void 0.20.0 → 0.20.2

package/dist/cli/cli.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { n as __exportAll } from "../rolldown-runtime-rQ84J-ij.mjs";
 import { o as join } from "../dist-BrsS7cai.mjs";
-import { D as log, G as normalizePlatformApiUrl, O as note, c as import_picocolors, d as formatCloudflareUserMessage, k as outro, l as sectionTitle, p as getPackageDir, s as helpLine, t as categoryTitle } from "../output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "../cf-access-AJ1ehiFR.mjs";
+import { D as log, d as formatCloudflareUserMessage, p as getPackageDir } from "../output-B0cfNSx5.mjs";
+import { a as printVoidHeader, i as printHelpPage, o as operatorGroups, r as printGlobalHelp, s as parseOperatorArgs, t as getHelpPath } from "../help-CwOX-zmI.mjs";
+import { r as OperatorClientError } from "../operator-client-LUZnlnYk.mjs";
 import { readFileSync } from "node:fs";
+import { PLATFORM_LOGIN_KINDS, parsePlatformLoginId } from "@void/platform";
 import { parseArgs } from "node:util";
 //#region src/cli/args.ts
 function parseDeployArgs(args) {
@@ -83,7 +84,11 @@ function parseDeployArgs(args) {
 const authSubcommands = [
 	{
 		name: "login",
-		description: "Log in with GitHub or Google"
+		description: "Log in with an enabled platform login method"
+	},
+	{
+		name: "link",
+		description: "Link another login method to your account"
 	},
 	{
 		name: "logout",
@@ -99,13 +104,20 @@ const authSubcommands = [
 	}
 ];
 function parseAuthArgs(args) {
-	const [subcommand, extra] = args;
+	const [subcommand, extra, trailing] = args;
+	if (subcommand === "link") {
+		if (trailing || extra !== void 0 && !/^[a-z][a-z0-9_-]{0,63}$/.test(extra)) throw new Error("auth: Usage: void auth link [connection-id].");
+		return {
+			subcommand,
+			...extra ? { connectionId: extra } : {}
+		};
+	}
 	if (!subcommand || ![
 		"login",
 		"logout",
 		"whoami",
 		"token"
-	].includes(subcommand)) throw new Error("auth: Usage: void auth <login|logout|whoami|token>.");
+	].includes(subcommand)) throw new Error("auth: Usage: void auth <login|link|logout|whoami|token>.");
 	if (extra) throw new Error(`auth: Unexpected argument '${extra}'.`);
 	return { subcommand };
 }
@@ -470,7 +482,7 @@ const PLATFORM_FLAG = {
 const emailSubcommands = [
 	{
 		name: "usage",
-		description: "Show monthly email send/receive counts and quota"
+		description: "Show monthly recipient attempts, inbound receipts, and quota"
 	},
 	{
 		name: "logs",
@@ -490,6 +502,11 @@ const emailSubcommands = [
 		arg: "<address>",
 		description: "Remove a verified recipient"
 	},
+	{
+		name: "domain",
+		arg: "<add|status|list|sync|rotate-secret|remove>",
+		description: "Send and receive at your own domain on a Cloudflare zone"
+	},
 	{
 		name: "status",
 		description: "Show the email setup state and address map",
@@ -507,9 +524,18 @@ const EMAIL_SUBCOMMANDS = [
 	"destinations",
 	"allow",
 	"disallow",
+	"domain",
 	"status",
 	"setup"
 ];
+const EMAIL_DOMAIN_VERBS = [
+	"add",
+	"status",
+	"list",
+	"sync",
+	"rotate-secret",
+	"remove"
+];
 /**
 * Read a value-taking flag in its `--flag value` or `--flag=value` form. Returns the
 * raw value, or `undefined` when the flag is the last token or is followed by another
@@ -534,11 +560,12 @@ function readFlagValue(rest, i, flag) {
 }
 function parseEmailArgs(args) {
 	const subcommand = args[0];
-	if (!subcommand || !EMAIL_SUBCOMMANDS.includes(subcommand)) throw new Error("email: Usage: void email <usage|logs|destinations|allow|disallow|status|setup> [args] [--project <name>] [--limit <n>] [--platform cloudflare].");
+	if (!subcommand || !EMAIL_SUBCOMMANDS.includes(subcommand)) throw new Error("email: Usage: void email <usage|logs|destinations|allow|disallow|domain|status|setup> [args] [--project <name>] [--limit <n>] [--platform cloudflare].");
 	let limit;
 	const projectValues = [];
 	const platformValues = [];
 	const backendValues = [];
+	const subdomainValues = [];
 	const positional = [];
 	const rest = args.slice(1);
 	for (let i = 0; i < rest.length; i++) if (rest[i] === "--project" || rest[i]?.startsWith("--project=")) {
@@ -563,6 +590,11 @@ function parseEmailArgs(args) {
 		if (value === void 0) throw new Error("email: --backend requires a value ('cloudflare').");
 		backendValues.push(value);
 		i = next;
+	} else if (rest[i] === "--subdomain" || rest[i]?.startsWith("--subdomain=")) {
+		const { value, next } = readFlagValue(rest, i, "--subdomain");
+		if (value === void 0 || value.trim() === "") throw new Error("email: --subdomain requires a value (a subdomain label or host).");
+		subdomainValues.push(value);
+		i = next;
 	} else positional.push(rest[i]);
 	if (projectValues.length > 1) throw new Error("email: --project can only be specified once.");
 	const projectSlug = projectValues[0];
@@ -580,6 +612,18 @@ function parseEmailArgs(args) {
 		if (backendValue !== "cloudflare") throw new Error("email: --backend must be 'cloudflare'.");
 		platform = "cloudflare";
 	}
+	if (subdomainValues.length > 1) throw new Error("email: --subdomain can only be specified once.");
+	const subdomain = subdomainValues[0];
+	if (subcommand === "domain") {
+		if (platform === "cloudflare") throw new Error("email: --platform cloudflare applies to `void email status` and `void email setup` only (`domain` is a Void platform command).");
+		return parseEmailDomainArgs(positional, {
+			projectSlug,
+			limit,
+			platform,
+			subdomain
+		});
+	}
+	if (subdomain !== void 0) throw new Error("email: --subdomain applies to `void email domain add` only.");
 	if (positional.length > 1) throw new Error(`email: \`void email ${subcommand}\` takes exactly one positional argument (got ${positional.length}: ${positional.map((p) => JSON.stringify(p)).join(", ")}).`);
 	const address = positional[0];
 	if ((subcommand === "allow" || subcommand === "disallow") && !address) throw new Error(`email: Usage: void email ${subcommand} <address> [--project <name>].`);
@@ -596,6 +640,32 @@ function parseEmailArgs(args) {
 		platform
 	};
 }
+/**
+* The nested `void email domain <verb> [<domain>]` group. positional[0] is the
+* verb, positional[1] the domain — `list` takes no domain, every other verb
+* requires exactly one. Shape validation of the domain itself is the command's
+* job (and ultimately the api's — its regex is authoritative); the parser only
+* counts positionals, exactly as it does for `allow <address>`.
+*/
+function parseEmailDomainArgs(positional, flags) {
+	const verb = positional[0];
+	if (!verb || !EMAIL_DOMAIN_VERBS.includes(verb)) throw new Error("email: Usage: void email domain <add|status|list|sync|rotate-secret|remove> [<domain>] [--project <name>].");
+	if (flags.subdomain !== void 0 && verb !== "add") throw new Error("email: --subdomain applies to `void email domain add` only.");
+	const domain = positional[1];
+	if (verb === "list") {
+		if (domain !== void 0) throw new Error("email: `void email domain list` takes no domain argument.");
+	} else if (domain === void 0) throw new Error(`email: Usage: void email domain ${verb} <domain> [--project <name>].`);
+	if (positional.length > 2) throw new Error(`email: \`void email domain ${verb}\` takes exactly one domain argument (got ${positional.length - 1}: ${positional.slice(1).map((p) => JSON.stringify(p)).join(", ")}).`);
+	return {
+		subcommand: "domain",
+		domainVerb: verb,
+		domain,
+		subdomain: flags.subdomain,
+		projectSlug: flags.projectSlug,
+		limit: flags.limit,
+		platform: flags.platform
+	};
+}
 //#endregion
 //#region src/cli/env-args.ts
 const envSubcommands = [{
@@ -1052,1858 +1122,113 @@ function parseGithubArgs(args) {
 	throw new Error("github: Usage: void github <install|installations|connect|update|status|disconnect|link|join>.");
 }
 //#endregion
-//#region src/cli/ascii.ts
-const asciiArts = [
-	`
-▄   ▄  ▄▄▄  ▄    ▐▌
-█   █ █   █ ▄    ▐▌
- ▀▄▀  ▀▄▄▄▀ █ ▗▞▀▜▌
-            █ ▝▚▄▟▌`,
-	`
-                  oo       dP 
-                           88 
-dP   .dP .d8888b. dP .d888b88 
-88   d8' 88'  \`88 88 88'  \`88 
-88 .88'  88.  .88 88 88.  .88 
-8888P'   \`88888P' dP \`88888P8`,
-	`
-              _     __
- _   ______ (__)___/ /
-| | / / __ \\/ / __  /
-| |/ / /_/ / / /_/ /
-|___/\\____/_/\\__,_/`
-];
-const OPERATOR_MAX_TIMEOUT_MS = 36e5;
-var OperatorClientError = class extends Error {
-	code;
-	status;
-	details;
-	constructor(message, code = "operator_error", status, details) {
-		super(message);
-		this.code = code;
-		this.status = status;
-		this.details = details;
-		this.name = "OperatorClientError";
-	}
-	toJSON() {
-		return {
-			error: this.code,
-			message: this.message,
-			...this.status === void 0 ? {} : { status: this.status },
-			...this.details === void 0 ? {} : { details: this.details }
-		};
-	}
-};
-var OperatorClient = class {
-	token;
-	fetcher;
-	origin;
-	constructor(origin, token, fetcher = fetch) {
-		this.token = token;
-		this.fetcher = fetcher;
-		this.origin = normalizePlatformApiUrl(origin);
-	}
-	async request(path, options = {}) {
-		if (!path.startsWith("/") || path.startsWith("//") || path.includes("?") || path.includes("#")) throw new OperatorClientError("Invalid operator API path.");
-		const timeoutMs = options.timeoutMs ?? (options.method === "POST" ? 3e5 : 3e4);
-		if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1e3 || timeoutMs > 36e5) throw new OperatorClientError(`Operator request timeout must be an integer from 1 to ${OPERATOR_MAX_TIMEOUT_MS / 1e3} seconds.`, "invalid_timeout");
-		const url = new URL(`${this.origin}/operator/v1${path}`);
-		for (const [name, value] of Object.entries(options.query ?? {})) url.searchParams.set(name, value);
-		const timeoutController = new AbortController();
-		const timer = setTimeout(() => timeoutController.abort(), timeoutMs);
-		timer.unref();
-		const signal = options.signal ? AbortSignal.any([options.signal, timeoutController.signal]) : timeoutController.signal;
-		try {
-			let response;
-			try {
-				response = await this.fetcher(url, {
-					method: options.method ?? "GET",
-					headers: {
-						...cfAccessHeaders(process.env, this.origin),
-						Authorization: `Bearer ${this.token}`,
-						Accept: "application/json",
-						...options.body ? { "Content-Type": "application/json" } : {}
-					},
-					...options.body ? { body: JSON.stringify(options.body) } : {},
-					redirect: "manual",
-					signal
-				});
-			} catch (error) {
-				if (options.signal?.aborted) throw error;
-				if (timeoutController.signal.aborted) throw new OperatorClientError(`Operator request exceeded the ${timeoutMs / 1e3}-second timeout. ${options.method === "POST" ? "Its outcome may be unknown; inspect platform state before retrying." : "Check connectivity and try again."}`, "request_timeout");
-				throw new OperatorClientError(`Operator request to ${this.origin} failed. ${options.method === "POST" ? "Its outcome may be unknown; inspect platform state before retrying." : "Check connectivity and try again."}`, "connection_failed");
-			}
-			if (response.status >= 300 && response.status < 400) throw new OperatorClientError("The operator API redirected the request. Credentials were not forwarded; use the exact platform API origin.", "redirect_rejected", response.status);
-			let data;
-			try {
-				data = await response.json();
-			} catch {
-				throw new OperatorClientError(`Operator API returned invalid JSON (HTTP ${response.status}).${options.method === "POST" ? " Inspect platform state before retrying." : ""}`, "invalid_response", response.status);
-			}
-			if (!data || typeof data !== "object" || Array.isArray(data)) throw new OperatorClientError("Operator API returned an invalid response object.", "invalid_response", response.status);
-			const result = data;
-			if (!response.ok) throw new OperatorClientError(typeof result.message === "string" ? result.message : `Operator request failed (HTTP ${response.status}).`, typeof result.error === "string" ? result.error : "request_failed", response.status, result.details);
-			if (result.partial === true || result.ok === false) throw new OperatorClientError("The operation did not fully complete. Inspect the partial result before retrying.", "partial_failure", response.status, result);
-			return result;
-		} finally {
-			clearTimeout(timer);
-		}
-	}
-};
-//#endregion
-//#region src/cli/operator-args.ts
-const operatorCommands = [
-	{
-		group: "auth",
-		action: "login",
-		description: "Sign in as a platform administrator",
-		path: "/session",
-		values: { provider: "OAuth provider" },
-		booleans: ["token-stdin"]
-	},
-	{
-		group: "auth",
-		action: "logout",
-		description: "Revoke the current operator session and remove its local credential",
-		path: "/session/logout"
-	},
-	{
-		group: "auth",
-		action: "status",
-		description: "Inspect operator identity, expiry, and capabilities",
-		path: "/session"
-	},
-	{
-		group: "auth",
-		action: "token",
-		description: "Print an operator token; exchange an API session with --token-stdin",
-		path: "/session",
-		booleans: ["token-stdin"]
-	},
-	{
-		group: "user",
-		action: "list",
-		description: "List users",
-		path: "/users",
-		values: { search: "Search login or email" }
-	},
-	{
-		group: "user",
-		action: "show",
-		description: "Inspect a user, usage, and projects",
-		path: "/users/:id",
-		positional: ["id"]
-	},
-	{
-		group: "user",
-		action: "plan",
-		description: "Change a user plan",
-		path: "/users/:id/plan",
-		positional: ["id", "plan"],
-		method: "POST"
-	},
-	{
-		group: "user",
-		action: "suspend",
-		description: "Suspend a user and their projects",
-		path: "/users/:id/suspend",
-		positional: ["id"],
-		values: { reason: "Reason for suspension" },
-		method: "POST"
-	},
-	{
-		group: "user",
-		action: "restore",
-		description: "Restore a suspended user",
-		path: "/users/:id/restore",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "user",
-		action: "delete",
-		description: "Delete a user and all owned resources",
-		path: "/users/:id/delete",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "project",
-		action: "list",
-		description: "List tenant projects",
-		path: "/projects",
-		values: {
-			user: "Owner user ID",
-			search: "Search projects"
-		}
-	},
-	{
-		group: "project",
-		action: "show",
-		description: "Inspect a project and its resources",
-		path: "/projects/:id",
-		positional: ["id"]
-	},
-	{
-		group: "project",
-		action: "delete",
-		description: "Delete a project and its resources",
-		path: "/projects/:id/delete",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "deployment",
-		action: "list",
-		description: "List tenant deployments",
-		path: "/deployments",
-		values: {
-			project: "Project ID",
-			search: "Search deployments",
-			status: "Deployment status"
-		}
-	},
-	{
-		group: "deployment",
-		action: "show",
-		description: "Inspect a deployment",
-		path: "/deployments/:id",
-		positional: ["id"]
-	},
-	{
-		group: "deployment",
-		action: "cancel",
-		description: "Cancel a deployment",
-		path: "/deployments/:id/cancel",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "deployment",
-		action: "logs",
-		description: "Read runtime logs (JSON follow emits one object per line)",
-		path: "/deployments/:id/logs",
-		positional: ["id"],
-		values: {
-			since: "Duration or ISO timestamp",
-			cursor: "Opaque continuation cursor"
-		},
-		booleans: ["follow"]
-	},
-	{
-		group: "build",
-		action: "show",
-		description: "Inspect a managed build",
-		path: "/builds/:id",
-		positional: ["id"]
-	},
-	{
-		group: "build",
-		action: "logs",
-		description: "Read build logs (JSON follow emits one object per line)",
-		path: "/builds/:id/logs",
-		positional: ["id"],
-		values: { since: "Last received sequence number" },
-		booleans: ["follow"]
-	},
-	{
-		group: "signup",
-		action: "show",
-		description: "Inspect signup restrictions and allowlist",
-		path: "/signup"
-	},
-	{
-		group: "signup",
-		action: "restrict",
-		description: "Restrict signup to the allowlist",
-		path: "/signup/restrict",
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "open",
-		description: "Open public signup",
-		path: "/signup/open",
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "allow",
-		description: "Add a github or email allowlist pattern",
-		path: "/signup/allow",
-		positional: ["type", "pattern"],
-		values: { note: "Allowlist note" },
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "remove",
-		description: "Remove a github or email allowlist pattern",
-		path: "/signup/remove",
-		positional: ["type", "pattern"],
-		method: "POST"
-	},
-	{
-		group: "invitation",
-		action: "list",
-		description: "List invitations",
-		path: "/invitations"
-	},
-	{
-		group: "invitation",
-		action: "send",
-		description: "Send invitations to comma-separated email addresses",
-		path: "/invitations/send",
-		positional: ["emails"],
-		method: "POST"
-	},
-	{
-		group: "invitation",
-		action: "revoke",
-		description: "Revoke an invitation",
-		path: "/invitations/:id/revoke",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "system",
-		action: "overview",
-		description: "Inspect platform usage and capacity",
-		path: "/system/overview"
-	},
-	{
-		group: "system",
-		action: "health",
-		description: "Check platform health",
-		path: "/system/health"
-	},
-	{
-		group: "system",
-		action: "cli-versions",
-		description: "Inspect CLI version adoption and deployment statistics",
-		path: "/system/cli-versions"
-	},
-	{
-		group: "system",
-		action: "events",
-		description: "List operator audit events",
-		path: "/system/events"
-	},
-	{
-		group: "system",
-		action: "backfill-queue-tokens",
-		description: "Repair missing queue authentication tokens",
-		path: "/system/backfill-queue-tokens",
-		method: "POST"
-	},
-	{
-		group: "system",
-		action: "sandbox-drain",
-		description: "Drain and verify managed Sandbox container applications",
-		path: "/system/sandbox-drain",
-		values: { cursor: "Opaque cursor returned by --plan" },
-		method: "POST"
-	},
-	{
-		group: "worker",
-		action: "list",
-		description: "List hosted platform workers",
-		path: "/workers",
-		values: { environment: "production or staging" }
-	},
-	{
-		group: "worker",
-		action: "show",
-		description: "Inspect hosted worker versions",
-		path: "/workers/:id",
-		positional: ["id"],
-		values: { environment: "production or staging" }
-	},
-	{
-		group: "worker",
-		action: "rollback",
-		description: "Roll back a hosted worker to a version",
-		path: "/workers/:id/rollback",
-		positional: ["id", "versionId"],
-		values: { environment: "production or staging" },
-		method: "POST"
-	},
-	{
-		group: "worker",
-		action: "rollback-all",
-		description: "Roll back all hosted workers to their previous versions",
-		path: "/workers/rollback-all",
-		values: { environment: "production or staging" },
-		method: "POST"
-	},
-	{
-		group: "worker",
-		action: "events",
-		description: "List hosted worker events or inspect a batch",
-		path: "/workers/events",
-		positional: ["batchId"],
-		optionalPositional: true,
-		values: { environment: "production or staging" }
-	}
+//#region src/cli/platform-config-args.ts
+const PLATFORM_AUTH_ACTIONS = [
+	"list",
+	"show",
+	"initialize",
+	"add",
+	"configure",
+	"test",
+	"enable",
+	"disable",
+	"link",
+	"admission",
+	"protection",
+	"recover"
 ];
-const operatorGroups = [...new Set(operatorCommands.map(({ group }) => group))];
-function parseOperatorArgs(args) {
+function parsePlatformConfigArgs(args) {
+	if (args.length && args[0] !== "auth") throw new Error("platform: Usage: void platform config auth [command] [options].");
 	const positional = [];
-	const values = {};
 	const flags = /* @__PURE__ */ new Set();
-	const booleanFlags = /* @__PURE__ */ new Set([
-		"json",
-		"plan",
-		"yes",
-		"follow",
-		"token-stdin"
-	]);
-	for (let index = 0; index < args.length; index++) {
+	const values = /* @__PURE__ */ new Map();
+	const valueFlags = [
+		"connection",
+		"installation",
+		"id",
+		"file",
+		"client-secret-env",
+		"test-id"
+	];
+	for (let index = 1; index < args.length; index++) {
 		const arg = args[index];
 		if (!arg.startsWith("-")) {
 			positional.push(arg);
 			continue;
 		}
-		if (!arg.startsWith("--")) throw new Error(`platform: Unknown flag '${arg}'.`);
-		const flag = arg.slice(2);
-		if (flags.has(flag) || Object.hasOwn(values, flag)) throw new Error(`platform: Duplicate flag '${arg}'.`);
-		if (booleanFlags.has(flag)) flags.add(flag);
-		else {
-			const value = args[++index];
-			if (!value || value.startsWith("-")) throw new Error(`platform: ${arg} requires a value.`);
-			values[flag] = value;
+		const name = arg.slice(2);
+		if (!arg.startsWith("--") || ![
+			"json",
+			"plan",
+			"yes"
+		].includes(name) && !valueFlags.includes(name)) throw new Error(`platform: Unknown config auth flag ${arg}.`);
+		if (flags.has(name) || values.has(name)) throw new Error(`platform: Duplicate flag ${arg}.`);
+		if (!valueFlags.includes(name)) {
+			flags.add(name);
+			continue;
 		}
-	}
-	const [group = "", action = "", ...parameters] = positional;
-	if (!operatorGroups.includes(group)) throw new Error("platform: Unknown operator command group.");
-	const parsed = {
-		subcommand: "operator",
-		group,
+		const value = args[++index];
+		if (!value || value.startsWith("-")) throw new Error(`platform: ${arg} requires a value.`);
+		values.set(name, value);
+	}
+	const [action = "", target = "", ...extra] = positional;
+	if (extra.length || action && !PLATFORM_AUTH_ACTIONS.includes(action)) throw new Error(`platform: Usage: void platform config auth <${PLATFORM_AUTH_ACTIONS.join("|")}>.`);
+	const needsTarget = action && action !== "list" && action !== "initialize" && action !== "admission";
+	if (needsTarget && !target || !needsTarget && target) throw new Error(`platform: ${action || "config auth"} ${needsTarget ? "requires a method" : "does not accept a method"}.`);
+	if (action === "add") {
+		if (!PLATFORM_LOGIN_KINDS.includes(target)) throw new Error(`platform: Login kind must be ${PLATFORM_LOGIN_KINDS.join(", ")}.`);
+	} else if (action === "protection") {
+		if (![
+			"enable",
+			"disable",
+			"show"
+		].includes(target)) throw new Error("platform: Usage: void platform config auth protection <enable|disable|show>.");
+	} else if (target) parsePlatformLoginId(target);
+	if (flags.has("plan") && flags.has("yes")) throw new Error("platform: --plan and --yes cannot be combined.");
+	if ((!action || action === "list" || action === "show") && (flags.has("plan") || flags.has("yes"))) throw new Error("platform: Select a configuration change before using --plan or --yes.");
+	if (values.has("id") && action !== "add") throw new Error("platform: --id is only valid when adding a login method.");
+	if (values.has("installation") && action !== "recover" && action !== "protection") throw new Error("platform: --installation is only valid for recovery or platform protection.");
+	if (values.has("file") && ![
+		"add",
+		"configure",
+		"admission",
+		"recover",
+		"protection"
+	].includes(action) || values.has("client-secret-env") && ![
+		"add",
+		"configure",
+		"recover"
+	].includes(action)) throw new Error("platform: --file is valid for add, configure, admission, recover, or protection; --client-secret-env is valid for add, configure, or recover.");
+	if (values.has("test-id") && action !== "enable" && action !== "link") throw new Error("platform: --test-id is only valid for enable or link.");
+	const secretEnv = values.get("client-secret-env") ?? "";
+	if (secretEnv && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(secretEnv)) throw new Error("platform: --client-secret-env requires an environment-variable name.");
+	if (values.has("id")) parsePlatformLoginId(values.get("id"));
+	return {
+		subcommand: "config",
 		action,
-		connection: values.connection ?? "",
+		target,
+		connection: values.get("connection") ?? "",
+		installation: values.get("installation") ?? "",
+		id: values.get("id") ?? "",
+		file: values.get("file") ?? "",
+		clientSecretEnv: secretEnv,
+		testId: values.get("test-id") ?? "",
 		json: flags.has("json"),
 		plan: flags.has("plan"),
-		yes: flags.has("yes"),
-		follow: flags.has("follow"),
-		tokenStdin: flags.has("token-stdin"),
-		provider: values.provider ?? "github",
-		method: "GET",
-		path: "",
-		query: {},
-		body: {}
+		yes: flags.has("yes")
 	};
-	if (!action && args.length === 1) return parsed;
-	const command = operatorCommands.find((entry) => entry.group === group && entry.action === action);
-	if (!command) throw new Error(`platform: Usage: void platform ${group} <${operatorCommands.filter((entry) => entry.group === group).map(({ action }) => action).join("|")}>.`);
-	const count = command.positional?.length ?? 0;
-	if (parameters.length > count || !command.optionalPositional && parameters.length !== count) throw new Error(`platform: Usage: void platform ${group} ${action}${command.positional?.map((name) => ` <${name}>`).join("") ?? ""}.`);
-	const paged = action === "list" || action === "events" || action === "logs";
-	const allowed = /* @__PURE__ */ new Set([
-		"connection",
-		...command.method ? ["timeout"] : [],
-		...Object.keys(command.values ?? {}),
-		...paged ? ["limit", ...action !== "logs" ? ["page"] : []] : []
-	]);
-	for (const name of Object.keys(values)) if (!allowed.has(name)) throw new Error(`platform: Unknown flag '--${name}' for ${group} ${action}.`);
-	for (const name of flags) if (![
-		"json",
-		...command.method ? ["yes", "plan"] : [],
-		...command.booleans ?? []
-	].includes(name)) throw new Error(`platform: Unknown flag '--${name}' for ${group} ${action}.`);
-	if (parsed.plan && parsed.yes) throw new Error("platform: --plan and --yes cannot be combined.");
-	parsed.path = command.path;
-	parsed.method = command.method ?? "GET";
-	for (const [index, name] of (command.positional ?? []).entries()) {
-		const value = parameters[index];
-		if (value === void 0) continue;
-		if (value === "." || value === "..") throw new Error("platform: An object ID cannot be a dot path segment.");
-		if (parsed.path.includes(`:${name}`)) parsed.path = parsed.path.replace(`:${name}`, encodeURIComponent(value));
-		else if (group === "worker" && action === "events") parsed.path += `/${encodeURIComponent(value)}`;
-		else parsed.body[name] = name === "emails" ? value.split(",").map((email) => email.trim()) : value;
-	}
-	for (const [name, value] of Object.entries(values)) {
-		if (name === "connection" || name === "provider") continue;
-		if (name === "timeout") {
-			const maximum = OPERATOR_MAX_TIMEOUT_MS / 1e3;
-			if (!/^[1-9]\d*$/.test(value) || Number(value) > maximum) throw new Error(`platform: --timeout must be an integer from 1 to ${maximum} seconds.`);
-			parsed.timeoutMs = Number(value) * 1e3;
-			continue;
-		}
-		if (name === "page" || name === "limit") {
-			const maximum = name === "limit" ? action === "logs" ? 500 : 100 : 1e6;
-			if (!/^[1-9]\d*$/.test(value) || Number(value) > maximum) throw new Error(`platform: --${name} must be an integer from 1 to ${maximum}.`);
-		}
-		if (name === "since" && group === "build" && (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))) throw new Error("platform: --since must be a nonnegative safe integer for build logs.");
-		if (name === "environment" && !["production", "staging"].includes(value)) throw new Error("platform: --environment must be production or staging.");
-		if (parsed.method === "POST") parsed.body[name] = value;
-		else parsed.query[name] = value;
-	}
-	if (parsed.body.type && !["github", "email"].includes(String(parsed.body.type))) throw new Error("platform: Signup pattern type must be github or email.");
-	return parsed;
-}
-//#endregion
-//#region src/cli/help.ts
-var help_exports = /* @__PURE__ */ __exportAll({
-	getHelpPath: () => getHelpPath,
-	printGlobalHelp: () => printGlobalHelp,
-	printHelpPage: () => printHelpPage,
-	printVoidHeader: () => printVoidHeader
-});
-function operatorHelpTree() {
-	return Object.fromEntries(operatorGroups.map((group) => {
-		const commands = operatorCommands.filter((entry) => entry.group === group);
-		return [group, {
-			summary: `Administer platform ${group}. Operator credentials are separate from deployment credentials.`,
-			usage: [`void platform ${group} <command> [options]`],
-			commands: commands.map((entry) => ({
-				command: entry.action,
-				description: entry.description
-			})),
-			children: Object.fromEntries(commands.map((entry) => [entry.action, {
-				summary: `${entry.description}.`,
-				usage: [`void platform ${group} ${entry.action}${entry.positional?.map((name) => entry.optionalPositional ? ` [${name}]` : ` <${name}>`).join("") ?? ""} [options]`],
-				options: [
-					{
-						command: "--connection <id-or-url>",
-						description: "Choose a registered connection; otherwise use VOID_API_URL or the active connection"
-					},
-					{
-						command: "--json",
-						description: "Write structured JSON to stdout (JSON Lines while following logs)"
-					},
-					...entry.method ? [
-						{
-							command: "--plan",
-							description: "Validate and preview without changing anything"
-						},
-						{
-							command: "--yes",
-							description: "Apply after preview without prompting; required in unattended scripts"
-						},
-						{
-							command: "--timeout <seconds>",
-							description: "Mutation deadline (default 300 seconds; maximum 3600 seconds)"
-						}
-					] : [],
-					...[
-						"list",
-						"events",
-						"logs"
-					].includes(entry.action) ? [{
-						command: "--limit <number>",
-						description: entry.action === "logs" ? "Maximum 500 log records" : "Maximum 100 records per page"
-					}, ...entry.action !== "logs" ? [{
-						command: "--page <number>",
-						description: "One-based page number"
-					}] : []] : [],
-					...Object.entries(entry.values ?? {}).map(([flag, description]) => ({
-						command: `--${flag} <value>`,
-						description
-					})),
-					...(entry.booleans ?? []).map((flag) => ({
-						command: `--${flag}`,
-						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : "Read a full API session from stdin for explicit operator session exchange"
-					}))
-				]
-			}]))
-		}];
-	}));
-}
-const HELP_TREE = {
-	connect: {
-		summary: "Connect this project to Cloudflare or an existing Void platform.",
-		usage: ["void connect [url] [--platform <cloudflare|void>] [--no-login]"],
-		options: [{
-			command: "--platform <cloudflare|void>",
-			description: "Choose the deployment destination"
-		}, {
-			command: "--no-login",
-			description: "Save a Void connection without authenticating"
-		}],
-		examples: [
-			{
-				command: "void connect",
-				description: "Choose a destination and sign in"
-			},
-			{
-				command: "void connect https://platform.example.com",
-				description: "Join a Void platform"
-			},
-			{
-				command: "void connect --platform cloudflare",
-				description: "Sign in and select a Cloudflare account"
-			}
-		]
-	},
-	init: {
-		summary: "Set up Void in a new or existing project.",
-		usage: ["void init [options]"],
-		options: [
-			{
-				command: "--agents",
-				description: "Set up agent instructions and skills"
-			},
-			{
-				command: "--tsconfig",
-				description: "Only update tsconfig.json"
-			},
-			{
-				command: "--git",
-				description: "Initialize a Git repository without prompting"
-			},
-			{
-				command: "--no-git",
-				description: "Skip Git repository initialization"
-			},
-			{
-				command: "--github",
-				description: "Only create the GitHub Actions deploy workflow (OIDC, no stored token)"
-			}
-		],
-		examples: [
-			{
-				command: "void init",
-				description: "Scaffold or configure the current project"
-			},
-			{
-				command: "void init --agents",
-				description: "Install agent instructions and skills"
-			},
-			{
-				command: "void init --github",
-				description: "Scaffold the GitHub Actions deploy workflow"
-			}
-		]
-	},
-	deploy: {
-		summary: "Build and deploy. Offers to link an existing Cloudflare Worker when no destination is configured.",
-		usage: ["void deploy [options]"],
-		options: [
-			{
-				command: "--project <name>",
-				description: "Deploy target project name"
-			},
-			{
-				command: "--dir <path>",
-				description: "Deploy a static directory and skip build"
-			},
-			{
-				command: "--spa",
-				description: "Use SPA mode for static deploys"
-			},
-			{
-				command: "--skip-build",
-				description: "Skip the build step and use existing output (static deploys on Cloudflare)"
-			},
-			{
-				command: "--platform <cloudflare|void>",
-				description: "Override the platform saved by void init"
-			},
-			{
-				command: "--require-email",
-				description: "Fail instead of deploying without email when the mail domain is not set up (with --platform cloudflare)"
-			},
-			{
-				command: "--debug",
-				description: "Mirror the deploy log to stderr (always written to ~/.void/logs)"
-			}
-		],
-		examples: [
-			{
-				command: "void deploy",
-				description: "Deploy the linked project"
-			},
-			{
-				command: "void deploy --project my-app",
-				description: "Deploy to a specific project"
-			},
-			{
-				command: "void deploy --dir dist --spa",
-				description: "Deploy a static SPA directory"
-			},
-			{
-				command: "void deploy --platform cloudflare",
-				description: "Deploy to your own Cloudflare account"
-			}
-		]
-	},
-	auth: {
-		summary: "Log in, log out, and inspect local auth state.",
-		usage: ["void auth <command>"],
-		commands: [
-			{
-				command: "login",
-				description: "Log in with GitHub or Google"
-			},
-			{
-				command: "logout",
-				description: "Log out and remove credentials"
-			},
-			{
-				command: "whoami",
-				description: "Show the logged-in username"
-			},
-			{
-				command: "token",
-				description: "Copy auth token to clipboard"
-			}
-		],
-		children: {
-			login: basicSubcommand("Log in with GitHub or Google.", "void auth login"),
-			logout: basicSubcommand("Log out and remove credentials.", "void auth logout"),
-			whoami: basicSubcommand("Show the logged-in username.", "void auth whoami"),
-			token: basicSubcommand("Copy auth token to clipboard.", "void auth token")
-		}
-	},
-	cloudflare: {
-		summary: "Manage Cloudflare authentication used by Void.",
-		usage: ["void cloudflare <command>"],
-		commands: [
-			{
-				command: "login",
-				description: "Sign in or switch users with browser OAuth"
-			},
-			{
-				command: "status",
-				description: "Show identity, authentication, and the deployment account"
-			},
-			{
-				command: "logout",
-				description: "Remove the local browser session"
-			}
-		],
-		children: {
-			login: basicSubcommand("Sign in again or switch Cloudflare users with browser OAuth.", "void cloudflare login"),
-			status: basicSubcommand("Show Cloudflare identity, authentication, accessible accounts, and the pinned deployment account.", "void cloudflare status"),
-			logout: basicSubcommand("Remove the local browser session.", "void cloudflare logout")
-		}
-	},
-	platform: {
-		summary: "Install Void platforms and administer users, projects, access, and operations. Use `void connect` to join one.",
-		usage: ["void platform <command>"],
-		commands: [
-			...operatorGroups.map((group) => ({
-				command: `${group} <command>`,
-				description: `Administer platform ${group}`
-			})),
-			{
-				command: "list",
-				description: "List installed and connected platforms"
-			},
-			{
-				command: "use [id]",
-				description: "Select the default Void platform"
-			},
-			{
-				command: "status [id]",
-				description: "Inspect a platform and its health"
-			},
-			{
-				command: "discover",
-				description: "Recover installations from a Cloudflare account"
-			},
-			{
-				command: "domain set <domain>",
-				description: "Add an application domain to a test platform"
-			},
-			{
-				command: "install",
-				description: "Install a Void platform in Cloudflare"
-			},
-			{
-				command: "upgrade [id]",
-				description: "Upgrade an installed Void platform"
-			},
-			{
-				command: "rollback [id]",
-				description: "Restore a compatible earlier platform runtime"
-			},
-			{
-				command: "repair [id]",
-				description: "Reconcile an installed Void platform"
-			},
-			{
-				command: "disable [id]",
-				description: "Disable traffic without deleting data"
-			},
-			{
-				command: "enable [id]",
-				description: "Restore traffic for a disabled platform"
-			},
-			{
-				command: "uninstall [id]",
-				description: "Safely remove an installed Void platform"
-			}
-		],
-		children: {
-			...operatorHelpTree(),
-			domain: {
-				summary: "Add an application domain while keeping existing workers.dev URLs.",
-				usage: ["void platform domain set <domain> [options]"],
-				children: { set: {
-					summary: "Set up DNS and verify HTTPS before making an application domain canonical. Rerun to resume.",
-					usage: ["void platform domain set <domain> [options]"],
-					options: [
-						{
-							command: "--installation <id>",
-							description: "Choose an installed platform; otherwise select interactively"
-						},
-						{
-							command: "--zone <domain>",
-							description: "Containing Cloudflare zone; detected when it already exists"
-						},
-						{
-							command: "--dedicated-zone",
-							description: "Add catch-all routes for a zone dedicated to this platform"
-						},
-						{
-							command: "--plan",
-							description: "Preview without making changes"
-						},
-						{
-							command: "--yes",
-							description: "Apply without an interactive confirmation"
-						}
-					]
-				} }
-			},
-			list: basicSubcommand("List installed and connected platforms.", "void platform list"),
-			use: basicSubcommand("Select the default Void platform.", "void platform use [id]"),
-			status: basicSubcommand("Inspect a platform and its health.", "void platform status [id]"),
-			discover: {
-				summary: "Recover owned platform installations from Cloudflare.",
-				usage: ["void platform discover [--account <id>] [--installation <id-or-name>]"],
-				options: [{
-					command: "--account <id>",
-					description: "Cloudflare account id"
-				}, {
-					command: "--installation <id-or-name>",
-					description: "Recover only one installation from a shared account"
-				}]
-			},
-			install: {
-				summary: "Install or resume a Void platform with a domain, or workers.dev for testing.",
-				usage: ["void platform install [options]"],
-				options: [
-					{
-						command: "--name <slug>",
-						description: "Installation name"
-					},
-					{
-						command: "--workers-dev",
-						description: "Use workers.dev for testing; add a domain later"
-					},
-					{
-						command: "--display-name <name>",
-						description: "Human-readable platform name"
-					},
-					{
-						command: "--account <id>",
-						description: "Cloudflare account id"
-					},
-					{
-						command: "--application-domain <domain>",
-						description: "Base domain for applications (zone apex is simplest)"
-					},
-					{
-						command: "--zone <domain>",
-						description: "Cloudflare zone containing the app domain"
-					},
-					{
-						command: "--dedicated-zone",
-						description: "Allow zone-wide application catch-all routes"
-					},
-					{
-						command: "--control-plane-domain <domain>",
-						description: "Optional API hostname"
-					},
-					{
-						command: "--plan",
-						description: "Print the exact plan without changing Cloudflare"
-					},
-					{
-						command: "--resume",
-						description: "Resume the matching local installation"
-					},
-					{
-						command: "--runtime <path>",
-						description: "Deploy an integrity-checked runtime directory instead of the package"
-					},
-					{
-						command: "--yes",
-						description: "Acknowledge changes without an interactive prompt"
-					}
-				]
-			},
-			upgrade: lifecycleHelp("upgrade", "Upgrade an installed platform without deleting resources."),
-			rollback: {
-				summary: "Restore a compatible earlier runtime without reversing database migrations.",
-				usage: ["void platform rollback [id] --runtime <earlier-path> [--from-runtime <current-path>] [--plan] [--yes]"],
-				options: [
-					{
-						command: "--runtime <path>",
-						description: "Earlier compatible runtime to restore"
-					},
-					{
-						command: "--from-runtime <path>",
-						description: "Current installed runtime when it differs from the packaged runtime"
-					},
-					{
-						command: "--plan",
-						description: "Print the exact plan without making changes"
-					},
-					{
-						command: "--yes",
-						description: "Acknowledge non-interactive Cloudflare changes"
-					}
-				]
-			},
-			repair: lifecycleHelp("repair", "Reconcile drift using the installation ownership manifest."),
-			disable: lifecycleHelp("disable", "Disable platform traffic without deleting data."),
-			enable: lifecycleHelp("enable", "Restore configured traffic for a disabled platform."),
-			uninstall: {
-				summary: "Safely remove installer-owned platform resources.",
-				usage: ["void platform uninstall [id] [options]"],
-				options: [
-					{
-						command: "--plan",
-						description: "Print the exact deletion and retention plan"
-					},
-					{
-						command: "--yes",
-						description: "Acknowledge changes without an interactive prompt"
-					},
-					{
-						command: "--purge-data",
-						description: "Delete installer-owned data even when it contains apps"
-					},
-					{
-						command: "--keep-zone",
-						description: "Explicitly retain an installer-created zone"
-					}
-				]
-			}
-		}
-	},
-	project: {
-		summary: "Manage Void projects and deployments.",
-		usage: ["void project <command>"],
-		commands: [
-			{
-				command: "status [name]",
-				description: "Show deployments for a project"
-			},
-			{
-				command: "link [name]",
-				description: "Link this directory to a project"
-			},
-			{
-				command: "list",
-				description: "List your projects"
-			},
-			{
-				command: "logs",
-				description: "Show runtime logs from the deployed project"
-			},
-			{
-				command: "requests",
-				description: "Show request-level traffic (status, method, timing)"
-			},
-			{
-				command: "rollback [deployId]",
-				description: "Roll back to a previous deployment"
-			},
-			{
-				command: "cancel [deployId]",
-				description: "Cancel an active deployment"
-			},
-			{
-				command: "delete [name]",
-				description: "Delete a project and all its resources"
-			},
-			{
-				command: "purge-cache",
-				description: "Purge all cached pages"
-			}
-		],
-		children: {
-			status: basicSubcommand("Show deployments for a project.", "void project status [name]", "void project status my-app"),
-			link: basicSubcommand("Link this directory to a Void project.", "void project link [name]", "void project link my-app"),
-			list: basicSubcommand("List your projects.", "void project list"),
-			logs: {
-				summary: "Show runtime logs from the deployed project.",
-				usage: ["void project logs [options]"],
-				options: [
-					{
-						command: "--filter <text>",
-						description: "Substring search over log messages"
-					},
-					{
-						command: "--level <level>",
-						description: "Filter by level: error|warn|info|log|debug|all (default: all)"
-					},
-					{
-						command: "--range <range>",
-						description: "Time range to query (default: 1h)"
-					},
-					{
-						command: "--deployment <id>",
-						description: "Limit logs to one deployment"
-					}
-				],
-				examples: [
-					{
-						command: "void project logs --range 30m",
-						description: "Show recent project logs"
-					},
-					{
-						command: "void project logs --level error",
-						description: "Show only error-level entries and exceptions"
-					},
-					{
-						command: "void project logs --filter websocket",
-						description: "Substring search over log messages"
-					}
-				]
-			},
-			requests: {
-				summary: "Show request-level traffic (status, method, type, timing). Surfaces 5xx that the edge router generated itself and requests to static/SPA projects that never invoke a worker — neither of which appears in `project logs`.",
-				usage: ["void project requests [options]"],
-				options: [{
-					command: "--status <filter>",
-					description: "Filter by status: a class like 5xx or an exact code like 500"
-				}, {
-					command: "--range <range>",
-					description: "Time range to query (default: 1h)"
-				}],
-				examples: [{
-					command: "void project requests --status 5xx",
-					description: "Show recent server-error responses, including edge-generated ones"
-				}, {
-					command: "void project requests --range 24h",
-					description: "Show all request traffic in the last day"
-				}]
-			},
-			rollback: basicSubcommand("Roll back to a previous deployment.", "void project rollback [deployId]"),
-			cancel: basicSubcommand("Cancel an active deployment.", "void project cancel [deployId]"),
-			delete: {
-				summary: "Delete a project and all its resources.",
-				usage: ["void project delete [name] [options]"],
-				options: [{
-					command: "--force, -f",
-					description: "Delete without confirmation"
-				}],
-				examples: [{
-					command: "void project delete my-app",
-					description: "Delete a project"
-				}]
-			},
-			"purge-cache": {
-				summary: "Purge all cached pages for a project.",
-				usage: ["void project purge-cache [options]"],
-				options: [{
-					command: "--project <name>",
-					description: "Project name override"
-				}]
-			}
-		}
-	},
-	secret: {
-		summary: "Manage production secrets for Void projects.",
-		usage: ["void secret <command>"],
-		commands: [
-			{
-				command: "list",
-				description: "List project secrets"
-			},
-			{
-				command: "put <name>",
-				description: "Set a project secret"
-			},
-			{
-				command: "delete <name>",
-				description: "Delete a project secret"
-			},
-			{
-				command: "sync <file>",
-				description: "Sync secrets from a dotenv file"
-			}
-		],
-		children: {
-			list: withProjectOption("List project secrets.", "void secret list [options]"),
-			put: withProjectOption("Set a project secret.", "void secret put <name> [options]"),
-			delete: withProjectOption("Delete a project secret.", "void secret delete <name> [options]"),
-			sync: withProjectOption("Sync secrets from a dotenv file.", "void secret sync <file> [options]")
-		}
-	},
-	domain: {
-		summary: "Configure custom domains for Void projects.",
-		usage: ["void domain <command>"],
-		commands: [
-			{
-				command: "add <hostname>",
-				description: "Add a custom domain"
-			},
-			{
-				command: "delete <hostname>",
-				description: "Remove a custom domain"
-			},
-			{
-				command: "list",
-				description: "List custom domains and status"
-			},
-			{
-				command: "status <hostname>",
-				description: "Check domain verification status"
-			}
-		],
-		children: {
-			add: withProjectOption("Add a custom domain.", "void domain add <hostname> [options]"),
-			delete: withProjectOption("Remove a custom domain.", "void domain delete <hostname> [options]"),
-			list: withProjectOption("List custom domains and status.", "void domain list [options]"),
-			status: {
-				summary: "Check domain verification status. Prints a rolled-up state with a one-line diagnostic.",
-				usage: ["void domain status <hostname> [options]"],
-				options: [{
-					command: "--project <name>",
-					description: "Project name override"
-				}, {
-					command: "--verbose",
-					description: "Also print the raw multi-line status breakdown"
-				}]
-			}
-		}
-	},
-	email: {
-		summary: "Inspect email activity and manage verified recipients.",
-		usage: ["void email <command>"],
-		commands: [
-			{
-				command: "usage",
-				description: "Show monthly outbound/inbound counts and quota"
-			},
-			{
-				command: "logs",
-				description: "Show recent email delivery activity"
-			},
-			{
-				command: "destinations",
-				description: "List verified recipient addresses"
-			},
-			{
-				command: "allow <address>",
-				description: "Add a recipient and trigger CF verification"
-			},
-			{
-				command: "disallow <address>",
-				description: "Remove a recipient from the allowlist"
-			},
-			{
-				command: "status --platform cloudflare",
-				description: "Show the email setup state and address map on your own account"
-			},
-			{
-				command: "setup --platform cloudflare",
-				description: "Set email up on your own Cloudflare account (one confirmation)"
-			}
-		],
-		children: {
-			usage: withProjectOption("Show monthly outbound/inbound counts and quota.", "void email usage [options]"),
-			logs: {
-				summary: "Show recent email delivery activity.",
-				usage: ["void email logs [options]"],
-				options: [{
-					command: "--project <name>",
-					description: "Project name override"
-				}, {
-					command: "--limit <n>",
-					description: "How many entries to show (positive integer)"
-				}]
-			},
-			destinations: withProjectOption("List verified recipient addresses.", "void email destinations [options]"),
-			allow: withProjectOption("Add a recipient and trigger a Cloudflare verification email.", "void email allow <address> [options]"),
-			disallow: withProjectOption("Remove a recipient from the verified allowlist.", "void email disallow <address> [options]"),
-			status: {
-				summary: "Show the email setup state and address map. Exit 1 when not ready.",
-				usage: ["void email status --platform cloudflare"],
-				options: [{
-					command: "--platform cloudflare",
-					description: "Your own Cloudflare account (the only platform with a status today)"
-				}]
-			},
-			setup: {
-				summary: "Set email up on your own Cloudflare account: enable Email Routing, onboard Email Sending, write send_email + addresses into wrangler.jsonc. Asks once before changing the account.",
-				usage: ["void email setup --platform cloudflare"],
-				options: [{
-					command: "--platform cloudflare",
-					description: "Your own Cloudflare account (required; the Void platform needs no setup)"
-				}]
-			}
-		}
-	},
-	github: {
-		summary: "Connect a GitHub repository for automatic deploys.",
-		usage: ["void github <command>"],
-		commands: [
-			{
-				command: "install",
-				description: "Open the GitHub App install page in your browser"
-			},
-			{
-				command: "installations",
-				description: "List your GitHub App installations"
-			},
-			{
-				command: "connect [project]",
-				description: "Connect a repository to a project for auto-deploy"
-			},
-			{
-				command: "update [project]",
-				description: "Update an existing connection's branch, build executor, or deploy workflow"
-			},
-			{
-				command: "status [project]",
-				description: "Show a project's GitHub connection (repo, branch, executor, workflow)"
-			},
-			{
-				command: "disconnect [project]",
-				description: "Disconnect a project from its GitHub repository"
-			},
-			{
-				command: "link",
-				description: "Link your GitHub account to Void"
-			},
-			{
-				command: "join",
-				description: "Join your organization's shared GitHub App installations"
-			}
-		],
-		children: {
-			install: basicSubcommand("Open the GitHub App install page in your browser.", "void github install"),
-			installations: basicSubcommand("List your GitHub App installations.", "void github installations"),
-			link: basicSubcommand("Link your GitHub account to Void.", "void github link"),
-			join: basicSubcommand("Join your organization's shared GitHub App installations.", "void github join"),
-			connect: {
-				summary: "Connect a repository to a project for automatic deploys.",
-				usage: ["void github connect [project] [options]"],
-				options: [
-					{
-						command: "--project <name>",
-						description: "Project name (alias for positional)"
-					},
-					{
-						command: "--installation <id>",
-						description: "GitHub App installation ID"
-					},
-					{
-						command: "--repo <owner/repo>",
-						description: "Repository full name (owner/repo)"
-					},
-					{
-						command: "--branch <name>",
-						description: "Branch to deploy from (required in non-interactive mode)"
-					},
-					{
-						command: "--executor <type>",
-						description: "Build executor: container (default) | github_actions; prompted interactively when omitted"
-					},
-					{
-						command: "--workflow <path>",
-						description: "Authorized deploy workflow file (default .github/workflows/void-deploy.yml); prompted interactively when using github_actions"
-					}
-				],
-				examples: [
-					{
-						command: "void github connect [project]",
-						description: "Connect a repository to a project"
-					},
-					{
-						command: "void github connect my-app --installation 42 --repo owner/repo --branch main",
-						description: "Non-interactive connect (all flags explicit)"
-					},
-					{
-						command: "void github connect my-app --repo owner/repo --branch main --executor github_actions",
-						description: "Non-interactive connect using the GitHub Actions executor"
-					}
-				]
-			},
-			update: {
-				summary: "Update an existing connection's branch, build executor, or deploy workflow.",
-				usage: ["void github update [project] [options]"],
-				options: [
-					{
-						command: "--project <name>",
-						description: "Project name (alias for positional)"
-					},
-					{
-						command: "--branch <name>",
-						description: "New branch to deploy from"
-					},
-					{
-						command: "--executor <type>",
-						description: "New build executor: container | github_actions; prompted interactively when omitted"
-					},
-					{
-						command: "--workflow <path>",
-						description: "New authorized deploy workflow file under .github/workflows/; prompted interactively when using github_actions"
-					}
-				],
-				examples: [{
-					command: "void github update my-app --executor github_actions",
-					description: "Switch an existing connection to the GitHub Actions executor"
-				}, {
-					command: "void github update my-app --branch release",
-					description: "Change the deploy branch"
-				}]
-			},
-			status: {
-				summary: "Show a project's GitHub connection settings.",
-				usage: ["void github status [project] [options]"],
-				options: [{
-					command: "--project <name>",
-					description: "Project name (alias for positional)"
-				}],
-				examples: [{
-					command: "void github status",
-					description: "Show the linked project's connection"
-				}, {
-					command: "void github status my-app",
-					description: "Show a specific project connection"
-				}]
-			},
-			disconnect: {
-				summary: "Disconnect a project from its GitHub repository.",
-				usage: ["void github disconnect [project] [options]"],
-				options: [{
-					command: "--project <name>",
-					description: "Project name (alias for positional)"
-				}, {
-					command: "--yes",
-					description: "Skip the confirmation prompt (required in non-interactive shells)"
-				}],
-				examples: [{
-					command: "void github disconnect",
-					description: "Disconnect the linked project's repository"
-				}, {
-					command: "void github disconnect my-app --yes",
-					description: "Disconnect a specific project without confirmation"
-				}]
-			}
-		}
-	},
-	build: {
-		summary: "Inspect remote builds.",
-		usage: ["void build <command>"],
-		commands: [{
-			command: "logs [build]",
-			description: "Stream, tail, or download logs for a build"
-		}],
-		children: { logs: {
-			summary: "Stream, tail, or download logs for a build.",
-			usage: ["void build logs [build] [options]"],
-			options: [
-				{
-					command: "--follow, -f",
-					description: "Live-tail until the build finishes"
-				},
-				{
-					command: "--output <file>, -o",
-					description: "Write logs to a file instead of stdout"
-				},
-				{
-					command: "--project <slug>, -p",
-					description: "Target project (else linked / VOID_PROJECT)"
-				}
-			],
-			examples: [
-				{
-					command: "void build logs",
-					description: "Print the latest build's logs"
-				},
-				{
-					command: "void build logs -f",
-					description: "Follow the latest build until it finishes"
-				},
-				{
-					command: "void build logs bld_123 -o build.log",
-					description: "Download a build's logs to a file"
-				}
-			]
-		} }
-	},
-	db: {
-		summary: "Manage local and remote database state.",
-		usage: ["void db <command>"],
-		commands: [
-			{
-				command: "push",
-				description: "Push schema to local D1 without migration files"
-			},
-			{
-				command: "generate",
-				description: "Generate SQL migrations from schema changes"
-			},
-			{
-				command: "status",
-				description: "Show migration status (local and remote)"
-			},
-			{
-				command: "reset",
-				description: "Reset local DB and re-run migrations"
-			},
-			{
-				command: "seed",
-				description: "Reset local DB, run migrations, and seed"
-			},
-			{
-				command: "execute <sql>",
-				description: "Run SQL against the database (--remote for deployed)"
-			},
-			{
-				command: "migrate",
-				description: "Apply pending migrations"
-			},
-			{
-				command: "studio",
-				description: "Open Drizzle Studio (--remote for deployed PG)"
-			},
-			{
-				command: "export",
-				description: "Export local database as SQL"
-			},
-			{
-				command: "connect",
-				description: "Connect or provision an external database"
-			},
-			{
-				command: "set-url",
-				description: "Update the external database URL"
-			},
-			{
-				command: "rename-migrations",
-				description: "Rename migrations to timestamp format"
-			}
-		],
-		children: {
-			push: basicSubcommand("Push schema to local D1 without migration files.", "void db push"),
-			generate: basicSubcommand("Generate SQL migrations from schema changes.", "void db generate"),
-			status: basicSubcommand("Show migration status for local and remote DBs.", "void db status"),
-			reset: basicSubcommand("Reset local DB and re-run migrations.", "void db reset"),
-			seed: {
-				summary: "Reset local DB, run migrations, and seed data.",
-				usage: ["void db seed [options]"],
-				options: [{
-					command: "--file <path>",
-					description: "Seed from a specific file"
-				}]
-			},
-			execute: {
-				summary: "Run SQL against the database (local by default; use --remote for the deployed database).",
-				usage: ["void db execute <sql>", "void db execute --file <path>"],
-				options: [{
-					command: "--file <path>",
-					description: "Run SQL from a file instead"
-				}, {
-					command: "--remote",
-					description: "Run against the deployed database (D1 via proxy; PostgreSQL via direct connection)"
-				}],
-				examples: [
-					{
-						command: "void db execute \"select * from users\"",
-						description: "Run inline SQL"
-					},
-					{
-						command: "void db execute --file query.sql",
-						description: "Run SQL from a file"
-					},
-					{
-						command: "void db execute --remote \"select count(*) from users\"",
-						description: "Query the deployed database"
-					}
-				]
-			},
-			migrate: {
-				summary: "Apply pending migrations.",
-				usage: ["void db migrate [options]"],
-				options: [{
-					command: "--remote",
-					description: "Apply to the remote database"
-				}]
-			},
-			studio: {
-				summary: "Open Drizzle Studio against the database (local by default; use --remote for the deployed PostgreSQL database; D1 remote not yet supported).",
-				usage: ["void db studio [options]"],
-				options: [{
-					command: "--remote",
-					description: "Open Studio against the deployed PostgreSQL database (D1 remote not yet supported)"
-				}],
-				examples: [{
-					command: "void db studio",
-					description: "Open Studio for the local database"
-				}, {
-					command: "void db studio --remote",
-					description: "Open Studio against the deployed PostgreSQL database"
-				}]
-			},
-			export: {
-				summary: "Export local database contents as SQL.",
-				usage: ["void db export [options]"],
-				options: [
-					{
-						command: "--output <path>",
-						description: "Export to a specific file path"
-					},
-					{
-						command: "--no-data",
-						description: "Schema only (no INSERT statements)"
-					},
-					{
-						command: "--no-schema",
-						description: "Data only (no CREATE TABLE)"
-					},
-					{
-						command: "--table <name>",
-						description: "Export a single table"
-					}
-				]
-			},
-			connect: {
-				summary: "Connect or provision an external PostgreSQL/MySQL database.",
-				usage: ["void db connect [connection-string]", "void db connect --provider <name-or-module> [options]"],
-				options: [
-					{
-						command: "--provider <name-or-module>",
-						description: "Provision with an adapter"
-					},
-					{
-						command: "--name <name>",
-						description: "Provider project/database name"
-					},
-					{
-						command: "--region <region>",
-						description: "Provider region identifier"
-					},
-					{
-						command: "--local-only",
-						description: "Do not sync a linked Void project"
-					}
-				],
-				examples: [{
-					command: "void db connect \"postgresql://user:pass@host/db\"",
-					description: "Connect an existing database"
-				}, {
-					command: "void db connect --provider neon --name my-app",
-					description: "Provision a Neon database using NEON_API_KEY"
-				}]
-			},
-			"set-url": basicSubcommand("Update the external database connection string for deployment.", "void db set-url"),
-			"rename-migrations": basicSubcommand("Rename migrations to timestamp-based format.", "void db rename-migrations")
-		}
-	},
-	env: {
-		summary: "Validate env.ts and generate environment types.",
-		usage: ["void env <command>"],
-		commands: [{
-			command: "check",
-			description: "Validate local .env or remote secret names"
-		}, {
-			command: "types",
-			description: "Regenerate .void/env.d.ts from env.ts"
-		}],
-		children: {
-			check: {
-				summary: "Validate local .env or required remote secret names.",
-				usage: ["void env check [options]"],
-				options: [{
-					command: "--remote",
-					description: "Check required server keys as remote secrets"
-				}]
-			},
-			types: basicSubcommand("Regenerate .void/env.d.ts from env.ts.", "void env types")
-		}
-	},
-	gen: {
-		summary: "Scaffold routes, models, background jobs, and framework entries.",
-		usage: ["void gen <command>"],
-		commands: [
-			{
-				command: "model <name> [cols...]",
-				description: "Generate migration, CRUD routes, and DB types"
-			},
-			{
-				command: "migration <name>",
-				description: "Generate an empty migration file"
-			},
-			{
-				command: "route <path>",
-				description: "Generate a route with handler exports"
-			},
-			{
-				command: "middleware <name>",
-				description: "Generate a numbered middleware file"
-			},
-			{
-				command: "ssr",
-				description: "Generate SSR entry, client, and App component"
-			},
-			{
-				command: "cron <name>",
-				description: "Generate a cron job file"
-			},
-			{
-				command: "queue <name>",
-				description: "Generate a queue consumer file"
-			}
-		],
-		children: {
-			model: {
-				summary: "Generate a migration, CRUD routes, and database types.",
-				usage: ["void gen model <name> [columns...]"],
-				examples: [{
-					command: "void gen model post title:string body:text",
-					description: "Create a model"
-				}]
-			},
-			migration: basicSubcommand("Generate an empty migration file.", "void gen migration <name>"),
-			route: {
-				summary: "Generate a route with handler exports.",
-				usage: ["void gen route <path> [options]"],
-				options: [{
-					command: "--methods <list>",
-					description: "Comma-separated methods (default: get)"
-				}],
-				examples: [{
-					command: "void gen route api/posts --methods get,post",
-					description: "Create a route"
-				}]
-			},
-			middleware: basicSubcommand("Generate a numbered middleware file.", "void gen middleware <name>"),
-			ssr: {
-				summary: "Generate SSR entry, client, and App component.",
-				usage: ["void gen ssr [options]"],
-				options: [
-					{
-						command: "--react",
-						description: "Use React"
-					},
-					{
-						command: "--vue",
-						description: "Use Vue"
-					},
-					{
-						command: "--svelte",
-						description: "Use Svelte"
-					},
-					{
-						command: "--solid",
-						description: "Use Solid"
-					}
-				]
-			},
-			cron: basicSubcommand("Generate a cron job file.", "void gen cron <name>"),
-			queue: basicSubcommand("Generate a queue consumer file.", "void gen queue <name>")
-		}
-	},
-	prepare: {
-		summary: "Generate .void artifacts without starting Vite.",
-		usage: ["void prepare"],
-		examples: [{
-			command: "void prepare",
-			description: "Refresh generated project types"
-		}]
-	}
-};
-function basicSubcommand(summary, usage, example) {
-	return {
-		summary,
-		usage: [usage],
-		examples: example ? [{
-			command: example,
-			description: summary
-		}] : void 0
-	};
-}
-function withProjectOption(summary, usage) {
-	return {
-		summary,
-		usage: [usage],
-		options: [{
-			command: "--project <name>",
-			description: "Project name override"
-		}]
-	};
-}
-function lifecycleHelp(command, summary) {
-	return {
-		summary,
-		usage: [`void platform ${command} [id] [--plan]${command === "disable" ? "" : " [--runtime <path>]"} [--yes]`],
-		options: [
-			{
-				command: "--plan",
-				description: "Print the exact plan without making changes"
-			},
-			...command === "disable" ? [] : [{
-				command: "--runtime <path>",
-				description: "Deploy an integrity-checked runtime directory instead of the package"
-			}],
-			{
-				command: "--yes",
-				description: "Acknowledge non-interactive Cloudflare changes"
-			}
-		]
-	};
-}
-function printGlobalHelp() {
-	printVoidHeader();
-	note([
-		globalCommandLine(["init"], "void init"),
-		...globalOptionLines(["init"]),
-		"",
-		globalCommandLine(["connect"], "void connect [url]"),
-		...globalOptionLines(["connect"]),
-		"",
-		globalCommandLine(["deploy"], "void deploy"),
-		...globalOptionLines(["deploy"]),
-		"",
-		...globalCommandGroup("auth"),
-		"",
-		...globalCommandGroup("platform"),
-		"",
-		...globalCommandGroup("project"),
-		"",
-		categoryTitle("secrets"),
-		...globalCommandLines("secret"),
-		"",
-		...globalCommandGroup("domain"),
-		"",
-		...globalCommandGroup("email"),
-		"",
-		...globalCommandGroup("github"),
-		"",
-		...globalCommandGroup("build"),
-		"",
-		categoryTitle("database"),
-		...globalCommandLines("db", {
-			execute: "execute <sql>",
-			export: "export [--output <path>]",
-			seed: "seed [--file <path>]"
-		}),
-		...globalOptionLines(["db", "execute"]),
-		...globalOptionLines(["db", "export"]),
-		"",
-		...globalCommandGroup("env"),
-		...globalOptionLines(["env", "check"]),
-		"",
-		categoryTitle("codegen"),
-		globalCommandLine(["prepare"], "void prepare"),
-		...globalCommandLines("gen", { route: "route <path> [--methods]" }),
-		"",
-		categoryTitle("agent"),
-		helpLine("void init --agents", requiredOption(["init"], "--agents").description),
-		"",
-		categoryTitle("help"),
-		helpLine("void help <command>", "Show command-specific help"),
-		helpLine("void <command> --help", "Show command-specific help")
-	].join("\n"), sectionTitle("Commands"));
-	note([helpLine("VOID_TOKEN", "Auth token (or use `void auth login`)"), helpLine("VOID_PROJECT", "Deploy target project name override")].join("\n"), sectionTitle("Environment"));
-	outro("https://void.cloud");
-}
-function printVoidHeader() {
-	const version = JSON.parse(readFileSync(join(getPackageDir(), "package.json"), "utf-8")).version;
-	const art = asciiArts[Math.floor(Math.random() * asciiArts.length)];
-	console.log(import_picocolors.default.blue(`${art}  v${version}\n`));
-}
-function getHelpPath(args) {
-	if (args.length === 0) return null;
-	const command = args[0];
-	if (command === "help") return args.slice(1);
-	if (command === "--help" || command === "-h") return [];
-	if (args[1] === "help") return [command, ...args.slice(2)];
-	const helpIndex = args.findIndex((arg) => arg === "--help" || arg === "-h");
-	if (helpIndex === -1) return null;
-	return getKnownHelpPrefix(args.slice(0, helpIndex));
-}
-function printHelpPage(path) {
-	const page = findHelpPage(path);
-	if (!page) throw new Error(`Unknown help topic: ${formatHelpPath(path)}`);
-	const lines = [
-		page.summary,
-		"",
-		categoryTitle("Usage"),
-		...page.usage.map((usage) => `  ${usage}`)
-	];
-	appendHelpSection(lines, "Commands", page.commands);
-	appendHelpSection(lines, "Options", page.options);
-	appendHelpSection(lines, "Examples", page.examples);
-	if (page.commands) lines.push("", `Run \`void help ${path.join(" ")} <command>\` for command-specific help.`);
-	note(lines.join("\n"), sectionTitle(`void ${path.join(" ")}`));
-}
-function appendHelpSection(lines, title, entries) {
-	if (!entries || entries.length === 0) return;
-	lines.push("", categoryTitle(title));
-	for (const entry of entries) lines.push(helpLine(entry.command, entry.description));
-}
-function globalCommandGroup(group) {
-	return [categoryTitle(group), ...globalCommandLines(group)];
-}
-function globalCommandLines(group, commandOverrides) {
-	return (requiredPage([group]).commands ?? []).map((command) => helpLine(`void ${group} ${commandOverrides?.[command.command.split(" ")[0]] ?? command.command}`, command.description));
-}
-function globalCommandLine(path, command) {
-	return helpLine(command, formatGlobalDescription(requiredPage(path).summary));
-}
-function globalOptionLines(path) {
-	return (requiredPage(path).options ?? []).map((option) => helpLine(`  ${option.command}`, option.description));
-}
-function requiredOption(path, command) {
-	const option = requiredPage(path).options?.find((entry) => entry.command === command);
-	if (!option) throw new Error(`Missing help option: ${formatHelpPath(path)} ${command}`);
-	return option;
-}
-function requiredPage(path) {
-	const page = findHelpPage(path);
-	if (!page) throw new Error(`Missing help page: ${formatHelpPath(path)}`);
-	return page;
-}
-function formatGlobalDescription(summary) {
-	return summary.replace(/\.$/, "");
-}
-function findHelpPage(path) {
-	let tree = HELP_TREE;
-	let page = null;
-	for (const part of path) {
-		const node = tree?.[part];
-		if (!node) return null;
-		page = node;
-		tree = node.children;
-	}
-	return page;
-}
-function getKnownHelpPrefix(args) {
-	let tree = HELP_TREE;
-	const path = [];
-	for (const arg of args) {
-		if (arg.startsWith("-")) break;
-		const node = tree?.[arg];
-		if (!node) {
-			if (path.length === 0) return [arg];
-			if (tree) return [...path, arg];
-			break;
-		}
-		path.push(arg);
-		tree = node.children;
-	}
-	return path;
-}
-function formatHelpPath(path) {
-	return path.length === 0 ? "help" : path.join(" ");
 }
 //#endregion
 //#region src/cli/platform-args.ts
 const platformSubcommands = [
+	{
+		name: "config",
+		hint: "Configure authentication",
+		description: "Configure login methods, company protection, or provider recovery"
+	},
 	...operatorGroups.map((name) => ({
 		name,
-		hint: "Operator commands",
+		hint: name === "email" ? "Domains, policy, limits, outcomes, and recovery" : "Operator commands",
 		description: `Administer platform ${name}`
 	})),
 	{
@@ -3019,6 +1344,7 @@ function parsePlatformArgs(args) {
 		"--timeout"
 	].includes(args[0] ?? "")) return parseOperatorArgs(args);
 	const [subcommand, ...rest] = args;
+	if (subcommand === "config") return parsePlatformConfigArgs(rest);
 	if (subcommand === "domain") {
 		if (rest.length === 0) return {
 			subcommand,
@@ -3139,6 +1465,7 @@ function parsePlatformArgs(args) {
 		let yes = false;
 		const valueFlags = /* @__PURE__ */ new Set([
 			"--account",
+			"--auth-config",
 			"--application-domain",
 			"--control-plane-domain",
 			"--display-name",
@@ -3164,6 +1491,7 @@ function parsePlatformArgs(args) {
 		return {
 			subcommand,
 			...workersDev ? { workersDev: true } : {},
+			...values.has("--auth-config") ? { authConfig: values.get("--auth-config") } : {},
 			account: values.get("--account") ?? "",
 			applicationDomain: values.get("--application-domain") ?? "",
 			controlPlaneDomain: values.get("--control-plane-domain") ?? "",
@@ -3177,7 +1505,7 @@ function parsePlatformArgs(args) {
 			zone: values.get("--zone") ?? ""
 		};
 	}
-	throw new Error("platform: Usage: void platform <auth|user|project|deployment|build|signup|invitation|system|worker|list|use|status|discover|install|domain|upgrade|rollback|repair|disable|enable|uninstall>.");
+	throw new Error("platform: Usage: void platform <config|auth|user|project|deployment|build|signup|invitation|email|system|worker|list|use|status|discover|install|domain|upgrade|rollback|repair|disable|enable|uninstall>.");
 }
 //#endregion
 //#region src/cli/prepare-args.ts
@@ -3202,6 +1530,11 @@ const LOG_LEVELS = /* @__PURE__ */ new Set([
 	"all"
 ]);
 const STATUS_FILTER = /^([1-5]xx|[1-5]\d{2}|all)$/;
+const TEAM_ROLES = /* @__PURE__ */ new Set([
+	"reader",
+	"collaborator",
+	"admin"
+]);
 const projectSubcommands = [
 	{
 		name: "status",
@@ -3217,6 +1550,16 @@ const projectSubcommands = [
 		name: "list",
 		description: "List your projects"
 	},
+	{
+		name: "token",
+		arg: "<create|list|renew|revoke>",
+		description: "Manage project-scoped CI deploy credentials"
+	},
+	{
+		name: "team",
+		hint: "list | invite | invitations | role | remove | revoke | leave | pending | accept | decline",
+		description: "Manage project members and invitations"
+	},
 	{
 		name: "logs",
 		description: "Show runtime logs from the deployed project"
@@ -3269,6 +1612,46 @@ function parseProjectArgs(args) {
 		if (rest.length > 0) throw new Error(`project: Unexpected argument '${rest[0]}'.`);
 		return { subcommand };
 	}
+	if (subcommand === "token") {
+		const action = rest.shift();
+		if (!action || ![
+			"create",
+			"list",
+			"renew",
+			"revoke"
+		].includes(action)) throw new Error("project: Usage: void project token <create|list|renew|revoke>.");
+		let credentialId = "";
+		let projectSlug = "";
+		let name = "";
+		let expiresInDays;
+		let json = false;
+		for (let index = 0; index < rest.length; index++) {
+			const value = rest[index];
+			if (value === "--project" && rest[index + 1]) projectSlug = rest[++index];
+			else if (value === "--name" && rest[index + 1]) name = rest[++index];
+			else if (value === "--expires-in" && rest[index + 1]) {
+				const parsed = Number(rest[++index]);
+				if (!Number.isInteger(parsed) || parsed < 1 || parsed > 90) throw new Error("project: --expires-in must be an integer from 1 to 90 days.");
+				expiresInDays = parsed;
+			} else if (value === "--json") json = true;
+			else if (value.startsWith("-")) throw new Error(`project: Unknown flag '${value}'.`);
+			else if ((action === "renew" || action === "revoke") && !credentialId) credentialId = value;
+			else throw new Error(`project: Unexpected argument '${value}'.`);
+		}
+		if ((action === "renew" || action === "revoke") && !credentialId) throw new Error(`project: ${action} requires a credential ID.`);
+		if (action !== "create" && name) throw new Error("project: --name is only valid with token create.");
+		if (action !== "create" && action !== "renew" && expiresInDays !== void 0) throw new Error("project: --expires-in is only valid with token create or token renew.");
+		return {
+			subcommand,
+			action,
+			credentialId,
+			projectSlug,
+			name,
+			expiresInDays,
+			json
+		};
+	}
+	if (subcommand === "team") return parseTeamArgs(rest);
 	if (subcommand === "logs") {
 		let filter = "";
 		let range = "1h";
@@ -3345,7 +1728,105 @@ function parseProjectArgs(args) {
 			projectSlug
 		};
 	}
-	throw new Error("project: Usage: void project <status|link|list|logs|requests|rollback|cancel|delete|purge-cache>.");
+	throw new Error("project: Usage: void project <status|link|list|team|token|logs|requests|rollback|cancel|delete|purge-cache>.");
+}
+function parseTeamArgs(rest) {
+	const [action, ...args] = rest;
+	const usage = "project: Usage: void project team <list|invite|invitations|role|remove|revoke|leave|pending|accept|decline>.";
+	if (!action) return {
+		subcommand: "team",
+		action: ""
+	};
+	const positionals = [];
+	let projectSlug = "";
+	let role = "";
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (arg === "--project" || arg === "--role") {
+			const value = args[++index];
+			if (!value || value.startsWith("-")) throw new Error(`project: ${arg} requires a value.`);
+			if (arg === "--project") {
+				if (projectSlug) throw new Error("project: Duplicate flag '--project'.");
+				projectSlug = value;
+			} else {
+				if (role) throw new Error("project: Duplicate flag '--role'.");
+				role = value;
+			}
+		} else if (arg.startsWith("-")) throw new Error(`project: Unknown flag '${arg}'.`);
+		else positionals.push(arg);
+	}
+	if (role && !TEAM_ROLES.has(role)) throw new Error(`project: Invalid role '${role}'. Use one of reader|collaborator|admin.`);
+	if ([
+		"pending",
+		"accept",
+		"decline"
+	].includes(action) && projectSlug) throw new Error(`project: --project is not used with team ${action}.`);
+	if (action === "list" || action === "invitations" || action === "leave") {
+		if (positionals.length || role) throw new Error(`project: Usage: void project team ${action} [--project <slug>].`);
+		return {
+			subcommand: "team",
+			action,
+			projectSlug
+		};
+	}
+	if (action === "invite") {
+		if (positionals.length !== 1 || !role) throw new Error("project: Usage: void project team invite <registered-email> --role <reader|collaborator|admin> [--project <slug>].");
+		const email = positionals[0];
+		if (email.length > 320 || !/^[^\s@]+@[^\s@]+$/.test(email)) throw new Error("project: Invitee must be a registered email address.");
+		return {
+			subcommand: "team",
+			action,
+			email,
+			role,
+			projectSlug
+		};
+	}
+	if (action === "role") {
+		if (positionals.length !== 2 || role) throw new Error("project: Usage: void project team role <user-id> <reader|collaborator|admin> [--project <slug>].");
+		const nextRole = positionals[1];
+		if (!TEAM_ROLES.has(nextRole)) throw new Error(`project: Invalid role '${nextRole}'. Use one of reader|collaborator|admin.`);
+		return {
+			subcommand: "team",
+			action,
+			userId: positionals[0],
+			role: nextRole,
+			projectSlug
+		};
+	}
+	if (action === "remove") {
+		if (positionals.length !== 1 || role) throw new Error("project: Usage: void project team remove <user-id> [--project <slug>].");
+		return {
+			subcommand: "team",
+			action,
+			userId: positionals[0],
+			projectSlug
+		};
+	}
+	if (action === "revoke") {
+		if (positionals.length !== 1 || role) throw new Error("project: Usage: void project team revoke <invitation-id> [--project <slug>].");
+		return {
+			subcommand: "team",
+			action,
+			invitationId: positionals[0],
+			projectSlug
+		};
+	}
+	if (action === "pending") {
+		if (positionals.length || role) throw new Error("project: Usage: void project team pending.");
+		return {
+			subcommand: "team",
+			action
+		};
+	}
+	if (action === "accept" || action === "decline") {
+		if (positionals.length !== 1 || role) throw new Error(`project: Usage: void project team ${action} <invitation-id>.`);
+		return {
+			subcommand: "team",
+			action,
+			invitationId: positionals[0]
+		};
+	}
+	throw new Error(usage);
 }
 //#endregion
 //#region src/cli/secret-args.ts
@@ -3449,7 +1930,7 @@ async function runSubcommandGroup(command, subcommands, parse, run) {
 	const hasNamedSubcommand = args.slice(1).some((arg) => subcommands.some(({ name }) => name === arg));
 	try {
 		if ((!sub || sub.startsWith("-") && !hasNamedSubcommand) && process.stdin.isTTY) {
-			const { promptSubcommand } = await import("../subcommand-prompt-WfySCQ7S.mjs");
+			const { promptSubcommand } = await import("../subcommand-prompt-Bmyn5Rlc.mjs");
 			const result = await promptSubcommand(command, subcommands);
 			if (!result) process.exit(0);
 			await run(root, parse(buildArgs(result, args.slice(1))));
@@ -3488,7 +1969,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-CcDoeBIf.mjs").then((n) => n.n).then(({ runDeploy }) => {
+	import("../deploy-DTaWUS1S.mjs").then((n) => n.n).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -3506,24 +1987,24 @@ if (helpPath) {
 	});
 } else if (command === "connect") (async () => {
 	const parsed = parseConnectArgs(args.slice(1));
-	const { runConnectCommand } = await import("../connect-D9Yr-T5f.mjs");
+	const { runConnectCommand } = await import("../connect-Bfk31O_8.mjs");
 	await runConnectCommand(process.cwd(), parsed);
 })().catch((err) => {
 	log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 	process.exit(1);
 });
-else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-CYVhSNFy.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
-else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-BEOVv1PN.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
-else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-D3ME2GAe.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-DCpk1cDt.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-BqTxGqki.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-gu_iaHmn.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-r6DHJyAB.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BxoUWL0F.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-DmU2To0C.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-BKw6qHIg.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
-else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-DJS5Ab-H.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
-else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-CkVD1uOh.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
+else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-gniL2fNt.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
+else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-BFhieCdV.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
+else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-4RPGN3KB.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-DmZK9Hxf.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-Bzzi2e9E.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-1RhhOVrC.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-C-lGh51B.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BkRoptAt.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-DJHsPE7Z.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-B_wPnVTK.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-PW7ZnWTp.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
+else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-sI18tX_O.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
 else if (command === "prepare") {
 	const root = process.cwd();
 	let prepareArgs;
@@ -3533,7 +2014,7 @@ else if (command === "prepare") {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../prepare-BfJvFUtJ.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-blNRQvQl.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			log.error(formatCloudflareUserMessage(err.message ?? String(err)));
 			process.exit(1);
@@ -3541,7 +2022,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-Dx5cgKqK.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-BWZ7q5Z4.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -3578,11 +2059,11 @@ else if (command === "prepare") {
 		{
 			name: "auth",
 			hint: "login | logout | whoami | token",
-			description: "Login, logout, and token management"
+			description: "Login, account linking, logout, and token management"
 		},
 		{
 			name: "platform",
-			hint: "auth | user | project | deployment | signup | system | install",
+			hint: "auth | user | project | deployment | signup | email | system | install",
 			description: "Install platforms and administer users, projects, access, and operations"
 		},
 		{
@@ -3592,8 +2073,8 @@ else if (command === "prepare") {
 		},
 		{
 			name: "project",
-			hint: "status | link | list | logs | requests | rollback | cancel | delete | purge-cache",
-			description: "Manage projects and deployments"
+			hint: "status | link | list | team | token | logs | requests | rollback | cancel | delete | purge-cache",
+			description: "Manage projects, teams, deployments, and scoped CI credentials"
 		},
 		{
 			name: "secret",
@@ -3607,7 +2088,7 @@ else if (command === "prepare") {
 		},
 		{
 			name: "email",
-			hint: "usage | logs | destinations | allow | disallow | status | setup",
+			hint: "usage | logs | destinations | allow | disallow | domain | status | setup",
 			description: "Inspect email activity and manage verified recipients"
 		},
 		{
@@ -3646,41 +2127,41 @@ else if (command === "prepare") {
 	];
 	(async () => {
 		printVoidHeader();
-		const { promptSubcommand } = await import("../subcommand-prompt-WfySCQ7S.mjs");
+		const { promptSubcommand } = await import("../subcommand-prompt-Bmyn5Rlc.mjs");
 		const result = await promptSubcommand("", topLevelCommands);
 		if (!result) process.exit(0);
 		const cmd = result.subcommand;
 		const root = process.cwd();
 		switch (cmd) {
 			case "connect": {
-				const { runConnectCommand } = await import("../connect-D9Yr-T5f.mjs");
+				const { runConnectCommand } = await import("../connect-Bfk31O_8.mjs");
 				await runConnectCommand(root, parseConnectArgs([]));
 				return;
 			}
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-Dx5cgKqK.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-BWZ7q5Z4.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-CcDoeBIf.mjs").then((n) => n.n);
+				const { runDeploy } = await import("../deploy-DTaWUS1S.mjs").then((n) => n.n);
 				await runDeploy(root);
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-CYVhSNFy.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
-			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-BEOVv1PN.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
-			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-D3ME2GAe.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-DCpk1cDt.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-BqTxGqki.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-gu_iaHmn.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-DJS5Ab-H.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
-			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-CkVD1uOh.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-r6DHJyAB.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BxoUWL0F.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-DmU2To0C.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-BKw6qHIg.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-gniL2fNt.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
+			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-BFhieCdV.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
+			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-4RPGN3KB.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-DmZK9Hxf.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-Bzzi2e9E.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-1RhhOVrC.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-PW7ZnWTp.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
+			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-sI18tX_O.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-C-lGh51B.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BkRoptAt.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-DJHsPE7Z.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-B_wPnVTK.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-BfJvFUtJ.mjs");
+				const { runPrepareCommand } = await import("../prepare-blNRQvQl.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}
@@ -3694,4 +2175,4 @@ else if (command === "prepare") {
 	});
 } else printGlobalHelp();
 //#endregion
-export { OperatorClient as n, OperatorClientError as r, help_exports as t };
+export {};