Routes reachable without diagnostics and without a credential.
/firstrun is trust-on-first-use: it mints the owner token that /export takes, so gating it on
diagnostics would force exposing /sql, /restore and /php just to obtain the token. The
claim window is the unprovisioned state only; once first_run_at is set the object answers 409
and ?force=1 needs the owner token or diagnostics (enforced in the object).
/setup/cf/callback and /oidc arrive as provider redirects carrying no header drupflare
controls; state authenticates them (constant-time match against the pending record).
/recover-token is for a caller who has lost the owner token: a nonce whose hash the account's
CONFIG_KV holds is the credential, and it shares the owner check's failure budget.
/csp-report takes a browser's violation report, which carries no credential; the Worker
answers it with a per-address budget and never addresses the object.
Routes reachable without diagnostics and without a credential.
/firstrunis trust-on-first-use: it mints the owner token that/exporttakes, so gating it on diagnostics would force exposing/sql,/restoreand/phpjust to obtain the token. The claim window is the unprovisioned state only; oncefirst_run_atis set the object answers 409 and?force=1needs the owner token or diagnostics (enforced in the object)./setup/cf/callbackand/oidcarrive as provider redirects carrying no header drupflare controls;stateauthenticates them (constant-time match against the pending record)./recover-tokenis for a caller who has lost the owner token: a nonce whose hash the account'sCONFIG_KVholds is the credential, and it shares the owner check's failure budget./csp-reporttakes a browser's violation report, which carries no credential; the Worker answers it with a per-address budget and never addresses the object.