alepha 0.22.0 → 0.24.0

package/dist/cli/platform-lib/index.js

@@ -1,4 +1,4 @@
-import { $atom, $inject, $module, $state, Alepha, AlephaError, t } from "alepha";
+import { $atom, $inject, $module, $state, Alepha, AlephaError, z } from "alepha";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -19,17 +19,17 @@ import { homedir, platform } from "node:os";
 const platformOptions = $atom({
 	name: "alepha.cli.platform.options",
 	description: "Platform deployment configuration",
-	schema: t.optional(t.object({
+	schema: z.object({
 		/**
 		* Project name override. Defaults to root package.json "name".
 		*/
-		name: t.optional(t.text()),
+		name: z.text().optional(),
 		/**
 		* Default environment when --env is omitted.
 		*
 		* @default "production"
 		*/
-		default: t.optional(t.text()),
+		default: z.text().optional(),
 		/**
 		* Multi-tenancy mode — controls whether `--tenant <slug>` is
 		* accepted/required and how it shapes resource names + the domain.
@@ -43,16 +43,16 @@ const platformOptions = $atom({
 		*
 		* @default "none"
 		*/
-		tenancy: t.optional(t.enum([
+		tenancy: z.enum([
 			"none",
 			"optional",
 			"required"
-		])),
+		]).optional(),
 		/**
 		* Secret store configuration for syncing .env secrets
 		* to external providers (e.g. GitHub Actions environments).
 		*/
-		secrets: t.optional(t.object({
+		secrets: z.object({
 			/**
 			* Explicit override of the worker secret-key allowlist.
 			*
@@ -69,24 +69,24 @@ const platformOptions = $atom({
 			* neither this nor a manifest is present, the `.env.<env>` file is
 			* itself the allowlist (legacy fallback).
 			*/
-			keys: t.optional(t.array(t.text())),
+			keys: z.array(z.text()).optional(),
 			/**
 			* Secret store backend.
 			*/
-			store: t.optional(t.enum(["github"])),
+			store: z.enum(["github"]).optional(),
 			/**
 			* Pattern for resolving environment names in the store.
 			* Placeholders: {project}, {env}.
 			*
 			* @default "{project}-{env}"
 			*/
-			environmentPattern: t.optional(t.text())
-		})),
+			environmentPattern: z.text().optional()
+		}).optional(),
 		/**
 		* Named environments with their adapter and configuration.
 		*/
-		environments: t.record(t.text({ description: "Environment name (e.g. 'production', 'staging', 'preview'). Used in resource naming and selected via --env." }), t.object({
-			adapter: t.enum(["cloudflare", "vercel"]),
+		environments: z.record(z.text({ description: "Environment name (e.g. 'production', 'staging', 'preview'). Used in resource naming and selected via --env." }), z.object({
+			adapter: z.enum(["cloudflare", "vercel"]),
 			/**
 			* Custom domain for the deployed worker (e.g. "api.example.com").
 			*
@@ -98,14 +98,30 @@ const platformOptions = $atom({
 			* Wildcard patterns require `zone` to be set, and the wildcard DNS
 			* record must already exist (proxied) in the Cloudflare zone.
 			*/
-			domain: t.optional(t.text()),
+			domain: z.text().optional(),
 			/**
 			* Cloudflare zone name (e.g. "alepha.dev") that owns `domain`.
 			*
-			* Required when `domain` contains a wildcard (`*`). Ignored for
-			* plain custom domains, which Cloudflare resolves automatically.
+			* Required when `domain` contains a wildcard (`*`). For a plain
+			* host, setting `zone` switches the binding from a Custom Domain to
+			* a zone *Route* (`domain/*`) — needed when another Worker holds a
+			* wildcard route covering the host (routes win by specificity,
+			* while a Custom Domain would lose to the wildcard route).
 			*/
-			zone: t.optional(t.text()),
+			zone: z.text().optional(),
+			/**
+			* Worker-to-worker service bindings, e.g.
+			* `[{ binding: "CLUB", service: "club-staging" }]`.
+			*
+			* Exposed on the runtime `env` (Alepha store key `cloudflare.env`).
+			* Use a binding to fetch() a sibling Worker on the same zone —
+			* plain subrequests to a host served by a same-zone Worker route
+			* bypass the route and 522.
+			*/
+			services: z.array(z.object({
+				binding: z.text(),
+				service: z.text()
+			})).optional(),
 			/**
 			* Cloudflare data jurisdiction for R2 buckets and D1 databases.
 			* - "eu": data stays within the EU
@@ -113,7 +129,7 @@ const platformOptions = $atom({
 			*
 			* Omit for the default (global) jurisdiction.
 			*/
-			jurisdiction: t.optional(t.enum(["eu", "fedramp"])),
+			jurisdiction: z.enum(["eu", "fedramp"]).optional(),
 			/**
 			* Cloudflare account ID to deploy into.
 			*
@@ -121,9 +137,9 @@ const platformOptions = $atom({
 			* token's account when the token is scoped to exactly one.
 			* Required when the token has access to multiple accounts.
 			*/
-			accountId: t.optional(t.text())
+			accountId: z.text().optional()
 		}))
-	}))
+	}).optional()
 });
 //#endregion
 //#region ../../src/cli/platform-lib/providers/PlatformCacheProvider.ts
@@ -174,104 +190,104 @@ var PlatformCacheProvider = class PlatformCacheProvider {
 };
 //#endregion
 //#region ../../src/cli/platform-lib/schemas/cloudflare.ts
-const cloudflareAccountSchema = t.object({
-	id: t.string(),
-	name: t.string()
+const cloudflareAccountSchema = z.object({
+	id: z.string(),
+	name: z.string()
 });
-const cloudflareD1Schema = t.object({
-	uuid: t.string(),
-	name: t.string()
+const cloudflareD1Schema = z.object({
+	uuid: z.string(),
+	name: z.string()
 });
-const cloudflareKVSchema = t.object({
-	id: t.string(),
-	title: t.string()
+const cloudflareKVSchema = z.object({
+	id: z.string(),
+	title: z.string()
 });
-const cloudflareR2Schema = t.object({
-	name: t.string(),
-	creation_date: t.optional(t.string())
+const cloudflareR2Schema = z.object({
+	name: z.string(),
+	creation_date: z.string().optional()
 });
-const cloudflareR2ListSchema = t.object({ buckets: t.array(cloudflareR2Schema) });
-const cloudflareQueueSchema = t.object({
-	queue_id: t.string(),
-	queue_name: t.string()
+const cloudflareR2ListSchema = z.object({ buckets: z.array(cloudflareR2Schema) });
+const cloudflareQueueSchema = z.object({
+	queue_id: z.string(),
+	queue_name: z.string()
 });
-const cloudflareQueueConsumerSchema = t.object({
-	consumer_id: t.string(),
-	service: t.string(),
-	environment: t.optional(t.string())
+const cloudflareQueueConsumerSchema = z.object({
+	consumer_id: z.string(),
+	service: z.string(),
+	environment: z.string().optional()
 });
-const cloudflareHyperdriveOriginSchema = t.object({ host: t.string() });
-const cloudflareHyperdriveSchema = t.object({
-	id: t.string(),
-	name: t.string(),
+const cloudflareHyperdriveOriginSchema = z.object({ host: z.string() });
+const cloudflareHyperdriveSchema = z.object({
+	id: z.string(),
+	name: z.string(),
 	origin: cloudflareHyperdriveOriginSchema
 });
-const cloudflareWorkerSchema = t.object({
-	id: t.string(),
-	created_on: t.string(),
-	modified_on: t.string()
+const cloudflareWorkerSchema = z.object({
+	id: z.string(),
+	created_on: z.string(),
+	modified_on: z.string()
 });
-const cloudflareDeploymentVersionSchema = t.object({
-	version_id: t.string(),
-	percentage: t.number()
+const cloudflareDeploymentVersionSchema = z.object({
+	version_id: z.string(),
+	percentage: z.number()
 });
-const cloudflareDeploymentSchema = t.object({
-	id: t.string(),
-	versions: t.array(cloudflareDeploymentVersionSchema),
-	created_on: t.string()
+const cloudflareDeploymentSchema = z.object({
+	id: z.string(),
+	versions: z.array(cloudflareDeploymentVersionSchema),
+	created_on: z.string()
 });
-const cloudflareDeploymentListSchema = t.object({ deployments: t.array(cloudflareDeploymentSchema) });
-const cloudflareVersionSchema = t.object({
-	id: t.string(),
-	metadata: t.object({ created_on: t.string() }),
-	annotations: t.optional(t.record(t.string(), t.string()))
+const cloudflareDeploymentListSchema = z.object({ deployments: z.array(cloudflareDeploymentSchema) });
+const cloudflareVersionSchema = z.object({
+	id: z.string(),
+	metadata: z.object({ created_on: z.string() }),
+	annotations: z.record(z.string(), z.string()).optional()
 });
-const cloudflareVersionListSchema = t.object({ items: t.array(cloudflareVersionSchema) });
-const cloudflareSecretSchema = t.object({
-	name: t.string(),
-	type: t.string()
+const cloudflareVersionListSchema = z.object({ items: z.array(cloudflareVersionSchema) });
+const cloudflareSecretSchema = z.object({
+	name: z.string(),
+	type: z.string()
 });
-const createD1BodySchema = t.object({
-	name: t.string(),
-	primary_location_hint: t.optional(t.string()),
-	jurisdiction: t.optional(t.string())
+const createD1BodySchema = z.object({
+	name: z.string(),
+	primary_location_hint: z.string().optional(),
+	jurisdiction: z.string().optional()
 });
-const createKVBodySchema = t.object({ title: t.string() });
-const createR2BodySchema = t.object({ name: t.string() });
-const cloudflareR2TokenSchema = t.object({
-	id: t.string(),
-	accessKeyId: t.string(),
-	secretAccessKey: t.string()
+const createKVBodySchema = z.object({ title: z.string() });
+const createR2BodySchema = z.object({ name: z.string() });
+const cloudflareR2TokenSchema = z.object({
+	id: z.string(),
+	accessKeyId: z.string(),
+	secretAccessKey: z.string()
 });
-const createR2TokenBodySchema = t.object({
-	name: t.string(),
-	policies: t.array(t.object({
-		effect: t.string(),
-		permissions: t.array(t.string()),
-		buckets: t.optional(t.array(t.string()))
+const createR2TokenBodySchema = z.object({
+	name: z.string(),
+	policies: z.array(z.object({
+		effect: z.string(),
+		permissions: z.array(z.string()),
+		buckets: z.array(z.string()).optional()
 	}))
 });
-const createQueueBodySchema = t.object({ queue_name: t.string() });
-const createHyperdriveOriginSchema = t.object({
-	scheme: t.string(),
-	host: t.string(),
-	port: t.number(),
-	database: t.string(),
-	user: t.string(),
-	password: t.string()
+const createQueueBodySchema = z.object({ queue_name: z.string() });
+const createHyperdriveOriginSchema = z.object({
+	scheme: z.string(),
+	host: z.string(),
+	port: z.number(),
+	database: z.string(),
+	user: z.string(),
+	password: z.string()
 });
-const createHyperdriveBodySchema = t.object({
-	name: t.string(),
+const createHyperdriveBodySchema = z.object({
+	name: z.string(),
 	origin: createHyperdriveOriginSchema
 });
-const putSecretBodySchema = t.object({
-	name: t.string(),
-	text: t.string(),
-	type: t.string()
+const putSecretBodySchema = z.object({
+	name: z.string(),
+	text: z.string(),
+	type: z.string()
 });
-const cloudflareApiErrorSchema = t.object({
-	code: t.number(),
-	message: t.string()
+const cloudflareApiErrorSchema = z.object({
+	code: z.number(),
+	message: z.string()
 });
 //#endregion
 //#region ../../src/cli/platform-lib/services/WranglerApi.ts
@@ -287,29 +303,19 @@ var WranglerApi = class {
 	shell = $inject(ShellProvider);
 	utils = $inject(AlephaCliUtils);
 	pm = $inject(PackageManagerUtils);
-	runner = $inject(Runner);
 	async runShell(command, options = {}) {
-		const capture = options.capture;
-		const output = await this.shell.run(command, {
-			...options,
-			capture: capture ?? this.runner.useDynamicLogger
-		});
-		if (capture && !this.runner.useDynamicLogger) this.log.info(output);
+		const output = await this.shell.run(command, options);
+		if (options.capture) this.log.info(output);
 		return output;
 	}
 	/**
 	* Ensure wrangler is installed in the project.
 	*/
-	async ensureInstalled(root, run) {
+	async ensureInstalled(root) {
 		await this.pm.ensureDependency(root, "wrangler", {
 			dev: true,
 			exec: async (cmd, opts) => {
-				run.pause();
-				try {
-					await this.utils.exec(cmd, opts);
-				} finally {
-					run.resume();
-				}
+				await this.utils.exec(cmd, opts);
 			}
 		});
 	}
@@ -417,7 +423,7 @@ var CloudflareApi = class CloudflareApi {
 			this.accountId = fromEnv;
 			return this.accountId;
 		}
-		const res = await this.fetch("/accounts", { schema: t.array(cloudflareAccountSchema) });
+		const res = await this.fetch("/accounts", { schema: z.array(cloudflareAccountSchema) });
 		if (res.length === 0) throw new AlephaError("No Cloudflare accounts found for this token.");
 		if (res.length > 1) {
 			const list = res.map((a) => `  - ${a.id}  ${a.name}`).join("\n");
@@ -582,7 +588,7 @@ var CloudflareApi = class CloudflareApi {
 	}
 	async listSecrets(scriptName) {
 		const accountId = await this.resolveAccountId();
-		return await this.fetch(`/accounts/${accountId}/workers/scripts/${scriptName}/secrets`, { schema: t.array(cloudflareSecretSchema) });
+		return await this.fetch(`/accounts/${accountId}/workers/scripts/${scriptName}/secrets`, { schema: z.array(cloudflareSecretSchema) });
 	}
 	async putSecret(scriptName, name, value) {
 		const accountId = await this.resolveAccountId();
@@ -681,7 +687,7 @@ var CloudflareApi = class CloudflareApi {
 				headers
 			})).json();
 			if (!json.success) throw new AlephaError(`Cloudflare API error (GET ${path}): ${json.errors.map((e) => e.message).join(", ")}`);
-			const validated = this.alepha.codec.validate(t.array(itemSchema), json.result);
+			const validated = this.alepha.codec.validate(z.array(itemSchema), json.result);
 			results.push(...validated);
 			const totalPages = json.result_info?.total_pages;
 			if (!totalPages || page >= totalPages || validated.length === 0) break;
@@ -702,7 +708,7 @@ var CloudflareApi = class CloudflareApi {
 			if (cursor) query.cursor = cursor;
 			const res = await this.fetch(path, { query });
 			const items = res[itemsKey] ?? [];
-			const validated = this.alepha.codec.validate(t.array(itemSchema), items);
+			const validated = this.alepha.codec.validate(z.array(itemSchema), items);
 			results.push(...validated);
 			const nextCursor = res.cursor;
 			if (!nextCursor || validated.length === 0) break;
@@ -882,12 +888,8 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 		this.api.setAccountId(ctx.envConfig.accountId);
 	}
 	async runShell(command, options = {}) {
-		const capture = options.capture;
-		const output = await this.shell.run(command, {
-			...options,
-			capture: capture ?? this.runner.useDynamicLogger
-		});
-		if (capture && !this.runner.useDynamicLogger) this.log.info(output);
+		const output = await this.shell.run(command, options);
+		if (options.capture) this.log.info(output);
 		return output;
 	}
 	async authenticate(ctx, run) {
@@ -895,18 +897,14 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 		await run({
 			name: "authenticate",
 			handler: async () => {
-				await this.wrangler.ensureInstalled(ctx.root, run);
+				await this.wrangler.ensureInstalled(ctx.root);
 				let needsLogin = false;
 				try {
 					await this.wrangler.getAuthToken();
 				} catch {
 					needsLogin = true;
 				}
-				if (needsLogin) {
-					run.pause();
-					await this.wrangler.login();
-					run.resume();
-				}
+				if (needsLogin) await this.wrangler.login();
 				if (await this.cache.isLoginFresh(ctx.root, "cloudflare")) return;
 				try {
 					const accountId = await this.api.resolveAccountId();
@@ -938,11 +936,11 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 		if (ctx.resources.hasQueue) env.CLOUDFLARE_QUEUE_NAME = ctx.naming.queue();
 		const host = tenantDomain(ctx.envConfig.domain, ctx.tenant);
 		if (host) {
-			if (host.includes("*") && !ctx.envConfig.zone) throw new AlephaError(`Wildcard domain "${host}" requires "zone" to be set in the environment config (the Cloudflare zone name, e.g. "alepha.dev").`);
 			env.CLOUDFLARE_DOMAIN = host;
 			if (ctx.envConfig.zone) env.CLOUDFLARE_ZONE = ctx.envConfig.zone;
 		}
 		if (ctx.envConfig.jurisdiction) env.CLOUDFLARE_JURISDICTION = ctx.envConfig.jurisdiction;
+		if (ctx.envConfig.services?.length) env.CLOUDFLARE_SERVICES = JSON.stringify(ctx.envConfig.services);
 		if (ctx.prebuilt) {
 			await run({
 				name: "alepha build -t cloudflare --prebuilt (in-process)",
@@ -1033,7 +1031,7 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 	* Vars that are handled by wrangler bindings or build config.
 	* These should not be pushed as secrets.
 	*/
-	static EXCLUDED_SECRET_KEYS = new Set([
+	static EXCLUDED_SECRET_KEYS = /* @__PURE__ */ new Set([
 		"DATABASE_URL",
 		"R2_BUCKET_NAME",
 		"CLOUDFLARE_DOMAIN",
@@ -1071,7 +1069,7 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 		const declaredKeys = this.options?.secrets?.keys;
 		const manifestKeys = await this.readManifestEnvKeys(ctx.root);
 		const localKeys = Object.keys(await this.envUtils.parseEnv(ctx.root, [`.env.${ctx.env}.local`]));
-		const keys = declaredKeys ?? Array.from(new Set([...manifestKeys ?? Object.keys(envVars), ...localKeys]));
+		const keys = declaredKeys ?? Array.from(/* @__PURE__ */ new Set([...manifestKeys ?? Object.keys(envVars), ...localKeys]));
 		const secrets = {};
 		for (const key of keys) {
 			if (CloudflareAdapter.EXCLUDED_SECRET_KEYS.has(key)) continue;
@@ -1450,11 +1448,10 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 				name: `delete r2 ${name}`,
 				handler: async () => {
 					try {
-						await this.wipeR2Bucket(name, ctx);
-						await this.api.deleteR2(name);
+						await this.deleteR2Bucket(name, ctx);
 					} catch (error) {
 						const msg = String(error.message || "");
-						if (msg.includes("does not exist") || msg.includes("NoSuchBucket")) this.log.debug(`Bucket ${name} not found — skipping.`);
+						if (this.isMissingBucketError(msg)) this.log.debug(`Bucket ${name} not found — skipping.`);
 						else this.log.warn(`Failed to delete r2 ${name}: ${msg}`);
 					}
 				}
@@ -1510,33 +1507,97 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 		if ((await this.api.listR2()).find((b) => b.name === name)) return;
 		await this.api.createR2(name);
 	}
+	/** Whether a Cloudflare error message indicates the bucket is already gone. */
+	isMissingBucketError(msg) {
+		return msg.includes("does not exist") || msg.includes("NoSuchBucket") || msg.includes("bucket not found");
+	}
+	/**
+	* Resolve S3 credentials for wiping an R2 bucket over the S3 protocol.
+	*
+	* Prefers the account's R2 S3 credentials from the environment
+	* (`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`) — these are already
+	* provisioned for the deploy (artifact registry) and are account-scoped,
+	* so they can empty any bucket without minting anything. Returns `null`
+	* when not configured, letting the caller fall back to token minting.
+	*/
+	resolveR2Credentials() {
+		const accessKeyId = process.env.S3_ACCESS_KEY_ID;
+		const secretAccessKey = process.env.S3_SECRET_ACCESS_KEY;
+		if (accessKeyId && secretAccessKey) return {
+			accessKeyId,
+			secretAccessKey
+		};
+		return null;
+	}
+	/**
+	* Delete an R2 bucket, emptying it first only when necessary.
+	*
+	* Cloudflare's REST `DELETE /r2/buckets/:name` succeeds on an empty bucket
+	* but rejects a non-empty one. So we attempt the delete directly (the
+	* common teardown case — no objects, no creds needed), and only on failure
+	* empty the bucket over the S3 protocol and retry. A missing bucket is a
+	* no-op, so teardown is idempotent.
+	*/
+	async deleteR2Bucket(name, ctx) {
+		try {
+			await this.api.deleteR2(name);
+			return;
+		} catch (error) {
+			const msg = String(error.message || "");
+			if (this.isMissingBucketError(msg)) return;
+			this.log.debug(`Direct delete of r2 ${name} failed (${msg}); emptying then retrying.`);
+		}
+		await this.wipeR2Bucket(name, ctx);
+		try {
+			await this.api.deleteR2(name);
+		} catch (error) {
+			const msg = String(error.message || "");
+			if (this.isMissingBucketError(msg)) return;
+			throw error;
+		}
+	}
 	/**
 	* Empty an R2 bucket via the S3-compatible API.
 	*
-	* Cloudflare's REST `DELETE /r2/buckets/:name` rejects non-empty buckets
-	* with `BucketNotEmpty`, and the REST API has no object-level endpoints —
-	* objects must be listed and deleted over the S3 protocol. To avoid
-	* making users pre-create R2 access keys, we mint a short-lived
-	* bucket-scoped API token using the wrangler bearer token, wipe the
-	* bucket with `s3mini`, then revoke the token.
+	* Cloudflare's REST API has no object-level endpoints — objects must be
+	* listed and deleted over the S3 protocol. We use the account's R2 S3
+	* credentials (`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`) when present;
+	* otherwise we fall back to minting a short-lived bucket-scoped token via
+	* the CF API (requires a user-scoped `CLOUDFLARE_API_TOKEN`) and revoke it
+	* after. When neither is available the wipe is skipped with a warning —
+	* the caller still attempts the delete, which succeeds for empty buckets.
 	*
 	* Also aborts any pending multipart uploads — those count as bucket
 	* contents from R2's perspective and would otherwise block the delete.
 	*/
 	async wipeR2Bucket(bucketName, ctx) {
-		if (!process.env.CLOUDFLARE_API_TOKEN) {
-			this.log.warn(`Skipping R2 wipe for ${bucketName}: CLOUDFLARE_API_TOKEN not set. Delete the bucket manually in the Cloudflare dashboard.`);
-			return;
+		let creds = this.resolveR2Credentials();
+		let mintedTokenId;
+		if (!creds) {
+			if (!process.env.CLOUDFLARE_API_TOKEN) {
+				this.log.warn(`Skipping R2 wipe for ${bucketName}: no S3 credentials (S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY) and no CLOUDFLARE_API_TOKEN to mint a bucket-scoped token. A non-empty bucket must be emptied manually in the Cloudflare dashboard.`);
+				return;
+			}
+			try {
+				const tokenName = `alepha-teardown-${bucketName}-${Date.now()}`;
+				const token = await this.api.createR2Token(tokenName, bucketName);
+				mintedTokenId = token.id;
+				creds = {
+					accessKeyId: token.accessKeyId,
+					secretAccessKey: token.secretAccessKey
+				};
+			} catch (error) {
+				this.log.warn(`Skipping R2 wipe for ${bucketName}: could not mint an R2 token (${String(error.message || "")}). Set S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY for reliable teardown.`);
+				return;
+			}
 		}
-		const tokenName = `alepha-teardown-${bucketName}-${Date.now()}`;
-		const token = await this.api.createR2Token(tokenName, bucketName);
 		try {
 			const accountId = await this.api.resolveAccountId();
 			const jur = ctx.envConfig.jurisdiction;
 			const host = jur ? `${accountId}.${jur}.r2.cloudflarestorage.com` : `${accountId}.r2.cloudflarestorage.com`;
 			const client = new S3mini({
-				accessKeyId: token.accessKeyId,
-				secretAccessKey: token.secretAccessKey,
+				accessKeyId: creds.accessKeyId,
+				secretAccessKey: creds.secretAccessKey,
 				region: "auto",
 				endpoint: `https://${host}/${bucketName}`
 			});
@@ -1567,10 +1628,10 @@ var CloudflareAdapter = class CloudflareAdapter extends PlatformAdapter {
 			}
 			if (total > 0) this.log.info(`Emptied ${total} object(s) from bucket ${bucketName}.`);
 		} finally {
-			try {
-				await this.api.deleteR2Token(token.id);
+			if (mintedTokenId) try {
+				await this.api.deleteR2Token(mintedTokenId);
 			} catch (error) {
-				this.log.warn(`Failed to revoke ephemeral R2 token ${token.id}: ${String(error.message || "")}`);
+				this.log.warn(`Failed to revoke ephemeral R2 token ${mintedTokenId}: ${String(error.message || "")}`);
 			}
 		}
 	}
@@ -1609,37 +1670,37 @@ function computeSecretsHash(secrets) {
 }
 //#endregion
 //#region ../../src/cli/platform-lib/schemas/vercel.ts
-const vercelProjectSchema = t.object({
-	id: t.string(),
-	name: t.string(),
-	accountId: t.string()
+const vercelProjectSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	accountId: z.string()
 });
-const createProjectBodySchema = t.object({
-	name: t.string(),
-	framework: t.optional(t.null())
+const createProjectBodySchema = z.object({
+	name: z.string(),
+	framework: z.null().optional()
 });
-const vercelDeploymentSchema = t.object({
-	uid: t.string(),
-	name: t.string(),
-	url: t.string(),
-	state: t.optional(t.string()),
-	readyState: t.optional(t.string()),
-	created: t.optional(t.number()),
-	target: t.optional(t.string()),
-	alias: t.optional(t.array(t.string()))
+const vercelDeploymentSchema = z.object({
+	uid: z.string(),
+	name: z.string(),
+	url: z.string(),
+	state: z.string().optional(),
+	readyState: z.string().optional(),
+	created: z.number().optional(),
+	target: z.string().optional(),
+	alias: z.array(z.string()).optional()
 });
-const vercelEnvVarSchema = t.object({
-	id: t.string(),
-	key: t.string(),
-	value: t.optional(t.string()),
-	type: t.string(),
-	target: t.array(t.string())
+const vercelEnvVarSchema = z.object({
+	id: z.string(),
+	key: z.string(),
+	value: z.string().optional(),
+	type: z.string(),
+	target: z.array(z.string())
 });
-const createEnvVarBodySchema = t.object({
-	key: t.string(),
-	value: t.string(),
-	type: t.string(),
-	target: t.array(t.string())
+const createEnvVarBodySchema = z.object({
+	key: z.string(),
+	value: z.string(),
+	type: z.string(),
+	target: z.array(z.string())
 });
 //#endregion
 //#region ../../src/cli/platform-lib/services/VercelCli.ts
@@ -1655,29 +1716,19 @@ var VercelCli = class {
 	fs = $inject(FileSystemProvider);
 	utils = $inject(AlephaCliUtils);
 	pm = $inject(PackageManagerUtils);
-	runner = $inject(Runner);
 	async runShell(command, options = {}) {
-		const capture = options.capture;
-		const output = await this.shell.run(command, {
-			...options,
-			capture: capture ?? this.runner.useDynamicLogger
-		});
-		if (capture && !this.runner.useDynamicLogger) this.log.info(output);
+		const output = await this.shell.run(command, options);
+		if (options.capture) this.log.info(output);
 		return output;
 	}
 	/**
 	* Ensure vercel CLI is installed in the project.
 	*/
-	async ensureInstalled(root, run) {
+	async ensureInstalled(root) {
 		await this.pm.ensureDependency(root, "vercel", {
 			dev: true,
 			exec: async (cmd, opts) => {
-				run.pause();
-				try {
-					await this.utils.exec(cmd, opts);
-				} finally {
-					run.resume();
-				}
+				await this.utils.exec(cmd, opts);
 			}
 		});
 	}
@@ -1764,7 +1815,7 @@ var VercelApi = class VercelApi {
 		return this.token;
 	}
 	async listProjects() {
-		return (await this.fetch("/v10/projects", { schema: t.object({ projects: t.array(vercelProjectSchema) }) })).projects;
+		return (await this.fetch("/v10/projects", { schema: z.object({ projects: z.array(vercelProjectSchema) }) })).projects;
 	}
 	async getProject(nameOrId) {
 		try {
@@ -1799,13 +1850,13 @@ var VercelApi = class VercelApi {
 		if (options?.target) query.target = options.target;
 		return (await this.fetch("/v6/deployments", {
 			query,
-			schema: t.object({ deployments: t.array(vercelDeploymentSchema) })
+			schema: z.object({ deployments: z.array(vercelDeploymentSchema) })
 		})).deployments;
 	}
 	async listEnvVars(projectId) {
 		return (await this.fetch(`/v10/projects/${encodeURIComponent(projectId)}/env`, {
 			query: { decrypt: "true" },
-			schema: t.object({ envs: t.array(vercelEnvVarSchema) })
+			schema: z.object({ envs: z.array(vercelEnvVarSchema) })
 		})).envs;
 	}
 	async upsertEnvVars(projectId, vars) {
@@ -1871,26 +1922,21 @@ var VercelAdapter = class VercelAdapter extends PlatformAdapter {
 	envUtils = $inject(EnvUtils);
 	api = $inject(VercelApi);
 	vercelCli = $inject(VercelCli);
-	runner = $inject(Runner);
 	/**
 	* Vars that should not be pushed as env vars.
 	* These are either handled by the build or are internal.
 	*/
-	static EXCLUDED_SECRET_KEYS = new Set(["NODE_ENV"]);
+	static EXCLUDED_SECRET_KEYS = /* @__PURE__ */ new Set(["NODE_ENV"]);
 	async runShell(command, options = {}) {
-		const capture = options.capture;
-		const output = await this.shell.run(command, {
-			...options,
-			capture: capture ?? this.runner.useDynamicLogger
-		});
-		if (capture && !this.runner.useDynamicLogger) this.log.info(output);
+		const output = await this.shell.run(command, options);
+		if (options.capture) this.log.info(output);
 		return output;
 	}
 	async authenticate(ctx, run) {
 		await run({
 			name: "authenticate",
 			handler: async () => {
-				await this.vercelCli.ensureInstalled(ctx.root, run);
+				await this.vercelCli.ensureInstalled(ctx.root);
 				let needsLogin = false;
 				try {
 					await this.vercelCli.getAuthToken();
@@ -1898,11 +1944,7 @@ var VercelAdapter = class VercelAdapter extends PlatformAdapter {
 				} catch {
 					needsLogin = true;
 				}
-				if (needsLogin) {
-					run.pause();
-					await this.vercelCli.login();
-					run.resume();
-				}
+				if (needsLogin) await this.vercelCli.login();
 				if (await this.cache.isLoginFresh(ctx.root, "vercel")) return;
 				await this.cache.recordLogin(ctx.root, "vercel");
 			}
@@ -2453,7 +2495,7 @@ var PlatformOrchestrator = class {
 * secret names starting with GITHUB_.
 */
 var SecretFilterService = class SecretFilterService {
-	static EXCLUDED_KEYS = new Set(["NODE_ENV"]);
+	static EXCLUDED_KEYS = /* @__PURE__ */ new Set(["NODE_ENV"]);
 	static GITHUB_PREFIX = "GITHUB_";
 	static REMOTE_PREFIX = "APP_GITHUB_";
 	/**
@@ -2497,65 +2539,65 @@ var SecretFilterService = class SecretFilterService {
 var SecretStoreProvider = class {};
 //#endregion
 //#region ../../src/cli/platform-lib/schemas/platform.ts
-const platformStatusWorkerSchema = t.object({
-	name: t.string(),
-	exists: t.boolean(),
-	id: t.optional(t.string()),
-	detail: t.optional(t.string()),
-	version: t.optional(t.string()),
-	tag: t.optional(t.string()),
-	createdAt: t.optional(t.string())
+const platformStatusWorkerSchema = z.object({
+	name: z.string(),
+	exists: z.boolean(),
+	id: z.string().optional(),
+	detail: z.string().optional(),
+	version: z.string().optional(),
+	tag: z.string().optional(),
+	createdAt: z.string().optional()
 });
-const platformStatusResourceSchema = t.object({
-	name: t.string(),
-	exists: t.boolean(),
-	id: t.optional(t.string()),
-	detail: t.optional(t.string())
+const platformStatusResourceSchema = z.object({
+	name: z.string(),
+	exists: z.boolean(),
+	id: z.string().optional(),
+	detail: z.string().optional()
 });
-const platformStatusSecretSchema = t.object({
-	name: t.string(),
-	deployed: t.boolean()
+const platformStatusSecretSchema = z.object({
+	name: z.string(),
+	deployed: z.boolean()
 });
-const platformStatusSchema = t.object({
-	project: t.string(),
-	env: t.string(),
-	adapter: t.string(),
-	workers: t.array(platformStatusWorkerSchema),
-	databases: t.array(platformStatusResourceSchema),
-	buckets: t.array(platformStatusResourceSchema),
-	kvNamespaces: t.array(platformStatusResourceSchema),
-	queues: t.array(platformStatusResourceSchema),
-	secrets: t.array(platformStatusSecretSchema)
+const platformStatusSchema = z.object({
+	project: z.string(),
+	env: z.string(),
+	adapter: z.string(),
+	workers: z.array(platformStatusWorkerSchema),
+	databases: z.array(platformStatusResourceSchema),
+	buckets: z.array(platformStatusResourceSchema),
+	kvNamespaces: z.array(platformStatusResourceSchema),
+	queues: z.array(platformStatusResourceSchema),
+	secrets: z.array(platformStatusSecretSchema)
 });
-const platformPlanAppResourcesSchema = t.object({
-	hasDatabase: t.boolean(),
-	hasBucket: t.boolean(),
-	hasKV: t.boolean(),
-	hasQueue: t.boolean(),
-	hasCron: t.boolean()
+const platformPlanAppResourcesSchema = z.object({
+	hasDatabase: z.boolean(),
+	hasBucket: z.boolean(),
+	hasKV: z.boolean(),
+	hasQueue: z.boolean(),
+	hasCron: z.boolean()
 });
-const platformPlanAppSchema = t.object({
-	name: t.string(),
-	path: t.string(),
+const platformPlanAppSchema = z.object({
+	name: z.string(),
+	path: z.string(),
 	resources: platformPlanAppResourcesSchema
 });
-const platformPlanEnvironmentSchema = t.object({
-	adapter: t.string(),
-	domain: t.optional(t.string()),
-	zone: t.optional(t.string())
+const platformPlanEnvironmentSchema = z.object({
+	adapter: z.string(),
+	domain: z.string().optional(),
+	zone: z.string().optional()
 });
-const platformPlanResourceSchema = t.object({
-	label: t.string(),
-	value: t.string()
+const platformPlanResourceSchema = z.object({
+	label: z.string(),
+	value: z.string()
 });
-const platformPlanSchema = t.object({
-	project: t.string(),
-	env: t.string(),
-	mode: t.enum(["monorepo", "standalone"]),
-	apps: t.array(platformPlanAppSchema),
-	environments: t.record(t.string(), platformPlanEnvironmentSchema),
-	resources: t.array(platformPlanResourceSchema),
-	secretCount: t.number()
+const platformPlanSchema = z.object({
+	project: z.string(),
+	env: z.string(),
+	mode: z.enum(["monorepo", "standalone"]),
+	apps: z.array(platformPlanAppSchema),
+	environments: z.record(z.string(), platformPlanEnvironmentSchema),
+	resources: z.array(platformPlanResourceSchema),
+	secretCount: z.number()
 });
 //#endregion
 //#region ../../src/cli/platform-lib/index.ts