void 0.23.0 → 0.24.0

package/skills/void/docs/guide/platform/installation/maintenance.md

@@ -28,6 +28,13 @@ existing gate, verify that its service policy admits the installation token and
 that the application covers the printed API and proxy origins. A Cloudflare
 management API token does not authenticate an Access-protected HTTP request.
 
+For automatic setup, resuming also creates or verifies an Access exception
+limited to `/health` on the reserved dispatch health hostname. Void still requires
+its private probe token on that endpoint; requests without it cannot reach an
+application. This lets installation check routing while employee protection and
+account-wide Default-Deny remain enabled. It does not bypass Access for an entire
+Worker or for deployed apps.
+
 For externally supplied credentials, set `VOID_ACCESS_CREDENTIALS` from your
 secret manager to an object keyed by each exact API/proxy origin, with
 `CF_ACCESS_CLIENT_ID` and `CF_ACCESS_CLIENT_SECRET` in each entry. Then rerun
@@ -35,6 +42,11 @@ secret manager to an object keyed by each exact API/proxy origin, with
 and stops if the gate still rejects its checks. Account-wide Default-Deny and
 deployed-application policies remain your responsibility.
 
+If **System Status** reports `proxy HTTP 302 (redirect)` on an older Access-protected
+installation, upgrade with `void platform upgrade <id>`. Current installations use
+a private connection for the dashboard's proxy health check. Keep the proxy's
+Access protection enabled.
+
 ### Expired administrator setup code
 
 Resume an unfinished installation with `void platform install --resume --name <id>`.

package/skills/void/docs/guide/platform/installation/prerequisites.md

@@ -8,7 +8,7 @@ To run a Void platform, you need:
 
 - A Cloudflare account with Workers for Platforms and R2 enabled.
 - An empty hosted PostgreSQL database.
-- An account with your chosen login provider. GitHub is the default; Google, OIDC, and Cloudflare Access are also supported.
+- An account with your chosen login provider: GitHub, Google, OIDC, or Cloudflare Access.
 - A domain for your apps, or `workers.dev` for testing. You can [add a domain later](/guide/platform/installation/domains#adding-a-domain).
 
 Void creates the Workers, storage, queues, routing, and database tables through the CLI.
@@ -19,9 +19,10 @@ Workers for Platforms requires a paid plan. Your database and Cloudflare usage a
 
 In the [Cloudflare dashboard](https://dash.cloudflare.com/), select the account where you want the platform to live:
 
-1. Open **Workers for Platforms** and enable its plan. Review [Workers for Platforms pricing](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/platform/pricing/) before confirming.
-2. Open **R2 Object Storage** and complete its activation. Void creates the bucket later.
-3. For a domain installation, choose a domain you own, such as `example.app`. If you need one, register it with your preferred registrar. Use a spare domain's root: apps will be served at `my-app.example.app`. For workers.dev testing, skip this step and the DNS setup below.
+1. Open **Workers & Pages** once to let Cloudflare provision Workers for the account.
+2. Open **Workers for Platforms** and enable its plan. Review [Workers for Platforms pricing](https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/platform/pricing/) before confirming.
+3. Open **R2 Object Storage** and complete its activation. Void creates the bucket later.
+4. For a domain installation, choose a domain you own, such as `example.app`. If you need one, register it with your preferred registrar. Use a spare domain's root: apps will be served at `my-app.example.app`. For workers.dev testing, skip this step and the DNS setup below.
 
 If that domain is already in this Cloudflare account, use its existing zone. Otherwise, [add the domain to Cloudflare](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/) and follow the nameserver instructions until the zone is active. A zone is Cloudflare's DNS configuration for a domain; creating one does not buy the domain.
 
@@ -36,7 +37,7 @@ pnpm add --global void
 void platform install --plan
 ```
 
-Sign in to Cloudflare when prompted, then choose an installation name and account. `--plan` previews the resources without changing them or requiring runtime secrets.
+Sign in to Cloudflare when prompted, then choose an installation name and account. `--plan` previews the resources without changing them or requiring runtime secrets. Completed plans save your choices locally. Run `void platform install` again to select a saved plan; Void checks the current Cloudflare state before asking you to apply it.
 
 For a domain installation, use these answers. Testing mode skips the application domain, zone, and catch-all questions:
 
@@ -51,7 +52,7 @@ For a domain installation, use these answers. Testing mode skips the application
 
 Choose an unused installation name in your account. For example, `team` creates resources such as `void-team-api` and `void-team-proxy`.
 
-The preview includes your login callback URL and links for creating credentials. Keep it open while following [Credentials](/guide/platform/installation/credentials), then run the install command printed at the end.
+The preview lists the credentials you will need. Review [Credentials](/guide/platform/installation/credentials), then run the install command printed at the end. The guided installation provides setup links and the login callback when needed.
 
 You can select either path directly:
 
@@ -87,7 +88,7 @@ Once installation claims the database, continue using that same database for res
 The installer can create Hyperdrive for you or use one you manage separately. For an existing configuration:
 
 1. Point it at the dedicated platform database using a runtime user, and disable SQL result caching.
-2. Select it in the installer and confirm the database, host, port, and runtime user.
+2. Select it in the installer and review the database, host, port, and runtime user.
 3. Supply a database owner connection at the PostgreSQL URL prompt so Void can apply migrations.
 
 To create one first, choose **Set up a separately managed Hyperdrive** and follow the printed instructions or [Cloudflare’s setup guide](https://developers.cloudflare.com/hyperdrive/get-started/). Rerun the installer once it is ready. Void leaves its configuration under your control. For unattended setup, use the Hyperdrive variables in [Install from CI](/guide/platform/installation/ci).

package/skills/void/docs/guide/platform/installation/setup.md

@@ -4,13 +4,19 @@ outline: deep
 
 # Install and Configure Login
 
+Press Enter to accept a suggested zone or display name, or type to replace it. Enter your own installation name and application domain; examples such as `company` and `example.com` are placeholders.
+
 For workers.dev testing, start the interactive install and choose your login method below:
 
 ```sh
 void platform install --workers-dev
 ```
 
-For a domain installation, the management token is the one value the interactive installer needs in the shell. Browser login cannot create the application's DNS record. In Bash or zsh, read the token without displaying it or putting its value in command history:
+For a domain installation or Access setup, Void guides you to create a management API token and paste it into a masked prompt. Browser login can preview DNS, but cannot change it or configure Access. The token-creation link preselects the permissions for your choices; scope the token to your account and, when using a domain, its zone. No shell environment variable is needed for interactive installation.
+
+::: details Use an existing management token from the shell
+
+Set `CLOUDFLARE_API_TOKEN` to use an existing token instead of the prompt. In Bash or zsh, read it without displaying it or putting its value in command history:
 
 ```sh
 printf 'Cloudflare management API token: '
@@ -20,7 +26,7 @@ export CLOUDFLARE_API_TOKEN
 void platform install
 ```
 
-::: details PowerShell equivalent
+In PowerShell:
 
 ```powershell
 $env:CLOUDFLARE_API_TOKEN = [System.Net.NetworkCredential]::new('', (Read-Host 'Cloudflare management API token' -AsSecureString)).Password
@@ -29,14 +35,66 @@ void platform install
 
 :::
 
-After reviewing `--plan`, run the command printed under **Next step: run this command to install**. It carries your choices into installation. Confirm the plan, then follow the credential prompts. Void opens the relevant setup pages and provides fallback links in the terminal. It reuses values you have already supplied.
+After reviewing `--plan`, run `void platform install` and select your saved plan, or run the command printed under **Next, run this command to install the platform**. Both carry your choices into installation and check the current Cloudflare state. Review the refreshed plan. At **Apply this plan?**, **Yes** is selected; press Enter to continue to the credential prompts, or choose **No** to stop. Void opens the relevant setup pages and provides fallback links in the terminal. It reuses values you have already supplied.
+
+Saved plans contain your installation choices, including paths to any authentication configuration or custom runtime. They contain no secrets or approval to install. Declining the plan or cancelling management-token setup keeps those choices for your next attempt.
 
 ## Choose login methods
 
-The installer offers GitHub, Google, generic OIDC, and Cloudflare Access login.
+The installer offers GitHub, Google, generic OIDC, and Cloudflare Access login. Select all methods you want to enable; none are selected initially.
 Cloudflare Access protection is a separate choice from Access login. The
 GitHub OAuth steps below apply when you select GitHub login.
 
+## Choose who can access apps
+
+The installer asks **Who should be able to access deployed apps?**
+
+- **Same people allowed by the platform’s Access policy** reuses your selected company identities and policies. This is recommended when platform Access protection is enabled.
+- **Anyone — public apps** allows public visits.
+- **Choose a different Access policy** selects separate company rules for apps. Without platform protection, this option is **Set up Cloudflare Access protection**.
+
+The plan shows the default app access. Void finishes and verifies app access before
+opening application traffic; new projects inherit the selected default automatically.
+If setup stops, use the printed resume command. Existing installations retain their
+administrator settings during upgrades.
+
+App protection uses the account hosting your platform. If platform login or
+protection uses another account, select equivalent identity providers and policies
+in the hosting account when prompted. Use the app domain’s apex or a workers.dev
+hostname for the API so it stays outside the app wildcard.
+
+Void checks account-wide Default-Deny during setup. For public apps in an account
+that requires Access rules, it creates rules for each app and its verified custom
+domains. Other subdomains keep their existing access rules. It leaves account-wide
+Default-Deny enabled and does not bypass the platform API or proxy.
+
+App rules need **Access: Apps and Policies Edit** and **Organizations, Identity
+Providers, and Groups Read**. Void stores this management token encrypted for future
+apps and domain changes. The installer asks before retaining a setup-only token for
+that purpose, or guides you to create a dedicated token. Public apps without
+Default-Deny need no ongoing Access-management credential.
+
+For scripts, use `--app-access public|platform|custom`. Supply
+`VOID_PLATFORM_APP_ACCESS_TOKEN` when app rules are needed, or add an `appAccess`
+section to your `--auth-config` file:
+
+```json
+{
+  "appAccess": {
+    "mode": "custom",
+    "identityProviderIds": ["hosting-account-identity-provider-id"],
+    "policyIds": ["hosting-account-company-policy-id"],
+    "tokenEnv": "APP_ACCESS_API_TOKEN"
+  }
+}
+```
+
+Keep the file’s existing `connections` configuration. For `mode: "platform"`,
+same-account identity and policy selections are reused. Headless setup requires an
+explicit app-management token; it never silently retains an installer-only token.
+
+## Finish login configuration
+
 For Google, create an OAuth client and register the printed callback URL. You
 can restrict it to named Google Workspace domains. For OIDC or Access login,
 provide the issuer URL, client ID, and client secret. Select **Company-approved
@@ -86,6 +144,10 @@ with GitHub or another login method. With company-approved signup, a colleague
 who passes the company gate can create an ordinary account using GitHub even
 when their GitHub email differs from their company email.
 
+Your identity provider determines how employees sign in, such as through Okta or
+Google Workspace. Your Access policies determine who can reach the platform and
+which MFA or device requirements apply.
+
 Automatic setup uses an existing Zero Trust organization, selected identity
 providers, and existing company policies. Void creates dedicated applications
 and a scoped service token for protected installation checks. It preserves your
@@ -94,9 +156,13 @@ company policies, including device and MFA requirements.
 The setup credential needs **Access: Apps and Policies Write** and
 **Access: Organizations, Identity Providers, and Groups Read** in the identity
 account. Creating protection also needs **Access: Service Tokens Write**.
-Provide a separate setup token through `VOID_PLATFORM_ACCESS_SETUP_TOKEN` if
-your Cloudflare management credential lacks these permissions. These permissions
-are not required by the platform's runtime token. See Cloudflare's
+For setup in the installation account, the initial management-token link includes
+these permissions. Void checks Access reads before provisioning and reuses that
+management token during Access setup, so you do not need a second API token.
+For applications in another account, provide a token scoped to that identity
+account when asked. Scripts can supply an explicit override through
+`VOID_PLATFORM_ACCESS_SETUP_TOKEN`. The platform's runtime token does not need
+Access management permissions. See Cloudflare's
 [Access API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/)
 and [service-token permissions](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/service_tokens/methods/create/).
 
@@ -117,7 +183,9 @@ Keep the file's `connections` list from the example above, or use a connection
 with `{"id":"access","kind":"cloudflare-access","label":"Company Access"}`
 to create Access login as well. Omit `protection` for login-only setup.
 
-To connect applications managed elsewhere, select **Connect existing applications**.
+To connect applications managed elsewhere, select **Use Access applications your company already manages**.
+Enter the account that owns the Access applications; it can differ from the
+account hosting Void.
 Scripts use `mode: "existing"`, optional `accountId`, and `loginApplicationId`
 and/or `protectionApplicationId`. For login, set `loginClientSecretEnv`. For
 protection, supply `serviceToken` with `id`, `clientIdEnv`, and `clientSecretEnv`
@@ -148,7 +216,7 @@ The installer collects your runtime token, PostgreSQL URL, login-provider creden
 
 Once installation finishes, open the printed admin dashboard link. For GitHub-only setup, sign in as the administrator selected during installation. For configurable login, use the one-time `/setup` code to confirm the administrator’s identity. Use the printed API URL to [connect and deploy an app](/guide/platform/installation/first-deployment).
 
-Remove the management token from the shell when finished:
+If you supplied a management token through the shell, remove it when finished:
 
 ```sh
 unset CLOUDFLARE_API_TOKEN
@@ -164,10 +232,12 @@ If Void created a zone, it stops in `waiting-for-dns` and prints nameservers. Se
 void platform install --resume --name <installation-id>
 ```
 
-Keep the management token available for any remaining DNS changes. When using a source build, also pass the same `--runtime` directory. Resume uses the saved checkpoint and original secrets; do not start a second installation or generate replacement keys. If setup failed before a checkpoint was saved, rerun the original command.
+Resume reuses the saved management token and asks for one if it is missing or rejected by Cloudflare. You can override it through `CLOUDFLARE_API_TOKEN`. When using a source build, also pass the same `--runtime` directory. Resume uses the saved checkpoint and original secrets; do not start a second installation or generate replacement keys. If setup stopped before a checkpoint was saved, rerun `void platform install` and select your saved plan, or rerun the original command.
 
 You can also rerun `void platform install` and choose **Continue setup** for an unfinished installation. For non-interactive recovery, use `--resume --name <id>`. Manage completed platforms with `platform status`, `repair`, or `upgrade`.
 
+Resume restores your selected Hyperdrive. If that selection is missing from the saved checkpoint, add `--hyperdrive <existing-id>` when resuming, using the same configuration you originally selected.
+
 If Cloudflare rejects a saved runtime token during continued credential setup, Void opens the token page and asks for a replacement in the same run. Network or service failures do not discard saved tokens. Tokens supplied through the environment must be corrected there instead.
 
 :::

package/skills/void/docs/guide/remote-dev.md

@@ -49,7 +49,7 @@ AI requests use your platform’s account and allowance in both local and remote
 When the dev server starts with remote mode active, it prints:
 
 ```
-⚡ Remote bindings active (my-project.void.app)
+⚡ Remote bindings active (my-project.apps.example.com)
    DB      → remote D1
    KV      → remote KV
    STORAGE → remote R2

package/skills/void/docs/reference/cli/auth.md

@@ -41,11 +41,12 @@ are Void account operations. Prefer `void auth status`, `void account link`, and
 
 Browser login through one of the platform's currently enabled methods. The token is saved in the operating-system keychain, scoped to the platform origin. Login fails closed when no keychain is available instead of writing the token to a plaintext file; headless environments use `VOID_TOKEN` from their secret manager.
 
-If an older CLI login is no longer recognized after updating Void, run `void account login` again. Your saved platform and project links remain unchanged.
+Connect to a platform with `void connect <url>` before logging in. If an older project link has no platform URL, connect and run `void project link` to select its project again.
 
 Set `VOID_API_URL` alongside `VOID_TOKEN` to identify the platform that issued it.
-A token without an API URL is only used for Void Cloud's production API; a saved
-connection or project cannot forward it to another platform. To use a platform's
+Both the URL and token are required for environment-based authentication, and the
+URL must already be connected. In a fresh CI environment, run
+`void connect "$VOID_API_URL" --no-login` before deploying. To use a platform's
 saved login instead, unset `VOID_TOKEN`.
 
 This is optional if you already completed auth during `void connect` or the interactive `void init` flow.

package/skills/void/docs/reference/cli/database.md

@@ -52,7 +52,7 @@ Run ad-hoc SQL against the database. Provide SQL inline or from a file. SELECT q
 
 By default, targets the local database. Pass `--remote` to run against the deployed database selected in `.void/project.json`:
 
-- **Void platform D1 projects**: routes the query through the selected platform's registered proxy using your auth token. Void Cloud's proxy is `proxy.void.cloud`; a self-hosted platform uses its own proxy URL.
+- **Void platform D1 projects**: routes the query through the selected platform's registered proxy using your auth token.
 - **Direct Cloudflare D1 projects**: invokes Cloudflare against the pinned D1 binding from `void.config.ts` or `void.lock.json`.
 - **Hosted PostgreSQL and MySQL projects**: fetches the stored connection string from the platform and connects directly.
 - **Direct Cloudflare PostgreSQL and MySQL projects**: uses `DATABASE_URL` from the current shell; Cloudflare cannot return the password from Hyperdrive.

package/skills/void/docs/reference/cli/deploy.md

@@ -14,8 +14,14 @@ void deploy --platform cloudflare --atomic
 
 Auto-detects your project type and chooses the right pipeline. See [Supported App Types](../../guide/app-types.md) and [Deployment](../../guide/deployment.md) for details.
 
+Deploying to a Void platform requires an explicit connection with `void connect <url>`.
+A saved project URL or `VOID_API_URL` alone does not establish a connection.
+In fresh CI environments, run `void connect "$VOID_API_URL" --no-login` first.
+
 On an upgraded Void platform, an accepted deployment continues if the CLI disconnects. The CLI automatically reconnects to its progress. Pressing Ctrl+C stops observation; use `void project cancel` to request cancellation and `void project status` to inspect the result. If interrupted execution requires recovery, wait for its result before deploying again.
 
+The CLI reports stalled progress and automatic recovery, and waits up to 30 minutes after acceptance. If it times out, the deployment can continue; check `void project status` before trying another deployment.
+
 For an existing Void Worker, `void deploy` can link the Worker and migrate its root Cloudflare config. Keep the first deployment focused on the existing app. See [Deploy an existing Worker](../../integrations/cloudflare.md#deploy-an-existing-worker) for requirements and the ISR cache choice.
 
 For Drizzle projects, deploy performs a read-only schema drift check. If a new migration would be generated, deploy stops and tells you to run `void db generate`, review the migration, commit it yourself, and rerun `void deploy`.
@@ -53,6 +59,20 @@ For the Void platform, project resolution precedence is:
 
 If no project is linked and no override is provided, CLI prompts to link or create one. In CI (non-TTY), `void deploy` errors out instead — set `VOID_PROJECT` or pass `--project <slug>`.
 
+To deploy to another connected Void platform for one invocation:
+
+```sh
+void connect https://second.example.com
+VOID_API_URL=https://second.example.com void deploy --platform void --project my-app
+```
+
+`VOID_API_URL` selects the platform and `--project` selects its project. You must
+name the project when overriding a different platform's saved link. Existing
+project links and deployment preferences remain unchanged, even when the target
+project is created. The same applies to `VOID_PROJECT` and to another project on
+the current platform. A first deployment still links the project when no destination
+is configured. See [Deploy to another Void platform](../../guide/deployment.md#deploy-to-another-void-platform).
+
 ## `void deploy --platform cloudflare` {#void-deploy-platform-cloudflare}
 
 Build and deploy to your Cloudflare account using `void.config.ts`:

package/skills/void/docs/reference/cli/platform-installation.md

@@ -8,32 +8,33 @@ outline: deep
 void platform install [options] [--yes]
 ```
 
-| Option                            | Purpose                                                                              |
-| --------------------------------- | ------------------------------------------------------------------------------------ |
-| `--name <slug>`                   | Installation name used in `void-<name>-<role>` resource names; choose an unused name |
-| `--display-name <name>`           | Human-readable platform name                                                         |
-| `--account <id>`                  | Cloudflare account id                                                                |
-| `--auth-config <path>`            | Login methods, signup policy, and environment references for provider secrets        |
-| `--login-methods <methods>`       | Comma-separated `github`, `google`, `oidc`, or `cloudflare-access` login methods     |
-| `--access-protection`             | Protect the platform UI and APIs with Cloudflare Access                              |
-| `--no-access-protection`          | Skip Cloudflare Access protection                                                    |
-| `--hyperdrive <create\|id>`       | Create Hyperdrive or use the specified existing configuration                        |
-| `--application-domain <domain>`   | Base domain for deployed apps                                                        |
-| `--workers-dev`                   | Explicit testing mode; add an application domain later                               |
-| `--zone <domain>`                 | Cloudflare zone containing the application domain                                    |
-| `--dedicated-zone`                | Add zone-wide catch-all routes; valid only when the app domain is the whole zone     |
-| `--no-dedicated-zone`             | Skip zone-wide application catch-all routes                                          |
-| `--control-plane-domain <domain>` | Optional API custom hostname; defaults to `workers.dev`                              |
-| `--no-control-plane-domain`       | Use the default `workers.dev` API hostname                                           |
-| `--dashboard-url <origin>`        | HTTPS origin of an optional dashboard deployed separately                            |
-| `--plan`                          | Resolve and print a read-only plan                                                   |
-| `--resume`                        | Continue the matching checkpointed installation                                      |
-| `--runtime <path>`                | Deploy a locally built, integrity-checked runtime directory                          |
-| `--yes`                           | Acknowledge Cloudflare changes in non-interactive use                                |
-
-For a first installation, follow [Install a Void Platform](../../guide/self-hosted-platform.md). The interactive installer recommends using a domain and offers **Use workers.dev for testing** as a visible alternative. Void creates the platform infrastructure and tables. External PostgreSQL and a configured login method are required in either mode; GitHub OAuth is the default login choice, not a requirement. `--workers-dev` skips zone/DNS/certificate operations and cannot be combined with `--application-domain`, `--zone`, or `--dedicated-zone`.
-
-Read-only plans, workers.dev installations with the default API hostname, and supported lifecycle operations can use Cloudflare browser login and the system keychain. Installation that writes DNS or creates a zone needs an explicit management token through `CLOUDFLARE_API_TOKEN` or `CF_API_TOKEN`.
+| Option                                    | Purpose                                                                              |
+| ----------------------------------------- | ------------------------------------------------------------------------------------ |
+| `--name <slug>`                           | Installation name used in `void-<name>-<role>` resource names; choose an unused name |
+| `--display-name <name>`                   | Human-readable platform name                                                         |
+| `--account <id>`                          | Cloudflare account id                                                                |
+| `--auth-config <path>`                    | Login methods, signup policy, and environment references for provider secrets        |
+| `--login-methods <methods>`               | Comma-separated `github`, `google`, `oidc`, or `cloudflare-access` login methods     |
+| `--access-protection`                     | Protect the platform UI and APIs with Cloudflare Access                              |
+| `--no-access-protection`                  | Skip Cloudflare Access protection                                                    |
+| `--app-access <public\|platform\|custom>` | Public apps, the platform's Access policy, or separately selected app policies       |
+| `--hyperdrive <create\|id>`               | Create Hyperdrive or use the specified existing configuration                        |
+| `--application-domain <domain>`           | Base domain for deployed apps                                                        |
+| `--workers-dev`                           | Explicit testing mode; add an application domain later                               |
+| `--zone <domain>`                         | Cloudflare zone containing the application domain                                    |
+| `--dedicated-zone`                        | Add zone-wide catch-all routes; valid only when the app domain is the whole zone     |
+| `--no-dedicated-zone`                     | Skip zone-wide application catch-all routes                                          |
+| `--control-plane-domain <domain>`         | Optional API custom hostname; defaults to `workers.dev`                              |
+| `--no-control-plane-domain`               | Use the default `workers.dev` API hostname                                           |
+| `--dashboard-url <origin>`                | HTTPS origin of an optional dashboard deployed separately                            |
+| `--plan`                                  | Preview Cloudflare changes and save installation choices locally                     |
+| `--resume`                                | Continue the matching checkpointed installation                                      |
+| `--runtime <path>`                        | Deploy a locally built, integrity-checked runtime directory                          |
+| `--yes`                                   | Acknowledge Cloudflare changes in non-interactive use                                |
+
+For a first installation, follow [Install a Void Platform](../../guide/self-hosted-platform.md). The interactive installer recommends using a domain and offers **Use workers.dev for testing** as a visible alternative. Void creates the platform infrastructure and tables. External PostgreSQL and a configured login method are required in either mode. Select all login methods you want to enable; none are selected initially. Non-interactive installation defaults to GitHub when no login configuration is supplied. `--workers-dev` skips zone/DNS/certificate operations and cannot be combined with `--application-domain`, `--zone`, or `--dedicated-zone`.
+
+Read-only plans, workers.dev installations with the default API hostname, and supported lifecycle operations can use Cloudflare browser login and the system keychain. Installation that writes DNS or creates a zone needs a management API token. The interactive installer guides you to create one and paste it into a masked prompt; scripts use `CLOUDFLARE_API_TOKEN` or `CF_API_TOKEN`.
 
 The installed platform needs a separate runtime token to provision resources for apps. The interactive installer prompts for it and the other setup values. For non-interactive installs, inject the variables listed in [Install from CI](../../guide/platform/installation/ci.md).
 
@@ -45,10 +46,24 @@ path, query, or fragment. Void permits that origin's login callbacks and saves
 it for later maintenance; it does not deploy a dashboard Worker. Omission keeps
 an existing installation's saved dashboard origin.
 
-`--plan` previews resource names, login methods, callback URLs, and credential requirements. Run the install or resume command printed at the end to continue. For login configuration, use either `--auth-config` or `--login-methods` with the Access protection flags.
+`--plan` previews resource names, login methods, default app access, the login callback URL, database configuration, and credential requirements. An existing Hyperdrive shows its database and configuration name. Setup links are shown during guided credential setup. Completed previews save nonsecret installation choices locally. Rerun `void platform install` to choose a saved plan and review a fresh check of Cloudflare state, or run the install or resume command printed at the end. Started installations use their saved checkpoints; completed installations are excluded from the chooser. For login configuration, use either `--auth-config` or `--login-methods` with the Access protection flags.
+
+App access is configured before traffic opens. With platform protection enabled,
+the installer recommends reusing its company policy; otherwise it defaults to
+public apps. Use `--app-access custom` to select separate hosting-account policies.
+Public apps in a Default-Deny account receive scoped public Access rules. The
+installer explains and collects the encrypted management credential when needed;
+scripts supply `VOID_PLATFORM_APP_ACCESS_TOKEN` or `appAccess.tokenEnv` in the
+authentication file. Upgrades preserve administrator settings.
 
 New resources use `void-<name>-<role>` names; choose an unused installation name. The installer opens setup pages for missing credentials and reuses values already supplied.
 
+During Access setup, choose existing company policies or **Create new** for manual
+setup instructions and an account dashboard link. After you save the policy and
+confirm completion, Void reloads the list so you can select it and continue in the
+same run. **Refresh list** reloads policies created in another window. Your
+identity-provider choice and still-available policy selections are retained.
+
 Installation progress and partial credentials are saved encrypted locally. Rerun the installer to continue unfinished setup, or pass `--resume --name <id>`. Use lifecycle commands for completed installations.
 
 Use an empty PostgreSQL database dedicated to the installation. You can correct a failed initial connection, but after the database is claimed or Hyperdrive is provisioned, commands reject a different URL.

package/skills/void/docs/reference/cli/platform-zero-trust.md

@@ -26,6 +26,20 @@ void platform zero-trust project-public <project-id>
 void platform zero-trust project-reconcile <project-id>
 ```
 
+New installations configure app access in `void platform install`. Use these
+commands to inspect or change it later. To configure or renew public-only rules
+for a Default-Deny account, omit identity policies and use `--public-apps`:
+
+```sh
+printf '%s' "$ACCESS_API_TOKEN" | void platform zero-trust configure \
+  --public-apps --token-stdin --yes
+```
+
+Add `--existing-projects public` when enabling from a disabled configuration.
+Public-only rules cannot be combined with protected project choices. To switch an
+already protected configuration to public-only rules, first disable it; Access may
+block traffic during that transition in a Default-Deny account.
+
 Mutations support `--plan`, `--yes`, and `--timeout`; use `--plan` instead of
 `--yes` to inspect this change without applying it. The Access management token
 is accepted only on standard input. Zero Trust uses the Cloudflare account that

package/skills/void/docs/reference/config.md

@@ -156,7 +156,7 @@ Configuration for the [email integration](../guide/email.md).
 
 During development, `email.from` is the default sender in the local inbox. On a Void platform, use your project's shared sender or registered domain.
 
-For direct Cloudflare deployment, this address selects the mail domain and default sender. Use a zone or subdomain in your account; an existing mail provider's MX records are preserved. See [Email setup](../guide/email/domains.md#your-own-cloudflare-account).
+For direct Cloudflare deployment, this address selects the mail domain and default sender. Use a zone or subdomain in your account; an existing mail provider's MX records are preserved. Without `email.from`, Void skips automatic setup and preserves authored `cloudflare.send_email` bindings and `cloudflare.addresses`; check their readiness yourself. `--require-email` still refuses deployment when automatic setup cannot be verified. See [Email setup](../guide/email/domains.md#your-own-cloudflare-account).
 
 ### `head`
 

package/dist/auth-CCjt0hcq.mjs

@@ -1,2 +0,0 @@
-import { a as getApiUrl, h as runPlatformLogin, s as getSiteDomain } from "./auth-CSkdO2Bb.mjs";
-export { getApiUrl, getSiteDomain, runPlatformLogin };

package/dist/client-Cu7jWiF1.mjs

@@ -1,2 +0,0 @@
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-export { PlatformClient };

package/dist/dist-BuDuKZJv.mjs

@@ -1,2 +0,0 @@
-import { B as text, I as select, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-export { isCancel, log, select, text };