void 0.21.2 → 0.21.4

package/dist/{provision-Cck2m3jJ.mjs → provision-BhreDAOS.mjs}

@@ -1,8 +1,8 @@
-import { a as join, n as dirname, o as normalize, t as basename, u as resolve$2 } from "./dist-4WkAWhWx.mjs";
-import { R as persistCloudflareConfig, _ as readProvisionedBindingEntry, k as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers } from "./wrangler-D01qs6VB.mjs";
+import { a as join, n as dirname, o as normalize, t as basename, u as resolve$2 } from "./dist-BVqXeR_h.mjs";
+import { R as persistCloudflareConfig, _ as readProvisionedBindingEntry, k as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers } from "./wrangler-BymcxrRa.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { o as resolveWranglerArgv } from "./preset-Dowh9tTt.mjs";
+import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -20,7 +20,7 @@ import lockfile from "proper-lockfile";
 * identifier — the SAME predicate the provisioner's read-first uses:
 *   - D1 `database_id` is a real UUID ({@link isRealD1Id}, not `'local'`);
 *   - KV `id` is a real 32-hex ({@link isRealKvId}, not `'local'`);
-*   - R2 `bucket_name` names a real bucket ({@link isRealStoredR2BucketName}, not `'default'`);
+*   - R2 `bucket_name` names a real bucket ({@link isRealStoredR2BucketName});
 *   - Hyperdrive `id` is a real 32-hex ({@link isRealHyperdriveId}).
 *
 * Queues are NAME-bearing (no id in the config), so they are NOT part of this
@@ -51,7 +51,7 @@ function checkCloudflareProvisionDrift(configPath, desired) {
 		name: kv.title
 	});
 	if (desired.r2) {
-		if (!isProvisioned("r2_buckets", desired.r2.binding, (e) => isRealStoredR2BucketName(e.bucket_name))) missing.push({
+		if (!isProvisioned("r2_buckets", desired.r2.binding, (e) => isRealStoredR2BucketName(e.bucket_name, desired.r2?.bucketName))) missing.push({
 			binding: desired.r2.binding,
 			kind: "r2",
 			name: desired.r2.bucketName
@@ -104,12 +104,13 @@ function isValidR2BucketNameFormat(value) {
 }
 /**
 * A STORED R2 `bucket_name` that names a REAL bucket, i.e. any non-empty string
-* that is not R2's own placeholder (`default`). `local` IS a real name here. Grammar is
+* other than the placeholder (`default`), unless `default` itself is desired.
+* `local` IS a real name here. Grammar is
 * deliberately not required: a grammar-invalid stored name that contradicts the desired
 * bucket must still fail closed as a contradiction, never be silently rewritten.
 */
-function isRealStoredR2BucketName(value) {
-	return typeof value === "string" && value.length > 0 && value !== R2_BUCKET_NAME_PLACEHOLDER;
+function isRealStoredR2BucketName(value, desiredName) {
+	return typeof value === "string" && value.length > 0 && (value !== R2_BUCKET_NAME_PLACEHOLDER || value === desiredName);
 }
 const defaultLogger = {
 	info: (msg) => voidLog(msg),
@@ -626,10 +627,13 @@ function createDefaultRunWrangler(root, options) {
 		const child = spawn(command, [...prefix, ...args], {
 			cwd: opts.cwd ?? root,
 			shell: false,
-			env: provisionEnv({
-				accountId: opts.accountId,
-				apiBaseUrl: opts.apiBaseUrl
-			}),
+			env: {
+				...provisionEnv({
+					accountId: opts.accountId,
+					apiBaseUrl: opts.apiBaseUrl
+				}),
+				...opts.suppressLogs ? { WRANGLER_WRITE_LOGS: "false" } : {}
+			},
 			stdio: [
 				"ignore",
 				"pipe",
@@ -2114,71 +2118,20 @@ async function provisionWithProcessSlot(root, rootWranglerPath, desired, opts) {
 	await lock.release();
 	return result;
 }
-/**
-* The provision body, run entirely UNDER the whole-provision lock (see
-* {@link provisionCloudflareResources}). `configPath` is the ONE resolved absolute
-* config path the lock is keyed on — threaded through read-first, wrangler `-c`, and
-* the writer so reads/writes can never hit different files.
-*/
-async function provisionCloudflareResourcesLocked(root, configPath, desired, opts) {
-	if (existsSync(configPath)) {
-		const raw = readFileSync(configPath, "utf-8");
-		const content = raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw;
-		assertNoDuplicateMembers(content, configPath);
-	}
-	if (desired.d1) assertValidResourceName("d1", desired.d1.name);
-	for (const { title } of desired.kvNamespaces) assertValidResourceName("kvTitle", title);
-	if (desired.r2) assertValidResourceName("r2", desired.r2.bucketName);
-	if (desired.hyperdrive) assertValidResourceName("hyperdrive", desired.hyperdrive.name);
-	for (const queueName of desired.queues) assertValidResourceName("queue", queueName);
-	const rootConfig = readRootConfig(configPath);
-	const rawConfigAccountId = rootConfig.account_id;
-	const configAccountId = typeof rawConfigAccountId === "string" && rawConfigAccountId.length > 0 ? rawConfigAccountId : void 0;
-	const rawComplianceRegion = rootConfig.compliance_region;
-	if (rawComplianceRegion !== void 0 && typeof rawComplianceRegion !== "string") throw new Error(`provision: "${configPath}" has a non-string "compliance_region"; it must be "public" or "fedramp_high". Fix the config and retry.`);
-	const configComplianceRegion = typeof rawComplianceRegion === "string" ? rawComplianceRegion : void 0;
-	if (configAccountId && opts?.accountId && configAccountId !== opts.accountId) throw new Error(`provision: Cloudflare account mismatch — "${configPath}" pins account_id ${JSON.stringify(configAccountId)} but deploy requested ${JSON.stringify(opts.accountId)}. Reconcile them (correct or remove the config's account_id, or deploy to the pinned account) and retry.`);
-	const ambientAccountId = typeof process.env.CLOUDFLARE_ACCOUNT_ID === "string" && process.env.CLOUDFLARE_ACCOUNT_ID.length > 0 ? process.env.CLOUDFLARE_ACCOUNT_ID : void 0;
-	const effectiveAccountId = configAccountId ?? opts?.accountId ?? ambientAccountId;
-	const log = opts?.log ?? defaultLogger;
-	const resources = [];
-	const write = (patch) => writeProvisionedWranglerConfig(root, patch, { configPath });
-	const persistCreatedConfig = () => {
-		if (basename(configPath) === ".void-wrangler.jsonc") persistCloudflareConfig(dirname(configPath));
-	};
-	const hasRemoteWork = !!desired.d1 || desired.kvNamespaces.length > 0 || !!desired.r2 || !!desired.hyperdrive || desired.queues.length > 0;
-	if (hasRemoteWork && !effectiveAccountId) throw new Error("provision: no Cloudflare account is resolvable — set \"account_id\" in your root wrangler config or export CLOUDFLARE_ACCOUNT_ID before deploying. Refusing to provision resources without a pinned account (wrangler would otherwise fall back to an ambient/interactive account that is never persisted, so a later retry could rebind them elsewhere).");
-	if (hasRemoteWork) assertNoTransportRedirectInProjectDotenv(root);
-	if (desired.hyperdrive && !opts?.listHyperdriveConfigs) {
-		const { binding, name, connectionString } = desired.hyperdrive;
-		const entry = readBindingEntry(configPath, "hyperdrive", binding);
-		if (!(entry !== void 0 && isRealHyperdriveId(entry.id)) && !resolveHyperdriveApiToken(opts?.apiToken)) {
-			if (connectionString) throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and creating it needs a Cloudflare API token. wrangler exposes no machine-readable Hyperdrive list, so Void checks the account over the Cloudflare REST API, which a Cloudflare browser OAuth cannot authenticate. Without that check a create would silently duplicate an existing same-named config, so nothing was provisioned. Either (a) export CLOUDFLARE_API_TOKEN with Hyperdrive edit permission and rerun, or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs no token.`);
-			throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and there is no DATABASE_URL to create it from. Nothing was provisioned. Either (a) export DATABASE_URL with your PostgreSQL connection string and rerun (Void reads it from the shell — a value in .env/.env.local is NOT used here, so it never ships as a plaintext worker var), or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs neither DATABASE_URL nor an API token.`);
-		}
-	}
-	let accountIdWritten = false;
-	if (effectiveAccountId && configAccountId !== effectiveAccountId) {
-		write({ accountId: effectiveAccountId });
-		accountIdWritten = true;
-	}
-	const transportAccountId = effectiveAccountId;
-	const transportApiBaseUrl = resolvePinnedApiBaseUrl(process.env, configComplianceRegion);
-	const selectedRunWrangler = opts?.runWrangler ?? createDefaultRunWrangler(root);
-	const redactSecrets = createSecretRedactor(desired.hyperdrive?.connectionString);
-	const redactResult = (result) => ({
-		...result,
-		stdout: redactSecrets(result.stdout),
-		stderr: redactSecrets(result.stderr),
-		error: result.error != null ? redactSecrets(result.error) : result.error
-	});
-	const runWrangler = (args, callOpts) => Promise.resolve(selectedRunWrangler(args, {
-		...callOpts,
-		accountId: transportAccountId,
-		apiBaseUrl: transportApiBaseUrl
-	})).then(redactResult, (error) => {
-		throw redactRejection(error, redactSecrets);
+async function enableD1ReadReplicationViaApi(context, token, fetchImpl = fetch) {
+	const response = await fetchImpl(`${context.apiBaseUrl}/accounts/${context.accountId}/d1/database/${context.databaseId}`, {
+		method: "PUT",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ read_replication: { mode: "auto" } }),
+		signal: AbortSignal.timeout(15e3)
 	});
+	const envelope = await response.json().catch(() => null);
+	if (!response.ok || envelope?.success !== true) throw new Error(`provision: could not enable D1 read replication for database ${context.databaseId} (Cloudflare API status ${response.status}). The credential needs D1 Edit permission.`);
+}
+async function reconcileD1(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log, transportAccountId, transportApiBaseUrl, opts) {
 	if (desired.d1) {
 		const { binding, name } = desired.d1;
 		const migrationsDir = desired.d1.migrationsDir ?? D1_MIGRATIONS_DIR;
@@ -2301,7 +2254,40 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 				} else throw new Error(`provision: "wrangler d1 create ${name}" failed: ${created.stderr || created.stdout}`);
 			}
 		}
+		const databaseId = readBindingEntry(configPath, "d1_databases", binding)?.database_id;
+		if (!isRealD1Id(databaseId)) throw new Error(`provision: D1 binding ${binding} has no real database id after setup.`);
+		const context = {
+			databaseId,
+			accountId: transportAccountId,
+			apiBaseUrl: transportApiBaseUrl
+		};
+		if (opts?.enableD1ReadReplication) await opts.enableD1ReadReplication(context);
+		else {
+			let token = opts?.apiToken ?? process.env.CLOUDFLARE_API_TOKEN;
+			if (!token) {
+				const auth = await runWrangler([
+					"auth",
+					"token",
+					"--json",
+					...wranglerConfigArgs(configPath)
+				], {
+					captureJson: true,
+					suppressLogs: true
+				});
+				const start = auth.stdout.indexOf("{");
+				const end = auth.stdout.lastIndexOf("}");
+				let parsed;
+				if (isCleanSuccess(auth) && start >= 0 && end > start) try {
+					parsed = JSON.parse(auth.stdout.slice(start, end + 1));
+				} catch {}
+				if ((parsed?.type === "oauth" || parsed?.type === "api_token") && typeof parsed.token === "string") token = parsed.token;
+			}
+			if (!token) throw new Error("provision: D1 read replication requires a Cloudflare API bearer with D1 Edit permission. Log in with `wrangler login` or set CLOUDFLARE_API_TOKEN, then retry.");
+			await enableD1ReadReplicationViaApi(context, token);
+		}
 	}
+}
+async function reconcileKv(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log) {
 	for (const { binding, title } of desired.kvNamespaces) {
 		const entry = readBindingEntry(configPath, "kv_namespaces", binding);
 		if (entry && isRealKvId(entry.id)) {
@@ -2374,11 +2360,13 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 			});
 		}
 	}
+}
+async function reconcileR2(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log) {
 	if (desired.r2) {
 		const { binding, bucketName } = desired.r2;
 		const entry = readBindingEntry(configPath, "r2_buckets", binding);
 		const storedBucketName = entry?.bucket_name;
-		if (entry && isRealStoredR2BucketName(storedBucketName)) {
+		if (entry && isRealStoredR2BucketName(storedBucketName, bucketName)) {
 			if (storedBucketName !== bucketName) throw new Error(`provision: R2 binding ${JSON.stringify(binding)} in "${configPath}" stores bucket_name ${JSON.stringify(storedBucketName)}, but this deploy wants bucket ${JSON.stringify(bucketName)}. bucket_name IS the R2 identity, so this entry contradicts the desired bucket. Fix "${configPath}" — correct the entry's bucket_name (or remove the entry to re-provision) — or rename the desired bucket, then retry.`);
 			resources.push({
 				kind: "r2",
@@ -2451,6 +2439,8 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 			} else throw new Error(`provision: "wrangler r2 bucket info ${bucketName}" failed: ${info.stderr || info.stdout}. Cannot determine whether the bucket exists; refusing to create a possible duplicate.`);
 		}
 	}
+}
+async function reconcileHyperdrive(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log, transportAccountId, transportApiBaseUrl, redactSecrets, opts) {
 	if (desired.hyperdrive) {
 		const { binding, name, connectionString } = desired.hyperdrive;
 		const entry = readBindingEntry(configPath, "hyperdrive", binding);
@@ -2533,6 +2523,8 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 			}
 		}
 	}
+}
+async function reconcileQueues(desired, configPath, runWrangler, resources) {
 	for (const name of desired.queues) {
 		const info = await runWrangler([
 			"queues",
@@ -2568,6 +2560,77 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 			action: "created"
 		});
 	}
+}
+/**
+* The provision body, run entirely UNDER the whole-provision lock (see
+* {@link provisionCloudflareResources}). `configPath` is the ONE resolved absolute
+* config path the lock is keyed on — threaded through read-first, wrangler `-c`, and
+* the writer so reads/writes can never hit different files.
+*/
+async function provisionCloudflareResourcesLocked(root, configPath, desired, opts) {
+	if (existsSync(configPath)) {
+		const raw = readFileSync(configPath, "utf-8");
+		const content = raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw;
+		assertNoDuplicateMembers(content, configPath);
+	}
+	if (desired.d1) assertValidResourceName("d1", desired.d1.name);
+	for (const { title } of desired.kvNamespaces) assertValidResourceName("kvTitle", title);
+	if (desired.r2) assertValidResourceName("r2", desired.r2.bucketName);
+	if (desired.hyperdrive) assertValidResourceName("hyperdrive", desired.hyperdrive.name);
+	for (const queueName of desired.queues) assertValidResourceName("queue", queueName);
+	const rootConfig = readRootConfig(configPath);
+	const rawConfigAccountId = rootConfig.account_id;
+	const configAccountId = typeof rawConfigAccountId === "string" && rawConfigAccountId.length > 0 ? rawConfigAccountId : void 0;
+	const rawComplianceRegion = rootConfig.compliance_region;
+	if (rawComplianceRegion !== void 0 && typeof rawComplianceRegion !== "string") throw new Error(`provision: "${configPath}" has a non-string "compliance_region"; it must be "public" or "fedramp_high". Fix the config and retry.`);
+	const configComplianceRegion = typeof rawComplianceRegion === "string" ? rawComplianceRegion : void 0;
+	if (configAccountId && opts?.accountId && configAccountId !== opts.accountId) throw new Error(`provision: Cloudflare account mismatch — "${configPath}" pins account_id ${JSON.stringify(configAccountId)} but deploy requested ${JSON.stringify(opts.accountId)}. Reconcile them (correct or remove the config's account_id, or deploy to the pinned account) and retry.`);
+	const ambientAccountId = typeof process.env.CLOUDFLARE_ACCOUNT_ID === "string" && process.env.CLOUDFLARE_ACCOUNT_ID.length > 0 ? process.env.CLOUDFLARE_ACCOUNT_ID : void 0;
+	const effectiveAccountId = configAccountId ?? opts?.accountId ?? ambientAccountId;
+	const log = opts?.log ?? defaultLogger;
+	const resources = [];
+	const write = (patch) => writeProvisionedWranglerConfig(root, patch, { configPath });
+	const persistCreatedConfig = () => {
+		if (basename(configPath) === ".void-wrangler.jsonc") persistCloudflareConfig(dirname(configPath));
+	};
+	const hasRemoteWork = !!desired.d1 || desired.kvNamespaces.length > 0 || !!desired.r2 || !!desired.hyperdrive || desired.queues.length > 0;
+	if (hasRemoteWork && !effectiveAccountId) throw new Error("provision: no Cloudflare account is resolvable — set \"account_id\" in your root wrangler config or export CLOUDFLARE_ACCOUNT_ID before deploying. Refusing to provision resources without a pinned account (wrangler would otherwise fall back to an ambient/interactive account that is never persisted, so a later retry could rebind them elsewhere).");
+	if (hasRemoteWork) assertNoTransportRedirectInProjectDotenv(root);
+	if (desired.hyperdrive && !opts?.listHyperdriveConfigs) {
+		const { binding, name, connectionString } = desired.hyperdrive;
+		const entry = readBindingEntry(configPath, "hyperdrive", binding);
+		if (!(entry !== void 0 && isRealHyperdriveId(entry.id)) && !resolveHyperdriveApiToken(opts?.apiToken)) {
+			if (connectionString) throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and creating it needs a Cloudflare API token. wrangler exposes no machine-readable Hyperdrive list, so Void checks the account over the Cloudflare REST API, which a Cloudflare browser OAuth cannot authenticate. Without that check a create would silently duplicate an existing same-named config, so nothing was provisioned. Either (a) export CLOUDFLARE_API_TOKEN with Hyperdrive edit permission and rerun, or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs no token.`);
+			throw new Error(`provision: Hyperdrive config ${JSON.stringify(name)} is not in "${configPath}" yet, and there is no DATABASE_URL to create it from. Nothing was provisioned. Either (a) export DATABASE_URL with your PostgreSQL connection string and rerun (Void reads it from the shell — a value in .env/.env.local is NOT used here, so it never ships as a plaintext worker var), or (b) create the Hyperdrive config yourself (dashboard / "wrangler hyperdrive create") and add its id to the ${JSON.stringify(binding)} hyperdrive binding in "${configPath}" — deploying an already-provisioned Hyperdrive needs neither DATABASE_URL nor an API token.`);
+		}
+	}
+	let accountIdWritten = false;
+	if (effectiveAccountId && configAccountId !== effectiveAccountId) {
+		write({ accountId: effectiveAccountId });
+		accountIdWritten = true;
+	}
+	const transportAccountId = effectiveAccountId;
+	const transportApiBaseUrl = resolvePinnedApiBaseUrl(process.env, configComplianceRegion);
+	const selectedRunWrangler = opts?.runWrangler ?? createDefaultRunWrangler(root);
+	const redactSecrets = createSecretRedactor(desired.hyperdrive?.connectionString);
+	const redactResult = (result) => ({
+		...result,
+		stdout: redactSecrets(result.stdout),
+		stderr: redactSecrets(result.stderr),
+		error: result.error != null ? redactSecrets(result.error) : result.error
+	});
+	const runWrangler = (args, callOpts) => Promise.resolve(selectedRunWrangler(args, {
+		...callOpts,
+		accountId: transportAccountId,
+		apiBaseUrl: transportApiBaseUrl
+	})).then(redactResult, (error) => {
+		throw redactRejection(error, redactSecrets);
+	});
+	await reconcileD1(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log, transportAccountId, transportApiBaseUrl, opts);
+	await reconcileKv(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log);
+	await reconcileR2(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log);
+	await reconcileHyperdrive(desired, configPath, runWrangler, write, persistCreatedConfig, resources, log, transportAccountId, transportApiBaseUrl, redactSecrets, opts);
+	await reconcileQueues(desired, configPath, runWrangler, resources);
 	return {
 		resources,
 		configPath,
@@ -2575,4 +2638,4 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 	};
 }
 //#endregion
-export { resolveProperLockfileKey as _, checkCloudflareProvisionDrift as a, isAlreadyGoneKillError as c, isRealD1Id as d, isRealKvId as f, resolvePinnedApiBaseUrl as g, provisionEnv as h, assertValidResourceName as i, isQuarantineError as l, provisionCloudflareResources as m, acquireProvisionLock as n, createDefaultRunWrangler as o, normalizeRunWranglerResult as p, assertNoTransportRedirectInProjectDotenv as r, deleteEnvVarCaseAware as s, WranglerQuarantineError as t, isQueueConfirmedAbsent as u };
+export { resolvePinnedApiBaseUrl as _, checkCloudflareProvisionDrift as a, enableD1ReadReplicationViaApi as c, isQueueConfirmedAbsent as d, isRealD1Id as f, provisionEnv as g, provisionCloudflareResources as h, assertValidResourceName as i, isAlreadyGoneKillError as l, normalizeRunWranglerResult as m, acquireProvisionLock as n, createDefaultRunWrangler as o, isRealKvId as p, assertNoTransportRedirectInProjectDotenv as r, deleteEnvVarCaseAware as s, WranglerQuarantineError as t, isQuarantineError as u, resolveProperLockfileKey as v };

package/dist/provision-DNtrtaVD.mjs

@@ -0,0 +1,3 @@
+import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
+import { _ as resolvePinnedApiBaseUrl, a as checkCloudflareProvisionDrift, c as enableD1ReadReplicationViaApi, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionEnv, h as provisionCloudflareResources, i as assertValidResourceName, l as isAlreadyGoneKillError, m as normalizeRunWranglerResult, n as acquireProvisionLock, o as createDefaultRunWrangler, p as isRealKvId, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware, t as WranglerQuarantineError, u as isQuarantineError, v as resolveProperLockfileKey } from "./provision-BhreDAOS.mjs";
+export { WranglerQuarantineError, acquireProvisionLock, assertNoTransportRedirectInProjectDotenv, assertValidResourceName, checkCloudflareProvisionDrift, createDefaultRunWrangler, deleteEnvVarCaseAware, enableD1ReadReplicationViaApi, isAlreadyGoneKillError, isQuarantineError, isQueueConfirmedAbsent, isRealD1Id, isRealKvId, normalizeRunWranglerResult, provisionCloudflareResources, provisionEnv, resolvePinnedApiBaseUrl, resolveProperLockfileKey, scanWranglerDotenvKeys };

package/dist/{requests-CphRF98D.mjs → requests-DFyhBMaf.mjs}

@@ -1,8 +1,8 @@
 import { a as dim, c as import_picocolors, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-B9_D6ygs.mjs";
-import { o as readProjectConfig } from "./project-CWNIPoXc.mjs";
+import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
 import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-PdAJ-F0t.mjs";
+import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {
 	console.log();

package/dist/{resolve-project-Xvis70DG.mjs → resolve-project-BG5ORGID.mjs}

@@ -1,4 +1,4 @@
-import { a as join } from "./dist-4WkAWhWx.mjs";
+import { a as join } from "./dist-BVqXeR_h.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/resolve-project.ts
 function getRequestedProjectSlug(options) {

package/dist/resolve-project-DtbidV4y.mjs

@@ -0,0 +1,2 @@
+import { n as inferDefaultSlug } from "./resolve-project-BG5ORGID.mjs";
+export { inferDefaultSlug };

package/dist/{rollback-BYHJV2yD.mjs → rollback-DHHxXZiS.mjs}

@@ -1,8 +1,8 @@
 import { a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-B9_D6ygs.mjs";
-import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-CWNIPoXc.mjs";
+import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
 import { E as confirm, I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-PdAJ-F0t.mjs";
+import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
 //#region src/cli/rollback.ts
 async function runRollbackCommand(root, deployId) {
 	console.log();
@@ -83,7 +83,7 @@ async function runRollbackCommand(root, deployId) {
 	outro(dim("Traffic is now serving the rolled-back deployment."));
 }
 async function runCloudflareRollback(root, deployId) {
-	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BHNJVDbN.mjs");
+	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BipGMJ5O.mjs");
 	const context = resolveCloudflareOperationContext(root);
 	const status = await readCloudflareWorkerStatus(context);
 	const deployedVersionIds = new Set(status.deployedVersionIds);

package/dist/{route-types-Id82-veQ.mjs → route-types-Clm4WD0B.mjs}

@@ -1,5 +1,5 @@
-import { a as join, l as relative } from "./dist-4WkAWhWx.mjs";
-import { r as writeFileIfChanged } from "./project-tsconfig-CwfqUnVp.mjs";
+import { a as join, l as relative } from "./dist-BVqXeR_h.mjs";
+import { r as writeFileIfChanged } from "./project-tsconfig-B8GeM0RM.mjs";
 import { mkdirSync } from "node:fs";
 //#region src/codegen/db-types.ts
 const DRIZZLE_OPERATORS = "sql, eq, ne, gt, gte, lt, lte, and, or, not, desc, asc, like, ilike, notLike, inArray, notInArray, isNull, isNotNull, between, notBetween, exists, notExists, count, sum, avg, min, max";
@@ -214,15 +214,30 @@ function generateRouteTypes(scan, routesDir, outDir, pagesDir) {
 	lines.push("      }[keyof PageActionMap]");
 	lines.push("");
 	lines.push("  interface RouteMap {");
-	for (const route of scan.routes) {
-		if (route.methods.length === 0) continue;
-		const absRoutePath = `${routesDir}/${route.filePath}`;
-		const importPath = relative(outDir, absRoutePath);
-		lines.push(`    ${JSON.stringify(route.pattern)}: {`);
-		for (const method of route.methods) {
+	const routesByPattern = /* @__PURE__ */ new Map();
+	for (const route of scan.routes) for (const method of route.methods) {
+		let methods = routesByPattern.get(route.pattern);
+		if (!methods) {
+			methods = /* @__PURE__ */ new Map();
+			routesByPattern.set(route.pattern, methods);
+		}
+		let sources = methods.get(method);
+		if (!sources) {
+			sources = [];
+			methods.set(method, sources);
+		}
+		sources.push(route);
+	}
+	for (const [pattern, methods] of routesByPattern) {
+		lines.push(`    ${JSON.stringify(pattern)}: {`);
+		for (const [method, sources] of methods) {
+			const imports = sources.map((route) => {
+				const importPath = relative(outDir, `${routesDir}/${route.filePath}`);
+				return `(typeof import(${JSON.stringify(importPath)}))["${method}"]`;
+			});
 			lines.push(`      ${method}: {`);
-			lines.push(`        input: ExtractInput<(typeof import(${JSON.stringify(importPath)}))["${method}"]["__validators"]>;`);
-			lines.push(`        output: Serialize<Awaited<(typeof import(${JSON.stringify(importPath)}))["${method}"]["__output"]>>;`);
+			lines.push(`        input: ${imports.map((source) => `ExtractInput<${source}["__validators"]>`).join(" & ")};`);
+			lines.push(`        output: ${imports.map((source) => `Serialize<Awaited<${source}["__output"]>>`).join(" | ")};`);
 			lines.push("      };");
 		}
 		lines.push("    };");
@@ -230,13 +245,21 @@ function generateRouteTypes(scan, routesDir, outDir, pagesDir) {
 	lines.push("  }");
 	lines.push("");
 	lines.push("  interface WebSocketRouteMap {");
+	const websocketsByPattern = /* @__PURE__ */ new Map();
 	for (const route of scan.websockets ?? []) {
-		const absRoutePath = `${routesDir}/${route.filePath}`;
-		const importPath = relative(outDir, absRoutePath);
-		lines.push(`    ${JSON.stringify(route.pattern)}: {`);
-		lines.push(`      params: RouteParams<${JSON.stringify(route.params)}>;`);
-		lines.push(`      client: ExtractInput<(typeof import(${JSON.stringify(importPath)}))["default"]["messages"]["client"]>;`);
-		lines.push(`      server: ExtractOutput<(typeof import(${JSON.stringify(importPath)}))["default"]["messages"]["server"]>;`);
+		const sources = websocketsByPattern.get(route.pattern) ?? [];
+		sources.push(route);
+		websocketsByPattern.set(route.pattern, sources);
+	}
+	for (const [pattern, sources] of websocketsByPattern) {
+		const imports = sources.map((route) => {
+			const importPath = relative(outDir, `${routesDir}/${route.filePath}`);
+			return `(typeof import(${JSON.stringify(importPath)}))["default"]["messages"]`;
+		});
+		lines.push(`    ${JSON.stringify(pattern)}: {`);
+		lines.push(`      params: RouteParams<${JSON.stringify(sources[0].params)}>;`);
+		lines.push(`      client: ${imports.map((source) => `ExtractInput<${source}["client"]>`).join(" & ")};`);
+		lines.push(`      server: ${imports.map((source) => `ExtractOutput<${source}["server"]>`).join(" | ")};`);
 		lines.push("    };");
 	}
 	lines.push("  }");

package/dist/{runner-CQs_cDSG.mjs → runner-B8wXwWlo.mjs}

@@ -1,2 +1,2 @@
-import { i as openSqliteDatabase, n as getAppliedMigrations, o as runMigrations, r as getMiniflareDatabasePath, t as getApplicationTables } from "./runner-BGVsGgkb.mjs";
+import { i as openSqliteDatabase, n as getAppliedMigrations, o as runMigrations, r as getMiniflareDatabasePath, t as getApplicationTables } from "./runner-p-dMs2UN.mjs";
 export { getApplicationTables, getAppliedMigrations, getMiniflareDatabasePath, openSqliteDatabase, runMigrations };

package/dist/{runner-mysql-1o47achK.mjs → runner-mysql-CEG5JozK.mjs}

@@ -1,2 +1,2 @@
-import { i as runMySqlMigrations, n as getMySqlAppliedMigrations, t as applyMySqlMigrations } from "./runner-mysql-BhwMk2Bm.mjs";
+import { i as runMySqlMigrations, n as getMySqlAppliedMigrations, t as applyMySqlMigrations } from "./runner-mysql-DmWchSWJ.mjs";
 export { applyMySqlMigrations, getMySqlAppliedMigrations, runMySqlMigrations };

package/dist/{runner-mysql-BhwMk2Bm.mjs → runner-mysql-DmWchSWJ.mjs}

@@ -1,4 +1,4 @@
-import { t as collectMigrations } from "./collect-DXHNWHcT.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
 //#region src/migrations/runner-mysql.ts
 async function readMySqlAppliedMigrations(client) {
 	try {

package/dist/{runner-BGVsGgkb.mjs → runner-p-dMs2UN.mjs}

@@ -1,6 +1,6 @@
-import { a as join, n as dirname } from "./dist-4WkAWhWx.mjs";
-import { n as hasPackageDependency, r as readNearestPackageJson } from "./package-json-iCbMg5XF.mjs";
-import { t as collectMigrations } from "./collect-DXHNWHcT.mjs";
+import { a as join, n as dirname } from "./dist-BVqXeR_h.mjs";
+import { n as hasPackageDependency, r as readNearestPackageJson } from "./package-json-DXfiT1jV.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
 import { a as classifyMigration } from "./plan-BEZ8VJW0.mjs";
 import { existsSync, mkdirSync } from "node:fs";
 import { createHash, createHmac } from "node:crypto";

package/dist/{runner-pg-D7z01mQS.mjs → runner-pg-Bh4AgZdj.mjs}

@@ -1,2 +1,2 @@
-import { i as runPgMigrations, n as getPgAppliedMigrations, t as applyPgMigrations } from "./runner-pg-CJ_JeGF6.mjs";
+import { i as runPgMigrations, n as getPgAppliedMigrations, t as applyPgMigrations } from "./runner-pg-D4OPlil-.mjs";
 export { applyPgMigrations, getPgAppliedMigrations, runPgMigrations };

package/dist/{runner-pg-CJ_JeGF6.mjs → runner-pg-D4OPlil-.mjs}

@@ -1,4 +1,4 @@
-import { t as collectMigrations } from "./collect-DXHNWHcT.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
 //#region src/migrations/runner-pg.ts
 async function readPgAppliedMigrations(client) {
 	try {

package/dist/runtime/better-auth-mysql.d.mts

@@ -1,4 +1,4 @@
-import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv, r as VoidAuthRuntimeApi, t as VoidAuthDialect } from "../better-auth-shared-BoVwA5Vm.mjs";
+import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv, r as VoidAuthRuntimeApi, t as VoidAuthDialect } from "../better-auth-shared-BVkjZ3vM.mjs";
 //#region src/runtime/better-auth-mysql.d.ts
 export declare const resolveVoidAuthOptions: VoidAuthRuntimeApi["resolveVoidAuthOptions"];
 export declare const createVoidAuth: VoidAuthRuntimeApi["createVoidAuth"];

package/dist/runtime/better-auth-mysql.mjs

@@ -1,5 +1,5 @@
 import { t as applyMySqlAuthMigrations } from "../auth-migrations-9vif1uj8.mjs";
-import { t as createVoidAuthRuntime } from "../better-auth-shared-syGYYmnY.mjs";
+import { t as createVoidAuthRuntime } from "../better-auth-shared-rsBGBvWJ.mjs";
 //#region src/runtime/better-auth-mysql.ts
 function resolveConnectionString(env) {
 	const connectionString = typeof env.DATABASE_URL === "string" && env.DATABASE_URL.length > 0 ? env.DATABASE_URL : typeof env.HYPERDRIVE?.connectionString === "string" && env.HYPERDRIVE.connectionString.length > 0 ? env.HYPERDRIVE.connectionString : void 0;

package/dist/runtime/better-auth-pg.d.mts

@@ -1,4 +1,4 @@
-import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv, r as VoidAuthRuntimeApi, t as VoidAuthDialect } from "../better-auth-shared-BoVwA5Vm.mjs";
+import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv, r as VoidAuthRuntimeApi, t as VoidAuthDialect } from "../better-auth-shared-BVkjZ3vM.mjs";
 //#region src/runtime/better-auth-pg.d.ts
 export declare const resolveVoidAuthOptions: VoidAuthRuntimeApi["resolveVoidAuthOptions"];
 export declare const createVoidAuth: VoidAuthRuntimeApi["createVoidAuth"];

package/dist/runtime/better-auth-pg.mjs

@@ -1,5 +1,5 @@
 import { n as applyPgAuthMigrations } from "../auth-migrations-9vif1uj8.mjs";
-import { t as createVoidAuthRuntime } from "../better-auth-shared-syGYYmnY.mjs";
+import { t as createVoidAuthRuntime } from "../better-auth-shared-rsBGBvWJ.mjs";
 import { t as disablePgPassFallback } from "../pg-J2HbZIkX.mjs";
 //#region src/runtime/better-auth-pg.ts
 function resolveConnectionString(env) {

package/dist/runtime/better-auth.d.mts

@@ -1,4 +1,4 @@
-import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv, r as VoidAuthRuntimeApi, t as VoidAuthDialect } from "../better-auth-shared-BoVwA5Vm.mjs";
+import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv, r as VoidAuthRuntimeApi, t as VoidAuthDialect } from "../better-auth-shared-BVkjZ3vM.mjs";
 //#region src/runtime/better-auth.d.ts
 export declare const resolveVoidAuthOptions: VoidAuthRuntimeApi["resolveVoidAuthOptions"];
 export declare const createVoidAuth: VoidAuthRuntimeApi["createVoidAuth"];

package/dist/runtime/better-auth.mjs

@@ -1,10 +1,10 @@
 import { r as applySqliteAuthMigrations } from "../auth-migrations-9vif1uj8.mjs";
-import { t as createVoidAuthRuntime } from "../better-auth-shared-syGYYmnY.mjs";
+import { t as createVoidAuthRuntime } from "../better-auth-shared-rsBGBvWJ.mjs";
 //#region src/runtime/better-auth.ts
 async function resolveDatabase(env) {
 	if (!env.DB) throw new Error("auth: Better Auth requires the \"DB\" D1 binding for sqlite apps.");
 	return {
-		database: env.DB,
+		database: env.DB.withSession("first-primary"),
 		async dispose() {}
 	};
 }

package/dist/runtime/db.mjs

@@ -1,4 +1,4 @@
-import { a as requireRuntimeBinding } from "../env-Yz4HcvHs.mjs";
+import { a as requireRuntimeBinding, r as getRuntimeRequestResource } from "../env-D5liuQYR.mjs";
 import { drizzle } from "drizzle-orm/d1";
 import { and, asc, avg, between, count, desc, eq, exists, gt, gte, ilike, inArray, isNotNull, isNull, like, lt, lte, max, min, ne, not, notBetween, notExists, notInArray, notLike, or, sql, sum } from "drizzle-orm";
 //#region src/runtime/db.ts
@@ -14,17 +14,20 @@ import { and, asc, avg, between, count, desc, eq, exists, gt, gte, ilike, inArra
 * Use this when you have multiple D1 databases or need a non-default binding.
 */
 function createDb(d1) {
-	return drizzle(d1);
+	return drizzle(d1.withSession("first-unconstrained"));
 }
-let _instance;
+function createPrimaryDb(d1) {
+	return drizzle(d1.withSession("first-primary"));
+}
+const requestDbKey = {};
 /**
 * Default Drizzle D1 instance — resolves the `DB` binding from the runtime
 * environment. When the Void plugin is active, this is replaced with a
 * schema-aware instance via virtual module.
 */
 const db = new Proxy({}, { get(_, prop) {
-	_instance ??= drizzle(requireRuntimeBinding("DB"));
-	return Reflect.get(_instance, prop);
+	const instance = getRuntimeRequestResource(requestDbKey, () => createDb(requireRuntimeBinding("DB")), () => createPrimaryDb(requireRuntimeBinding("DB")));
+	return Reflect.get(instance, prop);
 } });
 //#endregion
 export { and, asc, avg, between, count, createDb, db, desc, eq, exists, gt, gte, ilike, inArray, isNotNull, isNull, like, lt, lte, max, min, ne, not, notBetween, notExists, notInArray, notLike, or, sql, sum };

package/dist/runtime/durable.mjs

@@ -1,4 +1,4 @@
-import { a as requireRuntimeBinding, o as withRuntimeEnv } from "../env-Yz4HcvHs.mjs";
+import { a as requireRuntimeBinding, o as withRuntimeEnv } from "../env-D5liuQYR.mjs";
 import { DurableObject } from "cloudflare:workers";
 //#region src/runtime/durable.ts
 const DEFAULT_STORAGE_KEY = "__void_durable_state";

package/dist/runtime/email/testing.mjs

@@ -1,6 +1,6 @@
 import { i as normalizeEmail, r as buildMime } from "../../mime-D5Nmdzf7.mjs";
 import { y as registerEmailSink } from "../../dev-inbox-P0u4tM8Y.mjs";
-import { n as compileEmailPattern, t as compareEmailRoutes } from "../../email-C5kaZXzJ.mjs";
+import { n as compileEmailPattern, t as compareEmailRoutes } from "../../email--tEtMoj_.mjs";
 import { i as createMessageProxy, n as MAX_INBOUND_HEADERS, t as MAX_INBOUND_BYTES } from "../../inbound-aVHEUhKo.mjs";
 //#region src/runtime/email/testing.ts
 /**

package/dist/runtime/env-public.mjs

@@ -1,5 +1,5 @@
 import { a as getRawRuntimeEnv } from "../env-raw-Cx8ElDdj.mjs";
-import { i as isInternalBinding, n as getRuntimeEnv } from "../env-Yz4HcvHs.mjs";
+import { i as isInternalBinding, n as getRuntimeEnv } from "../env-D5liuQYR.mjs";
 import { a as oneOf, i as number, n as email, o as string, r as json, s as url, t as boolean } from "../env-helpers--wFmQ_5Q.mjs";
 //#region src/shared/env-mask.ts
 /**

package/dist/runtime/env.d.mts

@@ -4,7 +4,7 @@ type RuntimeEnv = Record<string, unknown>;
 //#endregion
 //#region src/runtime/env.d.ts
 /** @internal Reuse a resource only within the current runtime request. */
-export declare function getRuntimeRequestResource<T>(key: object, initialize: () => T): T;
+export declare function getRuntimeRequestResource<T>(key: object, initialize: () => T, outsideScope?: () => T): T;
 export declare function withRuntimeEnv<T>(env: unknown, fn: () => T): T;
 /**
  * Shared internal-binding predicate. A binding is framework-internal — and must

package/dist/runtime/env.mjs

@@ -1,2 +1,2 @@
-import { a as requireRuntimeBinding, i as isInternalBinding, n as getRuntimeEnv, o as withRuntimeEnv, r as getRuntimeRequestResource, t as getRuntimeBinding } from "../env-Yz4HcvHs.mjs";
+import { a as requireRuntimeBinding, i as isInternalBinding, n as getRuntimeEnv, o as withRuntimeEnv, r as getRuntimeRequestResource, t as getRuntimeBinding } from "../env-D5liuQYR.mjs";
 export { getRuntimeBinding, getRuntimeEnv, getRuntimeRequestResource, isInternalBinding, requireRuntimeBinding, withRuntimeEnv };

package/dist/runtime/kv.mjs

@@ -1,4 +1,4 @@
-import { a as requireRuntimeBinding } from "../env-Yz4HcvHs.mjs";
+import { a as requireRuntimeBinding } from "../env-D5liuQYR.mjs";
 //#region src/runtime/kv.ts
 function parseValue(raw) {
 	if (raw === null) return null;