void 0.22.0 → 0.24.0

package/AGENTS_TEMPLATE.md

@@ -1,6 +1,6 @@
 ## Void
 
 - This project uses [Void](https://void.cloud), a full-stack Vite framework for Cloudflare Workers with file-based API routing, server-rendered pages, and typed backend services.
-- Deploy to your Cloudflare account with `void deploy --platform cloudflare`, or connect to a Void platform with `void connect <url>` and deploy with `void deploy --platform void`. `void deploy` uses the saved destination.
+- Deploy to your Cloudflare account with `void deploy --platform cloudflare`, or explicitly connect to your team’s Void platform with `void connect <url>` before deploying with `void deploy --platform void`. `void deploy` uses the saved destination.
 - Use Void's CLI and typed APIs for development and infrastructure. Void infers Cloudflare bindings from your imports; use Void commands to manage them.
 - Before working with Void, read the relevant Markdown docs in `node_modules/void/skills/void/docs/`. Start with `guide/quickstart.md` for setup and `reference/cli.md` for commands; consult the other guides and references for any Void feature.

package/README.md

@@ -6,10 +6,11 @@ You can also administer a team platform with the same CLI. Sign in with
 `void platform auth login`, then manage users, signup access, projects, and logs.
 Commands show a preview before applying changes and support `--json` for scripts.
 See [Platform Administration](../../docs/guide/platform-administration.md) for a
-walkthrough and the [CLI reference](../../docs/reference/cli.md#operator-commands)
+walkthrough and the [CLI reference](../../docs/reference/cli/platform.md#operator-commands)
 for every command.
 
 Use `void platform config auth` to manage login methods and company signup.
+Use `void platform config plans` to manage account plans, enforced limits, and the default for new accounts. See [Plans and Limits](../../docs/guide/platform/administration/plans.md).
 Cloudflare Access protection has separate create/connect controls. Users can
 link another enabled login to their account with `void account link`.
 
@@ -57,6 +58,7 @@ export default defineConfig({
 
 - `voidPlugin()` — Vite integration, routing, pages mode, codegen, migrations, packaging
 - `void prepare` — generate `.void` artifacts for CI, editors, and fresh clones
+- `void info [--json]` — discover persistent resource names before moving definitions
 - `void auth login` — sign in to the project's saved Cloudflare or Void destination
 - `void account login` — platform auth
 - `void connect [url]` — choose Cloudflare or a Void platform, sign in, and save the deployment destination
@@ -98,6 +100,8 @@ Runtime helpers include:
 
 Direct Cloudflare deployments also support D1, KV, R2, Queues, Hyperdrive, auth, cron jobs, AI, ISR, typed SQLite Durable Objects, and WebSocket rooms. They upload an immutable Worker Version, probe it before activation (using a 0%-traffic version override when Durable Objects disable preview URLs), and retain version metadata for migration-aware rollback.
 
+Durable State and WebSocket definitions accept optional `name` to preserve their resource identity when files move. Run `void info` and pin the displayed name before moving deployed code. See [Durable State](../../docs/guide/durable-state.md#rename-a-file-while-keeping-its-state) and [WebSockets](../../docs/guide/websockets.md#move-a-route-while-keeping-its-state), including how to preserve room instances when renaming route parameters.
+
 Self-hosted platform upgrades verify every packaged PostgreSQL migration and require the live Drizzle history to be an exact prefix. Pending SQL is allowed only for an explicitly attested old-version/schema compatibility edge, runs in one transaction, and leaves the old Worker version authoritative until the target runtime passes discovery and health checks.
 
 An upgrade that changes the authenticated usage protocol briefly gates application traffic while it verifies the complete Worker set. An interruption leaves the gate closed for the next resumable upgrade instead of enabling an unsigned compatibility path.

package/dist/{account-cmd-CjyxcGkM.mjs → account-cmd-vJhh5lrb.mjs}

@@ -1,13 +1,13 @@
-import { c as getToken, p as removeToken } from "./auth-DLNN0D3Z.mjs";
-import { j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
-import { n as runLoginCommand } from "./login-CAsAsQ-_.mjs";
+import { c as getToken, f as removeToken } from "./auth-CQkSDS50.mjs";
+import { L as log } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { n as runLoginCommand } from "./login-BuiMyUrx.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/account-cmd.ts
 async function runAccountCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
-		case "link": return import("./auth-link-BLO4ptzo.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
+		case "link": return import("./auth-link-D75t9wO2.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) log.success("Logged out.");
 			else log.info("Not logged in.");

package/dist/{scan-ClYmX3sa.mjs → application-analysis-BVsVqc11.mjs}

@@ -1,12 +1,17 @@
 import { a as join, i as isAbsolute, t as basename } from "./dist-BVqXeR_h.mjs";
-import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
+import { c as scanWebSocketRoutes, f as readResourceDefinition, i as inferProjectBindings, l as scanWebSocketRoutesSync, m as needsApplicationDatabase, n as FRAMEWORK_SCAN_DIRS, r as detectFramework, s as isWebSocketPatternFile } from "./plugin-inference-CXWnn79A.mjs";
+import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
+import { t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
+import { h as resolveBindingNames, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
 import { n as globSync, t as glob } from "./dist-Bn8Kodjp.mjs";
 import { n as isIdentifier } from "./ast-CPGPjb0V.mjs";
-import { c as unwrapStaticExpression, o as staticExportInitializers, s as staticLiteral, t as scanPages } from "./scan-4tfN-PSn.mjs";
-import { a as isWebSocketPatternFile, o as scanWebSocketRoutes } from "./plugin-inference-BMfKRSqE.mjs";
-import { n as parseRouteFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-DioPHiR9.mjs";
-import { i as scanEmailHandlers } from "./email--tEtMoj_.mjs";
-import { readFileSync } from "node:fs";
+import { a as staticLiteral, i as staticExportInitializers, n as parseRouteFilename, o as unwrapStaticExpression, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
+import { n as resourceNameWords } from "./resource-name-C7LVpcRm.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
+import { a as scanEmailHandlersSync, i as scanEmailHandlers, r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
+import { t as scanPages } from "./scan-C7okrLyM.mjs";
+import { o as isSandboxEnabled } from "./config-C_XRIPx2.mjs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { parseSync } from "vite";
 //#region src/crons/scan.ts
 const JOB_EXTENSIONS = [
@@ -65,6 +70,44 @@ function scanJobsSync(root, jobsDir = "crons") {
 	return parseJobFiles(root, jobsDir, files);
 }
 //#endregion
+//#region src/durable/scan.ts
+const MODULE_PATTERN = /\.(?:[cm]?[jt]s)$/;
+function inferDurableResourceName(filePath) {
+	return filePath.replace(/\\/g, "/").split("/").pop().replace(MODULE_PATTERN, "");
+}
+const DURABLE_HELPERS = /* @__PURE__ */ new Set(["defineDurableState"]);
+function deriveDurableResourceIdentity(name) {
+	const parts = resourceNameWords(name);
+	const classBase = parts.map((part) => part[0].toUpperCase() + part.slice(1)).join("");
+	return {
+		bindingName: parts.join("_").toUpperCase(),
+		className: `${classBase}DurableObject`,
+		migrationTag: `void-durable-${parts.join("-").toLowerCase()}-v1`
+	};
+}
+function scanDurableObjectModules(root) {
+	const directory = join(root, "durable-objects");
+	if (!existsSync(directory)) return [];
+	const modules = readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isFile() && MODULE_PATTERN.test(entry.name) && !entry.name.endsWith(".d.ts")).sort((a, b) => a.name.localeCompare(b.name)).map((entry) => {
+		const filePath = join(directory, entry.name);
+		const name = readResourceDefinition(filePath, readFileSync(filePath, "utf-8"), DURABLE_HELPERS)?.name;
+		if (resourceNameWords(name ?? inferDurableResourceName(entry.name)).length === 0) throw new Error(`durable: cannot derive a name from durable-objects/${entry.name}.`);
+		return {
+			filePath,
+			...deriveDurableResourceIdentity(name ?? inferDurableResourceName(entry.name)),
+			...name === void 0 ? {} : { name }
+		};
+	});
+	const bindings = /* @__PURE__ */ new Set();
+	const classes = /* @__PURE__ */ new Set();
+	for (const module of modules) {
+		if (bindings.has(module.bindingName) || classes.has(module.className)) throw new Error(`durable: duplicate generated name for '${module.filePath}'. Choose a different resource name or rename one of the durable-objects files.`);
+		bindings.add(module.bindingName);
+		classes.add(module.className);
+	}
+	return modules;
+}
+//#endregion
 //#region src/queues/scan.ts
 const QUEUE_EXTENSIONS = [
 	"ts",
@@ -226,31 +269,31 @@ function compareRouteSpecificity(a, b) {
 async function scanRoutes(root, options) {
 	const paths = options?.paths ?? readProjectPaths(root);
 	const [routeFiles, websockets, middlewareFiles, jobs, queues, pages, email] = await Promise.all([
-		glob(ROUTE_PATTERN, {
+		options?.inventory ? [] : glob(ROUTE_PATTERN, {
 			cwd: paths.routesDir,
 			absolute: false
 		}),
-		scanWebSocketRoutes(root, paths, options?.environment),
-		glob(ROUTE_PATTERN, {
+		options?.inventory?.websockets ?? scanWebSocketRoutes(root, paths, options?.environment),
+		options?.inventory ? [] : glob(ROUTE_PATTERN, {
 			cwd: paths.middlewareDir,
 			absolute: false
 		}).catch(() => []),
-		scanJobs(root, paths.cronsDir),
-		scanQueues(root, paths.queuesDir),
+		options?.inventory?.jobs ?? scanJobs(root, paths.cronsDir),
+		options?.inventory?.queues ?? scanQueues(root, paths.queuesDir),
 		scanPages(root, {
 			output: options?.output,
 			paths
 		}),
-		scanEmailHandlers(paths.sourceRoot)
+		options?.inventory?.email ?? scanEmailHandlers(paths.sourceRoot)
 	]);
 	const routesDir = paths.routesDir;
 	return {
-		routes: routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((file) => parseRouteFilename(file)).filter((route) => isRouteEnabledForEnvironment(route, options?.environment)).map((route) => {
-			route.methods = detectHttpExports(join(routesDir, route.filePath));
-			return route;
-		}).sort(compareRouteSpecificity),
+		routes: (options?.inventory?.routes ?? routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((file) => parseRouteFilename(file)).filter((route) => isRouteEnabledForEnvironment(route, options?.environment))).map((route) => ({
+			...route,
+			methods: detectHttpExports(join(routesDir, route.filePath))
+		})).sort(compareRouteSpecificity),
 		websockets,
-		middleware: parseMiddlewareDefinitions(middlewareFiles),
+		middleware: options?.inventory?.middleware ?? parseMiddlewareDefinitions(middlewareFiles),
 		jobs,
 		queues,
 		pages,
@@ -282,4 +325,78 @@ function scanRoutePatternsSync(root, paths = readProjectPaths(root), environment
 	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).filter((route) => isRouteEnabledForEnvironment(route, environment)).sort(compareRouteSpecificity);
 }
 //#endregion
-export { scanJobsSync as a, scanQueuesSync as i, scanRoutePatternsSync as n, scanRoutes as r, scanMiddlewareSync as t };
+//#region src/application-analysis.ts
+/**
+* Discover application source features once for a consumer's environment.
+* Resource ids, generated provider configuration and migration history remain
+* the responsibility of the target consuming this analysis.
+*/
+function analyzeApplicationSync(root, options) {
+	const { config, environment } = options;
+	const paths = resolveProjectPaths(root, config);
+	const framework = detectFramework(root);
+	const scanDirs = config.inference?.scanDirs ?? (framework ? FRAMEWORK_SCAN_DIRS : void 0);
+	const inferred = inferProjectBindings(root, {
+		paths,
+		environment,
+		bindings: config.inference?.bindings
+	}, scanDirs);
+	const authConfigPath = findVoidAuthConfig(root, paths);
+	const authEnabled = inferred.needsAuth || authConfigPath !== null || config.auth !== void 0;
+	const bindings = {
+		...inferred,
+		needsAuth: authEnabled,
+		needsSandbox: inferred.needsSandbox || isSandboxEnabled(config)
+	};
+	const dialect = getDatabaseDialect(config);
+	const migrations = collectMigrations(paths.migrationsDir);
+	const jobs = scanJobsSync(root, paths.cronsDir);
+	const queues = scanQueuesSync(root, paths.queuesDir);
+	const allWebsockets = scanWebSocketRoutesSync(root, paths);
+	const websockets = allWebsockets.filter((route) => isRouteEnabledForEnvironment(route, environment));
+	const durableObjects = scanDurableObjectModules(root);
+	const email = scanEmailHandlersSync(paths.sourceRoot);
+	const overrides = config.inference?.bindings;
+	const bindingReason = (key, label, inferredReason) => overrides?.[key] ? `inference.bindings.${key} enables ${label}` : inferredReason;
+	const reasons = {
+		database: [],
+		kv: bindings.needsKV ? [bindingReason("kv", "KV", "app uses env.KV")] : [],
+		r2: bindings.needsR2 ? [bindingReason("storage", "R2", "app uses env.STORAGE (R2)")] : [],
+		ai: bindings.needsAI ? [bindingReason("ai", "Workers AI", "app uses Workers AI")] : [],
+		sandbox: bindings.needsSandbox ? [isSandboxEnabled(config) ? "void.config.ts enables Sandbox" : "app uses void/sandbox"] : [],
+		live: bindings.needsLive ? ["app uses void/live"] : [],
+		email: bindings.needsEmail ? [bindingReason("email", "email", "app uses void/email")] : [],
+		queues: bindings.needsQueues ? ["app uses void/queues"] : []
+	};
+	const databaseName = dialect === "sqlite" ? "a D1 database" : "a Hyperdrive database";
+	if (bindings.needsD1) reasons.database.push(bindingReason("db", databaseName, dialect === "sqlite" ? "app uses env.DB (D1)" : "app uses a database"));
+	if (authEnabled) reasons.database.push(`auth requires ${databaseName}`);
+	if (migrations.length > 0) reasons.database.push(`checked-in migrations need ${databaseName}`);
+	for (const queue of queues) reasons.queues.push(`queues/${queue.filePath} requires ${queue.bindingName}`);
+	if (hasEmailHandlers(email)) reasons.email.push("email/ contains inbound email handlers");
+	return {
+		root,
+		config,
+		environment,
+		paths,
+		framework,
+		bindings,
+		authConfigPath,
+		authEnabled,
+		dialect,
+		bindingNames: resolveBindingNames(config.inference?.bindings),
+		needsDatabase: needsApplicationDatabase(bindings, migrations.length),
+		migrations,
+		jobs,
+		queues,
+		websockets,
+		allWebsockets,
+		durableObjects,
+		email,
+		routes: scanRoutePatternsSync(root, paths, environment),
+		middleware: scanMiddlewareSync(root, paths),
+		reasons
+	};
+}
+//#endregion
+export { inferDurableResourceName as a, deriveDurableResourceIdentity as i, scanRoutes as n, scanDurableObjectModules as o, scanQueuesSync as r, scanJobsSync as s, analyzeApplicationSync as t };

package/dist/application-routing-B7QEjqSR.mjs

@@ -0,0 +1,27 @@
+import { n as scanRoutes, t as analyzeApplicationSync } from "./application-analysis-BVsVqc11.mjs";
+//#region src/application-routing.ts
+/** Complete route/page analysis using the same resource and handler inventories. */
+async function completeApplicationAnalysis(analysis) {
+	const scan = await scanRoutes(analysis.root, {
+		output: analysis.config.output,
+		paths: analysis.paths,
+		environment: analysis.environment,
+		inventory: {
+			routes: analysis.routes,
+			middleware: analysis.middleware,
+			jobs: analysis.jobs,
+			queues: analysis.queues,
+			websockets: analysis.websockets,
+			email: analysis.email
+		}
+	});
+	return {
+		...analysis,
+		scan
+	};
+}
+async function analyzeApplication(root, options) {
+	return completeApplicationAnalysis(analyzeApplicationSync(root, options));
+}
+//#endregion
+export { completeApplicationAnalysis as n, analyzeApplication as t };

package/dist/{auth-DLNN0D3Z.mjs → auth-CQkSDS50.mjs}

@@ -1,15 +1,11 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { S as writeKeyringPassword, b as deleteKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as readKeyringPassword } from "./platform-registry-QBa4DK32.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
-import { a as readProjectApplicationDomain, f as VOID_CLOUD_PLATFORM, m as readLegacyHostedPlatformSelection, n as isLegacyVoidCloudProject, p as VOID_CLOUD_STAGING_PLATFORM, r as isVoidInternalStaging, s as readProjectPlatformUrl } from "./project-C0Fqu05O.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { C as writeKeyringPassword, S as readKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as deleteKeyringPassword } from "./platform-registry-DkPPXfp_.mjs";
+import { t as ensureCloudflaredToken } from "./cf-access-BGe5sWXF.mjs";
+import { i as readProjectPlatformUrl, r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
-//#region src/shared/proxy.ts
-const DEFAULT_PROXY_URL = "https://proxy.void.cloud";
-const STAGING_PROXY_URL = "https://proxy.staging.void.cloud";
-//#endregion
 //#region src/cli/auth.ts
 const CONFIG_DIR = join(homedir(), ".void");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
@@ -50,19 +46,22 @@ function readOriginScopedToken(apiUrl, config) {
 	}
 	return fileToken;
 }
-function isStagingMode(root = process.cwd()) {
-	return isVoidInternalStaging(root);
+function connectedPlatform(apiUrl) {
+	if (!apiUrl) throw new Error("platform: No Void platform connected. Run `void connect <url>` first.");
+	const origin = normalizePlatformApiUrl(apiUrl);
+	const connection = listPlatformConnections().find((entry) => entry.apiUrl === origin);
+	if (!connection) throw new Error(`platform: No connection to ${origin}. Run \`void connect ${origin}\` first.`);
+	return connection;
 }
 function getSiteDomain(root = process.cwd()) {
-	const legacySelection = readLegacyHostedPlatformSelection();
-	const domain = readProjectApplicationDomain(root) ?? (isStagingMode(root) ? VOID_CLOUD_STAGING_PLATFORM.applicationDomain : void 0) ?? (isLegacyVoidCloudProject(root) || process.env.VOID_TOKEN && process.env.VOID_API_URL === void 0 ? VOID_CLOUD_PLATFORM.applicationDomain : void 0) ?? getActivePlatformConnection()?.applicationDomain ?? legacySelection?.applicationDomain;
-	if (!domain) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
-	return domain;
+	const connection = connectedPlatform(getApiUrl(root));
+	if (!connection.applicationDomain) throw new Error(`platform: Missing application domain. Run \`void connect ${connection.apiUrl}\` to refresh the connection.`);
+	return connection.applicationDomain;
 }
 /**
 * Read the deploy token.
 * Priority: origin-bound VOID_TOKEN > system keychain > migrated config.
-* An unscoped environment token retains its historical Void Cloud destination.
+* Environment tokens must name their recipient with VOID_API_URL.
 */
 function getToken(root = process.cwd()) {
 	const envToken = process.env.VOID_TOKEN;
@@ -74,47 +73,25 @@ function getToken(root = process.cwd()) {
 		return null;
 	}
 	const config = readConfig();
-	return readTokenForOrigin(apiUrl, config, legacyCredentialAccount(root, apiUrl, config));
+	return readTokenForOrigin(apiUrl, config);
 }
 /** Account actions follow the selected connection, independently of application metadata. */
 function getAccountCredential() {
 	const config = readConfig();
-	const apiUrl = normalizePlatformApiUrl(process.env.VOID_API_URL || (process.env.VOID_TOKEN ? DEFAULT_API_URL : getActivePlatformConnection()?.apiUrl ?? config.api ?? readLegacyHostedPlatformSelection()?.apiUrl ?? (keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : DEFAULT_API_URL)));
+	const apiUrl = connectedPlatform(process.env.VOID_API_URL || getActivePlatformConnection()?.apiUrl).apiUrl;
 	return {
 		apiUrl,
-		token: readTokenForOrigin(apiUrl, config, legacyCredentialAccountForMode(apiUrl === STAGING_API_URL, apiUrl, config))
+		token: readTokenForOrigin(apiUrl, config)
 	};
 }
-function readTokenForOrigin(apiUrl, config, legacyAccount) {
+function readTokenForOrigin(apiUrl, config) {
 	const envToken = process.env.VOID_TOKEN;
 	if (envToken) {
-		if (apiUrl !== (process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
+		if (!process.env.VOID_API_URL) throw new Error("auth: Set VOID_API_URL alongside VOID_TOKEN to identify the connected platform that issued it.");
+		if (apiUrl !== normalizePlatformApiUrl(process.env.VOID_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
 		return envToken;
 	}
-	const normalizedApiUrl = normalizePlatformApiUrl(apiUrl);
-	const originToken = readOriginScopedToken(normalizedApiUrl, config);
-	if (originToken) return originToken;
-	const account = platformCredentialAccount(normalizedApiUrl);
-	if (legacyAccount) {
-		const legacyKeyringToken = keyringGet(legacyAccount);
-		if (legacyKeyringToken) {
-			keyringSet(account, legacyKeyringToken);
-			return legacyKeyringToken;
-		}
-	}
-	if (!legacyAccount) return null;
-	const legacyFileToken = config[legacyAccount];
-	if (legacyFileToken) {
-		if (keyringSet(account, legacyFileToken)) {
-			config.api ??= normalizedApiUrl;
-			delete config[legacyAccount];
-			try {
-				writeConfig(config);
-			} catch {}
-		}
-		return legacyFileToken;
-	}
-	return null;
+	return readOriginScopedToken(apiUrl, config);
 }
 function getTokenSource() {
 	return process.env.VOID_TOKEN ? "ci" : "manual";
@@ -139,13 +116,6 @@ function removeToken(root = process.cwd()) {
 	try {
 		const config = readConfig();
 		let configChanged = false;
-		const legacyAccount = legacyCredentialAccount(root, apiUrl, config);
-		if (legacyAccount && keyringDelete(legacyAccount)) removed = true;
-		if (legacyAccount && config[legacyAccount]) {
-			delete config[legacyAccount];
-			configChanged = true;
-			removed = true;
-		}
 		if (config.tokens?.[apiUrl]) {
 			delete config.tokens[apiUrl];
 			if (Object.keys(config.tokens).length === 0) delete config.tokens;
@@ -156,21 +126,6 @@ function removeToken(root = process.cwd()) {
 	} catch {}
 	return removed;
 }
-const DEFAULT_API_URL = VOID_CLOUD_PLATFORM.apiUrl;
-const STAGING_API_URL = VOID_CLOUD_STAGING_PLATFORM.apiUrl;
-function legacyCredentialAccount(root, normalizedApiUrl, config) {
-	return legacyCredentialAccountForMode(isStagingMode(root), normalizedApiUrl, config);
-}
-function legacyCredentialAccountForMode(staging, normalizedApiUrl, config) {
-	const account = staging ? "stagingToken" : "token";
-	let configuredUrl;
-	try {
-		configuredUrl = normalizePlatformApiUrl(config.api ?? (staging ? STAGING_API_URL : DEFAULT_API_URL));
-	} catch {
-		return null;
-	}
-	return configuredUrl === normalizedApiUrl ? account : null;
-}
 function base64Url(buffer) {
 	return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
@@ -206,40 +161,15 @@ async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
 	if (!body || typeof body !== "object" || !("token" in body) || typeof body.token !== "string" || body.token.length === 0) throw new Error("auth: Login code exchange did not return a token.");
 	return body.token;
 }
-/**
-* Read the API URL from environment or config file.
-* Priority: VOID_API_URL env var > ~/.void/config.json > default
-*/
+/** Environment and project selections must refer to a verified local connection. */
 function getApiUrl(root = process.cwd()) {
-	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);
-	if (isStagingMode(root)) return STAGING_API_URL;
 	const projectApiUrl = readProjectPlatformUrl(root);
-	if (projectApiUrl) {
-		if (projectApiUrl === DEFAULT_API_URL || projectApiUrl === STAGING_API_URL) return projectApiUrl;
-		if (listPlatformConnections().some((connection) => connection.apiUrl === projectApiUrl)) return projectApiUrl;
-		throw new Error(`platform: Project metadata selected unverified platform ${projectApiUrl}. Connect to it explicitly with \`void connect ${projectApiUrl}\` before forwarding credentials.`);
-	}
-	const config = readConfig();
-	const legacySelection = readLegacyHostedPlatformSelection();
-	let apiUrl = (isLegacyVoidCloudProject(root) ? DEFAULT_API_URL : void 0) ?? getActivePlatformConnection()?.apiUrl ?? config.api ?? legacySelection?.apiUrl;
-	apiUrl ??= process.env.VOID_TOKEN ? DEFAULT_API_URL : void 0;
-	if (!apiUrl) {
-		apiUrl = keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : void 0;
-		if (apiUrl) try {
-			writeConfig({
-				...config,
-				api: apiUrl
-			});
-		} catch {}
-	}
-	if (!apiUrl) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
-	return normalizePlatformApiUrl(apiUrl);
+	if (readProjectConfig(root) && !projectApiUrl) throw new Error("platform: This project link has no platform URL. Run `void connect <url>`, then `void project link` to choose its destination.");
+	return connectedPlatform(process.env.VOID_API_URL || projectApiUrl || getActivePlatformConnection()?.apiUrl).apiUrl;
 }
 function getProxyUrl(root = process.cwd()) {
+	const apiUrl = getApiUrl(root);
 	if (process.env.VOID_PROXY_URL) return normalizePlatformApiUrl(process.env.VOID_PROXY_URL);
-	const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
-	if (apiUrl === STAGING_API_URL) return STAGING_PROXY_URL;
-	if (apiUrl === DEFAULT_API_URL) return DEFAULT_PROXY_URL;
 	const proxyUrl = listPlatformConnections().find((connection) => connection.apiUrl === apiUrl)?.proxyUrl;
 	if (proxyUrl === null || proxyUrl === void 0) throw new Error(`platform: No verified proxy is registered for ${apiUrl}. Reconnect with \`void connect ${apiUrl}\` or set VOID_PROXY_URL explicitly.`);
 	return proxyUrl;
@@ -412,4 +342,4 @@ async function runPlatformLogin(origin, provider = "github", onUrl) {
 	});
 }
 //#endregion
-export { saveToken as _, getApiUrl as a, getToken as c, openBrowser as d, readPlatformToken as f, savePlatformToken as g, runPlatformLogin as h, getAccountCredential as i, getTokenSource as l, runLogin as m, createCodeChallenge as n, getProxyUrl as o, removeToken as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, isStagingMode as u, DEFAULT_PROXY_URL as v, STAGING_PROXY_URL as y };
+export { getApiUrl as a, getToken as c, readPlatformToken as d, removeToken as f, saveToken as g, savePlatformToken as h, getAccountCredential as i, getTokenSource as l, runPlatformLogin as m, createCodeChallenge as n, getProxyUrl as o, runLogin as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, openBrowser as u };

package/dist/auth-DX3JURcX.mjs

@@ -0,0 +1,2 @@
+import { a as getApiUrl, m as runPlatformLogin, s as getSiteDomain } from "./auth-CQkSDS50.mjs";
+export { getApiUrl, getSiteDomain, runPlatformLogin };

package/dist/{auth-link-BLO4ptzo.mjs → auth-link-D75t9wO2.mjs}

@@ -1,8 +1,8 @@
-import { a as getApiUrl, c as getToken, d as openBrowser, g as savePlatformToken, h as runPlatformLogin } from "./auth-DLNN0D3Z.mjs";
-import { j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-BTZ3XkrB.mjs";
-import { r as selectPlatformLoginMethod } from "./login-CAsAsQ-_.mjs";
-import { t as discoverPlatform } from "./platform-cmd-B3hwKrFK.mjs";
+import { a as getApiUrl, c as getToken, h as savePlatformToken, m as runPlatformLogin, u as openBrowser } from "./auth-CQkSDS50.mjs";
+import { L as log } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { r as selectPlatformLoginMethod } from "./login-BuiMyUrx.mjs";
+import { t as discoverPlatform } from "./platform-cmd-DMDEc9uS.mjs";
 import { execFile } from "node:child_process";
 //#region src/cli/auth-link.ts
 async function runAuthLink(root, connectionId) {

package/dist/{auth-router-ZUg9MF_U.mjs → auth-router-ClfhL1J7.mjs}

@@ -1,6 +1,6 @@
-import { o as listPlatformConnections } from "./platform-registry-QBa4DK32.mjs";
-import { i as readDeploymentPlatform } from "./project-C0Fqu05O.mjs";
-import { I as select, W as isCancel } from "./dist-CTBk70IR.mjs";
+import { o as listPlatformConnections } from "./platform-registry-DkPPXfp_.mjs";
+import { n as readDeploymentPlatform } from "./project-DKG5Ra8p.mjs";
+import { K as select, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
 //#region src/cli/auth-router.ts
 async function chooseDestination(root, args, interactive) {
 	const saved = readDeploymentPlatform(root);
@@ -37,7 +37,7 @@ async function chooseDestination(root, args, interactive) {
 }
 async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isTTY)) {
 	if (args.subcommand === "link") {
-		const { runAccountCommand } = await import("./account-cmd-CjyxcGkM.mjs");
+		const { runAccountCommand } = await import("./account-cmd-vJhh5lrb.mjs");
 		await runAccountCommand(root, {
 			subcommand: "link",
 			...args.connectionId ? { connectionId: args.connectionId } : {}
@@ -45,17 +45,17 @@ async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isT
 		return;
 	}
 	if (args.subcommand === "token") {
-		const { runAccountCommand } = await import("./account-cmd-CjyxcGkM.mjs");
+		const { runAccountCommand } = await import("./account-cmd-vJhh5lrb.mjs");
 		await runAccountCommand(root, { subcommand: "token" });
 		return;
 	}
 	const destination = await chooseDestination(root, args, interactive);
 	if (destination.platform === "cloudflare") {
-		const { runCloudflareCommand } = await import("./cloudflare-cmd-BKlfGHAy.mjs");
+		const { runCloudflareCommand } = await import("./cloudflare-cmd-CmY8dGkd.mjs");
 		await runCloudflareCommand(root, { subcommand: args.subcommand === "whoami" || args.subcommand === "status" ? "status" : args.subcommand });
 		return;
 	}
-	const { runAccountCommand } = await import("./account-cmd-CjyxcGkM.mjs");
+	const { runAccountCommand } = await import("./account-cmd-vJhh5lrb.mjs");
 	const subcommand = args.subcommand === "status" ? "whoami" : args.subcommand;
 	if (!destination.apiUrl) {
 		await runAccountCommand(root, { subcommand });

package/dist/{better-auth-shared-rsBGBvWJ.mjs → better-auth-shared-hy6RPh9W.mjs}

@@ -77,11 +77,17 @@ function resolveSocialProviders(env, configuredProviders) {
 	}
 	return Object.keys(providers).length > 0 ? providers : void 0;
 }
-function appendAuthHeaders(c, source) {
+function appendAuthHeaders(c, source, includeCachePolicy) {
 	if (!source) return;
 	source.forEach((value, key) => {
+		if (!includeCachePolicy && ["cache-control", "pragma"].includes(key.toLowerCase())) return;
 		c.header(key, value, { append: key.toLowerCase() === "set-cookie" });
 	});
+	if (source.has("set-cookie") && !(source.get("cache-control") ?? "").split(",").some((directive) => [
+		"private",
+		"no-store",
+		"no-cache"
+	].includes(directive.trim().toLowerCase()))) c.header("Cache-Control", "private, no-store");
 }
 function resolveUserConfig(userConfig, defaults, request, env, dialect) {
 	const mergeEmailAndPasswordDefaults = (options) => {
@@ -175,7 +181,12 @@ function createVoidAuthRuntime(dialect, resolveDatabase, runVoidAuthMigrations)
 			}, async () => {
 				await next();
 			});
-			appendAuthHeaders(c, result.headers);
+			const credentialed = [
+				"cookie",
+				"authorization",
+				"cf-access-jwt-assertion"
+			].some((header) => c.req.raw.headers.has(header));
+			appendAuthHeaders(c, result.headers, state !== null || credentialed || result.headers?.has("set-cookie") === true);
 		} finally {
 			await dispose();
 		}

package/dist/{build-cmd-BxR5FROK.mjs → build-cmd-zMi1iFnS.mjs}

@@ -1,12 +1,18 @@
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-BTZ3XkrB.mjs";
-import { a as dim, c as import_picocolors, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken } from "./auth-CQkSDS50.mjs";
+import { H as outro, L as log, N as intro } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-DKAsFA4X.mjs";
+import { a as dim, c as import_picocolors, r as cliTitle } from "./output-CbM85T4k.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts
 const POLL_MS = 1e3;
+const BUILD_LOG_DRAIN_TIMEOUT_MS = 12e4;
+function isBuildLogComplete(page) {
+	if (!page.terminal) return false;
+	if (page.logsComplete === null || page.logsComplete === void 0) throw new Error("This platform cannot confirm that the final build logs were captured. Ask its administrator to upgrade the platform runtime, or read the retained logs without --follow.");
+	return page.logsComplete === true;
+}
 function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -24,7 +30,7 @@ function isFatalFollowError(err) {
 }
 /**
 * Pure follow-loop: repeatedly fetch pages since a cursor, write each new
-* line, and stop when the build reaches a terminal status. `fetchPage`,
+* line, and stop when the terminal build confirms its final logs were captured. `fetchPage`,
 * `write`, and `sleep` are injected so this is unit-testable. Returns the
 * final status + terminal flag.
 *
@@ -37,6 +43,7 @@ function isFatalFollowError(err) {
 async function followBuildLogs(opts) {
 	let cursor = opts.since;
 	let status = opts.status;
+	let terminalSince = null;
 	const pollMs = opts.pollMs ?? POLL_MS;
 	for (;;) {
 		await opts.sleep(pollMs);
@@ -51,10 +58,15 @@ async function followBuildLogs(opts) {
 		for (const l of pageResult.lines) opts.write(l.line);
 		cursor = pageResult.lastSeq;
 		status = pageResult.status;
-		if (pageResult.terminal) return {
+		if (isBuildLogComplete(pageResult)) return {
 			status,
 			terminal: true
 		};
+		if (pageResult.terminal) {
+			const now = Date.now();
+			terminalSince ??= now;
+			if (now - terminalSince >= BUILD_LOG_DRAIN_TIMEOUT_MS) throw new Error("Build finished, but its log producer did not confirm completion. Retry the command to recover the final log tail.");
+		} else terminalSince = null;
 	}
 }
 async function runBuildCommand(root, args) {
@@ -116,14 +128,14 @@ async function runBuildLogsCommand(root, args) {
 		await sleep(POLL_MS);
 	}
 	if (first.external) {
-		log.message(`This build ran on GitHub Actions. View logs:\n${import_picocolors.default.cyan(first.external)}`);
+		log.message(`This build ran on GitHub Actions. View logs:\n${import_picocolors.default.blue(first.external)}`);
 		return;
 	}
 	if (args.output) writeFileSync(args.output, "");
 	for (const l of first.lines) write(l.line);
 	let status = first.status;
 	let terminal = first.terminal;
-	if (args.follow && !terminal) ({status, terminal} = await followBuildLogs({
+	if (args.follow && !isBuildLogComplete(first)) ({status, terminal} = await followBuildLogs({
 		fetchPage: (since) => client.getBuildLogs(projectId, buildId, since),
 		write,
 		sleep,