void 0.21.9 → 0.23.0

package/dist/{dist-Dn6nn2IU.mjs → dist-CTBk70IR.mjs}

@@ -287,7 +287,7 @@ function wrapAnsi(string, columns, options) {
 	return String(string).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join("\n");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@clack+core@1.5.0/node_modules/@clack/core/dist/index.mjs
+//#region ../../node_modules/.pnpm/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
 var import_src = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const ESC = "\x1B";
 	const CSI = `${ESC}[`;
@@ -794,7 +794,7 @@ var n = class extends y {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@clack+prompts@1.8.0/node_modules/@clack/prompts/dist/index.mjs
+//#region ../../node_modules/.pnpm/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
 function isUnicodeSupported() {
 	if (process$1.platform !== "win32") return process$1.env.TERM !== "linux";
 	return Boolean(process$1.env.CI) || Boolean(process$1.env.WT_SESSION) || Boolean(process$1.env.TERMINUS_SUBLIME) || process$1.env.ConEmuTask === "{cmd::Cmder}" || process$1.env.TERM_PROGRAM === "Terminus-Sublime" || process$1.env.TERM_PROGRAM === "vscode" || process$1.env.TERM === "xterm-256color" || process$1.env.TERM === "alacritty" || process$1.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
@@ -891,28 +891,28 @@ const limitOptions = ({ cursor: l, options: e, style: w, output: p = process.std
 	for (const t of s) for (const n of t) x.push(n);
 	return c && x.push(M), x;
 };
-const confirm = (i) => {
-	const a = i.active ?? "Yes", s = i.inactive ?? "No";
+const confirm = (e) => {
+	const a = e.active ?? "Yes", o = e.inactive ?? "No";
 	return new r({
 		active: a,
-		inactive: s,
-		signal: i.signal,
-		input: i.input,
-		output: i.output,
-		initialValue: i.initialValue ?? true,
+		inactive: o,
+		signal: e.signal,
+		input: e.input,
+		output: e.output,
+		initialValue: e.initialValue ?? true,
 		render() {
-			const e = i.withGuide ?? settings.withGuide, u = `${symbol(this.state)}  `, l = e ? `${styleText("gray", S_BAR)}  ` : "", f = wrapTextWithPrefix(i.output, i.message, l, u), o = `${e ? `${styleText("gray", S_BAR)}
+			const i = e.withGuide ?? settings.withGuide, u = `${symbol(this.state)}  `, l = i ? `${styleText("gray", S_BAR)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText("gray", S_BAR)}
 ` : ""}${f}
-`, c = this.value ? a : s;
+`, c = this.value ? a : o;
 			switch (this.state) {
-				case "submit": return `${o}${e ? `${styleText("gray", S_BAR)}  ` : ""}${styleText("dim", c)}`;
-				case "cancel": return `${o}${e ? `${styleText("gray", S_BAR)}  ` : ""}${styleText(["strikethrough", "dim"], c)}${e ? `
+				case "submit": return `${s}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText("dim", c)}`;
+				case "cancel": return `${s}${i ? `${styleText("gray", S_BAR)}  ` : ""}${styleText(["strikethrough", "dim"], c)}${i ? `
 ${styleText("gray", S_BAR)}` : ""}`;
 				default: {
-					const r = e ? `${styleText("cyan", S_BAR)}  ` : "", g = e ? styleText("cyan", S_BAR_END) : "";
-					return `${o}${r}${this.value ? `${styleText("green", S_RADIO_ACTIVE)} ${a}` : `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", a)}`}${i.vertical ? e ? `
+					const r = i ? `${styleText("cyan", S_BAR)}  ` : "", g = i ? styleText("cyan", S_BAR_END) : "";
+					return `${s}${r}${this.value ? `${styleText("green", S_RADIO_ACTIVE)} ${a}` : `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", a)}`}${e.vertical ? i ? `
 ${styleText("cyan", S_BAR)}  ` : `
-` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", s)}` : `${styleText("green", S_RADIO_ACTIVE)} ${s}`}
+` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", o)}` : `${styleText("green", S_RADIO_ACTIVE)} ${o}`}
 ${g}
 `;
 				}
@@ -932,7 +932,7 @@ const multiselect = (i) => {
 	const u = (t, a) => {
 		const r = t.label ?? String(t.value);
 		return a === "disabled" ? `${styleText("gray", S_CHECKBOX_INACTIVE)} ${m(r, (o) => styleText(["strikethrough", "gray"], o))}${t.hint ? ` ${styleText("dim", `(${t.hint ?? "disabled"})`)}` : ""}` : a === "active" ? `${styleText("cyan", S_CHECKBOX_ACTIVE)} ${r}${t.hint ? ` ${styleText("dim", `(${t.hint})`)}` : ""}` : a === "selected" ? `${styleText("green", S_CHECKBOX_SELECTED)} ${m(r, (o) => styleText("dim", o))}${t.hint ? ` ${styleText("dim", `(${t.hint})`)}` : ""}` : a === "cancelled" ? `${m(r, (o) => styleText(["strikethrough", "dim"], o))}` : a === "active-selected" ? `${styleText("green", S_CHECKBOX_SELECTED)} ${r}${t.hint ? ` ${styleText("dim", `(${t.hint})`)}` : ""}` : a === "submitted" ? `${m(r, (o) => styleText("dim", o))}` : `${styleText("dim", S_CHECKBOX_INACTIVE)} ${m(r, (o) => styleText("dim", o))}`;
-	}, d = i.required ?? true, v = i.showInstructions ?? true;
+	}, d = i.required ?? true, x = i.showInstructions ?? true;
 	return new a({
 		options: i.options,
 		signal: i.signal,
@@ -952,7 +952,7 @@ ${styleText("reset", styleText("dim", `Press ${styleText([
 		render() {
 			const t = i.withGuide ?? settings.withGuide, a = wrapTextWithPrefix(i.output, i.message, t ? `${symbolBar(this.state)}  ` : "", `${symbol(this.state)}  `), r = `${t ? `${styleText("gray", S_BAR)}
 ` : ""}${a}
-`, o = this.value ?? [], p = (n, l) => {
+`, o = this.value ?? [], g = (n, l) => {
 				if (n.disabled) return u(n, "disabled");
 				const s = o.includes(n.value);
 				return l && s ? u(n, "active-selected") : s ? u(n, "selected") : u(n, l ? "active" : "inactive");
@@ -970,7 +970,7 @@ ${styleText("gray", S_BAR)}` : ""}`;
 				}
 				case "error": {
 					const n = t ? `${styleText("yellow", S_BAR)}  ` : "", l = this.error.split(`
-`).map(($, C) => C === 0 ? `${t ? `${styleText("yellow", S_BAR_END)}  ` : ""}${styleText("yellow", $)}` : `   ${$}`).join(`
+`).map(($, v) => v === 0 ? `${t ? `${styleText("yellow", S_BAR_END)}  ` : ""}${styleText("yellow", $)}` : `   ${$}`).join(`
 `), s = r.split(`
 `).length, h = l.split(`
 `).length + 1;
@@ -981,7 +981,7 @@ ${styleText("gray", S_BAR)}` : ""}`;
 						maxItems: i.maxItems,
 						columnPadding: n.length,
 						rowPadding: s + h,
-						style: p
+						style: g
 					}).join(`
 ${n}`)}
 ${l}
@@ -989,7 +989,7 @@ ${l}
 				}
 				default: {
 					const n = t ? `${styleText("cyan", S_BAR)}  ` : "", l = r.split(`
-`).length, s = v ? formatInstructionFooter(MULTISELECT_INSTRUCTIONS, t) : t ? [styleText("cyan", S_BAR_END)] : [], h = s.join(`
+`).length, s = x ? formatInstructionFooter(MULTISELECT_INSTRUCTIONS, t) : t ? [styleText("cyan", S_BAR_END)] : [], h = s.join(`
 `), $ = s.length + 1;
 					return `${r}${n}${limitOptions({
 						output: i.output,
@@ -998,7 +998,7 @@ ${l}
 						maxItems: i.maxItems,
 						columnPadding: n.length,
 						rowPadding: l + $,
-						style: p
+						style: g
 					}).join(`
 ${n}`)}
 ${h}
@@ -1102,29 +1102,29 @@ ${h}
 ${styleText("gray", l$1 + S_BAR_H.repeat(t + 2) + S_CORNER_BOTTOM_RIGHT)}
 `);
 };
-const password = (r) => new u$1({
-	validate: r.validate,
-	mask: r.mask ?? S_PASSWORD_MASK,
-	signal: r.signal,
-	input: r.input,
-	output: r.output,
+const password = (e) => new u$1({
+	validate: e.validate,
+	mask: e.mask ?? S_PASSWORD_MASK,
+	signal: e.signal,
+	input: e.input,
+	output: e.output,
 	render() {
-		const e = r.withGuide ?? settings.withGuide, o = `${e ? `${styleText("gray", S_BAR)}
-` : ""}${symbol(this.state)}  ${r.message}
-`, c = this.userInputWithCursor, i = this.masked;
+		const r = e.withGuide ?? settings.withGuide, o = `${r ? `${styleText("gray", S_BAR)}
+` : ""}${symbol(this.state)}  ${e.message}
+`, m = this.userInputWithCursor, i = this.masked;
 		switch (this.state) {
 			case "error": {
-				const s = e ? `${styleText("yellow", S_BAR)}  ` : "", n = e ? `${styleText("yellow", S_BAR_END)}  ` : "", l = i ?? "";
-				return r.clearOnError && this.clear(), `${o.trim()}
-${s}${l}
+				const s = r ? `${styleText("yellow", S_BAR)}  ` : "", n = r ? `${styleText("yellow", S_BAR_END)}  ` : "", d = i ?? "";
+				return e.clearOnError && this.clear(), `${o.trim()}
+${s}${d}
 ${n}${styleText("yellow", this.error)}
 `;
 			}
-			case "submit": return `${o}${e ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText("dim", i) : ""}`;
-			case "cancel": return `${o}${e ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText(["strikethrough", "dim"], i) : ""}${i && e ? `
+			case "submit": return `${o}${r ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText("dim", i) : ""}`;
+			case "cancel": return `${o}${r ? `${styleText("gray", S_BAR)}  ` : ""}${i ? styleText(["strikethrough", "dim"], i) : ""}${i && r ? `
 ${styleText("gray", S_BAR)}` : ""}`;
-			default: return `${o}${e ? `${styleText("cyan", S_BAR)}  ` : ""}${c}
-${e ? styleText("cyan", S_BAR_END) : ""}
+			default: return `${o}${r ? `${styleText("cyan", S_BAR)}  ` : ""}${m}
+${r ? styleText("cyan", S_BAR_END) : ""}
 `;
 		}
 	}
@@ -1245,19 +1245,19 @@ ${styleText("gray", S_BAR)}` : ""}`;
 				}
 				default: {
 					const r = n ? `${styleText("cyan", S_BAR)}  ` : "", a = u.split(`
-`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText("cyan", S_BAR_END)] : [], b = p.join(`
-`), f = p.length + 1;
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText("cyan", S_BAR_END)] : [], f = p.join(`
+`), b = p.length + 1;
 					return `${u}${r}${limitOptions({
 						output: t.output,
 						cursor: this.cursor,
 						options: this.options,
 						maxItems: t.maxItems,
 						columnPadding: r.length,
-						rowPadding: a + f,
+						rowPadding: a + b,
 						style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
 					}).join(`
 ${r}`)}
-${b}
+${f}
 `;
 				}
 			}

package/dist/{domain-Dmhvb2oU.mjs → domain-y5Tvydvo.mjs}

@@ -1,8 +1,8 @@
-import { c as import_picocolors } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { N as note, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { N as note, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/domain.ts
 async function runDomainCommand(root, args) {
 	const platform = readDeploymentPlatform(root);
@@ -40,7 +40,7 @@ async function runDomainCommand(root, args) {
 }
 async function runCloudflareDomainCommand(root, args) {
 	if (args.projectSlug) throw new Error("domain: --project selects a Void platform project and is not used for direct Cloudflare apps.");
-	const { changeCloudflareDomain, listCloudflareDomains } = await import("./cloudflare-operations-BipGMJ5O.mjs");
+	const { changeCloudflareDomain, listCloudflareDomains } = await import("./cloudflare-operations-AiWashgg.mjs");
 	if (args.subcommand === "add") {
 		const result = await changeCloudflareDomain(root, args.hostname, "add");
 		log.success(result.modified ? `Domain ${args.hostname} added and activated on Cloudflare.` : `Domain ${args.hostname} is already configured.`);

package/dist/{email-DFi-s2t4.mjs → email-B3umsW75.mjs}

@@ -1,14 +1,14 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { c as import_picocolors, i as createSpinner } from "./output-CCH48AMM.mjs";
-import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-WaAQez1O.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
-import { c as getToken, d as openBrowser } from "./auth-DLNN0D3Z.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { m as readConfig } from "./config-CafTW6Cz.mjs";
-import { k as writeProvisionedWranglerConfig } from "./wrangler-BymcxrRa.mjs";
-import { E as confirm, F as password, N as note, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { m as readConfig } from "./config-Br_JZD6u.mjs";
 import { a as scanEmailHandlersSync } from "./email--tEtMoj_.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
+import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as createNodeEmailDns, bt as renderAddressMap, gt as applyEmailSetup, h as createDeployWranglerRunner, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as findEmailConfigConflicts, xt as renderEmailChecklist, yt as preflightEmail } from "./deploy-DzAIwqNU.mjs";
+import { c as getToken, d as openBrowser } from "./auth-CSkdO2Bb.mjs";
+import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
+import { A as writeProvisionedWranglerConfig } from "./wrangler-7K-bW_DL.mjs";
+import { E as confirm, F as password, N as note, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
+import { c as import_picocolors, i as createSpinner } from "./output-Dm_A4Tbv.mjs";
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { execSync } from "node:child_process";
@@ -324,6 +324,7 @@ async function emailDomainAdd(client, projectId, rawDomain, subdomain, deps = {}
 	};
 	const domain = normalizeEmailDomainInput(rawDomain);
 	if (!isValidEmailDomainInput(domain)) return fail(`email: invalid domain '${rawDomain}'.`);
+	if (subdomain !== void 0) return fail("email: Platform-managed custom email requires a Cloudflare zone apex because inbound email uses its catch-all. Omit --subdomain, choose an unused zone apex, or use the platform shared mail address.");
 	let target;
 	try {
 		target = resolveEmailDomainTarget(domain, subdomain);
@@ -332,28 +333,16 @@ async function emailDomainAdd(client, projectId, rawDomain, subdomain, deps = {}
 	}
 	const dns = deps.dns ?? await createNodeEmailDns();
 	const decideTarget = async () => {
-		if (target.forced) {
-			const mx = await lookupMxForRender(dns, target.emailDomain);
-			if (mx !== null && mx.length > 0) log.warn(`MX        ${target.emailDomain} already carries MX (${mx.join(", ")}) — the platform re-checks over public DNS and may refuse it.`);
-		} else {
-			const mx = await lookupMxForRender(dns, domain);
-			if (mx === null) log.info(`MX        could not read ${domain}'s MX from here — the platform decides over public DNS.`);
-			else if (mx.length > 0) {
-				target = {
-					emailDomain: `mail.${domain}`,
-					forced: false
-				};
-				log.info(`MX        ${domain} carries MX for ${mx[0]} → apex is off limits\n          using ${target.emailDomain}  [change with --subdomain]`);
-				const subMx = await lookupMxForRender(dns, target.emailDomain);
-				if (subMx !== null && subMx.length > 0) log.warn(`MX        ${target.emailDomain} also carries MX (${subMx.join(", ")}) — the platform may refuse it; pick another with --subdomain.`);
-			} else log.info(`MX        ${domain} has no MX records → using the apex`);
-		}
+		const mx = await lookupMxForRender(dns, domain);
+		if (mx === null) log.info(`MX        could not read ${domain}'s MX from here — the platform decides over public DNS.`);
+		else if (mx.some((exchange) => !/\.mx\.cloudflare\.net$/i.test(exchange))) fail(`email: ${domain} already receives mail from another provider. Platform custom inbound email requires an unused Cloudflare zone apex; choose another apex or use the platform shared mail address.`);
+		else log.info(`MX        using the requested apex ${domain}`);
 	};
 	let renewal;
 	const settings = await client.getEmailSettings(projectId);
 	if (settings.domains.management === "admin") {
 		const rows = await client.listEmailDomains(projectId);
-		const existing = [target.emailDomain, ...target.forced ? [] : [`mail.${domain}`]].map((candidate) => rows.find((row) => row.domain === candidate && row.managed_by !== "admin")).find((row) => row !== void 0);
+		const existing = [target.emailDomain].map((candidate) => rows.find((row) => row.domain === candidate && row.managed_by !== "admin")).find((row) => row !== void 0);
 		if (!existing) {
 			await decideTarget();
 			const project = settings.domains.projectSlug ?? projectId;
@@ -724,11 +713,7 @@ async function runEmailCloudflareCommandInConfig(root, args, project, configPath
 		existingAddresses: rootConfig.addresses,
 		existingVars: rootConfig.vars && typeof rootConfig.vars === "object" && !Array.isArray(rootConfig.vars) ? rootConfig.vars : null,
 		configConflicts: findEmailConfigConflicts(rootConfig),
-		wranglerArgs: [
-			"-c",
-			wranglerConfigPath,
-			"--env="
-		],
+		configPath: wranglerConfigPath,
 		apiBaseUrl,
 		runWrangler,
 		getSessionBearer,

package/dist/{env-Csi-tMbT.mjs → env-BS6qYHDb.mjs}

@@ -1,11 +1,11 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
-import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-BB4GkLxn.mjs";
-import { N as note, O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-BPn7vk-V.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/env.ts
 async function runEnvCommand(root, args) {
@@ -26,7 +26,7 @@ async function runCheck(root, useRemoteSecrets) {
 		const platform = readDeploymentPlatform(root);
 		if (platform === "none") throw new Error("env: Deployment is disabled. Run `void init` to choose a platform.");
 		if (platform === "cloudflare") {
-			const { listCloudflareSecrets, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BipGMJ5O.mjs");
+			const { listCloudflareSecrets, resolveCloudflareOperationContext } = await import("./cloudflare-operations-AiWashgg.mjs");
 			remoteSecrets = await listCloudflareSecrets(resolveCloudflareOperationContext(root));
 		} else {
 			const token = getToken(root);

package/dist/{env-public-D_6u46fX.d.mts → env-public-BX_r8HR6.d.mts}

@@ -1,3 +1,4 @@
+import { l as VoidPlatformSandbox } from "./sandbox-XZAqzFlG.mjs";
 import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
 //#region src/runtime/env-public.d.ts
 type AnyValidator = StandardSchemaV1<unknown, unknown>;
@@ -112,7 +113,7 @@ declare global {
       KV: KVNamespace;
       STORAGE: R2Bucket;
       AI: Ai;
-      SANDBOX: DurableObjectNamespace<import("@cloudflare/sandbox").Sandbox>;
+      SANDBOX: DurableObjectNamespace<VoidPlatformSandbox>;
       /** @internal Service binding to proxy worker (AI, revalidation, future features) */
       __VOID_PROXY?: Fetcher;
       /** @internal Custom proxy URL override */

package/dist/{env-validation-BB4GkLxn.mjs → env-validation-BPn7vk-V.mjs}

@@ -2,7 +2,7 @@ import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { i as voidWarn } from "./log-ChfPKsVd.mjs";
 import { t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
 import { a as loadLocalEnv, i as isClientEnvKey, r as findLegacyEnvFiles } from "./env-_v349JBd.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
+import { c as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-B-wekeR6.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
@@ -733,59 +733,12 @@ function firstDeployMessage(missingKeys) {
 		...names.map((key) => `  void secret put ${key}`)
 	].join("\n");
 }
-/**
-* The exact `wrangler secret list` argv. Verified against the wrangler 4.131.0
-* bundle (`wrangler-dist/cli.js`, `secretListCommand`):
-*   - `secret list` accepts `--format` with choices `json`/`pretty`; `json` is
-*     the default AND suppresses the banner (`printBanner` is format==='pretty'),
-*     printing `JSON.stringify(secrets, null, '  ')` — an array of secret
-*     objects (each with a string `name`, per `fetchSecrets` →
-*     `GET /accounts/{id}/workers/scripts/{name}/secrets`). Pinned explicitly
-*     so a future default change can't silently switch us to `pretty`.
-*   - the worker name resolves from the config's `name` (`getLegacyScriptName`:
-*     `args.name ?? config.name` — we pass no `--name`, the pinned config is
-*     the single source of truth).
-*   - `-c <configPath>` (global `--config` alias) pins the ONE resolved config;
-*     `--env=` (explicit EMPTY environment) forces the top-level config env so
-*     a project dotenv exporting `CLOUDFLARE_ENV` can never reselect a named
-*     `env.*` block — same rationale as the provisioner's wranglerConfigArgs.
-*/
-function secretListArgs(configPath) {
-	return [
-		"secret",
-		"list",
-		"--format=json",
-		"-c",
-		configPath,
-		"--env="
-	];
-}
-/**
-* wrangler 4.131's `secret list` worker-not-found signal. When the worker has
-* never been deployed, `fetchSecrets` throws the API worker-not-found error and
-* `secretListCommand.handler` — ONLY when `isWorkerNotFoundError(e)` is true
-* (`e.code === 10007` WORKER_NOT_FOUND or `10090`
-* WORKER_LEGACY_ENVIRONMENT_NOT_FOUND, per wrangler-dist/cli.js) — rethrows a
-* `UserError` with this exact fixed diagnostic block:
-*
-*   Worker "<name>"[ (env: <env>)] not found.
-*
-*   If this is a new Worker, run `wrangler deploy` first to create it.
-*   Otherwise, check that the Worker name is correct and you're logged into the right account.
-*
-* The API code itself is caught and never printed, so the child's stderr
-* carries this MESSAGE, not `10007`/`10090`. Matching only the bare lead-in
-* `If this is a new Worker` misclassifies any unrelated status-1
-* diagnostic that merely contains that fragment. So we require the COMPLETE
-* structured block — the `… not found.` lead AND both fixed sentences of the
-* guidance — after normalizing whitespace (wrangler may wrap/indent the
-* multi-line UserError when it prints). The block carries no secret content, so
-* it survives `WRANGLER_LOG_SANITIZE=true`; the combined output is inspected
-* INTERNALLY only and never copied into any thrown error.
-*/
-function isWorkerNotFoundOutput(output) {
-	const normalized = output.replace(/\s+/g, " ");
-	return /Worker ".*?"(?: \(env: [^)]*\))? not found\./.test(normalized) && (normalized.includes("[code: 10007]") || normalized.includes("[code: 10090]") || normalized.includes("If this is a new Worker, run `wrangler deploy` first to create it.") && normalized.includes("Otherwise, check that the Worker name is correct and you're logged into the right account."));
+/** Select the generated top-level Worker config for structured secret discovery. */
+function secretListOperation(configPath) {
+	return {
+		type: "secret.list",
+		configPath
+	};
 }
 /**
 * Build the THROWN message for a wrangler-run failure from the structural
@@ -793,7 +746,7 @@ function isWorkerNotFoundOutput(output) {
 * `result.stdout`, a spawn-error string, or a rejection message — those are
 * unconstrained (the child inherits `process.env`) and could embed an env
 * value. Where wrangler's own diagnostics would help, the message tells the
-* user to re-run wrangler themselves rather than echoing its output here.
+* user to retry through Void rather than echoing its output here.
 */
 function secretListFailureMessage(reason, detail) {
 	const base = "env: `wrangler secret list` could not confirm the remote secrets";
@@ -815,14 +768,13 @@ function secretListError(reason, detail = {}) {
 * is never interpreted as "no secrets exist" — that would let a deploy proceed
 * with required secrets actually missing on the worker.
 *
-* A nonzero exit whose output carries wrangler's worker-not-found signal is a
+* A completed failure with a typed missing-Worker code is a
 * DISTINCT, structured {@link SelfHostFirstDeployError} carrying the still
-* unsatisfied required `missingKeys` + `wrangler secret put` bootstrap guidance,
+* unsatisfied required `missingKeys` + `void secret put` bootstrap guidance,
 * instead of the generic "list exited nonzero" dead end.
 *
 * Raw child output (stderr/stdout, spawn-error text, rejection messages)
-* is used ONLY internally: for worker-not-found classification the combined
-* output is matched to a boolean that never leaves this function. Every THROWN
+* does not participate in missing-Worker classification. Every THROWN
 * error carries only a structural {@link SecretListFailureReason} code and safe
 * scalars (exit code / signal name), so no env value the child may have echoed
 * can reach the error's message, fields, or JSON — even under `VOID_ENV_UNMASK`.
@@ -830,7 +782,7 @@ function secretListError(reason, detail = {}) {
 async function fetchSelfHostSecretNames(run, configPath, missingKeys) {
 	let result;
 	try {
-		result = await Promise.resolve(run(secretListArgs(configPath)));
+		result = await Promise.resolve(run(secretListOperation(configPath)));
 	} catch {
 		throw secretListError("spawn-error");
 	}
@@ -838,15 +790,10 @@ async function fetchSelfHostSecretNames(run, configPath, missingKeys) {
 	if (result.signal != null) throw secretListError("signal", { signal: String(result.signal) });
 	if (typeof result.status !== "number" || result.status !== 0) {
 		const exitCode = typeof result.status === "number" ? result.status : void 0;
-		if (isWorkerNotFoundOutput(`${result.stdout}\n${result.stderr}`)) throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys), missingKeys, exitCode);
+		if (Number.isSafeInteger(result.status) && result.status > 0 && ([10007, 10090].includes(result.errorCode ?? 0) || result.failure === "not-found")) throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys), missingKeys, exitCode);
 		throw secretListError("nonzero-exit", { exitCode });
 	}
-	let parsed;
-	try {
-		parsed = JSON.parse(result.stdout);
-	} catch {
-		throw secretListError("malformed-output");
-	}
+	const parsed = result.data;
 	if (!Array.isArray(parsed)) throw secretListError("malformed-output");
 	const names = [];
 	for (const member of parsed) {
@@ -881,7 +828,7 @@ const SECRET_LIST_TIMEOUT_MS = 12e4;
 /**
 * Default {@link RunSecretList}: resolves wrangler's REAL CLI entry
 * (`wrangler-dist/cli.js`, not the signal-swallowing `bin` wrapper) via
-* {@link resolveWranglerArgv} and spawns it ASYNC with `shell: false`, so every
+* {@link resolveCloudflareOperationArgv} and spawns it ASYNC with `shell: false`, so every
 * argv element is passed literally (no shell → no metacharacter injection) and
 * the event loop stays free. A hard timeout SIGKILLs a hung child; the result
 * carries `{status, signal, error}` provenance so the caller fails closed on
@@ -894,11 +841,11 @@ const SECRET_LIST_TIMEOUT_MS = 12e4;
 * fires), a bounded fallback settles the call as a HARD failure anyway.
 */
 function createDefaultSecretListRunner(root, options) {
-	const launcher = options?.launcher ?? resolveWranglerArgv(root);
+	const launcher = options?.launcher ?? resolveCloudflareOperationArgv(root);
 	const timeoutMs = options?.timeoutMs ?? SECRET_LIST_TIMEOUT_MS;
 	const [command, ...prefix] = launcher;
 	return (args) => new Promise((resolvePromise) => {
-		const child = spawn(command, [...prefix, ...args], {
+		const child = spawn(command, [...prefix, ...encodeCloudflareOperation(args)], {
 			cwd: root,
 			shell: false,
 			env: secretListEnv(options?.accountId),
@@ -927,7 +874,7 @@ function createDefaultSecretListRunner(root, options) {
 			settled = true;
 			clearTimeout(commandTimer);
 			clearTimeout(killFallbackTimer);
-			resolvePromise(result);
+			resolvePromise(decodeCloudflareOperationResult(result));
 		};
 		const timeoutNote = `env: wrangler secret list exceeded the ${timeoutMs}ms timeout`;
 		const commandTimer = setTimeout(() => {

package/dist/{env-validation-BXge7uyK.mjs → env-validation-DbTg7-ar.mjs}

@@ -1,2 +1,2 @@
-import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-BB4GkLxn.mjs";
+import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-BPn7vk-V.mjs";
 export { SelfHostSchemaError, computeInvalidEmittedKeys, deriveSelfHostSchemaFacts, readEmittedWorkerVars };

package/dist/{fetch-CXDChK7B.mjs → fetch-BIZJh7vR.mjs}

@@ -1,8 +1,8 @@
 import { n as ofetch } from "./fetch-error-Dj3crt0e.mjs";
+import { t as interpolateRouteParams } from "./route-url-CG7U-cRN.mjs";
 //#region src/runtime/fetch.ts
 async function fetch(path, options) {
-	let url = path;
-	if (options?.params) for (const [key, value] of Object.entries(options.params)) url = url.replace(`:${key}`, encodeURIComponent(value));
+	const url = interpolateRouteParams(path, options?.params);
 	return ofetch(url, {
 		method: options?.method ?? "GET",
 		body: options?.body,

package/dist/{fetch-stream-AOByI7Ki.mjs → fetch-stream-IvCYKyQL.mjs}

@@ -1,4 +1,5 @@
-import { n as ofetch } from "./fetch-error-Dj3crt0e.mjs";
+import { n as ofetch, t as FetchError } from "./fetch-error-Dj3crt0e.mjs";
+import { t as interpolateRouteParams } from "./route-url-CG7U-cRN.mjs";
 //#region src/runtime/fetch-stream.ts
 /**
 * Consume an SSE endpoint as an async generator of text chunks.
@@ -20,8 +21,7 @@ import { n as ofetch } from "./fetch-error-Dj3crt0e.mjs";
 * @yields {string} Text chunks from SSE data frames.
 */
 async function* fetchStream(path, options) {
-	let url = path;
-	if (options?.params) for (const [key, value] of Object.entries(options.params)) url = url.replace(`:${key}`, encodeURIComponent(value));
+	const url = interpolateRouteParams(path, options?.params);
 	const body = (await ofetch.raw(url, {
 		method: options?.method ?? "POST",
 		body: options?.body,
@@ -35,6 +35,16 @@ async function* fetchStream(path, options) {
 	const reader = body.getReader();
 	const decoder = new TextDecoder();
 	let buffer = "";
+	let event = "";
+	const terminal = (data) => {
+		if (event !== "void:error" && event !== "void:limit") return;
+		let message = "Generation was interrupted.";
+		try {
+			const body = JSON.parse(data);
+			if (typeof body.message === "string") message = body.message;
+		} catch {}
+		throw new FetchError(message);
+	};
 	try {
 		while (true) {
 			const { done, value } = await reader.read();
@@ -44,9 +54,18 @@ async function* fetchStream(path, options) {
 			buffer = lines.pop();
 			for (const line of lines) {
 				const trimmed = line.trim();
-				if (!trimmed || trimmed.startsWith(":")) continue;
+				if (trimmed.startsWith("event:")) {
+					event = trimmed.slice(6).trim();
+					continue;
+				}
+				if (!trimmed) {
+					event = "";
+					continue;
+				}
+				if (trimmed.startsWith(":")) continue;
 				if (trimmed.startsWith("data: ")) {
 					const data = trimmed.slice(6);
+					terminal(data);
 					if (data === "[DONE]") return;
 					try {
 						const parsed = JSON.parse(data);
@@ -64,6 +83,7 @@ async function* fetchStream(path, options) {
 			const trimmed = buffer.trim();
 			if (trimmed.startsWith("data: ")) {
 				const data = trimmed.slice(6);
+				terminal(data);
 				if (data !== "[DONE]") try {
 					const parsed = JSON.parse(data);
 					if (typeof parsed.response === "string") yield parsed.response;

package/dist/{gen-Dz3X1Qab.mjs → gen-B580--vC.mjs}

@@ -1,12 +1,12 @@
 import { a as join, l as relative, n as dirname } from "./dist-BVqXeR_h.mjs";
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
-import { m as readConfig, u as getDatabaseDialect } from "./config-CafTW6Cz.mjs";
-import { n as ensureProjectTsconfig } from "./project-tsconfig-B8GeM0RM.mjs";
+import { m as readConfig, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
 import { n as readJournal, t as collectMigrations } from "./collect-DiTn9yr6.mjs";
-import { I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { n as ensureProjectTsconfig } from "./project-tsconfig-B8GeM0RM.mjs";
+import { I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
 import { t as writeDrizzleConfig } from "./config-D8MOgiQV.mjs";
-import { r as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-CIUwFpjB.mjs";
+import { r as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-ctOrgiS3.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-BV4AzNul.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/dist/gen-BVaUUumi.mjs

@@ -0,0 +1,2 @@
+import { r as runGenCommand } from "./gen-B580--vC.mjs";
+export { runGenCommand };

package/dist/{github-cmd-BED3_9JD.mjs → github-cmd-v45BdfKX.mjs}

@@ -1,8 +1,8 @@
-import { c as import_picocolors } from "./output-CCH48AMM.mjs";
-import { c as getToken, d as openBrowser, n as createCodeChallenge, r as createCodeVerifier, t as awaitBrowserCallback } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken, d as openBrowser, n as createCodeChallenge, r as createCodeVerifier, t as awaitBrowserCallback } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { B as text, E as confirm, I as select, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
+import { B as text, E as confirm, I as select, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
+import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
 import { randomBytes } from "node:crypto";
@@ -90,14 +90,12 @@ function formatInstallations(installations) {
 function formatConnection(connection) {
 	const row = (label, value) => `  ${label.padEnd(16)}${value}`;
 	const workflow = connection.build_executor === "github_actions" ? connection.workflow_path : `${connection.workflow_path} (unused for container builds)`;
-	const rows = [
+	return [
 		row("Repository", connection.repo_full_name),
 		row("Branch", connection.branch),
 		row("Build executor", connection.build_executor),
 		row("Deploy workflow", workflow)
-	];
-	if (connection.requires_reconnect) rows.push(row("Authorization", "Reconnect required: run `void github connect` for this repository"));
-	return rows.join("\n");
+	].join("\n");
 }
 async function runGithubCommand(root, args) {
 	const token = getToken(root);

package/dist/{handler-BXJTXd02.d.mts → handler-CZ4nAylQ.d.mts}

@@ -1,3 +1,4 @@
+import { l as VoidPlatformSandbox } from "./sandbox-XZAqzFlG.mjs";
 import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
 import { n as HeadDescriptor } from "./head-Do8P4puT.mjs";
 import { r as AuthUser, t as AuthSession } from "./auth-DkcFflXV.mjs";
@@ -98,7 +99,7 @@ interface CloudBindings extends VoidGeneratedEnvBindings {
   KV: KVNamespace;
   STORAGE: R2Bucket;
   AI: Ai;
-  SANDBOX: DurableObjectNamespace<import("@cloudflare/sandbox").Sandbox>;
+  SANDBOX: DurableObjectNamespace<VoidPlatformSandbox>;
   [key: string]: unknown;
 }
 type CloudEnv = Env & {