void 0.10.10 → 0.10.12

package/AGENT_PROMPT.md

@@ -12,4 +12,8 @@ Rewrites and redirects: declare static rules in `void.json` under `routing.redir
 
 Logs: surface app-level errors that should show up under `void project logs --level error` via `import { logger } from "void/log"` and `logger.error(msg, fields?)` (also `.warn` / `.info`). Anything caught and only persisted to your own DB is invisible to Cloudflare Tail; route it through `logger.*` or `console.*` so the platform can see it.
 
+Requests: `void project logs` only has rows when a worker actually ran. 5xx generated by the edge router, and every request to a static/SPA project, produce no log line at all. Use `void project requests --status 5xx --range 12h` to see those — it lists status, method, and duration for every request the edge served, whether or not a worker was invoked.
+
+Self-host deploy: `void deploy` targets the Void platform; to deploy to the user's OWN Cloudflare account instead, use `void deploy --backend cloudflare` (add `--provision` on the first deploy to create the D1/KV/R2/Queues/Hyperdrive resources the source needs). It uses local wrangler auth, so pin an account (`account_id` in `wrangler.jsonc` or `CLOUDFLARE_ACCOUNT_ID`) and keep real secrets in `wrangler secret put` — every `.env*` file this backend loads (`.env`, `.env.local`, `.env.production`, `.env.production.local`) ships as plaintext worker vars, `.local` included. Provisioning a Hyperdrive config reads `DATABASE_URL` from the shell, not from `.env*`. v1 supports full Void apps on the Cloudflare Workers target only (D1/KV/R2/Queues/Hyperdrive; auth and ISR on D1/SQLite); framework SSR of every kind (TanStack Start, React Router, vinext, SvelteKit, Nuxt, Analog, Astro), static/SPA/SSG apps (including `output: "static"`), WebSocket/Durable Object apps (`*.ws.ts`), a custom `migrations_pattern`, node/bun/deno targets, and PostgreSQL apps with auth all fail closed with guidance. Auth apps must ship checked-in migrations that produce the Better Auth schema. `--provision` is a single-operator, dev-machine step and is disabled in CI.
+
 Full docs are in `node_modules/void/docs/`. If you have the `void` skill available, use it for a complete API reference covering project structure, routing, pages mode, database, auth, typed fetch, KV, storage, queues, cron jobs, CLI, configuration, and deployment.

package/README.md

@@ -42,7 +42,7 @@ export default defineConfig({
 - `void auth login` — platform auth
 - `void deploy` — build and deploy
 - `void db *` — local DB and migration commands
-- `void project *` — link, status, logs, rollback, delete
+- `void project *` — link, status, logs, requests, rollback, delete
 
 Runtime helpers include:
 

package/dist/{agents-Bmr5tFFb.mjs → agents-CtgBYqld.mjs}

@@ -1,5 +1,5 @@
 import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DJK8HYOj.mjs";
-import { a as join } from "./pathe.M-eThtNZ-CQzLbt4c.mjs";
+import { a as join } from "./dist-DaKKDf8D.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { styleText } from "node:util";

package/dist/{auth-cmd-Cw1edJdZ.mjs → auth-cmd-BqsdZJp5.mjs}

@@ -1,6 +1,6 @@
-import { T as log } from "./agents-Bmr5tFFb.mjs";
-import { f as getToken, g as removeToken, n as PlatformClient } from "./client-C9FG6Vzc.mjs";
-import { n as runLoginCommand } from "./login-CrOTnR_6.mjs";
+import { T as log } from "./agents-CtgBYqld.mjs";
+import { f as getToken, g as removeToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
+import { n as runLoginCommand } from "./login-BT3H8PN3.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/auth-cmd.ts
 async function runAuthCommand(root, args) {

package/dist/{better-auth-shared-BvnM9px6.d.mts → better-auth-shared-DealXecJ.d.mts}

@@ -1,5 +1,5 @@
-import { i as VoidAuthConfig, n as AuthState } from "./auth-qgMlYp7Z.mjs";
 import { t as VoidAuthProvider } from "./providers-BNKRacMr.mjs";
+import { i as VoidAuthConfig, n as AuthState } from "./auth-qgMlYp7Z.mjs";
 import { DBFieldAttribute } from "better-auth/db";
 import { BetterAuthOptions, betterAuth } from "better-auth";
 import { Context } from "hono";

package/dist/{build-cmd-C6kNDJBv.mjs → build-cmd-Bujrv5q-.mjs}

@@ -1,6 +1,6 @@
-import { D as outro, T as log, a as cliTitle, s as dim, u as import_picocolors, w as intro } from "./agents-Bmr5tFFb.mjs";
-import { b as readProjectConfig, f as getToken, n as PlatformClient, t as PlatformApiError } from "./client-C9FG6Vzc.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D2HI3TrG.mjs";
+import { D as outro, T as log, a as cliTitle, s as dim, u as import_picocolors, w as intro } from "./agents-CtgBYqld.mjs";
+import { b as readProjectConfig, f as getToken, n as PlatformClient, t as PlatformApiError } from "./client-Gb71-XkG.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BBMtLLV9.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts
 const POLL_MS = 1e3;

package/dist/{cache-DIUSnIjJ.mjs → cache-C11V8Fxq.mjs}

@@ -1,6 +1,6 @@
-import { D as outro, T as log, a as cliTitle, o as createSpinner, s as dim, w as intro } from "./agents-Bmr5tFFb.mjs";
-import { b as readProjectConfig, f as getToken, n as PlatformClient } from "./client-C9FG6Vzc.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D2HI3TrG.mjs";
+import { D as outro, T as log, a as cliTitle, o as createSpinner, s as dim, w as intro } from "./agents-CtgBYqld.mjs";
+import { b as readProjectConfig, f as getToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BBMtLLV9.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {
 	console.log();

package/dist/{cancel-deploy-BosnzEHC.mjs → cancel-deploy-fwFYF04b.mjs}

@@ -1,5 +1,5 @@
-import { D as outro, S as confirm, T as log, a as cliTitle, j as isCancel, w as intro } from "./agents-Bmr5tFFb.mjs";
-import { b as readProjectConfig, f as getToken, n as PlatformClient } from "./client-C9FG6Vzc.mjs";
+import { D as outro, S as confirm, T as log, a as cliTitle, j as isCancel, w as intro } from "./agents-CtgBYqld.mjs";
+import { b as readProjectConfig, f as getToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 	"pending",

package/dist/cli/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as join } from "../pathe.M-eThtNZ-CQzLbt4c.mjs";
-import { D as outro, E as note, T as log, d as sectionTitle, i as categoryTitle, l as helpLine, r as getPackageDir, u as import_picocolors } from "../agents-Bmr5tFFb.mjs";
+import { a as join } from "../dist-DaKKDf8D.mjs";
+import { D as outro, E as note, T as log, d as sectionTitle, i as categoryTitle, l as helpLine, r as getPackageDir, u as import_picocolors } from "../agents-CtgBYqld.mjs";
 import { readFileSync } from "node:fs";
 import { parseArgs } from "node:util";
 //#region src/cli/args.ts
@@ -14,7 +14,9 @@ function parseDeployArgs(args) {
 				dir: { type: "string" },
 				spa: { type: "boolean" },
 				"skip-build": { type: "boolean" },
-				debug: { type: "boolean" }
+				debug: { type: "boolean" },
+				backend: { type: "string" },
+				provision: { type: "boolean" }
 			},
 			allowPositionals: true,
 			strict: true,
@@ -22,22 +24,43 @@ function parseDeployArgs(args) {
 		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		if (message.includes("argument missing") || message.includes("argument is ambiguous")) throw new Error("deploy: --project requires a slug.");
+		if (message.includes("argument missing") || message.includes("argument is ambiguous")) {
+			if (message.match(/Option '(--[a-z-]+)/)?.[1] === "--backend") throw new Error("deploy: --backend requires a value ('cloudflare').");
+			throw new Error("deploy: --project requires a slug.");
+		}
 		const unknownOptionMatch = message.match(/Unknown option '([^']+)'/);
 		if (unknownOptionMatch) throw new Error(`deploy: Unknown option '${unknownOptionMatch[1]}'.`);
 		throw new Error(`deploy: ${message}.`);
 	}
-	if ((parsed.tokens ?? []).filter((token) => token.kind === "option" && token.name === "project").length > 1) throw new Error("deploy: --project can only be specified once.");
+	const tokens = parsed.tokens ?? [];
+	if (tokens.filter((token) => token.kind === "option" && token.name === "project").length > 1) throw new Error("deploy: --project can only be specified once.");
+	if (tokens.filter((token) => token.kind === "option" && token.name === "backend").length > 1) throw new Error("deploy: --backend can only be specified once.");
 	if (parsed.positionals.length > 0) throw new Error(`deploy: Unexpected argument '${parsed.positionals[0]}'.`);
 	const projectValue = parsed.values.project;
 	const projectSlug = typeof projectValue === "string" ? projectValue : void 0;
 	if (typeof projectSlug === "string" && projectSlug.startsWith("-")) throw new Error("deploy: --project requires a slug.");
+	const dir = typeof parsed.values.dir === "string" ? parsed.values.dir : void 0;
+	const spa = parsed.values.spa === true ? true : void 0;
+	const skipBuild = parsed.values["skip-build"] === true ? true : void 0;
+	const debug = parsed.values.debug === true ? true : void 0;
+	const backendValue = typeof parsed.values.backend === "string" ? parsed.values.backend : void 0;
+	if (backendValue !== void 0 && backendValue !== "cloudflare") throw new Error("deploy: --backend must be 'cloudflare'.");
+	const backend = backendValue;
+	const provision = parsed.values.provision === true ? true : void 0;
+	if (provision && backend !== "cloudflare") throw new Error("deploy: --provision requires --backend cloudflare.");
+	if (backend === "cloudflare") {
+		if (projectSlug !== void 0) throw new Error("deploy: --project is not supported with --backend cloudflare — this backend deploys to your own Cloudflare account and no Void project is involved.");
+		if (dir !== void 0) throw new Error("deploy: --dir is not supported with --backend cloudflare — this backend uploads the worker your build emits, not a static directory.");
+		if (spa) throw new Error("deploy: --spa is not supported with --backend cloudflare — this backend uploads the worker your build emits, not a static SPA.");
+	}
 	return {
 		projectSlug,
-		dir: typeof parsed.values.dir === "string" ? parsed.values.dir : void 0,
-		spa: parsed.values.spa === true ? true : void 0,
-		skipBuild: parsed.values["skip-build"] === true ? true : void 0,
-		debug: parsed.values.debug === true ? true : void 0
+		dir,
+		spa,
+		skipBuild,
+		debug,
+		backend,
+		provision
 	};
 }
 //#endregion
@@ -884,7 +907,15 @@ const HELP_TREE = {
 			},
 			{
 				command: "--skip-build",
-				description: "Skip the build step and use existing output"
+				description: "Skip the build step and use existing output (not with --backend cloudflare)"
+			},
+			{
+				command: "--backend cloudflare",
+				description: "Deploy to your own Cloudflare account instead of the Void platform"
+			},
+			{
+				command: "--provision",
+				description: "Create missing D1/KV/R2/Queue/Hyperdrive resources (with --backend cloudflare)"
 			},
 			{
 				command: "--debug",
@@ -903,6 +934,14 @@ const HELP_TREE = {
 			{
 				command: "void deploy --dir dist --spa",
 				description: "Deploy a static SPA directory"
+			},
+			{
+				command: "void deploy --backend cloudflare",
+				description: "Deploy to your own Cloudflare account"
+			},
+			{
+				command: "void deploy --backend cloudflare --provision",
+				description: "Provision missing resources, then deploy to Cloudflare"
 			}
 		]
 	},
@@ -954,6 +993,10 @@ const HELP_TREE = {
 				command: "logs",
 				description: "Show runtime logs from the deployed project"
 			},
+			{
+				command: "requests",
+				description: "Show request-level traffic (status, method, timing)"
+			},
 			{
 				command: "rollback [deployId]",
 				description: "Roll back to a previous deployment"
@@ -1011,6 +1054,24 @@ const HELP_TREE = {
 					}
 				]
 			},
+			requests: {
+				summary: "Show request-level traffic (status, method, type, timing). Surfaces 5xx that the edge router generated itself and requests to static/SPA projects that never invoke a worker — neither of which appears in `project logs`.",
+				usage: ["void project requests [options]"],
+				options: [{
+					command: "--status <filter>",
+					description: "Filter by status: a class like 5xx or an exact code like 500"
+				}, {
+					command: "--range <range>",
+					description: "Time range to query (default: 1h)"
+				}],
+				examples: [{
+					command: "void project requests --status 5xx",
+					description: "Show recent server-error responses, including edge-generated ones"
+				}, {
+					command: "void project requests --range 24h",
+					description: "Show all request traffic in the last day"
+				}]
+			},
 			rollback: basicSubcommand("Roll back to a previous deployment.", "void project rollback [deployId]"),
 			cancel: basicSubcommand("Cancel an active deployment.", "void project cancel [deployId]"),
 			delete: {
@@ -1741,6 +1802,7 @@ const LOG_LEVELS = /* @__PURE__ */ new Set([
 	"debug",
 	"all"
 ]);
+const STATUS_FILTER = /^([1-5]xx|[1-5]\d{2}|all)$/;
 const projectSubcommands = [
 	{
 		name: "status",
@@ -1760,6 +1822,10 @@ const projectSubcommands = [
 		name: "logs",
 		description: "Show runtime logs from the deployed project"
 	},
+	{
+		name: "requests",
+		description: "Show request-level traffic (status, method, timing)"
+	},
 	{
 		name: "rollback",
 		arg: "[deployId]",
@@ -1825,6 +1891,21 @@ function parseProjectArgs(args) {
 			level
 		};
 	}
+	if (subcommand === "requests") {
+		let status = "";
+		let range = "1h";
+		for (let i = 0; i < rest.length; i++) if (rest[i] === "--status" && rest[i + 1]) {
+			const value = rest[++i];
+			if (!STATUS_FILTER.test(value)) throw new Error(`project: Invalid --status '${value}'. Use a class like 5xx or an exact code like 500.`);
+			status = value;
+		} else if (rest[i] === "--range" && rest[i + 1]) range = rest[++i];
+		else throw new Error(`project: Unexpected argument '${rest[i]}'.`);
+		return {
+			subcommand,
+			status,
+			range
+		};
+	}
 	if (subcommand === "rollback") {
 		const [deployId, extra] = rest;
 		if (deployId?.startsWith("-")) throw new Error(`project: Unknown flag '${deployId}'.`);
@@ -1865,7 +1946,7 @@ function parseProjectArgs(args) {
 			projectSlug
 		};
 	}
-	throw new Error("project: Usage: void project <status|link|list|logs|rollback|cancel|delete|purge-cache>.");
+	throw new Error("project: Usage: void project <status|link|list|logs|requests|rollback|cancel|delete|purge-cache>.");
 }
 //#endregion
 //#region src/cli/secret-args.ts
@@ -1968,7 +2049,7 @@ async function runSubcommandGroup(command, subcommands, parse, run) {
 	const sub = args[1];
 	try {
 		if ((!sub || sub.startsWith("-")) && process.stdin.isTTY) {
-			const { promptSubcommand } = await import("../subcommand-prompt-DtES-oP6.mjs");
+			const { promptSubcommand } = await import("../subcommand-prompt-BzV8iQZo.mjs");
 			const result = await promptSubcommand(command, subcommands);
 			if (!result) process.exit(0);
 			await run(root, parse(buildArgs(result, args.slice(1))));
@@ -1997,27 +2078,29 @@ else if (command === "deploy") {
 		log.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../deploy-B02JyKP9.mjs").then((n) => n.t).then(({ runDeploy }) => {
+	import("../deploy-u7Rv9q_q.mjs").then((n) => n.t).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
 			spa: deployArgs.spa,
 			skipBuild: deployArgs.skipBuild,
-			debug: deployArgs.debug
+			debug: deployArgs.debug,
+			backend: deployArgs.backend,
+			provision: deployArgs.provision
 		}).catch((err) => {
 			log.error(err.message ?? err);
 			process.exit(1);
 		});
 	});
-} else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-Cw1edJdZ.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-B2bcKefD.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-DeMnMcV0.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-DMrBabBQ.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BvKV34IK.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-BfG7O71F.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-Bee261SV.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
-else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-DfeFEasr.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
-else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-C6kNDJBv.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
+} else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-BqsdZJp5.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-D_w-4w5B.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-Dt32J6RI.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-DiaNQbrl.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-DOiJMRt2.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-CZy5MorI.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-o_w-8yI8.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-DKcGUNsj.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
+else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-Bujrv5q-.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
 else if (command === "prepare") {
 	const root = process.cwd();
 	let prepareArgs;
@@ -2027,7 +2110,7 @@ else if (command === "prepare") {
 		log.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../prepare-BRyC4TCC.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-BoKHgMNx.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			log.error(err.message ?? err);
 			process.exit(1);
@@ -2035,7 +2118,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-xfwW7cLp.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-3rgHKBVi.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -2048,7 +2131,7 @@ else if (command === "prepare") {
 			process.exit(1);
 		});
 	});
-} else if (command === "mcp") import("../mcp-BNjMGMB0.mjs").then(({ runMcp }) => {
+} else if (command === "mcp") import("../mcp-DoM3_nhd.mjs").then(({ runMcp }) => {
 	runMcp();
 });
 else if (command === "-v" || command === "--version") {
@@ -2074,7 +2157,7 @@ else if (command === "-v" || command === "--version") {
 		},
 		{
 			name: "project",
-			hint: "status | link | list | logs | rollback | cancel | delete | purge-cache",
+			hint: "status | link | list | logs | requests | rollback | cancel | delete | purge-cache",
 			description: "Manage projects and deployments"
 		},
 		{
@@ -2127,38 +2210,38 @@ else if (command === "-v" || command === "--version") {
 	];
 	(async () => {
 		printVoidHeader();
-		const { promptSubcommand } = await import("../subcommand-prompt-DtES-oP6.mjs");
+		const { promptSubcommand } = await import("../subcommand-prompt-BzV8iQZo.mjs");
 		const result = await promptSubcommand("", topLevelCommands);
 		if (!result) process.exit(0);
 		const cmd = result.subcommand;
 		const root = process.cwd();
 		switch (cmd) {
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-xfwW7cLp.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-3rgHKBVi.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-B02JyKP9.mjs").then((n) => n.t);
+				const { runDeploy } = await import("../deploy-u7Rv9q_q.mjs").then((n) => n.t);
 				await runDeploy(root);
 				return;
 			}
 			case "mcp": {
-				const { runMcp } = await import("../mcp-BNjMGMB0.mjs");
+				const { runMcp } = await import("../mcp-DoM3_nhd.mjs");
 				runMcp();
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-Cw1edJdZ.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-B2bcKefD.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-DeMnMcV0.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-DMrBabBQ.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-DfeFEasr.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
-			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-C6kNDJBv.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BvKV34IK.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-BfG7O71F.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-Bee261SV.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-BqsdZJp5.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-D_w-4w5B.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-Dt32J6RI.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-DiaNQbrl.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-DKcGUNsj.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
+			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-Bujrv5q-.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-DOiJMRt2.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-CZy5MorI.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-o_w-8yI8.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-BRyC4TCC.mjs");
+				const { runPrepareCommand } = await import("../prepare-BoKHgMNx.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}

package/dist/cli/env-schema-probe.d.mts

@@ -0,0 +1,96 @@
+//#region src/cli/env-validation.d.ts
+/**
+* The stable, values-free classification of a self-host schema failure.
+* env.ts evaluation and Standard-Schema validators run ARBITRARY user code that
+* can embed an env value in a thrown/rejected error (its `message`, `stack`, or
+* `cause`), and `VOID_ENV_UNMASK` disables redaction — so the original error is
+* never surfaced. Every {@link SelfHostSchemaError} instead carries only one of
+* these codes plus fixed text, so neither its message, its `reason` field, nor
+* its JSON serialization can echo a value.
+*   - `schema-load-failed`      — importing/evaluating the user's env.ts threw.
+*   - `schema-validation-error` — a registered validator threw or rejected while
+*                                 checking a production value.
+*/
+type SelfHostSchemaFailureReason = "schema-load-failed" | "schema-validation-error";
+/**
+* The env-INSENSITIVE structural facts the self-host secret gate needs from the
+* project's env schema: whether a schema is registered, the REQUIRED key names (a
+* validator that rejects the ABSENT value — {@link requiredSchemaKeys}), and the
+* keys the schema flags `.secret()` ({@link getSecretOverride} === 'secret').
+* NONE of these depend on which `.env` file the build reads — they are fixed by
+* env.ts's structure — so this needs no `loadEnv` and no build env, and the result
+* is the SAME regardless of the build's mode/envDir. That is precisely why the old
+* probe-vs-build divergence class is gone: nothing derived here can diverge from
+* the build over which `.env*` set was loaded.
+*/
+type SelfHostSchemaFacts = {
+  /** Whether the project registered an env schema at all (no schema → nothing to gate). */hasSchema: boolean; /** Required key NAMES — validator rejects `undefined`. Values-free. */
+  requiredKeys: Array<string>; /** Keys the schema flags `.secret()`. Values-free. */
+  secretKeys: Array<string>;
+};
+//#endregion
+//#region src/cli/env-schema-probe.d.ts
+/** Input handed to the child (JSON in argv[3]). Path only — no env values cross here. */
+type EnvSchemaProbeInput = {
+  root: string;
+};
+/** The reason the `facts` probe rejected the app as unsupported (values-free). */
+type EnvSchemaProbeRejectReason = "custom-envdir" | "non-production-mode";
+/**
+* The structured result of the `facts` operation. `ok` carries the env-insensitive
+* schema facts; `reject` fails the deploy closed pre-account with clear v1-scope
+* guidance; `schema-error` surfaces a values-free env.ts/validator failure.
+*
+* `reject` crosses the process boundary as a FIXED reason CODE only — never the raw
+* resolved `mode` / `envDir` strings. Those are arbitrary Vite-config-derived values
+* (a config could set `envDir`/`mode` from any inherited secret), so echoing them
+* over fd 3 or into a parent log would break the values-free boundary; the parent
+* renders fixed guidance from the code alone.
+*/
+type EnvSchemaProbeResult = {
+  kind: "ok";
+  facts: SelfHostSchemaFacts;
+} | {
+  kind: "reject";
+  reason: EnvSchemaProbeRejectReason;
+} | {
+  kind: "schema-error";
+  reason: SelfHostSchemaFailureReason;
+};
+/**
+* The structured result of the `validate-emitted` operation. `invalid-keys` carries
+* the FAILING key NAMES only (never a value); `schema-error` surfaces a values-free
+* env.ts/validator failure.
+*/
+type EnvSchemaValidateResult = {
+  kind: "invalid-keys";
+  invalidKeys: Array<string>;
+} | {
+  kind: "schema-error";
+  reason: SelfHostSchemaFailureReason;
+};
+/** Minimal structural shape of a `spawnSync`-style result (injectable in tests). */
+type EnvSchemaProbeSpawnResult = {
+  status: number | null; /** The fd-3 buffer (the framed result) — dedicated so stdout noise can't truncate it. */
+  fd3: string | null;
+  error?: Error | null;
+  signal?: NodeJS.Signals | null;
+};
+type EnvSchemaProbeSpawn = (command: string, args: Array<string>, options: {
+  cwd: string;
+  env: NodeJS.ProcessEnv;
+}) => EnvSchemaProbeSpawnResult;
+/**
+* PARENT side (`facts`): return the env-insensitive schema facts + the v1 envDir/mode
+* narrowing. Runs pre-build so a custom envDir / non-production mode / broken env.ts
+* fails fast, before any account op.
+*/
+declare function resolveEnvSchemaFactsViaSubprocess(input: EnvSchemaProbeInput, env: NodeJS.ProcessEnv, spawn?: EnvSchemaProbeSpawn): Promise<EnvSchemaProbeResult>;
+/**
+* PARENT side (`validate-emitted`): validate the REAL emitted worker `vars` against
+* the schema validators and return the FAILING key NAMES only. Runs post-build so
+* the values validated are exactly what the worker ships.
+*/
+declare function validateEmittedVarsViaSubprocess(input: EnvSchemaProbeInput, env: NodeJS.ProcessEnv, spawn?: EnvSchemaProbeSpawn): Promise<EnvSchemaValidateResult>;
+//#endregion
+export { EnvSchemaProbeInput, EnvSchemaProbeRejectReason, EnvSchemaProbeResult, EnvSchemaProbeSpawn, EnvSchemaProbeSpawnResult, EnvSchemaValidateResult, resolveEnvSchemaFactsViaSubprocess, validateEmittedVarsViaSubprocess };