From cfac87411e499f2b7bf7a890b116a936509d5706 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E6=A9=98?= <xiaoju@shazhou.work>
Date: Fri, 3 Apr 2026 04:25:16 +0000
Subject: [PATCH] feat: wire up real CF API for deploy/delete/invoke

---
 src/index.ts  | 36 +++++++++++++++---------------------
 wrangler.toml | 14 ++++++++++++--
 2 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index 6a4a485..aa637a7 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,36 +1,30 @@
-import { WorkerPool, type CfApi } from './backend/worker-pool.js'
+import { WorkerPool } from './backend/worker-pool.js'
 import { AuthModule } from './auth.js'
 import { KvStore } from './kv.js'
 import { handleRequest } from './router.js'
-import { CONFIG } from './config.js'
+import { createCfApi } from './cf-api.js'
 
 export interface Env {
   SIGIL_KV: KVNamespace
-}
-
-const defaultCfApi: CfApi = {
-  async deployWorker(name: string, _code: string): Promise<void> {
-    // Production: use CF API to deploy
-    console.log(`[sigil] deploy worker: ${name}`)
-  },
-  async deleteWorker(name: string): Promise<void> {
-    console.log(`[sigil] delete worker: ${name}`)
-  },
-  getWorkerSubdomain(name: string): string {
-    return `${name}${CONFIG.SUBDOMAIN_SUFFIX}`
-  },
-  async invoke(_workerName: string, request: Request): Promise<Response> {
-    // Production: fetch from worker subdomain
-    return new Response('Not implemented', { status: 501 })
-  },
+  CF_API_TOKEN: string  // Worker Secret
+  CF_ACCOUNT_ID: string // Worker Secret
 }
 
 export default {
   async fetch(request: Request, env: Env): Promise<Response> {
     const kv = new KvStore(env.SIGIL_KV)
-    const backend = new WorkerPool(env.SIGIL_KV, defaultCfApi)
+    const cfApi = createCfApi(env.CF_ACCOUNT_ID, env.CF_API_TOKEN)
+    const backend = new WorkerPool(env.SIGIL_KV, cfApi)
     const auth = new AuthModule(kv)
 
-    return handleRequest(request, { SIGIL_KV: env.SIGIL_KV, backend, auth, kv })
+    try {
+      return await handleRequest(request, { SIGIL_KV: env.SIGIL_KV, backend, auth, kv })
+    } catch (e) {
+      console.error('[sigil] unhandled error:', e)
+      return new Response(JSON.stringify({ error: 'Internal server error' }), {
+        status: 500,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
   },
 }
diff --git a/wrangler.toml b/wrangler.toml
index 8318937..72969f3 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -4,5 +4,15 @@ compatibility_date = "2026-04-03"
 
 [[kv_namespaces]]
 binding = "SIGIL_KV"
-id = "placeholder"
-preview_id = "placeholder"
+id = "9943c8873e724b0fb2cf24b4475e5a52"
+
+[vars]
+SIGIL_ENV = "production"
+
+# Worker Secrets (set via `wrangler secret put`, never committed to source):
+#   CF_API_TOKEN   - Cloudflare API token with Workers:Edit permission
+#   CF_ACCOUNT_ID  - Cloudflare Account ID
+#
+# To configure:
+#   echo "$CF_API_TOKEN" | npx wrangler secret put CF_API_TOKEN
+#   echo "$CF_ACCOUNT_ID" | npx wrangler secret put CF_ACCOUNT_ID