void 0.23.0 → 0.24.0

package/dist/{deploy-DzAIwqNU.mjs → deploy-gCVaiJbS.mjs}

@@ -10,22 +10,22 @@ import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
 import { o as validateSsrEntry } from "./entry-CF5wvH4w.mjs";
 import { r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
 import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, r as SANDBOX_MIGRATION_TAG, s as requiresSandboxPlatformImage } from "./config-C_XRIPx2.mjs";
-import { i as trustedCloudflareWorkerAccessHeaders, r as scopedAccessCredentials, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode } from "./auth-CSkdO2Bb.mjs";
-import { r as ensurePlatformProxyAccess, t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
-import { d as writeProjectConfig, i as readDeploymentPlatform, l as writeDeploymentPlatform, o as readProjectConfig, t as attachSelectedPlatform } from "./project-C0Fqu05O.mjs";
+import { n as scopedAccessCredentials, r as trustedCloudflareWorkerAccessHeaders, t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { r as ensurePlatformProxyAccess, t as ensureCloudflaredToken } from "./cf-access-BGe5sWXF.mjs";
+import { l as writeProjectConfig, n as readDeploymentPlatform, o as shouldLinkDeployProject, r as readProjectConfig, s as writeDeploymentPlatform, t as attachSelectedPlatform } from "./project-DKG5Ra8p.mjs";
+import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl } from "./auth-CQkSDS50.mjs";
 import { i as persistCloudflareConfig, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-Bktvwtpf.mjs";
 import { A as writeProvisionedWranglerConfig, C as readWranglerPublishedTrafficSnapshot, D as syncWranglerDurableObjects, E as syncWranglerBindings, O as syncWranglerWebSockets, S as readWranglerManagedQueueCleanupCandidates, T as resolveLiveBindingConfig, _ as readExistingLiveBindingConfig, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, g as normalizeWranglerCompatibilityFlags, h as nextDurableObjectMigrationTag, j as writeWranglerPublishedTrafficSnapshot, l as bindingNamesForField, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, p as findBindingNameOwner, r as FRIENDLY_BINDING_NAMES, u as ensureWranglerCompat } from "./wrangler-7K-bW_DL.mjs";
-import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-DWi2IXWx.mjs";
+import { i as voidWarn, r as voidLog } from "./log-vqY3pqwI.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-2rKda9Y6.mjs";
 import { n as buildMigrationPlanBundle } from "./plan-NPpwZ_kc.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
 import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
 import { t as MagicString } from "./dist-AoCzRTJE.mjs";
-import { t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
-import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-BPn7vk-V.mjs";
+import { t as findEnvFile } from "./env-types-D5kds_OZ.mjs";
+import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-C_8tPdhs.mjs";
 import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-_v349JBd.mjs";
-import { E as confirm, I as select, N as note, O as intro, P as outro, W as isCancel, j as log$1 } from "./dist-CTBk70IR.mjs";
+import { A as confirm, B as note, H as outro, K as select, L as log$1, N as intro, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
 import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-B7QEjqSR.mjs";
 import { t as writeDrizzleConfig } from "./config-D8MOgiQV.mjs";
 import { i as runMySqlMigrations } from "./runner-mysql-DmWchSWJ.mjs";
@@ -35,18 +35,18 @@ import { i as validateMigrations, t as assertJournalCoherence } from "./validate
 import { t as renderPrerenderPaths } from "./prerender-render-D9qbLs2f.mjs";
 import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-BPqOT964.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
-import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
+import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-DKAsFA4X.mjs";
 import { a as detectPreset, c as resolveCloudflareOperationArgv, i as FRAMEWORK_PRESETS, l as resolveProjectCommand, o as formatProjectCommand, s as hasBackendFiles, t as createCloudflareProcessRunner } from "./cloudflare-process-B-wekeR6.mjs";
 import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-Qdc7tw8F.mjs";
 import { n as writeVoidProjectConfig } from "./config-write-B1f88wJA.mjs";
-import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-DHul7PRV.mjs";
-import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-fxHb-byx.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-q4_njtaW.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-DzH-A966.mjs";
 import { t as formatCloudflareUserMessage } from "./cloudflare-user-output-Q-k0QoNQ.mjs";
-import { c as import_picocolors$1, i as createSpinner, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
-import { a as promptProjectSelection, i as reportProjectCreationWarnings, o as promptProjectSetupAction, r as promptAndCreateProject } from "./create-project-bMf6ffLZ.mjs";
+import { c as import_picocolors$1, i as createSpinner, r as cliTitle } from "./output-CbM85T4k.mjs";
+import { a as promptProjectSelection, i as reportProjectCreationWarnings, o as promptProjectSetupAction, r as promptAndCreateProject } from "./create-project-CYOOAYcn.mjs";
 import { t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { t as promptForLoginToken } from "./login-UZKFM_u7.mjs";
+import { t as promptForLoginToken } from "./login-BuiMyUrx.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -112,6 +112,7 @@ function resolveAssetRoutingPolicy(inputs) {
 }
 //#endregion
 //#region src/cli/email-cloudflare.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 /** The `send_email` binding name Void provisions and the runtime reads. */
 const SEND_EMAIL_BINDING = "SEND_EMAIL";
 /** The root-config `vars` key carrying `void.config.ts` `email.from` into the worker. */
@@ -1538,8 +1539,8 @@ function buildPrerenderBindings(input) {
 	if (input.voidToken && input.voidProjectId) {
 		voidBindings.__VOID_TOKEN = input.voidToken;
 		voidBindings.__VOID_PROJECT_ID = input.voidProjectId;
-		if (input.voidStaging) voidBindings.__VOID_STAGING = "1";
-		voidBindings.__VOID_PROXY_URL = input.voidProxyUrl ?? (input.voidStaging ? "https://proxy.staging.void.cloud" : "https://proxy.void.cloud");
+		if (!input.voidProxyUrl) throw new Error("prerender: No connected platform proxy is available. Run `void connect <url>` first.");
+		voidBindings.__VOID_PROXY_URL = input.voidProxyUrl;
 		const access = scopedAccessCredentials(input.accessEnv ?? {}, voidBindings.__VOID_PROXY_URL);
 		if (access) voidBindings.__VOID_ACCESS_CREDENTIALS = access;
 		if (input.remoteMode) voidBindings.__VOID_REMOTE = "1";
@@ -1567,7 +1568,6 @@ async function createCloudflarePrerenderRunner(options) {
 		} catch {}
 	}
 	const voidToken = voidProjectId ? options.voidToken ?? getToken(root) : null;
-	const voidStaging = isStagingMode(root);
 	const voidProxyUrl = voidToken && voidProjectId ? getProxyUrl(root) : void 0;
 	if (voidProxyUrl) ensurePlatformProxyAccess(getApiUrl(root), voidProxyUrl);
 	const bindings = buildPrerenderBindings({
@@ -1577,7 +1577,6 @@ async function createCloudflarePrerenderRunner(options) {
 		voidToken,
 		voidProjectId,
 		voidProxyUrl,
-		voidStaging,
 		remoteMode
 	});
 	const { Miniflare, convertV4MiniflareOptions } = await import("miniflare");
@@ -1669,7 +1668,7 @@ async function prerenderPages(options) {
 			paths,
 			...await renderPrerenderPaths(paths, options.clientDir, (path) => runner.fetchPath(path), (path) => runner.fetchPageData(path), (path, outputFile, error) => {
 				if (error !== void 0) voidWarn(`prerender ${path} failed: ${error}`);
-				else voidLog(`prerender \x1b[36m${outputFile}\x1b[39m`);
+				else voidLog(`prerender ${import_picocolors.default.blue(outputFile)}`);
 			})
 		};
 	} finally {
@@ -1775,7 +1774,7 @@ async function prerenderPagesNode(options) {
 		ssrDir: options.ssrDir,
 		clientDir: options.clientDir
 	});
-	for (const path of result.rendered) voidLog(`prerender \x1b[36m${outputFileForPath(path)}\x1b[39m`);
+	for (const path of result.rendered) voidLog(`prerender ${import_picocolors.default.blue(outputFileForPath(path))}`);
 	for (const { path, error } of result.failed) voidWarn(`prerender ${path} failed: ${error}`);
 	return result;
 }
@@ -2894,14 +2893,25 @@ function createCfVersionRunner(options) {
 			};
 		}
 		if (operation.type === "versions.view") {
-			const result = await run([
+			const args = [
 				"workers",
 				"versions",
 				"get",
 				operation.versionId,
 				"--worker-id",
-				workerName
-			], true);
+				workerName,
+				...operation.includeSource ? ["--include", "modules"] : []
+			];
+			const called = operation.includeSource ? await runCf(args, {
+				cwd: output.directory,
+				capture: true,
+				timeoutMs: 3e4,
+				maxOutputBytes: 1048576
+			}) : await run(args, true);
+			const result = {
+				...called,
+				data: called.data ?? parseJson(called.stdout)
+			};
 			if (result.status !== 0 || result.signal || result.error) return result;
 			const version = result.data;
 			if (!record(version) || version.id !== operation.versionId || !Array.isArray(version.bindings)) return failed("The Cloudflare Worker version was not readable.");
@@ -3916,9 +3926,6 @@ function openDeployLog(opts) {
 		}
 	};
 }
-//#endregion
-//#region src/cli/log-summary.ts
-var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const FIELD_VALUE_MAX = 80;
 const LINE_MAX = 160;
 const MSG_COLUMN_MAX = 28;
@@ -5209,7 +5216,7 @@ let loadedProvisionModule;
 * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
 */
 async function loadProvisionModule() {
-	loadedProvisionModule ??= await import("./provision-C4ORE7G7.mjs");
+	loadedProvisionModule ??= await import("./provision-CVku1JFU.mjs");
 	return loadedProvisionModule;
 }
 /**
@@ -7251,7 +7258,8 @@ async function runCloudflareEmailStep(input) {
 	};
 	const from = input.voidConfig.email?.from;
 	if (!from) {
-		log.warn(["deploy: this app uses email, but void.config.ts names no sender.", "Set email.from to \"you@mail.acme.com\" in void.config.ts — deploying without email."].join("\n"));
+		if (Array.isArray(input.rootConfig.send_email) && input.rootConfig.send_email.some((binding) => binding?.name === "SEND_EMAIL") || Array.isArray(input.rootConfig.addresses) && input.rootConfig.addresses.length > 0) log.info("deploy: email.from is unset; skipping automatic email setup. Existing Cloudflare email configuration is preserved.");
+		else log.warn(["deploy: this app uses email, but void.config.ts names no sender.", "Set email.from to \"you@mail.acme.com\" in void.config.ts — automatic email setup skipped."].join("\n"));
 		return without;
 	}
 	const { rootConfig } = input;
@@ -8885,11 +8893,16 @@ async function runDeployInner(root, options, cliLog) {
 	}
 }
 async function runManagedDeploy(root, options, cliLog) {
+	const apiUrl = getApiUrl(root);
+	const requestedProjectSlug = getRequestedProjectSlug(options);
 	let reauthenticated = false;
 	while (true) try {
+		const savedProject = readProjectConfig(root);
+		const linkedProject = savedProject?.platformUrl === apiUrl ? savedProject : null;
+		if (savedProject && !linkedProject && !requestedProjectSlug) throw new Error(`deploy: This project is linked to ${savedProject.platformUrl}. Pass --project <slug> to deploy to ${apiUrl} without changing the saved link.`);
 		let token = process.env.VOID_TOKEN ? getToken(root) : null;
 		if (!token && isGithubActionsOidcAvailable()) {
-			const slug = getRequestedProjectSlug(options) ?? readProjectConfig(root)?.slug;
+			const slug = requestedProjectSlug ?? linkedProject?.slug;
 			if (!slug) throw new Error("deploy: running in GitHub Actions but the project is unknown — pass --project <slug> or link the project.");
 			cliLog.info("github_oidc_exchange_start", { slug });
 			const tokenOrigin = getApiUrl(root);
@@ -8908,8 +8921,6 @@ async function runManagedDeploy(root, options, cliLog) {
 			root,
 			cliLog
 		});
-		const requestedProjectSlug = getRequestedProjectSlug(options);
-		const linkedProject = readProjectConfig(root);
 		let config = null;
 		if (requestedProjectSlug) {
 			const linked = linkedProject?.slug === requestedProjectSlug ? await client.getProject(linkedProject.projectId) : null;
@@ -9007,24 +9018,31 @@ function assertProjectDeployAccess(project) {
 }
 async function promptDeployProjectConfig(root, client, cliLog) {
 	const projects = await client.listProjectChoices();
+	const link = shouldLinkDeployProject(root, client.apiUrl);
 	const deployableProjects = projects.filter((project) => project.role !== "reader");
 	if (deployableProjects.length !== projects.length) log.warn("Projects with reader access are hidden from deploy selection. Ask a project admin or owner to grant collaborator access to deploy to them.");
-	if (await promptProjectSetupAction("Set up a Void project for deploy:", { includeLink: deployableProjects.length > 0 }) === "create") return promptAndCreateProject(root, client);
+	if (await promptProjectSetupAction("Set up a Void project for deploy:", {
+		includeLink: deployableProjects.length > 0,
+		...link ? {} : { link: false }
+	}) === "create") return promptAndCreateProject(root, client, { link });
 	const result = await promptProjectSelection(deployableProjects, "Select a project to deploy to:", root, {
 		confirmExisting: true,
-		includeCreate: false
+		includeCreate: false,
+		...link ? {} : { link: false }
 	});
 	if (result.action === "create") throw new Error("Unexpected project selection result.");
 	const config = {
 		projectId: result.project.id,
 		slug: result.project.slug
 	};
-	writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
-	log.step(`Linked to ${import_picocolors$1.default.blue(config.slug)}`);
-	cliLog?.info("project_linked", {
-		projectId: config.projectId,
-		slug: config.slug
-	});
+	if (shouldLinkDeployProject(root, client.apiUrl)) {
+		writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
+		log.step(`Linked to ${import_picocolors$1.default.blue(config.slug)}`);
+		cliLog?.info("project_linked", {
+			projectId: config.projectId,
+			slug: config.slug
+		});
+	} else log.step(`Using ${import_picocolors$1.default.blue(config.slug)} for this deployment. Saved destination unchanged.`);
 	return config;
 }
 function resolveStaticBuildCommand(preset, buildOverride, hasExplicitDir = false) {
@@ -9133,7 +9151,9 @@ function applyDeployEvent(event, s) {
 				kind: "start",
 				deploymentId: event.deploymentId
 			};
-		case "heartbeat": return { kind: "continue" };
+		case "heartbeat":
+			if (event.status === "recovering") s.message("Recovering interrupted deployment...");
+			return { kind: "continue" };
 		case "asset_upload":
 			if (event.new > 0) s.message(`Uploading assets (${event.new} new, ${event.cached} cached)`);
 			else s.message(`Uploading assets (${event.total} cached)`);
@@ -9186,6 +9206,8 @@ function applyDeployEvent(event, s) {
 async function streamDeployEvents(projectId, events, s, cliLog) {
 	const startedAt = Date.now();
 	let deploymentId = null;
+	let lastProgressAt = startedAt;
+	let waitNotice;
 	let interrupted = false;
 	cliLog?.info("stream_start", { projectId });
 	const onSigint = () => {
@@ -9200,6 +9222,26 @@ async function streamDeployEvents(projectId, events, s, cliLog) {
 	process.once("SIGINT", onSigint);
 	try {
 		for await (const event of events) {
+			if (event.event === "heartbeat") {
+				const fields = {
+					deploymentId,
+					step: event.step,
+					status: event.status,
+					recoveryAt: event.recoveryAt
+				};
+				if (event.status === "recovering" && waitNotice !== "recovering") {
+					log.info(`Deployment ${deploymentId ?? event.deploymentId ?? ""} is recovering; waiting for its result.`);
+					cliLog?.info("deploy_recovering", fields);
+					waitNotice = "recovering";
+				} else if (Date.now() - lastProgressAt >= 9e4 && waitNotice === void 0) {
+					log.warn(`Deployment ${deploymentId ?? event.deploymentId ?? ""} has not reported new progress for 90 seconds (last reported progress: ${event.step.replaceAll("_", " ")}).` + (event.recoveryAt ? ` Automatic recovery can start after ${event.recoveryAt} if execution was interrupted.` : "") + " Inspect with `void project status`.");
+					cliLog?.warn("deploy_progress_stalled", fields);
+					waitNotice = "stalled";
+				}
+			} else {
+				lastProgressAt = Date.now();
+				waitNotice = void 0;
+			}
 			const result = applyDeployEvent(event, s);
 			if (result.kind === "start") {
 				deploymentId = result.deploymentId;
@@ -9556,7 +9598,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		} catch {}
 		if (resources) {
 			if (!resources.some((resource) => resource.type === "hyperdrive")) {
-				const { text: promptText, isCancel: isCancelPrompt } = await import("./dist-BuDuKZJv.mjs");
+				const { text: promptText, isCancel: isCancelPrompt } = await import("./prompts-2TGE6oXx.mjs");
 				const connectionString = await promptText({
 					message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
 					placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
@@ -9796,7 +9838,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 		} catch {}
 		if (resources) {
 			if (!resources.some((resource) => resource.type === "hyperdrive")) {
-				const { text: promptText, isCancel: isCancelPrompt } = await import("./dist-BuDuKZJv.mjs");
+				const { text: promptText, isCancel: isCancelPrompt } = await import("./prompts-2TGE6oXx.mjs");
 				const connectionString = await promptText({
 					message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
 					placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
@@ -10006,7 +10048,7 @@ async function createProjectFromSlug(root, client, slug, cliLog) {
 		projectId: project.id,
 		slug: project.slug
 	};
-	writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
+	if (shouldLinkDeployProject(root, client.apiUrl)) writeProjectConfig(root, attachSelectedPlatform(root, config, client.apiUrl));
 	log.success(`Project created: ${import_picocolors$1.default.blue(config.slug)}`);
 	reportProjectCreationWarnings(project);
 	cliLog?.info("project_create_success", {

package/dist/{deploy-bjXdFCtn.mjs → deploy-irP5q0-x.mjs}

@@ -1,2 +1,2 @@
-import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-DzAIwqNU.mjs";
+import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-gCVaiJbS.mjs";
 export { checkWranglerMigrationApplySet, parseRootWranglerConfig, runDeploy };

package/dist/{domain-y5Tvydvo.mjs → domain-DFfQE8jg.mjs}

@@ -1,8 +1,8 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { N as note, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
+import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken } from "./auth-CQkSDS50.mjs";
+import { B as note, L as log } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { c as import_picocolors } from "./output-CbM85T4k.mjs";
 //#region src/cli/domain.ts
 async function runDomainCommand(root, args) {
 	const platform = readDeploymentPlatform(root);
@@ -40,7 +40,7 @@ async function runDomainCommand(root, args) {
 }
 async function runCloudflareDomainCommand(root, args) {
 	if (args.projectSlug) throw new Error("domain: --project selects a Void platform project and is not used for direct Cloudflare apps.");
-	const { changeCloudflareDomain, listCloudflareDomains } = await import("./cloudflare-operations-AiWashgg.mjs");
+	const { changeCloudflareDomain, listCloudflareDomains } = await import("./cloudflare-operations-BCdXSsmo.mjs");
 	if (args.subcommand === "add") {
 		const result = await changeCloudflareDomain(root, args.hostname, "add");
 		log.success(result.modified ? `Domain ${args.hostname} added and activated on Cloudflare.` : `Domain ${args.hostname} is already configured.`);

package/dist/{email-B3umsW75.mjs → email-CdnhUHvJ.mjs}

@@ -2,13 +2,13 @@ import { a as join } from "./dist-BVqXeR_h.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { m as readConfig } from "./config-Br_JZD6u.mjs";
 import { a as scanEmailHandlersSync } from "./email--tEtMoj_.mjs";
-import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as createNodeEmailDns, bt as renderAddressMap, gt as applyEmailSetup, h as createDeployWranglerRunner, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as findEmailConfigConflicts, xt as renderEmailChecklist, yt as preflightEmail } from "./deploy-DzAIwqNU.mjs";
-import { c as getToken, d as openBrowser } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
+import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as createNodeEmailDns, bt as renderAddressMap, gt as applyEmailSetup, h as createDeployWranglerRunner, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as findEmailConfigConflicts, xt as renderEmailChecklist, yt as preflightEmail } from "./deploy-gCVaiJbS.mjs";
+import { r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken, u as openBrowser } from "./auth-CQkSDS50.mjs";
 import { A as writeProvisionedWranglerConfig } from "./wrangler-7K-bW_DL.mjs";
-import { E as confirm, F as password, N as note, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
-import { c as import_picocolors, i as createSpinner } from "./output-Dm_A4Tbv.mjs";
+import { A as confirm, B as note, L as log, U as password, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-DKAsFA4X.mjs";
+import { c as import_picocolors, i as createSpinner } from "./output-CbM85T4k.mjs";
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { execSync } from "node:child_process";
@@ -387,7 +387,7 @@ async function emailDomainAdd(client, projectId, rawDomain, subdomain, deps = {}
 				"Create the token in three clicks: Continue to summary → Create Token → Copy.",
 				"Watching the clipboard for it — nothing is read until you copy, and it is cleared afterwards.",
 				"(Enter pastes it yourself instead.)",
-				`If the browser didn't open, visit:\n${import_picocolors.default.cyan(url)}`
+				`If the browser didn't open, visit:\n${import_picocolors.default.blue(url)}`
 			].join("\n"));
 			const spinner = watchSpinner;
 			const deadline = Date.now() + (deps.watchTimeoutMs ?? 6e5);

package/dist/{env-BS6qYHDb.mjs → env-DmGdHi5i.mjs}

@@ -1,11 +1,11 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { i as readDeploymentPlatform, o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { r as generateEnvTypes, t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
-import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-BPn7vk-V.mjs";
-import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken } from "./auth-CQkSDS50.mjs";
+import { r as generateEnvTypes, t as findEnvFile } from "./env-types-D5kds_OZ.mjs";
+import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-C_8tPdhs.mjs";
+import { B as note, H as outro, L as log, N as intro } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { r as cliTitle } from "./output-CbM85T4k.mjs";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/env.ts
 async function runEnvCommand(root, args) {
@@ -26,7 +26,7 @@ async function runCheck(root, useRemoteSecrets) {
 		const platform = readDeploymentPlatform(root);
 		if (platform === "none") throw new Error("env: Deployment is disabled. Run `void init` to choose a platform.");
 		if (platform === "cloudflare") {
-			const { listCloudflareSecrets, resolveCloudflareOperationContext } = await import("./cloudflare-operations-AiWashgg.mjs");
+			const { listCloudflareSecrets, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BCdXSsmo.mjs");
 			remoteSecrets = await listCloudflareSecrets(resolveCloudflareOperationContext(root));
 		} else {
 			const token = getToken(root);

package/dist/{env-types-C2_bIk_b.mjs → env-types-D5kds_OZ.mjs}

@@ -1,6 +1,6 @@
 import { l as relative } from "./dist-BVqXeR_h.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
-import { i as voidWarn } from "./log-ChfPKsVd.mjs";
+import { i as voidWarn } from "./log-vqY3pqwI.mjs";
 import { existsSync } from "node:fs";
 //#region src/codegen/env-types.ts
 /** Roots already warned about duplicate env.ts files — dedupes noisy repeat calls. */

package/dist/{env-validation-BPn7vk-V.mjs → env-validation-C_8tPdhs.mjs}

@@ -1,6 +1,6 @@
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { i as voidWarn } from "./log-ChfPKsVd.mjs";
-import { t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
+import { i as voidWarn } from "./log-vqY3pqwI.mjs";
+import { t as findEnvFile } from "./env-types-D5kds_OZ.mjs";
 import { a as loadLocalEnv, i as isClientEnvKey, r as findLegacyEnvFiles } from "./env-_v349JBd.mjs";
 import { c as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-B-wekeR6.mjs";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{env-validation-DbTg7-ar.mjs → env-validation-zZOCcQVZ.mjs}

@@ -1,2 +1,2 @@
-import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-BPn7vk-V.mjs";
+import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-C_8tPdhs.mjs";
 export { SelfHostSchemaError, computeInvalidEmittedKeys, deriveSelfHostSchemaFacts, readEmittedWorkerVars };

package/dist/{gen-B580--vC.mjs → gen-CshAkukR.mjs}

@@ -3,10 +3,10 @@ import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { m as readConfig, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
 import { n as readJournal, t as collectMigrations } from "./collect-DiTn9yr6.mjs";
 import { n as ensureProjectTsconfig } from "./project-tsconfig-B8GeM0RM.mjs";
-import { I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { H as outro, K as select, L as log, N as intro, O as cancel, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
 import { t as writeDrizzleConfig } from "./config-D8MOgiQV.mjs";
 import { r as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-ctOrgiS3.mjs";
-import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as cliTitle } from "./output-CbM85T4k.mjs";
 import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-BV4AzNul.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/dist/gen-DvQTWzDU.mjs

@@ -0,0 +1,2 @@
+import { r as runGenCommand } from "./gen-CshAkukR.mjs";
+export { runGenCommand };

package/dist/{github-cmd-v45BdfKX.mjs → github-cmd-DftuEvIt.mjs}

@@ -1,8 +1,8 @@
-import { c as getToken, d as openBrowser, n as createCodeChallenge, r as createCodeVerifier, t as awaitBrowserCallback } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { B as text, E as confirm, I as select, T as cancel, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
-import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken, n as createCodeChallenge, r as createCodeVerifier, t as awaitBrowserCallback, u as openBrowser } from "./auth-CQkSDS50.mjs";
+import { A as confirm, K as select, L as log, O as cancel, X as text, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-DKAsFA4X.mjs";
+import { c as import_picocolors } from "./output-CbM85T4k.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
 import { randomBytes } from "node:crypto";
@@ -145,7 +145,7 @@ async function runInstall(root, client, linkIdentity = runGithubLink) {
 			}
 		} else throw err;
 	}
-	log.message(`Open this URL to install the Void GitHub App:\n${import_picocolors.default.cyan(url)}`);
+	log.message(`Open this URL to install the Void GitHub App:\n${import_picocolors.default.blue(url)}`);
 	const { execFile } = await import("node:child_process");
 	openBrowser(url, execFile);
 	log.message("After installing, run `void github connect` to link a repository to your project.");
@@ -173,7 +173,7 @@ async function runGithubLink(root, client) {
 				return url;
 			},
 			describeError: (p) => p.get("error") ? "GitHub authorization failed." : null,
-			onUrl: (url) => log.message(`Open this URL to link your GitHub account:\n${import_picocolors.default.cyan(url)}`),
+			onUrl: (url) => log.message(`Open this URL to link your GitHub account:\n${import_picocolors.default.blue(url)}`),
 			finalize: async (params) => {
 				const linkCode = params.get("link_code");
 				if (!linkCode) throw new Error("github: link callback did not return a link code.");
@@ -214,7 +214,7 @@ async function performGithubJoin(client) {
 			return url;
 		},
 		describeError: (p) => p.get("error") ? "GitHub authorization failed." : null,
-		onUrl: (url) => log.message(`Open this URL to join your organization's shared GitHub App installations:\n${import_picocolors.default.cyan(url)}`),
+		onUrl: (url) => log.message(`Open this URL to join your organization's shared GitHub App installations:\n${import_picocolors.default.blue(url)}`),
 		finalize: async (params) => {
 			const joinCode = params.get("join_code");
 			if (!joinCode) throw new Error("github: join callback did not return a join code.");
@@ -280,7 +280,7 @@ async function runGithubConnectAuthorize(client, installationId, repoFullName) {
 			if (e === "repo_not_accessible") return `You don't have access to ${repoFullName} under this installation on GitHub.`;
 			return e ? "GitHub authorization failed." : null;
 		},
-		onUrl: (url) => log.message(`Open this URL to authorize access to ${repoFullName}:\n${import_picocolors.default.cyan(url)}`),
+		onUrl: (url) => log.message(`Open this URL to authorize access to ${repoFullName}:\n${import_picocolors.default.blue(url)}`),
 		finalize: async (params) => {
 			const grant = params.get("connect_grant");
 			if (!grant) throw new Error("github: connect authorization did not return a grant.");
@@ -303,8 +303,8 @@ async function promptRepoFullName(root) {
 	const input = await text({
 		message: "Repository (owner/repo):",
 		placeholder: gitDefault ?? "owner/repo",
-		initialValue: gitDefault ?? "",
-		validate: (value) => /^[^/\s]+\/[^/\s]+$/.test((value ?? "").trim()) ? void 0 : "Enter the repository as owner/repo."
+		defaultValue: gitDefault ?? void 0,
+		validate: (value) => /^[^/\s]+\/[^/\s]+$/.test((value || gitDefault || "").trim()) ? void 0 : "Enter the repository as owner/repo."
 	});
 	if (isCancel(input)) {
 		cancel("Cancelled.");
@@ -447,7 +447,7 @@ async function runConnect(root, client, args) {
 		const input = await text({
 			message: "Branch to deploy from:",
 			placeholder: branchDefault,
-			initialValue: branchDefault
+			defaultValue: branchDefault
 		});
 		if (isCancel(input)) {
 			cancel("Cancelled.");
@@ -483,7 +483,7 @@ async function runConnect(root, client, args) {
 		const input = await text({
 			message: "Deploy workflow file:",
 			placeholder: DEFAULT_WORKFLOW_PATH,
-			initialValue: DEFAULT_WORKFLOW_PATH,
+			defaultValue: DEFAULT_WORKFLOW_PATH,
 			validate(value) {
 				const v = (value ?? "").trim();
 				if (v.length === 0 || isValidWorkflowPath(v)) return;

package/dist/{headers-DWi2IXWx.mjs → headers-2rKda9Y6.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { a as convertFallbacksConfig, c as convertRewritesConfig, f as isProtocolRelative, l as countSplats, n as VALID_REDIRECT_STATUSES, o as convertHeadersConfig, p as parseHostPrefixedSource, s as convertRedirectsConfig } from "./config-Br_JZD6u.mjs";
-import { i as voidWarn } from "./log-ChfPKsVd.mjs";
+import { i as voidWarn } from "./log-vqY3pqwI.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/headers.ts
 /**

package/dist/{help-daGKjXGk.mjs → help-Dotbf6iz.mjs}

@@ -1,8 +1,8 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { N as note, P as outro } from "./dist-CTBk70IR.mjs";
+import { B as note, H as outro } from "./prompts-BNUoTiaf.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
-import { c as import_picocolors, s as helpLine, t as categoryTitle, u as sectionTitle } from "./output-Dm_A4Tbv.mjs";
-import { n as operatorGroups, t as operatorCommands } from "./operator-args-CLgKGlwU.mjs";
+import { c as import_picocolors, s as helpLine, t as categoryTitle, u as sectionTitle } from "./output-CbM85T4k.mjs";
+import { n as operatorGroups, t as operatorCommands } from "./operator-args-B3BTmSoi.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/ascii.ts
 const asciiArts = [
@@ -82,7 +82,7 @@ function operatorHelpTree() {
 					})),
 					...(entry.booleans ?? []).map((flag) => ({
 						command: `--${flag}`,
-						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : flag === "ended" ? "Attest that the original provider execution has ended" : flag === "protect-new-projects" ? "Protect newly created projects by default" : flag === "check" && group === "zero-trust" ? "Also check the saved settings against Cloudflare Access (several API calls)" : flag === "token-stdin" && group === "zero-trust" ? "Read the Access management API token from stdin" : flag === "token-stdin" && group === "email" ? entry.action === "domain-remove" ? "Read a replacement Cloudflare token for blocked project cleanup from stdin" : "Read a scoped Cloudflare API token from stdin" : "Read a full API session from stdin for explicit operator session exchange"
+						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : flag === "ended" ? "Attest that the original provider execution has ended" : flag === "public-apps" ? "Manage public app rules without identity policies" : flag === "protect-new-projects" ? "Protect newly created projects by default" : flag === "check" && group === "zero-trust" ? "Also check the saved settings against Cloudflare Access (several API calls)" : flag === "token-stdin" && group === "zero-trust" ? "Read the Access management API token from stdin" : flag === "token-stdin" && group === "email" ? entry.action === "domain-remove" ? "Read a replacement Cloudflare token for blocked project cleanup from stdin" : "Read a scoped Cloudflare API token from stdin" : "Read a full API session from stdin for explicit operator session exchange"
 					}))
 				]
 			}]))
@@ -607,6 +607,10 @@ const HELP_TREE = {
 						command: "--no-access-protection",
 						description: "Skip Cloudflare Access protection"
 					},
+					{
+						command: "--app-access <public|platform|custom>",
+						description: "Choose public apps, reuse platform Access, or select separate app policies"
+					},
 					{
 						command: "--hyperdrive <create|id>",
 						description: "Create Hyperdrive or use the specified existing configuration"

package/dist/help-mabuIV98.mjs

@@ -0,0 +1,2 @@
+import { r as printHelpPage } from "./help-Dotbf6iz.mjs";
+export { printHelpPage };

package/dist/{inbound-aVHEUhKo.mjs → inbound-fRkqcXaC.mjs}

@@ -91,7 +91,7 @@ async function parseEmail(message) {
 const proxyRawCache = /* @__PURE__ */ new WeakMap();
 /**
 * Remove the platform-injected `<slug>+` prefix from a recipient address.
-* The platform's shared sender (e.g. `mail.void.cloud`) rewrites every recipient to
+* The platform's shared sender (e.g. `mail.example.com`) rewrites every recipient to
 * `<slug>+<tag>@<domain>`; user handlers expect `<tag>@<domain>`. If the
 * slug is unknown, missing, or doesn't match the local-part prefix, the
 * address is returned unchanged so callers without slug context (e.g. the