@clickraft/cli 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -1,8 +1,8 @@
-## [0.1.5](https://github.com/clickraft/cli/compare/v0.1.4...v0.1.5) (2026-05-23)
+## [0.1.7](https://github.com/clickraft/cli/compare/v0.1.6...v0.1.7) (2026-05-23)
 
 ### Bug Fixes
 
-* **tokens:** align /tokens list response to { data: T[] } envelope ([72d834d](https://github.com/clickraft/cli/commit/72d834db182b884b740aebc38153e6a0c51db95b))
+* **auth:** include Cloudflare Access headers in OAuth device flow requests ([e2cb7e9](https://github.com/clickraft/cli/commit/e2cb7e966f8935b43142a3d3d87a440e3478db10))
 
 # Changelog
 

package/README.md

@@ -21,6 +21,19 @@ clickraft generate create --prompt "a serene mountain landscape at dawn"
 
 Full documentation: [docs.clickraft.ai/cli](https://docs.clickraft.ai/cli) _(coming soon)_
 
+## Connecting to staging
+
+The staging API (`https://staging.clickraft.ai/api/agents/v1`) sits behind Cloudflare Access Zero Trust. To authenticate non-interactively, create a service token in the Cloudflare Zero Trust dashboard (**Access → Service Auth → Service Tokens**), then export both halves before invoking the CLI:
+
+```bash
+export CLOUDFLARE_ACCESS_CLIENT_ID="<client-id>.access"
+export CLOUDFLARE_ACCESS_CLIENT_SECRET="<client-secret>"
+
+clickraft tokens list --profile staging
+```
+
+Both env vars must be set together — if only one is set the CLI exits with a configuration error. Production usage (the default) does not require these env vars.
+
 ## Use with AI coding agents
 
 The Clickraft CLI is designed to work with Claude Code, Cursor, Codex, and other AI coding agents. Install the skills package for your agent:

package/dist/cli.js

@@ -529,6 +529,10 @@ var ApiClient = class {
     if (this.options.accessToken) {
       h.authorization = `Bearer ${this.options.accessToken}`;
     }
+    if (this.options.cloudflareAccess) {
+      h["cf-access-client-id"] = this.options.cloudflareAccess.clientId;
+      h["cf-access-client-secret"] = this.options.cloudflareAccess.clientSecret;
+    }
     if (opts.body !== void 0 && opts.method !== "GET" && opts.method !== "DELETE") {
       h["content-type"] = "application/json";
     }
@@ -1173,8 +1177,11 @@ var TOKEN_ENV_VAR = "CLICKRAFT_TOKEN";
 var PROFILE_ENV_VAR = "CLICKRAFT_PROFILE";
 var API_BASE_URL_ENV_VAR = "CLICKRAFT_API_BASE_URL";
 var TELEMETRY_DISABLE_ENV_VAR = "CLICKRAFT_DISABLE_TELEMETRY";
+var CLOUDFLARE_ACCESS_CLIENT_ID_ENV_VAR = "CLOUDFLARE_ACCESS_CLIENT_ID";
+var CLOUDFLARE_ACCESS_CLIENT_SECRET_ENV_VAR = "CLOUDFLARE_ACCESS_CLIENT_SECRET";
 async function loadConfig(options = {}) {
   const env = options.env ?? process.env;
+  const cloudflareAccess = loadCloudflareAccess(env);
   const flagToken = trim(options.flagToken);
   const envToken = trim(env[TOKEN_ENV_VAR]);
   const flagProfile = trim(options.flagProfile);
@@ -1204,9 +1211,26 @@ async function loadConfig(options = {}) {
   return {
     accessToken: tokenFromFlagOrEnv ?? fileAccessToken ?? null,
     profileName: profileName ?? fileProfileName ?? DEFAULT_PROFILE_NAME,
-    apiBaseUrl: apiBaseFromFlagOrEnv ?? fileApiBaseUrl ?? DEFAULT_API_BASE_URL
+    apiBaseUrl: apiBaseFromFlagOrEnv ?? fileApiBaseUrl ?? DEFAULT_API_BASE_URL,
+    cloudflareAccess
   };
 }
+function loadCloudflareAccess(env) {
+  const clientId = trim(env[CLOUDFLARE_ACCESS_CLIENT_ID_ENV_VAR]);
+  const clientSecret = trim(env[CLOUDFLARE_ACCESS_CLIENT_SECRET_ENV_VAR]);
+  if (clientId && clientSecret) {
+    return { clientId, clientSecret };
+  }
+  if (!clientId && !clientSecret) {
+    return null;
+  }
+  const onlySet = clientId ? CLOUDFLARE_ACCESS_CLIENT_ID_ENV_VAR : CLOUDFLARE_ACCESS_CLIENT_SECRET_ENV_VAR;
+  throw new ApiError(
+    "INPUT_INVALID_FORMAT",
+    `${CLOUDFLARE_ACCESS_CLIENT_ID_ENV_VAR} and ${CLOUDFLARE_ACCESS_CLIENT_SECRET_ENV_VAR} must both be set, or neither. Got only ${onlySet}.`,
+    { retryable: false }
+  );
+}
 function trim(value) {
   if (value === void 0) return void 0;
   const t = value.trim();
@@ -1300,7 +1324,8 @@ async function buildClient(opts) {
   return new ApiClient({
     apiBaseUrl: cfg.apiBaseUrl,
     accessToken: cfg.accessToken,
-    signal: opts.signal
+    signal: opts.signal,
+    cloudflareAccess: cfg.cloudflareAccess
   });
 }
 async function postAssetMetadata(args) {
@@ -1466,7 +1491,8 @@ async function buildGenerateClient(opts) {
   return new ApiClient({
     apiBaseUrl: cfg.apiBaseUrl,
     accessToken: cfg.accessToken,
-    signal: opts.signal
+    signal: opts.signal,
+    cloudflareAccess: cfg.cloudflareAccess
   });
 }
 function isUrlLike(value) {
@@ -1696,7 +1722,8 @@ async function runDeviceFlow(opts) {
       apiBaseUrl: opts.apiBaseUrl,
       clientId: opts.clientId,
       deviceCode: authResp.device_code,
-      signal: opts.signal
+      signal: opts.signal,
+      cloudflareAccess: opts.cloudflareAccess
     });
     if (result.kind === "success") {
       return result.token;
@@ -1731,11 +1758,16 @@ async function runDeviceFlow(opts) {
 }
 async function requestDeviceAuthorization(opts) {
   const body = new URLSearchParams({ client_id: opts.clientId, scope: opts.scope }).toString();
+  const headers = { "content-type": FORM_CONTENT_TYPE };
+  if (opts.cloudflareAccess) {
+    headers["cf-access-client-id"] = opts.cloudflareAccess.clientId;
+    headers["cf-access-client-secret"] = opts.cloudflareAccess.clientSecret;
+  }
   let resp;
   try {
     resp = await request(`${opts.apiBaseUrl}/oauth/device-authorization`, {
       method: "POST",
-      headers: { "content-type": FORM_CONTENT_TYPE },
+      headers,
       body,
       signal: opts.signal
     });
@@ -1802,11 +1834,16 @@ async function pollToken(args) {
     device_code: args.deviceCode,
     grant_type: GRANT_TYPE
   }).toString();
+  const headers = { "content-type": FORM_CONTENT_TYPE };
+  if (args.cloudflareAccess) {
+    headers["cf-access-client-id"] = args.cloudflareAccess.clientId;
+    headers["cf-access-client-secret"] = args.cloudflareAccess.clientSecret;
+  }
   let resp;
   try {
     resp = await request(`${args.apiBaseUrl}/oauth/token`, {
       method: "POST",
-      headers: { "content-type": FORM_CONTENT_TYPE },
+      headers,
       body,
       signal: args.signal
     });
@@ -2010,7 +2047,8 @@ async function login(options) {
     scope,
     onUserCode: options.onUserCode,
     onPoll: options.onPoll,
-    signal: options.signal
+    signal: options.signal,
+    cloudflareAccess: config.cloudflareAccess
   });
   const profile = buildCredentialsProfile({ token, apiBaseUrl });
   await setProfile(profileName, profile, options.credentialsPath);
@@ -2073,7 +2111,12 @@ async function logout(options) {
   let serverRevoked = false;
   let revokeFailureMessage;
   if (options.revoke) {
-    const factory = options.apiClientFactory ?? ((apiBaseUrl, accessToken) => new ApiClient({ apiBaseUrl, accessToken, signal: options.signal }));
+    const factory = options.apiClientFactory ?? ((apiBaseUrl, accessToken) => new ApiClient({
+      apiBaseUrl,
+      accessToken,
+      signal: options.signal,
+      cloudflareAccess: config.cloudflareAccess
+    }));
     const client = factory(profile.apiBaseUrl, profile.accessToken);
     try {
       await client.request({
@@ -2198,7 +2241,12 @@ async function listTokens(options) {
   if (!config.accessToken) {
     throw new AuthError("AUTH_TOKEN_MISSING", `Not authenticated. Run \`clickraft login\` first.`);
   }
-  const factory = options.apiClientFactory ?? ((apiBaseUrl, accessToken) => new ApiClient({ apiBaseUrl, accessToken, signal: options.signal }));
+  const factory = options.apiClientFactory ?? ((apiBaseUrl, accessToken) => new ApiClient({
+    apiBaseUrl,
+    accessToken,
+    signal: options.signal,
+    cloudflareAccess: config.cloudflareAccess
+  }));
   const client = factory(config.apiBaseUrl, config.accessToken);
   const data = await client.request({
     method: "GET",