void 0.22.0 → 0.23.0

package/skills/void/docs/reference/cli/platform-users.md

@@ -0,0 +1,89 @@
+---
+outline: deep
+---
+
+# Platform Users and Projects {#operator-users}
+
+Use your administrator session for these commands. See [Platform Management](./platform.md#operator-commands) for platform selection, previews, and confirmation.
+
+Find a user by login, email, or ID, then inspect their projects and usage:
+
+```sh
+void platform user list [--search <text>] [--page <n>] [--limit <n>]
+void platform user show <id>
+```
+
+Use the same ID to change a plan, suspend or restore the account, or delete it:
+
+```sh
+void platform user plan <id> <free|solo|pro|sponsored|custom>
+void platform user suspend <id> [--reason <text>]
+void platform user restore <id>
+void platform user delete <id>
+```
+
+Suspending a user blocks their applications. Deleting a user also deletes their project resources. A plan change updates resource limits while preserving any administrator suspension.
+
+The last active administrator cannot be deleted or suspended. Both previews and
+actual mutations enforce this rule, including in the browser admin UI. Allowed
+administrator removals revoke administrator access before resource cleanup; if
+cleanup fails, access stays revoked and the partial result reports it.
+
+## Projects {#operator-projects}
+
+List projects across the platform, filter them by owner, or inspect one project's resources:
+
+```sh
+void platform project list [--user <user-id>] [--search <text>] [--page <n>] [--limit <n>]
+void platform project show <id>
+void platform project normalize <id> [--plan | --yes]
+void platform project delete <id>
+void platform project owner <project-id> <user-id>
+```
+
+Search matches a project's slug, ID, or owner's login. `show` includes resources, domains, the latest 10 deployments, and the latest 20 builds. `delete` removes the project and its resources.
+
+If deployment reports that a project requires normalization, an operator can preview `normalize <id> --plan`, then apply it with `--yes`. It verifies the serving deployment and any recorded queue names before updating project records. It leaves traffic and Cloudflare resources in place and refuses changes while deployment or recovery is active. If a verified queue name differs from the expected delivery routing name, normalization refuses the change; reconcile that queue routing before retrying. If the serving deployment cannot be verified, investigate the reported route before retrying. Finish interrupted deployment recovery on the previous compatible platform runtime before upgrading a project whose active deployment is missing.
+
+`owner` transfers a project to another registered user. Preview it with `--plan`; apply it interactively or with `--yes`. The preview reports active-work blockers and the account plan that will apply. The former owner becomes a project administrator, existing project-scoped CI deploy credentials are revoked, and usage already incurred remains with the former owner.
+
+## Signup Access {#operator-signup}
+
+Inspect signup restrictions, open signup to everyone, or require an allowlist match:
+
+```sh
+void platform signup show
+void platform signup open
+void platform signup restrict
+```
+
+Add and remove GitHub or email entries by their type and pattern:
+
+```sh
+void platform signup allow <github|email> <pattern> [--note <text>]
+void platform signup disallow <github|email> <pattern>
+void platform signup remove <github|email> <pattern>
+```
+
+`remove` remains available as an alias for existing scripts. GitHub entries match a login. Email entries match an address or a domain pattern such as `*@example.com`, across sign-in providers. Quote wildcard patterns in your shell.
+
+For an OIDC identity that has no verified email, grant access using its configured connection ID and stable provider subject:
+
+```sh
+void platform signup allow identity <connection-id> <subject> [--note <text>]
+void platform signup disallow identity <connection-id> <subject>
+```
+
+Connection IDs are shown by `void platform config auth list`. Identity subjects match exactly and case-sensitively; wildcards, email inference, and account linking are not applied. The login method's domain or group restrictions must still pass, and a newly admitted account has the ordinary user role. Under invited/allowlisted signup, an empty allowlist blocks new accounts. Under company-approved signup, explicit grants admit people in addition to the company rules.
+
+## Invitations {#operator-invitations}
+
+Invite people by email and track whether they have joined:
+
+```sh
+void platform invitation list [--page <n>] [--limit <n>]
+void platform invitation send <email[,email...]>
+void platform invitation revoke <id>
+```
+
+Send accepts up to 100 comma-separated addresses. Invitations grant signup access even if email delivery is unavailable or fails; delivery is reported separately. Share the platform's `/invite` page or `void connect '<platform URL>'` command yourself when no email is sent. Revoking a pending invitation removes its exact email grant. A broader domain entry can still allow that person to sign up.

package/skills/void/docs/reference/cli/platform-zero-trust.md

@@ -0,0 +1,45 @@
+---
+outline: deep
+---
+
+# Project Zero Trust {#operator-zero-trust}
+
+Use your administrator session for these commands. See [Platform Management](./platform.md#operator-commands) for platform selection, previews, and confirmation.
+
+Configure the installation-wide Cloudflare Access policy and project overrides:
+
+```sh
+void platform zero-trust status [--check]
+printf '%s' "$ACCESS_API_TOKEN" | void platform zero-trust configure \
+  --identity-providers <id[,id...]> \
+  --policies <id[,id...]> \
+  [--existing-projects <protected|public>] \
+  [--protect-new-projects] \
+  --token-stdin \
+  --yes
+void platform zero-trust reconcile
+void platform zero-trust disable
+
+void platform zero-trust project-status <project-id>
+void platform zero-trust project-protect <project-id>
+void platform zero-trust project-public <project-id>
+void platform zero-trust project-reconcile <project-id>
+```
+
+Mutations support `--plan`, `--yes`, and `--timeout`; use `--plan` instead of
+`--yes` to inspect this change without applying it. The Access management token
+is accepted only on standard input. Zero Trust uses the Cloudflare account that
+hosts the platform. Omit `--protect-new-projects` to make new projects public
+by default. `--existing-projects` is required when you enable Zero Trust and
+rejected once it is enabled; later configuration changes keep each project's
+protection. `status` reports saved state; `--check` also compares it with
+Cloudflare Access. If status remains `configuring` or `disabling`, run
+`void platform zero-trust reconcile` to resume the saved operation. Protected
+projects support up to 100 custom domains.
+
+The token needs **Access: Apps and Policies Write** plus **Access:
+Organizations, Identity Providers, and Groups Read**, scoped to the platform's
+Cloudflare account. Select at least one Allow policy that matches people by
+identity; Void rejects Bypass and Service Auth policies and rules that allow
+Everyone or any service token. See [Project Zero Trust](../../guide/platform/administration/zero-trust.md)
+for requirements and recovery.

package/skills/void/docs/reference/cli/platform.md

@@ -0,0 +1,70 @@
+---
+outline: deep
+---
+
+# Platform Management {#platform-management}
+
+Void-managed projects deploy to an explicitly selected platform. Join one with [`void connect`](./auth.md#connect). Connections are stored per API origin, and credentials are scoped to that origin.
+
+## Connection commands {#connection-commands}
+
+```sh
+void platform list
+void platform use [id]
+void platform status [id]
+```
+
+`use` and `status` auto-select the only configured platform; with multiple platforms they show a picker interactively and require an id or URL in non-interactive use. A project with a recorded platform URL keeps using that platform when the global default changes.
+
+## Operator commands {#operator-commands}
+
+Use `void platform` to administer the users and apps on your selected platform. Start with the [Platform Administration guide](../../guide/platform-administration.md) for signing in, giving people access, and investigating deployments.
+
+Every command below accepts `--connection <registered-id-or-url>` to select a platform and `--json` for structured output. Without `--connection`, Void uses `VOID_API_URL` if set, then the active platform connection. Application project files do not change this selection.
+
+### Making Changes {#making-changes}
+
+Commands that change users, projects, signup access, invitations, or Workers show a preview before asking for confirmation:
+
+```sh
+void platform user plan <user-id> pro --plan
+void platform user plan <user-id> pro --yes
+```
+
+`--plan` validates the change and prints its effect without applying it. `--yes` applies the change without prompting, which is required in scripts. Use one or the other; they cannot be combined. These flags also apply to deployment cancellation and maintenance commands, but not to authentication commands.
+
+Each preview and apply request allows five minutes. Set `--timeout <seconds>` to an integer from 1 to 3600 to change that limit. Read requests and individual log polls allow 30 seconds.
+
+Void does not automatically retry changes. If a request loses its connection or times out, inspect the affected objects and `void platform system events` before repeating it. Partial results describe the work that completed and exit with a nonzero status.
+
+### Authentication {#operator-authentication}
+
+Sign in, inspect your session, or sign out:
+
+```sh
+void platform auth login [--provider <connection-id>] [--token-stdin]
+void platform auth status
+void platform auth logout
+void platform auth token [--token-stdin]
+```
+
+Browser login offers the platform's enabled methods; `--provider <connection-id>` selects one. Login saves a one-hour administrator session in your system keychain. Logout revokes that session and removes its local credential.
+
+`auth token` prints your current operator token. With `--token-stdin`, it exchanges a full administrator API login session from standard input for a new operator token. `auth login --token-stdin` saves the exchanged token to the keychain instead of printing it.
+
+For automation, supply `VOID_OPERATOR_TOKEN` with an explicit `VOID_API_URL` or `--connection`. Operator tokens are stored separately from application deployment credentials. The API checks your current administrator access on every request. See [Using Scripts](../../guide/platform/administration/operations.md#using-scripts) for an example.
+
+## Pagination and JSON {#pagination-and-json}
+
+User, project, deployment, invitation, and event lists default to page `1` with 20 items. `--limit` accepts 1 to 100 for these lists. Their JSON responses include the page, limit, and total count.
+
+With `--json`, results go to standard output and command errors go to standard error as JSON. Errors and partial failures exit with a nonzero status. An unhealthy `system health` result stays on standard output and also exits nonzero. Log following writes one JSON object per response, including each page and empty responses.
+
+## Platform Command Groups
+
+- [Installation and maintenance](./platform-installation.md)
+- [Plans and authentication configuration](./platform-config.md)
+- [Users, projects, and signup access](./platform-users.md)
+- [Project Zero Trust](./platform-zero-trust.md)
+- [Deployments, builds, and system operations](./platform-operations.md)
+- [Email administration](./platform-email.md)

package/skills/void/docs/reference/cli/project.md

@@ -0,0 +1,214 @@
+---
+outline: deep
+---
+
+# Projects {#project-commands}
+
+## `void project status [name]` {#void-project-status-name}
+
+Show deployments for the configured target.
+
+- Void targets show recent hosted deployments; `[name]` looks up a project by slug and otherwise the linked project is used.
+- Cloudflare targets list Worker Versions, identify the active version, and show the recorded migration count. A project name is not accepted because the Worker name comes from `cloudflare.name` in `void.config.ts`.
+
+## `void project link [name]` {#void-project-link-name}
+
+Link current directory to an existing hosted Void project by slug, or select interactively if omitted. State is stored in `.void/project.json`. Direct Cloudflare apps use `cloudflare.name` in `void.config.ts` and do not need linking.
+
+## `void project list` {#void-project-list}
+
+List all accessible hosted projects (slug, role, type, URL). Shared projects are included and the role column distinguishes them from projects you own. For a saved Cloudflare target, this displays the current Worker's versions instead because there is no Void project registry.
+
+## `void project team` {#void-project-team}
+
+Manage access to a project hosted on a Void platform:
+
+```sh
+void project team list [--project <slug>]
+void project team invite <email> --role <reader|collaborator|admin> [--project <slug>]
+void project team invitations [--project <slug>]
+void project team role <user-id> <reader|collaborator|admin> [--project <slug>]
+void project team remove <user-id> [--project <slug>]
+void project team revoke <invitation-id> [--project <slug>]
+void project team leave [--project <slug>]
+void project team pending
+void project team accept <invitation-id>
+void project team decline <invitation-id>
+```
+
+Project-scoped commands use `--project`, then `VOID_PROJECT`, then the linked project. Invitations can target only an email address already registered to a user on that platform; they do not create accounts or grant signup access. Only the invited account can accept or decline its invitation.
+
+Readers can view the project but cannot deploy. Collaborators can deploy and manage deploy prerequisites. Project administrators can additionally manage domains, email destinations, GitHub configuration, and the project team. The owner alone can delete the project. See [Project Collaboration](../../guide/project-collaboration.md) for the full role boundaries.
+
+Project-scoped team management commands are not available for projects deployed
+directly to Cloudflare. The account-scoped `pending`, `accept`, and `decline`
+commands use the active connection selected by `void connect <url>`, regardless
+of the current project's link or deploy target. `VOID_API_URL` takes precedence;
+an unscoped `VOID_TOKEN` selects Void Cloud. These commands display their
+platform, and accepting an invitation leaves directory links intact. To link
+the invited application, run `void project link` in an unlinked checkout of
+that application.
+
+## `void project zero-trust` {#void-project-zero-trust}
+
+Inspect or override protection for a project on a Void platform:
+
+```sh
+void project zero-trust status [--project <slug>]
+void project zero-trust protect [--project <slug>]
+void project zero-trust public [--project <slug>]
+void project zero-trust reconcile [--project <slug>]
+```
+
+Project selection follows `--project`, then `VOID_PROJECT`, then the linked
+project.
+
+Readers can inspect the state. The owner or a project administrator can protect
+the project, make it public, or repair drift. `public` does not change the
+platform default for future projects. Deploys and rollbacks wait until a
+protection change is finished; if one is refused, the owner or a project
+administrator can run `void project zero-trust reconcile` before you retry.
+These commands do not apply to direct Cloudflare deployments.
+
+## `void project token <create|list|renew|revoke>` {#void-project-token-create-list-renew-revoke}
+
+Manage revocable `aud: deploy` credentials for one Void platform project. The
+credential can only call the endpoints used by `void deploy`; it cannot access
+operator, account, secret-writing, project-deletion, or other projects' routes.
+
+```sh
+void project token create --name github-actions --expires-in 30
+void project token list
+void project token renew <credential-id> --expires-in 30
+void project token revoke <credential-id>
+```
+
+Pass `--project <name>` outside a linked project. Expiry is bounded to 1–90
+days. Create and renew display the bearer value once; replace the stored secret
+immediately after renewal because the previous credential is revoked in the
+same operation. Project deletion and owner suspension also stop its use. Login
+method disablement does not revoke these independent deploy credentials.
+
+Store the printed `VOID_TOKEN` and `VOID_API_URL` in the CI secret manager. The
+Access pair passes the perimeter; the scoped Void credential authorizes only
+this project's deploy workflow. When prerendering or remote proxy bindings are
+used on an Access-protected platform, store `VOID_ACCESS_CREDENTIALS` as an
+origin-keyed JSON secret containing both exact HTTPS origins, even if both use
+the same service-token pair:
+
+```json
+{
+  "https://void-company-api.example.workers.dev": {
+    "CF_ACCESS_CLIENT_ID": "<service-token client ID>",
+    "CF_ACCESS_CLIENT_SECRET": "<service-token client secret>"
+  },
+  "https://void-company-proxy.example.workers.dev": {
+    "CF_ACCESS_CLIENT_ID": "<service-token client ID>",
+    "CF_ACCESS_CLIENT_SECRET": "<service-token client secret>"
+  }
+}
+```
+
+`VOID_ACCESS_ORIGIN` scopes a pair to one origin, so selecting only the API
+origin is insufficient for a workflow that calls the proxy. Use distinct pairs
+in the two entries when the Access policies require them.
+
+## `void project logs` {#void-project-logs}
+
+```
+void project logs [--level <level>] [--filter <text>] [--range <duration>] [--deployment <id>]
+```
+
+Show runtime logs from the deployed target. Hosted Void targets query retained log history. Cloudflare targets open a live tail for the Worker named in `void.config.ts`; they do not provide historical log storage.
+
+| Flag                 | Purpose                                                                                                                                                                                                         | Default |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `--range <duration>` | How far back to look. Format: `<number><unit>` (m/h/d). Max 7d.                                                                                                                                                 | `1h`    |
+| `--level <level>`    | Filter by log level. One of `error`, `warn`, `info`, `log`, `debug`, `all`. `error` also includes uncaught exceptions, non-`ok` outcomes, and any 5xx response — even when the worker neither threw nor logged. | `all`   |
+| `--filter <text>`    | Case-insensitive **substring** match against log message text and exception name/message — not a level filter. Shows the full request entry on any hit.                                                         | none    |
+| `--deployment <id>`  | Filter logs to a specific deployment ID.                                                                                                                                                                        | none    |
+
+Output shows one line per request (`HH:MM:SS METHOD URL STATUS`) with indented console log and exception lines beneath. Errors and exceptions are colored red, warnings yellow.
+
+Examples:
+
+```
+void project logs --level error --range 12h
+void project logs --level error --filter websocket
+```
+
+Logs include top-level `console.*` calls and uncaught errors captured by Cloudflare Tail. If you catch an error and save it only to your database, it won't appear here. Also log it with `console.error()` or `logger.error()` from `void/log`.
+
+For errors that never reach your Worker, such as edge routing errors or static site requests, use `void project requests --status 5xx`.
+
+On a direct Cloudflare target, `--filter` becomes Cloudflare's live search, `--deployment` selects a Worker Version, and `--level error` selects error invocations. Other individual console levels cannot be filtered, and `--range` does not select history. `void project requests` is hosted-only.
+
+## `void project requests` {#void-project-requests}
+
+```
+void project requests [--status <filter>] [--range <duration>]
+```
+
+Show request traffic for the linked project, including static assets and edge errors that do not appear in Worker logs.
+
+| Flag                 | Purpose                                                                                       | Default |
+| -------------------- | --------------------------------------------------------------------------------------------- | ------- |
+| `--status <filter>`  | Filter by status: a class (`2xx`, `3xx`, `4xx`, `5xx`) or an exact 3-digit code (e.g. `500`). | none    |
+| `--range <duration>` | How far back to look. Format: `<number><unit>` (m/h/d). Max 7d.                               | `1h`    |
+
+Output shows one line per request (`HH:MM:SS METHOD STATUS TYPE DURATION`). 5xx are colored red, 4xx yellow. Note: request paths are not recorded, so this view shows status and type rather than URLs — use `void project logs` for per-URL, per-log detail on requests that do reach your worker.
+
+Examples:
+
+```
+void project requests --status 5xx
+void project requests --range 24h
+```
+
+## `void project rollback [deployId]` {#void-project-rollback-deployid}
+
+```
+void project rollback [deployId]
+```
+
+Roll back to a previous deployment or Worker Version.
+
+- If `[deployId]` is omitted, shows an interactive select menu of retained deployments
+- If the target deployment has fewer applied migrations than the current one, a warning is shown listing the migration diff before confirmation
+
+On a Void platform, you can select a retained deployment. On Cloudflare, use a complete Worker Version ID or an unambiguous prefix. Void activates that version at 100%. When both versions have complete trigger snapshots, it also restores the selected version's schedules, queues, workflows, routes, and custom domains. Otherwise, rollback keeps the current triggers and restores the code, including versions originally deployed outside Void.
+
+Rollback doesn't reverse database migrations. If older code may run against a newer schema, or migration metadata is missing, Void explains the risk and asks for confirmation.
+
+## `void project cancel [deployId]` {#void-project-cancel-deployid}
+
+```
+void project cancel [deployId]
+```
+
+Cancel an active deployment.
+
+- If `[deployId]` is omitted, shows an interactive select menu of active deployments for the linked project
+- If `[deployId]` is provided, cancels that deployment directly
+
+This command is hosted-only. Direct Cloudflare deploys are local operations and do not expose a remote build to cancel.
+
+## `void project delete [name]` {#void-project-delete-name}
+
+Permanently delete a hosted Void project and all its resources (databases, KV namespaces, R2 buckets, deployments). Requires typing the project slug to confirm.
+
+If `[name]` is omitted, uses the linked project.
+
+For direct Cloudflare targets this command refuses to run. Inferred resources can be shared, so Void never performs automatic teardown; verify ownership and remove resources explicitly with Cloudflare tooling.
+
+## `void project purge-cache` {#void-project-purge-cache}
+
+```
+void project purge-cache [--project <name>]
+```
+
+Purge all cached pages for the linked project. The edge cache will clear within seconds.
+
+If `--project` is provided, purges that project's cache instead of the linked project.
+
+This command is currently hosted-only. Direct Cloudflare cache purge fails closed with guidance.

package/skills/void/docs/reference/cli/secrets.md

@@ -0,0 +1,76 @@
+---
+outline: deep
+---
+
+# Secrets and Environment {#secrets}
+
+## `void secret list` {#void-secret-list}
+
+```
+void secret list [--project <name>]
+```
+
+List production secret names for the saved target. Secret values are never printed. Direct Cloudflare targets query the Worker named in `void.config.ts`; `--project` is hosted-only.
+
+## `void secret put` {#void-secret-put}
+
+On hosted projects, secret writes and deletes return a retryable conflict while a deployment or rollback is in progress. Wait for that operation to finish and retry; the rejected operation leaves the stored secret unchanged.
+
+```
+void secret put <name> [--project <name>]
+void secret put <name=value> [--project <name>]
+```
+
+Value input modes:
+
+- inline: `void secret put API_KEY=abcd`
+- prompt (TTY): `void secret put API_KEY` (masked input)
+- stdin: `echo -n "abcd" | void secret put API_KEY`
+
+On a direct Cloudflare target, the value is sent to Cloudflare over stdin and stored as an encrypted Worker secret.
+
+## `void secret sync` {#void-secret-sync}
+
+```
+void secret sync <file> [--project <name>]
+```
+
+Upload production server values from a dotenv file stored outside your project. Include only keys declared in `env.ts`; leave out local development credentials and public `VITE_*` values.
+
+```sh
+void secret sync /secure/path/production.env
+```
+
+Existing remote secrets absent from the file are kept. Every entry must be a server key declared in `env.ts`, and its value must pass validation.
+
+## `void secret delete` {#void-secret-delete}
+
+```
+void secret delete <name> [--project <name>]
+```
+
+Secret commands use the platform saved in `.void/project.json`. Hosted project resolution follows the same order as deploy (`--project`, env var, linked project). Direct Cloudflare targets reject `--project` and use the pinned root Cloudflare config.
+
+## Env Schema {#env-schema}
+
+### `void env check` {#void-env-check}
+
+```
+void env check [--remote]
+```
+
+Without `--remote`, validate `.env` plus the shell for local development. With `--remote`, validate build-shell client values and the remote server-secret names. Exits non-zero if a required key is missing or a readable value is invalid.
+
+### `void env types` {#void-env-types}
+
+```
+void env types
+```
+
+Regenerate `.void/env.d.ts` from `env.ts`. Normally happens automatically on dev server start and HMR; use this command after a fresh clone or to refresh stale types in non-dev contexts.
+
+::: tip Deploy validation
+`void deploy` runs the same schema validation automatically (with remote secrets) and refuses to upload if any required key is missing — no need to call `env check` separately when deploying.
+:::
+
+See [Environment Variables](../../guide/env-vars.md) for the full guide.

package/skills/void/docs/reference/cli/setup.md

@@ -0,0 +1,70 @@
+---
+outline: deep
+---
+
+# Project Setup {#setup}
+
+## `void info` {#void-info}
+
+```sh
+void info
+void info --json
+```
+
+Shows each Durable State and WebSocket definition's source file, inferred or explicit name, Worker class, and binding. WebSocket entries also include their route in JSON output. It runs locally without authentication, network requests, or file generation.
+
+Before moving a deployed definition, copy the suggested `name` into `defineDurableState()`, `defineRoom()`, or `defineWebSocket()`. Keep that name after moving the file to preserve the resource. See [Durable State](../../guide/durable-state.md#rename-a-file-while-keeping-its-state) and [WebSockets](../../guide/websockets.md#move-a-route-while-keeping-its-state) for migration flows, including WebSocket parameter renames.
+
+Resources recorded in `void.lock.json` without a matching definition appear separately. Adopt a suggested name only after identifying the resource you moved. If Void cannot suggest a name, restore its original source and inspect it before moving it again.
+
+`--json` returns `resources` and `recordedResources`. Current entries contain `file`, `definition`, `name`, `nameSource` (`inferred` or `explicit`), `className`, `bindingName`, and an optional `route`. Recorded entries contain `className` and `bindingName`, with `name` and `definition` when a matching name is available.
+
+## `void migrate` {#void-migrate}
+
+`void migrate` converts legacy `void.json` and root `wrangler.jsonc` or `wrangler.json` files into `void.config.ts`. It also accepts one root `wrangler*.json(c)` file referenced by a supported framework adapter. Void saves backups in `.void/config-migration/`, records resource IDs in `void.lock.json`, and updates supported adapters to use its generated Cloudflare config.
+
+`.void-wrangler.jsonc` is generated for Cloudflare tooling and belongs in `.gitignore`; migration adds the entry. Review and commit `void.config.ts`, `void.lock.json`, and `.gitignore`. `void init` and `void deploy` migrate legacy files automatically. If the project has conflicting or multiple Cloudflare configs, resolve them first. The project's installed `void` package must match the CLI version before Cloudflare deployment.
+
+## `void init` {#void-init}
+
+```sh
+void init [--tsconfig] [--github] [--agents] [--git | --no-git]
+```
+
+Set up a new or existing Void project. In an empty directory, choose Vite+ or Vite, a framework, and a D1, PostgreSQL, MySQL, or Static Pages starter.
+
+In an existing app, Void adds missing dependencies and scripts and updates the Vite config. If it cannot edit your config, it prints the snippet to add.
+
+The wizard also sets up TypeScript, agent instructions, environment declarations, and a deployment target. Choose Cloudflare, a Void platform, or skip deployment setup. If you skip sign-in, run `void connect` when you're ready. See [Quick Start](../../guide/quickstart.md).
+
+Outside an existing repository or workspace package, Void offers to initialize Git. Use `--git` to initialize without a prompt or `--no-git` to skip it. CI requires `--git` to initialize. Workspace packages do not accept these flags.
+
+Run selected setup steps with:
+
+| Flag         | Purpose                                                        |
+| ------------ | -------------------------------------------------------------- |
+| `--tsconfig` | Update TypeScript configuration, preserving existing settings. |
+| `--agents`   | Set up agent instructions and skills for detected agents.      |
+| `--github`   | Create the GitHub Actions deployment workflow.                 |
+
+These flags can be combined and skip the other wizard steps. Add `--git` if you also want Git initialization.
+
+For Cloudflare workflows, add a `CLOUDFLARE_API_TOKEN` repository secret. PostgreSQL and MySQL apps also need `DATABASE_URL`.
+
+Void platforms with GitHub Actions support use short-lived OIDC credentials. Authorize the repository with `void github connect <project> --repo <owner/repo> --executor github_actions`. Core self-hosted platforms do not support that integration. See [Deployment](../../guide/deployment.md#github).
+
+## `void prepare` {#void-prepare}
+
+```
+void prepare
+```
+
+Generates Void’s types and TypeScript configuration without starting the dev server or building the app. Run it after a fresh clone or before typechecking in CI.
+
+## Agent {#agent}
+
+### `void init --agents` {#void-init-agents}
+
+Adds Void instructions to `AGENTS.md` and links skills for detected coding agents. Existing instructions outside the Void block are preserved.
+
+If no supported agent is detected, `AGENTS.md` links to the bundled docs. See [Coding Agents](../../integrations/agents.md).