void 1.1.11 → 1.2.0

package/dist/serialize-YHvlcG3Q.mjs

@@ -0,0 +1,31 @@
+//#region src/pages/script-json.ts
+const UNSAFE_SCRIPT_CHARS = /[<>&\u2028\u2029]/g;
+function escapeScriptJson(json) {
+	return json.replace(UNSAFE_SCRIPT_CHARS, (c) => {
+		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	});
+}
+//#endregion
+//#region src/pages/serialize.ts
+/**
+* Escape JSON for embedding inside an inline `<script type="application/json">`
+* tag. Replaces `<`, `>`, `&`, U+2028, U+2029 with their `\uXXXX` JSON escape
+* sequences so the script tag cannot be closed early and the payload survives
+* `JSON.parse` on hydration.
+*/
+function serializePageData(pageObj) {
+	return escapeScriptJson(JSON.stringify(pageObj));
+}
+/** Element id of the Markdown page frontmatter that islands read when they hydrate. */
+const ISLAND_FRONTMATTER_ID = "__void_frontmatter";
+/**
+* Script tag that carries a Markdown page's frontmatter to its islands, so
+* `useFrontmatter()` returns the same value in the browser as on the server.
+* Empty when the page has no frontmatter.
+*/
+function islandFrontmatterScript(frontmatter) {
+	if (!frontmatter || Object.keys(frontmatter).length === 0) return "";
+	return `<script type="application/json" id="${ISLAND_FRONTMATTER_ID}">${serializePageData(frontmatter)}<\/script>`;
+}
+//#endregion
+export { escapeScriptJson as i, islandFrontmatterScript as n, serializePageData as r, ISLAND_FRONTMATTER_ID as t };

package/dist/{skills-C_yRTg0g.mjs → skills-CrUO3PJ0.mjs}

@@ -1,5 +1,5 @@
 import { a as join, s as relative } from "./dist-ipQi0Q8y.mjs";
-import { L as log } from "./dist-BVdsO7Py.mjs";
+import { L as log } from "./dist-Cor9XGoz.mjs";
 import { r as getPackageDir } from "./agents-CuNtT0D_.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, symlinkSync } from "node:fs";
 //#region src/cli/skills.ts

package/dist/{subcommand-prompt-Bm3ZlYgA.mjs → subcommand-prompt-D9OhhbGG.mjs}

@@ -1,5 +1,5 @@
-import { $ as wrapTextWithPrefix, G as promptTitle, M as getGuide, V as optionText, b as S_RADIO_ACTIVE, d as S_CHECKBOX_SELECTED, i as S_BAR_END, it as wrapAnsi, j as formatInstructionFooter, n as SELECT_INSTRUCTIONS, r as S_BAR, t as MULTISELECT_INSTRUCTIONS, u as S_CHECKBOX_INACTIVE, w as S_STEP_SUBMIT } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors } from "./output-Ba6ZbrzY.mjs";
+import { $ as wrapTextWithPrefix, G as promptTitle, M as getGuide, V as optionText, b as S_RADIO_ACTIVE, d as S_CHECKBOX_SELECTED, i as S_BAR_END, it as wrapAnsi, j as formatInstructionFooter, n as SELECT_INSTRUCTIONS, r as S_BAR, t as MULTISELECT_INSTRUCTIONS, u as S_CHECKBOX_INACTIVE, w as S_STEP_SUBMIT } from "./dist-Cor9XGoz.mjs";
+import { f as import_picocolors } from "./output-BpgYODYx.mjs";
 //#region src/cli/subcommand-prompt.ts
 const isUpKey = (key) => key === "\x1B[A" || key === "\x1BOA";
 const isDownKey = (key) => key === "\x1B[B" || key === "\x1BOB";

package/dist/{version-metadata-B1Bm2wSq.mjs → version-metadata-tS39iW09.mjs}

@@ -1,5 +1,5 @@
 import { a as join } from "./dist-ipQi0Q8y.mjs";
-import { l as bindingNamesForField, p as findBindingNameOwner } from "./wrangler-C9XSzrju.mjs";
+import { l as bindingNamesForField, p as findBindingNameOwner } from "./wrangler-F96NnLyb.mjs";
 //#region src/shared/untrusted-env.ts
 /** Authentication inputs that Wrangler may consume from the environment. */
 const WRANGLER_AUTH_CREDENTIAL_ENV_VARS = [

package/dist/wrangler-BLb3_luP.mjs

@@ -0,0 +1 @@
+export { b as readRootWranglerConfig } from "./wrangler-F96NnLyb.mjs";

package/dist/{wrangler-C9XSzrju.mjs → wrangler-F96NnLyb.mjs}

@@ -1,7 +1,7 @@
-import { a as join, n as dirname, o as normalize, t as basename } from "./dist-ipQi0Q8y.mjs";
+import { a as join, c as resolve, n as dirname, o as normalize, t as basename } from "./dist-ipQi0Q8y.mjs";
 import "./project-paths-DGu_QZ_Q.mjs";
-import { d as readConfig } from "./config-D26zcdKy.mjs";
-import { i as persistCloudflareConfig, r as materializeCloudflareConfig } from "./cloudflare-config-rdFOys4X.mjs";
+import { p as readConfig } from "./config-DHgSEWT7.mjs";
+import { i as persistCloudflareConfig, r as materializeCloudflareConfig } from "./cloudflare-config-DchHxPTo.mjs";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { appendSqliteClassMigration, isRecord } from "@void/deploy-core";
 import { createHash } from "node:crypto";
@@ -640,7 +640,7 @@ function writeProvisionedWranglerConfig(root, patch, options) {
 			const existingDir = d1Entries[index].migrations_dir;
 			if (existingDir !== void 0 && typeof existingDir !== "string") throw new Error(`deploy: cannot update "${configPath}" — the D1 entry for binding ${JSON.stringify(patch.d1MigrationsDir.binding)} has a non-string "migrations_dir" value; expected a string. Fix the config and retry.`);
 			if (typeof existingDir === "string") {
-				if (normalizeMigrationsPath(existingDir) !== normalizeMigrationsPath(patch.d1MigrationsDir.dir)) throw new Error(`deploy: cannot update "${configPath}" — the D1 entry for binding ${JSON.stringify(patch.d1MigrationsDir.binding)} already sets "migrations_dir": ${JSON.stringify(existingDir)}, but Void keeps this database's migrations in ${JSON.stringify(patch.d1MigrationsDir.dir)}. Refusing to overwrite an explicit different migrations directory. Either remove "migrations_dir" from the entry (or set it to ${JSON.stringify(patch.d1MigrationsDir.dir)}) to let Void manage it, or move the migrations and keep your directory, then retry.`);
+				if (!sameMigrationsDir(configPath, existingDir, patch.d1MigrationsDir.dir)) throw new Error(`deploy: cannot update "${configPath}" — the D1 entry for binding ${JSON.stringify(patch.d1MigrationsDir.binding)} already sets "migrations_dir": ${JSON.stringify(existingDir)}, but Void keeps this database's migrations in ${JSON.stringify(patch.d1MigrationsDir.dir)}. Refusing to overwrite an explicit different migrations directory. Either remove "migrations_dir" from the entry (or set it to ${JSON.stringify(patch.d1MigrationsDir.dir)}) to let Void manage it, or move the migrations and keep your directory, then retry.`);
 			} else {
 				if (existingPattern !== void 0 && !migrationsPatternMatchesDir(existingPattern, patch.d1MigrationsDir.dir)) throw new Error(`deploy: cannot update "${configPath}" — the D1 entry for binding ${JSON.stringify(patch.d1MigrationsDir.binding)} has "migrations_pattern": ${JSON.stringify(existingPattern)}, which is not under the requested "migrations_dir": ${JSON.stringify(patch.d1MigrationsDir.dir)}. Wrangler requires the pattern to start with the migrations dir, so this change would break \`wrangler d1 migrations\`. Align "migrations_pattern" with the dir (or remove it) and retry.`);
 				set([
@@ -1379,6 +1379,14 @@ function strictBindingEntries(members, keyField, field) {
 function bindingSetError(problem, hidden) {
 	return /* @__PURE__ */ new Error(`deploy: cannot verify binding-name uniqueness — ${problem}. Refusing to proceed on a partially-readable binding set (a ${hidden} could hide a real collision). Fix the wrangler config and retry.`);
 }
+/**
+* Whether two `migrations_dir` values name the same folder. Wrangler resolves the value
+* against the config file's directory and accepts either slash.
+*/
+function sameMigrationsDir(configPath, a, b) {
+	const base = dirname(configPath);
+	return resolve(base, a.replaceAll("\\", "/")) === resolve(base, b.replaceAll("\\", "/"));
+}
 /** Wrangler's rule: the normalized pattern starts with `<dir>/`, unless the dir is ".". */
 function migrationsPatternMatchesDir(pattern, dir) {
 	const normalizedDir = normalizeMigrationsPath(dir);
@@ -1391,4 +1399,4 @@ function normalizeMigrationsPath(p) {
 	return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
 }
 //#endregion
-export { updateWranglerCustomDomain as A, readWranglerManagedQueueCleanupCandidates as C, syncWranglerBindings as D, resolveLiveBindingConfig as E, writeWranglerPublishedTrafficSnapshot as M, syncWranglerDurableObjects as O, readWranglerCustomDomains as S, readWranglerWebSocketTombstones as T, persistMaterializedWranglerConfig as _, LIVE_MIGRATION_TAG as a, readRootWranglerConfig as b, bindingEntriesForField as c, ensureWranglerCompatibilityDate as d, ensureWranglerNodejsAlsFlag as f, normalizeWranglerCompatibilityFlags as g, nextDurableObjectMigrationTag as h, LATEST_KNOWN_COMPAT_DATE as i, writeProvisionedWranglerConfig as j, syncWranglerWebSockets as k, bindingNamesForField as l, hasDurableObjectSqliteMigration as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, findBindingNameOwner as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompat as u, readExistingLiveBindingConfig as v, readWranglerPublishedTrafficSnapshot as w, readWranglerCompat as x, readProvisionedBindingEntry as y };
+export { syncWranglerWebSockets as A, readWranglerManagedQueueCleanupCandidates as C, sameMigrationsDir as D, resolveLiveBindingConfig as E, writeProvisionedWranglerConfig as M, writeWranglerPublishedTrafficSnapshot as N, syncWranglerBindings as O, readWranglerCustomDomains as S, readWranglerWebSocketTombstones as T, persistMaterializedWranglerConfig as _, LIVE_MIGRATION_TAG as a, readRootWranglerConfig as b, bindingEntriesForField as c, ensureWranglerCompatibilityDate as d, ensureWranglerNodejsAlsFlag as f, normalizeWranglerCompatibilityFlags as g, nextDurableObjectMigrationTag as h, LATEST_KNOWN_COMPAT_DATE as i, updateWranglerCustomDomain as j, syncWranglerDurableObjects as k, bindingNamesForField as l, hasDurableObjectSqliteMigration as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, findBindingNameOwner as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompat as u, readExistingLiveBindingConfig as v, readWranglerPublishedTrafficSnapshot as w, readWranglerCompat as x, readProvisionedBindingEntry as y };

package/dist/{wrapper-BOigE1xJ.mjs → wrapper-D3sZyh2C.mjs}

@@ -1,9 +1,9 @@
 import { a as join, l as toSlash, n as dirname, r as extname } from "./dist-ipQi0Q8y.mjs";
 import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
-import { d as readConfig, s as getDatabaseDialect } from "./config-D26zcdKy.mjs";
-import { n as isIdentifier, r as isLiteral } from "./ast-CPGPjb0V.mjs";
+import { l as getDatabaseDialect, p as readConfig } from "./config-DHgSEWT7.mjs";
+import { n as isIdentifier, r as isLiteral } from "./ast-CsZ_q_gc.mjs";
 import { t as MagicString } from "./dist-Cegxq8gs.mjs";
-import { r as voidDbBundlerPlugin, t as generateQueueResolverSource } from "./dispatch-BAbbn3jg.mjs";
+import { r as voidDbBundlerPlugin, t as generateQueueResolverSource } from "./dispatch-DoUnxTNo.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -459,6 +459,7 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 	const lines = [];
 	lines.push(WRAPPER_MARKER);
 	lines.push(`import original from "./${renamedEntry}";`);
+	lines.push(`export * from "./${renamedEntry}";`);
 	if (features.isr) {
 		lines.push("import { handleFrameworkIsr } from \"./__void_isr.mjs\";");
 		lines.push(`const __voidIsrDeploymentId = ${JSON.stringify(crypto.randomUUID())};`);
@@ -558,6 +559,7 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 		lines.push("");
 	}
 	lines.push("export default {");
+	lines.push("  ...original,");
 	if (needsFetchWrap) lines.push("  fetch: wrappedFetch,");
 	else lines.push("  fetch: original.fetch,");
 	if (features.crons.length > 0) lines.push(features.isr ? "  scheduled(controller, env, ctx) { env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId; return handleScheduled(controller, env, ctx); }," : "  scheduled: handleScheduled,");

package/dist/{ws-CsBNxv86.d.mts → ws-BH-im_tX.d.mts}

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
 import { r as AuthUser } from "./auth-DkcFflXV.mjs";
-import { a as CloudEnv } from "./handler-_PqY82xe.mjs";
+import { a as CloudEnv } from "./handler-BbkSPzGF.mjs";
 import { WebSocketRouteMap } from "void/routes";
 //#region src/runtime/ws.d.ts
 type MaybePromise<T> = T | Promise<T>;

package/docs/guide/ai.md

@@ -261,7 +261,7 @@ void secret put OPENAI_API_KEY=sk-...
 
 For local development, add it to `.env` in your project root:
 
-```
+```dotenv
 OPENAI_API_KEY=sk-...
 ```
 

package/docs/guide/database/postgresql.md

@@ -28,7 +28,7 @@ Add to your `void.config.ts`:
 
 For local development, add `DATABASE_URL` to `.env`:
 
-```
+```dotenv
 DATABASE_URL=postgresql://user:password@host:5432/mydb?sslmode=require
 ```
 

package/docs/guide/database.md

@@ -114,6 +114,32 @@ export * from "./schema/users";
 export * from "./schema/posts";
 ```
 
+### Column casing
+
+By default, a column declared without a name, such as `createdAt: timestamp()`, uses its key as the column name. Set `database.casing` to `'snake_case'` to store these columns as `created_at` instead. It applies to `void/db` queries and to `void db` commands such as `generate`, `push`, and `seed`. Columns with an explicit name, such as `text('created_at')`, keep that name.
+
+```ts
+// void.config.ts
+import { defineConfig } from 'void/config';
+
+export default defineConfig({
+  database: { dialect: 'pg', casing: 'snake_case' },
+});
+```
+
+```ts
+// db/schema.ts
+import { pgTable, serial, text, timestamp } from 'void/schema-pg';
+
+export const posts = pgTable('posts', {
+  id: serial().primaryKey(),
+  title: text().notNull(),
+  createdAt: timestamp().notNull().defaultNow(), // created_at
+});
+```
+
+Omit `dialect` for D1. If your database already has tables, run `void db generate` after you change `casing` and review the migration before you apply it.
+
 ## Querying
 
 Void re-exports all common [Drizzle query operators](https://orm.drizzle.team/docs/select) from `void/db` so you don't need to install `drizzle-orm` separately. Import `db` from `void/db` and your tables from `@schema`:

package/docs/guide/deployment.md

@@ -35,6 +35,8 @@ void db generate
 
 Review and commit the SQL, then deploy again. Rollback does not reverse database migrations. See [Database](./database.md) for the local workflow.
 
+On your own Cloudflare account, deploy saves a D1 [Time Travel](https://developers.cloudflare.com/d1/reference/time-travel/) restore point before it applies pending migrations and prints the [`void db restore`](../reference/cli/database.md#void-db-restore) command for it. If no restore point can be saved, deploy stops before it migrates. If deploy fails after it applied the migrations, for example when the upload fails, it prints the command again. Usually you fix the error and deploy again; restore only if the live version cannot run against the new schema. To recover from a bad migration, roll back the code with `void project rollback` if the new version is live, restore the database, then fix or remove the migration before you deploy again. After a one-off `void deploy --platform cloudflare`, add `--platform cloudflare` to each of these commands. Restoring discards every write made after the restore point. Restore points expire after 7 days on Workers Free and 30 days on Workers Paid; after that, undo a migration with a new one.
+
 ### Environment variables
 
 Declare values in `env.ts` and set production server secrets with `void secret put`. Deploy never uploads your local `.env`. Supply public `VITE_*` values through the build environment. See [Environment Variables](./env-vars.md).

package/docs/guide/edge/headers.md

@@ -43,7 +43,7 @@ On a [Void platform](../deployment.md#deploy-to-a-team-platform), apps usually s
 
 This stops a header rule from setting or clearing cookies for other apps on the same domain. These limits apply only to header rules. Your app's own response can set cookies and send `Clear-Site-Data`, and on a shared domain those can affect other apps. See [Domains and Resources](../platform/installation/domains.md#adding-a-domain).
 
-In `void dev`, with `void deploy --platform cloudflare`, and on [other runtimes](../deployment.md#other-runtimes), header rules apply both headers as written.
+During local development, with `void deploy --platform cloudflare`, and on [other runtimes](../deployment.md#other-runtimes), header rules apply both headers as written.
 
 ## Framework `_headers` files
 

package/docs/guide/email/domains.md

@@ -16,7 +16,7 @@ void email domain add acme.com
 
 `add` opens a Cloudflare API-token template. Restrict the token to the selected account and mail zone before creating it; Workers Scripts permission applies across that account. The CLI accepts a masked paste or a newly copied token and asks you to confirm those restrictions. The platform encrypts the credential for the zone connection, so projects sharing that zone do not need separate ingress Workers.
 
-Platform-managed custom inbound email requires the apex of a Cloudflare zone. Cloudflare’s catch-all only covers that apex, so a subdomain of the selected zone cannot receive arbitrary addresses. Choose an apex without another mail provider, or use the platform’s shared mail address. Void preserves foreign MX records and enabled catch-alls. Each custom apex belongs to one project; a project can register more than one apex.
+Platform-managed custom inbound email requires the apex of a Cloudflare zone. Cloudflare’s catch-all only covers that apex, so a subdomain of the selected zone cannot receive arbitrary addresses. `add` refuses to register a new apex that already has MX records, or whose catch-all already routes elsewhere, so it never takes over mail hosted with another provider such as Microsoft 365 or Google Workspace. Use an apex that has no mail yet, or the platform’s shared mail address. Running `add` again for a registered apex, for example to renew its token, keeps working. Each custom apex belongs to one project; a project can register more than one apex.
 
 If setup is interrupted, use `void email domain status <domain>` to inspect the saved operation before retrying.
 

package/docs/guide/email/receiving.md

@@ -96,7 +96,7 @@ to check current provider routing and any remaining setup steps.
 
 For direct deployments, follow [Your own Cloudflare account](./domains.md#your-own-cloudflare-account) to configure inbound addresses.
 
-`void dev` has no local inbound trigger. It serves only the outbound dev inbox. Test inbound handlers with `createInboundTestHarness` below.
+The local dev server provides the outbound email inbox but has no inbound email trigger. Test inbound handlers with `createInboundTestHarness` below.
 
 ## Testing inbound handlers {#testing-inbound-handlers}
 

package/docs/guide/email/sending.md

@@ -34,7 +34,7 @@ Check both failure shapes: `result.error` reports a request failure, while `resu
 
 ## Setup {#setup}
 
-On a platform with email enabled, deploy without additional email configuration. Ask your administrator for its shared mail domain. Administrators [enable email during installation or upgrade](/guide/platform/installation/credentials#runtime-token-permissions).
+On a platform with email enabled, deploy without additional email configuration. Ask your administrator for its shared mail domain. Administrators [enable email during installation or upgrade](/guide/platform/installation/credentials#enable-email).
 
 Each project on an email-enabled platform has:
 
@@ -171,7 +171,7 @@ The default platform allowance is 200 recipient attempts per UTC month and 10 pe
 
 ## Local development {#local-development}
 
-During `void dev`, sends are captured to an in-memory inbox instead of going to Cloudflare. The dev server prints the inbox URL when it starts:
+During local development, sends are captured to an in-memory inbox instead of going to Cloudflare. The dev server prints the inbox URL when it starts:
 
 ```
 [void] Email inbox: http://localhost:5173/__void/inbox?token=<printed-token>
@@ -195,7 +195,7 @@ The inbox keeps the most recent 100 messages through HMR and clears on a full se
 
 The dev inbox works in native Void apps, TanStack Start, and React Router. It is unavailable in SvelteKit, Nuxt, Analog, and Astro; sends from those apps return `BINDING_MISSING`. Use `createEmailTestHarness` from `void/email/testing` to capture sends in tests. If a configured inbox cannot be reached, `sendEmail` returns `UPSTREAM_ERROR` without sending.
 
-`sendInDev` is deprecated. During `void dev` it skips the inbox and returns `BINDING_MISSING`, so it never delivers. Remove it, and deploy the app to test real delivery.
+`sendInDev` is deprecated. During local development it skips the inbox and returns `BINDING_MISSING`, so it never delivers. Remove it, and deploy the app to test real delivery.
 
 ## Testing {#testing}
 

package/docs/guide/pages-routing/actions-and-forms.md

@@ -197,7 +197,7 @@ export const actions = {
 };
 ```
 
-Named actions are dispatched via a `?actionName` suffix on the URL (e.g. `/users/42?update`). The client primitives `useForm` and `action()` handle this automatically.
+Named actions are dispatched via a `?actionName` suffix on the URL (e.g. `/users/42?update`). The client primitives `useForm` and `action()` handle this automatically. The action key stays out of the page URL. When `POST /users/42?update&tab=profile` renders the page again, `useForm` and `action()` leave the address bar at `/users/42?tab=profile`, and `c.redirect('/users/42')` goes to `/users/42?tab=profile`.
 
 Use `action` or `actions` in a file, not both.
 

package/docs/guide/pages-routing/markdown.md

@@ -137,7 +137,7 @@ Welcome to Void. Here's an interactive demo:
 ```
 
 - **`<script>` block:** extracted before markdown compilation. Island imports use `with { island: "..." }` syntax (see [islands](./islands)). Any other code in the block becomes a [client script](#client-scripts) that runs in the browser.
-- **Frontmatter:** YAML metadata between `---` fences. Layouts can read it through [`useFrontmatter()`](#frontmatter-access).
+- **Frontmatter:** YAML metadata between `---` fences. Layouts and islands can read it through [`useFrontmatter()`](#frontmatter-access).
 - **Body:** standard markdown plus GFM. Uppercase tags such as `<Counter />` reference imported components and render as islands.
 
 ## Client Scripts
@@ -230,6 +230,8 @@ export default function DocsLayout(props) {
 
 :::
 
+Island components on a Markdown page can call `useFrontmatter()` too. A page with islands includes its frontmatter in the HTML for them to read in the browser. Keep private values out of the frontmatter of those pages.
+
 ## Pages Virtual Module
 
 Import `@void/md/pages` to get metadata for all markdown pages at build time. Use it to build sidebars, navigation, or search indexes:

package/docs/guide/platform/administration/email.md

@@ -27,6 +27,12 @@ reconciliation verifies delivery afterward; a deleting project stays closed
 and its deletion can be retried. See [operator email commands](../../../reference/cli/platform-email.md#operator-email)
 for the recovery requirements.
 
+### Mail that the platform sends {#platform-sender}
+
+The platform sends its own mail, for example invitations, welcome mail, failed-deploy notices, and error alerts. This mail comes from `noreply@<mail domain>`, and the sender name is the platform's display name. Void sets this sender, so you do not need to configure one. Do not set a different sender on the platform Workers in the Cloudflare dashboard. That change stops the next `upgrade`, `repair`, `enable`, or `rollback` until you let Void replace it. See [Platform Workers changed outside Void](/guide/platform/installation/maintenance#workers-changed-outside-void).
+
+Mail to an address that is not verified needs Cloudflare Email Sending onboarding and [Workers Paid](https://dash.cloudflare.com/?to=/:account/workers/plans).
+
 ### Deciding who mail may reach
 
 By default, mail from the shared sender reaches only the recipients each project has verified. For a team whose applications mainly mail colleagues, widen that once for the whole installation:
@@ -114,7 +120,7 @@ Use the apex of the selected Cloudflare zone. Platform-managed custom inbound em
 void platform email domain-add other.example --project hr-portal --token-stdin --yes < token.txt
 ```
 
-Project owners see administrator-registered domains in `void email domain list` and `status`; `status` names the `void platform email` command for any step they cannot take themselves, and `sync` and `remove` point them at `domain-sync` and `domain-remove`. A domain an owner registered before you switched to `admin` stays theirs to renew, sync and remove. The runtime token needs the email permissions listed in the [self-hosting guide](/guide/platform/installation/credentials#runtime-token-permissions) for this to work.
+Project owners see administrator-registered domains in `void email domain list` and `status`; `status` names the `void platform email` command for any step they cannot take themselves, and `sync` and `remove` point them at `domain-sync` and `domain-remove`. A domain an owner registered before you switched to `admin` stays theirs to renew, sync and remove. The runtime token needs the [email permissions](/guide/platform/installation/credentials#enable-email) for this to work.
 
 A permission refusal leaves setup blocked. After correcting it, run `domain-sync`
 to resume that same setup operation; repeat `domain-rotate-secret` to resume a

package/docs/guide/platform/installation/ci.md

@@ -51,6 +51,8 @@ void platform install \
 
 Mutations require `--yes` in CI; a read-only `--plan` does not. Custom runtimes also require `--runtime <directory>`. For a new installation, run `--plan` with the same account, name, and domain options as the unattended install. If you use `--auth-config`, pass the same file to both commands. Register `<platform-api-url>/auth/callback` when creating a login provider's OAuth or OIDC client manually; automatic Access setup manages its own application. A custom API hostname is optional.
 
+In CI, `upgrade`, `repair`, `enable`, `rollback`, and `install --resume` stop before they change a platform Worker or pause traffic when a platform Worker was changed in the Cloudflare dashboard or with the Cloudflare API, or has an active version without a Void deployment record. See [Platform Workers changed outside Void](/guide/platform/installation/maintenance#workers-changed-outside-void).
+
 :::
 
 ## Customize the Platform

package/docs/guide/platform/installation/credentials.md

@@ -60,7 +60,7 @@ Use the following permissions for the core platform. Cloudflare may label write
 
 When Void configures Access in the installation account, the initial management-token link also selects **Account → Access: Apps and Policies → Edit** and **Account → Access: Organizations, Identity Providers, and Groups → Read**. Protection adds **Account → Access: Service Tokens → Edit**. When the authentication configuration or saved setup selects existing applications, the link requests Read access instead of Edit. These permissions belong to the management token; the runtime token does not need them.
 
-The management token also needs **Zone Edit** with authority to create zones if you ask Void to create the zone. If it already exists, use the selected zone with Zone Read and DNS Edit. Nested application domains additionally need **SSL and Certificates: Read** on the management token. A custom runtime that enables custom project domains needs **SSL and Certificates: Edit** on the runtime token; the core runtime does not enable that feature.
+The management token also needs **Zone Edit** with authority to create zones if you ask Void to create the zone. If it already exists, use the selected zone with Zone Read and DNS Edit. Nested application domains additionally need **SSL and Certificates: Read** on the management token. An installation with [project custom domains](/guide/platform/installation/domains#project-custom-domains) needs **SSL and Certificates: Edit** on the runtime token.
 
 Void checks access before provisioning. If it reports a missing permission, update the token's permissions for the selected account or zone and retry.
 
@@ -68,7 +68,25 @@ Void checks access before provisioning. If it reports a missing permission, upda
 
 ## Enable Email {#enable-email}
 
-Choose a shared sender domain and its Cloudflare zone ID. The mail zone may differ from the application zone, but it must belong to the platform's Cloudflare account. To enable email on an existing installation, run:
+Choose a shared sender domain and its Cloudflare zone ID. The mail zone may differ from the application zone, but it must belong to the platform's Cloudflare account.
+
+Before you enable email, enable [Cloudflare Email Routing](https://developers.cloudflare.com/email-service/get-started/route-emails/) for the exact shared sender domain and confirm that its MX records point to Cloudflare. For a subdomain, add that name under the zone's **Email Routing → Settings → Subdomains**. Cloudflare adds the required MX and SPF records. The installer's shared-mail bootstrap verifies those records; it does not add them. Keep existing mail-provider records on other domain names in place.
+
+Enabling email lets administrators [register email domains for projects](/guide/platform/administration/email#registering-email-domains-for-projects) and lets projects register destination addresses through the runtime token. The runtime token needs these permissions:
+
+| Scope   | Permission              | Access |
+| ------- | ----------------------- | ------ |
+| Account | Email Routing Addresses | Edit   |
+| Account | Email Sending           | Edit   |
+| Zone    | Zone                    | Read   |
+| Zone    | Zone Settings           | Edit   |
+| Zone    | Email Routing Rules     | Edit   |
+
+The zone permissions must include each zone that will carry mail, including the mail zone. Email Sending onboarding for arbitrary recipients needs Workers Paid.
+
+For a new installation, set `VOID_EMAIL_SENDER_DOMAIN` and `VOID_EMAIL_SHARED_ZONE_ID` before `void platform install`. The runtime-token link then preselects these permissions.
+
+For an existing installation, add the permissions to its runtime token first. Edit the token in the Cloudflare dashboard. The token value stays the same. Or set `VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN` to a new token that has all runtime permissions. Then run:
 
 ```sh
 VOID_EMAIL_SENDER_DOMAIN=mail.example.com \
@@ -76,13 +94,13 @@ VOID_EMAIL_SHARED_ZONE_ID=your-zone-id \
 void platform upgrade your-installation-id
 ```
 
-Set the same two variables before `void platform install` to enable email during a new installation. Void records the pair for later upgrades; an ordinary upgrade cannot replace it.
+Void records the domain and zone for later upgrades; an ordinary upgrade cannot replace them.
 
-Before installing, enable [Cloudflare Email Routing](https://developers.cloudflare.com/email-service/get-started/route-emails/) for the exact shared sender domain and confirm that its MX records point to Cloudflare. For a subdomain, add that name under the zone's **Email Routing → Settings → Subdomains**. Cloudflare adds the required MX and SPF records. The installer's shared-mail bootstrap verifies those records; it does not add them. Keep existing mail-provider records on other domain names in place.
+Before the CLI changes anything or pauses traffic, it checks that the runtime token can read the mail zone and its Email Routing settings, rules, and addresses. If Cloudflare denies a request, the command stops and names each missing permission. Void keeps a saved runtime token, so you can add the permission to the same token and run the command again. The check cannot confirm Edit access or Email Sending, so select those permissions as the table shows.
 
-Enabling email lets administrators [register email domains for projects](/guide/platform/administration/email#registering-email-domains-for-projects) and lets projects register destination addresses through the runtime token. That needs **Email Routing Addresses: Edit** and **Email Sending: Edit** on the account, plus **Zone: Read**, **Zone Settings: Edit** and **Email Routing Rules: Edit** on the zones that will carry mail. The runtime-token link preselects them when email is enabled. Email Sending onboarding for arbitrary recipients needs Workers Paid.
+Without `VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN`, `upgrade`, `repair`, `enable`, and `rollback` check the runtime token saved on this machine. The platform can use a newer token, for example one set from another machine. If Cloudflare does not accept the saved token, the CLI shows a warning and continues without the check. To check the token that the platform uses, set `VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN` to it.
 
-The installer deploys the email gateway, prepares the shared mail route, and verifies inbound readiness before opening platform traffic. If setup fails, correct the reported permission, exact-domain MX records, or routing conflict, then rerun the same install or upgrade command. A fresh install resumes with `void platform install --resume --name <installation-id>`; it continues the recorded email operation after the configuration is corrected.
+The installer deploys the email gateway, prepares the shared mail route, and verifies inbound readiness before opening platform traffic. If setup fails, fix the problem that the error names, for example a missing permission, the exact-domain MX records, or a routing conflict. Then run the same install or upgrade command again. A fresh install resumes with `void platform install --resume --name <installation-id>`; it continues the recorded email operation after the configuration is corrected.
 
 ## R2 Upload Credentials
 

package/docs/guide/platform/installation/domains.md

@@ -53,6 +53,22 @@ The management token needs **SSL and Certificates: Read** (or Edit) on that zone
 
 :::
 
+## Project Custom Domains
+
+Projects can serve their own domains, such as `www.example.com`, through Cloudflare for SaaS custom hostnames. This needs a dedicated application zone. Turn it on when installing, or later with an upgrade:
+
+```sh
+void platform install --application-domain example.app --zone example.app --dedicated-zone --custom-domains
+void platform upgrade <installation-id> --custom-domains
+```
+
+The runtime token needs **SSL and Certificates: Edit** on the application zone. Void includes it in the runtime token's creation link and checks it before deploying; a token created before custom domains were on needs it added. Before adding the first domain, set up Cloudflare for SaaS on that zone once:
+
+1. Create a proxied DNS record for `cname.<application domain>`, for example an `AAAA` record pointing to `100::`.
+2. Open **SSL/TLS > Custom Hostnames**, enable Cloudflare for SaaS, and set `cname.<application domain>` as the fallback origin.
+
+A project owner then runs `void domain add <hostname>`. Void prints the CNAME target, `cname.<application domain>`, and the TXT records that prove ownership. Once the records resolve and the certificate is issued, the dedicated zone's catch-all routes send the hostname to the project.
+
 ## Optional Dashboard
 
 The API's `/admin/` pages are included in the core installation. You can deploy

package/docs/guide/platform/installation/maintenance.md

@@ -113,9 +113,13 @@ An upgrade validates the runtime, applies supported pending migrations, deploys
 
 Before starting, Void checks access to the installation's Cloudflare account, Workers, and existing R2 buckets. If credentials are rejected, set `CLOUDFLARE_API_TOKEN` to a management token scoped to that account and retry. This overrides the installation's saved management token.
 
-::: details Migration safety, credential rotation, and interrupted upgrades
+Some upgrades pause application traffic during the cutover to the new version. Traffic resumes after the new version passes its health checks. If an upgrade or another lifecycle command fails after it paused traffic, traffic stays paused until a later run succeeds. To resume:
 
-Some upgrades briefly put the platform into maintenance mode. Traffic resumes after the new version passes health checks. If an upgrade is interrupted during maintenance, rerun the same command to complete it.
+1. Run `void platform status <id>` to see the saved progress.
+2. Fix the problem that the error names.
+3. Run the resume command that the CLI printed. It is the same command, with the same runtime.
+
+::: details Migration safety, credential rotation, and rollback
 
 To update the runtime Cloudflare token, GitHub OAuth credentials when GitHub login is enabled, or R2 credentials,
 provide their `VOID_PLATFORM_*` environment variables when running the upgrade.
@@ -141,6 +145,32 @@ Let running rotations finish before you roll back. If an older proxy runs next t
 
 :::
 
+### Platform Workers changed outside Void {#workers-changed-outside-void}
+
+Void manages the platform's own Workers. Do not change them in the Cloudflare dashboard or with the Cloudflare API. To change the platform, use the Void commands on this page.
+
+`upgrade`, `repair`, `enable`, `rollback`, and `install --resume` deploy the platform Workers again. Before they change a platform Worker or pause traffic, Void finds each platform Worker that:
+
+- was changed in the Cloudflare dashboard or with the Cloudflare API.
+- has an active version without a Void deployment record. This can occur when an earlier run replaced a change made outside Void, and then stopped or failed. If that run stopped during the cutover to the new version, the command first makes the earlier versions active again. Void checks those earlier versions too. A version that an older Void release deployed can also have no record.
+
+The `--plan` preview of `upgrade`, `repair`, `enable`, and `rollback` shows the same list as a warning.
+
+In a terminal, Void lists these Workers and asks **Replace the configuration of these Workers?** The default answer is No.
+
+- If you answer No, the command stops. No platform Worker changed, and the command did not pause traffic.
+- If you answer Yes, the command continues. First, Void prepares the platform resources and the database. Then, before it pauses traffic or deploys a Worker, the Cloudflare CLI asks you again for each Worker changed in the dashboard or with the API. For a dashboard change, it shows the differences. Void uploads a new version of each of these Workers and does not deploy it yet. For a Worker that has an active version without a Void deployment record, the Cloudflare CLI does not ask again.
+
+If you refuse in the Cloudflare CLI, the command stops. Void does not undo the resource and database changes. No deployment changed, and the command did not pause traffic.
+
+The replacement removes values that Void does not set, for example an `EMAIL_FROM` variable that you added. It also resets values that Void sets, for example `AUTH_REDIRECT_URI`.
+
+Without a terminal, for example in CI, or with `--yes`, the command stops before it changes a platform Worker, and it does not pause traffic. Run the command that Void prints once in a terminal, and answer the questions there. After that run completes, the command works in CI again.
+
+If Void cannot read a platform Worker, the command also stops before it changes a platform Worker or pauses traffic. Run the command again. If a platform Worker has no single version that gets 100% of traffic, for example after a gradual deployment, deploy one version of it to 100% of traffic in the Cloudflare dashboard. Then run the command once in a terminal, so that you can approve the dashboard change.
+
+If an earlier run failed after it paused traffic, traffic stays paused after these stops. To resume traffic, see [Upgrade the platform](#upgrade-the-platform).
+
 ### Follow upgrade and rollback progress
 
 Watching progress is optional: a running upgrade or rollback proceeds through

package/docs/guide/platform/installation/setup.md

@@ -260,6 +260,6 @@ You can also rerun `void platform install` and choose **Continue setup** for an
 
 Resume restores your selected Hyperdrive. If that selection is missing from the saved checkpoint, add `--hyperdrive <existing-id>` when resuming, using the same configuration you originally selected.
 
-If Cloudflare rejects a saved runtime token during continued credential setup, Void opens the token page and asks for a replacement in the same run. Network or service failures do not discard saved tokens. Tokens supplied through the environment must be corrected there instead.
+If Cloudflare rejects a saved runtime token during continued credential setup, Void opens the token page and asks for a replacement in the same run. A missing [email permission](/guide/platform/installation/credentials#enable-email) does not discard the saved token: add the permission to the same token, then resume. Network or service failures do not discard saved tokens. Tokens supplied through the environment must be corrected there instead.
 
 :::

package/docs/guide/self-hosted-platform.md

@@ -10,7 +10,7 @@ If you're deploying an app for yourself, [deploy directly to Cloudflare](/integr
 
 The core platform supports GitHub, Google, generic OIDC, and Cloudflare Access login, CLI deploys, D1, KV, R2, Queues, cron jobs, Workers AI, WebSockets, SSE, ISR, routing, logs, and rollback.
 
-The core installation includes managed Sandboxes and an email gateway; email is enabled when you configure a shared mail domain and zone. The user dashboard, GitHub builds and webhooks, build Containers, and custom project domains aren't part of the core installation. Source-built platforms that add the optional GitHub services should follow the [isolated webhook ingress setup](/guide/platform/development/runtime#optional-github-webhook-ingress-for-access-protected-apis) when Access protects the API.
+The core installation includes managed Sandboxes and an email gateway; email is enabled when you configure a shared mail domain and zone. The user dashboard, GitHub builds and webhooks, and build Containers aren't part of the core installation. [Project custom domains](/guide/platform/installation/domains#project-custom-domains) are opt-in with `--custom-domains`. Source-built platforms that add the optional GitHub services should follow the [isolated webhook ingress setup](/guide/platform/development/runtime#optional-github-webhook-ingress-for-access-protected-apis) when Access protects the API.
 
 ## Deployment features
 

package/docs/guide/server-routing.md

@@ -12,7 +12,7 @@ Create route handlers in `routes/**/*.ts`. Each file maps to a URL path based on
 
 <RoutesFileTree />
 
-Dynamic segments use brackets: `[id]` becomes a route parameter and `[...slug]` becomes a catch-all. Files or directories starting with `_` are ignored. Directories wrapped in parentheses like `(admin)` are route groups. They help organize files without changing the URL.
+Dynamic segments use brackets: `[id]` becomes a route parameter and `[...slug]` becomes a catch-all. Files or directories starting with `_` are ignored, and so are those starting with `.`, except `.well-known`. Directories wrapped in parentheses like `(admin)` are route groups. They help organize files without changing the URL.
 
 ### Environment-only routes
 

package/docs/guide/typed-fetch.md

@@ -106,4 +106,4 @@ export default defineRender(async (c, assetTags) => {
 });
 ```
 
-Server-side calls forward the incoming request's `cookie` and `authorization` headers. Explicit headers take precedence.
+Server-side calls to your app forward the incoming request's `cookie` and `authorization` headers. Explicit headers take precedence. Calls to an external `baseURL` use HTTP and do not inherit these headers.

package/docs/integrations/cloudflare.md

@@ -52,6 +52,7 @@ This provides binding types and Workers runtime types.
 | `KV`             | KV              | `c.env.KV` or `void/kv`           |
 | `STORAGE`        | R2              | `c.env.STORAGE` or `void/storage` |
 | `AI`             | Workers AI      | `c.env.AI` or `void/ai`           |
+| `ASSETS`         | Static assets   | `c.env.ASSETS.fetch(request)`     |
 | `QUEUE_*`        | Queues          | `defineQueue()` or `void/queues`  |
 | Filename-derived | Durable Objects | A module in `durable-objects/`    |
 
@@ -183,7 +184,7 @@ void project status
 void project rollback [version]
 ```
 
-Void restores recorded triggers along with the code. Versions without a complete trigger snapshot keep current routes and schedules. Rollback does not reverse database migrations.
+Void restores recorded triggers along with the code. Versions without a complete trigger snapshot keep current routes and schedules. Rollback does not reverse database migrations. To undo D1 migrations, run [`void db restore`](../reference/cli/database.md#void-db-restore) with the restore point that deploy printed before it applied them, within 7 days on Workers Free or 30 days on Workers Paid.
 
 #### Scope and limitations
 

package/docs/integrations/frameworks/tanstack-start.md

@@ -71,6 +71,31 @@ Use [KV](../../guide/kv.md), [object storage](../../guide/storage.md), and [AI](
 
 Declare variables in `env.ts` and read them with `import { env } from "void/env"`. See [Environment Variables](../../guide/env-vars.md) for local values, production secrets, and public `VITE_*` values.
 
+## Custom Worker Entry
+
+Set `cloudflare.main` in `void.config.ts` when your Worker needs its own entry module, for example to export a Durable Object class:
+
+```ts
+import { defineConfig } from 'void/config';
+
+export default defineConfig({
+  cloudflare: { main: './server.ts' },
+});
+```
+
+The path is relative to your app root. Default-export the TanStack request handler and add your named exports in that module:
+
+```ts
+import handler from '@tanstack/react-start/server-entry';
+
+export { Counter } from './counter';
+export default handler;
+```
+
+Void preserves these named exports in development, production builds, and deploys. Without `cloudflare.main`, Void uses TanStack's default server entry. A package entry such as `@tanstack/react-start/server-entry` is resolved as a module.
+
+Bind an exported Durable Object or Workflow class under `cloudflare` as well, for example in `cloudflare.durable_objects`. These settings apply when you deploy with `void deploy --platform cloudflare`. On a Void platform, use [Durable State](../../guide/durable-state.md) instead.
+
 ## Accessing Bindings Directly
 
 You can also access Cloudflare bindings via the `cloudflare:workers` module: