devflare 1.0.0-next.5 → 1.0.0-next.50

package/dist/_chunks/api-TzdliH-6.js

@@ -0,0 +1,568 @@
+import { t as __exportAll } from "./rolldown-runtime-CvQ6eiug.js";
+import { existsSync, readFileSync } from "node:fs";
+import { execSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parse } from "smol-toml";
+//#region src/cloudflare/auth.ts
+const WRANGLER_CONFIG_FILE = "config/default.toml";
+const EXPIRY_BUFFER_MS = 300 * 1e3;
+let cachedToken = null;
+let cacheExpiresAt = 0;
+/**
+* Invalidate the cached token (call when API returns auth error)
+* This forces the next getApiToken() call to refresh via wrangler
+*/
+function invalidateToken() {
+	cachedToken = null;
+	cacheExpiresAt = 0;
+}
+/**
+* Get possible paths to wrangler's config file
+* Returns array of paths to check, in order of priority
+*/
+function getWranglerConfigPaths() {
+	const paths = [];
+	if (process.platform === "win32" && process.env.APPDATA) paths.push(join(process.env.APPDATA, "xdg.config", ".wrangler", WRANGLER_CONFIG_FILE));
+	if (process.env.XDG_CONFIG_HOME) paths.push(join(process.env.XDG_CONFIG_HOME, ".wrangler", WRANGLER_CONFIG_FILE));
+	paths.push(join(homedir(), ".wrangler", WRANGLER_CONFIG_FILE));
+	return paths;
+}
+/**
+* Get the path to wrangler's config file (first existing path)
+*/
+function getWranglerConfigPath() {
+	const paths = getWranglerConfigPaths();
+	for (const path of paths) if (existsSync(path)) return path;
+	return null;
+}
+/**
+* Check if wrangler config file exists
+*/
+function hasWranglerConfig() {
+	return getWranglerConfigPath() !== null;
+}
+/**
+* Parse TOML config file (wrangler's stored OAuth state).
+*
+* Uses a real TOML parser (`smol-toml`) so that nested sections, escapes,
+* and other TOML 1.0 constructs are handled correctly. We deliberately
+* read only the implicit root section: any keys nested under a `[section]`
+* header are ignored to keep this resilient against future wrangler
+* additions that put new sections in the same file. If the parser throws
+* (corrupt file, partial write), the caller falls back to the slower
+* `bunx wrangler auth token` shell-out path.
+*/
+function parseSimpleToml(content) {
+	let parsed;
+	try {
+		parsed = parse(content);
+	} catch {
+		return {};
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(parsed)) if (typeof value === "string") result[key] = value;
+	else if (typeof value === "number" || typeof value === "boolean") result[key] = String(value);
+	return result;
+}
+/**
+* Extract OAuth token info from wrangler's stored configuration (sync)
+* Returns token and expiration time if available
+*/
+function readWranglerConfig() {
+	const configPath = getWranglerConfigPath();
+	if (!configPath || !existsSync(configPath)) return null;
+	try {
+		const config = parseSimpleToml(readFileSync(configPath, "utf-8"));
+		const token = config.oauth_token;
+		const expirationTime = config.expiration_time;
+		if (token && expirationTime) return {
+			token,
+			expiresAt: new Date(expirationTime)
+		};
+		return null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Extract OAuth token info from wrangler's stored configuration
+*/
+async function getWranglerAuth() {
+	const config = readWranglerConfig();
+	if (!config) return null;
+	const configPath = getWranglerConfigPath();
+	if (!configPath) return null;
+	try {
+		const parsed = parseSimpleToml(readFileSync(configPath, "utf-8"));
+		return {
+			oauthToken: parsed.oauth_token,
+			refreshToken: parsed.refresh_token,
+			expiresAt: config.expiresAt
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Refresh the token via `wrangler auth token` command
+* This is slow (~2-3s) so only called when necessary
+*/
+function refreshWranglerToken() {
+	try {
+		const lines = execSync("bunx wrangler auth token", {
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			timeout: 15e3
+		}).trim().split(/\r?\n/).filter((l) => l.trim().length > 0);
+		const token = lines[lines.length - 1]?.trim();
+		if (token && token.length >= 20 && !token.includes("wrangler") && !token.includes("⛅")) return token;
+		return null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Get the API token to use for Cloudflare API requests
+*
+* Strategy (fast path first):
+* 1. Check in-memory cache (unless forceRefresh)
+* 2. Check CLOUDFLARE_API_TOKEN env var
+* 3. Read token from wrangler config (if not expired)
+* 4. Call `wrangler auth token` to refresh (slow, only when needed)
+*
+* @param forceRefresh - Skip cache and force a refresh via wrangler
+*/
+async function getApiToken(forceRefresh = false) {
+	if (!forceRefresh && cachedToken && Date.now() < cacheExpiresAt) return cachedToken;
+	const envToken = process.env.CLOUDFLARE_API_TOKEN;
+	if (envToken) return envToken;
+	if (!forceRefresh) {
+		const config = readWranglerConfig();
+		if (config) {
+			const now = Date.now();
+			const expiresAt = config.expiresAt.getTime();
+			if (now < expiresAt - EXPIRY_BUFFER_MS) {
+				cachedToken = config.token;
+				cacheExpiresAt = expiresAt - EXPIRY_BUFFER_MS;
+				return config.token;
+			}
+		}
+	}
+	const refreshedToken = refreshWranglerToken();
+	if (refreshedToken) {
+		cachedToken = refreshedToken;
+		cacheExpiresAt = Date.now() + EXPIRY_BUFFER_MS;
+		return refreshedToken;
+	}
+	return null;
+}
+/**
+* Check if we have valid authentication
+*/
+async function isAuthenticated() {
+	return await getApiToken() !== null;
+}
+//#endregion
+//#region src/cloudflare/api.ts
+var api_exports = /* @__PURE__ */ __exportAll({
+	AuthenticationError: () => AuthenticationError,
+	CloudflareAPIError: () => CloudflareAPIError,
+	apiDelete: () => apiDelete,
+	apiGet: () => apiGet,
+	apiGetAll: () => apiGetAll,
+	apiPatch: () => apiPatch,
+	apiPost: () => apiPost,
+	apiPut: () => apiPut,
+	createCloudflareAuthSession: () => createCloudflareAuthSession,
+	kvDelete: () => kvDelete,
+	kvGet: () => kvGet,
+	kvPut: () => kvPut,
+	parseCloudflareEnvelope: () => parseCloudflareEnvelope
+});
+const API_BASE = "https://api.cloudflare.com/client/v4";
+const DEFAULT_TIMEOUT = 1e4;
+var CloudflareAPIError = class extends Error {
+	constructor(message, code, errors) {
+		super(message);
+		this.code = code;
+		this.errors = errors;
+		this.name = "CloudflareAPIError";
+	}
+};
+var AuthenticationError = class extends Error {
+	constructor(message = "Not authenticated. Run: devflare login") {
+		super(message);
+		this.name = "AuthenticationError";
+	}
+};
+/**
+* Wrap fetch with a guaranteed timeout using Promise.race
+* AbortSignal can sometimes fail to abort in certain environments
+*/
+async function fetchWithTimeout(url, init, timeoutMs) {
+	const controller = new AbortController();
+	const abortTimeoutId = setTimeout(() => controller.abort(), timeoutMs);
+	let rejectTimeoutId = null;
+	const timeoutPromise = new Promise((_, reject) => {
+		rejectTimeoutId = setTimeout(() => reject(/* @__PURE__ */ new Error(`Request timed out after ${timeoutMs}ms`)), timeoutMs);
+	});
+	try {
+		return await Promise.race([fetch(url, {
+			...init,
+			signal: controller.signal
+		}), timeoutPromise]);
+	} finally {
+		clearTimeout(abortTimeoutId);
+		if (rejectTimeoutId) clearTimeout(rejectTimeoutId);
+	}
+}
+function tryParseJson(text) {
+	if (text.length === 0) return { ok: false };
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(text)
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+function isEnvelopeShape(value) {
+	if (!value || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.success === "boolean" && Array.isArray(record.errors) && Array.isArray(record.messages) && "result" in record;
+}
+/**
+* Some Cloudflare API surfaces (notably the v4 Queues list endpoint)
+* return a bare `{ result, result_info? }` body without the standard
+* `{ success, errors, messages }` envelope. When the HTTP response is
+* a 2xx, treat this as a successful envelope so callers don't fail on
+* a perfectly valid payload.
+*/
+function coerceBareResultEnvelope(value, response) {
+	if (!response.ok) return null;
+	if (!value || typeof value !== "object") return null;
+	const record = value;
+	if (!("result" in record)) return null;
+	return {
+		success: true,
+		errors: [],
+		messages: [],
+		result: record.result,
+		...record.result_info && typeof record.result_info === "object" ? { result_info: record.result_info } : {}
+	};
+}
+function envelopeFailureError(response, envelope, endpoint) {
+	const first = envelope.errors[0];
+	return new CloudflareAPIError(first ? `Cloudflare ${endpoint} failed (${first.code}): ${first.message}` : `Cloudflare ${endpoint} failed`, response.status, envelope.errors);
+}
+/**
+* Read a response body once (as text) and decode the Cloudflare v4 envelope
+* without throwing on `success: false`. Returns `null` when a 404 is
+* explicitly allowed via `allow404: true`.
+*
+* Throws `CloudflareAPIError` when the body is not valid JSON or does not
+* match the expected v4 envelope shape.
+*/
+async function decodeCloudflareEnvelope(response, opts) {
+	if (opts.allow404 === true && response.status === 404) return null;
+	const text = await response.text();
+	const parsed = tryParseJson(text);
+	if (!parsed.ok) throw new CloudflareAPIError(`Cloudflare API returned an invalid JSON response. Body: ${truncateBody(text)}`, response.status, []);
+	if (!isEnvelopeShape(parsed.value)) {
+		const coerced = coerceBareResultEnvelope(parsed.value, response);
+		if (coerced) return coerced;
+		throw new CloudflareAPIError(`Cloudflare ${opts.endpoint} returned a non-envelope JSON response. Body: ${truncateBody(text)}`, response.status, []);
+	}
+	return parsed.value;
+}
+function truncateBody(text, max = 500) {
+	const trimmed = text.trim();
+	if (trimmed.length <= max) return trimmed;
+	return `${trimmed.slice(0, max)}…[truncated, total ${trimmed.length} chars]`;
+}
+/**
+* Canonical Cloudflare v4 envelope parser.
+*
+* - Reads the response body exactly once (text -> tryParseJson).
+* - Enforces the `{ success, errors, messages, result }` shape.
+* - Throws `CloudflareAPIError` when `success === false`, surfacing
+*   `errors[0].code` and `errors[0].message`.
+* - Treats `404` as success when `allow404: true` is passed, returning
+*   `null as T` without reading the body.
+*/
+async function parseCloudflareEnvelope(response, opts) {
+	const envelope = await decodeCloudflareEnvelope(response, opts);
+	if (envelope === null) return null;
+	if (!envelope.success) throw envelopeFailureError(response, envelope, opts.endpoint);
+	return envelope.result;
+}
+/**
+* Create a small auth session abstraction that centralises "which token are
+* we sending" for every request. The session owns token resolution and
+* invalidation so request code does not call `getApiToken` directly.
+*/
+function createCloudflareAuthSession(opts = {}) {
+	const provider = opts.tokenProvider ?? ((forceRefresh) => getApiToken(forceRefresh));
+	const onInvalidate = opts.onInvalidate ?? invalidateToken;
+	return {
+		async getAuthHeader(forceRefresh = false) {
+			const token = await provider(forceRefresh);
+			if (!token) throw new AuthenticationError();
+			return `Bearer ${token}`;
+		},
+		invalidate() {
+			onInvalidate();
+		}
+	};
+}
+const defaultAuthSession = createCloudflareAuthSession({});
+async function resolveAuthHeader(options, forceRefresh = false) {
+	if (options?.token) return `Bearer ${options.token}`;
+	return defaultAuthSession.getAuthHeader(forceRefresh);
+}
+/**
+* Check if a decoded envelope represents an auth failure worth retrying.
+*/
+function isAuthError(response, envelope) {
+	if (response.status === 401) return true;
+	if (!envelope.success && envelope.errors?.some((e) => e.code === 1e4 || e.message?.toLowerCase().includes("authentication") || e.message?.toLowerCase().includes("token"))) return true;
+	return false;
+}
+/**
+* Execute a Cloudflare JSON request and return the decoded envelope without
+* throwing on `success: false` so callers can inspect and retry on auth
+* errors before surfacing failures.
+*
+* Bursts of resource creates (KV, D1, Queues during deploy) can hit
+* Cloudflare's per-account rate limits, and edge proxies occasionally return
+* 5xx. We retry network errors and 429/5xx responses with bounded
+* exponential backoff before surfacing the failure.
+*/
+const RETRYABLE_STATUS = new Set([
+	408,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const RETRY_BASE_DELAY_MS = 250;
+const RETRY_MAX_ATTEMPTS = 4;
+function shouldRetryResponse(response) {
+	return RETRYABLE_STATUS.has(response.status);
+}
+function backoffDelayMs(attempt, retryAfterHeader) {
+	if (retryAfterHeader) {
+		const parsed = Number(retryAfterHeader);
+		if (Number.isFinite(parsed) && parsed > 0) return Math.min(parsed * 1e3, 1e4);
+	}
+	const base = RETRY_BASE_DELAY_MS * 2 ** attempt;
+	const jitter = Math.random() * RETRY_BASE_DELAY_MS;
+	return Math.min(base + jitter, 1e4);
+}
+async function requestCloudflareJson(path, request, options) {
+	const endpoint = `${request.method} ${path}`;
+	const makeRequest = async (forceRefresh) => {
+		const authorization = await resolveAuthHeader(options, forceRefresh);
+		const headers = new Headers({
+			Authorization: authorization,
+			"Content-Type": "application/json"
+		});
+		const response = await fetchWithTimeout(`${API_BASE}${path}`, {
+			method: request.method,
+			headers,
+			...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
+		}, options?.timeout ?? DEFAULT_TIMEOUT);
+		return {
+			response,
+			envelope: await decodeCloudflareEnvelope(response, { endpoint })
+		};
+	};
+	let result = null;
+	let lastError = null;
+	for (let attempt = 0; attempt < RETRY_MAX_ATTEMPTS; attempt++) {
+		try {
+			result = await makeRequest(false);
+		} catch (error) {
+			lastError = error;
+			if (attempt < RETRY_MAX_ATTEMPTS - 1) {
+				await new Promise((r) => setTimeout(r, backoffDelayMs(attempt, null)));
+				continue;
+			}
+			throw error;
+		}
+		const current = result;
+		if (!shouldRetryResponse(current.response) || attempt === RETRY_MAX_ATTEMPTS - 1) break;
+		await new Promise((r) => setTimeout(r, backoffDelayMs(attempt, current.response.headers.get("retry-after"))));
+	}
+	if (!result) throw lastError ?? /* @__PURE__ */ new Error(`Cloudflare API request failed: ${endpoint}`);
+	if (request.allowAuthRetry === true && isAuthError(result.response, result.envelope) && !options?.token) {
+		defaultAuthSession.invalidate();
+		result = await makeRequest(true);
+	}
+	return result;
+}
+async function requestCloudflareResult(path, request, options) {
+	const { response, envelope } = await requestCloudflareJson(path, request, options);
+	if (!envelope.success) throw envelopeFailureError(response, envelope, `${request.method} ${path}`);
+	return envelope.result;
+}
+/**
+* Make a GET request to the Cloudflare API
+* Automatically retries with a fresh token on auth failure
+*/
+async function apiGet(path, options) {
+	return requestCloudflareResult(path, {
+		method: "GET",
+		allowAuthRetry: true
+	}, options);
+}
+/**
+* Make a POST request to the Cloudflare API
+*/
+async function apiPost(path, body, options) {
+	return requestCloudflareResult(path, {
+		method: "POST",
+		body
+	}, options);
+}
+/**
+* Make a PUT request to the Cloudflare API
+*/
+async function apiPut(path, body, options) {
+	return requestCloudflareResult(path, {
+		method: "PUT",
+		body
+	}, options);
+}
+/**
+* Make a PATCH request to the Cloudflare API
+*/
+async function apiPatch(path, body, options) {
+	return requestCloudflareResult(path, {
+		method: "PATCH",
+		body
+	}, options);
+}
+/**
+* Make a DELETE request to the Cloudflare API
+*/
+async function apiDelete(path, options) {
+	return requestCloudflareResult(path, { method: "DELETE" }, options);
+}
+const DEFAULT_PAGINATION_MAX_PAGES = 500;
+const DEFAULT_PAGINATION_PAGE_SIZE = 50;
+/**
+* Make a paginated GET request, fetching all pages.
+*
+* Emits a `console.warn` and throws `PaginationCapExceededError` when the
+* explicit `maxPages` cap is reached with more data still available, to
+* prevent silent truncation (which would otherwise cause callers to
+* re-create already-existing resources as if they did not exist). Pass a
+* higher `maxPages` when the caller knows the resource count can exceed the
+* default cap.
+*/
+async function apiGetAll(path, options) {
+	const results = [];
+	let page = 1;
+	let cursor;
+	const perPage = options?.pageSize ?? DEFAULT_PAGINATION_PAGE_SIZE;
+	const maxPages = options?.maxPages ?? DEFAULT_PAGINATION_MAX_PAGES;
+	const seenCursors = /* @__PURE__ */ new Set();
+	const extractPaginatedItems = (result) => {
+		if (Array.isArray(result)) return result;
+		if (!result || typeof result !== "object") throw new Error("Expected paginated Cloudflare API result to be an array or an object containing an array.");
+		const arrayEntries = Object.entries(result).filter(([, value]) => Array.isArray(value));
+		if (arrayEntries.length !== 1) throw new Error("Expected paginated Cloudflare API result object to contain exactly one array property.");
+		return arrayEntries[0][1];
+	};
+	while (page <= maxPages) {
+		const separator = path.includes("?") ? "&" : "?";
+		const pagedPath = cursor ? `${path}${separator}cursor=${encodeURIComponent(cursor)}&per_page=${perPage}` : `${path}${separator}page=${page}&per_page=${perPage}`;
+		const { response, envelope } = await requestCloudflareJson(pagedPath, {
+			method: "GET",
+			allowAuthRetry: true
+		}, options);
+		if (!envelope.success) throw envelopeFailureError(response, envelope, `GET ${pagedPath}`);
+		const pageResults = extractPaginatedItems(envelope.result);
+		results.push(...pageResults);
+		if (!envelope.result_info) break;
+		if (pageResults.length === 0) break;
+		const nextCursor = envelope.result_info.cursor?.trim();
+		if (nextCursor) {
+			if (seenCursors.has(nextCursor)) break;
+			seenCursors.add(nextCursor);
+			cursor = nextCursor;
+			continue;
+		}
+		if (cursor) break;
+		if (envelope.result_info.total_count !== void 0) {
+			if (results.length >= envelope.result_info.total_count) break;
+		}
+		if (envelope.result_info.total_pages !== void 0) {
+			if (page >= envelope.result_info.total_pages) break;
+		}
+		page++;
+	}
+	if (page > maxPages) {
+		if (results.length % perPage === 0 && results.length > 0) console.warn(`[devflare] apiGetAll capped at ${maxPages} pages for ${path}. Results may be truncated; pass { maxPages } to raise the cap.`);
+	}
+	return results;
+}
+async function requestKVValue(accountId, namespaceId, key, request, options) {
+	const authorization = await resolveAuthHeader(options);
+	return fetchWithTimeout(`${API_BASE}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${encodeURIComponent(key)}`, {
+		method: request.method,
+		headers: {
+			Authorization: authorization,
+			...request.method === "PUT" ? { "Content-Type": "text/plain" } : {}
+		},
+		...request.method === "PUT" ? { body: request.value } : {}
+	}, options?.timeout ?? DEFAULT_TIMEOUT);
+}
+/**
+* Surface a failed KV-value response as a typed CloudflareAPIError by
+* decoding the envelope the error path emits.
+*/
+async function throwKVValueError(response, endpoint) {
+	await parseCloudflareEnvelope(response, { endpoint });
+	throw new CloudflareAPIError(`Cloudflare ${endpoint} failed`, response.status, []);
+}
+/**
+* Read a KV value (raw text response, not JSON envelope)
+* Returns null if key doesn't exist (404)
+*/
+async function kvGet(accountId, namespaceId, key, options) {
+	const response = await requestKVValue(accountId, namespaceId, key, { method: "GET" }, options);
+	if (response.status === 404) return null;
+	if (!response.ok) await throwKVValueError(response, "KV read");
+	return response.text();
+}
+/**
+* Write a KV value (raw text body, not JSON)
+*/
+async function kvPut(accountId, namespaceId, key, value, options) {
+	const response = await requestKVValue(accountId, namespaceId, key, {
+		method: "PUT",
+		value
+	}, options);
+	if (!response.ok) await throwKVValueError(response, "KV write");
+}
+/**
+* Delete a KV key
+* Treats 404 as success (key already absent).
+*/
+async function kvDelete(accountId, namespaceId, key, options) {
+	const response = await requestKVValue(accountId, namespaceId, key, { method: "DELETE" }, options);
+	if (response.status === 404) return;
+	if (!response.ok) await throwKVValueError(response, "KV delete");
+}
+//#endregion
+export { apiGetAll as a, apiPut as c, kvGet as d, kvPut as f, isAuthenticated as g, hasWranglerConfig as h, apiGet as i, api_exports as l, getWranglerAuth as m, CloudflareAPIError as n, apiPatch as o, getApiToken as p, apiDelete as r, apiPost as s, AuthenticationError as t, kvDelete as u };