@vigilbase/cli
Version:
Vigilbase CLI — security scanners, agent tools, and Vigilbase One from the terminal.
32 lines (31 loc) • 1.97 kB
TypeScript
/**
* The environment every cf child process receives (spec §F3).
*
* This is the only source file that names the Cloudflare API token variable;
* everything else imports `CF_TOKEN_ENV` (enforced by the grep guard test).
* The child environment is built from an empty object: a fixed allowlist is
* copied by name without inspecting values, then fixed values are forced.
* Base-URL overrides (`CLOUDFLARE_API_BASE_URL`, `CF_API_BASE_URL`), other
* Cloudflare/Wrangler credentials, `VIGILBASE_*`, `NODE_OPTIONS`, `DEBUG`,
* npm config and agent-harness markers are therefore absent by construction.
* Scrubbing the base-URL variables is the primary control against redirecting
* the token; the dry-run preflight cannot detect it.
*/
export declare const CF_TOKEN_ENV = "CLOUDFLARE_API_TOKEN";
export declare const CF_ACCOUNT_ENV = "CLOUDFLARE_ACCOUNT_ID";
export type CfAuthMode = 'profile' | 'env' | 'default';
/** `api`: authenticated reads; `offline`: --version and --dry-run; `login`: interactive `cf auth create` / `cf auth delete`. */
export type ChildEnvPurpose = 'api' | 'offline' | 'login';
/** Presence only: the value is never read, printed or validated by the Vigilbase CLI. */
export declare function hasEnvToken(parent: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
export declare function buildChildEnv(parent: NodeJS.ProcessEnv, options: {
purpose: ChildEnvPurpose;
authMode: CfAuthMode;
accountId?: string;
platform?: NodeJS.Platform;
}): Record<string, string>;
/** Variable names (never values) a cf child would receive, for `--dry-run` output. */
export declare function childEnvVariableNames(parent: NodeJS.ProcessEnv, authMode: CfAuthMode, platform?: NodeJS.Platform): string[];
/** Shown in profile and default modes when the token variable is set in the parent shell. */
export declare function strippedTokenNotice(authMode: CfAuthMode): string;
export declare function missingEnvTokenMessage(): string;