void 0.10.1 → 0.10.3

package/dist/{deploy-Cwa5sooV.mjs → deploy-DpOdwtla.mjs}

@@ -3,7 +3,8 @@ import { a as join, c as resolve, i as isAbsolute, n as dirname, r as extname, s
 import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { t as findVoidAuthConfig } from "./config-hhMYPVRT.mjs";
-import { a as isExpiredTokenError, d as getToken, f as getTokenSource, i as isCliOutdatedError, n as PlatformClient, o as parsePlatformErrorBody, p as isStagingMode, t as PlatformApiError } from "./client-D4awzTnj.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DKDsgwOU.mjs";
+import { a as isExpiredTokenError, f as getToken, i as isCliOutdatedError, m as isStagingMode, n as PlatformClient, o as parsePlatformErrorBody, p as getTokenSource, t as PlatformApiError, u as getApiUrl, y as ensureCloudflaredToken } from "./client-YIzxv2ZO.mjs";
 import { c as R, g as ge, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
@@ -19,11 +20,11 @@ import { n as buildMigrationPlanBundle } from "./plan-aD3wRDqF.mjs";
 import { r as validateMigrations, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
 import { t as scanPages } from "./scan-VCAM1oh3.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-M3pxItg2.mjs";
-import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
+import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-pLQdzEPe.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-Ce0AtSZL.mjs";
 import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BNWymgnH.mjs";
-import { t as promptForLoginToken } from "./login-Ca6mhQVI.mjs";
+import { t as promptForLoginToken } from "./login-B3l_sDwT.mjs";
 import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-B7ZQZn0u.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -1168,6 +1169,129 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
+//#region src/cli/github-oidc.ts
+/**
+* GitHub Actions OIDC → Void deploy-token exchange.
+*
+* When `void deploy` runs inside GitHub Actions with no explicit `VOID_TOKEN`,
+* the CLI mints a short-lived GitHub OIDC token (audience `void`) and exchanges
+* it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped
+* Void deploy token. Doing the exchange in-process lets the scaffolded workflow
+* collapse to a single `void deploy` step — no curl/jq token-exchange step.
+*
+* Server contract (platform `POST /auth/github-oidc` handler):
+*   request  { oidcToken: string, project: string }   (project = slug)
+*   response { token: string, projectId, buildId }
+*/
+const OIDC_AUDIENCE = "void";
+/**
+* True when the process is running inside GitHub Actions with the OIDC token
+* request endpoint available — i.e. the workflow granted
+* `permissions: id-token: write`, so GitHub injected the request URL + token.
+*/
+function isGithubActionsOidcAvailable(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" && typeof env.ACTIONS_ID_TOKEN_REQUEST_URL === "string" && env.ACTIONS_ID_TOKEN_REQUEST_URL.length > 0 && typeof env.ACTIONS_ID_TOKEN_REQUEST_TOKEN === "string" && env.ACTIONS_ID_TOKEN_REQUEST_TOKEN.length > 0;
+}
+/**
+* Mint a GitHub Actions OIDC token (audience `void`) and exchange it for a
+* short-lived, project-scoped Void deploy token.
+*
+* Two hops:
+*   1. GET  $ACTIONS_ID_TOKEN_REQUEST_URL&audience=void  (Bearer request token)
+*        → `.value` is the OIDC JWT.
+*   2. POST $apiUrl/auth/github-oidc  { oidcToken, project }
+*        → `.token` is the Void deploy token.
+*
+* Throws a clear, actionable error (including the HTTP status and server error
+* body when available) on any non-OK response or missing field.
+*/
+async function exchangeGithubOidcForDeployToken(apiUrl, project, env = process.env) {
+	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	if (!requestUrl || !requestToken) throw new Error("github-oidc: GitHub Actions OIDC is unavailable (missing ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN). Ensure the workflow grants `permissions: id-token: write`.");
+	return exchangeOidcTokenAtApi(apiUrl, project, await requestGithubOidcToken(requestUrl, requestToken));
+}
+/**
+* GET the GitHub Actions OIDC token for audience `void`. GitHub's request URL
+* already carries a query string, so `audience` is appended alongside it.
+*/
+async function requestGithubOidcToken(requestUrl, requestToken) {
+	const url = new URL(requestUrl);
+	url.searchParams.set("audience", OIDC_AUDIENCE);
+	let res;
+	try {
+		res = await fetch(url, { headers: { Authorization: `Bearer ${requestToken}` } });
+	} catch (err) {
+		throw new Error(`github-oidc: Failed to reach the GitHub OIDC token endpoint: ${errText(err)}`);
+	}
+	if (!res.ok) {
+		const body = await safeText(res);
+		throw new Error(`github-oidc: Failed to mint a GitHub OIDC token (${res.status})${body ? `: ${body}` : ""}.`);
+	}
+	let body;
+	try {
+		body = await res.json();
+	} catch {
+		throw new Error("github-oidc: GitHub OIDC token endpoint returned an invalid response.");
+	}
+	const value = body?.value;
+	if (typeof value !== "string" || value.length === 0) throw new Error("github-oidc: GitHub OIDC token endpoint did not return a token value.");
+	return value;
+}
+/** POST the OIDC JWT to the Void API and return the minted deploy token. */
+async function exchangeOidcTokenAtApi(apiUrl, project, oidcToken) {
+	const url = `${apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl}/auth/github-oidc`;
+	ensureCloudflaredToken(apiUrl);
+	let res;
+	try {
+		res = await fetch(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...cfAccessHeaders(process.env)
+			},
+			body: JSON.stringify({
+				oidcToken,
+				project
+			})
+		});
+	} catch (err) {
+		throw new Error(`github-oidc: Failed to reach ${url}: ${errText(err)}`);
+	}
+	if (!res.ok) {
+		const body = await safeText(res);
+		throw new Error(`github-oidc: OIDC token exchange failed (${res.status})${body ? `: ${body}` : ""}. Confirm the repository is connected to project "${project}" with the github_actions executor.`);
+	}
+	let body;
+	try {
+		body = await res.json();
+	} catch {
+		throw new Error("github-oidc: OIDC token exchange returned an invalid response.");
+	}
+	const token = body?.token;
+	if (typeof token !== "string" || token.length === 0) throw new Error("github-oidc: OIDC token exchange did not return a deploy token.");
+	return token;
+}
+/**
+* Emit a GitHub Actions `::add-mask::` workflow command so `value` is redacted
+* from workflow logs. No-op when not running inside GitHub Actions. GitHub reads
+* workflow commands from stdout.
+*/
+function maskGithubActionsSecret(value, env = process.env) {
+	if (env.GITHUB_ACTIONS !== "true" || !value) return;
+	process.stdout.write(`::add-mask::${value}\n`);
+}
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function safeText(res) {
+	try {
+		return (await res.text()).trim();
+	} catch {
+		return "";
+	}
+}
+//#endregion
 //#region src/cli/log-file.ts
 /**
 * Walk `err.cause` up to 6 levels and return a plain JSON-friendly chain.
@@ -2377,7 +2501,17 @@ function buildEnv(extra) {
 async function runDeployInner(root, options, cliLog) {
 	let reauthenticated = false;
 	while (true) try {
-		const token = getToken(root);
+		let token = process.env.VOID_TOKEN ?? null;
+		if (!token && isGithubActionsOidcAvailable()) {
+			const slug = getRequestedProjectSlug(options) ?? readProjectConfig(root)?.slug;
+			if (!slug) throw new Error("deploy: running in GitHub Actions but the project is unknown — pass --project <slug> or link the project.");
+			cliLog.info("github_oidc_exchange_start", { slug });
+			token = await exchangeGithubOidcForDeployToken(getApiUrl(root), slug);
+			maskGithubActionsSecret(token);
+			process.env.VOID_TOKEN = token;
+			cliLog.info("github_oidc_exchange_success", { slug });
+		}
+		token ??= getToken(root);
 		if (!token) {
 			R.error("No auth token found. Run `void auth login` first.");
 			process.exit(1);

package/dist/{domain-WvoAHE6w.mjs → domain-CkowysQx.mjs}

@@ -1,5 +1,5 @@
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { c as R, u as Se } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/domain.ts

package/dist/{env-Cx4czPsR.mjs → env-CIwG2y7G.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { c as R, g as ge, u as Se, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CaJaIRXU.mjs";

package/dist/{env-helpers-ZatKyjen.d.mts → env-helpers-B_ks681T.d.mts}

@@ -1,4 +1,4 @@
-import { t as StandardSchemaV1 } from "./standard-schema-BCBv-QaP.mjs";
+import { t as StandardSchemaV1 } from "./standard-schema-Cy0lfeWv.mjs";
 
 //#region src/shared/env-mask.d.ts
 /** Per-key override set by `.secret()` / `.public()` on built-in helpers. */

package/dist/{gen-Dgi4D7GC.mjs → gen-q6McxXgE.mjs}

@@ -7,7 +7,7 @@ import { c as getDatabaseDialect, f as readConfig } from "./config-8dLIngKW.mjs"
 import { n as writeDrizzleConfig } from "./config--wXmVOoe.mjs";
 import { r as readJournal, t as collectMigrations } from "./collect-9rO3JFNM.mjs";
 import { n as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
-import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DhCHHLAz.mjs";
+import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-WLW2IHUY.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";

package/dist/{github-cmd-CUB041gj.mjs → github-cmd-D3L0f93X.mjs}

@@ -1,5 +1,5 @@
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { c as createCodeChallenge, d as getToken, l as createCodeVerifier, m as openBrowser, n as PlatformClient, o as parsePlatformErrorBody, s as awaitBrowserCallback, t as PlatformApiError } from "./client-D4awzTnj.mjs";
+import { c as createCodeChallenge, f as getToken, h as openBrowser, l as createCodeVerifier, n as PlatformClient, o as parsePlatformErrorBody, s as awaitBrowserCallback, t as PlatformApiError } from "./client-YIzxv2ZO.mjs";
 import { _ as me, c as R, i as Ee, l as Re, x as q } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";
@@ -22,6 +22,18 @@ function describeConnectError(status, errorCode) {
 	return null;
 }
 /**
+* Like {@link describeConnectError}, but for `void github update`. The update
+* flow starts from an EXISTING connection, so a 404 "connection not found"
+* (the project has no GitHub connection, or it was disconnected between the
+* read and the write) is the common case and gets a "connect first" message.
+* Everything else defers to the shared connect mapping.
+*/
+function describeUpdateError(status, errorCode) {
+	const code = errorCode ?? "";
+	if (status === 404 && code.includes("connection not found")) return "This project is not connected to a GitHub repository. Run `void github connect` first.";
+	return describeConnectError(status, code);
+}
+/**
 * Extract `owner/repo` from a `https://github.com/owner/repo(.git)?` URL.
 * Returns null for non-GitHub URLs or null input.
 */
@@ -61,6 +73,7 @@ async function runGithubCommand(root, args) {
 		case "install": return runInstall(root, client);
 		case "installations": return runInstallations(client);
 		case "connect": return runConnect(root, client, args);
+		case "update": return runGithubUpdate(root, client, args);
 		case "link": return runGithubLink(root, client);
 	}
 }
@@ -282,12 +295,14 @@ async function runConnect(root, client, args) {
 		branch = input.trim() || branchDefault;
 	}
 	const executor = args.executor ?? "container";
+	let connection;
 	try {
-		await client.connectGithub(projectId, {
+		connection = await client.connectGithub(projectId, {
 			installationId: installation.installation_id,
 			repoFullName,
 			branch,
-			buildExecutor: executor
+			buildExecutor: executor,
+			workflowPath: args.workflowPath
 		});
 	} catch (err) {
 		if (err instanceof PlatformApiError) {
@@ -302,7 +317,136 @@ async function runConnect(root, client, args) {
 		}
 		throw err;
 	}
+	if (args.workflowPath !== void 0 && connection.workflow_path !== args.workflowPath) {
+		R.error(`connect: server did not apply --workflow ${args.workflowPath} (got ${connection.workflow_path ?? "none"}). The platform may be too old to support a custom workflow path.`);
+		process.exit(1);
+	}
 	R.success(`Connected ${repoFullName} (${branch}) → project. Push to ${branch} to deploy.`);
 }
+async function runGithubUpdate(root, client, args) {
+	const isTTY = process.stdin.isTTY === true;
+	if (!isTTY && args.branch === void 0 && args.executor === void 0 && args.workflowPath === void 0) {
+		R.error("update: Nothing to update. Pass --branch <name>, --executor <container|github_actions>, and/or --workflow <.github/workflows/...>.");
+		process.exit(1);
+	}
+	let projectId;
+	const requestedSlug = getRequestedProjectSlug({ projectSlug: args.projectName || void 0 });
+	if (requestedSlug) {
+		const resolved = resolveProjectBySlug(await client.listProjects(), requestedSlug);
+		if (!resolved) {
+			R.error(`update: No project found with slug '${requestedSlug}'.`);
+			process.exit(1);
+		}
+		projectId = resolved.projectId;
+	} else {
+		const linked = readProjectConfig(root);
+		if (linked) projectId = linked.projectId;
+		else if (!isTTY) {
+			R.error("update: No project specified. Pass a project name or --project <name>, set VOID_PROJECT, or link one with `void project link`.");
+			process.exit(1);
+		} else {
+			const projects = await client.listProjects();
+			if (projects.length === 0) {
+				R.error("No projects found. Create one first with `void deploy`.");
+				process.exit(1);
+			}
+			const picked = await Ee({
+				message: "Select a project:",
+				options: projects.map((p) => ({
+					value: p.id,
+					label: p.slug
+				}))
+			});
+			if (q(picked)) {
+				me("Cancelled.");
+				process.exit(0);
+			}
+			projectId = picked;
+		}
+	}
+	let current;
+	try {
+		current = await client.getGithubConnection(projectId);
+	} catch (err) {
+		if (err instanceof PlatformApiError) {
+			const body = parsePlatformErrorBody(err.body);
+			const code = body?.error ?? body?.message ?? "";
+			const message = describeUpdateError(err.status, code);
+			if (message !== null) {
+				R.error(`update: ${message}`);
+				process.exit(1);
+			}
+		}
+		throw err;
+	}
+	let branch;
+	let executor;
+	if (isTTY) {
+		if (args.branch !== void 0) branch = args.branch;
+		else {
+			const input = await Re({
+				message: "Branch to deploy from:",
+				placeholder: current.branch,
+				initialValue: current.branch
+			});
+			if (q(input)) {
+				me("Cancelled.");
+				process.exit(0);
+			}
+			branch = input.trim() || current.branch;
+		}
+		if (args.executor !== void 0) executor = args.executor;
+		else {
+			const picked = await Ee({
+				message: "Build executor:",
+				options: [{
+					value: "container",
+					label: "container"
+				}, {
+					value: "github_actions",
+					label: "github_actions"
+				}],
+				initialValue: current.build_executor
+			});
+			if (q(picked)) {
+				me("Cancelled.");
+				process.exit(0);
+			}
+			executor = picked;
+		}
+	} else {
+		branch = args.branch ?? current.branch;
+		executor = args.executor ?? current.build_executor;
+	}
+	const patch = {};
+	if (branch !== current.branch) patch.branch = branch;
+	if (executor !== current.build_executor) patch.buildExecutor = executor;
+	if (args.workflowPath !== void 0 && args.workflowPath !== current.workflow_path) patch.workflowPath = args.workflowPath;
+	if (patch.branch === void 0 && patch.buildExecutor === void 0 && patch.workflowPath === void 0) {
+		R.info(`No changes. ${current.repo_full_name} already deploys from ${current.branch} via ${current.build_executor}.`);
+		return;
+	}
+	let updated;
+	try {
+		updated = await client.updateGithubConnection(projectId, patch);
+	} catch (err) {
+		if (err instanceof PlatformApiError) {
+			const body = parsePlatformErrorBody(err.body);
+			const code = body?.error ?? body?.message ?? "";
+			const message = describeUpdateError(err.status, code);
+			if (message !== null) {
+				R.error(`update: ${message}`);
+				process.exit(1);
+			}
+			throw err;
+		}
+		throw err;
+	}
+	if (patch.workflowPath !== void 0 && updated.workflow_path !== patch.workflowPath) {
+		R.error(`update: server did not apply --workflow ${patch.workflowPath} (got ${updated.workflow_path ?? "none"}). The platform may be too old to support a custom workflow path.`);
+		process.exit(1);
+	}
+	R.success(`Updated ${updated.repo_full_name} → branch ${updated.branch}, executor ${updated.build_executor}, workflow ${updated.workflow_path}.`);
+}
 //#endregion
 export { runGithubCommand };

package/dist/{handler-DczZlaXR.d.mts → handler-B7rCOy21.d.mts}

@@ -1,6 +1,6 @@
-import { n as HeadDescriptor } from "./head-JAH2l3fg.mjs";
-import { r as AuthUser, t as AuthSession } from "./auth-nEUVHuFI.mjs";
-import { t as StandardSchemaV1 } from "./standard-schema-BCBv-QaP.mjs";
+import { n as HeadDescriptor } from "./head-eOUCWUNy.mjs";
+import { r as AuthUser, t as AuthSession } from "./auth-Dz2CCn4T.mjs";
+import { t as StandardSchemaV1 } from "./standard-schema-Cy0lfeWv.mjs";
 import * as _$_cloudflare_sandbox0 from "@cloudflare/sandbox";
 import { Context, Env, MiddlewareHandler } from "hono";
 import { RewriteDestination } from "void/routes";

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { n as HeadDescriptor } from "./head-JAH2l3fg.mjs";
-import { r as AuthUser } from "./auth-nEUVHuFI.mjs";
-import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, x as DeferredState, y as defineScheduled } from "./handler-DczZlaXR.mjs";
+import { n as HeadDescriptor } from "./head-eOUCWUNy.mjs";
+import { r as AuthUser } from "./auth-Dz2CCn4T.mjs";
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, x as DeferredState, y as defineScheduled } from "./handler-B7rCOy21.mjs";
 import { QueueMap } from "./runtime/queues.mjs";
 import { PluginConfig } from "@cloudflare/vite-plugin";
 import { Plugin } from "vite";

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { r as __toESM } from "./chunk-DJd-R1mw.mjs";
 import { a as join, n as dirname, s as relative } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { u as require_picocolors } from "./output-DeiS4oEX.mjs";
-import { C as hasApiRoutes, S as resolveSandboxConfig, T as resolveAssetRoutingPolicy, _ as readWranglerCompat, a as prerenderPagesNode, b as SANDBOX_MIGRATION_TAG, c as stripInternalEnvKeys, d as ensureWranglerCompatibilityDate, f as ensureWranglerNodejsAlsFlag, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, i as prerenderPages, l as LIVE_MIGRATION_TAG, m as nextDurableObjectMigrationTag, n as resolveDistDir, o as filterLoadedEnv, p as hasDurableObjectSqliteMigration, r as resolveWorkerDirName, s as resolveRemoteMode, u as ensureWranglerCompat, v as resolveLiveBindingConfig, w as hasDocumentRoutes, x as isSandboxEnabled, y as syncWranglerBindings } from "./deploy-Cwa5sooV.mjs";
+import { C as hasApiRoutes, S as resolveSandboxConfig, T as resolveAssetRoutingPolicy, _ as readWranglerCompat, a as prerenderPagesNode, b as SANDBOX_MIGRATION_TAG, c as stripInternalEnvKeys, d as ensureWranglerCompatibilityDate, f as ensureWranglerNodejsAlsFlag, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, i as prerenderPages, l as LIVE_MIGRATION_TAG, m as nextDurableObjectMigrationTag, n as resolveDistDir, o as filterLoadedEnv, p as hasDurableObjectSqliteMigration, r as resolveWorkerDirName, s as resolveRemoteMode, u as ensureWranglerCompat, v as resolveLiveBindingConfig, w as hasDocumentRoutes, x as isSandboxEnabled, y as syncWranglerBindings } from "./deploy-DpOdwtla.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-CCMrHYQm.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-hhMYPVRT.mjs";
-import { d as getToken, p as isStagingMode } from "./client-D4awzTnj.mjs";
+import { f as getToken, m as isStagingMode } from "./client-YIzxv2ZO.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-BTNuNoJ0.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
@@ -1654,7 +1654,7 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 						else warn();
 						return;
 					}
-					const { runPgMigrations, getPgAppliedMigrations } = await import("./runner-pg-BAheiT6v.mjs");
+					const { runPgMigrations, getPgAppliedMigrations } = await import("./runner-pg-EuhrFW3D.mjs");
 					const { collectMigrations } = await import("./collect-9rO3JFNM.mjs").then((n) => n.n);
 					const { validateMigrations } = await import("./validate-CNWm-PsL.mjs").then((n) => n.i);
 					const allMigrations = collectMigrations(migrationsDir);
@@ -4916,7 +4916,7 @@ const STAGING_API_URL = "https://api.staging.void.cloud";
 */
 async function runAiSetupPrompt(root, token, staging, server) {
 	const { select, text, isCancel, log } = await import("./dist-abzUneor.mjs").then((n) => n.p);
-	const { PlatformClient } = await import("./client-D4awzTnj.mjs").then((n) => n.r);
+	const { PlatformClient } = await import("./client-YIzxv2ZO.mjs").then((n) => n.r);
 	const { writeProjectConfig } = await import("./project-CH9pdo16.mjs").then((n) => n.n);
 	const { inferDefaultSlug } = await import("./resolve-project-D4O1_fZz.mjs").then((n) => n.i);
 	const client = new PlatformClient(token, staging ? STAGING_API_URL : DEFAULT_API_URL);
@@ -4945,7 +4945,7 @@ async function runAiSetupPrompt(root, token, staging, server) {
 	let slug;
 	if (result === "__create__") {
 		const { validateProjectSlug } = await import("./project-slug-rX3kTOfY.mjs").then((n) => n.t);
-		const { createProjectWithSlugRetry } = await import("./create-project-CGodxfzH.mjs").then((n) => n.t);
+		const { createProjectWithSlugRetry } = await import("./create-project-pLQdzEPe.mjs").then((n) => n.t);
 		let created;
 		try {
 			created = await createProjectWithSlugRetry(client, inferDefaultSlug(root), async (defaultSlug) => {

package/dist/{init-DvaRDMIc.mjs → init-CZP69LJu.mjs}

@@ -1,7 +1,7 @@
 import { a as join, c as resolve, i as isAbsolute, n as dirname, s as relative, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
-import { d as getToken, n as PlatformClient, p as isStagingMode } from "./client-D4awzTnj.mjs";
+import { f as getToken, m as isStagingMode, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { _ as me, c as R, g as ge, i as Ee, l as Re, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { n as ensureProjectTsconfig, t as createProjectTsconfig } from "./project-tsconfig-BTNuNoJ0.mjs";
@@ -11,10 +11,10 @@ import { r as parseDotenvFile, t as expandDotenv } from "./dotenv-lS94ymhM.mjs";
 import { t as MagicString } from "./magic-string.es-C1Fb0uxq.mjs";
 import { n as writeDrizzleConfig } from "./config--wXmVOoe.mjs";
 import { n as getAgentById, r as getPackageDir, t as detectAgents } from "./agents-MhSzNMiC.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
-import { t as promptForLoginToken } from "./login-Ca6mhQVI.mjs";
+import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-pLQdzEPe.mjs";
+import { t as promptForLoginToken } from "./login-B3l_sDwT.mjs";
 import { r as formatProjectCommand } from "./preset-B7ZQZn0u.mjs";
-import { n as findInstalledYarnPnpRuntime, r as hasLocalLockfile, t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DhCHHLAz.mjs";
+import { n as findInstalledYarnPnpRuntime, r as hasLocalLockfile, t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-WLW2IHUY.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -1805,10 +1805,12 @@ function getWorkflowSetupSteps(root, pm) {
 }
 /**
 * Scaffold the GitHub Actions workflow that deploys via GitHub OIDC — no
-* long-lived secret stored in the repo. The job requests an OIDC token from
-* GitHub (audience `void`), exchanges it at `POST $VOID_API_URL/auth/github-oidc`
-* for a short-lived (15-min) project-scoped deploy token, then runs
-* `void deploy --project <slug>` with that token exported as `VOID_TOKEN`.
+* long-lived secret stored in the repo. `void deploy` itself detects GitHub
+* Actions, mints an OIDC token (audience `void`), exchanges it at
+* `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped deploy
+* token, and uses it — so the workflow is a single `void deploy` step (no
+* curl/jq). `permissions: id-token: write` is still required: it is what lets
+* the job (and thus the CLI) mint the OIDC token.
 *
 * `slug` is the linked project slug when known (from `.void/project.json`);
 * otherwise a `${{ vars.VOID_PROJECT }}` placeholder is emitted with a comment
@@ -1830,8 +1832,8 @@ concurrency:
   cancel-in-progress: true
 
 # id-token: write lets the job mint a GitHub OIDC token. No long-lived
-# VOID_TOKEN secret is stored — the token below is exchanged for a
-# short-lived, project-scoped deploy token at deploy time.
+# VOID_TOKEN secret is stored — \`void deploy\` mints that OIDC token and
+# exchanges it for a short-lived, project-scoped deploy token at deploy time.
 permissions:
   id-token: write
   contents: read
@@ -1850,17 +1852,6 @@ jobs:
       - uses: actions/checkout@v6
 ${setup}
 ${install}
-      - name: Exchange GitHub OIDC token for a Void deploy token
-        run: |
-          OIDC_TOKEN="$(curl -sf \\
-            -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \\
-            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=void" | jq -r '.value')"
-          VOID_TOKEN="$(curl -sf \\
-            -H 'Content-Type: application/json' \\
-            -d "$(jq -n --arg t "$OIDC_TOKEN" --arg p "$VOID_PROJECT" '{oidcToken: $t, project: $p}')" \\
-            "$VOID_API_URL/auth/github-oidc" | jq -r '.token')"
-          echo "::add-mask::$VOID_TOKEN"
-          echo "VOID_TOKEN=$VOID_TOKEN" >> "$GITHUB_ENV"
       - name: Deploy
         run: ${runner} deploy --project "$VOID_PROJECT"
 `;
@@ -2807,7 +2798,7 @@ async function runInitCommand(root, initArgs) {
 		const agentSetup = await resolveAgentSetup(root);
 		injectAgentBlock(root, agentSetup.instructionFilePath);
 		if (agentSetup.agents.length > 0) {
-			const { linkSkillsForSpecificAgents } = await import("./skills--OMgLmXW.mjs");
+			const { linkSkillsForSpecificAgents } = await import("./skills-Dl3u05da.mjs");
 			linkSkillsForSpecificAgents(root, agentSetup.agents);
 		} else R.info("Skills linking skipped for generic agent setup");
 		setupMcpConfig(root, agentSetup.agents);

package/dist/{link-CpbWJY3P.mjs → link-BKLElphS.mjs}

@@ -1,8 +1,8 @@
 import { n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient, u as getSiteDomain } from "./client-D4awzTnj.mjs";
+import { d as getSiteDomain, f as getToken, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { _ as me, c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
+import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-pLQdzEPe.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-D4O1_fZz.mjs";
 //#region src/cli/link.ts
 async function runLink(root, slug) {

package/dist/{list-BkwE5vH4.mjs → list-B7qXBBjo.mjs}

@@ -1,5 +1,5 @@
 import { a as ensureUtc, i as dim, l as tablePrefix, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-D4O1_fZz.mjs";

package/dist/{login-Ca6mhQVI.mjs → login-B3l_sDwT.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { _ as saveToken, a as isExpiredTokenError, d as getToken, f as getTokenSource, g as runLogin, h as removeToken, n as PlatformClient, p as isStagingMode } from "./client-D4awzTnj.mjs";
+import { _ as runLogin, a as isExpiredTokenError, f as getToken, g as removeToken, m as isStagingMode, n as PlatformClient, p as getTokenSource, v as saveToken } from "./client-YIzxv2ZO.mjs";
 import { _ as me, c as R, g as ge, i as Ee, x as q, y as ye } from "./dist-abzUneor.mjs";
 //#region src/cli/login.ts
 async function promptForLoginToken(root = process.cwd()) {

package/dist/{logs-ArQzZquo.mjs → logs-AXm660MB.mjs}

@@ -1,5 +1,5 @@
 import { i as dim, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/logs.ts

package/dist/{mcp-Cc2MMXdQ.mjs → mcp-D2plINxM.mjs}

@@ -1,5 +1,5 @@
 import { a as join, n as dirname } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-YIzxv2ZO.mjs";
 import { a as writeProjectConfig } from "./project-CH9pdo16.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/dist/pages/client.d.mts

@@ -1,4 +1,4 @@
-import { t as PageObject } from "../protocol-63PHtCHS.mjs";
+import { t as PageObject } from "../protocol-6UZCowS1.mjs";
 import { CacheForInput, CacheForResult } from "./prefetch.mjs";
 
 //#region src/pages/action-result.d.ts

package/dist/pages/head-client.d.mts

@@ -1,4 +1,4 @@
-import { n as HeadDescriptor } from "../head-JAH2l3fg.mjs";
+import { n as HeadDescriptor } from "../head-eOUCWUNy.mjs";
 
 //#region src/pages/head-client.d.ts
 /**

package/dist/pages/head.d.mts

@@ -1,2 +1,2 @@
-import { a as renderHtmlAttrs, i as renderHeadToString, n as HeadDescriptor, o as resolveHead, r as renderBodyAttrs, t as HeadConfig } from "../head-JAH2l3fg.mjs";
+import { a as renderHtmlAttrs, i as renderHeadToString, n as HeadDescriptor, o as resolveHead, r as renderBodyAttrs, t as HeadConfig } from "../head-eOUCWUNy.mjs";
 export { HeadConfig, HeadDescriptor, renderBodyAttrs, renderHeadToString, renderHtmlAttrs, resolveHead };

package/dist/pages/index.d.mts

@@ -1,5 +1,5 @@
-import { a as renderHtmlAttrs, i as renderHeadToString, n as HeadDescriptor, o as resolveHead, r as renderBodyAttrs, t as HeadConfig } from "../head-JAH2l3fg.mjs";
-import { i as PageDefinition, n as LayoutDefinition, o as PageScanResult, r as NamedLayoutDefinition } from "../types-BnHMXezo.mjs";
+import { a as renderHtmlAttrs, i as renderHeadToString, n as HeadDescriptor, o as resolveHead, r as renderBodyAttrs, t as HeadConfig } from "../head-eOUCWUNy.mjs";
+import { i as PageDefinition, n as LayoutDefinition, o as PageScanResult, r as NamedLayoutDefinition } from "../types-BodZGegX.mjs";
 import { serializePageData } from "./serialize.mjs";
 import { RewriteDestination } from "void/routes";
 

package/dist/pages/islands-plugin.d.mts

@@ -1,4 +1,4 @@
-import { o as PageScanResult } from "../types-BnHMXezo.mjs";
+import { o as PageScanResult } from "../types-BodZGegX.mjs";
 import { ResolvedConfig, ViteDevServer } from "vite";
 
 //#region src/pages/islands-plugin.d.ts

package/dist/pages/protocol.d.mts

@@ -1,3 +1,3 @@
-import { w as ValidationError } from "../handler-DczZlaXR.mjs";
-import { a as handlePageMutation, i as handlePageGet, n as PageRenderResult, o as safeJsonStringify, r as flattenValidationErrors, t as PageObject } from "../protocol-63PHtCHS.mjs";
+import { w as ValidationError } from "../handler-B7rCOy21.mjs";
+import { a as handlePageMutation, i as handlePageGet, n as PageRenderResult, o as safeJsonStringify, r as flattenValidationErrors, t as PageObject } from "../protocol-6UZCowS1.mjs";
 export { PageObject, PageRenderResult, ValidationError, flattenValidationErrors, handlePageGet, handlePageMutation, safeJsonStringify };