cf 0.11.0 → 0.12.0

package/dist/{cf-Ds4JFovl.mjs → cf-yPz_IqW6.mjs}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
-import{C as e,H as t,M as n,St as r,T as i,Tt as a,V as o,Z as s,f as c,k as l,l as u,q as d,w as f}from"./dist-BWpErtDM.mjs";import{a as p,c as m,d as h,f as g,h as _,i as v,l as y,m as b,n as ee,o as te,p as ne,r as x,s as re,t as ie,u as S}from"./chunk-LQW53VED-22IYZovK.mjs";import{chmodSync as C,existsSync as w,mkdirSync as T,readFileSync as E,readdirSync as D,rmSync as O,writeFileSync as k}from"node:fs";import A from"node:path";import{URLSearchParams as ae}from"node:url";function j(e){function t(){return A.resolve(e(),`preferences.json`)}_(t,`getUserPreferencesPath`);function n(){try{let e=E(t(),`utf8`),n=JSON.parse(e);return typeof n==`object`&&n?n:{}}catch{return{}}}_(n,`readUserPreferences`);function r(e){let r={...n(),...e},i=t();T(A.dirname(i),{recursive:!0}),k(i,JSON.stringify(r,null,`	`),{encoding:`utf-8`})}return _(r,`updateUserPreferences`),{readUserPreferences:n,updateUserPreferences:r}}_(j,`createPreferences`);var M=6e4,N=525600,P=43200,F=1440,I=Symbol.for(`constructDateFrom`);function L(e,t){return typeof e==`function`?e(t):e&&typeof e==`object`&&I in e?e[I](t):e instanceof Date?new e.constructor(t):new Date(t)}_(L,`constructFrom`);function R(e,t){return L(t||e,e)}_(R,`toDate`);var z={};function B(){return z}_(B,`getDefaultOptions`);function V(e){let t=R(e),n=new Date(Date.UTC(t.getFullYear(),t.getMonth(),t.getDate(),t.getHours(),t.getMinutes(),t.getSeconds(),t.getMilliseconds()));return n.setUTCFullYear(t.getFullYear()),e-+n}_(V,`getTimezoneOffsetInMilliseconds`);function H(e,...t){let n=L.bind(null,e||t.find(e=>typeof e==`object`));return t.map(n)}_(H,`normalizeDates`);function U(e,t){let n=R(e)-+R(t);return n<0?-1:n>0?1:n}_(U,`compareAsc`);function oe(e){return L(e,Date.now())}_(oe,`constructNow`);function se(e){return t=>{let n=(e?Math[e]:Math.trunc)(t);return n===0?0:n}}_(se,`getRoundingMethod`);var ce={lessThanXSeconds:{one:`less than a second`,other:`less than {{count}} seconds`},xSeconds:{one:`1 second`,other:`{{count}} seconds`},halfAMinute:`half a minute`,lessThanXMinutes:{one:`less than a minute`,other:`less than {{count}} minutes`},xMinutes:{one:`1 minute`,other:`{{count}} minutes`},aboutXHours:{one:`about 1 hour`,other:`about {{count}} hours`},xHours:{one:`1 hour`,other:`{{count}} hours`},xDays:{one:`1 day`,other:`{{count}} days`},aboutXWeeks:{one:`about 1 week`,other:`about {{count}} weeks`},xWeeks:{one:`1 week`,other:`{{count}} weeks`},aboutXMonths:{one:`about 1 month`,other:`about {{count}} months`},xMonths:{one:`1 month`,other:`{{count}} months`},aboutXYears:{one:`about 1 year`,other:`about {{count}} years`},xYears:{one:`1 year`,other:`{{count}} years`},overXYears:{one:`over 1 year`,other:`over {{count}} years`},almostXYears:{one:`almost 1 year`,other:`almost {{count}} years`}},le=_((e,t,n)=>{let r,i=ce[e];return r=typeof i==`string`?i:t===1?i.one:i.other.replace(`{{count}}`,t.toString()),n?.addSuffix?n.comparison&&n.comparison>0?`in `+r:r+` ago`:r},`formatDistance`);function W(e){return(t={})=>{let n=t.width?String(t.width):e.defaultWidth;return e.formats[n]||e.formats[e.defaultWidth]}}_(W,`buildFormatLongFn`);var ue={date:W({formats:{full:`EEEE, MMMM do, y`,long:`MMMM do, y`,medium:`MMM d, y`,short:`MM/dd/yyyy`},defaultWidth:`full`}),time:W({formats:{full:`h:mm:ss a zzzz`,long:`h:mm:ss a z`,medium:`h:mm:ss a`,short:`h:mm a`},defaultWidth:`full`}),dateTime:W({formats:{full:`{{date}} 'at' {{time}}`,long:`{{date}} 'at' {{time}}`,medium:`{{date}}, {{time}}`,short:`{{date}}, {{time}}`},defaultWidth:`full`})},de={lastWeek:`'last' eeee 'at' p`,yesterday:`'yesterday at' p`,today:`'today at' p`,tomorrow:`'tomorrow at' p`,nextWeek:`eeee 'at' p`,other:`P`},fe=_((e,t,n,r)=>de[e],`formatRelative`);function G(e){return(t,n)=>{let r=n?.context?String(n.context):`standalone`,i;if(r===`formatting`&&e.formattingValues){let t=e.defaultFormattingWidth||e.defaultWidth,r=n?.width?String(n.width):t;i=e.formattingValues[r]||e.formattingValues[t]}else{let t=e.defaultWidth,r=n?.width?String(n.width):e.defaultWidth;i=e.values[r]||e.values[t]}let a=e.argumentCallback?e.argumentCallback(t):t;return i[a]}}_(G,`buildLocalizeFn`);var pe={ordinalNumber:_((e,t)=>{let n=Number(e),r=n%100;if(r>20||r<10)switch(r%10){case 1:return n+`st`;case 2:return n+`nd`;case 3:return n+`rd`}return n+`th`},`ordinalNumber`),era:G({values:{narrow:[`B`,`A`],abbreviated:[`BC`,`AD`],wide:[`Before Christ`,`Anno Domini`]},defaultWidth:`wide`}),quarter:G({values:{narrow:[`1`,`2`,`3`,`4`],abbreviated:[`Q1`,`Q2`,`Q3`,`Q4`],wide:[`1st quarter`,`2nd quarter`,`3rd quarter`,`4th quarter`]},defaultWidth:`wide`,argumentCallback:_(e=>e-1,`argumentCallback`)}),month:G({values:{narrow:[`J`,`F`,`M`,`A`,`M`,`J`,`J`,`A`,`S`,`O`,`N`,`D`],abbreviated:[`Jan`,`Feb`,`Mar`,`Apr`,`May`,`Jun`,`Jul`,`Aug`,`Sep`,`Oct`,`Nov`,`Dec`],wide:[`January`,`February`,`March`,`April`,`May`,`June`,`July`,`August`,`September`,`October`,`November`,`December`]},defaultWidth:`wide`}),day:G({values:{narrow:[`S`,`M`,`T`,`W`,`T`,`F`,`S`],short:[`Su`,`Mo`,`Tu`,`We`,`Th`,`Fr`,`Sa`],abbreviated:[`Sun`,`Mon`,`Tue`,`Wed`,`Thu`,`Fri`,`Sat`],wide:[`Sunday`,`Monday`,`Tuesday`,`Wednesday`,`Thursday`,`Friday`,`Saturday`]},defaultWidth:`wide`}),dayPeriod:G({values:{narrow:{am:`a`,pm:`p`,midnight:`mi`,noon:`n`,morning:`morning`,afternoon:`afternoon`,evening:`evening`,night:`night`},abbreviated:{am:`AM`,pm:`PM`,midnight:`midnight`,noon:`noon`,morning:`morning`,afternoon:`afternoon`,evening:`evening`,night:`night`},wide:{am:`a.m.`,pm:`p.m.`,midnight:`midnight`,noon:`noon`,morning:`morning`,afternoon:`afternoon`,evening:`evening`,night:`night`}},defaultWidth:`wide`,formattingValues:{narrow:{am:`a`,pm:`p`,midnight:`mi`,noon:`n`,morning:`in the morning`,afternoon:`in the afternoon`,evening:`in the evening`,night:`at night`},abbreviated:{am:`AM`,pm:`PM`,midnight:`midnight`,noon:`noon`,morning:`in the morning`,afternoon:`in the afternoon`,evening:`in the evening`,night:`at night`},wide:{am:`a.m.`,pm:`p.m.`,midnight:`midnight`,noon:`noon`,morning:`in the morning`,afternoon:`in the afternoon`,evening:`in the evening`,night:`at night`}},defaultFormattingWidth:`wide`})};function K(e){return(t,n={})=>{let r=n.width,i=r&&e.matchPatterns[r]||e.matchPatterns[e.defaultMatchWidth],a=t.match(i);if(!a)return null;let o=a[0],s=r&&e.parsePatterns[r]||e.parsePatterns[e.defaultParseWidth],c=Array.isArray(s)?me(s,e=>e.test(o)):q(s,e=>e.test(o)),l;l=e.valueCallback?e.valueCallback(c):c,l=n.valueCallback?n.valueCallback(l):l;let u=t.slice(o.length);return{value:l,rest:u}}}_(K,`buildMatchFn`);function q(e,t){for(let n in e)if(Object.prototype.hasOwnProperty.call(e,n)&&t(e[n]))return n}_(q,`findKey`);function me(e,t){for(let n=0;n<e.length;n++)if(t(e[n]))return n}_(me,`findIndex`);function he(e){return(t,n={})=>{let r=t.match(e.matchPattern);if(!r)return null;let i=r[0],a=t.match(e.parsePattern);if(!a)return null;let o=e.valueCallback?e.valueCallback(a[0]):a[0];o=n.valueCallback?n.valueCallback(o):o;let s=t.slice(i.length);return{value:o,rest:s}}}_(he,`buildMatchPatternFn`);var ge={code:`en-US`,formatDistance:le,formatLong:ue,formatRelative:fe,localize:pe,match:{ordinalNumber:he({matchPattern:/^(\d+)(th|st|nd|rd)?/i,parsePattern:/\d+/i,valueCallback:_(e=>parseInt(e,10),`valueCallback`)}),era:K({matchPatterns:{narrow:/^(b|a)/i,abbreviated:/^(b\.?\s?c\.?|b\.?\s?c\.?\s?e\.?|a\.?\s?d\.?|c\.?\s?e\.?)/i,wide:/^(before christ|before common era|anno domini|common era)/i},defaultMatchWidth:`wide`,parsePatterns:{any:[/^b/i,/^(a|c)/i]},defaultParseWidth:`any`}),quarter:K({matchPatterns:{narrow:/^[1234]/i,abbreviated:/^q[1234]/i,wide:/^[1234](th|st|nd|rd)? quarter/i},defaultMatchWidth:`wide`,parsePatterns:{any:[/1/i,/2/i,/3/i,/4/i]},defaultParseWidth:`any`,valueCallback:_(e=>e+1,`valueCallback`)}),month:K({matchPatterns:{narrow:/^[jfmasond]/i,abbreviated:/^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)/i,wide:/^(january|february|march|april|may|june|july|august|september|october|november|december)/i},defaultMatchWidth:`wide`,parsePatterns:{narrow:[/^j/i,/^f/i,/^m/i,/^a/i,/^m/i,/^j/i,/^j/i,/^a/i,/^s/i,/^o/i,/^n/i,/^d/i],any:[/^ja/i,/^f/i,/^mar/i,/^ap/i,/^may/i,/^jun/i,/^jul/i,/^au/i,/^s/i,/^o/i,/^n/i,/^d/i]},defaultParseWidth:`any`}),day:K({matchPatterns:{narrow:/^[smtwf]/i,short:/^(su|mo|tu|we|th|fr|sa)/i,abbreviated:/^(sun|mon|tue|wed|thu|fri|sat)/i,wide:/^(sunday|monday|tuesday|wednesday|thursday|friday|saturday)/i},defaultMatchWidth:`wide`,parsePatterns:{narrow:[/^s/i,/^m/i,/^t/i,/^w/i,/^t/i,/^f/i,/^s/i],any:[/^su/i,/^m/i,/^tu/i,/^w/i,/^th/i,/^f/i,/^sa/i]},defaultParseWidth:`any`}),dayPeriod:K({matchPatterns:{narrow:/^(a|p|mi|n|(in the|at) (morning|afternoon|evening|night))/i,any:/^([ap]\.?\s?m\.?|midnight|noon|(in the|at) (morning|afternoon|evening|night))/i},defaultMatchWidth:`any`,parsePatterns:{any:{am:/^a/i,pm:/^p/i,midnight:/^mi/i,noon:/^no/i,morning:/morning/i,afternoon:/afternoon/i,evening:/evening/i,night:/night/i}},defaultParseWidth:`any`})},options:{weekStartsOn:0,firstWeekContainsDate:1}};function _e(e,t,n){let r=B(),i=n?.locale??r.locale??ge,a=U(e,t);if(isNaN(a))throw RangeError(`Invalid time value`);let o=Object.assign({},n,{addSuffix:n?.addSuffix,comparison:a}),[s,c]=H(n?.in,...a>0?[t,e]:[e,t]),l=se(n?.roundingMethod??`round`),u=c.getTime()-s.getTime(),d=u/M,f=(u-(V(c)-V(s)))/M,p=n?.unit,m;if(m=p||(d<1?`second`:d<60?`minute`:d<F?`hour`:f<P?`day`:f<N?`month`:`year`),m===`second`){let e=l(u/1e3);return i.formatDistance(`xSeconds`,e,o)}else if(m===`minute`){let e=l(d);return i.formatDistance(`xMinutes`,e,o)}else if(m===`hour`){let e=l(d/60);return i.formatDistance(`xHours`,e,o)}else if(m===`day`){let e=l(f/F);return i.formatDistance(`xDays`,e,o)}else if(m===`month`){let e=l(f/P);return e===12&&p!==`month`?i.formatDistance(`xYears`,1,o):i.formatDistance(`xMonths`,e,o)}else{let e=l(f/N);return i.formatDistance(`xYears`,e,o)}}_(_e,`formatDistanceStrict`);function ve(e,t){return _e(e,oe(e),t)}_(ve,`formatDistanceToNowStrict`);function J(e,t){return{read:_(()=>{let n=t();if(!w(n))return;let i=r(n);try{return S(e,i)}catch{return}},`read`),write(n){let r=t();T(A.dirname(r),{recursive:!0}),k(r,g(e,n),{encoding:`utf-8`,mode:384}),C(r,384)},clear(){let e=t(),n=w(e);return O(e,{force:!0}),n},path:t}}_(J,`createFileStorage`);function ye(e){let{logger:t,prompt:n}=e;return _(async function(e,r){if(i())return t.log(r),!0;let a=await n(e);return typeof a==`string`&&a.trim().toLowerCase()===`yes`},`ensureTemporaryTermsAccepted`)}_(ye,`createTemporaryTermsPrompt`);var be=[9106,1e4];function Y(e){return e?.code}_(Y,`getErrorCode`);function xe(e){let t=Y(e);return t!==void 0&&be.includes(t)}_(xe,`isMembershipsInaccessible`);function Se(e){return{"no-credentials-non-interactive":`Could not authenticate because no credentials were found and the environment is non-interactive. Set a CLOUDFLARE_API_TOKEN environment variable or run \`${e}\` in an interactive terminal first.`,"no-credentials-login-failed":`No credentials were found and the login attempt was unsuccessful. Run \`${e}\` to try again.`,"token-expired-non-interactive":`Your auth token has expired and could not be refreshed, and the environment is non-interactive. Run \`${e}\` in an interactive terminal or set a CLOUDFLARE_API_TOKEN.`,"token-expired-login-failed":`Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${e}\` to try again.`}}_(Se,`notLoggedInErrorBodies`);function Ce(e,t,n){let r=new Date(t.claim.expiresAt);e.log(v`
+import{$ as e,Ct as t,D as n,Dt as r,P as i,T as a,U as o,W as s,Y as c,j as l,l as u,p as d,w as f}from"./dist-DV7LR38l.mjs";import{a as p,c as m,d as h,f as g,h as _,i as v,l as y,m as b,n as ee,o as te,p as ne,r as x,s as re,t as ie,u as S}from"./chunk-LQW53VED-9MACsvSG.mjs";import{chmodSync as C,existsSync as w,mkdirSync as T,readFileSync as E,readdirSync as D,rmSync as O,writeFileSync as k}from"node:fs";import A from"node:path";import{URLSearchParams as ae}from"node:url";function j(e){function t(){return A.resolve(e(),`preferences.json`)}_(t,`getUserPreferencesPath`);function n(){try{let e=E(t(),`utf8`),n=JSON.parse(e);return typeof n==`object`&&n?n:{}}catch{return{}}}_(n,`readUserPreferences`);function r(e){let r={...n(),...e},i=t();T(A.dirname(i),{recursive:!0}),k(i,JSON.stringify(r,null,`	`),{encoding:`utf-8`})}return _(r,`updateUserPreferences`),{readUserPreferences:n,updateUserPreferences:r}}_(j,`createPreferences`);var M=6e4,N=525600,P=43200,F=1440,I=Symbol.for(`constructDateFrom`);function L(e,t){return typeof e==`function`?e(t):e&&typeof e==`object`&&I in e?e[I](t):e instanceof Date?new e.constructor(t):new Date(t)}_(L,`constructFrom`);function R(e,t){return L(t||e,e)}_(R,`toDate`);var z={};function B(){return z}_(B,`getDefaultOptions`);function V(e){let t=R(e),n=new Date(Date.UTC(t.getFullYear(),t.getMonth(),t.getDate(),t.getHours(),t.getMinutes(),t.getSeconds(),t.getMilliseconds()));return n.setUTCFullYear(t.getFullYear()),e-+n}_(V,`getTimezoneOffsetInMilliseconds`);function H(e,...t){let n=L.bind(null,e||t.find(e=>typeof e==`object`));return t.map(n)}_(H,`normalizeDates`);function U(e,t){let n=R(e)-+R(t);return n<0?-1:n>0?1:n}_(U,`compareAsc`);function oe(e){return L(e,Date.now())}_(oe,`constructNow`);function se(e){return t=>{let n=(e?Math[e]:Math.trunc)(t);return n===0?0:n}}_(se,`getRoundingMethod`);var ce={lessThanXSeconds:{one:`less than a second`,other:`less than {{count}} seconds`},xSeconds:{one:`1 second`,other:`{{count}} seconds`},halfAMinute:`half a minute`,lessThanXMinutes:{one:`less than a minute`,other:`less than {{count}} minutes`},xMinutes:{one:`1 minute`,other:`{{count}} minutes`},aboutXHours:{one:`about 1 hour`,other:`about {{count}} hours`},xHours:{one:`1 hour`,other:`{{count}} hours`},xDays:{one:`1 day`,other:`{{count}} days`},aboutXWeeks:{one:`about 1 week`,other:`about {{count}} weeks`},xWeeks:{one:`1 week`,other:`{{count}} weeks`},aboutXMonths:{one:`about 1 month`,other:`about {{count}} months`},xMonths:{one:`1 month`,other:`{{count}} months`},aboutXYears:{one:`about 1 year`,other:`about {{count}} years`},xYears:{one:`1 year`,other:`{{count}} years`},overXYears:{one:`over 1 year`,other:`over {{count}} years`},almostXYears:{one:`almost 1 year`,other:`almost {{count}} years`}},le=_((e,t,n)=>{let r,i=ce[e];return r=typeof i==`string`?i:t===1?i.one:i.other.replace(`{{count}}`,t.toString()),n?.addSuffix?n.comparison&&n.comparison>0?`in `+r:r+` ago`:r},`formatDistance`);function W(e){return(t={})=>{let n=t.width?String(t.width):e.defaultWidth;return e.formats[n]||e.formats[e.defaultWidth]}}_(W,`buildFormatLongFn`);var ue={date:W({formats:{full:`EEEE, MMMM do, y`,long:`MMMM do, y`,medium:`MMM d, y`,short:`MM/dd/yyyy`},defaultWidth:`full`}),time:W({formats:{full:`h:mm:ss a zzzz`,long:`h:mm:ss a z`,medium:`h:mm:ss a`,short:`h:mm a`},defaultWidth:`full`}),dateTime:W({formats:{full:`{{date}} 'at' {{time}}`,long:`{{date}} 'at' {{time}}`,medium:`{{date}}, {{time}}`,short:`{{date}}, {{time}}`},defaultWidth:`full`})},de={lastWeek:`'last' eeee 'at' p`,yesterday:`'yesterday at' p`,today:`'today at' p`,tomorrow:`'tomorrow at' p`,nextWeek:`eeee 'at' p`,other:`P`},fe=_((e,t,n,r)=>de[e],`formatRelative`);function G(e){return(t,n)=>{let r=n?.context?String(n.context):`standalone`,i;if(r===`formatting`&&e.formattingValues){let t=e.defaultFormattingWidth||e.defaultWidth,r=n?.width?String(n.width):t;i=e.formattingValues[r]||e.formattingValues[t]}else{let t=e.defaultWidth,r=n?.width?String(n.width):e.defaultWidth;i=e.values[r]||e.values[t]}let a=e.argumentCallback?e.argumentCallback(t):t;return i[a]}}_(G,`buildLocalizeFn`);var pe={ordinalNumber:_((e,t)=>{let n=Number(e),r=n%100;if(r>20||r<10)switch(r%10){case 1:return n+`st`;case 2:return n+`nd`;case 3:return n+`rd`}return n+`th`},`ordinalNumber`),era:G({values:{narrow:[`B`,`A`],abbreviated:[`BC`,`AD`],wide:[`Before Christ`,`Anno Domini`]},defaultWidth:`wide`}),quarter:G({values:{narrow:[`1`,`2`,`3`,`4`],abbreviated:[`Q1`,`Q2`,`Q3`,`Q4`],wide:[`1st quarter`,`2nd quarter`,`3rd quarter`,`4th quarter`]},defaultWidth:`wide`,argumentCallback:_(e=>e-1,`argumentCallback`)}),month:G({values:{narrow:[`J`,`F`,`M`,`A`,`M`,`J`,`J`,`A`,`S`,`O`,`N`,`D`],abbreviated:[`Jan`,`Feb`,`Mar`,`Apr`,`May`,`Jun`,`Jul`,`Aug`,`Sep`,`Oct`,`Nov`,`Dec`],wide:[`January`,`February`,`March`,`April`,`May`,`June`,`July`,`August`,`September`,`October`,`November`,`December`]},defaultWidth:`wide`}),day:G({values:{narrow:[`S`,`M`,`T`,`W`,`T`,`F`,`S`],short:[`Su`,`Mo`,`Tu`,`We`,`Th`,`Fr`,`Sa`],abbreviated:[`Sun`,`Mon`,`Tue`,`Wed`,`Thu`,`Fri`,`Sat`],wide:[`Sunday`,`Monday`,`Tuesday`,`Wednesday`,`Thursday`,`Friday`,`Saturday`]},defaultWidth:`wide`}),dayPeriod:G({values:{narrow:{am:`a`,pm:`p`,midnight:`mi`,noon:`n`,morning:`morning`,afternoon:`afternoon`,evening:`evening`,night:`night`},abbreviated:{am:`AM`,pm:`PM`,midnight:`midnight`,noon:`noon`,morning:`morning`,afternoon:`afternoon`,evening:`evening`,night:`night`},wide:{am:`a.m.`,pm:`p.m.`,midnight:`midnight`,noon:`noon`,morning:`morning`,afternoon:`afternoon`,evening:`evening`,night:`night`}},defaultWidth:`wide`,formattingValues:{narrow:{am:`a`,pm:`p`,midnight:`mi`,noon:`n`,morning:`in the morning`,afternoon:`in the afternoon`,evening:`in the evening`,night:`at night`},abbreviated:{am:`AM`,pm:`PM`,midnight:`midnight`,noon:`noon`,morning:`in the morning`,afternoon:`in the afternoon`,evening:`in the evening`,night:`at night`},wide:{am:`a.m.`,pm:`p.m.`,midnight:`midnight`,noon:`noon`,morning:`in the morning`,afternoon:`in the afternoon`,evening:`in the evening`,night:`at night`}},defaultFormattingWidth:`wide`})};function K(e){return(t,n={})=>{let r=n.width,i=r&&e.matchPatterns[r]||e.matchPatterns[e.defaultMatchWidth],a=t.match(i);if(!a)return null;let o=a[0],s=r&&e.parsePatterns[r]||e.parsePatterns[e.defaultParseWidth],c=Array.isArray(s)?me(s,e=>e.test(o)):q(s,e=>e.test(o)),l;l=e.valueCallback?e.valueCallback(c):c,l=n.valueCallback?n.valueCallback(l):l;let u=t.slice(o.length);return{value:l,rest:u}}}_(K,`buildMatchFn`);function q(e,t){for(let n in e)if(Object.prototype.hasOwnProperty.call(e,n)&&t(e[n]))return n}_(q,`findKey`);function me(e,t){for(let n=0;n<e.length;n++)if(t(e[n]))return n}_(me,`findIndex`);function he(e){return(t,n={})=>{let r=t.match(e.matchPattern);if(!r)return null;let i=r[0],a=t.match(e.parsePattern);if(!a)return null;let o=e.valueCallback?e.valueCallback(a[0]):a[0];o=n.valueCallback?n.valueCallback(o):o;let s=t.slice(i.length);return{value:o,rest:s}}}_(he,`buildMatchPatternFn`);var ge={code:`en-US`,formatDistance:le,formatLong:ue,formatRelative:fe,localize:pe,match:{ordinalNumber:he({matchPattern:/^(\d+)(th|st|nd|rd)?/i,parsePattern:/\d+/i,valueCallback:_(e=>parseInt(e,10),`valueCallback`)}),era:K({matchPatterns:{narrow:/^(b|a)/i,abbreviated:/^(b\.?\s?c\.?|b\.?\s?c\.?\s?e\.?|a\.?\s?d\.?|c\.?\s?e\.?)/i,wide:/^(before christ|before common era|anno domini|common era)/i},defaultMatchWidth:`wide`,parsePatterns:{any:[/^b/i,/^(a|c)/i]},defaultParseWidth:`any`}),quarter:K({matchPatterns:{narrow:/^[1234]/i,abbreviated:/^q[1234]/i,wide:/^[1234](th|st|nd|rd)? quarter/i},defaultMatchWidth:`wide`,parsePatterns:{any:[/1/i,/2/i,/3/i,/4/i]},defaultParseWidth:`any`,valueCallback:_(e=>e+1,`valueCallback`)}),month:K({matchPatterns:{narrow:/^[jfmasond]/i,abbreviated:/^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)/i,wide:/^(january|february|march|april|may|june|july|august|september|october|november|december)/i},defaultMatchWidth:`wide`,parsePatterns:{narrow:[/^j/i,/^f/i,/^m/i,/^a/i,/^m/i,/^j/i,/^j/i,/^a/i,/^s/i,/^o/i,/^n/i,/^d/i],any:[/^ja/i,/^f/i,/^mar/i,/^ap/i,/^may/i,/^jun/i,/^jul/i,/^au/i,/^s/i,/^o/i,/^n/i,/^d/i]},defaultParseWidth:`any`}),day:K({matchPatterns:{narrow:/^[smtwf]/i,short:/^(su|mo|tu|we|th|fr|sa)/i,abbreviated:/^(sun|mon|tue|wed|thu|fri|sat)/i,wide:/^(sunday|monday|tuesday|wednesday|thursday|friday|saturday)/i},defaultMatchWidth:`wide`,parsePatterns:{narrow:[/^s/i,/^m/i,/^t/i,/^w/i,/^t/i,/^f/i,/^s/i],any:[/^su/i,/^m/i,/^tu/i,/^w/i,/^th/i,/^f/i,/^sa/i]},defaultParseWidth:`any`}),dayPeriod:K({matchPatterns:{narrow:/^(a|p|mi|n|(in the|at) (morning|afternoon|evening|night))/i,any:/^([ap]\.?\s?m\.?|midnight|noon|(in the|at) (morning|afternoon|evening|night))/i},defaultMatchWidth:`any`,parsePatterns:{any:{am:/^a/i,pm:/^p/i,midnight:/^mi/i,noon:/^no/i,morning:/morning/i,afternoon:/afternoon/i,evening:/evening/i,night:/night/i}},defaultParseWidth:`any`})},options:{weekStartsOn:0,firstWeekContainsDate:1}};function _e(e,t,n){let r=B(),i=n?.locale??r.locale??ge,a=U(e,t);if(isNaN(a))throw RangeError(`Invalid time value`);let o=Object.assign({},n,{addSuffix:n?.addSuffix,comparison:a}),[s,c]=H(n?.in,...a>0?[t,e]:[e,t]),l=se(n?.roundingMethod??`round`),u=c.getTime()-s.getTime(),d=u/M,f=(u-(V(c)-V(s)))/M,p=n?.unit,m;if(m=p||(d<1?`second`:d<60?`minute`:d<F?`hour`:f<P?`day`:f<N?`month`:`year`),m===`second`){let e=l(u/1e3);return i.formatDistance(`xSeconds`,e,o)}else if(m===`minute`){let e=l(d);return i.formatDistance(`xMinutes`,e,o)}else if(m===`hour`){let e=l(d/60);return i.formatDistance(`xHours`,e,o)}else if(m===`day`){let e=l(f/F);return i.formatDistance(`xDays`,e,o)}else if(m===`month`){let e=l(f/P);return e===12&&p!==`month`?i.formatDistance(`xYears`,1,o):i.formatDistance(`xMonths`,e,o)}else{let e=l(f/N);return i.formatDistance(`xYears`,e,o)}}_(_e,`formatDistanceStrict`);function ve(e,t){return _e(e,oe(e),t)}_(ve,`formatDistanceToNowStrict`);function J(e,n){return{read:_(()=>{let r=n();if(!w(r))return;let i=t(r);try{return S(e,i)}catch{return}},`read`),write(t){let r=n();T(A.dirname(r),{recursive:!0}),k(r,g(e,t),{encoding:`utf-8`,mode:384}),C(r,384)},clear(){let e=n(),t=w(e);return O(e,{force:!0}),t},path:n}}_(J,`createFileStorage`);function ye(e){let{logger:t,prompt:r}=e;return _(async function(e,i){if(n())return t.log(i),!0;let a=await r(e);return typeof a==`string`&&a.trim().toLowerCase()===`yes`},`ensureTemporaryTermsAccepted`)}_(ye,`createTemporaryTermsPrompt`);var be=[9106,1e4];function Y(e){return e?.code}_(Y,`getErrorCode`);function xe(e){let t=Y(e);return t!==void 0&&be.includes(t)}_(xe,`isMembershipsInaccessible`);function Se(e){return{"no-credentials-non-interactive":`Could not authenticate because no credentials were found and the environment is non-interactive. Set a CLOUDFLARE_API_TOKEN environment variable or run \`${e}\` in an interactive terminal first.`,"no-credentials-login-failed":`No credentials were found and the login attempt was unsuccessful. Run \`${e}\` to try again.`,"token-expired-non-interactive":`Your auth token has expired and could not be refreshed, and the environment is non-interactive. Run \`${e}\` in an interactive terminal or set a CLOUDFLARE_API_TOKEN.`,"token-expired-login-failed":`Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${e}\` to try again.`}}_(Se,`notLoggedInErrorBodies`);function Ce(e,t,n){let r=new Date(t.claim.expiresAt);e.log(v`
 			Temporary account ready:
 				Account: ${t.account.name} (${n?`reused`:`created`})
 				Claim within: ${ve(r)}
 				Claim URL: ${t.claim.url}
-		`)}_(Ce,`logTemporaryPreviewAccount`);function we(r,o){let{logger:s}=o,d=r.cliName,p=Se(r.commands.login),m=`
-Run \`${r.commands.whoami}\` to check your current authentication status.`,h=j(r.getConfigPath),g=u(s,r.cacheNamespace?{namespace:r.cacheNamespace}:void 0),v=ie({serviceName:r.keyringServiceName,getConfigPath:r.getConfigPath,isKeyringEnabled:_(()=>h.readUserPreferences().keyring_enabled===!0,`isKeyringEnabled`),logger:s,isNonInteractiveOrCI:i,loginCommand:r.commands.login,format:r.fileFormat}),y=r.allowGlobalAuthKey??!0,b=ee({logger:s,isNonInteractiveOrCI:i,openInBrowser:_(e=>l(e,s),`openInBrowser`),hasEnvCredentials:_(()=>te({allowGlobalAuthKey:y})!==void 0,`hasEnvCredentials`),purgeOnLoginOrLogout:g.purgeConfigCaches,clientId:r.clientId,consent:r.consent,displayName:r.displayName,deviceLoginCommand:r.commands.deviceLogin,redirectUri:r.redirectUri,storageFactory:v.storageFactory,allowGlobalAuthKey:y,temporary:{storage:J(r.fileFormat,r.getTemporaryAccountConfigPath),prompt:ye({logger:s,prompt:o.prompt})}});function x(e){b.setProfile(e)}_(x,`setProfile`);function S(){return b.getActiveProfile()}_(S,`getActiveProfile`);function C(){return v.getActiveStore(b.getActiveProfile())}_(C,`getCredentialStore`);function w(e){b.setTemporaryAllowed(e)}_(w,`setTemporaryAllowed`);function T(){return b.getAPIToken()}_(T,`getAPIToken`);function E(){return b.requireApiToken()}_(E,`requireApiToken`);function D(e,t){return{complianceConfig:e,scopes:t?.scopes??r.getDefaultScopeKeys(),browser:t?.browser??!0,callbackHost:t?.callbackHost,callbackPort:t?.callbackPort,profile:t?.profile,device:t?.device??r.useDeviceFlowByDefault??!1}}_(D,`withLoginDefaults`);async function O(e,t){return b.login(D(e,t))}_(O,`login`);async function k(e){return b.logout(e)}_(k,`logout`);async function A(e,t){return b.getActiveTemporaryAccount()?{loggedIn:!0}:b.loginOrRefreshIfRequired(D(e,t))}_(A,`loginOrRefreshIfRequired`);async function M(){return b.getOAuthTokenFromLocalState()}_(M,`getOAuthTokenFromLocalState`);function N(){return b.getScopes()}_(N,`getScopes`);function P(){return v.storageFactory(S()).read()}_(P,`readAuthCredentials`);function F(e){v.storageFactory(S()).write(e)}_(F,`writeAuthCredentials`);function I(){let e=b.getActiveProfile();return e===`default`?`${r.accountCachePrefix}.json`:`${r.accountCachePrefix}-${e}.json`}_(I,`getAccountCacheFileName`);function L(e){g.saveToConfigCache(I(),{account:e})}_(L,`saveAccountToCache`);function R(){return g.getConfigCache(I()).account}_(R,`getAccountFromCache`);async function z(t,r,i){let a=[],l=!0,u=1,d;for(;l;){d=new ae(d),d.set(`page`,String(u));let{response:f,status:p}=await c(t,r,{},o.userAgent,s,d,void 0,i);f.success?(a.push(...f.result),e(f.result_info)?u+=1:l=!1):n(r,f,p)}return a}_(z,`fetchAccountsPaged`);async function B(e,t={}){let{throwOnEmpty:n=!0}=t,i=await A(e);if(!i.loggedIn)throw new a(`Not logged in. ${p[i.reason]}${m}`,{telemetryMessage:`cfetch auth login required`});let o=E(),[s,c]=await Promise.allSettled([z(e,`/accounts`,o),z(e,`/memberships`,o)]);if(s.status===`rejected`)throw s.reason;if(c.status===`rejected`)if(xe(c.reason)){if(s.status===`fulfilled`&&s.value.length>0)return s.value;throw Y(c.reason)===9106?new a(`Failed to automatically retrieve account IDs for the logged in user.
+		`)}_(Ce,`logTemporaryPreviewAccount`);function we(e,t){let{logger:o}=t,c=e.cliName,p=Se(e.commands.login),m=`
+Run \`${e.commands.whoami}\` to check your current authentication status.`,h=j(e.getConfigPath),g=u(o,e.cacheNamespace?{namespace:e.cacheNamespace}:void 0),v=ie({serviceName:e.keyringServiceName,getConfigPath:e.getConfigPath,isKeyringEnabled:_(()=>h.readUserPreferences().keyring_enabled===!0,`isKeyringEnabled`),logger:o,isNonInteractiveOrCI:n,loginCommand:e.commands.login,format:e.fileFormat}),y=e.allowGlobalAuthKey??!0,b=ee({logger:o,isNonInteractiveOrCI:n,openInBrowser:_(e=>l(e,o),`openInBrowser`),hasEnvCredentials:_(()=>te({allowGlobalAuthKey:y})!==void 0,`hasEnvCredentials`),purgeOnLoginOrLogout:g.purgeConfigCaches,clientId:e.clientId,consent:e.consent,displayName:e.displayName,deviceLoginCommand:e.commands.deviceLogin,redirectUri:e.redirectUri,storageFactory:v.storageFactory,allowGlobalAuthKey:y,temporary:{storage:J(e.fileFormat,e.getTemporaryAccountConfigPath),prompt:ye({logger:o,prompt:t.prompt})}});function x(e){b.setProfile(e)}_(x,`setProfile`);function S(){return b.getActiveProfile()}_(S,`getActiveProfile`);function C(){return v.getActiveStore(b.getActiveProfile())}_(C,`getCredentialStore`);function w(e){b.setTemporaryAllowed(e)}_(w,`setTemporaryAllowed`);function T(){return b.getAPIToken()}_(T,`getAPIToken`);function E(){return b.requireApiToken()}_(E,`requireApiToken`);function D(t,n){return{complianceConfig:t,scopes:n?.scopes??e.getDefaultScopeKeys(),browser:n?.browser??!0,callbackHost:n?.callbackHost,callbackPort:n?.callbackPort,profile:n?.profile,device:n?.device??e.useDeviceFlowByDefault??!1}}_(D,`withLoginDefaults`);async function O(e,t){return b.login(D(e,t))}_(O,`login`);async function k(e){return b.logout(e)}_(k,`logout`);async function A(e,t){return b.getActiveTemporaryAccount()?{loggedIn:!0}:b.loginOrRefreshIfRequired(D(e,t))}_(A,`loginOrRefreshIfRequired`);async function M(){return b.getOAuthTokenFromLocalState()}_(M,`getOAuthTokenFromLocalState`);function N(){return b.getScopes()}_(N,`getScopes`);function P(){return v.storageFactory(S()).read()}_(P,`readAuthCredentials`);function F(e){v.storageFactory(S()).write(e)}_(F,`writeAuthCredentials`);function I(){let t=b.getActiveProfile();return t===`default`?`${e.accountCachePrefix}.json`:`${e.accountCachePrefix}-${t}.json`}_(I,`getAccountCacheFileName`);function L(e){g.saveToConfigCache(I(),{account:e})}_(L,`saveAccountToCache`);function R(){return g.getConfigCache(I()).account}_(R,`getAccountFromCache`);async function z(e,n,r){let a=[],s=!0,c=1,l;for(;s;){l=new ae(l),l.set(`page`,String(c));let{response:u,status:p}=await d(e,n,{},t.userAgent,o,l,void 0,r);u.success?(a.push(...u.result),f(u.result_info)?c+=1:s=!1):i(n,u,p)}return a}_(z,`fetchAccountsPaged`);async function B(t,n={}){let{throwOnEmpty:i=!0}=n,a=await A(t);if(!a.loggedIn)throw new r(`Not logged in. ${p[a.reason]}${m}`,{telemetryMessage:`cfetch auth login required`});let o=E(),[s,c]=await Promise.allSettled([z(t,`/accounts`,o),z(t,`/memberships`,o)]);if(s.status===`rejected`)throw s.reason;if(c.status===`rejected`)if(xe(c.reason)){if(s.status===`fulfilled`&&s.value.length>0)return s.value;throw Y(c.reason)===9106?new r(`Failed to automatically retrieve account IDs for the logged in user.
 You may have incorrect permissions on your API token, or an environment variable such as CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL may be set to an invalid value.
-Check your environment and unset or correct any Cloudflare credential variables, or run \`${r.commands.login}\` to re-authenticate.
-You can also skip this account check by adding an \`account_id\` in your ${r.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,{telemetryMessage:`user account fetch permission denied`}):new a(`Failed to automatically retrieve account IDs for the logged in user.
-You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${r.commands.login}\` to re-authenticate. You can also skip this account check by adding an \`account_id\` in your ${r.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,{telemetryMessage:`user account fetch permission denied`})}else throw c.reason;let l=new Set(c.value.map(e=>e.account.id)),u=s.value.filter(e=>l.has(e.id));if(u.length===0&&n)throw new a(`Failed to automatically retrieve account IDs for the logged in user.
-In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or as \`account_id\` in your ${r.getConfigFileLabel()} file.
-Alternatively, try running \`${r.commands.login}\` to re-authenticate.`,{telemetryMessage:`user account fetch empty`});return u}_(B,`fetchAllAccounts`);function V(e){let t=b.getActiveTemporaryAccount();return t?t.account.id:e.account_id?ne(e.account_id,`set as \`account_id\` in your ${r.getConfigFileLabel()} file`):re()||R()?.id}_(V,`getActiveAccountId`);async function H(e){let t=V(e);if(t)return t;let n=await B(e);if(n.length===1)return L({id:n[0].id,name:n[0].name}),n[0].id;try{let e=await o.select(`Select an account`,{choices:n.map(e=>({title:e.name,value:e.id}))}),t=n.find(t=>t.id===e);if(!t)throw Error(`Selected account not found in accounts list`);return L({id:t.id,name:t.name}),e}catch(e){if(o.isNoDefaultValueProvidedError(e)){let e=f();throw new a(`More than one account available but unable to select one in non-interactive mode.
-Please set the appropriate \`account_id\` in your ${r.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
+Check your environment and unset or correct any Cloudflare credential variables, or run \`${e.commands.login}\` to re-authenticate.
+You can also skip this account check by adding an \`account_id\` in your ${e.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,{telemetryMessage:`user account fetch permission denied`}):new r(`Failed to automatically retrieve account IDs for the logged in user.
+You may have incorrect permissions on your API token, or your authentication may have expired. Try running \`${e.commands.login}\` to re-authenticate. You can also skip this account check by adding an \`account_id\` in your ${e.getConfigFileLabel()} file, or by setting the value of CLOUDFLARE_ACCOUNT_ID`,{telemetryMessage:`user account fetch permission denied`})}else throw c.reason;let l=new Set(c.value.map(e=>e.account.id)),u=s.value.filter(e=>l.has(e.id));if(u.length===0&&i)throw new r(`Failed to automatically retrieve account IDs for the logged in user.
+In a non-interactive environment, it is mandatory to specify an account ID, either by assigning its value to CLOUDFLARE_ACCOUNT_ID, or as \`account_id\` in your ${e.getConfigFileLabel()} file.
+Alternatively, try running \`${e.commands.login}\` to re-authenticate.`,{telemetryMessage:`user account fetch empty`});return u}_(B,`fetchAllAccounts`);function V(t){let n=b.getActiveTemporaryAccount();return n?n.account.id:t.account_id?ne(t.account_id,`set as \`account_id\` in your ${e.getConfigFileLabel()} file`):re()||R()?.id}_(V,`getActiveAccountId`);async function H(n){let i=V(n);if(i)return i;let o=await B(n);if(o.length===1)return L({id:o[0].id,name:o[0].name}),o[0].id;try{let e=await t.select(`Select an account`,{choices:o.map(e=>({title:e.name,value:e.id}))}),n=o.find(t=>t.id===e);if(!n)throw Error(`Selected account not found in accounts list`);return L({id:n.id,name:n.name}),e}catch(n){if(t.isNoDefaultValueProvidedError(n)){let t=a();throw new r(`More than one account available but unable to select one in non-interactive mode.
+Please set the appropriate \`account_id\` in your ${e.getConfigFileLabel()} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
 Available accounts are (\`<name>\`: \`<account_id>\`):
-${n.map(t=>`  \`${e?`(redacted)`:t.name}\`: \`${t.id}\``).join(`
-`)}`,{telemetryMessage:`user account selection unavailable`})}throw e}}_(H,`getOrSelectAccountId`);async function U(e){if(b.isTemporaryAllowed()){if(t(e)!==`public`)throw new a(`Temporary accounts aren't available when the compliance region is not set to public.`,{telemetryMessage:`user temporary account unavailable in compliance region`});let n=b.getActiveTemporaryAccount();if(n)return n.account.id;if(T())throw new a("You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.",{telemetryMessage:`user temporary account already authenticated`});let{account:r,cached:i}=await b.activateTemporaryAccount();return Ce(s,r,i),r.account.id}let n=await A(e);if(!n.loggedIn)throw n.reason===`no-credentials-non-interactive`||n.reason===`token-expired-non-interactive`?new a(`In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for ${d} to work. Please go to https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN.`,{telemetryMessage:`user auth missing api token non interactive`}):new a(`Did not login, quitting...`,{telemetryMessage:`user login cancelled`});let r=await H(e);if(!r)throw new a(`No account id found, quitting...`,{telemetryMessage:`user auth missing account id`});return r}return _(U,`requireAuth`),{setProfile:x,getActiveProfile:S,getCredentialStore:C,setTemporaryAllowed:w,getAPIToken:T,requireApiToken:E,login:O,logout:k,loginOrRefreshIfRequired:A,getOAuthTokenFromLocalState:M,getScopes:N,readAuthCredentials:P,writeAuthCredentials:F,getActiveAccountId:V,getOrSelectAccountId:H,getAccountFromCache:R,fetchAllAccounts:B,requireAuth:U}}_(we,`createCloudflareAuth`);var Te=`profiles/directory-bindings.json`,Ee=`.enc`;function X(e){let{logger:t,getConfigPath:n,keyringServiceName:r,format:i}=e,a=`.${i}`;function o(e){return p(n(),e,i)}_(o,`plaintextPath`);function s(e){return y(n(),e)}_(s,`encryptedPath`);function c(){return A.dirname(o(`default`))}_(c,`getProfileConfigDirectory`);let l={exists(e){return w(o(e))||w(s(e))},list(){let e=c();if(!w(e))return[];let t=new Set;for(let n of D(e))n.endsWith(a)?t.add(n.slice(0,-a.length)):n.endsWith(Ee)&&t.add(n.slice(0,-Ee.length));return[...t]},delete(e){let{backendAvailable:a,encryptedFileExisted:s}=h({serviceName:r,configPath:n(),profile:e,format:i});J(i,()=>o(e)).clear(),s&&!a&&t.warn(`Removed the credential files for profile "${e}", but the keyring backend was not reachable on this host so its keyring entry could not be cleared. Clear it manually if it persists.`)}};function u(){return A.join(n(),Te)}return _(u,`getDirectoryBindingsPath`),x({configs:l,bindings:{read(){try{let e=E(u(),`utf-8`);return JSON.parse(e)}catch{return{}}},write(e){let t=u();T(A.dirname(t),{recursive:!0}),k(t,JSON.stringify(e,null,`	`),`utf-8`)}}})}_(X,`createCloudflareProfileStore`);function De(e){let{loginCommand:t,createProfileCommand:n,keyringServiceName:r,getConfigPath:i,format:a,preferences:o}=e,{readUserPreferences:s,updateUserPreferences:c}=o;function l(e){return e??`default`}_(l,`describeProfile`);function u(e){let t=[];w(y(i()))&&t.push(void 0);let n=X({logger:e,getConfigPath:i,keyringServiceName:r,format:a});for(let e of n.configs.list()){try{b(e)}catch{continue}w(y(i(),e))&&t.push(e)}return t}_(u,`listEncryptedProfiles`);function d(e){let o=u(e);if(o.length===0)return;let s=[],c=[];for(let t of o)try{let{backendAvailable:e}=h({serviceName:r,configPath:i(),profile:t,format:a});s.push(l(t)),e||c.push(l(t))}catch(n){e.warn(`Failed to remove encrypted credentials for profile "${l(t)}": ${n instanceof Error?n.message:String(n)}. You may need to clear them manually.`)}if(s.length>0){let r=n?`Re-authenticate with \`${t}\` (default profile) or \`${n} <name>\` (named profiles).`:`Re-authenticate with \`${t}\`.`;e.log(`Removed encrypted credentials for ${s.map(e=>`"${e}"`).join(`, `)}. ${r}`)}c.length>0&&e.warn(`The keyring backend was not reachable on this host, so the keyring entry for ${c.map(e=>`"${e}"`).join(`, `)} could not be cleared. Clear it manually if it persists.`)}_(d,`scrubAllEncryptedProfiles`);function f(e,t){let{logger:n,getCredentialStore:r}=t,i=s().keyring_enabled===!0,a=m();if(a!==void 0&&a!==e&&n.warn(`CLOUDFLARE_AUTH_USE_KEYRING=${a} overrides ${e?`enabling`:`disabling`} keyring storage for this command.`),!e&&a!==!0&&d(n),c({keyring_enabled:e}),e&&a!==!1)try{r().kind!==`encrypted-file`&&(c({keyring_enabled:i}),n.warn(`Keyring storage isn't available on this host (see warning above), so it was not enabled. Try again once the keyring backend is reachable.`))}catch(e){throw c({keyring_enabled:i}),e}return{enabled:s().keyring_enabled===!0}}return _(f,`setKeyringPreference`),{setKeyringPreference:f}}_(De,`createKeyringPreference`);function Oe(e){let{getConfigPath:t,format:n}=e;function r(e){return p(t(),e,n)}_(r,`getAuthConfigFilePath`);function i(e){return y(t(),e)}_(i,`getEncryptedAuthConfigFilePath`);function a(e){return J(n,()=>r(e))}_(a,`defaultAuthConfigStorage`);function o(e,t){a(t).write(e)}_(o,`writeAuthConfigFile`);function s(e){return a(e).read()}return _(s,`readAuthConfigFile`),{getAuthConfigFilePath:r,getEncryptedAuthConfigFilePath:i,defaultAuthConfigStorage:a,readAuthConfigFile:s,writeAuthConfigFile:o}}_(Oe,`createAuthConfigFileHelpers`);var Z=`cloudflare`,ke=`cf`,Ae=`cf`,je=`http://localhost:8877/oauth/callback`,Me={granted:{url:`https://welcome.developers.workers.dev/cf-oauth-consent-granted`},denied:{url:`https://welcome.developers.workers.dev/cf-oauth-consent-denied`,error:"Error: Consent denied. You must grant consent to cf in order to login.\nIf you don't want to do this consider passing an API token via the `CLOUDFLARE_API_TOKEN` environment variable"}},Ne=s({variableName:`CLOUDFLARE_CLIENT_ID`,defaultValue:_(()=>`cbca97e7-c331-4cdd-8fd8-e25a451b98bf`,`defaultValue`)});function Q(){return d({appName:`cloudflare`,leadingDot:!1,useLegacyHomeDir:!1})}_(Q,`getCfConfigPath`);var Pe=`access:read,access:write,account:read,agw:read,agw:run,agw:write,ai:read,ai:write,ai-search:read,ai-search:run,ai-search:write,aiaudit:read,aiaudit:write,aig:read,aig:write,auditlogs:read,billing:read,billing:write,browser:read,browser:write,cfone:read,cfone:write,cloudchamber:write,connectivity:admin,connectivity:bind,connectivity:read,constellation:write,containers:write,d1:write,dex:read,dex:write,dns_analytics:read,dns_records:edit,dns_records:read,dns_settings:read,email_routing:read,email_routing:write,email_sending:read,email_sending:write,firstpartytags:write,images:read,images:write,lb:edit,lb:read,logpush:read,logpush:write,mcp_portals:read,mcp_portals:write,notebook-examples:read,notebook-managed:read,notification:read,notification:write,oauth_account_ssl_and_certificates_write,offline,openid,pages:read,pages:write,pipelines:read,pipelines:setup,pipelines:write,query_cache:write,queues:write,r2_catalog:write,radar:read,rag:read,rag:write,registrar:read,registrar:write,secrets_store:read,secrets_store:write,sso-connector:read,sso-connector:write,ssl_certs:write,teams:pii,teams:read,teams:secure_location,teams:write,url_scanner:read,url_scanner:write,user:read,vectorize:write,workers:read,workers:write,workers_builds:read,workers_builds:write,workers_deployments:read,workers_kv:write,workers_observability:read,workers_observability:write,workers_observability_telemetry:write,workers_routes:write,workers_scripts:write,workers_tail:read,zone:read,account-analytics.read,account-ssl-and-certificates.write,ssl-and-certificates.read,ssl-and-certificates.write,registrar-domains.read,registrar-domains.admin,logs.read,logs.write,websearch.run,snippets.read,snippets.write,access-acct.read,access-acct.revoke,access-acct.write,access-app.read,access-app.revoke,access-app.write,access-audit-log.read,access-certificate.read,access-certificate.write,access-custom-page.read,access-custom-page.write,access-device-posture.read,access-device-posture.write,access-group.read,access-group.write,access-idp.read,access-idp.write,access-key.read,access-key.write,access-org.read,access-org.revoke,access-org.write,access-policy-test.read,access-policy-test.write,access-policy.read,access-policy.write,access-population.read,access-population.write,access-saml-certificate.read,access-saml-certificate.write,access-scim-log.read,access-seats.write,access-service-token.read,access-service-token.write,access-ssh-auditing.read,access-ssh-auditing.write,access-tag.read,access-tag.write,access-users.read,access-users.write,access.read,access.revoke,access.write,account-api-gateway.read,account-api-gateway.write,account-custom-asset.read,account-custom-asset.write,account-custom-error-rules.read,account-custom-error-rules.write,account-custom-pages.read,account-custom-pages.write,account-disable-esc.read,account-disable-esc.write,account-dns-settings.read,account-dns-settings.write,account-firewall-access-rules.read,account-firewall-access-rules.write,account-logs.read,account-logs.write,account-rule-lists.read,account-rule-lists.write,account-rulesets.read,account-rulesets.write,account-security-center-insights.read,account-security-center-insights.write,account-settings.read,account-settings.write,account-ssl-and-certificates.read,account-waf.read,account-waf.write,account-waiting-rooms.read,address-maps.read,address-maps.write,agent-memory.write,agw.read,agw.run,agw.write,ai-search.index,ai-search.metadata_read,ai-search.read,ai-search.run,ai-search.write,ai.read,ai.write,aiaudit.read,aiaudit.write,aig.metadata_read,aig.read,aig.run,aig.write,analytics.read,api-gateway.read,api-gateway.write,apps.write,argotunnel.read,argotunnel.write,artifacts.read,artifacts.write,bot-management-feedback.read,bot-management-feedback.write,bot-management.read,bot-management.write,browser-rendering.read,browser-rendering.write,cache-settings.read,cache-settings.write,cache.purge,calls.read,calls.write,casb.read,casb.write,cf-agents.read,cf-agents.write,challenge-widgets.read,challenge-widgets.write,chinanetwork-steering.read,chinanetwork-steering.write,cloud-connector.read,cloud-connector.write,cloud-email-security.read,cloud-email-security.write,cloudchamber.read,cloudchamber.write,cloudforce-one.read,cloudforce-one.write,config-settings.read,config-settings.write,connectivity-directory.admin,connectivity-directory.bind,connectivity-directory.read,constellation.read,constellation.write,containers.read,containers.write,custom-errors.read,custom-errors.write,custom-pages.read,custom-pages.write,d1.metadata_read,d1.read,d1.write,ddos-botnet-feed.read,ddos-botnet-feed.write,ddos-protection.read,ddos-protection.write,dls.read,dls.write,dns-firewall.read,dns-firewall.write,dns-view.read,dns-view.write,dns.read,dns.write,domain-page-shield.read,domain-page.shield,dynamic-redirect.read,dynamic-redirect.write,email-routing-account-rule.read,email-routing-address.read,email-routing-address.write,email-routing-rule.read,email-routing-rule.write,email-routing-suppression.read,email-routing-suppression.write,email-security-dmarcreports.read,email-security-dmarcreports.write,email-sending.read,email-sending.write,fbm.admin,fbm.read,fbm.write,field-extractor.read,field-extractor.write,firewall-for-ai.read,firewall-for-ai.write,firewall-services.read,firewall-services.write,flagship.evaluate,flagship.read,flagship.write,fraud-detection-pii.read,fraud-detection.read,fraud-detection.write,fraud-events.write,fraud-feedback.read,fraud-feedback.write,healthcheck.read,healthcheck.write,http-applications.read,http-applications.write,http-ddos-managed-ruleset.read,http-ddos-managed-ruleset.write,images.metadata_read,images.read,images.write,integration.write,intel.read,intel.write,iot.read,iot.write,ip-prefix-bgp-on-demand.read,ip-prefix-bgp-on-demand.write,ip-prefix.read,ip-prefix.write,l4-ddos-managed-ruleset.read,l4-ddos-managed-ruleset.write,load-balancers-account.read,load-balancers-account.write,load-balancers.read,load-balancers.write,load-balancing-monitors-and-pools.read,load-balancing-monitors-and-pools.write,magic-firewall.read,magic-firewall.write,magic-transit.read,magic-transit.write,magic-wan.read,magic-wan.write,managed-headers.read,managed-headers.write,mass-url-redirects.read,mass-url-redirects.write,mcp-portals.read,mcp-portals.write,memberships.read,memberships.write,messaging.edit,messaging.metadata_read,messaging.read,moq.read,moq.write,notifications.read,notifications.write,origin.read,origin.write,page-rules.read,page-rules.write,page-shield.read,page.read,page.shield,page.write,pages.metadata_read,payments-gateway.read,payments-gateway.write,pcaps-api.read,pcaps-api.write,pipelines.read,pipelines.send,pipelines.write,precursor.read,precursor.write,pubsub.read,pubsub.write,query-cache.read,query-cache.write,queues.metadata_read,queues.read,queues.write,r2-catalog-sql.read,r2-catalog.read,r2-catalog.write,radar.read,rag.read,rag.run,rag.write,realtime.admin,realtime.read,realtime.write,registrar-sandbox-domains.admin,registrar-sandbox-domains.read,reports-application-security-report.read,request-tracer.read,resource-library.read,resource-library.write,resource-sharing.read,response-compression.read,response-compression.write,sanitize.read,sanitize.write,secrets-store.read,secrets-store.write,select-configuration.read,select-configuration.write,stream.metadata_read,stream.read,stream.write,tag.read,tag.write,teams-cds-compute-account.read,teams-cds-compute-account.write,teams-connector-cloudflared.monitoring,teams-connector-cloudflared.read,teams-connector-cloudflared.write,teams-connector-warp.read,teams-connector-warp.write,teams-connectors.read,teams-connectors.write,teams-dex.read,teams-dex.write,teams-networks.read,teams-networks.write,teams-pii.read,teams-resilience.read,teams-resilience.write,teams-secure.location,teams.read,teams.report,teams.write,transform-rules.read,transform-rules.write,trust-and-safety.read,trust-and-safety.write,url-scanner.read,url-scanner.write,user-details.read,user-details.write,vectorize.read,vectorize.write,waiting-rooms.read,waiting-rooms.write,web3-hostnames.read,web3-hostnames.write,websearch.metadata_read,websearch.read,websearch.write,workers-ci.read,workers-ci.write,workers-kv-storage.metadata_read,workers-kv-storage.read,workers-kv-storage.write,workers-observability-telemetry.write,workers-observability.read,workers-observability.write,workers-r2-bucket-item.read,workers-r2-bucket-item.write,workers-r2.metadata_read,workers-r2.read,workers-r2.write,workers-routes.read,workers-routes.write,workers-scripts.bind,workers-scripts.read,workers-scripts.write,workers-tail.read,workers_ai.metadata_read,zaraz.edit,zaraz.read,zaraz.write,zone-access.read,zone-access.revoke,zone-access.write,zone-custom-asset.read,zone-custom-asset.write,zone-disable-esc.read,zone-disable-esc.write,zone-dns-settings.read,zone-dns-settings.write,zone-security-center-insights.read,zone-security-center-insights.write,zone-settings.read,zone-settings.write,zone-transform-rules.read,zone-transform-rules.write,zone-versioning.read,zone-versioning.write,zone-waf.read,zone-waf.write,zone.read,zone.write`.split(`,`),Fe=[...`openid.offline.user:read.account:read.access:read.access:write.agw:read.agw:run.agw:write.ai:read.ai:write.ai-search:read.ai-search:run.ai-search:write.aiaudit:read.aiaudit:write.aig:read.aig:write.auditlogs:read.browser:read.browser:write.cfone:read.cfone:write.cloudchamber:write.connectivity:admin.connectivity:bind.connectivity:read.constellation:write.containers:write.d1:write.dex:read.dex:write.dns_analytics:read.dns_records:edit.dns_records:read.dns_settings:read.email_routing:write.email_sending:write.firstpartytags:write.images:read.images:write.lb:edit.lb:read.logpush:read.logpush:write.mcp_portals:read.mcp_portals:write.notebook-examples:read.notification:read.notification:write.pages:read.pages:write.pipelines:read.pipelines:setup.pipelines:write.query_cache:write.queues:write.r2_catalog:write.radar:read.rag:read.rag:write.registrar:read.registrar:write.secrets_store:read.secrets_store:write.sso-connector:read.sso-connector:write.ssl_certs:write.teams:pii.teams:read.teams:secure_location.teams:write.url_scanner:read.url_scanner:write.vectorize:write.workers:read.workers:write.workers_builds:read.workers_builds:write.workers_deployments:read.workers_kv:write.workers_observability:read.workers_observability:write.workers_observability_telemetry:write.workers_routes:write.workers_scripts:write.workers_tail:read.zone:read`.split(`.`)];function Ie(e){Fe=e}_(Ie,`setLoginScopeKeys`);var Le=new Set(Pe);function Re(e){return e.every(e=>Le.has(e))}_(Re,`validateScopeKeys`);function ze(){let e=o();return e===`production`?`cloudflare-temporary-account.json`:`cloudflare-temporary-account.${e}.json`}_(ze,`getTemporaryAccountConfigFile`);function Be(){return A.join(Q(),ze())}_(Be,`getCfTemporaryAccountConfigPath`);function Ve(e){return J(`json`,e)}_(Ve,`createJsonFileStorage`);var{getAuthConfigFilePath:He,getEncryptedAuthConfigFilePath:Ue,defaultAuthConfigStorage:We,readAuthConfigFile:Ge,writeAuthConfigFile:Ke}=Oe({getConfigPath:Q,format:`json`}),$={cliName:ke,displayName:Ae,commands:{login:`cf auth login`,whoami:`cf auth whoami`,createProfile:`cf auth create`,deviceLogin:`cf auth login`},keyringServiceName:Z,clientId:Ne,consent:Me,redirectUri:je,useDeviceFlowByDefault:!0,allowGlobalAuthKey:!1,getConfigPath:Q,getTemporaryAccountConfigPath:Be,fileFormat:`json`,accountCachePrefix:`cloudflare-account`,cacheNamespace:`cloudflare`,getConfigFileLabel:_(()=>`cf config`,`getConfigFileLabel`),getDefaultScopeKeys:_(()=>Fe,`getDefaultScopeKeys`)},qe=j(Q),{readUserPreferences:Je,updateUserPreferences:Ye}=qe;function Xe(e){return we($,e)}_(Xe,`createCfAuth`);function Ze(e){return X({logger:e.logger,getConfigPath:Q,keyringServiceName:Z,format:`json`})}_(Ze,`createCfProfileStore`);var Qe=De({loginCommand:$.commands.login,createProfileCommand:$.commands.createProfile,keyringServiceName:Z,getConfigPath:Q,format:`json`,preferences:qe});function $e(e,t){return Qe.setKeyringPreference(e,t)}_($e,`setKeyringPreference`);export{Re as a,Q as i,Ze as n,Ve as r,Xe as t};
+${o.map(e=>`  \`${t?`(redacted)`:e.name}\`: \`${e.id}\``).join(`
+`)}`,{telemetryMessage:`user account selection unavailable`})}throw n}}_(H,`getOrSelectAccountId`);async function U(e){if(b.isTemporaryAllowed()){if(s(e)!==`public`)throw new r(`Temporary accounts aren't available when the compliance region is not set to public.`,{telemetryMessage:`user temporary account unavailable in compliance region`});let t=b.getActiveTemporaryAccount();if(t)return t.account.id;if(T())throw new r("You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.",{telemetryMessage:`user temporary account already authenticated`});let{account:n,cached:i}=await b.activateTemporaryAccount();return Ce(o,n,i),n.account.id}let t=await A(e);if(!t.loggedIn)throw t.reason===`no-credentials-non-interactive`||t.reason===`token-expired-non-interactive`?new r(`In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for ${c} to work. Please go to https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN.`,{telemetryMessage:`user auth missing api token non interactive`}):new r(`Did not login, quitting...`,{telemetryMessage:`user login cancelled`});let n=await H(e);if(!n)throw new r(`No account id found, quitting...`,{telemetryMessage:`user auth missing account id`});return n}return _(U,`requireAuth`),{setProfile:x,getActiveProfile:S,getCredentialStore:C,setTemporaryAllowed:w,getAPIToken:T,requireApiToken:E,login:O,logout:k,loginOrRefreshIfRequired:A,getOAuthTokenFromLocalState:M,getScopes:N,readAuthCredentials:P,writeAuthCredentials:F,getActiveAccountId:V,getOrSelectAccountId:H,getAccountFromCache:R,fetchAllAccounts:B,requireAuth:U}}_(we,`createCloudflareAuth`);var Te=`profiles/directory-bindings.json`,Ee=`.enc`;function X(e){let{logger:t,getConfigPath:n,keyringServiceName:r,format:i}=e,a=`.${i}`;function o(e){return p(n(),e,i)}_(o,`plaintextPath`);function s(e){return y(n(),e)}_(s,`encryptedPath`);function c(){return A.dirname(o(`default`))}_(c,`getProfileConfigDirectory`);let l={exists(e){return w(o(e))||w(s(e))},list(){let e=c();if(!w(e))return[];let t=new Set;for(let n of D(e))n.endsWith(a)?t.add(n.slice(0,-a.length)):n.endsWith(Ee)&&t.add(n.slice(0,-Ee.length));return[...t]},delete(e){let{backendAvailable:a,encryptedFileExisted:s}=h({serviceName:r,configPath:n(),profile:e,format:i});J(i,()=>o(e)).clear(),s&&!a&&t.warn(`Removed the credential files for profile "${e}", but the keyring backend was not reachable on this host so its keyring entry could not be cleared. Clear it manually if it persists.`)}};function u(){return A.join(n(),Te)}return _(u,`getDirectoryBindingsPath`),x({configs:l,bindings:{read(){try{let e=E(u(),`utf-8`);return JSON.parse(e)}catch{return{}}},write(e){let t=u();T(A.dirname(t),{recursive:!0}),k(t,JSON.stringify(e,null,`	`),`utf-8`)}}})}_(X,`createCloudflareProfileStore`);function De(e){let{loginCommand:t,createProfileCommand:n,keyringServiceName:r,getConfigPath:i,format:a,preferences:o}=e,{readUserPreferences:s,updateUserPreferences:c}=o;function l(e){return e??`default`}_(l,`describeProfile`);function u(e){let t=[];w(y(i()))&&t.push(void 0);let n=X({logger:e,getConfigPath:i,keyringServiceName:r,format:a});for(let e of n.configs.list()){try{b(e)}catch{continue}w(y(i(),e))&&t.push(e)}return t}_(u,`listEncryptedProfiles`);function d(e){let o=u(e);if(o.length===0)return;let s=[],c=[];for(let t of o)try{let{backendAvailable:e}=h({serviceName:r,configPath:i(),profile:t,format:a});s.push(l(t)),e||c.push(l(t))}catch(n){e.warn(`Failed to remove encrypted credentials for profile "${l(t)}": ${n instanceof Error?n.message:String(n)}. You may need to clear them manually.`)}if(s.length>0){let r=n?`Re-authenticate with \`${t}\` (default profile) or \`${n} <name>\` (named profiles).`:`Re-authenticate with \`${t}\`.`;e.log(`Removed encrypted credentials for ${s.map(e=>`"${e}"`).join(`, `)}. ${r}`)}c.length>0&&e.warn(`The keyring backend was not reachable on this host, so the keyring entry for ${c.map(e=>`"${e}"`).join(`, `)} could not be cleared. Clear it manually if it persists.`)}_(d,`scrubAllEncryptedProfiles`);function f(e,t){let{logger:n,getCredentialStore:r}=t,i=s().keyring_enabled===!0,a=m();if(a!==void 0&&a!==e&&n.warn(`CLOUDFLARE_AUTH_USE_KEYRING=${a} overrides ${e?`enabling`:`disabling`} keyring storage for this command.`),!e&&a!==!0&&d(n),c({keyring_enabled:e}),e&&a!==!1)try{r().kind!==`encrypted-file`&&(c({keyring_enabled:i}),n.warn(`Keyring storage isn't available on this host (see warning above), so it was not enabled. Try again once the keyring backend is reachable.`))}catch(e){throw c({keyring_enabled:i}),e}return{enabled:s().keyring_enabled===!0}}return _(f,`setKeyringPreference`),{setKeyringPreference:f}}_(De,`createKeyringPreference`);function Oe(e){let{getConfigPath:t,format:n}=e;function r(e){return p(t(),e,n)}_(r,`getAuthConfigFilePath`);function i(e){return y(t(),e)}_(i,`getEncryptedAuthConfigFilePath`);function a(e){return J(n,()=>r(e))}_(a,`defaultAuthConfigStorage`);function o(e,t){a(t).write(e)}_(o,`writeAuthConfigFile`);function s(e){return a(e).read()}return _(s,`readAuthConfigFile`),{getAuthConfigFilePath:r,getEncryptedAuthConfigFilePath:i,defaultAuthConfigStorage:a,readAuthConfigFile:s,writeAuthConfigFile:o}}_(Oe,`createAuthConfigFileHelpers`);var Z=`cloudflare`,ke=`cf`,Ae=`cf`,je=`http://localhost:8877/oauth/callback`,Me={granted:{url:`https://welcome.developers.workers.dev/cf-oauth-consent-granted`},denied:{url:`https://welcome.developers.workers.dev/cf-oauth-consent-denied`,error:"Error: Consent denied. You must grant consent to cf in order to login.\nIf you don't want to do this consider passing an API token via the `CLOUDFLARE_API_TOKEN` environment variable"}},Ne=e({variableName:`CLOUDFLARE_CLIENT_ID`,defaultValue:_(()=>`cbca97e7-c331-4cdd-8fd8-e25a451b98bf`,`defaultValue`)});function Q(){return c({appName:`cloudflare`,leadingDot:!1,useLegacyHomeDir:!1})}_(Q,`getCfConfigPath`);var Pe=`access:read,access:write,account:read,agw:read,agw:run,agw:write,ai:read,ai:write,ai-search:read,ai-search:run,ai-search:write,aiaudit:read,aiaudit:write,aig:read,aig:write,auditlogs:read,billing:read,billing:write,browser:read,browser:write,cfone:read,cfone:write,cloudchamber:write,connectivity:admin,connectivity:bind,connectivity:read,constellation:write,containers:write,d1:write,dex:read,dex:write,dns_analytics:read,dns_records:edit,dns_records:read,dns_settings:read,email_routing:read,email_routing:write,email_sending:read,email_sending:write,firstpartytags:write,images:read,images:write,lb:edit,lb:read,logpush:read,logpush:write,mcp_portals:read,mcp_portals:write,notebook-examples:read,notebook-managed:read,notification:read,notification:write,oauth_account_ssl_and_certificates_write,offline,openid,pages:read,pages:write,pipelines:read,pipelines:setup,pipelines:write,query_cache:write,queues:write,r2_catalog:write,radar:read,rag:read,rag:write,registrar:read,registrar:write,secrets_store:read,secrets_store:write,sso-connector:read,sso-connector:write,ssl_certs:write,teams:pii,teams:read,teams:secure_location,teams:write,url_scanner:read,url_scanner:write,user:read,vectorize:write,workers:read,workers:write,workers_builds:read,workers_builds:write,workers_deployments:read,workers_kv:write,workers_observability:read,workers_observability:write,workers_observability_telemetry:write,workers_routes:write,workers_scripts:write,workers_tail:read,zone:read,account-analytics.read,account-ssl-and-certificates.write,ssl-and-certificates.read,ssl-and-certificates.write,registrar-domains.read,registrar-domains.admin,logs.read,logs.write,websearch.run,snippets.read,snippets.write,access-acct.read,access-acct.revoke,access-acct.write,access-app.read,access-app.revoke,access-app.write,access-audit-log.read,access-certificate.read,access-certificate.write,access-custom-page.read,access-custom-page.write,access-device-posture.read,access-device-posture.write,access-group.read,access-group.write,access-idp.read,access-idp.write,access-key.read,access-key.write,access-org.read,access-org.revoke,access-org.write,access-policy-test.read,access-policy-test.write,access-policy.read,access-policy.write,access-population.read,access-population.write,access-saml-certificate.read,access-saml-certificate.write,access-scim-log.read,access-seats.write,access-service-token.read,access-service-token.write,access-ssh-auditing.read,access-ssh-auditing.write,access-tag.read,access-tag.write,access-users.read,access-users.write,access.read,access.revoke,access.write,account-api-gateway.read,account-api-gateway.write,account-custom-asset.read,account-custom-asset.write,account-custom-error-rules.read,account-custom-error-rules.write,account-custom-pages.read,account-custom-pages.write,account-disable-esc.read,account-disable-esc.write,account-dns-settings.read,account-dns-settings.write,account-firewall-access-rules.read,account-firewall-access-rules.write,account-logs.read,account-logs.write,account-rule-lists.read,account-rule-lists.write,account-rulesets.read,account-rulesets.write,account-security-center-insights.read,account-security-center-insights.write,account-settings.read,account-settings.write,account-ssl-and-certificates.read,account-waf.read,account-waf.write,account-waiting-rooms.read,address-maps.read,address-maps.write,agent-memory.write,agw.read,agw.run,agw.write,ai-search.index,ai-search.metadata_read,ai-search.read,ai-search.run,ai-search.write,ai.read,ai.write,aiaudit.read,aiaudit.write,aig.metadata_read,aig.read,aig.run,aig.write,analytics.read,api-gateway.read,api-gateway.write,apps.write,argotunnel.read,argotunnel.write,artifacts.read,artifacts.write,bot-management-feedback.read,bot-management-feedback.write,bot-management.read,bot-management.write,browser-rendering.read,browser-rendering.write,cache-settings.read,cache-settings.write,cache.purge,calls.read,calls.write,casb.read,casb.write,cf-agents.read,cf-agents.write,challenge-widgets.read,challenge-widgets.write,chinanetwork-steering.read,chinanetwork-steering.write,cloud-connector.read,cloud-connector.write,cloud-email-security.read,cloud-email-security.write,cloudchamber.read,cloudchamber.write,cloudforce-one.read,cloudforce-one.write,config-settings.read,config-settings.write,connectivity-directory.admin,connectivity-directory.bind,connectivity-directory.read,constellation.read,constellation.write,containers.read,containers.write,custom-errors.read,custom-errors.write,custom-pages.read,custom-pages.write,d1.metadata_read,d1.read,d1.write,ddos-botnet-feed.read,ddos-botnet-feed.write,ddos-protection.read,ddos-protection.write,dls.read,dls.write,dns-firewall.read,dns-firewall.write,dns-view.read,dns-view.write,dns.read,dns.write,domain-page-shield.read,domain-page.shield,dynamic-redirect.read,dynamic-redirect.write,email-routing-account-rule.read,email-routing-address.read,email-routing-address.write,email-routing-rule.read,email-routing-rule.write,email-routing-suppression.read,email-routing-suppression.write,email-security-dmarcreports.read,email-security-dmarcreports.write,email-sending.read,email-sending.write,fbm.admin,fbm.read,fbm.write,field-extractor.read,field-extractor.write,firewall-for-ai.read,firewall-for-ai.write,firewall-services.read,firewall-services.write,flagship.evaluate,flagship.read,flagship.write,fraud-detection-pii.read,fraud-detection.read,fraud-detection.write,fraud-events.write,fraud-feedback.read,fraud-feedback.write,healthcheck.read,healthcheck.write,http-applications.read,http-applications.write,http-ddos-managed-ruleset.read,http-ddos-managed-ruleset.write,images.metadata_read,images.read,images.write,integration.write,intel.read,intel.write,iot.read,iot.write,ip-prefix-bgp-on-demand.read,ip-prefix-bgp-on-demand.write,ip-prefix.read,ip-prefix.write,l4-ddos-managed-ruleset.read,l4-ddos-managed-ruleset.write,load-balancers-account.read,load-balancers-account.write,load-balancers.read,load-balancers.write,load-balancing-monitors-and-pools.read,load-balancing-monitors-and-pools.write,magic-firewall.read,magic-firewall.write,magic-transit.read,magic-transit.write,magic-wan.read,magic-wan.write,managed-headers.read,managed-headers.write,mass-url-redirects.read,mass-url-redirects.write,mcp-portals.read,mcp-portals.write,memberships.read,memberships.write,messaging.edit,messaging.metadata_read,messaging.read,moq.read,moq.write,notifications.read,notifications.write,origin.read,origin.write,page-rules.read,page-rules.write,page-shield.read,page.read,page.shield,page.write,pages.metadata_read,payments-gateway.read,payments-gateway.write,pcaps-api.read,pcaps-api.write,pipelines.read,pipelines.send,pipelines.write,precursor.read,precursor.write,pubsub.read,pubsub.write,query-cache.read,query-cache.write,queues.metadata_read,queues.read,queues.write,r2-catalog-sql.read,r2-catalog.read,r2-catalog.write,radar.read,rag.read,rag.run,rag.write,realtime.admin,realtime.read,realtime.write,registrar-sandbox-domains.admin,registrar-sandbox-domains.read,reports-application-security-report.read,request-tracer.read,resource-library.read,resource-library.write,resource-sharing.read,response-compression.read,response-compression.write,sanitize.read,sanitize.write,secrets-store.read,secrets-store.write,select-configuration.read,select-configuration.write,stream.metadata_read,stream.read,stream.write,tag.read,tag.write,teams-cds-compute-account.read,teams-cds-compute-account.write,teams-connector-cloudflared.monitoring,teams-connector-cloudflared.read,teams-connector-cloudflared.write,teams-connector-warp.read,teams-connector-warp.write,teams-connectors.read,teams-connectors.write,teams-dex.read,teams-dex.write,teams-networks.read,teams-networks.write,teams-pii.read,teams-resilience.read,teams-resilience.write,teams-secure.location,teams.read,teams.report,teams.write,transform-rules.read,transform-rules.write,trust-and-safety.read,trust-and-safety.write,url-scanner.read,url-scanner.write,user-details.read,user-details.write,vectorize.read,vectorize.write,waiting-rooms.read,waiting-rooms.write,web3-hostnames.read,web3-hostnames.write,websearch.metadata_read,websearch.read,websearch.write,workers-ci.read,workers-ci.write,workers-kv-storage.metadata_read,workers-kv-storage.read,workers-kv-storage.write,workers-observability-telemetry.write,workers-observability.read,workers-observability.write,workers-r2-bucket-item.read,workers-r2-bucket-item.write,workers-r2.metadata_read,workers-r2.read,workers-r2.write,workers-routes.read,workers-routes.write,workers-scripts.bind,workers-scripts.read,workers-scripts.write,workers-tail.read,workers_ai.metadata_read,zaraz.edit,zaraz.read,zaraz.write,zone-access.read,zone-access.revoke,zone-access.write,zone-custom-asset.read,zone-custom-asset.write,zone-disable-esc.read,zone-disable-esc.write,zone-dns-settings.read,zone-dns-settings.write,zone-security-center-insights.read,zone-security-center-insights.write,zone-settings.read,zone-settings.write,zone-transform-rules.read,zone-transform-rules.write,zone-versioning.read,zone-versioning.write,zone-waf.read,zone-waf.write,zone.read,zone.write`.split(`,`),Fe=[...`openid.offline.user:read.account:read.access:read.access:write.agw:read.agw:run.agw:write.ai:read.ai:write.ai-search:read.ai-search:run.ai-search:write.aiaudit:read.aiaudit:write.aig:read.aig:write.auditlogs:read.browser:read.browser:write.cfone:read.cfone:write.cloudchamber:write.connectivity:admin.connectivity:bind.connectivity:read.constellation:write.containers:write.d1:write.dex:read.dex:write.dns_analytics:read.dns_records:edit.dns_records:read.dns_settings:read.email_routing:write.email_sending:write.firstpartytags:write.images:read.images:write.lb:edit.lb:read.logpush:read.logpush:write.mcp_portals:read.mcp_portals:write.notebook-examples:read.notification:read.notification:write.pages:read.pages:write.pipelines:read.pipelines:setup.pipelines:write.query_cache:write.queues:write.r2_catalog:write.radar:read.rag:read.rag:write.registrar:read.registrar:write.secrets_store:read.secrets_store:write.sso-connector:read.sso-connector:write.ssl_certs:write.teams:pii.teams:read.teams:secure_location.teams:write.url_scanner:read.url_scanner:write.vectorize:write.workers:read.workers:write.workers_builds:read.workers_builds:write.workers_deployments:read.workers_kv:write.workers_observability:read.workers_observability:write.workers_observability_telemetry:write.workers_routes:write.workers_scripts:write.workers_tail:read.zone:read`.split(`.`)];function Ie(e){Fe=e}_(Ie,`setLoginScopeKeys`);var Le=new Set(Pe);function Re(e){return e.every(e=>Le.has(e))}_(Re,`validateScopeKeys`);function ze(){let e=o();return e===`production`?`cloudflare-temporary-account.json`:`cloudflare-temporary-account.${e}.json`}_(ze,`getTemporaryAccountConfigFile`);function Be(){return A.join(Q(),ze())}_(Be,`getCfTemporaryAccountConfigPath`);function Ve(e){return J(`json`,e)}_(Ve,`createJsonFileStorage`);var{getAuthConfigFilePath:He,getEncryptedAuthConfigFilePath:Ue,defaultAuthConfigStorage:We,readAuthConfigFile:Ge,writeAuthConfigFile:Ke}=Oe({getConfigPath:Q,format:`json`}),$={cliName:ke,displayName:Ae,commands:{login:`cf auth login`,whoami:`cf auth whoami`,createProfile:`cf auth create`,deviceLogin:`cf auth login`},keyringServiceName:Z,clientId:Ne,consent:Me,redirectUri:je,useDeviceFlowByDefault:!0,allowGlobalAuthKey:!1,getConfigPath:Q,getTemporaryAccountConfigPath:Be,fileFormat:`json`,accountCachePrefix:`cloudflare-account`,cacheNamespace:`cloudflare`,getConfigFileLabel:_(()=>`cf config`,`getConfigFileLabel`),getDefaultScopeKeys:_(()=>Fe,`getDefaultScopeKeys`)},qe=j(Q),{readUserPreferences:Je,updateUserPreferences:Ye}=qe;function Xe(e){return we($,e)}_(Xe,`createCfAuth`);function Ze(e){return X({logger:e.logger,getConfigPath:Q,keyringServiceName:Z,format:`json`})}_(Ze,`createCfProfileStore`);var Qe=De({loginCommand:$.commands.login,createProfileCommand:$.commands.createProfile,keyringServiceName:Z,getConfigPath:Q,format:`json`,preferences:qe});function $e(e,t){return Qe.setKeyringPreference(e,t)}_($e,`setKeyringPreference`);export{Re as a,Q as i,Ze as n,Ve as r,Xe as t};

package/dist/{chunk-LQW53VED-22IYZovK.mjs → chunk-LQW53VED-9MACsvSG.mjs}

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
-import{B as e,H as t,I as n,P as r,St as i,T as a,Tt as o,V as s,Y as c,Z as l,bt as u,wt as d}from"./dist-BWpErtDM.mjs";import{createRequire as f}from"node:module";import{chmodSync as p,existsSync as m,mkdirSync as h,rmSync as g,writeFileSync as _}from"node:fs";import v from"node:assert";import{TextEncoder as ee}from"node:util";import y from"node:path";import te from"node:url";import ne from"node:http";import{createCipheriv as re,createDecipheriv as ie,createHash as b,randomBytes as x,webcrypto as S}from"node:crypto";import{spawn as ae,spawnSync as C}from"node:child_process";var oe=Object.defineProperty,w=(e,t)=>oe(e,`name`,{value:t,configurable:!0}),T=r(),se=!1;function E(e){let{configOverride:t,warningLogger:n,storage:r}=e,{oauth_token:i,refresh_token:a,expiration_time:o,scopes:s,api_token:c}=t??r.read()??{};return i?{accessToken:{value:i,expiry:o??`2000-01-01:00:00:00+00:00`},refreshToken:{value:a??``},scopes:s}:c?(!se&&n&&(se=!0,n.warn(`It looks like you have used Wrangler v1's \`config\` command to login with an API token
+import{$ as e,Ct as t,D as n,Dt as r,Et as i,H as a,I as o,R as s,U as c,W as l,Z as u,xt as d}from"./dist-DV7LR38l.mjs";import{createRequire as f}from"node:module";import{chmodSync as p,existsSync as m,mkdirSync as h,rmSync as g,writeFileSync as _}from"node:fs";import v from"node:assert";import{TextEncoder as ee}from"node:util";import y from"node:path";import te from"node:url";import ne from"node:http";import{createCipheriv as re,createDecipheriv as ie,createHash as b,randomBytes as x,webcrypto as S}from"node:crypto";import{spawn as ae,spawnSync as C}from"node:child_process";var oe=Object.defineProperty,w=(e,t)=>oe(e,`name`,{value:t,configurable:!0}),T=o(),se=!1;function E(e){let{configOverride:t,warningLogger:n,storage:r}=e,{oauth_token:i,refresh_token:a,expiration_time:o,scopes:s,api_token:c}=t??r.read()??{};return i?{accessToken:{value:i,expiry:o??`2000-01-01:00:00:00+00:00`},refreshToken:{value:a??``},scopes:s}:c?(!se&&n&&(se=!0,n.warn(`It looks like you have used Wrangler v1's \`config\` command to login with an API token
 from ${t===void 0?r.path():`in-memory config`}.
 This is no longer supported in the current version of Wrangler.
-If you wish to authenticate via an API token then please set the \`CLOUDFLARE_API_TOKEN\` environment variable.`)),{deprecatedApiToken:c}):{}}w(E,`readStoredAuthState`);var ce=l({variableName:`CLOUDFLARE_API_TOKEN`,deprecatedName:`CF_API_TOKEN`}),le=l({variableName:`CLOUDFLARE_API_KEY`,deprecatedName:`CF_API_KEY`}),ue=l({variableName:`CLOUDFLARE_EMAIL`,deprecatedName:`CF_EMAIL`});function de(e){if(e?.allowGlobalAuthKey??!0){let e=le(),t=ue();if(e&&t)return{authKey:e,authEmail:t}}let t=ce();if(t)return{apiToken:t}}w(de,`getAuthFromEnv`);function fe(e){let t=de(e);if(t)return t;let n=E({storage:e.storage,warningLogger:e.warningLogger});if(n.deprecatedApiToken)return{apiToken:n.deprecatedApiToken};if(n.accessToken?.value)return{apiToken:n.accessToken.value}}w(fe,`getAPIToken`);function pe(e){let t=fe(e);if(!t)throw new o(`No API token found.`,{telemetryMessage:`user auth missing api token`});return t}w(pe,`requireApiToken`);var me=/^[A-Za-z0-9_-]+$/;function he(e,t){if(!me.test(e))throw new o(`Invalid account ID "${e}" ${t}. Account IDs may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`user account id invalid characters`});return e}w(he,`validateAccountId`);var D=l({variableName:`WRANGLER_AUTH_DOMAIN`,defaultValue:w(()=>s()===`staging`?`dash.staging.cloudflare.com`:`dash.cloudflare.com`,`defaultValue`)}),ge=l({variableName:`WRANGLER_AUTH_URL`,defaultValue:w(()=>`https://${D()}/oauth2/auth`,`defaultValue`)}),_e=l({variableName:`WRANGLER_TOKEN_URL`,defaultValue:w(()=>`https://${D()}/oauth2/token`,`defaultValue`)}),ve=l({variableName:`WRANGLER_REVOKE_URL`,defaultValue:w(()=>`https://${D()}/oauth2/revoke`,`defaultValue`)}),ye=l({variableName:`CLOUDFLARE_ACCOUNT_ID`,deprecatedName:`CF_ACCOUNT_ID`});function be(){let e=ye();if(e)return he(e,"set in the `CLOUDFLARE_ACCOUNT_ID` environment variable")}w(be,`getCloudflareAccountIdFromEnv`);var xe=`/oauth2/device/auth`;function Se(){return`https://${D()}${xe}`}w(Se,`getDeviceAuthUrl`);var Ce=l({variableName:`CLOUDFLARE_ACCESS_CLIENT_ID`}),we=l({variableName:`CLOUDFLARE_ACCESS_CLIENT_SECRET`}),Te=l({variableName:`WRANGLER_CF_AUTHORIZATION_TOKEN`}),Ee=c({variableName:`CLOUDFLARE_AUTH_USE_KEYRING`}),O={},k=new Map;function De(){for(let e of Object.keys(O))delete O[e];k.clear()}w(De,`clearAccessCaches`);async function Oe(e,t){if(t.debug(`Checking if domain has Access enabled:`,e),k.has(e))return t.debug(`Using cached Access switch for:`,e,k.get(e)),k.get(e)??!1;t.debug(`Access switch not cached for:`,e);try{let n=new AbortController,r=setTimeout(()=>{n.abort()},1e3),i=await(0,T.fetch)(`https://${e}`,{redirect:`manual`,signal:n.signal});clearTimeout(r);let a=!!(i.status===302&&i.headers.get(`location`)?.includes(`cloudflareaccess.com`));return t.debug(`Caching access switch for:`,e),k.set(e,a),a}catch{return k.set(e,!1),!1}}w(Oe,`domainUsesAccess`);async function ke(e,t){let n=t.logger,r=Ce(),i=we();if(r&&i)return n.debug(`Using Access Service Token headers for domain:`,e),{"CF-Access-Client-Id":r,"CF-Access-Client-Secret":i};if((r!==void 0||i!==void 0)&&n.warn(`Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${r===void 0?`CLOUDFLARE_ACCESS_CLIENT_SECRET`:`CLOUDFLARE_ACCESS_CLIENT_ID`} was found.`),!await Oe(e,n))return{};if(n.debug(`Getting Access headers for domain:`,e),O[e])return n.debug(`Using cached Access headers for domain:`,e),O[e];if((t.isNonInteractiveOrCI??a)())throw new o(`The domain "${e}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
+If you wish to authenticate via an API token then please set the \`CLOUDFLARE_API_TOKEN\` environment variable.`)),{deprecatedApiToken:c}):{}}w(E,`readStoredAuthState`);var ce=e({variableName:`CLOUDFLARE_API_TOKEN`,deprecatedName:`CF_API_TOKEN`}),le=e({variableName:`CLOUDFLARE_API_KEY`,deprecatedName:`CF_API_KEY`}),ue=e({variableName:`CLOUDFLARE_EMAIL`,deprecatedName:`CF_EMAIL`});function de(e){if(e?.allowGlobalAuthKey??!0){let e=le(),t=ue();if(e&&t)return{authKey:e,authEmail:t}}let t=ce();if(t)return{apiToken:t}}w(de,`getAuthFromEnv`);function fe(e){let t=de(e);if(t)return t;let n=E({storage:e.storage,warningLogger:e.warningLogger});if(n.deprecatedApiToken)return{apiToken:n.deprecatedApiToken};if(n.accessToken?.value)return{apiToken:n.accessToken.value}}w(fe,`getAPIToken`);function pe(e){let t=fe(e);if(!t)throw new r(`No API token found.`,{telemetryMessage:`user auth missing api token`});return t}w(pe,`requireApiToken`);var me=/^[A-Za-z0-9_-]+$/;function he(e,t){if(!me.test(e))throw new r(`Invalid account ID "${e}" ${t}. Account IDs may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`user account id invalid characters`});return e}w(he,`validateAccountId`);var D=e({variableName:`WRANGLER_AUTH_DOMAIN`,defaultValue:w(()=>c()===`staging`?`dash.staging.cloudflare.com`:`dash.cloudflare.com`,`defaultValue`)}),ge=e({variableName:`WRANGLER_AUTH_URL`,defaultValue:w(()=>`https://${D()}/oauth2/auth`,`defaultValue`)}),_e=e({variableName:`WRANGLER_TOKEN_URL`,defaultValue:w(()=>`https://${D()}/oauth2/token`,`defaultValue`)}),ve=e({variableName:`WRANGLER_REVOKE_URL`,defaultValue:w(()=>`https://${D()}/oauth2/revoke`,`defaultValue`)}),ye=e({variableName:`CLOUDFLARE_ACCOUNT_ID`,deprecatedName:`CF_ACCOUNT_ID`});function be(){let e=ye();if(e)return he(e,"set in the `CLOUDFLARE_ACCOUNT_ID` environment variable")}w(be,`getCloudflareAccountIdFromEnv`);var xe=`/oauth2/device/auth`;function Se(){return`https://${D()}${xe}`}w(Se,`getDeviceAuthUrl`);var Ce=e({variableName:`CLOUDFLARE_ACCESS_CLIENT_ID`}),we=e({variableName:`CLOUDFLARE_ACCESS_CLIENT_SECRET`}),Te=e({variableName:`WRANGLER_CF_AUTHORIZATION_TOKEN`}),Ee=u({variableName:`CLOUDFLARE_AUTH_USE_KEYRING`}),O={},k=new Map;function De(){for(let e of Object.keys(O))delete O[e];k.clear()}w(De,`clearAccessCaches`);async function Oe(e,t){if(t.debug(`Checking if domain has Access enabled:`,e),k.has(e))return t.debug(`Using cached Access switch for:`,e,k.get(e)),k.get(e)??!1;t.debug(`Access switch not cached for:`,e);try{let n=new AbortController,r=setTimeout(()=>{n.abort()},1e3),i=await(0,T.fetch)(`https://${e}`,{redirect:`manual`,signal:n.signal});clearTimeout(r);let a=!!(i.status===302&&i.headers.get(`location`)?.includes(`cloudflareaccess.com`));return t.debug(`Caching access switch for:`,e),k.set(e,a),a}catch{return k.set(e,!1),!1}}w(Oe,`domainUsesAccess`);async function ke(e,t){let i=t.logger,a=Ce(),o=we();if(a&&o)return i.debug(`Using Access Service Token headers for domain:`,e),{"CF-Access-Client-Id":a,"CF-Access-Client-Secret":o};if((a!==void 0||o!==void 0)&&i.warn(`Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${a===void 0?`CLOUDFLARE_ACCESS_CLIENT_SECRET`:`CLOUDFLARE_ACCESS_CLIENT_ID`} was found.`),!await Oe(e,i))return{};if(i.debug(`Getting Access headers for domain:`,e),O[e])return i.debug(`Using cached Access headers for domain:`,e),O[e];if((t.isNonInteractiveOrCI??n)())throw new r(`The domain "${e}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
 Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate with an Access Service Token.
-See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/`,{telemetryMessage:`user access missing service token non interactive`});n.debug(`Spawning cloudflared to get Access token for domain:`);let s=await Ae(e,t.signal);if(s.error)throw new o("To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",{telemetryMessage:`user access missing cloudflared`});let c=s.stdout;n.debug(`cloudflared output:`,c);let l=c.match(/fetched your token:\n\n(.*)/m);if(l&&l.length>=2){let t={Cookie:`CF_Authorization=${l[1]}`};return O[e]=t,n.debug(`Caching Access headers for domain:`,e),t}throw Error(`Failed to authenticate with Cloudflare Access`)}w(ke,`getAccessHeaders`);function Ae(e,t){return new Promise((n,r)=>{let i=ae(`cloudflared`,[`access`,`login`,e],{signal:t}),a=[];i.stdout.on(`data`,e=>a.push(e)),i.stderr.resume();let o=w(()=>i.kill(),`killChild`);process.once(`exit`,o),i.on(`error`,e=>{if(process.removeListener(`exit`,o),t?.aborted){r(e);return}n({error:e,stdout:``})}),i.on(`close`,()=>{if(process.removeListener(`exit`,o),t?.aborted){r(t.reason??Error(`The operation was aborted`));return}n({stdout:Buffer.concat(a).toString()})})})}w(Ae,`spawnCloudflaredAccessLogin`);async function je(e){let t=Te();return t===void 0?ke(D(),e):(e.logger.debug(`Using WRANGLER_CF_AUTHORIZATION_TOKEN from environment`),{Cookie:`CF_Authorization=${t}`})}w(je,`getCloudflareAccessHeaders`);var Me=96,Ne=32,Pe=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`;function Fe(e){let t=btoa(e);return t=t.replace(/\+/g,`-`),t=t.replace(/\//g,`_`),t=t.replace(/=/g,``),t}w(Fe,`base64urlEncode`);async function Ie(){let e=new Uint32Array(Me);S.getRandomValues(e);let t=Fe(Array.from(e).map(e=>Pe[e%Pe.length]).join(``)),n=await S.subtle.digest(`SHA-256`,new ee().encode(t)),r=new Uint8Array(n),i=``,a=r.byteLength;for(let e=0;e<a;e++)i+=String.fromCharCode(r[e]);return{codeChallenge:Fe(i),codeVerifier:t}}w(Ie,`generatePKCECodes`);var Le=w(({verificationUri:e,userCode:t})=>{let n=new URL(e);return n.searchParams.set(`user_code`,t),n.toString()},`generateVerificationUrl`);function Re(e){try{return new URL(e)}catch{return}}w(Re,`parseUrl`);function ze(e,t){let n=Re(e),r=Re(`https://${t.authDomain}`);if(!(n!==void 0&&r!==void 0&&n.protocol===`https:`&&n.username===``&&n.password===``&&n.host===r.host))throw new o(`The authorization server returned an untrusted \`${t.field}\`: ${e}
-Expected an \`https\` URL on \`${t.authDomain}\`. Refusing to display or open it.`,{telemetryMessage:`user device-flow untrusted verification url`})}w(ze,`assertTrustedVerificationUrl`);var Be=w(({authUrl:e,clientId:t,scopes:n,stateQueryParam:r,codeChallenge:i,redirectUri:a})=>e+`?response_type=code&client_id=${encodeURIComponent(t)}&redirect_uri=${encodeURIComponent(a)}&scope=${encodeURIComponent([...n,`offline_access`].join(` `))}&state=${r}&code_challenge=${encodeURIComponent(i)}&code_challenge_method=S256`,`generateAuthUrl`);function Ve(e){let t=new Uint32Array(e);return S.getRandomValues(t),Array.from(t).map(e=>Pe[e%Pe.length]).join(``)}w(Ve,`generateRandomState`);var He=64e6;function Ue(e,t,n){let r=Array(t+1),i=b(`sha256`).update(e).digest();r[0]=i;for(let e=0;e<t;e++){for(let e=0;e<n;e++)i=b(`sha256`).update(i).digest();r[e+1]=i}return r}w(Ue,`solvePow`);function We(e){return Buffer.concat(e).toString(`base64`)}w(We,`encodeCheckpoints`);function Ge(e){let t=Ue(Buffer.from(e.seed,`base64url`),e.k,e.g);return{challengeToken:e.challengeToken,solution:{checkpoints:We(t)}}}w(Ge,`solveChallenge`);var A={termsOfService:`https://www.cloudflare.com/terms/`,privacyPolicy:`https://www.cloudflare.com/privacypolicy/`},Ke=`You must accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`,qe=`Continuing means you accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}).`,Je=`You must accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}) to use --temporary.`;function Ye(){return`${e(n)}/provisioning/previews`}w(Ye,`getTemporaryPreviewUrl`);function Xe(){return`${Ye()}/challenge`}w(Xe,`getTemporaryPreviewChallengeUrl`);function Ze(e){let t=Date.parse(e);return!Number.isNaN(t)&&t>Date.now()}w(Ze,`isFutureTimestamp`);function Qe(e){let t=e.read();if(t&&!(!t.account?.id||!t.account?.apiToken||!t.account?.name||!t.claim?.url||!Ze(t.account?.expiresAt??``)||!Ze(t.claim?.expiresAt??``)))return t}w(Qe,`getCachedTemporaryPreviewAccount`);async function $e(e){let t=await(0,T.fetch)(Xe(),{method:`POST`,headers:{"Content-Type":`application/json`},body:`{}`});if(!t.ok)throw new d(`Failed to request a proof-of-work challenge (${t.status} ${t.statusText}).`,{telemetryMessage:`deploy temporary account challenge failed`});let n;try{n=await t.json()}catch{throw new d(`Failed to request a proof-of-work challenge. Received an invalid response (${t.status} ${t.statusText}).`,{telemetryMessage:`deploy temporary account challenge invalid response`})}let{challengeToken:r,seed:i,k:a,g:o}=n.result??{};if(r===void 0||i===void 0||a===void 0||o===void 0)throw new d(`Failed to request a proof-of-work challenge because the response was missing required fields.`,{telemetryMessage:`deploy temporary account challenge incomplete`});if(!Number.isInteger(a)||!Number.isInteger(o)||a<=0||o<=0||a*o>He||Buffer.from(i,`base64url`).length!==32)throw new d(`The proof-of-work challenge is not supported by this version of Wrangler.`,{telemetryMessage:`deploy temporary account challenge difficulty unsupported`});return e.log(`Solving proof-of-work challenge…`),Ge({challengeToken:r,seed:i,k:a,g:o})}w($e,`requestPowSolution`);async function et(e){let t=await $e(e),n=await(0,T.fetch)(Ye(),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({termsOfService:A.termsOfService,privacyPolicy:A.privacyPolicy,acceptTermsOfService:`yes`,challengeToken:t.challengeToken,solution:t.solution})});if(!n.ok)throw new d(`Failed to create a temporary preview account (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account create failed`});let r;try{r=await n.json()}catch{throw new d(`Failed to create a temporary preview account. Received an invalid response (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account invalid response`})}let i=r.result,a=i?.account?.id,o=i?.account?.name,s=i?.account?.apiToken,c=i?.account?.expiresAt,l=i?.claim?.url,u=i?.claim?.expiresAt;if(a===void 0||o===void 0||s===void 0||c===void 0||l===void 0||u===void 0)throw new d(`Failed to create a temporary preview account because the response was missing required fields.`,{telemetryMessage:`deploy temporary account response incomplete`});return{account:{id:a,name:o,apiToken:s,expiresAt:c},claim:{url:l,expiresAt:u}}}w(et,`createTemporaryPreviewAccount`);async function tt(e){let t=Qe(e.storage);if(t)return{account:t,cached:!0};if(!await e.prompt(Ke,qe))throw new o(Je,{telemetryMessage:`user temporary terms not accepted`});let n=await et(e.logger);return e.storage.write(n),{account:n,cached:!1}}w(tt,`getOrCreateTemporaryPreviewAccount`);function nt(e){var t=[...arguments].slice(1),n=Array.from(typeof e==`string`?[e]:e);n[n.length-1]=n[n.length-1].replace(/\r?\n([\t ]*)$/,``);var r=n.reduce(function(e,t){var n=t.match(/\n([\t ]+|(?!\s).)/g);return n?e.concat(n.map(function(e){return e.match(/[\t ]/g)?.length??0})):e},[]);if(r.length){var i=RegExp(`
+See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/`,{telemetryMessage:`user access missing service token non interactive`});i.debug(`Spawning cloudflared to get Access token for domain:`);let s=await Ae(e,t.signal);if(s.error)throw new r("To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",{telemetryMessage:`user access missing cloudflared`});let c=s.stdout;i.debug(`cloudflared output:`,c);let l=c.match(/fetched your token:\n\n(.*)/m);if(l&&l.length>=2){let t={Cookie:`CF_Authorization=${l[1]}`};return O[e]=t,i.debug(`Caching Access headers for domain:`,e),t}throw Error(`Failed to authenticate with Cloudflare Access`)}w(ke,`getAccessHeaders`);function Ae(e,t){return new Promise((n,r)=>{let i=ae(`cloudflared`,[`access`,`login`,e],{signal:t}),a=[];i.stdout.on(`data`,e=>a.push(e)),i.stderr.resume();let o=w(()=>i.kill(),`killChild`);process.once(`exit`,o),i.on(`error`,e=>{if(process.removeListener(`exit`,o),t?.aborted){r(e);return}n({error:e,stdout:``})}),i.on(`close`,()=>{if(process.removeListener(`exit`,o),t?.aborted){r(t.reason??Error(`The operation was aborted`));return}n({stdout:Buffer.concat(a).toString()})})})}w(Ae,`spawnCloudflaredAccessLogin`);async function je(e){let t=Te();return t===void 0?ke(D(),e):(e.logger.debug(`Using WRANGLER_CF_AUTHORIZATION_TOKEN from environment`),{Cookie:`CF_Authorization=${t}`})}w(je,`getCloudflareAccessHeaders`);var Me=96,Ne=32,Pe=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`;function Fe(e){let t=btoa(e);return t=t.replace(/\+/g,`-`),t=t.replace(/\//g,`_`),t=t.replace(/=/g,``),t}w(Fe,`base64urlEncode`);async function Ie(){let e=new Uint32Array(Me);S.getRandomValues(e);let t=Fe(Array.from(e).map(e=>Pe[e%Pe.length]).join(``)),n=await S.subtle.digest(`SHA-256`,new ee().encode(t)),r=new Uint8Array(n),i=``,a=r.byteLength;for(let e=0;e<a;e++)i+=String.fromCharCode(r[e]);return{codeChallenge:Fe(i),codeVerifier:t}}w(Ie,`generatePKCECodes`);var Le=w(({verificationUri:e,userCode:t})=>{let n=new URL(e);return n.searchParams.set(`user_code`,t),n.toString()},`generateVerificationUrl`);function Re(e){try{return new URL(e)}catch{return}}w(Re,`parseUrl`);function ze(e,t){let n=Re(e),i=Re(`https://${t.authDomain}`);if(!(n!==void 0&&i!==void 0&&n.protocol===`https:`&&n.username===``&&n.password===``&&n.host===i.host))throw new r(`The authorization server returned an untrusted \`${t.field}\`: ${e}
+Expected an \`https\` URL on \`${t.authDomain}\`. Refusing to display or open it.`,{telemetryMessage:`user device-flow untrusted verification url`})}w(ze,`assertTrustedVerificationUrl`);var Be=w(({authUrl:e,clientId:t,scopes:n,stateQueryParam:r,codeChallenge:i,redirectUri:a})=>e+`?response_type=code&client_id=${encodeURIComponent(t)}&redirect_uri=${encodeURIComponent(a)}&scope=${encodeURIComponent([...n,`offline_access`].join(` `))}&state=${r}&code_challenge=${encodeURIComponent(i)}&code_challenge_method=S256`,`generateAuthUrl`);function Ve(e){let t=new Uint32Array(e);return S.getRandomValues(t),Array.from(t).map(e=>Pe[e%Pe.length]).join(``)}w(Ve,`generateRandomState`);var He=64e6;function Ue(e,t,n){let r=Array(t+1),i=b(`sha256`).update(e).digest();r[0]=i;for(let e=0;e<t;e++){for(let e=0;e<n;e++)i=b(`sha256`).update(i).digest();r[e+1]=i}return r}w(Ue,`solvePow`);function We(e){return Buffer.concat(e).toString(`base64`)}w(We,`encodeCheckpoints`);function Ge(e){let t=Ue(Buffer.from(e.seed,`base64url`),e.k,e.g);return{challengeToken:e.challengeToken,solution:{checkpoints:We(t)}}}w(Ge,`solveChallenge`);var A={termsOfService:`https://www.cloudflare.com/terms/`,privacyPolicy:`https://www.cloudflare.com/privacypolicy/`},Ke=`You must accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`,qe=`Continuing means you accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}).`,Je=`You must accept Cloudflare's Terms of Service (${A.termsOfService}) and Privacy Policy (${A.privacyPolicy}) to use --temporary.`;function Ye(){return`${a(s)}/provisioning/previews`}w(Ye,`getTemporaryPreviewUrl`);function Xe(){return`${Ye()}/challenge`}w(Xe,`getTemporaryPreviewChallengeUrl`);function Ze(e){let t=Date.parse(e);return!Number.isNaN(t)&&t>Date.now()}w(Ze,`isFutureTimestamp`);function Qe(e){let t=e.read();if(t&&!(!t.account?.id||!t.account?.apiToken||!t.account?.name||!t.claim?.url||!Ze(t.account?.expiresAt??``)||!Ze(t.claim?.expiresAt??``)))return t}w(Qe,`getCachedTemporaryPreviewAccount`);async function $e(e){let t=await(0,T.fetch)(Xe(),{method:`POST`,headers:{"Content-Type":`application/json`},body:`{}`});if(!t.ok)throw new i(`Failed to request a proof-of-work challenge (${t.status} ${t.statusText}).`,{telemetryMessage:`deploy temporary account challenge failed`});let n;try{n=await t.json()}catch{throw new i(`Failed to request a proof-of-work challenge. Received an invalid response (${t.status} ${t.statusText}).`,{telemetryMessage:`deploy temporary account challenge invalid response`})}let{challengeToken:r,seed:a,k:o,g:s}=n.result??{};if(r===void 0||a===void 0||o===void 0||s===void 0)throw new i(`Failed to request a proof-of-work challenge because the response was missing required fields.`,{telemetryMessage:`deploy temporary account challenge incomplete`});if(!Number.isInteger(o)||!Number.isInteger(s)||o<=0||s<=0||o*s>He||Buffer.from(a,`base64url`).length!==32)throw new i(`The proof-of-work challenge is not supported by this version of Wrangler.`,{telemetryMessage:`deploy temporary account challenge difficulty unsupported`});return e.log(`Solving proof-of-work challenge…`),Ge({challengeToken:r,seed:a,k:o,g:s})}w($e,`requestPowSolution`);async function et(e){let t=await $e(e),n=await(0,T.fetch)(Ye(),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({termsOfService:A.termsOfService,privacyPolicy:A.privacyPolicy,acceptTermsOfService:`yes`,challengeToken:t.challengeToken,solution:t.solution})});if(!n.ok)throw new i(`Failed to create a temporary preview account (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account create failed`});let r;try{r=await n.json()}catch{throw new i(`Failed to create a temporary preview account. Received an invalid response (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account invalid response`})}let a=r.result,o=a?.account?.id,s=a?.account?.name,c=a?.account?.apiToken,l=a?.account?.expiresAt,u=a?.claim?.url,d=a?.claim?.expiresAt;if(o===void 0||s===void 0||c===void 0||l===void 0||u===void 0||d===void 0)throw new i(`Failed to create a temporary preview account because the response was missing required fields.`,{telemetryMessage:`deploy temporary account response incomplete`});return{account:{id:o,name:s,apiToken:c,expiresAt:l},claim:{url:u,expiresAt:d}}}w(et,`createTemporaryPreviewAccount`);async function tt(e){let t=Qe(e.storage);if(t)return{account:t,cached:!0};if(!await e.prompt(Ke,qe))throw new r(Je,{telemetryMessage:`user temporary terms not accepted`});let n=await et(e.logger);return e.storage.write(n),{account:n,cached:!1}}w(tt,`getOrCreateTemporaryPreviewAccount`);function nt(e){var t=[...arguments].slice(1),n=Array.from(typeof e==`string`?[e]:e);n[n.length-1]=n[n.length-1].replace(/\r?\n([\t ]*)$/,``);var r=n.reduce(function(e,t){var n=t.match(/\n([\t ]+|(?!\s).)/g);return n?e.concat(n.map(function(e){return e.match(/[\t ]/g)?.length??0})):e},[]);if(r.length){var i=RegExp(`
 [	 ]{`+Math.min.apply(Math,r)+`}`,`g`);n=n.map(function(e){return e.replace(i,`
 `)})}n[0]=n[0].replace(/^\r?\n/,``);var a=n[0];return t.forEach(function(e,t){var r=a.match(/(?:^|\n)( *)$/),i=r?r[1]:``,o=e;typeof e==`string`&&e.includes(`
 `)&&(o=String(e).split(`
 `).map(function(e,t){return t===0?e:``+i+e}).join(`
-`)),a+=o+n[t+1]}),a}w(nt,`dedent`);var rt=nt,j=class extends o{static{w(this,`ErrorOAuth2`)}code;description;uri;toString(){return`ErrorOAuth2`}},it=class extends j{static{w(this,`ErrorUnknown`)}toString(){return`ErrorUnknown`}},at=class extends j{static{w(this,`ErrorNoAuthCode`)}toString(){return`ErrorNoAuthCode`}},ot=class extends j{static{w(this,`ErrorInvalidReturnedStateParam`)}toString(){return`ErrorInvalidReturnedStateParam`}},st=class extends j{static{w(this,`ErrorInvalidJson`)}toString(){return`ErrorInvalidJson`}},ct=class extends j{static{w(this,`ErrorInvalidScope`)}toString(){return`ErrorInvalidScope`}},lt=class extends j{static{w(this,`ErrorInvalidRequest`)}toString(){return`ErrorInvalidRequest`}},ut=class extends j{static{w(this,`ErrorInvalidToken`)}toString(){return`ErrorInvalidToken`}},M=class extends j{static{w(this,`ErrorAuthenticationGrant`)}toString(){return`ErrorAuthenticationGrant`}},dt=class extends M{static{w(this,`ErrorUnauthorizedClient`)}toString(){return`ErrorUnauthorizedClient`}},ft=class extends M{static{w(this,`ErrorAccessDenied`)}toString(){return`ErrorAccessDenied`}},pt=class extends M{static{w(this,`ErrorUnsupportedResponseType`)}toString(){return`ErrorUnsupportedResponseType`}},mt=class extends M{static{w(this,`ErrorServerError`)}toString(){return`ErrorServerError`}},ht=class extends M{static{w(this,`ErrorTemporarilyUnavailable`)}toString(){return`ErrorTemporarilyUnavailable`}},gt=class extends j{static{w(this,`ErrorAccessTokenResponse`)}toString(){return`ErrorAccessTokenResponse`}},_t=class extends gt{static{w(this,`ErrorInvalidClient`)}toString(){return`ErrorInvalidClient`}},vt=class extends gt{static{w(this,`ErrorInvalidGrant`)}toString(){return`ErrorInvalidGrant`}},yt=class extends gt{static{w(this,`ErrorUnsupportedGrantType`)}toString(){return`ErrorUnsupportedGrantType`}};function bt(e,t,n){let r=`OAuth error: ${e}`;return t&&(r+=`
+`)),a+=o+n[t+1]}),a}w(nt,`dedent`);var rt=nt,j=class extends r{static{w(this,`ErrorOAuth2`)}code;description;uri;toString(){return`ErrorOAuth2`}},it=class extends j{static{w(this,`ErrorUnknown`)}toString(){return`ErrorUnknown`}},at=class extends j{static{w(this,`ErrorNoAuthCode`)}toString(){return`ErrorNoAuthCode`}},ot=class extends j{static{w(this,`ErrorInvalidReturnedStateParam`)}toString(){return`ErrorInvalidReturnedStateParam`}},st=class extends j{static{w(this,`ErrorInvalidJson`)}toString(){return`ErrorInvalidJson`}},ct=class extends j{static{w(this,`ErrorInvalidScope`)}toString(){return`ErrorInvalidScope`}},lt=class extends j{static{w(this,`ErrorInvalidRequest`)}toString(){return`ErrorInvalidRequest`}},ut=class extends j{static{w(this,`ErrorInvalidToken`)}toString(){return`ErrorInvalidToken`}},M=class extends j{static{w(this,`ErrorAuthenticationGrant`)}toString(){return`ErrorAuthenticationGrant`}},dt=class extends M{static{w(this,`ErrorUnauthorizedClient`)}toString(){return`ErrorUnauthorizedClient`}},ft=class extends M{static{w(this,`ErrorAccessDenied`)}toString(){return`ErrorAccessDenied`}},pt=class extends M{static{w(this,`ErrorUnsupportedResponseType`)}toString(){return`ErrorUnsupportedResponseType`}},mt=class extends M{static{w(this,`ErrorServerError`)}toString(){return`ErrorServerError`}},ht=class extends M{static{w(this,`ErrorTemporarilyUnavailable`)}toString(){return`ErrorTemporarilyUnavailable`}},gt=class extends j{static{w(this,`ErrorAccessTokenResponse`)}toString(){return`ErrorAccessTokenResponse`}},_t=class extends gt{static{w(this,`ErrorInvalidClient`)}toString(){return`ErrorInvalidClient`}},vt=class extends gt{static{w(this,`ErrorInvalidGrant`)}toString(){return`ErrorInvalidGrant`}},yt=class extends gt{static{w(this,`ErrorUnsupportedGrantType`)}toString(){return`ErrorUnsupportedGrantType`}};function bt(e,t,n){let r=`OAuth error: ${e}`;return t&&(r+=`
   ${t}`),n&&(r+=`
   See: ${n}`),r}w(bt,`formatOAuthErrorMessage`);function N(e,t,n){let r=bt(e,t,n),i;switch(e){case`invalid_request`:i=new lt(r,{telemetryMessage:`user oauth invalid request`});break;case`invalid_grant`:i=new vt(r,{telemetryMessage:`user oauth invalid grant`});break;case`unauthorized_client`:i=new dt(r,{telemetryMessage:`user oauth unauthorized client`});break;case`access_denied`:i=new ft(r,{telemetryMessage:`user oauth access denied`});break;case`unsupported_response_type`:i=new pt(r,{telemetryMessage:`user oauth unsupported response type`});break;case`invalid_scope`:i=new ct(r,{telemetryMessage:`user oauth invalid scope`});break;case`server_error`:i=new mt(r,{telemetryMessage:`user oauth server error`});break;case`temporarily_unavailable`:i=new ht(r,{telemetryMessage:`user oauth temporarily unavailable`});break;case`invalid_client`:i=new _t(r,{telemetryMessage:`user oauth invalid client`});break;case`unsupported_grant_type`:i=new yt(r,{telemetryMessage:`user oauth unsupported grant type`});break;case`invalid_json`:i=new st(r,{telemetryMessage:`user oauth invalid json`});break;case`invalid_token`:i=new ut(r,{telemetryMessage:`user oauth invalid token`});break;default:i=new it(r,{telemetryMessage:`user oauth unknown error`});break}return i.code=e,i.description=t,i.uri=n,i}w(N,`toErrorClass`);function xt(e,t,n){if(e.error)throw N(Array.isArray(e.error)?e.error[0]:e.error,Array.isArray(e.error_description)?e.error_description[0]:e.error_description,Array.isArray(e.error_uri)?e.error_uri[0]:e.error_uri);let r=e.code;if(!r)return!1;if(e.state!==t.stateQueryParam)throw n.warn(`Received query string parameter doesn't match the one sent! Possible malicious activity somewhere.`),new ot(``,{telemetryMessage:`user oauth invalid returned state`});return v(!Array.isArray(r)),t.authorizationCode=r,t.hasAuthCodeBeenExchangedForAccessToken=!1,!0}w(xt,`isReturningFromAuthServer`);async function St(e,t,n,r,i){let{codeChallenge:a,codeVerifier:o}=await Ie(),s=i.generateRandomState(Ne);return Object.assign(r,{codeChallenge:a,codeVerifier:o,stateQueryParam:s}),i.generateAuthUrl({authUrl:ge(),clientId:t,scopes:e,stateQueryParam:s,codeChallenge:a,redirectUri:n})}w(St,`getAuthURL`);async function Ct(e,t,n,r){let i=E({warningLogger:e,storage:r}).refreshToken;i||e.warn(`No refresh token is present.`);let a=await P(new URLSearchParams({grant_type:`refresh_token`,refresh_token:i?.value??``,client_id:n}),e,t);if(a.status>=400){let t;try{t=await F(a,e)}catch(t){e.error(t)}throw t===void 0?new it(`Failed to parse Error from exchangeRefreshTokenForAccessToken`,{telemetryMessage:`user oauth refresh token exchange parse error`}):typeof t==`string`?Error(t):t}else try{let t=await F(a,e);if(`error`in t)throw t.error;let{access_token:n,expires_in:r,refresh_token:o,scope:s}=t;return{token:{value:n,expiry:new Date(Date.now()+r*1e3).toISOString()},scopes:s?s.split(` `):[],refreshToken:o?{value:o}:i}}catch(e){throw typeof e==`string`?N(e):e}}w(Ct,`exchangeRefreshTokenForAccessToken`);async function wt(e,t,n,r,i){let{authorizationCode:a,codeVerifier:o=``}=e;o?a||t.warn(`No authorization grant code is being passed.`):t.warn(`No code verifier is being sent.`);let s=await P(new URLSearchParams({grant_type:`authorization_code`,code:a??``,redirect_uri:i,client_id:r,code_verifier:o}),t,n);if(!s.ok){let{error:e}=await F(s,t);throw e===`invalid_grant`&&t.log(`Expired! Auth code or refresh token needs to be renewed.`),N(e)}let c=await F(s,t);if(`error`in c)throw N(c.error);let{access_token:l,expires_in:u,refresh_token:d,scope:f}=c;return e.hasAuthCodeBeenExchangedForAccessToken=!0,{token:{value:l,expiry:new Date(Date.now()+u*1e3).toISOString()},scopes:f?f.split(` `):[],refreshToken:d?{value:d}:void 0}}w(wt,`exchangeAuthCodeForAccessToken`);async function P(e,t,n){let r={"Content-Type":`application/x-www-form-urlencoded`};if(t.debug(`fetching auth token`,`grant_type=${e.get(`grant_type`)??`<unknown>`}`),await Oe(D(),t)){t.debug(`Using Cloudflare Access to get an access token for the auth request`);let e=await je({logger:t,isNonInteractiveOrCI:n});Object.assign(r,e)}t.debug(`Fetching auth token from`,_e());try{let n=await(0,T.fetch)(_e(),{method:`POST`,body:e.toString(),headers:r});return n.ok||t.debug(`Failed to fetch auth token:`,n.status,n.statusText),n}catch(e){throw t.debug(`Failed to fetch auth token:`,e),e}}w(P,`fetchAuthToken`);async function F(e,t){let n=await e.text();try{return JSON.parse(n)}catch(r){throw n.match(/<!DOCTYPE html>/)&&(t.error(`The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response.`),n.match(/challenge-platform/)&&t.error(`It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${e.headers.get(`cf-ray`)}`)),t.debug(`Full body of response
 
-`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}w(F,`getJSONFromResponse`);async function Tt(e,t,n,r){let i=await St(e.scopes,e.clientId,e.redirectUri,t,r),a=new URL(e.redirectUri).pathname,s,c,l=new Promise((e,t)=>{c=setTimeout(()=>{s.close(),clearTimeout(c),t(new o(`Timed out waiting for authorization code, please try again.`,{telemetryMessage:`user oauth authorization timeout`}))},12e4)}),u=new Promise((r,i)=>{s=ne.createServer(async(l,u)=>{function d(e,t){clearTimeout(c),u.writableEnded||u.end(),s.close(n=>{t||n?i(t||n):(v(e),r(e))})}w(d,`finish`);function f(e){let t=w(e=>e.replace(/[&<>"']/g,e=>({"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&#39;`})[e]),`escape`),n=`<!doctype html>
+`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}w(F,`getJSONFromResponse`);async function Tt(e,t,n,i){let a=await St(e.scopes,e.clientId,e.redirectUri,t,i),o=new URL(e.redirectUri).pathname,s,c,l=new Promise((e,t)=>{c=setTimeout(()=>{s.close(),clearTimeout(c),t(new r(`Timed out waiting for authorization code, please try again.`,{telemetryMessage:`user oauth authorization timeout`}))},12e4)}),u=new Promise((i,a)=>{s=ne.createServer(async(l,u)=>{function d(e,t){clearTimeout(c),u.writableEnded||u.end(),s.close(n=>{t||n?a(t||n):(v(e),i(e))})}w(d,`finish`);function f(e){let t=w(e=>e.replace(/[&<>"']/g,e=>({"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&#39;`})[e]),`escape`),n=`<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8" />
@@ -33,28 +33,28 @@ Expected an \`https\` URL on \`${t.authDomain}\`. Refusing to display or open it
   ${e.description?`<p class="detail">${t(e.description)}</p>`:``}
   <p>You can close this tab and return to your terminal for more details.</p>
 </body>
-</html>`;u.writeHead(400,{"Content-Type":`text/html; charset=utf-8`}),u.end(n)}w(f,`renderErrorPage`),v(l.url,`This request doesn't have a URL`);let{pathname:p,query:m}=te.parse(l.url,!0);if(l.method!==`GET`)return u.end(`OK`);switch(p){case a:{let r=!1;try{r=xt(m,t,n.logger)}catch(t){if(t instanceof ft){u.writeHead(307,{Location:e.denied.url}),u.end(()=>{d(null,new o(e.denied.error,{telemetryMessage:`user oauth consent denied`}))});return}let n=t;f({code:n.code,description:n.description??n.message}),d(null,n);return}if(!r){let e=`The Cloudflare OAuth provider did not return an authorisation code.`;f({description:e}),d(null,new at(e,{telemetryMessage:`user oauth missing auth code`}));return}try{let r=await wt(t,n.logger,n.isNonInteractiveOrCI,e.clientId,e.redirectUri);u.writeHead(307,{Location:e.granted.url}),u.end(()=>{d(r)})}catch(e){let t=e,n=t instanceof j;f({code:n?t.code:void 0,description:(n?t.description:void 0)??t.message??`Failed to exchange the authorisation code for an access token.`}),d(null,t)}return}}});let l=new URL(e.redirectUri),u=Number(l.port||(l.protocol===`https:`?443:80));(l.hostname!==e.callbackHost||u!==e.callbackPort)&&(n.logger.log(`Temporary login server listening on ${e.callbackHost}:${e.callbackPort}`),n.logger.log(`Note that the OAuth login page will always redirect to \`${e.redirectUri}\`.
-If you have changed the callback host or port because you are running in a container, then ensure that you have port forwarding set up correctly.`)),s.once(`error`,t=>{clearTimeout(c),t.code===`EADDRINUSE`?i(new o(`The OAuth callback server could not bind to ${e.callbackHost}:${e.callbackPort} because the port is already in use. Stop the process using that port or pass a different \`--callback-port\`.`,{telemetryMessage:`user oauth callback port in use`})):i(t)}),s.listen(e.callbackPort,e.callbackHost)});return e.browser?(n.logger.log(`Opening a link in your default browser: ${i}`),await n.openInBrowser(i)):n.logger.log(`Visit this link to authenticate: ${i}`),Promise.race([l,u])}w(Tt,`getOauthToken`);var Et=300,Dt=1;function I(e,t){if(typeof e!=`object`||!e)return;let n=e[t];return typeof n==`string`&&n!==``?n:void 0}w(I,`getStringMember`);function L(e,t){if(typeof e!=`object`||!e)return;let n=e[t];return typeof n==`number`&&Number.isFinite(n)&&n>0?n:void 0}w(L,`getPositiveNumberMember`);function Ot(e,t){let n=`HTTP ${e.status} ${e.statusText}`.trim(),r=I(t,`error_description`);return r?`${n}: ${r}`:n}w(Ot,`describeUnusableResponse`);function kt(e){return e>=500||e===429}w(kt,`isRetryableStatus`);function At(e){let t=I(e,`device_code`),n=I(e,`user_code`),r=I(e,`verification_uri`),i=L(e,`expires_in`);if(!(!t||!n||!r||i===void 0))return{device_code:t,user_code:n,verification_uri:r,verification_uri_complete:I(e,`verification_uri_complete`),expires_in:i,interval:L(e,`interval`)}}w(At,`asDeviceAuthorizationResponse`);async function R(e,t){let n=await e.text();try{return JSON.parse(n)}catch(r){throw n.match(/<!DOCTYPE html>/)&&(t.debug(`The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response.`),n.match(/challenge-platform/)&&t.debug(`It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${e.headers.get(`cf-ray`)}`)),t.debug(`Full body of response
+</html>`;u.writeHead(400,{"Content-Type":`text/html; charset=utf-8`}),u.end(n)}w(f,`renderErrorPage`),v(l.url,`This request doesn't have a URL`);let{pathname:p,query:m}=te.parse(l.url,!0);if(l.method!==`GET`)return u.end(`OK`);switch(p){case o:{let i=!1;try{i=xt(m,t,n.logger)}catch(t){if(t instanceof ft){u.writeHead(307,{Location:e.denied.url}),u.end(()=>{d(null,new r(e.denied.error,{telemetryMessage:`user oauth consent denied`}))});return}let n=t;f({code:n.code,description:n.description??n.message}),d(null,n);return}if(!i){let e=`The Cloudflare OAuth provider did not return an authorisation code.`;f({description:e}),d(null,new at(e,{telemetryMessage:`user oauth missing auth code`}));return}try{let r=await wt(t,n.logger,n.isNonInteractiveOrCI,e.clientId,e.redirectUri);u.writeHead(307,{Location:e.granted.url}),u.end(()=>{d(r)})}catch(e){let t=e,n=t instanceof j;f({code:n?t.code:void 0,description:(n?t.description:void 0)??t.message??`Failed to exchange the authorisation code for an access token.`}),d(null,t)}return}}});let l=new URL(e.redirectUri),u=Number(l.port||(l.protocol===`https:`?443:80));(l.hostname!==e.callbackHost||u!==e.callbackPort)&&(n.logger.log(`Temporary login server listening on ${e.callbackHost}:${e.callbackPort}`),n.logger.log(`Note that the OAuth login page will always redirect to \`${e.redirectUri}\`.
+If you have changed the callback host or port because you are running in a container, then ensure that you have port forwarding set up correctly.`)),s.once(`error`,t=>{clearTimeout(c),t.code===`EADDRINUSE`?a(new r(`The OAuth callback server could not bind to ${e.callbackHost}:${e.callbackPort} because the port is already in use. Stop the process using that port or pass a different \`--callback-port\`.`,{telemetryMessage:`user oauth callback port in use`})):a(t)}),s.listen(e.callbackPort,e.callbackHost)});return e.browser?(n.logger.log(`Opening a link in your default browser: ${a}`),await n.openInBrowser(a)):n.logger.log(`Visit this link to authenticate: ${a}`),Promise.race([l,u])}w(Tt,`getOauthToken`);var Et=300,Dt=1;function I(e,t){if(typeof e!=`object`||!e)return;let n=e[t];return typeof n==`string`&&n!==``?n:void 0}w(I,`getStringMember`);function L(e,t){if(typeof e!=`object`||!e)return;let n=e[t];return typeof n==`number`&&Number.isFinite(n)&&n>0?n:void 0}w(L,`getPositiveNumberMember`);function Ot(e,t){let n=`HTTP ${e.status} ${e.statusText}`.trim(),r=I(t,`error_description`);return r?`${n}: ${r}`:n}w(Ot,`describeUnusableResponse`);function kt(e){return e>=500||e===429}w(kt,`isRetryableStatus`);function At(e){let t=I(e,`device_code`),n=I(e,`user_code`),r=I(e,`verification_uri`),i=L(e,`expires_in`);if(!(!t||!n||!r||i===void 0))return{device_code:t,user_code:n,verification_uri:r,verification_uri_complete:I(e,`verification_uri_complete`),expires_in:i,interval:L(e,`interval`)}}w(At,`asDeviceAuthorizationResponse`);async function R(e,t){let n=await e.text();try{return JSON.parse(n)}catch(r){throw n.match(/<!DOCTYPE html>/)&&(t.debug(`The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response.`),n.match(/challenge-platform/)&&t.debug(`It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${e.headers.get(`cf-ray`)}`)),t.debug(`Full body of response
 
-`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}w(R,`readJson`);async function jt(e,t){let n={"Content-Type":`application/x-www-form-urlencoded`};return await Oe(D(),e)&&(e.debug(`Using Cloudflare Access to get an access token for the device authorization request`),Object.assign(n,await je({logger:e,isNonInteractiveOrCI:t}))),n}w(jt,`buildDeviceAuthHeaders`);async function Mt(e,t,n,r){let i=new URLSearchParams({client_id:t,scope:[...e,`offline_access`].join(` `)}),a=await jt(n,r),s=Se();n.debug(`Fetching device authorization from`,s);let c=await(0,T.fetch)(s,{method:`POST`,body:i.toString(),headers:a});if(!c.ok){let e=await R(c,n).catch(()=>void 0);throw N(e&&typeof e==`object`&&`error`in e?String(e.error):`HTTP ${c.status} ${c.statusText}`)}let l=await R(c,n),u=At(l);if(u===void 0)throw n.debug(`Unusable device authorization response body:`,l),new o(`The device authorization endpoint returned a response that could not be interpreted (${Ot(c,l)}).
-Enable debug logging to see the full response.`,{telemetryMessage:`user device-flow unusable device authorization response`});return u}w(Mt,`requestDeviceAuthorization`);async function Nt(e,t,n,r){let i=await P(new URLSearchParams({grant_type:`urn:ietf:params:oauth:grant-type:device_code`,device_code:e,client_id:t}),n,r),a=await R(i,n),o=I(a,`error`);if(o!==void 0)return{kind:`oauth-error`,error:o};let s=I(a,`access_token`),c=L(a,`expires_in`);return!i.ok||s===void 0||c===void 0?(n.debug(`Unusable token response body:`,a),{kind:`unexpected`,detail:Ot(i,a),retryable:!i.ok&&kt(i.status)}):{kind:`token`,grant:{access_token:s,expires_in:c,refresh_token:I(a,`refresh_token`),scope:I(a,`scope`)}}}w(Nt,`pollDeviceToken`);function Pt(e){return new Promise(t=>setTimeout(t,e*1e3))}w(Pt,`sleep`);async function Ft(e,t){let{logger:n,openInBrowser:r,isNonInteractiveOrCI:i}=t,a=await Mt(e.scopes,e.clientId,n,i),s=D();ze(a.verification_uri,{field:`verification_uri`,authDomain:s}),a.verification_uri_complete!==void 0&&ze(a.verification_uri_complete,{field:`verification_uri_complete`,authDomain:s});let c=a.verification_uri_complete??Le({verificationUri:a.verification_uri,userCode:a.user_code}),l=Math.min(a.expires_in,Et);n.log(rt`
+`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}w(R,`readJson`);async function jt(e,t){let n={"Content-Type":`application/x-www-form-urlencoded`};return await Oe(D(),e)&&(e.debug(`Using Cloudflare Access to get an access token for the device authorization request`),Object.assign(n,await je({logger:e,isNonInteractiveOrCI:t}))),n}w(jt,`buildDeviceAuthHeaders`);async function Mt(e,t,n,i){let a=new URLSearchParams({client_id:t,scope:[...e,`offline_access`].join(` `)}),o=await jt(n,i),s=Se();n.debug(`Fetching device authorization from`,s);let c=await(0,T.fetch)(s,{method:`POST`,body:a.toString(),headers:o});if(!c.ok){let e=await R(c,n).catch(()=>void 0);throw N(e&&typeof e==`object`&&`error`in e?String(e.error):`HTTP ${c.status} ${c.statusText}`)}let l=await R(c,n),u=At(l);if(u===void 0)throw n.debug(`Unusable device authorization response body:`,l),new r(`The device authorization endpoint returned a response that could not be interpreted (${Ot(c,l)}).
+Enable debug logging to see the full response.`,{telemetryMessage:`user device-flow unusable device authorization response`});return u}w(Mt,`requestDeviceAuthorization`);async function Nt(e,t,n,r){let i=await P(new URLSearchParams({grant_type:`urn:ietf:params:oauth:grant-type:device_code`,device_code:e,client_id:t}),n,r),a=await R(i,n),o=I(a,`error`);if(o!==void 0)return{kind:`oauth-error`,error:o};let s=I(a,`access_token`),c=L(a,`expires_in`);return!i.ok||s===void 0||c===void 0?(n.debug(`Unusable token response body:`,a),{kind:`unexpected`,detail:Ot(i,a),retryable:!i.ok&&kt(i.status)}):{kind:`token`,grant:{access_token:s,expires_in:c,refresh_token:I(a,`refresh_token`),scope:I(a,`scope`)}}}w(Nt,`pollDeviceToken`);function Pt(e){return new Promise(t=>setTimeout(t,e*1e3))}w(Pt,`sleep`);async function Ft(e,t){let{logger:n,openInBrowser:i,isNonInteractiveOrCI:a}=t,o=await Mt(e.scopes,e.clientId,n,a),s=D();ze(o.verification_uri,{field:`verification_uri`,authDomain:s}),o.verification_uri_complete!==void 0&&ze(o.verification_uri_complete,{field:`verification_uri_complete`,authDomain:s});let c=o.verification_uri_complete??Le({verificationUri:o.verification_uri,userCode:o.user_code}),l=Math.min(o.expires_in,Et);n.log(rt`
 		To authorize ${t.displayName}, please visit:
 
-		  ${a.verification_uri}
+		  ${o.verification_uri}
 
 		and enter the code:
 
-		  ${a.user_code}
+		  ${o.user_code}
 
 		You have ${It(l)} to approve this request.
 	`),e.browser&&(n.log(`
-Opening a link in your default browser: ${c}`),await r(c));let u=Date.now()+l*1e3,d=Math.max(a.interval??Dt,Dt),f=!0,p;for(;Date.now()<u;){f||await Pt(d),f=!1;let r;try{r=await Nt(a.device_code,e.clientId,n,i)}catch(e){n.debug(`Ignoring transient error while polling for token:`,e),p=e instanceof Error?e.message:String(e);continue}if(r.kind===`unexpected`){if(!r.retryable)throw new o(`The token endpoint returned a response that could not be interpreted (${r.detail}).
-Enable debug logging to see the full response.`,{telemetryMessage:`user device-flow unusable token response`});n.debug(`Ignoring transient response while polling for token:`,r.detail),p=r.detail;continue}if(p=void 0,r.kind===`oauth-error`)switch(r.error){case`authorization_pending`:continue;case`slow_down`:d+=5;continue;case`access_denied`:throw new o(`Consent denied. You must grant consent to ${t.displayName} in order to login.
-If you don't want to do this consider passing an API token via the \`CLOUDFLARE_API_TOKEN\` environment variable.`,{telemetryMessage:`user device-flow consent denied`});case`expired_token`:throw new o(`Device code expired before the request was approved. Please run \`${t.deviceLoginCommand}\` again to obtain a new code.`,{telemetryMessage:`user device-flow code expired`});default:throw N(r.error)}let{grant:s}=r;return{token:{value:s.access_token,expiry:new Date(Date.now()+s.expires_in*1e3).toISOString()},scopes:s.scope?s.scope.split(` `):[],refreshToken:s.refresh_token?{value:s.refresh_token}:void 0}}throw p===void 0?new o(`Device authorization timed out after ${It(l)}. Please run \`${t.deviceLoginCommand}\` again to obtain a new code.`,{telemetryMessage:`user device-flow authorization timeout`}):new o(`Gave up waiting for device authorization: the token endpoint kept returning responses that could not be interpreted (last: ${p}).
-Enable debug logging to see the full response, then run \`${t.deviceLoginCommand}\` to try again.`,{telemetryMessage:`user device-flow poll failed`})}w(Ft,`getOauthTokenViaDeviceFlow`);function It(e){if(e<60)return`${e} seconds`;let t=Math.floor(e/60),n=t===1?`minute`:`minutes`,r=e%60;return r===0?`${t} ${n}`:r==59?`${t+1} ${n}`:`${t} ${n} and ${r} ${r===1?`second`:`seconds`}`}w(It,`toHumanPeriod`);function Lt(e){let n={},r={generateAuthUrl:e.generateAuthUrl??Be,generateRandomState:e.generateRandomState??Ve},i=`default`;function a(t){return e.storageFactory(t??i)}w(a,`getStorage`);let s=w(()=>typeof e.clientId==`function`?e.clientId():e.clientId,`getClientId`),c=e.consent,l=!1,u,d=new URL(e.redirectUri),f=d.hostname,p=Number(d.port);async function m(i){if(e.hasEnvCredentials())return e.logger.error(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth.`),!1;let l=t(i.complianceConfig);if(l===`fedramp_high`)throw new o(rt`
-				OAuth login is not supported in the \`${l}\` compliance region.
+Opening a link in your default browser: ${c}`),await i(c));let u=Date.now()+l*1e3,d=Math.max(o.interval??Dt,Dt),f=!0,p;for(;Date.now()<u;){f||await Pt(d),f=!1;let i;try{i=await Nt(o.device_code,e.clientId,n,a)}catch(e){n.debug(`Ignoring transient error while polling for token:`,e),p=e instanceof Error?e.message:String(e);continue}if(i.kind===`unexpected`){if(!i.retryable)throw new r(`The token endpoint returned a response that could not be interpreted (${i.detail}).
+Enable debug logging to see the full response.`,{telemetryMessage:`user device-flow unusable token response`});n.debug(`Ignoring transient response while polling for token:`,i.detail),p=i.detail;continue}if(p=void 0,i.kind===`oauth-error`)switch(i.error){case`authorization_pending`:continue;case`slow_down`:d+=5;continue;case`access_denied`:throw new r(`Consent denied. You must grant consent to ${t.displayName} in order to login.
+If you don't want to do this consider passing an API token via the \`CLOUDFLARE_API_TOKEN\` environment variable.`,{telemetryMessage:`user device-flow consent denied`});case`expired_token`:throw new r(`Device code expired before the request was approved. Please run \`${t.deviceLoginCommand}\` again to obtain a new code.`,{telemetryMessage:`user device-flow code expired`});default:throw N(i.error)}let{grant:s}=i;return{token:{value:s.access_token,expiry:new Date(Date.now()+s.expires_in*1e3).toISOString()},scopes:s.scope?s.scope.split(` `):[],refreshToken:s.refresh_token?{value:s.refresh_token}:void 0}}throw p===void 0?new r(`Device authorization timed out after ${It(l)}. Please run \`${t.deviceLoginCommand}\` again to obtain a new code.`,{telemetryMessage:`user device-flow authorization timeout`}):new r(`Gave up waiting for device authorization: the token endpoint kept returning responses that could not be interpreted (last: ${p}).
+Enable debug logging to see the full response, then run \`${t.deviceLoginCommand}\` to try again.`,{telemetryMessage:`user device-flow poll failed`})}w(Ft,`getOauthTokenViaDeviceFlow`);function It(e){if(e<60)return`${e} seconds`;let t=Math.floor(e/60),n=t===1?`minute`:`minutes`,r=e%60;return r===0?`${t} ${n}`:r==59?`${t+1} ${n}`:`${t} ${n} and ${r} ${r===1?`second`:`seconds`}`}w(It,`toHumanPeriod`);function Lt(e){let t={},n={generateAuthUrl:e.generateAuthUrl??Be,generateRandomState:e.generateRandomState??Ve},i=`default`;function a(t){return e.storageFactory(t??i)}w(a,`getStorage`);let o=w(()=>typeof e.clientId==`function`?e.clientId():e.clientId,`getClientId`),s=e.consent,c=!1,u,d=new URL(e.redirectUri),f=d.hostname,p=Number(d.port);async function m(i){if(e.hasEnvCredentials())return e.logger.error(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth.`),!1;let c=l(i.complianceConfig);if(c===`fedramp_high`)throw new r(rt`
+				OAuth login is not supported in the \`${c}\` compliance region.
 				Please use a Cloudflare API token (\`CLOUDFLARE_API_TOKEN\` environment variable) or remove the ${i.complianceConfig?.compliance_region?"`compliance_region` configuration property":"`CLOUDFLARE_API_ENVIRONMENT` environment variable"}.
-			`,{telemetryMessage:`user login unsupported compliance region`});let u;return i.device?(e.logger.log(`Attempting to login via OAuth Device Authorization Grant...`),u=await Ft({browser:i.browser??!0,scopes:i.scopes,clientId:s()},e)):(e.logger.log(`Attempting to login via OAuth...`),u=await Tt({browser:i.browser??!0,scopes:i.scopes,clientId:s(),redirectUri:e.redirectUri,denied:c.denied,granted:c.granted,callbackHost:i.callbackHost??f,callbackPort:i.callbackPort??p},n,e,r)),a(i.profile).write({oauth_token:u.token?.value??``,expiration_time:u.token?.expiry,refresh_token:u.refreshToken?.value,scopes:u.scopes}),e.logger.log(`Successfully logged in.`),x(),e.purgeOnLoginOrLogout?.(),!0}w(m,`login`);function h(t){if(e.hasEnvCredentials())return!1;let{accessToken:n}=E({warningLogger:e.logger,storage:a(t)});return!!(n&&new Date>=new Date(n.expiry))}w(h,`isRefreshNeeded`);async function g(t){let n=a(t);try{let{token:{value:t,expiry:r}={value:``,expiry:``},refreshToken:{value:i}={},scopes:a}=await Ct(e.logger,e.isNonInteractiveOrCI,s(),n);return n.write({oauth_token:t,expiration_time:r,refresh_token:i,scopes:a}),!0}catch(t){return e.logger.debug(`Token refresh failed: ${t instanceof Error?t.message:String(t)}`),!1}}w(g,`refreshToken`);async function _(t){if(e.hasEnvCredentials())return{loggedIn:!0};let n=E({warningLogger:e.logger,storage:a(t.profile)});return!n.accessToken&&!n.deprecatedApiToken?e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`no-credentials-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`no-credentials-login-failed`}:h(t.profile)?await g(t.profile)?{loggedIn:!0}:e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`token-expired-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`token-expired-login-failed`}:{loggedIn:!0}}w(_,`loginOrRefreshIfRequired`);async function v(t){let n=x();if(e.hasEnvCredentials()){e.logger.log(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log out.`);return}let r=E({warningLogger:e.logger,storage:a(t)}).refreshToken;if(!r){e.logger.log(n?`Cleared temporary preview account.`:`Not logged in, exiting...`);return}let i=`client_id=${encodeURIComponent(s())}&token_type_hint=refresh_token&token=${encodeURIComponent(r.value||``)}`;await(await(0,T.fetch)(ve(),{method:`POST`,body:i,headers:{"Content-Type":`application/x-www-form-urlencoded`}})).text(),a(t).clear(),e.logger.log(`Successfully logged out.`),e.purgeOnLoginOrLogout?.()}w(v,`logout`);async function ee(){let t=E({warningLogger:e.logger,storage:a()});if(t.accessToken){if(t.accessToken&&new Date>=new Date(t.accessToken.expiry)){if(!await g())return;t=E({warningLogger:e.logger,storage:a()})}return t.accessToken?.value}}w(ee,`getOAuthTokenFromLocalState`);function y(){return u?{apiToken:u.account.apiToken}:fe({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}w(y,`getAPITokenInternal`);function te(){return u?{apiToken:u.account.apiToken}:pe({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}w(te,`requireApiTokenInternal`);function ne(t){l=t&&e.temporary!==void 0,u=void 0}w(ne,`setTemporaryAllowed`);function re(){return l}w(re,`isTemporaryAllowed`);function ie(){return u}w(ie,`getActiveTemporaryAccount`);async function b(){if(!e.temporary)throw new o(`Temporary preview accounts are not supported by this CLI.`,{telemetryMessage:`user temporary account unsupported`});let t=await tt({...e.temporary,logger:e.logger});return u=t.account,t}w(b,`activateTemporaryAccount`);function x(){return u=void 0,e.temporary?.storage.clear()??!1}w(x,`clearTemporaryAccount`);function S(e){i=e}w(S,`setProfile`);function ae(){return i}w(ae,`getActiveProfile`);function C(){return E({warningLogger:e.logger,storage:a()}).scopes}return w(C,`getScopes`),{setProfile:S,getActiveProfile:ae,login:m,logout:v,loginOrRefreshIfRequired:_,getOAuthTokenFromLocalState:ee,getAPIToken:y,requireApiToken:te,getScopes:C,setTemporaryAllowed:ne,isTemporaryAllowed:re,getActiveTemporaryAccount:ie,activateTemporaryAccount:b}}w(Lt,`createOAuthFlow`);var Rt=[`default`,`staging`];function zt(e){let t={read(){return e.bindings.read()},write(t){e.bindings.write(t)},activate(t,n){let r=y.resolve(n),i=e.bindings.read();i[r]=t,e.bindings.write(i)},deactivate(t){let n=y.resolve(t),r=e.bindings.read(),i=r[n];if(i===void 0){let e=Bt(n,r);throw e?new o(`No profile is directly bound to "${B(n)}". The active profile "${e.profile}" is bound at "${B(e.dir)}". Run the deactivate command from that directory instead.`,{telemetryMessage:`auth deactivate wrong directory`}):new o(`No profile is bound to "${B(n)}". Nothing to deactivate.`,{telemetryMessage:`auth deactivate no binding`})}delete r[n],e.bindings.write(r);let a=Bt(n,r);return a?{removedProfile:i,newResolution:{profile:a.profile,source:`inherited from ${a.dir}`}}:e.configs.exists(`default`)?{removedProfile:i,newResolution:{profile:`default`,source:`default profile`}}:{removedProfile:i,newResolution:{profile:void 0,source:`no profile`}}},getProfileForDirectory(t){return Bt(t,e.bindings.read())?.profile},getBindingsForProfile(t){return Object.entries(e.bindings.read()).filter(([,e])=>e===t).map(([e])=>e)},removeAllBindingsForProfile(t){let n=e.bindings.read(),r=[];for(let[e,i]of Object.entries(n))i===t&&(r.push(e),delete n[e]);return r.length>0&&e.bindings.write(n),r}};return{configs:e.configs,bindings:t,resolve(e){return e.profile?e.profile===`default`?`default`:(z(e.profile),e.profile):t.getProfileForDirectory(e.cwd)||`default`}}}w(zt,`createProfileStore`);function z(e){if(Rt.includes(e.toLowerCase()))throw new o(`"${e}" is a reserved profile name. Use the login and logout commands to manage the default profile, which applies as a global fallback.`,{telemetryMessage:`auth profile reserved name`});if(!/^[a-zA-Z0-9_-]+$/.test(e))throw new o(`Invalid profile name "${e}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`auth profile invalid name`})}w(z,`validateProfileName`);function B(e){return y.relative(process.cwd(),e)||`.`}w(B,`formatDirectoryForUserError`);function Bt(e,t){let n=y.resolve(e),r=Object.entries(t).sort(([e],[t])=>t.length-e.length);for(let[e,t]of r)if(n===e||n.startsWith(e)&&n[e.length]===y.sep)return{profile:t,dir:e}}w(Bt,`getProfileForDirectoryFromBindings`);function Vt(e,t){let n=e.slice(0,t).split(/\r\n|\n|\r/g);return[n.length,n.pop().length+1]}w(Vt,`getLineColFromPtr`);function Ht(e,t,n){let r=e.split(/\r\n|\n|\r/g),i=``,a=(Math.log10(t+1)|0)+1;for(let e=t-1;e<=t+1;e++){let o=r[e-1];o&&(i+=e.toString().padEnd(a,` `),i+=`:  `,i+=o,i+=`
+			`,{telemetryMessage:`user login unsupported compliance region`});let u;return i.device?(e.logger.log(`Attempting to login via OAuth Device Authorization Grant...`),u=await Ft({browser:i.browser??!0,scopes:i.scopes,clientId:o()},e)):(e.logger.log(`Attempting to login via OAuth...`),u=await Tt({browser:i.browser??!0,scopes:i.scopes,clientId:o(),redirectUri:e.redirectUri,denied:s.denied,granted:s.granted,callbackHost:i.callbackHost??f,callbackPort:i.callbackPort??p},t,e,n)),a(i.profile).write({oauth_token:u.token?.value??``,expiration_time:u.token?.expiry,refresh_token:u.refreshToken?.value,scopes:u.scopes}),e.logger.log(`Successfully logged in.`),x(),e.purgeOnLoginOrLogout?.(),!0}w(m,`login`);function h(t){if(e.hasEnvCredentials())return!1;let{accessToken:n}=E({warningLogger:e.logger,storage:a(t)});return!!(n&&new Date>=new Date(n.expiry))}w(h,`isRefreshNeeded`);async function g(t){let n=a(t);try{let{token:{value:t,expiry:r}={value:``,expiry:``},refreshToken:{value:i}={},scopes:a}=await Ct(e.logger,e.isNonInteractiveOrCI,o(),n);return n.write({oauth_token:t,expiration_time:r,refresh_token:i,scopes:a}),!0}catch(t){return e.logger.debug(`Token refresh failed: ${t instanceof Error?t.message:String(t)}`),!1}}w(g,`refreshToken`);async function _(t){if(e.hasEnvCredentials())return{loggedIn:!0};let n=E({warningLogger:e.logger,storage:a(t.profile)});return!n.accessToken&&!n.deprecatedApiToken?e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`no-credentials-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`no-credentials-login-failed`}:h(t.profile)?await g(t.profile)?{loggedIn:!0}:e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`token-expired-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`token-expired-login-failed`}:{loggedIn:!0}}w(_,`loginOrRefreshIfRequired`);async function v(t){let n=x();if(e.hasEnvCredentials()){e.logger.log(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log out.`);return}let r=E({warningLogger:e.logger,storage:a(t)}).refreshToken;if(!r){e.logger.log(n?`Cleared temporary preview account.`:`Not logged in, exiting...`);return}let i=`client_id=${encodeURIComponent(o())}&token_type_hint=refresh_token&token=${encodeURIComponent(r.value||``)}`;await(await(0,T.fetch)(ve(),{method:`POST`,body:i,headers:{"Content-Type":`application/x-www-form-urlencoded`}})).text(),a(t).clear(),e.logger.log(`Successfully logged out.`),e.purgeOnLoginOrLogout?.()}w(v,`logout`);async function ee(){let t=E({warningLogger:e.logger,storage:a()});if(t.accessToken){if(t.accessToken&&new Date>=new Date(t.accessToken.expiry)){if(!await g())return;t=E({warningLogger:e.logger,storage:a()})}return t.accessToken?.value}}w(ee,`getOAuthTokenFromLocalState`);function y(){return u?{apiToken:u.account.apiToken}:fe({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}w(y,`getAPITokenInternal`);function te(){return u?{apiToken:u.account.apiToken}:pe({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}w(te,`requireApiTokenInternal`);function ne(t){c=t&&e.temporary!==void 0,u=void 0}w(ne,`setTemporaryAllowed`);function re(){return c}w(re,`isTemporaryAllowed`);function ie(){return u}w(ie,`getActiveTemporaryAccount`);async function b(){if(!e.temporary)throw new r(`Temporary preview accounts are not supported by this CLI.`,{telemetryMessage:`user temporary account unsupported`});let t=await tt({...e.temporary,logger:e.logger});return u=t.account,t}w(b,`activateTemporaryAccount`);function x(){return u=void 0,e.temporary?.storage.clear()??!1}w(x,`clearTemporaryAccount`);function S(e){i=e}w(S,`setProfile`);function ae(){return i}w(ae,`getActiveProfile`);function C(){return E({warningLogger:e.logger,storage:a()}).scopes}return w(C,`getScopes`),{setProfile:S,getActiveProfile:ae,login:m,logout:v,loginOrRefreshIfRequired:_,getOAuthTokenFromLocalState:ee,getAPIToken:y,requireApiToken:te,getScopes:C,setTemporaryAllowed:ne,isTemporaryAllowed:re,getActiveTemporaryAccount:ie,activateTemporaryAccount:b}}w(Lt,`createOAuthFlow`);var Rt=[`default`,`staging`];function zt(e){let t={read(){return e.bindings.read()},write(t){e.bindings.write(t)},activate(t,n){let r=y.resolve(n),i=e.bindings.read();i[r]=t,e.bindings.write(i)},deactivate(t){let n=y.resolve(t),i=e.bindings.read(),a=i[n];if(a===void 0){let e=Bt(n,i);throw e?new r(`No profile is directly bound to "${B(n)}". The active profile "${e.profile}" is bound at "${B(e.dir)}". Run the deactivate command from that directory instead.`,{telemetryMessage:`auth deactivate wrong directory`}):new r(`No profile is bound to "${B(n)}". Nothing to deactivate.`,{telemetryMessage:`auth deactivate no binding`})}delete i[n],e.bindings.write(i);let o=Bt(n,i);return o?{removedProfile:a,newResolution:{profile:o.profile,source:`inherited from ${o.dir}`}}:e.configs.exists(`default`)?{removedProfile:a,newResolution:{profile:`default`,source:`default profile`}}:{removedProfile:a,newResolution:{profile:void 0,source:`no profile`}}},getProfileForDirectory(t){return Bt(t,e.bindings.read())?.profile},getBindingsForProfile(t){return Object.entries(e.bindings.read()).filter(([,e])=>e===t).map(([e])=>e)},removeAllBindingsForProfile(t){let n=e.bindings.read(),r=[];for(let[e,i]of Object.entries(n))i===t&&(r.push(e),delete n[e]);return r.length>0&&e.bindings.write(n),r}};return{configs:e.configs,bindings:t,resolve(e){return e.profile?e.profile===`default`?`default`:(z(e.profile),e.profile):t.getProfileForDirectory(e.cwd)||`default`}}}w(zt,`createProfileStore`);function z(e){if(Rt.includes(e.toLowerCase()))throw new r(`"${e}" is a reserved profile name. Use the login and logout commands to manage the default profile, which applies as a global fallback.`,{telemetryMessage:`auth profile reserved name`});if(!/^[a-zA-Z0-9_-]+$/.test(e))throw new r(`Invalid profile name "${e}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`auth profile invalid name`})}w(z,`validateProfileName`);function B(e){return y.relative(process.cwd(),e)||`.`}w(B,`formatDirectoryForUserError`);function Bt(e,t){let n=y.resolve(e),r=Object.entries(t).sort(([e],[t])=>t.length-e.length);for(let[e,t]of r)if(n===e||n.startsWith(e)&&n[e.length]===y.sep)return{profile:t,dir:e}}w(Bt,`getProfileForDirectoryFromBindings`);function Vt(e,t){let n=e.slice(0,t).split(/\r\n|\n|\r/g);return[n.length,n.pop().length+1]}w(Vt,`getLineColFromPtr`);function Ht(e,t,n){let r=e.split(/\r\n|\n|\r/g),i=``,a=(Math.log10(t+1)|0)+1;for(let e=t-1;e<=t+1;e++){let o=r[e-1];o&&(i+=e.toString().padEnd(a,` `),i+=`:  `,i+=o,i+=`
 `,e===t&&(i+=` `.repeat(a+n+2),i+=`^
 `))}return i}w(Ht,`makeCodeBlock`);var V=class extends Error{static{w(this,`TomlError`)}line;column;codeblock;constructor(e,t){let[n,r]=Vt(t.toml,t.ptr),i=Ht(t.toml,n,r);super(`Invalid TOML document: ${e}
 
@@ -85,24 +85,24 @@ ${i}`,t),this.line=n,this.column=r,this.codeblock=i}};function Ut(e,t){let n=0;f
 ${a}`:`[${e}]`),a&&o?`${a}
 ${o}`:a||o}w(vn,`stringifyTable`);function yn(e,{maxDepth:t=1e3,numbersAsFloat:n=!1}={}){if(W(e)!==`object`)throw TypeError(`stringify can only be called with an object`);let r=vn(0,e,``,t,n);return r[r.length-1]===`
 `?r:r+`
-`}w(yn,`stringify`);var bn={parse:un,stringify:yn,TomlDate:Jt,TomlError:V},xn={toml:{parse:w(e=>u(e),`parse`),stringify:w(e=>bn.stringify(e),`stringify`)},json:{parse:w(e=>JSON.parse(e),`parse`),stringify:w(e=>JSON.stringify(e,null,`	`),`stringify`)}};function G(e,t){return xn[e].parse(t)}w(G,`parseFile`);function Sn(e,t){return xn[e].stringify(t)}w(Sn,`stringifyFile`);var Cn=`config`;function wn(e){if(e===void 0||e===`default`){let e=s();return e===`production`?`default`:e}return z(e),e}w(wn,`resolveAuthProfileBaseName`);function Tn(e,t,n=`toml`){return y.join(e,Cn,`${wn(t)}.${n}`)}w(Tn,`getAuthConfigFilePath`);var En=class{constructor(e,t,n=`toml`){this.configPath=e,this.profile=t,this.format=n}static{w(this,`FileCredentialStore`)}kind=`file`;filePath(){return Tn(this.configPath,this.profile,this.format)}read(){let e=this.filePath();if(m(e))return G(this.format,i(e))}write(e){let t=this.filePath();h(y.dirname(t),{recursive:!0}),_(t,Sn(this.format,e),{encoding:`utf-8`,mode:384}),p(t,384)}clear(){let e=this.filePath(),t=m(e);return t&&g(e),t}path(){return this.filePath()}describe(){return this.filePath()}},K=32,Dn=12,On=16,kn=`AES-256-GCM`,An=`aes-256-gcm`;function jn(){return new Uint8Array(x(K))}w(jn,`generateKey`);function Mn(e,t){if(t.length!==K)throw Error(`AES-256-GCM requires a ${K}-byte key (got ${t.length} bytes).`);let n=x(Dn),r=re(An,t,n),i=Buffer.concat([r.update(e,`utf-8`),r.final()]),a=r.getAuthTag();return{v:1,alg:kn,iv:n.toString(`base64`),tag:a.toString(`base64`),ciphertext:i.toString(`base64`)}}w(Mn,`encryptString`);function Nn(e,t){if(t.length!==K)throw Error(`AES-256-GCM requires a ${K}-byte key (got ${t.length} bytes).`);if(e.v!==1)throw Error(`Unsupported encrypted envelope version: ${e.v}.`);let n=Buffer.from(e.iv,`base64`),r=Buffer.from(e.tag,`base64`),i=Buffer.from(e.ciphertext,`base64`);if(n.length!==Dn)throw Error(`Expected ${Dn}-byte IV in envelope (got ${n.length} bytes).`);if(r.length!==On)throw Error(`Expected ${On}-byte auth tag in envelope (got ${r.length} bytes).`);let a=ie(An,t,n);return a.setAuthTag(r),Buffer.concat([a.update(i),a.final()]).toString(`utf-8`)}w(Nn,`decryptString`);function Pn(e){if(typeof e!=`object`||!e)return;let t=e;if(!(t.v!==1||t.alg!==kn||typeof t.iv!=`string`||typeof t.tag!=`string`||typeof t.ciphertext!=`string`))return t}w(Pn,`parseEncryptedEnvelope`);function q(e,t){return y.join(e,`config`,`${wn(t)}.enc`)}w(q,`getEncryptedAuthConfigFilePath`);var Fn=class{constructor(e,t,n,r,i=`toml`){this.configPath=e,this.keyProvider=t,this.onPlaintextMigration=n,this.profile=r,this.format=i}static{w(this,`EncryptedFileCredentialStore`)}kind=`encrypted-file`;plaintextPath(){return Tn(this.configPath,this.profile,this.format)}read(){let e=q(this.configPath,this.profile);if(m(e))return this.readEncryptedFile(e);let t=this.plaintextPath();if(m(t))return this.migrateFromPlaintext(t,e)}write(e){let t=this.ensureKey(),n=Mn(Sn(this.format,e),t),r=q(this.configPath,this.profile);h(y.dirname(r),{recursive:!0}),_(r,JSON.stringify(n,null,`	`),{encoding:`utf-8`,mode:384}),p(r,384);let i=this.plaintextPath();m(i)&&g(i)}clear(){let e=q(this.configPath,this.profile),t=this.plaintextPath(),n=!1;m(e)&&(g(e),n=!0),m(t)&&(g(t),n=!0);try{this.keyProvider.deleteKey()}catch{}return n}path(){return q(this.configPath,this.profile)}describe(){return`Encrypted file (${q(this.configPath,this.profile)}) with key in ${this.keyProvider.describe()}`}readEncryptedFile(e){let t=this.keyProvider.getKey();if(t===void 0)return;let n=i(e),r;try{r=Pn(JSON.parse(n))}catch{return}if(r===void 0)return;let a;try{a=Nn(r,t)}catch{return}try{return G(this.format,a)}catch{return}}migrateFromPlaintext(e,t){let n=i(e),r;try{r=G(this.format,n)}catch{return}return this.write(r),this.onPlaintextMigration?.({plaintextPath:e,encryptedPath:t,keyProviderDescription:this.keyProvider.describe()}),r}ensureKey(){let e=this.keyProvider.getKey();if(e!==void 0)return e;let t=jn();return this.keyProvider.setKey(t),t}},J=`1.3.0`;function In(e){return C(`npm`,e,{encoding:`utf-8`,stdio:[`ignore`,`pipe`,`pipe`],shell:process.platform===`win32`})}w(In,`defaultNpmRunner`);var Ln=In,Y=new Map;function Rn(e){Ln=e??In,Y.clear()}w(Rn,`setNpmRunner`);function zn(e){return y.join(e,`native`,`keyring`)}w(zn,`getKeyringInstallDir`);function Bn(e){return y.join(e,`node_modules`,`@napi-rs`,`keyring`)}w(Bn,`getInstalledBindingPath`);function Vn(e){try{return f(e)(e),!0}catch{return!1}}w(Vn,`canLoadKeyringBinding`);function Hn(e){let t=Y.get(e);if(t!==void 0)return t;let n=Bn(e);if(m(y.join(n,`index.js`))&&Vn(n))return Y.set(e,n),n;try{let t=Ln([`root`,`-g`]);if(t.status===0){let n=y.join(t.stdout.trim(),`@napi-rs`,`keyring`);if(m(y.join(n,`index.js`))&&Vn(n))return Y.set(e,n),n}}catch{}return Y.set(e,null),null}w(Hn,`findKeyringBinding`);function Un(e){let t=e;h(t,{recursive:!0});let n=y.join(t,`package.json`);m(n)||_(n,JSON.stringify({private:!0,name:`cloudflare-auth-keyring-host`},null,`	`),`utf-8`);let r;try{r=Ln([`install`,`@napi-rs/keyring@${J}`,`--prefix`,t,`--no-save`,`--no-audit`,`--no-fund`,`--no-package-lock`,`--loglevel=error`])}catch(e){throw new o(`Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error?e.message:String(e)}
+`}w(yn,`stringify`);var bn={parse:un,stringify:yn,TomlDate:Jt,TomlError:V},xn={toml:{parse:w(e=>d(e),`parse`),stringify:w(e=>bn.stringify(e),`stringify`)},json:{parse:w(e=>JSON.parse(e),`parse`),stringify:w(e=>JSON.stringify(e,null,`	`),`stringify`)}};function G(e,t){return xn[e].parse(t)}w(G,`parseFile`);function Sn(e,t){return xn[e].stringify(t)}w(Sn,`stringifyFile`);var Cn=`config`;function wn(e){if(e===void 0||e===`default`){let e=c();return e===`production`?`default`:e}return z(e),e}w(wn,`resolveAuthProfileBaseName`);function Tn(e,t,n=`toml`){return y.join(e,Cn,`${wn(t)}.${n}`)}w(Tn,`getAuthConfigFilePath`);var En=class{constructor(e,t,n=`toml`){this.configPath=e,this.profile=t,this.format=n}static{w(this,`FileCredentialStore`)}kind=`file`;filePath(){return Tn(this.configPath,this.profile,this.format)}read(){let e=this.filePath();if(m(e))return G(this.format,t(e))}write(e){let t=this.filePath();h(y.dirname(t),{recursive:!0}),_(t,Sn(this.format,e),{encoding:`utf-8`,mode:384}),p(t,384)}clear(){let e=this.filePath(),t=m(e);return t&&g(e),t}path(){return this.filePath()}describe(){return this.filePath()}},K=32,Dn=12,On=16,kn=`AES-256-GCM`,An=`aes-256-gcm`;function jn(){return new Uint8Array(x(K))}w(jn,`generateKey`);function Mn(e,t){if(t.length!==K)throw Error(`AES-256-GCM requires a ${K}-byte key (got ${t.length} bytes).`);let n=x(Dn),r=re(An,t,n),i=Buffer.concat([r.update(e,`utf-8`),r.final()]),a=r.getAuthTag();return{v:1,alg:kn,iv:n.toString(`base64`),tag:a.toString(`base64`),ciphertext:i.toString(`base64`)}}w(Mn,`encryptString`);function Nn(e,t){if(t.length!==K)throw Error(`AES-256-GCM requires a ${K}-byte key (got ${t.length} bytes).`);if(e.v!==1)throw Error(`Unsupported encrypted envelope version: ${e.v}.`);let n=Buffer.from(e.iv,`base64`),r=Buffer.from(e.tag,`base64`),i=Buffer.from(e.ciphertext,`base64`);if(n.length!==Dn)throw Error(`Expected ${Dn}-byte IV in envelope (got ${n.length} bytes).`);if(r.length!==On)throw Error(`Expected ${On}-byte auth tag in envelope (got ${r.length} bytes).`);let a=ie(An,t,n);return a.setAuthTag(r),Buffer.concat([a.update(i),a.final()]).toString(`utf-8`)}w(Nn,`decryptString`);function Pn(e){if(typeof e!=`object`||!e)return;let t=e;if(!(t.v!==1||t.alg!==kn||typeof t.iv!=`string`||typeof t.tag!=`string`||typeof t.ciphertext!=`string`))return t}w(Pn,`parseEncryptedEnvelope`);function q(e,t){return y.join(e,`config`,`${wn(t)}.enc`)}w(q,`getEncryptedAuthConfigFilePath`);var Fn=class{constructor(e,t,n,r,i=`toml`){this.configPath=e,this.keyProvider=t,this.onPlaintextMigration=n,this.profile=r,this.format=i}static{w(this,`EncryptedFileCredentialStore`)}kind=`encrypted-file`;plaintextPath(){return Tn(this.configPath,this.profile,this.format)}read(){let e=q(this.configPath,this.profile);if(m(e))return this.readEncryptedFile(e);let t=this.plaintextPath();if(m(t))return this.migrateFromPlaintext(t,e)}write(e){let t=this.ensureKey(),n=Mn(Sn(this.format,e),t),r=q(this.configPath,this.profile);h(y.dirname(r),{recursive:!0}),_(r,JSON.stringify(n,null,`	`),{encoding:`utf-8`,mode:384}),p(r,384);let i=this.plaintextPath();m(i)&&g(i)}clear(){let e=q(this.configPath,this.profile),t=this.plaintextPath(),n=!1;m(e)&&(g(e),n=!0),m(t)&&(g(t),n=!0);try{this.keyProvider.deleteKey()}catch{}return n}path(){return q(this.configPath,this.profile)}describe(){return`Encrypted file (${q(this.configPath,this.profile)}) with key in ${this.keyProvider.describe()}`}readEncryptedFile(e){let n=this.keyProvider.getKey();if(n===void 0)return;let r=t(e),i;try{i=Pn(JSON.parse(r))}catch{return}if(i===void 0)return;let a;try{a=Nn(i,n)}catch{return}try{return G(this.format,a)}catch{return}}migrateFromPlaintext(e,n){let r=t(e),i;try{i=G(this.format,r)}catch{return}return this.write(i),this.onPlaintextMigration?.({plaintextPath:e,encryptedPath:n,keyProviderDescription:this.keyProvider.describe()}),i}ensureKey(){let e=this.keyProvider.getKey();if(e!==void 0)return e;let t=jn();return this.keyProvider.setKey(t),t}},J=`1.3.0`;function In(e){return C(`npm`,e,{encoding:`utf-8`,stdio:[`ignore`,`pipe`,`pipe`],shell:process.platform===`win32`})}w(In,`defaultNpmRunner`);var Ln=In,Y=new Map;function Rn(e){Ln=e??In,Y.clear()}w(Rn,`setNpmRunner`);function zn(e){return y.join(e,`native`,`keyring`)}w(zn,`getKeyringInstallDir`);function Bn(e){return y.join(e,`node_modules`,`@napi-rs`,`keyring`)}w(Bn,`getInstalledBindingPath`);function Vn(e){try{return f(e)(e),!0}catch{return!1}}w(Vn,`canLoadKeyringBinding`);function Hn(e){let t=Y.get(e);if(t!==void 0)return t;let n=Bn(e);if(m(y.join(n,`index.js`))&&Vn(n))return Y.set(e,n),n;try{let t=Ln([`root`,`-g`]);if(t.status===0){let n=y.join(t.stdout.trim(),`@napi-rs`,`keyring`);if(m(y.join(n,`index.js`))&&Vn(n))return Y.set(e,n),n}}catch{}return Y.set(e,null),null}w(Hn,`findKeyringBinding`);function Un(e){let t=e;h(t,{recursive:!0});let n=y.join(t,`package.json`);m(n)||_(n,JSON.stringify({private:!0,name:`cloudflare-auth-keyring-host`},null,`	`),`utf-8`);let i;try{i=Ln([`install`,`@napi-rs/keyring@${J}`,`--prefix`,t,`--no-save`,`--no-audit`,`--no-fund`,`--no-package-lock`,`--loglevel=error`])}catch(e){throw new r(`Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error?e.message:String(e)}
 
 Install \`npm\` and retry, or install the binding globally:
-  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring npm spawn failed`})}if(r.status!==0)throw new o(`Failed to install \`@napi-rs/keyring\` (npm exited ${r.status}):
-${r.stderr?.trim()??`(no stderr)`}
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring npm spawn failed`})}if(i.status!==0)throw new r(`Failed to install \`@napi-rs/keyring\` (npm exited ${i.status}):
+${i.stderr?.trim()??`(no stderr)`}
 
 Retry once the underlying issue is fixed, or install the binding globally:
-  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring npm install failed`});if(Y.delete(e),Hn(e)===null)throw new o(`\`npm\` reported success but the \`@napi-rs/keyring\` native binding still cannot be loaded.
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring npm install failed`});if(Y.delete(e),Hn(e)===null)throw new r(`\`npm\` reported success but the \`@napi-rs/keyring\` native binding still cannot be loaded.
 
 Its platform-specific binary ships as a separate optional package, so a download that was skipped or interrupted leaves the binding unusable.
 
 Retry once the underlying issue is fixed, or install the binding globally:
-  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring install incomplete`})}w(Un,`installKeyringBindingSync`);var Wn;function Gn(e){Wn=e}w(Gn,`setKeyringEntryFactory`);function Kn(e){if(Wn!==void 0)return Wn;let t=Hn(e);if(t===null)throw new o(`The \`@napi-rs/keyring\` native binding is not available.
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring install incomplete`})}w(Un,`installKeyringBindingSync`);var Wn;function Gn(e){Wn=e}w(Gn,`setKeyringEntryFactory`);function Kn(e){if(Wn!==void 0)return Wn;let t=Hn(e);if(t===null)throw new r(`The \`@napi-rs/keyring\` native binding is not available.
 
 Retry the command, or install the binding globally:
-  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring binding not loadable`});let n=f(t)(t);return(e,t)=>new n.Entry(e,t)}w(Kn,`resolveKeyringEntryFactory`);function X(e){return wn(e)}w(X,`getKeyringAccountName`);function qn(e){let t={v:1,key:Buffer.from(e).toString(`base64`),created:new Date().toISOString()};return JSON.stringify(t)}w(qn,`encodeKeyEnvelope`);function Z(e){if(e===``)return;let t;try{t=JSON.parse(e)}catch{return}if(!(typeof t!=`object`||!t||t.v!==1||typeof t.key!=`string`))try{let e=Buffer.from(t.key,`base64`);return e.length===32?new Uint8Array(e):void 0}catch{return}}w(Z,`decodeKeyEnvelope`);function Jn(e,t={}){return C(`secret-tool`,e,{encoding:`utf-8`,input:t.input})}w(Jn,`defaultRunner`);var Q=Jn,Yn=void 0;function Xn(e){Q=e??Jn,Yn=void 0}w(Xn,`setLinuxSecretToolRunner`);function Zn(){if(Yn!==void 0)return Yn;let e;try{e=Q([`--version`]).error===void 0}catch{e=!1}return Yn=e,e}w(Zn,`probeSecretTool`);var Qn=class{constructor(e,t){this.serviceName=e,this.profile=t}static{w(this,`LinuxSecretToolKeyProvider`)}getKey(){let e=Q([`lookup`,`service`,this.serviceName,`account`,X(this.profile)]);if(e.status!==1){if(e.status!==0)throw Error(`Failed to read key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Z(e.stdout.trim())}}setKey(e){let t=Q([`store`,`--label=Cloudflare credentials key`,`service`,this.serviceName,`account`,X(this.profile)],{input:qn(e)});if(t.status!==0)throw Error(`Failed to write key via secret-tool (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=Q([`clear`,`service`,this.serviceName,`account`,X(this.profile)]);if(e.status!==0)throw Error(`Failed to delete key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`Linux secret-tool (service=${this.serviceName}, account=${X(this.profile)})`}},$n=44;function er(e,t={}){return C(`/usr/bin/security`,e,{encoding:`utf-8`,input:t.input})}w(er,`defaultRunner`);var tr=er;function nr(e){tr=e??er}w(nr,`setMacSecurityCommandRunner`);var rr=class{constructor(e,t){this.serviceName=e,this.profile=t}static{w(this,`MacSecurityKeyProvider`)}getKey(){let e=tr([`find-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile),`-w`]);if(e.status!==$n){if(e.status!==0)throw Error(`Failed to read key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Z(e.stdout.trim())}}setKey(e){let t=tr([`add-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile),`-w`,qn(e),`-U`]);if(t.status!==0)throw Error(`Failed to write key to macOS Keychain (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=tr([`delete-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile)]);if(!(e.status===0||e.status===$n))throw Error(`Failed to delete key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`macOS Keychain (service=${this.serviceName}, account=${X(this.profile)})`}},ir=class{constructor(e,t,n){this.serviceName=e,this.installDir=t,this.profile=n}static{w(this,`NapiKeyringKeyProvider`)}entry(){return Kn(this.installDir)(this.serviceName,X(this.profile))}getKey(){let e=this.entry().getPassword();if(!(e===null||e===``))return Z(e)}setKey(e){this.entry().setPassword(qn(e))}deleteKey(){try{this.entry().deletePassword()}catch{}}describe(){return`${process.platform===`win32`?`Windows Credential Manager`:`OS keyring`} via @napi-rs/keyring (service=${this.serviceName}, account=${X(this.profile)})`}},ar;function or(e){ar=e}w(or,`setKeyProviderFactoryForTesting`);function sr(e,t,n){if(ar!==void 0)return{kind:`available`,provider:ar(e,t)};switch(process.platform){case`darwin`:return{kind:`available`,provider:new rr(e,t)};case`linux`:return Zn()?{kind:`available`,provider:new Qn(e,t)}:{kind:`unsupported`};case`win32`:{let r=zn(n);return Hn(r)===null?{kind:`needs-install`,install:w(()=>Un(r),`install`),afterInstall:w(()=>new ir(e,r,t),`afterInstall`)}:{kind:`available`,provider:new ir(e,r,t)}}default:return{kind:`unsupported`}}}w(sr,`resolveKeyProvider`);var cr={installFailedThisSession:!1,hasWarnedAboutKeyringFallback:!1,hasWarnedAboutSecretToolMissing:!1};function lr(){return cr}w(lr,`getResolverSessionFlags`);function ur(){cr.installFailedThisSession=!1,cr.hasWarnedAboutKeyringFallback=!1,cr.hasWarnedAboutSecretToolMissing=!1}w(ur,`resetCredentialStorageState`);function dr(e){let t={...e,loginCommand:e.loginCommand??`your CLI login`,format:e.format??`toml`};function n(e){return fr(t,e)}w(n,`getActiveStore`);function r(e){return{read:w(()=>n(e).read(),`read`),write:w(t=>n(e).write(t),`write`),clear:w(()=>n(e).clear(),`clear`),path:w(()=>n(e).path(),`path`)}}return w(r,`storageFactory`),{storageFactory:r,getActiveStore:n}}w(dr,`createCredentialStorageContext`);function fr(e,t){let n=Ee(),r=e.getConfigPath();if(n===!1)return new En(r,t,e.format);let i=n===!0;if(!(n??e.isKeyringEnabled()??!1))return new En(r,t,e.format);let a=sr(e.serviceName,t,r);switch(a.kind){case`available`:return new Fn(r,a.provider,pr(e),t,e.format);case`needs-install`:return mr(a,i,e,t);case`unsupported`:return hr(i,e,t)}}w(fr,`resolveActiveCredentialStore`);function pr(e){return t=>{e.logger.warn(`Migrated credentials from ${t.plaintextPath} into ${t.encryptedPath} (key in ${t.keyProviderDescription}). The plaintext file has been deleted.`)}}w(pr,`buildMigrationLogger`);function mr(e,t,n,r){let i=lr();if(i.installFailedThisSession){if(t)throw new o(`CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,{telemetryMessage:`workers-auth keyring install previously failed`});return $(`The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,n,r)}if(n.isNonInteractiveOrCI())throw new o(_r(n.loginCommand),{telemetryMessage:`workers-auth keyring binding not installed`});try{n.logger.log(`🔐 Installing keyring backend (one-time, ~2 MB)…`),e.install()}catch(e){if(i.installFailedThisSession=!0,t)throw e instanceof o?e:new o(`Failed to install the keyring backend: ${e instanceof Error?e.message:String(e)}`,{telemetryMessage:`workers-auth keyring install threw`});return $(`Failed to install the keyring backend (${e instanceof Error?e.message:String(e)}); falling back to the plaintext credentials file.`,n,r)}return new Fn(n.getConfigPath(),e.afterInstall(),pr(n),r,n.format)}w(mr,`handleNeedsInstall`);function hr(e,t,n){let r=process.platform,i=r===`linux`,a=i?gr(t.loginCommand):`OS keyring storage is not supported on \`${r}\`; falling back to the plaintext credentials file.`;if(e)throw new o(i?`CLOUDFLARE_AUTH_USE_KEYRING is set but ${a}`:`CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${r}\`.`,{telemetryMessage:i?`workers-auth keyring secret tool missing`:`workers-auth keyring unsupported platform`});if(i&&t.isNonInteractiveOrCI())throw new o(a,{telemetryMessage:`workers-auth keyring secret tool missing`});let s=lr();return i?(s.hasWarnedAboutSecretToolMissing||(s.hasWarnedAboutSecretToolMissing=!0,t.logger.warn(`${a}
+  npm install -g @napi-rs/keyring@${J}`,{telemetryMessage:`workers-auth keyring binding not loadable`});let n=f(t)(t);return(e,t)=>new n.Entry(e,t)}w(Kn,`resolveKeyringEntryFactory`);function X(e){return wn(e)}w(X,`getKeyringAccountName`);function qn(e){let t={v:1,key:Buffer.from(e).toString(`base64`),created:new Date().toISOString()};return JSON.stringify(t)}w(qn,`encodeKeyEnvelope`);function Z(e){if(e===``)return;let t;try{t=JSON.parse(e)}catch{return}if(!(typeof t!=`object`||!t||t.v!==1||typeof t.key!=`string`))try{let e=Buffer.from(t.key,`base64`);return e.length===32?new Uint8Array(e):void 0}catch{return}}w(Z,`decodeKeyEnvelope`);function Jn(e,t={}){return C(`secret-tool`,e,{encoding:`utf-8`,input:t.input})}w(Jn,`defaultRunner`);var Q=Jn,Yn=void 0;function Xn(e){Q=e??Jn,Yn=void 0}w(Xn,`setLinuxSecretToolRunner`);function Zn(){if(Yn!==void 0)return Yn;let e;try{e=Q([`--version`]).error===void 0}catch{e=!1}return Yn=e,e}w(Zn,`probeSecretTool`);var Qn=class{constructor(e,t){this.serviceName=e,this.profile=t}static{w(this,`LinuxSecretToolKeyProvider`)}getKey(){let e=Q([`lookup`,`service`,this.serviceName,`account`,X(this.profile)]);if(e.status!==1){if(e.status!==0)throw Error(`Failed to read key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Z(e.stdout.trim())}}setKey(e){let t=Q([`store`,`--label=Cloudflare credentials key`,`service`,this.serviceName,`account`,X(this.profile)],{input:qn(e)});if(t.status!==0)throw Error(`Failed to write key via secret-tool (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=Q([`clear`,`service`,this.serviceName,`account`,X(this.profile)]);if(e.status!==0)throw Error(`Failed to delete key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`Linux secret-tool (service=${this.serviceName}, account=${X(this.profile)})`}},$n=44;function er(e,t={}){return C(`/usr/bin/security`,e,{encoding:`utf-8`,input:t.input})}w(er,`defaultRunner`);var tr=er;function nr(e){tr=e??er}w(nr,`setMacSecurityCommandRunner`);var rr=class{constructor(e,t){this.serviceName=e,this.profile=t}static{w(this,`MacSecurityKeyProvider`)}getKey(){let e=tr([`find-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile),`-w`]);if(e.status!==$n){if(e.status!==0)throw Error(`Failed to read key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Z(e.stdout.trim())}}setKey(e){let t=tr([`add-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile),`-w`,qn(e),`-U`]);if(t.status!==0)throw Error(`Failed to write key to macOS Keychain (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=tr([`delete-generic-password`,`-s`,this.serviceName,`-a`,X(this.profile)]);if(!(e.status===0||e.status===$n))throw Error(`Failed to delete key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`macOS Keychain (service=${this.serviceName}, account=${X(this.profile)})`}},ir=class{constructor(e,t,n){this.serviceName=e,this.installDir=t,this.profile=n}static{w(this,`NapiKeyringKeyProvider`)}entry(){return Kn(this.installDir)(this.serviceName,X(this.profile))}getKey(){let e=this.entry().getPassword();if(!(e===null||e===``))return Z(e)}setKey(e){this.entry().setPassword(qn(e))}deleteKey(){try{this.entry().deletePassword()}catch{}}describe(){return`${process.platform===`win32`?`Windows Credential Manager`:`OS keyring`} via @napi-rs/keyring (service=${this.serviceName}, account=${X(this.profile)})`}},ar;function or(e){ar=e}w(or,`setKeyProviderFactoryForTesting`);function sr(e,t,n){if(ar!==void 0)return{kind:`available`,provider:ar(e,t)};switch(process.platform){case`darwin`:return{kind:`available`,provider:new rr(e,t)};case`linux`:return Zn()?{kind:`available`,provider:new Qn(e,t)}:{kind:`unsupported`};case`win32`:{let r=zn(n);return Hn(r)===null?{kind:`needs-install`,install:w(()=>Un(r),`install`),afterInstall:w(()=>new ir(e,r,t),`afterInstall`)}:{kind:`available`,provider:new ir(e,r,t)}}default:return{kind:`unsupported`}}}w(sr,`resolveKeyProvider`);var cr={installFailedThisSession:!1,hasWarnedAboutKeyringFallback:!1,hasWarnedAboutSecretToolMissing:!1};function lr(){return cr}w(lr,`getResolverSessionFlags`);function ur(){cr.installFailedThisSession=!1,cr.hasWarnedAboutKeyringFallback=!1,cr.hasWarnedAboutSecretToolMissing=!1}w(ur,`resetCredentialStorageState`);function dr(e){let t={...e,loginCommand:e.loginCommand??`your CLI login`,format:e.format??`toml`};function n(e){return fr(t,e)}w(n,`getActiveStore`);function r(e){return{read:w(()=>n(e).read(),`read`),write:w(t=>n(e).write(t),`write`),clear:w(()=>n(e).clear(),`clear`),path:w(()=>n(e).path(),`path`)}}return w(r,`storageFactory`),{storageFactory:r,getActiveStore:n}}w(dr,`createCredentialStorageContext`);function fr(e,t){let n=Ee(),r=e.getConfigPath();if(n===!1)return new En(r,t,e.format);let i=n===!0;if(!(n??e.isKeyringEnabled()??!1))return new En(r,t,e.format);let a=sr(e.serviceName,t,r);switch(a.kind){case`available`:return new Fn(r,a.provider,pr(e),t,e.format);case`needs-install`:return mr(a,i,e,t);case`unsupported`:return hr(i,e,t)}}w(fr,`resolveActiveCredentialStore`);function pr(e){return t=>{e.logger.warn(`Migrated credentials from ${t.plaintextPath} into ${t.encryptedPath} (key in ${t.keyProviderDescription}). The plaintext file has been deleted.`)}}w(pr,`buildMigrationLogger`);function mr(e,t,n,i){let a=lr();if(a.installFailedThisSession){if(t)throw new r(`CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,{telemetryMessage:`workers-auth keyring install previously failed`});return $(`The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,n,i)}if(n.isNonInteractiveOrCI())throw new r(_r(n.loginCommand),{telemetryMessage:`workers-auth keyring binding not installed`});try{n.logger.log(`🔐 Installing keyring backend (one-time, ~2 MB)…`),e.install()}catch(e){if(a.installFailedThisSession=!0,t)throw e instanceof r?e:new r(`Failed to install the keyring backend: ${e instanceof Error?e.message:String(e)}`,{telemetryMessage:`workers-auth keyring install threw`});return $(`Failed to install the keyring backend (${e instanceof Error?e.message:String(e)}); falling back to the plaintext credentials file.`,n,i)}return new Fn(n.getConfigPath(),e.afterInstall(),pr(n),i,n.format)}w(mr,`handleNeedsInstall`);function hr(e,t,n){let i=process.platform,a=i===`linux`,o=a?gr(t.loginCommand):`OS keyring storage is not supported on \`${i}\`; falling back to the plaintext credentials file.`;if(e)throw new r(a?`CLOUDFLARE_AUTH_USE_KEYRING is set but ${o}`:`CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${i}\`.`,{telemetryMessage:a?`workers-auth keyring secret tool missing`:`workers-auth keyring unsupported platform`});if(a&&t.isNonInteractiveOrCI())throw new r(o,{telemetryMessage:`workers-auth keyring secret tool missing`});let s=lr();return a?(s.hasWarnedAboutSecretToolMissing||(s.hasWarnedAboutSecretToolMissing=!0,t.logger.warn(`${o}
 
-Falling back to the plaintext credentials file for this session.`)),new En(t.getConfigPath(),n,t.format)):$(a,t,n)}w(hr,`handleUnsupported`);function $(e,t,n){let r=lr();return r.hasWarnedAboutKeyringFallback||(r.hasWarnedAboutKeyringFallback=!0,t.logger.warn(e)),new En(t.getConfigPath(),n,t.format)}w($,`fallbackToFileWithWarning`);function gr(e){return`\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
+Falling back to the plaintext credentials file for this session.`)),new En(t.getConfigPath(),n,t.format)):$(o,t,n)}w(hr,`handleUnsupported`);function $(e,t,n){let r=lr();return r.hasWarnedAboutKeyringFallback||(r.hasWarnedAboutKeyringFallback=!0,t.logger.warn(e)),new En(t.getConfigPath(),n,t.format)}w($,`fallbackToFileWithWarning`);function gr(e){return`\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
 
 Install it via your package manager:
   Debian/Ubuntu:  sudo apt-get install libsecret-tools

package/dist/{chunk-QBZBEHZB-CKzQKcIp.mjs → chunk-QBZBEHZB-yeyhVUeD.mjs}

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{r as e,t}from"./chunk-vbHwaUoU.mjs";import{D as n,P as r,Tt as i,d as a,it as o}from"./dist-BWpErtDM.mjs";import{createRequire as s}from"node:module";import{readFileSync as c}from"node:fs";import l from"node:assert";import u,{resolve as d}from"node:path";import{spawnSync as f}from"node:child_process";var p=Object.create,m=Object.defineProperty,h=Object.getOwnPropertyDescriptor,g=Object.getOwnPropertyNames,_=Object.getPrototypeOf,v=Object.prototype.hasOwnProperty,y=(e,t)=>m(e,`name`,{value:t,configurable:!0}),b=e===void 0?s(import.meta.url):e,x=(e,t)=>function(){return t||(0,e[g(e)[0]])((t={exports:{}}).exports,t),t.exports},S=(e,t)=>{for(var n in t)m(e,n,{get:t[n],enumerable:!0})},C=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(let i of g(t))!v.call(e,i)&&i!==n&&m(e,i,{get:()=>t[i],enumerable:!(r=h(t,i))||r.enumerable});return e},w=(e,t,n)=>(n=e==null?{}:p(_(e)),C(t||!e||!e.__esModule?m(n,`default`,{value:e,enumerable:!0}):n,e)),T=t(((t,n)=>{var r=e(`child_process`).exec,i=e(`child_process`).execSync,a=e(`fs`),o=e(`path`),s=a.access,c=a.accessSync,l=a.constants||a,u=process.platform==`win32`,d=function(e,t){s(e,l.F_OK,function(e){t(!e)})},f=function(e){try{return c(e,l.F_OK),!1}catch{return!0}},p=function(e,t){s(e,l.F_OK|l.X_OK,function(e){t(null,!e)})},m=function(e){try{return c(e,l.F_OK|l.X_OK),!0}catch{return!1}},h=function(e,t,n){d(e,function(i){if(!i){r(`command -v `+t+` 2>/dev/null && { echo >&1 `+t+`; exit 0; }`,function(e,t,r){n(null,!!t)});return}p(e,n)})},g=function(e,t,n){if(!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(e)){n(null,!1);return}r(`where `+t,function(e){e===null?n(null,!0):n(null,!1)})},_=function(e,t){if(f(e))try{return!!i(`command -v `+t+` 2>/dev/null && { echo >&1 `+t+`; exit 0; }`)}catch{return!1}return m(e)},v=function(e,t,n){if(!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(e))return!1;try{return!!i(`where `+t,{stdio:[]})}catch{return!1}},y=function(e){return/[^A-Za-z0-9_\/:=-]/.test(e)&&(e=`'`+e.replace(/'/g,`'\\''`)+`'`,e=e.replace(/^(?:'')+/g,``).replace(/\\'''/g,`\\'`)),e};u&&(y=function(e){if(/[\\]/.test(e)){var t=`"`+o.dirname(e)+`"`,n=`"`+o.basename(e)+`"`;return t+`:`+n}return`"`+e+`"`}),n.exports=function e(t,n){var r=y(t);if(!n&&typeof Promise<`u`)return new Promise(function(n,r){e(t,function(e,i){i?n(t):r(e)})});u?g(t,r,n):h(t,r,n)},n.exports.sync=function(e){var t=y(e);return u?v(e,t):_(e,t)}})),E=t(((e,t)=>{t.exports=T()})),ee=r(),D=E();function O(e){if(e.compiled_schema)return c(d(e.compiled_schema));let{base_path:t,source_schemas:n}=e,r=(n??[]).map(e=>d(t,e));if(!(0,D.sync)(`capnp`))throw new i(`The capnp compiler is required to upload capnp schemas, but is not present.`,{telemetryMessage:`capnp compiler missing`});let a=f(`capnp`,[`compile`,`-o-`,`--src-prefix=${d(t??`.`)}`,...r],{maxBuffer:3*1024*1024});if(a.error)throw a.error;if(a.stderr.length)throw Error(a.stderr.toString());return a.stdout}y(O,`handleUnsafeCapnp`);var k={esm:`application/javascript+module`,commonjs:`application/javascript`,"compiled-wasm":`application/wasm`,buffer:`application/octet-stream`,text:`text/plain`,python:`text/x-python`,"python-requirement":`text/x-python-requirement`};function A(e){let t=k[e];if(t===void 0)throw TypeError(`Unsupported module: `+e);return t}y(A,`toMimeType`);function j(e){let t=Object.keys(k).find(t=>k[t]===e);if(t===void 0)throw TypeError(`Unsupported mime type: `+e);return t}y(j,`fromMimeType`);function M(e,t,r){let s=new ee.FormData,{main:d,sourceMaps:f,migrations:p,exports:m,compatibility_date:h,compatibility_flags:g,keepVars:_,keepSecrets:v,keepBindings:y,logpush:b,placement:x,tail_consumers:S,streaming_tail_consumers:C,limits:w,annotations:T,keep_assets:E,assets:D,observability:k,cache:j,package_dependencies:M}=e,N={html_handling:D?.assetConfig?.html_handling,not_found_handling:D?.assetConfig?.not_found_handling,run_worker_first:D?.run_worker_first,_redirects:D?._redirects,_headers:D?._headers};if(D&&!D.routerConfig.has_user_worker)return s.set(`metadata`,JSON.stringify({assets:{jwt:D.jwt,config:N},...T&&{annotations:T},...h&&{compatibility_date:h},...g&&{compatibility_flags:g}})),s;let{modules:P}=e,F=[],te=a(`plain_text`,t),ne=a(`json`,t),re=a(`secret_text`,t),ie=a(`kv_namespace`,t),I=a(`send_email`,t),ae=a(`durable_object_namespace`,t),oe=a(`workflow`,t),se=a(`queue`,t),ce=a(`r2_bucket`,t),le=a(`d1`,t),ue=a(`vectorize`,t),de=a(`ai_search_namespace`,t),L=a(`ai_search`,t),R=a(`agent_memory`,t),z=a(`hyperdrive`,t),B=a(`secrets_store_secret`,t),V=a(`artifacts`,t),fe=a(`unsafe_hello_world`,t),pe=a(`flagship`,t),me=a(`ratelimit`,t),he=a(`vpc_service`,t),ge=a(`vpc_network`,t),_e=a(`service`,t),H=a(`analytics_engine`,t),ve=a(`dispatch_namespace`,t),ye=a(`mtls_certificate`,t),be=a(`pipeline`,t),xe=a(`worker_loader`,t),Se=a(`logfwdr`,t),Ce=a(`wasm_module`,t),U=a(`browser`,t)[0],W=a(`ai`,t)[0],G=a(`images`,t)[0],K=a(`stream`,t)[0],q=a(`media`,t)[0],J=a(`version_metadata`,t)[0],Y=a(`assets`,t)[0],we=a(`text_blob`,t),Te=a(`data_blob`,t);a(`inherit`,t).forEach(({binding:e})=>{F.push({name:e,type:`inherit`})}),te.forEach(({binding:e,value:t})=>{F.push({name:e,type:`plain_text`,text:t})}),ne.forEach(({binding:e,value:t})=>{F.push({name:e,type:`json`,json:t})}),re.forEach(({binding:e,value:t})=>{F.push({name:e,type:`secret_text`,text:t})}),ie.forEach(({id:e,binding:t,raw:n})=>{if(r?.dryRun&&(e??=o),e===void 0)throw new i(`${t} bindings must have an "id" field`,{telemetryMessage:`kv namespace binding missing id`});e===o?F.push({name:t,type:`inherit`}):F.push({name:t,type:`kv_namespace`,namespace_id:e,raw:n})}),I.forEach(e=>{let t={name:e.name,type:`send_email`,allowed_sender_addresses:e.allowed_sender_addresses};e.destination_address===void 0?e.allowed_destination_addresses===void 0?F.push(t):F.push({...t,allowed_destination_addresses:e.allowed_destination_addresses}):F.push({...t,destination_address:e.destination_address})}),ae.forEach(({name:e,class_name:t,script_name:n,environment:r})=>{F.push({name:e,type:`durable_object_namespace`,class_name:t,...n&&{script_name:n},...r&&{environment:r}})}),oe.forEach(({binding:e,name:t,class_name:n,script_name:r,raw:i})=>{F.push({type:`workflow`,name:e,workflow_name:t,class_name:n,script_name:r,raw:i})}),se.forEach(({binding:e,queue_name:t,delivery_delay:n,raw:a})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have a "queue" field. Add a "queue" field to the producer in your Worker configuration specifying the name of the Queue to bind to.`,{telemetryMessage:`queue binding missing name`});t===o?F.push({name:e,type:`inherit`}):F.push({type:`queue`,name:e,queue_name:t,delivery_delay:n,raw:a})}),ce.forEach(({binding:e,bucket_name:t,jurisdiction:n,raw:a})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have a "bucket_name" field. Add a "bucket_name" field to the binding in your Worker configuration specifying the name of the R2 bucket to bind to.`,{telemetryMessage:`r2 bucket binding missing bucket_name`});t===o?F.push({name:e,type:`inherit`}):F.push({name:e,type:`r2_bucket`,bucket_name:t,jurisdiction:n,raw:a})}),le.forEach(({binding:e,database_id:t,database_internal_env:n,raw:a})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have a "database_id" field. Add a "database_id" field to the binding in your Worker configuration specifying the ID of the D1 database to bind to.`,{telemetryMessage:`d1 database binding missing database_id`});t===o?F.push({name:e,type:`inherit`}):F.push({name:e,type:`d1`,id:t,internalEnv:n,raw:a})}),ue.forEach(({binding:e,index_name:t,raw:n})=>{F.push({name:e,type:`vectorize`,index_name:t,raw:n})}),de.forEach(({binding:e,namespace:t})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the AI Search namespace to bind to.`,{telemetryMessage:`ai search namespace binding missing namespace`});t===o?F.push({name:e,type:`inherit`}):F.push({name:e,type:`ai_search_namespace`,namespace:t})}),L.forEach(({binding:e,instance_name:t})=>{F.push({name:e,type:`ai_search`,instance_name:t})}),R.forEach(({binding:e,namespace:t})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the namespace to bind to.`,{telemetryMessage:!1});t===o?F.push({name:e,type:`inherit`}):F.push({name:e,type:`agent_memory`,namespace:t})}),z.forEach(({binding:e,id:t})=>{F.push({name:e,type:`hyperdrive`,id:t})}),B.forEach(({binding:e,store_id:t,secret_name:n})=>{F.push({name:e,type:`secrets_store_secret`,store_id:t,secret_name:n})}),V.forEach(({binding:e,namespace:t})=>{F.push({name:e,type:`artifacts`,namespace:t})}),fe.forEach(({binding:e,enable_timer:t})=>{F.push({name:e,type:`unsafe_hello_world`,enable_timer:t})}),pe.forEach(({binding:e,app_id:t})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have an "app_id" field. Add an "app_id" field to the binding in your Worker configuration specifying the Flagship app to bind to.`,{telemetryMessage:`flagship binding missing app id`});F.push(t===o?{name:e,type:`inherit`}:{name:e,type:`flagship`,app_id:t})}),me.forEach(({name:e,namespace_id:t,simple:n})=>{F.push({name:e,type:`ratelimit`,namespace_id:t,simple:n})}),he.forEach(({binding:e,service_id:t})=>{F.push({name:e,type:`vpc_service`,service_id:t})}),ge.forEach(({binding:e,tunnel_id:t,network_id:n})=>{F.push({name:e,type:`vpc_network`,...t===void 0?{network_id:n}:{tunnel_id:t}})}),_e.forEach(({binding:e,service:t,environment:n,entrypoint:r,props:i,cross_account_grant:a})=>{F.push({name:e,type:`service`,service:t,cross_account_grant:a,...n&&{environment:n},...r&&{entrypoint:r},...i&&{props:i}})}),H.forEach(({binding:e,dataset:t})=>{F.push({name:e,type:`analytics_engine`,dataset:t})}),ve.forEach(({binding:e,namespace:t,outbound:n})=>{if(r?.dryRun&&(t??=o),t===void 0)throw new i(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the dispatch namespace to bind to.`,{telemetryMessage:`dispatch namespace binding missing namespace`});t===o?F.push({name:e,type:`inherit`}):F.push({name:e,type:`dispatch_namespace`,namespace:t,...n&&{outbound:{worker:{service:n.service,environment:n.environment},params:n.parameters?.map(e=>({name:e}))}}})}),ye.forEach(({binding:e,certificate_id:t})=>{F.push({name:e,type:`mtls_certificate`,certificate_id:t})}),be.forEach(({binding:e,stream:t,pipeline:n})=>{if(t)F.push({name:e,type:`pipelines`,stream:t});else if(n)F.push({name:e,type:`pipelines`,pipeline:n});else throw Error(`Pipeline binding must specify a stream or pipeline`)}),xe.forEach(({binding:e})=>{F.push({name:e,type:`worker_loader`})}),Se.forEach(({name:e,destination:t})=>{F.push({name:e,type:`logfwdr`,destination:t})}),Ce.forEach(({binding:e,source:t})=>{F.push({name:e,type:`wasm_module`,part:e}),s.set(e,new File([`contents`in t?t.contents:c(t.path)],`path`in t?t.path??e:e,{type:`application/wasm`}))}),U!==void 0&&F.push({name:U.binding,type:`browser`,raw:U.raw}),W!==void 0&&F.push({name:W.binding,staging:W.staging,type:`ai`,raw:W.raw}),G!==void 0&&F.push({name:G.binding,type:`images`,raw:G.raw}),K!==void 0&&F.push({name:K.binding,type:`stream`}),q!==void 0&&F.push({name:q.binding,type:`media`}),J!==void 0&&F.push({name:J.binding,type:`version_metadata`}),Y!==void 0&&F.push({name:Y.binding,type:`assets`}),we.forEach(({binding:e,source:t})=>{F.push({name:e,type:`text_blob`,part:e}),e!==`__STATIC_CONTENT_MANIFEST`&&(`contents`in t?s.set(e,new File([t.contents],t.path??e,{type:`text/plain`})):s.set(e,new File([c(t.path)],t.path,{type:`text/plain`})))}),Te.forEach(({binding:e,source:t})=>{F.push({name:e,type:`data_blob`,part:e}),s.set(e,new File([`contents`in t?t.contents:c(t.path)],`path`in t?t.path??e:e,{type:`application/octet-stream`}))});for(let[e,r]of Object.entries(t??{}))if(n(r.type)&&r.type!==`unsafe_hello_world`){let{type:t,...n}=r;F.push({name:e,type:t.slice(7),...n})}let X=`__STATIC_CONTENT_MANIFEST`;if(P?.some(({name:e})=>e===X)&&d.type===`esm`){l(P!==void 0);let e=new Set(P.map(e=>u.posix.dirname(e.name)));for(let t of e){if(t===`.`)continue;let e=u.posix.relative(t,X),n=u.posix.join(t,X);P.push({name:n,filePath:n,content:`export { default } from ${JSON.stringify(e)};`,type:`esm`})}}if(d.type===`commonjs`){for(let e of Object.values([...P||[]]))if(e.name===`__STATIC_CONTENT_MANIFEST`)s.set(e.name,new File([e.content],e.name,{type:`text/plain`})),P=P?.filter(t=>t!==e);else if(e.type===`compiled-wasm`||e.type===`text`||e.type===`buffer`){let t=e.name.replace(/[^a-zA-Z0-9_$]/g,`_`);F.push({name:t,type:e.type===`compiled-wasm`?`wasm_module`:e.type===`text`?`text_blob`:`data_blob`,part:t}),s.set(t,new File([e.content],e.name,{type:e.type===`compiled-wasm`?`application/wasm`:e.type===`text`?`text/plain`:`application/octet-stream`})),P=P?.filter(t=>t!==e)}}let Z;if(r?.unsafe?.capnp){let e=O(r.unsafe.capnp);Z=`./capnp-${Date.now()}.compiled`,s.set(Z,new File([e],Z,{type:`application/octet-stream`}))}let Q;_&&(Q??=[],Q.push(`plain_text`,`json`)),v&&(Q??=[],Q.push(`secret_text`,`secret_key`)),y&&(Q??=[],Q.push(...y));let $={...d.type===`commonjs`?{body_part:d.name}:{main_module:d.name},bindings:F,containers:e.containers===void 0?void 0:e.containers.map(e=>({...e.name!==void 0&&{name:e.name},...e.class_name!==void 0&&{class_name:e.class_name},...e.images!==void 0&&{images:e.images}})),...h&&{compatibility_date:h},...g&&{compatibility_flags:g},...p&&{migrations:p},...m&&Object.keys(m).length>0&&{exports:m},capnp_schema:Z,...Q&&{keep_bindings:Q},...b!==void 0&&{logpush:b},...x&&{placement:x},...S&&{tail_consumers:S},...C&&{streaming_tail_consumers:C},...w&&{limits:w},...T&&{annotations:T},...E!==void 0&&{keep_assets:E},...D&&{assets:{jwt:D.jwt,config:N}},...k&&{observability:k},...j&&{cache_options:j},...M?.length&&{package_dependencies:M}};if(r?.unsafe?.metadata!==void 0)for(let e of Object.keys(r.unsafe.metadata))$[e]=r.unsafe.metadata[e];if(s.set(`metadata`,JSON.stringify($)),d.type===`commonjs`&&P&&P.length>0)throw TypeError(`More than one module can only be specified when type = 'esm'`);for(let e of[d].concat(P||[]))s.set(e.name,new File([e.content],e.name,{type:A(e.type??d.type??`esm`)}));for(let e of f||[])s.set(e.name,new File([e.content],e.name,{type:`application/source-map`}));return s}y(M,`createWorkerUploadForm`);export{S as a,w as c,x as i,j as n,y as o,k as r,b as s,M as t};
+import{r as e,t}from"./chunk-vbHwaUoU.mjs";import{Dt as n,I as r,at as i,f as a,k as o}from"./dist-DV7LR38l.mjs";import{createRequire as s}from"node:module";import{readFileSync as c}from"node:fs";import l from"node:assert";import u,{resolve as d}from"node:path";import{spawnSync as f}from"node:child_process";var p=Object.create,m=Object.defineProperty,h=Object.getOwnPropertyDescriptor,g=Object.getOwnPropertyNames,_=Object.getPrototypeOf,v=Object.prototype.hasOwnProperty,y=(e,t)=>m(e,`name`,{value:t,configurable:!0}),b=e===void 0?s(import.meta.url):e,x=(e,t)=>function(){return t||(0,e[g(e)[0]])((t={exports:{}}).exports,t),t.exports},S=(e,t)=>{for(var n in t)m(e,n,{get:t[n],enumerable:!0})},C=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(let i of g(t))!v.call(e,i)&&i!==n&&m(e,i,{get:()=>t[i],enumerable:!(r=h(t,i))||r.enumerable});return e},w=(e,t,n)=>(n=e==null?{}:p(_(e)),C(t||!e||!e.__esModule?m(n,`default`,{value:e,enumerable:!0}):n,e)),T=t(((t,n)=>{var r=e(`child_process`).exec,i=e(`child_process`).execSync,a=e(`fs`),o=e(`path`),s=a.access,c=a.accessSync,l=a.constants||a,u=process.platform==`win32`,d=function(e,t){s(e,l.F_OK,function(e){t(!e)})},f=function(e){try{return c(e,l.F_OK),!1}catch{return!0}},p=function(e,t){s(e,l.F_OK|l.X_OK,function(e){t(null,!e)})},m=function(e){try{return c(e,l.F_OK|l.X_OK),!0}catch{return!1}},h=function(e,t,n){d(e,function(i){if(!i){r(`command -v `+t+` 2>/dev/null && { echo >&1 `+t+`; exit 0; }`,function(e,t,r){n(null,!!t)});return}p(e,n)})},g=function(e,t,n){if(!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(e)){n(null,!1);return}r(`where `+t,function(e){e===null?n(null,!0):n(null,!1)})},_=function(e,t){if(f(e))try{return!!i(`command -v `+t+` 2>/dev/null && { echo >&1 `+t+`; exit 0; }`)}catch{return!1}return m(e)},v=function(e,t,n){if(!/^(?!(?:.*\s|.*\.|\W+)$)(?:[a-zA-Z]:)?(?:(?:[^<>:"\|\?\*\n])+(?:\/\/|\/|\\\\|\\)?)+$/m.test(e))return!1;try{return!!i(`where `+t,{stdio:[]})}catch{return!1}},y=function(e){return/[^A-Za-z0-9_\/:=-]/.test(e)&&(e=`'`+e.replace(/'/g,`'\\''`)+`'`,e=e.replace(/^(?:'')+/g,``).replace(/\\'''/g,`\\'`)),e};u&&(y=function(e){if(/[\\]/.test(e)){var t=`"`+o.dirname(e)+`"`,n=`"`+o.basename(e)+`"`;return t+`:`+n}return`"`+e+`"`}),n.exports=function e(t,n){var r=y(t);if(!n&&typeof Promise<`u`)return new Promise(function(n,r){e(t,function(e,i){i?n(t):r(e)})});u?g(t,r,n):h(t,r,n)},n.exports.sync=function(e){var t=y(e);return u?v(e,t):_(e,t)}})),E=t(((e,t)=>{t.exports=T()})),ee=r(),D=E();function O(e){if(e.compiled_schema)return c(d(e.compiled_schema));let{base_path:t,source_schemas:r}=e,i=(r??[]).map(e=>d(t,e));if(!(0,D.sync)(`capnp`))throw new n(`The capnp compiler is required to upload capnp schemas, but is not present.`,{telemetryMessage:`capnp compiler missing`});let a=f(`capnp`,[`compile`,`-o-`,`--src-prefix=${d(t??`.`)}`,...i],{maxBuffer:3*1024*1024});if(a.error)throw a.error;if(a.stderr.length)throw Error(a.stderr.toString());return a.stdout}y(O,`handleUnsafeCapnp`);var k={esm:`application/javascript+module`,commonjs:`application/javascript`,"compiled-wasm":`application/wasm`,buffer:`application/octet-stream`,text:`text/plain`,python:`text/x-python`,"python-requirement":`text/x-python-requirement`};function A(e){let t=k[e];if(t===void 0)throw TypeError(`Unsupported module: `+e);return t}y(A,`toMimeType`);function j(e){let t=Object.keys(k).find(t=>k[t]===e);if(t===void 0)throw TypeError(`Unsupported mime type: `+e);return t}y(j,`fromMimeType`);function M(e,t,r){let s=new ee.FormData,{main:d,sourceMaps:f,migrations:p,exports:m,compatibility_date:h,compatibility_flags:g,keepVars:_,keepSecrets:v,keepBindings:y,logpush:b,placement:x,tail_consumers:S,streaming_tail_consumers:C,limits:w,annotations:T,keep_assets:E,assets:D,observability:k,cache:j,package_dependencies:M}=e,N={html_handling:D?.assetConfig?.html_handling,not_found_handling:D?.assetConfig?.not_found_handling,run_worker_first:D?.run_worker_first,_redirects:D?._redirects,_headers:D?._headers};if(D&&!D.routerConfig.has_user_worker)return s.set(`metadata`,JSON.stringify({assets:{jwt:D.jwt,config:N},...T&&{annotations:T},...h&&{compatibility_date:h},...g&&{compatibility_flags:g}})),s;let{modules:P}=e,F=[],te=a(`plain_text`,t),ne=a(`json`,t),re=a(`secret_text`,t),ie=a(`kv_namespace`,t),I=a(`send_email`,t),ae=a(`durable_object_namespace`,t),oe=a(`workflow`,t),se=a(`queue`,t),ce=a(`r2_bucket`,t),le=a(`d1`,t),ue=a(`vectorize`,t),de=a(`ai_search_namespace`,t),L=a(`ai_search`,t),R=a(`agent_memory`,t),z=a(`hyperdrive`,t),B=a(`secrets_store_secret`,t),V=a(`artifacts`,t),fe=a(`unsafe_hello_world`,t),pe=a(`flagship`,t),me=a(`ratelimit`,t),he=a(`vpc_service`,t),ge=a(`vpc_network`,t),_e=a(`service`,t),H=a(`analytics_engine`,t),ve=a(`dispatch_namespace`,t),ye=a(`mtls_certificate`,t),be=a(`pipeline`,t),xe=a(`worker_loader`,t),Se=a(`logfwdr`,t),Ce=a(`wasm_module`,t),U=a(`browser`,t)[0],W=a(`ai`,t)[0],G=a(`images`,t)[0],K=a(`stream`,t)[0],q=a(`media`,t)[0],J=a(`version_metadata`,t)[0],Y=a(`assets`,t)[0],we=a(`text_blob`,t),Te=a(`data_blob`,t);a(`inherit`,t).forEach(({binding:e})=>{F.push({name:e,type:`inherit`})}),te.forEach(({binding:e,value:t})=>{F.push({name:e,type:`plain_text`,text:t})}),ne.forEach(({binding:e,value:t})=>{F.push({name:e,type:`json`,json:t})}),re.forEach(({binding:e,value:t})=>{F.push({name:e,type:`secret_text`,text:t})}),ie.forEach(({id:e,binding:t,raw:a})=>{if(r?.dryRun&&(e??=i),e===void 0)throw new n(`${t} bindings must have an "id" field`,{telemetryMessage:`kv namespace binding missing id`});e===i?F.push({name:t,type:`inherit`}):F.push({name:t,type:`kv_namespace`,namespace_id:e,raw:a})}),I.forEach(e=>{let t={name:e.name,type:`send_email`,allowed_sender_addresses:e.allowed_sender_addresses};e.destination_address===void 0?e.allowed_destination_addresses===void 0?F.push(t):F.push({...t,allowed_destination_addresses:e.allowed_destination_addresses}):F.push({...t,destination_address:e.destination_address})}),ae.forEach(({name:e,class_name:t,script_name:n,environment:r})=>{F.push({name:e,type:`durable_object_namespace`,class_name:t,...n&&{script_name:n},...r&&{environment:r}})}),oe.forEach(({binding:e,name:t,class_name:n,script_name:r,raw:i})=>{F.push({type:`workflow`,name:e,workflow_name:t,class_name:n,script_name:r,raw:i})}),se.forEach(({binding:e,queue_name:t,delivery_delay:a,raw:o})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "queue" field. Add a "queue" field to the producer in your Worker configuration specifying the name of the Queue to bind to.`,{telemetryMessage:`queue binding missing name`});t===i?F.push({name:e,type:`inherit`}):F.push({type:`queue`,name:e,queue_name:t,delivery_delay:a,raw:o})}),ce.forEach(({binding:e,bucket_name:t,jurisdiction:a,raw:o})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "bucket_name" field. Add a "bucket_name" field to the binding in your Worker configuration specifying the name of the R2 bucket to bind to.`,{telemetryMessage:`r2 bucket binding missing bucket_name`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`r2_bucket`,bucket_name:t,jurisdiction:a,raw:o})}),le.forEach(({binding:e,database_id:t,database_internal_env:a,raw:o})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "database_id" field. Add a "database_id" field to the binding in your Worker configuration specifying the ID of the D1 database to bind to.`,{telemetryMessage:`d1 database binding missing database_id`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`d1`,id:t,internalEnv:a,raw:o})}),ue.forEach(({binding:e,index_name:t,raw:n})=>{F.push({name:e,type:`vectorize`,index_name:t,raw:n})}),de.forEach(({binding:e,namespace:t})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the AI Search namespace to bind to.`,{telemetryMessage:`ai search namespace binding missing namespace`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`ai_search_namespace`,namespace:t})}),L.forEach(({binding:e,instance_name:t})=>{F.push({name:e,type:`ai_search`,instance_name:t})}),R.forEach(({binding:e,namespace:t})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the namespace to bind to.`,{telemetryMessage:!1});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`agent_memory`,namespace:t})}),z.forEach(({binding:e,id:t})=>{F.push({name:e,type:`hyperdrive`,id:t})}),B.forEach(({binding:e,store_id:t,secret_name:n})=>{F.push({name:e,type:`secrets_store_secret`,store_id:t,secret_name:n})}),V.forEach(({binding:e,namespace:t})=>{F.push({name:e,type:`artifacts`,namespace:t})}),fe.forEach(({binding:e,enable_timer:t})=>{F.push({name:e,type:`unsafe_hello_world`,enable_timer:t})}),pe.forEach(({binding:e,app_id:t})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have an "app_id" field. Add an "app_id" field to the binding in your Worker configuration specifying the Flagship app to bind to.`,{telemetryMessage:`flagship binding missing app id`});F.push(t===i?{name:e,type:`inherit`}:{name:e,type:`flagship`,app_id:t})}),me.forEach(({name:e,namespace_id:t,simple:n})=>{F.push({name:e,type:`ratelimit`,namespace_id:t,simple:n})}),he.forEach(({binding:e,service_id:t})=>{F.push({name:e,type:`vpc_service`,service_id:t})}),ge.forEach(({binding:e,tunnel_id:t,network_id:n})=>{F.push({name:e,type:`vpc_network`,...t===void 0?{network_id:n}:{tunnel_id:t}})}),_e.forEach(({binding:e,service:t,environment:n,entrypoint:r,props:i,cross_account_grant:a})=>{F.push({name:e,type:`service`,service:t,cross_account_grant:a,...n&&{environment:n},...r&&{entrypoint:r},...i&&{props:i}})}),H.forEach(({binding:e,dataset:t})=>{F.push({name:e,type:`analytics_engine`,dataset:t})}),ve.forEach(({binding:e,namespace:t,outbound:a})=>{if(r?.dryRun&&(t??=i),t===void 0)throw new n(`${e} bindings must have a "namespace" field. Add a "namespace" field to the binding in your Worker configuration specifying the dispatch namespace to bind to.`,{telemetryMessage:`dispatch namespace binding missing namespace`});t===i?F.push({name:e,type:`inherit`}):F.push({name:e,type:`dispatch_namespace`,namespace:t,...a&&{outbound:{worker:{service:a.service,environment:a.environment},params:a.parameters?.map(e=>({name:e}))}}})}),ye.forEach(({binding:e,certificate_id:t})=>{F.push({name:e,type:`mtls_certificate`,certificate_id:t})}),be.forEach(({binding:e,stream:t,pipeline:n})=>{if(t)F.push({name:e,type:`pipelines`,stream:t});else if(n)F.push({name:e,type:`pipelines`,pipeline:n});else throw Error(`Pipeline binding must specify a stream or pipeline`)}),xe.forEach(({binding:e})=>{F.push({name:e,type:`worker_loader`})}),Se.forEach(({name:e,destination:t})=>{F.push({name:e,type:`logfwdr`,destination:t})}),Ce.forEach(({binding:e,source:t})=>{F.push({name:e,type:`wasm_module`,part:e}),s.set(e,new File([`contents`in t?t.contents:c(t.path)],`path`in t?t.path??e:e,{type:`application/wasm`}))}),U!==void 0&&F.push({name:U.binding,type:`browser`,raw:U.raw}),W!==void 0&&F.push({name:W.binding,staging:W.staging,type:`ai`,raw:W.raw}),G!==void 0&&F.push({name:G.binding,type:`images`,raw:G.raw}),K!==void 0&&F.push({name:K.binding,type:`stream`}),q!==void 0&&F.push({name:q.binding,type:`media`}),J!==void 0&&F.push({name:J.binding,type:`version_metadata`}),Y!==void 0&&F.push({name:Y.binding,type:`assets`}),we.forEach(({binding:e,source:t})=>{F.push({name:e,type:`text_blob`,part:e}),e!==`__STATIC_CONTENT_MANIFEST`&&(`contents`in t?s.set(e,new File([t.contents],t.path??e,{type:`text/plain`})):s.set(e,new File([c(t.path)],t.path,{type:`text/plain`})))}),Te.forEach(({binding:e,source:t})=>{F.push({name:e,type:`data_blob`,part:e}),s.set(e,new File([`contents`in t?t.contents:c(t.path)],`path`in t?t.path??e:e,{type:`application/octet-stream`}))});for(let[e,n]of Object.entries(t??{}))if(o(n.type)&&n.type!==`unsafe_hello_world`){let{type:t,...r}=n;F.push({name:e,type:t.slice(7),...r})}let X=`__STATIC_CONTENT_MANIFEST`;if(P?.some(({name:e})=>e===X)&&d.type===`esm`){l(P!==void 0);let e=new Set(P.map(e=>u.posix.dirname(e.name)));for(let t of e){if(t===`.`)continue;let e=u.posix.relative(t,X),n=u.posix.join(t,X);P.push({name:n,filePath:n,content:`export { default } from ${JSON.stringify(e)};`,type:`esm`})}}if(d.type===`commonjs`){for(let e of Object.values([...P||[]]))if(e.name===`__STATIC_CONTENT_MANIFEST`)s.set(e.name,new File([e.content],e.name,{type:`text/plain`})),P=P?.filter(t=>t!==e);else if(e.type===`compiled-wasm`||e.type===`text`||e.type===`buffer`){let t=e.name.replace(/[^a-zA-Z0-9_$]/g,`_`);F.push({name:t,type:e.type===`compiled-wasm`?`wasm_module`:e.type===`text`?`text_blob`:`data_blob`,part:t}),s.set(t,new File([e.content],e.name,{type:e.type===`compiled-wasm`?`application/wasm`:e.type===`text`?`text/plain`:`application/octet-stream`})),P=P?.filter(t=>t!==e)}}let Z;if(r?.unsafe?.capnp){let e=O(r.unsafe.capnp);Z=`./capnp-${Date.now()}.compiled`,s.set(Z,new File([e],Z,{type:`application/octet-stream`}))}let Q;_&&(Q??=[],Q.push(`plain_text`,`json`)),v&&(Q??=[],Q.push(`secret_text`,`secret_key`)),y&&(Q??=[],Q.push(...y));let $={...d.type===`commonjs`?{body_part:d.name}:{main_module:d.name},bindings:F,containers:e.containers===void 0?void 0:e.containers.map(e=>({...e.name!==void 0&&{name:e.name},...e.class_name!==void 0&&{class_name:e.class_name},...e.images!==void 0&&{images:e.images}})),...h&&{compatibility_date:h},...g&&{compatibility_flags:g},...p&&{migrations:p},...m&&Object.keys(m).length>0&&{exports:m},capnp_schema:Z,...Q&&{keep_bindings:Q},...b!==void 0&&{logpush:b},...x&&{placement:x},...S&&{tail_consumers:S},...C&&{streaming_tail_consumers:C},...w&&{limits:w},...T&&{annotations:T},...E!==void 0&&{keep_assets:E},...D&&{assets:{jwt:D.jwt,config:N}},...k&&{observability:k},...j&&{cache_options:j},...M?.length&&{package_dependencies:M}};if(r?.unsafe?.metadata!==void 0)for(let e of Object.keys(r.unsafe.metadata))$[e]=r.unsafe.metadata[e];if(s.set(`metadata`,JSON.stringify($)),d.type===`commonjs`&&P&&P.length>0)throw TypeError(`More than one module can only be specified when type = 'esm'`);for(let e of[d].concat(P||[]))s.set(e.name,new File([e.content],e.name,{type:A(e.type??d.type??`esm`)}));for(let e of f||[])s.set(e.name,new File([e.content],e.name,{type:`application/source-map`}));return s}y(M,`createWorkerUploadForm`);export{S as a,w as c,x as i,j as n,y as o,k as r,b as s,M as t};