void 0.21.9 → 0.22.0

package/dist/cli/cf-compat.mjs

@@ -1,13 +1,71 @@
 #!/usr/bin/env node
+import { n as __toESM } from "../rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "../dist-BVqXeR_h.mjs";
-import { t as prepareCfBuildOutput } from "../cf-build-output-CGT03qCD.mjs";
-import { copyFileSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { t as require_picocolors } from "../picocolors-BTps1_gs.mjs";
+import { t as prepareCfBuildOutput } from "../cf-build-output-BJ6yGEIS.mjs";
+import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { tmpdir } from "node:os";
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { parse } from "jsonc-parser";
+import { stripVTControlCharacters } from "node:util";
 import { readBuildOutput } from "@cloudflare/build-output-utils";
 import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
+import { getCloudflareAuthUseKeyringFromEnv } from "@cloudflare/workers-auth";
+import { createCfAuth, createCfProfileStore, readUserPreferences, setKeyringPreference } from "@cloudflare/workers-auth/cf";
+//#region src/cli/cf-session.ts
+const logger = {
+	debug() {},
+	info() {},
+	log() {},
+	warn() {},
+	error() {}
+};
+function session(root) {
+	const auth = createCfAuth({
+		logger,
+		userAgent: "void",
+		prompt: async () => {
+			throw new Error("Cloudflare session reads cannot prompt.");
+		},
+		select: async () => {
+			throw new Error("Cloudflare session reads cannot prompt.");
+		},
+		isNoDefaultValueProvidedError: () => false
+	});
+	auth.setProfile(createCfProfileStore({ logger }).resolve({ cwd: root }));
+	return auth;
+}
+/** Borrow only the profile just verified by cf, including its encrypted store. */
+function readCfSessionCredential(root, identity) {
+	if (identity.authenticated !== true || identity.tokenValid !== true) return null;
+	const auth = session(root);
+	if (identity.authSource !== `OAuth token from ${auth.getCredentialStore().path()}`) return null;
+	const token = auth.readAuthCredentials()?.oauth_token;
+	if (typeof token === "string" && token.length > 0) persistCfKeyringPreference(root);
+	return typeof token === "string" && token.length > 0 ? token : null;
+}
+/** Keep subsequent cf logins on the encrypted profile adopted by Void. */
+function persistCfKeyringPreference(root) {
+	if (getCloudflareAuthUseKeyringFromEnv() === false || readUserPreferences().keyring_enabled === true) return;
+	const auth = session(root);
+	if (!setKeyringPreference(true, {
+		logger,
+		getCredentialStore: auth.getCredentialStore
+	}).enabled) throw new Error("Cloudflare encrypted credential storage is unavailable.");
+}
+//#endregion
+//#region src/cli/cloudflare-login-output.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+/** The bundled cf login prints the device code before opening the browser. */
+function cloudflareDeviceCode(output) {
+	const plain = stripVTControlCharacters(output);
+	return /and enter the code:\s*([A-Za-z0-9-]+)\s/i.exec(plain)?.[1] ?? /[?&]user_code=([A-Za-z0-9-]+)\s/i.exec(plain)?.[1] ?? null;
+}
+function printCloudflareLoginPrompt(code) {
+	console.log(code ? `Opening Cloudflare login in your browser. Confirm the code ${import_picocolors.default.blue(code)} in your browser. Press Ctrl+C to cancel.` : "Opening Cloudflare login in your browser. Confirm the code shown in your browser. Press Ctrl+C to cancel.");
+}
+//#endregion
 //#region src/cli/cf-compat.ts
 /**
 * Private transport for the existing Void Cloudflare command seams. The
@@ -16,13 +74,14 @@ import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
 */
 const cf = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "bin", "cf");
 const args = process.argv.slice(2);
+process.env.CLOUDFLARE_AUTH_USE_KEYRING ??= "true";
 function cfEnvironment() {
 	const env = {
 		...process.env,
 		CF_DELEGATION: "1",
 		CF_SEND_TELEMETRY: "false",
 		CF_NO_OSC_PROGRESS: "1",
-		CLOUDFLARE_AUTH_USE_KEYRING: process.env.CLOUDFLARE_AUTH_USE_KEYRING ?? "true"
+		CLOUDFLARE_AUTH_USE_KEYRING: process.env.CLOUDFLARE_AUTH_USE_KEYRING
 	};
 	if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) env.NODE_USE_ENV_PROXY = "1";
 	for (const [canonical, alias] of [
@@ -64,21 +123,54 @@ function runCf(command, cwd = process.cwd()) {
 	return result(child.status ?? 1, child.stdout ?? "", stderr);
 }
 function runInteractiveCf(command) {
-	const child = spawnSync(process.execPath, [
-		cf,
-		...command,
-		"--quiet"
-	], {
-		cwd: process.cwd(),
-		env: {
-			...cfEnvironment(),
-			CF_QUIET: "1"
-		},
-		shell: false,
-		stdio: "inherit",
-		windowsHide: true
+	return new Promise((resolve) => {
+		const child = spawn(process.execPath, [
+			cf,
+			...command,
+			"--quiet"
+		], {
+			cwd: process.cwd(),
+			env: {
+				...cfEnvironment(),
+				CF_QUIET: "1"
+			},
+			shell: false,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let output = "";
+		let announced = false;
+		let settled = false;
+		const finish = (value) => {
+			if (!settled) {
+				settled = true;
+				resolve(value);
+			}
+		};
+		const collect = (chunk) => {
+			output = (output + chunk.toString()).slice(-32768);
+			if (!announced) {
+				const code = cloudflareDeviceCode(output);
+				if (code) {
+					announced = true;
+					printCloudflareLoginPrompt(code);
+				}
+			}
+		};
+		child.stdout.on("data", collect);
+		child.stderr.on("data", collect);
+		child.once("error", (error) => finish(result(1, "", error.message)));
+		child.once("close", (status, signal) => {
+			if (status === 0) {
+				if (!announced) printCloudflareLoginPrompt(null);
+				finish(result(0));
+			} else finish(result(status ?? 1, "", output.trim() || `Cloudflare login ended${signal ? ` (${signal})` : ""}.`));
+		});
 	});
-	return result(child.status ?? 1, "", child.error?.message ?? "");
 }
 async function withBuildOutput(raw, sourceMain, action) {
 	const scratch = mkdtempSync(join(tmpdir(), "void-cf-command-"));
@@ -99,7 +191,7 @@ async function withBuildOutput(raw, sourceMain, action) {
 			await assertExistingProvisionableResources(output.directory, accountId);
 			return action(output.directory);
 		} finally {
-			output.dispose();
+			await output.dispose();
 		}
 	} finally {
 		rmSync(scratch, {
@@ -210,6 +302,39 @@ async function clearWorkerCronSchedules(worker) {
 		await proxy?.close();
 	}
 }
+async function clearWorkerCustomDomains(worker) {
+	const endpoint = `${(process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "")}/accounts/${encodeURIComponent(accountId())}/workers/scripts/${encodeURIComponent(worker)}/domains/records`;
+	const proxy = process.env.HTTP_PROXY || process.env.HTTPS_PROXY || process.env.http_proxy || process.env.https_proxy ? new EnvHttpProxyAgent() : null;
+	try {
+		const response = await fetch$1(endpoint, {
+			method: "PUT",
+			headers: {
+				...await apiHeaders(),
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({
+				override_scope: true,
+				override_existing_origin: false,
+				override_existing_dns_record: false,
+				origins: []
+			}),
+			redirect: "error",
+			signal: AbortSignal.timeout(3e4),
+			...proxy ? { dispatcher: proxy } : {}
+		});
+		if (!response.ok) throw new Error(`Cloudflare rejected the empty custom-domain set (HTTP ${response.status}).`);
+		let body;
+		try {
+			body = await response.json();
+		} catch {
+			throw new Error(`Cloudflare returned HTTP ${response.status} with a non-JSON custom-domain response.`);
+		}
+		if (object(body).success !== true) throw new Error(`Cloudflare rejected the empty custom-domain set (HTTP ${response.status}).`);
+		return result(0);
+	} finally {
+		await proxy?.close();
+	}
+}
 async function assertExistingProvisionableResources(directory, account) {
 	const bindings = (await readBuildOutput(directory)).workers.default.config.env ?? {};
 	const queueNames = /* @__PURE__ */ new Set();
@@ -283,46 +408,29 @@ async function sessionCredential() {
 	if (identity.status !== 0) return null;
 	const state = object(parsedJson(identity.stdout));
 	if (state.authenticated !== true || state.tokenValid !== true) return null;
-	if (typeof state.authSource !== "string" || !state.authSource.startsWith("OAuth token")) return null;
-	const dist = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "dist");
-	const entry = readdirSync(dist).find((name) => /^cf-[^/]+\.mjs$/.test(name));
-	if (!entry) throw new Error("The bundled Cloudflare credential reader is unavailable.");
-	const previousKeyringSetting = process.env.CLOUDFLARE_AUTH_USE_KEYRING;
-	process.env.CLOUDFLARE_AUTH_USE_KEYRING = previousKeyringSetting ?? "true";
-	let stored;
-	try {
-		const module = await import(pathToFileURL(join(dist, entry)).href);
-		if (typeof module.t !== "function") throw new Error("The bundled Cloudflare credential reader is unavailable.");
-		const noop = () => {};
-		stored = module.t({ logger: {
-			debug: noop,
-			info: noop,
-			log: noop,
-			warn: noop,
-			error: noop
-		} }).readAuthCredentials();
-	} finally {
-		if (previousKeyringSetting === void 0) delete process.env.CLOUDFLARE_AUTH_USE_KEYRING;
-		else process.env.CLOUDFLARE_AUTH_USE_KEYRING = previousKeyringSetting;
-	}
-	const credential = stored && typeof stored === "object" ? stored : null;
-	return credential && typeof credential.oauth_token === "string" && credential.oauth_token ? {
+	const credential = readCfSessionCredential(process.cwd(), state);
+	return credential ? {
 		type: "oauth",
-		token: credential.oauth_token
+		token: credential
 	} : null;
 }
 async function auth() {
-	if (args[0] === "login") return runInteractiveCf([
-		"auth",
-		"login",
-		"--force"
-	]);
+	if (args[0] === "login") {
+		const loggedIn = await runInteractiveCf([
+			"auth",
+			"login",
+			"--force"
+		]);
+		if (loggedIn.status === 0) persistCfKeyringPreference(process.cwd());
+		return loggedIn;
+	}
 	if (args[0] === "logout") return runCf(["auth", "logout"]);
 	if (args[0] === "whoami") {
 		const called = runCf(["auth", "whoami"]);
 		if (called.status !== 0) return called;
 		const identity = object(parsedJson(called.stdout));
 		if (identity.authenticated !== true || identity.tokenValid !== true) return result(1, JSON.stringify({ loggedIn: false }), "Cloudflare authentication is required.");
+		if (String(identity.authSource).startsWith("OAuth token from ")) persistCfKeyringPreference(process.cwd());
 		return result(0, JSON.stringify({
 			loggedIn: true,
 			accounts: identity.accounts,
@@ -831,6 +939,12 @@ async function workerChanges() {
 		if (raw.name !== name || raw.account_id !== void 0 && raw.account_id !== accountId()) throw new Error("Cloudflare trigger target changed.");
 		return await clearWorkerCronSchedules(name);
 	}
+	if (args[0] === "triggers" && args[1] === "clear-domains") {
+		const raw = config();
+		const name = workerName();
+		if (raw.name !== name || raw.account_id !== void 0 && raw.account_id !== accountId()) throw new Error("Cloudflare trigger target changed.");
+		return await clearWorkerCustomDomains(name);
+	}
 	if (args[0] === "versions" && args[1] === "upload" || args[0] === "deploy") {
 		const raw = config();
 		const path = configPath();

package/dist/cli/cli.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { a as join } from "../dist-BVqXeR_h.mjs";
-import { j as log } from "../dist-Dn6nn2IU.mjs";
+import { j as log } from "../dist-CTBk70IR.mjs";
 import { n as getPackageDir } from "../agents-B_pX_HmQ.mjs";
 import { t as formatCloudflareUserMessage } from "../cloudflare-user-output-Q-k0QoNQ.mjs";
-import { a as operatorGroups, i as printVoidHeader, n as printGlobalHelp, o as parseOperatorArgs, r as printHelpPage, t as getHelpPath } from "../help-DC7gdz7L.mjs";
+import { a as operatorGroups, i as printVoidHeader, n as printGlobalHelp, o as parseOperatorArgs, r as printHelpPage, t as getHelpPath } from "../help-GKtwl07I.mjs";
 import { r as OperatorClientError } from "../operator-client-DUwumHpQ.mjs";
 import { readFileSync } from "node:fs";
 import { PLATFORM_LOGIN_KINDS, parsePlatformLoginId } from "@void/platform";
@@ -1278,7 +1278,7 @@ const platformSubcommands = [
 	},
 	...operatorGroups.map((name) => ({
 		name,
-		hint: name === "email" ? "Domains, policy, limits, outcomes, and recovery" : "Operator commands",
+		hint: name === "email" ? "Domains, policy, limits, outcomes, and recovery" : name === "zero-trust" ? "Configure Access protection and project overrides" : "Operator commands",
 		description: `Administer platform ${name}`
 	})),
 	{
@@ -1610,6 +1610,11 @@ const projectSubcommands = [
 		hint: "list | invite | invitations | role | remove | revoke | leave | pending | accept | decline",
 		description: "Manage project members and invitations"
 	},
+	{
+		name: "zero-trust",
+		hint: "status | protect | public | reconcile",
+		description: "Inspect or override Cloudflare Zero Trust protection"
+	},
 	{
 		name: "logs",
 		description: "Show runtime logs from the deployed project"
@@ -1702,6 +1707,30 @@ function parseProjectArgs(args) {
 		};
 	}
 	if (subcommand === "team") return parseTeamArgs(rest);
+	if (subcommand === "zero-trust") {
+		const [action = "", ...args] = rest;
+		if (action && ![
+			"status",
+			"protect",
+			"public",
+			"reconcile"
+		].includes(action)) throw new Error("project: Usage: void project zero-trust <status|protect|public|reconcile> [--project <slug>].");
+		let projectSlug = "";
+		for (let index = 0; index < args.length; index++) {
+			const arg = args[index];
+			if (arg === "--project") {
+				const value = args[++index];
+				if (!value || value.startsWith("-")) throw new Error("project: --project requires a value.");
+				if (projectSlug) throw new Error("project: Duplicate flag '--project'.");
+				projectSlug = value;
+			} else throw new Error(`project: Unexpected argument '${arg}'.`);
+		}
+		return {
+			subcommand,
+			action,
+			projectSlug
+		};
+	}
 	if (subcommand === "logs") {
 		let filter = "";
 		let range = "1h";
@@ -1778,7 +1807,7 @@ function parseProjectArgs(args) {
 			projectSlug
 		};
 	}
-	throw new Error("project: Usage: void project <status|link|list|team|token|logs|requests|rollback|cancel|delete|purge-cache>.");
+	throw new Error("project: Usage: void project <status|link|list|team|token|zero-trust|logs|requests|rollback|cancel|delete|purge-cache>.");
 }
 function parseTeamArgs(rest) {
 	const [action, ...args] = rest;
@@ -1980,7 +2009,7 @@ async function runSubcommandGroup(command, subcommands, parse, run) {
 	const hasNamedSubcommand = args.slice(1).some((arg) => subcommands.some(({ name }) => name === arg));
 	try {
 		if ((!sub || sub.startsWith("-") && !hasNamedSubcommand) && process.stdin.isTTY) {
-			const { promptSubcommand } = await import("../subcommand-prompt-BuGYkAkC.mjs");
+			const { promptSubcommand } = await import("../subcommand-prompt-CY1C4fvl.mjs");
 			if (command === "platform" && !sub) log.info("A Void platform lets a team deploy Void apps to a shared Cloudflare account.\nThis command sets up and manages platforms. Join with `void connect <url>`.\nDocs: https://void.cloud/guide/self-hosted-platform");
 			const result = await promptSubcommand(command, subcommands);
 			if (!result) process.exit(0);
@@ -2020,7 +2049,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-DDz7c8LK.mjs").then(({ runDeploy }) => {
+	import("../deploy-B19L2Bra.mjs").then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -2039,25 +2068,25 @@ if (helpPath) {
 	});
 } else if (command === "connect") (async () => {
 	const parsed = parseConnectArgs(args.slice(1));
-	const { runConnectCommand } = await import("../connect-BsUSRzln.mjs");
+	const { runConnectCommand } = await import("../connect-Dg-WkW-C.mjs");
 	await runConnectCommand(process.cwd(), parsed);
 })().catch((err) => {
 	log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 	process.exit(1);
 });
-else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-router-BgEFRuvZ.mjs").then(({ runAuthRouter }) => runAuthRouter(root, parsed)));
-else if (command === "account") runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (root, parsed) => import("../account-cmd-DZZGK80W.mjs").then(({ runAccountCommand }) => runAccountCommand(root, parsed)));
-else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-C4ZV3Vpy.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
-else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-bSmZ1d5L.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-B44I8J_W.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-DN9sSNiV.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-DFi-s2t4.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-hRrvZaq_.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
-else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
-else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-Dpt0jd-x.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
+else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-router-ZUg9MF_U.mjs").then(({ runAuthRouter }) => runAuthRouter(root, parsed)));
+else if (command === "account") runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (root, parsed) => import("../account-cmd-CjyxcGkM.mjs").then(({ runAccountCommand }) => runAccountCommand(root, parsed)));
+else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-E0FuL212.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
+else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-BKlfGHAy.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-BZLCqOqw.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-BOtOl_cb.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-JRF59P_r.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-Bo6G9LOZ.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-gp2sCXyN.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-BYOrWQnv.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-CNJ62MM7.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-0-7PexDq.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
+else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-BxR5FROK.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
 else if (command === "prepare") {
 	const root = process.cwd();
 	let prepareArgs;
@@ -2067,7 +2096,7 @@ else if (command === "prepare") {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../prepare-DyZ-Yok5.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-C-6YZyyg.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			log.error(formatCloudflareUserMessage(err.message ?? String(err)));
 			process.exit(1);
@@ -2075,7 +2104,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-WO0JlPx8.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-FZx3Elvz.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -2093,7 +2122,7 @@ else if (command === "prepare") {
 		log.error("migrate: This command takes no arguments.");
 		process.exit(1);
 	}
-	import("../migrate-TsHGBnDA.mjs").then(({ runMigrateCommand }) => {
+	import("../migrate-CYfbKkXh.mjs").then(({ runMigrateCommand }) => {
 		runMigrateCommand(process.cwd()).catch((err) => {
 			log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 			process.exit(1);
@@ -2136,7 +2165,7 @@ else if (command === "prepare") {
 		},
 		{
 			name: "platform",
-			hint: "auth | user | project | deployment | signup | email | system | install",
+			hint: "auth | user | project | deployment | signup | email | zero-trust | system | install",
 			description: "Install platforms and administer users, projects, access, and operations"
 		},
 		{
@@ -2146,7 +2175,7 @@ else if (command === "prepare") {
 		},
 		{
 			name: "project",
-			hint: "status | link | list | team | token | logs | requests | rollback | cancel | delete | purge-cache",
+			hint: "status | link | list | team | token | zero-trust | logs | requests | rollback | cancel | delete | purge-cache",
 			description: "Manage projects, teams, deployments, and scoped CI credentials"
 		},
 		{
@@ -2200,47 +2229,47 @@ else if (command === "prepare") {
 	];
 	(async () => {
 		printVoidHeader();
-		const { promptSubcommand } = await import("../subcommand-prompt-BuGYkAkC.mjs");
+		const { promptSubcommand } = await import("../subcommand-prompt-CY1C4fvl.mjs");
 		const result = await promptSubcommand("", topLevelCommands);
 		if (!result) process.exit(0);
 		const cmd = result.subcommand;
 		const root = process.cwd();
 		switch (cmd) {
 			case "connect": {
-				const { runConnectCommand } = await import("../connect-BsUSRzln.mjs");
+				const { runConnectCommand } = await import("../connect-Dg-WkW-C.mjs");
 				await runConnectCommand(root, parseConnectArgs([]));
 				return;
 			}
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-WO0JlPx8.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-FZx3Elvz.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "migrate": {
-				const { runMigrateCommand } = await import("../migrate-TsHGBnDA.mjs");
+				const { runMigrateCommand } = await import("../migrate-CYfbKkXh.mjs");
 				await runMigrateCommand(root);
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-DDz7c8LK.mjs");
+				const { runDeploy } = await import("../deploy-B19L2Bra.mjs");
 				await runDeploy(root);
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-router-BgEFRuvZ.mjs").then(({ runAuthRouter }) => runAuthRouter(r, p)));
-			case "account": return runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (r, p) => import("../account-cmd-DZZGK80W.mjs").then(({ runAccountCommand }) => runAccountCommand(r, p)));
-			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-C4ZV3Vpy.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
-			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-bSmZ1d5L.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-B44I8J_W.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-DN9sSNiV.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
-			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-Dpt0jd-x.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-DFi-s2t4.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-hRrvZaq_.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-router-ZUg9MF_U.mjs").then(({ runAuthRouter }) => runAuthRouter(r, p)));
+			case "account": return runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (r, p) => import("../account-cmd-CjyxcGkM.mjs").then(({ runAccountCommand }) => runAccountCommand(r, p)));
+			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-E0FuL212.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
+			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-BKlfGHAy.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-BZLCqOqw.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-BOtOl_cb.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-JRF59P_r.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-0-7PexDq.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
+			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-BxR5FROK.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-Bo6G9LOZ.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-gp2sCXyN.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-BYOrWQnv.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-CNJ62MM7.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-DyZ-Yok5.mjs");
+				const { runPrepareCommand } = await import("../prepare-C-6YZyyg.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}

package/dist/cli/env-schema-probe.d.mts

@@ -1,4 +1,4 @@
-import "../env-public-D_6u46fX.mjs";
+import "../env-public-BxU_0yTL.mjs";
 import "../types-CKWnYgfy.mjs";
 //#region src/cli/env-validation.d.ts
 /**

package/dist/{client-QTl6ko_D.mjs → client-BTZ3XkrB.mjs}

@@ -265,6 +265,31 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to list project tokens", res, "owner");
 		return res.json();
 	}
+	async getProjectZeroTrust(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to inspect project Zero Trust", res, "read");
+		return res.json();
+	}
+	async setProjectZeroTrust(projectId, protectedProject) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, {
+			method: "PUT",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ protected: protectedProject })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to update project Zero Trust", res, "settings");
+		return res.json();
+	}
+	async reconcileProjectZeroTrust(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust/reconcile`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to reconcile project Zero Trust", res, "settings");
+		return res.json();
+	}
 	async createProjectToken(projectId, input) {
 		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
 			method: "POST",

package/dist/client-Czz8o5jP.mjs

@@ -0,0 +1,2 @@
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+export { PlatformClient };

package/dist/{cloudflare-auth-C4_GPZr0.mjs → cloudflare-auth-DQkqoMYa.mjs}

@@ -1,4 +1,3 @@
-import { j as log } from "./dist-Dn6nn2IU.mjs";
 import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
 import { execFile, spawn, spawnSync } from "node:child_process";
 //#region src/cli/cloudflare-auth.ts
@@ -42,7 +41,6 @@ async function ensureCloudflareAuthentication(options) {
 	const existing = options.forceLogin ? null : await readSession();
 	if (existing) return existing;
 	if (!(options.interactive ?? (process.stdin.isTTY && process.stdout.isTTY))) throw new CloudflareAuthenticationError("Cloudflare authentication is required. Set CLOUDFLARE_API_TOKEN in CI, or run `void cloudflare login` in an interactive terminal.", "not-authenticated");
-	announceCloudflareLogin();
 	if (!isCleanExit(await run(["login"], false))) throw new CloudflareAuthenticationError("Cloudflare browser sign-in did not complete. Run `void cloudflare login` to try again.", "login");
 	const authenticated = await readSession();
 	if (!authenticated) throw new CloudflareAuthenticationError("Cloudflare sign-in completed without a usable session. Run `void cloudflare login` to try again.", "not-authenticated");
@@ -183,8 +181,5 @@ function cloudflareAuthEnvironment(source = process.env) {
 function isCleanExit(result) {
 	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
 }
-function announceCloudflareLogin() {
-	log.info("Opening Cloudflare login in your browser. Compare the code below with the browser prompt. Press Ctrl+C to cancel.");
-}
 //#endregion
-export { createBundledCloudflareAuthRunner as a, runCloudflareAuthCommand as c, cloudflareCredentialOverrides as i, announceCloudflareLogin as n, ensureCloudflareAuthentication as o, cloudflareAuthNeedsTerminal as r, parseCloudflareAuthSession as s, CloudflareAuthenticationError as t };
+export { ensureCloudflareAuthentication as a, createBundledCloudflareAuthRunner as i, cloudflareAuthNeedsTerminal as n, parseCloudflareAuthSession as o, cloudflareCredentialOverrides as r, runCloudflareAuthCommand as s, CloudflareAuthenticationError as t };

package/dist/{cloudflare-cmd-bSmZ1d5L.mjs → cloudflare-cmd-BKlfGHAy.mjs}

@@ -1,19 +1,18 @@
 import { t as basename } from "./dist-BVqXeR_h.mjs";
-import { v as readRootWranglerConfig } from "./wrangler-BymcxrRa.mjs";
-import { j as log } from "./dist-Dn6nn2IU.mjs";
-import { a as createBundledCloudflareAuthRunner, i as cloudflareCredentialOverrides, o as ensureCloudflareAuthentication, s as parseCloudflareAuthSession } from "./cloudflare-auth-C4_GPZr0.mjs";
+import { v as readRootWranglerConfig } from "./wrangler-DQF1vKyf.mjs";
+import { j as log } from "./dist-CTBk70IR.mjs";
+import { a as ensureCloudflareAuthentication, i as createBundledCloudflareAuthRunner, o as parseCloudflareAuthSession, r as cloudflareCredentialOverrides } from "./cloudflare-auth-DQkqoMYa.mjs";
 //#region src/cli/cloudflare-cmd.ts
 async function runCloudflareCommand(root, args) {
 	const runWrangler = createBundledCloudflareAuthRunner(root);
 	switch (args.subcommand) {
-		case "login": {
-			const session = await ensureCloudflareAuthentication({
+		case "login":
+			await ensureCloudflareAuthentication({
 				runWrangler,
 				forceLogin: true
 			});
-			log.success(formatSession(root, session));
+			console.log("Successfully logged in.");
 			return;
-		}
 		case "status": {
 			const result = await runWrangler(["whoami", "--json"], true);
 			const session = result.status === 0 && !result.signal && !result.error ? parseCloudflareAuthSession(result.stdout) : null;

package/dist/{cloudflare-connect-jAwacxxP.mjs → cloudflare-connect-Ctmrw579.mjs}

@@ -1,7 +1,7 @@
 import { a as join, t as basename } from "./dist-BVqXeR_h.mjs";
-import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler-BymcxrRa.mjs";
-import { I as select, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { a as createBundledCloudflareAuthRunner, o as ensureCloudflareAuthentication } from "./cloudflare-auth-C4_GPZr0.mjs";
+import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler-DQF1vKyf.mjs";
+import { I as select, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { a as ensureCloudflareAuthentication, i as createBundledCloudflareAuthRunner } from "./cloudflare-auth-DQkqoMYa.mjs";
 import { existsSync } from "node:fs";
 //#region src/cli/cloudflare-connect.ts
 async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY)) {