void 0.10.13 → 0.20.1

package/dist/cloudflare-auth-B1QtTO1b.mjs

@@ -0,0 +1,217 @@
+import { D as log } from "./output-tFQLLj26.mjs";
+import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
+import { execFile, spawn, spawnSync } from "node:child_process";
+//#region src/cli/cloudflare-auth.ts
+var CloudflareAuthenticationError = class extends Error {
+	name = "CloudflareAuthenticationError";
+	reason;
+	constructor(message, reason) {
+		super(message);
+		this.reason = reason;
+	}
+};
+/**
+* Authenticate with Cloudflare through Void's bundled deployment tooling.
+*
+* The caller owns the runner so deploy can retain its pinned account, API base,
+* config, and uploader-integrity boundary. Interactive sessions recover from an
+* expired or missing OAuth session in-process; CI remains token-only.
+*/
+async function ensureCloudflareAuthentication(options) {
+	if (options.forceLogin) {
+		const overrides = cloudflareCredentialOverrides();
+		if (overrides.length > 0) throw new CloudflareAuthenticationError(`Cloudflare browser login cannot replace credentials supplied by ${overrides.join(", ")}. Remove these overrides from this shell and rerun \`void cloudflare login\`.`, "environment-credentials");
+	}
+	if (options.acceptApiToken && !options.requireAccounts && (process.env.CLOUDFLARE_API_TOKEN?.trim() || process.env.CF_API_TOKEN?.trim())) return { accounts: [] };
+	const run = async (args, capture) => {
+		if (options.beforeRun && !options.beforeRun()) throw new CloudflareAuthenticationError("", "uploader-changed");
+		return await options.runWrangler(args, capture);
+	};
+	const whoamiArgs = [
+		"whoami",
+		"--json",
+		...options.whoamiArgs ?? []
+	];
+	const readSession = async () => {
+		const result = await run(whoamiArgs, true);
+		if (!isCleanExit(result)) return null;
+		const session = parseCloudflareAuthSession(result.stdout);
+		if (options.requireAccounts) return session && session.accounts.length > 0 ? session : null;
+		return session ?? (options.forceLogin ? null : { accounts: [] });
+	};
+	const existing = options.forceLogin ? null : await readSession();
+	if (existing) {
+		if (existing.authType === "OAuth Token") await enableCloudflareKeyring(run);
+		return existing;
+	}
+	if (!(options.interactive ?? (process.stdin.isTTY && process.stdout.isTTY))) throw new CloudflareAuthenticationError("Cloudflare authentication is required. Set CLOUDFLARE_API_TOKEN in CI, or run `void cloudflare login` in an interactive terminal.", "not-authenticated");
+	await enableCloudflareKeyring(run);
+	announceCloudflareLogin();
+	if (!isCleanExit(await run(["login", "--use-keyring"], true))) throw new CloudflareAuthenticationError("Cloudflare browser sign-in did not complete. Run `void cloudflare login` to try again.", "login");
+	const authenticated = await readSession();
+	if (!authenticated) throw new CloudflareAuthenticationError("Cloudflare sign-in completed without a usable session. Run `void cloudflare login` to try again.", "not-authenticated");
+	return authenticated;
+}
+async function enableCloudflareKeyring(run) {
+	if (!isCleanExit(await run([
+		"auth",
+		"keyring",
+		"enable"
+	], true))) throw new CloudflareAuthenticationError("Void could not enable secure Cloudflare credential storage in your operating-system keychain.", "keyring");
+}
+/** Credential names only: never include their values in diagnostics. */
+function cloudflareCredentialOverrides(source = process.env) {
+	const tokens = ["CLOUDFLARE_API_TOKEN", "CF_API_TOKEN"].filter((key) => Boolean(source[key]));
+	const key = ["CLOUDFLARE_API_KEY", "CF_API_KEY"].find((key) => Boolean(source[key]));
+	const email = ["CLOUDFLARE_EMAIL", "CF_EMAIL"].find((key) => Boolean(source[key]));
+	return [...tokens, ...key && email ? [key, email] : []];
+}
+function parseCloudflareAuthSession(stdout) {
+	let value;
+	try {
+		value = JSON.parse(stdout.trim());
+	} catch {
+		return null;
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.loggedIn !== true || !Array.isArray(record.accounts)) return null;
+	const accounts = [];
+	for (const account of record.accounts) {
+		if (!account || typeof account !== "object" || Array.isArray(account)) continue;
+		const item = account;
+		if (typeof item.id !== "string" || item.id.length === 0) continue;
+		accounts.push({
+			id: item.id,
+			name: typeof item.name === "string" && item.name.length > 0 ? item.name : "Cloudflare account"
+		});
+	}
+	return {
+		accounts,
+		...typeof record.email === "string" && record.email ? { email: record.email } : {},
+		...typeof record.authType === "string" && record.authType ? { authType: record.authType } : {}
+	};
+}
+function createBundledCloudflareAuthRunner(root) {
+	const [command, ...prefix] = resolveWranglerArgv(root);
+	return (args, capture) => {
+		const env = cloudflareAuthCommandEnvironment(args);
+		const result = spawnSync(command, [...prefix, ...args], {
+			cwd: root,
+			encoding: "utf8",
+			env,
+			maxBuffer: 10485760,
+			shell: false,
+			stdio: cloudflareKeyringNeedsTerminal(args) ? [
+				"inherit",
+				"inherit",
+				"ignore"
+			] : capture ? [
+				"ignore",
+				"pipe",
+				"pipe"
+			] : "inherit",
+			timeout: 6e5,
+			windowsHide: true
+		});
+		return {
+			status: result.status,
+			stderr: capture ? result.stderr || "" : "",
+			stdout: capture ? result.stdout || "" : "",
+			signal: result.signal,
+			error: result.error?.message
+		};
+	};
+}
+/** Run a captured auth command without blocking terminal input or exposing credentials. */
+function runCloudflareAuthCommand(root, args, signal) {
+	const [command, ...prefix] = resolveWranglerArgv(root);
+	if (cloudflareKeyringNeedsTerminal(args)) return new Promise((resolve) => {
+		const child = spawn(command, [...prefix, ...args], {
+			cwd: root,
+			env: cloudflareAuthCommandEnvironment(args),
+			shell: false,
+			signal,
+			stdio: [
+				"inherit",
+				"inherit",
+				"ignore"
+			],
+			timeout: 6e5,
+			windowsHide: true
+		});
+		child.once("error", (error) => {
+			resolve({
+				status: null,
+				stdout: "",
+				stderr: "",
+				error: error.message
+			});
+		});
+		child.once("close", (status, signal) => {
+			resolve({
+				status,
+				signal,
+				stdout: "",
+				stderr: ""
+			});
+		});
+	});
+	return new Promise((resolve) => {
+		execFile(command, [...prefix, ...args], {
+			cwd: root,
+			encoding: "utf8",
+			env: cloudflareAuthCommandEnvironment(args),
+			maxBuffer: 10485760,
+			shell: false,
+			signal,
+			timeout: 6e5,
+			windowsHide: true
+		}, (error, stdout, stderr) => {
+			resolve({
+				status: error ? typeof error.code === "number" ? error.code : null : 0,
+				stderr,
+				stdout,
+				signal: error?.signal,
+				error: error?.message
+			});
+		}).stdin?.end();
+	});
+}
+function cloudflareAuthCommandEnvironment(args, source = process.env) {
+	const env = cloudflareAuthEnvironment(source);
+	if (args[0] === "login" || args[0] === "logout" || isCloudflareKeyringEnable(args)) env.WRANGLER_LOG = "none";
+	return env;
+}
+function isCloudflareKeyringEnable(args) {
+	return args.length === 3 && args[0] === "auth" && args[1] === "keyring" && args[2] === "enable";
+}
+/**
+* Wrangler installs its Windows keyring backend only when stdin AND stdout are
+* terminals. Capturing `auth keyring enable` makes first-time setup fail even
+* inside PowerShell. This command only configures storage; it never reads or
+* prints a credential. Keep every other auth command captured.
+*/
+function cloudflareKeyringNeedsTerminal(args) {
+	return process.platform === "win32" && process.stdin.isTTY === true && process.stdout.isTTY === true && isCloudflareKeyringEnable(args);
+}
+function cloudflareAuthEnvironment(source = process.env) {
+	const env = { ...source };
+	const scrubbedWranglerKeys = /* @__PURE__ */ new Set([
+		"WRANGLER_OUTPUT_FILE_DIRECTORY",
+		"WRANGLER_OUTPUT_FILE_PATH",
+		"WRANGLER_LOG_SANITIZE"
+	]);
+	for (const key of Object.keys(env)) if (/^VOID_PLATFORM_/i.test(key) || /^(?:DATABASE_URL|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET|CF_ACCESS_TOKEN)$/i.test(key) || scrubbedWranglerKeys.has(key.toUpperCase())) delete env[key];
+	env.CLOUDFLARE_AUTH_USE_KEYRING = "true";
+	env.WRANGLER_LOG_SANITIZE = "true";
+	return env;
+}
+function isCleanExit(result) {
+	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
+}
+function announceCloudflareLogin() {
+	log.info("Opening Cloudflare login in your browser. Press Ctrl+C to cancel.");
+}
+//#endregion
+export { createBundledCloudflareAuthRunner as a, parseCloudflareAuthSession as c, cloudflareKeyringNeedsTerminal as i, runCloudflareAuthCommand as l, announceCloudflareLogin as n, enableCloudflareKeyring as o, cloudflareCredentialOverrides as r, ensureCloudflareAuthentication as s, CloudflareAuthenticationError as t };

package/dist/cloudflare-cmd-B6_OZx2V.mjs

@@ -0,0 +1,62 @@
+import { t as basename } from "./dist-BrsS7cai.mjs";
+import { D as log } from "./output-tFQLLj26.mjs";
+import { v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
+import { a as createBundledCloudflareAuthRunner, c as parseCloudflareAuthSession, o as enableCloudflareKeyring, r as cloudflareCredentialOverrides, s as ensureCloudflareAuthentication } from "./cloudflare-auth-B1QtTO1b.mjs";
+//#region src/cli/cloudflare-cmd.ts
+async function runCloudflareCommand(root, args) {
+	const runWrangler = createBundledCloudflareAuthRunner(root);
+	switch (args.subcommand) {
+		case "login": {
+			const session = await ensureCloudflareAuthentication({
+				runWrangler,
+				forceLogin: true
+			});
+			log.success(formatSession(root, session));
+			return;
+		}
+		case "status": {
+			const result = await runWrangler(["whoami", "--json"], true);
+			const session = result.status === 0 && !result.signal && !result.error ? parseCloudflareAuthSession(result.stdout) : null;
+			if (!session) throw new Error("Not signed in to Cloudflare. Run `void cloudflare login`.");
+			if (session.authType === "OAuth Token") await enableCloudflareKeyring(runWrangler);
+			log.info(formatSession(root, session));
+			return;
+		}
+		case "logout": {
+			await enableCloudflareKeyring(runWrangler);
+			if ((await runWrangler(["logout"], true)).status !== 0) throw new Error("Could not remove the local Cloudflare browser session.");
+			const overrides = cloudflareCredentialOverrides();
+			if (overrides.length > 0) log.warn(`Removed the local Cloudflare browser session. Environment credentials remain active: ${overrides.join(", ")}.`);
+			else log.success("Signed out of Cloudflare.");
+			return;
+		}
+	}
+}
+function formatSession(root, session) {
+	const lines = ["Signed in to Cloudflare."];
+	if (session.email) lines.push(`User: ${session.email}`);
+	if (session.authType) lines.push(`Authentication: ${session.authType}`);
+	if (session.authType === "OAuth Token") lines.push("Credential storage: encrypted file protected by the OS keychain.");
+	const overrides = cloudflareCredentialOverrides();
+	if (overrides.length > 0) lines.push(`Environment credentials: ${overrides.join(", ")}`);
+	lines.push("Accessible accounts:");
+	lines.push(...session.accounts.length > 0 ? session.accounts.map((account) => `  ${account.name} (${account.id})`) : ["  No accessible accounts were returned."]);
+	try {
+		const rootConfig = readRootWranglerConfig(root);
+		const configured = rootConfig?.config.account_id;
+		const environment = process.env.CLOUDFLARE_ACCOUNT_ID || process.env.CF_ACCOUNT_ID;
+		const accountId = typeof configured === "string" && configured ? configured : environment;
+		if (accountId) {
+			const source = accountId === configured ? basename(rootConfig.configPath) : process.env.CLOUDFLARE_ACCOUNT_ID ? "CLOUDFLARE_ACCOUNT_ID" : "CF_ACCOUNT_ID";
+			const account = session.accounts.find((account) => account.id === accountId);
+			lines.push(`Deployment account: ${account ? `${account.name} (${accountId})` : accountId} (from ${source}).`);
+			if (!account) lines.push("The pinned deployment account was not returned by this authentication check. Signing in does not change the project target.");
+			if (configured && environment && configured !== environment) lines.push("The environment account conflicts with the project configuration; resolve the mismatch before deploying.");
+		} else lines.push("Deployment account: not selected.");
+	} catch {
+		lines.push("Deployment account: unavailable because the Cloudflare configuration could not be read.");
+	}
+	return lines.join("\n");
+}
+//#endregion
+export { runCloudflareCommand };

package/dist/cloudflare-connect-j5D4hhrG.mjs

@@ -0,0 +1,56 @@
+import { o as join, t as basename } from "./dist-BrsS7cai.mjs";
+import { D as log, F as isCancel, j as select } from "./output-tFQLLj26.mjs";
+import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
+import { a as createBundledCloudflareAuthRunner, s as ensureCloudflareAuthentication } from "./cloudflare-auth-B1QtTO1b.mjs";
+import { existsSync } from "node:fs";
+//#region src/cli/cloudflare-connect.ts
+async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY)) {
+	if (process.env.CLOUDFLARE_ENV || process.env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH) throw new Error("connect: Named Cloudflare environments and config overrides are not supported.");
+	const existingConfigPath = ["wrangler.jsonc", "wrangler.json"].map((name) => join(root, name)).find(existsSync);
+	let existingConfig;
+	try {
+		existingConfig = readRootWranglerConfig(root);
+	} catch {
+		throw new Error(`connect: Invalid ${basename(existingConfigPath)}. Fix it before connecting to Cloudflare.`);
+	}
+	const config = existingConfig?.config ?? {};
+	const envAccount = process.env.CLOUDFLARE_ACCOUNT_ID || process.env.CF_ACCOUNT_ID;
+	const configuredAccount = typeof config.account_id === "string" ? config.account_id : void 0;
+	if (envAccount && configuredAccount && envAccount !== configuredAccount) throw new Error("connect: The environment account differs from account_id in the Cloudflare config.");
+	const pinnedAccount = configuredAccount || envAccount;
+	const compatibilityDate = typeof config.compatibility_date === "string" ? config.compatibility_date : LATEST_KNOWN_COMPAT_DATE;
+	if (existsSync(join(root, "wrangler.toml"))) throw new Error("connect: Found wrangler.toml. Convert it to wrangler.jsonc with the same settings before connecting to Cloudflare.");
+	const { accounts } = await ensureCloudflareAuthentication({
+		interactive,
+		requireAccounts: true,
+		runWrangler: createBundledCloudflareAuthRunner(root),
+		whoamiArgs: existingConfigPath ? ["-c", existingConfigPath] : []
+	});
+	let account = accounts.find((entry) => entry.id === pinnedAccount);
+	if (pinnedAccount && !account) throw new Error(`connect: The signed-in Cloudflare session cannot access account ${pinnedAccount}.`);
+	if (!account && accounts.length === 1) account = accounts[0];
+	if (!account) {
+		if (!interactive) throw new Error("connect: Multiple Cloudflare accounts are available. Set CLOUDFLARE_ACCOUNT_ID.");
+		const id = await select({
+			message: "Choose a Cloudflare account:",
+			initialValue: accounts[0]?.id,
+			options: accounts.map((entry) => ({
+				value: entry.id,
+				label: entry.name,
+				hint: entry.id
+			}))
+		});
+		if (isCancel(id)) throw new Error("connect: Cloudflare account selection was cancelled.");
+		account = accounts.find((entry) => entry.id === id);
+	}
+	if (!account) throw new Error("connect: No Cloudflare account was selected.");
+	const written = writeProvisionedWranglerConfig(root, {
+		accountId: account.id,
+		compatibilityDate
+	}, existingConfigPath ? { configPath: existingConfigPath } : void 0);
+	log.info(`${basename(written.configPath)} is ready for Cloudflare deployment`);
+	log.success(`Configured Cloudflare account: ${account.name}`);
+	return account;
+}
+//#endregion
+export { connectCloudflare as t };