void 0.20.0 → 0.20.2

package/dist/index.mjs

@@ -1,26 +1,27 @@
 import { r as __toESM } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { c as relative, l as resolve, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
-import { st as require_picocolors } from "./output-tFQLLj26.mjs";
-import { D as resolveAssetRoutingPolicy, E as hasDocumentRoutes, T as hasApiRoutes, _ as scanDurableObjectModules, c as resolveDistDir, d as generateQueueResolverSource, f as prerenderPages, g as hasRevalidate, h as collectRevalidate, l as resolveWorkerDirName, m as collectPages, p as prerenderPagesNode, v as SEND_EMAIL_BINDING } from "./deploy-CcDoeBIf.mjs";
+import { H as ensurePlatformProxyAccess, ft as require_picocolors } from "./output-B0cfNSx5.mjs";
+import { D as resolveAssetRoutingPolicy, E as hasDocumentRoutes, T as hasApiRoutes, _ as scanDurableObjectModules, c as resolveDistDir, d as generateQueueResolverSource, f as prerenderPages, g as hasRevalidate, h as collectRevalidate, l as resolveWorkerDirName, m as collectPages, p as prerenderPagesNode, v as SEND_EMAIL_BINDING } from "./deploy-DTaWUS1S.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-SK8nMHPp.mjs";
 import { a as scanQueuesSync, c as loadVoidAuthConfig, i as scanWebSocketRoutesSync, n as scanRoutePatternsSync, o as scanJobsSync, r as scanRoutes, s as findVoidAuthConfig, t as scanMiddlewareSync } from "./scan-BMH4rzlv.mjs";
-import { a as getApiUrl, b as readDeploymentPlatform, c as getToken, o as getProxyUrl, u as isStagingMode, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
+import { r as scopedAccessCredentials } from "./cf-access-DRsQRe6k.mjs";
+import { S as readProjectConfig, d as isStagingMode, l as getToken, o as getApiUrl, s as getProxyUrl, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
 import { C as readWranglerWebSocketTombstones, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, M as isSandboxEnabled, P as resolveSandboxConfig, T as syncWranglerBindings, a as LIVE_MIGRATION_TAG, d as ensureWranglerNodejsAlsFlag, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, j as SANDBOX_MIGRATION_TAG, l as ensureWranglerCompat, m as nextDurableObjectMigrationTag, p as hasDurableObjectSqliteMigration, u as ensureWranglerCompatibilityDate, w as resolveLiveBindingConfig, y as readWranglerCompat } from "./wrangler--imS8n0d.mjs";
-import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-BQFq7QvD.mjs";
+import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-uNGuFsI2.mjs";
 import { i as voidWarn, n as voidError, r as voidLog, t as setShowTimestamp } from "./log-ChfPKsVd.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-D8QfRX9Y.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BAHwgHdW.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-Ql2XsSQp.mjs";
 import { a as inferBindingsFromSource, i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, o as walk, r as detectFramework, t as DEFAULT_SCAN_DIRS } from "./plugin-inference-BDRfZngg.mjs";
 import { a as validateSsrEntries, c as isIdentifier, l as isLiteral, n as SSR_SERVER_ENTRY_RELATIVE_PATHS, o as validateSsrEntry, t as SSR_CLIENT_ENTRY_RELATIVE_PATHS, u as isMemberExpression } from "./entry-DU3oDoQ3.mjs";
-import { n as writeLocalD1PersistState, t as resolveLocalD1Target } from "./local-d1-BE8KBbMy.mjs";
+import { n as writeLocalD1PersistState, t as resolveLocalD1Target } from "./local-d1-D2I6Ox5F.mjs";
 import { n as parseDotenvFile } from "./dotenv-VQxupEUv.mjs";
 import { i as generateVoidAuthDrizzleSchema, n as generateQueueTypes, o as DRIZZLE_OPERATORS, r as generateVoidAuthDatabaseModule, s as generateDbDts, t as generateRouteTypes } from "./route-types-Da-DpyUp.mjs";
 import { t as discoverSchema } from "./discover-xvfrgJeo.mjs";
-import { _ as parseCapturedMessage, a as DEV_INBOX_ENV_VAR, c as DEV_INBOX_TOKEN_ENV_VAR, f as clearDevBuffer, g as listDevMessages, l as DEV_INBOX_TOKEN_HEADER, m as findDevMessage, n as DEV_INBOX_ACK_VALUE, o as DEV_INBOX_MAX_CAPTURE_BYTES, s as DEV_INBOX_PREFIX, t as DEV_INBOX_ACK_HEADER, u as DEV_INBOX_TOKEN_QUERY, v as pushToDevBuffer, y as registerEmailSink } from "./dev-inbox-DkgRWLkW.mjs";
+import { _ as parseCapturedMessage, a as DEV_INBOX_ENV_VAR, c as DEV_INBOX_TOKEN_ENV_VAR, f as clearDevBuffer, g as listDevMessages, l as DEV_INBOX_TOKEN_HEADER, m as findDevMessage, n as DEV_INBOX_ACK_VALUE, o as DEV_INBOX_MAX_CAPTURE_BYTES, s as DEV_INBOX_PREFIX, t as DEV_INBOX_ACK_HEADER, u as DEV_INBOX_TOKEN_QUERY, v as pushToDevBuffer, y as registerEmailSink } from "./dev-inbox-P0u4tM8Y.mjs";
 import { t as MagicString } from "./dist-BR1quN_w.mjs";
 import { n as findEnvFileForPaths, r as generateEnvTypes, t as findEnvFile } from "./env-types-BNPhro-M.mjs";
-import { h as loadUserEnvFile } from "./env-validation-ENpMy6Ez.mjs";
-import { a as loadLocalEnv, o as resolveRemoteMode, r as findLegacyEnvFiles, s as stripInternalEnvKeys, t as CLIENT_ENV_PREFIX$2 } from "./env-D4Emu-M_.mjs";
+import { h as loadUserEnvFile } from "./env-validation-CF6KvTRf.mjs";
+import { a as loadLocalEnv, o as resolveRemoteMode, r as findLegacyEnvFiles, s as stripInternalEnvKeys, t as CLIENT_ENV_PREFIX$2 } from "./env-DBKmK4vc.mjs";
 import { i as resolveLayoutIds, o as isRouteEnabledForEnvironment } from "./scan-CpK-57ug.mjs";
 import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email-Ce6SQq-i.mjs";
 import { n as INTERNAL_BINDING_PREFIXES, t as INTERNAL_BINDING_EXACT_NAMES } from "./env-raw-Cx8ElDdj.mjs";
@@ -701,7 +702,7 @@ export function createDb(d1) {
 			const migrationsDir = paths.migrationsDir;
 			if (!(existsSync(migrationsDir) && readdirSync(migrationsDir).some((f) => f.endsWith(".sql")))) {
 				if (dialect === "sqlite") {
-					const { getApplicationTables, getMiniflareDatabasePath } = await import("./local-d1-BE8KBbMy.mjs").then((n) => n.i);
+					const { getApplicationTables, getMiniflareDatabasePath } = await import("./local-d1-D2I6Ox5F.mjs").then((n) => n.i);
 					if ((await getApplicationTables(getMiniflareDatabasePath(options.localD1PersistRoot ?? join(root, ".void"), options.localD1DatabaseId ?? "local")).catch(() => [])).length > 0) return;
 				}
 				voidWarn(`Schema found but no migrations in ${paths.sourceRelative("db/migrations")}/.\n         \`void db push\` syncs the schema to your local DB without creating migration files.
@@ -1982,10 +1983,10 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 						else warn();
 						return;
 					}
-					const { collectMigrations } = await import("./validate-Bihr8WBi.mjs").then((n) => n.l);
-					const { validateMigrations } = await import("./validate-Bihr8WBi.mjs").then((n) => n.i);
+					const { collectMigrations } = await import("./validate-tBBN_dXH.mjs").then((n) => n.l);
+					const { validateMigrations } = await import("./validate-tBBN_dXH.mjs").then((n) => n.i);
 					const allMigrations = collectMigrations(migrationsDir);
-					const appliedNames = dialect === "mysql" ? await import("./runner-mysql-CgRFl3s6.mjs").then((n) => n.n).then((runner) => runner.getMySqlAppliedMigrations(url)) : await import("./runner-pg-DCkWPsWS.mjs").then((n) => n.n).then((runner) => runner.getPgAppliedMigrations(url));
+					const appliedNames = dialect === "mysql" ? await import("./runner-mysql-7BPUNGmL.mjs").then((n) => n.n).then((runner) => runner.getMySqlAppliedMigrations(url)) : await import("./runner-pg-BkEza-dX.mjs").then((n) => n.n).then((runner) => runner.getPgAppliedMigrations(url));
 					const appliedSet = new Set(appliedNames);
 					const pending = allMigrations.filter((migration) => !appliedSet.has(migration.name));
 					if (pending.length > 0) try {
@@ -1993,12 +1994,12 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 					} catch (err) {
 						voidWarn(err instanceof Error ? err.message : String(err));
 					}
-					const applied = dialect === "mysql" ? await import("./runner-mysql-CgRFl3s6.mjs").then((n) => n.n).then((runner) => runner.runMySqlMigrations(migrationsDir, url)) : await import("./runner-pg-DCkWPsWS.mjs").then((n) => n.n).then((runner) => runner.runPgMigrations(migrationsDir, url));
+					const applied = dialect === "mysql" ? await import("./runner-mysql-7BPUNGmL.mjs").then((n) => n.n).then((runner) => runner.runMySqlMigrations(migrationsDir, url)) : await import("./runner-pg-BkEza-dX.mjs").then((n) => n.n).then((runner) => runner.runPgMigrations(migrationsDir, url));
 					if (applied.length > 0) voidLog(`Applied ${applied.length} migration(s): ${applied.join(", ")}`);
 				} else if (hasSqlMigrations) {
-					const { runMigrations, getMiniflareDatabasePath, getAppliedMigrations } = await import("./local-d1-BE8KBbMy.mjs").then((n) => n.i);
-					const { collectMigrations } = await import("./validate-Bihr8WBi.mjs").then((n) => n.l);
-					const { validateMigrations } = await import("./validate-Bihr8WBi.mjs").then((n) => n.i);
+					const { runMigrations, getMiniflareDatabasePath, getAppliedMigrations } = await import("./local-d1-D2I6Ox5F.mjs").then((n) => n.i);
+					const { collectMigrations } = await import("./validate-tBBN_dXH.mjs").then((n) => n.l);
+					const { validateMigrations } = await import("./validate-tBBN_dXH.mjs").then((n) => n.i);
 					const dbPath = getMiniflareDatabasePath(persistRoot, databaseId);
 					const allMigrations = collectMigrations(migrationsDir);
 					const appliedRows = await getAppliedMigrations(dbPath);
@@ -2013,7 +2014,7 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 					if (applied.length > 0) voidLog(`Applied ${applied.length} migration(s): ${applied.join(", ")}`);
 				}
 				if (auth?.enabled) {
-					const { runLocalVoidAuthMigrations } = await import("./node-BkaXcpAc.mjs");
+					const { runLocalVoidAuthMigrations } = await import("./node-Ez5KW5rn.mjs");
 					await runLocalVoidAuthMigrations(root, dialect, persistRoot, databaseId, auth.configPath);
 					voidLog("Applied Better Auth migrations");
 				}
@@ -4116,6 +4117,7 @@ ${renderBlock}
 }`;
 	const internalRouteHelper = `async function __handleInternal(request, env, ctx) {
   const url = new URL(request.url);
+  ${hasEmail ? `if (url.pathname === "/__void/email/receipt/v1") return __handleEmailReceipt(request, env, ctx);` : ""}
   // Readiness probe — platform polls this to confirm the worker is live after WfP upload.
   // Handled here (before app.fetch) so user middleware cannot block it.
   if (request.method === "GET" && url.pathname === "/__void/ready") {
@@ -4144,11 +4146,12 @@ ${envValidateCall}${isrDeploymentStamp}  const userEnv = __filterInternalBinding
 }`;
 	const emailImport = hasEmail ? ", __emailHandler" : "";
 	const emailRuntimePath = runtimeEmailPath ?? deriveEmailRuntimePath(runtimeEnvPath);
-	const emailProxyImport = hasEmail ? `import { createMessageProxy as __createMessageProxy, enactEmailActions as __enactEmailActions, isForwardableEmailMessage as __isForwardableEmailMessage } from ${JSON.stringify(emailRuntimePath)};\n` : "";
+	const emailProxyImport = hasEmail ? `import { createMessageProxy as __createMessageProxy, enactEmailActions as __enactEmailActions, isForwardableEmailMessage as __isForwardableEmailMessage } from ${JSON.stringify(emailRuntimePath)};\nimport { EMAIL_PROTOCOL_VERSION as __EMAIL_PROTOCOL_VERSION, encodeEmailActions as __encodeEmailActions, readEmailEnvelope as __readEmailEnvelope, verifyEmailReceiptThroughProxy as __verifyEmailReceiptThroughProxy } from "void/_email-protocol";\n` : "";
 	const emailHandler = hasEmail ? remotePath ? `async function handleEmail(envelope, env, ctx) {
 ${envValidateCall}  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};
   const userEnv = __filterInternalBindings(env);
-  const __slug = typeof env.__VOID_PROJECT_SLUG === "string" && env.__VOID_PROJECT_SLUG.length > 0 ? env.__VOID_PROJECT_SLUG : undefined;
+  const __relayed = typeof envelope.viaDomain === "string" && envelope.viaDomain.length > 0;
+  const __slug = __relayed ? undefined : (typeof env.__VOID_PROJECT_SLUG === "string" && env.__VOID_PROJECT_SLUG.length > 0 ? env.__VOID_PROJECT_SLUG : undefined);
   const { message, getActions } = __createMessageProxy(envelope, { slug: __slug });
   await __withRawEnv(env, () => withRuntimeEnv(env, () => __emailHandler(message, userEnv, ctx, { slug: __slug })));
   const __actions = getActions();
@@ -4156,25 +4159,55 @@ ${envValidateCall}  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};
   return __actions;
 }` : `async function handleEmail(envelope, env, ctx) {
 ${envValidateCall}  const userEnv = __filterInternalBindings(env);
-  const __slug = typeof env.__VOID_PROJECT_SLUG === "string" && env.__VOID_PROJECT_SLUG.length > 0 ? env.__VOID_PROJECT_SLUG : undefined;
+  const __relayed = typeof envelope.viaDomain === "string" && envelope.viaDomain.length > 0;
+  const __slug = __relayed ? undefined : (typeof env.__VOID_PROJECT_SLUG === "string" && env.__VOID_PROJECT_SLUG.length > 0 ? env.__VOID_PROJECT_SLUG : undefined);
   const { message, getActions } = __createMessageProxy(envelope, { slug: __slug });
   await __withRawEnv(env, () => withRuntimeEnv(env, () => __emailHandler(message, userEnv, ctx, { slug: __slug })));
   const __actions = getActions();
   if (__isForwardableEmailMessage(envelope)) await __enactEmailActions(envelope, __actions);
   return __actions;
+}` : "";
+	const emailReceiptHandler = hasEmail ? `async function __handleEmailReceipt(request, env, ctx) {
+  if (request.method !== "POST" || request.headers.get("content-encoding")) return new Response(null, { status: 404 });
+  const __token = request.headers.get("x-void-email-receipt");
+  const __recipient = request.headers.get("x-void-email-recipient");
+  if (!__token || __token.length > 1536 || !__recipient || __recipient.length > 320 ||
+      !env.__VOID_PROXY_TOKEN || !env.__PROJECT_ID || !env.__VOID_EMAIL_DEPLOYMENT_ID || !env.__VOID_PROXY) {
+    return new Response(null, { status: 404 });
+  }
+  const __verified = await __verifyEmailReceiptThroughProxy(env.__VOID_PROXY, env.__VOID_PROXY_TOKEN, {
+    receipt: __token, projectId: env.__PROJECT_ID,
+    deploymentId: env.__VOID_EMAIL_DEPLOYMENT_ID, recipient: __recipient,
+  });
+  if (!__verified) return new Response(null, { status: 404 });
+  let __envelope;
+  try { __envelope = await __readEmailEnvelope(request.body); }
+  catch { return new Response(null, { status: 400 }); }
+  if (__envelope.to !== __recipient) return new Response(null, { status: 400 });
+  const __actions = await handleEmail(__envelope, env, ctx);
+  return new Response(__encodeEmailActions(__actions), {
+    headers: { "content-type": "application/vnd.void.email-actions; version=" + __EMAIL_PROTOCOL_VERSION,
+      "cache-control": "no-store" },
+  });
 }` : "";
 	const entryImport = `import { WorkerEntrypoint } from "cloudflare:workers";\n`;
 	const fetchDeclaration = `const __voidFetch = ${fetchHandler};`;
 	const entryClass = `export default class extends WorkerEntrypoint {
   async fetch(request) { return __voidFetch(request, this.env, this.ctx); }
   async scheduled(controller) { return handleScheduled(controller, this.env, this.ctx); }
-${hasQueues ? `  async queue(batch) { return __voidQueue(batch, this.env, this.ctx); }\n` : ""}${hasEmail ? `  async email(envelope) { return handleEmail(envelope, this.env, this.ctx); }\n` : ""}}`;
+${hasQueues ? `  async queue(batch) { return __voidQueue(batch, this.env, this.ctx); }\n` : ""}${hasEmail ? `  async email(message) {
+    if (this.env.__VOID_EMAIL_DEPLOYMENT_ID || !__isForwardableEmailMessage(message)) {
+      throw new TypeError("Native email event required");
+    }
+    await handleEmail(message, this.env, this.ctx);
+  }\n` : ""}}`;
 	if (hasQueues) return `${sandboxImport}${entryImport}${liveRuntimeImport}import app, { scheduled, __voidCollectPrerenderPaths, __voidHandleInternalRoute, __withRawEnv, __processQueue${emailImport}${webSocketClasses.length > 0 ? `, ${webSocketClasses.join(", ")}` : ""}${liveRouteImport} } from 'virtual:void-routes';
 ${durableObjectImports}\n${runtimeEnvImport}${emailProxyImport}${envSchemaImport}${remoteImport}${isrImport}${filterBindingsHelper}${assetHelper}
 ${internalRouteHelper}
 ${fetchDeclaration}
 ${scheduledHandler}
 ${emailHandler}
+${emailReceiptHandler}
 async function __voidQueue(batch, env, ctx) {
 ${envValidateCall}${remotePath ? `  if (env.__VOID_REMOTE === "1") env = ${createRemoteEnvCall};\n` : ""}${isrDeploymentStamp}  const userEnv = __filterInternalBindings(env);
   const messages = [...batch.messages].map(m => ({
@@ -4207,6 +4240,7 @@ ${internalRouteHelper}
 ${fetchDeclaration}
 ${scheduledHandler}
 ${emailHandler}
+${emailReceiptHandler}
 ${webSocketClasses.map((name) => `export { ${name} };`).join("\n")}
 ${liveExport}
 ${sandboxExport}
@@ -4995,8 +5029,8 @@ function routingPlugin(root, options) {
 			if (!options.target) {
 				const migrationsDir = paths.migrationsDir;
 				if (existsSync(migrationsDir) || compileOptions.auth) {
-					const { collectMigrations } = await import("./validate-Bihr8WBi.mjs").then((n) => n.l);
-					const { buildMigrationPlanBundle } = await import("./validate-Bihr8WBi.mjs").then((n) => n.s);
+					const { collectMigrations } = await import("./validate-tBBN_dXH.mjs").then((n) => n.l);
+					const { buildMigrationPlanBundle } = await import("./validate-tBBN_dXH.mjs").then((n) => n.s);
 					const migrations = existsSync(migrationsDir) ? collectMigrations(migrationsDir) : [];
 					const dialect = getDatabaseDialect(readConfig(root));
 					compileOptions.migrationHandlerPath = resolveFile(dialect === "postgresql" ? "#self/runtime/migration-handler-pg" : dialect === "mysql" ? "#self/runtime/migration-handler-mysql" : "#self/runtime/migration-handler");
@@ -5521,11 +5555,14 @@ function readVoidDevCredentials(root) {
 		token,
 		staging
 	};
+	const proxyUrl = getProxyUrl(root);
+	ensurePlatformProxyAccess(apiUrl, proxyUrl);
 	return {
 		status: "ok",
 		token,
 		projectId: project.projectId,
-		proxyUrl: getProxyUrl(root),
+		proxyUrl,
+		accessCredentials: scopedAccessCredentials(process.env, proxyUrl),
 		staging
 	};
 }
@@ -5535,9 +5572,9 @@ function readVoidDevCredentials(root) {
 * block the server. On completion, writes project.json and restarts the server.
 */
 async function runAiSetupPrompt(root, token, apiUrl, server) {
-	const { select, text, isCancel, log } = await import("./output-tFQLLj26.mjs").then((n) => n.T);
-	const { PlatformClient } = await import("./client-CyCHWSO_.mjs").then((n) => n.r);
-	const { attachSelectedPlatform, writeProjectConfig } = await import("./auth-W9WII-mN.mjs").then((n) => n.y);
+	const { select, text, isCancel, log } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
+	const { PlatformClient } = await import("./client-dHfSJvAN.mjs").then((n) => n.r);
+	const { attachSelectedPlatform, writeProjectConfig } = await import("./auth-DPl6kck4.mjs").then((n) => n.b);
 	const { inferDefaultSlug } = await import("./resolve-project--Vxawf7z.mjs").then((n) => n.i);
 	const client = new PlatformClient(token, apiUrl);
 	let projects;
@@ -5564,8 +5601,8 @@ async function runAiSetupPrompt(root, token, apiUrl, server) {
 	let projectId;
 	let slug;
 	if (result === "__create__") {
-		const { validateProjectSlug } = await import("./create-project-DMV-csEm.mjs").then((n) => n.a);
-		const { createProjectWithSlugRetry } = await import("./create-project-DMV-csEm.mjs").then((n) => n.t);
+		const { validateProjectSlug } = await import("./create-project-Bk9Z0-Jg.mjs").then((n) => n.a);
+		const { createProjectWithSlugRetry } = await import("./create-project-Bk9Z0-Jg.mjs").then((n) => n.t);
 		let created;
 		try {
 			created = await createProjectWithSlugRetry(client, inferDefaultSlug(root), async (defaultSlug) => {
@@ -6032,6 +6069,7 @@ function voidPlugin(options) {
 				vars.__VOID_TOKEN = credentials.token;
 				vars.__VOID_PROJECT_ID = credentials.projectId;
 				vars.__VOID_PROXY_URL = credentials.proxyUrl;
+				if (credentials.accessCredentials) vars.__VOID_ACCESS_CREDENTIALS = credentials.accessCredentials;
 				if (credentials.staging) vars.__VOID_STAGING = "1";
 				result.vars = vars;
 			}
@@ -6041,6 +6079,7 @@ function voidPlugin(options) {
 			if (credentials.status === "ok") {
 				const vars = result.vars ?? {};
 				vars.__VOID_PROXY_URL = credentials.proxyUrl;
+				if (credentials.accessCredentials) vars.__VOID_ACCESS_CREDENTIALS = credentials.accessCredentials;
 				vars.__VOID_TOKEN = credentials.token;
 				vars.__VOID_PROJECT_ID = credentials.projectId;
 				vars.__VOID_REMOTE = "1";

package/dist/{init-Dx5cgKqK.mjs → init-BWZ7q5Z4.mjs}

@@ -1,20 +1,20 @@
 import { a as isAbsolute, c as relative, l as resolve, n as dirname, o as join, t as basename } from "./dist-BrsS7cai.mjs";
-import { C as cancel, D as log, E as intro, F as isCancel, N as text, O as note, f as detectAgents, j as select, k as outro, p as getPackageDir, r as cliTitle, w as confirm } from "./output-tFQLLj26.mjs";
+import { A as outro, C as cancel, D as log, E as intro, I as isCancel, M as select, P as text, f as detectAgents, k as note, p as getPackageDir, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
 import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
-import { C as writeDeploymentPlatform, T as writeProjectConfig, b as readDeploymentPlatform, c as getToken, u as isStagingMode, v as attachSelectedPlatform, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
+import { E as writeProjectConfig, S as readProjectConfig, d as isStagingMode, l as getToken, w as writeDeploymentPlatform, x as readDeploymentPlatform, y as attachSelectedPlatform } from "./auth-DPl6kck4.mjs";
 import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig } from "./wrangler--imS8n0d.mjs";
-import { c as getDatabaseDialect, f as readConfig } from "./config-BQFq7QvD.mjs";
+import { c as getDatabaseDialect, f as readConfig } from "./config-uNGuFsI2.mjs";
 import { n as ensureProjectTsconfig, t as createProjectTsconfig } from "./project-tsconfig-Ql2XsSQp.mjs";
 import { r as detectFramework } from "./plugin-inference-BDRfZngg.mjs";
 import { n as parseDotenvFile, t as expandDotenv } from "./dotenv-VQxupEUv.mjs";
 import { t as MagicString } from "./dist-BR1quN_w.mjs";
 import { n as writeDrizzleConfig } from "./config-NOG_U1aK.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
 import { r as formatProjectCommand } from "./preset-lAy0B0BQ.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-DMV-csEm.mjs";
-import { t as promptForLoginToken } from "./login-C8-UuLnp.mjs";
-import { t as connectCloudflare } from "./cloudflare-connect-BivMefMA.mjs";
-import { discoverPlatform, saveDiscoveredPlatform } from "./platform-cmd-BEOVv1PN.mjs";
+import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-Bk9Z0-Jg.mjs";
+import { n as promptForLoginToken } from "./login-Uvferzmm.mjs";
+import { discoverPlatform, saveDiscoveredPlatform } from "./platform-cmd-BFhieCdV.mjs";
+import { t as connectCloudflare } from "./cloudflare-connect-t1UU5svD.mjs";
 import { n as findInstalledYarnPnpRuntime, r as hasLocalLockfile, t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DxSInkzL.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
@@ -1822,7 +1822,7 @@ async function ensureVoidPlatformConnection(root) {
 	let selectedApiUrl = null;
 	let promptedForPlatform = false;
 	try {
-		const { getApiUrl, getSiteDomain } = await import("./auth-W9WII-mN.mjs").then((n) => n.t);
+		const { getApiUrl, getSiteDomain } = await import("./auth-DPl6kck4.mjs").then((n) => n.t);
 		selectedApiUrl = getApiUrl(root);
 		getSiteDomain(root);
 	} catch (error) {
@@ -2831,7 +2831,7 @@ async function runInitCommand(root, initArgs) {
 		injectAgentBlock(root);
 		const agents = detectAgents(root);
 		if (agents.length > 0) {
-			const { linkSkillsForSpecificAgents } = await import("./skills-Q46GZMO-.mjs");
+			const { linkSkillsForSpecificAgents } = await import("./skills-C0RvGjeE.mjs");
 			linkSkillsForSpecificAgents(root, agents);
 		} else log.info("No coding agent detected; read the bundled docs linked in AGENTS.md");
 	}
@@ -2865,7 +2865,7 @@ async function runInitCommand(root, initArgs) {
 	let shouldSetupGithub = targeted ? initArgs?.github === true : deploymentPlatform !== "none";
 	if (shouldSetupGithub && !githubStepSkipForSubpackage && deploymentPlatform !== "cloudflare" && deploymentPlatform !== "none") {
 		if (!voidPlatformDiscovery) {
-			const { getApiUrl } = await import("./auth-W9WII-mN.mjs").then((n) => n.t);
+			const { getApiUrl } = await import("./auth-DPl6kck4.mjs").then((n) => n.t);
 			voidPlatformDiscovery = await discoverPlatform(getApiUrl(root));
 		}
 		if (!voidPlatformDiscovery.capabilities.githubActions) {

package/dist/{link-D_rm5sRH.mjs → link-Rmvu2Wl_.mjs}

@@ -1,7 +1,7 @@
-import { C as cancel, D as log, E as intro, c as import_picocolors, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { T as writeProjectConfig, c as getToken, s as getSiteDomain, v as attachSelectedPlatform, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-DMV-csEm.mjs";
+import { A as outro, C as cancel, D as log, E as intro, c as import_picocolors, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { E as writeProjectConfig, S as readProjectConfig, c as getSiteDomain, l as getToken, y as attachSelectedPlatform } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-Bk9Z0-Jg.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/link.ts
 function projectLabel(slug, root, url) {

package/dist/{list-M8XShti7.mjs → list-DEE2S6mY.mjs}

@@ -1,6 +1,6 @@
-import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, o as ensureUtc, r as cliTitle, u as tablePrefix } from "./output-tFQLLj26.mjs";
-import { b as readDeploymentPlatform, c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, o as ensureUtc, r as cliTitle, u as tablePrefix } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/list.ts
 async function runListCommand(root, slug) {
@@ -41,7 +41,7 @@ async function runListCommand(root, slug) {
 }
 async function showCloudflareDeployments(root, slug) {
 	if (slug) throw new Error("project: A project name selects a Void platform project and is not used for direct Cloudflare apps.");
-	const { readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+	const { readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 	const status = await readCloudflareWorkerStatus(resolveCloudflareOperationContext(root));
 	if (status.versions.length === 0) {
 		outro(`No deployments for ${status.workerName}.`);

package/dist/{local-d1-BE8KBbMy.mjs → local-d1-D2I6Ox5F.mjs}

@@ -2,7 +2,7 @@ import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { a as isAbsolute, l as resolve, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
 import { v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
 import { n as hasPackageDependency, r as readNearestPackageJson } from "./package-json-CPoWX79C.mjs";
-import { c as collectMigrations, o as classifyMigration } from "./validate-Bihr8WBi.mjs";
+import { c as collectMigrations, o as classifyMigration } from "./validate-tBBN_dXH.mjs";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, createHmac } from "node:crypto";
 //#region src/migrations/runner.ts

package/dist/{login-C8-UuLnp.mjs → login-Uvferzmm.mjs}

@@ -1,22 +1,40 @@
-import { C as cancel, D as log, E as intro, F as isCancel, c as import_picocolors, i as createSpinner, j as select, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { _ as saveToken, c as getToken, g as savePlatformToken, h as runPlatformLogin, l as getTokenSource, m as runLogin, p as removeToken, u as isStagingMode } from "./auth-W9WII-mN.mjs";
-import { a as isExpiredTokenError, n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { A as outro, C as cancel, D as log, E as intro, I as isCancel, M as select, c as import_picocolors, i as createSpinner, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { _ as savePlatformToken, d as isStagingMode, g as runPlatformLogin, h as runLogin, l as getToken, m as removeToken, o as getApiUrl, u as getTokenSource, v as saveToken } from "./auth-DPl6kck4.mjs";
+import { a as isExpiredTokenError, n as PlatformClient } from "./client-dHfSJvAN.mjs";
 //#region src/cli/login.ts
-async function promptForLoginToken(root = process.cwd(), platform) {
+var login_exports = /* @__PURE__ */ __exportAll({
+	promptForLoginToken: () => promptForLoginToken,
+	runLoginCommand: () => runLoginCommand,
+	selectPlatformLoginMethod: () => selectPlatformLoginMethod
+});
+async function selectPlatformLoginMethod(platform, requestedId) {
 	const providers = platform?.authenticationProviders ?? ["github", "google"];
-	if (providers.length === 0) throw new Error("auth: This platform has no login providers.");
+	const methods = platform?.authentication?.methods ?? providers.map((id) => ({
+		id,
+		label: id === "github" ? "GitHub" : id === "google" ? "Google" : id
+	}));
+	if (providers.length === 0) throw new Error(platform?.authentication?.setupPending ? "auth: The platform administrator must finish initial setup." : "auth: This platform has no login providers.");
+	if (requestedId) {
+		const selected = methods.find((method) => method.id === requestedId);
+		if (!selected) throw new Error(`auth: Login method ${requestedId} is not enabled on this platform.`);
+		return selected;
+	}
 	const provider = providers.length === 1 ? providers[0] : await select({
 		message: "Choose a login provider:",
-		options: providers.map((value) => ({
-			value,
-			label: value === "github" ? "GitHub" : "Google"
+		options: methods.map(({ id, label }) => ({
+			value: id,
+			label
 		}))
 	});
 	if (isCancel(provider) || typeof provider === "symbol") {
 		cancel("Login cancelled.");
 		process.exit(0);
 	}
-	const providerName = provider === "github" ? "GitHub" : "Google";
+	return methods.find((method) => method.id === provider);
+}
+async function promptForLoginToken(root = process.cwd(), platform) {
+	const { id: provider, label: providerName } = await selectPlatformLoginMethod(platform ?? await import("./platform-cmd-BFhieCdV.mjs").then(({ discoverPlatform }) => discoverPlatform(getApiUrl(root))));
 	const s = createSpinner();
 	s.start(`Opening browser for ${providerName} login...`);
 	try {
@@ -70,4 +88,4 @@ async function runLoginCommand(root = process.cwd()) {
 	outro(isStagingMode(root) ? "Staging token saved." : "Token saved.");
 }
 //#endregion
-export { runLoginCommand as n, promptForLoginToken as t };
+export { selectPlatformLoginMethod as i, promptForLoginToken as n, runLoginCommand as r, login_exports as t };

package/dist/{logs-DwFU7dMW.mjs → logs-27FenuiC.mjs}

@@ -1,13 +1,13 @@
-import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { b as readDeploymentPlatform, c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
 //#region src/cli/logs.ts
 async function runLogsCommand(root, filter, range, deployment, level) {
 	console.log();
 	intro(cliTitle("project logs"));
 	const platform = readDeploymentPlatform(root);
 	if (platform === "cloudflare") {
-		const { resolveCloudflareOperationContext, tailCloudflareWorker } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+		const { resolveCloudflareOperationContext, tailCloudflareWorker } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 		if (range !== "1h") log.warn("Cloudflare tail streams live logs; --range does not select historical entries.");
 		if (level && level !== "all" && level !== "error") log.warn("Cloudflare tail cannot filter individual console levels; showing all invocation logs.");
 		await tailCloudflareWorker(resolveCloudflareOperationContext(root), {

package/dist/{mime-BJD7d_qL.mjs → mime-D5Nmdzf7.mjs}

@@ -7,8 +7,8 @@ import { validate } from "email-validator";
 * and multipart/mixed for attachments — covering >95% of transactional sends.
 * Inline images use multipart/related when both attachments and html are present.
 */
-/** Cloudflare Email Workers reject messages larger than ~10 MB after base64 expansion. */
-const MAX_MESSAGE_BYTES = 10485760;
+/** Encoded outbound MIME ceiling, separate from the 10 MiB inbound limit. */
+const MAX_MESSAGE_BYTES = 5242880;
 /**
 * Upper bound on the TOTAL attachment bytes `normalizeEmail` will materialize.
 *
@@ -35,6 +35,8 @@ const MAX_MESSAGE_BYTES = 10485760;
 * on.
 */
 const MAX_ATTACHMENT_BYTES_TOTAL = Math.floor(MAX_MESSAGE_BYTES * 3 / 4);
+/** Maximum serialized size of app-defined top-level MIME fields. */
+const MAX_CUSTOM_HEADER_BYTES = 16384;
 const CRLF = "\r\n";
 const ASCII_PRINTABLE = /^[\x20-\x7e]*$/;
 const HEADER_NAME = /^[!-9;-~]+$/;
@@ -455,13 +457,25 @@ async function normalizeAttachment(att) {
 async function normalizeEmail(opts) {
 	if (!opts.text && !opts.html) throw new MimeError("MIME_ERROR", "email: at least one of 'text' or 'html' is required.");
 	if (opts.subject !== void 0) rejectCRLF("subject", opts.subject);
-	if (opts.headers) for (const [name, value] of Object.entries(opts.headers)) {
-		if (!HEADER_NAME.test(name)) throw new MimeError("MIME_ERROR", `headers: '${name}' is not a valid RFC 5322 header name.`);
-		if (name.length + HEADER_NAME_LINE_OVERHEAD > MAX_LINE_OCTETS) throw new MimeError("MIME_ERROR", `headers: a header name is ${name.length} characters; a field name cannot be folded, so its line would exceed the ${MAX_LINE_OCTETS}-octet limit in RFC 5322 §2.1.1. Shorten the name.`);
-		rejectCRLF(`header '${name}'`, value);
+	if (opts.headers) {
+		let headerInputBytes = 0;
+		let headerBytes = 0;
+		const encoder = new TextEncoder();
+		for (const [name, value] of Object.entries(opts.headers)) {
+			if (!HEADER_NAME.test(name)) throw new MimeError("MIME_ERROR", `headers: '${name}' is not a valid RFC 5322 header name.`);
+			if (name.length + HEADER_NAME_LINE_OVERHEAD > MAX_LINE_OCTETS) throw new MimeError("MIME_ERROR", `headers: a header name is ${name.length} characters; a field name cannot be folded, so its line would exceed the ${MAX_LINE_OCTETS}-octet limit in RFC 5322 §2.1.1. Shorten the name.`);
+			if (headerInputBytes + name.length + value.length + 4 > MAX_CUSTOM_HEADER_BYTES) throw new MimeError("MIME_ERROR", "email: custom headers exceed the 16 KiB limit.");
+			headerInputBytes += name.length + encoder.encode(value).byteLength + 4;
+			if (headerInputBytes > MAX_CUSTOM_HEADER_BYTES) throw new MimeError("MIME_ERROR", "email: custom headers exceed the 16 KiB limit.");
+			rejectCRLF(`header '${name}'`, value);
+			if (RESERVED_HEADERS.has(name.toLowerCase())) continue;
+			if (headerBytes + name.length + CUSTOM_HEADER_FRAMING_OCTETS + minHeaderValueOctets(value) > MAX_CUSTOM_HEADER_BYTES) throw new MimeError("MIME_ERROR", "email: custom headers exceed the 16 KiB limit.");
+			headerBytes += foldHeader(name, encodeWord(value)).length + 2;
+			if (headerBytes > MAX_CUSTOM_HEADER_BYTES) throw new MimeError("MIME_ERROR", "email: custom headers exceed the 16 KiB limit.");
+		}
 	}
 	const recipientCount = countRecipients(opts.to) + countRecipients(opts.cc) + countRecipients(opts.bcc);
-	if (recipientCount > 100) throw new MimeError("INVALID_TO", `email: too many recipients (max 100, got ${recipientCount}) across 'to', 'cc' and 'bcc'.`);
+	if (recipientCount > 50) throw new MimeError("INVALID_TO", `email: too many recipients (max 50, got ${recipientCount}) across 'to', 'cc' and 'bcc'.`);
 	const from = parseAddress(opts.from, "from");
 	const to = parseAddresses(opts.to, "to");
 	if (to.length === 0) throw new MimeError("INVALID_TO", "email: 'to' must include at least one recipient.");
@@ -1171,7 +1185,7 @@ function generateMessageId(fromEmail) {
 */
 function buildMime(email) {
 	const projected = minHeaderOctets(email) + (email.text ? minBodyOctets(email.text) : 0) + (email.html ? minBodyOctets(email.html) : 0) + email.attachments.reduce((sum, a) => sum + base64Octets(a.bytes.byteLength), 0);
-	if (projected > 10485760) throw new MimeError("MIME_ERROR", `email: message is at least ${projected} bytes once encoded, which exceeds Cloudflare limit of ${MAX_MESSAGE_BYTES} bytes.`);
+	if (projected > 5242880) throw new MimeError("MIME_ERROR", `email: message is at least ${projected} bytes once encoded, which exceeds Cloudflare limit of ${MAX_MESSAGE_BYTES} bytes.`);
 	const messageId = generateMessageId(email.from.email);
 	const topHeaders = [
 		["Date", (/* @__PURE__ */ new Date()).toUTCString().replace("GMT", "+0000")],
@@ -1206,7 +1220,7 @@ function buildMime(email) {
 	const raw = new TextEncoder().encode(rawText);
 	const overlong = findOverlongLine(rawText);
 	if (overlong !== void 0) throw new MimeError("MIME_ERROR", `email: header line ${overlong.index + 1} is ${overlong.octets} octets, over the ${MAX_LINE_OCTETS}-octet limit in RFC 5322 §2.1.1. A value with no whitespace cannot be folded — shorten it, or move it into the body.`);
-	if (raw.byteLength > 10485760) throw new MimeError("MIME_ERROR", `email: message size ${raw.byteLength} bytes exceeds Cloudflare limit of ${MAX_MESSAGE_BYTES} bytes.`);
+	if (raw.byteLength > 5242880) throw new MimeError("MIME_ERROR", `email: message size ${raw.byteLength} bytes exceeds Cloudflare limit of ${MAX_MESSAGE_BYTES} bytes.`);
 	return {
 		raw,
 		messageId

package/dist/{node-BkaXcpAc.mjs → node-Ez5KW5rn.mjs}

@@ -1,9 +1,9 @@
 import { o as join } from "./dist-BrsS7cai.mjs";
 import { c as loadVoidAuthConfig, s as findVoidAuthConfig } from "./scan-BMH4rzlv.mjs";
-import { f as readConfig } from "./config-BQFq7QvD.mjs";
-import { r as getMiniflareDatabasePath } from "./local-d1-BE8KBbMy.mjs";
+import { f as readConfig } from "./config-uNGuFsI2.mjs";
+import { r as getMiniflareDatabasePath } from "./local-d1-D2I6Ox5F.mjs";
 import { a as resolveVoidAuthMigrationSchema } from "./route-types-Da-DpyUp.mjs";
-import { a as loadLocalEnv } from "./env-D4Emu-M_.mjs";
+import { a as loadLocalEnv } from "./env-DBKmK4vc.mjs";
 import { n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-9vif1uj8.mjs";
 //#region src/auth/node.ts
 async function runLocalVoidAuthMigrations(root, dialect, persistRoot = join(root, ".void"), databaseId = "local", configPath = findVoidAuthConfig(root)) {

package/dist/operator-auth-B3e08unv.mjs

@@ -0,0 +1,52 @@
+import { K as getActivePlatformConnection, X as normalizePlatformApiUrl, Y as listPlatformConnections, Z as platformCredentialAccount, dt as writeKeyringPassword, lt as deleteKeyringPassword, ut as readKeyringPassword } from "./output-B0cfNSx5.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-LUZnlnYk.mjs";
+/** Operator authority never comes from repository-controlled metadata. */
+function resolveOperatorOrigin(connection = "") {
+	if (connection) {
+		let normalized = null;
+		try {
+			normalized = normalizePlatformApiUrl(connection);
+		} catch {}
+		const matches = listPlatformConnections().filter((entry) => entry.id === connection || entry.installationId === connection || entry.apiUrl === normalized);
+		if (matches.length !== 1) throw new OperatorClientError("Select a registered platform connection ID or URL. Run `void connect <url> --no-login` to register it first.", "invalid_connection");
+		return matches[0].apiUrl;
+	}
+	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);
+	if (process.env.VOID_OPERATOR_TOKEN) throw new OperatorClientError("VOID_OPERATOR_TOKEN requires an explicit --connection or VOID_API_URL to select its recipient.", "explicit_origin_required");
+	const active = getActivePlatformConnection();
+	if (!active) throw new OperatorClientError("No default platform connection. Run `void connect <url>` or specify --connection.", "connection_required");
+	return active.apiUrl;
+}
+function readOperatorToken(origin) {
+	const token = process.env.VOID_OPERATOR_TOKEN || readKeyringPassword("dev.void.cli.operator", platformCredentialAccount(origin));
+	if (!token) throw new OperatorClientError("No operator session. Run `void platform auth login` or set VOID_OPERATOR_TOKEN with an explicit origin.", "authentication_required");
+	return token;
+}
+function saveOperatorToken(origin, token) {
+	if (!writeKeyringPassword("dev.void.cli.operator", platformCredentialAccount(origin), token)) throw new OperatorClientError("The system keychain is unavailable. Use `void platform auth token --token-stdin` with a full API session to obtain a token for VOID_OPERATOR_TOKEN; plaintext credential storage is disabled.", "keychain_unavailable");
+}
+function removeOperatorToken(origin) {
+	const account = platformCredentialAccount(origin);
+	if (readKeyringPassword("dev.void.cli.operator", account) && !deleteKeyringPassword("dev.void.cli.operator", account)) throw new OperatorClientError("The operator session was revoked, but its local keychain entry could not be removed.", "keychain_unavailable");
+}
+async function readOperatorApiTokenStdin() {
+	if (process.stdin.isTTY) throw new OperatorClientError("--token-stdin requires an API session token piped on standard input.", "invalid_token_input");
+	let input = "";
+	for await (const chunk of process.stdin) {
+		input += String(chunk);
+		if (input.length > 32768) throw new OperatorClientError("API session token input is too large.", "invalid_token_input");
+	}
+	const token = input.trim();
+	if (!token || token.length > 32768 || /\s/.test(token)) throw new OperatorClientError("Standard input must contain one API session token.", "invalid_token_input");
+	return token;
+}
+async function exchangeOperatorSession(origin, apiToken) {
+	const session = await new OperatorClient(origin, apiToken).request("/session", {
+		method: "POST",
+		body: {}
+	});
+	if (typeof session.token !== "string" || !session.token || session.apiVersion !== 1 || typeof session.expiresAt !== "string") throw new OperatorClientError("Operator API returned an invalid session.", "invalid_response");
+	return session;
+}
+//#endregion
+export { resolveOperatorOrigin as a, removeOperatorToken as i, readOperatorApiTokenStdin as n, saveOperatorToken as o, readOperatorToken as r, exchangeOperatorSession as t };