@cloudflare/workers-utils 0.36.0 → 0.38.0

package/dist/index.mjs

@@ -1,12 +1,12 @@
 export { MetricsRegistry } from './chunk-Z62CVNHJ.mjs';
 export { _forceColour, formatZodError } from './chunk-7AX24RFK.mjs';
-import { isRedirectedRawConfig, configFileName, formatConfigSnippet, getDurableObjectExports, getContainerNameToClassNameMap, parsePackageJSON, readFileSync, ParseError, parseJSON, APIError, dir, parseTOML, modify, applyEdits, format, dist_default, parseJSONC } from './chunk-V6JSHOVJ.mjs';
-export { APIError, ENVIRONMENT_TAG_PREFIX, INHERIT_SYMBOL, JSON_CONFIG_FORMATS, PATH_TO_DEPLOY_CONFIG, ParseError, SERVICE_TAG_PREFIX, configFileName, configFormat, experimental_readRawConfig, findWranglerConfig, formatConfigSnippet, getContainerDurableObjectClassNames, getContainerNameToClassNameMap, getDurableObjectExports, hasDurableObjectExports, indexLocation, isRedirectedConfig, parseByteSize, parseHumanDuration, parseJSON, parseJSONC, parseNonHyphenedUuid, parsePackageJSON, parseTOML, partitionExports, readFileSync, readFileSyncToBuffer, resolveContainerClassName, resolveWranglerConfigPath, searchLocation } from './chunk-V6JSHOVJ.mjs';
-import { assertNever } from './chunk-2I4Q5QJP.mjs';
-export { DEFAULT_COMPAT_DATE, assertNever, constructWranglerConfig, mapWorkerMetadataBindings } from './chunk-2I4Q5QJP.mjs';
+import { isRedirectedRawConfig, configFileName, formatConfigSnippet, getDurableObjectExports, getContainerNameToClassNameMap, parsePackageJSON, readFileSync, ParseError, parseJSON, APIError, CONTAINER_IMAGES_BINDING, dir, parseTOML, modify, applyEdits, format, dist_default, parseJSONC } from './chunk-IQDQ5WRD.mjs';
+export { APIError, CONTAINER_IMAGES_BINDING, ENVIRONMENT_TAG_PREFIX, INHERIT_SYMBOL, JSON_CONFIG_FORMATS, PATH_TO_DEPLOY_CONFIG, ParseError, SERVICE_TAG_PREFIX, configFileName, configFormat, experimental_readRawConfig, findWranglerConfig, formatConfigSnippet, getContainerDurableObjectClassNames, getContainerNameToClassNameMap, getDurableObjectContainerApps, getDurableObjectExports, hasDurableObjectExports, indexLocation, isDurableObjectContainerApp, isRedirectedConfig, parseByteSize, parseHumanDuration, parseJSON, parseJSONC, parseNonHyphenedUuid, parsePackageJSON, parseTOML, partitionExports, readFileSync, readFileSyncToBuffer, resolveContainerClassName, resolveWranglerConfigPath, searchLocation } from './chunk-IQDQ5WRD.mjs';
+import { assertNever } from './chunk-S3ANQ67D.mjs';
+export { DEFAULT_COMPAT_DATE, assertNever, constructWranglerConfig, mapWorkerMetadataBindings } from './chunk-S3ANQ67D.mjs';
 export { NODEJS_COMPAT_DEFAULT_ON_DATE, NODEJS_COMPAT_V2_SWITCH_OVER_DATE, getTodaysCompatDate, isCompatDate, isNodejsCompatDefaultOn, resolveNodejsCompat, stripRedundantNodejsCompatFlags } from './chunk-C6O4ION7.mjs';
-import { getCloudflareEnv, getCloudflaredPathFromEnv, getCloudflareApiBaseUrl, getTraceHeader, getOutputFilePathFromEnv, getOutputFileDirectoryFromEnv, getCIOverrideName, getWranglerCacheDirFromEnv } from './chunk-XUGGRRBO.mjs';
-export { COMPLIANCE_REGION_CONFIG_PUBLIC, COMPLIANCE_REGION_CONFIG_UNKNOWN, getBrowserRenderingHeadfulFromEnv, getBuildConditionsFromEnv, getBuildPlatformFromEnv, getC3CommandFromEnv, getCIGeneratePreviewAlias, getCIMatchTag, getCIOverrideName, getCIOverrideNetworkModeHost, getCfFetchEnabledFromEnv, getCfFetchPathFromEnv, getCloudflareApiBaseUrl, getCloudflareApiEnvironmentFromEnv, getCloudflareComplianceRegion, getCloudflareEnv, getCloudflareIncludeProcessEnvFromEnv, getCloudflareLoadDevVarsFromDotEnv, getCloudflaredPathFromEnv, getComplianceRegionSubdomain, getD1ExtraLocationChoices, getDisableConfigWatching, getLocalExplorerEnabledFromEnv, getLocalObservabilityEnabledFromEnv, getNoSkillsUpdatePromptsFromEnv, getOpenNextDeployFromEnv, getOutputFileDirectoryFromEnv, getOutputFilePathFromEnv, getRegistryPath, getSanitizeLogs, getSubdomainMixedStateCheckDisabled, getTraceHeader, getWorkersCIBranchName, getWranglerCacheDirFromEnv, getWranglerHideBanner, getWranglerSendErrorReportsFromEnv, getWranglerSendMetricsFromEnv, isDoNotTrackEnabled } from './chunk-XUGGRRBO.mjs';
+import { getCloudflareEnv, getCloudflareContainerRegistry, getCloudflareApiBaseUrl, getTraceHeader, getCloudflaredPathFromEnv, getOutputFilePathFromEnv, getOutputFileDirectoryFromEnv, getCIOverrideName, getWranglerCacheDirFromEnv } from './chunk-IYSONYTF.mjs';
+export { COMPLIANCE_REGION_CONFIG_PUBLIC, COMPLIANCE_REGION_CONFIG_UNKNOWN, getBrowserRenderingHeadfulFromEnv, getBuildConditionsFromEnv, getBuildPlatformFromEnv, getC3CommandFromEnv, getCIGeneratePreviewAlias, getCIMatchTag, getCIOverrideName, getCIOverrideNetworkModeHost, getCfFetchEnabledFromEnv, getCfFetchPathFromEnv, getCloudflareApiBaseUrl, getCloudflareApiEnvironmentFromEnv, getCloudflareComplianceRegion, getCloudflareContainerRegistry, getCloudflareEnv, getCloudflareIncludeProcessEnvFromEnv, getCloudflareLoadDevVarsFromDotEnv, getCloudflaredPathFromEnv, getComplianceRegionSubdomain, getD1ExtraLocationChoices, getDisableConfigWatching, getLocalExplorerEnabledFromEnv, getLocalObservabilityEnabledFromEnv, getNoSkillsUpdatePromptsFromEnv, getOpenNextDeployFromEnv, getOutputFileDirectoryFromEnv, getOutputFilePathFromEnv, getRegistryPath, getSanitizeLogs, getSubdomainMixedStateCheckDisabled, getTraceHeader, getWorkersCIBranchName, getWranglerCacheDirFromEnv, getWranglerHideBanner, getWranglerSendErrorReportsFromEnv, getWranglerSendMetricsFromEnv, isDoNotTrackEnabled } from './chunk-IYSONYTF.mjs';
 import { dedent } from './chunk-MCNIGVAF.mjs';
 export { getBooleanEnvironmentVariableFactory, getDockerPath, getEnvironmentVariableFactory } from './chunk-3IYLA2JH.mjs';
 import { UserError, FatalError } from './chunk-WO2IAW6M.mjs';
@@ -22,11 +22,11 @@ import * as path from 'node:path';
 import path__default, { join, dirname, resolve, basename } from 'node:path';
 import { stripVTControlCharacters } from 'node:util';
 import chalk from 'chalk';
+import { URLSearchParams as URLSearchParams$1 } from 'node:url';
+import { Headers, FormData, Response, fetch } from 'undici';
 import { execFileSync, spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { arch } from 'node:os';
-import { fetch, Headers, FormData, Response } from 'undici';
-import { URLSearchParams } from 'node:url';
 import * as timersPromises from 'node:timers/promises';
 import { setTimeout as setTimeout$1 } from 'node:timers/promises';
 import { assert as assert$1 } from 'node:console';
@@ -18451,7 +18451,16 @@ function normalizeAndValidateEnvironment(diagnostics, configPath, rawEnv, isDisp
       // `name` is inheritable, so a named environment that doesn't redeclare it
       // still runs under the top level Worker name — fall back to it so the
       // generated container name isn't built from `undefined`.
-      validateContainerApp(envName, rawEnv.name ?? rawConfig?.name, configPath),
+      validateContainerApp(
+        envName,
+        rawEnv.name ?? rawConfig?.name,
+        configPath,
+        {
+          complianceConfig: {
+            compliance_region: rawEnv.compliance_region ?? topLevelEnv?.compliance_region
+          }
+        }
+      ),
       void 0
     ),
     send_email: notInheritable(
@@ -19903,6 +19912,15 @@ function validatePreviewsContainers(envName, configPath) {
   });
   return (diagnostics, field, value, config2) => {
     if (Array.isArray(value)) {
+      const durableObjectPolicyFields = [...value.entries()].filter(
+        ([, entry]) => entry && typeof entry === "object" && entry.scheduling_policy === "durable_object"
+      ).map(([index]) => `"${field}[${index}].scheduling_policy"`);
+      if (durableObjectPolicyFields.length > 0) {
+        diagnostics.errors.push(
+          `${durableObjectPolicyFields.join(", ")} cannot be "durable_object". Durable Object-managed Containers are configured only in the top-level "containers" array.`
+        );
+        return false;
+      }
       const nameFields = [...value.entries()].filter(
         ([, entry]) => entry && typeof entry === "object" && "name" in entry
       ).map(([index]) => `"${field}[${index}].name"`);
@@ -19937,6 +19955,85 @@ function validatePreviewsContainers(envName, configPath) {
   };
 }
 __name(validatePreviewsContainers, "validatePreviewsContainers");
+function validateDurableObjectContainerImages(diagnostics, field, images, complianceConfig) {
+  if (images === void 0) {
+    return true;
+  }
+  if (typeof images !== "object" || images === null || Array.isArray(images) || Object.keys(images).length === 0) {
+    diagnostics.errors.push(
+      `"${field}" must be a non-empty object when present.`
+    );
+    return false;
+  }
+  let valid = true;
+  const entries = Object.entries(images);
+  if (entries.length > 100) {
+    diagnostics.errors.push(`"${field}" must contain at most 100 images.`);
+    valid = false;
+  }
+  for (const [imageName, imageValue] of entries) {
+    const imageField = `${field}.${imageName}`;
+    if (imageName.length === 0 || imageName.length > 128) {
+      diagnostics.errors.push(
+        `"${field}" image names must be between 1 and 128 characters.`
+      );
+      valid = false;
+    }
+    if (typeof imageValue !== "object" || imageValue === null || Array.isArray(imageValue)) {
+      diagnostics.errors.push(
+        `"${imageField}" must be an object with either a "dockerfile" or "image" field.`
+      );
+      valid = false;
+      continue;
+    }
+    const image = imageValue;
+    const hasDockerfile = image.dockerfile !== void 0;
+    const hasImage = image.image !== void 0;
+    if (hasDockerfile === hasImage) {
+      diagnostics.errors.push(
+        `"${imageField}" must specify exactly one of "dockerfile" or "image".`
+      );
+      valid = false;
+    }
+    if (hasDockerfile && (typeof image.dockerfile !== "string" || image.dockerfile.length === 0)) {
+      diagnostics.errors.push(
+        `"${imageField}.dockerfile" must be a non-empty string.`
+      );
+      valid = false;
+    }
+    if (hasImage && (typeof image.image !== "string" || image.image.length === 0)) {
+      diagnostics.errors.push(
+        `"${imageField}.image" must be a non-empty string.`
+      );
+      valid = false;
+    }
+    if (typeof image.image === "string" && image.image.length > 0) {
+      const registry2 = getCloudflareContainerRegistry(complianceConfig);
+      const prefix = `${registry2}/`;
+      const reference = image.image.slice(prefix.length);
+      const digestReference = reference.match(
+        /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)+@sha256:[a-f0-9]{64}$/
+      );
+      if (!image.image.startsWith(prefix) || digestReference?.[0] !== reference) {
+        diagnostics.errors.push(
+          `"${imageField}.image" must be a digest-pinned image in the managed registry, in the form "${registry2}/<account-id>/<repository>@sha256:<64 lowercase hex characters>".`
+        );
+        valid = false;
+      }
+    }
+    const unsupportedFields = Object.keys(image).filter(
+      (property) => property !== "dockerfile" && property !== "image"
+    );
+    if (unsupportedFields.length > 0) {
+      diagnostics.errors.push(
+        `Unexpected fields found in ${imageField} field: ${unsupportedFields.map((property) => `"${property}"`).join(", ")}`
+      );
+      valid = false;
+    }
+  }
+  return valid;
+}
+__name(validateDurableObjectContainerImages, "validateDurableObjectContainerImages");
 function validateContainerApp(envName, topLevelName, configPath, options = {}) {
   const { generateDefaultName = true } = options;
   return (diagnostics, field, value, config2) => {
@@ -19950,13 +20047,23 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
       return false;
     }
     for (const containerAppOptional of value) {
-      validateOptionalProperty(
-        diagnostics,
-        field,
-        "class_name",
-        containerAppOptional.class_name,
-        "string"
-      );
+      const isDurableObjectManaged = containerAppOptional.scheduling_policy === "durable_object";
+      const hasValidDurableObjectClassName = typeof containerAppOptional.class_name === "string" && containerAppOptional.class_name.length > 0;
+      if (isDurableObjectManaged) {
+        if (!hasValidDurableObjectClassName) {
+          diagnostics.errors.push(
+            `"containers.class_name" must be a non-empty string when "containers.scheduling_policy" is "durable_object".`
+          );
+        }
+      } else {
+        validateOptionalProperty(
+          diagnostics,
+          field,
+          "class_name",
+          containerAppOptional.class_name,
+          "string"
+        );
+      }
       validateOptionalProperty(
         diagnostics,
         field,
@@ -19964,7 +20071,7 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
         containerAppOptional.name,
         "string"
       );
-      if (generateDefaultName && !containerAppOptional.name) {
+      if (generateDefaultName && !containerAppOptional.name && (!isDurableObjectManaged || hasValidDurableObjectClassName)) {
         if (containerAppOptional.class_name === void 0) {
           diagnostics.errors.push(
             `"containers.name" is required when "containers.class_name" is not defined, because there is no class name to derive a default name from. Either name this container and reference it from a Durable Object's \`exports\` entry, or set "containers.class_name".`
@@ -19979,6 +20086,23 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
           containerAppOptional.name = name.toLowerCase().replace(/ /g, "-");
         }
       }
+      if (isDurableObjectManaged) {
+        validateDurableObjectContainerImages(
+          diagnostics,
+          `${field}.images`,
+          containerAppOptional.images,
+          options.complianceConfig
+        );
+        const unsupportedFields = Object.keys(containerAppOptional).filter(
+          (key) => !["name", "class_name", "scheduling_policy", "images"].includes(key)
+        );
+        if (unsupportedFields.length > 0) {
+          diagnostics.errors.push(
+            `Unsupported fields for Durable Object-managed Containers in ${field}: ${unsupportedFields.map((key) => `"${key}"`).join(",")}. Only "name", "class_name", "scheduling_policy", and "images" are supported.`
+          );
+        }
+        continue;
+      }
       if (!containerAppOptional.configuration?.image && !containerAppOptional.image) {
         diagnostics.errors.push(
           `"containers.image" field must be defined for each container app. This should be the path to your Dockerfile or an image URI pointing to the Cloudflare registry.`
@@ -20117,6 +20241,12 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
         containerAppOptional.image_vars,
         "object"
       );
+      validateContainerObservability(
+        diagnostics,
+        `${field}.observability`,
+        containerAppOptional.observability,
+        config2
+      );
       validateOptionalProperty(
         diagnostics,
         field,
@@ -20160,6 +20290,7 @@ function validateContainerApp(envName, topLevelName, configPath, options = {}) {
           "image",
           "image_build_context",
           "image_vars",
+          "observability",
           "class_name",
           "scheduling_policy",
           "instance_type",
@@ -20985,6 +21116,7 @@ var validateBindingsHaveUniqueNames = /* @__PURE__ */ __name((diagnostics, confi
     ])
   );
   bindingsGroupedByType["Secret"] = config2.secrets?.required ?? [];
+  bindingsGroupedByType["Container images"] = [CONTAINER_IMAGES_BINDING];
   const bindingsGroupedByName = {};
   for (const bindingType in bindingsGroupedByType) {
     const bindingNames = bindingsGroupedByType[bindingType];
@@ -22400,6 +22532,133 @@ var validateExports = /* @__PURE__ */ __name((diagnostics, field, value) => {
   }
   return valid;
 }, "validateExports");
+var CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MIN = 1;
+var CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MAX = 99;
+var CONTAINER_OBSERVABILITY_TARGET_INSTANCE_COUNT_MIN = 1;
+function isContainerObservabilityEnabled(observability) {
+  return observability?.logs?.enabled === true || observability?.enabled === true;
+}
+__name(isContainerObservabilityEnabled, "isContainerObservabilityEnabled");
+function hasConflictingContainerObservabilityEnabledValues(observability) {
+  return typeof observability.enabled === "boolean" && typeof observability.logs?.enabled === "boolean" && observability.enabled !== observability.logs.enabled;
+}
+__name(hasConflictingContainerObservabilityEnabledValues, "hasConflictingContainerObservabilityEnabledValues");
+var validateContainerObservability = /* @__PURE__ */ __name((diagnostics, field, value) => {
+  if (value === void 0) {
+    return true;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    diagnostics.errors.push(
+      `"${field}" should be an object but got ${JSON.stringify(value)}.`
+    );
+    return false;
+  }
+  const val = value;
+  let isValid = true;
+  isValid = validateOptionalProperty(
+    diagnostics,
+    field,
+    "enabled",
+    val.enabled,
+    "boolean"
+  ) && isValid;
+  if (val.logs !== void 0) {
+    if (typeof val.logs !== "object" || val.logs === null || Array.isArray(val.logs)) {
+      diagnostics.errors.push(
+        `Expected "${field}.logs" to be of type object but got ${JSON.stringify(
+          val.logs
+        )}.`
+      );
+      isValid = false;
+    } else {
+      isValid = validateOptionalProperty(
+        diagnostics,
+        field,
+        "logs.enabled",
+        val.logs.enabled,
+        "boolean"
+      ) && isValid;
+      isValid = validateAdditionalProperties(
+        diagnostics,
+        `${field}.logs`,
+        Object.keys(val.logs),
+        ["enabled"]
+      ) && isValid;
+    }
+  }
+  if (val.enabled === void 0 && val.target_instance_percentage === void 0 && val.target_instance_count === void 0 && (val.logs === void 0 || typeof val.logs === "object" && val.logs !== null && !Array.isArray(val.logs) && val.logs.enabled === void 0)) {
+    isValid = validateAtLeastOnePropertyRequired(diagnostics, field, [
+      {
+        key: "enabled",
+        value: val.enabled,
+        type: "boolean"
+      },
+      {
+        key: "logs.enabled",
+        value: val.logs?.enabled,
+        type: "boolean"
+      }
+    ]) && isValid;
+  }
+  isValid = validateOptionalProperty(
+    diagnostics,
+    field,
+    "target_instance_percentage",
+    val.target_instance_percentage,
+    "number"
+  ) && isValid;
+  isValid = validateOptionalProperty(
+    diagnostics,
+    field,
+    "target_instance_count",
+    val.target_instance_count,
+    "number"
+  ) && isValid;
+  isValid = validateAdditionalProperties(diagnostics, field, Object.keys(val), [
+    "enabled",
+    "logs",
+    "target_instance_percentage",
+    "target_instance_count"
+  ]) && isValid;
+  if (hasConflictingContainerObservabilityEnabledValues(val)) {
+    diagnostics.errors.push(
+      `"${field}.enabled" and "${field}.logs.enabled" cannot be set to different values.`
+    );
+    isValid = false;
+  }
+  if (val.target_instance_percentage !== void 0 && val.target_instance_count !== void 0) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_percentage" and "${field}.target_instance_count" cannot both be set.`
+    );
+    isValid = false;
+  }
+  if (typeof val.target_instance_percentage === "number" && (!Number.isInteger(val.target_instance_percentage) || val.target_instance_percentage < CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MIN || val.target_instance_percentage > CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MAX)) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_percentage" must be an integer between ${CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MIN} and ${CONTAINER_OBSERVABILITY_TARGET_INSTANCE_PERCENTAGE_MAX} inclusive.`
+    );
+    isValid = false;
+  }
+  if (typeof val.target_instance_count === "number" && (!Number.isInteger(val.target_instance_count) || val.target_instance_count < CONTAINER_OBSERVABILITY_TARGET_INSTANCE_COUNT_MIN)) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_count" must be a positive integer.`
+    );
+    isValid = false;
+  }
+  const observabilityEnabled = isContainerObservabilityEnabled(val);
+  if (val.target_instance_percentage !== void 0 && !observabilityEnabled) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_percentage" requires "${field}.enabled" or "${field}.logs.enabled" to be true because container observability overrides root observability.`
+    );
+    isValid = false;
+  }
+  if (val.target_instance_count !== void 0 && !observabilityEnabled) {
+    diagnostics.errors.push(
+      `"${field}.target_instance_count" requires "${field}.enabled" or "${field}.logs.enabled" to be true because container observability overrides root observability.`
+    );
+    isValid = false;
+  }
+  return isValid;
+}, "validateContainerObservability");
 var validateObservability = /* @__PURE__ */ __name((diagnostics, field, value) => {
   if (value === void 0) {
     return true;
@@ -24305,7 +24564,9 @@ ${allTailConsumers.map(({ service, streaming }) => {
     }
     log(
       `${containersTitle}
-${containers.map((c) => `- ${c.name} (${c.image})`).join("\n")}`
+${containers.map(
+        (container) => container.scheduling_policy === "durable_object" ? `- ${container.class_name} (durable_object)` : `- ${container.name} (${container.image})`
+      ).join("\n")}`
     );
     log("");
   }
@@ -24783,1168 +25044,1310 @@ function getWranglerTmpDir(projectRoot, prefix, cleanup = true) {
 }
 __name(getWranglerTmpDir, "getWranglerTmpDir");
 
-// src/cloudflared.ts
-var import_command_exists = __toESM(require_command_exists2());
-var UPDATE_SERVICE_URL = "https://update.argotunnel.com";
-var CLOUDFLARED_VERSION_PATTERN = /^\d{4}\.\d+\.\d+$/;
-function sha256Hex(buffer) {
-  return createHash("sha256").update(buffer).digest("hex");
+// src/cfetch/errors.ts
+function buildDetailedError(message, ...extra) {
+  return new ParseError({
+    text: message,
+    notes: extra.map((text) => ({ text })),
+    telemetryMessage: false
+  });
 }
-__name(sha256Hex, "sha256Hex");
-function getGoArch() {
-  const nodeArch = arch();
-  switch (nodeArch) {
-    case "x64":
-      return "amd64";
-    case "arm64":
-      return "arm64";
-    case "arm":
-      return "arm";
-    default:
-      throw new UserError(
-        `Unsupported architecture for cloudflared: ${nodeArch}
-
-cloudflared supports: x64 (amd64), arm64, arm
-
-You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
-Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
-        { telemetryMessage: "tunnel cloudflared unsupported architecture" }
-      );
+__name(buildDetailedError, "buildDetailedError");
+function maybeThrowFriendlyError(error51) {
+  if (error51.message === "workers.api.error.email_verification_required") {
+    throw buildDetailedError(
+      "Please verify your account's email address and try again.",
+      "Check your email for a verification link, or login to https://dash.cloudflare.com and request a new one."
+    );
   }
 }
-__name(getGoArch, "getGoArch");
-function getGoOS() {
-  switch (process.platform) {
-    case "darwin":
-      return "darwin";
-    case "linux":
-      return "linux";
-    case "win32":
-      return "windows";
-    default:
-      throw new UserError(
-        `Unsupported platform for cloudflared: ${process.platform}
-
-cloudflared supports: darwin (macOS), linux, win32 (Windows)
+__name(maybeThrowFriendlyError, "maybeThrowFriendlyError");
 
-You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
-Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
-        { telemetryMessage: "tunnel cloudflared unsupported platform" }
-      );
-  }
+// src/cfetch/index.ts
+function logHeaders(headers, logger) {
+  const clone2 = cloneHeaders(headers);
+  clone2.delete("Authorization");
+  logger.debugWithSanitization?.(
+    "HEADERS:",
+    JSON.stringify(Object.fromEntries(clone2), null, 2)
+  );
 }
-__name(getGoOS, "getGoOS");
-var GITHUB_RELEASE_BASE = "https://github.com/cloudflare/cloudflared/releases/download";
-function getAssetFilename(goOS, goArch) {
-  if (goOS === "windows") {
-    return `cloudflared-${goOS}-${goArch}.exe`;
+__name(logHeaders, "logHeaders");
+async function performApiFetchBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+  assert2(credentials, "credentials are required for performApiFetch");
+  const method = init.method ?? "GET";
+  assert2(
+    resource.startsWith("/"),
+    `CF API fetch - resource path must start with a "/" but got "${resource}"`
+  );
+  const headers = cloneHeaders(new Headers(init.headers));
+  addAuthorizationHeader(headers, credentials);
+  headers.set("User-Agent", userAgent);
+  maybeAddTraceHeader(headers);
+  const queryString = queryParams ? `?${queryParams.toString()}` : "";
+  logger.debug(
+    `-- START CF API REQUEST: ${method} ${getCloudflareApiBaseUrl(complianceConfig)}${resource}`
+  );
+  logger.debugWithSanitization?.("QUERY STRING:", queryString);
+  logHeaders(headers, logger);
+  logger.debugWithSanitization?.("INIT:", JSON.stringify({ ...init }, null, 2));
+  if (init.body instanceof FormData) {
+    logger.debugWithSanitization?.(
+      "BODY:",
+      await new Response(init.body).text(),
+      null,
+      2
+    );
   }
-  if (goOS === "darwin") {
-    return `cloudflared-${goOS}-${goArch}.tgz`;
-  }
-  return `cloudflared-${goOS}-${goArch}`;
+  logger.debug("-- END CF API REQUEST");
+  return await fetch(
+    `${getCloudflareApiBaseUrl(complianceConfig)}${resource}${queryString}`,
+    {
+      method,
+      ...init,
+      headers,
+      signal: abortSignal
+    }
+  );
 }
-__name(getAssetFilename, "getAssetFilename");
-async function queryUpdateService(goOS, goArch, options) {
-  const { logger } = options ?? {};
-  const url2 = new URL(UPDATE_SERVICE_URL);
-  url2.searchParams.set("os", goOS);
-  url2.searchParams.set("arch", goArch);
-  logger?.debug(`Checking for latest cloudflared: ${url2.toString()}`);
-  let response;
-  try {
-    response = await fetch(url2.toString(), {
-      headers: { "User-Agent": "wrangler" }
-    });
-  } catch (e2) {
-    logger?.debug(
-      `Failed to reach update service: ${e2 instanceof Error ? e2.message : String(e2)}`
-    );
-    return null;
+__name(performApiFetchBase, "performApiFetchBase");
+async function fetchInternalBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+  const method = init.method ?? "GET";
+  const response = await performApiFetchBase(
+    complianceConfig,
+    resource,
+    init,
+    userAgent,
+    logger,
+    queryParams,
+    abortSignal,
+    credentials
+  );
+  const jsonText = await response.text();
+  logger.debug(
+    "-- START CF API RESPONSE:",
+    response.statusText,
+    response.status
+  );
+  logHeaders(response.headers, logger);
+  logger.debugWithSanitization?.("RESPONSE:", jsonText);
+  logger.debug("-- END CF API RESPONSE");
+  const retryAfterMs = parseRetryAfterMs(response.headers);
+  if (!jsonText && (response.status === 204 || response.status === 205)) {
+    return {
+      response: {
+        result: {},
+        success: true,
+        errors: [],
+        messages: []
+      },
+      status: response.status,
+      retryAfterMs
+    };
   }
-  if (!response.ok) {
-    logger?.debug(
-      `Update service returned ${response.status} for ${goOS}/${goArch}`
+  if (isWAFBlockResponse(response.headers)) {
+    throwWAFBlockError(
+      response.headers,
+      method,
+      resource,
+      response.status,
+      response.statusText,
+      retryAfterMs
     );
-    return null;
   }
-  let data;
   try {
-    data = await response.json();
-  } catch (e2) {
-    logger?.debug(
-      `Update service returned non-JSON response: ${e2 instanceof Error ? e2.message : String(e2)}`
-    );
-    return null;
+    const json2 = parseJSON(jsonText);
+    return { response: json2, status: response.status, retryAfterMs };
+  } catch {
+    const rayId = extractWAFBlockRayId(response.headers);
+    throw new APIError({
+      text: "Received a malformed response from the API",
+      notes: [
+        {
+          text: truncate(jsonText, 100)
+        },
+        {
+          text: `${method} ${resource} -> ${response.status} ${response.statusText}`
+        },
+        ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : []
+      ],
+      status: response.status,
+      retryAfterMs,
+      telemetryMessage: false
+    });
   }
-  if (typeof data.version === "string" && !CLOUDFLARED_VERSION_PATTERN.test(data.version)) {
-    throw new Error(
-      `[cloudflared] Invalid cloudflared version returned by update service: ${data.version}`
+}
+__name(fetchInternalBase, "fetchInternalBase");
+async function fetchResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+  const {
+    response: json2,
+    status,
+    retryAfterMs
+  } = await fetchInternalBase(
+    complianceConfig,
+    resource,
+    init,
+    userAgent,
+    logger,
+    queryParams,
+    abortSignal,
+    credentials
+  );
+  if (json2.success) {
+    return json2.result;
+  } else {
+    throwFetchError(resource, json2, status, retryAfterMs);
+  }
+}
+__name(fetchResultBase, "fetchResultBase");
+async function fetchListResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, credentials) {
+  const results = [];
+  let getMoreResults = true;
+  let cursor;
+  while (getMoreResults) {
+    if (cursor) {
+      queryParams = new URLSearchParams$1(queryParams);
+      queryParams.set("cursor", cursor);
+    }
+    const {
+      response: json2,
+      status,
+      retryAfterMs
+    } = await fetchInternalBase(
+      complianceConfig,
+      resource,
+      init,
+      userAgent,
+      logger,
+      queryParams,
+      void 0,
+      credentials
     );
+    if (json2.success) {
+      results.push(...json2.result);
+      if (hasCursor(json2.result_info)) {
+        cursor = json2.result_info?.cursor;
+      } else {
+        getMoreResults = false;
+      }
+    } else {
+      throwFetchError(resource, json2, status, retryAfterMs);
+    }
   }
-  if (data.error || !data.url || !data.version) {
-    return data.version ? data : null;
+  return results;
+}
+__name(fetchListResultBase, "fetchListResultBase");
+function truncate(text, maxLength) {
+  const { length } = text;
+  if (length <= maxLength) {
+    return text;
   }
-  return data;
+  return `${text.substring(0, maxLength)}... (length = ${length})`;
 }
-__name(queryUpdateService, "queryUpdateService");
-async function getLatestVersionInfo(options) {
-  const { logger } = options ?? {};
-  const goOS = getGoOS();
-  const goArch = getGoArch();
-  const primary = await queryUpdateService(goOS, goArch, { logger });
-  if (primary && primary.url && primary.version) {
-    return primary;
+__name(truncate, "truncate");
+function isWAFBlockResponse(headers) {
+  return headers.get("cf-mitigated") === "challenge";
+}
+__name(isWAFBlockResponse, "isWAFBlockResponse");
+function parseRetryAfterValue(retryAfter) {
+  if (!retryAfter) {
+    return void 0;
   }
-  logger?.debug(
-    `Update worker had no result for ${goOS}/${goArch}, falling back to GitHub release URL`
-  );
-  const fallback = await queryUpdateService("linux", "amd64", { logger });
-  if (!fallback?.version) {
-    throw new UserError(
-      `[cloudflared] Failed to determine the latest cloudflared version.
-
-The update service did not return results for ${goOS}/${goArch},
-and the fallback query also failed.
-
-You can manually install cloudflared from:
-https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
-      { telemetryMessage: "tunnel cloudflared version lookup failed" }
-    );
+  if (/^\d+$/.test(retryAfter.trim())) {
+    return Number(retryAfter) * 1e3;
   }
-  const version2 = fallback.version;
-  const filename = getAssetFilename(goOS, goArch);
-  const url2 = `${GITHUB_RELEASE_BASE}/${version2}/${filename}`;
-  const compressed = filename.endsWith(".tgz");
-  return {
-    url: url2,
-    version: version2,
-    checksum: "",
-    // no checksum available for fallback URLs
-    compressed,
-    shouldUpdate: true,
-    userMessage: "",
-    error: ""
-  };
+  const retryAfterDate = new Date(retryAfter);
+  if (!Number.isNaN(retryAfterDate.getTime())) {
+    return Math.max(0, retryAfterDate.getTime() - Date.now());
+  }
+  return void 0;
 }
-__name(getLatestVersionInfo, "getLatestVersionInfo");
-function getCacheDir(version2) {
-  return join(getGlobalConfigPath(), "cloudflared", version2);
+__name(parseRetryAfterValue, "parseRetryAfterValue");
+function parseRetryAfterMs(headers) {
+  return parseRetryAfterValue(headers.get("Retry-After"));
 }
-__name(getCacheDir, "getCacheDir");
-function getCloudflaredBinPath(version2) {
-  const binName = process.platform === "win32" ? "cloudflared.exe" : "cloudflared";
-  return join(getCacheDir(version2), binName);
+__name(parseRetryAfterMs, "parseRetryAfterMs");
+function extractWAFBlockRayId(headers) {
+  return headers.get("cf-ray") ?? void 0;
 }
-__name(getCloudflaredBinPath, "getCloudflaredBinPath");
-function isBinaryExecutable(binPath) {
-  try {
-    accessSync(binPath, constants.X_OK);
-    return true;
-  } catch {
-    return false;
-  }
+__name(extractWAFBlockRayId, "extractWAFBlockRayId");
+function extractAccountTag(resource) {
+  const re = new RegExp("/accounts/([a-zA-Z0-9]+)/?");
+  const matches = re.exec(resource);
+  return matches?.[1];
 }
-__name(isBinaryExecutable, "isBinaryExecutable");
-function validateBinary(binPath, options) {
-  const { logger } = options ?? {};
-  try {
-    const output = execFileSync(binPath, ["--version"], {
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 1e4,
-      encoding: "utf8"
-    }).trim();
-    logger?.debug(`cloudflared version: ${output}`);
-  } catch {
-    let errorMessage = `[cloudflared] Failed to validate cloudflared binary at ${binPath}
+__name(extractAccountTag, "extractAccountTag");
+function hasMorePages(result_info) {
+  const page = result_info?.page;
+  const per_page = result_info?.per_page;
+  const total = result_info?.total_count;
+  return page !== void 0 && per_page !== void 0 && total !== void 0 && page * per_page < total;
+}
+__name(hasMorePages, "hasMorePages");
+function renderError(err, level = 0) {
+  const indent = "  ".repeat(level);
+  const message = err.message ?? "";
+  const chainedMessages = "error_chain" in err ? err.error_chain?.map(
+    (chainedError) => `
 
-`;
-    errorMessage += `This usually means:
-`;
-    errorMessage += `  - The binary is corrupted or incomplete
-`;
-    errorMessage += `  - You're missing required system libraries
-`;
-    if (process.platform === "linux") {
-      errorMessage += `
-On Linux, make sure you have the required dependencies:
-`;
-      errorMessage += `  - glibc (GNU C Library)
-`;
-      errorMessage += `  - For Debian/Ubuntu: sudo apt-get install libc6
-`;
-    }
-    const cacheDir = join(getGlobalConfigPath(), "cloudflared");
-    errorMessage += `
-You can try:
-`;
-    errorMessage += `  1. Deleting the cache directory: rm -rf ${cacheDir}
-`;
-    errorMessage += `  2. Running the command again to re-download
-`;
-    errorMessage += `  3. Manually installing cloudflared: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/
-`;
-    errorMessage += `  4. Setting CLOUDFLARED_PATH to point to your cloudflared binary`;
-    throw new UserError(errorMessage, {
-      telemetryMessage: "tunnel cloudflared validation failed"
-    });
-  }
+${indent}- ${renderError(chainedError, level + 1)}`
+  ).join("\n") ?? "" : "";
+  return (err.code ? `${message} [code: ${err.code}]` : message) + (err.documentation_url ? `
+${indent}To learn more about this error, visit: ${err.documentation_url}` : "") + chainedMessages;
 }
-__name(validateBinary, "validateBinary");
-function redactCloudflaredArgsForLogging(args) {
-  const redacted = [...args];
-  for (let i = 0; i < redacted.length; i++) {
-    const arg = redacted[i];
-    if (arg === "--token" && i + 1 < redacted.length) {
-      redacted[i + 1] = "[REDACTED]";
-    }
-    if (arg.startsWith("--token=")) {
-      redacted[i] = "--token=[REDACTED]";
+__name(renderError, "renderError");
+function addAuthorizationHeader(headers, auth, overrideExisting = false) {
+  if (!headers.has("Authorization") || overrideExisting) {
+    if ("apiToken" in auth) {
+      const authorizationHeader = `Bearer ${auth.apiToken}`;
+      validateAuthorizationHeaderValue(authorizationHeader);
+      headers.set("Authorization", authorizationHeader);
+    } else {
+      headers.set("X-Auth-Key", auth.authKey);
+      headers.set("X-Auth-Email", auth.authEmail);
     }
   }
-  return redacted;
 }
-__name(redactCloudflaredArgsForLogging, "redactCloudflaredArgsForLogging");
-function tryGetCloudflaredFromPath(options) {
-  const { logger } = options ?? {};
-  if (!(0, import_command_exists.sync)("cloudflared")) {
-    return null;
-  }
-  try {
-    validateBinary("cloudflared", { logger });
-    return "cloudflared";
-  } catch (e2) {
-    logger?.debug("cloudflared found in PATH but failed validation", e2);
-    return null;
+__name(addAuthorizationHeader, "addAuthorizationHeader");
+function validateAuthorizationHeaderValue(value) {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint === void 0 || codePoint > 255) {
+      throw new UserError(
+        `The configured Cloudflare API token contains a character that cannot be used in an HTTP Authorization header: ${formatAuthorizationHeaderCharacter(character, codePoint)}. Recreate or copy the token again, making sure it does not include characters such as ellipses.`,
+        {
+          telemetryMessage: "cfetch auth invalid authorization header"
+        }
+      );
+    }
   }
 }
-__name(tryGetCloudflaredFromPath, "tryGetCloudflaredFromPath");
-function getInstalledVersion(binPath) {
-  try {
-    const output = execFileSync(binPath, ["--version"], {
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 1e4,
-      encoding: "utf8"
-    });
-    const match = output.match(/(\d+\.\d+\.\d+)/);
-    return match ? match[1] : null;
-  } catch {
-    return null;
+__name(validateAuthorizationHeaderValue, "validateAuthorizationHeaderValue");
+function formatAuthorizationHeaderCharacter(character, codePoint) {
+  if (codePoint === void 0) {
+    return '"\\u{unknown}"';
   }
+  const codePointLabel = `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
+  const characterLabel = isPrintableCharacter(character) ? `"${character}"` : `"${escapeCharacter(character)}"`;
+  return `${characterLabel} (${codePointLabel})`;
 }
-__name(getInstalledVersion, "getInstalledVersion");
-function isVersionOutdated(installed, latest) {
-  const parse3 = /* @__PURE__ */ __name((v) => v.split(".").map(Number), "parse");
-  const [iYear, iMonth, iPatch] = parse3(installed);
-  const [lYear, lMonth, lPatch] = parse3(latest);
-  if (iYear !== lYear) {
-    return iYear < lYear;
-  }
-  if (iMonth !== lMonth) {
-    return iMonth < lMonth;
-  }
-  return iPatch < lPatch;
+__name(formatAuthorizationHeaderCharacter, "formatAuthorizationHeaderCharacter");
+function isPrintableCharacter(character) {
+  return !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(character);
 }
-__name(isVersionOutdated, "isVersionOutdated");
-async function warnIfOutdated(binPath, options) {
-  const { logger } = options ?? {};
-  try {
-    const installed = getInstalledVersion(binPath);
-    if (!installed) {
-      return;
-    }
-    const latest = await queryUpdateService(getGoOS(), getGoArch(), { logger }) ?? await queryUpdateService("linux", "amd64", { logger });
-    const latestVersion = latest?.version;
-    if (!latestVersion) {
-      return;
-    }
-    if (isVersionOutdated(installed, latestVersion)) {
-      logger?.warn(
-        `Your cloudflared (${installed}) is outdated. Latest version is ${latestVersion}.
-Update: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`
-      );
+__name(isPrintableCharacter, "isPrintableCharacter");
+function escapeCharacter(character) {
+  return Array.from(character).map((c) => {
+    const codePoint = c.codePointAt(0);
+    if (codePoint === void 0) {
+      return "";
     }
-  } catch (e2) {
-    logger?.debug("Failed to check cloudflared version", e2);
-  }
+    return codePoint <= 65535 ? `\\u${codePoint.toString(16).toUpperCase().padStart(4, "0")}` : `\\u{${codePoint.toString(16).toUpperCase()}}`;
+  }).join("");
 }
-__name(warnIfOutdated, "warnIfOutdated");
-function writeFileAtomic(filePath, contents) {
-  const dir2 = dirname(filePath);
-  const tmpPath = join(
-    dir2,
-    `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`
-  );
-  try {
-    writeFileSync(tmpPath, contents);
-    renameSync(tmpPath, filePath);
-  } finally {
-    try {
-      if (existsSync(tmpPath)) {
-        unlinkSync(tmpPath);
-      }
-    } catch {
+__name(escapeCharacter, "escapeCharacter");
+function throwFetchError(resource, response, status, retryAfterMs) {
+  const errors = response.errors ?? [];
+  for (const error52 of errors) {
+    maybeThrowFriendlyError(error52);
+  }
+  const notes = [
+    ...errors.map((err) => ({ text: renderError(err) })),
+    ...response.messages?.map((msg) => ({
+      text: typeof msg === "string" ? msg : msg.message ?? String(msg)
+    })) ?? []
+  ];
+  if (notes.length === 0) {
+    const raw = response;
+    const fallbackMessage = typeof raw.error === "string" ? `${raw.error}${raw.code ? ` [code: ${raw.code}]` : ""}` : void 0;
+    if (fallbackMessage) {
+      notes.push({ text: fallbackMessage });
     }
   }
-}
-__name(writeFileAtomic, "writeFileAtomic");
-async function downloadCloudflared(versionInfo, binPath, options) {
-  const { logger } = options ?? {};
-  const { url: url2, version: version2, checksum, compressed } = versionInfo;
-  logger?.log(`Downloading cloudflared ${version2}...`);
-  logger?.debug(`Download URL: ${url2}`);
-  const cacheDir = dirname(binPath);
-  mkdirSync(cacheDir, { recursive: true });
-  let response;
-  try {
-    response = await fetch(url2, {
-      headers: { "User-Agent": "wrangler" }
+  if (retryAfterMs !== void 0) {
+    notes.push({
+      text: `The API responded with a "Retry-After" header indicating you should wait ${Math.ceil(retryAfterMs / 1e3)} second(s) before retrying.`
     });
-  } catch (e2) {
-    throw new UserError(
-      `[cloudflared] Failed to download cloudflared from ${url2}
-
-Network error: ${e2 instanceof Error ? e2.message : String(e2)}
-
-Please check your internet connection and try again.
-If you're behind a proxy, make sure it's configured correctly.`,
-      { telemetryMessage: "tunnel cloudflared download network failed" }
-    );
   }
-  if (!response.ok) {
-    throw new UserError(
-      `[cloudflared] Failed to download cloudflared from ${url2}
-
-HTTP ${response.status}: ${response.statusText}
-
-You can manually download cloudflared from:
-https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
-      { telemetryMessage: "tunnel cloudflared download response failed" }
-    );
+  const error51 = new APIError({
+    text: `A request to the Cloudflare API (${resource}) failed.`,
+    notes,
+    status,
+    // hoist the parsed `Retry-After` header (if any) so consumers such as
+    // `retryOnAPIFailure()` can back off for the amount of time the API
+    // asked us to wait, e.g. when rate limited (HTTP 429).
+    retryAfterMs,
+    telemetryMessage: false
+  });
+  const code = errors[0]?.code;
+  if (code) {
+    error51.code = code;
   }
-  try {
-    if (compressed) {
-      await downloadAndExtractTarball(response, checksum, binPath, cacheDir);
-    } else {
-      await downloadBinary(response, checksum, binPath);
-    }
-  } catch (e2) {
-    try {
-      if (existsSync(binPath)) {
-        unlinkSync(binPath);
-      }
-    } catch {
-    }
-    if (e2 instanceof UserError) {
-      throw e2;
-    }
-    throw new UserError(
-      `[cloudflared] Failed to save cloudflared binary
-
-Error: ${e2 instanceof Error ? e2.message : String(e2)}
-
-Please ensure you have write permissions to: ${cacheDir}`,
-      { telemetryMessage: "tunnel cloudflared save failed" }
+  const meta3 = errors[0]?.meta;
+  if (meta3) {
+    error51.meta = meta3;
+  }
+  error51.accountTag = extractAccountTag(resource);
+  throw error51;
+}
+__name(throwFetchError, "throwFetchError");
+function throwWAFBlockError(headers, method, resource, status, statusText, retryAfterMs) {
+  const rayId = extractWAFBlockRayId(headers);
+  throw new APIError({
+    text: "The Cloudflare API responded with a WAF block page instead of the expected JSON response",
+    notes: [
+      {
+        text: "Cloudflare's firewall (WAF) blocked this API request. This is usually a false positive."
+      },
+      ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : [],
+      {
+        text: rayId ? "If the issue persists, please open a Cloudflare Support ticket and include the Ray ID above." : "If the issue persists, please open a Cloudflare Support ticket. You can find the Cloudflare Ray ID on the block page in your browser."
+      },
+      {
+        text: `${method} ${resource} -> ${status} ${statusText}`
+      }
+    ],
+    status,
+    retryAfterMs,
+    telemetryMessage: false
+  });
+}
+__name(throwWAFBlockError, "throwWAFBlockError");
+async function fetchKVGetValueBase(complianceConfig, accountId, namespaceId, key, userAgent, logger, credentials) {
+  const headers = new Headers();
+  addAuthorizationHeader(headers, credentials);
+  headers.set("User-Agent", userAgent);
+  maybeAddTraceHeader(headers);
+  const resource = `${getCloudflareApiBaseUrl(complianceConfig)}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${key}`;
+  logger.debug(`-- START CF API REQUEST: GET ${resource}`);
+  logger.debug("-- END CF API REQUEST");
+  const response = await fetch(resource, {
+    method: "GET",
+    headers
+  });
+  if (response.ok) {
+    return await response.arrayBuffer();
+  } else {
+    throw new Error(
+      `Failed to fetch ${resource} - ${response.status}: ${response.statusText}`
     );
   }
-  if (process.platform !== "win32") {
-    chmodSync(binPath, 493);
+}
+__name(fetchKVGetValueBase, "fetchKVGetValueBase");
+function hasCursor(result_info) {
+  const cursor = result_info?.cursor;
+  return cursor !== void 0 && cursor !== null && cursor !== "";
+}
+__name(hasCursor, "hasCursor");
+function maybeAddTraceHeader(headers) {
+  const traceHeader = getTraceHeader();
+  if (traceHeader) {
+    headers.set("Cf-Trace-Id", traceHeader);
   }
-  logger?.log(`cloudflared ${version2} installed`);
-  logger?.debug(`Binary location: ${binPath}`);
 }
-__name(downloadCloudflared, "downloadCloudflared");
-async function downloadAndExtractTarball(response, expectedChecksum, binPath, cacheDir) {
-  const tempTarPath = join(cacheDir, "cloudflared.tgz");
-  const buffer = Buffer.from(await response.arrayBuffer());
-  writeFileSync(tempTarPath, buffer);
-  try {
-    execFileSync("tar", ["-xzf", tempTarPath, "-C", cacheDir], {
-      stdio: "ignore"
-    });
-    const extractedPath = join(cacheDir, "cloudflared");
-    if (extractedPath !== binPath && existsSync(extractedPath)) {
-      renameSync(extractedPath, binPath);
-    }
-    if (expectedChecksum) {
-      const extractedBinary = readFileSync$1(binPath);
-      const actualSha256 = sha256Hex(extractedBinary);
-      if (actualSha256 !== expectedChecksum) {
-        throw new UserError(
-          `[cloudflared] SHA256 mismatch for downloaded cloudflared binary.
+__name(maybeAddTraceHeader, "maybeAddTraceHeader");
+function cloneHeaders(headers) {
+  return new Headers(headers);
+}
+__name(cloneHeaders, "cloneHeaders");
 
-Expected: ${expectedChecksum}
-Actual:   ${actualSha256}`,
-          {
-            telemetryMessage: "tunnel cloudflared extracted binary checksum mismatch"
-          }
-        );
-      }
-    }
-  } finally {
-    try {
-      if (existsSync(tempTarPath)) {
-        unlinkSync(tempTarPath);
-      }
-    } catch {
-    }
-  }
+// src/cloudflared.ts
+var import_command_exists = __toESM(require_command_exists2());
+var UPDATE_SERVICE_URL = "https://update.argotunnel.com";
+var CLOUDFLARED_VERSION_PATTERN = /^\d{4}\.\d+\.\d+$/;
+function sha256Hex(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
 }
-__name(downloadAndExtractTarball, "downloadAndExtractTarball");
-async function downloadBinary(response, expectedChecksum, binPath) {
-  const buffer = Buffer.from(await response.arrayBuffer());
-  if (expectedChecksum) {
-    const actualSha256 = sha256Hex(buffer);
-    if (actualSha256 !== expectedChecksum) {
+__name(sha256Hex, "sha256Hex");
+function getGoArch() {
+  const nodeArch = arch();
+  switch (nodeArch) {
+    case "x64":
+      return "amd64";
+    case "arm64":
+      return "arm64";
+    case "arm":
+      return "arm";
+    default:
       throw new UserError(
-        `[cloudflared] SHA256 mismatch for downloaded cloudflared binary.
+        `Unsupported architecture for cloudflared: ${nodeArch}
 
-Expected: ${expectedChecksum}
-Actual:   ${actualSha256}`,
-        { telemetryMessage: "tunnel cloudflared binary checksum mismatch" }
+cloudflared supports: x64 (amd64), arm64, arm
+
+You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        { telemetryMessage: "tunnel cloudflared unsupported architecture" }
       );
-    }
   }
-  writeFileAtomic(binPath, buffer);
 }
-__name(downloadBinary, "downloadBinary");
-async function getCloudflaredPath(options) {
-  const logger = options?.logger;
-  const envPath = getCloudflaredPathFromEnv();
-  if (envPath) {
-    if (!existsSync(envPath)) {
+__name(getGoArch, "getGoArch");
+function getGoOS() {
+  switch (process.platform) {
+    case "darwin":
+      return "darwin";
+    case "linux":
+      return "linux";
+    case "win32":
+      return "windows";
+    default:
       throw new UserError(
-        `CLOUDFLARED_PATH is set to "${envPath}" but the file does not exist.
+        `Unsupported platform for cloudflared: ${process.platform}
 
-Please ensure the path points to a valid cloudflared binary.`,
-        { telemetryMessage: "tunnel cloudflared env path missing" }
+cloudflared supports: darwin (macOS), linux, win32 (Windows)
+
+You can manually install cloudflared and set the CLOUDFLARED_PATH environment variable.
+Download instructions: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+        { telemetryMessage: "tunnel cloudflared unsupported platform" }
       );
-    }
-    logger?.debug(`Using cloudflared from CLOUDFLARED_PATH: ${envPath}`);
-    return envPath;
   }
-  const pathBin = tryGetCloudflaredFromPath({ logger });
-  if (pathBin) {
-    logger?.debug("Using cloudflared from PATH");
-    if (!options?.skipVersionCheck) {
-      await warnIfOutdated(pathBin, { logger });
-    }
-    return pathBin;
+}
+__name(getGoOS, "getGoOS");
+var GITHUB_RELEASE_BASE = "https://github.com/cloudflare/cloudflared/releases/download";
+function getAssetFilename(goOS, goArch) {
+  if (goOS === "windows") {
+    return `cloudflared-${goOS}-${goArch}.exe`;
   }
-  const versionInfo = await getLatestVersionInfo({ logger });
-  const binPath = getCloudflaredBinPath(versionInfo.version);
-  let needsDownload = !isBinaryExecutable(binPath);
-  if (!needsDownload) {
-    try {
-      validateBinary(binPath, { logger });
-      logger?.debug(
-        `Using cached cloudflared ${versionInfo.version}: ${binPath}`
-      );
-      return binPath;
-    } catch (e2) {
-      logger?.debug("Cached cloudflared failed validation; re-downloading", e2);
-      needsDownload = true;
-    }
+  if (goOS === "darwin") {
+    return `cloudflared-${goOS}-${goArch}.tgz`;
   }
-  const shouldDownload = await options?.confirmDownload?.(
-    `cloudflared (${versionInfo.version}) is needed but not installed. Download to ${binPath}?`
-  ) ?? true;
-  if (!shouldDownload) {
-    throw new UserError(
-      `cloudflared is required to run this command.
-
-You can install it manually from:
-https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/
-
-Then either add it to your PATH or set CLOUDFLARED_PATH.`,
-      { telemetryMessage: "tunnel cloudflared download declined" }
+  return `cloudflared-${goOS}-${goArch}`;
+}
+__name(getAssetFilename, "getAssetFilename");
+async function queryUpdateService(goOS, goArch, options) {
+  const { logger } = options ?? {};
+  const url2 = new URL(UPDATE_SERVICE_URL);
+  url2.searchParams.set("os", goOS);
+  url2.searchParams.set("arch", goArch);
+  logger?.debug(`Checking for latest cloudflared: ${url2.toString()}`);
+  let response;
+  try {
+    response = await fetch(url2.toString(), {
+      headers: { "User-Agent": "wrangler" }
+    });
+  } catch (e2) {
+    logger?.debug(
+      `Failed to reach update service: ${e2 instanceof Error ? e2.message : String(e2)}`
     );
+    return null;
   }
-  if (existsSync(binPath)) {
-    const cacheDir = removeCloudflaredCache(versionInfo.version);
-    if (cacheDir) {
-      logger?.log(`Removed cloudflared cache: ${cacheDir}`);
-    }
+  if (!response.ok) {
+    logger?.debug(
+      `Update service returned ${response.status} for ${goOS}/${goArch}`
+    );
+    return null;
+  }
+  let data;
+  try {
+    data = await response.json();
+  } catch (e2) {
+    logger?.debug(
+      `Update service returned non-JSON response: ${e2 instanceof Error ? e2.message : String(e2)}`
+    );
+    return null;
+  }
+  if (typeof data.version === "string" && !CLOUDFLARED_VERSION_PATTERN.test(data.version)) {
+    throw new Error(
+      `[cloudflared] Invalid cloudflared version returned by update service: ${data.version}`
+    );
+  }
+  if (data.error || !data.url || !data.version) {
+    return data.version ? data : null;
+  }
+  return data;
+}
+__name(queryUpdateService, "queryUpdateService");
+async function getLatestVersionInfo(options) {
+  const { logger } = options ?? {};
+  const goOS = getGoOS();
+  const goArch = getGoArch();
+  const primary = await queryUpdateService(goOS, goArch, { logger });
+  if (primary && primary.url && primary.version) {
+    return primary;
   }
-  await downloadCloudflared(versionInfo, binPath, { logger });
-  validateBinary(binPath, { logger });
-  return binPath;
-}
-__name(getCloudflaredPath, "getCloudflaredPath");
-async function spawnCloudflared(args, options) {
-  const logger = options?.logger;
-  const binPath = await getCloudflaredPath({
-    skipVersionCheck: options?.skipVersionCheck,
-    confirmDownload: options?.confirmDownload,
-    logger
-  });
   logger?.debug(
-    `Spawning cloudflared: ${binPath} ${redactCloudflaredArgsForLogging(args).join(" ")}`
+    `Update worker had no result for ${goOS}/${goArch}, falling back to GitHub release URL`
   );
-  const cloudflared = spawn(binPath, args, {
-    stdio: options?.stdio ?? "inherit",
-    env: options?.env ? { ...process.env, ...options.env } : void 0
-  });
-  return cloudflared;
+  const fallback = await queryUpdateService("linux", "amd64", { logger });
+  if (!fallback?.version) {
+    throw new UserError(
+      `[cloudflared] Failed to determine the latest cloudflared version.
+
+The update service did not return results for ${goOS}/${goArch},
+and the fallback query also failed.
+
+You can manually install cloudflared from:
+https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+      { telemetryMessage: "tunnel cloudflared version lookup failed" }
+    );
+  }
+  const version2 = fallback.version;
+  const filename = getAssetFilename(goOS, goArch);
+  const url2 = `${GITHUB_RELEASE_BASE}/${version2}/${filename}`;
+  const compressed = filename.endsWith(".tgz");
+  return {
+    url: url2,
+    version: version2,
+    checksum: "",
+    // no checksum available for fallback URLs
+    compressed,
+    shouldUpdate: true,
+    userMessage: "",
+    error: ""
+  };
 }
-__name(spawnCloudflared, "spawnCloudflared");
-function removeCloudflaredCache(version2) {
-  const cacheDir = version2 ? getCacheDir(version2) : join(getGlobalConfigPath(), "cloudflared");
-  if (existsSync(cacheDir)) {
-    removeDirSync(cacheDir);
-    return cacheDir;
+__name(getLatestVersionInfo, "getLatestVersionInfo");
+function getCacheDir(version2) {
+  return join(getGlobalConfigPath(), "cloudflared", version2);
+}
+__name(getCacheDir, "getCacheDir");
+function getCloudflaredBinPath(version2) {
+  const binName = process.platform === "win32" ? "cloudflared.exe" : "cloudflared";
+  return join(getCacheDir(version2), binName);
+}
+__name(getCloudflaredBinPath, "getCloudflaredBinPath");
+function isBinaryExecutable(binPath) {
+  try {
+    accessSync(binPath, constants.X_OK);
+    return true;
+  } catch {
+    return false;
   }
-  return null;
 }
-__name(removeCloudflaredCache, "removeCloudflaredCache");
+__name(isBinaryExecutable, "isBinaryExecutable");
+function validateBinary(binPath, options) {
+  const { logger } = options ?? {};
+  try {
+    const output = execFileSync(binPath, ["--version"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4,
+      encoding: "utf8"
+    }).trim();
+    logger?.debug(`cloudflared version: ${output}`);
+  } catch {
+    let errorMessage = `[cloudflared] Failed to validate cloudflared binary at ${binPath}
 
-// src/tunnel.ts
-var TUNNEL_STARTUP_TIMEOUT_MS = 3e4;
-var TUNNEL_FORCE_KILL_TIMEOUT_MS = 5e3;
-var DEFAULT_TUNNEL_EXPIRY_MS = 60 * 60 * 1e3;
-var DEFAULT_TUNNEL_EXTENSION_MS = 60 * 60 * 1e3;
-var DEFAULT_TUNNEL_MAX_REMAINING_MS = 3 * 60 * 60 * 1e3;
-var DEFAULT_TUNNEL_REMINDER_INTERVAL_MS = 10 * 60 * 1e3;
-var QUICK_TUNNEL_URL_REGEX = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
-function startTunnel(options) {
-  let disposed = false;
-  let reminderInterval;
-  let expiryTimeout;
-  let expiresAt = 0;
-  let cloudflaredProcess;
-  const logger = options.logger;
-  const timeoutMs = options.timeoutMs ?? TUNNEL_STARTUP_TIMEOUT_MS;
-  const reminderIntervalMs = options.reminderIntervalMs ?? DEFAULT_TUNNEL_REMINDER_INTERVAL_MS;
-  const defaultExpiryMs = options.expiryMs ?? DEFAULT_TUNNEL_EXPIRY_MS;
-  const isNamedTunnel = options.token !== void 0;
-  const timeFormatter = new Intl.DateTimeFormat(void 0, {
-    timeStyle: "short"
-  });
-  const cloudflaredArgs = isNamedTunnel ? ["tunnel", "--no-autoupdate", "run"] : ["tunnel", "--no-autoupdate", "--url", options.origin.href];
-  const cloudflaredPromise = spawnCloudflared(cloudflaredArgs, {
-    stdio: "pipe",
-    env: options.token ? { TUNNEL_TOKEN: options.token } : void 0,
-    skipVersionCheck: true,
-    logger
-  }).then((process4) => {
-    cloudflaredProcess = process4;
-    if (disposed) {
-      terminateCloudflared(process4);
-    }
-    return process4;
-  });
-  const readyPromise = cloudflaredPromise.then((process4) => {
-    if (isNamedTunnel) {
-      return { mode: "named" };
+`;
+    errorMessage += `This usually means:
+`;
+    errorMessage += `  - The binary is corrupted or incomplete
+`;
+    errorMessage += `  - You're missing required system libraries
+`;
+    if (process.platform === "linux") {
+      errorMessage += `
+On Linux, make sure you have the required dependencies:
+`;
+      errorMessage += `  - glibc (GNU C Library)
+`;
+      errorMessage += `  - For Debian/Ubuntu: sudo apt-get install libc6
+`;
     }
-    return waitForQuickTunnelReady(process4, timeoutMs, {
-      logger,
-      origin: options.origin
+    const cacheDir = join(getGlobalConfigPath(), "cloudflared");
+    errorMessage += `
+You can try:
+`;
+    errorMessage += `  1. Deleting the cache directory: rm -rf ${cacheDir}
+`;
+    errorMessage += `  2. Running the command again to re-download
+`;
+    errorMessage += `  3. Manually installing cloudflared: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/
+`;
+    errorMessage += `  4. Setting CLOUDFLARED_PATH to point to your cloudflared binary`;
+    throw new UserError(errorMessage, {
+      telemetryMessage: "tunnel cloudflared validation failed"
     });
-  }).then((result) => {
-    expiresAt = Date.now() + defaultExpiryMs;
-    scheduleExpiryTimeout();
-    scheduleReminder(
-      result.mode === "quick" ? result.publicUrl.origin : void 0
-    );
-    return result;
-  });
-  function disposeTunnel() {
-    disposed = true;
-    clearTunnelTimers();
-    if (cloudflaredProcess) {
-      terminateCloudflared(cloudflaredProcess);
-    }
   }
-  __name(disposeTunnel, "disposeTunnel");
-  function clearTunnelTimers() {
-    if (expiryTimeout) {
-      clearTimeout(expiryTimeout);
-      expiryTimeout = void 0;
+}
+__name(validateBinary, "validateBinary");
+function redactCloudflaredArgsForLogging(args) {
+  const redacted = [...args];
+  for (let i = 0; i < redacted.length; i++) {
+    const arg = redacted[i];
+    if (arg === "--token" && i + 1 < redacted.length) {
+      redacted[i + 1] = "[REDACTED]";
     }
-    if (reminderInterval) {
-      clearInterval(reminderInterval);
-      reminderInterval = void 0;
+    if (arg.startsWith("--token=")) {
+      redacted[i] = "--token=[REDACTED]";
     }
   }
-  __name(clearTunnelTimers, "clearTunnelTimers");
-  function scheduleReminder(publicURL) {
-    if (reminderIntervalMs > 0) {
-      reminderInterval = setInterval(() => {
-        if (disposed) {
-          return;
-        }
-        const remainingMs = expiresAt - Date.now();
-        if (remainingMs <= 0) {
-          return;
-        }
-        logger?.log(
-          `${publicURL ? `Tunnel still open, expires in ${formatTunnelDuration(remainingMs)}: ${publicURL}` : `The tunnel is still open. It expires in ${formatTunnelDuration(remainingMs)}.`}${options.extendHint ? ` ${options.extendHint}` : ""}`
-        );
-      }, reminderIntervalMs);
-      reminderInterval.unref?.();
-    }
+  return redacted;
+}
+__name(redactCloudflaredArgsForLogging, "redactCloudflaredArgsForLogging");
+function tryGetCloudflaredFromPath(options) {
+  const { logger } = options ?? {};
+  if (!(0, import_command_exists.sync)("cloudflared")) {
+    return null;
   }
-  __name(scheduleReminder, "scheduleReminder");
-  function scheduleExpiryTimeout() {
-    if (disposed) {
+  try {
+    validateBinary("cloudflared", { logger });
+    return "cloudflared";
+  } catch (e2) {
+    logger?.debug("cloudflared found in PATH but failed validation", e2);
+    return null;
+  }
+}
+__name(tryGetCloudflaredFromPath, "tryGetCloudflaredFromPath");
+function getInstalledVersion(binPath) {
+  try {
+    const output = execFileSync(binPath, ["--version"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4,
+      encoding: "utf8"
+    });
+    const match = output.match(/(\d+\.\d+\.\d+)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+__name(getInstalledVersion, "getInstalledVersion");
+function isVersionOutdated(installed, latest) {
+  const parse3 = /* @__PURE__ */ __name((v) => v.split(".").map(Number), "parse");
+  const [iYear, iMonth, iPatch] = parse3(installed);
+  const [lYear, lMonth, lPatch] = parse3(latest);
+  if (iYear !== lYear) {
+    return iYear < lYear;
+  }
+  if (iMonth !== lMonth) {
+    return iMonth < lMonth;
+  }
+  return iPatch < lPatch;
+}
+__name(isVersionOutdated, "isVersionOutdated");
+async function warnIfOutdated(binPath, options) {
+  const { logger } = options ?? {};
+  try {
+    const installed = getInstalledVersion(binPath);
+    if (!installed) {
       return;
     }
-    if (expiryTimeout) {
-      clearTimeout(expiryTimeout);
-    }
-    expiryTimeout = setTimeout(
-      () => {
-        if (disposed) {
-          return;
-        }
-        logger?.log("Tunnel expired. Closing tunnel.");
-        disposeTunnel();
-      },
-      Math.max(0, expiresAt - Date.now())
-    );
-    expiryTimeout.unref();
-  }
-  __name(scheduleExpiryTimeout, "scheduleExpiryTimeout");
-  function extendExpiry(ms = DEFAULT_TUNNEL_EXTENSION_MS) {
-    if (disposed || !expiryTimeout || ms <= 0) {
+    const latest = await queryUpdateService(getGoOS(), getGoArch(), { logger }) ?? await queryUpdateService("linux", "amd64", { logger });
+    const latestVersion = latest?.version;
+    if (!latestVersion) {
       return;
     }
-    const now = Date.now();
-    const previousExpiresAt = expiresAt;
-    expiresAt = Math.min(
-      now + DEFAULT_TUNNEL_MAX_REMAINING_MS,
-      Math.max(expiresAt, now) + ms
-    );
-    const extendedByMs = expiresAt - previousExpiresAt;
-    if (extendedByMs < ms) {
-      logger?.log(
-        `Tunnel expiry extended to the ${formatTunnelDuration(DEFAULT_TUNNEL_MAX_REMAINING_MS)} limit. It now expires at ${timeFormatter.format(new Date(expiresAt))}.`
+    if (isVersionOutdated(installed, latestVersion)) {
+      logger?.warn(
+        `Your cloudflared (${installed}) is outdated. Latest version is ${latestVersion}.
+Update: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`
       );
-      scheduleExpiryTimeout();
-      return;
     }
-    logger?.log(
-      `Tunnel expiry extended by ${formatTunnelDuration(extendedByMs)}. It now expires at ${timeFormatter.format(new Date(expiresAt))}.`
-    );
-    scheduleExpiryTimeout();
+  } catch (e2) {
+    logger?.debug("Failed to check cloudflared version", e2);
   }
-  __name(extendExpiry, "extendExpiry");
-  return {
-    ready: /* @__PURE__ */ __name(() => readyPromise, "ready"),
-    isOpen: /* @__PURE__ */ __name(() => !disposed, "isOpen"),
-    dispose: disposeTunnel,
-    extendExpiry
-  };
 }
-__name(startTunnel, "startTunnel");
-function formatTunnelDuration(durationMs) {
-  const totalMinutes = Math.max(1, Math.ceil(durationMs / 6e4));
-  const hours = Math.floor(totalMinutes / 60);
-  const minutes = totalMinutes % 60;
-  if (hours === 0) {
-    return `${minutes}m`;
-  }
-  if (minutes === 0) {
-    return `${hours}h`;
+__name(warnIfOutdated, "warnIfOutdated");
+function writeFileAtomic(filePath, contents) {
+  const dir2 = dirname(filePath);
+  const tmpPath = join(
+    dir2,
+    `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`
+  );
+  try {
+    writeFileSync(tmpPath, contents);
+    renameSync(tmpPath, filePath);
+  } finally {
+    try {
+      if (existsSync(tmpPath)) {
+        unlinkSync(tmpPath);
+      }
+    } catch {
+    }
   }
-  return `${hours}h ${minutes}m`;
 }
-__name(formatTunnelDuration, "formatTunnelDuration");
-function terminateCloudflared(cloudflared) {
-  if (cloudflared.killed) {
-    return;
+__name(writeFileAtomic, "writeFileAtomic");
+async function downloadCloudflared(versionInfo, binPath, options) {
+  const { logger } = options ?? {};
+  const { url: url2, version: version2, checksum, compressed } = versionInfo;
+  logger?.log(`Downloading cloudflared ${version2}...`);
+  logger?.debug(`Download URL: ${url2}`);
+  const cacheDir = dirname(binPath);
+  mkdirSync(cacheDir, { recursive: true });
+  let response;
+  try {
+    response = await fetch(url2, {
+      headers: { "User-Agent": "wrangler" }
+    });
+  } catch (e2) {
+    throw new UserError(
+      `[cloudflared] Failed to download cloudflared from ${url2}
+
+Network error: ${e2 instanceof Error ? e2.message : String(e2)}
+
+Please check your internet connection and try again.
+If you're behind a proxy, make sure it's configured correctly.`,
+      { telemetryMessage: "tunnel cloudflared download network failed" }
+    );
   }
-  cloudflared.unref();
-  cloudflared.kill("SIGTERM");
-  const forceKillTimer = setTimeout(() => {
-    if (!cloudflared.killed) {
-      cloudflared.kill("SIGKILL");
+  if (!response.ok) {
+    throw new UserError(
+      `[cloudflared] Failed to download cloudflared from ${url2}
+
+HTTP ${response.status}: ${response.statusText}
+
+You can manually download cloudflared from:
+https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/`,
+      { telemetryMessage: "tunnel cloudflared download response failed" }
+    );
+  }
+  try {
+    if (compressed) {
+      await downloadAndExtractTarball(response, checksum, binPath, cacheDir);
+    } else {
+      await downloadBinary(response, checksum, binPath);
     }
-  }, TUNNEL_FORCE_KILL_TIMEOUT_MS);
-  forceKillTimer.unref();
+  } catch (e2) {
+    try {
+      if (existsSync(binPath)) {
+        unlinkSync(binPath);
+      }
+    } catch {
+    }
+    if (e2 instanceof UserError) {
+      throw e2;
+    }
+    throw new UserError(
+      `[cloudflared] Failed to save cloudflared binary
+
+Error: ${e2 instanceof Error ? e2.message : String(e2)}
+
+Please ensure you have write permissions to: ${cacheDir}`,
+      { telemetryMessage: "tunnel cloudflared save failed" }
+    );
+  }
+  if (process.platform !== "win32") {
+    chmodSync(binPath, 493);
+  }
+  logger?.log(`cloudflared ${version2} installed`);
+  logger?.debug(`Binary location: ${binPath}`);
 }
-__name(terminateCloudflared, "terminateCloudflared");
-function waitForQuickTunnelReady(cloudflared, timeoutMs, options) {
-  return new Promise((resolve3, reject) => {
-    let resolved = false;
-    let stderrOutput = "";
-    const logger = options?.logger;
-    const origin = options?.origin;
-    const timeoutId = setTimeout(() => {
-      if (!resolved) {
-        resolved = true;
-        terminateCloudflared(cloudflared);
-        reject(
-          createTunnelStartupError(
-            `Timed out waiting for cloudflared to start (${timeoutMs / 1e3}s).`,
-            stderrOutput,
-            origin
-          )
+__name(downloadCloudflared, "downloadCloudflared");
+async function downloadAndExtractTarball(response, expectedChecksum, binPath, cacheDir) {
+  const tempTarPath = join(cacheDir, "cloudflared.tgz");
+  const buffer = Buffer.from(await response.arrayBuffer());
+  writeFileSync(tempTarPath, buffer);
+  try {
+    execFileSync("tar", ["-xzf", tempTarPath, "-C", cacheDir], {
+      stdio: "ignore"
+    });
+    const extractedPath = join(cacheDir, "cloudflared");
+    if (extractedPath !== binPath && existsSync(extractedPath)) {
+      renameSync(extractedPath, binPath);
+    }
+    if (expectedChecksum) {
+      const extractedBinary = readFileSync$1(binPath);
+      const actualSha256 = sha256Hex(extractedBinary);
+      if (actualSha256 !== expectedChecksum) {
+        throw new UserError(
+          `[cloudflared] SHA256 mismatch for downloaded cloudflared binary.
+
+Expected: ${expectedChecksum}
+Actual:   ${actualSha256}`,
+          {
+            telemetryMessage: "tunnel cloudflared extracted binary checksum mismatch"
+          }
         );
       }
-    }, timeoutMs);
-    timeoutId.unref();
-    if (cloudflared.stderr) {
-      cloudflared.stderr.on("data", (data) => {
-        const chunk = data.toString();
-        stderrOutput += chunk;
-        logger?.debug("[cloudflared]", chunk.trimEnd());
-        const match = QUICK_TUNNEL_URL_REGEX.exec(stderrOutput);
-        if (match && !resolved) {
-          resolved = true;
-          clearTimeout(timeoutId);
-          resolve3({ mode: "quick", publicUrl: new URL(match[0]) });
-        }
-      });
     }
-    cloudflared.on("error", (error51) => {
-      if (!resolved) {
-        resolved = true;
-        clearTimeout(timeoutId);
-        reject(new Error(`Failed to start cloudflared: ${error51.message}`));
-      }
-    });
-    cloudflared.on("exit", (code, signal) => {
-      if (!resolved) {
-        resolved = true;
-        clearTimeout(timeoutId);
-        const reason = signal ? `terminated by signal ${signal}` : `exited with code ${code}`;
-        reject(
-          createTunnelStartupError(
-            `cloudflared ${reason} before the tunnel was ready.`,
-            stderrOutput,
-            origin
-          )
-        );
+  } finally {
+    try {
+      if (existsSync(tempTarPath)) {
+        unlinkSync(tempTarPath);
       }
-    });
-  });
-}
-__name(waitForQuickTunnelReady, "waitForQuickTunnelReady");
-function createTunnelStartupError(message, stderrOutput, origin) {
-  const isQuickTunnelRateLimited = stderrOutput.includes(
-    "429 Too Many Requests"
-  );
-  const errorMessage = `${message}
-cloudflared output:
-${stderrOutput || "(no output)"}
-
-The local dev server started at ${origin.href}
-` + (isQuickTunnelRateLimited ? "Cloudflare Quick Tunnel creation was rate limited. Try again in a few minutes, or use a named tunnel if you need more reliable access." : `Check the cloudflared output above for more details, and verify that ${origin.href} is reachable from this machine if this keeps happening.`);
-  if (isQuickTunnelRateLimited) {
-    return new UserError(errorMessage, { telemetryMessage: false });
+    } catch {
+    }
   }
-  return new Error(errorMessage);
 }
-__name(createTunnelStartupError, "createTunnelStartupError");
+__name(downloadAndExtractTarball, "downloadAndExtractTarball");
+async function downloadBinary(response, expectedChecksum, binPath) {
+  const buffer = Buffer.from(await response.arrayBuffer());
+  if (expectedChecksum) {
+    const actualSha256 = sha256Hex(buffer);
+    if (actualSha256 !== expectedChecksum) {
+      throw new UserError(
+        `[cloudflared] SHA256 mismatch for downloaded cloudflared binary.
 
-// src/cfetch/errors.ts
-function buildDetailedError(message, ...extra) {
-  return new ParseError({
-    text: message,
-    notes: extra.map((text) => ({ text })),
-    telemetryMessage: false
-  });
-}
-__name(buildDetailedError, "buildDetailedError");
-function maybeThrowFriendlyError(error51) {
-  if (error51.message === "workers.api.error.email_verification_required") {
-    throw buildDetailedError(
-      "Please verify your account's email address and try again.",
-      "Check your email for a verification link, or login to https://dash.cloudflare.com and request a new one."
-    );
+Expected: ${expectedChecksum}
+Actual:   ${actualSha256}`,
+        { telemetryMessage: "tunnel cloudflared binary checksum mismatch" }
+      );
+    }
   }
+  writeFileAtomic(binPath, buffer);
 }
-__name(maybeThrowFriendlyError, "maybeThrowFriendlyError");
+__name(downloadBinary, "downloadBinary");
+async function getCloudflaredPath(options) {
+  const logger = options?.logger;
+  const envPath = getCloudflaredPathFromEnv();
+  if (envPath) {
+    if (!existsSync(envPath)) {
+      throw new UserError(
+        `CLOUDFLARED_PATH is set to "${envPath}" but the file does not exist.
 
-// src/cfetch/index.ts
-function logHeaders(headers, logger) {
-  const clone2 = cloneHeaders(headers);
-  clone2.delete("Authorization");
-  logger.debugWithSanitization?.(
-    "HEADERS:",
-    JSON.stringify(Object.fromEntries(clone2), null, 2)
-  );
-}
-__name(logHeaders, "logHeaders");
-async function performApiFetchBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
-  assert2(credentials, "credentials are required for performApiFetch");
-  const method = init.method ?? "GET";
-  assert2(
-    resource.startsWith("/"),
-    `CF API fetch - resource path must start with a "/" but got "${resource}"`
-  );
-  const headers = cloneHeaders(new Headers(init.headers));
-  addAuthorizationHeader(headers, credentials);
-  headers.set("User-Agent", userAgent);
-  maybeAddTraceHeader(headers);
-  const queryString = queryParams ? `?${queryParams.toString()}` : "";
-  logger.debug(
-    `-- START CF API REQUEST: ${method} ${getCloudflareApiBaseUrl(complianceConfig)}${resource}`
-  );
-  logger.debugWithSanitization?.("QUERY STRING:", queryString);
-  logHeaders(headers, logger);
-  logger.debugWithSanitization?.("INIT:", JSON.stringify({ ...init }, null, 2));
-  if (init.body instanceof FormData) {
-    logger.debugWithSanitization?.(
-      "BODY:",
-      await new Response(init.body).text(),
-      null,
-      2
-    );
+Please ensure the path points to a valid cloudflared binary.`,
+        { telemetryMessage: "tunnel cloudflared env path missing" }
+      );
+    }
+    logger?.debug(`Using cloudflared from CLOUDFLARED_PATH: ${envPath}`);
+    return envPath;
   }
-  logger.debug("-- END CF API REQUEST");
-  return await fetch(
-    `${getCloudflareApiBaseUrl(complianceConfig)}${resource}${queryString}`,
-    {
-      method,
-      ...init,
-      headers,
-      signal: abortSignal
+  const pathBin = tryGetCloudflaredFromPath({ logger });
+  if (pathBin) {
+    logger?.debug("Using cloudflared from PATH");
+    if (!options?.skipVersionCheck) {
+      await warnIfOutdated(pathBin, { logger });
     }
-  );
-}
-__name(performApiFetchBase, "performApiFetchBase");
-async function fetchInternalBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
-  const method = init.method ?? "GET";
-  const response = await performApiFetchBase(
-    complianceConfig,
-    resource,
-    init,
-    userAgent,
-    logger,
-    queryParams,
-    abortSignal,
-    credentials
-  );
-  const jsonText = await response.text();
-  logger.debug(
-    "-- START CF API RESPONSE:",
-    response.statusText,
-    response.status
-  );
-  logHeaders(response.headers, logger);
-  logger.debugWithSanitization?.("RESPONSE:", jsonText);
-  logger.debug("-- END CF API RESPONSE");
-  const retryAfterMs = parseRetryAfterMs(response.headers);
-  if (!jsonText && (response.status === 204 || response.status === 205)) {
-    return {
-      response: {
-        result: {},
-        success: true,
-        errors: [],
-        messages: []
-      },
-      status: response.status,
-      retryAfterMs
-    };
+    return pathBin;
   }
-  if (isWAFBlockResponse(response.headers)) {
-    throwWAFBlockError(
-      response.headers,
-      method,
-      resource,
-      response.status,
-      response.statusText,
-      retryAfterMs
+  const versionInfo = await getLatestVersionInfo({ logger });
+  const binPath = getCloudflaredBinPath(versionInfo.version);
+  let needsDownload = !isBinaryExecutable(binPath);
+  if (!needsDownload) {
+    try {
+      validateBinary(binPath, { logger });
+      logger?.debug(
+        `Using cached cloudflared ${versionInfo.version}: ${binPath}`
+      );
+      return binPath;
+    } catch (e2) {
+      logger?.debug("Cached cloudflared failed validation; re-downloading", e2);
+      needsDownload = true;
+    }
+  }
+  const shouldDownload = await options?.confirmDownload?.(
+    `cloudflared (${versionInfo.version}) is needed but not installed. Download to ${binPath}?`
+  ) ?? true;
+  if (!shouldDownload) {
+    throw new UserError(
+      `cloudflared is required to run this command.
+
+You can install it manually from:
+https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/
+
+Then either add it to your PATH or set CLOUDFLARED_PATH.`,
+      { telemetryMessage: "tunnel cloudflared download declined" }
     );
   }
-  try {
-    const json2 = parseJSON(jsonText);
-    return { response: json2, status: response.status, retryAfterMs };
-  } catch {
-    const rayId = extractWAFBlockRayId(response.headers);
-    throw new APIError({
-      text: "Received a malformed response from the API",
-      notes: [
-        {
-          text: truncate(jsonText, 100)
-        },
-        {
-          text: `${method} ${resource} -> ${response.status} ${response.statusText}`
-        },
-        ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : []
-      ],
-      status: response.status,
-      retryAfterMs,
-      telemetryMessage: false
-    });
+  if (existsSync(binPath)) {
+    const cacheDir = removeCloudflaredCache(versionInfo.version);
+    if (cacheDir) {
+      logger?.log(`Removed cloudflared cache: ${cacheDir}`);
+    }
+  }
+  await downloadCloudflared(versionInfo, binPath, { logger });
+  validateBinary(binPath, { logger });
+  return binPath;
+}
+__name(getCloudflaredPath, "getCloudflaredPath");
+async function spawnCloudflared(args, options) {
+  const logger = options?.logger;
+  const binPath = await getCloudflaredPath({
+    skipVersionCheck: options?.skipVersionCheck,
+    confirmDownload: options?.confirmDownload,
+    logger
+  });
+  logger?.debug(
+    `Spawning cloudflared: ${binPath} ${redactCloudflaredArgsForLogging(args).join(" ")}`
+  );
+  const cloudflared = spawn(binPath, args, {
+    stdio: options?.stdio ?? "inherit",
+    env: options?.env ? { ...process.env, ...options.env } : void 0
+  });
+  return cloudflared;
+}
+__name(spawnCloudflared, "spawnCloudflared");
+function removeCloudflaredCache(version2) {
+  const cacheDir = version2 ? getCacheDir(version2) : join(getGlobalConfigPath(), "cloudflared");
+  if (existsSync(cacheDir)) {
+    removeDirSync(cacheDir);
+    return cacheDir;
   }
+  return null;
 }
-__name(fetchInternalBase, "fetchInternalBase");
-async function fetchResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, abortSignal, credentials) {
+__name(removeCloudflaredCache, "removeCloudflaredCache");
+
+// src/tunnel.ts
+var TUNNEL_STARTUP_TIMEOUT_MS = 3e4;
+var TUNNEL_API_TIMEOUT_MS = 6e4;
+var TUNNEL_FORCE_KILL_TIMEOUT_MS = 5e3;
+var DEFAULT_TUNNEL_EXPIRY_MS = 60 * 60 * 1e3;
+var DEFAULT_TUNNEL_EXTENSION_MS = 60 * 60 * 1e3;
+var DEFAULT_TUNNEL_MAX_REMAINING_MS = 3 * 60 * 60 * 1e3;
+var DEFAULT_TUNNEL_REMINDER_INTERVAL_MS = 10 * 60 * 1e3;
+var QUICK_TUNNEL_URL_REGEX = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+var LOCAL_TUNNEL_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "127.0.0.1",
+  "::1",
+  "0.0.0.0",
+  "::"
+]);
+async function resolveNamedTunnel(name, origin, options) {
   const {
-    response: json2,
-    status,
-    retryAfterMs
-  } = await fetchInternalBase(
+    accountId,
+    apiToken,
+    complianceRegion,
+    logger,
+    userAgent,
+    abortSignal
+  } = options;
+  const complianceConfig = { compliance_region: complianceRegion };
+  const resource = `/accounts/${accountId}/cfd_tunnel`;
+  const tunnels = await fetchResultBase(
     complianceConfig,
     resource,
-    init,
+    void 0,
     userAgent,
     logger,
-    queryParams,
-    abortSignal,
-    credentials
+    new URLSearchParams({ name, is_deleted: "false" }),
+    createApiAbortSignal(TUNNEL_API_TIMEOUT_MS, abortSignal),
+    apiToken
   );
-  if (json2.success) {
-    return json2.result;
-  } else {
-    throwFetchError(resource, json2, status, retryAfterMs);
+  const tunnel = tunnels.find((item) => item.name === name);
+  if (!tunnel) {
+    throw new UserError(
+      `No Cloudflare Tunnel named "${name}" was found in this account. Use "wrangler tunnel list" to see available tunnels.`,
+      { telemetryMessage: "tunnel resolve named missing tunnel" }
+    );
   }
-}
-__name(fetchResultBase, "fetchResultBase");
-async function fetchListResultBase(complianceConfig, resource, init = {}, userAgent, logger, queryParams, credentials) {
-  const results = [];
-  let getMoreResults = true;
-  let cursor;
-  while (getMoreResults) {
-    if (cursor) {
-      queryParams = new URLSearchParams(queryParams);
-      queryParams.set("cursor", cursor);
-    }
-    const {
-      response: json2,
-      status,
-      retryAfterMs
-    } = await fetchInternalBase(
-      complianceConfig,
-      resource,
-      init,
-      userAgent,
-      logger,
-      queryParams,
-      void 0,
-      credentials
+  const tunnelId = tunnel.id;
+  if (!tunnelId) {
+    throw new FatalError(
+      `Tunnel "${name}" was found but has no ID. This is unexpected.`,
+      { telemetryMessage: "tunnel resolve named missing tunnel id" }
     );
-    if (json2.success) {
-      results.push(...json2.result);
-      if (hasCursor(json2.result_info)) {
-        cursor = json2.result_info?.cursor;
-      } else {
-        getMoreResults = false;
-      }
-    } else {
-      throwFetchError(resource, json2, status, retryAfterMs);
-    }
   }
-  return results;
-}
-__name(fetchListResultBase, "fetchListResultBase");
-function truncate(text, maxLength) {
-  const { length } = text;
-  if (length <= maxLength) {
-    return text;
+  const configuration = await fetchResultBase(
+    complianceConfig,
+    `${resource}/${tunnelId}/configurations`,
+    void 0,
+    userAgent,
+    logger,
+    void 0,
+    createApiAbortSignal(TUNNEL_API_TIMEOUT_MS, abortSignal),
+    apiToken
+  );
+  const ingress = configuration.config?.ingress ?? [];
+  const hostnames = getMatchingIngressHostnames(origin, ingress);
+  if (hostnames.length === 0) {
+    throw new UserError(
+      createMissingIngressMessage(name, origin, {
+        dashboardUrl: `https://dash.cloudflare.com/${accountId}/tunnels/${tunnelId}`,
+        ingress
+      }),
+      { telemetryMessage: "tunnel resolve named ingress mismatch" }
+    );
   }
-  return `${text.substring(0, maxLength)}... (length = ${length})`;
-}
-__name(truncate, "truncate");
-function isWAFBlockResponse(headers) {
-  return headers.get("cf-mitigated") === "challenge";
+  const token = await fetchResultBase(
+    complianceConfig,
+    `${resource}/${tunnelId}/token`,
+    void 0,
+    userAgent,
+    logger,
+    void 0,
+    createApiAbortSignal(TUNNEL_API_TIMEOUT_MS, abortSignal),
+    apiToken
+  );
+  return { hostnames, token: String(token) };
 }
-__name(isWAFBlockResponse, "isWAFBlockResponse");
-function parseRetryAfterValue(retryAfter) {
-  if (!retryAfter) {
-    return void 0;
+__name(resolveNamedTunnel, "resolveNamedTunnel");
+function getMatchingIngressHostnames(origin, ingressConfig) {
+  const hostnames = /* @__PURE__ */ new Set();
+  const originUrl = normalizeURL(origin);
+  for (const ingress of ingressConfig) {
+    try {
+      const serviceUrl = normalizeURL(ingress.service);
+      if (ingress.hostname && serviceUrl.toString() === originUrl.toString()) {
+        hostnames.add(ingress.hostname);
+      }
+    } catch {
+    }
   }
-  if (/^\d+$/.test(retryAfter.trim())) {
-    return Number(retryAfter) * 1e3;
+  return [...hostnames];
+}
+__name(getMatchingIngressHostnames, "getMatchingIngressHostnames");
+function normalizeURL(url2) {
+  const normalizedUrl = new URL(url2);
+  if (LOCAL_TUNNEL_HOSTNAMES.has(normalizedUrl.hostname)) {
+    normalizedUrl.hostname = "localhost";
   }
-  const retryAfterDate = new Date(retryAfter);
-  if (!Number.isNaN(retryAfterDate.getTime())) {
-    return Math.max(0, retryAfterDate.getTime() - Date.now());
+  if (!normalizedUrl.port) {
+    switch (normalizedUrl.protocol) {
+      case "http:":
+        normalizedUrl.port = "80";
+        break;
+      case "https:":
+        normalizedUrl.port = "443";
+        break;
+    }
   }
-  return void 0;
-}
-__name(parseRetryAfterValue, "parseRetryAfterValue");
-function parseRetryAfterMs(headers) {
-  return parseRetryAfterValue(headers.get("Retry-After"));
-}
-__name(parseRetryAfterMs, "parseRetryAfterMs");
-function extractWAFBlockRayId(headers) {
-  return headers.get("cf-ray") ?? void 0;
-}
-__name(extractWAFBlockRayId, "extractWAFBlockRayId");
-function extractAccountTag(resource) {
-  const re = new RegExp("/accounts/([a-zA-Z0-9]+)/?");
-  const matches = re.exec(resource);
-  return matches?.[1];
+  return normalizedUrl;
 }
-__name(extractAccountTag, "extractAccountTag");
-function hasMorePages(result_info) {
-  const page = result_info?.page;
-  const per_page = result_info?.per_page;
-  const total = result_info?.total_count;
-  return page !== void 0 && per_page !== void 0 && total !== void 0 && page * per_page < total;
+__name(normalizeURL, "normalizeURL");
+function createApiAbortSignal(timeoutMs, abortSignal) {
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  return abortSignal ? AbortSignal.any([abortSignal, timeoutSignal]) : timeoutSignal;
 }
-__name(hasMorePages, "hasMorePages");
-function renderError(err, level = 0) {
-  const indent = "  ".repeat(level);
-  const message = err.message ?? "";
-  const chainedMessages = "error_chain" in err ? err.error_chain?.map(
-    (chainedError) => `
-
-${indent}- ${renderError(chainedError, level + 1)}`
-  ).join("\n") ?? "" : "";
-  return (err.code ? `${message} [code: ${err.code}]` : message) + (err.documentation_url ? `
-${indent}To learn more about this error, visit: ${err.documentation_url}` : "") + chainedMessages;
+__name(createApiAbortSignal, "createApiAbortSignal");
+function createMissingIngressMessage(name, origin, {
+  dashboardUrl,
+  ingress
+}) {
+  if (ingress.length === 0) {
+    return [
+      `Tunnel "${name}" has no routes configured.`,
+      "",
+      `Add a route for ${origin} in the Cloudflare dashboard:`,
+      dashboardUrl,
+      ""
+    ].join("\n");
+  }
+  return [
+    `Tunnel "${name}" has no route for ${origin}`,
+    "",
+    "Resolved routes:",
+    ...ingress.map(
+      ({ hostname: hostname3, service }) => `  - ${hostname3 ?? "(no hostname)"} -> ${service}`
+    ),
+    "",
+    "Update your local server settings or the tunnel routes in the Cloudflare dashboard:",
+    dashboardUrl,
+    ""
+  ].join("\n");
 }
-__name(renderError, "renderError");
-function addAuthorizationHeader(headers, auth, overrideExisting = false) {
-  if (!headers.has("Authorization") || overrideExisting) {
-    if ("apiToken" in auth) {
-      const authorizationHeader = `Bearer ${auth.apiToken}`;
-      validateAuthorizationHeaderValue(authorizationHeader);
-      headers.set("Authorization", authorizationHeader);
-    } else {
-      headers.set("X-Auth-Key", auth.authKey);
-      headers.set("X-Auth-Email", auth.authEmail);
+__name(createMissingIngressMessage, "createMissingIngressMessage");
+function startTunnel(options) {
+  let disposed = false;
+  let reminderInterval;
+  let expiryTimeout;
+  let expiresAt = 0;
+  let cloudflaredProcess;
+  const logger = options.logger;
+  const timeoutMs = options.timeoutMs ?? TUNNEL_STARTUP_TIMEOUT_MS;
+  const reminderIntervalMs = options.reminderIntervalMs ?? DEFAULT_TUNNEL_REMINDER_INTERVAL_MS;
+  const defaultExpiryMs = options.expiryMs ?? DEFAULT_TUNNEL_EXPIRY_MS;
+  const isNamedTunnel = options.token !== void 0;
+  const timeFormatter = new Intl.DateTimeFormat(void 0, {
+    timeStyle: "short"
+  });
+  const cloudflaredArgs = isNamedTunnel ? ["tunnel", "--no-autoupdate", "run"] : ["tunnel", "--no-autoupdate", "--url", options.origin.href];
+  const cloudflaredPromise = spawnCloudflared(cloudflaredArgs, {
+    stdio: "pipe",
+    env: options.token ? { TUNNEL_TOKEN: options.token } : void 0,
+    skipVersionCheck: true,
+    logger
+  }).then((process4) => {
+    cloudflaredProcess = process4;
+    if (disposed) {
+      terminateCloudflared(process4);
+    }
+    return process4;
+  });
+  const readyPromise = cloudflaredPromise.then((process4) => {
+    if (isNamedTunnel) {
+      return { mode: "named" };
+    }
+    return waitForQuickTunnelReady(process4, timeoutMs, {
+      logger,
+      origin: options.origin
+    });
+  }).then((result) => {
+    expiresAt = Date.now() + defaultExpiryMs;
+    scheduleExpiryTimeout();
+    scheduleReminder(
+      result.mode === "quick" ? result.publicUrl.origin : void 0
+    );
+    return result;
+  });
+  function disposeTunnel() {
+    disposed = true;
+    clearTunnelTimers();
+    if (cloudflaredProcess) {
+      terminateCloudflared(cloudflaredProcess);
     }
   }
-}
-__name(addAuthorizationHeader, "addAuthorizationHeader");
-function validateAuthorizationHeaderValue(value) {
-  for (const character of value) {
-    const codePoint = character.codePointAt(0);
-    if (codePoint === void 0 || codePoint > 255) {
-      throw new UserError(
-        `The configured Cloudflare API token contains a character that cannot be used in an HTTP Authorization header: ${formatAuthorizationHeaderCharacter(character, codePoint)}. Recreate or copy the token again, making sure it does not include characters such as ellipses.`,
-        {
-          telemetryMessage: "cfetch auth invalid authorization header"
+  __name(disposeTunnel, "disposeTunnel");
+  function clearTunnelTimers() {
+    if (expiryTimeout) {
+      clearTimeout(expiryTimeout);
+      expiryTimeout = void 0;
+    }
+    if (reminderInterval) {
+      clearInterval(reminderInterval);
+      reminderInterval = void 0;
+    }
+  }
+  __name(clearTunnelTimers, "clearTunnelTimers");
+  function scheduleReminder(publicURL) {
+    if (reminderIntervalMs > 0) {
+      reminderInterval = setInterval(() => {
+        if (disposed) {
+          return;
+        }
+        const remainingMs = expiresAt - Date.now();
+        if (remainingMs <= 0) {
+          return;
+        }
+        logger?.log(
+          `${publicURL ? `Tunnel still open, expires in ${formatTunnelDuration(remainingMs)}: ${publicURL}` : `The tunnel is still open. It expires in ${formatTunnelDuration(remainingMs)}.`}${options.extendHint ? ` ${options.extendHint}` : ""}`
+        );
+      }, reminderIntervalMs);
+      reminderInterval.unref?.();
+    }
+  }
+  __name(scheduleReminder, "scheduleReminder");
+  function scheduleExpiryTimeout() {
+    if (disposed) {
+      return;
+    }
+    if (expiryTimeout) {
+      clearTimeout(expiryTimeout);
+    }
+    expiryTimeout = setTimeout(
+      () => {
+        if (disposed) {
+          return;
         }
+        logger?.log("Tunnel expired. Closing tunnel.");
+        disposeTunnel();
+      },
+      Math.max(0, expiresAt - Date.now())
+    );
+    expiryTimeout.unref();
+  }
+  __name(scheduleExpiryTimeout, "scheduleExpiryTimeout");
+  function extendExpiry(ms = DEFAULT_TUNNEL_EXTENSION_MS) {
+    if (disposed || !expiryTimeout || ms <= 0) {
+      return;
+    }
+    const now = Date.now();
+    const previousExpiresAt = expiresAt;
+    expiresAt = Math.min(
+      now + DEFAULT_TUNNEL_MAX_REMAINING_MS,
+      Math.max(expiresAt, now) + ms
+    );
+    const extendedByMs = expiresAt - previousExpiresAt;
+    if (extendedByMs < ms) {
+      logger?.log(
+        `Tunnel expiry extended to the ${formatTunnelDuration(DEFAULT_TUNNEL_MAX_REMAINING_MS)} limit. It now expires at ${timeFormatter.format(new Date(expiresAt))}.`
       );
+      scheduleExpiryTimeout();
+      return;
     }
+    logger?.log(
+      `Tunnel expiry extended by ${formatTunnelDuration(extendedByMs)}. It now expires at ${timeFormatter.format(new Date(expiresAt))}.`
+    );
+    scheduleExpiryTimeout();
   }
+  __name(extendExpiry, "extendExpiry");
+  return {
+    ready: /* @__PURE__ */ __name(() => readyPromise, "ready"),
+    isOpen: /* @__PURE__ */ __name(() => !disposed, "isOpen"),
+    dispose: disposeTunnel,
+    extendExpiry
+  };
 }
-__name(validateAuthorizationHeaderValue, "validateAuthorizationHeaderValue");
-function formatAuthorizationHeaderCharacter(character, codePoint) {
-  if (codePoint === void 0) {
-    return '"\\u{unknown}"';
+__name(startTunnel, "startTunnel");
+function formatTunnelDuration(durationMs) {
+  const totalMinutes = Math.max(1, Math.ceil(durationMs / 6e4));
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  if (hours === 0) {
+    return `${minutes}m`;
   }
-  const codePointLabel = `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
-  const characterLabel = isPrintableCharacter(character) ? `"${character}"` : `"${escapeCharacter(character)}"`;
-  return `${characterLabel} (${codePointLabel})`;
-}
-__name(formatAuthorizationHeaderCharacter, "formatAuthorizationHeaderCharacter");
-function isPrintableCharacter(character) {
-  return !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(character);
+  if (minutes === 0) {
+    return `${hours}h`;
+  }
+  return `${hours}h ${minutes}m`;
 }
-__name(isPrintableCharacter, "isPrintableCharacter");
-function escapeCharacter(character) {
-  return Array.from(character).map((c) => {
-    const codePoint = c.codePointAt(0);
-    if (codePoint === void 0) {
-      return "";
+__name(formatTunnelDuration, "formatTunnelDuration");
+function terminateCloudflared(cloudflared) {
+  if (cloudflared.killed) {
+    return;
+  }
+  cloudflared.unref();
+  cloudflared.kill("SIGTERM");
+  const forceKillTimer = setTimeout(() => {
+    if (!cloudflared.killed) {
+      cloudflared.kill("SIGKILL");
     }
-    return codePoint <= 65535 ? `\\u${codePoint.toString(16).toUpperCase().padStart(4, "0")}` : `\\u{${codePoint.toString(16).toUpperCase()}}`;
-  }).join("");
+  }, TUNNEL_FORCE_KILL_TIMEOUT_MS);
+  forceKillTimer.unref();
 }
-__name(escapeCharacter, "escapeCharacter");
-function throwFetchError(resource, response, status, retryAfterMs) {
-  const errors = response.errors ?? [];
-  for (const error52 of errors) {
-    maybeThrowFriendlyError(error52);
-  }
-  const notes = [
-    ...errors.map((err) => ({ text: renderError(err) })),
-    ...response.messages?.map((msg) => ({
-      text: typeof msg === "string" ? msg : msg.message ?? String(msg)
-    })) ?? []
-  ];
-  if (notes.length === 0) {
-    const raw = response;
-    const fallbackMessage = typeof raw.error === "string" ? `${raw.error}${raw.code ? ` [code: ${raw.code}]` : ""}` : void 0;
-    if (fallbackMessage) {
-      notes.push({ text: fallbackMessage });
+__name(terminateCloudflared, "terminateCloudflared");
+function waitForQuickTunnelReady(cloudflared, timeoutMs, options) {
+  return new Promise((resolve3, reject) => {
+    let resolved = false;
+    let stderrOutput = "";
+    const logger = options?.logger;
+    const origin = options?.origin;
+    const timeoutId = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        terminateCloudflared(cloudflared);
+        reject(
+          createTunnelStartupError(
+            `Timed out waiting for cloudflared to start (${timeoutMs / 1e3}s).`,
+            stderrOutput,
+            origin
+          )
+        );
+      }
+    }, timeoutMs);
+    timeoutId.unref();
+    if (cloudflared.stderr) {
+      cloudflared.stderr.on("data", (data) => {
+        const chunk = data.toString();
+        stderrOutput += chunk;
+        logger?.debug("[cloudflared]", chunk.trimEnd());
+        const match = QUICK_TUNNEL_URL_REGEX.exec(stderrOutput);
+        if (match && !resolved) {
+          resolved = true;
+          clearTimeout(timeoutId);
+          resolve3({ mode: "quick", publicUrl: new URL(match[0]) });
+        }
+      });
     }
-  }
-  if (retryAfterMs !== void 0) {
-    notes.push({
-      text: `The API responded with a "Retry-After" header indicating you should wait ${Math.ceil(retryAfterMs / 1e3)} second(s) before retrying.`
+    cloudflared.on("error", (error51) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeoutId);
+        reject(new Error(`Failed to start cloudflared: ${error51.message}`));
+      }
     });
-  }
-  const error51 = new APIError({
-    text: `A request to the Cloudflare API (${resource}) failed.`,
-    notes,
-    status,
-    // hoist the parsed `Retry-After` header (if any) so consumers such as
-    // `retryOnAPIFailure()` can back off for the amount of time the API
-    // asked us to wait, e.g. when rate limited (HTTP 429).
-    retryAfterMs,
-    telemetryMessage: false
-  });
-  const code = errors[0]?.code;
-  if (code) {
-    error51.code = code;
-  }
-  const meta3 = errors[0]?.meta;
-  if (meta3) {
-    error51.meta = meta3;
-  }
-  error51.accountTag = extractAccountTag(resource);
-  throw error51;
-}
-__name(throwFetchError, "throwFetchError");
-function throwWAFBlockError(headers, method, resource, status, statusText, retryAfterMs) {
-  const rayId = extractWAFBlockRayId(headers);
-  throw new APIError({
-    text: "The Cloudflare API responded with a WAF block page instead of the expected JSON response",
-    notes: [
-      {
-        text: "Cloudflare's firewall (WAF) blocked this API request. This is usually a false positive."
-      },
-      ...rayId ? [{ text: `Cloudflare Ray ID: ${rayId}` }] : [],
-      {
-        text: rayId ? "If the issue persists, please open a Cloudflare Support ticket and include the Ray ID above." : "If the issue persists, please open a Cloudflare Support ticket. You can find the Cloudflare Ray ID on the block page in your browser."
-      },
-      {
-        text: `${method} ${resource} -> ${status} ${statusText}`
+    cloudflared.on("exit", (code, signal) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeoutId);
+        const reason = signal ? `terminated by signal ${signal}` : `exited with code ${code}`;
+        reject(
+          createTunnelStartupError(
+            `cloudflared ${reason} before the tunnel was ready.`,
+            stderrOutput,
+            origin
+          )
+        );
       }
-    ],
-    status,
-    retryAfterMs,
-    telemetryMessage: false
-  });
-}
-__name(throwWAFBlockError, "throwWAFBlockError");
-async function fetchKVGetValueBase(complianceConfig, accountId, namespaceId, key, userAgent, logger, credentials) {
-  const headers = new Headers();
-  addAuthorizationHeader(headers, credentials);
-  headers.set("User-Agent", userAgent);
-  maybeAddTraceHeader(headers);
-  const resource = `${getCloudflareApiBaseUrl(complianceConfig)}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${key}`;
-  logger.debug(`-- START CF API REQUEST: GET ${resource}`);
-  logger.debug("-- END CF API REQUEST");
-  const response = await fetch(resource, {
-    method: "GET",
-    headers
+    });
   });
-  if (response.ok) {
-    return await response.arrayBuffer();
-  } else {
-    throw new Error(
-      `Failed to fetch ${resource} - ${response.status}: ${response.statusText}`
-    );
-  }
-}
-__name(fetchKVGetValueBase, "fetchKVGetValueBase");
-function hasCursor(result_info) {
-  const cursor = result_info?.cursor;
-  return cursor !== void 0 && cursor !== null && cursor !== "";
 }
-__name(hasCursor, "hasCursor");
-function maybeAddTraceHeader(headers) {
-  const traceHeader = getTraceHeader();
-  if (traceHeader) {
-    headers.set("Cf-Trace-Id", traceHeader);
+__name(waitForQuickTunnelReady, "waitForQuickTunnelReady");
+function createTunnelStartupError(message, stderrOutput, origin) {
+  const isQuickTunnelRateLimited = stderrOutput.includes(
+    "429 Too Many Requests"
+  );
+  const errorMessage = `${message}
+cloudflared output:
+${stderrOutput || "(no output)"}
+
+The local dev server started at ${origin.href}
+` + (isQuickTunnelRateLimited ? "Cloudflare Quick Tunnel creation was rate limited. Try again in a few minutes, or use a named tunnel if you need more reliable access." : `Check the cloudflared output above for more details, and verify that ${origin.href} is reachable from this machine if this keeps happening.`);
+  if (isQuickTunnelRateLimited) {
+    return new UserError(errorMessage, { telemetryMessage: false });
   }
+  return new Error(errorMessage);
 }
-__name(maybeAddTraceHeader, "maybeAddTraceHeader");
-function cloneHeaders(headers) {
-  return new Headers(headers);
-}
-__name(cloneHeaders, "cloneHeaders");
+__name(createTunnelStartupError, "createTunnelStartupError");
 
 // src/update-check.ts
 var import_update_check = __toESM(require_update_check());
@@ -26277,4 +26680,4 @@ safe-buffer/index.js:
   (*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> *)
 */
 
-export { ARTIFACTS_EVENT_TYPES, BunPackageManager, Diagnostics, LOGGER_LEVELS, NpmPackageManager, NubPackageManager, PatchConfigError, PnpmPackageManager, YarnPackageManager, addAuthorizationHeader, bucketFormatMessage, checkWorkerNameValidity, clearOutputFilePath, convertConfigToBindings, createConfigCache, defaultWranglerConfig, experimental_patchConfig, extractAccountTag, extractBindingsOfType, extractWAFBlockRayId, fetchInternalBase, fetchKVGetValueBase, fetchLatestNpmVersion, fetchListResultBase, fetchResultBase, formatTime, friendlyBindingNames2 as friendlyBindingNames, getBindingLocalSupport, getBindingTypeFriendlyName, getBindings, getHostFromRoute, getHostFromUrl, getInstalledPackageVersion, getPackagePath, getWorkerName, getWorkerNameFromProject, getWranglerHiddenDirPath, getWranglerTmpDir, getZoneFromRoute, hasCursor, hasMorePages, hasProperty, isCI, isDockerfile, isInteractive, isNonInteractiveOrCI, isOptionalProperty, isPackageInstalled, isPagesConfig, isRequiredProperty, isUnsafeBindingType, isValidR2BucketName, isWAFBlockResponse, maybeAddTraceHeader, normalizeAndValidateConfig, openInBrowser, parseRetryAfterMs, parseRetryAfterValue, performApiFetchBase, printBindings, renderError, retryOnAPIFailure, spawnCloudflared, startTunnel, sweepStaleWranglerTmpDirs, throwFetchError, toUrlPath, toValidWorkerName, truncate, validateBindingRemoteSetting, validatePagesConfig, writeOutput };
+export { ARTIFACTS_EVENT_TYPES, BunPackageManager, Diagnostics, LOGGER_LEVELS, NpmPackageManager, NubPackageManager, PatchConfigError, PnpmPackageManager, YarnPackageManager, addAuthorizationHeader, bucketFormatMessage, checkWorkerNameValidity, clearOutputFilePath, convertConfigToBindings, createConfigCache, defaultWranglerConfig, experimental_patchConfig, extractAccountTag, extractBindingsOfType, extractWAFBlockRayId, fetchInternalBase, fetchKVGetValueBase, fetchLatestNpmVersion, fetchListResultBase, fetchResultBase, formatTime, friendlyBindingNames2 as friendlyBindingNames, getBindingLocalSupport, getBindingTypeFriendlyName, getBindings, getHostFromRoute, getHostFromUrl, getInstalledPackageVersion, getPackagePath, getWorkerName, getWorkerNameFromProject, getWranglerHiddenDirPath, getWranglerTmpDir, getZoneFromRoute, hasCursor, hasMorePages, hasProperty, isCI, isDockerfile, isInteractive, isNonInteractiveOrCI, isOptionalProperty, isPackageInstalled, isPagesConfig, isRequiredProperty, isUnsafeBindingType, isValidR2BucketName, isWAFBlockResponse, maybeAddTraceHeader, normalizeAndValidateConfig, openInBrowser, parseRetryAfterMs, parseRetryAfterValue, performApiFetchBase, printBindings, renderError, resolveNamedTunnel, retryOnAPIFailure, spawnCloudflared, startTunnel, sweepStaleWranglerTmpDirs, throwFetchError, toUrlPath, toValidWorkerName, truncate, validateBindingRemoteSetting, validatePagesConfig, writeOutput };