void 0.21.9 → 0.23.0

package/dist/cli/env-schema-probe.d.mts

@@ -1,5 +1,6 @@
-import "../env-public-D_6u46fX.mjs";
+import "../env-public-BX_r8HR6.mjs";
 import "../types-CKWnYgfy.mjs";
+import "@void/deploy-cloudflare";
 //#region src/cli/env-validation.d.ts
 /**
  * The stable, values-free classification of a self-host schema failure.

package/dist/cli/env-schema-probe.mjs

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 //#region src/cli/env-schema-probe.ts
 /**
-* The self-host `void deploy --backend cloudflare` orchestrator validates the REAL
+* The self-host `void deploy --platform cloudflare` orchestrator validates the REAL
 * build artifact (`dist/ssr/wrangler.json` `vars`) instead of predicting it. Two
 * pieces still need project code, and BOTH run here — in an ISOLATED SUBPROCESS —
 * because the orchestrator runs in a credential-bearing PARENT (CF Access service
@@ -169,7 +169,7 @@ function emitResult(result) {
 * facts. The import stays isolated because env.ts is arbitrary project code.
 */
 async function runFactsChild(root) {
-	const { deriveSelfHostSchemaFacts, SelfHostSchemaError } = await import("../env-validation-BXge7uyK.mjs");
+	const { deriveSelfHostSchemaFacts, SelfHostSchemaError } = await import("../env-validation-DbTg7-ar.mjs");
 	try {
 		emitResult({
 			kind: "ok",
@@ -194,7 +194,7 @@ async function runFactsChild(root) {
 * fault → fail closed as a values-free schema error.
 */
 async function runValidateEmittedChild(root) {
-	const { computeInvalidEmittedKeys, readEmittedWorkerVars, SelfHostSchemaError } = await import("../env-validation-BXge7uyK.mjs");
+	const { computeInvalidEmittedKeys, readEmittedWorkerVars, SelfHostSchemaError } = await import("../env-validation-DbTg7-ar.mjs");
 	const emitted = readEmittedWorkerVars(root);
 	if (!emitted.ok) {
 		emitResult({

package/dist/client-Cu7jWiF1.mjs

@@ -0,0 +1,2 @@
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+export { PlatformClient };

package/dist/{client-QTl6ko_D.mjs → client-RV8NVeB8.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { a as getApiUrl } from "./auth-DLNN0D3Z.mjs";
+import { a as getApiUrl } from "./auth-CSkdO2Bb.mjs";
 import { s as normalizePlatformApiUrl } from "./platform-registry-QBa4DK32.mjs";
 import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
@@ -152,10 +152,11 @@ function isPreflightRejection(error) {
 *   the server's precheck, the only atomic (project-locked) verdict: if
 *   an earlier attempt or a concurrent deploy is still in flight, the
 *   replay is rejected with 409 and surfaced as a deploy conflict
-*   naming the deployment id. A client-side GET-then-decide lookup can
-*   never be authoritative (the row can transition between lookup and
-*   replay), so no dedupe query is made — the residual case is the lost
-*   attempt completing within seconds and being redeployed identically.
+*   naming the deployment id. Receipt-aware platforms additionally bind
+*   the stable invocation key to the accepted artifact, so an accepted
+*   request can be recovered without creating another execution. Older
+*   platforms retain their concurrency guard. No client-side deployment
+*   lookup may authorize replay or identify an unrelated conflicting row.
 */
 const DEPLOY_POST_MAX_RETRIES = 3;
 const DEPLOY_POST_BACKOFF_MS = [
@@ -163,6 +164,24 @@ const DEPLOY_POST_BACKOFF_MS = [
 	5e3,
 	1e4
 ];
+const DEPLOY_OBSERVATION_TIMEOUT_MS = 3e4;
+const DEPLOY_OBSERVATION_DEADLINE_MS = 18e5;
+const DEPLOY_OBSERVATION_BACKOFF_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4
+];
+const DEPLOY_EVENT_MAX_BYTES = 1048576;
+var DeploymentProtocolError = class extends Error {};
+function parseDeployEvent(value) {
+	if (!value || typeof value !== "object" || !("event" in value) || typeof value.event !== "string") throw new DeploymentProtocolError("Invalid deployment event from platform.");
+	const event = value;
+	if (event.seq !== void 0 && (!Number.isSafeInteger(event.seq) || event.seq < 1)) throw new DeploymentProtocolError("Invalid deployment event sequence from platform.");
+	if (event.event === "start" && typeof event.deploymentId !== "string" || event.event === "done" && (typeof event.deployment !== "string" || typeof event.url !== "string" || !Array.isArray(event.urls) || !event.urls.every((url) => typeof url === "string") || !Number.isSafeInteger(event.assets) || event.assets < 0 || !Number.isSafeInteger(event.workers) || event.workers < 0 || event.published !== void 0 && typeof event.published !== "boolean") || event.event === "error" && (typeof event.message !== "string" || typeof event.step !== "string")) throw new DeploymentProtocolError("Invalid deployment result from platform.");
+	return event;
+}
 /**
 * HTTP client for the Void platform API.
 */
@@ -237,10 +256,10 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to list projects", res);
 		return res.json();
 	}
-	/** A lightweight project list for interactive linking; older platforms use the full list. */
+	/** A lightweight project list for interactive linking. */
 	async listProjectChoices() {
 		const res = await this.request(`${this.baseUrl}/projects/choices`, { headers: { ...this.authHeaders } });
-		if (res.status === 404) return this.listProjects();
+		if (res.status === 404) throw new Error("This platform does not support project lookup. Ask its administrator to upgrade the platform runtime.");
 		if (!res.ok) await throwPlatformApiError("Failed to list project choices", res);
 		return res.json();
 	}
@@ -251,12 +270,12 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to get project", res);
 		return res.json();
 	}
-	/** New platforms resolve a slug directly; older installations retain the list fallback. */
+	/** Resolve a slug through the current platform contract. */
 	async findProjectBySlug(slug) {
 		const url = new URL(`${this.baseUrl}/projects/resolve`);
 		url.searchParams.set("slug", slug);
 		const res = await this.request(url.toString(), { headers: { ...this.authHeaders } });
-		if (res.status === 404) return (await this.listProjects()).find((project) => project.slug === slug) ?? null;
+		if (res.status === 404) throw new Error("This platform does not support project lookup. Ask its administrator to upgrade the platform runtime.");
 		if (!res.ok) await throwPlatformApiError("Failed to resolve project", res);
 		return (await res.json()).project;
 	}
@@ -265,6 +284,31 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to list project tokens", res, "owner");
 		return res.json();
 	}
+	async getProjectZeroTrust(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to inspect project Zero Trust", res, "read");
+		return res.json();
+	}
+	async setProjectZeroTrust(projectId, protectedProject) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, {
+			method: "PUT",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ protected: protectedProject })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to update project Zero Trust", res, "settings");
+		return res.json();
+	}
+	async reconcileProjectZeroTrust(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust/reconcile`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to reconcile project Zero Trust", res, "settings");
+		return res.json();
+	}
 	async createProjectToken(projectId, input) {
 		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
 			method: "POST",
@@ -481,7 +525,8 @@ var PlatformClient = class {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
-				...this.authHeaders
+				...this.authHeaders,
+				"x-void-deploy-idempotency-key": crypto.randomUUID()
 			},
 			body: JSON.stringify(payload)
 		});
@@ -543,6 +588,24 @@ var PlatformClient = class {
 			}
 			throw new PlatformApiError("Deploy failed", res.status, body, isCloudflareAccessChallenge(res) ? void 0 : "deploy");
 		}
+		const receipt = res.headers.get("x-void-deployment-id");
+		if (receipt !== null && !/^[A-Za-z0-9_-]{1,128}$/.test(receipt)) {
+			res.body?.cancel().catch(() => {});
+			throw new Error("Invalid deployment receipt from platform.");
+		}
+		let cursor = 0;
+		let terminal = false;
+		if (!res.body) {
+			if (receipt) {
+				yield {
+					event: "start",
+					deploymentId: receipt
+				};
+				yield* this.followDeploymentEvents(projectId, receipt, cursor);
+				return;
+			}
+			throw new Error("Platform returned no deployment event stream.");
+		}
 		const reader = res.body.getReader();
 		const decoder = new TextDecoder();
 		let buffer = "";
@@ -551,10 +614,49 @@ var PlatformClient = class {
 		const startedAt = Date.now();
 		let eventCount = 0;
 		let lastEventName = "<none>";
+		let streamFinished = false;
+		let readTimer;
+		const read = async () => {
+			if (!receipt) return reader.read();
+			try {
+				return await Promise.race([reader.read(), new Promise((_, reject) => {
+					readTimer = setTimeout(() => reject(/* @__PURE__ */ new TypeError("Deployment event stream timed out.")), DEPLOY_OBSERVATION_TIMEOUT_MS);
+				})]);
+			} finally {
+				clearTimeout(readTimer);
+			}
+		};
+		const parseLine = (line) => {
+			if (Buffer.byteLength(line) > DEPLOY_EVENT_MAX_BYTES) throw new DeploymentProtocolError("Deployment event exceeds the platform response limit.");
+			if (!line.trim()) return null;
+			const event = parseDeployEvent(JSON.parse(line));
+			if (event.seq !== void 0) {
+				if (event.seq <= cursor) return null;
+				cursor = event.seq;
+			}
+			eventCount++;
+			lastEventName = event.event;
+			cliLog?.info("deploy_event", {
+				eventCount,
+				event: lastEventName,
+				raw: line.slice(0, 200)
+			});
+			if (receipt && event.event === "start") return null;
+			terminal = event.event === "done" || event.event === "error";
+			return event;
+		};
 		try {
+			if (receipt) yield {
+				event: "start",
+				deploymentId: receipt
+			};
 			while (true) {
-				const { done, value } = await reader.read();
+				const { done, value } = await read();
 				if (done) {
+					streamFinished = true;
+					buffer += decoder.decode();
+					const event = parseLine(buffer);
+					if (event) yield event;
 					cliLog?.info("deploy_stream_eof", {
 						bytesRead,
 						eventCount,
@@ -572,18 +674,13 @@ var PlatformClient = class {
 				while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
 					const line = buffer.slice(0, newlineIdx);
 					buffer = buffer.slice(newlineIdx + 1);
-					if (line.trim()) {
-						const event = JSON.parse(line);
-						eventCount++;
-						lastEventName = event.event ?? "<no-event-field>";
-						cliLog?.info("deploy_event", {
-							eventCount,
-							event: lastEventName,
-							raw: line.slice(0, 200)
-						});
+					const event = parseLine(line);
+					if (event) {
 						yield event;
+						if (terminal) return;
 					}
 				}
+				if (Buffer.byteLength(buffer) > DEPLOY_EVENT_MAX_BYTES) throw new DeploymentProtocolError("Deployment event exceeds the platform response limit.");
 			}
 		} catch (err) {
 			cliLog?.error("deploy_stream_error", err, {
@@ -591,8 +688,55 @@ var PlatformClient = class {
 				eventCount,
 				lastEvent: lastEventName
 			});
-			throw err;
+			if (!receipt || err instanceof DeploymentProtocolError || err instanceof SyntaxError || err instanceof DOMException && err.name === "AbortError") throw err;
+		} finally {
+			clearTimeout(readTimer);
+			if (!streamFinished) reader.cancel().catch(() => {});
+			reader.releaseLock();
+		}
+		if (receipt && !terminal) yield* this.followDeploymentEvents(projectId, receipt, cursor);
+	}
+	async *followDeploymentEvents(projectId, deploymentId, since) {
+		let cursor = since;
+		let failures = 0;
+		const deadline = Date.now() + DEPLOY_OBSERVATION_DEADLINE_MS;
+		while (Date.now() < deadline) {
+			const url = `${this.baseUrl}/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/events?since=${cursor}`;
+			let page;
+			try {
+				const response = await this.request(url, {
+					headers: { ...this.authHeaders },
+					signal: AbortSignal.timeout(DEPLOY_OBSERVATION_TIMEOUT_MS)
+				});
+				if (!response.ok) await throwPlatformApiError("Failed to observe deployment", response, "read");
+				page = await response.json();
+			} catch (err) {
+				if (!(err instanceof TypeError || err instanceof DOMException && err.name === "TimeoutError" || err instanceof PlatformApiError && (err.status === 429 || err.status >= 500)) || failures >= DEPLOY_OBSERVATION_BACKOFF_MS.length) throw err;
+				const delayMs = DEPLOY_OBSERVATION_BACKOFF_MS[failures++];
+				this.cliLog?.warn("deploy_observation_retry", {
+					deploymentId,
+					cursor,
+					delayMs
+				});
+				await sleep(delayMs);
+				continue;
+			}
+			failures = 0;
+			if (!page || page.deploymentId !== deploymentId || !Array.isArray(page.events) || page.events.length > 1e3 || !Number.isSafeInteger(page.lastSeq) || page.lastSeq < cursor || typeof page.terminal !== "boolean") throw new Error("Invalid deployment observation response from platform.");
+			let previousSeq = 0;
+			for (const row of page.events) {
+				if (!row || !Number.isSafeInteger(row.seq) || row.seq <= previousSeq || row.seq > page.lastSeq) throw new Error("Invalid deployment observation sequence from platform.");
+				previousSeq = row.seq;
+				const event = parseDeployEvent(row.event);
+				if (row.seq <= cursor) continue;
+				cursor = row.seq;
+				if (event.event !== "start") yield event;
+				if (event.event === "done" || event.event === "error") return;
+			}
+			if (page.terminal) throw new Error("Platform finished deployment without a terminal result.");
+			await sleep(1e3);
 		}
+		throw new Error(`Timed out observing deployment ${deploymentId}. Inspect with \`void project status\`.`);
 	}
 	async listSecrets(projectId) {
 		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets`, { headers: { ...this.authHeaders } });

package/dist/{cloudflare-auth-C4_GPZr0.mjs → cloudflare-auth-Qdc7tw8F.mjs}

@@ -1,5 +1,4 @@
-import { j as log } from "./dist-Dn6nn2IU.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
+import { c as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-B-wekeR6.mjs";
 import { execFile, spawn, spawnSync } from "node:child_process";
 //#region src/cli/cloudflare-auth.ts
 var CloudflareAuthenticationError = class extends Error {
@@ -23,27 +22,25 @@ async function ensureCloudflareAuthentication(options) {
 		if (overrides.length > 0) throw new CloudflareAuthenticationError(`Cloudflare browser login cannot replace credentials supplied by ${overrides.join(", ")}. Remove these overrides from this shell and rerun \`void cloudflare login\`.`, "environment-credentials");
 	}
 	if (options.acceptApiToken && !options.requireAccounts && (process.env.CLOUDFLARE_API_TOKEN?.trim() || process.env.CF_API_TOKEN?.trim())) return { accounts: [] };
-	const run = async (args, capture) => {
+	const run = async (operation, capture) => {
 		if (options.beforeRun && !options.beforeRun()) throw new CloudflareAuthenticationError("", "uploader-changed");
-		return await options.runWrangler(args, capture);
+		return await options.runWrangler(operation, capture);
+	};
+	const whoami = {
+		type: "auth.whoami",
+		...options.configPath ? { configPath: options.configPath } : {}
 	};
-	const whoamiArgs = [
-		"whoami",
-		"--json",
-		...options.whoamiArgs ?? []
-	];
 	const readSession = async () => {
-		const result = await run(whoamiArgs, true);
+		const result = await run(whoami, true);
 		if (!isCleanExit(result)) return null;
-		const session = parseCloudflareAuthSession(result.stdout);
+		const session = parseCloudflareAuthSession(result.data);
 		if (options.requireAccounts) return session && session.accounts.length > 0 ? session : null;
-		return session ?? (options.forceLogin ? null : { accounts: [] });
+		return session;
 	};
 	const existing = options.forceLogin ? null : await readSession();
 	if (existing) return existing;
 	if (!(options.interactive ?? (process.stdin.isTTY && process.stdout.isTTY))) throw new CloudflareAuthenticationError("Cloudflare authentication is required. Set CLOUDFLARE_API_TOKEN in CI, or run `void cloudflare login` in an interactive terminal.", "not-authenticated");
-	announceCloudflareLogin();
-	if (!isCleanExit(await run(["login"], false))) throw new CloudflareAuthenticationError("Cloudflare browser sign-in did not complete. Run `void cloudflare login` to try again.", "login");
+	if (!isCleanExit(await run({ type: "auth.login" }, false))) throw new CloudflareAuthenticationError("Cloudflare browser sign-in did not complete. Run `void cloudflare login` to try again.", "login");
 	const authenticated = await readSession();
 	if (!authenticated) throw new CloudflareAuthenticationError("Cloudflare sign-in completed without a usable session. Run `void cloudflare login` to try again.", "not-authenticated");
 	return authenticated;
@@ -55,13 +52,7 @@ function cloudflareCredentialOverrides(source = process.env) {
 	const email = ["CLOUDFLARE_EMAIL", "CF_EMAIL"].find((key) => Boolean(source[key]));
 	return [...tokens, ...key && email ? [key, email] : []];
 }
-function parseCloudflareAuthSession(stdout) {
-	let value;
-	try {
-		value = JSON.parse(stdout.trim());
-	} catch {
-		return null;
-	}
+function parseCloudflareAuthSession(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	const record = value;
 	if (record.loggedIn !== true || !Array.isArray(record.accounts)) return null;
@@ -82,39 +73,49 @@ function parseCloudflareAuthSession(stdout) {
 	};
 }
 function createBundledCloudflareAuthRunner(root) {
-	const [command, ...prefix] = resolveWranglerArgv(root);
-	return (args, capture) => {
-		const env = cloudflareAuthCommandEnvironment(args);
+	const [command, ...prefix] = resolveCloudflareOperationArgv(root);
+	return (operation, capture) => {
+		const args = encodeCloudflareOperation(operation);
+		const env = cloudflareAuthCommandEnvironment(operation);
+		const streaming = cloudflareAuthNeedsTerminal(operation);
 		const result = spawnSync(command, [...prefix, ...args], {
 			cwd: root,
 			encoding: "utf8",
 			env,
 			maxBuffer: 10485760,
 			shell: false,
-			stdio: cloudflareAuthNeedsTerminal(args) ? "inherit" : capture ? [
+			stdio: streaming ? "inherit" : [
 				"ignore",
 				"pipe",
 				"pipe"
-			] : "inherit",
+			],
 			timeout: 6e5,
 			windowsHide: true
 		});
-		return {
+		const raw = {
 			status: result.status,
-			stderr: capture ? result.stderr || "" : "",
-			stdout: capture ? result.stdout || "" : "",
+			stderr: streaming ? "" : result.stderr || "",
+			stdout: streaming ? "" : result.stdout || "",
 			signal: result.signal,
 			error: result.error?.message
 		};
+		if (streaming) return raw;
+		const decoded = decodeCloudflareOperationResult(raw);
+		if (!capture) {
+			if (decoded.stdout) process.stdout.write(decoded.stdout);
+			if (decoded.stderr) process.stderr.write(decoded.stderr);
+		}
+		return decoded;
 	};
 }
 /** Run a captured auth command without blocking terminal input or exposing credentials. */
-function runCloudflareAuthCommand(root, args, signal) {
-	const [command, ...prefix] = resolveWranglerArgv(root);
-	if (cloudflareAuthNeedsTerminal(args)) return new Promise((resolve) => {
+function runCloudflareAuthCommand(root, operation, signal) {
+	const [command, ...prefix] = resolveCloudflareOperationArgv(root);
+	const args = encodeCloudflareOperation(operation);
+	if (cloudflareAuthNeedsTerminal(operation)) return new Promise((resolve) => {
 		const child = spawn(command, [...prefix, ...args], {
 			cwd: root,
-			env: cloudflareAuthCommandEnvironment(args),
+			env: cloudflareAuthCommandEnvironment(operation),
 			shell: false,
 			signal,
 			stdio: "inherit",
@@ -142,29 +143,29 @@ function runCloudflareAuthCommand(root, args, signal) {
 		execFile(command, [...prefix, ...args], {
 			cwd: root,
 			encoding: "utf8",
-			env: cloudflareAuthCommandEnvironment(args),
+			env: cloudflareAuthCommandEnvironment(operation),
 			maxBuffer: 10485760,
 			shell: false,
 			signal,
 			timeout: 6e5,
 			windowsHide: true
 		}, (error, stdout, stderr) => {
-			resolve({
+			resolve(decodeCloudflareOperationResult({
 				status: error ? typeof error.code === "number" ? error.code : null : 0,
 				stderr,
 				stdout,
 				signal: error?.signal,
 				error: error?.message
-			});
+			}));
 		}).stdin?.end();
 	});
 }
-function cloudflareAuthCommandEnvironment(args, source = process.env) {
+function cloudflareAuthCommandEnvironment(operation, source = process.env) {
 	return cloudflareAuthEnvironment(source);
 }
 /** Browser login must display cf's prompts before it completes. */
-function cloudflareAuthNeedsTerminal(args) {
-	return args[0] === "login";
+function cloudflareAuthNeedsTerminal(operation) {
+	return operation.type === "auth.login";
 }
 function cloudflareAuthEnvironment(source = process.env) {
 	const env = { ...source };
@@ -183,8 +184,5 @@ function cloudflareAuthEnvironment(source = process.env) {
 function isCleanExit(result) {
 	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
 }
-function announceCloudflareLogin() {
-	log.info("Opening Cloudflare login in your browser. Compare the code below with the browser prompt. Press Ctrl+C to cancel.");
-}
 //#endregion
-export { createBundledCloudflareAuthRunner as a, runCloudflareAuthCommand as c, cloudflareCredentialOverrides as i, announceCloudflareLogin as n, ensureCloudflareAuthentication as o, cloudflareAuthNeedsTerminal as r, parseCloudflareAuthSession as s, CloudflareAuthenticationError as t };
+export { parseCloudflareAuthSession as a, ensureCloudflareAuthentication as i, cloudflareCredentialOverrides as n, runCloudflareAuthCommand as o, createBundledCloudflareAuthRunner as r, CloudflareAuthenticationError as t };

package/dist/{cloudflare-cmd-bSmZ1d5L.mjs → cloudflare-cmd-BcrVyTmJ.mjs}

@@ -1,28 +1,27 @@
 import { t as basename } from "./dist-BVqXeR_h.mjs";
-import { v as readRootWranglerConfig } from "./wrangler-BymcxrRa.mjs";
-import { j as log } from "./dist-Dn6nn2IU.mjs";
-import { a as createBundledCloudflareAuthRunner, i as cloudflareCredentialOverrides, o as ensureCloudflareAuthentication, s as parseCloudflareAuthSession } from "./cloudflare-auth-C4_GPZr0.mjs";
+import { y as readRootWranglerConfig } from "./wrangler-7K-bW_DL.mjs";
+import { j as log } from "./dist-CTBk70IR.mjs";
+import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, r as createBundledCloudflareAuthRunner } from "./cloudflare-auth-Qdc7tw8F.mjs";
 //#region src/cli/cloudflare-cmd.ts
 async function runCloudflareCommand(root, args) {
 	const runWrangler = createBundledCloudflareAuthRunner(root);
 	switch (args.subcommand) {
-		case "login": {
-			const session = await ensureCloudflareAuthentication({
+		case "login":
+			await ensureCloudflareAuthentication({
 				runWrangler,
 				forceLogin: true
 			});
-			log.success(formatSession(root, session));
+			console.log("Successfully logged in.");
 			return;
-		}
 		case "status": {
-			const result = await runWrangler(["whoami", "--json"], true);
-			const session = result.status === 0 && !result.signal && !result.error ? parseCloudflareAuthSession(result.stdout) : null;
+			const result = await runWrangler({ type: "auth.whoami" }, true);
+			const session = result.status === 0 && !result.signal && !result.error ? parseCloudflareAuthSession(result.data) : null;
 			if (!session) throw new Error("Not signed in to Cloudflare. Run `void cloudflare login`.");
 			log.info(formatSession(root, session));
 			return;
 		}
 		case "logout": {
-			if ((await runWrangler(["logout"], true)).status !== 0) throw new Error("Could not remove the local Cloudflare browser session.");
+			if ((await runWrangler({ type: "auth.logout" }, true)).status !== 0) throw new Error("Could not remove the local Cloudflare browser session.");
 			const overrides = cloudflareCredentialOverrides();
 			if (overrides.length > 0) log.warn(`Removed the local Cloudflare browser session. Environment credentials remain active: ${overrides.join(", ")}.`);
 			else log.success("Signed out of Cloudflare.");