void 0.9.3 → 0.10.1

package/dist/{deploy-RQXpVBL-.mjs → deploy-Cwa5sooV.mjs}

@@ -3,12 +3,12 @@ import { a as join, c as resolve, i as isAbsolute, n as dirname, r as extname, s
 import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { t as findVoidAuthConfig } from "./config-hhMYPVRT.mjs";
-import { a as isExpiredTokenError, c as getToken, i as isCliOutdatedError, l as getTokenSource, n as PlatformClient, o as parsePlatformErrorBody, t as PlatformApiError, u as isStagingMode } from "./client-DIfOFf1W.mjs";
+import { a as isExpiredTokenError, d as getToken, f as getTokenSource, i as isCliOutdatedError, n as PlatformClient, o as parsePlatformErrorBody, p as isStagingMode, t as PlatformApiError } from "./client-D4awzTnj.mjs";
 import { c as R, g as ge, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
-import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes } from "./scan-B2H1Vo2C.mjs";
-import { i as inferProjectBindings, l as validateSsrEntry, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference--7geW5Z2.mjs";
+import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes } from "./scan-DGEp1-1Q.mjs";
+import { i as inferProjectBindings, l as validateSsrEntry, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-C3fLzFvP.mjs";
 import { i as voidWarn, r as voidLog } from "./log-BdD_Fpms.mjs";
 import { t as discoverSchema } from "./discover-C8N1I4tK.mjs";
 import { t as findEnvFile } from "./env-types-CaJaIRXU.mjs";
@@ -19,18 +19,19 @@ import { n as buildMigrationPlanBundle } from "./plan-aD3wRDqF.mjs";
 import { r as validateMigrations, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
 import { t as scanPages } from "./scan-VCAM1oh3.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-M3pxItg2.mjs";
-import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-DCUrFJxa.mjs";
+import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-VkAnACKX.mjs";
-import { t as promptForLoginToken } from "./login-tt1OmNVg.mjs";
-import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-2aBxMfY1.mjs";
+import { t as collectGitDeployMetadata } from "./git-metadata-Ce0AtSZL.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BNWymgnH.mjs";
+import { t as promptForLoginToken } from "./login-Ca6mhQVI.mjs";
+import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-B7ZQZn0u.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { build, loadEnv } from "vite";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { execFile, execFileSync, execSync, spawnSync } from "node:child_process";
+import { execFile, execSync, spawnSync } from "node:child_process";
 import { parse } from "jsonc-parser";
 import { hash } from "blake3-jit";
 import ignore from "ignore";
@@ -1167,86 +1168,6 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-//#region src/cli/git-metadata.ts
-function git(root, args) {
-	try {
-		return execFileSync("git", args, {
-			cwd: root,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return null;
-	}
-}
-function stripGitSuffix(pathname) {
-	return pathname.endsWith(".git") ? pathname.slice(0, -4) : pathname;
-}
-function normalizeGitRemoteUrl(remote) {
-	if (!remote) return null;
-	const trimmed = remote.trim();
-	if (!trimmed) return null;
-	const scpLike = /^(?:[^@]+@)?([^:]+):(.+)$/.exec(trimmed);
-	if (scpLike && !trimmed.includes("://")) {
-		const host = scpLike[1]?.toLowerCase();
-		const path = stripGitSuffix(scpLike[2] ?? "").replace(/^\/+/, "");
-		return host && path ? `https://${host}/${path}` : null;
-	}
-	try {
-		const url = new URL(trimmed);
-		if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "ssh:") return null;
-		const host = url.hostname.toLowerCase();
-		const path = stripGitSuffix(url.pathname).replace(/^\/+/, "");
-		return host && path ? `https://${host}/${path}` : null;
-	} catch {
-		return null;
-	}
-}
-function buildCommitUrl(repositoryUrl, commit) {
-	if (!repositoryUrl || !commit) return null;
-	try {
-		const url = new URL(repositoryUrl);
-		if (url.hostname === "github.com") return `${repositoryUrl}/commit/${commit}`;
-		if (url.hostname === "gitlab.com") return `${repositoryUrl}/-/commit/${commit}`;
-		if (url.hostname === "bitbucket.org") return `${repositoryUrl}/commits/${commit}`;
-	} catch {
-		return null;
-	}
-	return null;
-}
-function getGitRefFromEnv(env) {
-	if (env.GITHUB_HEAD_REF) return env.GITHUB_HEAD_REF;
-	if (env.GITHUB_REF_NAME) return env.GITHUB_REF_NAME;
-	if (env.GITHUB_REF) return env.GITHUB_REF.replace(/^refs\/(?:heads|tags|pull)\//, "");
-	return null;
-}
-function getGitHubRepositoryUrl(env) {
-	if (!env.GITHUB_REPOSITORY) return null;
-	return normalizeGitRemoteUrl(`${env.GITHUB_SERVER_URL ?? "https://github.com"}/${env.GITHUB_REPOSITORY}`);
-}
-function collectGitDeployMetadata(root, commit, env = process.env) {
-	const repositoryUrl = getGitHubRepositoryUrl(env) ?? normalizeGitRemoteUrl(git(root, [
-		"remote",
-		"get-url",
-		"origin"
-	]));
-	const gitRef = getGitRefFromEnv(env) ?? git(root, [
-		"rev-parse",
-		"--abbrev-ref",
-		"HEAD"
-	]);
-	return {
-		commit,
-		commitUrl: buildCommitUrl(repositoryUrl, commit),
-		gitRef: gitRef && gitRef !== "HEAD" ? gitRef : null,
-		repositoryUrl
-	};
-}
-//#endregion
 //#region src/cli/log-file.ts
 /**
 * Walk `err.cause` up to 6 levels and return a plain JSON-friendly chain.
@@ -2292,6 +2213,7 @@ function generateHandlersSource(root, features) {
 //#region src/cli/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({
 	applyDeployEvent: () => applyDeployEvent,
+	buildEnv: () => buildEnv,
 	ensurePreviouslyDeployedLiveBindingConfig: () => ensurePreviouslyDeployedLiveBindingConfig,
 	generateDeployWrapperIfNeeded: () => generateDeployWrapperIfNeeded,
 	hasDeploySchemaDrift: () => hasDeploySchemaDrift,
@@ -2305,7 +2227,9 @@ var deploy_exports = /* @__PURE__ */ __exportAll({
 	resolveWorkerDirName: () => resolveWorkerDirName,
 	runDeploy: () => runDeploy,
 	runStaticDeploy: () => runStaticDeploy,
-	warnRedundantForceOn3xx: () => warnRedundantForceOn3xx
+	streamDeployEvents: () => streamDeployEvents,
+	warnRedundantForceOn3xx: () => warnRedundantForceOn3xx,
+	warnUnpublishedRouting: () => warnUnpublishedRouting
 });
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve("drizzle-kit")), "..", "bin.cjs");
 const deployDriftCheckDir = join(".void", "deploy-drift-check");
@@ -2423,6 +2347,33 @@ async function runDeploy(root, options) {
 		await cliLog.close().catch(() => {});
 	}
 }
+/**
+* Build a child-process environment with the CF Access service-token PAIR
+* removed.
+*
+* The deploy flow spawns UNTRUSTED user build code (`vite build`, framework
+* preset builds, drizzle-kit loading the user schema) which inherits the
+* spawn env. A shared, long-lived CF Access service token is needed only by
+* this CLI's own API client (which captures the Access headers once at
+* construction and reuses them for every request) — never by the build — so it
+* must not survive into those children, or it would leak to arbitrary repo
+* build scripts/plugins.
+*
+* We scrub it on the CHILD env rather than mutating `process.env`: deleting it
+* from the parent also breaks interactive expired-token re-auth, which reads
+* `cfAccessHeaders(process.env)` / the cloudflared pair-guard AFTER the build
+* step. Only the service-token pair is scrubbed; the cloudflared
+* `CF_ACCESS_TOKEN` JWT (dev path) is left untouched.
+*/
+function buildEnv(extra) {
+	const env = {
+		...process.env,
+		...extra
+	};
+	delete env.CF_ACCESS_CLIENT_ID;
+	delete env.CF_ACCESS_CLIENT_SECRET;
+	return env;
+}
 async function runDeployInner(root, options, cliLog) {
 	let reauthenticated = false;
 	while (true) try {
@@ -2598,7 +2549,8 @@ function applyDeployEvent(event, s) {
 			s.message(`Prerendering ${event.pages} pages...`);
 			return { kind: "continue" };
 		case "done":
-			s.stop("Deployed!");
+			if (event.published === false) s.stop("Deployed, but routing was not published — the project may be unreachable or still serving the previous deploy. Re-run `void deploy` to publish routing.");
+			else s.stop("Deployed!");
 			return {
 				kind: "done",
 				event
@@ -2639,12 +2591,14 @@ async function streamDeployEvents(projectId, events, s, cliLog) {
 				deploymentId = result.deploymentId;
 				cliLog?.info("stream_deployment_id", { deploymentId });
 			} else if (result.kind === "done") {
-				cliLog?.info("deploy_success", {
+				const degraded = result.event.published === false;
+				cliLog?.info(degraded ? "deploy_degraded" : "deploy_success", {
 					deploymentId,
 					url: result.event.url,
 					assets: result.event.assets,
 					workers: result.event.workers,
-					durationMs: Date.now() - startedAt
+					durationMs: Date.now() - startedAt,
+					degraded
 				});
 				return result.event;
 			} else if (result.kind === "error") {
@@ -2784,7 +2738,8 @@ async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetad
 		const buildStartedAt = Date.now();
 		execSync(preset.buildCommand, {
 			cwd: root,
-			stdio: "inherit"
+			stdio: "inherit",
+			env: buildEnv()
 		});
 		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 	} else if (skipBuild) cliLog?.info("build_skipped", { reason: "skipBuild" });
@@ -2836,9 +2791,21 @@ async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetad
 	});
 	const result = await streamDirectR2Deploy(client, config.projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, neededSet !== null, void 0, s, cliLog);
 	Se([`${typeLabel} — ${formatKnownAssetSummary(result, skipped)}`].join("\n"), result.url);
+	warnUnpublishedRouting(result);
 	ye("Done!");
 }
 /**
+* Surface a persistent warning when a deploy committed live but its routing
+* KV was not published. Uses `log.warn` (not the spinner) so the warning
+* survives the following `note`/`outro` calls and the user sees it after the
+* deploy summary. The deploy is still committed — this is a warning, not a
+* failure, so the process exit code is unaffected.
+*/
+function warnUnpublishedRouting(result) {
+	if (result.published !== false) return;
+	R.warn("Routing was not published for this deploy. The project may be unreachable (first deploy) or still serving the previous deploy. Re-run `void deploy` to publish routing.");
+}
+/**
 * Emit a single aggregated lint warning when a `_redirects` file contains
 * one or more `!` force suffixes on 3xx entries (e.g. `301!`, `302!`).
 * The `!` is a no-op on redirects — we parse them as if the `!` weren't
@@ -2866,7 +2833,8 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		const buildStartedAt = Date.now();
 		execSync(voidConfig.inference?.build ?? resolveProjectCommand(root, fwPreset.buildCommand), {
 			cwd: root,
-			stdio: "inherit"
+			stdio: "inherit",
+			env: buildEnv()
 		});
 		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 	} else cliLog?.info("build_skipped", { reason: "skipBuild" });
@@ -3043,6 +3011,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	summary.push(`Framework: ${detected.name}`);
 	Se(summary.join("\n"), result.url);
 	cleanupWrapper(root);
+	warnUnpublishedRouting(result);
 	ye("Done!");
 }
 async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetadata, detected, cliLog) {
@@ -3059,10 +3028,7 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 			execSync(resolveProjectCommand(root, "vite build"), {
 				cwd: root,
 				stdio: "inherit",
-				env: {
-					...process.env,
-					VOID_DEPLOY_PROJECT_ID: config.projectId
-				}
+				env: buildEnv({ VOID_DEPLOY_PROJECT_ID: config.projectId })
 			});
 			cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 		} catch (err) {
@@ -3343,6 +3309,7 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 	else summary.push(`ISR revalidate: ${Object.keys(revalidate).length} path rule(s)`);
 	if (isFrameworkMode) summary.push("Framework mode");
 	Se(summary.join("\n"), result.url);
+	warnUnpublishedRouting(result);
 	ye("Done!");
 }
 async function createProjectFromSlug(root, client, slug, cliLog) {
@@ -3365,17 +3332,21 @@ function getGitCommit(root) {
 	try {
 		const githubSha = process.env.GITHUB_SHA?.trim();
 		if (githubSha && /^[0-9a-f]{7,64}$/i.test(githubSha)) return githubSha;
+		const gitEnv = buildEnv();
 		execSync("git rev-parse --is-inside-work-tree", {
 			cwd: root,
-			stdio: "ignore"
+			stdio: "ignore",
+			env: gitEnv
 		});
 		if (execSync("git status --porcelain", {
 			cwd: root,
-			encoding: "utf-8"
+			encoding: "utf-8",
+			env: gitEnv
 		}).trim() !== "") return null;
 		return execSync("git rev-parse HEAD", {
 			cwd: root,
-			encoding: "utf-8"
+			encoding: "utf-8",
+			env: gitEnv
 		}).trim();
 	} catch {
 		return null;
@@ -3421,7 +3392,8 @@ function runDrizzleKitGenerate(root, configPath) {
 		configPath
 	], {
 		cwd: root,
-		encoding: "utf-8"
+		encoding: "utf-8",
+		env: buildEnv()
 	});
 	const stderr = bufferToString(result.stderr);
 	const output = [stderr, bufferToString(result.stdout)].filter(Boolean).join("\n").trim();

package/dist/{domain-B7RntQ1r.mjs → domain-WvoAHE6w.mjs}

@@ -1,5 +1,5 @@
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
 import { c as R, u as Se } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/domain.ts

package/dist/{env-C_ZcxxED.mjs → env-Cx4czPsR.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
 import { c as R, g as ge, u as Se, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CaJaIRXU.mjs";

package/dist/{env-helpers-Bd2wVdxz.d.mts → env-helpers-ZatKyjen.d.mts}

@@ -1,4 +1,4 @@
-import { t as StandardSchemaV1 } from "./standard-schema-Dnsh2vnl.mjs";
+import { t as StandardSchemaV1 } from "./standard-schema-BCBv-QaP.mjs";
 
 //#region src/shared/env-mask.d.ts
 /** Per-key override set by `.secret()` / `.public()` on built-in helpers. */

package/dist/{gen-O5mXZ76K.mjs → gen-Dgi4D7GC.mjs}

@@ -7,7 +7,7 @@ import { c as getDatabaseDialect, f as readConfig } from "./config-8dLIngKW.mjs"
 import { n as writeDrizzleConfig } from "./config--wXmVOoe.mjs";
 import { r as readJournal, t as collectMigrations } from "./collect-9rO3JFNM.mjs";
 import { n as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
-import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-0SwYgQxx.mjs";
+import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DhCHHLAz.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";

package/dist/git-metadata-Ce0AtSZL.mjs

@@ -0,0 +1,82 @@
+import { execFileSync } from "node:child_process";
+//#region src/cli/git-metadata.ts
+function git(root, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: root,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+function stripGitSuffix(pathname) {
+	return pathname.endsWith(".git") ? pathname.slice(0, -4) : pathname;
+}
+function normalizeGitRemoteUrl(remote) {
+	if (!remote) return null;
+	const trimmed = remote.trim();
+	if (!trimmed) return null;
+	const scpLike = /^(?:[^@]+@)?([^:]+):(.+)$/.exec(trimmed);
+	if (scpLike && !trimmed.includes("://")) {
+		const host = scpLike[1]?.toLowerCase();
+		const path = stripGitSuffix(scpLike[2] ?? "").replace(/^\/+/, "");
+		return host && path ? `https://${host}/${path}` : null;
+	}
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "ssh:") return null;
+		const host = url.hostname.toLowerCase();
+		const path = stripGitSuffix(url.pathname).replace(/^\/+/, "");
+		return host && path ? `https://${host}/${path}` : null;
+	} catch {
+		return null;
+	}
+}
+function buildCommitUrl(repositoryUrl, commit) {
+	if (!repositoryUrl || !commit) return null;
+	try {
+		const url = new URL(repositoryUrl);
+		if (url.hostname === "github.com") return `${repositoryUrl}/commit/${commit}`;
+		if (url.hostname === "gitlab.com") return `${repositoryUrl}/-/commit/${commit}`;
+		if (url.hostname === "bitbucket.org") return `${repositoryUrl}/commits/${commit}`;
+	} catch {
+		return null;
+	}
+	return null;
+}
+function getGitRefFromEnv(env) {
+	if (env.GITHUB_HEAD_REF) return env.GITHUB_HEAD_REF;
+	if (env.GITHUB_REF_NAME) return env.GITHUB_REF_NAME;
+	if (env.GITHUB_REF) return env.GITHUB_REF.replace(/^refs\/(?:heads|tags|pull)\//, "");
+	return null;
+}
+function getGitHubRepositoryUrl(env) {
+	if (!env.GITHUB_REPOSITORY) return null;
+	return normalizeGitRemoteUrl(`${env.GITHUB_SERVER_URL ?? "https://github.com"}/${env.GITHUB_REPOSITORY}`);
+}
+function collectGitDeployMetadata(root, commit, env = process.env) {
+	const repositoryUrl = getGitHubRepositoryUrl(env) ?? normalizeGitRemoteUrl(git(root, [
+		"remote",
+		"get-url",
+		"origin"
+	]));
+	const gitRef = getGitRefFromEnv(env) ?? git(root, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return {
+		commit,
+		commitUrl: buildCommitUrl(repositoryUrl, commit),
+		gitRef: gitRef && gitRef !== "HEAD" ? gitRef : null,
+		repositoryUrl
+	};
+}
+//#endregion
+export { collectGitDeployMetadata as t };