super-secret 1.0.1 → 1.0.2

package/README.md

@@ -88,7 +88,7 @@ and tokens live in the vault, not in the manifest.
 | `manual` | the operator mints it where `create` says and pastes it (hidden, or on stdin); checked against `pattern` and `probe` | `retire` is queued as a manual step |
 | `stripe-secret-key` | manual roll in the Dashboard, paste; checked against the same account and mode | manual expire |
 | `stripe-webhook-secret` | a twin endpoint at `url`; its secret ships | the old endpoint is deleted |
-| `cloudflare-api-token` | the token rolls itself in place (needs "API Tokens: Edit") | none |
+| `cloudflare-api-token` | the token rolls itself in place; user-owned and account-owned tokens both work (needs "API Tokens: Edit" or "Account API Tokens: Edit"; optional `account`) | none |
 
 Probes (`probe` on `generated` and `manual`): `{ kind: 'http', url, headers, bearer, basic, expect }`,
 or a preset: `railway-account`, `railway-project`, `github-token`, `stripe-key`,

package/dist/rotators/cloudflareToken.d.ts

@@ -3,11 +3,19 @@ export interface CloudflareApiTokenSpec {
     kind: 'cloudflare-api-token';
     /** Store key (default CLOUDFLARE_API_TOKEN). */
     key?: string;
+    /**
+     * Account id for an account-owned token: a literal or `${KEY}`. Optional:
+     * without it the account is discovered with the token itself. Ignored for
+     * a user-owned token.
+     */
+    account?: string;
 }
 /**
- * Cloudflare can roll a token's value in place (PUT /user/tokens/:id/value)
- * when the caller may edit API tokens. The token rolls itself: same id, same
- * permissions, new secret; nothing to revoke. Without that permission the
+ * Cloudflare can roll a token's value in place (PUT …/tokens/:id/value) when
+ * the caller may edit API tokens. The token rolls itself: same id, same
+ * permissions, new secret; nothing to revoke. User-owned and account-owned
+ * tokens roll at different endpoints (/user/tokens vs /accounts/{id}/tokens);
+ * the rotator finds out which kind it holds. Without the edit permission the
  * call fails and the manifest should use a `manual` rotator instead.
  */
 export declare function cloudflareApiTokenRotator(spec?: CloudflareApiTokenSpec): Rotator;

package/dist/rotators/cloudflareToken.js

@@ -1,28 +1,31 @@
+import { resolveRef } from "../resolve.js";
 import { http, HttpError } from "../util.js";
-import { PRESETS, bearer } from "./probes.js";
-const API = 'https://api.cloudflare.com/client/v4';
+import { bearer, locateCloudflareToken } from "./probes.js";
 /**
- * Cloudflare can roll a token's value in place (PUT /user/tokens/:id/value)
- * when the caller may edit API tokens. The token rolls itself: same id, same
- * permissions, new secret; nothing to revoke. Without that permission the
+ * Cloudflare can roll a token's value in place (PUT …/tokens/:id/value) when
+ * the caller may edit API tokens. The token rolls itself: same id, same
+ * permissions, new secret; nothing to revoke. User-owned and account-owned
+ * tokens roll at different endpoints (/user/tokens vs /accounts/{id}/tokens);
+ * the rotator finds out which kind it holds. Without the edit permission the
  * call fails and the manifest should use a `manual` rotator instead.
  */
 export function cloudflareApiTokenRotator(spec = { kind: 'cloudflare-api-token' }) {
     const KEY = spec.key ?? 'CLOUDFLARE_API_TOKEN';
+    const account = async (ctx) => (spec.account ? resolveRef(spec.account, ctx, 'cloudflare account') : undefined);
     return {
         async preflight(ctx) {
             const token = await ctx.store.get(KEY);
             if (!token)
                 throw new Error(`${KEY} is not in the store`);
-            const r = await PRESETS['cloudflare-token'](token);
+            const r = await locateCloudflareToken(token, await account(ctx));
             if (!r.ok)
                 throw new Error(r.detail);
             return [r.detail];
         },
         async plan() {
             return [
-                `GET ${API}/user/tokens/verify for the token id, then PUT /user/tokens/{id}/value (roll in place)`,
-                'needs the token (or the operator env) to carry "API Tokens: Edit"; otherwise use a manual rotator',
+                'verify the token at /user/tokens, else /accounts/{id}/tokens, for its id; then PUT …/tokens/{id}/value (roll in place)',
+                'needs the token to carry "API Tokens: Edit" (user-owned) or "Account API Tokens: Edit" (account-owned); otherwise use a manual rotator',
                 'nothing to revoke: the old value stops working the moment the roll returns',
             ];
         },
@@ -30,24 +33,28 @@ export function cloudflareApiTokenRotator(spec = { kind: 'cloudflare-api-token'
             const token = await ctx.store.get(KEY);
             if (!token)
                 throw new Error(`${KEY} is not in the store`);
-            const verify = await http(`${API}/user/tokens/verify`, { headers: bearer(token) });
+            const where = await locateCloudflareToken(token, await account(ctx));
+            if (!where.ok || !where.id || !where.base)
+                throw new Error(where.detail);
             try {
-                const rolled = await http(`${API}/user/tokens/${verify.result.id}/value`, {
+                const rolled = await http(`${where.base}/${where.id}/value`, {
                     method: 'PUT',
                     headers: { ...bearer(token), 'content-type': 'application/json' },
                     body: '{}',
                 });
-                return { values: { [KEY]: rolled.result }, revoke: [], notes: [`rolled token ${verify.result.id}`] };
+                return { values: { [KEY]: rolled.result }, revoke: [], notes: [`rolled token ${where.id}`] };
             }
             catch (e) {
-                if (e instanceof HttpError && (e.status === 403 || e.status === 401))
-                    throw new Error(`token ${verify.result.id} may not roll itself (HTTP ${e.status}); give it "User → API Tokens → Edit" or switch this secret to a manual rotator`);
+                if (e instanceof HttpError && (e.status === 403 || e.status === 401)) {
+                    const perm = where.account ? '"Account → Account API Tokens → Edit"' : '"User → API Tokens → Edit"';
+                    throw new Error(`token ${where.id} may not roll itself (HTTP ${e.status}); give it ${perm} or switch this secret to a manual rotator`);
+                }
                 throw e;
             }
         },
-        async probe(values) {
+        async probe(values, ctx) {
             const v = values[KEY];
-            return v ? PRESETS['cloudflare-token'](v) : { ok: false, detail: `${KEY} missing` };
+            return v ? locateCloudflareToken(v, await account(ctx)) : { ok: false, detail: `${KEY} missing` };
         },
     };
 }

package/dist/rotators/cloudflareToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflareToken.js","sourceRoot":"","sources":["../../src/rotators/cloudflareToken.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQ9C,MAAM,GAAG,GAAG,sCAAsC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACxG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,sBAAsB,CAAC;IAC/C,OAAO;QACN,KAAK,CAAC,SAAS,CAAC,GAAG;YAClB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI;YACT,OAAO;gBACN,OAAO,GAAG,wFAAwF;gBAClG,mGAAmG;gBACnG,4EAA4E;aAC5E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,GAAG;YAClB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAA6B,GAAG,GAAG,qBAAqB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/G,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAqB,GAAG,GAAG,gBAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE;oBAC7F,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBACjE,IAAI,EAAE,IAAI;iBACV,CAAC,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,gBAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACtG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,YAAY,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC;oBACnE,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,CAAC,MAAM,iFAAiF,CAAC,CAAC;gBACnK,MAAM,CAAC,CAAC;YACT,CAAC;QACF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM;YACjB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC;QACrF,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"cloudflareToken.js","sourceRoot":"","sources":["../../src/rotators/cloudflareToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAc5D;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACxG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,sBAAsB,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrH,OAAO;QACN,KAAK,CAAC,SAAS,CAAC,GAAG;YAClB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI;YACT,OAAO;gBACN,wHAAwH;gBACxH,wIAAwI;gBACxI,4EAA4E;aAC5E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,GAAG;YAClB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAqB,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,QAAQ,EAAE;oBAChF,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBACjE,IAAI,EAAE,IAAI;iBACV,CAAC,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,gBAAgB,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC9F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,YAAY,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,4BAA4B,CAAC;oBACpG,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,8BAA8B,CAAC,CAAC,MAAM,cAAc,IAAI,4CAA4C,CAAC,CAAC;gBACxI,CAAC;gBACD,MAAM,CAAC,CAAC;YACT,CAAC;QACF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG;YACtB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC;QACnG,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/rotators/index.d.ts

@@ -7,5 +7,5 @@ import { stripeSecretKeyRotator, stripeWebhookSecretRotator, type StripeSecretKe
 export type RotatorSpec = GeneratedSpec | StaticSpec | ManualSpec | StripeSecretKeySpec | StripeWebhookSecretSpec | CloudflareApiTokenSpec;
 export declare function createRotator(spec: RotatorSpec | Rotator, id: string): Rotator;
 export { cloudflareApiTokenRotator, generatedRotator, manualRotator, staticRotator, stripeSecretKeyRotator, stripeWebhookSecretRotator };
-export { PRESETS, runProbe, type PresetName, type ProbeSpec } from './probes.ts';
+export { PRESETS, locateCloudflareToken, runProbe, type CloudflareTokenLocation, type PresetName, type ProbeSpec } from './probes.ts';
 export type { CloudflareApiTokenSpec, GeneratedSpec, ManualSpec, StaticSpec, StripeSecretKeySpec, StripeWebhookSecretSpec };

package/dist/rotators/index.js

@@ -24,5 +24,5 @@ export function createRotator(spec, id) {
     }
 }
 export { cloudflareApiTokenRotator, generatedRotator, manualRotator, staticRotator, stripeSecretKeyRotator, stripeWebhookSecretRotator };
-export { PRESETS, runProbe } from "./probes.js";
+export { PRESETS, locateCloudflareToken, runProbe } from "./probes.js";
 //# sourceMappingURL=index.js.map

package/dist/rotators/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rotators/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAA+B,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAsB,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACN,sBAAsB,EACtB,0BAA0B,GAG1B,MAAM,aAAa,CAAC;AAUrB,MAAM,UAAU,aAAa,CAAC,IAA2B,EAAE,EAAU;IACpE,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW;YACf,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACZ,OAAO,aAAa,EAAE,CAAC;QACxB,KAAK,QAAQ;YACZ,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,mBAAmB;YACvB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,uBAAuB;YAC3B,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,sBAAsB;YAC1B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxC;YACC,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,0BAA0B,MAAM,CAAE,IAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACF,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,CAAC;AACzI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAmC,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rotators/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAA+B,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAsB,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACN,sBAAsB,EACtB,0BAA0B,GAG1B,MAAM,aAAa,CAAC;AAUrB,MAAM,UAAU,aAAa,CAAC,IAA2B,EAAE,EAAU;IACpE,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW;YACf,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACZ,OAAO,aAAa,EAAE,CAAC;QACxB,KAAK,QAAQ;YACZ,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,mBAAmB;YACvB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,uBAAuB;YAC3B,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,sBAAsB;YAC1B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxC;YACC,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,0BAA0B,MAAM,CAAE,IAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACF,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,CAAC;AACzI,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAiE,MAAM,aAAa,CAAC"}

package/dist/rotators/probes.d.ts

@@ -51,11 +51,26 @@ export declare const PRESETS: {
         ok: boolean;
         detail: string;
     }>;
-    'cloudflare-token': (token: string) => Promise<{
-        ok: boolean;
-        detail: string;
-    }>;
+    'cloudflare-token': (token: string) => Promise<CloudflareTokenLocation>;
 };
+export declare const CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
+export interface CloudflareTokenLocation extends ProbeResult {
+    /** The token's id, when a verify endpoint recognised it. */
+    id?: string;
+    /** Collection the token lives in: `…/user/tokens` or `…/accounts/{id}/tokens`. */
+    base?: string;
+    /** Owning account, for an account-owned token. */
+    account?: string;
+}
+/**
+ * Cloudflare has two kinds of API token and each verifies (and rolls) only
+ * at its own endpoint: user-owned at /user/tokens, account-owned at
+ * /accounts/{id}/tokens. The user endpoint answers an account-owned token
+ * with 401 "Invalid API Token", which says nothing about its health, so a
+ * token is dead only when neither endpoint knows it. `account` skips the
+ * discovery call (GET /accounts, which a token can make for its own account).
+ */
+export declare function locateCloudflareToken(token: string, account?: string): Promise<CloudflareTokenLocation>;
 export declare function basic(user: string, pass?: string): Record<string, string>;
 export declare function bearer(token: string): Record<string, string>;
 export declare function runProbe(spec: ProbeSpec | undefined, values: Values, ctx: Ctx, def: SecretDef): Promise<ProbeResult>;

package/dist/rotators/probes.js

@@ -54,14 +54,55 @@ export const PRESETS = {
         const code = r.body?.SUMMARY?.RESPONSE_CODE;
         return { ok: r.status === 200 && code === 1, detail: `synoptic → HTTP ${r.status}, RESPONSE_CODE ${code ?? '?'}` };
     },
-    'cloudflare-token': async (token) => {
-        const r = await json('https://api.cloudflare.com/client/v4/user/tokens/verify', {
-            headers: bearer(token),
-        });
-        const status = r.body?.result?.status;
-        return { ok: status === 'active', detail: `cloudflare tokens/verify → HTTP ${r.status}, status ${status ?? '?'}` };
-    },
+    'cloudflare-token': async (token) => locateCloudflareToken(token),
 };
+export const CLOUDFLARE_API = 'https://api.cloudflare.com/client/v4';
+/**
+ * Cloudflare has two kinds of API token and each verifies (and rolls) only
+ * at its own endpoint: user-owned at /user/tokens, account-owned at
+ * /accounts/{id}/tokens. The user endpoint answers an account-owned token
+ * with 401 "Invalid API Token", which says nothing about its health, so a
+ * token is dead only when neither endpoint knows it. `account` skips the
+ * discovery call (GET /accounts, which a token can make for its own account).
+ */
+export async function locateCloudflareToken(token, account) {
+    const headers = bearer(token);
+    const user = await json(`${CLOUDFLARE_API}/user/tokens/verify`, { headers });
+    const userStatus = user.body?.result?.status;
+    if (userStatus) {
+        return {
+            ok: userStatus === 'active',
+            detail: `cloudflare user token → HTTP ${user.status}, status ${userStatus}`,
+            id: user.body?.result?.id,
+            base: `${CLOUDFLARE_API}/user/tokens`,
+        };
+    }
+    if (user.status === 0)
+        return { ok: false, detail: 'cloudflare tokens/verify → no response' };
+    let accounts = account ? [account] : [];
+    let listed = '';
+    if (!account) {
+        const list = await json(`${CLOUDFLARE_API}/accounts`, { headers });
+        accounts = (list.body?.result ?? []).map((a) => a.id).filter((id) => !!id);
+        listed = `; GET /accounts → HTTP ${list.status}, ${accounts.length} account(s)`;
+    }
+    let last = '';
+    for (const id of accounts) {
+        const r = await json(`${CLOUDFLARE_API}/accounts/${id}/tokens/verify`, { headers });
+        const status = r.body?.result?.status;
+        if (status) {
+            return {
+                ok: status === 'active',
+                detail: `cloudflare account token (account ${id}) → HTTP ${r.status}, status ${status}`,
+                id: r.body?.result?.id,
+                base: `${CLOUDFLARE_API}/accounts/${id}/tokens`,
+                account: id,
+            };
+        }
+        last = `; account ${id} tokens/verify → HTTP ${r.status}`;
+    }
+    return { ok: false, detail: `cloudflare user tokens/verify → HTTP ${user.status}${listed}${last}` };
+}
 export function basic(user, pass = '') {
     return { authorization: `Basic ${Buffer.from(`${user}:${pass}`).toString('base64')}` };
 }

package/dist/rotators/probes.js.map

@@ -1 +1 @@
-{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/rotators/probes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AA6BpD,KAAK,UAAU,IAAI,CAAI,GAAW,EAAE,IAAiB;IACpD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAmB,CAAC;QACxB,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,cAAc;QACf,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACtB,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAyC,WAAW,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;IACtH,CAAC;IACD,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAuD,WAAW,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,KAAK,EAAE;YAC9E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;IACjI,CAAC;IACD,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAqB,6BAA6B,EAAE;YACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;SAC3E,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7H,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC3B,eAAe,CAAC,MAAM,QAAQ,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,wBAAwB,CAAC;IACxH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,eAAe,CACd,MAAM,QAAQ,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mBAAmB,EAAE,YAAY,EAAE,EAAE,CAAC,EACnI,0BAA0B,CAC1B;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,MAAM,QAAQ,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,uBAAuB,CAAC;IACvH,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACzB,eAAe,CAAC,MAAM,QAAQ,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,0BAA0B,CAAC;IAC/H,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACvB,eAAe,CAAC,MAAM,QAAQ,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,4BAA4B,CAAC;IACpI,0HAA0H;IAC1H,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CACd,MAAM,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAChJ,6BAA6B,EAC7B,CAAC,GAAG,EAAE,GAAG,CAAC,CACV;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CACnB,2DAA2D,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAChG,EAAE,CACF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,MAAM,mBAAmB,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;IACpH,CAAC;IACD,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAmC,yDAAyD,EAAE;YACjH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,QAAQ,EAAE,MAAM,EAAE,mCAAmC,CAAC,CAAC,MAAM,YAAY,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;IACpH,CAAC;CACgC,CAAC;AAEnC,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,IAAI,GAAG,EAAE;IAC5C,OAAO,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AACxF,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA2B,EAAE,MAAc,EAAE,GAAQ,EAAE,GAAc;IACnG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,sFAAsF;QACtF,MAAM,GAAG,GAAW,EAAE,GAAG,MAAM,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,KAAK;YACb,MAAM,CAAC,MAAM,CACZ,OAAO,EACP,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAC7H,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtH,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAuB,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAChF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/rotators/probes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AA6BpD,KAAK,UAAU,IAAI,CAAI,GAAW,EAAE,IAAiB;IACpD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAmB,CAAC;QACxB,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,cAAc;QACf,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACtB,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAyC,WAAW,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;IACtH,CAAC;IACD,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAuD,WAAW,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,KAAK,EAAE;YAC9E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;IACjI,CAAC;IACD,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAqB,6BAA6B,EAAE;YACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;SAC3E,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7H,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC3B,eAAe,CAAC,MAAM,QAAQ,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,wBAAwB,CAAC;IACxH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,eAAe,CACd,MAAM,QAAQ,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mBAAmB,EAAE,YAAY,EAAE,EAAE,CAAC,EACnI,0BAA0B,CAC1B;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,MAAM,QAAQ,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,uBAAuB,CAAC;IACvH,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACzB,eAAe,CAAC,MAAM,QAAQ,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,0BAA0B,CAAC;IAC/H,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACvB,eAAe,CAAC,MAAM,QAAQ,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,4BAA4B,CAAC;IACpI,0HAA0H;IAC1H,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CACd,MAAM,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAChJ,6BAA6B,EAC7B,CAAC,GAAG,EAAE,GAAG,CAAC,CACV;IACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CACnB,2DAA2D,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAChG,EAAE,CACF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,MAAM,mBAAmB,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;IACpH,CAAC;IACD,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC;CAChC,CAAC;AAEnC,MAAM,CAAC,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAWrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,OAAgB;IAE1E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAS,GAAG,cAAc,qBAAqB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC7C,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO;YACN,EAAE,EAAE,UAAU,KAAK,QAAQ;YAC3B,MAAM,EAAE,gCAAgC,IAAI,CAAC,MAAM,YAAY,UAAU,EAAE;YAC3E,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,EAAE,GAAG,cAAc,cAAc;SACrC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAE9F,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAsC,GAAG,cAAc,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxG,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,GAAG,0BAA0B,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,aAAa,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAS,GAAG,cAAc,aAAa,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO;gBACN,EAAE,EAAE,MAAM,KAAK,QAAQ;gBACvB,MAAM,EAAE,qCAAqC,EAAE,YAAY,CAAC,CAAC,MAAM,YAAY,MAAM,EAAE;gBACvF,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACtB,IAAI,EAAE,GAAG,cAAc,aAAa,EAAE,SAAS;gBAC/C,OAAO,EAAE,EAAE;aACX,CAAC;QACH,CAAC;QACD,IAAI,GAAG,aAAa,EAAE,yBAAyB,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,IAAI,GAAG,EAAE;IAC5C,OAAO,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AACxF,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA2B,EAAE,MAAc,EAAE,GAAQ,EAAE,GAAc;IACnG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,sFAAsF;QACtF,MAAM,GAAG,GAAW,EAAE,GAAG,MAAM,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,KAAK;YACb,MAAM,CAAC,MAAM,CACZ,OAAO,EACP,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAC7H,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtH,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAuB,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAChF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-secret",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Import, push and rotate a project's secrets with 1Password as the store: dry run by default, values never printed, one manifest per repo.",
   "license": "MIT",
   "author": "Matthew Preucil",