void 0.23.0 → 0.25.0

package/AGENTS_TEMPLATE.md

@@ -1,6 +1,6 @@
 ## Void
 
 - This project uses [Void](https://void.cloud), a full-stack Vite framework for Cloudflare Workers with file-based API routing, server-rendered pages, and typed backend services.
-- Deploy to your Cloudflare account with `void deploy --platform cloudflare`, or connect to a Void platform with `void connect <url>` and deploy with `void deploy --platform void`. `void deploy` uses the saved destination.
+- Deploy to your Cloudflare account with `void deploy --platform cloudflare`, or explicitly connect to your team’s Void platform with `void connect <url>` before deploying with `void deploy --platform void`. `void deploy` uses the saved destination.
 - Use Void's CLI and typed APIs for development and infrastructure. Void infers Cloudflare bindings from your imports; use Void commands to manage them.
 - Before working with Void, read the relevant Markdown docs in `node_modules/void/skills/void/docs/`. Start with `guide/quickstart.md` for setup and `reference/cli.md` for commands; consult the other guides and references for any Void feature.

package/README.md

@@ -1,124 +1,37 @@
 # void
 
-Vite plugin and CLI for building and deploying apps on Void.
+Build and deploy full-stack Vite apps on Cloudflare Workers. Void provides server routes, server-rendered pages, and typed access to databases, storage, and AI.
 
-You can also administer a team platform with the same CLI. Sign in with
-`void platform auth login`, then manage users, signup access, projects, and logs.
-Commands show a preview before applying changes and support `--json` for scripts.
-See [Platform Administration](../../docs/guide/platform-administration.md) for a
-walkthrough and the [CLI reference](../../docs/reference/cli/platform.md#operator-commands)
-for every command.
+## Getting Started
 
-Use `void platform config auth` to manage login methods and company signup.
-Use `void platform config plans` to manage account plans, enforced limits, and the default for new accounts. See [Plans and Limits](../../docs/guide/platform/administration/plans.md).
-Cloudflare Access protection has separate create/connect controls. Users can
-link another enabled login to their account with `void account link`.
+Use Node.js 24.21.0 or later. In an empty directory, run:
 
-## What It Covers
-
-- file-based API routes from `routes/`
-- Pages mode from `pages/`
-- typed Drizzle access via `void/db`
-- `crons/` and `queues/`
-- URL redirects, rewrites, and fallbacks (`void.config.ts` / `public/_redirects`, plus `c.rewrite()` from middleware)
-- binding inference for D1, KV, R2, AI, auth, queues, and typed Durable Objects
-- remote bindings for local development
-- one target-aware deploy path for Void-hosted and direct Cloudflare apps
-- automatic Cloudflare provisioning, verified Worker Version activation, and operational commands
-
-## Quick Start
-
-Install the Void CLI:
-
-```bash
+```sh
 npm install -D void
+npx void init
+npm run dev
 ```
 
-If you run `void init` in an empty directory, the scaffold flow adds the matching Pages adapter and Vite+ by default.
-
-Init offers to initialize Git and suggests an optional initial commit command. Use `--git` or `--no-git` to choose without the Git prompt. Existing repositories are preserved; Void does not commit automatically.
-
-To install a team platform, use `void platform install`. A domain is recommended; the visible workers.dev testing option is also available as `--workers-dev`. Add a domain later with `void platform domain set example.com`, preserving projects, deployments, and API connections. See the [platform setup guide](../../docs/guide/self-hosted-platform.md).
+Choose a UI framework, starter, and deployment target. Then deploy:
 
-Init always writes brief coding-agent instructions to `AGENTS.md`, pointing to `node_modules/void/skills/void/docs/`, and links skills for detected agents. Run `void init --agents` to add or refresh just this setup without choosing an agent.
-
-Then run `npx void init`. In an empty directory, the full interactive flow can scaffold a starter and configure local project files. It then asks where to deploy: Cloudflare (the default) writes `void.config.ts`, handles secure browser sign-in through Void's bundled tooling, and saves the selected account; Void asks for the API URL of an explicitly connected company platform (`void connect <url>` or `void platform install`). Existing `void.json` and root Wrangler JSON/JSONC files are migrated automatically; commit `void.config.ts` and `void.lock.json` when created. Back up `~/.void/platforms/` after installing a company platform because its owner-only recovery material contains runtime keys that Cloudflare cannot return. The next app step is just `npx void deploy`. Auth-enabled deploys preserve an existing `BETTER_AUTH_SECRET` or create a persistent encrypted secret when missing on either platform. Root `.env` is local-only; production server keys declared in `env.ts` use encrypted remote secret storage and are rejected as plaintext Worker vars. In an existing app, init configures Void in place by adding missing Vite scripts and creating or patching `vite.config.*` with `voidPlugin()`.
-
-```ts
-// vite.config.ts
-import { defineConfig } from 'vite';
-import { voidPlugin } from 'void';
-
-export default defineConfig({
-  plugins: [voidPlugin()],
-});
+```sh
+npx void deploy
 ```
 
-## Core Surfaces
-
-- `voidPlugin()` — Vite integration, routing, pages mode, codegen, migrations, packaging
-- `void prepare` — generate `.void` artifacts for CI, editors, and fresh clones
-- `void info [--json]` — discover persistent resource names before moving definitions
-- `void auth login` — sign in to the project's saved Cloudflare or Void destination
-- `void account login` — platform auth
-- `void connect [url]` — choose Cloudflare or a Void platform, sign in, and save the deployment destination
-- `void platform *` — list, select, inspect, install, recover, repair, upgrade, disable, and safely uninstall a company platform
-- `void deploy` — build and deploy to the saved Cloudflare or Void target
-- `void db *` — local DB and migration commands
-- `void project *` — target-aware status, logs, rollback, managed-project operations, and scoped CI deploy credentials
-- `void secret *` / `void domain *` — target-aware Worker secrets and custom domains
-
-Runtime helpers include:
+Void builds your app, provisions its resources, applies migrations, and prints the deployed URL.
 
-- `defineHandler`
-- `defineMiddleware`
-- `basicAuth`
-- `defineScheduled`
-- `defineQueue`
-- `void/db`
-- `void/kv`
-- `void/storage`
-- `void/durable`
-- `void/ai`
-- `void/isr`
-- `void/client`
-- `void/auth`
-
-## Supported App Shapes
-
-- native Void apps (`routes/`, `pages/`, `middleware/`, `crons/`, `queues/`)
-- supported meta-framework deploy targets:
-  - TanStack Start
-  - React Router
-  - vinext App Router and Pages Router
-  - SvelteKit
-  - Nuxt
-  - Analog
-  - Astro
-- static and SPA deploys
-- non-Cloudflare server targets (`node`, `bun`, `deno`)
-
-Direct Cloudflare deployments also support D1, KV, R2, Queues, Hyperdrive, auth, cron jobs, AI, ISR, typed SQLite Durable Objects, and WebSocket rooms. They upload an immutable Worker Version, probe it before activation (using a 0%-traffic version override when Durable Objects disable preview URLs), and retain version metadata for migration-aware rollback.
-
-Durable State and WebSocket definitions accept optional `name` to preserve their resource identity when files move. Run `void info` and pin the displayed name before moving deployed code. See [Durable State](../../docs/guide/durable-state.md#rename-a-file-while-keeping-its-state) and [WebSockets](../../docs/guide/websockets.md#move-a-route-while-keeping-its-state), including how to preserve room instances when renaming route parameters.
-
-Self-hosted platform upgrades verify every packaged PostgreSQL migration and require the live Drizzle history to be an exact prefix. Pending SQL is allowed only for an explicitly attested old-version/schema compatibility edge, runs in one transaction, and leaves the old Worker version authoritative until the target runtime passes discovery and health checks.
-
-An upgrade that changes the authenticated usage protocol briefly gates application traffic while it verifies the complete Worker set. An interruption leaves the gate closed for the next resumable upgrade instead of enabling an unsigned compatibility path.
-
-## Database Model
-
-`void/db` is Drizzle-first.
-
-- D1 is the default managed database target; development and local database commands share the configured binding ID and persistence directory
-- apps can opt into PostgreSQL or MySQL mode
-- route types, DB types, and queue types are generated into `.void/*.d.ts`
-
-Node.js, Bun, and Deno Pages builds include production hydration assets. Deploy `dist/ssr` together with `dist/client`; the server loads its manifest and assets relative to the emitted module.
+Follow the [Quickstart](https://void.cloud/guide/quickstart) for your first app or to add Void to an existing project.
 
 ## Documentation
 
-Full docs live at [void.cloud/guide](https://void.cloud/guide).
+- [Introduction](https://void.cloud/guide/)
+- [Server routing](https://void.cloud/guide/server-routing) and [Pages routing](https://void.cloud/guide/pages-routing/overview)
+- [Database](https://void.cloud/guide/database) and [type safety](https://void.cloud/guide/type-safety)
+- [Deployment](https://void.cloud/guide/deployment)
+- [Framework integrations](https://void.cloud/integrations/frameworks/overview)
+- [API](https://void.cloud/reference/api) and [CLI](https://void.cloud/reference/cli) reference
+
+To share a deployment platform with your team, see [Install a Void Platform](https://void.cloud/guide/self-hosted-platform).
 
 ## License
 

package/dist/{account-cmd-C84Ee8cO.mjs → account-cmd-DcR1ywt8.mjs}

@@ -1,13 +1,13 @@
-import { c as getToken, p as removeToken } from "./auth-CSkdO2Bb.mjs";
-import { j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { n as runLoginCommand } from "./login-UZKFM_u7.mjs";
+import { c as getToken, f as removeToken } from "./auth-7wuZ5ob8.mjs";
+import { L as log } from "./prompts-6OSVA7DJ.mjs";
+import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
+import { n as runLoginCommand } from "./login-pWQHYVu2.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/account-cmd.ts
 async function runAccountCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
-		case "link": return import("./auth-link-CioEg6uY.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
+		case "link": return import("./auth-link-Z6E5DYvM.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) log.success("Logged out.");
 			else log.info("Not logged in.");

package/dist/{auth-CSkdO2Bb.mjs → auth-7wuZ5ob8.mjs}

@@ -1,15 +1,11 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { S as writeKeyringPassword, b as deleteKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as readKeyringPassword } from "./platform-registry-QBa4DK32.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
-import { a as readProjectApplicationDomain, f as VOID_CLOUD_PLATFORM, m as readLegacyHostedPlatformSelection, n as isLegacyVoidCloudProject, p as VOID_CLOUD_STAGING_PLATFORM, r as isVoidInternalStaging, s as readProjectPlatformUrl } from "./project-C0Fqu05O.mjs";
+import { C as writeKeyringPassword, S as readKeyringPassword, c as platformCredentialAccount, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, x as deleteKeyringPassword } from "./platform-registry-KfNEF84O.mjs";
+import { i as readProjectPlatformUrl, r as readProjectConfig } from "./project-BkbfDs0V.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { t as ensureCloudflaredToken } from "./cf-access-AHKBzmuu.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
-//#region src/shared/proxy.ts
-const DEFAULT_PROXY_URL = "https://proxy.void.cloud";
-const STAGING_PROXY_URL = "https://proxy.staging.void.cloud";
-//#endregion
 //#region src/cli/auth.ts
 const CONFIG_DIR = join(homedir(), ".void");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
@@ -50,19 +46,22 @@ function readOriginScopedToken(apiUrl, config) {
 	}
 	return fileToken;
 }
-function isStagingMode(root = process.cwd()) {
-	return isVoidInternalStaging(root);
+function connectedPlatform(apiUrl) {
+	if (!apiUrl) throw new Error("platform: No Void platform connected. Run `void connect <url>` first.");
+	const origin = normalizePlatformApiUrl(apiUrl);
+	const connection = listPlatformConnections().find((entry) => entry.apiUrl === origin);
+	if (!connection) throw new Error(`platform: No connection to ${origin}. Run \`void connect ${origin}\` first.`);
+	return connection;
 }
 function getSiteDomain(root = process.cwd()) {
-	const legacySelection = readLegacyHostedPlatformSelection();
-	const domain = readProjectApplicationDomain(root) ?? (isStagingMode(root) ? VOID_CLOUD_STAGING_PLATFORM.applicationDomain : void 0) ?? (isLegacyVoidCloudProject(root) || process.env.VOID_TOKEN && process.env.VOID_API_URL === void 0 ? VOID_CLOUD_PLATFORM.applicationDomain : void 0) ?? getActivePlatformConnection()?.applicationDomain ?? legacySelection?.applicationDomain;
-	if (!domain) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
-	return domain;
+	const connection = connectedPlatform(getApiUrl(root));
+	if (!connection.applicationDomain) throw new Error(`platform: Missing application domain. Run \`void connect ${connection.apiUrl}\` to refresh the connection.`);
+	return connection.applicationDomain;
 }
 /**
 * Read the deploy token.
 * Priority: origin-bound VOID_TOKEN > system keychain > migrated config.
-* An unscoped environment token retains its historical Void Cloud destination.
+* Environment tokens must name their recipient with VOID_API_URL.
 */
 function getToken(root = process.cwd()) {
 	const envToken = process.env.VOID_TOKEN;
@@ -79,7 +78,7 @@ function getToken(root = process.cwd()) {
 /** Account actions follow the selected connection, independently of application metadata. */
 function getAccountCredential() {
 	const config = readConfig();
-	const apiUrl = normalizePlatformApiUrl(process.env.VOID_API_URL || (process.env.VOID_TOKEN ? DEFAULT_API_URL : getActivePlatformConnection()?.apiUrl ?? config.api ?? readLegacyHostedPlatformSelection()?.apiUrl ?? (keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : DEFAULT_API_URL)));
+	const apiUrl = connectedPlatform(process.env.VOID_API_URL || getActivePlatformConnection()?.apiUrl).apiUrl;
 	return {
 		apiUrl,
 		token: readTokenForOrigin(apiUrl, config)
@@ -88,7 +87,8 @@ function getAccountCredential() {
 function readTokenForOrigin(apiUrl, config) {
 	const envToken = process.env.VOID_TOKEN;
 	if (envToken) {
-		if (apiUrl !== (process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
+		if (!process.env.VOID_API_URL) throw new Error("auth: Set VOID_API_URL alongside VOID_TOKEN to identify the connected platform that issued it.");
+		if (apiUrl !== normalizePlatformApiUrl(process.env.VOID_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
 		return envToken;
 	}
 	return readOriginScopedToken(apiUrl, config);
@@ -126,8 +126,6 @@ function removeToken(root = process.cwd()) {
 	} catch {}
 	return removed;
 }
-const DEFAULT_API_URL = VOID_CLOUD_PLATFORM.apiUrl;
-const STAGING_API_URL = VOID_CLOUD_STAGING_PLATFORM.apiUrl;
 function base64Url(buffer) {
 	return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
@@ -163,40 +161,15 @@ async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
 	if (!body || typeof body !== "object" || !("token" in body) || typeof body.token !== "string" || body.token.length === 0) throw new Error("auth: Login code exchange did not return a token.");
 	return body.token;
 }
-/**
-* Read the API URL from environment or config file.
-* Priority: VOID_API_URL env var > ~/.void/config.json > default
-*/
+/** Environment and project selections must refer to a verified local connection. */
 function getApiUrl(root = process.cwd()) {
-	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);
-	if (isStagingMode(root)) return STAGING_API_URL;
 	const projectApiUrl = readProjectPlatformUrl(root);
-	if (projectApiUrl) {
-		if (projectApiUrl === DEFAULT_API_URL || projectApiUrl === STAGING_API_URL) return projectApiUrl;
-		if (listPlatformConnections().some((connection) => connection.apiUrl === projectApiUrl)) return projectApiUrl;
-		throw new Error(`platform: Project metadata selected unverified platform ${projectApiUrl}. Connect to it explicitly with \`void connect ${projectApiUrl}\` before forwarding credentials.`);
-	}
-	const config = readConfig();
-	const legacySelection = readLegacyHostedPlatformSelection();
-	let apiUrl = (isLegacyVoidCloudProject(root) ? DEFAULT_API_URL : void 0) ?? getActivePlatformConnection()?.apiUrl ?? config.api ?? legacySelection?.apiUrl;
-	apiUrl ??= process.env.VOID_TOKEN ? DEFAULT_API_URL : void 0;
-	if (!apiUrl) {
-		apiUrl = keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : void 0;
-		if (apiUrl) try {
-			writeConfig({
-				...config,
-				api: apiUrl
-			});
-		} catch {}
-	}
-	if (!apiUrl) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
-	return normalizePlatformApiUrl(apiUrl);
+	if (readProjectConfig(root) && !projectApiUrl) throw new Error("platform: This project link has no platform URL. Run `void connect <url>`, then `void project link` to choose its destination.");
+	return connectedPlatform(process.env.VOID_API_URL || projectApiUrl || getActivePlatformConnection()?.apiUrl).apiUrl;
 }
 function getProxyUrl(root = process.cwd()) {
+	const apiUrl = getApiUrl(root);
 	if (process.env.VOID_PROXY_URL) return normalizePlatformApiUrl(process.env.VOID_PROXY_URL);
-	const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
-	if (apiUrl === STAGING_API_URL) return STAGING_PROXY_URL;
-	if (apiUrl === DEFAULT_API_URL) return DEFAULT_PROXY_URL;
 	const proxyUrl = listPlatformConnections().find((connection) => connection.apiUrl === apiUrl)?.proxyUrl;
 	if (proxyUrl === null || proxyUrl === void 0) throw new Error(`platform: No verified proxy is registered for ${apiUrl}. Reconnect with \`void connect ${apiUrl}\` or set VOID_PROXY_URL explicitly.`);
 	return proxyUrl;
@@ -369,4 +342,4 @@ async function runPlatformLogin(origin, provider = "github", onUrl) {
 	});
 }
 //#endregion
-export { saveToken as _, getApiUrl as a, getToken as c, openBrowser as d, readPlatformToken as f, savePlatformToken as g, runPlatformLogin as h, getAccountCredential as i, getTokenSource as l, runLogin as m, createCodeChallenge as n, getProxyUrl as o, removeToken as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, isStagingMode as u, DEFAULT_PROXY_URL as v, STAGING_PROXY_URL as y };
+export { getApiUrl as a, getToken as c, readPlatformToken as d, removeToken as f, saveToken as g, savePlatformToken as h, getAccountCredential as i, getTokenSource as l, runPlatformLogin as m, createCodeChallenge as n, getProxyUrl as o, runLogin as p, createCodeVerifier as r, getSiteDomain as s, awaitBrowserCallback as t, openBrowser as u };

package/dist/auth-CdgZ9uag.mjs

@@ -0,0 +1,2 @@
+import { a as getApiUrl, m as runPlatformLogin, s as getSiteDomain } from "./auth-7wuZ5ob8.mjs";
+export { getApiUrl, getSiteDomain, runPlatformLogin };

package/dist/{auth-link-CioEg6uY.mjs → auth-link-Z6E5DYvM.mjs}

@@ -1,8 +1,8 @@
-import { a as getApiUrl, c as getToken, d as openBrowser, g as savePlatformToken, h as runPlatformLogin } from "./auth-CSkdO2Bb.mjs";
-import { j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { r as selectPlatformLoginMethod } from "./login-UZKFM_u7.mjs";
-import { t as discoverPlatform } from "./platform-cmd-DMcQStSc.mjs";
+import { a as getApiUrl, c as getToken, h as savePlatformToken, m as runPlatformLogin, u as openBrowser } from "./auth-7wuZ5ob8.mjs";
+import { L as log } from "./prompts-6OSVA7DJ.mjs";
+import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
+import { r as selectPlatformLoginMethod } from "./login-pWQHYVu2.mjs";
+import { t as discoverPlatform } from "./platform-cmd-D7vSWMvV.mjs";
 import { execFile } from "node:child_process";
 //#region src/cli/auth-link.ts
 async function runAuthLink(root, connectionId) {
@@ -13,7 +13,6 @@ async function runAuthLink(root, connectionId) {
 	if (!platform.authentication) throw new Error("auth: This platform must be upgraded before linking login methods.");
 	const target = await selectPlatformLoginMethod(platform, connectionId);
 	const existing = await new PlatformClient(token, apiUrl).whoami();
-	if (!existing.id) throw new Error("auth: This platform does not support account linking.");
 	log.info(`Sign in again to ${existing.login} using an already linked login method.`);
 	const source = await selectPlatformLoginMethod(platform);
 	const freshToken = await runPlatformLogin(apiUrl, source.id, (url) => log.info(`Sign in: ${url}`));

package/dist/{auth-router-BsR981d4.mjs → auth-router-BdM4avI8.mjs}

@@ -1,6 +1,6 @@
-import { o as listPlatformConnections } from "./platform-registry-QBa4DK32.mjs";
-import { i as readDeploymentPlatform } from "./project-C0Fqu05O.mjs";
-import { I as select, W as isCancel } from "./dist-CTBk70IR.mjs";
+import { o as listPlatformConnections } from "./platform-registry-KfNEF84O.mjs";
+import { n as readDeploymentPlatform } from "./project-BkbfDs0V.mjs";
+import { K as select, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
 //#region src/cli/auth-router.ts
 async function chooseDestination(root, args, interactive) {
 	const saved = readDeploymentPlatform(root);
@@ -37,7 +37,7 @@ async function chooseDestination(root, args, interactive) {
 }
 async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isTTY)) {
 	if (args.subcommand === "link") {
-		const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
+		const { runAccountCommand } = await import("./account-cmd-DcR1ywt8.mjs");
 		await runAccountCommand(root, {
 			subcommand: "link",
 			...args.connectionId ? { connectionId: args.connectionId } : {}
@@ -45,17 +45,17 @@ async function runAuthRouter(root, args, interactive = Boolean(process.stdin.isT
 		return;
 	}
 	if (args.subcommand === "token") {
-		const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
+		const { runAccountCommand } = await import("./account-cmd-DcR1ywt8.mjs");
 		await runAccountCommand(root, { subcommand: "token" });
 		return;
 	}
 	const destination = await chooseDestination(root, args, interactive);
 	if (destination.platform === "cloudflare") {
-		const { runCloudflareCommand } = await import("./cloudflare-cmd-BcrVyTmJ.mjs");
+		const { runCloudflareCommand } = await import("./cloudflare-cmd-bhwCxAN6.mjs");
 		await runCloudflareCommand(root, { subcommand: args.subcommand === "whoami" || args.subcommand === "status" ? "status" : args.subcommand });
 		return;
 	}
-	const { runAccountCommand } = await import("./account-cmd-C84Ee8cO.mjs");
+	const { runAccountCommand } = await import("./account-cmd-DcR1ywt8.mjs");
 	const subcommand = args.subcommand === "status" ? "whoami" : args.subcommand;
 	if (!destination.apiUrl) {
 		await runAccountCommand(root, { subcommand });

package/dist/{build-cmd-LzvNJORH.mjs → build-cmd-CEE7D-hM.mjs}

@@ -1,8 +1,8 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
-import { a as dim, c as import_picocolors, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-BkbfDs0V.mjs";
+import { c as getToken } from "./auth-7wuZ5ob8.mjs";
+import { H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
+import { n as PlatformApiError, r as PlatformClient } from "./client-RsPo8wsP.mjs";
+import { c as import_picocolors, i as dim } from "./output-BBsUwdyT.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts
@@ -10,7 +10,7 @@ const POLL_MS = 1e3;
 const BUILD_LOG_DRAIN_TIMEOUT_MS = 12e4;
 function isBuildLogComplete(page) {
 	if (!page.terminal) return false;
-	if (page.logsComplete === null || page.logsComplete === void 0) throw new Error("This platform cannot confirm that the final build logs were captured. Ask its administrator to upgrade the platform runtime, or read the retained logs without --follow.");
+	if (page.logsComplete === null) throw new Error("This platform cannot confirm that the final build logs were captured. Ask its administrator to upgrade the platform runtime, or read the retained logs without --follow.");
 	return page.logsComplete === true;
 }
 function sleep(ms) {
@@ -74,7 +74,6 @@ async function runBuildCommand(root, args) {
 }
 async function runBuildLogsCommand(root, args) {
 	console.log();
-	intro(cliTitle("build logs"));
 	const token = getToken(root);
 	if (!token) {
 		log.error("Not logged in. Run `void account login` first.");
@@ -128,7 +127,7 @@ async function runBuildLogsCommand(root, args) {
 		await sleep(POLL_MS);
 	}
 	if (first.external) {
-		log.message(`This build ran on GitHub Actions. View logs:\n${import_picocolors.default.cyan(first.external)}`);
+		log.message(`This build ran on GitHub Actions. View logs:\n${import_picocolors.default.blue(first.external)}`);
 		return;
 	}
 	if (args.output) writeFileSync(args.output, "");

package/dist/{cache-C4MvnrMH.mjs → cache-TcZnBLtH.mjs}

@@ -1,13 +1,12 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { a as dim, i as createSpinner, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-BkbfDs0V.mjs";
+import { c as getToken } from "./auth-7wuZ5ob8.mjs";
+import { H as outro, L as log } from "./prompts-6OSVA7DJ.mjs";
+import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
+import { i as dim, o as formatCount, r as createSpinner } from "./output-BBsUwdyT.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {
 	console.log();
-	intro(cliTitle("project purge-cache"));
 	const token = getToken(root);
 	if (!token) {
 		log.error("Not logged in. Run `void account login` first.");
@@ -39,7 +38,7 @@ async function runPurgeCacheCommand(root, projectSlug) {
 	try {
 		const result = await client.purgeCache(projectId);
 		s.stop("Cache purged.");
-		log.success(`Purged ${result.purged} cached page(s).`);
+		log.success(`Purged ${formatCount(result.purged, "cached page")}.`);
 	} catch (err) {
 		s.stop("Cache purge failed.");
 		log.error(err instanceof Error ? err.message : String(err));

package/dist/{cancel-deploy-abUxpP2n.mjs → cancel-deploy-CYoZmcmR.mjs}

@@ -1,8 +1,7 @@
-import { c as getToken } from "./auth-CSkdO2Bb.mjs";
-import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { E as confirm, O as intro, P as outro, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
-import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as readProjectConfig } from "./project-BkbfDs0V.mjs";
+import { c as getToken } from "./auth-7wuZ5ob8.mjs";
+import { A as confirm, H as outro, L as log, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
+import { r as PlatformClient } from "./client-RsPo8wsP.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 	"pending",
@@ -12,7 +11,6 @@ const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 ]);
 async function runCancelDeployCommand(root, deployId) {
 	console.log();
-	intro(cliTitle("project cancel"));
 	const token = getToken(root);
 	if (!token) {
 		log.error("Not logged in. Run `void account login` first.");

package/dist/{cf-access-P0iZnu0q.mjs → cf-access-AHKBzmuu.mjs}

@@ -1,5 +1,5 @@
-import { n as isVoidAccessGatedUrl, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { S as writeKeyringPassword, c as platformCredentialAccount, s as normalizePlatformApiUrl, x as readKeyringPassword } from "./platform-registry-QBa4DK32.mjs";
+import { C as writeKeyringPassword, S as readKeyringPassword, c as platformCredentialAccount, s as normalizePlatformApiUrl } from "./platform-registry-KfNEF84O.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
 import { spawnSync } from "node:child_process";
 //#region src/cli/cf-access.ts
 const ACCESS_KEYRING_SERVICE = "dev.void.cli.access";
@@ -106,53 +106,9 @@ function ensurePlatformAccessToken(apiUrl, challenged = false, required = false,
 	keyringTokens.set(origin, token);
 	writeKeyringPassword(ACCESS_KEYRING_SERVICE, account, token);
 }
-const probedHosts = /* @__PURE__ */ new Set();
-/**
-* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
-* probe the locally-installed `cloudflared` binary for a cached user JWT
-* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
-* token, open a browser login flow to populate the cache, then re-read it.
-*
-* Cached per-host so that an early non-gated call (e.g. prod) does not
-* permanently disable the probe for a later gated call (e.g. staging) in
-* the same process. Noop when:
-*   - a service-token pair is already set (CI path)
-*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
-*   - the target host is not gated
-*   - `cloudflared` is not installed
-*/
+/** Restore only credentials scoped to this explicitly selected platform origin. */
 function ensureCloudflaredToken(apiUrl) {
-	if (!isVoidAccessGatedUrl(apiUrl) || process.env.VOID_ACCESS_ORIGIN || process.env.VOID_ACCESS_CREDENTIALS) {
-		ensurePlatformAccessToken(apiUrl);
-		return;
-	}
-	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
-	if (process.env.CF_ACCESS_TOKEN) return;
-	if (!isVoidAccessGatedUrl(apiUrl)) return;
-	const host = new URL(apiUrl).hostname;
-	if (probedHosts.has(host)) return;
-	probedHosts.add(host);
-	let token = runCloudflared([
-		"access",
-		"token",
-		`-app=${apiUrl}`
-	]);
-	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
-		runCloudflared([
-			"access",
-			"login",
-			apiUrl
-		], {
-			inherit: true,
-			timeoutMs: 12e4
-		});
-		token = runCloudflared([
-			"access",
-			"token",
-			`-app=${apiUrl}`
-		]);
-	}
-	if (token) process.env.CF_ACCESS_TOKEN = token;
+	ensurePlatformAccessToken(apiUrl);
 }
 function runCloudflared(args, opts) {
 	try {

package/dist/{cf-access-DRsQRe6k.mjs → cf-access-TWNzXltp.mjs}

@@ -7,14 +7,6 @@
 *   2. User JWT (`CF_ACCESS_TOKEN`) — dev path, typically populated via `cloudflared access token`
 *   3. No headers — prod, or unprotected hostnames
 */
-function isVoidAccessGatedUrl(targetUrl) {
-	try {
-		const url = new URL(targetUrl);
-		return url.protocol === "https:" && (url.hostname.endsWith(".staging.void.cloud") || url.hostname.endsWith(".staging.void.app"));
-	} catch {
-		return false;
-	}
-}
 function accessHeaders(env) {
 	const id = env.CF_ACCESS_CLIENT_ID;
 	const secret = env.CF_ACCESS_CLIENT_SECRET;
@@ -26,7 +18,7 @@ function accessHeaders(env) {
 	if (typeof token === "string" && token.length > 0) return { "cf-access-token": token };
 	return {};
 }
-/** Attach shared Void Access credentials only to known hosted staging origins. */
+/** Attach Access credentials only to their explicitly scoped origin. */
 function cfAccessHeaders(env, targetUrl) {
 	let origin;
 	try {
@@ -52,7 +44,7 @@ function cfAccessHeaders(env, targetUrl) {
 	} catch {
 		return {};
 	}
-	return isVoidAccessGatedUrl(targetUrl) ? accessHeaders(env) : {};
+	return {};
 }
 /**
 * Capture credentials for a Cloudflare Worker readiness request whose target
@@ -72,4 +64,4 @@ function scopedAccessCredentials(env, targetUrl) {
 	} : { CF_ACCESS_TOKEN: headers["cf-access-token"] } });
 }
 //#endregion
-export { trustedCloudflareWorkerAccessHeaders as i, isVoidAccessGatedUrl as n, scopedAccessCredentials as r, cfAccessHeaders as t };
+export { scopedAccessCredentials as n, trustedCloudflareWorkerAccessHeaders as r, cfAccessHeaders as t };

package/dist/cf-build-output-ChY6-XWP.mjs

@@ -0,0 +1,2 @@
+import { t as prepareCfBuildOutput } from "./cf-build-output-U8o1Gl6X.mjs";
+export { prepareCfBuildOutput };