Cloudflare `cf` CLI

cf 命令与覆盖范围会变化。以已安装版本和命令帮助为准，不把 Wrangler 参数直接套用。

Start with the installed CLI

Check cf --version and the project's package manager, scripts, config, and any local cf or Wrangler dependency. Run project commands through the project's pinned version when present. For account-level work, the installed global cf is fine. Cloudflare's announcement documents npm i -g cf for installation.
Run cf cli search "<action and resource type>". Keep the query anonymous: no domains, account or resource IDs, names, email addresses, or tokens. Pick the relevant result; search can rank a similarly named product above the intended one.
Read cf <discovered command> --help. For API request fields and response shape, run cf schema <discovered command without cf>. Read the specific Cloudflare documentation or API page when semantics or prerequisites matter. Do not infer flags from Wrangler.
If search misses a command, consult the official docs or inspect the exact command group once. Do not run a chain of nested --help calls or guess a similarly named command.

Check cf auth whoami before remote operations. A Wrangler login does not establish a cf login. Use cf auth login or an existing, appropriately scoped CLOUDFLARE_API_TOKEN; do not print, paste, log, or put token values in command arguments. If login opens a browser, follow the workspace's browser instructions.
Resolve the intended account, zone, project, Worker, hostname, and environment from the request and existing configuration before changing anything. Use a named cf profile or account setting when several accounts are available.
Read results are safe to inspect; for mutations, review the exact target and required permissions. Use a command's --dry-run when available, then verify the remote result separately. A dry run is not deployment or domain activation.