@monoedge/jdu-cli 0.5.0 → 0.6.0

package/dist/cli.js

@@ -5,8 +5,8 @@ import path, { basename, dirname, extname, join, relative, resolve, sep } from "
 import fs, { chmodSync, createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import process$1 from "node:process";
 import { stripVTControlCharacters } from "node:util";
-import { createHash, randomBytes } from "node:crypto";
 import { homedir, hostname, tmpdir } from "node:os";
+import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { createInterface } from "node:readline";
 import { readFile, readdir } from "node:fs/promises";
@@ -2965,75 +2965,6 @@ function useColor() {
 }
 new Command();
 //#endregion
-//#region src/blobs.ts
-/** 流式算 hash，避免把大图整份读进内存。 */
-function sha256File(path) {
-	return new Promise((res, rej) => {
-		const h = createHash("sha256");
-		const rs = createReadStream(path);
-		rs.on("error", rej);
-		rs.on("data", (chunk) => h.update(chunk));
-		rs.on("end", () => res(h.digest("hex")));
-	});
-}
-var MIME$1 = Object.freeze({
-	".md": "text/markdown; charset=utf-8",
-	".markdown": "text/markdown; charset=utf-8",
-	".txt": "text/plain; charset=utf-8",
-	".json": "application/json",
-	".js": "text/javascript; charset=utf-8",
-	".mjs": "text/javascript; charset=utf-8",
-	".css": "text/css; charset=utf-8",
-	".html": "text/html; charset=utf-8",
-	".svg": "image/svg+xml",
-	".png": "image/png",
-	".jpg": "image/jpeg",
-	".jpeg": "image/jpeg",
-	".gif": "image/gif",
-	".webp": "image/webp",
-	".avif": "image/avif",
-	".ico": "image/x-icon",
-	".mp4": "video/mp4",
-	".webm": "video/webm",
-	".mov": "video/quicktime",
-	".mp3": "audio/mpeg",
-	".wav": "audio/wav",
-	".pdf": "application/pdf",
-	".zip": "application/zip",
-	".woff2": "font/woff2"
-});
-function guessMime(path) {
-	return MIME$1[extname(path).toLowerCase()] ?? "application/octet-stream";
-}
-/**
-* 增量上传：先用 hash 清单跟 server 协商，只 PUT 缺失的。
-* server 返回体不可解析时按「全都缺」处理 —— 宁可多传也不能漏传导致文档半残。
-*/
-async function syncBlobs(api, entries) {
-	const byHash = /* @__PURE__ */ new Map();
-	for (const e of entries) if (!byHash.has(e.hash)) byHash.set(e.hash, e.path);
-	const hashes = [...byHash.keys()];
-	if (hashes.length === 0) return {
-		total: 0,
-		uploaded: [],
-		reused: 0
-	};
-	const res = await api.postJson("/api/blobs/check", { hashes });
-	const missing = Array.isArray(res?.missing) ? res.missing.filter((h) => typeof h === "string") : hashes;
-	const uploaded = [];
-	for (const hash of missing) {
-		const path = byHash.get(hash);
-		if (path === void 0) continue;
-		await api.putBytes(`/api/blobs/${hash}`, readFileSync(path), guessMime(path));
-		uploaded.push(hash);
-	}
-	return {
-		total: hashes.length,
-		uploaded,
-		reused: hashes.length - uploaded.length
-	};
-}
-//#endregion
 //#region src/errors.ts
 /**
 * 面向用户的可读错误。
@@ -3241,6 +3172,31 @@ function configPath() {
 	const base = xdg && xdg.length > 0 ? xdg : join(homedir(), ".config");
 	return join(base, "jiandu", "config.json");
 }
+/**
+* `~/.config/jiandu/cf.json`：`jdu deploy` / `jdu access` 用的 Cloudflare 账号凭据
+* （OAuth 拿到的 access / refresh token + account id + 邮箱）。与站点凭据分开存，
+* 因为它是「这个 Cloudflare 账号」的钥匙，不属于任何一台简牍实例。
+*/
+function cfConfigPath() {
+	const xdg = process.env.XDG_CONFIG_HOME?.trim();
+	const base = xdg && xdg.length > 0 ? xdg : join(homedir(), ".config");
+	return join(base, "jiandu", "cf.json");
+}
+/** 缺文件返回空对象；解析失败一律当作没有（重新登录即可），不阻塞命令。 */
+function readCfConfig() {
+	try {
+		const parsed = JSON.parse(readFileSync(cfConfigPath(), "utf8"));
+		return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+function writeCfConfig(next) {
+	const path = cfConfigPath();
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 384 });
+	return path;
+}
 function readOidc(raw) {
 	if (raw === null || typeof raw !== "object") return void 0;
 	const obj = raw;
@@ -3272,6 +3228,7 @@ function readStoredConfig() {
 	const out = {};
 	if (typeof obj.server === "string") out.server = obj.server;
 	if (typeof obj.token === "string") out.token = obj.token;
+	if (obj.cfAccess === true) out.cfAccess = true;
 	if (typeof obj.user === "string") out.user = obj.user;
 	if (typeof obj.proxySecret === "string") out.proxySecret = obj.proxySecret;
 	const oidc = readOidc(obj.oidc);
@@ -3283,6 +3240,7 @@ function saveConfig(next) {
 	mkdirSync(dirname(path), { recursive: true });
 	const body = { server: next.server };
 	if (next.token !== void 0) body.token = next.token;
+	if (next.cfAccess === true) body.cfAccess = true;
 	if (next.user !== void 0) body.user = next.user;
 	if (next.proxySecret !== void 0) body.proxySecret = next.proxySecret;
 	if (next.oidc !== void 0) body.oidc = next.oidc;
@@ -3300,16 +3258,36 @@ function loadConfig() {
 	const cfg = {
 		server,
 		token: rawToken && rawToken.length > 0 ? rawToken : void 0,
+		...stored.cfAccess === true ? { cfAccess: true } : {},
 		user: user && user.length > 0 ? user : void 0,
 		proxySecret: proxySecret && proxySecret.length > 0 ? proxySecret : void 0
 	};
 	if (stored.oidc) cfg.oidc = stored.oidc;
 	return cfg;
 }
+/** 未验签地读 JWT 的 exp（只用于本地提前给出「去重新登录」的提示；验签永远在 server 侧）。 */
+function jwtExpiry(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts[1] === void 0) return null;
+	try {
+		const json = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+		const payload = JSON.parse(json);
+		const exp = payload !== null && typeof payload === "object" ? payload["exp"] : void 0;
+		return typeof exp === "number" ? exp * 1e3 : null;
+	} catch {
+		return null;
+	}
+}
 /** 运行时配置：没有显式 token 时，用已保存 / 环境变量里的 OIDC 客户端去续期。 */
 async function loadRuntimeConfig() {
 	const cfg = loadConfig();
-	if (cfg.token) return cfg;
+	if (cfg.token) {
+		if (cfg.cfAccess === true) {
+			const exp = jwtExpiry(cfg.token);
+			if (exp !== null && exp <= Date.now()) throw new CliError(`Cloudflare Access 会话已过期（${cfg.server}）`, `重新执行 jdu login --server ${cfg.server}，浏览器里的 Cloudflare 会话还在，点一下就续上`);
+		}
+		return cfg;
+	}
 	const issuer = cfg.oidc?.issuer ?? process.env["JIANDU_OIDC_ISSUER"]?.trim();
 	const clientId = cfg.oidc?.clientId ?? process.env["JIANDU_OIDC_CLIENT_ID"]?.trim();
 	if (!issuer || !clientId) return cfg;
@@ -3325,139 +3303,433 @@ async function loadRuntimeConfig() {
 	return cfg;
 }
 //#endregion
-//#region src/comments.ts
-/** 附件一行：`[图片 ×N] /blob/… /blob/…`，给 agent 的是相对路径，拼上 server 地址就能取 */
-function attachmentsLine(c) {
-	const list = c.attachments ?? [];
-	return list.length === 0 ? null : `[图片 ×${list.length}] ${list.map((s) => `/blob/${s}`).join(" ")}`;
+//#region src/cf-oauth.ts
+/**
+* Cloudflare 账号的 OAuth：`jdu deploy` / `jdu access` 拿一把能配 Access 的 token。
+*
+* 为什么不复用 `wrangler login` 的结果：wrangler 的 OAuth 客户端请求的 scope 里没有 Zero Trust，
+* 实测拿它的 token 打 `POST /accounts/<id>/access/apps` 是 `1010 auth.forbidden`。
+* Cloudflare 自己的 CLI OAuth 客户端（wrangler 包里以 `CLOUDFLARE_CLIENT_ID` 常量存在）
+* 的 scope 集合里有 `access:read` / `access:write`，专门干这件事。
+*
+* 这条路需要人在浏览器里点一次同意（与 `wrangler login` 同类）；想跳过就用
+* `--cf-token` 或 `CLOUDFLARE_API_TOKEN` 给一把带 Access 权限的 API token。
+*
+* 回调固定 `http://localhost:8877/oauth/callback`：OAuth 的 redirect_uri 是精确匹配的，
+* 不能用随机端口。PKCE（S256）保证 code 拿到也用不了。
+*/
+var CF_AUTH_URL = "https://dash.cloudflare.com/oauth2/auth";
+var CF_TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
+/** Cloudflare CLI（cf）的 OAuth 客户端；`CLOUDFLARE_CLIENT_ID` 可覆盖（测试 / 换客户端）。 */
+var CF_CLIENT_ID_ENV = "CLOUDFLARE_CLIENT_ID";
+var CF_CLIENT_ID_DEFAULT = "cbca97e7-c331-4cdd-8fd8-e25a451b98bf";
+/** OAuth 客户端里登记的回调地址，端口不能换。 */
+var CF_REDIRECT_URL = "http://localhost:8877/oauth/callback";
+var CF_CALLBACK_PORT = 8877;
+/**
+* 申请的 scope：Access 配置（access:read/write）＋ wrangler 部署同样的 Workers 面。
+* 这份 token 会以 `CLOUDFLARE_API_TOKEN` 交给 wrangler deploy，所以 workers 那几项不能少。
+*/
+var CF_SCOPES = [
+	"offline_access",
+	"user:read",
+	"account:read",
+	"access:read",
+	"access:write",
+	"workers:write",
+	"workers_scripts:write",
+	"workers_kv:write",
+	"workers_routes:write",
+	"workers_tail:read",
+	"d1:write",
+	"pages:write",
+	"zone:read"
+];
+function cfClientId(env = process.env) {
+	const fromEnv = env[CF_CLIENT_ID_ENV]?.trim();
+	return fromEnv && fromEnv.length > 0 ? fromEnv : CF_CLIENT_ID_DEFAULT;
 }
-var QUOTE_MAX = 120;
-function when(ms) {
-	return new Date(ms).toISOString().slice(0, 16).replace("T", " ");
+/** 浏览器授权码流程：开浏览器 → 本地回调收 code → 换 token。 */
+async function cfOAuthLogin(opts = {}) {
+	const { verifier, challenge } = pkce();
+	const state = randomBytes(16).toString("base64url");
+	const authURL = new URL(CF_AUTH_URL);
+	authURL.search = new URLSearchParams({
+		response_type: "code",
+		client_id: cfClientId(),
+		redirect_uri: CF_REDIRECT_URL,
+		scope: CF_SCOPES.join(" "),
+		state,
+		code_challenge: challenge,
+		code_challenge_method: "S256"
+	}).toString();
+	const tok = await tokenRequest(CF_TOKEN_URL, {
+		grant_type: "authorization_code",
+		code: await new Promise((resolve, reject) => {
+			const finish = (fn) => (value) => {
+				clearTimeout(timer);
+				server.close();
+				fn(value);
+			};
+			const fail = finish((msg) => reject(new CliError(msg, "不想开浏览器就用 --cf-token <token>（Cloudflare API token，需要 Access 权限）")));
+			const handler = callbackHandler(state, finish(resolve));
+			const server = createServer((req, res) => {
+				if (new URL(req.url ?? "/", "http://localhost").pathname !== "/oauth/callback") {
+					res.writeHead(404).end();
+					return;
+				}
+				handler(req, res);
+			});
+			const timer = setTimeout(() => fail("等待 Cloudflare 授权回调超时"), opts.timeoutMs ?? 3e5);
+			server.on("error", (err) => {
+				fail(`监听 ${CF_REDIRECT_URL} 失败（端口 8877 被占用？）：${err.message}`);
+			});
+			server.listen(CF_CALLBACK_PORT, "localhost", () => {
+				process.stderr.write(`在浏览器中授权 Cloudflare 账号：${authURL.toString()}\n`);
+				(opts.open ?? openBrowser)(authURL.toString());
+			});
+		}),
+		redirect_uri: CF_REDIRECT_URL,
+		client_id: cfClientId(),
+		code_verifier: verifier
+	});
+	return {
+		accessToken: tok.access_token,
+		refreshToken: tok.refresh_token,
+		expiry: tok.expiry
+	};
 }
-/** owner 是 UUID 且没有显示名时 authorLabel 为空串，退回原始 id 也比空着好认。 */
-function who(c) {
-	return `${c.authorLabel || c.author}${c.authorType === "ai" ? " [ai]" : ""}`;
+/** refresh token 换新 access token；失败返回 null（调用方回落成重新登录）。 */
+async function cfRefresh(refreshToken) {
+	try {
+		const tok = await tokenRequest(CF_TOKEN_URL, {
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: cfClientId()
+		});
+		return {
+			accessToken: tok.access_token,
+			refreshToken: tok.refresh_token ?? refreshToken,
+			expiry: tok.expiry
+		};
+	} catch {
+		return null;
+	}
 }
-function indent(text, pad) {
-	return text.split("\n").map((line) => `${pad}${line}`).join("\n");
+//#endregion
+//#region src/cf-api.ts
+/**
+* Cloudflare API 薄封装 + Access（Zero Trust）的幂等配置。`jdu deploy` 与 `jdu access` 共用。
+*
+* 只做两件事：把 `/client/v4` 的信封拆开（`{success, result, errors}` → 抛 CliError 或返回 result），
+* 以及把「建 team / 确保 Cloudflare IdP / upsert 保护 /p 的应用与邮箱策略」写成幂等函数。
+*
+* 凭据优先级：`--cf-token` / `CLOUDFLARE_API_TOKEN` > 本地缓存（~/.config/jiandu/cf.json）> 浏览器 OAuth。
+* 缓存的 access token 过期就用 refresh token 换；换不动就重跑 OAuth。
+*/
+var API = "https://api.cloudflare.com/client/v4";
+function firstError(body) {
+	const err = body.errors?.[0];
+	return {
+		code: err?.code ?? 0,
+		message: err?.message ?? err?.error ?? "未知错误"
+	};
+}
+/** 权限不够（Cloudflare 用 1010/10000/9109 表达）时给一句能干的话，别让人对着裸错误码发愣。 */
+function hintFor(status, code) {
+	if (code === 1010 || code === 9109 || code === 1e4 && status === 403) return "这把 token 没有 Zero Trust（Access）权限：用浏览器登录一次 jdu deploy，或 --cf-token 给一把带「Access: Apps and Policies / Organizations, Identity Providers and Groups」编辑权限的 API token";
+	if (status === 401) return "Cloudflare 凭据已失效：重新执行 jdu deploy（会打开浏览器授权）";
+}
+var CfApi = class {
+	credentials;
+	onTokens;
+	fetchImpl;
+	constructor(opts) {
+		this.credentials = opts.credentials;
+		this.onTokens = opts.onTokens;
+		this.fetchImpl = opts.fetchImpl ?? ((input, init) => fetch(input, init));
+	}
+	get accountId() {
+		return this.credentials.accountId;
+	}
+	get email() {
+		return this.credentials.email;
+	}
+	get tokens() {
+		return this.credentials.tokens;
+	}
+	/** 401 时用 refresh token 续一次再重试；续不动就抛错让人重新登录。 */
+	async request(method, path, body) {
+		let res = await this.send(method, path, body);
+		if (res.status === 401 && this.credentials.tokens.refreshToken) {
+			const refreshed = await cfRefresh(this.credentials.tokens.refreshToken);
+			if (refreshed) {
+				this.credentials.tokens = refreshed;
+				this.onTokens?.(refreshed);
+				res = await this.send(method, path, body);
+			}
+		}
+		const text = await res.text();
+		let parsed = {};
+		try {
+			parsed = JSON.parse(text);
+		} catch {}
+		if (!res.ok || parsed.success === false) {
+			const err = firstError(parsed);
+			const detail = err.message !== "未知错误" ? err.message : text.slice(0, 200);
+			throw new CliError(`Cloudflare API ${method} ${path} 失败（HTTP ${res.status}${err.code ? `，code ${err.code}` : ""}）：${detail}`, hintFor(res.status, err.code));
+		}
+		return parsed.result;
+	}
+	send(method, path, body) {
+		return this.fetchImpl(`${API}${path}`, {
+			method,
+			headers: {
+				authorization: `Bearer ${this.credentials.tokens.accessToken}`,
+				...body === void 0 ? {} : { "content-type": "application/json" }
+			},
+			...body === void 0 ? {} : { body: JSON.stringify(body) }
+		});
+	}
+};
+function isFresh(tokens) {
+	const at = Date.parse(tokens.expiry);
+	return Number.isFinite(at) && at - 6e4 > Date.now();
 }
 /**
-* 线程列表。stdout 纯文本、一线程一段，给 agent 直接读：
-* 首行 `<threadId>  <blockId>  <open|resolved>  <作者>  <时间>  [v<seq>]`，引文一行 `> …`，正文缩进两格，回复 `↳` 缩进。
+* 拿一份能调 Cloudflare API 的凭据。`--cf-token` / 环境变量优先（CI / 已有 API token 的人），
+* 其次本地缓存（过期先 refresh），最后才开浏览器走 OAuth。
+*
+* 拿到 token 后顺手把 account id / 邮箱补齐（API token 本身不带这两个信息）：
+* 后续所有 API 路径都要 account id，`jdu access` 也就不需要再问。
 */
-async function listComments(api, docId, opts) {
-	const res = await api.getJson(`/api/docs/${encodeURIComponent(docId)}/comments`);
-	const all = Array.isArray(res?.comments) ? res.comments : [];
-	const roots = all.filter((c) => c.parentId === null && (opts.all || !c.resolved));
-	if (roots.length === 0) {
-		process.stdout.write(`${opts.all ? "(无评论)" : "(无未处理评论)"}\n`);
-		return;
+async function resolveCfCredentials(opts) {
+	const env = opts.env ?? process.env;
+	const given = (opts.cfToken ?? env["JIANDU_CF_TOKEN"] ?? env["CLOUDFLARE_API_TOKEN"] ?? "").trim();
+	const stored = readCfConfig();
+	let source = "oauth";
+	let tokens;
+	if (given !== "") {
+		tokens = {
+			accessToken: given,
+			expiry: new Date(Date.now() + 31536e6).toISOString()
+		};
+		source = "flag";
+	} else {
+		const cached = tokensOf(stored);
+		if (cached && isFresh(cached)) {
+			tokens = cached;
+			source = "cache";
+		} else if (cached?.refreshToken) {
+			const refreshed = await cfRefresh(cached.refreshToken);
+			if (refreshed) {
+				tokens = refreshed;
+				source = "cache";
+				writeCfConfig({
+					...stored,
+					...serialize(refreshed)
+				});
+			}
+		}
 	}
-	const replies = /* @__PURE__ */ new Map();
-	for (const c of all) {
-		if (c.parentId === null) continue;
-		const list = replies.get(c.parentId) ?? [];
-		list.push(c);
-		replies.set(c.parentId, list);
+	if (tokens === void 0) {
+		if (opts.allowBrowser === false) throw new CliError("没有可用的 Cloudflare 凭据（本地缓存过期，也没给 --cf-token）", "传 --cf-token <token>（带 Access 权限的 Cloudflare API token），或不带 --json 跑一次让浏览器授权");
+		tokens = await cfOAuthLogin(opts.open ? { open: opts.open } : {});
+		writeCfConfig({
+			...readCfConfig(),
+			...serialize(tokens)
+		});
+	}
+	const credentials = {
+		accountId: stored.accountId ?? "",
+		email: stored.email ?? "",
+		tokens,
+		source
+	};
+	if (credentials.accountId === "" || credentials.email === "") {
+		const identity = await readIdentity(new CfApi({
+			credentials,
+			...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}
+		}));
+		credentials.accountId = identity.accountId;
+		credentials.email = identity.email;
+		writeCfConfig({
+			...readCfConfig(),
+			accountId: identity.accountId,
+			email: identity.email
+		});
 	}
+	return credentials;
+}
+function tokensOf(stored) {
+	if (typeof stored.accessToken !== "string" || stored.accessToken === "") return null;
+	const tokens = {
+		accessToken: stored.accessToken,
+		expiry: typeof stored.expiry === "string" ? stored.expiry : ""
+	};
+	if (typeof stored.refreshToken === "string" && stored.refreshToken !== "") tokens.refreshToken = stored.refreshToken;
+	return tokens;
+}
+function serialize(tokens) {
+	const out = {
+		accessToken: tokens.accessToken,
+		expiry: tokens.expiry
+	};
+	if (tokens.refreshToken !== void 0) out.refreshToken = tokens.refreshToken;
+	return out;
+}
+/** `GET /user` + `GET /accounts`：只认第一个账号（个人自部署形态就是单人单账号）。 */
+async function readIdentity(api) {
+	const user = await api.request("GET", "/user");
+	const accountId = (await api.request("GET", "/accounts")).find((a) => typeof a.id === "string" && a.id !== "")?.id ?? "";
+	const email = user.email ?? "";
+	if (accountId === "") throw new CliError("读不到 Cloudflare account id", "GET /accounts 返回空");
+	if (email === "") throw new CliError("读不到 Cloudflare 账号邮箱", "GET /user 没有 email");
+	return {
+		accountId,
+		email: email.toLowerCase()
+	};
+}
+/** 应用策略里所有 email 规则（`{email:{email}}`），小写去重、保持原顺序。 */
+function emailsOf(policy) {
 	const out = [];
-	for (const root of roots) {
-		const head = [
-			root.id,
-			root.blockId ?? "全文",
-			root.resolved ? "resolved" : "open",
-			who(root),
-			when(root.createdAt)
-		];
-		if (root.versionSeq !== null) head.push(`v${root.versionSeq}`);
-		out.push(head.join("  "));
-		const quote = root.selection?.quote;
-		if (quote) out.push(`  > ${quote.length > QUOTE_MAX ? `${quote.slice(0, QUOTE_MAX)}…` : quote}`);
-		if (root.body) out.push(indent(root.body, "  "));
-		const rootPics = attachmentsLine(root);
-		if (rootPics) out.push(`  ${rootPics}`);
-		for (const reply of replies.get(root.id) ?? []) {
-			out.push(`  ↳ ${reply.id}  ${who(reply)}  ${when(reply.createdAt)}`);
-			if (reply.body) out.push(indent(reply.body, "    "));
-			const pics = attachmentsLine(reply);
-			if (pics) out.push(`    ${pics}`);
-		}
-		out.push("");
+	for (const rule of policy.include ?? []) {
+		if (typeof rule !== "object" || rule === null) continue;
+		const email = rule.email?.email;
+		if (typeof email !== "string") continue;
+		const normalized = email.trim().toLowerCase();
+		if (normalized !== "" && !out.includes(normalized)) out.push(normalized);
 	}
-	process.stdout.write(out.join("\n"));
+	return out;
 }
-async function replyComment(api, threadId, opts) {
-	const res = await api.postJson(`/api/comments/${encodeURIComponent(threadId)}/reply`, {
-		body: opts.message,
-		authorType: opts.ai ? "ai" : "human"
+/** 保留策略里非 email 的规则（人手加的账号成员选择器等），只重写 email 那部分。 */
+function nonEmailRules(policy) {
+	return (policy.include ?? []).filter((rule) => {
+		if (typeof rule !== "object" || rule === null) return true;
+		return !("email" in rule);
 	});
-	process.stdout.write(`replied ${String(res?.parentId ?? threadId)} → ${String(res?.id ?? "")}\n`);
 }
-async function resolveComment(api, threadId, opts) {
-	const res = await api.postJson(`/api/comments/${encodeURIComponent(threadId)}/resolve`, { resolved: !opts.undo });
-	process.stdout.write(`${opts.undo ? "reopened" : "resolved"} ${String(res?.id ?? threadId)}\n`);
+function emailRules(emails) {
+	return emails.map((email) => ({ email: { email } }));
+}
+/** 建好的应用认领方式：先按 host 的 `/p` 目标认，认不到再按名字。 */
+function appMatchesHost(app, host) {
+	if ((app.destinations ?? []).map((d) => d.uri ?? "").some((uri) => uri.startsWith(`${host}/p`))) return true;
+	return app.domain === `${host}/p` || app.domain === host;
+}
+async function listApps(api) {
+	return await api.request("GET", `/accounts/${api.accountId}/access/apps`);
+}
+async function findAppForHost(api, host) {
+	return (await listApps(api)).find((app) => appMatchesHost(app, host)) ?? null;
+}
+async function appPolicies(api, appId) {
+	return await api.request("GET", `/accounts/${api.accountId}/access/apps/${appId}/policies`);
+}
+/** 直接改策略的 include（保留其它规则与 decision / name）。 */
+async function setPolicyEmails(api, appId, policy, emails) {
+	await api.request("PUT", `/accounts/${api.accountId}/access/apps/${appId}/policies/${policy.id}`, {
+		name: policy.name ?? "jiandu",
+		decision: policy.decision ?? "allow",
+		include: [...emailRules(emails), ...nonEmailRules(policy)]
+	});
+}
+async function getOrganization(api) {
+	try {
+		return await api.request("GET", `/accounts/${api.accountId}/access/organizations`);
+	} catch {
+		return null;
+	}
 }
-//#endregion
-//#region src/browser-auth.ts
 /**
-* jdu login 的浏览器授权（#66）：本机起一个 loopback 回调，打开 server 下发的 authorizeUrl，
-* 人在浏览器里用 passkey 会话点一次「授权」，回跳带回一次性 code，再用 PKCE verifier 向 server 换 token。
-*
-* authorizeUrl 与 server 可能不同源（CLI 连 127.0.0.1:18082，浏览器开 https://md.mason.local）——
-* 浏览器去前者，code 换 token 打后者。回调端口随机（server 接受任意 loopback 端口），不和 OIDC 的 8085 抢。
+* 账号还没有 Zero Trust team 时建一个。auth_domain 要全局唯一，撞了就换一个后缀重试。
+* 名字里的 account id 前缀足够区分，撞名是极小概率，但撞了不能让整个部署挂在这里。
 */
-async function browserAuthorize(input) {
-	const { verifier, challenge } = pkce();
-	const state = randomBytes(16).toString("base64url");
-	const code = await new Promise((resolve, reject) => {
-		const finish = (fn) => (value) => {
-			clearTimeout(timer);
-			server.close();
-			fn(value);
-		};
-		const fail = finish((msg) => reject(new CliError(msg, "重新执行 jdu login；不想开浏览器就带 --token")));
-		const handler = callbackHandler(state, finish(resolve));
-		const server = createServer((req, res) => {
-			if (new URL(req.url ?? "/", "http://localhost").pathname !== "/callback") {
-				res.writeHead(404).end();
-				return;
-			}
-			handler(req, res);
-		});
-		const timer = setTimeout(() => fail("等待浏览器授权超时"), input.timeoutMs ?? 18e4);
-		server.on("error", (err) => fail(`监听 loopback 回调失败：${err.message}`));
-		server.listen(0, "127.0.0.1", () => {
-			const port = server.address().port;
-			const url = new URL(input.authorizeUrl);
-			url.search = new URLSearchParams({
-				state,
-				code_challenge: challenge,
-				port: String(port),
-				label: input.label ?? hostname()
-			}).toString();
-			process.stderr.write(`在浏览器中完成授权：${url.toString()}\n`);
-			(input.open ?? openBrowser)(url.toString());
+async function ensureOrganization(api, workerName) {
+	const domain = (await getOrganization(api))?.auth_domain;
+	if (typeof domain === "string" && domain !== "") return domain;
+	const base = `${workerName}-${api.accountId.slice(0, 8)}`.replace(/[^a-z0-9-]/gi, "-").toLowerCase();
+	for (const candidate of [base, `${base}-${Date.now().toString(36).slice(-4)}`]) try {
+		const created = await api.request("POST", `/accounts/${api.accountId}/access/organizations`, {
+			name: workerName,
+			auth_domain: candidate
 		});
+		if (typeof created.auth_domain === "string" && created.auth_domain !== "") return created.auth_domain;
+	} catch (err) {
+		const again = await getOrganization(api);
+		if (typeof again?.auth_domain === "string" && again.auth_domain !== "") return again.auth_domain;
+		if (candidate.endsWith("4")) throw err;
+	}
+	throw new CliError("建 Zero Trust team 失败", "去 Cloudflare 控制台 Zero Trust 里手建一个 team 再重试");
+}
+/** 登录方式必须是 Cloudflare 账号（决策 8）：没有就建一个，已存在就用它。 */
+async function ensureCloudflareIdp(api) {
+	const hit = (await api.request("GET", `/accounts/${api.accountId}/access/identity_providers`)).find((p) => p.type === "cloudflare");
+	if (hit) return hit.id;
+	return (await api.request("POST", `/accounts/${api.accountId}/access/identity_providers`, {
+		name: "Cloudflare",
+		type: "cloudflare",
+		config: { restrict_to_account_members: false }
+	})).id;
+}
+/**
+* 保护 `/p*` 的应用：没有就建，有就保证部署者邮箱在策略里（其余邮箱保留）。
+* 只挡 /p：公开页（/d、/docs、/official、静态资源）与读 API 都不挂 Access，
+* 写 API 由 Worker 自己验同一份 JWT——理由见 docs/deploy.md「Cloudflare 形态」。
+*/
+async function ensureAccessApp(api, input) {
+	const destinations = [{
+		type: "public",
+		uri: `${input.host}/p`
+	}, {
+		type: "public",
+		uri: `${input.host}/p/*`
+	}];
+	const existing = await findAppForHost(api, input.host);
+	const app = existing ?? await api.request("POST", `/accounts/${api.accountId}/access/apps`, {
+		name: input.name,
+		type: "self_hosted",
+		destinations,
+		session_duration: "24h",
+		allowed_idps: [input.idpId],
+		auto_redirect_to_identity: true,
+		skip_interstitial: true,
+		app_launcher_visible: false
 	});
-	const res = await fetch(`${input.server}/api/cli/token`, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({
-			code,
-			code_verifier: verifier
-		})
+	const policies = await appPolicies(api, app.id);
+	const policy = policies.find((p) => (p.decision ?? "allow") === "allow") ?? policies[0];
+	const current = policy ? emailsOf(policy) : [];
+	const wanted = ensureEmailIncluded(current, input.emails);
+	if (policy) {
+		if (wanted.length !== current.length || wanted.some((e, i) => current[i] !== e)) await setPolicyEmails(api, app.id, policy, wanted);
+	} else await api.request("POST", `/accounts/${api.accountId}/access/apps/${app.id}/policies`, {
+		name: input.name,
+		decision: "allow",
+		include: emailRules(wanted)
 	});
-	const text = await res.text();
-	if (!res.ok) throw new CliError(`code 换 token 失败（HTTP ${res.status}）：${text.slice(0, 200)}`, "重新执行 jdu login 再试一次");
-	let token;
+	return {
+		app,
+		emails: wanted,
+		existed: existing !== null
+	};
+}
+/** 合并邮箱：保序去重，且保证部署者邮箱一定在。 */
+function ensureEmailIncluded(current, wanted) {
+	const out = [...current];
+	for (const email of wanted) {
+		const normalized = email.trim().toLowerCase();
+		if (normalized !== "" && !out.includes(normalized)) out.push(normalized);
+	}
+	return out;
+}
+/** `GET /accounts/:id/workers/subdomain`：拿不到（账号还没注册 workers.dev 子域）返回 null。 */
+async function workersDevSubdomain(api) {
 	try {
-		token = JSON.parse(text).token;
+		const result = await api.request("GET", `/accounts/${api.accountId}/workers/subdomain`);
+		return typeof result.subdomain === "string" && result.subdomain !== "" ? result.subdomain : null;
 	} catch {
-		token = void 0;
+		return null;
 	}
-	if (typeof token !== "string" || token === "") throw new CliError("server 没有返回 token");
-	return token;
 }
 //#endregion
 //#region src/login.ts
@@ -3495,6 +3767,13 @@ async function probeApiWithBearer(server, token) {
 		redirect: "manual"
 	})).ok;
 }
+/** Cloudflare 形态的凭据是 Access 应用 token：过边缘用 cf-access-token 头，不是 Bearer。 */
+async function probeApiWithAccessToken(server, token) {
+	return (await fetch(`${server}/api/docs`, {
+		headers: { "cf-access-token": token },
+		redirect: "manual"
+	})).ok;
+}
 /**
 * forward-auth / OIDC 分支，外加 --user 直连与 --token 直存。
 * 不是命令入口——入口是 init.ts 的 runLogin，它探完 healthz 才分派到这里。
@@ -3560,6 +3839,302 @@ async function runOidcLogin(opts) {
 	};
 }
 //#endregion
+//#region src/access.ts
+/**
+* `jdu access`：改 Cloudflare 形态实例的准入——Access 策略里的邮箱列表。
+*
+* 加人 = 把同事的邮箱写进 Allow 策略，对方用自己的 Cloudflare 账号（同一邮箱）登录；
+* 减人 = 从策略里去掉。jiandu 自己不存成员表，身份与准入只有 Access 这一个真源（决策 5）。
+*
+* 需要一把有 Access 权限的 Cloudflare 凭据：`jdu deploy` 时授权过就直接用缓存，
+* 否则 `--cf-token` / `CLOUDFLARE_API_TOKEN`，再不行会开浏览器授权。
+*/
+var EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+function normalizeEmails(emails) {
+	const out = [];
+	for (const raw of emails) {
+		const email = raw.trim().toLowerCase();
+		if (email === "") continue;
+		if (!EMAIL_RE.test(email)) throw new CliError(`不是合法的邮箱：${raw}`, "邮箱要和对方的 Cloudflare 账号一致");
+		if (!out.includes(email)) out.push(email);
+	}
+	return out;
+}
+/** 站点地址：显式给的优先，其次本地配置里的那台。 */
+function serverOf(opts) {
+	const server = (opts.server ?? readStoredConfig().server ?? "").trim().replace(/\/+$/, "");
+	if (server === "") throw new CliError("需要知道改哪台实例的 Access 策略", "带 --server <url>，或先 jdu login --server <url>");
+	return server;
+}
+/** 只有 Cloudflare 形态的实例有 Access 策略；其它 provider 说清而不是给个看不懂的 API 错误。 */
+async function ensureCloudflareInstance(server) {
+	const healthz = await fetchHealthz(server);
+	if (healthz.authProvider !== "cloudflare-access") throw new CliError(`${server} 是 ${healthz.authProvider ?? "未知"} 鉴权，没有 Access 邮箱策略`, "Docker / 本机形态的准入用 jdu member invite（passkey）或网关自己的配置");
+}
+async function locate(opts) {
+	const server = serverOf(opts);
+	await ensureCloudflareInstance(server);
+	const host = new URL(server).host;
+	const api = new CfApi({ credentials: await resolveCfCredentials({ ...opts.cfToken ? { cfToken: opts.cfToken } : {} }) });
+	const app = await findAppForHost(api, host);
+	if (!app) throw new CliError(`${host} 上没有找到 jiandu 的 Access 应用`, "确认实例是用 jdu deploy 部出来的（Access 应用由它建），或去 Zero Trust → Access 看一眼");
+	const policies = await api.request("GET", `/accounts/${api.accountId}/access/apps/${app.id}/policies`);
+	const policy = policies.find((p) => (p.decision ?? "allow") === "allow") ?? policies[0];
+	if (!policy) throw new CliError(`${host} 的 Access 应用没有策略`, "去 Zero Trust → Access 里给它加一条 Allow 策略再重试");
+	return {
+		api,
+		appId: app.id,
+		policyId: policy.id,
+		emails: emailsOf(policy)
+	};
+}
+async function runAccessList(opts) {
+	const { api, appId, emails } = await locate(opts);
+	return {
+		server: serverOf(opts),
+		accountId: api.accountId,
+		appId,
+		emails
+	};
+}
+/** 加邮箱：先把现有的读回来，确保对方不在列表里再加（幂等）。 */
+async function runAccessAllow(emails, opts) {
+	const wanted = normalizeEmails(emails);
+	if (wanted.length === 0) throw new CliError("没有要加的邮箱", "jdu access allow <邮箱> [<邮箱>...]");
+	const { api, appId, policyId, emails: current } = await locate(opts);
+	const merged = ensureEmailIncluded(current, wanted);
+	if (merged.length !== current.length || merged.some((e, i) => current[i] !== e)) await putEmails(api, appId, policyId, merged);
+	return {
+		server: serverOf(opts),
+		accountId: api.accountId,
+		appId,
+		emails: merged
+	};
+}
+async function runAccessDeny(emails, opts) {
+	const unwanted = normalizeEmails(emails);
+	if (unwanted.length === 0) throw new CliError("没有要移除的邮箱", "jdu access deny <邮箱> [<邮箱>...]");
+	const { api, appId, policyId, emails: current } = await locate(opts);
+	const kept = current.filter((email) => !unwanted.includes(email));
+	const missing = unwanted.filter((email) => !current.includes(email));
+	if (missing.length > 0) throw new CliError(`这些邮箱本来就不在策略里：${missing.join(", ")}`, "用 jdu access list 看当前名单（大小写不敏感）");
+	await putEmails(api, appId, policyId, kept);
+	return {
+		server: serverOf(opts),
+		accountId: api.accountId,
+		appId,
+		emails: kept
+	};
+}
+/** 重写策略的 include：email 规则用新名单，其它规则（人手加的账号成员选择器等）原样保留。 */
+async function putEmails(api, appId, policyId, emails) {
+	await setPolicyEmails(api, appId, await api.request("GET", `/accounts/${api.accountId}/access/apps/${appId}/policies/${policyId}`), emails);
+}
+//#endregion
+//#region src/blobs.ts
+/** 流式算 hash，避免把大图整份读进内存。 */
+function sha256File(path) {
+	return new Promise((res, rej) => {
+		const h = createHash("sha256");
+		const rs = createReadStream(path);
+		rs.on("error", rej);
+		rs.on("data", (chunk) => h.update(chunk));
+		rs.on("end", () => res(h.digest("hex")));
+	});
+}
+var MIME$1 = Object.freeze({
+	".md": "text/markdown; charset=utf-8",
+	".markdown": "text/markdown; charset=utf-8",
+	".txt": "text/plain; charset=utf-8",
+	".json": "application/json",
+	".js": "text/javascript; charset=utf-8",
+	".mjs": "text/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".html": "text/html; charset=utf-8",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".webp": "image/webp",
+	".avif": "image/avif",
+	".ico": "image/x-icon",
+	".mp4": "video/mp4",
+	".webm": "video/webm",
+	".mov": "video/quicktime",
+	".mp3": "audio/mpeg",
+	".wav": "audio/wav",
+	".pdf": "application/pdf",
+	".zip": "application/zip",
+	".woff2": "font/woff2"
+});
+function guessMime(path) {
+	return MIME$1[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+/**
+* 增量上传：先用 hash 清单跟 server 协商，只 PUT 缺失的。
+* server 返回体不可解析时按「全都缺」处理 —— 宁可多传也不能漏传导致文档半残。
+*/
+async function syncBlobs(api, entries) {
+	const byHash = /* @__PURE__ */ new Map();
+	for (const e of entries) if (!byHash.has(e.hash)) byHash.set(e.hash, e.path);
+	const hashes = [...byHash.keys()];
+	if (hashes.length === 0) return {
+		total: 0,
+		uploaded: [],
+		reused: 0
+	};
+	const res = await api.postJson("/api/blobs/check", { hashes });
+	const missing = Array.isArray(res?.missing) ? res.missing.filter((h) => typeof h === "string") : hashes;
+	const uploaded = [];
+	for (const hash of missing) {
+		const path = byHash.get(hash);
+		if (path === void 0) continue;
+		await api.putBytes(`/api/blobs/${hash}`, readFileSync(path), guessMime(path));
+		uploaded.push(hash);
+	}
+	return {
+		total: hashes.length,
+		uploaded,
+		reused: hashes.length - uploaded.length
+	};
+}
+//#endregion
+//#region src/comments.ts
+/** 附件一行：`[图片 ×N] /blob/… /blob/…`，给 agent 的是相对路径，拼上 server 地址就能取 */
+function attachmentsLine(c) {
+	const list = c.attachments ?? [];
+	return list.length === 0 ? null : `[图片 ×${list.length}] ${list.map((s) => `/blob/${s}`).join(" ")}`;
+}
+var QUOTE_MAX = 120;
+function when(ms) {
+	return new Date(ms).toISOString().slice(0, 16).replace("T", " ");
+}
+/** owner 是 UUID 且没有显示名时 authorLabel 为空串，退回原始 id 也比空着好认。 */
+function who(c) {
+	return `${c.authorLabel || c.author}${c.authorType === "ai" ? " [ai]" : ""}`;
+}
+function indent(text, pad) {
+	return text.split("\n").map((line) => `${pad}${line}`).join("\n");
+}
+/**
+* 线程列表。stdout 纯文本、一线程一段，给 agent 直接读：
+* 首行 `<threadId>  <blockId>  <open|resolved>  <作者>  <时间>  [v<seq>]`，引文一行 `> …`，正文缩进两格，回复 `↳` 缩进。
+*/
+async function listComments(api, docId, opts) {
+	const res = await api.getJson(`/api/docs/${encodeURIComponent(docId)}/comments`);
+	const all = Array.isArray(res?.comments) ? res.comments : [];
+	const roots = all.filter((c) => c.parentId === null && (opts.all || !c.resolved));
+	if (roots.length === 0) {
+		process.stdout.write(`${opts.all ? "(无评论)" : "(无未处理评论)"}\n`);
+		return;
+	}
+	const replies = /* @__PURE__ */ new Map();
+	for (const c of all) {
+		if (c.parentId === null) continue;
+		const list = replies.get(c.parentId) ?? [];
+		list.push(c);
+		replies.set(c.parentId, list);
+	}
+	const out = [];
+	for (const root of roots) {
+		const head = [
+			root.id,
+			root.blockId ?? "全文",
+			root.resolved ? "resolved" : "open",
+			who(root),
+			when(root.createdAt)
+		];
+		if (root.versionSeq !== null) head.push(`v${root.versionSeq}`);
+		out.push(head.join("  "));
+		const quote = root.selection?.quote;
+		if (quote) out.push(`  > ${quote.length > QUOTE_MAX ? `${quote.slice(0, QUOTE_MAX)}…` : quote}`);
+		if (root.body) out.push(indent(root.body, "  "));
+		const rootPics = attachmentsLine(root);
+		if (rootPics) out.push(`  ${rootPics}`);
+		for (const reply of replies.get(root.id) ?? []) {
+			out.push(`  ↳ ${reply.id}  ${who(reply)}  ${when(reply.createdAt)}`);
+			if (reply.body) out.push(indent(reply.body, "    "));
+			const pics = attachmentsLine(reply);
+			if (pics) out.push(`    ${pics}`);
+		}
+		out.push("");
+	}
+	process.stdout.write(out.join("\n"));
+}
+async function replyComment(api, threadId, opts) {
+	const res = await api.postJson(`/api/comments/${encodeURIComponent(threadId)}/reply`, {
+		body: opts.message,
+		authorType: opts.ai ? "ai" : "human"
+	});
+	process.stdout.write(`replied ${String(res?.parentId ?? threadId)} → ${String(res?.id ?? "")}\n`);
+}
+async function resolveComment(api, threadId, opts) {
+	const res = await api.postJson(`/api/comments/${encodeURIComponent(threadId)}/resolve`, { resolved: !opts.undo });
+	process.stdout.write(`${opts.undo ? "reopened" : "resolved"} ${String(res?.id ?? threadId)}\n`);
+}
+//#endregion
+//#region src/browser-auth.ts
+/**
+* jdu login 的浏览器授权（#66）：本机起一个 loopback 回调，打开 server 下发的 authorizeUrl，
+* 人在浏览器里用 passkey 会话点一次「授权」，回跳带回一次性 code，再用 PKCE verifier 向 server 换 token。
+*
+* authorizeUrl 与 server 可能不同源（CLI 连 127.0.0.1:18082，浏览器开 https://md.mason.local）——
+* 浏览器去前者，code 换 token 打后者。回调端口随机（server 接受任意 loopback 端口），不和 OIDC 的 8085 抢。
+*/
+async function browserAuthorize(input) {
+	const { verifier, challenge } = pkce();
+	const state = randomBytes(16).toString("base64url");
+	const code = await new Promise((resolve, reject) => {
+		const finish = (fn) => (value) => {
+			clearTimeout(timer);
+			server.close();
+			fn(value);
+		};
+		const fail = finish((msg) => reject(new CliError(msg, "重新执行 jdu login；不想开浏览器就带 --token")));
+		const handler = callbackHandler(state, finish(resolve));
+		const server = createServer((req, res) => {
+			if (new URL(req.url ?? "/", "http://localhost").pathname !== "/callback") {
+				res.writeHead(404).end();
+				return;
+			}
+			handler(req, res);
+		});
+		const timer = setTimeout(() => fail("等待浏览器授权超时"), input.timeoutMs ?? 18e4);
+		server.on("error", (err) => fail(`监听 loopback 回调失败：${err.message}`));
+		server.listen(0, "127.0.0.1", () => {
+			const port = server.address().port;
+			const url = new URL(input.authorizeUrl);
+			url.search = new URLSearchParams({
+				state,
+				code_challenge: challenge,
+				port: String(port),
+				label: input.label ?? hostname()
+			}).toString();
+			process.stderr.write(`在浏览器中完成授权：${url.toString()}\n`);
+			(input.open ?? openBrowser)(url.toString());
+		});
+	});
+	const res = await fetch(`${input.server}/api/cli/token`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			code,
+			code_verifier: verifier
+		})
+	});
+	const text = await res.text();
+	if (!res.ok) throw new CliError(`code 换 token 失败（HTTP ${res.status}）：${text.slice(0, 200)}`, "重新执行 jdu login 再试一次");
+	let token;
+	try {
+		token = JSON.parse(text).token;
+	} catch {
+		token = void 0;
+	}
+	if (typeof token !== "string" || token === "") throw new CliError("server 没有返回 token");
+	return token;
+}
+//#endregion
 //#region src/init.ts
 /**
 * jdu login：选定站点、拿到凭据、写好本地配置，一条命令把「登录到哪台简牍」定下来。
@@ -3612,6 +4187,7 @@ async function runLogin(opts) {
 		authProvider: provider,
 		authMethods: methods
 	};
+	const cfAccess = provider === "cloudflare-access";
 	if (opts.user !== void 0 && opts.user.trim() !== "") {
 		const r = await runOidcLogin({
 			server,
@@ -3628,10 +4204,11 @@ async function runLogin(opts) {
 		};
 	}
 	if (opts.token !== void 0 && opts.token !== "") {
-		if (!await (opts.probe ?? probeApiWithBearer)(server, opts.token)) throw new CliError("token 校验失败（/api/docs 未放行）", "确认 token 正确、且网关放行 Authorization: Bearer");
+		if (!await (opts.probe ?? (cfAccess ? probeApiWithAccessToken : probeApiWithBearer))(server, opts.token)) throw new CliError(cfAccess ? "Access 应用 token 校验失败（/api/docs 未放行）" : "token 校验失败（/api/docs 未放行）", cfAccess ? "token 要没过期、且是本实例 Access 应用签的" : "确认 token 正确、且网关放行 Authorization: Bearer");
 		const path = saveConfig({
 			server,
-			token: opts.token
+			token: opts.token,
+			...cfAccess ? { cfAccess: true } : {}
 		});
 		return {
 			...base,
@@ -3661,7 +4238,8 @@ async function runLogin(opts) {
 			token: await (opts.authorize ?? browserAuthorize)({
 				server,
 				authorizeUrl
-			})
+			}),
+			...cfAccess ? { cfAccess: true } : {}
 		});
 		return {
 			...base,
@@ -3670,6 +4248,12 @@ async function runLogin(opts) {
 			next: null
 		};
 	}
+	if (cfAccess) return {
+		...base,
+		loggedIn: false,
+		configPath: path,
+		next: `jdu login --server '${server}'（打开浏览器，用 Cloudflare 账号授权；--json / --no-browser 下不会开浏览器）`
+	};
 	const viaToken = `jdu login --server '${server}' --token <token>（${healthz.cliAuth?.tokenHint ?? "token 在 server 首启 stdout / data/initial-token.txt"}）`;
 	if (provider === "forward-auth" && opts.browser) {
 		const r = await runOidcLogin({
@@ -3700,28 +4284,38 @@ async function runLogin(opts) {
 function fallbackMethods(provider) {
 	if (provider === "anonymous") return [];
 	if (provider === "forward-auth") return ["oidc", "token"];
+	if (provider === "cloudflare-access") return ["browser"];
 	return ["token"];
 }
 //#endregion
 //#region src/deploy.ts
 /**
-* `jdu deploy`：在用户自己的 Cloudflare 账号里起一个 jiandu，一条命令从零到能登录。
+* `jdu deploy`：在用户自己的 Cloudflare 账号里起一个 jiandu。
 *
-* 为什么是 CLI 而不是 Deploy 按钮：jiandu 是给 agent 用的，agent 会跑命令不会点按钮；
-* 而且这条路不要求 GitHub 账号、不在用户账号里留一个仓库与构建流水线，`JIANDU_SETUP_SECRET`
-* 由这里随机生成（用户手填的 secret 强度没法保证）。
+* 一条命令要做完的事（顺序有依赖，每一步都幂等）：
 *
-* 我们不自己调 Cloudflare API：Worker 上传、Durable Object migration、静态资源上传会话
-* 是三套协议，wrangler 已经把它们做完了，重写一遍只会多一份要跟着 Cloudflare 演进的代码。
-* 所以这里只做三件事：把产物取下来、按正确的顺序敲 wrangler、把结果接回 jdu 的登录态。
+*   OAuth 或 --cf-token ──▶ 读 account id / 邮箱
+*   ──▶ 确保 Zero Trust team 与 Cloudflare IdP
+*   ──▶ upsert Access 应用（只挡 /p*）与邮箱策略
+*   ──▶ wrangler deploy（带 JIANDU_AUTH_* / TEAM_DOMAIN / POLICY_AUD 变量）
+*   ──▶ 退避探 /healthz ──▶ 本地 jdu login（浏览器）
 *
-*   jdu deploy --owner mason     首次：部署 → 生成 secret → 自动 jdu login
-*   jdu deploy                   升级：npm 取 latest 再部署一次，vars 与 secret 原样保留
+* 为什么不是「点一个 Deploy 按钮」：jiandu 是给 agent 用的，agent 会跑命令不会点按钮。
+* 为什么不自己调 Cloudflare API 传 Worker：Worker 上传、Durable Object migration、静态资源
+* 上传会话是三套协议，wrangler 已经把它们做完了，重写一遍只会多一份要跟着 Cloudflare 演进的代码。
+* 所以 wrangler 只负责「传产物」，Access 与变量由这里直接调 API 配。
+*
+* Access 的权限 wrangler 的 OAuth 客户端没有（实测 POST /access/apps → 1010 auth.forbidden），
+* 而 Cloudflare 自己的 CLI OAuth 客户端有 access:read/write，见 cf-oauth.ts。
+* 拿到的 token 以 CLOUDFLARE_API_TOKEN 交给 wrangler（一把 token 干完两件事）。
 */
 /** npm 上的部署产物包：worker.js + assets/ + wrangler.json。 */
 var PACKAGE = "@monoedge/jiandu-cf";
 /** wrangler 主版本锁死：它改 flag 我们要跟着改，不能让用户某天突然拿到 v5。 */
 var WRANGLER = "wrangler@4";
+/** healthz 退避探活：#155 的教训——冷启动要种 16 篇官方文档，第一次探活必须允许它慢。 */
+var HEALTH_TIMEOUT_MS = 45e3;
+var HEALTH_INTERVAL_MS = 2e3;
 /** 默认 runner：stdio 继承给用户看（wrangler 的 OAuth 提示、进度条都靠它）。 */
 var spawnRunner = (cmd, args, opts) => new Promise((ok, fail) => {
 	const child = spawn(cmd, args, {
@@ -3740,10 +4334,6 @@ var spawnRunner = (cmd, args, opts) => new Promise((ok, fail) => {
 	child.on("error", (err) => fail(new CliError(`跑不起来 ${cmd}：${err.message}`, "需要 node 与 npm 在 PATH 里")));
 	child.on("exit", (code) => code === 0 ? ok() : fail(new CliError(`${cmd} ${args[0] ?? ""} 失败（退出码 ${code}）`)));
 });
-/** 24 字节随机，base64url —— 它会出现在 URL 的 query 里（/setup?invite=），别带需要转义的字符。 */
-function newSecret() {
-	return randomBytes(24).toString("base64url");
-}
 /**
 * 取部署产物：`--dist` 指本地目录，否则临时装一份 npm 包。
 * 返回 wrangler 配置的绝对路径 —— wrangler 按**配置文件所在目录**解析 main 与 assets.directory，
@@ -3805,17 +4395,77 @@ function urlFromOutput(file) {
 	}
 	return null;
 }
-/** 部署完探一次 healthz：缺 secret 的实例冷启动就抛错，所有请求 500。 */
-async function healthy(url) {
+/**
+* 退避探活：冷启动要建表 + 种官方文档，第一次请求可能落在 DO 还没热身完的窗口里（#155）。
+* 返回最后一次看到的 healthz；一直不通返回 null。
+*/
+async function waitHealthy(url, fetchImpl, timeoutMs = HEALTH_TIMEOUT_MS) {
+	const deadline = Date.now() + timeoutMs;
+	for (;;) {
+		try {
+			const res = await fetchImpl(`${url}/healthz`, { headers: { accept: "application/json" } });
+			if (res.ok) {
+				const body = await res.json();
+				if (body.runtime === "cloudflare") return body;
+			}
+		} catch {}
+		if (Date.now() >= deadline) return null;
+		await new Promise((r) => setTimeout(r, HEALTH_INTERVAL_MS));
+	}
+}
+/** 部署命令：产物配置 + 变量 + 输出文件。 */
+function deployArgs(input) {
+	const args = [
+		"--yes",
+		WRANGLER,
+		"deploy",
+		"-c",
+		input.config,
+		"--name",
+		input.name,
+		"--keep-vars"
+	];
+	for (const [key, value] of Object.entries(input.vars ?? {})) args.push("--var", `${key}:${value}`);
+	return args;
+}
+/**
+* 账号还没注册 workers.dev 子域时的兜底：先不带 Access 变量传一次，让 wrangler 引导注册并
+* 打印地址；随后配好 Access 再带变量传第二次（那才是真正生效的那次）。
+*/
+async function warmupDeploy(config, name, env, run) {
+	const outDir = mkdtempSync(join(tmpdir(), "jdu-wrangler-out-"));
+	const outFile = join(outDir, "out.ndjson");
 	try {
-		return (await fetch(`${url}/healthz`, { headers: { accept: "application/json" } })).ok;
-	} catch {
-		return false;
+		await run("npx", deployArgs({
+			config,
+			name
+		}), { env: {
+			...env,
+			WRANGLER_OUTPUT_FILE_PATH: outFile
+		} });
+		const url = urlFromOutput(outFile);
+		if (url === null) throw new CliError("部署命令跑完了，但没能从 wrangler 的输出里读到地址", "去 Cloudflare 控制台看这个 Worker 的 workers.dev 地址，再重跑一次 jdu deploy");
+		return url;
+	} finally {
+		rmSync(outDir, {
+			recursive: true,
+			force: true
+		});
 	}
 }
 async function runDeploy(opts) {
 	const run = opts.run ?? spawnRunner;
 	const name = opts.name ?? "jiandu";
+	const empty = {
+		name,
+		url: null,
+		accountId: null,
+		ownerEmail: null,
+		emails: [],
+		accessAppId: null,
+		upgraded: false,
+		loggedIn: false
+	};
 	const { config, cleanup } = await resolveConfig(opts, run);
 	try {
 		if (opts.dryRun) {
@@ -3829,74 +4479,87 @@ async function runDeploy(opts) {
 				"--name",
 				name
 			], {});
-			return {
-				name,
-				url: null,
-				setupSecret: null,
-				setupUrl: null,
-				loggedIn: false
-			};
+			return empty;
 		}
-		await run("npx", [
-			"--yes",
-			WRANGLER,
-			"login"
-		], {});
+		const fetchImpl = opts.fetchImpl ?? fetch;
+		const credentials = await resolveCfCredentials({
+			...opts.cfToken ? { cfToken: opts.cfToken } : {},
+			allowBrowser: opts.json !== true,
+			fetchImpl
+		});
+		const api = new CfApi({
+			credentials,
+			fetchImpl,
+			onTokens: (tokens) => writeCfConfig({
+				...tokens,
+				accountId: credentials.accountId,
+				email: credentials.email
+			})
+		});
+		const identity = {
+			accountId: credentials.accountId,
+			email: credentials.email
+		};
+		const deployEnv = { CLOUDFLARE_API_TOKEN: credentials.tokens.accessToken };
+		const subdomain = await workersDevSubdomain(api);
+		const fromSubdomain = subdomain === null ? null : `${name}.${subdomain}.workers.dev`;
+		const deployed = fromSubdomain === null ? await warmupDeploy(config, name, deployEnv, run) : null;
+		const siteUrl = deployed ?? `https://${fromSubdomain}`;
+		const siteHost = deployed === null ? fromSubdomain : new URL(deployed).host;
+		const authDomain = await ensureOrganization(api, name);
+		const idpId = await ensureCloudflareIdp(api);
+		const { app, emails, existed } = await ensureAccessApp(api, {
+			name,
+			host: siteHost,
+			emails: [identity.email],
+			idpId
+		});
+		const vars = {
+			JIANDU_AUTH_PROVIDER: "cloudflare-access",
+			JIANDU_AUTH_OWNER: identity.accountId,
+			JIANDU_AUTH_OWNER_EMAIL: identity.email,
+			JIANDU_TEAM_DOMAIN: `https://${authDomain}`,
+			JIANDU_POLICY_AUD: app.aud ?? ""
+		};
+		if (app.aud === void 0 || app.aud === "") throw new CliError("Access 应用没有 aud", "去 Cloudflare Zero Trust → Access 里看一眼应用是否建好");
+		if (!siteUrl.startsWith("https://")) throw new CliError(`部署地址不是 https：${siteUrl}`, "Cloudflare 形态必须有 https 才能用 Access");
 		const outDir = mkdtempSync(join(tmpdir(), "jdu-wrangler-out-"));
 		const outFile = join(outDir, "out.ndjson");
-		const args = [
-			"--yes",
-			WRANGLER,
-			"deploy",
-			"-c",
+		await run("npx", deployArgs({
 			config,
-			"--name",
 			name,
-			"--keep-vars"
-		];
-		if (opts.owner !== void 0) args.push("--var", `JIANDU_AUTH_OWNER:${opts.owner}`);
-		await run("npx", args, { env: { WRANGLER_OUTPUT_FILE_PATH: outFile } });
-		const url = urlFromOutput(outFile);
+			vars
+		}), { env: {
+			...deployEnv,
+			WRANGLER_OUTPUT_FILE_PATH: outFile
+		} });
 		rmSync(outDir, {
 			recursive: true,
 			force: true
 		});
-		if (url === null) throw new CliError("部署命令跑完了，但没能从 wrangler 的输出里读到地址", "去 Cloudflare 控制台看这个 Worker 的地址，再手动 npx wrangler secret put JIANDU_SETUP_SECRET");
-		const setupSecret = await healthy(url) ? null : newSecret();
-		if (setupSecret !== null) {
-			await run("npx", [
-				"--yes",
-				WRANGLER,
-				"secret",
-				"put",
-				"JIANDU_SETUP_SECRET",
-				"-c",
-				config,
-				"--name",
-				name
-			], { input: setupSecret });
-			if (!await healthy(url)) throw new CliError(`${url} 起不来（secret 已设）`, `跑 npx ${WRANGLER} tail --name ${name} 看冷启动日志；常见原因是 JIANDU_AUTH_OWNER 没设或 provider 填了不支持的值`);
-		}
+		const health = await waitHealthy(siteUrl, fetchImpl);
+		if (health === null) throw new CliError(`${siteUrl} 起来了但 /healthz 一直不通（等了 ${HEALTH_TIMEOUT_MS / 1e3}s）`, `跑 npx ${WRANGLER} tail --name ${name} 看 Worker 日志；Access 策略已经配好，修完不用重跑 jdu deploy`);
+		if (health.authProvider !== "cloudflare-access") throw new CliError(`${siteUrl} 的 authProvider 是 ${health.authProvider ?? "未知"}，不是 cloudflare-access`, "确认 wrangler 变量写进去了（wrangler deploy 会打印绑定列表）");
 		let loggedIn = false;
-		if (setupSecret !== null) {
-			await runLogin({
-				server: url,
-				token: setupSecret,
-				browser: false
-			});
-			loggedIn = true;
-		}
+		if (opts.login !== false) loggedIn = (await runLogin({
+			server: siteUrl,
+			browser: true
+		})).loggedIn;
 		return {
 			name,
-			url,
-			setupSecret,
-			setupUrl: setupSecret === null ? null : `${url}/setup?invite=${setupSecret}`,
+			url: siteUrl,
+			accountId: identity.accountId,
+			ownerEmail: identity.email,
+			emails,
+			accessAppId: app.id,
+			upgraded: existed,
 			loggedIn
 		};
 	} finally {
 		cleanup();
 	}
 }
+/** 已存在的应用（升级路径）：只用来报「这次是升级」，邮箱列表由 ensureAccessApp 保证不动。 */
 //#endregion
 //#region src/http.ts
 /** 错误响应体太长会淹没终端，只留头部。 */
@@ -3904,6 +4567,8 @@ var MAX_DETAIL = 400;
 var ApiClient = class {
 	server;
 	token;
+	/** token 是 Cloudflare Access 应用 token：带上 cf-access-token 头过边缘（见 docs/deploy.md） */
+	cfAccess;
 	/** forward-auth 直连身份：作为 X-Forwarded-User 注入（server 默认 userHeader） */
 	user;
 	/** forward-auth fail-closed 的共享密钥：作为 X-Jiandu-Proxy-Secret 注入 */
@@ -3911,6 +4576,7 @@ var ApiClient = class {
 	constructor(cfg) {
 		this.server = cfg.server;
 		this.token = cfg.token;
+		this.cfAccess = cfg.cfAccess === true;
 		this.user = cfg.user;
 		this.proxySecret = cfg.proxySecret;
 	}
@@ -3959,7 +4625,10 @@ var ApiClient = class {
 	async send(method, path, body, contentType) {
 		const url = this.url(path);
 		const headers = {};
-		if (this.token !== void 0) headers.Authorization = `Bearer ${this.token}`;
+		if (this.token !== void 0) {
+			if (this.cfAccess) headers["cf-access-token"] = this.token;
+			else headers.Authorization = `Bearer ${this.token}`;
+		}
 		if (this.user !== void 0) headers["X-Forwarded-User"] = this.user;
 		if (this.proxySecret !== void 0) headers["X-Jiandu-Proxy-Secret"] = this.proxySecret;
 		if (contentType !== void 0) headers["Content-Type"] = contentType;
@@ -4003,7 +4672,7 @@ async function httpError(method, url, res) {
 		const msg = obj.error ?? obj.message;
 		if (typeof msg === "string" && msg !== "") detail = msg;
 	} catch {}
-	const hint = res.status === 401 || res.status === 403 ? "token 无效或无权访问，执行 jdu login --server <url>；forward-auth 下确认已设 JIANDU_FORWARD_AUTH_USER 与 JIANDU_PROXY_SECRET" : res.status === 302 ? "网关要登录。forward-auth 下先 jdu login；若已登录，网关需接受 Authorization: Bearer" : void 0;
+	const hint = res.status === 401 || res.status === 403 ? "token 无效或无权访问，执行 jdu login --server <url>；forward-auth 下确认已设 JIANDU_FORWARD_AUTH_USER 与 JIANDU_PROXY_SECRET" : res.status === 302 ? "网关要登录。Cloudflare 形态下重新执行 jdu login；forward-auth 下先 jdu login，且网关需接受 Authorization: Bearer" : void 0;
 	const suffix = detail === "" ? "" : `：${detail}`;
 	return new CliError(`${method} ${url} 返回 HTTP ${res.status} ${res.statusText}${suffix}`, hint);
 }
@@ -5949,11 +6618,14 @@ async function client() {
 function collectTag(value, previous) {
 	return [...previous ?? [], value];
 }
-var VERSION = "0.5.0";
+var VERSION = "0.6.0";
 var program = new Command();
 program.name("jdu").description("jiandu 命令行").version(VERSION).showHelpAfterError();
-program.command("deploy").description("把一台简牍部署到你自己的 Cloudflare 账号（Worker + Durable Object，Free 计划够用）").option("--owner <name>", "管理员用户名（JIANDU_AUTH_OWNER）。首次部署必填；升级时不给就保持账号上现有的值").option("--name <name>", "Worker 名字，决定 workers.dev 的子域名前缀", "jiandu").option("--dist <dir>", "用本地构建的产物代替 npm 包（开发用，指向 server/dist-cf）").option("--dry-run", "只校验配置与产物，不上传、不碰你的账号", false).option("--json", "机器可读输出（agent 联动用）", false).action(async (opts) => {
-	const result = await runDeploy(opts);
+program.command("deploy").description("把一台简牍部署到你自己的 Cloudflare 账号（Worker + Durable Object，Free 计划够用）").option("--name <name>", "Worker 名字，决定 workers.dev 的子域名前缀", "jiandu").option("--dist <dir>", "用本地构建的产物代替 npm 包（开发用，指向 server/dist-cf）").option("--cf-token <token>", "带 Access 权限的 Cloudflare API token（不给就走浏览器 OAuth / 本地缓存）").option("--no-login", "部署完不自动 jdu login（之后手动跑一次即可）").option("--dry-run", "只校验配置与产物，不上传、不碰你的账号", false).option("--json", "机器可读输出（agent 联动用）", false).action(async (opts) => {
+	const result = await runDeploy({
+		...opts,
+		login: opts.login && !opts.json
+	});
 	if (opts.json) {
 		process.stdout.write(`${JSON.stringify(result)}\n`);
 		return;
@@ -5962,14 +6634,31 @@ program.command("deploy").description("把一台简牍部署到你自己的 Clou
 		process.stdout.write("校验通过：产物与 wrangler 配置都没问题，没有上传任何东西\n");
 		return;
 	}
-	process.stdout.write(`已部署 ${result.url}\n`);
-	if (result.setupSecret === null) {
-		process.stdout.write("实例本来就在跑，secret 与配置原样保留（这是一次升级）\n");
+	process.stdout.write(`已部署 ${result.url}${result.upgraded ? "（升级：Access 策略与实例数据都没动）" : ""}\n`);
+	process.stdout.write(`\n浏览器打开它，用 Cloudflare 账号（${result.ownerEmail}）登录；公开文档匿名可读。\n`);
+	process.stdout.write(`加人：jdu access allow <邮箱>\n`);
+	if (result.loggedIn) process.stdout.write("\njdu 已经连上它了，可以直接 jdu push\n");
+	else process.stdout.write(`\n下一步：jdu login --server ${result.url}\n`);
+});
+var access = program.command("access").description("Cloudflare 形态的准入（Access 策略里的邮箱列表）");
+access.command("list").description("列出能登录这台实例的邮箱").option("--server <url>", "目标站点（缺省用 jdu login 时定下的那台）").option("--cf-token <token>", "带 Access 权限的 Cloudflare API token").option("--json", "机器可读输出", false).action(async (opts) => {
+	const result = await runAccessList(opts);
+	if (opts.json) {
+		process.stdout.write(`${JSON.stringify(result)}\n`);
 		return;
 	}
-	process.stdout.write(`\n第一把钥匙（只在这里出现这一次，记下来）：\n  ${result.setupSecret}\n`);
-	process.stdout.write(`\n打开这个链接绑 passkey：\n  ${result.setupUrl}\n`);
-	if (result.loggedIn) process.stdout.write("\njdu 已经连上它了，可以直接 jdu push\n");
+	if (result.emails.length === 0) process.stdout.write(`（${result.server} 的 Access 策略里没有邮箱）\n`);
+	for (const email of result.emails) process.stdout.write(`${email}\n`);
+});
+access.command("allow").argument("<email...>", "要允许登录的邮箱（对方的 Cloudflare 账号邮箱）").description("把邮箱写进 Access 策略：对方用自己的 Cloudflare 账号（同一邮箱）登录").option("--server <url>", "目标站点（缺省用 jdu login 时定下的那台）").option("--cf-token <token>", "带 Access 权限的 Cloudflare API token").option("--json", "机器可读输出", false).action(async (emails, opts) => {
+	const result = await runAccessAllow(emails, opts);
+	if (opts.json) process.stdout.write(`${JSON.stringify(result)}\n`);
+	else process.stdout.write(`已允许：${result.emails.join(", ")}\n`);
+});
+access.command("deny").argument("<email...>", "要移除的邮箱").description("把邮箱从 Access 策略里去掉：对方即刻失去访问（浏览器与 CLI 同时失效）").option("--server <url>", "目标站点（缺省用 jdu login 时定下的那台）").option("--cf-token <token>", "带 Access 权限的 Cloudflare API token").option("--json", "机器可读输出", false).action(async (emails, opts) => {
+	const result = await runAccessDeny(emails, opts);
+	if (opts.json) process.stdout.write(`${JSON.stringify(result)}\n`);
+	else process.stdout.write(`剩余邮箱：${result.emails.join(", ")}\n`);
 });
 program.command("login").description("登录到一台简牍：定站点、拿凭据、写本地配置（必须指定 --server 或 --local）").option("--local", "目标是本机自部署（http://127.0.0.1:8080）").option("--server <url>", "目标简牍站点地址").option("--token <token>", "直接用 token 登录（无浏览器的机器；token 在 server 首启 stdout / data/initial-token.txt）").option("--user <owner>", "forward-auth：以指定 owner 直连，跳过 SSO（请求注入 X-Forwarded-User 头）").option("--proxy-secret <secret>", "forward-auth：网关共享密钥（X-Jiandu-Proxy-Secret 头）").option("--issuer <url>", "OIDC issuer（缺省读 healthz.oidc 或 JIANDU_OIDC_ISSUER）").option("--client-id <id>", "OIDC client id（缺省读 healthz.oidc 或 JIANDU_OIDC_CLIENT_ID）").option("--no-browser", "站点支持浏览器授权时也不打开浏览器，只给 token 指引").option("--json", "机器可读输出（agent 联动用；不会打开浏览器）", false).action(async (opts) => {
 	const result = await runLogin({