void 0.23.0 → 0.24.0

package/AGENTS_TEMPLATE.md

@@ -1,6 +1,6 @@
 ## Void
 
 - This project uses [Void](https://void.cloud), a full-stack Vite framework for Cloudflare Workers with file-based API routing, server-rendered pages, and typed backend services.
-- Deploy to your Cloudflare account with `void deploy --platform cloudflare`, or connect to a Void platform with `void connect <url>` and deploy with `void deploy --platform void`. `void deploy` uses the saved destination.
+- Deploy to your Cloudflare account with `void deploy --platform cloudflare`, or explicitly connect to your team’s Void platform with `void connect <url>` before deploying with `void deploy --platform void`. `void deploy` uses the saved destination.
 - Use Void's CLI and typed APIs for development and infrastructure. Void infers Cloudflare bindings from your imports; use Void commands to manage them.
 - Before working with Void, read the relevant Markdown docs in `node_modules/void/skills/void/docs/`. Start with `guide/quickstart.md` for setup and `reference/cli.md` for commands; consult the other guides and references for any Void feature.

package/dist/{account-cmd-C84Ee8cO.mjs → account-cmd-vJhh5lrb.mjs}

@@ -1,13 +1,13 @@
-import { c as getToken, p as removeToken } from "./auth-CSkdO2Bb.mjs";
-import { j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { n as runLoginCommand } from "./login-UZKFM_u7.mjs";
+import { c as getToken, f as removeToken } from "./auth-CQkSDS50.mjs";
+import { L as log } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { n as runLoginCommand } from "./login-BuiMyUrx.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/account-cmd.ts
 async function runAccountCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
-		case "link": return import("./auth-link-CioEg6uY.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
+		case "link": return import("./auth-link-D75t9wO2.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) log.success("Logged out.");
 			else log.info("Not logged in.");

package/dist/{auth-CSkdO2Bb.mjs → auth-CQkSDS50.mjs}

@@ -1,15 +1,11 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { S as writeKeyringPassword, b as deleteKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as readKeyringPassword } from "./platform-registry-QBa4DK32.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
-import { a as readProjectApplicationDomain, f as VOID_CLOUD_PLATFORM, m as readLegacyHostedPlatformSelection, n as isLegacyVoidCloudProject, p as VOID_CLOUD_STAGING_PLATFORM, r as isVoidInternalStaging, s as readProjectPlatformUrl } from "./project-C0Fqu05O.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { C as writeKeyringPassword, S as readKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as deleteKeyringPassword } from "./platform-registry-DkPPXfp_.mjs";
+import { t as ensureCloudflaredToken } from "./cf-access-BGe5sWXF.mjs";
+import { i as readProjectPlatformUrl, r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
-//#region src/shared/proxy.ts
-const DEFAULT_PROXY_URL = "https://proxy.void.cloud";
-const STAGING_PROXY_URL = "https://proxy.staging.void.cloud";
-//#endregion
 //#region src/cli/auth.ts
 const CONFIG_DIR = join(homedir(), ".void");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
@@ -50,19 +46,22 @@ function readOriginScopedToken(apiUrl, config) {
 	}
 	return fileToken;
 }
-function isStagingMode(root = process.cwd()) {
-	return isVoidInternalStaging(root);
+function connectedPlatform(apiUrl) {
+	if (!apiUrl) throw new Error("platform: No Void platform connected. Run `void connect <url>` first.");
+	const origin = normalizePlatformApiUrl(apiUrl);
+	const connection = listPlatformConnections().find((entry) => entry.apiUrl === origin);
+	if (!connection) throw new Error(`platform: No connection to ${origin}. Run \`void connect ${origin}\` first.`);
+	return connection;
 }
 function getSiteDomain(root = process.cwd()) {
-	const legacySelection = readLegacyHostedPlatformSelection();
-	const domain = readProjectApplicationDomain(root) ?? (isStagingMode(root) ? VOID_CLOUD_STAGING_PLATFORM.applicationDomain : void 0) ?? (isLegacyVoidCloudProject(root) || process.env.VOID_TOKEN && process.env.VOID_API_URL === void 0 ? VOID_CLOUD_PLATFORM.applicationDomain : void 0) ?? getActivePlatformConnection()?.applicationDomain ?? legacySelection?.applicationDomain;
-	if (!domain) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
-	return domain;
+	const connection = connectedPlatform(getApiUrl(root));
+	if (!connection.applicationDomain) throw new Error(`platform: Missing application domain. Run \`void connect ${connection.apiUrl}\` to refresh the connection.`);
+	return connection.applicationDomain;
 }
 /**
 * Read the deploy token.
 * Priority: origin-bound VOID_TOKEN > system keychain > migrated config.
-* An unscoped environment token retains its historical Void Cloud destination.
+* Environment tokens must name their recipient with VOID_API_URL.
 */
 function getToken(root = process.cwd()) {
 	const envToken = process.env.VOID_TOKEN;
@@ -79,7 +78,7 @@ function getToken(root = process.cwd()) {
 /** Account actions follow the selected connection, independently of application metadata. */
 function getAccountCredential() {
 	const config = readConfig();
-	const apiUrl = normalizePlatformApiUrl(process.env.VOID_API_URL || (process.env.VOID_TOKEN ? DEFAULT_API_URL : getActivePlatformConnection()?.apiUrl ?? config.api ?? readLegacyHostedPlatformSelection()?.apiUrl ?? (keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : DEFAULT_API_URL)));
+	const apiUrl = connectedPlatform(process.env.VOID_API_URL || getActivePlatformConnection()?.apiUrl).apiUrl;
 	return {
 		apiUrl,
 		token: readTokenForOrigin(apiUrl, config)
@@ -88,7 +87,8 @@ function getAccountCredential() {
 function readTokenForOrigin(apiUrl, config) {
 	const envToken = process.env.VOID_TOKEN;
 	if (envToken) {
-		if (apiUrl !== (process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
+		if (!process.env.VOID_API_URL) throw new Error("auth: Set VOID_API_URL alongside VOID_TOKEN to identify the connected platform that issued it.");
+		if (apiUrl !== normalizePlatformApiUrl(process.env.VOID_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
 		return envToken;
 	}
 	return readOriginScopedToken(apiUrl, config);
@@ -126,8 +126,6 @@ function removeToken(root = process.cwd()) {
 	} catch {}
 	return removed;
 }
-const DEFAULT_API_URL = VOID_CLOUD_PLATFORM.apiUrl;
-const STAGING_API_URL = VOID_CLOUD_STAGING_PLATFORM.apiUrl;
 function base64Url(buffer) {
 	return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
@@ -163,40 +161,15 @@ async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
 	if (!body || typeof body !== "object" || !("token" in body) || typeof body.token !== "string" || body.token.length === 0) throw new Error("auth: Login code exchange did not return a token.");
 	return body.token;
 }
-/**
-* Read the API URL from environment or config file.
-* Priority: VOID_API_URL env var > ~/.void/config.json > default
-*/
+/** Environment and project selections must refer to a verified local connection. */
 function getApiUrl(root = process.cwd()) {
-	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);
-	if (isStagingMode(root)) return STAGING_API_URL;
 	const projectApiUrl = readProjectPlatformUrl(root);
-	if (projectApiUrl) {
-		if (projectApiUrl === DEFAULT_API_URL || projectApiUrl === STAGING_API_URL) return projectApiUrl;
-		if (listPlatformConnections().some((connection) => connection.apiUrl === projectApiUrl)) return projectApiUrl;
-		throw new Error(`platform: Project metadata selected unverified platform ${projectApiUrl}. Connect to it explicitly with \`void connect ${projectApiUrl}\` before forwarding credentials.`);
-	}
-	const config = readConfig();
-	const legacySelection = readLegacyHostedPlatformSelection();
-	let apiUrl = (isLegacyVoidCloudProject(root) ? DEFAULT_API_URL : void 0) ?? getActivePlatformConnection()?.apiUrl ?? config.api ?? legacySelection?.apiUrl;
-	apiUrl ??= process.env.VOID_TOKEN ? DEFAULT_API_URL : void 0;
-	if (!apiUrl) {
-		apiUrl = keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : void 0;
-		if (apiUrl) try {
-			writeConfig({
-				...config,
-				api: apiUrl
-			});
-		} catch {}
-	}
-	if (!apiUrl) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
-	return normalizePlatformApiUrl(apiUrl);
+	if (readProjectConfig(root) && !projectApiUrl) throw new Error("platform: This project link has no platform URL. Run `void connect <url>`, then `void project link` to choose its destination.");
+	return connectedPlatform(process.env.VOID_API_URL || projectApiUrl || getActivePlatformConnection()?.apiUrl).apiUrl;
 }
 function getProxyUrl(root = process.cwd()) {
+	const apiUrl = getApiUrl(root);
 	if (process.env.VOID_PROXY_URL) return normalizePlatformApiUrl(process.env.VOID_PROXY_URL);
-	const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
-	if (apiUrl === STAGING_API_URL) return STAGING_PROXY_URL;
-	if (apiUrl === DEFAULT_API_URL) return DEFAULT_PROXY_URL;
 	const proxyUrl = listPlatformConnections().find((connection) => connection.apiUrl === apiUrl)?.proxyUrl;
 	if (proxyUrl === null || proxyUrl === void 0) throw new Error(`platform: No verified proxy is registered for ${apiUrl}. Reconnect with \`void connect ${apiUrl}\` or set VOID_PROXY_URL explicitly.`);
 	return proxyUrl;
@@ -369,4 +342,4 @@ async function runPlatformLogin(origin, provider = "github", onUrl) {
 	});
 }
 //#endregion
-export { saveToken as _, getApiUrl as a, getToken as c, openBrowser as d, readPlatformToken as f, savePlatformToken as g, runPlatformLogin as h, getAccountCredential as i, getTokenSource as l, runLogin as m, createCodeChallenge as n, getProxyUrl as o, removeToken as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, isStagingMode as u, DEFAULT_PROXY_URL as v, STAGING_PROXY_URL as y };
+export { getApiUrl as a, getToken as c, readPlatformToken as d, removeToken as f, saveToken as g, savePlatformToken as h, getAccountCredential as i, getTokenSource as l, runPlatformLogin as m, createCodeChallenge as n, getProxyUrl as o, runLogin as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, openBrowser as u };

package/dist/auth-DX3JURcX.mjs

@@ -0,0 +1,2 @@
+import { a as getApiUrl, m as runPlatformLogin, s as getSiteDomain } from "./auth-CQkSDS50.mjs";
+export { getApiUrl, getSiteDomain, runPlatformLogin };

package/dist/{auth-link-CioEg6uY.mjs → auth-link-D75t9wO2.mjs}

@@ -1,8 +1,8 @@
-import { a as getApiUrl, c as getToken, d as openBrowser, g as savePlatformToken, h as runPlatformLogin } from "./auth-CSkdO2Bb.mjs";
-import { j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { r as selectPlatformLoginMethod } from "./login-UZKFM_u7.mjs";
-import { t as discoverPlatform } from "./platform-cmd-DMcQStSc.mjs";
+import { a as getApiUrl, c as getToken, h as savePlatformToken, m as runPlatformLogin, u as openBrowser } from "./auth-CQkSDS50.mjs";
+import { L as log } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { r as selectPlatformLoginMethod } from "./login-BuiMyUrx.mjs";
+import { t as discoverPlatform } from "./platform-cmd-DMDEc9uS.mjs";
 import { execFile } from "node:child_process";
 //#region src/cli/auth-link.ts
 async function runAuthLink(root, connectionId) {

package/dist/{auth-router-BsR981d4.mjs → auth-router-ClfhL1J7.mjs}

@@ -1,6 +1,6 @@
-import { o as listPlatformConnections } from "./platform-registry-QBa4DK32.mjs";
-import { i as readDeploymentPlatform } from "./project-C0Fqu05O.mjs";
-import { I as select, W as isCancel } from "./dist-CTBk70IR.mjs";
+import { o as listPlatformConnections } from "./platform-registry-DkPPXfp_.mjs";
+import { n as readDeploymentPlatform } from "./project-DKG5Ra8p.mjs";
+import { K as select, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
 //#region src/cli/auth-router.ts
 async function chooseDestination(root, args, interactive) {
 	const saved = readDeploymentPlatform(root);
@@ -37,7 +37,7 @@ async function chooseDestination(root, args, interactive) {
 }
 async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isTTY)) {
 	if (args.subcommand === "link") {
-		const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
+		const { runAccountCommand } = await import("./account-cmd-vJhh5lrb.mjs");
 		await runAccountCommand(root, {
 			subcommand: "link",
 			...args.connectionId ? { connectionId: args.connectionId } : {}
@@ -45,17 +45,17 @@ async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isT
 		return;
 	}
 	if (args.subcommand === "token") {
-		const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
+		const { runAccountCommand } = await import("./account-cmd-vJhh5lrb.mjs");
 		await runAccountCommand(root, { subcommand: "token" });
 		return;
 	}
 	const destination = await chooseDestination(root, args, interactive);
 	if (destination.platform === "cloudflare") {
-		const { runCloudflareCommand } = await import("./cloudflare-cmd-BcrVyTmJ.mjs");
+		const { runCloudflareCommand } = await import("./cloudflare-cmd-CmY8dGkd.mjs");
 		await runCloudflareCommand(root, { subcommand: args.subcommand === "whoami" || args.subcommand === "status" ? "status" : args.subcommand });
 		return;
 	}
-	const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
+	const { runAccountCommand } = await import("./account-cmd-vJhh5lrb.mjs");
 	const subcommand = args.subcommand === "status" ? "whoami" : args.subcommand;
 	if (!destination.apiUrl) {
 		await runAccountCommand(root, { subcommand });

package/dist/{build-cmd-LzvNJORH.mjs → build-cmd-zMi1iFnS.mjs}

@@ -1,8 +1,8 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
-import { a as dim, c as import_picocolors, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken } from "./auth-CQkSDS50.mjs";
+import { H as outro, L as log, N as intro } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-DKAsFA4X.mjs";
+import { a as dim, c as import_picocolors, r as cliTitle } from "./output-CbM85T4k.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts
@@ -128,7 +128,7 @@ async function runBuildLogsCommand(root, args) {
 		await sleep(POLL_MS);
 	}
 	if (first.external) {
-		log.message(`This build ran on GitHub Actions. View logs:\n${import_picocolors.default.cyan(first.external)}`);
+		log.message(`This build ran on GitHub Actions. View logs:\n${import_picocolors.default.blue(first.external)}`);
 		return;
 	}
 	if (args.output) writeFileSync(args.output, "");

package/dist/{cache-C4MvnrMH.mjs → cache-ZtQmyxVV.mjs}

@@ -1,8 +1,8 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { a as dim, i as createSpinner, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken } from "./auth-CQkSDS50.mjs";
+import { H as outro, L as log, N as intro } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { a as dim, i as createSpinner, r as cliTitle } from "./output-CbM85T4k.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {

package/dist/{cancel-deploy-abUxpP2n.mjs → cancel-deploy-Box0kkEV.mjs}

@@ -1,8 +1,8 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { E as confirm, O as intro, P as outro, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-DKG5Ra8p.mjs";
+import { c as getToken } from "./auth-CQkSDS50.mjs";
+import { A as confirm, H as outro, L as log, N as intro, tt as isCancel } from "./prompts-BNUoTiaf.mjs";
+import { n as PlatformClient } from "./client-DKAsFA4X.mjs";
+import { r as cliTitle } from "./output-CbM85T4k.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 	"pending",

package/dist/{cf-access-P0iZnu0q.mjs → cf-access-BGe5sWXF.mjs}

@@ -1,5 +1,5 @@
-import { n as isVoidAccessGatedUrl, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { S as writeKeyringPassword, c as platformCredentialAccount, s as normalizePlatformApiUrl, x as readKeyringPassword } from "./platform-registry-QBa4DK32.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { C as writeKeyringPassword, S as readKeyringPassword, c as platformCredentialAccount, s as normalizePlatformApiUrl } from "./platform-registry-DkPPXfp_.mjs";
 import { spawnSync } from "node:child_process";
 //#region src/cli/cf-access.ts
 const ACCESS_KEYRING_SERVICE = "dev.void.cli.access";
@@ -106,53 +106,9 @@ function ensurePlatformAccessToken(apiUrl, challenged = false, required = false,
 	keyringTokens.set(origin, token);
 	writeKeyringPassword(ACCESS_KEYRING_SERVICE, account, token);
 }
-const probedHosts = /* @__PURE__ */ new Set();
-/**
-* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
-* probe the locally-installed `cloudflared` binary for a cached user JWT
-* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
-* token, open a browser login flow to populate the cache, then re-read it.
-*
-* Cached per-host so that an early non-gated call (e.g. prod) does not
-* permanently disable the probe for a later gated call (e.g. staging) in
-* the same process. Noop when:
-*   - a service-token pair is already set (CI path)
-*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
-*   - the target host is not gated
-*   - `cloudflared` is not installed
-*/
+/** Restore only credentials scoped to this explicitly selected platform origin. */
 function ensureCloudflaredToken(apiUrl) {
-	if (!isVoidAccessGatedUrl(apiUrl) || process.env.VOID_ACCESS_ORIGIN || process.env.VOID_ACCESS_CREDENTIALS) {
-		ensurePlatformAccessToken(apiUrl);
-		return;
-	}
-	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
-	if (process.env.CF_ACCESS_TOKEN) return;
-	if (!isVoidAccessGatedUrl(apiUrl)) return;
-	const host = new URL(apiUrl).hostname;
-	if (probedHosts.has(host)) return;
-	probedHosts.add(host);
-	let token = runCloudflared([
-		"access",
-		"token",
-		`-app=${apiUrl}`
-	]);
-	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
-		runCloudflared([
-			"access",
-			"login",
-			apiUrl
-		], {
-			inherit: true,
-			timeoutMs: 12e4
-		});
-		token = runCloudflared([
-			"access",
-			"token",
-			`-app=${apiUrl}`
-		]);
-	}
-	if (token) process.env.CF_ACCESS_TOKEN = token;
+	ensurePlatformAccessToken(apiUrl);
 }
 function runCloudflared(args, opts) {
 	try {

package/dist/{cf-access-DRsQRe6k.mjs → cf-access-TWNzXltp.mjs}

@@ -7,14 +7,6 @@
 *   2. User JWT (`CF_ACCESS_TOKEN`) — dev path, typically populated via `cloudflared access token`
 *   3. No headers — prod, or unprotected hostnames
 */
-function isVoidAccessGatedUrl(targetUrl) {
-	try {
-		const url = new URL(targetUrl);
-		return url.protocol === "https:" && (url.hostname.endsWith(".staging.void.cloud") || url.hostname.endsWith(".staging.void.app"));
-	} catch {
-		return false;
-	}
-}
 function accessHeaders(env) {
 	const id = env.CF_ACCESS_CLIENT_ID;
 	const secret = env.CF_ACCESS_CLIENT_SECRET;
@@ -26,7 +18,7 @@ function accessHeaders(env) {
 	if (typeof token === "string" && token.length > 0) return { "cf-access-token": token };
 	return {};
 }
-/** Attach shared Void Access credentials only to known hosted staging origins. */
+/** Attach Access credentials only to their explicitly scoped origin. */
 function cfAccessHeaders(env, targetUrl) {
 	let origin;
 	try {
@@ -52,7 +44,7 @@ function cfAccessHeaders(env, targetUrl) {
 	} catch {
 		return {};
 	}
-	return isVoidAccessGatedUrl(targetUrl) ? accessHeaders(env) : {};
+	return {};
 }
 /**
 * Capture credentials for a Cloudflare Worker readiness request whose target
@@ -72,4 +64,4 @@ function scopedAccessCredentials(env, targetUrl) {
 	} : { CF_ACCESS_TOKEN: headers["cf-access-token"] } });
 }
 //#endregion
-export { trustedCloudflareWorkerAccessHeaders as i, isVoidAccessGatedUrl as n, scopedAccessCredentials as r, cfAccessHeaders as t };
+export { scopedAccessCredentials as n, trustedCloudflareWorkerAccessHeaders as r, cfAccessHeaders as t };

package/dist/cli/cli.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { a as join } from "../dist-BVqXeR_h.mjs";
-import { j as log } from "../dist-CTBk70IR.mjs";
+import { L as log } from "../prompts-BNUoTiaf.mjs";
 import { n as getPackageDir } from "../agents-B_pX_HmQ.mjs";
 import { t as formatCloudflareUserMessage } from "../cloudflare-user-output-Q-k0QoNQ.mjs";
-import { i as printVoidHeader, n as printGlobalHelp, r as printHelpPage, t as getHelpPath } from "../help-daGKjXGk.mjs";
-import { r as OperatorClientError } from "../operator-client-DUwumHpQ.mjs";
-import { n as platformSubcommands, t as parsePlatformArgs } from "../platform-args-BJdRtlLq.mjs";
+import { c as import_picocolors } from "../output-CbM85T4k.mjs";
+import { i as printVoidHeader, n as printGlobalHelp, r as printHelpPage, t as getHelpPath } from "../help-Dotbf6iz.mjs";
+import { r as OperatorClientError } from "../operator-client-CpHjTd0t.mjs";
+import { n as platformSubcommands, t as parsePlatformArgs } from "../platform-args-3k8X9-H_.mjs";
 import { readFileSync } from "node:fs";
 import { parseArgs } from "node:util";
 //#region src/cli/account-args.ts
@@ -1612,7 +1613,7 @@ async function runSubcommandGroup(command, subcommands, parse, run) {
 	const hasNamedSubcommand = args.slice(1).some((arg) => subcommands.some(({ name }) => name === arg));
 	try {
 		if ((!sub || sub.startsWith("-") && !hasNamedSubcommand) && process.stdin.isTTY) {
-			const { promptSubcommand } = await import("../subcommand-prompt-CY1C4fvl.mjs");
+			const { promptSubcommand } = await import("../subcommand-prompt-klFCfcor.mjs");
 			if (command === "platform" && !sub) log.info("A Void platform lets a team deploy Void apps to a shared Cloudflare account.\nThis command sets up and manages platforms. Join with `void connect <url>`.\nDocs: https://void.cloud/guide/self-hosted-platform");
 			const result = await promptSubcommand(command, subcommands);
 			if (!result) process.exit(0);
@@ -1627,8 +1628,10 @@ async function runSubcommandGroup(command, subcommands, parse, run) {
 			process.exit(1);
 		}
 		const message = formatCloudflareUserMessage(err instanceof Error ? err.message : String(err));
-		if (command === "platform") console.error(err instanceof OperatorClientError && err.details !== void 0 ? `${message}\nPartial result:\n${JSON.stringify(err.details, null, 2)}` : message);
-		else log.error(message);
+		if (command === "platform") {
+			const platformMessage = message.replace(/^platform:/, import_picocolors.default.bold(import_picocolors.default.red("platform:")));
+			console.error(err instanceof OperatorClientError && err.details !== void 0 ? `${platformMessage}\nPartial result:\n${JSON.stringify(err.details, null, 2)}` : platformMessage);
+		} else log.error(message);
 		process.exit(1);
 	}
 }
@@ -1652,7 +1655,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-bjXdFCtn.mjs").then(({ runDeploy }) => {
+	import("../deploy-irP5q0-x.mjs").then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -1670,25 +1673,25 @@ if (helpPath) {
 	});
 } else if (command === "connect") (async () => {
 	const parsed = parseConnectArgs(args.slice(1));
-	const { runConnectCommand } = await import("../connect-Bd4kJd9U.mjs");
+	const { runConnectCommand } = await import("../connect-B-usTnlF.mjs");
 	await runConnectCommand(process.cwd(), parsed);
 })().catch((err) => {
 	log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 	process.exit(1);
 });
-else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-router-BsR981d4.mjs").then(({ runAuthRouter }) => runAuthRouter(root, parsed)));
-else if (command === "account") runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (root, parsed) => import("../account-cmd-C84Ee8cO.mjs").then(({ runAccountCommand }) => runAccountCommand(root, parsed)));
-else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-Bt-1w6pY.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
-else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-BcrVyTmJ.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-CNzrqvBv.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-Dli5fP0B.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-y5Tvydvo.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-B3umsW75.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-8uG64XLl.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-BS6qYHDb.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-BVaUUumi.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
-else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-v45BdfKX.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
-else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-LzvNJORH.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
+else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-router-ClfhL1J7.mjs").then(({ runAuthRouter }) => runAuthRouter(root, parsed)));
+else if (command === "account") runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (root, parsed) => import("../account-cmd-vJhh5lrb.mjs").then(({ runAccountCommand }) => runAccountCommand(root, parsed)));
+else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-pMTRhvYs.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
+else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-CmY8dGkd.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-DxnXstAq.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-ByWJWBUG.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-DFfQE8jg.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-CdnhUHvJ.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-Ck2eZ2iB.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-DmGdHi5i.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-DvQTWzDU.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-DftuEvIt.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
+else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-zMi1iFnS.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
 else if (command === "info") import("../info-B97bTX9N.mjs").then(async ({ runInfoCommand }) => {
 	try {
 		await runInfoCommand(process.cwd(), parseInfoArgs(args.slice(1)));
@@ -1711,7 +1714,7 @@ else if (command === "prepare") {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../prepare-B5Mkic5u.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-CBLT3CHH.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			log.error(formatCloudflareUserMessage(err.message ?? String(err)));
 			process.exit(1);
@@ -1719,7 +1722,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-Bvy7zrBo.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-BTQEZZGJ.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -1737,7 +1740,7 @@ else if (command === "prepare") {
 		log.error("migrate: This command takes no arguments.");
 		process.exit(1);
 	}
-	import("../migrate-8_2u55MD.mjs").then(({ runMigrateCommand }) => {
+	import("../migrate-BCiJ8w0f.mjs").then(({ runMigrateCommand }) => {
 		runMigrateCommand(process.cwd()).catch((err) => {
 			log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 			process.exit(1);
@@ -1849,52 +1852,52 @@ else if (command === "prepare") {
 	];
 	(async () => {
 		printVoidHeader();
-		const { promptSubcommand } = await import("../subcommand-prompt-CY1C4fvl.mjs");
+		const { promptSubcommand } = await import("../subcommand-prompt-klFCfcor.mjs");
 		const result = await promptSubcommand("", topLevelCommands);
 		if (!result) process.exit(0);
 		const cmd = result.subcommand;
 		const root = process.cwd();
 		switch (cmd) {
 			case "connect": {
-				const { runConnectCommand } = await import("../connect-Bd4kJd9U.mjs");
+				const { runConnectCommand } = await import("../connect-B-usTnlF.mjs");
 				await runConnectCommand(root, parseConnectArgs([]));
 				return;
 			}
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-Bvy7zrBo.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-BTQEZZGJ.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "migrate": {
-				const { runMigrateCommand } = await import("../migrate-8_2u55MD.mjs");
+				const { runMigrateCommand } = await import("../migrate-BCiJ8w0f.mjs");
 				await runMigrateCommand(root);
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-bjXdFCtn.mjs");
+				const { runDeploy } = await import("../deploy-irP5q0-x.mjs");
 				await runDeploy(root);
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-router-BsR981d4.mjs").then(({ runAuthRouter }) => runAuthRouter(r, p)));
-			case "account": return runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (r, p) => import("../account-cmd-C84Ee8cO.mjs").then(({ runAccountCommand }) => runAccountCommand(r, p)));
-			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-Bt-1w6pY.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
-			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-BcrVyTmJ.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-CNzrqvBv.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-Dli5fP0B.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-y5Tvydvo.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-v45BdfKX.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
-			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-LzvNJORH.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-B3umsW75.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-8uG64XLl.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-BS6qYHDb.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-BVaUUumi.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-router-ClfhL1J7.mjs").then(({ runAuthRouter }) => runAuthRouter(r, p)));
+			case "account": return runSubcommandGroup("account", accountSubcommands, parseAccountArgs, (r, p) => import("../account-cmd-vJhh5lrb.mjs").then(({ runAccountCommand }) => runAccountCommand(r, p)));
+			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-pMTRhvYs.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
+			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-CmY8dGkd.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-DxnXstAq.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-ByWJWBUG.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-DFfQE8jg.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-DftuEvIt.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
+			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-zMi1iFnS.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-CdnhUHvJ.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-Ck2eZ2iB.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-DmGdHi5i.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-DvQTWzDU.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "info": {
 				const { runInfoCommand } = await import("../info-B97bTX9N.mjs");
 				await runInfoCommand(root, parseInfoArgs([]));
 				return;
 			}
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-B5Mkic5u.mjs");
+				const { runPrepareCommand } = await import("../prepare-CBLT3CHH.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}