void 0.26.1 → 0.28.0

package/README.md

@@ -20,7 +20,7 @@ npx void init
 npm run dev
 ```
 
-Choose your UI framework and starter, then select Cloudflare to deploy to your account:
+Vite+ is the default toolchain; setup installs it for you and keeps your existing package-manager configuration. Choose your UI framework and starter, then select Cloudflare to deploy to your account:
 
 ```sh
 npx void deploy
@@ -43,6 +43,8 @@ Read the [Void documentation](https://void.cloud) online or use the Markdown gui
 - [API](https://void.cloud/reference/api) and [CLI](https://void.cloud/reference/cli) reference
 - [Coding agents](https://void.cloud/integrations/agents)
 
+Applications that publish through a platform OAuth client can prepare a built app without credentials using [`void/deploy`](https://void.cloud/reference/api/deploy), then request [user approval](https://void.cloud/guide/platform/administration/connected-apps).
+
 ## License
 
 MIT

package/dist/{account-cmd-CfUXh_nU.mjs → account-cmd-Ci00cncT.mjs}

@@ -1,14 +1,14 @@
-import { c as getToken, f as removeToken } from "./auth-B5_tZLxT.mjs";
+import { c as getToken, f as removeToken } from "./auth-B6iOCjKI.mjs";
 import { L as log } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess } from "./output-C50ag2r3.mjs";
-import { r as PlatformClient } from "./client-C2Prx_Bi.mjs";
-import { n as runLoginCommand } from "./login-D-Q4xw3Q.mjs";
+import { m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+import { n as runLoginCommand } from "./login-CZ2Cqa-D.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/account-cmd.ts
 async function runAccountCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
-		case "link": return import("./auth-link-D5RmKnzh.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
+		case "link": return import("./auth-link-DWr6Afao.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) printSuccess("Logged out.");
 			else log.info("Not logged in.");

package/dist/{agents-B_pX_HmQ.mjs → agents-CuNtT0D_.mjs}

@@ -1,4 +1,4 @@
-import { a as join } from "./dist-BVqXeR_h.mjs";
+import { a as join } from "./dist-ipQi0Q8y.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/cli/agents.ts
@@ -12,6 +12,9 @@ function getPackageDir() {
 	}
 	throw new Error("Could not find void package root");
 }
+function getOwnVersion() {
+	return JSON.parse(readFileSync(join(getPackageDir(), "package.json"), "utf-8")).version;
+}
 const agents = {
 	"claude-code": {
 		displayName: "Claude Code",
@@ -108,4 +111,4 @@ function detectAgents(root) {
 	return Object.values(agents).filter((a) => a.detect(root));
 }
 //#endregion
-export { getPackageDir as n, detectAgents as t };
+export { getOwnVersion as n, getPackageDir as r, detectAgents as t };

package/dist/{application-analysis-DKy02UY0.mjs → application-analysis-D72ZQfMZ.mjs}

@@ -1,20 +1,20 @@
-import { a as join, i as isAbsolute, t as basename } from "./dist-BVqXeR_h.mjs";
-import { c as scanWebSocketRoutes, h as needsApplicationDatabase, i as inferProjectBindings, l as scanWebSocketRoutesSync, n as FRAMEWORK_SCAN_DIRS, p as readResourceDefinition, r as detectFramework, s as isWebSocketPatternFile } from "./plugin-inference-BlQbOL0P.mjs";
-import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
-import { t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { h as resolveBindingNames, u as getDatabaseDialect } from "./config-DiowPT80.mjs";
-import { n as globSync, t as glob } from "./dist-Bn8Kodjp.mjs";
+import { a as join, i as isAbsolute, t as basename } from "./dist-ipQi0Q8y.mjs";
+import { c as scanWebSocketRoutesSync, f as readResourceDefinition, h as needsApplicationDatabase, i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, p as listConventionFiles, r as detectFramework, s as isWebSocketPatternFile } from "./plugin-inference-DsARdQKE.mjs";
+import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-DMvEeSau.mjs";
+import { t as findVoidAuthConfig } from "./config-D0GY5ItR.mjs";
+import { f as resolveBindingNames, s as getDatabaseDialect } from "./config-Bx_1SpnO.mjs";
+import { n as globSync } from "./dist-Bn8Kodjp.mjs";
 import { n as isIdentifier } from "./ast-CPGPjb0V.mjs";
 import { a as staticLiteral, i as staticExportInitializers, n as parseRouteFilename, o as unwrapStaticExpression, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
 import { n as resourceNameWords } from "./resource-name-C7LVpcRm.mjs";
-import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
-import { a as scanEmailHandlersSync, i as scanEmailHandlers, r as hasEmailHandlers } from "./email-d_Aux1vM.mjs";
-import { t as scanPages } from "./scan-C3uDzz6J.mjs";
-import { o as isSandboxEnabled } from "./config-B_ggY-IO.mjs";
+import { t as collectMigrations } from "./collect-xjffdCdk.mjs";
+import { i as scanEmailHandlersSync } from "./email-BcjSyAL0.mjs";
+import { t as scanPages } from "./scan-C0BMdmEd.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { parseSync } from "vite";
+import { isSandboxRegistryImage } from "@void/deploy-core";
 //#region src/crons/scan.ts
-const JOB_PATTERN = "**/*.{ts,mts,js,mjs}";
 function extractJobName(filePath) {
 	return filePath.replace(/\.[^.]+$/, "");
 }
@@ -29,14 +29,9 @@ function extractCronExpressions(source, filePath) {
 		return cron.trim();
 	});
 }
-function resolveDir(root, dir) {
-	return isAbsolute(dir) ? dir : join(root, dir);
-}
-function parseJobFiles(root, jobsDir, files) {
-	const jobsDirPath = resolveDir(root, jobsDir);
-	return files.filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_"))).sort((leftFilePath, rightFilePath) => leftFilePath.localeCompare(rightFilePath)).map((filePath) => {
-		const absPath = join(jobsDirPath, filePath);
-		const source = readFileSync(absPath, "utf-8");
+function scanJobsSync(cronsDir) {
+	return listConventionFiles(cronsDir).sort((leftFilePath, rightFilePath) => leftFilePath.localeCompare(rightFilePath)).map((filePath) => {
+		const source = readFileSync(join(cronsDir, filePath), "utf-8");
 		return {
 			filePath,
 			name: extractJobName(filePath),
@@ -44,31 +39,13 @@ function parseJobFiles(root, jobsDir, files) {
 		};
 	});
 }
-async function scanJobs(root, jobsDir = "crons") {
-	return parseJobFiles(root, jobsDir, await glob(JOB_PATTERN, {
-		cwd: resolveDir(root, jobsDir),
-		absolute: false
-	}).catch(() => []));
-}
-function scanJobsSync(root, jobsDir = "crons") {
-	let files;
-	try {
-		files = globSync(JOB_PATTERN, {
-			cwd: resolveDir(root, jobsDir),
-			absolute: false
-		});
-	} catch {
-		files = [];
-	}
-	return parseJobFiles(root, jobsDir, files);
-}
 //#endregion
 //#region src/durable/scan.ts
 const MODULE_PATTERN = /\.(?:[cm]?[jt]s)$/;
 function inferDurableResourceName(filePath) {
 	return filePath.replace(/\\/g, "/").split("/").pop().replace(MODULE_PATTERN, "");
 }
-const DURABLE_HELPERS = /* @__PURE__ */ new Set(["defineDurableState"]);
+const DURABLE_HELPERS = /* @__PURE__ */ new Set(["defineDurableState", "defineDurableObject"]);
 function deriveDurableResourceIdentity(name) {
 	const parts = resourceNameWords(name);
 	const classBase = parts.map((part) => part[0].toUpperCase() + part.slice(1)).join("");
@@ -103,7 +80,6 @@ function scanDurableObjectModules(root) {
 }
 //#endregion
 //#region src/queues/scan.ts
-const QUEUE_PATTERN = "**/*.{ts,mts,js,mjs}";
 function extractName(filePath) {
 	return filePath.replace(/\.[^.]+$/, "").replaceAll("/", "-");
 }
@@ -116,12 +92,9 @@ const OPTION_NAMES = [
 	"maxRetries",
 	"retryDelay"
 ];
-function resolveQueuesDir(root, queuesDir) {
-	return isAbsolute(queuesDir) ? queuesDir : join(root, queuesDir);
-}
-function parseQueueFiles(queuesDirPath, files) {
-	const definitions = files.filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_"))).sort().map((filePath) => {
-		const absPath = join(queuesDirPath, filePath);
+function scanQueuesSync(queuesDir) {
+	const definitions = listConventionFiles(queuesDir).sort().map((filePath) => {
+		const absPath = join(queuesDir, filePath);
 		const source = readFileSync(absPath, "utf-8");
 		const name = extractName(filePath);
 		const options = OPTION_NAMES.some((option) => source.includes(option)) ? staticExportInitializers(absPath, source, new Set(OPTION_NAMES)) : /* @__PURE__ */ new Map();
@@ -156,26 +129,6 @@ function parseQueueFiles(queuesDirPath, files) {
 	].join("\n"));
 	return definitions;
 }
-async function scanQueues(root, queuesDir = "queues") {
-	const queuesDirPath = resolveQueuesDir(root, queuesDir);
-	return parseQueueFiles(queuesDirPath, await glob(QUEUE_PATTERN, {
-		cwd: queuesDirPath,
-		absolute: false
-	}).catch(() => []));
-}
-function scanQueuesSync(root, queuesDir = "queues") {
-	const queuesDirPath = resolveQueuesDir(root, queuesDir);
-	let files;
-	try {
-		files = globSync(QUEUE_PATTERN, {
-			cwd: queuesDirPath,
-			absolute: false
-		});
-	} catch {
-		files = [];
-	}
-	return parseQueueFiles(queuesDirPath, files);
-}
 //#endregion
 //#region src/router/detect-exports.ts
 const HTTP_METHODS = /* @__PURE__ */ new Set([
@@ -224,12 +177,6 @@ function detectHttpExports(absPath) {
 }
 //#endregion
 //#region src/router/scan.ts
-const ROUTE_PATTERN = `**/*.{${[
-	"ts",
-	"mts",
-	"js",
-	"mjs"
-].join(",")}}`;
 function parseMiddlewareDefinitions(files) {
 	return files.filter((f) => !f.startsWith("_")).map((f) => {
 		const match = f.split("/").pop().match(/^(\d+)\./);
@@ -251,67 +198,110 @@ function compareRouteSpecificity(a, b) {
 	}
 	return aSegments.length - bSegments.length;
 }
-/**
-* Scan routes/ and middleware/ directories and return a structured manifest.
-* Files starting with _ are ignored.
-*/
+/** Add pages and HTTP methods to the inventories already resolved for this application phase. */
 async function scanRoutes(root, options) {
-	const paths = options?.paths ?? readProjectPaths(root);
-	const [routeFiles, websockets, middlewareFiles, jobs, queues, pages, email] = await Promise.all([
-		options?.inventory ? [] : glob(ROUTE_PATTERN, {
-			cwd: paths.routesDir,
-			absolute: false
-		}),
-		options?.inventory?.websockets ?? scanWebSocketRoutes(root, paths, options?.environment),
-		options?.inventory ? [] : glob(ROUTE_PATTERN, {
-			cwd: paths.middlewareDir,
-			absolute: false
-		}).catch(() => []),
-		options?.inventory?.jobs ?? scanJobs(root, paths.cronsDir),
-		options?.inventory?.queues ?? scanQueues(root, paths.queuesDir),
-		scanPages(root, {
-			output: options?.output,
-			paths
-		}),
-		options?.inventory?.email ?? scanEmailHandlers(paths.sourceRoot)
-	]);
-	const routesDir = paths.routesDir;
+	const { paths, inventory } = options;
+	const pages = await scanPages(root, {
+		output: options.output,
+		paths
+	});
+	const routes = inventory.routes.map((route) => ({
+		...route,
+		methods: detectHttpExports(join(paths.routesDir, route.filePath))
+	})).sort(compareRouteSpecificity);
 	return {
-		routes: (options?.inventory?.routes ?? routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((file) => parseRouteFilename(file)).filter((route) => isRouteEnabledForEnvironment(route, options?.environment))).map((route) => ({
-			...route,
-			methods: detectHttpExports(join(routesDir, route.filePath))
-		})).sort(compareRouteSpecificity),
-		websockets,
-		middleware: options?.inventory?.middleware ?? parseMiddlewareDefinitions(middlewareFiles),
-		jobs,
-		queues,
-		pages,
-		email
+		...inventory,
+		routes,
+		pages
 	};
 }
 function scanMiddlewareSync(root, paths = readProjectPaths(root)) {
-	let middlewareFiles;
-	try {
-		middlewareFiles = globSync(ROUTE_PATTERN, {
-			cwd: paths.middlewareDir,
-			absolute: false
-		});
-	} catch {
-		middlewareFiles = [];
-	}
-	return parseMiddlewareDefinitions(middlewareFiles);
+	return parseMiddlewareDefinitions(globSync("**/*.{ts,mts,js,mjs}", { cwd: paths.middlewareDir }));
 }
 function scanRoutePatternsSync(root, paths = readProjectPaths(root), environment) {
-	let routeFiles;
-	try {
-		routeFiles = globSync(ROUTE_PATTERN, {
-			cwd: paths.routesDir,
-			absolute: false
-		});
-	} catch {
-		routeFiles = [];
+	return listConventionFiles(paths.routesDir).filter((f) => !isWebSocketPatternFile(f)).map((f) => parseRouteFilename(f)).filter((route) => isRouteEnabledForEnvironment(route, environment)).sort(compareRouteSpecificity);
+}
+const DEFAULT_SANDBOX_CLASS_NAME = "SandboxV1";
+const DEFAULT_SANDBOX_CONTAINER_NAME = "void-sandbox-v1";
+const SANDBOX_MIGRATION_TAG = "void-sandbox-v2";
+function isSandboxEnabled(config) {
+	return config.sandbox !== void 0 && config.sandbox !== false;
+}
+function getDefaultSandboxImage() {
+	return fileURLToPath(new URL("../../sandbox.Dockerfile", import.meta.resolve("void/sandbox")));
+}
+function getDefaultSandboxPlatformImage() {
+	return "cloudflare/debian-trixie";
+}
+function isLocalSandboxImage(image) {
+	return isAbsolute(image) || image.startsWith("./") || image.startsWith("../") || image.toLowerCase().includes("dockerfile");
+}
+function requiresSandboxPlatformImage(config) {
+	if (typeof config.sandbox !== "object" || config.sandbox === null) return false;
+	return typeof config.sandbox.image === "string" && isLocalSandboxImage(config.sandbox.image) && config.sandbox.platformImage === void 0;
+}
+function resolveSandboxConfig(config, root = process.cwd()) {
+	const raw = typeof config.sandbox === "object" ? config.sandbox : {};
+	const image = raw.image ?? getDefaultSandboxImage();
+	const imageBuildContext = raw.imageBuildContext;
+	const platformImage = raw.platformImage ?? (raw.image && !isLocalSandboxImage(raw.image) ? raw.image : getDefaultSandboxPlatformImage());
+	if (!isLocalSandboxImage(image) && !isSandboxRegistryImage(image)) throw new Error("sandbox.image must be a Dockerfile or a digest-pinned Cloudflare registry image (registry.cloudflare.com/<account>/<image>@sha256:<digest>).");
+	if (platformImage !== getDefaultSandboxPlatformImage() && !isSandboxRegistryImage(platformImage)) throw new Error("sandbox.platformImage must be a digest-pinned Cloudflare registry image (registry.cloudflare.com/<account>/<image>@sha256:<digest>).");
+	return {
+		binding: raw.binding ?? "SANDBOX",
+		className: raw.className ?? "SandboxV1",
+		containerName: raw.containerName ?? DEFAULT_SANDBOX_CONTAINER_NAME,
+		image: resolveSandboxImage(image, root),
+		platformImage,
+		...imageBuildContext && { imageBuildContext: isAbsolute(imageBuildContext) ? imageBuildContext : join(root, imageBuildContext) },
+		...raw.instanceType && { instanceType: raw.instanceType }
+	};
+}
+function resolveSandboxImage(image, root) {
+	if (!isLocalSandboxImage(image) || isAbsolute(image)) return image;
+	return join(root, image);
+}
+function sandboxContainerConfig(sandbox) {
+	return {
+		name: sandbox.containerName,
+		class_name: sandbox.className,
+		scheduling_policy: "durable_object",
+		images: { default: isLocalSandboxImage(sandbox.image) ? {
+			dockerfile: sandbox.image,
+			...sandbox.imageBuildContext && { build_context: sandbox.imageBuildContext }
+		} : { image: sandbox.image } }
+	};
+}
+/** Resolve the final local storage kind without recreating a renamed or deleted class. */
+function resolveSandboxMigrationStorage(migrations, className) {
+	const storage = /* @__PURE__ */ new Map();
+	for (const migration of migrations) {
+		for (const name of migration.new_classes ?? []) storage.set(name, "legacy-kv");
+		for (const name of migration.new_sqlite_classes ?? []) storage.set(name, "sqlite");
+		for (const rename of migration.renamed_classes ?? []) {
+			const sqlite = storage.get(rename.from);
+			storage.delete(rename.from);
+			storage.set(rename.to, sqlite ?? "unknown");
+		}
+		for (const transfer of migration.transferred_classes ?? []) storage.set(transfer.to, "unknown");
+		for (const name of migration.deleted_classes ?? []) storage.delete(name);
 	}
-	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).filter((route) => isRouteEnabledForEnvironment(route, environment)).sort(compareRouteSpecificity);
+	return storage.get(className);
+}
+function hasSandboxSqliteMigration(migrations, className) {
+	return resolveSandboxMigrationStorage(migrations, className) === "sqlite";
+}
+/** Refuse namespace reuse before either uploader can change a live Worker. */
+function assertSandboxNamespaceConfig(config, sandbox) {
+	const containers = Array.isArray(config.containers) ? config.containers : [];
+	const durable = config.durable_objects;
+	const binding = durable?.bindings?.find((entry) => entry.name === sandbox.binding);
+	if (binding && (binding.script_name !== void 0 || binding.environment !== void 0)) throw new Error(`sandbox: binding '${sandbox.binding}' must reference the local '${sandbox.className}' class. Choose another sandbox.binding name to preserve the existing external Durable Object.`);
+	const migrations = Array.isArray(config.migrations) ? config.migrations : [];
+	const storage = resolveSandboxMigrationStorage(migrations, sandbox.className);
+	if (storage === "legacy-kv" || storage === "unknown") throw new Error(`sandbox: class '${sandbox.className}' needs SQLite storage, but its existing namespace has ${storage} storage. Preserve the existing migration history and choose a fresh Worker name or a new sandbox.className and sandbox.binding.`);
+	if (storage !== "sqlite" && migrations.some((migration) => migration.tag === "void-sandbox-v2")) throw new Error(`sandbox: migration tag '${SANDBOX_MIGRATION_TAG}' is already configured for another class. Keep the existing history and choose a fresh Worker for Sandbox.`);
+	if (containers.some((container) => container.class_name === sandbox.className && container.scheduling_policy !== "durable_object") || durable?.bindings?.some((binding) => binding.name === sandbox.binding && binding.class_name !== sandbox.className)) throw new Error("Sandbox SDK 1.0 needs a new Durable Object namespace. Back up existing Sandbox data and deploy to a fresh Worker name with the new Sandbox configuration; remove legacy Sandbox bindings, containers, and migrations from that new Worker configuration. See https://developers.cloudflare.com/containers/guides/migrate-to-durable-object-scheduling-policy/.");
 }
 //#endregion
 //#region src/application-analysis.ts
@@ -339,8 +329,8 @@ function analyzeApplicationSync(root, options) {
 	};
 	const dialect = getDatabaseDialect(config);
 	const migrations = collectMigrations(paths.migrationsDir);
-	const jobs = scanJobsSync(root, paths.cronsDir);
-	const queues = scanQueuesSync(root, paths.queuesDir);
+	const jobs = scanJobsSync(paths.cronsDir);
+	const queues = scanQueuesSync(paths.queuesDir);
 	const allWebsockets = scanWebSocketRoutesSync(root, paths);
 	const websockets = allWebsockets.filter((route) => isRouteEnabledForEnvironment(route, environment));
 	const durableObjects = scanDurableObjectModules(root);
@@ -350,19 +340,12 @@ function analyzeApplicationSync(root, options) {
 	const reasons = {
 		database: [],
 		kv: bindings.needsKV ? [bindingReason("kv", "KV", "app uses env.KV")] : [],
-		r2: bindings.needsR2 ? [bindingReason("storage", "R2", "app uses env.STORAGE (R2)")] : [],
-		ai: bindings.needsAI ? [bindingReason("ai", "Workers AI", "app uses Workers AI")] : [],
-		sandbox: bindings.needsSandbox ? [isSandboxEnabled(config) ? "void.config.ts enables Sandbox" : "app uses void/sandbox"] : [],
-		live: bindings.needsLive ? ["app uses void/live"] : [],
-		email: bindings.needsEmail ? [bindingReason("email", "email", "app uses void/email")] : [],
-		queues: bindings.needsQueues ? ["app uses void/queues"] : []
+		r2: bindings.needsR2 ? [bindingReason("storage", "R2", "app uses env.STORAGE (R2)")] : []
 	};
 	const databaseName = dialect === "sqlite" ? "a D1 database" : "a Hyperdrive database";
 	if (bindings.needsD1) reasons.database.push(bindingReason("db", databaseName, dialect === "sqlite" ? "app uses env.DB (D1)" : "app uses a database"));
 	if (authEnabled) reasons.database.push(`auth requires ${databaseName}`);
 	if (migrations.length > 0) reasons.database.push(`checked-in migrations need ${databaseName}`);
-	for (const queue of queues) reasons.queues.push(`queues/${queue.filePath} requires ${queue.bindingName}`);
-	if (hasEmailHandlers(email)) reasons.email.push("email/ contains inbound email handlers");
 	return {
 		root,
 		config,
@@ -388,4 +371,4 @@ function analyzeApplicationSync(root, options) {
 	};
 }
 //#endregion
-export { inferDurableResourceName as a, deriveDurableResourceIdentity as i, scanRoutes as n, scanDurableObjectModules as o, scanQueuesSync as r, scanJobsSync as s, analyzeApplicationSync as t };
+export { hasSandboxSqliteMigration as a, sandboxContainerConfig as c, deriveDurableResourceIdentity as d, inferDurableResourceName as f, assertSandboxNamespaceConfig as i, scanRoutes as l, scanJobsSync as m, DEFAULT_SANDBOX_CLASS_NAME as n, requiresSandboxPlatformImage as o, scanDurableObjectModules as p, SANDBOX_MIGRATION_TAG as r, resolveSandboxConfig as s, analyzeApplicationSync as t, scanQueuesSync as u };

package/dist/{application-routing-DQyUh_5S.mjs → application-routing-Dy589Vgn.mjs}

@@ -1,11 +1,10 @@
-import { n as scanRoutes, t as analyzeApplicationSync } from "./application-analysis-DKy02UY0.mjs";
+import { l as scanRoutes, t as analyzeApplicationSync } from "./application-analysis-D72ZQfMZ.mjs";
 //#region src/application-routing.ts
 /** Complete route/page analysis using the same resource and handler inventories. */
 async function completeApplicationAnalysis(analysis) {
 	const scan = await scanRoutes(analysis.root, {
 		output: analysis.config.output,
 		paths: analysis.paths,
-		environment: analysis.environment,
 		inventory: {
 			routes: analysis.routes,
 			middleware: analysis.middleware,

package/dist/atomic-write-Dq6R0BPN.mjs

@@ -0,0 +1,18 @@
+import { renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+//#region src/shared/atomic-write.ts
+/** Write through a unique temporary file and rename it, so readers never see a partial file. */
+function writeFileAtomic(path, content, mode) {
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	try {
+		writeFileSync(temporary, content, {
+			flag: "wx",
+			mode
+		});
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+}
+//#endregion
+export { writeFileAtomic as t };

package/dist/{auth-B5_tZLxT.mjs → auth-B6iOCjKI.mjs}

@@ -1,11 +1,12 @@
-import { a as join } from "./dist-BVqXeR_h.mjs";
-import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, s as listPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-P387v42A.mjs";
-import { i as readProjectPlatformUrl, r as readProjectConfig } from "./project-DQstYTxO.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-ngGqZpHZ.mjs";
+import { a as join } from "./dist-ipQi0Q8y.mjs";
+import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, s as listPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-B9mWX9LO.mjs";
+import { a as readProjectPlatformUrl, r as readProjectConfig } from "./project-rqDnVsJN.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
+import { execFile } from "node:child_process";
 import { browserPageLead, browserPageStatus, renderBrowserPage } from "@void/platform/browser-page";
 //#region src/cli/auth.ts
 const CONFIG_DIR = join(homedir(), ".void");
@@ -97,20 +98,16 @@ function readTokenForOrigin(apiUrl, config) {
 function getTokenSource() {
 	return process.env.VOID_TOKEN ? "ci" : "manual";
 }
-function saveToken(token, root = process.cwd(), dependencies = {}) {
-	savePlatformToken(token, getApiUrl(root), dependencies);
-}
 function readPlatformToken(apiUrl) {
 	return readOriginScopedToken(apiUrl, readConfig());
 }
-function savePlatformToken(token, origin, dependencies = {}) {
+function savePlatformToken(token, origin) {
 	const apiUrl = normalizePlatformApiUrl(origin);
-	const account = platformCredentialAccount(apiUrl);
-	if ((dependencies.keyringSet ?? keyringSet)(account, token)) return;
+	if (keyringSet(platformCredentialAccount(apiUrl), token)) return;
 	throw new Error("auth: The system keychain is unavailable. Refusing to store your platform token in plaintext. Configure a system keychain, or set VOID_TOKEN from a secret manager in headless environments.");
 }
 function removeToken(root = process.cwd()) {
-	const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
+	const apiUrl = getApiUrl(root);
 	const account = platformCredentialAccount(apiUrl);
 	let removed = false;
 	if (keyringDelete(account)) removed = true;
@@ -137,9 +134,8 @@ function createCodeChallenge(verifier) {
 	return base64Url(createHash("sha256").update(verifier).digest());
 }
 async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
-	const base = apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
-	ensureCloudflaredToken(apiUrl);
-	const res = await fetch(new URL("auth/cli/token", base), {
+	ensurePlatformAccessToken(apiUrl);
+	const res = await fetch(`${apiUrl}/auth/cli/token`, {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
@@ -181,48 +177,32 @@ function page(title, message) {
 		content: browserPageStatus(title === "Login failed" ? "error" : "success") + browserPageLead(title, message)
 	});
 }
-function openBrowser(url, execFile) {
+function openBrowser(url, run = execFile) {
 	const ignore = () => {};
 	if (process.platform === "win32") {
-		execFile("rundll32.exe", ["url.dll,FileProtocolHandler", url], ignore);
+		run("rundll32.exe", ["url.dll,FileProtocolHandler", url], ignore);
 		return;
 	}
 	if (process.platform === "darwin") {
-		execFile("open", [url], ignore);
+		run("open", [url], ignore);
 		return;
 	}
 	if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) {
-		execFile("wslview", [url], (error) => {
-			if (error) execFile("rundll32.exe", ["url.dll,FileProtocolHandler", url], ignore);
+		run("wslview", [url], (error) => {
+			if (error) run("rundll32.exe", ["url.dll,FileProtocolHandler", url], ignore);
 		});
 		return;
 	}
-	execFile("xdg-open", [url], ignore);
+	run("xdg-open", [url], ignore);
 }
 /**
-* Start a local HTTP callback server, open the browser to a caller-built
-* authorize URL, and wait for the redirect back to `http://localhost:PORT/callback`.
-*
-* The server validates the `state` it appended to the callback URL against the
-* incoming request, then runs the caller's `finalize` hook INSIDE the request
-* handler (so the browser only ever sees the success page after the underlying
-* exchange/link actually succeeded). On finalize success it renders the success
-* HTML and resolves with finalize's return value; on finalize failure it
-* renders the same "could not complete" failure page the login flow uses and
-* rejects with the thrown error. The server is always closed before settling.
-*
-* `onUrl` is invoked with the authorize URL once the local server is listening,
-* so callers can show the URL to the user as a manual fallback when the browser
-* fails to open (common on WSL2, headless SSH, Docker, etc.). To match the
-* login flow it fires immediately before the browser is opened.
-*
-* `execFile` is injectable so tests can avoid launching a real browser.
+* Serve `http://localhost:PORT/callback`, open the browser at the caller's
+* authorize URL, and settle with `finalize`'s result. The server closes before settling.
 */
 async function awaitBrowserCallback(options) {
 	const http = await import("node:http");
 	const { state, buildAuthUrl, finalize, describeError, validate, onUrl } = options;
 	const timeoutMs = options.timeoutMs ?? 3e5;
-	const execFile = options.execFile ?? (await import("node:child_process")).execFile;
 	return new Promise((resolve, reject) => {
 		let settled = false;
 		const fail = (error) => {
@@ -295,37 +275,24 @@ async function awaitBrowserCallback(options) {
 				return;
 			}
 			onUrl?.(authUrl);
-			openBrowser(authUrl, execFile);
+			openBrowser(authUrl, options.execFile);
 		});
 		setTimeout(() => {
 			fail(/* @__PURE__ */ new Error("auth: Login timed out after 5 minutes. Try again."));
 		}, timeoutMs).unref();
 	});
 }
-/**
-* Start a local HTTP server, open the browser to the platform login page,
-* and wait for the OAuth callback with a short-lived code. The CLI exchanges
-* the code itself so the localhost callback never accepts bearer tokens.
-*
-* `onUrl` is invoked with the login URL once the local server is listening,
-* so callers can show the URL to the user as a manual fallback when the
-* browser fails to open (common on WSL2, headless SSH, Docker, etc.).
-*/
-async function runLogin(root = process.cwd(), provider = "github", onUrl) {
-	return runPlatformLogin(getApiUrl(root), provider, onUrl);
-}
+/** The CLI exchanges the code itself, so the localhost callback never accepts bearer tokens. */
 async function runPlatformLogin(origin, provider = "github", onUrl) {
-	const { execFile } = await import("node:child_process");
 	const apiUrl = normalizePlatformApiUrl(origin);
 	const state = randomBytes(32).toString("hex");
 	const codeVerifier = createCodeVerifier();
 	const codeChallenge = createCodeChallenge(codeVerifier);
 	return awaitBrowserCallback({
 		state,
-		execFile,
 		onUrl,
 		buildAuthUrl: (callback) => {
-			const loginUrl = new URL("auth/login", apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`);
+			const loginUrl = new URL(`${apiUrl}/auth/login`);
 			loginUrl.searchParams.set("redirect", callback.href);
 			loginUrl.searchParams.set("provider", provider);
 			loginUrl.searchParams.set("code_challenge", codeChallenge);
@@ -342,4 +309,4 @@ async function runPlatformLogin(origin, provider = "github", onUrl) {
 	});
 }
 //#endregion
-export { getApiUrl as a, getToken as c, readPlatformToken as d, removeToken as f, saveToken as g, savePlatformToken as h, getAccountCredential as i, getTokenSource as l, runPlatformLogin as m, createCodeChallenge as n, getProxyUrl as o, runLogin as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, openBrowser as u };
+export { getApiUrl as a, getToken as c, readPlatformToken as d, removeToken as f, getAccountCredential as i, getTokenSource as l, savePlatformToken as m, createCodeChallenge as n, getProxyUrl as o, runPlatformLogin as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, openBrowser as u };

package/dist/{auth-link-D5RmKnzh.mjs → auth-link-DWr6Afao.mjs}

@@ -1,9 +1,9 @@
-import { a as getApiUrl, c as getToken, h as savePlatformToken, m as runPlatformLogin, u as openBrowser } from "./auth-B5_tZLxT.mjs";
+import { a as getApiUrl, c as getToken, m as savePlatformToken, p as runPlatformLogin, u as openBrowser } from "./auth-B6iOCjKI.mjs";
 import { L as log } from "./dist-D3m88sjf.mjs";
-import { r as PlatformClient } from "./client-C2Prx_Bi.mjs";
-import { r as selectPlatformLoginMethod } from "./login-D-Q4xw3Q.mjs";
-import { t as discoverPlatform } from "./platform-cmd-B8-bCb7t.mjs";
-import { execFile } from "node:child_process";
+import { l as formatUrl } from "./output-FNHKw5Ac.mjs";
+import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+import { r as selectPlatformLoginMethod } from "./login-CZ2Cqa-D.mjs";
+import { t as discoverPlatform } from "./platform-cmd-DxxZO6e5.mjs";
 //#region src/cli/auth-link.ts
 async function runAuthLink(root, connectionId) {
 	const token = getToken(root);
@@ -12,16 +12,16 @@ async function runAuthLink(root, connectionId) {
 	const platform = await discoverPlatform(apiUrl);
 	if (!platform.authentication) throw new Error("auth: This platform must be upgraded before linking login methods.");
 	const target = await selectPlatformLoginMethod(platform, connectionId);
-	const existing = await new PlatformClient(token, apiUrl).whoami();
+	const existing = await new PlatformClient(token, { apiUrl }).whoami();
 	log.info(`Sign in again to ${existing.login} using an already linked login method.`);
 	const source = await selectPlatformLoginMethod(platform);
-	const freshToken = await runPlatformLogin(apiUrl, source.id, (url) => log.info(`Sign in: ${url}`));
-	const client = new PlatformClient(freshToken, apiUrl);
+	const freshToken = await runPlatformLogin(apiUrl, source.id, (url) => log.info(`Sign in: ${formatUrl(url)}`));
+	const client = new PlatformClient(freshToken, { apiUrl });
 	if ((await client.whoami()).id !== existing.id) throw new Error("auth: You signed in to a different Void account. Start again with a login method already linked to your original account.");
 	savePlatformToken(freshToken, apiUrl);
 	const launch = await client.startIdentityLink(target.id);
-	log.info(`Authenticate with ${target.label}, then review and confirm the identity in your browser.\n${launch.url}`);
-	openBrowser(launch.url, execFile);
+	log.info(`Authenticate with ${target.label}, then review and confirm the identity in your browser.\n${formatUrl(launch.url)}`);
+	openBrowser(launch.url);
 }
 //#endregion
 export { runAuthLink };