void 0.20.0 → 0.20.2

package/dist/operator-client-LUZnlnYk.mjs

@@ -0,0 +1,82 @@
+import { B as ensureCloudflaredToken, X as normalizePlatformApiUrl } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+const OPERATOR_MAX_TIMEOUT_MS = 36e5;
+var OperatorClientError = class extends Error {
+	code;
+	status;
+	details;
+	constructor(message, code = "operator_error", status, details) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.details = details;
+		this.name = "OperatorClientError";
+	}
+	toJSON() {
+		return {
+			error: this.code,
+			message: this.message,
+			...this.status === void 0 ? {} : { status: this.status },
+			...this.details === void 0 ? {} : { details: this.details }
+		};
+	}
+};
+var OperatorClient = class {
+	token;
+	fetcher;
+	origin;
+	constructor(origin, token, fetcher = fetch) {
+		this.token = token;
+		this.fetcher = fetcher;
+		this.origin = normalizePlatformApiUrl(origin);
+	}
+	async request(path, options = {}) {
+		if (!path.startsWith("/") || path.startsWith("//") || path.includes("?") || path.includes("#")) throw new OperatorClientError("Invalid operator API path.");
+		const timeoutMs = options.timeoutMs ?? (options.method === "POST" ? 3e5 : 3e4);
+		if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1e3 || timeoutMs > 36e5) throw new OperatorClientError(`Operator request timeout must be an integer from 1 to ${OPERATOR_MAX_TIMEOUT_MS / 1e3} seconds.`, "invalid_timeout");
+		const url = new URL(`${this.origin}/operator/v1${path}`);
+		ensureCloudflaredToken(this.origin);
+		for (const [name, value] of Object.entries(options.query ?? {})) url.searchParams.set(name, value);
+		const timeoutController = new AbortController();
+		const timer = setTimeout(() => timeoutController.abort(), timeoutMs);
+		timer.unref();
+		const signal = options.signal ? AbortSignal.any([options.signal, timeoutController.signal]) : timeoutController.signal;
+		try {
+			let response;
+			try {
+				response = await this.fetcher(url, {
+					method: options.method ?? "GET",
+					headers: {
+						...cfAccessHeaders(process.env, this.origin),
+						Authorization: `Bearer ${this.token}`,
+						Accept: "application/json",
+						...options.body ? { "Content-Type": "application/json" } : {}
+					},
+					...options.body ? { body: JSON.stringify(options.body) } : {},
+					redirect: "manual",
+					signal
+				});
+			} catch (error) {
+				if (options.signal?.aborted) throw error;
+				if (timeoutController.signal.aborted) throw new OperatorClientError(`Operator request exceeded the ${timeoutMs / 1e3}-second timeout. ${options.method === "POST" ? "Its outcome may be unknown; inspect platform state before retrying." : "Check connectivity and try again."}`, "request_timeout");
+				throw new OperatorClientError(`Operator request to ${this.origin} failed. ${options.method === "POST" ? "Its outcome may be unknown; inspect platform state before retrying." : "Check connectivity and try again."}`, "connection_failed");
+			}
+			if (response.status >= 300 && response.status < 400) throw new OperatorClientError("The operator API redirected the request. Credentials were not forwarded; use the exact platform API origin.", "redirect_rejected", response.status);
+			let data;
+			try {
+				data = await response.json();
+			} catch {
+				throw new OperatorClientError(`Operator API returned invalid JSON (HTTP ${response.status}).${options.method === "POST" ? " Inspect platform state before retrying." : ""}`, "invalid_response", response.status);
+			}
+			if (!data || typeof data !== "object" || Array.isArray(data)) throw new OperatorClientError("Operator API returned an invalid response object.", "invalid_response", response.status);
+			const result = data;
+			if (!response.ok) throw new OperatorClientError(typeof result.message === "string" ? result.message : `Operator request failed (HTTP ${response.status}).`, typeof result.error === "string" ? result.error : "request_failed", response.status, result.details);
+			if (result.partial === true || result.ok === false) throw new OperatorClientError("The operation did not fully complete. Inspect the partial result before retrying.", "partial_failure", response.status, result);
+			return result;
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+};
+//#endregion
+export { OperatorClient as n, OperatorClientError as r, OPERATOR_MAX_TIMEOUT_MS as t };

package/dist/{operator-cmd-DYWRbWUA.mjs → operator-cmd-CjOTmAYE.mjs}

@@ -1,57 +1,8 @@
-import { G as normalizePlatformApiUrl, K as platformCredentialAccount, V as getActivePlatformConnection, W as listPlatformConnections, at as readKeyringPassword, it as deleteKeyringPassword, ot as writeKeyringPassword } from "./output-tFQLLj26.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./cli/cli.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-LUZnlnYk.mjs";
+import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-B3e08unv.mjs";
 import { createHash } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { setTimeout } from "node:timers/promises";
-/** Operator authority never comes from repository-controlled metadata. */
-function resolveOperatorOrigin(connection = "") {
-	if (connection) {
-		let normalized = null;
-		try {
-			normalized = normalizePlatformApiUrl(connection);
-		} catch {}
-		const matches = listPlatformConnections().filter((entry) => entry.id === connection || entry.installationId === connection || entry.apiUrl === normalized);
-		if (matches.length !== 1) throw new OperatorClientError("Select a registered platform connection ID or URL. Run `void connect <url> --no-login` to register it first.", "invalid_connection");
-		return matches[0].apiUrl;
-	}
-	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);
-	if (process.env.VOID_OPERATOR_TOKEN) throw new OperatorClientError("VOID_OPERATOR_TOKEN requires an explicit --connection or VOID_API_URL to select its recipient.", "explicit_origin_required");
-	const active = getActivePlatformConnection();
-	if (!active) throw new OperatorClientError("No default platform connection. Run `void connect <url>` or specify --connection.", "connection_required");
-	return active.apiUrl;
-}
-function readOperatorToken(origin) {
-	const token = process.env.VOID_OPERATOR_TOKEN || readKeyringPassword("dev.void.cli.operator", platformCredentialAccount(origin));
-	if (!token) throw new OperatorClientError("No operator session. Run `void platform auth login` or set VOID_OPERATOR_TOKEN with an explicit origin.", "authentication_required");
-	return token;
-}
-function saveOperatorToken(origin, token) {
-	if (!writeKeyringPassword("dev.void.cli.operator", platformCredentialAccount(origin), token)) throw new OperatorClientError("The system keychain is unavailable. Use `void platform auth token --token-stdin` with a full API session to obtain a token for VOID_OPERATOR_TOKEN; plaintext credential storage is disabled.", "keychain_unavailable");
-}
-function removeOperatorToken(origin) {
-	const account = platformCredentialAccount(origin);
-	if (readKeyringPassword("dev.void.cli.operator", account) && !deleteKeyringPassword("dev.void.cli.operator", account)) throw new OperatorClientError("The operator session was revoked, but its local keychain entry could not be removed.", "keychain_unavailable");
-}
-async function readOperatorApiTokenStdin() {
-	if (process.stdin.isTTY) throw new OperatorClientError("--token-stdin requires an API session token piped on standard input.", "invalid_token_input");
-	let input = "";
-	for await (const chunk of process.stdin) {
-		input += String(chunk);
-		if (input.length > 32768) throw new OperatorClientError("API session token input is too large.", "invalid_token_input");
-	}
-	const token = input.trim();
-	if (!token || token.length > 32768 || /\s/.test(token)) throw new OperatorClientError("Standard input must contain one API session token.", "invalid_token_input");
-	return token;
-}
-async function exchangeOperatorSession(origin, apiToken) {
-	const session = await new OperatorClient(origin, apiToken).request("/session", {
-		method: "POST",
-		body: {}
-	});
-	if (typeof session.token !== "string" || !session.token || session.apiVersion !== 1 || typeof session.expiresAt !== "string") throw new OperatorClientError("Operator API returned an invalid session.", "invalid_response");
-	return session;
-}
-//#endregion
 //#region src/cli/operator-cmd.ts
 const MAX_RUNTIME_FOLLOW_ROWS = 1e4;
 function printable(value) {
@@ -137,6 +88,20 @@ function outputLogs(result, json) {
 		if (result.nextCursor) console.log(`Next cursor: ${printable(result.nextCursor)}`);
 	} else output(result, false);
 }
+function operationRecoveryFence(value) {
+	const target = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+	if (!target || typeof target.stepId !== "string" || typeof target.attempt !== "number" || !Number.isSafeInteger(target.attempt) || typeof target.requestDigest !== "string" || typeof target.resourceIdentity !== "string" || typeof target.connectionId !== "string" || typeof target.desiredGeneration !== "number" || !Number.isSafeInteger(target.desiredGeneration) || target.routeId !== null && typeof target.routeId !== "string" || target.routeDesiredGeneration !== null && (typeof target.routeDesiredGeneration !== "number" || !Number.isSafeInteger(target.routeDesiredGeneration))) throw new OperatorClientError("The server did not return a valid email operation recovery fence. No change was requested.", "invalid_preview");
+	return {
+		stepId: target.stepId,
+		attempt: target.attempt,
+		requestDigest: target.requestDigest,
+		resourceIdentity: target.resourceIdentity,
+		connectionId: target.connectionId,
+		desiredGeneration: target.desiredGeneration,
+		routeId: target.routeId,
+		routeDesiredGeneration: target.routeDesiredGeneration
+	};
+}
 function runtimeLogFingerprint(row) {
 	const ingestedAt = row && typeof row === "object" && !Array.isArray(row) ? row.ingestedAt : void 0;
 	if (!row || typeof row !== "object" || Array.isArray(row) || typeof ingestedAt !== "number" || !Number.isSafeInteger(ingestedAt)) throw new OperatorClientError("Runtime log response has an invalid ingestion cursor.", "invalid_response");
@@ -171,7 +136,13 @@ async function confirmOperatorMutation(origin, preview, args) {
 async function runAuth(origin, args) {
 	if (args.action === "login" || args.action === "token" && args.tokenStdin) {
 		if (!args.tokenStdin && !process.stdin.isTTY) throw new OperatorClientError("Browser login requires an interactive terminal. Use --token-stdin to exchange an API session.", "interactive_login_required");
-		const session = await exchangeOperatorSession(origin, args.tokenStdin ? await readOperatorApiTokenStdin() : await import("./auth-W9WII-mN.mjs").then((n) => n.t).then(({ runPlatformLogin }) => runPlatformLogin(origin, args.provider, (url) => process.stderr.write(`Sign in at ${url}\n`))));
+		const apiToken = args.tokenStdin ? await readOperatorApiTokenStdin() : await (async () => {
+			const { discoverPlatform } = await import("./platform-cmd-BFhieCdV.mjs");
+			const { selectPlatformLoginMethod } = await import("./login-Uvferzmm.mjs").then((n) => n.t);
+			const { runPlatformLogin } = await import("./auth-DPl6kck4.mjs").then((n) => n.t);
+			return runPlatformLogin(origin, (await selectPlatformLoginMethod(await discoverPlatform(origin), args.providerExplicit ? args.provider : void 0)).id, (url) => process.stderr.write(`Sign in at ${url}\n`));
+		})();
+		const session = await exchangeOperatorSession(origin, apiToken);
 		const { token, ...identity } = session;
 		if (args.action === "token") {
 			if (args.json) output({
@@ -308,7 +279,7 @@ async function followOperatorLogs(client, args, signal, pollIntervalMs = 2e3) {
 }
 async function runOperatorCommand(args) {
 	if (!args.action) {
-		const { printHelpPage } = await import("./cli/cli.mjs").then((n) => n.t);
+		const { printHelpPage } = await import("./help-CwOX-zmI.mjs").then((n) => n.n);
 		printHelpPage(["platform", args.group]);
 		return;
 	}
@@ -317,6 +288,13 @@ async function runOperatorCommand(args) {
 	const client = new OperatorClient(origin, readOperatorToken(origin));
 	if (args.method === "POST") {
 		if (!args.plan && !args.yes && (!process.stdin.isTTY || !process.stderr.isTTY)) throw new OperatorClientError("Mutations in non-interactive mode require --yes or --plan.", "confirmation_required");
+		if (args.tokenStdin && args.group === "email" && (args.action === "domain-add" || args.action === "domain-remove")) args = {
+			...args,
+			body: {
+				...args.body,
+				apiToken: await readOperatorApiTokenStdin()
+			}
+		};
 		const preview = await client.request(args.path, {
 			method: "POST",
 			body: {
@@ -326,10 +304,12 @@ async function runOperatorCommand(args) {
 			timeoutMs: args.timeoutMs
 		});
 		if (preview.dryRun !== true || typeof preview.action !== "string" || !Object.hasOwn(preview, "target")) throw new OperatorClientError("The server did not return a valid mutation preview. No change was requested.", "invalid_preview");
+		const recoveryFence = args.group === "email" && args.action === "operation-resolve" ? operationRecoveryFence(preview.target) : {};
 		if (!await confirmOperatorMutation(origin, preview, args)) return;
 		const body = {
 			...args.body,
-			...args.group === "worker" && args.action === "rollback-all" ? { versions: preview.versions } : {}
+			...args.group === "worker" && args.action === "rollback-all" ? { versions: preview.versions } : {},
+			...recoveryFence
 		};
 		output(await client.request(args.path, {
 			method: "POST",
@@ -339,7 +319,7 @@ async function runOperatorCommand(args) {
 	} else if (args.follow) await followOperatorLogs(client, args);
 	else {
 		const result = await client.request(args.path, { query: args.query });
-		if (args.action === "logs") outputLogs(result, args.json);
+		if (args.action === "logs" && args.group !== "email") outputLogs(result, args.json);
 		else output(result, args.json);
 		if (result.allOk === false) process.exitCode = 1;
 	}

package/dist/{output-tFQLLj26.mjs → output-B0cfNSx5.mjs}

@@ -1,9 +1,11 @@
 import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { l as resolve, o as join } from "./dist-BrsS7cai.mjs";
+import { n as isVoidAccessGatedUrl, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { homedir, hostname } from "node:os";
+import { spawnSync } from "node:child_process";
 import { Entry } from "@napi-rs/keyring";
 import { parsePlatformInstallationManifest } from "@void/platform";
 import { styleText } from "node:util";
@@ -505,6 +507,183 @@ function removePlatformConnectionForInstallation(installationId, directory = pla
 	});
 }
 //#endregion
+//#region src/cli/cf-access.ts
+const ACCESS_KEYRING_SERVICE = "dev.void.cli.access";
+const keyringTokens = /* @__PURE__ */ new Map();
+function usableToken(token) {
+	try {
+		const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+		return typeof payload.exp === "number" && payload.exp > Date.now() / 1e3 + 60;
+	} catch {
+		return false;
+	}
+}
+function rememberOriginToken(origin, token) {
+	let entries = {};
+	if (process.env.VOID_ACCESS_CREDENTIALS) {
+		const parsed = JSON.parse(process.env.VOID_ACCESS_CREDENTIALS);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed JSON object.");
+		entries = parsed;
+	}
+	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
+		...entries,
+		[origin]: { CF_ACCESS_TOKEN: token }
+	});
+}
+function forgetOriginToken(origin) {
+	if (!process.env.VOID_ACCESS_CREDENTIALS) return;
+	const parsed = JSON.parse(process.env.VOID_ACCESS_CREDENTIALS);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed JSON object.");
+	const entries = { ...parsed };
+	delete entries[origin];
+	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify(entries);
+}
+function isCloudflareAccessChallenge(response) {
+	const location = response.headers.get("Location");
+	if (!location || response.status < 300 || response.status >= 400) return false;
+	try {
+		const target = new URL(location);
+		return target.protocol === "https:" && !target.username && !target.password && /^[a-z0-9-]+\.cloudflareaccess\.com$/.test(target.hostname) && target.pathname.startsWith("/cdn-cgi/access/login");
+	} catch {
+		return false;
+	}
+}
+/** Called for a selected origin, never for a redirect destination. */
+function ensurePlatformAccessToken(apiUrl, challenged = false, required = false, rejectedToken) {
+	const origin = normalizePlatformApiUrl(apiUrl);
+	if (!origin.startsWith("https://")) return;
+	const headers = cfAccessHeaders(process.env, origin);
+	if (headers["CF-Access-Client-Id"]) return;
+	if (!challenged && headers["cf-access-token"] && usableToken(headers["cf-access-token"])) return;
+	const account = platformCredentialAccount(origin);
+	if (!keyringTokens.has(origin)) {
+		if (keyringTokens.size >= 64) keyringTokens.delete(keyringTokens.keys().next().value);
+		keyringTokens.set(origin, readKeyringPassword(ACCESS_KEYRING_SERVICE, account));
+	}
+	const stored = keyringTokens.get(origin);
+	if (!challenged && stored && usableToken(stored)) {
+		rememberOriginToken(origin, stored);
+		return;
+	}
+	if (!challenged && !required && !stored && !headers["cf-access-token"]) return;
+	const rejectedTokens = new Set([
+		headers["cf-access-token"],
+		stored,
+		rejectedToken
+	].filter((token) => typeof token === "string" && token.length > 0));
+	if (challenged && rejectedTokens.size > 0) {
+		forgetOriginToken(origin);
+		keyringTokens.set(origin, null);
+		if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error(`platform: Cloudflare Access rejected the cached credential for ${origin}. Re-run this command in an interactive terminal to renew it.`);
+		console.error(`Renew Cloudflare Access authentication for ${origin}.`);
+		runCloudflared([
+			"access",
+			"login",
+			origin
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+	}
+	let token = runCloudflared([
+		"access",
+		"token",
+		`-app=${origin}`
+	]);
+	if (token && rejectedTokens.has(token)) token = null;
+	if ((!token || !usableToken(token)) && process.stdin.isTTY && process.stdout.isTTY) {
+		console.error(`Authenticate to Cloudflare Access for ${origin}.`);
+		runCloudflared([
+			"access",
+			"login",
+			origin
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+		token = runCloudflared([
+			"access",
+			"token",
+			`-app=${origin}`
+		]);
+	}
+	if (!token || !usableToken(token)) throw new Error("platform: Cloudflare Access authentication is required. Install cloudflared and sign in interactively, or set VOID_ACCESS_ORIGIN with scoped CF_ACCESS_CLIENT_ID/CF_ACCESS_CLIENT_SECRET credentials for CI.");
+	rememberOriginToken(origin, token);
+	keyringTokens.set(origin, token);
+	writeKeyringPassword(ACCESS_KEYRING_SERVICE, account, token);
+}
+const probedHosts = /* @__PURE__ */ new Set();
+/**
+* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
+* probe the locally-installed `cloudflared` binary for a cached user JWT
+* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
+* token, open a browser login flow to populate the cache, then re-read it.
+*
+* Cached per-host so that an early non-gated call (e.g. prod) does not
+* permanently disable the probe for a later gated call (e.g. staging) in
+* the same process. Noop when:
+*   - a service-token pair is already set (CI path)
+*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
+*   - the target host is not gated
+*   - `cloudflared` is not installed
+*/
+function ensureCloudflaredToken(apiUrl) {
+	if (!isVoidAccessGatedUrl(apiUrl) || process.env.VOID_ACCESS_ORIGIN || process.env.VOID_ACCESS_CREDENTIALS) {
+		ensurePlatformAccessToken(apiUrl);
+		return;
+	}
+	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
+	if (process.env.CF_ACCESS_TOKEN) return;
+	if (!isVoidAccessGatedUrl(apiUrl)) return;
+	const host = new URL(apiUrl).hostname;
+	if (probedHosts.has(host)) return;
+	probedHosts.add(host);
+	let token = runCloudflared([
+		"access",
+		"token",
+		`-app=${apiUrl}`
+	]);
+	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
+		runCloudflared([
+			"access",
+			"login",
+			apiUrl
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+		token = runCloudflared([
+			"access",
+			"token",
+			`-app=${apiUrl}`
+		]);
+	}
+	if (token) process.env.CF_ACCESS_TOKEN = token;
+}
+function runCloudflared(args, opts) {
+	try {
+		const result = spawnSync("cloudflared", args, {
+			encoding: "utf-8",
+			stdio: opts?.inherit ? "inherit" : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			timeout: opts?.timeoutMs ?? 5e3
+		});
+		if (result.error || result.status !== 0) return null;
+		const out = (result.stdout ?? "").trim();
+		return out.length > 0 ? out : null;
+	} catch {
+		return null;
+	}
+}
+/** A protected API and proxy have separate audiences and separately scoped credentials. */
+function ensurePlatformProxyAccess(apiUrl, proxyUrl) {
+	ensurePlatformAccessToken(apiUrl);
+	ensurePlatformAccessToken(proxyUrl, false, Object.keys(cfAccessHeaders(process.env, apiUrl)).length > 0);
+}
+//#endregion
 //#region ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 const getCodePointsLength = (() => {
 	const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
@@ -1175,6 +1354,50 @@ var r = class extends y {
 		});
 	}
 };
+var a = class extends y {
+	options;
+	cursor = 0;
+	get _value() {
+		return this.options[this.cursor]?.value;
+	}
+	get _enabledOptions() {
+		return this.options.filter((e) => e.disabled !== true);
+	}
+	toggleAll() {
+		const e = this._enabledOptions, i = this.value !== void 0 && this.value.length === e.length;
+		this.value = i ? [] : e.map((t) => t.value);
+	}
+	toggleInvert() {
+		const e = this.value;
+		if (!e) return;
+		const i = this._enabledOptions.filter((t) => !e.includes(t.value));
+		this.value = i.map((t) => t.value);
+	}
+	toggleValue() {
+		this.value === void 0 && (this.value = []);
+		const e = this.value.includes(this._value);
+		this.value = e ? this.value.filter((i) => i !== this._value) : [...this.value, this._value];
+	}
+	constructor(e) {
+		super(e, false), this.options = e.options, this.value = [...e.initialValues ?? []];
+		const i = Math.max(this.options.findIndex(({ value: t }) => t === e.cursorAt), 0);
+		this.cursor = this.options[i]?.disabled ? findCursor(i, 1, this.options) : i, this.on("key", (t, l) => {
+			l.name === "a" && this.toggleAll(), l.name === "i" && this.toggleInvert();
+		}), this.on("cursor", (t) => {
+			switch (t) {
+				case "left":
+				case "up":
+					this.cursor = findCursor(this.cursor, -1, this.options);
+					break;
+				case "down":
+				case "right":
+					this.cursor = findCursor(this.cursor, 1, this.options);
+					break;
+				case "space": this.toggleValue();
+			}
+		});
+	}
+};
 let u$1 = class u extends y {
 	_mask = "•";
 	get cursor() {
@@ -1252,6 +1475,7 @@ var n = class extends y {
 //#endregion
 //#region ../../node_modules/.pnpm/@clack+prompts@1.8.0/node_modules/@clack/prompts/dist/index.mjs
 var dist_exports = /* @__PURE__ */ __exportAll({
+	MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
 	SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
 	S_BAR: () => S_BAR,
 	S_BAR_END: () => S_BAR_END,
@@ -1259,6 +1483,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	S_BAR_START: () => S_BAR_START,
 	S_CHECKBOX_ACTIVE: () => S_CHECKBOX_ACTIVE,
 	S_CHECKBOX_INACTIVE: () => S_CHECKBOX_INACTIVE,
+	S_CHECKBOX_SELECTED: () => S_CHECKBOX_SELECTED,
 	S_CONNECT_LEFT: () => S_CONNECT_LEFT,
 	S_CORNER_BOTTOM_LEFT: () => S_CORNER_BOTTOM_LEFT,
 	S_CORNER_BOTTOM_RIGHT: () => S_CORNER_BOTTOM_RIGHT,
@@ -1282,6 +1507,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	isCancel: () => isCancel,
 	limitOptions: () => limitOptions,
 	log: () => log,
+	multiselect: () => multiselect,
 	note: () => note,
 	outro: () => outro,
 	password: () => password,
@@ -1310,6 +1536,7 @@ const S_BAR_END = unicodeOr("└", "—");
 const S_RADIO_ACTIVE = unicodeOr("●", ">");
 const S_RADIO_INACTIVE = unicodeOr("○", " ");
 const S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]");
+const S_CHECKBOX_SELECTED = unicodeOr("◼", "[+]");
 const S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]");
 const S_PASSWORD_MASK = unicodeOr("▪", "•");
 const S_BAR_H = unicodeOr("─", "-");
@@ -1417,7 +1644,94 @@ ${g}
 		}
 	}).prompt();
 };
-`${styleText("dim", "↑/↓")}`, `${styleText("dim", "Space:")}`, `${styleText("dim", "Enter:")}`;
+const MULTISELECT_INSTRUCTIONS = [
+	`${styleText("dim", "↑/↓")} to navigate`,
+	`${styleText("dim", "Space:")} select`,
+	`${styleText("dim", "Enter:")} confirm`
+];
+const m = (i, u) => i.split(`
+`).map((d) => u(d)).join(`
+`);
+const multiselect = (i) => {
+	const u = (t, a) => {
+		const r = t.label ?? String(t.value);
+		return a === "disabled" ? `${styleText("gray", S_CHECKBOX_INACTIVE)} ${m(r, (o) => styleText(["strikethrough", "gray"], o))}${t.hint ? ` ${styleText("dim", `(${t.hint ?? "disabled"})`)}` : ""}` : a === "active" ? `${styleText("cyan", S_CHECKBOX_ACTIVE)} ${r}${t.hint ? ` ${styleText("dim", `(${t.hint})`)}` : ""}` : a === "selected" ? `${styleText("green", S_CHECKBOX_SELECTED)} ${m(r, (o) => styleText("dim", o))}${t.hint ? ` ${styleText("dim", `(${t.hint})`)}` : ""}` : a === "cancelled" ? `${m(r, (o) => styleText(["strikethrough", "dim"], o))}` : a === "active-selected" ? `${styleText("green", S_CHECKBOX_SELECTED)} ${r}${t.hint ? ` ${styleText("dim", `(${t.hint})`)}` : ""}` : a === "submitted" ? `${m(r, (o) => styleText("dim", o))}` : `${styleText("dim", S_CHECKBOX_INACTIVE)} ${m(r, (o) => styleText("dim", o))}`;
+	}, d = i.required ?? true, v = i.showInstructions ?? true;
+	return new a({
+		options: i.options,
+		signal: i.signal,
+		input: i.input,
+		output: i.output,
+		initialValues: i.initialValues,
+		required: d,
+		cursorAt: i.cursorAt,
+		validate(t) {
+			if (d && (t === void 0 || t.length === 0)) return `Please select at least one option.
+${styleText("reset", styleText("dim", `Press ${styleText([
+				"gray",
+				"bgWhite",
+				"inverse"
+			], " space ")} to select, ${styleText("gray", styleText("bgWhite", styleText("inverse", " enter ")))} to submit`))}`;
+		},
+		render() {
+			const t = i.withGuide ?? settings.withGuide, a = wrapTextWithPrefix(i.output, i.message, t ? `${symbolBar(this.state)}  ` : "", `${symbol(this.state)}  `), r = `${t ? `${styleText("gray", S_BAR)}
+` : ""}${a}
+`, o = this.value ?? [], p = (n, l) => {
+				if (n.disabled) return u(n, "disabled");
+				const s = o.includes(n.value);
+				return l && s ? u(n, "active-selected") : s ? u(n, "selected") : u(n, l ? "active" : "inactive");
+			};
+			switch (this.state) {
+				case "submit": {
+					const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "submitted")).join(styleText("dim", ", ")) || styleText("dim", "none");
+					return `${r}${wrapTextWithPrefix(i.output, n, t ? `${styleText("gray", S_BAR)}  ` : "")}`;
+				}
+				case "cancel": {
+					const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "cancelled")).join(styleText("dim", ", "));
+					if (n.trim() === "") return `${r}${styleText("gray", S_BAR)}`;
+					return `${r}${wrapTextWithPrefix(i.output, n, t ? `${styleText("gray", S_BAR)}  ` : "")}${t ? `
+${styleText("gray", S_BAR)}` : ""}`;
+				}
+				case "error": {
+					const n = t ? `${styleText("yellow", S_BAR)}  ` : "", l = this.error.split(`
+`).map(($, C) => C === 0 ? `${t ? `${styleText("yellow", S_BAR_END)}  ` : ""}${styleText("yellow", $)}` : `   ${$}`).join(`
+`), s = r.split(`
+`).length, h = l.split(`
+`).length + 1;
+					return `${r}${n}${limitOptions({
+						output: i.output,
+						options: this.options,
+						cursor: this.cursor,
+						maxItems: i.maxItems,
+						columnPadding: n.length,
+						rowPadding: s + h,
+						style: p
+					}).join(`
+${n}`)}
+${l}
+`;
+				}
+				default: {
+					const n = t ? `${styleText("cyan", S_BAR)}  ` : "", l = r.split(`
+`).length, s = v ? formatInstructionFooter(MULTISELECT_INSTRUCTIONS, t) : t ? [styleText("cyan", S_BAR_END)] : [], h = s.join(`
+`), $ = s.length + 1;
+					return `${r}${n}${limitOptions({
+						output: i.output,
+						options: this.options,
+						cursor: this.cursor,
+						maxItems: i.maxItems,
+						columnPadding: n.length,
+						rowPadding: l + $,
+						style: p
+					}).join(`
+${n}`)}
+${h}
+`;
+				}
+			}
+		}
+	}).prompt();
+};
 const log = {
 	message: (s = [], { symbol: e = styleText("gray", S_BAR), secondarySymbol: r = styleText("gray", S_BAR), output: m = process.stdout, spacing: l = 1, withGuide: c } = {}) => {
 		const t = [], o = c ?? settings.withGuide, f = o ? r : "", O = o ? `${e}  ` : "", u = o ? `${r}  ` : "";
@@ -1916,4 +2230,4 @@ function ensureUtc(s) {
 	return s + "Z";
 }
 //#endregion
-export { resolveInstallationManifest as $, password as A, assertPlatformInstallationSlugAvailable as B, cancel as C, log as D, intro as E, isCancel as F, normalizePlatformApiUrl as G, latestPlatformWorkerCutoverGeneration as H, settings as I, promoteInstallationSecrets as J, platformCredentialAccount as K, u$1 as L, symbol as M, text as N, note as O, CANCEL_SYMBOL as P, removePlatformConnectionForInstallation as Q, wrapAnsi as R, S_STEP_SUBMIT as S, dist_exports as T, listInstallationManifests as U, getActivePlatformConnection as V, listPlatformConnections as W, readPendingInstallationSecrets as X, readInstallationRecoverySecrets as Y, removeInstallationRecoverySecrets as Z, S_CHECKBOX_INACTIVE as _, dim as a, readKeyringPassword as at, S_RADIO_INACTIVE as b, import_picocolors as c, formatCloudflareUserMessage as d, savePlatformConnection as et, detectAgents as f, S_CHECKBOX_ACTIVE as g, S_BAR_END as h, createSpinner as i, deleteKeyringPassword as it, select as j, outro as k, sectionTitle as l, S_BAR as m, cliCommandName as n, writeInstallationManifest as nt, ensureUtc as o, writeKeyringPassword as ot, getPackageDir as p, platformWorkerSecretUpdateIntentState as q, cliTitle as r, writePendingInstallationSecrets as rt, helpLine as s, require_picocolors as st, categoryTitle as t, selectPlatformConnection as tt, tablePrefix as u, S_PASSWORD_MASK as v, confirm as w, S_STEP_ACTIVE as x, S_RADIO_ACTIVE as y, acquirePlatformLifecycleLock as z };
+export { promoteInstallationSecrets as $, outro as A, ensureCloudflaredToken as B, cancel as C, log as D, intro as E, CANCEL_SYMBOL as F, assertPlatformInstallationSlugAvailable as G, ensurePlatformProxyAccess as H, isCancel as I, listInstallationManifests as J, getActivePlatformConnection as K, settings as L, select as M, symbol as N, multiselect as O, text as P, platformWorkerSecretUpdateIntentState as Q, u$1 as R, S_STEP_SUBMIT as S, dist_exports as T, isCloudflareAccessChallenge as U, ensurePlatformAccessToken as V, acquirePlatformLifecycleLock as W, normalizePlatformApiUrl as X, listPlatformConnections as Y, platformCredentialAccount as Z, S_CHECKBOX_INACTIVE as _, dim as a, savePlatformConnection as at, S_RADIO_INACTIVE as b, import_picocolors as c, writePendingInstallationSecrets as ct, formatCloudflareUserMessage as d, writeKeyringPassword as dt, readInstallationRecoverySecrets as et, detectAgents as f, require_picocolors as ft, S_CHECKBOX_ACTIVE as g, S_BAR_END as h, createSpinner as i, resolveInstallationManifest as it, password as j, note as k, sectionTitle as l, deleteKeyringPassword as lt, S_BAR as m, cliCommandName as n, removeInstallationRecoverySecrets as nt, ensureUtc as o, selectPlatformConnection as ot, getPackageDir as p, latestPlatformWorkerCutoverGeneration as q, cliTitle as r, removePlatformConnectionForInstallation as rt, helpLine as s, writeInstallationManifest as st, categoryTitle as t, readPendingInstallationSecrets as tt, tablePrefix as u, readKeyringPassword as ut, S_PASSWORD_MASK as v, confirm as w, S_STEP_ACTIVE as x, S_RADIO_ACTIVE as y, wrapAnsi as z };

package/dist/pages/index.mjs

@@ -1,7 +1,7 @@
 import { o as join } from "../dist-BrsS7cai.mjs";
 import { r as resolvePagesDir } from "../project-paths-SK8nMHPp.mjs";
-import { f as readConfig } from "../config-BQFq7QvD.mjs";
-import { i as parseRedirectsFile } from "../headers-D8QfRX9Y.mjs";
+import { f as readConfig } from "../config-uNGuFsI2.mjs";
+import { i as parseRedirectsFile } from "../headers-BAHwgHdW.mjs";
 import { a as resolveNamedLayout, i as resolveLayoutIds, n as resolveEffectiveLayoutChain, r as resolveLayoutChain, t as scanPages } from "../scan-CpK-57ug.mjs";
 import { renderBodyAttrs, renderHeadToString, renderHtmlAttrs, resolveHead } from "./head.mjs";
 import { serializePageData } from "./serialize.mjs";