ugly-app 0.1.963 → 0.1.965

package/dist/character/client/index.d.ts

@@ -12,7 +12,7 @@ export type { CharPart, PartManifest, EyesManifest, MouthManifest, } from './lib
 export { CharPartDraw } from './lib/charPartDraw.js';
 export { loadHairMeshes, HAIR_CUTOUT } from './lib/charHair.js';
 export type { HairMeshes, HairManifest, GeoStyle } from './lib/charHair.js';
-export { loadGarments, garmentSlotById, conformGarment, garmentNormals, wornOver, drapeOverInner, GARMENT_SLOTS, } from './lib/charGarment.js';
+export { loadGarments, garmentSlotById, transferSkinWeights, conformGarment, garmentNormals, wornOver, drapeOverInner, GARMENT_SLOTS, } from './lib/charGarment.js';
 export type { Garment, GarmentKit, GarmentRung, GarmentSlot, GarmentMeta, GarmentManifest, } from './lib/charGarment.js';
 export { makeSkinCache, makeHairCache, makeGarmentCache, loadSkinManifest, loadHairTextures, } from './lib/skinTextures.js';
 export type { SkinCache, SkinManifest } from './lib/skinTextures.js';

package/dist/character/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/character/client/index.ts"],"names":[],"mappings":"AAUA,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7E,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EACL,YAAY,EACZ,eAAe,EACf,cAAc,EACd,cAAc,EACd,QAAQ,EACR,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,SAAS,GACV,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAgBzD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACzE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,EACL,SAAS,EACT,OAAO,EACP,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAChF,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/character/client/index.ts"],"names":[],"mappings":"AAUA,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7E,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EACL,YAAY,EACZ,eAAe,EAGf,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,SAAS,GACV,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAgBzD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACzE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,EACL,SAAS,EACT,OAAO,EACP,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAChF,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/character/client/index.js

@@ -18,7 +18,10 @@ export { loadCharKit } from './lib/charKit.js';
 export { loadCharParts, paintMouth, partDigestOk } from './lib/charParts.js';
 export { CharPartDraw } from './lib/charPartDraw.js';
 export { loadHairMeshes, HAIR_CUTOUT } from './lib/charHair.js';
-export { loadGarments, garmentSlotById, conformGarment, garmentNormals, wornOver, drapeOverInner, GARMENT_SLOTS, } from './lib/charGarment.js';
+export { loadGarments, garmentSlotById, 
+// Needed by a consumer assembling its own scene — the cook-time skin-weight
+// transfer a garment needs against a morphed body. See the export note below.
+transferSkinWeights, conformGarment, garmentNormals, wornOver, drapeOverInner, GARMENT_SLOTS, } from './lib/charGarment.js';
 export { makeSkinCache, makeHairCache, makeGarmentCache, loadSkinManifest, loadHairTextures, } from './lib/skinTextures.js';
 export { loadFbxClip, fbxClipNames } from './lib/fbxClips.js';
 export { useCharSpeech, speechChannels } from './lib/charSpeech.js';

package/dist/character/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/character/client/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kCAAkC;AAClC,EAAE;AACF,0FAA0F;AAC1F,2FAA2F;AAC3F,uEAAuE;AACvE,EAAE;AACF,wFAAwF;AACxF,uFAAuF;AACvF,gFAAgF;AAChF,cAAc,oBAAoB,CAAC;AAEnC,4FAA4F;AAC5F,8EAA8E;AAC9E,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQ7E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,cAAc,EACd,cAAc,EACd,QAAQ,EACR,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAOpE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,gFAAgF;AAChF,6CAA6C;AAC7C,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,OAAO,EACP,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/character/client/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kCAAkC;AAClC,EAAE;AACF,0FAA0F;AAC1F,2FAA2F;AAC3F,uEAAuE;AACvE,EAAE;AACF,wFAAwF;AACxF,uFAAuF;AACvF,gFAAgF;AAChF,cAAc,oBAAoB,CAAC;AAEnC,4FAA4F;AAC5F,8EAA8E;AAC9E,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQ7E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,eAAe;AACf,4EAA4E;AAC5E,8EAA8E;AAC9E,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAOpE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,gFAAgF;AAChF,6CAA6C;AAC7C,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,OAAO,EACP,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/cli/auth/cloudflareOauth.d.ts

@@ -1,4 +1,5 @@
 import { type CloudflareCredentials } from './credentials.js';
+import { type RefreshSpawnDeps } from './refreshCli.js';
 export interface RunCloudflareOAuthOptions {
     /** Local callback server port (default 8976). */
     port?: number | undefined;
@@ -37,28 +38,62 @@ export declare function refreshCloudflareToken(refreshToken: string): Promise<{
     refreshToken?: string;
     expiresAt: number;
 } | undefined>;
+export interface RefreshHealOptions {
+    /**
+     * When true, the refresh CLI is spawned and AWAITED — for callers where the
+     * token is load-bearing for the current operation (deploy steps, `tail`).
+     * When false/absent (default), the refresh CLI is fired detached and the
+     * caller proceeds best-effort with the token it already has.
+     */
+    awaitRefresh?: boolean | undefined;
+    /** Test seam — observe spawning without launching a real child process. */
+    deps?: RefreshSpawnDeps | undefined;
+}
 /**
- * Return a fresh Cloudflare access token, refreshing when within REFRESH_SKEW_MS
- * of expiry. The refresh runs inside the cross-process credentials lock and
- * re-reads inside it, so concurrent callers don't double-consume the single-use
- * refresh token. Returns `undefined` when not signed in or the refresh failed.
+ * Return a fresh Cloudflare access token. When the cached token is within
+ * REFRESH_SKEW_MS of expiry, the refresh is handed to the
+ * `ugly-app refresh cloudflare` CLI (which runs it under the cross-process
+ * credentials lock) rather than being performed inline: by default the CLI is
+ * fired detached and this returns the best available (possibly stale) creds so
+ * the request path never blocks on the lock; with `awaitRefresh: true` the
+ * CLI's exit is awaited and the healed credentials are re-read.
+ *
+ * Returns `undefined` when not signed in or no refresh token exists.
  */
-export declare function getFreshCloudflareCredentials(): Promise<CloudflareCredentials | undefined>;
+export declare function getFreshCloudflareCredentials(opts?: RefreshHealOptions): Promise<CloudflareCredentials | undefined>;
 /**
- * FORCE a token refresh (ignoring the local `expiresAt`) and persist the result.
- * For callers that hit a real 401 despite a locally-"valid" token — the cached
- * `expiresAt` can lie (revoked token, or a mis-computed expiry).
- *
- * Runs inside the cross-process credentials lock. Pass `staleToken` — the access
- * token that just 401'd — so that if another process already rotated the token
- * out from under us (the on-disk access token no longer matches), we return the
- * fresh token WITHOUT consuming the single-use refresh token a second time. This
- * is the dedupe that collapses concurrent 401 storms into a single refresh and
- * stops the refresh chain from being breach-invalidated.
+ * FORCE a token refresh (ignoring the local `expiresAt`). For callers that hit
+ * a real 401 despite a locally-"valid" token — the cached `expiresAt` can lie
+ * (revoked token, or a mis-computed expiry).
  *
- * Persisting the rotated refresh token is mandatory (Cloudflare rotates them
- * single-use). Returns `undefined` if there's no session or the refresh token is
- * dead (caller must prompt re-login).
+ * Pass `staleToken` — the access token that just 401'd. If the on-disk access
+ * token no longer matches, another process already rotated it and we reuse the
+ * fresh one WITHOUT firing another refresh. Otherwise the refresh is handed to
+ * the `ugly-app refresh cloudflare` CLI with the same stale-token dedupe (the
+ * command no-ops if the on-disk token moved on), collapsing a concurrent 401
+ * storm into a single locked refresh. Fire-and-forget by default (returns the
+ * current creds; the retry uses a rotated token only if one already landed);
+ * `awaitRefresh: true` blocks on the CLI and re-reads.
+ */
+export declare function forceRefreshCloudflareCredentials(staleToken?: string, opts?: RefreshHealOptions): Promise<CloudflareCredentials | undefined>;
+export type CloudflareRefreshStatus = 'refreshed' | 'already-fresh' | 'no-session';
+export interface RefreshNowOptions {
+    /** Refresh even when the cached `expiresAt` still looks fresh. */
+    force?: boolean;
+    /** Only refresh if the on-disk access token still equals this (401-storm dedupe). */
+    staleToken?: string;
+    /** Test seam — stub the token endpoint. Defaults to the real fetch. */
+    refreshTokenFn?: typeof refreshCloudflareToken;
+    /** Test seam — override the lock wait budget. */
+    lockTimeoutMs?: number;
+}
+/**
+ * The body of `ugly-app refresh cloudflare` — THE single locked refresh path.
+ * Acquires the credentials lock (waiting up to REFRESH_LOCK_TIMEOUT_MS and
+ * failing cleanly on timeout — it never refreshes unlocked), re-reads inside
+ * the lock, no-ops when the token is fresh or was already rotated by someone
+ * else, and refreshes + persists (including the rotated single-use refresh
+ * token) when stale. Throws when the refresh token is rejected.
  */
-export declare function forceRefreshCloudflareCredentials(staleToken?: string): Promise<CloudflareCredentials | undefined>;
+export declare function refreshCloudflareCredentialsNow(opts?: RefreshNowOptions): Promise<CloudflareRefreshStatus>;
 //# sourceMappingURL=cloudflareOauth.d.ts.map

package/dist/cli/auth/cloudflareOauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflareOauth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/cloudflareOauth.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,qBAAqB,EAI3B,MAAM,kBAAkB,CAAC;AAgG1B,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAYD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CACR;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAC9E,CAsBA;AASD;;;;;GAKG;AACH,wBAAsB,6BAA6B,IAAI,OAAO,CAC5D,qBAAqB,GAAG,SAAS,CAClC,CAuBA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iCAAiC,CACrD,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAiB5C"}
+{"version":3,"file":"cloudflareOauth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/cloudflareOauth.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,qBAAqB,EAI3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,iBAAiB,CAAC;AAgGzB,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAYD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CACR;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAC9E,CAsBA;AAkBD,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACrC;AAyBD;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAM5C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iCAAiC,CACrD,UAAU,CAAC,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAU5C;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,eAAe,GAAG,YAAY,CAAC;AAEnF,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAC/C,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,uBAAuB,CAAC,CAoClC"}

package/dist/cli/auth/cloudflareOauth.js

@@ -3,6 +3,7 @@ import { openInBrowser } from './browser.js';
 import { startCallbackServer } from './callbackServer.js';
 import { generateCodeChallenge, generateCodeVerifier, generateState, } from './pkce.js';
 import { getCloudflareCredentials, setCloudflareCredentials, withCredentialsLock, } from './credentials.js';
+import { runCloudflareRefreshCli, triggerCloudflareRefresh, } from './refreshCli.js';
 import { parseOrLog, parseOrThrow } from '../../shared/parseWithZod.js';
 /**
  * Cloudflare OAuth configuration.
@@ -197,16 +198,48 @@ export async function refreshCloudflareToken(refreshToken) {
 /**
  * How far before local `expiresAt` we proactively refresh. Bumped from 60s to
  * 5 min so a token doesn't expire mid-operation (a multi-step publish can outlive
- * a 60s window). The real durability comes from the single-flight lock below.
+ * a 60s window).
  */
 const REFRESH_SKEW_MS = 300_000;
 /**
- * Return a fresh Cloudflare access token, refreshing when within REFRESH_SKEW_MS
- * of expiry. The refresh runs inside the cross-process credentials lock and
- * re-reads inside it, so concurrent callers don't double-consume the single-use
- * refresh token. Returns `undefined` when not signed in or the refresh failed.
+ * Lock budget for the refresh command's critical section. A refresh must NEVER
+ * run without the cross-process lock (an unlocked refresh can double-consume
+ * the single-use refresh token and breach-invalidate the chain), so the command
+ * waits far longer than the legacy 10s best-effort budget and fails cleanly
+ * (`onTimeout: 'throw'`) rather than proceeding unlocked.
  */
-export async function getFreshCloudflareCredentials() {
+const REFRESH_LOCK_TIMEOUT_MS = 60_000;
+/**
+ * Route a needed refresh through the `ugly-app refresh cloudflare` CLI (the
+ * single locked refresh path) instead of refreshing inline. Fire-and-forget
+ * by default; awaited when `opts.awaitRefresh`. After an awaited refresh we
+ * re-read the credentials file — a concurrent refresher may have healed it
+ * even if our child failed, and vice versa.
+ */
+async function healViaRefreshCli(creds, opts) {
+    const req = {
+        ...(opts.force ? { force: true } : {}),
+        ...(opts.staleToken ? { staleToken: opts.staleToken } : {}),
+    };
+    if (!opts.awaitRefresh) {
+        await triggerCloudflareRefresh(req, opts.deps);
+        return creds;
+    }
+    await runCloudflareRefreshCli(req, opts.deps);
+    return (await getCloudflareCredentials()) ?? creds;
+}
+/**
+ * Return a fresh Cloudflare access token. When the cached token is within
+ * REFRESH_SKEW_MS of expiry, the refresh is handed to the
+ * `ugly-app refresh cloudflare` CLI (which runs it under the cross-process
+ * credentials lock) rather than being performed inline: by default the CLI is
+ * fired detached and this returns the best available (possibly stale) creds so
+ * the request path never blocks on the lock; with `awaitRefresh: true` the
+ * CLI's exit is awaited and the healed credentials are re-read.
+ *
+ * Returns `undefined` when not signed in or no refresh token exists.
+ */
+export async function getFreshCloudflareCredentials(opts) {
     const creds = await getCloudflareCredentials();
     if (!creds)
         return undefined;
@@ -214,65 +247,74 @@ export async function getFreshCloudflareCredentials() {
         return creds;
     if (!creds.refreshToken)
         return undefined;
-    return withCredentialsLock(async () => {
-        // Re-read INSIDE the lock — another process/waiter may have just refreshed,
-        // in which case we reuse its token instead of consuming the rotated one.
-        const cur = await getCloudflareCredentials();
-        if (!cur)
-            return undefined;
-        if (cur.expiresAt > Date.now() + REFRESH_SKEW_MS)
-            return cur;
-        if (!cur.refreshToken)
-            return undefined;
-        const refreshed = await refreshCloudflareToken(cur.refreshToken);
-        if (!refreshed)
-            return undefined;
-        const next = {
-            ...cur,
-            accessToken: refreshed.accessToken,
-            refreshToken: refreshed.refreshToken,
-            expiresAt: refreshed.expiresAt,
-        };
-        await setCloudflareCredentials(next);
-        return next;
-    });
+    return healViaRefreshCli(creds, { ...opts });
 }
 /**
- * FORCE a token refresh (ignoring the local `expiresAt`) and persist the result.
- * For callers that hit a real 401 despite a locally-"valid" token — the cached
- * `expiresAt` can lie (revoked token, or a mis-computed expiry).
- *
- * Runs inside the cross-process credentials lock. Pass `staleToken` — the access
- * token that just 401'd — so that if another process already rotated the token
- * out from under us (the on-disk access token no longer matches), we return the
- * fresh token WITHOUT consuming the single-use refresh token a second time. This
- * is the dedupe that collapses concurrent 401 storms into a single refresh and
- * stops the refresh chain from being breach-invalidated.
+ * FORCE a token refresh (ignoring the local `expiresAt`). For callers that hit
+ * a real 401 despite a locally-"valid" token — the cached `expiresAt` can lie
+ * (revoked token, or a mis-computed expiry).
  *
- * Persisting the rotated refresh token is mandatory (Cloudflare rotates them
- * single-use). Returns `undefined` if there's no session or the refresh token is
- * dead (caller must prompt re-login).
+ * Pass `staleToken` — the access token that just 401'd. If the on-disk access
+ * token no longer matches, another process already rotated it and we reuse the
+ * fresh one WITHOUT firing another refresh. Otherwise the refresh is handed to
+ * the `ugly-app refresh cloudflare` CLI with the same stale-token dedupe (the
+ * command no-ops if the on-disk token moved on), collapsing a concurrent 401
+ * storm into a single locked refresh. Fire-and-forget by default (returns the
+ * current creds; the retry uses a rotated token only if one already landed);
+ * `awaitRefresh: true` blocks on the CLI and re-reads.
  */
-export async function forceRefreshCloudflareCredentials(staleToken) {
+export async function forceRefreshCloudflareCredentials(staleToken, opts) {
+    const creds = await getCloudflareCredentials();
+    if (!creds?.refreshToken)
+        return undefined;
+    // Someone else already rotated it — reuse instead of double-consuming.
+    if (staleToken && creds.accessToken !== staleToken)
+        return creds;
+    return healViaRefreshCli(creds, {
+        ...opts,
+        force: true,
+        ...(staleToken ? { staleToken } : {}),
+    });
+}
+/**
+ * The body of `ugly-app refresh cloudflare` — THE single locked refresh path.
+ * Acquires the credentials lock (waiting up to REFRESH_LOCK_TIMEOUT_MS and
+ * failing cleanly on timeout — it never refreshes unlocked), re-reads inside
+ * the lock, no-ops when the token is fresh or was already rotated by someone
+ * else, and refreshes + persists (including the rotated single-use refresh
+ * token) when stale. Throws when the refresh token is rejected.
+ */
+export async function refreshCloudflareCredentialsNow(opts = {}) {
+    const creds = await getCloudflareCredentials();
+    if (!creds?.refreshToken)
+        return 'no-session';
     return withCredentialsLock(async () => {
-        const creds = await getCloudflareCredentials();
-        if (!creds?.refreshToken)
-            return undefined;
-        // Someone else already rotated it — reuse instead of double-consuming.
-        if (staleToken && creds.accessToken !== staleToken)
-            return creds;
-        const refreshed = await refreshCloudflareToken(creds.refreshToken);
-        if (!refreshed)
-            return undefined;
+        // Re-read INSIDE the lock — another process/waiter may have just
+        // refreshed, in which case we reuse its token instead of consuming the
+        // rotated single-use refresh token a second time.
+        const cur = await getCloudflareCredentials();
+        if (!cur?.refreshToken)
+            return 'no-session';
+        // 401-storm dedupe: the token that failed is already gone from disk.
+        if (opts.staleToken && cur.accessToken !== opts.staleToken) {
+            return 'already-fresh';
+        }
+        if (!opts.force && cur.expiresAt > Date.now() + REFRESH_SKEW_MS) {
+            return 'already-fresh';
+        }
+        const refreshed = await (opts.refreshTokenFn ?? refreshCloudflareToken)(cur.refreshToken);
+        if (!refreshed) {
+            throw new Error('Cloudflare rejected the refresh token. Re-authenticate: `ugly-app login cloudflare`.');
+        }
         const next = {
-            ...creds,
+            ...cur,
             accessToken: refreshed.accessToken,
             refreshToken: refreshed.refreshToken,
             expiresAt: refreshed.expiresAt,
         };
         await setCloudflareCredentials(next);
-        return next;
-    });
+        return 'refreshed';
+    }, { timeoutMs: opts.lockTimeoutMs ?? REFRESH_LOCK_TIMEOUT_MS, onTimeout: 'throw' });
 }
 const cfUserResponseSchema = z
     .object({

package/dist/cli/auth/cloudflareOauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflareOauth.js","sourceRoot":"","sources":["../../../src/cli/auth/cloudflareOauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,kCAAkC,CAAC;AAE7E,MAAM,wBAAwB,GAAG,yCAAyC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,yBAAyB,GAAG,2CAA2C,CAAC;AAE9E,0EAA0E;AAC1E,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACzD,EAAE,KAAK,CAAC,QAAQ,CAAC;KAChB,MAAM,CAAC,OAAO,CAAC,IAAI;IACpB,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,uBAAuB;IACvB,kBAAkB;IAClB,8BAA8B;IAC9B,oEAAoE;IACpE,8DAA8D;IAC9D,yBAAyB;IACzB,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,UAAU;IACV,SAAS;IACT,sEAAsE;IACtE,kFAAkF;IAClF,yEAAyE;IACzE,2EAA2E;IAC3E,8BAA8B;IAC9B,gBAAgB;IAChB,iBAAiB;IACjB,sEAAsE;IACtE,+EAA+E;IAC/E,iBAAiB;IACjB,kBAAkB;IAClB,WAAW;IACX,YAAY;IACZ,WAAW;IACX,8EAA8E;IAC9E,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,uBAAuB;IACvB,wBAAwB;IACxB,2DAA2D;IAC3D,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,gEAAgE;IAChE,mEAAmE;IACnE,iDAAiD;IACjD,uBAAuB;IACvB,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,2EAA2E;IAC3E,6EAA6E;IAC7E,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,cAAc;IACd,aAAa;IACb,cAAc;IACd,gBAAgB;CACjB,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAoBhC,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,KAAK,EAAE,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAC7C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3E,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;IAC3C,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,mFAAmF,kBAAkB,4BAA4B,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC5D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACnD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,4CAA4C,OAAO,CAAC,QAAQ,EAAE,IAAI,CACnE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;IAEvC,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,oBAAoB;YAC/B,YAAY,EAAE,QAAQ;YACtB,aAAa,EAAE,QAAQ;SACxB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CACzB,qBAAqB,EACrB,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,wBAAwB,CACzB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAC3D,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,SAAS,CACf,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,SAAS;QACT,SAAS;QACT,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAoB;IAIpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,oBAAoB;SAChC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,UAAU,CACvB,qBAAqB,EACrB,MAAM,GAAG,CAAC,IAAI,EAAE,EAChB,0BAA0B,CAC3B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;QAClD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;KACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B;IAGjD,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACpC,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;YAAE,OAAO,GAAG,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,IAAI,GAA0B;YAClC,GAAG,GAAG;YACN,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;QACF,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,UAAmB;IAEnB,OAAO,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,YAAY;YAAE,OAAO,SAAS,CAAC;QAC3C,uEAAuE;QACvE,IAAI,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,IAAI,GAA0B;YAClC,GAAG,KAAK;YACR,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;QACF,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE;CAChD,CAAC;KACD,KAAK,EAAE,CAAC;AAEX,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;CACxE,CAAC;KACD,KAAK,EAAE,CAAC;AAEX,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,SAA6B;IAM7B,2EAA2E;IAC3E,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,KAAK,CAAC,2CAA2C,EAAE;YACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC;QACF,KAAK,CAAC,+CAA+C,EAAE;YACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,UAAU,CAClB,oBAAoB,EACpB,MAAM,OAAO,CAAC,IAAI,EAAE,EACpB,uBAAuB,CACxB,CAAC;QACF,IAAI,CAAC,EAAE,OAAO;YAAE,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CACzB,wBAAwB,EACxB,MAAM,WAAW,CAAC,IAAI,EAAE,EACxB,2BAA2B,CAC5B,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAC9B,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,wEAAwE;IACxE,qDAAqD;IACrD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CACT,4BAA4B,CAAC,CAAC,IAAI,6CAA6C,CAChF,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"cloudflareOauth.js","sourceRoot":"","sources":["../../../src/cli/auth/cloudflareOauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,kCAAkC,CAAC;AAE7E,MAAM,wBAAwB,GAAG,yCAAyC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,yBAAyB,GAAG,2CAA2C,CAAC;AAE9E,0EAA0E;AAC1E,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACzD,EAAE,KAAK,CAAC,QAAQ,CAAC;KAChB,MAAM,CAAC,OAAO,CAAC,IAAI;IACpB,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,uBAAuB;IACvB,kBAAkB;IAClB,8BAA8B;IAC9B,oEAAoE;IACpE,8DAA8D;IAC9D,yBAAyB;IACzB,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,UAAU;IACV,SAAS;IACT,sEAAsE;IACtE,kFAAkF;IAClF,yEAAyE;IACzE,2EAA2E;IAC3E,8BAA8B;IAC9B,gBAAgB;IAChB,iBAAiB;IACjB,sEAAsE;IACtE,+EAA+E;IAC/E,iBAAiB;IACjB,kBAAkB;IAClB,WAAW;IACX,YAAY;IACZ,WAAW;IACX,8EAA8E;IAC9E,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,uBAAuB;IACvB,wBAAwB;IACxB,2DAA2D;IAC3D,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,gEAAgE;IAChE,mEAAmE;IACnE,iDAAiD;IACjD,uBAAuB;IACvB,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,2EAA2E;IAC3E,6EAA6E;IAC7E,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,cAAc;IACd,aAAa;IACb,cAAc;IACd,gBAAgB;CACjB,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAoBhC,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,KAAK,EAAE,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAC7C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3E,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;IAC3C,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,mFAAmF,kBAAkB,4BAA4B,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC5D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACnD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,4CAA4C,OAAO,CAAC,QAAQ,EAAE,IAAI,CACnE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;IAEvC,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,oBAAoB;YAC/B,YAAY,EAAE,QAAQ;YACtB,aAAa,EAAE,QAAQ;SACxB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CACzB,qBAAqB,EACrB,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,wBAAwB,CACzB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAC3D,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,SAAS,CACf,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,SAAS;QACT,SAAS;QACT,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAoB;IAIpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,oBAAoB;SAChC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,UAAU,CACvB,qBAAqB,EACrB,MAAM,GAAG,CAAC,IAAI,EAAE,EAChB,0BAA0B,CAC3B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;QAClD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;KACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAcvC;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAA4B,EAC5B,IAAmE;IAEnE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,KAAK,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,UAAmB,EACnB,IAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO,SAAS,CAAC;IAC3C,uEAAuE;IACvE,IAAI,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,iBAAiB,CAAC,KAAK,EAAE;QAC9B,GAAG,IAAI;QACP,KAAK,EAAE,IAAI;QACX,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO,YAAY,CAAC;IAC9C,OAAO,mBAAmB,CACxB,KAAK,IAAI,EAAE;QACT,iEAAiE;QACjE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,YAAY;YAAE,OAAO,YAAY,CAAC;QAC5C,qEAAqE;QACrE,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;YAChE,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,sBAAsB,CAAC,CACrE,GAAG,CAAC,YAAY,CACjB,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAA0B;YAClC,GAAG,GAAG;YACN,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;QACF,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,uBAAuB,EAAE,SAAS,EAAE,OAAO,EAAE,CACjF,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE;CAChD,CAAC;KACD,KAAK,EAAE,CAAC;AAEX,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;CACxE,CAAC;KACD,KAAK,EAAE,CAAC;AAEX,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,SAA6B;IAM7B,2EAA2E;IAC3E,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,KAAK,CAAC,2CAA2C,EAAE;YACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC;QACF,KAAK,CAAC,+CAA+C,EAAE;YACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,UAAU,CAClB,oBAAoB,EACpB,MAAM,OAAO,CAAC,IAAI,EAAE,EACpB,uBAAuB,CACxB,CAAC;QACF,IAAI,CAAC,EAAE,OAAO;YAAE,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CACzB,wBAAwB,EACxB,MAAM,WAAW,CAAC,IAAI,EAAE,EACxB,2BAA2B,CAC5B,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAC9B,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,wEAAwE;IACxE,qDAAqD;IACrD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CACT,4BAA4B,CAAC,CAAC,IAAI,6CAA6C,CAChF,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC"}

package/dist/cli/auth/credentials.d.ts

@@ -59,7 +59,27 @@ export declare function writeCredentials(creds: Credentials): Promise<void>;
  * The callback MUST use the lock-free `readCredentials`/`writeCredentials` (never
  * re-enter this lock).
  */
-export declare function withCredentialsLock<T>(fn: () => Promise<T>): Promise<T>;
+export interface CredentialsLockOptions {
+    /**
+     * Max time to wait for the lock. Default 10s. Refresh callers should pass a
+     * longer budget (the refresh command waits up to a minute) — a short wait
+     * plus `onTimeout: 'throw'` is how a refresh guarantees it never runs unlocked.
+     */
+    timeoutMs?: number;
+    /**
+     * What to do when the wait budget is exhausted:
+     * - `'proceed'` (default, legacy): run the callback WITHOUT the lock. Kept for
+     *   non-refresh callers where a best-effort read-modify-write is acceptable.
+     * - `'throw'`: reject instead. MANDATORY for refresh paths — an unlocked
+     *   refresh can double-consume Cloudflare's single-use refresh token and
+     *   breach-invalidate the whole chain.
+     */
+    onTimeout?: 'proceed' | 'throw';
+}
+export declare class CredentialsLockTimeoutError extends Error {
+    constructor(lockPath: string, waitedMs: number);
+}
+export declare function withCredentialsLock<T>(fn: () => Promise<T>, opts?: CredentialsLockOptions): Promise<T>;
 export declare function getCloudflareCredentials(): Promise<CloudflareCredentials | undefined>;
 export declare function setCloudflareCredentials(cf: CloudflareCredentials): Promise<void>;
 export declare function getNeonCredentials(): Promise<NeonCredentials | undefined>;

package/dist/cli/auth/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/credentials.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAU5D;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA4C7E;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CACvD,qBAAqB,GAAG,SAAS,CAClC,CAGA;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,qBAAqB,GACxB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CACjD,eAAe,GAAG,SAAS,CAC5B,CAGA;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,GAAG,MAAM,GAC9B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9C"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/credentials.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAU5D;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CACjC;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAO/C;AAED,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAmDZ;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CACvD,qBAAqB,GAAG,SAAS,CAClC,CAGA;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,qBAAqB,GACxB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CACjD,eAAe,GAAG,SAAS,CAC5B,CAGA;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,GAAG,MAAM,GAC9B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9C"}

package/dist/cli/auth/credentials.js

@@ -43,28 +43,21 @@ export async function writeCredentials(creds) {
     await fs.writeFile(tmp, JSON.stringify(creds, null, 2), { mode: 0o600 });
     await fs.rename(tmp, file);
 }
-/**
- * Serialize a read→(refresh)→write critical section on the credentials file
- * across processes. Cloudflare rotates the OAuth refresh token single-use, so two
- * processes (e.g. `ugly-app errors` + the ugly-studio publish sidecar, or two
- * concurrent CLIs) that both refresh with the same refresh token cause Cloudflare
- * to breach-invalidate the whole chain — leaving a dead access token with a
- * still-future `expiresAt`. Holding this lock across the whole refresh lets the
- * second waiter re-read the freshly-rotated token instead of double-consuming it.
- *
- * Implementation: an atomic `O_CREAT|O_EXCL` create of a sibling `.lock` file
- * (works cross-process on local filesystems — this is a single-machine dev tool).
- * A crashed holder can't wedge login forever: a lock older than STALE_MS is broken.
- * The callback MUST use the lock-free `readCredentials`/`writeCredentials` (never
- * re-enter this lock).
- */
-export async function withCredentialsLock(fn) {
+export class CredentialsLockTimeoutError extends Error {
+    constructor(lockPath, waitedMs) {
+        super(`Timed out after ${waitedMs}ms waiting for the credentials lock (${lockPath}). ` +
+            `Another process may be mid-refresh; retry shortly.`);
+        this.name = 'CredentialsLockTimeoutError';
+    }
+}
+export async function withCredentialsLock(fn, opts) {
     const lock = `${credentialsPath()}.lock`;
     const dir = path.dirname(lock);
     await fs.mkdir(dir, { recursive: true, mode: 0o700 });
     const STALE_MS = 15_000;
-    const MAX_WAIT_MS = 10_000;
+    const MAX_WAIT_MS = opts?.timeoutMs ?? 10_000;
     const started = Date.now();
+    let acquired = false;
     // eslint-disable-next-line no-constant-condition
     while (true) {
         try {
@@ -75,6 +68,7 @@ export async function withCredentialsLock(fn) {
             finally {
                 await fh.close();
             }
+            acquired = true;
             break; // acquired
         }
         catch (err) {
@@ -93,6 +87,9 @@ export async function withCredentialsLock(fn) {
                 continue;
             }
             if (Date.now() - started > MAX_WAIT_MS) {
+                if (opts?.onTimeout === 'throw') {
+                    throw new CredentialsLockTimeoutError(lock, Date.now() - started);
+                }
                 // Give up waiting rather than hang login forever; proceed best-effort.
                 break;
             }
@@ -103,7 +100,10 @@ export async function withCredentialsLock(fn) {
         return await fn();
     }
     finally {
-        await fs.rm(lock, { force: true }).catch(() => { });
+        // Only the process that actually acquired the lock may release it — a
+        // timed-out best-effort caller must not delete the real holder's lock.
+        if (acquired)
+            await fs.rm(lock, { force: true }).catch(() => { });
     }
 }
 export async function getCloudflareCredentials() {

package/dist/cli/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/cli/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAiC7B;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAkB;IACvD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,EAAoB;IAC/D,MAAM,IAAI,GAAG,GAAG,eAAe,EAAE,OAAO,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrD,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,WAAW;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,+CAA+C;YAC/C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnC,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,WAAW,EAAE,CAAC;gBACvC,uEAAuE;gBACvE,MAAM;YACR,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,UAAU,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAG5C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IAGtC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAqB;IAC5D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/cli/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAiC7B;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAkB;IACvD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAmCD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,QAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,mBAAmB,QAAQ,wCAAwC,QAAQ,KAAK;YAC9E,oDAAoD,CACvD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAoB,EACpB,IAA6B;IAE7B,MAAM,IAAI,GAAG,GAAG,eAAe,EAAE,OAAO,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrD,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,CAAC,WAAW;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,+CAA+C;YAC/C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnC,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,WAAW,EAAE,CAAC;gBACvC,IAAI,IAAI,EAAE,SAAS,KAAK,OAAO,EAAE,CAAC;oBAChC,MAAM,IAAI,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;gBACpE,CAAC;gBACD,uEAAuE;gBACvE,MAAM;YACR,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,UAAU,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,QAAQ;YAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAG5C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IAGtC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAqB;IAC5D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/auth/refreshCli.d.ts

@@ -0,0 +1,59 @@
+import { spawn } from 'node:child_process';
+/**
+ * Spawn helpers for `ugly-app refresh cloudflare`.
+ *
+ * All Cloudflare token refreshes flow through that ONE CLI command, which holds
+ * the cross-process credentials lock for the whole read→refresh→write. Callers
+ * that detect a stale/401'd token never refresh inline — they either:
+ *
+ * - `triggerCloudflareRefresh()` — fire-and-forget a detached refresher and
+ *   proceed best-effort (telemetry queries and other degradable paths). The
+ *   next call picks up the healed credentials.
+ * - `runCloudflareRefreshCli()` — spawn the same command and AWAIT its exit
+ *   (deploy steps and other paths where the token is load-bearing for the
+ *   current operation).
+ */
+export interface RefreshCliRequest {
+    /** Refresh even when the cached `expiresAt` still looks fresh. */
+    force?: boolean | undefined;
+    /**
+     * The access token that just failed. The refresh command no-ops when the
+     * on-disk token no longer matches (another process already rotated it) —
+     * this collapses a concurrent 401 storm into a single refresh.
+     */
+    staleToken?: string | undefined;
+}
+/** Injectable seam so tests can observe spawning without a real child process. */
+export interface RefreshSpawnDeps {
+    spawn?: typeof spawn;
+}
+/**
+ * Debounce window for fire-and-forget triggers: a marker file records the last
+ * spawn, and triggers within the window skip. A 401 storm across N processes
+ * therefore spawns one refresher, not fifty. Nobody deletes the marker — its
+ * mtime IS the debounce state, so a crashed refresher can never wedge it.
+ */
+export declare const REFRESH_SPAWN_DEBOUNCE_MS = 10000;
+/**
+ * The CLI entry to spawn. Resolved relative to THIS module
+ * (`dist/cli/auth/refreshCli.js` → `dist/cli/index.js`), so it works for both
+ * `npx ugly-app` and global installs regardless of how the bin was invoked.
+ */
+export declare function refreshCliEntry(): string;
+/**
+ * Fire-and-forget: spawn `ugly-app refresh cloudflare` detached (survives this
+ * process exiting), with stdio sent to a log next to the credentials file.
+ * Debounced — concurrent triggers within REFRESH_SPAWN_DEBOUNCE_MS collapse to
+ * a single spawn. Best-effort: never throws, returns whether it spawned.
+ */
+export declare function triggerCloudflareRefresh(req?: RefreshCliRequest, deps?: RefreshSpawnDeps): Promise<boolean>;
+/**
+ * Spawn the refresh CLI and await its exit code. For paths where the token is
+ * load-bearing for the current operation (mid-deploy steps, `tail`): the
+ * refresh still flows through the single locked CLI code path, but the caller
+ * blocks until credentials are healed (or the refresh fails). Caller should
+ * re-read credentials after this resolves — a concurrent refresher may have
+ * done the work even if this child exited non-zero.
+ */
+export declare function runCloudflareRefreshCli(req?: RefreshCliRequest, deps?: RefreshSpawnDeps): Promise<number>;
+//# sourceMappingURL=refreshCli.d.ts.map

package/dist/cli/auth/refreshCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshCli.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/refreshCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAK9D;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAUhD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAoCD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,GAAE,iBAAsB,EAC3B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,iBAAsB,EAC3B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAejB"}