void 0.28.0 → 1.0.3

package/dist/platform-lifecycle-u9pMOvxC.mjs

@@ -0,0 +1 @@
+export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-DBiS0cJd.mjs";

package/dist/{platform-management-t7HKy4-U.mjs → platform-management-DhEFdQAf.mjs}

@@ -1,7 +1,8 @@
-import { _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
-import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-FNHKw5Ac.mjs";
-import { A as revalidatePlatformInstallAction, B as hyperdriveOriginConfigHash, C as formatPlatformInstallPlan, D as platformAdoptionIntentHash, E as matchesRecordedR2Fingerprint, H as hyperdriveOriginMatches, M as assertPlatformOperatorCredentialCanApplyPlan, N as resolvePlatformCloudflareCredential, O as r2BucketConfigHash, P as verifyPlatformCloudflareCredential, R as PlatformCloudflareApiError, S as dnsRecordConfigHash, T as legacyResourceConfigHash, U as verifyPlatformRuntimeTokenPermissions, V as hyperdriveOriginFromConnectionString, _ as resolveBootstrapGitHubId, a as REMOTE_INSTALLATION_MANIFEST_KEY, d as readPlatformProjectZeroTrustState, f as assertProjectZeroTrustAllowsUninstall, g as createPlatformInstallationSecrets, j as platformDatabaseNameFromOwnerUrl, k as resourceMarkerProblem, m as loadPlatformRuntime, n as resolvePlatformInstallDatabaseUrl, o as installPlatform, p as readPlatformDatabase, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as readPlatformProjectSlugs, w as hasProvisionIntentStep, x as createPlatformInstallPlan, y as platformTrafficAttachmentWorker, z as PlatformCloudflareClient } from "./platform-lifecycle-DOW-wLfx.mjs";
+import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-Ba6ZbrzY.mjs";
+import { A as matchesRecordedR2Fingerprint, B as activatePlatformAccessCredentials, C as platformTrafficAttachmentWorker, D as formatPlatformInstallPlan, E as dnsRecordConfigHash, F as platformDatabaseNameFromOwnerUrl, G as PlatformCloudflareClient, I as turnOffInstalledProjectZeroTrust, J as hyperdriveOriginMatches, K as hyperdriveOriginConfigHash, L as assertPlatformOperatorCredentialCanApplyPlan, M as r2BucketConfigHash, N as resourceMarkerProblem, O as hasProvisionIntentStep, P as revalidatePlatformInstallAction, R as resolvePlatformCloudflareCredential, T as createPlatformInstallPlan, W as PlatformCloudflareApiError, Y as verifyPlatformRuntimeTokenPermissions, _ as readPlatformDatabase, a as authenticationSetupRequestHash, b as createPlatformInstallationSecrets, c as REMOTE_INSTALLATION_MANIFEST_KEY, g as formatZeroTrustApplications, h as assertProjectZeroTrustAllowsUninstall, j as platformAdoptionIntentHash, k as legacyResourceConfigHash, l as installPlatform, m as readPlatformProjectZeroTrustState, n as resolvePlatformInstallDatabaseUrl, o as readLoginReplacementFile, p as readPlatformProjectSlugs, q as hyperdriveOriginFromConnectionString, s as replacePendingInstallationAuthentication, t as assertNoninteractivePlatformMutationAcknowledged, u as acquirePlatformDatabaseLifecycleLock, v as loadPlatformRuntime, x as resolveBootstrapGitHubId, y as createPlatformHealthProbeToken, z as verifyPlatformCloudflareCredential } from "./platform-lifecycle-DBiS0cJd.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 //#region src/cli/platform-teardown.ts
@@ -665,6 +666,8 @@ async function runInstalledPlatformCommand(args) {
 			return;
 		}
 		if (args.subcommand === "uninstall") {
+			const apiUrl = manifest.endpoints.apiUrl;
+			const appAccessSetupToken = recovery?.appAccessSetupToken;
 			await uninstallPlatform(client, manifest, args, {
 				checkpoint: databaseLock?.checkpoint,
 				databaseUrl,
@@ -676,7 +679,19 @@ async function runInstalledPlatformCommand(args) {
 				credential: {
 					source: operatorCredential.source,
 					aiGatewayToken: !!gatewayToken
-				}
+				},
+				...apiUrl && appAccessSetupToken ? { turnOffProjectZeroTrust: async () => {
+					const saved = recovery?.accessCredentialsJson ? JSON.parse(recovery.accessCredentialsJson) : {};
+					if (saved && typeof saved === "object" && apiUrl in saved) activatePlatformAccessCredentials(JSON.stringify({ [apiUrl]: saved[apiUrl] }), [apiUrl]);
+					if (manifest.deployment.authentication.accessProtection) ensurePlatformAccessToken(apiUrl, false, true);
+					await turnOffInstalledProjectZeroTrust({
+						apiUrl,
+						installationId: manifest.id,
+						probeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
+						setupToken: appAccessSetupToken,
+						updateCommand: readPendingInstallationSecrets(manifest) ? `void platform install --resume --name ${commandArgument(manifest.id)}` : `void platform upgrade ${commandArgument(manifest.id)}`
+					});
+				} } : {}
 			});
 			return;
 		}
@@ -684,6 +699,13 @@ async function runInstalledPlatformCommand(args) {
 			log.info(`${manifest.deployment.displayName} is already enabled.`);
 			return;
 		}
+		const loginFile = args.subcommand === "repair" ? args.authConfig : void 0;
+		if (loginFile !== void 0) {
+			if (manifest.desiredState === "disabled") throw new Error(`platform: This platform is disabled. Run \`void platform enable ${commandArgument(manifest.id)}\` first, then repair to change the login settings.`);
+			if (!manifest.deployment.authentication.configurable) throw new Error("platform: This installation signs in with the GitHub OAuth App from its installation settings. Set VOID_PLATFORM_GITHUB_CLIENT_ID and VOID_PLATFORM_GITHUB_CLIENT_SECRET when running repair to replace it.");
+			if (!recovery?.authenticationSetupJson || !recovery.authSetupToken) throw new Error("platform: Changing the login settings needs the setup authority saved on the computer that installed the platform. Run this repair there.");
+			await readLoginReplacementFile(loginFile, manifest.deployment.authentication, recovery.authenticationSetupJson);
+		}
 		const deployment = manifest.deployment;
 		const planInput = {
 			accountId: manifest.account.id,
@@ -715,6 +737,7 @@ async function runInstalledPlatformCommand(args) {
 		].join("\n"), "Platform runtime");
 		log.info(manifest.desiredState === "disabled" && args.subcommand !== "enable" ? "Application traffic will stay paused because this installation is disabled." : "Application traffic may pause briefly during a safe cutover.");
 		if (args.plan) {
+			if (loginFile !== void 0) log.info(`Login settings will be replaced from ${loginFile}; a new setup code is printed at the end.`);
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
@@ -726,6 +749,21 @@ async function runInstalledPlatformCommand(args) {
 			databaseUrl
 		});
 		markPhase("ownership");
+		let replacedLogin;
+		if (args.subcommand === "repair" && (loginFile !== void 0 || process.stdin.isTTY && !args.yes) && manifest.desiredState !== "disabled" && manifest.deployment.authentication.configurable && recovery?.authenticationSetupJson && recovery.authSetupToken) {
+			const setup = await databaseLock?.readAdministratorSetup?.();
+			if (loginFile !== void 0) {
+				if (!setup) throw new Error("platform: The database lifecycle lock cannot read the administrator setup.");
+				if (setup.usersExist || setup.requestHash !== null && !setup.pending) throw new Error("platform: The first administrator has already signed in. Change login methods with `void platform config auth`.");
+				if (setup.requestHash === null) throw new Error(`platform: Administrator setup was never started. Resume the install with \`void platform install --resume --name ${commandArgument(manifest.id)}\`.`);
+			}
+			if (setup?.pending && !setup.usersExist && (loginFile !== void 0 || await promptForConfirmation("First administrator setup is not finished. Change the login settings before continuing?", false))) replacedLogin = await replacePendingInstallationAuthentication({
+				...loginFile !== void 0 ? { file: loginFile } : {},
+				authentication: manifest.deployment.authentication,
+				setupJson: recovery.authenticationSetupJson,
+				apiUrl: plan.apiUrl
+			});
+		}
 		const installation = args.subcommand === "enable" ? setInstallationDesiredState(manifest, "enabled", (/* @__PURE__ */ new Date()).toISOString()) : manifest;
 		const bootstrapGitHubLogin = process.env.VOID_PLATFORM_ADMIN_GITHUB_LOGIN || recovery?.bootstrapGitHubLogin || "";
 		const bootstrapGitHubId = process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || recovery?.bootstrapGitHubId || (bootstrapGitHubLogin ? await resolveBootstrapGitHubId(bootstrapGitHubLogin) : "");
@@ -747,7 +785,8 @@ async function runInstalledPlatformCommand(args) {
 			projectSecretKeysJson: process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || "",
 			projectSecretActiveKeyVersion: process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION || "",
 			r2AccessKeyId: process.env.VOID_PLATFORM_R2_ACCESS_KEY_ID || "",
-			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || ""
+			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || "",
+			...replacedLogin
 		});
 		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets);
 		if (runtimeTokenToPreflight) await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(runtimeTokenToPreflight), {
@@ -763,6 +802,17 @@ async function runInstalledPlatformCommand(args) {
 		} });
 		progress.start(args.subcommand === "upgrade" ? "Upgrading the platform" : args.subcommand === "rollback" ? "Rolling back the platform" : args.subcommand === "enable" ? "Enabling the platform" : "Repairing the platform");
 		if (installation !== manifest) writeInstallationManifest(installation);
+		const keepAcceptedLogin = async (error) => {
+			const after = replacedLogin ? await databaseLock?.readAdministratorSetup?.().catch(() => void 0) : void 0;
+			if (!after || !recovery?.authenticationSetupJson || after.requestHash !== authenticationSetupRequestHash(recovery.authenticationSetupJson) || !after.usersExist && after.pending) return error;
+			const pending = readPendingInstallationSecrets(installation);
+			if (pending) writePendingInstallationSecrets(installation, {
+				...pending,
+				authenticationSetupJson: recovery.authenticationSetupJson,
+				...recovery.authBootstrapCode ? { authBootstrapCode: recovery.authBootstrapCode } : {}
+			});
+			return new Error("platform: The first administrator signed in before the new login settings were applied. Nothing changed. Change login methods with `void platform config auth`.", { cause: error });
+		};
 		const result = await installPlatform(plan, secrets, installation, {
 			acquireDatabaseLifecycleLock: async () => Object.assign(async () => {}, {
 				checkpoint: databaseLock?.checkpoint,
@@ -793,6 +843,8 @@ async function runInstalledPlatformCommand(args) {
 				repairMissing: args.subcommand === "repair",
 				stableWorkerUpdate: args.subcommand === "upgrade"
 			})
+		}).catch(async (error) => {
+			throw await keepAcceptedLogin(error);
 		});
 		progress.message("Finalizing platform changes");
 		markPhase("installer complete");
@@ -821,6 +873,8 @@ async function runInstalledPlatformCommand(args) {
 				if (code) {
 					log.info(`First administrator setup: ${formatUrl(`${plan.apiUrl}/setup`)}`);
 					console.log(`One-time administrator setup code: ${code}`);
+					log.info(`Login callback URL: ${formatUrl(`${plan.apiUrl}/auth/callback`)}`);
+					log.info(`If sign-in fails, run \`void platform repair ${commandArgument(manifest.id)}\` to change the login settings.`);
 				}
 			}
 			printSuccess(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
@@ -957,14 +1011,14 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	const interactive = dependencies.interactive ?? process.stdin.isTTY;
 	const confirmAction = dependencies.confirm ?? promptForConfirmation;
 	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
-	await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust);
+	const zeroTrust = await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust, { canTurnOff: !!dependencies.turnOffProjectZeroTrust });
 	if (purgeResources) await assertNoPlatformProjects(dependencies.readProjects);
-	if (args.plan || interactive && !args.yes) note(purgeResources ? purgeResourcesPlanText(manifest) : [
+	if (args.plan || interactive && !args.yes) note([...zeroTrust ? zeroTrust.turnOff.length ? ["Turn off project Zero Trust; no platform user exists yet. Delete its Access applications:", formatZeroTrustApplications(zeroTrust.turnOff)] : ["Turn off project Zero Trust; no platform user exists yet."] : [], purgeResources ? purgeResourcesPlanText(manifest) : [
 		"Disable platform traffic.",
 		retainData ? "Keep Workers and data." : "Delete eligible data; keep Workers, R2, and AI Gateway.",
 		"Delete unused Queues.",
 		...describeKeptResources(manifest, plannedKeptResources(manifest, retainData, hasRoutingCheckpoint), "Keep for manual cleanup:", "Keep Access resources:")
-	].join("\n"), import_picocolors.default.bold("Uninstall plan"));
+	].join("\n")].join("\n"), import_picocolors.default.bold("Uninstall plan"));
 	if (purgeResources) {
 		const credentialCheck = checkPurgeResourcesCredentials(client, manifest, dependencies.credential ?? {
 			source: "environment",
@@ -1013,6 +1067,10 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	}
 	const { fenceProjectZeroTrust, liftProjectZeroTrustFence, lockProjectZeroTrust } = dependencies;
 	if (!lockProjectZeroTrust || !fenceProjectZeroTrust || !liftProjectZeroTrustFence) throw new Error("platform: Refusing to uninstall because no platform database connection is available to hold off project Zero Trust changes.");
+	if (zeroTrust) {
+		log.step("Turning off project Zero Trust");
+		await dependencies.turnOffProjectZeroTrust();
+	}
 	const releaseProjectZeroTrust = await lockProjectZeroTrust();
 	let fenced = false;
 	let disablingTraffic = false;

package/dist/platform-management-DvBS83rC.mjs

@@ -0,0 +1 @@
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-DhEFdQAf.mjs";

package/dist/{platform-plans-config-CNH6zbPX.mjs → platform-plans-config-BWn1S2Rv.mjs}

@@ -1,5 +1,5 @@
-import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-BVdsO7Py.mjs";
+import { m as printSuccess } from "./output-Ba6ZbrzY.mjs";
 import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
 import { stripVTControlCharacters } from "node:util";

package/dist/{platform-recovery-DeucI7A9.mjs → platform-recovery-BUGOB4RC.mjs}

@@ -1,7 +1,7 @@
 import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { a as REMOTE_INSTALLATION_MANIFEST_KEY, x as createPlatformInstallPlan } from "./platform-lifecycle-DOW-wLfx.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-t7HKy4-U.mjs";
+import { T as createPlatformInstallPlan, c as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-DBiS0cJd.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-DhEFdQAf.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{platform-setup-CTf6MMT9.mjs → platform-setup-YvN9VQXV.mjs}

@@ -1,6 +1,6 @@
 import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
-import { L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { f as import_picocolors, s as formatLink } from "./output-FNHKw5Ac.mjs";
+import { L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
+import { f as import_picocolors, s as formatLink } from "./output-Ba6ZbrzY.mjs";
 //#region src/cli/platform-setup.ts
 /** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
 function platformPromptAnswer(value) {
@@ -228,7 +228,7 @@ function formatPlatformSetupPlan(plan, options = {}) {
 			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
 			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
 			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
-			"JWT signing key and project encryption key"
+			...process.stdin.isTTY ? [] : ["JWT signing key and project encryption key for non-interactive installs"]
 		].map((credential) => `• ${credential}`)
 	].join("\n");
 }

package/dist/prepare-CYT6tAzD.mjs

@@ -0,0 +1 @@
+export { t as prepareProject } from "./prepare-DEB5SeVJ.mjs";

package/dist/{prepare-CSH9dKTI.mjs → prepare-DEB5SeVJ.mjs}

@@ -2,12 +2,13 @@ import { a as join } from "./dist-ipQi0Q8y.mjs";
 import { n as loadVoidAuthConfig } from "./config-D0GY5ItR.mjs";
 import { d as readConfig } from "./config-Bx_1SpnO.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-bveqhlYA.mjs";
-import { i as generateDbDts, n as generateQueueTypes, t as generateRouteTypes } from "./route-types-IrBuwJ7u.mjs";
+import { n as generateDbDts } from "./db-types-Bb4WBWIs.mjs";
 import { t as discoverSchema } from "./discover-D2PGT63u.mjs";
 import { o as loadLocalEnv } from "./env-BJjULvL0.mjs";
 import { n as findEnvFileForPaths, r as generateEnvTypes } from "./env-types-DS2_y4X8.mjs";
-import { t as analyzeApplication } from "./application-routing-Dy589Vgn.mjs";
+import { t as analyzeApplication } from "./application-routing-L7V-TFhZ.mjs";
 import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-CF84FOVM.mjs";
+import { n as generateQueueTypes, t as generateRouteTypes } from "./route-types-BZi26DVS.mjs";
 import { existsSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/codegen/prepare.ts

package/dist/{prepare-C4zfwks4.mjs → prepare-PQCgsny0.mjs}

@@ -1,6 +1,6 @@
-import { L as log } from "./dist-D3m88sjf.mjs";
-import { m as printSuccess, p as note } from "./output-FNHKw5Ac.mjs";
-import { t as prepareProject } from "./prepare-CSH9dKTI.mjs";
+import { L as log } from "./dist-BVdsO7Py.mjs";
+import { m as printSuccess, p as note } from "./output-Ba6ZbrzY.mjs";
+import { t as prepareProject } from "./prepare-DEB5SeVJ.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root) {
 	console.log();

package/dist/prerender-render.mjs

@@ -1,2 +1 @@
-import { n as readPrerenderPathsResponse, r as renderPrerenderPaths, t as outputFileForPath } from "./prerender-render-Bfsumdkv.mjs";
-export { outputFileForPath, readPrerenderPathsResponse, renderPrerenderPaths };
+export { t as outputFileForPath, n as readPrerenderPathsResponse, r as renderPrerenderPaths } from "./prerender-render-Bfsumdkv.mjs";

package/dist/{project-cmd-Dq75AXzy.mjs → project-cmd-DVatD8Ev.mjs}

@@ -1,7 +1,7 @@
 import { n as readDeploymentPlatform } from "./project-rqDnVsJN.mjs";
 import { c as getToken, s as getSiteDomain } from "./auth-B6iOCjKI.mjs";
-import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
-import { _ as tablePrefix, f as import_picocolors, i as dim, l as formatUrl, o as formatCount } from "./output-FNHKw5Ac.mjs";
+import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
+import { _ as tablePrefix, f as import_picocolors, i as dim, l as formatUrl, o as formatCount } from "./output-Ba6ZbrzY.mjs";
 import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
@@ -38,77 +38,77 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-CuWeOnzk.mjs");
+		const { runListCommand } = await import("./list-CQ2EQEHL.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by cloudflare.name in void.config.ts and do not need linking.");
-		const { runLink } = await import("./link-UEc7bnF4.mjs");
+		const { runLink } = await import("./link-WMoJFf4i.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-CuWeOnzk.mjs");
+			const { runListCommand } = await import("./list-CQ2EQEHL.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
 	if (args.subcommand === "token") {
 		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
-		const { runProjectTokenCommand } = await import("./project-token-CvsRvv2I.mjs");
+		const { runProjectTokenCommand } = await import("./project-token-CBgLBuL6.mjs");
 		return runProjectTokenCommand(root, args);
 	}
 	if (args.subcommand === "team") {
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-s9q7LTcu.mjs");
+			const { printHelpPage } = await import("./help-i2YGGnTH.mjs");
 			printHelpPage(["project", "team"]);
 			return;
 		}
 		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
 		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
-		const { runProjectTeamCommand } = await import("./project-team-B3_QcStG.mjs");
+		const { runProjectTeamCommand } = await import("./project-team-DJrWEAG1.mjs");
 		return runProjectTeamCommand(root, args);
 	}
 	if (args.subcommand === "zero-trust") {
 		if (cloudflare) throw new Error("project: Zero Trust overrides are available only for projects hosted on a Void platform.");
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-s9q7LTcu.mjs");
+			const { printHelpPage } = await import("./help-i2YGGnTH.mjs");
 			printHelpPage(["project", "zero-trust"]);
 			return;
 		}
 		const action = args.action;
-		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-D1ICiwN_.mjs");
+		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-92gLtZ25.mjs");
 		return runProjectZeroTrustCommand(root, {
 			...args,
 			action
 		});
 	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-TihRcLTk.mjs");
+		const { runLogsCommand } = await import("./logs-DnC1d7xB.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-3CL3BuZh.mjs");
+		const { runRequestsCommand } = await import("./requests-7W1Pygt2.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-Ce1d_0J9.mjs");
+		const { runRollbackCommand } = await import("./rollback-BcASVnwP.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-CJKvk7AN.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-CD9o-SsC.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-BbsZFZIw.mjs");
+		const { runDeleteCommand } = await import("./delete-Cy-M1u-r.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-D0Tt28cn.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-Ctzfig-W.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/project-slug-6cyz8E7k.mjs

@@ -0,0 +1 @@
+export { t as validateProjectSlug } from "./project-slug-23TpquG4.mjs";

package/dist/{project-team-B3_QcStG.mjs → project-team-DJrWEAG1.mjs}

@@ -1,9 +1,9 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken, i as getAccountCredential } from "./auth-B6iOCjKI.mjs";
-import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
-import { h as sanitizeTerminalText, l as formatUrl, m as printSuccess, o as formatCount, p as note } from "./output-FNHKw5Ac.mjs";
+import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
+import { h as sanitizeTerminalText, l as formatUrl, m as printSuccess, o as formatCount, p as note } from "./output-Ba6ZbrzY.mjs";
 import { c as platformErrorMessage, n as PlatformApiError, r as PlatformClient, s as parsePlatformErrorBody } from "./client-DM9Kcf4e.mjs";
-import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-C_Cu7E8a.mjs";
+import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-WpwkCB_c.mjs";
 //#region src/cli/project-team.ts
 function clean(value) {
 	return (value ?? "—").replace(/[\u0000-\u001f\u007f]/g, " ");

package/dist/{project-token-CvsRvv2I.mjs → project-token-CBgLBuL6.mjs}

@@ -1,9 +1,9 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken } from "./auth-B6iOCjKI.mjs";
-import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
-import { _ as tablePrefix, i as dim, m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
+import { _ as tablePrefix, i as dim, m as printSuccess } from "./output-Ba6ZbrzY.mjs";
 import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
-import { r as requireProjectBySlug } from "./resolve-project-C_Cu7E8a.mjs";
+import { r as requireProjectBySlug } from "./resolve-project-WpwkCB_c.mjs";
 //#region src/cli/project-token.ts
 async function resolveTarget(root, args) {
 	const humanToken = getToken(root);

package/dist/project-zdB3fs9G.mjs

@@ -0,0 +1 @@
+export { t as attachSelectedPlatform, u as writeProjectConfig } from "./project-rqDnVsJN.mjs";

package/dist/{project-zero-trust-D1ICiwN_.mjs → project-zero-trust-92gLtZ25.mjs}

@@ -1,9 +1,9 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken } from "./auth-B6iOCjKI.mjs";
-import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
-import { h as sanitizeTerminalText, m as printSuccess, p as note } from "./output-FNHKw5Ac.mjs";
+import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
+import { h as sanitizeTerminalText, m as printSuccess, p as note } from "./output-Ba6ZbrzY.mjs";
 import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
-import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-C_Cu7E8a.mjs";
+import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-WpwkCB_c.mjs";
 //#region src/cli/project-zero-trust.ts
 async function resolveTarget(root, args) {
 	const token = getToken(root);

package/dist/{provision-DDh7ITVS.mjs → provision-BnSSkiED.mjs}

@@ -1469,7 +1469,7 @@ async function reconcileD1(desired, configPath, runWrangler, write, persistCreat
 				const parsed = isCleanSuccess(auth) && isRecord(auth.data) ? auth.data : void 0;
 				if ((parsed?.type === "oauth" || parsed?.type === "api_token") && typeof parsed.token === "string") token = parsed.token;
 			}
-			if (!token) throw new Error("provision: D1 read replication requires a Cloudflare API bearer with D1 Edit permission. Log in with `wrangler login` or set CLOUDFLARE_API_TOKEN, then retry.");
+			if (!token) throw new Error("provision: D1 read replication requires a Cloudflare API bearer with D1 Edit permission. Run `void cloudflare login`, or set CLOUDFLARE_API_TOKEN, then retry.");
 			await enableD1ReadReplicationViaApi(context, token);
 		}
 	}

package/dist/{requests-3CL3BuZh.mjs → requests-7W1Pygt2.mjs}

@@ -1,7 +1,7 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken } from "./auth-B6iOCjKI.mjs";
-import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
-import { f as import_picocolors, i as dim } from "./output-FNHKw5Ac.mjs";
+import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
+import { f as import_picocolors, i as dim } from "./output-Ba6ZbrzY.mjs";
 import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
 //#region src/cli/requests.ts
 async function runRequestsCommand(root, range, status) {

package/dist/resolve-project-PnhzMtY6.mjs

@@ -0,0 +1 @@
+export { n as inferDefaultSlug } from "./resolve-project-WpwkCB_c.mjs";

package/dist/{resolve-project-C_Cu7E8a.mjs → resolve-project-WpwkCB_c.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./dist-ipQi0Q8y.mjs";
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
-import { L as log } from "./dist-D3m88sjf.mjs";
+import { L as log } from "./dist-BVdsO7Py.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/resolve-project.ts
 function getRequestedProjectSlug(options) {

package/dist/{rollback-Ce1d_0J9.mjs → rollback-BcASVnwP.mjs}

@@ -1,7 +1,7 @@
 import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken } from "./auth-B6iOCjKI.mjs";
-import { A as confirm, H as outro, K as select, L as log, O as cancel, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { c as formatRelativeTime, i as dim, m as printSuccess, o as formatCount, r as createSpinner } from "./output-FNHKw5Ac.mjs";
+import { A as confirm, H as outro, K as select, L as log, O as cancel, tt as isCancel } from "./dist-BVdsO7Py.mjs";
+import { c as formatRelativeTime, i as dim, m as printSuccess, o as formatCount, r as createSpinner } from "./output-Ba6ZbrzY.mjs";
 import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
 //#region src/cli/rollback.ts
 async function runRollbackCommand(root, deployId) {
@@ -74,7 +74,7 @@ async function runRollbackCommand(root, deployId) {
 	}
 }
 async function runCloudflareRollback(root, deployId) {
-	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-Ds-lX3Ts.mjs");
+	const { activateCloudflareExistingVersion, readCloudflareWorkerStatus, resolveCloudflareOperationContext } = await import("./cloudflare-operations-CrSUFRzJ.mjs");
 	const context = resolveCloudflareOperationContext(root);
 	const status = await readCloudflareWorkerStatus(context);
 	const deployedVersionIds = new Set(status.deployedVersionIds);

package/dist/{route-types-IrBuwJ7u.mjs → route-types-BZi26DVS.mjs}

@@ -1,51 +1,4 @@
-import { a as join, s as relative } from "./dist-ipQi0Q8y.mjs";
-import { r as writeFileIfChanged } from "./project-tsconfig-bveqhlYA.mjs";
-//#region src/codegen/db-types.ts
-const DRIZZLE_OPERATORS = "sql, eq, ne, gt, gte, lt, lte, and, or, not, desc, asc, like, ilike, notLike, inArray, notInArray, isNull, isNotNull, between, notBetween, exists, notExists, count, sum, avg, min, max";
-const DIALECT_DB_TYPES = {
-	sqlite: {
-		type: "DrizzleD1Database",
-		from: "void/_db",
-		arg: "d1: D1Database"
-	},
-	postgresql: {
-		type: "NodePgDatabase",
-		from: "void/_db-pg",
-		arg: "connectionString: string"
-	},
-	mysql: {
-		type: "MySql2Database",
-		from: "void/_db-mysql",
-		arg: "connectionString: string"
-	}
-};
-/**
-* Generate `.void/db.d.ts` with Drizzle types referencing the user's schema.
-*
-* This is a proper module file (not `declare module`) whose types override
-* the base `void/db` package via a tsconfig `paths` redirect:
-*   "void/db": ["./.void/db.d.ts"]
-*
-* Imports reference `void/_db` (internal subpath pointing at the same
-* base module) to avoid circular resolution through the paths redirect.
-*/
-function generateDbDts(outDir, schema, dialect) {
-	const { type, from, arg } = DIALECT_DB_TYPES[dialect];
-	const schemaType = schema ? "Schema" : "Record<string, never>";
-	const lines = [
-		"// Auto-generated by void — do not edit",
-		...dialect === "sqlite" ? ["/// <reference types=\"@cloudflare/workers-types\" />"] : [],
-		`import type { ${type} } from "${from}";`,
-		...schema ? ["import type * as schema from \"@schema\";", "type Schema = typeof schema;"] : [],
-		`export declare const db: ${type}<${schemaType}>;`,
-		`export declare function createDb(${arg}): ${type}<${schemaType}>;`,
-		`export { ${DRIZZLE_OPERATORS} } from "void/_db";`,
-		`export type { ${type} } from "${from}";`,
-		""
-	];
-	return writeFileIfChanged(join(outDir, "db.d.ts"), lines.join("\n"));
-}
-//#endregion
+import { s as relative } from "./dist-ipQi0Q8y.mjs";
 //#region src/codegen/queue-types.ts
 /**
 * Generate .void/queues.d.ts content.
@@ -265,4 +218,4 @@ function generateRouteTypes(scan, routesDir, outDir, pagesDir) {
 	return { dts: lines.join("\n") };
 }
 //#endregion
-export { generateDbDts as i, generateQueueTypes as n, DRIZZLE_OPERATORS as r, generateRouteTypes as t };
+export { generateQueueTypes as n, generateRouteTypes as t };

package/dist/{runner-DcVDrzuR.mjs → runner-CabsQ-iM.mjs}

@@ -138,12 +138,21 @@ async function runMigrations(migrationsDir, dbPath) {
 		const insertStmt = db.prepare("INSERT INTO _void_migrations (name) VALUES (?)");
 		const checkStmt = db.prepare("SELECT 1 FROM _void_migrations WHERE name = ?");
 		const appliedNames = [];
-		for (const migration of pending) if (db.transaction(() => {
-			if (checkStmt.get(migration.name)) return false;
-			db.exec(migration.sql);
-			insertStmt.run(migration.name);
-			return true;
-		}).immediate()) appliedNames.push(migration.name);
+		for (const migration of pending) {
+			const tx = db.transaction(() => {
+				if (checkStmt.get(migration.name)) return false;
+				db.exec(migration.sql);
+				insertStmt.run(migration.name);
+				return true;
+			});
+			let applied;
+			try {
+				applied = tx.immediate();
+			} catch (err) {
+				throw new Error(`migration ${migration.name} failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			}
+			if (applied) appliedNames.push(migration.name);
+		}
 		return appliedNames;
 	} finally {
 		db.close();

package/dist/runner-So9mYfcm.mjs

@@ -0,0 +1 @@
+export { t as getApplicationTables, n as getAppliedMigrations, r as getMiniflareDatabasePath, i as openSqliteDatabase, a as runMigrations } from "./runner-CabsQ-iM.mjs";