void 0.26.0 → 0.26.1

package/dist/{wrangler-DhUerFkW.mjs → wrangler-D9KTuqnv.mjs}

@@ -1,8 +1,8 @@
 import { a as join, n as dirname, o as normalize, t as basename } from "./dist-BVqXeR_h.mjs";
 import "./project-paths-GgcMozYz.mjs";
-import { m as readConfig } from "./config-Br_JZD6u.mjs";
-import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, r as SANDBOX_MIGRATION_TAG } from "./config-C_XRIPx2.mjs";
-import { i as persistCloudflareConfig, r as materializeCloudflareConfig } from "./cloudflare-config-Bktvwtpf.mjs";
+import { m as readConfig } from "./config-DiowPT80.mjs";
+import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, r as SANDBOX_MIGRATION_TAG } from "./config-B_ggY-IO.mjs";
+import { i as persistCloudflareConfig, r as materializeCloudflareConfig } from "./cloudflare-config-BmhBv3HV.mjs";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { appendSqliteClassMigration, isRecord } from "@void/deploy-core";
 import { createHash } from "node:crypto";
@@ -18,9 +18,39 @@ function projectWranglerPaths(root) {
 	if (existsSync(join(root, "void.config.ts"))) return [materializeCloudflareConfig(root)];
 	return ["wrangler.jsonc", "wrangler.json"].map((name) => join(root, name));
 }
+/** Record a change to the generated Cloudflare config in `void.lock.json`. */
+function persistMaterializedWranglerConfig(configPath) {
+	if (basename(configPath) === ".void-wrangler.jsonc") persistCloudflareConfig(dirname(configPath));
+}
 function writeProjectWranglerFile(configPath, text) {
 	writeFileSync(configPath, text);
-	if (basename(configPath) === ".void-wrangler.jsonc") persistCloudflareConfig(dirname(configPath));
+	persistMaterializedWranglerConfig(configPath);
+}
+/**
+* Read the first existing project Wrangler config. A missing or unparseable one is
+* replaced by the generated config, starting from an empty object.
+*/
+function readOrCreateProjectWranglerConfig(root) {
+	const configPath = projectWranglerPaths(root).find((path) => existsSync(path));
+	if (configPath) {
+		let parsed;
+		try {
+			parsed = parseJsonc(readFileSync(configPath, "utf-8"));
+		} catch {}
+		if (parsed) return {
+			configPath,
+			parsed,
+			created: false
+		};
+	}
+	return {
+		configPath: materializeCloudflareConfig(root),
+		parsed: {},
+		created: true
+	};
+}
+function durableObjectBindingsOf(config) {
+	return config.durable_objects?.bindings ?? [];
 }
 const MANAGED_QUEUES_MARKER = /^\s*\/\/ void:managed-queues:v1:([A-Za-z0-9_-]+)\s*$/m;
 const PUBLISHED_TRAFFIC_MARKER = /^\s*\/\/ void:published-traffic:v1:([A-Za-z0-9_-]+)\s*$/m;
@@ -241,21 +271,7 @@ function ensureVoidCompatibilityDate(root, config) {
 * Returns true if the file was modified.
 */
 function syncWranglerBindings(root, bindings, options) {
-	let configPath;
-	let parsed;
-	let created = false;
-	for (const p of projectWranglerPaths(root)) if (existsSync(p)) {
-		configPath = p;
-		try {
-			parsed = parseJsonc(readFileSync(p, "utf-8"));
-		} catch {}
-		break;
-	}
-	if (!configPath || !parsed) {
-		configPath = materializeCloudflareConfig(root);
-		parsed = {};
-		created = true;
-	}
+	const { configPath, parsed, created } = readOrCreateProjectWranglerConfig(root);
 	let modified = false;
 	const d1Name = options?.bindingNames?.d1 ?? "DB";
 	if (bindings.needsD1) {
@@ -317,18 +333,17 @@ function syncWranglerBindings(root, bindings, options) {
 		}
 	}
 	if (options?.websockets) {
-		const existing = parsed.durable_objects?.bindings ?? [];
+		const existing = durableObjectBindingsOf(parsed);
 		const migrations = Array.isArray(parsed.migrations) ? parsed.migrations : [];
-		const retained = existing;
 		for (const route of options.websockets) {
-			const conflict = retained.find((binding) => binding.name === route.bindingName && binding.class_name !== route.className);
+			const conflict = existing.find((binding) => binding.name === route.bindingName && binding.class_name !== route.className);
 			if (conflict) throw new Error(`websocket: binding '${route.bindingName}' is already configured for class '${conflict.class_name}', but '${route.filePath}' requires '${route.className}'.`);
 		}
-		const additions = options.websockets.filter((route) => !retained.some((binding) => binding.name === route.bindingName)).map((route) => ({
+		const additions = options.websockets.filter((route) => !existing.some((binding) => binding.name === route.bindingName)).map((route) => ({
 			name: route.bindingName,
 			class_name: route.className
 		}));
-		const nextBindings = [...retained, ...additions];
+		const nextBindings = [...existing, ...additions];
 		if (nextBindings.length !== existing.length || nextBindings.some((binding, index) => binding.name !== existing[index]?.name || binding.class_name !== existing[index]?.class_name)) {
 			parsed.durable_objects = {
 				...parsed.durable_objects ?? {},
@@ -336,14 +351,14 @@ function syncWranglerBindings(root, bindings, options) {
 			};
 			modified = true;
 		}
-		const planned = appendSqliteClassMigration(migrations, options.websockets.map((route) => route.className), "void-ws-v1", retained.map((binding) => binding.class_name));
+		const planned = appendSqliteClassMigration(migrations, options.websockets.map((route) => route.className), "void-ws-v1", existing.map((binding) => binding.class_name));
 		if (planned.added) {
 			parsed.migrations = planned.migrations;
 			modified = true;
 		}
 	}
 	if (options?.durableObjects && options.durableObjects.length > 0) {
-		const existingBindings = parsed.durable_objects?.bindings ?? [];
+		const existingBindings = durableObjectBindingsOf(parsed);
 		for (const module of options.durableObjects) {
 			const conflict = existingBindings.find((binding) => binding.name === module.bindingName && binding.class_name !== module.className);
 			if (conflict) throw new Error(`durable: binding '${module.bindingName}' is already configured for class '${conflict.class_name}', but durable-objects/ requires '${module.className}'.`);
@@ -374,7 +389,7 @@ function syncWranglerBindings(root, bindings, options) {
 		const bindingName = options?.bindingNames?.sandbox ?? sandbox?.binding ?? "SANDBOX";
 		const className = sandbox.className;
 		assertSandboxNamespaceConfig(parsed, sandbox);
-		const existingDurableObjectBindings = parsed.durable_objects?.bindings ?? [];
+		const existingDurableObjectBindings = durableObjectBindingsOf(parsed);
 		if (!existingDurableObjectBindings.some((binding) => binding.name === bindingName)) {
 			parsed.durable_objects = { bindings: [...existingDurableObjectBindings, {
 				name: bindingName,
@@ -398,7 +413,7 @@ function syncWranglerBindings(root, bindings, options) {
 		}
 	}
 	if (bindings.needsLive || options?.live) {
-		const existingDurableObjectBindings = parsed.durable_objects?.bindings ?? [];
+		const existingDurableObjectBindings = durableObjectBindingsOf(parsed);
 		const liveConfig = typeof options?.live === "object" ? options.live : resolveLiveBindingConfig(root, {
 			existingBindings: existingDurableObjectBindings,
 			reservedBindings: options?.websockets?.map((route) => route.bindingName),
@@ -466,19 +481,7 @@ function readWranglerWebSocketTombstones(root, websockets) {
 */
 function ensureWranglerCompatibilityDate(root, compatibilityDate) {
 	validateCompatDate(compatibilityDate, "void.json worker config");
-	let configPath;
-	let parsed;
-	for (const p of projectWranglerPaths(root)) if (existsSync(p)) {
-		configPath = p;
-		try {
-			parsed = parseJsonc(readFileSync(p, "utf-8"));
-		} catch {}
-		break;
-	}
-	if (!configPath || !parsed) {
-		configPath = materializeCloudflareConfig(root);
-		parsed = {};
-	}
+	const { configPath, parsed } = readOrCreateProjectWranglerConfig(root);
 	if (parsed.compatibility_date === compatibilityDate) return false;
 	parsed.compatibility_date = compatibilityDate;
 	writeProjectWranglerFile(configPath, JSON.stringify(parsed, null, 2) + "\n");
@@ -489,19 +492,7 @@ function ensureWranglerCompatibilityDate(root, compatibilityDate) {
 * Returns true if the config file was modified.
 */
 function ensureWranglerNodejsAlsFlag(root) {
-	let configPath;
-	let parsed;
-	for (const p of projectWranglerPaths(root)) if (existsSync(p)) {
-		configPath = p;
-		try {
-			parsed = parseJsonc(readFileSync(p, "utf-8"));
-		} catch {}
-		break;
-	}
-	if (!configPath || !parsed) {
-		configPath = materializeCloudflareConfig(root);
-		parsed = {};
-	}
+	const { configPath, parsed } = readOrCreateProjectWranglerConfig(root);
 	const compatibilityFlags = Array.isArray(parsed.compatibility_flags) ? parsed.compatibility_flags : [];
 	if (compatibilityFlags.includes(NODEJS_ALS_FLAG)) return false;
 	parsed.compatibility_flags = [...compatibilityFlags, NODEJS_ALS_FLAG];
@@ -509,30 +500,24 @@ function ensureWranglerNodejsAlsFlag(root) {
 	return true;
 }
 function readManagedQueueProvenance(text) {
-	const encoded = MANAGED_QUEUES_MARKER.exec(text)?.[1];
-	if (!encoded) return {
+	const none = {
 		producerBindings: [],
 		consumerQueues: [],
 		pendingConsumerRemovals: []
 	};
+	const encoded = MANAGED_QUEUES_MARKER.exec(text)?.[1];
+	if (!encoded) return none;
+	const strings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 	try {
 		const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-		if (!isRecord(parsed)) return {
-			producerBindings: [],
-			consumerQueues: [],
-			pendingConsumerRemovals: []
-		};
+		if (!isRecord(parsed)) return none;
 		return {
-			producerBindings: Array.isArray(parsed.producerBindings) ? parsed.producerBindings.filter((value) => typeof value === "string") : [],
-			consumerQueues: Array.isArray(parsed.consumerQueues) ? parsed.consumerQueues.filter((value) => typeof value === "string") : [],
-			pendingConsumerRemovals: Array.isArray(parsed.pendingConsumerRemovals) ? parsed.pendingConsumerRemovals.filter((value) => typeof value === "string") : []
+			producerBindings: strings(parsed.producerBindings),
+			consumerQueues: strings(parsed.consumerQueues),
+			pendingConsumerRemovals: strings(parsed.pendingConsumerRemovals)
 		};
 	} catch {
-		return {
-			producerBindings: [],
-			consumerQueues: [],
-			pendingConsumerRemovals: []
-		};
+		return none;
 	}
 }
 function writeManagedQueueProvenance(text, provenance) {
@@ -592,14 +577,7 @@ function acknowledgeWranglerManagedQueueRemovals(configPath, removedQueues) {
 * idempotent upsert — running twice produces byte-identical output.
 */
 function writeProvisionedWranglerConfig(root, patch, options) {
-	let configPath = options?.configPath;
-	if (configPath === void 0) {
-		for (const p of projectWranglerPaths(root)) if (existsSync(p)) {
-			configPath = p;
-			break;
-		}
-		configPath ??= materializeCloudflareConfig(root);
-	}
+	const configPath = options?.configPath ?? discoverWranglerConfigPath(root);
 	const rawContent = existsSync(configPath) ? readFileSync(configPath, "utf-8") : "{}";
 	const hasBom = rawContent.startsWith(UTF8_BOM);
 	const original = hasBom ? rawContent.slice(1) : rawContent;
@@ -1427,7 +1405,7 @@ function findBindingNameOwner(config, field, name) {
 *   2. MORE THAN ONE entry in the target field sharing `binding` (ambiguous identity —
 *      wrangler also rejects duplicate binding names);
 *   3. a worker-wide CROSS-TYPE collision — `binding` is ALSO owned by any OTHER binding
-*      type (reuses the {@link collectWorkerBindingNames} Task-3 collector, EXCLUDING the
+*      type (reuses the {@link collectWorkerBindingNames} collector, EXCLUDING the
 *      target field so the entry never self-collides, and INCLUDING `queues.producers`).
 * Returns the single matching entry, or `undefined` when the binding is absent.
 */
@@ -1513,15 +1491,8 @@ const BINDING_FIELD_SHAPES = {
 * `ratelimits` name-keying and `logfwdr`'s nested `.bindings`, among others).
 */
 function bindingNamesForField(field, value) {
-	const shape = BINDING_FIELD_SHAPES[field] ?? { kind: "namespace-array" };
-	switch (shape.kind) {
-		case "key-map": return keyMapBindingNames(field, value);
-		case "name-keyed-array": return nameKeyedBindingNames(field, value);
-		case "namespace-array": return namespaceArrayBindingNames(field, value);
-		case "singleton": return singletonBindingName(field, value, shape.bindingRequired);
-		case "binding-list": return bindingListNames(field, value, shape.bindingsRequired);
-		case "whole-object": return [];
-	}
+	if (BINDING_FIELD_SHAPES[field]?.kind === "key-map") return keyMapBindingNames(field, value);
+	return bindingEntriesForField(field, value).map((entry) => entry.name);
 }
 /**
 * The entry-shaped sibling of {@link bindingNamesForField}: routes each field to its KNOWN
@@ -1529,8 +1500,8 @@ function bindingNamesForField(field, value) {
 * caller can compare not just WHICH bindings a field declares but the TARGET each one points
 * at (a `services` binding's `service`, an `unsafe` binding's `type`, …). Same fail-closed
 * philosophy as {@link bindingNamesForField} — a malformed/missing REQUIRED identity or wrong
-* outer shape THROWS. By construction `bindingEntriesForField(f, v).map((e) => e.name)` equals
-* `bindingNamesForField(f, v)` for every field (both read identity through the same shapes).
+* outer shape THROWS. {@link bindingNamesForField} is this reader's `.name` projection for every
+* non-key-map field.
 *
 * Exported so the deploy orchestrator's pass-through assert-set check can pin a legitimately
 * hand-declared binding's ENTRY pre-build and reject a build that KEEPS the name but REWRITES
@@ -1559,9 +1530,10 @@ function keyMapBindingEntries(field) {
 	throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" must be an object mapping names to values. Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
 }
 /**
-* Entry-shaped reader for a NAMESPACE-array field (mirror of {@link namespaceArrayBindingNames}):
-* a PRESENT non-array THROWS; every member is strictly validated for a non-empty string
-* `.binding` and returned with its full entry object.
+* Entry-shaped reader for a NAMESPACE-array field (`[{ binding }]`: kv_namespaces, d1_databases,
+* r2_buckets, hyperdrive, services, vectorize, …). A PRESENT value that is not an array THROWS
+* rather than being re-read as a key-map (which could under-collect and hide a real collision);
+* every member is strictly validated for a non-empty string `.binding`.
 */
 function namespaceArrayBindingEntries(field, value) {
 	if (value === void 0) return [];
@@ -1569,8 +1541,15 @@ function namespaceArrayBindingEntries(field, value) {
 	return strictBindingEntries(value, "binding", field);
 }
 /**
-* Entry-shaped reader for a NAME-keyed array field (mirror of {@link nameKeyedBindingNames}):
-* identity is `.name` only; a PRESENT non-array THROWS; every member is strictly validated.
+* Entry-shaped reader for a NAME-keyed array field (`send_email` / `ratelimits`: an array of
+* `{ name }`). A PRESENT non-array THROWS; every member is strictly validated.
+*
+* Identity is the `.name` ONLY. Verified against wrangler 4.131's bundle +
+* `config-schema.json`: NEITHER `send_email` NOR `ratelimits` has a `.binding` property in
+* the schema, and on UPLOAD wrangler keys them by `.name`. An optional `.binding` that happens
+* to sit on such an entry is NOT a binding identity wrangler recognizes, so unioning it would
+* invent a PHANTOM collision (e.g. `send_email:[{name:"EMAIL_A",binding:"QUEUE_JOBS"}]` would
+* falsely block a legitimate `QUEUE_JOBS` queue producer).
 */
 function nameKeyedBindingEntries(field, value) {
 	if (value === void 0) return [];
@@ -1578,10 +1557,10 @@ function nameKeyedBindingEntries(field, value) {
 	return strictBindingEntries(value, "name", field);
 }
 /**
-* Entry-shaped reader for a binding-LIST field (mirror of {@link bindingListNames}): the entry
-* of each member is the member itself (`{ name, ... }`), keyed on `.name`. Same throw semantics
-* as the name reader — a wrong outer shape, or a required-but-missing `bindings`, THROWS; a
-* `bindings`-less `unsafe` (optional) contributes nothing.
+* Entry-shaped reader for a binding-LIST field (`{ bindings: [{ name }] }`: durable_objects /
+* logfwdr / unsafe): the entry of each member is the member itself, keyed on `.name`. A wrong
+* outer shape, or a missing `bindings` when required (durable_objects / logfwdr per schema),
+* THROWS; a `bindings`-less `unsafe` (optional) contributes nothing.
 */
 function bindingListEntries(field, value, bindingsRequired) {
 	if (value === void 0) return [];
@@ -1594,10 +1573,11 @@ function bindingListEntries(field, value, bindingsRequired) {
 	return strictBindingEntries(value.bindings, "name", `${field}.bindings`);
 }
 /**
-* Entry-shaped reader for a SINGLETON field (mirror of {@link singletonBindingName}): the entry
-* is the singleton value itself. A PRESENT non-object THROWS; a present-but-malformed `binding`
-* THROWS; a required-but-absent `binding` THROWS; a binding-optional `assets` with no binding
-* contributes nothing.
+* Entry-shaped reader for a SINGLETON field (`{ binding }`: ai / browser / images / stream /
+* media / websearch / version_metadata / assets): the entry is the singleton value itself. A
+* PRESENT non-object THROWS; a present-but-malformed `binding` THROWS; a required-but-absent
+* `binding` THROWS (never a fall-through that would mis-collect the object's OTHER keys); a
+* binding-optional `assets` with no binding contributes nothing.
 */
 function singletonBindingEntry(field, value, bindingRequired) {
 	if (value === void 0) return [];
@@ -1614,8 +1594,7 @@ function singletonBindingEntry(field, value, bindingRequired) {
 * Read binding names from a KEY-MAP field (`vars`/`wasm_modules`/`text_blobs`/
 * `data_blobs`): the object's KEYS are the binding names. Reads ONLY the keys — never
 * the values — so a value that happens to look like a binding list (`{bindings:[…]}`)
-* or a singleton (`{binding:'x'}`) is NOT misread (the old generic path returned the
-* VALUE, or a nested `name`, instead of the real KEY). A PRESENT value that is not a
+* or a singleton (`{binding:'x'}`) is NOT misread. A PRESENT value that is not a
 * plain object is the wrong outer shape and THROWS (fail closed). An explicitly
 * `undefined`-valued key is not a real binding and is skipped.
 */
@@ -1625,95 +1604,11 @@ function keyMapBindingNames(field, value) {
 	return Object.keys(value).filter((key) => value[key] !== void 0);
 }
 /**
-* Read binding names from a NAMESPACE-array field (`[{ binding }]`: kv_namespaces,
-* d1_databases, r2_buckets, hyperdrive, services, vectorize, …). A PRESENT value that
-* is not an array is the wrong outer shape and THROWS rather than being re-read as a
-* key-map (which could under-collect and hide a real collision); every member is
-* strictly validated for a non-empty string `.binding`.
-*/
-function namespaceArrayBindingNames(field, value) {
-	if (value === void 0) return [];
-	if (!Array.isArray(value)) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" must be an array of binding entries. Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
-	return strictBindingArray(value, "binding", field);
-}
-/**
-* Read binding names from a NAME-keyed array field (`send_email` / `ratelimits`:
-* an array of `{ name }`). Encodes the field's REQUIRED outer shape: a PRESENT value that
-* is not an array THROWS (fail closed) rather than falling back to generic key collection —
-* wrangler validates these via `validateBindingArray`, so a non-array is malformed and
-* could hide a real collision if silently re-read as a key-map. An ABSENT value contributes
-* nothing. Every array member is strictly validated (a malformed one rejects the whole
-* config).
-*
-* Identity is the `.name` ONLY. Verified against wrangler 4.131's bundle +
-* `config-schema.json`: NEITHER `send_email` NOR `ratelimits` has a `.binding` property in
-* the schema, and on UPLOAD wrangler keys them by `.name` (send_email:
-* `output[name] = { type: "send_email", ...}`; ratelimits push `{ name: binding.name, … }`).
-* An optional `.binding` that happens to sit on such an entry is NOT a binding identity
-* wrangler recognizes, so unioning it invents a PHANTOM collision — e.g. a
-* `send_email:[{name:"EMAIL_A",binding:"QUEUE_JOBS"}]` would falsely block a legitimate
-* `QUEUE_JOBS` queue producer / adopt / read-first. We therefore collect ONLY the `.name`
-* of every member (a genuine same-`name` collision is still caught).
-*/
-function nameKeyedBindingNames(field, value) {
-	if (value === void 0) return [];
-	if (!Array.isArray(value)) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" must be an array of binding entries. Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
-	return strictBindingArray(value, "name", field);
-}
-/**
-* Read the binding names from a binding-LIST field (`{ bindings: [{ name }] }`:
-* durable_objects / logfwdr / unsafe). A PRESENT value that is not an object is the
-* wrong outer shape and THROWS. When `bindingsRequired` (durable_objects / logfwdr per
-* schema), a MISSING `bindings` array THROWS (never a silent empty read); `unsafe` is
-* optional, so a `bindings`-less `{ metadata }` contributes nothing. A PRESENT
-* `bindings` array has EVERY member strictly validated for a non-empty string `name`.
-*/
-function bindingListNames(field, value, bindingsRequired) {
-	if (value === void 0) return [];
-	if (!isRecord(value)) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" must be an object with a "bindings" array. Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
-	if (value.bindings === void 0) {
-		if (bindingsRequired) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" requires a "bindings" array. Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
-		return [];
-	}
-	if (!Array.isArray(value.bindings)) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}.bindings" must be an array. Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
-	return strictBindingArray(value.bindings, "name", `${field}.bindings`);
-}
-/**
-* Read the binding name from a SINGLETON field (`{ binding }`: ai / browser /
-* images / stream / media / websearch / version_metadata / assets). A PRESENT value
-* that is not an object is the wrong outer shape and THROWS. A PRESENT-but-malformed
-* `binding` (non-string / empty) THROWS. When `bindingRequired` (every singleton except
-* `assets`, per schema), an ABSENT `binding` also THROWS — never a silent empty read,
-* and never a fall-through that would mis-collect the object's OTHER keys (e.g.
-* `{ staging: true }`) as bogus binding names. `assets` is binding-optional, so an
-* absent binding (e.g. `{ directory }`) contributes nothing.
-*/
-function singletonBindingName(field, value, bindingRequired) {
-	if (value === void 0) return [];
-	if (!isRecord(value)) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" must be an object with a "binding". Refusing to proceed on a partially-readable binding set (a wrong-shaped field could hide a real collision). Fix the wrangler config and retry.`);
-	if (typeof value.binding === "string" && value.binding.length > 0) return [value.binding];
-	if (value.binding !== void 0) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" has a malformed "binding" (expected a non-empty string). Refusing to proceed on a partially-readable binding set (a dropped binding could hide a real collision). Fix the wrangler config and retry.`);
-	if (bindingRequired) throw new Error(`deploy: cannot verify binding-name uniqueness — "${field}" requires a "binding" (a non-empty string). Refusing to proceed on a partially-readable binding set (a dropped binding could hide a real collision). Fix the wrangler config and retry.`);
-	return [];
-}
-/**
-* Strictly read `keyField` (a non-empty string) from EVERY member of a
-* binding-bearing array. THROWS (fail closed) on ANY malformed member — never
-* silently drops one. Dropping a malformed member could convert a mixed-validity
-* array (e.g. `[null, { binding: 'DB', id: '…' }]`) into an empty/partial binding
-* set, so the worker-wide uniqueness guard would MISS the existing `DB` and commit
-* a conflicting binding — a fail-open in a documented invariant. Mirrors the
-* writer's existing fail-closed-on-malformed-config philosophy.
-*/
-function strictBindingArray(members, keyField, field) {
-	return strictBindingEntries(members, keyField, field).map((e) => e.name);
-}
-/**
-* The entry-shaped sibling of {@link strictBindingArray}: reads `keyField` (a non-empty string)
-* from EVERY member and returns it PAIRED with the member's full entry object. Same fail-closed
-* validation — a non-record member, or one missing a non-empty string `keyField`, THROWS (never
-* silently dropped). {@link strictBindingArray} is defined in terms of this, so the two agree on
-* names and error messages for every field.
+* Strictly read `keyField` (a non-empty string) from EVERY member of a binding-bearing array and
+* return it PAIRED with the member's full entry object. THROWS (fail closed) on ANY malformed
+* member — never silently drops one. Dropping a malformed member could convert a mixed-validity
+* array (e.g. `[null, { binding: 'DB', id: '…' }]`) into an empty/partial binding set, so the
+* worker-wide uniqueness guard would MISS the existing `DB` and commit a conflicting binding.
 */
 function strictBindingEntries(members, keyField, field) {
 	return members.map((member, index) => {
@@ -1755,4 +1650,4 @@ function canonicalize(value) {
 	return value;
 }
 //#endregion
-export { writeProvisionedWranglerConfig as A, readWranglerPublishedTrafficSnapshot as C, syncWranglerDurableObjects as D, syncWranglerBindings as E, syncWranglerWebSockets as O, readWranglerManagedQueueCleanupCandidates as S, resolveLiveBindingConfig as T, readExistingLiveBindingConfig as _, LIVE_MIGRATION_TAG as a, readWranglerCompat as b, bindingEntriesForField as c, ensureWranglerCompatibilityDate as d, ensureWranglerNodejsAlsFlag as f, normalizeWranglerCompatibilityFlags as g, nextDurableObjectMigrationTag as h, LATEST_KNOWN_COMPAT_DATE as i, writeWranglerPublishedTrafficSnapshot as j, updateWranglerCustomDomain as k, bindingNamesForField as l, hasDurableObjectSqliteMigration as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, findBindingNameOwner as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompat as u, readProvisionedBindingEntry as v, readWranglerWebSocketTombstones as w, readWranglerCustomDomains as x, readRootWranglerConfig as y };
+export { updateWranglerCustomDomain as A, readWranglerManagedQueueCleanupCandidates as C, syncWranglerBindings as D, resolveLiveBindingConfig as E, writeWranglerPublishedTrafficSnapshot as M, syncWranglerDurableObjects as O, readWranglerCustomDomains as S, readWranglerWebSocketTombstones as T, persistMaterializedWranglerConfig as _, LIVE_MIGRATION_TAG as a, readRootWranglerConfig as b, bindingEntriesForField as c, ensureWranglerCompatibilityDate as d, ensureWranglerNodejsAlsFlag as f, normalizeWranglerCompatibilityFlags as g, nextDurableObjectMigrationTag as h, LATEST_KNOWN_COMPAT_DATE as i, writeProvisionedWranglerConfig as j, syncWranglerWebSockets as k, bindingNamesForField as l, hasDurableObjectSqliteMigration as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, findBindingNameOwner as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompat as u, readExistingLiveBindingConfig as v, readWranglerPublishedTrafficSnapshot as w, readWranglerCompat as x, readProvisionedBindingEntry as y };

package/dist/{ws-C79j4aED.d.mts → ws-CChrrAU-.d.mts}

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
 import { r as AuthUser } from "./auth-DkcFflXV.mjs";
-import { a as CloudEnv } from "./handler-BeK3weD4.mjs";
+import { a as CloudEnv } from "./handler-CNAwjRcW.mjs";
 import { WebSocketRouteMap } from "void/routes";
 //#region src/runtime/ws.d.ts
 type MaybePromise<T> = T | Promise<T>;

package/dist/{yarn-pnp-BV4AzNul.mjs → yarn-pnp-CUX_iTPA.mjs}

@@ -69,26 +69,28 @@ function hasLocalLockfile(dir) {
 * PnP monorepo, `.pnp.cjs` lives at the workspace root, not in each
 * subpackage. Checking only `start` would miss the common shape.
 *
-* Round 46: local PnP files at `start` are always authoritative and
-* take precedence over the leaf-managed guard below. When `start` has
-* no local PnP files but DOES have local install ownership (lockfile or
-* Corepack pin), stop here — ancestor PnP data belongs to a different
-* install graph and injecting it will break resolution for the local
-* one. Only walk past `start` when neither condition holds.
-*
-* Internal: only `buildDrizzleKitSpawnEnv` below consumes this. The
-* stricter `findInstalledYarnPnpRuntime` is the public variant callers
-* outside this module reach for.
+* Local PnP files at `start` are always authoritative and take
+* precedence over the leaf-managed guard below. When `start` has no
+* local PnP files but DOES have a local lockfile, stop here — ancestor
+* PnP data belongs to a different install graph and injecting it will
+* break resolution for the local one. Only walk past `start` when
+* neither condition holds.
 */
 function findYarnPnpRuntime(start) {
 	const local = readPnpRuntimeAt(start);
-	if (local !== void 0) return local;
+	if (local !== void 0) return {
+		dir: start,
+		runtime: local
+	};
 	if (hasLocalLockfile(start)) return;
 	let dir = dirname(start);
 	if (dir === start) return;
 	while (true) {
 		const found = readPnpRuntimeAt(dir);
-		if (found !== void 0) return found;
+		if (found !== void 0) return {
+			dir,
+			runtime: found
+		};
 		const parent = dirname(dir);
 		if (parent === dir) return;
 		dir = parent;
@@ -99,7 +101,7 @@ function findYarnPnpRuntime(start) {
 * when the PnP runtime files AND a post-install marker live in the
 * SAME ancestor directory.
 *
-* Round 40 rationale: Yarn Berry repos commonly commit `.pnp.cjs` to
+* Yarn Berry repos commonly commit `.pnp.cjs` to
 * version control but NOT `.yarn/cache/*.zip` (zero-install is an
 * opt-in, not the default). A fresh `git clone` before `yarn install`
 * therefore has `.pnp.cjs` on disk while the PnP data points at ZIP
@@ -108,7 +110,7 @@ function findYarnPnpRuntime(start) {
 * install step, and the subsequent `drizzle-kit generate` spawn crashes
 * because PnP tries to load `void/schema-d1` from a missing ZIP.
 *
-* Round 42: accept EITHER of two markers, to cover both non-zero-install
+* Accept EITHER of two markers, to cover both non-zero-install
 * and zero-install shapes:
 *
 *   1. `.yarn/install-state.gz` in the same dir. Yarn Berry (3.x and
@@ -135,18 +137,8 @@ function findYarnPnpRuntime(start) {
 * a spawn, the env needs to be prepared.
 */
 function findInstalledYarnPnpRuntime(start) {
-	const local = readPnpRuntimeAt(start);
-	if (local !== void 0) return isYarnPnpInstalled(start) ? local : void 0;
-	if (hasLocalLockfile(start)) return;
-	let dir = dirname(start);
-	if (dir === start) return;
-	while (true) {
-		const found = readPnpRuntimeAt(dir);
-		if (found !== void 0) return isYarnPnpInstalled(dir) ? found : void 0;
-		const parent = dirname(dir);
-		if (parent === dir) return;
-		dir = parent;
-	}
+	const found = findYarnPnpRuntime(start);
+	return found && isYarnPnpInstalled(found.dir) ? found.runtime : void 0;
 }
 /**
 * Return true when `dir` looks like a post-install Yarn Berry PnP
@@ -183,7 +175,7 @@ function isYarnPnpInstalled(dir) {
 */
 function buildDrizzleKitSpawnEnv(root) {
 	const env = { ...process.env };
-	const pnp = findYarnPnpRuntime(root);
+	const pnp = findYarnPnpRuntime(root)?.runtime;
 	if (!pnp) return env;
 	const flags = [];
 	if (pnp.pnpCjs) flags.push(`--require ${JSON.stringify(pnp.pnpCjs)}`);

package/{skills/void/docs → docs}/guide/ai.md

@@ -41,7 +41,7 @@ export const POST = defineHandler(async (c) => {
 });
 ```
 
-AI methods return promises. Await them to receive the result, or return the promise directly from a handler. Usage limits reject with [`UsageLimit`](#usage-limits); Void route handlers and Pages actions automatically send a structured HTTP 429 when it is left uncaught.
+AI methods return promises. Await them to receive the result, or return the promise directly from a handler. See [Usage Limits](#usage-limits) for limit errors.
 
 You can use any model available through Cloudflare's AI binding, including Workers AI models such as `@cf/meta/llama-3.3-70b-instruct-fp8-fast` and Cloudflare Gateway models such as `google/gemini-2.5-flash` or `openai/gpt-4.1-mini`. The input object must match the selected Cloudflare model's schema. Models that return binary data, such as generated images, are returned as a `Blob` from `ai.run()`.
 
@@ -133,7 +133,7 @@ const result = await ai.run('google/gemini-2.5-flash', {
 });
 ```
 
-Pass AI Gateway options as the third argument: `ai.run(model, inputs, { gateway: { skipCache: true } })`.
+Pass AI Gateway options as the third argument: `ai.run(model, inputs, { gateway: { skipCache: true } })`. On a team platform, the platform chooses the gateway and sets its metadata and logging; options such as `skipCache` and `cacheTtl` still apply.
 
 For provider-native requests on a direct deployment, configure [`ai.gateway`](../integrations/cloudflare.md#ai-self-host).
 
@@ -142,7 +142,9 @@ For provider-native requests on a direct deployment, configure [`ai.gateway`](..
 Use `ai.provider(provider).fetch(path, init)` for a provider-native API with your
 own provider key. The request goes through the configured Cloudflare AI Gateway
 and retains the provider's native HTTP shape. On a team platform, it also passes
-through that installation's proxy.
+through that installation's proxy. AI Gateway cache, timeout and retry headers,
+such as `cf-aig-cache-ttl` and `cf-aig-max-attempts`, still apply there; the
+platform ignores logging, metadata and cost headers.
 
 ### OpenAI
 

package/{skills/void/docs → docs}/guide/auth.md

@@ -92,7 +92,7 @@ Email/password is enabled by default. To add social providers:
 }
 ```
 
-Use `auth.providers` when you want to enable social providers explicitly. Provider credentials come from `AUTH_<PROVIDER>_CLIENT_ID` and `AUTH_<PROVIDER>_CLIENT_SECRET`.
+Provider credentials come from `AUTH_<PROVIDER>_CLIENT_ID` and `AUTH_<PROVIDER>_CLIENT_SECRET`.
 
 See the full provider list in the [config reference](../reference/config.md#auth).
 
@@ -127,6 +127,42 @@ Auth sessions use the same database as your app. Void creates `BETTER_AUTH_SECRE
 
 Local development needs no secret setup. To preview a production build locally, provide `BETTER_AUTH_SECRET`.
 
+`POST`, `PUT`, `PATCH` and `DELETE` requests and WebSocket connections from another origin don't use the signed-in session unless that origin is in `trustedOrigins`. If a separate frontend calls your app, add its origin there (see [Customization](#customization)). If your routes use their own cookies, check the request `Origin` yourself, for example with Hono's [`csrf()`](https://hono.dev/docs/middleware/builtin/csrf) middleware.
+
+Deployed apps on Cloudflare limit auth requests per client IP with Better Auth's defaults, for example 3 sign-in attempts per 10 seconds. Each Worker instance keeps its own count. Change or turn off the limits with `rateLimit` in `auth.ts`. To share one count across instances, set `rateLimit: { storage: 'database' }`, then run `void db generate` for a direct Cloudflare deploy.
+
+### Proxies and end-to-end tests
+
+All requests from one IP share one count. Two common setups reach the limits:
+
+- A server calls your auth endpoints for your users, such as a backend-for-frontend, a rewrite from Vercel or nginx, or another Worker's `fetch`. All of those users share that server's IP.
+- End-to-end tests sign up or sign in many times against a deployed app.
+
+Don't read the client IP from `x-forwarded-for` instead: any client can send that header. Give the trusted caller a secret header, and skip the limits only for requests that carry it:
+
+```ts
+import { defineAuth } from 'void/auth';
+
+export default defineAuth(({ defaults, env }) => ({
+  ...defaults,
+  rateLimit: {
+    customRules: {
+      '/**': (request, rule) =>
+        env.AUTH_TRUSTED_KEY && request.headers.get('x-auth-trusted-key') === env.AUTH_TRUSTED_KEY
+          ? false
+          : rule,
+    },
+  },
+}));
+```
+
+`'/**'` matches every auth endpoint. Returning `false` skips the limit, and returning `rule` keeps the default limit for everyone else. Declare `AUTH_TRUSTED_KEY: string().optional()` in `env.ts` and set it with `void secret put AUTH_TRUSTED_KEY` (see [Environment variables](./env-vars.md#production-server-values)).
+
+Your app no longer limits requests that carry the key, so:
+
+- A proxy that sends it must limit every auth request it forwards for each of its users, including sign-up, password reset and verification emails.
+- A test runner should send it only to your app. Never put the key in code that runs in your users' browsers.
+
 ## Customization
 
 For advanced configuration, create `auth.ts` at the project root and export `defineAuth(...)`:

package/{skills/void/docs → docs}/guide/database/postgresql.md

@@ -59,7 +59,7 @@ export const users = pgTable('users', {
 });
 ```
 
-`void gen model` generates PostgreSQL-appropriate code when the dialect is set to `postgresql`.
+`void gen model` generates PostgreSQL-appropriate code when `database` is set to `"pg"`.
 
 ## Migrations
 
@@ -88,4 +88,4 @@ To update a linked Void project's connection, for example after moving the datab
 void db set-url
 ```
 
-This prompts for the new connection string and updates the Hyperdrive configuration. The change takes effect on the next deploy.
+This prompts for the new connection string and updates the Hyperdrive configuration.