void 0.25.0 → 0.26.1

package/dist/{project-team-ohAWWaew.mjs → project-team-CDPE1Tsg.mjs}

@@ -1,9 +1,9 @@
-import { r as readProjectConfig } from "./project-BkbfDs0V.mjs";
-import { c as getToken, i as getAccountCredential } from "./auth-7wuZ5ob8.mjs";
-import { B as note, H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
-import { c as platformErrorMessage, n as PlatformApiError, r as PlatformClient, s as parsePlatformErrorBody } from "./client-RsPo8wsP.mjs";
-import { o as formatCount } from "./output-BBsUwdyT.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
+import { r as readProjectConfig } from "./project-DQstYTxO.mjs";
+import { c as getToken, i as getAccountCredential } from "./auth-B5_tZLxT.mjs";
+import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, f as sanitizeTerminalText, s as formatCount, u as note } from "./output-C50ag2r3.mjs";
+import { c as parsePlatformErrorBody, l as platformErrorMessage, n as PlatformApiError, r as PlatformClient } from "./client-C2Prx_Bi.mjs";
+import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-CP8rZs_p.mjs";
 //#region src/cli/project-team.ts
 function clean(value) {
 	return (value ?? "—").replace(/[\u0000-\u001f\u007f]/g, " ");
@@ -33,11 +33,7 @@ function invitationLines(invitations, pending) {
 }
 async function resolveProjectId(root, client, projectSlug) {
 	const requestedSlug = getRequestedProjectSlug({ projectSlug });
-	if (requestedSlug) {
-		const project = resolveProjectBySlug(await client.listProjects(), requestedSlug);
-		if (!project) throw new Error(`project: No project found with slug '${requestedSlug}'.`);
-		return project.projectId;
-	}
+	if (requestedSlug) return (await requireProjectBySlug(client, requestedSlug)).projectId;
 	const linked = readProjectConfig(root);
 	if (!linked) throw new Error("No linked project. Run `void project link` or pass --project <slug>.");
 	return linked.projectId;
@@ -83,12 +79,13 @@ async function runProjectTeamCommand(root, args) {
 			throw invitationResponseError(error, client.apiUrl);
 		}
 		if (args.action === "accept") log.info("Open the invited application’s directory and run `void project link` if it is not linked yet. If it is linked to another project, use a separate checkout. Accepting an invitation keeps existing project links.");
-		outro(`Project invitation ${args.action === "accept" ? "accepted" : "declined"}.`);
+		printSuccess(`Project invitation ${args.action === "accept" ? "accepted" : "declined"}.`);
 		return;
 	}
 	const projectId = await resolveProjectId(root, client, "projectSlug" in args ? args.projectSlug : "");
 	if (args.action === "list") {
-		const members = await client.listProjectMembers(projectId);
+		const { members, warnings } = await client.listProjectMembers(projectId);
+		for (const warning of warnings ?? []) log.warn(sanitizeTerminalText(warning));
 		note(memberLines(members), "Project Team");
 		outro(formatCount(members.length, "member"));
 		return;
@@ -108,26 +105,26 @@ async function runProjectTeamCommand(root, args) {
 		const delivery = result.delivery.status === "sent" ? "" : ` (email delivery: ${result.delivery.status.replace("_", " ")})`;
 		const action = result.refreshed ? "Updated invitation for" : "Invited";
 		if (result.delivery.status !== "sent") note(`Invitation: ${clean(result.invitation.id)}\nShare these steps with the invited user:\n\nvoid connect '${client.apiUrl.replaceAll("'", "'\\''")}'\nvoid project team pending\nvoid project team accept ${clean(result.invitation.id)}`, "Invitation saved; email was not sent");
-		outro(`${action} ${clean(invitationEmail(result.invitation))} as ${args.role}${delivery}.`);
+		printSuccess(`${action} ${clean(invitationEmail(result.invitation))} as ${args.role}${delivery}.`);
 		return;
 	}
 	if (args.action === "role") {
 		await client.updateProjectMemberRole(projectId, args.userId, args.role);
-		outro(`Changed ${args.userId} to ${args.role}.`);
+		printSuccess(`Changed ${args.userId} to ${args.role}.`);
 		return;
 	}
 	if (args.action === "remove") {
 		await client.removeProjectMember(projectId, args.userId);
-		outro(`Removed ${args.userId} from the project.`);
+		printSuccess(`Removed ${args.userId} from the project.`);
 		return;
 	}
 	if (args.action === "revoke") {
 		await client.revokeProjectInvitation(projectId, args.invitationId);
-		outro(`Revoked invitation ${args.invitationId}.`);
+		printSuccess(`Revoked invitation ${args.invitationId}.`);
 		return;
 	}
 	await client.leaveProject(projectId);
-	outro("Left the project.");
+	printSuccess("Left the project.");
 }
 //#endregion
 export { runProjectTeamCommand };

package/dist/{project-token-CP01Jna6.mjs → project-token-CkZ1cN0Z.mjs}

@@ -1,23 +1,19 @@
-import { r as readProjectConfig } from "./project-BkbfDs0V.mjs";
-import { c as getToken } from "./auth-7wuZ5ob8.mjs";
-import { H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
-import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
-import { d as tablePrefix, i as dim } from "./output-BBsUwdyT.mjs";
-import { r as resolveProjectBySlug } from "./resolve-project-BG5ORGID.mjs";
+import { r as readProjectConfig } from "./project-DQstYTxO.mjs";
+import { c as getToken } from "./auth-B5_tZLxT.mjs";
+import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, i as dim, m as tablePrefix } from "./output-C50ag2r3.mjs";
+import { r as PlatformClient } from "./client-C2Prx_Bi.mjs";
+import { r as requireProjectBySlug } from "./resolve-project-CP8rZs_p.mjs";
 //#region src/cli/project-token.ts
 async function resolveTarget(root, args) {
 	const humanToken = getToken(root);
 	if (!humanToken) throw new Error("project: Sign in with a human account before managing CI credentials.");
 	const client = new PlatformClient(humanToken, { root });
-	if (args.projectSlug) {
-		const resolved = resolveProjectBySlug(await client.listProjects(), args.projectSlug);
-		if (!resolved) throw new Error(`project: No project found with slug '${args.projectSlug}'.`);
-		return {
-			client,
-			projectId: resolved.projectId,
-			slug: args.projectSlug
-		};
-	}
+	if (args.projectSlug) return {
+		client,
+		projectId: (await requireProjectBySlug(client, args.projectSlug)).projectId,
+		slug: args.projectSlug
+	};
 	const linked = readProjectConfig(root);
 	if (!linked) throw new Error("project: No linked project. Pass --project <name>.");
 	return {
@@ -34,9 +30,10 @@ function printIssued(args, result, apiUrl) {
 		}));
 		return;
 	}
-	log.success(`Credential ${result.id} is valid until ${result.expiresAt}.`);
+	log.info(`Credential ${result.id} is valid until ${result.expiresAt}.`);
 	log.warn("Copy this token now. Void will not display it again.");
 	console.log(`\nVOID_TOKEN=${result.token}\nVOID_API_URL=${apiUrl}\n`);
+	printSuccess("Project deploy credential created.");
 }
 async function runProjectTokenCommand(root, args) {
 	if (!args.json) console.log();
@@ -52,7 +49,7 @@ async function runProjectTokenCommand(root, args) {
 			ok: true,
 			id: args.credentialId
 		}));
-		else log.success(`Revoked ${args.credentialId}.`);
+		else printSuccess(`Revoked ${args.credentialId}.`);
 	} else {
 		const rows = await client.listProjectTokens(projectId);
 		if (args.json) {

package/dist/{project-tsconfig-B8GeM0RM.mjs → project-tsconfig-CVJhNMxs.mjs}

@@ -23,7 +23,8 @@ function writeFileIfChanged(path, content) {
 *
 * @param hasRouteTypes - When true, include routes.d.ts. When omitted,
 *   auto-detect by checking for a routes/ directory.
-* @param hasDrizzle - When true, configure `@schema` paths for the user's
+* @param hasDb - When true, include db.d.ts and redirect `void/db` to it.
+* @param hasSchema - When true, configure `@schema` paths for the user's
 *   Drizzle schema.
 */
 function createProjectTsconfig(root, hasRouteTypes, hasDb, hasSchema, options = {}) {

package/dist/{project-zero-trust-BzkVgx35.mjs → project-zero-trust-DdjLR61k.mjs}

@@ -1,9 +1,9 @@
-import { r as readProjectConfig } from "./project-BkbfDs0V.mjs";
-import { c as getToken } from "./auth-7wuZ5ob8.mjs";
-import { B as note, H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
-import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
-import { l as sanitizeTerminalText } from "./output-BBsUwdyT.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
+import { r as readProjectConfig } from "./project-DQstYTxO.mjs";
+import { c as getToken } from "./auth-B5_tZLxT.mjs";
+import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, f as sanitizeTerminalText, u as note } from "./output-C50ag2r3.mjs";
+import { r as PlatformClient } from "./client-C2Prx_Bi.mjs";
+import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-CP8rZs_p.mjs";
 //#region src/cli/project-zero-trust.ts
 async function resolveTarget(root, args) {
 	const token = getToken(root);
@@ -11,8 +11,7 @@ async function resolveTarget(root, args) {
 	const client = new PlatformClient(token, { root });
 	const requestedSlug = getRequestedProjectSlug({ projectSlug: args.projectSlug });
 	if (requestedSlug) {
-		const project = resolveProjectBySlug(await client.listProjects(), requestedSlug);
-		if (!project) throw new Error(`project: No project found with slug '${requestedSlug}'.`);
+		const project = await requireProjectBySlug(client, requestedSlug);
 		return {
 			client,
 			projectId: project.projectId,
@@ -56,7 +55,11 @@ async function runProjectZeroTrustCommand(root, args) {
 		outro(`${slug} Zero Trust update is still in progress. Run \`void project zero-trust reconcile\` to continue, or wait for scheduled maintenance.`);
 		return;
 	}
-	outro(args.action === "protect" ? `${slug} is protected by Zero Trust.` : args.action === "public" ? `${slug} is public.` : `${slug} Zero Trust reconciled (${result.project.state}).`);
+	if (result.project.last_error || result.project.state === "error") {
+		outro(`${slug} Zero Trust needs attention (${result.project.state}).`);
+		return;
+	}
+	printSuccess(args.action === "protect" ? `${slug} is protected by Zero Trust.` : args.action === "public" ? `${slug} is public.` : `${slug} Zero Trust reconciled (${result.project.state}).`);
 }
 //#endregion
 export { runProjectZeroTrustCommand };

package/dist/{protocol-CjF_iI9X.d.mts → protocol-BPZaNqBo.d.mts}

@@ -1,5 +1,5 @@
-import { n as HeadDescriptor, t as HeadConfig } from "./head-Do8P4puT.mjs";
-import { n as CloudBindings, r as CloudContext } from "./handler-CZ4nAylQ.mjs";
+import { n as HeadDescriptor, t as HeadConfig } from "./head-C8K_iGe6.mjs";
+import { n as CloudBindings, r as CloudContext } from "./handler-CNAwjRcW.mjs";
 import { a as PageRenderMode, t as DevCssAsset } from "./types-BAp5AEBU.mjs";
 //#region src/pages/protocol.d.ts
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */
@@ -20,6 +20,8 @@ type PageHandler = ((c: CloudContext) => unknown | Promise<unknown>) | undefined
 type PageHeadHandler = ((c: CloudContext, props: Record<string, unknown>) => HeadDescriptor | undefined) | undefined;
 type PageRenderOptions = {
   renderMode?: PageRenderMode;
+  /** Dev server build: rejected deferred props keep their raw error message. */
+  dev?: boolean;
 };
 type AssetTags = {
   css: string;

package/dist/{protocol-U7bfjHmA.mjs → protocol-CfaUwNs8.mjs}

@@ -1,6 +1,6 @@
 import { n as isConvertedResponse } from "./response-Tn7rU0MV.mjs";
-import { i as ValidationError, r as separateDeferred, t as DEFERRED } from "./defer-YsYDUoii.mjs";
-import { i as resolveHead, n as renderHeadToString, r as renderHtmlAttrs, t as renderBodyAttrs } from "./head-D_QRR5Yd.mjs";
+import { i as separateDeferred, n as DEFERRED, t as ValidationError } from "./validation-error-Dg9Recn1.mjs";
+import { i as resolveHead, n as renderHeadToString, r as renderHtmlAttrs, t as renderBodyAttrs } from "./head-D2VF4ApL.mjs";
 import { t as serializePageData } from "./serialize-BPvnNQuA.mjs";
 //#region src/pages/protocol.ts
 const POWERED_BY = { "X-Powered-By": "Void" };
@@ -44,30 +44,17 @@ function adjustCspValue(value, nonce) {
 			sources
 		};
 	});
-	const styleElem = parsed.find((directive) => directive.name === "style-src-elem");
-	if (styleElem) {
-		if (!styleElem.sources.some((source) => hasCompatibleStyleSource(source, nonceSource))) styleElem.sources.push(nonceSource);
-		return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
-	}
-	const style = parsed.find((directive) => directive.name === "style-src");
+	const style = parsed.find((directive) => directive.name === "style-src-elem") ?? parsed.find((directive) => directive.name === "style-src");
 	if (style) {
 		if (!style.sources.some((source) => hasCompatibleStyleSource(source, nonceSource))) style.sources.push(nonceSource);
-		return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
-	}
-	const defaultSrc = parsed.find((directive) => directive.name === "default-src");
-	if (defaultSrc) {
+	} else {
+		const defaultSrc = parsed.find((directive) => directive.name === "default-src");
 		parsed.push({
 			name: "style-src",
 			originalName: "style-src",
-			sources: [...defaultSrc.sources, nonceSource]
+			sources: [...defaultSrc?.sources ?? [], nonceSource]
 		});
-		return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
 	}
-	parsed.push({
-		name: "style-src",
-		originalName: "style-src",
-		sources: [nonceSource]
-	});
 	return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
 }
 function adjustDevCssCsp(headers, nonce) {
@@ -116,6 +103,13 @@ function renderClientOnlyPage(pageObj, assetTags, renderFn) {
 </body>
 </html>`;
 }
+async function renderPageHtml(c, pageObj, componentId, renderMode, renderFn, getAssetTags) {
+	const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
+	return {
+		html: renderMode === "client" ? renderClientOnlyPage(pageObj, assetTags, renderFn) : await renderWithAssetTags(renderFn, pageObj, assetTags),
+		assetTags
+	};
+}
 function pageJsonResponse(c, pageObj) {
 	return Response.json(pageObj, { headers: pageResponseHeaders(c, {
 		"X-VoidPages": "true",
@@ -172,12 +166,24 @@ function renderedResponse(c, result, contentType, assetTags) {
 		...POWERED_BY
 	}), assetTags?.devCssNonce) });
 }
+/**
+* Message sent to the browser for a rejected deferred prop. HTTPException
+* messages are deliberate and pass through, as in the page error handler.
+* Anything else is logged and, outside dev, replaced with a generic message so
+* internal details (SQL, hostnames, URLs) do not reach the page.
+*/
+function deferredErrorMessage(err, dev) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (err && typeof err === "object" && "getResponse" in err && typeof err.getResponse === "function") return message;
+	console.error(err);
+	return dev ? message : "Internal Server Error";
+}
 /** Build a streaming response that sends an initial chunk then streams deferred results. */
-function streamDeferredResponse(initialChunk, deferredMap, c, contentType, formatResolved, formatRejected, assetTags) {
+function streamDeferredResponse(initialChunk, deferredMap, c, contentType, dev, formatResolved, formatRejected, assetTags) {
 	const encoder = new TextEncoder();
 	const { readable, writable } = new TransformStream();
 	const writer = writable.getWriter();
-	const pendingChunks = Object.entries(deferredMap).map(([group, { resolver }]) => resolver(c).then((data) => formatResolved(group, data)).catch((err) => formatRejected(group, err instanceof Error ? err.message : String(err))));
+	const pendingChunks = Object.entries(deferredMap).map(([group, { resolver }]) => resolver(c).then((data) => formatResolved(group, data)).catch((err) => formatRejected(group, deferredErrorMessage(err, dev))));
 	(async () => {
 		await writeRenderResult(writer, encoder, initialChunk);
 		await Promise.all(pendingChunks.map(async (chunk) => writer.write(encoder.encode(await chunk))));
@@ -185,10 +191,7 @@ function streamDeferredResponse(initialChunk, deferredMap, c, contentType, forma
 	})().catch((error) => {
 		writer.abort(error).catch(() => {});
 	});
-	return new Response(readable, { headers: adjustDevCssCsp(pageResponseHeaders(c, {
-		"content-type": contentType,
-		...POWERED_BY
-	}), assetTags?.devCssNonce) });
+	return renderedResponse(c, readable, contentType, assetTags);
 }
 /** Handle GET page request — run handler, return page object or SSR HTML */
 async function handlePageGet(handler, headFn, c, componentId, renderFn, getAssetTags, configHead, options) {
@@ -209,7 +212,7 @@ async function handlePageGet(handler, headFn, c, componentId, renderFn, getAsset
 	const { immediateProps, deferredMap } = separateDeferred(props);
 	const hasDeferred = Object.keys(deferredMap).length > 0;
 	const deferredKeys = {};
-	if (hasDeferred) for (const [group, { keys }] of Object.entries(deferredMap)) for (const key of keys) deferredKeys[key] = group;
+	for (const [group, { keys }] of Object.entries(deferredMap)) for (const key of keys) deferredKeys[key] = group;
 	const pageObj = {
 		component: componentId,
 		props: immediateProps,
@@ -249,7 +252,7 @@ async function handlePageGet(handler, headFn, c, componentId, renderFn, getAsset
 		const headers = new Headers(c.res.headers);
 		appendVary(headers, "X-VoidPages");
 		c.header("Vary", headers.get("Vary"));
-		return streamDeferredResponse(JSON.stringify(pageObj) + "\n", deferredMap, c, "application/x-ndjson", (group, data) => JSON.stringify({
+		return streamDeferredResponse(JSON.stringify(pageObj) + "\n", deferredMap, c, "application/x-ndjson", options?.dev === true, (group, data) => JSON.stringify({
 			__deferred: group,
 			data
 		}) + "\n", (group, error) => JSON.stringify({
@@ -257,10 +260,9 @@ async function handlePageGet(handler, headFn, c, componentId, renderFn, getAsset
 			error
 		}) + "\n");
 	}
-	const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
-	const html = renderMode === "client" ? renderClientOnlyPage(pageObj, assetTags, renderFn) : await renderWithAssetTags(renderFn, pageObj, assetTags);
+	const { html, assetTags } = await renderPageHtml(c, pageObj, componentId, renderMode, renderFn, getAssetTags);
 	if (!hasDeferred) return renderedResponse(c, html, "text/html; charset=utf-8", assetTags);
-	return streamDeferredResponse(html, deferredMap, c, "text/html; charset=utf-8", (group, data) => `\n<script>window.__resolveDeferred?window.__resolveDeferred(${safeJsonStringify(group)},${safeJsonStringify(data)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},${safeJsonStringify(data)}])<\/script>`, (group, error) => `\n<script>window.__rejectDeferred?window.__rejectDeferred(${safeJsonStringify(group)},${safeJsonStringify(error)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},0,${safeJsonStringify(error)}])<\/script>`, assetTags);
+	return streamDeferredResponse(html, deferredMap, c, "text/html; charset=utf-8", options?.dev === true, (group, data) => `\n<script>window.__resolveDeferred?window.__resolveDeferred(${safeJsonStringify(group)},${safeJsonStringify(data)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},${safeJsonStringify(data)}])<\/script>`, (group, error) => `\n<script>window.__rejectDeferred?window.__rejectDeferred(${safeJsonStringify(group)},${safeJsonStringify(error)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},0,${safeJsonStringify(error)}])<\/script>`, assetTags);
 }
 function isSameOriginAction(request) {
 	const origin = new URL(request.url).origin;
@@ -295,37 +297,32 @@ async function handlePageMutation(mutationHandler, getHandler, headFn, c, compon
 			...head && { head }
 		};
 	}
+	/** Re-run the GET loader and respond with the page, optionally carrying validation errors. */
+	async function respondWithPage(errors) {
+		const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), errors);
+		if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
+		const { html, assetTags } = await renderPageHtml(c, pageObj, componentId, renderMode, renderFn, getAssetTags);
+		return renderedResponse(c, html, "text/html; charset=utf-8", assetTags);
+	}
+	function respondWithErrors(errors) {
+		if (renderMode === "island") return Promise.resolve(Response.json({ errors }, { status: 422 }));
+		return respondWithPage(errors);
+	}
 	let result;
 	try {
 		result = mutationHandler ? await mutationHandler(c) : void 0;
 	} catch (e) {
-		if (e instanceof ValidationError) {
-			if (renderMode === "island") return Response.json({ errors: e.errors }, { status: 422 });
-			const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), e.errors);
-			if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
-			const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
-			return renderedResponse(c, renderMode === "client" ? renderClientOnlyPage(pageObj, assetTags, renderFn) : await renderWithAssetTags(renderFn, pageObj, assetTags), "text/html; charset=utf-8", assetTags);
-		}
+		if (e instanceof ValidationError) return respondWithErrors(e.errors);
 		throw e;
 	}
 	if (result instanceof Response) {
 		const status = result.status;
 		if (status >= 300 && status < 400) return result;
-		if (status === 400) {
-			const errors = flattenValidationErrors(await result.json());
-			if (renderMode === "island") return Response.json({ errors }, { status: 422 });
-			const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), errors);
-			if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
-			const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
-			return renderedResponse(c, renderMode === "client" ? renderClientOnlyPage(pageObj, assetTags, renderFn) : await renderWithAssetTags(renderFn, pageObj, assetTags), "text/html; charset=utf-8", assetTags);
-		}
+		if (status === 400) return respondWithErrors(flattenValidationErrors(await result.json()));
 		if (status !== 204) return result;
 	}
 	if (renderMode === "island") return Response.json({ success: true });
-	const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), null);
-	if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
-	const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
-	return renderedResponse(c, renderMode === "client" ? renderClientOnlyPage(pageObj, assetTags, renderFn) : await renderWithAssetTags(renderFn, pageObj, assetTags), "text/html; charset=utf-8", assetTags);
+	return respondWithPage(null);
 }
 //#endregion
 export { safeJsonStringify as i, handlePageGet as n, handlePageMutation as r, flattenValidationErrors as t };

package/dist/{providers-CJlNS3kT.mjs → providers-BXuhmuub.mjs}

@@ -47,21 +47,10 @@ function isVoidAuthProvider(value) {
 }
 function getVoidAuthProviderEnvNames(provider) {
 	const normalized = provider.toUpperCase().replaceAll("-", "_");
-	const envNames = {
+	return {
 		clientId: `AUTH_${normalized}_CLIENT_ID`,
 		clientSecret: `AUTH_${normalized}_CLIENT_SECRET`
 	};
-	if (provider === "github") return {
-		...envNames,
-		legacyClientId: "GITHUB_OAUTH_ID",
-		legacyClientSecret: "GITHUB_OAUTH_SECRET"
-	};
-	if (provider === "google") return {
-		...envNames,
-		legacyClientId: "GOOGLE_OAUTH_ID",
-		legacyClientSecret: "GOOGLE_OAUTH_SECRET"
-	};
-	return envNames;
 }
 //#endregion
 export { isVoidSocialAuthProvider as a, isVoidAuthProvider as i, VOID_EMAIL_AUTH_PROVIDER as n, getVoidAuthProviderEnvNames as r, VOID_AUTH_PROVIDERS as t };

package/dist/{provision-Btj1jppf.mjs → provision-BfaLiWbj.mjs}

@@ -1,9 +1,8 @@
 import { a as join, n as dirname, o as normalize, t as basename, u as resolve$2 } from "./dist-BVqXeR_h.mjs";
 import { i as voidWarn, r as voidLog } from "./log-vqY3pqwI.mjs";
-import { i as persistCloudflareConfig } from "./cloudflare-config-Bktvwtpf.mjs";
-import { A as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers, v as readProvisionedBindingEntry } from "./wrangler-DhUerFkW.mjs";
-import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { c as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-B-wekeR6.mjs";
+import { _ as persistMaterializedWranglerConfig, j as writeProvisionedWranglerConfig, s as assertNoDuplicateMembers, y as readProvisionedBindingEntry } from "./wrangler-D9KTuqnv.mjs";
+import { n as scanWranglerDotenvKeys } from "./dotenv-BfU6eqFt.mjs";
+import { l as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-2-TfIEzB.mjs";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { isRecord } from "@void/deploy-core";
@@ -282,21 +281,6 @@ function assertNoTransportRedirectInProjectDotenv(root, platform = process.platf
 	}
 }
 /**
-* Child-process env with every CF Access credential scrubbed. Mirrors `buildEnv`
-* in `deploy.ts`: Access credentials are needed only by this CLI's own guarded
-* HTTP requests and must never leak into the spawned wrangler process (which may
-* in turn run user hooks). This includes the short-lived cloudflared
-* `CF_ACCESS_TOKEN` JWT used by local readiness probes.
-*
-* Pins ONE transport context: scrubs every {@link TRANSPORT_REDIRECT_ENV_VARS}
-* from the child env, then re-sets `CLOUDFLARE_API_BASE_URL` to the SINGLE resolved
-* `apiBaseUrl` so the spawned wrangler and the Hyperdrive REST lister hit the exact same
-* endpoint. Scrubbing the compliance/staging/env selectors makes the explicit base
-* authoritative (they can no longer re-derive a different base). Combined with
-* {@link assertNoTransportRedirectInProjectDotenv} (which blocks a project dotenv from
-* repopulating any of them via wrangler's per-command reload), the pin cannot be moved.
-*/
-/**
 * Delete `name` from `env` IN PLACE, honoring the platform's env-key case rule.
 * Windows environment keys are CASE-INSENSITIVE: a spawned child's `process.env`
 * resolves `WRANGLER_OUTPUT_FILE_PATH` from an ambient `Wrangler_Output_File_Path`
@@ -314,6 +298,21 @@ function deleteEnvVarCaseAware(env, name, platform = process.platform) {
 	const lower = name.toLowerCase();
 	for (const key of Object.keys(env)) if (key.toLowerCase() === lower) delete env[key];
 }
+/**
+* Child-process env with every CF Access credential scrubbed. Mirrors `buildEnv`
+* in `deploy.ts`: Access credentials are needed only by this CLI's own guarded
+* HTTP requests and must never leak into the spawned wrangler process (which may
+* in turn run user hooks). This includes the short-lived cloudflared
+* `CF_ACCESS_TOKEN` JWT used by local readiness probes.
+*
+* Pins ONE transport context: scrubs every {@link TRANSPORT_REDIRECT_ENV_VARS}
+* from the child env, then re-sets `CLOUDFLARE_API_BASE_URL` to the SINGLE resolved
+* `apiBaseUrl` so the spawned wrangler and the Hyperdrive REST lister hit the exact same
+* endpoint. Scrubbing the compliance/staging/env selectors makes the explicit base
+* authoritative (they can no longer re-derive a different base). Combined with
+* {@link assertNoTransportRedirectInProjectDotenv} (which blocks a project dotenv from
+* repopulating any of them via wrangler's per-command reload), the pin cannot be moved.
+*/
 function provisionEnv(ctx) {
 	const env = { ...process.env };
 	const platform = ctx?.platform ?? process.platform;
@@ -332,6 +331,17 @@ function provisionEnv(ctx) {
 		scrub("CLOUDFLARE_ACCOUNT_ID");
 		env.CLOUDFLARE_ACCOUNT_ID = ctx.accountId;
 	}
+	if (ctx?.apiToken) {
+		for (const name of [
+			"CLOUDFLARE_API_TOKEN",
+			"CF_API_TOKEN",
+			"CLOUDFLARE_API_KEY",
+			"CF_API_KEY",
+			"CLOUDFLARE_EMAIL",
+			"CF_EMAIL"
+		]) scrub(name);
+		env.CLOUDFLARE_API_TOKEN = ctx.apiToken;
+	}
 	return env;
 }
 /**
@@ -574,7 +584,7 @@ function armRetentionWatchdog(lock, info) {
 			try {
 				process.kill(process.platform === "win32" ? info.pid : -info.pid, 0);
 			} catch (error) {
-				dead = error.code === "ESRCH";
+				dead = isAlreadyGoneKillError(error);
 			}
 			if (dead) {
 				lock.release().then(() => resolveWatchdog(), (error) => {
@@ -636,7 +646,8 @@ function createDefaultRunWrangler(root, options) {
 			env: {
 				...provisionEnv({
 					accountId: opts.accountId,
-					apiBaseUrl: opts.apiBaseUrl
+					apiBaseUrl: opts.apiBaseUrl,
+					apiToken: opts.apiToken
 				}),
 				...opts.suppressLogs ? { WRANGLER_WRITE_LOGS: "false" } : {}
 			},
@@ -700,14 +711,14 @@ function createDefaultRunWrangler(root, options) {
 				try {
 					process.kill(child.pid, 0);
 				} catch (error) {
-					if (error.code === "ESRCH") groupGone = true;
+					groupGone = isAlreadyGoneKillError(error);
 				}
 				return groupGone;
 			}
 			try {
 				process.kill(-child.pid, 0);
 			} catch (error) {
-				if (error.code === "ESRCH") groupGone = true;
+				groupGone = isAlreadyGoneKillError(error);
 			}
 			return groupGone;
 		};
@@ -1134,7 +1145,7 @@ function assertQuarantineClearedOrClear(lockTarget, onBeforeClear) {
 	if (probeTarget !== void 0) try {
 		process.kill(probeTarget, 0);
 	} catch (error) {
-		if (error.code === "ESRCH") confirmedDead = true;
+		confirmedDead = isAlreadyGoneKillError(error);
 	}
 	if (!confirmedDead) {
 		const who = pid !== void 0 || pgid !== void 0 ? `process group ${String(pgid ?? pid)}` : "an unrecorded process";
@@ -1436,7 +1447,7 @@ function parseJsonObject(value) {
 * config, delegating to the STRICT canonical reader in `wrangler.ts`
 * ({@link readProvisionedBindingEntry}). Unlike the old loose first-match `.find()`, this
 * validates the target field's outer shape, fails closed on a DUPLICATE binding, and runs
-* the worker-wide CROSS-TYPE collision check (reusing the Task-3 collector) — so a
+* the worker-wide CROSS-TYPE collision check — so a
 * duplicate/collision config can never be reported `reused` or pass a create postcondition.
 */
 function readBindingEntry(configPath, field, binding) {
@@ -1444,8 +1455,8 @@ function readBindingEntry(configPath, field, binding) {
 }
 /**
 * Read + parse the root wrangler config (fresh each call — wrangler mutates it).
-* BOM-aware (wrangler + the Task 3 writer strip a leading BOM before parsing, so
-* we must too, else a BOM-prefixed config would look unparseable). FAILS CLOSED
+* BOM-aware (wrangler + `writeProvisionedWranglerConfig` strip a leading BOM before
+* parsing, so we must too, else a BOM-prefixed config would look unparseable). FAILS CLOSED
 * on a genuine parse error or a non-object root: never silently treat a real
 * config as `{}`, which would miss existing ids (re-provision/orphan) and mask a
 * corrupt file. A missing file is fine (nothing to read-first → `{}`).
@@ -1474,7 +1485,7 @@ function assertDiscoverySucceeded(result, label) {
 /**
 * STRICT list validator shared by KV + D1. Rejects the ENTIRE list (throws) if ANY
 * member is not a well-formed object carrying a non-empty name AND a
-* FORMAT-VALID id (per {@link ResourceListSpec.idValidator}). A member is NEVER
+* FORMAT-VALID id (per {@link ResourceListSpec.hasValidId}). A member is NEVER
 * silently filtered, and a member with a malformed id is NEVER accepted, because
 * either could BE the requested target (or signal a corrupt list) and treating it as
 * "absent" would mint a duplicate. Validates EVERY member up front — BEFORE any
@@ -1565,20 +1576,20 @@ function isAlreadyExistsError(result) {
 	return result.errorCode === 7502;
 }
 /**
-* EXACT, name-aware not-found classifier shared by R2 + queues. Given a
-* already-NON-zero `<res> info`-by-name probe, returns `true` (confirmed absent →
-* safe to create) ONLY on wrangler's exact, resource-specific not-found signal
-* for THIS name (regex-escaped). Everything else returns `false` so the caller
+* Not-found classifier shared by R2 + queues. Given an `<res> info`-by-name probe,
+* returns `true` (confirmed absent → safe to create) ONLY on a clean non-zero exit
+* with the provider's typed not-found result (R2 error code 10006; the queue
+* operation's `not-found` failure). Everything else returns `false` so the caller
 * fails closed — a signal/spawn failure, an auth/network/metrics error, or a
 * GENERIC "not found" (e.g. `Account not found`) is NEVER treated as absence,
 * which would mint a duplicate resource.
 */
-function isConfirmedAbsent(result, kind, _name) {
+function isConfirmedAbsent(result, kind) {
 	return isCleanFailure(result) && (kind === "r2" ? result.errorCode === 10006 : result.failure === "not-found");
 }
 /** Only a completed, typed not-found response confirms queue absence. */
-function isQueueConfirmedAbsent(result, name) {
-	return isConfirmedAbsent(result, "queue", name);
+function isQueueConfirmedAbsent(result, _name) {
+	return isConfirmedAbsent(result, "queue");
 }
 /** Reuse and post-create verification require clean success and the exact returned name. */
 function queueInfoConfirmsExists(result, name) {
@@ -1999,8 +2010,8 @@ function redactRejection(error, redactText) {
 * `wrangler <res> create --update-config` write real ids into the root config.
 * For resources that already exist (adopt path) — where `create` cannot run —
 * the real id is captured from `wrangler <res> list/info` (or, for Hyperdrive,
-* the account-list existence seam) and written through the Task 3 writer's adopt
-* fields. Pure provisioning: NO build, deploy, or drift-check. Idempotent +
+* the account-list existence seam) and written through `writeProvisionedWranglerConfig`'s
+* adopt fields. Pure provisioning: NO build, deploy, or drift-check. Idempotent +
 * read-first: a binding already pointing at a real id is left untouched.
 */
 async function provisionCloudflareResources(root, rootWranglerPath, desired, opts) {
@@ -2305,7 +2316,7 @@ async function reconcileR2(desired, configPath, runWrangler, write, persistCreat
 					name: bucketName,
 					action: "adopted"
 				});
-			} else if (isConfirmedAbsent(info, "r2", bucketName)) {
+			} else if (isConfirmedAbsent(info, "r2")) {
 				const created = await runWrangler({
 					type: "r2.bucket.create",
 					name: bucketName,
@@ -2436,7 +2447,7 @@ async function reconcileQueues(desired, configPath, runWrangler, resources) {
 			});
 			continue;
 		}
-		if (!isConfirmedAbsent(info, "queue", name)) throw new Error(`provision: "wrangler queues info ${name}" failed or did not confirm the queue exists: ${info.stderr || info.stdout || "no output"}`);
+		if (!isConfirmedAbsent(info, "queue")) throw new Error(`provision: "wrangler queues info ${name}" failed or did not confirm the queue exists: ${info.stderr || info.stdout || "no output"}`);
 		const created = await runWrangler({
 			type: "queues.create",
 			name,
@@ -2484,9 +2495,7 @@ async function provisionCloudflareResourcesLocked(root, configPath, desired, opt
 	const log = opts?.log ?? defaultLogger;
 	const resources = [];
 	const write = (patch) => writeProvisionedWranglerConfig(root, patch, { configPath });
-	const persistCreatedConfig = () => {
-		if (basename(configPath) === ".void-wrangler.jsonc") persistCloudflareConfig(dirname(configPath));
-	};
+	const persistCreatedConfig = () => persistMaterializedWranglerConfig(configPath);
 	const hasRemoteWork = !!desired.d1 || desired.kvNamespaces.length > 0 || !!desired.r2 || !!desired.hyperdrive || desired.queues.length > 0;
 	if (hasRemoteWork && !effectiveAccountId) throw new Error("provision: no Cloudflare account is resolvable — set \"account_id\" in your root wrangler config or export CLOUDFLARE_ACCOUNT_ID before deploying. Refusing to provision resources without a pinned account (wrangler would otherwise fall back to an ambient/interactive account that is never persisted, so a later retry could rebind them elsewhere).");
 	if (hasRemoteWork) assertNoTransportRedirectInProjectDotenv(root);

package/dist/{provision-BEv0k-qz.mjs → provision-Wu9ZBk9L.mjs}

@@ -1,3 +1,2 @@
-import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { _ as resolvePinnedApiBaseUrl, a as checkCloudflareProvisionDrift, c as enableD1ReadReplicationViaApi, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionEnv, h as provisionCloudflareResources, i as assertValidResourceName, l as isAlreadyGoneKillError, m as normalizeRunWranglerResult, n as acquireProvisionLock, o as createDefaultRunWrangler, p as isRealKvId, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware, t as WranglerQuarantineError, u as isQuarantineError, v as resolveProperLockfileKey } from "./provision-Btj1jppf.mjs";
-export { WranglerQuarantineError, acquireProvisionLock, assertNoTransportRedirectInProjectDotenv, assertValidResourceName, checkCloudflareProvisionDrift, createDefaultRunWrangler, deleteEnvVarCaseAware, enableD1ReadReplicationViaApi, isAlreadyGoneKillError, isQuarantineError, isQueueConfirmedAbsent, isRealD1Id, isRealKvId, normalizeRunWranglerResult, provisionCloudflareResources, provisionEnv, resolvePinnedApiBaseUrl, resolveProperLockfileKey, scanWranglerDotenvKeys };
+import { _ as resolvePinnedApiBaseUrl, a as checkCloudflareProvisionDrift, c as enableD1ReadReplicationViaApi, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionEnv, h as provisionCloudflareResources, i as assertValidResourceName, l as isAlreadyGoneKillError, m as normalizeRunWranglerResult, n as acquireProvisionLock, o as createDefaultRunWrangler, p as isRealKvId, r as assertNoTransportRedirectInProjectDotenv, s as deleteEnvVarCaseAware, t as WranglerQuarantineError, u as isQuarantineError, v as resolveProperLockfileKey } from "./provision-BfaLiWbj.mjs";
+export { WranglerQuarantineError, acquireProvisionLock, assertNoTransportRedirectInProjectDotenv, assertValidResourceName, checkCloudflareProvisionDrift, createDefaultRunWrangler, deleteEnvVarCaseAware, enableD1ReadReplicationViaApi, isAlreadyGoneKillError, isQuarantineError, isQueueConfirmedAbsent, isRealD1Id, isRealKvId, normalizeRunWranglerResult, provisionCloudflareResources, provisionEnv, resolvePinnedApiBaseUrl, resolveProperLockfileKey };