void 0.21.3 → 0.21.4

package/dist/cli/cli.mjs

@@ -2020,7 +2020,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-BH0grP4y.mjs").then(({ runDeploy }) => {
+	import("../deploy-BVwow28d.mjs").then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -2052,8 +2052,8 @@ else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSu
 else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-B44I8J_W.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
 else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-DN9sSNiV.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
 else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-BRKOG2RG.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-DzJRn-qz.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-BxHabktK.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-CTXIWD42.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
 else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
 else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
 else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
@@ -2222,7 +2222,7 @@ else if (command === "prepare") {
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-BH0grP4y.mjs");
+				const { runDeploy } = await import("../deploy-BVwow28d.mjs");
 				await runDeploy(root);
 				return;
 			}
@@ -2235,8 +2235,8 @@ else if (command === "prepare") {
 			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
 			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
 			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-Dpt0jd-x.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-BRKOG2RG.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-DzJRn-qz.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-BxHabktK.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-CTXIWD42.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
 			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
 			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {

package/dist/{db-DzJRn-qz.mjs → db-CTXIWD42.mjs}

@@ -862,7 +862,7 @@ async function runMigrate(root, dialect, remote) {
 				log.error(getErrorMessage(error));
 				process.exit(1);
 			}
-			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-BH0grP4y.mjs");
+			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-BVwow28d.mjs");
 			const applySet = await checkWranglerMigrationApplySet(context.operation.configPath, parseRootWranglerConfig(context.operation.configPath), binding, context.migrationsDir, rawMigrations);
 			if (!applySet.ok) {
 				log.error(applySet.reason);

package/dist/{deploy-BH0grP4y.mjs → deploy-BVwow28d.mjs}

@@ -1,2 +1,2 @@
-import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-CsMJrPfM.mjs";
+import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-F1exK5F4.mjs";
 export { checkWranglerMigrationApplySet, parseRootWranglerConfig, runDeploy };

package/dist/{deploy-CsMJrPfM.mjs → deploy-F1exK5F4.mjs}

@@ -1885,6 +1885,44 @@ function safePositional(value) {
 		return code < 32 || code === 127;
 	});
 }
+/** Pin opaque secrets to the live version in the private, disposable Build Output. */
+async function pinActiveWorkerSecrets(options) {
+	const { activeVersionId, bindings, requiredNames, explicitNames = [] } = options;
+	if (!/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(activeVersionId)) return false;
+	const secretNames = new Set(bindings.map((binding) => binding.name));
+	const explicit = new Set(explicitNames);
+	if (bindings.some((binding) => !safePositional(binding.name)) || secretNames.size !== bindings.length) return false;
+	if (requiredNames.some((name) => !secretNames.has(name) && !explicit.has(name))) return false;
+	const path = getWorkerConfigPath(options.output.directory);
+	const worker = parseJson(readFileSync(path, "utf8"));
+	if (!record(worker) || worker.env !== void 0 && !record(worker.env)) return false;
+	const env = { ...worker.env ?? {} };
+	for (const name of explicit) delete env[name];
+	for (const [name, value] of Object.entries(env)) if (record(value) && (value.type === "secret" || value.type === "inherit" || value.type === "unsafe:inherit") && !secretNames.has(name) && !explicit.has(name)) return false;
+	for (const { name } of bindings) {
+		if (explicit.has(name)) continue;
+		const current = env[name];
+		if (current !== void 0 && (!record(current) || current.type !== "secret" && current.type !== "inherit" && current.type !== "unsafe:inherit")) return false;
+		env[name] = {
+			type: "unsafe:inherit",
+			version_id: activeVersionId
+		};
+	}
+	const unsafe = record(worker.unsafe) ? { ...worker.unsafe } : {};
+	const metadata = record(unsafe.metadata) ? { ...unsafe.metadata } : {};
+	if (metadata.bindings !== void 0) return false;
+	if (metadata.keep_bindings !== void 0 && (!Array.isArray(metadata.keep_bindings) || !metadata.keep_bindings.every((type) => typeof type === "string"))) return false;
+	metadata.keep_bindings = (metadata.keep_bindings ?? []).filter((type) => type !== "secret_text" && type !== "secret_key");
+	unsafe.metadata = metadata;
+	const next = {
+		...worker,
+		env,
+		unsafe
+	};
+	writeFileSync(path, JSON.stringify(next), { mode: 384 });
+	await readBuildOutput(options.output.directory);
+	return true;
+}
 /** Prevent cf's prebuilt uploader from creating a resource as a side effect. */
 function createCfResourceVerifier(options) {
 	return async (directory) => {
@@ -7507,6 +7545,13 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
 		queueConsumerCleanup,
 		verifyInheritedSecrets: true,
+		...cfOutput && existingWorker && !pinnedHandoffLink ? { pinActiveSecrets: (activeVersionId, bindings) => pinActiveWorkerSecrets({
+			output: cfOutput,
+			activeVersionId,
+			bindings,
+			requiredNames: schemaFacts.requiredKeys,
+			...initialAuthSecret ? { explicitNames: [BETTER_AUTH_SECRET_NAME] } : {}
+		}) } : {},
 		atomic,
 		...initialAuthSecret ? { candidateSecrets: { [BETTER_AUTH_SECRET_NAME]: initialAuthSecret } } : {}
 	}).finally(() => cfOutput?.dispose());
@@ -7581,9 +7626,8 @@ function formatCloudflareActivationError(result) {
 		case "deployment-changed": return result.triggerRepair === "succeeded" ? `deploy: another Cloudflare operation superseded this deployment. Void restored triggers for the active version ${result.activeVersionId ?? "(unknown)"}; retry from fresh deployment status.` : `deploy: another Cloudflare operation superseded this deployment, but its trigger state could not be verified. Inspect the active Worker version ${result.activeVersionId ?? "(unknown)"} immediately.`;
 		case "inheritance-source-unavailable": return "deploy: could not verify which Worker Version would supply inherited secrets; production traffic is unchanged.";
 		case "inheritance-source-changed": return [
-			"deploy: the active Worker Version is not the latest upload, so inherited secrets cannot be pinned safely.",
-			"Supply explicit local values for every schema-marked text secret and retry. If the Worker has",
-			"non-text secret bindings, inspect its active and latest versions in Cloudflare before proceeding.",
+			"deploy: the active Worker Version is not the latest upload, and its secrets could not be pinned safely.",
+			"Inspect the active and latest Worker versions in Cloudflare before retrying.",
 			"No version was uploaded; production traffic is unchanged."
 		].join("\n");
 		case "traffic-preservation-unavailable": return ["deploy: the existing Worker has dashboard-managed routes or visibility that Void cannot safely republish.", "Add its current routes, workers_dev, and preview_urls values to the root Wrangler config, then retry; no version was uploaded."].join("\n");

package/dist/{email-BRKOG2RG.mjs → email-BxHabktK.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { c as import_picocolors, i as createSpinner } from "./output-CCH48AMM.mjs";
-import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-CsMJrPfM.mjs";
+import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-F1exK5F4.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { c as getToken, d as openBrowser } from "./auth-DLNN0D3Z.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, l as relative, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { d as require_picocolors } from "./output-CCH48AMM.mjs";
-import { G as resolveWorkerDirName, St as hasDocumentRoutes, V as resolveDistDir, ct as prerenderPagesNode, dt as collectRevalidate, ft as hasRevalidate, mt as SEND_EMAIL_BINDING, ot as generateQueueResolverSource, pt as scanDurableObjectModules, st as prerenderPages, ut as collectPages, wt as resolveAssetRoutingPolicy, xt as hasApiRoutes } from "./deploy-CsMJrPfM.mjs";
+import { G as resolveWorkerDirName, St as hasDocumentRoutes, V as resolveDistDir, ct as prerenderPagesNode, dt as collectRevalidate, ft as hasRevalidate, mt as SEND_EMAIL_BINDING, ot as generateQueueResolverSource, pt as scanDurableObjectModules, st as prerenderPages, ut as collectPages, wt as resolveAssetRoutingPolicy, xt as hasApiRoutes } from "./deploy-F1exK5F4.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
 import { r as scopedAccessCredentials } from "./cf-access-DRsQRe6k.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.21.3",
+  "version": "0.21.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -325,11 +325,11 @@
     "@cloudflare/vite-plugin": "1.54.7",
     "@cloudflare/workers-types": "^4.20260702.1",
     "@napi-rs/keyring": "2.0.0",
-    "@void/deploy-cloudflare": "0.21.3",
-    "@void/deploy-core": "0.21.3",
-    "@void/edge": "0.21.3",
-    "@void/isr": "0.21.3",
-    "@void/platform": "0.21.3",
+    "@void/deploy-cloudflare": "0.21.4",
+    "@void/deploy-core": "0.21.4",
+    "@void/edge": "0.21.4",
+    "@void/isr": "0.21.4",
+    "@void/platform": "0.21.4",
     "acorn": "^8.15.0",
     "better-auth": "^1.7.3",
     "better-sqlite3": "^13.0.3",
@@ -379,7 +379,7 @@
     "zod": "^4.6.1"
   },
   "peerDependencies": {
-    "@void/md": "0.21.3",
+    "@void/md": "0.21.4",
     "arktype": ">=2.0.0",
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",

package/skills/void/docs/integrations/cloudflare.md

@@ -308,6 +308,7 @@ Custom D1 layouts are supported through `migrations_dir`, `migrations_table`, an
 Root `.env` is local-only and is never emitted into Worker vars. Every non-client key declared in `env.ts` is a server value: store it with `void secret put <NAME>`. Void emits required server names through `secrets.required`, rejects plaintext Worker vars with those names, and preserves existing remote secrets.
 
 For apps using auth, Void creates a random 32-byte `BETTER_AUTH_SECRET` only when the remote secret is missing. It reuses that value on later deploys. Both auth secrets and schema-marked secrets can be set up on a new Worker's draft before its first upload.
+If an earlier deployment leaves a newer inactive upload, Void pins later uploads to the active version's secret bindings. You do not need to recover the plaintext values from Cloudflare.
 
 ### Readiness and rollback
 

package/skills/void/docs/reference/cli.md

@@ -995,6 +995,7 @@ Void records provisioned resource IDs in `void.lock.json`. Commit it for other m
 `.env` stays local. Store server keys declared in `env.ts` with `void secret put <NAME>`; Void rejects them as plaintext Worker vars. If the first deploy reports missing remote secrets, set them and retry. Custom D1 migration layouts must match the exact files, contents, and order Void validated. Direct deploy and Cloudflare commands use the top-level settings, not named environments or alternate config paths.
 
 Existing remote secrets are preserved. Void also preserves or creates `BETTER_AUTH_SECRET` for auth apps.
+If a failed upload leaves a newer inactive version, later deployments inherit secret bindings from the live version without requiring their plaintext values.
 
 **Email.** If the app uses `sendEmail()` or `email/` handlers, set `email.from` in `void.config.ts`. Void shows the Cloudflare account changes and asks before applying them. Later deploys skip the prompt once setup is ready. Without `email.from`, deploy continues without email. For CI, run `void email setup --platform cloudflare` locally and commit `void.lock.json`; pass `--require-email` to fail when email is unavailable. DNS propagation may delay a deploy after setup. See [Email on your own Cloudflare account](../guide/email.md#your-own-cloudflare-account) for setup and recovery.