void 0.21.9 → 0.23.0

package/dist/{help-DC7gdz7L.mjs → help-daGKjXGk.mjs}

@@ -1,8 +1,8 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { c as import_picocolors, l as sectionTitle, s as helpLine, t as categoryTitle } from "./output-CCH48AMM.mjs";
-import { N as note, P as outro } from "./dist-Dn6nn2IU.mjs";
+import { N as note, P as outro } from "./dist-CTBk70IR.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
-import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-DUwumHpQ.mjs";
+import { c as import_picocolors, s as helpLine, t as categoryTitle, u as sectionTitle } from "./output-Dm_A4Tbv.mjs";
+import { n as operatorGroups, t as operatorCommands } from "./operator-args-CLgKGlwU.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/ascii.ts
 const asciiArts = [
@@ -26,563 +26,6 @@ dP   .dP .d8888b. dP .d888b88
 |___/\\____/_/\\__,_/`
 ];
 //#endregion
-//#region src/cli/operator-args.ts
-const operatorCommands = [
-	{
-		group: "auth",
-		action: "login",
-		description: "Sign in as a platform administrator",
-		path: "/session",
-		values: { provider: "OAuth provider" },
-		booleans: ["token-stdin"]
-	},
-	{
-		group: "auth",
-		action: "logout",
-		description: "Revoke the current operator session and remove its local credential",
-		path: "/session/logout"
-	},
-	{
-		group: "auth",
-		action: "status",
-		description: "Inspect operator identity, expiry, and capabilities",
-		path: "/session"
-	},
-	{
-		group: "auth",
-		action: "token",
-		description: "Print an operator token; exchange an API session with --token-stdin",
-		path: "/session",
-		booleans: ["token-stdin"]
-	},
-	{
-		group: "user",
-		action: "list",
-		description: "List users",
-		path: "/users",
-		values: { search: "Search login or email" }
-	},
-	{
-		group: "user",
-		action: "show",
-		description: "Inspect a user, usage, and projects",
-		path: "/users/:id",
-		positional: ["id"]
-	},
-	{
-		group: "user",
-		action: "plan",
-		description: "Change a user plan",
-		path: "/users/:id/plan",
-		positional: ["id", "plan"],
-		method: "POST"
-	},
-	{
-		group: "user",
-		action: "suspend",
-		description: "Suspend a user and their projects",
-		path: "/users/:id/suspend",
-		positional: ["id"],
-		values: { reason: "Reason for suspension" },
-		method: "POST"
-	},
-	{
-		group: "user",
-		action: "restore",
-		description: "Restore a suspended user",
-		path: "/users/:id/restore",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "user",
-		action: "delete",
-		description: "Delete a user and all owned resources",
-		path: "/users/:id/delete",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "project",
-		action: "list",
-		description: "List tenant projects",
-		path: "/projects",
-		values: {
-			user: "Owner user ID",
-			search: "Search projects"
-		}
-	},
-	{
-		group: "project",
-		action: "show",
-		description: "Inspect a project and its resources",
-		path: "/projects/:id",
-		positional: ["id"]
-	},
-	{
-		group: "project",
-		action: "delete",
-		description: "Delete a project and its resources",
-		path: "/projects/:id/delete",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "project",
-		action: "owner",
-		description: "Transfer project ownership to another registered user",
-		path: "/projects/:id/owner",
-		positional: ["id", "userId"],
-		method: "POST"
-	},
-	{
-		group: "deployment",
-		action: "list",
-		description: "List tenant deployments",
-		path: "/deployments",
-		values: {
-			project: "Project ID",
-			search: "Search deployments",
-			status: "Deployment status"
-		}
-	},
-	{
-		group: "deployment",
-		action: "show",
-		description: "Inspect a deployment",
-		path: "/deployments/:id",
-		positional: ["id"]
-	},
-	{
-		group: "deployment",
-		action: "cancel",
-		description: "Cancel a deployment",
-		path: "/deployments/:id/cancel",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "deployment",
-		action: "logs",
-		description: "Read runtime logs (JSON follow emits one object per line)",
-		path: "/deployments/:id/logs",
-		positional: ["id"],
-		values: {
-			since: "Duration or ISO timestamp",
-			cursor: "Opaque continuation cursor"
-		},
-		booleans: ["follow"]
-	},
-	{
-		group: "build",
-		action: "show",
-		description: "Inspect a managed build",
-		path: "/builds/:id",
-		positional: ["id"]
-	},
-	{
-		group: "build",
-		action: "logs",
-		description: "Read build logs (JSON follow emits one object per line)",
-		path: "/builds/:id/logs",
-		positional: ["id"],
-		values: { since: "Last received sequence number" },
-		booleans: ["follow"]
-	},
-	{
-		group: "signup",
-		action: "show",
-		description: "Inspect signup restrictions and allowlist",
-		path: "/signup"
-	},
-	{
-		group: "signup",
-		action: "restrict",
-		description: "Restrict signup to the allowlist",
-		path: "/signup/restrict",
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "open",
-		description: "Open public signup",
-		path: "/signup/open",
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "allow",
-		description: "Add a GitHub, email, or exact login identity grant",
-		path: "/signup/allow",
-		positional: ["type", "pattern"],
-		usage: ["void platform signup allow <github|email> <pattern> [options]", "void platform signup allow identity <connection-id> <subject> [options]"],
-		values: { note: "Allowlist note" },
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "disallow",
-		description: "Remove a GitHub, email, or exact login identity grant",
-		path: "/signup/disallow",
-		positional: ["type", "pattern"],
-		usage: ["void platform signup disallow <github|email> <pattern> [options]", "void platform signup disallow identity <connection-id> <subject> [options]"],
-		method: "POST"
-	},
-	{
-		group: "signup",
-		action: "remove",
-		description: "Remove a GitHub or email allowlist pattern (compatibility alias)",
-		path: "/signup/remove",
-		positional: ["type", "pattern"],
-		method: "POST"
-	},
-	{
-		group: "invitation",
-		action: "list",
-		description: "List invitations",
-		path: "/invitations"
-	},
-	{
-		group: "invitation",
-		action: "send",
-		description: "Send invitations to comma-separated email addresses",
-		path: "/invitations/send",
-		positional: ["emails"],
-		method: "POST"
-	},
-	{
-		group: "invitation",
-		action: "revoke",
-		description: "Revoke an invitation",
-		path: "/invitations/:id/revoke",
-		positional: ["id"],
-		method: "POST"
-	},
-	{
-		group: "system",
-		action: "overview",
-		description: "Inspect platform usage and capacity",
-		path: "/system/overview"
-	},
-	{
-		group: "system",
-		action: "health",
-		description: "Check platform health",
-		path: "/system/health"
-	},
-	{
-		group: "system",
-		action: "cli-versions",
-		description: "Inspect CLI version adoption and deployment statistics",
-		path: "/system/cli-versions"
-	},
-	{
-		group: "system",
-		action: "events",
-		description: "List operator audit events",
-		path: "/system/events"
-	},
-	{
-		group: "system",
-		action: "backfill-queue-tokens",
-		description: "Repair missing queue authentication tokens",
-		path: "/system/backfill-queue-tokens",
-		method: "POST"
-	},
-	{
-		group: "system",
-		action: "sandbox-drain",
-		description: "Drain and verify managed Sandbox container applications",
-		path: "/system/sandbox-drain",
-		values: { cursor: "Opaque cursor returned by --plan" },
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "policy",
-		description: "Show the recipient policy for the shared sender",
-		path: "/email/policy"
-	},
-	{
-		group: "email",
-		action: "policy-set",
-		description: "Set the recipient policy: verified, domains, or any",
-		path: "/email/policy",
-		positional: ["mode"],
-		values: { domains: "Comma-separated recipient domains for mode=domains" },
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "settings",
-		description: "Show platform email settings",
-		path: "/email/settings"
-	},
-	{
-		group: "email",
-		action: "settings-set",
-		description: "Set who manages email domains: self-serve or admin",
-		path: "/email/settings",
-		values: { domains: "self-serve or admin" },
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "limit",
-		description: "Set a project's monthly and burst recipient submission caps",
-		path: "/email/projects/:project/limit",
-		positional: ["project"],
-		values: {
-			monthly: "Recipient submissions per UTC calendar month",
-			burst: "Recipient submissions per rolling 60-second window"
-		},
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "logs",
-		description: "Inspect retained email receipt and recipient outcomes for a project",
-		path: "/email/projects/:project/logs",
-		positional: ["project"]
-	},
-	{
-		group: "email",
-		action: "attempts",
-		description: "List unresolved email send attempts awaiting operator reconciliation",
-		path: "/email/attempts",
-		values: { project: "Project id or slug" }
-	},
-	{
-		group: "email",
-		action: "attempt-resolve",
-		description: "Resolve a stopped send as outcome unknown and release its cleanup fence",
-		path: "/email/attempts/:id/resolve",
-		positional: ["id"],
-		values: { reason: "Audit reason without recipient or message content" },
-		booleans: ["ended"],
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "operation-resolve",
-		description: "Resolve an ended ambiguous email setup write with operator attestation",
-		path: "/email/operations/:id/resolve",
-		positional: ["id"],
-		values: {
-			outcome: "Provider outcome: applied or not-applied",
-			reason: "Audit reason for the verified provider outcome"
-		},
-		booleans: ["ended"],
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "domains",
-		description: "List email domains registered on this platform",
-		path: "/email/domains",
-		values: { project: "Project id or slug" }
-	},
-	{
-		group: "email",
-		action: "domain-add",
-		description: "Register an email domain for a project with the platform credential",
-		path: "/email/domains",
-		positional: ["domain"],
-		values: { project: "Project id or slug" },
-		booleans: ["token-stdin"],
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "domain-status",
-		description: "Inspect an email domain's setup, credential and relay",
-		path: "/email/domains/:domain",
-		positional: ["domain"]
-	},
-	{
-		group: "email",
-		action: "domain-sync",
-		description: "Reconcile an email domain with its Cloudflare setup",
-		path: "/email/domains/:domain/sync",
-		positional: ["domain"],
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "domain-rotate-secret",
-		description: "Rotate an email domain's ingress secret",
-		path: "/email/domains/:domain/rotate-secret",
-		positional: ["domain"],
-		method: "POST"
-	},
-	{
-		group: "email",
-		action: "domain-remove",
-		description: "Remove an email domain and its Cloudflare setup",
-		path: "/email/domains/:domain/remove",
-		positional: ["domain"],
-		booleans: ["token-stdin"],
-		method: "POST"
-	},
-	{
-		group: "worker",
-		action: "list",
-		description: "List hosted platform workers",
-		path: "/workers",
-		values: { environment: "production or staging" }
-	},
-	{
-		group: "worker",
-		action: "show",
-		description: "Inspect hosted worker versions",
-		path: "/workers/:id",
-		positional: ["id"],
-		values: { environment: "production or staging" }
-	},
-	{
-		group: "worker",
-		action: "rollback",
-		description: "Roll back a hosted worker to a version",
-		path: "/workers/:id/rollback",
-		positional: ["id", "versionId"],
-		values: { environment: "production or staging" },
-		method: "POST"
-	},
-	{
-		group: "worker",
-		action: "rollback-all",
-		description: "Roll back all hosted workers to their previous versions",
-		path: "/workers/rollback-all",
-		values: { environment: "production or staging" },
-		method: "POST"
-	},
-	{
-		group: "worker",
-		action: "events",
-		description: "List hosted worker events or inspect a batch",
-		path: "/workers/events",
-		positional: ["batchId"],
-		optionalPositional: true,
-		values: { environment: "production or staging" }
-	}
-];
-const operatorGroups = [...new Set(operatorCommands.map(({ group }) => group))];
-function parseOperatorArgs(args) {
-	const positional = [];
-	const values = {};
-	const flags = /* @__PURE__ */ new Set();
-	const booleanFlags = /* @__PURE__ */ new Set([
-		"json",
-		"plan",
-		"yes",
-		"follow",
-		"token-stdin",
-		"force",
-		"ended"
-	]);
-	for (let index = 0; index < args.length; index++) {
-		const arg = args[index];
-		if (!arg.startsWith("-")) {
-			positional.push(arg);
-			continue;
-		}
-		if (!arg.startsWith("--")) throw new Error(`platform: Unknown flag '${arg}'.`);
-		const flag = arg.slice(2);
-		if (flags.has(flag) || Object.hasOwn(values, flag)) throw new Error(`platform: Duplicate flag '${arg}'.`);
-		if (booleanFlags.has(flag)) flags.add(flag);
-		else {
-			const value = args[++index];
-			if (!value || value.startsWith("-")) throw new Error(`platform: ${arg} requires a value.`);
-			values[flag] = value;
-		}
-	}
-	const [group = "", action = "", ...parameters] = positional;
-	if (!operatorGroups.includes(group)) throw new Error("platform: Unknown operator command group.");
-	const parsed = {
-		subcommand: "operator",
-		group,
-		action,
-		connection: values.connection ?? "",
-		json: flags.has("json"),
-		plan: flags.has("plan"),
-		yes: flags.has("yes"),
-		follow: flags.has("follow"),
-		tokenStdin: flags.has("token-stdin"),
-		provider: values.provider ?? "github",
-		...values.provider ? { providerExplicit: true } : {},
-		method: "GET",
-		path: "",
-		query: {},
-		body: {}
-	};
-	if (!action && args.length === 1) return parsed;
-	const command = operatorCommands.find((entry) => entry.group === group && entry.action === action);
-	if (!command) throw new Error(`platform: Usage: void platform ${group} <${operatorCommands.filter((entry) => entry.group === group).map(({ action }) => action).join("|")}>.`);
-	const count = command.positional?.length ?? 0;
-	const identitySignupEntry = group === "signup" && ["allow", "disallow"].includes(action) && parameters[0] === "identity";
-	if (group === "signup" && action === "remove" && parameters[0] === "identity") throw new Error("platform: Use `void platform signup disallow identity <connection-id> <subject>`.");
-	const expectedCount = identitySignupEntry ? 3 : count;
-	if (parameters.length > expectedCount || !command.optionalPositional && parameters.length !== expectedCount) throw new Error(`platform: Usage: ${command.usage?.[identitySignupEntry ? 1 : 0]?.replace(/ \[options\]$/, "") ?? `void platform ${group} ${action}${command.positional?.map((name) => ` <${name}>`).join("") ?? ""}`}.`);
-	const paged = action === "list" || action === "events" || action === "logs" || action === "attempts";
-	const allowed = /* @__PURE__ */ new Set([
-		"connection",
-		...command.method ? ["timeout"] : [],
-		...Object.keys(command.values ?? {}),
-		...paged ? ["limit", ...action !== "logs" || group === "email" ? ["page"] : []] : []
-	]);
-	for (const name of Object.keys(values)) if (!allowed.has(name)) throw new Error(`platform: Unknown flag '--${name}' for ${group} ${action}.`);
-	for (const name of flags) if (![
-		"json",
-		...command.method ? ["yes", "plan"] : [],
-		...command.booleans ?? []
-	].includes(name)) throw new Error(`platform: Unknown flag '--${name}' for ${group} ${action}.`);
-	if (parsed.plan && parsed.yes) throw new Error("platform: --plan and --yes cannot be combined.");
-	parsed.path = command.path;
-	parsed.method = command.method ?? "GET";
-	if (identitySignupEntry) {
-		const connectionId = parameters[1];
-		const subject = parameters[2];
-		if (!/^[a-z][a-z0-9-]{0,63}$/.test(connectionId)) throw new Error("platform: Invalid login connection ID.");
-		if (!subject || subject.length > 255) throw new Error("platform: Identity subject must be 1–255 characters.");
-		parsed.body = {
-			type: "identity",
-			connectionId,
-			subject
-		};
-	} else for (const [index, name] of (command.positional ?? []).entries()) {
-		const value = parameters[index];
-		if (value === void 0) continue;
-		if (value === "." || value === "..") throw new Error("platform: An object ID cannot be a dot path segment.");
-		if (parsed.path.includes(`:${name}`)) parsed.path = parsed.path.replace(`:${name}`, encodeURIComponent(value));
-		else if (group === "worker" && action === "events") parsed.path += `/${encodeURIComponent(value)}`;
-		else parsed.body[name] = name === "emails" ? value.split(",").map((email) => email.trim()) : value;
-	}
-	for (const [name, value] of Object.entries(values)) {
-		if (name === "connection" || name === "provider") continue;
-		if (name === "timeout") {
-			const maximum = OPERATOR_MAX_TIMEOUT_MS / 1e3;
-			if (!/^[1-9]\d*$/.test(value) || Number(value) > maximum) throw new Error(`platform: --timeout must be an integer from 1 to ${maximum} seconds.`);
-			parsed.timeoutMs = Number(value) * 1e3;
-			continue;
-		}
-		if (name === "page" || name === "limit") {
-			const maximum = name === "limit" ? action === "logs" && group !== "email" ? 500 : 100 : 1e6;
-			if (!/^[1-9]\d*$/.test(value) || Number(value) > maximum) throw new Error(`platform: --${name} must be an integer from 1 to ${maximum}.`);
-		}
-		if (name === "since" && group === "build" && (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))) throw new Error("platform: --since must be a nonnegative safe integer for build logs.");
-		if (name === "environment" && !["production", "staging"].includes(value)) throw new Error("platform: --environment must be production or staging.");
-		if (parsed.method === "POST") parsed.body[name] = value;
-		else parsed.query[name] = value;
-	}
-	if (parsed.body.type && ![
-		"github",
-		"email",
-		"identity"
-	].includes(String(parsed.body.type))) throw new Error("platform: Signup grant type must be github, email, or identity.");
-	for (const name of command.booleans ?? []) if (name !== "token-stdin" && flags.has(name)) parsed.body[name] = true;
-	return parsed;
-}
-//#endregion
 //#region src/cli/help.ts
 function operatorHelpTree() {
 	return Object.fromEntries(operatorGroups.map((group) => {
@@ -624,7 +67,8 @@ function operatorHelpTree() {
 						"list",
 						"events",
 						"logs",
-						"attempts"
+						"attempts",
+						"shared-recipients"
 					].includes(entry.action) ? [{
 						command: "--limit <number>",
 						description: entry.action === "logs" && group !== "email" ? "Maximum 500 log records" : "Maximum 100 records per page"
@@ -638,7 +82,7 @@ function operatorHelpTree() {
 					})),
 					...(entry.booleans ?? []).map((flag) => ({
 						command: `--${flag}`,
-						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : flag === "ended" ? "Attest that the original provider execution has ended" : flag === "token-stdin" && group === "email" ? entry.action === "domain-remove" ? "Read a replacement Cloudflare token for blocked project cleanup from stdin" : "Read a scoped Cloudflare API token from stdin" : "Read a full API session from stdin for explicit operator session exchange"
+						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : flag === "ended" ? "Attest that the original provider execution has ended" : flag === "protect-new-projects" ? "Protect newly created projects by default" : flag === "check" && group === "zero-trust" ? "Also check the saved settings against Cloudflare Access (several API calls)" : flag === "token-stdin" && group === "zero-trust" ? "Read the Access management API token from stdin" : flag === "token-stdin" && group === "email" ? entry.action === "domain-remove" ? "Read a replacement Cloudflare token for blocked project cleanup from stdin" : "Read a scoped Cloudflare API token from stdin" : "Read a full API session from stdin for explicit operator session exchange"
 					}))
 				]
 			}]))
@@ -870,6 +314,10 @@ const HELP_TREE = {
 				command: "config auth [command]",
 				description: "Configure login methods, company protection, and provider recovery"
 			},
+			{
+				command: "config plans [command]",
+				description: "Manage plans, account limits, and the default plan"
+			},
 			{
 				command: "list",
 				description: "List installed and connected platforms"
@@ -923,99 +371,177 @@ const HELP_TREE = {
 			...operatorHelpTree(),
 			config: {
 				summary: "Configure platform settings.",
-				usage: ["void platform config auth [command] [options]"],
-				children: { auth: {
-					summary: "Manage login methods and independent platform protection. Without a command, opens interactive configuration.",
-					usage: ["void platform config auth [list|show|initialize|add|configure|test|enable|disable|link|admission|protection|recover] [method-or-action] [options]"],
-					commands: [
-						{
-							command: "list",
-							description: "List configured login methods and platform protection"
-						},
-						{
-							command: "show <id>",
-							description: "Inspect a login method without displaying secrets"
-						},
-						{
-							command: "initialize",
-							description: "Import existing login settings before first configuration"
-						},
-						{
-							command: "add <github|google|oidc|cloudflare-access>",
-							description: "Configure a new login method"
-						},
-						{
-							command: "configure <id>",
-							description: "Stage an update to a login method"
-						},
-						{
-							command: "test <id>",
-							description: "Verify a login configuration in the browser"
-						},
-						{
-							command: "enable <id>",
-							description: "Enable a successfully tested configuration"
-						},
-						{
-							command: "disable <id>",
-							description: "Disable a method and revoke its human sessions"
-						},
-						{
-							command: "link <id>",
-							description: "Explicitly link a tested identity to your account"
-						},
-						{
-							command: "admission",
-							description: "Choose invited, company-approved, or public signup"
-						},
-						{
-							command: "protection <enable|disable|show>",
-							description: "Create or connect Access protection independently from login"
-						},
-						{
-							command: "recover <id>",
-							description: "Recover an existing administrator using installation authority"
-						}
-					],
-					options: [
-						{
-							command: "--connection <id-or-url>",
-							description: "Select a registered platform"
-						},
-						{
-							command: "--installation <id>",
-							description: "Select recovery authority for protection or provider recovery"
-						},
-						{
-							command: "--id <id>",
-							description: "Name a new OIDC or Access connection"
-						},
-						{
-							command: "--file <path>",
-							description: "Read nonsecret configuration from JSON"
-						},
-						{
-							command: "--client-secret-env <name>",
-							description: "Read the client secret from an environment variable"
-						},
-						{
-							command: "--test-id <id>",
-							description: "Use a completed test for enable or link"
-						},
-						{
-							command: "--plan",
-							description: "Validate and preview a change"
-						},
-						{
-							command: "--yes",
-							description: "Apply without prompting"
-						},
-						{
-							command: "--json",
-							description: "Print structured output"
-						}
-					]
-				} }
+				usage: ["void platform config <auth|plans> [command] [options]"],
+				children: {
+					plans: {
+						summary: "Manage plans and limits. Without a command, opens interactive configuration.",
+						usage: ["void platform config plans [show|add|set|reset|archive|restore|remove|default|sync] [plan-id] [options]"],
+						commands: [
+							{
+								command: "show [id]",
+								description: "Show the catalog or one plan and its account count"
+							},
+							{
+								command: "add <id> --copy <id> --name <name>",
+								description: "Copy an existing plan with a new stable ID"
+							},
+							{
+								command: "set <id>",
+								description: "Edit a plan name, limits, or build instance size"
+							},
+							{
+								command: "reset <id>",
+								description: "Restore a built-in plan’s original limits and build size"
+							},
+							{
+								command: "archive <id>",
+								description: "Keep current accounts while stopping new assignments"
+							},
+							{
+								command: "restore <id>",
+								description: "Allow assignments to an archived plan again"
+							},
+							{
+								command: "remove <id>",
+								description: "Remove an unused plan or move its accounts to a replacement"
+							},
+							{
+								command: "default <id>",
+								description: "Choose the plan new accounts receive"
+							},
+							{
+								command: "sync",
+								description: "Continue pending account limit updates"
+							}
+						],
+						options: [
+							{
+								command: "--connection <id-or-url>",
+								description: "Select a registered platform"
+							},
+							{
+								command: "--file <path>",
+								description: "Read plan settings and partial limits from JSON"
+							},
+							{
+								command: "--name <name>",
+								description: "Set the display name when adding or editing"
+							},
+							{
+								command: "--copy <id>",
+								description: "Copy this plan when adding a new one"
+							},
+							{
+								command: "--replacement <id>",
+								description: "Move accounts and any default before removing a plan"
+							},
+							{
+								command: "--plan",
+								description: "Preview the change and affected accounts"
+							},
+							{
+								command: "--yes",
+								description: "Apply without prompting"
+							},
+							{
+								command: "--json",
+								description: "Print structured output"
+							}
+						]
+					},
+					auth: {
+						summary: "Manage login methods and independent platform protection. Without a command, opens interactive configuration.",
+						usage: ["void platform config auth [list|show|initialize|add|configure|test|enable|disable|link|admission|protection|recover] [method-or-action] [options]"],
+						commands: [
+							{
+								command: "list",
+								description: "List configured login methods and platform protection"
+							},
+							{
+								command: "show <id>",
+								description: "Inspect a login method without displaying secrets"
+							},
+							{
+								command: "initialize",
+								description: "Import existing login settings before first configuration"
+							},
+							{
+								command: "add <github|google|oidc|cloudflare-access>",
+								description: "Configure a new login method"
+							},
+							{
+								command: "configure <id>",
+								description: "Stage an update to a login method"
+							},
+							{
+								command: "test <id>",
+								description: "Verify a login configuration in the browser"
+							},
+							{
+								command: "enable <id>",
+								description: "Enable a successfully tested configuration"
+							},
+							{
+								command: "disable <id>",
+								description: "Disable a method and revoke its human sessions"
+							},
+							{
+								command: "link <id>",
+								description: "Explicitly link a tested identity to your account"
+							},
+							{
+								command: "admission",
+								description: "Choose invited, company-approved, or public signup"
+							},
+							{
+								command: "protection <enable|disable|show>",
+								description: "Create or connect Access protection independently from login"
+							},
+							{
+								command: "recover <id>",
+								description: "Recover an existing administrator using installation authority"
+							}
+						],
+						options: [
+							{
+								command: "--connection <id-or-url>",
+								description: "Select a registered platform"
+							},
+							{
+								command: "--installation <id>",
+								description: "Select recovery authority for protection or provider recovery"
+							},
+							{
+								command: "--id <id>",
+								description: "Name a new OIDC or Access connection"
+							},
+							{
+								command: "--file <path>",
+								description: "Read nonsecret configuration from JSON"
+							},
+							{
+								command: "--client-secret-env <name>",
+								description: "Read the client secret from an environment variable"
+							},
+							{
+								command: "--test-id <id>",
+								description: "Use a completed test for enable or link"
+							},
+							{
+								command: "--plan",
+								description: "Validate and preview a change"
+							},
+							{
+								command: "--yes",
+								description: "Apply without prompting"
+							},
+							{
+								command: "--json",
+								description: "Print structured output"
+							}
+						]
+					}
+				}
 			},
 			domain: {
 				summary: "Add an application domain while keeping existing workers.dev URLs.",
@@ -1069,13 +595,29 @@ const HELP_TREE = {
 						command: "--auth-config <path>",
 						description: "Read login methods and signup policy from nonsecret JSON with environment secret references"
 					},
+					{
+						command: "--login-methods <methods>",
+						description: "Comma-separated github, google, oidc, or cloudflare-access login methods"
+					},
+					{
+						command: "--access-protection",
+						description: "Protect platform UI and APIs with Cloudflare Access"
+					},
+					{
+						command: "--no-access-protection",
+						description: "Skip Cloudflare Access protection"
+					},
+					{
+						command: "--hyperdrive <create|id>",
+						description: "Create Hyperdrive or use the specified existing configuration"
+					},
 					{
 						command: "--name <slug>",
 						description: "Installation name"
 					},
 					{
 						command: "--workers-dev",
-						description: "Use workers.dev for testing; add a domain later"
+						description: "Use workers.dev for testing. Add a domain later."
 					},
 					{
 						command: "--display-name <name>",
@@ -1087,7 +629,7 @@ const HELP_TREE = {
 					},
 					{
 						command: "--application-domain <domain>",
-						description: "Base domain for applications (zone apex is simplest)"
+						description: "Base domain for applications"
 					},
 					{
 						command: "--zone <domain>",
@@ -1097,10 +639,22 @@ const HELP_TREE = {
 						command: "--dedicated-zone",
 						description: "Allow zone-wide application catch-all routes"
 					},
+					{
+						command: "--no-dedicated-zone",
+						description: "Skip zone-wide application catch-all routes"
+					},
 					{
 						command: "--control-plane-domain <domain>",
 						description: "Optional API hostname"
 					},
+					{
+						command: "--no-control-plane-domain",
+						description: "Use the default workers.dev API hostname"
+					},
+					{
+						command: "--dashboard-url <origin>",
+						description: "HTTPS origin of a separately deployed dashboard"
+					},
 					{
 						command: "--plan",
 						description: "Print the exact plan without changing Cloudflare"
@@ -1193,6 +747,10 @@ const HELP_TREE = {
 				command: "team <command>",
 				description: "Manage members and project invitations"
 			},
+			{
+				command: "zero-trust <command>",
+				description: "Inspect or override Cloudflare Zero Trust protection"
+			},
 			{
 				command: "logs",
 				description: "Show runtime logs from the deployed project"
@@ -1319,6 +877,38 @@ const HELP_TREE = {
 					decline: basicSubcommand("Decline your invitation on the active platform connection (VOID_API_URL overrides it).", "void project team decline <invitation-id>")
 				}
 			},
+			"zero-trust": {
+				summary: "Inspect and manage Zero Trust protection for a Void platform project.",
+				usage: ["void project zero-trust <status|protect|public|reconcile> [options]"],
+				commands: [
+					{
+						command: "status",
+						description: "Show desired and effective protection state"
+					},
+					{
+						command: "protect",
+						description: "Protect the project"
+					},
+					{
+						command: "public",
+						description: "Make the project public"
+					},
+					{
+						command: "reconcile",
+						description: "Repair Cloudflare Access configuration drift"
+					}
+				],
+				options: [{
+					command: "--project <name>",
+					description: "Project name override"
+				}],
+				children: Object.fromEntries([
+					"status",
+					"protect",
+					"public",
+					"reconcile"
+				].map((action) => [action, withProjectOption(action === "status" ? "Show desired and effective Zero Trust protection." : action === "protect" ? "Protect the project with the platform Access policy." : action === "public" ? "Make the project public with a managed Access bypass." : "Repair Cloudflare Access configuration drift for the project.", `void project zero-trust ${action} [options]`)]))
+			},
 			logs: {
 				summary: "Show runtime logs from the deployed project.",
 				usage: ["void project logs [options]"],
@@ -1546,20 +1136,14 @@ const HELP_TREE = {
 					}
 				],
 				options: [{
-					command: "--subdomain <label|host>",
-					description: "On add: register this subdomain instead of the proposed mail.<domain>"
-				}, {
 					command: "--project <name>",
 					description: "Project name override"
 				}],
 				children: {
 					add: {
-						summary: "Register a domain on a Cloudflare zone you own for sending and receiving. Proposes mail.<domain> when the apex already carries MX.",
+						summary: "Register a Cloudflare zone apex you own for sending and receiving.",
 						usage: ["void email domain add <domain> [options]"],
 						options: [{
-							command: "--subdomain <label|host>",
-							description: "Register this subdomain instead of the proposed mail.<domain>"
-						}, {
 							command: "--project <name>",
 							description: "Project name override"
 						}]
@@ -2052,6 +1636,18 @@ const HELP_TREE = {
 			queue: basicSubcommand("Generate a queue consumer file.", "void gen queue <name>")
 		}
 	},
+	info: {
+		summary: "Inspect persistent resource names in this project without deploying.",
+		usage: ["void info [--json]"],
+		options: [{
+			command: "--json",
+			description: "Write structured JSON to stdout"
+		}],
+		examples: [{
+			command: "void info",
+			description: "Find names to preserve before moving persistent definitions"
+		}]
+	},
 	prepare: {
 		summary: "Generate .void artifacts without starting Vite.",
 		usage: ["void prepare"],
@@ -2084,7 +1680,7 @@ function withProjectOption(summary, usage) {
 function lifecycleHelp(command, summary) {
 	return {
 		summary,
-		usage: [`void platform ${command} [id] [--plan]${command === "disable" ? "" : " [--runtime <path>]"} [--yes]`],
+		usage: [`void platform ${command} [id] [--plan]${command === "disable" ? "" : " [--runtime <path>]"}${command === "upgrade" || command === "repair" ? " [--dashboard-url <origin>]" : ""} [--yes]`],
 		options: [
 			{
 				command: "--plan",
@@ -2094,6 +1690,10 @@ function lifecycleHelp(command, summary) {
 				command: "--runtime <path>",
 				description: "Deploy an integrity-checked runtime directory instead of the package"
 			}],
+			...command === "upgrade" || command === "repair" ? [{
+				command: "--dashboard-url <origin>",
+				description: "Configure a separately deployed dashboard; omission keeps its saved origin"
+			}] : [],
 			{
 				command: "--yes",
 				description: "Acknowledge non-interactive Cloudflare changes"
@@ -2109,6 +1709,8 @@ function printGlobalHelp() {
 		"",
 		globalCommandLine(["migrate"], "void migrate"),
 		"",
+		globalCommandLine(["info"], "void info [--json]"),
+		"",
 		globalCommandLine(["connect"], "void connect [url]"),
 		...globalOptionLines(["connect"]),
 		"",
@@ -2253,4 +1855,4 @@ function formatHelpPath(path) {
 	return path.length === 0 ? "help" : path.join(" ");
 }
 //#endregion
-export { operatorGroups as a, printVoidHeader as i, printGlobalHelp as n, parseOperatorArgs as o, printHelpPage as r, getHelpPath as t };
+export { printVoidHeader as i, printGlobalHelp as n, printHelpPage as r, getHelpPath as t };