@hot-updater/cloudflare 0.35.7 → 0.35.9

package/dist/iac/index.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
-import { ConfigBuilder, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, link, makeEnv, p, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
 import { Cloudflare } from "cloudflare";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
@@ -20,6 +20,7 @@ import { appendFileSync, createReadStream, createWriteStream, readFileSync, stat
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
+import { APIError } from "cloudflare/error";
 import os from "os";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -46,302 +47,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
-var import_dayjs_min = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	(function(t, e) {
-		"object" == typeof exports && "undefined" != typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define(e) : (t = "undefined" != typeof globalThis ? globalThis : t || self).dayjs = e();
-	})(exports, (function() {
-		"use strict";
-		var t = 1e3, e = 6e4, n = 36e5, r = "millisecond", i = "second", s = "minute", u = "hour", a = "day", o = "week", c = "month", f = "quarter", h = "year", d = "date", l = "Invalid Date", $ = /^(\d{4})[-/]?(\d{1,2})?[-/]?(\d{0,2})[Tt\s]*(\d{1,2})?:?(\d{1,2})?:?(\d{1,2})?[.:]?(\d+)?$/, y = /\[([^\]]+)]|YYYY|YY|M{1,4}|D{1,2}|d{1,4}|H{1,2}|h{1,2}|a|A|m{1,2}|s{1,2}|Z{1,2}|SSS/g, M = {
-			name: "en",
-			weekdays: "Sunday_Monday_Tuesday_Wednesday_Thursday_Friday_Saturday".split("_"),
-			months: "January_February_March_April_May_June_July_August_September_October_November_December".split("_"),
-			ordinal: function(t) {
-				var e = [
-					"th",
-					"st",
-					"nd",
-					"rd"
-				], n = t % 100;
-				return "[" + t + (e[(n - 20) % 10] || e[n] || e[0]) + "]";
-			}
-		}, m = function(t, e, n) {
-			var r = String(t);
-			return !r || r.length >= e ? t : "" + Array(e + 1 - r.length).join(n) + t;
-		}, v = {
-			s: m,
-			z: function(t) {
-				var e = -t.utcOffset(), n = Math.abs(e), r = Math.floor(n / 60), i = n % 60;
-				return (e <= 0 ? "+" : "-") + m(r, 2, "0") + ":" + m(i, 2, "0");
-			},
-			m: function t(e, n) {
-				if (e.date() < n.date()) return -t(n, e);
-				var r = 12 * (n.year() - e.year()) + (n.month() - e.month()), i = e.clone().add(r, c), s = n - i < 0, u = e.clone().add(r + (s ? -1 : 1), c);
-				return +(-(r + (n - i) / (s ? i - u : u - i)) || 0);
-			},
-			a: function(t) {
-				return t < 0 ? Math.ceil(t) || 0 : Math.floor(t);
-			},
-			p: function(t) {
-				return {
-					M: c,
-					y: h,
-					w: o,
-					d: a,
-					D: d,
-					h: u,
-					m: s,
-					s: i,
-					ms: r,
-					Q: f
-				}[t] || String(t || "").toLowerCase().replace(/s$/, "");
-			},
-			u: function(t) {
-				return void 0 === t;
-			}
-		}, g = "en", D = {};
-		D[g] = M;
-		var p = "$isDayjsObject", S = function(t) {
-			return t instanceof _ || !(!t || !t[p]);
-		}, w = function t(e, n, r) {
-			var i;
-			if (!e) return g;
-			if ("string" == typeof e) {
-				var s = e.toLowerCase();
-				D[s] && (i = s), n && (D[s] = n, i = s);
-				var u = e.split("-");
-				if (!i && u.length > 1) return t(u[0]);
-			} else {
-				var a = e.name;
-				D[a] = e, i = a;
-			}
-			return !r && i && (g = i), i || !r && g;
-		}, O = function(t, e) {
-			if (S(t)) return t.clone();
-			var n = "object" == typeof e ? e : {};
-			return n.date = t, n.args = arguments, new _(n);
-		}, b = v;
-		b.l = w, b.i = S, b.w = function(t, e) {
-			return O(t, {
-				locale: e.$L,
-				utc: e.$u,
-				x: e.$x,
-				$offset: e.$offset
-			});
-		};
-		var _ = function() {
-			function M(t) {
-				this.$L = w(t.locale, null, !0), this.parse(t), this.$x = this.$x || t.x || {}, this[p] = !0;
-			}
-			var m = M.prototype;
-			return m.parse = function(t) {
-				this.$d = function(t) {
-					var e = t.date, n = t.utc;
-					if (null === e) return /* @__PURE__ */ new Date(NaN);
-					if (b.u(e)) return /* @__PURE__ */ new Date();
-					if (e instanceof Date) return new Date(e);
-					if ("string" == typeof e && !/Z$/i.test(e)) {
-						var r = e.match($);
-						if (r) {
-							var i = r[2] - 1 || 0, s = (r[7] || "0").substring(0, 3);
-							return n ? new Date(Date.UTC(r[1], i, r[3] || 1, r[4] || 0, r[5] || 0, r[6] || 0, s)) : new Date(r[1], i, r[3] || 1, r[4] || 0, r[5] || 0, r[6] || 0, s);
-						}
-					}
-					return new Date(e);
-				}(t), this.init();
-			}, m.init = function() {
-				var t = this.$d;
-				this.$y = t.getFullYear(), this.$M = t.getMonth(), this.$D = t.getDate(), this.$W = t.getDay(), this.$H = t.getHours(), this.$m = t.getMinutes(), this.$s = t.getSeconds(), this.$ms = t.getMilliseconds();
-			}, m.$utils = function() {
-				return b;
-			}, m.isValid = function() {
-				return !(this.$d.toString() === l);
-			}, m.isSame = function(t, e) {
-				var n = O(t);
-				return this.startOf(e) <= n && n <= this.endOf(e);
-			}, m.isAfter = function(t, e) {
-				return O(t) < this.startOf(e);
-			}, m.isBefore = function(t, e) {
-				return this.endOf(e) < O(t);
-			}, m.$g = function(t, e, n) {
-				return b.u(t) ? this[e] : this.set(n, t);
-			}, m.unix = function() {
-				return Math.floor(this.valueOf() / 1e3);
-			}, m.valueOf = function() {
-				return this.$d.getTime();
-			}, m.startOf = function(t, e) {
-				var n = this, r = !!b.u(e) || e, f = b.p(t), l = function(t, e) {
-					var i = b.w(n.$u ? Date.UTC(n.$y, e, t) : new Date(n.$y, e, t), n);
-					return r ? i : i.endOf(a);
-				}, $ = function(t, e) {
-					return b.w(n.toDate()[t].apply(n.toDate("s"), (r ? [
-						0,
-						0,
-						0,
-						0
-					] : [
-						23,
-						59,
-						59,
-						999
-					]).slice(e)), n);
-				}, y = this.$W, M = this.$M, m = this.$D, v = "set" + (this.$u ? "UTC" : "");
-				switch (f) {
-					case h: return r ? l(1, 0) : l(31, 11);
-					case c: return r ? l(1, M) : l(0, M + 1);
-					case o:
-						var g = this.$locale().weekStart || 0, D = (y < g ? y + 7 : y) - g;
-						return l(r ? m - D : m + (6 - D), M);
-					case a:
-					case d: return $(v + "Hours", 0);
-					case u: return $(v + "Minutes", 1);
-					case s: return $(v + "Seconds", 2);
-					case i: return $(v + "Milliseconds", 3);
-					default: return this.clone();
-				}
-			}, m.endOf = function(t) {
-				return this.startOf(t, !1);
-			}, m.$set = function(t, e) {
-				var n, o = b.p(t), f = "set" + (this.$u ? "UTC" : ""), l = (n = {}, n[a] = f + "Date", n[d] = f + "Date", n[c] = f + "Month", n[h] = f + "FullYear", n[u] = f + "Hours", n[s] = f + "Minutes", n[i] = f + "Seconds", n[r] = f + "Milliseconds", n)[o], $ = o === a ? this.$D + (e - this.$W) : e;
-				if (o === c || o === h) {
-					var y = this.clone().set(d, 1);
-					y.$d[l]($), y.init(), this.$d = y.set(d, Math.min(this.$D, y.daysInMonth())).$d;
-				} else l && this.$d[l]($);
-				return this.init(), this;
-			}, m.set = function(t, e) {
-				return this.clone().$set(t, e);
-			}, m.get = function(t) {
-				return this[b.p(t)]();
-			}, m.add = function(r, f) {
-				var d, l = this;
-				r = Number(r);
-				var $ = b.p(f), y = function(t) {
-					var e = O(l);
-					return b.w(e.date(e.date() + Math.round(t * r)), l);
-				};
-				if ($ === c) return this.set(c, this.$M + r);
-				if ($ === h) return this.set(h, this.$y + r);
-				if ($ === a) return y(1);
-				if ($ === o) return y(7);
-				var M = (d = {}, d[s] = e, d[u] = n, d[i] = t, d)[$] || 1, m = this.$d.getTime() + r * M;
-				return b.w(m, this);
-			}, m.subtract = function(t, e) {
-				return this.add(-1 * t, e);
-			}, m.format = function(t) {
-				var e = this, n = this.$locale();
-				if (!this.isValid()) return n.invalidDate || l;
-				var r = t || "YYYY-MM-DDTHH:mm:ssZ", i = b.z(this), s = this.$H, u = this.$m, a = this.$M, o = n.weekdays, c = n.months, f = n.meridiem, h = function(t, n, i, s) {
-					return t && (t[n] || t(e, r)) || i[n].slice(0, s);
-				}, d = function(t) {
-					return b.s(s % 12 || 12, t, "0");
-				}, $ = f || function(t, e, n) {
-					var r = t < 12 ? "AM" : "PM";
-					return n ? r.toLowerCase() : r;
-				};
-				return r.replace(y, (function(t, r) {
-					return r || function(t) {
-						switch (t) {
-							case "YY": return String(e.$y).slice(-2);
-							case "YYYY": return b.s(e.$y, 4, "0");
-							case "M": return a + 1;
-							case "MM": return b.s(a + 1, 2, "0");
-							case "MMM": return h(n.monthsShort, a, c, 3);
-							case "MMMM": return h(c, a);
-							case "D": return e.$D;
-							case "DD": return b.s(e.$D, 2, "0");
-							case "d": return String(e.$W);
-							case "dd": return h(n.weekdaysMin, e.$W, o, 2);
-							case "ddd": return h(n.weekdaysShort, e.$W, o, 3);
-							case "dddd": return o[e.$W];
-							case "H": return String(s);
-							case "HH": return b.s(s, 2, "0");
-							case "h": return d(1);
-							case "hh": return d(2);
-							case "a": return $(s, u, !0);
-							case "A": return $(s, u, !1);
-							case "m": return String(u);
-							case "mm": return b.s(u, 2, "0");
-							case "s": return String(e.$s);
-							case "ss": return b.s(e.$s, 2, "0");
-							case "SSS": return b.s(e.$ms, 3, "0");
-							case "Z": return i;
-						}
-						return null;
-					}(t) || i.replace(":", "");
-				}));
-			}, m.utcOffset = function() {
-				return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
-			}, m.diff = function(r, d, l) {
-				var $, y = this, M = b.p(d), m = O(r), v = (m.utcOffset() - this.utcOffset()) * e, g = this - m, D = function() {
-					return b.m(y, m);
-				};
-				switch (M) {
-					case h:
-						$ = D() / 12;
-						break;
-					case c:
-						$ = D();
-						break;
-					case f:
-						$ = D() / 3;
-						break;
-					case o:
-						$ = (g - v) / 6048e5;
-						break;
-					case a:
-						$ = (g - v) / 864e5;
-						break;
-					case u:
-						$ = g / n;
-						break;
-					case s:
-						$ = g / e;
-						break;
-					case i:
-						$ = g / t;
-						break;
-					default: $ = g;
-				}
-				return l ? $ : b.a($);
-			}, m.daysInMonth = function() {
-				return this.endOf(c).$D;
-			}, m.$locale = function() {
-				return D[this.$L];
-			}, m.locale = function(t, e) {
-				if (!t) return this.$L;
-				var n = this.clone(), r = w(t, e, !0);
-				return r && (n.$L = r), n;
-			}, m.clone = function() {
-				return b.w(this.$d, this);
-			}, m.toDate = function() {
-				return new Date(this.valueOf());
-			}, m.toJSON = function() {
-				return this.isValid() ? this.toISOString() : null;
-			}, m.toISOString = function() {
-				return this.$d.toISOString();
-			}, m.toString = function() {
-				return this.$d.toUTCString();
-			}, M;
-		}(), Y = _.prototype;
-		return O.prototype = Y, [
-			["$ms", r],
-			["$s", i],
-			["$m", s],
-			["$H", u],
-			["$W", a],
-			["$M", c],
-			["$y", h],
-			["$D", d]
-		].forEach((function(t) {
-			Y[t[1]] = function(e) {
-				return this.$g(e, t[0], t[1]);
-			};
-		})), O.extend = function(t, e) {
-			return t.$i || (t(e, _, O), t.$i = !0), O;
-		}, O.locale = w, O.isDayjs = S, O.unix = function(t) {
-			return O(1e3 * t);
-		}, O.en = D[g], O.Ls = D, O.p = {}, O;
-	}));
-})))(), 1);
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -6501,13 +6206,14 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region src/utils/createWrangler.ts
-const createWrangler = ({ stdio, accountId, cloudflareApiToken, cwd }) => {
+const createWrangler = ({ stdio, accountId, cloudflareApiToken, cwd, nonInteractive }) => {
 	const $ = execa({
 		stdio,
 		extendsEnv: true,
-		shell: stdio === "inherit",
+		shell: false,
 		cwd,
 		env: {
+			...nonInteractive ? { CI: "true" } : {},
 			CLOUDFLARE_ACCOUNT_ID: accountId,
 			CLOUDFLARE_API_TOKEN: cloudflareApiToken
 		}
@@ -6515,6 +6221,465 @@ const createWrangler = ({ stdio, accountId, cloudflareApiToken, cwd }) => {
 	return (...command) => $("npx", ["wrangler", ...command]);
 };
 //#endregion
+//#region iac/cloudflareInitErrors.ts
+const CLOUDFLARE_INIT_PERMISSION = { d1: "D1: Edit" };
+const CLOUDFLARE_INIT_PERMISSIONS = [CLOUDFLARE_INIT_PERMISSION.d1];
+const getCredentialRemediation = (source) => {
+	switch (source.kind) {
+		case "environment": return ["Update HOT_UPDATER_CLOUDFLARE_API_TOKEN in the environment, then rerun init."];
+		case "env-file": return [`Update HOT_UPDATER_CLOUDFLARE_API_TOKEN in ${source.envFile}, then rerun init.`, "Alternatively, rerun without --env-file to enter a new token."];
+		case "prompt": return ["Create a new API token, then rerun init and enter it again."];
+		case "wrangler-oauth": return ["Refresh Wrangler authentication with `npx wrangler login`, then rerun init."];
+	}
+};
+const getErrorOutput = (error) => {
+	const output = [];
+	if (error instanceof Error) output.push(error.message);
+	if (typeof error === "object" && error !== null && "stderr" in error && typeof error.stderr === "string") output.push(error.stderr);
+	if (typeof error === "object" && error !== null && "stdout" in error && typeof error.stdout === "string") output.push(error.stdout);
+	return output.join("\n");
+};
+const isCloudflareAuthenticationError = (error) => {
+	if (error instanceof APIError) return error.status === 401 || error.status === 403 || error.errors.some(({ code }) => code === 6003 || code === 6111 || code === 1e4 || code === 9109) || /invalid format for authorization header/i.test(error.message);
+	return [
+		/authentication error/i,
+		/invalid access token/i,
+		/invalid format for authorization header/i,
+		/code:\s*(?:6003|6111|10000|9109)/i,
+		/"code"\s*:\s*(?:6003|6111|10000|9109)/i
+	].some((pattern) => pattern.test(getErrorOutput(error)));
+};
+var CloudflareAuthenticationError = class extends InitError {
+	name = "CloudflareAuthenticationError";
+	constructor(source, accountId, options) {
+		super([
+			source.kind === "wrangler-oauth" ? "Cloudflare Wrangler authentication failed." : "Cloudflare API token is invalid, expired, or missing required permissions.",
+			...accountId ? [`Selected account: ${accountId}`, "Confirm the token is active and its resource scope includes this account."] : [],
+			...getCredentialRemediation(source),
+			...source.kind === "wrangler-oauth" ? [] : [`Required permissions: ${CLOUDFLARE_INIT_PERMISSIONS.join(", ")}`],
+			"Verify token status: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/#test-the-token"
+		].join("\n"), options);
+		this.source = source;
+		this.accountId = accountId;
+	}
+};
+var CloudflarePermissionError = class extends InitError {
+	name = "CloudflarePermissionError";
+	constructor(source, { accountId, check, requiredPermission }, options) {
+		super([
+			"Cloudflare API token cannot access a required account resource.",
+			`Selected account: ${accountId}`,
+			`Failed check: ${check}`,
+			`Required permission: ${requiredPermission}`,
+			"Confirm the token permission and account resource scope, then rerun init.",
+			...getCredentialRemediation(source)
+		].join("\n"), options);
+		this.source = source;
+		this.accountId = accountId;
+		this.check = check;
+		this.requiredPermission = requiredPermission;
+	}
+	accountId;
+	check;
+	requiredPermission;
+};
+var CloudflareDeploymentError = class extends InitError {
+	name = "CloudflareDeploymentError";
+	constructor(cause) {
+		super([
+			"Cloudflare Worker deployment failed.",
+			"Review the Wrangler error above, fix the reported resource or permission, then rerun init.",
+			`Cause: ${cause.message}`
+		].join("\n"), { cause });
+	}
+};
+var CloudflareApiRequestError = class extends InitError {
+	name = "CloudflareApiRequestError";
+	constructor(cause) {
+		super([
+			"Cloudflare infrastructure request failed.",
+			"Review the Cloudflare error, confirm the token permissions and selected resources, then rerun init.",
+			`Cause: ${cause.message}`
+		].join("\n"), { cause });
+	}
+};
+const toCloudflareApiError = (error, source) => {
+	if (error instanceof InitError) return error;
+	if (isCloudflareAuthenticationError(error)) return new CloudflareAuthenticationError(source, void 0, { cause: error });
+	if (error instanceof APIError) return new CloudflareApiRequestError(error);
+	return error instanceof Error ? error : new Error(String(error));
+};
+const runCloudflareApiRequest = async ({ request, source }) => {
+	try {
+		return await request();
+	} catch (error) {
+		if (error instanceof Error) throw toCloudflareApiError(error, source);
+		throw new Error(String(error));
+	}
+};
+const toCloudflareDeploymentError = (error, source) => {
+	const apiError = toCloudflareApiError(error, source);
+	return apiError instanceof InitError ? apiError : new CloudflareDeploymentError(apiError);
+};
+//#endregion
+//#region iac/cloudflareApiToken.ts
+const verifyCloudflareApiTokenIdentity = async ({ accountId, apiToken, verifyAccountToken, verifyUserToken }) => {
+	if (apiToken.startsWith("cfat_")) return verifyAccountToken(accountId);
+	if (apiToken.startsWith("cfut_")) return verifyUserToken();
+	try {
+		return await verifyAccountToken(accountId);
+	} catch (error) {
+		if (!isCloudflareAuthenticationError(error)) throw error;
+		return verifyUserToken();
+	}
+};
+const validateCloudflareApiToken = async ({ accountId, probes, source, verify }) => {
+	let verification;
+	try {
+		verification = await verify();
+	} catch (error) {
+		if (isCloudflareAuthenticationError(error)) throw new CloudflareAuthenticationError(source, accountId, { cause: error });
+		throw toCloudflareApiError(error, source);
+	}
+	if (verification.status !== "active") throw new CloudflareAuthenticationError(source, accountId);
+	for (const probe of probes) try {
+		await probe.request();
+	} catch (error) {
+		if (isCloudflareAuthenticationError(error)) throw new CloudflarePermissionError(source, {
+			accountId,
+			check: probe.check,
+			requiredPermission: probe.requiredPermission
+		}, { cause: error });
+		throw toCloudflareApiError(error, source);
+	}
+};
+//#endregion
+//#region iac/cloudflareD1Selection.ts
+var CloudflareD1IdentifierConflictError = class extends InitError {
+	name = "CloudflareD1IdentifierConflictError";
+	constructor({ databaseId, databaseName }) {
+		super([
+			"Cloudflare D1 identifiers conflict.",
+			`Database ID: ${databaseId}`,
+			`Database name: ${databaseName}`,
+			"Update the env file so both values identify the same database, then rerun init."
+		].join("\n"));
+	}
+};
+const resolveCloudflareReplayD1Database = ({ availableDatabases, databaseId, databaseName }) => {
+	const exactMatch = availableDatabases.find((database) => database.uuid === databaseId && database.name === databaseName);
+	if (exactMatch) return {
+		database: exactMatch,
+		kind: "existing"
+	};
+	if (availableDatabases.some((database) => database.uuid === databaseId || database.name === databaseName)) throw new CloudflareD1IdentifierConflictError({
+		databaseId,
+		databaseName
+	});
+	return {
+		kind: "create",
+		name: databaseName
+	};
+};
+//#endregion
+//#region ../../node_modules/.pnpm/dayjs@1.11.21/node_modules/dayjs/dayjs.min.js
+var require_dayjs_min = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	(function(t, e) {
+		"object" == typeof exports && "undefined" != typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define(e) : (t = "undefined" != typeof globalThis ? globalThis : t || self).dayjs = e();
+	})(exports, (function() {
+		"use strict";
+		var t = 1e3, e = 6e4, n = 36e5, r = "millisecond", i = "second", s = "minute", u = "hour", a = "day", o = "week", c = "month", f = "quarter", h = "year", d = "date", l = "Invalid Date", $ = /^(\d{4})[-/]?(\d{1,2})?[-/]?(\d{0,2})[Tt\s]*(\d{1,2})?:?(\d{1,2})?:?(\d{1,2})?[.:]?(\d+)?$/, y = /\[([^\]]+)]|YYYY|YY|M{1,4}|D{1,2}|d{1,4}|H{1,2}|h{1,2}|a|A|m{1,2}|s{1,2}|Z{1,2}|SSS/g, M = {
+			name: "en",
+			weekdays: "Sunday_Monday_Tuesday_Wednesday_Thursday_Friday_Saturday".split("_"),
+			months: "January_February_March_April_May_June_July_August_September_October_November_December".split("_"),
+			ordinal: function(t) {
+				var e = [
+					"th",
+					"st",
+					"nd",
+					"rd"
+				], n = t % 100;
+				return "[" + t + (e[(n - 20) % 10] || e[n] || e[0]) + "]";
+			}
+		}, m = function(t, e, n) {
+			var r = String(t);
+			return !r || r.length >= e ? t : "" + Array(e + 1 - r.length).join(n) + t;
+		}, v = {
+			s: m,
+			z: function(t) {
+				var e = -t.utcOffset(), n = Math.abs(e), r = Math.floor(n / 60), i = n % 60;
+				return (e <= 0 ? "+" : "-") + m(r, 2, "0") + ":" + m(i, 2, "0");
+			},
+			m: function t(e, n) {
+				if (e.date() < n.date()) return -t(n, e);
+				var r = 12 * (n.year() - e.year()) + (n.month() - e.month()), i = e.clone().add(r, c), s = n - i < 0, u = e.clone().add(r + (s ? -1 : 1), c);
+				return +(-(r + (n - i) / (s ? i - u : u - i)) || 0);
+			},
+			a: function(t) {
+				return t < 0 ? Math.ceil(t) || 0 : Math.floor(t);
+			},
+			p: function(t) {
+				return {
+					M: c,
+					y: h,
+					w: o,
+					d: a,
+					D: d,
+					h: u,
+					m: s,
+					s: i,
+					ms: r,
+					Q: f
+				}[t] || String(t || "").toLowerCase().replace(/s$/, "");
+			},
+			u: function(t) {
+				return void 0 === t;
+			}
+		}, g = "en", D = {};
+		D[g] = M;
+		var p = "$isDayjsObject", S = function(t) {
+			return t instanceof _ || !(!t || !t[p]);
+		}, w = function t(e, n, r) {
+			var i;
+			if (!e) return g;
+			if ("string" == typeof e) {
+				var s = e.toLowerCase();
+				D[s] && (i = s), n && (D[s] = n, i = s);
+				var u = e.split("-");
+				if (!i && u.length > 1) return t(u[0]);
+			} else {
+				var a = e.name;
+				D[a] = e, i = a;
+			}
+			return !r && i && (g = i), i || !r && g;
+		}, O = function(t, e) {
+			if (S(t)) return t.clone();
+			var n = "object" == typeof e ? e : {};
+			return n.date = t, n.args = arguments, new _(n);
+		}, b = v;
+		b.l = w, b.i = S, b.w = function(t, e) {
+			return O(t, {
+				locale: e.$L,
+				utc: e.$u,
+				x: e.$x,
+				$offset: e.$offset
+			});
+		};
+		var _ = function() {
+			function M(t) {
+				this.$L = w(t.locale, null, !0), this.parse(t), this.$x = this.$x || t.x || {}, this[p] = !0;
+			}
+			var m = M.prototype;
+			return m.parse = function(t) {
+				this.$d = function(t) {
+					var e = t.date, n = t.utc;
+					if (null === e) return /* @__PURE__ */ new Date(NaN);
+					if (b.u(e)) return /* @__PURE__ */ new Date();
+					if (e instanceof Date) return new Date(e);
+					if ("string" == typeof e && !/Z$/i.test(e)) {
+						var r = e.match($);
+						if (r) {
+							var i = r[2] - 1 || 0, s = (r[7] || "0").substring(0, 3);
+							return n ? new Date(Date.UTC(r[1], i, r[3] || 1, r[4] || 0, r[5] || 0, r[6] || 0, s)) : new Date(r[1], i, r[3] || 1, r[4] || 0, r[5] || 0, r[6] || 0, s);
+						}
+					}
+					return new Date(e);
+				}(t), this.init();
+			}, m.init = function() {
+				var t = this.$d;
+				this.$y = t.getFullYear(), this.$M = t.getMonth(), this.$D = t.getDate(), this.$W = t.getDay(), this.$H = t.getHours(), this.$m = t.getMinutes(), this.$s = t.getSeconds(), this.$ms = t.getMilliseconds();
+			}, m.$utils = function() {
+				return b;
+			}, m.isValid = function() {
+				return !(this.$d.toString() === l);
+			}, m.isSame = function(t, e) {
+				var n = O(t);
+				return this.startOf(e) <= n && n <= this.endOf(e);
+			}, m.isAfter = function(t, e) {
+				return O(t) < this.startOf(e);
+			}, m.isBefore = function(t, e) {
+				return this.endOf(e) < O(t);
+			}, m.$g = function(t, e, n) {
+				return b.u(t) ? this[e] : this.set(n, t);
+			}, m.unix = function() {
+				return Math.floor(this.valueOf() / 1e3);
+			}, m.valueOf = function() {
+				return this.$d.getTime();
+			}, m.startOf = function(t, e) {
+				var n = this, r = !!b.u(e) || e, f = b.p(t), l = function(t, e) {
+					var i = b.w(n.$u ? Date.UTC(n.$y, e, t) : new Date(n.$y, e, t), n);
+					return r ? i : i.endOf(a);
+				}, $ = function(t, e) {
+					return b.w(n.toDate()[t].apply(n.toDate("s"), (r ? [
+						0,
+						0,
+						0,
+						0
+					] : [
+						23,
+						59,
+						59,
+						999
+					]).slice(e)), n);
+				}, y = this.$W, M = this.$M, m = this.$D, v = "set" + (this.$u ? "UTC" : "");
+				switch (f) {
+					case h: return r ? l(1, 0) : l(31, 11);
+					case c: return r ? l(1, M) : l(0, M + 1);
+					case o:
+						var g = this.$locale().weekStart || 0, D = (y < g ? y + 7 : y) - g;
+						return l(r ? m - D : m + (6 - D), M);
+					case a:
+					case d: return $(v + "Hours", 0);
+					case u: return $(v + "Minutes", 1);
+					case s: return $(v + "Seconds", 2);
+					case i: return $(v + "Milliseconds", 3);
+					default: return this.clone();
+				}
+			}, m.endOf = function(t) {
+				return this.startOf(t, !1);
+			}, m.$set = function(t, e) {
+				var n, o = b.p(t), f = "set" + (this.$u ? "UTC" : ""), l = (n = {}, n[a] = f + "Date", n[d] = f + "Date", n[c] = f + "Month", n[h] = f + "FullYear", n[u] = f + "Hours", n[s] = f + "Minutes", n[i] = f + "Seconds", n[r] = f + "Milliseconds", n)[o], $ = o === a ? this.$D + (e - this.$W) : e;
+				if (o === c || o === h) {
+					var y = this.clone().set(d, 1);
+					y.$d[l]($), y.init(), this.$d = y.set(d, Math.min(this.$D, y.daysInMonth())).$d;
+				} else l && this.$d[l]($);
+				return this.init(), this;
+			}, m.set = function(t, e) {
+				return this.clone().$set(t, e);
+			}, m.get = function(t) {
+				return this[b.p(t)]();
+			}, m.add = function(r, f) {
+				var d, l = this;
+				r = Number(r);
+				var $ = b.p(f), y = function(t) {
+					var e = O(l);
+					return b.w(e.date(e.date() + Math.round(t * r)), l);
+				};
+				if ($ === c) return this.set(c, this.$M + r);
+				if ($ === h) return this.set(h, this.$y + r);
+				if ($ === a) return y(1);
+				if ($ === o) return y(7);
+				var M = (d = {}, d[s] = e, d[u] = n, d[i] = t, d)[$] || 1, m = this.$d.getTime() + r * M;
+				return b.w(m, this);
+			}, m.subtract = function(t, e) {
+				return this.add(-1 * t, e);
+			}, m.format = function(t) {
+				var e = this, n = this.$locale();
+				if (!this.isValid()) return n.invalidDate || l;
+				var r = t || "YYYY-MM-DDTHH:mm:ssZ", i = b.z(this), s = this.$H, u = this.$m, a = this.$M, o = n.weekdays, c = n.months, f = n.meridiem, h = function(t, n, i, s) {
+					return t && (t[n] || t(e, r)) || i[n].slice(0, s);
+				}, d = function(t) {
+					return b.s(s % 12 || 12, t, "0");
+				}, $ = f || function(t, e, n) {
+					var r = t < 12 ? "AM" : "PM";
+					return n ? r.toLowerCase() : r;
+				};
+				return r.replace(y, (function(t, r) {
+					return r || function(t) {
+						switch (t) {
+							case "YY": return String(e.$y).slice(-2);
+							case "YYYY": return b.s(e.$y, 4, "0");
+							case "M": return a + 1;
+							case "MM": return b.s(a + 1, 2, "0");
+							case "MMM": return h(n.monthsShort, a, c, 3);
+							case "MMMM": return h(c, a);
+							case "D": return e.$D;
+							case "DD": return b.s(e.$D, 2, "0");
+							case "d": return String(e.$W);
+							case "dd": return h(n.weekdaysMin, e.$W, o, 2);
+							case "ddd": return h(n.weekdaysShort, e.$W, o, 3);
+							case "dddd": return o[e.$W];
+							case "H": return String(s);
+							case "HH": return b.s(s, 2, "0");
+							case "h": return d(1);
+							case "hh": return d(2);
+							case "a": return $(s, u, !0);
+							case "A": return $(s, u, !1);
+							case "m": return String(u);
+							case "mm": return b.s(u, 2, "0");
+							case "s": return String(e.$s);
+							case "ss": return b.s(e.$s, 2, "0");
+							case "SSS": return b.s(e.$ms, 3, "0");
+							case "Z": return i;
+						}
+						return null;
+					}(t) || i.replace(":", "");
+				}));
+			}, m.utcOffset = function() {
+				return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
+			}, m.diff = function(r, d, l) {
+				var $, y = this, M = b.p(d), m = O(r), v = (m.utcOffset() - this.utcOffset()) * e, g = this - m, D = function() {
+					return b.m(y, m);
+				};
+				switch (M) {
+					case h:
+						$ = D() / 12;
+						break;
+					case c:
+						$ = D();
+						break;
+					case f:
+						$ = D() / 3;
+						break;
+					case o:
+						$ = (g - v) / 6048e5;
+						break;
+					case a:
+						$ = (g - v) / 864e5;
+						break;
+					case u:
+						$ = g / n;
+						break;
+					case s:
+						$ = g / e;
+						break;
+					case i:
+						$ = g / t;
+						break;
+					default: $ = g;
+				}
+				return l ? $ : b.a($);
+			}, m.daysInMonth = function() {
+				return this.endOf(c).$D;
+			}, m.$locale = function() {
+				return D[this.$L];
+			}, m.locale = function(t, e) {
+				if (!t) return this.$L;
+				var n = this.clone(), r = w(t, e, !0);
+				return r && (n.$L = r), n;
+			}, m.clone = function() {
+				return b.w(this.$d, this);
+			}, m.toDate = function() {
+				return new Date(this.valueOf());
+			}, m.toJSON = function() {
+				return this.isValid() ? this.toISOString() : null;
+			}, m.toISOString = function() {
+				return this.$d.toISOString();
+			}, m.toString = function() {
+				return this.$d.toUTCString();
+			}, M;
+		}(), Y = _.prototype;
+		return O.prototype = Y, [
+			["$ms", r],
+			["$s", i],
+			["$m", s],
+			["$H", u],
+			["$W", a],
+			["$M", c],
+			["$y", h],
+			["$D", d]
+		].forEach((function(t) {
+			Y[t[1]] = function(e) {
+				return this.$g(e, t[0], t[1]);
+			};
+		})), O.extend = function(t, e) {
+			return t.$i || (t(e, _, O), t.$i = !0), O;
+		}, O.locale = w, O.isDayjs = S, O.unix = function(t) {
+			return O(1e3 * t);
+		}, O.en = D[g], O.Ls = D, O.p = {}, O;
+	}));
+}));
+//#endregion
 //#region ../../node_modules/.pnpm/toml@3.0.0/node_modules/toml/lib/parser.js
 var require_parser = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = (function() {
@@ -10802,6 +10967,7 @@ var require_mod_cjs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 }));
 //#endregion
 //#region ../../node_modules/.pnpm/xdg-app-paths@8.3.0/node_modules/xdg-app-paths/dist/cjs/esm-wrapper/mod.esm.js
+var import_dayjs_min = /* @__PURE__ */ __toESM(require_dayjs_min(), 1);
 var import_toml = /* @__PURE__ */ __toESM(require_toml(), 1);
 var mod_esm_default = (/* @__PURE__ */ __toESM(require_mod_cjs())).default;
 //#endregion
@@ -10829,6 +10995,206 @@ const getWranglerLoginAuthToken = () => {
 	}
 };
 //#endregion
+//#region iac/cloudflareInfrastructureAuth.ts
+var CloudflareWranglerLoginRequiredError = class extends InitError {
+	name = "CloudflareWranglerLoginRequiredError";
+	constructor() {
+		super(["Cloudflare Wrangler login is required.", "Run `npx wrangler login` interactively, then rerun init."].join("\n"));
+	}
+};
+const getValidWranglerAuthToken = () => {
+	const auth = getWranglerLoginAuthToken();
+	if (!auth || (0, import_dayjs_min.default)(auth.expiration_time).isBefore((0, import_dayjs_min.default)())) return;
+	return auth.oauth_token;
+};
+const resolveCloudflareInfrastructureApiToken = async ({ cwd, nonInteractive }) => {
+	const existingToken = getValidWranglerAuthToken();
+	if (existingToken) return existingToken;
+	if (nonInteractive) throw new CloudflareWranglerLoginRequiredError();
+	await execa("npx", [
+		"wrangler",
+		"login",
+		"--scopes",
+		"account:read",
+		"user:read",
+		"d1:write",
+		"workers:write",
+		"workers_scripts:write"
+	], { cwd });
+	const authenticatedToken = getValidWranglerAuthToken();
+	if (!authenticatedToken) throw new CloudflareWranglerLoginRequiredError();
+	return authenticatedToken;
+};
+//#endregion
+//#region iac/init/index.ts
+const initProvider = {
+	label: "Cloudflare D1 + R2 + Worker",
+	inputs: {
+		accountId: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID",
+			help: "Cloudflare account ID",
+			prompt: {
+				message: "Account List",
+				type: "select"
+			}
+		},
+		apiToken: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_API_TOKEN",
+			help: "API token with D1 edit permission",
+			persistence: "with-consent",
+			prompt: {
+				message: "Enter the Cloudflare D1 API Token",
+				type: "password"
+			}
+		},
+		bucketName: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME",
+			help: "R2 bucket name",
+			prompt: {
+				defaultValue: "hot-updater-storage",
+				message: "Enter the name of the new R2 Bucket",
+				placeholder: "hot-updater-storage",
+				type: "text"
+			}
+		},
+		accessKeyId: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID",
+			help: "R2 access key ID",
+			persistence: "with-consent",
+			prompt: {
+				message: "Enter the R2 Access Key ID",
+				type: "password"
+			}
+		},
+		secretAccessKey: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY",
+			help: "R2 secret access key",
+			persistence: "with-consent",
+			prompt: {
+				message: "Enter the R2 Secret Access Key",
+				type: "password"
+			}
+		},
+		workerName: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_WORKER_NAME",
+			help: "Worker name",
+			prompt: {
+				defaultValue: "hot-updater",
+				message: "Enter the name of the worker",
+				placeholder: "hot-updater",
+				type: "text"
+			}
+		},
+		d1DatabaseId: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID",
+			help: "D1 database ID"
+		},
+		d1DatabaseName: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_D1_DATABASE_NAME",
+			help: "D1 database name",
+			prompt: {
+				defaultValue: "hot-updater",
+				message: "Enter the name of the new D1 Database",
+				placeholder: "hot-updater",
+				type: "text"
+			}
+		},
+		r2Private: {
+			envKey: "HOT_UPDATER_CLOUDFLARE_R2_PRIVATE",
+			help: "Whether the R2 bucket is private (true or false)",
+			prompt: {
+				message: "Make R2 bucket private?",
+				type: "confirm"
+			},
+			validate: (value) => value === "true" || value === "false"
+		}
+	}
+};
+//#endregion
+//#region iac/cloudflareInitInputs.ts
+const shouldUpdateR2ManagedDomain = ({ isPrivate, managedDomainEnabled }) => managedDomainEnabled !== !isPrivate;
+const resolveR2Privacy = ({ createBucket, managedDomainEnabled, savedPrivateSetting }) => {
+	if (savedPrivateSetting === "true" || savedPrivateSetting === "false") return {
+		isPrivate: savedPrivateSetting === "true",
+		kind: "resolved"
+	};
+	if (!createBucket && managedDomainEnabled !== void 0) return {
+		isPrivate: !managedDomainEnabled,
+		kind: "resolved"
+	};
+	return { kind: "prompt" };
+};
+const resolveCloudflareInitInputs = (existingEnv) => {
+	const { inputs } = initProvider;
+	return {
+		accessKeyId: resolveInitProviderInput(existingEnv, inputs.accessKeyId),
+		accountId: resolveInitProviderInput(existingEnv, inputs.accountId),
+		apiToken: resolveInitProviderInput(existingEnv, inputs.apiToken),
+		bucketName: resolveInitProviderInput(existingEnv, inputs.bucketName),
+		d1DatabaseId: resolveInitProviderInput(existingEnv, inputs.d1DatabaseId),
+		d1DatabaseName: resolveInitProviderInput(existingEnv, inputs.d1DatabaseName),
+		r2Private: resolveInitProviderInput(existingEnv, inputs.r2Private),
+		secretAccessKey: resolveInitProviderInput(existingEnv, inputs.secretAccessKey),
+		workerName: resolveInitProviderInput(existingEnv, inputs.workerName)
+	};
+};
+const assertCloudflareNonInteractiveInputs = (inputs, nonInteractive) => {
+	assertInitProviderInputs({
+		inputs,
+		provider: initProvider,
+		strict: nonInteractive
+	});
+};
+//#endregion
+//#region iac/cloudflareInitSecrets.ts
+const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, accessKeyId, secretAccessKey, workerName, nonInteractive }) => {
+	const inputDefinitions = initProvider.inputs;
+	assertInitInputs({
+		inputs: {
+			[inputDefinitions.apiToken.envKey]: apiToken,
+			[inputDefinitions.accessKeyId.envKey]: accessKeyId,
+			[inputDefinitions.secretAccessKey.envKey]: secretAccessKey,
+			[inputDefinitions.workerName.envKey]: workerName
+		},
+		strict: nonInteractive
+	});
+	if (nonInteractive && apiToken && accessKeyId && secretAccessKey && workerName) return {
+		accessKeyId,
+		apiToken,
+		secretAccessKey,
+		workerName
+	};
+	if (!nonInteractive) {
+		p.log.step(`D1 API Token dashboard: ${link(`https://dash.cloudflare.com/${accountId}/api-tokens`)}`);
+		p.log.step(`Required permissions: ${CLOUDFLARE_INIT_PERMISSIONS.join(", ")}`);
+		p.log.step("Used by d1Database for bundle metadata writes.");
+	}
+	if (!nonInteractive) {
+		p.log.step(`R2 API Tokens dashboard: ${link(`https://dash.cloudflare.com/${accountId}/r2/api-tokens`)}`);
+		p.log.step("Required permission: Object Read & Write");
+		p.log.step(`Target bucket: ${bucketName}`);
+	}
+	return await p.group({
+		apiToken: () => nonInteractive && apiToken ? Promise.resolve(apiToken) : p.password({
+			message: inputDefinitions.apiToken.prompt.message,
+			validate: (value) => value ? void 0 : "Cloudflare API Token is required"
+		}),
+		accessKeyId: () => nonInteractive && accessKeyId ? Promise.resolve(accessKeyId) : p.password({
+			message: inputDefinitions.accessKeyId.prompt.message,
+			validate: (value) => value ? void 0 : "R2 Access Key ID is required"
+		}),
+		secretAccessKey: () => nonInteractive && secretAccessKey ? Promise.resolve(secretAccessKey) : p.password({
+			message: inputDefinitions.secretAccessKey.prompt.message,
+			validate: (value) => value ? void 0 : "R2 Secret Access Key is required"
+		}),
+		workerName: () => nonInteractive && workerName ? Promise.resolve(workerName) : p.text({
+			...getInitProviderTextPromptValues(inputDefinitions.workerName.prompt, workerName),
+			message: inputDefinitions.workerName.prompt.message,
+			validate: (value) => value ? void 0 : "Worker name is required"
+		})
+	}, { onCancel: () => process.exit(1) });
+};
+//#endregion
 //#region iac/index.ts
 const getConfigScaffold = (build) => {
 	return createHotUpdaterConfigScaffoldFromBuilder(new ConfigBuilder().setBuildType(build).setStorage({
@@ -10867,50 +11233,7 @@ export default HotUpdater.wrap({
   baseURL: "%%source%%",
   updateStrategy: "appVersion", // or "fingerprint"
 })(App);`;
-const HOT_UPDATER_ENV_PATH = ".env.hotupdater";
-const unquoteEnvValue = (value) => {
-	const trimmed = value.trim();
-	if (trimmed.startsWith("\"") && trimmed.endsWith("\"") || trimmed.startsWith("'") && trimmed.endsWith("'")) return trimmed.slice(1, -1);
-	return trimmed;
-};
-const readHotUpdaterEnv = async (cwd) => {
-	const envPath = path.join(cwd, HOT_UPDATER_ENV_PATH);
-	const content = await fs.readFile(envPath, "utf-8").catch(() => "");
-	const env = {};
-	for (const line of content.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
-		const [key, ...valueParts] = trimmed.split("=");
-		if (!key) continue;
-		env[key.trim()] = unquoteEnvValue(valueParts.join("="));
-	}
-	return env;
-};
-const getEnvValue = (env, key) => {
-	return process.env[key]?.trim() || env[key]?.trim() || void 0;
-};
-const inputR2ApiCredentials = async ({ accountId, bucketName, accessKeyId, secretAccessKey }) => {
-	p.log.step(`R2 API Tokens dashboard: ${link(`https://dash.cloudflare.com/${accountId}/r2/api-tokens`)}`);
-	p.log.step("Required permission: Object Read & Write");
-	p.log.step(`Target bucket: ${bucketName}`);
-	let resolvedAccessKeyId = accessKeyId;
-	if (!resolvedAccessKeyId) {
-		const inputR2AccessKeyId = await p.password({ message: "Enter the R2 Access Key ID" });
-		if (p.isCancel(inputR2AccessKeyId)) process.exit(1);
-		resolvedAccessKeyId = inputR2AccessKeyId;
-	}
-	let resolvedSecretAccessKey = secretAccessKey;
-	if (!resolvedSecretAccessKey) {
-		const inputR2SecretAccessKey = await p.password({ message: "Enter the R2 Secret Access Key" });
-		if (p.isCancel(inputR2SecretAccessKey)) process.exit(1);
-		resolvedSecretAccessKey = inputR2SecretAccessKey;
-	}
-	return {
-		accessKeyId: resolvedAccessKeyId,
-		secretAccessKey: resolvedSecretAccessKey
-	};
-};
-const deployWorker = async (oauth_token, accountId, { d1DatabaseId, d1DatabaseName, r2BucketName, workerName }) => {
+const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseId, d1DatabaseName, nonInteractive, r2BucketName, workerName }) => {
 	const cwd = getCwd();
 	const cloudflarePackagePath = __require.resolve("@hot-updater/cloudflare/package.json", { paths: [cwd] });
 	const { tmpDir, removeTmpDir } = await copyDirToTmp(path.dirname(cloudflarePackagePath));
@@ -10930,9 +11253,10 @@ const deployWorker = async (oauth_token, accountId, { d1DatabaseId, d1DatabaseNa
 		await fs.writeFile(path.join(workerRoot, "wrangler.json"), JSON.stringify(wranglerConfig, null, 2));
 		const wrangler = await createWrangler({
 			stdio: "inherit",
-			cloudflareApiToken: oauth_token,
+			cloudflareApiToken: apiToken,
 			cwd: workerRoot,
-			accountId
+			accountId,
+			nonInteractive
 		});
 		const migrationPath = await path.join(workerRoot, "migrations");
 		const migrationFiles = await fs.readdir(migrationPath);
@@ -10942,48 +11266,35 @@ const deployWorker = async (oauth_token, accountId, { d1DatabaseId, d1DatabaseNa
 			await fs.writeFile(filePath, transformTemplate(content, { BUCKET_NAME: r2BucketName }));
 		}
 		await wrangler("d1", "migrations", "apply", d1DatabaseName, "--remote");
-		let resolvedWorkerName = workerName;
-		if (resolvedWorkerName) p.log.info("Using existing Cloudflare Worker name.");
-		else {
-			const inputWorkerName = await p.text({
-				message: "Enter the name of the worker",
-				defaultValue: "hot-updater",
-				placeholder: "hot-updater"
-			});
-			if (p.isCancel(inputWorkerName)) process.exit(1);
-			resolvedWorkerName = inputWorkerName;
-		}
-		await wrangler("deploy", "--name", resolvedWorkerName);
-		return resolvedWorkerName;
+		await wrangler("deploy", "--name", workerName);
+		return workerName;
 	} catch (error) {
-		throw new Error("Failed to deploy worker", { cause: error });
+		if (error instanceof Error) throw toCloudflareDeploymentError(error, credentialSource);
+		throw new Error(String(error));
 	} finally {
 		await removeTmpDir();
 	}
 };
-const runInit = async ({ build }) => {
+const runInit = async ({ build, envFile }) => {
 	const cwd = getCwd();
-	const existingEnv = await readHotUpdaterEnv(cwd);
-	let auth = getWranglerLoginAuthToken();
-	if (!auth || (0, import_dayjs_min.default)(auth?.expiration_time).isBefore((0, import_dayjs_min.default)())) {
-		await execa("npx", [
-			"wrangler",
-			"login",
-			"--scopes",
-			"account:read",
-			"user:read",
-			"d1:write",
-			"workers:write",
-			"workers_scripts:write"
-		], { cwd });
-		auth = getWranglerLoginAuthToken();
-	}
-	if (!auth) throw new Error("'npx wrangler login' is required to use this command");
-	const cf = new Cloudflare({ apiToken: auth.oauth_token });
+	const nonInteractive = envFile !== void 0;
+	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile);
+	const { managedEnv } = initEnvSources;
+	const existingInputs = resolveCloudflareInitInputs(getHotUpdaterInitInputEnv(initEnvSources, nonInteractive));
+	assertCloudflareNonInteractiveInputs(existingInputs, nonInteractive);
+	const { accessKeyId: existingR2AccessKeyId, accountId: existingAccountId, apiToken: existingApiToken, bucketName: existingBucketName, d1DatabaseId: existingD1DatabaseId, d1DatabaseName: existingD1DatabaseName, r2Private: savedPrivateSetting, secretAccessKey: existingR2SecretAccessKey, workerName: existingWorkerName } = existingInputs;
+	const infrastructureCredentialSource = { kind: "wrangler-oauth" };
+	const infrastructureApiToken = await resolveCloudflareInfrastructureApiToken({
+		cwd,
+		nonInteractive
+	});
+	const cf = new Cloudflare({ apiToken: infrastructureApiToken });
 	const createKey = `create/${Math.random().toString(36).substring(2, 15)}`;
-	let accountId = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID");
-	if (accountId) p.log.info("Using existing Cloudflare account ID.");
-	else {
+	let accountId;
+	if (nonInteractive && existingAccountId) {
+		accountId = existingAccountId;
+		p.log.info("Using existing Cloudflare account ID.");
+	} else {
 		const accounts = [];
 		try {
 			await p.tasks([{
@@ -10995,12 +11306,15 @@ const runInit = async ({ build }) => {
 					})));
 				}
 			}]);
-		} catch (e) {
-			if (e instanceof Error) p.log.error(e.message);
-			throw e;
+		} catch (error) {
+			if (error instanceof Error) throw toCloudflareApiError(error, infrastructureCredentialSource);
+			throw new Error(String(error));
 		}
+		const savedAccount = accounts.find((account) => account.id === existingAccountId);
+		if (existingAccountId && !savedAccount) p.log.warn("Saved Cloudflare account was not found. Select an account again.");
 		const selectedAccountId = await p.select({
-			message: "Account List",
+			initialValue: savedAccount?.id ?? accounts[0]?.id,
+			message: initProvider.inputs.accountId.prompt.message,
 			options: accounts.map((account) => ({
 				value: account.id,
 				label: `${account.name} (${account.id})`
@@ -11009,103 +11323,60 @@ const runInit = async ({ build }) => {
 		if (p.isCancel(selectedAccountId)) process.exit(1);
 		accountId = selectedAccountId;
 	}
-	let apiToken = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_API_TOKEN");
-	if (apiToken) p.log.info("Using existing Cloudflare API token.");
-	else {
-		p.log.step(`D1 API Token dashboard: ${link(`https://dash.cloudflare.com/${accountId}/api-tokens`)}`);
-		p.log.step("Required permission: D1 Edit");
-		p.log.step("Used for bundle metadata writes after init.");
-		const inputApiToken = await p.password({ message: "Enter the D1 API Token" });
-		if (p.isCancel(inputApiToken)) process.exit(1);
-		apiToken = inputApiToken;
-		if (!apiToken) p.log.warn("Skipping API Token. You can set it later in .env HOT_UPDATER_CLOUDFLARE_API_TOKEN file.");
-	}
-	const existingBucketName = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME");
+	const availableBuckets = [];
+	try {
+		await p.tasks([{
+			title: "Checking R2 Buckets...",
+			task: async () => {
+				const buckets = (await cf.r2.buckets.list({ account_id: accountId })).buckets ?? [];
+				availableBuckets.push(...buckets.flatMap((bucket) => bucket.name ? [{ name: bucket.name }] : []));
+			}
+		}]);
+	} catch (error) {
+		if (error instanceof Error) throw toCloudflareApiError(error, infrastructureCredentialSource);
+		throw new Error(String(error));
+	}
+	const hasExistingBucket = availableBuckets.some((bucket) => bucket.name === existingBucketName);
+	let createBucket = false;
 	let selectedBucketName;
-	if (existingBucketName) {
+	if (nonInteractive && existingBucketName && hasExistingBucket) {
+		selectedBucketName = existingBucketName;
+		p.log.info("Using existing Cloudflare R2 bucket.");
+	} else if (nonInteractive && existingBucketName) {
 		selectedBucketName = existingBucketName;
-		p.log.info("Using existing Cloudflare R2 bucket name.");
+		createBucket = true;
 	} else {
-		const availableBuckets = [];
-		try {
-			await p.tasks([{
-				title: "Checking R2 Buckets...",
-				task: async () => {
-					const buckets = (await cf.r2.buckets.list({ account_id: accountId })).buckets ?? [];
-					availableBuckets.push(...buckets.filter((bucket) => bucket.name).map((bucket) => ({ name: bucket.name })));
-				}
-			}]);
-		} catch (e) {
-			if (e instanceof Error) p.log.error(e.message);
-			throw e;
-		}
-		if (availableBuckets.length === 1) {
-			selectedBucketName = availableBuckets[0].name;
-			p.log.info("Using the only Cloudflare R2 bucket.");
-		} else {
-			const selectedR2BucketName = await p.select({
-				message: "R2 List",
-				options: [...availableBuckets.map((bucket) => ({
-					value: bucket.name,
-					label: bucket.name
-				})), {
-					value: createKey,
-					label: "Create New R2 Bucket"
-				}]
+		if (existingBucketName && !hasExistingBucket) p.log.warn("Saved Cloudflare R2 bucket was not found. Select a bucket again.");
+		const selectedR2BucketName = await p.select({
+			initialValue: hasExistingBucket ? existingBucketName : availableBuckets[0]?.name,
+			message: "R2 List",
+			options: [...availableBuckets.map((bucket) => ({
+				value: bucket.name,
+				label: bucket.name
+			})), {
+				value: createKey,
+				label: "Create New R2 Bucket"
+			}]
+		});
+		if (p.isCancel(selectedR2BucketName)) process.exit(1);
+		if (selectedR2BucketName === createKey) {
+			const prompt = initProvider.inputs.bucketName.prompt;
+			const name = await p.text({
+				...getInitProviderTextPromptValues(prompt, existingBucketName),
+				message: prompt.message,
+				validate: (value) => value ? void 0 : "R2 bucket name is required"
 			});
-			if (p.isCancel(selectedR2BucketName)) process.exit(1);
-			selectedBucketName = selectedR2BucketName;
-		}
-		if (selectedBucketName === createKey) {
-			const name = await p.text({ message: "Enter the name of the new R2 Bucket" });
 			if (p.isCancel(name)) process.exit(1);
-			const newR2 = await cf.r2.buckets.create({
-				account_id: accountId,
-				name
-			});
-			if (!newR2.name) throw new Error("Failed to create new R2 Bucket");
-			selectedBucketName = newR2.name;
-		}
-	}
-	p.log.info(`Selected R2: ${selectedBucketName}`);
-	const existingR2AccessKeyId = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID");
-	const existingR2SecretAccessKey = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY");
-	let r2AccessKeyId = existingR2AccessKeyId;
-	let r2SecretAccessKey = existingR2SecretAccessKey;
-	if (r2AccessKeyId && r2SecretAccessKey) p.log.info("Using existing Cloudflare R2 API credentials.");
-	else if (r2AccessKeyId || r2SecretAccessKey) {
-		p.log.warn("Existing Cloudflare R2 API credentials are incomplete.");
-		const credentials = await inputR2ApiCredentials({
-			accountId,
-			bucketName: selectedBucketName,
-			accessKeyId: r2AccessKeyId,
-			secretAccessKey: r2SecretAccessKey
-		});
-		r2AccessKeyId = credentials.accessKeyId;
-		r2SecretAccessKey = credentials.secretAccessKey;
-	} else {
-		const credentials = await inputR2ApiCredentials({
-			accountId,
-			bucketName: selectedBucketName
-		});
-		r2AccessKeyId = credentials.accessKeyId;
-		r2SecretAccessKey = credentials.secretAccessKey;
+			selectedBucketName = name;
+			createBucket = true;
+		} else selectedBucketName = selectedR2BucketName;
 	}
-	if ((existingBucketName ? { enabled: false } : await cf.r2.buckets.domains.managed.list(selectedBucketName, { account_id: accountId })).enabled) {
-		if (await p.confirm({ message: "Make R2 bucket private?" })) try {
-			await p.tasks([{
-				title: "Making R2 bucket private...",
-				task: async () => {
-					await cf.r2.buckets.domains.managed.update(selectedBucketName, {
-						account_id: accountId,
-						enabled: false
-					});
-				}
-			}]);
-		} catch (e) {
-			if (e instanceof Error) p.log.error(e.message);
-			throw e;
-		}
+	let managedDomainEnabled;
+	if (!createBucket) try {
+		managedDomainEnabled = (await cf.r2.buckets.domains.managed.list(selectedBucketName, { account_id: accountId })).enabled;
+	} catch (error) {
+		if (error instanceof Error) throw toCloudflareApiError(error, infrastructureCredentialSource);
+		throw new Error(String(error));
 	}
 	const availableD1List = [];
 	try {
@@ -11113,25 +11384,38 @@ const runInit = async ({ build }) => {
 			title: "Checking D1 List...",
 			task: async () => {
 				const d1List = (await cf.d1.database.list({ account_id: accountId })).result ?? [];
-				availableD1List.push(...d1List.filter((d1) => d1.name || d1.uuid).map((d1) => ({
+				availableD1List.push(...d1List.flatMap((d1) => d1.name && d1.uuid ? [{
 					name: d1.name,
 					uuid: d1.uuid
-				})));
+				}] : []));
 			}
 		}]);
-	} catch (e) {
-		if (e instanceof Error) p.log.error(e.message);
-		throw e;
+	} catch (error) {
+		if (error instanceof Error) throw toCloudflareApiError(error, infrastructureCredentialSource);
+		throw new Error(String(error));
 	}
-	const existingD1DatabaseId = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID");
-	const hasExistingD1Database = availableD1List.some((d1) => d1.uuid === existingD1DatabaseId);
+	const existingD1Database = availableD1List.find((d1) => d1.uuid === existingD1DatabaseId || d1.name === existingD1DatabaseName);
+	let createD1Database = false;
 	let selectedD1DatabaseId;
-	if (existingD1DatabaseId && hasExistingD1Database) {
-		selectedD1DatabaseId = existingD1DatabaseId;
-		p.log.info("Using existing Cloudflare D1 database ID.");
+	let d1DatabaseName;
+	if (nonInteractive && existingD1DatabaseId && existingD1DatabaseName) {
+		const replayResolution = resolveCloudflareReplayD1Database({
+			availableDatabases: availableD1List,
+			databaseId: existingD1DatabaseId,
+			databaseName: existingD1DatabaseName
+		});
+		if (replayResolution.kind === "existing") {
+			selectedD1DatabaseId = replayResolution.database.uuid;
+			d1DatabaseName = replayResolution.database.name;
+			p.log.info("Using existing Cloudflare D1 database.");
+		} else {
+			createD1Database = true;
+			d1DatabaseName = replayResolution.name;
+		}
 	} else {
-		if (existingD1DatabaseId) p.log.warn("Existing Cloudflare D1 database ID was not found. Select a database again.");
+		if ((existingD1DatabaseId || existingD1DatabaseName) && !existingD1Database) p.log.warn("Existing Cloudflare D1 database ID was not found. Select a database again.");
 		const selectedD1 = await p.select({
+			initialValue: existingD1Database?.uuid ?? availableD1List[0]?.uuid,
 			message: "D1 List",
 			options: [...availableD1List.map((d1) => ({
 				value: d1.uuid,
@@ -11142,43 +11426,149 @@ const runInit = async ({ build }) => {
 			}]
 		});
 		if (p.isCancel(selectedD1)) process.exit(1);
-		selectedD1DatabaseId = selectedD1;
-	}
-	if (selectedD1DatabaseId === createKey) {
-		const name = await p.text({ message: "Enter the name of the new D1 Database" });
-		if (p.isCancel(name)) process.exit(1);
-		const newD1 = await cf.d1.database.create({
-			account_id: accountId,
-			name
+		if (selectedD1 === createKey) {
+			const prompt = initProvider.inputs.d1DatabaseName.prompt;
+			const name = await p.text({
+				...getInitProviderTextPromptValues(prompt, existingD1DatabaseName),
+				message: prompt.message,
+				validate: (value) => value ? void 0 : "D1 database name is required"
+			});
+			if (p.isCancel(name)) process.exit(1);
+			createD1Database = true;
+			d1DatabaseName = name;
+		} else {
+			const selectedDatabase = availableD1List.find((d1) => d1.uuid === selectedD1);
+			if (!selectedDatabase) throw new Error("Failed to get D1 Database");
+			selectedD1DatabaseId = selectedDatabase.uuid;
+			d1DatabaseName = selectedDatabase.name;
+			p.log.info(`Selected D1: ${selectedD1DatabaseId}`);
+		}
+	}
+	if (nonInteractive && existingR2AccessKeyId && existingR2SecretAccessKey) p.log.info("Using existing Cloudflare R2 API credentials.");
+	else if (nonInteractive && (existingR2AccessKeyId || existingR2SecretAccessKey)) p.log.warn("Existing Cloudflare R2 API credentials are incomplete.");
+	const { apiToken, accessKeyId, secretAccessKey, workerName } = await inputCloudflareInitSecrets({
+		accountId,
+		bucketName: selectedBucketName,
+		apiToken: existingApiToken,
+		accessKeyId: existingR2AccessKeyId,
+		secretAccessKey: existingR2SecretAccessKey,
+		workerName: existingWorkerName,
+		nonInteractive
+	});
+	const privacyResolution = resolveR2Privacy({
+		createBucket,
+		managedDomainEnabled,
+		savedPrivateSetting
+	});
+	const isPrivate = nonInteractive && privacyResolution.kind === "resolved" ? privacyResolution.isPrivate : await p.confirm({
+		message: initProvider.inputs.r2Private.prompt.message,
+		initialValue: privacyResolution.kind === "resolved" ? privacyResolution.isPrivate : true
+	});
+	if (p.isCancel(isPrivate)) process.exit(1);
+	const databaseCredentialSource = existingApiToken ? envFile ? {
+		envFile,
+		kind: "env-file"
+	} : { kind: "environment" } : { kind: "prompt" };
+	const credentialClient = new Cloudflare({ apiToken });
+	await validateCloudflareApiToken({
+		accountId,
+		probes: [{
+			check: "D1 database access",
+			request: () => credentialClient.d1.database.list({ account_id: accountId }),
+			requiredPermission: CLOUDFLARE_INIT_PERMISSION.d1
+		}],
+		source: databaseCredentialSource,
+		verify: () => verifyCloudflareApiTokenIdentity({
+			accountId,
+			apiToken,
+			verifyAccountToken: (selectedAccountId) => credentialClient.accounts.tokens.verify({ account_id: selectedAccountId }),
+			verifyUserToken: () => credentialClient.user.tokens.verify()
+		})
+	});
+	const resolvedInputs = {
+		...existingInputs,
+		accessKeyId,
+		accountId,
+		apiToken,
+		bucketName: selectedBucketName,
+		d1DatabaseId: selectedD1DatabaseId,
+		d1DatabaseName,
+		r2Private: String(isPrivate),
+		secretAccessKey,
+		workerName
+	};
+	await makeEnv({ ...getInitProviderEnvVars({
+		includeConsentInputs: await confirmInitInputPersistence({
+			existingEnv: managedEnv,
+			inputs: resolvedInputs,
+			nonInteractive,
+			provider: initProvider
+		}),
+		inputs: resolvedInputs,
+		provider: initProvider
+	}) });
+	if (createBucket) {
+		const newR2 = await runCloudflareApiRequest({
+			request: () => cf.r2.buckets.create({
+				account_id: accountId,
+				name: selectedBucketName
+			}),
+			source: infrastructureCredentialSource
 		});
-		if (!newD1.uuid || !newD1.name) throw new Error("Failed to create new D1 Database");
-		selectedD1DatabaseId = newD1.uuid;
-		availableD1List.push({
-			name: newD1.name,
-			uuid: newD1.uuid
+		if (!newR2.name) throw new Error("Failed to create new R2 Bucket");
+		p.log.info(`Created R2: ${newR2.name}`);
+		managedDomainEnabled = (await runCloudflareApiRequest({
+			request: () => cf.r2.buckets.domains.managed.list(selectedBucketName, { account_id: accountId }),
+			source: infrastructureCredentialSource
+		})).enabled;
+	} else p.log.info(`Selected R2: ${selectedBucketName}`);
+	if (managedDomainEnabled === void 0) throw new Error("Failed to resolve the R2 managed domain state.");
+	if (shouldUpdateR2ManagedDomain({
+		isPrivate,
+		managedDomainEnabled
+	})) await p.tasks([{
+		title: `Making R2 bucket ${isPrivate ? "private" : "public"}...`,
+		task: async () => {
+			await runCloudflareApiRequest({
+				request: () => cf.r2.buckets.domains.managed.update(selectedBucketName, {
+					account_id: accountId,
+					enabled: !isPrivate
+				}),
+				source: infrastructureCredentialSource
+			});
+		}
+	}]);
+	if (createD1Database) {
+		const newD1 = await runCloudflareApiRequest({
+			request: () => cf.d1.database.create({
+				account_id: accountId,
+				name: d1DatabaseName
+			}),
+			source: infrastructureCredentialSource
 		});
-		p.log.info(`Created new D1 Database: ${newD1.name} (${newD1.uuid})`);
-	} else p.log.info(`Selected D1: ${selectedD1DatabaseId}`);
-	const d1DatabaseName = availableD1List.find((d1) => d1.uuid === selectedD1DatabaseId)?.name;
-	if (!d1DatabaseName) throw new Error("Failed to get D1 Database name");
-	const subdomains = await cf.workers.subdomains.get({ account_id: accountId });
-	const existingWorkerName = getEnvValue(existingEnv, "HOT_UPDATER_CLOUDFLARE_WORKER_NAME");
-	const workerName = await deployWorker(auth.oauth_token, accountId, {
+		if (!newD1.uuid || !newD1.name) throw new Error("Failed to create the requested D1 Database");
+		selectedD1DatabaseId = newD1.uuid;
+		d1DatabaseName = newD1.name;
+		p.log.info(`Created D1 Database: ${newD1.name} (${newD1.uuid})`);
+	}
+	if (!selectedD1DatabaseId) throw new Error("Failed to resolve the D1 Database");
+	await makeEnv({
+		[initProvider.inputs.d1DatabaseId.envKey]: selectedD1DatabaseId,
+		[initProvider.inputs.d1DatabaseName.envKey]: d1DatabaseName
+	});
+	const subdomains = await runCloudflareApiRequest({
+		request: () => cf.workers.subdomains.get({ account_id: accountId }),
+		source: infrastructureCredentialSource
+	});
+	await deployWorker(infrastructureApiToken, accountId, {
+		credentialSource: infrastructureCredentialSource,
 		d1DatabaseId: selectedD1DatabaseId,
 		d1DatabaseName,
+		nonInteractive,
 		r2BucketName: selectedBucketName,
-		workerName: existingWorkerName
+		workerName
 	});
 	const configWriteResult = await writeHotUpdaterConfig(getConfigScaffold(build));
-	await makeEnv({
-		HOT_UPDATER_CLOUDFLARE_API_TOKEN: apiToken,
-		HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID: accountId,
-		HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME: selectedBucketName,
-		HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID: r2AccessKeyId,
-		HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY: r2SecretAccessKey,
-		HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID: selectedD1DatabaseId,
-		HOT_UPDATER_CLOUDFLARE_WORKER_NAME: workerName
-	});
 	p.log.success("Generated '.env.hotupdater' file with Cloudflare settings.");
 	if (configWriteResult.status === "created") p.log.success("Generated 'hot-updater.config.ts' file with Cloudflare settings.");
 	else if (configWriteResult.status === "merged") p.log.success("Updated 'hot-updater.config.ts' file with Cloudflare settings.");