void 0.21.5 → 0.21.7

package/dist/{account-cmd-DGt9cpRe.mjs → account-cmd-CQ2wi4Th.mjs}

@@ -1,13 +1,13 @@
 import { c as getToken, p as removeToken } from "./auth-DLNN0D3Z.mjs";
 import { j as log } from "./dist-Dn6nn2IU.mjs";
 import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
-import { n as runLoginCommand } from "./login-BQyISZuW.mjs";
+import { n as runLoginCommand } from "./login-DZldyb8c.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/account-cmd.ts
 async function runAccountCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
-		case "link": return import("./auth-link-Cl9vOuf7.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
+		case "link": return import("./auth-link-B_lceSHK.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) log.success("Logged out.");
 			else log.info("Not logged in.");

package/dist/{auth-link-Cl9vOuf7.mjs → auth-link-B_lceSHK.mjs}

@@ -1,8 +1,8 @@
 import { a as getApiUrl, c as getToken, d as openBrowser, g as savePlatformToken, h as runPlatformLogin } from "./auth-DLNN0D3Z.mjs";
 import { j as log } from "./dist-Dn6nn2IU.mjs";
 import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
-import { r as selectPlatformLoginMethod } from "./login-BQyISZuW.mjs";
-import { t as discoverPlatform } from "./platform-cmd-CRSKfu8k.mjs";
+import { r as selectPlatformLoginMethod } from "./login-DZldyb8c.mjs";
+import { t as discoverPlatform } from "./platform-cmd-BtxZrT6w.mjs";
 import { execFile } from "node:child_process";
 //#region src/cli/auth-link.ts
 async function runAuthLink(root, connectionId) {

package/dist/{auth-router-D4ZcMUSf.mjs → auth-router-cZq0HuWe.mjs}

@@ -37,7 +37,7 @@ async function chooseDestination(root, args, interactive) {
 }
 async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isTTY)) {
 	if (args.subcommand === "link") {
-		const { runAccountCommand } = await import("./account-cmd-DGt9cpRe.mjs");
+		const { runAccountCommand } = await import("./account-cmd-CQ2wi4Th.mjs");
 		await runAccountCommand(root, {
 			subcommand: "link",
 			...args.connectionId ? { connectionId: args.connectionId } : {}
@@ -45,17 +45,17 @@ async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isT
 		return;
 	}
 	if (args.subcommand === "token") {
-		const { runAccountCommand } = await import("./account-cmd-DGt9cpRe.mjs");
+		const { runAccountCommand } = await import("./account-cmd-CQ2wi4Th.mjs");
 		await runAccountCommand(root, { subcommand: "token" });
 		return;
 	}
 	const destination = await chooseDestination(root, args, interactive);
 	if (destination.platform === "cloudflare") {
-		const { runCloudflareCommand } = await import("./cloudflare-cmd-BjNxR1XF.mjs");
+		const { runCloudflareCommand } = await import("./cloudflare-cmd-bSmZ1d5L.mjs");
 		await runCloudflareCommand(root, { subcommand: args.subcommand === "whoami" || args.subcommand === "status" ? "status" : args.subcommand });
 		return;
 	}
-	const { runAccountCommand } = await import("./account-cmd-DGt9cpRe.mjs");
+	const { runAccountCommand } = await import("./account-cmd-CQ2wi4Th.mjs");
 	const subcommand = args.subcommand === "status" ? "whoami" : args.subcommand;
 	if (!destination.apiUrl) {
 		await runAccountCommand(root, { subcommand });

package/dist/cli/cf-compat.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as join, n as dirname, u as resolve } from "../dist-BVqXeR_h.mjs";
 import { t as prepareCfBuildOutput } from "../cf-build-output-CGT03qCD.mjs";
-import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
+import { copyFileSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 import { parse } from "jsonc-parser";
@@ -21,7 +21,8 @@ function cfEnvironment() {
 		...process.env,
 		CF_DELEGATION: "1",
 		CF_SEND_TELEMETRY: "false",
-		CF_NO_OSC_PROGRESS: "1"
+		CF_NO_OSC_PROGRESS: "1",
+		CLOUDFLARE_AUTH_USE_KEYRING: "true"
 	};
 	if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) env.NODE_USE_ENV_PROXY = "1";
 	for (const [canonical, alias] of [
@@ -39,10 +40,9 @@ function result(status, stdout = "", stderr = "") {
 		stderr
 	};
 }
-function runCf(command, cwd = process.cwd(), useLoginProfile = false) {
+function runCf(command, cwd = process.cwd()) {
 	const env = cfEnvironment();
 	env.CF_QUIET = "1";
-	if (useLoginProfile) delete env.CLOUDFLARE_AUTH_USE_KEYRING;
 	const child = spawnSync(process.execPath, [cf, ...command], {
 		cwd,
 		env,
@@ -169,7 +169,7 @@ async function cloudflareApiGet(path, failure, extraHeaders = {}) {
 	try {
 		const response = await fetch$1(url, {
 			headers: {
-				...apiHeaders(),
+				...await apiHeaders(),
 				...extraHeaders
 			},
 			redirect: "error",
@@ -190,7 +190,7 @@ async function clearWorkerCronSchedules(worker) {
 		const response = await fetch$1(endpoint, {
 			method: "PUT",
 			headers: {
-				...apiHeaders(),
+				...await apiHeaders(),
 				"Content-Type": "application/json"
 			},
 			body: "[]",
@@ -245,14 +245,14 @@ async function readVersionResources(worker, versionId) {
 	if (!Array.isArray(resources.bindings) || !resources.script || !resources.script_runtime) throw new Error("Cloudflare Worker version resources were incomplete.");
 	return resources;
 }
-function apiHeaders() {
+async function apiHeaders() {
 	const key = process.env.CLOUDFLARE_API_KEY ?? process.env.CF_API_KEY;
 	const email = process.env.CLOUDFLARE_EMAIL ?? process.env.CF_EMAIL;
 	if (key && email) return {
 		"X-Auth-Key": key,
 		"X-Auth-Email": email
 	};
-	const credential = sessionCredential();
+	const credential = await sessionCredential();
 	if (!credential) throw new Error("Cloudflare session bearer is unavailable.");
 	return { Authorization: `Bearer ${credential.token}` };
 }
@@ -269,25 +269,37 @@ async function withSecretFile(content, action) {
 		});
 	}
 }
-function sessionCredential() {
+async function sessionCredential() {
 	const token = process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN;
 	if (token) return {
 		type: "api_token",
 		token
 	};
-	const identity = runCf(["auth", "whoami"], process.cwd(), true);
+	const identity = runCf(["auth", "whoami"]);
 	if (identity.status !== 0) return null;
 	const state = object(parsedJson(identity.stdout));
 	if (state.authenticated !== true || state.tokenValid !== true) return null;
-	const source = state.authSource;
-	if (typeof source !== "string" || !source.startsWith("OAuth token from ")) return null;
-	const credential = object(parsedJson(readFileSync(source.slice(17), "utf8")));
-	return typeof credential.oauth_token === "string" && credential.oauth_token ? {
+	if (typeof state.authSource !== "string" || !state.authSource.startsWith("OAuth token")) return null;
+	const dist = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "dist");
+	const entry = readdirSync(dist).find((name) => /^cf-[^/]+\.mjs$/.test(name));
+	if (!entry) throw new Error("The bundled Cloudflare credential reader is unavailable.");
+	const module = await import(pathToFileURL(join(dist, entry)).href);
+	if (typeof module.t !== "function") throw new Error("The bundled Cloudflare credential reader is unavailable.");
+	const noop = () => {};
+	const stored = module.t({ logger: {
+		debug: noop,
+		info: noop,
+		log: noop,
+		warn: noop,
+		error: noop
+	} }).readAuthCredentials();
+	const credential = stored && typeof stored === "object" ? stored : null;
+	return credential && typeof credential.oauth_token === "string" && credential.oauth_token ? {
 		type: "oauth",
 		token: credential.oauth_token
 	} : null;
 }
-function auth() {
+async function auth() {
 	if (args[0] === "login") return runInteractiveCf([
 		"auth",
 		"login",
@@ -308,7 +320,7 @@ function auth() {
 		}), called.stderr);
 	}
 	if (args[0] === "auth" && args[1] === "token") {
-		const credential = sessionCredential();
+		const credential = await sessionCredential();
 		return credential ? result(0, `${JSON.stringify(credential)}\n`) : result(1, "", "Cloudflare session has no OAuth bearer.");
 	}
 	return result(1, "", "Unsupported Cloudflare authentication operation.");
@@ -843,7 +855,7 @@ async function tail() {
 	] });
 	const endpoint = `${(process.env.CLOUDFLARE_API_BASE_URL ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "")}/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(worker)}/tails`;
 	const headers = {
-		...apiHeaders(),
+		...await apiHeaders(),
 		"Content-Type": "application/json"
 	};
 	const stopped = new AbortController();

package/dist/cli/cli.mjs

@@ -2020,7 +2020,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-CmePjn6m.mjs").then(({ runDeploy }) => {
+	import("../deploy-BM_LoBXC.mjs").then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -2039,21 +2039,21 @@ if (helpPath) {
 	});
 } else if (command === "connect") (async () => {
 	const parsed = parseConnectArgs(args.slice(1));
-	const { runConnectCommand } = await import("../connect-4Ph5Y0QE.mjs");
+	const { runConnectCommand } = await import("../connect-BY38i-9E.mjs");
 	await runConnectCommand(process.cwd(), parsed);
 })().catch((err) => {
 	log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 	process.exit(1);
 });
-else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-router-D4ZcMUSf.mjs").then(({ runAuthRouter }) => runAuthRouter(root, parsed)));
-else if (command === "account") runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (root, parsed) => import("../account-cmd-DGt9cpRe.mjs").then(({ runAccountCommand }) => runAccountCommand(root, parsed)));
-else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-C8OqhqPt.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
-else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-BjNxR1XF.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
+else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-router-cZq0HuWe.mjs").then(({ runAuthRouter }) => runAuthRouter(root, parsed)));
+else if (command === "account") runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (root, parsed) => import("../account-cmd-CQ2wi4Th.mjs").then(({ runAccountCommand }) => runAccountCommand(root, parsed)));
+else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-CjNB09OF.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
+else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-bSmZ1d5L.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
 else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-B44I8J_W.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
 else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-DN9sSNiV.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
 else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-CYq8VQ96.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BAJbaEVn.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-dMnE_Lat.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BIo37Y7H.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
 else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
 else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
 else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
@@ -2075,7 +2075,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-CRGDXzVC.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-CJSnEcuj.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -2207,12 +2207,12 @@ else if (command === "prepare") {
 		const root = process.cwd();
 		switch (cmd) {
 			case "connect": {
-				const { runConnectCommand } = await import("../connect-4Ph5Y0QE.mjs");
+				const { runConnectCommand } = await import("../connect-BY38i-9E.mjs");
 				await runConnectCommand(root, parseConnectArgs([]));
 				return;
 			}
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-CRGDXzVC.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-CJSnEcuj.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
@@ -2222,21 +2222,21 @@ else if (command === "prepare") {
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-CmePjn6m.mjs");
+				const { runDeploy } = await import("../deploy-BM_LoBXC.mjs");
 				await runDeploy(root);
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-router-D4ZcMUSf.mjs").then(({ runAuthRouter }) => runAuthRouter(r, p)));
-			case "account": return runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (r, p) => import("../account-cmd-DGt9cpRe.mjs").then(({ runAccountCommand }) => runAccountCommand(r, p)));
-			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-C8OqhqPt.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
-			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-BjNxR1XF.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-router-cZq0HuWe.mjs").then(({ runAuthRouter }) => runAuthRouter(r, p)));
+			case "account": return runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (r, p) => import("../account-cmd-CQ2wi4Th.mjs").then(({ runAccountCommand }) => runAccountCommand(r, p)));
+			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-CjNB09OF.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
+			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-bSmZ1d5L.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
 			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-B44I8J_W.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
 			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-DN9sSNiV.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
 			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
 			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
 			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-Dpt0jd-x.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-CYq8VQ96.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BAJbaEVn.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-dMnE_Lat.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BIo37Y7H.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
 			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
 			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {

package/dist/{cloudflare-auth-B9jPCkV2.mjs → cloudflare-auth-C4_GPZr0.mjs}

@@ -173,7 +173,11 @@ function cloudflareAuthEnvironment(source = process.env) {
 		"WRANGLER_OUTPUT_FILE_PATH",
 		"WRANGLER_LOG_SANITIZE"
 	]);
-	for (const key of Object.keys(env)) if (/^VOID_PLATFORM_/i.test(key) || /^(?:DATABASE_URL|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET|CF_ACCESS_TOKEN|VOID_ACCESS_CREDENTIALS|VOID_ACCESS_ORIGIN)$/i.test(key) || scrubbedWranglerKeys.has(key.toUpperCase())) delete env[key];
+	for (const key of Object.keys(env)) {
+		if (/^VOID_PLATFORM_/i.test(key) || /^(?:DATABASE_URL|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET|CF_ACCESS_TOKEN|VOID_ACCESS_CREDENTIALS|VOID_ACCESS_ORIGIN)$/i.test(key) || scrubbedWranglerKeys.has(key.toUpperCase())) delete env[key];
+		if (key.toUpperCase() === "CLOUDFLARE_AUTH_USE_KEYRING") delete env[key];
+	}
+	env.CLOUDFLARE_AUTH_USE_KEYRING = "true";
 	return env;
 }
 function isCleanExit(result) {

package/dist/{cloudflare-cmd-BjNxR1XF.mjs → cloudflare-cmd-bSmZ1d5L.mjs}

@@ -1,7 +1,7 @@
 import { t as basename } from "./dist-BVqXeR_h.mjs";
 import { v as readRootWranglerConfig } from "./wrangler-BymcxrRa.mjs";
 import { j as log } from "./dist-Dn6nn2IU.mjs";
-import { a as createBundledCloudflareAuthRunner, i as cloudflareCredentialOverrides, o as ensureCloudflareAuthentication, s as parseCloudflareAuthSession } from "./cloudflare-auth-B9jPCkV2.mjs";
+import { a as createBundledCloudflareAuthRunner, i as cloudflareCredentialOverrides, o as ensureCloudflareAuthentication, s as parseCloudflareAuthSession } from "./cloudflare-auth-C4_GPZr0.mjs";
 //#region src/cli/cloudflare-cmd.ts
 async function runCloudflareCommand(root, args) {
 	const runWrangler = createBundledCloudflareAuthRunner(root);

package/dist/{cloudflare-connect-CCUozPOe.mjs → cloudflare-connect-jAwacxxP.mjs}

@@ -1,7 +1,7 @@
 import { a as join, t as basename } from "./dist-BVqXeR_h.mjs";
 import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler-BymcxrRa.mjs";
 import { I as select, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { a as createBundledCloudflareAuthRunner, o as ensureCloudflareAuthentication } from "./cloudflare-auth-B9jPCkV2.mjs";
+import { a as createBundledCloudflareAuthRunner, o as ensureCloudflareAuthentication } from "./cloudflare-auth-C4_GPZr0.mjs";
 import { existsSync } from "node:fs";
 //#region src/cli/cloudflare-connect.ts
 async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY)) {

package/dist/{connect-4Ph5Y0QE.mjs → connect-BY38i-9E.mjs}

@@ -3,9 +3,9 @@ import { o as listPlatformConnections, s as normalizePlatformApiUrl } from "./pl
 import { i as readDeploymentPlatform, l as writeDeploymentPlatform, u as writePlatformSelection } from "./project-C0Fqu05O.mjs";
 import { I as select, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
 import { i as isExpiredTokenError, n as PlatformClient } from "./client-QTl6ko_D.mjs";
-import { t as promptForLoginToken } from "./login-BQyISZuW.mjs";
-import { i as saveDiscoveredPlatform, n as promptPlatformUrl, t as discoverPlatform } from "./platform-cmd-CRSKfu8k.mjs";
-import { t as connectCloudflare } from "./cloudflare-connect-CCUozPOe.mjs";
+import { t as promptForLoginToken } from "./login-DZldyb8c.mjs";
+import { i as saveDiscoveredPlatform, n as promptPlatformUrl, t as discoverPlatform } from "./platform-cmd-BtxZrT6w.mjs";
+import { t as connectCloudflare } from "./cloudflare-connect-jAwacxxP.mjs";
 //#region src/cli/connect.ts
 async function selectVoidPlatform(interactive) {
 	if (!interactive) throw new Error("connect: Supply a Void platform URL in non-interactive mode.");

package/dist/{db-BAJbaEVn.mjs → db-BIo37Y7H.mjs}

@@ -862,7 +862,7 @@ async function runMigrate(root, dialect, remote) {
 				log.error(getErrorMessage(error));
 				process.exit(1);
 			}
-			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-CmePjn6m.mjs");
+			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-BM_LoBXC.mjs");
 			const applySet = await checkWranglerMigrationApplySet(context.operation.configPath, parseRootWranglerConfig(context.operation.configPath), binding, context.migrationsDir, rawMigrations);
 			if (!applySet.ok) {
 				log.error(applySet.reason);

package/dist/{deploy-CmePjn6m.mjs → deploy-BM_LoBXC.mjs}

@@ -1,2 +1,2 @@
-import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-BfZyWZIn.mjs";
+import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-C0JaQSWS.mjs";
 export { checkWranglerMigrationApplySet, parseRootWranglerConfig, runDeploy };

package/dist/{deploy-BfZyWZIn.mjs → deploy-C0JaQSWS.mjs}

@@ -36,7 +36,7 @@ import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
 import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
 import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-UHj9ARyP.mjs";
-import { o as ensureCloudflareAuthentication, r as cloudflareAuthNeedsTerminal, t as CloudflareAuthenticationError } from "./cloudflare-auth-B9jPCkV2.mjs";
+import { i as cloudflareCredentialOverrides, o as ensureCloudflareAuthentication, r as cloudflareAuthNeedsTerminal, s as parseCloudflareAuthSession, t as CloudflareAuthenticationError } from "./cloudflare-auth-C4_GPZr0.mjs";
 import { n as writeVoidProjectConfig } from "./config-write-BSduPMY8.mjs";
 import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-B8KuoYsO.mjs";
 import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-sMZXpk_S.mjs";
@@ -44,7 +44,7 @@ import { t as formatCloudflareUserMessage } from "./cloudflare-user-output-Q-k0Q
 import { a as promptProjectSetupAction, i as promptProjectSelection, r as promptAndCreateProject } from "./create-project-DBfFSZKY.mjs";
 import { t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { t as promptForLoginToken } from "./login-BQyISZuW.mjs";
+import { t as promptForLoginToken } from "./login-DZldyb8c.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -56,8 +56,8 @@ import { execFile, execSync, spawn, spawnSync } from "node:child_process";
 import { applyEdits, modify, parse } from "jsonc-parser";
 import { isDeepStrictEqual } from "node:util";
 import { Minimatch } from "minimatch";
-import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
-import { getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
+import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
+import { getWorkerAssetsDir, getWorkerBundleDir, getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import ignore from "ignore";
 import { hash } from "blake3-jit";
 //#region src/asset-routing.ts
@@ -1857,6 +1857,324 @@ async function prerenderPagesNode(options) {
 	return result;
 }
 //#endregion
+//#region src/cli/cf-version-api.ts
+function object(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function requiredString(value, label) {
+	if (typeof value !== "string" || !value) throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
+	return value;
+}
+function textValue(value, label) {
+	if (typeof value !== "string") throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
+	return value;
+}
+const moduleContentTypes = {
+	esm: "application/javascript+module",
+	cjs: "application/javascript",
+	wasm: "application/wasm",
+	text: "text/plain",
+	data: "application/octet-stream",
+	json: "text/plain",
+	sourcemap: "application/source-map"
+};
+function bindingsFromOutput(env, workerName, activeSecrets, explicitSecrets) {
+	const inherited = new Map(activeSecrets.bindings.map((binding) => [binding.name, binding.type]));
+	const names = /* @__PURE__ */ new Set([
+		...Object.keys(env),
+		...inherited.keys(),
+		...Object.keys(explicitSecrets)
+	]);
+	const bindings = [];
+	for (const name of names) {
+		const value = object(env[name]);
+		const explicit = explicitSecrets[name];
+		if (explicit !== void 0) {
+			if (typeof explicit !== "string" || inherited.get(name) === "secret_key" || value && value.type !== "secret") throw new Error(`Cloudflare secret ${name} has an invalid explicit value or binding.`);
+			bindings.push({
+				name,
+				type: "secret_text",
+				text: explicit
+			});
+			continue;
+		}
+		if (inherited.has(name)) {
+			if (value && ![
+				"secret",
+				"inherit",
+				"unsafe:inherit"
+			].includes(String(value.type))) throw new Error(`Cloudflare secret ${name} conflicts with a Worker binding.`);
+			bindings.push({
+				name,
+				type: "inherit",
+				version_id: activeSecrets.versionId
+			});
+			continue;
+		}
+		if (!value) throw new Error(`Cloudflare binding ${name} is missing from the Worker output.`);
+		switch (value.type) {
+			case "text":
+				bindings.push({
+					name,
+					type: "plain_text",
+					text: textValue(value.value, name)
+				});
+				break;
+			case "json":
+				bindings.push({
+					name,
+					type: "json",
+					json: value.value
+				});
+				break;
+			case "kv":
+				bindings.push({
+					name,
+					type: "kv_namespace",
+					namespace_id: requiredString(value.id, name)
+				});
+				break;
+			case "d1":
+				bindings.push({
+					name,
+					type: "d1",
+					database_id: requiredString(value.id, name)
+				});
+				break;
+			case "r2":
+				bindings.push({
+					name,
+					type: "r2_bucket",
+					bucket_name: requiredString(value.name, name),
+					...value.jurisdiction ? { jurisdiction: value.jurisdiction } : {}
+				});
+				break;
+			case "durable-object":
+				bindings.push({
+					name,
+					type: "durable_object_namespace",
+					class_name: requiredString(value.exportName, name),
+					...value.worker !== workerName ? { script_name: requiredString(value.worker, name) } : {}
+				});
+				break;
+			case "assets":
+				bindings.push({
+					name,
+					type: "assets"
+				});
+				break;
+			default: throw new Error(`Cloudflare binding ${name} cannot be uploaded with pinned secrets.`);
+		}
+	}
+	return bindings;
+}
+function exportsFromOutput(exports) {
+	if (exports === void 0) return;
+	const entries = object(exports);
+	if (!entries) throw new Error("Cloudflare Durable Object exports were not readable.");
+	const result = {};
+	for (const [name, raw] of Object.entries(entries)) {
+		const value = object(raw);
+		if (!value || value.type !== "durable-object") throw new Error(`Cloudflare export ${name} cannot be uploaded with pinned secrets.`);
+		if (value.state === "deleted") result[name] = {
+			type: "durable-object",
+			state: "deleted"
+		};
+		else if (value.storage === "sqlite" || value.storage === "legacy-kv") result[name] = {
+			type: "durable-object",
+			storage: value.storage,
+			state: "created"
+		};
+		else throw new Error(`Cloudflare Durable Object export ${name} has no storage type.`);
+	}
+	return result;
+}
+function assetConfigFromOutput(value) {
+	if (value === void 0) return;
+	const config = object(value);
+	if (!config) throw new Error("Cloudflare asset configuration was not readable.");
+	const supported = /* @__PURE__ */ new Set([
+		"basePath",
+		"htmlHandling",
+		"notFoundHandling",
+		"runWorkerFirst"
+	]);
+	if (Object.keys(config).some((key) => !supported.has(key))) throw new Error("Cloudflare asset configuration has an unsupported setting.");
+	return {
+		...config.basePath === void 0 ? {} : { base_path: config.basePath },
+		...config.htmlHandling === void 0 ? {} : { html_handling: config.htmlHandling },
+		...config.notFoundHandling === void 0 ? {} : { not_found_handling: config.notFoundHandling },
+		...config.runWorkerFirst === void 0 ? {} : { run_worker_first: config.runWorkerFirst }
+	};
+}
+async function apiResult(url, token, method, body, verifyUploader, timeout = 12e4) {
+	if (!verifyUploader()) throw new Error("The Cloudflare uploader changed during deployment.");
+	const form = body instanceof FormData;
+	const response = await fetch(url, {
+		method,
+		headers: {
+			Authorization: `Bearer ${token}`,
+			...body && !form ? { "Content-Type": "application/json" } : {}
+		},
+		...body ? { body: form ? body : JSON.stringify(body) } : {},
+		redirect: "manual",
+		signal: AbortSignal.timeout(timeout)
+	});
+	const parsed = object(await response.json());
+	const result = object(parsed?.result);
+	if (!response.ok || parsed?.success !== true || !result) {
+		const error = Array.isArray(parsed?.errors) ? object(parsed.errors[0]) : null;
+		const code = Number.isSafeInteger(error?.code) ? ` [code: ${error.code}]` : "";
+		const message = typeof error?.message === "string" ? ` ${error.message}` : "";
+		throw new Error(`Cloudflare version upload failed (${response.status})${code}.${message}`);
+	}
+	return result;
+}
+async function uploadAssets(options) {
+	if (!options.output.assetsDirectory) return;
+	const directory = getWorkerAssetsDir(options.output.directory);
+	const manifest = {};
+	const byHash = /* @__PURE__ */ new Map();
+	const ignored = ignore().add([
+		"/.assetsignore",
+		"/_headers",
+		"/_redirects",
+		".DS_Store",
+		".env",
+		".env.*",
+		".dev.vars",
+		".dev.vars.*"
+	]);
+	const ignorePath = join(directory, ".assetsignore");
+	try {
+		ignored.add(readFileSync(ignorePath, "utf8"));
+	} catch (cause) {
+		if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT")) throw cause;
+	}
+	for (const entry of readdirSync(directory, {
+		recursive: true,
+		withFileTypes: true
+	})) {
+		if (entry.isDirectory()) continue;
+		if (!entry.isFile()) throw new Error("The Cloudflare asset output contains an unsupported entry.");
+		const path = join(entry.parentPath, entry.name);
+		const relativeName = relative(directory, path).replaceAll("\\", "/");
+		if (ignored.ignores(relativeName)) continue;
+		const name = `/${relativeName}`;
+		const content = readFileSync(path);
+		const extension = extname(entry.name).slice(1);
+		const hash = createHash("sha256").update(content.toString("base64") + extension).digest("hex").slice(0, 32);
+		manifest[name] = {
+			hash,
+			size: content.length
+		};
+		byHash.set(hash, path);
+	}
+	const session = await apiResult(`${options.accountUrl}/workers/scripts/${encodeURIComponent(options.workerName)}/assets-upload-session`, options.token, "POST", { manifest }, options.verifyUploader);
+	const uploadJwt = requiredString(session.jwt, "asset upload token");
+	if (!Array.isArray(session.buckets)) throw new Error("Cloudflare did not provide asset upload batches.");
+	if (session.buckets.length === 0) return uploadJwt;
+	let completionJwt;
+	for (const bucket of session.buckets) {
+		if (!Array.isArray(bucket) || !bucket.every((hash) => typeof hash === "string")) throw new Error("Cloudflare returned an invalid asset upload batch.");
+		const form = new FormData();
+		for (const hash of bucket) {
+			const path = byHash.get(hash);
+			if (!path) throw new Error("Cloudflare requested an asset outside the verified Worker output.");
+			form.append(hash, readFileSync(path).toString("base64"));
+		}
+		const uploaded = await apiResult(`${options.accountUrl}/workers/assets/upload?base64=true`, uploadJwt, "POST", form, options.verifyUploader);
+		if (uploaded.jwt !== void 0) completionJwt = requiredString(uploaded.jwt, "asset completion token");
+	}
+	return requiredString(completionJwt, "asset completion token");
+}
+/** The Workers beta API is the only upload endpoint that accepts a version UUID as an inheritance source. */
+async function uploadPinnedCloudflareVersion(options) {
+	const activeSecrets = options.output.activeSecrets;
+	if (!activeSecrets) throw new Error("The active Worker secret source was not verified.");
+	const config = (await readBuildOutput(options.output.directory)).workers.default.config;
+	if (config.name !== options.workerName || !config.manifest || config.manifest.type !== "complete") throw new Error("The verified Cloudflare Worker output changed before upload.");
+	const unsupported = Object.keys(config).filter((key) => !(/* @__PURE__ */ new Set([
+		"name",
+		"compatibilityDate",
+		"compatibilityFlags",
+		"assets",
+		"domains",
+		"observability",
+		"workersDev",
+		"previewUrls",
+		"unsafe",
+		"env",
+		"exports",
+		"manifest",
+		"triggers"
+	])).has(key));
+	if (unsupported.length) throw new Error(`Cloudflare Worker setting ${unsupported[0]} cannot be uploaded with pinned secrets.`);
+	const unsafe = object(config.unsafe);
+	const metadata = object(unsafe?.metadata);
+	if (unsafe && Object.keys(unsafe).some((key) => key !== "metadata") || metadata && Object.keys(metadata).some((key) => key !== "keep_bindings") || metadata?.keep_bindings !== void 0 && (!Array.isArray(metadata.keep_bindings) || !metadata.keep_bindings.every((type) => typeof type === "string"))) throw new Error("Cloudflare Worker upload metadata has an unsupported setting.");
+	const explicitSecrets = options.secretsFilePath ? object(JSON.parse(readFileSync(options.secretsFilePath, "utf8"))) : {};
+	if (!explicitSecrets) throw new Error("The explicit Cloudflare secrets file was not readable.");
+	const bindings = bindingsFromOutput(config.env ?? {}, options.workerName, activeSecrets, explicitSecrets);
+	const active = await apiResult(`${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/workers/${encodeURIComponent(options.workerName)}/versions/${encodeURIComponent(activeSecrets.versionId)}`, options.token, "GET", void 0, options.verifyUploader);
+	if (active.id !== activeSecrets.versionId || !Array.isArray(active.bindings)) throw new Error("The active Cloudflare Worker bindings could not be verified.");
+	const activeBindingNames = /* @__PURE__ */ new Set();
+	const candidateNames = new Set(bindings.map((binding) => String(binding.name)));
+	const keptTypes = new Set(metadata?.keep_bindings ?? []);
+	for (const entry of active.bindings) {
+		const binding = object(entry);
+		if (!binding || typeof binding.name !== "string" || typeof binding.type !== "string") throw new Error("The active Cloudflare Worker bindings could not be verified.");
+		activeBindingNames.add(binding.name);
+		if (!candidateNames.has(binding.name) && keptTypes.has(binding.type) && ["plain_text", "json"].includes(binding.type)) {
+			bindings.push({
+				name: binding.name,
+				type: "inherit",
+				version_id: activeSecrets.versionId
+			});
+			candidateNames.add(binding.name);
+		}
+	}
+	if (activeSecrets.bindings.some(({ name }) => !activeBindingNames.has(name))) throw new Error("The active Cloudflare Worker secrets changed before upload.");
+	const exports = exportsFromOutput(config.exports);
+	const assetConfig = assetConfigFromOutput(config.assets);
+	if (bindings.some((binding) => binding.type === "assets") && !options.output.assetsDirectory) throw new Error("The Cloudflare Worker has an assets binding without verified assets.");
+	const modules = [];
+	for (const [name, entry] of Object.entries(config.manifest.modules)) {
+		const type = moduleContentTypes[entry.type];
+		if (!type || name.startsWith("/") || name.split("/").includes("..")) throw new Error(`Cloudflare Worker module ${name} cannot be uploaded with pinned secrets.`);
+		modules.push({
+			name,
+			content_type: type,
+			content_base64: readFileSync(join(getWorkerBundleDir(options.output.directory), name)).toString("base64")
+		});
+	}
+	const accountUrl = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}`;
+	const jwt = await uploadAssets({
+		output: options.output,
+		accountUrl,
+		workerName: options.workerName,
+		token: options.token,
+		verifyUploader: options.verifyUploader
+	});
+	const uploaded = await apiResult(`${accountUrl}/workers/workers/${encodeURIComponent(options.workerName)}/versions${options.atomic ? "?deploy=true" : ""}`, options.token, "POST", {
+		main_module: config.manifest.mainModule,
+		modules,
+		compatibility_date: config.compatibilityDate,
+		compatibility_flags: config.compatibilityFlags,
+		bindings,
+		...exports ? { exports } : {},
+		...jwt ? { assets: {
+			jwt,
+			...assetConfig ? { config: assetConfig } : {}
+		} } : {},
+		annotations: { "workers/message": options.message ?? "" }
+	}, options.verifyUploader);
+	return {
+		id: requiredString(uploaded.id, "Worker Version ID"),
+		urls: Array.isArray(uploaded.urls) ? uploaded.urls.filter((url) => typeof url === "string") : []
+	};
+}
+//#endregion
 //#region src/cli/cf-version-runner.ts
 function failed(message) {
 	return {
@@ -1897,7 +2215,7 @@ function createActiveSecretPinner(options) {
 		explicitNames: options.explicitNames
 	});
 }
-/** Pin opaque secrets to the live version in the private, disposable Build Output. */
+/** Record the live secret source for the version-aware API uploader. */
 async function pinActiveWorkerSecrets(options) {
 	const { activeVersionId, bindings, requiredNames, explicitNames = [] } = options;
 	if (!/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(activeVersionId)) return false;
@@ -1908,31 +2226,17 @@ async function pinActiveWorkerSecrets(options) {
 	const path = getWorkerConfigPath(options.output.directory);
 	const worker = parseJson(readFileSync(path, "utf8"));
 	if (!record(worker) || worker.env !== void 0 && !record(worker.env)) return false;
-	const env = { ...worker.env ?? {} };
-	for (const name of explicit) delete env[name];
+	const env = worker.env ?? {};
 	for (const [name, value] of Object.entries(env)) if (record(value) && (value.type === "secret" || value.type === "inherit" || value.type === "unsafe:inherit") && !secretNames.has(name) && !explicit.has(name)) return false;
 	for (const { name } of bindings) {
 		if (explicit.has(name)) continue;
 		const current = env[name];
 		if (current !== void 0 && (!record(current) || current.type !== "secret" && current.type !== "inherit" && current.type !== "unsafe:inherit")) return false;
-		env[name] = {
-			type: "unsafe:inherit",
-			version_id: activeVersionId
-		};
 	}
-	const unsafe = record(worker.unsafe) ? { ...worker.unsafe } : {};
-	const metadata = record(unsafe.metadata) ? { ...unsafe.metadata } : {};
-	if (metadata.bindings !== void 0) return false;
-	if (metadata.keep_bindings !== void 0 && (!Array.isArray(metadata.keep_bindings) || !metadata.keep_bindings.every((type) => typeof type === "string"))) return false;
-	metadata.keep_bindings = (metadata.keep_bindings ?? []).filter((type) => type !== "secret_text" && type !== "secret_key");
-	unsafe.metadata = metadata;
-	const next = {
-		...worker,
-		env,
-		unsafe
+	options.output.activeSecrets = {
+		versionId: activeVersionId,
+		bindings: [...bindings]
 	};
-	writeFileSync(path, JSON.stringify(next), { mode: 384 });
-	await readBuildOutput(options.output.directory);
 	return true;
 }
 /** Prevent cf's prebuilt uploader from creating a resource as a side effect. */
@@ -2089,6 +2393,32 @@ function createCfVersionRunner(options) {
 			return failed("Cloudflare resources could not be verified before upload.");
 		}
 	};
+	const uploadPinnedVersion = async (args, atomic) => {
+		if (!options.pinnedUpload || !options.pinnedUpload.verifyUploader()) return failed("The version-aware Cloudflare uploader is unavailable.");
+		const token = await options.pinnedUpload.getToken();
+		if (!token) return failed("Cloudflare session has no bearer for version-aware upload.");
+		try {
+			const version = await uploadPinnedCloudflareVersion({
+				output,
+				accountId: options.pinnedUpload.accountId,
+				apiBaseUrl: options.pinnedUpload.apiBaseUrl,
+				workerName,
+				token,
+				...flag(args, "--message") ? { message: flag(args, "--message") } : {},
+				...flag(args, "--secrets-file") ? { secretsFilePath: flag(args, "--secrets-file") } : {},
+				atomic,
+				verifyUploader: options.pinnedUpload.verifyUploader
+			});
+			const preview = version.urls.find((url) => /^https:\/\//.test(url));
+			return {
+				status: 0,
+				stdout: `Worker Version ID: ${version.id}\n${preview ? `Version Preview URL: ${preview}\n` : ""}`,
+				stderr: ""
+			};
+		} catch (cause) {
+			return failed(cause instanceof Error ? cause.message : "Cloudflare version upload failed.");
+		}
+	};
 	return async (args, command) => {
 		if (args[0] === "deployments" && args[1] === "status") {
 			const result = await run([
@@ -2184,6 +2514,7 @@ function createCfVersionRunner(options) {
 			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare version upload target changed.");
 			const verified = await verifyResources(output.directory);
 			if (verified.status !== 0 || verified.signal || verified.error) return verified;
+			if (output.activeSecrets) return uploadPinnedVersion(args, false);
 			return run([
 				"workers",
 				"versions",
@@ -2228,6 +2559,7 @@ function createCfVersionRunner(options) {
 			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare bootstrap target changed.");
 			const verified = await verifyResources(output.directory);
 			if (verified.status !== 0 || verified.signal || verified.error) return verified;
+			if (output.activeSecrets) return uploadPinnedVersion(args, true);
 			return run([
 				"deploy",
 				"--prebuilt",
@@ -6419,6 +6751,42 @@ function createDeployWranglerRunner(root, accountId, apiBaseUrl) {
 		};
 	};
 }
+/** Retry an existing-Worker read only when a fresh identity check proves the session is gone. */
+async function prepareExistingCloudflareDeployWithAuth(options, beforeRun) {
+	try {
+		return await prepareExistingCloudflareDeploy(options);
+	} catch (error) {
+		if (!(error instanceof CloudflareWorkerInspectionError)) throw error;
+		if (!beforeRun()) throw new CloudflareAuthenticationError("The Cloudflare uploader changed during Worker verification.", "uploader-changed");
+		const whoamiArgs = [...existingWranglerConfigArgs(options.configPath), "--env="];
+		const identity = await options.runWrangler([
+			"whoami",
+			"--json",
+			...whoamiArgs
+		], { capture: true });
+		const session = isCleanWranglerExit(identity) ? parseCloudflareAuthSession(identity.stdout) : null;
+		const wrongAccount = session !== null && session.accounts.length > 0 && !session.accounts.some((account) => account.id === options.accountId);
+		if (session && !wrongAccount) throw error;
+		let loggedOut = false;
+		try {
+			loggedOut = JSON.parse(identity.stdout).loggedIn === false;
+		} catch {}
+		if (!(loggedOut || wrongAccount || /authentication is required|not authenticated|no api token|invalid.*token|expired.*token|unauthorized/i.test(identity.stderr)) || identity.signal || identity.error) throw new Error("Could not verify the Cloudflare session after the Worker check failed. Run `void cloudflare status` and retry.");
+		const overrides = cloudflareCredentialOverrides();
+		if (overrides.length > 0) throw new Error(`Cloudflare credentials from ${overrides.join(", ")} were rejected or cannot access account ${options.accountId}. Correct or unset them, then retry the deploy.`);
+		if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error(wrongAccount ? `The Cloudflare session cannot access account ${options.accountId}. Run \`void cloudflare login\` with the correct user, or set a token for that account in CI, then retry.` : "Cloudflare authentication expired or is unavailable. Run `void cloudflare login` in a terminal, or set CLOUDFLARE_API_TOKEN in CI, then retry.");
+		log.warn(wrongAccount ? "The current Cloudflare session cannot access the deployment account. Signing in before retrying the Worker check." : "Cloudflare session is unavailable. Signing in before retrying the Worker check.");
+		if (!(await ensureCloudflareAuthentication({
+			forceLogin: true,
+			requireAccounts: true,
+			beforeRun,
+			runWrangler: (args, capture) => options.runWrangler([...args], { capture }),
+			whoamiArgs
+		})).accounts.some((account) => account.id === options.accountId)) throw new Error(`The signed-in Cloudflare user cannot access account ${options.accountId}. Sign in with a user who can access it, then retry.`);
+		if (!beforeRun()) throw new CloudflareAuthenticationError("The Cloudflare uploader changed during sign-in.", "uploader-changed");
+		return await prepareExistingCloudflareDeploy(options);
+	}
+}
 async function chooseCloudflareDeployAccount(options) {
 	const accounts = (await ensureCloudflareAuthentication({
 		beforeRun: options.beforeWranglerRun,
@@ -7085,7 +7453,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	if (options.reuseExistingWorker || initialCloudflareLink) {
 		if (authEnabled || needsSandbox || needsAI || expectedCrons.length || desired.queues.length || preBuildMigrations.length) throw new Error("Link the existing site without adding runtime features, auth setup, or database migrations. Make those changes in a later deployment.");
 		approvedHandoffKv = approvedCloudflareIsrBinding(voidConfig, rootConfig);
-		existingWorker = await prepareExistingCloudflareDeploy({
+		existingWorker = await prepareExistingCloudflareDeployWithAuth({
 			root,
 			configPath,
 			accountId,
@@ -7094,7 +7462,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			approvedKv: approvedHandoffKv
-		});
+		}, assertUploaderStillPinned);
 		pinnedHandoffLink = readCloudflareLink(root);
 		if (!pinnedHandoffLink) throw new Error("The pending Cloudflare handoff was not saved before deployment.");
 		rootConfig = parseRootWranglerConfig(configPath);
@@ -7504,6 +7872,12 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		output: cfOutput,
 		workerName,
 		runCf: cfCommand,
+		pinnedUpload: {
+			accountId,
+			apiBaseUrl,
+			getToken: () => runWranglerAuthToken(runWrangler, generatedConfigPath),
+			verifyUploader: cfUploaderIsPinned
+		},
 		verifyResources: createCfResourceVerifier({
 			configPath: generatedConfigPath,
 			runCf: cfCommand,
@@ -7871,7 +8245,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		log.error(`deploy: ${getErrorMessage(error)}`);
 		return exit(1);
 	}
-	const existingWorker = await prepareExistingCloudflareDeploy({
+	const existingWorker = await prepareExistingCloudflareDeployWithAuth({
 		root,
 		configPath,
 		accountId,
@@ -7879,7 +8253,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		pinnedLink: initialCloudflareLink,
 		runWrangler,
 		readExistingWorker: deps.readExistingWorker
-	});
+	}, uploaderIsPinned);
 	const pinnedHandoffLink = existingWorker ? readCloudflareLink(root) : null;
 	if (existingWorker && !pinnedHandoffLink) throw new Error("The pending Cloudflare handoff was not saved before deployment.");
 	rootConfig = parseRootWranglerConfig(configPath);
@@ -7983,6 +8357,12 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		output: cfOutput,
 		workerName,
 		runCf: cfCommand,
+		pinnedUpload: {
+			accountId,
+			apiBaseUrl,
+			getToken: () => runWranglerAuthToken(runWrangler, staticConfigPath),
+			verifyUploader: cfUploaderIsPinned
+		},
 		verifyResources: createCfResourceVerifier({
 			configPath: staticConfigPath,
 			runCf: cfCommand,

package/dist/{email-CYq8VQ96.mjs → email-dMnE_Lat.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { c as import_picocolors, i as createSpinner } from "./output-CCH48AMM.mjs";
-import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-BfZyWZIn.mjs";
+import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-C0JaQSWS.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { c as getToken, d as openBrowser } from "./auth-DLNN0D3Z.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, l as relative, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { d as require_picocolors } from "./output-CCH48AMM.mjs";
-import { G as resolveWorkerDirName, St as hasDocumentRoutes, V as resolveDistDir, ct as prerenderPagesNode, dt as collectRevalidate, ft as hasRevalidate, mt as SEND_EMAIL_BINDING, ot as generateQueueResolverSource, pt as scanDurableObjectModules, st as prerenderPages, ut as collectPages, wt as resolveAssetRoutingPolicy, xt as hasApiRoutes } from "./deploy-BfZyWZIn.mjs";
+import { G as resolveWorkerDirName, St as hasDocumentRoutes, V as resolveDistDir, ct as prerenderPagesNode, dt as collectRevalidate, ft as hasRevalidate, mt as SEND_EMAIL_BINDING, ot as generateQueueResolverSource, pt as scanDurableObjectModules, st as prerenderPages, ut as collectPages, wt as resolveAssetRoutingPolicy, xt as hasApiRoutes } from "./deploy-C0JaQSWS.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
 import { r as scopedAccessCredentials } from "./cf-access-DRsQRe6k.mjs";

package/dist/{init-CRGDXzVC.mjs → init-CJSnEcuj.mjs}

@@ -17,9 +17,9 @@ import { r as formatProjectCommand } from "./preset-UHj9ARyP.mjs";
 import { n as writeVoidProjectConfig, t as canRewriteVoidProjectConfig } from "./config-write-BSduPMY8.mjs";
 import { i as migrateFrameworkAdapterPaths, t as migrateLegacyVoidConfig } from "./migrate-B8KuoYsO.mjs";
 import { i as promptProjectSelection, r as promptAndCreateProject } from "./create-project-DBfFSZKY.mjs";
-import { t as promptForLoginToken } from "./login-BQyISZuW.mjs";
-import { i as saveDiscoveredPlatform, t as discoverPlatform } from "./platform-cmd-CRSKfu8k.mjs";
-import { t as connectCloudflare } from "./cloudflare-connect-CCUozPOe.mjs";
+import { t as promptForLoginToken } from "./login-DZldyb8c.mjs";
+import { i as saveDiscoveredPlatform, t as discoverPlatform } from "./platform-cmd-BtxZrT6w.mjs";
+import { t as connectCloudflare } from "./cloudflare-connect-jAwacxxP.mjs";
 import { n as findInstalledYarnPnpRuntime, r as hasLocalLockfile, t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-BV4AzNul.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";

package/dist/{login-BQyISZuW.mjs → login-DZldyb8c.mjs}

@@ -29,7 +29,7 @@ async function selectPlatformLoginMethod(platform, requestedId) {
 	return methods.find((method) => method.id === provider);
 }
 async function promptForLoginToken(root = process.cwd(), platform) {
-	const { id: provider, label: providerName } = await selectPlatformLoginMethod(platform ?? await import("./platform-cmd-C8OqhqPt.mjs").then(({ discoverPlatform }) => discoverPlatform(getApiUrl(root))));
+	const { id: provider, label: providerName } = await selectPlatformLoginMethod(platform ?? await import("./platform-cmd-CjNB09OF.mjs").then(({ discoverPlatform }) => discoverPlatform(getApiUrl(root))));
 	const s = createSpinner();
 	s.start(`Opening browser for ${providerName} login...`);
 	try {

package/dist/login-t6rndSRW.mjs

@@ -0,0 +1,2 @@
+import { r as selectPlatformLoginMethod } from "./login-DZldyb8c.mjs";
+export { selectPlatformLoginMethod };

package/dist/{operator-cmd-Co-PeaeD.mjs → operator-cmd-B9dbG3Od.mjs}

@@ -137,8 +137,8 @@ async function runAuth(origin, args) {
 	if (args.action === "login" || args.action === "token" && args.tokenStdin) {
 		if (!args.tokenStdin && !process.stdin.isTTY) throw new OperatorClientError("Browser login requires an interactive terminal. Use --token-stdin to exchange an API session.", "interactive_login_required");
 		const apiToken = args.tokenStdin ? await readOperatorApiTokenStdin() : await (async () => {
-			const { discoverPlatform } = await import("./platform-cmd-C8OqhqPt.mjs");
-			const { selectPlatformLoginMethod } = await import("./login-r2gL8l7B.mjs");
+			const { discoverPlatform } = await import("./platform-cmd-CjNB09OF.mjs");
+			const { selectPlatformLoginMethod } = await import("./login-t6rndSRW.mjs");
 			const { runPlatformLogin } = await import("./auth-CZuiVsFh.mjs");
 			return runPlatformLogin(origin, (await selectPlatformLoginMethod(await discoverPlatform(origin), args.providerExplicit ? args.provider : void 0)).id, (url) => process.stderr.write(`Sign in at ${url}\n`));
 		})();

package/dist/{platform-auth-config-TSw8edHw.mjs → platform-auth-config-Bex45lQt.mjs}

@@ -140,11 +140,11 @@ async function configurationInput(args, existing) {
 }
 async function runPlatformAuthConfig(args) {
 	if (args.action === "recover") {
-		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-BkT3EsF2.mjs");
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-COOhMCvx.mjs");
 		return runPlatformAuthRecovery(args);
 	}
 	if (args.action === "protection") {
-		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-Ba1XqGhn.mjs");
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-Dma02l6-.mjs");
 		return runPlatformProtectionConfig(args);
 	}
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-auth-protection-Ba1XqGhn.mjs → platform-auth-protection-Dma02l6-.mjs}

@@ -4,8 +4,8 @@ import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
 import { E as confirm, W as isCancel } from "./dist-Dn6nn2IU.mjs";
 import { n as OperatorClient } from "./operator-client-DUwumHpQ.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-8KnOVXVd.mjs";
-import { D as preparePlatformAccessSetup, E as parsePlatformAccessSetupSpec, O as PlatformCloudflareClient, T as checkpointPlatformAccessResources, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-78H0XQUA.mjs";
-import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-6w8-DUjC.mjs";
+import { D as preparePlatformAccessSetup, E as parsePlatformAccessSetupSpec, O as PlatformCloudflareClient, T as checkpointPlatformAccessResources, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BpDlxT3t.mjs";
+import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-BKYenDlE.mjs";
 import { createHmac } from "node:crypto";
 import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
 import { readFile } from "node:fs/promises";

package/dist/{platform-auth-recovery-BkT3EsF2.mjs → platform-auth-recovery-COOhMCvx.mjs}

@@ -2,8 +2,8 @@ import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
 import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, t as acquirePlatformLifecycleLock } from "./platform-registry-QBa4DK32.mjs";
 import { E as confirm, W as isCancel } from "./dist-Dn6nn2IU.mjs";
 import { a as resolveOperatorOrigin } from "./operator-auth-8KnOVXVd.mjs";
-import { O as PlatformCloudflareClient, f as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLockConnection, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-78H0XQUA.mjs";
-import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-6w8-DUjC.mjs";
+import { O as PlatformCloudflareClient, f as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLockConnection, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BpDlxT3t.mjs";
+import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-BKYenDlE.mjs";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";

package/dist/{platform-cmd-CRSKfu8k.mjs → platform-cmd-BtxZrT6w.mjs}

@@ -92,12 +92,12 @@ function saveDiscoveredPlatform(discovery) {
 }
 async function runPlatformCommand(_root, args) {
 	if (args.subcommand === "config") {
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-TSw8edHw.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-Bex45lQt.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-Co-PeaeD.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-B9dbG3Od.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -129,7 +129,7 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-DDc9zCeJ.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-CYll-oKE.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 //#endregion

package/dist/{platform-cmd-C8OqhqPt.mjs → platform-cmd-CjNB09OF.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-CRSKfu8k.mjs";
+import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-BtxZrT6w.mjs";
 export { discoverPlatform, runPlatformCommand };

package/dist/{platform-domain-j9YCXRm6.mjs → platform-domain-DppaTARe.mjs}

@@ -1,8 +1,8 @@
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { d as readInstallationRecoverySecrets, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
 import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { C as assertPlatformOperatorCredentialCanApplyPlan, O as PlatformCloudflareClient, _ as createPlatformInstallPlan, c as createPlatformHealthProbeToken, h as recordPlatformWorkerTraffic, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, p as recordResource, t as assertNoninteractivePlatformMutationAcknowledged, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-78H0XQUA.mjs";
-import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-6w8-DUjC.mjs";
+import { C as assertPlatformOperatorCredentialCanApplyPlan, O as PlatformCloudflareClient, _ as createPlatformInstallPlan, c as createPlatformHealthProbeToken, h as recordPlatformWorkerTraffic, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, p as recordResource, t as assertNoninteractivePlatformMutationAcknowledged, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BpDlxT3t.mjs";
+import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-BKYenDlE.mjs";
 import { randomUUID } from "node:crypto";
 import { PLATFORM_APPLICATION_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts

package/dist/{platform-lifecycle-78H0XQUA.mjs → platform-lifecycle-BpDlxT3t.mjs}

@@ -7,7 +7,7 @@ import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f
 import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
 import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-Dn6nn2IU.mjs";
 import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
-import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-B9jPCkV2.mjs";
+import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-C4_GPZr0.mjs";
 import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BhreDAOS.mjs";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
@@ -1499,7 +1499,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Ba1XqGhn.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Dma02l6-.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -5568,14 +5568,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-j9YCXRm6.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-DppaTARe.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-Do8VOyDE.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-dJ5Me-I0.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5585,7 +5585,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-DzKNsMlt.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-BS5r6Ao8.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -5809,7 +5809,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DzKNsMlt.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-BS5r6Ao8.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -6038,7 +6038,7 @@ async function runPlatformLifecycleCommand(args) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DzKNsMlt.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-BS5r6Ao8.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;

package/dist/{platform-lifecycle-DDc9zCeJ.mjs → platform-lifecycle-CYll-oKE.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-78H0XQUA.mjs";
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-BpDlxT3t.mjs";
 export { runPlatformLifecycleCommand };

package/dist/{platform-management-6w8-DUjC.mjs → platform-management-BKYenDlE.mjs}

@@ -1,7 +1,7 @@
 import { i as createSpinner } from "./output-CCH48AMM.mjs";
 import { a as listInstallationManifests, d as readInstallationRecoverySecrets, h as resolveInstallationManifest, m as removePlatformConnectionForInstallation, p as removeInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
 import { E as confirm, I as select, N as note, P as outro, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { A as hyperdriveOriginFromConnectionString, C as assertPlatformOperatorCredentialCanApplyPlan, M as verifyPlatformRuntimeTokenPermissions, O as PlatformCloudflareClient, S as platformDatabaseNameFromOwnerUrl, _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as platformProvisionIntentHash, d as loadPlatformRuntime, g as trackedPlatformWorkerTraffic, j as hyperdriveOriginMatches, k as hyperdriveOriginConfigHash, l as createPlatformInstallationSecrets, m as resolveBootstrapGitHubId, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as installPlatform, v as formatPlatformInstallPlan, w as resolvePlatformCloudflareCredential, x as revalidatePlatformInstallAction, y as platformAdoptionIntentHash } from "./platform-lifecycle-78H0XQUA.mjs";
+import { A as hyperdriveOriginFromConnectionString, C as assertPlatformOperatorCredentialCanApplyPlan, M as verifyPlatformRuntimeTokenPermissions, O as PlatformCloudflareClient, S as platformDatabaseNameFromOwnerUrl, _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as platformProvisionIntentHash, d as loadPlatformRuntime, g as trackedPlatformWorkerTraffic, j as hyperdriveOriginMatches, k as hyperdriveOriginConfigHash, l as createPlatformInstallationSecrets, m as resolveBootstrapGitHubId, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as installPlatform, v as formatPlatformInstallPlan, w as resolvePlatformCloudflareCredential, x as revalidatePlatformInstallAction, y as platformAdoptionIntentHash } from "./platform-lifecycle-BpDlxT3t.mjs";
 import { createHash } from "node:crypto";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 //#region src/cli/platform-management.ts

package/dist/{platform-management-DzKNsMlt.mjs → platform-management-BS5r6Ao8.mjs}

@@ -1,2 +1,2 @@
-import { c as selectAuthoritativePlatformManifest, s as runInstalledPlatformCommand, u as verifyPlatformInstallationOwnership } from "./platform-management-6w8-DUjC.mjs";
+import { c as selectAuthoritativePlatformManifest, s as runInstalledPlatformCommand, u as verifyPlatformInstallationOwnership } from "./platform-management-BKYenDlE.mjs";
 export { runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };

package/dist/{platform-recovery-Do8VOyDE.mjs → platform-recovery-dJ5Me-I0.mjs}

@@ -1,7 +1,7 @@
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { a as listInstallationManifests, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
-import { _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-78H0XQUA.mjs";
-import { i as recoverDurablyMarkedProvisionIntents, r as isPlatformManifestMonotonicExtension, u as verifyPlatformInstallationOwnership } from "./platform-management-6w8-DUjC.mjs";
+import { _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-BpDlxT3t.mjs";
+import { i as recoverDurablyMarkedProvisionIntents, r as isPlatformManifestMonotonicExtension, u as verifyPlatformInstallationOwnership } from "./platform-management-BKYenDlE.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.21.5",
+  "version": "0.21.7",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -325,11 +325,11 @@
     "@cloudflare/vite-plugin": "1.54.7",
     "@cloudflare/workers-types": "^4.20260702.1",
     "@napi-rs/keyring": "2.0.0",
-    "@void/deploy-cloudflare": "0.21.5",
-    "@void/deploy-core": "0.21.5",
-    "@void/edge": "0.21.5",
-    "@void/isr": "0.21.5",
-    "@void/platform": "0.21.5",
+    "@void/deploy-cloudflare": "0.21.7",
+    "@void/deploy-core": "0.21.7",
+    "@void/edge": "0.21.7",
+    "@void/isr": "0.21.7",
+    "@void/platform": "0.21.7",
     "acorn": "^8.15.0",
     "better-auth": "^1.7.3",
     "better-sqlite3": "^13.0.3",
@@ -379,7 +379,7 @@
     "zod": "^4.6.1"
   },
   "peerDependencies": {
-    "@void/md": "0.21.5",
+    "@void/md": "0.21.7",
     "arktype": ">=2.0.0",
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",

package/dist/login-r2gL8l7B.mjs

@@ -1,2 +0,0 @@
-import { r as selectPlatformLoginMethod } from "./login-BQyISZuW.mjs";
-export { selectPlatformLoginMethod };