@dutodev/cli 1.7.0 → 1.8.1

package/README.md

@@ -3,7 +3,7 @@
 Put a local service on the internet at a stable HTTPS URL, with one command:
 
 ```
-duto 3000 --name web     # https://web-<user>.duto.dev → localhost:3000
+duto 3000 --name web     # https://web-<user>.duto.page → localhost:3000
 ```
 
 The URL stays the same from one session to the next. That makes it good for webhooks, login callbacks, testing on your phone, or showing someone your work without deploying.
@@ -20,8 +20,13 @@ Requires Node 18 or later. On first run, the CLI downloads a pinned release of t
 
 ## Get started
 
-1. At [duto.dev](https://duto.dev), open **Authtoken** and generate your token.
-2. Connect the CLI to your account (once per machine):
+1. Connect the CLI to your account (once per machine). It opens your browser so you can approve it:
+
+   ```
+   duto login
+   ```
+
+2. On CI and servers with no browser, create a token on the **Machines** page at [duto.dev](https://duto.dev) and pass it:
 
    ```
    duto login <token>
@@ -30,11 +35,11 @@ Requires Node 18 or later. On first run, the CLI downloads a pinned release of t
 3. Open a tunnel:
 
    ```
-   duto 3000                  # https://<user>.duto.dev
-   duto 3000 --name web       # https://web-<user>.duto.dev
+   duto 3000                  # https://<user>.duto.page
+   duto 3000 --name web       # https://web-<user>.duto.page
    ```
 
-Every name you use with `--name` is reserved for you and keeps the same URL. Names take lowercase letters and numbers only, no hyphens.
+Every name you use with `--name` keeps the same URL, and only you can use it. Names take lowercase letters and numbers only, no hyphens. The account limit counts named tunnels online at once: closed ones do not count, and names unused for 30 days are released.
 
 ## Several tunnels: `duto.yml`
 
@@ -47,11 +52,13 @@ tunnels:
   webhook: 4000
 ```
 
-All tunnels start together, in one screen. The CLI looks for the file in the current folder and its parents, up to the git root. If you commit it, everyone on the team gets their own addresses (`web-<user>.duto.dev`) from the same file.
+All tunnels start together, in one screen. The CLI looks for the file in the current folder and its parents, up to the git root. If you commit it, everyone on the team gets their own addresses (`web-<user>.duto.page`) from the same file.
+
+**Edit while it runs.** Save `duto.yml` and the change applies right away, without restarting: new tunnels open, removed ones close, and a new `port`, `host`, `headers`, `auth` or `allow` counts from the next request, on the same URL. Visitors signed in with a password stay signed in while their user is still in `auth`. A save with a mistake changes nothing: the tunnels keep the last valid config and the screen shows the error with its line until you save a fixed file. Tunnels opened with `n` on the screen are left alone. Saving `.env` or `.env.local` applies the file again with the new values.
 
 ### Host and headers
 
-By default, your local service gets the request as it arrived from the internet: `Host: web-<user>.duto.dev`, `X-Forwarded-Proto: https` and the Cloudflare headers (`CF-Connecting-IP` and others). That is enough for most apps. When your app decides things by domain, you have two tools per tunnel:
+By default, your local service gets the request as it arrived from the internet: `Host: web-<user>.duto.page`, `X-Forwarded-Proto: https` and the Cloudflare headers (`CF-Connecting-IP` and others). That is enough for most apps. When your app decides things by domain, you have two tools per tunnel:
 
 ```yaml
 tunnels:
@@ -77,7 +84,7 @@ tunnels:
 **What `host:` does:**
 
 - Your service receives the Host you set, and `X-Forwarded-Host` is not sent. To send it anyway, put it in `headers:`.
-- Redirects come back with the public address. A `Location: http://admin.myapp.test:8081/login` reaches the browser as `https://admin-<user>.duto.dev/login`. This also applies inside encoded parameters of the `Location`. To turn it off, set `rewrite_redirects: false` on the tunnel.
+- Redirects come back with the public address. A `Location: http://admin.myapp.test:8081/login` reaches the browser as `https://admin-<user>.duto.page/login`. This also applies inside encoded parameters of the `Location`. To turn it off, set `rewrite_redirects: false` on the tunnel.
 - Links in response bodies (HTML, JSON) are not rewritten. URLs your app builds from the Host only open on your machine.
 - On the command line: `duto 8081 --host admin.myapp.test`, and `--no-rewrite-redirects` to turn the swap off.
 
@@ -89,7 +96,7 @@ Ways out, from simplest to most work:
 2. If the app needs the local domain for other decisions and reads `X-Forwarded-Host`, pass the domain through `headers:` and keep the public Host.
 3. Set the public callback URL in the app, if it lets you.
 
-In every case, register `https://<name>-<user>.duto.dev/<callback path>` as the callback URL at the provider. The comparison is usually exact, with no wildcards: each person on the team has their own address.
+In every case, register `https://<name>-<user>.duto.page/<callback path>` as the callback URL at the provider. The comparison is usually exact, with no wildcards: each person on the team has their own address.
 
 **What you cannot set.** Some headers belong to Cloudflare, to Duto or to the HTTP connection itself. `duto.yml` refuses them, with the line and what to do:
 
@@ -140,7 +147,7 @@ tunnels:
 ```
 
 - `auth` is a list of `user:password`. Use one pair per person. The first `:` separates the user from the password; the password is 8 to 128 characters.
-- `${VAR}` reads an environment variable. Always use it: that keeps the password out of git along with `duto.yml`. If the variable does not exist, the CLI stops and prints the line number. The name can only have uppercase letters, digits and `_` (`${ANA_PASSWORD}`); anything else, like `${password}`, is left as text and becomes part of the password.
+- `${VAR}` reads an environment variable, or the `.env` and `.env.local` next to `duto.yml` (`.env.local` wins over `.env`; a variable exported in the shell wins over both). Always use it: that keeps the password out of git along with `duto.yml`. If the variable does not exist, the CLI stops and prints the line number. The name can only have uppercase letters, digits and `_` (`${ANA_PASSWORD}`); anything else, like `${password}`, is left as text and becomes part of the password.
 - In a one-line list in brackets, `${VAR}` needs quotes (`auth: ["client:${CLIENT_PASSWORD}"]`), because `{` is special in YAML. In a block list, as above, it does not.
 - On the command line, for a single tunnel: `duto 3000 --auth client:my-password1 --allow stripe`. Both options can be repeated. They only work with a port; with a `duto.yml`, put them in the file.
 - Careful: a password passed to `--auth` ends up in your shell history and is visible to anyone who runs `ps` on the machine. For anything beyond a quick test, use `duto.yml` with `${VAR}`.
@@ -151,12 +158,12 @@ People get in one of these ways:
 |---|---|
 | Person in a browser | Opens the URL, sees the "This tunnel is password protected" page and signs in with user and password |
 | Phone | Scans the QR code (key `m`, see below) and gets in without typing |
-| `curl`, Postman, scripts | `curl -u client:password https://backend-<user>.duto.dev/` (`Authorization: Basic`) |
+| `curl`, Postman, scripts | `curl -u client:password https://backend-<user>.duto.page/` (`Authorization: Basic`) |
 | An API that already uses `Authorization: Bearer` | Send `X-Duto-Auth: client:password`; the `Bearer` goes through to the app untouched |
 
 Without credentials, a browser is sent to the sign-in page and other clients get `401`. After 10 wrong passwords from one address in 5 minutes, that address is locked out for the rest of the window (the sign-in page answers `429` with `Retry-After`, other clients keep getting `401`). After 100 wrong passwords from all addresses, every password attempt is locked out the same way. A browser that already signed in keeps working. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
 
-**Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
+**Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.page` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
 
 **QR code.** With the full screen open, key `m` shows the QR of the selected tunnel in place of the request list. On a tunnel without a password, the QR points to the tunnel URL. On a tunnel with a password, it points to a link that signs in directly, as the first user in the `auth` list. That link is valid for 5 minutes and for one device only: once opened, or after it expires, it falls back to the sign-in page. On the QR screen, `g` generates a new link (and invalidates the previous one) and `esc` goes back to the list.
 
@@ -229,7 +236,7 @@ The page has the list on the left and the details on the right, with the tabs **
 
 | Option | What it does |
 |---|---|
-| `--name <name>` | Fixed address `<name>-<user>.duto.dev` |
+| `--name <name>` | Fixed address `<name>-<user>.duto.page` |
 | `--host <host>` | Host the local service receives instead of the public one |
 | `--no-rewrite-redirects` | With `--host`, keep redirects as the service sent them |
 | `--auth <user:password>` | Ask for a username and password to open the address (repeatable) |

package/dist/{chunk-QVJHHURM.js → chunk-QFM4MUED.js}

@@ -1,5 +1,27 @@
 #!/usr/bin/env node
 
+// src/ui/brand.ts
+function colorOn(stream = process.stdout) {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0") return true;
+  return Boolean(stream.isTTY);
+}
+var SGR = {
+  signal: "38;2;45;212;191",
+  muted: "38;2;138;143;139",
+  strong: "1",
+  ok: "38;2;74;222;128",
+  warn: "38;2;250;204;21",
+  err: "38;2;248;113;113"
+};
+function paint(tone, text, stream) {
+  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text}\x1B[0m` : text;
+}
+var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
+var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
+var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
+var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
+
 // ../shared/src/names.ts
 var EMAIL_SENDING_SUBDOMAINS = ["send"];
 var RESERVED_NAMES = [
@@ -477,6 +499,95 @@ function loadConfig() {
   return fresh;
 }
 
+// src/ui/format.ts
+function statusColor(status) {
+  if (status === null) return "muted";
+  if (status === 101) return "signal";
+  if (status >= 500) return "err";
+  if (status >= 400) return "warn";
+  if (status >= 300) return "muted";
+  return "ok";
+}
+function formatDuration(ms) {
+  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+function formatTime(ms) {
+  const d = new Date(ms);
+  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
+}
+function localLabel(t) {
+  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
+}
+
+// src/ui/plain.ts
+var KEEPING_LAST_CONFIG = "Tunnels keep the last valid config.";
+function runPlain(session, out) {
+  const announced = /* @__PURE__ */ new Map();
+  const failed = /* @__PURE__ */ new Set();
+  const printed = /* @__PURE__ */ new Set();
+  let configError = null;
+  let reloads = 0;
+  const onTunnels = (state) => {
+    const keys = new Set(state.tunnels.map((t) => t.key));
+    for (const key of [...announced.keys()]) {
+      if (keys.has(key)) continue;
+      announced.delete(key);
+      out(`${paint("muted", "\u25CB")} ${key}  closed`);
+    }
+    for (const key of [...failed]) if (!keys.has(key)) failed.delete(key);
+    for (const t of state.tunnels) {
+      if ((t.status === "live" || t.status === "no-listener") && t.url) {
+        const line = `${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`;
+        if (announced.get(t.key) !== line) {
+          announced.set(t.key, line);
+          out(line);
+        }
+      }
+      if (t.status !== "failed") failed.delete(t.key);
+      if (t.status === "failed" && t.error && !failed.has(t.key)) {
+        failed.add(t.key);
+        out(`${paint("err", "\u2716")} ${t.key}  ${t.error}`);
+      }
+    }
+  };
+  const onConfig = (state) => {
+    const { error, warnings } = state.config;
+    if (error && error !== configError) out(`${paint("err", "\u2716")} ${error} ${KEEPING_LAST_CONFIG}`);
+    configError = error;
+    if (state.config.reloads === reloads) return;
+    reloads = state.config.reloads;
+    out(`${paint("signal", "\u21BB")} ${state.source} reloaded`);
+    for (const w of warnings) out(paint("warn", w));
+  };
+  const onState = () => {
+    const state = session.getState();
+    onTunnels(state);
+    onConfig(state);
+  };
+  const onRecords = () => {
+    for (const r of [...session.records.list()].reverse()) {
+      if (printed.has(r.id) || r.status === null || r.durationMs === null) continue;
+      printed.add(r.id);
+      const method = r.websocket ? "WS" : r.method;
+      out(
+        `${formatTime(r.startedAt)}  ${r.tunnel.padEnd(8)}  ${method} ${r.path}  ${paint(statusColor(r.status), String(r.status))}  ${formatDuration(r.durationMs)}  ${formatBytes(r.bytes)}${r.redirect ? `  ${paint("signal", `\u21AA Location rewritten to ${r.redirect.to}`)}` : ""}`
+      );
+    }
+  };
+  const offState = session.subscribe(onState);
+  const offRecords = session.records.subscribe(onRecords);
+  onState();
+  return () => {
+    offState();
+    offRecords();
+  };
+}
+
 // src/updates.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2 } from "path";
@@ -575,32 +686,12 @@ function bodyNote(r, side) {
   return null;
 }
 
-// src/ui/format.ts
-function statusColor(status) {
-  if (status === null) return "muted";
-  if (status === 101) return "signal";
-  if (status >= 500) return "err";
-  if (status >= 400) return "warn";
-  if (status >= 300) return "muted";
-  return "ok";
-}
-function formatDuration(ms) {
-  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
-}
-function formatBytes(n) {
-  if (n < 1024) return `${n} B`;
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
-  return `${(n / 1024 / 1024).toFixed(1)} MB`;
-}
-function formatTime(ms) {
-  const d = new Date(ms);
-  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-}
-function localLabel(t) {
-  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
-}
-
 export {
+  paint,
+  mark,
+  ok,
+  fail,
+  warn,
   MAX_NAME,
   normalizeName,
   validateName,
@@ -628,6 +719,8 @@ export {
   formatBytes,
   formatTime,
   localLabel,
+  KEEPING_LAST_CONFIG,
+  runPlain,
   checkForUpdate,
   updateLine
 };

package/dist/{fullscreen-ZNFUDV2B.js → fullscreen-Q3RGW6NJ.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  KEEPING_LAST_CONFIG,
   MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
@@ -15,7 +16,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-QVJHHURM.js";
+} from "./chunk-QFM4MUED.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";
@@ -348,6 +349,12 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
     const t = setTimeout(() => setMessage(null), 4e3);
     return () => clearTimeout(t);
   }, [message]);
+  const reloads = state.config.reloads;
+  const reloadWarnings = state.config.warnings;
+  useEffect(() => {
+    if (reloads === 0) return;
+    setMessage({ text: [`\u21BB ${state.source} reloaded`, ...reloadWarnings].join("  "), tone: reloadWarnings.length ? "warn" : "signal" });
+  }, [reloads]);
   const inQr = mode.kind === "qr";
   useEffect(() => {
     if (!inQr) return;
@@ -467,7 +474,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
   });
   const live = state.tunnels.filter((t) => t.status === "live").length;
   const conn = state.connection === "online" ? { text: "connected \u25CF", color: C.signal } : state.connection === "connecting" ? { text: "connecting\u2026", color: C.muted } : { text: "reconnecting\u2026", color: C.warn };
-  const listHeight = Math.max(3, rows - state.tunnels.length - (inspector ? 10 : 9) - (update ? 1 : 0));
+  const listHeight = Math.max(3, rows - state.tunnels.length - (inspector ? 10 : 9) - (update ? 1 : 0) - (state.config.error ? 1 : 0));
   const detailRecord = mode.kind === "detail" ? all.find((r) => r.id === mode.id) : void 0;
   const qrTunnel = mode.kind === "qr" ? state.tunnels.find((t) => t.key === mode.key) : void 0;
   return /* @__PURE__ */ jsxs6(Box5, { flexDirection: "column", width, children: [
@@ -493,6 +500,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
       /* @__PURE__ */ jsx6(Text6, { color: conn.color, children: conn.text })
     ] }),
     update && /* @__PURE__ */ jsx6(Text6, { color: C.warn, children: updateLine(update) }),
+    state.config.error && /* @__PURE__ */ jsx6(Text6, { color: C.err, children: `${state.config.error} ${KEEPING_LAST_CONFIG}` }),
     /* @__PURE__ */ jsx6(Text6, { children: " " }),
     /* @__PURE__ */ jsx6(TunnelTable, { tunnels: state.tunnels, selected: selTun, focused: focus === "tunnels" }),
     inspector && /* @__PURE__ */ jsx6(Text6, { color: C.muted, children: `inspector  ${inspector.url}` }),

package/dist/index.js

@@ -12,52 +12,31 @@ import {
   checkForUpdate,
   describeChange,
   dutoHome,
-  formatBytes,
-  formatDuration,
-  formatTime,
+  fail,
   headerLabel,
   isCredentialLike,
   isValidHeaderValue,
   loadConfig,
-  localLabel,
+  mark,
   normalizeName,
+  ok,
+  paint,
   placeOf,
   reservedHeaderError,
+  runPlain,
   saveConfig,
-  statusColor,
   updateLine,
-  validateName
-} from "./chunk-QVJHHURM.js";
-
-// src/ui/brand.ts
-function colorOn(stream = process.stdout) {
-  if (process.env.NO_COLOR) return false;
-  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0") return true;
-  return Boolean(stream.isTTY);
-}
-var SGR = {
-  signal: "38;2;45;212;191",
-  muted: "38;2;138;143;139",
-  strong: "1",
-  ok: "38;2;74;222;128",
-  warn: "38;2;250;204;21",
-  err: "38;2;248;113;113"
-};
-function paint(tone, text2, stream) {
-  return colorOn(stream) ? `\x1B[${SGR[tone]}m${text2}\x1B[0m` : text2;
-}
-var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
-var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
-var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
-var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
+  validateName,
+  warn
+} from "./chunk-QFM4MUED.js";
 
 // src/index.ts
 import { hostname as hostname2 } from "os";
-import { join as join5, relative } from "path";
+import { join as join7, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.7.0";
+var CLI_VERSION = "1.8.1";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -360,9 +339,29 @@ async function resolveAllow(entries, o = {}) {
 }
 
 // src/session/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
 import { isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
+
+// src/session/envFiles.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+import { parse } from "dotenv";
+var ENV_FILES = [".env", ".env.local"];
+function readEnvFile(path) {
+  try {
+    return parse(readFileSync2(path, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw err;
+  }
+}
+function configEnv(dir, shell = process.env) {
+  const files = ENV_FILES.reduce((env, file) => ({ ...env, ...readEnvFile(join3(dir, file)) }), {});
+  return { ...files, ...shell };
+}
+
+// src/session/config.ts
 var ConfigError = class extends Error {
   constructor(message2, line, file = CONFIG_FILES[0]) {
     super(!file ? message2 : line ? `${file}, line ${line}: ${message2}` : `${file}: ${message2}`);
@@ -376,6 +375,7 @@ var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "trust_forwarded", "auth", "allow"];
+var SET_IT = `Add it to .env next to ${CONFIG_FILES[0]} or export it in the shell.`;
 var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
@@ -463,7 +463,7 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
           if (headers.has(hName.toLowerCase())) throw fail3(`header ${hName} appears twice in "${raw}"`, hLine);
           const text3 = headerText(h.value);
           if (text3 === void 0) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
-          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}")`, hLine));
+          const value = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in headers of "${raw}"). ${SET_IT}`, hLine));
           if (!isValidHeaderValue(value)) throw fail3(`invalid character in the value of ${hName} in "${raw}". Use ASCII or Latin-1 text.`, hLine);
           headers.set(hName.toLowerCase(), value);
         }
@@ -490,7 +490,7 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const text3 = isScalar(item) && typeof item.value === "string" ? item.value : null;
           if (text3 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
-          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine));
+          const expanded = expandEnv(text3, env, (name2) => fail3(`environment variable ${name2} is not set (used in auth of "${raw}"). ${SET_IT}`, iLine));
           const parsed = parseCredential(expanded);
           if (!parsed.ok) {
             if (parsed.reason === "format") throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
@@ -525,13 +525,13 @@ function parseConfig(text2, file = CONFIG_FILES[0], env = process.env) {
 function findConfig(cwd) {
   let dir = cwd;
   for (; ; ) {
-    const present = CONFIG_FILES.filter((f) => existsSync2(join3(dir, f)));
+    const present = CONFIG_FILES.filter((f) => existsSync2(join4(dir, f)));
     if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" and ")} in the same folder. Delete one of them.`, void 0, "");
     if (present.length === 1) {
-      const path = join3(dir, present[0]);
-      return { path, tunnels: parseConfig(readFileSync2(path, "utf8"), present[0]) };
+      const path = join4(dir, present[0]);
+      return { path, tunnels: parseConfig(readFileSync3(path, "utf8"), present[0], configEnv(dir)) };
     }
-    if (existsSync2(join3(dir, ".git"))) return null;
+    if (existsSync2(join4(dir, ".git"))) return null;
     const up = dirname2(dir);
     if (up === dir) return null;
     dir = up;
@@ -561,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.7.0",
+    cliVersion: "1.8.1",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -1729,7 +1729,7 @@ function redirectIssues(r, ctx) {
       {
         level: "warn",
         title: "Redirect drops to http",
-        detail: `Location is ${location}. duto.dev only serves https, so the browser takes an extra hop and loses POST bodies. Have the app trust X-Forwarded-Proto.`
+        detail: `Location is ${location}. Duto tunnels only serve https, so the browser takes an extra hop and loses POST bodies. Have the app trust X-Forwarded-Proto.`
       }
     ];
   }
@@ -2246,7 +2246,6 @@ function sameHostOrigin(h) {
   return host !== "" && bareHost(host) === bareHost(h.host ?? "");
 }
 var TunnelAuth = class {
-  qrUser;
   tunnel;
   credentials;
   allow;
@@ -2260,9 +2259,16 @@ var TunnelAuth = class {
     this.allow = o.allow;
     this.now = o.now ?? Date.now;
     this.secret = o.secret ?? randomBytes2(32);
-    this.qrUser = o.credentials[0]?.user ?? "";
     this.failures = new FailedAttempts(this.now);
   }
+  get qrUser() {
+    return this.credentials[0]?.user ?? "";
+  }
+  update(o) {
+    if (o.credentials[0]?.user !== this.qrUser) this.qr = null;
+    this.credentials = o.credentials;
+    this.allow = o.allow;
+  }
   access(h) {
     if (this.allow) {
       const ip = first2(h["cf-connecting-ip"]);
@@ -2653,7 +2659,9 @@ async function authRoute(req, res, route, auth) {
   };
   const { pathname } = url;
   if (pathname === LOGIN_PATH && req.method === "GET") {
-    page(200, safeNext(url.searchParams.get("next")), null);
+    const next = safeNext(url.searchParams.get("next"));
+    if (auth.access(req.headers).kind !== "denied") go(next);
+    else page(200, next, null);
     return true;
   }
   if (pathname === LOGIN_PATH && req.method === "POST") {
@@ -2983,9 +2991,9 @@ async function startProxy(o) {
 
 // src/session/orphans.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
-var fileOf = (dir, cfPid) => join4(dir, `cloudflared-${cfPid}.json`);
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+var fileOf = (dir, cfPid) => join5(dir, `cloudflared-${cfPid}.json`);
 function recordCloudflared(dir, cfPid, sessionPid = process.pid) {
   try {
     mkdirSync3(dir, { recursive: true });
@@ -3007,7 +3015,7 @@ var realProc = {
   },
   isCloudflared(pid) {
     try {
-      if (process.platform === "linux") return readFileSync3(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
+      if (process.platform === "linux") return readFileSync4(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
       if (process.platform === "darwin") return spawnSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8" }).stdout.includes("cloudflared");
     } catch {
       return false;
@@ -3026,10 +3034,10 @@ function reapOrphans(dir, proc = realProc) {
   let killed = 0;
   for (const name of readdirSync(dir)) {
     if (!/^cloudflared-\d+\.json$/.test(name)) continue;
-    const path = join4(dir, name);
+    const path = join5(dir, name);
     let rec;
     try {
-      rec = JSON.parse(readFileSync3(path, "utf8"));
+      rec = JSON.parse(readFileSync4(path, "utf8"));
     } catch {
       rmSync2(path, { force: true });
       continue;
@@ -3113,6 +3121,10 @@ var Session = class {
   routes = /* @__PURE__ */ new Map();
   specs = /* @__PURE__ */ new Map();
   persistentAuths = /* @__PURE__ */ new Map();
+  allows = /* @__PURE__ */ new Map();
+  config = { error: null, warnings: [], reloads: 0 };
+  applying = Promise.resolve();
+  background = /* @__PURE__ */ new Set();
   proxy = null;
   child = null;
   token = null;
@@ -3124,7 +3136,7 @@ var Session = class {
   listeners = /* @__PURE__ */ new Set();
   snapshot = null;
   getState() {
-    this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })) };
+    this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })), config: { ...this.config } };
     return this.snapshot;
   }
   subscribe(fn) {
@@ -3136,12 +3148,17 @@ var Session = class {
     this.proxy = await startProxy({ routes: this.routes, store: this.records });
     this.tunnels = specs.map((s) => this.blank(s, false));
     this.emit();
+    const opening = this.openAll();
+    this.applying = opening.catch(() => void 0);
+    await opening;
+    const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
+    this.timer = setInterval(() => void this.beat(), every);
+  }
+  async openAll() {
     const me = await this.o.api.me().catch(() => null);
     if (me) this.account = me.username ?? me.email;
     const existing = await this.o.api.endpoints().catch(() => []);
-    for (const t of this.tunnels) await this.open(t, existing);
-    const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
-    this.timer = setInterval(() => void this.beat(), every);
+    await Promise.all([...this.tunnels].map((t) => this.open(t, existing)));
   }
   async add(spec) {
     if (this.tunnels.some((t2) => t2.key === keyOf(spec))) return;
@@ -3151,6 +3168,106 @@ var Session = class {
     const existing = await this.o.api.endpoints().catch(() => []);
     await this.open(t, existing);
   }
+  apply(specs) {
+    const run = this.applying.then(() => this.reconcile(specs));
+    this.applying = run.catch(() => void 0);
+    return run;
+  }
+  async settled() {
+    await this.applying;
+    while (this.background.size) await Promise.all([...this.background]);
+  }
+  inBackground(work) {
+    const run = work().catch(() => void 0);
+    this.background.add(run);
+    void run.finally(() => this.background.delete(run));
+  }
+  configFailed(error) {
+    this.config = { ...this.config, error };
+    this.emit();
+  }
+  async reconcile(specs) {
+    if (this.stopped) return;
+    const wanted = new Set(specs.map(keyOf));
+    for (const t of this.tunnels.filter((x) => !x.adHoc && !wanted.has(x.key))) this.remove(t);
+    const fresh = [];
+    for (const spec of specs) {
+      if (this.stopped) return;
+      const t = this.tunnels.find((x) => x.key === keyOf(spec));
+      if (t) {
+        await this.update(t, spec);
+        continue;
+      }
+      const added = this.blank(spec, false);
+      this.tunnels.push(added);
+      fresh.push(added);
+    }
+    if (fresh.length) this.inBackground(() => this.openFresh(fresh));
+    this.config = { error: null, warnings: credentialWarnings(specs), reloads: this.config.reloads + 1 };
+    this.emit();
+  }
+  async openFresh(tunnels) {
+    const existing = await this.o.api.endpoints().catch(() => []);
+    await Promise.all(tunnels.filter((t) => !this.gone(t)).map((t) => this.open(t, existing)));
+  }
+  remove(t) {
+    this.tunnels = this.tunnels.filter((x) => x !== t);
+    this.forget(t);
+    this.emit();
+    const endpointId = t.endpointId;
+    if (endpointId) this.inBackground(async () => void await withTimeout(this.o.api.closeTunnel(endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS));
+  }
+  forget(t) {
+    if (t.hostname) this.routes.delete(t.hostname.toLowerCase());
+    this.specs.delete(t.key);
+    this.persistentAuths.delete(t.key);
+    this.allows.delete(t.key);
+  }
+  async update(t, spec) {
+    const before = JSON.stringify(this.specs.get(t.key));
+    const changed = before !== JSON.stringify(spec);
+    const portChanged = t.port !== spec.port;
+    this.specs.set(t.key, spec);
+    const runtime = { url: t.url, hostname: t.hostname, endpointId: t.endpointId, status: t.status, error: t.error, requests: t.requests, errors: t.errors };
+    for (const k of Object.keys(t)) delete t[k];
+    Object.assign(t, this.describe(spec), { adHoc: false }, runtime);
+    const auth = await this.refreshAuth(t.key);
+    if (t.status === "failed") {
+      if (changed) this.inBackground(() => this.open(t, null));
+      return;
+    }
+    if (t.hostname) this.routes.set(t.hostname.toLowerCase(), this.routeOf(t, auth));
+    this.emit();
+    if (portChanged && t.endpointId) this.inBackground(() => this.open(t, null));
+  }
+  routeOf(t, auth) {
+    return { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth };
+  }
+  async allowFor(key, spec) {
+    if (!spec.allow?.length) {
+      this.allows.delete(key);
+      return void 0;
+    }
+    const entries = JSON.stringify(spec.allow);
+    const cached = this.allows.get(key);
+    if (cached?.entries === entries) return cached.list;
+    const list = await (this.o.resolveAllow ?? resolveAllow)(spec.allow);
+    this.allows.set(key, { entries, list });
+    return list;
+  }
+  async refreshAuth(key) {
+    const spec = this.specs.get(key);
+    const existing = this.persistentAuths.get(key);
+    if (!spec?.auth?.length) {
+      this.persistentAuths.delete(key);
+      this.allows.delete(key);
+      return void 0;
+    }
+    const allow = await this.allowFor(key, spec);
+    if (!existing) return this.authFor(key);
+    existing.update({ credentials: spec.auth, allow });
+    return existing;
+  }
   qrLink(key) {
     const t = this.tunnels.find((x) => x.key === key);
     if (!t?.url) return null;
@@ -3167,7 +3284,7 @@ var Session = class {
     if (existing) return existing;
     const spec = this.specs.get(key);
     if (!spec?.auth?.length) return void 0;
-    const allow = spec.allow?.length ? await (this.o.resolveAllow ?? resolveAllow)(spec.allow) : void 0;
+    const allow = await this.allowFor(key, spec);
     const auth = new TunnelAuth({ tunnel: key, credentials: spec.auth, allow });
     this.persistentAuths.set(key, auth);
     return auth;
@@ -3188,7 +3305,13 @@ var Session = class {
   }
   blank(spec, adHoc) {
     this.specs.set(keyOf(spec), spec);
-    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+    return { ...this.describe(spec), url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+  }
+  describe(spec) {
+    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.trustForwarded ? { trustForwarded: true } : {}, ...spec.auth?.length ? { auth: true } : {} };
+  }
+  gone(t) {
+    return this.stopped || !this.tunnels.includes(t);
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
@@ -3204,12 +3327,12 @@ var Session = class {
         ...t.name ? { name: t.name } : {},
         proxyPort: this.proxy.port
       });
-      if (this.stopped) {
+      if (this.gone(t)) {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
       const auth = await this.authFor(t.key);
-      if (this.stopped) {
+      if (this.gone(t)) {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
@@ -3217,7 +3340,7 @@ var Session = class {
       t.hostname = res.hostname;
       t.endpointId = res.endpointId;
       t.error = null;
-      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, trustForwarded: t.trustForwarded, auth });
+      this.routes.set(res.hostname.toLowerCase(), this.routeOf(t, auth));
       t.status = await isPortListening(t.port) ? "live" : "no-listener";
       this.ensureCloudflared(res.tunnelToken);
       this.emit();
@@ -3334,39 +3457,60 @@ var Session = class {
   }
 };
 
-// src/ui/plain.ts
-function runPlain(session, out) {
-  const announced = /* @__PURE__ */ new Set();
-  const failed = /* @__PURE__ */ new Set();
-  const printed = /* @__PURE__ */ new Set();
-  const onState = () => {
-    for (const t of session.getState().tunnels) {
-      if ((t.status === "live" || t.status === "no-listener") && t.url && !announced.has(t.key)) {
-        announced.add(t.key);
-        out(`${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`);
-      }
-      if (t.status === "failed" && t.error && !failed.has(t.key)) {
-        failed.add(t.key);
-        out(`${paint("err", "\u2716")} ${t.key}  ${t.error}`);
-      }
+// src/session/watch.ts
+import { readFileSync as readFileSync5, watch } from "fs";
+import { basename, dirname as dirname3, join as join6 } from "path";
+var RELOAD_DEBOUNCE_MS = 150;
+function readText(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function watchConfig(o) {
+  const file = basename(o.path);
+  const dir = dirname3(o.path);
+  const watched = /* @__PURE__ */ new Set([file, ...ENV_FILES]);
+  const snapshot = () => [readText(o.path), ...ENV_FILES.map((f) => readText(join6(dir, f)))].join("\0");
+  let lastSeen = snapshot();
+  let timer = null;
+  const reload = () => {
+    timer = null;
+    let text2;
+    let seen;
+    try {
+      text2 = readText(o.path);
+      seen = snapshot();
+    } catch (err) {
+      return o.onError(`${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
-  };
-  const onRecords = () => {
-    for (const r of [...session.records.list()].reverse()) {
-      if (printed.has(r.id) || r.status === null || r.durationMs === null) continue;
-      printed.add(r.id);
-      const method = r.websocket ? "WS" : r.method;
-      out(
-        `${formatTime(r.startedAt)}  ${r.tunnel.padEnd(8)}  ${method} ${r.path}  ${paint(statusColor(r.status), String(r.status))}  ${formatDuration(r.durationMs)}  ${formatBytes(r.bytes)}${r.redirect ? `  ${paint("signal", `\u21AA Location rewritten to ${r.redirect.to}`)}` : ""}`
-      );
+    if (seen === lastSeen) return;
+    lastSeen = seen;
+    if (text2 === null) return o.onError(`${file} was deleted.`);
+    let specs;
+    try {
+      specs = parseConfig(text2, file, configEnv(dir));
+    } catch (err) {
+      if (err instanceof ConfigError) return o.onError(err.message);
+      return o.onError(`${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    o.onChange(specs);
   };
-  const offState = session.subscribe(onState);
-  const offRecords = session.records.subscribe(onRecords);
-  onState();
-  return () => {
-    offState();
-    offRecords();
+  const schedule = () => {
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(reload, o.debounceMs ?? RELOAD_DEBOUNCE_MS);
+  };
+  const watcher = watch(dir, (_event, name) => {
+    if (name === null || watched.has(name)) schedule();
+  });
+  watcher.on("error", () => void 0);
+  return {
+    close() {
+      if (timer) clearTimeout(timer);
+      watcher.close();
+    }
   };
 }
 
@@ -3416,7 +3560,7 @@ function wantsUi(flags) {
   if (process.platform === "win32") return process.argv.includes("--ui");
   return true;
 }
-async function runSession(specs, source, flags) {
+async function runSession(specs, source, flags, configPath) {
   const config = loadConfig();
   if (!config.authtoken) fail2(LOGIN_HINT);
   const api = createApiClient({ baseUrl: apiUrl(), token: config.authtoken });
@@ -3427,7 +3571,7 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join5(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join7(dutoHome(), "run") });
   let inspector = null;
   let inspectorError;
   if (flags.inspect !== false) {
@@ -3438,9 +3582,11 @@ async function runSession(specs, source, flags) {
     }
   }
   const warnings = credentialWarnings(specs);
+  const watcher = configPath ? watchConfig({ path: configPath, onChange: (next) => void session.apply(next).catch((err) => session.configFailed(err instanceof Error ? err.message : String(err))), onError: (error) => session.configFailed(error) }) : null;
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-ZNFUDV2B.js");
+    const { runFullscreen } = await import("./fullscreen-Q3RGW6NJ.js");
     const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
+    watcher?.close();
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
@@ -3463,6 +3609,7 @@ async function runSession(specs, source, flags) {
   });
   await Promise.race([session.start(specs), stopped]);
   await stopped;
+  watcher?.close();
   stopLog();
   await session.stop();
   await inspector?.close().catch(() => void 0);
@@ -3490,7 +3637,7 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
 `);
       process.exit(0);
     }
-    return runSession(found.tunnels, relative(process.cwd(), found.path) || "duto.yml", flags);
+    return runSession(found.tunnels, relative(process.cwd(), found.path) || "duto.yml", flags, found.path);
   }
   const port = parsePort(rawPort);
   const name = parseName(flags.name) ?? null;
@@ -3503,7 +3650,7 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
   return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "command line", flags);
 }
 var cli = cac("duto");
-cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.dev)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
+cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.page)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
 cli.command("http <port>", "Same as duto <port> (for people coming from ngrok)").option("--name <name>", "Fixed address name").option("--host <host>", "Host the local service receives instead of the public one").option("--no-rewrite-redirects", "With --host: keep redirects as the service sent them").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
 cli.command("login [token]", "Log in through the browser, or save an authtoken").action(async (token) => {
   try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.7.0",
-  "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
+  "version": "1.8.1",
+  "description": "Expose a local port at https://<name>-<user>.duto.page with one command.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -29,6 +29,7 @@
   },
   "dependencies": {
     "cac": "^6.7.14",
+    "dotenv": "17.4.2",
     "ink": "^5.2.1",
     "qrcode-generator": "^1.5.2",
     "react": "^18.3.1",