void 0.26.0 → 0.27.0

package/dist/index.mjs

@@ -1,50 +1,51 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, l as relative, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
-import { d as walk, n as FRAMEWORK_SCAN_DIRS, p as applyBindingOverrides, t as DEFAULT_SCAN_DIRS, u as inferBindingsFromSource } from "./plugin-inference-CXWnn79A.mjs";
+import { d as staticModuleReferences, f as walk, m as applyBindingOverrides, n as FRAMEWORK_SCAN_DIRS, t as DEFAULT_SCAN_DIRS, u as inferBindingsFromSource } from "./plugin-inference-BlQbOL0P.mjs";
 import { n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
 import { n as loadVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { d as isNodeTarget, m as readConfig, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
+import { d as isNodeTarget, m as readConfig, u as getDatabaseDialect } from "./config-DiowPT80.mjs";
 import { i as isMemberExpression, n as isIdentifier, r as isLiteral } from "./ast-CPGPjb0V.mjs";
 import { t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
-import { r as scanQueuesSync, s as scanJobsSync, t as analyzeApplicationSync } from "./application-analysis-DC2yPvzY.mjs";
-import { a as validateSsrEntries, n as SSR_SERVER_ENTRY_RELATIVE_PATHS, o as validateSsrEntry, t as SSR_CLIENT_ENTRY_RELATIVE_PATHS } from "./entry-CF5wvH4w.mjs";
-import { r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
-import { i as resolveLayoutIds } from "./scan-C8dA7iM4.mjs";
-import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, n as DEFAULT_SANDBOX_CLASS_NAME, r as SANDBOX_MIGRATION_TAG } from "./config-C_XRIPx2.mjs";
-import { Ct as hasDocumentRoutes, H as selectNativeVersionMetadataBinding, J as collectPages, St as hasApiRoutes, Tt as resolveAssetRoutingPolicy, V as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV, X as hasRevalidate, Y as collectRevalidate, at as resolveDistDir, lt as resolveWorkerDirName, o as prerenderPages, s as prerenderPagesNode, u as SEND_EMAIL_BINDING, xt as generateQueueResolverSource } from "./deploy-CeEbnv4b.mjs";
+import { r as scanQueuesSync, s as scanJobsSync, t as analyzeApplicationSync } from "./application-analysis-DKy02UY0.mjs";
+import { a as validateSsrEntries, n as SSR_SERVER_ENTRY_RELATIVE_PATHS, o as validateSsrEntry, t as SSR_CLIENT_ENTRY_RELATIVE_PATHS } from "./entry-CMAkqBmU.mjs";
+import { r as hasEmailHandlers } from "./email-d_Aux1vM.mjs";
+import { i as resolveLayoutIds } from "./scan-C3uDzz6J.mjs";
+import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, n as DEFAULT_SANDBOX_CLASS_NAME, r as SANDBOX_MIGRATION_TAG } from "./config-B_ggY-IO.mjs";
+import { G as hasRevalidate, R as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV, U as collectPages, W as collectRevalidate, _t as hasApiRoutes, et as resolveDistDir, gt as generateQueueResolverSource, it as resolveWorkerDirName, o as prerenderPages, s as prerenderPagesNode, u as SEND_EMAIL_BINDING, vt as hasDocumentRoutes, yt as resolveAssetRoutingPolicy, z as selectNativeVersionMetadataBinding } from "./deploy-Bqe1PYBw.mjs";
 import { i as voidWarn, n as voidError, r as voidLog, t as setShowTimestamp } from "./log-vqY3pqwI.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-2rKda9Y6.mjs";
-import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-DQstYTxO.mjs";
-import { a as restoreCloudflarePreviewPointer, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-Bktvwtpf.mjs";
-import { D as syncWranglerDurableObjects, E as syncWranglerBindings, O as syncWranglerWebSockets, T as resolveLiveBindingConfig, _ as readExistingLiveBindingConfig, a as LIVE_MIGRATION_TAG, b as readWranglerCompat, d as ensureWranglerCompatibilityDate, f as ensureWranglerNodejsAlsFlag, g as normalizeWranglerCompatibilityFlags, h as nextDurableObjectMigrationTag, m as hasDurableObjectSqliteMigration, p as findBindingNameOwner, u as ensureWranglerCompat, w as readWranglerWebSocketTombstones } from "./wrangler-DhUerFkW.mjs";
-import { n as writeLocalD1PersistState, t as resolveLocalD1Target } from "./local-d1-fGxYrVD6.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-DlfR78Nu.mjs";
+import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-BAm2aB6Q.mjs";
+import { a as restoreCloudflarePreviewPointer, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-BmhBv3HV.mjs";
+import { D as syncWranglerBindings, E as resolveLiveBindingConfig, O as syncWranglerDurableObjects, T as readWranglerWebSocketTombstones, a as LIVE_MIGRATION_TAG, d as ensureWranglerCompatibilityDate, f as ensureWranglerNodejsAlsFlag, g as normalizeWranglerCompatibilityFlags, h as nextDurableObjectMigrationTag, k as syncWranglerWebSockets, m as hasDurableObjectSqliteMigration, p as findBindingNameOwner, u as ensureWranglerCompat, v as readExistingLiveBindingConfig, x as readWranglerCompat } from "./wrangler-D9KTuqnv.mjs";
+import { n as writeLocalD1PersistState, t as resolveLocalD1Target } from "./local-d1-ga5O_idV.mjs";
 import { n as scopedAccessCredentials } from "./cf-access-TWNzXltp.mjs";
-import { r as ensurePlatformProxyAccess } from "./cf-access-YTlqvAsk.mjs";
-import { a as getApiUrl, c as getToken, o as getProxyUrl } from "./auth-D52yG7hl.mjs";
-import { n as parseDotenvFile } from "./dotenv-VQxupEUv.mjs";
-import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-B8GeM0RM.mjs";
-import { i as generateDbDts, n as generateQueueTypes, r as DRIZZLE_OPERATORS, t as generateRouteTypes } from "./route-types-Clm4WD0B.mjs";
-import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
-import { _ as parseCapturedMessage, a as DEV_INBOX_ENV_VAR, c as DEV_INBOX_TOKEN_ENV_VAR, f as clearDevBuffer, g as listDevMessages, l as DEV_INBOX_TOKEN_HEADER, m as findDevMessage, n as DEV_INBOX_ACK_VALUE, o as DEV_INBOX_MAX_CAPTURE_BYTES, s as DEV_INBOX_PREFIX, t as DEV_INBOX_ACK_HEADER, u as DEV_INBOX_TOKEN_QUERY, v as pushToDevBuffer, y as registerEmailSink } from "./dev-inbox-D64ZKUod.mjs";
-import { t as MagicString } from "./dist-AoCzRTJE.mjs";
-import { n as findEnvFileForPaths, r as generateEnvTypes, t as findEnvFile } from "./env-types-D5kds_OZ.mjs";
-import { y as loadUserEnvFile } from "./env-validation-vBSQ8gw5.mjs";
-import { a as loadLocalEnv, o as resolveRemoteMode, r as findLegacyEnvFiles, s as stripInternalEnvKeys, t as CLIENT_ENV_PREFIX$2 } from "./env-_v349JBd.mjs";
-import { n as INTERNAL_BINDING_PREFIXES, t as INTERNAL_BINDING_EXACT_NAMES } from "./env-raw-Cx8ElDdj.mjs";
-import { n as completeApplicationAnalysis } from "./application-routing-C9khgLiS.mjs";
-import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-Beb2Am5S.mjs";
-import { n as defer } from "./defer-YsYDUoii.mjs";
-import { a as defineMiddleware, c as defineScheduled, i as defineHead, n as basicAuth, o as defineQueue, r as defineHandler, s as defineRender, t as VoidAssetRewriteError } from "./handler-DghKr6dU.mjs";
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { r as ensurePlatformProxyAccess } from "./cf-access-BcIBSKqG.mjs";
+import { a as getApiUrl, c as getToken, o as getProxyUrl } from "./auth-Dn2vw-SG.mjs";
+import { d as printSuccess } from "./output-C50ag2r3.mjs";
+import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-CVJhNMxs.mjs";
+import { i as generateDbDts, n as generateQueueTypes, r as DRIZZLE_OPERATORS, t as generateRouteTypes } from "./route-types-CbtsIeFn.mjs";
+import { t as discoverSchema } from "./discover-CkCYv9T_.mjs";
+import { _ as listDevMessages, a as DEV_INBOX_ENV_VAR, b as registerEmailSink, c as DEV_INBOX_TOKEN_ENV_VAR, h as findDevMessage, l as DEV_INBOX_TOKEN_HEADER, n as DEV_INBOX_ACK_VALUE, o as DEV_INBOX_MAX_CAPTURE_BYTES, p as clearDevBuffer, s as DEV_INBOX_PREFIX, t as DEV_INBOX_ACK_HEADER, u as DEV_INBOX_TOKEN_QUERY, v as parseCapturedMessage, y as pushToDevBuffer } from "./dev-inbox-CK-UuPob.mjs";
+import { t as MagicString } from "./dist-Cegxq8gs.mjs";
+import { n as scanWranglerDotenvKeys } from "./dotenv-BfU6eqFt.mjs";
+import { a as isClientEnvKey, c as resolveRemoteMode, i as findReservedEnvKeys, n as LOCAL_ENV_FILE, o as loadLocalEnv, r as findLegacyEnvFiles, s as reservedEnvKeysMessage } from "./env-BxocywBB.mjs";
+import { n as findEnvFileForPaths, r as generateEnvTypes, t as findEnvFile } from "./env-types-CwXgeMgL.mjs";
+import { y as loadUserEnvFile } from "./env-validation-Dxdx_5wo.mjs";
+import { n as INTERNAL_BINDING_PREFIXES, t as INTERNAL_BINDING_EXACT_NAMES } from "./env-raw-jZpP5n47.mjs";
+import { n as completeApplicationAnalysis } from "./application-routing-DQyUh_5S.mjs";
+import { r as defer } from "./validation-error-Dg9Recn1.mjs";
+import { i as safeJsonStringify } from "./protocol-CfaUwNs8.mjs";
+import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-CF84FOVM.mjs";
+import { a as defineMiddleware, c as defineScheduled, i as defineHead, n as basicAuth, o as defineQueue, r as defineHandler, s as defineRender, t as VoidAssetRewriteError } from "./handler-BHAn2fZJ.mjs";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { cloudflare } from "@cloudflare/vite-plugin";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { normalizePath, parseSync } from "vite";
+import { loadEnv, normalizePath, parseSync, resolveEnvPrefix } from "vite";
 import { appendSqliteClassMigration } from "@void/deploy-core";
-import { timingSafeEqual } from "node:crypto";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
-import { isDeepStrictEqual } from "node:util";
-import { init, parse } from "es-module-lexer";
+import { isDeepStrictEqual, parseEnv } from "node:util";
 import { compilePattern } from "@void/edge";
 //#region src/pages/dev-css-assets.ts
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
@@ -75,7 +76,7 @@ function normalizeDevCssUrl(id, root) {
 	const { pathname, suffix } = splitQueryHash(normalized);
 	const normalizedRoot = normalizePath(root);
 	if (pathname === normalizedRoot || pathname.startsWith(normalizedRoot + "/")) return "/" + normalizePath(pathname.slice(normalizedRoot.length + 1)) + suffix;
-	if (pathname.startsWith("/@fs/") || pathname.startsWith("/@vite/") || pathname === "/@vite/client" || pathname.startsWith("/@react-refresh") || pathname.startsWith("/node_modules/.vite/")) return normalized;
+	if (pathname.startsWith("/@fs/") || pathname.startsWith("/@vite/") || pathname.startsWith("/@react-refresh") || pathname.startsWith("/node_modules/.vite/")) return normalized;
 	if (pathname.startsWith("/")) {
 		const rootFirstSegment = normalizedRoot.split("/").filter(Boolean)[0];
 		if (rootFirstSegment && !pathname.startsWith(`/${rootFirstSegment}/`)) return normalized;
@@ -86,9 +87,6 @@ function normalizeDevCssUrl(id, root) {
 function normalizeRequestUrl(url) {
 	return normalizePath(url).replace(/^\/@id\/__x00__/, "\0");
 }
-function toTransformRequestUrl(url) {
-	return normalizeRequestUrl(url);
-}
 function isCssRequest(url) {
 	return !CSS_BYPASS_RE.test(url) && (CSS_REQUEST_RE.test(url) || STYLE_QUERY_RE.test(url));
 }
@@ -194,7 +192,7 @@ var DevCssProvider = class {
 		const addByUrl = async (rawUrl) => {
 			const url = normalizeDevCssUrl(rawUrl, this.root);
 			if (isOptimizedDepUrl(url)) return;
-			const requestUrl = toTransformRequestUrl(url);
+			const requestUrl = normalizeRequestUrl(url);
 			let result;
 			try {
 				result = await environment.transformRequest(requestUrl);
@@ -243,16 +241,9 @@ var DevCssProvider = class {
 				});
 				continue;
 			}
-			const inlineUrl = appendInlineQuery(url);
-			let result;
-			try {
-				result = await environment.transformRequest(inlineUrl);
-			} catch (error) {
-				this.server.config.logger.warnOnce(`[void] Skipping dev CSS asset for ${url}: ${error instanceof Error ? error.message : String(error)}`);
-				continue;
-			}
-			if (!result) continue;
 			try {
+				const result = await environment.transformRequest(appendInlineQuery(url));
+				if (!result) continue;
 				assets.push({
 					url,
 					id: cssViteDevIds.get(url) ?? url,
@@ -396,7 +387,7 @@ export async function getVoidPagesDevCss(request, env, payload) {
 					res.end("Method Not Allowed");
 					return;
 				}
-				if (req.headers["X-Void-Dev-Asset-Request".toLowerCase()] !== "pages-css") {
+				if (req.headers[DEV_CSS_ASSET_GUARD_HEADER.toLowerCase()] !== DEV_CSS_ASSET_GUARD_VALUE) {
 					res.statusCode = 403;
 					res.end("Forbidden");
 					return;
@@ -428,17 +419,16 @@ export async function getVoidPagesDevCss(request, env, payload) {
 		async transform(code, id) {
 			if (this.environment?.name !== "client") return;
 			if (id.includes("/node_modules/.vite/")) return;
-			await init;
-			let imports;
+			let parsed;
 			try {
-				[imports] = parse(code);
+				parsed = parseSync(id, code, { lang: "js" });
+				if (parsed.errors.length > 0) return;
 			} catch {
 				return;
 			}
 			const edges = [];
-			for (const item of imports) {
-				if (item.type !== "static" && item.type !== "reexport-star" || !item.specifier) continue;
-				const resolved = await this.resolve(item.specifier, id, { skipSelf: true });
+			for (const { source } of staticModuleReferences(parsed, code)) {
+				const resolved = await this.resolve(source, id, { skipSelf: true });
 				if (resolved?.id) edges.push(normalizeDevCssUrl(resolved.id, root));
 			}
 			edgeStore.set(id, edges);
@@ -501,10 +491,10 @@ function readVoidDevCredentials(root) {
 * block the server. On completion, writes project.json and restarts the server.
 */
 async function runAiSetupPrompt(root, token, apiUrl, server) {
-	const { select, text, isCancel, log } = await import("./prompts-ZAuJlyCj.mjs");
-	const { PlatformClient } = await import("./client-BxVixJBI.mjs");
-	const { attachSelectedPlatform, writeProjectConfig } = await import("./project-BiaPQ7ur.mjs");
-	const { inferDefaultSlug } = await import("./resolve-project-DtbidV4y.mjs");
+	const { select, text, isCancel, log } = await import("./dist-Bx1z6Eva.mjs");
+	const { PlatformClient } = await import("./client-tso2OfcG.mjs");
+	const { attachSelectedPlatform, writeProjectConfig } = await import("./project-DedqCp59.mjs");
+	const { inferDefaultSlug } = await import("./resolve-project-BIeYs9Cw.mjs");
 	const client = new PlatformClient(token, apiUrl);
 	let projects;
 	try {
@@ -531,7 +521,7 @@ async function runAiSetupPrompt(root, token, apiUrl, server) {
 	let slug;
 	if (result === "__create__") {
 		const { validateProjectSlug } = await import("./project-slug-DofjTFd-.mjs");
-		const { createProjectWithSlugRetry } = await import("./create-project-Dbb4uiN-.mjs");
+		const { createProjectWithSlugRetry } = await import("./create-project-qFDC45zg.mjs");
 		let created;
 		try {
 			created = await createProjectWithSlugRetry(client, inferDefaultSlug(root), async (defaultSlug) => {
@@ -560,8 +550,8 @@ async function runAiSetupPrompt(root, token, apiUrl, server) {
 		projectId,
 		slug
 	}, client.apiUrl));
-	log.success(`Linked to ${import_picocolors.default.blue(slug)}`);
 	await server.restart();
+	printSuccess(`Linked to ${slug}.`);
 }
 //#endregion
 //#region src/plugin-binding-runtime.ts
@@ -691,6 +681,25 @@ function createClientStubsPlugin() {
 }
 //#endregion
 //#region src/plugin-dev-config.ts
+/** Run `fn` shortly after Vite prints "ready" so dev messages stay visible. */
+function afterServerReady(server, fn) {
+	if (server.httpServer) server.httpServer.once("listening", () => setTimeout(fn, 100));
+	else fn();
+}
+/**
+* Best-effort detection of `vite build` (and `vite preview`) so we can skip
+* dev-only side effects — writing the dev-trigger token and the dispatch
+* file — when no dev server will run. Vite's CLI passes the subcommand as
+* `process.argv[2]`; programmatic API users (and `vite` with no subcommand)
+* default to `dev`, which we detect as the absence of a build-shaped first
+* positional. This is intentionally permissive: when in doubt, we behave as
+* if we're in dev so first-request correctness is preserved.
+*/
+function isViteBuildOrPreview() {
+	const subcommand = process.argv[2];
+	return subcommand === "build" || subcommand === "preview";
+}
+const DEV_TRIGGER_TOKEN_FILE_MODE = 384;
 /**
 * Persist the dev-trigger token at `<root>/.void/dev-trigger-token` so
 * every voidPlugin() invocation against the same project reads the same
@@ -701,12 +710,8 @@ function createClientStubsPlugin() {
 * hint plugin would print the other, and curls would land on
 * `unauthorized`.
 *
-* The file persists across dev sessions by design — it lives under `.void/`
-* (gitignored), and `cleanupWrapper` in `void deploy` explicitly preserves
-* it across its own wipe so saved curl scripts keep working between deploys.
-* The token is local to the project and only honored by a worker bound to
-* localhost; treat it like the rest of `.void/` — disposable scratch state,
-* safe to remove manually if desired.
+* The file persists across dev sessions and deploys so saved curl scripts
+* keep working. It lives under `.void/` (gitignored) and is safe to remove.
 *
 * The file is owner-only (0600). It is the one credential the dev-inbox
 * routes accept, and loopback is reachable by every account on the host,
@@ -715,20 +720,6 @@ function createClientStubsPlugin() {
 * release is tightened in place, never rotated. Windows has no group/other
 * bits — `mode` and `chmod` only toggle write there — so it is left alone.
 */
-/**
-* Best-effort detection of `vite build` (and `vite preview`) so we can skip
-* dev-only side effects — writing the dev-trigger token and the dispatch
-* file — when no dev server will run. Vite's CLI passes the subcommand as
-* `process.argv[2]`; programmatic API users (and `vite` with no subcommand)
-* default to `dev`, which we detect as the absence of a build-shaped first
-* positional. This is intentionally permissive: when in doubt, we behave as
-* if we're in dev so first-request correctness is preserved.
-*/
-function isViteBuildOrPreview() {
-	const subcommand = process.argv[2];
-	return subcommand === "build" || subcommand === "preview";
-}
-const DEV_TRIGGER_TOKEN_FILE_MODE = 384;
 function getOrCreateDevTriggerToken(root) {
 	const tokenPath = join(root, ".void", "dev-trigger-token");
 	const readExisting = () => {
@@ -767,6 +758,48 @@ function getOrCreateDevTriggerToken(root) {
 		return fresh;
 	}
 }
+const DEV_TRIGGER_SECRET_PATH_RE = /(?:^|\/)\.void[. ]*\/(?:.*\/)?(?:dev-trigger|drizzle\.config\.json)|(?:^|\/)\.(?:nuxt|nitro)[. ]*\/(?:.*\/)?dev\/|(?:^|\/)\.astro[. ]*\/(?:.*\/)?dev\.log/;
+function isDevTriggerSecretRequest(url) {
+	if (!url) return false;
+	let path = url.split(/[?#]/, 1)[0] ?? "";
+	for (let i = 0; i < 3; i++) {
+		let decoded;
+		try {
+			decoded = decodeURIComponent(path);
+		} catch {
+			break;
+		}
+		if (decoded === path) break;
+		path = decoded;
+	}
+	return DEV_TRIGGER_SECRET_PATH_RE.test(path.replaceAll("\\", "/").toLowerCase());
+}
+/**
+* Vite serves every root file that `server.fs.deny` does not list, and its default
+* CORS lets any localhost origin read the reply, so the files above would hand their
+* secrets to `--host` peers, other local accounts and other local dev servers.
+* `server.fs.deny` is not used: a plugin's list replaces Vite's defaults, and the
+* Cloudflare worker environment applies the same check when it imports
+* `.void/dev-triggers.ts`. The middleware is added in configureServer, so it runs
+* before Vite's transform, /@fs/ and static middlewares.
+*/
+function devTriggerSecretGuardPlugin() {
+	return {
+		name: "void:dev-trigger-secret-guard",
+		apply: "serve",
+		enforce: "pre",
+		configureServer(server) {
+			server.middlewares.use((req, res, next) => {
+				if (!isDevTriggerSecretRequest(req.url)) {
+					next();
+					return;
+				}
+				res.statusCode = 404;
+				res.end("Not Found");
+			});
+		}
+	};
+}
 /**
 * Warn when the project's `package.json` does not declare `"type": "module"`.
 *
@@ -809,11 +842,7 @@ function devTriggersHintPlugin(root, options) {
 			const jobs = scanJobsSync(root, paths.cronsDir);
 			const queues = scanQueuesSync(root, paths.queuesDir);
 			if (jobs.length === 0 && queues.length === 0) return;
-			const afterReady = (fn) => {
-				if (server.httpServer) server.httpServer.once("listening", () => setTimeout(fn, 100));
-				else fn();
-			};
-			afterReady(() => {
+			afterServerReady(server, () => {
 				const address = server.httpServer?.address();
 				const port = typeof address === "object" && address ? address.port : null;
 				if (port == null) return;
@@ -823,8 +852,7 @@ function devTriggersHintPlugin(root, options) {
 				if (queues.length > 0) summary.push(`${queues.length} queue${queues.length === 1 ? "" : "s"}`);
 				console.log();
 				voidLog(`Detected ${summary.join(" and ")}. Trigger locally:`);
-				const configuredProxyToken = parseDotenvFile(join(root, ".env"), { expand: false }).__VOID_PROXY_TOKEN;
-				const authHeader = configuredProxyToken ? `x-void-internal: ${configuredProxyToken}` : `x-void-dev-trigger: ${devTriggerToken}`;
+				const authHeader = `x-void-dev-trigger: ${devTriggerToken}`;
 				if (jobs.length > 0) {
 					const sample = jobs[0].crons[0];
 					console.log(`         \x1b[2mcurl -X POST ${baseUrl}/__void/scheduled \\\n           -H "${authHeader}" \\\n           -d '{"cron":"${sample}","scheduledTime":'"$(date +%s000)"'}'\x1b[22m`);
@@ -1021,7 +1049,7 @@ function createPrimaryDb(d1) {
 			const migrationsDir = paths.migrationsDir;
 			if (!(existsSync(migrationsDir) && readdirSync(migrationsDir).some((f) => f.endsWith(".sql")))) {
 				if (dialect === "sqlite") {
-					const { getApplicationTables, getMiniflareDatabasePath } = await import("./runner-voIltZrY.mjs");
+					const { getApplicationTables, getMiniflareDatabasePath } = await import("./runner-9wjsSZx-.mjs");
 					if ((await getApplicationTables(getMiniflareDatabasePath(options.localD1PersistRoot ?? join(root, ".void"), options.localD1DatabaseId ?? "local")).catch(() => [])).length > 0) return;
 				}
 				voidWarn(`Schema found but no migrations in ${paths.sourceRelative("db/migrations")}/.\n         \`void db push\` syncs the schema to your local DB without creating migration files.
@@ -1039,7 +1067,6 @@ function createPrimaryDb(d1) {
 }
 //#endregion
 //#region src/plugin-email-dev-inbox.ts
-const INBOX_PREFIX = DEV_INBOX_PREFIX;
 const SECURITY_HEADERS = {
 	"Cache-Control": "no-store",
 	"X-Content-Type-Options": "nosniff",
@@ -1049,18 +1076,14 @@ const SECURITY_HEADERS = {
 };
 function emailDevInboxPlugin(options) {
 	const { devTriggerToken } = options;
-	let devMode = false;
 	let unregister;
 	/** `href` for an inbox path that keeps the browser session authorized. */
-	const inboxHref = (path) => `${INBOX_PREFIX}${path}?${DEV_INBOX_TOKEN_QUERY}=${encodeURIComponent(devTriggerToken)}`;
+	const inboxHref = (path) => `${DEV_INBOX_PREFIX}${path}?${DEV_INBOX_TOKEN_QUERY}=${encodeURIComponent(devTriggerToken)}`;
 	return {
 		name: "void:email-dev-inbox",
 		apply: "serve",
-		config() {
-			devMode = true;
-		},
 		buildStart() {
-			if (!devMode || unregister) return;
+			if (unregister) return;
 			unregister = registerEmailSink((m) => pushToDevBuffer(m));
 		},
 		buildEnd() {
@@ -1070,7 +1093,6 @@ function emailDevInboxPlugin(options) {
 			}
 		},
 		configureServer(server) {
-			if (server.config.command !== "serve") return;
 			const printInboxUrl = () => {
 				const address = server.httpServer?.address();
 				const port = typeof address === "object" && address ? address.port : null;
@@ -1078,12 +1100,7 @@ function emailDevInboxPlugin(options) {
 				voidLog(`Email inbox: http://localhost:${port}${inboxHref("")}`);
 			};
 			if (server.httpServer) server.httpServer.once("listening", () => setTimeout(printInboxUrl, 100));
-			server.middlewares.use(INBOX_PREFIX, (req, res) => {
-				if (server.config.command !== "serve") {
-					res.writeHead(404, SECURITY_HEADERS);
-					res.end();
-					return;
-				}
+			server.middlewares.use(DEV_INBOX_PREFIX, (req, res) => {
 				const url = new URL(req.url ?? "/", "http://localhost");
 				const path = url.pathname;
 				if (!isAuthorized(req.headers["x-void-dev-trigger"], url, devTriggerToken)) {
@@ -1296,168 +1313,6 @@ function renderDetailHtml(m, href) {
 </body></html>`;
 }
 //#endregion
-//#region src/plugin-env-client-fold.ts
-let cachedModule$1 = null;
-async function loadEnvPublic$1() {
-	if (cachedModule$1) return cachedModule$1;
-	const mod = await import("./runtime/env-public.mjs");
-	cachedModule$1 = mod;
-	return mod;
-}
-const SKIP_EXT$1 = /\.(?:css|s[ac]ss|less|styl|json|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|otf|eot|wasm|mp[34]|webm|md|mdx)(?:\?|$)/;
-const SCRIPT_LANG_RE$1 = /[?&]lang\.([a-z0-9]+)/i;
-function mentionsVoidEnv$1(code) {
-	return code.includes("void/env");
-}
-function extractEnvBindings$1(program) {
-	const direct = /* @__PURE__ */ new Set();
-	const namespace = /* @__PURE__ */ new Set();
-	let found = false;
-	for (const node of program.body ?? []) {
-		if (node.type !== "ImportDeclaration") continue;
-		if (node.source.value !== "void/env") continue;
-		found = true;
-		for (const spec of node.specifiers ?? []) if (spec.type === "ImportSpecifier") {
-			const importedName = spec.imported;
-			if (!isIdentifier(importedName)) continue;
-			if (importedName.name === "env") direct.add(spec.local.name);
-		} else if (spec.type === "ImportNamespaceSpecifier") namespace.add(spec.local.name);
-	}
-	if (!found || direct.size === 0 && namespace.size === 0) return null;
-	return {
-		directNames: direct,
-		namespaceNames: namespace
-	};
-}
-/**
-* Walk the AST and collect every static `env.FOO` / `env["FOO"]` (or
-* `<ns>.env.FOO`) read. Dynamic keys (`env[variable]`) are intentionally
-* ignored — the Proxy still serves them at runtime, and we can't prove
-* they'd be folded the same way Vite folds `import.meta.env.FOO`.
-*/
-function findFoldHits(program, bindings) {
-	const hits = [];
-	walk(program, { enter(node) {
-		const current = node;
-		if (!isMemberExpression(current)) return;
-		if (isIdentifier(current.object) && bindings.directNames.has(current.object.name)) {
-			pushHit(current, hits);
-			return;
-		}
-		const obj = current.object;
-		if (isMemberExpression(obj) && !obj.computed && isIdentifier(obj.object) && bindings.namespaceNames.has(obj.object.name) && isIdentifier(obj.property) && obj.property.name === "env") pushHit(current, hits);
-	} });
-	return hits;
-}
-function pushHit(node, hits) {
-	if (!node.computed && isIdentifier(node.property)) {
-		hits.push({
-			start: node.start,
-			end: node.end,
-			property: node.property.name
-		});
-		return;
-	}
-	if (node.computed && isLiteral(node.property) && typeof node.property.value === "string") {
-		hits.push({
-			start: node.start,
-			end: node.end,
-			property: node.property.value
-		});
-		return;
-	}
-}
-const CLIENT_ENV_PREFIX$1 = "VITE_";
-/**
-* Build-time constant folding for client-only `env.FOO` reads.
-*
-* Purpose: match what Vite already does for `import.meta.env.FOO` so that
-* branches like `if (env.MODE === "production") { ... }` get dead-code
-* eliminated in production client bundles. The runtime `env` Proxy on the
-* client already resolves keys via `import.meta.env`, so *semantics* don't
-* change — we just move the lookup from runtime to build time, which
-* unlocks DCE and bundler minification of guarded blocks.
-*
-* Safety properties:
-*   • Runs only when `this.environment.name === 'client'`. Server / SSR /
-*     worker builds keep the full runtime Proxy (secrets, runtime-injected
-*     vars, HMR remain live).
-*   • Only folds keys that match Void's fixed `VITE_` client prefix. A
-*     server-only key is never folded (and the env-client-guard plugin
-*     would have errored out earlier anyway).
-*   • Only folds static member access: `env.FOO` and `env["FOO"]`.
-*     Dynamic access, destructuring, and reassignment fall through to the
-*     runtime Proxy.
-*   • Only folds keys with a known build-time value (build shell or schema
-*     `.default(...)`). Unknown keys are left as-is
-*     and the Proxy handles them at runtime — no "undefined" shoved in.
-*   • Build-only (`apply: 'build'`). Dev runs through the Proxy so local
-*     `.env` edits take effect without a full rebuild.
-*/
-function envClientFoldPlugin() {
-	let loadedEnv = {};
-	const schemaDefaults = {};
-	/** The merged view the transform consults for each key. */
-	function resolveValue(key) {
-		if (key in loadedEnv) return loadedEnv[key];
-		if (key in schemaDefaults) return schemaDefaults[key];
-	}
-	function isExposedToClient(key) {
-		return key.startsWith(CLIENT_ENV_PREFIX$1);
-	}
-	return {
-		name: "void:env-client-fold",
-		apply: "build",
-		enforce: "post",
-		async configResolved(config) {
-			loadedEnv = config.env ?? {};
-			try {
-				const mod = await loadEnvPublic$1();
-				if (mod._hasRegisteredSchema()) {
-					const defaults = mod._getSchemaDefaults();
-					for (const [key, value] of Object.entries(defaults)) if (isExposedToClient(key) && !(key in loadedEnv)) schemaDefaults[key] = value;
-				}
-			} catch {}
-		},
-		async transform(code, id) {
-			if (this.environment?.name !== "client") return;
-			if (id.includes("/node_modules/")) return;
-			if (SKIP_EXT$1.test(id)) return;
-			const langMatch = SCRIPT_LANG_RE$1.exec(id);
-			const isScriptQuery = langMatch !== null && /^(?:m?[jt]sx?|cjs)$/i.test(langMatch[1]);
-			const isPlainScript = /\.(?:[mc]?[jt]sx?)(?:\?|$)/.test(id);
-			const isSfc = /\.(?:svelte|vue|astro)(?:\?|$)/.test(id);
-			if (!isScriptQuery && !isPlainScript && !isSfc) return;
-			if (!mentionsVoidEnv$1(code)) return;
-			if (Object.keys(loadedEnv).length === 0 && Object.keys(schemaDefaults).length === 0) return;
-			let parsed;
-			try {
-				parsed = parseSync(id, code);
-			} catch {
-				return;
-			}
-			const program = parsed.program;
-			const bindings = extractEnvBindings$1(program);
-			if (!bindings) return;
-			const hits = findFoldHits(program, bindings);
-			if (hits.length === 0) return;
-			let ms = null;
-			for (const hit of hits) {
-				if (!isExposedToClient(hit.property)) continue;
-				const value = resolveValue(hit.property);
-				if (value === void 0) continue;
-				if (!ms) ms = new MagicString(code);
-				ms.overwrite(hit.start, hit.end, JSON.stringify(value));
-			}
-			if (!ms) return;
-			return {
-				code: ms.toString(),
-				map: ms.generateMap({ hires: "boundary" })
-			};
-		}
-	};
-}
-//#endregion
 //#region src/plugin-env-client-guard.ts
 let cachedModule = null;
 async function loadEnvPublic() {
@@ -1469,12 +1324,22 @@ async function loadEnvPublic() {
 const SKIP_EXT = /\.(?:css|s[ac]ss|less|styl|json|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|otf|eot|wasm|mp[34]|webm|md|mdx)(?:\?|$)/;
 const SCRIPT_LANG_RE = /[?&]lang\.([a-z0-9]+)/i;
 /**
-* Quick check: does the source mention `void/env` at all? If not, skip the
-* full AST walk. Catches static imports, dynamic imports, and edge cases
-* like comments — false positives here just mean we parse a file we didn't
-* have to, never that we miss a real reference.
+* Cheap prefilter shared with the fold plugin: is this a client script
+* module that mentions `void/env`? Anything we'd want to parse is JS/TS or
+* has a script sub-resource (Vue/Svelte SFC virtual chunks include a
+* `lang.tsx` / `lang.ts` / `lang.js` query). SFC files themselves
+* (`.svelte`, `.vue`, `.astro`) are accepted because both plugins run with
+* `enforce: 'post'`, after the framework compiler has turned them into
+* plain JS. The `void/env` substring check lets most files skip the AST
+* walk; a false positive only means an unneeded parse.
 */
-function mentionsVoidEnv(code) {
+function isVoidEnvScriptCandidate(id, code) {
+	if (id.includes("/node_modules/") || SKIP_EXT.test(id)) return false;
+	const langMatch = SCRIPT_LANG_RE.exec(id);
+	const isScriptQuery = langMatch !== null && /^(?:m?[jt]sx?|cjs)$/i.test(langMatch[1]);
+	const isPlainScript = /\.(?:[mc]?[jt]sx?)(?:\?|$)/.test(id);
+	const isSfc = /\.(?:svelte|vue|astro)(?:\?|$)/.test(id);
+	if (!isScriptQuery && !isPlainScript && !isSfc) return false;
 	return code.includes("void/env");
 }
 function extractEnvBindings(program) {
@@ -1490,7 +1355,6 @@ function extractEnvBindings(program) {
 			if (!isIdentifier(importedName)) continue;
 			if (importedName.name === "env") direct.add(spec.local.name);
 		} else if (spec.type === "ImportNamespaceSpecifier") namespace.add(spec.local.name);
-		else if (spec.type === "ImportDefaultSpecifier") {}
 	}
 	if (!found || direct.size === 0 && namespace.size === 0) return null;
 	return {
@@ -1518,22 +1382,28 @@ function offsetToLineCol(index, offset) {
 	};
 }
 /**
-* Walk the AST collecting every `env.X` (or `<ns>.env.X`) read where `env`
-* is bound to the `void/env` proxy. Computed access produces a warning hit
-* with `property === null`; everything else carries the property name.
+* Visit every `env.X` (or `<ns>.env.X`) member expression where `env` is
+* bound to the `void/env` proxy.
 */
-function findHits(program, bindings) {
-	const hits = [];
+function walkEnvReads(program, bindings, visit) {
 	walk(program, { enter(node) {
 		const current = node;
 		if (!isMemberExpression(current)) return;
 		if (isIdentifier(current.object) && bindings.directNames.has(current.object.name)) {
-			recordHit(current, hits);
+			visit(current);
 			return;
 		}
 		const obj = current.object;
-		if (isMemberExpression(obj) && !obj.computed && isIdentifier(obj.object) && bindings.namespaceNames.has(obj.object.name) && isIdentifier(obj.property) && obj.property.name === "env") recordHit(current, hits);
+		if (isMemberExpression(obj) && !obj.computed && isIdentifier(obj.object) && bindings.namespaceNames.has(obj.object.name) && isIdentifier(obj.property) && obj.property.name === "env") visit(current);
 	} });
+}
+/**
+* Collect every `void/env` read. Computed access produces a warning hit
+* with `property === null`; everything else carries the property name.
+*/
+function findHits(program, bindings) {
+	const hits = [];
+	walkEnvReads(program, bindings, (node) => recordHit(node, hits));
 	return hits;
 }
 function recordHit(node, hits) {
@@ -1564,21 +1434,13 @@ function recordHit(node, hits) {
 * No-op when no `env.ts` is registered. Server / SSR / worker environments
 * are skipped — only the `client` environment is checked.
 */
-const CLIENT_ENV_PREFIX = "VITE_";
 function envClientGuardPlugin(root) {
 	return {
 		name: "void:env-client-guard",
 		enforce: "post",
 		async transform(code, id) {
 			if (this.environment?.name !== "client") return;
-			if (id.includes("/node_modules/")) return;
-			if (SKIP_EXT.test(id)) return;
-			const langMatch = SCRIPT_LANG_RE.exec(id);
-			const isScriptQuery = langMatch !== null && /^(?:m?[jt]sx?|cjs)$/i.test(langMatch[1]);
-			const isPlainScript = /\.(?:[mc]?[jt]sx?)(?:\?|$)/.test(id);
-			const isSfc = /\.(?:svelte|vue|astro)(?:\?|$)/.test(id);
-			if (!isScriptQuery && !isPlainScript && !isSfc) return;
-			if (!mentionsVoidEnv(code)) return;
+			if (!isVoidEnvScriptCandidate(id, code)) return;
 			const { _hasRegisteredSchema, _getRegisteredSchema } = await loadEnvPublic();
 			if (!_hasRegisteredSchema()) return;
 			const schema = _getRegisteredSchema();
@@ -1611,7 +1473,7 @@ function envClientGuardPlugin(root) {
 				}
 				const key = hit.property;
 				if (!(key in schema)) continue;
-				if (key.startsWith(CLIENT_ENV_PREFIX)) continue;
+				if (isClientEnvKey(key)) continue;
 				this.error({
 					message: `Server-only env "${key}" referenced from client code at ${relPath}:${line}:${column}.\nIf this should be available in the browser, rename it with the VITE_* prefix in env.ts.\nIf it must stay server-only, remove this reference and read the value via a server route or loader.`,
 					loc: {
@@ -1625,14 +1487,176 @@ function envClientGuardPlugin(root) {
 	};
 }
 //#endregion
+//#region src/plugin-env-client-fold.ts
+/**
+* Walk the AST and collect every static `env.FOO` / `env["FOO"]` (or
+* `<ns>.env.FOO`) read. Dynamic keys (`env[variable]`) are intentionally
+* ignored — the Proxy still serves them at runtime, and we can't prove
+* they'd be folded the same way Vite folds `import.meta.env.FOO`.
+*/
+function findFoldHits(program, bindings) {
+	const hits = [];
+	walkEnvReads(program, bindings, (node) => pushHit(node, hits));
+	return hits;
+}
+function pushHit(node, hits) {
+	if (!node.computed && isIdentifier(node.property)) {
+		hits.push({
+			start: node.start,
+			end: node.end,
+			property: node.property.name
+		});
+		return;
+	}
+	if (node.computed && isLiteral(node.property) && typeof node.property.value === "string") {
+		hits.push({
+			start: node.start,
+			end: node.end,
+			property: node.property.value
+		});
+		return;
+	}
+}
+/**
+* Build-time constant folding for client-only `env.FOO` reads.
+*
+* Purpose: match what Vite already does for `import.meta.env.FOO` so that
+* branches like `if (env.VITE_FLAG === "on") { ... }` get dead-code
+* eliminated in production client bundles. The runtime `env` Proxy on the
+* client already resolves keys via `import.meta.env`, so *semantics* don't
+* change — we just move the lookup from runtime to build time, which
+* unlocks DCE and bundler minification of guarded blocks.
+*
+* Safety properties:
+*   • Runs only when `this.environment.name === 'client'`. Server / SSR /
+*     worker builds keep the full runtime Proxy (secrets, runtime-injected
+*     vars, HMR remain live).
+*   • Only folds keys that match Void's fixed `VITE_` client prefix. A
+*     server-only key is never folded (and the env-client-guard plugin
+*     would have errored out earlier anyway).
+*   • Only folds static member access: `env.FOO` and `env["FOO"]`.
+*     Dynamic access, destructuring, and reassignment fall through to the
+*     runtime Proxy.
+*   • Only folds keys with a known build-time value (build shell or schema
+*     `.default(...)`). Unknown keys are left as-is
+*     and the Proxy handles them at runtime — no "undefined" shoved in.
+*   • Build-only (`apply: 'build'`). Dev runs through the Proxy so local
+*     `.env` edits take effect without a full rebuild.
+*/
+function envClientFoldPlugin() {
+	let loadedEnv = {};
+	const schemaDefaults = {};
+	/** The merged view the transform consults for each key. */
+	function resolveValue(key) {
+		if (key in loadedEnv) return loadedEnv[key];
+		if (key in schemaDefaults) return schemaDefaults[key];
+	}
+	return {
+		name: "void:env-client-fold",
+		apply: "build",
+		enforce: "post",
+		async configResolved(config) {
+			loadedEnv = config.env ?? {};
+			try {
+				const mod = await loadEnvPublic();
+				if (mod._hasRegisteredSchema()) {
+					const defaults = mod._getSchemaDefaults();
+					for (const [key, value] of Object.entries(defaults)) if (isClientEnvKey(key) && !(key in loadedEnv)) schemaDefaults[key] = value;
+				}
+			} catch {}
+		},
+		async transform(code, id) {
+			if (this.environment?.name !== "client") return;
+			if (!isVoidEnvScriptCandidate(id, code)) return;
+			if (Object.keys(loadedEnv).length === 0 && Object.keys(schemaDefaults).length === 0) return;
+			let parsed;
+			try {
+				parsed = parseSync(id, code);
+			} catch {
+				return;
+			}
+			const program = parsed.program;
+			const bindings = extractEnvBindings(program);
+			if (!bindings) return;
+			const hits = findFoldHits(program, bindings);
+			if (hits.length === 0) return;
+			let ms = null;
+			for (const hit of hits) {
+				if (!isClientEnvKey(hit.property)) continue;
+				const value = resolveValue(hit.property);
+				if (value === void 0) continue;
+				if (!ms) ms = new MagicString(code);
+				ms.overwrite(hit.start, hit.end, JSON.stringify(value));
+			}
+			if (!ms) return;
+			return {
+				code: ms.toString(),
+				map: ms.generateMap({ hires: "boundary" })
+			};
+		}
+	};
+}
+//#endregion
 //#region src/plugin-env-schema.ts
-let cachedSchemaModule = null;
-async function loadSchemaModule() {
-	if (cachedSchemaModule) return cachedSchemaModule;
-	const mod = await import("./runtime/env-public.mjs");
-	cachedSchemaModule = mod;
-	return mod;
+/**
+* Variables Vite's `loadEnv` copies from env files into `process.env` when
+* they are unset, as `[file key, process.env key]`.
+*/
+const VITE_PROCESS_ENV_COPIES = [
+	["NODE_ENV", "VITE_USER_NODE_ENV"],
+	["BROWSER", "BROWSER"],
+	["BROWSER_ARGS", "BROWSER_ARGS"]
+];
+/** The `process.env` values Vite may overwrite, read before it loads env files. */
+function readProcessEnvCopies() {
+	return Object.fromEntries(VITE_PROCESS_ENV_COPIES.map(([, target]) => [target, process.env[target]]));
+}
+/**
+* Delete the client values Vite took from `<root>/.env` during a build.
+* Keys come from Vite's own parser (`node:util` `parseEnv`), so every key
+* Vite read is covered. A key stays when the shell or the `vp run` task
+* runner supplies it: `loadEnv` with `envDir: false` returns exactly those
+* values. Nothing is stripped when Vite loads env files from another
+* `envDir` (or none), since `<root>/.env` was not the source.
+*
+* Vite also copies a few `.env` values into `process.env` (see
+* {@link VITE_PROCESS_ENV_COPIES}), where they would pass as shell values.
+* `before` holds those variables as they were before Vite loaded the file;
+* a copy Vite made is removed from `process.env` again, so this check and
+* the next config resolution in the same build (the app builder resolves
+* once per environment) see only the shell.
+*/
+function stripLocalClientEnv(root, config, before) {
+	if (config.envDir === false || realDir(config.envDir) !== realDir(root)) return;
+	const file = join(root, LOCAL_ENV_FILE);
+	if (!existsSync(file)) return;
+	const parsed = parseEnv(readFileSync(file, "utf8"));
+	const keys = new Set(Object.keys(parsed));
+	for (const [source, target] of VITE_PROCESS_ENV_COPIES) {
+		const value = parsed[source];
+		if (value === void 0) continue;
+		keys.add(target);
+		if (before && before[target] === void 0 && process.env[target] === value) delete process.env[target];
+	}
+	const prefixes = resolveEnvPrefix({ envPrefix: config.envPrefix });
+	const shell = loadEnv(config.mode, false, prefixes);
+	for (const key of keys) {
+		if (!prefixes.some((prefix) => key.startsWith(prefix))) continue;
+		const value = shell[key];
+		if (value === void 0) delete config.env[key];
+		else config.env[key] = value;
+	}
 }
+/** Match Vite's canonical paths, including Windows short names and filesystem casing. */
+function realDir(dir) {
+	try {
+		return realpathSync.native(dir);
+	} catch {
+		return resolve(dir);
+	}
+}
+/** Patterns Vite's `define` typically uses for env-shaped constants. */
+const DEFINE_ENV_PATTERN = /^(?:globalThis\.)?(?:process\.env|import\.meta\.env)\.([A-Z_][A-Z0-9_]*)$/;
 /**
 * Vite plugin that auto-discovers `env.ts` at the project root and:
 *   - imports it (registering the user's schema via `defineEnv`)
@@ -1641,24 +1665,22 @@ async function loadSchemaModule() {
 *     on missing/invalid required keys
 *   - regenerates types + re-validates when env.ts changes (HMR)
 *
-* Hard errors are reserved for `void deploy`; dev keeps moving with warnings
+* Hard errors are reserved for builds and deploys; dev keeps moving with warnings
 * so unrelated work isn't blocked by a stale local value.
 */
-/** Patterns Vite's `define` typically uses for env-shaped constants. */
-const DEFINE_ENV_PATTERN = /^(?:globalThis\.)?(?:process\.env|import\.meta\.env)\.([A-Z_][A-Z0-9_]*)$/;
-const CLIENT_ENV_PREFIXES = [CLIENT_ENV_PREFIX$2];
 function envSchemaPlugin(root, options = {}) {
 	const outDir = join(root, ".void");
 	let envFile = null;
 	let command = "serve";
+	let processEnvCopiesBefore;
 	const appliedClientDefaults = /* @__PURE__ */ new Map();
-	async function emitSchemaFacts(prefixes) {
+	async function emitSchemaFacts() {
 		if (!envFile || !options.onSchema) return;
-		const { _hasRegisteredSchema, _getRegisteredSchema } = await loadSchemaModule();
+		const { _hasRegisteredSchema, _getRegisteredSchema } = await loadEnvPublic();
 		if (!_hasRegisteredSchema()) return;
 		const schema = _getRegisteredSchema() ?? {};
 		const keys = Object.keys(schema);
-		const clientKeys = keys.filter((key) => prefixes.some((prefix) => key.startsWith(prefix)));
+		const clientKeys = keys.filter(isClientEnvKey);
 		const clientKeySet = new Set(clientKeys);
 		const serverKeys = keys.filter((key) => !clientKeySet.has(key));
 		const requiredServerKeys = [];
@@ -1673,6 +1695,12 @@ function envSchemaPlugin(root, options = {}) {
 			requiredServerKeys
 		});
 	}
+	async function assertNoReservedSchemaKeys() {
+		const { _hasRegisteredSchema, _getRegisteredSchema } = await loadEnvPublic();
+		if (!_hasRegisteredSchema()) return;
+		const reserved = findReservedEnvKeys(Object.keys(_getRegisteredSchema() ?? {}));
+		if (reserved.length > 0) throw new Error(reservedEnvKeysMessage("env.ts", reserved));
+	}
 	function regenerateTypes() {
 		if (!envFile) return;
 		mkdirSync(outDir, { recursive: true });
@@ -1689,7 +1717,7 @@ function envSchemaPlugin(root, options = {}) {
 		}
 	}
 	async function warnOnDefineOverlap(define) {
-		const { _hasRegisteredSchema, _getRegisteredSchema } = await loadSchemaModule();
+		const { _hasRegisteredSchema, _getRegisteredSchema } = await loadEnvPublic();
 		if (!_hasRegisteredSchema()) return;
 		const schema = _getRegisteredSchema();
 		if (!schema) return;
@@ -1710,7 +1738,7 @@ function envSchemaPlugin(root, options = {}) {
 	}
 	async function validateAndWarn() {
 		if (!envFile) return;
-		const { _hasRegisteredSchema, validateAllEnv } = await loadSchemaModule();
+		const { _hasRegisteredSchema, validateAllEnv } = await loadEnvPublic();
 		if (!_hasRegisteredSchema()) return;
 		const report = await validateAllEnv({
 			...loadLocalEnv(root, { onWarn: (message) => voidWarn(message) }),
@@ -1727,7 +1755,7 @@ function envSchemaPlugin(root, options = {}) {
 		const configEnv = config.env ?? {};
 		for (const [key, value] of appliedClientDefaults) if (configEnv[key] === value) delete configEnv[key];
 		appliedClientDefaults.clear();
-		const { _hasRegisteredSchema, _getRegisteredSchema, _getSchemaDefaults } = await loadSchemaModule();
+		const { _hasRegisteredSchema, _getRegisteredSchema, _getSchemaDefaults } = await loadEnvPublic();
 		if (!_hasRegisteredSchema()) return;
 		const schema = _getRegisteredSchema() ?? {};
 		const readable = {
@@ -1735,13 +1763,12 @@ function envSchemaPlugin(root, options = {}) {
 			...process.env
 		};
 		for (const key of Object.keys(schema)) {
-			if (!key.startsWith("VITE_") || configEnv[key] !== void 0) continue;
+			if (!isClientEnvKey(key) || configEnv[key] !== void 0) continue;
 			const value = readable[key];
 			if (value !== void 0) configEnv[key] = value;
 		}
 		for (const [key, value] of Object.entries(_getSchemaDefaults())) {
-			if (!key.startsWith("VITE_")) continue;
-			if (configEnv[key] !== void 0) continue;
+			if (!isClientEnvKey(key) || configEnv[key] !== void 0) continue;
 			configEnv[key] = value;
 			appliedClientDefaults.set(key, value);
 		}
@@ -1750,31 +1777,31 @@ function envSchemaPlugin(root, options = {}) {
 		name: "void:env-schema",
 		enforce: "pre",
 		async config(_config, environment) {
+			processEnvCopiesBefore = environment.command === "build" ? readProcessEnvCopies() : void 0;
 			const legacyFiles = findLegacyEnvFiles(root);
 			if (legacyFiles.length > 0) throw new Error(`void/env supports one local file: .env. Remove ${legacyFiles.join(", ")} and follow the env migration guide.`);
+			const reservedInDotenv = findReservedEnvKeys(scanWranglerDotenvKeys(join(root, LOCAL_ENV_FILE)));
+			if (reservedInDotenv.length > 0) throw new Error(reservedEnvKeysMessage(".env", reservedInDotenv));
 			envFile = findEnvFile(root);
 			if (!envFile) return;
 			regenerateTypes();
 			await importUserEnv(environment.command === "build");
-			await emitSchemaFacts(CLIENT_ENV_PREFIXES);
+			await emitSchemaFacts();
+			await assertNoReservedSchemaKeys();
 		},
 		async configResolved(config) {
 			command = config.command;
-			await emitSchemaFacts(CLIENT_ENV_PREFIXES);
-			if (command === "build") {
-				const local = loadLocalEnv(root, { onWarn: (message) => voidWarn(message) });
-				for (const [key, value] of Object.entries(local)) if (process.env[key] === void 0 && config.env[key] === value) delete config.env[key];
-			}
+			await emitSchemaFacts();
+			if (command === "build") stripLocalClientEnv(root, config, processEnvCopiesBefore);
 			await applyClientValuesToViteEnv(config);
 			if (command === "build" && envFile) {
-				const { validateAllEnv } = await loadSchemaModule();
+				const { validateAllEnv } = await loadEnvPublic();
 				const report = await validateAllEnv({
 					...config.env,
 					...process.env
 				});
-				const clientKey = (key) => key.startsWith(CLIENT_ENV_PREFIX$2);
-				const missing = report.missing.filter(clientKey);
-				const invalid = report.invalid.filter(({ key }) => clientKey(key));
+				const missing = report.missing.filter(isClientEnvKey);
+				const invalid = report.invalid.filter(({ key }) => isClientEnvKey(key));
 				if (missing.length > 0 || invalid.length > 0) {
 					const lines = ["Client env validation failed:"];
 					for (const key of missing) lines.push(`  • ${key} is required — set it in the build shell or add a schema default`);
@@ -1787,18 +1814,16 @@ function envSchemaPlugin(root, options = {}) {
 		async configureServer(server) {
 			if (!envFile) return;
 			await importUserEnv();
-			const run = () => {
+			afterServerReady(server, () => {
 				validateAndWarn();
-			};
-			if (server.httpServer) server.httpServer.once("listening", () => setTimeout(run, 100));
-			else run();
+			});
 			server.watcher.add(envFile);
 			server.watcher.on("change", async (file) => {
 				if (file === envFile) {
 					voidLog("env.ts changed — regenerating types");
 					regenerateTypes();
 					await importUserEnv();
-					await emitSchemaFacts(CLIENT_ENV_PREFIXES);
+					await emitSchemaFacts();
 					await applyClientValuesToViteEnv(server.config);
 					await validateAndWarn();
 					server.ws.send({ type: "full-reload" });
@@ -1899,12 +1924,9 @@ function __json(body, status = 200) {
   });
 }
 
-function __authorize(request, env) {
-  const internal = request.headers.get("x-void-internal");
-  const dev = request.headers.get("x-void-dev-trigger");
-  const expected = env?.__VOID_PROXY_TOKEN;
-  if (expected) return internal === expected;
-  return dev === __DEV_TRIGGER_TOKEN;
+// Dev only: production framework Workers dispatch through cli/wrapper.ts.
+function __authorize(request) {
+  return request.headers.get("x-void-dev-trigger") === __DEV_TRIGGER_TOKEN;
 }
 
 function __wrapMessage(m, decisions) {
@@ -1994,7 +2016,7 @@ export async function handleDevTrigger(request, env, ctx) {
   if (url.pathname !== "/__void/scheduled" && url.pathname !== "/__void/queue") {
     return null;
   }
-  if (!__authorize(request, env)) {
+  if (!__authorize(request)) {
     return __json({ error: "unauthorized" }, 401);
   }
   if (url.pathname === "/__void/scheduled") {
@@ -2004,6 +2026,17 @@ export async function handleDevTrigger(request, env, ctx) {
 }
 `;
 }
+/** Append any missing `lines` to the project's `.gitignore`. */
+function ensureGitignoreLines(root, lines) {
+	const gitignorePath = join(root, ".gitignore");
+	let contents = "";
+	if (existsSync(gitignorePath)) contents = readFileSync(gitignorePath, "utf-8");
+	const existing = new Set(contents.split("\n").map((line) => line.trim()));
+	const missing = lines.filter((line) => !existing.has(line));
+	if (missing.length === 0) return;
+	const sep = contents.length === 0 || contents.endsWith("\n") ? "" : "\n";
+	writeFileSync(gitignorePath, `${contents}${sep}${missing.join("\n")}\n`);
+}
 const NITRO_MIDDLEWARE_FILENAME = "__void-dev-trigger.ts";
 function nitroMiddlewareSource(dispatchPath) {
 	return `// @ts-nocheck — Auto-generated by Void in dev. Do NOT edit. Removed when the dev server stops.
@@ -2040,33 +2073,22 @@ export default async function voidDevTrigger(event) {
 }
 /**
 * Writes a tiny Nitro server middleware to the user's project so
-* \`/__void/scheduled\` and \`/__void/queue\` are intercepted inside Nitro's
-* request pipeline (where \`event.context.cloudflare?.env\` is populated).
+* `/__void/scheduled` and `/__void/queue` are intercepted inside Nitro's
+* request pipeline (where `event.context.cloudflare?.env` is populated).
 *
-* Nitro discovers middleware from \`<serverDir>/middleware/*.ts\`. Nuxt scans
-* \`server/\`, Analog scans \`src/server/\`, so the caller specifies which.
-* To keep the generated file out of git we append a \`.gitignore\` entry,
+* Nitro discovers middleware from `<serverDir>/middleware/*.ts`. Nuxt scans
+* `server/`, Analog scans `src/server/`, so the caller specifies which.
+* To keep the generated file out of git we append a `.gitignore` entry,
 * and the file is removed when the dev server stops.
 */
 function nitroDevTriggerInjectPlugin(root, options) {
 	const middlewareRelative = `${options.serverDir}/middleware/${NITRO_MIDDLEWARE_FILENAME}`;
 	const middlewarePath = join(root, middlewareRelative);
-	const gitignoreLine = middlewareRelative;
 	const dispatchPath = frameworkTriggersDispatchPath(root);
 	const ensureFile = () => {
 		mkdirSync(dirname(middlewarePath), { recursive: true });
 		writeFileSync(middlewarePath, nitroMiddlewareSource(dispatchPath));
 	};
-	const ensureGitignore = () => {
-		const gitignorePath = join(root, ".gitignore");
-		let contents = "";
-		if (existsSync(gitignorePath)) {
-			contents = readFileSync(gitignorePath, "utf-8");
-			if (contents.split("\n").some((line) => line.trim() === gitignoreLine)) return;
-		}
-		const sep = contents.length === 0 || contents.endsWith("\n") ? "" : "\n";
-		writeFileSync(gitignorePath, `${contents}${sep}${gitignoreLine}\n`);
-	};
 	const cleanup = () => {
 		rmSync(middlewarePath, { force: true });
 	};
@@ -2075,10 +2097,9 @@ function nitroDevTriggerInjectPlugin(root, options) {
 		apply: "serve",
 		configureServer(server) {
 			ensureFile();
-			ensureGitignore();
+			ensureGitignoreLines(root, [middlewareRelative]);
 			server.httpServer?.once("close", cleanup);
-			const onExit = () => cleanup();
-			process.once("exit", onExit);
+			process.once("exit", cleanup);
 		}
 	};
 }
@@ -2130,9 +2151,9 @@ export default defineEventHandler(async (event) => {
 * some routes out of Nitro), so Nitro plugins like nitro-cloudflare-dev never
 * run for it and `event.context.cloudflare` is empty there.
 *
-* Workaround: put the actual handler at \`src/server/routes/api/__void/[trigger].ts\`
-* — Nitro \*does\* run plugins for routes — and proxy \`/__void/{scheduled,queue}\`
-* to \`/api/__void/{scheduled,queue}\` from a small Vite middleware so the
+* Workaround: put the actual handlers at `src/server/routes/api/__void/{cron,queue}-trigger.ts`
+* — Nitro *does* run plugins for routes — and proxy `/__void/{scheduled,queue}`
+* to `/api/__void/{cron,queue}-trigger` from a small Vite middleware so the
 * user-facing URL stays consistent with the other frameworks.
 */
 function analogDevTriggerInjectPlugin(root) {
@@ -2147,16 +2168,6 @@ function analogDevTriggerInjectPlugin(root) {
 		mkdirSync(routeDir, { recursive: true });
 		for (const { user, path } of routePaths) writeFileSync(path, analogRouteSource(dispatchPath, user));
 	};
-	const ensureGitignore = () => {
-		const gitignorePath = join(root, ".gitignore");
-		let contents = "";
-		if (existsSync(gitignorePath)) contents = readFileSync(gitignorePath, "utf-8");
-		const existing = new Set(contents.split("\n").map((l) => l.trim()));
-		const missing = gitignoreLines.filter((l) => !existing.has(l));
-		if (missing.length === 0) return;
-		const sep = contents.length === 0 || contents.endsWith("\n") ? "" : "\n";
-		writeFileSync(gitignorePath, `${contents}${sep}${missing.join("\n")}\n`);
-	};
 	const cleanup = () => {
 		for (const { path } of routePaths) rmSync(path, { force: true });
 	};
@@ -2165,7 +2176,7 @@ function analogDevTriggerInjectPlugin(root) {
 		apply: "serve",
 		configureServer(server) {
 			ensureFiles();
-			ensureGitignore();
+			ensureGitignoreLines(root, gitignoreLines);
 			const proxy = async (req, res, next) => {
 				if (req.method !== "POST") {
 					next();
@@ -2177,6 +2188,12 @@ function analogDevTriggerInjectPlugin(root) {
 					next();
 					return;
 				}
+				const address = server.httpServer?.address();
+				if (!address || typeof address !== "object") {
+					next();
+					return;
+				}
+				const hostname = address.address === "0.0.0.0" ? "127.0.0.1" : address.address === "::" ? "localhost" : address.address.includes(":") ? `[${address.address}]` : address.address;
 				try {
 					const chunks = [];
 					for await (const chunk of req) chunks.push(chunk);
@@ -2184,8 +2201,7 @@ function analogDevTriggerInjectPlugin(root) {
 					const headers = new Headers();
 					for (const [key, value] of Object.entries(req.headers)) if (typeof value === "string") headers.set(key, value);
 					else if (Array.isArray(value)) headers.set(key, value.join(", "));
-					const host = req.headers.host ?? "localhost";
-					const upstream = await fetch(`http://${host}/api/__void/${match.file}`, {
+					const upstream = await fetch(`http://${hostname}:${address.port}/api/__void/${match.file}`, {
 						method: "POST",
 						headers,
 						body
@@ -2199,8 +2215,7 @@ function analogDevTriggerInjectPlugin(root) {
 			};
 			server.middlewares.use(proxy);
 			server.httpServer?.once("close", cleanup);
-			const onExit = () => cleanup();
-			process.once("exit", onExit);
+			process.once("exit", cleanup);
 		}
 	};
 }
@@ -2221,15 +2236,13 @@ export const onRequest = defineMiddleware(async (context, next) => {
 });
 `;
 }
-const ASTRO_GITIGNORE_LINE = "src/middleware.ts";
 /**
 * Writes a tiny Astro middleware to the user's project so
-* \`/__void/scheduled\` and \`/__void/queue\` are intercepted inside Astro's
-* request pipeline (where \`context.locals.runtime.env\` is populated by
-* \`@astrojs/cloudflare\`).
+* `/__void/scheduled` and `/__void/queue` are intercepted inside Astro's
+* request pipeline, with bindings from `cloudflare:workers`.
 *
 * Astro middleware lives at a single discoverable entry, so if the user
-* already has \`src/middleware.ts\` we don't overwrite it — instead we log a
+* already has `src/middleware.ts` we don't overwrite it — instead we log a
 * one-shot snippet they can paste into their existing middleware.
 *
 * If we wrote the file we remove it on dev-server close so the user's
@@ -2248,17 +2261,6 @@ function astroDevTriggerInjectPlugin(root) {
 		writeFileSync(middlewarePath, astroMiddlewareSource(frameworkTriggersDispatchPath(root)));
 		wroteFile = true;
 	};
-	const ensureGitignore = () => {
-		if (!wroteFile) return;
-		const gitignorePath = join(root, ".gitignore");
-		let contents = "";
-		if (existsSync(gitignorePath)) {
-			contents = readFileSync(gitignorePath, "utf-8");
-			if (contents.split("\n").some((line) => line.trim() === ASTRO_GITIGNORE_LINE)) return;
-		}
-		const sep = contents.length === 0 || contents.endsWith("\n") ? "" : "\n";
-		writeFileSync(gitignorePath, `${contents}${sep}${ASTRO_GITIGNORE_LINE}\n`);
-	};
 	const cleanup = () => {
 		if (wroteFile) rmSync(middlewarePath, { force: true });
 	};
@@ -2267,10 +2269,9 @@ function astroDevTriggerInjectPlugin(root) {
 		apply: "serve",
 		configureServer(server) {
 			ensureFile();
-			ensureGitignore();
+			if (wroteFile) ensureGitignoreLines(root, [ASTRO_MIDDLEWARE_RELATIVE]);
 			server.httpServer?.once("close", cleanup);
-			const onExit = () => cleanup();
-			process.once("exit", onExit);
+			process.once("exit", cleanup);
 		}
 	};
 }
@@ -2382,7 +2383,7 @@ function compileRouteTable(scan, routesDir, middlewareDir, jobsDir, queuesDir, s
 	lines.push("app.use(__routingRuntime.requestMiddleware);");
 	lines.push("");
 	const emitEdgeRules = !managedDispatch;
-	if (emitEdgeRules && options.redirectRules?.length) compileRoutingRulesMiddleware(lines, options.redirectRules, options.dev === true, options.nodeTarget === true);
+	if (emitEdgeRules && options.redirectRules?.length) compileRoutingRulesMiddleware(lines, options.redirectRules, options.dev === true);
 	if (emitEdgeRules && options.headerRules?.length) compileHeaderMiddleware(lines, options.headerRules);
 	if (auth) {
 		lines.push("app.use(async (c, next) => {");
@@ -2475,20 +2476,26 @@ function compileRouteTable(scan, routesDir, middlewareDir, jobsDir, queuesDir, s
 		}
 		lines.push("");
 		lines.push("export async function scheduled(controller, env, ctx) {");
+		lines.push("  const run = async (job, loadJob) => {");
+		lines.push("    try {");
+		lines.push("      const mod = await loadJob();");
+		lines.push("      if (typeof mod.default === 'function') await mod.default(controller, env, ctx);");
+		lines.push("    } catch (error) {");
+		lines.push("      console.error(`[void] Scheduled job ${job} failed for cron \"${controller.cron}\":`, error);");
+		lines.push("      return { job, error };");
+		lines.push("    }");
+		lines.push("  };");
 		lines.push("  const tasks = [];");
 		for (let i = 0; i < scan.jobs.length; i++) {
 			const job = scan.jobs[i];
 			const filePath = JSON.stringify(`${jobsDir}/${job.filePath}`);
-			lines.push(`  if (job${i}Crons.includes(controller.cron)) {`);
-			lines.push("    tasks.push((async () => {");
-			lines.push(`      const mod = await import(${filePath});`);
-			lines.push("      if (typeof mod.default === 'function') await mod.default(controller, env, ctx);");
-			lines.push("    })());");
-			lines.push("  }");
+			const label = JSON.stringify(relative(options.projectRoot, `${jobsDir}/${job.filePath}`));
+			lines.push(`  if (job${i}Crons.includes(controller.cron)) tasks.push(run(${label}, () => import(${filePath})));`);
 		}
-		lines.push("  const results = await Promise.allSettled(tasks);");
-		lines.push("  const errors = results.filter(result => result.status === \"rejected\").map(result => result.reason);");
-		lines.push("  if (errors.length) throw new AggregateError(errors, \"Scheduled jobs failed\");");
+		lines.push("  const failures = (await Promise.all(tasks)).filter(Boolean);");
+		lines.push("  if (failures.length) {");
+		lines.push("    throw new AggregateError(failures.map((failure) => failure.error), `Scheduled jobs failed: ${failures.map((failure) => failure.job).join(\", \")}`);");
+		lines.push("  }");
 		lines.push("}");
 		lines.push("");
 	} else {
@@ -2500,7 +2507,7 @@ function compileRouteTable(scan, routesDir, middlewareDir, jobsDir, queuesDir, s
 		lines.push("  const __token = c.req.header(\"x-void-internal\");");
 		lines.push("  const __expected = __getRawEnv()?.__VOID_PROXY_TOKEN;");
 		lines.push("  const __devToken = c.req.header(\"x-void-dev-trigger\");");
-		lines.push("  if (__expected ? __token !== __expected : import.meta.env.DEV ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __token !== __VOID_BUILD_KEY) {");
+		lines.push("  if (__VOID_SERVE ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __expected ? __token !== __expected : __token !== __VOID_BUILD_KEY) {");
 		lines.push("    return c.json({ error: \"unauthorized\" }, 401);");
 		lines.push("  }");
 		lines.push("  const { cron, scheduledTime } = await c.req.json();");
@@ -2556,7 +2563,7 @@ function compileRouteTable(scan, routesDir, middlewareDir, jobsDir, queuesDir, s
 		lines.push("  const __token = c.req.header(\"x-void-internal\");");
 		lines.push("  const __expected = __getRawEnv()?.__VOID_PROXY_TOKEN;");
 		lines.push("  const __devToken = c.req.header(\"x-void-dev-trigger\");");
-		lines.push("  if (__expected ? __token !== __expected : import.meta.env.DEV ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __token !== __VOID_BUILD_KEY) {");
+		lines.push("  if (__VOID_SERVE ? __devToken !== __VOID_DEV_TRIGGER_TOKEN : __expected ? __token !== __expected : __token !== __VOID_BUILD_KEY) {");
 		lines.push("    return c.json({ error: \"unauthorized\" }, 401);");
 		lines.push("  }");
 		lines.push("  const payload = await c.req.json();");
@@ -2740,6 +2747,7 @@ function compileRouteTable(scan, routesDir, middlewareDir, jobsDir, queuesDir, s
 	lines.push("function __getRawEnv() { return __rawEnvStore.getStore(); }");
 	lines.push(`export const __VOID_BUILD_KEY = ${JSON.stringify(crypto.randomUUID())};`);
 	lines.push(`export const __VOID_DEV_TRIGGER_TOKEN = ${JSON.stringify(options.devTriggerToken ?? crypto.randomUUID())};`);
+	lines.push(`const __VOID_SERVE = ${JSON.stringify(options.dev === true)};`);
 	lines.push(`export const __VOID_ISR_REVALIDATE = ${JSON.stringify(mergedRevalidate)};`);
 	lines.push(`export const __VOID_ISR_PAGES = ${JSON.stringify(isrPages)};`);
 	lines.push(`export const __VOID_ISR_PATH_REVALIDATE = ${JSON.stringify(isrPathRevalidate)};`);
@@ -2888,7 +2896,10 @@ function compilePageRoutes(lines, scan, pages, options) {
 		}
 		const renderer = page.renderMode === "island" ? "renderIslandPage" : "renderPage";
 		const assetTags = page.renderMode === "island" && pages.islandClientEntryId ? "getIslandsAssetTags" : "getPagesAssetTags";
-		const routeOptions = `{ ${serverImportPath ? "load: _pload_" + safeId + ", " : ""}${mdHeadRef ? "head: " + mdHeadRef + ", " : ""}componentId: ${JSON.stringify(page.componentId)}, render: ${renderer}, assets: ${assetTags}, headConfig: __voidHeadConfig, renderOptions: ${JSON.stringify({ renderMode: page.renderMode })} }`;
+		const routeOptions = `{ ${serverImportPath ? "load: _pload_" + safeId + ", " : ""}${mdHeadRef ? "head: " + mdHeadRef + ", " : ""}componentId: ${JSON.stringify(page.componentId)}, render: ${renderer}, assets: ${assetTags}, headConfig: __voidHeadConfig, renderOptions: ${JSON.stringify({
+			renderMode: page.renderMode,
+			...options.dev === true ? { dev: true } : {}
+		})} }`;
 		lines.push(`app.get(${JSON.stringify(page.pattern)}, __createPageGetHandler(${routeOptions}));`);
 		if (page.methods.includes("action") || page.methods.includes("actions")) lines.push(`app.on(["POST", "PUT", "PATCH", "DELETE"], ${JSON.stringify(page.pattern)}, __createPageMutationHandler({ ...${routeOptions}, namedActions: ${JSON.stringify(page.methods.includes("actions"))} }));`);
 	}
@@ -2919,26 +2930,25 @@ const serveWithAssets = __createAssetFallback(${JSON.stringify({
 	})});
 `;
 }
+function deriveEmailRuntimePath(runtimeEnvPath) {
+	return runtimeEnvPath.replace(/_?env(\.[^/]+)?$/, (_m, ext) => "email" + (ext ?? ""));
+}
 /**
 * Generate the Worker entry module code.
 * Re-exports the Hono app from the virtual module with an asset-serving
 * fallthrough: when the app returns 404, the entry tries env.ASSETS.fetch()
 * and adds proper Cache-Control headers (immutable for Vite-hashed /assets/*).
 *
-* When `hasQueues` is true, also exports a `queue()` handler that
-* serializes the native MessageBatch and dispatches it to the
-* `/__void/queue` Hono route. In local dev Miniflare delivers batches
-* natively to this export; in production the relay worker does it.
+* When `hasQueues` is true, also exports a `queue()` method that passes the
+* native MessageBatch to `__processQueue` and applies its ack/retry
+* decisions. Managed delivery uses the `/__void/queue` route instead.
 *
-* When `remotePath` is provided, wraps the fetch handler to detect
+* When `remote` is provided, wraps the fetch handler to detect
 * remote mode (`__VOID_REMOTE`) and replace local bindings with
 * proxy-backed versions.
 */
-function deriveEmailRuntimePath(runtimeEnvPath) {
-	return runtimeEnvPath.replace(/_?env(\.[^/]+)?$/, (_m, ext) => "email" + (ext ?? ""));
-}
 function compileWorkerEntry(options = {}) {
-	const { hasQueues = false, versionMetadataBinding, remote, assetsDir = "assets", webSocketClasses = [], runtimeEnvPath = "void/_env", runtimeEmailPath, envSchemaModule, sandbox, serveSpaFallback = false, hasEmail = false, live, isr, notFound = "none", durableObjects = [] } = options;
+	const { hasQueues = false, versionMetadataBinding, remote, assetsDir = "assets", webSocketClasses = [], runtimeEnvPath = "void/_env", runtimeEmailPath, envSchemaModule, sandbox, serveSpaFallback = false, hasEmail = false, live, dev = false, isr, notFound = "none", durableObjects = [] } = options;
 	const remotePath = remote?.remotePath;
 	const remoteBindingNames = JSON.stringify(remote?.bindingNames);
 	const createRemoteEnvCall = `createRemoteEnv(env${remote?.bindingNames ? `, ${remoteBindingNames}` : ""})`;
@@ -2953,8 +2963,10 @@ function compileWorkerEntry(options = {}) {
 	const liveBindingName = typeof live === "object" ? live.bindingName ?? "VOID_LIVE" : "VOID_LIVE";
 	const liveClassName = typeof live === "object" ? live.className ?? "VoidLiveStreamDurableObject" : "VoidLiveStreamDurableObject";
 	const liveRouteImport = hasLive ? ", VoidLiveStreamDurableObject" : "";
-	const liveRuntimeImport = hasLive ? `import { __setLiveBindingName } from "void/live";\n` : "";
-	const liveExport = hasLive ? liveClassName === "VoidLiveStreamDurableObject" ? `export { VoidLiveStreamDurableObject };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n` : `export { VoidLiveStreamDurableObject as ${liveClassName} };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n` : "";
+	const liveDev = hasLive && dev === true;
+	const liveRuntimeImport = hasLive ? `import { __setLiveBindingName${liveDev ? ", __setLiveDev" : ""} } from "void/live";\n` : "";
+	const liveDevCall = liveDev ? "__setLiveDev(true);\n" : "";
+	const liveExport = hasLive ? liveClassName === "VoidLiveStreamDurableObject" ? `export { VoidLiveStreamDurableObject };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n${liveDevCall}` : `export { VoidLiveStreamDurableObject as ${liveClassName} };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n${liveDevCall}` : "";
 	const durableObjectImports = durableObjects.map(({ filePath }, index) => `import __voidDurableObject${index} from ${JSON.stringify(filePath)};`).join("\n");
 	const durableObjectExports = durableObjects.map(({ bindingName, className, name }, index) => `__voidDurableObject${index}.__bind(${JSON.stringify(bindingName)}${name !== void 0 ? `, ${JSON.stringify(name)}` : ""});\nexport const ${className} = __voidDurableObject${index}.class;`).join("\n");
 	const runtimeEnvImport = `import { withRuntimeEnv } from ${JSON.stringify(runtimeEnvPath)};\n`;
@@ -3097,7 +3109,7 @@ ${entryClass}`;
 function compileNodeApp(target, honoPath, envSchemaModule) {
 	const staticImport = target === "bun" ? `import { serveStatic } from "hono/bun";` : target === "deno" ? `import { serveStatic } from "hono/deno";` : `import { serveStatic } from "@hono/node-server/serve-static";`;
 	const envSchemaImport = envSchemaModule ? `import ${JSON.stringify(envSchemaModule.importPath)};\nimport { _validateEnvOnce } from ${JSON.stringify(envSchemaModule.helperPath)};\n` : "";
-	const envMiddleware = envSchemaModule ? `app.use("*", async (c, next) => { if (c.req.method !== "POST" || c.req.path !== "/__void/prerender-paths") await _validateEnvOnce(${target === "deno" ? "Deno.env.toObject()" : "process.env"}); return next(); });\n` : "";
+	const envMiddleware = envSchemaModule ? `app.use("*", async (c, next) => { if (!(c.req.method === "POST" && c.req.path === "/__void/prerender-paths" && c.env?.__VOID_PRERENDER === "1")) await _validateEnvOnce(${target === "deno" ? "Deno.env.toObject()" : "process.env"}); return next(); });\n` : "";
 	return `${staticImport}
 import { fileURLToPath } from "node:url";
 import { Hono } from ${JSON.stringify(honoPath)};
@@ -3110,11 +3122,7 @@ assetApp.get("*", serveStatic({ root: clientRoot }));
 const assets = { fetch: (request) => assetApp.fetch(request) };
 const app = new Hono();
 ${envMiddleware}app.post("/__void/prerender-paths", async (c) => {
-  const __expected = c.env?.__VOID_PROXY_TOKEN;
-  if (__expected) {
-    const __token = c.req.header("x-void-internal");
-    if (!__token || __token !== __expected) return c.json({ error: "unauthorized" }, 401);
-  }
+  if (c.env?.__VOID_PRERENDER !== "1") return c.notFound();
   const paths = await __voidCollectPrerenderPaths(c.req.raw);
   return c.json({ paths });
 });
@@ -3144,16 +3152,17 @@ serve({ fetch: app.fetch, port }, (info) => {
   console.log("Listening on http://localhost:" + info.port);
 });`;
 }
-/**
-* Generate the server-side fetch client module for non-CF targets.
-* Same as compileWorkerClient but without cloudflare:workers dependency.
-* Calls app.fetch() directly (no HTTP round-trip) with ALS context forwarding.
-*/
+/** Generate the browser client module: re-exports the HTTP fetch, stream, and auth clients. */
 function compileBrowserClient(authClientPath, fetchPath, fetchStreamPath) {
 	return `export { fetch, FetchError } from ${JSON.stringify(fetchPath)};
 export { fetchStream, StreamError } from ${JSON.stringify(fetchStreamPath)};
 export { auth, createAuthClient } from ${JSON.stringify(authClientPath)};`;
 }
+/**
+* Generate the server-side fetch client module for non-CF targets.
+* Same as compileWorkerClient but without cloudflare:workers dependency.
+* Calls app.fetch() directly (no HTTP round-trip) with ALS context forwarding.
+*/
 function compileNodeClient(authClientPath) {
 	return `import app, { requestContext } from "virtual:void-routes";
 import { interpolateRouteParams } from ${JSON.stringify(ROUTE_URL_PATH)};
@@ -3220,7 +3229,7 @@ export async function fetch(path, options) {
 function stripOriginForProd(rules) {
 	return rules.map(({ origin: _origin, ...rest }) => rest);
 }
-function compileRoutingRulesMiddleware(lines, rules, dev, _nodeTarget) {
+function compileRoutingRulesMiddleware(lines, rules, dev) {
 	lines.push("// Routing rules: redirects + rewrites (applied before route handlers)");
 	lines.push(`const __routingRules = ${JSON.stringify(dev ? rules : stripOriginForProd(rules))};`);
 	lines.push("app.use(\"*\", __routingRuntime.routingMiddleware(__routingRules));");
@@ -3304,10 +3313,8 @@ export async function fetch(path, options) {
 * Resolve the server entry module for a Class A framework. We always wrap
 * the framework's own entry with a tiny shim that intercepts
 * `/__void/{scheduled,queue}` in dev so cron and queue handlers run with
-* the worker's full CF bindings. The interception block is gated on
-* `import.meta.env.DEV` and the dispatch module is loaded via dynamic
-* `import()` so the entire dev path (including user cron imports) is
-* dead-code-eliminated in `vite build`. Production deploys go through
+* the worker's full CF bindings. `vite build` gets a dispatch-free shim
+* (see `generateClassATriggerWrapper`). Production deploys go through
 * `cli/wrapper.ts` instead.
 */
 function getFrameworkEntry(framework, root, devTriggerToken, notFound) {
@@ -3447,18 +3454,16 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 				if (hasSqlMigrations && dialect !== "sqlite") {
 					const url = readDatabaseUrl(root);
 					if (!url) {
-						const warn = () => {
+						afterServerReady(server, () => {
 							console.log();
 							voidError(`DATABASE_URL not found in .env — skipping ${dialect === "mysql" ? "MySQL" : "PostgreSQL"} migrations.`);
-						};
-						if (server.httpServer) server.httpServer.once("listening", () => setTimeout(warn, 100));
-						else warn();
+						});
 						return;
 					}
 					const { collectMigrations } = await import("./collect-DLyFDiKW.mjs");
-					const { validateMigrations } = await import("./validate-pna7R3Pv.mjs");
+					const { validateMigrations } = await import("./validate-BJr9LfXy.mjs");
 					const allMigrations = collectMigrations(migrationsDir);
-					const appliedNames = dialect === "mysql" ? await import("./runner-mysql-CEG5JozK.mjs").then((runner) => runner.getMySqlAppliedMigrations(url)) : await import("./runner-pg-Bh4AgZdj.mjs").then((runner) => runner.getPgAppliedMigrations(url));
+					const appliedNames = dialect === "mysql" ? await import("./runner-mysql-CkFqZ6CE.mjs").then((runner) => runner.getMySqlAppliedMigrations(url)) : await import("./runner-pg-BGYRFdRp.mjs").then((runner) => runner.getPgAppliedMigrations(url));
 					const appliedSet = new Set(appliedNames);
 					const pending = allMigrations.filter((migration) => !appliedSet.has(migration.name));
 					if (pending.length > 0) try {
@@ -3466,12 +3471,12 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 					} catch (err) {
 						voidWarn(err instanceof Error ? err.message : String(err));
 					}
-					const applied = dialect === "mysql" ? await import("./runner-mysql-CEG5JozK.mjs").then((runner) => runner.runMySqlMigrations(migrationsDir, url)) : await import("./runner-pg-Bh4AgZdj.mjs").then((runner) => runner.runPgMigrations(migrationsDir, url));
+					const applied = dialect === "mysql" ? await import("./runner-mysql-CkFqZ6CE.mjs").then((runner) => runner.runMySqlMigrations(migrationsDir, url)) : await import("./runner-pg-BGYRFdRp.mjs").then((runner) => runner.runPgMigrations(migrationsDir, url));
 					if (applied.length > 0) voidLog(`Applied ${applied.length} migration(s): ${applied.join(", ")}`);
 				} else if (hasSqlMigrations) {
-					const { runMigrations, getMiniflareDatabasePath, getAppliedMigrations } = await import("./runner-voIltZrY.mjs");
+					const { runMigrations, getMiniflareDatabasePath, getAppliedMigrations } = await import("./runner-9wjsSZx-.mjs");
 					const { collectMigrations } = await import("./collect-DLyFDiKW.mjs");
-					const { validateMigrations } = await import("./validate-pna7R3Pv.mjs");
+					const { validateMigrations } = await import("./validate-BJr9LfXy.mjs");
 					const dbPath = getMiniflareDatabasePath(persistRoot, databaseId);
 					const allMigrations = collectMigrations(migrationsDir);
 					const appliedRows = await getAppliedMigrations(dbPath);
@@ -3486,7 +3491,7 @@ function migrationPlugin(root, dialect, databaseId = "local", persistRoot = join
 					if (applied.length > 0) voidLog(`Applied ${applied.length} migration(s): ${applied.join(", ")}`);
 				}
 				if (auth?.enabled) {
-					const { runLocalVoidAuthMigrations } = await import("./node-C6Q6e1Es.mjs");
+					const { runLocalVoidAuthMigrations } = await import("./node-DJicPvPj.mjs");
 					await runLocalVoidAuthMigrations(root, dialect, persistRoot, databaseId, auth.configPath);
 					voidLog("Applied Better Auth migrations");
 				}
@@ -3686,6 +3691,7 @@ function createFrameworkPlugins(input) {
 		}
 	};
 	return [
+		devTriggerSecretGuardPlugin(),
 		createCloudflareBuiltinsExternalPlugin(),
 		wranglerCompatPlugin,
 		wranglerSyncPlugin,
@@ -3886,8 +3892,7 @@ function prerenderPlugin(root, config) {
 					workerDir,
 					clientDir,
 					persistDir,
-					remoteMode,
-					projectId: process.env.VOID_DEPLOY_PROJECT_ID || void 0
+					remoteMode
 				});
 			}
 			if (result.paths.length === 0) {
@@ -3901,7 +3906,7 @@ function prerenderPlugin(root, config) {
 //#endregion
 //#region src/plugin-restart.ts
 const BINDING_HINT_RESOLVED = "\0virtual:void/binding-hint";
-const RESTARTING_HTML = `<!DOCTYPE html>
+const RESTARTING_HTML_HEAD = `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
@@ -3919,24 +3924,87 @@ const RESTARTING_HTML = `<!DOCTYPE html>
 <body>
   <div><span class="tag">[void]</span> Restarting dev server<span class="dots"><span>.</span><span>.</span><span>.</span></span></div>
   <script>
-    fetch("/__void/restart",{method:"POST"}).catch(function(){});
+    var target=`;
+const RESTARTING_HTML_MIDDLE = `;
+    var token=`;
+const RESTARTING_HTML_TAIL = `;
+    fetch("/__void/restart",{method:"POST",headers:{"x-void-restart":token}}).catch(function(){});
     setTimeout(function p(){
       fetch("/__void/ping").then(function(r){
-        if(r.ok)location.href=new URLSearchParams(location.search).get("return")||"/";
+        if(r.ok)location.href=target;
         else setTimeout(p,150);
       }).catch(function(){setTimeout(p,150)});
     },300);
   <\/script>
 </body>
 </html>`;
-const CLIENT_MODULE = `if (import.meta.hot) {
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/**
+* Returns `value` when it is a path on the dev server's own origin, else `/`.
+* The restarting page navigates to it, so a scheme (`javascript:`) or a
+* protocol-relative form (`//host`, `/\host`) must never get through.
+*/
+function sanitizeReturnPath(value) {
+	if (!value || value[0] !== "/" || value[1] === "/" || value[1] === "\\") return "/";
+	if (CONTROL_CHARS.test(value)) return "/";
+	const base = "http://void.invalid";
+	try {
+		if (new URL(value, base).origin !== base) return "/";
+	} catch {
+		return "/";
+	}
+	return value;
+}
+/**
+* `token` is the `t` query value the toast navigated with. The page sends it
+* back with its POST; `/__void/restart` checks it, not this page.
+*/
+function renderRestartingPage(returnPath, token) {
+	return RESTARTING_HTML_HEAD + safeJsonStringify(sanitizeReturnPath(returnPath)) + RESTARTING_HTML_MIDDLE + safeJsonStringify(token ?? "") + RESTARTING_HTML_TAIL;
+}
+/** Whether `presented` is this server's restart token, compared in constant time. */
+function isRestartTokenValid(presented, expected) {
+	if (typeof presented !== "string" || expected.length === 0) return false;
+	const a = Buffer.from(presented);
+	const b = Buffer.from(expected);
+	return a.byteLength === b.byteLength && timingSafeEqual(a, b);
+}
+/**
+* Whether a browser sent `req` from the dev server's own origin. Any page the
+* developer visits can POST to localhost, so cross-site callers are refused.
+* `Sec-Fetch-Site` is set by the browser and cannot be forged by a page;
+* `Origin` is the fallback for browsers that do not send it. Clients that send
+* neither (curl, scripts) are not browsers acting for another site.
+*/
+function isSameOriginRequest(req) {
+	const site = req.headers["sec-fetch-site"];
+	if (site !== void 0) return site === "same-origin";
+	const origin = req.headers.origin;
+	if (origin === void 0) return true;
+	const host = req.headers.host;
+	if (!host) return false;
+	return origin === `${req.socket?.encrypted ? "https" : "http"}://${host}`;
+}
+/** Whether a browser navigated here from the dev origin itself or from the address bar. */
+function isSameOriginNavigation(req) {
+	const site = req.headers["sec-fetch-site"];
+	return site === void 0 || site === "same-origin" || site === "none";
+}
+/**
+* The toast is the only in-app way to reach `/__void/restarting`, so it is
+* the only place that knows the restart token. Vite's default `server.cors`
+* lets only localhost origins read this module, the same exposure as the
+* HMR token in `/@vite/client`.
+*/
+const clientModule = (token) => `if (import.meta.hot) {
+  const token = ${JSON.stringify(token)};
   import.meta.hot.on("void:new-binding", (d) => {
     if (document.getElementById("void-binding-hint")) return;
     const e = document.createElement("div");
     e.id = "void-binding-hint";
     e.style.cssText = "position:fixed;top:16px;right:16px;z-index:99999;padding:12px 16px;background:rgba(26,26,46,0.95);color:#e0def4;font:13px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;border-radius:8px;border:1px solid rgba(255,255,255,0.08);box-shadow:0 8px 32px rgba(0,0,0,0.4);backdrop-filter:blur(8px);cursor:pointer;max-width:300px;transform:translateX(calc(100% + 16px));transition:transform .3s ease";
     e.innerHTML = "<strong style=\\"color:#c4a7e7\\">[void]</strong> " + d.message + " Click to restart.";
-    e.onclick = () => { location.href = "/__void/restarting?return=" + encodeURIComponent(location.pathname + location.search); };
+    e.onclick = () => { location.href = "/__void/restarting?return=" + encodeURIComponent(location.pathname + location.search) + "&t=" + encodeURIComponent(token); };
     document.body.appendChild(e);
     requestAnimationFrame(() => requestAnimationFrame(() => {
       e.style.transform = "translateX(0)";
@@ -3947,8 +4015,10 @@ const CLIENT_MODULE = `if (import.meta.hot) {
 * Vite plugin that provides controlled dev-server restart via the browser.
 *
 * Serves three endpoints:
-* - `/__void/restarting` — standalone loading page (no Vite HMR client)
-* - `/__void/restart`    — POST triggers `server.restart()` after a short delay
+* - `/__void/restarting` — standalone loading page (no Vite HMR client);
+*                          same-origin navigation only
+* - `/__void/restart`    — same-origin POST carrying this server's restart
+*                          token triggers `server.restart()` after a short delay
 * - `/__void/ping`       — health check; returns 503 on the old server instance
 *                          (after restart is triggered) and 200 on the new one
 *
@@ -3956,6 +4026,7 @@ const CLIENT_MODULE = `if (import.meta.hot) {
 * `void:new-binding` HMR events and shows a toast with a click-to-restart action.
 */
 function restartPlugin() {
+	let restartToken = "";
 	return {
 		name: "void:restart",
 		apply: "serve",
@@ -3968,11 +4039,13 @@ function restartPlugin() {
 		load: {
 			filter: { id: /^\0virtual:void\/binding-hint$/ },
 			handler() {
-				return CLIENT_MODULE;
+				return clientModule(restartToken);
 			}
 		},
 		configureServer(server) {
 			let restartPending = false;
+			const token = randomBytes(16).toString("base64url");
+			restartToken = token;
 			server.middlewares.use("/__void/ping", (_req, res) => {
 				res.writeHead(restartPending ? 503 : 200);
 				res.end();
@@ -3983,14 +4056,35 @@ function restartPlugin() {
 					res.end();
 					return;
 				}
+				if (!isSameOriginRequest(req) || !isRestartTokenValid(req.headers["x-void-restart"], token)) {
+					res.writeHead(403);
+					res.end();
+					return;
+				}
 				restartPending = true;
 				res.writeHead(200);
 				res.end();
 				setTimeout(() => server.restart(), 50);
 			});
-			server.middlewares.use("/__void/restarting", (_req, res) => {
-				res.writeHead(200, { "Content-Type": "text/html" });
-				res.end(RESTARTING_HTML);
+			server.middlewares.use("/__void/restarting", (req, res) => {
+				if (!isSameOriginNavigation(req)) {
+					res.writeHead(403, { "Content-Type": "text/plain" });
+					res.end("Restart the dev server from its own page.");
+					return;
+				}
+				let returnPath = null;
+				let presented = null;
+				try {
+					const params = new URL(req.url ?? "/", "http://void.invalid").searchParams;
+					returnPath = params.get("return");
+					presented = params.get("t");
+				} catch {}
+				res.writeHead(200, {
+					"Content-Type": "text/html",
+					"Cache-Control": "no-store",
+					"Referrer-Policy": "no-referrer"
+				});
+				res.end(renderRestartingPage(returnPath, presented));
 			});
 		}
 	};
@@ -4026,9 +4120,16 @@ const PAGE_VIRTUAL_MODULE_IDS = [
 ];
 const RESOLVE_ID_FILTER = /^(virtual:void-(routes|client-worker(?::(react|vue|svelte|solid))?|client-browser(?::(react|vue|svelte|solid))?)|void(\/client(\/(react|vue|svelte|solid))?|\/queues)?)$/;
 const LOAD_ID_FILTER = /^virtual:void-(routes|client-worker(?::(react|vue|svelte|solid))?|client-browser(?::(react|vue|svelte|solid))?)$/;
+/**
+* Vite plugin that provides file-based routing.
+* - Scans routes/ and middleware/ directories
+* - Generates virtual modules for the route table and worker entry
+* - Watches for file changes and triggers HMR
+*/
 function routingPlugin(root, options) {
 	let scan = null;
 	let routeEnvironment = "prod";
+	let previewing = false;
 	let ssr = null;
 	let authConfigPath = null;
 	const paths = readProjectPaths(root);
@@ -4264,24 +4365,48 @@ function routingPlugin(root, options) {
 			notFound: options.routing?.notFound
 		});
 	}
+	const sandboxEntry = options.hasSandbox ? {
+		bindingName: options.sandboxBindingName,
+		className: options.sandboxClassName,
+		instanceType: options.sandboxInstanceType,
+		runtimePath: sandboxRuntimePath
+	} : false;
+	function writeNodeEntries(target) {
+		writeFileIfChanged(join(outDir, "app.ts"), compileNodeApp(target, compileOptions.honoPath, getEnvSchemaModule()));
+		writeFileIfChanged(join(outDir, "index.ts"), compileNodeServer(target));
+	}
+	/** Write the Cloudflare worker entry from the completed scan. */
+	function writeWorkerEntry(isr) {
+		writeFileIfChanged(join(outDir, "entry.ts"), compileWorkerEntry({
+			versionMetadataBinding: options.getVersionMetadataBinding?.(),
+			hasQueues: scan.queues.length > 0,
+			remote,
+			assetsDir: resolvedConfig?.build.assetsDir,
+			webSocketClasses: [...(scan.websockets ?? []).map((route) => route.className), ...options.websocketTombstones ?? []],
+			runtimeEnvPath: compileOptions.runtimeEnvPath,
+			runtimeEmailPath: compileOptions.runtimeEmailPath,
+			envSchemaModule: getEnvSchemaModule(),
+			sandbox: sandboxEntry,
+			hasEmail: hasEmailHandlers(),
+			serveSpaFallback: shouldServeSpaFallback(),
+			live: options.live,
+			dev: compileOptions.dev,
+			isr,
+			notFound: currentNotFoundHandling(),
+			durableObjects: options.durableObjects
+		}));
+	}
 	const outDir = join(root, ".void");
 	mkdirSync(outDir, { recursive: true });
-	if (options.target) {
-		writeFileIfChanged(join(outDir, "app.ts"), compileNodeApp(options.target, compileOptions.honoPath, getEnvSchemaModule()));
-		writeFileIfChanged(join(outDir, "index.ts"), compileNodeServer(options.target));
-	} else writeFileIfChanged(join(outDir, "entry.ts"), compileWorkerEntry({
+	if (options.target) writeNodeEntries(options.target);
+	else writeFileIfChanged(join(outDir, "entry.ts"), compileWorkerEntry({
 		versionMetadataBinding: options.getVersionMetadataBinding?.(),
 		remote,
 		webSocketClasses: options.websocketTombstones,
 		runtimeEnvPath: compileOptions.runtimeEnvPath,
 		runtimeEmailPath: compileOptions.runtimeEmailPath,
 		envSchemaModule: getEnvSchemaModule(),
-		sandbox: options.hasSandbox ? {
-			bindingName: options.sandboxBindingName,
-			className: options.sandboxClassName,
-			instanceType: options.sandboxInstanceType,
-			runtimePath: sandboxRuntimePath
-		} : false,
+		sandbox: sandboxEntry,
 		live: options.live,
 		durableObjects: options.durableObjects
 	}));
@@ -4291,7 +4416,7 @@ function routingPlugin(root, options) {
 		configResolved(config) {
 			resolvedConfig = config;
 			authClientPath = resolveAuthClientPath(config);
-			compileOptions.dev = config.command === "serve";
+			compileOptions.dev = config.command === "serve" && !previewing;
 			compileOptions.assetsDir = config.build.assetsDir;
 			compileOptions.reactRefresh = config.plugins.some((plugin) => plugin.name === "vite:react-babel" || plugin.name === "vite:react-refresh" || plugin.name === "vite:react-swc");
 			const resolvedPublicDir = config.publicDir && config.publicDir.length > 0 ? config.publicDir : null;
@@ -4301,6 +4426,7 @@ function routingPlugin(root, options) {
 			}
 		},
 		config(_, env) {
+			previewing = env.isPreview === true;
 			routeEnvironment = env.command === "serve" && !env.isPreview ? "dev" : "prod";
 			compileOptions.hasLive = options.live !== void 0;
 			compileOptions.managedDispatch = !options.target && env.command === "build" && Boolean(process.env.VOID_DEPLOY_PROJECT_ID);
@@ -4345,7 +4471,7 @@ function routingPlugin(root, options) {
 				const migrationsDir = paths.migrationsDir;
 				if (existsSync(migrationsDir) || compileOptions.auth) {
 					const { collectMigrations } = await import("./collect-DLyFDiKW.mjs");
-					const { buildMigrationPlanBundle } = await import("./plan-COtUvdMA.mjs");
+					const { buildMigrationPlanBundle } = await import("./plan-CH2G51je.mjs");
 					const migrations = existsSync(migrationsDir) ? collectMigrations(migrationsDir) : [];
 					const dialect = getDatabaseDialect(readConfig(root));
 					compileOptions.migrationHandlerPath = resolveFile(dialect === "postgresql" ? "#self/runtime/migration-handler-pg" : dialect === "mysql" ? "#self/runtime/migration-handler-mysql" : "#self/runtime/migration-handler");
@@ -4354,43 +4480,19 @@ function routingPlugin(root, options) {
 					compileOptions.migrationDialect = dialect;
 				}
 			}
-			if (options.target) {
-				writeFileIfChanged(join(outDir, "app.ts"), compileNodeApp(options.target, compileOptions.honoPath, getEnvSchemaModule()));
-				writeFileIfChanged(join(outDir, "index.ts"), compileNodeServer(options.target));
-			} else {
+			if (options.target) writeNodeEntries(options.target);
+			else {
 				const buildConfig = readConfig(root);
 				const merged = collectRevalidate(buildConfig, scan.pages);
 				const configuredRevalidate = buildConfig.routing?.revalidate;
-				const emitIsr = !options.target && resolvedConfig?.command === "build" && !process.env.VOID_DEPLOY_PROJECT_ID && hasRevalidate(merged);
+				const emitIsr = resolvedConfig?.command === "build" && !process.env.VOID_DEPLOY_PROJECT_ID && hasRevalidate(merged);
 				isrRevalidate = emitIsr ? merged : void 0;
 				isrPages = emitIsr ? collectPages(scan.pages, configuredRevalidate) : void 0;
 				isrPathRevalidate = emitIsr && configuredRevalidate && typeof configuredRevalidate === "object" ? configuredRevalidate : void 0;
-				const isr = emitIsr ? {
+				writeWorkerEntry(emitIsr ? {
 					runtimePath: resolveFile("@void/isr/runtime"),
 					queryAllowlist: buildConfig.routing?.revalidateQueryAllowlist
-				} : void 0;
-				writeFileIfChanged(join(outDir, "entry.ts"), compileWorkerEntry({
-					versionMetadataBinding: options.getVersionMetadataBinding?.(),
-					hasQueues: scan.queues.length > 0,
-					remote,
-					assetsDir: resolvedConfig?.build.assetsDir,
-					webSocketClasses: [...(scan.websockets ?? []).map((route) => route.className), ...options.websocketTombstones ?? []],
-					runtimeEnvPath: compileOptions.runtimeEnvPath,
-					runtimeEmailPath: compileOptions.runtimeEmailPath,
-					envSchemaModule: getEnvSchemaModule(),
-					sandbox: options.hasSandbox ? {
-						bindingName: options.sandboxBindingName,
-						className: options.sandboxClassName,
-						instanceType: options.sandboxInstanceType,
-						runtimePath: sandboxRuntimePath
-					} : false,
-					hasEmail: hasEmailHandlers(),
-					serveSpaFallback: shouldServeSpaFallback(),
-					live: options.live,
-					isr,
-					notFound: currentNotFoundHandling(),
-					durableObjects: options.durableObjects
-				}));
+				} : void 0);
 			}
 		},
 		resolveId: {
@@ -4414,6 +4516,7 @@ function routingPlugin(root, options) {
 					return compileWorkerClient(getClientAuthPath(id));
 				}
 				if (id !== VIRTUAL_ROUTES_ID) return;
+				if (this?.environment?.name === "client") throw new Error(`${VIRTUAL_ROUTES_ID} is server-only and cannot be loaded by client code.`);
 				if (!scan) await rescan();
 				return compileRouteTable(scan, routesDir, middlewareDir, jobsDir, queuesDir, ssr, compileOptions, getPagesCompileOptions(), isrRevalidate, isrPages, isrPathRevalidate);
 			}
@@ -4423,7 +4526,7 @@ function routingPlugin(root, options) {
 			const handleFileChange = async (path, event) => {
 				const normalizedPath = normalizePath(path);
 				const sourceConventionChanged = isInDirectory(normalizedPath, normalizedRoutesDir) || isInDirectory(normalizedPath, normalizedMiddlewareDir) || isInDirectory(normalizedPath, normalizedJobsDir) || isInDirectory(normalizedPath, normalizedQueuesDir) || isInDirectory(normalizedPath, normalizedEmailDir) || isInDirectory(normalizedPath, normalizedPagesDir) || isPotentialAuthConfigPath(normalizedPath) || isPotentialEnvFilePath(normalizedPath);
-				if (!sourceConventionChanged && !isInDirectory(normalizedPath, normalizedSsrDir) && !isPotentialEnvFilePath(normalizedPath)) return;
+				if (!sourceConventionChanged && !isInDirectory(normalizedPath, normalizedSsrDir)) return;
 				if (!sourceConventionChanged && isInDirectory(normalizedPath, normalizedSsrDir) && !ssrEntryAbsPaths.has(normalizedPath)) return;
 				await rescan(true);
 				resolveAuthCompileOptions();
@@ -4434,31 +4537,8 @@ function routingPlugin(root, options) {
 				await writeAuthDatabaseFiles();
 				writeRouteTypes();
 				writeQueueTypes();
-				if (options.target) {
-					writeFileIfChanged(join(outDir, "app.ts"), compileNodeApp(options.target, compileOptions.honoPath, getEnvSchemaModule()));
-					writeFileIfChanged(join(outDir, "index.ts"), compileNodeServer(options.target));
-				} else writeFileIfChanged(join(outDir, "entry.ts"), compileWorkerEntry({
-					versionMetadataBinding: options.getVersionMetadataBinding?.(),
-					hasQueues: scan.queues.length > 0,
-					remote,
-					assetsDir: resolvedConfig?.build.assetsDir,
-					webSocketClasses: [...(scan.websockets ?? []).map((route) => route.className), ...options.websocketTombstones ?? []],
-					runtimeEnvPath: compileOptions.runtimeEnvPath,
-					runtimeEmailPath: compileOptions.runtimeEmailPath,
-					envSchemaModule: getEnvSchemaModule(),
-					sandbox: options.hasSandbox ? {
-						bindingName: options.sandboxBindingName,
-						className: options.sandboxClassName,
-						instanceType: options.sandboxInstanceType,
-						runtimePath: sandboxRuntimePath
-					} : false,
-					hasEmail: hasEmailHandlers(),
-					serveSpaFallback: shouldServeSpaFallback(),
-					live: options.live,
-					isr: void 0,
-					notFound: currentNotFoundHandling(),
-					durableObjects: options.durableObjects
-				}));
+				if (options.target) writeNodeEntries(options.target);
+				else writeWorkerEntry(void 0);
 				const structural = event !== "change";
 				const pageManifestChanged = isInDirectory(normalizedPath, normalizedPagesDir) && (structural || normalizedPath.endsWith(".md"));
 				for (const env of Object.values(devServer.environments)) {
@@ -4585,6 +4665,15 @@ function shouldInjectEmailDevInboxVar(routeEnvironment, needsEmail, assetsBindin
 }
 //#endregion
 //#region src/plugin-worker-bindings.ts
+/** Durable Object bindings already in the patch, else in the resolved config. */
+function currentDurableObjectBindings(result, resolved) {
+	return (result.durable_objects ?? resolved.durable_objects)?.bindings ?? [];
+}
+/** Migrations already in the patch, else in the resolved config. */
+function currentMigrations(result, resolved) {
+	const current = result.migrations ?? resolved.migrations;
+	return Array.isArray(current) ? current : [];
+}
 function mergeWorkerBindings(resolved, input) {
 	const { websocketRoutes, routeEnvironment, workerConfig, envSchemaFacts, authEnabled, viteCommand, bindingNames, dialect, application, bindings, directCloudflareDestination, config, devTriggerToken, queues, durableObjects, sandboxConfig, shouldEmitLive, liveConfig, root, remoteMode } = input;
 	const environmentWebsocketRoutes = websocketRoutes.filter((route) => isRouteEnabledForEnvironment(route, routeEnvironment));
@@ -4691,12 +4780,12 @@ function mergeWorkerBindings(resolved, input) {
 			class_name: route.className
 		}));
 		if (missingDurableObjectBindings.length > 0) result.durable_objects = { bindings: [...existingDurableObjectBindings, ...missingDurableObjectBindings] };
-		const currentMigrations = resolved.migrations;
-		const planned = appendSqliteClassMigration(Array.isArray(currentMigrations) ? currentMigrations : [], environmentWebsocketRoutes.map((route) => route.className), "void-ws-v1", existingDurableObjectBindings.map((binding) => binding.class_name));
+		const resolvedMigrations = resolved.migrations;
+		const planned = appendSqliteClassMigration(Array.isArray(resolvedMigrations) ? resolvedMigrations : [], environmentWebsocketRoutes.map((route) => route.className), "void-ws-v1", existingDurableObjectBindings.map((binding) => binding.class_name));
 		if (planned.added) result.migrations = planned.migrations;
 	}
 	if (durableObjects.length > 0) {
-		const existingBindings = (result.durable_objects ?? resolved.durable_objects)?.bindings ?? [];
+		const existingBindings = currentDurableObjectBindings(result, resolved);
 		for (const module of durableObjects) {
 			const conflict = existingBindings.find((binding) => binding.name === module.bindingName && binding.class_name !== module.className);
 			if (conflict) throw new Error(`durable: binding '${module.bindingName}' is already configured for class '${conflict.class_name}', but durable-objects/ requires '${module.className}'.`);
@@ -4706,8 +4795,7 @@ function mergeWorkerBindings(resolved, input) {
 			class_name: module.className
 		}));
 		if (additions.length > 0) result.durable_objects = { bindings: [...existingBindings, ...additions] };
-		const currentMigrations = result.migrations ?? resolved.migrations;
-		const existingMigrations = Array.isArray(currentMigrations) ? currentMigrations : [];
+		const existingMigrations = currentMigrations(result, resolved);
 		for (const module of durableObjects) if (existingMigrations.find((migration) => migration.tag === module.migrationTag && !migration.new_sqlite_classes?.includes(module.className))) throw new Error(`durable: migration tag '${module.migrationTag}' is already used by another Durable Object migration.`);
 		const migrationAdditions = durableObjects.filter((module) => !existingMigrations.some((migration) => migration.tag === module.migrationTag || migration.new_sqlite_classes?.includes(module.className))).map((module) => ({
 			tag: module.migrationTag,
@@ -4720,28 +4808,26 @@ function mergeWorkerBindings(resolved, input) {
 			...resolved,
 			...result
 		}, sandboxConfig);
-		const existingDurableObjectBindings = (result.durable_objects ?? resolved.durable_objects)?.bindings ?? [];
+		const existingDurableObjectBindings = currentDurableObjectBindings(result, resolved);
 		if (!existingDurableObjectBindings.some((binding) => binding.name === sandboxConfig.binding)) result.durable_objects = { bindings: [...existingDurableObjectBindings, {
 			name: sandboxConfig.binding,
 			class_name: sandboxConfig.className
 		}] };
 		result.containers = [...(result.containers ?? resolved.containers ?? []).filter((container) => container.class_name !== sandboxConfig.className), sandboxContainerConfig(sandboxConfig)];
 		resolved.containers = [];
-		const currentMigrations = result.migrations ?? resolved.migrations;
-		const existingMigrations = Array.isArray(currentMigrations) ? currentMigrations : [];
+		const existingMigrations = currentMigrations(result, resolved);
 		if (!hasSandboxSqliteMigration(existingMigrations, sandboxConfig.className)) result.migrations = [...existingMigrations, {
 			tag: SANDBOX_MIGRATION_TAG,
 			new_sqlite_classes: [sandboxConfig.className]
 		}];
 	}
 	if (shouldEmitLive() && liveConfig) {
-		const existingDurableObjectBindings = (result.durable_objects ?? resolved.durable_objects)?.bindings ?? [];
+		const existingDurableObjectBindings = currentDurableObjectBindings(result, resolved);
 		if (!existingDurableObjectBindings.some((binding) => binding.name === liveConfig.bindingName)) result.durable_objects = { bindings: [...existingDurableObjectBindings, {
 			name: liveConfig.bindingName,
 			class_name: liveConfig.className
 		}] };
-		const currentMigrations = result.migrations ?? resolved.migrations;
-		const existingMigrations = Array.isArray(currentMigrations) ? currentMigrations : [];
+		const existingMigrations = currentMigrations(result, resolved);
 		if (!hasDurableObjectSqliteMigration(existingMigrations, liveConfig.className)) result.migrations = [...existingMigrations, {
 			tag: nextDurableObjectMigrationTag(existingMigrations, LIVE_MIGRATION_TAG),
 			new_sqlite_classes: [liveConfig.className]
@@ -4801,6 +4887,8 @@ function mergeWorkerBindings(resolved, input) {
 }
 //#endregion
 //#region src/index.ts
+const scheduledPointerCleanups = /* @__PURE__ */ new Set();
+const scheduledPreviewPointerCleanups = /* @__PURE__ */ new Set();
 /**
 * Void plugin — the main entry point.
 *
@@ -4818,8 +4906,6 @@ function mergeWorkerBindings(resolved, input) {
 * that are missing. This allows `vite build && wrangler deploy` to work
 * for deploying directly to Cloudflare without the Void platform.
 */
-const scheduledPointerCleanups = /* @__PURE__ */ new Set();
-const scheduledPreviewPointerCleanups = /* @__PURE__ */ new Set();
 function voidPlugin(options) {
 	const root = process.cwd();
 	const directCloudflareDestination = readDeploymentPlatform(root) === "cloudflare";
@@ -5008,10 +5094,8 @@ function voidPlugin(options) {
 			const ignored = ["**/.void/**"];
 			if (command === "serve") {
 				const local = loadLocalEnv(root, { onWarn: (message) => voidWarn(message) });
-				const devEnv = { ...local };
-				for (const key of /* @__PURE__ */ new Set([...Object.keys(local), ...envSchemaFacts?.keys ?? []])) if (process.env[key] !== void 0) devEnv[key] = process.env[key];
-				const { sanitized: env, stripped } = stripInternalEnvKeys(devEnv);
-				if (stripped.length > 0) voidWarn(`Ignoring internal env keys from .env: ${stripped.join(", ")}. These are reserved for Void runtime use.`);
+				const env = { ...local };
+				for (const key of /* @__PURE__ */ new Set([...Object.keys(local), ...envSchemaFacts?.keys ?? []])) if (process.env[key] !== void 0) env[key] = process.env[key];
 				workerConfig.vars = {
 					...workerConfig.vars,
 					...env
@@ -5167,6 +5251,7 @@ function voidPlugin(options) {
 			createCloudflareBuiltinsExternalPlugin(),
 			createWorkerEnvironmentSanitizerPlugin([viteEnvironment.name, ...viteEnvironment.childEnvironments ?? []]),
 			createWranglerCompatPersistPlugin(root, config),
+			devTriggerSecretGuardPlugin(),
 			restartPlugin(),
 			bindingWatchPlugin,
 			...bindings.needsEmail ? [emailDevInboxPlugin({ devTriggerToken })] : [],
@@ -5215,6 +5300,7 @@ function voidPlugin(options) {
 		if (hasInboundEmail) throw new Error(`email: inbound email handlers (email/) require target: "cloudflare". They are not available with target: '${config.target}'.`);
 		if (config.routing?.revalidate) voidWarn("\"routing.revalidate\" in void.config.ts is ignored with target: \"" + config.target + "\" (edge caching is CF-only)");
 		return [
+			devTriggerSecretGuardPlugin(),
 			restartPlugin(),
 			envPlugin,
 			serverRuntimeOptimizerPlugin,
@@ -5291,6 +5377,7 @@ function voidPlugin(options) {
 		createDefaultWorkerEnvironmentPlugin(),
 		createWorkerEnvironmentSanitizerPlugin([DEFAULT_WORKER_ENVIRONMENT_NAME]),
 		createWranglerCompatPersistPlugin(root, config),
+		devTriggerSecretGuardPlugin(),
 		restartPlugin(),
 		bindingWatchPlugin,
 		...bindings.needsEmail ? [emailDevInboxPlugin({ devTriggerToken })] : [],