void 0.20.2 → 0.20.3

package/dist/{platform-lifecycle-BwAIgz-t.mjs → platform-lifecycle-R9xAxvtG.mjs}

@@ -1501,7 +1501,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Bhtvp0B_.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Drl0qhrn.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1599,6 +1599,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	const enableEmail = options?.includeEmailGateway !== false && !!emailSharedZoneId && !!normalizedEmailSenderDomain;
 	const capabilities = {
 		...existing?.deployment.capabilities,
+		...options?.enableSandbox ? { sandbox: true } : {},
 		...input.authentication ? {
 			githubOAuth: input.authentication.providers.includes("github"),
 			googleOAuth: input.authentication.providers.includes("google")
@@ -1629,13 +1630,20 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	});
 	const { emailSharedZoneId: configuredEmailZone, emailSenderDomain: configuredSenderDomain, ...deploymentWithoutEmailZone } = deployment;
 	const { emailSharedZoneId: recordedEmailZone, emailSenderDomain: recordedSenderDomain, ...existingWithoutEmailZone } = existing?.deployment ?? deployment;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithSandbox = existing && options?.enableSandbox ? {
 		...existingWithoutEmailZone,
 		capabilities: {
 			...existingWithoutEmailZone.capabilities,
-			email: true
+			sandbox: true
 		}
 	} : existingWithoutEmailZone;
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithSandbox,
+		capabilities: {
+			...existingWithSandbox.capabilities,
+			email: true
+		}
+	} : existingWithSandbox;
 	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
@@ -1793,7 +1801,8 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 		zoneName: deployment.application.zoneName
 	}, manifest, {
 		...options,
-		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker")
+		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker"),
+		enableSandbox: original.deployment.capabilities.sandbox
 	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
@@ -2771,7 +2780,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
 		const prepareSandboxDrain = dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
 		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
-		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
 		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
 		const writeSandboxDrainMirror = async (preparation) => {
 			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
@@ -3836,14 +3846,14 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
      ) AS "present"`)).rows[0]?.present === true;
-	if (requiredAdmissionProtocol === 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
+	if (requiredAdmissionProtocol >= 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
 	const readCheckpoint = () => client.query(`SELECT ${hasAdmissionColumn ? "\"admission_protocol\"" : "0 AS \"admission_protocol\""}, "generation", "state", "phase", "cursor", "started_at", "updated_at", "completed_at"
        FROM "sandbox_drain_checkpoints"
        WHERE "singleton" = true`);
 	const classify = (row) => {
 		if (!row) return null;
 		const cursor = row.cursor;
-		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
+		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 && row.admission_protocol !== 3 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
 		return {
 			admissionProtocol: row.admission_protocol,
 			generation: row.generation,
@@ -3860,7 +3870,23 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
 	};
 	const existingState = classify((await readCheckpoint()).rows[0]);
 	if (existingState && (requiredAdmissionProtocol === 0 || existingState.admissionProtocol >= requiredAdmissionProtocol)) return existingState;
-	if (requiredAdmissionProtocol === 2) {
+	if (requiredAdmissionProtocol >= 2) {
+		if (existingState && existingState.admissionProtocol >= 2) {
+			await client.query("BEGIN");
+			try {
+				await client.query("LOCK TABLE \"deployments\" IN SHARE MODE");
+				await client.query(`UPDATE "sandbox_drain_checkpoints"
+           SET "admission_protocol" = GREATEST("admission_protocol", $1), "updated_at" = now()
+           WHERE "singleton" = true`, [requiredAdmissionProtocol]);
+				const advanced = classify((await readCheckpoint()).rows[0]);
+				if (!advanced || advanced.admissionProtocol < requiredAdmissionProtocol) throw new Error("platform: The Sandbox controller admission barrier could not be armed.");
+				await client.query("COMMIT");
+				return advanced;
+			} catch (error) {
+				await client.query("ROLLBACK").catch(() => void 0);
+				throw error;
+			}
+		}
 		const generation = randomUUID();
 		await client.query("BEGIN");
 		try {
@@ -3893,8 +3919,10 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
            WHERE "singleton" = true
              AND "admission_protocol" = 2
              AND "generation" = $1`, [generation]);
+			if (requiredAdmissionProtocol >= 3) await client.query(`UPDATE "sandbox_drain_checkpoints" SET "admission_protocol" = $1
+           WHERE "singleton" = true`, [requiredAdmissionProtocol]);
 			const armed = classify((await readCheckpoint()).rows[0]);
-			if (!armed || armed.admissionProtocol !== 2) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
+			if (!armed || armed.admissionProtocol < requiredAdmissionProtocol) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
 			await client.query("COMMIT");
 			return armed;
 		} catch (error) {
@@ -3937,12 +3965,17 @@ async function readRequiredPlatformSafetyProtocols(client) {
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
      ) AS "present"`)).rows[0]?.present === true) {
-		if ((await client.query(`SELECT EXISTS(
+		const admission = await client.query(`SELECT EXISTS(
          SELECT 1
          FROM "sandbox_drain_checkpoints"
          WHERE "singleton" = true
            AND "admission_protocol" >= 2
-       ) AS "required"`)).rows[0]?.required === true) return { sandboxDrain: 2 };
+       ) AS "required", (SELECT "admission_protocol" FROM "sandbox_drain_checkpoints"
+                         WHERE "singleton" = true) AS "protocol"`);
+		if (admission.rows[0]?.required === true) {
+			if (admission.rows[0].protocol != null && admission.rows[0].protocol > 3) throw new Error("platform: The database requires a newer Sandbox controller protocol.");
+			return { sandboxDrain: admission.rows[0].protocol === 3 ? 3 : 2 };
+		}
 	}
 	return { sandboxDrain: (await client.query(`SELECT EXISTS(
        SELECT 1
@@ -4817,7 +4850,7 @@ var PlatformAccessBlockedError = class extends Error {
 			"Void’s own authentication stays enabled. Keep account-wide Default-Deny on.",
 			"",
 			"For platforms that must remain Access-protected:",
-			"https://void.cloud/guide/self-hosted-platform#cloudflare-access"
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
 		].join("\n"));
 	}
 };
@@ -5199,9 +5232,9 @@ function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
 	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + page.title + "\x1B]8;;\x1B\\" : page.title + ": " + page.url;
 }
 function platformSetupFieldHelp(key) {
-	const docs = (section, title) => platformSetupLink({
+	const docs = (page, section, title) => platformSetupLink({
 		title,
-		url: "https://void.cloud/guide/self-hosted-platform#" + section
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
 	});
 	switch (key) {
 		case "databaseUrl": return {
@@ -5209,10 +5242,10 @@ function platformSetupFieldHelp(key) {
 			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
 				title: "Neon",
 				url: "https://neon.com/"
-			}) + ". " + docs("platform-database", "Database setup")
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
 		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("signing-and-encryption-keys", "Key setup") };
+		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
 		default: return;
 	}
 }
@@ -5407,14 +5440,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-C74PULqV.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-4GiDlcqx.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-ewqLefp1.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-CbK-I1FB.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5424,7 +5457,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-COogu_Se.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-BfWsXHEW.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -5574,7 +5607,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-COogu_Se.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-BfWsXHEW.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -5599,7 +5632,8 @@ async function runPlatformLifecycleCommand(args) {
 		let plan = await createPlatformInstallPlan(client, planInput, existing, {
 			authoritativeProvisionIntents,
 			allowUnverifiedAiGateway: true,
-			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 		});
 		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
 		note(formatPlatformRuntime(runtime), "Platform runtime");
@@ -5780,11 +5814,12 @@ async function runPlatformLifecycleCommand(args) {
 			replanWorkers: async (manifest) => (await createPlatformInstallPlan(client, planInput, manifest, {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
-				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-COogu_Se.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-BfWsXHEW.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -5849,7 +5884,8 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 	try {
 		verified = await createPlatformInstallPlan(client, input, existing, {
 			authoritativeProvisionIntents,
-			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker")
+			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker"),
+			enableSandbox: preview.deployment.capabilities.sandbox
 		});
 	} catch (error) {
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });

package/dist/{platform-management-COogu_Se.mjs → platform-management-BfWsXHEW.mjs}

@@ -1,5 +1,5 @@
 import { A as outro, D as log, I as isCancel, J as listInstallationManifests, M as select, W as acquirePlatformLifecycleLock, et as readInstallationRecoverySecrets, i as createSpinner, it as resolveInstallationManifest, k as note, nt as removeInstallationRecoverySecrets, rt as removePlatformConnectionForInstallation, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
-import { C as PlatformCloudflareClient, D as verifyPlatformRuntimeTokenPermissions, E as hyperdriveOriginMatches, T as hyperdriveOriginFromConnectionString, _ as revalidatePlatformInstallAction, a as createPlatformInstallationSecrets, assertNoninteractivePlatformMutationAcknowledged, f as trackedPlatformWorkerTraffic, g as platformProvisionIntentHash, h as platformAdoptionIntentHash, m as formatPlatformInstallPlan, n as acquirePlatformDatabaseLifecycleLock, o as installPlatform, p as createPlatformInstallPlan, resolvePlatformInstallDatabaseUrl, s as loadPlatformRuntime, t as REMOTE_INSTALLATION_MANIFEST_KEY, u as resolveBootstrapGitHubId, v as assertPlatformOperatorCredentialCanApplyPlan, w as hyperdriveOriginConfigHash, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BwAIgz-t.mjs";
+import { C as PlatformCloudflareClient, D as verifyPlatformRuntimeTokenPermissions, E as hyperdriveOriginMatches, T as hyperdriveOriginFromConnectionString, _ as revalidatePlatformInstallAction, a as createPlatformInstallationSecrets, assertNoninteractivePlatformMutationAcknowledged, f as trackedPlatformWorkerTraffic, g as platformProvisionIntentHash, h as platformAdoptionIntentHash, m as formatPlatformInstallPlan, n as acquirePlatformDatabaseLifecycleLock, o as installPlatform, p as createPlatformInstallPlan, resolvePlatformInstallDatabaseUrl, s as loadPlatformRuntime, t as REMOTE_INSTALLATION_MANIFEST_KEY, u as resolveBootstrapGitHubId, v as assertPlatformOperatorCredentialCanApplyPlan, w as hyperdriveOriginConfigHash, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-R9xAxvtG.mjs";
 import { createHash } from "node:crypto";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 //#region src/cli/platform-management.ts
@@ -72,7 +72,8 @@ async function runInstalledPlatformCommand(args) {
 			authoritativeProvisionIntents: databaseCheckpointExists,
 			repairMissing: args.subcommand === "repair",
 			allowUnverifiedAiGateway: args.plan,
-			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 		});
 		note(formatPlatformInstallPlan(plan), args.subcommand === "upgrade" ? "Upgrade plan" : args.subcommand === "rollback" ? "Rollback plan" : args.subcommand === "enable" ? "Enable plan" : "Repair plan");
 		note([
@@ -144,7 +145,8 @@ async function runInstalledPlatformCommand(args) {
 			replanWorkers: async (recoveryManifest) => (await createPlatformInstallPlan(client, planInput, recoveryManifest, {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
-				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action, { repairMissing: args.subcommand === "repair" })
 		});

package/dist/{platform-recovery-ewqLefp1.mjs → platform-recovery-CbK-I1FB.mjs}

@@ -1,7 +1,7 @@
 import { J as listInstallationManifests, W as acquirePlatformLifecycleLock, at as savePlatformConnection, st as writeInstallationManifest } from "./output-B0cfNSx5.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { p as createPlatformInstallPlan, t as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-BwAIgz-t.mjs";
-import { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, verifyPlatformInstallationOwnership } from "./platform-management-COogu_Se.mjs";
+import { p as createPlatformInstallPlan, t as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-R9xAxvtG.mjs";
+import { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, verifyPlatformInstallationOwnership } from "./platform-management-BfWsXHEW.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{project-cmd-DmZK9Hxf.mjs → project-cmd-CTdmnzvc.mjs}

@@ -1,6 +1,6 @@
 import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, r as cliTitle, u as tablePrefix } from "./output-B0cfNSx5.mjs";
 import { c as getSiteDomain, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
-import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -37,24 +37,24 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-DEE2S6mY.mjs");
+		const { runListCommand } = await import("./list-CvkK_G7k.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by the name in wrangler.jsonc and do not need linking.");
-		const { runLink } = await import("./link-Rmvu2Wl_.mjs");
+		const { runLink } = await import("./link-D2kbqhWb.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-DEE2S6mY.mjs");
+			const { runListCommand } = await import("./list-CvkK_G7k.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
 	if (args.subcommand === "token") {
 		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
-		const { runProjectTokenCommand } = await import("./project-token-DA34bf-C.mjs");
+		const { runProjectTokenCommand } = await import("./project-token-Cirx7uwZ.mjs");
 		return runProjectTokenCommand(root, args);
 	}
 	if (args.subcommand === "team") {
@@ -65,35 +65,35 @@ async function runProjectCommand(root, args) {
 		}
 		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
 		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
-		const { runProjectTeamCommand } = await import("./project-team-D8jOJMUJ.mjs");
+		const { runProjectTeamCommand } = await import("./project-team-CGxsQe3_.mjs");
 		return runProjectTeamCommand(root, args);
 	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-27FenuiC.mjs");
+		const { runLogsCommand } = await import("./logs-dLUFCapG.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-CUExwGQQ.mjs");
+		const { runRequestsCommand } = await import("./requests-4Nq59hOr.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-CDNGU1gr.mjs");
+		const { runRollbackCommand } = await import("./rollback-Dr7u0Ljx.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-C5qTOdLi.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-CPbEQLMG.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-DouASY9P.mjs");
+		const { runDeleteCommand } = await import("./delete-BZ4-WaGm.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-IHn5MwBC.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-D98YTqeE.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/{project-team-D8jOJMUJ.mjs → project-team-CGxsQe3_.mjs}

@@ -1,6 +1,6 @@
 import { A as outro, D as log, E as intro, k as note, r as cliTitle } from "./output-B0cfNSx5.mjs";
 import { S as readProjectConfig, a as getAccountCredential, l as getToken } from "./auth-DPl6kck4.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-dHfSJvAN.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-BQBrZoCX.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/project-team.ts
 function clean(value) {
@@ -42,13 +42,15 @@ async function resolveProjectId(root, client, projectSlug) {
 }
 function invitationResponseError(error, apiUrl) {
 	if (!(error instanceof PlatformApiError)) return error;
+	if (platformErrorMessage(parsePlatformErrorBody(error.body))) return error;
 	let message;
 	if (error.code === "project invitation not found") message = `Invitation not found on ${apiUrl}. Check VOID_API_URL if set, connect to the platform in your invitation with \`void connect <url>\`, then run \`void project team pending\` to check the invitation ID. If it is missing, ask a project administrator for a new invitation.`;
 	else if (error.code === "forbidden") message = `Your account cannot respond to this invitation on ${apiUrl}. Sign in with the account whose registered email received the invitation. To switch accounts, set VOID_API_URL to ${apiUrl}, unset VOID_TOKEN if present, then run \`void auth logout\` and \`void auth login\`. Run \`void project team pending\` to see that account's invitations.`;
 	else if (error.code === "project invitation has expired") message = "This invitation has expired. Ask a project administrator to invite you again, then run `void project team pending`.";
 	else if (error.code === "project invitation is no longer pending") message = "This invitation has already been answered or revoked. Run `void project team pending` to see invitations awaiting your response, or ask a project administrator to check your access.";
 	else return error;
-	return new Error(message, { cause: error });
+	error.message = message;
+	return error;
 }
 async function runProjectTeamCommand(root, args) {
 	console.log();

package/dist/{project-token-DA34bf-C.mjs → project-token-Cirx7uwZ.mjs}

@@ -1,6 +1,6 @@
 import { A as outro, D as log, E as intro, a as dim, r as cliTitle, u as tablePrefix } from "./output-B0cfNSx5.mjs";
 import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
-import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/project-token.ts
 async function resolveTarget(root, args) {

package/dist/{requests-CUExwGQQ.mjs → requests-4Nq59hOr.mjs}

@@ -1,6 +1,6 @@
 import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, r as cliTitle } from "./output-B0cfNSx5.mjs";
 import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
-import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {
 	console.log();

package/dist/{rollback-CDNGU1gr.mjs → rollback-Dr7u0Ljx.mjs}

@@ -1,6 +1,6 @@
 import { A as outro, C as cancel, D as log, E as intro, I as isCancel, M as select, a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
 import { S as readProjectConfig, l as getToken, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
-import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { n as PlatformClient } from "./client-BQBrZoCX.mjs";
 //#region src/cli/rollback.ts
 async function runRollbackCommand(root, deployId) {
 	console.log();

package/dist/runtime/remote/index.mjs

@@ -1,6 +1,53 @@
 import { t as cfAccessHeaders } from "../../cf-access-DRsQRe6k.mjs";
 import { n as serializeR2Conditional } from "../../r2-conditions-D1Wk8i7b.mjs";
 //#region src/runtime/remote/client.ts
+function readableMessage(value) {
+	if (typeof value !== "string") return;
+	const text = value.replace(/(?:\u001b\]|\u009d)[\s\S]*?(?:\u0007|\u001b\\|\u009c|$)/g, "").replace(/(?:\u001b\[|\u009b)[0-?]*[ -/]*[@-~]/g, "").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").trim();
+	if (!text || /^[{[]/.test(text) || /<\/?[a-z!][^>]*>/i.test(text)) return;
+	return text.length > 500 ? `${text.slice(0, 500)}…` : text;
+}
+function isGenericPermissionMessage(message) {
+	return /^(?:(?:HTTP\s*)?(?:401|403)\s*[:-]?\s*)?(?:forbidden|unauthorized|access denied|permission denied|invalid or expired token)[.!]?$/i.test(message);
+}
+async function proxyError(response) {
+	const reader = response.body?.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let remaining = 16384;
+	try {
+		while (reader && remaining > 0) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			text += decoder.decode(value.subarray(0, remaining), { stream: true });
+			remaining -= value.byteLength;
+		}
+		text += decoder.decode();
+	} catch {} finally {
+		await reader?.cancel().catch(() => {});
+		reader?.releaseLock();
+	}
+	let message;
+	let error;
+	try {
+		const body = JSON.parse(text);
+		if (body && typeof body === "object" && !Array.isArray(body)) {
+			const payload = body;
+			message = readableMessage(payload.message);
+			error = readableMessage(payload.error);
+		}
+	} catch {
+		if (!response.headers.get("content-type")?.includes("text/html")) error = readableMessage(text);
+	}
+	if (message && isGenericPermissionMessage(message)) message = void 0;
+	if (!message && error && !isGenericPermissionMessage(error)) message = error;
+	if (!message) {
+		if (response.status === 401) message = "Remote access could not be authenticated. Sign in to the connected platform again, or restart the build to obtain a fresh prerender token.";
+		else if (response.status === 403) message = "Remote access could not be authorized. Check the selected platform and project, then ask a project admin or owner to confirm your access. If your access is correct, retry shortly.";
+		else message = error ?? "The remote service returned an unreadable error. Retry the request.";
+	}
+	return /* @__PURE__ */ new Error(`remote: Proxy request failed with ${response.status}: ${message}`);
+}
 /**
 * HTTP client for the remote bindings proxy (proxy.void.cloud).
 *
@@ -37,10 +84,7 @@ var ProxyClient = class {
 			}),
 			redirect: "manual"
 		});
-		if (!res.ok) {
-			const text = await res.text().catch(() => res.statusText);
-			throw new Error(`remote: Proxy request failed with ${res.status}: '${text}'.`);
-		}
+		if (!res.ok) throw await proxyError(res);
 		return res;
 	}
 	/**
@@ -66,10 +110,7 @@ var ProxyClient = class {
 			body,
 			redirect: "manual"
 		});
-		if (!res.ok) {
-			const text = await res.text().catch(() => res.statusText);
-			throw new Error(`remote: Proxy request failed with ${res.status}: '${text}'.`);
-		}
+		if (!res.ok) throw await proxyError(res);
 		return res;
 	}
 };

package/dist/runtime/sandbox.d.mts

@@ -3,80 +3,28 @@ import { Sandbox, SandboxOptions } from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.d.ts
 export declare const DEFAULT_SANDBOX_ID = "default";
 export declare const DEFAULT_SANDBOX_BINDING = "SANDBOX";
-export declare const SANDBOX_USAGE_QUEUE_BINDING = "USAGE_EVENTS_QUEUE";
-export declare const SANDBOX_GATE_BINDING = "__VOID_PROXY";
-export declare const HEARTBEAT_MS: number;
+export declare const SANDBOX_SERVICE_BINDING = "__VOID_SANDBOX";
 export type VoidSandboxOptions = SandboxOptions & {
   binding?: string;
 };
-export type SandboxUsageEvent = Readonly<{
-  requests: 0;
-  responseBytes: 0;
-  userId?: string;
-  projectId?: string;
-  slug?: string;
-  sandboxRuntimeSeconds: number;
-  sandboxInstanceId: string;
-}>;
-/**
- * Thrown by `getSandbox()` when the platform gate denies a new acquire because
- * the user has hit a concurrency or runtime budget cap. Surface this to the
- * caller so they can render a friendly error; do not retry transparently.
- */
 export declare class SandboxLimitError extends Error {
   override readonly name = "SandboxLimitError";
   readonly reason: "concurrency" | "runtime_budget";
   constructor(reason: "concurrency" | "runtime_budget", message?: string);
 }
-/** Managed platform Sandbox is unavailable or its activation gate cannot be verified. */
 export declare class SandboxUnavailableError extends Error {
   override readonly name = "SandboxUnavailableError";
   constructor(message?: string);
 }
 export declare function __setSandboxBindingName(bindingName: string): void;
 /**
- * Sandbox variant that participates in Void platform metering: it records
- * container runtime seconds into DO storage, emits periodic heartbeats to
- * the usage queue, and notifies the gate when the container stops.
- *
- * Generated code from `void inference` wires user `Sandbox` subclasses to
- * extend this class on platform deploys so per-tenant accounting works
- * without user opt-in. On local dev (no usage-queue / gate bindings), all
- * overrides degrade to no-ops and the sandbox behaves like the upstream
- * `Sandbox` class.
+ * Retained for generated native/local Worker entries. Managed deployments host
+ * the platform-owned Sandbox class in a separate Worker and never use this DO.
  */
 export declare class VoidPlatformSandbox<Env = unknown> extends Sandbox<Env> {
   override onStart(): Promise<void>;
-  override alarm(alarmProps?: AlarmInvocationInfo): Promise<void>;
-  override onStop(): Promise<void>;
-  override onActivityExpired(): Promise<void>;
-  private flushFinal;
 }
-/**
- * Resolve the platform-provided sandbox stub for the given id, optionally
- * coordinating with the platform gate to enforce per-user concurrency and
- * runtime budgets.
- *
- * When the gate binding (`__VOID_PROXY` by default) is present AND the
- * platform's `__PROJECT_ID` + `__VOID_PROXY_TOKEN` identity vars are
- * available, we POST to `https://gate/sandbox/acquire` with the HMAC-signed
- * body the shared proxy auth middleware expects. A `409` response means the
- * user has exceeded a budget — we throw `SandboxLimitError` so the caller
- * can render a clear message. Any other non-OK status (or a thrown transport
- * error from the service binding) fails closed before returning a usable
- * managed stub.
- *
- * When all reserved platform identity bindings are absent, this is a native
- * Cloudflare or local deployment and returns the upstream stub directly.
- *
- * The stub is constructed BEFORE calling the gate so we can pass its opaque,
- * namespace-specific Durable Object id (`stub.id.toString()`) as `sandboxId`.
- * The same id is available as `ctx.id.toString()` inside lifecycle hooks, so
- * acquire, heartbeat, and release use one globally unique instance identity
- * even when separate projects or deployments both request the name `default`.
- * Constructing the stub does NOT start a container — that only happens on
- * the first method call against the stub.
- */
+/** Resolve an isolated Sandbox on the current deployment. Starts on first use. */
 export declare function getSandbox<T extends Sandbox = Sandbox>(id?: string, options?: VoidSandboxOptions): Promise<T>;
 export declare const sandbox: {
   get: typeof getSandbox;