void 0.21.8 → 0.22.0

package/dist/sandbox-qpNBT8a3.d.mts

@@ -0,0 +1,49 @@
+import { i as SandboxExecOptions, r as SandboxContainer, s as SandboxOptions } from "./sandbox-container-DdNEBfCc.mjs";
+import { Files } from "@cloudflare/sandbox";
+//#region src/runtime/sandbox.d.ts
+declare const DEFAULT_SANDBOX_ID = "default";
+declare const DEFAULT_SANDBOX_BINDING = "SANDBOX";
+declare const SANDBOX_SERVICE_BINDING = "__VOID_SANDBOX";
+type VoidSandboxOptions = SandboxOptions & {
+  binding?: string;
+  normalizeId?: boolean;
+};
+type SandboxProcess = {
+  pid: number;
+  isPty: boolean;
+  stdin: WritableStream | null;
+  stdout: ReadableStream | null;
+  stderr: ReadableStream | null;
+  readonly exitCode: Promise<number>;
+  output(): Promise<ExecOutput>;
+  kill(signal?: number): Promise<void>;
+  resize(cols: number, rows: number): Promise<void>;
+};
+type SandboxClient = {
+  exec(argv: Array<string>, options?: SandboxExecOptions): Promise<SandboxProcess>;
+  files: Files;
+  fetch(port: number, request: Request): Promise<Response>;
+  running(): Promise<boolean>;
+  destroy(): Promise<void>;
+};
+declare class SandboxLimitError extends Error {
+  override readonly name = "SandboxLimitError";
+  readonly reason: "concurrency" | "runtime_budget";
+  constructor(reason: "concurrency" | "runtime_budget", message?: string);
+}
+declare class SandboxUnavailableError extends Error {
+  override readonly name = "SandboxUnavailableError";
+  constructor(message?: string);
+}
+declare function __setSandboxBindingName(bindingName: string): void;
+/** Generated local/native DO. Managed execution uses the trusted controller. */
+declare class VoidPlatformSandbox<Env = unknown> extends SandboxContainer<Env> {
+  protected override beforeStart(): Promise<void>;
+}
+/** Resolve a container by name. Starts on the first command, file or port operation. */
+declare function getSandbox(id?: string, options?: VoidSandboxOptions): Promise<SandboxClient>;
+declare const sandbox: {
+  get: typeof getSandbox;
+};
+//#endregion
+export { SandboxLimitError as a, VoidPlatformSandbox as c, getSandbox as d, sandbox as f, SandboxClient as i, VoidSandboxOptions as l, DEFAULT_SANDBOX_ID as n, SandboxProcess as o, SANDBOX_SERVICE_BINDING as r, SandboxUnavailableError as s, DEFAULT_SANDBOX_BINDING as t, __setSandboxBindingName as u };

package/dist/{secret-DN9sSNiV.mjs → secret-BOtOl_cb.mjs}

@@ -1,9 +1,9 @@
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
 import { c as getToken } from "./auth-DLNN0D3Z.mjs";
 import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
 import { _ as validateSecretValues } from "./env-validation-BB4GkLxn.mjs";
-import { E as confirm, F as password, N as note, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { E as confirm, F as password, N as note, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/secret.ts
@@ -78,7 +78,7 @@ async function runSecretCommand(root, args) {
 }
 async function runCloudflareSecretCommand(root, args) {
 	if (args.projectName) throw new Error("secret: --project selects a Void platform project and is not used for direct Cloudflare apps.");
-	const { deleteCloudflareSecret, listCloudflareSecrets, putCloudflareSecret, resolveCloudflareOperationContext, syncCloudflareSecrets } = await import("./cloudflare-operations-BipGMJ5O.mjs");
+	const { deleteCloudflareSecret, listCloudflareSecrets, putCloudflareSecret, resolveCloudflareOperationContext, syncCloudflareSecrets } = await import("./cloudflare-operations-BT6OWFBk.mjs");
 	const context = resolveCloudflareOperationContext(root);
 	if (args.action === "list") {
 		const secrets = await listCloudflareSecrets(context);

package/dist/{skills-O6FUaizK.mjs → skills-D1II1Juz.mjs}

@@ -1,5 +1,5 @@
 import { a as join, l as relative } from "./dist-BVqXeR_h.mjs";
-import { j as log } from "./dist-Dn6nn2IU.mjs";
+import { j as log } from "./dist-CTBk70IR.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, symlinkSync } from "node:fs";
 //#region src/cli/skills.ts

package/dist/{subcommand-prompt-BuGYkAkC.mjs → subcommand-prompt-CY1C4fvl.mjs}

@@ -1,5 +1,5 @@
-import { c as import_picocolors } from "./output-CCH48AMM.mjs";
-import { S as S_STEP_SUBMIT, _ as S_RADIO_ACTIVE, c as S_CHECKBOX_INACTIVE, i as S_BAR_END, q as wrapAnsi, r as S_BAR, s as S_CHECKBOX_ACTIVE, v as S_RADIO_INACTIVE, y as S_STEP_ACTIVE } from "./dist-Dn6nn2IU.mjs";
+import { S as S_STEP_SUBMIT, _ as S_RADIO_ACTIVE, c as S_CHECKBOX_INACTIVE, i as S_BAR_END, q as wrapAnsi, r as S_BAR, s as S_CHECKBOX_ACTIVE, v as S_RADIO_INACTIVE, y as S_STEP_ACTIVE } from "./dist-CTBk70IR.mjs";
+import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/subcommand-prompt.ts
 function promptSubcommand(command, subcommands) {
 	return new Promise((resolve) => {

package/dist/{wrangler-BymcxrRa.mjs → wrangler-DQF1vKyf.mjs}

@@ -1,9 +1,9 @@
 import { a as join, i as isAbsolute, n as dirname, o as normalize, t as basename } from "./dist-BVqXeR_h.mjs";
 import "./project-paths-GgcMozYz.mjs";
-import { m as readConfig } from "./config-CafTW6Cz.mjs";
-import { createRequire } from "node:module";
+import { m as readConfig } from "./config-Br_JZD6u.mjs";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { appendSqliteClassMigration } from "@void/deploy-core";
+import { fileURLToPath } from "node:url";
+import { appendSqliteClassMigration, isSandboxRegistryImage } from "@void/deploy-core";
 import { createHash, randomUUID } from "node:crypto";
 import { SyntaxKind, applyEdits, createScanner, findNodeAtLocation, modify, parse, parseTree } from "jsonc-parser";
 import { isDeepStrictEqual } from "node:util";
@@ -180,16 +180,16 @@ function seedCloudflareConfig(root, source, text) {
 		text
 	});
 }
-const SANDBOX_MIGRATION_TAG = "void-sandbox-v1";
-const require = createRequire(import.meta.url);
+const DEFAULT_SANDBOX_CLASS_NAME = "SandboxV1";
+const SANDBOX_MIGRATION_TAG = "void-sandbox-v2";
 function isSandboxEnabled(config) {
 	return config.sandbox !== void 0 && config.sandbox !== false;
 }
 function getDefaultSandboxImage() {
-	return getDefaultSandboxPlatformImage();
+	return fileURLToPath(new URL("../../sandbox.Dockerfile", import.meta.resolve("void/sandbox")));
 }
 function getDefaultSandboxPlatformImage() {
-	return `docker.io/cloudflare/sandbox:${JSON.parse(readFileSync(join(getSandboxPackageRoot(), "package.json"), "utf-8")).version ?? "latest"}`;
+	return "cloudflare/debian-trixie";
 }
 function isLocalSandboxImage(image) {
 	const lowerImage = image.toLowerCase();
@@ -204,24 +204,39 @@ function resolveSandboxConfig(config, root = process.cwd()) {
 	const image = raw.image ?? getDefaultSandboxImage();
 	const imageBuildContext = raw.imageBuildContext;
 	const platformImage = raw.platformImage ?? (raw.image && !isLocalSandboxImage(raw.image) ? raw.image : getDefaultSandboxPlatformImage());
+	if (!isLocalSandboxImage(image) && !isSandboxRegistryImage(image)) throw new Error("sandbox.image must be a Dockerfile or a digest-pinned Cloudflare registry image (registry.cloudflare.com/<account>/<image>@sha256:<digest>).");
+	if (platformImage !== getDefaultSandboxPlatformImage() && !isSandboxRegistryImage(platformImage)) throw new Error("sandbox.platformImage must be a digest-pinned Cloudflare registry image (registry.cloudflare.com/<account>/<image>@sha256:<digest>).");
 	return {
 		binding: raw.binding ?? "SANDBOX",
-		className: raw.className ?? "Sandbox",
-		containerName: raw.containerName ?? "void-sandbox",
+		className: raw.className ?? "SandboxV1",
+		containerName: raw.containerName ?? "void-sandbox-v1",
 		image: resolveSandboxImage(image, root),
 		platformImage,
 		...imageBuildContext && { imageBuildContext: isAbsolute(imageBuildContext) ? imageBuildContext : join(root, imageBuildContext) },
-		...raw.instanceType && { instanceType: raw.instanceType },
-		...raw.maxInstances != null && { maxInstances: raw.maxInstances }
+		...raw.instanceType && { instanceType: raw.instanceType }
 	};
 }
-function getSandboxPackageRoot() {
-	return join(dirname(require.resolve("@cloudflare/sandbox")), "..");
-}
 function resolveSandboxImage(image, root) {
 	if (!isLocalSandboxImage(image) || isAbsolute(image)) return image;
 	return join(root, image);
 }
+function sandboxContainerConfig(sandbox) {
+	return {
+		name: sandbox.containerName,
+		class_name: sandbox.className,
+		scheduling_policy: "durable_object",
+		images: { default: isLocalSandboxImage(sandbox.image) ? {
+			dockerfile: sandbox.image,
+			...sandbox.imageBuildContext && { build_context: sandbox.imageBuildContext }
+		} : { image: sandbox.image } }
+	};
+}
+/** Refuse namespace reuse before either uploader can change a live Worker. */
+function assertSandboxNamespaceConfig(config, sandbox) {
+	const containers = Array.isArray(config.containers) ? config.containers : [];
+	const durable = config.durable_objects;
+	if (containers.some((container) => container.class_name === sandbox.className && container.scheduling_policy !== "durable_object") || durable?.bindings?.some((binding) => binding.name === sandbox.binding && binding.class_name !== sandbox.className)) throw new Error("Sandbox SDK 1.0 needs a new Durable Object namespace. Back up existing Sandbox data and deploy to a fresh Worker name with the new Sandbox configuration; remove legacy Sandbox bindings, containers, and migrations from that new Worker configuration. See https://developers.cloudflare.com/containers/guides/migrate-to-durable-object-scheduling-policy/.");
+}
 //#endregion
 //#region src/cli/wrangler.ts
 const COMPAT_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
@@ -588,7 +603,8 @@ function syncWranglerBindings(root, bindings, options) {
 	if (bindings.needsSandbox) {
 		const sandbox = options?.sandbox ?? resolveSandboxConfig({ sandbox: true }, root);
 		const bindingName = options?.bindingNames?.sandbox ?? sandbox?.binding ?? "SANDBOX";
-		const className = sandbox?.className ?? "Sandbox";
+		const className = sandbox.className;
+		assertSandboxNamespaceConfig(parsed, sandbox);
 		const existingDurableObjectBindings = parsed.durable_objects?.bindings ?? [];
 		if (!existingDurableObjectBindings.some((binding) => binding.name === bindingName)) {
 			parsed.durable_objects = { bindings: [...existingDurableObjectBindings, {
@@ -598,19 +614,13 @@ function syncWranglerBindings(root, bindings, options) {
 			modified = true;
 		}
 		const existingContainers = parsed.containers ?? [];
-		if (!existingContainers.some((container) => container.class_name === className)) {
-			parsed.containers = [...existingContainers, {
-				name: sandbox?.containerName ?? "void-sandbox",
-				class_name: className,
-				image: sandbox?.image,
-				...sandbox?.imageBuildContext && { image_build_context: sandbox.imageBuildContext },
-				...sandbox?.instanceType && { instance_type: sandbox.instanceType },
-				...sandbox?.maxInstances != null && { max_instances: sandbox.maxInstances }
-			}];
+		const containers = [...existingContainers.filter((container) => container.class_name !== className), sandboxContainerConfig(sandbox)];
+		if (JSON.stringify(containers) !== JSON.stringify(existingContainers)) {
+			parsed.containers = containers;
 			modified = true;
 		}
 		const migrations = Array.isArray(parsed.migrations) ? parsed.migrations : [];
-		if (!migrations.some((migration) => migration.tag === "void-sandbox-v1" || migration.new_sqlite_classes?.includes(className))) {
+		if (!migrations.some((migration) => migration.tag === "void-sandbox-v2" || migration.new_sqlite_classes?.includes(className))) {
 			parsed.migrations = [...migrations, {
 				tag: SANDBOX_MIGRATION_TAG,
 				new_sqlite_classes: [className]
@@ -675,7 +685,7 @@ function readWranglerWebSocketTombstones(root, websockets) {
 	if (!configPath) return [];
 	const parsed = parseJsonc(readFileSync(configPath, "utf-8"));
 	const migrations = Array.isArray(parsed.migrations) ? parsed.migrations : [];
-	const historicalClasses = new Set(migrations.filter((migration) => /^void-ws-v1(?:-\d+)?$/.test(migration.tag ?? "")).flatMap((migration) => [...migration.new_classes ?? [], ...migration.new_sqlite_classes ?? []]));
+	const historicalClasses = new Set(migrations.flatMap((migration) => /^void-ws-v1(?:-\d+)?$/.test(migration.tag ?? "") ? [...migration.new_classes ?? [], ...migration.new_sqlite_classes ?? []] : []));
 	const currentClasses = new Set(websockets.map((route) => route.className));
 	const bindings = parsed.durable_objects?.bindings;
 	return [...new Set((Array.isArray(bindings) ? bindings : []).flatMap((binding) => typeof binding.class_name === "string" && historicalClasses.has(binding.class_name) && !currentClasses.has(binding.class_name) ? [binding.class_name] : []))].sort();
@@ -1981,4 +1991,4 @@ function canonicalize(value) {
 	return value;
 }
 //#endregion
-export { writeWranglerPublishedTrafficSnapshot as A, seedCloudflareConfig as B, readWranglerWebSocketTombstones as C, syncWranglerWebSockets as D, syncWranglerDurableObjects as E, MATERIALIZED_CLOUDFLARE_FILE as F, VOID_LOCK_FILE as I, materializeCloudflareConfig as L, isSandboxEnabled as M, requiresSandboxPlatformImage as N, updateWranglerCustomDomain as O, resolveSandboxConfig as P, persistCloudflareConfig as R, readWranglerPublishedTrafficSnapshot as S, syncWranglerBindings as T, stashCloudflareDeployPointer as V, readProvisionedBindingEntry as _, LIVE_MIGRATION_TAG as a, readWranglerCustomDomains as b, bindingEntriesForField as c, ensureWranglerNodejsAlsFlag as d, findBindingNameOwner as f, readExistingLiveBindingConfig as g, normalizeWranglerCompatibilityFlags as h, LATEST_KNOWN_COMPAT_DATE as i, SANDBOX_MIGRATION_TAG as j, writeProvisionedWranglerConfig as k, ensureWranglerCompat as l, nextDurableObjectMigrationTag as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, hasDurableObjectSqliteMigration as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompatibilityDate as u, readRootWranglerConfig as v, resolveLiveBindingConfig as w, readWranglerManagedQueueCleanupCandidates as x, readWranglerCompat as y, restoreCloudflarePreviewPointer as z };
+export { writeWranglerPublishedTrafficSnapshot as A, materializeCloudflareConfig as B, readWranglerWebSocketTombstones as C, syncWranglerWebSockets as D, syncWranglerDurableObjects as E, requiresSandboxPlatformImage as F, restoreCloudflarePreviewPointer as H, resolveSandboxConfig as I, sandboxContainerConfig as L, SANDBOX_MIGRATION_TAG as M, assertSandboxNamespaceConfig as N, updateWranglerCustomDomain as O, isSandboxEnabled as P, MATERIALIZED_CLOUDFLARE_FILE as R, readWranglerPublishedTrafficSnapshot as S, syncWranglerBindings as T, seedCloudflareConfig as U, persistCloudflareConfig as V, stashCloudflareDeployPointer as W, readProvisionedBindingEntry as _, LIVE_MIGRATION_TAG as a, readWranglerCustomDomains as b, bindingEntriesForField as c, ensureWranglerNodejsAlsFlag as d, findBindingNameOwner as f, readExistingLiveBindingConfig as g, normalizeWranglerCompatibilityFlags as h, LATEST_KNOWN_COMPAT_DATE as i, DEFAULT_SANDBOX_CLASS_NAME as j, writeProvisionedWranglerConfig as k, ensureWranglerCompat as l, nextDurableObjectMigrationTag as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, hasDurableObjectSqliteMigration as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompatibilityDate as u, readRootWranglerConfig as v, resolveLiveBindingConfig as w, readWranglerManagedQueueCleanupCandidates as x, readWranglerCompat as y, VOID_LOCK_FILE as z };

package/dist/{ws-BwcqizuH.d.mts → ws-BoY7vQML.d.mts}

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
 import { r as AuthUser } from "./auth-DkcFflXV.mjs";
-import { a as CloudEnv } from "./handler-BXJTXd02.mjs";
+import { a as CloudEnv } from "./handler-HEcZsaij.mjs";
 import { WebSocketRouteMap } from "void/routes";
 //#region src/runtime/ws.d.ts
 type MaybePromise<T> = T | Promise<T>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.21.8",
+  "version": "0.22.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -14,7 +14,8 @@
     "schema.json",
     "skills",
     "AGENTS_TEMPLATE.md",
-    "README.md"
+    "README.md",
+    "sandbox.Dockerfile"
   ],
   "type": "module",
   "imports": {
@@ -316,57 +317,64 @@
       "types": "./dist/runtime/db-mysql.d.mts",
       "import": "./dist/runtime/db-mysql.mjs",
       "require": "./dist/runtime/db-mysql.mjs"
+    },
+    "./_sandbox-container": {
+      "types": "./dist/runtime/sandbox-container.d.mts",
+      "import": "./dist/runtime/sandbox-container.mjs"
     }
   },
   "dependencies": {
-    "@cloudflare/build-output-utils": "0.8.2",
-    "@cloudflare/config": "0.20.0",
-    "@cloudflare/sandbox": "^0.12.9",
-    "@cloudflare/vite-plugin": "1.54.7",
+    "@cloudflare/build-output-utils": "0.8.4",
+    "@cloudflare/codemods": "0.3.0",
+    "@cloudflare/config": "0.22.0",
+    "@cloudflare/sandbox": "1.0.0",
+    "@cloudflare/vite-plugin": "1.62.2",
+    "@cloudflare/workers-auth": "0.9.5",
     "@cloudflare/workers-types": "^4.20260702.1",
-    "@napi-rs/keyring": "2.0.0",
-    "@void/deploy-cloudflare": "0.21.8",
-    "@void/deploy-core": "0.21.8",
-    "@void/edge": "0.21.8",
-    "@void/isr": "0.21.8",
-    "@void/platform": "0.21.8",
-    "acorn": "^8.15.0",
-    "better-auth": "^1.7.3",
+    "@napi-rs/keyring": "2.1.0",
+    "@void/deploy-cloudflare": "0.22.0",
+    "@void/deploy-core": "0.22.0",
+    "@void/edge": "0.22.0",
+    "@void/isr": "0.22.0",
+    "@void/platform": "0.22.0",
+    "acorn": "^8.18.0",
+    "better-auth": "^1.7.6",
     "better-sqlite3": "^13.0.3",
     "blake3-jit": "^1.1.0",
-    "cf": "1.0.0-beta.5",
+    "cf": "1.0.0-beta.9",
     "drizzle-arktype": "^0.1.3",
-    "drizzle-kit": "^0.31.10",
-    "drizzle-orm": "^0.45.2",
+    "drizzle-kit": "^0.31.11",
+    "drizzle-orm": "^0.45.3",
     "drizzle-valibot": "^0.4.2",
     "drizzle-zod": "^0.8.3",
     "email-validator": "^2.0.4",
     "es-module-lexer": "^3.0.2",
-    "hono": "^4.13.7",
-    "ignore": "^7.0.9",
+    "hono": "^4.13.11",
+    "ignore": "^7.0.10",
     "jiti": "^2.7.0",
     "jsonc-parser": "3.3.1",
-    "miniflare": "5.20260926.0-alpha",
+    "mime": "4.1.0",
+    "miniflare": "5.20260926.1-alpha",
     "minimatch": "^10.2.6",
-    "mysql2": "3.24.4",
+    "mysql2": "3.24.5",
     "pg": "8.23.0",
-    "postal-mime": "^2.7.4",
+    "postal-mime": "^4.0.0",
     "proper-lockfile": "^4.1.2",
-    "undici": "7.29.0"
+    "undici": "8.11.2"
   },
   "devDependencies": {
-    "@clack/core": "1.5.0",
-    "@clack/prompts": "^1.8.0",
+    "@clack/core": "^1.5.1",
+    "@clack/prompts": "^1.8.1",
     "@electric-sql/pglite": "0.5.8",
     "@types/better-sqlite3": "^9.6.0",
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.3",
     "@types/pg": "^8.23.1",
     "@types/proper-lockfile": "^4.1.4",
-    "arktype": "^2.2.3",
+    "arktype": "^2.2.5",
     "ci-info": "^4.4.0",
     "estree-walker": "^3.0.3",
     "fast-wrap-ansi": "^0.2.2",
-    "magic-string": "^1.3.1",
+    "magic-string": "^1.4.2",
     "ofetch": "2.0.0-alpha.3",
     "pathslash": "^0.1.0",
     "pglite-server": "0.1.5",
@@ -374,12 +382,12 @@
     "tinyglobby": "^0.2.17",
     "typescript": "7.0.2",
     "valibot": "^1.5.0",
-    "vite": "npm:@voidzero-dev/vite-plus-core@0.3.1",
-    "vite-plus": "0.3.1",
-    "zod": "^4.6.1"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
+    "vite-plus": "1.0.0",
+    "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@void/md": "0.21.8",
+    "@void/md": "0.22.0",
     "arktype": ">=2.0.0",
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",

package/sandbox.Dockerfile

@@ -0,0 +1,4 @@
+FROM node:24.21.0-trixie-slim
+COPY --from=docker.io/cloudflare/sandbox:1.0.0 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim
+WORKDIR /workspace
+CMD ["sleep", "infinity"]

package/schema.json

@@ -297,9 +297,11 @@
       "description": "Connect to remote D1/KV/R2 bindings during local development. Can also be set via VOID_REMOTE=1 environment variable."
     },
     "sandbox": {
-      "description": "Enable Cloudflare Sandboxes. `true` uses the default SANDBOX binding and Cloudflare sandbox image; an object customizes the Durable Object binding, container image, and scaling.",
+      "description": "Enable Cloudflare Sandboxes. `true` uses the default SANDBOX binding and Node.js environment; an object customizes the Durable Object binding, container image, and instance size.",
       "oneOf": [
-        { "type": "boolean" },
+        {
+          "type": "boolean"
+        },
         {
           "type": "object",
           "properties": {
@@ -309,42 +311,28 @@
             },
             "className": {
               "type": "string",
-              "description": "Durable Object class name. Defaults to Sandbox."
+              "description": "Durable Object class name. Defaults to SandboxV1."
             },
             "containerName": {
               "type": "string",
-              "description": "Cloudflare Container application name. Defaults to void-sandbox."
+              "description": "Cloudflare Container application name. Defaults to void-sandbox-v1."
             },
             "image": {
               "type": "string",
-              "description": "Container image or Dockerfile path used by local Wrangler development."
+              "description": "Dockerfile path or digest-pinned Cloudflare managed registry image for local and native Cloudflare use."
             },
             "imageBuildContext": {
               "type": "string",
-              "description": "Optional Docker build context path for local Wrangler development."
+              "description": "Optional Docker build context path for local development and native Cloudflare deploys."
             },
             "platformImage": {
               "type": "string",
-              "description": "Registry image reference used by `void deploy`. Required when `image` is a custom local Dockerfile path."
+              "description": "Cloudflare managed registry image pinned by digest, containing the SDK 1.0 sandbox-shim. Defaults to Cloudflare’s managed Node.js image."
             },
             "instanceType": {
               "type": "string",
-              "enum": [
-                "dev",
-                "lite",
-                "basic",
-                "standard",
-                "standard-1",
-                "standard-2",
-                "standard-3",
-                "standard-4"
-              ],
+              "enum": ["lite", "standard-1", "standard-2", "standard-3", "standard-4"],
               "description": "Cloudflare Container instance type."
-            },
-            "maxInstances": {
-              "type": "integer",
-              "minimum": 1,
-              "description": "Maximum number of sandbox container instances."
             }
           },
           "additionalProperties": false

package/skills/void/SKILL.md

@@ -77,6 +77,8 @@ Use `void connect` for deployment onboarding: no arguments offers Cloudflare or
 
 For Void platform project access, use `void project team`: invite only an email already registered on that platform and assign `reader`, `collaborator`, or `admin`. The invited account uses `void connect <url>` followed by pending/accept/decline on that active connection, regardless of the current directory's project link or deploy target. `VOID_API_URL` overrides the connection; an unscoped `VOID_TOKEN` selects Void Cloud. Acceptance preserves directory links; run `void project link` in an unlinked checkout of the invited application. Project-scoped team management does not apply to direct Cloudflare deployments. Installation administrators transfer ownership with `void platform project owner <project-id> <user-id> --plan` and apply the reviewed transfer with `--yes`.
 
+For a self-hosted platform's project Zero Trust policy, installation administrators use `void platform zero-trust`; pass the Access management token only through `--token-stdin`. Project owners and project administrators use `void project zero-trust status|protect|public|reconcile`; these commands do not apply to direct Cloudflare deployments. When a deploy or rollback is refused because protection is not settled, check `void project zero-trust status`; an owner or project administrator can run `void project zero-trust reconcile` before retrying.
+
 Use Void commands for every user-facing workflow. Never ask the user to install, authenticate, or run Wrangler directly. Say Cloudflare or Void instead, except when naming literal `wrangler.jsonc` / `wrangler.json` files or `WRANGLER_*` environment variables the user must inspect.
 
 `void auth login|status|logout` follows the saved deploy destination or asks the user to choose; `void account` explicitly manages a Void platform account.

package/skills/void/docs/guide/deployment.md

@@ -150,7 +150,7 @@ void github join
 void github connect --executor container
 ```
 
-Organization installations always require a browser proof for the specific repository, including for the person who installed the App. Void does not reveal the installation's full private repository list. If an upgraded platform marks an older organization connection as requiring reconnection, run the same `void github connect` command again to renew that repository-scoped authorization before builds resume.
+Organization installations always require a browser proof for the specific repository, including for the person who installed the App. Void does not reveal the installation's full private repository list.
 
 4. Verify the connection
 

package/skills/void/docs/guide/edge/revalidation.md

@@ -105,7 +105,7 @@ revalidation, Void removes its HTML, Pages JSON, and KV cache entries.
 
 ## Cache bypass
 
-Requests with `Cookie` or `Authorization` headers bypass the ISR cache entirely and always dispatch to the worker. This ensures personalized or authenticated pages are never served from a shared cache.
+Requests with `Cookie`, `Authorization`, or Cloudflare Access's `Cf-Access-Jwt-Assertion` header bypass the ISR cache entirely and always dispatch to the worker. Authenticated responses are not shared between users, including when Access authentication supplies no cookie.
 
 ## Cache keys and rewrites
 

package/skills/void/docs/guide/edge/static-assets.md

@@ -51,6 +51,7 @@ Cached at the edge until the next deploy. Browsers always revalidate on the next
 - `/api/*` routes, which always hit the worker
 - SSR-rendered pages (paths without file extensions in SSR projects)
 - Non-GET requests
+- Requests carrying `Cookie`, `Authorization`, or `Cf-Access-Jwt-Assertion` credentials
 - Responses other than a complete `200`
 
 ### Opting out