void 0.20.1 → 0.20.3

package/dist/{platform-management-Db2PXw0B.mjs → platform-management-BfWsXHEW.mjs}

@@ -1,5 +1,5 @@
-import { $ as resolveInstallationManifest, D as log, F as isCancel, O as note, Q as removePlatformConnectionForInstallation, U as listInstallationManifests, Y as readInstallationRecoverySecrets, Z as removeInstallationRecoverySecrets, i as createSpinner, j as select, k as outro, nt as writeInstallationManifest, w as confirm, z as acquirePlatformLifecycleLock } from "./output-tFQLLj26.mjs";
-import { S as resolvePlatformCloudflareCredential, _ as hyperdriveOriginConfigHash, a as installPlatform, assertNoninteractivePlatformMutationAcknowledged, b as verifyPlatformRuntimeTokenPermissions, c as resolveBootstrapGitHubId, d as createPlatformInstallPlan, f as formatPlatformInstallPlan, g as PlatformCloudflareClient, h as revalidatePlatformInstallAction, i as createPlatformInstallationSecrets, m as platformProvisionIntentHash, n as acquirePlatformDatabaseLifecycleLock, o as loadPlatformRuntime, p as platformAdoptionIntentHash, resolvePlatformInstallDatabaseUrl, t as REMOTE_INSTALLATION_MANIFEST_KEY, u as trackedPlatformWorkerTraffic, v as hyperdriveOriginFromConnectionString, x as assertPlatformOperatorCredentialCanApplyPlan, y as hyperdriveOriginMatches } from "./platform-lifecycle-DN4MzJF_.mjs";
+import { A as outro, D as log, I as isCancel, J as listInstallationManifests, M as select, W as acquirePlatformLifecycleLock, et as readInstallationRecoverySecrets, i as createSpinner, it as resolveInstallationManifest, k as note, nt as removeInstallationRecoverySecrets, rt as removePlatformConnectionForInstallation, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
+import { C as PlatformCloudflareClient, D as verifyPlatformRuntimeTokenPermissions, E as hyperdriveOriginMatches, T as hyperdriveOriginFromConnectionString, _ as revalidatePlatformInstallAction, a as createPlatformInstallationSecrets, assertNoninteractivePlatformMutationAcknowledged, f as trackedPlatformWorkerTraffic, g as platformProvisionIntentHash, h as platformAdoptionIntentHash, m as formatPlatformInstallPlan, n as acquirePlatformDatabaseLifecycleLock, o as installPlatform, p as createPlatformInstallPlan, resolvePlatformInstallDatabaseUrl, s as loadPlatformRuntime, t as REMOTE_INSTALLATION_MANIFEST_KEY, u as resolveBootstrapGitHubId, v as assertPlatformOperatorCredentialCanApplyPlan, w as hyperdriveOriginConfigHash, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-R9xAxvtG.mjs";
 import { createHash } from "node:crypto";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 //#region src/cli/platform-management.ts
@@ -59,6 +59,8 @@ async function runInstalledPlatformCommand(args) {
 		const deployment = manifest.deployment;
 		const planInput = {
 			accountId: manifest.account.id,
+			...args.subcommand === "upgrade" && process.env.VOID_EMAIL_SHARED_ZONE_ID ? { emailSharedZoneId: process.env.VOID_EMAIL_SHARED_ZONE_ID } : {},
+			...args.subcommand === "upgrade" && process.env.VOID_EMAIL_SENDER_DOMAIN ? { emailSenderDomain: process.env.VOID_EMAIL_SENDER_DOMAIN } : {},
 			applicationDomain: deployment.application.baseDomain,
 			controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
 			dedicatedZone: deployment.application.dedicatedZone,
@@ -69,7 +71,9 @@ async function runInstalledPlatformCommand(args) {
 		const plan = await createPlatformInstallPlan(client, planInput, manifest, {
 			authoritativeProvisionIntents: databaseCheckpointExists,
 			repairMissing: args.subcommand === "repair",
-			allowUnverifiedAiGateway: args.plan
+			allowUnverifiedAiGateway: args.plan,
+			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 		});
 		note(formatPlatformInstallPlan(plan), args.subcommand === "upgrade" ? "Upgrade plan" : args.subcommand === "rollback" ? "Rollback plan" : args.subcommand === "enable" ? "Enable plan" : "Repair plan");
 		note([
@@ -103,6 +107,9 @@ async function runInstalledPlatformCommand(args) {
 			cloudflareApiToken: process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN || "",
 			checkpoint: recovery,
 			databaseUrl,
+			emailEnabled: plan.deployment.capabilities.email,
+			emailSigningSecret: process.env.VOID_PLATFORM_EMAIL_SIGNING_SECRET || "",
+			existingEmailEnabled: manifest.deployment.capabilities.email,
 			existingInstallation: true,
 			updateExistingWorkers: true,
 			githubClientId: process.env.VOID_PLATFORM_GITHUB_CLIENT_ID || "",
@@ -121,11 +128,13 @@ async function runInstalledPlatformCommand(args) {
 			customDomains: plan.deployment.capabilities.customDomains,
 			zoneId: plan.zone?.id ?? null
 		});
+		if (!databaseLock?.readAuthenticationState) throw new Error("platform: The database lifecycle lock cannot read authoritative authentication settings.");
 		const result = await installPlatform(plan, secrets, installation, {
 			acquireDatabaseLifecycleLock: async () => Object.assign(async () => {}, {
 				checkpoint: databaseLock?.checkpoint,
 				prepareDatabase: databaseLock?.prepareDatabase,
 				prepareSandboxDrain: databaseLock?.prepareSandboxDrain,
+				readAuthenticationState: databaseLock?.readAuthenticationState,
 				requiredSafetyProtocols: databaseLock?.requiredSafetyProtocols,
 				verifyDatabase: databaseLock?.verifyDatabase
 			}),
@@ -135,7 +144,9 @@ async function runInstalledPlatformCommand(args) {
 			runtime,
 			replanWorkers: async (recoveryManifest) => (await createPlatformInstallPlan(client, planInput, recoveryManifest, {
 				authoritativeProvisionIntents: true,
-				repairMissing: true
+				repairMissing: true,
+				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action, { repairMissing: args.subcommand === "repair" })
 		});
@@ -152,6 +163,14 @@ async function runInstalledPlatformCommand(args) {
 				return;
 			}
 			log.success(args.subcommand === "rollback" ? `${deployment.displayName} is running compatible runtime ${runtime.manifest.platformVersion}; PostgreSQL remains at schema ${rollbackSourceRuntime.manifest.database.schemaDigest}.` : `${deployment.displayName} is healthy at ${plan.apiUrl}.`);
+			if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
+			if (result.setupPending) {
+				const code = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
+				if (code) {
+					log.info(`First administrator setup: ${plan.apiUrl}/setup`);
+					console.log(`One-time administrator setup code: ${code}`);
+				}
+			}
 		};
 	};
 	if (args.plan) {
@@ -189,9 +208,12 @@ async function runInstalledPlatformCommand(args) {
 	}
 }
 function assertPlatformRollbackCompatibility(installation, target, source) {
+	if (target.manifest.emailProtocolVersion !== 1 && (installation.deployment.capabilities.email || installation.resources.some((resource) => resource.key === "email-gateway-worker" && resource.state === "ready"))) throw new Error("platform: The rollback target predates the email gateway and cannot safely replace this installation. Use a runtime with email protocol version 1.");
 	if (!installation.runtime) throw new Error("platform: The installed runtime has no artifact provenance, so post-success rollback cannot identify its compatibility manifest.");
 	if (source.manifest.platformVersion !== installation.platformVersion || source.manifestSha256 !== installation.runtime.manifestSha256) throw new Error("platform: --from-runtime does not exactly match the installed runtime artifact digest. Supply the runtime used by the current successful deployment.");
 	if (target.manifestSha256 === source.manifestSha256) throw new Error("platform: The rollback target is already the installed runtime artifact.");
+	if ((target.manifest.authenticationProtocolVersion ?? 0) < Math.max(source.manifest.authenticationProtocolVersion ?? 0, installation.deployment.authentication.configurable ? 1 : 0)) throw new Error("platform: The rollback target cannot enforce the installed authentication configuration and session revocation protocol. Use a compatible runtime.");
+	if (Math.max(installation.usageProtocolVersion, source.manifest.usageProtocolVersion) >= 2 && target.manifest.usageProtocolVersion < 2) throw new Error("platform: The rollback target predates ownership-aware usage attribution and cannot safely account for transferred projects. Use a runtime with usage protocol version 2 or newer.");
 	if (target.manifest.database.lineage !== source.manifest.database.lineage) throw new Error("platform: The rollback target belongs to a different database lineage.");
 	const prefix = source.manifest.database.migrations.slice(0, target.manifest.database.migrations.length);
 	if (JSON.stringify(prefix) !== JSON.stringify(target.manifest.database.migrations)) throw new Error("platform: The rollback target database migrations are not an exact prefix of the installed runtime.");
@@ -202,7 +224,7 @@ function assertPlatformRollbackCompatibility(installation, target, source) {
 function resolvePlatformRuntimeTokenToPreflight(plan, secrets) {
 	const explicitUpdate = secrets.workerSecretUpdates?.CF_API_TOKEN;
 	if (explicitUpdate) return explicitUpdate;
-	return plan.actions.some((action) => action.kind === "worker" && action.action === "create") ? secrets.cloudflareApiToken : "";
+	return plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (action.key === "api-worker" || action.key === "proxy-worker")) ? secrets.cloudflareApiToken : "";
 }
 async function resolveInstalledPlatformManifest(selector, dependencies = {}) {
 	if (selector) return resolveInstallationManifest(selector);
@@ -275,7 +297,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	const confirmAction = dependencies.confirm ?? promptForConfirmation;
 	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
 	const dataMessage = retainData ? "Retain installer-owned Workers, storage, dispatch, AI logs, and Hyperdrive by default." : args.purgeData ? "Delete safely identifiable installer-owned data (--purge-data); retain Workers, R2, AI Gateway, and external PostgreSQL for manual cleanup." : "Retain installer-owned data; external PostgreSQL is never deleted.";
-	note(`Disable all platform traffic through installation-owned routing storage.\nRetain DNS records, routes, and custom domains for explicit dashboard cleanup.\nDelete installer-owned Queues.\n${dataMessage}\n${createdZone ? `Keep zone ${createdZone.name} for explicit manual cleanup.` : "Never delete the adopted application zone."}`, "Uninstall plan");
+	note(`Disable all platform traffic through installation-owned routing storage.\nRetain DNS records, routes, and custom domains for explicit dashboard cleanup.\nDelete installer-owned Queues.\n${dataMessage}\n${createdZone ? `Keep zone ${createdZone.name} for explicit manual cleanup.` : "Never delete the adopted application zone."}${(manifest.authenticationResources ?? []).length ? "\nRetain Access resources for deliberate cleanup:\n" + manifest.authenticationResources.map((resource) => `  ${resource.ownership} ${resource.kind}: ${resource.name} (${resource.id}, account ${resource.accountId})`).join("\n") : ""}`, "Uninstall plan");
 	if (args.plan) {
 		outro("No Cloudflare or local installation state was changed.");
 		return;
@@ -397,6 +419,11 @@ async function recoverDurablyMarkedProvisionIntents(client, manifest) {
 			"worker",
 			manifest.deployment.resources.proxyWorker
 		],
+		[
+			"email-gateway-worker",
+			"worker",
+			manifest.deployment.resources.emailGatewayWorker
+		],
 		[
 			"tail-worker",
 			"worker",
@@ -596,7 +623,8 @@ function isPlatformManifestMonotonicExtension(earlier, later) {
 		return next?.id === resource.id && next.kind === resource.kind && next.name === resource.name && next.ownership === resource.ownership && (next.state === resource.state || resource.state === "ready" && (next.state === "deleted" || next.state === "retained"));
 	});
 	const stepsAdvance = earlier.steps.every((step) => later.steps.some((entry) => entry.key === step.key && entry.completedAt === step.completedAt && entry.resultHash === step.resultHash));
-	return resourcesAdvance && stepsAdvance;
+	const authenticationResourcesAdvance = (earlier.authenticationResources ?? []).every((resource) => (later.authenticationResources ?? []).some((next) => JSON.stringify(next) === JSON.stringify(resource)));
+	return resourcesAdvance && stepsAdvance && authenticationResourcesAdvance;
 }
 function hasNamedResource(entries, resource) {
 	return entries.some((entry) => entry.id === resource.id && entry.name === resource.name);

package/dist/{platform-recovery-C_YO-tIs.mjs → platform-recovery-CbK-I1FB.mjs}

@@ -1,7 +1,7 @@
-import { U as listInstallationManifests, et as savePlatformConnection, nt as writeInstallationManifest, z as acquirePlatformLifecycleLock } from "./output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { d as createPlatformInstallPlan, t as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-DN4MzJF_.mjs";
-import { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, verifyPlatformInstallationOwnership } from "./platform-management-Db2PXw0B.mjs";
+import { J as listInstallationManifests, W as acquirePlatformLifecycleLock, at as savePlatformConnection, st as writeInstallationManifest } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { p as createPlatformInstallPlan, t as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-R9xAxvtG.mjs";
+import { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, verifyPlatformInstallationOwnership } from "./platform-management-BfWsXHEW.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {
@@ -90,7 +90,8 @@ async function verifyInstallationEndpoint(manifest, fetcher = fetch) {
 			Accept: "application/json",
 			...cfAccessHeaders(process.env, apiUrl)
 		},
-		signal: AbortSignal.timeout(15e3)
+		signal: AbortSignal.timeout(15e3),
+		redirect: "manual"
 	});
 	if (!response.ok) throw new Error(`platform: Installation ${manifest.id} is not reachable (HTTP ${response.status}).`);
 	if ((await response.json()).installationId !== manifest.id) throw new Error(`platform: Installation ${manifest.id} endpoint identity does not match.`);

package/dist/{prepare-CBetXvsN.mjs → prepare-CtDJjoOj.mjs}

@@ -1,13 +1,13 @@
 import { o as join } from "./dist-BrsS7cai.mjs";
 import { i as resolveProjectPaths } from "./project-paths-SK8nMHPp.mjs";
 import { c as loadVoidAuthConfig, r as scanRoutes, s as findVoidAuthConfig } from "./scan-BMH4rzlv.mjs";
-import { c as getDatabaseDialect, f as readConfig } from "./config-BQFq7QvD.mjs";
+import { c as getDatabaseDialect, f as readConfig } from "./config-uNGuFsI2.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-Ql2XsSQp.mjs";
 import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-BDRfZngg.mjs";
 import { i as generateVoidAuthDrizzleSchema, n as generateQueueTypes, r as generateVoidAuthDatabaseModule, s as generateDbDts, t as generateRouteTypes } from "./route-types-Da-DpyUp.mjs";
 import { t as discoverSchema } from "./discover-xvfrgJeo.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-BNPhro-M.mjs";
-import { a as loadLocalEnv } from "./env-D4Emu-M_.mjs";
+import { a as loadLocalEnv } from "./env-DBKmK4vc.mjs";
 import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/codegen/prepare.ts

package/dist/{prepare-BfJvFUtJ.mjs → prepare-blNRQvQl.mjs}

@@ -1,5 +1,5 @@
-import { D as log, E as intro, O as note, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { prepareProject } from "./prepare-CBetXvsN.mjs";
+import { A as outro, D as log, E as intro, k as note, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { prepareProject } from "./prepare-CtDJjoOj.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root, _args) {
 	console.log();

package/dist/prerender-render.d.mts

@@ -0,0 +1,11 @@
+//#region src/prerender-render.d.ts
+export type PrerenderResult = {
+  rendered: Array<string>;
+  failed: Array<{
+    path: string;
+    error: string;
+  }>;
+};
+/** Shared renderer for local Workers and the isolated Node prerender child. */
+export declare function renderPrerenderPaths(paths: Array<string>, clientDir: string, fetchPath: (path: string) => Promise<Response>, fetchPageData?: (path: string) => Promise<Response>, onResult?: (path: string, outputFile: string, error?: string) => void): Promise<PrerenderResult>;
+//#endregion

package/dist/prerender-render.mjs

@@ -0,0 +1,111 @@
+import { n as dirname, o as join } from "./dist-BrsS7cai.mjs";
+import { mkdirSync, writeFileSync } from "node:fs";
+//#region src/prerender-render.ts
+function outputFileForPath(path) {
+	return path === "/" ? "index.html" : `${path.slice(1)}.html`;
+}
+function pageDataFileForPath(path) {
+	return path === "/" ? "_void/pages/index.json" : `_void/pages/${path.slice(1)}.json`;
+}
+function normalizedFile(clientDir, path) {
+	return join(clientDir, path).normalize("NFC").toLowerCase();
+}
+function generatedFiles(path, clientDir) {
+	return [outputFileForPath(path), pageDataFileForPath(path)].map((file) => normalizedFile(clientDir, file));
+}
+function requestAssetCandidates(path, clientDir) {
+	const relativePath = path === "/" ? "" : path.slice(1);
+	const candidates = /* @__PURE__ */ new Set();
+	const addCandidates = (candidate) => {
+		candidates.add(candidate);
+		if (candidate === "" || candidate.endsWith("/")) candidates.add(`${candidate}index.html`);
+		else if (!candidate.split("/").at(-1)?.includes(".")) {
+			candidates.add(`${candidate}.html`);
+			candidates.add(`${candidate}/index.html`);
+		}
+	};
+	addCandidates(relativePath);
+	try {
+		addCandidates(decodeURI(relativePath));
+	} catch {}
+	try {
+		addCandidates(decodeURIComponent(relativePath));
+	} catch {}
+	return new Set([...candidates].map((file) => normalizedFile(clientDir, file)));
+}
+function renderConcurrency(paths, clientDir) {
+	const outputs = paths.map((path) => generatedFiles(path, clientDir));
+	const ownerByOutput = /* @__PURE__ */ new Map();
+	for (let index = 0; index < outputs.length; index++) for (const output of outputs[index]) {
+		if (ownerByOutput.has(output)) return 1;
+		ownerByOutput.set(output, index);
+	}
+	for (const file of ownerByOutput.keys()) {
+		let parent = dirname(file);
+		while (parent !== dirname(parent)) {
+			if (ownerByOutput.has(parent)) return 1;
+			parent = dirname(parent);
+		}
+	}
+	for (let index = 0; index < paths.length; index++) for (const candidate of requestAssetCandidates(paths[index], clientDir)) {
+		const owner = ownerByOutput.get(candidate);
+		if (owner !== void 0 && owner !== index) return 1;
+	}
+	return 4;
+}
+/** Shared renderer for local Workers and the isolated Node prerender child. */
+async function renderPrerenderPaths(paths, clientDir, fetchPath, fetchPageData, onResult) {
+	const results = paths.map(() => ({
+		rendered: [],
+		failed: []
+	}));
+	let next = 0;
+	await Promise.all(Array.from({ length: Math.min(paths.length, renderConcurrency(paths, clientDir)) }, async () => {
+		while (next < paths.length) {
+			const index = next++;
+			const path = paths[index];
+			const result = results[index];
+			const outputFile = outputFileForPath(path);
+			try {
+				const response = await fetchPath(path);
+				const html = await response.text();
+				if (!response.ok) {
+					const error = `HTTP ${response.status}`;
+					result.failed.push({
+						path,
+						error
+					});
+					onResult?.(path, outputFile, error);
+					continue;
+				}
+				const outputPath = join(clientDir, outputFile);
+				mkdirSync(dirname(outputPath), { recursive: true });
+				writeFileSync(outputPath, html);
+				if (fetchPageData) {
+					const pageDataResponse = await fetchPageData(path);
+					if (pageDataResponse.headers.get("X-VoidPages")) {
+						const pageData = await pageDataResponse.json();
+						const pageDataPath = join(clientDir, pageDataFileForPath(path));
+						mkdirSync(dirname(pageDataPath), { recursive: true });
+						writeFileSync(pageDataPath, JSON.stringify(pageData));
+					}
+				}
+				result.rendered.push(path);
+				onResult?.(path, outputFile);
+			} catch (err) {
+				const error = err instanceof Error ? err.message : String(err);
+				result.failed.push({
+					path,
+					error
+				});
+				onResult?.(path, outputFile, error);
+			}
+		}
+	}));
+	return {
+		rendered: results.flatMap((result) => result.rendered),
+		failed: results.flatMap((result) => result.failed)
+	};
+}
+//#endregion
+export { renderPrerenderPaths };

package/dist/{project-cmd-Mo0V9yKS.mjs → project-cmd-CTdmnzvc.mjs}

@@ -1,6 +1,6 @@
-import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle, u as tablePrefix } from "./output-tFQLLj26.mjs";
-import { b as readDeploymentPlatform, c as getToken, s as getSiteDomain } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, r as cliTitle, u as tablePrefix } from "./output-B0cfNSx5.mjs";
+import { c as getSiteDomain, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -17,14 +17,16 @@ async function runProjectsCommand(root) {
 	}
 	const rows = projects.map((p) => ({
 		slug: p.slug,
+		role: p.role ?? "owner",
 		appType: p.type ?? "worker",
 		url: p.custom_domain ? `https://${p.custom_domain}` : p.url ?? `https://${p.slug}.${getSiteDomain(root)}`
 	}));
 	const slugWidth = Math.max(4, ...rows.map((r) => r.slug.length));
+	const roleWidth = Math.max(4, ...rows.map((r) => r.role.length));
 	const typeWidth = Math.max(4, ...rows.map((r) => r.appType.length));
 	const prefix = tablePrefix();
-	const header = `${prefix}${dim(`${"slug".padEnd(slugWidth)}  ${"type".padEnd(typeWidth)}  url`)}`;
-	const lines = rows.map((row) => `${prefix}${import_picocolors.default.green(row.slug)}${"".padEnd(slugWidth - row.slug.length)}  ${row.appType.padEnd(typeWidth)}  ${row.url}`);
+	const header = `${prefix}${dim(`${"slug".padEnd(slugWidth)}  ${"role".padEnd(roleWidth)}  ${"type".padEnd(typeWidth)}  url`)}`;
+	const lines = rows.map((row) => `${prefix}${import_picocolors.default.green(row.slug)}${"".padEnd(slugWidth - row.slug.length)}  ${row.role.padEnd(roleWidth)}  ${row.appType.padEnd(typeWidth)}  ${row.url}`);
 	console.log(prefix);
 	console.log(header);
 	for (const line of lines) console.log(line);
@@ -35,47 +37,63 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-3F52R_yO.mjs");
+		const { runListCommand } = await import("./list-CvkK_G7k.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by the name in wrangler.jsonc and do not need linking.");
-		const { runLink } = await import("./link-RMdgjF1v.mjs");
+		const { runLink } = await import("./link-D2kbqhWb.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-3F52R_yO.mjs");
+			const { runListCommand } = await import("./list-CvkK_G7k.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
+	if (args.subcommand === "token") {
+		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
+		const { runProjectTokenCommand } = await import("./project-token-Cirx7uwZ.mjs");
+		return runProjectTokenCommand(root, args);
+	}
+	if (args.subcommand === "team") {
+		if (args.action === "") {
+			const { printHelpPage } = await import("./help-CwOX-zmI.mjs").then((n) => n.n);
+			printHelpPage(["project", "team"]);
+			return;
+		}
+		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
+		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
+		const { runProjectTeamCommand } = await import("./project-team-CGxsQe3_.mjs");
+		return runProjectTeamCommand(root, args);
+	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-DFHHD6wE.mjs");
+		const { runLogsCommand } = await import("./logs-dLUFCapG.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-BcKOVpRg.mjs");
+		const { runRequestsCommand } = await import("./requests-4Nq59hOr.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-Bx85-0xh.mjs");
+		const { runRollbackCommand } = await import("./rollback-Dr7u0Ljx.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-CmlAZ9P6.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-CPbEQLMG.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-D8GigDk8.mjs");
+		const { runDeleteCommand } = await import("./delete-BZ4-WaGm.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-BlNeQjuP.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-D98YTqeE.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/project-team-CGxsQe3_.mjs

@@ -0,0 +1,132 @@
+import { A as outro, D as log, E as intro, k as note, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, a as getAccountCredential, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-BQBrZoCX.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
+//#region src/cli/project-team.ts
+function clean(value) {
+	return (value ?? "—").replace(/[\u0000-\u001f\u007f]/g, " ");
+}
+function memberLines(members) {
+	const rows = members.map((member) => ({
+		id: member.user.id,
+		login: member.user.login ?? "—",
+		role: member.role
+	}));
+	const widths = {
+		id: Math.max(2, ...rows.map((row) => clean(row.id).length)),
+		login: Math.max(5, ...rows.map((row) => clean(row.login).length))
+	};
+	return [`${"ID".padEnd(widths.id)}  ${"LOGIN".padEnd(widths.login)}  ROLE`, ...rows.map((row) => `${clean(row.id).padEnd(widths.id)}  ${clean(row.login).padEnd(widths.login)}  ${row.role}`)].join("\n");
+}
+function invitationEmail(invitation) {
+	return invitation.target?.email ?? invitation.target_email ?? "—";
+}
+function invitationLines(invitations, pending) {
+	return invitations.map((invitation) => {
+		const project = pending ? `  ${clean(invitation.project?.slug)}` : "";
+		const target = pending ? "" : `  ${clean(invitationEmail(invitation))}`;
+		const status = pending ? "" : `  ${invitation.status ?? "pending"}`;
+		return `${clean(invitation.id)}${project}${target}  ${invitation.role}${status}  expires ${clean(invitation.expires_at)}`;
+	}).join("\n");
+}
+async function resolveProjectId(root, client, projectSlug) {
+	const requestedSlug = getRequestedProjectSlug({ projectSlug });
+	if (requestedSlug) {
+		const project = resolveProjectBySlug(await client.listProjects(), requestedSlug);
+		if (!project) throw new Error(`project: No project found with slug '${requestedSlug}'.`);
+		return project.projectId;
+	}
+	const linked = readProjectConfig(root);
+	if (!linked) throw new Error("No linked project. Run `void project link` or pass --project <slug>.");
+	return linked.projectId;
+}
+function invitationResponseError(error, apiUrl) {
+	if (!(error instanceof PlatformApiError)) return error;
+	if (platformErrorMessage(parsePlatformErrorBody(error.body))) return error;
+	let message;
+	if (error.code === "project invitation not found") message = `Invitation not found on ${apiUrl}. Check VOID_API_URL if set, connect to the platform in your invitation with \`void connect <url>\`, then run \`void project team pending\` to check the invitation ID. If it is missing, ask a project administrator for a new invitation.`;
+	else if (error.code === "forbidden") message = `Your account cannot respond to this invitation on ${apiUrl}. Sign in with the account whose registered email received the invitation. To switch accounts, set VOID_API_URL to ${apiUrl}, unset VOID_TOKEN if present, then run \`void auth logout\` and \`void auth login\`. Run \`void project team pending\` to see that account's invitations.`;
+	else if (error.code === "project invitation has expired") message = "This invitation has expired. Ask a project administrator to invite you again, then run `void project team pending`.";
+	else if (error.code === "project invitation is no longer pending") message = "This invitation has already been answered or revoked. Run `void project team pending` to see invitations awaiting your response, or ask a project administrator to check your access.";
+	else return error;
+	error.message = message;
+	return error;
+}
+async function runProjectTeamCommand(root, args) {
+	console.log();
+	intro(cliTitle(`project team ${args.action}`));
+	const { apiUrl, token } = args.action === "pending" || args.action === "accept" || args.action === "decline" ? getAccountCredential() : {
+		apiUrl: void 0,
+		token: getToken(root)
+	};
+	if (apiUrl) log.info(`Platform: ${apiUrl}`);
+	if (!token) {
+		log.error(apiUrl ? `Not logged in to ${apiUrl}. Run \`void connect ${apiUrl}\` to sign in.` : "Not logged in. Run `void auth login` first.");
+		process.exit(1);
+	}
+	const client = new PlatformClient(token, apiUrl ? { apiUrl } : { root });
+	if (args.action === "pending") {
+		const invitations = await client.listPendingProjectInvitations();
+		if (invitations.length === 0) {
+			outro("No pending project invitations.");
+			return;
+		}
+		note(invitationLines(invitations, true), "Pending Project Invitations");
+		outro(`${invitations.length} invitation(s)`);
+		return;
+	}
+	if (args.action === "accept" || args.action === "decline") {
+		try {
+			await client.respondToProjectInvitation(args.invitationId, args.action);
+		} catch (error) {
+			throw invitationResponseError(error, client.apiUrl);
+		}
+		if (args.action === "accept") log.info("Open the invited application’s directory and run `void project link` if it is not linked yet. If it is linked to another project, use a separate checkout. Accepting an invitation keeps existing project links.");
+		outro(`Project invitation ${args.action === "accept" ? "accepted" : "declined"}.`);
+		return;
+	}
+	const projectId = await resolveProjectId(root, client, "projectSlug" in args ? args.projectSlug : "");
+	if (args.action === "list") {
+		const members = await client.listProjectMembers(projectId);
+		note(memberLines(members), "Project Team");
+		outro(`${members.length} member(s)`);
+		return;
+	}
+	if (args.action === "invitations") {
+		const invitations = await client.listProjectInvitations(projectId);
+		if (invitations.length === 0) {
+			outro("No project invitations found.");
+			return;
+		}
+		note(invitationLines(invitations, false), "Project Invitations");
+		outro(`${invitations.length} invitation(s)`);
+		return;
+	}
+	if (args.action === "invite") {
+		const result = await client.inviteProjectMember(projectId, args.email, args.role);
+		const delivery = result.delivery.status === "sent" ? "" : ` (email delivery: ${result.delivery.status.replace("_", " ")})`;
+		const action = result.refreshed ? "Updated invitation for" : "Invited";
+		if (result.delivery.status !== "sent") note(`Invitation: ${clean(result.invitation.id)}\nShare these steps with the invited user:\n\nvoid connect '${client.apiUrl.replaceAll("'", "'\\''")}'\nvoid project team pending\nvoid project team accept ${clean(result.invitation.id)}`, "Invitation saved; email was not sent");
+		outro(`${action} ${clean(invitationEmail(result.invitation))} as ${args.role}${delivery}.`);
+		return;
+	}
+	if (args.action === "role") {
+		await client.updateProjectMemberRole(projectId, args.userId, args.role);
+		outro(`Changed ${args.userId} to ${args.role}.`);
+		return;
+	}
+	if (args.action === "remove") {
+		await client.removeProjectMember(projectId, args.userId);
+		outro(`Removed ${args.userId} from the project.`);
+		return;
+	}
+	if (args.action === "revoke") {
+		await client.revokeProjectInvitation(projectId, args.invitationId);
+		outro(`Revoked invitation ${args.invitationId}.`);
+		return;
+	}
+	await client.leaveProject(projectId);
+	outro("Left the project.");
+}
+//#endregion
+export { runProjectTeamCommand };

package/dist/project-token-Cirx7uwZ.mjs

@@ -0,0 +1,75 @@
+import { A as outro, D as log, E as intro, a as dim, r as cliTitle, u as tablePrefix } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
+import { r as resolveProjectBySlug } from "./resolve-project--Vxawf7z.mjs";
+//#region src/cli/project-token.ts
+async function resolveTarget(root, args) {
+	const humanToken = getToken(root);
+	if (!humanToken) throw new Error("project: Sign in with a human account before managing CI credentials.");
+	const client = new PlatformClient(humanToken, { root });
+	if (args.projectSlug) {
+		const resolved = resolveProjectBySlug(await client.listProjects(), args.projectSlug);
+		if (!resolved) throw new Error(`project: No project found with slug '${args.projectSlug}'.`);
+		return {
+			client,
+			projectId: resolved.projectId,
+			slug: args.projectSlug
+		};
+	}
+	const linked = readProjectConfig(root);
+	if (!linked) throw new Error("project: No linked project. Pass --project <name>.");
+	return {
+		client,
+		projectId: linked.projectId,
+		slug: linked.slug
+	};
+}
+function printIssued(args, result, apiUrl) {
+	if (args.json) {
+		console.log(JSON.stringify({
+			...result,
+			apiUrl
+		}));
+		return;
+	}
+	log.success(`Credential ${result.id} is valid until ${result.expiresAt}.`);
+	log.warn("Copy this token now. Void will not display it again.");
+	console.log(`\nVOID_TOKEN=${result.token}\nVOID_API_URL=${apiUrl}\n`);
+}
+async function runProjectTokenCommand(root, args) {
+	if (!args.json) {
+		console.log();
+		intro(cliTitle(`project token ${args.action}`));
+	}
+	const { client, projectId, slug } = await resolveTarget(root, args);
+	if (args.action === "create") printIssued(args, await client.createProjectToken(projectId, {
+		...args.name ? { name: args.name } : {},
+		...args.expiresInDays ? { expiresInDays: args.expiresInDays } : {}
+	}), client.apiUrl);
+	else if (args.action === "renew") printIssued(args, await client.renewProjectToken(projectId, args.credentialId, args.expiresInDays), client.apiUrl);
+	else if (args.action === "revoke") {
+		await client.revokeProjectToken(projectId, args.credentialId);
+		if (args.json) console.log(JSON.stringify({
+			ok: true,
+			id: args.credentialId
+		}));
+		else log.success(`Revoked ${args.credentialId}.`);
+	} else {
+		const rows = await client.listProjectTokens(projectId);
+		if (args.json) {
+			console.log(JSON.stringify(rows));
+			return;
+		}
+		const prefix = tablePrefix();
+		console.log(prefix);
+		console.log(`${prefix}${dim("id                                    status   expires     name")}`);
+		for (const row of rows) {
+			const status = row.revokedAt ? "revoked" : Date.parse(row.expiresAt) <= Date.now() ? "expired" : "active";
+			console.log(`${prefix}${row.id.padEnd(38)}${status.padEnd(9)}${row.expiresAt.slice(0, 10)}  ${row.name}`);
+		}
+		if (rows.length === 0) log.info("No CI deploy credentials.");
+	}
+	if (!args.json) outro(`${slug} — project-scoped deploy access only`);
+}
+//#endregion
+export { runProjectTokenCommand };

package/dist/{provision-Blnstcm2.mjs → provision-CSJOjjQk.mjs}

@@ -339,6 +339,8 @@ function provisionEnv(ctx) {
 	scrub("CF_ACCESS_CLIENT_ID");
 	scrub("CF_ACCESS_CLIENT_SECRET");
 	scrub("CF_ACCESS_TOKEN");
+	scrub("VOID_ACCESS_CREDENTIALS");
+	scrub("VOID_ACCESS_ORIGIN");
 	for (const name of TRANSPORT_REDIRECT_ENV_VARS) scrub(name);
 	for (const name of OUTPUT_FILE_ENV_VARS) scrub(name);
 	scrub("WRANGLER_LOG_SANITIZE");

package/dist/{requests-BcKOVpRg.mjs → requests-4Nq59hOr.mjs}

@@ -1,6 +1,6 @@
-import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {
 	console.log();