void 0.27.0 → 0.28.0

package/dist/cli/cloudflare-operation-process.mjs

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import { n as __toESM } from "../rolldown-runtime-DXIUcv95.mjs";
-import { a as join, n as dirname, u as resolve } from "../dist-BVqXeR_h.mjs";
+import { a as join, c as resolve, n as dirname } from "../dist-ipQi0Q8y.mjs";
 import { t as require_picocolors } from "../picocolors-BTps1_gs.mjs";
-import { n as getVoidUserAgent, t as getCfCliVersion } from "../cf-user-agent-lKblH3zU.mjs";
+import { l as formatUrl } from "../output-FNHKw5Ac.mjs";
+import { i as safePositional, n as getVoidUserAgent, r as readCfUploadOutput, t as getCfCliVersion } from "../cf-user-agent-ChjQp2MU.mjs";
 import { t as sanitizeTerminalLogText } from "../terminal-log-text-D9ACPOuG.mjs";
 import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { parsePlatformResourceOwnershipMarker } from "@void/platform";
 import { tmpdir } from "node:os";
-import { parse } from "jsonc-parser";
 import { stripVTControlCharacters } from "node:util";
+import { parse } from "jsonc-parser";
 import { spawn, spawnSync } from "node:child_process";
 import { setGlobalProxyFromEnv } from "node:http";
 import { getCloudflareAuthUseKeyringFromEnv } from "@cloudflare/workers-auth";
@@ -68,12 +70,33 @@ function cloudflareVerificationUrl(output) {
 	return /(?:Opening a link in your default browser:|Visit this link to authenticate:)\s*(https?:\/\/\S+)\s/i.exec(plain)?.[1] ?? /please visit:\s*(https?:\/\/\S+)\s/i.exec(plain)?.[1] ?? null;
 }
 function printCloudflareLoginLink(url) {
-	console.log(`Open this link if your browser did not open: ${url}`);
+	console.log(`Open this link if your browser did not open: ${formatUrl(url)}`);
 }
 function printCloudflareLoginPrompt(code) {
 	console.log(code ? `Opening Cloudflare login in your browser. Confirm the code ${import_picocolors.default.blue(code)} in your browser. Press Ctrl+C to cancel.` : "Opening Cloudflare login in your browser. Confirm the code shown in your browser. Press Ctrl+C to cancel.");
 }
 //#endregion
+//#region src/cli/platform-worker-user-agent.ts
+/** Attribute infrastructure uploads using the installer's existing ownership proof. */
+function platformWorkerUploadAttribution(config) {
+	const vars = config.vars;
+	if (typeof vars?.PLATFORM_OWNERSHIP_MARKER !== "string") return;
+	try {
+		const marker = parsePlatformResourceOwnershipMarker(JSON.parse(vars.PLATFORM_OWNERSHIP_MARKER));
+		if (marker.resourceKind !== "worker" || marker.accountId !== config.account_id || marker.resourceName !== config.name || ![
+			"api-worker",
+			"proxy-worker",
+			"dispatch-worker",
+			"tail-worker",
+			"email-gateway-worker"
+		].includes(marker.resourceKey)) return;
+		const version = typeof vars.PLATFORM_VERSION === "string" ? vars.PLATFORM_VERSION : "unknown";
+		return `void-platform-install/${encodeURIComponent(version)} void-role/${marker.resourceKey} void-installation/${encodeURIComponent(marker.installationId)}`;
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/cli/cloudflare-operation-process.ts
 const cf = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "bin", "cf");
 const operation = (() => {
@@ -95,7 +118,7 @@ function cfEnvironment() {
 	const env = {
 		...process.env,
 		CF_DELEGATION: "1",
-		CLI_VERSION: getCfCliVersion(),
+		CLI_VERSION: getCfCliVersion(operation.type === "versions.upload" || operation.type === "worker.deploy" ? platformWorkerUploadAttribution(config()) : void 0),
 		CF_SEND_TELEMETRY: "false",
 		CF_NO_OSC_PROGRESS: "1",
 		CLOUDFLARE_AUTH_USE_KEYRING: process.env.CLOUDFLARE_AUTH_USE_KEYRING
@@ -230,7 +253,7 @@ async function withBuildOutput(raw, sourceMain, action) {
 		}), { mode: 384 });
 		const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? raw.account_id;
 		if (typeof accountId !== "string" || !accountId) throw new Error("Cloudflare account is not pinned for Worker deployment.");
-		const { prepareCfBuildOutput } = await import("../cf-build-output-H9a97vME.mjs");
+		const { prepareCfBuildOutput } = await import("../cf-build-output-2u583yJK.mjs");
 		const output = await prepareCfBuildOutput(scratch, accountId);
 		if (!output) throw new Error("Could not prepare the Cloudflare Worker build output.");
 		try {
@@ -399,7 +422,13 @@ async function readVersionResources(worker, versionId) {
 	if (!Array.isArray(resources.bindings) || !resources.script || !resources.script_runtime) throw new Error("Cloudflare Worker version resources were incomplete.");
 	return resources;
 }
-async function apiHeaders() {
+let cachedApiHeaders;
+/** This process runs one operation, so the credential is read once. */
+function apiHeaders() {
+	cachedApiHeaders ??= readApiHeaders();
+	return cachedApiHeaders;
+}
+async function readApiHeaders() {
 	const key = process.env.CLOUDFLARE_API_KEY ?? process.env.CF_API_KEY;
 	const email = process.env.CLOUDFLARE_EMAIL ?? process.env.CF_EMAIL;
 	if (key && email) return {
@@ -909,10 +938,7 @@ async function workerChanges() {
 		});
 		if (matching.length > 1) throw new Error("Queue consumer Worker identity is ambiguous.");
 		for (const item of matching) {
-			if (typeof item.consumer_id !== "string" || !item.consumer_id || item.consumer_id.startsWith("-") || /\s/.test(item.consumer_id) || [...item.consumer_id].some((character) => {
-				const code = character.charCodeAt(0);
-				return code < 32 || code === 127;
-			}) || item.type !== void 0 && item.type !== "worker") throw new Error("Queue consumer ID or type is invalid.");
+			if (!safePositional(item.consumer_id) || /\s/.test(item.consumer_id) || item.type !== void 0 && item.type !== "worker") throw new Error("Queue consumer ID or type is invalid.");
 			const deleted = runCf([
 				"queues",
 				"consumers",
@@ -959,11 +985,11 @@ async function workerChanges() {
 		try {
 			uploaded = object(parsedJson(called.stdout));
 		} catch {}
-		const output = called.stdout;
-		const versionId = uploaded.version_id ?? uploaded.id ?? uploaded.versionId ?? output.match(/(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i)?.[1];
+		const printed = readCfUploadOutput(called.stdout);
+		const versionId = uploaded.version_id ?? uploaded.id ?? uploaded.versionId ?? printed.versionId;
 		if (typeof versionId !== "string" || !/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(versionId)) throw new Error("Cloudflare did not return the uploaded Worker version ID.");
-		const previewUrl = typeof uploaded.preview_url === "string" ? uploaded.preview_url : output.match(/Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i)?.[1];
-		const workersDevUrl = typeof uploaded.workers_dev_url === "string" ? uploaded.workers_dev_url : output.match(/(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i)?.[1];
+		const previewUrl = typeof uploaded.preview_url === "string" ? uploaded.preview_url : printed.previewUrl;
+		const workersDevUrl = typeof uploaded.workers_dev_url === "string" ? uploaded.workers_dev_url : printed.workersDevUrl;
 		return result(0, "", called.stderr, {
 			versionId,
 			...previewUrl ? { previewUrl } : {},

package/dist/cli/env-schema-probe.d.mts

@@ -1,44 +1,20 @@
-import "../env-public-DR7ZM6d-.mjs";
+import "../env-public-CCdykygU.mjs";
 import "../types-CKWnYgfy.mjs";
 import "@void/deploy-cloudflare";
 //#region src/cli/env-validation.d.ts
-/**
- * The stable, values-free classification of a self-host schema failure.
- * env.ts evaluation and Standard-Schema validators run ARBITRARY user code that
- * can embed an env value in a thrown/rejected error (its `message`, `stack`, or
- * `cause`), and `VOID_ENV_UNMASK` disables redaction — so the original error is
- * never surfaced. Every {@link SelfHostSchemaError} instead carries only one of
- * these codes plus fixed text, so neither its message, its `reason` field, nor
- * its JSON serialization can echo a value.
- *   - `schema-load-failed`      — importing/evaluating the user's env.ts threw.
- *   - `schema-validation-error` — a registered validator threw or rejected while
- *                                 checking a production value.
- */
 type SelfHostSchemaFailureReason = "schema-load-failed" | "schema-validation-error";
-/**
- * The env-INSENSITIVE structural facts the self-host secret gate needs from the
- * project's env schema: whether a schema is registered, every server key, and the
- * REQUIRED key names (validators that reject the absent value). These are fixed by
- * env.ts's structure and require no dotenv loading.
- */
+/** Schema structure the gate needs, read once in the env-schema probe child. */
 type SelfHostSchemaFacts = {
-  /** Whether the project registered an env schema at all (no schema → nothing to gate). */
   hasSchema: boolean;
-  /** Every server-only schema key. These may never be emitted as plaintext vars. */
+  /** Server-only keys. These may never be emitted as plaintext vars. */
   serverKeys: Array<string>;
-  /** Required key NAMES — validator rejects `undefined`. Values-free. */
   requiredKeys: Array<string>;
 };
 //#endregion
 //#region src/cli/env-schema-probe.d.ts
-/** Input handed to the child (JSON in argv[3]). Path only — no env values cross here. */
 export type EnvSchemaProbeInput = {
   root: string;
 };
-/**
- * The structured result of the `facts` operation. `ok` carries the env-insensitive
- * schema facts; `schema-error` surfaces a values-free env.ts/validator failure.
- */
 export type EnvSchemaProbeResult = {
   kind: "ok";
   facts: SelfHostSchemaFacts;
@@ -46,11 +22,6 @@ export type EnvSchemaProbeResult = {
   kind: "schema-error";
   reason: SelfHostSchemaFailureReason;
 };
-/**
- * The structured result of the `validate-emitted` operation. `invalid-keys` carries
- * the FAILING key NAMES only (never a value); `schema-error` surfaces a values-free
- * env.ts/validator failure.
- */
 export type EnvSchemaValidateResult = {
   kind: "invalid-keys";
   invalidKeys: Array<string>;
@@ -58,10 +29,8 @@ export type EnvSchemaValidateResult = {
   kind: "schema-error";
   reason: SelfHostSchemaFailureReason;
 };
-/** Minimal structural shape of a `spawnSync`-style result (injectable in tests). */
 export type EnvSchemaProbeSpawnResult = {
   status: number | null;
-  /** The fd-3 buffer (the framed result) — dedicated so stdout noise can't truncate it. */
   fd3: string | null;
   error?: Error | null;
   signal?: NodeJS.Signals | null;
@@ -70,15 +39,8 @@ export type EnvSchemaProbeSpawn = (command: string, args: Array<string>, options
   cwd: string;
   env: NodeJS.ProcessEnv;
 }) => EnvSchemaProbeSpawnResult;
-/**
- * PARENT side (`facts`): return the env-insensitive schema facts. Runs pre-build so
- * a broken env.ts fails fast, before any account operation.
- */
+/** Runs before the build so a broken env.ts fails before any account operation. */
 export declare function resolveEnvSchemaFactsViaSubprocess(input: EnvSchemaProbeInput, env: NodeJS.ProcessEnv, spawn?: EnvSchemaProbeSpawn): Promise<EnvSchemaProbeResult>;
-/**
- * PARENT side (`validate-emitted`): validate the REAL emitted worker `vars` against
- * the schema validators and return the FAILING key NAMES only. Runs post-build so
- * the values validated are exactly what the worker ships.
- */
+/** Runs after the build so it validates exactly the vars the Worker ships. */
 export declare function validateEmittedVarsViaSubprocess(input: EnvSchemaProbeInput, env: NodeJS.ProcessEnv, spawn?: EnvSchemaProbeSpawn): Promise<EnvSchemaValidateResult>;
 //#endregion

package/dist/cli/env-schema-probe.mjs

@@ -1,47 +1,19 @@
-import { t as findEnvFile } from "../env-types-CwXgeMgL.mjs";
+import { t as findEnvFile } from "../env-types-DS2_y4X8.mjs";
 import { writeSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 //#region src/cli/env-schema-probe.ts
 /**
-* The self-host `void deploy --platform cloudflare` orchestrator validates the REAL
-* build artifact (`dist/ssr/wrangler.json` `vars`) instead of predicting it. Two
-* pieces still need project code, and BOTH run here — in an ISOLATED SUBPROCESS —
-* because the orchestrator runs in a credential-bearing PARENT (CF Access service
-* token / `CLOUDFLARE_API_TOKEN` in `process.env`) and must NOT evaluate arbitrary
-* project code in-process:
-*
-*   1. `facts` — the env-INSENSITIVE server and required key names, fixed by
-*      env.ts's structure.
-*   2. `validate-emitted` — validate the REAL emitted worker `vars` (post-build
-*      ground truth) against the schema's Standard-Schema validators and return the
-*      FAILING key NAMES only. A required var shipped with an INVALID value (fails
-*      the validator) must fail the deploy closed before any remote mutation, not
-*      only at worker boot.
-*
-* Three hardening rules apply to the child:
-*   - the framed result is written to a DEDICATED file descriptor (fd 3), NOT
-*     stdout, so anything the user's code prints while evaluating can never
-*     truncate or interleave with the result;
-*   - the caller scrubs the FULL wrangler-auth credential set from the child env
-*     (neither derivation needs credentials);
-*   - the parent NEVER captures the child's stdout/stderr — they are IGNORED
-*     (fds 1 + 2), never buffered — so a leaking env.ts / validator cannot print a
-*     raw secret to the terminal or CI log, and every failure surfaces as a stable
-*     classification only.
+* Runs the project's env.ts for the self-host deploy in a child process. The caller
+* passes the build env with Cloudflare credentials removed. Two operations: `facts`
+* (server and required key names) and `validate-emitted` (emitted vars that fail the
+* schema). The child writes its result to fd 3 and its stdout/stderr are ignored, so
+* user output cannot corrupt the result or print a secret into the deploy log.
+* Anything unexpected fails closed.
 */
-/** argv[2] sentinel that switches this module from library import to child-process entry. */
+/** argv[2] marker that runs this module as the child. */
 const PROBE_MARKER = "__void-deploy-env-schema-probe__";
-/** The dedicated fd the child writes its framed result to (see stdio config below). */
 const RESULT_FD = 3;
-/**
-* Default spawner: run THIS module as a child and read ONLY the dedicated fd-3
-* result. stdin is ignored, stdout/stderr are IGNORED (fds 1 + 2) so a broken /
-* leaking env.ts can never print a raw secret to the terminal or a captured CI log,
-* and fd 3 is a pipe carrying the framed JSON result. `spawnSync`'s `output` array
-* is indexed by fd, so `output[3]` is the result channel — isolated from stdout
-* entirely (and unaffected by ignoring fds 1 + 2).
-*/
 const defaultSpawn = (command, args, options) => {
 	const result = spawnSync(command, args, {
 		cwd: options.cwd,
@@ -62,19 +34,7 @@ const defaultSpawn = (command, args, options) => {
 		signal: result.signal ?? null
 	};
 };
-/**
-* Spawn THIS module as a child (`node <self> <marker> <json>`) under the scrubbed
-* `env` for one operation, and return its framed fd-3 result. The child inherits
-* ONLY `env` (the caller scrubs the full wrangler-auth credential set), so the
-* arbitrary project code never sees the parent's credentials. `import.meta.url` is
-* this module's own path — a named build entry (`dist/cli/env-schema-probe.mjs`),
-* stable in source and dist — so the child re-enters here and hits the {@link
-* PROBE_MARKER} branch. Throws (caller fails closed) on a spawn error, a signal-kill,
-* a nonzero exit, or a missing/unparseable result — exactly the cases where the
-* project code itself could not be evaluated. NEVER echoes the child's
-* stdout/stderr (never captured), so no env value the child may have printed can
-* reach the thrown error.
-*/
+/** Run this module as the child for one operation and parse its fd-3 result. */
 async function spawnEnvSchemaProbe(op, input, env, spawn) {
 	const childInput = {
 		op,
@@ -96,10 +56,7 @@ async function spawnEnvSchemaProbe(op, input, env, spawn) {
 	if (!parsed) throw new Error("the env-schema probe produced no parseable result.");
 	return parsed;
 }
-/**
-* PARENT side (`facts`): return the env-insensitive schema facts. Runs pre-build so
-* a broken env.ts fails fast, before any account operation.
-*/
+/** Runs before the build so a broken env.ts fails before any account operation. */
 async function resolveEnvSchemaFactsViaSubprocess(input, env, spawn = defaultSpawn) {
 	if (findEnvFile(input.root) === null) return {
 		kind: "ok",
@@ -113,22 +70,12 @@ async function resolveEnvSchemaFactsViaSubprocess(input, env, spawn = defaultSpa
 	if (result.kind === "invalid-keys") throw new Error("the env-schema probe returned an unexpected result for the facts operation.");
 	return result;
 }
-/**
-* PARENT side (`validate-emitted`): validate the REAL emitted worker `vars` against
-* the schema validators and return the FAILING key NAMES only. Runs post-build so
-* the values validated are exactly what the worker ships.
-*/
+/** Runs after the build so it validates exactly the vars the Worker ships. */
 async function validateEmittedVarsViaSubprocess(input, env, spawn = defaultSpawn) {
 	const result = await spawnEnvSchemaProbe("validate-emitted", input, env, spawn);
 	if (result.kind === "ok") throw new Error("the env-schema probe returned an unexpected result for the validate-emitted operation.");
 	return result;
 }
-/**
-* Parse the child's framed result from the DEDICATED fd-3 channel. The whole buffer
-* is the JSON result (nothing else writes to fd 3), so no sentinel scan is needed:
-* config/env.ts stdout noise lives on a different fd and can never reach here. Returns undefined on a missing/unparseable/ill-shaped result
-* so the caller fails closed.
-*/
 function parseProbeResult(fd3) {
 	const trimmed = fd3.trim();
 	if (!trimmed) return;
@@ -153,22 +100,16 @@ function parseProbeResult(fd3) {
 		reason: record.reason
 	};
 }
-/** Structural guard for the values-free facts the child returns. */
 function isSchemaFacts(value) {
 	if (!value || typeof value !== "object") return false;
 	const f = value;
 	return typeof f.hasSchema === "boolean" && Array.isArray(f.requiredKeys) && f.requiredKeys.every((k) => typeof k === "string") && Array.isArray(f.serverKeys) && f.serverKeys.every((k) => typeof k === "string");
 }
-/** Write the framed result to the dedicated fd 3 (synchronous → flushed before exit). */
 function emitResult(result) {
 	writeSync(RESULT_FD, JSON.stringify(result));
 }
-/**
-* CHILD side (`facts`): import the user's env.ts and derive its structural schema
-* facts. The import stays isolated because env.ts is arbitrary project code.
-*/
 async function runFactsChild(root) {
-	const { deriveSelfHostSchemaFacts, SelfHostSchemaError } = await import("../env-validation-CrVNjsPm.mjs");
+	const { deriveSelfHostSchemaFacts, SelfHostSchemaError } = await import("../env-validation-CTn-HhG1.mjs");
 	try {
 		emitResult({
 			kind: "ok",
@@ -185,15 +126,9 @@ async function runFactsChild(root) {
 		throw err;
 	}
 }
-/**
-* CHILD side (`validate-emitted`): read the REAL emitted worker `vars` the build
-* baked into `dist/ssr/wrangler.json` (ground truth), validate them against the
-* schema's validators, and emit the FAILING key NAMES only. The parent already
-* confirmed the artifact exists, so a read failure here is a probe-infrastructure
-* fault → fail closed as a values-free schema error.
-*/
+/** The parent already found the emitted config, so a read failure here fails closed. */
 async function runValidateEmittedChild(root) {
-	const { computeInvalidEmittedKeys, readEmittedWorkerVars, SelfHostSchemaError } = await import("../env-validation-CrVNjsPm.mjs");
+	const { computeInvalidEmittedKeys, readEmittedWorkerVars, SelfHostSchemaError } = await import("../env-validation-CTn-HhG1.mjs");
 	const emitted = readEmittedWorkerVars(root);
 	if (!emitted.ok) {
 		emitResult({
@@ -218,7 +153,6 @@ async function runValidateEmittedChild(root) {
 		throw err;
 	}
 }
-/** Dispatch the child to the requested operation. */
 async function runEnvSchemaProbeChild(rawInput) {
 	const input = JSON.parse(rawInput);
 	if (input.op === "validate-emitted") {

package/dist/client-C1BjRn3g.mjs

@@ -0,0 +1,2 @@
+import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+export { PlatformClient };