void 0.21.9 → 0.23.0

package/dist/cli/cloudflare-operation-process.mjs

@@ -0,0 +1,1103 @@
+#!/usr/bin/env node
+import { n as __toESM } from "../rolldown-runtime-DXIUcv95.mjs";
+import { a as join, n as dirname, u as resolve } from "../dist-BVqXeR_h.mjs";
+import { t as require_picocolors } from "../picocolors-BTps1_gs.mjs";
+import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { tmpdir } from "node:os";
+import { spawn, spawnSync } from "node:child_process";
+import { parse } from "jsonc-parser";
+import { stripVTControlCharacters } from "node:util";
+import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
+import { getCloudflareAuthUseKeyringFromEnv } from "@cloudflare/workers-auth";
+import { createCfAuth, createCfProfileStore, readUserPreferences, setKeyringPreference } from "@cloudflare/workers-auth/cf";
+//#region src/cli/cf-session.ts
+const logger = {
+	debug() {},
+	info() {},
+	log() {},
+	warn() {},
+	error() {}
+};
+function session(root) {
+	const auth = createCfAuth({
+		logger,
+		userAgent: "void",
+		prompt: async () => {
+			throw new Error("Cloudflare session reads cannot prompt.");
+		},
+		select: async () => {
+			throw new Error("Cloudflare session reads cannot prompt.");
+		},
+		isNoDefaultValueProvidedError: () => false
+	});
+	auth.setProfile(createCfProfileStore({ logger }).resolve({ cwd: root }));
+	return auth;
+}
+/** Borrow only the profile just verified by cf, including its encrypted store. */
+function readCfSessionCredential(root, identity) {
+	if (identity.authenticated !== true || identity.tokenValid !== true) return null;
+	const auth = session(root);
+	if (identity.authSource !== `OAuth token from ${auth.getCredentialStore().path()}`) return null;
+	const token = auth.readAuthCredentials()?.oauth_token;
+	if (typeof token === "string" && token.length > 0) persistCfKeyringPreference(root);
+	return typeof token === "string" && token.length > 0 ? token : null;
+}
+/** Keep subsequent cf logins on the encrypted profile adopted by Void. */
+function persistCfKeyringPreference(root) {
+	if (getCloudflareAuthUseKeyringFromEnv() === false || readUserPreferences().keyring_enabled === true) return;
+	const auth = session(root);
+	if (!setKeyringPreference(true, {
+		logger,
+		getCredentialStore: auth.getCredentialStore
+	}).enabled) throw new Error("Cloudflare encrypted credential storage is unavailable.");
+}
+//#endregion
+//#region src/cli/cloudflare-login-output.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+/** The bundled cf login prints the device code before opening the browser. */
+function cloudflareDeviceCode(output) {
+	const plain = stripVTControlCharacters(output);
+	return /and enter the code:\s*([A-Za-z0-9-]+)\s/i.exec(plain)?.[1] ?? /[?&]user_code=([A-Za-z0-9-]+)\s/i.exec(plain)?.[1] ?? null;
+}
+function cloudflareVerificationUrl(output) {
+	const plain = stripVTControlCharacters(output);
+	return /(?:Opening a link in your default browser:|Visit this link to authenticate:)\s*(https?:\/\/\S+)\s/i.exec(plain)?.[1] ?? /please visit:\s*(https?:\/\/\S+)\s/i.exec(plain)?.[1] ?? null;
+}
+function printCloudflareLoginLink(url) {
+	console.log(`Open this link if your browser did not open: ${url}`);
+}
+function printCloudflareLoginPrompt(code) {
+	console.log(code ? `Opening Cloudflare login in your browser. Confirm the code ${import_picocolors.default.blue(code)} in your browser. Press Ctrl+C to cancel.` : "Opening Cloudflare login in your browser. Confirm the code shown in your browser. Press Ctrl+C to cancel.");
+}
+//#endregion
+//#region src/cli/cloudflare-operation-process.ts
+const cf = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "bin", "cf");
+const operation = (() => {
+	try {
+		return JSON.parse(process.argv[2] ?? "null");
+	} catch {
+		return null;
+	}
+})();
+process.env.CLOUDFLARE_AUTH_USE_KEYRING ??= "true";
+function cfEnvironment() {
+	const env = {
+		...process.env,
+		CF_DELEGATION: "1",
+		CF_SEND_TELEMETRY: "false",
+		CF_NO_OSC_PROGRESS: "1",
+		CLOUDFLARE_AUTH_USE_KEYRING: process.env.CLOUDFLARE_AUTH_USE_KEYRING
+	};
+	if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) env.NODE_USE_ENV_PROXY = "1";
+	for (const [canonical, alias] of [
+		["CLOUDFLARE_API_TOKEN", "CF_API_TOKEN"],
+		["CLOUDFLARE_API_KEY", "CF_API_KEY"],
+		["CLOUDFLARE_EMAIL", "CF_EMAIL"],
+		["CLOUDFLARE_ACCOUNT_ID", "CF_ACCOUNT_ID"]
+	]) if (!env[canonical] && env[alias]) env[canonical] = env[alias];
+	return env;
+}
+function result(status, stdout = "", stderr = "", data) {
+	const code = /\[(?:code:\s*)?(\d{4,})\]/.exec(stderr);
+	const errorCode = code ? Number(code[1]) : void 0;
+	return {
+		status,
+		stdout,
+		stderr,
+		...data !== void 0 ? { data } : {},
+		...errorCode ? { errorCode } : {},
+		...[
+			10006,
+			10007,
+			10090
+		].includes(errorCode ?? 0) ? { failure: "not-found" } : {}
+	};
+}
+function runCf(command, cwd = process.cwd()) {
+	const env = cfEnvironment();
+	env.CF_QUIET = "1";
+	const child = spawnSync(process.execPath, [cf, ...command], {
+		cwd,
+		env,
+		encoding: "utf8",
+		shell: false,
+		windowsHide: true,
+		maxBuffer: 33554432,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	const stderr = [
+		child.stderr || "",
+		child.error?.message || "",
+		child.signal ? `Cloudflare CLI terminated by ${child.signal}.` : ""
+	].filter(Boolean).join("\n").replace(/\[(\d{4,})\]/g, "[code: $1]");
+	if (child.signal || child.error || child.status === null) return {
+		status: 1,
+		stdout: "",
+		stderr,
+		signal: child.signal,
+		error: child.error?.message ?? (child.signal ? void 0 : "Cloudflare CLI did not report an exit status.")
+	};
+	return result(child.status, child.stdout ?? "", stderr);
+}
+function runInteractiveCf(command) {
+	return new Promise((resolve) => {
+		const child = spawn(process.execPath, [
+			cf,
+			...command,
+			"--quiet"
+		], {
+			cwd: process.cwd(),
+			env: {
+				...cfEnvironment(),
+				CF_QUIET: "1"
+			},
+			shell: false,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let output = "";
+		let announced = false;
+		let announcedLink = false;
+		let settled = false;
+		const finish = (value) => {
+			if (!settled) {
+				settled = true;
+				resolve(value);
+			}
+		};
+		const collect = (chunk) => {
+			output = (output + chunk.toString()).slice(-32768);
+			if (!announced) {
+				const code = cloudflareDeviceCode(output);
+				if (code) {
+					announced = true;
+					printCloudflareLoginPrompt(code);
+				}
+			}
+			if (!announcedLink) {
+				const url = cloudflareVerificationUrl(output);
+				if (url) {
+					announcedLink = true;
+					printCloudflareLoginLink(url);
+				}
+			}
+		};
+		child.stdout.on("data", collect);
+		child.stderr.on("data", collect);
+		child.once("error", (error) => finish(result(1, "", error.message)));
+		child.once("close", (status, signal) => {
+			if (status === 0) {
+				if (!announced) printCloudflareLoginPrompt(null);
+				finish(result(0));
+			} else finish(result(status ?? 1, "", output.trim() || `Cloudflare login ended${signal ? ` (${signal})` : ""}.`));
+		});
+	});
+}
+async function withBuildOutput(raw, sourceMain, action) {
+	const scratch = mkdtempSync(join(tmpdir(), "void-cf-command-"));
+	try {
+		const main = "index.js";
+		if (sourceMain) copyFileSync(sourceMain, join(scratch, main));
+		else writeFileSync(join(scratch, main), "export default { fetch() { return new Response(\"\"); } };\n");
+		writeFileSync(join(scratch, "wrangler.json"), JSON.stringify({
+			...raw,
+			main,
+			compatibility_date: raw.compatibility_date ?? "2025-01-01"
+		}), { mode: 384 });
+		const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? raw.account_id;
+		if (typeof accountId !== "string" || !accountId) throw new Error("Cloudflare account is not pinned for Worker deployment.");
+		const { prepareCfBuildOutput } = await import("../cf-build-output-_0HNWysu.mjs");
+		const output = await prepareCfBuildOutput(scratch, accountId);
+		if (!output) throw new Error("Could not prepare the Cloudflare Worker build output.");
+		try {
+			await assertExistingProvisionableResources(output.directory, accountId);
+			return action(output.directory);
+		} finally {
+			await output.dispose();
+		}
+	} finally {
+		rmSync(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function parsedJson(value) {
+	return JSON.parse(value);
+}
+function object(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Cloudflare returned an unexpected response.");
+	return value;
+}
+function configPath() {
+	return "configPath" in operation ? operation.configPath : void 0;
+}
+function config() {
+	const path = configPath();
+	if (!path) throw new Error("Cloudflare config path is required for this operation.");
+	return object(parse(readFileSync(path, "utf8")));
+}
+function workerName() {
+	const name = ("workerName" in operation ? operation.workerName : void 0) ?? config().name;
+	if (typeof name !== "string" || !name) throw new Error("Cloudflare Worker name is missing from the generated config.");
+	return name;
+}
+function updateBinding(section, binding, values) {
+	const path = configPath();
+	if (!path || !binding) throw new Error("Cloudflare resource binding and config are required.");
+	const current = config();
+	const previous = Array.isArray(current[section]) ? current[section] : [];
+	const existing = previous.map(object).find((entry) => entry.binding === binding);
+	current[section] = [...previous.filter((entry) => object(entry).binding !== binding), {
+		...existing,
+		binding,
+		...values
+	}];
+	writeFileSync(path, `${JSON.stringify(current, null, 2)}\n`);
+}
+function d1Database(token) {
+	const entries = config().d1_databases;
+	if (!Array.isArray(entries)) throw new Error("D1 database binding is unavailable.");
+	const selected = entries.map(object).find((entry) => entry.database_id === token || entry.database_name === token || entry.binding === token);
+	if (!selected || typeof selected.database_id !== "string") throw new Error("D1 database binding is unavailable.");
+	return {
+		id: selected.database_id,
+		dir: typeof selected.migrations_dir === "string" ? selected.migrations_dir : "./migrations",
+		...typeof selected.migrations_pattern === "string" ? { pattern: selected.migrations_pattern } : {},
+		table: typeof selected.migrations_table === "string" ? selected.migrations_table : "d1_migrations"
+	};
+}
+function cleanJson(command, transform) {
+	const called = runCf(command);
+	if (called.status !== 0 || !transform) return called;
+	return result(0, `${JSON.stringify(transform(parsedJson(called.stdout)))}\n`, called.stderr);
+}
+function accountId() {
+	const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? config().account_id;
+	if (typeof accountId !== "string" || !accountId) throw new Error("Cloudflare account is not pinned for API inspection.");
+	return accountId;
+}
+async function cloudflareApiGet(path, failure, extraHeaders = {}) {
+	const url = `${(process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "")}${path}`;
+	const proxy = process.env.HTTP_PROXY || process.env.HTTPS_PROXY || process.env.http_proxy || process.env.https_proxy ? new EnvHttpProxyAgent() : null;
+	try {
+		const response = await fetch$1(url, {
+			headers: {
+				...await apiHeaders(),
+				...extraHeaders
+			},
+			redirect: "error",
+			signal: AbortSignal.timeout(3e4),
+			...proxy ? { dispatcher: proxy } : {}
+		});
+		const body = object(await response.json());
+		if (!response.ok || body.success !== true) throw new Error(failure);
+		return body;
+	} finally {
+		await proxy?.close();
+	}
+}
+async function clearWorkerCronSchedules(worker) {
+	const endpoint = `${(process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "")}/accounts/${encodeURIComponent(accountId())}/workers/scripts/${encodeURIComponent(worker)}/schedules`;
+	const proxy = process.env.HTTP_PROXY || process.env.HTTPS_PROXY || process.env.http_proxy || process.env.https_proxy ? new EnvHttpProxyAgent() : null;
+	try {
+		const response = await fetch$1(endpoint, {
+			method: "PUT",
+			headers: {
+				...await apiHeaders(),
+				"Content-Type": "application/json"
+			},
+			body: "[]",
+			redirect: "error",
+			signal: AbortSignal.timeout(3e4),
+			...proxy ? { dispatcher: proxy } : {}
+		});
+		const body = object(await response.json());
+		const schedules = object(body.result).schedules;
+		if (!response.ok || body.success !== true || !Array.isArray(schedules) || schedules.length !== 0) throw new Error(`Cloudflare did not clear the Worker Cron Triggers (HTTP ${response.status}).`);
+		return result(0);
+	} finally {
+		await proxy?.close();
+	}
+}
+async function clearWorkerCustomDomains(worker) {
+	const endpoint = `${(process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "")}/accounts/${encodeURIComponent(accountId())}/workers/scripts/${encodeURIComponent(worker)}/domains/records`;
+	const proxy = process.env.HTTP_PROXY || process.env.HTTPS_PROXY || process.env.http_proxy || process.env.https_proxy ? new EnvHttpProxyAgent() : null;
+	try {
+		const response = await fetch$1(endpoint, {
+			method: "PUT",
+			headers: {
+				...await apiHeaders(),
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({
+				override_scope: true,
+				override_existing_origin: false,
+				override_existing_dns_record: false,
+				origins: []
+			}),
+			redirect: "error",
+			signal: AbortSignal.timeout(3e4),
+			...proxy ? { dispatcher: proxy } : {}
+		});
+		if (!response.ok) throw new Error(`Cloudflare rejected the empty custom-domain set (HTTP ${response.status}).`);
+		let body;
+		try {
+			body = await response.json();
+		} catch {
+			throw new Error(`Cloudflare returned HTTP ${response.status} with a non-JSON custom-domain response.`);
+		}
+		if (object(body).success !== true) throw new Error(`Cloudflare rejected the empty custom-domain set (HTTP ${response.status}).`);
+		return result(0);
+	} finally {
+		await proxy?.close();
+	}
+}
+async function assertExistingProvisionableResources(directory, account) {
+	const { readBuildOutput } = await import("@cloudflare/build-output-utils");
+	const bindings = (await readBuildOutput(directory)).workers.default.config.env ?? {};
+	const queueNames = /* @__PURE__ */ new Set();
+	const accountPath = `/accounts/${encodeURIComponent(account)}`;
+	for (const [bindingName, value] of Object.entries(bindings)) {
+		const binding = object(value);
+		const identifier = (key) => {
+			const id = binding[key];
+			if (typeof id !== "string" || !id) throw new Error(`Cloudflare binding ${bindingName} has no ${key}; refusing automatic provisioning.`);
+			return id;
+		};
+		if (binding.type === "kv" || binding.type === "d1") identifier("id");
+		else if (binding.type === "r2") {
+			const name = identifier("name");
+			const jurisdiction = binding.jurisdiction;
+			if (jurisdiction !== void 0 && typeof jurisdiction !== "string") throw new Error(`Cloudflare R2 binding ${bindingName} has an invalid jurisdiction.`);
+			await cloudflareApiGet(`${accountPath}/r2/buckets/${encodeURIComponent(name)}`, `Cloudflare R2 bucket ${name} is unavailable; refusing automatic provisioning.`, jurisdiction ? { "cf-r2-jurisdiction": jurisdiction } : {});
+		} else if (binding.type === "queue") queueNames.add(identifier("name"));
+		else if (binding.type === "dispatch-namespace") {
+			const name = identifier("namespace");
+			await cloudflareApiGet(`${accountPath}/workers/dispatch/namespaces/${encodeURIComponent(name)}`, `Cloudflare dispatch namespace ${name} is unavailable; refusing automatic provisioning.`);
+		} else if (binding.type === "ai-search-namespace") {
+			const name = identifier("namespace");
+			await cloudflareApiGet(`${accountPath}/ai-search/namespaces/${encodeURIComponent(name)}`, `Cloudflare AI Search namespace ${name} is unavailable; refusing automatic provisioning.`);
+		} else if (binding.type === "agent-memory") {
+			const name = identifier("namespace");
+			await cloudflareApiGet(`${accountPath}/agent-memory/namespaces/${encodeURIComponent(name)}`, `Cloudflare Agent Memory namespace ${name} is unavailable; refusing automatic provisioning.`);
+		} else if (binding.type === "flagship") identifier("id");
+	}
+	if (queueNames.size > 0) {
+		const existing = new Set((await readAllQueues()).map((queue) => queue.queue_name));
+		for (const name of queueNames) if (!existing.has(name)) throw new Error(`Cloudflare Queue ${name} is unavailable; refusing automatic provisioning.`);
+	}
+}
+async function readVersionResources(worker, versionId) {
+	const resources = object(object((await cloudflareApiGet(`/accounts/${encodeURIComponent(accountId())}/workers/scripts/${encodeURIComponent(worker)}/versions/${encodeURIComponent(versionId)}`, "Cloudflare did not return Worker version resources.")).result).resources);
+	if (!Array.isArray(resources.bindings) || !resources.script || !resources.script_runtime) throw new Error("Cloudflare Worker version resources were incomplete.");
+	return resources;
+}
+async function apiHeaders() {
+	const key = process.env.CLOUDFLARE_API_KEY ?? process.env.CF_API_KEY;
+	const email = process.env.CLOUDFLARE_EMAIL ?? process.env.CF_EMAIL;
+	if (key && email) return {
+		"X-Auth-Key": key,
+		"X-Auth-Email": email
+	};
+	const credential = await sessionCredential();
+	if (!credential) throw new Error("Cloudflare session bearer is unavailable.");
+	return { Authorization: `Bearer ${credential.token}` };
+}
+async function withSecretFile(content, action) {
+	const directory = mkdtempSync(join(tmpdir(), "void-cf-secret-"));
+	try {
+		const path = join(directory, "body.json");
+		writeFileSync(path, content, { mode: 384 });
+		return await action(path);
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function sessionCredential() {
+	const token = process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN;
+	if (token) return {
+		type: "api_token",
+		token
+	};
+	const identity = runCf(["auth", "whoami"]);
+	if (identity.status !== 0) return null;
+	const state = object(parsedJson(identity.stdout));
+	if (state.authenticated !== true || state.tokenValid !== true) return null;
+	const credential = readCfSessionCredential(process.cwd(), state);
+	return credential ? {
+		type: "oauth",
+		token: credential
+	} : null;
+}
+async function auth() {
+	if (operation.type === "auth.login") {
+		const loggedIn = await runInteractiveCf([
+			"auth",
+			"login",
+			"--force"
+		]);
+		if (loggedIn.status === 0) persistCfKeyringPreference(process.cwd());
+		return loggedIn;
+	}
+	if (operation.type === "auth.logout") return runCf(["auth", "logout"]);
+	if (operation.type === "auth.whoami") {
+		const called = runCf(["auth", "whoami"]);
+		if (called.status !== 0) return called;
+		const identity = object(parsedJson(called.stdout));
+		if (identity.authenticated !== true || identity.tokenValid !== true) return result(1, "", "Cloudflare authentication is required.", { loggedIn: false });
+		if (String(identity.authSource).startsWith("OAuth token from ")) persistCfKeyringPreference(process.cwd());
+		return result(0, "", called.stderr, {
+			loggedIn: true,
+			accounts: identity.accounts,
+			email: identity.email,
+			tokenPermissions: identity.scopes,
+			authType: process.env.CLOUDFLARE_API_KEY || process.env.CF_API_KEY ? "Global API Key" : String(identity.authSource).startsWith("OAuth token") ? "OAuth Token" : "API Token"
+		});
+	}
+	if (operation.type !== "auth.token") throw new Error("Unsupported Cloudflare authentication operation.");
+	const credential = await sessionCredential();
+	return credential ? result(0, "", "", credential) : result(1, "", "Cloudflare session has no OAuth bearer.");
+}
+function listAllResourcePages(command, extraFlags = []) {
+	const pageSize = 100;
+	const entries = [];
+	for (let page = 1; page <= 100; page++) {
+		const listed = runCf([
+			...command,
+			"--page",
+			String(page),
+			"--per-page",
+			String(pageSize),
+			...extraFlags
+		]);
+		if (listed.status !== 0) return listed;
+		const items = parsedJson(listed.stdout);
+		if (!Array.isArray(items) || items.length > pageSize) throw new Error(`Cloudflare returned an invalid ${command.join(" ")} page.`);
+		entries.push(...items);
+		if (items.length < pageSize) return result(0, `${JSON.stringify(entries)}\n`);
+	}
+	throw new Error(`Cloudflare ${command.join(" ")} exceeded the supported page limit.`);
+}
+async function readAllQueues() {
+	const queues = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (let page = 1; page <= 1e3; page++) {
+		const body = await cloudflareApiGet(`/accounts/${encodeURIComponent(accountId())}/queues?page=${page}`, "Cloudflare did not return the Queue list.");
+		const entries = body.result;
+		const info = object(body.result_info);
+		if (!Array.isArray(entries) || !Number.isSafeInteger(info.page) || info.page !== page || !Number.isSafeInteger(info.total_pages) || info.total_pages < 0 || info.total_pages > 1e3) throw new Error("Cloudflare returned incomplete Queue pagination.");
+		for (const entry of entries) {
+			const queue = object(entry);
+			if (typeof queue.queue_id !== "string" || typeof queue.queue_name !== "string" || seen.has(queue.queue_id)) throw new Error("Cloudflare returned an invalid Queue list.");
+			seen.add(queue.queue_id);
+			queues.push(queue);
+		}
+		if (page >= info.total_pages) return queues;
+	}
+	throw new Error("Cloudflare Queue list exceeded the supported page limit.");
+}
+async function resources() {
+	switch (operation.type) {
+		case "d1.execute": return runCf([
+			"d1",
+			"query",
+			d1Database(operation.database).id,
+			"--sql",
+			operation.sql
+		]);
+		case "d1.migrations.list":
+		case "d1.migrations.apply": {
+			const database = d1Database(operation.database);
+			const verb = operation.type === "d1.migrations.list" ? "list" : "apply";
+			const called = runCf([
+				"d1",
+				"migrations",
+				verb,
+				database.id,
+				"--dir",
+				database.dir,
+				...database.pattern ? ["--pattern", database.pattern] : [],
+				"--table",
+				database.table
+			]);
+			if (called.status !== 0 || verb !== "list") return called;
+			const pending = parsedJson(called.stdout);
+			if (!Array.isArray(pending) || pending.some((item) => typeof object(item).Name !== "string")) throw new Error("D1 migration list was malformed.");
+			return result(0, "", called.stderr, { pending: pending.map((item) => object(item).Name) });
+		}
+		case "containers.list": return runCf([
+			"containers",
+			"applications",
+			"list"
+		]);
+		case "d1.list": return listAllResourcePages(["d1", "list"]);
+		case "d1.info": {
+			const listed = listAllResourcePages(["d1", "list"]);
+			if (listed.status !== 0) return listed;
+			const list = parsedJson(listed.stdout);
+			if (!Array.isArray(list)) throw new Error("D1 list was malformed.");
+			const value = list.find((item) => object(item).name === operation.name);
+			return value === void 0 ? {
+				...result(1, "", "D1 database does not exist."),
+				failure: "not-found"
+			} : result(0, "", "", value);
+		}
+		case "d1.create": {
+			const created = runCf([
+				"d1",
+				"create",
+				"--name",
+				operation.name
+			]);
+			if (created.status !== 0) return created;
+			const database = object(parsedJson(created.stdout));
+			if (typeof database.uuid !== "string") throw new Error("D1 creation returned no database ID.");
+			updateBinding("d1_databases", operation.binding, {
+				database_name: operation.name,
+				database_id: database.uuid
+			});
+			return created;
+		}
+		case "kv.namespace.list": return listAllResourcePages([
+			"kv",
+			"namespaces",
+			"list"
+		], [
+			"--order",
+			"id",
+			"--direction",
+			"asc"
+		]);
+		case "kv.namespace.create": {
+			const created = runCf([
+				"kv",
+				"namespaces",
+				"create",
+				"--title",
+				operation.name
+			]);
+			if (created.status !== 0) return created;
+			const namespace = object(parsedJson(created.stdout));
+			if (typeof namespace.id !== "string") throw new Error("KV creation returned no namespace ID.");
+			updateBinding("kv_namespaces", operation.binding, { id: namespace.id });
+			return created;
+		}
+		case "r2.bucket.info": return runCf([
+			"r2",
+			"buckets",
+			"get",
+			operation.name
+		]);
+		case "r2.bucket.create": {
+			const created = runCf([
+				"r2",
+				"buckets",
+				"create",
+				"--name",
+				operation.name
+			]);
+			if (created.status === 0) updateBinding("r2_buckets", operation.binding, { bucket_name: operation.name });
+			return created;
+		}
+		case "hyperdrive.create": {
+			const url = new URL(readFileSync(0, "utf8"));
+			const name = operation.name;
+			const created = await withSecretFile(JSON.stringify({
+				name,
+				origin: {
+					host: url.hostname,
+					port: Number(url.port || (url.protocol.startsWith("mysql") ? 3306 : 5432)),
+					database: decodeURIComponent(url.pathname.replace(/^\//, "")),
+					scheme: url.protocol.replace(":", ""),
+					user: decodeURIComponent(url.username),
+					password: decodeURIComponent(url.password)
+				}
+			}), (path) => runCf([
+				"hyperdrive",
+				"create",
+				"--body",
+				"@" + path
+			]));
+			if (created.status !== 0) return {
+				...created,
+				stdout: "",
+				stderr: "Hyperdrive creation failed."
+			};
+			const hyperdrive = object(parsedJson(created.stdout));
+			if (typeof hyperdrive.id !== "string") throw new Error("Hyperdrive creation returned no ID.");
+			updateBinding("hyperdrive", operation.binding, { id: hyperdrive.id });
+			return result(0, "", "", {
+				id: hyperdrive.id,
+				name
+			});
+		}
+		case "queues.create": return runCf([
+			"queues",
+			"create",
+			"--queue-name",
+			operation.name
+		]);
+		case "queues.info": {
+			const queue = (await readAllQueues()).find((item) => item.queue_name === operation.name);
+			return queue ? result(0, "", "", {
+				id: queue.queue_id,
+				name: queue.queue_name
+			}) : {
+				...result(1, "", "Cloudflare Queue does not exist."),
+				failure: "not-found"
+			};
+		}
+		default: throw new Error("Unsupported Cloudflare resource operation.");
+	}
+}
+function emailZone(domain) {
+	const labels = domain.split(".");
+	for (let offset = 0; offset <= labels.length - 2; offset++) {
+		const candidate = labels.slice(offset).join(".");
+		const read = runCf([
+			"email-routing",
+			"settings",
+			"get",
+			"--zone",
+			candidate
+		]);
+		if (read.status === 0) return candidate;
+		if (read.signal || read.error || !/Zone not found:/.test(read.stderr)) throw new Error("Cloudflare could not resolve the Email zone.");
+	}
+	throw new Error(`Cloudflare Email zone for ${domain} was not found.`);
+}
+function email() {
+	if (!("domain" in operation)) throw new Error("Cloudflare Email domain is missing.");
+	const domain = operation.domain;
+	switch (operation.type) {
+		case "email.routing.settings": {
+			const read = runCf([
+				"email-routing",
+				"settings",
+				"get",
+				"--zone",
+				domain
+			]);
+			return read.status !== 0 && !read.signal && !read.error && /Zone not found:/.test(read.stderr) ? result(0, "", "", null) : read;
+		}
+		case "email.routing.enable": return runCf([
+			"email-routing",
+			"enable",
+			"--zone",
+			domain,
+			"--name",
+			domain
+		]);
+		case "email.routing.rules.list": return listAllResourcePages([
+			"email-routing",
+			"rules",
+			"list-account"
+		], ["--zone", domain]);
+		case "email.sending.settings": {
+			const listed = runCf([
+				"email-sending",
+				"subdomains",
+				"list",
+				"--zone",
+				emailZone(domain)
+			]);
+			if (listed.status !== 0) return listed;
+			const values = parsedJson(listed.stdout);
+			if (!Array.isArray(values)) throw new Error("Email Sending subdomains were malformed.");
+			return result(0, "", "", values.map(object).find((item) => item.name === domain) ?? null);
+		}
+		case "email.sending.enable": return runCf([
+			"email-sending",
+			"subdomains",
+			"create",
+			"--zone",
+			emailZone(domain),
+			"--name",
+			domain
+		]);
+		default: throw new Error("Unsupported Cloudflare Email operation.");
+	}
+}
+async function secrets() {
+	const worker = workerName();
+	const apply = async (action) => {
+		const first = action();
+		if (first.status === 0 || first.errorCode !== 10007) return first;
+		const draft = await withBuildOutput({
+			name: worker,
+			account_id: process.env.CLOUDFLARE_ACCOUNT_ID ?? config().account_id,
+			compatibility_date: config().compatibility_date ?? "2025-01-01",
+			workers_dev: false,
+			preview_urls: false
+		}, null, (directory) => runCf([
+			"deploy",
+			"--prebuilt",
+			"--message",
+			"void:secret-draft"
+		], directory));
+		return draft.status === 0 ? action() : draft;
+	};
+	switch (operation.type) {
+		case "secret.list": return runCf([
+			"workers",
+			"secrets",
+			"list",
+			"--worker",
+			worker
+		]);
+		case "secret.put": {
+			const value = readFileSync(0, "utf8").replace(/\n$/, "");
+			const name = operation.name;
+			return withSecretFile(JSON.stringify({
+				name,
+				text: value,
+				type: "secret_text"
+			}), (path) => apply(() => runCf([
+				"workers",
+				"secrets",
+				"update",
+				name,
+				"--worker",
+				worker,
+				"--body",
+				"@" + path
+			])));
+		}
+		case "secret.bulk": {
+			const values = object(parsedJson(readFileSync(0, "utf8")));
+			const patch = Object.fromEntries(Object.entries(values).map(([name, text]) => [name, {
+				type: "secret_text",
+				text
+			}]));
+			return withSecretFile(JSON.stringify(patch), (path) => apply(() => runCf([
+				"workers",
+				"secrets",
+				"bulk",
+				"--worker",
+				worker,
+				"--file",
+				path
+			])));
+		}
+		case "secret.delete": return runCf([
+			"workers",
+			"secrets",
+			"delete",
+			operation.name,
+			"--worker",
+			worker,
+			"--force"
+		]);
+		default: throw new Error("Unsupported Cloudflare secret operation.");
+	}
+}
+async function workerHistory() {
+	const worker = workerName();
+	switch (operation.type) {
+		case "deployments.status":
+		case "deployments.list": {
+			const called = runCf([
+				"workers",
+				"deployments",
+				"list",
+				"--worker",
+				worker
+			]);
+			if (called.status !== 0) return called;
+			const deployments = object(parsedJson(called.stdout)).deployments;
+			if (!Array.isArray(deployments)) throw new Error("Worker deployments were malformed.");
+			return operation.type === "deployments.list" ? result(0, "", called.stderr, deployments) : deployments[0] ? result(0, "", called.stderr, deployments[0]) : result(1, "", "Worker has no active deployment.");
+		}
+		case "versions.list": return cleanJson([
+			"workers",
+			"versions",
+			"list",
+			"--worker-id",
+			worker
+		], (value) => {
+			if (!Array.isArray(value)) throw new Error("Worker versions were malformed.");
+			return value.map((entry) => {
+				const version = object(entry);
+				return {
+					...version,
+					metadata: { created_on: version.created_on }
+				};
+			});
+		});
+		case "versions.view": {
+			const versionId = operation.versionId;
+			const called = runCf([
+				"workers",
+				"versions",
+				"get",
+				versionId,
+				"--worker-id",
+				worker
+			]);
+			if (called.status !== 0) return called;
+			const version = object(parsedJson(called.stdout));
+			if (version.id !== versionId || !Array.isArray(version.bindings)) throw new Error("Worker version bindings were malformed.");
+			const resources = await readVersionResources(worker, versionId);
+			return result(0, "", called.stderr, {
+				...version,
+				resources
+			});
+		}
+		case "versions.deploy": {
+			const versions = operation.versions.map((value) => ({
+				version_id: value.versionId,
+				percentage: value.percentage
+			}));
+			if (!versions.length || versions.some((value) => !/^[-a-f\d]{36}$/i.test(value.version_id) || !Number.isFinite(value.percentage) || value.percentage < 0 || value.percentage > 100) || Math.abs(versions.reduce((sum, value) => sum + value.percentage, 0) - 100) > .001) throw new Error("Cloudflare deployment percentages must total 100.");
+			return runCf([
+				"workers",
+				"deployments",
+				"create",
+				"--worker",
+				worker,
+				"--body",
+				JSON.stringify({
+					strategy: "percentage",
+					versions,
+					...operation.message ? { annotations: { "workers/message": operation.message } } : {}
+				})
+			]);
+		}
+		default: throw new Error("Unsupported Cloudflare Worker history operation.");
+	}
+}
+async function workerChanges() {
+	if (operation.type === "queues.consumer.remove") {
+		const queue = (await readAllQueues()).find((item) => item.queue_name === operation.queueName);
+		if (!queue || typeof queue.queue_id !== "string") return {
+			...result(1, "", "Cloudflare Queue does not exist."),
+			failure: "not-found"
+		};
+		const consumers = runCf([
+			"queues",
+			"consumers",
+			"list",
+			"--queue-id",
+			queue.queue_id
+		]);
+		if (consumers.status !== 0) return consumers;
+		const members = parsedJson(consumers.stdout);
+		if (!Array.isArray(members)) throw new Error("Queue consumer list was malformed.");
+		const matching = members.map(object).filter((entry) => {
+			const name = entry.script_name ?? entry.script;
+			if (entry.script_name !== void 0 && (typeof entry.script_name !== "string" || !entry.script_name) || entry.script !== void 0 && (typeof entry.script !== "string" || !entry.script) || entry.script_name !== void 0 && entry.script !== void 0 && entry.script_name !== entry.script || entry.type === "worker" && name === void 0) throw new Error("Queue consumer Worker identity is ambiguous.");
+			return name === operation.workerName;
+		});
+		if (matching.length > 1) throw new Error("Queue consumer Worker identity is ambiguous.");
+		for (const item of matching) {
+			if (typeof item.consumer_id !== "string" || !item.consumer_id || item.consumer_id.startsWith("-") || /\s/.test(item.consumer_id) || [...item.consumer_id].some((character) => {
+				const code = character.charCodeAt(0);
+				return code < 32 || code === 127;
+			}) || item.type !== void 0 && item.type !== "worker") throw new Error("Queue consumer ID or type is invalid.");
+			const deleted = runCf([
+				"queues",
+				"consumers",
+				"delete",
+				item.consumer_id,
+				"--queue-id",
+				queue.queue_id,
+				"--force"
+			]);
+			if (deleted.status !== 0) return deleted;
+		}
+		return result(0);
+	}
+	const raw = config();
+	const name = workerName();
+	if (raw.name !== name) throw new Error("Cloudflare Worker target changed.");
+	if (operation.type === "triggers.clear-crons" || operation.type === "triggers.clear-domains") {
+		if (raw.account_id !== void 0 && raw.account_id !== accountId()) throw new Error("Cloudflare trigger target changed.");
+		return operation.type === "triggers.clear-crons" ? clearWorkerCronSchedules(name) : clearWorkerCustomDomains(name);
+	}
+	if (operation.type === "triggers.deploy") return withBuildOutput(raw, null, (directory) => runCf([
+		"workers",
+		"triggers",
+		"deploy",
+		"--prebuilt"
+	], directory));
+	if (operation.type === "versions.upload" || operation.type === "worker.deploy") {
+		const path = configPath();
+		if (typeof raw.main !== "string" || !raw.main || raw.no_bundle !== true) throw new Error("Cloudflare Worker upload requires a prebuilt platform Worker.");
+		const source = resolve(dirname(path), raw.main);
+		const request = operation;
+		const called = await withBuildOutput(raw, source, (directory) => runCf([
+			...request.type === "worker.deploy" ? ["deploy"] : [
+				"workers",
+				"versions",
+				"create"
+			],
+			"--prebuilt",
+			...request.message ? ["--message", request.message] : [],
+			...request.secretsFilePath ? ["--secrets-file", request.secretsFilePath] : []
+		], directory));
+		if (called.status !== 0) return called;
+		let uploaded = {};
+		try {
+			uploaded = object(parsedJson(called.stdout));
+		} catch {}
+		const output = called.stdout;
+		const versionId = uploaded.version_id ?? uploaded.id ?? uploaded.versionId ?? output.match(/(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i)?.[1];
+		if (typeof versionId !== "string" || !/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(versionId)) throw new Error("Cloudflare did not return the uploaded Worker version ID.");
+		const previewUrl = typeof uploaded.preview_url === "string" ? uploaded.preview_url : output.match(/Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i)?.[1];
+		const workersDevUrl = typeof uploaded.workers_dev_url === "string" ? uploaded.workers_dev_url : output.match(/(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i)?.[1];
+		return result(0, "", called.stderr, {
+			versionId,
+			...previewUrl ? { previewUrl } : {},
+			...workersDevUrl ? { workersDevUrl } : {}
+		});
+	}
+	throw new Error("Unsupported Cloudflare Worker operation.");
+}
+async function tail() {
+	if (operation.type !== "tail") throw new Error("Cloudflare tail operation is required.");
+	const worker = workerName();
+	const raw = config();
+	const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? raw.account_id;
+	if (!worker || typeof accountId !== "string" || !accountId || worker !== raw.name) throw new Error("Cloudflare tail target is not pinned.");
+	const filters = [];
+	if (operation.search) filters.push({ query: operation.search });
+	if (operation.versionId) filters.push({ scriptVersion: operation.versionId });
+	if (operation.status === "error") filters.push({ outcome: [
+		"exception",
+		"exceededCpu",
+		"exceededMemory",
+		"unknown"
+	] });
+	const endpoint = `${(process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "")}/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(worker)}/tails`;
+	const headers = {
+		...await apiHeaders(),
+		"Content-Type": "application/json"
+	};
+	const stopped = new AbortController();
+	let socket;
+	let finish;
+	const stop = () => {
+		stopped.abort();
+		socket?.close();
+		finish?.();
+	};
+	process.once("SIGINT", stop);
+	process.once("SIGTERM", stop);
+	let record;
+	try {
+		const created = await fetch(endpoint, {
+			method: "POST",
+			headers,
+			body: JSON.stringify({ filters }),
+			signal: AbortSignal.any([stopped.signal, AbortSignal.timeout(3e4)])
+		});
+		const body = object(await created.json());
+		if (!created.ok || body.success !== true) return result(1, "", "Could not start the Cloudflare Worker tail.");
+		record = object(body.result);
+		if (typeof record.id !== "string" || typeof record.url !== "string") throw new Error("Cloudflare Worker tail response was incomplete.");
+		const tailUrl = record.url;
+		if (stopped.signal.aborted) return result(0);
+		await new Promise((resolve, reject) => {
+			finish = resolve;
+			let pendingMessages = Promise.resolve();
+			socket = new WebSocket(tailUrl, "trace-v1");
+			socket.addEventListener("open", () => {
+				socket.send(JSON.stringify({ debug: false }));
+			});
+			socket.addEventListener("message", (event) => {
+				pendingMessages = pendingMessages.then(async () => {
+					const data = event.data;
+					const text = typeof data === "string" ? data : data instanceof Blob ? await data.text() : data instanceof ArrayBuffer ? new TextDecoder().decode(data) : null;
+					if (text === null) throw new Error("Unsupported Cloudflare tail frame.");
+					const log = object(parsedJson(text));
+					const detail = object(log.event ?? {});
+					const request = object(detail.request ?? {});
+					const prefix = typeof request.url === "string" ? `${request.method ?? "GET"} ${request.url}` : typeof detail.queue === "string" ? `Queue ${detail.queue}` : typeof detail.mailFrom === "string" ? `Email from ${detail.mailFrom}` : "Worker event";
+					process.stdout.write(`${prefix} - ${log.outcome ?? "unknown"} @ ${new Date(Number(log.eventTimestamp)).toLocaleString()}\n`);
+					if (Array.isArray(log.logs)) for (const line of log.logs.map(object)) process.stdout.write(`  (${line.level ?? "log"}) ${Array.isArray(line.message) ? line.message.join(" ") : ""}\n`);
+					if (Array.isArray(log.exceptions)) for (const exception of log.exceptions.map(object)) process.stderr.write(`  ${exception.name ?? "Error"}: ${exception.message ?? ""}\n`);
+				}).catch(() => {
+					process.stderr.write("Cloudflare returned a malformed tail event.\n");
+				});
+			});
+			socket.addEventListener("error", () => reject(/* @__PURE__ */ new Error("Cloudflare Worker tail connection failed.")));
+			socket.addEventListener("close", () => void pendingMessages.then(resolve));
+			if (stopped.signal.aborted) resolve();
+		});
+	} catch (error) {
+		if (stopped.signal.aborted) return result(0);
+		throw error;
+	} finally {
+		process.off("SIGINT", stop);
+		process.off("SIGTERM", stop);
+		socket?.close();
+		if (record && typeof record.id === "string") await fetch(`${endpoint}/${encodeURIComponent(record.id)}`, {
+			method: "DELETE",
+			headers,
+			signal: AbortSignal.timeout(5e3)
+		}).catch(() => {});
+		if (stopped.signal.aborted) process.exit(0);
+	}
+	return result(0);
+}
+async function main() {
+	if (process.argv.length !== 3) throw new Error("Exactly one typed Cloudflare operation is required.");
+	if (!operation || typeof operation !== "object" || typeof operation.type !== "string") throw new Error("Cloudflare operation is required.");
+	if (operation.type.startsWith("auth.")) return auth();
+	if (operation.type.startsWith("secret.")) return secrets();
+	if (operation.type === "tail") return tail();
+	if (operation.type.startsWith("email.")) return email();
+	if (operation.type.startsWith("deployments.") || operation.type.startsWith("versions.") && operation.type !== "versions.upload") return workerHistory();
+	if (operation.type.startsWith("triggers.") || operation.type === "worker.deploy" || operation.type === "versions.upload" || operation.type === "queues.consumer.remove") return workerChanges();
+	return resources();
+}
+try {
+	const output = await main();
+	if (operation.type !== "auth.login" && operation.type !== "tail") {
+		let data = output.data;
+		let humanOutput = "";
+		if (data === void 0 && output.stdout.trim()) try {
+			data = parsedJson(output.stdout);
+		} catch {
+			humanOutput = output.stdout;
+		}
+		process.stdout.write(JSON.stringify({
+			operationResult: 1,
+			...output.signal ? { signal: output.signal } : {},
+			...output.error ? { error: output.error } : {},
+			...data !== void 0 ? { data } : {},
+			...output.errorCode !== void 0 ? { errorCode: output.errorCode } : {},
+			...output.failure ? { failure: output.failure } : {},
+			...output.stderr ? { errors: [{
+				code: output.errorCode,
+				message: output.stderr
+			}] } : {},
+			...humanOutput ? { output: humanOutput } : {}
+		}) + "\n");
+	}
+	if (output.stderr) process.stderr.write(output.stderr);
+	process.exitCode = output.status;
+} catch (error) {
+	const message = error instanceof Error ? error.message : "Cloudflare operation failed.";
+	if (operation?.type !== "auth.login" && operation?.type !== "tail") process.stdout.write(JSON.stringify({
+		operationResult: 1,
+		errors: [{ message }]
+	}) + "\n");
+	process.stderr.write(message);
+	process.exitCode = 1;
+}
+//#endregion
+export {};