void 0.20.2 → 0.21.0

package/dist/platform-lifecycle-CuJIZNvA.mjs

@@ -0,0 +1,2 @@
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-BquAaU-5.mjs";
+export { runPlatformLifecycleCommand };

package/dist/{platform-management-COogu_Se.mjs → platform-management-CCQKGsq4.mjs}

@@ -1,5 +1,7 @@
-import { A as outro, D as log, I as isCancel, J as listInstallationManifests, M as select, W as acquirePlatformLifecycleLock, et as readInstallationRecoverySecrets, i as createSpinner, it as resolveInstallationManifest, k as note, nt as removeInstallationRecoverySecrets, rt as removePlatformConnectionForInstallation, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
-import { C as PlatformCloudflareClient, D as verifyPlatformRuntimeTokenPermissions, E as hyperdriveOriginMatches, T as hyperdriveOriginFromConnectionString, _ as revalidatePlatformInstallAction, a as createPlatformInstallationSecrets, assertNoninteractivePlatformMutationAcknowledged, f as trackedPlatformWorkerTraffic, g as platformProvisionIntentHash, h as platformAdoptionIntentHash, m as formatPlatformInstallPlan, n as acquirePlatformDatabaseLifecycleLock, o as installPlatform, p as createPlatformInstallPlan, resolvePlatformInstallDatabaseUrl, s as loadPlatformRuntime, t as REMOTE_INSTALLATION_MANIFEST_KEY, u as resolveBootstrapGitHubId, v as assertPlatformOperatorCredentialCanApplyPlan, w as hyperdriveOriginConfigHash, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BwAIgz-t.mjs";
+import { i as createSpinner } from "./output-urU86XeT.mjs";
+import { a as listInstallationManifests, d as readInstallationRecoverySecrets, h as resolveInstallationManifest, m as removePlatformConnectionForInstallation, p as removeInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-BJbgZLS1.mjs";
+import { E as confirm, I as select, N as note, P as outro, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { A as hyperdriveOriginFromConnectionString, C as assertPlatformOperatorCredentialCanApplyPlan, M as verifyPlatformRuntimeTokenPermissions, O as PlatformCloudflareClient, S as platformDatabaseNameFromOwnerUrl, _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as platformProvisionIntentHash, d as loadPlatformRuntime, g as trackedPlatformWorkerTraffic, j as hyperdriveOriginMatches, k as hyperdriveOriginConfigHash, l as createPlatformInstallationSecrets, m as resolveBootstrapGitHubId, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as installPlatform, v as formatPlatformInstallPlan, w as resolvePlatformCloudflareCredential, x as revalidatePlatformInstallAction, y as platformAdoptionIntentHash } from "./platform-lifecycle-BquAaU-5.mjs";
 import { createHash } from "node:crypto";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 //#region src/cli/platform-management.ts
@@ -72,7 +74,8 @@ async function runInstalledPlatformCommand(args) {
 			authoritativeProvisionIntents: databaseCheckpointExists,
 			repairMissing: args.subcommand === "repair",
 			allowUnverifiedAiGateway: args.plan,
-			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 		});
 		note(formatPlatformInstallPlan(plan), args.subcommand === "upgrade" ? "Upgrade plan" : args.subcommand === "rollback" ? "Rollback plan" : args.subcommand === "enable" ? "Enable plan" : "Repair plan");
 		note([
@@ -144,7 +147,8 @@ async function runInstalledPlatformCommand(args) {
 			replanWorkers: async (recoveryManifest) => (await createPlatformInstallPlan(client, planInput, recoveryManifest, {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
-				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action, { repairMissing: args.subcommand === "repair" })
 		});
@@ -556,12 +560,13 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 						name: resource.name
 					})).digest("hex");
 					const malformedLegacyHash = !/^[a-f0-9]{64}$/.test(resource.configHash);
-					if (options.databaseUrl) {
+					if (options.databaseUrl && resource.ownership !== "adopted") {
 						const expected = hyperdriveOriginFromConnectionString(options.databaseUrl);
 						if (!hyperdriveOriginMatches(live.origin, expected)) throw ownershipError(`hyperdrive ${resource.name} targets a different PostgreSQL origin than this installation's pinned database`);
 						const expectedHash = hyperdriveOriginConfigHash(expected);
 						if (resource.configHash !== expectedHash && resource.configHash !== legacyHash && !malformedLegacyHash) throw ownershipError(`hyperdrive ${resource.name} does not match the installation's database fingerprint`);
-					} else if (resource.configHash !== hyperdriveOriginConfigHash(live.origin) && resource.configHash !== legacyHash && !malformedLegacyHash) throw ownershipError(`hyperdrive ${resource.name} changed configuration`);
+					} else if (resource.ownership === "adopted" && (resource.configHash !== hyperdriveOriginConfigHash(live.origin) || options.databaseUrl && live.origin.database !== platformDatabaseNameFromOwnerUrl(options.databaseUrl))) throw ownershipError(`hyperdrive ${resource.name} changed configuration`);
+					else if (resource.ownership !== "adopted" && resource.configHash !== hyperdriveOriginConfigHash(live.origin) && resource.configHash !== legacyHash && !malformedLegacyHash) throw ownershipError(`hyperdrive ${resource.name} changed configuration`);
 				}
 			}
 		} else if (resource.kind === "kv-namespace") exists = hasNamedResource(kvNamespaces, resource);
@@ -721,4 +726,4 @@ async function promptForConfirmation(message, initialValue) {
 	return answer;
 }
 //#endregion
-export { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, resolveInstalledPlatformManifest, runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };
+export { resolveInstalledPlatformManifest as a, selectAuthoritativePlatformManifest as c, recoverDurablyMarkedProvisionIntents as i, uninstallPlatform as l, disablePlatform as n, resolvePlatformRuntimeTokenToPreflight as o, isPlatformManifestMonotonicExtension as r, runInstalledPlatformCommand as s, assertPlatformRollbackCompatibility as t, verifyPlatformInstallationOwnership as u };

package/dist/platform-management-Cgyed0WY.mjs

@@ -0,0 +1,2 @@
+import { c as selectAuthoritativePlatformManifest, s as runInstalledPlatformCommand, u as verifyPlatformInstallationOwnership } from "./platform-management-CCQKGsq4.mjs";
+export { runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };

package/dist/{platform-recovery-ewqLefp1.mjs → platform-recovery-DS8ih1SW.mjs}

@@ -1,7 +1,7 @@
-import { J as listInstallationManifests, W as acquirePlatformLifecycleLock, at as savePlatformConnection, st as writeInstallationManifest } from "./output-B0cfNSx5.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { p as createPlatformInstallPlan, t as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-BwAIgz-t.mjs";
-import { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, verifyPlatformInstallationOwnership } from "./platform-management-COogu_Se.mjs";
+import { a as listInstallationManifests, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-BJbgZLS1.mjs";
+import { _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-BquAaU-5.mjs";
+import { i as recoverDurablyMarkedProvisionIntents, r as isPlatformManifestMonotonicExtension, u as verifyPlatformInstallationOwnership } from "./platform-management-CCQKGsq4.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/platform-registry-BJbgZLS1.mjs

@@ -0,0 +1,431 @@
+import { a as join, u as resolve } from "./dist-4WkAWhWx.mjs";
+import { closeSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { homedir, hostname } from "node:os";
+import { Entry } from "@napi-rs/keyring";
+import { parsePlatformInstallationManifest } from "@void/platform";
+//#region src/cli/keyring.ts
+function readKeyringPassword(service, account) {
+	try {
+		return new Entry(service, account).getPassword();
+	} catch {
+		return null;
+	}
+}
+function writeKeyringPassword(service, account, password) {
+	try {
+		new Entry(service, account).setPassword(password);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function deleteKeyringPassword(service, account) {
+	try {
+		new Entry(service, account).deletePassword();
+		return true;
+	} catch {
+		return false;
+	}
+}
+const DEFAULT_REGISTRY = {
+	activeConnectionId: null,
+	connections: [],
+	schemaVersion: 1
+};
+const PLATFORM_RECOVERY_KEYRING_SERVICE = "dev.void.cli.platform";
+const PLATFORM_RECOVERY_ENVELOPE_VERSION = 1;
+function platformRegistryDirectory() {
+	return process.env.VOID_PLATFORM_REGISTRY_DIR ?? join(homedir(), ".void", "platforms");
+}
+function normalizePlatformApiUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`platform: Invalid platform URL ${JSON.stringify(value)}.`);
+	}
+	if (!(url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1")) && url.protocol !== "https:" || url.username || url.password) throw new Error("platform: Platform URLs must use HTTPS and must not contain credentials.");
+	if (url.search || url.hash) throw new Error("platform: Platform URLs must not contain query parameters or fragments.");
+	if (url.pathname !== "/" && url.pathname !== "") throw new Error("platform: Platform URLs must not contain a path.");
+	return url.origin;
+}
+function platformConnectionId(apiUrl) {
+	return createHash("sha256").update(normalizePlatformApiUrl(apiUrl)).digest("hex").slice(0, 20);
+}
+function platformCredentialAccount(apiUrl) {
+	return `platform:${createHash("sha256").update(normalizePlatformApiUrl(apiUrl)).digest("hex")}`;
+}
+function parseConnection(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Invalid connection entry in the local registry.");
+	const entry = value;
+	const apiUrl = normalizePlatformApiUrl(String(entry.apiUrl ?? ""));
+	const id = String(entry.id ?? "");
+	if (id !== platformConnectionId(apiUrl)) throw new Error("platform: Connection id does not match its API URL.");
+	if (entry.kind !== "connected" && entry.kind !== "installed") throw new Error("platform: Invalid connection kind in the local registry.");
+	const lastUsedAt = String(entry.lastUsedAt ?? "");
+	if (!Number.isFinite(Date.parse(lastUsedAt))) throw new Error("platform: Invalid connection timestamp in the local registry.");
+	const optionalString = (input) => typeof input === "string" && input !== "" ? input : null;
+	const proxyUrl = optionalString(entry.proxyUrl) ?? (apiUrl === "https://api.void.cloud" ? "https://proxy.void.cloud" : apiUrl === "https://api.staging.void.cloud" ? "https://proxy.staging.void.cloud" : null);
+	return {
+		accountId: optionalString(entry.accountId),
+		apiUrl,
+		applicationDomain: optionalString(entry.applicationDomain),
+		displayName: typeof entry.displayName === "string" && entry.displayName.trim() ? entry.displayName.trim() : new URL(apiUrl).hostname,
+		id,
+		installationId: optionalString(entry.installationId),
+		kind: entry.kind,
+		lastUsedAt,
+		proxyUrl: proxyUrl === null ? null : normalizePlatformApiUrl(proxyUrl)
+	};
+}
+function readRegistry(directory) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(directory, "registry.json"), "utf8"));
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("registry must be an object");
+		const value = parsed;
+		if (value.schemaVersion !== 1 || !Array.isArray(value.connections)) throw new Error("unsupported schema");
+		const connections = value.connections.map(parseConnection);
+		return {
+			activeConnectionId: typeof value.activeConnectionId === "string" && connections.some((connection) => connection.id === value.activeConnectionId) ? value.activeConnectionId : null,
+			connections,
+			schemaVersion: 1
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") return DEFAULT_REGISTRY;
+		throw new Error(`platform: Could not read ${join(directory, "registry.json")}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function withRegistryLock(directory, operation) {
+	mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const lockPath = join(directory, ".registry.lock");
+	let descriptor;
+	try {
+		descriptor = openSync(lockPath, "wx", 384);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		if (Date.now() - statSync(lockPath).mtimeMs < 6e5) throw new Error("platform: Another process is updating the platform registry.");
+		rmSync(lockPath, { force: true });
+		descriptor = openSync(lockPath, "wx", 384);
+	}
+	try {
+		return operation();
+	} finally {
+		closeSync(descriptor);
+		rmSync(lockPath, { force: true });
+	}
+}
+function writeJsonAtomically(path, value) {
+	const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	try {
+		writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+}
+function acquirePlatformLifecycleLock(accountId, installationSlug, directory = platformRegistryDirectory()) {
+	if (!/^[A-Za-z0-9_-]+$/.test(accountId) || !/^[a-z0-9][a-z0-9-]{0,79}$/.test(installationSlug)) throw new Error("platform: Invalid lifecycle lock identity.");
+	const lockDirectory = join(directory, "locks");
+	mkdirSync(lockDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	const lockPath = join(lockDirectory, `${accountId}-${installationSlug}.lock`);
+	const acquire = () => {
+		try {
+			const descriptor = openSync(lockPath, "wx", 384);
+			writeFileSync(descriptor, `${JSON.stringify({
+				host: hostname(),
+				pid: process.pid,
+				startedAt: (/* @__PURE__ */ new Date()).toISOString()
+			})}\n`);
+			return descriptor;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			let stale = false;
+			try {
+				const owner = JSON.parse(readFileSync(lockPath, "utf8"));
+				if (owner.host === hostname() && typeof owner.pid === "number") try {
+					process.kill(owner.pid, 0);
+				} catch (ownerError) {
+					stale = ownerError.code === "ESRCH";
+				}
+				else {
+					const startedAt = typeof owner.startedAt === "string" ? Date.parse(owner.startedAt) : NaN;
+					stale = Number.isFinite(startedAt) && Date.now() - startedAt > 72e5;
+				}
+			} catch {
+				stale = Date.now() - statSync(lockPath).mtimeMs > 72e5;
+			}
+			if (!stale) throw new Error(`platform: Another lifecycle operation is active for ${installationSlug} in account ${accountId}.`);
+			rmSync(lockPath, { force: true });
+			return acquire();
+		}
+	};
+	const descriptor = acquire();
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		closeSync(descriptor);
+		rmSync(lockPath, { force: true });
+	};
+}
+function listPlatformConnections(directory = platformRegistryDirectory()) {
+	return readRegistry(directory).connections;
+}
+function assertPlatformInstallationSlugAvailable(installationSlug, directory = platformRegistryDirectory()) {
+	const collision = listInstallationManifests(directory).find((manifest) => manifest.status !== "uninstalled" && manifest.deployment.installationSlug === installationSlug);
+	if (collision) throw new Error(`platform: Installation ${collision.id} already uses this name. Resume it with \`void platform install --resume --name ${collision.id}\`.`);
+}
+function getActivePlatformConnection(directory = platformRegistryDirectory()) {
+	const registry = readRegistry(directory);
+	return registry.connections.find((connection) => connection.id === registry.activeConnectionId) ?? (registry.connections.length === 1 ? registry.connections[0] : null);
+}
+function savePlatformConnection(input, directory = platformRegistryDirectory()) {
+	const apiUrl = normalizePlatformApiUrl(input.apiUrl);
+	const id = platformConnectionId(apiUrl);
+	const lastUsedAt = input.lastUsedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+	const connection = parseConnection({
+		...input,
+		apiUrl,
+		id,
+		lastUsedAt
+	});
+	return withRegistryLock(directory, () => {
+		const connections = readRegistry(directory).connections.filter((entry) => entry.id !== id);
+		connections.push(connection);
+		connections.sort((left, right) => left.displayName.localeCompare(right.displayName));
+		writeJsonAtomically(join(directory, "registry.json"), {
+			activeConnectionId: id,
+			connections,
+			schemaVersion: 1
+		});
+		return connection;
+	});
+}
+function selectPlatformConnection(selector, directory = platformRegistryDirectory()) {
+	return withRegistryLock(directory, () => {
+		const current = readRegistry(directory);
+		const normalizedUrl = (() => {
+			try {
+				return normalizePlatformApiUrl(selector);
+			} catch {
+				return null;
+			}
+		})();
+		const matches = current.connections.filter((entry) => entry.id === selector || entry.installationId === selector || entry.displayName.toLowerCase() === selector.toLowerCase() || normalizedUrl !== null && entry.apiUrl === normalizedUrl);
+		if (matches.length !== 1) throw new Error(matches.length === 0 ? `platform: No installed or connected platform matches ${JSON.stringify(selector)}.` : `platform: More than one platform matches ${JSON.stringify(selector)}. Use its id or URL.`);
+		const selected = {
+			...matches[0],
+			lastUsedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const connections = current.connections.map((entry) => entry.id === selected.id ? selected : entry);
+		writeJsonAtomically(join(directory, "registry.json"), {
+			activeConnectionId: selected.id,
+			connections,
+			schemaVersion: 1
+		});
+		return selected;
+	});
+}
+function installationManifestPath(accountId, installationId, directory = platformRegistryDirectory()) {
+	if (!/^[A-Za-z0-9_-]+$/.test(accountId) || !/^[a-z0-9][a-z0-9-]{7,79}$/.test(installationId)) throw new Error("platform: Invalid account or installation id.");
+	return join(directory, accountId, `${installationId}.json`);
+}
+function writeInstallationManifest(manifest, directory = platformRegistryDirectory()) {
+	const path = installationManifestPath(manifest.account.id, manifest.id, directory);
+	const parent = join(directory, manifest.account.id);
+	mkdirSync(parent, {
+		recursive: true,
+		mode: 448
+	});
+	writeJsonAtomically(path, manifest);
+}
+function listInstallationManifests(directory = platformRegistryDirectory()) {
+	const manifests = [];
+	let accountDirectories;
+	try {
+		accountDirectories = readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	for (const accountId of accountDirectories) {
+		const accountPath = join(directory, accountId);
+		for (const entry of readdirSync(accountPath, { withFileTypes: true })) {
+			if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+			const path = join(accountPath, entry.name);
+			try {
+				manifests.push(parsePlatformInstallationManifest(JSON.parse(readFileSync(path, "utf8"))));
+			} catch (error) {
+				throw new Error(`platform: Invalid installation manifest ${path}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+	}
+	return manifests.sort((left, right) => left.deployment.displayName.localeCompare(right.deployment.displayName));
+}
+function resolveInstallationManifest(selector, directory = platformRegistryDirectory()) {
+	const manifests = listInstallationManifests(directory).filter((manifest) => manifest.status !== "uninstalled" && (!selector || manifest.id === selector || manifest.deployment.installationSlug === selector || manifest.deployment.displayName.toLowerCase() === selector.toLowerCase()));
+	if (manifests.length !== 1) throw new Error(manifests.length === 0 ? `platform: No local installation matches ${JSON.stringify(selector)}.` : "platform: Multiple local installations match; specify an installation id.");
+	return manifests[0];
+}
+function writePendingInstallationSecrets(manifest, secrets, directory = platformRegistryDirectory()) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	writeEncryptedRecoveryMaterial(manifest, "pending", manifestPath.replace(/\.json$/, ".secrets.enc"), secrets, directory);
+	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
+}
+function readPendingInstallationSecrets(manifest, directory = platformRegistryDirectory()) {
+	return readRecoveryMaterial(manifest, "pending", directory);
+}
+function promoteInstallationSecrets(manifest, directory = platformRegistryDirectory()) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	const values = readPendingInstallationSecrets(manifest, directory);
+	if (!values) throw new Error("platform: Pending installation recovery material is missing.");
+	writeEncryptedRecoveryMaterial(manifest, "recovery", manifestPath.replace(/\.json$/, ".recovery.enc"), values, directory);
+	rmSync(manifestPath.replace(/\.json$/, ".secrets.enc"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".recovery"), { force: true });
+}
+function readInstallationRecoverySecrets(manifest, directory = platformRegistryDirectory()) {
+	const pending = readPendingInstallationSecrets(manifest, directory);
+	if (!pending) return readRecoveryMaterial(manifest, "recovery", directory);
+	const updateState = pendingWorkerSecretUpdateState(manifest, pending.workerSecretUpdatesJson);
+	if (updateState === "stale") return readRecoveryMaterial(manifest, "recovery", directory);
+	if (updateState === "committed") return Object.fromEntries(Object.entries(pending).filter(([name]) => name !== "workerSecretUpdatesJson"));
+	return pending;
+}
+function pendingWorkerSecretUpdateState(manifest, value) {
+	if (!value) return "active";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return "active";
+	}
+	if (!parsed || typeof parsed !== "object" || !("schema" in parsed) || parsed.schema !== 1 || !("id" in parsed) || typeof parsed.id !== "string" || !("baselineGeneration" in parsed) || !Number.isSafeInteger(parsed.baselineGeneration) || !("generation" in parsed) || parsed.generation !== null && !Number.isSafeInteger(parsed.generation)) return "active";
+	return platformWorkerSecretUpdateIntentState(manifest, {
+		baselineGeneration: Number(parsed.baselineGeneration),
+		generation: parsed.generation === null ? null : Number(parsed.generation),
+		id: parsed.id
+	});
+}
+function platformWorkerSecretUpdateIntentState(manifest, intent) {
+	const latestGeneration = latestPlatformWorkerCutoverGeneration(manifest);
+	const latestState = manifest.steps.flatMap((step) => {
+		const match = /^worker-secret-updates:(\d+):(pending|committed)$/.exec(step.key);
+		return match ? [{
+			generation: Number(match[1]),
+			id: step.resultHash,
+			state: match[2]
+		}] : [];
+	}).sort((left, right) => right.generation - left.generation || (left.state === right.state ? 0 : left.state === "committed" ? -1 : 1))[0];
+	if (!latestState) return intent.generation === null && intent.baselineGeneration === latestGeneration ? "active" : "stale";
+	if (latestState.generation !== latestGeneration || latestState.id !== intent.id) return "stale";
+	return latestState.state === "committed" ? "committed" : "active";
+}
+function latestPlatformWorkerCutoverGeneration(manifest) {
+	return Math.max(0, ...manifest.steps.flatMap((step) => {
+		const match = /^worker-(?:cutover|secret-updates|traffic-state):(\d+)/.exec(step.key);
+		return match ? [Number(match[1])] : [];
+	}));
+}
+function removeInstallationRecoverySecrets(manifest, directory = platformRegistryDirectory()) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	rmSync(manifestPath.replace(/\.json$/, ".recovery.enc"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".secrets.enc"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".recovery"), { force: true });
+	rmSync(manifestPath.replace(/\.json$/, ".secrets"), { force: true });
+}
+function readRecoveryMaterial(manifest, kind, directory) {
+	const manifestPath = installationManifestPath(manifest.account.id, manifest.id, directory);
+	const encryptedPath = manifestPath.replace(/\.json$/, `.${kind === "pending" ? "secrets" : "recovery"}.enc`);
+	try {
+		const envelope = parseRecoveryEnvelope(JSON.parse(readFileSync(encryptedPath, "utf8")));
+		const key = platformRecoveryKey(directory, false);
+		if (!key) throw new Error("the encryption key is unavailable; restore it from the system keychain or set VOID_PLATFORM_RECOVERY_KEY");
+		const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"));
+		decipher.setAAD(recoveryAad(manifest, kind));
+		decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+		const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64")), decipher.final()]);
+		return parseRecoveryValues(JSON.parse(plaintext.toString("utf8")), `${kind} recovery material`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw new Error(`platform: Could not read encrypted ${kind} material: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const legacyPath = manifestPath.replace(/\.json$/, kind === "pending" ? ".secrets" : ".recovery");
+	try {
+		const values = parseRecoveryValues(JSON.parse(readFileSync(legacyPath, "utf8")), `legacy ${kind} recovery material`);
+		writeEncryptedRecoveryMaterial(manifest, kind, encryptedPath, values, directory);
+		rmSync(legacyPath, { force: true });
+		return values;
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw new Error(`platform: Could not migrate legacy ${kind} material: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function writeEncryptedRecoveryMaterial(manifest, kind, path, values, directory) {
+	const key = platformRecoveryKey(directory, true);
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	cipher.setAAD(recoveryAad(manifest, kind));
+	writeJsonAtomically(path, {
+		algorithm: "aes-256-gcm",
+		ciphertext: Buffer.concat([cipher.update(JSON.stringify(parseRecoveryValues(values, `${kind} recovery material`)), "utf8"), cipher.final()]).toString("base64"),
+		iv: iv.toString("base64"),
+		schemaVersion: PLATFORM_RECOVERY_ENVELOPE_VERSION,
+		tag: cipher.getAuthTag().toString("base64")
+	});
+}
+function recoveryAad(manifest, kind) {
+	return Buffer.from(`void-platform-recovery-v1\0${manifest.account.id}\0${manifest.id}\0${manifest.ownershipNonce}\0${kind}`);
+}
+function platformRecoveryKey(directory, create) {
+	const fromEnvironment = process.env.VOID_PLATFORM_RECOVERY_KEY;
+	if (fromEnvironment) return parseRecoveryKey(fromEnvironment, "VOID_PLATFORM_RECOVERY_KEY");
+	const account = `recovery:${createHash("sha256").update(resolve(directory)).digest("hex")}`;
+	const saved = readKeyringPassword(PLATFORM_RECOVERY_KEYRING_SERVICE, account);
+	if (saved) return parseRecoveryKey(saved, "system keychain recovery key");
+	if (!create) return null;
+	const generated = randomBytes(32);
+	if (!writeKeyringPassword(PLATFORM_RECOVERY_KEYRING_SERVICE, account, generated.toString("base64"))) throw new Error("platform: The system keychain is unavailable. Refusing to write platform secrets to disk. Configure a system keychain or set a base64-encoded 32-byte VOID_PLATFORM_RECOVERY_KEY from your secret manager.");
+	return generated;
+}
+function parseRecoveryKey(value, name) {
+	const key = Buffer.from(value, "base64");
+	if (key.byteLength !== 32 || key.toString("base64") !== value) throw new Error(`platform: ${name} must be a canonical base64-encoded 32-byte key.`);
+	return key;
+}
+function parseRecoveryEnvelope(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("encrypted recovery envelope must be an object");
+	const envelope = value;
+	if (envelope.schemaVersion !== PLATFORM_RECOVERY_ENVELOPE_VERSION || envelope.algorithm !== "aes-256-gcm" || typeof envelope.ciphertext !== "string" || typeof envelope.iv !== "string" || typeof envelope.tag !== "string") throw new Error("encrypted recovery envelope is invalid");
+	if (Buffer.from(envelope.iv, "base64").byteLength !== 12) throw new Error("encrypted recovery IV is invalid");
+	if (Buffer.from(envelope.tag, "base64").byteLength !== 16) throw new Error("encrypted recovery tag is invalid");
+	return envelope;
+}
+function parseRecoveryValues(value, name) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${name} must be an object`);
+	const entries = Object.entries(value);
+	if (entries.some(([, entry]) => typeof entry !== "string")) throw new Error(`${name} values must be strings`);
+	return Object.fromEntries(entries);
+}
+function removePlatformConnectionForInstallation(installationId, directory = platformRegistryDirectory()) {
+	withRegistryLock(directory, () => {
+		const current = readRegistry(directory);
+		const connections = current.connections.filter((connection) => connection.installationId !== installationId);
+		writeJsonAtomically(join(directory, "registry.json"), {
+			activeConnectionId: current.activeConnectionId && connections.some((connection) => connection.id === current.activeConnectionId) ? current.activeConnectionId : connections[0]?.id ?? null,
+			connections,
+			schemaVersion: 1
+		});
+	});
+}
+//#endregion
+export { writeKeyringPassword as S, selectPlatformConnection as _, listInstallationManifests as a, deleteKeyringPassword as b, platformCredentialAccount as c, readInstallationRecoverySecrets as d, readPendingInstallationSecrets as f, savePlatformConnection as g, resolveInstallationManifest as h, latestPlatformWorkerCutoverGeneration as i, platformWorkerSecretUpdateIntentState as l, removePlatformConnectionForInstallation as m, assertPlatformInstallationSlugAvailable as n, listPlatformConnections as o, removeInstallationRecoverySecrets as p, getActivePlatformConnection as r, normalizePlatformApiUrl as s, acquirePlatformLifecycleLock as t, promoteInstallationSecrets as u, writeInstallationManifest as v, readKeyringPassword as x, writePendingInstallationSecrets as y };

package/dist/{plugin-inference-BDRfZngg.mjs → plugin-inference-DsvtJLll.mjs}

@@ -1,7 +1,7 @@
-import { o as join } from "./dist-BrsS7cai.mjs";
-import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
-import { n as globSync } from "./dist-m40_XgNh.mjs";
-import { c as isIdentifier, r as getSsrServerEntryPath, u as isMemberExpression } from "./entry-DU3oDoQ3.mjs";
+import { a as join } from "./dist-4WkAWhWx.mjs";
+import { n as readProjectPaths } from "./project-paths-CKQ-Q5JS.mjs";
+import { n as globSync } from "./dist-Bn8Kodjp.mjs";
+import { c as isIdentifier, r as getSsrServerEntryPath, u as isMemberExpression } from "./entry-DdRFGK0y.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parse } from "es-module-lexer/js";
 import { parseSync } from "vite";

package/dist/prefetch-Bsc_Pb6c.mjs

@@ -0,0 +1,90 @@
+//#region src/pages/prefetch.ts
+const UNITS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+function parseUnit(value) {
+	const match = value.match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/);
+	if (!match) throw new Error(`prefetch: Invalid cacheFor value '${value}'. Use a number with ms, s, m, h, or d.`);
+	return Number(match[1]) * UNITS[match[2]];
+}
+function parseCacheFor(value) {
+	if (typeof value === "number") return {
+		stale: value,
+		expires: value
+	};
+	if (Array.isArray(value)) return {
+		stale: parseUnit(value[0]),
+		expires: parseUnit(value[1])
+	};
+	const ms = parseUnit(value);
+	return {
+		stale: ms,
+		expires: ms
+	};
+}
+var PrefetchCache = class {
+	entries = /* @__PURE__ */ new Map();
+	key(url, method = "GET") {
+		return `${method}:${url}`;
+	}
+	has(url, method = "GET") {
+		return this.get(url, method) !== null;
+	}
+	get(url, method = "GET") {
+		const entry = this.entries.get(this.key(url, method));
+		if (!entry) return null;
+		if (Date.now() >= entry.expiresAt && !entry.singleUse) {
+			this.entries.delete(this.key(url, method));
+			return null;
+		}
+		return entry;
+	}
+	isFresh(entry) {
+		return Date.now() < entry.staleAt;
+	}
+	isUsable(entry) {
+		return Date.now() < entry.expiresAt || entry.singleUse;
+	}
+	set(url, method, response, ttl) {
+		const k = this.key(url, method);
+		const existing = this.entries.get(k);
+		if (existing && this.isUsable(existing)) return;
+		const now = Date.now();
+		const singleUse = ttl.stale === 0 && ttl.expires === 0;
+		const entry = {
+			url,
+			method,
+			response,
+			staleAt: now + ttl.stale,
+			expiresAt: now + ttl.expires,
+			singleUse,
+			timer: null
+		};
+		if (!singleUse && ttl.expires > 0) entry.timer = setTimeout(() => this.entries.delete(k), ttl.expires);
+		this.entries.set(k, entry);
+	}
+	/** Mark entry as consumed — removes it if singleUse. */
+	consume(url, method = "GET") {
+		const entry = this.entries.get(this.key(url, method));
+		if (entry?.singleUse) {
+			if (entry.timer) clearTimeout(entry.timer);
+			this.entries.delete(this.key(url, method));
+		}
+	}
+	flush(url, method = "GET") {
+		const k = this.key(url, method);
+		const entry = this.entries.get(k);
+		if (entry?.timer) clearTimeout(entry.timer);
+		this.entries.delete(k);
+	}
+	flushAll() {
+		for (const entry of this.entries.values()) if (entry.timer) clearTimeout(entry.timer);
+		this.entries.clear();
+	}
+};
+//#endregion
+export { parseCacheFor as n, PrefetchCache as t };

package/dist/prefetch-Ce6la4EI.d.mts

@@ -0,0 +1,31 @@
+//#region src/pages/prefetch.d.ts
+type CacheForResult = {
+  stale: number;
+  expires: number;
+};
+type CacheForInput = number | string | [string, string];
+declare function parseCacheFor(value: CacheForInput): CacheForResult;
+type CacheEntry = {
+  url: string;
+  method: string;
+  response: Promise<unknown>;
+  staleAt: number;
+  expiresAt: number;
+  singleUse: boolean;
+  timer: ReturnType<typeof setTimeout> | null;
+};
+declare class PrefetchCache {
+  private readonly entries;
+  private key;
+  has(url: string, method?: string): boolean;
+  get(url: string, method?: string): CacheEntry | null;
+  isFresh(entry: CacheEntry): boolean;
+  isUsable(entry: CacheEntry): boolean;
+  set(url: string, method: string, response: Promise<unknown>, ttl: CacheForResult): void;
+  /** Mark entry as consumed — removes it if singleUse. */
+  consume(url: string, method?: string): void;
+  flush(url: string, method?: string): void;
+  flushAll(): void;
+}
+//#endregion
+export { parseCacheFor as a, PrefetchCache as i, CacheForInput as n, CacheForResult as r, CacheEntry as t };

package/dist/{prepare-blNRQvQl.mjs → prepare-CaUxODOU.mjs}

@@ -1,5 +1,6 @@
-import { A as outro, D as log, E as intro, k as note, r as cliTitle } from "./output-B0cfNSx5.mjs";
-import { prepareProject } from "./prepare-CtDJjoOj.mjs";
+import { r as cliTitle } from "./output-urU86XeT.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
+import { t as prepareProject } from "./prepare-pcWcxSCh.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root, _args) {
 	console.log();

package/dist/prepare-D4CkM3_v.mjs

@@ -0,0 +1,2 @@
+import { t as prepareProject } from "./prepare-pcWcxSCh.mjs";
+export { prepareProject };