@vigilbase/cli 0.1.4 → 0.2.0

package/dist/local/cloudflare-checkup/errors.js

@@ -0,0 +1,99 @@
+/**
+ * Stable error codes for `vigilbase cloudflare-checkup` (spec §F8).
+ *
+ * Every code matches `formatError`'s code pattern. Messages and hints are
+ * authored here; cf stderr and Vigilbase server text are never echoed. Hints
+ * point at the one command ("run the same command again", `--yes`,
+ * `--account-id`), not at the advanced subcommands. The browser
+ * troubleshooting accordion mirrors the code set.
+ */
+import { CF_TOKEN_ENV } from './cf/child-env.js';
+export const LOCAL_ERROR_CODES = [
+    // Environment and cf
+    'NODE_UNSUPPORTED', 'CF_NOT_FOUND', 'CF_WRONG_BINARY', 'CF_UNSUPPORTED_VERSION', 'CF_ALLOWLIST_MISMATCH',
+    'CF_INSTALL_FAILED', 'CF_AUTH_REQUIRED', 'CF_PERMISSION_DENIED', 'CF_RATE_LIMITED', 'CF_ERROR',
+    // Account
+    'ACCOUNT_SELECTION_REQUIRED', 'ACCOUNT_NOT_VISIBLE', 'ACCOUNT_TOO_LARGE', 'ACCOUNT_MISMATCH',
+    // Files and snapshots
+    'OUTPUT_EXISTS', 'SNAPSHOT_INVALID', 'SNAPSHOT_TOO_LARGE', 'SNAPSHOT_STALE', 'SNAPSHOT_SECRET_LIKE_VALUE',
+    // Email verification
+    'EMAIL_INVALID', 'EMAIL_CODE_INVALID', 'VERIFICATION_INVALID', 'VERIFICATION_EXPIRED',
+    // Session
+    'SESSION_INVALID', 'SESSION_EXPIRED', 'SESSION_USED', 'SESSION_BUSY', 'SESSION_CLOSED',
+    // Submission
+    'SUBMIT_ORIGIN_UNTRUSTED', 'CONFIRMATION_REQUIRED', 'CLI_UPGRADE_REQUIRED', 'LOCAL_MODE_DISABLED',
+    'VIGILBASE_RATE_LIMITED', 'VIGILBASE_CHALLENGED', 'SUBMIT_FAILED',
+];
+const INSTALL_CF = '`npm install --global cf@1.0.0-beta.13`';
+/** One fix per code; shown after the error and in `--json` as `hint`. */
+export const LOCAL_ERROR_HINTS = {
+    NODE_UNSUPPORTED: 'Install Node.js 22.18 or newer from https://nodejs.org (cf runs under the same Node), then run the same command again.',
+    CF_NOT_FOUND: `Run the same command again in a terminal and let it install cf (add --yes when no terminal is available), or install it yourself with ${INSTALL_CF}.`,
+    CF_WRONG_BINARY: `Another program named cf (for example the Cloud Foundry CLI, or a pnpm or Volta shim) was found. Run the same command again without --cf-bin and let it install cf, or pass --cf-bin "$(npm root -g)/cf".`,
+    CF_UNSUPPORTED_VERSION: `Run the same command again without --cf-bin and let it install the tested cf 1.0.0-beta.13, or install it yourself with ${INSTALL_CF}.`,
+    // Without --cf-bin the one command offers the managed install itself; the user's own cf is left alone.
+    CF_ALLOWLIST_MISMATCH: 'This cf release renamed commands the checkup needs. Run the same command again without --cf-bin and let it install the tested cf 1.0.0-beta.13 for Vigilbase; your own cf is left alone.',
+    CF_INSTALL_FAILED: `Install cf yourself with ${INSTALL_CF}, then run the same command again.`,
+    CF_AUTH_REQUIRED: `Run the same command again in a terminal to sign in to Cloudflare with a read-only login, or set ${CF_TOKEN_ENV} in this shell first.`,
+    CF_PERMISSION_DENIED: 'Your Cloudflare login cannot read this account\'s zones. Check its permissions, then run the same command again.',
+    CF_RATE_LIMITED: 'Cloudflare paused your API access. Wait 5 minutes, then run the same command again; add --max-requests-per-5min 600 if it repeats.',
+    CF_ERROR: 'Run the same command again in a few minutes. If it persists, contact help@vigilbase.com.',
+    ACCOUNT_SELECTION_REQUIRED: 'Run the same command again in a terminal to choose the account, or add --account-id <ACCOUNT_ID> with one of the IDs listed.',
+    ACCOUNT_NOT_VISIBLE: 'Check that your Cloudflare user can read the account and its zones, then run the same command again.',
+    ACCOUNT_TOO_LARGE: 'Local collection supports up to 100 zones. Use the browser token mode on vigilbase.com instead.',
+    ACCOUNT_MISMATCH: 'This checkup is for a different Cloudflare account. Run the same command again without --account-id to start a new checkup.',
+    OUTPUT_EXISTS: 'Choose another --out path, or pass --overwrite to replace the file.',
+    SNAPSHOT_INVALID: 'The file is not a valid snapshot. Run the same command again to collect a fresh one.',
+    SNAPSHOT_TOO_LARGE: 'The snapshot is over the upload limit. Use the browser token mode on vigilbase.com instead.',
+    SNAPSHOT_STALE: 'Snapshots are accepted for 24 hours. Run the same command again to collect a fresh one.',
+    SNAPSHOT_SECRET_LIKE_VALUE: 'The snapshot contains a value that looks like a credential. Remove it from the Cloudflare rule description or name, then run the same command again.',
+    EMAIL_INVALID: 'Use your work email address (personal and disposable addresses are not accepted), then run the same command again.',
+    EMAIL_CODE_INVALID: 'Run the same command again to get a new code, and enter the 6 digits from the newest email.',
+    VERIFICATION_INVALID: 'Run the same command again to get a new code by email.',
+    VERIFICATION_EXPIRED: 'Run the same command again to get a new code by email, and enter it before the time shown.',
+    SESSION_INVALID: 'Run the same command again to verify your email and start a new checkup.',
+    SESSION_EXPIRED: 'Run the same command again to verify your email and start a new checkup.',
+    SESSION_USED: 'This checkup already has results. Run the same command again to start a new checkup.',
+    SESSION_BUSY: 'A snapshot for this checkup is still being processed. Wait for the results email, or run the same command again to start a new checkup.',
+    SESSION_CLOSED: 'This checkup was cancelled or has expired. Run the same command again to start a new one.',
+    SUBMIT_ORIGIN_UNTRUSTED: 'Upload only to https://vigilbase.com (or a loopback origin for local testing).',
+    CONFIRMATION_REQUIRED: 'Run the command in a terminal to confirm the upload, or add --yes.',
+    CLI_UPGRADE_REQUIRED: 'Run `npx @vigilbase/cli@latest cloudflare-checkup`, or upgrade with `npm install --global @vigilbase/cli@latest`.',
+    LOCAL_MODE_DISABLED: 'Local checkups are temporarily unavailable. Use the browser token mode on vigilbase.com, or try later.',
+    VIGILBASE_RATE_LIMITED: 'Too many requests to vigilbase.com. Wait as long as the error says (a few minutes if it says nothing), then run the same command again.',
+    VIGILBASE_CHALLENGED: 'vigilbase.com asked for a browser challenge. Try another network, or contact help@vigilbase.com.',
+    SUBMIT_FAILED: 'Run the same command again in a few minutes. If it persists, contact help@vigilbase.com.',
+};
+/**
+ * CF_AUTH_REQUIRED in env mode (`--cf-auth env`, or `auto` with the variable
+ * set): the browser sign-in is never offered while the token is used, so the
+ * hint names both ways out.
+ */
+export const ENV_TOKEN_AUTH_HINT = `Set ${CF_TOKEN_ENV} in this shell to a valid read-only Cloudflare API token (read -rs ${CF_TOKEN_ENV} && export ${CF_TOKEN_ENV}) and run the same command again, or unset it (or use --cf-auth profile) to sign in with your browser instead.`;
+/** CF_PERMISSION_DENIED in env mode: the token lacks a read permission; the browser sign-in is the other way out. */
+export const ENV_TOKEN_PERMISSION_HINT = `The API token in ${CF_TOKEN_ENV} cannot read everything the checkup needs. Add the read permissions to it, or unset it (or use --cf-auth profile) to sign in with your browser instead, then run the same command again.`;
+export class LocalCheckupError extends Error {
+    code;
+    hint;
+    /** HTTP status of the Cloudflare or Vigilbase response, when one caused the error. */
+    status;
+    retryAfterSec;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = 'LocalCheckupError';
+        this.code = code;
+        this.hint = options.hint ?? LOCAL_ERROR_HINTS[code];
+        if (options.status !== undefined)
+            this.status = options.status;
+        if (options.retryAfterSec !== undefined)
+            this.retryAfterSec = options.retryAfterSec;
+    }
+    /** Mapped to exit code 2 by `runCli`. */
+    get isRateLimited() {
+        return this.code === 'CF_RATE_LIMITED' || this.code === 'VIGILBASE_RATE_LIMITED';
+    }
+}
+export function isLocalCheckupError(error) {
+    return error instanceof LocalCheckupError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/local/cloudflare-checkup/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,uBAAuB;IACxG,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,UAAU;IAC9F,UAAU;IACV,4BAA4B,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB;IAC5F,sBAAsB;IACtB,eAAe,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,4BAA4B;IACzG,qBAAqB;IACrB,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB;IACrF,UAAU;IACV,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACtF,aAAa;IACb,yBAAyB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,qBAAqB;IACjG,wBAAwB,EAAE,sBAAsB,EAAE,eAAe;CACzD,CAAA;AAGV,MAAM,UAAU,GAAG,yCAAyC,CAAA;AAE5D,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAA0C;IACtE,gBAAgB,EAAE,wHAAwH;IAC1I,YAAY,EAAE,yIAAyI,UAAU,GAAG;IACpK,eAAe,EAAE,2MAA2M;IAC5N,sBAAsB,EAAE,2HAA2H,UAAU,GAAG;IAChK,uGAAuG;IACvG,qBAAqB,EAAE,0LAA0L;IACjN,iBAAiB,EAAE,4BAA4B,UAAU,oCAAoC;IAC7F,gBAAgB,EAAE,oGAAoG,YAAY,uBAAuB;IACzJ,oBAAoB,EAAE,kHAAkH;IACxI,eAAe,EAAE,oIAAoI;IACrJ,QAAQ,EAAE,0FAA0F;IACpG,0BAA0B,EAAE,8HAA8H;IAC1J,mBAAmB,EAAE,sGAAsG;IAC3H,iBAAiB,EAAE,iGAAiG;IACpH,gBAAgB,EAAE,6HAA6H;IAC/I,aAAa,EAAE,qEAAqE;IACpF,gBAAgB,EAAE,sFAAsF;IACxG,kBAAkB,EAAE,6FAA6F;IACjH,cAAc,EAAE,yFAAyF;IACzG,0BAA0B,EAAE,sJAAsJ;IAClL,aAAa,EAAE,oHAAoH;IACnI,kBAAkB,EAAE,6FAA6F;IACjH,oBAAoB,EAAE,wDAAwD;IAC9E,oBAAoB,EAAE,4FAA4F;IAClH,eAAe,EAAE,0EAA0E;IAC3F,eAAe,EAAE,0EAA0E;IAC3F,YAAY,EAAE,sFAAsF;IACpG,YAAY,EAAE,yIAAyI;IACvJ,cAAc,EAAE,2FAA2F;IAC3G,uBAAuB,EAAE,gFAAgF;IACzG,qBAAqB,EAAE,oEAAoE;IAC3F,oBAAoB,EAAE,mHAAmH;IACzI,mBAAmB,EAAE,wGAAwG;IAC7H,sBAAsB,EAAE,yIAAyI;IACjK,oBAAoB,EAAE,kGAAkG;IACxH,aAAa,EAAE,0FAA0F;CAC1G,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,YAAY,sEAAsE,YAAY,cAAc,YAAY,gHAAgH,CAAA;AAElR,qHAAqH;AACrH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,YAAY,0LAA0L,CAAA;AAEnQ,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAuB;IAC3B,IAAI,CAAQ;IACrB,sFAAsF;IAC7E,MAAM,CAAS;IACf,aAAa,CAAS;IAE/B,YAAY,IAA2B,EAAE,OAAe,EAAE,UAAsE,EAAE;QAChI,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC9D,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IACrF,CAAC;IAED,yCAAyC;IACzC,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAA;IAClF,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,KAAK,YAAY,iBAAiB,CAAA;AAC3C,CAAC"}

package/dist/local/cloudflare-checkup/output.d.ts

@@ -0,0 +1,24 @@
+import type { EntryCounts } from './snapshot-file.js';
+/**
+ * Untrusted single-line text (account names from cf): controls and line
+ * breaks collapsed, length bounded. The terminal UI passes its `ellipsis`
+ * (`...` on an ASCII-only console).
+ */
+export declare function displayText(value: string, max: number, ellipsis?: string): string;
+/** `0123…cdef` (`0123...cdef` with the ASCII `ellipsis` of the terminal UI). */
+export declare function maskId(id: string, ellipsis?: string): string;
+/** `9f2c…a71e` */
+export declare function shortSha(sha256: string): string;
+export declare function formatBytes(bytes: number): string;
+/** Local `HH:MM` for an ISO timestamp. */
+export declare function formatClock(iso: string): string;
+export declare function formatDuration(seconds: number): string;
+/** `3 reads denied (HTTP 403) · 60 reads not collectable with cf` */
+export declare function readsSummary(counts: EntryCounts, denied: number): string;
+export type CountsProgress = {
+    update(text: string): void;
+    stop(): void;
+};
+/** A single updating stderr line, or nothing when progress is disabled. */
+export declare function startCountsProgress(enabled: boolean, stream?: NodeJS.WritableStream): CountsProgress;
+//# sourceMappingURL=output.d.ts.map

package/dist/local/cloudflare-checkup/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/output.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIrD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAG9E;AAED,gFAAgF;AAChF,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAEzD;AAED,kBAAkB;AAClB,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQxE;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,IAAI,IAAI,IAAI,CAAA;CACb,CAAA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,GAAE,MAAM,CAAC,cAA+B,GAAG,cAAc,CA0BpH"}

package/dist/local/cloudflare-checkup/output.js

@@ -0,0 +1,89 @@
+/**
+ * Terminal formatting for local checkups. Progress shows counts only, never
+ * account or zone names, and is written to stderr. Every other line goes
+ * through the CLI writer, which strips terminal controls from untrusted text.
+ */
+import { sanitizeTerminal } from '../../lib/format.js';
+const SPINNER = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+/**
+ * Untrusted single-line text (account names from cf): controls and line
+ * breaks collapsed, length bounded. The terminal UI passes its `ellipsis`
+ * (`...` on an ASCII-only console).
+ */
+export function displayText(value, max, ellipsis = '…') {
+    const flat = sanitizeTerminal(value.replace(/[\s\u0085\u2028\u2029]+/g, ' ')).trim();
+    return flat.length > max ? `${flat.slice(0, Math.max(0, max - ellipsis.length))}${ellipsis}` : flat;
+}
+/** `0123…cdef` (`0123...cdef` with the ASCII `ellipsis` of the terminal UI). */
+export function maskId(id, ellipsis = '…') {
+    return id.length > 8 ? `${id.slice(0, 4)}${ellipsis}${id.slice(-4)}` : id;
+}
+/** `9f2c…a71e` */
+export function shortSha(sha256) {
+    return `${sha256.slice(0, 4)}…${sha256.slice(-4)}`;
+}
+export function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${Math.max(1, Math.round(bytes / 1024))} KB`;
+    return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+/** Local `HH:MM` for an ISO timestamp. */
+export function formatClock(iso) {
+    const date = new Date(iso);
+    if (Number.isNaN(date.getTime()))
+        return iso;
+    return `${String(date.getHours()).padStart(2, '0')}:${String(date.getMinutes()).padStart(2, '0')}`;
+}
+export function formatDuration(seconds) {
+    if (seconds < 90)
+        return `~${Math.max(1, Math.round(seconds))} s`;
+    return `~${Math.round(seconds / 60)} min`;
+}
+/** `3 reads denied (HTTP 403) · 60 reads not collectable with cf` */
+export function readsSummary(counts, denied) {
+    const parts = [];
+    if (denied > 0)
+        parts.push(`${denied} ${denied === 1 ? 'read' : 'reads'} denied (HTTP 403)`);
+    const otherHttp = counts.httpError - denied;
+    if (otherHttp > 0)
+        parts.push(`${otherHttp} ${otherHttp === 1 ? 'read' : 'reads'} failed with another HTTP error`);
+    if (counts.collectionFailed > 0)
+        parts.push(`${counts.collectionFailed} ${counts.collectionFailed === 1 ? 'read' : 'reads'} could not be collected`);
+    if (counts.notCollected > 0)
+        parts.push(`${counts.notCollected} reads not collectable with cf`);
+    return parts.join(' · ');
+}
+/** A single updating stderr line, or nothing when progress is disabled. */
+export function startCountsProgress(enabled, stream = process.stderr) {
+    if (!enabled)
+        return { update: () => undefined, stop: () => undefined };
+    let text = '';
+    let frame = 0;
+    let closed = false;
+    let width = 0;
+    const draw = () => {
+        if (closed)
+            return;
+        const line = `${SPINNER[frame++ % SPINNER.length]} ${sanitizeTerminal(text).replace(/[\n\t]/g, ' ')}`;
+        width = Math.max(width, line.length);
+        stream.write(`\r${line.padEnd(width)}`);
+    };
+    const timer = setInterval(draw, 80);
+    timer.unref?.();
+    return {
+        update(next) {
+            text = next;
+            draw();
+        },
+        stop() {
+            if (closed)
+                return;
+            closed = true;
+            clearInterval(timer);
+            stream.write(`\r${' '.repeat(width)}\r`);
+        },
+    };
+}
+//# sourceMappingURL=output.js.map

package/dist/local/cloudflare-checkup/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAGtD,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAA;AAE3E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,GAAW,EAAE,QAAQ,GAAG,GAAG;IACpE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpF,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACrG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,MAAM,CAAC,EAAU,EAAE,QAAQ,GAAG,GAAG;IAC/C,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,IAAI,CAAA;IACrC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;IAC7E,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AACjD,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAA;IAC5C,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;AACpG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAA;IACjE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAA;AAC3C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAA;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAA;IAC3C,IAAI,SAAS,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,iCAAiC,CAAC,CAAA;IAClH,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,yBAAyB,CAAC,CAAA;IACpJ,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,gCAAgC,CAAC,CAAA;IAC/F,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAOD,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,SAAgC,OAAO,CAAC,MAAM;IAClG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAA;IACvE,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,MAAM;YAAE,OAAM;QAClB,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAA;QACrG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACnC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACf,OAAO;QACL,MAAM,CAAC,IAAI;YACT,IAAI,GAAG,IAAI,CAAA;YACX,IAAI,EAAE,CAAA;QACR,CAAC;QACD,IAAI;YACF,IAAI,MAAM;gBAAE,OAAM;YAClB,MAAM,GAAG,IAAI,CAAA;YACb,aAAa,CAAC,KAAK,CAAC,CAAA;YACpB,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1C,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/local/cloudflare-checkup/prompts.d.ts

@@ -0,0 +1,41 @@
+/** One piped answer is at most this long (an email address is at most 254 bytes). */
+export declare const MAX_ANSWER_BYTES = 256;
+export type PromptIO = {
+    stdin?: NodeJS.ReadableStream;
+    stderr: NodeJS.WritableStream;
+};
+export declare function hasInteractiveInput(stdin: NodeJS.ReadableStream | undefined): boolean;
+/**
+ * A visible one-line prompt on a TTY (account picker, confirmations): the
+ * trimmed answer, or null when the input ended (Ctrl-D) before one.
+ */
+export declare function promptLine(io: PromptIO, label: string): Promise<string | null>;
+/**
+ * One line of piped input, without consuming the next one: whatever follows
+ * the newline is pushed back onto the stream for the next prompt. Bytes past
+ * `MAX_ANSWER_BYTES` are dropped up to the newline, so an overlong line comes
+ * back too long and fails validation. Null at the end of the input.
+ */
+export declare function readPipedLine(stdin: NodeJS.ReadableStream): Promise<string | null>;
+/**
+ * A visible prompt for the email verification. On a terminal it is
+ * `promptLine`; without one the label still goes to stderr and the answer is
+ * one line of piped stdin. Null when the input ended without an answer.
+ */
+export declare function promptAnswer(io: PromptIO, label: string): Promise<string | null>;
+/**
+ * `[y/N]` upload confirmation: an explicit `y` is required. `--yes` (or its
+ * alias `--confirm`) answers yes; without a terminal and without them it is
+ * CONFIRMATION_REQUIRED.
+ */
+export declare function confirmUpload(io: PromptIO, question: string, options: {
+    isConfirmed: boolean;
+    flag?: string;
+}): Promise<boolean>;
+/**
+ * `[Y/n]` question where Enter means yes (installing cf). The caller handles
+ * `--yes` and the no-terminal case; an input that ends before an answer is
+ * CONFIRMATION_REQUIRED.
+ */
+export declare function confirmDefaultYes(io: PromptIO, question: string): Promise<boolean>;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/local/cloudflare-checkup/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/prompts.ts"],"names":[],"mappings":"AAcA,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;IAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAA;CAC9B,CAAA;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,SAAS,GAAG,OAAO,CAErF;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBpF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiClF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOtF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAWtI;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIxF"}

package/dist/local/cloudflare-checkup/prompts.js

@@ -0,0 +1,140 @@
+/**
+ * Prompts and confirmations of local checkups.
+ *
+ * Every prompt goes to stderr, so `--json` keeps stdout one JSON object. On a
+ * terminal, answers are typed at a visible prompt. Without one, only the email
+ * verification reads its answers (the work email without `--email`, and the
+ * emailed code) from piped stdin, one line each, so a script can write the code
+ * once it sees the prompt; every other question needs a flag (`--yes`,
+ * `--account-id`). What is read is never echoed in errors.
+ */
+import { createInterface } from 'node:readline/promises';
+import { LocalCheckupError } from './errors.js';
+/** One piped answer is at most this long (an email address is at most 254 bytes). */
+export const MAX_ANSWER_BYTES = 256;
+function isTty(stream) {
+    return Boolean(stream && stream.isTTY);
+}
+export function hasInteractiveInput(stdin) {
+    return isTty(stdin);
+}
+/**
+ * A visible one-line prompt on a TTY (account picker, confirmations): the
+ * trimmed answer, or null when the input ended (Ctrl-D) before one.
+ */
+export async function promptLine(io, label) {
+    if (!isTty(io.stdin)) {
+        throw new LocalCheckupError('CONFIRMATION_REQUIRED', 'No terminal is available for this prompt.', { hint: 'Run the command in a terminal, or pass the answer as a flag (--account-id, --yes).' });
+    }
+    if (io.stdin.readableEnded)
+        return null;
+    const rl = createInterface({ input: io.stdin, output: io.stderr, terminal: false });
+    // readline's question() never settles once the input ends; the interface's 'close' does.
+    const ended = new Promise((resolve) => rl.once('close', () => resolve(null)));
+    try {
+        const answer = await Promise.race([rl.question(label).catch(() => null), ended]);
+        if (answer !== null)
+            return answer.trim();
+        // Ctrl-D leaves the cursor on the prompt line.
+        io.stderr.write('\n');
+        return null;
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * One line of piped input, without consuming the next one: whatever follows
+ * the newline is pushed back onto the stream for the next prompt. Bytes past
+ * `MAX_ANSWER_BYTES` are dropped up to the newline, so an overlong line comes
+ * back too long and fails validation. Null at the end of the input.
+ */
+export function readPipedLine(stdin) {
+    const stream = stdin;
+    if (stream.readableEnded)
+        return Promise.resolve(null);
+    return new Promise((resolve, reject) => {
+        let kept = Buffer.alloc(0);
+        let settled = false;
+        const finish = (error, line, rest) => {
+            if (settled)
+                return;
+            settled = true;
+            stream.removeListener('readable', onReadable);
+            stream.removeListener('end', onEnd);
+            stream.removeListener('error', onError);
+            if (rest && rest.byteLength > 0)
+                stream.unshift(rest);
+            if (error)
+                reject(error);
+            else
+                resolve(line === null ? null : line.toString('utf8').replace(/\r$/, ''));
+        };
+        const onReadable = () => {
+            let chunk;
+            while (!settled && (chunk = stream.read()) !== null) {
+                const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+                const newline = bytes.indexOf(0x0a);
+                const head = newline >= 0 ? bytes.subarray(0, newline) : bytes;
+                if (kept.byteLength <= MAX_ANSWER_BYTES)
+                    kept = Buffer.concat([kept, head.subarray(0, MAX_ANSWER_BYTES + 1 - kept.byteLength)]);
+                if (newline >= 0)
+                    finish(null, kept, bytes.subarray(newline + 1));
+            }
+        };
+        const onEnd = () => finish(null, kept.byteLength > 0 ? kept : null);
+        const onError = (error) => finish(error, null);
+        stream.on('readable', onReadable);
+        stream.on('end', onEnd);
+        stream.on('error', onError);
+        onReadable();
+    });
+}
+/**
+ * A visible prompt for the email verification. On a terminal it is
+ * `promptLine`; without one the label still goes to stderr and the answer is
+ * one line of piped stdin. Null when the input ended without an answer.
+ */
+export async function promptAnswer(io, label) {
+    if (isTty(io.stdin))
+        return promptLine(io, label);
+    io.stderr.write(label);
+    const line = io.stdin ? await readPipedLine(io.stdin) : null;
+    // A piped answer is not echoed by a terminal; end the prompt line.
+    io.stderr.write('\n');
+    return line === null ? null : line.trim();
+}
+/**
+ * `[y/N]` upload confirmation: an explicit `y` is required. `--yes` (or its
+ * alias `--confirm`) answers yes; without a terminal and without them it is
+ * CONFIRMATION_REQUIRED.
+ */
+export async function confirmUpload(io, question, options) {
+    if (options.isConfirmed) {
+        io.stderr.write(`${question} [y/N] y (${options.flag ?? '--yes'})\n`);
+        return true;
+    }
+    if (!isTty(io.stdin)) {
+        throw new LocalCheckupError('CONFIRMATION_REQUIRED', 'Uploading needs confirmation, and no terminal is available to ask.');
+    }
+    const answer = await promptLine(io, `${question} [y/N] `);
+    if (answer === null)
+        throw inputEnded('Uploading needs confirmation, and the input ended before an answer.');
+    return /^y(?:es)?$/i.test(answer);
+}
+/**
+ * `[Y/n]` question where Enter means yes (installing cf). The caller handles
+ * `--yes` and the no-terminal case; an input that ends before an answer is
+ * CONFIRMATION_REQUIRED.
+ */
+export async function confirmDefaultYes(io, question) {
+    const answer = await promptLine(io, `${question} [Y/n] `);
+    if (answer === null)
+        throw inputEnded('The question needs an answer, and the input ended before one.');
+    return answer === '' || /^y(?:es)?$/i.test(answer);
+}
+/** Ctrl-D at a confirmation: nothing was confirmed. */
+function inputEnded(message) {
+    return new LocalCheckupError('CONFIRMATION_REQUIRED', message, { hint: 'Run the same command again and answer the question, or add --yes.' });
+}
+//# sourceMappingURL=prompts.js.map

package/dist/local/cloudflare-checkup/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AASnC,SAAS,KAAK,CAAC,MAAyC;IACtD,OAAO,OAAO,CAAC,MAAM,IAAK,MAAmB,CAAC,KAAK,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAwC;IAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAY,EAAE,KAAa;IAC1D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE,2CAA2C,EAAE,EAAE,IAAI,EAAE,oFAAoF,EAAE,CAAC,CAAA;IACnM,CAAC;IACD,IAAK,EAAE,CAAC,KAAkB,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACnF,yFAAyF;IACzF,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;QAChF,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;QACzC,+CAA+C;QAC/C,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAA4B;IACxD,MAAM,MAAM,GAAG,KAAiB,CAAA;IAChC,IAAI,MAAM,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,IAAmB,EAAE,IAAa,EAAE,EAAE;YACzE,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAC7C,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACnC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;gBAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACrD,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBACnB,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,CAAC,CAAA;QACD,MAAM,UAAU,GAAG,GAAG,EAAE;YACtB,IAAI,KAAc,CAAA;YAClB,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;gBACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACnC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9D,IAAI,IAAI,CAAC,UAAU,IAAI,gBAAgB;oBAAE,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;gBAC/H,IAAI,OAAO,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;YACnE,CAAC;QACH,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3B,UAAU,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,KAAa;IAC5D,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IACjD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,mEAAmE;IACnE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACrB,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,QAAgB,EAAE,OAAgD;IAClH,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,aAAa,OAAO,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,CAAA;QACrE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE,oEAAoE,CAAC,CAAA;IAC5H,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,QAAQ,SAAS,CAAC,CAAA;IACzD,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,UAAU,CAAC,qEAAqE,CAAC,CAAA;IAC5G,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,QAAQ,SAAS,CAAC,CAAA;IACzD,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,UAAU,CAAC,+DAA+D,CAAC,CAAA;IACtG,OAAO,MAAM,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED,uDAAuD;AACvD,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,iBAAiB,CAAC,uBAAuB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,mEAAmE,EAAE,CAAC,CAAA;AAC/I,CAAC"}

package/dist/local/cloudflare-checkup/rate-budget.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Cloudflare request budget (spec §F5).
+ *
+ * Cloudflare allows 1,200 API requests per user per rolling 5 minutes, shared
+ * with the user's dashboard; going over blocks every API call for 5 minutes.
+ * The default spends at most 900 per rolling 5 minutes (configurable 100 to
+ * 1,100). A token bucket with capacity `burst` that refills at
+ * `(limit − burst) / 300 s` never admits more than `limit` calls in any
+ * 300-second window: at most `burst` from the full bucket plus the refill.
+ * Local `--version` and `--dry-run` calls are free.
+ */
+export declare const DEFAULT_REQUESTS_PER_5MIN = 900;
+export declare const MIN_REQUESTS_PER_5MIN = 100;
+export declare const MAX_REQUESTS_PER_5MIN = 1100;
+export declare const BUDGET_BURST = 8;
+export declare const BUDGET_WINDOW_MS = 300000;
+export type Clock = {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+};
+export declare const systemClock: Clock;
+export declare function parseRequestBudget(raw: string | undefined): number;
+export declare class RequestBudget {
+    readonly limit: number;
+    private readonly clock;
+    readonly burst: number;
+    private tokens;
+    private updatedAt;
+    private readonly refillPerMs;
+    private queue;
+    constructor(limit?: number, clock?: Clock, burst?: number);
+    private refill;
+    /** Tokens available now (fractional). */
+    available(): number;
+    /** Wait for one request slot. Callers are served in order. */
+    acquire(): Promise<void>;
+    /** Seconds the bucket needs for `requests` calls, ignoring network latency. */
+    estimateSeconds(requests: number): number;
+}
+/** Seconds a full bucket needs to admit `requests` calls at `limit` per 5 minutes. */
+export declare function estimateBudgetSeconds(limit: number, requests: number, burst?: number): number;
+//# sourceMappingURL=rate-budget.d.ts.map

package/dist/local/cloudflare-checkup/rate-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-budget.d.ts","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/rate-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAA;AACxC,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAC1C,eAAO,MAAM,YAAY,IAAI,CAAA;AAC7B,eAAO,MAAM,gBAAgB,SAAU,CAAA;AAEvC,MAAM,MAAM,KAAK,GAAG;IAClB,GAAG,IAAI,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjC,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,KAGzB,CAAA;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAOlE;AAED,qBAAa,aAAa;IAMZ,QAAQ,CAAC,KAAK,EAAE,MAAM;IAA8B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAuB,QAAQ,CAAC,KAAK,EAAE,MAAM;IALnI,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,KAAK,CAAmC;gBAE3B,KAAK,GAAE,MAAkC,EAAmB,KAAK,GAAE,KAAmB,EAAW,KAAK,GAAE,MAAqB;IAOlJ,OAAO,CAAC,MAAM;IAMd,yCAAyC;IACzC,SAAS,IAAI,MAAM;IAKnB,8DAA8D;IAC9D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAaxB,+EAA+E;IAC/E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAG1C;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,MAAqB,GAAG,MAAM,CAE3G"}

package/dist/local/cloudflare-checkup/rate-budget.js

@@ -0,0 +1,80 @@
+/**
+ * Cloudflare request budget (spec §F5).
+ *
+ * Cloudflare allows 1,200 API requests per user per rolling 5 minutes, shared
+ * with the user's dashboard; going over blocks every API call for 5 minutes.
+ * The default spends at most 900 per rolling 5 minutes (configurable 100 to
+ * 1,100). A token bucket with capacity `burst` that refills at
+ * `(limit − burst) / 300 s` never admits more than `limit` calls in any
+ * 300-second window: at most `burst` from the full bucket plus the refill.
+ * Local `--version` and `--dry-run` calls are free.
+ */
+export const DEFAULT_REQUESTS_PER_5MIN = 900;
+export const MIN_REQUESTS_PER_5MIN = 100;
+export const MAX_REQUESTS_PER_5MIN = 1_100;
+export const BUDGET_BURST = 8;
+export const BUDGET_WINDOW_MS = 300_000;
+export const systemClock = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
+export function parseRequestBudget(raw) {
+    if (raw === undefined)
+        return DEFAULT_REQUESTS_PER_5MIN;
+    const value = Number(raw);
+    if (!/^\d+$/.test(raw) || !Number.isSafeInteger(value) || value < MIN_REQUESTS_PER_5MIN || value > MAX_REQUESTS_PER_5MIN) {
+        throw new Error(`--max-requests-per-5min must be an integer between ${MIN_REQUESTS_PER_5MIN} and ${MAX_REQUESTS_PER_5MIN}.`);
+    }
+    return value;
+}
+export class RequestBudget {
+    limit;
+    clock;
+    burst;
+    tokens;
+    updatedAt;
+    refillPerMs;
+    queue = Promise.resolve();
+    constructor(limit = DEFAULT_REQUESTS_PER_5MIN, clock = systemClock, burst = BUDGET_BURST) {
+        this.limit = limit;
+        this.clock = clock;
+        this.burst = burst;
+        if (!(limit > burst))
+            throw new Error('The request budget must exceed the burst size.');
+        this.tokens = burst;
+        this.updatedAt = clock.now();
+        this.refillPerMs = (limit - burst) / BUDGET_WINDOW_MS;
+    }
+    refill() {
+        const now = this.clock.now();
+        this.tokens = Math.min(this.burst, this.tokens + (now - this.updatedAt) * this.refillPerMs);
+        this.updatedAt = now;
+    }
+    /** Tokens available now (fractional). */
+    available() {
+        this.refill();
+        return this.tokens;
+    }
+    /** Wait for one request slot. Callers are served in order. */
+    acquire() {
+        const next = this.queue.then(async () => {
+            this.refill();
+            while (this.tokens < 1) {
+                await this.clock.sleep(Math.max(1, Math.ceil((1 - this.tokens) / this.refillPerMs)));
+                this.refill();
+            }
+            this.tokens -= 1;
+        });
+        this.queue = next.catch(() => undefined);
+        return next;
+    }
+    /** Seconds the bucket needs for `requests` calls, ignoring network latency. */
+    estimateSeconds(requests) {
+        return estimateBudgetSeconds(this.limit, requests, this.burst);
+    }
+}
+/** Seconds a full bucket needs to admit `requests` calls at `limit` per 5 minutes. */
+export function estimateBudgetSeconds(limit, requests, burst = BUDGET_BURST) {
+    return Math.max(0, ((requests - burst) * BUDGET_WINDOW_MS) / (limit - burst) / 1000);
+}
+//# sourceMappingURL=rate-budget.js.map

package/dist/local/cloudflare-checkup/rate-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-budget.js","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/rate-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAA;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAA;AAC7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAOvC,MAAM,CAAC,MAAM,WAAW,GAAU;IAChC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CACjE,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,yBAAyB,CAAA;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,qBAAqB,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACzH,MAAM,IAAI,KAAK,CAAC,sDAAsD,qBAAqB,QAAQ,qBAAqB,GAAG,CAAC,CAAA;IAC9H,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,OAAO,aAAa;IAMH;IAA4D;IAAqC;IAL9G,MAAM,CAAQ;IACd,SAAS,CAAQ;IACR,WAAW,CAAQ;IAC5B,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAEhD,YAAqB,QAAgB,yBAAyB,EAAmB,QAAe,WAAW,EAAW,QAAgB,YAAY;QAA7H,UAAK,GAAL,KAAK,CAAoC;QAAmB,UAAK,GAAL,KAAK,CAAqB;QAAW,UAAK,GAAL,KAAK,CAAuB;QAChJ,IAAI,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACvF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5B,IAAI,CAAC,WAAW,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAA;IACvD,CAAC;IAEO,MAAM;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;QAC3F,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;IACtB,CAAC;IAED,yCAAyC;IACzC,SAAS;QACP,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,8DAA8D;IAC9D,OAAO;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC,MAAM,EAAE,CAAA;YACb,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;gBACpF,IAAI,CAAC,MAAM,EAAE,CAAA;YACf,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;QAClB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+EAA+E;IAC/E,eAAe,CAAC,QAAgB;QAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAgB,YAAY;IACjG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAA;AACtF,CAAC"}

package/dist/local/cloudflare-checkup/snapshot-file.d.ts

@@ -0,0 +1,53 @@
+import { type CloudflareCheckupSnapshotV1, type SnapshotEntry } from './contract.js';
+import { LocalCheckupError } from './errors.js';
+export declare function sha256Hex(bytes: Uint8Array | string): string;
+/** Write the snapshot; refuses an existing file unless `overwrite` (atomic rename). */
+export declare function writeSnapshotFile(path: string, text: string, options: {
+    overwrite: boolean;
+}): Promise<{
+    bytes: number;
+    sha256: string;
+}>;
+export type LoadedSnapshot = {
+    path: string;
+    bytes: Buffer;
+    sha256: string;
+    snapshot: CloudflareCheckupSnapshotV1;
+};
+/** Map a failed contract parse to the CLI error (no values, issue codes only). */
+export declare function snapshotParseError(issues: ReadonlyArray<{
+    code?: string;
+    message?: string;
+    path?: ReadonlyArray<PropertyKey>;
+    params?: unknown;
+}>): LocalCheckupError;
+/** Read, hash and validate a snapshot file against the vendored contract. */
+export declare function loadSnapshotFile(path: string): Promise<LoadedSnapshot>;
+export type EntryCounts = {
+    total: number;
+    ok: number;
+    httpError: number;
+    notCollected: number;
+    collectionFailed: number;
+};
+export declare function countEntries(entries: readonly SnapshotEntry[]): EntryCounts;
+export type EntryKindCounts = Record<string, {
+    total: number;
+    ok: number;
+    httpError: number;
+    notCollected: number;
+    collectionFailed: number;
+}>;
+export declare function countEntriesByKind(entries: readonly SnapshotEntry[]): EntryKindCounts;
+/** Counts of every free-text or identifying category the snapshot carries (`inspect`). */
+export type DataCategories = {
+    memberEmails: number;
+    accessRuleValues: number;
+    dnsHostnames: number;
+    pseudonymizedIps: number;
+    ruleDescriptions: number;
+};
+export declare function dataCategories(snapshot: CloudflareCheckupSnapshotV1): DataCategories;
+export declare function zoneCount(snapshot: CloudflareCheckupSnapshotV1): number;
+export declare function accountName(snapshot: CloudflareCheckupSnapshotV1): string | null;
+//# sourceMappingURL=snapshot-file.d.ts.map

package/dist/local/cloudflare-checkup/snapshot-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-file.d.ts","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/snapshot-file.ts"],"names":[],"mappings":"AAcA,OAAO,EAOL,KAAK,2BAA2B,EAChC,KAAK,aAAa,EACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAE5D;AAiCD,uFAAuF;AACvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB/I;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,2BAA2B,CAAA;CACtC,CAAA;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,iBAAiB,CAOrK;AAED,6EAA6E;AAC7E,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB5E;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1H,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,WAAW,CAU3E;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAE9I,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,eAAe,CAarF;AAED,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,2BAA2B,GAAG,cAAc,CA4BpF;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,CAGvE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,GAAG,IAAI,CAGhF"}