDir) {
     const r = npmRunner(["root", "-g"]);
     if (r.status === 0) {
       const global = path4.join(r.stdout.trim(), "@napi-rs", "keyring");
-      if (existsSync(path4.join(global, "index.js"))) {
+      if (existsSync(path4.join(global, "index.js")) && canLoadKeyringBinding(global)) {
         cachedBindingPathByDir.set(installDir, global);
         return global;
       }
@@ -3291,6 +3300,17 @@ Retry once the underlying issue is fixed, or install the binding globally:
     );
   }
   cachedBindingPathByDir.delete(installDir);
+  if (findKeyringBinding(installDir) === null) {
+    throw new UserError(
+      `\`npm\` reported success but the \`@napi-rs/keyring\` native binding still cannot be loaded.
+
+Its platform-specific binary ships as a separate optional package, so a download that was skipped or interrupted leaves the binding unusable.
+
+Retry once the underlying issue is fixed, or install the binding globally:
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      { telemetryMessage: "workers-auth keyring install incomplete" }
+    );
+  }
 }
 __name(installKeyringBindingSync, "installKeyringBindingSync");
 var entryFactoryOverride;
@@ -3304,8 +3324,12 @@ function resolveKeyringEntryFactory(installDir) {
   }
   const bindingPath = findKeyringBinding(installDir);
   if (bindingPath === null) {
-    throw new Error(
-      "`@napi-rs/keyring` binding not found. Call `installKeyringBindingSync()` first."
+    throw new UserError(
+      `The \`@napi-rs/keyring\` native binding is not available.
+
+Retry the command, or install the binding globally:
+  npm install -g @napi-rs/keyring@${PINNED_KEYRING_VERSION}`,
+      { telemetryMessage: "workers-auth keyring binding not loadable" }
     );
   }
   const mod = createRequire(bindingPath)(bindingPath);
@@ -3372,7 +3396,7 @@ function probeSecretTool() {
   let result;
   try {
     const r = runner(["--version"]);
-    result = r.status === 0;
+    result = r.error === void 0;
   } catch {
     result = false;
   }

package/dist/{chunk-5EWNHNLD.mjs → chunk-YCVYA5LL.mjs}

@@ -1,4 +1,4 @@
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-LXNXA7SZ.mjs';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-LQW53VED.mjs';
 import { __name } from './chunk-O6YSETKJ.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -1077,6 +1077,10 @@ ${accounts.map(
           }
         );
       }
+      const latchedTemporaryAccount = oauthFlow.getActiveTemporaryAccount();
+      if (latchedTemporaryAccount) {
+        return latchedTemporaryAccount.account.id;
+      }
       if (getAPIToken()) {
         throw new UserError(
           "You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.",

package/dist/{file-format-Dbmn5hhd.d.mts → file-format-Bpmgm2Po.d.mts}

@@ -491,4 +491,4 @@ interface CredentialStore extends AuthConfigStorage {
  */
 type FileFormat = "toml" | "json";
 
-export { type AuthConfigStorage as A, type CredentialStore as C, type DeactivateDirectoryResult as D, type FileFormat as F, type LoginOrRefreshFailureReason as L, type OAuthFlowLogger as O, type ProfileConfigOperations as P, type TemporaryPreviewAccount as T, type UserAuthConfig as U, type ConfigStorage as a, type OAuthFlowContext as b, createOAuthFlow as c, type LoginOrRefreshResult as d, type LoginProps as e, generateRandomState as f, generateAuthUrl as g, createProfileStore as h, type DirectoryBindingOperations as i, type DirectoryBindingsStorage as j, type ProfileStore as k, type OAuthConsentPages as l, validateProfileName as v };
+export { type AuthConfigStorage as A, type CredentialStore as C, type DeactivateDirectoryResult as D, type FileFormat as F, type LoginOrRefreshFailureReason as L, type OAuthFlowLogger as O, type ProfileConfigOperations as P, type TemporaryPreviewAccount as T, type UserAuthConfig as U, type ConfigStorage as a, type DirectoryBindingOperations as b, type DirectoryBindingsStorage as c, type LoginOrRefreshResult as d, type LoginProps as e, type OAuthFlowContext as f, type ProfileStore as g, createOAuthFlow as h, createProfileStore as i, generateAuthUrl as j, generateRandomState as k, type OAuthConsentPages as l, validateProfileName as v };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-Dbmn5hhd.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, i as DirectoryBindingOperations, j as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, b as OAuthFlowContext, P as ProfileConfigOperations, k as ProfileStore, T as TemporaryPreviewAccount, c as createOAuthFlow, h as createProfileStore, g as generateAuthUrl, f as generateRandomState, v as validateProfileName } from './file-format-Dbmn5hhd.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-Bpmgm2Po.mjs';
+export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryPreviewAccount, h as createOAuthFlow, i as createProfileStore, j as generateAuthUrl, k as generateRandomState, v as validateProfileName } from './file-format-Bpmgm2Po.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 
@@ -557,7 +557,11 @@ declare function setLinuxSecretToolRunner(fn: LinuxSecretToolRunner | undefined)
 /**
  * Probe whether `secret-tool` is callable in the current environment.
  *
- * Returns `true` when `secret-tool --version` exits 0. The probe does not
+ * Returns `true` when `secret-tool` could be spawned at all, whatever its
+ * exit status. libsecret's `secret-tool` has no `--version` flag: it prints
+ * its usage and exits 2, so the exit status says nothing about whether the
+ * tool is installed. Only a failure to spawn the process (e.g. `ENOENT`
+ * when it is not on `PATH`) means it is missing. The probe does not
  * exercise the keyring backend itself — a missing D-Bus session surfaces
  * on the first real read/write rather than every consumer invocation, so
  * we avoid the extra latency on every command for users whose desktop
@@ -663,6 +667,11 @@ declare function getKeyringInstallDir(configPath: string): string;
  *      @napi-rs/keyring` works in CI environments where the lazy install
  *      path is unavailable.
  *
+ * A candidate only counts when it actually loads (see
+ * {@link canLoadKeyringBinding}) — a half-installed binding is reported as
+ * absent so the caller reinstalls it, rather than being trusted forever on the
+ * strength of an `index.js` that cannot be required.
+ *
  * Returns `null` when no binding is available; callers handle the missing
  * binding case explicitly so they can surface remediation instructions.
  *
@@ -677,9 +686,10 @@ declare function findKeyringBinding(installDir: string): string | null;
  * Install `@napi-rs/keyring` into the private install dir using the user's
  * `npm`.
  *
- * Throws a {@link UserError} when `npm` cannot be spawned or returns a
- * non-zero exit code, so callers can surface actionable remediation hints
- * rather than a raw stack trace.
+ * Throws a {@link UserError} when `npm` cannot be spawned, returns a non-zero
+ * exit code, or exits cleanly without leaving a loadable binding behind, so
+ * callers can surface actionable remediation hints rather than a raw stack
+ * trace.
  */
 declare function installKeyringBindingSync(installDir: string): void;
 /**

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-LXNXA7SZ.mjs';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-LQW53VED.mjs';
 import './chunk-O6YSETKJ.mjs';

package/dist/{keyring-preference-CeP6MLyb.d.mts → keyring-preference-CdaCHp2c.d.mts}

@@ -1,4 +1,4 @@
-import { l as OAuthConsentPages, F as FileFormat, b as OAuthFlowContext, C as CredentialStore, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-Dbmn5hhd.mjs';
+import { f as OAuthFlowContext, l as OAuthConsentPages, F as FileFormat, C as CredentialStore, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-Bpmgm2Po.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */