void 0.23.0 → 0.25.0

package/dist/pages/client.mjs

@@ -60,6 +60,103 @@ async function createActionErrorFromResponse(response, url) {
 	});
 }
 //#endregion
+//#region src/pages/scroll-restoration.ts
+const STORAGE_PREFIX = "void:scroll:";
+function readKey(state) {
+	return typeof state?.__voidScrollKey === "string" ? state.__voidScrollKey : null;
+}
+function readPosition(value) {
+	if (!value || typeof value !== "object") return null;
+	const { x, y } = value;
+	return typeof x === "number" && Number.isFinite(x) && typeof y === "number" && Number.isFinite(y) ? {
+		x,
+		y
+	} : null;
+}
+function newKey() {
+	return crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(4)).join("-");
+}
+function currentUrl$1() {
+	return window.location.pathname + window.location.search + window.location.hash;
+}
+/** Positions belong to the rendered entry, even after the browser starts a traversal. */
+function createScrollRestoration() {
+	const positions = /* @__PURE__ */ new Map();
+	let renderedKey = null;
+	let renderedUrl = currentUrl$1();
+	let ready = false;
+	function read(key) {
+		if (!key) return null;
+		const position = positions.get(key);
+		if (position) return position;
+		try {
+			const saved = readPosition(JSON.parse(sessionStorage.getItem(STORAGE_PREFIX + key) || "null"));
+			if (saved) return saved;
+		} catch {}
+		return null;
+	}
+	function save() {
+		if (!ready || !renderedKey) return;
+		const position = {
+			x: window.scrollX,
+			y: window.scrollY
+		};
+		positions.set(renderedKey, position);
+		try {
+			sessionStorage.setItem(STORAGE_PREFIX + renderedKey, JSON.stringify(position));
+		} catch {}
+	}
+	return {
+		get ready() {
+			return ready;
+		},
+		start() {
+			renderedKey = readKey(history.state);
+			if (!renderedKey) {
+				renderedKey = newKey();
+				history.replaceState({
+					...history.state,
+					__voidScrollKey: renderedKey
+				}, "");
+			}
+			history.scrollRestoration = "manual";
+			window.addEventListener("pagehide", save);
+			return read(renderedKey);
+		},
+		save,
+		writeHistory(url, replace) {
+			renderedKey = newKey();
+			const state = {
+				...replace ? history.state : {},
+				__voidScrollKey: renderedKey
+			};
+			if (replace) history.replaceState(state, "", url);
+			else history.pushState(state, "", url);
+		},
+		commit() {
+			renderedKey = readKey(history.state) ?? renderedKey;
+			renderedUrl = currentUrl$1();
+			ready = true;
+		},
+		pop(state) {
+			save();
+			let key = readKey(state);
+			const newFragment = key === renderedKey && currentUrl$1() !== renderedUrl;
+			if (!key || newFragment) {
+				key = newKey();
+				history.replaceState({
+					...state,
+					__voidScrollKey: key
+				}, "");
+			}
+			return newFragment ? null : read(key) ?? readPosition({
+				x: state?.scrollX,
+				y: state?.scrollY
+			});
+		}
+	};
+}
+//#endregion
 //#region src/pages/navigation-engine.ts
 const PAGE_DATA_SCRIPT_ID = "__VOID_PAGE_DATA__";
 const STATIC_PAGE_DATA_PREFIX = "/_void/pages";
@@ -138,6 +235,9 @@ async function createPageNavigationEngine(config) {
 	let _htmlDeferredRegistry = null;
 	let _currentFetchUrl = window.location.pathname + window.location.search;
 	let popStateHandler = null;
+	let initialScrollPosition = null;
+	const initialUrl = window.location.pathname + window.location.search + window.location.hash;
+	const scrollRestoration = createScrollRestoration();
 	function getPageDataCacheKey(url, method = "GET") {
 		return `${method}:${url}`;
 	}
@@ -329,16 +429,8 @@ async function createPageNavigationEngine(config) {
 	deferredWindow.__rejectDeferred = (group, error) => _htmlDeferredRegistry?.resolve(group, void 0, error);
 	function commitHashNavigation(effectiveFetchUrl, hash, options, writeHistory) {
 		_currentFetchUrl = effectiveFetchUrl;
-		if (writeHistory) {
-			if (options.replace) history.replaceState({}, "", effectiveFetchUrl + hash);
-			else {
-				history.replaceState({
-					scrollX: window.scrollX,
-					scrollY: window.scrollY
-				}, "");
-				history.pushState({}, "", effectiveFetchUrl + hash);
-			}
-		}
+		if (writeHistory) scrollRestoration.writeHistory(effectiveFetchUrl + hash, !!options.replace);
+		scrollRestoration.commit();
 		if (options._scrollPosition) {
 			window.scrollTo(options._scrollPosition.x, options._scrollPosition.y);
 			return;
@@ -536,15 +628,9 @@ async function createPageNavigationEngine(config) {
 			_currentFetchUrl = commitTarget.fetchUrl;
 			if (!options.preserveState) {
 				const historyUrl = commitTarget.fetchUrl + commitTarget.hash;
-				if (options.replace) history.replaceState({}, "", historyUrl);
-				else {
-					history.replaceState({
-						scrollX: window.scrollX,
-						scrollY: window.scrollY
-					}, "");
-					history.pushState({}, "", historyUrl);
-				}
+				scrollRestoration.writeHistory(historyUrl, !!options.replace);
 			}
+			scrollRestoration.commit();
 			const doScroll = () => {
 				if (options.preserveScroll) return;
 				if (options._scrollPosition) window.scrollTo(options._scrollPosition.x, options._scrollPosition.y);
@@ -570,6 +656,7 @@ async function createPageNavigationEngine(config) {
 		initialComponent,
 		initialLayouts,
 		prepareVisit(url, options = {}) {
+			if (!options._popstate) scrollRestoration.save();
 			const hashIndex = url.indexOf("#");
 			const hash = hashIndex !== -1 ? url.slice(hashIndex) : "";
 			const fetchUrl = hashIndex !== -1 ? url.slice(0, hashIndex) : url;
@@ -686,12 +773,14 @@ async function createPageNavigationEngine(config) {
 		setPopStateHandler(handler) {
 			popStateHandler = handler;
 		},
+		commitInitialRender() {
+			const saved = initialScrollPosition;
+			initialScrollPosition = null;
+			scrollRestoration.commit();
+			if (saved && _nextNavigationId === 0) window.scrollTo(saved.x, saved.y);
+		},
 		start() {
-			history.scrollRestoration = "manual";
-			history.replaceState({
-				scrollX: window.scrollX,
-				scrollY: window.scrollY
-			}, "");
+			initialScrollPosition = scrollRestoration.start();
 			initClientHead(initialPageData.head);
 			if (deferredWindow.__deferredQueue) {
 				for (const entry of deferredWindow.__deferredQueue) if (entry.length === 3) _htmlDeferredRegistry?.resolve(entry[0], void 0, entry[2]);
@@ -699,14 +788,15 @@ async function createPageNavigationEngine(config) {
 				delete deferredWindow.__deferredQueue;
 			}
 			window.addEventListener("popstate", (e) => {
-				const saved = e.state;
 				const url = window.location.pathname + window.location.search + window.location.hash;
+				const saved = scrollRestoration.pop(e.state);
+				if (!scrollRestoration.ready && url === initialUrl) {
+					initialScrollPosition = saved;
+					return;
+				}
 				const options = {
 					preserveState: true,
-					_scrollPosition: saved ? {
-						x: saved.scrollX ?? 0,
-						y: saved.scrollY ?? 0
-					} : null,
+					_scrollPosition: saved,
 					_popstate: true
 				};
 				if (popStateHandler) popStateHandler(url, options);
@@ -1020,7 +1110,8 @@ async function createVoidRouter(config) {
 			initialPageData: engine.initialPageData,
 			initialComponent: engine.initialComponent,
 			initialLayouts: engine.initialLayouts,
-			start: engine.start
+			start: engine.start,
+			commitInitialRender: engine.commitInitialRender
 		};
 	}
 }

package/dist/pages/index.mjs

@@ -2,7 +2,7 @@ import { a as join } from "../dist-BVqXeR_h.mjs";
 import { r as resolvePagesDir } from "../project-paths-GgcMozYz.mjs";
 import { m as readConfig } from "../config-Br_JZD6u.mjs";
 import { a as resolveNamedLayout, i as resolveLayoutIds, n as resolveEffectiveLayoutChain, r as resolveLayoutChain, t as scanPages } from "../scan-C7okrLyM.mjs";
-import { i as parseRedirectsFile } from "../headers-DWi2IXWx.mjs";
+import { i as parseRedirectsFile } from "../headers-2rKda9Y6.mjs";
 import { i as resolveHead, n as renderHeadToString, r as renderHtmlAttrs, t as renderBodyAttrs } from "../head-D_QRR5Yd.mjs";
 import { t as serializePageData } from "../serialize-BPvnNQuA.mjs";
 //#region src/pages/manifest.ts

package/dist/{platform-args-BJdRtlLq.mjs → platform-args-Bzf8JPc2.mjs}

@@ -1,4 +1,4 @@
-import { n as operatorGroups, r as parseOperatorArgs } from "./operator-args-CLgKGlwU.mjs";
+import { n as operatorGroups, r as parseOperatorArgs } from "./operator-args-CAVcmwUt.mjs";
 import { PLATFORM_LOGIN_KINDS, normalizePlatformDashboardUrl, parsePlatformLoginId } from "@void/platform";
 import { parsePlatformPlanId } from "@void/platform/plans";
 //#region src/cli/platform-config-args.ts
@@ -212,8 +212,8 @@ const platformSubcommands = [
 	},
 	{
 		name: "install",
-		hint: "Preview choices with --plan, then run the printed install command",
-		description: "Install a Void platform with a domain or workers.dev for testing"
+		hint: "Preview and save choices with --plan, then select the saved plan to install",
+		description: "Install a Void platform and choose who can access its apps"
 	},
 	{
 		name: "upgrade",
@@ -442,6 +442,7 @@ function parsePlatformArgs(args) {
 			"--account",
 			"--auth-config",
 			"--login-methods",
+			"--app-access",
 			"--hyperdrive",
 			"--application-domain",
 			"--control-plane-domain",
@@ -474,6 +475,12 @@ function parsePlatformArgs(args) {
 		if (noControlPlaneDomain && values.has("--control-plane-domain")) throw new Error("platform: Choose either --control-plane-domain or --no-control-plane-domain.");
 		if (noDedicatedZone && dedicatedZone) throw new Error("platform: Choose either --dedicated-zone or --no-dedicated-zone.");
 		if (values.has("--auth-config") && (values.has("--login-methods") || accessProtection !== void 0)) throw new Error("platform: --auth-config cannot be combined with login or Access protection options.");
+		const appAccess = values.get("--app-access");
+		if (appAccess !== void 0 && ![
+			"public",
+			"platform",
+			"custom"
+		].includes(appAccess)) throw new Error("platform: --app-access accepts public, platform, or custom.");
 		const loginMethods = values.get("--login-methods")?.split(",");
 		if (loginMethods && loginMethods.some((method) => !PLATFORM_LOGIN_KINDS.includes(method))) throw new Error("platform: --login-methods accepts github, google, oidc, and cloudflare-access.");
 		if (workersDev && (values.has("--application-domain") || values.has("--zone") || dedicatedZone)) throw new Error("platform: --workers-dev cannot be combined with a domain, zone, or --dedicated-zone.");
@@ -484,6 +491,7 @@ function parsePlatformArgs(args) {
 			...values.has("--hyperdrive") ? { hyperdrive: values.get("--hyperdrive") } : {},
 			...loginMethods ? { loginMethods: [...new Set(loginMethods)] } : {},
 			...accessProtection !== void 0 ? { accessProtection } : {},
+			...appAccess !== void 0 ? { appAccess } : {},
 			...workersDev ? { workersDev: true } : {},
 			...values.has("--auth-config") ? { authConfig: values.get("--auth-config") } : {},
 			account: values.get("--account") ?? "",

package/dist/platform-args-Cq6EjQro.mjs

@@ -0,0 +1,2 @@
+import { t as parsePlatformArgs } from "./platform-args-Bzf8JPc2.mjs";
+export { parsePlatformArgs };

package/dist/{platform-auth-config-B56E9YP1.mjs → platform-auth-config-0V0lA3pF.mjs}

@@ -1,10 +1,10 @@
-import { d as openBrowser } from "./auth-CSkdO2Bb.mjs";
-import { B as text, E as confirm, F as password, I as select, M as multiselect, W as isCancel } from "./dist-CTBk70IR.mjs";
-import { n as OperatorClient } from "./operator-client-DUwumHpQ.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-8KnOVXVd.mjs";
-import { execFile } from "node:child_process";
+import { u as openBrowser } from "./auth-7wuZ5ob8.mjs";
+import { A as confirm, K as select, U as password, X as text, tt as isCancel, z as multiselect } from "./prompts-6OSVA7DJ.mjs";
+import { n as OperatorClient } from "./operator-client-LmwjxT6q.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-CkmTE3rt.mjs";
 import { parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
+import { execFile } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 //#region src/cli/platform-auth-config.ts
@@ -140,11 +140,11 @@ async function configurationInput(args, existing) {
 }
 async function runPlatformAuthConfig(args) {
 	if (args.action === "recover") {
-		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-1gg4CSRe.mjs");
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-ICy4muq6.mjs");
 		return runPlatformAuthRecovery(args);
 	}
 	if (args.action === "protection") {
-		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-BDWO_aER.mjs");
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-DFeJ-JkK.mjs");
 		return runPlatformProtectionConfig(args);
 	}
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-auth-protection-BDWO_aER.mjs → platform-auth-protection-DFeJ-JkK.mjs}

@@ -1,13 +1,13 @@
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
-import { E as confirm, W as isCancel } from "./dist-CTBk70IR.mjs";
-import { n as OperatorClient } from "./operator-client-DUwumHpQ.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-8KnOVXVd.mjs";
-import { A as PlatformCloudflareClient, D as checkpointPlatformAccessResources, E as resolvePlatformCloudflareCredential, O as parsePlatformAccessSetupSpec, k as preparePlatformAccessSetup, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock } from "./platform-lifecycle-9OyBALhH.mjs";
-import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CjwLVQwN.mjs";
-import { createHmac } from "node:crypto";
+import { b as writePendingInstallationSecrets, d as promoteInstallationSecrets, f as readInstallationRecoverySecrets, g as resolveInstallationManifest, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, y as writeInstallationManifest } from "./platform-registry-KfNEF84O.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-AHKBzmuu.mjs";
+import { A as confirm, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
+import { n as OperatorClient } from "./operator-client-LmwjxT6q.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-CkmTE3rt.mjs";
+import { A as PlatformCloudflareClient, D as checkpointPlatformAccessResources, E as resolvePlatformCloudflareCredential, O as parsePlatformAccessSetupSpec, k as preparePlatformAccessSetup, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLock } from "./platform-lifecycle-Dm09JNkn.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BSEc_ZeG.mjs";
 import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
+import { createHmac } from "node:crypto";
 import { readFile } from "node:fs/promises";
 //#region src/cli/platform-auth-protection.ts
 /** Read every externally routed control-plane Worker before changing its preview settings. */

package/dist/{platform-auth-recovery-1gg4CSRe.mjs → platform-auth-recovery-ICy4muq6.mjs}

@@ -1,12 +1,12 @@
-import { d as openBrowser } from "./auth-CSkdO2Bb.mjs";
-import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, t as acquirePlatformLifecycleLock } from "./platform-registry-QBa4DK32.mjs";
-import { E as confirm, W as isCancel } from "./dist-CTBk70IR.mjs";
-import { a as resolveOperatorOrigin } from "./operator-auth-8KnOVXVd.mjs";
-import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, f as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLockConnection } from "./platform-lifecycle-9OyBALhH.mjs";
-import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CjwLVQwN.mjs";
+import { f as readInstallationRecoverySecrets, g as resolveInstallationManifest, t as acquirePlatformLifecycleLock } from "./platform-registry-KfNEF84O.mjs";
+import { u as openBrowser } from "./auth-7wuZ5ob8.mjs";
+import { A as confirm, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
+import { a as resolveOperatorOrigin } from "./operator-auth-CkmTE3rt.mjs";
+import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, c as acquirePlatformDatabaseLifecycleLockConnection, l as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl } from "./platform-lifecycle-Dm09JNkn.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BSEc_ZeG.mjs";
+import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
-import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 //#region src/cli/platform-auth-recovery-core.ts

package/dist/{platform-cmd-Bt-1w6pY.mjs → platform-cmd-BPySFOew.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-DMcQStSc.mjs";
+import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-D7vSWMvV.mjs";
 export { discoverPlatform, runPlatformCommand };

package/dist/{platform-cmd-DMcQStSc.mjs → platform-cmd-D7vSWMvV.mjs}

@@ -1,9 +1,9 @@
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { _ as selectPlatformConnection, g as savePlatformConnection, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl } from "./platform-registry-QBa4DK32.mjs";
-import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
-import { B as text, I as select, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
-import { parsePlatformDiscoveryDocument } from "@void/platform";
+import { _ as savePlatformConnection, a as listInstallationManifests, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl, v as selectPlatformConnection } from "./platform-registry-KfNEF84O.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-AHKBzmuu.mjs";
+import { K as select, L as log, X as text, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
+import { t as readPlatformDiscoveryResponse } from "./platform-discovery-DDDUvnqp.mjs";
+import { c as import_picocolors } from "./output-BBsUwdyT.mjs";
 //#region src/cli/platform-cmd.ts
 async function discoverPlatform(input, fetcher = fetch) {
 	const apiUrl = normalizePlatformApiUrl(input);
@@ -22,22 +22,7 @@ async function discoverPlatform(input, fetcher = fetch) {
 		ensurePlatformAccessToken(apiUrl, true);
 		response = await request();
 	}
-	if (!response.ok) throw new Error(`platform: Discovery failed at ${apiUrl} (HTTP ${response.status}).`);
-	let value;
-	try {
-		value = await response.json();
-	} catch {
-		throw new Error(`platform: ${apiUrl} returned invalid discovery metadata.`);
-	}
-	let discovery;
-	try {
-		discovery = parsePlatformDiscoveryDocument(value);
-	} catch (error) {
-		throw new Error(`platform: ${apiUrl} returned invalid discovery metadata: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	const finalOrigin = normalizePlatformApiUrl(response.url ? new URL(response.url).origin : apiUrl);
-	if (discovery.apiUrl !== finalOrigin) throw new Error(`platform: Discovery origin mismatch. The response came from ${finalOrigin}, but identifies ${discovery.apiUrl}.`);
-	return discovery;
+	return readPlatformDiscoveryResponse(apiUrl, response);
 }
 async function promptPlatformUrl() {
 	if (!process.stdin.isTTY) throw new Error("platform: A platform URL is required in non-interactive mode.");
@@ -106,19 +91,19 @@ async function runPlatformCommand(_root, args) {
 					}]
 				});
 				if (isCancel(group)) return;
-				const { parsePlatformArgs } = await import("./platform-args-D3RXyR6h.mjs");
+				const { parsePlatformArgs } = await import("./platform-args-Cq6EjQro.mjs");
 				return runPlatformCommand(_root, parsePlatformArgs(["config", group]));
 			}
-			const { runPlatformPlansConfig } = await import("./platform-plans-config-BNGKGr4P.mjs");
+			const { runPlatformPlansConfig } = await import("./platform-plans-config-B0pOVQyW.mjs");
 			await runPlatformPlansConfig(args);
 			return;
 		}
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-B56E9YP1.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-0V0lA3pF.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-DBA6dl0m.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-d-IEKgNk.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -138,7 +123,22 @@ async function runPlatformCommand(_root, args) {
 		return;
 	}
 	if (args.subcommand === "status") {
-		const discovery = await discoverPlatform((await resolveConnection(args.selector)).apiUrl);
+		const local = args.selector ? listInstallationManifests().find((manifest) => manifest.id === args.selector && manifest.status !== "uninstalled") : void 0;
+		const connection = local ? null : await resolveConnection(args.selector);
+		const saved = local ?? (connection?.installationId ? listInstallationManifests().find((manifest) => manifest.id === connection.installationId) : void 0);
+		if (saved) showSavedInstallationStatus(saved);
+		const apiUrl = local?.endpoints.apiUrl ?? connection?.apiUrl;
+		if (!apiUrl) {
+			log.info("No verified API endpoint is saved yet. Live traffic availability is unknown.");
+			return;
+		}
+		let discovery;
+		try {
+			discovery = await discoverPlatform(apiUrl);
+		} catch (error) {
+			if (saved) log.info("Live availability could not be confirmed. The saved checkpoint above may be out of date.");
+			throw error;
+		}
 		log.success(`${discovery.displayName} is reachable.`);
 		console.log(`API: ${discovery.apiUrl}`);
 		console.log(`Proxy: ${discovery.proxyUrl}`);
@@ -150,8 +150,18 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-BE6C_jxh.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-BaUdTRPU.mjs");
 	await runPlatformLifecycleCommand(args);
 }
+function showSavedInstallationStatus(manifest) {
+	console.log(`Saved installation: ${manifest.id} (${manifest.status})`);
+	console.log(`Checkpoint: ${manifest.updatedAt}`);
+	if (manifest.operation) {
+		const operation = manifest.operation;
+		console.log(`Saved operation: ${operation.action} — ${operation.phase}`);
+		console.log(`Runtime: ${operation.fromVersion ?? "new installation"} → ${operation.toVersion}`);
+	}
+	if (manifest.endpoints.apiUrl) console.log(`Administrator status: ${manifest.endpoints.apiUrl}/admin/status`);
+}
 //#endregion
 export { saveDiscoveredPlatform as i, promptPlatformUrl as n, runPlatformCommand as r, discoverPlatform as t };

package/dist/platform-discovery-DDDUvnqp.mjs

@@ -0,0 +1,27 @@
+import { s as normalizePlatformApiUrl } from "./platform-registry-KfNEF84O.mjs";
+import { parsePlatformDiscoveryDocument } from "@void/platform";
+//#region src/cli/platform-discovery.ts
+/** Validates a `GET /.well-known/void-platform` response from `apiUrl`. */
+async function readPlatformDiscoveryResponse(apiUrl, response) {
+	if (!response.ok) {
+		await response.body?.cancel();
+		throw new Error(`platform: Discovery failed at ${apiUrl} (HTTP ${response.status}).`);
+	}
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error(`platform: ${apiUrl} returned invalid discovery metadata.`);
+	}
+	let discovery;
+	try {
+		discovery = parsePlatformDiscoveryDocument(value);
+	} catch (error) {
+		throw new Error(`platform: ${apiUrl} returned invalid discovery metadata: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const finalOrigin = normalizePlatformApiUrl(response.url ? new URL(response.url).origin : apiUrl);
+	if (discovery.apiUrl !== finalOrigin) throw new Error(`platform: Discovery origin mismatch. The response came from ${finalOrigin}, but identifies ${discovery.apiUrl}.`);
+	return discovery;
+}
+//#endregion
+export { readPlatformDiscoveryResponse as t };

package/dist/{platform-domain-BNkcz0OB.mjs → platform-domain-CUdY064e.mjs}

@@ -1,8 +1,8 @@
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as readInstallationRecoverySecrets, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
-import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
-import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, T as assertPlatformOperatorCredentialCanApplyPlan, _ as recordPlatformWorkerTraffic, c as createPlatformHealthProbeToken, m as recordResource, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, y as createPlatformInstallPlan } from "./platform-lifecycle-9OyBALhH.mjs";
-import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CjwLVQwN.mjs";
+import { _ as savePlatformConnection, f as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, y as writeInstallationManifest } from "./platform-registry-KfNEF84O.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { A as confirm, B as note, L as log, X as text, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
+import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, T as assertPlatformOperatorCredentialCanApplyPlan, _ as recordPlatformWorkerTraffic, g as recordResource, n as resolvePlatformInstallDatabaseUrl, p as createPlatformHealthProbeToken, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, y as createPlatformInstallPlan } from "./platform-lifecycle-Dm09JNkn.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-BSEc_ZeG.mjs";
 import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {

package/dist/{platform-lifecycle-BE6C_jxh.mjs → platform-lifecycle-BaUdTRPU.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-9OyBALhH.mjs";
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-Dm09JNkn.mjs";
 export { runPlatformLifecycleCommand };