@vigilbase/cli 0.1.3 → 0.2.0

package/dist/local/cloudflare-checkup/cf/auth-lifecycle.js

@@ -0,0 +1,313 @@
+/**
+ * cf authentication lifecycle and call scheduling (spec §F3, §F5).
+ *
+ * cf refreshes an OAuth token only once it has expired (`now >= expiry`), per
+ * process and without a lock, so concurrent cf processes near expiry could
+ * race a rotating refresh token. The scheduler therefore:
+ * - runs one serial `cf auth whoami` before any fan-out (it performs any due
+ *   refresh and reports `expiresAt`; `tokenValid` is ignored, cf issue #21);
+ * - in profile and default modes, stops dispatching when `now ≥ expiresAt − 60 s`,
+ *   lets in-flight calls drain (each is capped at 45 s), sleeps until
+ *   `expiresAt + 1 s` and runs up to two serial `whoami` calls, then resumes.
+ *   The first performs the single refresh; cf 1.0.0-beta.13 reads the
+ *   credential file before its token getter refreshes, so that call prints the
+ *   old (passed) expiry and a second serial `whoami` reads the new one;
+ * - on a 401 pauses dispatch, runs one serial `whoami` (plus the re-read when
+ *   it reports a passed expiry) and retries once;
+ * - on a 429 pauses every worker for 30 s and retries once; a second 429
+ *   aborts with CF_RATE_LIMITED;
+ * - retries 5xx, network errors and timeouts twice (after 1 s, then 3 s);
+ * - spends the request budget for every API call, including `whoami`.
+ */
+import { z } from 'zod';
+import { RECOMMENDED_CF_SCOPES } from '../contract.js';
+import { LocalCheckupError, ENV_TOKEN_AUTH_HINT } from '../errors.js';
+import { classifyCfStderr } from './run-cf.js';
+export const PRE_EXPIRY_MARGIN_MS = 60_000;
+export const RATE_LIMIT_PAUSE_MS = 30_000;
+export const TRANSIENT_RETRY_DELAYS_MS = [1_000, 3_000];
+export const MAX_CF_INVOCATIONS = 6_000;
+const WhoamiSchema = z.object({
+    authenticated: z.boolean(),
+    scopes: z.array(z.string().max(128)).max(1_000).optional(),
+    expiresAt: z.union([z.string().max(64), z.number()]).optional(),
+}).passthrough();
+/** Reduce cf's whoami JSON; email, account names and the credential file path are dropped. */
+export function parseWhoami(stdout) {
+    let raw;
+    try {
+        raw = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    const parsed = WhoamiSchema.safeParse(raw);
+    if (!parsed.success)
+        return null;
+    const summary = { authenticated: parsed.data.authenticated };
+    if (parsed.data.expiresAt !== undefined) {
+        const time = typeof parsed.data.expiresAt === 'number' ? parsed.data.expiresAt : Date.parse(parsed.data.expiresAt);
+        if (Number.isFinite(time))
+            summary.expiresAt = new Date(time).toISOString();
+    }
+    if (parsed.data.scopes)
+        summary.scopes = parsed.data.scopes.filter((scope) => /^[A-Za-z0-9_.:-]{1,64}$/.test(scope));
+    return summary;
+}
+export function isReadOnlyScope(scope) {
+    return /(?:^|[.:])read$/.test(scope) || scope === 'offline' || scope === 'offline_access';
+}
+export function authSourceFor(mode) {
+    return mode === 'profile' ? 'cf_profile' : mode === 'env' ? 'cf_env_token' : 'cf_default_profile';
+}
+/**
+ * Doctor's auth view. In env mode cf reports `scopes` and `expiresAt` from the
+ * active profile's stored OAuth file even while the API token is in use, so
+ * both are ignored: API token permissions cannot be introspected.
+ */
+export function doctorAuth(summary, mode, profile) {
+    const base = { source: authSourceFor(mode), profile: mode === 'profile' ? profile : null, authenticated: summary.authenticated };
+    if (mode === 'env' || !summary.scopes)
+        return { ...base, scopes: 'unknown' };
+    return {
+        ...base,
+        ...(summary.expiresAt ? { expiresAt: summary.expiresAt } : {}),
+        scopes: 'known',
+        missingRecommendedScopes: RECOMMENDED_CF_SCOPES.filter((scope) => !summary.scopes.includes(scope)),
+        writeScopeCount: summary.scopes.filter((scope) => !isReadOnlyScope(scope)).length,
+    };
+}
+export function authRequiredError(mode, message) {
+    return new LocalCheckupError('CF_AUTH_REQUIRED', message ?? (mode === 'env'
+        ? 'cf could not authenticate with the API token from this shell.'
+        : 'cf is not signed in for this checkup (the profile is missing or its login expired).'), mode === 'env' ? { hint: ENV_TOKEN_AUTH_HINT } : {});
+}
+/** Dispatch gate shared by every worker. */
+export class CfScheduler {
+    options;
+    invocations = 0;
+    dispatched = 0;
+    inFlight = 0;
+    drainWaiters = [];
+    gate = null;
+    refreshing = null;
+    expiresAtMs;
+    preExpiryEnabled = true;
+    /** Dispatch sequence number when the first 429 paused the run. */
+    rateLimitPauseSeq = null;
+    abortError = null;
+    constructor(options) {
+        this.options = options;
+    }
+    get aborted() {
+        return this.abortError;
+    }
+    /** The serial whoami (re-read once if it refreshed) before fan-out. Throws CF_AUTH_REQUIRED when cf is not signed in. */
+    async start() {
+        let summary = await this.serialWhoami();
+        this.setExpiry(summary);
+        if (this.expiryHasPassed()) {
+            // This whoami refreshed an expired token but printed the pre-refresh expiry (see the header).
+            summary = await this.serialWhoami();
+            this.setExpiry(summary);
+        }
+        return summary;
+    }
+    /** Abort the run: no further dispatches, live children are killed. */
+    abort(error) {
+        if (this.abortError)
+            return;
+        this.abortError = error;
+        void this.options.terminateAll?.();
+    }
+    throwIfAborted() {
+        if (this.abortError)
+            throw this.abortError;
+    }
+    /** One cf API call with the §F5 retry policy. */
+    async call(argv, options = {}) {
+        let transientRetries = 0;
+        let authRetried = false;
+        let rateLimitRetried = false;
+        for (;;) {
+            const seq = await this.dispatch();
+            let result;
+            try {
+                result = await this.options.invoke(argv, options);
+            }
+            finally {
+                this.release();
+            }
+            this.throwIfAborted();
+            const failure = toFailure(result);
+            if (!failure)
+                return { ok: true, stdout: result.stdout };
+            if (failure.kind === 'http' && failure.status === 429) {
+                // The first 429 pauses every worker for 30 s; calls already in flight
+                // when it began join that pause and retry once. A 429 on a call
+                // dispatched after the pause, or a second 429 on the same call, aborts.
+                if (rateLimitRetried || (this.rateLimitPauseSeq !== null && seq > this.rateLimitPauseSeq)) {
+                    const error = new LocalCheckupError('CF_RATE_LIMITED', 'Cloudflare rate-limited the collection twice (HTTP 429). No file was written.', { status: 429 });
+                    this.abort(error);
+                    throw error;
+                }
+                rateLimitRetried = true;
+                if (this.rateLimitPauseSeq === null) {
+                    this.rateLimitPauseSeq = this.dispatched;
+                    await this.setGate(() => this.options.clock.sleep(RATE_LIMIT_PAUSE_MS));
+                }
+                else if (this.gate) {
+                    await this.gate;
+                }
+                continue;
+            }
+            if ((failure.kind === 'http' && failure.status === 401) || failure.kind === 'auth') {
+                if (authRetried)
+                    return { ok: false, failure };
+                authRetried = true;
+                await this.refresh('reactive');
+                continue;
+            }
+            const transient = failure.kind === 'timeout' || failure.kind === 'network' || (failure.kind === 'http' && failure.status >= 500);
+            if (transient && transientRetries < TRANSIENT_RETRY_DELAYS_MS.length) {
+                await this.options.clock.sleep(TRANSIENT_RETRY_DELAYS_MS[transientRetries]);
+                transientRetries++;
+                continue;
+            }
+            return { ok: false, failure };
+        }
+    }
+    /** Wait for a request slot and an open gate; returns the dispatch sequence number. */
+    async dispatch() {
+        this.throwIfAborted();
+        await this.options.budget.acquire();
+        for (;;) {
+            this.throwIfAborted();
+            if (this.gate) {
+                await this.gate;
+                continue;
+            }
+            if (this.shouldRefreshBeforeExpiry()) {
+                void this.refresh('expiry');
+                continue;
+            }
+            if (this.invocations >= (this.options.maxInvocations ?? MAX_CF_INVOCATIONS)) {
+                const error = new LocalCheckupError('ACCOUNT_TOO_LARGE', 'Collection would exceed 6,000 cf requests; this account is too large for a local checkup.');
+                this.abort(error);
+                throw error;
+            }
+            this.invocations++;
+            this.inFlight++;
+            return ++this.dispatched;
+        }
+    }
+    release() {
+        this.inFlight--;
+        if (this.inFlight === 0) {
+            const waiters = this.drainWaiters;
+            this.drainWaiters = [];
+            for (const resolve of waiters)
+                resolve();
+        }
+    }
+    drain() {
+        if (this.inFlight === 0)
+            return Promise.resolve();
+        return new Promise((resolve) => this.drainWaiters.push(resolve));
+    }
+    shouldRefreshBeforeExpiry() {
+        return this.options.authMode !== 'env' && this.preExpiryEnabled && this.expiresAtMs !== undefined &&
+            this.options.clock.now() >= this.expiresAtMs - PRE_EXPIRY_MARGIN_MS;
+    }
+    /** Close the dispatch gate until `work` (queued after any current gate) finishes. Failures abort the run. */
+    setGate(work) {
+        const previous = this.gate ?? Promise.resolve();
+        const gate = previous.then(work).catch((error) => {
+            this.abort(error instanceof Error ? error : new Error(String(error)));
+        }).finally(() => {
+            if (this.gate === gate)
+                this.gate = null;
+        });
+        this.gate = gate;
+        return gate;
+    }
+    /** Pause dispatch, drain in-flight calls, run up to two serial whoami calls, resume. */
+    refresh(reason) {
+        if (this.refreshing)
+            return this.refreshing;
+        const refreshing = this.setGate(async () => {
+            await this.drain();
+            if (reason === 'expiry' && this.expiresAtMs !== undefined) {
+                const wait = this.expiresAtMs + 1_000 - this.options.clock.now();
+                if (wait > 0)
+                    await this.options.clock.sleep(wait);
+            }
+            const previous = this.expiresAtMs;
+            this.setExpiry(await this.serialWhoami());
+            // cf 1.0.0-beta.13 `auth whoami` reads the credential file before its token getter
+            // refreshes, so the whoami that performs the refresh prints the old expiry. Re-read once
+            // (also after a 401, so a passed expiry does not trigger a second pause straight away).
+            if (this.expiryHasPassed()) {
+                this.setExpiry(await this.serialWhoami());
+            }
+            // A refresh that did not move the expiry forward falls back to the reactive 401 path.
+            if (reason === 'expiry' && (this.expiresAtMs === undefined || this.expiresAtMs === previous ||
+                this.expiresAtMs - PRE_EXPIRY_MARGIN_MS <= this.options.clock.now())) {
+                this.preExpiryEnabled = false;
+            }
+        }).finally(() => {
+            if (this.refreshing === refreshing)
+                this.refreshing = null;
+        });
+        this.refreshing = refreshing;
+        return refreshing;
+    }
+    expiryHasPassed() {
+        return this.expiresAtMs !== undefined && this.expiresAtMs <= this.options.clock.now();
+    }
+    setExpiry(summary) {
+        if (this.options.authMode === 'env')
+            return;
+        const time = summary.expiresAt === undefined ? Number.NaN : Date.parse(summary.expiresAt);
+        this.expiresAtMs = Number.isFinite(time) ? time : undefined;
+    }
+    async serialWhoami() {
+        this.throwIfAborted();
+        await this.options.budget.acquire();
+        this.invocations++;
+        const result = await this.options.whoami();
+        if (result.exitCode === 0 && !result.timedOut && !result.stdoutTooLarge) {
+            const summary = parseWhoami(result.stdout);
+            if (!summary)
+                throw new LocalCheckupError('CF_ERROR', 'cf auth whoami printed unexpected output.');
+            if (!summary.authenticated)
+                throw authRequiredError(this.options.authMode);
+            return summary;
+        }
+        const failure = toFailure(result);
+        if (failure?.kind === 'auth' || (failure?.kind === 'http' && (failure.status === 401 || failure.status === 403))) {
+            throw authRequiredError(this.options.authMode);
+        }
+        if (failure?.kind === 'http' && failure.status === 429) {
+            throw new LocalCheckupError('CF_RATE_LIMITED', 'Cloudflare rate-limited cf auth whoami (HTTP 429).', { status: 429 });
+        }
+        throw new LocalCheckupError('CF_ERROR', 'cf auth whoami failed; Cloudflare could not be reached or returned an error.');
+    }
+}
+/** `null` for a clean exit; otherwise the classified failure. */
+export function toFailure(result) {
+    if (result.stdoutTooLarge)
+        return { kind: 'output_too_large' };
+    if (result.timedOut)
+        return { kind: 'timeout' };
+    if (result.spawnFailed)
+        return { kind: 'cf_error' };
+    if (result.exitCode === 0)
+        return null;
+    const classified = classifyCfStderr(result.stderr);
+    if (classified.kind === 'node_unsupported') {
+        throw new LocalCheckupError('NODE_UNSUPPORTED', 'cf refused to run under this Node.js version.');
+    }
+    return classified;
+}
+//# sourceMappingURL=auth-lifecycle.js.map

package/dist/local/cloudflare-checkup/cf/auth-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lifecycle.js","sourceRoot":"","sources":["../../../../src/local/cloudflare-checkup/cf/auth-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGrE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,aAAa,CAAA;AAEpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AACzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE,KAAK,CAAU,CAAA;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEvC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC1D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC,WAAW,EAAE,CAAA;AAShB,8FAA8F;AAC9F,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,OAAO,GAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAA;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClH,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACpH,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,gBAAgB,CAAA;AAC3F,CAAC;AAYD,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAA;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAsB,EAAE,IAAgB,EAAE,OAAe;IAClF,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAA;IAChI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC5E,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,OAAO;QACf,wBAAwB,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnG,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KAClF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,OAAgB;IAClE,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK;QACzE,CAAC,CAAC,+DAA+D;QACjE,CAAC,CAAC,qFAAqF,CAAC,EAC1F,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACtD,CAAC;AAiCD,4CAA4C;AAC5C,MAAM,OAAO,WAAW;IAaO;IAZ7B,WAAW,GAAG,CAAC,CAAA;IACP,UAAU,GAAG,CAAC,CAAA;IACd,QAAQ,GAAG,CAAC,CAAA;IACZ,YAAY,GAAsB,EAAE,CAAA;IACpC,IAAI,GAAyB,IAAI,CAAA;IACjC,UAAU,GAAyB,IAAI,CAAA;IACvC,WAAW,CAAoB;IAC/B,gBAAgB,GAAG,IAAI,CAAA;IAC/B,kEAAkE;IAC1D,iBAAiB,GAAkB,IAAI,CAAA;IACvC,UAAU,GAAiB,IAAI,CAAA;IAEvC,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;IAAG,CAAC;IAE1D,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,yHAAyH;IACzH,KAAK,CAAC,KAAK;QACT,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACvC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACvB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,8FAA8F;YAC9F,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;YACnC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,KAAY;QAChB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAM;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACvB,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAA;IACpC,CAAC;IAED,cAAc;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,UAAU,CAAA;IAC5C,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,IAAI,CAAC,IAAuB,EAAE,UAAyB,EAAE;QAC7D,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;YACjC,IAAI,MAAuB,CAAA;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACnD,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,OAAO,EAAE,CAAA;YAChB,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAA;YACrB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;YACjC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;YACxD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACtD,sEAAsE;gBACtE,gEAAgE;gBAChE,wEAAwE;gBACxE,IAAI,gBAAgB,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC1F,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,+EAA+E,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBACxJ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBACjB,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,gBAAgB,GAAG,IAAI,CAAA;gBACvB,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;oBACpC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAA;oBACxC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;gBACzE,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,IAAI,CAAA;gBACjB,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACnF,IAAI,WAAW;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;gBAC9C,WAAW,GAAG,IAAI,CAAA;gBAClB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAC9B,SAAQ;YACV,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAA;YAChI,IAAI,SAAS,IAAI,gBAAgB,GAAG,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACrE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,gBAAgB,CAAE,CAAC,CAAA;gBAC5E,gBAAgB,EAAE,CAAA;gBAClB,SAAQ;YACV,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,QAAQ;QACpB,IAAI,CAAC,cAAc,EAAE,CAAA;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACnC,SAAS,CAAC;YACR,IAAI,CAAC,cAAc,EAAE,CAAA;YACrB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,IAAI,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC;gBACrC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAC3B,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,CAAC,EAAE,CAAC;gBAC5E,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,2FAA2F,CAAC,CAAA;gBACrJ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACjB,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,CAAC,WAAW,EAAE,CAAA;YAClB,IAAI,CAAC,QAAQ,EAAE,CAAA;YACf,OAAO,EAAE,IAAI,CAAC,UAAU,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,QAAQ,EAAE,CAAA;QACf,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAA;YACjC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;YACtB,KAAK,MAAM,OAAO,IAAI,OAAO;gBAAE,OAAO,EAAE,CAAA;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK;QACX,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,CAAC;IAEO,yBAAyB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAC/F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,WAAW,GAAG,oBAAoB,CAAA;IACvE,CAAC;IAED,6GAA6G;IACrG,OAAO,CAAC,IAAyB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/C,MAAM,IAAI,GAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACvE,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACvE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAC1C,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wFAAwF;IAChF,OAAO,CAAC,MAA6B;QAC3C,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAClB,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;gBAChE,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAA;YACjC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YACzC,mFAAmF;YACnF,yFAAyF;YACzF,wFAAwF;YACxF,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAC3C,CAAC;YACD,sFAAsF;YACtF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;gBACzF,IAAI,CAAC,WAAW,GAAG,oBAAoB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACvE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAA;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QAC5D,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,OAAO,UAAU,CAAA;IACnB,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;IACvF,CAAC;IAEO,SAAS,CAAC,OAAsB;QACtC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAM;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzF,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,cAAc,EAAE,CAAA;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACnC,IAAI,CAAC,WAAW,EAAE,CAAA;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;QAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACxE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,2CAA2C,CAAC,CAAA;YAClG,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC1E,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,OAAO,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACjH,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,oDAAoD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACvH,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,8EAA8E,CAAC,CAAA;IACzH,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC9D,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC/C,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,UAAU,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/local/cloudflare-checkup/cf/child-env.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The environment every cf child process receives (spec §F3).
+ *
+ * This is the only source file that names the Cloudflare API token variable;
+ * everything else imports `CF_TOKEN_ENV` (enforced by the grep guard test).
+ * The child environment is built from an empty object: a fixed allowlist is
+ * copied by name without inspecting values, then fixed values are forced.
+ * Base-URL overrides (`CLOUDFLARE_API_BASE_URL`, `CF_API_BASE_URL`), other
+ * Cloudflare/Wrangler credentials, `VIGILBASE_*`, `NODE_OPTIONS`, `DEBUG`,
+ * npm config and agent-harness markers are therefore absent by construction.
+ * Scrubbing the base-URL variables is the primary control against redirecting
+ * the token; the dry-run preflight cannot detect it.
+ */
+export declare const CF_TOKEN_ENV = "CLOUDFLARE_API_TOKEN";
+export declare const CF_ACCOUNT_ENV = "CLOUDFLARE_ACCOUNT_ID";
+export type CfAuthMode = 'profile' | 'env' | 'default';
+/** `api`: authenticated reads; `offline`: --version and --dry-run; `login`: interactive `cf auth create` / `cf auth delete`. */
+export type ChildEnvPurpose = 'api' | 'offline' | 'login';
+/** Presence only: the value is never read, printed or validated by the Vigilbase CLI. */
+export declare function hasEnvToken(parent: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+export declare function buildChildEnv(parent: NodeJS.ProcessEnv, options: {
+    purpose: ChildEnvPurpose;
+    authMode: CfAuthMode;
+    accountId?: string;
+    platform?: NodeJS.Platform;
+}): Record<string, string>;
+/** Variable names (never values) a cf child would receive, for `--dry-run` output. */
+export declare function childEnvVariableNames(parent: NodeJS.ProcessEnv, authMode: CfAuthMode, platform?: NodeJS.Platform): string[];
+/** Shown in profile and default modes when the token variable is set in the parent shell. */
+export declare function strippedTokenNotice(authMode: CfAuthMode): string;
+export declare function missingEnvTokenMessage(): string;
+//# sourceMappingURL=child-env.d.ts.map

package/dist/local/cloudflare-checkup/cf/child-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../../../src/local/cloudflare-checkup/cf/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,YAAY,yBAAyB,CAAA;AAClD,eAAO,MAAM,cAAc,0BAA0B,CAAA;AAErD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAA;AACtD,gIAAgI;AAChI,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAA;AAwBzD,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAG5G;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,UAAU,EACzB,OAAO,EAAE;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,UAAU,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAE,GAC1G,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBxB;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,EAAE,CAI7I;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAEhE;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C"}

package/dist/local/cloudflare-checkup/cf/child-env.js

@@ -0,0 +1,81 @@
+/**
+ * The environment every cf child process receives (spec §F3).
+ *
+ * This is the only source file that names the Cloudflare API token variable;
+ * everything else imports `CF_TOKEN_ENV` (enforced by the grep guard test).
+ * The child environment is built from an empty object: a fixed allowlist is
+ * copied by name without inspecting values, then fixed values are forced.
+ * Base-URL overrides (`CLOUDFLARE_API_BASE_URL`, `CF_API_BASE_URL`), other
+ * Cloudflare/Wrangler credentials, `VIGILBASE_*`, `NODE_OPTIONS`, `DEBUG`,
+ * npm config and agent-harness markers are therefore absent by construction.
+ * Scrubbing the base-URL variables is the primary control against redirecting
+ * the token; the dry-run preflight cannot detect it.
+ */
+export const CF_TOKEN_ENV = 'CLOUDFLARE_API_TOKEN';
+export const CF_ACCOUNT_ENV = 'CLOUDFLARE_ACCOUNT_ID';
+const PASSTHROUGH = [
+    'PATH', 'HOME', 'USER', 'LOGNAME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'SystemRoot', 'WINDIR',
+    'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME', 'XDG_RUNTIME_DIR',
+    'TMPDIR', 'TMP', 'TEMP', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TZ',
+    'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy',
+    'NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'DBUS_SESSION_BUS_ADDRESS', 'CLOUDFLARE_AUTH_USE_KEYRING',
+];
+/** Telemetry off, no update checks or prompts, no project-local delegation. */
+const FORCED_TELEMETRY = { CF_SEND_TELEMETRY: 'false', DO_NOT_TRACK: '1', CF_DELEGATION: '1' };
+const FORCED_NON_INTERACTIVE = { CI: '1', NO_COLOR: '1', FORCE_COLOR: '0', CF_QUIET: '1' };
+function lookup(parent, platform) {
+    if (platform !== 'win32')
+        return (name) => parent[name];
+    // Windows variable names are case-insensitive (`Path`, `SystemRoot`).
+    const keys = new Map(Object.keys(parent).map((key) => [key.toUpperCase(), key]));
+    return (name) => {
+        const key = keys.get(name.toUpperCase());
+        return key === undefined ? undefined : parent[key];
+    };
+}
+/** Presence only: the value is never read, printed or validated by the Vigilbase CLI. */
+export function hasEnvToken(parent, platform = process.platform) {
+    const value = lookup(parent, platform)(CF_TOKEN_ENV);
+    return typeof value === 'string' && value.length > 0;
+}
+export function buildChildEnv(parent, options) {
+    const platform = options.platform ?? process.platform;
+    const get = lookup(parent, platform);
+    const env = {};
+    for (const name of PASSTHROUGH) {
+        const value = get(name);
+        if (typeof value === 'string')
+            env[name] = value;
+    }
+    Object.assign(env, FORCED_TELEMETRY);
+    if (options.purpose !== 'login')
+        Object.assign(env, FORCED_NON_INTERACTIVE);
+    if (options.accountId !== undefined) {
+        if (!/^[0-9a-f]{32}$/.test(options.accountId))
+            throw new Error('Invalid Cloudflare account ID for cf.');
+        env[CF_ACCOUNT_ENV] = options.accountId;
+    }
+    // Copied by name, only for authenticated reads in --cf-auth env mode. In
+    // profile and default modes it would outrank --profile, so it is stripped.
+    if (options.purpose === 'api' && options.authMode === 'env') {
+        const token = get(CF_TOKEN_ENV);
+        if (typeof token === 'string' && token.length > 0)
+            env[CF_TOKEN_ENV] = token;
+    }
+    return env;
+}
+/** Variable names (never values) a cf child would receive, for `--dry-run` output. */
+export function childEnvVariableNames(parent, authMode, platform = process.platform) {
+    const names = Object.keys(buildChildEnv(parent, { purpose: 'api', authMode, accountId: '0'.repeat(32), platform }));
+    if (authMode === 'env' && !names.includes(CF_TOKEN_ENV))
+        names.push(CF_TOKEN_ENV);
+    return names.sort();
+}
+/** Shown in profile and default modes when the token variable is set in the parent shell. */
+export function strippedTokenNotice(authMode) {
+    return `${CF_TOKEN_ENV} is set in this shell but is not passed to cf in --cf-auth ${authMode} mode (it would override the profile). Use --cf-auth env to collect with it.`;
+}
+export function missingEnvTokenMessage() {
+    return `--cf-auth env requires ${CF_TOKEN_ENV} in this shell. cf reads it itself; the Vigilbase CLI only passes it through by name.`;
+}
+//# sourceMappingURL=child-env.js.map

package/dist/local/cloudflare-checkup/cf/child-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../../../src/local/cloudflare-checkup/cf/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAA;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAA;AAMrD,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ;IACnG,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB;IACzF,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI;IAC3D,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU;IAChF,qBAAqB,EAAE,eAAe,EAAE,cAAc,EAAE,0BAA0B,EAAE,6BAA6B;CACzG,CAAA;AAEV,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAW,CAAA;AACvG,MAAM,sBAAsB,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAW,CAAA;AAEnG,SAAS,MAAM,CAAC,MAAyB,EAAE,QAAyB;IAClE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvD,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IAChF,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QACxC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC,CAAA;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,WAAW,CAAC,MAAyB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAyB,EACzB,OAA2G;IAE3G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IAClD,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACpC,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC3E,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QACvG,GAAG,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,CAAA;IACzC,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAA;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;IAC9E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,MAAyB,EAAE,QAAoB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACjI,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IACnH,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACjF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,QAAoB;IACtD,OAAO,GAAG,YAAY,8DAA8D,QAAQ,8EAA8E,CAAA;AAC5K,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,0BAA0B,YAAY,uFAAuF,CAAA;AACtI,CAAC"}

package/dist/local/cloudflare-checkup/cf/install.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The Vigilbase-managed install of Cloudflare's cf (spec "one command", decision 5).
+ *
+ * When no usable cf is found, the full flow may install the pinned release
+ * into `<configDir>/cf/<version>/` with the npm that ships with this Node:
+ *
+ * - npm runs as `process.execPath <npm-cli.js> install --prefix <staging> …`
+ *   with no shell, from the fresh 0700 staging directory, with the user's
+ *   environment (npm needs their npmrc, proxy and CA settings) minus every
+ *   `CF_*` / `CLOUDFLARE_*` variable and, defensively, any variable whose
+ *   value holds a session code, a verification token or `--email`. (npx 10
+ *   passes arguments only in argv, not in the environment:
+ *   `npm_lifecycle_script` is just the bin name.)
+ * - `--ignore-scripts`: cf runs `--version`, `--dry-run` and API reads without
+ *   lifecycle scripts. `--omit=optional`: the optional dependencies are the
+ *   workerd and sharp platform binaries (about 150 MB). In cf 1.0.0-beta.13
+ *   they are loaded only by `--local` mode and the `workers`, `deploy` and
+ *   `previews` command trees (static and dynamic import graph of
+ *   `dist/*.mjs`), none of which the checkup runs; see LOCAL.md.
+ * - Integrity is pinned: after npm exits, the staging lockfile must record
+ *   `node_modules/cf` at exactly the pinned version and npm `dist.integrity`,
+ *   and the installed package.json must agree; otherwise the staging
+ *   directory is deleted (CF_INSTALL_FAILED). Only then is it renamed into
+ *   place, so a half-finished install is never used. `locateCf` still applies
+ *   its identity checks to the result.
+ * - Ctrl-C while npm runs kills npm and removes the staging directory. Staging
+ *   directories left by a crash or a closed terminal are removed by the next
+ *   install once they are older than the npm timeout (a concurrent install is
+ *   always younger), and by `logout`.
+ */
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+import { LocalCheckupError } from '../errors.js';
+/** The cf release the CLI installs; `integrity` is npm's `dist.integrity` for it. */
+export declare const MANAGED_CF: Readonly<{
+    version: "1.0.0-beta.13";
+    integrity: "sha512-dCjpzCJvjudIu8IQbXCJfy9diFoyHU84D/30K4lJp7jUaBgvjJypsMFzLqvUFOuwhF1ggR/igsLqXyehAOR2FQ==";
+    /** Measured `du` of the install without optional dependencies (darwin-arm64: 73 MB). */
+    approxSize: "about 75 MB";
+}>;
+export declare const NPM_INSTALL_TIMEOUT_MS: number;
+export declare const NPM_STDERR_TAIL_LINES = 20;
+export type SpawnFn = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+/** `<configDir>/cf`: every managed version, plus any leftover staging directory. */
+export declare function managedCfRoot(configDir: string): string;
+export declare function managedCfInstallDir(configDir: string, version?: string): string;
+export declare function managedCfPackageDir(installDir: string): string;
+/** The npm arguments after `process.execPath`. */
+export declare function npmInstallArgv(npmCli: string, prefix: string, version?: string): string[];
+/**
+ * The npm to run: `npm_execpath` when it names an existing `npm-cli.js` (or
+ * `npx-cli.js`, whose sibling is used), otherwise the npm bundled beside this
+ * Node. `null` when neither exists.
+ */
+export declare function resolveNpmCli(options?: {
+    env: NodeJS.ProcessEnv;
+    execPath?: string;
+    platform?: NodeJS.Platform;
+    exists?: (target: string) => boolean;
+}): string | null;
+/** The user's environment minus Cloudflare variables and anything carrying a session code, token or `--email`. */
+export declare function npmChildEnv(parent: NodeJS.ProcessEnv): Record<string, string>;
+/**
+ * True when every lockfile npm wrote records `node_modules/cf` at the pinned
+ * version and integrity (at least one must exist), and the installed
+ * package.json has that version.
+ */
+export declare function verifyManagedInstall(installDir: string, pin?: {
+    version: string;
+    integrity: string;
+}): Promise<boolean>;
+/** The managed cf package directory when a verified install exists, else null. */
+export declare function findManagedCf(configDir: string): Promise<string | null>;
+/** Create `dir` 0700 if missing; refuse a symlink or non-directory in its place. */
+export declare function ensurePrivateDir(dir: string): Promise<void>;
+/** A CF_INSTALL_FAILED error that carries the redacted tail of npm's stderr. */
+export declare class CfInstallError extends LocalCheckupError {
+    readonly npmOutput: string[];
+    constructor(message: string, npmOutput?: string[]);
+}
+/** The last lines of npm's stderr, dropping any line that could carry a registry credential. */
+export declare function npmStderrTail(stderr: string, lines?: number): string[];
+/** Remove `.staging-*` leftovers older than `maxAgeMs`; a younger one may belong to a concurrent install. */
+export declare function removeStaleStaging(root: string, maxAgeMs?: number, now?: number): Promise<string[]>;
+/**
+ * Install the pinned cf into `<configDir>/cf/<version>/` and return its
+ * package directory. Throws CF_INSTALL_FAILED (a `CfInstallError`) when npm
+ * is missing or fails, or the result does not match the pin; the staging
+ * directory is always removed (on Ctrl-C too).
+ */
+export declare function installManagedCf(options: {
+    configDir: string;
+    env: NodeJS.ProcessEnv;
+    spawn?: SpawnFn;
+    npmCli?: string | null;
+    timeoutMs?: number;
+    /** Replace a verified install too (it was found but cf could not run). */
+    replace?: boolean;
+    /** Runs first on Ctrl-C during the install (the caller stops its spinner). */
+    onInterrupt?: () => void;
+}): Promise<string>;
+/** `logout`: remove every managed cf version (and any staging leftovers). */
+export declare function removeManagedCf(configDir: string): Promise<{
+    path: string;
+    removed: boolean;
+}>;
+//# sourceMappingURL=install.d.ts.map

package/dist/local/cloudflare-checkup/cf/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../../src/local/cloudflare-checkup/cf/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAI7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,qFAAqF;AACrF,eAAO,MAAM,UAAU;;;IAGrB,wFAAwF;;EAExF,CAAA;AAEF,eAAO,MAAM,sBAAsB,QAAc,CAAA;AAMjD,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAIvC,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,KAAK,YAAY,CAAA;AAEvG,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,MAA2B,GAAG,MAAM,CAEnG;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kDAAkD;AAClD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAA2B,GAAG,MAAM,EAAE,CAE7G;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE;IACrC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;CACd,GAAG,MAAM,GAAG,IAAI,CAevC;AAED,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU7E;AAcD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAYzI;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK7E;AAED,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjE;AAED,gFAAgF;AAChF,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAA;gBAEhB,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO;CAItD;AAID,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAA8B,GAAG,MAAM,EAAE,CAK7F;AAsCD,6GAA6G;AAC7G,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUvI;AAwBD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,IAAI,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0ClB;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAMpG"}