@phnx-labs/agents-cli 1.22.113 → 1.22.115

package/dist/lib/channels/owner-forward.d.ts

@@ -34,8 +34,8 @@ import type { DeviceProfile } from '../devices/registry.js';
  */
 export declare const OWNER_FORWARD_GUARD_ENV = "AGENTS_OWNER_NO_FORWARD";
 /** Why forwarding did not run, so a caller/test can assert the decision. */
-export type OwnerForwardSkip = 'guarded' | 'not-rush-backed' | 'no-capable-peer';
-export interface OwnerForwardPlan {
+type OwnerForwardSkip = 'guarded' | 'not-rush-backed' | 'no-capable-peer';
+interface OwnerForwardPlan {
     /** Ordered machine ids to try — capable (macOS), reachable, self excluded. */
     candidates: string[];
     /** Set when forwarding does not apply; the caller keeps its local error. */
@@ -70,11 +70,11 @@ export declare function planOwnerForward(channel: string, meta: Meta, devices: D
  * unreachable / not a dialable device / answered with unparseable output —
  * every one of which means "try the next peer".
  */
-export interface PeerOwnerEnvelope {
+interface PeerOwnerEnvelope {
     thread?: string;
     from?: string;
 }
-export type PeerOwnerSender = (machine: string, text: string, channel: string, target: string, envelope?: PeerOwnerEnvelope) => Promise<SendResult | undefined>;
+type PeerOwnerSender = (machine: string, text: string, channel: string, target: string, envelope?: PeerOwnerEnvelope) => Promise<SendResult | undefined>;
 /**
  * Try each capable peer in order and return the first successful delivery. A
  * peer that is unreachable or reports its own delivery failure is skipped and
@@ -92,3 +92,4 @@ export declare function forwardOwnerNotifyToPeer(text: string, channel: string,
     send?: PeerOwnerSender;
     envelope?: PeerOwnerEnvelope;
 }): Promise<SendResult | undefined>;
+export {};

package/dist/lib/channels/owner-sink.js

@@ -1,7 +1,7 @@
 /**
  * Owner-delivery-sink reachability probe (RUSH-2262).
  *
- * The feed/notify owner-delivery lane (`agents notify`, `agents feed post
+ * The feed/notify owner-delivery lane (`agents send --to owner`, `agents feed post
  * --level important` / `--blocked`) reaches the owner over the rush-backed owner
  * channel (iMessage via `rush message send`). That transport can only deliver
  * from a context that BOTH finds the `rush` CLI on PATH and can read its
@@ -26,7 +26,7 @@
  * reads that file — checking it is the mistake that made a signed-in box look
  * signed out.
  *
- * `agents notify --dry-run` is NOT this probe: it short-circuits before the
+ * `agents send --to owner --dry-run` is NOT this probe: it short-circuits before the
  * `which rush` preflight (`providers/rush.ts`), so it reports `ok:true` on a box
  * with no rush at all. Resolvability (does the envelope build?) and reachability
  * (can this box actually deliver?) are different questions; this answers the

package/dist/lib/channels/providers/desktop.js

@@ -106,7 +106,7 @@ export const desktopProvider = {
     async send(text, opts) {
         // `target` is meaningless for a local notification — the recipient is whoever
         // is at this machine — but it is echoed for --json parity with every other
-        // provider, and `agents notify` still requires notify.owner.to to be set.
+        // provider, and `agents send --to owner` still requires notify.owner.to to be set.
         const id = opts.target || os.hostname();
         // Order matters, and CI caught it: validate the CALLER first, then honour
         // dry-run, and only then probe the platform.

package/dist/lib/channels/providers/rush.d.ts

@@ -1,8 +1,9 @@
 import type { ChannelProvider, SendOptions } from '../registry.js';
-export type RushChannel = 'telegram' | 'imessage' | 'slack' | 'discord';
+type RushChannel = 'telegram' | 'imessage' | 'slack' | 'discord';
 export declare const RUSH_CHANNELS: RushChannel[];
 /** Build the `rush send` argv (exported for tests). */
 export declare function buildRushSendArgs(channel: RushChannel, text: string, opts: SendOptions): string[];
 /** Build the owner-scoped iMessage argv. */
 export declare function buildRushOwnerMessageArgs(text: string): string[];
 export declare const rushProviders: ChannelProvider[];
+export {};

package/dist/lib/channels/registry.d.ts

@@ -1,5 +1,5 @@
 /**
- * Channel-provider registry for `agents send` / `agents notify`.
+ * Channel-provider registry for `agents send`.
  *
  * One primitive, many channels. A provider knows how to deliver a message over
  * exactly one channel — the agent mailbox, a rush-daemon gateway (telegram /

package/dist/lib/channels/registry.js

@@ -1,5 +1,5 @@
 /**
- * Channel-provider registry for `agents send` / `agents notify`.
+ * Channel-provider registry for `agents send`.
  *
  * One primitive, many channels. A provider knows how to deliver a message over
  * exactly one channel — the agent mailbox, a rush-daemon gateway (telegram /

package/dist/lib/channels/resolve.d.ts

@@ -9,12 +9,12 @@
  * Two entry points, deliberately: `lookupTransport` *returns* the failure, for
  * long-lived callers (the monitor daemon, the feed-dispatch loop) that must
  * survive a bad channel name; `resolveTransport` `die()`s on it, for the
- * interactive `agents send` / `agents notify` command path where exiting with a
+ * interactive `agents send` command path where exiting with a
  * loud message is the right answer. Never give a daemon the dying one.
  */
 import type { Meta } from '../types.js';
 import { type ChannelProvider } from './registry.js';
-export interface TransportLookup {
+interface TransportLookup {
     /** Provider name after applying the `notify.transports` mapping. */
     providerName: string;
     /** Registered provider, or undefined when `providerName` resolves to nothing. */
@@ -26,3 +26,4 @@ export interface TransportLookup {
 export declare function lookupTransport(channel: string, meta: Meta): TransportLookup;
 /** Interactive-command resolution: an unregistered provider dies loud. */
 export declare function resolveTransport(channel: string, meta: Meta): ChannelProvider;
+export {};

package/dist/lib/channels/send.d.ts

@@ -1,5 +1,5 @@
 /**
- * Delivery envelope for `agents send` / `agents notify`.
+ * Delivery envelope for `agents send`.
  *
  * One primitive: resolve a destination (channel + target), compose text + urls +
  * attachments, hand off to a channel provider. `notify` is the same path with
@@ -12,7 +12,7 @@ import type { Meta } from '../types.js';
 import type { SendResult } from './registry.js';
 import type { SinkMessageFormat } from '../sink-format.js';
 /** Normalized delivery request after CLI/config resolution. */
-export interface SendEnvelope {
+interface SendEnvelope {
     text: string;
     channel: string;
     to: string;
@@ -45,12 +45,12 @@ export interface ResolveSendInput {
     from?: string;
     dryRun?: boolean;
     /**
-     * When true (`agents notify`), missing channel/to default to `notify.owner`.
+     * When true (a feed owner sink), missing channel/to default to `notify.owner`.
      * Explicit flags still win.
      */
     ownerMode?: boolean;
 }
-export type ResolveSendResult = {
+type ResolveSendResult = {
     ok: true;
     envelope: SendEnvelope;
 } | {
@@ -94,3 +94,4 @@ export declare function sendMessage(input: ResolveSendInput, meta: Meta, ownerCo
 } | {
     error: string;
 }>;
+export {};

package/dist/lib/cli-resources.d.ts

@@ -51,19 +51,12 @@ export interface CliManifest {
     path: string;
 }
 /** A validation problem in a CLI manifest. */
-export interface CliManifestError {
+interface CliManifestError {
     /** Filename that failed to parse. */
     file: string;
     /** Human-readable reason. */
     reason: string;
 }
-/**
- * Parse a `check:` field into a CheckSpec. Accepts either a structured object
- * (`{ kind: 'which'|'version', cmd, args? }`) or a legacy whitespace-separated
- * string. String form is split on whitespace and each token is validated against
- * SAFE_CHECK_TOKEN — manifests cannot smuggle in shell metacharacters.
- */
-export declare function parseCheckSpec(raw: unknown, defaultName: string): CheckSpec;
 /**
  * Parse a single CLI manifest from its YAML contents.
  * Returns a manifest on success; throws on schema violations so callers can
@@ -151,7 +144,7 @@ export declare function buildInstallCommand(method: InstallMethod): string;
 export declare function installCli(manifest: CliManifest, opts?: {
     dryRun?: boolean;
 }): InstallResult;
-export interface CliStatus {
+interface CliStatus {
     manifest: CliManifest;
     installed: boolean;
 }
@@ -171,3 +164,4 @@ export declare function listCliStatusAsync(cwd?: string): Promise<{
     statuses: CliStatus[];
     errors: CliManifestError[];
 }>;
+export {};

package/dist/lib/cli-resources.js

@@ -23,6 +23,7 @@ import * as yaml from 'yaml';
 import { listResources, resolveResource } from './resources.js';
 import { probeCapture } from './probe.js';
 import { composeWin32CommandLine } from './platform/index.js';
+import { execFileShellSpec } from './platform/exec.js';
 import { localBinDir } from './platform/posixpath.js';
 // ─── Validation primitives ───────────────────────────────────────────────────
 /** Token allowed inside `check:` strings — letters, digits, underscore, dot, slash, dash. */
@@ -72,7 +73,7 @@ function assertSafePathSegment(seg) {
  * string. String form is split on whitespace and each token is validated against
  * SAFE_CHECK_TOKEN — manifests cannot smuggle in shell metacharacters.
  */
-export function parseCheckSpec(raw, defaultName) {
+function parseCheckSpec(raw, defaultName) {
     if (raw == null) {
         assertSafeCheckToken(defaultName);
         return { kind: 'version', cmd: defaultName, args: ['--version'] };
@@ -457,7 +458,8 @@ export function buildInstallCommand(method) {
 function runInstallMethod(method) {
     if ('npm' in method) {
         assertNpmPackage(method.npm);
-        const r = spawnSync('npm', ['install', '-g', method.npm], { stdio: 'inherit' });
+        const invocation = execFileShellSpec('npm', ['install', '-g', method.npm]);
+        const r = spawnSync(invocation.command, invocation.args, { stdio: 'inherit', shell: invocation.shell });
         if (r.status !== 0) {
             throw new Error(`npm install -g ${method.npm} exited with status ${r.status ?? 'unknown'}`);
         }

package/dist/lib/cloud/cursor.d.ts

@@ -1,6 +1,5 @@
 /** Cursor Cloud Agents provider backed by the public v1 REST API. */
 import type { CloudEvent, CloudProvider, CloudTask, CloudTaskStatus, DispatchOptions, ProviderCapabilities } from './types.js';
-export declare const CURSOR_API_BASE_URL = "https://api.cursor.com/v1";
 interface CursorAgent {
     id: string;
     name?: string;
@@ -29,7 +28,7 @@ interface CursorRun {
         }>;
     };
 }
-export interface CursorCreateBody {
+interface CursorCreateBody {
     prompt: {
         text: string;
         images?: Array<{

package/dist/lib/cloud/cursor.js

@@ -1,7 +1,7 @@
 /** Cursor Cloud Agents provider backed by the public v1 REST API. */
 import { normalizeProviderStatus, resolveDispatchRepos } from './types.js';
 import { readAndResolveBundleEnv } from '../secrets-client.js';
-export const CURSOR_API_BASE_URL = 'https://api.cursor.com/v1';
+const CURSOR_API_BASE_URL = 'https://api.cursor.com/v1';
 const KEY_NAME = 'CURSOR_API_KEY';
 /** Translate unified dispatch options into Cursor's documented v1 create shape. */
 export function buildCursorCreateBody(options) {

package/dist/lib/cloud/dispatch.d.ts

@@ -7,7 +7,7 @@ export declare function resolveCloudPrompt(raw: string | undefined, opts: {
     json: boolean;
     hint: string;
 }): string;
-export interface ExecuteCloudDispatchParams {
+interface ExecuteCloudDispatchParams {
     provider: CloudProvider;
     dispatchOptions: DispatchOptions;
     /** Image file paths for vision dispatch (checked against provider capability). */
@@ -25,3 +25,4 @@ export interface ExecuteCloudDispatchParams {
  * kill-switch. Dies on any dispatch failure — callers never see a partial.
  */
 export declare function executeCloudDispatch(params: ExecuteCloudDispatchParams): Promise<void>;
+export {};

package/dist/lib/cloud/dispatch.js

@@ -16,7 +16,7 @@ import { insertTask, updateTaskStatus } from './store.js';
 import { renderStream } from './stream.js';
 import { MissingTargetError, MAX_IMAGES_PER_DISPATCH } from './types.js';
 import { emit } from '../feed/events.js';
-import { shareRuntimeEnv } from '../share/config.js';
+import { shareRuntimeEnv } from '../share-runtime.js';
 /** Map a supported image file extension to its wire mimeType. Rejects anything else. */
 function imageMimeFromPath(file) {
     const ext = path.extname(file).toLowerCase();

package/dist/lib/cloud/factory.d.ts

@@ -20,8 +20,6 @@
  * message rather than misfiring when unconfigured.
  */
 import type { CloudProvider, CloudTask, CloudTaskStatus, CloudEvent, CloudTarget, DispatchOptions, ProviderCapabilities, DroidAutonomy } from './types.js';
-/** Locate the droid binary, checking agents-cli shims first then PATH. */
-export declare function findDroidBinary(): string | null;
 /** Normalize an autonomy value, falling back to the safe cloud default (`high`). */
 export declare function resolveAutonomy(value: unknown, fallback?: DroidAutonomy): DroidAutonomy;
 /**

package/dist/lib/cloud/factory.js

@@ -29,7 +29,7 @@ const SHIMS_DIR = getShimsDir();
 const DEFAULT_AUTONOMY = 'high';
 const VALID_AUTONOMY = new Set(['low', 'medium', 'high']);
 /** Locate the droid binary, checking agents-cli shims first then PATH. */
-export function findDroidBinary() {
+function findDroidBinary() {
     const shim = path.join(SHIMS_DIR, 'droid');
     if (fs.existsSync(shim))
         return shim;

package/dist/lib/cloud/rush.d.ts

@@ -21,7 +21,7 @@ export declare function isRushSessionValid(yamlPath?: string): boolean;
  */
 export declare function readToken(yamlPath?: string): string;
 /** One version's entry in the account manifest sent on every dispatch. */
-export interface AccountManifestEntry {
+interface AccountManifestEntry {
     version: string;
     email: string;
 }
@@ -36,19 +36,10 @@ export interface AccountManifestEntry {
  * cloud. Dispatch fails loud and steers to a portable provider account instead
  * (see the 401 handler in `dispatch()`).
  */
-export interface AccountManifest {
+interface AccountManifest {
     fp: string;
     versions: AccountManifestEntry[];
 }
-/**
- * Build a manifest of the user's local Claude installations to send on every
- * cloud dispatch. The manifest is the contract the server uses to detect when
- * the user has added a new account or rotated a token.
- *
- * Returns null when no Claude versions are signed in (the dispatch falls back
- * to the platform-wide key, current behavior).
- */
-export declare function buildAccountManifest(strategy?: string): Promise<AccountManifest | null>;
 /**
  * Build the POST body for /api/v1/cloud-runs. Exported so tests can verify
  * the back-compat shape (singular fields + repos[]) without needing real
@@ -93,3 +84,4 @@ export declare class RushCloudProvider implements CloudProvider {
     cancel(taskId: string): Promise<void>;
     message(taskId: string, content: string): Promise<void>;
 }
+export {};

package/dist/lib/cloud/rush.js

@@ -153,7 +153,7 @@ function parsePromptCode(body) {
  * Returns null when no Claude versions are signed in (the dispatch falls back
  * to the platform-wide key, current behavior).
  */
-export async function buildAccountManifest(strategy) {
+async function buildAccountManifest(strategy) {
     let candidateVersions;
     if (strategy === 'balanced') {
         // Use the same health-checked, deduped-by-email set that `agents run --balanced` uses.

package/dist/lib/cloud/session-index.d.ts

@@ -18,7 +18,7 @@
  */
 import type { CloudTask } from './types.js';
 /** Context a cloud task needs to become a session row — the LOCAL dir it was launched from. */
-export interface CloudSessionContext {
+interface CloudSessionContext {
     /** Local directory `agents cloud run` was invoked from. Defaults to process.cwd(). */
     cwd?: string;
 }
@@ -30,3 +30,4 @@ export interface CloudSessionContext {
  * failed index write must never break the dispatch/poll it rides on.
  */
 export declare function registerCloudSession(task: CloudTask, ctx?: CloudSessionContext): void;
+export {};

package/dist/lib/cloud/types.d.ts

@@ -31,7 +31,7 @@ export type CloudProviderId = 'rush' | 'codex' | 'factory' | 'antigravity' | 'cu
  */
 export type CloudTaskStatus = 'queued' | 'allocating' | 'running' | 'idle' | 'input_required' | 'completed' | 'failed' | 'cancelled';
 /** Cloud backends whose wire status is normalized by `normalizeProviderStatus`. */
-export type StatusNormalizingProvider = 'rush' | 'codex' | 'antigravity' | 'cursor';
+type StatusNormalizingProvider = 'rush' | 'codex' | 'antigravity' | 'cursor';
 /**
  * Normalize a provider's raw wire status into the canonical `CloudTaskStatus`.
  *
@@ -313,3 +313,4 @@ export interface CloudConfig {
     default_provider?: CloudProviderId;
     providers?: CloudProviderConfig;
 }
+export {};

package/dist/lib/cloudflare/creds.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_CF_BUNDLE = "cloudflare";
+/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
+ * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
+export declare function readCloudflareCreds(bundle?: string, override?: {
+    apiToken?: string;
+    accountId?: string;
+}): {
+    apiToken: string;
+    accountId: string;
+};

package/dist/lib/cloudflare/creds.js

@@ -0,0 +1,46 @@
+// Cloudflare API credential glue, shared by the commands that provision or read
+// Cloudflare-backed endpoints (`agents traces`, `agents sessions backup`).
+//
+// This used to live in `lib/share/config.ts` alongside the embedded artifact
+// share engine. The share engine moved out to `@phnx-labs/artifacts-cli`
+// (PHNX-3992); `readCloudflareCreds` stayed because it is a generic Cloudflare
+// util that `traces`/`sessions backup` borrow, unrelated to sharing.
+import { bundleExistsSync as bundleExists, readAndResolveBundleEnvSync as readAndResolveBundleEnv, } from '../secrets-client.js';
+export const DEFAULT_CF_BUNDLE = 'cloudflare';
+/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
+ * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
+export function readCloudflareCreds(bundle = DEFAULT_CF_BUNDLE, override) {
+    // Explicit --token/--account bypass the bundle entirely (robust escape hatch).
+    if (override?.apiToken) {
+        return { apiToken: override.apiToken, accountId: override.accountId ?? '' };
+    }
+    // Check existence first: resolving a missing bundle through the process client
+    // surfaces an opaque transport code (e.g. LOCKED), never naming the bundle the
+    // user typed — so name it here.
+    if (!bundleExists(bundle)) {
+        throw new Error(`The '${bundle}' bundle does not exist. ` +
+            `Pass credentials directly with --token <t> [--account <id>], or create it: ` +
+            `agents secrets add ${bundle} CLOUDFLARE_API_TOKEN`);
+    }
+    const { env } = readAndResolveBundleEnv(bundle, {
+        caller: 'cloudflare',
+        // Setup is still a read; only `agents secrets unlock` may authenticate.
+        agentOnly: true,
+    });
+    const find = (re) => {
+        for (const [k, v] of Object.entries(env))
+            if (re.test(k) && v)
+                return v;
+        return '';
+    };
+    const apiToken = env.CLOUDFLARE_API_TOKEN || env.CF_API_TOKEN || find(/API[_-]?TOKEN|(?:^|_)TOKEN$/i);
+    const accountId = override?.accountId || env.CLOUDFLARE_ACCOUNT_ID || env.CF_ACCOUNT_ID || find(/ACCOUNT[_-]?ID/i);
+    if (!apiToken) {
+        const keys = Object.keys(env);
+        throw new Error(`No Cloudflare API token in the '${bundle}' bundle ` +
+            `(keys present: ${keys.length ? keys.join(', ') : 'none'}). ` +
+            `Pass it directly with --token <t> [--account <id>], or add it: ` +
+            `agents secrets add ${bundle} CLOUDFLARE_API_TOKEN`);
+    }
+    return { apiToken, accountId };
+}

package/dist/lib/cloudflare/provision.d.ts

@@ -0,0 +1,35 @@
+/** One compiled non-JS Worker module (e.g. WASM) uploaded alongside the script. */
+export interface WorkerModule {
+    name: string;
+    contentType: string;
+    contents: Uint8Array<ArrayBuffer>;
+}
+/** A Worker script plus any extra modules to upload with it. */
+export interface WorkerBundle {
+    script: string;
+    modules: WorkerModule[];
+}
+export interface CloudflareRequest {
+    apiToken: string;
+    method: string;
+    pathname: string;
+    body?: unknown;
+    form?: FormData;
+}
+export type CloudflareRequester = <T = unknown>(request: CloudflareRequest) => Promise<T>;
+interface ProvisionOptions {
+    request?: CloudflareRequester;
+}
+/** Create the R2 bucket (idempotent). */
+export declare function createBucket(apiToken: string, accountId: string, name: string, opts?: ProvisionOptions): Promise<void>;
+/** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
+export declare function deployWorker(apiToken: string, accountId: string, workerName: string, worker: string | WorkerBundle, bucketName: string, opts?: ProvisionOptions): Promise<void>;
+/** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
+export declare function putWorkerSecret(apiToken: string, accountId: string, workerName: string, name: string, text: string, opts?: ProvisionOptions): Promise<void>;
+/** Enable the free `*.workers.dev` route for the script, and return the account subdomain. */
+export declare function enableWorkersDev(apiToken: string, accountId: string, workerName: string, opts?: ProvisionOptions): Promise<string>;
+/** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
+export declare function findZoneId(apiToken: string, domain: string, opts?: ProvisionOptions): Promise<string | null>;
+/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
+export declare function addCustomDomain(apiToken: string, accountId: string, workerName: string, zoneId: string, hostname: string, opts?: ProvisionOptions): Promise<void>;
+export {};

package/dist/lib/cloudflare/provision.js

@@ -0,0 +1,144 @@
+// Generic Cloudflare orchestration — plain `fetch` against the CF REST API (the
+// repo has no CF wrapper). Create an R2 bucket, upload a module Worker with an R2
+// binding, set secrets via the Workers Secrets API, enable the free
+// `*.workers.dev` subdomain, and map a custom domain when the token owns the zone.
+//
+// This was `lib/share/provision.ts`. The artifact share engine moved out to
+// `@phnx-labs/artifacts-cli` (PHNX-3992), but `agents traces` provisions its own
+// isolated Cloudflare-backed store with the SAME primitives — so the generic
+// layer relocated here (share-specific lifecycle/collab/managed helpers left
+// with the share engine). `traces/provision.ts` is now the only consumer.
+const CF_API = 'https://api.cloudflare.com/client/v4';
+async function cf(apiToken, method, pathname, body, form) {
+    const headers = { authorization: `Bearer ${apiToken}` };
+    let payload;
+    if (form) {
+        payload = form; // fetch sets multipart boundary
+    }
+    else if (body !== undefined) {
+        headers['content-type'] = 'application/json';
+        payload = JSON.stringify(body);
+    }
+    const res = await fetch(`${CF_API}${pathname}`, { method, headers, body: payload });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok || json.success === false) {
+        const msg = (json.errors ?? []).map((e) => `${e.code ?? ''} ${e.message ?? ''}`.trim()).join('; ') ||
+            res.statusText;
+        throw new Error(`Cloudflare ${method} ${pathname} failed (${res.status}): ${msg}`);
+    }
+    return json.result;
+}
+const defaultCloudflareRequester = (request) => cf(request.apiToken, request.method, request.pathname, request.body, request.form);
+/** True if the CF error looks like "the thing already exists" (idempotent create). */
+function isAlreadyExists(e) {
+    return /already exists|duplicate|10004|10014/i.test(String(e));
+}
+/** Create the R2 bucket (idempotent). */
+export async function createBucket(apiToken, accountId, name, opts = {}) {
+    const request = opts.request ?? defaultCloudflareRequester;
+    try {
+        await request({
+            apiToken,
+            method: 'POST',
+            pathname: `/accounts/${accountId}/r2/buckets`,
+            body: { name },
+        });
+    }
+    catch (e) {
+        if (!isAlreadyExists(e))
+            throw e;
+    }
+}
+/** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
+export async function deployWorker(apiToken, accountId, workerName, worker, bucketName, opts = {}) {
+    const request = opts.request ?? defaultCloudflareRequester;
+    const metadata = {
+        main_module: 'worker.js',
+        compatibility_date: '2024-11-06',
+        bindings: [
+            { type: 'r2_bucket', name: 'BUCKET', bucket_name: bucketName },
+        ],
+    };
+    const form = new FormData();
+    form.set('metadata', new Blob([JSON.stringify(metadata)], { type: 'application/json' }));
+    const bundle = typeof worker === 'string' ? { script: worker, modules: [] } : worker;
+    form.set('worker.js', new Blob([bundle.script], { type: 'application/javascript+module' }), 'worker.js');
+    for (const module of bundle.modules) {
+        form.set(module.name, new Blob([module.contents], { type: module.contentType }), module.name);
+    }
+    await request({
+        apiToken,
+        method: 'PUT',
+        pathname: `/accounts/${accountId}/workers/scripts/${workerName}`,
+        form,
+    });
+}
+/** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
+export async function putWorkerSecret(apiToken, accountId, workerName, name, text, opts = {}) {
+    const request = opts.request ?? defaultCloudflareRequester;
+    await request({
+        apiToken,
+        method: 'PUT',
+        pathname: `/accounts/${accountId}/workers/scripts/${workerName}/secrets`,
+        body: { name, text, type: 'secret_text' },
+    });
+}
+/** Enable the free `*.workers.dev` route for the script, and return the account subdomain. */
+export async function enableWorkersDev(apiToken, accountId, workerName, opts = {}) {
+    const request = opts.request ?? defaultCloudflareRequester;
+    await request({
+        apiToken,
+        method: 'POST',
+        pathname: `/accounts/${accountId}/workers/scripts/${workerName}/subdomain`,
+        body: {
+            enabled: true,
+            previews_enabled: false,
+        },
+    });
+    const sub = await request({
+        apiToken,
+        method: 'GET',
+        pathname: `/accounts/${accountId}/workers/subdomain`,
+    });
+    if (!sub?.subdomain) {
+        throw new Error('No workers.dev subdomain on this account yet — register one at dash.cloudflare.com → Workers → Subdomain, then re-run.');
+    }
+    return sub.subdomain;
+}
+/** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
+export async function findZoneId(apiToken, domain, opts = {}) {
+    const request = opts.request ?? defaultCloudflareRequester;
+    // Try the exact name, then the registrable parent (share.getrush.ai -> getrush.ai).
+    const candidates = [domain, domain.split('.').slice(-2).join('.')];
+    for (const name of candidates) {
+        const zones = await request({
+            apiToken,
+            method: 'GET',
+            pathname: `/zones?name=${encodeURIComponent(name)}`,
+        }).catch(() => []);
+        if (zones?.length)
+            return zones[0].id;
+    }
+    return null;
+}
+/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
+export async function addCustomDomain(apiToken, accountId, workerName, zoneId, hostname, opts = {}) {
+    const request = opts.request ?? defaultCloudflareRequester;
+    try {
+        await request({
+            apiToken,
+            method: 'PUT',
+            pathname: `/accounts/${accountId}/workers/domains`,
+            body: {
+                zone_id: zoneId,
+                hostname,
+                service: workerName,
+                environment: 'production',
+            },
+        });
+    }
+    catch (e) {
+        if (!isAlreadyExists(e))
+            throw e;
+    }
+}

package/dist/lib/codex-policy.d.ts

@@ -1,4 +1,4 @@
-export type CodexPolicyMode = 'plan' | 'edit' | 'auto' | 'skip';
+type CodexPolicyMode = 'plan' | 'edit' | 'auto' | 'skip';
 export declare const CODEX_PLAN_PROFILE = "agents-plan";
 export declare const CODEX_EDIT_PROFILE = "agents-edit";
 export declare const CODEX_AUTO_PROFILE = "agents-auto";
@@ -33,3 +33,4 @@ export declare function codexPolicyArgs(mode: CodexPolicyMode, writableRoots?: s
 export declare function modeForRemoteDispatch(mode: string, source: string | undefined): string | undefined;
 /** Only the untouched Commander default selects Codex's writable default. */
 export declare function modeWasImplicit(source: string | undefined, hasConfiguredDefault: boolean): boolean;
+export {};