void 0.22.0 → 0.24.0

package/dist/cli/{cf-compat.mjs → cloudflare-operation-process.mjs}

@@ -2,14 +2,12 @@
 import { n as __toESM } from "../rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "../dist-BVqXeR_h.mjs";
 import { t as require_picocolors } from "../picocolors-BTps1_gs.mjs";
-import { t as prepareCfBuildOutput } from "../cf-build-output-BJ6yGEIS.mjs";
 import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { tmpdir } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { parse } from "jsonc-parser";
 import { stripVTControlCharacters } from "node:util";
-import { readBuildOutput } from "@cloudflare/build-output-utils";
 import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
 import { getCloudflareAuthUseKeyringFromEnv } from "@cloudflare/workers-auth";
 import { createCfAuth, createCfProfileStore, readUserPreferences, setKeyringPreference } from "@cloudflare/workers-auth/cf";
@@ -62,18 +60,26 @@ function cloudflareDeviceCode(output) {
 	const plain = stripVTControlCharacters(output);
 	return /and enter the code:\s*([A-Za-z0-9-]+)\s/i.exec(plain)?.[1] ?? /[?&]user_code=([A-Za-z0-9-]+)\s/i.exec(plain)?.[1] ?? null;
 }
+function cloudflareVerificationUrl(output) {
+	const plain = stripVTControlCharacters(output);
+	return /(?:Opening a link in your default browser:|Visit this link to authenticate:)\s*(https?:\/\/\S+)\s/i.exec(plain)?.[1] ?? /please visit:\s*(https?:\/\/\S+)\s/i.exec(plain)?.[1] ?? null;
+}
+function printCloudflareLoginLink(url) {
+	console.log(`Open this link if your browser did not open: ${url}`);
+}
 function printCloudflareLoginPrompt(code) {
 	console.log(code ? `Opening Cloudflare login in your browser. Confirm the code ${import_picocolors.default.blue(code)} in your browser. Press Ctrl+C to cancel.` : "Opening Cloudflare login in your browser. Confirm the code shown in your browser. Press Ctrl+C to cancel.");
 }
 //#endregion
-//#region src/cli/cf-compat.ts
-/**
-* Private transport for the existing Void Cloudflare command seams. The
-* orchestrators still use their established argument/result contracts; this
-* process translates them to the pinned cf CLI. It never invokes Wrangler.
-*/
+//#region src/cli/cloudflare-operation-process.ts
 const cf = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "bin", "cf");
-const args = process.argv.slice(2);
+const operation = (() => {
+	try {
+		return JSON.parse(process.argv[2] ?? "null");
+	} catch {
+		return null;
+	}
+})();
 process.env.CLOUDFLARE_AUTH_USE_KEYRING ??= "true";
 function cfEnvironment() {
 	const env = {
@@ -92,14 +98,23 @@ function cfEnvironment() {
 	]) if (!env[canonical] && env[alias]) env[canonical] = env[alias];
 	return env;
 }
-function result(status, stdout = "", stderr = "") {
+function result(status, stdout = "", stderr = "", data) {
+	const code = /\[(?:code:\s*)?(\d{4,})\]/.exec(stderr);
+	const errorCode = code ? Number(code[1]) : void 0;
 	return {
 		status,
 		stdout,
-		stderr
+		stderr,
+		...data !== void 0 ? { data } : {},
+		...errorCode ? { errorCode } : {},
+		...[
+			10006,
+			10007,
+			10090
+		].includes(errorCode ?? 0) ? { failure: "not-found" } : {}
 	};
 }
-function runCf(command, cwd = process.cwd()) {
+function runCf(command, cwd = process.cwd(), bounds) {
 	const env = cfEnvironment();
 	env.CF_QUIET = "1";
 	const child = spawnSync(process.execPath, [cf, ...command], {
@@ -108,7 +123,8 @@ function runCf(command, cwd = process.cwd()) {
 		encoding: "utf8",
 		shell: false,
 		windowsHide: true,
-		maxBuffer: 33554432,
+		maxBuffer: bounds?.maxOutputBytes ?? 33554432,
+		...bounds ? { timeout: bounds.timeoutMs } : {},
 		stdio: [
 			"ignore",
 			"pipe",
@@ -120,7 +136,14 @@ function runCf(command, cwd = process.cwd()) {
 		child.error?.message || "",
 		child.signal ? `Cloudflare CLI terminated by ${child.signal}.` : ""
 	].filter(Boolean).join("\n").replace(/\[(\d{4,})\]/g, "[code: $1]");
-	return result(child.status ?? 1, child.stdout ?? "", stderr);
+	if (child.signal || child.error || child.status === null) return {
+		status: 1,
+		stdout: "",
+		stderr,
+		signal: child.signal,
+		error: child.error?.message ?? (child.signal ? void 0 : "Cloudflare CLI did not report an exit status.")
+	};
+	return result(child.status, child.stdout ?? "", stderr);
 }
 function runInteractiveCf(command) {
 	return new Promise((resolve) => {
@@ -144,6 +167,7 @@ function runInteractiveCf(command) {
 		});
 		let output = "";
 		let announced = false;
+		let announcedLink = false;
 		let settled = false;
 		const finish = (value) => {
 			if (!settled) {
@@ -160,6 +184,13 @@ function runInteractiveCf(command) {
 					printCloudflareLoginPrompt(code);
 				}
 			}
+			if (!announcedLink) {
+				const url = cloudflareVerificationUrl(output);
+				if (url) {
+					announcedLink = true;
+					printCloudflareLoginLink(url);
+				}
+			}
 		};
 		child.stdout.on("data", collect);
 		child.stderr.on("data", collect);
@@ -177,7 +208,10 @@ async function withBuildOutput(raw, sourceMain, action) {
 	try {
 		const main = "index.js";
 		if (sourceMain) copyFileSync(sourceMain, join(scratch, main));
-		else writeFileSync(join(scratch, main), "export default { fetch() { return new Response(\"\"); } };\n");
+		else {
+			const { VOID_SECRET_DRAFT_SOURCE } = await import("@void/deploy-cloudflare");
+			writeFileSync(join(scratch, main), VOID_SECRET_DRAFT_SOURCE);
+		}
 		writeFileSync(join(scratch, "wrangler.json"), JSON.stringify({
 			...raw,
 			main,
@@ -185,6 +219,7 @@ async function withBuildOutput(raw, sourceMain, action) {
 		}), { mode: 384 });
 		const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? raw.account_id;
 		if (typeof accountId !== "string" || !accountId) throw new Error("Cloudflare account is not pinned for Worker deployment.");
+		const { prepareCfBuildOutput } = await import("../cf-build-output-_0HNWysu.mjs");
 		const output = await prepareCfBuildOutput(scratch, accountId);
 		if (!output) throw new Error("Could not prepare the Cloudflare Worker build output.");
 		try {
@@ -207,12 +242,8 @@ function object(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Cloudflare returned an unexpected response.");
 	return value;
 }
-function field(name) {
-	const index = args.indexOf(name);
-	return index >= 0 ? args[index + 1] : void 0;
-}
 function configPath() {
-	return field("-c") ?? field("--config");
+	return "configPath" in operation ? operation.configPath : void 0;
 }
 function config() {
 	const path = configPath();
@@ -220,7 +251,7 @@ function config() {
 	return object(parse(readFileSync(path, "utf8")));
 }
 function workerName() {
-	const name = field("--name") ?? config().name;
+	const name = ("workerName" in operation ? operation.workerName : void 0) ?? config().name;
 	if (typeof name !== "string" || !name) throw new Error("Cloudflare Worker name is missing from the generated config.");
 	return name;
 }
@@ -336,6 +367,7 @@ async function clearWorkerCustomDomains(worker) {
 	}
 }
 async function assertExistingProvisionableResources(directory, account) {
+	const { readBuildOutput } = await import("@cloudflare/build-output-utils");
 	const bindings = (await readBuildOutput(directory)).workers.default.config.env ?? {};
 	const queueNames = /* @__PURE__ */ new Set();
 	const accountPath = `/accounts/${encodeURIComponent(account)}`;
@@ -415,7 +447,7 @@ async function sessionCredential() {
 	} : null;
 }
 async function auth() {
-	if (args[0] === "login") {
+	if (operation.type === "auth.login") {
 		const loggedIn = await runInteractiveCf([
 			"auth",
 			"login",
@@ -424,26 +456,24 @@ async function auth() {
 		if (loggedIn.status === 0) persistCfKeyringPreference(process.cwd());
 		return loggedIn;
 	}
-	if (args[0] === "logout") return runCf(["auth", "logout"]);
-	if (args[0] === "whoami") {
+	if (operation.type === "auth.logout") return runCf(["auth", "logout"]);
+	if (operation.type === "auth.whoami") {
 		const called = runCf(["auth", "whoami"]);
 		if (called.status !== 0) return called;
 		const identity = object(parsedJson(called.stdout));
-		if (identity.authenticated !== true || identity.tokenValid !== true) return result(1, JSON.stringify({ loggedIn: false }), "Cloudflare authentication is required.");
+		if (identity.authenticated !== true || identity.tokenValid !== true) return result(1, "", "Cloudflare authentication is required.", { loggedIn: false });
 		if (String(identity.authSource).startsWith("OAuth token from ")) persistCfKeyringPreference(process.cwd());
-		return result(0, JSON.stringify({
+		return result(0, "", called.stderr, {
 			loggedIn: true,
 			accounts: identity.accounts,
 			email: identity.email,
 			tokenPermissions: identity.scopes,
 			authType: process.env.CLOUDFLARE_API_KEY || process.env.CF_API_KEY ? "Global API Key" : String(identity.authSource).startsWith("OAuth token") ? "OAuth Token" : "API Token"
-		}), called.stderr);
-	}
-	if (args[0] === "auth" && args[1] === "token") {
-		const credential = await sessionCredential();
-		return credential ? result(0, `${JSON.stringify(credential)}\n`) : result(1, "", "Cloudflare session has no OAuth bearer.");
+		});
 	}
-	return result(1, "", "Unsupported Cloudflare authentication operation.");
+	if (operation.type !== "auth.token") throw new Error("Unsupported Cloudflare authentication operation.");
+	const credential = await sessionCredential();
+	return credential ? result(0, "", "", credential) : result(1, "", "Cloudflare session has no OAuth bearer.");
 }
 function listAllResourcePages(command, extraFlags = []) {
 	const pageSize = 100;
@@ -484,152 +514,158 @@ async function readAllQueues() {
 	throw new Error("Cloudflare Queue list exceeded the supported page limit.");
 }
 async function resources() {
-	const [group, verb, third] = args;
-	if (group === "d1" && verb === "execute" && third) {
-		const database = d1Database(third);
-		const sql = field("--command");
-		if (!sql) throw new Error("D1 SQL command is missing.");
-		return runCf([
+	switch (operation.type) {
+		case "d1.execute": return runCf([
 			"d1",
 			"query",
-			database.id,
+			d1Database(operation.database).id,
 			"--sql",
-			sql
+			operation.sql
 		]);
-	}
-	if (group === "d1" && verb === "migrations" && (third === "list" || third === "apply")) {
-		const token = args[3];
-		if (!token) throw new Error("D1 migration target is missing.");
-		const database = d1Database(token);
-		const called = runCf([
-			"d1",
-			"migrations",
-			third,
-			database.id,
-			"--dir",
-			database.dir,
-			...database.pattern ? ["--pattern", database.pattern] : [],
-			"--table",
-			database.table
-		]);
-		if (called.status !== 0 || third !== "list") return called;
-		const pending = parsedJson(called.stdout);
-		if (!Array.isArray(pending)) throw new Error("D1 migration list was malformed.");
-		return result(0, pending.length ? `Migrations to be applied:\n${pending.map((item) => object(item).Name).join("\n")}\n` : "No migrations to apply!\n");
-	}
-	if (group === "containers" && verb === "list") return runCf([
-		"containers",
-		"applications",
-		"list"
-	]);
-	if (group === "d1" && verb === "list") return listAllResourcePages(["d1", "list"]);
-	if (group === "d1" && verb === "info" && third) {
-		const listed = listAllResourcePages(["d1", "list"]);
-		if (listed.status !== 0) return listed;
-		const value = parsedJson(listed.stdout);
-		if (!Array.isArray(value)) throw new Error("D1 list was malformed.");
-		const selected = value.find((item) => object(item).name === third) ?? null;
-		return selected === null ? result(1, "", `D1 database ${JSON.stringify(third)} does not exist.`) : result(0, `${JSON.stringify(selected)}\n`);
-	}
-	if (group === "d1" && verb === "create" && third) {
-		const created = runCf([
-			"d1",
-			"create",
-			"--name",
-			third
+		case "d1.migrations.list":
+		case "d1.migrations.apply": {
+			const database = d1Database(operation.database);
+			const verb = operation.type === "d1.migrations.list" ? "list" : "apply";
+			const called = runCf([
+				"d1",
+				"migrations",
+				verb,
+				database.id,
+				"--dir",
+				database.dir,
+				...database.pattern ? ["--pattern", database.pattern] : [],
+				"--table",
+				database.table
+			]);
+			if (called.status !== 0 || verb !== "list") return called;
+			const pending = parsedJson(called.stdout);
+			if (!Array.isArray(pending) || pending.some((item) => typeof object(item).Name !== "string")) throw new Error("D1 migration list was malformed.");
+			return result(0, "", called.stderr, { pending: pending.map((item) => object(item).Name) });
+		}
+		case "containers.list": return runCf([
+			"containers",
+			"applications",
+			"list"
 		]);
-		if (created.status !== 0) return created;
-		const database = object(parsedJson(created.stdout));
-		if (typeof database.uuid !== "string") throw new Error("D1 creation returned no database ID.");
-		updateBinding("d1_databases", field("--binding") ?? "", {
-			database_name: third,
-			database_id: database.uuid
-		});
-		return created;
-	}
-	if (group === "kv" && verb === "namespace" && third === "list") return listAllResourcePages([
-		"kv",
-		"namespaces",
-		"list"
-	], [
-		"--order",
-		"id",
-		"--direction",
-		"asc"
-	]);
-	if (group === "kv" && verb === "namespace" && third === "create" && args[3]) {
-		const created = runCf([
+		case "d1.list": return listAllResourcePages(["d1", "list"]);
+		case "d1.info": {
+			const listed = listAllResourcePages(["d1", "list"]);
+			if (listed.status !== 0) return listed;
+			const list = parsedJson(listed.stdout);
+			if (!Array.isArray(list)) throw new Error("D1 list was malformed.");
+			const value = list.find((item) => object(item).name === operation.name);
+			return value === void 0 ? {
+				...result(1, "", "D1 database does not exist."),
+				failure: "not-found"
+			} : result(0, "", "", value);
+		}
+		case "d1.create": {
+			const created = runCf([
+				"d1",
+				"create",
+				"--name",
+				operation.name
+			]);
+			if (created.status !== 0) return created;
+			const database = object(parsedJson(created.stdout));
+			if (typeof database.uuid !== "string") throw new Error("D1 creation returned no database ID.");
+			updateBinding("d1_databases", operation.binding, {
+				database_name: operation.name,
+				database_id: database.uuid
+			});
+			return created;
+		}
+		case "kv.namespace.list": return listAllResourcePages([
 			"kv",
 			"namespaces",
-			"create",
-			"--title",
-			args[3]
+			"list"
+		], [
+			"--order",
+			"id",
+			"--direction",
+			"asc"
 		]);
-		if (created.status !== 0) return created;
-		const namespace = object(parsedJson(created.stdout));
-		if (typeof namespace.id !== "string") throw new Error("KV creation returned no namespace ID.");
-		updateBinding("kv_namespaces", field("--binding") ?? "", { id: namespace.id });
-		return created;
-	}
-	if (group === "r2" && verb === "bucket" && third === "info" && args[3]) {
-		const read = runCf([
+		case "kv.namespace.create": {
+			const created = runCf([
+				"kv",
+				"namespaces",
+				"create",
+				"--title",
+				operation.name
+			]);
+			if (created.status !== 0) return created;
+			const namespace = object(parsedJson(created.stdout));
+			if (typeof namespace.id !== "string") throw new Error("KV creation returned no namespace ID.");
+			updateBinding("kv_namespaces", operation.binding, { id: namespace.id });
+			return created;
+		}
+		case "r2.bucket.info": return runCf([
 			"r2",
 			"buckets",
 			"get",
-			args[3]
+			operation.name
 		]);
-		return read.status !== 0 && /\[code:\s*10006\]/.test(read.stderr) ? result(1, "", "[code: 10006] The specified bucket does not exist.") : read;
-	}
-	if (group === "r2" && verb === "bucket" && third === "create" && args[3]) {
-		const created = runCf([
-			"r2",
-			"buckets",
-			"create",
-			"--name",
-			args[3]
-		]);
-		if (created.status === 0) updateBinding("r2_buckets", field("--binding") ?? "", { bucket_name: args[3] });
-		return created;
-	}
-	if (group === "hyperdrive" && verb === "create" && third) {
-		const connection = args.find((part) => part.startsWith("--connection-string="))?.slice(20);
-		if (!connection) throw new Error("Hyperdrive connection string is missing.");
-		const url = new URL(connection);
-		const created = await withSecretFile(JSON.stringify({
-			name: third,
-			origin: {
-				host: url.hostname,
-				port: Number(url.port || (url.protocol.startsWith("mysql") ? 3306 : 5432)),
-				database: decodeURIComponent(url.pathname.replace(/^\//, "")),
-				scheme: url.protocol.replace(":", ""),
-				user: decodeURIComponent(url.username),
-				password: decodeURIComponent(url.password)
-			}
-		}), (path) => runCf([
-			"hyperdrive",
-			"create",
-			"--body",
-			`@${path}`
-		]));
-		if (created.status !== 0) return result(created.status, "", "Hyperdrive creation failed.");
-		const hyperdrive = object(parsedJson(created.stdout));
-		if (typeof hyperdrive.id !== "string") throw new Error("Hyperdrive creation returned no ID.");
-		updateBinding("hyperdrive", field("--binding") ?? "", { id: hyperdrive.id });
-		return result(0, `${JSON.stringify({
-			id: hyperdrive.id,
-			name: third
-		})}\n`);
-	}
-	if (group === "queues" && (verb === "info" || verb === "create") && third) {
-		if (verb === "create") return runCf([
+		case "r2.bucket.create": {
+			const created = runCf([
+				"r2",
+				"buckets",
+				"create",
+				"--name",
+				operation.name
+			]);
+			if (created.status === 0) updateBinding("r2_buckets", operation.binding, { bucket_name: operation.name });
+			return created;
+		}
+		case "hyperdrive.create": {
+			const url = new URL(readFileSync(0, "utf8"));
+			const name = operation.name;
+			const created = await withSecretFile(JSON.stringify({
+				name,
+				origin: {
+					host: url.hostname,
+					port: Number(url.port || (url.protocol.startsWith("mysql") ? 3306 : 5432)),
+					database: decodeURIComponent(url.pathname.replace(/^\//, "")),
+					scheme: url.protocol.replace(":", ""),
+					user: decodeURIComponent(url.username),
+					password: decodeURIComponent(url.password)
+				}
+			}), (path) => runCf([
+				"hyperdrive",
+				"create",
+				"--body",
+				"@" + path
+			]));
+			if (created.status !== 0) return {
+				...created,
+				stdout: "",
+				stderr: "Hyperdrive creation failed."
+			};
+			const hyperdrive = object(parsedJson(created.stdout));
+			if (typeof hyperdrive.id !== "string") throw new Error("Hyperdrive creation returned no ID.");
+			updateBinding("hyperdrive", operation.binding, { id: hyperdrive.id });
+			return result(0, "", "", {
+				id: hyperdrive.id,
+				name
+			});
+		}
+		case "queues.create": return runCf([
 			"queues",
 			"create",
 			"--queue-name",
-			third
+			operation.name
 		]);
-		return (await readAllQueues()).find((item) => item.queue_name === third) ? result(0, `Queue Name: ${third}\n`) : result(1, "", `Queue "${third}" does not exist`);
+		case "queues.info": {
+			const queue = (await readAllQueues()).find((item) => item.queue_name === operation.name);
+			return queue ? result(0, "", "", {
+				id: queue.queue_id,
+				name: queue.queue_name
+			}) : {
+				...result(1, "", "Cloudflare Queue does not exist."),
+				failure: "not-found"
+			};
+		}
+		default: throw new Error("Unsupported Cloudflare resource operation.");
 	}
-	return result(1, "", `Unsupported Cloudflare resource operation: ${group} ${verb}.`);
 }
 function emailZone(domain) {
 	const labels = domain.split(".");
@@ -643,103 +679,67 @@ function emailZone(domain) {
 			candidate
 		]);
 		if (read.status === 0) return candidate;
-		if (!/Zone not found:/.test(read.stderr)) throw new Error("Cloudflare could not resolve the Email zone.");
+		if (read.signal || read.error || !/Zone not found:/.test(read.stderr)) throw new Error("Cloudflare could not resolve the Email zone.");
 	}
 	throw new Error(`Cloudflare Email zone for ${domain} was not found.`);
 }
 function email() {
-	const [group, product, operation, candidate] = args;
-	if (group !== "email" || !candidate) return result(1, "", "Unsupported Cloudflare email operation.");
-	if (product === "routing" && operation === "settings") {
-		const read = runCf([
+	if (!("domain" in operation)) throw new Error("Cloudflare Email domain is missing.");
+	const domain = operation.domain;
+	switch (operation.type) {
+		case "email.routing.settings": {
+			const read = runCf([
+				"email-routing",
+				"settings",
+				"get",
+				"--zone",
+				domain
+			]);
+			return read.status !== 0 && !read.signal && !read.error && /Zone not found:/.test(read.stderr) ? result(0, "", "", null) : read;
+		}
+		case "email.routing.enable": return runCf([
 			"email-routing",
-			"settings",
-			"get",
+			"enable",
 			"--zone",
-			candidate
+			domain,
+			"--name",
+			domain
 		]);
-		if (read.status !== 0) return /Zone not found:/.test(read.stderr) ? result(1, "", `Could not find a zone for \`${candidate}\`.`) : read;
-		const settings = object(parsedJson(read.stdout));
-		if (typeof settings.tag !== "string" || typeof settings.name !== "string") throw new Error("Email Routing settings were incomplete.");
-		return result(0, `Email Routing for ${settings.name}:\n  Enabled: ${settings.enabled === true}\n  Status: ${settings.status}\n  Tag: ${settings.tag}\n`);
-	}
-	if (product === "routing" && operation === "enable") return runCf([
-		"email-routing",
-		"enable",
-		"--zone",
-		candidate,
-		"--name",
-		candidate
-	]);
-	if (product === "routing" && operation === "rules" && args[3] === "list" && args[4]) {
-		const zone = args[4];
-		const lines = [];
-		for (let page = 1; page <= 100; page++) {
+		case "email.routing.rules.list": return listAllResourcePages([
+			"email-routing",
+			"rules",
+			"list-account"
+		], ["--zone", domain]);
+		case "email.sending.settings": {
 			const listed = runCf([
-				"email-routing",
-				"rules",
-				"list-account",
+				"email-sending",
+				"subdomains",
+				"list",
 				"--zone",
-				zone,
-				"--page",
-				String(page),
-				"--per-page",
-				"100"
+				emailZone(domain)
 			]);
 			if (listed.status !== 0) return listed;
-			const items = parsedJson(listed.stdout);
-			if (!Array.isArray(items)) throw new Error("Email Routing rules were malformed.");
-			for (const entry of items.map(object)) {
-				const actions = Array.isArray(entry.actions) ? entry.actions.map((action) => {
-					const item = object(action);
-					return item.type === "worker" ? `worker:${item.value}` : item.type === "forward" && Array.isArray(item.value) ? `forward:${item.value.join(",")}` : String(item.type);
-				}) : [];
-				const matchers = Array.isArray(entry.matchers) ? entry.matchers.map(object) : [];
-				if (matchers.some((item) => item.type === "all")) lines.push(`Catch-all rule: ${entry.enabled === true ? "enabled" : "disabled"}, action: ${actions.join(", ")}`);
-				else {
-					if (typeof entry.id !== "string") throw new Error("Email Routing rule ID was missing.");
-					const recipients = matchers.filter((item) => item.type === "literal" || item.type === "to").map((item) => `to:${item.value}`);
-					lines.push(`Rule: ${entry.id}\n  Name: ${entry.name || "(none)"}\n  Enabled: ${entry.enabled === true}\n  Matchers: ${recipients.join(", ")}\n  Actions: ${actions.join(", ")}\n  Priority: ${entry.priority ?? 0}`);
-				}
-			}
-			if (items.length < 100) return result(0, lines.length ? `${lines.join("\n")}\n` : "No routing rules found.\n");
+			const values = parsedJson(listed.stdout);
+			if (!Array.isArray(values)) throw new Error("Email Sending subdomains were malformed.");
+			return result(0, "", "", values.map(object).find((item) => item.name === domain) ?? null);
 		}
-		throw new Error("Email Routing rules exceeded the supported page limit.");
-	}
-	if (product === "sending" && operation === "settings") {
-		const listed = runCf([
+		case "email.sending.enable": return runCf([
 			"email-sending",
 			"subdomains",
-			"list",
+			"create",
 			"--zone",
-			emailZone(candidate)
+			emailZone(domain),
+			"--name",
+			domain
 		]);
-		if (listed.status !== 0) return listed;
-		const values = parsedJson(listed.stdout);
-		if (!Array.isArray(values)) throw new Error("Email Sending subdomains were malformed.");
-		const match = values.map(object).find((item) => item.name === candidate);
-		if (!match) return result(1, "", `No sending subdomain found for \`${candidate}\`.`);
-		const tag = match.tag ?? match.id;
-		if (typeof tag !== "string") throw new Error("Email Sending subdomain ID was missing.");
-		return result(0, `Email Sending for ${candidate}:\n  Enabled: ${match.enabled === true}\n  Tag: ${tag}\n`);
+		default: throw new Error("Unsupported Cloudflare Email operation.");
 	}
-	if (product === "sending" && operation === "enable") return runCf([
-		"email-sending",
-		"subdomains",
-		"create",
-		"--zone",
-		emailZone(candidate),
-		"--name",
-		candidate
-	]);
-	return result(1, "", `Unsupported Cloudflare email operation: ${product} ${operation}.`);
 }
 async function secrets() {
 	const worker = workerName();
-	const verb = args[1];
 	const apply = async (action) => {
 		const first = action();
-		if (first.status === 0 || !/\[code:\s*10007\]/.test(first.stderr)) return first;
+		if (first.status === 0 || first.errorCode !== 10007) return first;
 		const draft = await withBuildOutput({
 			name: worker,
 			account_id: process.env.CLOUDFLARE_ACCOUNT_ID ?? config().account_id,
@@ -754,148 +754,147 @@ async function secrets() {
 		], directory));
 		return draft.status === 0 ? action() : draft;
 	};
-	if (verb === "list") {
-		const listed = runCf([
+	switch (operation.type) {
+		case "secret.list": return runCf([
 			"workers",
 			"secrets",
 			"list",
 			"--worker",
 			worker
 		]);
-		if (listed.status !== 0 && /\[code:\s*(?:10007|10090)\]/.test(listed.stderr)) return result(1, "", `Worker "${worker}" not found. [code: 10007]`);
-		return listed;
-	}
-	if (verb === "put" && args[2]) {
-		const value = readFileSync(0, "utf8").replace(/\n$/, "");
-		return await withSecretFile(JSON.stringify({
-			name: args[2],
-			text: value,
-			type: "secret_text"
-		}), (path) => apply(() => runCf([
-			"workers",
-			"secrets",
-			"update",
-			args[2],
-			"--worker",
-			worker,
-			"--body",
-			`@${path}`
-		])));
-	}
-	if (verb === "bulk") {
-		const input = object(parsedJson(readFileSync(0, "utf8")));
-		const patch = Object.fromEntries(Object.entries(input).map(([name, text]) => [name, {
-			type: "secret_text",
-			text
-		}]));
-		return await withSecretFile(JSON.stringify(patch), (path) => apply(() => runCf([
+		case "secret.put": {
+			const value = readFileSync(0, "utf8").replace(/\n$/, "");
+			const name = operation.name;
+			return withSecretFile(JSON.stringify({
+				name,
+				text: value,
+				type: "secret_text"
+			}), (path) => apply(() => runCf([
+				"workers",
+				"secrets",
+				"update",
+				name,
+				"--worker",
+				worker,
+				"--body",
+				"@" + path
+			])));
+		}
+		case "secret.bulk": {
+			const values = object(parsedJson(readFileSync(0, "utf8")));
+			const patch = Object.fromEntries(Object.entries(values).map(([name, text]) => [name, {
+				type: "secret_text",
+				text
+			}]));
+			return withSecretFile(JSON.stringify(patch), (path) => apply(() => runCf([
+				"workers",
+				"secrets",
+				"bulk",
+				"--worker",
+				worker,
+				"--file",
+				path
+			])));
+		}
+		case "secret.delete": return runCf([
 			"workers",
 			"secrets",
-			"bulk",
+			"delete",
+			operation.name,
 			"--worker",
 			worker,
-			"--file",
-			path
-		])));
+			"--force"
+		]);
+		default: throw new Error("Unsupported Cloudflare secret operation.");
 	}
-	if (verb === "delete" && args[2]) return runCf([
-		"workers",
-		"secrets",
-		"delete",
-		args[2],
-		"--worker",
-		worker,
-		"--force"
-	]);
-	return result(1, "", `Unsupported Cloudflare secret operation: ${verb}.`);
 }
 async function workerHistory() {
 	const worker = workerName();
-	const [group, verb, third] = args;
-	if (group === "deployments" && (verb === "status" || verb === "list")) {
-		const called = runCf([
-			"workers",
-			"deployments",
-			"list",
-			"--worker",
-			worker
-		]);
-		if (called.status !== 0) return called;
-		const deployments = object(parsedJson(called.stdout)).deployments;
-		if (!Array.isArray(deployments)) throw new Error("Worker deployments were malformed.");
-		if (verb === "status") return deployments[0] ? result(0, `${JSON.stringify(deployments[0])}\n`) : result(1, "", "Worker has no active deployment.");
-		return result(0, `${JSON.stringify(deployments)}\n`);
-	}
-	if (group === "versions" && verb === "list") return cleanJson([
-		"workers",
-		"versions",
-		"list",
-		"--worker-id",
-		worker
-	], (value) => {
-		if (!Array.isArray(value)) throw new Error("Worker versions were malformed.");
-		return value.map((entry) => {
-			const version = object(entry);
-			return {
-				...version,
-				metadata: { created_on: version.created_on }
-			};
-		});
-	});
-	if (group === "versions" && verb === "view" && third) {
-		const called = runCf([
+	switch (operation.type) {
+		case "deployments.status":
+		case "deployments.list": {
+			const called = runCf([
+				"workers",
+				"deployments",
+				"list",
+				"--worker",
+				worker
+			]);
+			if (called.status !== 0) return called;
+			const deployments = object(parsedJson(called.stdout)).deployments;
+			if (!Array.isArray(deployments)) throw new Error("Worker deployments were malformed.");
+			return operation.type === "deployments.list" ? result(0, "", called.stderr, deployments) : deployments[0] ? result(0, "", called.stderr, deployments[0]) : result(1, "", "Worker has no active deployment.");
+		}
+		case "versions.list": return cleanJson([
 			"workers",
 			"versions",
-			"get",
-			third,
+			"list",
 			"--worker-id",
 			worker
-		]);
-		if (called.status !== 0) return called;
-		const version = object(parsedJson(called.stdout));
-		if (version.id !== third || !Array.isArray(version.bindings)) throw new Error("Worker version bindings were malformed.");
-		const resources = await readVersionResources(worker, third);
-		return result(0, `${JSON.stringify({
-			...version,
-			resources
-		})}\n`);
-	}
-	if (group === "versions" && verb === "deploy") {
-		const firstFlag = args.findIndex((part, index) => index >= 2 && part.startsWith("-"));
-		const versions = args.slice(2, firstFlag === -1 ? void 0 : firstFlag).map((part) => {
-			const [version_id, fraction] = part.split("@");
-			const percentage = Number(fraction);
-			if (!/^[0-9a-f-]{36}$/i.test(version_id ?? "") || !Number.isFinite(percentage)) throw new Error("Cloudflare deployment version was malformed.");
-			return {
-				version_id,
-				percentage
-			};
+		], (value) => {
+			if (!Array.isArray(value)) throw new Error("Worker versions were malformed.");
+			return value.map((entry) => {
+				const version = object(entry);
+				return {
+					...version,
+					metadata: { created_on: version.created_on }
+				};
+			});
 		});
-		if (!versions.length || Math.abs(versions.reduce((sum, entry) => sum + entry.percentage, 0) - 100) > .001) throw new Error("Cloudflare deployment percentages must total 100.");
-		const message = field("--message");
-		return runCf([
-			"workers",
-			"deployments",
-			"create",
-			"--worker",
-			worker,
-			"--body",
-			JSON.stringify({
-				strategy: "percentage",
-				versions,
-				...message ? { annotations: { "workers/message": message } } : {}
-			})
-		]);
+		case "versions.view": {
+			const versionId = operation.versionId;
+			const called = runCf([
+				"workers",
+				"versions",
+				"get",
+				versionId,
+				"--worker-id",
+				worker,
+				...operation.includeSource ? ["--include", "modules"] : []
+			], process.cwd(), operation.includeSource ? {
+				timeoutMs: 3e4,
+				maxOutputBytes: 1048576
+			} : void 0);
+			if (called.status !== 0) return called;
+			const version = object(parsedJson(called.stdout));
+			if (version.id !== versionId || !Array.isArray(version.bindings)) throw new Error("Worker version bindings were malformed.");
+			if (operation.includeSource) return result(0, "", called.stderr, version);
+			const resources = await readVersionResources(worker, versionId);
+			return result(0, "", called.stderr, {
+				...version,
+				resources
+			});
+		}
+		case "versions.deploy": {
+			const versions = operation.versions.map((value) => ({
+				version_id: value.versionId,
+				percentage: value.percentage
+			}));
+			if (!versions.length || versions.some((value) => !/^[-a-f\d]{36}$/i.test(value.version_id) || !Number.isFinite(value.percentage) || value.percentage < 0 || value.percentage > 100) || Math.abs(versions.reduce((sum, value) => sum + value.percentage, 0) - 100) > .001) throw new Error("Cloudflare deployment percentages must total 100.");
+			return runCf([
+				"workers",
+				"deployments",
+				"create",
+				"--worker",
+				worker,
+				"--body",
+				JSON.stringify({
+					strategy: "percentage",
+					versions,
+					...operation.message ? { annotations: { "workers/message": operation.message } } : {}
+				})
+			]);
+		}
+		default: throw new Error("Unsupported Cloudflare Worker history operation.");
 	}
-	return result(1, "", `Unsupported Cloudflare Worker history operation: ${group} ${verb}.`);
 }
 async function workerChanges() {
-	if (args[0] === "queues" && args[1] === "consumer" && args[2] === "remove") {
-		const queueName = args[3];
-		const worker = args[4];
-		if (!queueName || !worker) throw new Error("Queue consumer target is missing.");
-		const queue = (await readAllQueues()).find((item) => item.queue_name === queueName);
-		if (!queue || typeof queue.queue_id !== "string") return result(1, "", `Queue "${queueName}" does not exist`);
+	if (operation.type === "queues.consumer.remove") {
+		const queue = (await readAllQueues()).find((item) => item.queue_name === operation.queueName);
+		if (!queue || typeof queue.queue_id !== "string") return {
+			...result(1, "", "Cloudflare Queue does not exist."),
+			failure: "not-found"
+		};
 		const consumers = runCf([
 			"queues",
 			"consumers",
@@ -906,8 +905,17 @@ async function workerChanges() {
 		if (consumers.status !== 0) return consumers;
 		const members = parsedJson(consumers.stdout);
 		if (!Array.isArray(members)) throw new Error("Queue consumer list was malformed.");
-		for (const item of members.map(object).filter((entry) => entry.script === worker)) {
-			if (typeof item.consumer_id !== "string") throw new Error("Queue consumer ID is missing.");
+		const matching = members.map(object).filter((entry) => {
+			const name = entry.script_name ?? entry.script;
+			if (entry.script_name !== void 0 && (typeof entry.script_name !== "string" || !entry.script_name) || entry.script !== void 0 && (typeof entry.script !== "string" || !entry.script) || entry.script_name !== void 0 && entry.script !== void 0 && entry.script_name !== entry.script || entry.type === "worker" && name === void 0) throw new Error("Queue consumer Worker identity is ambiguous.");
+			return name === operation.workerName;
+		});
+		if (matching.length > 1) throw new Error("Queue consumer Worker identity is ambiguous.");
+		for (const item of matching) {
+			if (typeof item.consumer_id !== "string" || !item.consumer_id || item.consumer_id.startsWith("-") || /\s/.test(item.consumer_id) || [...item.consumer_id].some((character) => {
+				const code = character.charCodeAt(0);
+				return code < 32 || code === 127;
+			}) || item.type !== void 0 && item.type !== "worker") throw new Error("Queue consumer ID or type is invalid.");
 			const deleted = runCf([
 				"queues",
 				"consumers",
@@ -921,59 +929,62 @@ async function workerChanges() {
 		}
 		return result(0);
 	}
-	if (args[0] === "triggers" && args[1] === "deploy") {
-		const raw = config();
-		const name = workerName();
-		if (raw.name !== name) throw new Error("Cloudflare trigger Worker name changed.");
-		return await withBuildOutput(raw, null, (directory) => runCf([
-			"workers",
-			"triggers",
-			"deploy",
-			"--prebuilt",
-			...args.includes("--dry-run") ? ["--dry-run"] : []
-		], directory));
+	const raw = config();
+	const name = workerName();
+	if (raw.name !== name) throw new Error("Cloudflare Worker target changed.");
+	if (operation.type === "triggers.clear-crons" || operation.type === "triggers.clear-domains") {
+		if (raw.account_id !== void 0 && raw.account_id !== accountId()) throw new Error("Cloudflare trigger target changed.");
+		return operation.type === "triggers.clear-crons" ? clearWorkerCronSchedules(name) : clearWorkerCustomDomains(name);
 	}
-	if (args[0] === "triggers" && args[1] === "clear-crons") {
-		const raw = config();
-		const name = workerName();
-		if (raw.name !== name || raw.account_id !== void 0 && raw.account_id !== accountId()) throw new Error("Cloudflare trigger target changed.");
-		return await clearWorkerCronSchedules(name);
-	}
-	if (args[0] === "triggers" && args[1] === "clear-domains") {
-		const raw = config();
-		const name = workerName();
-		if (raw.name !== name || raw.account_id !== void 0 && raw.account_id !== accountId()) throw new Error("Cloudflare trigger target changed.");
-		return await clearWorkerCustomDomains(name);
-	}
-	if (args[0] === "versions" && args[1] === "upload" || args[0] === "deploy") {
-		const raw = config();
+	if (operation.type === "triggers.deploy") return withBuildOutput(raw, null, (directory) => runCf([
+		"workers",
+		"triggers",
+		"deploy",
+		"--prebuilt"
+	], directory));
+	if (operation.type === "versions.upload" || operation.type === "worker.deploy") {
 		const path = configPath();
 		if (typeof raw.main !== "string" || !raw.main || raw.no_bundle !== true) throw new Error("Cloudflare Worker upload requires a prebuilt platform Worker.");
 		const source = resolve(dirname(path), raw.main);
-		const message = field("--message");
-		const secrets = field("--secrets-file");
-		return await withBuildOutput(raw, source, (directory) => runCf([
-			...args[0] === "deploy" ? ["deploy"] : [
+		const request = operation;
+		const called = await withBuildOutput(raw, source, (directory) => runCf([
+			...request.type === "worker.deploy" ? ["deploy"] : [
 				"workers",
 				"versions",
 				"create"
 			],
 			"--prebuilt",
-			...message ? ["--message", message] : [],
-			...secrets ? ["--secrets-file", secrets] : [],
-			...args.includes("--dry-run") ? ["--dry-run"] : []
+			...request.message ? ["--message", request.message] : [],
+			...request.secretsFilePath ? ["--secrets-file", request.secretsFilePath] : []
 		], directory));
+		if (called.status !== 0) return called;
+		let uploaded = {};
+		try {
+			uploaded = object(parsedJson(called.stdout));
+		} catch {}
+		const output = called.stdout;
+		const versionId = uploaded.version_id ?? uploaded.id ?? uploaded.versionId ?? output.match(/(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i)?.[1];
+		if (typeof versionId !== "string" || !/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(versionId)) throw new Error("Cloudflare did not return the uploaded Worker version ID.");
+		const previewUrl = typeof uploaded.preview_url === "string" ? uploaded.preview_url : output.match(/Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i)?.[1];
+		const workersDevUrl = typeof uploaded.workers_dev_url === "string" ? uploaded.workers_dev_url : output.match(/(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i)?.[1];
+		return result(0, "", called.stderr, {
+			versionId,
+			...previewUrl ? { previewUrl } : {},
+			...workersDevUrl ? { workersDevUrl } : {}
+		});
 	}
-	return result(1, "", `Unsupported Cloudflare Worker operation: ${args.slice(0, 2).join(" ")}.`);
+	throw new Error("Unsupported Cloudflare Worker operation.");
 }
 async function tail() {
-	const worker = args[1];
-	const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? config().account_id;
-	if (!worker || typeof accountId !== "string" || !accountId || worker !== workerName()) throw new Error("Cloudflare tail target is not pinned.");
+	if (operation.type !== "tail") throw new Error("Cloudflare tail operation is required.");
+	const worker = workerName();
+	const raw = config();
+	const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? raw.account_id;
+	if (!worker || typeof accountId !== "string" || !accountId || worker !== raw.name) throw new Error("Cloudflare tail target is not pinned.");
 	const filters = [];
-	if (field("--search")) filters.push({ query: field("--search") });
-	if (field("--version-id")) filters.push({ scriptVersion: field("--version-id") });
-	if (field("--status") === "error") filters.push({ outcome: [
+	if (operation.search) filters.push({ query: operation.search });
+	if (operation.versionId) filters.push({ scriptVersion: operation.versionId });
+	if (operation.status === "error") filters.push({ outcome: [
 		"exception",
 		"exceededCpu",
 		"exceededMemory",
@@ -1010,25 +1021,29 @@ async function tail() {
 		if (stopped.signal.aborted) return result(0);
 		await new Promise((resolve, reject) => {
 			finish = resolve;
+			let pendingMessages = Promise.resolve();
 			socket = new WebSocket(tailUrl, "trace-v1");
 			socket.addEventListener("open", () => {
 				socket.send(JSON.stringify({ debug: false }));
 			});
 			socket.addEventListener("message", (event) => {
-				try {
-					const log = object(parsedJson(String(event.data)));
+				pendingMessages = pendingMessages.then(async () => {
+					const data = event.data;
+					const text = typeof data === "string" ? data : data instanceof Blob ? await data.text() : data instanceof ArrayBuffer ? new TextDecoder().decode(data) : null;
+					if (text === null) throw new Error("Unsupported Cloudflare tail frame.");
+					const log = object(parsedJson(text));
 					const detail = object(log.event ?? {});
 					const request = object(detail.request ?? {});
 					const prefix = typeof request.url === "string" ? `${request.method ?? "GET"} ${request.url}` : typeof detail.queue === "string" ? `Queue ${detail.queue}` : typeof detail.mailFrom === "string" ? `Email from ${detail.mailFrom}` : "Worker event";
 					process.stdout.write(`${prefix} - ${log.outcome ?? "unknown"} @ ${new Date(Number(log.eventTimestamp)).toLocaleString()}\n`);
 					if (Array.isArray(log.logs)) for (const line of log.logs.map(object)) process.stdout.write(`  (${line.level ?? "log"}) ${Array.isArray(line.message) ? line.message.join(" ") : ""}\n`);
 					if (Array.isArray(log.exceptions)) for (const exception of log.exceptions.map(object)) process.stderr.write(`  ${exception.name ?? "Error"}: ${exception.message ?? ""}\n`);
-				} catch {
+				}).catch(() => {
 					process.stderr.write("Cloudflare returned a malformed tail event.\n");
-				}
+				});
 			});
 			socket.addEventListener("error", () => reject(/* @__PURE__ */ new Error("Cloudflare Worker tail connection failed.")));
-			socket.addEventListener("close", () => resolve());
+			socket.addEventListener("close", () => void pendingMessages.then(resolve));
 			if (stopped.signal.aborted) resolve();
 		});
 	} catch (error) {
@@ -1048,34 +1063,49 @@ async function tail() {
 	return result(0);
 }
 async function main() {
-	if ([
-		"whoami",
-		"login",
-		"logout",
-		"auth"
-	].includes(args[0] ?? "")) return auth();
-	if (args[0] === "secret") return await secrets();
-	if (args[0] === "tail") return await tail();
-	if (args[0] === "email") return email();
-	if (args[0] === "deployments" || args[0] === "versions" && args[1] !== "upload") return await workerHistory();
-	if (args[0] === "triggers" || args[0] === "deploy" || args[0] === "versions" && args[1] === "upload" || args[0] === "queues" && args[1] === "consumer") return await workerChanges();
-	if ([
-		"d1",
-		"kv",
-		"r2",
-		"hyperdrive",
-		"queues",
-		"containers"
-	].includes(args[0] ?? "")) return await resources();
-	return result(1, "", `Unsupported Cloudflare operation: ${args.slice(0, 2).join(" ")}.`);
+	if (process.argv.length !== 3) throw new Error("Exactly one typed Cloudflare operation is required.");
+	if (!operation || typeof operation !== "object" || typeof operation.type !== "string") throw new Error("Cloudflare operation is required.");
+	if (operation.type.startsWith("auth.")) return auth();
+	if (operation.type.startsWith("secret.")) return secrets();
+	if (operation.type === "tail") return tail();
+	if (operation.type.startsWith("email.")) return email();
+	if (operation.type.startsWith("deployments.") || operation.type.startsWith("versions.") && operation.type !== "versions.upload") return workerHistory();
+	if (operation.type.startsWith("triggers.") || operation.type === "worker.deploy" || operation.type === "versions.upload" || operation.type === "queues.consumer.remove") return workerChanges();
+	return resources();
 }
 try {
 	const output = await main();
-	if (output.stdout) process.stdout.write(output.stdout);
+	if (operation.type !== "auth.login" && operation.type !== "tail") {
+		let data = output.data;
+		let humanOutput = "";
+		if (data === void 0 && output.stdout.trim()) try {
+			data = parsedJson(output.stdout);
+		} catch {
+			humanOutput = output.stdout;
+		}
+		process.stdout.write(JSON.stringify({
+			operationResult: 1,
+			...output.signal ? { signal: output.signal } : {},
+			...output.error ? { error: output.error } : {},
+			...data !== void 0 ? { data } : {},
+			...output.errorCode !== void 0 ? { errorCode: output.errorCode } : {},
+			...output.failure ? { failure: output.failure } : {},
+			...output.stderr ? { errors: [{
+				code: output.errorCode,
+				message: output.stderr
+			}] } : {},
+			...humanOutput ? { output: humanOutput } : {}
+		}) + "\n");
+	}
 	if (output.stderr) process.stderr.write(output.stderr);
 	process.exitCode = output.status;
 } catch (error) {
-	process.stderr.write(error instanceof Error ? error.message : "Cloudflare command failed.");
+	const message = error instanceof Error ? error.message : "Cloudflare operation failed.";
+	if (operation?.type !== "auth.login" && operation?.type !== "tail") process.stdout.write(JSON.stringify({
+		operationResult: 1,
+		errors: [{ message }]
+	}) + "\n");
+	process.stderr.write(message);
 	process.exitCode = 1;
 }
 //#endregion