void 0.25.0 → 0.26.1

package/dist/platform-setup-DVe42Ws7.mjs

@@ -0,0 +1,299 @@
+import { u as openBrowser } from "./auth-B5_tZLxT.mjs";
+import { L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { l as import_picocolors } from "./output-C50ag2r3.mjs";
+import { execFile } from "node:child_process";
+//#region src/cli/platform-setup.ts
+/** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
+function platformPromptAnswer(value) {
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
+	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + import_picocolors.default.underline(page.title) + "\x1B]8;;\x1B\\" : page.title + ": " + import_picocolors.default.underline(page.url);
+}
+function platformSetupFieldHelp(key) {
+	const docs = (page, section, title) => platformSetupLink({
+		title,
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
+	});
+	switch (key) {
+		case "databaseUrl": return {
+			placeholder: "postgresql://user:pw@…/database",
+			description: "Provide a PostgreSQL database URL for platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
+				title: "Neon",
+				url: "https://neon.com/"
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
+		};
+		case "jwtSecret": return { description: `Create a JWT signing key for platform login tokens. Run ${import_picocolors.default.blue("openssl rand -base64 32")}. Save the key in your password manager. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: `Generate a project encryption key for app secrets. Run ${import_picocolors.default.blue("openssl rand -base64 32")} separately. Save this key for recovery. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		default: return;
+	}
+}
+function supportsSetupLinks() {
+	return !!process.stdout.isTTY && ([
+		"ghostty",
+		"iTerm.app",
+		"WezTerm",
+		"vscode",
+		"WarpTerminal"
+	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
+}
+/** Dashboard keys use permission-catalog labels, which can differ from product names. */
+function platformAccountTokenPermissions(includeAiGateway) {
+	return [
+		{
+			key: "account_settings",
+			type: "read"
+		},
+		{
+			key: "workers_scripts",
+			type: "edit"
+		},
+		{
+			key: "workers_kv_storage",
+			type: "edit"
+		},
+		{
+			key: "workers_r2",
+			type: "edit"
+		},
+		{
+			key: "d1",
+			type: "edit"
+		},
+		{
+			key: "queues",
+			type: "edit"
+		},
+		{
+			key: "account_analytics",
+			type: "read"
+		},
+		{
+			key: "workers_tail",
+			type: "read"
+		},
+		{
+			key: "query_cache",
+			type: "edit"
+		},
+		...includeAiGateway ? [{
+			key: "aig",
+			type: "edit"
+		}] : []
+	];
+}
+/**
+* Account token links cannot preselect a zone: Cloudflare documents only
+* `permissionGroupKeys` and `name`, and the form puts zone permissions in an
+* "All Domains" policy. Tell the user which dashboard choice to change.
+*/
+function specifiedDomainsInstruction(zones) {
+	return `Change the zone policy from All Domains to Specified Domains → ${zones.join(" and ")}.`;
+}
+function plansZoneCreation(plan) {
+	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+}
+function platformManagementSetupPage(plan, options = {}) {
+	const createsZone = plansZoneCreation(plan);
+	const zoneName = plan.deployment.application.zoneName;
+	const apiHostname = plan.deployment.controlPlane.apiHostname;
+	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
+		protection: !!plan.deployment.authentication.accessProtection,
+		readOnly: false
+	} : void 0);
+	const zones = [...zoneName ? [zoneName] : [], ...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`the zone for ${apiHostname}`] : []];
+	const accessLevel = access && access.readOnly ? "read" : "edit";
+	const appAccess = !!plan.deployment.appAccess;
+	const appAccessLevel = appAccess ? "edit" : accessLevel;
+	const permissions = [
+		...platformAccountTokenPermissions(true),
+		...zoneName || apiHostname || createsZone ? [
+			{
+				key: "zone",
+				type: createsZone ? "edit" : "read"
+			},
+			{
+				key: "dns",
+				type: "edit"
+			},
+			{
+				key: "workers_routes",
+				type: "edit"
+			}
+		] : [],
+		...access || appAccess ? [
+			{
+				key: "access",
+				type: appAccessLevel
+			},
+			{
+				key: "access_acct",
+				type: "read"
+			},
+			...access && access.protection ? [{
+				key: "access_service_token",
+				type: accessLevel
+			}] : []
+		] : [],
+		...zoneName && plan.deployment.application.baseDomain !== zoneName ? [{
+			key: "ssl_and_certificates",
+			type: "read"
+		}] : []
+	];
+	return {
+		title: "Cloudflare management API token",
+		linkInTitle: true,
+		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+			to: "/" + plan.account.id + "/api-tokens",
+			name: plan.deployment.displayName + " Management",
+			permissionGroupKeys: JSON.stringify(permissions)
+		}),
+		instructions: [
+			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
+			`Scope it to ${plan.account.name}.`,
+			...createsZone ? [`Keep the zone policy on All Domains so Void can create ${zoneName}.`] : zones.length ? [specifiedDomainsInstruction(zones)] : []
+		].join("\n")
+	};
+}
+function platformSetupPages(plan) {
+	const permissions = [
+		...platformAccountTokenPermissions(plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect")),
+		...plan.deployment.application.zoneName ? [{
+			key: "cache",
+			type: "purge"
+		}] : [],
+		...plan.deployment.capabilities.customDomains ? [{
+			key: "ssl_and_certificates",
+			type: "edit"
+		}] : [],
+		...plan.deployment.capabilities.email ? [
+			{
+				key: "zone",
+				type: "read"
+			},
+			{
+				key: "zone_settings",
+				type: "edit"
+			},
+			{
+				key: "email_routing_address",
+				type: "edit"
+			},
+			{
+				key: "email_routing_rule",
+				type: "edit"
+			},
+			{
+				key: "email_sending",
+				type: "edit"
+			}
+		] : []
+	];
+	const zoneName = plan.deployment.application.zoneName;
+	return {
+		runtime: {
+			title: "Cloudflare runtime token",
+			linkInTitle: true,
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/api-tokens",
+				name: plan.deployment.displayName + " Runtime",
+				permissionGroupKeys: JSON.stringify(permissions)
+			}),
+			instructions: ["Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.", ...zoneName && plansZoneCreation(plan) ? [`Keep the zone policy on All Domains so the token can purge cache on ${zoneName} after Void creates it.`] : zoneName ? [specifiedDomainsInstruction([zoneName, ...plan.deployment.capabilities.email ? ["every zone that will carry mail"] : []])] : []].join("\n")
+		},
+		github: {
+			title: "GitHub OAuth App",
+			url: "https://github.com/settings/applications/new",
+			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
+		},
+		r2: {
+			title: "R2 upload token",
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/r2/api-tokens/create",
+				type: "account"
+			}),
+			instructions: [
+				"Select Object Read & Write.",
+				"Keep Apply to all buckets in this account selected.",
+				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
+			].join("\n")
+		}
+	};
+}
+function formatPlatformSetupPlan(plan, options = {}) {
+	const writesDns = plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse");
+	return [
+		"The installation will guide you through setting up the following credentials:",
+		"",
+		...[
+			...options.managementToken ? [options.managementAccess ? `Cloudflare management API token for ${writesDns ? "DNS changes and " : ""}Access setup` : "Cloudflare management API token for DNS changes"] : [],
+			"PostgreSQL database URL",
+			"Cloudflare runtime token",
+			"R2 upload token",
+			...plan.deployment.authentication.providers.includes("github") ? ["GitHub OAuth App client ID and secret"] : [],
+			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
+			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
+			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
+			"JWT signing key and project encryption key"
+		].map((credential) => `• ${credential}`)
+	].join("\n");
+}
+function platformInstallCommandArguments(options) {
+	const parts = [
+		options.commandName,
+		"platform",
+		"install"
+	];
+	const flag = (name, value) => {
+		if (value) parts.push(name, value);
+	};
+	if (options.resumeId) {
+		parts.push("--resume");
+		flag("--name", options.resumeId);
+	} else {
+		flag("--name", options.installationSlug);
+		flag("--account", options.accountId);
+		flag("--display-name", options.displayName);
+		if (options.workersDev) parts.push("--workers-dev");
+		else {
+			flag("--application-domain", options.applicationDomain);
+			flag("--zone", options.zoneName);
+			if (options.dedicatedZone) parts.push("--dedicated-zone");
+			else parts.push("--no-dedicated-zone");
+		}
+		flag("--control-plane-domain", options.controlPlaneDomain);
+		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
+	}
+	flag("--hyperdrive", options.hyperdrive ?? "");
+	flag("--auth-config", options.authConfig ?? "");
+	if (!options.resumeId && options.appAccess) flag("--app-access", options.appAccess);
+	if (!options.authConfig && !options.resumeId && options.authentication) {
+		flag("--login-methods", options.authentication.providers.join(","));
+		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
+	}
+	flag("--dashboard-url", options.dashboardUrl ?? "");
+	flag("--runtime", options.runtime);
+	if (options.yes) parts.push("--yes");
+	return parts;
+}
+function formatPlatformInstallCommand(options) {
+	return platformInstallCommandArguments(options).map((value) => {
+		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+	}).join(" ");
+}
+function openPlatformSetupPage(page, dependencies = {}) {
+	log.info((page.linkInTitle ? platformSetupLink(page) : page.title) + "\n" + page.instructions);
+	if (!page.linkInTitle) console.log(platformSetupLink({
+		...page,
+		title: "Open " + page.title
+	}));
+	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
+		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
+	} catch {
+		log.info("Could not open the browser. Use the link above.");
+	}
+}
+//#endregion
+export { platformManagementSetupPage as a, platformSetupLink as c, platformInstallCommandArguments as i, platformSetupPages as l, formatPlatformSetupPlan as n, platformPromptAnswer as o, openPlatformSetupPage as r, platformSetupFieldHelp as s, formatPlatformInstallCommand as t };

package/dist/{plugin-inference-CXWnn79A.mjs → plugin-inference-BlQbOL0P.mjs}

@@ -4,10 +4,9 @@ import { n as globSync, t as glob } from "./dist-Bn8Kodjp.mjs";
 import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CPGPjb0V.mjs";
 import { a as staticLiteral, n as parseRouteFilename, o as unwrapStaticExpression, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
 import { n as resourceNameWords, t as isResourceName } from "./resource-name-C7LVpcRm.mjs";
-import { r as getSsrServerEntryPath } from "./entry-CF5wvH4w.mjs";
+import { r as getSsrServerEntryPath } from "./entry-CMAkqBmU.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";
-import { parse } from "es-module-lexer/js";
 //#region src/application-features.ts
 /** Apply explicitly named overrides while preserving unrelated source features. */
 function applyBindingOverrides(inferred, overrides) {
@@ -331,16 +330,39 @@ function walk(ast, { enter, leave }) {
 	return new SyncWalker(enter, leave).visit(ast, null);
 }
 //#endregion
+//#region src/shared/module-references.ts
+/** Runtime imports and re-exports, in source order, including empty export lists. */
+function staticModuleReferences(parsed, code) {
+	const { staticImports, staticExports } = parsed.module;
+	if (!(/\bexport\s*(?:\/|\{\s*(?:\}|\/))/.test(code) || staticImports.some((item) => item.entries.length === 0 && code.slice(item.start, item.moduleRequest.start).trim() !== "import"))) return [...staticImports.filter((item) => item.entries.length === 0 || item.entries.some((entry) => !entry.isType)).map((item) => ({
+		source: item.moduleRequest.value,
+		start: item.start,
+		end: item.end
+	})), ...staticExports.flatMap((item) => {
+		const entry = item.entries.find((entry) => !entry.isType && entry.moduleRequest);
+		return entry?.moduleRequest ? [{
+			source: entry.moduleRequest.value,
+			start: item.start,
+			end: item.end
+		}] : [];
+	})].sort((a, b) => a.start - b.start);
+	return parsed.program.body.flatMap((statement) => {
+		if (statement.type !== "ImportDeclaration" && statement.type !== "ExportNamedDeclaration" && statement.type !== "ExportAllDeclaration") return [];
+		if (!statement.source || "importKind" in statement && statement.importKind === "type" || "exportKind" in statement && statement.exportKind === "type" || "specifiers" in statement && statement.specifiers.length > 0 && statement.specifiers.every((specifier) => "importKind" in specifier && specifier.importKind === "type" || "exportKind" in specifier && specifier.exportKind === "type")) return [];
+		return [{
+			source: statement.source.value,
+			start: statement.start,
+			end: statement.end
+		}];
+	});
+}
+//#endregion
 //#region src/inference/walk.ts
 const ENV_BINDING_RE = /\benv\s*\.\s*(DB|KV|STORAGE|QUEUE_\w+|AI|SANDBOX)\b/;
 /**
 * Infer which Cloudflare bindings a source file uses.
 *
-* Uses a tiered approach for performance:
-*   Tier 1: es-module-lexer to extract import sources (fast, asm.js, no init),
-*           with a TSX parser fallback when the lexer cannot parse JSX
-*   Tier 2: Regex check for env.DB/KV/STORAGE patterns
-*   Tier 3: Full AST walk only when regex matches (to confirm member expressions)
+* Read Vite's module metadata, then walk the AST only for potential env bindings.
 */
 function inferBindingsFromSource(code, filename) {
 	const result = {
@@ -354,25 +376,14 @@ function inferBindingsFromSource(code, filename) {
 		needsLive: false,
 		needsEmail: false
 	};
-	const moduleReferences = [];
-	let parsedProgram;
+	let parsed;
 	try {
-		const [imports] = parse(code);
-		for (const imp of imports) if (imp.specifier) moduleReferences.push({
-			source: imp.specifier,
-			statement: code.slice(imp.importStart, imp.importEnd + 1)
-		});
+		parsed = parseSync(filename, code);
+		if (parsed.errors.length > 0) return result;
 	} catch {
-		try {
-			parsedProgram = parseSync(filename, code).program;
-			for (const node of parsedProgram.body) if ((node.type === "ImportDeclaration" || node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration") && typeof node.source?.value === "string") moduleReferences.push({
-				source: node.source.value,
-				statement: code.slice(node.start, node.end)
-			});
-		} catch {}
+		return result;
 	}
-	for (const { source, statement } of moduleReferences) {
-		if (isTypeOnlyModuleStatement(statement)) continue;
+	function recordModuleReference(source, statement) {
 		switch (source) {
 			case "void/db":
 				result.needsD1 = true;
@@ -408,15 +419,15 @@ function inferBindingsFromSource(code, filename) {
 			case "void/client/solid": if (/\bauth\b/.test(statement)) result.needsAuth = true;
 		}
 	}
-	if (result.needsD1 && result.needsKV && result.needsR2 && result.needsAI && result.needsSandbox && result.needsLive) return result;
-	if (!ENV_BINDING_RE.test(code)) return result;
-	let program = parsedProgram;
-	if (!program) try {
-		program = parseSync(filename, code).program;
-	} catch {
-		return result;
+	for (const reference of staticModuleReferences(parsed, code)) recordModuleReference(reference.source, code.slice(reference.start, reference.end));
+	for (const reference of parsed.module.dynamicImports) {
+		const argument = code.slice(reference.moduleRequest.start, reference.moduleRequest.end);
+		const expression = parseSync(filename, `(${argument})`).program.body[0];
+		const source = expression?.type === "ExpressionStatement" ? staticLiteral(expression.expression) : void 0;
+		if (typeof source === "string") recordModuleReference(source, code.slice(reference.start, reference.end));
 	}
-	walk(program, { enter(node) {
+	if (!ENV_BINDING_RE.test(code)) return result;
+	walk(parsed.program, { enter(node) {
 		const current = node;
 		if (!isMemberExpression(current)) return;
 		if (current.computed) return;
@@ -447,16 +458,6 @@ function inferBindingsFromSource(code, filename) {
 	} });
 	return result;
 }
-function isTypeOnlyModuleStatement(statement) {
-	if (/^\s*(?:import|export)\s+type\b/.test(statement)) return true;
-	const specifierStart = statement.indexOf("{");
-	const specifierEnd = statement.lastIndexOf("}");
-	if (specifierStart === -1 || specifierEnd === -1 || specifierEnd < specifierStart) return false;
-	const beforeSpecifiers = statement.slice(0, specifierStart);
-	if (!/^\s*(?:import|export)\s*$/.test(beforeSpecifiers)) return false;
-	const specifiers = statement.slice(specifierStart + 1, specifierEnd).split(",").map((specifier) => specifier.trim()).filter(Boolean);
-	return specifiers.length > 0 && specifiers.every((specifier) => specifier.startsWith("type "));
-}
 /**
 * Merge multiple InferredBindings into a single result (union).
 */
@@ -721,4 +722,4 @@ function inferProjectBindings(root, options, scanDirs) {
 	return applyBindingOverrides(mergeBindings(allBindings), options?.bindings);
 }
 //#endregion
-export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutes as c, walk as d, readResourceDefinition as f, inferProjectBindings as i, scanWebSocketRoutesSync as l, needsApplicationDatabase as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, applyBindingOverrides as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, inferBindingsFromSource as u };
+export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutes as c, staticModuleReferences as d, walk as f, needsApplicationDatabase as h, inferProjectBindings as i, scanWebSocketRoutesSync as l, applyBindingOverrides as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, readResourceDefinition as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, inferBindingsFromSource as u };

package/dist/prepare-DRUV-g3X.mjs

@@ -0,0 +1,2 @@
+import { t as prepareProject } from "./prepare-Do96654b.mjs";
+export { prepareProject };

package/dist/{prepare-DnaKBi--.mjs → prepare-Do96654b.mjs}

@@ -1,13 +1,13 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { n as loadVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig } from "./config-Br_JZD6u.mjs";
-import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-B8GeM0RM.mjs";
-import { i as generateDbDts, n as generateQueueTypes, t as generateRouteTypes } from "./route-types-Clm4WD0B.mjs";
-import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
-import { r as generateEnvTypes, t as findEnvFile } from "./env-types-D5kds_OZ.mjs";
-import { a as loadLocalEnv } from "./env-_v349JBd.mjs";
-import { t as analyzeApplication } from "./application-routing-B7QEjqSR.mjs";
-import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-Beb2Am5S.mjs";
+import { m as readConfig } from "./config-DiowPT80.mjs";
+import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-CVJhNMxs.mjs";
+import { i as generateDbDts, n as generateQueueTypes, t as generateRouteTypes } from "./route-types-CbtsIeFn.mjs";
+import { t as discoverSchema } from "./discover-CkCYv9T_.mjs";
+import { o as loadLocalEnv } from "./env-BxocywBB.mjs";
+import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CwXgeMgL.mjs";
+import { t as analyzeApplication } from "./application-routing-DQyUh_5S.mjs";
+import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-CF84FOVM.mjs";
 import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/codegen/prepare.ts

package/dist/{prepare-39EvOhI6.mjs → prepare-Dq9hTIbo.mjs}

@@ -1,5 +1,6 @@
-import { B as note, H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
-import { t as prepareProject } from "./prepare-DnaKBi--.mjs";
+import { L as log } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, u as note } from "./output-C50ag2r3.mjs";
+import { t as prepareProject } from "./prepare-Do96654b.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root, _args) {
 	console.log();
@@ -7,7 +8,7 @@ async function runPrepareCommand(root, _args) {
 	if (result.written.length > 0) note(result.written.join("\n"), "Wrote");
 	if (result.removed.length > 0) note(result.removed.join("\n"), "Removed stale files");
 	if (result.written.length === 0 && result.removed.length === 0) log.info("No generated files changed.");
-	outro("Project codegen is ready.");
+	printSuccess("Project codegen is ready.");
 }
 //#endregion
 export { runPrepareCommand };

package/dist/{prerender-render-D9qbLs2f.mjs → prerender-render-Ct20jftc.mjs}

@@ -1,4 +1,4 @@
-import { a as join, n as dirname } from "./dist-BVqXeR_h.mjs";
+import { a as join, i as isAbsolute, l as relative, n as dirname } from "./dist-BVqXeR_h.mjs";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/prerender-render.ts
 function outputFileForPath(path) {
@@ -7,6 +7,11 @@ function outputFileForPath(path) {
 function pageDataFileForPath(path) {
 	return path === "/" ? "_void/pages/index.json" : `_void/pages/${path.slice(1)}.json`;
 }
+/** Whether `path` resolves strictly inside `directory`. */
+function isInside(directory, path) {
+	const child = relative(directory, path);
+	return child !== "" && child !== ".." && !child.startsWith("../") && !isAbsolute(child);
+}
 function normalizedFile(clientDir, path) {
 	return join(clientDir, path).normalize("NFC").toLowerCase();
 }
@@ -66,6 +71,17 @@ async function renderPrerenderPaths(paths, clientDir, fetchPath, fetchPageData,
 			const path = paths[index];
 			const result = results[index];
 			const outputFile = outputFileForPath(path);
+			const outputPath = join(clientDir, outputFile);
+			const pageDataPath = join(clientDir, pageDataFileForPath(path));
+			if (!isInside(clientDir, outputPath) || !isInside(join(clientDir, "_void/pages"), pageDataPath)) {
+				const error = "prerender path resolves outside the output directory";
+				result.failed.push({
+					path,
+					error
+				});
+				onResult?.(path, outputFile, error);
+				continue;
+			}
 			try {
 				const response = await fetchPath(path);
 				const html = await response.text();
@@ -78,14 +94,12 @@ async function renderPrerenderPaths(paths, clientDir, fetchPath, fetchPageData,
 					onResult?.(path, outputFile, error);
 					continue;
 				}
-				const outputPath = join(clientDir, outputFile);
 				mkdirSync(dirname(outputPath), { recursive: true });
 				writeFileSync(outputPath, html);
 				if (fetchPageData) {
 					const pageDataResponse = await fetchPageData(path);
 					if (pageDataResponse.headers.get("X-VoidPages")) {
 						const pageData = await pageDataResponse.json();
-						const pageDataPath = join(clientDir, pageDataFileForPath(path));
 						mkdirSync(dirname(pageDataPath), { recursive: true });
 						writeFileSync(pageDataPath, JSON.stringify(pageData));
 					}

package/dist/prerender-render.mjs

@@ -1,2 +1,2 @@
-import { t as renderPrerenderPaths } from "./prerender-render-D9qbLs2f.mjs";
+import { t as renderPrerenderPaths } from "./prerender-render-Ct20jftc.mjs";
 export { renderPrerenderPaths };

package/dist/{project-IOjBU8R6.mjs → project-BiaPQ7ur.mjs}

@@ -1,2 +1,2 @@
-import { l as writeProjectConfig, t as attachSelectedPlatform } from "./project-BkbfDs0V.mjs";
+import { l as writeProjectConfig, t as attachSelectedPlatform } from "./project-DQstYTxO.mjs";
 export { attachSelectedPlatform, writeProjectConfig };

package/dist/{project-BkbfDs0V.mjs → project-DQstYTxO.mjs}

@@ -1,5 +1,5 @@
 import { a as join, n as dirname } from "./dist-BVqXeR_h.mjs";
-import { o as listPlatformConnections, s as normalizePlatformApiUrl } from "./platform-registry-KfNEF84O.mjs";
+import { c as normalizePlatformApiUrl, s as listPlatformConnections } from "./platform-registry-P387v42A.mjs";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/project.ts

package/dist/{project-cmd-Bs5A392E.mjs → project-cmd-ti8_yTcA.mjs}

@@ -1,8 +1,8 @@
-import { n as readDeploymentPlatform } from "./project-BkbfDs0V.mjs";
-import { c as getToken, s as getSiteDomain } from "./auth-7wuZ5ob8.mjs";
-import { H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
-import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
-import { c as import_picocolors, d as tablePrefix, i as dim, o as formatCount } from "./output-BBsUwdyT.mjs";
+import { n as readDeploymentPlatform } from "./project-DQstYTxO.mjs";
+import { c as getToken, s as getSiteDomain } from "./auth-B5_tZLxT.mjs";
+import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
+import { i as dim, l as import_picocolors, m as tablePrefix, s as formatCount } from "./output-C50ag2r3.mjs";
+import { r as PlatformClient } from "./client-C2Prx_Bi.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -38,77 +38,77 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-eEWVJEPn.mjs");
+		const { runListCommand } = await import("./list-2GN7_ueV.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by cloudflare.name in void.config.ts and do not need linking.");
-		const { runLink } = await import("./link-CXOlqh2F.mjs");
+		const { runLink } = await import("./link-DlPG8iX3.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-eEWVJEPn.mjs");
+			const { runListCommand } = await import("./list-2GN7_ueV.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
 	if (args.subcommand === "token") {
 		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
-		const { runProjectTokenCommand } = await import("./project-token-CP01Jna6.mjs");
+		const { runProjectTokenCommand } = await import("./project-token-CkZ1cN0Z.mjs");
 		return runProjectTokenCommand(root, args);
 	}
 	if (args.subcommand === "team") {
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-DPGBwomV.mjs");
+			const { printHelpPage } = await import("./help-DzKUrQvk.mjs");
 			printHelpPage(["project", "team"]);
 			return;
 		}
 		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
 		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
-		const { runProjectTeamCommand } = await import("./project-team-ohAWWaew.mjs");
+		const { runProjectTeamCommand } = await import("./project-team-CDPE1Tsg.mjs");
 		return runProjectTeamCommand(root, args);
 	}
 	if (args.subcommand === "zero-trust") {
 		if (cloudflare) throw new Error("project: Zero Trust overrides are available only for projects hosted on a Void platform.");
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-DPGBwomV.mjs");
+			const { printHelpPage } = await import("./help-DzKUrQvk.mjs");
 			printHelpPage(["project", "zero-trust"]);
 			return;
 		}
 		const action = args.action;
-		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-BzkVgx35.mjs");
+		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-DdjLR61k.mjs");
 		return runProjectZeroTrustCommand(root, {
 			...args,
 			action
 		});
 	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-DnxVX7TR.mjs");
+		const { runLogsCommand } = await import("./logs-rd8J-OFh.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-B3PBuGlX.mjs");
+		const { runRequestsCommand } = await import("./requests-DFAqyYy8.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-DDub9GsO.mjs");
+		const { runRollbackCommand } = await import("./rollback-BKYXBduI.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-CYoZmcmR.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-BZNz3Q26.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-pKMVsrpJ.mjs");
+		const { runDeleteCommand } = await import("./delete-esYlMiSJ.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-TcZnBLtH.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-Bo52trKF.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }