void 0.23.0 → 0.25.0

package/dist/{wrangler-7K-bW_DL.mjs → wrangler-DhUerFkW.mjs}

@@ -4,7 +4,7 @@ import { m as readConfig } from "./config-Br_JZD6u.mjs";
 import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, r as SANDBOX_MIGRATION_TAG } from "./config-C_XRIPx2.mjs";
 import { i as persistCloudflareConfig, r as materializeCloudflareConfig } from "./cloudflare-config-Bktvwtpf.mjs";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { appendSqliteClassMigration } from "@void/deploy-core";
+import { appendSqliteClassMigration, isRecord } from "@void/deploy-core";
 import { createHash } from "node:crypto";
 import { SyntaxKind, applyEdits, createScanner, findNodeAtLocation, modify, parse, parseTree } from "jsonc-parser";
 //#region src/cli/wrangler.ts
@@ -686,7 +686,10 @@ function writeProvisionedWranglerConfig(root, patch, options) {
 		const matches = [];
 		for (let i = 0; i < currentList.length; i++) {
 			const entry = currentList[i];
-			if (isRecord(entry) && entry[identityKey] === binding) matches.push(i);
+			if (isRecord(entry) && entry[identityKey] === binding) matches.push({
+				index: i,
+				entry
+			});
 		}
 		if (matches.length > 1) throw new Error(`deploy: cannot update "${configPath}" — binding ${JSON.stringify(binding)} is declared ${matches.length} times in "${field}". Void cannot choose which entry to update, and wrangler rejects duplicate binding names. Remove the duplicate and retry.`);
 		const owners = collectWorkerBindingNames(configWithoutField(currentConfig, field));
@@ -694,8 +697,7 @@ function writeProvisionedWranglerConfig(root, patch, options) {
 		const owner = owners.get(binding);
 		if (owner !== void 0) throw new Error(`deploy: cannot update "${configPath}" — cannot adopt ${JSON.stringify(binding)} into "${field}" because that binding name is already used by a ${owner} binding. Wrangler requires every binding name to be unique across the whole worker, so this would make the config undeployable. Rename the conflicting binding and retry.`);
 		if (matches.length === 1) {
-			const index = matches[0];
-			const existing = isRecord(currentList[index]) ? currentList[index] : {};
+			const { index, entry: existing } = matches[0];
 			for (const [key, value] of Object.entries(properties)) if (!jsonEqual(existing[key], value)) set([
 				field,
 				index,
@@ -752,20 +754,16 @@ function writeProvisionedWranglerConfig(root, patch, options) {
 	const upsertQueueEntries = (section, entries) => {
 		if (!entries || entries.length === 0) return;
 		const currentQueues = assertObjectContainer(parseJsonc(text).queues, "queues");
-		if (section === "producers") assertValidQueueProducers(currentQueues?.producers);
-		const currentList = Array.isArray(currentQueues?.[section]) ? [...currentQueues[section]] : [];
+		const currentList = section === "producers" ? assertValidQueueProducers(currentQueues?.producers) : Array.isArray(currentQueues?.consumers) ? [...currentQueues.consumers] : [];
 		for (const entry of entries) {
 			let index;
 			if (section === "producers") {
 				const matches = [];
-				for (let i = 0; i < currentList.length; i++) {
-					const existing = currentList[i];
-					if (isRecord(existing) && existing.binding === entry.binding) matches.push(i);
-				}
+				for (let i = 0; i < currentList.length; i++) if (currentList[i].binding === entry.binding) matches.push(i);
 				if (matches.length > 1) throw new Error(`deploy: cannot update "${configPath}" — queue producer binding ${JSON.stringify(entry.binding)} is declared ${matches.length} times across producers. A producer binding must map to exactly one queue, so wrangler rejects this config. Remove the duplicate producers and retry.`);
 				if (matches.length === 1) {
 					const existing = currentList[matches[0]];
-					if (isRecord(existing) && existing.queue !== entry.queue) throw new Error(`deploy: cannot update "${configPath}" — queue producer binding ${JSON.stringify(entry.binding)} is already bound to queue ${JSON.stringify(existing.queue)}, but queue ${JSON.stringify(entry.queue)} also requests it. A producer binding must map to exactly one queue. Rename or remove the conflicting producer and retry.`);
+					if (existing.queue !== entry.queue) throw new Error(`deploy: cannot update "${configPath}" — queue producer binding ${JSON.stringify(entry.binding)} is already bound to queue ${JSON.stringify(existing.queue)}, but queue ${JSON.stringify(entry.queue)} also requests it. A producer binding must map to exactly one queue. Rename or remove the conflicting producer and retry.`);
 				}
 				index = matches.length === 1 ? matches[0] : -1;
 				workerBindingOwners ??= collectWorkerBindingNames(parseJsonc(text));
@@ -774,7 +772,7 @@ function writeProvisionedWranglerConfig(root, patch, options) {
 				if (owner !== void 0) throw new Error(`deploy: cannot update "${configPath}" — queue producer binding ${JSON.stringify(bindingName)} is already used by a ${owner} binding. Wrangler requires every binding name to be unique across the whole worker, so this producer would make the config undeployable. Rename the conflicting binding (or the queue) and retry.`);
 			} else index = currentList.findIndex((existing) => isRecord(existing) && existing.queue === entry.queue);
 			if (index >= 0) {
-				const existing = isRecord(currentList[index]) ? currentList[index] : {};
+				const existing = currentList[index];
 				for (const [key, value] of Object.entries(entry)) {
 					if (value === void 0) continue;
 					if (!jsonEqual(existing[key], value)) set([
@@ -1243,9 +1241,6 @@ function offsetToLineColumn(text, offset) {
 		column
 	};
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function validateDurableObjectMigrations(value, configPath) {
 	if (value === void 0) return [];
 	if (!Array.isArray(value)) throw new Error(`deploy: cannot update "${configPath}" — "migrations" must be an array of Durable Object migration steps.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -331,24 +331,24 @@
     }
   },
   "dependencies": {
-    "@cloudflare/build-output-utils": "0.8.4",
-    "@cloudflare/codemods": "0.3.0",
-    "@cloudflare/config": "0.22.0",
+    "@cloudflare/build-output-utils": "0.8.5",
+    "@cloudflare/codemods": "0.4.0",
+    "@cloudflare/config": "0.23.0",
     "@cloudflare/sandbox": "1.0.0",
-    "@cloudflare/vite-plugin": "1.62.2",
-    "@cloudflare/workers-auth": "0.9.5",
+    "@cloudflare/vite-plugin": "1.62.5",
+    "@cloudflare/workers-auth": "0.12.0",
     "@cloudflare/workers-types": "^4.20260702.1",
     "@napi-rs/keyring": "2.1.0",
-    "@void/deploy-cloudflare": "0.23.0",
-    "@void/deploy-core": "0.23.0",
-    "@void/edge": "0.23.0",
-    "@void/isr": "0.23.0",
-    "@void/platform": "0.23.0",
+    "@void/deploy-cloudflare": "0.25.0",
+    "@void/deploy-core": "0.25.0",
+    "@void/edge": "0.25.0",
+    "@void/isr": "0.25.0",
+    "@void/platform": "0.25.0",
     "acorn": "^8.18.0",
-    "better-auth": "^1.7.6",
+    "better-auth": "^1.7.7",
     "better-sqlite3": "^13.0.3",
     "blake3-jit": "^1.1.0",
-    "cf": "1.0.0-beta.9",
+    "cf": "1.0.0-beta.12",
     "drizzle-arktype": "^0.1.3",
     "drizzle-kit": "^0.31.11",
     "drizzle-orm": "^0.45.3",
@@ -356,28 +356,27 @@
     "drizzle-zod": "^0.8.3",
     "email-validator": "^2.0.4",
     "es-module-lexer": "^3.0.2",
-    "hono": "^4.13.11",
-    "ignore": "^7.0.10",
+    "hono": "^4.13.13",
+    "ignore": "^7.0.12",
     "jiti": "^2.7.0",
     "jsonc-parser": "3.3.1",
     "mime": "4.1.0",
-    "miniflare": "5.20260926.1-alpha",
+    "miniflare": "5.20261001.0-alpha",
     "minimatch": "^10.2.6",
     "mysql2": "3.24.5",
-    "pg": "8.23.0",
-    "postal-mime": "^4.0.0",
+    "pg": "8.23.1",
+    "postal-mime": "^4.0.4",
     "proper-lockfile": "^4.1.2",
     "undici": "8.11.2"
   },
   "devDependencies": {
-    "@clack/core": "^1.5.1",
-    "@clack/prompts": "^1.8.1",
     "@electric-sql/pglite": "0.5.8",
     "@types/better-sqlite3": "^9.6.0",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "@types/pg": "^8.23.1",
     "@types/proper-lockfile": "^4.1.4",
-    "arktype": "^2.2.5",
+    "@voidzero-dev/vite-plus-prompts": "0.0.0",
+    "arktype": "^2.2.7",
     "ci-info": "^4.4.0",
     "estree-walker": "^3.0.3",
     "fast-wrap-ansi": "^0.2.2",
@@ -394,7 +393,7 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@void/md": "0.23.0",
+    "@void/md": "0.25.0",
     "arktype": ">=2.0.0",
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",

package/sandbox.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.21.0-trixie-slim
+FROM node:26.10.0-trixie-slim
 COPY --from=docker.io/cloudflare/sandbox:1.0.0 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim
 WORKDIR /workspace
 CMD ["sleep", "infinity"]

package/skills/void/SKILL.md

@@ -16,7 +16,12 @@ workflows. Mention Wrangler only when the user needs to recognize a literal
 configuration file or environment variable.
 
 Use `void` and `@void/*` in imports, examples, and package manifests. Follow the
-project's existing framework and deployment destination.
+project's existing framework and deployment destination. Deploying to a Void
+platform requires an explicit `void connect <url>` first; never infer a platform
+from old examples, tokens, or project IDs.
+For a one-time deployment elsewhere, connect to that platform, then set
+`VOID_API_URL` for the deploy command and pass `--project <slug>`. This preserves
+the app's existing saved destination, including when the target project is new.
 
 ## Task Routing
 

package/skills/void/docs/guide/ai.md

@@ -4,19 +4,24 @@ outline: deep
 
 # AI
 
-Void provides a typed AI client for Workers AI and Cloudflare's [AI Gateway](https://developers.cloudflare.com/ai-gateway/). Import `ai` from `void/ai` and run inference directly from your route handlers. Direct deployments use your Cloudflare account; a team platform routes requests through its installation's proxy and usage controls.
+Run Workers AI models and provider APIs from server code with `ai` from `void/ai`. Provider requests use Cloudflare's [AI Gateway](https://developers.cloudflare.com/ai-gateway/).
 
-```ts
-import { ai } from 'void/ai';
-```
+## Local Development
 
-## Handling usage limits
+For a direct Cloudflare project, connect your account and start development:
 
-Every AI operation is lazy and must be executed with `.match({ ok, limited })`. Both handlers are required, including for provider-native requests, model listing and document conversion. Return a useful fallback from `limited`, or use `limit.response({ message: 'AI is temporarily unavailable.' })` to send a structured HTTP 429. Limits expose `resource`, `reason`, and an optional `retryAt`. Other failures still reject.
+```sh
+void connect --platform cloudflare
+npm run dev
+```
 
-Do not await the operation itself; await its `.match()` call. TypeScript checks your handlers and the resulting success/fallback union.
+When the app imports `void/ai`, Void enables a remote Workers AI binding during
+development and preview. Requests use your Cloudflare account and its allowance;
+Workers AI has no local simulator. Use your Cloudflare login or
+`CLOUDFLARE_API_TOKEN` in an automated environment.
 
-Streaming responses end with a `void:error` SSE event if generation is interrupted after the response starts. A recognized quota interruption calls your `limited` handler and emits `void:limit`, preserving the message from `limit.response()`. `fetchStream()` throws on either terminal event so your UI can exit its generating state. This also applies to streaming provider responses and `ai.run()` with `stream: true`.
+For a team platform, use `void connect <platform-url>` and link your project.
+Development requests use that platform's account and usage limits.
 
 ## Basic Usage
 
@@ -29,16 +34,16 @@ import { ai } from 'void/ai';
 export const POST = defineHandler(async (c) => {
   const { prompt } = await c.req.json();
 
-  const result = await ai
+  return ai
     .run('@cf/meta/llama-3.3-70b-instruct-fp8-fast', {
       messages: [{ role: 'user', content: prompt }],
     })
-    .match({ ok: (result) => result, limited: (limit) => limit.response() });
-
-  return c.json(result);
+    .match({ ok: (result) => c.json(result), limited: (limit) => limit.response() });
 });
 ```
 
+Every operation runs through `.match({ ok, limited })`. Both handlers are required. Return a fallback from `limited`, or use `limit.response()` to send a structured HTTP 429. Limits include `resource`, `reason`, and an optional `retryAt`; other failures throw. Await `.match()`, rather than the operation itself.
+
 You can use any model available through Cloudflare's AI binding, including Workers AI models such as `@cf/meta/llama-3.3-70b-instruct-fp8-fast` and Cloudflare Gateway models such as `google/gemini-2.5-flash` or `openai/gpt-4.1-mini`. The input object must match the selected Cloudflare model's schema. Models that return binary data, such as generated images, are returned as a `Blob` from `ai.run()`.
 
 ## Streaming
@@ -60,6 +65,8 @@ export const POST = defineHandler(async (c) => {
 });
 ```
 
+Streaming responses end with a `void:error` SSE event if generation is interrupted after the response starts. A recognized quota interruption calls your `limited` handler and emits `void:limit`, preserving the message from `limit.response()`. `fetchStream()` throws on either terminal event so your UI can exit its generating state. This also applies to streaming provider responses and `ai.run()` with `stream: true`.
+
 ## Listing Models
 
 Use `ai.models()` to list available models:
@@ -85,23 +92,6 @@ const result = await ai
   .match({ ok: (result) => result, limited: (limit) => limit.response() });
 ```
 
-## Local Development
-
-For a direct Cloudflare project, connect your account and start development:
-
-```sh
-void connect --platform cloudflare
-npm run dev
-```
-
-When the app imports `void/ai`, Void enables a remote Workers AI binding during
-development and preview. Requests use your Cloudflare account and its allowance;
-Workers AI has no local simulator. Use your Cloudflare login or
-`CLOUDFLARE_API_TOKEN` in an automated environment.
-
-For a team platform, use `void connect <platform-url>` and link your project.
-Development requests use that platform's account and usage limits.
-
 ## Usage Limits
 
 Workers AI usage is measured in [neurons](https://developers.cloudflare.com/workers-ai/platform/pricing/).
@@ -127,33 +117,7 @@ const result = await ai
   .match({ ok: (result) => result, limited: (limit) => limit.response() });
 ```
 
-OpenAI-compatible models use OpenAI-style `messages`:
-
-```ts
-const result = await ai
-  .run('openai/gpt-4.1-mini', {
-    messages: [{ role: 'user', content: 'Summarize this deploy.' }],
-  })
-  .match({ ok: (result) => result, limited: (limit) => limit.response() });
-```
-
-Pass Cloudflare AI Gateway options as the third argument:
-
-```ts
-const result = await ai
-  .run(
-    'openai/gpt-4.1-mini',
-    {
-      messages: [{ role: 'user', content: 'Summarize this deploy.' }],
-    },
-    {
-      gateway: {
-        skipCache: true,
-      },
-    },
-  )
-  .match({ ok: (result) => result, limited: (limit) => limit.response() });
-```
+Pass AI Gateway options as the third argument: `ai.run(model, inputs, { gateway: { skipCache: true } })`.
 
 For provider-native requests on a direct deployment, configure [`ai.gateway`](../integrations/cloudflare.md#ai-self-host).
 
@@ -173,7 +137,7 @@ import { ai } from 'void/ai';
 export const POST = defineHandler(async (c) => {
   const { prompt } = await c.req.json();
 
-  const response = await ai
+  return ai
     .provider('openai')
     .fetch('/chat/completions', {
       body: {
@@ -183,9 +147,6 @@ export const POST = defineHandler(async (c) => {
       },
     })
     .match({ ok: (result) => result, limited: (limit) => limit.response() });
-
-  const result = await response.json();
-  return c.json(result);
 });
 ```
 
@@ -205,8 +166,6 @@ const response = await ai
     },
   })
   .match({ ok: (result) => result, limited: (limit) => limit.response() });
-
-const result = await response.json();
 ```
 
 ### Custom Providers
@@ -277,30 +236,9 @@ export const POST = defineHandler(async (c) => {
 
 ### Provider Key Convention
 
-Provider-native requests require an API key set as a project secret. The env var name is automatically derived from the provider name:
-
-| Provider prefix    | Env var               |
-| ------------------ | --------------------- |
-| `openai`           | `OPENAI_API_KEY`      |
-| `anthropic`        | `ANTHROPIC_API_KEY`   |
-| `google-ai-studio` | `GOOGLE_API_KEY`      |
-| `deepseek`         | `DEEPSEEK_API_KEY`    |
-| `groq`             | `GROQ_API_KEY`        |
-| `mistral`          | `MISTRAL_API_KEY`     |
-| `grok`             | `GROK_API_KEY`        |
-| `openrouter`       | `OPENROUTER_API_KEY`  |
-| `perplexity`       | `PERPLEXITY_API_KEY`  |
-| `cohere`           | `COHERE_API_KEY`      |
-| `cerebras`         | `CEREBRAS_API_KEY`    |
-| `huggingface`      | `HUGGINGFACE_API_KEY` |
-| `replicate`        | `REPLICATE_API_KEY`   |
-| `baseten`          | `BASETEN_API_KEY`     |
-| `cartesia`         | `CARTESIA_API_KEY`    |
-| `deepgram`         | `DEEPGRAM_API_KEY`    |
-| `elevenlabs`       | `ELEVENLABS_API_KEY`  |
-| `fal`              | `FAL_API_KEY`         |
-| `ideogram`         | `IDEOGRAM_API_KEY`    |
-| `parallel`         | `PARALLEL_API_KEY`    |
+Provider-native requests use a project secret, such as `OPENAI_API_KEY` for OpenAI or `GOOGLE_API_KEY` for Google AI Studio.
+
+See the [provider key reference](../reference/api/resources.md#provider-keys) for supported providers and their secret names.
 
 OpenAI-style providers use `Authorization: Bearer <key>`. Google AI Studio uses `x-goog-api-key`. Use `apiKeyHeader` and `apiKeyPrefix` for custom providers.
 

package/skills/void/docs/guide/auth.md

@@ -155,5 +155,3 @@ void db generate
 ```
 
 Review and commit the SQL before deploying. Void includes your auth configuration and plugin tables; you don't need to duplicate them in `db/schema.ts` or run the Better Auth CLI.
-
-MySQL stores OAuth access, refresh, and ID tokens as unbounded text. Existing direct-deploy MySQL apps should run `void db generate` once after upgrading to widen earlier `varchar(255)` token columns. Void platform deployments apply the same safe widening automatically.

package/skills/void/docs/guide/database/d1.md

@@ -6,12 +6,6 @@ outline: deep
 
 [Cloudflare D1](https://developers.cloudflare.com/d1/) is Void's default SQLite database. Start with a [schema](../database.md#schema-definition); Void manages the database locally and when you deploy.
 
-## Read replication
-
-Void enables [D1 read replication](https://developers.cloudflare.com/d1/best-practices/read-replication/) when it provisions a database. To enable it on an existing database, run `void deploy --platform cloudflare --provision`. Queries through `db` from `void/db` use a D1 session for each Void request, so reads can run near the request and later queries in that request see at least the same data. Framework handlers without Void's request scope start each database operation on the primary. `createDb` starts a replica-capable session for the binding you pass it.
-
-Replicas can lag between requests. Authentication session checks start on the primary so a revoked session is not accepted because of replica lag. If another read must start with the latest primary data, use `env.DB.withSession('first-primary')` from `cloudflare:workers`. Other query libraries and raw D1 calls need their own `withSession()` to use replicas; a bare D1 binding reads from the primary.
-
 ## Local Database
 
 `void dev` and local `void db` commands share the same database. If `cloudflare.d1_databases` in `void.config.ts` declares the D1 binding, Void uses its ID. A `preview_database_id` takes precedence during local development.
@@ -44,6 +38,12 @@ await db.batch([
 ]);
 ```
 
+## Read replication
+
+Void enables [D1 read replication](https://developers.cloudflare.com/d1/best-practices/read-replication/) when it provisions a database. To enable it on an existing database, run `void deploy --platform cloudflare --provision`. Queries through `db` from `void/db` use a D1 session for each Void request, so reads can run near the request and later queries in that request see at least the same data. Framework handlers without Void's request scope start each database operation on the primary. `createDb` starts a replica-capable session for the binding you pass it.
+
+Replicas can lag between requests. Authentication session checks start on the primary so a revoked session is not accepted because of replica lag. If another read must start with the latest primary data, use `env.DB.withSession('first-primary')` from `cloudflare:workers`. Other query libraries and raw D1 calls need their own `withSession()` to use replicas; a bare D1 binding reads from the primary.
+
 ## Alternative Query Layers
 
 Use `env.DB` from `cloudflare:workers` with another query library or the raw D1 API:
@@ -69,5 +69,5 @@ const { results } = await env.DB.prepare('SELECT * FROM users WHERE id = ?').bin
 Void still handles binding inference and deployment regardless of which query layer you use.
 
 ::: warning ⚠️ Meta framework limitation
-Nuxt and SvelteKit do not support `cloudflare:workers` imports during local development. Use `void/db` or your framework's binding access API.
+Nuxt and SvelteKit 2 do not support `cloudflare:workers` imports during local development. Use `void/db` or your framework's binding access API. SvelteKit 3 supports these imports.
 :::