@forgezero/agent 0.1.34 → 0.1.36

package/dist/cloudflare-edge.d.ts

@@ -0,0 +1,265 @@
+export interface CloudflareEdgeConfig {
+    accountId: string;
+    zoneId: string;
+    tunnelId: string;
+    hostname: string;
+    service: string;
+    apiToken: string;
+    /** Optional least-privilege overrides. `apiToken` remains the single-token path. */
+    tunnelApiToken?: string;
+    dnsApiToken?: string;
+}
+export interface CloudflarePrivateRouteConfig {
+    accountId: string;
+    tunnelId: string;
+    network: string;
+    virtualNetworkId?: string;
+    comment: string;
+    apiToken: string;
+}
+export interface CloudflarePrivateRoute {
+    id: string;
+    network: string;
+    tunnel_id: string;
+    virtual_network_id?: string;
+    comment?: string;
+    deleted_at?: string | null;
+}
+/**
+ * Idempotently advertise a private CIDR through a Tunnel.
+ *
+ * This is Cloudflare One routing only: it creates no DNS record and therefore
+ * cannot accidentally turn a database address into a public hostname.
+ */
+export declare function ensureCloudflarePrivateRoute(config: CloudflarePrivateRouteConfig, fetcher?: typeof fetch): Promise<{
+    route: CloudflarePrivateRoute;
+    created: boolean;
+}>;
+/**
+ * Advertise exactly one database member, never its surrounding subnet. The
+ * caller still selects a VNET when private ranges overlap between sites.
+ */
+export declare function ensureCloudflarePrivateDatabaseRoute(config: Omit<CloudflarePrivateRouteConfig, 'network'> & {
+    privateAddress: string;
+}, fetcher?: typeof fetch): Promise<{
+    route: CloudflarePrivateRoute;
+    created: boolean;
+}>;
+/**
+ * Remove one private route only while it is still owned by the expected
+ * Tunnel/VNET. Migration cleanup must never delete a route that another
+ * controller has deliberately reassigned since this operation was planned.
+ */
+export declare function removeCloudflarePrivateRoute(config: Pick<CloudflarePrivateRouteConfig, 'accountId' | 'tunnelId' | 'network' | 'virtualNetworkId' | 'apiToken'>, fetcher?: typeof fetch): Promise<{
+    removed: boolean;
+    route?: CloudflarePrivateRoute;
+}>;
+export declare function removeCloudflarePrivateDatabaseRoute(config: Omit<CloudflarePrivateRouteConfig, 'network' | 'comment'> & {
+    privateAddress: string;
+}, fetcher?: typeof fetch): Promise<{
+    removed: boolean;
+    route?: CloudflarePrivateRoute;
+}>;
+export interface CloudflareWarpIncludeConfig {
+    accountId: string;
+    /** Omit only when the account default device profile is intentionally dedicated to ForgeZero computes. */
+    policyId?: string;
+    privateAddress: string;
+    description: string;
+    apiToken: string;
+}
+interface CloudflareSplitTunnelEntry {
+    address?: string;
+    host?: string;
+    description?: string;
+}
+/** Preserve the profile's existing entries while including one exact database host route. */
+export declare function ensureCloudflareWarpDatabaseInclude(config: CloudflareWarpIncludeConfig, fetcher?: typeof fetch): Promise<{
+    entries: readonly CloudflareSplitTunnelEntry[];
+    created: boolean;
+}>;
+/** Remove only one exact host include and preserve the rest of the profile. */
+export declare function removeCloudflareWarpDatabaseInclude(config: Omit<CloudflareWarpIncludeConfig, 'description'>, fetcher?: typeof fetch): Promise<{
+    entries: readonly CloudflareSplitTunnelEntry[];
+    removed: boolean;
+}>;
+/** Reconcile one remotely-managed tunnel route and its proxied DNS record. */
+export declare function configureCloudflareEdge(config: CloudflareEdgeConfig, fetcher?: typeof fetch): Promise<void>;
+export interface CloudflareApiTokens {
+    /** One scoped token may perform every operation. */
+    apiToken?: string;
+    /** Or split tokens may constrain each operation independently. */
+    tunnelApiToken?: string;
+    dnsApiToken?: string;
+    kvApiToken?: string;
+    accessApiToken?: string;
+    workerApiToken?: string;
+}
+export interface CloudflareKvNamespace {
+    id: string;
+    title: string;
+}
+export interface CloudflareAccessServiceToken {
+    id: string;
+    name: string;
+    client_id: string;
+    client_secret?: string;
+    duration?: string;
+}
+export interface CloudflareAccessCredentials {
+    tokenId: string;
+    clientId: string;
+    clientSecret: string;
+}
+export interface CloudflareAccountRuntimeToken {
+    id: string;
+    value: string;
+    name: string;
+    permissionNames: string[];
+}
+/**
+ * Create one account-owned API token from exact, dynamically resolved account
+ * permission groups. The value is returned once for immediate 0600 checkpoint.
+ */
+export declare function createCloudflareAccountRuntimeToken(config: {
+    accountId: string;
+    name: string;
+    permissionNames: readonly string[];
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<CloudflareAccountRuntimeToken>;
+/**
+ * Create the Worker's Access service token, or prove the caller supplied the
+ * sealed secret for the existing token. Cloudflare intentionally returns the
+ * client secret only once, so silently "reusing" an existing row without its
+ * secret would configure a Worker that can never authenticate.
+ */
+export declare function ensureCloudflareAccessServiceToken(config: {
+    accountId: string;
+    name: string;
+    duration?: string;
+    apiToken: string;
+    existing?: CloudflareAccessCredentials;
+}, fetcher?: typeof fetch): Promise<{
+    credentials: CloudflareAccessCredentials;
+    created: boolean;
+}>;
+interface CloudflareAccessPolicy {
+    id: string;
+    name: string;
+    decision?: string;
+    include?: unknown[];
+}
+/** Create or update one reusable Service Auth policy for the Worker token. */
+export declare function ensureCloudflareAccessPolicy(config: {
+    accountId: string;
+    name: string;
+    serviceTokenId: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    policy: CloudflareAccessPolicy;
+    created: boolean;
+}>;
+interface CloudflareAccessApplication {
+    id: string;
+    name: string;
+    type?: string;
+    domain?: string;
+    self_hosted_domains?: string[];
+}
+/** Protect one node hostname so only the public Worker can reach it. */
+export declare function ensureCloudflareAccessApplication(config: {
+    accountId: string;
+    name: string;
+    hostname: string;
+    policyId: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    application: CloudflareAccessApplication;
+    created: boolean;
+}>;
+/** Attach the same non-interactive service-auth policy to WARP enrollment. */
+export declare function ensureCloudflareWarpEnrollmentApplication(config: {
+    accountId: string;
+    name: string;
+    policyId: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    application: CloudflareAccessApplication;
+    created: boolean;
+}>;
+export interface CloudflareVirtualNetwork {
+    id: string;
+    name: string;
+    comment?: string;
+    is_default_network?: boolean;
+    deleted_at?: string | null;
+}
+/** Create or reuse one named VNET; never silently adopt an ambiguous/deleted row. */
+export declare function ensureCloudflareVirtualNetwork(config: {
+    accountId: string;
+    name: string;
+    comment: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    virtualNetwork: CloudflareVirtualNetwork;
+    created: boolean;
+}>;
+interface CloudflareDevicePolicy {
+    id: string;
+    name: string;
+    match?: string;
+    precedence?: number;
+}
+/**
+ * Create a locked WARP device profile selected only by this service token.
+ * Split-tunnel includes are reconciled separately so existing owned entries
+ * remain visible and reviewable.
+ */
+export declare function ensureCloudflareWarpDevicePolicy(config: {
+    accountId: string;
+    name: string;
+    serviceTokenId: string;
+    virtualNetworkId: string;
+    precedence?: number;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    policy: CloudflareDevicePolicy;
+    created: boolean;
+}>;
+/** Atomically replace both Worker-side Access credentials. */
+export declare function configureCloudflareWorkerAccessSecrets(config: {
+    accountId: string;
+    scriptName: string;
+    credentials: CloudflareAccessCredentials;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<void>;
+/** Create or reuse exactly one named Worker KV namespace. */
+export declare function ensureCloudflareKvNamespace(config: {
+    accountId: string;
+    title: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    namespace: CloudflareKvNamespace;
+    created: boolean;
+}>;
+export interface CloudflareTunnel {
+    id: string;
+    name: string;
+    status?: string;
+    deleted_at?: string | null;
+}
+/**
+ * Create or reuse one remotely-managed Tunnel and obtain its connector token.
+ * The token is returned once to the caller so it can be PQ-delivered to the
+ * Agent and sealed as a systemd credential; it is never persisted in ArangoDB.
+ */
+export declare function ensureCloudflareTunnel(config: {
+    accountId: string;
+    name: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    tunnel: CloudflareTunnel;
+    connectorToken: string;
+    created: boolean;
+}>;
+export {};

package/dist/cloudflare-edge.js

@@ -0,0 +1,424 @@
+// @bun
+// src/cloudflare-edge.ts
+import { isIP } from "net";
+function isPrivateDatabaseAddress(value) {
+  const address = value.trim().toLowerCase();
+  const family = isIP(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    return Number.isFinite(first) && (first & 65024) === 64512;
+  }
+  return false;
+}
+function privateDatabaseHostRoute(value) {
+  const address = value.trim().toLowerCase();
+  if (!isPrivateDatabaseAddress(address)) {
+    throw new Error("database address must be an RFC 1918 IPv4 or unique-local IPv6 address");
+  }
+  return `${address}/${isIP(address) === 4 ? 32 : 128}`;
+}
+var endpoint = "https://api.cloudflare.com/client/v4";
+async function cf(config, path, init = {}, fetcher = fetch) {
+  const response = await fetcher(`${endpoint}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${config.apiToken}`,
+      "content-type": "application/json",
+      ...init.headers
+    }
+  });
+  const body = await response.json();
+  if (!response.ok || body.success !== true) {
+    throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
+  }
+  return body.result;
+}
+async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (current) {
+    if (current.tunnel_id !== config.tunnelId) {
+      throw new Error(`private route ${config.network} already belongs to another Tunnel`);
+    }
+    return { route: current, created: false };
+  }
+  const route = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({
+      network: config.network,
+      tunnel_id: config.tunnelId,
+      comment: config.comment.slice(0, 100),
+      ...config.virtualNetworkId ? { virtual_network_id: config.virtualNetworkId } : {}
+    })
+  }, fetcher);
+  return { route, created: true };
+}
+async function ensureCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return ensureCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function removeCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route) => !route.deleted_at && route.network === config.network && (route.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (!current)
+    return { removed: false };
+  if (current.tunnel_id !== config.tunnelId) {
+    throw new Error(`private route ${config.network} belongs to another Tunnel`);
+  }
+  await cf(config, `${path}/${encodeURIComponent(current.id)}`, { method: "DELETE" }, fetcher);
+  return { removed: true, route: current };
+}
+async function removeCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return removeCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function ensureCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  if (entries.some((entry) => entry.address === route))
+    return { entries, created: false };
+  const next = [...entries, { address: route, description: config.description.slice(0, 100) }];
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, created: true };
+}
+async function removeCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  const next = entries.filter((entry) => entry.address !== route);
+  if (next.length === entries.length)
+    return { entries, removed: false };
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, removed: true };
+}
+async function configureCloudflareEdge(config, fetcher = fetch) {
+  const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
+  const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
+  const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
+  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  await cf(tunnelAuth, tunnelPath, {
+    method: "PUT",
+    body: JSON.stringify({ config: { ingress: [
+      { hostname: config.hostname, service: config.service },
+      ...otherHosts,
+      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+    ] } })
+  }, fetcher);
+  const dnsPath = `/zones/${config.zoneId}/dns_records`;
+  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  if (records.length > 1) {
+    throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
+  }
+  const record = {
+    type: "CNAME",
+    name: config.hostname,
+    content: `${config.tunnelId}.cfargotunnel.com`,
+    proxied: true,
+    ttl: 1
+  };
+  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
+    method: records[0] ? "PUT" : "POST",
+    body: JSON.stringify(record)
+  }, fetcher);
+}
+var exactAccountPermissionGroup = async (config, name, fetcher) => {
+  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
+  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
+  if (matches.length !== 1) {
+    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
+  }
+  return { id: matches[0].id, name };
+};
+async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
+    throw new Error("Cloudflare account id is invalid");
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
+    throw new Error("Cloudflare account runtime-token name is invalid");
+  }
+  const permissionNames = [...new Set(config.permissionNames)];
+  if (permissionNames.length === 0)
+    throw new Error("Cloudflare account runtime token needs a permission group");
+  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
+  const body = {
+    name,
+    policies: [{
+      effect: "allow",
+      permission_groups: permissionGroups.map(({ id }) => ({ id })),
+      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
+    }]
+  };
+  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
+  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
+    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
+  }
+  return { id: created.id, value: created.value, name, permissionNames };
+}
+async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Access service-token name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/service_tokens`;
+  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = tokens.filter((token) => token.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
+  if (matches[0]) {
+    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
+      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
+    }
+    return { credentials: config.existing, created: false };
+  }
+  const created = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
+  }, fetcher);
+  if (!created.id || !created.client_id || !created.client_secret) {
+    throw new Error("Cloudflare did not return the new Access service-token secret");
+  }
+  return {
+    credentials: {
+      tokenId: created.id,
+      clientId: created.client_id,
+      clientSecret: created.client_secret
+    },
+    created: true
+  };
+}
+async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/policies`;
+  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === config.name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
+  const desired = {
+    name: config.name,
+    decision: "non_identity",
+    include: [{ service_token: { token_id: config.serviceTokenId } }]
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
+    method: matches[0] ? "PUT" : "POST",
+    body: JSON.stringify(desired)
+  }, fetcher);
+  return { policy, created: !matches[0] };
+}
+async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
+  const desired = {
+    name: config.name,
+    type: "self_hosted",
+    domain: config.hostname,
+    session_duration: "24h",
+    service_auth_401_redirect: true,
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare WARP enrollment application name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
+  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
+    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
+  }
+  const desired = {
+    name,
+    type: "warp",
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!application.id || application.type && application.type !== "warp") {
+    throw new Error("Cloudflare did not return the WARP enrollment application");
+  }
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare VNET name is invalid");
+  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
+  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
+  if (matches[0])
+    return { virtualNetwork: matches[0], created: false };
+  const virtualNetwork = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
+  }, fetcher);
+  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
+    throw new Error("Cloudflare did not return the VNET id");
+  }
+  return { virtualNetwork, created: true };
+}
+async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare WARP device profile name is invalid");
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
+    throw new Error("Cloudflare service-token id is invalid");
+  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
+    throw new Error("Cloudflare VNET id is invalid");
+  const precedence = config.precedence ?? 100;
+  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
+    throw new Error("Cloudflare WARP device profile precedence is invalid");
+  }
+  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
+  const listPath = `/accounts/${config.accountId}/devices/policies`;
+  const path = `/accounts/${config.accountId}/devices/policy`;
+  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
+  if (matches[0]?.match && matches[0].match !== match) {
+    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
+  }
+  const desired = {
+    name,
+    match,
+    precedence,
+    description: "ForgeZero non-interactive compute enrollment",
+    enabled: true,
+    allow_mode_switch: false,
+    allowed_to_leave: false,
+    auto_connect: 0,
+    switch_locked: true,
+    service_mode_v2: { mode: "warp" },
+    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!policy.id)
+    throw new Error("Cloudflare did not return the WARP device profile id");
+  return { policy, created: !matches[0] };
+}
+async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
+    throw new Error("Cloudflare Worker script name is invalid");
+  }
+  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      secrets: {
+        CF_ACCESS_CLIENT_ID: {
+          name: "CF_ACCESS_CLIENT_ID",
+          type: "secret_text",
+          text: config.credentials.clientId
+        },
+        CF_ACCESS_CLIENT_SECRET: {
+          name: "CF_ACCESS_CLIENT_SECRET",
+          type: "secret_text",
+          text: config.credentials.clientSecret
+        }
+      }
+    })
+  }, fetcher);
+}
+async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
+  const title = config.title.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
+  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = namespaces.filter((namespace2) => namespace2.title === title);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
+  if (matches[0])
+    return { namespace: matches[0], created: false };
+  const namespace = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ title })
+  }, fetcher);
+  return { namespace, created: true };
+}
+async function ensureCloudflareTunnel(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Tunnel name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/cfd_tunnel`;
+  const tunnels = await cf(config, `${path}?is_deleted=false&name=${encodeURIComponent(name)}&per_page=1000`, {}, fetcher);
+  const matches = tunnels.filter((tunnel2) => tunnel2.name === name && !tunnel2.deleted_at);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Tunnel ${name} is ambiguous`);
+  const created = !matches[0];
+  const tunnel = matches[0] ?? await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, config_src: "cloudflare" })
+  }, fetcher);
+  const connectorToken = await cf(config, `${path}/${encodeURIComponent(tunnel.id)}/token`, {}, fetcher);
+  if (!connectorToken || connectorToken.length > 16384) {
+    throw new Error("Cloudflare returned an invalid Tunnel connector token");
+  }
+  return { tunnel, connectorToken, created };
+}
+export {
+  removeCloudflareWarpDatabaseInclude,
+  removeCloudflarePrivateRoute,
+  removeCloudflarePrivateDatabaseRoute,
+  ensureCloudflareWarpEnrollmentApplication,
+  ensureCloudflareWarpDevicePolicy,
+  ensureCloudflareWarpDatabaseInclude,
+  ensureCloudflareVirtualNetwork,
+  ensureCloudflareTunnel,
+  ensureCloudflarePrivateRoute,
+  ensureCloudflarePrivateDatabaseRoute,
+  ensureCloudflareKvNamespace,
+  ensureCloudflareAccessServiceToken,
+  ensureCloudflareAccessPolicy,
+  ensureCloudflareAccessApplication,
+  createCloudflareAccountRuntimeToken,
+  configureCloudflareWorkerAccessSecrets,
+  configureCloudflareEdge
+};