void 0.26.0 → 0.27.0

package/dist/{mime-D5Nmdzf7.mjs → mime-DxCznlJq.mjs}

@@ -52,10 +52,8 @@ function rejectCRLF(field, value) {
 * `rejectCRLF` is enough for a value `encodeWord` renders (the subject, a
 * custom header value, a display name): anything outside printable ASCII
 * sends the whole value into base64, so a control never reaches the wire.
-* These three go through `quoteParam` or straight into the line, so
-* `invoice\x01.pdf` was written raw into `name="…"` and `filename="…"`,
-* captured as a success under `void dev` and by the test harness, and left
-* for the receiving MTA to refuse.
+* These three go through `quoteParam` or straight into the line, so a
+* control would reach the wire for the receiving MTA to refuse.
 *
 * RFC 5322 §3.2.4 `qtext` is printable US-ASCII less `"` and `\`; a
 * control inside a quoted-string is `obs-qtext`, which §4 says MUST NOT be
@@ -88,12 +86,9 @@ function isTokenChar(c) {
 * `type "/" subtype *(";" parameter)`.
 *
 * `rejectControls` answers only for CTLs, and `buildAttachmentPart` writes
-* the value verbatim ahead of its own `; name="…"`, so `text/plain; x="`
-* rendered `Content-Type: text/plain; x="; name="a.txt"` — captured as a
-* success under `void dev` and by the harness, while Python's `email`
-* reports `end of header inside quoted string` on that line and reads the
-* builder's `name` parameter as the VALUE of `x`. `text` (no subtype),
-* `text/plain; charset` (no value) and `text/plain;;` went the same way.
+* the value verbatim ahead of its own `; name="…"`, so an unterminated
+* quote such as `text/plain; x="` would swallow the builder's `name`
+* parameter as the value of `x`.
 *
 * The grammar is the RFC's, read as a generator: a `token` is printable
 * US-ASCII less SPACE and `tspecials`; a `value` is a `token` or a
@@ -170,10 +165,8 @@ function isAtext(c) {
 *
 * `rejectControls` answers only for CTLs, and `buildAttachmentPart` writes
 * the value verbatim — adding `<` and `>` unless the value already starts
-* with `<` — so `logo other` rendered `Content-ID: <logo other>`, `<logo`
-* rendered `Content-ID: <logo` and `logo>` rendered `Content-ID: <logo>>`:
-* captured as a success under `void dev` and by the harness, and left for
-* the receiver to refuse or to fail the `cid:` reference against.
+* with `<` — so a malformed id would reach the receiver and break the
+* `cid:` reference.
 *
 * The grammar is the RFC's, read as a generator, with two deliberate
 * differences. An `msg-id` is `"<" id-left "@" id-right ">"`, each side a
@@ -191,9 +184,7 @@ function isAtext(c) {
 *
 * Refused, then: whitespace of any kind, a second `@`, `<` or `>` anywhere
 * but as that one pair, `"`, `(`, `)`, `,`, `;`, `:`, `\`, `[`, `]`,
-* anything non-ASCII, and the empty string (which used to be validated
-* and then silently NOT rendered). Everything accepted renders exactly as
-* it did.
+* anything non-ASCII, and the empty string.
 *
 * One pass, no allocation, which is why this runs AFTER the value's length
 * bound. The message names the rule and never echoes the value.
@@ -274,12 +265,7 @@ function fieldErrorCode(field) {
 * `email-router.ts`), so there is exactly ONE address syntax in the tree:
 * an action the framework records is never dropped by the router for its
 * shape, and a test harness never captures as a success what the managed
-* deployment would lose. The hand-written predecessor grew one character
-* per review round — the exactly-one-`@` rule, then every C0 control and
-* DEL, then `:`, then a parity test against the router's own regex, which
-* had drifted on the dot in the domain — and still admitted `a..b@x.com`,
-* `.a@x.com` and `a@x..com`, which no dot-atom allows and every MTA
-* refuses. One maintained rule on both sides ends that series.
+* deployment would lose.
 *
 * What it enforces: at most 254 characters in total; an ASCII dot-atom
 * local part of at most 64 characters (RFC 5322 §3.2.3 `atext`, dots only
@@ -315,9 +301,7 @@ function validateAddressParts(field, email, name) {
 * `x` for any `x` (RFC 5322 §3.2.4 — `qtext` excludes `"` and `\`, so a
 * quoted-string carries either only as a quoted-pair). The parsed name is
 * the RAW text `formatAddress` will quote and escape again, so leaving the
-* pairs in place rendered `"Smith \"Bob\"" <a@x.dev>` as
-* `"Smith \\\"Bob\\\""` and the recipient saw `Smith \"Bob\"`, while the
-* object form of the same name rendered correctly. Only the quoted branch
+* pairs in place would escape them twice. Only the quoted branch
 * of `parseAddress` calls this; a backslash in an unquoted name is a
 * character like any other, as it is in the object form.
 *
@@ -328,7 +312,7 @@ function validateAddressParts(field, email, name) {
 * never bounded at all. Measured, 10 MiB of `\"` pairs peaked at 307 MB of
 * heap that way and terminated a 128 MB isolate; this shape peaks at 49 MB.
 * Same discipline as `to7bitBody`: one counting pass, a buffer of exactly
-* the output size, one fill, and the 32K-chunk conversion `base64` uses.
+* the output size, one fill, and one chunked `codeUnitsToString`.
 * The common case — no backslash at all — is one scan and no allocation.
 * The regex that admits the text guarantees every backslash is followed by
 * a character, so the fill never reads past the end.
@@ -348,16 +332,13 @@ function unquotePairs(text) {
 		if (c === 92) c = text.charCodeAt(++i);
 		out[n++] = c;
 	}
-	let s = "";
-	const chunk = 32768;
-	for (let i = 0; i < n; i += chunk) s += String.fromCharCode(...out.subarray(i, i + chunk));
-	return s;
+	return codeUnitsToString(out);
 }
 /**
 * Parse one address — a bare `email@domain` or `Display Name <email@domain>`
 * — into its parts, throwing a `MimeError` for `field` on anything else.
-* Exported so `void.json` `email.from` is validated by the same rules the
-* runtime applies to `from` at send time.
+* Exported so `void.config.ts` `email.from` is validated by the same rules
+* the runtime applies to `from` at send time.
 */
 function parseAddress(value, field) {
 	if (typeof value === "string") {
@@ -525,10 +506,9 @@ const ENCODED_WORD_PAYLOAD_BYTES = 45;
 * Text longer than one word's payload becomes several encoded-words
 * separated by a space, which `foldHeader` turns into CRLF + SPACE
 * wherever a line would otherwise overrun (RFC 2047 §6.2: whitespace
-* between adjacent encoded-words is dropped on decode either way). A
-* single unbounded word breached both §2's 75-character ceiling and —
-* for a long subject or display name — RFC 5322 §2.1.1's 998-octet hard
-* line limit, which nothing downstream repairs.
+* between adjacent encoded-words is dropped on decode either way). This
+* keeps each word under §2's 75-character ceiling and a long subject or
+* display name under RFC 5322 §2.1.1's 998-octet line limit.
 */
 function encodeWord(text) {
 	if (ASCII_PRINTABLE.test(text)) return text;
@@ -561,20 +541,14 @@ function encodeWord(text) {
 * quoted-string`, and `atext` is everything printable EXCEPT these, so an
 * ASCII name containing any of them must be rendered as one quoted-string.
 * The class below lists the thirteen in the RFC's order so it can be checked
-* against the production by eye. This check has been wrong twice: it once
-* sat inside a branch that had already excluded every special, so it was
-* unreachable and a comma in a name split the address list; then the list
-* itself lacked `.`, so `Dr. Smith <a@x.dev>` went out unquoted. That is
-* `obs-phrase` (§4.1, `word *(word / "." / CFWS)`), which §4 says MUST NOT
-* be generated, and a strict receiver flags it as obsolete syntax (Python's
-* `email` parser: "period in 'phrase'"). Every conforming generator —
-* Python's `email.headerregistry.Address`, for one — emits `"Dr. Smith"`.
+* against the production by eye. `.` matters: an unquoted `Dr. Smith` is
+* `obs-phrase` (§4.1), which §4 says MUST NOT be generated.
 */
 const RFC5322_SPECIALS = /[()<>[\]:;@\\,."]/;
 function formatAddress(addr) {
 	if (!addr.name) return addr.email;
 	if (!ASCII_PRINTABLE.test(addr.name)) return `${encodeWord(addr.name)} <${addr.email}>`;
-	if (RFC5322_SPECIALS.test(addr.name)) return `"${addr.name.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}" <${addr.email}>`;
+	if (RFC5322_SPECIALS.test(addr.name)) return `"${quoteParam(addr.name)}" <${addr.email}>`;
 	return `${addr.name} <${addr.email}>`;
 }
 function formatAddressList(addrs) {
@@ -596,13 +570,10 @@ function formatAddressList(addrs) {
 * best a WSP-only fold rule allows (§3.2.2 permits folding only at WSP).
 *
 * One pass, and the only thing kept per input character is the folded
-* output itself: each finished line is one flat string in `lines`. The
-* earlier shape — tokenize the whole value into an array of slices, wrap
-* each in a `{ text, comma }` object, then grow the result with `out +=`
-* per token — held about 130 bytes of heap per token for the length of the
-* fold (a slice, an object and a cons-string node each), so a legal 3 MB
-* subject of one-letter words terminated a 128 MB isolate. That was a
-* per-TOKEN cost, invisible to any size projection: the message fit.
+* output itself: each finished line is one flat string in `lines`. Any
+* per-token allocation (a slice array, token objects, `out +=`) costs about
+* 130 bytes of heap per token, so a legal 3 MB subject of one-letter words
+* would terminate a 128 MB isolate even though the message fits.
 */
 function foldHeader(name, value) {
 	const line = `${name}: ${value}`;
@@ -713,10 +684,9 @@ const HEADER_NAME_LINE_OVERHEAD = 1;
 * fixed width — so a hit is always a header.
 *
 * One pass over the string, counting UTF-8 octets per CRLF-delimited line,
-* with NO allocation. The earlier `text.split(CRLF)` held one array slot and
-* one substring per line for the whole scan, and a legal body of millions of
-* short lines — pasted logs, say — is millions of lines. Only a CRLF pair
-* ends a line, exactly as the split did; a bare CR or LF is content.
+* with NO allocation: a `split(CRLF)` would hold one substring per line, and
+* a legal body of pasted logs is millions of lines. Only a CRLF pair ends a
+* line; a bare CR or LF is content.
 */
 function findOverlongLine(text) {
 	let index = 0;
@@ -751,28 +721,16 @@ function findOverlongLine(text) {
 * quoted-string comes from RFC 5322 §3.2.4).
 *
 * `qtext` excludes both `\\` and `"`, so each may appear only as a
-* quoted-pair. Deleting the quotes and leaving backslashes raw — what this
-* did before — is wrong in two ways: a TRAILING backslash escapes the
-* closing quote and leaves the parameter unterminated, and every embedded
-* backslash is silently eaten by a conformant parser, so a Windows path
-* `C:\\Users\\bob\\report.pdf` arrived as `C:Usersbobreport.pdf`. Measured,
-* Python's `email.policy.default` and postal-mime both report
-* `InvalidHeaderDefect: end of header inside quoted string` on the first
-* case and disagree with a naive parser on the second.
+* quoted-pair: a raw trailing backslash would escape the closing quote, and
+* a conformant parser drops every other raw backslash.
 *
 * Backslash first, then quote — the other order would double-escape.
-*
-* Note this file's own `foldHeader` already tracks quoted-pairs when
-* folding, so the emitter was contradicting the folder.
 */
 function quoteParam(value) {
 	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
 }
 function base64(bytes) {
-	let binary = "";
-	const chunk = 32768;
-	for (let i = 0; i < bytes.length; i += chunk) binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
-	return btoa(binary);
+	return btoa(codeUnitsToString(bytes));
 }
 function base64Wrapped(bytes) {
 	const encoded = base64(bytes);
@@ -829,13 +787,13 @@ function quotedPrintable(text) {
 		}
 		flush(b);
 	}
-	return bytesToAsciiString(out.subarray(0, n));
+	return codeUnitsToString(out.subarray(0, n));
 }
-/** Pure-ASCII bytes to a string, in the same 32K chunks `base64` uses. */
-function bytesToAsciiString(bytes) {
+/** One character per code unit, in 32K chunks to stay under the call-argument limit. */
+function codeUnitsToString(units) {
 	let s = "";
 	const chunk = 32768;
-	for (let i = 0; i < bytes.length; i += chunk) s += String.fromCharCode(...bytes.subarray(i, i + chunk));
+	for (let i = 0; i < units.length; i += chunk) s += String.fromCharCode(...units.subarray(i, i + chunk));
 	return s;
 }
 /**
@@ -844,13 +802,9 @@ function bytesToAsciiString(bytes) {
 * makes 998 octets the hard limit). Only LF and CRLF end a line; a bare CR
 * is a control character like any other and forces the encoding.
 *
-* One pass over the string with NO allocation. The earlier shape — strip
-* every line break with a global `replace`, test the copy, then `split` the
-* text into an array of lines — was linear in the message but held a copy
-* of the body plus one array slot and one substring per line, and a legal
-* 6 MB body of millions of two-character lines needed 64 MB for the strip
-* and another 24-40 MB for the split. Those are per-LINE costs, invisible
-* to any size projection: the message fit.
+* One pass over the string with NO allocation: a `replace`/`split` shape
+* holds a copy of the body plus one substring per line, and a legal 6 MB
+* body of millions of two-character lines needed about 100 MB that way.
 */
 function needsQuotedPrintable(text) {
 	let lineLen = 0;
@@ -895,7 +849,7 @@ function to7bitBody(text) {
 		if (c === 10 && (i === 0 || text.charCodeAt(i - 1) !== 13)) out[n++] = 13;
 		out[n++] = c;
 	}
-	return bytesToAsciiString(out);
+	return codeUnitsToString(out);
 }
 /**
 * Lower bound on the octets `text` will occupy in the rendered message, in
@@ -961,16 +915,14 @@ function makeBoundary(prefix) {
 	crypto.getRandomValues(bytes);
 	return `=_void_${prefix}_${base64(bytes).replace(/[+/=]/g, "")}`;
 }
-function wrapMultipart(type, parts, extra = {}) {
+function wrapMultipart(type, parts) {
 	const boundary = makeBoundary(type);
-	const headerEntries = [["Content-Type", `multipart/${type}; boundary="${boundary}"`]];
-	for (const [k, v] of Object.entries(extra)) headerEntries.push([k, v]);
 	return {
-		headers: headerEntries,
+		headers: [["Content-Type", `multipart/${type}; boundary="${boundary}"`]],
 		body: parts.map((p) => `--${boundary}${CRLF}${renderPart(p)}`).join(CRLF) + `${CRLF}--${boundary}--${CRLF}`
 	};
 }
-const RESERVED_HEADERS = new Set([
+const RESERVED_HEADERS = /* @__PURE__ */ new Set([
 	"from",
 	"to",
 	"cc",
@@ -985,7 +937,7 @@ const RESERVED_HEADERS = new Set([
 	"content-type",
 	"content-transfer-encoding",
 	"content-disposition"
-].map((h) => h.toLowerCase()));
+]);
 /**
 * Lower bound on the octets one header VALUE occupies once `encodeWord` (or
 * `formatAddress`, for a display name) and `foldHeader` have rendered it, in
@@ -1132,10 +1084,8 @@ const CUSTOM_HEADER_FRAMING_OCTETS = 4;
 *   empty values the names and the `: ` CRLF around each are the entire
 *   size, and the framing is exact once the name is counted (see
 *   `CUSTOM_HEADER_FRAMING_OCTETS`), so charging both cannot reject a
-*   message that fits. Measured before the name was charged, 60k empty
-*   headers with 500-character names — a 30 MB message — projected to
-*   zero, rendered in full and peaked at 121 MB of a 128 MB isolate; 100k
-*   of them (50 MB) went to 169 MB.
+*   message that fits. Uncharged, 60k empty headers with 500-character
+*   names (a 30 MB message) would project to zero.
 * - An attachment part: `normalizeAttachment` bounds ONE filename at under
 *   a kilobyte, not the sum, and a message is free to carry any number of
 *   parts, so the filename and the framing every part is wrapped in are
@@ -1145,7 +1095,7 @@ const CUSTOM_HEADER_FRAMING_OCTETS = 4;
 *   `rawText` and `raw` — and terminated a 128 MB isolate before the final
 *   size check could return `MIME_ERROR`.
 *
-* The header COUNT is deliberately not bounded here. Each header now costs
+* The header COUNT is deliberately not bounded here. Each header costs
 * at least five octets (a one-character name, `: `, CRLF), so the count
 * the projection can admit is finite, and past a few hundred thousand keys
 * the caller's own object — measured at about 74 bytes per key, before

package/dist/{node-C6Q6e1Es.mjs → node-DJicPvPj.mjs}

@@ -1,10 +1,10 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig } from "./config-Br_JZD6u.mjs";
-import { r as getMiniflareDatabasePath } from "./runner--2KF6Kua.mjs";
-import { a as loadLocalEnv } from "./env-_v349JBd.mjs";
-import { r as resolveVoidAuthMigrationSchema } from "./drizzle-Beb2Am5S.mjs";
-import { n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-9vif1uj8.mjs";
+import { m as readConfig } from "./config-DiowPT80.mjs";
+import { r as getMiniflareDatabasePath } from "./runner-DMBKSrRk.mjs";
+import { o as loadLocalEnv } from "./env-BxocywBB.mjs";
+import { r as resolveVoidAuthMigrationSchema } from "./drizzle-CF84FOVM.mjs";
+import { n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-BwHgeEsD.mjs";
 //#region src/auth/node.ts
 async function runLocalVoidAuthMigrations(root, dialect, persistRoot = join(root, ".void"), databaseId = "local", configPath = findVoidAuthConfig(root)) {
 	const authConfig = await loadVoidAuthConfig(configPath);

package/dist/{operator-args-DdY54Bgb.mjs → operator-args-DOBhIaIg.mjs}

@@ -1,4 +1,4 @@
-import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-BFqpp6z0.mjs";
+import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-DbDv4vtE.mjs";
 //#region src/cli/operator-args.ts
 const operatorCommands = [
 	{
@@ -366,6 +366,15 @@ const operatorCommands = [
 		values: { cursor: "Opaque cursor returned by --plan" },
 		method: "POST"
 	},
+	{
+		group: "system",
+		action: "rotate-proxy-tokens",
+		description: "Rotate project proxy tokens on tenant Workers",
+		path: "/system/rotate-proxy-tokens",
+		values: { project: "Project ID" },
+		booleans: ["all"],
+		method: "POST"
+	},
 	{
 		group: "email",
 		action: "policy",

package/dist/{operator-auth-2dsGlTT5.mjs → operator-auth-BEZ_u0Cz.mjs}

@@ -1,5 +1,5 @@
-import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, r as findPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-P387v42A.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BFqpp6z0.mjs";
+import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, r as findPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-Cjv2Qf0r.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-DbDv4vtE.mjs";
 /** Operator authority never comes from repository-controlled metadata. */
 function resolveOperatorOrigin(connection = "") {
 	if (connection) {

package/dist/{operator-client-BFqpp6z0.mjs → operator-client-DbDv4vtE.mjs}

@@ -1,6 +1,6 @@
-import { c as normalizePlatformApiUrl } from "./platform-registry-P387v42A.mjs";
+import { c as normalizePlatformApiUrl } from "./platform-registry-Cjv2Qf0r.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-YTlqvAsk.mjs";
+import { t as ensureCloudflaredToken } from "./cf-access-BcIBSKqG.mjs";
 const OPERATOR_MAX_TIMEOUT_MS = 36e5;
 var OperatorClientError = class extends Error {
 	code;

package/dist/{operator-cmd-CUGHXrQf.mjs → operator-cmd-BT4hgavL.mjs}

@@ -1,5 +1,6 @@
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BFqpp6z0.mjs";
-import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-2dsGlTT5.mjs";
+import { d as printSuccess, f as sanitizeTerminalText } from "./output-C50ag2r3.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-DbDv4vtE.mjs";
+import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-BEZ_u0Cz.mjs";
 import { createHash } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
@@ -8,8 +9,8 @@ const MAX_RUNTIME_FOLLOW_ROWS = 1e4;
 const BUILD_LOG_DRAIN_TIMEOUT_MS = 12e4;
 function printable(value) {
 	if (value === null || value === void 0) return "—";
-	if (typeof value === "string") return value.replace(/[\u0000-\u001f\u007f]/g, " ");
-	if (typeof value === "object") return JSON.stringify(value);
+	if (typeof value === "string") return sanitizeTerminalText(value);
+	if (typeof value === "object") return sanitizeTerminalText(JSON.stringify(value));
 	return String(value);
 }
 function table(rows, indent) {
@@ -73,6 +74,13 @@ function humanLines(value, indent = "") {
 function output(value, json) {
 	console.log(json ? JSON.stringify(value) : humanLines(value).join("\n"));
 }
+function outputMutation(result, args) {
+	output(result, args.json);
+	const configuration = result.configuration;
+	const project = result.project;
+	if (args.json || result.ok === false || result.partial === true || result.complete === false || result.error || result.operationStatus && result.operationStatus !== "completed" || configuration?.status && configuration.status !== "ready" && configuration.status !== "disabled" || project?.state === "reconciling" || project?.state === "error" || project?.last_error) return;
+	printSuccess(`Platform ${args.group} ${args.action} completed.`);
+}
 function outputLogs(result, json) {
 	if (json) {
 		output(result, true);
@@ -155,9 +163,9 @@ async function runAuth(origin, args) {
 	if (args.action === "login" || args.action === "token" && args.tokenStdin) {
 		if (!args.tokenStdin && !process.stdin.isTTY) throw new OperatorClientError("Browser login requires an interactive terminal. Use --token-stdin to exchange an API session.", "interactive_login_required");
 		const apiToken = args.tokenStdin ? await readOperatorApiTokenStdin() : await (async () => {
-			const { discoverPlatform } = await import("./platform-cmd-dyFUof0t.mjs");
-			const { selectPlatformLoginMethod } = await import("./login-D7meQg_3.mjs");
-			const { runPlatformLogin } = await import("./auth-B60QDbjg.mjs");
+			const { discoverPlatform } = await import("./platform-cmd-BbmJiq5O.mjs");
+			const { selectPlatformLoginMethod } = await import("./login-mx_ydhmp.mjs");
+			const { runPlatformLogin } = await import("./auth-LMJcNESe.mjs");
 			return runPlatformLogin(origin, (await selectPlatformLoginMethod(await discoverPlatform(origin), args.providerExplicit ? args.provider : void 0)).id, (url) => process.stderr.write(`Sign in at ${url}\n`));
 		})();
 		const session = await exchangeOperatorSession(origin, apiToken);
@@ -174,6 +182,7 @@ async function runAuth(origin, args) {
 				origin,
 				...identity
 			}, args.json);
+			if (!args.json) printSuccess("Signed in to platform administration.");
 		}
 		return;
 	}
@@ -194,6 +203,7 @@ async function runAuth(origin, args) {
 			ok: true,
 			...process.env.VOID_OPERATOR_TOKEN ? { message: "Operator session revoked. Unset VOID_OPERATOR_TOKEN in your shell." } : {}
 		}, args.json);
+		if (!args.json) printSuccess("Signed out of platform administration.");
 	} else {
 		const session = await client.request("/session");
 		if (args.action === "token") {
@@ -320,7 +330,10 @@ async function migrateDeploymentAssets(client, origin, args) {
 			result
 		});
 		output(result, args.json);
-		if (result.complete) return;
+		if (result.complete) {
+			if (!args.json) printSuccess("Deployment assets migrated.");
+			return;
+		}
 		const cursor = nextCursor;
 		seenCursors.add(cursor);
 		body = {
@@ -331,7 +344,7 @@ async function migrateDeploymentAssets(client, origin, args) {
 }
 async function runOperatorCommand(args) {
 	if (!args.action) {
-		const { printHelpPage } = await import("./help-Dw5f9Xrg.mjs");
+		const { printHelpPage } = await import("./help-DfQYVfGY.mjs");
 		printHelpPage(["platform", args.group]);
 		return;
 	}
@@ -370,11 +383,11 @@ async function runOperatorCommand(args) {
 			...args.group === "project" && args.action === "normalize" ? { expected: preview.changes } : {},
 			...recoveryFence
 		};
-		output(await client.request(args.path, {
+		outputMutation(await client.request(args.path, {
 			method: "POST",
 			body,
 			timeoutMs: args.timeoutMs
-		}), args.json);
+		}), args);
 	} else if (args.follow) await followOperatorLogs(client, args);
 	else {
 		const result = await client.request(args.path, { query: args.query });

package/dist/operator-cmd-CwBB-1yb.mjs

@@ -0,0 +1,2 @@
+import { a as runOperatorCommand } from "./operator-cmd-BT4hgavL.mjs";
+export { runOperatorCommand };

package/dist/{output-BvdaehtE.mjs → output-C50ag2r3.mjs}

@@ -1,8 +1,13 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
-import { B as note$1, L as log, P as isCI, nt as settings, q as spinner } from "./prompts-6OSVA7DJ.mjs";
+import { B as note$1, H as outro, L as log, P as isCI, nt as settings, q as spinner } from "./dist-D3m88sjf.mjs";
+import { stripVTControlCharacters } from "node:util";
 //#region src/cli/output.ts
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+/** Complete an action with the same spacing, checkmark, and color on every target. */
+function printSuccess(message) {
+	outro(`\n${import_picocolors.default.green(`✓ ${stripVTControlCharacters(message)}`)}`, { withGuide: false });
+}
 function formatCount(count, singular, plural = `${singular}s`) {
 	return `${count} ${count === 1 ? singular : plural}`;
 }
@@ -109,5 +114,18 @@ function ensureUtc(s) {
 	if (s.lastIndexOf("-") > 9) return s;
 	return s + "Z";
 }
+/**
+* Stack frames of an error a Worker reported, one line per frame. The log or
+* exception line already shows `Name: message`, so a leading copy of that
+* header is dropped; Workers send stacks both with and without it.
+*/
+function errorStackFrames(error) {
+	if (!error || typeof error !== "object") return [];
+	const { name, message, stack } = error;
+	if (typeof stack !== "string") return [];
+	const header = message ? `${String(name)}: ${String(message)}` : String(name);
+	const frames = stack === header ? "" : stack.startsWith(`${header}\n`) ? stack.slice(header.length + 1) : stack;
+	return frames.trimEnd() ? frames.trimEnd().split("\n") : [];
+}
 //#endregion
-export { ensureUtc as a, import_picocolors as c, sectionTitle as d, tablePrefix as f, dim as i, note as l, cliCommandName as n, formatCount as o, createSpinner as r, helpLine as s, categoryTitle as t, sanitizeTerminalText as u };
+export { ensureUtc as a, helpLine as c, printSuccess as d, sanitizeTerminalText as f, dim as i, import_picocolors as l, tablePrefix as m, cliCommandName as n, errorStackFrames as o, sectionTitle as p, createSpinner as r, formatCount as s, categoryTitle as t, note as u };

package/dist/pages/client.d.mts

@@ -1,4 +1,5 @@
-import { t as PageObject } from "../protocol-BX8t2jiw.mjs";
+import { t as interpolateRouteParams } from "../route-url-BgPja1GS.mjs";
+import { t as PageObject } from "../protocol-BPZaNqBo.mjs";
 import { n as CacheForInput, r as CacheForResult } from "../prefetch-Ce6la4EI.mjs";
 import { UsageLimitData } from "@void/edge";
 import { ActionUrl, ResolveActionBody, ResolveActionParams } from "void/routes";
@@ -33,7 +34,7 @@ type PageComponentModule = {
   default: unknown;
 };
 type PageData = PageObject;
-type VisitOptions$1 = {
+type VisitOptions = {
   method?: string;
   data?: unknown;
   preserveScroll?: boolean;
@@ -50,7 +51,7 @@ type VisitOptions$1 = {
   /** @internal Used by popstate handler to avoid writing history while traversing */
   _popstate?: boolean;
 };
-type PrefetchOptions$1 = {
+type PrefetchOptions = {
   method?: string;
   cacheFor?: CacheForInput;
 };
@@ -88,7 +89,7 @@ type PageNavigationResource = {
   fetchUrl: string;
   hash: string;
   method: string;
-  options: VisitOptions$1;
+  options: VisitOptions;
   immediate: boolean;
   shell: Promise<PageNavigationResult | undefined>;
   abort(): void;
@@ -100,17 +101,25 @@ type PageNavigationEngine = {
   initialPageData: PageData;
   initialComponent: unknown;
   initialLayouts: Array<unknown>;
-  prepareVisit(url: string, options?: VisitOptions$1): PageNavigationResource;
-  prefetch(url: string, options?: PrefetchOptions$1): Promise<unknown>;
+  prepareVisit(url: string, options?: VisitOptions): PageNavigationResource;
+  prefetch(url: string, options?: PrefetchOptions): Promise<unknown>;
   flush(url: string, method?: string): void;
   flushAll(): void;
-  setPopStateHandler(handler: (url: string, options: VisitOptions$1) => void): void;
+  setPopStateHandler(handler: (url: string, options: VisitOptions) => void): void;
   start(): void;
   /** Called after the adapter commits the initial page DOM. */
   commitInitialRender(): void;
 };
+export declare function isFile(value: unknown): boolean;
+export declare function hasFiles(data: unknown): boolean;
+export declare function objectToFormData(source: Record<string, unknown>, form?: FormData, parentKey?: string): FormData;
 export declare function createPageNavigationEngine(config: PageNavigationEngineConfig): Promise<PageNavigationEngine>;
 //#endregion
+//#region src/pages/adapter-helpers.d.ts
+export declare function getValidationErrors(body: unknown): Record<string, string> | null;
+export declare function mergeDataIntoHref(href: string, data?: Record<string, unknown>): string;
+export declare function isModifiedEvent(e: Pick<MouseEvent, "currentTarget" | "ctrlKey" | "metaKey" | "shiftKey" | "altKey" | "button">): boolean;
+//#endregion
 //#region src/pages/form-value-equality.d.ts
 export declare function isEqualFormValue(a: unknown, b: unknown): boolean;
 //#endregion
@@ -128,27 +137,6 @@ export declare function formSubmissionBlocked(form: Pick<FormModel, "pending" |
 export declare function scheduleFormRetry(error: VoidActionError | null, ready: () => void): () => void;
 //#endregion
 //#region src/pages/client.d.ts
-export type VisitOptions = {
-  method?: string;
-  data?: unknown;
-  preserveScroll?: boolean;
-  preserveState?: boolean;
-  replace?: boolean;
-  viewTransition?: boolean;
-  /** @internal Used by React Actions to avoid waiting for a commit blocked by the action itself. */
-  _resolveOnShell?: boolean;
-  /** @internal Used by popstate handler to pass saved scroll position */
-  _scrollPosition?: {
-    x: number;
-    y: number;
-  } | null;
-  /** @internal Used by popstate handler to avoid writing history while traversing */
-  _popstate?: boolean;
-};
-export type PrefetchOptions = {
-  method?: string;
-  cacheFor?: CacheForInput;
-};
 export type NavigationStateType = "idle" | "loading" | "submitting";
 export type NavigationMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 export type NavigationState = {
@@ -168,39 +156,19 @@ export type VoidRouter = {
   flush(url: string | URL, method?: string): void;
   flushAll(): void;
 };
-export type VoidRouterAdapter = {
-  createDeferred(): unknown;
-  resolveDeferred(ref: unknown, value: unknown): unknown;
-  rejectDeferred(ref: unknown, error: string): unknown;
-  isLoading(ref: unknown): boolean;
+export type VoidRouterAdapter = VoidRouterAdapter$1 & {
   applyUpdate(pageData: PageData, component: unknown, layouts: Array<unknown>, options: {
     preserveState: boolean;
   }): void | Promise<void>;
-  onDeferredUpdate?(props: Record<string, unknown>): void;
 };
-export type VoidRouterConfig = {
+export type VoidRouterConfig = Omit<PageNavigationEngineConfig, "adapter"> & {
   adapter: VoidRouterAdapter;
-  components: Record<string, () => Promise<PageComponentModule>>;
-  layoutTree: Record<string, Array<string>>;
-  routeMeta: Record<string, {
-    island?: boolean;
-  }>;
-  matchRoute(url: string): string | null;
-  staticPageData?: boolean;
-  staticPageDataFastPath?: boolean;
-  viewTransitions: boolean;
-  prefetchHoverDelay: number;
-  prefetchDefaultCacheFor: CacheForResult;
-  cacheVisitedPageData?: boolean;
   onRouteChange?(url: string): void;
   onNavigationChange?(navigation: NavigationState): void;
 };
 export declare function idleNavigationState(): NavigationState;
 export declare function createRouterFacade(router: VoidRouter, getCurrentUrl: () => string, getCurrentParams?: () => Record<string, string>): VoidRouter;
 export declare function createSsrRouter(url?: string, params?: Record<string, string>): VoidRouter;
-export declare function isFile(value: unknown): boolean;
-export declare function hasFiles(data: unknown): boolean;
-export declare function objectToFormData(source: Record<string, unknown>, form?: FormData, parentKey?: string): FormData;
 export declare const ssrProxy: VoidRouter;
 export declare function submitAction(router: VoidRouter, url: string, options: VisitOptions): Promise<ActionResult>;
 type ActionMethod = "POST" | "PUT" | "PATCH" | "DELETE";
@@ -230,4 +198,4 @@ export declare function createVoidRouter(config: VoidRouterConfig): Promise<{
 export declare function scheduleHydration(el: Element, loader: () => Promise<unknown>, props: Record<string, unknown>, strategy: string, hydrateFn: (el: Element, mod: unknown, props: Record<string, unknown>) => void | Promise<void>): void;
 export declare function initIslands(islands: Record<string, () => Promise<unknown>>, hydrateFn: (el: Element, mod: unknown, props: Record<string, unknown>) => void | Promise<void>): void;
 //#endregion
-export type { ActionErrorHandlingScope, ActionResult, FormMethod, FormModel, PageNavigationEngine, PageNavigationResource, PageNavigationResult };
+export { type ActionErrorHandlingScope, type ActionResult, type FormMethod, type FormModel, type PageNavigationEngine, type PageNavigationResource, type PageNavigationResult, type PrefetchOptions, type VisitOptions, interpolateRouteParams };