void 0.10.12 → 0.20.0

package/dist/{agents-CtgBYqld.mjs → output-tFQLLj26.mjs}

@@ -1,7 +1,11 @@
-import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DJK8HYOj.mjs";
-import { a as join } from "./dist-DaKKDf8D.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { l as resolve, o as join } from "./dist-BrsS7cai.mjs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { homedir, hostname } from "node:os";
+import { Entry } from "@napi-rs/keyring";
+import { parsePlatformInstallationManifest } from "@void/platform";
 import { styleText } from "node:util";
 import process$1, { stdin, stdout } from "node:process";
 import * as l from "node:readline";
@@ -9,7 +13,9 @@ import l__default from "node:readline";
 import { ReadStream } from "node:tty";
 //#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
 var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	let p = process || {}, argv = p.argv || [], env = p.env || {};
+	let p = process || {};
+	let argv = p.argv || [];
+	let env = p.env || {};
 	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
 	let formatter = (open, close, replace = open) => (input) => {
 		let string = "" + input, index = string.indexOf(close, open.length);
@@ -75,6 +81,430 @@ var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.createColors = createColors;
 }));
 //#endregion
+//#region src/cli/keyring.ts
+function readKeyringPassword(service, account) {
+	try {
+		return new Entry(service, account).getPassword();
+	} catch {
+		return null;
+	}
+}
+function writeKeyringPassword(service, account, password) {
+	try {
+		new Entry(service, account).setPassword(password);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function deleteKeyringPassword(service, account) {
+	try {
+		new Entry(service, account).deletePassword();
+		return true;
+	} catch {
+		return false;
+	}
+}
+const DEFAULT_REGISTRY = {
+	activeConnectionId: null,
+	connections: [],
+	schemaVersion: 1
+};
+const PLATFORM_RECOVERY_KEYRING_SERVICE = "dev.void.cli.platform";
+const PLATFORM_RECOVERY_ENVELOPE_VERSION = 1;
+function platformRegistryDirectory() {
+	return process.env.VOID_PLATFORM_REGISTRY_DIR ?? join(homedir(), ".void", "platforms");
+}
+function normalizePlatformApiUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`platform: Invalid platform URL ${JSON.stringify(value)}.`);
+	}
+	if (!(url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1")) && url.protocol !== "https:" || url.username || url.password) throw new Error("platform: Platform URLs must use HTTPS and must not contain credentials.");
+	if (url.search || url.hash) throw new Error("platform: Platform URLs must not contain query parameters or fragments.");
+	if (url.pathname !== "/" && url.pathname !== "") throw new Error("platform: Platform URLs must not contain a path.");
+	return url.origin;
+}
+function platformConnectionId(apiUrl) {
+	return createHash("sha256").update(normalizePlatformApiUrl(apiUrl)).digest("hex").slice(0, 20);
+}
+function platformCredentialAccount(apiUrl) {
+	return `platform:${createHash("sha256").update(normalizePlatformApiUrl(apiUrl)).digest("hex")}`;
+}
+function parseConnection(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Invalid connection entry in the local registry.");
+	const entry = value;
+	const apiUrl = normalizePlatformApiUrl(String(entry.apiUrl ?? ""));
+	const id = String(entry.id ?? "");
+	if (id !== platformConnectionId(apiUrl)) throw new Error("platform: Connection id does not match its API URL.");
+	if (entry.kind !== "connected" && entry.kind !== "installed") throw new Error("platform: Invalid connection kind in the local registry.");
+	const lastUsedAt = String(entry.lastUsedAt ?? "");
+	if (!Number.isFinite(Date.parse(lastUsedAt))) throw new Error("platform: Invalid connection timestamp in the local registry.");
+	const optionalString = (input) => typeof input === "string" && input !== "" ? input : null;
+	const proxyUrl = optionalString(entry.proxyUrl) ?? (apiUrl === "https://api.void.cloud" ? "https://proxy.void.cloud" : apiUrl === "https://api.staging.void.cloud" ? "https://proxy.staging.void.cloud" : null);
+	return {
+		accountId: optionalString(entry.accountId),
+		apiUrl,
+		applicationDomain: optionalString(entry.applicationDomain),
+		displayName: typeof entry.displayName === "string" && entry.displayName.trim() ? entry.displayName.trim() : new URL(apiUrl).hostname,
+		id,
+		installationId: optionalString(entry.installationId),
+		kind: entry.kind,
+		lastUsedAt,
+		proxyUrl: proxyUrl === null ? null : normalizePlatformApiUrl(proxyUrl)
+	};
+}
+function readRegistry(directory) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(directory, "registry.json"), "utf8"));
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("registry must be an object");
+		const value = parsed;
+		if (value.schemaVersion !== 1 || !Array.isArray(value.connections)) throw new Error("unsupported schema");
+		const connections = value.connections.map(parseConnection);
+		return {
+			activeConnectionId: typeof value.activeConnectionId === "string" && connections.some((connection) => connection.id === value.activeConnectionId) ? value.activeConnectionId : null,
+			connections,
+			schemaVersion: 1
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") return DEFAULT_REGISTRY;
+		throw new Error(`platform: Could not read ${join(directory, "registry.json")}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function withRegistryLock(directory, operation) {
+	mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const lockPath = join(directory, ".registry.lock");
+	let descriptor;
+	try {
+		descriptor = openSync(lockPath, "wx", 384);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		if (Date.now() - statSync(lockPath).mtimeMs < 6e5) throw new Error("platform: Another process is updating the platform registry.");
+		rmSync(lockPath, { force: true });
+		descriptor = openSync(lockPath, "wx", 384);
+	}
+	try {
+		return operation();
+	} finally {
+		closeSync(descriptor);
+		rmSync(lockPath, { force: true });
+	}
+}
+function writeJsonAtomically(path, value) {
+	const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	try {
+		writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+}
+function acquirePlatformLifecycleLock(accountId, installationSlug, directory = platformRegistryDirectory()) {
+	if (!/^[A-Za-z0-9_-]+$/.test(accountId) || !/^[a-z0-9][a-z0-9-]{0,79}$/.test(installationSlug)) throw new Error("platform: Invalid lifecycle lock identity.");
+	const lockDirectory = join(directory, "locks");
+	mkdirSync(lockDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	const lockPath = join(lockDirectory, `${accountId}-${installationSlug}.lock`);
+	const acquire = () => {
+		try {
+			const descriptor = openSync(lockPath, "wx", 384);
+			writeFileSync(descriptor, `${JSON.stringify({
+				host: hostname(),
+				pid: process.pid,
+				startedAt: (/* @__PURE__ */ new Date()).toISOString()
+			})}\n`);
+			return descriptor;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			let stale = false;
+			try {
+				const owner = JSON.parse(readFileSync(lockPath, "utf8"));
+				if (owner.host === hostname() && typeof owner.pid === "number") try {
+					process.kill(owner.pid, 0);
+				} catch (ownerError) {
+					stale = ownerError.code === "ESRCH";
+				}
+				else {
+					const startedAt = typeof owner.startedAt === "string" ? Date.parse(owner.startedAt) : NaN;
+					stale = Number.isFinite(startedAt) && Date.now() - startedAt > 72e5;
+				}
+			} catch {
+				stale = Date.now() - statSync(lockPath).mtimeMs > 72e5;
+			}
+			if (!stale) throw new Error(`platform: Another lifecycle operation is active for ${installationSlug} in account ${accountId}.`);
+			rmSync(lockPath, { force: true });
+			return acquire();
+		}
+	};
+	const descriptor = acquire();
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		closeSync(descriptor);
+		rmSync(lockPath, { force: true });
+	};
+}
+function listPlatformConnections(directory = platformRegistryDirectory()) {
+	return readRegistry(directory).connections;
+}
+function assertPlatformInstallationSlugAvailable(installationSlug, directory = platformRegistryDirectory()) {
+	const collision = listInstallationManifests(directory).find((manifest) => manifest.status !== "uninstalled" && manifest.deployment.installationSlug === installationSlug);
+	if (collision) throw new Error(`platform: Installation ${collision.id} already uses this name. Resume it with \`void platform install --resume --name ${collision.id}\`.`);
+}
+function getActivePlatformConnection(directory = platformRegistryDirectory()) {
+	const registry = readRegistry(directory);
+	return registry.connections.find((connection) => connection.id === registry.activeConnectionId) ?? (registry.connections.length === 1 ? registry.connections[0] : null);
+}
+function savePlatformConnection(input, directory = platformRegistryDirectory()) {
+	const apiUrl = normalizePlatformApiUrl(input.apiUrl);
+	const id = platformConnectionId(apiUrl);
+	const lastUsedAt = input.lastUsedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+	const connection = parseConnection({
+		...input,
+		apiUrl,
+		id,
+		lastUsedAt
+	});
+	return withRegistryLock(directory, () => {
+		const connections = readRegistry(directory).connections.filter((entry) => entry.id !== id);
+		connections.push(connection);
+		connections.sort((left, right) => left.displayName.localeCompare(right.displayName));
+		writeJsonAtomically(join(directory, "registry.json"), {
+			activeConnectionId: id,
+			connections,
+			schemaVersion: 1
+		});
+		return connection;
+	});
+}
+function selectPlatformConnection(selector, directory = platformRegistryDirectory()) {
+	return withRegistryLock(directory, () => {
+		const current = readRegistry(directory);
+		const normalizedUrl = (() => {
+			try {
+				return normalizePlatformApiUrl(selector);
+			} catch {
+				return null;
+			}
+		})();
+		const matches = current.connections.filter((entry) => entry.id === selector || entry.installationId === selector || entry.displayName.toLowerCase() === selector.toLowerCase() || normalizedUrl !== null && entry.apiUrl === normalizedUrl);
+		if (matches.length !== 1) throw new Error(matches.length === 0 ? `platform: No installed or connected platform matches ${JSON.stringify(selector)}.` : `platform: More than one platform matches ${JSON.stringify(selector)}. Use its id or URL.`);
+		const selected = {
+			...matches[0],
+			lastUsedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const connections = current.connections.map((entry) => entry.id === selected.id ? selected : entry);
+		writeJsonAtomically(join(directory, "registry.json"), {
+			activeConnectionId: selected.id,
+			connections,
+			schemaVersion: 1
+		});
+		return selected;
+	});
+}
+function installationManifestPath(accountId, installationId, directory = platformRegistryDirectory()) {
+	if (!/^[A-Za-z0-9_-]+$/.test(accountId) || !/^[a-z0-9][a-z0-9-]{7,79}$/.test(installationId)) throw new Error("platform: Invalid account or installation id.");
+	return join(directory, accountId, `${installationId}.json`);
+}
+function writeInstallationManifest(manifest, directory = platformRegistryDirectory()) {
+	const path = installationManifestPath(manifest.account.id, manifest.id, directory);
+	const parent = join(directory, manifest.account.id);
+	mkdirSync(parent, {
+		recursive: true,
+		mode: 448
+	});
+	writeJsonAtomically(path, manifest);
+}
+function listInstallationManifests(directory = platformRegistryDirectory()) {
+	const manifests = [];
+	let accountDirectories;
+	try {
+		accountDirectories = readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	for (const accountId of accountDirectories) {
+		const accountPath = join(directory, accountId);
+		for (const entry of readdirSync(accountPath, { withFileTypes: true })) {
+			if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+			const path = join(accountPath, entry.name);
+			try {
+				manifests.push(parsePlatformInstallationManifest(JSON.parse(readFileSync(path, "utf8"))));
+			} catch (error) {
+				throw new Error(`platform: Invalid installation manifest ${path}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+	}
+	return manifests.sort((left, right) => left.deployment.displayName.localeCompare(right.deployment.displayName));
+}
+function resolveInstallationManifest(selector, directory = platformRegistryDirectory()) {
+	const manifests = listInstallationManifests(directory).filter((manifest) => manifest.status !== "uninstalled" && (!selector || manifest.id === selector || manifest.deployment.installationSlug === selector || manifest.deployment.displayName.toLowerCase() === selector.toLowerCase()));
+	if (manifests.length !== 1) throw new Error(manifests.length === 0 ? `platform: No local installation matches ${JSON.stringify(selector)}.` : "platform: Multiple local installations match; specify an installation id.");
+	return manifests[0];
+}
+function writePendingInstallationSecrets(manifest, secrets, directory = platformRegistryDirectory()) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	writeEncryptedRecoveryMaterial(manifest, "pending", manifestPath.replace(/\.json$/, ".secrets.enc"), secrets, directory);
+	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
+}
+function readPendingInstallationSecrets(manifest, directory = platformRegistryDirectory()) {
+	return readRecoveryMaterial(manifest, "pending", directory);
+}
+function promoteInstallationSecrets(manifest, directory = platformRegistryDirectory()) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	const values = readPendingInstallationSecrets(manifest, directory);
+	if (!values) throw new Error("platform: Pending installation recovery material is missing.");
+	writeEncryptedRecoveryMaterial(manifest, "recovery", manifestPath.replace(/\.json$/, ".recovery.enc"), values, directory);
+	rmSync(manifestPath.replace(/\.json$/, ".secrets.enc"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".recovery"), { force: true });
+}
+function readInstallationRecoverySecrets(manifest, directory = platformRegistryDirectory()) {
+	const pending = readPendingInstallationSecrets(manifest, directory);
+	if (!pending) return readRecoveryMaterial(manifest, "recovery", directory);
+	const updateState = pendingWorkerSecretUpdateState(manifest, pending.workerSecretUpdatesJson);
+	if (updateState === "stale") return readRecoveryMaterial(manifest, "recovery", directory);
+	if (updateState === "committed") return Object.fromEntries(Object.entries(pending).filter(([name]) => name !== "workerSecretUpdatesJson"));
+	return pending;
+}
+function pendingWorkerSecretUpdateState(manifest, value) {
+	if (!value) return "active";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return "active";
+	}
+	if (!parsed || typeof parsed !== "object" || !("schema" in parsed) || parsed.schema !== 1 || !("id" in parsed) || typeof parsed.id !== "string" || !("baselineGeneration" in parsed) || !Number.isSafeInteger(parsed.baselineGeneration) || !("generation" in parsed) || parsed.generation !== null && !Number.isSafeInteger(parsed.generation)) return "active";
+	return platformWorkerSecretUpdateIntentState(manifest, {
+		baselineGeneration: Number(parsed.baselineGeneration),
+		generation: parsed.generation === null ? null : Number(parsed.generation),
+		id: parsed.id
+	});
+}
+function platformWorkerSecretUpdateIntentState(manifest, intent) {
+	const latestGeneration = latestPlatformWorkerCutoverGeneration(manifest);
+	const latestState = manifest.steps.flatMap((step) => {
+		const match = /^worker-secret-updates:(\d+):(pending|committed)$/.exec(step.key);
+		return match ? [{
+			generation: Number(match[1]),
+			id: step.resultHash,
+			state: match[2]
+		}] : [];
+	}).sort((left, right) => right.generation - left.generation || (left.state === right.state ? 0 : left.state === "committed" ? -1 : 1))[0];
+	if (!latestState) return intent.generation === null && intent.baselineGeneration === latestGeneration ? "active" : "stale";
+	if (latestState.generation !== latestGeneration || latestState.id !== intent.id) return "stale";
+	return latestState.state === "committed" ? "committed" : "active";
+}
+function latestPlatformWorkerCutoverGeneration(manifest) {
+	return Math.max(0, ...manifest.steps.flatMap((step) => {
+		const match = /^worker-(?:cutover|secret-updates|traffic-state):(\d+)/.exec(step.key);
+		return match ? [Number(match[1])] : [];
+	}));
+}
+function removeInstallationRecoverySecrets(manifest, directory = platformRegistryDirectory()) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	rmSync(manifestPath.replace(/\.json$/, ".recovery.enc"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".secrets.enc"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".recovery"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
+}
+function readRecoveryMaterial(manifest, kind, directory) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	const encryptedPath = manifestPath.replace(/\.json$/, `.${kind === "pending" ? "secrets" : "recovery"}.enc`);
+	try {
+		const envelope = parseRecoveryEnvelope(JSON.parse(readFileSync(encryptedPath, "utf8")));
+		const key = platformRecoveryKey(directory, false);
+		if (!key) throw new Error("the encryption key is unavailable; restore it from the system keychain or set VOID_PLATFORM_RECOVERY_KEY");
+		const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"));
+		decipher.setAAD(recoveryAad(manifest, kind));
+		decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+		const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64")), decipher.final()]);
+		return parseRecoveryValues(JSON.parse(plaintext.toString("utf8")), `${kind} recovery material`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw new Error(`platform: Could not read encrypted ${kind} material: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const legacyPath = manifestPath.replace(/\.json$/, kind === "pending" ? ".secrets" : ".recovery");
+	try {
+		const values = parseRecoveryValues(JSON.parse(readFileSync(legacyPath, "utf8")), `legacy ${kind} recovery material`);
+		writeEncryptedRecoveryMaterial(manifest, kind, encryptedPath, values, directory);
+		rmSync(legacyPath, { force: true });
+		return values;
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw new Error(`platform: Could not migrate legacy ${kind} material: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function writeEncryptedRecoveryMaterial(manifest, kind, path, values, directory) {
+	const key = platformRecoveryKey(directory, true);
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	cipher.setAAD(recoveryAad(manifest, kind));
+	writeJsonAtomically(path, {
+		algorithm: "aes-256-gcm",
+		ciphertext: Buffer.concat([cipher.update(JSON.stringify(parseRecoveryValues(values, `${kind} recovery material`)), "utf8"), cipher.final()]).toString("base64"),
+		iv: iv.toString("base64"),
+		schemaVersion: PLATFORM_RECOVERY_ENVELOPE_VERSION,
+		tag: cipher.getAuthTag().toString("base64")
+	});
+}
+function recoveryAad(manifest, kind) {
+	return Buffer.from(`void-platform-recovery-v1\0${manifest.account.id}\0${manifest.id}\0${manifest.ownershipNonce}\0${kind}`);
+}
+function platformRecoveryKey(directory, create) {
+	const fromEnvironment = process.env.VOID_PLATFORM_RECOVERY_KEY;
+	if (fromEnvironment) return parseRecoveryKey(fromEnvironment, "VOID_PLATFORM_RECOVERY_KEY");
+	const account = `recovery:${createHash("sha256").update(resolve(directory)).digest("hex")}`;
+	const saved = readKeyringPassword(PLATFORM_RECOVERY_KEYRING_SERVICE, account);
+	if (saved) return parseRecoveryKey(saved, "system keychain recovery key");
+	if (!create) return null;
+	const generated = randomBytes(32);
+	if (!writeKeyringPassword(PLATFORM_RECOVERY_KEYRING_SERVICE, account, generated.toString("base64"))) throw new Error("platform: The system keychain is unavailable. Refusing to write platform secrets to disk. Configure a system keychain or set a base64-encoded 32-byte VOID_PLATFORM_RECOVERY_KEY from your secret manager.");
+	return generated;
+}
+function parseRecoveryKey(value, name) {
+	const key = Buffer.from(value, "base64");
+	if (key.byteLength !== 32 || key.toString("base64") !== value) throw new Error(`platform: ${name} must be a canonical base64-encoded 32-byte key.`);
+	return key;
+}
+function parseRecoveryEnvelope(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("encrypted recovery envelope must be an object");
+	const envelope = value;
+	if (envelope.schemaVersion !== PLATFORM_RECOVERY_ENVELOPE_VERSION || envelope.algorithm !== "aes-256-gcm" || typeof envelope.ciphertext !== "string" || typeof envelope.iv !== "string" || typeof envelope.tag !== "string") throw new Error("encrypted recovery envelope is invalid");
+	if (Buffer.from(envelope.iv, "base64").byteLength !== 12) throw new Error("encrypted recovery IV is invalid");
+	if (Buffer.from(envelope.tag, "base64").byteLength !== 16) throw new Error("encrypted recovery tag is invalid");
+	return envelope;
+}
+function parseRecoveryValues(value, name) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${name} must be an object`);
+	const entries = Object.entries(value);
+	if (entries.some(([, entry]) => typeof entry !== "string")) throw new Error(`${name} values must be strings`);
+	return Object.fromEntries(entries);
+}
+function removePlatformConnectionForInstallation(installationId, directory = platformRegistryDirectory()) {
+	withRegistryLock(directory, () => {
+		const current = readRegistry(directory);
+		const connections = current.connections.filter((connection) => connection.installationId !== installationId);
+		writeJsonAtomically(join(directory, "registry.json"), {
+			activeConnectionId: current.activeConnectionId && connections.some((connection) => connection.id === current.activeConnectionId) ? current.activeConnectionId : connections[0]?.id ?? null,
+			connections,
+			schemaVersion: 1
+		});
+	});
+}
+//#endregion
 //#region ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 const getCodePointsLength = (() => {
 	const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
@@ -357,7 +787,7 @@ function wrapAnsi(string, columns, options) {
 	return String(string).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join("\n");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@clack+core@1.4.3/node_modules/@clack/core/dist/index.mjs
+//#region ../../node_modules/.pnpm/@clack+core@1.5.0/node_modules/@clack/core/dist/index.mjs
 var import_src = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const ESC = "\x1B";
 	const CSI = `${ESC}[`;
@@ -438,6 +868,7 @@ const settings = {
 		error: "Something went wrong"
 	},
 	withGuide: true,
+	accessible: void 0,
 	date: {
 		monthNames: [...[
 			"January",
@@ -462,6 +893,12 @@ const settings = {
 		}
 	}
 };
+function isAccessible(n) {
+	if (n !== void 0) return n;
+	if (settings.accessible !== void 0) return settings.accessible;
+	const e = process.env.ACCESSIBLE;
+	return e !== void 0 && e !== "" && e !== "0" && e !== "false";
+}
 function isActionKey(n, e) {
 	if (typeof n == "string") return settings.aliases.get(n) === e;
 	for (const s of n) if (s !== void 0 && isActionKey(s, e)) return true;
@@ -489,7 +926,7 @@ function setRawMode(e, r) {
 	const o = e;
 	o.isTTY && o.setRawMode(r);
 }
-function block({ input: e = stdin, output: r = stdout, overwrite: o = true, hideCursor: t = true } = {}) {
+function block({ input: e = stdin, output: r = stdout, overwrite: o = true, hideCursor: n = true } = {}) {
 	const s = l.createInterface({
 		input: e,
 		output: r,
@@ -497,48 +934,48 @@ function block({ input: e = stdin, output: r = stdout, overwrite: o = true, hide
 		tabSize: 1
 	});
 	l.emitKeypressEvents(e, s), e instanceof ReadStream && e.isTTY && e.setRawMode(true);
-	const n = (f, { name: a, sequence: p }) => {
+	const t = (f, { name: a, sequence: w }) => {
 		if (isActionKey([
 			String(f),
 			a,
-			p
+			w
 		], "cancel")) {
-			t && r.write(import_src.cursor.show), process.exit(0);
+			n && r.write(import_src.cursor.show), process.exit(0);
 			return;
 		}
 		if (!o) return;
 		const i = a === "return" ? 0 : -1, m = a === "return" ? -1 : 0;
 		l.moveCursor(r, i, m, () => {
 			l.clearLine(r, 1, () => {
-				e.once("keypress", n);
+				e.once("keypress", t);
 			});
 		});
 	};
-	return t && r.write(import_src.cursor.hide), e.once("keypress", n), () => {
-		e.off("keypress", n), t && r.write(import_src.cursor.show), e instanceof ReadStream && e.isTTY && !R && e.setRawMode(false), s.terminal = false, s.close();
+	return n && r.write(import_src.cursor.hide), e.once("keypress", t), () => {
+		e.off("keypress", t), n && r.write(import_src.cursor.show), e instanceof ReadStream && e.isTTY && !R && e.setRawMode(false), s.terminal = false, s.close();
 	};
 }
-const getColumns = (e) => "columns" in e && typeof e.columns == "number" ? e.columns : 80, getRows = (e) => "rows" in e && typeof e.rows == "number" ? e.rows : 20;
-function wrapTextWithPrefix(e, r, o, t = o, s = o, n) {
+const getColumns = (e) => "columns" in e && typeof e.columns == "number" ? e.columns : 80;
+const getRows = (e) => "rows" in e && typeof e.rows == "number" ? e.rows : 20;
+function wrapTextWithPrefix(e, r, o, n = o, s = o, t) {
 	return wrapAnsi(r, getColumns(e ?? stdout) - o.length, {
 		hard: true,
 		trim: false
 	}).split(`
 `).map((c, i, m) => {
-		const d = n ? n(c, i) : c;
-		return i === 0 ? `${t}${d}` : i === m.length - 1 ? `${s}${d}` : `${o}${d}`;
+		const d = t ? t(c, i) : c;
+		return i === 0 ? `${n}${d}` : i === m.length - 1 ? `${s}${d}` : `${o}${d}`;
 	}).join(`
 `);
 }
-function runValidation(e, n) {
+function runValidation(e, a) {
 	if ("~standard" in e) {
-		const a = e["~standard"].validate(n);
-		if (a instanceof Promise) throw new TypeError("Schema validation must be synchronous. Update `validate()` and remove any asynchronous logic.");
-		return a.issues?.at(0)?.message;
+		const n = e["~standard"].validate(a);
+		return n instanceof Promise ? n.then((r) => r.issues?.at(0)?.message) : n.issues?.at(0)?.message;
 	}
-	return e(n);
+	return e(a);
 }
-var V = class {
+var y = class {
 	input;
 	output;
 	_abortSignal;
@@ -553,9 +990,17 @@ var V = class {
 	error = "";
 	value;
 	userInput = "";
+	/**
+	* Whether accessible (static, screen-reader friendly) output is enabled for
+	* this prompt, resolved from the `accessible` option, the global setting,
+	* and the `ACCESSIBLE` env var.
+	*/
+	get accessible() {
+		return isAccessible(this.opts.accessible);
+	}
 	constructor(t, e = true) {
-		const { input: i = stdin, output: n = stdout, render: s, signal: r, ...o } = t;
-		this.opts = o, this.onKeypress = this.onKeypress.bind(this), this.close = this.close.bind(this), this.render = this.render.bind(this), this._render = s.bind(this), this._track = e, this._abortSignal = r, this.input = i, this.output = n;
+		const { input: i = stdin, output: s = stdout, render: r, signal: n, ...o } = t;
+		this.opts = o, this.onKeypress = this.onKeypress.bind(this), this.close = this.close.bind(this), this.render = this.render.bind(this), this._render = r.bind(this), this._track = e, this._abortSignal = n, this.input = i, this.output = s;
 	}
 	/**
 	* Unsubscribe all listeners
@@ -596,9 +1041,9 @@ var V = class {
 	* @param data - The data to pass to the callback
 	*/
 	emit(t, ...e) {
-		const i = this._subscribers.get(t) ?? [], n = [];
-		for (const s of i) s.cb(...e), s.once && n.push(() => i.splice(i.indexOf(s), 1));
-		for (const s of n) s();
+		const i = this._subscribers.get(t) ?? [], s = [];
+		for (const r of i) r.cb(...e), r.once && s.push(() => i.splice(i.indexOf(r), 1));
+		for (const r of s) r();
 	}
 	prompt() {
 		return new Promise((t) => {
@@ -639,22 +1084,25 @@ var V = class {
 			name: "u"
 		}), this._setUserInput("");
 	}
-	onKeypress(t, e) {
-		if (this._track && e.name !== "return" && (e.name && this._isActionKey(t, e) && this.rl?.write(null, {
-			ctrl: true,
-			name: "h"
-		}), this._cursor = this.rl?.cursor ?? 0, this._setUserInput(this.rl?.line)), this.state === "error" && (this.state = "active"), e?.name && (!this._track && settings.aliases.has(e.name) && this.emit("cursor", settings.aliases.get(e.name)), settings.actions.has(e.name) && this.emit("cursor", e.name)), t && (t.toLowerCase() === "y" || t.toLowerCase() === "n") && this.emit("confirm", t.toLowerCase() === "y"), this.emit("key", t, e), e?.name === "return" && this._shouldSubmit(t, e)) {
-			if (this.opts.validate) {
-				const i = runValidation(this.opts.validate, this.value);
-				i && (this.error = i instanceof Error ? i.message : i, this.state = "error", this.rl?.write(this.userInput));
+	async onKeypress(t, e) {
+		if (this.state !== "validating") {
+			if (this._track && e.name !== "return" && (e.name && this._isActionKey(t, e) && this.rl?.write(null, {
+				ctrl: true,
+				name: "h"
+			}), this._cursor = this.rl?.cursor ?? 0, this._setUserInput(this.rl?.line)), this.state === "error" && (this.state = "active"), e?.name && (!this._track && settings.aliases.has(e.name) && this.emit("cursor", settings.aliases.get(e.name)), settings.actions.has(e.name) && this.emit("cursor", e.name)), t && (t.toLowerCase() === "y" || t.toLowerCase() === "n") && this.emit("confirm", t.toLowerCase() === "y"), this.emit("key", t, e), e?.name === "return" && this._shouldSubmit(t, e)) {
+				if (this.opts.validate) {
+					const i = runValidation(this.opts.validate, this.value);
+					let s;
+					i instanceof Promise ? (this.state = "validating", this.render(), s = await i) : s = i, s && (this.error = s instanceof Error ? s.message : s, this.state = "error", this.rl?.write(this.userInput));
+				}
+				this.state !== "error" && (this.state = "submit");
 			}
-			this.state !== "error" && (this.state = "submit");
+			isActionKey([
+				t,
+				e?.name,
+				e?.sequence
+			], "cancel") && (this.state = "cancel"), (this.state === "submit" || this.state === "cancel") && this.emit("finalize"), this.render(), (this.state === "submit" || this.state === "cancel") && this.close();
 		}
-		isActionKey([
-			t,
-			e?.name,
-			e?.sequence
-		], "cancel") && (this.state = "cancel"), (this.state === "submit" || this.state === "cancel") && this.emit("finalize"), this.render(), (this.state === "submit" || this.state === "cancel") && this.close();
 	}
 	close() {
 		this.input.unpipe(), this.input.removeListener("keypress", this.onKeypress), this.output.write(`
@@ -678,27 +1126,27 @@ var V = class {
 			else {
 				const e = diffLines(this._prevFrame, t), i = getRows(this.output);
 				if (this.restoreCursor(), e) {
-					const n = Math.max(0, e.numLinesAfter - i), s = Math.max(0, e.numLinesBefore - i);
-					let r = e.lines.find((o) => o >= n);
-					if (r === void 0) {
+					const s = Math.max(0, e.numLinesAfter - i), r = Math.max(0, e.numLinesBefore - i);
+					let n = e.lines.find((o) => o >= s);
+					if (n === void 0) {
 						this._prevFrame = t;
 						return;
 					}
 					if (e.lines.length === 1) {
-						this.output.write(import_src.cursor.move(0, r - s)), this.output.write(import_src.erase.lines(1));
+						this.output.write(import_src.cursor.move(0, n - r)), this.output.write(import_src.erase.lines(1));
 						const o = t.split(`
 `);
-						this.output.write(o[r]), this._prevFrame = t, this.output.write(import_src.cursor.move(0, o.length - r - 1));
+						this.output.write(o[n]), this._prevFrame = t, this.output.write(import_src.cursor.move(0, o.length - n - 1));
 						return;
 					} else if (e.lines.length > 1) {
-						if (n < s) r = n;
+						if (s < r) n = s;
 						else {
-							const h = r - s;
+							const h = n - r;
 							h > 0 && this.output.write(import_src.cursor.move(0, h));
 						}
 						this.output.write(import_src.erase.down());
 						const f = t.split(`
-`).slice(r);
+`).slice(n);
 						this.output.write(f.join(`
 `)), this._prevFrame = t;
 						return;
@@ -710,7 +1158,7 @@ var V = class {
 		}
 	}
 };
-var r = class extends V {
+var r = class extends y {
 	get cursor() {
 		return this.value ? 0 : 1;
 	}
@@ -727,7 +1175,7 @@ var r = class extends V {
 		});
 	}
 };
-let u$1 = class u extends V {
+let u$1 = class u extends y {
 	_mask = "•";
 	get cursor() {
 		return this._cursor;
@@ -753,7 +1201,7 @@ let u$1 = class u extends V {
 		});
 	}
 };
-let n$1 = class n extends V {
+let n$1 = class n extends y {
 	options;
 	cursor = 0;
 	get _selectedValue() {
@@ -773,15 +1221,13 @@ let n$1 = class n extends V {
 					this.cursor = findCursor(this.cursor, -1, this.options);
 					break;
 				case "down":
-				case "right":
-					this.cursor = findCursor(this.cursor, 1, this.options);
-					break;
+				case "right": this.cursor = findCursor(this.cursor, 1, this.options);
 			}
 			this.changeValue();
 		});
 	}
 };
-var n = class extends V {
+var n = class extends y {
 	get userInputWithCursor() {
 		if (this.state === "submit") return this.userInput;
 		const t = this.userInput;
@@ -804,7 +1250,7 @@ var n = class extends V {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@clack+prompts@1.7.0/node_modules/@clack/prompts/dist/index.mjs
+//#region ../../node_modules/.pnpm/@clack+prompts@1.8.0/node_modules/@clack/prompts/dist/index.mjs
 var dist_exports = /* @__PURE__ */ __exportAll({
 	SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
 	S_BAR: () => S_BAR,
@@ -851,15 +1297,41 @@ function isUnicodeSupported() {
 	if (process$1.platform !== "win32") return process$1.env.TERM !== "linux";
 	return Boolean(process$1.env.CI) || Boolean(process$1.env.WT_SESSION) || Boolean(process$1.env.TERMINUS_SUBLIME) || process$1.env.ConEmuTask === "{cmd::Cmder}" || process$1.env.TERM_PROGRAM === "Terminus-Sublime" || process$1.env.TERM_PROGRAM === "vscode" || process$1.env.TERM === "xterm-256color" || process$1.env.TERM === "alacritty" || process$1.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-const unicode = isUnicodeSupported(), isCI = () => process.env.CI === "true", unicodeOr = (o, e) => unicode ? o : e, S_STEP_ACTIVE = unicodeOr("◆", "*"), S_STEP_CANCEL = unicodeOr("■", "x"), S_STEP_ERROR = unicodeOr("▲", "x"), S_STEP_SUBMIT = unicodeOr("◇", "o"), S_BAR_START = unicodeOr("┌", "T"), S_BAR = unicodeOr("│", "|"), S_BAR_END = unicodeOr("└", "—"), S_RADIO_ACTIVE = unicodeOr("●", ">"), S_RADIO_INACTIVE = unicodeOr("○", " "), S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]"), S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]"), S_PASSWORD_MASK = unicodeOr("▪", "•"), S_BAR_H = unicodeOr("─", "-"), S_CORNER_TOP_RIGHT = unicodeOr("╮", "+"), S_CONNECT_LEFT = unicodeOr("├", "+"), S_CORNER_BOTTOM_RIGHT = unicodeOr("╯", "+"), S_CORNER_BOTTOM_LEFT = unicodeOr("╰", "+"), S_INFO = unicodeOr("●", "•"), S_SUCCESS = unicodeOr("◆", "*"), S_WARN = unicodeOr("▲", "!"), S_ERROR = unicodeOr("■", "x"), symbol = (o) => {
+const unicode = isUnicodeSupported();
+const isCI = () => process.env.CI === "true";
+const unicodeOr = (o, e) => unicode ? o : e;
+const S_STEP_ACTIVE = unicodeOr("◆", "*");
+const S_STEP_CANCEL = unicodeOr("■", "x");
+const S_STEP_ERROR = unicodeOr("▲", "x");
+const S_STEP_SUBMIT = unicodeOr("◇", "o");
+const S_BAR_START = unicodeOr("┌", "T");
+const S_BAR = unicodeOr("│", "|");
+const S_BAR_END = unicodeOr("└", "—");
+const S_RADIO_ACTIVE = unicodeOr("●", ">");
+const S_RADIO_INACTIVE = unicodeOr("○", " ");
+const S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]");
+const S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]");
+const S_PASSWORD_MASK = unicodeOr("▪", "•");
+const S_BAR_H = unicodeOr("─", "-");
+const S_CORNER_TOP_RIGHT = unicodeOr("╮", "+");
+const S_CONNECT_LEFT = unicodeOr("├", "+");
+const S_CORNER_BOTTOM_RIGHT = unicodeOr("╯", "+");
+const S_CORNER_BOTTOM_LEFT = unicodeOr("╰", "+");
+const S_INFO = unicodeOr("●", "•");
+const S_SUCCESS = unicodeOr("◆", "*");
+const S_WARN = unicodeOr("▲", "!");
+const S_ERROR = unicodeOr("■", "x");
+const symbol = (o) => {
 	switch (o) {
 		case "initial":
 		case "active": return styleText("cyan", S_STEP_ACTIVE);
 		case "cancel": return styleText("red", S_STEP_CANCEL);
 		case "error": return styleText("yellow", S_STEP_ERROR);
 		case "submit": return styleText("green", S_STEP_SUBMIT);
+		case "validating": return styleText("dim", S_STEP_ACTIVE);
 	}
-}, symbolBar = (o) => {
+};
+const symbolBar = (o) => {
 	switch (o) {
 		case "initial":
 		case "active": return styleText("cyan", S_BAR);
@@ -1001,18 +1473,21 @@ const cancel = (o = "", t) => {
 	i.write(`${e}${styleText("red", o)}
 
 `);
-}, intro = (o = "", t) => {
+};
+const intro = (o = "", t) => {
 	const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText("gray", S_BAR_START)}  ` : "";
 	i.write(`${e}${o}
 `);
-}, outro = (o = "", t) => {
+};
+const outro = (o = "", t) => {
 	const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText("gray", S_BAR)}
 ${styleText("gray", S_BAR_END)}  ` : "";
 	i.write(`${e}${o}
 
 `);
 };
-const W$1 = (o) => o, C = (o, e, s) => {
+const W$1 = (o) => o;
+const C = (o, e, s) => {
 	const a = {
 		hard: true,
 		trim: false
@@ -1200,110 +1675,48 @@ ${b}
 	}).prompt();
 };
 `${styleText("gray", S_BAR)}`;
-const text = (e) => new n({
-	validate: e.validate,
-	placeholder: e.placeholder,
-	defaultValue: e.defaultValue,
-	initialValue: e.initialValue,
-	output: e.output,
-	signal: e.signal,
-	input: e.input,
+const text = (t) => new n({
+	validate: t.validate,
+	placeholder: t.placeholder,
+	defaultValue: t.defaultValue,
+	initialValue: t.initialValue,
+	output: t.output,
+	signal: t.signal,
+	input: t.input,
 	render() {
-		const i = e?.withGuide ?? settings.withGuide, s = `${`${i ? `${styleText("gray", S_BAR)}
-` : ""}${symbol(this.state)}  `}${e.message}
-`, c = e.placeholder && e.placeholder.length > 0 ? styleText("inverse", e.placeholder[0]) + styleText("dim", e.placeholder.slice(1)) : styleText(["inverse", "hidden"], "_"), o = this.userInput ? this.userInputWithCursor : c, l = this.value ?? "";
+		const r = t?.withGuide ?? settings.withGuide, l = `${`${r ? `${styleText("gray", S_BAR)}
+` : ""}${symbol(this.state)}  `}${t.message}
+`, d = t.placeholder && t.placeholder.length > 0 ? styleText("inverse", t.placeholder[0]) + styleText("dim", t.placeholder.slice(1)) : styleText(["inverse", "hidden"], "_"), o = this.userInput ? this.userInputWithCursor : d, s = this.value ?? "";
 		switch (this.state) {
+			case "validating": {
+				const n = r ? `${styleText("cyan", S_BAR)}  ` : "", i = r ? styleText("cyan", S_BAR_END) : "";
+				return `${l}${n}${styleText("dim", o)}
+${i}  ${styleText("dim", "Validating...")}
+`;
+			}
 			case "error": {
-				const n = this.error ? `  ${styleText("yellow", this.error)}` : "", r = i ? `${styleText("yellow", S_BAR)}  ` : "", d = i ? styleText("yellow", S_BAR_END) : "";
-				return `${s.trim()}
-${r}${o}
-${d}${n}
+				const n = this.error ? `  ${styleText("yellow", this.error)}` : "", i = r ? `${styleText("yellow", S_BAR)}  ` : "", c = r ? styleText("yellow", S_BAR_END) : "";
+				return `${l.trim()}
+${i}${o}
+${c}${n}
 `;
 			}
 			case "submit": {
-				const n = l ? `  ${styleText("dim", l)}` : "";
-				return `${s}${i ? styleText("gray", S_BAR) : ""}${n}`;
+				const n = s ? `${r ? "  " : ""}${styleText("dim", s)}` : "";
+				return `${l}${r ? styleText("gray", S_BAR) : ""}${n}`;
 			}
 			case "cancel": {
-				const n = l ? `  ${styleText(["strikethrough", "dim"], l)}` : "", r = i ? styleText("gray", S_BAR) : "";
-				return `${s}${r}${n}${l.trim() ? `
-${r}` : ""}`;
+				const n = s ? `  ${styleText(["strikethrough", "dim"], s)}` : "", i = r ? styleText("gray", S_BAR) : "";
+				return `${l}${i}${n}${s.trim() ? `
+${i}` : ""}`;
 			}
-			default: return `${s}${i ? `${styleText("cyan", S_BAR)}  ` : ""}${o}
-${i ? styleText("cyan", S_BAR_END) : ""}
+			default: return `${l}${r ? `${styleText("cyan", S_BAR)}  ` : ""}${o}
+${r ? styleText("cyan", S_BAR_END) : ""}
 `;
 		}
 	}
 }).prompt();
 //#endregion
-//#region src/cli/output.ts
-var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
-/**
-* CI-safe spinner wrapper. In CI environments (GitHub Actions, etc.),
-* `@clack/prompts` spinner emits DEC Private Mode cursor hide/show codes
-* (`\x1b[?25l` / `\x1b[?25h`) that render as text artifacts. This wrapper
-* replaces the spinner with plain log output in CI.
-*/
-function createSpinner() {
-	if (!isCI()) return spinner();
-	let currentMessage = "";
-	return {
-		start(msg = "") {
-			currentMessage = msg;
-			if (msg) log.step(msg);
-		},
-		stop(msg = "") {
-			if (msg) log.info(msg);
-		},
-		message(msg = "") {
-			if (msg && msg !== currentMessage) {
-				currentMessage = msg;
-				log.step(msg);
-			}
-		},
-		cancel(msg = "") {
-			if (msg) log.warn(msg);
-		},
-		error(msg = "") {
-			if (msg) log.error(msg);
-		},
-		clear() {},
-		get isCancelled() {
-			return false;
-		}
-	};
-}
-function cliTitle(command) {
-	return import_picocolors.default.blue(`void ${command}`);
-}
-function sectionTitle(title) {
-	return import_picocolors.default.reset(import_picocolors.default.blue(title));
-}
-function categoryTitle(title) {
-	return import_picocolors.default.reset(import_picocolors.default.bold(import_picocolors.default.cyan(title)));
-}
-function dim(text) {
-	return import_picocolors.default.dim(text);
-}
-function tablePrefix() {
-	return `${import_picocolors.default.gray("│")}  `;
-}
-function helpLine(command, description) {
-	return `${import_picocolors.default.reset(command.padEnd(34))} ${import_picocolors.default.dim(description)}`;
-}
-/**
-* Ensure a timestamp string will be parsed as UTC by `new Date()`.
-* DB timestamps lack timezone info — appends 'Z' only when no
-* existing indicator (Z, z, or numeric offset) is present.
-*/
-function ensureUtc(s) {
-	const last = s.at(-1);
-	if (last === "Z" || last === "z") return s;
-	if (s.includes("+", 10)) return s;
-	if (s.lastIndexOf("-") > 9) return s;
-	return s + "Z";
-}
-//#endregion
 //#region src/cli/agents.ts
 function getPackageDir() {
 	let dir = join(fileURLToPath(import.meta.url), "..");
@@ -1319,136 +1732,188 @@ const agents = {
 	"claude-code": {
 		displayName: "Claude Code",
 		skillsDir: ".claude/skills",
-		detect: (root) => existsSync(join(root, ".claude")) || existsSync(join(root, "CLAUDE.md")),
-		mcpConfig: [{
-			filePath: ".claude/settings.json",
-			rootKey: "mcpServers"
-		}, {
-			filePath: ".claude/settings.local.json",
-			rootKey: "mcpServers"
-		}]
+		detect: (root) => existsSync(join(root, ".claude")) || existsSync(join(root, "CLAUDE.md"))
 	},
 	amp: {
 		displayName: "Amp",
 		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".agents")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".agents"))
 	},
 	codex: {
 		displayName: "Codex",
 		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".codex")),
-		mcpHint: "codex mcp add void -- npx void mcp"
+		detect: (root) => existsSync(join(root, ".codex"))
 	},
 	cursor: {
 		displayName: "Cursor",
 		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".cursor")),
-		mcpConfig: [{
-			filePath: ".cursor/mcp.json",
-			rootKey: "mcpServers"
-		}]
+		detect: (root) => existsSync(join(root, ".cursor"))
 	},
 	windsurf: {
 		displayName: "Windsurf",
 		skillsDir: ".windsurf/skills",
-		detect: (root) => existsSync(join(root, ".windsurf")),
-		mcpConfig: [{
-			filePath: ".windsurf/mcp.json",
-			rootKey: "mcpServers"
-		}]
+		detect: (root) => existsSync(join(root, ".windsurf"))
 	},
 	"gemini-cli": {
 		displayName: "Gemini CLI",
 		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".gemini")),
-		mcpHint: "gemini mcp add void -- npx void mcp"
+		detect: (root) => existsSync(join(root, ".gemini"))
 	},
 	"github-copilot": {
 		displayName: "GitHub Copilot",
 		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".github", "copilot-instructions.md")) || existsSync(join(root, ".vscode", "mcp.json")),
-		mcpConfig: [{
-			filePath: ".vscode/mcp.json",
-			rootKey: "servers",
-			extraFields: { type: "stdio" }
-		}]
+		detect: (root) => existsSync(join(root, ".github", "copilot-instructions.md"))
 	},
 	cline: {
 		displayName: "Cline",
 		skillsDir: ".cline/skills",
-		detect: (root) => existsSync(join(root, ".cline")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".cline"))
 	},
 	roo: {
 		displayName: "Roo Code",
 		skillsDir: ".roo/skills",
-		detect: (root) => existsSync(join(root, ".roo")),
-		mcpConfig: [{
-			filePath: ".roo/mcp.json",
-			rootKey: "mcpServers"
-		}]
+		detect: (root) => existsSync(join(root, ".roo"))
 	},
 	kilo: {
 		displayName: "Kilo Code",
 		skillsDir: ".kilocode/skills",
-		detect: (root) => existsSync(join(root, ".kilocode")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".kilocode"))
 	},
 	continue: {
 		displayName: "Continue",
 		skillsDir: ".continue/skills",
-		detect: (root) => existsSync(join(root, ".continue")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".continue"))
 	},
 	goose: {
 		displayName: "Goose",
 		skillsDir: ".goose/skills",
-		detect: (root) => existsSync(join(root, ".goose")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".goose"))
 	},
 	opencode: {
 		displayName: "OpenCode",
 		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".opencode")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".opencode"))
 	},
 	trae: {
 		displayName: "Trae",
 		skillsDir: ".trae/skills",
-		detect: (root) => existsSync(join(root, ".trae")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".trae"))
 	},
 	junie: {
 		displayName: "Junie",
 		skillsDir: ".junie/skills",
-		detect: (root) => existsSync(join(root, ".junie")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".junie"))
 	},
 	"kiro-cli": {
 		displayName: "Kiro CLI",
 		skillsDir: ".kiro/skills",
-		detect: (root) => existsSync(join(root, ".kiro")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".kiro"))
 	},
 	zencoder: {
 		displayName: "Zencoder",
 		skillsDir: ".zencoder/skills",
-		detect: (root) => existsSync(join(root, ".zencoder")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".zencoder"))
 	},
 	"qwen-code": {
 		displayName: "Qwen Code",
 		skillsDir: ".qwen/skills",
-		detect: (root) => existsSync(join(root, ".qwen")),
-		mcpHint: "Run `npx void mcp` — this starts a stdio MCP server. See your agent's docs for how to add a local MCP server."
+		detect: (root) => existsSync(join(root, ".qwen"))
 	}
 };
-function getAgentById(id) {
-	return agents[id];
-}
 function detectAgents(root) {
 	return Object.values(agents).filter((a) => a.detect(root));
 }
 //#endregion
-export { text as A, dist_exports as C, outro as D, note as E, require_picocolors as M, password as O, confirm as S, log as T, S_RADIO_ACTIVE as _, cliTitle as a, S_STEP_SUBMIT as b, ensureUtc as c, sectionTitle as d, tablePrefix as f, S_CHECKBOX_INACTIVE as g, S_CHECKBOX_ACTIVE as h, categoryTitle as i, isCancel as j, select as k, helpLine as l, S_BAR_END as m, getAgentById as n, createSpinner as o, S_BAR as p, getPackageDir as r, dim as s, detectAgents as t, import_picocolors as u, S_RADIO_INACTIVE as v, intro as w, cancel as x, S_STEP_ACTIVE as y };
+//#region src/cli/cloudflare-user-output.ts
+/**
+* Keep Void's public CLI vocabulary at the product level while preserving real
+* Cloudflare config filenames and environment variables that users may need to
+* inspect. The underlying implementation remains available in source and deploy
+* diagnostics, but normal remediation always points back to Void commands.
+*/
+function formatCloudflareUserMessage(message) {
+	const preserved = [];
+	const protect = (value) => {
+		return `\uE000VOID_CF_TERM_${preserved.push(value) - 1}\uE001`;
+	};
+	let result = message.replace(/(?:[A-Za-z]:)?[^\s`"']*wrangler\.jsonc?/gi, protect).replace(/\bWRANGLER_[A-Z0-9_]+\b/g, protect).replace(/\.wrangler\b/gi, protect).replace(/`wrangler deploy`/gi, "`void deploy --platform cloudflare`").replace(/`wrangler secret list[^`]*`/gi, "`void secret list`").replace(/`wrangler secret put\s+([^`]*)`/gi, "`void secret put $1`").replace(/`wrangler d1 migrations apply[^`]*`/gi, "`void db migrate --remote`").replace(/`wrangler d1 migrations list[^`]*`/gi, "`void db status`").replace(/`wrangler[^`]*`/gi, "the underlying Cloudflare operation").replace(/"wrangler[^"\n]*"/gi, "\"Cloudflare operation\"").replace(/\bwrangler uploader\b/gi, "Cloudflare deployment tool").replace(/\bwrangler (?:CLI|binary|process|child)\b/gi, "Cloudflare deployment tool").replace(/\bwrangler config\b/gi, "Cloudflare config").replace(/\bwrangler\b/gi, "Cloudflare tooling");
+	result = result.replace(/\uE000VOID_CF_TERM_(\d+)\uE001/g, (_match, index) => {
+		return preserved[Number(index)] ?? "";
+	});
+	return result;
+}
+//#endregion
+//#region src/cli/output.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+/** Keep recovery commands on the same CLI when using the local checkout launcher. */
+function cliCommandName() {
+	const entryName = process.argv[1]?.split(/[\\/]/).at(-1);
+	return entryName === "void-dev" || entryName === "void-dev.cmd" ? "void-dev" : "void";
+}
+/**
+* CI-safe spinner wrapper. In CI environments (GitHub Actions, etc.),
+* `@clack/prompts` spinner emits DEC Private Mode cursor hide/show codes
+* (`\x1b[?25l` / `\x1b[?25h`) that render as text artifacts. This wrapper
+* replaces the spinner with plain log output in CI.
+*/
+function createSpinner(options) {
+	if (!isCI()) return spinner(options);
+	let currentMessage = "";
+	return {
+		start(msg = "") {
+			currentMessage = msg;
+			if (msg) log.step(msg);
+		},
+		stop(msg = "") {
+			if (msg) log.info(msg);
+		},
+		message(msg = "") {
+			if (msg && msg !== currentMessage) {
+				currentMessage = msg;
+				log.step(msg);
+			}
+		},
+		cancel(msg = "") {
+			if (msg) log.warn(msg);
+		},
+		error(msg = "") {
+			if (msg) log.error(msg);
+		},
+		clear() {},
+		get isCancelled() {
+			return false;
+		}
+	};
+}
+function cliTitle(command) {
+	return import_picocolors.default.blue(`void ${command}`);
+}
+function sectionTitle(title) {
+	return import_picocolors.default.reset(import_picocolors.default.blue(title));
+}
+function categoryTitle(title) {
+	return import_picocolors.default.reset(import_picocolors.default.bold(import_picocolors.default.cyan(title)));
+}
+function dim(text) {
+	return import_picocolors.default.dim(text);
+}
+function tablePrefix() {
+	return `${import_picocolors.default.gray("│")}  `;
+}
+function helpLine(command, description) {
+	return `${import_picocolors.default.reset(command.padEnd(34))} ${import_picocolors.default.dim(description)}`;
+}
+/**
+* Ensure a timestamp string will be parsed as UTC by `new Date()`.
+* DB timestamps lack timezone info — appends 'Z' only when no
+* existing indicator (Z, z, or numeric offset) is present.
+*/
+function ensureUtc(s) {
+	const last = s.at(-1);
+	if (last === "Z" || last === "z") return s;
+	if (s.includes("+", 10)) return s;
+	if (s.lastIndexOf("-") > 9) return s;
+	return s + "Z";
+}
+//#endregion
+export { resolveInstallationManifest as $, password as A, assertPlatformInstallationSlugAvailable as B, cancel as C, log as D, intro as E, isCancel as F, normalizePlatformApiUrl as G, latestPlatformWorkerCutoverGeneration as H, settings as I, promoteInstallationSecrets as J, platformCredentialAccount as K, u$1 as L, symbol as M, text as N, note as O, CANCEL_SYMBOL as P, removePlatformConnectionForInstallation as Q, wrapAnsi as R, S_STEP_SUBMIT as S, dist_exports as T, listInstallationManifests as U, getActivePlatformConnection as V, listPlatformConnections as W, readPendingInstallationSecrets as X, readInstallationRecoverySecrets as Y, removeInstallationRecoverySecrets as Z, S_CHECKBOX_INACTIVE as _, dim as a, readKeyringPassword as at, S_RADIO_INACTIVE as b, import_picocolors as c, formatCloudflareUserMessage as d, savePlatformConnection as et, detectAgents as f, S_CHECKBOX_ACTIVE as g, S_BAR_END as h, createSpinner as i, deleteKeyringPassword as it, select as j, outro as k, sectionTitle as l, S_BAR as m, cliCommandName as n, writeInstallationManifest as nt, ensureUtc as o, writeKeyringPassword as ot, getPackageDir as p, platformWorkerSecretUpdateIntentState as q, cliTitle as r, writePendingInstallationSecrets as rt, helpLine as s, require_picocolors as st, categoryTitle as t, selectPlatformConnection as tt, tablePrefix as u, S_PASSWORD_MASK as v, confirm as w, S_STEP_ACTIVE as x, S_RADIO_ACTIVE as y, acquirePlatformLifecycleLock as z };