void 0.10.13 → 0.20.1

package/dist/{project-cmd-D_w-4w5B.mjs → project-cmd-Mo0V9yKS.mjs}

@@ -1,5 +1,6 @@
-import { D as outro, T as log, a as cliTitle, f as tablePrefix, s as dim, u as import_picocolors, w as intro } from "./agents-CtgBYqld.mjs";
-import { d as getSiteDomain, f as getToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
+import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle, u as tablePrefix } from "./output-tFQLLj26.mjs";
+import { b as readDeploymentPlatform, c as getToken, s as getSiteDomain } from "./auth-W9WII-mN.mjs";
+import { n as PlatformClient } from "./client-Clirrol3.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -17,7 +18,7 @@ async function runProjectsCommand(root) {
 	const rows = projects.map((p) => ({
 		slug: p.slug,
 		appType: p.type ?? "worker",
-		url: p.custom_domain ? `https://${p.custom_domain}` : `https://${p.slug}.${getSiteDomain(root)}`
+		url: p.custom_domain ? `https://${p.custom_domain}` : p.url ?? `https://${p.slug}.${getSiteDomain(root)}`
 	}));
 	const slugWidth = Math.max(4, ...rows.map((r) => r.slug.length));
 	const typeWidth = Math.max(4, ...rows.map((r) => r.appType.length));
@@ -32,37 +33,49 @@ async function runProjectsCommand(root) {
 //#endregion
 //#region src/cli/project-cmd.ts
 async function runProjectCommand(root, args) {
+	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-CPwFDZ_c.mjs");
+		const { runListCommand } = await import("./list-3F52R_yO.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
-		const { runLink } = await import("./link-CdGHSIy-.mjs");
+		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by the name in wrangler.jsonc and do not need linking.");
+		const { runLink } = await import("./link-RMdgjF1v.mjs");
 		return runLink(root, args.name || void 0);
 	}
-	if (args.subcommand === "list") return runProjectsCommand(root);
+	if (args.subcommand === "list") {
+		if (cloudflare) {
+			const { runListCommand } = await import("./list-3F52R_yO.mjs");
+			return runListCommand(root);
+		}
+		return runProjectsCommand(root);
+	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-Bt313ax7.mjs");
+		const { runLogsCommand } = await import("./logs-DFHHD6wE.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
-		const { runRequestsCommand } = await import("./requests-B8sZxaFM.mjs");
+		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
+		const { runRequestsCommand } = await import("./requests-BcKOVpRg.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-CkvTFXx5.mjs");
+		const { runRollbackCommand } = await import("./rollback-Bx85-0xh.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
-		const { runCancelDeployCommand } = await import("./cancel-deploy-fwFYF04b.mjs");
+		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-CmlAZ9P6.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
-		const { runDeleteCommand } = await import("./delete-mh6p-zkQ.mjs");
+		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
+		const { runDeleteCommand } = await import("./delete-D8GigDk8.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
-		const { runPurgeCacheCommand } = await import("./cache-C11V8Fxq.mjs");
+		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
+		const { runPurgeCacheCommand } = await import("./cache-BlNeQjuP.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/{project-paths-BQd7OmIo.mjs → project-paths-SK8nMHPp.mjs}

@@ -1,4 +1,4 @@
-import { a as join, i as isAbsolute, o as normalize, s as relative } from "./dist-DaKKDf8D.mjs";
+import { a as isAbsolute, c as relative, o as join, s as normalize } from "./dist-BrsS7cai.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/project-paths.ts
 const SOURCE_CONVENTION_DIRECTORIES = [
@@ -7,6 +7,7 @@ const SOURCE_CONVENTION_DIRECTORIES = [
 	"middleware",
 	"crons",
 	"queues",
+	"email",
 	"db"
 ];
 const AUTH_CONFIG_FILES = [
@@ -54,6 +55,7 @@ function resolveProjectPaths(root, config) {
 		middlewareDir: join(sourceRoot, "middleware"),
 		cronsDir: join(sourceRoot, "crons"),
 		queuesDir: join(sourceRoot, "queues"),
+		emailDir: join(sourceRoot, "email"),
 		pagesDir: join(sourceRoot, "pages"),
 		dbDir: join(sourceRoot, "db"),
 		migrationsDir: join(sourceRoot, "db", "migrations"),

package/dist/{project-tsconfig-B-QtXjLQ.mjs → project-tsconfig-Ql2XsSQp.mjs}

@@ -1,5 +1,5 @@
-import { a as join, n as dirname, s as relative } from "./dist-DaKKDf8D.mjs";
-import { n as readProjectPaths } from "./project-paths-BQd7OmIo.mjs";
+import { c as relative, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
+import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/codegen/write-if-changed.ts
 function writeFileIfChanged(path, content) {

package/dist/{protocol-Bnb0LFp3.d.mts → protocol-C-pqYJjE.d.mts}

@@ -1,7 +1,6 @@
-import { n as HeadDescriptor, t as HeadConfig } from "./head-nmvOgFjd.mjs";
-import { n as CloudBindings, r as CloudContext } from "./handler-Cjh8uM3Y.mjs";
-import { a as PageRenderMode, t as DevCssAsset } from "./types-lLjNE9Qp.mjs";
-
+import { n as HeadDescriptor, t as HeadConfig } from "./head-Do8P4puT.mjs";
+import { n as CloudBindings, r as CloudContext } from "./handler-D1hLsObx.mjs";
+import { a as PageRenderMode, t as DevCssAsset } from "./types-BAp5AEBU.mjs";
 //#region src/pages/protocol.d.ts
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */
 declare function safeJsonStringify(value: unknown): string;

package/dist/{provision-CPx2ZxsH.mjs → provision-Blnstcm2.mjs}

@@ -1,15 +1,39 @@
-import { a as join, c as resolve, n as dirname, o as normalize, t as basename } from "./dist-DaKKDf8D.mjs";
-import { b as readProvisionedBindingEntry, f as assertNoDuplicateMembers, w as writeProvisionedWranglerConfig } from "./deploy-jBJT1fUT.mjs";
+import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { l as resolve$2, n as dirname, o as join, s as normalize, t as basename } from "./dist-BrsS7cai.mjs";
+import { _ as readProvisionedBindingEntry, k as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers } from "./wrangler--imS8n0d.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
-import { o as resolveWranglerArgv, u as scanWranglerDotenvKeys } from "./preset-BjyR3lzz.mjs";
+import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
+import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
 import { createRequire } from "node:module";
-import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { types } from "node:util";
 import { parse } from "jsonc-parser";
+import { types } from "node:util";
+import { resolve } from "node:path/posix";
+import { resolve as resolve$1 } from "node:path/win32";
 import lockfile from "proper-lockfile";
 //#region src/cli/provision.ts
+var provision_exports = /* @__PURE__ */ __exportAll({
+	WranglerQuarantineError: () => WranglerQuarantineError,
+	acquireProvisionLock: () => acquireProvisionLock,
+	assertNoTransportRedirectInProjectDotenv: () => assertNoTransportRedirectInProjectDotenv,
+	assertValidResourceName: () => assertValidResourceName,
+	checkCloudflareProvisionDrift: () => checkCloudflareProvisionDrift,
+	createDefaultRunWrangler: () => createDefaultRunWrangler,
+	deleteEnvVarCaseAware: () => deleteEnvVarCaseAware,
+	isAlreadyGoneKillError: () => isAlreadyGoneKillError,
+	isQuarantineError: () => isQuarantineError,
+	isQueueConfirmedAbsent: () => isQueueConfirmedAbsent,
+	isRealD1Id: () => isRealD1Id,
+	isRealKvId: () => isRealKvId,
+	normalizeRunWranglerResult: () => normalizeRunWranglerResult,
+	provisionCloudflareResources: () => provisionCloudflareResources,
+	provisionEnv: () => provisionEnv,
+	resolvePinnedApiBaseUrl: () => resolvePinnedApiBaseUrl,
+	resolveProperLockfileKey: () => resolveProperLockfileKey,
+	scanWranglerDotenvKeys: () => scanWranglerDotenvKeys
+});
 /**
 * Diff the DESIRED id-bearing resources against the ACTUAL bindings in the root
 * wrangler config, WITHOUT any remote/wrangler call. A resource counts as
@@ -23,9 +47,8 @@ import lockfile from "proper-lockfile";
 * Queues are NAME-bearing (no id in the config), so they are NOT part of this
 * id-drift check. A missing config file yields every desired resource as missing.
 *
-* Used by the deploy orchestrator (Task 6) for BOTH the no-`--provision` DRIFT
-* CHECK (any `missing` → guidance error) and the CI `--provision` no-op gate
-* (`missing.length === 0` ⇒ a provable no-op the committed config already covers).
+* Used by the deploy orchestrator to decide whether automatic provisioning is needed
+* and to verify that every id-bearing resource was satisfied afterward.
 * A malformed/duplicate-binding config makes {@link readProvisionedBindingEntry}
 * throw — fail closed, exactly as the provisioner would.
 */
@@ -73,7 +96,7 @@ const KV_ID_PLACEHOLDER = "local";
 const R2_BUCKET_NAME_PLACEHOLDER = "default";
 const D1_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const HEX32_ID_RE = /^[0-9a-f]{32}$/i;
-/** R2 bucket names ARE the identity: wrangler 4.107's `isValidR2BucketName`. */
+/** R2 bucket names ARE the identity: wrangler 4.131's `isValidR2BucketName`. */
 const R2_BUCKET_NAME_RE = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
 /**
 * A D1 `database_id` that is a real (non-placeholder) hyphenated UUID. Exported so
@@ -114,7 +137,7 @@ const defaultLogger = {
 	warn: (msg) => voidWarn(msg)
 };
 /**
-* The transport-redirecting env vars wrangler 4.107 honors. Each can point
+* The transport-redirecting env vars wrangler 4.131 honors. Each can point
 * wrangler's authenticated API transport at a DIFFERENT endpoint (or select a
 * different env-block/account) than the ONE this provision pinned:
 *   - `CLOUDFLARE_API_BASE_URL` / `CF_API_BASE_URL` — override the API base URL directly
@@ -133,7 +156,7 @@ const TRANSPORT_REDIRECT_ENV_VARS = [
 	"CLOUDFLARE_ENV"
 ];
 /**
-* Wrangler 4.107's diagnostic-output sinks that would PERSIST the raw provisioning
+* Wrangler 4.131's diagnostic-output sinks that would PERSIST the raw provisioning
 * argv (including a Hyperdrive connection string, password and all) to disk:
 *   - `WRANGLER_OUTPUT_FILE_PATH` / `WRANGLER_OUTPUT_FILE_DIRECTORY` — when either is set
 *     (`getOutputFilePathFromEnv`/`getOutputFileDirectoryFromEnv`), wrangler's startup
@@ -151,7 +174,7 @@ const TRANSPORT_REDIRECT_ENV_VARS = [
 const OUTPUT_FILE_ENV_VARS = ["WRANGLER_OUTPUT_FILE_PATH", "WRANGLER_OUTPUT_FILE_DIRECTORY"];
 /**
 * Resolve the ONE Cloudflare API base URL this provision is pinned to, mirroring
-* wrangler 4.107's `getCloudflareApiBaseUrl` EXACTLY (wrangler-dist/cli.js) so the
+* wrangler 4.131's `getCloudflareApiBaseUrl` EXACTLY (wrangler-dist/cli.js) so the
 * Hyperdrive REST lister and the spawned wrangler agree on the endpoint:
 *
 *   getCloudflareApiBaseUrl = (complianceConfig) =>
@@ -188,7 +211,7 @@ function resolvePinnedApiBaseUrl(env = process.env, configComplianceRegion) {
 	return `https://api${resolveComplianceRegion(env, configRegion) === "fedramp_high" ? ".fed" : ""}${resolveApiEnvironment(env) === "staging" ? ".staging" : ""}.cloudflare.com/client/v4`;
 }
 /**
-* Mirror wrangler 4.107's `getCloudflareApiEnvironmentFromEnv` (env factory with
+* Mirror wrangler 4.131's `getCloudflareApiEnvironmentFromEnv` (env factory with
 * `choices: ["production", "staging"]`, default `"production"`): an ABSENT variable
 * defaults to production; a PRESENT value outside the choices — `"stagng"`, an empty
 * string — makes wrangler's `assertOneOf` throw, so we fail closed identically instead of
@@ -200,14 +223,14 @@ function resolveApiEnvironment(env) {
 	if (raw !== "production" && raw !== "staging") throw new Error(`provision: the WRANGLER_API_ENVIRONMENT environment variable must be one of "production" or "staging", got ${JSON.stringify(raw)}. wrangler rejects this value, so provisioning refuses to guess an endpoint; fix or unset it and retry.`);
 	return raw;
 }
-/** The compliance-region choices wrangler 4.107 accepts (`getCloudflareComplianceRegionFromEnv`). */
+/** The compliance-region choices wrangler 4.131 accepts (`getCloudflareComplianceRegionFromEnv`). */
 const COMPLIANCE_REGIONS = ["public", "fedramp_high"];
 function assertComplianceChoice(value, source) {
 	if (value !== "public" && value !== "fedramp_high") throw new Error(`provision: ${source} must be one of ${COMPLIANCE_REGIONS.map((c) => JSON.stringify(c)).join(" or ")}, got ${JSON.stringify(value)}.`);
 	return value;
 }
 /**
-* Reconcile the effective Cloudflare compliance region, mirroring wrangler 4.107's
+* Reconcile the effective Cloudflare compliance region, mirroring wrangler 4.131's
 * `getCloudflareComplianceRegion(complianceConfig)` EXACTLY (evaluated only on the
 * DERIVED-base branch — with a direct base override wrangler never calls it):
 *   - reads `CLOUDFLARE_COMPLIANCE_REGION` by PRESENCE and validates it against the
@@ -227,7 +250,7 @@ function resolveComplianceRegion(env, configRegion) {
 	return envRegion ?? configRegion ?? "public";
 }
 /**
-* Mirror wrangler 4.107's `getDefaultEnvFiles(env)`: base `.env`/`.env.local`, then —
+* Mirror wrangler 4.131's `getDefaultEnvFiles(env)`: base `.env`/`.env.local`, then —
 * when the environment argument is DEFINED (we always pass `--env=`, so wrangler sees
 * `args.env === ""`, which is `!== undefined`) — the per-env pair `.env.${env}`/`.env.${env}.local`.
 * With the empty environment those are the empty-env filenames `.env.` and `.env..local`.
@@ -242,7 +265,7 @@ function defaultWranglerEnvFiles(env) {
 }
 /**
 * FAIL CLOSED when the project's dotenv files declare a transport-redirecting
-* variable. wrangler 4.107 reloads `.env`/`.env.local` (and the dev-vars files) from the
+* variable. wrangler 4.131 reloads `.env`/`.env.local` (and the dev-vars files) from the
 * project root into `process.env` on EVERY command with `override: true`, so a repo `.env`
 * setting `CLOUDFLARE_API_BASE_URL` / `WRANGLER_API_ENVIRONMENT` /
 * `CLOUDFLARE_COMPLIANCE_REGION` / `CLOUDFLARE_ENV` would redirect wrangler's authenticated
@@ -277,11 +300,11 @@ function assertNoTransportRedirectInProjectDotenv(root, platform = process.platf
 	}
 }
 /**
-* Child-process env with the CF Access service-token PAIR scrubbed. Mirrors
-* `buildEnv` in `deploy.ts`: a shared, long-lived Access token is needed only by
-* this CLI's own API client and must never leak into the spawned wrangler
-* process (which may in turn run user hooks). The cloudflared `CF_ACCESS_TOKEN`
-* JWT (dev path) is left untouched.
+* Child-process env with every CF Access credential scrubbed. Mirrors `buildEnv`
+* in `deploy.ts`: Access credentials are needed only by this CLI's own guarded
+* HTTP requests and must never leak into the spawned wrangler process (which may
+* in turn run user hooks). This includes the short-lived cloudflared
+* `CF_ACCESS_TOKEN` JWT used by local readiness probes.
 *
 * Pins ONE transport context: scrubs every {@link TRANSPORT_REDIRECT_ENV_VARS}
 * from the child env, then re-sets `CLOUDFLARE_API_BASE_URL` to the SINGLE resolved
@@ -315,6 +338,7 @@ function provisionEnv(ctx) {
 	const scrub = (name) => deleteEnvVarCaseAware(env, name, platform);
 	scrub("CF_ACCESS_CLIENT_ID");
 	scrub("CF_ACCESS_CLIENT_SECRET");
+	scrub("CF_ACCESS_TOKEN");
 	for (const name of TRANSPORT_REDIRECT_ENV_VARS) scrub(name);
 	for (const name of OUTPUT_FILE_ENV_VARS) scrub(name);
 	scrub("WRANGLER_LOG_SANITIZE");
@@ -1185,7 +1209,7 @@ function canonicalizeConfigPath(absoluteConfigPath, depth = 0) {
 	if (linkStat?.isSymbolicLink()) {
 		if (depth >= 40) throw Object.assign(/* @__PURE__ */ new Error(`ELOOP: too many symbolic links while resolving "${absoluteConfigPath}"`), { code: "ELOOP" });
 		const target = readlinkSync(absoluteConfigPath);
-		return canonicalizeConfigPath(resolve(dirname(absoluteConfigPath), target), depth + 1);
+		return canonicalizeConfigPath(resolve$2(dirname(absoluteConfigPath), target), depth + 1);
 	}
 	const dir = dirname(absoluteConfigPath);
 	try {
@@ -1252,13 +1276,26 @@ function normalizeLockRetries(retries) {
 	};
 }
 /**
+* Match the key spelling `proper-lockfile` stores when `realpath: false`.
+*
+* The library uses the host's native `node:path.resolve`, including backslashes on
+* Windows. Most Void paths intentionally use `pathslash`, but its forward-slash output
+* cannot address `proper-lockfile`'s internal registry on Windows.
+*/
+function resolveProperLockfileKey(file, platform = process.platform) {
+	return platform === "win32" ? resolve$1(file) : resolve(file);
+}
+/**
 * Acquire the cross-process provision lock over the resolved config path via
 * `proper-lockfile` (an atomic `mkdir`-based mutex at `<configPath>.void-provision.lock.lock`).
-* `proper-lockfile` requires the locked pathname to EXIST, so we lock a DEDICATED
-* adjacent marker file (`<configPath>.void-provision.lock`), creating it if absent —
-* never the real config, so the writer's missing-vs-empty config semantics stay
-* untouched. Returns a handle whose `release()` drops the mutex; ALWAYS call it in a
-* `finally` so an interruption never leaks the lock.
+* The library normally realpaths the pathname being locked, which requires it to exist.
+* Both lock identities here are deliberately SYNTHETIC adjacent paths, so acquisition
+* passes `realpath: false`: proper-lockfile resolves the identity lexically and creates
+* only its temporary mutex directory — never an empty marker file in the user's project.
+* This is safe because the config path was already canonicalized (including missing-file
+* and symlink cases) before reaching this function. It also preserves the writer's
+* missing-vs-empty config semantics. Returns a handle whose `release()` drops the mutex;
+* ALWAYS call it in a `finally` so an interruption never leaks the lock.
 *
 * `onCompromised` FAILS CLOSED (re-throws): if the lock is ever detected stolen (its
 * mtime changed, or the mutex vanished under a live owner), provisioning must NEVER
@@ -1288,8 +1325,6 @@ function normalizeLockRetries(retries) {
 async function acquireProvisionLock(configPath, lockOptions) {
 	const lockTarget = `${configPath}.void-provision.lock`;
 	const recoveryTarget = `${lockTarget}.recovery`;
-	if (!existsSync(lockTarget)) writeFileSync(lockTarget, "");
-	if (!existsSync(recoveryTarget)) writeFileSync(recoveryTarget, "");
 	const staleMs = lockOptions?.stale ?? LOCK_STALE_MS;
 	const retryCfg = normalizeLockRetries(lockOptions?.retries);
 	const isElocked = (error) => error?.code === "ELOCKED";
@@ -1298,6 +1333,7 @@ async function acquireProvisionLock(configPath, lockOptions) {
 		stale: staleMs,
 		update: lockOptions?.update ?? LOCK_UPDATE_MS,
 		retries: 0,
+		realpath: false,
 		...lockOptions?.fs !== void 0 ? { fs: lockOptions.fs } : {},
 		onCompromised: (error) => {
 			throw error;
@@ -1306,6 +1342,7 @@ async function acquireProvisionLock(configPath, lockOptions) {
 	const acquireRecoveryOnce = () => lockfile.lock(recoveryTarget, {
 		stale: RECOVERY_LOCK_STALE_MS,
 		retries: 0,
+		realpath: false,
 		onCompromised: (error) => {
 			throw error;
 		}
@@ -1375,12 +1412,7 @@ async function acquireProvisionLock(configPath, lockOptions) {
 			releasePromise = Promise.resolve();
 			const locks = loadProperLockfileInternals()?.getLocks?.();
 			if (!locks) return;
-			let key;
-			try {
-				key = realpathSync(lockTarget);
-			} catch {
-				key = resolve(lockTarget);
-			}
+			const key = resolveProperLockfileKey(lockTarget);
 			const tracked = locks[key];
 			if (tracked) {
 				tracked.released = true;
@@ -1600,7 +1632,7 @@ function isQueueConfirmedAbsent(result, name) {
 * `code === null → exit(0)`), so a KILLED probe/create can surface a clean exit 0
 * with empty/partial output. A bare clean 0 is therefore NOT proof the queue exists.
 * We require BOTH a clean success (numeric exit 0, no signal/spawn error — the
-* provenance rule) AND the output to name THIS exact queue: wrangler 4.107's
+* provenance rule) AND the output to name THIS exact queue: wrangler 4.131's
 * `queues info` prints `Queue Name: <queue_name>` for the queue it fetched by name
 * (account-unique), so an exact `Queue Name: <name>` line is the positive signal.
 * Used for BOTH the reuse probe and the post-create verify probe.
@@ -1622,7 +1654,7 @@ function assertD1MigrationsDirApplied(result, binding, configPath) {
 }
 /**
 * Backstop — verify a create's POSTCONDITION, RESOURCE-SPECIFICALLY + identity
-* checked. wrangler 4.107's `bin.wrangler` is a WRAPPER that spawns
+* checked. wrangler 4.131's `bin.wrangler` is a WRAPPER that spawns
 * `wrangler-dist/cli.js` and maps a signal-killed child (`code === null`) to
 * `process.exit(0)`, so `spawnSync` can see a `create` report "success" though the
 * real CLI was killed and `--update-config` wrote NO id. After every config-writing
@@ -1700,8 +1732,8 @@ const RESOURCE_NAME_GRAMMARS = {
 * violation, before the account gate or any wrangler/REST call.
 *
 * Exported — like {@link isQueueConfirmedAbsent} — so the deploy orchestrator's
-* no-`--provision` queue probe (`cli/deploy.ts`) gates names on the SAME rules this
-* provisioner enforces, instead of only the `--provision` path being protected. Queue names
+* pre-provision queue probe (`cli/deploy.ts`) gates names on the SAME rules this
+* provisioner enforces. Queue names
 * are taken verbatim from filenames with no sanitization, so without this gate a name
 * beginning with `-` reaches wrangler as a FLAG rather than a positional.
 */
@@ -1715,7 +1747,7 @@ function assertValidResourceName(kind, name) {
 * ONCE so no call site can forget them:
 *   - `-c <configPath>` pins the ONE resolved config (no split-brain reads/writes);
 *   - `--env=` (an explicit EMPTY environment) FORCES wrangler onto the top-level
-*     config environment. wrangler 4.107 selects its config env as
+*     config environment. wrangler 4.131 selects its config env as
 *     `args.env ?? getCloudflareEnv()`; passing an explicit empty `args.env`
 *     short-circuits the `??` so a project `.env`/`.env.local` that sets
 *     `CLOUDFLARE_ENV` (reloaded into `process.env` on every wrangler command)
@@ -2063,7 +2095,7 @@ async function provisionCloudflareResources(root, rootWranglerPath, desired, opt
 /** The provision body, run while holding this process's single provision slot. */
 async function provisionWithProcessSlot(root, rootWranglerPath, desired, opts) {
 	await Promise.resolve();
-	const configPath = canonicalizeConfigPath(resolve(root, rootWranglerPath));
+	const configPath = canonicalizeConfigPath(resolve$2(root, rootWranglerPath));
 	const lock = await acquireProvisionLock(configPath, opts?.lockOptions);
 	const quarantineHook = (info) => retainQuarantinedLock(lock, info);
 	activeProvisionQuarantineHook = quarantineHook;
@@ -2110,7 +2142,8 @@ async function provisionWithProcessSlot(root, rootWranglerPath, desired, opts) {
 async function provisionCloudflareResourcesLocked(root, configPath, desired, opts) {
 	if (existsSync(configPath)) {
 		const raw = readFileSync(configPath, "utf-8");
-		assertNoDuplicateMembers(raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw, configPath);
+		const content = raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw;
+		assertNoDuplicateMembers(content, configPath);
 	}
 	if (desired.d1) assertValidResourceName("d1", desired.d1.name);
 	for (const { title } of desired.kvNamespaces) assertValidResourceName("kvTitle", title);
@@ -2136,7 +2169,7 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 		const { binding, name, connectionString } = desired.hyperdrive;
 		const entry = readBindingEntry(configPath, "hyperdrive", binding);
 		if (!(entry !== void 0 && isRealHyperdriveId(entry.id)) && !resolveHyperdriveApiToken(opts?.apiToken)) {
-			if (connectionString) throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and creating it needs a Cloudflare API token. wrangler exposes no machine-readable Hyperdrive list, so Void checks the account over the Cloudflare REST API, which a "wrangler login" (OAuth) session cannot authenticate. Without that check a create would silently duplicate an existing same-named config, so nothing was provisioned. Either (a) export CLOUDFLARE_API_TOKEN with Hyperdrive edit permission and rerun, or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs no token.`);
+			if (connectionString) throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and creating it needs a Cloudflare API token. wrangler exposes no machine-readable Hyperdrive list, so Void checks the account over the Cloudflare REST API, which a Cloudflare browser OAuth cannot authenticate. Without that check a create would silently duplicate an existing same-named config, so nothing was provisioned. Either (a) export CLOUDFLARE_API_TOKEN with Hyperdrive edit permission and rerun, or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs no token.`);
 			throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and there is no DATABASE_URL to create it from. Nothing was provisioned. Either (a) export DATABASE_URL with your PostgreSQL connection string and rerun (Void reads it from the shell — a value in .env/.env.local is NOT used here, so it never ships as a plaintext worker var), or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs neither DATABASE_URL nor an API token.`);
 		}
 	}
@@ -2554,4 +2587,4 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 	};
 }
 //#endregion
-export { WranglerQuarantineError, acquireProvisionLock, assertNoTransportRedirectInProjectDotenv, assertValidResourceName, checkCloudflareProvisionDrift, createDefaultRunWrangler, deleteEnvVarCaseAware, isAlreadyGoneKillError, isQuarantineError, isQueueConfirmedAbsent, isRealD1Id, isRealKvId, normalizeRunWranglerResult, provisionCloudflareResources, provisionEnv, resolvePinnedApiBaseUrl, scanWranglerDotenvKeys };
+export { provision_exports as a, provisionEnv as i, createDefaultRunWrangler as n, resolvePinnedApiBaseUrl as o, deleteEnvVarCaseAware as r, assertNoTransportRedirectInProjectDotenv as t };

package/dist/r2-conditions-D1Wk8i7b.mjs

@@ -0,0 +1,30 @@
+//#region src/runtime/remote/r2-conditions.ts
+function serializeR2Conditional(value) {
+	if (value instanceof Headers) return Array.from(value.entries());
+	return {
+		...value,
+		uploadedBefore: value.uploadedBefore?.toISOString(),
+		uploadedAfter: value.uploadedAfter?.toISOString()
+	};
+}
+function parseR2Conditional(value) {
+	if (Array.isArray(value)) {
+		if (!value.every((pair) => Array.isArray(pair) && pair.length === 2 && pair.every((item) => typeof item === "string"))) throw new Error("Invalid R2 conditional headers");
+		return new Headers(value);
+	}
+	if (!value || typeof value !== "object") throw new Error("Invalid R2 conditional options");
+	const result = {};
+	for (const [key, entry] of Object.entries(value)) if (key === "etagMatches" || key === "etagDoesNotMatch") {
+		if (typeof entry !== "string") throw new Error(`Invalid R2 condition: ${key}`);
+		result[key] = entry;
+	} else if (key === "uploadedBefore" || key === "uploadedAfter") {
+		if (typeof entry !== "string" || !Number.isFinite(Date.parse(entry))) throw new Error(`Invalid R2 condition: ${key}`);
+		result[key] = new Date(entry);
+	} else if (key === "secondsGranularity") {
+		if (typeof entry !== "boolean") throw new Error(`Invalid R2 condition: ${key}`);
+		result[key] = entry;
+	} else throw new Error(`Unsupported R2 condition: ${key}`);
+	return result;
+}
+//#endregion
+export { serializeR2Conditional as n, parseR2Conditional as t };

package/dist/{requests-B8sZxaFM.mjs → requests-BcKOVpRg.mjs}

@@ -1,5 +1,6 @@
-import { D as outro, T as log, a as cliTitle, s as dim, u as import_picocolors, w as intro } from "./agents-CtgBYqld.mjs";
-import { b as readProjectConfig, f as getToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
+import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
+import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
+import { n as PlatformClient } from "./client-Clirrol3.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {
 	console.log();
@@ -27,7 +28,8 @@ async function runRequestsCommand(root, range, status) {
 		process.exit(1);
 	}
 	if (entries.length === 0) {
-		outro(`No requests found in the last ${range}${status ? ` matching status ${status}` : ""}.`);
+		const suffix = status ? ` matching status ${status}` : "";
+		outro(`No requests found in the last ${range}${suffix}.`);
 		return;
 	}
 	for (const entry of entries) printRequest(entry);

package/dist/{resolve-project-BBMtLLV9.mjs → resolve-project--Vxawf7z.mjs}

@@ -1,5 +1,5 @@
-import { n as __exportAll } from "./rolldown-runtime-DJK8HYOj.mjs";
-import { a as join } from "./dist-DaKKDf8D.mjs";
+import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { o as join } from "./dist-BrsS7cai.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/resolve-project.ts
 var resolve_project_exports = /* @__PURE__ */ __exportAll({