flarelink-verify

Prove that the Flarelink auth Worker running in your Cloudflare account is the exact published, source-available bundle — byte-for-byte — using only your own Cloudflare API token.

CF_API_TOKEN=<token> CF_ACCOUNT_ID=<account-id> \
  npx @flarelink/verify --url https://your-auth-worker.workers.dev

Worker      : your-auth-worker (your-auth-worker.subdomain.workers.dev)
Version     : v0.3.0
Module size : 840820 bytes
Deployed    : 06c3ded7f856061c3c70ba6ea7a7bd87d3a8f3593075cee079df0a7f089ed6c9
Published   : 06c3ded7f856061c3c70ba6ea7a7bd87d3a8f3593075cee079df0a7f089ed6c9

PASS — the bundle running in your account is the published v0.3.0 bundle.

Why

Flarelink deploys a source-available auth Worker onto your own Cloudflare account and walks away. The dashboard/orchestrator that does the deploying is closed source — but it doesn't need to be trusted, because everything it produces in your account is verifiable. This tool closes the last gap: it proves the bytes Cloudflare is actually running for your users match the published auth-module source.

The chain:

1. The published bundle is reproducible from source. Clone flarelink-dev/auth-module at the version tag, run npm ci && npm run build, and you get the exact bytes listed in its HASHES.md.
2. The deployed bundle matches the published bundle. That's what this tool checks — it downloads the live Worker from your account and hashes it.

Together: deployed bytes → published hash → public source you can read and rebuild. No need to trust the closed dashboard.

How it works

1. Reads your Worker's version from GET <url>/__flarelink.
2. Downloads the live Worker script via the Cloudflare Workers Scripts API (module Workers return multipart/form-data; it extracts the module).
3. Fetches the published SHA-256 for that version from auth-module's HASHES.md.
4. Hashes the deployed module and compares.

It makes no network calls beyond your Worker, the Cloudflare API, and raw.githubusercontent.com. No telemetry. Zero dependencies.

Usage

flarelink-verify --url <your-auth-worker-url> [--script <name>] [--account <id>]

| | | |---|---| | CF_API_TOKEN (env, required) | A Cloudflare token with Workers Scripts: Read on the account. Passed only via env so it can't leak into shell history. | | CF_ACCOUNT_ID (env, or --account) | Your 32-hex Cloudflare account id. | | --url | Your auth Worker's URL. Also accepted as a positional argument. | | --script | Worker script name. Only needed for custom domains; for *.workers.dev it's derived from the URL. |

Exit codes

| Code | Meaning | |------|---------| | 0 | PASS — deployed bytes match the published bundle. | | 1 | MISMATCH — deployed bytes differ. Modified, different build, or tampered. | | 2 | Usage or I/O error (missing token, network, download failed). | | 3 | No published hash for the deployed version (e.g. you run a modified fork — rebuild and diff yourself). |

Non-zero on mismatch, so you can run it in CI.

License

MIT. The auth Worker it verifies is source-available under FSL-1.1-MIT (it converts to MIT two years after each release); this CLI and the Flarelink SDK are MIT.