@we8/cloudflare 0.1.2 → 0.2.0

package/dist/jwt.js

@@ -0,0 +1,265 @@
+/**
+ * RS256 verification for a Cloudflare Access assertion, on WebCrypto.
+ *
+ * Access signs its assertion with the team's own key and publishes the public
+ * half as a JWKS at `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`.
+ * Verifying it is four checks: the signature against that key, the issuer, the
+ * audience, and the clock. All four have to pass, and a token that fails any of
+ * them is refused rather than downgraded.
+ *
+ * Written against WebCrypto rather than pulled from a JWT library on purpose.
+ * `@we8/cloudflare` has no runtime dependencies, this runs on Workers where
+ * `crypto.subtle` is the platform, and the whole verification is small enough
+ * to read in one sitting, which is the property that matters most in the file
+ * that decides who administers a site.
+ *
+ * Everything here fails CLOSED. An unreadable token, an unknown key, an
+ * unreachable JWKS endpoint, and an algorithm this file does not implement all
+ * produce a refusal, never an admission.
+ */
+/**
+ * The one signature algorithm accepted.
+ *
+ * Pinned rather than read from the token's own header, because "which
+ * algorithm" being a field the attacker controls is the classic JWT forgery:
+ * `alg: none` and an HS256 token signed with the public key are both defeated
+ * by refusing to look at anything but RS256.
+ */
+export const ACCESS_JWT_ALGORITHM = 'RS256';
+/**
+ * How long a fetched key set is used before it is fetched again. Access
+ * rotates keys, and an hour is short enough to pick a rotation up quickly and
+ * long enough that the endpoint is not in the path of every admin request.
+ */
+export const JWKS_TTL_MS = 60 * 60 * 1000;
+/**
+ * The shortest gap between two fetches provoked by an unknown key id. Without
+ * it, a stream of forged tokens carrying invented `kid` values would turn into
+ * a stream of requests to Cloudflare.
+ */
+export const JWKS_REFETCH_FLOOR_MS = 60 * 1000;
+/** A few seconds of tolerance, because two machines never agree exactly. */
+export const CLOCK_SKEW_SECONDS = 60;
+/**
+ * Module scope, deliberately: a Worker isolate serves many requests, and the
+ * key set is public, immutable while it lives, and identical for every request
+ * against the same team. This is the cache the doc comment above promises.
+ */
+const jwksCache = new Map();
+/** Drops every cached key set. Tests use it; nothing in the request path does. */
+export function clearJwksCache() {
+    jwksCache.clear();
+}
+/** True for a segment that is legal base64url. `atob` is laxer than that. */
+function isBase64Url(value) {
+    return value.length > 0 && /^[A-Za-z0-9_-]+$/.test(value);
+}
+/** base64url to bytes, or null when the input is not base64url at all. */
+export function base64UrlToBytes(value) {
+    if (!isBase64Url(value))
+        return null;
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/');
+    const remainder = padded.length % 4;
+    if (remainder === 1)
+        return null;
+    const full = remainder === 0 ? padded : padded + '='.repeat(4 - remainder);
+    try {
+        const binary = atob(full);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i += 1)
+            bytes[i] = binary.charCodeAt(i);
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
+/** A base64url JSON segment as an object, or null when it is neither. */
+function decodeJsonSegment(segment) {
+    const bytes = base64UrlToBytes(segment);
+    if (!bytes)
+        return null;
+    try {
+        const parsed = JSON.parse(new TextDecoder().decode(bytes));
+        return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Imports the RSA keys out of a JWKS document. A key this file cannot use (a
+ * different type, a different algorithm, a malformed modulus) is skipped
+ * rather than fatal: a key set is allowed to carry more than we understand.
+ */
+async function importJwks(document) {
+    const keys = new Map();
+    const list = typeof document === 'object' && document !== null
+        ? document.keys
+        : undefined;
+    if (!Array.isArray(list))
+        return keys;
+    for (const candidate of list) {
+        if (typeof candidate !== 'object' || candidate === null)
+            continue;
+        const { kid, kty, alg, n, e } = candidate;
+        if (typeof kid !== 'string' || kid.length === 0)
+            continue;
+        if (kty !== 'RSA')
+            continue;
+        if (alg !== undefined && alg !== ACCESS_JWT_ALGORITHM)
+            continue;
+        if (typeof n !== 'string' || typeof e !== 'string')
+            continue;
+        try {
+            const key = await crypto.subtle.importKey('jwk', { kty: 'RSA', alg: ACCESS_JWT_ALGORITHM, use: 'sig', n, e, ext: true }, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+            keys.set(kid, key);
+        }
+        catch {
+            // A key that will not import cannot verify anything. Skip it.
+        }
+    }
+    return keys;
+}
+async function fetchJwks(entry, certsUrl, fetchImpl, now) {
+    entry.attemptedAt = now;
+    try {
+        const response = await fetchImpl(certsUrl, { headers: { Accept: 'application/json' } });
+        if (!response.ok) {
+            console.error(`[access] ${certsUrl} answered ${String(response.status)}`);
+            return;
+        }
+        const document = await response.json();
+        const keys = await importJwks(document);
+        if (keys.size === 0) {
+            console.error(`[access] ${certsUrl} carried no usable RS256 keys`);
+            return;
+        }
+        entry.keys = keys;
+        entry.fetchedAt = now;
+    }
+    catch (error) {
+        console.error(`[access] could not read ${certsUrl}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * One fetch of the key set, with concurrent callers waiting on the same round
+ * trip rather than each opening their own.
+ */
+async function loadJwks(certsUrl, fetchImpl, now) {
+    const existing = jwksCache.get(certsUrl);
+    if (existing?.inflight) {
+        await existing.inflight;
+        return;
+    }
+    const entry = existing ?? {
+        keys: new Map(),
+        fetchedAt: 0,
+        attemptedAt: 0,
+        inflight: null,
+    };
+    jwksCache.set(certsUrl, entry);
+    const inflight = fetchJwks(entry, certsUrl, fetchImpl, now);
+    entry.inflight = inflight;
+    try {
+        await inflight;
+    }
+    finally {
+        entry.inflight = null;
+    }
+}
+/**
+ * The signing key for one key id, fetching the team's key set when the cached
+ * one cannot answer.
+ *
+ * A cached key stays usable while the set is fresh. Past that, or for a key id
+ * the set does not carry (which is what a rotation looks like), the endpoint is
+ * read again; a fetch that fails falls back to whatever was cached, because a
+ * transient outage at Cloudflare should not lock an operator out of their own
+ * admin, and refuses outright when there is nothing to fall back to.
+ */
+export async function accessSigningKey(certsUrl, kid, now, fetchImpl = fetch) {
+    const cached = jwksCache.get(certsUrl);
+    const fresh = cached !== undefined && now - cached.fetchedAt < JWKS_TTL_MS;
+    if (fresh && cached.keys.has(kid))
+        return cached.keys.get(kid);
+    // An unknown kid against a fresh set is either a rotation or a forgery. One
+    // refetch per floor tells the two apart without letting the second one
+    // become an outbound request per request.
+    if (cached && cached.inflight === null && now - cached.attemptedAt < JWKS_REFETCH_FLOOR_MS) {
+        return cached.keys.get(kid) ?? null;
+    }
+    await loadJwks(certsUrl, fetchImpl, now);
+    return jwksCache.get(certsUrl)?.keys.get(kid) ?? null;
+}
+/** True when `aud` (a string or an array, per the spec) contains `audience`. */
+export function audienceMatches(aud, audience) {
+    if (typeof aud === 'string')
+        return aud === audience;
+    if (Array.isArray(aud))
+        return aud.some((entry) => entry === audience);
+    return false;
+}
+/**
+ * Verifies an Access assertion end to end.
+ *
+ * Order matters only for what a log line says; every check is required, and the
+ * first failure is the reported one.
+ */
+export async function verifyAccessJwt(options) {
+    const { token, certsUrl, issuer, audience } = options;
+    const nowSeconds = options.now ?? Math.floor(Date.now() / 1000);
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return { ok: false, reason: 'not a three-part JWT' };
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const header = decodeJsonSegment(encodedHeader);
+    if (!header)
+        return { ok: false, reason: 'the header is not base64url JSON' };
+    if (header['alg'] !== ACCESS_JWT_ALGORITHM) {
+        return { ok: false, reason: `alg is ${JSON.stringify(header['alg'])}, not ${ACCESS_JWT_ALGORITHM}` };
+    }
+    const kid = header['kid'];
+    if (typeof kid !== 'string' || kid.length === 0) {
+        return { ok: false, reason: 'the header names no key id' };
+    }
+    const payload = decodeJsonSegment(encodedPayload);
+    if (!payload)
+        return { ok: false, reason: 'the payload is not base64url JSON' };
+    const signature = base64UrlToBytes(encodedSignature);
+    if (!signature)
+        return { ok: false, reason: 'the signature is not base64url' };
+    const key = await accessSigningKey(certsUrl, kid, nowSeconds * 1000, fetchImpl);
+    if (!key)
+        return { ok: false, reason: `no published key for kid ${kid}` };
+    const signed = new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`);
+    let verified = false;
+    try {
+        verified = await crypto.subtle.verify({ name: 'RSASSA-PKCS1-v1_5' }, key, signature, signed);
+    }
+    catch {
+        return { ok: false, reason: 'the signature could not be checked' };
+    }
+    if (!verified)
+        return { ok: false, reason: 'the signature does not match' };
+    if (payload['iss'] !== issuer) {
+        return { ok: false, reason: `iss is ${JSON.stringify(payload['iss'])}, not ${issuer}` };
+    }
+    if (!audienceMatches(payload['aud'], audience)) {
+        return { ok: false, reason: 'aud does not carry this application' };
+    }
+    const exp = payload['exp'];
+    if (typeof exp !== 'number')
+        return { ok: false, reason: 'no exp claim' };
+    if (exp + CLOCK_SKEW_SECONDS < nowSeconds)
+        return { ok: false, reason: 'expired' };
+    const nbf = payload['nbf'];
+    if (typeof nbf === 'number' && nbf - CLOCK_SKEW_SECONDS > nowSeconds) {
+        return { ok: false, reason: 'not valid yet' };
+    }
+    return { ok: true, claims: payload };
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2BH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAWrC;;;;GAIG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE/C,kFAAkF;AAClF,MAAM,UAAU,cAAc;IAC5B,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,QAAiB;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,MAAM,IAAI,GACR,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAC/C,CAAC,CAAE,QAA+B,CAAC,IAAI;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,KAAK,MAAM,SAAS,IAAI,IAAqB,EAAE,CAAC;QAC9C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YAAE,SAAS;QAClE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC;QAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,IAAI,GAAG,KAAK,KAAK;YAAE,SAAS;QAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,oBAAoB;YAAE,SAAS;QAChE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAE7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EACtE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAAgB,EAChB,QAAgB,EAChB,SAAuB,EACvB,GAAW;IAEX,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,YAAY,QAAQ,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,YAAY,QAAQ,+BAA+B,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CACX,2BAA2B,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAuB,EAAE,GAAW;IAC5E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvB,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACxB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAc,QAAQ,IAAI;QACnC,IAAI,EAAE,IAAI,GAAG,EAAE;QACf,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,IAAI;KACf,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,GAAW,EACX,GAAW,EACX,YAA0B,KAAK;IAE/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,WAAW,CAAC;IAC3E,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAe,CAAC;IAE7E,4EAA4E;IAC5E,uEAAuE;IACvE,0CAA0C;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,qBAAqB,EAAE,CAAC;QAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,QAAgB;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAK,QAAQ,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAQrC;IACC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC7E,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAiC,CAAC;IAE5F,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,oBAAoB,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAEhF,MAAM,SAAS,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAE/E,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,GAAG,EAAE,EAAE,CAAC;IAE1E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,CAAC;IAC9E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAE5E,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1E,IAAI,GAAG,GAAG,kBAAkB,GAAG,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,kBAAkB,GAAG,UAAU,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC"}

package/dist/perimeter.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Perimeter mode: this worker checks nothing, and whatever reached it owns the
+ * site.
+ *
+ * DANGEROUS BY DESIGN, and only correct when something in front of the worker
+ * is doing the authenticating: a Cloudflare Access application with no role
+ * mapping to give this worker, a VPN, a company gateway, an on-premises proxy.
+ * Every request that arrives at `/v1/admin/*` resolves to one owner identity,
+ * so if the perimeter ever opens (an Access policy edited, a hostname exposed
+ * outside the tunnel, a route pointed straight at the Worker's workers.dev
+ * subdomain), the whole admin API opens with it: content, settings, API keys,
+ * and the form inbox, which is other people's personal data.
+ *
+ *     import cms, { registerAdminAuth } from '@we8/cms';
+ *     import { perimeterAdminAuth } from '@we8/cloudflare';
+ *
+ *     registerAdminAuth(perimeterAdminAuth({ acknowledged: true }));
+ *     export default cms;
+ *
+ * `acknowledged: true` is a deliberate typing exercise, not a feature flag. The
+ * doctor fails `--remote` without it, so nobody deploys this mode by copying a
+ * snippet without reading what it does, and the acknowledgement sits in the
+ * same line of code as the choice, where a reviewer sees both at once.
+ *
+ * A Worker is reachable at `<name>.<subdomain>.workers.dev` unless that route
+ * is disabled. In perimeter mode, disabling it is part of the perimeter.
+ */
+import type { AdminAuthProvider } from './admin-auth.js';
+/** What `GET /v1/auth/mode` reports this provider as. */
+export declare const PERIMETER_PROVIDER_NAME = "perimeter";
+/**
+ * The identity every request gets. A fixed, obviously synthetic id rather than
+ * an invented per-request one: publish history in this mode says "the
+ * perimeter" and means it, instead of implying a person nobody can name.
+ */
+export declare const PERIMETER_USER_ID = "perimeter-admin";
+export interface PerimeterOptions {
+    /**
+     * Confirms the operator knows every request that reaches this worker is the
+     * owner. `we8-cloudflare doctor --remote` fails without it.
+     */
+    acknowledged?: boolean;
+}
+/**
+ * The provider, ready to register. Resolving is unconditional: there is
+ * nothing to check, which is the entire point and the entire risk.
+ */
+export declare function perimeterAdminAuth(options?: PerimeterOptions): AdminAuthProvider;
+//# sourceMappingURL=perimeter.d.ts.map

package/dist/perimeter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"perimeter.d.ts","sourceRoot":"","sources":["../src/perimeter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AAExE,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,gBAAqB,GAAG,iBAAiB,CAkBpF"}

package/dist/perimeter.js

@@ -0,0 +1,54 @@
+/**
+ * Perimeter mode: this worker checks nothing, and whatever reached it owns the
+ * site.
+ *
+ * DANGEROUS BY DESIGN, and only correct when something in front of the worker
+ * is doing the authenticating: a Cloudflare Access application with no role
+ * mapping to give this worker, a VPN, a company gateway, an on-premises proxy.
+ * Every request that arrives at `/v1/admin/*` resolves to one owner identity,
+ * so if the perimeter ever opens (an Access policy edited, a hostname exposed
+ * outside the tunnel, a route pointed straight at the Worker's workers.dev
+ * subdomain), the whole admin API opens with it: content, settings, API keys,
+ * and the form inbox, which is other people's personal data.
+ *
+ *     import cms, { registerAdminAuth } from '@we8/cms';
+ *     import { perimeterAdminAuth } from '@we8/cloudflare';
+ *
+ *     registerAdminAuth(perimeterAdminAuth({ acknowledged: true }));
+ *     export default cms;
+ *
+ * `acknowledged: true` is a deliberate typing exercise, not a feature flag. The
+ * doctor fails `--remote` without it, so nobody deploys this mode by copying a
+ * snippet without reading what it does, and the acknowledgement sits in the
+ * same line of code as the choice, where a reviewer sees both at once.
+ *
+ * A Worker is reachable at `<name>.<subdomain>.workers.dev` unless that route
+ * is disabled. In perimeter mode, disabling it is part of the perimeter.
+ */
+/** What `GET /v1/auth/mode` reports this provider as. */
+export const PERIMETER_PROVIDER_NAME = 'perimeter';
+/**
+ * The identity every request gets. A fixed, obviously synthetic id rather than
+ * an invented per-request one: publish history in this mode says "the
+ * perimeter" and means it, instead of implying a person nobody can name.
+ */
+export const PERIMETER_USER_ID = 'perimeter-admin';
+/**
+ * The provider, ready to register. Resolving is unconditional: there is
+ * nothing to check, which is the entire point and the entire risk.
+ */
+export function perimeterAdminAuth(options = {}) {
+    if (options.acknowledged !== true) {
+        console.warn('[perimeter] admin auth is perimeter mode and it is NOT acknowledged: every request that reaches this worker is the owner. Register perimeterAdminAuth({ acknowledged: true }) once that is what you mean.');
+    }
+    else {
+        console.warn('[perimeter] admin auth is perimeter mode: every request that reaches this worker is the owner.');
+    }
+    return {
+        name: PERIMETER_PROVIDER_NAME,
+        resolve(_request, _env) {
+            return Promise.resolve({ userId: PERIMETER_USER_ID, role: 'owner', email: null });
+        },
+    };
+}
+//# sourceMappingURL=perimeter.js.map

package/dist/perimeter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"perimeter.js","sourceRoot":"","sources":["../src/perimeter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAUnD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA4B,EAAE;IAC/D,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CACV,2MAA2M,CAC5M,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,uBAAuB;QAE7B,OAAO,CAAC,QAAiB,EAAE,IAAa;YACtC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/project.d.ts

@@ -8,6 +8,8 @@ import { type DoctorFacts, type DoctorTarget } from './doctor.js';
 export declare const CONFIG_FILENAMES: readonly ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 /** Where the seed lives inside an installed project. */
 export declare const SEED_RELATIVE_PATH = "node_modules/@we8/cms/seed/local.sql";
+/** Where an installed `@we8/auth` announces itself. */
+export declare const AUTH_PACKAGE_RELATIVE_PATH = "node_modules/@we8/auth/package.json";
 /**
  * Parses `.dev.vars` for the names it sets. Only names: a doctor that printed
  * the value of a secret to prove it exists would be the bug it is looking for.
@@ -21,6 +23,11 @@ export declare function findConfigPath(projectDir: string): string | null;
  * deliberately never touches.
  */
 export declare function gatherFacts(projectDir: string, target: DoctorTarget, remoteSecrets?: string[] | null): DoctorFacts;
+/**
+ * The source of the worker entry named by `main`, or null when there is no
+ * readable one. The doctor reads the composed admin auth provider out of it.
+ */
+export declare function readWorkerEntry(projectDir: string, config: unknown): string | null;
 /** The seed file inside the project's installed `@we8/cms`, or null when absent. */
 export declare function findSeedFile(projectDir: string): string | null;
 //# sourceMappingURL=project.d.ts.map

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAErF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,+DAAgE,CAAC;AAE9F,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,yCAAyC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAa3D;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMhE;AAoBD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,EACpB,aAAa,GAAE,MAAM,EAAE,GAAG,IAAW,GACpC,WAAW,CAuCb;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAIrF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,+DAAgE,CAAC;AAE9F,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,yCAAyC,CAAC;AAEzE,uDAAuD;AACvD,eAAO,MAAM,0BAA0B,wCAAwC,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAa3D;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMhE;AAoBD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,EACpB,aAAa,GAAE,MAAM,EAAE,GAAG,IAAW,GACpC,WAAW,CAkDb;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAalF;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D"}

package/dist/project.js

@@ -7,10 +7,14 @@ import { readdirSync, readFileSync, existsSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { parseJsonc } from './jsonc.js';
 import { readMigrationsDir } from './doctor.js';
+import { SKILL_RELATIVE_PATH } from './skill.js';
+import { AUTH_MIGRATIONS_DIR } from './wrangler-config.js';
 /** The config filenames wrangler itself accepts, in the order it looks for them. */
 export const CONFIG_FILENAMES = ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'];
 /** Where the seed lives inside an installed project. */
 export const SEED_RELATIVE_PATH = 'node_modules/@we8/cms/seed/local.sql';
+/** Where an installed `@we8/auth` announces itself. */
+export const AUTH_PACKAGE_RELATIVE_PATH = 'node_modules/@we8/auth/package.json';
 /**
  * Parses `.dev.vars` for the names it sets. Only names: a doctor that printed
  * the value of a secret to prove it exists would be the bug it is looking for.
@@ -94,6 +98,11 @@ export function gatherFacts(projectDir, target, remoteSecrets = null) {
             migrations = readdirSync(absolute).filter((name) => name.endsWith('.sql'));
         }
     }
+    const authPackageInstalled = existsSync(resolve(projectDir, AUTH_PACKAGE_RELATIVE_PATH));
+    const authMigrationsPath = resolve(projectDir, AUTH_MIGRATIONS_DIR);
+    const authMigrations = authPackageInstalled && existsSync(authMigrationsPath)
+        ? readdirSync(authMigrationsPath).filter((name) => name.endsWith('.sql'))
+        : null;
     return {
         target,
         config,
@@ -102,8 +111,30 @@ export function gatherFacts(projectDir, target, remoteSecrets = null) {
         remoteSecrets,
         migrations,
         packageScripts: readScripts(projectDir),
+        workerEntry: readWorkerEntry(projectDir, config),
+        authPackageInstalled,
+        authMigrations,
+        skillPresent: existsSync(resolve(projectDir, SKILL_RELATIVE_PATH)),
     };
 }
+/**
+ * The source of the worker entry named by `main`, or null when there is no
+ * readable one. The doctor reads the composed admin auth provider out of it.
+ */
+export function readWorkerEntry(projectDir, config) {
+    const main = typeof config === 'object' && config !== null
+        ? config.main
+        : undefined;
+    if (typeof main !== 'string' || main.length === 0)
+        return null;
+    const absolute = isAbsolute(main) ? main : resolve(projectDir, main);
+    try {
+        return readFileSync(absolute, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
 /** The seed file inside the project's installed `@we8/cms`, or null when absent. */
 export function findSeedFile(projectDir) {
     const candidate = resolve(projectDir, SEED_RELATIVE_PATH);

package/dist/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAuC,MAAM,aAAa,CAAC;AAErF,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAU,CAAC;AAE9F,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,uDAAuD;QACvD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACnE,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,MAAoB,EACpB,gBAAiC,IAAI;IAErC,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAE9C,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,WAA+B,CAAC;IAEpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,WAAW,GAAG,yDAAyD,CAAC;IAC1E,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,WAAW,GAAG,GAAG,UAAU,wDAAwD,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,GAAG,UAAU,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAErG,IAAI,UAAU,GAAoB,IAAI,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAChG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,OAAO;QACP,aAAa;QACb,UAAU;QACV,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC"}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAuC,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAU,CAAC;AAE9F,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAEzE,uDAAuD;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,uDAAuD;QACvD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACnE,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,MAAoB,EACpB,gBAAiC,IAAI;IAErC,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAE9C,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,WAA+B,CAAC;IAEpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,WAAW,GAAG,yDAAyD,CAAC;IAC1E,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,WAAW,GAAG,GAAG,UAAU,wDAAwD,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,GAAG,UAAU,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAErG,IAAI,UAAU,GAAoB,IAAI,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAChG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACzF,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,cAAc,GAClB,oBAAoB,IAAI,UAAU,CAAC,kBAAkB,CAAC;QACpD,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,OAAO;QACP,aAAa;QACb,UAAU;QACV,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC;QACvC,WAAW,EAAE,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC;QAChD,oBAAoB;QACpB,cAAc;QACd,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,MAAe;IACjE,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC"}

package/dist/skill-command.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `we8-cloudflare skill`: write or refresh the project skill in place.
+ *
+ * The scaffolder writes the skill once, at `npm create we8`. Everything after
+ * that is this command's job: a project that predates the skill adopts one, a
+ * project whose auth registration changed refreshes it, and CI checks that the
+ * file in the repository is the one this version of the pack would write.
+ *
+ * The state it generates from is derived from the project itself, never asked
+ * for. The mode comes out of the worker entry with its comments stripped (the
+ * same read the doctor does, for the same reason: the generated entries
+ * explain the modes they are not in), the site workspace is a directory that
+ * either exists or does not, and the perimeter acknowledgement is a fact about
+ * one line of code. Nothing here can produce a skill that describes a project
+ * other than this one.
+ */
+import { type AdminAuthMode } from './doctor.js';
+/**
+ * What the command did, or would have done.
+ *
+ * `unchanged` and `current` are separate from `written` because they answer
+ * different questions: one says the write was a no-op, the other says the
+ * check passed. Both exit zero; `stale`, `missing`, and `not-a-project` do not.
+ */
+export type SkillCommandStatus = 'written' | 'unchanged' | 'current' | 'stale' | 'missing' | 'not-a-project';
+export interface SkillCommandResult {
+    status: SkillCommandStatus;
+    /** The absolute path the skill lives at, even when nothing was written. */
+    path: string;
+    /** The mode the skill was generated for, or null when the project was refused. */
+    mode: AdminAuthMode | null;
+    /** One line for a terminal. */
+    message: string;
+    /** A command that resolves a non-zero status. */
+    fix?: string;
+}
+/** Whether a directory carries the Astro starter the template scaffolds. */
+export declare function hasSiteWorkspace(projectDir: string): boolean;
+/**
+ * Writes the skill, or checks it. `check` never touches the filesystem beyond
+ * reading, so it is safe to run anywhere, CI included.
+ */
+export declare function runSkillCommand(projectDir: string, options: {
+    check: boolean;
+}): SkillCommandResult;
+/** Zero when the project is in the state the command asked for, one otherwise. */
+export declare function skillExitCode(status: SkillCommandStatus): number;
+//# sourceMappingURL=skill-command.d.ts.map

package/dist/skill-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-command.d.ts","sourceRoot":"","sources":["../src/skill-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAKrB;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,WAAW,GACX,SAAS,GACT,OAAO,GACP,SAAS,GACT,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5D;AA4CD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,kBAAkB,CAqDnG;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAEhE"}