void 0.21.9 → 0.23.0

package/README.md

@@ -6,10 +6,11 @@ You can also administer a team platform with the same CLI. Sign in with
 `void platform auth login`, then manage users, signup access, projects, and logs.
 Commands show a preview before applying changes and support `--json` for scripts.
 See [Platform Administration](../../docs/guide/platform-administration.md) for a
-walkthrough and the [CLI reference](../../docs/reference/cli.md#operator-commands)
+walkthrough and the [CLI reference](../../docs/reference/cli/platform.md#operator-commands)
 for every command.
 
 Use `void platform config auth` to manage login methods and company signup.
+Use `void platform config plans` to manage account plans, enforced limits, and the default for new accounts. See [Plans and Limits](../../docs/guide/platform/administration/plans.md).
 Cloudflare Access protection has separate create/connect controls. Users can
 link another enabled login to their account with `void account link`.
 
@@ -57,6 +58,7 @@ export default defineConfig({
 
 - `voidPlugin()` — Vite integration, routing, pages mode, codegen, migrations, packaging
 - `void prepare` — generate `.void` artifacts for CI, editors, and fresh clones
+- `void info [--json]` — discover persistent resource names before moving definitions
 - `void auth login` — sign in to the project's saved Cloudflare or Void destination
 - `void account login` — platform auth
 - `void connect [url]` — choose Cloudflare or a Void platform, sign in, and save the deployment destination
@@ -98,6 +100,8 @@ Runtime helpers include:
 
 Direct Cloudflare deployments also support D1, KV, R2, Queues, Hyperdrive, auth, cron jobs, AI, ISR, typed SQLite Durable Objects, and WebSocket rooms. They upload an immutable Worker Version, probe it before activation (using a 0%-traffic version override when Durable Objects disable preview URLs), and retain version metadata for migration-aware rollback.
 
+Durable State and WebSocket definitions accept optional `name` to preserve their resource identity when files move. Run `void info` and pin the displayed name before moving deployed code. See [Durable State](../../docs/guide/durable-state.md#rename-a-file-while-keeping-its-state) and [WebSockets](../../docs/guide/websockets.md#move-a-route-while-keeping-its-state), including how to preserve room instances when renaming route parameters.
+
 Self-hosted platform upgrades verify every packaged PostgreSQL migration and require the live Drizzle history to be an exact prefix. Pending SQL is allowed only for an explicitly attested old-version/schema compatibility edge, runs in one transaction, and leaves the old Worker version authoritative until the target runtime passes discovery and health checks.
 
 An upgrade that changes the authenticated usage protocol briefly gates application traffic while it verifies the complete Worker set. An interruption leaves the gate closed for the next resumable upgrade instead of enabling an unsigned compatibility path.

package/dist/{account-cmd-DZZGK80W.mjs → account-cmd-C84Ee8cO.mjs}

@@ -1,13 +1,13 @@
-import { c as getToken, p as removeToken } from "./auth-DLNN0D3Z.mjs";
-import { j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
-import { n as runLoginCommand } from "./login-DvqXsfGs.mjs";
+import { c as getToken, p as removeToken } from "./auth-CSkdO2Bb.mjs";
+import { j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { n as runLoginCommand } from "./login-UZKFM_u7.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/account-cmd.ts
 async function runAccountCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
-		case "link": return import("./auth-link-B_CeugBw.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
+		case "link": return import("./auth-link-CioEg6uY.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) log.success("Logged out.");
 			else log.info("Not logged in.");

package/dist/{scan-ClYmX3sa.mjs → application-analysis-BVsVqc11.mjs}

@@ -1,12 +1,17 @@
 import { a as join, i as isAbsolute, t as basename } from "./dist-BVqXeR_h.mjs";
-import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
+import { c as scanWebSocketRoutes, f as readResourceDefinition, i as inferProjectBindings, l as scanWebSocketRoutesSync, m as needsApplicationDatabase, n as FRAMEWORK_SCAN_DIRS, r as detectFramework, s as isWebSocketPatternFile } from "./plugin-inference-CXWnn79A.mjs";
+import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
+import { t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
+import { h as resolveBindingNames, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
 import { n as globSync, t as glob } from "./dist-Bn8Kodjp.mjs";
 import { n as isIdentifier } from "./ast-CPGPjb0V.mjs";
-import { c as unwrapStaticExpression, o as staticExportInitializers, s as staticLiteral, t as scanPages } from "./scan-4tfN-PSn.mjs";
-import { a as isWebSocketPatternFile, o as scanWebSocketRoutes } from "./plugin-inference-BMfKRSqE.mjs";
-import { n as parseRouteFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-DioPHiR9.mjs";
-import { i as scanEmailHandlers } from "./email--tEtMoj_.mjs";
-import { readFileSync } from "node:fs";
+import { a as staticLiteral, i as staticExportInitializers, n as parseRouteFilename, o as unwrapStaticExpression, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
+import { n as resourceNameWords } from "./resource-name-C7LVpcRm.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
+import { a as scanEmailHandlersSync, i as scanEmailHandlers, r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
+import { t as scanPages } from "./scan-C7okrLyM.mjs";
+import { o as isSandboxEnabled } from "./config-C_XRIPx2.mjs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { parseSync } from "vite";
 //#region src/crons/scan.ts
 const JOB_EXTENSIONS = [
@@ -65,6 +70,44 @@ function scanJobsSync(root, jobsDir = "crons") {
 	return parseJobFiles(root, jobsDir, files);
 }
 //#endregion
+//#region src/durable/scan.ts
+const MODULE_PATTERN = /\.(?:[cm]?[jt]s)$/;
+function inferDurableResourceName(filePath) {
+	return filePath.replace(/\\/g, "/").split("/").pop().replace(MODULE_PATTERN, "");
+}
+const DURABLE_HELPERS = /* @__PURE__ */ new Set(["defineDurableState"]);
+function deriveDurableResourceIdentity(name) {
+	const parts = resourceNameWords(name);
+	const classBase = parts.map((part) => part[0].toUpperCase() + part.slice(1)).join("");
+	return {
+		bindingName: parts.join("_").toUpperCase(),
+		className: `${classBase}DurableObject`,
+		migrationTag: `void-durable-${parts.join("-").toLowerCase()}-v1`
+	};
+}
+function scanDurableObjectModules(root) {
+	const directory = join(root, "durable-objects");
+	if (!existsSync(directory)) return [];
+	const modules = readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isFile() && MODULE_PATTERN.test(entry.name) && !entry.name.endsWith(".d.ts")).sort((a, b) => a.name.localeCompare(b.name)).map((entry) => {
+		const filePath = join(directory, entry.name);
+		const name = readResourceDefinition(filePath, readFileSync(filePath, "utf-8"), DURABLE_HELPERS)?.name;
+		if (resourceNameWords(name ?? inferDurableResourceName(entry.name)).length === 0) throw new Error(`durable: cannot derive a name from durable-objects/${entry.name}.`);
+		return {
+			filePath,
+			...deriveDurableResourceIdentity(name ?? inferDurableResourceName(entry.name)),
+			...name === void 0 ? {} : { name }
+		};
+	});
+	const bindings = /* @__PURE__ */ new Set();
+	const classes = /* @__PURE__ */ new Set();
+	for (const module of modules) {
+		if (bindings.has(module.bindingName) || classes.has(module.className)) throw new Error(`durable: duplicate generated name for '${module.filePath}'. Choose a different resource name or rename one of the durable-objects files.`);
+		bindings.add(module.bindingName);
+		classes.add(module.className);
+	}
+	return modules;
+}
+//#endregion
 //#region src/queues/scan.ts
 const QUEUE_EXTENSIONS = [
 	"ts",
@@ -226,31 +269,31 @@ function compareRouteSpecificity(a, b) {
 async function scanRoutes(root, options) {
 	const paths = options?.paths ?? readProjectPaths(root);
 	const [routeFiles, websockets, middlewareFiles, jobs, queues, pages, email] = await Promise.all([
-		glob(ROUTE_PATTERN, {
+		options?.inventory ? [] : glob(ROUTE_PATTERN, {
 			cwd: paths.routesDir,
 			absolute: false
 		}),
-		scanWebSocketRoutes(root, paths, options?.environment),
-		glob(ROUTE_PATTERN, {
+		options?.inventory?.websockets ?? scanWebSocketRoutes(root, paths, options?.environment),
+		options?.inventory ? [] : glob(ROUTE_PATTERN, {
 			cwd: paths.middlewareDir,
 			absolute: false
 		}).catch(() => []),
-		scanJobs(root, paths.cronsDir),
-		scanQueues(root, paths.queuesDir),
+		options?.inventory?.jobs ?? scanJobs(root, paths.cronsDir),
+		options?.inventory?.queues ?? scanQueues(root, paths.queuesDir),
 		scanPages(root, {
 			output: options?.output,
 			paths
 		}),
-		scanEmailHandlers(paths.sourceRoot)
+		options?.inventory?.email ?? scanEmailHandlers(paths.sourceRoot)
 	]);
 	const routesDir = paths.routesDir;
 	return {
-		routes: routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((file) => parseRouteFilename(file)).filter((route) => isRouteEnabledForEnvironment(route, options?.environment)).map((route) => {
-			route.methods = detectHttpExports(join(routesDir, route.filePath));
-			return route;
-		}).sort(compareRouteSpecificity),
+		routes: (options?.inventory?.routes ?? routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((file) => parseRouteFilename(file)).filter((route) => isRouteEnabledForEnvironment(route, options?.environment))).map((route) => ({
+			...route,
+			methods: detectHttpExports(join(routesDir, route.filePath))
+		})).sort(compareRouteSpecificity),
 		websockets,
-		middleware: parseMiddlewareDefinitions(middlewareFiles),
+		middleware: options?.inventory?.middleware ?? parseMiddlewareDefinitions(middlewareFiles),
 		jobs,
 		queues,
 		pages,
@@ -282,4 +325,78 @@ function scanRoutePatternsSync(root, paths = readProjectPaths(root), environment
 	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).filter((route) => isRouteEnabledForEnvironment(route, environment)).sort(compareRouteSpecificity);
 }
 //#endregion
-export { scanJobsSync as a, scanQueuesSync as i, scanRoutePatternsSync as n, scanRoutes as r, scanMiddlewareSync as t };
+//#region src/application-analysis.ts
+/**
+* Discover application source features once for a consumer's environment.
+* Resource ids, generated provider configuration and migration history remain
+* the responsibility of the target consuming this analysis.
+*/
+function analyzeApplicationSync(root, options) {
+	const { config, environment } = options;
+	const paths = resolveProjectPaths(root, config);
+	const framework = detectFramework(root);
+	const scanDirs = config.inference?.scanDirs ?? (framework ? FRAMEWORK_SCAN_DIRS : void 0);
+	const inferred = inferProjectBindings(root, {
+		paths,
+		environment,
+		bindings: config.inference?.bindings
+	}, scanDirs);
+	const authConfigPath = findVoidAuthConfig(root, paths);
+	const authEnabled = inferred.needsAuth || authConfigPath !== null || config.auth !== void 0;
+	const bindings = {
+		...inferred,
+		needsAuth: authEnabled,
+		needsSandbox: inferred.needsSandbox || isSandboxEnabled(config)
+	};
+	const dialect = getDatabaseDialect(config);
+	const migrations = collectMigrations(paths.migrationsDir);
+	const jobs = scanJobsSync(root, paths.cronsDir);
+	const queues = scanQueuesSync(root, paths.queuesDir);
+	const allWebsockets = scanWebSocketRoutesSync(root, paths);
+	const websockets = allWebsockets.filter((route) => isRouteEnabledForEnvironment(route, environment));
+	const durableObjects = scanDurableObjectModules(root);
+	const email = scanEmailHandlersSync(paths.sourceRoot);
+	const overrides = config.inference?.bindings;
+	const bindingReason = (key, label, inferredReason) => overrides?.[key] ? `inference.bindings.${key} enables ${label}` : inferredReason;
+	const reasons = {
+		database: [],
+		kv: bindings.needsKV ? [bindingReason("kv", "KV", "app uses env.KV")] : [],
+		r2: bindings.needsR2 ? [bindingReason("storage", "R2", "app uses env.STORAGE (R2)")] : [],
+		ai: bindings.needsAI ? [bindingReason("ai", "Workers AI", "app uses Workers AI")] : [],
+		sandbox: bindings.needsSandbox ? [isSandboxEnabled(config) ? "void.config.ts enables Sandbox" : "app uses void/sandbox"] : [],
+		live: bindings.needsLive ? ["app uses void/live"] : [],
+		email: bindings.needsEmail ? [bindingReason("email", "email", "app uses void/email")] : [],
+		queues: bindings.needsQueues ? ["app uses void/queues"] : []
+	};
+	const databaseName = dialect === "sqlite" ? "a D1 database" : "a Hyperdrive database";
+	if (bindings.needsD1) reasons.database.push(bindingReason("db", databaseName, dialect === "sqlite" ? "app uses env.DB (D1)" : "app uses a database"));
+	if (authEnabled) reasons.database.push(`auth requires ${databaseName}`);
+	if (migrations.length > 0) reasons.database.push(`checked-in migrations need ${databaseName}`);
+	for (const queue of queues) reasons.queues.push(`queues/${queue.filePath} requires ${queue.bindingName}`);
+	if (hasEmailHandlers(email)) reasons.email.push("email/ contains inbound email handlers");
+	return {
+		root,
+		config,
+		environment,
+		paths,
+		framework,
+		bindings,
+		authConfigPath,
+		authEnabled,
+		dialect,
+		bindingNames: resolveBindingNames(config.inference?.bindings),
+		needsDatabase: needsApplicationDatabase(bindings, migrations.length),
+		migrations,
+		jobs,
+		queues,
+		websockets,
+		allWebsockets,
+		durableObjects,
+		email,
+		routes: scanRoutePatternsSync(root, paths, environment),
+		middleware: scanMiddlewareSync(root, paths),
+		reasons
+	};
+}
+//#endregion
+export { inferDurableResourceName as a, deriveDurableResourceIdentity as i, scanRoutes as n, scanDurableObjectModules as o, scanQueuesSync as r, scanJobsSync as s, analyzeApplicationSync as t };

package/dist/application-routing-B7QEjqSR.mjs

@@ -0,0 +1,27 @@
+import { n as scanRoutes, t as analyzeApplicationSync } from "./application-analysis-BVsVqc11.mjs";
+//#region src/application-routing.ts
+/** Complete route/page analysis using the same resource and handler inventories. */
+async function completeApplicationAnalysis(analysis) {
+	const scan = await scanRoutes(analysis.root, {
+		output: analysis.config.output,
+		paths: analysis.paths,
+		environment: analysis.environment,
+		inventory: {
+			routes: analysis.routes,
+			middleware: analysis.middleware,
+			jobs: analysis.jobs,
+			queues: analysis.queues,
+			websockets: analysis.websockets,
+			email: analysis.email
+		}
+	});
+	return {
+		...analysis,
+		scan
+	};
+}
+async function analyzeApplication(root, options) {
+	return completeApplicationAnalysis(analyzeApplicationSync(root, options));
+}
+//#endregion
+export { completeApplicationAnalysis as n, analyzeApplication as t };

package/dist/{auth-CZuiVsFh.mjs → auth-CCjt0hcq.mjs}

@@ -1,2 +1,2 @@
-import { a as getApiUrl, h as runPlatformLogin, s as getSiteDomain } from "./auth-DLNN0D3Z.mjs";
+import { a as getApiUrl, h as runPlatformLogin, s as getSiteDomain } from "./auth-CSkdO2Bb.mjs";
 export { getApiUrl, getSiteDomain, runPlatformLogin };

package/dist/{auth-DLNN0D3Z.mjs → auth-CSkdO2Bb.mjs}

@@ -74,7 +74,7 @@ function getToken(root = process.cwd()) {
 		return null;
 	}
 	const config = readConfig();
-	return readTokenForOrigin(apiUrl, config, legacyCredentialAccount(root, apiUrl, config));
+	return readTokenForOrigin(apiUrl, config);
 }
 /** Account actions follow the selected connection, independently of application metadata. */
 function getAccountCredential() {
@@ -82,39 +82,16 @@ function getAccountCredential() {
 	const apiUrl = normalizePlatformApiUrl(process.env.VOID_API_URL || (process.env.VOID_TOKEN ? DEFAULT_API_URL : getActivePlatformConnection()?.apiUrl ?? config.api ?? readLegacyHostedPlatformSelection()?.apiUrl ?? (keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : DEFAULT_API_URL)));
 	return {
 		apiUrl,
-		token: readTokenForOrigin(apiUrl, config, legacyCredentialAccountForMode(apiUrl === STAGING_API_URL, apiUrl, config))
+		token: readTokenForOrigin(apiUrl, config)
 	};
 }
-function readTokenForOrigin(apiUrl, config, legacyAccount) {
+function readTokenForOrigin(apiUrl, config) {
 	const envToken = process.env.VOID_TOKEN;
 	if (envToken) {
 		if (apiUrl !== (process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
 		return envToken;
 	}
-	const normalizedApiUrl = normalizePlatformApiUrl(apiUrl);
-	const originToken = readOriginScopedToken(normalizedApiUrl, config);
-	if (originToken) return originToken;
-	const account = platformCredentialAccount(normalizedApiUrl);
-	if (legacyAccount) {
-		const legacyKeyringToken = keyringGet(legacyAccount);
-		if (legacyKeyringToken) {
-			keyringSet(account, legacyKeyringToken);
-			return legacyKeyringToken;
-		}
-	}
-	if (!legacyAccount) return null;
-	const legacyFileToken = config[legacyAccount];
-	if (legacyFileToken) {
-		if (keyringSet(account, legacyFileToken)) {
-			config.api ??= normalizedApiUrl;
-			delete config[legacyAccount];
-			try {
-				writeConfig(config);
-			} catch {}
-		}
-		return legacyFileToken;
-	}
-	return null;
+	return readOriginScopedToken(apiUrl, config);
 }
 function getTokenSource() {
 	return process.env.VOID_TOKEN ? "ci" : "manual";
@@ -139,13 +116,6 @@ function removeToken(root = process.cwd()) {
 	try {
 		const config = readConfig();
 		let configChanged = false;
-		const legacyAccount = legacyCredentialAccount(root, apiUrl, config);
-		if (legacyAccount && keyringDelete(legacyAccount)) removed = true;
-		if (legacyAccount && config[legacyAccount]) {
-			delete config[legacyAccount];
-			configChanged = true;
-			removed = true;
-		}
 		if (config.tokens?.[apiUrl]) {
 			delete config.tokens[apiUrl];
 			if (Object.keys(config.tokens).length === 0) delete config.tokens;
@@ -158,19 +128,6 @@ function removeToken(root = process.cwd()) {
 }
 const DEFAULT_API_URL = VOID_CLOUD_PLATFORM.apiUrl;
 const STAGING_API_URL = VOID_CLOUD_STAGING_PLATFORM.apiUrl;
-function legacyCredentialAccount(root, normalizedApiUrl, config) {
-	return legacyCredentialAccountForMode(isStagingMode(root), normalizedApiUrl, config);
-}
-function legacyCredentialAccountForMode(staging, normalizedApiUrl, config) {
-	const account = staging ? "stagingToken" : "token";
-	let configuredUrl;
-	try {
-		configuredUrl = normalizePlatformApiUrl(config.api ?? (staging ? STAGING_API_URL : DEFAULT_API_URL));
-	} catch {
-		return null;
-	}
-	return configuredUrl === normalizedApiUrl ? account : null;
-}
 function base64Url(buffer) {
 	return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }

package/dist/{auth-link-B_CeugBw.mjs → auth-link-CioEg6uY.mjs}

@@ -1,8 +1,8 @@
-import { a as getApiUrl, c as getToken, d as openBrowser, g as savePlatformToken, h as runPlatformLogin } from "./auth-DLNN0D3Z.mjs";
-import { j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
-import { r as selectPlatformLoginMethod } from "./login-DvqXsfGs.mjs";
-import { t as discoverPlatform } from "./platform-cmd-DNl8WosH.mjs";
+import { a as getApiUrl, c as getToken, d as openBrowser, g as savePlatformToken, h as runPlatformLogin } from "./auth-CSkdO2Bb.mjs";
+import { j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { r as selectPlatformLoginMethod } from "./login-UZKFM_u7.mjs";
+import { t as discoverPlatform } from "./platform-cmd-DMcQStSc.mjs";
 import { execFile } from "node:child_process";
 //#region src/cli/auth-link.ts
 async function runAuthLink(root, connectionId) {

package/dist/{auth-router-BgEFRuvZ.mjs → auth-router-BsR981d4.mjs}

@@ -1,6 +1,6 @@
 import { o as listPlatformConnections } from "./platform-registry-QBa4DK32.mjs";
 import { i as readDeploymentPlatform } from "./project-C0Fqu05O.mjs";
-import { I as select, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { I as select, W as isCancel } from "./dist-CTBk70IR.mjs";
 //#region src/cli/auth-router.ts
 async function chooseDestination(root, args, interactive) {
 	const saved = readDeploymentPlatform(root);
@@ -37,7 +37,7 @@ async function chooseDestination(root, args, interactive) {
 }
 async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isTTY)) {
 	if (args.subcommand === "link") {
-		const { runAccountCommand } = await import("./account-cmd-DZZGK80W.mjs");
+		const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
 		await runAccountCommand(root, {
 			subcommand: "link",
 			...args.connectionId ? { connectionId: args.connectionId } : {}
@@ -45,17 +45,17 @@ async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isT
 		return;
 	}
 	if (args.subcommand === "token") {
-		const { runAccountCommand } = await import("./account-cmd-DZZGK80W.mjs");
+		const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
 		await runAccountCommand(root, { subcommand: "token" });
 		return;
 	}
 	const destination = await chooseDestination(root, args, interactive);
 	if (destination.platform === "cloudflare") {
-		const { runCloudflareCommand } = await import("./cloudflare-cmd-bSmZ1d5L.mjs");
+		const { runCloudflareCommand } = await import("./cloudflare-cmd-BcrVyTmJ.mjs");
 		await runCloudflareCommand(root, { subcommand: args.subcommand === "whoami" || args.subcommand === "status" ? "status" : args.subcommand });
 		return;
 	}
-	const { runAccountCommand } = await import("./account-cmd-DZZGK80W.mjs");
+	const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
 	const subcommand = args.subcommand === "status" ? "whoami" : args.subcommand;
 	if (!destination.apiUrl) {
 		await runAccountCommand(root, { subcommand });

package/dist/{better-auth-shared-rsBGBvWJ.mjs → better-auth-shared-hy6RPh9W.mjs}

@@ -77,11 +77,17 @@ function resolveSocialProviders(env, configuredProviders) {
 	}
 	return Object.keys(providers).length > 0 ? providers : void 0;
 }
-function appendAuthHeaders(c, source) {
+function appendAuthHeaders(c, source, includeCachePolicy) {
 	if (!source) return;
 	source.forEach((value, key) => {
+		if (!includeCachePolicy && ["cache-control", "pragma"].includes(key.toLowerCase())) return;
 		c.header(key, value, { append: key.toLowerCase() === "set-cookie" });
 	});
+	if (source.has("set-cookie") && !(source.get("cache-control") ?? "").split(",").some((directive) => [
+		"private",
+		"no-store",
+		"no-cache"
+	].includes(directive.trim().toLowerCase()))) c.header("Cache-Control", "private, no-store");
 }
 function resolveUserConfig(userConfig, defaults, request, env, dialect) {
 	const mergeEmailAndPasswordDefaults = (options) => {
@@ -175,7 +181,12 @@ function createVoidAuthRuntime(dialect, resolveDatabase, runVoidAuthMigrations)
 			}, async () => {
 				await next();
 			});
-			appendAuthHeaders(c, result.headers);
+			const credentialed = [
+				"cookie",
+				"authorization",
+				"cf-access-jwt-assertion"
+			].some((header) => c.req.raw.headers.has(header));
+			appendAuthHeaders(c, result.headers, state !== null || credentialed || result.headers?.has("set-cookie") === true);
 		} finally {
 			await dispose();
 		}

package/dist/{build-cmd-Dpt0jd-x.mjs → build-cmd-LzvNJORH.mjs}

@@ -1,12 +1,18 @@
-import { a as dim, c as import_picocolors, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
+import { a as dim, c as import_picocolors, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts
 const POLL_MS = 1e3;
+const BUILD_LOG_DRAIN_TIMEOUT_MS = 12e4;
+function isBuildLogComplete(page) {
+	if (!page.terminal) return false;
+	if (page.logsComplete === null || page.logsComplete === void 0) throw new Error("This platform cannot confirm that the final build logs were captured. Ask its administrator to upgrade the platform runtime, or read the retained logs without --follow.");
+	return page.logsComplete === true;
+}
 function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -24,7 +30,7 @@ function isFatalFollowError(err) {
 }
 /**
 * Pure follow-loop: repeatedly fetch pages since a cursor, write each new
-* line, and stop when the build reaches a terminal status. `fetchPage`,
+* line, and stop when the terminal build confirms its final logs were captured. `fetchPage`,
 * `write`, and `sleep` are injected so this is unit-testable. Returns the
 * final status + terminal flag.
 *
@@ -37,6 +43,7 @@ function isFatalFollowError(err) {
 async function followBuildLogs(opts) {
 	let cursor = opts.since;
 	let status = opts.status;
+	let terminalSince = null;
 	const pollMs = opts.pollMs ?? POLL_MS;
 	for (;;) {
 		await opts.sleep(pollMs);
@@ -51,10 +58,15 @@ async function followBuildLogs(opts) {
 		for (const l of pageResult.lines) opts.write(l.line);
 		cursor = pageResult.lastSeq;
 		status = pageResult.status;
-		if (pageResult.terminal) return {
+		if (isBuildLogComplete(pageResult)) return {
 			status,
 			terminal: true
 		};
+		if (pageResult.terminal) {
+			const now = Date.now();
+			terminalSince ??= now;
+			if (now - terminalSince >= BUILD_LOG_DRAIN_TIMEOUT_MS) throw new Error("Build finished, but its log producer did not confirm completion. Retry the command to recover the final log tail.");
+		} else terminalSince = null;
 	}
 }
 async function runBuildCommand(root, args) {
@@ -123,7 +135,7 @@ async function runBuildLogsCommand(root, args) {
 	for (const l of first.lines) write(l.line);
 	let status = first.status;
 	let terminal = first.terminal;
-	if (args.follow && !terminal) ({status, terminal} = await followBuildLogs({
+	if (args.follow && !isBuildLogComplete(first)) ({status, terminal} = await followBuildLogs({
 		fetchPage: (since) => client.getBuildLogs(projectId, buildId, since),
 		write,
 		sleep,

package/dist/{cache-7_UeZdTk.mjs → cache-C4MvnrMH.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, i as createSpinner, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { a as dim, i as createSpinner, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {

package/dist/{cancel-deploy-D23R1RXT.mjs → cancel-deploy-abUxpP2n.mjs}

@@ -1,8 +1,8 @@
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { E as confirm, O as intro, P as outro, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { E as confirm, O as intro, P as outro, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 	"pending",