void 1.1.0 → 1.1.12

package/dist/{platform-lifecycle-u9pMOvxC.mjs → platform-lifecycle-CWc5gr6c.mjs}

@@ -1 +1 @@
-export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-DBiS0cJd.mjs";
+export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-3CR98Tg2.mjs";

package/dist/{platform-management-DvBS83rC.mjs → platform-management-DAE6g2QU.mjs}

@@ -1 +1 @@
-export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-DhEFdQAf.mjs";
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-o3LCCeE4.mjs";

package/dist/{platform-management-DhEFdQAf.mjs → platform-management-o3LCCeE4.mjs}

@@ -1,8 +1,8 @@
 import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-Ba6ZbrzY.mjs";
-import { A as matchesRecordedR2Fingerprint, B as activatePlatformAccessCredentials, C as platformTrafficAttachmentWorker, D as formatPlatformInstallPlan, E as dnsRecordConfigHash, F as platformDatabaseNameFromOwnerUrl, G as PlatformCloudflareClient, I as turnOffInstalledProjectZeroTrust, J as hyperdriveOriginMatches, K as hyperdriveOriginConfigHash, L as assertPlatformOperatorCredentialCanApplyPlan, M as r2BucketConfigHash, N as resourceMarkerProblem, O as hasProvisionIntentStep, P as revalidatePlatformInstallAction, R as resolvePlatformCloudflareCredential, T as createPlatformInstallPlan, W as PlatformCloudflareApiError, Y as verifyPlatformRuntimeTokenPermissions, _ as readPlatformDatabase, a as authenticationSetupRequestHash, b as createPlatformInstallationSecrets, c as REMOTE_INSTALLATION_MANIFEST_KEY, g as formatZeroTrustApplications, h as assertProjectZeroTrustAllowsUninstall, j as platformAdoptionIntentHash, k as legacyResourceConfigHash, l as installPlatform, m as readPlatformProjectZeroTrustState, n as resolvePlatformInstallDatabaseUrl, o as readLoginReplacementFile, p as readPlatformProjectSlugs, q as hyperdriveOriginFromConnectionString, s as replacePendingInstallationAuthentication, t as assertNoninteractivePlatformMutationAcknowledged, u as acquirePlatformDatabaseLifecycleLock, v as loadPlatformRuntime, x as resolveBootstrapGitHubId, y as createPlatformHealthProbeToken, z as verifyPlatformCloudflareCredential } from "./platform-lifecycle-DBiS0cJd.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-CKguMgr7.mjs";
+import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-3CR98Tg2.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 //#region src/cli/platform-teardown.ts
@@ -738,6 +738,8 @@ async function runInstalledPlatformCommand(args) {
 		log.info(manifest.desiredState === "disabled" && args.subcommand !== "enable" ? "Application traffic will stay paused because this installation is disabled." : "Application traffic may pause briefly during a safe cutover.");
 		if (args.plan) {
 			if (loginFile !== void 0) log.info(`Login settings will be replaced from ${loginFile}; a new setup code is printed at the end.`);
+			const outsideChanges = await findPlatformWorkerOutsideChanges(client, plan, runtime, { manifest });
+			if (outsideChanges.length > 0) log.warn(`${formatPlatformWorkerOutsideChanges(outsideChanges)}\nThis command replaces their configuration with the Void configuration. Run it in a terminal to review them first.`);
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
@@ -789,14 +791,41 @@ async function runInstalledPlatformCommand(args) {
 			...replacedLogin
 		});
 		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets);
+		const emailZoneId = installation.desiredState !== "disabled" && plan.deployment.capabilities.email ? plan.deployment.emailSharedZoneId : void 0;
 		if (runtimeTokenToPreflight) await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(runtimeTokenToPreflight), {
 			accountId: manifest.account.id,
 			applicationDomain: deployment.application.baseDomain,
 			customDomains: plan.deployment.capabilities.customDomains,
+			...emailZoneId ? { emailZoneId } : {},
 			zoneId: plan.zone?.id ?? null
 		});
+		else if (emailZoneId && secrets.cloudflareApiToken) try {
+			await verifyPlatformRuntimeTokenEmailPermissions(new PlatformCloudflareClient(secrets.cloudflareApiToken), {
+				accountId: manifest.account.id,
+				savedToken: true,
+				zoneId: emailZoneId
+			});
+		} catch (error) {
+			if (!(error instanceof PlatformRuntimeTokenEmailPermissionError) || !error.tokenNotValid) throw error;
+			log.warn("The runtime API token saved on this machine is not valid (HTTP 401). Void cannot check the platform email permissions before it changes the platform, and it continues without this check. To do the check, set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to the runtime token of the platform.");
+		}
 		markPhase("runtime token");
 		if (!databaseLock?.readAuthenticationState) throw new Error("platform: The database lifecycle lock cannot read authoritative authentication settings.");
+		const outsideChanges = await reviewPlatformWorkerOutsideChanges({
+			client,
+			plan,
+			runtime,
+			installation: {
+				manifest: installation,
+				readAuthenticationState: databaseLock.readAuthenticationState
+			},
+			interactive: process.stdin.isTTY === true && process.stdout.isTTY === true && !args.yes,
+			command: platformLifecycleResumeCommand({
+				...args,
+				yes: false
+			}, manifest.id)
+		});
+		markPhase("outside changes");
 		progress = createSpinner({ onCancel: () => {
 			if (!process.emit("SIGINT")) process.exit(130);
 		} });
@@ -825,6 +854,15 @@ async function runInstalledPlatformCommand(args) {
 			}),
 			client,
 			operatorApiToken: operatorCredential.token,
+			...outsideChanges.length > 0 ? {
+				replaceOutsideChanges: outsideChanges.map((change) => change.name),
+				uploadOutsideChanges: (configs) => uploadPlatformWorkerOutsideChanges(configs, {
+					changes: outsideChanges,
+					client,
+					operatorApiToken: operatorCredential.token,
+					progress
+				})
+			} : {},
 			databaseRollbackSource: rollbackSourceRuntime ?? void 0,
 			onProgress: (message) => {
 				markPhase(message);
@@ -1007,10 +1045,8 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	const routingKv = manifest.resources.find((resource) => resource.key === "routing-kv");
 	const reopenedRouting = purgeResources && routingKv?.state === "retained" && isPurgeResourcesCandidate(manifest, routingKv);
 	const hasRoutingCheckpoint = routingKv?.state === "ready" || reopenedRouting;
-	const createdZone = manifest.resources.find((resource) => resource.key === "zone" && resource.ownership === "created");
 	const interactive = dependencies.interactive ?? process.stdin.isTTY;
 	const confirmAction = dependencies.confirm ?? promptForConfirmation;
-	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
 	const zeroTrust = await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust, { canTurnOff: !!dependencies.turnOffProjectZeroTrust });
 	if (purgeResources) await assertNoPlatformProjects(dependencies.readProjects);
 	if (args.plan || interactive && !args.yes) note([...zeroTrust ? zeroTrust.turnOff.length ? ["Turn off project Zero Trust; no platform user exists yet. Delete its Access applications:", formatZeroTrustApplications(zeroTrust.turnOff)] : ["Turn off project Zero Trust; no platform user exists yet."] : [], purgeResources ? purgeResourcesPlanText(manifest) : [

package/dist/{platform-plans-config-BWn1S2Rv.mjs → platform-plans-config-CBMZxCep.mjs}

@@ -1,5 +1,5 @@
 import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { m as printSuccess } from "./output-Ba6ZbrzY.mjs";
+import { m as printSuccess } from "./output-CKguMgr7.mjs";
 import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
 import { stripVTControlCharacters } from "node:util";

package/dist/{platform-recovery-BUGOB4RC.mjs → platform-recovery-Dmsg7lWA.mjs}

@@ -1,7 +1,7 @@
 import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { T as createPlatformInstallPlan, c as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-DBiS0cJd.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-DhEFdQAf.mjs";
+import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-3CR98Tg2.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-o3LCCeE4.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{platform-setup-YvN9VQXV.mjs → platform-setup-hFbnWAVQ.mjs}

@@ -1,6 +1,6 @@
 import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
 import { L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, s as formatLink } from "./output-Ba6ZbrzY.mjs";
+import { f as import_picocolors, s as formatLink } from "./output-CKguMgr7.mjs";
 //#region src/cli/platform-setup.ts
 /** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
 function platformPromptAnswer(value) {

package/dist/{plugin-inference-DsARdQKE.mjs → plugin-inference-Bekzjuqw.mjs}

@@ -1,10 +1,10 @@
 import { a as join, l as toSlash, s as relative } from "./dist-ipQi0Q8y.mjs";
-import { n as readProjectPaths } from "./project-paths-DMvEeSau.mjs";
+import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
 import { n as globSync } from "./dist-Bn8Kodjp.mjs";
 import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CPGPjb0V.mjs";
 import { a as staticLiteral, n as parseRouteFilename, o as unwrapStaticExpression, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
 import { n as resourceNameWords, t as isResourceName } from "./resource-name-C7LVpcRm.mjs";
-import { r as getSsrServerEntryPath } from "./entry-ehmBvs5w.mjs";
+import { r as getSsrServerEntryPath } from "./entry-B_0IhV64.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";
 //#region src/application-features.ts

package/dist/{prepare-DEB5SeVJ.mjs → prepare-DepAGBcV.mjs}

@@ -1,13 +1,13 @@
 import { a as join } from "./dist-ipQi0Q8y.mjs";
-import { n as loadVoidAuthConfig } from "./config-D0GY5ItR.mjs";
-import { d as readConfig } from "./config-Bx_1SpnO.mjs";
-import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-bveqhlYA.mjs";
-import { n as generateDbDts } from "./db-types-Bb4WBWIs.mjs";
-import { t as discoverSchema } from "./discover-D2PGT63u.mjs";
+import { n as loadVoidAuthConfig } from "./config-CyUJzi3q.mjs";
+import { d as readConfig } from "./config-D26zcdKy.mjs";
+import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-Itv1f4WC.mjs";
+import { n as generateDbDts } from "./db-types-NGxPwnlt.mjs";
+import { t as discoverSchema } from "./discover-LaV0tbIu.mjs";
 import { o as loadLocalEnv } from "./env-BJjULvL0.mjs";
-import { n as findEnvFileForPaths, r as generateEnvTypes } from "./env-types-DS2_y4X8.mjs";
-import { t as analyzeApplication } from "./application-routing-L7V-TFhZ.mjs";
-import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-CF84FOVM.mjs";
+import { n as findEnvFileForPaths, r as generateEnvTypes } from "./env-types-GRchm5dw.mjs";
+import { t as analyzeApplication } from "./application-routing-CZH66gXn.mjs";
+import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-BQfyvQKX.mjs";
 import { n as generateQueueTypes, t as generateRouteTypes } from "./route-types-BZi26DVS.mjs";
 import { existsSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -37,7 +37,7 @@ async function prepareProject(root) {
 		const { dts } = generateRouteTypes(scan, paths.routesDir, outDir, paths.pagesDir);
 		writeGeneratedFile(outDir, "routes.d.ts", dts, written);
 	} else removeGeneratedFile(outDir, "routes.d.ts", removed);
-	if (scan.queues.length > 0) writeGeneratedFile(outDir, "queues.d.ts", generateQueueTypes(scan.queues, paths.queuesDir, outDir), written);
+	if (existsSync(paths.queuesDir)) writeGeneratedFile(outDir, "queues.d.ts", generateQueueTypes(scan.queues, paths.queuesDir, outDir), written);
 	else removeGeneratedFile(outDir, "queues.d.ts", removed);
 	const schema = discoverSchema(root, paths);
 	const hasDbRuntime = schema != null || authEnabled;

package/dist/prepare-EVEbQ9n2.mjs

@@ -0,0 +1 @@
+export { t as prepareProject } from "./prepare-DepAGBcV.mjs";

package/dist/{prepare-PQCgsny0.mjs → prepare-HKo7Rh5V.mjs}

@@ -1,6 +1,6 @@
 import { L as log } from "./dist-BVdsO7Py.mjs";
-import { m as printSuccess, p as note } from "./output-Ba6ZbrzY.mjs";
-import { t as prepareProject } from "./prepare-DEB5SeVJ.mjs";
+import { m as printSuccess, p as note } from "./output-CKguMgr7.mjs";
+import { t as prepareProject } from "./prepare-DepAGBcV.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root) {
 	console.log();

package/dist/{project-cmd-DVatD8Ev.mjs → project-cmd-8ylYGx-O.mjs}

@@ -1,8 +1,8 @@
 import { n as readDeploymentPlatform } from "./project-rqDnVsJN.mjs";
 import { c as getToken, s as getSiteDomain } from "./auth-B6iOCjKI.mjs";
 import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
-import { _ as tablePrefix, f as import_picocolors, i as dim, l as formatUrl, o as formatCount } from "./output-Ba6ZbrzY.mjs";
-import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+import { _ as tablePrefix, f as import_picocolors, i as dim, l as formatUrl, o as formatCount } from "./output-CKguMgr7.mjs";
+import { r as PlatformClient } from "./client-BdzxubTS.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -38,77 +38,77 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-CQ2EQEHL.mjs");
+		const { runListCommand } = await import("./list-hKoW5z-b.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by cloudflare.name in void.config.ts and do not need linking.");
-		const { runLink } = await import("./link-WMoJFf4i.mjs");
+		const { runLink } = await import("./link-CwrfpjIM.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-CQ2EQEHL.mjs");
+			const { runListCommand } = await import("./list-hKoW5z-b.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
 	if (args.subcommand === "token") {
 		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
-		const { runProjectTokenCommand } = await import("./project-token-CBgLBuL6.mjs");
+		const { runProjectTokenCommand } = await import("./project-token-QWHoJH2t.mjs");
 		return runProjectTokenCommand(root, args);
 	}
 	if (args.subcommand === "team") {
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-i2YGGnTH.mjs");
+			const { printHelpPage } = await import("./help-w-xlx_kq.mjs");
 			printHelpPage(["project", "team"]);
 			return;
 		}
 		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
 		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
-		const { runProjectTeamCommand } = await import("./project-team-DJrWEAG1.mjs");
+		const { runProjectTeamCommand } = await import("./project-team-Bvpl78we.mjs");
 		return runProjectTeamCommand(root, args);
 	}
 	if (args.subcommand === "zero-trust") {
 		if (cloudflare) throw new Error("project: Zero Trust overrides are available only for projects hosted on a Void platform.");
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-i2YGGnTH.mjs");
+			const { printHelpPage } = await import("./help-w-xlx_kq.mjs");
 			printHelpPage(["project", "zero-trust"]);
 			return;
 		}
 		const action = args.action;
-		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-92gLtZ25.mjs");
+		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-8tJ-RFvu.mjs");
 		return runProjectZeroTrustCommand(root, {
 			...args,
 			action
 		});
 	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-DnC1d7xB.mjs");
+		const { runLogsCommand } = await import("./logs-CEWqD-_B.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-7W1Pygt2.mjs");
+		const { runRequestsCommand } = await import("./requests-Vk5Zyhcy.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-BcASVnwP.mjs");
-		return runRollbackCommand(root, args.deployId || void 0);
+		const { runRollbackCommand } = await import("./rollback-CH4yMQys.mjs");
+		return runRollbackCommand(root, args.deployId || void 0, args.platform);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-CD9o-SsC.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-CaARY26n.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-Cy-M1u-r.mjs");
+		const { runDeleteCommand } = await import("./delete-CAma7nFi.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
-		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-Ctzfig-W.mjs");
+		if (cloudflare) throw new Error("project: `void project purge-cache` is available only for projects hosted on a Void platform. For a direct Cloudflare deploy, redeploy or purge the configured ISR KV namespace.");
+		const { runPurgeCacheCommand } = await import("./cache-CEFb5ban.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/{project-paths-DMvEeSau.mjs → project-paths-DGu_QZ_Q.mjs}

@@ -24,7 +24,7 @@ function loadVoidConfig(root) {
 	const jsonPath = join(root, LEGACY_CONFIG_FILE);
 	const hasTyped = existsSync(typedPath);
 	const hasJson = existsSync(jsonPath);
-	if (hasTyped && hasJson) throw new Error(`config: Found both ${TYPED_CONFIG_FILE} and ${LEGACY_CONFIG_FILE}. Keep one source of truth.`);
+	if (hasTyped && hasJson) throw new Error(`config: Found both ${TYPED_CONFIG_FILE} and ${LEGACY_CONFIG_FILE}. Move the settings from ${LEGACY_CONFIG_FILE} into ${TYPED_CONFIG_FILE}, then delete ${LEGACY_CONFIG_FILE}.`);
 	if (!hasTyped && !hasJson) return null;
 	if (hasTyped) try {
 		return {

package/dist/{project-team-DJrWEAG1.mjs → project-team-Bvpl78we.mjs}

@@ -1,8 +1,8 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken, i as getAccountCredential } from "./auth-B6iOCjKI.mjs";
 import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
-import { h as sanitizeTerminalText, l as formatUrl, m as printSuccess, o as formatCount, p as note } from "./output-Ba6ZbrzY.mjs";
-import { c as platformErrorMessage, n as PlatformApiError, r as PlatformClient, s as parsePlatformErrorBody } from "./client-DM9Kcf4e.mjs";
+import { h as sanitizeTerminalText, l as formatUrl, m as printSuccess, o as formatCount, p as note } from "./output-CKguMgr7.mjs";
+import { c as platformErrorMessage, n as PlatformApiError, r as PlatformClient, s as parsePlatformErrorBody } from "./client-BdzxubTS.mjs";
 import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-WpwkCB_c.mjs";
 //#region src/cli/project-team.ts
 function clean(value) {

package/dist/{project-token-CBgLBuL6.mjs → project-token-QWHoJH2t.mjs}

@@ -1,8 +1,8 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken } from "./auth-B6iOCjKI.mjs";
 import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
-import { _ as tablePrefix, i as dim, m as printSuccess } from "./output-Ba6ZbrzY.mjs";
-import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+import { _ as tablePrefix, i as dim, m as printSuccess } from "./output-CKguMgr7.mjs";
+import { r as PlatformClient } from "./client-BdzxubTS.mjs";
 import { r as requireProjectBySlug } from "./resolve-project-WpwkCB_c.mjs";
 //#region src/cli/project-token.ts
 async function resolveTarget(root, args) {

package/dist/{project-tsconfig-bveqhlYA.mjs → project-tsconfig-Itv1f4WC.mjs}

@@ -1,5 +1,5 @@
 import { a as join, n as dirname, s as relative } from "./dist-ipQi0Q8y.mjs";
-import { n as readProjectPaths } from "./project-paths-DMvEeSau.mjs";
+import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/codegen/write-if-changed.ts
 function writeFileIfChanged(path, content) {

package/dist/{project-zero-trust-92gLtZ25.mjs → project-zero-trust-8tJ-RFvu.mjs}

@@ -1,8 +1,8 @@
 import { r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { c as getToken } from "./auth-B6iOCjKI.mjs";
 import { H as outro, L as log } from "./dist-BVdsO7Py.mjs";
-import { h as sanitizeTerminalText, m as printSuccess, p as note } from "./output-Ba6ZbrzY.mjs";
-import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+import { h as sanitizeTerminalText, m as printSuccess, p as note } from "./output-CKguMgr7.mjs";
+import { r as PlatformClient } from "./client-BdzxubTS.mjs";
 import { r as requireProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-WpwkCB_c.mjs";
 //#region src/cli/project-zero-trust.ts
 async function resolveTarget(root, args) {

package/dist/{protocol-4H7V_3Os.d.mts → protocol-Ssc_LhHj.d.mts}

@@ -1,6 +1,6 @@
 import { n as HeadDescriptor, t as HeadConfig } from "./head-C8K_iGe6.mjs";
-import { n as CloudBindings, r as CloudContext } from "./handler-_PqY82xe.mjs";
-import { a as PageRenderMode, t as DevCssAsset } from "./types-BAp5AEBU.mjs";
+import { n as CloudBindings, r as CloudContext } from "./handler-D5K_yP6T.mjs";
+import { a as PageRenderMode, t as DevCssAsset } from "./types-7AIz0OZu.mjs";
 //#region src/pages/protocol.d.ts
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */
 declare function safeJsonStringify(value: unknown): string;

package/dist/{protocol-RNP0u7UY.mjs → protocol-bAUUkx70.mjs}

@@ -1,7 +1,7 @@
 import { n as isConvertedResponse } from "./response-Tn7rU0MV.mjs";
 import { i as separateDeferred, n as DEFERRED, t as ValidationError } from "./validation-error-Dg9Recn1.mjs";
 import { i as resolveHead, n as renderHeadToString, r as renderHtmlAttrs, t as renderBodyAttrs } from "./head-D2VF4ApL.mjs";
-import { n as escapeScriptJson, t as serializePageData } from "./serialize-BtQyaYoC.mjs";
+import { i as escapeScriptJson, r as serializePageData } from "./serialize-YHvlcG3Q.mjs";
 //#region src/pages/protocol.ts
 const POWERED_BY = { "X-Powered-By": "Void" };
 const RENDER_ERROR_ASSET_TAGS_KEY = "__voidPageAssetTags";

package/dist/{providers-BXuhmuub.mjs → providers-BUHwJlmM.mjs}

@@ -45,6 +45,15 @@ function isVoidSocialAuthProvider(value) {
 function isVoidAuthProvider(value) {
 	return VOID_AUTH_PROVIDER_SET.has(value);
 }
+/** Provider options other than the client credentials, with the env var that holds each one. */
+const VOID_AUTH_PROVIDER_SETTING_ENV_NAMES = { cognito: {
+	domain: "AUTH_COGNITO_DOMAIN",
+	region: "AUTH_COGNITO_REGION",
+	userPoolId: "AUTH_COGNITO_USER_POOL_ID"
+} };
+function getVoidAuthProviderSettingEnvNames(provider) {
+	return VOID_AUTH_PROVIDER_SETTING_ENV_NAMES[provider] ?? {};
+}
 function getVoidAuthProviderEnvNames(provider) {
 	const normalized = provider.toUpperCase().replaceAll("-", "_");
 	return {
@@ -53,4 +62,4 @@ function getVoidAuthProviderEnvNames(provider) {
 	};
 }
 //#endregion
-export { isVoidSocialAuthProvider as a, isVoidAuthProvider as i, VOID_EMAIL_AUTH_PROVIDER as n, getVoidAuthProviderEnvNames as r, VOID_AUTH_PROVIDERS as t };
+export { isVoidAuthProvider as a, getVoidAuthProviderSettingEnvNames as i, VOID_EMAIL_AUTH_PROVIDER as n, isVoidSocialAuthProvider as o, getVoidAuthProviderEnvNames as r, VOID_AUTH_PROVIDERS as t };

package/dist/provision-BgXFDv0d.mjs

@@ -0,0 +1 @@
+export { f as isRealD1Id, p as isRealHyperdriveId } from "./provision-DZKYCEJg.mjs";