cf 0.10.0 → 0.12.0

package/dist/chunk-LQW53VED-9MACsvSG.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+import{$ as e,Ct as t,D as n,Dt as r,Et as i,H as a,I as o,R as s,U as c,W as l,Z as u,xt as d}from"./dist-DV7LR38l.mjs";import{createRequire as f}from"node:module";import{chmodSync as p,existsSync as m,mkdirSync as h,rmSync as g,writeFileSync as _}from"node:fs";import v from"node:assert";import{TextEncoder as ee}from"node:util";import y from"node:path";import te from"node:url";import ne from"node:http";import{createCipheriv as re,createDecipheriv as ie,createHash as b,randomBytes as x,webcrypto as S}from"node:crypto";import{spawn as ae,spawnSync as C}from"node:child_process";var oe=Object.defineProperty,w=(e,t)=>oe(e,`name`,{value:t,configurable:!0}),T=o(),se=!1;function E(e){let{configOverride:t,warningLogger:n,storage:r}=e,{oauth_token:i,refresh_token:a,expiration_time:o,scopes:s,api_token:c}=t??r.read()??{};return i?{accessToken:{value:i,expiry:o??`2000-01-01:00:00:00+00:00`},refreshToken:{value:a??``},scopes:s}:c?(!se&&n&&(se=!0,n.warn(`It looks like you have used Wrangler v1's \`config\` command to login with an API token
+from ${t===void 0?r.path():`in-memory config`}.
+This is no longer supported in the current version of Wrangler.
+If you wish to authenticate via an API token then please set the \`CLOUDFLARE_API_TOKEN\` environment variable.`)),{deprecatedApiToken:c}):{}}w(E,`readStoredAuthState`);var ce=e({variableName:`CLOUDFLARE_API_TOKEN`,deprecatedName:`CF_API_TOKEN`}),le=e({variableName:`CLOUDFLARE_API_KEY`,deprecatedName:`CF_API_KEY`}),ue=e({variableName:`CLOUDFLARE_EMAIL`,deprecatedName:`CF_EMAIL`});function de(e){if(e?.allowGlobalAuthKey??!0){let e=le(),t=ue();if(e&&t)return{authKey:e,authEmail:t}}let t=ce();if(t)return{apiToken:t}}w(de,`getAuthFromEnv`);function fe(e){let t=de(e);if(t)return t;let n=E({storage:e.storage,warningLogger:e.warningLogger});if(n.deprecatedApiToken)return{apiToken:n.deprecatedApiToken};if(n.accessToken?.value)return{apiToken:n.accessToken.value}}w(fe,`getAPIToken`);function pe(e){let t=fe(e);if(!t)throw new r(`No API token found.`,{telemetryMessage:`user auth missing api token`});return t}w(pe,`requireApiToken`);var me=/^[A-Za-z0-9_-]+$/;function he(e,t){if(!me.test(e))throw new r(`Invalid account ID "${e}" ${t}. Account IDs may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`user account id invalid characters`});return e}w(he,`validateAccountId`);var D=e({variableName:`WRANGLER_AUTH_DOMAIN`,defaultValue:w(()=>c()===`staging`?`dash.staging.cloudflare.com`:`dash.cloudflare.com`,`defaultValue`)}),ge=e({variableName:`WRANGLER_AUTH_URL`,defaultValue:w(()=>`https://${D()}/oauth2/auth`,`defaultValue`)}),_e=e({variableName:`WRANGLER_TOKEN_URL`,defaultValue:w(()=>`https://${D()}/oauth2/token`,`defaultValue`)}),ve=e({variableName:`WRANGLER_REVOKE_URL`,defaultValue:w(()=>`https://${D()}/oauth2/revoke`,`defaultValue`)}),ye=e({variableName:`CLOUDFLARE_ACCOUNT_ID`,deprecatedName:`CF_ACCOUNT_ID`});function be(){let e=ye();if(e)return he(e,"set in the `CLOUDFLARE_ACCOUNT_ID` environment variable")}w(be,`getCloudflareAccountIdFromEnv`);var xe=`/oauth2/device/auth`;function Se(){return`https://${D()}${xe}`}w(Se,`getDeviceAuthUrl`);var Ce=e({variableName:`CLOUDFLARE_ACCESS_CLIENT_ID`}),we=e({variableName:`CLOUDFLARE_ACCESS_CLIENT_SECRET`}),Te=e({variableName:`WRANGLER_CF_AUTHORIZATION_TOKEN`}),Ee=u({variableName:`CLOUDFLARE_AUTH_USE_KEYRING`}),O={},k=new Map;function De(){for(let e of Object.keys(O))delete O[e];k.clear()}w(De,`clearAccessCaches`);async function Oe(e,t){if(t.debug(`Checking if domain has Access enabled:`,e),k.has(e))return t.debug(`Using cached Access switch for:`,e,k.get(e)),k.get(e)??!1;t.debug(`Access switch not cached for:`,e);try{let n=new AbortController,r=setTimeout(()=>{n.abort()},1e3),i=await(0,T.fetch)(`https://${e}`,{redirect:`manual`,signal:n.signal});clearTimeout(r);let a=!!(i.status===302&&i.headers.get(`location`)?.includes(`cloudflareaccess.com`));return t.debug(`Caching access switch for:`,e),k.set(e,a),a}catch{return k.set(e,!1),!1}}w(Oe,`domainUsesAccess`);async function ke(e,t){let i=t.logger,a=Ce(),o=we();if(a&&o)return i.debug(`Using Access Service Token headers for domain:`,e),{"CF-Access-Client-Id":a,"CF-Access-Client-Secret":o};if((a!==void 0||o!==void 0)&&i.warn(`Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${a===void 0?`CLOUDFLARE_ACCESS_CLIENT_SECRET`:`CLOUDFLARE_ACCESS_CLIENT_ID`} was found.`),!await Oe(e,i))return{};if(i.debug(`Getting Access headers for domain:`,e),O[e])return i.debug(`Using cached Access headers for domain:`,e),O[e];if((t.isNonInteractiveOrCI??n)())throw new r(`The domain "${e}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
+Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate with an Access Service Token.
+See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/`,{telemetryMessage:`user access missing service token non interactive`});i.debug(`Spawning cloudflared to get Access token for domain:`);let s=await Ae(e,t.signal);if(s.error)throw new r("To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",{telemetryMessage:`user access missing cloudflared`});let c=s.stdout;i.debug(`cloudflared output:`,c);let l=c.match(/fetched your token:\n\n(.*)/m);if(l&&l.length>=2){let t={Cookie:`CF_Authorization=${l[1]}`};return O[e]=t,i.debug(`Caching Access headers for domain:`,e),t}throw Error(`Failed to authenticate with Cloudflare Access`)}w(ke,`getAccessHeaders`);function Ae(e,t){return new Promise((n,r)=>{let i=ae(`cloudflared`,[`access`,`login`,e],{signal:t}),a=[];i.stdout.on(`data`,e=>a.push(e)),i.stderr.resume();let o=w(()=>i.kill(),`killChild`);process.once(`exit`,o),i.on(`error`,e=>{if(process.removeListener(`exit`,o),t?.aborted){r(e);return}n({error:e,stdout:``})}),i.on(`close`,()=>{if(process.removeListener(`exit`,o),t?.aborted){r(t.reason??Error(`The operation was aborted`));return}n({stdout:Buffer.concat(a).toString()})})})}w(Ae,`spawnCloudflaredAccessLogin`);async function je(e){let t=Te();return t===void 0?ke(D(),e):(e.logger.debug(`Using WRANGLER_CF_AUTHORIZATION_TOKEN from environment`),{Cookie:`CF_Authorization=${t}`})}w(je,`getCloudflareAccessHeaders`);var Me=96,Ne=32,Pe=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`;function Fe(e){let t=btoa(e);return t=t.replace(/\+/g,`-`),t=t.replace(/\//g,`_`),t=t.replace(/=/g,``),t}w(Fe,`base64urlEncode`);async function Ie(){let e=new Uint32Array(Me);S.getRandomValues(e);let t=Fe(Array.from(e).map(e=>Pe[e%Pe.length]).join(``)),n=await S.subtle.digest(`SHA-256`,new ee().encode(t)),r=new Uint8Array(n),i=``,a=r.byteLength;for(let e=0;e<a;e++)i+=String.fromCharCode(r[e]);return{codeChallenge:Fe(i),codeVerifier:t}}w(Ie,`generatePKCECodes`);var Le=w(({verificationUri:e,userCode:t})=>{let n=new URL(e);return n.searchParams.set(`user_code`,t),n.toString()},`generateVerificationUrl`);function Re(e){try{return new URL(e)}catch{return}}w(Re,`parseUrl`);function ze(e,t){let n=Re(e),i=Re(`https://${t.authDomain}`);if(!(n!==void 0&&i!==void 0&&n.protocol===`https:`&&n.username===``&&n.password===``&&n.host===i.host))throw new r(`The authorization server returned an untrusted \`${t.field}\`: ${e}
+Expected an \`https\` URL on \`${t.authDomain}\`. Refusing to display or open it.`,{telemetryMessage:`user device-flow untrusted verification url`})}w(ze,`assertTrustedVerificationUrl`);var Be=w(({authUrl:e,clientId:t,scopes:n,stateQueryParam:r,codeChallenge:i,redirectUri:a})=>e+`?response_type=code&client_id=${encodeURIComponent(t)}&redirect_uri=${encodeURIComponent(a)}&scope=${encodeURIComponent([...n,`offline_access`].join(` `))}&state=${r}&code_challenge=${encodeURIComponent(i)}&code_challenge_method=S256`,`generateAuthUrl`);function Ve(e){let t=new Uint32Array(e);return S.getRandomValues(t),Array.from(t).map(e=>Pe[e%Pe.length]).join(``)}w(Ve,`generateRandomState`);var He=64e6;function Ue(e,t,n){let r=Array(t+1),i=b(`sha256`).update(e).digest();r[0]=i;for(let e=0;e<t;e++){for(let e=0;e<n;e++)i=b(`sha256`).update(i).digest();r[e+1]=i}return r}w(Ue,`solvePow`);function We(e){return Buffer.concat(e).toString(`base64`)}w(We,`encodeCheckpoints`);function Ge(e){let t=Ue(Buffer.from(e.seed,`base64url`),e.k,e.g);return{challengeToken:e.challengeToken,solution:{checkpoints:We(t)}}}w(Ge,`solveChallenge`);var A={termsOfService:`https://www.cloudflare.com/terms/`,privacyPolicy:`https://www.cloudflare.com/privacypolicy/`},Ke=`You must accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`,qe=`Continuing means you accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}).`,Je=`You must accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}) to use --temporary.`;function Ye(){return`${a(s)}/provisioning/previews`}w(Ye,`getTemporaryPreviewUrl`);function Xe(){return`${Ye()}/challenge`}w(Xe,`getTemporaryPreviewChallengeUrl`);function Ze(e){let t=Date.parse(e);return!Number.isNaN(t)&&t>Date.now()}w(Ze,`isFutureTimestamp`);function Qe(e){let t=e.read();if(t&&!(!t.account?.id||!t.account?.apiToken||!t.account?.name||!t.claim?.url||!Ze(t.account?.expiresAt??``)||!Ze(t.claim?.expiresAt??``)))return t}w(Qe,`getCachedTemporaryPreviewAccount`);async function $e(e){let t=await(0,T.fetch)(Xe(),{method:`POST`,headers:{"Content-Type":`application/json`},body:`{}`});if(!t.ok)throw new i(`Failed to request a proof-of-work challenge (${t.status} ${t.statusText}).`,{telemetryMessage:`deploy temporary account challenge failed`});let n;try{n=await t.json()}catch{throw new i(`Failed to request a proof-of-work challenge. Received an invalid response (${t.status} ${t.statusText}).`,{telemetryMessage:`deploy temporary account challenge invalid response`})}let{challengeToken:r,seed:a,k:o,g:s}=n.result??{};if(r===void 0||a===void 0||o===void 0||s===void 0)throw new i(`Failed to request a proof-of-work challenge because the response was missing required fields.`,{telemetryMessage:`deploy temporary account challenge incomplete`});if(!Number.isInteger(o)||!Number.isInteger(s)||o<=0||s<=0||o*s>He||Buffer.from(a,`base64url`).length!==32)throw new i(`The proof-of-work challenge is not supported by this version of Wrangler.`,{telemetryMessage:`deploy temporary account challenge difficulty unsupported`});return e.log(`Solving proof-of-work challenge…`),Ge({challengeToken:r,seed:a,k:o,g:s})}w($e,`requestPowSolution`);async function et(e){let t=await $e(e),n=await(0,T.fetch)(Ye(),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({termsOfService:A.termsOfService,privacyPolicy:A.privacyPolicy,acceptTermsOfService:`yes`,challengeToken:t.challengeToken,solution:t.solution})});if(!n.ok)throw new i(`Failed to create a temporary preview account (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account create failed`});let r;try{r=await n.json()}catch{throw new i(`Failed to create a temporary preview account. Received an invalid response (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account invalid response`})}let a=r.result,o=a?.account?.id,s=a?.account?.name,c=a?.account?.apiToken,l=a?.account?.expiresAt,u=a?.claim?.url,d=a?.claim?.expiresAt;if(o===void 0||s===void 0||c===void 0||l===void 0||u===void 0||d===void 0)throw new i(`Failed to create a temporary preview account because the response was missing required fields.`,{telemetryMessage:`deploy temporary account response incomplete`});return{account:{id:o,name:s,apiToken:c,expiresAt:l},claim:{url:u,expiresAt:d}}}w(et,`createTemporaryPreviewAccount`);async function tt(e){let t=Qe(e.storage);if(t)return{account:t,cached:!0};if(!await e.prompt(Ke,qe))throw new r(Je,{telemetryMessage:`user temporary terms not accepted`});let n=await et(e.logger);return e.storage.write(n),{account:n,cached:!1}}w(tt,`getOrCreateTemporaryPreviewAccount`);function nt(e){var t=[...arguments].slice(1),n=Array.from(typeof e==`string`?[e]:e);n[n.length-1]=n[n.length-1].replace(/\r?\n([\t ]*)$/,``);var r=n.reduce(function(e,t){var n=t.match(/\n([\t ]+|(?!\s).)/g);return n?e.concat(n.map(function(e){return e.match(/[\t ]/g)?.length??0})):e},[]);if(r.length){var i=RegExp(`
+[	 ]{`+Math.min.apply(Math,r)+`}`,`g`);n=n.map(function(e){return e.replace(i,`
+`)})}n[0]=n[0].replace(/^\r?\n/,``);var a=n[0];return t.forEach(function(e,t){var r=a.match(/(?:^|\n)( *)$/),i=r?r[1]:``,o=e;typeof e==`string`&&e.includes(`
+`)&&(o=String(e).split(`
+`).map(function(e,t){return t===0?e:``+i+e}).join(`
+`)),a+=o+n[t+1]}),a}w(nt,`dedent`);var rt=nt,j=class extends r{static{w(this,`ErrorOAuth2`)}code;description;uri;toString(){return`ErrorOAuth2`}},it=class extends j{static{w(this,`ErrorUnknown`)}toString(){return`ErrorUnknown`}},at=class extends j{static{w(this,`ErrorNoAuthCode`)}toString(){return`ErrorNoAuthCode`}},ot=class extends j{static{w(this,`ErrorInvalidReturnedStateParam`)}toString(){return`ErrorInvalidReturnedStateParam`}},st=class extends j{static{w(this,`ErrorInvalidJson`)}toString(){return`ErrorInvalidJson`}},ct=class extends j{static{w(this,`ErrorInvalidScope`)}toString(){return`ErrorInvalidScope`}},lt=class extends j{static{w(this,`ErrorInvalidRequest`)}toString(){return`ErrorInvalidRequest`}},ut=class extends j{static{w(this,`ErrorInvalidToken`)}toString(){return`ErrorInvalidToken`}},M=class extends j{static{w(this,`ErrorAuthenticationGrant`)}toString(){return`ErrorAuthenticationGrant`}},dt=class extends M{static{w(this,`ErrorUnauthorizedClient`)}toString(){return`ErrorUnauthorizedClient`}},ft=class extends M{static{w(this,`ErrorAccessDenied`)}toString(){return`ErrorAccessDenied`}},pt=class extends M{static{w(this,`ErrorUnsupportedResponseType`)}toString(){return`ErrorUnsupportedResponseType`}},mt=class extends M{static{w(this,`ErrorServerError`)}toString(){return`ErrorServerError`}},ht=class extends M{static{w(this,`ErrorTemporarilyUnavailable`)}toString(){return`ErrorTemporarilyUnavailable`}},gt=class extends j{static{w(this,`ErrorAccessTokenResponse`)}toString(){return`ErrorAccessTokenResponse`}},_t=class extends gt{static{w(this,`ErrorInvalidClient`)}toString(){return`ErrorInvalidClient`}},vt=class extends gt{static{w(this,`ErrorInvalidGrant`)}toString(){return`ErrorInvalidGrant`}},yt=class extends gt{static{w(this,`ErrorUnsupportedGrantType`)}toString(){return`ErrorUnsupportedGrantType`}};function bt(e,t,n){let r=`OAuth error: ${e}`;return t&&(r+=`
+  ${t}`),n&&(r+=`
+  See: ${n}`),r}w(bt,`formatOAuthErrorMessage`);function N(e,t,n){let r=bt(e,t,n),i;switch(e){case`invalid_request`:i=new lt(r,{telemetryMessage:`user oauth invalid request`});break;case`invalid_grant`:i=new vt(r,{telemetryMessage:`user oauth invalid grant`});break;case`unauthorized_client`:i=new dt(r,{telemetryMessage:`user oauth unauthorized client`});break;case`access_denied`:i=new ft(r,{telemetryMessage:`user oauth access denied`});break;case`unsupported_response_type`:i=new pt(r,{telemetryMessage:`user oauth unsupported response type`});break;case`invalid_scope`:i=new ct(r,{telemetryMessage:`user oauth invalid scope`});break;case`server_error`:i=new mt(r,{telemetryMessage:`user oauth server error`});break;case`temporarily_unavailable`:i=new ht(r,{telemetryMessage:`user oauth temporarily unavailable`});break;case`invalid_client`:i=new _t(r,{telemetryMessage:`user oauth invalid client`});break;case`unsupported_grant_type`:i=new yt(r,{telemetryMessage:`user oauth unsupported grant type`});break;case`invalid_json`:i=new st(r,{telemetryMessage:`user oauth invalid json`});break;case`invalid_token`:i=new ut(r,{telemetryMessage:`user oauth invalid token`});break;default:i=new it(r,{telemetryMessage:`user oauth unknown error`});break}return i.code=e,i.description=t,i.uri=n,i}w(N,`toErrorClass`);function xt(e,t,n){if(e.error)throw N(Array.isArray(e.error)?e.error[0]:e.error,Array.isArray(e.error_description)?e.error_description[0]:e.error_description,Array.isArray(e.error_uri)?e.error_uri[0]:e.error_uri);let r=e.code;if(!r)return!1;if(e.state!==t.stateQueryParam)throw n.warn(`Received query string parameter doesn't match the one sent! Possible malicious activity somewhere.`),new ot(``,{telemetryMessage:`user oauth invalid returned state`});return v(!Array.isArray(r)),t.authorizationCode=r,t.hasAuthCodeBeenExchangedForAccessToken=!1,!0}w(xt,`isReturningFromAuthServer`);async function St(e,t,n,r,i){let{codeChallenge:a,codeVerifier:o}=await Ie(),s=i.generateRandomState(Ne);return Object.assign(r,{codeChallenge:a,codeVerifier:o,stateQueryParam:s}),i.generateAuthUrl({authUrl:ge(),clientId:t,scopes:e,stateQueryParam:s,codeChallenge:a,redirectUri:n})}w(St,`getAuthURL`);async function Ct(e,t,n,r){let i=E({warningLogger:e,storage:r}).refreshToken;i||e.warn(`No refresh token is present.`);let a=await P(new URLSearchParams({grant_type:`refresh_token`,refresh_token:i?.value??``,client_id:n}),e,t);if(a.status>=400){let t;try{t=await F(a,e)}catch(t){e.error(t)}throw t===void 0?new it(`Failed to parse Error from exchangeRefreshTokenForAccessToken`,{telemetryMessage:`user oauth refresh token exchange parse error`}):typeof t==`string`?Error(t):t}else try{let t=await F(a,e);if(`error`in t)throw t.error;let{access_token:n,expires_in:r,refresh_token:o,scope:s}=t;return{token:{value:n,expiry:new Date(Date.now()+r*1e3).toISOString()},scopes:s?s.split(` `):[],refreshToken:o?{value:o}:i}}catch(e){throw typeof e==`string`?N(e):e}}w(Ct,`exchangeRefreshTokenForAccessToken`);async function wt(e,t,n,r,i){let{authorizationCode:a,codeVerifier:o=``}=e;o?a||t.warn(`No authorization grant code is being passed.`):t.warn(`No code verifier is being sent.`);let s=await P(new URLSearchParams({grant_type:`authorization_code`,code:a??``,redirect_uri:i,client_id:r,code_verifier:o}),t,n);if(!s.ok){let{error:e}=await F(s,t);throw e===`invalid_grant`&&t.log(`Expired! Auth code or refresh token needs to be renewed.`),N(e)}let c=await F(s,t);if(`error`in c)throw N(c.error);let{access_token:l,expires_in:u,refresh_token:d,scope:f}=c;return e.hasAuthCodeBeenExchangedForAccessToken=!0,{token:{value:l,expiry:new Date(Date.now()+u*1e3).toISOString()},scopes:f?f.split(` `):[],refreshToken:d?{value:d}:void 0}}w(wt,`exchangeAuthCodeForAccessToken`);async function P(e,t,n){let r={"Content-Type":`application/x-www-form-urlencoded`};if(t.debug(`fetching auth token`,`grant_type=${e.get(`grant_type`)??`<unknown>`}`),await Oe(D(),t)){t.debug(`Using Cloudflare Access to get an access token for the auth request`);let e=await je({logger:t,isNonInteractiveOrCI:n});Object.assign(r,e)}t.debug(`Fetching auth token from`,_e());try{let n=await(0,T.fetch)(_e(),{method:`POST`,body:e.toString(),headers:r});return n.ok||t.debug(`Failed to fetch auth token:`,n.status,n.statusText),n}catch(e){throw t.debug(`Failed to fetch auth token:`,e),e}}w(P,`fetchAuthToken`);async function F(e,t){let n=await e.text();try{return JSON.parse(n)}catch(r){throw n.match(/<!DOCTYPE html>/)&&(t.error(`The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response.`),n.match(/challenge-platform/)&&t.error(`It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${e.headers.get(`cf-ray`)}`)),t.debug(`Full body of response
+
+`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}w(F,`getJSONFromResponse`);async function Tt(e,t,n,i){let a=await St(e.scopes,e.clientId,e.redirectUri,t,i),o=new URL(e.redirectUri).pathname,s,c,l=new Promise((e,t)=>{c=setTimeout(()=>{s.close(),clearTimeout(c),t(new r(`Timed out waiting for authorization code, please try again.`,{telemetryMessage:`user oauth authorization timeout`}))},12e4)}),u=new Promise((i,a)=>{s=ne.createServer(async(l,u)=>{function d(e,t){clearTimeout(c),u.writableEnded||u.end(),s.close(n=>{t||n?a(t||n):(v(e),i(e))})}w(d,`finish`);function f(e){let t=w(e=>e.replace(/[&<>"']/g,e=>({"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&#39;`})[e]),`escape`),n=`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Wrangler login failed</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 720px; margin: 4rem auto; padding: 0 1rem; color: #1f2933; line-height: 1.5; }
+    h1 { color: #c12d3f; }
+    code { background: #f5f7fa; padding: 0.15em 0.3em; border-radius: 3px; }
+    p.detail { background: #f5f7fa; padding: 1rem; border-radius: 4px; white-space: pre-wrap; }
+  </style>
+</head>
+<body>
+  <h1>Wrangler login failed</h1>
+  <p>The Cloudflare OAuth provider returned an error.</p>
+  ${e.code?`<p>Code: <code>${t(e.code)}</code></p>`:``}
+  ${e.description?`<p class="detail">${t(e.description)}</p>`:``}
+  <p>You can close this tab and return to your terminal for more details.</p>
+</body>
+</html>`;u.writeHead(400,{"Content-Type":`text/html; charset=utf-8`}),u.end(n)}w(f,`renderErrorPage`),v(l.url,`This request doesn't have a URL`);let{pathname:p,query:m}=te.parse(l.url,!0);if(l.method!==`GET`)return u.end(`OK`);switch(p){case o:{let i=!1;try{i=xt(m,t,n.logger)}catch(t){if(t instanceof ft){u.writeHead(307,{Location:e.denied.url}),u.end(()=>{d(null,new r(e.denied.error,{telemetryMessage:`user oauth consent denied`}))});return}let n=t;f({code:n.code,description:n.description??n.message}),d(null,n);return}if(!i){let e=`The Cloudflare OAuth provider did not return an authorisation code.`;f({description:e}),d(null,new at(e,{telemetryMessage:`user oauth missing auth code`}));return}try{let r=await wt(t,n.logger,n.isNonInteractiveOrCI,e.clientId,e.redirectUri);u.writeHead(307,{Location:e.granted.url}),u.end(()=>{d(r)})}catch(e){let t=e,n=t instanceof j;f({code:n?t.code:void 0,description:(n?t.description:void 0)??t.message??`Failed to exchange the authorisation code for an access token.`}),d(null,t)}return}}});let l=new URL(e.redirectUri),u=Number(l.port||(l.protocol===`https:`?443:80));(l.hostname!==e.callbackHost||u!==e.callbackPort)&&(n.logger.log(`Temporary login server listening on ${e.callbackHost}:${e.callbackPort}`),n.logger.log(`Note that the OAuth login page will always redirect to \`${e.redirectUri}\`.
+If you have changed the callback host or port because you are running in a container, then ensure that you have port forwarding set up correctly.`)),s.once(`error`,t=>{clearTimeout(c),t.code===`EADDRINUSE`?a(new r(`The OAuth callback server could not bind to ${e.callbackHost}:${e.callbackPort} because the port is already in use. Stop the process using that port or pass a different \`--callback-port\`.`,{telemetryMessage:`user oauth callback port in use`})):a(t)}),s.listen(e.callbackPort,e.callbackHost)});return e.browser?(n.logger.log(`Opening a link in your default browser: ${a}`),await n.openInBrowser(a)):n.logger.log(`Visit this link to authenticate: ${a}`),Promise.race([l,u])}w(Tt,`getOauthToken`);var Et=300,Dt=1;function I(e,t){if(typeof e!=`object`||!e)return;let n=e[t];return typeof n==`string`&&n!==``?n:void 0}w(I,`getStringMember`);function L(e,t){if(typeof e!=`object`||!e)return;let n=e[t];return typeof n==`number`&&Number.isFinite(n)&&n>0?n:void 0}w(L,`getPositiveNumberMember`);function Ot(e,t){let n=`HTTP ${e.status} ${e.statusText}`.trim(),r=I(t,`error_description`);return r?`${n}: ${r}`:n}w(Ot,`describeUnusableResponse`);function kt(e){return e>=500||e===429}w(kt,`isRetryableStatus`);function At(e){let t=I(e,`device_code`),n=I(e,`user_code`),r=I(e,`verification_uri`),i=L(e,`expires_in`);if(!(!t||!n||!r||i===void 0))return{device_code:t,user_code:n,verification_uri:r,verification_uri_complete:I(e,`verification_uri_complete`),expires_in:i,interval:L(e,`interval`)}}w(At,`asDeviceAuthorizationResponse`);async function R(e,t){let n=await e.text();try{return JSON.parse(n)}catch(r){throw n.match(/<!DOCTYPE html>/)&&(t.debug(`The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response.`),n.match(/challenge-platform/)&&t.debug(`It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${e.headers.get(`cf-ray`)}`)),t.debug(`Full body of response
+
+`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}w(R,`readJson`);async function jt(e,t){let n={"Content-Type":`application/x-www-form-urlencoded`};return await Oe(D(),e)&&(e.debug(`Using Cloudflare Access to get an access token for the device authorization request`),Object.assign(n,await je({logger:e,isNonInteractiveOrCI:t}))),n}w(jt,`buildDeviceAuthHeaders`);async function Mt(e,t,n,i){let a=new URLSearchParams({client_id:t,scope:[...e,`offline_access`].join(` `)}),o=await jt(n,i),s=Se();n.debug(`Fetching device authorization from`,s);let c=await(0,T.fetch)(s,{method:`POST`,body:a.toString(),headers:o});if(!c.ok){let e=await R(c,n).catch(()=>void 0);throw N(e&&typeof e==`object`&&`error`in e?String(e.error):`HTTP ${c.status} ${c.statusText}`)}let l=await R(c,n),u=At(l);if(u===void 0)throw n.debug(`Unusable device authorization response body:`,l),new r(`The device authorization endpoint returned a response that could not be interpreted (${Ot(c,l)}).
+Enable debug logging to see the full response.`,{telemetryMessage:`user device-flow unusable device authorization response`});return u}w(Mt,`requestDeviceAuthorization`);async function Nt(e,t,n,r){let i=await P(new URLSearchParams({grant_type:`urn:ietf:params:oauth:grant-type:device_code`,device_code:e,client_id:t}),n,r),a=await R(i,n),o=I(a,`error`);if(o!==void 0)return{kind:`oauth-error`,error:o};let s=I(a,`access_token`),c=L(a,`expires_in`);return!i.ok||s===void 0||c===void 0?(n.debug(`Unusable token response body:`,a),{kind:`unexpected`,detail:Ot(i,a),retryable:!i.ok&&kt(i.status)}):{kind:`token`,grant:{access_token:s,expires_in:c,refresh_token:I(a,`refresh_token`),scope:I(a,`scope`)}}}w(Nt,`pollDeviceToken`);function Pt(e){return new Promise(t=>setTimeout(t,e*1e3))}w(Pt,`sleep`);async function Ft(e,t){let{logger:n,openInBrowser:i,isNonInteractiveOrCI:a}=t,o=await Mt(e.scopes,e.clientId,n,a),s=D();ze(o.verification_uri,{field:`verification_uri`,authDomain:s}),o.verification_uri_complete!==void 0&&ze(o.verification_uri_complete,{field:`verification_uri_complete`,authDomain:s});let c=o.verification_uri_complete??Le({verificationUri:o.verification_uri,userCode:o.user_code}),l=Math.min(o.expires_in,Et);n.log(rt`
+		To authorize ${t.displayName}, please visit:
+
+		  ${o.verification_uri}
+
+		and enter the code:
+
+		  ${o.user_code}
+
+		You have ${It(l)} to approve this request.
+	`),e.browser&&(n.log(`
+Opening a link in your default browser: ${c}`),await i(c));let u=Date.now()+l*1e3,d=Math.max(o.interval??Dt,Dt),f=!0,p;for(;Date.now()<u;){f||await Pt(d),f=!1;let i;try{i=await Nt(o.device_code,e.clientId,n,a)}catch(e){n.debug(`Ignoring transient error while polling for token:`,e),p=e instanceof Error?e.message:String(e);continue}if(i.kind===`unexpected`){if(!i.retryable)throw new r(`The token endpoint returned a response that could not be interpreted (${i.detail}).
+Enable debug logging to see the full response.`,{telemetryMessage:`user device-flow unusable token response`});n.debug(`Ignoring transient response while polling for token:`,i.detail),p=i.detail;continue}if(p=void 0,i.kind===`oauth-error`)switch(i.error){case`authorization_pending`:continue;case`slow_down`:d+=5;continue;case`access_denied`:throw new r(`Consent denied. You must grant consent to ${t.displayName} in order to login.
+If you don't want to do this consider passing an API token via the \`CLOUDFLARE_API_TOKEN\` environment variable.`,{telemetryMessage:`user device-flow consent denied`});case`expired_token`:throw new r(`Device code expired before the request was approved. Please run \`${t.deviceLoginCommand}\` again to obtain a new code.`,{telemetryMessage:`user device-flow code expired`});default:throw N(i.error)}let{grant:s}=i;return{token:{value:s.access_token,expiry:new Date(Date.now()+s.expires_in*1e3).toISOString()},scopes:s.scope?s.scope.split(` `):[],refreshToken:s.refresh_token?{value:s.refresh_token}:void 0}}throw p===void 0?new r(`Device authorization timed out after ${It(l)}. Please run \`${t.deviceLoginCommand}\` again to obtain a new code.`,{telemetryMessage:`user device-flow authorization timeout`}):new r(`Gave up waiting for device authorization: the token endpoint kept returning responses that could not be interpreted (last: ${p}).
+Enable debug logging to see the full response, then run \`${t.deviceLoginCommand}\` to try again.`,{telemetryMessage:`user device-flow poll failed`})}w(Ft,`getOauthTokenViaDeviceFlow`);function It(e){if(e<60)return`${e} seconds`;let t=Math.floor(e/60),n=t===1?`minute`:`minutes`,r=e%60;return r===0?`${t} ${n}`:r==59?`${t+1} ${n}`:`${t} ${n} and ${r} ${r===1?`second`:`seconds`}`}w(It,`toHumanPeriod`);function Lt(e){let t={},n={generateAuthUrl:e.generateAuthUrl??Be,generateRandomState:e.generateRandomState??Ve},i=`default`;function a(t){return e.storageFactory(t??i)}w(a,`getStorage`);let o=w(()=>typeof e.clientId==`function`?e.clientId():e.clientId,`getClientId`),s=e.consent,c=!1,u,d=new URL(e.redirectUri),f=d.hostname,p=Number(d.port);async function m(i){if(e.hasEnvCredentials())return e.logger.error(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth.`),!1;let c=l(i.complianceConfig);if(c===`fedramp_high`)throw new r(rt`
+				OAuth login is not supported in the \`${c}\` compliance region.
+				Please use a Cloudflare API token (\`CLOUDFLARE_API_TOKEN\` environment variable) or remove the ${i.complianceConfig?.compliance_region?"`compliance_region` configuration property":"`CLOUDFLARE_API_ENVIRONMENT` environment variable"}.
+			`,{telemetryMessage:`user login unsupported compliance region`});let u;return i.device?(e.logger.log(`Attempting to login via OAuth Device Authorization Grant...`),u=await Ft({browser:i.browser??!0,scopes:i.scopes,clientId:o()},e)):(e.logger.log(`Attempting to login via OAuth...`),u=await Tt({browser:i.browser??!0,scopes:i.scopes,clientId:o(),redirectUri:e.redirectUri,denied:s.denied,granted:s.granted,callbackHost:i.callbackHost??f,callbackPort:i.callbackPort??p},t,e,n)),a(i.profile).write({oauth_token:u.token?.value??``,expiration_time:u.token?.expiry,refresh_token:u.refreshToken?.value,scopes:u.scopes}),e.logger.log(`Successfully logged in.`),x(),e.purgeOnLoginOrLogout?.(),!0}w(m,`login`);function h(t){if(e.hasEnvCredentials())return!1;let{accessToken:n}=E({warningLogger:e.logger,storage:a(t)});return!!(n&&new Date>=new Date(n.expiry))}w(h,`isRefreshNeeded`);async function g(t){let n=a(t);try{let{token:{value:t,expiry:r}={value:``,expiry:``},refreshToken:{value:i}={},scopes:a}=await Ct(e.logger,e.isNonInteractiveOrCI,o(),n);return n.write({oauth_token:t,expiration_time:r,refresh_token:i,scopes:a}),!0}catch(t){return e.logger.debug(`Token refresh failed: ${t instanceof Error?t.message:String(t)}`),!1}}w(g,`refreshToken`);async function _(t){if(e.hasEnvCredentials())return{loggedIn:!0};let n=E({warningLogger:e.logger,storage:a(t.profile)});return!n.accessToken&&!n.deprecatedApiToken?e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`no-credentials-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`no-credentials-login-failed`}:h(t.profile)?await g(t.profile)?{loggedIn:!0}:e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`token-expired-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`token-expired-login-failed`}:{loggedIn:!0}}w(_,`loginOrRefreshIfRequired`);async function v(t){let n=x();if(e.hasEnvCredentials()){e.logger.log(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log out.`);return}let r=E({warningLogger:e.logger,storage:a(t)}).refreshToken;if(!r){e.logger.log(n?`Cleared temporary preview account.`:`Not logged in, exiting...`);return}let i=`client_id=${encodeURIComponent(o())}&token_type_hint=refresh_token&token=${encodeURIComponent(r.value||``)}`;await(await(0,T.fetch)(ve(),{method:`POST`,body:i,headers:{"Content-Type":`application/x-www-form-urlencoded`}})).text(),a(t).clear(),e.logger.log(`Successfully logged out.`),e.purgeOnLoginOrLogout?.()}w(v,`logout`);async function ee(){let t=E({warningLogger:e.logger,storage:a()});if(t.accessToken){if(t.accessToken&&new Date>=new Date(t.accessToken.expiry)){if(!await g())return;t=E({warningLogger:e.logger,storage:a()})}return t.accessToken?.value}}w(ee,`getOAuthTokenFromLocalState`);function y(){return u?{apiToken:u.account.apiToken}:fe({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}w(y,`getAPITokenInternal`);function te(){return u?{apiToken:u.account.apiToken}:pe({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}w(te,`requireApiTokenInternal`);function ne(t){c=t&&e.temporary!==void 0,u=void 0}w(ne,`setTemporaryAllowed`);function re(){return c}w(re,`isTemporaryAllowed`);function ie(){return u}w(ie,`getActiveTemporaryAccount`);async function b(){if(!e.temporary)throw new r(`Temporary preview accounts are not supported by this CLI.`,{telemetryMessage:`user temporary account unsupported`});let t=await tt({...e.temporary,logger:e.logger});return u=t.account,t}w(b,`activateTemporaryAccount`);function x(){return u=void 0,e.temporary?.storage.clear()??!1}w(x,`clearTemporaryAccount`);function S(e){i=e}w(S,`setProfile`);function ae(){return i}w(ae,`getActiveProfile`);function C(){return E({warningLogger:e.logger,storage:a()}).scopes}return w(C,`getScopes`),{setProfile:S,getActiveProfile:ae,login:m,logout:v,loginOrRefreshIfRequired:_,getOAuthTokenFromLocalState:ee,getAPIToken:y,requireApiToken:te,getScopes:C,setTemporaryAllowed:ne,isTemporaryAllowed:re,getActiveTemporaryAccount:ie,activateTemporaryAccount:b}}w(Lt,`createOAuthFlow`);var Rt=[`default`,`staging`];function zt(e){let t={read(){return e.bindings.read()},write(t){e.bindings.write(t)},activate(t,n){let r=y.resolve(n),i=e.bindings.read();i[r]=t,e.bindings.write(i)},deactivate(t){let n=y.resolve(t),i=e.bindings.read(),a=i[n];if(a===void 0){let e=Bt(n,i);throw e?new r(`No profile is directly bound to "${B(n)}". The active profile "${e.profile}" is bound at "${B(e.dir)}". Run the deactivate command from that directory instead.`,{telemetryMessage:`auth deactivate wrong directory`}):new r(`No profile is bound to "${B(n)}". Nothing to deactivate.`,{telemetryMessage:`auth deactivate no binding`})}delete i[n],e.bindings.write(i);let o=Bt(n,i);return o?{removedProfile:a,newResolution:{profile:o.profile,source:`inherited from ${o.dir}`}}:e.configs.exists(`default`)?{removedProfile:a,newResolution:{profile:`default`,source:`default profile`}}:{removedProfile:a,newResolution:{profile:void 0,source:`no profile`}}},getProfileForDirectory(t){return Bt(t,e.bindings.read())?.profile},getBindingsForProfile(t){return Object.entries(e.bindings.read()).filter(([,e])=>e===t).map(([e])=>e)},removeAllBindingsForProfile(t){let n=e.bindings.read(),r=[];for(let[e,i]of Object.entries(n))i===t&&(r.push(e),delete n[e]);return r.length>0&&e.bindings.write(n),r}};return{configs:e.configs,bindings:t,resolve(e){return e.profile?e.profile===`default`?`default`:(z(e.profile),e.profile):t.getProfileForDirectory(e.cwd)||`default`}}}w(zt,`createProfileStore`);function z(e){if(Rt.includes(e.toLowerCase()))throw new r(`"${e}" is a reserved profile name. Use the login and logout commands to manage the default profile, which applies as a global fallback.`,{telemetryMessage:`auth profile reserved name`});if(!/^[a-zA-Z0-9_-]+$/.test(e))throw new r(`Invalid profile name "${e}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`auth profile invalid name`})}w(z,`validateProfileName`);function B(e){return y.relative(process.cwd(),e)||`.`}w(B,`formatDirectoryForUserError`);function Bt(e,t){let n=y.resolve(e),r=Object.entries(t).sort(([e],[t])=>t.length-e.length);for(let[e,t]of r)if(n===e||n.startsWith(e)&&n[e.length]===y.sep)return{profile:t,dir:e}}w(Bt,`getProfileForDirectoryFromBindings`);function Vt(e,t){let n=e.slice(0,t).split(/\r\n|\n|\r/g);return[n.length,n.pop().length+1]}w(Vt,`getLineColFromPtr`);function Ht(e,t,n){let r=e.split(/\r\n|\n|\r/g),i=``,a=(Math.log10(t+1)|0)+1;for(let e=t-1;e<=t+1;e++){let o=r[e-1];o&&(i+=e.toString().padEnd(a,` `),i+=`:  `,i+=o,i+=`
+`,e===t&&(i+=` `.repeat(a+n+2),i+=`^
+`))}return i}w(Ht,`makeCodeBlock`);var V=class extends Error{static{w(this,`TomlError`)}line;column;codeblock;constructor(e,t){let[n,r]=Vt(t.toml,t.ptr),i=Ht(t.toml,n,r);super(`Invalid TOML document: ${e}
+
+${i}`,t),this.line=n,this.column=r,this.codeblock=i}};function Ut(e,t){let n=0;for(;e[t-++n]===`\\`;);return--n&&n%2}w(Ut,`isEscaped`);function H(e,t=0,n=e.length){let r=e.indexOf(`
+`,t);return e[r-1]===`\r`&&r--,r<=n?r:-1}w(H,`indexOfNewline`);function Wt(e,t){for(let n=t;n<e.length;n++){let r=e[n];if(r===`
+`)return n;if(r===`\r`&&e[n+1]===`
+`)return n+1;if(r<` `&&r!==`	`||r===``)throw new V(`control characters are not allowed in comments`,{toml:e,ptr:t})}return e.length}w(Wt,`skipComment`);function U(e,t,n,r){let i;for(;(i=e[t])===` `||i===`	`||!n&&(i===`
+`||i===`\r`&&e[t+1]===`
+`);)t++;return r||i!==`#`?t:U(e,Wt(e,t),n)}w(U,`skipVoid`);function Gt(e,t,n,r,i=!1){if(!r)return t=H(e,t),t<0?e.length:t;for(let a=t;a<e.length;a++){let t=e[a];if(t===`#`)a=H(e,a);else if(t===n)return a+1;else if(t===r||i&&(t===`
+`||t===`\r`&&e[a+1]===`
+`))return a}throw new V(`cannot find end of structure`,{toml:e,ptr:t})}w(Gt,`skipUntil`);function Kt(e,t){let n=e[t],r=n===e[t+1]&&e[t+1]===e[t+2]?e.slice(t,t+3):n;t+=r.length-1;do t=e.indexOf(r,++t);while(t>-1&&n!==`'`&&Ut(e,t));return t>-1&&(t+=r.length,r.length>1&&(e[t]===n&&t++,e[t]===n&&t++)),t}w(Kt,`getStringEnd`);var qt=/^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i,Jt=class e extends Date{static{w(this,`TomlDate`)}#e=!1;#t=!1;#n=null;constructor(e){let t=!0,n=!0,r=`Z`;if(typeof e==`string`){let i=e.match(qt);i?(i[1]||(t=!1,e=`0000-01-01T${e}`),n=!!i[2],n&&e[10]===` `&&(e=e.replace(` `,`T`)),i[2]&&+i[2]>23?e=``:(r=i[3]||null,e=e.toUpperCase(),!r&&n&&(e+=`Z`))):e=``}super(e),isNaN(this.getTime())||(this.#e=t,this.#t=n,this.#n=r)}isDateTime(){return this.#e&&this.#t}isLocal(){return!this.#e||!this.#t||!this.#n}isDate(){return this.#e&&!this.#t}isTime(){return this.#t&&!this.#e}isValid(){return this.#e||this.#t}toISOString(){let e=super.toISOString();if(this.isDate())return e.slice(0,10);if(this.isTime())return e.slice(11,23);if(this.#n===null)return e.slice(0,-1);if(this.#n===`Z`)return e;let t=this.#n.slice(1,3)*60+ +this.#n.slice(4,6);return t=this.#n[0]===`-`?t:-t,new Date(this.getTime()-t*6e4).toISOString().slice(0,-1)+this.#n}static wrapAsOffsetDateTime(t,n=`Z`){let r=new e(t);return r.#n=n,r}static wrapAsLocalDateTime(t){let n=new e(t);return n.#n=null,n}static wrapAsLocalDate(t){let n=new e(t);return n.#t=!1,n.#n=null,n}static wrapAsLocalTime(t){let n=new e(t);return n.#e=!1,n.#n=null,n}},Yt=/^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/,Xt=/^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/,Zt=/^[+-]?0[0-9_]/,Qt=/^[0-9a-f]{4,8}$/i,$t={b:`\b`,t:`	`,n:`
+`,f:`\f`,r:`\r`,'"':`"`,"\\":`\\`};function en(e,t=0,n=e.length){let r=e[t]===`'`,i=e[t++]===e[t]&&e[t]===e[t+1];i&&(n-=2,e[t+=2]===`\r`&&t++,e[t]===`
+`&&t++);let a=0,o,s=``,c=t;for(;t<n-1;){let n=e[t++];if(n===`
+`||n===`\r`&&e[t]===`
+`){if(!i)throw new V(`newlines are not allowed in strings`,{toml:e,ptr:t-1})}else if(n<` `&&n!==`	`||n===``)throw new V(`control characters are not allowed in strings`,{toml:e,ptr:t-1});if(o){if(o=!1,n===`u`||n===`U`){let r=e.slice(t,t+=n===`u`?4:8);if(!Qt.test(r))throw new V(`invalid unicode escape`,{toml:e,ptr:a});try{s+=String.fromCodePoint(parseInt(r,16))}catch{throw new V(`invalid unicode escape`,{toml:e,ptr:a})}}else if(i&&(n===`
+`||n===` `||n===`	`||n===`\r`)){if(t=U(e,t-1,!0),e[t]!==`
+`&&e[t]!==`\r`)throw new V(`invalid escape: only line-ending whitespace may be escaped`,{toml:e,ptr:a});t=U(e,t)}else if(n in $t)s+=$t[n];else throw new V(`unrecognized escape sequence`,{toml:e,ptr:a});c=t}else !r&&n===`\\`&&(a=t-1,o=!0,s+=e.slice(c,a))}return s+e.slice(c,n-1)}w(en,`parseString`);function tn(e,t,n,r){if(e===`true`)return!0;if(e===`false`)return!1;if(e===`-inf`)return-1/0;if(e===`inf`||e===`+inf`)return 1/0;if(e===`nan`||e===`+nan`||e===`-nan`)return NaN;if(e===`-0`)return r?0n:0;let i=Yt.test(e);if(i||Xt.test(e)){if(Zt.test(e))throw new V(`leading zeroes are not allowed`,{toml:t,ptr:n});e=e.replace(/_/g,``);let a=+e;if(isNaN(a))throw new V(`invalid number`,{toml:t,ptr:n});if(i){if((i=!Number.isSafeInteger(a))&&!r)throw new V(`integer value cannot be represented losslessly`,{toml:t,ptr:n});(i||r===!0)&&(a=BigInt(e))}return a}let a=new Jt(e);if(!a.isValid())throw new V(`invalid value`,{toml:t,ptr:n});return a}w(tn,`parseValue`);function nn(e,t,n,r){let i=e.slice(t,n),a=i.indexOf(`#`);a>-1&&(Wt(e,a),i=i.slice(0,a));let o=i.trimEnd();if(!r){let n=i.indexOf(`
+`,o.length);if(n>-1)throw new V(`newlines are not allowed in inline tables`,{toml:e,ptr:t+n})}return[o,a]}w(nn,`sliceAndTrimEndOf`);function rn(e,t,n,r,i){if(r===0)throw new V(`document contains excessively nested structures. aborting.`,{toml:e,ptr:t});let a=e[t];if(a===`[`||a===`{`){let[o,s]=a===`[`?cn(e,t,r,i):sn(e,t,r,i),c=n?Gt(e,s,`,`,n):s;if(s-c&&n===`}`){let t=H(e,s,c);if(t>-1)throw new V(`newlines are not allowed in inline tables`,{toml:e,ptr:t})}return[o,c]}let o;if(a===`"`||a===`'`){o=Kt(e,t);let r=en(e,t,o);if(n){if(o=U(e,o,n!==`]`),e[o]&&e[o]!==`,`&&e[o]!==n&&e[o]!==`
+`&&e[o]!==`\r`)throw new V(`unexpected character encountered`,{toml:e,ptr:o});o+=+(e[o]===`,`)}return[r,o]}o=Gt(e,t,`,`,n);let s=nn(e,t,o-+(e[o-1]===`,`),n===`]`);if(!s[0])throw new V(`incomplete key-value declaration: no value specified`,{toml:e,ptr:t});return n&&s[1]>-1&&(o=U(e,t+s[1]),o+=+(e[o]===`,`)),[tn(s[0],e,t,i),o]}w(rn,`extractValue`);var an=/^[a-zA-Z0-9-_]+[ \t]*$/;function on(e,t,n=`=`){let r=t-1,i=[],a=e.indexOf(n,t);if(a<0)throw new V(`incomplete key-value: cannot find end of key`,{toml:e,ptr:t});do{let o=e[t=++r];if(o!==` `&&o!==`	`)if(o===`"`||o===`'`){if(o===e[t+1]&&o===e[t+2])throw new V(`multiline strings are not allowed in keys`,{toml:e,ptr:t});let s=Kt(e,t);if(s<0)throw new V(`unfinished string encountered`,{toml:e,ptr:t});r=e.indexOf(`.`,s);let c=e.slice(s,r<0||r>a?a:r),l=H(c);if(l>-1)throw new V(`newlines are not allowed in keys`,{toml:e,ptr:t+r+l});if(c.trimStart())throw new V(`found extra tokens after the string part`,{toml:e,ptr:s});if(a<s&&(a=e.indexOf(n,s),a<0))throw new V(`incomplete key-value: cannot find end of key`,{toml:e,ptr:t});i.push(en(e,t,s))}else{r=e.indexOf(`.`,t);let n=e.slice(t,r<0||r>a?a:r);if(!an.test(n))throw new V(`only letter, numbers, dashes and underscores are allowed in keys`,{toml:e,ptr:t});i.push(n.trimEnd())}}while(r+1&&r<a);return[i,U(e,a+1,!0,!0)]}w(on,`parseKey`);function sn(e,t,n,r){let i={},a=new Set,o,s=0;for(t++;(o=e[t++])!==`}`&&o;){let c={toml:e,ptr:t-1};if(o===`
+`)throw new V(`newlines are not allowed in inline tables`,c);if(o===`#`)throw new V(`inline tables cannot contain comments`,c);if(o===`,`)throw new V(`expected key-value, found comma`,c);if(o!==` `&&o!==`	`){let o,c=i,l=!1,[u,d]=on(e,t-1);for(let n=0;n<u.length;n++){if(n&&(c=l?c[o]:c[o]={}),o=u[n],(l=Object.hasOwn(c,o))&&(typeof c[o]!=`object`||a.has(c[o])))throw new V(`trying to redefine an already defined value`,{toml:e,ptr:t});!l&&o===`__proto__`&&Object.defineProperty(c,o,{enumerable:!0,configurable:!0,writable:!0})}if(l)throw new V(`trying to redefine an already defined value`,{toml:e,ptr:t});let[f,p]=rn(e,d,`}`,n-1,r);a.add(f),c[o]=f,t=p,s=e[t-1]===`,`?t-1:0}}if(s)throw new V(`trailing commas are not allowed in inline tables`,{toml:e,ptr:s});if(!o)throw new V(`unfinished table encountered`,{toml:e,ptr:t});return[i,t]}w(sn,`parseInlineTable`);function cn(e,t,n,r){let i=[],a;for(t++;(a=e[t++])!==`]`&&a;)if(a===`,`)throw new V(`expected value, found comma`,{toml:e,ptr:t-1});else if(a===`#`)t=Wt(e,t);else if(a!==` `&&a!==`	`&&a!==`
+`&&a!==`\r`){let a=rn(e,t-1,`]`,n-1,r);i.push(a[0]),t=a[1]}if(!a)throw new V(`unfinished array encountered`,{toml:e,ptr:t});return[i,t]}w(cn,`parseArray`);function ln(e,t,n,r){let i=t,a=n,o,s=!1,c;for(let t=0;t<e.length;t++){if(t){if(i=s?i[o]:i[o]={},a=(c=a[o]).c,r===0&&(c.t===1||c.t===2))return null;if(c.t===2){let e=i.length-1;i=i[e],a=a[e].c}}if(o=e[t],(s=Object.hasOwn(i,o))&&a[o]?.t===0&&a[o]?.d)return null;s||(o===`__proto__`&&(Object.defineProperty(i,o,{enumerable:!0,configurable:!0,writable:!0}),Object.defineProperty(a,o,{enumerable:!0,configurable:!0,writable:!0})),a[o]={t:t<e.length-1&&r===2?3:r,d:!1,i:0,c:{}})}if(c=a[o],c.t!==r&&!(r===1&&c.t===3)||(r===2&&(c.d||(c.d=!0,i[o]=[]),i[o].push(i={}),c.c[c.i++]=c={t:1,d:!1,i:0,c:{}}),c.d))return null;if(c.d=!0,r===1)i=s?i[o]:i[o]={};else if(r===0&&s)return null;return[o,i,c.c]}w(ln,`peekTable`);function un(e,{maxDepth:t=1e3,integersAsBigInt:n}={}){let r={},i={},a=r,o=i;for(let s=U(e,0);s<e.length;){if(e[s]===`[`){let t=e[++s]===`[`,n=on(e,s+=+t,`]`);if(t){if(e[n[1]-1]!==`]`)throw new V(`expected end of table declaration`,{toml:e,ptr:n[1]-1});n[1]++}let c=ln(n[0],r,i,t?2:1);if(!c)throw new V(`trying to redefine an already defined table or value`,{toml:e,ptr:s});o=c[2],a=c[1],s=n[1]}else{let r=on(e,s),i=ln(r[0],a,o,0);if(!i)throw new V(`trying to redefine an already defined table or value`,{toml:e,ptr:s});let c=rn(e,r[1],void 0,t,n);i[1][i[0]]=c[0],s=c[1]}if(s=U(e,s,!0),e[s]&&e[s]!==`
+`&&e[s]!==`\r`)throw new V(`each key-value declaration must be followed by an end-of-line`,{toml:e,ptr:s});s=U(e,s)}return r}w(un,`parse`);var dn=/^[a-z0-9-_]+$/i;function W(e){let t=typeof e;if(t===`object`){if(Array.isArray(e))return`array`;if(e instanceof Date)return`date`}return t}w(W,`extendedTypeOf`);function fn(e){for(let t=0;t<e.length;t++)if(W(e[t])!==`object`)return!1;return e.length!=0}w(fn,`isArrayOfTables`);function pn(e){return JSON.stringify(e).replace(/\x7f/g,`\\u007f`)}w(pn,`formatString`);function mn(e,t,n,r){if(n===0)throw Error(`Could not stringify the object: maximum object depth exceeded`);if(t===`number`)return isNaN(e)?`nan`:e===1/0?`inf`:e===-1/0?`-inf`:r&&Number.isInteger(e)?e.toFixed(1):e.toString();if(t===`bigint`||t===`boolean`)return e.toString();if(t===`string`)return pn(e);if(t===`date`){if(isNaN(e.getTime()))throw TypeError(`cannot serialize invalid date`);return e.toISOString()}if(t===`object`)return hn(e,n,r);if(t===`array`)return gn(e,n,r)}w(mn,`stringifyValue`);function hn(e,t,n){let r=Object.keys(e);if(r.length===0)return`{}`;let i=`{ `;for(let a=0;a<r.length;a++){let o=r[a];a&&(i+=`, `),i+=dn.test(o)?o:pn(o),i+=` = `,i+=mn(e[o],W(e[o]),t-1,n)}return i+` }`}w(hn,`stringifyInlineTable`);function gn(e,t,n){if(e.length===0)return`[]`;let r=`[ `;for(let i=0;i<e.length;i++){if(i&&(r+=`, `),e[i]===null||e[i]===void 0)throw TypeError(`arrays cannot contain null or undefined values`);r+=mn(e[i],W(e[i]),t-1,n)}return r+` ]`}w(gn,`stringifyArray`);function _n(e,t,n,r){if(n===0)throw Error(`Could not stringify the object: maximum object depth exceeded`);let i=``;for(let a=0;a<e.length;a++)i+=`${i&&`
+`}[[${t}]]
+`,i+=vn(0,e[a],t,n,r);return i}w(_n,`stringifyArrayTable`);function vn(e,t,n,r,i){if(r===0)throw Error(`Could not stringify the object: maximum object depth exceeded`);let a=``,o=``,s=Object.keys(t);for(let e=0;e<s.length;e++){let c=s[e];if(t[c]!==null&&t[c]!==void 0){let e=W(t[c]);if(e===`symbol`||e===`function`)throw TypeError(`cannot serialize values of type '${e}'`);let s=dn.test(c)?c:pn(c);if(e===`array`&&fn(t[c]))o+=(o&&`
+`)+_n(t[c],n?`${n}.${s}`:s,r-1,i);else if(e===`object`){let e=n?`${n}.${s}`:s;o+=(o&&`
+`)+vn(e,t[c],e,r-1,i)}else a+=s,a+=` = `,a+=mn(t[c],e,r,i),a+=`
+`}}return e&&(a||!o)&&(a=a?`[${e}]
+${a}`:`[${e}]`),a&&o?`${a}
+${o}`:a||o}w(vn,`stringifyTable`);function yn(e,{maxDepth:t=1e3,numbersAsFloat:n=!1}={}){if(W(e)!==`object`)throw TypeError(`stringify can only be called with an object`);let r=vn(0,e,``,t,n);return r[r.length-1]===`
+`?r:r+`
+`}w(yn,`stringify`);var bn={parse:un,stringify:yn,TomlDate:Jt,TomlError:V},xn={toml:{parse:w(e=>d(e),`parse`),stringify:w(e=>bn.stringify(e),`stringify`)},json:{parse:w(e=>JSON.parse(e),`parse`),stringify:w(e=>JSON.stringify(e,null,`	`),`stringify`)}};function G(e,t){return xn[e].parse(t)}w(G,`parseFile`);function Sn(e,t){return xn[e].stringify(t)}w(Sn,`stringifyFile`);var Cn=`config`;function wn(e){if(e===void 0||e===`default`){let e=c();return e===`production`?`default`:e}return z(e),e}w(wn,`resolveAuthProfileBaseName`);function Tn(e,t,n=`toml`){return y.join(e,Cn,`${wn(t)}.${n}`)}w(Tn,`getAuthConfigFilePath`);var En=class{constructor(e,t,n=`toml`){this.configPath=e,this.profile=t,this.format=n}static{w(this,`FileCredentialStore`)}kind=`file`;filePath(){return Tn(this.configPath,this.profile,this.format)}read(){let e=this.filePath();if(m(e))return G(this.format,t(e))}write(e){let t=this.filePath();h(y.dirname(t),{recursive:!0}),_(t,Sn(this.format,e),{encoding:`utf-8`,mode:384}),p(t,384)}clear(){let e=this.filePath(),t=m(e);return t&&g(e),t}path(){return this.filePath()}describe(){return this.filePath()}},K=32,Dn=12,On=16,kn=`AES-256-GCM`,An=`aes-256-gcm`;function jn(){return new Uint8Array(x(K))}w(jn,`generateKey`);function Mn(e,t){if(t.length!==K)throw Error(`AES-256-GCM requires a ${K}-byte key (got ${t.length} bytes).`);let n=x(Dn),r=re(An,t,n),i=Buffer.concat([r.update(e,`utf-8`),r.final()]),a=r.getAuthTag();return{v:1,alg:kn,iv:n.toString(`base64`),tag:a.toString(`base64`),ciphertext:i.toString(`base64`)}}w(Mn,`encryptString`);function Nn(e,t){if(t.length!==K)throw Error(`AES-256-GCM requires a ${K}-byte key (got ${t.length} bytes).`);if(e.v!==1)throw Error(`Unsupported encrypted envelope version: ${e.v}.`);let n=Buffer.from(e.iv,`base64`),r=Buffer.from(e.tag,`base64`),i=Buffer.from(e.ciphertext,`base64`);if(n.length!==Dn)throw Error(`Expected ${Dn}-byte IV in envelope (got ${n.length} bytes).`);if(r.length!==On)throw Error(`Expected ${On}-byte auth tag in envelope (got ${r.length} bytes).`);let a=ie(An,t,n);return a.setAuthTag(r),Buffer.concat([a.update(i),a.final()]).toString(`utf-8`)}w(Nn,`decryptString`);function Pn(e){if(typeof e!=`object`||!e)return;let t=e;if(!(t.v!==1||t.alg!==kn||typeof t.iv!=`string`||typeof t.tag!=`string`||typeof t.ciphertext!=`string`))return t}w(Pn,`parseEncryptedEnvelope`);function q(e,t){return y.join(e,`config`,`${wn(t)}.enc`)}w(q,`getEncryptedAuthConfigFilePath`);var Fn=class{constructor(e,t,n,r,i=`toml`){this.configPath=e,this.keyProvider=t,this.onPlaintextMigration=n,this.profile=r,this.format=i}static{w(this,`EncryptedFileCredentialStore`)}kind=`encrypted-file`;plaintextPath(){return Tn(this.configPath,this.profile,this.format)}read(){let e=q(this.configPath,this.profile);if(m(e))return this.readEncryptedFile(e);let t=this.plaintextPath();if(m(t))return this.migrateFromPlaintext(t,e)}write(e){let t=this.ensureKey(),n=Mn(Sn(this.format,e),t),r=q(this.configPath,this.profile);h(y.dirname(r),{recursive:!0}),_(r,JSON.stringify(n,null,`	`),{encoding:`utf-8`,mode:384}),p(r,384);let i=this.plaintextPath();m(i)&&g(i)}clear(){let e=q(this.configPath,this.profile),t=this.plaintextPath(),n=!1;m(e)&&(g(e),n=!0),m(t)&&(g(t),n=!0);try{this.keyProvider.deleteKey()}catch{}return n}path(){return q(this.configPath,this.profile)}describe(){return`Encrypted file (${q(this.configPath,this.profile)}) with key in ${this.keyProvider.describe()}`}readEncryptedFile(e){let n=this.keyProvider.getKey();if(n===void 0)return;let r=t(e),i;try{i=Pn(JSON.parse(r))}catch{return}if(i===void 0)return;let a;try{a=Nn(i,n)}catch{return}try{return G(this.format,a)}catch{return}}migrateFromPlaintext(e,n){let r=t(e),i;try{i=G(this.format,r)}catch{return}return this.write(i),this.onPlaintextMigration?.({plaintextPath:e,encryptedPath:n,keyProviderDescription:this.keyProvider.describe()}),i}ensureKey(){let e=this.keyProvider.getKey();if(e!==void 0)return e;let t=jn();return this.keyProvider.setKey(t),t}},J=`1.3.0`;function In(e){return C(`npm`,e,{encoding:`utf-8`,stdio:[`ignore`,`pipe`,`pipe`],shell:process.platform===`win32`})}w(In,`defaultNpmRunner`);var Ln=In,Y=new Map;function Rn(e){Ln=e??In,Y.clear()}w(Rn,`setNpmRunner`);function zn(e){return y.join(e,`native`,`keyring`)}w(zn,`getKeyringInstallDir`);function Bn(e){return y.join(e,`node_modules`,`@napi-rs`,`keyring`)}w(Bn,`getInstalledBindingPath`);function Vn(e){try{return f(e)(e),!0}catch{return!1}}w(Vn,`canLoadKeyringBinding`);function Hn(e){let t=Y.get(e);if(t!==void 0)return t;let n=Bn(e);if(m(y.join(n,`index.js`))&&Vn(n))return Y.set(e,n),n;try{let t=Ln([`root`,`-g`]);if(t.status===0){let n=y.join(t.stdout.trim(),`@napi-rs`,`keyring`);if(m(y.join(n,`index.js`))&&Vn(n))return Y.set(e,n),n}}catch{}return Y.set(e,null),null}w(Hn,`findKeyringBinding`);function Un(e){let t=e;h(t,{recursive:!0});let n=y.join(t,`package.json`);m(n)||_(n,JSON.stringify({private:!0,name:`cloudflare-auth-keyring-host`},null,`	`),`utf-8`);let i;try{i=Ln([`install`,`@napi-rs/keyring@${J}`,`--prefix`,t,`--no-save`,`--no-audit`,`--no-fund`,`--no-package-lock`,`--loglevel=error`])}catch(e){throw new r(`Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error?e.message:String(e)}
+
+Install \`npm\` and retry, or install the binding globally:
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring npm spawn failed`})}if(i.status!==0)throw new r(`Failed to install \`@napi-rs/keyring\` (npm exited ${i.status}):
+${i.stderr?.trim()??`(no stderr)`}
+
+Retry once the underlying issue is fixed, or install the binding globally:
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring npm install failed`});if(Y.delete(e),Hn(e)===null)throw new r(`\`npm\` reported success but the \`@napi-rs/keyring\` native binding still cannot be loaded.
+
+Its platform-specific binary ships as a separate optional package, so a download that was skipped or interrupted leaves the binding unusable.
+
+Retry once the underlying issue is fixed, or install the binding globally:
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring install incomplete`})}w(Un,`installKeyringBindingSync`);var Wn;function Gn(e){Wn=e}w(Gn,`setKeyringEntryFactory`);function Kn(e){if(Wn!==void 0)return Wn;let t=Hn(e);if(t===null)throw new r(`The \`@napi-rs/keyring\` native binding is not available.
+
+Retry the command, or install the binding globally:
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring binding not loadable`});let n=f(t)(t);return(e,t)=>new n.Entry(e,t)}w(Kn,`resolveKeyringEntryFactory`);function X(e){return wn(e)}w(X,`getKeyringAccountName`);function qn(e){let t={v:1,key:Buffer.from(e).toString(`base64`),created:new Date().toISOString()};return JSON.stringify(t)}w(qn,`encodeKeyEnvelope`);function Z(e){if(e===``)return;let t;try{t=JSON.parse(e)}catch{return}if(!(typeof t!=`object`||!t||t.v!==1||typeof t.key!=`string`))try{let e=Buffer.from(t.key,`base64`);return e.length===32?new Uint8Array(e):void 0}catch{return}}w(Z,`decodeKeyEnvelope`);function Jn(e,t={}){return C(`secret-tool`,e,{encoding:`utf-8`,input:t.input})}w(Jn,`defaultRunner`);var Q=Jn,Yn=void 0;function Xn(e){Q=e??Jn,Yn=void 0}w(Xn,`setLinuxSecretToolRunner`);function Zn(){if(Yn!==void 0)return Yn;let e;try{e=Q([`--version`]).error===void 0}catch{e=!1}return Yn=e,e}w(Zn,`probeSecretTool`);var Qn=class{constructor(e,t){this.serviceName=e,this.profile=t}static{w(this,`LinuxSecretToolKeyProvider`)}getKey(){let e=Q([`lookup`,`service`,this.serviceName,`account`,X(this.profile)]);if(e.status!==1){if(e.status!==0)throw Error(`Failed to read key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Z(e.stdout.trim())}}setKey(e){let t=Q([`store`,`--label=Cloudflare credentials key`,`service`,this.serviceName,`account`,X(this.profile)],{input:qn(e)});if(t.status!==0)throw Error(`Failed to write key via secret-tool (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=Q([`clear`,`service`,this.serviceName,`account`,X(this.profile)]);if(e.status!==0)throw Error(`Failed to delete key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`Linux secret-tool (service=${this.serviceName}, account=${X(this.profile)})`}},$n=44;function er(e,t={}){return C(`/usr/bin/security`,e,{encoding:`utf-8`,input:t.input})}w(er,`defaultRunner`);var tr=er;function nr(e){tr=e??er}w(nr,`setMacSecurityCommandRunner`);var rr=class{constructor(e,t){this.serviceName=e,this.profile=t}static{w(this,`MacSecurityKeyProvider`)}getKey(){let e=tr([`find-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile),`-w`]);if(e.status!==$n){if(e.status!==0)throw Error(`Failed to read key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Z(e.stdout.trim())}}setKey(e){let t=tr([`add-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile),`-w`,qn(e),`-U`]);if(t.status!==0)throw Error(`Failed to write key to macOS Keychain (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=tr([`delete-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile)]);if(!(e.status===0||e.status===$n))throw Error(`Failed to delete key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`macOS Keychain (service=${this.serviceName}, account=${X(this.profile)})`}},ir=class{constructor(e,t,n){this.serviceName=e,this.installDir=t,this.profile=n}static{w(this,`NapiKeyringKeyProvider`)}entry(){return Kn(this.installDir)(this.serviceName,X(this.profile))}getKey(){let e=this.entry().getPassword();if(!(e===null||e===``))return Z(e)}setKey(e){this.entry().setPassword(qn(e))}deleteKey(){try{this.entry().deletePassword()}catch{}}describe(){return`${process.platform===`win32`?`Windows Credential Manager`:`OS keyring`} via @napi-rs/keyring (service=${this.serviceName}, account=${X(this.profile)})`}},ar;function or(e){ar=e}w(or,`setKeyProviderFactoryForTesting`);function sr(e,t,n){if(ar!==void 0)return{kind:`available`,provider:ar(e,t)};switch(process.platform){case`darwin`:return{kind:`available`,provider:new rr(e,t)};case`linux`:return Zn()?{kind:`available`,provider:new Qn(e,t)}:{kind:`unsupported`};case`win32`:{let r=zn(n);return Hn(r)===null?{kind:`needs-install`,install:w(()=>Un(r),`install`),afterInstall:w(()=>new ir(e,r,t),`afterInstall`)}:{kind:`available`,provider:new ir(e,r,t)}}default:return{kind:`unsupported`}}}w(sr,`resolveKeyProvider`);var cr={installFailedThisSession:!1,hasWarnedAboutKeyringFallback:!1,hasWarnedAboutSecretToolMissing:!1};function lr(){return cr}w(lr,`getResolverSessionFlags`);function ur(){cr.installFailedThisSession=!1,cr.hasWarnedAboutKeyringFallback=!1,cr.hasWarnedAboutSecretToolMissing=!1}w(ur,`resetCredentialStorageState`);function dr(e){let t={...e,loginCommand:e.loginCommand??`your CLI login`,format:e.format??`toml`};function n(e){return fr(t,e)}w(n,`getActiveStore`);function r(e){return{read:w(()=>n(e).read(),`read`),write:w(t=>n(e).write(t),`write`),clear:w(()=>n(e).clear(),`clear`),path:w(()=>n(e).path(),`path`)}}return w(r,`storageFactory`),{storageFactory:r,getActiveStore:n}}w(dr,`createCredentialStorageContext`);function fr(e,t){let n=Ee(),r=e.getConfigPath();if(n===!1)return new En(r,t,e.format);let i=n===!0;if(!(n??e.isKeyringEnabled()??!1))return new En(r,t,e.format);let a=sr(e.serviceName,t,r);switch(a.kind){case`available`:return new Fn(r,a.provider,pr(e),t,e.format);case`needs-install`:return mr(a,i,e,t);case`unsupported`:return hr(i,e,t)}}w(fr,`resolveActiveCredentialStore`);function pr(e){return t=>{e.logger.warn(`Migrated credentials from ${t.plaintextPath} into ${t.encryptedPath} (key in ${t.keyProviderDescription}). The plaintext file has been deleted.`)}}w(pr,`buildMigrationLogger`);function mr(e,t,n,i){let a=lr();if(a.installFailedThisSession){if(t)throw new r(`CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,{telemetryMessage:`workers-auth keyring install previously failed`});return $(`The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,n,i)}if(n.isNonInteractiveOrCI())throw new r(_r(n.loginCommand),{telemetryMessage:`workers-auth keyring binding not installed`});try{n.logger.log(`🔐 Installing keyring backend (one-time, ~2 MB)…`),e.install()}catch(e){if(a.installFailedThisSession=!0,t)throw e instanceof r?e:new r(`Failed to install the keyring backend: ${e instanceof Error?e.message:String(e)}`,{telemetryMessage:`workers-auth keyring install threw`});return $(`Failed to install the keyring backend (${e instanceof Error?e.message:String(e)}); falling back to the plaintext credentials file.`,n,i)}return new Fn(n.getConfigPath(),e.afterInstall(),pr(n),i,n.format)}w(mr,`handleNeedsInstall`);function hr(e,t,n){let i=process.platform,a=i===`linux`,o=a?gr(t.loginCommand):`OS keyring storage is not supported on \`${i}\`; falling back to the plaintext credentials file.`;if(e)throw new r(a?`CLOUDFLARE_AUTH_USE_KEYRING is set but ${o}`:`CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${i}\`.`,{telemetryMessage:a?`workers-auth keyring secret tool missing`:`workers-auth keyring unsupported platform`});if(a&&t.isNonInteractiveOrCI())throw new r(o,{telemetryMessage:`workers-auth keyring secret tool missing`});let s=lr();return a?(s.hasWarnedAboutSecretToolMissing||(s.hasWarnedAboutSecretToolMissing=!0,t.logger.warn(`${o}
+
+Falling back to the plaintext credentials file for this session.`)),new En(t.getConfigPath(),n,t.format)):$(o,t,n)}w(hr,`handleUnsupported`);function $(e,t,n){let r=lr();return r.hasWarnedAboutKeyringFallback||(r.hasWarnedAboutKeyringFallback=!0,t.logger.warn(e)),new En(t.getConfigPath(),n,t.format)}w($,`fallbackToFileWithWarning`);function gr(e){return`\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
+
+Install it via your package manager:
+  Debian/Ubuntu:  sudo apt-get install libsecret-tools
+  Fedora/RHEL:    sudo dnf install libsecret
+  Arch:           sudo pacman -S libsecret
+  Alpine:         apk add libsecret
+
+Or disable keyring storage: \`${e} --no-use-keyring\`.`}w(gr,`secretToolMissingMessage`);function _r(e){return`\`@napi-rs/keyring\` is required for OS keyring storage on Windows but is not installed.
+
+Run \`${e} --use-keyring\` interactively to install it automatically, or install it globally for CI:
+
+  npm install -g @napi-rs/keyring@${J}
+
+Or disable keyring storage: \`${e} --no-use-keyring\`.`}w(_r,`windowsBindingMissingMessage`);function vr(e){let t=q(e.configPath,e.profile),n=m(t),r=sr(e.serviceName,e.profile,e.configPath);return r.kind===`available`?(new Fn(e.configPath,r.provider,void 0,e.profile,e.format??`toml`).clear(),{backendAvailable:!0,encryptedFileExisted:n}):(n&&g(t),{backendAvailable:!1,encryptedFileExisted:n})}w(vr,`scrubEncryptedCredentials`);export{Tn as a,Ee as c,vr as d,Sn as f,w as h,nt as i,q as l,z as m,Lt as n,de as o,he as p,zt as r,be as s,dr as t,G as u};

package/dist/chunk-QBZBEHZB-yeyhVUeD.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{r as e,t}from"./chunk-vbHwaUoU.mjs";import{Dt as n,I as r,at as i,f as a,k as o}from"./dist-DV7LR38l.mjs";import{createRequire as s}from"node:module";import{readFileSync as c}from"node:fs";import l from"node:assert";import u,{resolve as d}from"node:path";import{spawnSync as f}from"node:child_process";var p=Object.create,m=Object.defineProperty,h=Object.getOwnPropertyDescriptor,g=Object.getOwnPropertyNames,_=Object.getPrototypeOf,v=Object.prototype.hasOwnProperty,y=(e,t)=>m(e,`name`,{value:t,configurable:!0}),b=e===void 0?s(import.meta.url):e,x=(e,t)=>function(){return t||(0,e[g(e)[0]])((t={exports:{}}).exports,t),t.exports},S=(e,t)=>{for(var n in t)m(e,n,{get:t[n],enumerable:!0})},C=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(let i of g(t))!v.call(e,i)&&i!==n&&m(e,i,{get:()=>t[i],enumerable:!(r=h(t,i))||r.enumerable});return e},w=(e,t,n)=>(n=e==null?{}:p(_(e)),C(t||!e||!e.__esModule?m(n,`default`,{value:e,enumerable:!0}):n,e)),T=t(((t,n)=>{var r=e(`child_process`).exec,i=e(`child_process`).execSync,a=e(`fs`),o=e(`path`),s=a.access,c=a.accessSync,l=a.constants||a,u=process.platform==`win32`,d=function(e,t){s(e,l.F_OK,function(e){t(!e)})},f=function(e){try{return c(e,l.F_OK),!1}catch{return!0}},p=function(e,t){s(e,l.F_OK|l.X_OK,function(e){t(null,!e)})},m=function(e){try{return c(e,l.F_OK|l.X_OK),!0}catch{return!1}},h=function(e,t,n){d(e,function(i){if(!i){r(`command -v `+t+` 2>/dev/null && { echo >&1 `+t+`; exit 0; }`,function(e,t,r){n(null,!!t)});return}p(e,n)})},g=function(e,t,n){if(!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(e)){n(null,!1);return}r(`where `+t,function(e){e===null?n(null,!0):n(null,!1)})},_=function(e,t){if(f(e))try{return!!i(`command -v `+t+` 2>/dev/null && { echo >&1 `+t+`; exit 0; }`)}catch{return!1}return m(e)},v=function(e,t,n){if(!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(e))return!1;try{return!!i(`where `+t,{stdio:[]})}catch{return!1}},y=function(e){return/[^A-Za-z0-9_\/:=-]/.test(e)&&(e=`'`+e.replace(/'/g,`'\\''`)+`'`,e=e.replace(/^(?:'')+/g,``).replace(/\\'''/g,`\\'`)),e};u&&(y=function(e){if(/[\\]/.test(e)){var t=`"`+o.dirname(e)+`"`,n=`"`+o.basename(e)+`"`;return t+`:`+n}return`"`+e+`"`}),n.exports=function e(t,n){var r=y(t);if(!n&&typeof Promise<`u`)return new Promise(function(n,r){e(t,function(e,i){i?n(t):r(e)})});u?g(t,r,n):h(t,r,n)},n.exports.sync=function(e){var t=y(e);return u?v(e,t):_(e,t)}})),E=t(((e,t)=>{t.exports=T()})),ee=r(),D=E();function O(e){if(e.compiled_schema)return c(d(e.compiled_schema));let{base_path:t,source_schemas:r}=e,i=(r??[]).map(e=>d(t,e));if(!(0,D.sync)(`capnp`))throw new n(`The capnp compiler is required to upload capnp schemas, but is not present.`,{telemetryMessage:`capnp compiler missing`});let a=f(`capnp`,[`compile`,`-o-`,`--src-prefix=${d(t??`.`)}`,...i],{maxBuffer:3*1024*1024});if(a.error)throw a.error;if(a.stderr.length)throw Error(a.stderr.toString());return a.stdout}y(O,`handleUnsafeCapnp`);var k={esm:`application/javascript+module`,commonjs:`application/javascript`,"compiled-wasm":`application/wasm`,buffer:`application/octet-stream`,text:`text/plain`,python:`text/x-python`,"python-requirement":`text/x-python-requirement`};function A(e){let t=k[e];if(t===void 0)throw TypeError(`Unsupported module: `+e);return t}y(A,`toMimeType`);function j(e){let t=Object.keys(k).find(t=>k[t]===e);if(t===void 0)throw TypeError(`Unsupported mime type: `+e);return t}y(j,`fromMimeType`);function M(e,t,r){let s=new ee.FormData,{main:d,sourceMaps:f,migrations:p,exports:m,compatibility_date:h,compatibility_flags:g,keepVars:_,keepSecrets:v,keepBindings:y,logpush:b,placement:x,tail_consumers:S,streaming_tail_consumers:C,limits:w,annotations:T,keep_assets:E,assets:D,observability:k,cache:j,package_dependencies:M}=e,N={html_handling:D?.assetConfig?.html_handling,not_found_handling:D?.assetConfig?.not_found_handling,run_worker_first:D?.run_worker_first,_redirects:D?._redirects,_headers:D?._headers};if(D&&!D.routerConfig.has_user_worker)return s.set(`metadata`,JSON.stringify({assets:{jwt:D.jwt,config:N},...T&&{annotations:T},...h&&{compatibility_date:h},...g&&{compatibility_flags:g}})),s;let{modules:P}=e,F=[],te=a(`plain_text`,t),ne=a(`json`,t),re=a(`secret_text`,t),ie=a(`kv_namespace`,t),I=a(`send_email`,t),ae=a(`durable_object_namespace`,t),oe=a(`workflow`,t),se=a(`queue`,t),ce=a(`r2_bucket`,t),le=a(`d1`,t),ue=a(`vectorize`,t),de=a(`ai_search_namespace`,t),L=a(`ai_search`,t),R=a(`agent_memory`,t),z=a(`hyperdrive`,t),B=a(`secrets_store_secret`,t),V=a(`artifacts`,t),fe=a(`unsafe_hello_world`,t),pe=a(`flagship`,t),me=a(`ratelimit`,t),he=a(`vpc_service`,t),ge=a(`vpc_network`,t),_e=a(`service`,t),H=a(`analytics_engine`,t),ve=a(`dispatch_namespace`,t),ye=a(`mtls_certificate`,t),be=a(`pipeline`,t),xe=a(`worker_loader`,t),Se=a(`logfwdr`,t),Ce=a(`wasm_module`,t),U=a(`browser`,t)[0],W=a(`ai`,t)[0],G=a(`images`,t)[0],K=a(`stream`,t)[0],q=a(`media`,t)[0],J=a(`version_metadata`,t)[0],Y=a(`assets`,t)[0],we=a(`text_blob`,t),Te=a(`data_blob`,t);a(`inherit`,t).forEach(({binding:e})=>{F.push({name:e,type:`inherit`})}),te.forEach(({binding:e,value:t})=>{F.push({name:e,type:`plain_text`,text:t})}),ne.forEach(({binding:e,value:t})=>{F.push({name:e,type:`json`,json:t})}),re.forEach(({binding:e,value:t})=>{F.push({name:e,type:`secret_text`,text:t})}),ie.forEach(({id:e,binding:t,raw:a})=>{if(r?.dryRun&&(e??=i),e===void 0)throw new n(`${t} bindings must have an "id" field`,{telemetryMessage:`kv namespace binding missing id`});e===i?F.push({name:t,type:`inherit`}):F.push({name:t,type:`kv_namespace`,namespace_id:e,raw:a})}),I.forEach(e=>{let t={name:e.name,type:`send_email`,allowed_sender_addresses:e.allowed_sender_addresses};e.destination_address===void 0?e.allowed_destination_addresses===void 0?F.push(t):F.push({...t,allowed_destination_addresses:e.allowed_destination_addresses}):F.push({...t,destination_address:e.destination_address})}),ae.forEach(({name:e,class_name:t,script_name:n,environment:r})=>{F.push({name:e,type:`durable_object_namespace`,class_name:t,...n&&{script_name:n},...r&&{environment:r}})}),oe.forEach(({binding:e,name:t,class_name:n,script_name:r,raw:i})=>{F.push({type:`workflow`,name:e,workflow_name:t,class_name:n,script_name:r,raw:i})}),se.forEach(({binding:e,queue_name:t,delivery_delay:a,raw:o})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "queue" field. Add a "queue" field to the producer in your Worker configuration specifying the name of the Queue to bind to.`,{telemetryMessage:`queue binding missing name`});t===i?F.push({name:e,type:`inherit`}):F.push({type:`queue`,name:e,queue_name:t,delivery_delay:a,raw:o})}),ce.forEach(({binding:e,bucket_name:t,jurisdiction:a,raw:o})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "bucket_name" field. Add a "bucket_name" field to the binding in your Worker configuration specifying the name of the R2 bucket to bind to.`,{telemetryMessage:`r2 bucket binding missing bucket_name`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`r2_bucket`,bucket_name:t,jurisdiction:a,raw:o})}),le.forEach(({binding:e,database_id:t,database_internal_env:a,raw:o})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "database_id" field. Add a "database_id" field to the binding in your Worker configuration specifying the ID of the D1 database to bind to.`,{telemetryMessage:`d1 database binding missing database_id`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`d1`,id:t,internalEnv:a,raw:o})}),ue.forEach(({binding:e,index_name:t,raw:n})=>{F.push({name:e,type:`vectorize`,index_name:t,raw:n})}),de.forEach(({binding:e,namespace:t})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the AI Search namespace to bind to.`,{telemetryMessage:`ai search namespace binding missing namespace`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`ai_search_namespace`,namespace:t})}),L.forEach(({binding:e,instance_name:t})=>{F.push({name:e,type:`ai_search`,instance_name:t})}),R.forEach(({binding:e,namespace:t})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the namespace to bind to.`,{telemetryMessage:!1});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`agent_memory`,namespace:t})}),z.forEach(({binding:e,id:t})=>{F.push({name:e,type:`hyperdrive`,id:t})}),B.forEach(({binding:e,store_id:t,secret_name:n})=>{F.push({name:e,type:`secrets_store_secret`,store_id:t,secret_name:n})}),V.forEach(({binding:e,namespace:t})=>{F.push({name:e,type:`artifacts`,namespace:t})}),fe.forEach(({binding:e,enable_timer:t})=>{F.push({name:e,type:`unsafe_hello_world`,enable_timer:t})}),pe.forEach(({binding:e,app_id:t})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have an "app_id" field. Add an "app_id" field to the binding in your Worker configuration specifying the Flagship app to bind to.`,{telemetryMessage:`flagship binding missing app id`});F.push(t===i?{name:e,type:`inherit`}:{name:e,type:`flagship`,app_id:t})}),me.forEach(({name:e,namespace_id:t,simple:n})=>{F.push({name:e,type:`ratelimit`,namespace_id:t,simple:n})}),he.forEach(({binding:e,service_id:t})=>{F.push({name:e,type:`vpc_service`,service_id:t})}),ge.forEach(({binding:e,tunnel_id:t,network_id:n})=>{F.push({name:e,type:`vpc_network`,...t===void 0?{network_id:n}:{tunnel_id:t}})}),_e.forEach(({binding:e,service:t,environment:n,entrypoint:r,props:i,cross_account_grant:a})=>{F.push({name:e,type:`service`,service:t,cross_account_grant:a,...n&&{environment:n},...r&&{entrypoint:r},...i&&{props:i}})}),H.forEach(({binding:e,dataset:t})=>{F.push({name:e,type:`analytics_engine`,dataset:t})}),ve.forEach(({binding:e,namespace:t,outbound:a})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the dispatch namespace to bind to.`,{telemetryMessage:`dispatch namespace binding missing namespace`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`dispatch_namespace`,namespace:t,...a&&{outbound:{worker:{service:a.service,environment:a.environment},params:a.parameters?.map(e=>({name:e}))}}})}),ye.forEach(({binding:e,certificate_id:t})=>{F.push({name:e,type:`mtls_certificate`,certificate_id:t})}),be.forEach(({binding:e,stream:t,pipeline:n})=>{if(t)F.push({name:e,type:`pipelines`,stream:t});else if(n)F.push({name:e,type:`pipelines`,pipeline:n});else throw Error(`Pipeline binding must specify a stream or pipeline`)}),xe.forEach(({binding:e})=>{F.push({name:e,type:`worker_loader`})}),Se.forEach(({name:e,destination:t})=>{F.push({name:e,type:`logfwdr`,destination:t})}),Ce.forEach(({binding:e,source:t})=>{F.push({name:e,type:`wasm_module`,part:e}),s.set(e,new File([`contents`in t?t.contents:c(t.path)],`path`in t?t.path??e:e,{type:`application/wasm`}))}),U!==void 0&&F.push({name:U.binding,type:`browser`,raw:U.raw}),W!==void 0&&F.push({name:W.binding,staging:W.staging,type:`ai`,raw:W.raw}),G!==void 0&&F.push({name:G.binding,type:`images`,raw:G.raw}),K!==void 0&&F.push({name:K.binding,type:`stream`}),q!==void 0&&F.push({name:q.binding,type:`media`}),J!==void 0&&F.push({name:J.binding,type:`version_metadata`}),Y!==void 0&&F.push({name:Y.binding,type:`assets`}),we.forEach(({binding:e,source:t})=>{F.push({name:e,type:`text_blob`,part:e}),e!==`__STATIC_CONTENT_MANIFEST`&&(`contents`in t?s.set(e,new File([t.contents],t.path??e,{type:`text/plain`})):s.set(e,new File([c(t.path)],t.path,{type:`text/plain`})))}),Te.forEach(({binding:e,source:t})=>{F.push({name:e,type:`data_blob`,part:e}),s.set(e,new File([`contents`in t?t.contents:c(t.path)],`path`in t?t.path??e:e,{type:`application/octet-stream`}))});for(let[e,n]of Object.entries(t??{}))if(o(n.type)&&n.type!==`unsafe_hello_world`){let{type:t,...r}=n;F.push({name:e,type:t.slice(7),...r})}let X=`__STATIC_CONTENT_MANIFEST`;if(P?.some(({name:e})=>e===X)&&d.type===`esm`){l(P!==void 0);let e=new Set(P.map(e=>u.posix.dirname(e.name)));for(let t of e){if(t===`.`)continue;let e=u.posix.relative(t,X),n=u.posix.join(t,X);P.push({name:n,filePath:n,content:`export { default } from ${JSON.stringify(e)};`,type:`esm`})}}if(d.type===`commonjs`){for(let e of Object.values([...P||[]]))if(e.name===`__STATIC_CONTENT_MANIFEST`)s.set(e.name,new File([e.content],e.name,{type:`text/plain`})),P=P?.filter(t=>t!==e);else if(e.type===`compiled-wasm`||e.type===`text`||e.type===`buffer`){let t=e.name.replace(/[^a-zA-Z0-9_$]/g,`_`);F.push({name:t,type:e.type===`compiled-wasm`?`wasm_module`:e.type===`text`?`text_blob`:`data_blob`,part:t}),s.set(t,new File([e.content],e.name,{type:e.type===`compiled-wasm`?`application/wasm`:e.type===`text`?`text/plain`:`application/octet-stream`})),P=P?.filter(t=>t!==e)}}let Z;if(r?.unsafe?.capnp){let e=O(r.unsafe.capnp);Z=`./capnp-${Date.now()}.compiled`,s.set(Z,new File([e],Z,{type:`application/octet-stream`}))}let Q;_&&(Q??=[],Q.push(`plain_text`,`json`)),v&&(Q??=[],Q.push(`secret_text`,`secret_key`)),y&&(Q??=[],Q.push(...y));let $={...d.type===`commonjs`?{body_part:d.name}:{main_module:d.name},bindings:F,containers:e.containers===void 0?void 0:e.containers.map(e=>({...e.name!==void 0&&{name:e.name},...e.class_name!==void 0&&{class_name:e.class_name},...e.images!==void 0&&{images:e.images}})),...h&&{compatibility_date:h},...g&&{compatibility_flags:g},...p&&{migrations:p},...m&&Object.keys(m).length>0&&{exports:m},capnp_schema:Z,...Q&&{keep_bindings:Q},...b!==void 0&&{logpush:b},...x&&{placement:x},...S&&{tail_consumers:S},...C&&{streaming_tail_consumers:C},...w&&{limits:w},...T&&{annotations:T},...E!==void 0&&{keep_assets:E},...D&&{assets:{jwt:D.jwt,config:N}},...k&&{observability:k},...j&&{cache_options:j},...M?.length&&{package_dependencies:M}};if(r?.unsafe?.metadata!==void 0)for(let e of Object.keys(r.unsafe.metadata))$[e]=r.unsafe.metadata[e];if(s.set(`metadata`,JSON.stringify($)),d.type===`commonjs`&&P&&P.length>0)throw TypeError(`More than one module can only be specified when type = 'esm'`);for(let e of[d].concat(P||[]))s.set(e.name,new File([e.content],e.name,{type:A(e.type??d.type??`esm`)}));for(let e of f||[])s.set(e.name,new File([e.content],e.name,{type:`application/source-map`}));return s}y(M,`createWorkerUploadForm`);export{S as a,w as c,x as i,j as n,y as o,k as r,b as s,M as t};

package/dist/{client-certificates-DDUv8K0a.mjs → client-certificates-RBRqYP3f.mjs}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{h as e}from"./oauth-B0ETkNcX.mjs";import{r as t}from"./auth-MQEamPN9.mjs";import{t as n}from"./output-DrpYYfnB.mjs";import{n as r,t as i}from"./progress-CsHIt3Tp.mjs";import{n as a,t as o}from"./body-parser-C-c9gfH1.mjs";import{n as s}from"./input-validation-Bav2M9F-.mjs";import{a as c,n as l}from"./prompt-DdegNPpg.mjs";import{t as u}from"./cli-types-BsTty22w.mjs";function d(e){return e.option(`csr`,{type:`string`,description:`The Certificate Signing Request (CSR). Must be newline-encoded.`}).option(`validity-days`,{type:`number`,description:`The number of days the Client Certificate will be valid after the issued_on date.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const f={command:`create`,describe:`Create a new API Shield mTLS Client Certificate.`,builder:d,handler:async l=>{if(l.dryRun){r({command:`cf client-certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${l.zone??l.zoneId??`<zone>`}/client_certificates`,pathParams:{"zone-id":String(l.zone??l[`zone-id`]??``)},bodyKind:`json`,body:l.body===void 0?o({csr:s(l.csr,`csr`,`text`),validity_days:l[`validity-days`]}):a(l.body)});return}let u=await t(l),d=await e({zone:l.zone},u,{quiet:l.quiet});if(l.zoneId=d,l.body){let e=a(l.body);n(await i(`Creating`,async()=>u.clientCertificates.create({...e,zone_id:d})),{successLabel:`Created`});return}if(l.csr===void 0&&(l.csr=await c(`csr`,`The Certificate Signing Request (CSR). Must be newline-encoded.`)),l[`validity-days`]===void 0)throw Error(`--validity-days is required (or pass --body with this field set).`);let f=o({csr:s(l.csr,`csr`,`text`),validity_days:l[`validity-days`]});n(await i(`Creating`,async()=>u.clientCertificates.create({...f,zone_id:d})),{successLabel:`Created`})}};function p(e){return e.positional(`client-certificate-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const m={command:`delete <client-certificate-id>`,describe:`Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status.`,builder:p,handler:async a=>{if(a.dryRun){r({command:`cf client-certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/client_certificates/${a[`client-certificate-id`]==null?`<client-certificate-id>`:encodeURIComponent(String(a[`client-certificate-id`]))}`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``),"client-certificate-id":String(a[`client-certificate-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});if(a.zoneId=s,!await l({force:!!a.force})){process.stderr.write(`Aborted.
+import{h as e}from"./oauth-DAa7SwkM.mjs";import{r as t}from"./auth-DY_Y2bXC.mjs";import{t as n}from"./output-BqDR9h74.mjs";import{t as r}from"./dry-run-ILZRVpnp.mjs";import{t as i}from"./progress-jYW64HY7.mjs";import{n as a,t as o}from"./body-parser-BGVbwPeM.mjs";import{n as s}from"./input-validation-1esLElok.mjs";import{a as c,n as l}from"./prompt-CyATfGUu.mjs";import{t as u}from"./cli-types-C3nVfpSG.mjs";function d(e){return e.option(`csr`,{type:`string`,description:`The Certificate Signing Request (CSR). Must be newline-encoded.`}).option(`validity-days`,{type:`number`,description:`The number of days the Client Certificate will be valid after the issued_on date.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const f={command:`create`,describe:`Create a new API Shield mTLS Client Certificate.`,builder:d,handler:async l=>{if(l.dryRun){r({command:`cf client-certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${l.zone??l.zoneId??`<zone>`}/client_certificates`,pathParams:{"zone-id":String(l.zone??l[`zone-id`]??``)},bodyKind:`json`,body:l.body===void 0?o({csr:s(l.csr,`csr`,`text`),validity_days:l[`validity-days`]}):a(l.body)});return}let u=await t(l),d=await e({zone:l.zone},u,{quiet:l.quiet});if(l.zoneId=d,l.body){let e=a(l.body);n(await i(`Creating`,async()=>u.clientCertificates.create({...e,zone_id:d})),{successLabel:`Created`});return}if(l.csr===void 0&&(l.csr=await c(`csr`,`The Certificate Signing Request (CSR). Must be newline-encoded.`)),l[`validity-days`]===void 0)throw Error(`--validity-days is required (or pass --body with this field set).`);let f=o({csr:s(l.csr,`csr`,`text`),validity_days:l[`validity-days`]});n(await i(`Creating`,async()=>u.clientCertificates.create({...f,zone_id:d})),{successLabel:`Created`})}};function p(e){return e.positional(`client-certificate-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const m={command:`delete <client-certificate-id>`,describe:`Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status.`,builder:p,handler:async a=>{if(a.dryRun){r({command:`cf client-certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/client_certificates/${a[`client-certificate-id`]==null?`<client-certificate-id>`:encodeURIComponent(String(a[`client-certificate-id`]))}`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``),"client-certificate-id":String(a[`client-certificate-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});if(a.zoneId=s,!await l({force:!!a.force})){process.stderr.write(`Aborted.
 `);return}n(await i(`Deleting`,async()=>o.clientCertificates.delete({zone_id:s,client_certificate_id:a[`client-certificate-id`]})),{successLabel:`Deleted`})}};function h(e){return e.positional(`client-certificate-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`reactivate`,{type:`boolean`,description:`The reactivate field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const g={command:`edit <client-certificate-id>`,describe:`If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint.`,builder:h,handler:async s=>{if(s.dryRun){r({command:`cf client-certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${s.zone??s.zoneId??`<zone>`}/client_certificates/${s[`client-certificate-id`]==null?`<client-certificate-id>`:encodeURIComponent(String(s[`client-certificate-id`]))}`,pathParams:{"zone-id":String(s.zone??s[`zone-id`]??``),"client-certificate-id":String(s[`client-certificate-id`]??``)},bodyKind:`json`,body:s.body===void 0?o({reactivate:s.reactivate}):a(s.body)});return}let c=await t(s),l=await e({zone:s.zone},c,{quiet:s.quiet});if(s.zoneId=l,s.body){let e=a(s.body);n(await i(`Updating`,async()=>c.clientCertificates.edit({...e,zone_id:l,client_certificate_id:s[`client-certificate-id`]})),{successLabel:`Updated`});return}let u=o({reactivate:s.reactivate});n(await i(`Updating`,async()=>c.clientCertificates.edit({...u,zone_id:l,client_certificate_id:s[`client-certificate-id`]})),{successLabel:`Updated`})}};function _(e){return e.positional(`client-certificate-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const v={command:`get <client-certificate-id>`,describe:`Get Details for a single mTLS API Shield Client Certificate.`,builder:_,handler:async a=>{if(a.dryRun){r({command:`cf client-certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/client_certificates/${a[`client-certificate-id`]==null?`<client-certificate-id>`:encodeURIComponent(String(a[`client-certificate-id`]))}`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``),"client-certificate-id":String(a[`client-certificate-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});a.zoneId=s,n(await i(`Loading`,async()=>o.clientCertificates.get({zone_id:s,client_certificate_id:a[`client-certificate-id`]})),{successLabel:`Loaded`})}};function y(e){return e.option(`status`,{type:`string`,description:`Client Certitifcate Status to filter results by.`,choices:[`all`,`active`,`pending_reactivation`,`pending_revocation`,`revoked`]}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of records per page.`}).option(`limit`,{type:`number`,description:`Limit to the number of records returned.`}).option(`offset`,{type:`number`,description:`Offset the results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const b={command:`list`,describe:`List all of your Zone's API Shield mTLS Client Certificates by Status and/or using Pagination.`,builder:u(y),handler:async a=>{let o={status:a.status,page:a.page,per_page:a[`per-page`],limit:a.limit,offset:a.offset};if(a.dryRun){r({command:`cf client-certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/client_certificates`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``)},query:o,bodyKind:`none`});return}let s=await t(a),c=await e({zone:a.zone},s,{quiet:a.quiet});a.zoneId=c,n(await i(`Loading`,async()=>s.clientCertificates.list({zone_id:c,...o})),{successLabel:`Loaded`})}},x={command:`client-certificates`,describe:`client-certificates`,builder:e=>e.command(f).command(m).command(g).command(v).command(b).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{x as default};

package/dist/{client-side-security-D4ysjwWT.mjs → client-side-security-HOmA37et.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{h as e}from"./oauth-B0ETkNcX.mjs";import{r as t}from"./auth-MQEamPN9.mjs";import{t as n}from"./output-DrpYYfnB.mjs";import{n as r,t as i}from"./progress-CsHIt3Tp.mjs";import{n as a,t as o}from"./body-parser-C-c9gfH1.mjs";import{n as s}from"./input-validation-Bav2M9F-.mjs";import{a as c,i as l,n as u}from"./prompt-DdegNPpg.mjs";import{t as d}from"./cli-types-BsTty22w.mjs";function f(e){return e.positional(`connection-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const p={command:`get <connection-id>`,describe:`Returns a webpage connection detected on the zone by connection ID.`,builder:f,handler:async a=>{if(a.dryRun){r({command:`cf client-side-security connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/page_shield/connections/${a[`connection-id`]==null?`<connection-id>`:encodeURIComponent(String(a[`connection-id`]))}`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``),"connection-id":String(a[`connection-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});a.zoneId=s,n(await i(`Loading`,async()=>o.clientSideSecurity.connections.get({zone_id:s,connection_id:a[`connection-id`]})),{successLabel:`Loaded`})}};function m(e){return e.option(`exclude-urls`,{type:`string`,description:`Excludes connections whose URL contains one of the URL-encoded URLs separated by commas.`}).option(`urls`,{type:`string`,description:`Includes connections whose URL contain one or more URL-encoded URLs separated by commas.`}).option(`hosts`,{type:`string`,description:`Includes connections that match one or more URL-encoded hostnames separated by commas.
+import{h as e}from"./oauth-DAa7SwkM.mjs";import{r as t}from"./auth-DY_Y2bXC.mjs";import{t as n}from"./output-BqDR9h74.mjs";import{t as r}from"./dry-run-ILZRVpnp.mjs";import{t as i}from"./progress-jYW64HY7.mjs";import{n as a,t as o}from"./body-parser-BGVbwPeM.mjs";import{n as s}from"./input-validation-1esLElok.mjs";import{a as c,i as l,n as u}from"./prompt-CyATfGUu.mjs";import{t as d}from"./cli-types-C3nVfpSG.mjs";function f(e){return e.positional(`connection-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const p={command:`get <connection-id>`,describe:`Returns a webpage connection detected on the zone by connection ID.`,builder:f,handler:async a=>{if(a.dryRun){r({command:`cf client-side-security connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/page_shield/connections/${a[`connection-id`]==null?`<connection-id>`:encodeURIComponent(String(a[`connection-id`]))}`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``),"connection-id":String(a[`connection-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});a.zoneId=s,n(await i(`Loading`,async()=>o.clientSideSecurity.connections.get({zone_id:s,connection_id:a[`connection-id`]})),{successLabel:`Loaded`})}};function m(e){return e.option(`exclude-urls`,{type:`string`,description:`Excludes connections whose URL contains one of the URL-encoded URLs separated by commas.`}).option(`urls`,{type:`string`,description:`Includes connections whose URL contain one or more URL-encoded URLs separated by commas.`}).option(`hosts`,{type:`string`,description:`Includes connections that match one or more URL-encoded hostnames separated by commas.
 
 Wildcards are supported at the start and end of each hostname to support starts with, ends with
 and contains. If no wildcards are used, results will be filtered by exact match`}).option(`page`,{type:`string`,description:`The current page number of the paginated results.

package/dist/cloud-connector-C7hw1c1f.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{h as e}from"./oauth-DAa7SwkM.mjs";import{r as t}from"./auth-DY_Y2bXC.mjs";import{t as n}from"./output-BqDR9h74.mjs";import{t as r}from"./dry-run-ILZRVpnp.mjs";import{t as i}from"./progress-jYW64HY7.mjs";import{n as a}from"./body-parser-BGVbwPeM.mjs";function o(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const s={command:`list`,describe:`Retrieves the Cloud Connector rules configured for a zone. Rules define how traffic is routed to cloud services.`,builder:o,handler:async a=>{if(a.dryRun){r({command:`cf cloud-connector rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/cloud_connector/rules`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});a.zoneId=s,n(await i(`Loading`,async()=>o.cloudConnector.rules.list({zone_id:s})),{successLabel:`Loaded`})}};function c(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const l={command:`update`,describe:`Updates Cloud Connector rules for a zone, replacing the existing rule configuration.`,builder:c,handler:async o=>{if(o.dryRun){r({command:`cf cloud-connector rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${o.zone??o.zoneId??`<zone>`}/cloud_connector/rules`,pathParams:{"zone-id":String(o.zone??o[`zone-id`]??``)},bodyKind:`json`,body:o.body===void 0?void 0:a(o.body)});return}let s=await t(o),c=await e({zone:o.zone},s,{quiet:o.quiet});if(o.zoneId=c,o.body){let e=a(o.body);n(await i(`Updating`,async()=>s.cloudConnector.rules.update({body:e,zone_id:c})),{successLabel:`Updated`});return}if(o.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},u={command:`rules`,describe:`Routing rules that map request patterns to cloud provider endpoints`,builder:e=>e.command(s).command(l).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},d={command:`cloud-connector`,describe:`Route traffic from Cloudflare directly to cloud provider services (AWS, Azure, GCP) without origin servers`,builder:e=>e.command(u).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{d as default};