@ponharu/pkgflare 0.0.0

package/dist/cli.js

@@ -0,0 +1,528 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { randomBytes } from "crypto";
+import { open } from "fs/promises";
+import { relative as relative2, resolve as resolve3 } from "path";
+
+// src/cli/deploy.ts
+import { copyFile, mkdir, readFile, readdir, writeFile } from "fs/promises";
+import { dirname as dirname2, join as join2, relative, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/cli/config-loader.ts
+import { access } from "fs/promises";
+import { resolve } from "path";
+import { pathToFileURL } from "url";
+import { createJiti } from "jiti";
+
+// src/config.ts
+var workerNamePattern = /^[a-z](?:[a-z0-9-]{0,52}[a-z0-9])?$/;
+var accountIdPattern = /^[a-f0-9]{32}$/;
+var scopePattern = /^@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;
+var bindingPattern = /^[A-Z][A-Z0-9_]*$/;
+var hostnamePattern = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var reservedBindings = /* @__PURE__ */ new Set(["PKGFLARE_DB", "PKGFLARE_BUCKET", "PKGFLARE_CONFIG"]);
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeConfig(value) {
+  if (!isObject(value)) throw new Error("configuration must be an object");
+  const { name, scopes: scopeValues, accountId, hostname, auth } = value;
+  if (typeof name !== "string" || !workerNamePattern.test(name)) {
+    throw new Error("name must be a lowercase Cloudflare resource name of at most 54 characters");
+  }
+  if (accountId !== void 0 && (typeof accountId !== "string" || !accountIdPattern.test(accountId))) {
+    throw new Error("accountId must be a 32-character lowercase hexadecimal Cloudflare account ID");
+  }
+  if (!Array.isArray(scopeValues) || scopeValues.length === 0 || scopeValues.some((scope) => typeof scope !== "string")) {
+    throw new Error("at least one package scope is required");
+  }
+  const scopes = [...new Set(scopeValues)];
+  for (const scope of scopes) {
+    if (!scopePattern.test(scope)) {
+      throw new Error(`invalid package scope: ${scope}`);
+    }
+  }
+  if (hostname !== void 0 && (typeof hostname !== "string" || !hostnamePattern.test(hostname))) {
+    throw new Error("hostname must be a valid DNS hostname without a scheme or path");
+  }
+  if (!isObject(auth) || auth.provider !== "secrets") {
+    throw new Error("unsupported authentication provider");
+  }
+  if (!Array.isArray(auth.tokens) || auth.tokens.length === 0) {
+    throw new Error("at least one authentication token binding is required");
+  }
+  const seenBindings = /* @__PURE__ */ new Set();
+  const tokens = auth.tokens.map((tokenValue) => {
+    if (!isObject(tokenValue) || typeof tokenValue.binding !== "string") {
+      throw new Error("authentication token binding must be an object with a binding name");
+    }
+    const { binding, permissions: permissionValues } = tokenValue;
+    if (!bindingPattern.test(binding)) {
+      throw new Error(`invalid secret binding: ${binding}`);
+    }
+    if (reservedBindings.has(binding)) {
+      throw new Error(`secret binding is reserved by pkgflare: ${binding}`);
+    }
+    if (seenBindings.has(binding)) {
+      throw new Error(`duplicate secret binding: ${binding}`);
+    }
+    seenBindings.add(binding);
+    if (!Array.isArray(permissionValues) || permissionValues.length === 0 || permissionValues.some((permission) => permission !== "read" && permission !== "publish")) {
+      throw new Error(`invalid permissions for ${binding}`);
+    }
+    const permissions = [...new Set(permissionValues)];
+    return { binding, permissions };
+  });
+  return {
+    name,
+    scopes,
+    ...accountId === void 0 ? {} : { accountId },
+    ...hostname === void 0 ? {} : { hostname },
+    auth: { provider: "secrets", tokens }
+  };
+}
+
+// src/cli/config-loader.ts
+var defaultConfigFile = "pkgflare.config.ts";
+async function loadConfig(cwd, configFile = defaultConfigFile) {
+  const path = resolve(cwd, configFile);
+  try {
+    await access(path);
+  } catch {
+    throw new Error(`configuration file not found: ${configFile}`);
+  }
+  const jiti = createJiti(pathToFileURL(import.meta.url).href, {
+    interopDefault: true,
+    moduleCache: false
+  });
+  const imported = await jiti.import(path, { default: true });
+  return normalizeConfig(imported);
+}
+
+// src/cli/runner.ts
+import { spawn } from "child_process";
+import { createRequire } from "module";
+import { dirname, join } from "path";
+function wranglerEntry() {
+  const require2 = createRequire(import.meta.url);
+  return join(dirname(require2.resolve("wrangler/package.json")), "bin", "wrangler.js");
+}
+function createWranglerRunner(cwd) {
+  return async (arguments_, options = {}) => {
+    const result = await new Promise((resolve4, reject) => {
+      const child = spawn(process.execPath, [wranglerEntry(), ...arguments_], {
+        cwd,
+        env: process.env,
+        shell: false,
+        stdio: ["inherit", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      child.stdout.setEncoding("utf8");
+      child.stderr.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        stdout += chunk;
+        if (!options.silent) process.stdout.write(chunk);
+      });
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+        if (!options.silent) process.stderr.write(chunk);
+      });
+      child.once("error", reject);
+      child.once("close", (code) => resolve4({ exitCode: code ?? 1, stdout, stderr }));
+    });
+    if (result.exitCode !== 0 && !options.allowFailure) {
+      const operation = arguments_.slice(0, 3).join(" ");
+      throw new Error(
+        `Wrangler command ${JSON.stringify(operation)} exited with status ${String(result.exitCode)}`
+      );
+    }
+    return result;
+  };
+}
+
+// src/cli/deploy.ts
+var stateDirectoryName = ".pkgflare";
+var stateFileName = "wrangler.json";
+var ownershipFileName = "ownership.json";
+var d1Binding = "PKGFLARE_DB";
+var r2Binding = "PKGFLARE_BUCKET";
+function packageRoot() {
+  return dirname2(fileURLToPath(import.meta.url));
+}
+function stateFor(config, accountId, previous) {
+  if (previous?.account_id !== void 0 && previous.account_id !== accountId) {
+    throw new Error("authenticated Cloudflare account does not match the deployment state");
+  }
+  const state = {
+    $schema: "https://raw.githubusercontent.com/cloudflare/workers-sdk/main/packages/wrangler/config-schema.json",
+    account_id: accountId,
+    name: config.name,
+    main: "runtime/worker.js",
+    compatibility_date: "2026-08-01",
+    workers_dev: config.hostname === void 0,
+    vars: { PKGFLARE_CONFIG: JSON.stringify(config) },
+    d1_databases: previous?.d1_databases ?? [],
+    r2_buckets: previous?.r2_buckets ?? []
+  };
+  if (config.hostname !== void 0) {
+    state.routes = [{ pattern: config.hostname, custom_domain: true }];
+  }
+  return state;
+}
+async function readState(path, config) {
+  let contents;
+  try {
+    contents = await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  const state = JSON.parse(contents);
+  if (state.name !== config.name) {
+    throw new Error(
+      `existing deployment state belongs to ${state.name}; remove ${stateDirectoryName} only after verifying the remote resources`
+    );
+  }
+  return state;
+}
+async function writeState(path, state) {
+  await writeFile(path, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+}
+async function readWorkerOwnership(path, workerName, accountId) {
+  let contents;
+  try {
+    contents = await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  const ownership = JSON.parse(contents);
+  if (ownership.worker_name !== workerName || ownership.account_id !== accountId) {
+    throw new Error("deployment ownership state does not match the configured Worker and account");
+  }
+  return true;
+}
+async function writeWorkerOwnership(path, workerName, accountId) {
+  const ownership = { account_id: accountId, worker_name: workerName };
+  await writeFile(path, `${JSON.stringify(ownership, null, 2)}
+`, "utf8");
+}
+async function copyRuntimeFiles(stateDirectory, root) {
+  const runtimeDirectory = join2(stateDirectory, "runtime");
+  const migrationsDirectory = join2(stateDirectory, "migrations");
+  await Promise.all([
+    mkdir(runtimeDirectory, { recursive: true }),
+    mkdir(migrationsDirectory, { recursive: true })
+  ]);
+  const sourceMigrations = resolve2(root, "..", "migrations");
+  const migrationFiles = (await readdir(sourceMigrations, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name);
+  migrationFiles.sort();
+  if (migrationFiles.length === 0) throw new Error("pkgflare package contains no D1 migrations");
+  await Promise.all([
+    copyFile(join2(root, "worker.js"), join2(runtimeDirectory, "worker.js")),
+    copyFile(join2(root, "worker.js.map"), join2(runtimeDirectory, "worker.js.map")),
+    ...migrationFiles.map(
+      (file) => copyFile(join2(sourceMigrations, file), join2(migrationsDirectory, file))
+    )
+  ]);
+  await writeFile(join2(stateDirectory, ".gitignore"), "runtime/\nmigrations/\n", {
+    flag: "wx"
+  }).catch((error) => {
+    if (error.code !== "EEXIST") throw error;
+  });
+}
+function configArguments(stateFile, cwd) {
+  return ["--config", relative(cwd, stateFile)];
+}
+async function recoverD1(runner, databaseName, configArgs) {
+  const result = await runner(["d1", "list", "--json", ...configArgs], { silent: true });
+  const entries = JSON.parse(result.stdout);
+  const matches = entries.filter(
+    (entry) => entry.name === databaseName && typeof entry.uuid === "string"
+  );
+  if (matches.length > 1) throw new Error(`multiple D1 databases are named ${databaseName}`);
+  const match = matches[0];
+  return match === void 0 ? null : {
+    binding: d1Binding,
+    database_name: databaseName,
+    database_id: match.uuid,
+    migrations_dir: "migrations"
+  };
+}
+async function recoverR2(runner, bucketName, configArgs) {
+  const result = await runner(["r2", "bucket", "info", bucketName, "--json", ...configArgs], {
+    silent: true,
+    allowFailure: true
+  });
+  if (result.exitCode === 0) return { binding: r2Binding, bucket_name: bucketName };
+  if (/not found|does not exist|10006/i.test(result.stderr)) return null;
+  throw new Error(`unable to inspect the ${bucketName} R2 bucket with the current credentials`);
+}
+function accountsFromWhoami(value) {
+  if (typeof value !== "object" || value === null)
+    throw new Error("Wrangler returned invalid account information");
+  const accounts = value.accounts;
+  if (!Array.isArray(accounts)) throw new Error("Wrangler returned invalid account information");
+  return accounts.flatMap((account) => {
+    if (typeof account !== "object" || account === null || !("id" in account) || typeof account.id !== "string") {
+      return [];
+    }
+    return [
+      {
+        id: account.id,
+        ...typeof account.name === "string" ? { name: account.name } : {}
+      }
+    ];
+  });
+}
+async function resolveAccountId(runner, configuredAccountId) {
+  if (configuredAccountId !== void 0) return configuredAccountId;
+  const result = await runner(["whoami", "--json"], { silent: true });
+  const accounts = accountsFromWhoami(JSON.parse(result.stdout));
+  if (accounts.length !== 1) {
+    throw new Error("accountId is required when Wrangler credentials can access multiple accounts");
+  }
+  const account = accounts[0];
+  if (account === void 0)
+    throw new Error("Wrangler credentials do not provide a Cloudflare account");
+  return account.id;
+}
+async function workerExists(runner, workerName, configArgs) {
+  const result = await runner(["versions", "list", "--name", workerName, "--json", ...configArgs], {
+    silent: true,
+    allowFailure: true
+  });
+  if (result.exitCode === 0) return true;
+  if (/not found|does not exist|10007/i.test(result.stderr)) return false;
+  throw new Error(`unable to inspect the ${workerName} Worker with the current credentials`);
+}
+async function verifyWorkerOwnership(workerName, configArgs, runner, adoptExisting) {
+  const exists = await workerExists(runner, workerName, configArgs);
+  if (exists && !adoptExisting) {
+    throw new Error(
+      `the ${workerName} Worker already exists; verify it, then rerun with --adopt-existing`
+    );
+  }
+  return exists;
+}
+async function ensureResources(state, stateFile, cwd, runner, adoptExisting) {
+  const d1Name = `${state.name}-metadata`;
+  const r2Name = `${state.name}-packages`;
+  const configArgs = configArguments(stateFile, cwd);
+  const configuredD1 = state.d1_databases.filter((database) => database.binding === d1Binding);
+  const configuredR2 = state.r2_buckets.filter((bucket) => bucket.binding === r2Binding);
+  const selectedD1 = configuredD1[0];
+  const selectedR2 = configuredR2[0];
+  if (configuredD1.length > 1 || selectedD1 !== void 0 && selectedD1.database_name !== d1Name) {
+    throw new Error(`${d1Binding} must reference the ${d1Name} D1 database`);
+  }
+  if (configuredR2.length > 1 || selectedR2 !== void 0 && selectedR2.bucket_name !== r2Name) {
+    throw new Error(`${r2Binding} must reference the ${r2Name} R2 bucket`);
+  }
+  if (configuredD1.length === 0) {
+    const recovered = await recoverD1(runner, d1Name, configArgs);
+    if (recovered !== null) {
+      if (!adoptExisting) {
+        throw new Error(
+          `the ${d1Name} D1 database already exists; verify it, then rerun with --adopt-existing`
+        );
+      }
+      state.d1_databases.push(recovered);
+      await writeState(stateFile, state);
+    } else {
+      await runner([
+        "d1",
+        "create",
+        d1Name,
+        "--binding",
+        d1Binding,
+        "--update-config",
+        ...configArgs
+      ]);
+      state = JSON.parse(await readFile(stateFile, "utf8"));
+    }
+  }
+  if (configuredR2.length === 0) {
+    const recovered = await recoverR2(runner, r2Name, configArgs);
+    if (recovered !== null) {
+      if (!adoptExisting) {
+        throw new Error(
+          `the ${r2Name} R2 bucket already exists; verify it, then rerun with --adopt-existing`
+        );
+      }
+      state.r2_buckets.push(recovered);
+      await writeState(stateFile, state);
+    } else {
+      await runner([
+        "r2",
+        "bucket",
+        "create",
+        r2Name,
+        "--binding",
+        r2Binding,
+        "--update-config",
+        ...configArgs
+      ]);
+      state = JSON.parse(await readFile(stateFile, "utf8"));
+    }
+  }
+  state.d1_databases = state.d1_databases.map(
+    (database) => database.binding === d1Binding ? { ...database, migrations_dir: "migrations" } : database
+  );
+  await writeState(stateFile, state);
+  return state;
+}
+function deploymentUrl(output, config) {
+  if (config.hostname !== void 0) return `https://${config.hostname}`;
+  return output.match(/https:\/\/[^\s]+\.workers\.dev\b/)?.[0] ?? null;
+}
+async function deploy(options) {
+  const cwd = resolve2(options.cwd);
+  const config = await loadConfig(cwd, options.configFile);
+  const stateDirectory = join2(cwd, stateDirectoryName);
+  const stateFile = join2(stateDirectory, stateFileName);
+  const ownershipFile = join2(stateDirectory, ownershipFileName);
+  await mkdir(stateDirectory, { recursive: true });
+  const previous = await readState(stateFile, config);
+  const runner = options.runner ?? createWranglerRunner(cwd);
+  const environmentAccountId = process.env.CLOUDFLARE_ACCOUNT_ID;
+  const configuredAccountId = config.accountId ?? previous?.account_id;
+  if (environmentAccountId !== void 0 && configuredAccountId !== void 0 && environmentAccountId !== configuredAccountId) {
+    throw new Error("CLOUDFLARE_ACCOUNT_ID does not match the configured deployment account");
+  }
+  const accountId = await resolveAccountId(runner, configuredAccountId ?? environmentAccountId);
+  const ownsWorker = await readWorkerOwnership(ownershipFile, config.name, accountId);
+  let state = stateFor(config, accountId, previous);
+  await writeState(stateFile, state);
+  await copyRuntimeFiles(stateDirectory, options.assetsDirectory ?? packageRoot());
+  state = await ensureResources(state, stateFile, cwd, runner, options.adoptExisting ?? false);
+  const configArgs = configArguments(stateFile, cwd);
+  await runner(["d1", "migrations", "apply", d1Binding, "--remote", ...configArgs]);
+  const adoptedWorker = ownsWorker ? false : await verifyWorkerOwnership(state.name, configArgs, runner, options.adoptExisting ?? false);
+  if (adoptedWorker) await writeWorkerOwnership(ownershipFile, state.name, accountId);
+  const deployArguments = ["deploy", "--no-bundle", ...configArgs];
+  if (options.secretsFile !== void 0) {
+    deployArguments.push("--secrets-file", options.secretsFile);
+  }
+  const deployed = await runner(deployArguments);
+  if (!ownsWorker && !adoptedWorker)
+    await writeWorkerOwnership(ownershipFile, state.name, accountId);
+  return {
+    registryUrl: deploymentUrl(deployed.stdout, config),
+    stateFile,
+    secretBindings: config.auth.tokens.map((token) => token.binding),
+    scopes: config.scopes
+  };
+}
+
+// src/cli.ts
+function valueAfter(arguments_, flag) {
+  const index = arguments_.indexOf(flag);
+  if (index === -1) return void 0;
+  const value = arguments_[index + 1];
+  if (value === void 0 || value.startsWith("--")) throw new Error(`${flag} requires a value`);
+  return value;
+}
+function help() {
+  process.stdout.write(
+    `pkgflare
+
+Usage:
+  pkgflare deploy [--config <path>] [--secrets-file <path>] [--adopt-existing]
+  pkgflare init
+  pkgflare token generate
+`
+  );
+}
+async function init(cwd) {
+  const path = resolve3(cwd, "pkgflare.config.ts");
+  const file = await open(path, "wx").catch((error) => {
+    if (error.code === "EEXIST")
+      throw new Error("pkgflare.config.ts already exists");
+    throw error;
+  });
+  await file.writeFile(
+    `import { defineConfig } from "@ponharu/pkgflare";
+
+export default defineConfig({
+  name: "acme-registry",
+  scopes: ["@acme"],
+  auth: {
+    provider: "secrets",
+    tokens: [
+      { binding: "PKGFLARE_READ_TOKEN", permissions: ["read"] },
+      { binding: "PKGFLARE_PUBLISH_TOKEN", permissions: ["publish"] },
+    ],
+  },
+});
+`
+  );
+  await file.close();
+  process.stdout.write("Created pkgflare.config.ts\n");
+}
+async function main(arguments_) {
+  const [command, subcommand] = arguments_;
+  if (command === void 0 || command === "--help" || command === "-h") {
+    help();
+    return;
+  }
+  if (command === "deploy") {
+    const configFile = valueAfter(arguments_, "--config");
+    const secretsFile = valueAfter(arguments_, "--secrets-file");
+    const adoptExisting = arguments_.includes("--adopt-existing");
+    const result = await deploy({
+      cwd: process.cwd(),
+      ...configFile === void 0 ? {} : { configFile },
+      ...secretsFile === void 0 ? {} : { secretsFile },
+      adoptExisting
+    });
+    const statePath = relative2(process.cwd(), result.stateFile);
+    process.stdout.write(`
+Deployment state: ${statePath}
+`);
+    if (result.registryUrl !== null) {
+      process.stdout.write(`Registry: ${result.registryUrl}
+`);
+    }
+    process.stdout.write("\nRegister each token secret if it was not supplied during deploy:\n");
+    for (const binding of result.secretBindings) {
+      process.stdout.write(`  npx wrangler secret put ${binding} --config ${statePath}
+`);
+    }
+    if (result.registryUrl !== null) {
+      const host = new URL(result.registryUrl).host;
+      process.stdout.write("\n.npmrc:\n");
+      for (const scope of result.scopes) {
+        process.stdout.write(`  ${scope}:registry=${result.registryUrl}
+`);
+      }
+      process.stdout.write(`  //${host}/:_authToken=\${NPM_TOKEN}
+`);
+    }
+    return;
+  }
+  if (command === "init") {
+    await init(process.cwd());
+    return;
+  }
+  if (command === "token" && subcommand === "generate") {
+    let binary = "";
+    for (const byte of randomBytes(32)) binary += String.fromCharCode(byte);
+    const token = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    process.stdout.write(`${token}
+`);
+    return;
+  }
+  throw new Error(`unknown command: ${arguments_.join(" ")}`);
+}
+main(process.argv.slice(2)).catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`pkgflare: ${message}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts","../src/cli/deploy.ts","../src/cli/config-loader.ts","../src/config.ts","../src/cli/runner.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { open } from \"node:fs/promises\";\nimport { relative, resolve } from \"node:path\";\nimport { deploy } from \"./cli/deploy.js\";\n\nfunction valueAfter(arguments_: readonly string[], flag: string): string | undefined {\n  const index = arguments_.indexOf(flag);\n  if (index === -1) return undefined;\n  const value = arguments_[index + 1];\n  if (value === undefined || value.startsWith(\"--\")) throw new Error(`${flag} requires a value`);\n  return value;\n}\n\nfunction help(): void {\n  process.stdout.write(\n    `pkgflare\\n\\nUsage:\\n  pkgflare deploy [--config <path>] [--secrets-file <path>] [--adopt-existing]\\n  pkgflare init\\n  pkgflare token generate\\n`,\n  );\n}\n\nasync function init(cwd: string): Promise<void> {\n  const path = resolve(cwd, \"pkgflare.config.ts\");\n  const file = await open(path, \"wx\").catch((error: unknown) => {\n    if ((error as NodeJS.ErrnoException).code === \"EEXIST\")\n      throw new Error(\"pkgflare.config.ts already exists\");\n    throw error;\n  });\n  await file.writeFile(\n    `import { defineConfig } from \"@ponharu/pkgflare\";\\n\\nexport default defineConfig({\\n  name: \"acme-registry\",\\n  scopes: [\"@acme\"],\\n  auth: {\\n    provider: \"secrets\",\\n    tokens: [\\n      { binding: \"PKGFLARE_READ_TOKEN\", permissions: [\"read\"] },\\n      { binding: \"PKGFLARE_PUBLISH_TOKEN\", permissions: [\"publish\"] },\\n    ],\\n  },\\n});\\n`,\n  );\n  await file.close();\n  process.stdout.write(\"Created pkgflare.config.ts\\n\");\n}\n\nasync function main(arguments_: string[]): Promise<void> {\n  const [command, subcommand] = arguments_;\n  if (command === undefined || command === \"--help\" || command === \"-h\") {\n    help();\n    return;\n  }\n  if (command === \"deploy\") {\n    const configFile = valueAfter(arguments_, \"--config\");\n    const secretsFile = valueAfter(arguments_, \"--secrets-file\");\n    const adoptExisting = arguments_.includes(\"--adopt-existing\");\n    const result = await deploy({\n      cwd: process.cwd(),\n      ...(configFile === undefined ? {} : { configFile }),\n      ...(secretsFile === undefined ? {} : { secretsFile }),\n      adoptExisting,\n    });\n    const statePath = relative(process.cwd(), result.stateFile);\n    process.stdout.write(`\\nDeployment state: ${statePath}\\n`);\n    if (result.registryUrl !== null) {\n      process.stdout.write(`Registry: ${result.registryUrl}\\n`);\n    }\n    process.stdout.write(\"\\nRegister each token secret if it was not supplied during deploy:\\n\");\n    for (const binding of result.secretBindings) {\n      process.stdout.write(`  npx wrangler secret put ${binding} --config ${statePath}\\n`);\n    }\n    if (result.registryUrl !== null) {\n      const host = new URL(result.registryUrl).host;\n      process.stdout.write(\"\\n.npmrc:\\n\");\n      for (const scope of result.scopes) {\n        process.stdout.write(`  ${scope}:registry=${result.registryUrl}\\n`);\n      }\n      process.stdout.write(`  //${host}/:_authToken=\\${NPM_TOKEN}\\n`);\n    }\n    return;\n  }\n  if (command === \"init\") {\n    await init(process.cwd());\n    return;\n  }\n  if (command === \"token\" && subcommand === \"generate\") {\n    let binary = \"\";\n    for (const byte of randomBytes(32)) binary += String.fromCharCode(byte);\n    const token = btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n    process.stdout.write(`${token}\\n`);\n    return;\n  }\n  throw new Error(`unknown command: ${arguments_.join(\" \")}`);\n}\n\nmain(process.argv.slice(2)).catch((error: unknown) => {\n  const message = error instanceof Error ? error.message : String(error);\n  process.stderr.write(`pkgflare: ${message}\\n`);\n  process.exitCode = 1;\n});\n","import { copyFile, mkdir, readFile, readdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { NormalizedConfig } from \"../config.js\";\nimport { loadConfig } from \"./config-loader.js\";\nimport { createWranglerRunner, type WranglerRunner } from \"./runner.js\";\n\nconst stateDirectoryName = \".pkgflare\";\nconst stateFileName = \"wrangler.json\";\nconst ownershipFileName = \"ownership.json\";\nconst d1Binding = \"PKGFLARE_DB\";\nconst r2Binding = \"PKGFLARE_BUCKET\";\n\ninterface D1Binding {\n  binding: string;\n  database_name: string;\n  database_id: string;\n  migrations_dir?: string;\n}\n\ninterface R2Binding {\n  binding: string;\n  bucket_name: string;\n}\n\ninterface WranglerState {\n  $schema: string;\n  account_id?: string;\n  name: string;\n  main: string;\n  compatibility_date: string;\n  workers_dev: boolean;\n  routes?: Array<{ pattern: string; custom_domain: true }>;\n  vars: { PKGFLARE_CONFIG: string };\n  d1_databases: D1Binding[];\n  r2_buckets: R2Binding[];\n}\n\ninterface D1ListEntry {\n  name?: unknown;\n  uuid?: unknown;\n}\n\ninterface WhoamiResult {\n  loggedIn?: unknown;\n  accounts?: unknown;\n}\n\ninterface AccountEntry {\n  id: string;\n  name?: string;\n}\n\ninterface OwnershipState {\n  account_id: string;\n  worker_name: string;\n}\n\nexport interface DeployOptions {\n  cwd: string;\n  configFile?: string;\n  secretsFile?: string;\n  adoptExisting?: boolean;\n  runner?: WranglerRunner;\n  assetsDirectory?: string;\n}\n\nexport interface DeployResult {\n  registryUrl: string | null;\n  stateFile: string;\n  secretBindings: string[];\n  scopes: string[];\n}\n\nfunction packageRoot(): string {\n  return dirname(fileURLToPath(import.meta.url));\n}\n\nfunction stateFor(\n  config: NormalizedConfig,\n  accountId: string,\n  previous?: WranglerState,\n): WranglerState {\n  if (previous?.account_id !== undefined && previous.account_id !== accountId) {\n    throw new Error(\"authenticated Cloudflare account does not match the deployment state\");\n  }\n  const state: WranglerState = {\n    $schema:\n      \"https://raw.githubusercontent.com/cloudflare/workers-sdk/main/packages/wrangler/config-schema.json\",\n    account_id: accountId,\n    name: config.name,\n    main: \"runtime/worker.js\",\n    compatibility_date: \"2026-08-01\",\n    workers_dev: config.hostname === undefined,\n    vars: { PKGFLARE_CONFIG: JSON.stringify(config) },\n    d1_databases: previous?.d1_databases ?? [],\n    r2_buckets: previous?.r2_buckets ?? [],\n  };\n  if (config.hostname !== undefined) {\n    state.routes = [{ pattern: config.hostname, custom_domain: true }];\n  }\n  return state;\n}\n\nasync function readState(\n  path: string,\n  config: NormalizedConfig,\n): Promise<WranglerState | undefined> {\n  let contents: string;\n  try {\n    contents = await readFile(path, \"utf8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw error;\n  }\n  const state = JSON.parse(contents) as WranglerState;\n  if (state.name !== config.name) {\n    throw new Error(\n      `existing deployment state belongs to ${state.name}; remove ${stateDirectoryName} only after verifying the remote resources`,\n    );\n  }\n  return state;\n}\n\nasync function writeState(path: string, state: WranglerState): Promise<void> {\n  await writeFile(path, `${JSON.stringify(state, null, 2)}\\n`, \"utf8\");\n}\n\nasync function readWorkerOwnership(\n  path: string,\n  workerName: string,\n  accountId: string,\n): Promise<boolean> {\n  let contents: string;\n  try {\n    contents = await readFile(path, \"utf8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw error;\n  }\n  const ownership = JSON.parse(contents) as Partial<OwnershipState>;\n  if (ownership.worker_name !== workerName || ownership.account_id !== accountId) {\n    throw new Error(\"deployment ownership state does not match the configured Worker and account\");\n  }\n  return true;\n}\n\nasync function writeWorkerOwnership(\n  path: string,\n  workerName: string,\n  accountId: string,\n): Promise<void> {\n  const ownership: OwnershipState = { account_id: accountId, worker_name: workerName };\n  await writeFile(path, `${JSON.stringify(ownership, null, 2)}\\n`, \"utf8\");\n}\n\nasync function copyRuntimeFiles(stateDirectory: string, root: string): Promise<void> {\n  const runtimeDirectory = join(stateDirectory, \"runtime\");\n  const migrationsDirectory = join(stateDirectory, \"migrations\");\n  await Promise.all([\n    mkdir(runtimeDirectory, { recursive: true }),\n    mkdir(migrationsDirectory, { recursive: true }),\n  ]);\n  const sourceMigrations = resolve(root, \"..\", \"migrations\");\n  const migrationFiles = (await readdir(sourceMigrations, { withFileTypes: true }))\n    .filter((entry) => entry.isFile() && entry.name.endsWith(\".sql\"))\n    .map((entry) => entry.name);\n  // oxlint-disable-next-line unicorn/no-array-sort -- this array has just been created locally\n  migrationFiles.sort();\n  if (migrationFiles.length === 0) throw new Error(\"pkgflare package contains no D1 migrations\");\n  await Promise.all([\n    copyFile(join(root, \"worker.js\"), join(runtimeDirectory, \"worker.js\")),\n    copyFile(join(root, \"worker.js.map\"), join(runtimeDirectory, \"worker.js.map\")),\n    ...migrationFiles.map((file) =>\n      copyFile(join(sourceMigrations, file), join(migrationsDirectory, file)),\n    ),\n  ]);\n  await writeFile(join(stateDirectory, \".gitignore\"), \"runtime/\\nmigrations/\\n\", {\n    flag: \"wx\",\n  }).catch((error: unknown) => {\n    if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n  });\n}\n\nfunction configArguments(stateFile: string, cwd: string): string[] {\n  return [\"--config\", relative(cwd, stateFile)];\n}\n\nasync function recoverD1(\n  runner: WranglerRunner,\n  databaseName: string,\n  configArgs: readonly string[],\n): Promise<D1Binding | null> {\n  const result = await runner([\"d1\", \"list\", \"--json\", ...configArgs], { silent: true });\n  const entries = JSON.parse(result.stdout) as D1ListEntry[];\n  const matches = entries.filter(\n    (entry) => entry.name === databaseName && typeof entry.uuid === \"string\",\n  );\n  if (matches.length > 1) throw new Error(`multiple D1 databases are named ${databaseName}`);\n  const match = matches[0];\n  return match === undefined\n    ? null\n    : {\n        binding: d1Binding,\n        database_name: databaseName,\n        database_id: match.uuid as string,\n        migrations_dir: \"migrations\",\n      };\n}\n\nasync function recoverR2(\n  runner: WranglerRunner,\n  bucketName: string,\n  configArgs: readonly string[],\n): Promise<R2Binding | null> {\n  const result = await runner([\"r2\", \"bucket\", \"info\", bucketName, \"--json\", ...configArgs], {\n    silent: true,\n    allowFailure: true,\n  });\n  if (result.exitCode === 0) return { binding: r2Binding, bucket_name: bucketName };\n  if (/not found|does not exist|10006/i.test(result.stderr)) return null;\n  throw new Error(`unable to inspect the ${bucketName} R2 bucket with the current credentials`);\n}\n\nfunction accountsFromWhoami(value: unknown): AccountEntry[] {\n  if (typeof value !== \"object\" || value === null)\n    throw new Error(\"Wrangler returned invalid account information\");\n  const accounts = (value as WhoamiResult).accounts;\n  if (!Array.isArray(accounts)) throw new Error(\"Wrangler returned invalid account information\");\n  return accounts.flatMap((account) => {\n    if (\n      typeof account !== \"object\" ||\n      account === null ||\n      !(\"id\" in account) ||\n      typeof account.id !== \"string\"\n    ) {\n      return [];\n    }\n    return [\n      {\n        id: account.id,\n        ...(typeof (account as { name?: unknown }).name === \"string\"\n          ? { name: (account as { name: string }).name }\n          : {}),\n      },\n    ];\n  });\n}\n\nasync function resolveAccountId(\n  runner: WranglerRunner,\n  configuredAccountId: string | undefined,\n): Promise<string> {\n  if (configuredAccountId !== undefined) return configuredAccountId;\n  const result = await runner([\"whoami\", \"--json\"], { silent: true });\n  const accounts = accountsFromWhoami(JSON.parse(result.stdout) as unknown);\n  if (accounts.length !== 1) {\n    throw new Error(\"accountId is required when Wrangler credentials can access multiple accounts\");\n  }\n  const account = accounts[0];\n  if (account === undefined)\n    throw new Error(\"Wrangler credentials do not provide a Cloudflare account\");\n  return account.id;\n}\n\nasync function workerExists(\n  runner: WranglerRunner,\n  workerName: string,\n  configArgs: readonly string[],\n): Promise<boolean> {\n  const result = await runner([\"versions\", \"list\", \"--name\", workerName, \"--json\", ...configArgs], {\n    silent: true,\n    allowFailure: true,\n  });\n  if (result.exitCode === 0) return true;\n  if (/not found|does not exist|10007/i.test(result.stderr)) return false;\n  throw new Error(`unable to inspect the ${workerName} Worker with the current credentials`);\n}\n\nasync function verifyWorkerOwnership(\n  workerName: string,\n  configArgs: readonly string[],\n  runner: WranglerRunner,\n  adoptExisting: boolean,\n): Promise<boolean> {\n  const exists = await workerExists(runner, workerName, configArgs);\n  if (exists && !adoptExisting) {\n    throw new Error(\n      `the ${workerName} Worker already exists; verify it, then rerun with --adopt-existing`,\n    );\n  }\n  return exists;\n}\n\nasync function ensureResources(\n  state: WranglerState,\n  stateFile: string,\n  cwd: string,\n  runner: WranglerRunner,\n  adoptExisting: boolean,\n): Promise<WranglerState> {\n  const d1Name = `${state.name}-metadata`;\n  const r2Name = `${state.name}-packages`;\n  const configArgs = configArguments(stateFile, cwd);\n  const configuredD1 = state.d1_databases.filter((database) => database.binding === d1Binding);\n  const configuredR2 = state.r2_buckets.filter((bucket) => bucket.binding === r2Binding);\n  const selectedD1 = configuredD1[0];\n  const selectedR2 = configuredR2[0];\n  if (\n    configuredD1.length > 1 ||\n    (selectedD1 !== undefined && selectedD1.database_name !== d1Name)\n  ) {\n    throw new Error(`${d1Binding} must reference the ${d1Name} D1 database`);\n  }\n  if (configuredR2.length > 1 || (selectedR2 !== undefined && selectedR2.bucket_name !== r2Name)) {\n    throw new Error(`${r2Binding} must reference the ${r2Name} R2 bucket`);\n  }\n\n  if (configuredD1.length === 0) {\n    const recovered = await recoverD1(runner, d1Name, configArgs);\n    if (recovered !== null) {\n      if (!adoptExisting) {\n        throw new Error(\n          `the ${d1Name} D1 database already exists; verify it, then rerun with --adopt-existing`,\n        );\n      }\n      state.d1_databases.push(recovered);\n      await writeState(stateFile, state);\n    } else {\n      await runner([\n        \"d1\",\n        \"create\",\n        d1Name,\n        \"--binding\",\n        d1Binding,\n        \"--update-config\",\n        ...configArgs,\n      ]);\n      state = JSON.parse(await readFile(stateFile, \"utf8\")) as WranglerState;\n    }\n  }\n\n  if (configuredR2.length === 0) {\n    const recovered = await recoverR2(runner, r2Name, configArgs);\n    if (recovered !== null) {\n      if (!adoptExisting) {\n        throw new Error(\n          `the ${r2Name} R2 bucket already exists; verify it, then rerun with --adopt-existing`,\n        );\n      }\n      state.r2_buckets.push(recovered);\n      await writeState(stateFile, state);\n    } else {\n      await runner([\n        \"r2\",\n        \"bucket\",\n        \"create\",\n        r2Name,\n        \"--binding\",\n        r2Binding,\n        \"--update-config\",\n        ...configArgs,\n      ]);\n      state = JSON.parse(await readFile(stateFile, \"utf8\")) as WranglerState;\n    }\n  }\n\n  state.d1_databases = state.d1_databases.map((database) =>\n    database.binding === d1Binding ? { ...database, migrations_dir: \"migrations\" } : database,\n  );\n  await writeState(stateFile, state);\n  return state;\n}\n\nfunction deploymentUrl(output: string, config: NormalizedConfig): string | null {\n  if (config.hostname !== undefined) return `https://${config.hostname}`;\n  return output.match(/https:\\/\\/[^\\s]+\\.workers\\.dev\\b/)?.[0] ?? null;\n}\n\nexport async function deploy(options: DeployOptions): Promise<DeployResult> {\n  const cwd = resolve(options.cwd);\n  const config = await loadConfig(cwd, options.configFile);\n  const stateDirectory = join(cwd, stateDirectoryName);\n  const stateFile = join(stateDirectory, stateFileName);\n  const ownershipFile = join(stateDirectory, ownershipFileName);\n  await mkdir(stateDirectory, { recursive: true });\n\n  const previous = await readState(stateFile, config);\n  const runner = options.runner ?? createWranglerRunner(cwd);\n  const environmentAccountId = process.env.CLOUDFLARE_ACCOUNT_ID;\n  const configuredAccountId = config.accountId ?? previous?.account_id;\n  if (\n    environmentAccountId !== undefined &&\n    configuredAccountId !== undefined &&\n    environmentAccountId !== configuredAccountId\n  ) {\n    throw new Error(\"CLOUDFLARE_ACCOUNT_ID does not match the configured deployment account\");\n  }\n  const accountId = await resolveAccountId(runner, configuredAccountId ?? environmentAccountId);\n  const ownsWorker = await readWorkerOwnership(ownershipFile, config.name, accountId);\n  let state = stateFor(config, accountId, previous);\n  await writeState(stateFile, state);\n  await copyRuntimeFiles(stateDirectory, options.assetsDirectory ?? packageRoot());\n\n  state = await ensureResources(state, stateFile, cwd, runner, options.adoptExisting ?? false);\n  const configArgs = configArguments(stateFile, cwd);\n  await runner([\"d1\", \"migrations\", \"apply\", d1Binding, \"--remote\", ...configArgs]);\n\n  const adoptedWorker = ownsWorker\n    ? false\n    : await verifyWorkerOwnership(state.name, configArgs, runner, options.adoptExisting ?? false);\n  if (adoptedWorker) await writeWorkerOwnership(ownershipFile, state.name, accountId);\n\n  const deployArguments = [\"deploy\", \"--no-bundle\", ...configArgs];\n  if (options.secretsFile !== undefined) {\n    deployArguments.push(\"--secrets-file\", options.secretsFile);\n  }\n  const deployed = await runner(deployArguments);\n  if (!ownsWorker && !adoptedWorker)\n    await writeWorkerOwnership(ownershipFile, state.name, accountId);\n  return {\n    registryUrl: deploymentUrl(deployed.stdout, config),\n    stateFile,\n    secretBindings: config.auth.tokens.map((token) => token.binding),\n    scopes: config.scopes,\n  };\n}\n","import { access } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { createJiti } from \"jiti\";\nimport { normalizeConfig, type NormalizedConfig } from \"../config.js\";\n\nexport const defaultConfigFile = \"pkgflare.config.ts\";\n\nexport async function loadConfig(\n  cwd: string,\n  configFile = defaultConfigFile,\n): Promise<NormalizedConfig> {\n  const path = resolve(cwd, configFile);\n  try {\n    await access(path);\n  } catch {\n    throw new Error(`configuration file not found: ${configFile}`);\n  }\n\n  const jiti = createJiti(pathToFileURL(import.meta.url).href, {\n    interopDefault: true,\n    moduleCache: false,\n  });\n  const imported = await jiti.import(path, { default: true });\n  return normalizeConfig(imported);\n}\n","export type Permission = \"read\" | \"publish\";\n\nexport interface SecretTokenConfig {\n  binding: string;\n  permissions: readonly Permission[];\n}\n\nexport interface SecretsAuthConfig {\n  provider: \"secrets\";\n  tokens: readonly SecretTokenConfig[];\n}\n\nexport interface PkgflareConfig {\n  name: string;\n  scopes: readonly string[];\n  accountId?: string;\n  hostname?: string;\n  auth: SecretsAuthConfig;\n}\n\nexport interface NormalizedConfig {\n  name: string;\n  scopes: string[];\n  accountId?: string;\n  hostname?: string;\n  auth: {\n    provider: \"secrets\";\n    tokens: Array<{\n      binding: string;\n      permissions: Permission[];\n    }>;\n  };\n}\n\nconst workerNamePattern = /^[a-z](?:[a-z0-9-]{0,52}[a-z0-9])?$/;\nconst accountIdPattern = /^[a-f0-9]{32}$/;\nconst scopePattern = /^@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;\nconst bindingPattern = /^[A-Z][A-Z0-9_]*$/;\nconst hostnamePattern =\n  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;\nconst reservedBindings = new Set([\"PKGFLARE_DB\", \"PKGFLARE_BUCKET\", \"PKGFLARE_CONFIG\"]);\n\nexport function defineConfig(config: PkgflareConfig): PkgflareConfig {\n  return config;\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nexport function normalizeConfig(value: unknown): NormalizedConfig {\n  if (!isObject(value)) throw new Error(\"configuration must be an object\");\n  const { name, scopes: scopeValues, accountId, hostname, auth } = value;\n  if (typeof name !== \"string\" || !workerNamePattern.test(name)) {\n    throw new Error(\"name must be a lowercase Cloudflare resource name of at most 54 characters\");\n  }\n\n  if (\n    accountId !== undefined &&\n    (typeof accountId !== \"string\" || !accountIdPattern.test(accountId))\n  ) {\n    throw new Error(\"accountId must be a 32-character lowercase hexadecimal Cloudflare account ID\");\n  }\n\n  if (\n    !Array.isArray(scopeValues) ||\n    scopeValues.length === 0 ||\n    scopeValues.some((scope) => typeof scope !== \"string\")\n  ) {\n    throw new Error(\"at least one package scope is required\");\n  }\n\n  const scopes = [...new Set(scopeValues as string[])];\n  for (const scope of scopes) {\n    if (!scopePattern.test(scope)) {\n      throw new Error(`invalid package scope: ${scope}`);\n    }\n  }\n\n  if (hostname !== undefined && (typeof hostname !== \"string\" || !hostnamePattern.test(hostname))) {\n    throw new Error(\"hostname must be a valid DNS hostname without a scheme or path\");\n  }\n\n  if (!isObject(auth) || auth.provider !== \"secrets\") {\n    throw new Error(\"unsupported authentication provider\");\n  }\n\n  if (!Array.isArray(auth.tokens) || auth.tokens.length === 0) {\n    throw new Error(\"at least one authentication token binding is required\");\n  }\n\n  const seenBindings = new Set<string>();\n  const tokens = auth.tokens.map((tokenValue) => {\n    if (!isObject(tokenValue) || typeof tokenValue.binding !== \"string\") {\n      throw new Error(\"authentication token binding must be an object with a binding name\");\n    }\n    const { binding, permissions: permissionValues } = tokenValue;\n    if (!bindingPattern.test(binding)) {\n      throw new Error(`invalid secret binding: ${binding}`);\n    }\n    if (reservedBindings.has(binding)) {\n      throw new Error(`secret binding is reserved by pkgflare: ${binding}`);\n    }\n    if (seenBindings.has(binding)) {\n      throw new Error(`duplicate secret binding: ${binding}`);\n    }\n    seenBindings.add(binding);\n\n    if (\n      !Array.isArray(permissionValues) ||\n      permissionValues.length === 0 ||\n      permissionValues.some((permission) => permission !== \"read\" && permission !== \"publish\")\n    ) {\n      throw new Error(`invalid permissions for ${binding}`);\n    }\n    const permissions = [...new Set(permissionValues)] as Permission[];\n\n    return { binding, permissions };\n  });\n\n  return {\n    name,\n    scopes,\n    ...(accountId === undefined ? {} : { accountId }),\n    ...(hostname === undefined ? {} : { hostname }),\n    auth: { provider: \"secrets\", tokens },\n  };\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\nexport interface CommandResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\nexport type WranglerRunner = (\n  arguments_: readonly string[],\n  options?: { allowFailure?: boolean; silent?: boolean },\n) => Promise<CommandResult>;\n\nfunction wranglerEntry(): string {\n  const require = createRequire(import.meta.url);\n  return join(dirname(require.resolve(\"wrangler/package.json\")), \"bin\", \"wrangler.js\");\n}\n\nexport function createWranglerRunner(cwd: string): WranglerRunner {\n  return async (arguments_, options = {}) => {\n    const result = await new Promise<CommandResult>((resolve, reject) => {\n      const child = spawn(process.execPath, [wranglerEntry(), ...arguments_], {\n        cwd,\n        env: process.env,\n        shell: false,\n        stdio: [\"inherit\", \"pipe\", \"pipe\"],\n      });\n      let stdout = \"\";\n      let stderr = \"\";\n      child.stdout.setEncoding(\"utf8\");\n      child.stderr.setEncoding(\"utf8\");\n      child.stdout.on(\"data\", (chunk: string) => {\n        stdout += chunk;\n        if (!options.silent) process.stdout.write(chunk);\n      });\n      child.stderr.on(\"data\", (chunk: string) => {\n        stderr += chunk;\n        if (!options.silent) process.stderr.write(chunk);\n      });\n      child.once(\"error\", reject);\n      child.once(\"close\", (code) => resolve({ exitCode: code ?? 1, stdout, stderr }));\n    });\n\n    if (result.exitCode !== 0 && !options.allowFailure) {\n      const operation = arguments_.slice(0, 3).join(\" \");\n      throw new Error(\n        `Wrangler command ${JSON.stringify(operation)} exited with status ${String(result.exitCode)}`,\n      );\n    }\n    return result;\n  };\n}\n"],"mappings":";;;AAAA,SAAS,mBAAmB;AAC5B,SAAS,YAAY;AACrB,SAAS,YAAAA,WAAU,WAAAC,gBAAe;;;ACFlC,SAAS,UAAU,OAAO,UAAU,SAAS,iBAAiB;AAC9D,SAAS,WAAAC,UAAS,QAAAC,OAAM,UAAU,WAAAC,gBAAe;AACjD,SAAS,qBAAqB;;;ACF9B,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;;;AC+B3B,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AACzB,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,kBACJ;AACF,IAAM,mBAAmB,oBAAI,IAAI,CAAC,eAAe,mBAAmB,iBAAiB,CAAC;AAMtF,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,gBAAgB,OAAkC;AAChE,MAAI,CAAC,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,iCAAiC;AACvE,QAAM,EAAE,MAAM,QAAQ,aAAa,WAAW,UAAU,KAAK,IAAI;AACjE,MAAI,OAAO,SAAS,YAAY,CAAC,kBAAkB,KAAK,IAAI,GAAG;AAC7D,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAEA,MACE,cAAc,WACb,OAAO,cAAc,YAAY,CAAC,iBAAiB,KAAK,SAAS,IAClE;AACA,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AAEA,MACE,CAAC,MAAM,QAAQ,WAAW,KAC1B,YAAY,WAAW,KACvB,YAAY,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ,GACrD;AACA,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,WAAuB,CAAC;AACnD,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,aAAa,KAAK,KAAK,GAAG;AAC7B,YAAM,IAAI,MAAM,0BAA0B,KAAK,EAAE;AAAA,IACnD;AAAA,EACF;AAEA,MAAI,aAAa,WAAc,OAAO,aAAa,YAAY,CAAC,gBAAgB,KAAK,QAAQ,IAAI;AAC/F,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAEA,MAAI,CAAC,SAAS,IAAI,KAAK,KAAK,aAAa,WAAW;AAClD,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,MAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,OAAO,WAAW,GAAG;AAC3D,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,SAAS,KAAK,OAAO,IAAI,CAAC,eAAe;AAC7C,QAAI,CAAC,SAAS,UAAU,KAAK,OAAO,WAAW,YAAY,UAAU;AACnE,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,UAAM,EAAE,SAAS,aAAa,iBAAiB,IAAI;AACnD,QAAI,CAAC,eAAe,KAAK,OAAO,GAAG;AACjC,YAAM,IAAI,MAAM,2BAA2B,OAAO,EAAE;AAAA,IACtD;AACA,QAAI,iBAAiB,IAAI,OAAO,GAAG;AACjC,YAAM,IAAI,MAAM,2CAA2C,OAAO,EAAE;AAAA,IACtE;AACA,QAAI,aAAa,IAAI,OAAO,GAAG;AAC7B,YAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE;AAAA,IACxD;AACA,iBAAa,IAAI,OAAO;AAExB,QACE,CAAC,MAAM,QAAQ,gBAAgB,KAC/B,iBAAiB,WAAW,KAC5B,iBAAiB,KAAK,CAAC,eAAe,eAAe,UAAU,eAAe,SAAS,GACvF;AACA,YAAM,IAAI,MAAM,2BAA2B,OAAO,EAAE;AAAA,IACtD;AACA,UAAM,cAAc,CAAC,GAAG,IAAI,IAAI,gBAAgB,CAAC;AAEjD,WAAO,EAAE,SAAS,YAAY;AAAA,EAChC,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IAC/C,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,MAAM,EAAE,UAAU,WAAW,OAAO;AAAA,EACtC;AACF;;;ADzHO,IAAM,oBAAoB;AAEjC,eAAsB,WACpB,KACA,aAAa,mBACc;AAC3B,QAAM,OAAO,QAAQ,KAAK,UAAU;AACpC,MAAI;AACF,UAAM,OAAO,IAAI;AAAA,EACnB,QAAQ;AACN,UAAM,IAAI,MAAM,iCAAiC,UAAU,EAAE;AAAA,EAC/D;AAEA,QAAM,OAAO,WAAW,cAAc,YAAY,GAAG,EAAE,MAAM;AAAA,IAC3D,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf,CAAC;AACD,QAAM,WAAW,MAAM,KAAK,OAAO,MAAM,EAAE,SAAS,KAAK,CAAC;AAC1D,SAAO,gBAAgB,QAAQ;AACjC;;;AEzBA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAC9B,SAAS,SAAS,YAAY;AAa9B,SAAS,gBAAwB;AAC/B,QAAMC,WAAU,cAAc,YAAY,GAAG;AAC7C,SAAO,KAAK,QAAQA,SAAQ,QAAQ,uBAAuB,CAAC,GAAG,OAAO,aAAa;AACrF;AAEO,SAAS,qBAAqB,KAA6B;AAChE,SAAO,OAAO,YAAY,UAAU,CAAC,MAAM;AACzC,UAAM,SAAS,MAAM,IAAI,QAAuB,CAACC,UAAS,WAAW;AACnE,YAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,cAAc,GAAG,GAAG,UAAU,GAAG;AAAA,QACtE;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,OAAO;AAAA,QACP,OAAO,CAAC,WAAW,QAAQ,MAAM;AAAA,MACnC,CAAC;AACD,UAAI,SAAS;AACb,UAAI,SAAS;AACb,YAAM,OAAO,YAAY,MAAM;AAC/B,YAAM,OAAO,YAAY,MAAM;AAC/B,YAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,kBAAU;AACV,YAAI,CAAC,QAAQ,OAAQ,SAAQ,OAAO,MAAM,KAAK;AAAA,MACjD,CAAC;AACD,YAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,kBAAU;AACV,YAAI,CAAC,QAAQ,OAAQ,SAAQ,OAAO,MAAM,KAAK;AAAA,MACjD,CAAC;AACD,YAAM,KAAK,SAAS,MAAM;AAC1B,YAAM,KAAK,SAAS,CAAC,SAASA,SAAQ,EAAE,UAAU,QAAQ,GAAG,QAAQ,OAAO,CAAC,CAAC;AAAA,IAChF,CAAC;AAED,QAAI,OAAO,aAAa,KAAK,CAAC,QAAQ,cAAc;AAClD,YAAM,YAAY,WAAW,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG;AACjD,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,UAAU,SAAS,CAAC,uBAAuB,OAAO,OAAO,QAAQ,CAAC;AAAA,MAC7F;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AH9CA,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAC1B,IAAM,YAAY;AAClB,IAAM,YAAY;AA+DlB,SAAS,cAAsB;AAC7B,SAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AAC/C;AAEA,SAAS,SACP,QACA,WACA,UACe;AACf,MAAI,UAAU,eAAe,UAAa,SAAS,eAAe,WAAW;AAC3E,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,QAAM,QAAuB;AAAA,IAC3B,SACE;AAAA,IACF,YAAY;AAAA,IACZ,MAAM,OAAO;AAAA,IACb,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,aAAa,OAAO,aAAa;AAAA,IACjC,MAAM,EAAE,iBAAiB,KAAK,UAAU,MAAM,EAAE;AAAA,IAChD,cAAc,UAAU,gBAAgB,CAAC;AAAA,IACzC,YAAY,UAAU,cAAc,CAAC;AAAA,EACvC;AACA,MAAI,OAAO,aAAa,QAAW;AACjC,UAAM,SAAS,CAAC,EAAE,SAAS,OAAO,UAAU,eAAe,KAAK,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,eAAe,UACb,MACA,QACoC;AACpC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,SAAS,MAAM,MAAM;AAAA,EACxC,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACA,QAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,MAAI,MAAM,SAAS,OAAO,MAAM;AAC9B,UAAM,IAAI;AAAA,MACR,wCAAwC,MAAM,IAAI,YAAY,kBAAkB;AAAA,IAClF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,WAAW,MAAc,OAAqC;AAC3E,QAAM,UAAU,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AACrE;AAEA,eAAe,oBACb,MACA,YACA,WACkB;AAClB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,SAAS,MAAM,MAAM;AAAA,EACxC,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACA,QAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,MAAI,UAAU,gBAAgB,cAAc,UAAU,eAAe,WAAW;AAC9E,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,eAAe,qBACb,MACA,YACA,WACe;AACf,QAAM,YAA4B,EAAE,YAAY,WAAW,aAAa,WAAW;AACnF,QAAM,UAAU,MAAM,GAAG,KAAK,UAAU,WAAW,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AACzE;AAEA,eAAe,iBAAiB,gBAAwB,MAA6B;AACnF,QAAM,mBAAmBC,MAAK,gBAAgB,SAAS;AACvD,QAAM,sBAAsBA,MAAK,gBAAgB,YAAY;AAC7D,QAAM,QAAQ,IAAI;AAAA,IAChB,MAAM,kBAAkB,EAAE,WAAW,KAAK,CAAC;AAAA,IAC3C,MAAM,qBAAqB,EAAE,WAAW,KAAK,CAAC;AAAA,EAChD,CAAC;AACD,QAAM,mBAAmBC,SAAQ,MAAM,MAAM,YAAY;AACzD,QAAM,kBAAkB,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,GAC5E,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC,EAC/D,IAAI,CAAC,UAAU,MAAM,IAAI;AAE5B,iBAAe,KAAK;AACpB,MAAI,eAAe,WAAW,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC7F,QAAM,QAAQ,IAAI;AAAA,IAChB,SAASD,MAAK,MAAM,WAAW,GAAGA,MAAK,kBAAkB,WAAW,CAAC;AAAA,IACrE,SAASA,MAAK,MAAM,eAAe,GAAGA,MAAK,kBAAkB,eAAe,CAAC;AAAA,IAC7E,GAAG,eAAe;AAAA,MAAI,CAAC,SACrB,SAASA,MAAK,kBAAkB,IAAI,GAAGA,MAAK,qBAAqB,IAAI,CAAC;AAAA,IACxE;AAAA,EACF,CAAC;AACD,QAAM,UAAUA,MAAK,gBAAgB,YAAY,GAAG,2BAA2B;AAAA,IAC7E,MAAM;AAAA,EACR,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC3B,QAAK,MAAgC,SAAS,SAAU,OAAM;AAAA,EAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,WAAmB,KAAuB;AACjE,SAAO,CAAC,YAAY,SAAS,KAAK,SAAS,CAAC;AAC9C;AAEA,eAAe,UACb,QACA,cACA,YAC2B;AAC3B,QAAM,SAAS,MAAM,OAAO,CAAC,MAAM,QAAQ,UAAU,GAAG,UAAU,GAAG,EAAE,QAAQ,KAAK,CAAC;AACrF,QAAM,UAAU,KAAK,MAAM,OAAO,MAAM;AACxC,QAAM,UAAU,QAAQ;AAAA,IACtB,CAAC,UAAU,MAAM,SAAS,gBAAgB,OAAO,MAAM,SAAS;AAAA,EAClE;AACA,MAAI,QAAQ,SAAS,EAAG,OAAM,IAAI,MAAM,mCAAmC,YAAY,EAAE;AACzF,QAAM,QAAQ,QAAQ,CAAC;AACvB,SAAO,UAAU,SACb,OACA;AAAA,IACE,SAAS;AAAA,IACT,eAAe;AAAA,IACf,aAAa,MAAM;AAAA,IACnB,gBAAgB;AAAA,EAClB;AACN;AAEA,eAAe,UACb,QACA,YACA,YAC2B;AAC3B,QAAM,SAAS,MAAM,OAAO,CAAC,MAAM,UAAU,QAAQ,YAAY,UAAU,GAAG,UAAU,GAAG;AAAA,IACzF,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,OAAO,aAAa,EAAG,QAAO,EAAE,SAAS,WAAW,aAAa,WAAW;AAChF,MAAI,kCAAkC,KAAK,OAAO,MAAM,EAAG,QAAO;AAClE,QAAM,IAAI,MAAM,yBAAyB,UAAU,yCAAyC;AAC9F;AAEA,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,YAAY,UAAU;AACzC,UAAM,IAAI,MAAM,+CAA+C;AACjE,QAAM,WAAY,MAAuB;AACzC,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,OAAM,IAAI,MAAM,+CAA+C;AAC7F,SAAO,SAAS,QAAQ,CAAC,YAAY;AACnC,QACE,OAAO,YAAY,YACnB,YAAY,QACZ,EAAE,QAAQ,YACV,OAAO,QAAQ,OAAO,UACtB;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO;AAAA,MACL;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,GAAI,OAAQ,QAA+B,SAAS,WAChD,EAAE,MAAO,QAA6B,KAAK,IAC3C,CAAC;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,iBACb,QACA,qBACiB;AACjB,MAAI,wBAAwB,OAAW,QAAO;AAC9C,QAAM,SAAS,MAAM,OAAO,CAAC,UAAU,QAAQ,GAAG,EAAE,QAAQ,KAAK,CAAC;AAClE,QAAM,WAAW,mBAAmB,KAAK,MAAM,OAAO,MAAM,CAAY;AACxE,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,QAAM,UAAU,SAAS,CAAC;AAC1B,MAAI,YAAY;AACd,UAAM,IAAI,MAAM,0DAA0D;AAC5E,SAAO,QAAQ;AACjB;AAEA,eAAe,aACb,QACA,YACA,YACkB;AAClB,QAAM,SAAS,MAAM,OAAO,CAAC,YAAY,QAAQ,UAAU,YAAY,UAAU,GAAG,UAAU,GAAG;AAAA,IAC/F,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,OAAO,aAAa,EAAG,QAAO;AAClC,MAAI,kCAAkC,KAAK,OAAO,MAAM,EAAG,QAAO;AAClE,QAAM,IAAI,MAAM,yBAAyB,UAAU,sCAAsC;AAC3F;AAEA,eAAe,sBACb,YACA,YACA,QACA,eACkB;AAClB,QAAM,SAAS,MAAM,aAAa,QAAQ,YAAY,UAAU;AAChE,MAAI,UAAU,CAAC,eAAe;AAC5B,UAAM,IAAI;AAAA,MACR,OAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,gBACb,OACA,WACA,KACA,QACA,eACwB;AACxB,QAAM,SAAS,GAAG,MAAM,IAAI;AAC5B,QAAM,SAAS,GAAG,MAAM,IAAI;AAC5B,QAAM,aAAa,gBAAgB,WAAW,GAAG;AACjD,QAAM,eAAe,MAAM,aAAa,OAAO,CAAC,aAAa,SAAS,YAAY,SAAS;AAC3F,QAAM,eAAe,MAAM,WAAW,OAAO,CAAC,WAAW,OAAO,YAAY,SAAS;AACrF,QAAM,aAAa,aAAa,CAAC;AACjC,QAAM,aAAa,aAAa,CAAC;AACjC,MACE,aAAa,SAAS,KACrB,eAAe,UAAa,WAAW,kBAAkB,QAC1D;AACA,UAAM,IAAI,MAAM,GAAG,SAAS,uBAAuB,MAAM,cAAc;AAAA,EACzE;AACA,MAAI,aAAa,SAAS,KAAM,eAAe,UAAa,WAAW,gBAAgB,QAAS;AAC9F,UAAM,IAAI,MAAM,GAAG,SAAS,uBAAuB,MAAM,YAAY;AAAA,EACvE;AAEA,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,YAAY,MAAM,UAAU,QAAQ,QAAQ,UAAU;AAC5D,QAAI,cAAc,MAAM;AACtB,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI;AAAA,UACR,OAAO,MAAM;AAAA,QACf;AAAA,MACF;AACA,YAAM,aAAa,KAAK,SAAS;AACjC,YAAM,WAAW,WAAW,KAAK;AAAA,IACnC,OAAO;AACL,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL,CAAC;AACD,cAAQ,KAAK,MAAM,MAAM,SAAS,WAAW,MAAM,CAAC;AAAA,IACtD;AAAA,EACF;AAEA,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,YAAY,MAAM,UAAU,QAAQ,QAAQ,UAAU;AAC5D,QAAI,cAAc,MAAM;AACtB,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI;AAAA,UACR,OAAO,MAAM;AAAA,QACf;AAAA,MACF;AACA,YAAM,WAAW,KAAK,SAAS;AAC/B,YAAM,WAAW,WAAW,KAAK;AAAA,IACnC,OAAO;AACL,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL,CAAC;AACD,cAAQ,KAAK,MAAM,MAAM,SAAS,WAAW,MAAM,CAAC;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,eAAe,MAAM,aAAa;AAAA,IAAI,CAAC,aAC3C,SAAS,YAAY,YAAY,EAAE,GAAG,UAAU,gBAAgB,aAAa,IAAI;AAAA,EACnF;AACA,QAAM,WAAW,WAAW,KAAK;AACjC,SAAO;AACT;AAEA,SAAS,cAAc,QAAgB,QAAyC;AAC9E,MAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO,QAAQ;AACpE,SAAO,OAAO,MAAM,kCAAkC,IAAI,CAAC,KAAK;AAClE;AAEA,eAAsB,OAAO,SAA+C;AAC1E,QAAM,MAAMC,SAAQ,QAAQ,GAAG;AAC/B,QAAM,SAAS,MAAM,WAAW,KAAK,QAAQ,UAAU;AACvD,QAAM,iBAAiBD,MAAK,KAAK,kBAAkB;AACnD,QAAM,YAAYA,MAAK,gBAAgB,aAAa;AACpD,QAAM,gBAAgBA,MAAK,gBAAgB,iBAAiB;AAC5D,QAAM,MAAM,gBAAgB,EAAE,WAAW,KAAK,CAAC;AAE/C,QAAM,WAAW,MAAM,UAAU,WAAW,MAAM;AAClD,QAAM,SAAS,QAAQ,UAAU,qBAAqB,GAAG;AACzD,QAAM,uBAAuB,QAAQ,IAAI;AACzC,QAAM,sBAAsB,OAAO,aAAa,UAAU;AAC1D,MACE,yBAAyB,UACzB,wBAAwB,UACxB,yBAAyB,qBACzB;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,YAAY,MAAM,iBAAiB,QAAQ,uBAAuB,oBAAoB;AAC5F,QAAM,aAAa,MAAM,oBAAoB,eAAe,OAAO,MAAM,SAAS;AAClF,MAAI,QAAQ,SAAS,QAAQ,WAAW,QAAQ;AAChD,QAAM,WAAW,WAAW,KAAK;AACjC,QAAM,iBAAiB,gBAAgB,QAAQ,mBAAmB,YAAY,CAAC;AAE/E,UAAQ,MAAM,gBAAgB,OAAO,WAAW,KAAK,QAAQ,QAAQ,iBAAiB,KAAK;AAC3F,QAAM,aAAa,gBAAgB,WAAW,GAAG;AACjD,QAAM,OAAO,CAAC,MAAM,cAAc,SAAS,WAAW,YAAY,GAAG,UAAU,CAAC;AAEhF,QAAM,gBAAgB,aAClB,QACA,MAAM,sBAAsB,MAAM,MAAM,YAAY,QAAQ,QAAQ,iBAAiB,KAAK;AAC9F,MAAI,cAAe,OAAM,qBAAqB,eAAe,MAAM,MAAM,SAAS;AAElF,QAAM,kBAAkB,CAAC,UAAU,eAAe,GAAG,UAAU;AAC/D,MAAI,QAAQ,gBAAgB,QAAW;AACrC,oBAAgB,KAAK,kBAAkB,QAAQ,WAAW;AAAA,EAC5D;AACA,QAAM,WAAW,MAAM,OAAO,eAAe;AAC7C,MAAI,CAAC,cAAc,CAAC;AAClB,UAAM,qBAAqB,eAAe,MAAM,MAAM,SAAS;AACjE,SAAO;AAAA,IACL,aAAa,cAAc,SAAS,QAAQ,MAAM;AAAA,IAClD;AAAA,IACA,gBAAgB,OAAO,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,IAC/D,QAAQ,OAAO;AAAA,EACjB;AACF;;;ADraA,SAAS,WAAW,YAA+B,MAAkC;AACnF,QAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,MAAI,UAAU,GAAI,QAAO;AACzB,QAAM,QAAQ,WAAW,QAAQ,CAAC;AAClC,MAAI,UAAU,UAAa,MAAM,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,mBAAmB;AAC7F,SAAO;AACT;AAEA,SAAS,OAAa;AACpB,UAAQ,OAAO;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EACF;AACF;AAEA,eAAe,KAAK,KAA4B;AAC9C,QAAM,OAAOE,SAAQ,KAAK,oBAAoB;AAC9C,QAAM,OAAO,MAAM,KAAK,MAAM,IAAI,EAAE,MAAM,CAAC,UAAmB;AAC5D,QAAK,MAAgC,SAAS;AAC5C,YAAM,IAAI,MAAM,mCAAmC;AACrD,UAAM;AAAA,EACR,CAAC;AACD,QAAM,KAAK;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EACF;AACA,QAAM,KAAK,MAAM;AACjB,UAAQ,OAAO,MAAM,8BAA8B;AACrD;AAEA,eAAe,KAAK,YAAqC;AACvD,QAAM,CAAC,SAAS,UAAU,IAAI;AAC9B,MAAI,YAAY,UAAa,YAAY,YAAY,YAAY,MAAM;AACrE,SAAK;AACL;AAAA,EACF;AACA,MAAI,YAAY,UAAU;AACxB,UAAM,aAAa,WAAW,YAAY,UAAU;AACpD,UAAM,cAAc,WAAW,YAAY,gBAAgB;AAC3D,UAAM,gBAAgB,WAAW,SAAS,kBAAkB;AAC5D,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B,KAAK,QAAQ,IAAI;AAAA,MACjB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACjD,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,MACnD;AAAA,IACF,CAAC;AACD,UAAM,YAAYC,UAAS,QAAQ,IAAI,GAAG,OAAO,SAAS;AAC1D,YAAQ,OAAO,MAAM;AAAA,oBAAuB,SAAS;AAAA,CAAI;AACzD,QAAI,OAAO,gBAAgB,MAAM;AAC/B,cAAQ,OAAO,MAAM,aAAa,OAAO,WAAW;AAAA,CAAI;AAAA,IAC1D;AACA,YAAQ,OAAO,MAAM,sEAAsE;AAC3F,eAAW,WAAW,OAAO,gBAAgB;AAC3C,cAAQ,OAAO,MAAM,6BAA6B,OAAO,aAAa,SAAS;AAAA,CAAI;AAAA,IACrF;AACA,QAAI,OAAO,gBAAgB,MAAM;AAC/B,YAAM,OAAO,IAAI,IAAI,OAAO,WAAW,EAAE;AACzC,cAAQ,OAAO,MAAM,aAAa;AAClC,iBAAW,SAAS,OAAO,QAAQ;AACjC,gBAAQ,OAAO,MAAM,KAAK,KAAK,aAAa,OAAO,WAAW;AAAA,CAAI;AAAA,MACpE;AACA,cAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,CAA8B;AAAA,IAChE;AACA;AAAA,EACF;AACA,MAAI,YAAY,QAAQ;AACtB,UAAM,KAAK,QAAQ,IAAI,CAAC;AACxB;AAAA,EACF;AACA,MAAI,YAAY,WAAW,eAAe,YAAY;AACpD,QAAI,SAAS;AACb,eAAW,QAAQ,YAAY,EAAE,EAAG,WAAU,OAAO,aAAa,IAAI;AACtE,UAAM,QAAQ,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpF,YAAQ,OAAO,MAAM,GAAG,KAAK;AAAA,CAAI;AACjC;AAAA,EACF;AACA,QAAM,IAAI,MAAM,oBAAoB,WAAW,KAAK,GAAG,CAAC,EAAE;AAC5D;AAEA,KAAK,QAAQ,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,UAAmB;AACpD,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAQ,OAAO,MAAM,aAAa,OAAO;AAAA,CAAI;AAC7C,UAAQ,WAAW;AACrB,CAAC;","names":["relative","resolve","dirname","join","resolve","require","resolve","dirname","join","resolve","resolve","relative"]}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+type Permission = "read" | "publish";
+interface SecretTokenConfig {
+    binding: string;
+    permissions: readonly Permission[];
+}
+interface SecretsAuthConfig {
+    provider: "secrets";
+    tokens: readonly SecretTokenConfig[];
+}
+interface PkgflareConfig {
+    name: string;
+    scopes: readonly string[];
+    accountId?: string;
+    hostname?: string;
+    auth: SecretsAuthConfig;
+}
+declare function defineConfig(config: PkgflareConfig): PkgflareConfig;
+
+export { type Permission, type PkgflareConfig, type SecretTokenConfig, type SecretsAuthConfig, defineConfig };

package/dist/index.js

@@ -0,0 +1,8 @@
+// src/config.ts
+function defineConfig(config) {
+  return config;
+}
+export {
+  defineConfig
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["export type Permission = \"read\" | \"publish\";\n\nexport interface SecretTokenConfig {\n  binding: string;\n  permissions: readonly Permission[];\n}\n\nexport interface SecretsAuthConfig {\n  provider: \"secrets\";\n  tokens: readonly SecretTokenConfig[];\n}\n\nexport interface PkgflareConfig {\n  name: string;\n  scopes: readonly string[];\n  accountId?: string;\n  hostname?: string;\n  auth: SecretsAuthConfig;\n}\n\nexport interface NormalizedConfig {\n  name: string;\n  scopes: string[];\n  accountId?: string;\n  hostname?: string;\n  auth: {\n    provider: \"secrets\";\n    tokens: Array<{\n      binding: string;\n      permissions: Permission[];\n    }>;\n  };\n}\n\nconst workerNamePattern = /^[a-z](?:[a-z0-9-]{0,52}[a-z0-9])?$/;\nconst accountIdPattern = /^[a-f0-9]{32}$/;\nconst scopePattern = /^@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;\nconst bindingPattern = /^[A-Z][A-Z0-9_]*$/;\nconst hostnamePattern =\n  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;\nconst reservedBindings = new Set([\"PKGFLARE_DB\", \"PKGFLARE_BUCKET\", \"PKGFLARE_CONFIG\"]);\n\nexport function defineConfig(config: PkgflareConfig): PkgflareConfig {\n  return config;\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nexport function normalizeConfig(value: unknown): NormalizedConfig {\n  if (!isObject(value)) throw new Error(\"configuration must be an object\");\n  const { name, scopes: scopeValues, accountId, hostname, auth } = value;\n  if (typeof name !== \"string\" || !workerNamePattern.test(name)) {\n    throw new Error(\"name must be a lowercase Cloudflare resource name of at most 54 characters\");\n  }\n\n  if (\n    accountId !== undefined &&\n    (typeof accountId !== \"string\" || !accountIdPattern.test(accountId))\n  ) {\n    throw new Error(\"accountId must be a 32-character lowercase hexadecimal Cloudflare account ID\");\n  }\n\n  if (\n    !Array.isArray(scopeValues) ||\n    scopeValues.length === 0 ||\n    scopeValues.some((scope) => typeof scope !== \"string\")\n  ) {\n    throw new Error(\"at least one package scope is required\");\n  }\n\n  const scopes = [...new Set(scopeValues as string[])];\n  for (const scope of scopes) {\n    if (!scopePattern.test(scope)) {\n      throw new Error(`invalid package scope: ${scope}`);\n    }\n  }\n\n  if (hostname !== undefined && (typeof hostname !== \"string\" || !hostnamePattern.test(hostname))) {\n    throw new Error(\"hostname must be a valid DNS hostname without a scheme or path\");\n  }\n\n  if (!isObject(auth) || auth.provider !== \"secrets\") {\n    throw new Error(\"unsupported authentication provider\");\n  }\n\n  if (!Array.isArray(auth.tokens) || auth.tokens.length === 0) {\n    throw new Error(\"at least one authentication token binding is required\");\n  }\n\n  const seenBindings = new Set<string>();\n  const tokens = auth.tokens.map((tokenValue) => {\n    if (!isObject(tokenValue) || typeof tokenValue.binding !== \"string\") {\n      throw new Error(\"authentication token binding must be an object with a binding name\");\n    }\n    const { binding, permissions: permissionValues } = tokenValue;\n    if (!bindingPattern.test(binding)) {\n      throw new Error(`invalid secret binding: ${binding}`);\n    }\n    if (reservedBindings.has(binding)) {\n      throw new Error(`secret binding is reserved by pkgflare: ${binding}`);\n    }\n    if (seenBindings.has(binding)) {\n      throw new Error(`duplicate secret binding: ${binding}`);\n    }\n    seenBindings.add(binding);\n\n    if (\n      !Array.isArray(permissionValues) ||\n      permissionValues.length === 0 ||\n      permissionValues.some((permission) => permission !== \"read\" && permission !== \"publish\")\n    ) {\n      throw new Error(`invalid permissions for ${binding}`);\n    }\n    const permissions = [...new Set(permissionValues)] as Permission[];\n\n    return { binding, permissions };\n  });\n\n  return {\n    name,\n    scopes,\n    ...(accountId === undefined ? {} : { accountId }),\n    ...(hostname === undefined ? {} : { hostname }),\n    auth: { provider: \"secrets\", tokens },\n  };\n}\n"],"mappings":";AA0CO,SAAS,aAAa,QAAwC;AACnE,SAAO;AACT;","names":[]}