nomoreide 0.1.103 → 0.3.0

package/dist/core/cloudflare-actions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-actions.js","sourceRoot":"","sources":["../../src/core/cloudflare-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;GAYG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,YAAY,EAAE,SAAS,CAAU,CAAC;AAG1E,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,IAA2B,EAC3B,SAAiB;QADjB,SAAI,GAAJ,IAAI,CAAuB;QAC3B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,YAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAChC,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EACxF,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAC3F,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,WAAmB,EACnB,KAA+E;QAE/E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QACnE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,WAAmB,EACnB,GAAW,EACX,KAAkD;QAElD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY;YAC/B,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC;YACzC,CAAC,CAAE,OAAO,CAAC,YAAwC,CAAC;QAEtD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7E,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,WAAW,GAAG,QAAQ,WAAW,mEAAmE,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAoC,CAAC,EAAE,CAAC;gBAC3D,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,GAAW;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY;YAAE,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,QAAQ,CACpB,WAAmB,EACnB,GAAW,EACX,KAAe;QAEf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,qBAAqB,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,KAAe;QAC7D,MAAM,iBAAiB,GAAgD,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,OAAO;gBAAE,iBAAiB,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE;YACnF,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;SAChD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,GAAW;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,oBAAoB,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,WAAW,CAAC,WAAmB;QACrC,OAAO,aAAa,IAAI,CAAC,SAAS,mBAAmB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IACzF,CAAC;IAEO,OAAO,CAAI,IAAY,EAAE,IAA0C;QACzE,OAAO,iBAAiB,CAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;CACF;AAYD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,YAAsB;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAA8B,CAAC,CAC7E,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,YAAuC,CAAC;AACjD,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CACnB,OAAgD;IAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,aAAa;oBAAE,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAGpE,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAsC,IAAI,GAAG,CAAC;IACrF,UAAU;CACX,CAAC,CAAC"}

package/dist/core/cloudflare-auth.d.ts

@@ -1,61 +0,0 @@
-import { type ProviderAuthSpec, type ProviderCliSession, type ProviderCliStatus } from "./providers/credentials.js";
-/** Provider id this integration stores its connection under. */
-export declare const CLOUDFLARE_PROVIDER_ID = "cloudflare";
-/**
- * Candidate locations of Wrangler's `config/default.toml`, newest convention
- * first. Wrangler resolves these through `xdg-app-paths` under the app name
- * `.wrangler`; the trailing entry is the pre-XDG path that long-lived installs
- * still carry, and `WRANGLER_HOME` overrides all of them.
- */
-export declare function wranglerConfigDirs(env?: NodeJS.ProcessEnv): string[];
-/**
- * The ambient Cloudflare credential, or null when there is none.
- *
- * Two sources, in the order Wrangler itself prefers them:
- *
- * 1. `CLOUDFLARE_API_TOKEN` in the environment, which is how Wrangler runs in
- *    CI and in most shells that have been set up for it;
- * 2. the OAuth token `wrangler login` wrote to `config/default.toml`.
- *
- * Neither is ever copied into NoMoreIDE's config — that is the shared `cli`
- * policy, and it is what makes `wrangler logout` revoke us too.
- *
- * An expired stored token reads as "not logged in" rather than being handed
- * out: Wrangler refreshes it roughly hourly and rotates the refresh token when
- * it does, so renewing it here would invalidate Wrangler's own copy.
- */
-export declare function readWranglerSession(env?: NodeJS.ProcessEnv): Promise<ProviderCliSession | null>;
-/**
- * Cloudflare's half of the shared credential resolver.
- *
- * **No `oauth` block — because of how our flow works, not because Cloudflare
- * has no OAuth.** The shared `providers/oauth.ts` mints its own client at
- * runtime via dynamic client registration (RFC 7591), which is what lets
- * NoMoreIDE ship no client id at all. Cloudflare has no registration endpoint,
- * so `registerOAuthClient()` would throw before a browser ever opened.
- *
- * That is a narrower obstacle than it was, and narrower than this comment used
- * to claim: Cloudflare *does* serve OIDC discovery, at
- * `dash.cloudflare.com/.well-known/openid-configuration`. It advertises PKCE
- * (S256), `none` for token endpoint auth, and both the `authorization_code` and
- * `refresh_token` grants — but no `registration_endpoint`. Since 2026-06-03 you
- * register the client yourself instead, and a *public* client needs no secret.
- *
- * Adopting it is therefore a change of model rather than a new provider entry:
- * NoMoreIDE would ship a pre-registered client id, which `ProviderAuthSpec`
- * has no way to express, and public visibility additionally requires a verified
- * client domain and is irreversible once granted.
- *
- * Loopback redirect URIs are accepted — verified against a live client, and the
- * thing that would otherwise have ruled this out. Cloudflare also exposes a
- * device authorization endpoint, so a provider that ever *does* refuse loopback
- * has a redirect-free path available.
- *
- * Until then Cloudflare connects with an API token or by inheriting Wrangler's
- * own login. The three-source model survives contact with provider #2; only
- * this provider's subset of it is smaller.
- *
- * @see docs/plans/2026-08-13-provider-registry-design.md §11
- */
-export declare const CLOUDFLARE_AUTH: ProviderAuthSpec;
-export declare function cloudflareCliStatus(env?: NodeJS.ProcessEnv): Promise<ProviderCliStatus>;

package/dist/core/cloudflare-auth.js

@@ -1,149 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { providerCliStatus, } from "./providers/credentials.js";
-/** Provider id this integration stores its connection under. */
-export const CLOUDFLARE_PROVIDER_ID = "cloudflare";
-/**
- * Candidate locations of Wrangler's `config/default.toml`, newest convention
- * first. Wrangler resolves these through `xdg-app-paths` under the app name
- * `.wrangler`; the trailing entry is the pre-XDG path that long-lived installs
- * still carry, and `WRANGLER_HOME` overrides all of them.
- */
-export function wranglerConfigDirs(env = process.env) {
-    // `env.HOME` rather than `homedir()` so an overridden environment redirects
-    // every candidate, not just the XDG one — otherwise a caller that points
-    // XDG_CONFIG_HOME somewhere still falls through to the real user's login.
-    const home = env.HOME?.trim() || homedir();
-    const dirs = [];
-    const wranglerHome = env.WRANGLER_HOME?.trim();
-    if (wranglerHome)
-        dirs.push(wranglerHome);
-    const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
-    if (xdgConfigHome)
-        dirs.push(join(xdgConfigHome, ".wrangler"));
-    if (process.platform === "darwin") {
-        dirs.push(join(home, "Library", "Preferences", ".wrangler"));
-    }
-    else if (process.platform === "win32") {
-        const appData = env.APPDATA?.trim();
-        if (appData)
-            dirs.push(join(appData, ".wrangler", "Config"));
-    }
-    dirs.push(join(home, ".config", ".wrangler"));
-    dirs.push(join(home, ".wrangler"));
-    return dirs;
-}
-/**
- * The ambient Cloudflare credential, or null when there is none.
- *
- * Two sources, in the order Wrangler itself prefers them:
- *
- * 1. `CLOUDFLARE_API_TOKEN` in the environment, which is how Wrangler runs in
- *    CI and in most shells that have been set up for it;
- * 2. the OAuth token `wrangler login` wrote to `config/default.toml`.
- *
- * Neither is ever copied into NoMoreIDE's config — that is the shared `cli`
- * policy, and it is what makes `wrangler logout` revoke us too.
- *
- * An expired stored token reads as "not logged in" rather than being handed
- * out: Wrangler refreshes it roughly hourly and rotates the refresh token when
- * it does, so renewing it here would invalidate Wrangler's own copy.
- */
-export async function readWranglerSession(env = process.env) {
-    const currentScope = env.CLOUDFLARE_ACCOUNT_ID?.trim() || env.CF_ACCOUNT_ID?.trim() || undefined;
-    const envToken = env.CLOUDFLARE_API_TOKEN?.trim() || env.CF_API_TOKEN?.trim();
-    if (envToken)
-        return { token: envToken, currentScope };
-    for (const dir of wranglerConfigDirs(env)) {
-        const config = await readTomlFields(join(dir, "config", "default.toml"));
-        const token = config.oauth_token;
-        if (!token)
-            continue;
-        const expiresAt = Date.parse(config.expiration_time ?? "");
-        if (Number.isFinite(expiresAt) && expiresAt <= Date.now())
-            return null;
-        return { token, currentScope };
-    }
-    return null;
-}
-/**
- * The top-level `key = "value"` pairs of a TOML file, or `{}` if anything goes
- * wrong.
- *
- * Deliberately not a TOML parser and deliberately not shared: Wrangler's auth
- * file is flat and quoted, and the only reason this exists rather than
- * `readJsonField` is that Cloudflare's CLI happens to store its login as TOML.
- * A malformed or missing file must read as "not logged in", never as an error
- * the UI has to explain.
- */
-async function readTomlFields(path) {
-    const fields = {};
-    try {
-        const raw = await readFile(path, "utf8");
-        for (const line of raw.split("\n")) {
-            // Stop at the first table header: everything Wrangler stores is top-level,
-            // and a nested table's keys are not the same keys.
-            if (/^\s*\[/.test(line))
-                break;
-            const match = /^\s*([A-Za-z_][\w-]*)\s*=\s*"([^"]*)"\s*$/.exec(line);
-            if (match?.[2])
-                fields[match[1]] = match[2];
-        }
-    }
-    catch {
-        /* an unreadable file is "not logged in" */
-    }
-    return fields;
-}
-/**
- * Cloudflare's half of the shared credential resolver.
- *
- * **No `oauth` block — because of how our flow works, not because Cloudflare
- * has no OAuth.** The shared `providers/oauth.ts` mints its own client at
- * runtime via dynamic client registration (RFC 7591), which is what lets
- * NoMoreIDE ship no client id at all. Cloudflare has no registration endpoint,
- * so `registerOAuthClient()` would throw before a browser ever opened.
- *
- * That is a narrower obstacle than it was, and narrower than this comment used
- * to claim: Cloudflare *does* serve OIDC discovery, at
- * `dash.cloudflare.com/.well-known/openid-configuration`. It advertises PKCE
- * (S256), `none` for token endpoint auth, and both the `authorization_code` and
- * `refresh_token` grants — but no `registration_endpoint`. Since 2026-06-03 you
- * register the client yourself instead, and a *public* client needs no secret.
- *
- * Adopting it is therefore a change of model rather than a new provider entry:
- * NoMoreIDE would ship a pre-registered client id, which `ProviderAuthSpec`
- * has no way to express, and public visibility additionally requires a verified
- * client domain and is irreversible once granted.
- *
- * Loopback redirect URIs are accepted — verified against a live client, and the
- * thing that would otherwise have ruled this out. Cloudflare also exposes a
- * device authorization endpoint, so a provider that ever *does* refuse loopback
- * has a redirect-free path available.
- *
- * Until then Cloudflare connects with an API token or by inheriting Wrangler's
- * own login. The three-source model survives contact with provider #2; only
- * this provider's subset of it is smaller.
- *
- * @see docs/plans/2026-08-13-provider-registry-design.md §11
- */
-export const CLOUDFLARE_AUTH = {
-    id: CLOUDFLARE_PROVIDER_ID,
-    name: "Cloudflare",
-    cliSession: readWranglerSession,
-    messages: {
-        cliMissing: "No Wrangler login found. Run `wrangler login`, or paste a Cloudflare API token instead.",
-        noStoredToken: "No Cloudflare token stored. Reconnect Cloudflare with an API token.",
-        cliLoggedOut: "Wrangler is no longer logged in. Run `wrangler login` again, or connect with a Cloudflare API token.",
-        notConnected: "Cloudflare is not connected. Run `wrangler login`, or add a Cloudflare API token.",
-        // Reachable only if a connection were somehow saved as `oauth`; Cloudflare
-        // never creates one, so the message points at what does work.
-        signInExpired: "Cloudflare has no browser sign-in. Connect with a Cloudflare API token.",
-        refreshFailed: "Could not renew your Cloudflare credential ({error}). Add an API token.",
-    },
-};
-export function cloudflareCliStatus(env = process.env) {
-    return providerCliStatus(CLOUDFLARE_AUTH, env);
-}
-//# sourceMappingURL=cloudflare-auth.js.map

package/dist/core/cloudflare-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-auth.js","sourceRoot":"","sources":["../../src/core/cloudflare-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,iBAAiB,GAIlB,MAAM,4BAA4B,CAAC;AAEpC,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACpC,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,YAAY,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACjG,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAEvD,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,2EAA2E;YAC3E,mDAAmD;YACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC/B,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,YAAY;IAClB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE;QACR,UAAU,EACR,yFAAyF;QAC3F,aAAa,EAAE,qEAAqE;QACpF,YAAY,EACV,sGAAsG;QACxG,YAAY,EACV,mFAAmF;QACrF,2EAA2E;QAC3E,8DAA8D;QAC9D,aAAa,EAAE,yEAAyE;QACxF,aAAa,EAAE,yEAAyE;KACzF;CACF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,iBAAiB,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/cloudflare-context.d.ts

@@ -1,2 +0,0 @@
-import type { RegisteredDeployProvider } from "./providers/registry.js";
-export declare const cloudflareDeployProvider: RegisteredDeployProvider;

package/dist/core/cloudflare-context.js

@@ -1,106 +0,0 @@
-import { CloudflareActions } from "./cloudflare-actions.js";
-import { CLOUDFLARE_AUTH, CLOUDFLARE_PROVIDER_ID } from "./cloudflare-auth.js";
-import { CloudflareManager } from "./cloudflare-manager.js";
-import { CLOUDFLARE_HOOKS, CLOUDFLARE_MANIFEST, createCloudflareDeployActions, createCloudflareDeployProvider, toProviderProject, } from "./cloudflare-provider.js";
-import { resolveProviderCredential } from "./providers/credentials.js";
-import { createProviderFetch } from "./providers/egress.js";
-import { adoptSoleScope, resolveProviderProject, } from "./providers/project-resolution.js";
-/**
- * Cloudflare's registry entry — how a connected client is built for a working
- * directory, and the write-capable half resolved separately from it.
- *
- * The registry imports this; this must not import the registry, or the two
- * would cycle.
- *
- * Shorter than Vercel's counterpart in one place and longer in another, which
- * is the point of doing provider #2 before publishing anything:
- *
- * - **No token persistence.** Cloudflare has no browser sign-in, so nothing
- *   here ever rotates a refresh token — the `onTokensRefreshed` plumbing Vercel
- *   needs is simply absent.
- * - **The account is resolved before the project, not after.** Every Pages path
- *   contains an account id, so project resolution cannot even begin until the
- *   scope is known.
- */
-/**
- * A connected Cloudflare client for the given working directory.
- *
- * Throws when Cloudflare isn't connected. A missing *account* is not an error
- * either: `account()` and `listScopes()` answer without one, which is what lets
- * the dashboard show the account switcher rather than a dead end.
- */
-/**
- * The scoped `fetch` every Cloudflare client here is built with, minted once
- * from the manifest's `api.hosts`. This is the only file that mints it, which
- * is what makes the allowlist a boundary rather than a suggestion — a manager
- * built anywhere else gets global `fetch` and is a test, not a client.
- */
-const cloudflareFetch = createProviderFetch(CLOUDFLARE_MANIFEST);
-async function cloudflareContext(configStore, gitCwd) {
-    const config = await configStore.load();
-    const credential = await resolveProviderCredential(CLOUDFLARE_AUTH, config, process.env);
-    const accountId = credential.scopeId ?? (await adoptDefaultAccount(configStore, credential));
-    const manager = new CloudflareManager(credential.token, accountId, undefined, cloudflareFetch);
-    const project = await resolveProject(config, manager, gitCwd);
-    return {
-        // The project is resolved first and handed to the provider: Cloudflare has
-        // no global deployment endpoint, so the deployment reads need it.
-        provider: createCloudflareDeployProvider(manager, project?.name),
-        credential: { ...credential, scopeId: accountId },
-        project,
-    };
-}
-/**
- * The account to use when the user has never chosen one.
- *
- * `cliSelectsScope: false` because Wrangler has no account switch to inherit —
- * so unlike Vercel, a `cli` credential does adopt the sole account, or a
- * `wrangler login` with one account could never read a single project. It is
- * still not written to config, so `CLOUDFLARE_ACCOUNT_ID` keeps winning.
- */
-function adoptDefaultAccount(configStore, credential) {
-    return adoptSoleScope({
-        source: credential.source,
-        cliSelectsScope: false,
-        listScopes: () => new CloudflareManager(credential.token, undefined, undefined, cloudflareFetch)
-            .listAccounts()
-            .then((accounts) => 
-        // Cloudflare accounts have no slug; the id addresses one.
-        accounts.map((account) => ({ id: account.id, slug: account.id }))),
-        persist: (scope) => configStore.setConnectionScope(CLOUDFLARE_PROVIDER_ID, scope).then(() => undefined),
-    });
-}
-/** Write-capable counterpart, resolved the same way but returned separately. */
-async function cloudflareActions(configStore) {
-    const config = await configStore.load();
-    const credential = await resolveProviderCredential(CLOUDFLARE_AUTH, config, process.env);
-    const accountId = credential.scopeId ?? (await adoptDefaultAccount(configStore, credential));
-    if (!accountId) {
-        throw new Error("Choose a Cloudflare account before changing one of its projects.");
-    }
-    return createCloudflareDeployActions(new CloudflareActions({ token: credential.token, fetch: cloudflareFetch }, accountId));
-}
-/**
- * Which Cloudflare project this repository deploys — the shared three-tier
- * ladder, with only two of its three tiers in play: Wrangler writes no link
- * file, so an unpinned repo is matched on its git remote.
- */
-async function resolveProject(config, manager, gitCwd) {
-    const project = await resolveProviderProject({
-        providerId: CLOUDFLARE_PROVIDER_ID,
-        hooks: CLOUDFLARE_HOOKS,
-        config,
-        gitCwd,
-        getProject: (id) => manager.getProject(id),
-        findByRepoUrl: (repoUrl) => manager.findProjectByRepo(repoUrl),
-    });
-    return project ? toProviderProject(project) : undefined;
-}
-export const cloudflareDeployProvider = {
-    manifest: CLOUDFLARE_MANIFEST,
-    auth: CLOUDFLARE_AUTH,
-    hooks: CLOUDFLARE_HOOKS,
-    context: cloudflareContext,
-    actions: cloudflareActions,
-};
-//# sourceMappingURL=cloudflare-context.js.map

package/dist/core/cloudflare-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-context.js","sourceRoot":"","sources":["../../src/core/cloudflare-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAA0B,MAAM,yBAAyB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAA2B,MAAM,4BAA4B,CAAC;AAEhG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAI3C;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;AAEjE,KAAK,UAAU,iBAAiB,CAC9B,WAAwB,EACxB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,MAAM,mBAAmB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO;QACL,2EAA2E;QAC3E,kEAAkE;QAClE,QAAQ,EAAE,8BAA8B,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;QAChE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;QACjD,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,WAAwB,EACxB,UAA8B;IAE9B,OAAO,cAAc,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,GAAG,EAAE,CACf,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;aAC3E,YAAY,EAAE;aACd,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,0DAA0D;QAC1D,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAClE;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,WAAW,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KACtF,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAAC,WAAwB;IACvD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,MAAM,mBAAmB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,6BAA6B,CAClC,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,SAAS,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAuB,EACvB,OAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAoB;QAC9D,UAAU,EAAE,sBAAsB;QAClC,KAAK,EAAE,gBAAgB;QACvB,MAAM;QACN,MAAM;QACN,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IAChE,QAAQ,EAAE,mBAAmB;IAC7B,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;CAC3B,CAAC"}

package/dist/core/cloudflare-manager.d.ts

@@ -1,256 +0,0 @@
-/**
- * Read-safe Cloudflare Pages REST client — the agent-reachable half of the
- * integration, and the mirror of `vercel-manager.ts`.
- *
- * Like {@link ./git-manager.js GitManager}, nothing here changes what is
- * deployed: retry / rollback and the environment-variable writes live in
- * `cloudflare-actions.ts` behind the dashboard's guarded route.
- *
- * Two shapes of Cloudflare's API drive most of what looks odd below:
- *
- * 1. **Everything is account-scoped.** Vercel's `teamId` is optional; a
- *    Cloudflare account id is in the path of every Pages call, so an unscoped
- *    client can answer `viewer()` and `listAccounts()` and nothing else.
- * 2. **Projects are addressed by name, deployments only within a project.**
- *    There is no global deployment endpoint, which is why every deployment read
- *    here takes the project name.
- */
-import type { ProviderFetch } from "./providers/egress.js";
-export interface CloudflareUser {
-    id: string;
-    email?: string | null;
-    username?: string | null;
-}
-export interface CloudflareAccount {
-    id: string;
-    name: string;
-}
-/** A project's Git connection, when it was imported from a repository. */
-export interface CloudflareSource {
-    type: string;
-    owner?: string;
-    repoName?: string;
-    productionBranch?: string;
-}
-export interface CloudflareProject {
-    /** Cloudflare's own UUID. Not what the API addresses the project by — see {@link name}. */
-    uuid: string;
-    /** The path segment every project-scoped call uses. */
-    name: string;
-    framework?: string | null;
-    productionBranch?: string | null;
-    createdAt?: number;
-    updatedAt?: number;
-    source?: CloudflareSource;
-    /**
-     * The `<project>.pages.dev` host Cloudflare assigns. The address the site
-     * actually serves from until a custom domain exists, and absent from the
-     * project's `/domains` list — see {@link CloudflareManager.listDomains}.
-     */
-    subdomain?: string | null;
-    /**
-     * Build settings. Null means "not set", which Cloudflare renders as its own
-     * default — distinct from the field being absent, though in practice the list
-     * and single-project endpoints return the same shape, unlike Vercel's.
-     */
-    buildCommand?: string | null;
-    destinationDir?: string | null;
-    rootDir?: string | null;
-    /** Per-environment variables, embedded in the project rather than listed separately. */
-    envVars: CloudflareEnvVar[];
-}
-/**
- * One variable, already merged across the environments it appears in.
- *
- * Cloudflare stores these as a `{ NAME: { type, value } }` map per environment,
- * so the same key in production and preview is two entries there and one here.
- * `value` is present only for `plain_text`; a `secret_text` value never reads
- * back over the API at all.
- */
-export interface CloudflareEnvVar {
-    key: string;
-    environments: string[];
-    type: "plain_text" | "secret_text";
-    value?: string;
-}
-export interface CloudflareDeploymentStage {
-    name: string;
-    status: string;
-}
-export interface CloudflareDeployment {
-    id: string;
-    shortId?: string;
-    projectName: string;
-    url: string | null;
-    environment: string;
-    stage: CloudflareDeploymentStage;
-    isSkipped: boolean;
-    createdAt: number;
-    modifiedAt?: number;
-    aliases: string[];
-    branch?: string;
-    commitHash?: string;
-    commitMessage?: string;
-}
-export interface CloudflareBuildLogLine {
-    id: string;
-    createdAt: number;
-    text: string;
-}
-export interface CloudflareDomain {
-    name: string;
-    status: string;
-    createdAt?: number;
-    /** Set when validation is outstanding — the DNS record the user must add. */
-    validation?: {
-        method?: string;
-        status?: string;
-        txtName?: string;
-        txtValue?: string;
-    };
-    errorMessage?: string;
-}
-export declare class CloudflareApiError extends Error {
-    readonly status: number;
-    readonly path: string;
-    /** Cloudflare's own numeric error code, when it sent one. */
-    readonly code?: number | undefined;
-    constructor(message: string, status: number, path: string, 
-    /** Cloudflare's own numeric error code, when it sent one. */
-    code?: number | undefined);
-}
-/**
- * Cloudflare keys an imported project by owner and repository name rather than
- * by a URL, so the "repo url" this provider matches on is `owner/repo`.
- *
- * The contract calls this a repo *URL* because that is what Vercel wants; what
- * it actually means is "the string this vendor recognizes a repository by", and
- * only {@link CloudflareManager.findProjectByRepo} ever interprets it.
- */
-export declare function cloudflareRepoUrl(remoteUrl: string): string | null;
-export declare class CloudflareManager {
-    private readonly token;
-    private readonly accountId?;
-    private readonly baseUrl;
-    /** The provider's scoped `fetch`; global `fetch` when built outside the registry. */
-    private readonly fetchImpl?;
-    constructor(token: string, accountId?: string | undefined, baseUrl?: string, 
-    /** The provider's scoped `fetch`; global `fetch` when built outside the registry. */
-    fetchImpl?: ProviderFetch | undefined);
-    /**
-     * The signed-in account.
-     *
-     * `/user` needs a token carrying User Details Read, which a project-scoped
-     * API token typically does not have. Rather than fail the whole dashboard
-     * over an identity nicety, a rejected `/user` falls back to the token's own
-     * verification and the selected account's name.
-     */
-    viewer(): Promise<CloudflareUser>;
-    /**
-     * Identity for a token that cannot read `/user`. `/user/tokens/verify` is
-     * answerable by every API token, so a failure there is a genuine auth error
-     * and is left to propagate.
-     */
-    private tokenViewer;
-    listAccounts(): Promise<CloudflareAccount[]>;
-    /**
-     * Every project in the account.
-     *
-     * Cloudflare has no search or repository filter on this endpoint, so both are
-     * applied here. That is a page of extra bytes, not a page of extra requests —
-     * the list endpoint returns whole project objects either way.
-     */
-    listProjects(opts?: {
-        search?: string;
-        repoUrl?: string;
-        limit?: number;
-    }): Promise<CloudflareProject[]>;
-    /** The project a repository deploys, matched on `owner/repo`. */
-    findProjectByRepo(repoUrl: string): Promise<CloudflareProject | undefined>;
-    getProject(name: string): Promise<CloudflareProject>;
-    listDeployments(opts: {
-        projectName: string;
-        env?: "production" | "preview";
-        limit?: number;
-    }): Promise<CloudflareDeployment[]>;
-    getDeployment(projectName: string, deploymentId: string): Promise<CloudflareDeployment>;
-    /**
-     * The deployment that currently serves production, which Cloudflare records
-     * on the project rather than on the deployment. A rollback moves it, so it
-     * cannot be inferred from "the newest successful production build".
-     */
-    canonicalDeploymentId(projectName: string): Promise<string | undefined>;
-    deploymentBuildLogs(projectName: string, deploymentId: string, limit?: number): Promise<CloudflareBuildLogLine[]>;
-    /** Variables for the project, keys and environments only — values are dropped. */
-    listEnv(projectName: string): Promise<CloudflareEnvVar[]>;
-    /**
-     * One variable's value.
-     *
-     * Cloudflare returns `plain_text` values in the project payload but never a
-     * `secret_text` one — the value is write-only. So this can answer for the
-     * former and must say so plainly for the latter, rather than returning an
-     * empty string the UI would render as "this secret is blank".
-     */
-    getEnvValue(projectName: string, key: string): Promise<string>;
-    /**
-     * The project's domains, including the `*.pages.dev` host Cloudflare assigns.
-     *
-     * `/domains` lists **custom** domains only, so a project that is serving
-     * perfectly well reads as having none — while Vercel's equivalent endpoint
-     * includes the vendor-assigned `*.vercel.app`. Both render through the same
-     * generic view, so the asymmetry showed up on a live account as "no domains"
-     * beside a site anyone could load. The subdomain goes last, the way Vercel
-     * orders its own, so a custom domain still leads.
-     *
-     * A failed project read degrades to the custom domains alone: the panel is
-     * still correct, just missing the assigned host.
-     */
-    listDomains(projectName: string): Promise<CloudflareDomain[]>;
-    /** The dashboard page for a deployment, which Cloudflare does not return. */
-    inspectorUrl(projectName: string, deploymentId: string): string | undefined;
-    /**
-     * A Pages list endpoint, read a page at a time until `limit` is reached.
-     *
-     * Pages caps `per_page` at 10 and rejects anything larger outright with
-     * `8000024 Invalid list options provided` — a whole-request failure, not a
-     * silent truncation. The cap is undocumented: the OpenAPI schema types
-     * `per_page` as a plain integer and only hints at it through `example: 10`.
-     * Asking for the old 20–100 therefore failed every single call.
-     *
-     * Paging is what keeps the callers whole, since a 10-item page cannot answer
-     * "find the project for this repo" on its own.
-     */
-    private pages;
-    private projectPath;
-    /**
-     * The account every Pages path needs. Throwing here rather than sending a
-     * request with `undefined` in the URL is what turns "no account chosen" into
-     * a sentence the scope switcher answers.
-     *
-     * The message names the empty-picker case too: `/accounts` answers `success`
-     * with an empty list for a token carrying no Account Resources, so "choose an
-     * account" on its own sends the reader looking for a choice that isn't there.
-     */
-    private account;
-    private request;
-}
-export interface CloudflareRequestAuth {
-    token: string;
-    baseUrl?: string;
-    /**
-     * The provider's scoped `fetch` (see `providers/egress.ts`). Absent means
-     * global `fetch` — the case for a manager built directly in a test. Production
-     * clients come from `cloudflare-context.ts`, which always supplies one.
-     */
-    fetch?: ProviderFetch;
-}
-/**
- * The one place a Cloudflare API call is made. Shared with
- * `cloudflare-actions.ts` so auth and error shaping stay identical across the
- * read and write halves — the read/write boundary is which module exposes an
- * operation, not which one can reach the network.
- */
-export declare function cloudflareRequest<T>(auth: CloudflareRequestAuth, path: string, opts?: {
-    method?: string;
-    body?: unknown;
-}): Promise<T>;