@cloudflare/workers-utils 0.18.0 → 0.19.0

package/dist/index.mjs

@@ -1,13 +1,16 @@
 export { assertNever, constructWranglerConfig, getTodaysCompatDate, isCompatDate, mapWorkerMetadataBindings } from './chunk-BLWXWFJK.mjs';
 export { MetricsRegistry } from './chunk-O4YGOZSW.mjs';
-import { isDirectory, UserError, isRedirectedRawConfig, dedent, configFileName, formatConfigSnippet, FatalError, readFileSync, parseTOML, modify, applyEdits, format, dist_default, parseJSONC } from './chunk-A4F3D336.mjs';
-export { APIError, CommandLineArgsError, DeprecationError, FatalError, JsonFriendlyFatalError, MissingConfigError, ParseError, UserError, configFileName, configFormat, createFatalError, experimental_readRawConfig, findWranglerConfig, formatConfigSnippet, indexLocation, isDirectory, parseByteSize, parseHumanDuration, parseJSON, parseJSONC, parseNonHyphenedUuid, parsePackageJSON, parseTOML, readFileSync, readFileSyncToBuffer, removeDir, removeDirSync, resolveWranglerConfigPath, searchLocation } from './chunk-A4F3D336.mjs';
+import { isDirectory, UserError, isRedirectedRawConfig, dedent, configFileName, formatConfigSnippet, FatalError, removeDirSync, readFileSync, parseTOML, modify, applyEdits, format, dist_default, parseJSONC } from './chunk-XXCQEG76.mjs';
+export { APIError, CommandLineArgsError, DeprecationError, FatalError, JsonFriendlyFatalError, MissingConfigError, ParseError, UserError, configFileName, configFormat, createFatalError, experimental_readRawConfig, findWranglerConfig, formatConfigSnippet, indexLocation, isDirectory, parseByteSize, parseHumanDuration, parseJSON, parseJSONC, parseNonHyphenedUuid, parsePackageJSON, parseTOML, readFileSync, readFileSyncToBuffer, removeDir, removeDirSync, resolveWranglerConfigPath, searchLocation } from './chunk-XXCQEG76.mjs';
 export { ENVIRONMENT_TAG_PREFIX, INHERIT_SYMBOL, JSON_CONFIG_FORMATS, PATH_TO_DEPLOY_CONFIG, SERVICE_TAG_PREFIX } from './chunk-OZQVB3L3.mjs';
 import { __commonJS, __name, __require, __export, __toESM, __reExport } from './chunk-DCOBXSFB.mjs';
-import fs, { writeFileSync } from 'node:fs';
+import fs, { accessSync, constants, writeFileSync, renameSync, existsSync, unlinkSync, mkdirSync, chmodSync } from 'node:fs';
 import assert from 'node:assert';
-import path3 from 'node:path';
-import os from 'node:os';
+import path3, { join, dirname } from 'node:path';
+import os, { arch } from 'node:os';
+import { execFileSync, spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { fetch } from 'undici';
 
 // ../../node_modules/.pnpm/xdg-app-paths@8.3.0/node_modules/xdg-app-paths/dist/cjs/lib/XDGAppPaths.js
 var require_XDGAppPaths = __commonJS({
@@ -515,6 +518,160 @@ var require_mod_cjs3 = __commonJS({
   }
 });
 
+// ../../node_modules/.pnpm/command-exists@1.2.9/node_modules/command-exists/lib/command-exists.js
+var require_command_exists = __commonJS({
+  "../../node_modules/.pnpm/command-exists@1.2.9/node_modules/command-exists/lib/command-exists.js"(exports, module) {
+    var exec = __require("child_process").exec;
+    var execSync = __require("child_process").execSync;
+    var fs2 = __require("fs");
+    var path4 = __require("path");
+    var access = fs2.access;
+    var accessSync2 = fs2.accessSync;
+    var constants2 = fs2.constants || fs2;
+    var isUsingWindows = process.platform == "win32";
+    var fileNotExists = /* @__PURE__ */ __name(function(commandName, callback) {
+      access(
+        commandName,
+        constants2.F_OK,
+        function(err) {
+          callback(!err);
+        }
+      );
+    }, "fileNotExists");
+    var fileNotExistsSync = /* @__PURE__ */ __name(function(commandName) {
+      try {
+        accessSync2(commandName, constants2.F_OK);
+        return false;
+      } catch (e2) {
+        return true;
+      }
+    }, "fileNotExistsSync");
+    var localExecutable = /* @__PURE__ */ __name(function(commandName, callback) {
+      access(
+        commandName,
+        constants2.F_OK | constants2.X_OK,
+        function(err) {
+          callback(null, !err);
+        }
+      );
+    }, "localExecutable");
+    var localExecutableSync = /* @__PURE__ */ __name(function(commandName) {
+      try {
+        accessSync2(commandName, constants2.F_OK | constants2.X_OK);
+        return true;
+      } catch (e2) {
+        return false;
+      }
+    }, "localExecutableSync");
+    var commandExistsUnix = /* @__PURE__ */ __name(function(commandName, cleanedCommandName, callback) {
+      fileNotExists(commandName, function(isFile) {
+        if (!isFile) {
+          exec(
+            "command -v " + cleanedCommandName + " 2>/dev/null && { echo >&1 " + cleanedCommandName + "; exit 0; }",
+            function(error, stdout, stderr) {
+              callback(null, !!stdout);
+            }
+          );
+          return;
+        }
+        localExecutable(commandName, callback);
+      });
+    }, "commandExistsUnix");
+    var commandExistsWindows = /* @__PURE__ */ __name(function(commandName, cleanedCommandName, callback) {
+      if (!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(commandName)) {
+        callback(null, false);
+        return;
+      }
+      exec(
+        "where " + cleanedCommandName,
+        function(error) {
+          if (error !== null) {
+            callback(null, false);
+          } else {
+            callback(null, true);
+          }
+        }
+      );
+    }, "commandExistsWindows");
+    var commandExistsUnixSync = /* @__PURE__ */ __name(function(commandName, cleanedCommandName) {
+      if (fileNotExistsSync(commandName)) {
+        try {
+          var stdout = execSync(
+            "command -v " + cleanedCommandName + " 2>/dev/null && { echo >&1 " + cleanedCommandName + "; exit 0; }"
+          );
+          return !!stdout;
+        } catch (error) {
+          return false;
+        }
+      }
+      return localExecutableSync(commandName);
+    }, "commandExistsUnixSync");
+    var commandExistsWindowsSync = /* @__PURE__ */ __name(function(commandName, cleanedCommandName, callback) {
+      if (!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(commandName)) {
+        return false;
+      }
+      try {
+        var stdout = execSync("where " + cleanedCommandName, { stdio: [] });
+        return !!stdout;
+      } catch (error) {
+        return false;
+      }
+    }, "commandExistsWindowsSync");
+    var cleanInput = /* @__PURE__ */ __name(function(s) {
+      if (/[^A-Za-z0-9_\/:=-]/.test(s)) {
+        s = "'" + s.replace(/'/g, "'\\''") + "'";
+        s = s.replace(/^(?:'')+/g, "").replace(/\\'''/g, "\\'");
+      }
+      return s;
+    }, "cleanInput");
+    if (isUsingWindows) {
+      cleanInput = /* @__PURE__ */ __name(function(s) {
+        var isPathName = /[\\]/.test(s);
+        if (isPathName) {
+          var dirname2 = '"' + path4.dirname(s) + '"';
+          var basename = '"' + path4.basename(s) + '"';
+          return dirname2 + ":" + basename;
+        }
+        return '"' + s + '"';
+      }, "cleanInput");
+    }
+    module.exports = /* @__PURE__ */ __name(function commandExists(commandName, callback) {
+      var cleanedCommandName = cleanInput(commandName);
+      if (!callback && typeof Promise !== "undefined") {
+        return new Promise(function(resolve, reject) {
+          commandExists(commandName, function(error, output) {
+            if (output) {
+              resolve(commandName);
+            } else {
+              reject(error);
+            }
+          });
+        });
+      }
+      if (isUsingWindows) {
+        commandExistsWindows(commandName, cleanedCommandName, callback);
+      } else {
+        commandExistsUnix(commandName, cleanedCommandName, callback);
+      }
+    }, "commandExists");
+    module.exports.sync = function(commandName) {
+      var cleanedCommandName = cleanInput(commandName);
+      if (isUsingWindows) {
+        return commandExistsWindowsSync(commandName, cleanedCommandName);
+      } else {
+        return commandExistsUnixSync(commandName, cleanedCommandName);
+      }
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/command-exists@1.2.9/node_modules/command-exists/index.js
+var require_command_exists2 = __commonJS({
+  "../../node_modules/.pnpm/command-exists@1.2.9/node_modules/command-exists/index.js"(exports, module) {
+    module.exports = require_command_exists();
+  }
+});
+
 // src/config/config.ts
 var defaultWranglerConfig = {
   /* COMPUTED_FIELDS */
@@ -4608,7 +4765,8 @@ function getBooleanEnvironmentVariableFactory(options) {
         throw new UserError(
           `Expected ${options.variableName} to be "true" or "false", but got ${JSON.stringify(
             process.env[options.variableName]
-          )}`
+          )}`,
+          { telemetryMessage: false }
         );
     }
   };
@@ -4646,7 +4804,8 @@ __name(getProcessEnv, "getProcessEnv");
 function assertOneOf(choices, value) {
   if (Array.isArray(choices) && !choices.includes(value)) {
     throw new UserError(
-      `Expected ${JSON.stringify(value)} to be one of ${JSON.stringify(choices)}`
+      `Expected ${JSON.stringify(value)} to be one of ${JSON.stringify(choices)}`,
+      { telemetryMessage: false }
     );
   }
 }
@@ -4683,11 +4842,14 @@ var getCloudflareComplianceRegionFromEnv = getEnvironmentVariableFactory({
 var getCloudflareComplianceRegion = /* @__PURE__ */ __name((complianceConfig) => {
   const complianceRegionFromEnv = getCloudflareComplianceRegionFromEnv();
   if (complianceRegionFromEnv !== void 0 && complianceConfig?.compliance_region !== void 0 && complianceRegionFromEnv !== complianceConfig.compliance_region) {
-    throw new UserError(dedent`
+    throw new UserError(
+      dedent`
 			The compliance region has been set to different values in two places:
 			 - \`CLOUDFLARE_COMPLIANCE_REGION\` environment variable: \`${complianceRegionFromEnv}\`
 			 - \`compliance_region\` configuration property: \`${complianceConfig.compliance_region}\`
-			`);
+			`,
+      { telemetryMessage: false }
+    );
   }
   return complianceRegionFromEnv || complianceConfig?.compliance_region || "public";
 }, "getCloudflareComplianceRegion");
@@ -5528,7 +5690,8 @@ function applyPythonConfig(config, args) {
     }
     if (!config.compatibility_flags.includes("python_workers")) {
       throw new UserError(
-        "The `python_workers` compatibility flag is required to use Python."
+        "The `python_workers` compatibility flag is required to use Python.",
+        { telemetryMessage: false }
       );
     }
   }
@@ -6166,7 +6329,6 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
     "error"
   );
   experimental(diagnostics, rawEnv, "unsafe");
-  experimental(diagnostics, rawEnv, "secrets");
   const route = normalizeAndValidateRoute(diagnostics, topLevelEnv, rawEnv);
   const account_id = inheritableInWranglerEnvironments(
     diagnostics,
@@ -9245,6 +9407,7 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName) => (diagnostics, f
     "secrets_store_secrets",
     "artifacts",
     "unsafe_hello_world",
+    "flagship",
     "worker_loaders",
     "ratelimits",
     "vpc_services",
@@ -9425,6 +9588,12 @@ var validatePreviewsConfig = /* @__PURE__ */ __name((envName) => (diagnostics, f
     previews.unsafe_hello_world,
     void 0
   ) && isValid2;
+  isValid2 = validateBindingArray(envName, validateFlagshipBinding)(
+    diagnostics,
+    `${field}.flagship`,
+    previews.flagship,
+    void 0
+  ) && isValid2;
   isValid2 = validateBindingArray(envName, validateWorkerLoaderBinding)(
     diagnostics,
     `${field}.worker_loaders`,
@@ -9798,7 +9967,8 @@ function isDockerfile(imagePath, configPath) {
   if (fs.existsSync(maybeDockerfile)) {
     if (isDirectory(maybeDockerfile)) {
       throw new UserError(
-        `${imagePath} is a directory, you should specify a path to the Dockerfile`
+        `${imagePath} is a directory, you should specify a path to the Dockerfile`,
+        { telemetryMessage: false }
       );
     }
     return true;
@@ -9809,19 +9979,23 @@ function isDockerfile(imagePath, configPath) {
     new URL(`https://${imagePath}`);
   } catch (e2) {
     if (e2 instanceof Error) {
-      throw new UserError(errorPrefix + e2.message);
+      throw new UserError(errorPrefix + e2.message, {
+        telemetryMessage: false
+      });
     }
     throw e2;
   }
   const imageParts = imagePath.split("/");
   if (!imageParts[imageParts.length - 1]?.includes(":")) {
     throw new UserError(
-      errorPrefix + `If this is an image registry path, it needs to include at least a tag ':' (e.g: docker.io/httpd:1)`
+      errorPrefix + `If this is an image registry path, it needs to include at least a tag ':' (e.g: docker.io/httpd:1)`,
+      { telemetryMessage: false }
     );
   }
   if (imagePath.includes("://")) {
     throw new UserError(
-      errorPrefix + `Image reference should not include the protocol part (e.g: docker.io/httpd:1, not https://docker.io/httpd:1)`
+      errorPrefix + `Image reference should not include the protocol part (e.g: docker.io/httpd:1, not https://docker.io/httpd:1)`,
+      { telemetryMessage: false }
     );
   }
   return false;
@@ -9864,8 +10038,11 @@ var supportedPagesConfigFields = [
 ];
 function validatePagesConfig(config, envNames, projectName) {
   if (!config.pages_build_output_dir) {
-    throw new FatalError(`Attempting to validate Pages configuration file, but "pages_build_output_dir" field was not found.
-		"pages_build_output_dir" is required for Pages projects.`);
+    throw new FatalError(
+      `Attempting to validate Pages configuration file, but "pages_build_output_dir" field was not found.
+		"pages_build_output_dir" is required for Pages projects.`,
+      { telemetryMessage: false }
+    );
   }
   const diagnostics = new Diagnostics(
     `Running configuration file validation for Pages:`
@@ -9956,4 +10133,754 @@ Pages requires Durable Object bindings to specify the name of the Worker where t
 }
 __name(validateDurableObjectBinding2, "validateDurableObjectBinding");
 
-export { COMPLIANCE_REGION_CONFIG_PUBLIC, COMPLIANCE_REGION_CONFIG_UNKNOWN, Diagnostics, PatchConfigError, bucketFormatMessage, defaultWranglerConfig, experimental_patchConfig, friendlyBindingNames, getBindingTypeFriendlyName, getBooleanEnvironmentVariableFactory, getBrowserRenderingHeadfulFromEnv, getBuildConditionsFromEnv, getBuildPlatformFromEnv, getC3CommandFromEnv, getCIGeneratePreviewAlias, getCIMatchTag, getCIOverrideName, getCIOverrideNetworkModeHost, getCfFetchEnabledFromEnv, getCfFetchPathFromEnv, getCloudflareApiBaseUrl, getCloudflareApiEnvironmentFromEnv, getCloudflareComplianceRegion, getCloudflareEnv, getCloudflareIncludeProcessEnvFromEnv, getCloudflareLoadDevVarsFromDotEnv, getCloudflaredPathFromEnv, getComplianceRegionSubdomain, getD1ExtraLocationChoices, getDisableConfigWatching, getDockerPath, getEnvironmentVariableFactory, getGlobalWranglerConfigPath, getLocalExplorerEnabledFromEnv, getOpenNextDeployFromEnv, getOutputFileDirectoryFromEnv, getOutputFilePathFromEnv, getRegistryPath, getSanitizeLogs, getSubdomainMixedStateCheckDisabled, getTraceHeader, getWorkersCIBranchName, getWranglerCacheDirFromEnv, getWranglerHideBanner, getWranglerSendErrorReportsFromEnv, getWranglerSendMetricsFromEnv, hasProperty, isDockerfile, isOptionalProperty, isPagesConfig, isRequiredProperty, isValidR2BucketName, normalizeAndValidateConfig, validatePagesConfig };
+// src/cloudflared.ts
+var import_command_exists = __toESM(require_command_exists2());
+var UPDATE_SERVICE_URL = "https://update.argotunnel.com";
+var CLOUDFLARED_VERSION_PATTERN = /^\d{4}\.\d+\.\d+$/;
+function sha256Hex(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+__name(sha256Hex, "sha256Hex");
+function getGoArch() {
+  const nodeArch = arch();
+  switch (nodeArch) {
+    case "x64":
+      return "amd64";
+    case "arm64":
+      return "arm64";
+    case "arm":
+      return "arm";
+    default:
+      throw new UserError(
+        `Unsupported architecture for cloudflared: ${nodeArch}
+
+cloudflared supports: x64 (amd64), arm64, arm
+
+You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        { telemetryMessage: "tunnel cloudflared unsupported architecture" }
+      );
+  }
+}
+__name(getGoArch, "getGoArch");
+function getGoOS() {
+  switch (process.platform) {
+    case "darwin":
+      return "darwin";
+    case "linux":
+      return "linux";
+    case "win32":
+      return "windows";
+    default:
+      throw new UserError(
+        `Unsupported platform for cloudflared: ${process.platform}
+
+cloudflared supports: darwin (macOS), linux, win32 (Windows)
+
+You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        { telemetryMessage: "tunnel cloudflared unsupported platform" }
+      );
+  }
+}
+__name(getGoOS, "getGoOS");
+var GITHUB_RELEASE_BASE = "https://github.com/cloudflare/cloudflared/releases/download";
+function getAssetFilename(goOS, goArch) {
+  if (goOS === "windows") {
+    return `cloudflared-${goOS}-${goArch}.exe`;
+  }
+  if (goOS === "darwin") {
+    return `cloudflared-${goOS}-${goArch}.tgz`;
+  }
+  return `cloudflared-${goOS}-${goArch}`;
+}
+__name(getAssetFilename, "getAssetFilename");
+async function queryUpdateService(goOS, goArch, options) {
+  const { logger } = options ?? {};
+  const url = new URL(UPDATE_SERVICE_URL);
+  url.searchParams.set("os", goOS);
+  url.searchParams.set("arch", goArch);
+  logger?.debug(`Checking for latest cloudflared: ${url.toString()}`);
+  let response;
+  try {
+    response = await fetch(url.toString(), {
+      headers: { "User-Agent": "wrangler" }
+    });
+  } catch (e2) {
+    logger?.debug(
+      `Failed to reach update service: ${e2 instanceof Error ? e2.message : String(e2)}`
+    );
+    return null;
+  }
+  if (!response.ok) {
+    logger?.debug(
+      `Update service returned ${response.status} for ${goOS}/${goArch}`
+    );
+    return null;
+  }
+  let data;
+  try {
+    data = await response.json();
+  } catch (e2) {
+    logger?.debug(
+      `Update service returned non-JSON response: ${e2 instanceof Error ? e2.message : String(e2)}`
+    );
+    return null;
+  }
+  if (typeof data.version === "string" && !CLOUDFLARED_VERSION_PATTERN.test(data.version)) {
+    throw new Error(
+      `[cloudflared] Invalid cloudflared version returned by update service: ${data.version}`
+    );
+  }
+  if (data.error || !data.url || !data.version) {
+    return data.version ? data : null;
+  }
+  return data;
+}
+__name(queryUpdateService, "queryUpdateService");
+async function getLatestVersionInfo(options) {
+  const { logger } = options ?? {};
+  const goOS = getGoOS();
+  const goArch = getGoArch();
+  const primary = await queryUpdateService(goOS, goArch, { logger });
+  if (primary && primary.url && primary.version) {
+    return primary;
+  }
+  logger?.debug(
+    `Update worker had no result for ${goOS}/${goArch}, falling back to GitHub release URL`
+  );
+  const fallback = await queryUpdateService("linux", "amd64", { logger });
+  if (!fallback?.version) {
+    throw new UserError(
+      `[cloudflared] Failed to determine the latest cloudflared version.
+
+The update service did not return results for ${goOS}/${goArch},
+and the fallback query also failed.
+
+You can manually install cloudflared from:
+https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+      { telemetryMessage: "tunnel cloudflared version lookup failed" }
+    );
+  }
+  const version = fallback.version;
+  const filename = getAssetFilename(goOS, goArch);
+  const url = `${GITHUB_RELEASE_BASE}/${version}/${filename}`;
+  const compressed = filename.endsWith(".tgz");
+  return {
+    url,
+    version,
+    checksum: "",
+    // no checksum available for fallback URLs
+    compressed,
+    shouldUpdate: true,
+    userMessage: "",
+    error: ""
+  };
+}
+__name(getLatestVersionInfo, "getLatestVersionInfo");
+function getCacheDir(version) {
+  return join(getGlobalWranglerConfigPath(), "cloudflared", version);
+}
+__name(getCacheDir, "getCacheDir");
+function getCloudflaredBinPath(version) {
+  const binName = process.platform === "win32" ? "cloudflared.exe" : "cloudflared";
+  return join(getCacheDir(version), binName);
+}
+__name(getCloudflaredBinPath, "getCloudflaredBinPath");
+function isBinaryExecutable(binPath) {
+  try {
+    accessSync(binPath, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(isBinaryExecutable, "isBinaryExecutable");
+function validateBinary(binPath, options) {
+  const { logger } = options ?? {};
+  try {
+    const output = execFileSync(binPath, ["--version"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4,
+      encoding: "utf8"
+    }).trim();
+    logger?.debug(`cloudflared version: ${output}`);
+  } catch {
+    let errorMessage = `[cloudflared] Failed to validate cloudflared binary at ${binPath}
+
+`;
+    errorMessage += `This usually means:
+`;
+    errorMessage += `  - The binary is corrupted or incomplete
+`;
+    errorMessage += `  - You're missing required system libraries
+`;
+    if (process.platform === "linux") {
+      errorMessage += `
+On Linux, make sure you have the required dependencies:
+`;
+      errorMessage += `  - glibc (GNU C Library)
+`;
+      errorMessage += `  - For Debian/Ubuntu: sudo apt-get install libc6
+`;
+    }
+    const cacheDir = join(getGlobalWranglerConfigPath(), "cloudflared");
+    errorMessage += `
+You can try:
+`;
+    errorMessage += `  1. Deleting the cache directory: rm -rf ${cacheDir}
+`;
+    errorMessage += `  2. Running the command again to re-download
+`;
+    errorMessage += `  3. Manually installing cloudflared: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/
+`;
+    errorMessage += `  4. Setting CLOUDFLARED_PATH to point to your cloudflared binary`;
+    throw new UserError(errorMessage, {
+      telemetryMessage: "tunnel cloudflared validation failed"
+    });
+  }
+}
+__name(validateBinary, "validateBinary");
+function redactCloudflaredArgsForLogging(args) {
+  const redacted = [...args];
+  for (let i = 0; i < redacted.length; i++) {
+    const arg = redacted[i];
+    if (arg === "--token" && i + 1 < redacted.length) {
+      redacted[i + 1] = "[REDACTED]";
+    }
+    if (arg.startsWith("--token=")) {
+      redacted[i] = "--token=[REDACTED]";
+    }
+  }
+  return redacted;
+}
+__name(redactCloudflaredArgsForLogging, "redactCloudflaredArgsForLogging");
+function tryGetCloudflaredFromPath(options) {
+  const { logger } = options ?? {};
+  if (!(0, import_command_exists.sync)("cloudflared")) {
+    return null;
+  }
+  try {
+    validateBinary("cloudflared", { logger });
+    return "cloudflared";
+  } catch (e2) {
+    logger?.debug("cloudflared found in PATH but failed validation", e2);
+    return null;
+  }
+}
+__name(tryGetCloudflaredFromPath, "tryGetCloudflaredFromPath");
+function getInstalledVersion(binPath) {
+  try {
+    const output = execFileSync(binPath, ["--version"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4,
+      encoding: "utf8"
+    });
+    const match = output.match(/(\d+\.\d+\.\d+)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+__name(getInstalledVersion, "getInstalledVersion");
+function isVersionOutdated(installed, latest) {
+  const parse = /* @__PURE__ */ __name((v) => v.split(".").map(Number), "parse");
+  const [iYear, iMonth, iPatch] = parse(installed);
+  const [lYear, lMonth, lPatch] = parse(latest);
+  if (iYear !== lYear) {
+    return iYear < lYear;
+  }
+  if (iMonth !== lMonth) {
+    return iMonth < lMonth;
+  }
+  return iPatch < lPatch;
+}
+__name(isVersionOutdated, "isVersionOutdated");
+async function warnIfOutdated(binPath, options) {
+  const { logger } = options ?? {};
+  try {
+    const installed = getInstalledVersion(binPath);
+    if (!installed) {
+      return;
+    }
+    const latest = await queryUpdateService(getGoOS(), getGoArch(), { logger }) ?? await queryUpdateService("linux", "amd64", { logger });
+    const latestVersion = latest?.version;
+    if (!latestVersion) {
+      return;
+    }
+    if (isVersionOutdated(installed, latestVersion)) {
+      logger?.warn(
+        `Your cloudflared (${installed}) is outdated. Latest version is ${latestVersion}.
+Update: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`
+      );
+    }
+  } catch (e2) {
+    logger?.debug("Failed to check cloudflared version", e2);
+  }
+}
+__name(warnIfOutdated, "warnIfOutdated");
+function writeFileAtomic(filePath, contents) {
+  const dir = dirname(filePath);
+  const tmpPath = join(
+    dir,
+    `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`
+  );
+  try {
+    writeFileSync(tmpPath, contents);
+    renameSync(tmpPath, filePath);
+  } finally {
+    try {
+      if (existsSync(tmpPath)) {
+        unlinkSync(tmpPath);
+      }
+    } catch {
+    }
+  }
+}
+__name(writeFileAtomic, "writeFileAtomic");
+async function downloadCloudflared(versionInfo, binPath, options) {
+  const { logger } = options ?? {};
+  const { url, version, checksum, compressed } = versionInfo;
+  logger?.log(`Downloading cloudflared ${version}...`);
+  logger?.debug(`Download URL: ${url}`);
+  const cacheDir = dirname(binPath);
+  mkdirSync(cacheDir, { recursive: true });
+  let response;
+  try {
+    response = await fetch(url, {
+      headers: { "User-Agent": "wrangler" }
+    });
+  } catch (e2) {
+    throw new UserError(
+      `[cloudflared] Failed to download cloudflared from ${url}
+
+Network error: ${e2 instanceof Error ? e2.message : String(e2)}
+
+Please check your internet connection and try again.
+If you're behind a proxy, make sure it's configured correctly.`,
+      { telemetryMessage: "tunnel cloudflared download network failed" }
+    );
+  }
+  if (!response.ok) {
+    throw new UserError(
+      `[cloudflared] Failed to download cloudflared from ${url}
+
+HTTP ${response.status}: ${response.statusText}
+
+You can manually download cloudflared from:
+https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+      { telemetryMessage: "tunnel cloudflared download response failed" }
+    );
+  }
+  try {
+    if (compressed) {
+      await downloadAndExtractTarball(response, checksum, binPath, cacheDir);
+    } else {
+      await downloadBinary(response, checksum, binPath);
+    }
+  } catch (e2) {
+    try {
+      if (existsSync(binPath)) {
+        unlinkSync(binPath);
+      }
+    } catch {
+    }
+    if (e2 instanceof UserError) {
+      throw e2;
+    }
+    throw new UserError(
+      `[cloudflared] Failed to save cloudflared binary
+
+Error: ${e2 instanceof Error ? e2.message : String(e2)}
+
+Please ensure you have write permissions to: ${cacheDir}`,
+      { telemetryMessage: "tunnel cloudflared save failed" }
+    );
+  }
+  if (process.platform !== "win32") {
+    chmodSync(binPath, 493);
+  }
+  logger?.log(`cloudflared ${version} installed`);
+  logger?.debug(`Binary location: ${binPath}`);
+}
+__name(downloadCloudflared, "downloadCloudflared");
+async function downloadAndExtractTarball(response, expectedChecksum, binPath, cacheDir) {
+  const tempTarPath = join(cacheDir, "cloudflared.tgz");
+  const buffer = Buffer.from(await response.arrayBuffer());
+  if (expectedChecksum) {
+    const actualSha256 = sha256Hex(buffer);
+    if (actualSha256 !== expectedChecksum) {
+      throw new UserError(
+        `[cloudflared] SHA256 mismatch for downloaded cloudflared tarball.
+
+Expected: ${expectedChecksum}
+Actual:   ${actualSha256}`,
+        { telemetryMessage: "tunnel cloudflared tarball checksum mismatch" }
+      );
+    }
+  }
+  writeFileSync(tempTarPath, buffer);
+  try {
+    execFileSync("tar", ["-xzf", tempTarPath, "-C", cacheDir], {
+      stdio: "ignore"
+    });
+    const extractedPath = join(cacheDir, "cloudflared");
+    if (extractedPath !== binPath && existsSync(extractedPath)) {
+      renameSync(extractedPath, binPath);
+    }
+  } finally {
+    try {
+      if (existsSync(tempTarPath)) {
+        unlinkSync(tempTarPath);
+      }
+    } catch {
+    }
+  }
+}
+__name(downloadAndExtractTarball, "downloadAndExtractTarball");
+async function downloadBinary(response, expectedChecksum, binPath) {
+  const buffer = Buffer.from(await response.arrayBuffer());
+  if (expectedChecksum) {
+    const actualSha256 = sha256Hex(buffer);
+    if (actualSha256 !== expectedChecksum) {
+      throw new UserError(
+        `[cloudflared] SHA256 mismatch for downloaded cloudflared binary.
+
+Expected: ${expectedChecksum}
+Actual:   ${actualSha256}`,
+        { telemetryMessage: "tunnel cloudflared binary checksum mismatch" }
+      );
+    }
+  }
+  writeFileAtomic(binPath, buffer);
+}
+__name(downloadBinary, "downloadBinary");
+async function getCloudflaredPath(options) {
+  const logger = options?.logger;
+  const envPath = getCloudflaredPathFromEnv();
+  if (envPath) {
+    if (!existsSync(envPath)) {
+      throw new UserError(
+        `CLOUDFLARED_PATH is set to "${envPath}" but the file does not exist.
+
+Please ensure the path points to a valid cloudflared binary.`,
+        { telemetryMessage: "tunnel cloudflared env path missing" }
+      );
+    }
+    logger?.debug(`Using cloudflared from CLOUDFLARED_PATH: ${envPath}`);
+    return envPath;
+  }
+  const pathBin = tryGetCloudflaredFromPath({ logger });
+  if (pathBin) {
+    logger?.debug("Using cloudflared from PATH");
+    if (!options?.skipVersionCheck) {
+      await warnIfOutdated(pathBin, { logger });
+    }
+    return pathBin;
+  }
+  const versionInfo = await getLatestVersionInfo({ logger });
+  const binPath = getCloudflaredBinPath(versionInfo.version);
+  let needsDownload = !isBinaryExecutable(binPath);
+  if (!needsDownload) {
+    try {
+      validateBinary(binPath, { logger });
+      logger?.debug(
+        `Using cached cloudflared ${versionInfo.version}: ${binPath}`
+      );
+      return binPath;
+    } catch (e2) {
+      logger?.debug("Cached cloudflared failed validation; re-downloading", e2);
+      needsDownload = true;
+    }
+  }
+  const shouldDownload = await options?.confirmDownload?.(
+    `cloudflared (${versionInfo.version}) is needed but not installed. Download to ${binPath}?`
+  ) ?? true;
+  if (!shouldDownload) {
+    throw new UserError(
+      `cloudflared is required to run this command.
+
+You can install it manually from:
+https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/
+
+Then either add it to your PATH or set CLOUDFLARED_PATH.`,
+      { telemetryMessage: "tunnel cloudflared download declined" }
+    );
+  }
+  if (existsSync(binPath)) {
+    const cacheDir = removeCloudflaredCache(versionInfo.version);
+    if (cacheDir) {
+      logger?.log(`Removed cloudflared cache: ${cacheDir}`);
+    }
+  }
+  await downloadCloudflared(versionInfo, binPath, { logger });
+  validateBinary(binPath, { logger });
+  return binPath;
+}
+__name(getCloudflaredPath, "getCloudflaredPath");
+async function spawnCloudflared(args, options) {
+  const logger = options?.logger;
+  const binPath = await getCloudflaredPath({
+    skipVersionCheck: options?.skipVersionCheck,
+    confirmDownload: options?.confirmDownload,
+    logger
+  });
+  logger?.debug(
+    `Spawning cloudflared: ${binPath} ${redactCloudflaredArgsForLogging(args).join(" ")}`
+  );
+  const cloudflared = spawn(binPath, args, {
+    stdio: options?.stdio ?? "inherit",
+    env: options?.env ? { ...process.env, ...options.env } : void 0
+  });
+  return cloudflared;
+}
+__name(spawnCloudflared, "spawnCloudflared");
+function removeCloudflaredCache(version) {
+  const cacheDir = version ? getCacheDir(version) : join(getGlobalWranglerConfigPath(), "cloudflared");
+  if (existsSync(cacheDir)) {
+    removeDirSync(cacheDir);
+    return cacheDir;
+  }
+  return null;
+}
+__name(removeCloudflaredCache, "removeCloudflaredCache");
+
+// src/tunnel.ts
+var TUNNEL_STARTUP_TIMEOUT_MS = 3e4;
+var TUNNEL_FORCE_KILL_TIMEOUT_MS = 5e3;
+var DEFAULT_TUNNEL_EXPIRY_MS = 60 * 60 * 1e3;
+var DEFAULT_TUNNEL_EXTENSION_MS = 60 * 60 * 1e3;
+var DEFAULT_TUNNEL_MAX_REMAINING_MS = 3 * 60 * 60 * 1e3;
+var DEFAULT_TUNNEL_REMINDER_INTERVAL_MS = 10 * 60 * 1e3;
+var QUICK_TUNNEL_URL_REGEX = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+function startTunnel(options) {
+  let disposed = false;
+  let reminderInterval;
+  let expiryTimeout;
+  let expiresAt = 0;
+  let cloudflaredProcess;
+  const logger = options.logger;
+  const timeoutMs = options.timeoutMs ?? TUNNEL_STARTUP_TIMEOUT_MS;
+  const reminderIntervalMs = options.reminderIntervalMs ?? DEFAULT_TUNNEL_REMINDER_INTERVAL_MS;
+  const defaultExpiryMs = options.expiryMs ?? DEFAULT_TUNNEL_EXPIRY_MS;
+  const timeFormatter = new Intl.DateTimeFormat(void 0, {
+    timeStyle: "short"
+  });
+  const cloudflaredArgs = [
+    "tunnel",
+    "--no-autoupdate",
+    "--url",
+    options.origin.href
+  ];
+  const cloudflaredPromise = spawnCloudflared(cloudflaredArgs, {
+    stdio: "pipe",
+    skipVersionCheck: true,
+    logger
+  }).then((process2) => {
+    cloudflaredProcess = process2;
+    if (disposed) {
+      terminateCloudflared(process2);
+    }
+    return process2;
+  });
+  const readyPromise = cloudflaredPromise.then(
+    (process2) => waitForQuickTunnelReady(process2, timeoutMs, {
+      logger,
+      origin: options.origin
+    })
+  ).then((result) => {
+    expiresAt = Date.now() + defaultExpiryMs;
+    scheduleExpiryTimeout();
+    scheduleReminder(result.publicUrl.origin);
+    return result;
+  });
+  function disposeTunnel() {
+    disposed = true;
+    clearTunnelTimers();
+    if (cloudflaredProcess) {
+      terminateCloudflared(cloudflaredProcess);
+    }
+  }
+  __name(disposeTunnel, "disposeTunnel");
+  function clearTunnelTimers() {
+    if (expiryTimeout) {
+      clearTimeout(expiryTimeout);
+      expiryTimeout = void 0;
+    }
+    if (reminderInterval) {
+      clearInterval(reminderInterval);
+      reminderInterval = void 0;
+    }
+  }
+  __name(clearTunnelTimers, "clearTunnelTimers");
+  function scheduleReminder(publicURL) {
+    if (reminderIntervalMs > 0) {
+      reminderInterval = setInterval(() => {
+        if (disposed) {
+          return;
+        }
+        const remainingMs = expiresAt - Date.now();
+        if (remainingMs <= 0) {
+          return;
+        }
+        logger?.log(
+          `The tunnel is still open at ${publicURL}. It expires in ${formatTunnelDuration(remainingMs)}. ${options.extendHint ?? ""}`
+        );
+      }, reminderIntervalMs);
+      reminderInterval.unref?.();
+    }
+  }
+  __name(scheduleReminder, "scheduleReminder");
+  function scheduleExpiryTimeout() {
+    if (disposed) {
+      return;
+    }
+    if (expiryTimeout) {
+      clearTimeout(expiryTimeout);
+    }
+    expiryTimeout = setTimeout(
+      () => {
+        if (disposed) {
+          return;
+        }
+        logger?.log("Tunnel expired. Closing tunnel.");
+        disposeTunnel();
+      },
+      Math.max(0, expiresAt - Date.now())
+    );
+    expiryTimeout.unref();
+  }
+  __name(scheduleExpiryTimeout, "scheduleExpiryTimeout");
+  function extendExpiry(ms = DEFAULT_TUNNEL_EXTENSION_MS) {
+    if (disposed || !expiryTimeout || ms <= 0) {
+      return;
+    }
+    const now = Date.now();
+    const previousExpiresAt = expiresAt;
+    expiresAt = Math.min(
+      now + DEFAULT_TUNNEL_MAX_REMAINING_MS,
+      Math.max(expiresAt, now) + ms
+    );
+    const extendedByMs = expiresAt - previousExpiresAt;
+    if (extendedByMs < ms) {
+      logger?.log(
+        `Tunnel expiry extended to the ${formatTunnelDuration(DEFAULT_TUNNEL_MAX_REMAINING_MS)} limit. It now expires at ${timeFormatter.format(new Date(expiresAt))}.`
+      );
+      scheduleExpiryTimeout();
+      return;
+    }
+    logger?.log(
+      `Tunnel expiry extended by ${formatTunnelDuration(extendedByMs)}. It now expires at ${timeFormatter.format(new Date(expiresAt))}.`
+    );
+    scheduleExpiryTimeout();
+  }
+  __name(extendExpiry, "extendExpiry");
+  return {
+    ready: /* @__PURE__ */ __name(() => readyPromise, "ready"),
+    dispose: disposeTunnel,
+    extendExpiry
+  };
+}
+__name(startTunnel, "startTunnel");
+function formatTunnelDuration(durationMs) {
+  const totalMinutes = Math.max(1, Math.ceil(durationMs / 6e4));
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  if (hours === 0) {
+    return `${minutes}m`;
+  }
+  if (minutes === 0) {
+    return `${hours}h`;
+  }
+  return `${hours}h ${minutes}m`;
+}
+__name(formatTunnelDuration, "formatTunnelDuration");
+function terminateCloudflared(cloudflared) {
+  if (cloudflared.killed) {
+    return;
+  }
+  cloudflared.unref();
+  cloudflared.kill("SIGTERM");
+  const forceKillTimer = setTimeout(() => {
+    if (!cloudflared.killed) {
+      cloudflared.kill("SIGKILL");
+    }
+  }, TUNNEL_FORCE_KILL_TIMEOUT_MS);
+  forceKillTimer.unref();
+}
+__name(terminateCloudflared, "terminateCloudflared");
+function waitForQuickTunnelReady(cloudflared, timeoutMs, options) {
+  return new Promise((resolve, reject) => {
+    let resolved = false;
+    let stderrOutput = "";
+    const logger = options?.logger;
+    const origin = options?.origin;
+    const timeoutId = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        terminateCloudflared(cloudflared);
+        reject(
+          createTunnelStartupError(
+            `Timed out waiting for cloudflared to start (${timeoutMs / 1e3}s).`,
+            stderrOutput,
+            origin
+          )
+        );
+      }
+    }, timeoutMs);
+    timeoutId.unref();
+    if (cloudflared.stderr) {
+      cloudflared.stderr.on("data", (data) => {
+        const chunk = data.toString();
+        stderrOutput += chunk;
+        logger?.debug("[cloudflared]", chunk.trimEnd());
+        const match = QUICK_TUNNEL_URL_REGEX.exec(stderrOutput);
+        if (match && !resolved) {
+          resolved = true;
+          clearTimeout(timeoutId);
+          resolve({ publicUrl: new URL(match[0]) });
+        }
+      });
+    }
+    cloudflared.on("error", (error) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeoutId);
+        reject(new Error(`Failed to start cloudflared: ${error.message}`));
+      }
+    });
+    cloudflared.on("exit", (code, signal) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeoutId);
+        const reason = signal ? `terminated by signal ${signal}` : `exited with code ${code}`;
+        reject(
+          createTunnelStartupError(
+            `cloudflared ${reason} before the tunnel was ready.`,
+            stderrOutput,
+            origin
+          )
+        );
+      }
+    });
+  });
+}
+__name(waitForQuickTunnelReady, "waitForQuickTunnelReady");
+function createTunnelStartupError(message, stderrOutput, origin) {
+  const isQuickTunnelRateLimited = stderrOutput.includes(
+    "429 Too Many Requests"
+  );
+  const errorMessage = `${message}
+cloudflared output:
+${stderrOutput || "(no output)"}
+
+The local dev server started at ${origin.href}.
+` + (isQuickTunnelRateLimited ? "Cloudflare Quick Tunnel creation was rate limited. Try again in a few minutes, or use a named tunnel if you need more reliable access." : `Check the cloudflared output above for more details, and verify that ${origin.href} is reachable from this machine if this keeps happening.`);
+  if (isQuickTunnelRateLimited) {
+    return new UserError(errorMessage, { telemetryMessage: false });
+  }
+  return new Error(errorMessage);
+}
+__name(createTunnelStartupError, "createTunnelStartupError");
+
+export { COMPLIANCE_REGION_CONFIG_PUBLIC, COMPLIANCE_REGION_CONFIG_UNKNOWN, Diagnostics, PatchConfigError, bucketFormatMessage, defaultWranglerConfig, experimental_patchConfig, friendlyBindingNames, getBindingTypeFriendlyName, getBooleanEnvironmentVariableFactory, getBrowserRenderingHeadfulFromEnv, getBuildConditionsFromEnv, getBuildPlatformFromEnv, getC3CommandFromEnv, getCIGeneratePreviewAlias, getCIMatchTag, getCIOverrideName, getCIOverrideNetworkModeHost, getCfFetchEnabledFromEnv, getCfFetchPathFromEnv, getCloudflareApiBaseUrl, getCloudflareApiEnvironmentFromEnv, getCloudflareComplianceRegion, getCloudflareEnv, getCloudflareIncludeProcessEnvFromEnv, getCloudflareLoadDevVarsFromDotEnv, getCloudflaredPathFromEnv, getComplianceRegionSubdomain, getD1ExtraLocationChoices, getDisableConfigWatching, getDockerPath, getEnvironmentVariableFactory, getGlobalWranglerConfigPath, getLocalExplorerEnabledFromEnv, getOpenNextDeployFromEnv, getOutputFileDirectoryFromEnv, getOutputFilePathFromEnv, getRegistryPath, getSanitizeLogs, getSubdomainMixedStateCheckDisabled, getTraceHeader, getWorkersCIBranchName, getWranglerCacheDirFromEnv, getWranglerHideBanner, getWranglerSendErrorReportsFromEnv, getWranglerSendMetricsFromEnv, hasProperty, isDockerfile, isOptionalProperty, isPagesConfig, isRequiredProperty, isValidR2BucketName, normalizeAndValidateConfig, spawnCloudflared, startTunnel, validatePagesConfig };