void 0.26.0 → 0.27.0

package/dist/{head-D_QRR5Yd.mjs → head-D2VF4ApL.mjs}

@@ -9,6 +9,11 @@
 */
 function resolveHead(configHead, middlewareHead, pageHead) {
 	if (!configHead && !middlewareHead && !pageHead) return;
+	const layers = [
+		configHead,
+		middlewareHead,
+		pageHead
+	];
 	const result = {};
 	const title = pageHead?.title ?? middlewareHead?.title ?? configHead?.title;
 	if (title !== void 0) {
@@ -16,62 +21,40 @@ function resolveHead(configHead, middlewareHead, pageHead) {
 		result.title = template ? template.replace("%s", title) : title;
 	}
 	const metaMap = /* @__PURE__ */ new Map();
-	const metaOrder = [];
-	for (const layer of [
-		configHead,
-		middlewareHead,
-		pageHead
-	]) {
+	for (const layer of layers) {
 		if (!layer?.meta) continue;
 		for (const entry of layer.meta) {
 			const key = entry.charset ? "charset" : entry.property ? `property:${entry.property}` : `name:${entry.name ?? ""}`;
-			if (!metaMap.has(key)) metaOrder.push(key);
 			metaMap.set(key, entry);
 		}
 	}
-	if (metaMap.size > 0) result.meta = metaOrder.map((key) => metaMap.get(key));
-	const links = [];
-	for (const layer of [
-		configHead,
-		middlewareHead,
-		pageHead
-	]) if (layer?.link) links.push(...layer.link);
+	if (metaMap.size > 0) result.meta = [...metaMap.values()];
+	const links = layers.flatMap((layer) => layer?.link ?? []);
 	if (links.length > 0) result.link = links;
-	const scripts = [];
-	for (const layer of [
-		configHead,
-		middlewareHead,
-		pageHead
-	]) if (layer?.script) scripts.push(...layer.script);
+	const scripts = layers.flatMap((layer) => layer?.script ?? []);
 	if (scripts.length > 0) result.script = scripts;
-	const htmlAttrs = {};
-	let hasHtmlAttrs = false;
-	for (const layer of [
-		configHead,
-		middlewareHead,
-		pageHead
-	]) if (layer?.htmlAttrs) {
-		Object.assign(htmlAttrs, layer.htmlAttrs);
-		hasHtmlAttrs = true;
-	}
-	if (hasHtmlAttrs) result.htmlAttrs = htmlAttrs;
-	const bodyAttrs = {};
-	let hasBodyAttrs = false;
-	for (const layer of [
-		configHead,
-		middlewareHead,
-		pageHead
-	]) if (layer?.bodyAttrs) {
-		Object.assign(bodyAttrs, layer.bodyAttrs);
-		hasBodyAttrs = true;
-	}
-	if (hasBodyAttrs) result.bodyAttrs = bodyAttrs;
+	const htmlAttrs = mergeAttrs(layers, "htmlAttrs");
+	if (htmlAttrs) result.htmlAttrs = htmlAttrs;
+	const bodyAttrs = mergeAttrs(layers, "bodyAttrs");
+	if (bodyAttrs) result.bodyAttrs = bodyAttrs;
 	if (result.title === void 0 && !result.meta && !result.link && !result.script && !result.htmlAttrs && !result.bodyAttrs) return;
 	return result;
 }
+/** Shallow-merge an attribute map across layers; undefined when no layer sets it. */
+function mergeAttrs(layers, key) {
+	let merged;
+	for (const layer of layers) {
+		const attrs = layer?.[key];
+		if (attrs) merged = Object.assign(merged ?? {}, attrs);
+	}
+	return merged;
+}
 function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function serializeAttrs(attrs) {
+	return Object.entries(attrs).filter(([, value]) => value != null).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+}
 /** Serialize a HeadDescriptor to HTML tags for injection into `<head>`. */
 function renderHeadToString(head) {
 	const parts = [];
@@ -84,13 +67,10 @@ function renderHeadToString(head) {
 		if (entry.content !== void 0) attrs.push(`content="${escapeHtml(entry.content)}"`);
 		parts.push(`<meta ${attrs.join(" ")}>`);
 	}
-	if (head.link) for (const entry of head.link) {
-		const attrs = Object.entries(entry).filter(([, value]) => value != null).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
-		parts.push(`<link ${attrs}>`);
-	}
+	if (head.link) for (const entry of head.link) parts.push(`<link ${serializeAttrs(entry)}>`);
 	if (head.script) for (const entry of head.script) {
 		const { innerHTML, ...rest } = entry;
-		const attrs = Object.entries(rest).filter(([, value]) => value != null).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+		const attrs = serializeAttrs(rest);
 		if (innerHTML) parts.push(`<script${attrs ? " " + attrs : ""}>${innerHTML}<\/script>`);
 		else if (attrs) parts.push(`<script ${attrs}><\/script>`);
 	}
@@ -98,14 +78,12 @@ function renderHeadToString(head) {
 }
 /** Serialize htmlAttrs to an attribute string (includes leading space). */
 function renderHtmlAttrs(head) {
-	if (!head.htmlAttrs) return "";
-	const attrs = Object.entries(head.htmlAttrs).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+	const attrs = head.htmlAttrs ? serializeAttrs(head.htmlAttrs) : "";
 	return attrs ? " " + attrs : "";
 }
 /** Serialize bodyAttrs to an attribute string (includes leading space). */
 function renderBodyAttrs(head) {
-	if (!head.bodyAttrs) return "";
-	const attrs = Object.entries(head.bodyAttrs).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+	const attrs = head.bodyAttrs ? serializeAttrs(head.bodyAttrs) : "";
 	return attrs ? " " + attrs : "";
 }
 //#endregion

package/dist/{headers-2rKda9Y6.mjs → headers-DlfR78Nu.mjs}

@@ -1,5 +1,5 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { a as convertFallbacksConfig, c as convertRewritesConfig, f as isProtocolRelative, l as countSplats, n as VALID_REDIRECT_STATUSES, o as convertHeadersConfig, p as parseHostPrefixedSource, s as convertRedirectsConfig } from "./config-Br_JZD6u.mjs";
+import { a as convertFallbacksConfig, c as convertRewritesConfig, f as isProtocolRelative, l as countSplats, n as VALID_REDIRECT_STATUSES, o as convertHeadersConfig, p as parseHostPrefixedSource, s as convertRedirectsConfig } from "./config-DiowPT80.mjs";
 import { i as voidWarn } from "./log-vqY3pqwI.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/headers.ts
@@ -186,8 +186,8 @@ function splitRedirectRulesByForce(rules) {
 *   - `routing.redirects` + `routing.rewrites`    → `redirectRules`
 *   - `routing.fallbacks`                         → `fallbackRules`
 *
-* Returns `fallbackRules === undefined` when empty so callers that default to
-* "no post-asset phase" behave identically to the old deploy code.
+* Returns `fallbackRules === undefined` when empty, meaning "no post-asset
+* phase".
 *
 * Duplicate linting is NOT called here (callers decide which warning surface
 * to use — CLI vs. Vite logger). `redundantForceOn3xx` is returned raw for

package/dist/{help-Bv44e2tm.mjs → help-0bTe_lID.mjs}

@@ -1,8 +1,8 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { H as outro } from "./prompts-6OSVA7DJ.mjs";
+import { H as outro } from "./dist-D3m88sjf.mjs";
+import { c as helpLine, l as import_picocolors, p as sectionTitle, t as categoryTitle, u as note } from "./output-C50ag2r3.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
-import { c as import_picocolors, d as sectionTitle, l as note, s as helpLine, t as categoryTitle } from "./output-BvdaehtE.mjs";
-import { n as operatorGroups, t as operatorCommands } from "./operator-args-DdY54Bgb.mjs";
+import { n as operatorGroups, t as operatorCommands } from "./operator-args-DOBhIaIg.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/ascii.ts
 const asciiArts = [
@@ -82,7 +82,7 @@ function operatorHelpTree() {
 					})),
 					...(entry.booleans ?? []).map((flag) => ({
 						command: `--${flag}`,
-						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : flag === "ended" ? "Attest that the original provider execution has ended" : flag === "public-apps" ? "Manage public app rules without identity policies" : flag === "protect-new-projects" ? "Protect newly created projects by default" : flag === "check" && group === "zero-trust" ? "Also check the saved settings against Cloudflare Access (several API calls)" : flag === "token-stdin" && group === "zero-trust" ? "Read the Access management API token from stdin" : flag === "token-stdin" && group === "email" ? entry.action === "domain-remove" ? "Read a replacement Cloudflare token for blocked project cleanup from stdin" : "Read a scoped Cloudflare API token from stdin" : "Read a full API session from stdin for explicit operator session exchange"
+						description: flag === "follow" ? "Poll new logs until interrupted or the build ends" : flag === "ended" ? "Attest that the original provider execution has ended" : flag === "public-apps" ? "Manage public app rules without identity policies" : flag === "protect-new-projects" ? "Protect newly created projects by default" : flag === "check" && group === "zero-trust" ? "Also check the saved settings against Cloudflare Access (several API calls)" : flag === "token-stdin" && group === "zero-trust" ? "Read the Access management API token from stdin" : flag === "token-stdin" && group === "email" ? entry.action === "domain-remove" ? "Read a replacement Cloudflare token for blocked project cleanup from stdin" : "Read a scoped Cloudflare API token from stdin" : flag === "all" ? "Rotate every project" : "Read a full API session from stdin for explicit operator session exchange"
 					}))
 				]
 			}]))
@@ -119,13 +119,9 @@ const HELP_TREE = {
 		summary: "Set up Void in a new or existing project.",
 		usage: ["void init [options]"],
 		options: [
-			{
-				command: "--agents",
-				description: "Set up agent instructions and skills"
-			},
 			{
 				command: "--tsconfig",
-				description: "Only update tsconfig.json"
+				description: "Update tsconfig.json and set up coding agents"
 			},
 			{
 				command: "--git",
@@ -137,23 +133,16 @@ const HELP_TREE = {
 			},
 			{
 				command: "--github",
-				description: "Only create the GitHub Actions deploy workflow (OIDC, no stored token)"
+				description: "Create the GitHub Actions deploy workflow and set up coding agents"
 			}
 		],
-		examples: [
-			{
-				command: "void init",
-				description: "Scaffold or configure the current project"
-			},
-			{
-				command: "void init --agents",
-				description: "Install agent instructions and skills"
-			},
-			{
-				command: "void init --github",
-				description: "Scaffold the GitHub Actions deploy workflow"
-			}
-		]
+		examples: [{
+			command: "void init",
+			description: "Scaffold or configure the current project"
+		}, {
+			command: "void init --github",
+			description: "Scaffold the GitHub Actions deploy workflow"
+		}]
 	},
 	migrate: {
 		summary: "Move legacy Void project settings into void.config.ts.",
@@ -1762,9 +1751,6 @@ function printGlobalHelp() {
 		globalCommandLine(["prepare"], "void prepare"),
 		...globalCommandLines("gen", { route: "route <path> [--methods]" }),
 		"",
-		categoryTitle("agent"),
-		helpLine("void init --agents", requiredOption(["init"], "--agents").description),
-		"",
 		categoryTitle("help"),
 		helpLine("void help <command>", "Show command-specific help"),
 		helpLine("void <command> --help", "Show command-specific help")
@@ -1819,11 +1805,6 @@ function globalCommandLine(path, command) {
 function globalOptionLines(path) {
 	return (requiredPage(path).options ?? []).map((option) => helpLine(`  ${option.command}`, option.description));
 }
-function requiredOption(path, command) {
-	const option = requiredPage(path).options?.find((entry) => entry.command === command);
-	if (!option) throw new Error(`Missing help option: ${formatHelpPath(path)} ${command}`);
-	return option;
-}
 function requiredPage(path) {
 	const page = findHelpPage(path);
 	if (!page) throw new Error(`Missing help page: ${formatHelpPath(path)}`);

package/dist/help-DfQYVfGY.mjs

@@ -0,0 +1,2 @@
+import { r as printHelpPage } from "./help-0bTe_lID.mjs";
+export { printHelpPage };

package/dist/{inbound-fRkqcXaC.mjs → inbound-PfQDLXc5.mjs}

@@ -1,18 +1,20 @@
-import { i as normalizeEmail, n as MimeError, o as validateAddressParts, r as buildMime } from "./mime-D5Nmdzf7.mjs";
-import { a as getRawRuntimeEnv } from "./env-raw-Cx8ElDdj.mjs";
-import { EMAIL_MAX_RESPONSE_BYTES } from "@void/platform/email-protocol";
+import { i as normalizeEmail, n as MimeError, o as validateAddressParts, r as buildMime } from "./mime-DxCznlJq.mjs";
+import { a as getRawRuntimeEnv } from "./env-raw-jZpP5n47.mjs";
+import { EMAIL_MAX_ACTIONS, EMAIL_MAX_INBOUND_BYTES, EMAIL_MAX_INBOUND_HEADERS, EMAIL_MAX_METADATA_BYTES, EMAIL_MAX_REPLY_BYTES, EMAIL_MAX_RESPONSE_BYTES } from "@void/platform/email-protocol";
 //#region src/runtime/email/inbound.ts
 const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
-const MAX_ACTIONS = 100;
+const MAX_ACTIONS = EMAIL_MAX_ACTIONS;
 const MAX_ACTION_ADDRESS_LENGTH = 320;
-const MAX_ACTION_METADATA_BYTES = 8192;
+const MAX_ACTION_METADATA_BYTES = EMAIL_MAX_METADATA_BYTES;
+/** Bounds on a forward's headers. */
+const MAX_FORWARD_HEADERS = 32;
 const MAX_FORWARD_HEADER_LENGTH = 1024;
 /** Maximum normalized SMTP rejection reason length. */
 const MAX_REJECT_REASON_LENGTH = 1e3;
 /** Inbound admission limits also applied by the handler test harness. */
-const MAX_INBOUND_BYTES = 10485760;
-const MAX_INBOUND_HEADERS = 1024;
-const MAX_REPLY_BYTES = 5242880;
+const MAX_INBOUND_BYTES = EMAIL_MAX_INBOUND_BYTES;
+const MAX_INBOUND_HEADERS = EMAIL_MAX_INBOUND_HEADERS;
+const MAX_REPLY_BYTES = EMAIL_MAX_REPLY_BYTES;
 const EMAIL_STREAM_DEADLINE_MS = 15e3;
 const EMAIL_ACTION_TERMINAL_BYTES = 5;
 const actionEncoder = new TextEncoder();
@@ -78,7 +80,7 @@ var ParseEmailError = class extends Error {
 * one-shot.
 */
 async function parseEmail(message) {
-	if (message.rawSize > 10485760) throw new ParseEmailError("INBOUND_TOO_LARGE", `parseEmail: message size ${message.rawSize} bytes exceeds maximum of ${MAX_INBOUND_BYTES} bytes.`);
+	if (message.rawSize > MAX_INBOUND_BYTES) throw new ParseEmailError("INBOUND_TOO_LARGE", `parseEmail: message size ${message.rawSize} bytes exceeds maximum of ${MAX_INBOUND_BYTES} bytes.`);
 	const { default: PostalMime } = await import("postal-mime");
 	const cached = proxyRawCache.get(message);
 	try {
@@ -135,12 +137,12 @@ function invalidForwardHeaders(cause) {
 */
 function assertForwardHeadersWithinBounds(headers) {
 	const names = Object.keys(headers);
-	if (names.length > 32) throw new MimeError("MIME_ERROR", `forward: ${names.length} headers, over the 32-header limit.`);
+	if (names.length > MAX_FORWARD_HEADERS) throw new MimeError("MIME_ERROR", `forward: ${names.length} headers, over the ${MAX_FORWARD_HEADERS}-header limit.`);
 	for (const name of names) {
-		if (name.length > 1024) throw new MimeError("MIME_ERROR", `forward: header name is ${name.length} characters, over the ${MAX_FORWARD_HEADER_LENGTH}-character limit.`);
+		if (name.length > MAX_FORWARD_HEADER_LENGTH) throw new MimeError("MIME_ERROR", `forward: header name is ${name.length} characters, over the ${MAX_FORWARD_HEADER_LENGTH}-character limit.`);
 		const value = headers[name];
 		if (typeof value !== "string") throw new MimeError("MIME_ERROR", `forward: header "${name.slice(0, 64)}" value is not a string.`);
-		if (value.length > 1024) throw new MimeError("MIME_ERROR", `forward: header "${name.slice(0, 64)}" value is ${value.length} characters, over the ${MAX_FORWARD_HEADER_LENGTH}-character limit.`);
+		if (value.length > MAX_FORWARD_HEADER_LENGTH) throw new MimeError("MIME_ERROR", `forward: header "${name.slice(0, 64)}" value is ${value.length} characters, over the ${MAX_FORWARD_HEADER_LENGTH}-character limit.`);
 	}
 }
 /**
@@ -152,10 +154,9 @@ function assertForwardHeadersWithinBounds(headers) {
 * The reason goes into the SMTP reply to the connecting client, and a
 * handler may build it from the inbound message: a remote sender's CRLF is
 * then a line injected into that reply, and a multi-megabyte reason is a
-* transient-heap amplifier. The router already refuses both, but on your
-* own account `enactEmailActions` handed the recorded string to the native
-* `setReject()` untouched, so the same handler injected there and was
-* clean here. NORMALIZED rather than refused, unlike the forward bounds
+* transient-heap amplifier. The router already refuses both; normalizing at
+* record time covers the native `setReject()` replay on your own account
+* too. NORMALIZED rather than refused, unlike the forward bounds
 * above: a reject is the handler's terminal decision, and throwing out of
 * it would drop that decision and bounce the message as a dispatch error
 * (see the `MAX_ACTIONS` note in `setReject`). Slice FIRST, then replace: a
@@ -431,7 +432,7 @@ function fitsHeaderLine(name, value) {
 * Whether `value` carries a C0 control other than HTAB, or DEL. The
 * sibling of `fitsHeaderLine` for the other way a remote-controlled id can
 * be unrepresentable: a threading value is emitted verbatim, so a control
-* inside it reached the reply's `In-Reply-To` / `References` line raw —
+* inside it would reach the reply's `In-Reply-To` / `References` line raw —
 * `\x01` and DEL pass a WHATWG `Headers`, which refuses only CR, LF and
 * NUL — and an RFC 5322 §3.6.4 `msg-id` is `dot-atom-text`, which admits no
 * control at all. HTAB is not one here: it is the whitespace that separates
@@ -488,7 +489,7 @@ function dropControlIds(chain) {
 * replacements below cost 66 bytes of heap per match, so at this size they
 * cost at most 135 KB, and the reply's own `Subject` line is at most ~20 KB
 * — 4096 code units x 3 UTF-8 octets, base64'd in 45-octet encoded-words
-* with their framing — against a `MAX_MESSAGE_BYTES` of 10 MiB, so the
+* with their framing — against a `MAX_MESSAGE_BYTES` of 5 MiB, so the
 * subject alone can never push the reply over the limit.
 */
 const MAX_REPLY_SUBJECT_CHARS = 4096;
@@ -512,13 +513,11 @@ function prefixReplySubject(original) {
 * `header_size_limit` discards header bytes past 100 KiB. A message-id is
 * tens of characters, so 8 KiB carries a chain over a hundred replies deep
 * with every id intact — an order of magnitude past any conversation — and
-* a value this size, folded and encoded, is at most ~25 KB of a 10 MiB
+* a value this size, folded and encoded, is at most ~25 KB of a 5 MiB
 * reply, so the chain alone can never push the reply over the limit.
 * Unbounded, it could: the inbound header can be the whole 10 MiB message,
-* and 10 MiB of short ids passes the line guard — every id folds — yet
-* `foldHeader`'s continuations put the rendered reply over
-* `MAX_MESSAGE_BYTES`, and `buildMime` threw (measured: 10,777,129 bytes
-* from a 10,485,557-character chain) for a reply the guide promises is sent.
+* and short ids pass the line guard — every id folds — yet `foldHeader`'s
+* continuations would put the rendered reply over `MAX_MESSAGE_BYTES`.
 *
 * Past the bound the NEWEST ids are kept, whole, and the parent's id still
 * ends the chain. That is what a mail client threads on: it links the reply
@@ -733,4 +732,4 @@ async function enactEmailActions(message, actions) {
 	}
 }
 //#endregion
-export { defineEmail as a, parseEmail as c, createMessageProxy as i, replyEmail as l, MAX_INBOUND_HEADERS as n, enactEmailActions as o, ParseEmailError as r, isForwardableEmailMessage as s, MAX_INBOUND_BYTES as t };
+export { createMessageProxy as a, isForwardableEmailMessage as c, bytesToReadableStream as i, parseEmail as l, MAX_INBOUND_HEADERS as n, defineEmail as o, ParseEmailError as r, enactEmailActions as s, MAX_INBOUND_BYTES as t, replyEmail as u };

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { n as HeadDescriptor } from "./head-Do8P4puT.mjs";
+import { n as HeadDescriptor } from "./head-C8K_iGe6.mjs";
 import { r as AuthUser } from "./auth-DkcFflXV.mjs";
-import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, x as DeferredState, y as defineScheduled } from "./handler-BeK3weD4.mjs";
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, x as DeferredState, y as defineScheduled } from "./handler-CNAwjRcW.mjs";
 import { t as QueueMap } from "./queues-BWKt1Xo4.mjs";
 import { PluginConfig } from "@cloudflare/vite-plugin";
 import { Plugin } from "vite";
@@ -49,6 +49,23 @@ export declare function shouldBindWorkersAi(command: string, needsAI: boolean, r
 export declare function resolveWorkersAiBindingName(resolvedAi: unknown, configuredName?: string): string;
 //#endregion
 //#region src/index.d.ts
+/**
+ * Void plugin — the main entry point.
+ *
+ * Composes:
+ * 1. Routing plugin (file-based routing from routes/ and middleware/)
+ * 2. Migration plugin (auto-apply .sql migrations on dev startup)
+ * 3. @cloudflare/vite-plugin (workerd runtime, HMR, builds)
+ *
+ * Binding inference runs synchronously here so results are available
+ * before the Cloudflare plugin initializes.
+ *
+ * The Cloudflare plugin reads Void's generated config and provides it to our
+ * config function. Bindings already defined there (with real IDs for
+ * production deployment) are preserved — we only add inferred bindings
+ * that are missing. This allows `vite build && wrangler deploy` to work
+ * for deploying directly to Cloudflare without the Void platform.
+ */
 export declare function voidPlugin(options?: {
   persistTo?: string;
   auxiliaryWorkers?: PluginConfig["auxiliaryWorkers"];