void 0.21.9 → 0.22.0

package/dist/{platform-management-CVpGI9Y5.mjs → platform-management-Brz_BDiT.mjs}

@@ -1,7 +1,7 @@
-import { i as createSpinner } from "./output-CCH48AMM.mjs";
 import { a as listInstallationManifests, d as readInstallationRecoverySecrets, h as resolveInstallationManifest, m as removePlatformConnectionForInstallation, p as removeInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
-import { E as confirm, I as select, N as note, P as outro, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { A as hyperdriveOriginFromConnectionString, C as assertPlatformOperatorCredentialCanApplyPlan, M as verifyPlatformRuntimeTokenPermissions, O as PlatformCloudflareClient, S as platformDatabaseNameFromOwnerUrl, _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as platformProvisionIntentHash, d as loadPlatformRuntime, g as trackedPlatformWorkerTraffic, j as hyperdriveOriginMatches, k as hyperdriveOriginConfigHash, l as createPlatformInstallationSecrets, m as resolveBootstrapGitHubId, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as installPlatform, v as formatPlatformInstallPlan, w as resolvePlatformCloudflareCredential, x as revalidatePlatformInstallAction, y as platformAdoptionIntentHash } from "./platform-lifecycle-Bc047IeT.mjs";
+import { E as confirm, I as select, N as note, P as outro, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { i as createSpinner } from "./output-Dm_A4Tbv.mjs";
+import { A as PlatformCloudflareClient, C as revalidatePlatformInstallAction, E as resolvePlatformCloudflareCredential, M as hyperdriveOriginFromConnectionString, N as hyperdriveOriginMatches, P as verifyPlatformRuntimeTokenPermissions, S as platformProvisionIntentHash, T as assertPlatformOperatorCredentialCanApplyPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as formatPlatformInstallPlan, d as loadPlatformRuntime, g as assertProjectZeroTrustAllowsUninstall, h as resolveBootstrapGitHubId, j as hyperdriveOriginConfigHash, l as createPlatformInstallationSecrets, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, p as readPlatformProjectZeroTrustState, t as assertNoninteractivePlatformMutationAcknowledged, u as installPlatform, v as trackedPlatformWorkerTraffic, w as platformDatabaseNameFromOwnerUrl, x as platformAdoptionIntentHash, y as createPlatformInstallPlan } from "./platform-lifecycle-k0E0xoxx.mjs";
 import { createHash } from "node:crypto";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 //#region src/cli/platform-management.ts
@@ -58,7 +58,11 @@ async function runInstalledPlatformCommand(args) {
 		if (args.subcommand === "uninstall") {
 			await uninstallPlatform(client, manifest, args, {
 				checkpoint: databaseLock?.checkpoint,
-				databaseUrl
+				databaseUrl,
+				readProjectZeroTrust: databaseLock ? databaseLock.readProjectZeroTrust : () => readPlatformProjectZeroTrustState(databaseUrl, manifest.id, manifest.ownershipNonce),
+				lockProjectZeroTrust: databaseLock?.lockProjectZeroTrust,
+				fenceProjectZeroTrust: databaseLock?.fenceProjectZeroTrust,
+				liftProjectZeroTrustFence: databaseLock?.liftProjectZeroTrustFence
 			});
 			return;
 		}
@@ -145,6 +149,7 @@ async function runInstalledPlatformCommand(args) {
 		const result = await installPlatform(plan, secrets, installation, {
 			acquireDatabaseLifecycleLock: async () => Object.assign(async () => {}, {
 				checkpoint: databaseLock?.checkpoint,
+				liftProjectZeroTrustFence: databaseLock?.liftProjectZeroTrustFence,
 				prepareDatabase: databaseLock?.prepareDatabase,
 				prepareSandboxDrain: databaseLock?.prepareSandboxDrain,
 				readAuthenticationState: databaseLock?.readAuthenticationState,
@@ -164,7 +169,10 @@ async function runInstalledPlatformCommand(args) {
 				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
 				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
-			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action, { repairMissing: args.subcommand === "repair" })
+			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action, {
+				repairMissing: args.subcommand === "repair",
+				stableWorkerUpdate: args.subcommand === "upgrade"
+			})
 		});
 		progress.message("Finalizing platform changes");
 		markPhase("installer complete");
@@ -315,8 +323,9 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	const interactive = dependencies.interactive ?? process.stdin.isTTY;
 	const confirmAction = dependencies.confirm ?? promptForConfirmation;
 	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
+	await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust);
 	const dataMessage = retainData ? "Retain installer-owned Workers, storage, dispatch, AI logs, and Hyperdrive by default." : args.purgeData ? "Delete safely identifiable installer-owned data (--purge-data); retain Workers, R2, AI Gateway, and external PostgreSQL for manual cleanup." : "Retain installer-owned data; external PostgreSQL is never deleted.";
-	note(`Disable all platform traffic through installation-owned routing storage.\nRetain DNS records, routes, and custom domains for explicit dashboard cleanup.\nDelete installer-owned Queues.\n${dataMessage}\n${createdZone ? `Keep zone ${createdZone.name} for explicit manual cleanup.` : "Never delete the adopted application zone."}${(manifest.authenticationResources ?? []).length ? "\nRetain Access resources for deliberate cleanup:\n" + manifest.authenticationResources.map((resource) => `  ${resource.ownership} ${resource.kind}: ${resource.name} (${resource.id}, account ${resource.accountId})`).join("\n") : ""}`, "Uninstall plan");
+	note(`Disable all platform traffic through installation-owned routing storage.\nRetain DNS records, routes, and custom domains for explicit dashboard cleanup.\nDelete installer-owned Queues unless a retained Worker still uses them.\n${dataMessage}\n${createdZone ? `Keep zone ${createdZone.name} for explicit manual cleanup.` : "Never delete the adopted application zone."}${(manifest.authenticationResources ?? []).length ? "\nRetain Access resources for deliberate cleanup:\n" + manifest.authenticationResources.map((resource) => `  ${resource.ownership} ${resource.kind}: ${resource.name} (${resource.id}, account ${resource.accountId})`).join("\n") : ""}`, "Uninstall plan");
 	if (args.plan) {
 		outro("No Cloudflare or local installation state was changed.");
 		return;
@@ -345,12 +354,34 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		await verifyPlatformInstallationOwnership(client, manifest, { databaseUrl: dependencies.databaseUrl });
 		missingResources = /* @__PURE__ */ new Set();
 	}
-	let next = transitionInstallation(manifest, "uninstalling", (/* @__PURE__ */ new Date()).toISOString());
-	writeInstallationManifest(next);
+	const { fenceProjectZeroTrust, liftProjectZeroTrustFence, lockProjectZeroTrust } = dependencies;
+	if (!lockProjectZeroTrust || !fenceProjectZeroTrust || !liftProjectZeroTrustFence) throw new Error("platform: Refusing to uninstall because no platform database connection is available to hold off project Zero Trust changes.");
+	const releaseProjectZeroTrust = await lockProjectZeroTrust();
+	let fenced = false;
+	let disablingTraffic = false;
+	const stopProjectZeroTrustHold = async () => {
+		if (fenced && !disablingTraffic) await liftProjectZeroTrustFence().catch((error) => {
+			log.warn(`Could not reopen project Zero Trust changes after the uninstall stopped: ${error instanceof Error ? error.message : String(error)}\nRun \`void platform uninstall\` again, or \`void platform repair\` to keep the platform.`);
+		});
+		await releaseProjectZeroTrust();
+	};
+	let next = manifest;
+	try {
+		await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust);
+		fenced = true;
+		await fenceProjectZeroTrust();
+		next = transitionInstallation(manifest, "uninstalling", (/* @__PURE__ */ new Date()).toISOString());
+		writeInstallationManifest(next);
+	} catch (error) {
+		await stopProjectZeroTrustHold();
+		throw error;
+	}
 	try {
 		await writeRemoteManifestIfPresent(client, next);
 		const routing = next.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready");
+		disablingTraffic = true;
 		if (routing) await client.putKvValue(next.account.id, routing.id, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+		await releaseProjectZeroTrust();
 		for (const key of missingResources) {
 			const resource = requireResource(next, key);
 			next = updateResourceState(next, key, resource.ownership === "created" ? "deleted" : "retained");
@@ -383,6 +414,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 			zone: 8
 		};
 		const resources = [...next.resources].sort((left, right) => resourceDeletionPriority(left, deletionPriority) - resourceDeletionPriority(right, deletionPriority));
+		const queuesInUse = hasRoutingCheckpoint && resources.some((resource) => resource.kind === "queue" && shouldDeleteResource(resource, retainData)) && await hasLiveInstallationWorker(client, next);
 		for (const resource of resources) {
 			if (resource.state !== "ready") continue;
 			if (!hasRoutingCheckpoint && resource.kind !== "zone") {
@@ -395,7 +427,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 				await writeLifecycleCheckpoint(client, next);
 				continue;
 			}
-			if (resource.kind === "dns-record" && !zone) {
+			if (resource.kind === "dns-record" && !zone || resource.kind === "queue" && queuesInUse) {
 				next = updateResourceState(next, resource.key, "retained");
 				await writeLifecycleCheckpoint(client, next);
 				continue;
@@ -420,6 +452,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		removePlatformConnectionForInstallation(next.id);
 		log.success(retainData ? `${next.deployment.displayName} was uninstalled; data resources were retained and recorded in ${next.id}.` : `${next.deployment.displayName} was uninstalled.`);
 	} catch (error) {
+		await stopProjectZeroTrustHold().catch(() => {});
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
 		writeInstallationManifest(next);
 		await writeRemoteManifestIfPresent(client, next).catch(() => {});
@@ -505,6 +538,18 @@ function shouldDeleteResource(resource, retainData) {
 	if (resource.kind === "worker-route" || resource.kind === "worker-custom-domain") return false;
 	return !(retainData && DATA_RESOURCE_KINDS.has(resource.kind));
 }
+async function hasLiveInstallationWorker(client, manifest) {
+	const names = manifest.deployment.resources;
+	const installationWorkers = /* @__PURE__ */ new Set([
+		names.apiWorker,
+		names.proxyWorker,
+		names.emailGatewayWorker,
+		names.tailWorker,
+		names.dispatchWorker,
+		...manifest.resources.filter((resource) => resource.kind === "worker").map((resource) => resource.name)
+	]);
+	return (await client.listWorkerNames(manifest.account.id)).some((name) => installationWorkers.has(name));
+}
 function resourceDeletionPriority(resource, priorities) {
 	return resource.key === "routing-kv" ? 100 : priorities[resource.kind] ?? 99;
 }

package/dist/{platform-management-C8tt6D8h.mjs → platform-management-DOtss0BN.mjs}

@@ -1,2 +1,2 @@
-import { c as selectAuthoritativePlatformManifest, s as runInstalledPlatformCommand, u as verifyPlatformInstallationOwnership } from "./platform-management-CVpGI9Y5.mjs";
+import { c as selectAuthoritativePlatformManifest, s as runInstalledPlatformCommand, u as verifyPlatformInstallationOwnership } from "./platform-management-Brz_BDiT.mjs";
 export { runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };

package/dist/{platform-recovery-dvUaptLr.mjs → platform-recovery-BvtcXON5.mjs}

@@ -1,7 +1,7 @@
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { a as listInstallationManifests, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
-import { _ as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-Bc047IeT.mjs";
-import { i as recoverDurablyMarkedProvisionIntents, r as isPlatformManifestMonotonicExtension, u as verifyPlatformInstallationOwnership } from "./platform-management-CVpGI9Y5.mjs";
+import { a as REMOTE_INSTALLATION_MANIFEST_KEY, y as createPlatformInstallPlan } from "./platform-lifecycle-k0E0xoxx.mjs";
+import { i as recoverDurablyMarkedProvisionIntents, r as isPlatformManifestMonotonicExtension, u as verifyPlatformInstallationOwnership } from "./platform-management-Brz_BDiT.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/prepare-Bm3iq-u4.mjs

@@ -0,0 +1,2 @@
+import { t as prepareProject } from "./prepare-CRhJbVrG.mjs";
+export { prepareProject };

package/dist/{prepare-DyZ-Yok5.mjs → prepare-C-6YZyyg.mjs}

@@ -1,6 +1,6 @@
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
-import { N as note, O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { t as prepareProject } from "./prepare-C3kt3Rst.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { t as prepareProject } from "./prepare-CRhJbVrG.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root, _args) {
 	console.log();

package/dist/{prepare-C3kt3Rst.mjs → prepare-CRhJbVrG.mjs}

@@ -1,7 +1,7 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { i as resolveProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig, u as getDatabaseDialect } from "./config-CafTW6Cz.mjs";
+import { m as readConfig, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-B8GeM0RM.mjs";
 import { r as scanRoutes } from "./scan-ClYmX3sa.mjs";
 import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-BMfKRSqE.mjs";

package/dist/{project-cmd-B44I8J_W.mjs → project-cmd-BZLCqOqw.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, c as import_picocolors, r as cliTitle, u as tablePrefix } from "./output-CCH48AMM.mjs";
 import { c as getToken, s as getSiteDomain } from "./auth-DLNN0D3Z.mjs";
 import { i as readDeploymentPlatform } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+import { a as dim, c as import_picocolors, d as tablePrefix, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -39,63 +39,77 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-CDb-4bZ1.mjs");
+		const { runListCommand } = await import("./list-D44jmIAM.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by cloudflare.name in void.config.ts and do not need linking.");
-		const { runLink } = await import("./link-CsHOinF7.mjs");
+		const { runLink } = await import("./link-BrQfb_CU.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-CDb-4bZ1.mjs");
+			const { runListCommand } = await import("./list-D44jmIAM.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
 	if (args.subcommand === "token") {
 		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
-		const { runProjectTokenCommand } = await import("./project-token-C8xEEQnB.mjs");
+		const { runProjectTokenCommand } = await import("./project-token-l5DqK6Az.mjs");
 		return runProjectTokenCommand(root, args);
 	}
 	if (args.subcommand === "team") {
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-DQMfeKMz.mjs");
+			const { printHelpPage } = await import("./help-CmZzxUba.mjs");
 			printHelpPage(["project", "team"]);
 			return;
 		}
 		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
 		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
-		const { runProjectTeamCommand } = await import("./project-team-BkbYIsXN.mjs");
+		const { runProjectTeamCommand } = await import("./project-team-BvgM0WoX.mjs");
 		return runProjectTeamCommand(root, args);
 	}
+	if (args.subcommand === "zero-trust") {
+		if (cloudflare) throw new Error("project: Zero Trust overrides are available only for projects hosted on a Void platform.");
+		if (args.action === "") {
+			const { printHelpPage } = await import("./help-CmZzxUba.mjs");
+			printHelpPage(["project", "zero-trust"]);
+			return;
+		}
+		const action = args.action;
+		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-v6Mvpp8y.mjs");
+		return runProjectZeroTrustCommand(root, {
+			...args,
+			action
+		});
+	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-BdfiOezj.mjs");
+		const { runLogsCommand } = await import("./logs-BjKvFnVM.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-DFyhBMaf.mjs");
+		const { runRequestsCommand } = await import("./requests-DN-BbNiM.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-DHHxXZiS.mjs");
+		const { runRollbackCommand } = await import("./rollback-D7rzSaZM.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-D23R1RXT.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-D4NUqFbi.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-D6dZ9B6B.mjs");
+		const { runDeleteCommand } = await import("./delete-TTedbH6B.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-7_UeZdTk.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-D0sWhgKI.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/{project-team-BkbYIsXN.mjs → project-team-BvgM0WoX.mjs}

@@ -1,8 +1,8 @@
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
 import { c as getToken, i as getAccountCredential } from "./auth-DLNN0D3Z.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { N as note, O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-BTZ3XkrB.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/project-team.ts
 function clean(value) {

package/dist/{project-token-C8xEEQnB.mjs → project-token-l5DqK6Az.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, r as cliTitle, u as tablePrefix } from "./output-CCH48AMM.mjs";
 import { c as getToken } from "./auth-DLNN0D3Z.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+import { a as dim, d as tablePrefix, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/project-token.ts
 async function resolveTarget(root, args) {

package/dist/project-zero-trust-v6Mvpp8y.mjs

@@ -0,0 +1,63 @@
+import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+import { l as sanitizeTerminalText, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
+//#region src/cli/project-zero-trust.ts
+async function resolveTarget(root, args) {
+	const token = getToken(root);
+	if (!token) throw new Error("project: Not logged in. Run `void account login` first.");
+	const client = new PlatformClient(token, { root });
+	const requestedSlug = getRequestedProjectSlug({ projectSlug: args.projectSlug });
+	if (requestedSlug) {
+		const project = resolveProjectBySlug(await client.listProjects(), requestedSlug);
+		if (!project) throw new Error(`project: No project found with slug '${requestedSlug}'.`);
+		return {
+			client,
+			projectId: project.projectId,
+			slug: project.slug
+		};
+	}
+	const linked = readProjectConfig(root);
+	if (!linked) throw new Error("project: No linked project. Pass --project <name> or set VOID_PROJECT.");
+	return {
+		client,
+		projectId: linked.projectId,
+		slug: linked.slug
+	};
+}
+function statusLines(result) {
+	const project = result.project;
+	const platformStatus = sanitizeTerminalText(result.platformStatus);
+	const unavailableMessage = result.platformStatus === "invalid_configuration" ? "The platform Zero Trust configuration is invalid. Ask a platform administrator to review it." : result.platformStatus === "configuring" ? "The platform is still applying Zero Trust configuration. A platform administrator can resume it with `void platform zero-trust reconcile`." : result.platformStatus === "disabling" ? "The platform is disabling project Zero Trust. A platform administrator can resume it with `void platform zero-trust reconcile`." : result.platformStatus === "error" ? "The platform Zero Trust configuration needs administrator attention. A platform administrator can inspect its status and reconcile it." : result.platformStatus === "ready" ? "The platform administrator has disabled project Zero Trust." : "The platform administrator has not configured project Zero Trust.";
+	return [
+		`Available: ${result.available ? "yes" : "no"}`,
+		`Platform: ${platformStatus}`,
+		...result.platformStatus === "not_configured" || result.platformStatus === "invalid_configuration" ? [] : [`Default for new projects: ${result.protectNewProjects ? "protected" : "public"}`],
+		`Desired: ${project ? project.desired_protected ? "protected" : "public" : "not initialized"}`,
+		`Effective: ${project ? project.effective_protected ? "protected" : "public" : "not initialized"}`,
+		`State: ${project?.state ?? "not initialized"}`,
+		...project?.last_error ? [`Last error: ${sanitizeTerminalText(project.last_error)}`] : [],
+		...!result.available ? [unavailableMessage] : []
+	].join("\n");
+}
+async function runProjectZeroTrustCommand(root, args) {
+	console.log();
+	intro(cliTitle(`project zero-trust ${args.action}`));
+	const { client, projectId, slug } = await resolveTarget(root, args);
+	if (args.action === "status") {
+		note(statusLines(await client.getProjectZeroTrust(projectId)), slug);
+		outro(`${slug} Zero Trust status`);
+		return;
+	}
+	const result = args.action === "reconcile" ? await client.reconcileProjectZeroTrust(projectId) : await client.setProjectZeroTrust(projectId, args.action === "protect");
+	if (result.project.last_error) log.warn(sanitizeTerminalText(result.project.last_error));
+	if (result.project.state === "reconciling") {
+		outro(`${slug} Zero Trust update is still in progress. Run \`void project zero-trust reconcile\` to continue, or wait for scheduled maintenance.`);
+		return;
+	}
+	outro(args.action === "protect" ? `${slug} is protected by Zero Trust.` : args.action === "public" ? `${slug} is public.` : `${slug} Zero Trust reconciled (${result.project.state}).`);
+}
+//#endregion
+export { runProjectZeroTrustCommand };

package/dist/{protocol-ZH3jP4a7.d.mts → protocol-BBa6cstI.d.mts}

@@ -1,5 +1,5 @@
 import { n as HeadDescriptor, t as HeadConfig } from "./head-Do8P4puT.mjs";
-import { n as CloudBindings, r as CloudContext } from "./handler-BXJTXd02.mjs";
+import { n as CloudBindings, r as CloudContext } from "./handler-HEcZsaij.mjs";
 import { a as PageRenderMode, t as DevCssAsset } from "./types-BAp5AEBU.mjs";
 //#region src/pages/protocol.d.ts
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */

package/dist/{provision-BhreDAOS.mjs → provision-C4IGqkBf.mjs}

@@ -1,5 +1,5 @@
 import { a as join, n as dirname, o as normalize, t as basename, u as resolve$2 } from "./dist-BVqXeR_h.mjs";
-import { R as persistCloudflareConfig, _ as readProvisionedBindingEntry, k as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers } from "./wrangler-BymcxrRa.mjs";
+import { V as persistCloudflareConfig, _ as readProvisionedBindingEntry, k as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers } from "./wrangler-DQF1vKyf.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
 import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
@@ -418,8 +418,8 @@ let activeProvisionQuarantineHook;
 function isQuarantineError(error) {
 	return error instanceof WranglerQuarantineError || error?.quarantine === true;
 }
-/** The (at most one) currently-registered {runner, owning-lock} pair. */
-let activeRegistration;
+/** Concurrent registrations are allowed only for two immutable Worker uploads. */
+const activeRegistrations = /* @__PURE__ */ new Map();
 let coordinatorListenersInstalled = false;
 let activeTeardown;
 let reRaisedOnce = false;
@@ -437,21 +437,25 @@ function removeCoordinatorListeners() {
 	process.removeListener("SIGINT", onCoordinatorSigint);
 	process.removeListener("SIGTERM", onCoordinatorSigterm);
 }
-function registerRunner(registrant) {
-	if (activeRegistration !== void 0) throw new Error("provision: internal invariant violated — a second wrangler child tried to register while one is already active in this process");
-	activeRegistration = {
+function canRegisterRunner(parallelWorkerUpload) {
+	return activeRegistrations.size === 0 || parallelWorkerUpload && activeProvisionQuarantineHook === void 0 && activeRegistrations.size < 2 && [...activeRegistrations.values()].every((entry) => entry.parallelWorkerUpload);
+}
+function registerRunner(registrant, parallelWorkerUpload) {
+	if (!canRegisterRunner(parallelWorkerUpload)) throw new Error("provision: internal invariant violated — a Cloudflare child tried to register outside its concurrency limit");
+	activeRegistrations.set(registrant, {
 		registrant,
-		lockQuarantine: activeProvisionQuarantineHook
-	};
+		lockQuarantine: activeProvisionQuarantineHook,
+		parallelWorkerUpload
+	});
 	installCoordinatorListeners();
 }
 function deregisterRunner(registrant) {
-	if (activeRegistration?.registrant === registrant) activeRegistration = void 0;
-	if (activeRegistration === void 0 && activeTeardown === void 0 && retentionWatchdog === void 0) removeCoordinatorListeners();
+	activeRegistrations.delete(registrant);
+	if (activeRegistrations.size === 0 && activeTeardown === void 0 && retentionWatchdog === void 0) removeCoordinatorListeners();
 }
 function coordinatorHandleSignal(signal) {
 	if (activeTeardown !== void 0) return;
-	if (retentionWatchdog !== void 0 && activeRegistration === void 0) {
+	if (retentionWatchdog !== void 0 && activeRegistrations.size === 0) {
 		process.stderr.write(`provision: ignoring ${signal} — a provision lock is retained while an unconfirmed wrangler child may live and its quarantine metadata is not yet durable. The process exits once the child is confirmed dead or the metadata persists.\n`);
 		return;
 	}
@@ -462,15 +466,15 @@ function coordinatorHandleSignal(signal) {
 		persistFailed: false,
 		finished: false,
 		deadlineTimer: void 0,
-		expirePendingPair: void 0
+		expirePendingPairs: []
 	};
 	activeTeardown = teardown;
-	const snapshot = activeRegistration !== void 0 ? [activeRegistration] : [];
+	const snapshot = [...activeRegistrations.values()];
 	teardown.pending = snapshot.length;
 	if (snapshot.length > 0) {
 		const deadlineMs = Math.max(...snapshot.map((r) => r.registrant.teardownDeadlineMs));
 		teardown.deadlineTimer = setTimeout(() => {
-			teardown.expirePendingPair?.(`the coordinator-wide ${deadlineMs}ms teardown deadline expired before the process group's termination was confirmed`);
+			for (const expire of teardown.expirePendingPairs) expire(`the coordinator-wide ${deadlineMs}ms teardown deadline expired before the process group's termination was confirmed`);
 		}, deadlineMs);
 	}
 	for (const registration of snapshot) coordinatorTearDownRegistrant(teardown, registration);
@@ -507,7 +511,7 @@ function coordinatorTearDownRegistrant(teardown, registration) {
 		registrant.quarantine(detail);
 		complete();
 	};
-	teardown.expirePendingPair = quarantinePair;
+	teardown.expirePendingPairs.push(quarantinePair);
 	const outcome = registrant.signalGroup(teardown.signal);
 	if (typeof outcome === "object") {
 		quarantinePair(`the process group could not be signalled: ${outcome.error.message}`);
@@ -560,7 +564,7 @@ function armRetentionWatchdog(lock, info) {
 	const resolveWatchdog = () => {
 		if (retentionWatchdog !== void 0) clearTimeout(retentionWatchdog.timer);
 		retentionWatchdog = void 0;
-		if (activeRegistration === void 0 && activeTeardown === void 0) removeCoordinatorListeners();
+		if (activeRegistrations.size === 0 && activeTeardown === void 0) removeCoordinatorListeners();
 	};
 	const tick = () => {
 		if (info.pid !== void 0) {
@@ -616,12 +620,13 @@ function createDefaultRunWrangler(root, options) {
 	const isWindows = process.platform === "win32";
 	const teardownDeadlineMs = options?.signalTeardownDeadlineMs ?? confirmGraceMs + SIGNAL_TEARDOWN_DEADLINE_MARGIN_MS;
 	return (args, opts) => new Promise((resolvePromise, rejectPromise) => {
+		const parallelWorkerUpload = options?.parallelWorkerUpload === true && args[0] === "versions" && args[1] === "upload";
 		if (activeTeardown !== void 0) {
 			rejectPromise(/* @__PURE__ */ new Error(`provision: refusing to spawn wrangler — a fatal ${activeTeardown.signal} is being handled and this process is terminating; no new wrangler work may start.`));
 			return;
 		}
-		if (activeRegistration !== void 0) {
-			rejectPromise(/* @__PURE__ */ new Error("provision: refusing to spawn wrangler — another wrangler child is already active in this process (wrangler calls must run sequentially; provisions run at most one per process)."));
+		if (!canRegisterRunner(parallelWorkerUpload)) {
+			rejectPromise(/* @__PURE__ */ new Error("provision: refusing to spawn wrangler — another wrangler child is already active in this process (only two immutable Worker uploads may overlap; all other Cloudflare commands and provisions remain sequential)."));
 			return;
 		}
 		const child = spawn(command, [...prefix, ...args], {
@@ -842,7 +847,7 @@ function createDefaultRunWrangler(root, options) {
 			confirmThenSettle(makeResult, `the child's exit (status ${String(code)}; surviving process-group members were SIGKILLed)`);
 			nudgeConfirmPolls();
 		});
-		registerRunner(registrant);
+		registerRunner(registrant, parallelWorkerUpload);
 		options?.onSpawnedChild?.(child);
 	});
 }

package/dist/{provision-DNtrtaVD.mjs → provision-Fr9pRqce.mjs}

@@ -1,3 +1,3 @@
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { _ as resolvePinnedApiBaseUrl, a as checkCloudflareProvisionDrift, c as enableD1ReadReplicationViaApi, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionEnv, h as provisionCloudflareResources, i as assertValidResourceName, l as isAlreadyGoneKillError, m as normalizeRunWranglerResult, n as acquireProvisionLock, o as createDefaultRunWrangler, p as isRealKvId, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware, t as WranglerQuarantineError, u as isQuarantineError, v as resolveProperLockfileKey } from "./provision-BhreDAOS.mjs";
+import { _ as resolvePinnedApiBaseUrl, a as checkCloudflareProvisionDrift, c as enableD1ReadReplicationViaApi, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionEnv, h as provisionCloudflareResources, i as assertValidResourceName, l as isAlreadyGoneKillError, m as normalizeRunWranglerResult, n as acquireProvisionLock, o as createDefaultRunWrangler, p as isRealKvId, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware, t as WranglerQuarantineError, u as isQuarantineError, v as resolveProperLockfileKey } from "./provision-C4IGqkBf.mjs";
 export { WranglerQuarantineError, acquireProvisionLock, assertNoTransportRedirectInProjectDotenv, assertValidResourceName, checkCloudflareProvisionDrift, createDefaultRunWrangler, deleteEnvVarCaseAware, enableD1ReadReplicationViaApi, isAlreadyGoneKillError, isQuarantineError, isQueueConfirmedAbsent, isRealD1Id, isRealKvId, normalizeRunWranglerResult, provisionCloudflareResources, provisionEnv, resolvePinnedApiBaseUrl, resolveProperLockfileKey, scanWranglerDotenvKeys };

package/dist/{requests-DFyhBMaf.mjs → requests-DN-BbNiM.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, c as import_picocolors, r as cliTitle } from "./output-CCH48AMM.mjs";
 import { c as getToken } from "./auth-DLNN0D3Z.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+import { a as dim, c as import_picocolors, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {
 	console.log();

package/dist/{rollback-DHHxXZiS.mjs → rollback-D7rzSaZM.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle } from "./output-CCH48AMM.mjs";
 import { c as getToken } from "./auth-DLNN0D3Z.mjs";
 import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { E as confirm, I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { E as confirm, I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
+import { a as dim, c as import_picocolors, i as createSpinner, o as ensureUtc, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/rollback.ts
 async function runRollbackCommand(root, deployId) {
 	console.log();
@@ -83,7 +83,7 @@ async function runRollbackCommand(root, deployId) {
 	outro(dim("Traffic is now serving the rolled-back deployment."));
 }
 async function runCloudflareRollback(root, deployId) {
-	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BipGMJ5O.mjs");
+	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BT6OWFBk.mjs");
 	const context = resolveCloudflareOperationContext(root);
 	const status = await readCloudflareWorkerStatus(context);
 	const deployedVersionIds = new Set(status.deployedVersionIds);

package/dist/runtime/env-public.d.mts

@@ -1,4 +1,4 @@
 /// <reference types="@cloudflare/workers-types" />
 import { a as number, c as url, i as json, n as boolean, o as oneOf, r as email, s as string, t as EnvSchema } from "../env-helpers-CyKtOBpj.mjs";
-import { a as _getSchemaDefaults, c as defineEnv, i as _getRegisteredSchema, l as env, n as EnvValidationReport, o as _hasRegisteredSchema, r as ValidatedEnv, s as _validateEnvOnce, t as EnvValidationError, u as validateAllEnv } from "../env-public-D_6u46fX.mjs";
+import { a as _getSchemaDefaults, c as defineEnv, i as _getRegisteredSchema, l as env, n as EnvValidationReport, o as _hasRegisteredSchema, r as ValidatedEnv, s as _validateEnvOnce, t as EnvValidationError, u as validateAllEnv } from "../env-public-BxU_0yTL.mjs";
 export { type EnvSchema, EnvValidationError, EnvValidationReport, ValidatedEnv, _getRegisteredSchema, _getSchemaDefaults, _hasRegisteredSchema, _validateEnvOnce, boolean, defineEnv, email, env, json, number, oneOf, string, url, validateAllEnv };

package/dist/runtime/handler.d.mts

@@ -1,3 +1,3 @@
 /// <reference types="@cloudflare/workers-types" />
-import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-BXJTXd02.mjs";
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-HEcZsaij.mjs";
 export { BasicAuthOptions, CloudBindings, CloudContext, CloudContextVariables, CloudEnv, type Deferred, type HandlerInput, type InferProps, QueueBatch, QueueMessage, QueueRetryOptions, RenderAssetTags, TypedHandler, TypedQueueHandler, ValidationError, type ValidatorSlots, VoidAssetRewriteError, basicAuth, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };

package/dist/runtime/live-client.d.mts

@@ -1,4 +1,4 @@
-import { t as LiveClientEvent } from "../live-CKiJilLr.mjs";
+import { t as LiveClientEvent } from "../live-CKJlvlNp.mjs";
 //#region src/runtime/live-client.d.ts
 export type LiveSubscribeOptions<Data = unknown> = {
   id: string;

package/dist/runtime/live.d.mts

@@ -1,3 +1,3 @@
 /// <reference types="@cloudflare/workers-types" />
-import { _ as __getLiveBindingName, a as LiveControlErrorCode, c as LiveControlOptions, d as LiveHookContext, f as LiveLimits, g as LiveSubscribeHookContext, h as LiveStreamOptions, i as LiveControlError, l as LiveControlRequest, m as LiveStream, n as LiveConnectHookContext, o as LiveControlOperation, p as LivePublishOptions, r as LiveConnectOptions, s as LiveControlOperationResult, t as LiveClientEvent, u as LiveControlResponse, v as __setLiveBindingName, y as defineLiveStream } from "../live-CKiJilLr.mjs";
+import { _ as __getLiveBindingName, a as LiveControlErrorCode, c as LiveControlOptions, d as LiveHookContext, f as LiveLimits, g as LiveSubscribeHookContext, h as LiveStreamOptions, i as LiveControlError, l as LiveControlRequest, m as LiveStream, n as LiveConnectHookContext, o as LiveControlOperation, p as LivePublishOptions, r as LiveConnectOptions, s as LiveControlOperationResult, t as LiveClientEvent, u as LiveControlResponse, v as __setLiveBindingName, y as defineLiveStream } from "../live-CKJlvlNp.mjs";
 export { LiveClientEvent, LiveConnectHookContext, LiveConnectOptions, LiveControlError, LiveControlErrorCode, LiveControlOperation, LiveControlOperationResult, LiveControlOptions, LiveControlRequest, LiveControlResponse, LiveHookContext, LiveLimits, LivePublishOptions, LiveStream, LiveStreamOptions, LiveSubscribeHookContext, __getLiveBindingName, __setLiveBindingName, defineLiveStream };

package/dist/runtime/sandbox-container.d.mts

@@ -0,0 +1,3 @@
+/// <reference types="@cloudflare/workers-types" />
+import { a as SandboxInstance, c as SandboxProcessWire, i as SandboxExecOptions, l as validateSandboxOptions, n as SandboxCapability, o as SandboxNativeContainer, r as SandboxContainer, s as SandboxOptions, t as DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS } from "../sandbox-container-DdNEBfCc.mjs";
+export { DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS, SandboxCapability, SandboxContainer, SandboxExecOptions, SandboxInstance, SandboxNativeContainer, SandboxOptions, SandboxProcessWire, validateSandboxOptions };

package/dist/runtime/sandbox-container.mjs

@@ -0,0 +1,2 @@
+import { n as SandboxContainer, r as validateSandboxOptions, t as DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS } from "../sandbox-container-4fdqLnyb.mjs";
+export { DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS, SandboxContainer, validateSandboxOptions };