cf 0.4.0 → 0.6.0

package/dist/{secrets-store-CBX0dvHL.mjs → secrets-store-B7_HkE8I.mjs}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
-import{C as e,D as t,T as n,_ as r,n as i}from"./auth-BqDOIrKX.mjs";import{n as a,t as o}from"./body-parser-CBpeIUns.mjs";import{t as s}from"./output-CUxZRM5A.mjs";import{n as c,t as l}from"./progress-Cent9Lsg.mjs";import{n as u}from"./input-validation-CTqtyiY9.mjs";import{t as d}from"./local-D8bhHUMK.mjs";import{t as f}from"./cli-types-CMNMD1V7.mjs";function p(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const m={command:`get`,describe:`Lists the number of secrets used in the account.`,builder:p,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/quota`,pathParams:{},bodyKind:`none`});return}let n=await i(t),a=t.local?d:await r(n);t.accountId=a,s(await l(`Loading`,async()=>n.secretsStore.quota.get({account_id:a})),{successLabel:`Loaded`})}},ee={command:`quota`,describe:`Account quota limits for secrets stores, secrets count, and storage capacity`,builder:e=>e.command(m).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function h(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const g={command:`create <store-id>`,describe:`Creates a secret in the account`,builder:h,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store secrets bulk create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}/secrets`,pathParams:{"store-id":String(t[`store-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:a(t.body)});return}let n=await i(t),o=t.local?d:await r(n);if(t.accountId=o,t.body){let e=a(t.body);s(await l(`Creating`,async()=>n.secretsStore.secrets.bulk.create({body:e,account_id:o,store_id:t[`store-id`]})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function _(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`ids`,{type:`string`,array:!0,description:`List of secret identifier tags to delete.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Request body for bulk deleting secrets`})}const v={command:`delete <store-id>`,describe:`Deletes one or more secrets`,builder:_,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store secrets bulk delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}/secrets`,pathParams:{"store-id":String(t[`store-id`]??``)},bodyKind:`json`,body:t.body===void 0?o({ids:t.ids}):a(t.body)});return}let u=await i(t),f=t.local?d:await r(u);if(t.accountId=f,!await n({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=a(t.body);s(await l(`Deleting`,async()=>u.secretsStore.secrets.bulk.delete({body:e,account_id:f,store_id:t[`store-id`]})),{successLabel:`Deleted`});return}if(t.ids===void 0)throw Error(`--ids is required (or pass --body with this field set).`);let p=o({ids:t.ids});s(await l(`Deleting`,async()=>u.secretsStore.secrets.bulk.delete({body:p,account_id:f,store_id:t[`store-id`]})),{successLabel:`Deleted`})}},y={command:`bulk`,describe:`Encrypted key-value secrets within a store. Pass --store-id to scope.`,builder:e=>e.command(g).command(v).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function b(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const x={command:`delete <secret-id>`,describe:`Deletes a single secret`,builder:b,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store secrets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}/secrets/${t[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(t[`secret-id`]))}`,pathParams:{"store-id":String(t[`store-id`]??``),"secret-id":String(t[`secret-id`]??``)},bodyKind:`none`});return}let a=await i(t),o=t.local?d:await r(a);if(t.accountId=o,!await n({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}s(await l(`Deleting`,async()=>a.secretsStore.secrets.delete({account_id:o,store_id:t[`store-id`],secret_id:t[`secret-id`]})),{successLabel:`Deleted`})}};function S(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`name`,{type:`string`,description:`The name of the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const C={command:`duplicate <secret-id>`,describe:`Duplicates the secret, keeping the value`,builder:S,handler:async n=>{if(n.dryRun){c({command:`cf secrets-store secrets duplicate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${n[`store-id`]==null?`<store-id>`:encodeURIComponent(String(n[`store-id`]))}/secrets/${n[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(n[`secret-id`]))}/duplicate`,pathParams:{"store-id":String(n[`store-id`]??``),"secret-id":String(n[`secret-id`]??``)},bodyKind:`json`,body:n.body===void 0?o({comment:u(n.comment,`comment`,`text`),name:u(n.name,`name`,`text`),scopes:n.scopes}):a(n.body)});return}let f=await i(n),p=n.local?d:await r(f);if(n.accountId=p,n.body){let e=a(n.body);s(await l(`Creating`,async()=>f.secretsStore.secrets.duplicate({body:e,account_id:p,store_id:n[`store-id`],secret_id:n[`secret-id`]})),{successLabel:`Created`});return}if(n.name===void 0&&(n.name=await t(`name`,`The name of the secret`)),n.scopes===void 0)throw Error(`--scopes is required (or pass --body with this field set).`);let m=o({comment:u(n.comment,`comment`,`text`),name:u(n.name,`name`,`text`),scopes:n.scopes});s(await l(`Creating`,async()=>f.secretsStore.secrets.duplicate({body:m,account_id:p,store_id:n[`store-id`],secret_id:n[`secret-id`]})),{successLabel:`Created`})}};function w(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`value`,{type:`string`,description:`The value of the secret. Maximum 64 KiB (65,536 bytes). Note that this is 'write only' - no API response will provide this value, it is only used to create/modify secrets.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const T={command:`edit <secret-id>`,describe:`Updates a single secret`,builder:w,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store secrets edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}/secrets/${t[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(t[`secret-id`]))}`,pathParams:{"store-id":String(t[`store-id`]??``),"secret-id":String(t[`secret-id`]??``)},bodyKind:`json`,body:t.body===void 0?o({comment:u(t.comment,`comment`,`text`),scopes:t.scopes,value:u(t.value,`value`,`text`)}):a(t.body)});return}let n=await i(t),f=t.local?d:await r(n);if(t.accountId=f,t.body){let e=a(t.body);s(await l(`Updating`,async()=>n.secretsStore.secrets.edit({body:e,account_id:f,store_id:t[`store-id`],secret_id:t[`secret-id`]})),{successLabel:`Updated`});return}let p=o({comment:u(t.comment,`comment`,`text`),scopes:t.scopes,value:u(t.value,`value`,`text`)});s(await l(`Updating`,async()=>n.secretsStore.secrets.edit({body:p,account_id:f,store_id:t[`store-id`],secret_id:t[`secret-id`]})),{successLabel:`Updated`})}};function E(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const D={command:`get <secret-id>`,describe:`Returns details of a single secret`,builder:E,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store secrets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}/secrets/${t[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(t[`secret-id`]))}`,pathParams:{"store-id":String(t[`store-id`]??``),"secret-id":String(t[`secret-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?d:await r(n);t.accountId=a,s(await l(`Loading`,async()=>n.secretsStore.secrets.get({account_id:a,store_id:t[`store-id`],secret_id:t[`secret-id`]})),{successLabel:`Loaded`})}};function O(e){return e.option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`search`,{type:`string`,description:`Search secrets using a filter string, filtering across name and comment`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`scopes`,{type:`string`,description:`Only secrets with the given scopes will be returned`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const k={command:`list`,describe:`Lists all store secrets`,builder:f(O),handler:async t=>{let n={direction:t.direction,page:t.page,per_page:t[`per-page`],search:t.search,order:t.order,scopes:t.scopes};if(t.dryRun){c({command:`cf secrets-store secrets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}/secrets`,pathParams:{"store-id":String(t[`store-id`]??``)},query:n,bodyKind:`none`});return}let a=await i(t),o=t.local?d:await r(a);t.accountId=o,s(await l(`Loading`,async()=>a.secretsStore.secrets.list({account_id:o,store_id:t[`store-id`],...n})),{successLabel:`Loaded`})}},A={command:`secrets`,describe:`Encrypted key-value secrets within a store. Pass --store-id to scope.`,builder:e=>e.command(x).command(C).command(T).command(D).command(k).command(y).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function j(e){return e.option(`name`,{type:`string`,description:`The name of the store`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const M={command:`create`,describe:`Creates a store in the account`,builder:j,handler:async n=>{if(n.dryRun){c({command:`cf secrets-store stores create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores`,pathParams:{},bodyKind:`json`,body:n.body===void 0?o({name:u(n.name,`name`,`text`)}):a(n.body)});return}let f=await i(n),p=n.local?d:await r(f);if(n.accountId=p,n.body){let e=a(n.body);s(await l(`Creating`,async()=>f.secretsStore.stores.create({...e,account_id:p})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the store`));let m=o({name:u(n.name,`name`,`text`)});s(await l(`Creating`,async()=>f.secretsStore.stores.create({...m,account_id:p})),{successLabel:`Created`})}};function N(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`force`,{type:`boolean`,description:`When true, cascade-deletes all secrets in the store before deleting
+import{O as e,P as t}from"./oauth-B5k80sip.mjs";import{n}from"./auth-DX9KnJ0P.mjs";import{n as r,t as i}from"./body-parser-DWSy7uZ8.mjs";import{t as a}from"./output-B6fBFRqe.mjs";import{n as o,t as s}from"./progress-CL8I-7YK.mjs";import{n as c}from"./input-validation-_fMCApaH.mjs";import{t as l}from"./local-CYc9q7l2.mjs";import{r as u,t as d}from"./prompt-q3B7sM2A.mjs";import{t as f}from"./cli-types-DGgEbf8K.mjs";function p(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const m={command:`get`,describe:`Lists the number of secrets used in the account.`,builder:p,handler:async r=>{if(r.dryRun){o({command:`cf secrets-store quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/quota`,pathParams:{},bodyKind:`none`});return}let i=await n(r),c=r.local?l:await e();r.accountId=c,a(await s(`Loading`,async()=>i.secretsStore.quota.get({account_id:c})),{successLabel:`Loaded`})}},ee={command:`quota`,describe:`Account quota limits for secrets stores, secrets count, and storage capacity`,builder:e=>e.command(m).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function h(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const g={command:`create <store-id>`,describe:`Creates a secret in the account`,builder:h,handler:async i=>{if(i.dryRun){o({command:`cf secrets-store secrets bulk create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${i[`store-id`]==null?`<store-id>`:encodeURIComponent(String(i[`store-id`]))}/secrets`,pathParams:{"store-id":String(i[`store-id`]??``)},bodyKind:`json`,body:i.body===void 0?void 0:r(i.body)});return}let c=await n(i),u=i.local?l:await e();if(i.accountId=u,i.body){let e=r(i.body);a(await s(`Creating`,async()=>c.secretsStore.secrets.bulk.create({body:e,account_id:u,store_id:i[`store-id`]})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function _(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`ids`,{type:`string`,array:!0,description:`List of secret identifier tags to delete.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Request body for bulk deleting secrets`})}const v={command:`delete <store-id>`,describe:`Deletes one or more secrets`,builder:_,handler:async c=>{if(c.dryRun){o({command:`cf secrets-store secrets bulk delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${c[`store-id`]==null?`<store-id>`:encodeURIComponent(String(c[`store-id`]))}/secrets`,pathParams:{"store-id":String(c[`store-id`]??``)},bodyKind:`json`,body:c.body===void 0?i({ids:c.ids}):r(c.body)});return}let u=await n(c),f=c.local?l:await e();if(c.accountId=f,!await d({force:!!c.force})){process.stderr.write(`Aborted.
+`);return}if(c.body){let e=r(c.body);a(await s(`Deleting`,async()=>u.secretsStore.secrets.bulk.delete({body:e,account_id:f,store_id:c[`store-id`]})),{successLabel:`Deleted`});return}if(c.ids===void 0)throw Error(`--ids is required (or pass --body with this field set).`);let p=i({ids:c.ids});a(await s(`Deleting`,async()=>u.secretsStore.secrets.bulk.delete({body:p,account_id:f,store_id:c[`store-id`]})),{successLabel:`Deleted`})}},y={command:`bulk`,describe:`Encrypted key-value secrets within a store. Pass --store-id to scope.`,builder:e=>e.command(g).command(v).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function b(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const x={command:`delete <secret-id>`,describe:`Deletes a single secret`,builder:b,handler:async r=>{if(r.dryRun){o({command:`cf secrets-store secrets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${r[`store-id`]==null?`<store-id>`:encodeURIComponent(String(r[`store-id`]))}/secrets/${r[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(r[`secret-id`]))}`,pathParams:{"store-id":String(r[`store-id`]??``),"secret-id":String(r[`secret-id`]??``)},bodyKind:`none`});return}let i=await n(r),c=r.local?l:await e();if(r.accountId=c,!await d({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>i.secretsStore.secrets.delete({account_id:c,store_id:r[`store-id`],secret_id:r[`secret-id`]})),{successLabel:`Deleted`})}};function S(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`name`,{type:`string`,description:`The name of the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const C={command:`duplicate <secret-id>`,describe:`Duplicates the secret, keeping the value`,builder:S,handler:async d=>{if(d.dryRun){o({command:`cf secrets-store secrets duplicate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${d[`store-id`]==null?`<store-id>`:encodeURIComponent(String(d[`store-id`]))}/secrets/${d[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(d[`secret-id`]))}/duplicate`,pathParams:{"store-id":String(d[`store-id`]??``),"secret-id":String(d[`secret-id`]??``)},bodyKind:`json`,body:d.body===void 0?i({comment:c(d.comment,`comment`,`text`),name:c(d.name,`name`,`text`),scopes:d.scopes}):r(d.body)});return}let f=await n(d),p=d.local?l:await e();if(d.accountId=p,d.body){let e=r(d.body);a(await s(`Creating`,async()=>f.secretsStore.secrets.duplicate({body:e,account_id:p,store_id:d[`store-id`],secret_id:d[`secret-id`]})),{successLabel:`Created`});return}if(d.name===void 0&&(d.name=await u(`name`,`The name of the secret`)),d.scopes===void 0)throw Error(`--scopes is required (or pass --body with this field set).`);let m=i({comment:c(d.comment,`comment`,`text`),name:c(d.name,`name`,`text`),scopes:d.scopes});a(await s(`Creating`,async()=>f.secretsStore.secrets.duplicate({body:m,account_id:p,store_id:d[`store-id`],secret_id:d[`secret-id`]})),{successLabel:`Created`})}};function w(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`value`,{type:`string`,description:`The value of the secret. Maximum 64 KiB (65,536 bytes). Note that this is 'write only' - no API response will provide this value, it is only used to create/modify secrets.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const T={command:`edit <secret-id>`,describe:`Updates a single secret`,builder:w,handler:async u=>{if(u.dryRun){o({command:`cf secrets-store secrets edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${u[`store-id`]==null?`<store-id>`:encodeURIComponent(String(u[`store-id`]))}/secrets/${u[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(u[`secret-id`]))}`,pathParams:{"store-id":String(u[`store-id`]??``),"secret-id":String(u[`secret-id`]??``)},bodyKind:`json`,body:u.body===void 0?i({comment:c(u.comment,`comment`,`text`),scopes:u.scopes,value:c(u.value,`value`,`text`)}):r(u.body)});return}let d=await n(u),f=u.local?l:await e();if(u.accountId=f,u.body){let e=r(u.body);a(await s(`Updating`,async()=>d.secretsStore.secrets.edit({body:e,account_id:f,store_id:u[`store-id`],secret_id:u[`secret-id`]})),{successLabel:`Updated`});return}let p=i({comment:c(u.comment,`comment`,`text`),scopes:u.scopes,value:c(u.value,`value`,`text`)});a(await s(`Updating`,async()=>d.secretsStore.secrets.edit({body:p,account_id:f,store_id:u[`store-id`],secret_id:u[`secret-id`]})),{successLabel:`Updated`})}};function E(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const D={command:`get <secret-id>`,describe:`Returns details of a single secret`,builder:E,handler:async r=>{if(r.dryRun){o({command:`cf secrets-store secrets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${r[`store-id`]==null?`<store-id>`:encodeURIComponent(String(r[`store-id`]))}/secrets/${r[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(r[`secret-id`]))}`,pathParams:{"store-id":String(r[`store-id`]??``),"secret-id":String(r[`secret-id`]??``)},bodyKind:`none`});return}let i=await n(r),c=r.local?l:await e();r.accountId=c,a(await s(`Loading`,async()=>i.secretsStore.secrets.get({account_id:c,store_id:r[`store-id`],secret_id:r[`secret-id`]})),{successLabel:`Loaded`})}};function O(e){return e.option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`search`,{type:`string`,description:`Search secrets using a filter string, filtering across name and comment`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`scopes`,{type:`string`,description:`Only secrets with the given scopes will be returned`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const k={command:`list`,describe:`Lists all store secrets`,builder:f(O),handler:async r=>{let i={direction:r.direction,page:r.page,per_page:r[`per-page`],search:r.search,order:r.order,scopes:r.scopes};if(r.dryRun){o({command:`cf secrets-store secrets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${r[`store-id`]==null?`<store-id>`:encodeURIComponent(String(r[`store-id`]))}/secrets`,pathParams:{"store-id":String(r[`store-id`]??``)},query:i,bodyKind:`none`});return}let c=await n(r),u=r.local?l:await e();r.accountId=u,a(await s(`Loading`,async()=>c.secretsStore.secrets.list({account_id:u,store_id:r[`store-id`],...i})),{successLabel:`Loaded`})}},A={command:`secrets`,describe:`Encrypted key-value secrets within a store. Pass --store-id to scope.`,builder:e=>e.command(x).command(C).command(T).command(D).command(k).command(y).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function j(e){return e.option(`name`,{type:`string`,description:`The name of the store`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const M={command:`create`,describe:`Creates a store in the account`,builder:j,handler:async d=>{if(d.dryRun){o({command:`cf secrets-store stores create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores`,pathParams:{},bodyKind:`json`,body:d.body===void 0?i({name:c(d.name,`name`,`text`)}):r(d.body)});return}let f=await n(d),p=d.local?l:await e();if(d.accountId=p,d.body){let e=r(d.body);a(await s(`Creating`,async()=>f.secretsStore.stores.create({...e,account_id:p})),{successLabel:`Created`});return}d.name===void 0&&(d.name=await u(`name`,`The name of the store`));let m=i({name:c(d.name,`name`,`text`)});a(await s(`Creating`,async()=>f.secretsStore.stores.create({...m,account_id:p})),{successLabel:`Created`})}};function N(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`force`,{type:`boolean`,description:`When true, cascade-deletes all secrets in the store before deleting
 the store itself. Required when deleting a non-empty store. Without
-this parameter, attempting to delete a non-empty store returns 409.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P={command:`delete <store-id>`,describe:'Deletes a single store. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the "store_not_empty" error. Pass `force=true` to cascade-delete all secrets in the store. Empty stores are always deleted regardless of the force parameter.',builder:N,handler:async t=>{let a={force:t.force};if(t.dryRun){c({command:`cf secrets-store stores delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}`,pathParams:{"store-id":String(t[`store-id`]??``)},query:a,bodyKind:`none`});return}let o=await i(t),u=t.local?d:await r(o);if(t.accountId=u,!await n({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}s(await l(`Deleting`,async()=>o.secretsStore.stores.delete({account_id:u,store_id:t[`store-id`],...a})),{successLabel:`Deleted`})}};function F(e){return e.option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const I={command:`list`,describe:`Lists all the stores in an account`,builder:f(F),handler:async t=>{let n={direction:t.direction,page:t.page,per_page:t[`per-page`],order:t.order};if(t.dryRun){c({command:`cf secrets-store stores list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores`,pathParams:{},query:n,bodyKind:`none`});return}let a=await i(t),o=t.local?d:await r(a);t.accountId=o,s(await l(`Loading`,async()=>a.secretsStore.stores.list({account_id:o,...n})),{successLabel:`Loaded`})}},L={command:`stores`,describe:`Secret stores that hold encrypted key-value secrets accessible by Workers and services`,builder:e=>e.command(M).command(P).command(I).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function R(e){return e.positional(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31'). This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`account-id`,{type:`number`,description:`Account internal ID (numeric). Required for system API routes.
+this parameter, attempting to delete a non-empty store returns 409.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P={command:`delete <store-id>`,describe:'Deletes a single store. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the "store_not_empty" error. Pass `force=true` to cascade-delete all secrets in the store. Empty stores are always deleted regardless of the force parameter.',builder:N,handler:async r=>{let i={force:r.force};if(r.dryRun){o({command:`cf secrets-store stores delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${r[`store-id`]==null?`<store-id>`:encodeURIComponent(String(r[`store-id`]))}`,pathParams:{"store-id":String(r[`store-id`]??``)},query:i,bodyKind:`none`});return}let c=await n(r),u=r.local?l:await e();if(r.accountId=u,!await d({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.secretsStore.stores.delete({account_id:u,store_id:r[`store-id`],...i})),{successLabel:`Deleted`})}};function F(e){return e.option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const I={command:`list`,describe:`Lists all the stores in an account`,builder:f(F),handler:async r=>{let i={direction:r.direction,page:r.page,per_page:r[`per-page`],order:r.order};if(r.dryRun){o({command:`cf secrets-store stores list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores`,pathParams:{},query:i,bodyKind:`none`});return}let c=await n(r),u=r.local?l:await e();r.accountId=u,a(await s(`Loading`,async()=>c.secretsStore.stores.list({account_id:u,...i})),{successLabel:`Loaded`})}},L={command:`stores`,describe:`Secret stores that hold encrypted key-value secrets accessible by Workers and services`,builder:e=>e.command(M).command(P).command(I).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function R(e){return e.positional(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31'). This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`account-id`,{type:`number`,description:`Account internal ID (numeric). Required for system API routes.
 This value must remain consistent for all stores within an account
 managed by the same service.
-`}).option(`name`,{type:`string`,description:`The name of the store`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Request body for creating a store via system API routes`})}const z={command:`create <account-tag>`,describe:`Creates a store in the account on behalf of the calling service. The store will be marked as managed by the authenticated service. Requires account_id in the request body.`,builder:R,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores`,pathParams:{"account-tag":String(e[`account-tag`]??``)},bodyKind:`json`,body:e.body===void 0?o({account_id:e[`account-id`],name:u(e.name,`name`,`text`)}):a(e.body)});return}let n=await i(e);if(e.body){let t=a(e.body);s(await l(`Creating`,async()=>n.secretsStore.systemStores.create({...t,account_tag:e[`account-tag`]})),{successLabel:`Created`});return}if(e[`account-id`]===void 0)throw Error(`--account-id is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await t(`name`,`The name of the store`));let r=o({account_id:e[`account-id`],name:u(e.name,`name`,`text`)});s(await l(`Creating`,async()=>n.secretsStore.systemStores.create({...r,account_tag:e[`account-tag`]})),{successLabel:`Created`})}};function B(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+`}).option(`name`,{type:`string`,description:`The name of the store`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Request body for creating a store via system API routes`})}const z={command:`create <account-tag>`,describe:`Creates a store in the account on behalf of the calling service. The store will be marked as managed by the authenticated service. Requires account_id in the request body.`,builder:R,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores`,pathParams:{"account-tag":String(e[`account-tag`]??``)},bodyKind:`json`,body:e.body===void 0?i({account_id:e[`account-id`],name:c(e.name,`name`,`text`)}):r(e.body)});return}let t=await n(e);if(e.body){let n=r(e.body);a(await s(`Creating`,async()=>t.secretsStore.systemStores.create({...n,account_tag:e[`account-tag`]})),{successLabel:`Created`});return}if(e[`account-id`]===void 0)throw Error(`--account-id is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await u(`name`,`The name of the store`));let l=i({account_id:e[`account-id`],name:c(e.name,`name`,`text`)});a(await s(`Creating`,async()=>t.secretsStore.systemStores.create({...l,account_tag:e[`account-tag`]})),{successLabel:`Created`})}};function B(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
 This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`force`,{type:`boolean`,description:`When true, cascade-deletes all secrets in the store before deleting
 the store itself. Required when deleting a non-empty store. Without
-this parameter, attempting to delete a non-empty store returns 409.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const V={command:`delete <store-id>`,describe:'Deletes a store managed by the calling service. Returns 404 if the store doesn\'t exist or is not managed by the authenticated service. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the "store_not_empty" error. Pass `force=true` to cascade-delete all secrets in the store.',builder:B,handler:async e=>{let t={force:e.force};if(e.dryRun){c({command:`cf secrets-store system-stores delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},query:t,bodyKind:`none`});return}let r=await i(e);if(!await n({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}s(await l(`Deleting`,async()=>r.secretsStore.systemStores.delete({account_tag:e[`account-tag`],store_id:e[`store-id`],...t})),{successLabel:`Deleted`})}};function H(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const te={command:`id <store-id>`,describe:`Returns details of a single store`,builder:H,handler:async t=>{if(t.dryRun){c({command:`cf secrets-store system-stores get by id`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/secrets_store/stores/${t[`store-id`]==null?`<store-id>`:encodeURIComponent(String(t[`store-id`]))}`,pathParams:{"store-id":String(t[`store-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?d:await r(n);t.accountId=a,s(await l(`Loading`,async()=>n.secretsStore.systemStores.get.by.id({account_id:a,store_id:t[`store-id`]})),{successLabel:`Loaded`})}},U={command:`by`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(te).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function W(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const G={command:`v2 <store-id>`,describe:`Returns details of a single store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:W,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores get v2`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},bodyKind:`none`});return}let t=await i(e);s(await l(`Loading`,async()=>t.secretsStore.systemStores.get.v2({account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Loaded`})}},K={command:`get`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(G).command(U).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function q(e){return e.option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const J={command:`list`,describe:`Lists all stores in an account that are managed by the calling service. Only returns stores where managed_by matches the authenticated service.`,builder:f(q),handler:async e=>{let t={direction:e.direction,page:e.page,per_page:e[`per-page`],order:e.order};if(e.dryRun){c({command:`cf secrets-store system-stores list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores`,pathParams:{"account-tag":String(e[`account-tag`]??``)},query:t,bodyKind:`none`});return}let n=await i(e);s(await l(`Loading`,async()=>n.secretsStore.systemStores.list({account_tag:e[`account-tag`],...t})),{successLabel:`Loaded`})}};function Y(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const X={command:`create <store-id>`,describe:`Creates one or more secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:Y,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores secrets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:a(e.body)});return}let t=await i(e);if(e.body){let n=a(e.body);s(await l(`Creating`,async()=>t.secretsStore.systemStores.secrets.create({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Z(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Q={command:`id <secret-id>`,describe:`Deletes a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:Z,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores secrets delete by id`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`none`});return}let t=await i(e);if(!await n({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}s(await l(`Deleting`,async()=>t.secretsStore.systemStores.secrets.delete.by.id({account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Deleted`})}},ne={command:`by`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(Q).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function re(e){return e.option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`ids`,{type:`string`,array:!0,description:`List of secret identifier tags to delete.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Request body for bulk deleting secrets`})}const ie={command:`bulk`,describe:`Deletes one or more secrets from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:re,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores secrets delete system bulk`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},bodyKind:`json`,body:e.body===void 0?o({ids:e.ids}):a(e.body)});return}let t=await i(e);if(!await n({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}if(e.body){let n=a(e.body);s(await l(`Deleting`,async()=>t.secretsStore.systemStores.secrets.delete.system.bulk({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Deleted`});return}if(e.ids===void 0)throw Error(`--ids is required (or pass --body with this field set).`);let r=o({ids:e.ids});s(await l(`Deleting`,async()=>t.secretsStore.systemStores.secrets.delete.system.bulk({body:r,account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Deleted`})}},ae={command:`system`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(ie).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},oe={command:`delete`,describe:`Operations for system-stores.secrets.delete`,builder:e=>e.command(ne).command(ae).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function se(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`name`,{type:`string`,description:`The name of the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ce={command:`create <secret-id>`,describe:`Duplicates a secret in a store managed by the calling service, keeping the value. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:se,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores secrets duplicate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}/duplicate`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`json`,body:e.body===void 0?o({comment:u(e.comment,`comment`,`text`),name:u(e.name,`name`,`text`),scopes:e.scopes}):a(e.body)});return}let n=await i(e);if(e.body){let t=a(e.body);s(await l(`Creating`,async()=>n.secretsStore.systemStores.secrets.duplicate.create({body:t,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Created`});return}if(e.name===void 0&&(e.name=await t(`name`,`The name of the secret`)),e.scopes===void 0)throw Error(`--scopes is required (or pass --body with this field set).`);let r=o({comment:u(e.comment,`comment`,`text`),name:u(e.name,`name`,`text`),scopes:e.scopes});s(await l(`Creating`,async()=>n.secretsStore.systemStores.secrets.duplicate.create({body:r,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Created`})}},le={command:`duplicate`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(ce).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ue(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`value`,{type:`string`,description:`The value of the secret. Maximum 64 KiB (65,536 bytes). Note that this is 'write only' - no API response will provide this value, it is only used to create/modify secrets.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const de={command:`edit <secret-id>`,describe:`Updates a single secret in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:ue,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores secrets edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`json`,body:e.body===void 0?o({comment:u(e.comment,`comment`,`text`),scopes:e.scopes,value:u(e.value,`value`,`text`)}):a(e.body)});return}let t=await i(e);if(e.body){let n=a(e.body);s(await l(`Updating`,async()=>t.secretsStore.systemStores.secrets.edit({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Updated`});return}let n=o({comment:u(e.comment,`comment`,`text`),scopes:e.scopes,value:u(e.value,`value`,`text`)});s(await l(`Updating`,async()=>t.secretsStore.systemStores.secrets.edit({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Updated`})}};function fe(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pe={command:`get <secret-id>`,describe:`Returns details of a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:fe,handler:async e=>{if(e.dryRun){c({command:`cf secrets-store system-stores secrets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`none`});return}let t=await i(e);s(await l(`Loading`,async()=>t.secretsStore.systemStores.secrets.get({account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Loaded`})}};function $(e){return e.option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
-This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`search`,{type:`string`,description:`Search secrets using a filter string, filtering across name and comment`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`scopes`,{type:`string`,description:`Only secrets with the given scopes will be returned`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const me={command:`list`,describe:`Lists all secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:f($),handler:async e=>{let t={direction:e.direction,page:e.page,per_page:e[`per-page`],search:e.search,order:e.order,scopes:e.scopes};if(e.dryRun){c({command:`cf secrets-store system-stores secrets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e);s(await l(`Loading`,async()=>n.secretsStore.systemStores.secrets.list({account_tag:e[`account-tag`],store_id:e[`store-id`],...t})),{successLabel:`Loaded`})}},he={command:`secrets`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(X).command(de).command(pe).command(me).command(oe).command(le).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ge={command:`system-stores`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(z).command(V).command(J).command(K).command(he).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_e={command:`secrets-store`,describe:`Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products`,builder:e=>e.command(ee).command(A).command(L).command(ge).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{_e as default};
+this parameter, attempting to delete a non-empty store returns 409.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const V={command:`delete <store-id>`,describe:'Deletes a store managed by the calling service. Returns 404 if the store doesn\'t exist or is not managed by the authenticated service. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the "store_not_empty" error. Pass `force=true` to cascade-delete all secrets in the store.',builder:B,handler:async e=>{let t={force:e.force};if(e.dryRun){o({command:`cf secrets-store system-stores delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},query:t,bodyKind:`none`});return}let r=await n(e);if(!await d({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.secretsStore.systemStores.delete({account_tag:e[`account-tag`],store_id:e[`store-id`],...t})),{successLabel:`Deleted`})}};function H(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const te={command:`id <store-id>`,describe:`Returns details of a single store`,builder:H,handler:async r=>{if(r.dryRun){o({command:`cf secrets-store system-stores get by id`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/secrets_store/stores/${r[`store-id`]==null?`<store-id>`:encodeURIComponent(String(r[`store-id`]))}`,pathParams:{"store-id":String(r[`store-id`]??``)},bodyKind:`none`});return}let i=await n(r),c=r.local?l:await e();r.accountId=c,a(await s(`Loading`,async()=>i.secretsStore.systemStores.get.by.id({account_id:c,store_id:r[`store-id`]})),{successLabel:`Loaded`})}},U={command:`by`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(te).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function W(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const G={command:`v2 <store-id>`,describe:`Returns details of a single store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:W,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores get v2`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},bodyKind:`none`});return}let t=await n(e);a(await s(`Loading`,async()=>t.secretsStore.systemStores.get.v2({account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Loaded`})}},K={command:`get`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(G).command(U).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function q(e){return e.option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const J={command:`list`,describe:`Lists all stores in an account that are managed by the calling service. Only returns stores where managed_by matches the authenticated service.`,builder:f(q),handler:async e=>{let t={direction:e.direction,page:e.page,per_page:e[`per-page`],order:e.order};if(e.dryRun){o({command:`cf secrets-store system-stores list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores`,pathParams:{"account-tag":String(e[`account-tag`]??``)},query:t,bodyKind:`none`});return}let r=await n(e);a(await s(`Loading`,async()=>r.secretsStore.systemStores.list({account_tag:e[`account-tag`],...t})),{successLabel:`Loaded`})}};function Y(e){return e.positional(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const X={command:`create <store-id>`,describe:`Creates one or more secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:Y,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores secrets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:r(e.body)});return}let t=await n(e);if(e.body){let n=r(e.body);a(await s(`Creating`,async()=>t.secretsStore.systemStores.secrets.create({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Z(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Q={command:`id <secret-id>`,describe:`Deletes a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:Z,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores secrets delete by id`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`none`});return}let t=await n(e);if(!await d({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>t.secretsStore.systemStores.secrets.delete.by.id({account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Deleted`})}},ne={command:`by`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(Q).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function re(e){return e.option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`ids`,{type:`string`,array:!0,description:`List of secret identifier tags to delete.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Request body for bulk deleting secrets`})}const ie={command:`bulk`,describe:`Deletes one or more secrets from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:re,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores secrets delete system bulk`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},bodyKind:`json`,body:e.body===void 0?i({ids:e.ids}):r(e.body)});return}let t=await n(e);if(!await d({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}if(e.body){let n=r(e.body);a(await s(`Deleting`,async()=>t.secretsStore.systemStores.secrets.delete.system.bulk({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Deleted`});return}if(e.ids===void 0)throw Error(`--ids is required (or pass --body with this field set).`);let c=i({ids:e.ids});a(await s(`Deleting`,async()=>t.secretsStore.systemStores.secrets.delete.system.bulk({body:c,account_tag:e[`account-tag`],store_id:e[`store-id`]})),{successLabel:`Deleted`})}},ae={command:`system`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(ie).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},oe={command:`delete`,describe:`Operations for system-stores.secrets.delete`,builder:e=>e.command(ne).command(ae).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function se(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`name`,{type:`string`,description:`The name of the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ce={command:`create <secret-id>`,describe:`Duplicates a secret in a store managed by the calling service, keeping the value. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:se,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores secrets duplicate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}/duplicate`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`json`,body:e.body===void 0?i({comment:c(e.comment,`comment`,`text`),name:c(e.name,`name`,`text`),scopes:e.scopes}):r(e.body)});return}let t=await n(e);if(e.body){let n=r(e.body);a(await s(`Creating`,async()=>t.secretsStore.systemStores.secrets.duplicate.create({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Created`});return}if(e.name===void 0&&(e.name=await u(`name`,`The name of the secret`)),e.scopes===void 0)throw Error(`--scopes is required (or pass --body with this field set).`);let l=i({comment:c(e.comment,`comment`,`text`),name:c(e.name,`name`,`text`),scopes:e.scopes});a(await s(`Creating`,async()=>t.secretsStore.systemStores.secrets.duplicate.create({body:l,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Created`})}},le={command:`duplicate`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(ce).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ue(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`comment`,{type:`string`,description:`Freeform text describing the secret`}).option(`scopes`,{type:`string`,array:!0,description:`The list of services that can use this secret.`}).option(`value`,{type:`string`,description:`The value of the secret. Maximum 64 KiB (65,536 bytes). Note that this is 'write only' - no API response will provide this value, it is only used to create/modify secrets.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const de={command:`edit <secret-id>`,describe:`Updates a single secret in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:ue,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores secrets edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`json`,body:e.body===void 0?i({comment:c(e.comment,`comment`,`text`),scopes:e.scopes,value:c(e.value,`value`,`text`)}):r(e.body)});return}let t=await n(e);if(e.body){let n=r(e.body);a(await s(`Updating`,async()=>t.secretsStore.systemStores.secrets.edit({body:n,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Updated`});return}let l=i({comment:c(e.comment,`comment`,`text`),scopes:e.scopes,value:c(e.value,`value`,`text`)});a(await s(`Updating`,async()=>t.secretsStore.systemStores.secrets.edit({body:l,account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Updated`})}};function fe(e){return e.positional(`secret-id`,{type:`string`,description:`Secret identifier tag.`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pe={command:`get <secret-id>`,describe:`Returns details of a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:fe,handler:async e=>{if(e.dryRun){o({command:`cf secrets-store system-stores secrets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets/${e[`secret-id`]==null?`<secret-id>`:encodeURIComponent(String(e[`secret-id`]))}`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``),"secret-id":String(e[`secret-id`]??``)},bodyKind:`none`});return}let t=await n(e);a(await s(`Loading`,async()=>t.secretsStore.systemStores.secrets.get({account_tag:e[`account-tag`],store_id:e[`store-id`],secret_id:e[`secret-id`]})),{successLabel:`Loaded`})}};function $(e){return e.option(`account-tag`,{type:`string`,description:`Account tag identifier (e.g., '12a6ed19f349896cfbd6694ba3de8d31').
+This is the account's external tag identifier, not the numeric account ID.`,demandOption:!0}).option(`store-id`,{type:`string`,description:`Store Identifier`,demandOption:!0}).option(`direction`,{type:`string`,description:`Direction to sort objects`,choices:[`asc`,`desc`]}).option(`page`,{type:`number`,description:`Page number`}).option(`per-page`,{type:`number`,description:`Number of objects to return per page`}).option(`search`,{type:`string`,description:`Search secrets using a filter string, filtering across name and comment`}).option(`order`,{type:`string`,description:`Order secrets by values in the given field`,choices:[`name`,`comment`,`created`,`modified`,`status`]}).option(`scopes`,{type:`string`,description:`Only secrets with the given scopes will be returned`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const me={command:`list`,describe:`Lists all secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.`,builder:f($),handler:async e=>{let t={direction:e.direction,page:e.page,per_page:e[`per-page`],search:e.search,order:e.order,scopes:e.scopes};if(e.dryRun){o({command:`cf secrets-store system-stores secrets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/system/accounts/${e[`account-tag`]==null?`<account-tag>`:encodeURIComponent(String(e[`account-tag`]))}/stores/${e[`store-id`]==null?`<store-id>`:encodeURIComponent(String(e[`store-id`]))}/secrets`,pathParams:{"account-tag":String(e[`account-tag`]??``),"store-id":String(e[`store-id`]??``)},query:t,bodyKind:`none`});return}let r=await n(e);a(await s(`Loading`,async()=>r.secretsStore.systemStores.secrets.list({account_tag:e[`account-tag`],store_id:e[`store-id`],...t})),{successLabel:`Loaded`})}},he={command:`secrets`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(X).command(de).command(pe).command(me).command(oe).command(le).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ge={command:`system-stores`,describe:`System-level secret store management — CRUD for stores and their secrets`,builder:e=>e.command(z).command(V).command(J).command(K).command(he).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_e={command:`secrets-store`,describe:`Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products`,builder:e=>e.command(ee).command(A).command(L).command(ge).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{_e as default};

package/dist/security-center-BQT21oiM.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{N as e,O as t,P as n}from"./oauth-B5k80sip.mjs";import{n as r}from"./auth-DX9KnJ0P.mjs";import{n as i,t as a}from"./body-parser-DWSy7uZ8.mjs";import{t as o}from"./output-B6fBFRqe.mjs";import{n as s,t as c}from"./progress-CL8I-7YK.mjs";import{t as l}from"./local-CYc9q7l2.mjs";import{t as u}from"./cli-types-DGgEbf8K.mjs";function d(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const f={command:`get`,describe:`Retrieves Security Center insight counts aggregated by classification class.`,builder:u(d),handler:async e=>{let i={dismissed:e.dismissed,issue_class:e[`issue-class`],issue_type:e[`issue-type`],product:e.product,severity:e.severity,subject:e.subject};if(e.dryRun){s({command:`cf security-center insights class get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${n()??`<account-id>`}/security-center/insights/class`,pathParams:{},query:i,bodyKind:`none`});return}let a=await r(e),u=e.local?l:await t();e.accountId=u,o(await c(`Loading`,async()=>a.securityCenter.insights.class.get({account_id:u,...i})),{successLabel:`Loaded`})}},p={command:`class`,describe:`Security findings and recommendations across your account — DNS, SSL, WAF misconfigurations, etc.`,builder:e=>e.command(f).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function m(e){return e.positional(`issue-id`,{type:`string`,description:`Issue ID`,demandOption:!0}).option(`dismiss`,{type:`boolean`,description:`The dismiss field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const h={command:`dismiss <issue-id>`,describe:`Archives a Security Center insight for an account, removing it from the active insights list while preserving historical data.`,builder:m,handler:async e=>{if(e.dryRun){s({command:`cf security-center insights dismiss`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n()??`<account-id>`}/security-center/insights/${e[`issue-id`]==null?`<issue-id>`:encodeURIComponent(String(e[`issue-id`]))}/dismiss`,pathParams:{"issue-id":String(e[`issue-id`]??``)},bodyKind:`json`,body:e.body===void 0?a({dismiss:e.dismiss}):i(e.body)});return}let u=await r(e),d=e.local?l:await t();if(e.accountId=d,e.body){let t=i(e.body);o(await c(`Updating`,async()=>u.securityCenter.insights.dismiss({...t,account_id:d,issue_id:e[`issue-id`]})),{successLabel:`Updated`});return}let f=a({dismiss:e.dismiss});o(await c(`Updating`,async()=>u.securityCenter.insights.dismiss({...f,account_id:d,issue_id:e[`issue-id`]})),{successLabel:`Updated`})}};function g(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`page`,{type:`number`,description:`Specifies the current page within paginated list of results.`}).option(`per-page`,{type:`number`,description:`Sets the number of results per page of results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _={command:`list`,describe:`Lists all Security Center insights for the account, showing security findings and recommendations.`,builder:u(g),handler:async e=>{let i={dismissed:e.dismissed,issue_class:e[`issue-class`],issue_type:e[`issue-type`],product:e.product,severity:e.severity,subject:e.subject,page:e.page,per_page:e[`per-page`]};if(e.dryRun){s({command:`cf security-center insights list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${n()??`<account-id>`}/security-center/insights`,pathParams:{},query:i,bodyKind:`none`});return}let a=await r(e),u=e.local?l:await t();e.accountId=u,o(await c(`Loading`,async()=>a.securityCenter.insights.list({account_id:u,...i})),{successLabel:`Loaded`})}};function v(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const y={command:`get`,describe:`Retrieves Security Center insight counts aggregated by severity level (critical, high, medium, low).`,builder:u(v),handler:async e=>{let i={dismissed:e.dismissed,issue_class:e[`issue-class`],issue_type:e[`issue-type`],product:e.product,severity:e.severity,subject:e.subject};if(e.dryRun){s({command:`cf security-center insights severity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${n()??`<account-id>`}/security-center/insights/severity`,pathParams:{},query:i,bodyKind:`none`});return}let a=await r(e),u=e.local?l:await t();e.accountId=u,o(await c(`Loading`,async()=>a.securityCenter.insights.severity.get({account_id:u,...i})),{successLabel:`Loaded`})}},b={command:`severity`,describe:`Security findings and recommendations across your account — DNS, SSL, WAF misconfigurations, etc.`,builder:e=>e.command(y).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function x(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const S={command:`get`,describe:`Retrieves Security Center insight counts aggregated by insight type.`,builder:u(x),handler:async e=>{let i={dismissed:e.dismissed,issue_class:e[`issue-class`],issue_type:e[`issue-type`],product:e.product,severity:e.severity,subject:e.subject};if(e.dryRun){s({command:`cf security-center insights type get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${n()??`<account-id>`}/security-center/insights/type`,pathParams:{},query:i,bodyKind:`none`});return}let a=await r(e),u=e.local?l:await t();e.accountId=u,o(await c(`Loading`,async()=>a.securityCenter.insights.type.get({account_id:u,...i})),{successLabel:`Loaded`})}},C={command:`type`,describe:`Security findings and recommendations across your account — DNS, SSL, WAF misconfigurations, etc.`,builder:e=>e.command(S).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},w={command:`insights`,describe:`Security findings and recommendations across your account — DNS, SSL, WAF misconfigurations, etc.`,builder:e=>e.command(h).command(_).command(p).command(b).command(C).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function T(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const E={command:`get`,describe:`Retrieves zone-specific Security Center insight counts aggregated by classification class.`,builder:u(T),handler:async t=>{let n={dismissed:t.dismissed,issue_class:t[`issue-class`],issue_type:t[`issue-type`],product:t.product,severity:t.severity,subject:t.subject};if(t.dryRun){s({command:`cf security-center zone-insights class get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/security-center/insights/class`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},query:n,bodyKind:`none`});return}let i=await r(t),a=await e({zone:t.zone},i,{quiet:t.quiet});t.zoneId=a,o(await c(`Loading`,async()=>i.securityCenter.zoneInsights.class.get({zone_id:a,...n})),{successLabel:`Loaded`})}},D={command:`class`,describe:`Zone-scoped security insights — counts by class, severity, type, and dismissal`,builder:e=>e.command(E).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function O(e){return e.positional(`issue-id`,{type:`string`,description:`Issue ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const k={command:`get <issue-id>`,describe:`Returns the full context payload for an insight. This endpoint is used for insights with large payloads that are not included inline in the list response.`,builder:O,handler:async e=>{if(e.dryRun){s({command:`cf security-center zone-insights context get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${n()??`<account-id>`}/security-center/insights/${e[`issue-id`]==null?`<issue-id>`:encodeURIComponent(String(e[`issue-id`]))}/context`,pathParams:{"issue-id":String(e[`issue-id`]??``)},bodyKind:`none`});return}let i=await r(e),a=e.local?l:await t();e.accountId=a,o(await c(`Loading`,async()=>i.securityCenter.zoneInsights.context.get({account_id:a,issue_id:e[`issue-id`]})),{successLabel:`Loaded`})}},A={command:`context`,describe:`Zone-scoped security insights — counts by class, severity, type, and dismissal`,builder:e=>e.command(k).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function j(e){return e.positional(`issue-id`,{type:`string`,description:`Issue ID`,demandOption:!0}).option(`dismiss`,{type:`boolean`,description:`The dismiss field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const M={command:`update <issue-id>`,describe:`Archives a zone-specific Security Center insight, removing it from the active zone insights while preserving historical data.`,builder:j,handler:async t=>{if(t.dryRun){s({command:`cf security-center zone-insights dismiss update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/security-center/insights/${t[`issue-id`]==null?`<issue-id>`:encodeURIComponent(String(t[`issue-id`]))}/dismiss`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``),"issue-id":String(t[`issue-id`]??``)},bodyKind:`json`,body:t.body===void 0?a({dismiss:t.dismiss}):i(t.body)});return}let n=await r(t),l=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=l,t.body){let e=i(t.body);o(await c(`Updating`,async()=>n.securityCenter.zoneInsights.dismiss.update({...e,zone_id:l,issue_id:t[`issue-id`]})),{successLabel:`Updated`});return}let u=a({dismiss:t.dismiss});o(await c(`Updating`,async()=>n.securityCenter.zoneInsights.dismiss.update({...u,zone_id:l,issue_id:t[`issue-id`]})),{successLabel:`Updated`})}},N={command:`dismiss`,describe:`Zone-scoped security insights — counts by class, severity, type, and dismissal`,builder:e=>e.command(M).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function P(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`page`,{type:`number`,description:`Specifies the current page within paginated list of results.`}).option(`per-page`,{type:`number`,description:`Sets the number of results per page of results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const F={command:`get`,describe:`Lists Security Center insights for a specific zone, showing zone-level security findings.`,builder:u(P),handler:async t=>{let n={dismissed:t.dismissed,issue_class:t[`issue-class`],issue_type:t[`issue-type`],product:t.product,severity:t.severity,subject:t.subject,page:t.page,per_page:t[`per-page`]};if(t.dryRun){s({command:`cf security-center zone-insights get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/security-center/insights`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},query:n,bodyKind:`none`});return}let i=await r(t),a=await e({zone:t.zone},i,{quiet:t.quiet});t.zoneId=a,o(await c(`Loading`,async()=>i.securityCenter.zoneInsights.get({zone_id:a,...n})),{successLabel:`Loaded`})}};function I(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const L={command:`get`,describe:`Retrieves zone-specific Security Center insight counts aggregated by severity level.`,builder:u(I),handler:async t=>{let n={dismissed:t.dismissed,issue_class:t[`issue-class`],issue_type:t[`issue-type`],product:t.product,severity:t.severity,subject:t.subject};if(t.dryRun){s({command:`cf security-center zone-insights severity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/security-center/insights/severity`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},query:n,bodyKind:`none`});return}let i=await r(t),a=await e({zone:t.zone},i,{quiet:t.quiet});t.zoneId=a,o(await c(`Loading`,async()=>i.securityCenter.zoneInsights.severity.get({zone_id:a,...n})),{successLabel:`Loaded`})}},R={command:`severity`,describe:`Zone-scoped security insights — counts by class, severity, type, and dismissal`,builder:e=>e.command(L).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function z(e){return e.option(`dismissed`,{type:`boolean`,description:`Dismissed`}).option(`issue-class`,{type:`string`,description:`Issue class`}).option(`issue-type`,{type:`string`,description:`Issue type`}).option(`product`,{type:`string`,description:`Product`}).option(`severity`,{type:`string`,description:`Severity`}).option(`subject`,{type:`string`,description:`Subject`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const B={command:`get`,describe:`Retrieves zone-specific Security Center insight counts aggregated by insight type.`,builder:u(z),handler:async t=>{let n={dismissed:t.dismissed,issue_class:t[`issue-class`],issue_type:t[`issue-type`],product:t.product,severity:t.severity,subject:t.subject};if(t.dryRun){s({command:`cf security-center zone-insights type get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/security-center/insights/type`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},query:n,bodyKind:`none`});return}let i=await r(t),a=await e({zone:t.zone},i,{quiet:t.quiet});t.zoneId=a,o(await c(`Loading`,async()=>i.securityCenter.zoneInsights.type.get({zone_id:a,...n})),{successLabel:`Loaded`})}},V={command:`type`,describe:`Zone-scoped security insights — counts by class, severity, type, and dismissal`,builder:e=>e.command(B).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},H={command:`zone-insights`,describe:`Zone-scoped security insights — counts by class, severity, type, and dismissal`,builder:e=>e.command(F).command(D).command(A).command(N).command(R).command(V).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},U={command:`security-center`,describe:`Security posture dashboard — view and manage security insights, misconfigurations, and vulnerabilities`,builder:e=>e.command(w).command(H).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{U as default};

package/dist/security-txt-CVpmJo29.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{N as e}from"./oauth-B5k80sip.mjs";import{n as t}from"./auth-DX9KnJ0P.mjs";import{n,t as r}from"./body-parser-DWSy7uZ8.mjs";import{t as i}from"./output-B6fBFRqe.mjs";import{n as a,t as o}from"./progress-CL8I-7YK.mjs";import{n as s}from"./input-validation-_fMCApaH.mjs";import{t as c}from"./prompt-q3B7sM2A.mjs";function l(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const u={command:`delete`,describe:`Removes the security.txt file configuration for a zone. The /.well-known/security.txt endpoint will no longer be served.`,builder:l,handler:async n=>{if(n.dryRun){a({command:`cf security-txt delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${n.zone??n.zoneId??`<zone>`}/security-center/securitytxt`,pathParams:{"zone-id":String(n.zone??n[`zone-id`]??``)},bodyKind:`none`});return}let r=await t(n),s=await e({zone:n.zone},r,{quiet:n.quiet});if(n.zoneId=s,!await c({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>r.securityTxt.delete({zone_id:s})),{successLabel:`Deleted`})}};function d(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const f={command:`get`,describe:`Retrieves the current security.txt file configuration for a zone, used for security vulnerability reporting.`,builder:d,handler:async n=>{if(n.dryRun){a({command:`cf security-txt get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${n.zone??n.zoneId??`<zone>`}/security-center/securitytxt`,pathParams:{"zone-id":String(n.zone??n[`zone-id`]??``)},bodyKind:`none`});return}let r=await t(n),s=await e({zone:n.zone},r,{quiet:n.quiet});n.zoneId=s,i(await o(`Loading`,async()=>r.securityTxt.get({zone_id:s})),{successLabel:`Loaded`})}};function p(e){return e.option(`acknowledgments`,{type:`string`,array:!0,description:`The acknowledgments field`}).option(`canonical`,{type:`string`,array:!0,description:`The canonical field`}).option(`contact`,{type:`string`,array:!0,description:`The contact field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`encryption`,{type:`string`,array:!0,description:`The encryption field`}).option(`expires`,{type:`string`,description:`The expires field`}).option(`hiring`,{type:`string`,array:!0,description:`The hiring field`}).option(`policy`,{type:`string`,array:!0,description:`The policy field`}).option(`preferred-languages`,{type:`string`,description:`The preferred_languages field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const m={command:`update`,describe:`Updates the security.txt file configuration for a zone, which provides security researchers with vulnerability reporting information.`,builder:p,handler:async c=>{if(c.dryRun){a({command:`cf security-txt update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${c.zone??c.zoneId??`<zone>`}/security-center/securitytxt`,pathParams:{"zone-id":String(c.zone??c[`zone-id`]??``)},bodyKind:`json`,body:c.body===void 0?r({acknowledgments:c.acknowledgments,canonical:c.canonical,contact:c.contact,enabled:c.enabled,encryption:c.encryption,expires:s(c.expires,`expires`,`text`),hiring:c.hiring,policy:c.policy,preferred_languages:s(c[`preferred-languages`],`preferred-languages`,`text`)}):n(c.body)});return}let l=await t(c),u=await e({zone:c.zone},l,{quiet:c.quiet});if(c.zoneId=u,c.body){let e=n(c.body);i(await o(`Updating`,async()=>l.securityTxt.update({body:e,zone_id:u})),{successLabel:`Updated`});return}let d=r({acknowledgments:c.acknowledgments,canonical:c.canonical,contact:c.contact,enabled:c.enabled,encryption:c.encryption,expires:s(c.expires,`expires`,`text`),hiring:c.hiring,policy:c.policy,preferred_languages:s(c[`preferred-languages`],`preferred-languages`,`text`)});i(await o(`Updating`,async()=>l.securityTxt.update({body:d,zone_id:u})),{successLabel:`Updated`})}},h={command:`security-txt`,describe:`Manage the /.well-known/security.txt file that tells security researchers how to report vulnerabilities`,builder:e=>e.command(u).command(f).command(m).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{h as default};

package/dist/session-B8r8LNQN.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import{$ as e,B as t,L as n,S as r,W as i,Z as a,_ as o,g as s,m as c,t as l,v as u}from"./dist-C6zxsVdY.mjs";import"./delegate.mjs";import{a as d,n as f,t as p}from"./theme-DbNbIY4d.mjs";import{createRequire as m}from"node:module";import{chmodSync as ee,existsSync as h,mkdirSync as g,rmSync as _,writeFileSync as v}from"node:fs";import y from"node:assert";import b from"node:path";import{spawnSync as x}from"node:child_process";import{createCipheriv as te,createDecipheriv as ne,createHash as S,randomBytes as C,webcrypto as w}from"node:crypto";import re from"node:http";import{TextEncoder as ie,stripVTControlCharacters as ae}from"node:util";import oe from"node:url";function se({onlyFirst:e=!1}={}){return RegExp(`(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))|[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]`,e?void 0:`g`)}const ce=se();function le(e){if(typeof e!=`string`)throw TypeError(`Expected a \`string\`, got \`${typeof e}\``);return!e.includes(`\x1B`)&&!e.includes(`›`)?e:e.replace(ce,``)}const ue=(e=0)=>t=>`\u001B[${t+e}m`,de=(e=0)=>t=>`\u001B[${38+e};5;${t}m`,fe=(e=0)=>(t,n,r)=>`\u001B[${38+e};2;${t};${n};${r}m`,T={modifier:{reset:[0,0],bold:[1,22],dim:[2,22],italic:[3,23],underline:[4,24],overline:[53,55],inverse:[7,27],hidden:[8,28],strikethrough:[9,29]},color:{black:[30,39],red:[31,39],green:[32,39],yellow:[33,39],blue:[34,39],magenta:[35,39],cyan:[36,39],white:[37,39],blackBright:[90,39],gray:[90,39],grey:[90,39],redBright:[91,39],greenBright:[92,39],yellowBright:[93,39],blueBright:[94,39],magentaBright:[95,39],cyanBright:[96,39],whiteBright:[97,39]},bgColor:{bgBlack:[40,49],bgRed:[41,49],bgGreen:[42,49],bgYellow:[43,49],bgBlue:[44,49],bgMagenta:[45,49],bgCyan:[46,49],bgWhite:[47,49],bgBlackBright:[100,49],bgGray:[100,49],bgGrey:[100,49],bgRedBright:[101,49],bgGreenBright:[102,49],bgYellowBright:[103,49],bgBlueBright:[104,49],bgMagentaBright:[105,49],bgCyanBright:[106,49],bgWhiteBright:[107,49]}};Object.keys(T.modifier);const pe=Object.keys(T.color),me=Object.keys(T.bgColor);[...pe,...me];function he(){let e=new Map;for(let[t,n]of Object.entries(T)){for(let[t,r]of Object.entries(n))T[t]={open:`\u001B[${r[0]}m`,close:`\u001B[${r[1]}m`},n[t]=T[t],e.set(r[0],r[1]);Object.defineProperty(T,t,{value:n,enumerable:!1})}return Object.defineProperty(T,`codes`,{value:e,enumerable:!1}),T.color.close=`\x1B[39m`,T.bgColor.close=`\x1B[49m`,T.color.ansi=ue(),T.color.ansi256=de(),T.color.ansi16m=fe(),T.bgColor.ansi=ue(10),T.bgColor.ansi256=de(10),T.bgColor.ansi16m=fe(10),Object.defineProperties(T,{rgbToAnsi256:{value(e,t,n){return e===t&&t===n?e<8?16:e>248?231:Math.round((e-8)/247*24)+232:16+36*Math.round(e/255*5)+6*Math.round(t/255*5)+Math.round(n/255*5)},enumerable:!1},hexToRgb:{value(e){let t=/[a-f\d]{6}|[a-f\d]{3}/i.exec(e.toString(16));if(!t)return[0,0,0];let[n]=t;n.length===3&&(n=[...n].map(e=>e+e).join(``));let r=Number.parseInt(n,16);return[r>>16&255,r>>8&255,r&255]},enumerable:!1},hexToAnsi256:{value:e=>T.rgbToAnsi256(...T.hexToRgb(e)),enumerable:!1},ansi256ToAnsi:{value(e){if(e<8)return 30+e;if(e<16)return 90+(e-8);let t,n,r;if(e>=232)t=((e-232)*10+8)/255,n=t,r=t;else{e-=16;let i=e%36;t=Math.floor(e/36)/5,n=Math.floor(i/6)/5,r=i%6/5}let i=Math.max(t,n,r)*2;if(i===0)return 30;let a=30+(Math.round(r)<<2|Math.round(n)<<1|Math.round(t));return i===2&&(a+=60),a},enumerable:!1},rgbToAnsi:{value:(e,t,n)=>T.ansi256ToAnsi(T.rgbToAnsi256(e,t,n)),enumerable:!1},hexToAnsi:{value:e=>T.ansi256ToAnsi(T.hexToAnsi256(e)),enumerable:!1}}),T}const ge=he(),_e=process.env.CLI_VERSION??`0.6.0`,ve=`cf-cli/${_e}`;var ye=Object.defineProperty,E=(e,t)=>ye(e,`name`,{value:t,configurable:!0}),D=n(),be=!1;function O(e){let{configOverride:t,warningLogger:n,storage:r}=e,{oauth_token:i,refresh_token:a,expiration_time:o,scopes:s,api_token:c}=t??r.read()??{};return i?{accessToken:{value:i,expiry:o??`2000-01-01:00:00:00+00:00`},refreshToken:{value:a??``},scopes:s}:c?(!be&&n&&(be=!0,n.warn(`It looks like you have used Wrangler v1's \`config\` command to login with an API token
+from ${t===void 0?r.path():`in-memory config`}.
+This is no longer supported in the current version of Wrangler.
+If you wish to authenticate via an API token then please set the \`CLOUDFLARE_API_TOKEN\` environment variable.`)),{deprecatedApiToken:c}):{}}E(O,`readStoredAuthState`);var xe=r({variableName:`CLOUDFLARE_API_TOKEN`,deprecatedName:`CF_API_TOKEN`}),Se=r({variableName:`CLOUDFLARE_API_KEY`,deprecatedName:`CF_API_KEY`}),Ce=r({variableName:`CLOUDFLARE_EMAIL`,deprecatedName:`CF_EMAIL`});function we(e){if(e?.allowGlobalAuthKey??!0){let e=Se(),t=Ce();if(e&&t)return{authKey:e,authEmail:t}}let t=xe();if(t)return{apiToken:t}}E(we,`getAuthFromEnv`);function Te(e){let t=we(e);if(t)return t;let n=O({storage:e.storage,warningLogger:e.warningLogger});if(n.deprecatedApiToken)return{apiToken:n.deprecatedApiToken};if(n.accessToken?.value)return{apiToken:n.accessToken.value}}E(Te,`getAPIToken`);function Ee(e){let t=Te(e);if(!t)throw new i(`No API token found.`,{telemetryMessage:`user auth missing api token`});return t}E(Ee,`requireApiToken`);var k=r({variableName:`WRANGLER_AUTH_DOMAIN`,defaultValue:E(()=>o()===`staging`?`dash.staging.cloudflare.com`:`dash.cloudflare.com`,`defaultValue`)}),De=r({variableName:`WRANGLER_AUTH_URL`,defaultValue:E(()=>`https://${k()}/oauth2/auth`,`defaultValue`)}),Oe=r({variableName:`WRANGLER_TOKEN_URL`,defaultValue:E(()=>`https://${k()}/oauth2/token`,`defaultValue`)}),ke=r({variableName:`WRANGLER_REVOKE_URL`,defaultValue:E(()=>`https://${k()}/oauth2/revoke`,`defaultValue`)}),Ae=r({variableName:`CLOUDFLARE_ACCOUNT_ID`,deprecatedName:`CF_ACCOUNT_ID`}),je=r({variableName:`CLOUDFLARE_ACCESS_CLIENT_ID`}),Me=r({variableName:`CLOUDFLARE_ACCESS_CLIENT_SECRET`}),Ne=r({variableName:`WRANGLER_CF_AUTHORIZATION_TOKEN`}),Pe=c({variableName:`CLOUDFLARE_AUTH_USE_KEYRING`}),A={},j=new Map;function Fe(){for(let e of Object.keys(A))delete A[e];j.clear()}E(Fe,`clearAccessCaches`);async function Ie(e,t){if(t.debug(`Checking if domain has Access enabled:`,e),j.has(e))return t.debug(`Using cached Access switch for:`,e,j.get(e)),j.get(e)??!1;t.debug(`Access switch not cached for:`,e);try{let n=new AbortController,r=setTimeout(()=>{n.abort()},1e3),i=await(0,D.fetch)(`https://${e}`,{redirect:`manual`,signal:n.signal});clearTimeout(r);let a=!!(i.status===302&&i.headers.get(`location`)?.includes(`cloudflareaccess.com`));return t.debug(`Caching access switch for:`,e),j.set(e,a),a}catch{return j.set(e,!1),!1}}E(Ie,`domainUsesAccess`);async function Le(e,t){let n=t.logger,r=t.isNonInteractiveOrCI,a=je(),o=Me();if(a&&o){n.debug(`Using Access Service Token headers for domain:`,e);let t={"CF-Access-Client-Id":a,"CF-Access-Client-Secret":o};return A[e]=t,t}if((a!==void 0||o!==void 0)&&n.warn(`Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${a===void 0?`CLOUDFLARE_ACCESS_CLIENT_SECRET`:`CLOUDFLARE_ACCESS_CLIENT_ID`} was found.`),!await Ie(e,n))return{};if(n.debug(`Getting Access headers for domain:`,e),A[e])return n.debug(`Using cached Access headers for domain:`,e),A[e];if(r())throw new i(`The domain "${e}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
+Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate with an Access Service Token.
+See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/`,{telemetryMessage:`user access missing service token non interactive`});n.debug(`Spawning cloudflared to get Access token for domain:`);let s=x(`cloudflared`,[`access`,`login`,e]);if(s.error)throw new i("To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",{telemetryMessage:`user access missing cloudflared`});let c=s.stdout.toString();n.debug(`cloudflared output:`,c);let l=c.match(/fetched your token:\n\n(.*)/m);if(l&&l.length>=2){let t={Cookie:`CF_Authorization=${l[1]}`};return A[e]=t,n.debug(`Caching Access headers for domain:`,e),t}throw Error(`Failed to authenticate with Cloudflare Access`)}E(Le,`getAccessHeaders`);async function Re(e){let t=Ne();return t===void 0?Le(k(),e):(e.logger.debug(`Using WRANGLER_CF_AUTHORIZATION_TOKEN from environment`),{Cookie:`CF_Authorization=${t}`})}E(Re,`getCloudflareAccessHeaders`);var ze=96,Be=32,M=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`;function Ve(e){let t=btoa(e);return t=t.replace(/\+/g,`-`),t=t.replace(/\//g,`_`),t=t.replace(/=/g,``),t}E(Ve,`base64urlEncode`);async function He(){let e=new Uint32Array(ze);w.getRandomValues(e);let t=Ve(Array.from(e).map(e=>M[e%M.length]).join(``)),n=await w.subtle.digest(`SHA-256`,new ie().encode(t)),r=new Uint8Array(n),i=``,a=r.byteLength;for(let e=0;e<a;e++)i+=String.fromCharCode(r[e]);return{codeChallenge:Ve(i),codeVerifier:t}}E(He,`generatePKCECodes`);var Ue=E(({authUrl:e,clientId:t,scopes:n,stateQueryParam:r,codeChallenge:i,redirectUri:a})=>e+`?response_type=code&client_id=${encodeURIComponent(t)}&redirect_uri=${encodeURIComponent(a)}&scope=${encodeURIComponent([...n,`offline_access`].join(` `))}&state=${r}&code_challenge=${encodeURIComponent(i)}&code_challenge_method=S256`,`generateAuthUrl`);function We(e){let t=new Uint32Array(e);return w.getRandomValues(t),Array.from(t).map(e=>M[e%M.length]).join(``)}E(We,`generateRandomState`);var Ge=64e6;function Ke(e,t,n){let r=Array(t+1),i=S(`sha256`).update(e).digest();r[0]=i;for(let e=0;e<t;e++){for(let e=0;e<n;e++)i=S(`sha256`).update(i).digest();r[e+1]=i}return r}E(Ke,`solvePow`);function qe(e){return Buffer.concat(e).toString(`base64`)}E(qe,`encodeCheckpoints`);function Je(e){let t=Ke(Buffer.from(e.seed,`base64url`),e.k,e.g);return{challengeToken:e.challengeToken,solution:{checkpoints:qe(t)}}}E(Je,`solveChallenge`);var N={termsOfService:`https://www.cloudflare.com/terms/`,privacyPolicy:`https://www.cloudflare.com/privacypolicy/`},Ye=`You must accept Cloudflare's Terms of Service (${N.termsOfService}) and Privacy Policy (${N.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`,Xe=`Continuing means you accept Cloudflare's Terms of Service (${N.termsOfService}) and Privacy Policy (${N.privacyPolicy}).`,Ze=`You must accept Cloudflare's Terms of Service (${N.termsOfService}) and Privacy Policy (${N.privacyPolicy}) to use --temporary.`;function Qe(){return`${s(l)}/provisioning/previews`}E(Qe,`getTemporaryPreviewUrl`);function $e(){return`${Qe()}/challenge`}E($e,`getTemporaryPreviewChallengeUrl`);function et(e){let t=Date.parse(e);return!Number.isNaN(t)&&t>Date.now()}E(et,`isFutureTimestamp`);function tt(e){let t=e.read();if(t&&!(!t.account?.id||!t.account?.apiToken||!t.account?.name||!t.claim?.url||!et(t.account?.expiresAt??``)||!et(t.claim?.expiresAt??``)))return t}E(tt,`getCachedTemporaryPreviewAccount`);async function nt(e){let n=await(0,D.fetch)($e(),{method:`POST`,headers:{"Content-Type":`application/json`},body:`{}`});if(!n.ok)throw new t(`Failed to request a proof-of-work challenge (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account challenge failed`});let r;try{r=await n.json()}catch{throw new t(`Failed to request a proof-of-work challenge. Received an invalid response (${n.status} ${n.statusText}).`,{telemetryMessage:`deploy temporary account challenge invalid response`})}let{challengeToken:i,seed:a,k:o,g:s}=r.result??{};if(i===void 0||a===void 0||o===void 0||s===void 0)throw new t(`Failed to request a proof-of-work challenge because the response was missing required fields.`,{telemetryMessage:`deploy temporary account challenge incomplete`});if(!Number.isInteger(o)||!Number.isInteger(s)||o<=0||s<=0||o*s>Ge||Buffer.from(a,`base64url`).length!==32)throw new t(`The proof-of-work challenge is not supported by this version of Wrangler.`,{telemetryMessage:`deploy temporary account challenge difficulty unsupported`});return e.log(`Solving proof-of-work challenge…`),Je({challengeToken:i,seed:a,k:o,g:s})}E(nt,`requestPowSolution`);async function rt(e){let n=await nt(e),r=await(0,D.fetch)(Qe(),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({termsOfService:N.termsOfService,privacyPolicy:N.privacyPolicy,acceptTermsOfService:`yes`,challengeToken:n.challengeToken,solution:n.solution})});if(!r.ok)throw new t(`Failed to create a temporary preview account (${r.status} ${r.statusText}).`,{telemetryMessage:`deploy temporary account create failed`});let i;try{i=await r.json()}catch{throw new t(`Failed to create a temporary preview account. Received an invalid response (${r.status} ${r.statusText}).`,{telemetryMessage:`deploy temporary account invalid response`})}let a=i.result,o=a?.account?.id,s=a?.account?.name,c=a?.account?.apiToken,l=a?.account?.expiresAt,u=a?.claim?.url,d=a?.claim?.expiresAt;if(o===void 0||s===void 0||c===void 0||l===void 0||u===void 0||d===void 0)throw new t(`Failed to create a temporary preview account because the response was missing required fields.`,{telemetryMessage:`deploy temporary account response incomplete`});return{account:{id:o,name:s,apiToken:c,expiresAt:l},claim:{url:u,expiresAt:d}}}E(rt,`createTemporaryPreviewAccount`);async function it(e){let t=tt(e.storage);if(t)return{account:t,cached:!0};if(!await e.prompt(Ye,Xe))throw new i(Ze,{telemetryMessage:`user temporary terms not accepted`});let n=await rt(e.logger);return e.storage.write(n),{account:n,cached:!1}}E(it,`getOrCreateTemporaryPreviewAccount`);function at(e){var t=[...arguments].slice(1),n=Array.from(typeof e==`string`?[e]:e);n[n.length-1]=n[n.length-1].replace(/\r?\n([\t ]*)$/,``);var r=n.reduce(function(e,t){var n=t.match(/\n([\t ]+|(?!\s).)/g);return n?e.concat(n.map(function(e){return e.match(/[\t ]/g)?.length??0})):e},[]);if(r.length){var i=RegExp(`
+[	 ]{`+Math.min.apply(Math,r)+`}`,`g`);n=n.map(function(e){return e.replace(i,`
+`)})}n[0]=n[0].replace(/^\r?\n/,``);var a=n[0];return t.forEach(function(e,t){var r=a.match(/(?:^|\n)( *)$/),i=r?r[1]:``,o=e;typeof e==`string`&&e.includes(`
+`)&&(o=String(e).split(`
+`).map(function(e,t){return t===0?e:``+i+e}).join(`
+`)),a+=o+n[t+1]}),a}E(at,`dedent`);var ot=at,P=class extends i{static{E(this,`ErrorOAuth2`)}code;description;uri;toString(){return`ErrorOAuth2`}},st=class extends P{static{E(this,`ErrorUnknown`)}toString(){return`ErrorUnknown`}},ct=class extends P{static{E(this,`ErrorNoAuthCode`)}toString(){return`ErrorNoAuthCode`}},lt=class extends P{static{E(this,`ErrorInvalidReturnedStateParam`)}toString(){return`ErrorInvalidReturnedStateParam`}},ut=class extends P{static{E(this,`ErrorInvalidJson`)}toString(){return`ErrorInvalidJson`}},dt=class extends P{static{E(this,`ErrorInvalidScope`)}toString(){return`ErrorInvalidScope`}},ft=class extends P{static{E(this,`ErrorInvalidRequest`)}toString(){return`ErrorInvalidRequest`}},pt=class extends P{static{E(this,`ErrorInvalidToken`)}toString(){return`ErrorInvalidToken`}},F=class extends P{static{E(this,`ErrorAuthenticationGrant`)}toString(){return`ErrorAuthenticationGrant`}},mt=class extends F{static{E(this,`ErrorUnauthorizedClient`)}toString(){return`ErrorUnauthorizedClient`}},ht=class extends F{static{E(this,`ErrorAccessDenied`)}toString(){return`ErrorAccessDenied`}},gt=class extends F{static{E(this,`ErrorUnsupportedResponseType`)}toString(){return`ErrorUnsupportedResponseType`}},_t=class extends F{static{E(this,`ErrorServerError`)}toString(){return`ErrorServerError`}},vt=class extends F{static{E(this,`ErrorTemporarilyUnavailable`)}toString(){return`ErrorTemporarilyUnavailable`}},yt=class extends P{static{E(this,`ErrorAccessTokenResponse`)}toString(){return`ErrorAccessTokenResponse`}},bt=class extends yt{static{E(this,`ErrorInvalidClient`)}toString(){return`ErrorInvalidClient`}},xt=class extends yt{static{E(this,`ErrorInvalidGrant`)}toString(){return`ErrorInvalidGrant`}},St=class extends yt{static{E(this,`ErrorUnsupportedGrantType`)}toString(){return`ErrorUnsupportedGrantType`}};function Ct(e,t,n){let r=`OAuth error: ${e}`;return t&&(r+=`
+  ${t}`),n&&(r+=`
+  See: ${n}`),r}E(Ct,`formatOAuthErrorMessage`);function I(e,t,n){let r=Ct(e,t,n),i;switch(e){case`invalid_request`:i=new ft(r,{telemetryMessage:`user oauth invalid request`});break;case`invalid_grant`:i=new xt(r,{telemetryMessage:`user oauth invalid grant`});break;case`unauthorized_client`:i=new mt(r,{telemetryMessage:`user oauth unauthorized client`});break;case`access_denied`:i=new ht(r,{telemetryMessage:`user oauth access denied`});break;case`unsupported_response_type`:i=new gt(r,{telemetryMessage:`user oauth unsupported response type`});break;case`invalid_scope`:i=new dt(r,{telemetryMessage:`user oauth invalid scope`});break;case`server_error`:i=new _t(r,{telemetryMessage:`user oauth server error`});break;case`temporarily_unavailable`:i=new vt(r,{telemetryMessage:`user oauth temporarily unavailable`});break;case`invalid_client`:i=new bt(r,{telemetryMessage:`user oauth invalid client`});break;case`unsupported_grant_type`:i=new St(r,{telemetryMessage:`user oauth unsupported grant type`});break;case`invalid_json`:i=new ut(r,{telemetryMessage:`user oauth invalid json`});break;case`invalid_token`:i=new pt(r,{telemetryMessage:`user oauth invalid token`});break;default:i=new st(r,{telemetryMessage:`user oauth unknown error`});break}return i.code=e,i.description=t,i.uri=n,i}E(I,`toErrorClass`);function wt(e,t,n){if(e.error)throw I(Array.isArray(e.error)?e.error[0]:e.error,Array.isArray(e.error_description)?e.error_description[0]:e.error_description,Array.isArray(e.error_uri)?e.error_uri[0]:e.error_uri);let r=e.code;if(!r)return!1;if(e.state!==t.stateQueryParam)throw n.warn(`Received query string parameter doesn't match the one sent! Possible malicious activity somewhere.`),new lt(``,{telemetryMessage:`user oauth invalid returned state`});return y(!Array.isArray(r)),t.authorizationCode=r,t.hasAuthCodeBeenExchangedForAccessToken=!1,!0}E(wt,`isReturningFromAuthServer`);async function Tt(e,t,n,r,i){let{codeChallenge:a,codeVerifier:o}=await He(),s=i.generateRandomState(Be);return Object.assign(r,{codeChallenge:a,codeVerifier:o,stateQueryParam:s}),i.generateAuthUrl({authUrl:De(),clientId:t,scopes:e,stateQueryParam:s,codeChallenge:a,redirectUri:n})}E(Tt,`getAuthURL`);async function Et(e,t,n,r){let i=O({warningLogger:e,storage:r}).refreshToken;i||e.warn(`No refresh token is present.`);let a=await Ot(new URLSearchParams({grant_type:`refresh_token`,refresh_token:i?.value??``,client_id:n}),e,t);if(a.status>=400){let t;try{t=await L(a,e)}catch(t){e.error(t)}throw t===void 0?new st(`Failed to parse Error from exchangeRefreshTokenForAccessToken`,{telemetryMessage:`user oauth refresh token exchange parse error`}):typeof t==`string`?Error(t):t}else try{let t=await L(a,e);if(`error`in t)throw t.error;let{access_token:n,expires_in:r,refresh_token:o,scope:s}=t;return{token:{value:n,expiry:new Date(Date.now()+r*1e3).toISOString()},scopes:s?s.split(` `):[],refreshToken:o?{value:o}:i}}catch(e){throw typeof e==`string`?I(e):e}}E(Et,`exchangeRefreshTokenForAccessToken`);async function Dt(e,t,n,r,i){let{authorizationCode:a,codeVerifier:o=``}=e;o?a||t.warn(`No authorization grant code is being passed.`):t.warn(`No code verifier is being sent.`);let s=await Ot(new URLSearchParams({grant_type:`authorization_code`,code:a??``,redirect_uri:i,client_id:r,code_verifier:o}),t,n);if(!s.ok){let{error:e}=await L(s,t);throw e===`invalid_grant`&&t.log(`Expired! Auth code or refresh token needs to be renewed.`),I(e)}let c=await L(s,t);if(`error`in c)throw I(c.error);let{access_token:l,expires_in:u,refresh_token:d,scope:f}=c;return e.hasAuthCodeBeenExchangedForAccessToken=!0,{token:{value:l,expiry:new Date(Date.now()+u*1e3).toISOString()},scopes:f?f.split(` `):[],refreshToken:d?{value:d}:void 0}}E(Dt,`exchangeAuthCodeForAccessToken`);async function Ot(e,t,n){let r={"Content-Type":`application/x-www-form-urlencoded`};if(t.debug(`fetching auth token`,`grant_type=${e.get(`grant_type`)??`<unknown>`}`),await Ie(k(),t)){t.debug(`Using Cloudflare Access to get an access token for the auth request`);let e=await Re({logger:t,isNonInteractiveOrCI:n});Object.assign(r,e)}t.debug(`Fetching auth token from`,Oe());try{let n=await(0,D.fetch)(Oe(),{method:`POST`,body:e.toString(),headers:r});return n.ok||t.debug(`Failed to fetch auth token:`,n.status,n.statusText),n}catch(e){throw t.debug(`Failed to fetch auth token:`,e),e}}E(Ot,`fetchAuthToken`);async function L(e,t){let n=await e.text();try{return JSON.parse(n)}catch(r){throw n.match(/<!DOCTYPE html>/)&&(t.error(`The body of the response was HTML rather than JSON. Check the debug logs to see the full body of the response.`),n.match(/challenge-platform/)&&t.error(`It looks like you might have hit a bot challenge page. This may be transient but if not, please contact Cloudflare to find out what can be done. When you contact Cloudflare, please provide your Ray ID: ${e.headers.get(`cf-ray`)}`)),t.debug(`Full body of response
+
+`,n),Error(`Invalid JSON in response: status: ${e.status} ${e.statusText}`,{cause:r})}}E(L,`getJSONFromResponse`);async function kt(e,t,n,r){let a=await Tt(e.scopes,e.clientId,e.redirectUri,t,r),o=new URL(e.redirectUri).pathname,s,c,l=new Promise((e,t)=>{c=setTimeout(()=>{s.close(),clearTimeout(c),t(new i(`Timed out waiting for authorization code, please try again.`,{telemetryMessage:`user oauth authorization timeout`}))},12e4)}),u=new Promise((r,a)=>{s=re.createServer(async(l,u)=>{function d(e,t){clearTimeout(c),u.writableEnded||u.end(),s.close(n=>{t||n?a(t||n):(y(e),r(e))})}E(d,`finish`);function f(e){let t=E(e=>e.replace(/[&<>"']/g,e=>({"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&#39;`})[e]),`escape`),n=`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Wrangler login failed</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 720px; margin: 4rem auto; padding: 0 1rem; color: #1f2933; line-height: 1.5; }
+    h1 { color: #c12d3f; }
+    code { background: #f5f7fa; padding: 0.15em 0.3em; border-radius: 3px; }
+    p.detail { background: #f5f7fa; padding: 1rem; border-radius: 4px; white-space: pre-wrap; }
+  </style>
+</head>
+<body>
+  <h1>Wrangler login failed</h1>
+  <p>The Cloudflare OAuth provider returned an error.</p>
+  ${e.code?`<p>Code: <code>${t(e.code)}</code></p>`:``}
+  ${e.description?`<p class="detail">${t(e.description)}</p>`:``}
+  <p>You can close this tab and return to your terminal for more details.</p>
+</body>
+</html>`;u.writeHead(400,{"Content-Type":`text/html; charset=utf-8`}),u.end(n)}E(f,`renderErrorPage`),y(l.url,`This request doesn't have a URL`);let{pathname:p,query:m}=oe.parse(l.url,!0);if(l.method!==`GET`)return u.end(`OK`);switch(p){case o:{let r=!1;try{r=wt(m,t,n.logger)}catch(t){if(t instanceof ht){u.writeHead(307,{Location:e.denied.url}),u.end(()=>{d(null,new i(e.denied.error,{telemetryMessage:`user oauth consent denied`}))});return}let n=t;f({code:n.code,description:n.description??n.message}),d(null,n);return}if(!r){let e=`The Cloudflare OAuth provider did not return an authorisation code.`;f({description:e}),d(null,new ct(e,{telemetryMessage:`user oauth missing auth code`}));return}try{let r=await Dt(t,n.logger,n.isNonInteractiveOrCI,e.clientId,e.redirectUri);u.writeHead(307,{Location:e.granted.url}),u.end(()=>{d(r)})}catch(e){let t=e,n=t instanceof P;f({code:n?t.code:void 0,description:(n?t.description:void 0)??t.message??`Failed to exchange the authorisation code for an access token.`}),d(null,t)}return}}});let l=new URL(e.redirectUri),u=Number(l.port||(l.protocol===`https:`?443:80));(l.hostname!==e.callbackHost||u!==e.callbackPort)&&(n.logger.log(`Temporary login server listening on ${e.callbackHost}:${e.callbackPort}`),n.logger.log(`Note that the OAuth login page will always redirect to \`${e.redirectUri}\`.
+If you have changed the callback host or port because you are running in a container, then ensure that you have port forwarding set up correctly.`)),s.once(`error`,t=>{clearTimeout(c),t.code===`EADDRINUSE`?a(new i(`The OAuth callback server could not bind to ${e.callbackHost}:${e.callbackPort} because the port is already in use. Stop the process using that port or pass a different \`--callback-port\`.`,{telemetryMessage:`user oauth callback port in use`})):a(t)}),s.listen(e.callbackPort,e.callbackHost)});return e.browser?(n.logger.log(`Opening a link in your default browser: ${a}`),await n.openInBrowser(a)):n.logger.log(`Visit this link to authenticate: ${a}`),Promise.race([l,u])}E(kt,`getOauthToken`);function At(e){let t={},n={generateAuthUrl:e.generateAuthUrl??Ue,generateRandomState:e.generateRandomState??We},r=`default`;function a(t){return e.storageFactory(t??r)}E(a,`getStorage`);let o=E(()=>typeof e.clientId==`function`?e.clientId():e.clientId,`getClientId`),s=e.consent,c=!1,l,d=new URL(e.redirectUri),f=d.hostname,p=Number(d.port);async function m(r){if(e.hasEnvCredentials())return e.logger.error(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth.`),!1;let c=u(r.complianceConfig);if(c===`fedramp_high`)throw new i(ot`
+				OAuth login is not supported in the \`${c}\` compliance region.
+				Please use a Cloudflare API token (\`CLOUDFLARE_API_TOKEN\` environment variable) or remove the ${r.complianceConfig?.compliance_region?"`compliance_region` configuration property":"`CLOUDFLARE_API_ENVIRONMENT` environment variable"}.
+			`,{telemetryMessage:`user login unsupported compliance region`});e.logger.log(`Attempting to login via OAuth...`);let l=await kt({browser:r.browser??!0,scopes:r.scopes,clientId:o(),redirectUri:e.redirectUri,denied:s.denied,granted:s.granted,callbackHost:r.callbackHost??f,callbackPort:r.callbackPort??p},t,e,n);return a(r.profile).write({oauth_token:l.token?.value??``,expiration_time:l.token?.expiry,refresh_token:l.refreshToken?.value,scopes:l.scopes}),e.logger.log(`Successfully logged in.`),C(),e.purgeOnLoginOrLogout?.(),!0}E(m,`login`);function ee(t){if(e.hasEnvCredentials())return!1;let{accessToken:n}=O({warningLogger:e.logger,storage:a(t)});return!!(n&&new Date>=new Date(n.expiry))}E(ee,`isRefreshNeeded`);async function h(t){let n=a(t);try{let{token:{value:t,expiry:r}={value:``,expiry:``},refreshToken:{value:i}={},scopes:a}=await Et(e.logger,e.isNonInteractiveOrCI,o(),n);return n.write({oauth_token:t,expiration_time:r,refresh_token:i,scopes:a}),!0}catch(t){return e.logger.debug(`Token refresh failed: ${t instanceof Error?t.message:String(t)}`),!1}}E(h,`refreshToken`);async function g(t){if(e.hasEnvCredentials())return{loggedIn:!0};let n=O({warningLogger:e.logger,storage:a(t.profile)});return!n.accessToken&&!n.deprecatedApiToken?e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`no-credentials-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`no-credentials-login-failed`}:ee(t.profile)?await h(t.profile)?{loggedIn:!0}:e.isNonInteractiveOrCI()?{loggedIn:!1,reason:`token-expired-non-interactive`}:await m(t)?{loggedIn:!0}:{loggedIn:!1,reason:`token-expired-login-failed`}:{loggedIn:!0}}E(g,`loginOrRefreshIfRequired`);async function _(t){let n=C();if(e.hasEnvCredentials()){e.logger.log(`You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log out.`);return}let r=O({warningLogger:e.logger,storage:a(t)}).refreshToken;if(!r){e.logger.log(n?`Cleared temporary preview account.`:`Not logged in, exiting...`);return}let i=`client_id=${encodeURIComponent(o())}&token_type_hint=refresh_token&token=${encodeURIComponent(r.value||``)}`;await(await(0,D.fetch)(ke(),{method:`POST`,body:i,headers:{"Content-Type":`application/x-www-form-urlencoded`}})).text(),a(t).clear(),e.logger.log(`Successfully logged out.`),e.purgeOnLoginOrLogout?.()}E(_,`logout`);async function v(){let t=O({warningLogger:e.logger,storage:a()});if(t.accessToken){if(t.accessToken&&new Date>=new Date(t.accessToken.expiry)){if(!await h())return;t=O({warningLogger:e.logger,storage:a()})}return t.accessToken?.value}}E(v,`getOAuthTokenFromLocalState`);function y(){return l?{apiToken:l.account.apiToken}:Te({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}E(y,`getAPITokenInternal`);function b(){return l?{apiToken:l.account.apiToken}:Ee({storage:a(),warningLogger:e.logger,allowGlobalAuthKey:e.allowGlobalAuthKey})}E(b,`requireApiTokenInternal`);function x(t){c=t&&e.temporary!==void 0,l=void 0}E(x,`setTemporaryAllowed`);function te(){return c}E(te,`isTemporaryAllowed`);function ne(){return l}E(ne,`getActiveTemporaryAccount`);async function S(){if(!e.temporary)throw new i(`Temporary preview accounts are not supported by this CLI.`,{telemetryMessage:`user temporary account unsupported`});let t=await it({...e.temporary,logger:e.logger});return l=t.account,t}E(S,`activateTemporaryAccount`);function C(){return l=void 0,e.temporary?.storage.clear()??!1}E(C,`clearTemporaryAccount`);function w(e){r=e}E(w,`setProfile`);function re(){return r}E(re,`getActiveProfile`);function ie(){return O({warningLogger:e.logger,storage:a()}).scopes}return E(ie,`getScopes`),{setProfile:w,getActiveProfile:re,login:m,logout:_,loginOrRefreshIfRequired:g,getOAuthTokenFromLocalState:v,getAPIToken:y,requireApiToken:b,getScopes:ie,setTemporaryAllowed:x,isTemporaryAllowed:te,getActiveTemporaryAccount:ne,activateTemporaryAccount:S}}E(At,`createOAuthFlow`);var jt=[`default`,`staging`];function Mt(e){let t={read(){return e.bindings.read()},write(t){e.bindings.write(t)},activate(t,n){let r=b.resolve(n),i=e.bindings.read();i[r]=t,e.bindings.write(i)},deactivate(t){let n=b.resolve(t),r=e.bindings.read(),a=r[n];if(a===void 0){let e=B(n,r);throw e?new i(`No profile is directly bound to "${z(n)}". The active profile "${e.profile}" is bound at "${z(e.dir)}". Run \`wrangler auth deactivate\` from that directory instead.`,{telemetryMessage:`auth deactivate wrong directory`}):new i(`No profile is bound to "${z(n)}". Nothing to deactivate.`,{telemetryMessage:`auth deactivate no binding`})}delete r[n],e.bindings.write(r);let o=B(n,r);return o?{removedProfile:a,newResolution:{profile:o.profile,source:`inherited from ${o.dir}`}}:e.configs.exists(`default`)?{removedProfile:a,newResolution:{profile:`default`,source:`default profile`}}:{removedProfile:a,newResolution:{profile:void 0,source:`no profile`}}},getProfileForDirectory(t){return B(t,e.bindings.read())?.profile},getBindingsForProfile(t){return Object.entries(e.bindings.read()).filter(([,e])=>e===t).map(([e])=>e)},removeAllBindingsForProfile(t){let n=e.bindings.read(),r=[];for(let[e,i]of Object.entries(n))i===t&&(r.push(e),delete n[e]);return r.length>0&&e.bindings.write(n),r}};return{configs:e.configs,bindings:t,resolve(e){return e.profile?e.profile===`default`?`default`:(R(e.profile),e.profile):t.getProfileForDirectory(e.cwd)||`default`}}}E(Mt,`createProfileStore`);function R(e){if(jt.includes(e.toLowerCase()))throw new i(`"${e}" is a reserved profile name. Use \`wrangler login\` and \`wrangler logout\` to manage the default profile, which applies as a global fallback.`,{telemetryMessage:`auth profile reserved name`});if(!/^[a-zA-Z0-9_-]+$/.test(e))throw new i(`Invalid profile name "${e}". Profile names may only contain alphanumeric characters, hyphens, and underscores.`,{telemetryMessage:`auth profile invalid name`})}E(R,`validateProfileName`);function z(e){return b.relative(process.cwd(),e)||`.`}E(z,`formatDirectoryForUserError`);function B(e,t){let n=b.resolve(e),r=Object.entries(t).sort(([e],[t])=>t.length-e.length);for(let[e,t]of r)if(n===e||n.startsWith(e)&&n[e.length]===b.sep)return{profile:t,dir:e}}E(B,`getProfileForDirectoryFromBindings`);function Nt(e,t){let n=e.slice(0,t).split(/\r\n|\n|\r/g);return[n.length,n.pop().length+1]}E(Nt,`getLineColFromPtr`);function Pt(e,t,n){let r=e.split(/\r\n|\n|\r/g),i=``,a=(Math.log10(t+1)|0)+1;for(let e=t-1;e<=t+1;e++){let o=r[e-1];o&&(i+=e.toString().padEnd(a,` `),i+=`:  `,i+=o,i+=`
+`,e===t&&(i+=` `.repeat(a+n+2),i+=`^
+`))}return i}E(Pt,`makeCodeBlock`);var V=class extends Error{static{E(this,`TomlError`)}line;column;codeblock;constructor(e,t){let[n,r]=Nt(t.toml,t.ptr),i=Pt(t.toml,n,r);super(`Invalid TOML document: ${e}
+
+${i}`,t),this.line=n,this.column=r,this.codeblock=i}};function Ft(e,t){let n=0;for(;e[t-++n]===`\\`;);return--n&&n%2}E(Ft,`isEscaped`);function H(e,t=0,n=e.length){let r=e.indexOf(`
+`,t);return e[r-1]===`\r`&&r--,r<=n?r:-1}E(H,`indexOfNewline`);function U(e,t){for(let n=t;n<e.length;n++){let r=e[n];if(r===`
+`)return n;if(r===`\r`&&e[n+1]===`
+`)return n+1;if(r<` `&&r!==`	`||r===``)throw new V(`control characters are not allowed in comments`,{toml:e,ptr:t})}return e.length}E(U,`skipComment`);function W(e,t,n,r){let i;for(;(i=e[t])===` `||i===`	`||!n&&(i===`
+`||i===`\r`&&e[t+1]===`
+`);)t++;return r||i!==`#`?t:W(e,U(e,t),n)}E(W,`skipVoid`);function It(e,t,n,r,i=!1){if(!r)return t=H(e,t),t<0?e.length:t;for(let a=t;a<e.length;a++){let t=e[a];if(t===`#`)a=H(e,a);else if(t===n)return a+1;else if(t===r||i&&(t===`
+`||t===`\r`&&e[a+1]===`
+`))return a}throw new V(`cannot find end of structure`,{toml:e,ptr:t})}E(It,`skipUntil`);function Lt(e,t){let n=e[t],r=n===e[t+1]&&e[t+1]===e[t+2]?e.slice(t,t+3):n;t+=r.length-1;do t=e.indexOf(r,++t);while(t>-1&&n!==`'`&&Ft(e,t));return t>-1&&(t+=r.length,r.length>1&&(e[t]===n&&t++,e[t]===n&&t++)),t}E(Lt,`getStringEnd`);var Rt=/^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i,zt=class e extends Date{static{E(this,`TomlDate`)}#e=!1;#t=!1;#n=null;constructor(e){let t=!0,n=!0,r=`Z`;if(typeof e==`string`){let i=e.match(Rt);i?(i[1]||(t=!1,e=`0000-01-01T${e}`),n=!!i[2],n&&e[10]===` `&&(e=e.replace(` `,`T`)),i[2]&&+i[2]>23?e=``:(r=i[3]||null,e=e.toUpperCase(),!r&&n&&(e+=`Z`))):e=``}super(e),isNaN(this.getTime())||(this.#e=t,this.#t=n,this.#n=r)}isDateTime(){return this.#e&&this.#t}isLocal(){return!this.#e||!this.#t||!this.#n}isDate(){return this.#e&&!this.#t}isTime(){return this.#t&&!this.#e}isValid(){return this.#e||this.#t}toISOString(){let e=super.toISOString();if(this.isDate())return e.slice(0,10);if(this.isTime())return e.slice(11,23);if(this.#n===null)return e.slice(0,-1);if(this.#n===`Z`)return e;let t=this.#n.slice(1,3)*60+ +this.#n.slice(4,6);return t=this.#n[0]===`-`?t:-t,new Date(this.getTime()-t*6e4).toISOString().slice(0,-1)+this.#n}static wrapAsOffsetDateTime(t,n=`Z`){let r=new e(t);return r.#n=n,r}static wrapAsLocalDateTime(t){let n=new e(t);return n.#n=null,n}static wrapAsLocalDate(t){let n=new e(t);return n.#t=!1,n.#n=null,n}static wrapAsLocalTime(t){let n=new e(t);return n.#e=!1,n.#n=null,n}},Bt=/^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/,Vt=/^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/,Ht=/^[+-]?0[0-9_]/,Ut=/^[0-9a-f]{4,8}$/i,Wt={b:`\b`,t:`	`,n:`
+`,f:`\f`,r:`\r`,'"':`"`,"\\":`\\`};function Gt(e,t=0,n=e.length){let r=e[t]===`'`,i=e[t++]===e[t]&&e[t]===e[t+1];i&&(n-=2,e[t+=2]===`\r`&&t++,e[t]===`
+`&&t++);let a=0,o,s=``,c=t;for(;t<n-1;){let n=e[t++];if(n===`
+`||n===`\r`&&e[t]===`
+`){if(!i)throw new V(`newlines are not allowed in strings`,{toml:e,ptr:t-1})}else if(n<` `&&n!==`	`||n===``)throw new V(`control characters are not allowed in strings`,{toml:e,ptr:t-1});if(o){if(o=!1,n===`u`||n===`U`){let r=e.slice(t,t+=n===`u`?4:8);if(!Ut.test(r))throw new V(`invalid unicode escape`,{toml:e,ptr:a});try{s+=String.fromCodePoint(parseInt(r,16))}catch{throw new V(`invalid unicode escape`,{toml:e,ptr:a})}}else if(i&&(n===`
+`||n===` `||n===`	`||n===`\r`)){if(t=W(e,t-1,!0),e[t]!==`
+`&&e[t]!==`\r`)throw new V(`invalid escape: only line-ending whitespace may be escaped`,{toml:e,ptr:a});t=W(e,t)}else if(n in Wt)s+=Wt[n];else throw new V(`unrecognized escape sequence`,{toml:e,ptr:a});c=t}else !r&&n===`\\`&&(a=t-1,o=!0,s+=e.slice(c,a))}return s+e.slice(c,n-1)}E(Gt,`parseString`);function Kt(e,t,n,r){if(e===`true`)return!0;if(e===`false`)return!1;if(e===`-inf`)return-1/0;if(e===`inf`||e===`+inf`)return 1/0;if(e===`nan`||e===`+nan`||e===`-nan`)return NaN;if(e===`-0`)return r?0n:0;let i=Bt.test(e);if(i||Vt.test(e)){if(Ht.test(e))throw new V(`leading zeroes are not allowed`,{toml:t,ptr:n});e=e.replace(/_/g,``);let a=+e;if(isNaN(a))throw new V(`invalid number`,{toml:t,ptr:n});if(i){if((i=!Number.isSafeInteger(a))&&!r)throw new V(`integer value cannot be represented losslessly`,{toml:t,ptr:n});(i||r===!0)&&(a=BigInt(e))}return a}let a=new zt(e);if(!a.isValid())throw new V(`invalid value`,{toml:t,ptr:n});return a}E(Kt,`parseValue`);function qt(e,t,n,r){let i=e.slice(t,n),a=i.indexOf(`#`);a>-1&&(U(e,a),i=i.slice(0,a));let o=i.trimEnd();if(!r){let n=i.indexOf(`
+`,o.length);if(n>-1)throw new V(`newlines are not allowed in inline tables`,{toml:e,ptr:t+n})}return[o,a]}E(qt,`sliceAndTrimEndOf`);function G(e,t,n,r,i){if(r===0)throw new V(`document contains excessively nested structures. aborting.`,{toml:e,ptr:t});let a=e[t];if(a===`[`||a===`{`){let[o,s]=a===`[`?Zt(e,t,r,i):Xt(e,t,r,i),c=n?It(e,s,`,`,n):s;if(s-c&&n===`}`){let t=H(e,s,c);if(t>-1)throw new V(`newlines are not allowed in inline tables`,{toml:e,ptr:t})}return[o,c]}let o;if(a===`"`||a===`'`){o=Lt(e,t);let r=Gt(e,t,o);if(n){if(o=W(e,o,n!==`]`),e[o]&&e[o]!==`,`&&e[o]!==n&&e[o]!==`
+`&&e[o]!==`\r`)throw new V(`unexpected character encountered`,{toml:e,ptr:o});o+=+(e[o]===`,`)}return[r,o]}o=It(e,t,`,`,n);let s=qt(e,t,o-+(e[o-1]===`,`),n===`]`);if(!s[0])throw new V(`incomplete key-value declaration: no value specified`,{toml:e,ptr:t});return n&&s[1]>-1&&(o=W(e,t+s[1]),o+=+(e[o]===`,`)),[Kt(s[0],e,t,i),o]}E(G,`extractValue`);var Jt=/^[a-zA-Z0-9-_]+[ \t]*$/;function Yt(e,t,n=`=`){let r=t-1,i=[],a=e.indexOf(n,t);if(a<0)throw new V(`incomplete key-value: cannot find end of key`,{toml:e,ptr:t});do{let o=e[t=++r];if(o!==` `&&o!==`	`)if(o===`"`||o===`'`){if(o===e[t+1]&&o===e[t+2])throw new V(`multiline strings are not allowed in keys`,{toml:e,ptr:t});let s=Lt(e,t);if(s<0)throw new V(`unfinished string encountered`,{toml:e,ptr:t});r=e.indexOf(`.`,s);let c=e.slice(s,r<0||r>a?a:r),l=H(c);if(l>-1)throw new V(`newlines are not allowed in keys`,{toml:e,ptr:t+r+l});if(c.trimStart())throw new V(`found extra tokens after the string part`,{toml:e,ptr:s});if(a<s&&(a=e.indexOf(n,s),a<0))throw new V(`incomplete key-value: cannot find end of key`,{toml:e,ptr:t});i.push(Gt(e,t,s))}else{r=e.indexOf(`.`,t);let n=e.slice(t,r<0||r>a?a:r);if(!Jt.test(n))throw new V(`only letter, numbers, dashes and underscores are allowed in keys`,{toml:e,ptr:t});i.push(n.trimEnd())}}while(r+1&&r<a);return[i,W(e,a+1,!0,!0)]}E(Yt,`parseKey`);function Xt(e,t,n,r){let i={},a=new Set,o,s=0;for(t++;(o=e[t++])!==`}`&&o;){let c={toml:e,ptr:t-1};if(o===`
+`)throw new V(`newlines are not allowed in inline tables`,c);if(o===`#`)throw new V(`inline tables cannot contain comments`,c);if(o===`,`)throw new V(`expected key-value, found comma`,c);if(o!==` `&&o!==`	`){let o,c=i,l=!1,[u,d]=Yt(e,t-1);for(let n=0;n<u.length;n++){if(n&&(c=l?c[o]:c[o]={}),o=u[n],(l=Object.hasOwn(c,o))&&(typeof c[o]!=`object`||a.has(c[o])))throw new V(`trying to redefine an already defined value`,{toml:e,ptr:t});!l&&o===`__proto__`&&Object.defineProperty(c,o,{enumerable:!0,configurable:!0,writable:!0})}if(l)throw new V(`trying to redefine an already defined value`,{toml:e,ptr:t});let[f,p]=G(e,d,`}`,n-1,r);a.add(f),c[o]=f,t=p,s=e[t-1]===`,`?t-1:0}}if(s)throw new V(`trailing commas are not allowed in inline tables`,{toml:e,ptr:s});if(!o)throw new V(`unfinished table encountered`,{toml:e,ptr:t});return[i,t]}E(Xt,`parseInlineTable`);function Zt(e,t,n,r){let i=[],a;for(t++;(a=e[t++])!==`]`&&a;)if(a===`,`)throw new V(`expected value, found comma`,{toml:e,ptr:t-1});else if(a===`#`)t=U(e,t);else if(a!==` `&&a!==`	`&&a!==`
+`&&a!==`\r`){let a=G(e,t-1,`]`,n-1,r);i.push(a[0]),t=a[1]}if(!a)throw new V(`unfinished array encountered`,{toml:e,ptr:t});return[i,t]}E(Zt,`parseArray`);function Qt(e,t,n,r){let i=t,a=n,o,s=!1,c;for(let t=0;t<e.length;t++){if(t){if(i=s?i[o]:i[o]={},a=(c=a[o]).c,r===0&&(c.t===1||c.t===2))return null;if(c.t===2){let e=i.length-1;i=i[e],a=a[e].c}}if(o=e[t],(s=Object.hasOwn(i,o))&&a[o]?.t===0&&a[o]?.d)return null;s||(o===`__proto__`&&(Object.defineProperty(i,o,{enumerable:!0,configurable:!0,writable:!0}),Object.defineProperty(a,o,{enumerable:!0,configurable:!0,writable:!0})),a[o]={t:t<e.length-1&&r===2?3:r,d:!1,i:0,c:{}})}if(c=a[o],c.t!==r&&!(r===1&&c.t===3)||(r===2&&(c.d||(c.d=!0,i[o]=[]),i[o].push(i={}),c.c[c.i++]=c={t:1,d:!1,i:0,c:{}}),c.d))return null;if(c.d=!0,r===1)i=s?i[o]:i[o]={};else if(r===0&&s)return null;return[o,i,c.c]}E(Qt,`peekTable`);function $t(e,{maxDepth:t=1e3,integersAsBigInt:n}={}){let r={},i={},a=r,o=i;for(let s=W(e,0);s<e.length;){if(e[s]===`[`){let t=e[++s]===`[`,n=Yt(e,s+=+t,`]`);if(t){if(e[n[1]-1]!==`]`)throw new V(`expected end of table declaration`,{toml:e,ptr:n[1]-1});n[1]++}let c=Qt(n[0],r,i,t?2:1);if(!c)throw new V(`trying to redefine an already defined table or value`,{toml:e,ptr:s});o=c[2],a=c[1],s=n[1]}else{let r=Yt(e,s),i=Qt(r[0],a,o,0);if(!i)throw new V(`trying to redefine an already defined table or value`,{toml:e,ptr:s});let c=G(e,r[1],void 0,t,n);i[1][i[0]]=c[0],s=c[1]}if(s=W(e,s,!0),e[s]&&e[s]!==`
+`&&e[s]!==`\r`)throw new V(`each key-value declaration must be followed by an end-of-line`,{toml:e,ptr:s});s=W(e,s)}return r}E($t,`parse`);var en=/^[a-z0-9-_]+$/i;function K(e){let t=typeof e;if(t===`object`){if(Array.isArray(e))return`array`;if(e instanceof Date)return`date`}return t}E(K,`extendedTypeOf`);function tn(e){for(let t=0;t<e.length;t++)if(K(e[t])!==`object`)return!1;return e.length!=0}E(tn,`isArrayOfTables`);function nn(e){return JSON.stringify(e).replace(/\x7f/g,`\\u007f`)}E(nn,`formatString`);function rn(e,t,n,r){if(n===0)throw Error(`Could not stringify the object: maximum object depth exceeded`);if(t===`number`)return isNaN(e)?`nan`:e===1/0?`inf`:e===-1/0?`-inf`:r&&Number.isInteger(e)?e.toFixed(1):e.toString();if(t===`bigint`||t===`boolean`)return e.toString();if(t===`string`)return nn(e);if(t===`date`){if(isNaN(e.getTime()))throw TypeError(`cannot serialize invalid date`);return e.toISOString()}if(t===`object`)return an(e,n,r);if(t===`array`)return on(e,n,r)}E(rn,`stringifyValue`);function an(e,t,n){let r=Object.keys(e);if(r.length===0)return`{}`;let i=`{ `;for(let a=0;a<r.length;a++){let o=r[a];a&&(i+=`, `),i+=en.test(o)?o:nn(o),i+=` = `,i+=rn(e[o],K(e[o]),t-1,n)}return i+` }`}E(an,`stringifyInlineTable`);function on(e,t,n){if(e.length===0)return`[]`;let r=`[ `;for(let i=0;i<e.length;i++){if(i&&(r+=`, `),e[i]===null||e[i]===void 0)throw TypeError(`arrays cannot contain null or undefined values`);r+=rn(e[i],K(e[i]),t-1,n)}return r+` ]`}E(on,`stringifyArray`);function sn(e,t,n,r){if(n===0)throw Error(`Could not stringify the object: maximum object depth exceeded`);let i=``;for(let a=0;a<e.length;a++)i+=`${i&&`
+`}[[${t}]]
+`,i+=cn(0,e[a],t,n,r);return i}E(sn,`stringifyArrayTable`);function cn(e,t,n,r,i){if(r===0)throw Error(`Could not stringify the object: maximum object depth exceeded`);let a=``,o=``,s=Object.keys(t);for(let e=0;e<s.length;e++){let c=s[e];if(t[c]!==null&&t[c]!==void 0){let e=K(t[c]);if(e===`symbol`||e===`function`)throw TypeError(`cannot serialize values of type '${e}'`);let s=en.test(c)?c:nn(c);if(e===`array`&&tn(t[c]))o+=(o&&`
+`)+sn(t[c],n?`${n}.${s}`:s,r-1,i);else if(e===`object`){let e=n?`${n}.${s}`:s;o+=(o&&`
+`)+cn(e,t[c],e,r-1,i)}else a+=s,a+=` = `,a+=rn(t[c],e,r,i),a+=`
+`}}return e&&(a||!o)&&(a=a?`[${e}]
+${a}`:`[${e}]`),a&&o?`${a}
+${o}`:a||o}E(cn,`stringifyTable`);function ln(e,{maxDepth:t=1e3,numbersAsFloat:n=!1}={}){if(K(e)!==`object`)throw TypeError(`stringify can only be called with an object`);let r=cn(0,e,``,t,n);return r[r.length-1]===`
+`?r:r+`
+`}E(ln,`stringify`);var un={parse:$t,stringify:ln,TomlDate:zt,TomlError:V},dn={toml:{parse:E(e=>a(e),`parse`),stringify:E(e=>un.stringify(e),`stringify`)},json:{parse:E(e=>JSON.parse(e),`parse`),stringify:E(e=>JSON.stringify(e,null,`	`),`stringify`)}};function q(e,t){return dn[e].parse(t)}E(q,`parseFile`);function fn(e,t){return dn[e].stringify(t)}E(fn,`stringifyFile`);var pn=`config`;function mn(e){if(e===void 0||e===`default`){let e=o();return e===`production`?`default`:e}return R(e),e}E(mn,`resolveAuthProfileBaseName`);function J(e,t,n=`toml`){return b.join(e,pn,`${mn(t)}.${n}`)}E(J,`getAuthConfigFilePath`);var hn=class{constructor(e,t,n=`toml`){this.configPath=e,this.profile=t,this.format=n}static{E(this,`FileCredentialStore`)}kind=`file`;filePath(){return J(this.configPath,this.profile,this.format)}read(){let t=this.filePath();if(h(t))return q(this.format,e(t))}write(e){let t=this.filePath();g(b.dirname(t),{recursive:!0}),v(t,fn(this.format,e),{encoding:`utf-8`,mode:384}),ee(t,384)}clear(){let e=this.filePath(),t=h(e);return t&&_(e),t}path(){return this.filePath()}describe(){return this.filePath()}},Y=32,gn=12,_n=16,vn=`AES-256-GCM`,yn=`aes-256-gcm`;function bn(){return new Uint8Array(C(Y))}E(bn,`generateKey`);function xn(e,t){if(t.length!==Y)throw Error(`AES-256-GCM requires a ${Y}-byte key (got ${t.length} bytes).`);let n=C(gn),r=te(yn,t,n),i=Buffer.concat([r.update(e,`utf-8`),r.final()]),a=r.getAuthTag();return{v:1,alg:vn,iv:n.toString(`base64`),tag:a.toString(`base64`),ciphertext:i.toString(`base64`)}}E(xn,`encryptString`);function Sn(e,t){if(t.length!==Y)throw Error(`AES-256-GCM requires a ${Y}-byte key (got ${t.length} bytes).`);if(e.v!==1)throw Error(`Unsupported encrypted envelope version: ${e.v}.`);let n=Buffer.from(e.iv,`base64`),r=Buffer.from(e.tag,`base64`),i=Buffer.from(e.ciphertext,`base64`);if(n.length!==gn)throw Error(`Expected ${gn}-byte IV in envelope (got ${n.length} bytes).`);if(r.length!==_n)throw Error(`Expected ${_n}-byte auth tag in envelope (got ${r.length} bytes).`);let a=ne(yn,t,n);return a.setAuthTag(r),Buffer.concat([a.update(i),a.final()]).toString(`utf-8`)}E(Sn,`decryptString`);function Cn(e){if(typeof e!=`object`||!e)return;let t=e;if(!(t.v!==1||t.alg!==vn||typeof t.iv!=`string`||typeof t.tag!=`string`||typeof t.ciphertext!=`string`))return t}E(Cn,`parseEncryptedEnvelope`);function X(e,t){return b.join(e,`config`,`${mn(t)}.enc`)}E(X,`getEncryptedAuthConfigFilePath`);var wn=class{constructor(e,t,n,r,i=`toml`){this.configPath=e,this.keyProvider=t,this.onPlaintextMigration=n,this.profile=r,this.format=i}static{E(this,`EncryptedFileCredentialStore`)}kind=`encrypted-file`;plaintextPath(){return J(this.configPath,this.profile,this.format)}read(){let e=X(this.configPath,this.profile);if(h(e))return this.readEncryptedFile(e);let t=this.plaintextPath();if(h(t))return this.migrateFromPlaintext(t,e)}write(e){let t=this.ensureKey(),n=xn(fn(this.format,e),t),r=X(this.configPath,this.profile);g(b.dirname(r),{recursive:!0}),v(r,JSON.stringify(n,null,`	`),{encoding:`utf-8`,mode:384}),ee(r,384);let i=this.plaintextPath();h(i)&&_(i)}clear(){let e=X(this.configPath,this.profile),t=this.plaintextPath(),n=!1;h(e)&&(_(e),n=!0),h(t)&&(_(t),n=!0);try{this.keyProvider.deleteKey()}catch{}return n}path(){return X(this.configPath,this.profile)}describe(){return`Encrypted file (${X(this.configPath,this.profile)}) with key in ${this.keyProvider.describe()}`}readEncryptedFile(t){let n=this.keyProvider.getKey();if(n===void 0)return;let r=e(t),i;try{i=Cn(JSON.parse(r))}catch{return}if(i===void 0)return;let a;try{a=Sn(i,n)}catch{return}try{return q(this.format,a)}catch{return}}migrateFromPlaintext(t,n){let r=e(t),i;try{i=q(this.format,r)}catch{return}return this.write(i),this.onPlaintextMigration?.({plaintextPath:t,encryptedPath:n,keyProviderDescription:this.keyProvider.describe()}),i}ensureKey(){let e=this.keyProvider.getKey();if(e!==void 0)return e;let t=bn();return this.keyProvider.setKey(t),t}},Tn=`1.3.0`;function En(e){return x(`npm`,e,{encoding:`utf-8`,stdio:[`ignore`,`pipe`,`pipe`],shell:process.platform===`win32`})}E(En,`defaultNpmRunner`);var Dn=En,Z=new Map;function On(e){Dn=e??En,Z.clear()}E(On,`setNpmRunner`);function kn(e){return b.join(e,`native`,`keyring`)}E(kn,`getKeyringInstallDir`);function An(e){return b.join(e,`node_modules`,`@napi-rs`,`keyring`)}E(An,`getInstalledBindingPath`);function jn(e){let t=Z.get(e);if(t!==void 0)return t;let n=An(e);if(h(b.join(n,`index.js`)))return Z.set(e,n),n;try{let t=Dn([`root`,`-g`]);if(t.status===0){let n=b.join(t.stdout.trim(),`@napi-rs`,`keyring`);if(h(b.join(n,`index.js`)))return Z.set(e,n),n}}catch{}return Z.set(e,null),null}E(jn,`findKeyringBinding`);function Mn(e){let t=e;g(t,{recursive:!0});let n=b.join(t,`package.json`);h(n)||v(n,JSON.stringify({private:!0,name:`cloudflare-auth-keyring-host`},null,`	`),`utf-8`);let r;try{r=Dn([`install`,`@napi-rs/keyring@${Tn}`,`--prefix`,t,`--no-save`,`--no-audit`,`--no-fund`,`--no-package-lock`,`--loglevel=error`])}catch(e){throw new i(`Failed to spawn \`npm\` to install the keyring backend: ${e instanceof Error?e.message:String(e)}
+
+Install \`npm\` and retry, or install the binding globally:
+  npm install -g @napi-rs/keyring@${Tn}`,{telemetryMessage:`workers-auth keyring npm spawn failed`})}if(r.status!==0)throw new i(`Failed to install \`@napi-rs/keyring\` (npm exited ${r.status}):
+${r.stderr?.trim()??`(no stderr)`}
+
+Retry once the underlying issue is fixed, or install the binding globally:
+  npm install -g @napi-rs/keyring@${Tn}`,{telemetryMessage:`workers-auth keyring npm install failed`});Z.delete(e)}E(Mn,`installKeyringBindingSync`);var Nn;function Pn(e){Nn=e}E(Pn,`setKeyringEntryFactory`);var Fn=m(import.meta.url);function In(e){if(Nn!==void 0)return Nn;let t=jn(e);if(t===null)throw Error("`@napi-rs/keyring` binding not found. Call `installKeyringBindingSync()` first.");let n=Fn(t);return(e,t)=>new n.Entry(e,t)}E(In,`resolveKeyringEntryFactory`);function Q(e){return mn(e)}E(Q,`getKeyringAccountName`);function Ln(e){let t={v:1,key:Buffer.from(e).toString(`base64`),created:new Date().toISOString()};return JSON.stringify(t)}E(Ln,`encodeKeyEnvelope`);function Rn(e){if(e===``)return;let t;try{t=JSON.parse(e)}catch{return}if(!(typeof t!=`object`||!t||t.v!==1||typeof t.key!=`string`))try{let e=Buffer.from(t.key,`base64`);return e.length===32?new Uint8Array(e):void 0}catch{return}}E(Rn,`decodeKeyEnvelope`);function zn(e,t={}){return x(`secret-tool`,e,{encoding:`utf-8`,input:t.input})}E(zn,`defaultRunner`);var $=zn,Bn=void 0;function Vn(e){$=e??zn,Bn=void 0}E(Vn,`setLinuxSecretToolRunner`);function Hn(){if(Bn!==void 0)return Bn;let e;try{e=$([`--version`]).status===0}catch{e=!1}return Bn=e,e}E(Hn,`probeSecretTool`);var Un=class{constructor(e,t){this.serviceName=e,this.profile=t}static{E(this,`LinuxSecretToolKeyProvider`)}getKey(){let e=$([`lookup`,`service`,this.serviceName,`account`,Q(this.profile)]);if(e.status!==1){if(e.status!==0)throw Error(`Failed to read key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Rn(e.stdout.trim())}}setKey(e){let t=$([`store`,`--label=Cloudflare credentials key`,`service`,this.serviceName,`account`,Q(this.profile)],{input:Ln(e)});if(t.status!==0)throw Error(`Failed to write key via secret-tool (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=$([`clear`,`service`,this.serviceName,`account`,Q(this.profile)]);if(e.status!==0)throw Error(`Failed to delete key via secret-tool (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`Linux secret-tool (service=${this.serviceName}, account=${Q(this.profile)})`}},Wn=44;function Gn(e,t={}){return x(`/usr/bin/security`,e,{encoding:`utf-8`,input:t.input})}E(Gn,`defaultRunner`);var Kn=Gn;function qn(e){Kn=e??Gn}E(qn,`setMacSecurityCommandRunner`);var Jn=class{constructor(e,t){this.serviceName=e,this.profile=t}static{E(this,`MacSecurityKeyProvider`)}getKey(){let e=Kn([`find-generic-password`,`-s`,this.serviceName,`-a`,Q(this.profile),`-w`]);if(e.status!==Wn){if(e.status!==0)throw Error(`Failed to read key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`);return Rn(e.stdout.trim())}}setKey(e){let t=Kn([`add-generic-password`,`-s`,this.serviceName,`-a`,Q(this.profile),`-w`,Ln(e),`-U`]);if(t.status!==0)throw Error(`Failed to write key to macOS Keychain (exit ${t.status}): ${t.stderr?.trim()??`(no stderr)`}`)}deleteKey(){let e=Kn([`delete-generic-password`,`-s`,this.serviceName,`-a`,Q(this.profile)]);if(!(e.status===0||e.status===Wn))throw Error(`Failed to delete key from macOS Keychain (exit ${e.status}): ${e.stderr?.trim()??`(no stderr)`}`)}describe(){return`macOS Keychain (service=${this.serviceName}, account=${Q(this.profile)})`}},Yn=class{constructor(e,t,n){this.serviceName=e,this.installDir=t,this.profile=n}static{E(this,`NapiKeyringKeyProvider`)}entry(){return In(this.installDir)(this.serviceName,Q(this.profile))}getKey(){let e=this.entry().getPassword();if(!(e===null||e===``))return Rn(e)}setKey(e){this.entry().setPassword(Ln(e))}deleteKey(){try{this.entry().deletePassword()}catch{}}describe(){return`${process.platform===`win32`?`Windows Credential Manager`:`OS keyring`} via @napi-rs/keyring (service=${this.serviceName}, account=${Q(this.profile)})`}},Xn;function Zn(e){Xn=e}E(Zn,`setKeyProviderFactoryForTesting`);function Qn(e,t,n){if(Xn!==void 0)return{kind:`available`,provider:Xn(e,t)};switch(process.platform){case`darwin`:return{kind:`available`,provider:new Jn(e,t)};case`linux`:return Hn()?{kind:`available`,provider:new Un(e,t)}:{kind:`unsupported`};case`win32`:{let r=kn(n);return jn(r)===null?{kind:`needs-install`,install:E(()=>Mn(r),`install`),afterInstall:E(()=>new Yn(e,r,t),`afterInstall`)}:{kind:`available`,provider:new Yn(e,r,t)}}default:return{kind:`unsupported`}}}E(Qn,`resolveKeyProvider`);var $n={installFailedThisSession:!1,hasWarnedAboutKeyringFallback:!1,hasWarnedAboutSecretToolMissing:!1};function er(){return $n}E(er,`getResolverSessionFlags`);function tr(){$n.installFailedThisSession=!1,$n.hasWarnedAboutKeyringFallback=!1,$n.hasWarnedAboutSecretToolMissing=!1}E(tr,`resetCredentialStorageState`);function nr(e){let t={...e,loginCommand:e.loginCommand??`your CLI login`,format:e.format??`toml`};function n(e){return rr(t,e)}E(n,`getActiveStore`);function r(e){return{read:E(()=>n(e).read(),`read`),write:E(t=>n(e).write(t),`write`),clear:E(()=>n(e).clear(),`clear`),path:E(()=>n(e).path(),`path`)}}return E(r,`storageFactory`),{storageFactory:r,getActiveStore:n}}E(nr,`createCredentialStorageContext`);function rr(e,t){let n=Pe(),r=e.getConfigPath();if(n===!1)return new hn(r,t,e.format);let i=n===!0;if(!(n??e.isKeyringEnabled()??!1))return new hn(r,t,e.format);let a=Qn(e.serviceName,t,r);switch(a.kind){case`available`:return new wn(r,a.provider,ir(e),t,e.format);case`needs-install`:return ar(a,i,e,t);case`unsupported`:return or(i,e,t)}}E(rr,`resolveActiveCredentialStore`);function ir(e){return t=>{e.logger.warn(`Migrated credentials from ${t.plaintextPath} into ${t.encryptedPath} (key in ${t.keyProviderDescription}). The plaintext file has been deleted.`)}}E(ir,`buildMigrationLogger`);function ar(e,t,n,r){let a=er();if(a.installFailedThisSession){if(t)throw new i(`CLOUDFLARE_AUTH_USE_KEYRING is set but the keyring backend could not be installed earlier this session.`,{telemetryMessage:`workers-auth keyring install previously failed`});return sr(`The keyring backend could not be installed earlier this session; using the plaintext credentials file.`,n,r)}if(n.isNonInteractiveOrCI())throw new i(lr(n.loginCommand),{telemetryMessage:`workers-auth keyring binding not installed`});try{n.logger.log(`🔐 Installing keyring backend (one-time, ~2 MB)…`),e.install()}catch(e){if(a.installFailedThisSession=!0,t)throw e instanceof i?e:new i(`Failed to install the keyring backend: ${e instanceof Error?e.message:String(e)}`,{telemetryMessage:`workers-auth keyring install threw`});return sr(`Failed to install the keyring backend (${e instanceof Error?e.message:String(e)}); falling back to the plaintext credentials file.`,n,r)}return new wn(n.getConfigPath(),e.afterInstall(),ir(n),r,n.format)}E(ar,`handleNeedsInstall`);function or(e,t,n){let r=process.platform,a=r===`linux`,o=a?cr(t.loginCommand):`OS keyring storage is not supported on \`${r}\`; falling back to the plaintext credentials file.`;if(e)throw new i(a?`CLOUDFLARE_AUTH_USE_KEYRING is set but ${o}`:`CLOUDFLARE_AUTH_USE_KEYRING is set but no keyring backend is available on \`${r}\`.`,{telemetryMessage:a?`workers-auth keyring secret tool missing`:`workers-auth keyring unsupported platform`});if(a&&t.isNonInteractiveOrCI())throw new i(o,{telemetryMessage:`workers-auth keyring secret tool missing`});let s=er();return a?(s.hasWarnedAboutSecretToolMissing||(s.hasWarnedAboutSecretToolMissing=!0,t.logger.warn(`${o}
+
+Falling back to the plaintext credentials file for this session.`)),new hn(t.getConfigPath(),n,t.format)):sr(o,t,n)}E(or,`handleUnsupported`);function sr(e,t,n){let r=er();return r.hasWarnedAboutKeyringFallback||(r.hasWarnedAboutKeyringFallback=!0,t.logger.warn(e)),new hn(t.getConfigPath(),n,t.format)}E(sr,`fallbackToFileWithWarning`);function cr(e){return`\`secret-tool\` is required for OS keyring storage on Linux but is not installed.
+
+Install it via your package manager:
+  Debian/Ubuntu:  sudo apt-get install libsecret-tools
+  Fedora/RHEL:    sudo dnf install libsecret
+  Arch:           sudo pacman -S libsecret
+  Alpine:         apk add libsecret
+
+Or disable keyring storage: \`${e} --no-use-keyring\`.`}E(cr,`secretToolMissingMessage`);function lr(e){return`\`@napi-rs/keyring\` is required for OS keyring storage on Windows but is not installed.
+
+Run \`${e} --use-keyring\` interactively to install it automatically, or install it globally for CI:
+
+  npm install -g @napi-rs/keyring@${Tn}
+
+Or disable keyring storage: \`${e} --no-use-keyring\`.`}E(lr,`windowsBindingMissingMessage`);function ur(e){let t=X(e.configPath,e.profile),n=h(t),r=Qn(e.serviceName,e.profile,e.configPath);return r.kind===`available`?(new wn(e.configPath,r.provider,void 0,e.profile,e.format??`toml`).clear(),{backendAvailable:!0,encryptedFileExisted:n}):(n&&_(t),{backendAvailable:!1,encryptedFileExisted:n})}E(ur,`scrubEncryptedCredentials`);function dr(e){let t=f(),n=process.env.CF_DELEGATION?` ${t.dim(`·`)} ${t.dim(`delegated`)}`:``,r=`🍊☁️  ${t.bold.hex(p.orange)(`cf`)} ${t.dim(`·`)} ${t.dim(`v${e}`)}${n}`,i=ae(r).length,a=`─`.repeat(i);return`${r}\n${t.hex(p.orange)(a)}`}let fr=!1,pr=!1,mr=!1;function hr(e,t={}){if(!(fr||pr)){if(t.quiet||!process.stderr.isTTY){pr=!0;return}process.stderr.write(`${dr(e)}\n`),fr=!0}}function gr(e){!fr||pr||mr||e===`default`||we({allowGlobalAuthKey:!1})!==void 0||(process.stderr.write(`${d.muted(`Active profile:`)} ${d.info(e)}\n`),mr=!0)}export{E as _,At as a,ge as b,J as c,Pe as d,X as f,R as g,fn as h,nr as i,we as l,ur as m,gr as n,Mt as o,q as p,dr as r,at as s,hr as t,Ae as u,ve as v,le as x,_e as y};