nomoreide 0.1.101 → 0.1.102

package/dist/core/agent-profiles/types.d.ts

@@ -283,8 +283,8 @@ export declare const credentialSpecSchema: z.ZodObject<{
     required: z.ZodDefault<z.ZodBoolean>;
     description: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    key: string;
     required: boolean;
+    key: string;
     description?: string | undefined;
 }, {
     key: string;
@@ -311,8 +311,8 @@ export declare const profileManifestSchema: z.ZodObject<{
         required: z.ZodDefault<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        key: string;
         required: boolean;
+        key: string;
         description?: string | undefined;
     }, {
         key: string;
@@ -327,8 +327,8 @@ export declare const profileManifestSchema: z.ZodObject<{
         tool: string;
     } | undefined;
     credentials?: {
-        key: string;
         required: boolean;
+        key: string;
         description?: string | undefined;
     }[] | undefined;
 }, {

package/dist/core/cloudflare-actions.d.ts

@@ -0,0 +1,90 @@
+import { type CloudflareEnvVar, type CloudflareRequestAuth } from "./cloudflare-manager.js";
+/**
+ * Write-capable Cloudflare Pages operations, deliberately separate from the
+ * read-safe {@link ./cloudflare-manager.js CloudflareManager} — the same split
+ * as `git-manager` / `git-actions` and `db-peek` / `db-write`.
+ *
+ * Everything here changes what the internet is serving, so none of it is
+ * exposed as an MCP tool: these are reached only from the dashboard's own
+ * routes, where a human clicked the button.
+ *
+ * Still intentionally excludes the irreversible ones — Cloudflare's
+ * `DELETE .../deployments/{id}` and project deletion — which would need their
+ * own guarded surface.
+ */
+/** The only two environments Pages has. A third would be silently created by a PATCH. */
+export declare const CLOUDFLARE_ENVIRONMENTS: readonly ["production", "preview"];
+export type CloudflareEnvironment = (typeof CLOUDFLARE_ENVIRONMENTS)[number];
+export declare class CloudflareActions {
+    private readonly auth;
+    private readonly accountId;
+    constructor(auth: CloudflareRequestAuth, accountId: string);
+    /**
+     * Rebuild an existing deployment.
+     *
+     * Cloudflare calls this "retry" and mints a new deployment id, inheriting the
+     * original's branch, commit and environment — so, unlike Vercel's redeploy,
+     * nothing has to be carried through by the caller to keep a production retry
+     * in production.
+     */
+    retry(projectName: string, deploymentId: string): Promise<{
+        id: string;
+        url: string | null;
+    }>;
+    /**
+     * Point the project's production alias at an earlier deployment without
+     * rebuilding it. Cloudflare records this as a rollback, and it takes effect
+     * immediately.
+     */
+    rollback(projectName: string, deploymentId: string): Promise<{
+        id: string;
+        url: string | null;
+    }>;
+    /**
+     * Add a variable. `secret` (Vercel's "encrypted") is the default, and its
+     * value never reads back over the API afterwards.
+     */
+    createEnv(projectName: string, input: {
+        key: string;
+        value: string;
+        environments: string[];
+        secret?: boolean;
+    }): Promise<CloudflareEnvVar>;
+    /**
+     * Change a variable's value and/or the environments it applies to.
+     *
+     * Adding an environment needs a value: Cloudflare stores the variable
+     * separately per environment and never hands back a secret's value, so there
+     * is nothing to copy across. Saying that is better than writing an empty
+     * string into the new environment.
+     */
+    updateEnv(projectName: string, key: string, input: {
+        value?: string;
+        environments?: string[];
+    }): Promise<CloudflareEnvVar>;
+    /** Remove a variable from every environment it is set in. */
+    deleteEnv(projectName: string, key: string): Promise<void>;
+    /**
+     * The one write to a project's variables.
+     *
+     * Cloudflare merges the `env_vars` map it is sent — a key set to `null` is
+     * deleted, and keys the patch does not mention are untouched — so this never
+     * has to read-modify-write the whole map and cannot clobber a variable added
+     * between the read and the write.
+     */
+    private patchEnv;
+    private patchProject;
+    private currentEnv;
+    private projectPath;
+    private request;
+}
+/**
+ * Cloudflare's action vocabulary, mapped onto the names the shared UI already
+ * knows. "retry" is Cloudflare's word for what Vercel calls a redeploy, and
+ * there is no cancel endpoint for a Pages build at all — so the manifest is
+ * two actions, not four, and the deployment row hides what it cannot do.
+ */
+export declare const CLOUDFLARE_ACTIONS: readonly ["redeploy", "rollback"];
+export type CloudflareActionName = (typeof CLOUDFLARE_ACTIONS)[number];
+/** Actions that change what production serves — the UI confirms these first. */
+export declare const PRODUCTION_AFFECTING_ACTIONS: ReadonlySet<CloudflareActionName>;

package/dist/core/cloudflare-actions.js

@@ -0,0 +1,178 @@
+import { cloudflareRequest, } from "./cloudflare-manager.js";
+/**
+ * Write-capable Cloudflare Pages operations, deliberately separate from the
+ * read-safe {@link ./cloudflare-manager.js CloudflareManager} — the same split
+ * as `git-manager` / `git-actions` and `db-peek` / `db-write`.
+ *
+ * Everything here changes what the internet is serving, so none of it is
+ * exposed as an MCP tool: these are reached only from the dashboard's own
+ * routes, where a human clicked the button.
+ *
+ * Still intentionally excludes the irreversible ones — Cloudflare's
+ * `DELETE .../deployments/{id}` and project deletion — which would need their
+ * own guarded surface.
+ */
+/** The only two environments Pages has. A third would be silently created by a PATCH. */
+export const CLOUDFLARE_ENVIRONMENTS = ["production", "preview"];
+export class CloudflareActions {
+    auth;
+    accountId;
+    constructor(auth, accountId) {
+        this.auth = auth;
+        this.accountId = accountId;
+    }
+    /**
+     * Rebuild an existing deployment.
+     *
+     * Cloudflare calls this "retry" and mints a new deployment id, inheriting the
+     * original's branch, commit and environment — so, unlike Vercel's redeploy,
+     * nothing has to be carried through by the caller to keep a production retry
+     * in production.
+     */
+    async retry(projectName, deploymentId) {
+        const created = await this.request(`${this.projectPath(projectName)}/deployments/${encodeURIComponent(deploymentId)}/retry`, { method: "POST" });
+        return { id: created.id ?? "", url: created.url ?? null };
+    }
+    /**
+     * Point the project's production alias at an earlier deployment without
+     * rebuilding it. Cloudflare records this as a rollback, and it takes effect
+     * immediately.
+     */
+    async rollback(projectName, deploymentId) {
+        const rolled = await this.request(`${this.projectPath(projectName)}/deployments/${encodeURIComponent(deploymentId)}/rollback`, { method: "POST" });
+        return { id: rolled.id ?? deploymentId, url: rolled.url ?? null };
+    }
+    /**
+     * Add a variable. `secret` (Vercel's "encrypted") is the default, and its
+     * value never reads back over the API afterwards.
+     */
+    createEnv(projectName, input) {
+        const type = input.secret === false ? "plain_text" : "secret_text";
+        const patch = {};
+        for (const environment of requireEnvironments(input.environments)) {
+            patch[environment] = { [input.key]: { type, value: input.value } };
+        }
+        return this.patchEnv(projectName, input.key, patch);
+    }
+    /**
+     * Change a variable's value and/or the environments it applies to.
+     *
+     * Adding an environment needs a value: Cloudflare stores the variable
+     * separately per environment and never hands back a secret's value, so there
+     * is nothing to copy across. Saying that is better than writing an empty
+     * string into the new environment.
+     */
+    async updateEnv(projectName, key, input) {
+        const current = await this.currentEnv(projectName, key);
+        const wanted = input.environments
+            ? requireEnvironments(input.environments)
+            : current.environments;
+        const patch = {};
+        for (const environment of wanted) {
+            if (input.value !== undefined) {
+                patch[environment] = { [key]: { type: current.type, value: input.value } };
+            }
+            else if (!current.environments.includes(environment)) {
+                throw new Error(`Adding "${key}" to ${environment} needs a value — Cloudflare stores it separately per environment.`);
+            }
+        }
+        for (const environment of current.environments) {
+            if (!wanted.includes(environment)) {
+                patch[environment] = { [key]: null };
+            }
+        }
+        return this.patchEnv(projectName, key, patch);
+    }
+    /** Remove a variable from every environment it is set in. */
+    async deleteEnv(projectName, key) {
+        const current = await this.currentEnv(projectName, key);
+        const patch = {};
+        for (const environment of current.environments)
+            patch[environment] = { [key]: null };
+        await this.patchProject(projectName, patch);
+    }
+    /**
+     * The one write to a project's variables.
+     *
+     * Cloudflare merges the `env_vars` map it is sent — a key set to `null` is
+     * deleted, and keys the patch does not mention are untouched — so this never
+     * has to read-modify-write the whole map and cannot clobber a variable added
+     * between the read and the write.
+     */
+    async patchEnv(projectName, key, patch) {
+        const updated = await this.patchProject(projectName, patch);
+        const found = updated.find((entry) => entry.key === key);
+        if (!found)
+            throw new Error(`Cloudflare did not report "${key}" after the update.`);
+        return found;
+    }
+    async patchProject(projectName, patch) {
+        const deploymentConfigs = {};
+        for (const [environment, envVars] of Object.entries(patch)) {
+            if (envVars)
+                deploymentConfigs[environment] = { env_vars: envVars };
+        }
+        const project = await this.request(this.projectPath(projectName), {
+            method: "PATCH",
+            body: { deployment_configs: deploymentConfigs },
+        });
+        return mergeEnvVars(project.deployment_configs);
+    }
+    async currentEnv(projectName, key) {
+        const project = await this.request(this.projectPath(projectName));
+        const found = mergeEnvVars(project.deployment_configs).find((entry) => entry.key === key);
+        if (!found)
+            throw new Error(`No variable named "${key}" on this project.`);
+        return found;
+    }
+    projectPath(projectName) {
+        return `/accounts/${this.accountId}/pages/projects/${encodeURIComponent(projectName)}`;
+    }
+    request(path, opts) {
+        return cloudflareRequest(this.auth, path, opts);
+    }
+}
+/**
+ * Rejects anything that is not one of Pages' two environments. Vercel's env
+ * dialog offers `development` as well, and a PATCH naming it would quietly
+ * create a third deployment config that nothing ever reads.
+ */
+function requireEnvironments(environments) {
+    const invalid = environments.filter((entry) => !CLOUDFLARE_ENVIRONMENTS.includes(entry));
+    if (invalid.length > 0) {
+        throw new Error(`Cloudflare Pages only has ${CLOUDFLARE_ENVIRONMENTS.join(" and ")} environments, not ${invalid.join(", ")}.`);
+    }
+    return environments;
+}
+/** The read side's flattening, applied to whatever a write handed back. */
+function mergeEnvVars(configs) {
+    const merged = new Map();
+    for (const [environment, config] of Object.entries(configs ?? {})) {
+        for (const [key, entry] of Object.entries(config?.env_vars ?? {})) {
+            if (!entry)
+                continue;
+            const type = entry.type === "plain_text" ? "plain_text" : "secret_text";
+            const existing = merged.get(key);
+            if (existing) {
+                existing.environments.push(environment);
+                if (type === "secret_text")
+                    existing.type = "secret_text";
+                continue;
+            }
+            merged.set(key, { key, environments: [environment], type, value: entry.value });
+        }
+    }
+    return [...merged.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+/**
+ * Cloudflare's action vocabulary, mapped onto the names the shared UI already
+ * knows. "retry" is Cloudflare's word for what Vercel calls a redeploy, and
+ * there is no cancel endpoint for a Pages build at all — so the manifest is
+ * two actions, not four, and the deployment row hides what it cannot do.
+ */
+export const CLOUDFLARE_ACTIONS = ["redeploy", "rollback"];
+/** Actions that change what production serves — the UI confirms these first. */
+export const PRODUCTION_AFFECTING_ACTIONS = new Set([
+    "rollback",
+]);
+//# sourceMappingURL=cloudflare-actions.js.map

package/dist/core/cloudflare-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-actions.js","sourceRoot":"","sources":["../../src/core/cloudflare-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;GAYG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,YAAY,EAAE,SAAS,CAAU,CAAC;AAG1E,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,IAA2B,EAC3B,SAAiB;QADjB,SAAI,GAAJ,IAAI,CAAuB;QAC3B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,YAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAChC,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EACxF,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAC3F,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,WAAmB,EACnB,KAA+E;QAE/E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QACnE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,WAAmB,EACnB,GAAW,EACX,KAAkD;QAElD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY;YAC/B,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC;YACzC,CAAC,CAAE,OAAO,CAAC,YAAwC,CAAC;QAEtD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7E,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,WAAW,GAAG,QAAQ,WAAW,mEAAmE,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAoC,CAAC,EAAE,CAAC;gBAC3D,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,GAAW;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY;YAAE,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,QAAQ,CACpB,WAAmB,EACnB,GAAW,EACX,KAAe;QAEf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,qBAAqB,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,KAAe;QAC7D,MAAM,iBAAiB,GAAgD,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,OAAO;gBAAE,iBAAiB,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE;YACnF,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;SAChD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,GAAW;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,oBAAoB,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,WAAW,CAAC,WAAmB;QACrC,OAAO,aAAa,IAAI,CAAC,SAAS,mBAAmB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IACzF,CAAC;IAEO,OAAO,CAAI,IAAY,EAAE,IAA0C;QACzE,OAAO,iBAAiB,CAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;CACF;AAYD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,YAAsB;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAA8B,CAAC,CAC7E,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,YAAuC,CAAC;AACjD,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CACnB,OAAgD;IAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,aAAa;oBAAE,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAGpE,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAsC,IAAI,GAAG,CAAC;IACrF,UAAU;CACX,CAAC,CAAC"}

package/dist/core/cloudflare-auth.d.ts

@@ -0,0 +1,61 @@
+import { type ProviderAuthSpec, type ProviderCliSession, type ProviderCliStatus } from "./providers/credentials.js";
+/** Provider id this integration stores its connection under. */
+export declare const CLOUDFLARE_PROVIDER_ID = "cloudflare";
+/**
+ * Candidate locations of Wrangler's `config/default.toml`, newest convention
+ * first. Wrangler resolves these through `xdg-app-paths` under the app name
+ * `.wrangler`; the trailing entry is the pre-XDG path that long-lived installs
+ * still carry, and `WRANGLER_HOME` overrides all of them.
+ */
+export declare function wranglerConfigDirs(env?: NodeJS.ProcessEnv): string[];
+/**
+ * The ambient Cloudflare credential, or null when there is none.
+ *
+ * Two sources, in the order Wrangler itself prefers them:
+ *
+ * 1. `CLOUDFLARE_API_TOKEN` in the environment, which is how Wrangler runs in
+ *    CI and in most shells that have been set up for it;
+ * 2. the OAuth token `wrangler login` wrote to `config/default.toml`.
+ *
+ * Neither is ever copied into NoMoreIDE's config — that is the shared `cli`
+ * policy, and it is what makes `wrangler logout` revoke us too.
+ *
+ * An expired stored token reads as "not logged in" rather than being handed
+ * out: Wrangler refreshes it roughly hourly and rotates the refresh token when
+ * it does, so renewing it here would invalidate Wrangler's own copy.
+ */
+export declare function readWranglerSession(env?: NodeJS.ProcessEnv): Promise<ProviderCliSession | null>;
+/**
+ * Cloudflare's half of the shared credential resolver.
+ *
+ * **No `oauth` block — because of how our flow works, not because Cloudflare
+ * has no OAuth.** The shared `providers/oauth.ts` mints its own client at
+ * runtime via dynamic client registration (RFC 7591), which is what lets
+ * NoMoreIDE ship no client id at all. Cloudflare has no registration endpoint,
+ * so `registerOAuthClient()` would throw before a browser ever opened.
+ *
+ * That is a narrower obstacle than it was, and narrower than this comment used
+ * to claim: Cloudflare *does* serve OIDC discovery, at
+ * `dash.cloudflare.com/.well-known/openid-configuration`. It advertises PKCE
+ * (S256), `none` for token endpoint auth, and both the `authorization_code` and
+ * `refresh_token` grants — but no `registration_endpoint`. Since 2026-06-03 you
+ * register the client yourself instead, and a *public* client needs no secret.
+ *
+ * Adopting it is therefore a change of model rather than a new provider entry:
+ * NoMoreIDE would ship a pre-registered client id, which `ProviderAuthSpec`
+ * has no way to express, and public visibility additionally requires a verified
+ * client domain and is irreversible once granted.
+ *
+ * Loopback redirect URIs are accepted — verified against a live client, and the
+ * thing that would otherwise have ruled this out. Cloudflare also exposes a
+ * device authorization endpoint, so a provider that ever *does* refuse loopback
+ * has a redirect-free path available.
+ *
+ * Until then Cloudflare connects with an API token or by inheriting Wrangler's
+ * own login. The three-source model survives contact with provider #2; only
+ * this provider's subset of it is smaller.
+ *
+ * @see docs/plans/2026-08-13-provider-registry-design.md §11
+ */
+export declare const CLOUDFLARE_AUTH: ProviderAuthSpec;
+export declare function cloudflareCliStatus(env?: NodeJS.ProcessEnv): Promise<ProviderCliStatus>;

package/dist/core/cloudflare-auth.js

@@ -0,0 +1,149 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { providerCliStatus, } from "./providers/credentials.js";
+/** Provider id this integration stores its connection under. */
+export const CLOUDFLARE_PROVIDER_ID = "cloudflare";
+/**
+ * Candidate locations of Wrangler's `config/default.toml`, newest convention
+ * first. Wrangler resolves these through `xdg-app-paths` under the app name
+ * `.wrangler`; the trailing entry is the pre-XDG path that long-lived installs
+ * still carry, and `WRANGLER_HOME` overrides all of them.
+ */
+export function wranglerConfigDirs(env = process.env) {
+    // `env.HOME` rather than `homedir()` so an overridden environment redirects
+    // every candidate, not just the XDG one — otherwise a caller that points
+    // XDG_CONFIG_HOME somewhere still falls through to the real user's login.
+    const home = env.HOME?.trim() || homedir();
+    const dirs = [];
+    const wranglerHome = env.WRANGLER_HOME?.trim();
+    if (wranglerHome)
+        dirs.push(wranglerHome);
+    const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
+    if (xdgConfigHome)
+        dirs.push(join(xdgConfigHome, ".wrangler"));
+    if (process.platform === "darwin") {
+        dirs.push(join(home, "Library", "Preferences", ".wrangler"));
+    }
+    else if (process.platform === "win32") {
+        const appData = env.APPDATA?.trim();
+        if (appData)
+            dirs.push(join(appData, ".wrangler", "Config"));
+    }
+    dirs.push(join(home, ".config", ".wrangler"));
+    dirs.push(join(home, ".wrangler"));
+    return dirs;
+}
+/**
+ * The ambient Cloudflare credential, or null when there is none.
+ *
+ * Two sources, in the order Wrangler itself prefers them:
+ *
+ * 1. `CLOUDFLARE_API_TOKEN` in the environment, which is how Wrangler runs in
+ *    CI and in most shells that have been set up for it;
+ * 2. the OAuth token `wrangler login` wrote to `config/default.toml`.
+ *
+ * Neither is ever copied into NoMoreIDE's config — that is the shared `cli`
+ * policy, and it is what makes `wrangler logout` revoke us too.
+ *
+ * An expired stored token reads as "not logged in" rather than being handed
+ * out: Wrangler refreshes it roughly hourly and rotates the refresh token when
+ * it does, so renewing it here would invalidate Wrangler's own copy.
+ */
+export async function readWranglerSession(env = process.env) {
+    const currentScope = env.CLOUDFLARE_ACCOUNT_ID?.trim() || env.CF_ACCOUNT_ID?.trim() || undefined;
+    const envToken = env.CLOUDFLARE_API_TOKEN?.trim() || env.CF_API_TOKEN?.trim();
+    if (envToken)
+        return { token: envToken, currentScope };
+    for (const dir of wranglerConfigDirs(env)) {
+        const config = await readTomlFields(join(dir, "config", "default.toml"));
+        const token = config.oauth_token;
+        if (!token)
+            continue;
+        const expiresAt = Date.parse(config.expiration_time ?? "");
+        if (Number.isFinite(expiresAt) && expiresAt <= Date.now())
+            return null;
+        return { token, currentScope };
+    }
+    return null;
+}
+/**
+ * The top-level `key = "value"` pairs of a TOML file, or `{}` if anything goes
+ * wrong.
+ *
+ * Deliberately not a TOML parser and deliberately not shared: Wrangler's auth
+ * file is flat and quoted, and the only reason this exists rather than
+ * `readJsonField` is that Cloudflare's CLI happens to store its login as TOML.
+ * A malformed or missing file must read as "not logged in", never as an error
+ * the UI has to explain.
+ */
+async function readTomlFields(path) {
+    const fields = {};
+    try {
+        const raw = await readFile(path, "utf8");
+        for (const line of raw.split("\n")) {
+            // Stop at the first table header: everything Wrangler stores is top-level,
+            // and a nested table's keys are not the same keys.
+            if (/^\s*\[/.test(line))
+                break;
+            const match = /^\s*([A-Za-z_][\w-]*)\s*=\s*"([^"]*)"\s*$/.exec(line);
+            if (match?.[2])
+                fields[match[1]] = match[2];
+        }
+    }
+    catch {
+        /* an unreadable file is "not logged in" */
+    }
+    return fields;
+}
+/**
+ * Cloudflare's half of the shared credential resolver.
+ *
+ * **No `oauth` block — because of how our flow works, not because Cloudflare
+ * has no OAuth.** The shared `providers/oauth.ts` mints its own client at
+ * runtime via dynamic client registration (RFC 7591), which is what lets
+ * NoMoreIDE ship no client id at all. Cloudflare has no registration endpoint,
+ * so `registerOAuthClient()` would throw before a browser ever opened.
+ *
+ * That is a narrower obstacle than it was, and narrower than this comment used
+ * to claim: Cloudflare *does* serve OIDC discovery, at
+ * `dash.cloudflare.com/.well-known/openid-configuration`. It advertises PKCE
+ * (S256), `none` for token endpoint auth, and both the `authorization_code` and
+ * `refresh_token` grants — but no `registration_endpoint`. Since 2026-06-03 you
+ * register the client yourself instead, and a *public* client needs no secret.
+ *
+ * Adopting it is therefore a change of model rather than a new provider entry:
+ * NoMoreIDE would ship a pre-registered client id, which `ProviderAuthSpec`
+ * has no way to express, and public visibility additionally requires a verified
+ * client domain and is irreversible once granted.
+ *
+ * Loopback redirect URIs are accepted — verified against a live client, and the
+ * thing that would otherwise have ruled this out. Cloudflare also exposes a
+ * device authorization endpoint, so a provider that ever *does* refuse loopback
+ * has a redirect-free path available.
+ *
+ * Until then Cloudflare connects with an API token or by inheriting Wrangler's
+ * own login. The three-source model survives contact with provider #2; only
+ * this provider's subset of it is smaller.
+ *
+ * @see docs/plans/2026-08-13-provider-registry-design.md §11
+ */
+export const CLOUDFLARE_AUTH = {
+    id: CLOUDFLARE_PROVIDER_ID,
+    name: "Cloudflare",
+    cliSession: readWranglerSession,
+    messages: {
+        cliMissing: "No Wrangler login found. Run `wrangler login`, or paste a Cloudflare API token instead.",
+        noStoredToken: "No Cloudflare token stored. Reconnect Cloudflare with an API token.",
+        cliLoggedOut: "Wrangler is no longer logged in. Run `wrangler login` again, or connect with a Cloudflare API token.",
+        notConnected: "Cloudflare is not connected. Run `wrangler login`, or add a Cloudflare API token.",
+        // Reachable only if a connection were somehow saved as `oauth`; Cloudflare
+        // never creates one, so the message points at what does work.
+        signInExpired: "Cloudflare has no browser sign-in. Connect with a Cloudflare API token.",
+        refreshFailed: "Could not renew your Cloudflare credential ({error}). Add an API token.",
+    },
+};
+export function cloudflareCliStatus(env = process.env) {
+    return providerCliStatus(CLOUDFLARE_AUTH, env);
+}
+//# sourceMappingURL=cloudflare-auth.js.map

package/dist/core/cloudflare-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-auth.js","sourceRoot":"","sources":["../../src/core/cloudflare-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,iBAAiB,GAIlB,MAAM,4BAA4B,CAAC;AAEpC,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACpC,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,YAAY,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACjG,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAEvD,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,2EAA2E;YAC3E,mDAAmD;YACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC/B,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,YAAY;IAClB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE;QACR,UAAU,EACR,yFAAyF;QAC3F,aAAa,EAAE,qEAAqE;QACpF,YAAY,EACV,sGAAsG;QACxG,YAAY,EACV,mFAAmF;QACrF,2EAA2E;QAC3E,8DAA8D;QAC9D,aAAa,EAAE,yEAAyE;QACxF,aAAa,EAAE,yEAAyE;KACzF;CACF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,iBAAiB,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/cloudflare-context.d.ts

@@ -0,0 +1,2 @@
+import type { RegisteredDeployProvider } from "./providers/registry.js";
+export declare const cloudflareDeployProvider: RegisteredDeployProvider;

package/dist/core/cloudflare-context.js

@@ -0,0 +1,106 @@
+import { CloudflareActions } from "./cloudflare-actions.js";
+import { CLOUDFLARE_AUTH, CLOUDFLARE_PROVIDER_ID } from "./cloudflare-auth.js";
+import { CloudflareManager } from "./cloudflare-manager.js";
+import { CLOUDFLARE_HOOKS, CLOUDFLARE_MANIFEST, createCloudflareDeployActions, createCloudflareDeployProvider, toProviderProject, } from "./cloudflare-provider.js";
+import { resolveProviderCredential } from "./providers/credentials.js";
+import { createProviderFetch } from "./providers/egress.js";
+import { adoptSoleScope, resolveProviderProject, } from "./providers/project-resolution.js";
+/**
+ * Cloudflare's registry entry — how a connected client is built for a working
+ * directory, and the write-capable half resolved separately from it.
+ *
+ * The registry imports this; this must not import the registry, or the two
+ * would cycle.
+ *
+ * Shorter than Vercel's counterpart in one place and longer in another, which
+ * is the point of doing provider #2 before publishing anything:
+ *
+ * - **No token persistence.** Cloudflare has no browser sign-in, so nothing
+ *   here ever rotates a refresh token — the `onTokensRefreshed` plumbing Vercel
+ *   needs is simply absent.
+ * - **The account is resolved before the project, not after.** Every Pages path
+ *   contains an account id, so project resolution cannot even begin until the
+ *   scope is known.
+ */
+/**
+ * A connected Cloudflare client for the given working directory.
+ *
+ * Throws when Cloudflare isn't connected. A missing *account* is not an error
+ * either: `account()` and `listScopes()` answer without one, which is what lets
+ * the dashboard show the account switcher rather than a dead end.
+ */
+/**
+ * The scoped `fetch` every Cloudflare client here is built with, minted once
+ * from the manifest's `api.hosts`. This is the only file that mints it, which
+ * is what makes the allowlist a boundary rather than a suggestion — a manager
+ * built anywhere else gets global `fetch` and is a test, not a client.
+ */
+const cloudflareFetch = createProviderFetch(CLOUDFLARE_MANIFEST);
+async function cloudflareContext(configStore, gitCwd) {
+    const config = await configStore.load();
+    const credential = await resolveProviderCredential(CLOUDFLARE_AUTH, config, process.env);
+    const accountId = credential.scopeId ?? (await adoptDefaultAccount(configStore, credential));
+    const manager = new CloudflareManager(credential.token, accountId, undefined, cloudflareFetch);
+    const project = await resolveProject(config, manager, gitCwd);
+    return {
+        // The project is resolved first and handed to the provider: Cloudflare has
+        // no global deployment endpoint, so the deployment reads need it.
+        provider: createCloudflareDeployProvider(manager, project?.name),
+        credential: { ...credential, scopeId: accountId },
+        project,
+    };
+}
+/**
+ * The account to use when the user has never chosen one.
+ *
+ * `cliSelectsScope: false` because Wrangler has no account switch to inherit —
+ * so unlike Vercel, a `cli` credential does adopt the sole account, or a
+ * `wrangler login` with one account could never read a single project. It is
+ * still not written to config, so `CLOUDFLARE_ACCOUNT_ID` keeps winning.
+ */
+function adoptDefaultAccount(configStore, credential) {
+    return adoptSoleScope({
+        source: credential.source,
+        cliSelectsScope: false,
+        listScopes: () => new CloudflareManager(credential.token, undefined, undefined, cloudflareFetch)
+            .listAccounts()
+            .then((accounts) => 
+        // Cloudflare accounts have no slug; the id addresses one.
+        accounts.map((account) => ({ id: account.id, slug: account.id }))),
+        persist: (scope) => configStore.setConnectionScope(CLOUDFLARE_PROVIDER_ID, scope).then(() => undefined),
+    });
+}
+/** Write-capable counterpart, resolved the same way but returned separately. */
+async function cloudflareActions(configStore) {
+    const config = await configStore.load();
+    const credential = await resolveProviderCredential(CLOUDFLARE_AUTH, config, process.env);
+    const accountId = credential.scopeId ?? (await adoptDefaultAccount(configStore, credential));
+    if (!accountId) {
+        throw new Error("Choose a Cloudflare account before changing one of its projects.");
+    }
+    return createCloudflareDeployActions(new CloudflareActions({ token: credential.token, fetch: cloudflareFetch }, accountId));
+}
+/**
+ * Which Cloudflare project this repository deploys — the shared three-tier
+ * ladder, with only two of its three tiers in play: Wrangler writes no link
+ * file, so an unpinned repo is matched on its git remote.
+ */
+async function resolveProject(config, manager, gitCwd) {
+    const project = await resolveProviderProject({
+        providerId: CLOUDFLARE_PROVIDER_ID,
+        hooks: CLOUDFLARE_HOOKS,
+        config,
+        gitCwd,
+        getProject: (id) => manager.getProject(id),
+        findByRepoUrl: (repoUrl) => manager.findProjectByRepo(repoUrl),
+    });
+    return project ? toProviderProject(project) : undefined;
+}
+export const cloudflareDeployProvider = {
+    manifest: CLOUDFLARE_MANIFEST,
+    auth: CLOUDFLARE_AUTH,
+    hooks: CLOUDFLARE_HOOKS,
+    context: cloudflareContext,
+    actions: cloudflareActions,
+};
+//# sourceMappingURL=cloudflare-context.js.map

package/dist/core/cloudflare-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-context.js","sourceRoot":"","sources":["../../src/core/cloudflare-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAA0B,MAAM,yBAAyB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAA2B,MAAM,4BAA4B,CAAC;AAEhG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAI3C;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;AAEjE,KAAK,UAAU,iBAAiB,CAC9B,WAAwB,EACxB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,MAAM,mBAAmB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO;QACL,2EAA2E;QAC3E,kEAAkE;QAClE,QAAQ,EAAE,8BAA8B,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;QAChE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;QACjD,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,WAAwB,EACxB,UAA8B;IAE9B,OAAO,cAAc,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,GAAG,EAAE,CACf,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;aAC3E,YAAY,EAAE;aACd,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,0DAA0D;QAC1D,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAClE;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,WAAW,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KACtF,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAAC,WAAwB;IACvD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,MAAM,mBAAmB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,6BAA6B,CAClC,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,SAAS,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAuB,EACvB,OAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAoB;QAC9D,UAAU,EAAE,sBAAsB;QAClC,KAAK,EAAE,gBAAgB;QACvB,MAAM;QACN,MAAM;QACN,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IAChE,QAAQ,EAAE,mBAAmB;IAC7B,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;CAC3B,CAAC"}