Cloudflare Access app setup (API-driven)

Creates a self-hosted Cloudflare Access application, an email-allowlist policy, and a service token for headless CLI / CI access. Idempotent: re-running updates the existing app rather than creating duplicates.

Pulumi is the recommended long-term option (declarative + drift detection), but a script is the right answer for:

• One-shot setup when you don't want Pulumi state for a single app.
• CI that needs to spin up an ephemeral Access app per PR for testing.
• Replacing the service token (rotating credentials) without re-importing the rest of the stack.

When to invoke

Use when you're:

• Setting up Access for a brand-new Cloudflare Worker without an existing Pulumi stack.
• Adding a service token to an existing Access app for CI smoke runs.
• Rotating service token credentials without touching the rest of infra.

What's in here

assets/scripts/setup-access-app.ts