void 0.26.0 → 0.27.0

package/dist/{platform-management-Bbwf6-Dq.mjs → platform-management-CBOT4BSM.mjs}

@@ -1,2 +1,2 @@
-import { c as runInstalledPlatformCommand, d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BrF9STZp.mjs";
+import { c as runInstalledPlatformCommand, d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-CuuVDhyt.mjs";
 export { runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };

package/dist/{platform-management-BrF9STZp.mjs → platform-management-CuuVDhyt.mjs}

@@ -1,7 +1,7 @@
-import { _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-P387v42A.mjs";
-import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
-import { c as import_picocolors, l as note, r as createSpinner } from "./output-BvdaehtE.mjs";
-import { A as resolveBootstrapGitHubId, B as assertPlatformOperatorCredentialCanApplyPlan, C as purgeResourcesKeptReason, D as loadPlatformRuntime, E as runPurgeResourcesTeardown, F as formatPlatformInstallPlan, H as verifyPlatformCloudflareCredential, I as platformAdoptionIntentHash, J as hyperdriveOriginFromConnectionString, K as PlatformCloudflareClient, L as platformProvisionIntentHash, N as trackedPlatformWorkerTraffic, P as createPlatformInstallPlan, R as revalidatePlatformInstallAction, S as purgeResourcesHandlesEmailRouting, T as purgeResourcesPermissions, V as resolvePlatformCloudflareCredential, X as verifyPlatformRuntimeTokenPermissions, Y as hyperdriveOriginMatches, _ as describePurgeResourcesPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as isPurgedAccessResource, d as readPlatformProjectZeroTrustState, f as assertProjectZeroTrustAllowsUninstall, g as checkPurgeResourcesCredentials, h as assertNoPlatformProjects, k as createPlatformInstallationSecrets, m as PlatformResourceChangedError, n as resolvePlatformInstallDatabaseUrl, o as installPlatform, q as hyperdriveOriginConfigHash, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as readPlatformProjectSlugs, v as isPlatformTailWorker, w as purgeResourcesKeptResources, x as purgeResourcesAlwaysKept, y as isPurgeResourcesCandidate, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-Cfi0o6xM.mjs";
+import { _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-Cjv2Qf0r.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, l as import_picocolors, r as createSpinner, u as note } from "./output-C50ag2r3.mjs";
+import { A as resolveBootstrapGitHubId, B as assertPlatformOperatorCredentialCanApplyPlan, C as purgeResourcesKeptReason, D as loadPlatformRuntime, E as runPurgeResourcesTeardown, F as formatPlatformInstallPlan, H as verifyPlatformCloudflareCredential, I as platformAdoptionIntentHash, J as hyperdriveOriginFromConnectionString, K as PlatformCloudflareClient, L as platformProvisionIntentHash, N as trackedPlatformWorkerTraffic, P as createPlatformInstallPlan, R as revalidatePlatformInstallAction, S as purgeResourcesHandlesEmailRouting, T as purgeResourcesPermissions, V as resolvePlatformCloudflareCredential, X as verifyPlatformRuntimeTokenPermissions, Y as hyperdriveOriginMatches, _ as describePurgeResourcesPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as isPurgedAccessResource, d as readPlatformProjectZeroTrustState, f as assertProjectZeroTrustAllowsUninstall, g as checkPurgeResourcesCredentials, h as assertNoPlatformProjects, k as createPlatformInstallationSecrets, m as PlatformResourceChangedError, n as resolvePlatformInstallDatabaseUrl, o as installPlatform, q as hyperdriveOriginConfigHash, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as readPlatformProjectSlugs, v as isPlatformTailWorker, w as purgeResourcesKeptResources, x as purgeResourcesAlwaysKept, y as isPurgeResourcesCandidate, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-DzCwqhFq.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { createHash } from "node:crypto";
 //#region src/cli/platform-management.ts
@@ -227,7 +227,6 @@ async function runInstalledPlatformCommand(args) {
 				].join("\n"), "Waiting for managed Sandbox drain");
 				return;
 			}
-			log.success(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
 			log.info(result.manifest.desiredState === "disabled" ? "Application traffic remains paused. Enable the installation when you are ready." : `Platform verification passed. Traffic is enabled at ${plan.apiUrl}.`);
 			if (args.subcommand === "rollback") log.info("PostgreSQL migrations were retained; rollback changes the runtime only.");
 			if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
@@ -238,6 +237,7 @@ async function runInstalledPlatformCommand(args) {
 					console.log(`One-time administrator setup code: ${code}`);
 				}
 			}
+			printSuccess(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
 		};
 	};
 	if (args.plan) {
@@ -354,7 +354,7 @@ async function disablePlatform(client, initialManifest, planOnly, dependencies =
 		await writeLifecycleCheckpoint(client, next);
 		next = transitionInstallation(next, "disabled", (/* @__PURE__ */ new Date()).toISOString());
 		await writeLifecycleCheckpoint(client, next);
-		log.success(`${next.deployment.displayName} is disabled. Its data was not changed.`);
+		printSuccess(`${next.deployment.displayName} is disabled. Its data was not changed.`);
 	} catch (error) {
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
 		writeInstallationManifest(next);
@@ -552,7 +552,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		removePlatformConnectionForInstallation(next.id);
 		const kept = describeKeptResources(next, next.resources.filter((resource) => resource.state === "retained"), "Cloudflare resources:", "Access resources:", purgeResources && purgeResourcesHandlesEmailRouting(next));
 		if (kept.length) note(kept.join("\n"), import_picocolors.default.bold("Kept resources"));
-		log.success(`Uninstalled ${next.deployment.displayName}.`);
+		printSuccess(`Uninstalled ${next.deployment.displayName}.`);
 	} catch (error) {
 		await stopProjectZeroTrustHold().catch(() => {});
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());

package/dist/{platform-plans-config-DU-8nC2Y.mjs → platform-plans-config-CN-heS4q.mjs}

@@ -1,6 +1,7 @@
-import { A as confirm, K as select, X as text, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BFqpp6z0.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-2dsGlTT5.mjs";
+import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess } from "./output-C50ag2r3.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-DbDv4vtE.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-BEZ_u0Cz.mjs";
 import { stripVTControlCharacters } from "node:util";
 import { PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanId } from "@void/platform/plans";
 import { readFile } from "node:fs/promises";
@@ -215,7 +216,7 @@ async function apply(client, path, body, args, catalog) {
 		...result
 	};
 	if (args.json) print(completed);
-	else console.log(`Saved ${applied.action ?? "plans.sync"} ${applied.target ?? ""}. Account updates complete.`);
+	else printSuccess(`Saved ${applied.action ?? "plans.sync"} ${applied.target ?? ""}. Account updates complete.`);
 }
 async function runPlatformPlansConfig(args) {
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-recovery-DQAqAQYu.mjs → platform-recovery-CskSJgLh.mjs}

@@ -1,7 +1,7 @@
-import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-P387v42A.mjs";
+import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-Cjv2Qf0r.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { P as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-Cfi0o6xM.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-BrF9STZp.mjs";
+import { P as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-DzCwqhFq.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-CuuVDhyt.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{platform-registry-P387v42A.mjs → platform-registry-Cjv2Qf0r.mjs}

@@ -45,7 +45,11 @@ function normalizePlatformApiUrl(value) {
 	} catch {
 		throw new Error(`platform: Invalid platform URL ${JSON.stringify(value)}.`);
 	}
-	if (!(url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1")) && url.protocol !== "https:" || url.username || url.password) throw new Error("platform: Platform URLs must use HTTPS and must not contain credentials.");
+	if (!(url.protocol === "http:" && [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname)) && url.protocol !== "https:" || url.username || url.password) throw new Error("platform: Platform URLs must use HTTPS and must not contain credentials.");
 	if (url.search || url.hash) throw new Error("platform: Platform URLs must not contain query parameters or fragments.");
 	if (url.pathname !== "/" && url.pathname !== "") throw new Error("platform: Platform URLs must not contain a path.");
 	return url.origin;

package/dist/platform-setup-BBxRxmFC.mjs

@@ -0,0 +1,299 @@
+import { u as openBrowser } from "./auth-Dn2vw-SG.mjs";
+import { L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { l as import_picocolors } from "./output-C50ag2r3.mjs";
+import { execFile } from "node:child_process";
+//#region src/cli/platform-setup.ts
+/** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
+function platformPromptAnswer(value) {
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
+	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + import_picocolors.default.underline(page.title) + "\x1B]8;;\x1B\\" : page.title + ": " + import_picocolors.default.underline(page.url);
+}
+function platformSetupFieldHelp(key) {
+	const docs = (page, section, title) => platformSetupLink({
+		title,
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
+	});
+	switch (key) {
+		case "databaseUrl": return {
+			placeholder: "postgresql://user:pw@…/database",
+			description: "Provide a PostgreSQL database URL for platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
+				title: "Neon",
+				url: "https://neon.com/"
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
+		};
+		case "jwtSecret": return { description: `Create a JWT signing key for platform login tokens. Run ${import_picocolors.default.blue("openssl rand -base64 32")}. Save the key in your password manager. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: `Generate a project encryption key for app secrets. Run ${import_picocolors.default.blue("openssl rand -base64 32")} separately. Save this key for recovery. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		default: return;
+	}
+}
+function supportsSetupLinks() {
+	return !!process.stdout.isTTY && ([
+		"ghostty",
+		"iTerm.app",
+		"WezTerm",
+		"vscode",
+		"WarpTerminal"
+	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
+}
+/** Dashboard keys use permission-catalog labels, which can differ from product names. */
+function platformAccountTokenPermissions(includeAiGateway) {
+	return [
+		{
+			key: "account_settings",
+			type: "read"
+		},
+		{
+			key: "workers_scripts",
+			type: "edit"
+		},
+		{
+			key: "workers_kv_storage",
+			type: "edit"
+		},
+		{
+			key: "workers_r2",
+			type: "edit"
+		},
+		{
+			key: "d1",
+			type: "edit"
+		},
+		{
+			key: "queues",
+			type: "edit"
+		},
+		{
+			key: "account_analytics",
+			type: "read"
+		},
+		{
+			key: "workers_tail",
+			type: "read"
+		},
+		{
+			key: "query_cache",
+			type: "edit"
+		},
+		...includeAiGateway ? [{
+			key: "aig",
+			type: "edit"
+		}] : []
+	];
+}
+/**
+* Account token links cannot preselect a zone: Cloudflare documents only
+* `permissionGroupKeys` and `name`, and the form puts zone permissions in an
+* "All Domains" policy. Tell the user which dashboard choice to change.
+*/
+function specifiedDomainsInstruction(zones) {
+	return `Change the zone policy from All Domains to Specified Domains → ${zones.join(" and ")}.`;
+}
+function plansZoneCreation(plan) {
+	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+}
+function platformManagementSetupPage(plan, options = {}) {
+	const createsZone = plansZoneCreation(plan);
+	const zoneName = plan.deployment.application.zoneName;
+	const apiHostname = plan.deployment.controlPlane.apiHostname;
+	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
+		protection: !!plan.deployment.authentication.accessProtection,
+		readOnly: false
+	} : void 0);
+	const zones = [...zoneName ? [zoneName] : [], ...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`the zone for ${apiHostname}`] : []];
+	const accessLevel = access && access.readOnly ? "read" : "edit";
+	const appAccess = !!plan.deployment.appAccess;
+	const appAccessLevel = appAccess ? "edit" : accessLevel;
+	const permissions = [
+		...platformAccountTokenPermissions(true),
+		...zoneName || apiHostname || createsZone ? [
+			{
+				key: "zone",
+				type: createsZone ? "edit" : "read"
+			},
+			{
+				key: "dns",
+				type: "edit"
+			},
+			{
+				key: "workers_routes",
+				type: "edit"
+			}
+		] : [],
+		...access || appAccess ? [
+			{
+				key: "access",
+				type: appAccessLevel
+			},
+			{
+				key: "access_acct",
+				type: "read"
+			},
+			...access && access.protection ? [{
+				key: "access_service_token",
+				type: accessLevel
+			}] : []
+		] : [],
+		...zoneName && plan.deployment.application.baseDomain !== zoneName ? [{
+			key: "ssl_and_certificates",
+			type: "read"
+		}] : []
+	];
+	return {
+		title: "Cloudflare management API token",
+		linkInTitle: true,
+		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+			to: "/" + plan.account.id + "/api-tokens",
+			name: plan.deployment.displayName + " Management",
+			permissionGroupKeys: JSON.stringify(permissions)
+		}),
+		instructions: [
+			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
+			`Scope it to ${plan.account.name}.`,
+			...createsZone ? [`Keep the zone policy on All Domains so Void can create ${zoneName}.`] : zones.length ? [specifiedDomainsInstruction(zones)] : []
+		].join("\n")
+	};
+}
+function platformSetupPages(plan) {
+	const permissions = [
+		...platformAccountTokenPermissions(plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect")),
+		...plan.deployment.application.zoneName ? [{
+			key: "cache",
+			type: "purge"
+		}] : [],
+		...plan.deployment.capabilities.customDomains ? [{
+			key: "ssl_and_certificates",
+			type: "edit"
+		}] : [],
+		...plan.deployment.capabilities.email ? [
+			{
+				key: "zone",
+				type: "read"
+			},
+			{
+				key: "zone_settings",
+				type: "edit"
+			},
+			{
+				key: "email_routing_address",
+				type: "edit"
+			},
+			{
+				key: "email_routing_rule",
+				type: "edit"
+			},
+			{
+				key: "email_sending",
+				type: "edit"
+			}
+		] : []
+	];
+	const zoneName = plan.deployment.application.zoneName;
+	return {
+		runtime: {
+			title: "Cloudflare runtime token",
+			linkInTitle: true,
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/api-tokens",
+				name: plan.deployment.displayName + " Runtime",
+				permissionGroupKeys: JSON.stringify(permissions)
+			}),
+			instructions: ["Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.", ...zoneName && plansZoneCreation(plan) ? [`Keep the zone policy on All Domains so the token can purge cache on ${zoneName} after Void creates it.`] : zoneName ? [specifiedDomainsInstruction([zoneName, ...plan.deployment.capabilities.email ? ["every zone that will carry mail"] : []])] : []].join("\n")
+		},
+		github: {
+			title: "GitHub OAuth App",
+			url: "https://github.com/settings/applications/new",
+			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
+		},
+		r2: {
+			title: "R2 upload token",
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/r2/api-tokens/create",
+				type: "account"
+			}),
+			instructions: [
+				"Select Object Read & Write.",
+				"Keep Apply to all buckets in this account selected.",
+				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
+			].join("\n")
+		}
+	};
+}
+function formatPlatformSetupPlan(plan, options = {}) {
+	const writesDns = plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse");
+	return [
+		"The installation will guide you through setting up the following credentials:",
+		"",
+		...[
+			...options.managementToken ? [options.managementAccess ? `Cloudflare management API token for ${writesDns ? "DNS changes and " : ""}Access setup` : "Cloudflare management API token for DNS changes"] : [],
+			"PostgreSQL database URL",
+			"Cloudflare runtime token",
+			"R2 upload token",
+			...plan.deployment.authentication.providers.includes("github") ? ["GitHub OAuth App client ID and secret"] : [],
+			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
+			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
+			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
+			"JWT signing key and project encryption key"
+		].map((credential) => `• ${credential}`)
+	].join("\n");
+}
+function platformInstallCommandArguments(options) {
+	const parts = [
+		options.commandName,
+		"platform",
+		"install"
+	];
+	const flag = (name, value) => {
+		if (value) parts.push(name, value);
+	};
+	if (options.resumeId) {
+		parts.push("--resume");
+		flag("--name", options.resumeId);
+	} else {
+		flag("--name", options.installationSlug);
+		flag("--account", options.accountId);
+		flag("--display-name", options.displayName);
+		if (options.workersDev) parts.push("--workers-dev");
+		else {
+			flag("--application-domain", options.applicationDomain);
+			flag("--zone", options.zoneName);
+			if (options.dedicatedZone) parts.push("--dedicated-zone");
+			else parts.push("--no-dedicated-zone");
+		}
+		flag("--control-plane-domain", options.controlPlaneDomain);
+		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
+	}
+	flag("--hyperdrive", options.hyperdrive ?? "");
+	flag("--auth-config", options.authConfig ?? "");
+	if (!options.resumeId && options.appAccess) flag("--app-access", options.appAccess);
+	if (!options.authConfig && !options.resumeId && options.authentication) {
+		flag("--login-methods", options.authentication.providers.join(","));
+		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
+	}
+	flag("--dashboard-url", options.dashboardUrl ?? "");
+	flag("--runtime", options.runtime);
+	if (options.yes) parts.push("--yes");
+	return parts;
+}
+function formatPlatformInstallCommand(options) {
+	return platformInstallCommandArguments(options).map((value) => {
+		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+	}).join(" ");
+}
+function openPlatformSetupPage(page, dependencies = {}) {
+	log.info((page.linkInTitle ? platformSetupLink(page) : page.title) + "\n" + page.instructions);
+	if (!page.linkInTitle) console.log(platformSetupLink({
+		...page,
+		title: "Open " + page.title
+	}));
+	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
+		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
+	} catch {
+		log.info("Could not open the browser. Use the link above.");
+	}
+}
+//#endregion
+export { platformManagementSetupPage as a, platformSetupLink as c, platformInstallCommandArguments as i, platformSetupPages as l, formatPlatformSetupPlan as n, platformPromptAnswer as o, openPlatformSetupPage as r, platformSetupFieldHelp as s, formatPlatformInstallCommand as t };

package/dist/{plugin-inference-CXWnn79A.mjs → plugin-inference-BlQbOL0P.mjs}

@@ -4,10 +4,9 @@ import { n as globSync, t as glob } from "./dist-Bn8Kodjp.mjs";
 import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CPGPjb0V.mjs";
 import { a as staticLiteral, n as parseRouteFilename, o as unwrapStaticExpression, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
 import { n as resourceNameWords, t as isResourceName } from "./resource-name-C7LVpcRm.mjs";
-import { r as getSsrServerEntryPath } from "./entry-CF5wvH4w.mjs";
+import { r as getSsrServerEntryPath } from "./entry-CMAkqBmU.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";
-import { parse } from "es-module-lexer/js";
 //#region src/application-features.ts
 /** Apply explicitly named overrides while preserving unrelated source features. */
 function applyBindingOverrides(inferred, overrides) {
@@ -331,16 +330,39 @@ function walk(ast, { enter, leave }) {
 	return new SyncWalker(enter, leave).visit(ast, null);
 }
 //#endregion
+//#region src/shared/module-references.ts
+/** Runtime imports and re-exports, in source order, including empty export lists. */
+function staticModuleReferences(parsed, code) {
+	const { staticImports, staticExports } = parsed.module;
+	if (!(/\bexport\s*(?:\/|\{\s*(?:\}|\/))/.test(code) || staticImports.some((item) => item.entries.length === 0 && code.slice(item.start, item.moduleRequest.start).trim() !== "import"))) return [...staticImports.filter((item) => item.entries.length === 0 || item.entries.some((entry) => !entry.isType)).map((item) => ({
+		source: item.moduleRequest.value,
+		start: item.start,
+		end: item.end
+	})), ...staticExports.flatMap((item) => {
+		const entry = item.entries.find((entry) => !entry.isType && entry.moduleRequest);
+		return entry?.moduleRequest ? [{
+			source: entry.moduleRequest.value,
+			start: item.start,
+			end: item.end
+		}] : [];
+	})].sort((a, b) => a.start - b.start);
+	return parsed.program.body.flatMap((statement) => {
+		if (statement.type !== "ImportDeclaration" && statement.type !== "ExportNamedDeclaration" && statement.type !== "ExportAllDeclaration") return [];
+		if (!statement.source || "importKind" in statement && statement.importKind === "type" || "exportKind" in statement && statement.exportKind === "type" || "specifiers" in statement && statement.specifiers.length > 0 && statement.specifiers.every((specifier) => "importKind" in specifier && specifier.importKind === "type" || "exportKind" in specifier && specifier.exportKind === "type")) return [];
+		return [{
+			source: statement.source.value,
+			start: statement.start,
+			end: statement.end
+		}];
+	});
+}
+//#endregion
 //#region src/inference/walk.ts
 const ENV_BINDING_RE = /\benv\s*\.\s*(DB|KV|STORAGE|QUEUE_\w+|AI|SANDBOX)\b/;
 /**
 * Infer which Cloudflare bindings a source file uses.
 *
-* Uses a tiered approach for performance:
-*   Tier 1: es-module-lexer to extract import sources (fast, asm.js, no init),
-*           with a TSX parser fallback when the lexer cannot parse JSX
-*   Tier 2: Regex check for env.DB/KV/STORAGE patterns
-*   Tier 3: Full AST walk only when regex matches (to confirm member expressions)
+* Read Vite's module metadata, then walk the AST only for potential env bindings.
 */
 function inferBindingsFromSource(code, filename) {
 	const result = {
@@ -354,25 +376,14 @@ function inferBindingsFromSource(code, filename) {
 		needsLive: false,
 		needsEmail: false
 	};
-	const moduleReferences = [];
-	let parsedProgram;
+	let parsed;
 	try {
-		const [imports] = parse(code);
-		for (const imp of imports) if (imp.specifier) moduleReferences.push({
-			source: imp.specifier,
-			statement: code.slice(imp.importStart, imp.importEnd + 1)
-		});
+		parsed = parseSync(filename, code);
+		if (parsed.errors.length > 0) return result;
 	} catch {
-		try {
-			parsedProgram = parseSync(filename, code).program;
-			for (const node of parsedProgram.body) if ((node.type === "ImportDeclaration" || node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration") && typeof node.source?.value === "string") moduleReferences.push({
-				source: node.source.value,
-				statement: code.slice(node.start, node.end)
-			});
-		} catch {}
+		return result;
 	}
-	for (const { source, statement } of moduleReferences) {
-		if (isTypeOnlyModuleStatement(statement)) continue;
+	function recordModuleReference(source, statement) {
 		switch (source) {
 			case "void/db":
 				result.needsD1 = true;
@@ -408,15 +419,15 @@ function inferBindingsFromSource(code, filename) {
 			case "void/client/solid": if (/\bauth\b/.test(statement)) result.needsAuth = true;
 		}
 	}
-	if (result.needsD1 && result.needsKV && result.needsR2 && result.needsAI && result.needsSandbox && result.needsLive) return result;
-	if (!ENV_BINDING_RE.test(code)) return result;
-	let program = parsedProgram;
-	if (!program) try {
-		program = parseSync(filename, code).program;
-	} catch {
-		return result;
+	for (const reference of staticModuleReferences(parsed, code)) recordModuleReference(reference.source, code.slice(reference.start, reference.end));
+	for (const reference of parsed.module.dynamicImports) {
+		const argument = code.slice(reference.moduleRequest.start, reference.moduleRequest.end);
+		const expression = parseSync(filename, `(${argument})`).program.body[0];
+		const source = expression?.type === "ExpressionStatement" ? staticLiteral(expression.expression) : void 0;
+		if (typeof source === "string") recordModuleReference(source, code.slice(reference.start, reference.end));
 	}
-	walk(program, { enter(node) {
+	if (!ENV_BINDING_RE.test(code)) return result;
+	walk(parsed.program, { enter(node) {
 		const current = node;
 		if (!isMemberExpression(current)) return;
 		if (current.computed) return;
@@ -447,16 +458,6 @@ function inferBindingsFromSource(code, filename) {
 	} });
 	return result;
 }
-function isTypeOnlyModuleStatement(statement) {
-	if (/^\s*(?:import|export)\s+type\b/.test(statement)) return true;
-	const specifierStart = statement.indexOf("{");
-	const specifierEnd = statement.lastIndexOf("}");
-	if (specifierStart === -1 || specifierEnd === -1 || specifierEnd < specifierStart) return false;
-	const beforeSpecifiers = statement.slice(0, specifierStart);
-	if (!/^\s*(?:import|export)\s*$/.test(beforeSpecifiers)) return false;
-	const specifiers = statement.slice(specifierStart + 1, specifierEnd).split(",").map((specifier) => specifier.trim()).filter(Boolean);
-	return specifiers.length > 0 && specifiers.every((specifier) => specifier.startsWith("type "));
-}
 /**
 * Merge multiple InferredBindings into a single result (union).
 */
@@ -721,4 +722,4 @@ function inferProjectBindings(root, options, scanDirs) {
 	return applyBindingOverrides(mergeBindings(allBindings), options?.bindings);
 }
 //#endregion
-export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutes as c, walk as d, readResourceDefinition as f, inferProjectBindings as i, scanWebSocketRoutesSync as l, needsApplicationDatabase as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, applyBindingOverrides as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, inferBindingsFromSource as u };
+export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutes as c, staticModuleReferences as d, walk as f, needsApplicationDatabase as h, inferProjectBindings as i, scanWebSocketRoutesSync as l, applyBindingOverrides as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, readResourceDefinition as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, inferBindingsFromSource as u };

package/dist/prepare-DRUV-g3X.mjs

@@ -0,0 +1,2 @@
+import { t as prepareProject } from "./prepare-Do96654b.mjs";
+export { prepareProject };

package/dist/{prepare-WoUubFKL.mjs → prepare-Do96654b.mjs}

@@ -1,13 +1,13 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { n as loadVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig } from "./config-Br_JZD6u.mjs";
-import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-B8GeM0RM.mjs";
-import { i as generateDbDts, n as generateQueueTypes, t as generateRouteTypes } from "./route-types-Clm4WD0B.mjs";
-import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
-import { r as generateEnvTypes, t as findEnvFile } from "./env-types-D5kds_OZ.mjs";
-import { a as loadLocalEnv } from "./env-_v349JBd.mjs";
-import { t as analyzeApplication } from "./application-routing-C9khgLiS.mjs";
-import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-Beb2Am5S.mjs";
+import { m as readConfig } from "./config-DiowPT80.mjs";
+import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-CVJhNMxs.mjs";
+import { i as generateDbDts, n as generateQueueTypes, t as generateRouteTypes } from "./route-types-CbtsIeFn.mjs";
+import { t as discoverSchema } from "./discover-CkCYv9T_.mjs";
+import { o as loadLocalEnv } from "./env-BxocywBB.mjs";
+import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CwXgeMgL.mjs";
+import { t as analyzeApplication } from "./application-routing-DQyUh_5S.mjs";
+import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-CF84FOVM.mjs";
 import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/codegen/prepare.ts

package/dist/{prepare-BMrRWLwP.mjs → prepare-Dq9hTIbo.mjs}

@@ -1,6 +1,6 @@
-import { H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
-import { l as note } from "./output-BvdaehtE.mjs";
-import { t as prepareProject } from "./prepare-WoUubFKL.mjs";
+import { L as log } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, u as note } from "./output-C50ag2r3.mjs";
+import { t as prepareProject } from "./prepare-Do96654b.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root, _args) {
 	console.log();
@@ -8,7 +8,7 @@ async function runPrepareCommand(root, _args) {
 	if (result.written.length > 0) note(result.written.join("\n"), "Wrote");
 	if (result.removed.length > 0) note(result.removed.join("\n"), "Removed stale files");
 	if (result.written.length === 0 && result.removed.length === 0) log.info("No generated files changed.");
-	outro("Project codegen is ready.");
+	printSuccess("Project codegen is ready.");
 }
 //#endregion
 export { runPrepareCommand };

package/dist/{prerender-render-D9qbLs2f.mjs → prerender-render-Ct20jftc.mjs}

@@ -1,4 +1,4 @@
-import { a as join, n as dirname } from "./dist-BVqXeR_h.mjs";
+import { a as join, i as isAbsolute, l as relative, n as dirname } from "./dist-BVqXeR_h.mjs";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/prerender-render.ts
 function outputFileForPath(path) {
@@ -7,6 +7,11 @@ function outputFileForPath(path) {
 function pageDataFileForPath(path) {
 	return path === "/" ? "_void/pages/index.json" : `_void/pages/${path.slice(1)}.json`;
 }
+/** Whether `path` resolves strictly inside `directory`. */
+function isInside(directory, path) {
+	const child = relative(directory, path);
+	return child !== "" && child !== ".." && !child.startsWith("../") && !isAbsolute(child);
+}
 function normalizedFile(clientDir, path) {
 	return join(clientDir, path).normalize("NFC").toLowerCase();
 }
@@ -66,6 +71,17 @@ async function renderPrerenderPaths(paths, clientDir, fetchPath, fetchPageData,
 			const path = paths[index];
 			const result = results[index];
 			const outputFile = outputFileForPath(path);
+			const outputPath = join(clientDir, outputFile);
+			const pageDataPath = join(clientDir, pageDataFileForPath(path));
+			if (!isInside(clientDir, outputPath) || !isInside(join(clientDir, "_void/pages"), pageDataPath)) {
+				const error = "prerender path resolves outside the output directory";
+				result.failed.push({
+					path,
+					error
+				});
+				onResult?.(path, outputFile, error);
+				continue;
+			}
 			try {
 				const response = await fetchPath(path);
 				const html = await response.text();
@@ -78,14 +94,12 @@ async function renderPrerenderPaths(paths, clientDir, fetchPath, fetchPageData,
 					onResult?.(path, outputFile, error);
 					continue;
 				}
-				const outputPath = join(clientDir, outputFile);
 				mkdirSync(dirname(outputPath), { recursive: true });
 				writeFileSync(outputPath, html);
 				if (fetchPageData) {
 					const pageDataResponse = await fetchPageData(path);
 					if (pageDataResponse.headers.get("X-VoidPages")) {
 						const pageData = await pageDataResponse.json();
-						const pageDataPath = join(clientDir, pageDataFileForPath(path));
 						mkdirSync(dirname(pageDataPath), { recursive: true });
 						writeFileSync(pageDataPath, JSON.stringify(pageData));
 					}

package/dist/prerender-render.mjs

@@ -1,2 +1,2 @@
-import { t as renderPrerenderPaths } from "./prerender-render-D9qbLs2f.mjs";
+import { t as renderPrerenderPaths } from "./prerender-render-Ct20jftc.mjs";
 export { renderPrerenderPaths };

package/dist/{project-DQstYTxO.mjs → project-BAm2aB6Q.mjs}

@@ -1,5 +1,5 @@
 import { a as join, n as dirname } from "./dist-BVqXeR_h.mjs";
-import { c as normalizePlatformApiUrl, s as listPlatformConnections } from "./platform-registry-P387v42A.mjs";
+import { c as normalizePlatformApiUrl, s as listPlatformConnections } from "./platform-registry-Cjv2Qf0r.mjs";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/project.ts