void 0.21.9 → 0.23.0

package/dist/cloudflare-config-Bktvwtpf.mjs

@@ -0,0 +1,182 @@
+import { a as join } from "./dist-BVqXeR_h.mjs";
+import "./project-paths-GgcMozYz.mjs";
+import { m as readConfig } from "./config-Br_JZD6u.mjs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { parse } from "jsonc-parser";
+import { isDeepStrictEqual } from "node:util";
+//#region src/cloudflare-config.ts
+const MATERIALIZED_CLOUDFLARE_FILE = ".void-wrangler.jsonc";
+const VOID_LOCK_FILE = "void.lock.json";
+const PREVIEW_POINTER_FILE = "preview-deploy-config.json";
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function arrayIdentity(value) {
+	if (isObject(value)) {
+		for (const key of [
+			"binding",
+			"name",
+			"tag",
+			"class_name",
+			"pattern",
+			"route"
+		]) if (typeof value[key] === "string") return `${key}:${value[key]}`;
+	}
+	return JSON.stringify(value) ?? String(value);
+}
+/** Keep authored values authoritative while retaining fields produced by Void. */
+function mergeConfig(previous, resolved, authored) {
+	if (isDeepStrictEqual(previous, authored)) return resolved;
+	if (Array.isArray(previous) && Array.isArray(resolved) && Array.isArray(authored)) {
+		const previousByIdentity = new Map(previous.map((item) => [arrayIdentity(item), item]));
+		const resolvedByIdentity = new Map(resolved.map((item) => [arrayIdentity(item), item]));
+		const authoredIdentities = new Set(authored.map(arrayIdentity));
+		return [...authored.map((item) => {
+			const identity = arrayIdentity(item);
+			return previousByIdentity.has(identity) && resolvedByIdentity.has(identity) ? mergeConfig(previousByIdentity.get(identity), resolvedByIdentity.get(identity), item) : item;
+		}), ...resolved.filter((item) => {
+			const identity = arrayIdentity(item);
+			return !previousByIdentity.has(identity) && !authoredIdentities.has(identity);
+		})];
+	}
+	if (isObject(previous) && isObject(resolved) && isObject(authored)) {
+		const result = {};
+		for (const key of /* @__PURE__ */ new Set([
+			...Object.keys(previous),
+			...Object.keys(resolved),
+			...Object.keys(authored)
+		])) {
+			if (!(key in authored)) {
+				if (!(key in previous) && key in resolved) Object.defineProperty(result, key, {
+					value: resolved[key],
+					enumerable: true,
+					writable: true,
+					configurable: true
+				});
+				continue;
+			}
+			const value = mergeConfig(previous[key], resolved[key], authored[key]);
+			Object.defineProperty(result, key, {
+				value,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+		}
+		return result;
+	}
+	return authored;
+}
+function parseCloudflareText(text, path) {
+	const errors = [];
+	const value = parse(text.replace(/^\uFEFF/, ""), errors, { allowTrailingComma: true });
+	if (errors.length > 0 || !isObject(value)) throw new Error(`config: ${path} must contain a valid JSON/JSONC object.`);
+	return value;
+}
+function readState(root) {
+	const path = join(root, VOID_LOCK_FILE);
+	if (!existsSync(path)) return;
+	let value;
+	try {
+		value = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new Error(`config: Invalid ${VOID_LOCK_FILE}. Fix or restore it before continuing.`);
+	}
+	if (!isObject(value) || value.version !== 1 || !isObject(value.source) || !isObject(value.resolved) || typeof value.text !== "string") throw new Error(`config: Invalid ${VOID_LOCK_FILE}. Fix or restore it before continuing.`);
+	const state = value;
+	if (!isDeepStrictEqual(parseCloudflareText(state.text, "void.lock.json"), state.resolved)) state.text = `${provenance(state.text)}${JSON.stringify(state.resolved, null, 2)}\n`;
+	return state;
+}
+function writeAtomic(path, content) {
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	writeFileSync(temporary, content, { flag: "wx" });
+	try {
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+}
+function writeState(root, state) {
+	const path = join(root, VOID_LOCK_FILE);
+	const content = `${JSON.stringify(state, null, 2)}\n`;
+	if (existsSync(path)) try {
+		if (isDeepStrictEqual(JSON.parse(readFileSync(path, "utf8")), state)) return;
+	} catch {}
+	writeAtomic(path, content);
+}
+/** Keep Vite preview usable without leaving Wrangler's implicit deploy pointer after a build. */
+function stashCloudflareDeployPointer(root) {
+	const pointer = join(root, ".wrangler", "deploy", "config.json");
+	if (!existsSync(pointer)) return;
+	const directory = join(root, ".void");
+	mkdirSync(directory, { recursive: true });
+	writeAtomic(join(directory, PREVIEW_POINTER_FILE), readFileSync(pointer, "utf8"));
+	rmSync(pointer, { force: true });
+}
+function restoreCloudflarePreviewPointer(root) {
+	const saved = join(root, ".void", PREVIEW_POINTER_FILE);
+	if (!existsSync(saved)) return false;
+	const directory = join(root, ".wrangler", "deploy");
+	mkdirSync(directory, { recursive: true });
+	writeAtomic(join(directory, "config.json"), readFileSync(saved, "utf8"));
+	return true;
+}
+/** Preserve Void's JSONC provenance comments when authored settings change. */
+function provenance(text) {
+	const lines = text.match(/^\s*\/\/ void:(?:managed-queues|published-traffic):v1:[A-Za-z0-9_-]+\s*$/gm);
+	return lines ? `${lines.join("\n")}\n` : "";
+}
+/** Resolve the config file passed to Cloudflare tooling. Typed projects use a generated file. */
+function materializeCloudflareConfig(root) {
+	if (!existsSync(join(root, "void.config.ts"))) {
+		for (const name of ["wrangler.jsonc", "wrangler.json"]) if (existsSync(join(root, name))) return join(root, name);
+		return join(root, "wrangler.jsonc");
+	}
+	if (["wrangler.jsonc", "wrangler.json"].some((name) => existsSync(join(root, name)))) throw new Error("config: Run `void migrate` to move the root Wrangler config into void.config.ts.");
+	const authored = readConfig(root).cloudflare ?? {};
+	const state = readState(root);
+	const resolved = state ? mergeConfig(state.source, state.resolved, authored) : authored;
+	const text = state && isDeepStrictEqual(resolved, state.resolved) && isDeepStrictEqual(authored, state.source) ? state.text : `${provenance(state?.text ?? "")}${JSON.stringify(resolved, null, 2)}\n`;
+	const path = join(root, MATERIALIZED_CLOUDFLARE_FILE);
+	if (!existsSync(path) || readFileSync(path, "utf8") !== text) writeAtomic(path, text);
+	if (state) writeState(root, {
+		version: 1,
+		source: authored,
+		resolved,
+		text
+	});
+	return path;
+}
+/** Record Cloudflare settings written by Void so later builds reproduce them. */
+function persistCloudflareConfig(root) {
+	if (!existsSync(join(root, "void.config.ts"))) return;
+	const path = join(root, MATERIALIZED_CLOUDFLARE_FILE);
+	if (!existsSync(path)) throw new Error(`config: Missing generated ${MATERIALIZED_CLOUDFLARE_FILE}.`);
+	const text = readFileSync(path, "utf8");
+	const resolved = parseCloudflareText(text, path);
+	const authored = readConfig(root).cloudflare ?? {};
+	if (readState(root) || !isDeepStrictEqual(resolved, authored) || text !== `${JSON.stringify(authored, null, 2)}\n`) writeState(root, {
+		version: 1,
+		source: authored,
+		resolved,
+		text
+	});
+}
+/** Seed the checked-in lock from a root Wrangler file during migration. */
+function seedCloudflareConfig(root, source, text) {
+	const existing = readState(root);
+	if (existing) {
+		if (isDeepStrictEqual(existing.source, source) && isDeepStrictEqual(existing.resolved, source)) return;
+		throw new Error(`migrate: ${VOID_LOCK_FILE} already exists with different settings. Resolve it before migrating.`);
+	}
+	if (!isDeepStrictEqual(parseCloudflareText(text, ".void-wrangler.jsonc"), source)) throw new Error("migrate: The Cloudflare config changed during migration. Retry.");
+	writeState(root, {
+		version: 1,
+		source,
+		resolved: source,
+		text
+	});
+}
+//#endregion
+export { restoreCloudflarePreviewPointer as a, persistCloudflareConfig as i, VOID_LOCK_FILE as n, seedCloudflareConfig as o, materializeCloudflareConfig as r, stashCloudflareDeployPointer as s, MATERIALIZED_CLOUDFLARE_FILE as t };

package/dist/{cloudflare-connect-jAwacxxP.mjs → cloudflare-connect-B8uPZ4nx.mjs}

@@ -1,7 +1,7 @@
 import { a as join, t as basename } from "./dist-BVqXeR_h.mjs";
-import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler-BymcxrRa.mjs";
-import { I as select, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { a as createBundledCloudflareAuthRunner, o as ensureCloudflareAuthentication } from "./cloudflare-auth-C4_GPZr0.mjs";
+import { A as writeProvisionedWranglerConfig, i as LATEST_KNOWN_COMPAT_DATE, y as readRootWranglerConfig } from "./wrangler-7K-bW_DL.mjs";
+import { I as select, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { i as ensureCloudflareAuthentication, r as createBundledCloudflareAuthRunner } from "./cloudflare-auth-Qdc7tw8F.mjs";
 import { existsSync } from "node:fs";
 //#region src/cli/cloudflare-connect.ts
 async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY)) {
@@ -24,7 +24,7 @@ async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY
 		interactive,
 		requireAccounts: true,
 		runWrangler: createBundledCloudflareAuthRunner(root),
-		whoamiArgs: existingConfigPath ? ["-c", existingConfigPath] : []
+		configPath: existingConfigPath
 	});
 	let account = accounts.find((entry) => entry.id === pinnedAccount);
 	if (pinnedAccount && !account) throw new Error(`connect: The signed-in Cloudflare session cannot access account ${pinnedAccount}.`);

package/dist/{cloudflare-operations-BipGMJ5O.mjs → cloudflare-operations-AiWashgg.mjs}

@@ -1,2 +1,2 @@
-import { _ as resolveCloudflareD1Context, b as tailCloudflareWorker, c as listCloudflareDomains, g as readCloudflareWorkerStatus, h as readCloudflareD1Migrations, l as listCloudflareSecrets, m as putCloudflareSecret, n as applyCloudflareD1Migrations, o as deleteCloudflareSecret, r as changeCloudflareDomain, s as executeCloudflareD1Sql, t as activateCloudflareExistingVersion, v as resolveCloudflareOperationContext, y as syncCloudflareSecrets } from "./cloudflare-operations-sMZXpk_S.mjs";
+import { _ as resolveCloudflareD1Context, b as tailCloudflareWorker, c as listCloudflareDomains, g as readCloudflareWorkerStatus, h as readCloudflareD1Migrations, l as listCloudflareSecrets, m as putCloudflareSecret, n as applyCloudflareD1Migrations, o as deleteCloudflareSecret, r as changeCloudflareDomain, s as executeCloudflareD1Sql, t as activateCloudflareExistingVersion, v as resolveCloudflareOperationContext, y as syncCloudflareSecrets } from "./cloudflare-operations-fxHb-byx.mjs";
 export { activateCloudflareExistingVersion, applyCloudflareD1Migrations, changeCloudflareDomain, deleteCloudflareSecret, executeCloudflareD1Sql, listCloudflareDomains, listCloudflareSecrets, putCloudflareSecret, readCloudflareD1Migrations, readCloudflareWorkerStatus, resolveCloudflareD1Context, resolveCloudflareOperationContext, syncCloudflareSecrets, tailCloudflareWorker };

package/dist/{cloudflare-operations-sMZXpk_S.mjs → cloudflare-operations-fxHb-byx.mjs}

@@ -1,11 +1,11 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { A as writeWranglerPublishedTrafficSnapshot, L as materializeCloudflareConfig, O as updateWranglerCustomDomain, R as persistCloudflareConfig, S as readWranglerPublishedTrafficSnapshot, b as readWranglerCustomDomains } from "./wrangler-BymcxrRa.mjs";
+import { i as persistCloudflareConfig, r as materializeCloudflareConfig } from "./cloudflare-config-Bktvwtpf.mjs";
+import { C as readWranglerPublishedTrafficSnapshot, j as writeWranglerPublishedTrafficSnapshot, k as updateWranglerCustomDomain, x as readWranglerCustomDomains } from "./wrangler-7K-bW_DL.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
-import { _ as resolvePinnedApiBaseUrl, g as provisionEnv, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware } from "./provision-BhreDAOS.mjs";
+import { t as createCloudflareProcessRunner } from "./cloudflare-process-B-wekeR6.mjs";
+import { _ as resolvePinnedApiBaseUrl, g as provisionEnv, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware } from "./provision-CJFgTZY8.mjs";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { spawnSync } from "node:child_process";
 import { deployCloudflareVersionTraffic, encodeCloudflareVersionMessage, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readWranglerTopLevelString, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 //#region src/cli/cloudflare-operations.ts
 function resolveCloudflareOperationContext(root, runner) {
@@ -28,13 +28,11 @@ function resolveCloudflareOperationContext(root, runner) {
 	};
 }
 async function listCloudflareSecrets(context) {
-	const parsed = parseJson((await run(context, [
-		"secret",
-		"list",
-		...targetArgs(context),
-		"--format",
-		"json"
-	])).stdout, "Cloudflare secret list");
+	const parsed = parseJson((await run(context, {
+		type: "secret.list",
+		configPath: context.configPath,
+		workerName: context.workerName
+	})).data, "Cloudflare secret list");
 	if (!Array.isArray(parsed)) throw new Error("Cloudflare secret list returned an unexpected response.");
 	return parsed.map((entry) => {
 		if (typeof entry !== "object" || entry === null) return null;
@@ -43,28 +41,28 @@ async function listCloudflareSecrets(context) {
 	}).filter((name) => name !== null).sort();
 }
 async function putCloudflareSecret(context, name, value) {
-	await run(context, [
-		"secret",
-		"put",
+	await run(context, {
+		type: "secret.put",
 		name,
-		...targetArgs(context)
-	], { input: value });
+		configPath: context.configPath,
+		workerName: context.workerName
+	}, { input: value });
 }
 async function syncCloudflareSecrets(context, secrets) {
 	const values = Object.fromEntries(secrets.map(({ name, value }) => [name, value]));
-	await run(context, [
-		"secret",
-		"bulk",
-		...targetArgs(context)
-	], { input: `${JSON.stringify(values)}\n` });
+	await run(context, {
+		type: "secret.bulk",
+		configPath: context.configPath,
+		workerName: context.workerName
+	}, { input: `${JSON.stringify(values)}\n` });
 }
 async function deleteCloudflareSecret(context, name) {
-	await run(context, [
-		"secret",
-		"delete",
+	await run(context, {
+		type: "secret.delete",
 		name,
-		...targetArgs(context)
-	]);
+		configPath: context.configPath,
+		workerName: context.workerName
+	});
 }
 function resolveCloudflareD1Context(root, binding, runner) {
 	const operation = resolveCloudflareOperationContext(root, runner);
@@ -84,18 +82,12 @@ function resolveCloudflareD1Context(root, binding, runner) {
 	};
 }
 async function executeCloudflareD1Sql(context, sql) {
-	const parsed = parseJson((await run(context.operation, [
-		"d1",
-		"execute",
-		context.migrateToken,
-		"--remote",
-		"--command",
+	const parsed = parseJson((await run(context.operation, {
+		type: "d1.execute",
+		database: context.migrateToken,
 		sql,
-		"--json",
-		"-c",
-		context.operation.configPath,
-		"--env="
-	])).stdout, "Cloudflare D1 execute");
+		configPath: context.operation.configPath
+	})).data, "Cloudflare D1 execute");
 	if (!Array.isArray(parsed)) throw new Error("Cloudflare D1 execute returned an unexpected response.");
 	const rows = [];
 	for (const item of parsed) {
@@ -116,46 +108,38 @@ async function readCloudflareD1Migrations(context) {
 	}
 }
 async function applyCloudflareD1Migrations(context) {
-	await run(context.operation, [
-		"d1",
-		"migrations",
-		"apply",
-		context.migrateToken,
-		"--remote",
-		"-c",
-		context.operation.configPath,
-		"--env="
-	], { capture: false });
+	await run(context.operation, {
+		type: "d1.migrations.apply",
+		database: context.migrateToken,
+		configPath: context.operation.configPath
+	}, { capture: false });
 }
 async function readCloudflareWorkerStatus(context) {
 	const [deployment, deployments, versions] = await Promise.all([
-		run(context, [
-			"deployments",
-			"status",
-			...targetArgs(context),
-			"--json"
-		]),
-		run(context, [
-			"deployments",
-			"list",
-			...targetArgs(context),
-			"--json"
-		]),
-		run(context, [
-			"versions",
-			"list",
-			...targetArgs(context),
-			"--json"
-		])
+		run(context, {
+			type: "deployments.status",
+			configPath: context.configPath,
+			workerName: context.workerName
+		}),
+		run(context, {
+			type: "deployments.list",
+			configPath: context.configPath,
+			workerName: context.workerName
+		}),
+		run(context, {
+			type: "versions.list",
+			configPath: context.configPath,
+			workerName: context.workerName
+		})
 	]);
-	const activeVersionId = parseActiveVersionId(deployment.stdout);
-	const deployedVersionIds = parseCloudflareDeployedVersionIds(deployments.stdout);
+	const activeVersionId = parseActiveVersionId(deployment.data);
+	const deployedVersionIds = parseCloudflareDeployedVersionIds(deployments.data);
 	if (activeVersionId && !deployedVersionIds.includes(activeVersionId)) deployedVersionIds.push(activeVersionId);
 	return {
 		workerName: context.workerName,
 		activeVersionId,
 		deployedVersionIds,
-		versions: parseCloudflareVersions(versions.stdout)
+		versions: parseCloudflareVersions(versions.data)
 	};
 }
 /** Return only versions that Cloudflare records as members of a production deployment. */
@@ -221,15 +205,16 @@ async function activateCloudflareExistingVersion(context, target, current) {
 	const expectedVersionId = current?.id ?? await readActiveCloudflareVersionId(context);
 	const ownerBeforeActivation = await readActiveCloudflareVersionId(context);
 	if (ownerBeforeActivation !== expectedVersionId) throw new Error(`Cloudflare production changed from ${expectedVersionId ?? "no active version"} to ${ownerBeforeActivation ?? "no active version"} before rollback activation. Retry from fresh deployment status.`);
-	await run(context, [
-		"versions",
-		"deploy",
-		`${target.id}@100`,
-		...targetArgs(context),
-		"--message",
-		message,
-		"--yes"
-	], { capture: false });
+	await run(context, {
+		type: "versions.deploy",
+		versions: [{
+			versionId: target.id,
+			percentage: 100
+		}],
+		configPath: context.configPath,
+		workerName: context.workerName,
+		message
+	}, { capture: false });
 	const knownTriggerConfigs = { [target.id]: targetTriggerConfig };
 	if (currentTriggerConfig && current) knownTriggerConfigs[current.id] = currentTriggerConfig;
 	const triggers = await stabilizeCloudflareVersionTriggers({
@@ -272,15 +257,16 @@ async function activateCloudflareExistingVersion(context, target, current) {
 	}
 	let recoveryFailure = null;
 	try {
-		await run(context, [
-			"versions",
-			"deploy",
-			`${current.id}@100`,
-			...targetArgs(context),
-			"--message",
-			`Void automatic rollback after trigger synchronization failed.`,
-			"--yes"
-		], { capture: false });
+		await run(context, {
+			type: "versions.deploy",
+			versions: [{
+				versionId: current.id,
+				percentage: 100
+			}],
+			configPath: context.configPath,
+			workerName: context.workerName,
+			message: `Void automatic rollback after trigger synchronization failed.`
+		}, { capture: false });
 		const restoredTriggers = await stabilizeCloudflareVersionTriggers({
 			runWrangler: context.runWrangler,
 			workerName: context.workerName,
@@ -305,27 +291,21 @@ async function activateCloudflareExistingVersion(context, target, current) {
 	throw new Error(recoveryFailure ? `Cloudflare trigger synchronization failed after activating ${target.id}, and automatic recovery also failed: ${recoveryFailure}` : `Cloudflare trigger synchronization failed after activating ${target.id}; traffic and triggers were restored to ${current.id}.`);
 }
 async function readActiveCloudflareVersionId(context) {
-	return parseActiveVersionId((await run(context, [
-		"deployments",
-		"status",
-		...targetArgs(context),
-		"--json"
-	])).stdout);
+	return parseActiveVersionId((await run(context, {
+		type: "deployments.status",
+		configPath: context.configPath,
+		workerName: context.workerName
+	})).data);
 }
 async function tailCloudflareWorker(context, options) {
-	const args = [
-		"tail",
-		context.workerName,
-		"-c",
-		context.configPath,
-		"--env=",
-		"--format",
-		"pretty"
-	];
-	if (options.filter) args.push("--search", options.filter);
-	if (options.versionId) args.push("--version-id", options.versionId);
-	if (options.status) args.push("--status", options.status);
-	await run(context, args, { capture: false });
+	await run(context, {
+		type: "tail",
+		workerName: context.workerName,
+		configPath: context.configPath,
+		search: options.filter,
+		versionId: options.versionId,
+		status: options.status
+	}, { capture: false });
 }
 function listCloudflareDomains(root) {
 	return readWranglerCustomDomains(root).domains;
@@ -336,11 +316,6 @@ async function changeCloudflareDomain(root, hostname, action, runner, emptyDomai
 	const original = readFileSync(before.configPath, "utf-8");
 	const update = updateWranglerCustomDomain(root, hostname, action);
 	if (!update.modified) return update;
-	if (update.domains.length === 0 && !emptyDomainPublisher && !resolveCloudflareApiToken()) {
-		writeFileSync(before.configPath, original);
-		persistCloudflareConfig(root);
-		throw new Error("Deleting the final Cloudflare custom domain requires CLOUDFLARE_API_TOKEN for the empty-domain API update. Export a scoped token with Workers Scripts: Edit permission and retry. No local or remote state changed.");
-	}
 	const triggerConfigDir = mkdtempSync(join(tmpdir(), "void-domain-triggers-"));
 	const triggerConfigPath = join(triggerConfigDir, "wrangler.json");
 	const deployRoutes = async () => {
@@ -349,15 +324,11 @@ async function changeCloudflareDomain(root, hostname, action, runner, emptyDomai
 			return;
 		}
 		writeDomainTriggerConfig(context, before.configPath, triggerConfigPath);
-		await run(context, [
-			"triggers",
-			"deploy",
-			"-c",
-			triggerConfigPath,
-			"--env=",
-			"--name",
-			context.workerName
-		], { capture: false });
+		await run(context, {
+			type: "triggers.deploy",
+			configPath: triggerConfigPath,
+			workerName: context.workerName
+		}, { capture: false });
 	};
 	try {
 		await deployRoutes();
@@ -385,37 +356,16 @@ async function changeCloudflareDomain(root, hostname, action, runner, emptyDomai
 	return update;
 }
 /**
-* Reconcile an empty Custom Domain set through the API Wrangler itself uses.
-* Wrangler 4.130 skips `publishCustomDomains()` when its configured set is
-* empty, so `triggers deploy` exits successfully without removing the final
-* domain. Direct API access is deliberately limited to an explicit API token;
-* OAuth credential storage is Wrangler-private and must not be scraped.
+* Publish an explicit empty Custom Domain set through the pinned cf transport.
+* Trigger deploy omits empty domain sets; this operation must reconcile them
+* explicitly using the same verified browser/API credentials as other commands.
 */
 async function publishEmptyCloudflareCustomDomainSet(context) {
-	const token = resolveCloudflareApiToken();
-	if (!token) throw new Error("CLOUDFLARE_API_TOKEN is required to restore an empty custom-domain set after the Cloudflare trigger update failed.");
-	const response = await fetch(`${context.apiBaseUrl}/accounts/${context.accountId}/workers/scripts/${context.workerName}/domains/records`, {
-		method: "PUT",
-		headers: {
-			Authorization: `Bearer ${token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({
-			override_scope: true,
-			override_existing_origin: false,
-			override_existing_dns_record: false,
-			origins: []
-		}),
-		redirect: "error",
-		signal: AbortSignal.timeout(3e4)
+	await run(context, {
+		type: "triggers.clear-domains",
+		configPath: context.configPath,
+		workerName: context.workerName
 	});
-	let body;
-	try {
-		body = await response.json();
-	} catch {
-		throw new Error(`Cloudflare returned HTTP ${response.status} with a non-JSON custom-domain response.`);
-	}
-	if (!response.ok || typeof body !== "object" || body === null || body.success !== true) throw new Error(`Cloudflare rejected the empty custom-domain set (HTTP ${response.status}).`);
 }
 /** Adapt the direct empty-domain API call to the deployment package's result contract. */
 function createCloudflareEmptyDomainPublisher(context) {
@@ -441,11 +391,11 @@ function createCloudflareEmptyDomainPublisher(context) {
 function createCloudflareEmptyCronPublisher(context) {
 	return async () => {
 		try {
-			return await run(context, [
-				"triggers",
-				"clear-crons",
-				...targetArgs(context)
-			]);
+			return await run(context, {
+				type: "triggers.clear-crons",
+				configPath: context.configPath,
+				workerName: context.workerName
+			});
 		} catch (error) {
 			return {
 				status: 1,
@@ -456,9 +406,6 @@ function createCloudflareEmptyCronPublisher(context) {
 		}
 	};
 }
-function resolveCloudflareApiToken() {
-	return process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN || void 0;
-}
 /**
 * Build a route-only Wrangler config for a domain update. `triggers deploy`
 * also reconciles cron, queue-consumer, and workflow triggers found in its
@@ -479,15 +426,6 @@ function writeDomainTriggerConfig(context, sourceConfigPath, triggerConfigPath)
 	if (compatibilityDate) config.compatibility_date = compatibilityDate;
 	writeFileSync(triggerConfigPath, `${JSON.stringify(config, null, 2)}\n`);
 }
-function targetArgs(context) {
-	return [
-		"-c",
-		context.configPath,
-		"--env=",
-		"--name",
-		context.workerName
-	];
-}
 async function run(context, args, options) {
 	const result = await Promise.resolve(context.runWrangler(args, {
 		capture: options?.capture ?? true,
@@ -495,44 +433,24 @@ async function run(context, args, options) {
 	}));
 	if (result.status !== 0 || result.signal != null || result.error !== void 0 && result.error !== null && result.error !== "") {
 		const detail = result.stderr.trim() || result.stdout.trim() || result.error || "unknown error";
-		throw new Error(`Cloudflare command failed (${args.slice(0, 2).join(" ")}, exit ${result.status}): ${detail}`);
+		throw new Error(`Cloudflare command failed (${args.type}, exit ${result.status}): ${detail}`);
 	}
 	return result;
 }
 function createCloudflareOperationRunner(root, accountId, apiBaseUrl) {
-	const [command, ...prefix] = resolveWranglerArgv(root);
-	return (args, options) => {
-		const env = provisionEnv({
-			accountId,
-			apiBaseUrl
-		});
-		deleteEnvVarCaseAware(env, "WRANGLER_CI_OVERRIDE_NAME");
-		if (!options.capture) env.WRANGLER_LOG = "none";
-		const result = spawnSync(command, [...prefix, ...args], {
-			cwd: root,
-			env,
-			shell: false,
-			windowsHide: true,
-			encoding: "utf-8",
-			input: options.input,
-			stdio: options.input !== void 0 ? [
-				"pipe",
-				options.capture ? "pipe" : "inherit",
-				options.capture ? "pipe" : "inherit"
-			] : options.capture ? [
-				"ignore",
-				"pipe",
-				"pipe"
-			] : "inherit"
-		});
-		return {
-			status: typeof result.status === "number" ? result.status : 1,
-			stdout: result.stdout ?? "",
-			stderr: result.stderr ?? "",
-			signal: result.signal ?? null,
-			error: result.error?.message ?? null
-		};
-	};
+	return createCloudflareProcessRunner({
+		root,
+		accountId,
+		apiBaseUrl,
+		env: () => {
+			const env = provisionEnv({
+				accountId,
+				apiBaseUrl
+			});
+			deleteEnvVarCaseAware(env, "WRANGLER_CI_OVERRIDE_NAME");
+			return env;
+		}
+	});
 }
 function discoverRootWranglerConfig(root) {
 	return materializeCloudflareConfig(root);
@@ -551,11 +469,8 @@ function assertNoOperationConfigOverride(root) {
 	}
 }
 function parseJson(value, label) {
-	try {
-		return JSON.parse(value);
-	} catch {
-		throw new Error(`${label} did not return valid JSON.`);
-	}
+	if (value === void 0) throw new Error(label + " did not return structured data.");
+	return value;
 }
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);