@vigilbase/cli 0.1.4 → 0.2.0

package/dist/local/cloudflare-checkup/cf/run-cf.d.ts

@@ -0,0 +1,89 @@
+export declare const CF_CALL_TIMEOUT_MS = 45000;
+export declare const STDOUT_CAP_BYTES: number;
+/** `rulesets get` bodies can be large managed rulesets. */
+export declare const RULESET_STDOUT_CAP_BYTES: number;
+export declare const STDERR_CAP_BYTES: number;
+/**
+ * Flags that skip confirmations, switch cf to local simulation or project
+ * config, or send a request body. No allowlisted argv contains them; the
+ * runner refuses to spawn one that does.
+ */
+export declare const FORBIDDEN_CF_FLAGS: readonly string[];
+export declare function assertSafeCfArgv(argv: readonly string[]): void;
+export type CfProcessResult = {
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    stdoutTooLarge: boolean;
+    /** Set when the process could not be started at all. */
+    spawnFailed: boolean;
+};
+export type CfRunOptions = {
+    env: Record<string, string>;
+    timeoutMs?: number;
+    stdoutCapBytes?: number;
+};
+/** Owns the private working directory and every live cf child. */
+export declare class CfProcessRunner {
+    readonly entry: string;
+    readonly privateDir: string;
+    private readonly active;
+    private disposed;
+    /** Set once the runner kills its children (abort or shutdown), so those kills are not read as timeouts. */
+    private terminating;
+    private constructor();
+    static create(entry: string): Promise<CfProcessRunner>;
+    run(argv: readonly string[], options: CfRunOptions): Promise<CfProcessResult>;
+    /**
+     * The only interactive cf passthroughs: `cf auth create` (sign-in) and
+     * `cf auth delete` (logout). With `stdoutToStderr` (`--json`), cf's stdout
+     * is sent to stderr so the CLI's stdout stays a single JSON object.
+     */
+    runInteractive(argv: readonly string[], env: Record<string, string>, options?: {
+        stdoutToStderr?: boolean;
+    }): Promise<number>;
+    get activeCount(): number;
+    /** SIGTERM every live child, then SIGKILL whatever is still running after 2 s. */
+    terminateAll(): Promise<void>;
+    dispose(): Promise<void>;
+}
+/**
+ * Run `work` with a private cf runner; the directory is removed afterwards and
+ * on SIGINT, when live children get SIGTERM and then SIGKILL.
+ */
+export declare function withCfRunner<T>(entry: string, work: (runner: CfProcessRunner) => Promise<T>): Promise<T>;
+export type CfFailure = {
+    kind: 'node_unsupported';
+} | {
+    kind: 'command_unavailable';
+} | {
+    kind: 'auth';
+} | {
+    kind: 'http';
+    status: number;
+} | {
+    kind: 'network';
+} | {
+    kind: 'cf_error';
+};
+/** ANSI and box-drawing characters removed; lines kept. */
+export declare function cleanCfStderr(stderr: string): string;
+/**
+ * Classify a failed cf call from its stderr, in order: Node version, unknown
+ * command, auth without an HTTP status, the HTTP status line
+ * (`${status} ${text}[ · HTTP <path>]`), network, anything else. cf wraps
+ * messages at the terminal width, so word patterns run over collapsed text.
+ */
+export declare function classifyCfStderr(stderr: string): CfFailure;
+/**
+ * Parse cf stdout: lists print a bare JSON array, gets a bare object. cf prints
+ * nothing for a `null` result, so an empty get is `null` (the projectors decide).
+ */
+export declare function parseCfJson(stdout: string, shape: 'array' | 'object'): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+};
+//# sourceMappingURL=run-cf.d.ts.map

package/dist/local/cloudflare-checkup/cf/run-cf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-cf.d.ts","sourceRoot":"","sources":["../../../../src/local/cloudflare-checkup/cf/run-cf.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,kBAAkB,QAAS,CAAA;AACxC,eAAO,MAAM,gBAAgB,QAAkB,CAAA;AAC/C,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AACxD,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAGzC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,mBAAuG,CAAA;AAEtI,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAK9D;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,OAAO,CAAA;IACjB,cAAc,EAAE,OAAO,CAAA;IACvB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,kEAAkE;AAClE,qBAAa,eAAe;IAMN,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM;IALvE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAQ;IACxB,2GAA2G;IAC3G,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO;WAEM,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAM5D,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IA2E7E;;;;OAIG;IACH,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBjI,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,kFAAkF;IAC5E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB7B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAY9G;AAMD,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAaxB,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAYD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAU1D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAWnH"}

package/dist/local/cloudflare-checkup/cf/run-cf.js

@@ -0,0 +1,275 @@
+/**
+ * Spawning cf (spec §F3, §F6).
+ *
+ * cf always runs as `process.execPath <cf entry> …argv` with no shell (and so
+ * no `.cmd` shim on Windows), from a private, empty 0700 working directory, so
+ * a project's `.env`, `.env.local`, `cloudflare.config.ts`, directory profile
+ * bindings and account cache never apply. Output is capped, stderr is never
+ * echoed, and every failure is reduced to a small classification.
+ */
+import { spawn } from 'node:child_process';
+import { chmod, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { stripVTControlCharacters } from 'node:util';
+import { CF_TOKEN_ENV } from './child-env.js';
+export const CF_CALL_TIMEOUT_MS = 45_000;
+export const STDOUT_CAP_BYTES = 8 * 1024 * 1024;
+/** `rulesets get` bodies can be large managed rulesets. */
+export const RULESET_STDOUT_CAP_BYTES = 16 * 1024 * 1024;
+export const STDERR_CAP_BYTES = 64 * 1024;
+const KILL_GRACE_MS = 2_000;
+/**
+ * Flags that skip confirmations, switch cf to local simulation or project
+ * config, or send a request body. No allowlisted argv contains them; the
+ * runner refuses to spawn one that does.
+ */
+export const FORBIDDEN_CF_FLAGS = Object.freeze(['--force', '-f', '--yes', '-y', '--local', '--mode', '-m', '--body', '--persist-to']);
+export function assertSafeCfArgv(argv) {
+    for (const arg of argv) {
+        const flag = arg.split('=')[0];
+        if (FORBIDDEN_CF_FLAGS.includes(flag))
+            throw new Error(`Refusing to run cf with ${flag}.`);
+    }
+}
+/** Owns the private working directory and every live cf child. */
+export class CfProcessRunner {
+    entry;
+    privateDir;
+    active = new Set();
+    disposed = false;
+    /** Set once the runner kills its children (abort or shutdown), so those kills are not read as timeouts. */
+    terminating = false;
+    constructor(entry, privateDir) {
+        this.entry = entry;
+        this.privateDir = privateDir;
+    }
+    static async create(entry) {
+        const privateDir = await mkdtemp(join(tmpdir(), 'vigilbase-cf-'));
+        await chmod(privateDir, 0o700);
+        return new CfProcessRunner(entry, privateDir);
+    }
+    run(argv, options) {
+        assertSafeCfArgv(argv);
+        if (this.disposed)
+            return Promise.resolve(failedToStart());
+        const timeoutMs = options.timeoutMs ?? CF_CALL_TIMEOUT_MS;
+        const stdoutCap = options.stdoutCapBytes ?? STDOUT_CAP_BYTES;
+        return new Promise((resolve) => {
+            let child;
+            try {
+                child = spawn(process.execPath, [this.entry, ...argv], {
+                    shell: false,
+                    cwd: this.privateDir,
+                    env: options.env,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    windowsHide: true,
+                    timeout: timeoutMs,
+                    killSignal: 'SIGKILL',
+                });
+            }
+            catch {
+                resolve(failedToStart());
+                return;
+            }
+            this.active.add(child);
+            const stdout = [];
+            const stderr = [];
+            let stdoutBytes = 0;
+            let stderrBytes = 0;
+            let timedOut = false;
+            let stdoutTooLarge = false;
+            let settled = false;
+            // Node's own `timeout` option kills the child too; this timer only makes
+            // the cause observable when it wins the race.
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGKILL');
+            }, timeoutMs);
+            timer.unref?.();
+            child.stdout?.on('data', (chunk) => {
+                if (stdoutTooLarge)
+                    return;
+                stdoutBytes += chunk.byteLength;
+                if (stdoutBytes > stdoutCap) {
+                    stdoutTooLarge = true;
+                    stdout.length = 0;
+                    child.kill('SIGKILL');
+                    return;
+                }
+                stdout.push(chunk);
+            });
+            child.stderr?.on('data', (chunk) => {
+                if (stderrBytes >= STDERR_CAP_BYTES)
+                    return;
+                const room = STDERR_CAP_BYTES - stderrBytes;
+                stderr.push(chunk.byteLength > room ? chunk.subarray(0, room) : chunk);
+                stderrBytes += Math.min(chunk.byteLength, room);
+            });
+            const finish = (exitCode, signal, spawnFailed) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                this.active.delete(child);
+                // A child killed by a signal we did not send for the stdout cap or a
+                // shutdown was killed by the spawn timeout.
+                if (signal !== null && !stdoutTooLarge && !this.terminating)
+                    timedOut = true;
+                resolve({
+                    exitCode,
+                    stdout: Buffer.concat(stdout).toString('utf8'),
+                    stderr: Buffer.concat(stderr).toString('utf8'),
+                    timedOut,
+                    stdoutTooLarge,
+                    spawnFailed,
+                });
+            };
+            child.once('error', () => finish(null, null, true));
+            child.once('close', (code, signal) => finish(typeof code === 'number' ? code : null, signal ?? null, false));
+        });
+    }
+    /**
+     * The only interactive cf passthroughs: `cf auth create` (sign-in) and
+     * `cf auth delete` (logout). With `stdoutToStderr` (`--json`), cf's stdout
+     * is sent to stderr so the CLI's stdout stays a single JSON object.
+     */
+    runInteractive(argv, env, options = {}) {
+        assertSafeCfArgv(argv);
+        return new Promise((resolve, reject) => {
+            const child = spawn(process.execPath, [this.entry, ...argv], {
+                shell: false, cwd: this.privateDir, env, stdio: ['inherit', options.stdoutToStderr ? 2 : 'inherit', 'inherit'], windowsHide: true,
+            });
+            this.active.add(child);
+            child.once('error', (error) => {
+                this.active.delete(child);
+                reject(error);
+            });
+            child.once('close', (code) => {
+                this.active.delete(child);
+                resolve(typeof code === 'number' ? code : 1);
+            });
+        });
+    }
+    get activeCount() {
+        return this.active.size;
+    }
+    /** SIGTERM every live child, then SIGKILL whatever is still running after 2 s. */
+    async terminateAll() {
+        this.terminating = true;
+        if (this.active.size === 0)
+            return;
+        const children = [...this.active];
+        for (const child of children)
+            child.kill('SIGTERM');
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                for (const child of children)
+                    if (child.exitCode === null && child.signalCode === null)
+                        child.kill('SIGKILL');
+                resolve();
+            }, KILL_GRACE_MS);
+            timer.unref?.();
+            Promise.all(children.map((child) => child.exitCode !== null || child.signalCode !== null
+                ? Promise.resolve()
+                : new Promise((done) => child.once('close', () => done())))).then(() => {
+                clearTimeout(timer);
+                resolve();
+            }, () => undefined);
+        });
+    }
+    async dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        await this.terminateAll();
+        await rm(this.privateDir, { recursive: true, force: true });
+    }
+}
+function failedToStart() {
+    return { exitCode: null, stdout: '', stderr: '', timedOut: false, stdoutTooLarge: false, spawnFailed: true };
+}
+/**
+ * Run `work` with a private cf runner; the directory is removed afterwards and
+ * on SIGINT, when live children get SIGTERM and then SIGKILL.
+ */
+export async function withCfRunner(entry, work) {
+    const runner = await CfProcessRunner.create(entry);
+    const onSignal = () => {
+        void runner.dispose().finally(() => process.exit(130));
+    };
+    process.once('SIGINT', onSignal);
+    try {
+        return await work(runner);
+    }
+    finally {
+        process.removeListener('SIGINT', onSignal);
+        await runner.dispose();
+    }
+}
+const BOX_DRAWING = /[\u2500-\u257f]/g;
+// cf's API error header: `${status} ${statusText}`, where statusText is empty
+// outside 400-504, optionally followed by ` · HTTP <path>` (absent when the
+// response URL is unknown). Body lines (`[code] message`, notes) never match:
+// after the status only a known status text, whitespace or the `·` suffix may follow.
+const STATUS_TEXT = '(?:Bad Request|Unauthorized|Forbidden|Not Found|Method Not Allowed|Conflict|Unprocessable Entity|' +
+    'Too Many Requests|Internal Server Error|Bad Gateway|Service Unavailable|Gateway Timeout)';
+const STATUS_LINE = new RegExp(`^\\s*([1-5]\\d\\d)(?: ${STATUS_TEXT})?\\s*(?:\u00b7.*)?$`, 'gm');
+// Node/undici network failures and the cf SDK's own client timeout ("Timeout exceeded when calling …").
+const NETWORK = /ENOTFOUND|ECONNRESET|ETIMEDOUT|ECONNREFUSED|EAI_AGAIN|UND_ERR|fetch failed|socket hang up|Timeout exceeded|Request timed out/i;
+/** ANSI and box-drawing characters removed; lines kept. */
+export function cleanCfStderr(stderr) {
+    return stripVTControlCharacters(stderr).replace(BOX_DRAWING, ' ').replace(/\r\n?/g, '\n');
+}
+// cf's non-interactive no-credential / expired-token message names the token variable.
+const AUTH = new RegExp(`not logged in|cf auth (login|create)|expired|does not exist|necessary to set a ${CF_TOKEN_ENV}`, 'i');
+/** The last status header line in cleaned stderr, if any. */
+function statusFromLines(lines) {
+    let status = null;
+    for (const match of lines.matchAll(STATUS_LINE))
+        status = Number(match[1]);
+    return status;
+}
+/**
+ * Classify a failed cf call from its stderr, in order: Node version, unknown
+ * command, auth without an HTTP status, the HTTP status line
+ * (`${status} ${text}[ · HTTP <path>]`), network, anything else. cf wraps
+ * messages at the terminal width, so word patterns run over collapsed text.
+ */
+export function classifyCfStderr(stderr) {
+    const lines = cleanCfStderr(stderr);
+    const flat = lines.replace(/\s+/g, ' ');
+    if (/cf requires Node\.js/.test(flat))
+        return { kind: 'node_unsupported' };
+    if (/Did you mean|Unknown (argument|command)/.test(flat))
+        return { kind: 'command_unavailable' };
+    const status = statusFromLines(lines);
+    if (status === null && AUTH.test(flat))
+        return { kind: 'auth' };
+    if (status !== null)
+        return { kind: 'http', status };
+    if (NETWORK.test(flat))
+        return { kind: 'network' };
+    return { kind: 'cf_error' };
+}
+/**
+ * Parse cf stdout: lists print a bare JSON array, gets a bare object. cf prints
+ * nothing for a `null` result, so an empty get is `null` (the projectors decide).
+ */
+export function parseCfJson(stdout, shape) {
+    if (shape === 'object' && stdout.trim() === '')
+        return { ok: true, value: null };
+    let value;
+    try {
+        value = JSON.parse(stdout);
+    }
+    catch {
+        return { ok: false };
+    }
+    if (shape === 'array')
+        return Array.isArray(value) ? { ok: true, value } : { ok: false };
+    if (value === null || (typeof value === 'object' && !Array.isArray(value)))
+        return { ok: true, value };
+    return { ok: false };
+}
+//# sourceMappingURL=run-cf.js.map

package/dist/local/cloudflare-checkup/cf/run-cf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-cf.js","sourceRoot":"","sources":["../../../../src/local/cloudflare-checkup/cf/run-cf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAC/C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AACzC,MAAM,aAAa,GAAG,KAAK,CAAA;AAE3B;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAA;AAEtI,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC/B,IAAK,kBAAwC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,CAAC,CAAA;IACnH,CAAC;AACH,CAAC;AAkBD,kEAAkE;AAClE,MAAM,OAAO,eAAe;IAMG;IAAwB;IALpC,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAA;IACzC,QAAQ,GAAG,KAAK,CAAA;IACxB,2GAA2G;IACnG,WAAW,GAAG,KAAK,CAAA;IAE3B,YAA6B,KAAa,EAAW,UAAkB;QAA1C,UAAK,GAAL,KAAK,CAAQ;QAAW,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAE3E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC9B,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,CAAC;IAED,GAAG,CAAC,IAAuB,EAAE,OAAqB;QAChD,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACzD,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAA;QAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,KAAmB,CAAA;YACvB,IAAI,CAAC;gBACH,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE;oBACrD,KAAK,EAAE,KAAK;oBACZ,GAAG,EAAE,IAAI,CAAC,UAAU;oBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;oBACjC,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,cAAc,GAAG,KAAK,CAAA;YAC1B,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAA;gBACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,EAAE,SAAS,CAAC,CAAA;YACb,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;YACf,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,cAAc;oBAAE,OAAM;gBAC1B,WAAW,IAAI,KAAK,CAAC,UAAU,CAAA;gBAC/B,IAAI,WAAW,GAAG,SAAS,EAAE,CAAC;oBAC5B,cAAc,GAAG,IAAI,CAAA;oBACrB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACrB,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,WAAW,IAAI,gBAAgB;oBAAE,OAAM;gBAC3C,MAAM,IAAI,GAAG,gBAAgB,GAAG,WAAW,CAAA;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACtE,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,CAAC,QAAuB,EAAE,MAA6B,EAAE,WAAoB,EAAE,EAAE;gBAC9F,IAAI,OAAO;oBAAE,OAAM;gBACnB,OAAO,GAAG,IAAI,CAAA;gBACd,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzB,qEAAqE;gBACrE,4CAA4C;gBAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,QAAQ,GAAG,IAAI,CAAA;gBAC5E,OAAO,CAAC;oBACN,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC9C,QAAQ;oBACR,cAAc;oBACd,WAAW;iBACZ,CAAC,CAAA;YACJ,CAAC,CAAA;YACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACnD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9G,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,IAAuB,EAAE,GAA2B,EAAE,UAAwC,EAAE;QAC7G,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI;aAClI,CAAC,CAAA;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzB,MAAM,CAAC,KAAK,CAAC,CAAA;YACf,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzB,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IACzB,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAM;QAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACjC,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,MAAM,KAAK,IAAI,QAAQ;oBAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;wBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC7G,OAAO,EAAE,CAAA;YACX,CAAC,EAAE,aAAa,CAAC,CAAA;YACjB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBACtF,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;gBACnB,CAAC,CAAC,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC7E,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,OAAO,EAAE,CAAA;YACX,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACrB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACzB,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;CACF;AAED,SAAS,aAAa;IACpB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;AAC9G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,KAAa,EAAE,IAA6C;IAChG,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;AACH,CAAC;AAcD,MAAM,WAAW,GAAG,kBAAkB,CAAA;AACtC,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,sFAAsF;AACtF,MAAM,WAAW,GAAG,mGAAmG;IACrH,0FAA0F,CAAA;AAC5F,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,yBAAyB,WAAW,sBAAsB,EAAE,IAAI,CAAC,CAAA;AAChG,wGAAwG;AACxG,MAAM,OAAO,GAAG,+HAA+H,CAAA;AAE/I,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;AAC3F,CAAC;AAED,uFAAuF;AACvF,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,kFAAkF,YAAY,EAAE,EAAE,GAAG,CAAC,CAAA;AAE9H,6DAA6D;AAC7D,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,MAAM,GAAkB,IAAI,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC1E,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAChG,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC/D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAyB;IACnE,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAChF,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IACxF,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;AACtB,CAAC"}

package/dist/local/cloudflare-checkup/collector.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Collecting a Cloudflare account through cf (spec §F5, §D3).
+ *
+ * Every read goes through the frozen allowlist and the shared scheduler (four
+ * workers, the request budget, auth pauses and retries). Each response is
+ * projected immediately by the vendored contract and the raw text discarded.
+ * Lists are paged with `--page N` until an empty page, because cf strips
+ * `result_info`: a final page and a server-clamped page look the same.
+ */
+import { type CollectedEntry, type CloudflareCheckupSnapshotV1, type SnapshotCollector, type ZoneData } from './contract.js';
+import { type ProfileArgs } from './cf/allowlist.js';
+import { type CfScheduler } from './cf/auth-lifecycle.js';
+export declare const WORKER_COUNT = 4;
+export type CollectEnv = {
+    scheduler: CfScheduler;
+    auth: ProfileArgs;
+    /** Template IDs, or `zone_setting:<id>`, whose dry-run mapping did not match. */
+    unavailable: ReadonlySet<string>;
+    concurrency?: number;
+    onProgress?: (progress: CollectProgress) => void;
+};
+export type CollectProgress = {
+    zonesDone: number;
+    zonesTotal: number;
+    requests: number;
+};
+export type AccountSummary = {
+    id: string;
+    name: string;
+};
+/** `accounts list --per-page 50 --page N` until an empty page. */
+export declare function listAccounts(env: CollectEnv): Promise<AccountSummary[]>;
+/** Requests for N zones: about 19 + extra pages + N × (33 + rulesets per zone). */
+export declare function estimateRequests(zoneCount: number, rulesetsPerZone?: number): number;
+/**
+ * Collect every snapshot entry for one account. Aborts (no file) when the
+ * account read fails other than 400/403/404, when the zone list fails, when it
+ * holds more than 100 zones, or when the account is invisible and has no zones.
+ */
+export declare function collectAccount(env: CollectEnv, accountId: string, hooks?: {
+    onZones?: (zones: readonly ZoneData[]) => void;
+}): Promise<CollectedEntry[]>;
+/** Assemble, validate and serialise; the returned text is exactly what is written and uploaded. */
+export declare function buildSnapshot(accountId: string, collector: SnapshotCollector, entries: readonly CollectedEntry[]): {
+    snapshot: CloudflareCheckupSnapshotV1;
+    text: string;
+};
+//# sourceMappingURL=collector.d.ts.map

package/dist/local/cloudflare-checkup/collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAgBL,KAAK,cAAc,EAInB,KAAK,2BAA2B,EAGhC,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAEd,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAwB,KAAK,WAAW,EAAqC,MAAM,mBAAmB,CAAA;AAC7G,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGhG,eAAO,MAAM,YAAY,IAAI,CAAA;AAI7B,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,WAAW,CAAA;IACtB,IAAI,EAAE,WAAW,CAAA;IACjB,iFAAiF;IACjF,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzF,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAuFzD,kEAAkE;AAClE,wBAAsB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAW7E;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,SAA8B,GAAG,MAAM,CAEzG;AAkDD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE;IAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,KAAK,IAAI,CAAA;CAAO,GAC7D,OAAO,CAAC,cAAc,EAAE,CAAC,CA2F3B;AAcD,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG;IAAE,QAAQ,EAAE,2BAA2B,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAS1K"}