@aalexis.dev/cfx 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,162 @@
+# ⚡ cfx (`@aalexis.dev/cfx`)
+
+> **Ultra-lightweight, secure CLI wrapper for managing multiple Cloudflare accounts with Wrangler.**
+>
+> 🔒 Encrypted local storage with `AES-256-GCM` | ⚡ 0 runtime dependencies | 🌐 Cross-platform (Windows, macOS, Linux).
+
+---
+
+## 🚀 Features
+
+- **Multi-Account Switching:** Switch between Cloudflare accounts instantly using `--acc=<name>` or `-a <name>`.
+- **Batch Execution:** Run commands sequentially across all registered accounts with `--all`.
+- **Transparent Wrangler Proxy:** Forwards all arguments, flags, and real-time outputs (`stdio: inherit`) directly to the `wrangler` binary.
+- **Zero Runtime Dependencies:** Built exclusively on Node.js native modules (`node:crypto`, `node:child_process`, `node:readline`, `node:fs`, `node:os`).
+- **Cryptographic Security:** Credentials (`accountId` and `apiToken`) are encrypted locally with `AES-256-GCM` using a 256-bit master key with strict permissions (`0600` / `0700`).
+- **Cross-Platform:** Works seamlessly across Windows (CMD, PowerShell, Windows Terminal), macOS, and Linux.
+
+---
+
+## 🛠️ Global Installation (Recommended)
+
+Install globally once to use the clean and short `cfx` command anywhere in your terminal:
+
+```bash
+# With pnpm
+pnpm add -g @aalexis.dev/cfx
+
+# With npm
+npm install -g @aalexis.dev/cfx
+```
+
+Once installed globally, you can simply run:
+```bash
+cfx --add
+cfx --list
+cfx --acc=production deploy
+```
+
+---
+
+## 📦 Direct Execution (Without Installation)
+
+You can also run `@aalexis.dev/cfx` directly using your preferred package manager:
+
+```bash
+# With pnpm dlx
+pnpm dlx @aalexis.dev/cfx --add
+pnpm dlx @aalexis.dev/cfx --list
+pnpm dlx @aalexis.dev/cfx --acc=production deploy
+
+# With npx
+npx @aalexis.dev/cfx --acc=staging tail
+```
+
+---
+
+## 📖 Command Reference
+
+### 1. Register an Account (`--add`)
+Starts an interactive prompt to enter the account identifier name, **Cloudflare Account ID**, and **Cloudflare API Token** (the token input is securely masked in the terminal):
+
+```bash
+cfx --add
+# or
+cfx add
+```
+
+### 2. List Registered Accounts (`--list`)
+Displays a formatted list of all configured accounts:
+
+```bash
+cfx --list
+# or
+cfx list
+# or
+cfx ls
+```
+
+### 3. Remove an Account (`--remove`)
+Deletes an account from your local encrypted storage:
+
+```bash
+cfx --remove <name>
+# or
+cfx rm <name>
+```
+
+### 4. Run Wrangler on a Specific Account (`--acc` or `-a`)
+Decrypts credentials in memory, injects `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN`, and invokes `wrangler`:
+
+```bash
+# Deploy a Worker
+cfx --acc=production deploy
+
+# Stream real-time logs
+cfx -a staging tail
+
+# Inspect current authenticated user and permissions
+cfx --acc=client1 whoami
+
+# Generate Cloudflare Worker / D1 / KV types
+cfx --acc=prod types
+```
+
+### 5. Run Across All Accounts (`--all`)
+Sequentially executes the specified command on every registered account and presents a summary table:
+
+```bash
+cfx --all deploy
+cfx --all whoami
+```
+
+---
+
+## 🔐 Security & Storage
+
+- **Storage Location:** `~/.cfx/accounts.json`
+- **Master Encryption Key:** `~/.cfx/.key` (generated locally with `crypto.randomBytes(32)` and protected with `0600` permissions on Unix systems).
+- **Algorithm:** `AES-256-GCM` with a unique 16-byte initialization vector (`iv`) and 16-byte authentication tag (`authTag`) per encrypted value.
+- Credentials are never transmitted over the network or stored in plain text.
+
+---
+
+## 💻 Local Development & Publishing
+
+### 1. Clone and Install Dev Dependencies
+```bash
+git clone https://github.com/your-username/cfx.git
+cd cfx
+pnpm install
+```
+
+### 2. Build the Project (TypeScript)
+```bash
+pnpm build
+```
+
+### 3. Run Automated Tests
+```bash
+pnpm test
+```
+
+### 4. Link Locally for Testing
+```bash
+pnpm link --global
+```
+You can now test the `cfx` command directly from any terminal window.
+
+### 5. Publish to the NPM Registry
+```bash
+# 1. Log in to your npm account (if not already authenticated)
+pnpm login
+
+# 2. Publish package with public access
+pnpm publish --access public
+```
+
+---
+
+## 📄 License
+
+MIT © 2026

package/bin/crypto.js

@@ -0,0 +1,68 @@
+import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16; // 128 bits
+const KEY_LENGTH = 32; // 256 bits
+let cachedMasterKey = null;
+/**
+ * Retrieves or creates the master encryption key at the specified path.
+ * Enforces 0600 file permissions on POSIX systems.
+ */
+export function getOrCreateMasterKey(keyFilePath) {
+    if (cachedMasterKey) {
+        return cachedMasterKey;
+    }
+    if (existsSync(keyFilePath)) {
+        const rawKey = readFileSync(keyFilePath);
+        if (rawKey.length === KEY_LENGTH) {
+            cachedMasterKey = rawKey;
+            return cachedMasterKey;
+        }
+    }
+    // Generate new 256-bit key
+    const newKey = randomBytes(KEY_LENGTH);
+    writeFileSync(keyFilePath, newKey, { mode: 0o600 });
+    // Enforce POSIX permissions when not on Windows
+    if (process.platform !== 'win32') {
+        try {
+            chmodSync(keyFilePath, 0o600);
+        }
+        catch {
+            // Ignore permission failures on unsupported filesystems
+        }
+    }
+    cachedMasterKey = newKey;
+    return cachedMasterKey;
+}
+/**
+ * Encrypts a string using AES-256-GCM and the provided master key.
+ */
+export function encrypt(text, masterKey) {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, masterKey, iv);
+    const encryptedBuffer = Buffer.concat([
+        cipher.update(text, 'utf8'),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    return {
+        iv: iv.toString('hex'),
+        authTag: authTag.toString('hex'),
+        data: encryptedBuffer.toString('hex'),
+    };
+}
+/**
+ * Decrypts an encrypted payload using AES-256-GCM and the master key.
+ */
+export function decrypt(payload, masterKey) {
+    const iv = Buffer.from(payload.iv, 'hex');
+    const authTag = Buffer.from(payload.authTag, 'hex');
+    const encryptedData = Buffer.from(payload.data, 'hex');
+    const decipher = createDecipheriv(ALGORITHM, masterKey, iv);
+    decipher.setAuthTag(authTag);
+    const decryptedBuffer = Buffer.concat([
+        decipher.update(encryptedData),
+        decipher.final(),
+    ]);
+    return decryptedBuffer.toString('utf8');
+}

package/bin/index.js

@@ -0,0 +1,252 @@
+#!/usr/bin/env node
+import { argv, exit } from 'node:process';
+import { saveAccount, getStoredAccounts, removeAccount, getDecryptedAccount, getAllDecryptedAccounts, } from './storage.js';
+import { runWrangler } from './runner.js';
+import { askQuestion, askSecret } from './prompt.js';
+import { colors, log, printBanner, printHelp } from './utils.js';
+const VERSION = '1.0.2';
+/**
+ * Parses command-line arguments natively
+ */
+function parseCliArgs(rawArgs) {
+    const args = rawArgs.slice(2);
+    if (args.length === 0) {
+        return { action: 'help', wranglerArgs: [] };
+    }
+    const firstArg = args[0];
+    // Help & version commands
+    if (args.includes('--help') || args.includes('-h') || firstArg === 'help') {
+        return { action: 'help', wranglerArgs: [] };
+    }
+    if (args.includes('--version') || args.includes('-v') || firstArg === 'version') {
+        return { action: 'version', wranglerArgs: [] };
+    }
+    // Action: Add account
+    if (args.includes('--add') || firstArg === 'add') {
+        return { action: 'add', wranglerArgs: [] };
+    }
+    // Action: List accounts
+    if (args.includes('--list') || firstArg === 'list' || firstArg === 'ls') {
+        return { action: 'list', wranglerArgs: [] };
+    }
+    // Action: Remove account
+    if (firstArg === 'remove' || firstArg === 'rm') {
+        return { action: 'remove', removeTarget: args[1], wranglerArgs: [] };
+    }
+    const removeFlagIndex = args.findIndex((arg) => arg.startsWith('--remove'));
+    if (removeFlagIndex !== -1) {
+        const flag = args[removeFlagIndex];
+        if (flag.includes('=')) {
+            return { action: 'remove', removeTarget: flag.split('=')[1], wranglerArgs: [] };
+        }
+        return { action: 'remove', removeTarget: args[removeFlagIndex + 1], wranglerArgs: [] };
+    }
+    // Action: Execute across all accounts (--all)
+    if (args.includes('--all')) {
+        const remaining = args.filter((a) => a !== '--all');
+        return { action: 'exec-all', wranglerArgs: remaining };
+    }
+    // Action: Execute on specific account (--acc=<name> or -a <name>)
+    let accountName;
+    const filteredWranglerArgs = [];
+    for (let i = 0; i < args.length; i++) {
+        const current = args[i];
+        if (current.startsWith('--acc=')) {
+            accountName = current.slice('--acc='.length);
+        }
+        else if (current === '--acc') {
+            accountName = args[++i];
+        }
+        else if (current.startsWith('-a=')) {
+            accountName = current.slice('-a='.length);
+        }
+        else if (current === '-a') {
+            accountName = args[++i];
+        }
+        else {
+            filteredWranglerArgs.push(current);
+        }
+    }
+    if (accountName) {
+        return {
+            action: 'exec-single',
+            accountName,
+            wranglerArgs: filteredWranglerArgs,
+        };
+    }
+    // If no known flags were specified, show unknown action / help
+    return { action: 'unknown', wranglerArgs: args };
+}
+/**
+ * Interactive prompt to register a new Cloudflare account
+ */
+async function handleAddAccount() {
+    printBanner();
+    console.log(`${colors.bold}Register new Cloudflare account:${colors.reset}\n`);
+    const name = await askQuestion(`${colors.cyan}?${colors.reset} Account identifier name (e.g. personal, prod, client1): `);
+    if (!name) {
+        log.error('Account name cannot be empty.');
+        exit(1);
+    }
+    const accountId = await askQuestion(`${colors.cyan}?${colors.reset} Cloudflare Account ID: `);
+    if (!accountId) {
+        log.error('Account ID cannot be empty.');
+        exit(1);
+    }
+    const apiToken = await askSecret(`${colors.cyan}?${colors.reset} Cloudflare API Token (hidden): `);
+    if (!apiToken) {
+        log.error('API Token cannot be empty.');
+        exit(1);
+    }
+    try {
+        saveAccount(name, accountId, apiToken);
+        console.log();
+        log.success(`Account ${colors.bold}"${name}"${colors.reset} saved and encrypted successfully in ~/.cfx/accounts.json`);
+        console.log(`\n${colors.gray}You can now use it with:${colors.reset} ${colors.cyan}cfx --acc=${name} <command>${colors.reset}\n`);
+    }
+    catch (err) {
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        log.error(`Failed to save account: ${errorMsg}`);
+        exit(1);
+    }
+}
+/**
+ * Lists all stored accounts
+ */
+function handleListAccounts() {
+    printBanner();
+    const accounts = getStoredAccounts();
+    if (accounts.length === 0) {
+        log.info('No Cloudflare accounts registered.');
+        console.log(`\nRegister your first account by running: ${colors.cyan}pnpm dlx @aalexis.dev/cfx --add${colors.reset}\n`);
+        return;
+    }
+    console.log(`${colors.bold}Registered accounts (${accounts.length}):${colors.reset}\n`);
+    console.log(`  ${colors.bold}${'NAME'.padEnd(20)} ${'CREATED AT'.padEnd(25)} STATUS${colors.reset}`);
+    console.log(`  ${colors.gray}${'─'.repeat(55)}${colors.reset}`);
+    for (const acc of accounts) {
+        const date = acc.createdAt ? new Date(acc.createdAt).toLocaleString() : 'N/A';
+        console.log(`  ${colors.cyan}${acc.name.padEnd(20)}${colors.reset} ${colors.gray}${date.padEnd(25)}${colors.reset} ${colors.green}🔒 Encrypted${colors.reset}`);
+    }
+    console.log(`\n${colors.gray}Usage:${colors.reset} ${colors.cyan}cfx --acc=<name> [wrangler command]${colors.reset}\n`);
+}
+/**
+ * Removes a stored account
+ */
+function handleRemoveAccount(targetName) {
+    if (!targetName) {
+        log.error('You must specify the name of the account to remove.');
+        console.log(`Example: ${colors.cyan}cfx --remove my-account${colors.reset}`);
+        exit(1);
+    }
+    const removed = removeAccount(targetName);
+    if (removed) {
+        log.success(`Account ${colors.bold}"${targetName}"${colors.reset} removed successfully.`);
+    }
+    else {
+        log.error(`No account found with the name "${targetName}".`);
+        const accounts = getStoredAccounts();
+        if (accounts.length > 0) {
+            console.log(`Available accounts: ${accounts.map((a) => colors.cyan + a.name + colors.reset).join(', ')}`);
+        }
+        exit(1);
+    }
+}
+/**
+ * Executes wrangler command for a single account
+ */
+async function handleSingleAccountExec(accountName, wranglerArgs) {
+    const account = getDecryptedAccount(accountName);
+    if (!account) {
+        log.error(`Account ${colors.bold}"${accountName}"${colors.reset} was not found.`);
+        const accounts = getStoredAccounts();
+        if (accounts.length > 0) {
+            console.log(`\nRegistered accounts: ${accounts.map((a) => colors.cyan + a.name + colors.reset).join(', ')}`);
+        }
+        else {
+            console.log(`\nNo accounts registered yet. Add one with: ${colors.cyan}cfx --add${colors.reset}`);
+        }
+        exit(1);
+    }
+    const exitCode = await runWrangler({ account, args: wranglerArgs });
+    exit(exitCode);
+}
+/**
+ * Executes wrangler command sequentially across all registered accounts
+ */
+async function handleAllAccountsExec(wranglerArgs) {
+    const accounts = getAllDecryptedAccounts();
+    if (accounts.length === 0) {
+        log.error('No accounts registered to execute command.');
+        console.log(`Add an account with: ${colors.cyan}cfx --add${colors.reset}`);
+        exit(1);
+    }
+    printBanner();
+    console.log(`${colors.bold}Executing command across ${accounts.length} account(s):${colors.reset} ${colors.gray}wrangler ${wranglerArgs.join(' ')}${colors.reset}\n`);
+    const results = [];
+    for (let i = 0; i < accounts.length; i++) {
+        const acc = accounts[i];
+        const stepLabel = `${i + 1}/${accounts.length}`;
+        console.log(`\n${colors.bold}${colors.orange}──────────────────────────────────────────────────${colors.reset}`);
+        log.step(stepLabel, `Account: ${colors.bold}${colors.cyan}${acc.name}${colors.reset}`);
+        console.log(`${colors.bold}${colors.orange}──────────────────────────────────────────────────${colors.reset}\n`);
+        const code = await runWrangler({ account: acc, args: wranglerArgs });
+        results.push({ name: acc.name, success: code === 0, code });
+    }
+    // Summary
+    console.log(`\n${colors.bold}═══════════════════ SUMMARY ═══════════════════${colors.reset}`);
+    let hasFailures = false;
+    for (const res of results) {
+        if (res.success) {
+            console.log(`  ${colors.green}✔${colors.reset} ${res.name.padEnd(20)} ${colors.green}Completed successfully${colors.reset}`);
+        }
+        else {
+            hasFailures = true;
+            console.log(`  ${colors.red}✖${colors.reset} ${res.name.padEnd(20)} ${colors.red}Failed (code ${res.code})${colors.reset}`);
+        }
+    }
+    console.log(`${colors.bold}═══════════════════════════════════════════════${colors.reset}\n`);
+    if (hasFailures) {
+        exit(1);
+    }
+}
+/**
+ * Main CLI entry point
+ */
+async function main() {
+    const parsed = parseCliArgs(argv);
+    switch (parsed.action) {
+        case 'help':
+            printHelp();
+            break;
+        case 'version':
+            console.log(`cfx v${VERSION}`);
+            break;
+        case 'add':
+            await handleAddAccount();
+            break;
+        case 'list':
+            handleListAccounts();
+            break;
+        case 'remove':
+            handleRemoveAccount(parsed.removeTarget);
+            break;
+        case 'exec-single':
+            if (parsed.accountName) {
+                await handleSingleAccountExec(parsed.accountName, parsed.wranglerArgs);
+            }
+            break;
+        case 'exec-all':
+            await handleAllAccountsExec(parsed.wranglerArgs);
+            break;
+        case 'unknown':
+        default:
+            log.warn(`No recognized account flag or command specified.`);
+            printHelp();
+            exit(1);
+    }
+}
+main().catch((err) => {
+    log.error(`Unexpected error: ${err.message}`);
+    exit(1);
+});

package/bin/prompt.js

@@ -0,0 +1,73 @@
+import { createInterface } from 'node:readline';
+import { stdin as input, stdout as output } from 'node:process';
+import { colors } from './utils.js';
+/**
+ * Prompts for standard text input
+ */
+export function askQuestion(query) {
+    const rl = createInterface({ input, output });
+    return new Promise((resolve) => {
+        rl.question(query, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+/**
+ * Prompts for sensitive input (masks input if TTY is available)
+ */
+export function askSecret(query) {
+    return new Promise((resolve) => {
+        if (!input.isTTY) {
+            // Fallback for non-TTY / CI environments or pipes
+            const rl = createInterface({ input, output });
+            rl.question(query, (answer) => {
+                rl.close();
+                resolve(answer.trim());
+            });
+            return;
+        }
+        output.write(query);
+        let buffer = '';
+        const onData = (chunk) => {
+            const str = chunk.toString();
+            for (let i = 0; i < str.length; i++) {
+                const char = str[i];
+                const code = char.charCodeAt(0);
+                // Enter (\r or \n)
+                if (code === 13 || code === 10) {
+                    cleanup();
+                    output.write('\n');
+                    resolve(buffer.trim());
+                    return;
+                }
+                // Ctrl+C (interruption)
+                if (code === 3) {
+                    cleanup();
+                    output.write('\n');
+                    process.exit(130);
+                }
+                // Backspace (127 or 8)
+                if (code === 127 || code === 8) {
+                    if (buffer.length > 0) {
+                        buffer = buffer.slice(0, -1);
+                        output.write('\b \b');
+                    }
+                }
+                else if (code >= 32) {
+                    // Visible character -> mask with dot
+                    buffer += char;
+                    output.write(`${colors.gray}•${colors.reset}`);
+                }
+            }
+        };
+        const cleanup = () => {
+            input.removeListener('data', onData);
+            input.setRawMode(false);
+            input.pause();
+        };
+        input.setRawMode(true);
+        input.resume();
+        input.on('data', onData);
+    });
+}

package/bin/runner.js

@@ -0,0 +1,75 @@
+import { spawn } from 'node:child_process';
+import { join, dirname, delimiter } from 'node:path';
+import { colors, log } from './utils.js';
+/**
+ * Builds an augmented PATH that includes local and parent monorepo node_modules/.bin directories.
+ * This allows cfx to detect locally installed wrangler instances seamlessly.
+ */
+function getAugmentedPath() {
+    const binDirs = [];
+    let current = process.cwd();
+    while (true) {
+        binDirs.push(join(current, 'node_modules', '.bin'));
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    const existingPath = process.env.PATH || '';
+    return [...binDirs, existingPath].filter(Boolean).join(delimiter);
+}
+/**
+ * Runs wrangler by injecting account credentials via environment variables.
+ * Transparently supports Windows, macOS, and Linux, detecting both local and global wrangler installations.
+ */
+export function runWrangler({ account, args }) {
+    return new Promise((resolve) => {
+        const isWindows = process.platform === 'win32';
+        const env = {
+            ...process.env,
+            PATH: getAugmentedPath(),
+            CLOUDFLARE_ACCOUNT_ID: account.accountId,
+            CLOUDFLARE_API_TOKEN: account.apiToken,
+        };
+        // Main command
+        const command = 'wrangler';
+        // On Windows, use shell: true to resolve .cmd / .ps1 shims automatically
+        const child = spawn(command, args, {
+            stdio: 'inherit',
+            shell: isWindows,
+            env,
+        });
+        // Forward termination signals to child process
+        const sigintHandler = () => {
+            if (child.pid && !isWindows) {
+                child.kill('SIGINT');
+            }
+        };
+        const sigtermHandler = () => {
+            if (child.pid && !isWindows) {
+                child.kill('SIGTERM');
+            }
+        };
+        process.on('SIGINT', sigintHandler);
+        process.on('SIGTERM', sigtermHandler);
+        child.on('error', (err) => {
+            process.off('SIGINT', sigintHandler);
+            process.off('SIGTERM', sigtermHandler);
+            if (err.code === 'ENOENT') {
+                log.error(`Command ${colors.bold}'wrangler'${colors.reset} was not found in your project or global environment.\n` +
+                    `  You can install it in this project with: ${colors.cyan}pnpm add -D wrangler${colors.reset}\n` +
+                    `  Or install it globally with: ${colors.cyan}pnpm add -g wrangler${colors.reset}`);
+                resolve(1);
+            }
+            else {
+                log.error(`Failed to execute wrangler: ${err.message}`);
+                resolve(1);
+            }
+        });
+        child.on('close', (code) => {
+            process.off('SIGINT', sigintHandler);
+            process.off('SIGTERM', sigtermHandler);
+            resolve(code ?? 0);
+        });
+    });
+}

package/bin/storage.js

@@ -0,0 +1,159 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { getOrCreateMasterKey, encrypt, decrypt } from './crypto.js';
+export const CFX_DIR = join(homedir(), '.cfx');
+export const ACCOUNTS_FILE = join(CFX_DIR, 'accounts.json');
+export const KEY_FILE = join(CFX_DIR, '.key');
+/**
+ * Initializes the ~/.cfx configuration directory securely
+ */
+export function ensureConfigDirectory() {
+    if (!existsSync(CFX_DIR)) {
+        mkdirSync(CFX_DIR, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32') {
+            try {
+                chmodSync(CFX_DIR, 0o700);
+            }
+            catch {
+                // Ignore errors if the platform does not support chmod permissions
+            }
+        }
+    }
+}
+/**
+ * Retrieves the local master encryption key
+ */
+function getMasterKey() {
+    ensureConfigDirectory();
+    return getOrCreateMasterKey(KEY_FILE);
+}
+/**
+ * Reads the accounts.json file from ~/.cfx/
+ */
+export function getStoredAccounts() {
+    ensureConfigDirectory();
+    if (!existsSync(ACCOUNTS_FILE)) {
+        return [];
+    }
+    try {
+        const raw = readFileSync(ACCOUNTS_FILE, 'utf8');
+        if (!raw.trim()) {
+            return [];
+        }
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+            return parsed;
+        }
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Saves accounts array into accounts.json
+ */
+function saveStoredAccounts(accounts) {
+    ensureConfigDirectory();
+    writeFileSync(ACCOUNTS_FILE, JSON.stringify(accounts, null, 2), {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    if (process.platform !== 'win32') {
+        try {
+            chmodSync(ACCOUNTS_FILE, 0o600);
+        }
+        catch {
+            // Ignore permission errors on unsupported filesystems
+        }
+    }
+}
+/**
+ * Adds or updates an encrypted account
+ */
+export function saveAccount(name, accountId, apiToken) {
+    const masterKey = getMasterKey();
+    const accounts = getStoredAccounts();
+    const encryptedAccountId = encrypt(accountId.trim(), masterKey);
+    const encryptedApiToken = encrypt(apiToken.trim(), masterKey);
+    const existingIndex = accounts.findIndex((acc) => acc.name.toLowerCase() === name.trim().toLowerCase());
+    const now = new Date().toISOString();
+    if (existingIndex >= 0) {
+        accounts[existingIndex] = {
+            ...accounts[existingIndex],
+            name: name.trim(),
+            accountId: encryptedAccountId,
+            apiToken: encryptedApiToken,
+            updatedAt: now,
+        };
+    }
+    else {
+        accounts.push({
+            name: name.trim(),
+            accountId: encryptedAccountId,
+            apiToken: encryptedApiToken,
+            createdAt: now,
+        });
+    }
+    saveStoredAccounts(accounts);
+}
+/**
+ * Removes an account by name
+ */
+export function removeAccount(name) {
+    const accounts = getStoredAccounts();
+    const targetName = name.trim().toLowerCase();
+    const filtered = accounts.filter((acc) => acc.name.toLowerCase() !== targetName);
+    if (filtered.length === accounts.length) {
+        return false;
+    }
+    saveStoredAccounts(filtered);
+    return true;
+}
+/**
+ * Retrieves and decrypts a specific account by name
+ */
+export function getDecryptedAccount(name) {
+    const accounts = getStoredAccounts();
+    const targetName = name.trim().toLowerCase();
+    const found = accounts.find((acc) => acc.name.toLowerCase() === targetName);
+    if (!found) {
+        return null;
+    }
+    try {
+        const masterKey = getMasterKey();
+        const accountId = decrypt(found.accountId, masterKey);
+        const apiToken = decrypt(found.apiToken, masterKey);
+        return {
+            name: found.name,
+            accountId,
+            apiToken,
+        };
+    }
+    catch {
+        throw new Error(`Could not decrypt credentials for account "${found.name}". Check integrity of ~/.cfx/.key`);
+    }
+}
+/**
+ * Retrieves and decrypts all registered accounts
+ */
+export function getAllDecryptedAccounts() {
+    const accounts = getStoredAccounts();
+    if (accounts.length === 0) {
+        return [];
+    }
+    const masterKey = getMasterKey();
+    return accounts.map((acc) => {
+        try {
+            return {
+                name: acc.name,
+                accountId: decrypt(acc.accountId, masterKey),
+                apiToken: decrypt(acc.apiToken, masterKey),
+            };
+        }
+        catch {
+            throw new Error(`Failed to decrypt account "${acc.name}". Check ~/.cfx/.key`);
+        }
+    });
+}

package/bin/types.js

@@ -0,0 +1 @@
+export {};

package/bin/utils.js

@@ -0,0 +1,69 @@
+import { env, stdout } from 'node:process';
+const isColorSupported = !env.NO_COLOR && (stdout.isTTY || env.FORCE_COLOR !== undefined);
+export const colors = {
+    reset: isColorSupported ? '\x1b[0m' : '',
+    bold: isColorSupported ? '\x1b[1m' : '',
+    dim: isColorSupported ? '\x1b[2m' : '',
+    italic: isColorSupported ? '\x1b[3m' : '',
+    underline: isColorSupported ? '\x1b[4m' : '',
+    // Colors
+    cyan: isColorSupported ? '\x1b[36m' : '',
+    green: isColorSupported ? '\x1b[32m' : '',
+    yellow: isColorSupported ? '\x1b[33m' : '',
+    red: isColorSupported ? '\x1b[31m' : '',
+    blue: isColorSupported ? '\x1b[34m' : '',
+    magenta: isColorSupported ? '\x1b[35m' : '',
+    gray: isColorSupported ? '\x1b[90m' : '',
+    orange: isColorSupported ? '\x1b[38;5;208m' : '',
+};
+export const log = {
+    info: (msg) => console.log(`${colors.cyan}ℹ${colors.reset} ${msg}`),
+    success: (msg) => console.log(`${colors.green}✔${colors.reset} ${msg}`),
+    warn: (msg) => console.warn(`${colors.yellow}⚠${colors.reset} ${msg}`),
+    error: (msg) => console.error(`${colors.red}✖${colors.reset} ${msg}`),
+    step: (step, msg) => console.log(`${colors.bold}${colors.orange}[${step}]${colors.reset} ${msg}`),
+};
+export function printBanner() {
+    console.log(`${colors.bold}${colors.orange}⚡ cfx${colors.reset} ${colors.gray}- Multi-account Cloudflare Wrangler Proxy${colors.reset}\n`);
+}
+export function printHelp() {
+    console.log(`
+${colors.bold}${colors.orange}⚡ cfx${colors.reset} ${colors.gray}- Ultra-lightweight Cloudflare Multi-Account Wrangler CLI${colors.reset}
+
+${colors.bold}USAGE:${colors.reset}
+  ${colors.cyan}cfx${colors.reset} [cfx options] [wrangler commands/args...]
+
+${colors.bold}ACCOUNT MANAGEMENT:${colors.reset}
+  ${colors.cyan}--add${colors.reset}, ${colors.cyan}add${colors.reset}                 Register a new account interactively
+  ${colors.cyan}--list${colors.reset}, ${colors.cyan}list${colors.reset}, ${colors.cyan}ls${colors.reset}           List all registered accounts
+  ${colors.cyan}--remove${colors.reset} <name>, ${colors.cyan}rm${colors.reset} <name>   Remove a registered account
+
+${colors.bold}WRANGLER EXECUTION:${colors.reset}
+  ${colors.cyan}--acc=<name>${colors.reset} <args...>      Run wrangler using account credentials
+  ${colors.cyan}-a <name>${colors.reset} <args...>          Short alias for --acc=<name>
+  ${colors.cyan}--all${colors.reset} <args...>               Run wrangler sequentially across ALL registered accounts
+
+${colors.bold}GENERAL:${colors.reset}
+  ${colors.cyan}--help${colors.reset}, ${colors.cyan}-h${colors.reset}                  Show this help message
+  ${colors.cyan}--version${colors.reset}, ${colors.cyan}-v${colors.reset}               Show cfx version
+
+${colors.bold}EXAMPLES:${colors.reset}
+  ${colors.gray}# Register an account${colors.reset}
+  $ ${colors.cyan}pnpm dlx @aalexis.dev/cfx --add${colors.reset}
+
+  ${colors.gray}# List configured accounts${colors.reset}
+  $ ${colors.cyan}pnpm dlx @aalexis.dev/cfx --list${colors.reset}
+
+  ${colors.gray}# Deploy a Worker to a specific account${colors.reset}
+  $ ${colors.cyan}pnpm dlx @aalexis.dev/cfx --acc=production deploy${colors.reset}
+
+  ${colors.gray}# Stream real-time logs${colors.reset}
+  $ ${colors.cyan}pnpm dlx @aalexis.dev/cfx -a staging tail${colors.reset}
+
+  ${colors.gray}# Deploy across all configured accounts${colors.reset}
+  $ ${colors.cyan}pnpm dlx @aalexis.dev/cfx --all deploy${colors.reset}
+
+  ${colors.gray}# Check current account information (whoami)${colors.reset}
+  $ ${colors.cyan}pnpm dlx @aalexis.dev/cfx --acc=client1 whoami${colors.reset}
+`);
+}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@aalexis.dev/cfx",
+  "version": "1.0.2",
+  "description": "Ultra-lightweight multi-account Cloudflare Wrangler wrapper CLI with encrypted local storage",
+  "type": "module",
+  "main": "./bin/index.js",
+  "bin": {
+    "cfx": "./bin/index.js",
+    "cfpipe": "./bin/index.js"
+  },
+  "files": [
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "cloudflare",
+    "wrangler",
+    "cli",
+    "multi-account",
+    "cfx",
+    "cfpipe",
+    "security",
+    "encryption",
+    "pnpm"
+  ],
+  "author": "Alexis",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.0"
+  },
+  "scripts": {
+    "build": "tsc && node scripts/make-executable.js",
+    "dev": "tsc --watch",
+    "test": "tsc -p tsconfig.test.json && node dist-test/tests/test-flow.js && node scripts/cleanup-test.js"
+  }
+}