void 0.20.2 → 0.21.0

package/dist/{output-B0cfNSx5.mjs → dist-Dn6nn2IU.mjs}

@@ -1,689 +1,10 @@
-import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-rQ84J-ij.mjs";
-import { l as resolve, o as join } from "./dist-BrsS7cai.mjs";
-import { n as isVoidAccessGatedUrl, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
-import { homedir, hostname } from "node:os";
-import { spawnSync } from "node:child_process";
-import { Entry } from "@napi-rs/keyring";
-import { parsePlatformInstallationManifest } from "@void/platform";
+import { t as __commonJSMin } from "./rolldown-runtime-DXIUcv95.mjs";
+import "node:fs";
 import { styleText } from "node:util";
 import process$1, { stdin, stdout } from "node:process";
 import * as l from "node:readline";
 import l__default from "node:readline";
 import { ReadStream } from "node:tty";
-//#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
-var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	let p = process || {};
-	let argv = p.argv || [];
-	let env = p.env || {};
-	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
-	let formatter = (open, close, replace = open) => (input) => {
-		let string = "" + input, index = string.indexOf(close, open.length);
-		return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
-	};
-	let replaceClose = (string, close, replace, index) => {
-		let result = "", cursor = 0;
-		do {
-			result += string.substring(cursor, index) + replace;
-			cursor = index + close.length;
-			index = string.indexOf(close, cursor);
-		} while (~index);
-		return result + string.substring(cursor);
-	};
-	let createColors = (enabled = isColorSupported) => {
-		let f = enabled ? formatter : () => String;
-		return {
-			isColorSupported: enabled,
-			reset: f("\x1B[0m", "\x1B[0m"),
-			bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
-			dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
-			italic: f("\x1B[3m", "\x1B[23m"),
-			underline: f("\x1B[4m", "\x1B[24m"),
-			inverse: f("\x1B[7m", "\x1B[27m"),
-			hidden: f("\x1B[8m", "\x1B[28m"),
-			strikethrough: f("\x1B[9m", "\x1B[29m"),
-			black: f("\x1B[30m", "\x1B[39m"),
-			red: f("\x1B[31m", "\x1B[39m"),
-			green: f("\x1B[32m", "\x1B[39m"),
-			yellow: f("\x1B[33m", "\x1B[39m"),
-			blue: f("\x1B[34m", "\x1B[39m"),
-			magenta: f("\x1B[35m", "\x1B[39m"),
-			cyan: f("\x1B[36m", "\x1B[39m"),
-			white: f("\x1B[37m", "\x1B[39m"),
-			gray: f("\x1B[90m", "\x1B[39m"),
-			bgBlack: f("\x1B[40m", "\x1B[49m"),
-			bgRed: f("\x1B[41m", "\x1B[49m"),
-			bgGreen: f("\x1B[42m", "\x1B[49m"),
-			bgYellow: f("\x1B[43m", "\x1B[49m"),
-			bgBlue: f("\x1B[44m", "\x1B[49m"),
-			bgMagenta: f("\x1B[45m", "\x1B[49m"),
-			bgCyan: f("\x1B[46m", "\x1B[49m"),
-			bgWhite: f("\x1B[47m", "\x1B[49m"),
-			blackBright: f("\x1B[90m", "\x1B[39m"),
-			redBright: f("\x1B[91m", "\x1B[39m"),
-			greenBright: f("\x1B[92m", "\x1B[39m"),
-			yellowBright: f("\x1B[93m", "\x1B[39m"),
-			blueBright: f("\x1B[94m", "\x1B[39m"),
-			magentaBright: f("\x1B[95m", "\x1B[39m"),
-			cyanBright: f("\x1B[96m", "\x1B[39m"),
-			whiteBright: f("\x1B[97m", "\x1B[39m"),
-			bgBlackBright: f("\x1B[100m", "\x1B[49m"),
-			bgRedBright: f("\x1B[101m", "\x1B[49m"),
-			bgGreenBright: f("\x1B[102m", "\x1B[49m"),
-			bgYellowBright: f("\x1B[103m", "\x1B[49m"),
-			bgBlueBright: f("\x1B[104m", "\x1B[49m"),
-			bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
-			bgCyanBright: f("\x1B[106m", "\x1B[49m"),
-			bgWhiteBright: f("\x1B[107m", "\x1B[49m")
-		};
-	};
-	module.exports = createColors();
-	module.exports.createColors = createColors;
-}));
-//#endregion
-//#region src/cli/keyring.ts
-function readKeyringPassword(service, account) {
-	try {
-		return new Entry(service, account).getPassword();
-	} catch {
-		return null;
-	}
-}
-function writeKeyringPassword(service, account, password) {
-	try {
-		new Entry(service, account).setPassword(password);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function deleteKeyringPassword(service, account) {
-	try {
-		new Entry(service, account).deletePassword();
-		return true;
-	} catch {
-		return false;
-	}
-}
-const DEFAULT_REGISTRY = {
-	activeConnectionId: null,
-	connections: [],
-	schemaVersion: 1
-};
-const PLATFORM_RECOVERY_KEYRING_SERVICE = "dev.void.cli.platform";
-const PLATFORM_RECOVERY_ENVELOPE_VERSION = 1;
-function platformRegistryDirectory() {
-	return process.env.VOID_PLATFORM_REGISTRY_DIR ?? join(homedir(), ".void", "platforms");
-}
-function normalizePlatformApiUrl(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw new Error(`platform: Invalid platform URL ${JSON.stringify(value)}.`);
-	}
-	if (!(url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1")) && url.protocol !== "https:" || url.username || url.password) throw new Error("platform: Platform URLs must use HTTPS and must not contain credentials.");
-	if (url.search || url.hash) throw new Error("platform: Platform URLs must not contain query parameters or fragments.");
-	if (url.pathname !== "/" && url.pathname !== "") throw new Error("platform: Platform URLs must not contain a path.");
-	return url.origin;
-}
-function platformConnectionId(apiUrl) {
-	return createHash("sha256").update(normalizePlatformApiUrl(apiUrl)).digest("hex").slice(0, 20);
-}
-function platformCredentialAccount(apiUrl) {
-	return `platform:${createHash("sha256").update(normalizePlatformApiUrl(apiUrl)).digest("hex")}`;
-}
-function parseConnection(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Invalid connection entry in the local registry.");
-	const entry = value;
-	const apiUrl = normalizePlatformApiUrl(String(entry.apiUrl ?? ""));
-	const id = String(entry.id ?? "");
-	if (id !== platformConnectionId(apiUrl)) throw new Error("platform: Connection id does not match its API URL.");
-	if (entry.kind !== "connected" && entry.kind !== "installed") throw new Error("platform: Invalid connection kind in the local registry.");
-	const lastUsedAt = String(entry.lastUsedAt ?? "");
-	if (!Number.isFinite(Date.parse(lastUsedAt))) throw new Error("platform: Invalid connection timestamp in the local registry.");
-	const optionalString = (input) => typeof input === "string" && input !== "" ? input : null;
-	const proxyUrl = optionalString(entry.proxyUrl) ?? (apiUrl === "https://api.void.cloud" ? "https://proxy.void.cloud" : apiUrl === "https://api.staging.void.cloud" ? "https://proxy.staging.void.cloud" : null);
-	return {
-		accountId: optionalString(entry.accountId),
-		apiUrl,
-		applicationDomain: optionalString(entry.applicationDomain),
-		displayName: typeof entry.displayName === "string" && entry.displayName.trim() ? entry.displayName.trim() : new URL(apiUrl).hostname,
-		id,
-		installationId: optionalString(entry.installationId),
-		kind: entry.kind,
-		lastUsedAt,
-		proxyUrl: proxyUrl === null ? null : normalizePlatformApiUrl(proxyUrl)
-	};
-}
-function readRegistry(directory) {
-	try {
-		const parsed = JSON.parse(readFileSync(join(directory, "registry.json"), "utf8"));
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("registry must be an object");
-		const value = parsed;
-		if (value.schemaVersion !== 1 || !Array.isArray(value.connections)) throw new Error("unsupported schema");
-		const connections = value.connections.map(parseConnection);
-		return {
-			activeConnectionId: typeof value.activeConnectionId === "string" && connections.some((connection) => connection.id === value.activeConnectionId) ? value.activeConnectionId : null,
-			connections,
-			schemaVersion: 1
-		};
-	} catch (error) {
-		if (error.code === "ENOENT") return DEFAULT_REGISTRY;
-		throw new Error(`platform: Could not read ${join(directory, "registry.json")}: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-function withRegistryLock(directory, operation) {
-	mkdirSync(directory, {
-		recursive: true,
-		mode: 448
-	});
-	const lockPath = join(directory, ".registry.lock");
-	let descriptor;
-	try {
-		descriptor = openSync(lockPath, "wx", 384);
-	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
-		if (Date.now() - statSync(lockPath).mtimeMs < 6e5) throw new Error("platform: Another process is updating the platform registry.");
-		rmSync(lockPath, { force: true });
-		descriptor = openSync(lockPath, "wx", 384);
-	}
-	try {
-		return operation();
-	} finally {
-		closeSync(descriptor);
-		rmSync(lockPath, { force: true });
-	}
-}
-function writeJsonAtomically(path, value) {
-	const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-	try {
-		writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
-			mode: 384,
-			flag: "wx"
-		});
-		renameSync(temporary, path);
-	} finally {
-		rmSync(temporary, { force: true });
-	}
-}
-function acquirePlatformLifecycleLock(accountId, installationSlug, directory = platformRegistryDirectory()) {
-	if (!/^[A-Za-z0-9_-]+$/.test(accountId) || !/^[a-z0-9][a-z0-9-]{0,79}$/.test(installationSlug)) throw new Error("platform: Invalid lifecycle lock identity.");
-	const lockDirectory = join(directory, "locks");
-	mkdirSync(lockDirectory, {
-		recursive: true,
-		mode: 448
-	});
-	const lockPath = join(lockDirectory, `${accountId}-${installationSlug}.lock`);
-	const acquire = () => {
-		try {
-			const descriptor = openSync(lockPath, "wx", 384);
-			writeFileSync(descriptor, `${JSON.stringify({
-				host: hostname(),
-				pid: process.pid,
-				startedAt: (/* @__PURE__ */ new Date()).toISOString()
-			})}\n`);
-			return descriptor;
-		} catch (error) {
-			if (error.code !== "EEXIST") throw error;
-			let stale = false;
-			try {
-				const owner = JSON.parse(readFileSync(lockPath, "utf8"));
-				if (owner.host === hostname() && typeof owner.pid === "number") try {
-					process.kill(owner.pid, 0);
-				} catch (ownerError) {
-					stale = ownerError.code === "ESRCH";
-				}
-				else {
-					const startedAt = typeof owner.startedAt === "string" ? Date.parse(owner.startedAt) : NaN;
-					stale = Number.isFinite(startedAt) && Date.now() - startedAt > 72e5;
-				}
-			} catch {
-				stale = Date.now() - statSync(lockPath).mtimeMs > 72e5;
-			}
-			if (!stale) throw new Error(`platform: Another lifecycle operation is active for ${installationSlug} in account ${accountId}.`);
-			rmSync(lockPath, { force: true });
-			return acquire();
-		}
-	};
-	const descriptor = acquire();
-	let released = false;
-	return () => {
-		if (released) return;
-		released = true;
-		closeSync(descriptor);
-		rmSync(lockPath, { force: true });
-	};
-}
-function listPlatformConnections(directory = platformRegistryDirectory()) {
-	return readRegistry(directory).connections;
-}
-function assertPlatformInstallationSlugAvailable(installationSlug, directory = platformRegistryDirectory()) {
-	const collision = listInstallationManifests(directory).find((manifest) => manifest.status !== "uninstalled" && manifest.deployment.installationSlug === installationSlug);
-	if (collision) throw new Error(`platform: Installation ${collision.id} already uses this name. Resume it with \`void platform install --resume --name ${collision.id}\`.`);
-}
-function getActivePlatformConnection(directory = platformRegistryDirectory()) {
-	const registry = readRegistry(directory);
-	return registry.connections.find((connection) => connection.id === registry.activeConnectionId) ?? (registry.connections.length === 1 ? registry.connections[0] : null);
-}
-function savePlatformConnection(input, directory = platformRegistryDirectory()) {
-	const apiUrl = normalizePlatformApiUrl(input.apiUrl);
-	const id = platformConnectionId(apiUrl);
-	const lastUsedAt = input.lastUsedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-	const connection = parseConnection({
-		...input,
-		apiUrl,
-		id,
-		lastUsedAt
-	});
-	return withRegistryLock(directory, () => {
-		const connections = readRegistry(directory).connections.filter((entry) => entry.id !== id);
-		connections.push(connection);
-		connections.sort((left, right) => left.displayName.localeCompare(right.displayName));
-		writeJsonAtomically(join(directory, "registry.json"), {
-			activeConnectionId: id,
-			connections,
-			schemaVersion: 1
-		});
-		return connection;
-	});
-}
-function selectPlatformConnection(selector, directory = platformRegistryDirectory()) {
-	return withRegistryLock(directory, () => {
-		const current = readRegistry(directory);
-		const normalizedUrl = (() => {
-			try {
-				return normalizePlatformApiUrl(selector);
-			} catch {
-				return null;
-			}
-		})();
-		const matches = current.connections.filter((entry) => entry.id === selector || entry.installationId === selector || entry.displayName.toLowerCase() === selector.toLowerCase() || normalizedUrl !== null && entry.apiUrl === normalizedUrl);
-		if (matches.length !== 1) throw new Error(matches.length === 0 ? `platform: No installed or connected platform matches ${JSON.stringify(selector)}.` : `platform: More than one platform matches ${JSON.stringify(selector)}. Use its id or URL.`);
-		const selected = {
-			...matches[0],
-			lastUsedAt: (/* @__PURE__ */ new Date()).toISOString()
-		};
-		const connections = current.connections.map((entry) => entry.id === selected.id ? selected : entry);
-		writeJsonAtomically(join(directory, "registry.json"), {
-			activeConnectionId: selected.id,
-			connections,
-			schemaVersion: 1
-		});
-		return selected;
-	});
-}
-function installationManifestPath(accountId, installationId, directory = platformRegistryDirectory()) {
-	if (!/^[A-Za-z0-9_-]+$/.test(accountId) || !/^[a-z0-9][a-z0-9-]{7,79}$/.test(installationId)) throw new Error("platform: Invalid account or installation id.");
-	return join(directory, accountId, `${installationId}.json`);
-}
-function writeInstallationManifest(manifest, directory = platformRegistryDirectory()) {
-	const path = installationManifestPath(manifest.account.id, manifest.id, directory);
-	const parent = join(directory, manifest.account.id);
-	mkdirSync(parent, {
-		recursive: true,
-		mode: 448
-	});
-	writeJsonAtomically(path, manifest);
-}
-function listInstallationManifests(directory = platformRegistryDirectory()) {
-	const manifests = [];
-	let accountDirectories;
-	try {
-		accountDirectories = readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-	} catch (error) {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	}
-	for (const accountId of accountDirectories) {
-		const accountPath = join(directory, accountId);
-		for (const entry of readdirSync(accountPath, { withFileTypes: true })) {
-			if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-			const path = join(accountPath, entry.name);
-			try {
-				manifests.push(parsePlatformInstallationManifest(JSON.parse(readFileSync(path, "utf8"))));
-			} catch (error) {
-				throw new Error(`platform: Invalid installation manifest ${path}: ${error instanceof Error ? error.message : String(error)}`);
-			}
-		}
-	}
-	return manifests.sort((left, right) => left.deployment.displayName.localeCompare(right.deployment.displayName));
-}
-function resolveInstallationManifest(selector, directory = platformRegistryDirectory()) {
-	const manifests = listInstallationManifests(directory).filter((manifest) => manifest.status !== "uninstalled" && (!selector || manifest.id === selector || manifest.deployment.installationSlug === selector || manifest.deployment.displayName.toLowerCase() === selector.toLowerCase()));
-	if (manifests.length !== 1) throw new Error(manifests.length === 0 ? `platform: No local installation matches ${JSON.stringify(selector)}.` : "platform: Multiple local installations match; specify an installation id.");
-	return manifests[0];
-}
-function writePendingInstallationSecrets(manifest, secrets, directory = platformRegistryDirectory()) {
-	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
-	writeEncryptedRecoveryMaterial(manifest, "pending", manifestPath.replace(/\.json$/, ".secrets.enc"), secrets, directory);
-	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
-}
-function readPendingInstallationSecrets(manifest, directory = platformRegistryDirectory()) {
-	return readRecoveryMaterial(manifest, "pending", directory);
-}
-function promoteInstallationSecrets(manifest, directory = platformRegistryDirectory()) {
-	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
-	const values = readPendingInstallationSecrets(manifest, directory);
-	if (!values) throw new Error("platform: Pending installation recovery material is missing.");
-	writeEncryptedRecoveryMaterial(manifest, "recovery", manifestPath.replace(/\.json$/, ".recovery.enc"), values, directory);
-	rmSync(manifestPath.replace(/\.json$/, ".secrets.enc"), { force: true });
-	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
-	rmSync(manifestPath.replace(/\.json$/, ".recovery"), { force: true });
-}
-function readInstallationRecoverySecrets(manifest, directory = platformRegistryDirectory()) {
-	const pending = readPendingInstallationSecrets(manifest, directory);
-	if (!pending) return readRecoveryMaterial(manifest, "recovery", directory);
-	const updateState = pendingWorkerSecretUpdateState(manifest, pending.workerSecretUpdatesJson);
-	if (updateState === "stale") return readRecoveryMaterial(manifest, "recovery", directory);
-	if (updateState === "committed") return Object.fromEntries(Object.entries(pending).filter(([name]) => name !== "workerSecretUpdatesJson"));
-	return pending;
-}
-function pendingWorkerSecretUpdateState(manifest, value) {
-	if (!value) return "active";
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch {
-		return "active";
-	}
-	if (!parsed || typeof parsed !== "object" || !("schema" in parsed) || parsed.schema !== 1 || !("id" in parsed) || typeof parsed.id !== "string" || !("baselineGeneration" in parsed) || !Number.isSafeInteger(parsed.baselineGeneration) || !("generation" in parsed) || parsed.generation !== null && !Number.isSafeInteger(parsed.generation)) return "active";
-	return platformWorkerSecretUpdateIntentState(manifest, {
-		baselineGeneration: Number(parsed.baselineGeneration),
-		generation: parsed.generation === null ? null : Number(parsed.generation),
-		id: parsed.id
-	});
-}
-function platformWorkerSecretUpdateIntentState(manifest, intent) {
-	const latestGeneration = latestPlatformWorkerCutoverGeneration(manifest);
-	const latestState = manifest.steps.flatMap((step) => {
-		const match = /^worker-secret-updates:(\d+):(pending|committed)$/.exec(step.key);
-		return match ? [{
-			generation: Number(match[1]),
-			id: step.resultHash,
-			state: match[2]
-		}] : [];
-	}).sort((left, right) => right.generation - left.generation || (left.state === right.state ? 0 : left.state === "committed" ? -1 : 1))[0];
-	if (!latestState) return intent.generation === null && intent.baselineGeneration === latestGeneration ? "active" : "stale";
-	if (latestState.generation !== latestGeneration || latestState.id !== intent.id) return "stale";
-	return latestState.state === "committed" ? "committed" : "active";
-}
-function latestPlatformWorkerCutoverGeneration(manifest) {
-	return Math.max(0, ...manifest.steps.flatMap((step) => {
-		const match = /^worker-(?:cutover|secret-updates|traffic-state):(\d+)/.exec(step.key);
-		return match ? [Number(match[1])] : [];
-	}));
-}
-function removeInstallationRecoverySecrets(manifest, directory = platformRegistryDirectory()) {
-	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
-	rmSync(manifestPath.replace(/\.json$/, ".recovery.enc"), { force: true });
-	rmSync(manifestPath.replace(/\.json$/, ".secrets.enc"), { force: true });
-	rmSync(manifestPath.replace(/\.json$/, ".recovery"), { force: true });
-	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
-}
-function readRecoveryMaterial(manifest, kind, directory) {
-	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
-	const encryptedPath = manifestPath.replace(/\.json$/, `.${kind === "pending" ? "secrets" : "recovery"}.enc`);
-	try {
-		const envelope = parseRecoveryEnvelope(JSON.parse(readFileSync(encryptedPath, "utf8")));
-		const key = platformRecoveryKey(directory, false);
-		if (!key) throw new Error("the encryption key is unavailable; restore it from the system keychain or set VOID_PLATFORM_RECOVERY_KEY");
-		const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"));
-		decipher.setAAD(recoveryAad(manifest, kind));
-		decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
-		const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64")), decipher.final()]);
-		return parseRecoveryValues(JSON.parse(plaintext.toString("utf8")), `${kind} recovery material`);
-	} catch (error) {
-		if (error.code !== "ENOENT") throw new Error(`platform: Could not read encrypted ${kind} material: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	const legacyPath = manifestPath.replace(/\.json$/, kind === "pending" ? ".secrets" : ".recovery");
-	try {
-		const values = parseRecoveryValues(JSON.parse(readFileSync(legacyPath, "utf8")), `legacy ${kind} recovery material`);
-		writeEncryptedRecoveryMaterial(manifest, kind, encryptedPath, values, directory);
-		rmSync(legacyPath, { force: true });
-		return values;
-	} catch (error) {
-		if (error.code === "ENOENT") return null;
-		throw new Error(`platform: Could not migrate legacy ${kind} material: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-function writeEncryptedRecoveryMaterial(manifest, kind, path, values, directory) {
-	const key = platformRecoveryKey(directory, true);
-	const iv = randomBytes(12);
-	const cipher = createCipheriv("aes-256-gcm", key, iv);
-	cipher.setAAD(recoveryAad(manifest, kind));
-	writeJsonAtomically(path, {
-		algorithm: "aes-256-gcm",
-		ciphertext: Buffer.concat([cipher.update(JSON.stringify(parseRecoveryValues(values, `${kind} recovery material`)), "utf8"), cipher.final()]).toString("base64"),
-		iv: iv.toString("base64"),
-		schemaVersion: PLATFORM_RECOVERY_ENVELOPE_VERSION,
-		tag: cipher.getAuthTag().toString("base64")
-	});
-}
-function recoveryAad(manifest, kind) {
-	return Buffer.from(`void-platform-recovery-v1\0${manifest.account.id}\0${manifest.id}\0${manifest.ownershipNonce}\0${kind}`);
-}
-function platformRecoveryKey(directory, create) {
-	const fromEnvironment = process.env.VOID_PLATFORM_RECOVERY_KEY;
-	if (fromEnvironment) return parseRecoveryKey(fromEnvironment, "VOID_PLATFORM_RECOVERY_KEY");
-	const account = `recovery:${createHash("sha256").update(resolve(directory)).digest("hex")}`;
-	const saved = readKeyringPassword(PLATFORM_RECOVERY_KEYRING_SERVICE, account);
-	if (saved) return parseRecoveryKey(saved, "system keychain recovery key");
-	if (!create) return null;
-	const generated = randomBytes(32);
-	if (!writeKeyringPassword(PLATFORM_RECOVERY_KEYRING_SERVICE, account, generated.toString("base64"))) throw new Error("platform: The system keychain is unavailable. Refusing to write platform secrets to disk. Configure a system keychain or set a base64-encoded 32-byte VOID_PLATFORM_RECOVERY_KEY from your secret manager.");
-	return generated;
-}
-function parseRecoveryKey(value, name) {
-	const key = Buffer.from(value, "base64");
-	if (key.byteLength !== 32 || key.toString("base64") !== value) throw new Error(`platform: ${name} must be a canonical base64-encoded 32-byte key.`);
-	return key;
-}
-function parseRecoveryEnvelope(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("encrypted recovery envelope must be an object");
-	const envelope = value;
-	if (envelope.schemaVersion !== PLATFORM_RECOVERY_ENVELOPE_VERSION || envelope.algorithm !== "aes-256-gcm" || typeof envelope.ciphertext !== "string" || typeof envelope.iv !== "string" || typeof envelope.tag !== "string") throw new Error("encrypted recovery envelope is invalid");
-	if (Buffer.from(envelope.iv, "base64").byteLength !== 12) throw new Error("encrypted recovery IV is invalid");
-	if (Buffer.from(envelope.tag, "base64").byteLength !== 16) throw new Error("encrypted recovery tag is invalid");
-	return envelope;
-}
-function parseRecoveryValues(value, name) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${name} must be an object`);
-	const entries = Object.entries(value);
-	if (entries.some(([, entry]) => typeof entry !== "string")) throw new Error(`${name} values must be strings`);
-	return Object.fromEntries(entries);
-}
-function removePlatformConnectionForInstallation(installationId, directory = platformRegistryDirectory()) {
-	withRegistryLock(directory, () => {
-		const current = readRegistry(directory);
-		const connections = current.connections.filter((connection) => connection.installationId !== installationId);
-		writeJsonAtomically(join(directory, "registry.json"), {
-			activeConnectionId: current.activeConnectionId && connections.some((connection) => connection.id === current.activeConnectionId) ? current.activeConnectionId : connections[0]?.id ?? null,
-			connections,
-			schemaVersion: 1
-		});
-	});
-}
-//#endregion
-//#region src/cli/cf-access.ts
-const ACCESS_KEYRING_SERVICE = "dev.void.cli.access";
-const keyringTokens = /* @__PURE__ */ new Map();
-function usableToken(token) {
-	try {
-		const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
-		return typeof payload.exp === "number" && payload.exp > Date.now() / 1e3 + 60;
-	} catch {
-		return false;
-	}
-}
-function rememberOriginToken(origin, token) {
-	let entries = {};
-	if (process.env.VOID_ACCESS_CREDENTIALS) {
-		const parsed = JSON.parse(process.env.VOID_ACCESS_CREDENTIALS);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed JSON object.");
-		entries = parsed;
-	}
-	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
-		...entries,
-		[origin]: { CF_ACCESS_TOKEN: token }
-	});
-}
-function forgetOriginToken(origin) {
-	if (!process.env.VOID_ACCESS_CREDENTIALS) return;
-	const parsed = JSON.parse(process.env.VOID_ACCESS_CREDENTIALS);
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed JSON object.");
-	const entries = { ...parsed };
-	delete entries[origin];
-	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify(entries);
-}
-function isCloudflareAccessChallenge(response) {
-	const location = response.headers.get("Location");
-	if (!location || response.status < 300 || response.status >= 400) return false;
-	try {
-		const target = new URL(location);
-		return target.protocol === "https:" && !target.username && !target.password && /^[a-z0-9-]+\.cloudflareaccess\.com$/.test(target.hostname) && target.pathname.startsWith("/cdn-cgi/access/login");
-	} catch {
-		return false;
-	}
-}
-/** Called for a selected origin, never for a redirect destination. */
-function ensurePlatformAccessToken(apiUrl, challenged = false, required = false, rejectedToken) {
-	const origin = normalizePlatformApiUrl(apiUrl);
-	if (!origin.startsWith("https://")) return;
-	const headers = cfAccessHeaders(process.env, origin);
-	if (headers["CF-Access-Client-Id"]) return;
-	if (!challenged && headers["cf-access-token"] && usableToken(headers["cf-access-token"])) return;
-	const account = platformCredentialAccount(origin);
-	if (!keyringTokens.has(origin)) {
-		if (keyringTokens.size >= 64) keyringTokens.delete(keyringTokens.keys().next().value);
-		keyringTokens.set(origin, readKeyringPassword(ACCESS_KEYRING_SERVICE, account));
-	}
-	const stored = keyringTokens.get(origin);
-	if (!challenged && stored && usableToken(stored)) {
-		rememberOriginToken(origin, stored);
-		return;
-	}
-	if (!challenged && !required && !stored && !headers["cf-access-token"]) return;
-	const rejectedTokens = new Set([
-		headers["cf-access-token"],
-		stored,
-		rejectedToken
-	].filter((token) => typeof token === "string" && token.length > 0));
-	if (challenged && rejectedTokens.size > 0) {
-		forgetOriginToken(origin);
-		keyringTokens.set(origin, null);
-		if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error(`platform: Cloudflare Access rejected the cached credential for ${origin}. Re-run this command in an interactive terminal to renew it.`);
-		console.error(`Renew Cloudflare Access authentication for ${origin}.`);
-		runCloudflared([
-			"access",
-			"login",
-			origin
-		], {
-			inherit: true,
-			timeoutMs: 12e4
-		});
-	}
-	let token = runCloudflared([
-		"access",
-		"token",
-		`-app=${origin}`
-	]);
-	if (token && rejectedTokens.has(token)) token = null;
-	if ((!token || !usableToken(token)) && process.stdin.isTTY && process.stdout.isTTY) {
-		console.error(`Authenticate to Cloudflare Access for ${origin}.`);
-		runCloudflared([
-			"access",
-			"login",
-			origin
-		], {
-			inherit: true,
-			timeoutMs: 12e4
-		});
-		token = runCloudflared([
-			"access",
-			"token",
-			`-app=${origin}`
-		]);
-	}
-	if (!token || !usableToken(token)) throw new Error("platform: Cloudflare Access authentication is required. Install cloudflared and sign in interactively, or set VOID_ACCESS_ORIGIN with scoped CF_ACCESS_CLIENT_ID/CF_ACCESS_CLIENT_SECRET credentials for CI.");
-	rememberOriginToken(origin, token);
-	keyringTokens.set(origin, token);
-	writeKeyringPassword(ACCESS_KEYRING_SERVICE, account, token);
-}
-const probedHosts = /* @__PURE__ */ new Set();
-/**
-* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
-* probe the locally-installed `cloudflared` binary for a cached user JWT
-* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
-* token, open a browser login flow to populate the cache, then re-read it.
-*
-* Cached per-host so that an early non-gated call (e.g. prod) does not
-* permanently disable the probe for a later gated call (e.g. staging) in
-* the same process. Noop when:
-*   - a service-token pair is already set (CI path)
-*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
-*   - the target host is not gated
-*   - `cloudflared` is not installed
-*/
-function ensureCloudflaredToken(apiUrl) {
-	if (!isVoidAccessGatedUrl(apiUrl) || process.env.VOID_ACCESS_ORIGIN || process.env.VOID_ACCESS_CREDENTIALS) {
-		ensurePlatformAccessToken(apiUrl);
-		return;
-	}
-	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
-	if (process.env.CF_ACCESS_TOKEN) return;
-	if (!isVoidAccessGatedUrl(apiUrl)) return;
-	const host = new URL(apiUrl).hostname;
-	if (probedHosts.has(host)) return;
-	probedHosts.add(host);
-	let token = runCloudflared([
-		"access",
-		"token",
-		`-app=${apiUrl}`
-	]);
-	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
-		runCloudflared([
-			"access",
-			"login",
-			apiUrl
-		], {
-			inherit: true,
-			timeoutMs: 12e4
-		});
-		token = runCloudflared([
-			"access",
-			"token",
-			`-app=${apiUrl}`
-		]);
-	}
-	if (token) process.env.CF_ACCESS_TOKEN = token;
-}
-function runCloudflared(args, opts) {
-	try {
-		const result = spawnSync("cloudflared", args, {
-			encoding: "utf-8",
-			stdio: opts?.inherit ? "inherit" : [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			timeout: opts?.timeoutMs ?? 5e3
-		});
-		if (result.error || result.status !== 0) return null;
-		const out = (result.stdout ?? "").trim();
-		return out.length > 0 ? out : null;
-	} catch {
-		return null;
-	}
-}
-/** A protected API and proxy have separate audiences and separately scoped credentials. */
-function ensurePlatformProxyAccess(apiUrl, proxyUrl) {
-	ensurePlatformAccessToken(apiUrl);
-	ensurePlatformAccessToken(proxyUrl, false, Object.keys(cfAccessHeaders(process.env, apiUrl)).length > 0);
-}
-//#endregion
 //#region ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 const getCodePointsLength = (() => {
 	const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
@@ -1474,51 +795,6 @@ var n = class extends y {
 };
 //#endregion
 //#region ../../node_modules/.pnpm/@clack+prompts@1.8.0/node_modules/@clack/prompts/dist/index.mjs
-var dist_exports = /* @__PURE__ */ __exportAll({
-	MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
-	SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
-	S_BAR: () => S_BAR,
-	S_BAR_END: () => S_BAR_END,
-	S_BAR_H: () => S_BAR_H,
-	S_BAR_START: () => S_BAR_START,
-	S_CHECKBOX_ACTIVE: () => S_CHECKBOX_ACTIVE,
-	S_CHECKBOX_INACTIVE: () => S_CHECKBOX_INACTIVE,
-	S_CHECKBOX_SELECTED: () => S_CHECKBOX_SELECTED,
-	S_CONNECT_LEFT: () => S_CONNECT_LEFT,
-	S_CORNER_BOTTOM_LEFT: () => S_CORNER_BOTTOM_LEFT,
-	S_CORNER_BOTTOM_RIGHT: () => S_CORNER_BOTTOM_RIGHT,
-	S_CORNER_TOP_RIGHT: () => S_CORNER_TOP_RIGHT,
-	S_ERROR: () => S_ERROR,
-	S_INFO: () => S_INFO,
-	S_PASSWORD_MASK: () => S_PASSWORD_MASK,
-	S_RADIO_ACTIVE: () => S_RADIO_ACTIVE,
-	S_RADIO_INACTIVE: () => S_RADIO_INACTIVE,
-	S_STEP_ACTIVE: () => S_STEP_ACTIVE,
-	S_STEP_CANCEL: () => S_STEP_CANCEL,
-	S_STEP_ERROR: () => S_STEP_ERROR,
-	S_STEP_SUBMIT: () => S_STEP_SUBMIT,
-	S_SUCCESS: () => S_SUCCESS,
-	S_WARN: () => S_WARN,
-	cancel: () => cancel,
-	confirm: () => confirm,
-	formatInstructionFooter: () => formatInstructionFooter,
-	intro: () => intro,
-	isCI: () => isCI,
-	isCancel: () => isCancel,
-	limitOptions: () => limitOptions,
-	log: () => log,
-	multiselect: () => multiselect,
-	note: () => note,
-	outro: () => outro,
-	password: () => password,
-	select: () => select,
-	spinner: () => spinner,
-	symbol: () => symbol,
-	symbolBar: () => symbolBar,
-	text: () => text,
-	unicode: () => unicode,
-	unicodeOr: () => unicodeOr
-});
 function isUnicodeSupported() {
 	if (process$1.platform !== "win32") return process$1.env.TERM !== "linux";
 	return Boolean(process$1.env.CI) || Boolean(process$1.env.WT_SESSION) || Boolean(process$1.env.TERMINUS_SUBLIME) || process$1.env.ConEmuTask === "{cmd::Cmder}" || process$1.env.TERM_PROGRAM === "Terminus-Sublime" || process$1.env.TERM_PROGRAM === "vscode" || process$1.env.TERM === "xterm-256color" || process$1.env.TERM === "alacritty" || process$1.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
@@ -2031,203 +1307,4 @@ ${r ? styleText("cyan", S_BAR_END) : ""}
 	}
 }).prompt();
 //#endregion
-//#region src/cli/agents.ts
-function getPackageDir() {
-	let dir = join(fileURLToPath(import.meta.url), "..");
-	for (let i = 0; i < 5; i++) {
-		if (existsSync(join(dir, "package.json"))) {
-			if (JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")).name === "void") return dir;
-		}
-		dir = join(dir, "..");
-	}
-	throw new Error("Could not find void package root");
-}
-const agents = {
-	"claude-code": {
-		displayName: "Claude Code",
-		skillsDir: ".claude/skills",
-		detect: (root) => existsSync(join(root, ".claude")) || existsSync(join(root, "CLAUDE.md"))
-	},
-	amp: {
-		displayName: "Amp",
-		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".agents"))
-	},
-	codex: {
-		displayName: "Codex",
-		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".codex"))
-	},
-	cursor: {
-		displayName: "Cursor",
-		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".cursor"))
-	},
-	windsurf: {
-		displayName: "Windsurf",
-		skillsDir: ".windsurf/skills",
-		detect: (root) => existsSync(join(root, ".windsurf"))
-	},
-	"gemini-cli": {
-		displayName: "Gemini CLI",
-		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".gemini"))
-	},
-	"github-copilot": {
-		displayName: "GitHub Copilot",
-		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".github", "copilot-instructions.md"))
-	},
-	cline: {
-		displayName: "Cline",
-		skillsDir: ".cline/skills",
-		detect: (root) => existsSync(join(root, ".cline"))
-	},
-	roo: {
-		displayName: "Roo Code",
-		skillsDir: ".roo/skills",
-		detect: (root) => existsSync(join(root, ".roo"))
-	},
-	kilo: {
-		displayName: "Kilo Code",
-		skillsDir: ".kilocode/skills",
-		detect: (root) => existsSync(join(root, ".kilocode"))
-	},
-	continue: {
-		displayName: "Continue",
-		skillsDir: ".continue/skills",
-		detect: (root) => existsSync(join(root, ".continue"))
-	},
-	goose: {
-		displayName: "Goose",
-		skillsDir: ".goose/skills",
-		detect: (root) => existsSync(join(root, ".goose"))
-	},
-	opencode: {
-		displayName: "OpenCode",
-		skillsDir: ".agents/skills",
-		detect: (root) => existsSync(join(root, ".opencode"))
-	},
-	trae: {
-		displayName: "Trae",
-		skillsDir: ".trae/skills",
-		detect: (root) => existsSync(join(root, ".trae"))
-	},
-	junie: {
-		displayName: "Junie",
-		skillsDir: ".junie/skills",
-		detect: (root) => existsSync(join(root, ".junie"))
-	},
-	"kiro-cli": {
-		displayName: "Kiro CLI",
-		skillsDir: ".kiro/skills",
-		detect: (root) => existsSync(join(root, ".kiro"))
-	},
-	zencoder: {
-		displayName: "Zencoder",
-		skillsDir: ".zencoder/skills",
-		detect: (root) => existsSync(join(root, ".zencoder"))
-	},
-	"qwen-code": {
-		displayName: "Qwen Code",
-		skillsDir: ".qwen/skills",
-		detect: (root) => existsSync(join(root, ".qwen"))
-	}
-};
-function detectAgents(root) {
-	return Object.values(agents).filter((a) => a.detect(root));
-}
-//#endregion
-//#region src/cli/cloudflare-user-output.ts
-/**
-* Keep Void's public CLI vocabulary at the product level while preserving real
-* Cloudflare config filenames and environment variables that users may need to
-* inspect. The underlying implementation remains available in source and deploy
-* diagnostics, but normal remediation always points back to Void commands.
-*/
-function formatCloudflareUserMessage(message) {
-	const preserved = [];
-	const protect = (value) => {
-		return `\uE000VOID_CF_TERM_${preserved.push(value) - 1}\uE001`;
-	};
-	let result = message.replace(/(?:[A-Za-z]:)?[^\s`"']*wrangler\.jsonc?/gi, protect).replace(/\bWRANGLER_[A-Z0-9_]+\b/g, protect).replace(/\.wrangler\b/gi, protect).replace(/`wrangler deploy`/gi, "`void deploy --platform cloudflare`").replace(/`wrangler secret list[^`]*`/gi, "`void secret list`").replace(/`wrangler secret put\s+([^`]*)`/gi, "`void secret put $1`").replace(/`wrangler d1 migrations apply[^`]*`/gi, "`void db migrate --remote`").replace(/`wrangler d1 migrations list[^`]*`/gi, "`void db status`").replace(/`wrangler[^`]*`/gi, "the underlying Cloudflare operation").replace(/"wrangler[^"\n]*"/gi, "\"Cloudflare operation\"").replace(/\bwrangler uploader\b/gi, "Cloudflare deployment tool").replace(/\bwrangler (?:CLI|binary|process|child)\b/gi, "Cloudflare deployment tool").replace(/\bwrangler config\b/gi, "Cloudflare config").replace(/\bwrangler\b/gi, "Cloudflare tooling");
-	result = result.replace(/\uE000VOID_CF_TERM_(\d+)\uE001/g, (_match, index) => {
-		return preserved[Number(index)] ?? "";
-	});
-	return result;
-}
-//#endregion
-//#region src/cli/output.ts
-var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
-/** Keep recovery commands on the same CLI when using the local checkout launcher. */
-function cliCommandName() {
-	const entryName = process.argv[1]?.split(/[\\/]/).at(-1);
-	return entryName === "void-dev" || entryName === "void-dev.cmd" ? "void-dev" : "void";
-}
-/**
-* CI-safe spinner wrapper. In CI environments (GitHub Actions, etc.),
-* `@clack/prompts` spinner emits DEC Private Mode cursor hide/show codes
-* (`\x1b[?25l` / `\x1b[?25h`) that render as text artifacts. This wrapper
-* replaces the spinner with plain log output in CI.
-*/
-function createSpinner(options) {
-	if (!isCI()) return spinner(options);
-	let currentMessage = "";
-	return {
-		start(msg = "") {
-			currentMessage = msg;
-			if (msg) log.step(msg);
-		},
-		stop(msg = "") {
-			if (msg) log.info(msg);
-		},
-		message(msg = "") {
-			if (msg && msg !== currentMessage) {
-				currentMessage = msg;
-				log.step(msg);
-			}
-		},
-		cancel(msg = "") {
-			if (msg) log.warn(msg);
-		},
-		error(msg = "") {
-			if (msg) log.error(msg);
-		},
-		clear() {},
-		get isCancelled() {
-			return false;
-		}
-	};
-}
-function cliTitle(command) {
-	return import_picocolors.default.blue(`void ${command}`);
-}
-function sectionTitle(title) {
-	return import_picocolors.default.reset(import_picocolors.default.blue(title));
-}
-function categoryTitle(title) {
-	return import_picocolors.default.reset(import_picocolors.default.bold(import_picocolors.default.cyan(title)));
-}
-function dim(text) {
-	return import_picocolors.default.dim(text);
-}
-function tablePrefix() {
-	return `${import_picocolors.default.gray("│")}  `;
-}
-function helpLine(command, description) {
-	return `${import_picocolors.default.reset(command.padEnd(34))} ${import_picocolors.default.dim(description)}`;
-}
-/**
-* Ensure a timestamp string will be parsed as UTC by `new Date()`.
-* DB timestamps lack timezone info — appends 'Z' only when no
-* existing indicator (Z, z, or numeric offset) is present.
-*/
-function ensureUtc(s) {
-	const last = s.at(-1);
-	if (last === "Z" || last === "z") return s;
-	if (s.includes("+", 10)) return s;
-	if (s.lastIndexOf("-") > 9) return s;
-	return s + "Z";
-}
-//#endregion
-export { promoteInstallationSecrets as $, outro as A, ensureCloudflaredToken as B, cancel as C, log as D, intro as E, CANCEL_SYMBOL as F, assertPlatformInstallationSlugAvailable as G, ensurePlatformProxyAccess as H, isCancel as I, listInstallationManifests as J, getActivePlatformConnection as K, settings as L, select as M, symbol as N, multiselect as O, text as P, platformWorkerSecretUpdateIntentState as Q, u$1 as R, S_STEP_SUBMIT as S, dist_exports as T, isCloudflareAccessChallenge as U, ensurePlatformAccessToken as V, acquirePlatformLifecycleLock as W, normalizePlatformApiUrl as X, listPlatformConnections as Y, platformCredentialAccount as Z, S_CHECKBOX_INACTIVE as _, dim as a, savePlatformConnection as at, S_RADIO_INACTIVE as b, import_picocolors as c, writePendingInstallationSecrets as ct, formatCloudflareUserMessage as d, writeKeyringPassword as dt, readInstallationRecoverySecrets as et, detectAgents as f, require_picocolors as ft, S_CHECKBOX_ACTIVE as g, S_BAR_END as h, createSpinner as i, resolveInstallationManifest as it, password as j, note as k, sectionTitle as l, deleteKeyringPassword as lt, S_BAR as m, cliCommandName as n, removeInstallationRecoverySecrets as nt, ensureUtc as o, selectPlatformConnection as ot, getPackageDir as p, latestPlatformWorkerCutoverGeneration as q, cliTitle as r, removePlatformConnectionForInstallation as rt, helpLine as s, writeInstallationManifest as st, categoryTitle as t, readPendingInstallationSecrets as tt, tablePrefix as u, readKeyringPassword as ut, S_PASSWORD_MASK as v, confirm as w, S_STEP_ACTIVE as x, S_RADIO_ACTIVE as y, wrapAnsi as z };
+export { limitOptions as A, text as B, S_SUCCESS as C, formatInstructionFooter as D, confirm as E, password as F, settings as G, unicodeOr as H, select as I, u$1 as K, spinner as L, multiselect as M, note as N, intro as O, outro as P, symbol as R, S_STEP_SUBMIT as S, cancel as T, CANCEL_SYMBOL as U, unicode as V, isCancel as W, S_RADIO_ACTIVE as _, S_BAR_H as a, S_STEP_CANCEL as b, S_CHECKBOX_INACTIVE as c, S_CORNER_BOTTOM_LEFT as d, S_CORNER_BOTTOM_RIGHT as f, S_PASSWORD_MASK as g, S_INFO as h, S_BAR_END as i, log as j, isCI as k, S_CHECKBOX_SELECTED as l, S_ERROR as m, SELECT_INSTRUCTIONS as n, S_BAR_START as o, S_CORNER_TOP_RIGHT as p, wrapAnsi as q, S_BAR as r, S_CHECKBOX_ACTIVE as s, MULTISELECT_INSTRUCTIONS as t, S_CONNECT_LEFT as u, S_RADIO_INACTIVE as v, S_WARN as w, S_STEP_ERROR as x, S_STEP_ACTIVE as y, symbolBar as z };