void 0.20.1 → 0.20.3

package/dist/{deploy-iXZ3F0N6.mjs → deploy-BAhhcg5q.mjs}

@@ -1,37 +1,37 @@
 import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { c as relative, i as extname, l as resolve, n as dirname, o as join, s as normalize, t as basename } from "./dist-BrsS7cai.mjs";
-import { D as log$1, E as intro, F as isCancel, O as note, c as import_picocolors$1, d as formatCloudflareUserMessage, i as createSpinner, j as select, k as outro, r as cliTitle, st as require_picocolors, w as confirm } from "./output-tFQLLj26.mjs";
+import { A as outro, B as ensureCloudflaredToken, D as log$1, E as intro, H as ensurePlatformProxyAccess, I as isCancel, M as select, c as import_picocolors$1, d as formatCloudflareUserMessage, ft as require_picocolors, i as createSpinner, k as note, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-SK8nMHPp.mjs";
 import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes, s as findVoidAuthConfig } from "./scan-BMH4rzlv.mjs";
-import { r as trustedCloudflareWorkerAccessHeaders, t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { C as writeDeploymentPlatform, T as writeProjectConfig, a as getApiUrl, b as readDeploymentPlatform, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode, v as attachSelectedPlatform, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-DsSsZUPr.mjs";
+import { i as trustedCloudflareWorkerAccessHeaders, r as scopedAccessCredentials, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { E as writeProjectConfig, S as readProjectConfig, d as isStagingMode, l as getToken, o as getApiUrl, s as getProxyUrl, u as getTokenSource, w as writeDeploymentPlatform, x as readDeploymentPlatform, y as attachSelectedPlatform } from "./auth-DPl6kck4.mjs";
 import { A as writeWranglerPublishedTrafficSnapshot, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, M as isSandboxEnabled, N as requiresSandboxPlatformImage, P as resolveSandboxConfig, S as readWranglerPublishedTrafficSnapshot, T as syncWranglerBindings, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, f as findBindingNameOwner, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, k as writeProvisionedWranglerConfig, l as ensureWranglerCompat, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, w as resolveLiveBindingConfig, x as readWranglerManagedQueueCleanupCandidates } from "./wrangler--imS8n0d.mjs";
-import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-BQFq7QvD.mjs";
+import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-uNGuFsI2.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-D8QfRX9Y.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BAHwgHdW.mjs";
 import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-BDRfZngg.mjs";
 import { o as validateSsrEntry } from "./entry-DU3oDoQ3.mjs";
 import { a as buildMigrationPlanBundle, c as collectMigrations, r as validateMigrations, t as assertJournalCoherence } from "./validate-tBBN_dXH.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
 import { t as discoverSchema } from "./discover-xvfrgJeo.mjs";
 import { t as findEnvFile } from "./env-types-BNPhro-M.mjs";
-import { a as deriveSelfHostEnvContextFromVars, c as fetchRemoteSecretNames, d as readEmittedWorkerVars, f as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as formatEnvReport, n as SelfHostFirstDeployError, o as dischargeSelfHostEnvContext, p as validateProdEnv, r as SelfHostSchemaError, t as SelfHostEnvValidationError, u as listSelfHostSecretNames } from "./env-validation-ENpMy6Ez.mjs";
-import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-D4Emu-M_.mjs";
+import { a as deriveSelfHostEnvContextFromVars, c as fetchRemoteSecretNames, d as readEmittedWorkerVars, f as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as formatEnvReport, n as SelfHostFirstDeployError, o as dischargeSelfHostEnvContext, p as validateProdEnv, r as SelfHostSchemaError, t as SelfHostEnvValidationError, u as listSelfHostSecretNames } from "./env-validation-CF6KvTRf.mjs";
+import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-DBKmK4vc.mjs";
 import { n as writeDrizzleConfig } from "./config-NOG_U1aK.mjs";
 import { t as runMySqlMigrations } from "./runner-mysql-7BPUNGmL.mjs";
 import { t as runPgMigrations } from "./runner-pg-BkEza-dX.mjs";
 import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
 import { t as scanPages } from "./scan-CpK-57ug.mjs";
+import { renderPrerenderPaths } from "./prerender-render.mjs";
 import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email-Ce6SQq-i.mjs";
-import { a as isExpiredTokenError, i as isCliOutdatedError, n as PlatformClient, o as parsePlatformErrorBody, t as PlatformApiError } from "./client-Clirrol3.mjs";
+import { a as isExpiredTokenError, i as isCliOutdatedError, n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-BQBrZoCX.mjs";
 import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-lAy0B0BQ.mjs";
-import { i as cloudflareKeyringNeedsTerminal, s as ensureCloudflareAuthentication, t as CloudflareAuthenticationError } from "./cloudflare-auth-B1QtTO1b.mjs";
-import { n as createCloudflareEmptyDomainPublisher } from "./cloudflare-operations-CPTpRW6d.mjs";
-import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-ChGZ1DFd.mjs";
+import { i as cloudflareKeyringNeedsTerminal, s as ensureCloudflareAuthentication, t as CloudflareAuthenticationError } from "./cloudflare-auth-6M5llVPC.mjs";
+import { n as createCloudflareEmptyDomainPublisher } from "./cloudflare-operations-BzWnlC1_.mjs";
+import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-D0oXA090.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { t as promptForLoginToken } from "./login-pV69H-ZO.mjs";
+import { n as promptForLoginToken } from "./login-WIjNc77c.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -43,7 +43,7 @@ import { applyEdits, modify, parse } from "jsonc-parser";
 import { build } from "vite";
 import { Minimatch } from "minimatch";
 import { isDeepStrictEqual } from "node:util";
-import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
+import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
 import { hash } from "blake3-jit";
 import ignore from "ignore";
 //#region src/asset-routing.ts
@@ -597,7 +597,7 @@ async function preflightEmail(inputs) {
 				status: settings.status,
 				enabled: settings.enabled
 			};
-			if (/^(unlocked|misconfigured)/.test(settings.status)) block("all", `Email Routing on ${apex} is ${settings.status} — fix it in the Cloudflare dashboard; Void never re-locks records you unlocked`);
+			if (settings.status === "unlocked") block("all", `Email Routing on ${apex} is ${settings.status} — fix it in the Cloudflare dashboard; Void never re-locks records you unlocked`);
 		}
 	}
 	if (pre.routing.state !== "ready") {
@@ -1507,6 +1507,8 @@ const UNTRUSTED_PROJECT_CODE_ENV_VARS = [
 	...WRANGLER_AUTH_CREDENTIAL_ENV_VARS,
 	"CF_ACCESS_CLIENT_ID",
 	"CF_ACCESS_CLIENT_SECRET",
+	"VOID_ACCESS_CREDENTIALS",
+	"VOID_ACCESS_ORIGIN",
 	"VOID_TOKEN",
 	"DATABASE_URL",
 	"ACTIONS_ID_TOKEN_REQUEST_URL",
@@ -1534,61 +1536,16 @@ function buildEnv(extra, options) {
 //#endregion
 //#region src/prerender.ts
 const PRERENDER_PATHS_ENDPOINT = "/__void/prerender-paths";
-const STATIC_PAGE_DATA_DIR = "_void/pages";
+const nodeRendererUrl = new URL(import.meta.url.endsWith(".ts") ? "./prerender-render.ts" : "./prerender-render.mjs", import.meta.url).href;
 function outputFileForPath(path) {
 	return path === "/" ? "index.html" : `${path.slice(1)}.html`;
 }
-function pageDataFileForPath(path) {
-	return path === "/" ? `${STATIC_PAGE_DATA_DIR}/index.json` : `${STATIC_PAGE_DATA_DIR}/${path.slice(1)}.json`;
-}
 async function readPrerenderPathsResponse(response) {
 	if (!response.ok) throw new Error(`prerender: Failed to collect prerender paths. HTTP ${response.status}.`);
 	const payload = await response.json();
 	if (!Array.isArray(payload.paths) || !payload.paths.every((path) => typeof path === "string")) throw new Error("prerender: Failed to collect prerender paths. Response payload is invalid.");
 	return payload.paths;
 }
-async function renderPrerenderPaths(paths, clientDir, fetchPath, fetchPageData) {
-	const result = {
-		rendered: [],
-		failed: []
-	};
-	for (const path of paths) try {
-		const response = await fetchPath(path);
-		const html = await response.text();
-		if (!response.ok) {
-			result.failed.push({
-				path,
-				error: `HTTP ${response.status}`
-			});
-			voidWarn(`prerender ${path} failed: HTTP ${response.status}`);
-			continue;
-		}
-		const outputFile = outputFileForPath(path);
-		const outputPath = join(clientDir, outputFile);
-		mkdirSync(dirname(outputPath), { recursive: true });
-		writeFileSync(outputPath, html);
-		if (fetchPageData) {
-			const pageDataResponse = await fetchPageData(path);
-			if (pageDataResponse.headers.get("X-VoidPages")) {
-				const pageData = await pageDataResponse.json();
-				const pageDataFile = pageDataFileForPath(path);
-				const pageDataPath = join(clientDir, pageDataFile);
-				mkdirSync(dirname(pageDataPath), { recursive: true });
-				writeFileSync(pageDataPath, JSON.stringify(pageData));
-			}
-		}
-		result.rendered.push(path);
-		voidLog(`prerender \x1b[36m${outputFile}\x1b[39m`);
-	} catch (err) {
-		const error = err instanceof Error ? err.message : String(err);
-		result.failed.push({
-			path,
-			error
-		});
-		voidWarn(`prerender ${path} failed: ${error}`);
-	}
-	return result;
-}
 function normalizeWorkerModulePath(path) {
 	return path.replace(/\\/g, "/").replace(/^\.\//, "");
 }
@@ -1646,6 +1603,8 @@ function buildPrerenderBindings(input) {
 		voidBindings.__VOID_PROJECT_ID = input.voidProjectId;
 		if (input.voidStaging) voidBindings.__VOID_STAGING = "1";
 		voidBindings.__VOID_PROXY_URL = input.voidProxyUrl ?? (input.voidStaging ? "https://proxy.staging.void.cloud" : "https://proxy.void.cloud");
+		const access = scopedAccessCredentials(input.accessEnv ?? {}, voidBindings.__VOID_PROXY_URL);
+		if (access) voidBindings.__VOID_ACCESS_CREDENTIALS = access;
 		if (input.remoteMode) voidBindings.__VOID_REMOTE = "1";
 	}
 	return {
@@ -1673,7 +1632,9 @@ async function createCloudflarePrerenderRunner(options) {
 	const voidToken = voidProjectId ? options.voidToken ?? getToken(root) : null;
 	const voidStaging = isStagingMode(root);
 	const voidProxyUrl = voidToken && voidProjectId ? getProxyUrl(root) : void 0;
+	if (voidProxyUrl) ensurePlatformProxyAccess(getApiUrl(root), voidProxyUrl);
 	const bindings = buildPrerenderBindings({
+		accessEnv: process.env,
 		wranglerVars: wranglerConfig.vars,
 		env,
 		voidToken,
@@ -1771,7 +1732,10 @@ async function prerenderPages(options) {
 		};
 		return {
 			paths,
-			...await renderPrerenderPaths(paths, options.clientDir, (path) => runner.fetchPath(path), (path) => runner.fetchPageData(path))
+			...await renderPrerenderPaths(paths, options.clientDir, (path) => runner.fetchPath(path), (path) => runner.fetchPageData(path), (path, outputFile, error) => {
+				if (error !== void 0) voidWarn(`prerender ${path} failed: ${error}`);
+				else voidLog(`prerender \x1b[36m${outputFile}\x1b[39m`);
+			})
 		};
 	} finally {
 		await runner.close();
@@ -1783,7 +1747,7 @@ async function runNodePrerenderRunner(root, config) {
 	writeFileSync(runnerPath, `
 import { pathToFileURL } from "node:url";
 import { dirname, join } from "node:path";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { renderPrerenderPaths } from ${JSON.stringify(nodeRendererUrl)};
 
 const config = JSON.parse(process.argv[2]);
 const { mode, ssrDir, clientDir } = config;
@@ -1814,37 +1778,13 @@ async function collectPaths() {
 
 async function renderPaths(paths) {
   if (!clientDir) return { rendered: [], failed: [] };
-  const result = { rendered: [], failed: [] };
-
-  for (const path of paths) {
-    try {
-      const response = await fetch(new Request("http://localhost" + path));
-      const html = await response.text();
-      if (!response.ok) {
-        result.failed.push({ path, error: "HTTP " + response.status });
-        continue;
-      }
-      const outputFile = path === "/" ? "index.html" : path.slice(1) + ".html";
-      const outputPath = join(clientDir, outputFile);
-      mkdirSync(dirname(outputPath), { recursive: true });
-      writeFileSync(outputPath, html);
-      const pageDataResponse = await fetch(new Request("http://localhost" + path, {
-        headers: { "Accept": "application/json", "Purpose": "prefetch", "X-VoidPages": "true" },
-      }));
-      if (pageDataResponse.headers.get("X-VoidPages")) {
-        const pageData = await pageDataResponse.json();
-        const pageDataFile = path === "/" ? "_void/pages/index.json" : "_void/pages/" + path.slice(1) + ".json";
-        const pageDataPath = join(clientDir, pageDataFile);
-        mkdirSync(dirname(pageDataPath), { recursive: true });
-        writeFileSync(pageDataPath, JSON.stringify(pageData));
-      }
-      result.rendered.push(path);
-    } catch (err) {
-      result.failed.push({ path, error: err instanceof Error ? err.message : String(err) });
-    }
-  }
-
-  return result;
+  return renderPrerenderPaths(
+    paths, clientDir,
+    (path) => fetch(new Request("http://localhost" + path)),
+    (path) => fetch(new Request("http://localhost" + path, {
+      headers: { "Accept": "application/json", "Purpose": "prefetch", "X-VoidPages": "true" },
+    })),
+  );
 }
 
 if (mode === "collect") {
@@ -2183,8 +2123,8 @@ function formatConnectionLostMessage(deploymentId, logPath) {
 * Three cases:
 *   1. `PlatformApiError` with 409 + a JSON body carrying `{error, deployment}`
 *      — surface the server-supplied error and prefer the body's deployment id.
-*   2. Any other `PlatformApiError` — surface as `Deploy failed (HTTP <status>): <detail>`
-*      where detail is the parsed `error`/`message` field or a trimmed body snippet.
+*   2. Any other `PlatformApiError` — retain the client's actionable message and
+*      structured error fields; opaque provider failures use a trimmed body snippet.
 *   3. Anything else — preserve the original message under a `Connection lost
 *      during deploy: <original>` prefix so the caller can still tell network,
 *      parse, and transport errors apart.
@@ -2192,13 +2132,19 @@ function formatConnectionLostMessage(deploymentId, logPath) {
 function formatStreamDeployError(err, deploymentId, logPath) {
 	if (err instanceof PlatformApiError) {
 		const parsed = parsePlatformErrorBody(err.body);
-		const parsedError = parsed?.error ?? parsed?.message ?? null;
+		const parsedError = platformErrorMessage(parsed) ?? parsed?.error ?? null;
 		const effectiveDeploymentId = parsed?.deployment ?? null ?? deploymentId;
-		if (isCliOutdatedError(err) && parsed?.message) return new Error(appendTrailingLines(parsed.message, effectiveDeploymentId, logPath));
-		if (err.status === 409 && parsedError) return new Error(appendTrailingLines(`deploy: Deploy failed: ${parsedError}`, effectiveDeploymentId, logPath));
+		if (isCliOutdatedError(err) && parsed?.message) {
+			err.message = appendTrailingLines(err.message, effectiveDeploymentId, logPath);
+			return err;
+		}
+		if (parsedError || err.status === 401 || err.status === 403 || parsed !== null) {
+			err.message = appendTrailingLines(`deploy: ${err.message}`, effectiveDeploymentId, logPath);
+			return err;
+		}
 		const detail = parsedError ?? trimSnippet(err.body);
-		const base = detail ? `deploy: Deploy failed (HTTP ${err.status}): ${detail}` : `deploy: Deploy failed (HTTP ${err.status}).`;
-		return new Error(appendTrailingLines(base, effectiveDeploymentId, logPath));
+		err.message = appendTrailingLines(detail ? `deploy: Deploy failed (HTTP ${err.status}): ${detail}` : `deploy: Deploy failed (HTTP ${err.status}).`, effectiveDeploymentId, logPath);
+		return err;
 	}
 	const original = err instanceof Error ? err.message : String(err);
 	return new Error(appendTrailingLines(`deploy: Connection lost during deploy: '${original}'.`, deploymentId, logPath));
@@ -2410,7 +2356,10 @@ async function requestGithubOidcToken(requestUrl, requestToken) {
 	url.searchParams.set("audience", OIDC_AUDIENCE);
 	let res;
 	try {
-		res = await fetch(url, { headers: { Authorization: `Bearer ${requestToken}` } });
+		res = await fetch(url, {
+			headers: { Authorization: `Bearer ${requestToken}` },
+			redirect: "manual"
+		});
 	} catch (err) {
 		throw new Error(`github-oidc: Failed to reach the GitHub OIDC token endpoint: ${errText(err)}`);
 	}
@@ -2443,7 +2392,8 @@ async function exchangeOidcTokenAtApi(apiUrl, project, oidcToken) {
 			body: JSON.stringify({
 				oidcToken,
 				project
-			})
+			}),
+			redirect: "manual"
 		});
 	} catch (err) {
 		throw new Error(`github-oidc: Failed to reach ${url}: ${errText(err)}`);
@@ -3114,6 +3064,7 @@ function toWebSocketManifest(routes) {
 }
 function toSandboxManifest(sandbox) {
 	return {
+		controllerProtocol: 1,
 		bindingName: sandbox.binding,
 		className: sandbox.className,
 		containerName: sandbox.containerName,
@@ -3169,6 +3120,7 @@ function buildVoidManifest(opts) {
 		assetManifestVersion: 2,
 		bindings: {}
 	};
+	if (opts.hasEmailHandlers) manifest.emailProtocolVersion = 1;
 	if (bindings.needsAuth) manifest.auth = true;
 	const hasMigrations = migrations && migrations.length > 0;
 	if (bindings.needsD1 || bindings.needsAuth || hasMigrations) {
@@ -3899,7 +3851,7 @@ let loadedProvisionModule;
 * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
 */
 async function loadProvisionModule() {
-	loadedProvisionModule ??= await import("./provision-Blnstcm2.mjs").then((n) => n.a);
+	loadedProvisionModule ??= await import("./provision-CSJOjjQk.mjs").then((n) => n.a);
 	return loadedProvisionModule;
 }
 /**
@@ -5809,14 +5761,27 @@ async function runWranglerAuthToken(runWrangler, configPath) {
 	return (type === "oauth" || type === "api_token") && typeof token === "string" && token.length > 0 ? token : null;
 }
 /**
+* Immediately after setup, the local resolver can retain ENODATA while Cloudflare's public DNS
+* already serves the new subdomain MX. When the committed config is exactly setup's plan and
+* every other inbound prerequisite is still ready, DNS is ambiguous: deleting `addresses`
+* destroys the handoff, while deploying it could fail after upload if routing is genuinely off.
+*/
+function isCommittedSubdomainPlanWaitingForDns(pre, rootConfig) {
+	if (pre.mode !== "subdomain" || pre.domainMx.state !== "empty" && pre.domainMx.state !== "unknown" || pre.routing.enabled !== true || pre.subaddressing.state !== "on" || pre.binding.state !== "present" || pre.sender.state !== "ready" || pre.addressesOwnership.state !== "mine" || pre.addressesStale || pre.rules.state === "unknown" || pre.rules.foreign.length > 0 || !Array.isArray(rootConfig.addresses) || rootConfig.addresses.length === 0) return false;
+	const allBlockers = pre.blockers.filter((blocker) => blocker.scope === "all");
+	if (pre.domainMx.state === "empty") return allBlockers.length === 0;
+	return allBlockers.length === 1;
+}
+/**
 * Step 3b-ii — Mode B email on the developer's own account (design doc 0078, "One keystroke").
 * Preflight is read-only; the checklist is shown; ONE `confirm` (default Yes) authorizes the
 * apply, which runs only the rows not ready and returns the root-config patch this writes.
-* Every branch that cannot finish prints why and returns `satisfied: false` so the deploy
-* continues (never a deploy failure on its own — `--require-email` is the caller's call),
-* WITH the email setup the config already carries when the binding is committed, and
-* without email otherwise. No output of this step ever contains the session bearer: the
-* module borrows it through `getSessionBearer` inside its own closures and drops it.
+* Most branches that cannot finish return `satisfied: false`, leaving `--require-email` to
+* decide whether deployment continues. One ambiguous handoff fails closed for every deploy:
+* an exact committed subdomain plan whose new MX is still empty or unreadable. It is preserved,
+* and the caller stops before build/upload until DNS can be verified. No output of this step
+* ever contains the session bearer: the module borrows it through `getSessionBearer` inside its
+* own closures and drops it.
 */
 async function runCloudflareEmailStep(input) {
 	const without = {
@@ -5905,6 +5870,19 @@ async function runCloudflareEmailStep(input) {
 		};
 	}
 	log.message(renderEmailChecklist(pre));
+	if (isCommittedSubdomainPlanWaitingForDns(pre, rootConfig)) {
+		const dnsState = pre.domainMx.state === "empty" ? "this resolver sees no MX records yet" : "the MX lookup failed";
+		log.error([
+			`deploy: cannot verify Email Routing on ${pre.domain} because ${dnsState}.`,
+			`The existing addresses plan in ${configName} is preserved. DNS may still be propagating after \`void email setup\`; run \`void email status --platform cloudflare\` and retry the deploy when this resolver sees Cloudflare's MX records.`,
+			"Nothing was built or uploaded."
+		].join("\n"));
+		return {
+			...without,
+			abortDeploy: true,
+			map: mapFor(existingAddresses(rootConfig, pre), pre.sending.state === "ready")
+		};
+	}
 	const shipsBinding = pre.binding.state === "present";
 	const leaveAccount = (reason) => {
 		let configWritten = false;
@@ -6159,6 +6137,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			fetchImpl: deps.emailFetch ?? fetch,
 			dns: deps.emailDns ?? await createNodeEmailDns()
 		});
+		if (email.abortDeploy) return exit(1);
 		if (options.requireEmail && !email.satisfied) {
 			log.error(["deploy: --require-email — email is not fully set up for this deploy (see above); refusing to deploy.", "Nothing was built or uploaded. Set email up, or drop --require-email."].join("\n"));
 			return exit(1);
@@ -6711,8 +6690,18 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
 	if (existingWorker) assertCloudflareLinkUnchanged(root, pinnedHandoffLink);
 	const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
-	const execution = await (deps.activateVersion ?? activateCloudflareVersion)({
+	const activationRunner = preBuildRootConfig.compliance_region ? runWrangler : createCloudflareMetadataRunner({
 		runWrangler,
+		accountId,
+		apiBaseUrl,
+		workerName,
+		configPath: generatedConfigPath,
+		fetch: deps.metadataFetch,
+		verifyUploader: assertUploaderStillPinned,
+		getToken: () => runWranglerAuthToken(runWrangler, generatedConfigPath)
+	});
+	const execution = await (deps.activateVersion ?? activateCloudflareVersion)({
+		runWrangler: activationRunner,
 		verifyUploader: assertUploaderStillPinned,
 		workerName,
 		configPath: generatedConfigPath,
@@ -7103,8 +7092,18 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
 	if (existingWorker) assertCloudflareLinkUnchanged(root, pinnedHandoffLink);
 	const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
-	const execution = await (deps.activateVersion ?? activateCloudflareVersion)({
+	const activationRunner = rootConfig.compliance_region ? runWrangler : createCloudflareMetadataRunner({
 		runWrangler,
+		accountId,
+		apiBaseUrl,
+		workerName,
+		configPath: staticConfigPath,
+		fetch: deps.metadataFetch,
+		verifyUploader: uploaderIsPinned,
+		getToken: () => runWranglerAuthToken(runWrangler, staticConfigPath)
+	});
+	const execution = await (deps.activateVersion ?? activateCloudflareVersion)({
+		runWrangler: activationRunner,
 		verifyUploader: uploaderIsPinned,
 		configPath: staticConfigPath,
 		preserveTriggers: existingWorker !== null,
@@ -7270,6 +7269,7 @@ async function runManagedDeploy(root, options, cliLog) {
 		let config = null;
 		if (requestedProjectSlug) {
 			const projects = await client.listProjects();
+			assertProjectDeployAccess(projects.find((project) => project.slug === requestedProjectSlug));
 			config = resolveProjectBySlug(projects, requestedProjectSlug);
 			if (!config) {
 				if (!process.stdin.isTTY) config = await createProjectFromSlug(root, client, requestedProjectSlug, cliLog);
@@ -7282,7 +7282,16 @@ async function runManagedDeploy(root, options, cliLog) {
 					config = await createProjectFromSlug(root, client, requestedProjectSlug, cliLog);
 				}
 			}
-		} else config = readProjectConfig(root);
+		} else {
+			config = readProjectConfig(root);
+			if (config) {
+				const projects = await client.listProjects();
+				const { projectId, slug } = config;
+				const project = projects.find((project) => project.id === projectId);
+				if (!project) throw new Error(`deploy: The linked project "${slug}" is unavailable or you no longer have access. Ask a project admin or owner to restore access, or choose another project with \`--project <slug>\`.`);
+				assertProjectDeployAccess(project);
+			}
+		}
 		if (!config && !process.stdin.isTTY) {
 			log.error("No project specified. Set `VOID_PROJECT`, pass `--project <slug>`, or commit `.void/project.json`.");
 			process.exit(1);
@@ -7345,10 +7354,15 @@ async function runManagedDeploy(root, options, cliLog) {
 		throw error;
 	}
 }
+function assertProjectDeployAccess(project) {
+	if (project?.role === "reader") throw new Error(`deploy: You have reader access to "${project.slug}" and cannot deploy. Ask a project admin or owner to grant collaborator access, or choose another project with \`--project <slug>\`.`);
+}
 async function promptDeployProjectConfig(root, client, cliLog) {
 	const projects = await client.listProjects();
-	if (await promptProjectSetupAction("Set up a Void project for deploy:", { includeLink: projects.length > 0 }) === "create") return promptAndCreateProject(root, client);
-	const result = await promptProjectSelection(projects, "Select a project to deploy to:", root, {
+	const deployableProjects = projects.filter((project) => project.role !== "reader");
+	if (deployableProjects.length !== projects.length) log.warn("Projects with reader access are hidden from deploy selection. Ask a project admin or owner to grant collaborator access to deploy to them.");
+	if (await promptProjectSetupAction("Set up a Void project for deploy:", { includeLink: deployableProjects.length > 0 }) === "create") return promptAndCreateProject(root, client);
+	const result = await promptProjectSelection(deployableProjects, "Select a project to deploy to:", root, {
 		confirmExisting: true,
 		includeCreate: false
 	});
@@ -7645,7 +7659,10 @@ async function streamDirectR2Deploy(client, projectId, manifest, assetManifest,
 		await uploadAssetsToR2(items, cliLog, void 0, (item) => {
 			assetFiles.delete(item.path);
 		});
-	} else cliLog?.info("presign_skipped", { reason: "no_needed_assets" });
+	} else {
+		assetFiles.clear();
+		cliLog?.info("presign_skipped", { reason: "no_needed_assets" });
+	}
 	let encodedWorkerFiles;
 	if (workerFiles && workerFiles.size > 0) {
 		encodedWorkerFiles = {};
@@ -7894,7 +7911,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		} catch {}
 		if (resources) {
 			if (!resources.some((resource) => resource.type === "hyperdrive")) {
-				const { text: promptText, isCancel: isCancelPrompt } = await import("./output-tFQLLj26.mjs").then((n) => n.T);
+				const { text: promptText, isCancel: isCancelPrompt } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
 				const connectionString = await promptText({
 					message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
 					placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
@@ -8140,7 +8157,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 		} catch {}
 		if (resources) {
 			if (!resources.some((resource) => resource.type === "hyperdrive")) {
-				const { text: promptText, isCancel: isCancelPrompt } = await import("./output-tFQLLj26.mjs").then((n) => n.T);
+				const { text: promptText, isCancel: isCancelPrompt } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
 				const connectionString = await promptText({
 					message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
 					placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
@@ -8296,6 +8313,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			...effectiveBindings,
 			needsLive: true
 		} : effectiveBindings,
+		hasEmailHandlers: !isFrameworkMode && routeScan.email !== void 0 && hasEmailHandlers(routeScan.email),
 		migrations: validatedMigrations,
 		schedules,
 		ssr: isSsr || hasRoutes || hasMiddleware || hasWebSockets || authEnabled,

package/dist/{dev-inbox-DkgRWLkW.mjs → dev-inbox-P0u4tM8Y.mjs}

@@ -1,4 +1,4 @@
-import { t as MAX_MESSAGE_BYTES } from "./mime-BJD7d_qL.mjs";
+import { t as MAX_MESSAGE_BYTES } from "./mime-D5Nmdzf7.mjs";
 //#region src/runtime/email/dev-inbox.ts
 /**
 * In-memory capture sink for emails during local dev / tests.

package/dist/{domain-B1VmoSr0.mjs → domain-BxAyhxXN.mjs}

@@ -1,6 +1,6 @@
-import { D as log, O as note, c as import_picocolors } from "./output-tFQLLj26.mjs";
-import { b as readDeploymentPlatform, c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { D as log, c as import_picocolors, k as note } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/domain.ts
 async function runDomainCommand(root, args) {
 	const platform = readDeploymentPlatform(root);
@@ -38,7 +38,7 @@ async function runDomainCommand(root, args) {
 }
 async function runCloudflareDomainCommand(root, args) {
 	if (args.projectSlug) throw new Error("domain: --project selects a Void platform project and is not used for direct Cloudflare apps.");
-	const { changeCloudflareDomain, listCloudflareDomains } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+	const { changeCloudflareDomain, listCloudflareDomains } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 	if (args.subcommand === "add") {
 		const result = await changeCloudflareDomain(root, args.hostname, "add");
 		log.success(result.modified ? `Domain ${args.hostname} added and activated on Cloudflare.` : `Domain ${args.hostname} is already configured.`);