void 0.25.0 → 0.26.1

package/dist/{mime-D5Nmdzf7.mjs → mime-DxCznlJq.mjs}

@@ -52,10 +52,8 @@ function rejectCRLF(field, value) {
 * `rejectCRLF` is enough for a value `encodeWord` renders (the subject, a
 * custom header value, a display name): anything outside printable ASCII
 * sends the whole value into base64, so a control never reaches the wire.
-* These three go through `quoteParam` or straight into the line, so
-* `invoice\x01.pdf` was written raw into `name="…"` and `filename="…"`,
-* captured as a success under `void dev` and by the test harness, and left
-* for the receiving MTA to refuse.
+* These three go through `quoteParam` or straight into the line, so a
+* control would reach the wire for the receiving MTA to refuse.
 *
 * RFC 5322 §3.2.4 `qtext` is printable US-ASCII less `"` and `\`; a
 * control inside a quoted-string is `obs-qtext`, which §4 says MUST NOT be
@@ -88,12 +86,9 @@ function isTokenChar(c) {
 * `type "/" subtype *(";" parameter)`.
 *
 * `rejectControls` answers only for CTLs, and `buildAttachmentPart` writes
-* the value verbatim ahead of its own `; name="…"`, so `text/plain; x="`
-* rendered `Content-Type: text/plain; x="; name="a.txt"` — captured as a
-* success under `void dev` and by the harness, while Python's `email`
-* reports `end of header inside quoted string` on that line and reads the
-* builder's `name` parameter as the VALUE of `x`. `text` (no subtype),
-* `text/plain; charset` (no value) and `text/plain;;` went the same way.
+* the value verbatim ahead of its own `; name="…"`, so an unterminated
+* quote such as `text/plain; x="` would swallow the builder's `name`
+* parameter as the value of `x`.
 *
 * The grammar is the RFC's, read as a generator: a `token` is printable
 * US-ASCII less SPACE and `tspecials`; a `value` is a `token` or a
@@ -170,10 +165,8 @@ function isAtext(c) {
 *
 * `rejectControls` answers only for CTLs, and `buildAttachmentPart` writes
 * the value verbatim — adding `<` and `>` unless the value already starts
-* with `<` — so `logo other` rendered `Content-ID: <logo other>`, `<logo`
-* rendered `Content-ID: <logo` and `logo>` rendered `Content-ID: <logo>>`:
-* captured as a success under `void dev` and by the harness, and left for
-* the receiver to refuse or to fail the `cid:` reference against.
+* with `<` — so a malformed id would reach the receiver and break the
+* `cid:` reference.
 *
 * The grammar is the RFC's, read as a generator, with two deliberate
 * differences. An `msg-id` is `"<" id-left "@" id-right ">"`, each side a
@@ -191,9 +184,7 @@ function isAtext(c) {
 *
 * Refused, then: whitespace of any kind, a second `@`, `<` or `>` anywhere
 * but as that one pair, `"`, `(`, `)`, `,`, `;`, `:`, `\`, `[`, `]`,
-* anything non-ASCII, and the empty string (which used to be validated
-* and then silently NOT rendered). Everything accepted renders exactly as
-* it did.
+* anything non-ASCII, and the empty string.
 *
 * One pass, no allocation, which is why this runs AFTER the value's length
 * bound. The message names the rule and never echoes the value.
@@ -274,12 +265,7 @@ function fieldErrorCode(field) {
 * `email-router.ts`), so there is exactly ONE address syntax in the tree:
 * an action the framework records is never dropped by the router for its
 * shape, and a test harness never captures as a success what the managed
-* deployment would lose. The hand-written predecessor grew one character
-* per review round — the exactly-one-`@` rule, then every C0 control and
-* DEL, then `:`, then a parity test against the router's own regex, which
-* had drifted on the dot in the domain — and still admitted `a..b@x.com`,
-* `.a@x.com` and `a@x..com`, which no dot-atom allows and every MTA
-* refuses. One maintained rule on both sides ends that series.
+* deployment would lose.
 *
 * What it enforces: at most 254 characters in total; an ASCII dot-atom
 * local part of at most 64 characters (RFC 5322 §3.2.3 `atext`, dots only
@@ -315,9 +301,7 @@ function validateAddressParts(field, email, name) {
 * `x` for any `x` (RFC 5322 §3.2.4 — `qtext` excludes `"` and `\`, so a
 * quoted-string carries either only as a quoted-pair). The parsed name is
 * the RAW text `formatAddress` will quote and escape again, so leaving the
-* pairs in place rendered `"Smith \"Bob\"" <a@x.dev>` as
-* `"Smith \\\"Bob\\\""` and the recipient saw `Smith \"Bob\"`, while the
-* object form of the same name rendered correctly. Only the quoted branch
+* pairs in place would escape them twice. Only the quoted branch
 * of `parseAddress` calls this; a backslash in an unquoted name is a
 * character like any other, as it is in the object form.
 *
@@ -328,7 +312,7 @@ function validateAddressParts(field, email, name) {
 * never bounded at all. Measured, 10 MiB of `\"` pairs peaked at 307 MB of
 * heap that way and terminated a 128 MB isolate; this shape peaks at 49 MB.
 * Same discipline as `to7bitBody`: one counting pass, a buffer of exactly
-* the output size, one fill, and the 32K-chunk conversion `base64` uses.
+* the output size, one fill, and one chunked `codeUnitsToString`.
 * The common case — no backslash at all — is one scan and no allocation.
 * The regex that admits the text guarantees every backslash is followed by
 * a character, so the fill never reads past the end.
@@ -348,16 +332,13 @@ function unquotePairs(text) {
 		if (c === 92) c = text.charCodeAt(++i);
 		out[n++] = c;
 	}
-	let s = "";
-	const chunk = 32768;
-	for (let i = 0; i < n; i += chunk) s += String.fromCharCode(...out.subarray(i, i + chunk));
-	return s;
+	return codeUnitsToString(out);
 }
 /**
 * Parse one address — a bare `email@domain` or `Display Name <email@domain>`
 * — into its parts, throwing a `MimeError` for `field` on anything else.
-* Exported so `void.json` `email.from` is validated by the same rules the
-* runtime applies to `from` at send time.
+* Exported so `void.config.ts` `email.from` is validated by the same rules
+* the runtime applies to `from` at send time.
 */
 function parseAddress(value, field) {
 	if (typeof value === "string") {
@@ -525,10 +506,9 @@ const ENCODED_WORD_PAYLOAD_BYTES = 45;
 * Text longer than one word's payload becomes several encoded-words
 * separated by a space, which `foldHeader` turns into CRLF + SPACE
 * wherever a line would otherwise overrun (RFC 2047 §6.2: whitespace
-* between adjacent encoded-words is dropped on decode either way). A
-* single unbounded word breached both §2's 75-character ceiling and —
-* for a long subject or display name — RFC 5322 §2.1.1's 998-octet hard
-* line limit, which nothing downstream repairs.
+* between adjacent encoded-words is dropped on decode either way). This
+* keeps each word under §2's 75-character ceiling and a long subject or
+* display name under RFC 5322 §2.1.1's 998-octet line limit.
 */
 function encodeWord(text) {
 	if (ASCII_PRINTABLE.test(text)) return text;
@@ -561,20 +541,14 @@ function encodeWord(text) {
 * quoted-string`, and `atext` is everything printable EXCEPT these, so an
 * ASCII name containing any of them must be rendered as one quoted-string.
 * The class below lists the thirteen in the RFC's order so it can be checked
-* against the production by eye. This check has been wrong twice: it once
-* sat inside a branch that had already excluded every special, so it was
-* unreachable and a comma in a name split the address list; then the list
-* itself lacked `.`, so `Dr. Smith <a@x.dev>` went out unquoted. That is
-* `obs-phrase` (§4.1, `word *(word / "." / CFWS)`), which §4 says MUST NOT
-* be generated, and a strict receiver flags it as obsolete syntax (Python's
-* `email` parser: "period in 'phrase'"). Every conforming generator —
-* Python's `email.headerregistry.Address`, for one — emits `"Dr. Smith"`.
+* against the production by eye. `.` matters: an unquoted `Dr. Smith` is
+* `obs-phrase` (§4.1), which §4 says MUST NOT be generated.
 */
 const RFC5322_SPECIALS = /[()<>[\]:;@\\,."]/;
 function formatAddress(addr) {
 	if (!addr.name) return addr.email;
 	if (!ASCII_PRINTABLE.test(addr.name)) return `${encodeWord(addr.name)} <${addr.email}>`;
-	if (RFC5322_SPECIALS.test(addr.name)) return `"${addr.name.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}" <${addr.email}>`;
+	if (RFC5322_SPECIALS.test(addr.name)) return `"${quoteParam(addr.name)}" <${addr.email}>`;
 	return `${addr.name} <${addr.email}>`;
 }
 function formatAddressList(addrs) {
@@ -596,13 +570,10 @@ function formatAddressList(addrs) {
 * best a WSP-only fold rule allows (§3.2.2 permits folding only at WSP).
 *
 * One pass, and the only thing kept per input character is the folded
-* output itself: each finished line is one flat string in `lines`. The
-* earlier shape — tokenize the whole value into an array of slices, wrap
-* each in a `{ text, comma }` object, then grow the result with `out +=`
-* per token — held about 130 bytes of heap per token for the length of the
-* fold (a slice, an object and a cons-string node each), so a legal 3 MB
-* subject of one-letter words terminated a 128 MB isolate. That was a
-* per-TOKEN cost, invisible to any size projection: the message fit.
+* output itself: each finished line is one flat string in `lines`. Any
+* per-token allocation (a slice array, token objects, `out +=`) costs about
+* 130 bytes of heap per token, so a legal 3 MB subject of one-letter words
+* would terminate a 128 MB isolate even though the message fits.
 */
 function foldHeader(name, value) {
 	const line = `${name}: ${value}`;
@@ -713,10 +684,9 @@ const HEADER_NAME_LINE_OVERHEAD = 1;
 * fixed width — so a hit is always a header.
 *
 * One pass over the string, counting UTF-8 octets per CRLF-delimited line,
-* with NO allocation. The earlier `text.split(CRLF)` held one array slot and
-* one substring per line for the whole scan, and a legal body of millions of
-* short lines — pasted logs, say — is millions of lines. Only a CRLF pair
-* ends a line, exactly as the split did; a bare CR or LF is content.
+* with NO allocation: a `split(CRLF)` would hold one substring per line, and
+* a legal body of pasted logs is millions of lines. Only a CRLF pair ends a
+* line; a bare CR or LF is content.
 */
 function findOverlongLine(text) {
 	let index = 0;
@@ -751,28 +721,16 @@ function findOverlongLine(text) {
 * quoted-string comes from RFC 5322 §3.2.4).
 *
 * `qtext` excludes both `\\` and `"`, so each may appear only as a
-* quoted-pair. Deleting the quotes and leaving backslashes raw — what this
-* did before — is wrong in two ways: a TRAILING backslash escapes the
-* closing quote and leaves the parameter unterminated, and every embedded
-* backslash is silently eaten by a conformant parser, so a Windows path
-* `C:\\Users\\bob\\report.pdf` arrived as `C:Usersbobreport.pdf`. Measured,
-* Python's `email.policy.default` and postal-mime both report
-* `InvalidHeaderDefect: end of header inside quoted string` on the first
-* case and disagree with a naive parser on the second.
+* quoted-pair: a raw trailing backslash would escape the closing quote, and
+* a conformant parser drops every other raw backslash.
 *
 * Backslash first, then quote — the other order would double-escape.
-*
-* Note this file's own `foldHeader` already tracks quoted-pairs when
-* folding, so the emitter was contradicting the folder.
 */
 function quoteParam(value) {
 	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
 }
 function base64(bytes) {
-	let binary = "";
-	const chunk = 32768;
-	for (let i = 0; i < bytes.length; i += chunk) binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
-	return btoa(binary);
+	return btoa(codeUnitsToString(bytes));
 }
 function base64Wrapped(bytes) {
 	const encoded = base64(bytes);
@@ -829,13 +787,13 @@ function quotedPrintable(text) {
 		}
 		flush(b);
 	}
-	return bytesToAsciiString(out.subarray(0, n));
+	return codeUnitsToString(out.subarray(0, n));
 }
-/** Pure-ASCII bytes to a string, in the same 32K chunks `base64` uses. */
-function bytesToAsciiString(bytes) {
+/** One character per code unit, in 32K chunks to stay under the call-argument limit. */
+function codeUnitsToString(units) {
 	let s = "";
 	const chunk = 32768;
-	for (let i = 0; i < bytes.length; i += chunk) s += String.fromCharCode(...bytes.subarray(i, i + chunk));
+	for (let i = 0; i < units.length; i += chunk) s += String.fromCharCode(...units.subarray(i, i + chunk));
 	return s;
 }
 /**
@@ -844,13 +802,9 @@ function bytesToAsciiString(bytes) {
 * makes 998 octets the hard limit). Only LF and CRLF end a line; a bare CR
 * is a control character like any other and forces the encoding.
 *
-* One pass over the string with NO allocation. The earlier shape — strip
-* every line break with a global `replace`, test the copy, then `split` the
-* text into an array of lines — was linear in the message but held a copy
-* of the body plus one array slot and one substring per line, and a legal
-* 6 MB body of millions of two-character lines needed 64 MB for the strip
-* and another 24-40 MB for the split. Those are per-LINE costs, invisible
-* to any size projection: the message fit.
+* One pass over the string with NO allocation: a `replace`/`split` shape
+* holds a copy of the body plus one substring per line, and a legal 6 MB
+* body of millions of two-character lines needed about 100 MB that way.
 */
 function needsQuotedPrintable(text) {
 	let lineLen = 0;
@@ -895,7 +849,7 @@ function to7bitBody(text) {
 		if (c === 10 && (i === 0 || text.charCodeAt(i - 1) !== 13)) out[n++] = 13;
 		out[n++] = c;
 	}
-	return bytesToAsciiString(out);
+	return codeUnitsToString(out);
 }
 /**
 * Lower bound on the octets `text` will occupy in the rendered message, in
@@ -961,16 +915,14 @@ function makeBoundary(prefix) {
 	crypto.getRandomValues(bytes);
 	return `=_void_${prefix}_${base64(bytes).replace(/[+/=]/g, "")}`;
 }
-function wrapMultipart(type, parts, extra = {}) {
+function wrapMultipart(type, parts) {
 	const boundary = makeBoundary(type);
-	const headerEntries = [["Content-Type", `multipart/${type}; boundary="${boundary}"`]];
-	for (const [k, v] of Object.entries(extra)) headerEntries.push([k, v]);
 	return {
-		headers: headerEntries,
+		headers: [["Content-Type", `multipart/${type}; boundary="${boundary}"`]],
 		body: parts.map((p) => `--${boundary}${CRLF}${renderPart(p)}`).join(CRLF) + `${CRLF}--${boundary}--${CRLF}`
 	};
 }
-const RESERVED_HEADERS = new Set([
+const RESERVED_HEADERS = /* @__PURE__ */ new Set([
 	"from",
 	"to",
 	"cc",
@@ -985,7 +937,7 @@ const RESERVED_HEADERS = new Set([
 	"content-type",
 	"content-transfer-encoding",
 	"content-disposition"
-].map((h) => h.toLowerCase()));
+]);
 /**
 * Lower bound on the octets one header VALUE occupies once `encodeWord` (or
 * `formatAddress`, for a display name) and `foldHeader` have rendered it, in
@@ -1132,10 +1084,8 @@ const CUSTOM_HEADER_FRAMING_OCTETS = 4;
 *   empty values the names and the `: ` CRLF around each are the entire
 *   size, and the framing is exact once the name is counted (see
 *   `CUSTOM_HEADER_FRAMING_OCTETS`), so charging both cannot reject a
-*   message that fits. Measured before the name was charged, 60k empty
-*   headers with 500-character names — a 30 MB message — projected to
-*   zero, rendered in full and peaked at 121 MB of a 128 MB isolate; 100k
-*   of them (50 MB) went to 169 MB.
+*   message that fits. Uncharged, 60k empty headers with 500-character
+*   names (a 30 MB message) would project to zero.
 * - An attachment part: `normalizeAttachment` bounds ONE filename at under
 *   a kilobyte, not the sum, and a message is free to carry any number of
 *   parts, so the filename and the framing every part is wrapped in are
@@ -1145,7 +1095,7 @@ const CUSTOM_HEADER_FRAMING_OCTETS = 4;
 *   `rawText` and `raw` — and terminated a 128 MB isolate before the final
 *   size check could return `MIME_ERROR`.
 *
-* The header COUNT is deliberately not bounded here. Each header now costs
+* The header COUNT is deliberately not bounded here. Each header costs
 * at least five octets (a one-character name, `: `, CRLF), so the count
 * the projection can admit is finite, and past a few hundred thousand keys
 * the caller's own object — measured at about 74 bytes per key, before

package/dist/{node-BkyRWRx8.mjs → node-DJicPvPj.mjs}

@@ -1,10 +1,10 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig } from "./config-Br_JZD6u.mjs";
-import { r as getMiniflareDatabasePath } from "./runner-Ol0TNjk6.mjs";
-import { a as loadLocalEnv } from "./env-_v349JBd.mjs";
-import { r as resolveVoidAuthMigrationSchema } from "./drizzle-Beb2Am5S.mjs";
-import { n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-9vif1uj8.mjs";
+import { m as readConfig } from "./config-DiowPT80.mjs";
+import { r as getMiniflareDatabasePath } from "./runner-DMBKSrRk.mjs";
+import { o as loadLocalEnv } from "./env-BxocywBB.mjs";
+import { r as resolveVoidAuthMigrationSchema } from "./drizzle-CF84FOVM.mjs";
+import { n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-BwHgeEsD.mjs";
 //#region src/auth/node.ts
 async function runLocalVoidAuthMigrations(root, dialect, persistRoot = join(root, ".void"), databaseId = "local", configPath = findVoidAuthConfig(root)) {
 	const authConfig = await loadVoidAuthConfig(configPath);

package/dist/{operator-args-CAVcmwUt.mjs → operator-args-BNsW5gfp.mjs}

@@ -1,4 +1,4 @@
-import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-LmwjxT6q.mjs";
+import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-BQtzyG-g.mjs";
 //#region src/cli/operator-args.ts
 const operatorCommands = [
 	{
@@ -366,6 +366,15 @@ const operatorCommands = [
 		values: { cursor: "Opaque cursor returned by --plan" },
 		method: "POST"
 	},
+	{
+		group: "system",
+		action: "rotate-proxy-tokens",
+		description: "Rotate project proxy tokens on tenant Workers",
+		path: "/system/rotate-proxy-tokens",
+		values: { project: "Project ID" },
+		booleans: ["all"],
+		method: "POST"
+	},
 	{
 		group: "email",
 		action: "policy",

package/dist/{operator-auth-CkmTE3rt.mjs → operator-auth-AzVLbrr3.mjs}

@@ -1,14 +1,10 @@
-import { C as writeKeyringPassword, S as readKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as deleteKeyringPassword } from "./platform-registry-KfNEF84O.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-LmwjxT6q.mjs";
+import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, r as findPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-P387v42A.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BQtzyG-g.mjs";
 /** Operator authority never comes from repository-controlled metadata. */
 function resolveOperatorOrigin(connection = "") {
 	if (connection) {
-		let normalized = null;
-		try {
-			normalized = normalizePlatformApiUrl(connection);
-		} catch {}
-		const matches = listPlatformConnections().filter((entry) => entry.id === connection || entry.installationId === connection || entry.apiUrl === normalized);
-		if (matches.length !== 1) throw new OperatorClientError("Select a registered platform connection ID or URL. Run `void connect <url> --no-login` to register it first.", "invalid_connection");
+		const matches = findPlatformConnections(connection);
+		if (matches.length !== 1) throw new OperatorClientError("Select a registered platform slug or URL. Run `void connect <url> --no-login` to register it first.", "invalid_connection");
 		return matches[0].apiUrl;
 	}
 	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);

package/dist/{operator-client-LmwjxT6q.mjs → operator-client-BQtzyG-g.mjs}

@@ -1,6 +1,6 @@
-import { s as normalizePlatformApiUrl } from "./platform-registry-KfNEF84O.mjs";
+import { c as normalizePlatformApiUrl } from "./platform-registry-P387v42A.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-AHKBzmuu.mjs";
+import { t as ensureCloudflaredToken } from "./cf-access-ngGqZpHZ.mjs";
 const OPERATOR_MAX_TIMEOUT_MS = 36e5;
 var OperatorClientError = class extends Error {
 	code;
@@ -71,7 +71,7 @@ var OperatorClient = class {
 			}
 			if (!data || typeof data !== "object" || Array.isArray(data)) throw new OperatorClientError("Operator API returned an invalid response object.", "invalid_response", response.status);
 			const result = data;
-			if (!response.ok) throw new OperatorClientError(typeof result.message === "string" ? result.message : `Operator request failed (HTTP ${response.status}).`, typeof result.error === "string" ? result.error : "request_failed", response.status, result.details);
+			if (!response.ok) throw new OperatorClientError(typeof result.message === "string" ? result.message : typeof result.error === "string" ? result.error === "Platform disabled" && result.reason === "maintenance" ? `Operator request failed (HTTP ${response.status}): the platform is paused for an upgrade or repair. Retry when it finishes.` : `Operator request failed (HTTP ${response.status}): ${result.error}.${result.error === "Platform disabled" ? " Run `void platform enable`." : ""}` : `Operator request failed (HTTP ${response.status}).`, typeof result.error === "string" ? result.error : "request_failed", response.status, result.details);
 			if (result.partial === true || result.ok === false) throw new OperatorClientError("The operation did not fully complete. Inspect the partial result before retrying.", "partial_failure", response.status, result);
 			return result;
 		} finally {

package/dist/{operator-cmd-d-IEKgNk.mjs → operator-cmd-B6f6Cg9Z.mjs}

@@ -1,14 +1,16 @@
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-LmwjxT6q.mjs";
-import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-CkmTE3rt.mjs";
+import { d as printSuccess, f as sanitizeTerminalText } from "./output-C50ag2r3.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BQtzyG-g.mjs";
+import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-AzVLbrr3.mjs";
 import { createHash } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
 //#region src/cli/operator-cmd.ts
 const MAX_RUNTIME_FOLLOW_ROWS = 1e4;
+const BUILD_LOG_DRAIN_TIMEOUT_MS = 12e4;
 function printable(value) {
 	if (value === null || value === void 0) return "—";
-	if (typeof value === "string") return value.replace(/[\u0000-\u001f\u007f]/g, " ");
-	if (typeof value === "object") return JSON.stringify(value);
+	if (typeof value === "string") return sanitizeTerminalText(value);
+	if (typeof value === "object") return sanitizeTerminalText(JSON.stringify(value));
 	return String(value);
 }
 function table(rows, indent) {
@@ -42,11 +44,28 @@ function eventLines(events, indent) {
 	if (!events.length) return [`${indent}(none)`];
 	return events.flatMap((event, index) => [`${indent}${index + 1}.`, ...humanLines(event, `${indent}  `)]);
 }
+const LABEL_WORDS = {
+	api: "API",
+	dns: "DNS",
+	github: "GitHub",
+	http: "HTTP",
+	id: "ID",
+	ids: "IDs",
+	oauth: "OAuth",
+	oidc: "OIDC",
+	url: "URL",
+	urls: "URLs"
+};
+function fieldLabel(key) {
+	const words = key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[\s_-]+/).filter(Boolean).map((word) => LABEL_WORDS[word.toLowerCase()] ?? word.toLowerCase());
+	if (words[0]) words[0] = words[0][0].toUpperCase() + words[0].slice(1);
+	return words.join(" ");
+}
 function humanLines(value, indent = "") {
 	if (Array.isArray(value)) return table(value, indent);
 	if (!value || typeof value !== "object") return [`${indent}${printable(value)}`];
 	return Object.entries(value).flatMap(([key, item]) => {
-		const label = key.replaceAll("_", " ").replace(/([a-z])([A-Z])/g, "$1 $2");
+		const label = fieldLabel(key);
 		if (Array.isArray(item)) return [`${indent}${label}:`, ...key === "events" ? eventLines(item, `${indent}  `) : table(item, `${indent}  `)];
 		if (item && typeof item === "object") return [`${indent}${label}:`, ...humanLines(item, `${indent}  `)];
 		return [`${indent}${label}: ${printable(item)}`];
@@ -55,6 +74,13 @@ function humanLines(value, indent = "") {
 function output(value, json) {
 	console.log(json ? JSON.stringify(value) : humanLines(value).join("\n"));
 }
+function outputMutation(result, args) {
+	output(result, args.json);
+	const configuration = result.configuration;
+	const project = result.project;
+	if (args.json || result.ok === false || result.partial === true || result.complete === false || result.error || result.operationStatus && result.operationStatus !== "completed" || configuration?.status && configuration.status !== "ready" && configuration.status !== "disabled" || project?.state === "reconciling" || project?.state === "error" || project?.last_error) return;
+	printSuccess(`Platform ${args.group} ${args.action} completed.`);
+}
 function outputLogs(result, json) {
 	if (json) {
 		output(result, true);
@@ -137,9 +163,9 @@ async function runAuth(origin, args) {
 	if (args.action === "login" || args.action === "token" && args.tokenStdin) {
 		if (!args.tokenStdin && !process.stdin.isTTY) throw new OperatorClientError("Browser login requires an interactive terminal. Use --token-stdin to exchange an API session.", "interactive_login_required");
 		const apiToken = args.tokenStdin ? await readOperatorApiTokenStdin() : await (async () => {
-			const { discoverPlatform } = await import("./platform-cmd-BPySFOew.mjs");
-			const { selectPlatformLoginMethod } = await import("./login-C98-sw79.mjs");
-			const { runPlatformLogin } = await import("./auth-CdgZ9uag.mjs");
+			const { discoverPlatform } = await import("./platform-cmd-C00YM14r.mjs");
+			const { selectPlatformLoginMethod } = await import("./login-Dc-wuTDq.mjs");
+			const { runPlatformLogin } = await import("./auth-BgX2qYSY.mjs");
 			return runPlatformLogin(origin, (await selectPlatformLoginMethod(await discoverPlatform(origin), args.providerExplicit ? args.provider : void 0)).id, (url) => process.stderr.write(`Sign in at ${url}\n`));
 		})();
 		const session = await exchangeOperatorSession(origin, apiToken);
@@ -156,6 +182,7 @@ async function runAuth(origin, args) {
 				origin,
 				...identity
 			}, args.json);
+			if (!args.json) printSuccess("Signed in to platform administration.");
 		}
 		return;
 	}
@@ -176,6 +203,7 @@ async function runAuth(origin, args) {
 			ok: true,
 			...process.env.VOID_OPERATOR_TOKEN ? { message: "Operator session revoked. Unset VOID_OPERATOR_TOKEN in your shell." } : {}
 		}, args.json);
+		if (!args.json) printSuccess("Signed out of platform administration.");
 	} else {
 		const session = await client.request("/session");
 		if (args.action === "token") {
@@ -302,7 +330,10 @@ async function migrateDeploymentAssets(client, origin, args) {
 			result
 		});
 		output(result, args.json);
-		if (result.complete) return;
+		if (result.complete) {
+			if (!args.json) printSuccess("Deployment assets migrated.");
+			return;
+		}
 		const cursor = nextCursor;
 		seenCursors.add(cursor);
 		body = {
@@ -313,7 +344,7 @@ async function migrateDeploymentAssets(client, origin, args) {
 }
 async function runOperatorCommand(args) {
 	if (!args.action) {
-		const { printHelpPage } = await import("./help-DPGBwomV.mjs");
+		const { printHelpPage } = await import("./help-DzKUrQvk.mjs");
 		printHelpPage(["platform", args.group]);
 		return;
 	}
@@ -352,18 +383,18 @@ async function runOperatorCommand(args) {
 			...args.group === "project" && args.action === "normalize" ? { expected: preview.changes } : {},
 			...recoveryFence
 		};
-		output(await client.request(args.path, {
+		outputMutation(await client.request(args.path, {
 			method: "POST",
 			body,
 			timeoutMs: args.timeoutMs
-		}), args.json);
+		}), args);
 	} else if (args.follow) await followOperatorLogs(client, args);
 	else {
 		const result = await client.request(args.path, { query: args.query });
 		if (args.action === "logs" && args.group !== "email") outputLogs(result, args.json);
 		else if (args.group === "system" && args.action === "asset-migrations" && !args.json && Array.isArray(result.deployments)) console.log([
 			...humanLines({ pagination: result.pagination }),
-			"deployments:",
+			"Deployments:",
 			...eventLines(result.deployments, "  ")
 		].join("\n"));
 		else output(result, args.json);
@@ -371,4 +402,4 @@ async function runOperatorCommand(args) {
 	}
 }
 //#endregion
-export { runOperatorCommand };
+export { runOperatorCommand as a, humanLines as i, confirmOperatorMutation as n, followOperatorLogs as r, BUILD_LOG_DRAIN_TIMEOUT_MS as t };

package/dist/operator-cmd-Cwn50lOV.mjs

@@ -0,0 +1,2 @@
+import { a as runOperatorCommand } from "./operator-cmd-B6f6Cg9Z.mjs";
+export { runOperatorCommand };

package/dist/{output-BBsUwdyT.mjs → output-C50ag2r3.mjs}

@@ -1,8 +1,13 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
-import { L as log, P as isCI, nt as settings, q as spinner } from "./prompts-6OSVA7DJ.mjs";
+import { B as note$1, H as outro, L as log, P as isCI, nt as settings, q as spinner } from "./dist-D3m88sjf.mjs";
+import { stripVTControlCharacters } from "node:util";
 //#region src/cli/output.ts
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+/** Complete an action with the same spacing, checkmark, and color on every target. */
+function printSuccess(message) {
+	outro(`\n${import_picocolors.default.green(`✓ ${stripVTControlCharacters(message)}`)}`, { withGuide: false });
+}
 function formatCount(count, singular, plural = `${singular}s`) {
 	return `${count} ${count === 1 ? singular : plural}`;
 }
@@ -54,6 +59,30 @@ function createSpinner(options, isTerminal = process.stdout.isTTY === true) {
 		}
 	};
 }
+/** Narrowest terminal the shared box renderer can draw a note in, guide bar included. */
+const MIN_NOTE_COLUMNS = 6;
+/**
+* The shared box renderer throws when the terminal is narrower than its smallest box (a 0x0 pty
+* reports 0 columns). Treat a non-positive width as unknown, like `stdout.columns || 80` elsewhere
+* in the CLI, and draw tiny terminals at the narrowest width the box supports.
+*/
+function note(...args) {
+	const [message, title, opts] = args;
+	const output = opts?.output ?? process.stdout;
+	const columns = output.columns;
+	if (typeof columns !== "number" || columns >= MIN_NOTE_COLUMNS) {
+		note$1(...args);
+		return;
+	}
+	const sized = {
+		columns: columns > 0 ? MIN_NOTE_COLUMNS : 80,
+		write: (chunk) => output.write(chunk)
+	};
+	note$1(message, title, {
+		...opts,
+		output: sized
+	});
+}
 function sectionTitle(title) {
 	return import_picocolors.default.reset(import_picocolors.default.blue(title));
 }
@@ -85,5 +114,18 @@ function ensureUtc(s) {
 	if (s.lastIndexOf("-") > 9) return s;
 	return s + "Z";
 }
+/**
+* Stack frames of an error a Worker reported, one line per frame. The log or
+* exception line already shows `Name: message`, so a leading copy of that
+* header is dropped; Workers send stacks both with and without it.
+*/
+function errorStackFrames(error) {
+	if (!error || typeof error !== "object") return [];
+	const { name, message, stack } = error;
+	if (typeof stack !== "string") return [];
+	const header = message ? `${String(name)}: ${String(message)}` : String(name);
+	const frames = stack === header ? "" : stack.startsWith(`${header}\n`) ? stack.slice(header.length + 1) : stack;
+	return frames.trimEnd() ? frames.trimEnd().split("\n") : [];
+}
 //#endregion
-export { ensureUtc as a, import_picocolors as c, tablePrefix as d, dim as i, sanitizeTerminalText as l, cliCommandName as n, formatCount as o, createSpinner as r, helpLine as s, categoryTitle as t, sectionTitle as u };
+export { ensureUtc as a, helpLine as c, printSuccess as d, sanitizeTerminalText as f, dim as i, import_picocolors as l, tablePrefix as m, cliCommandName as n, errorStackFrames as o, sectionTitle as p, createSpinner as r, formatCount as s, categoryTitle as t, note as u };