void 0.10.13 → 0.20.1

package/dist/auth-W9WII-mN.mjs

@@ -0,0 +1,630 @@
+import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { n as dirname, o as join } from "./dist-BrsS7cai.mjs";
+import { G as normalizePlatformApiUrl, K as platformCredentialAccount, V as getActivePlatformConnection, W as listPlatformConnections, at as readKeyringPassword, it as deleteKeyringPassword, ot as writeKeyringPassword } from "./output-tFQLLj26.mjs";
+import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
+import { t as ensureCloudflaredToken } from "./cf-access-DsSsZUPr.mjs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+import { homedir } from "node:os";
+import { normalizeApplicationDomain } from "@void/platform";
+//#region src/shared/proxy.ts
+const DEFAULT_PROXY_URL = "https://proxy.void.cloud";
+const STAGING_PROXY_URL = "https://proxy.staging.void.cloud";
+//#endregion
+//#region src/cli/hosted-platform.ts
+const VOID_CLOUD_PLATFORM = Object.freeze({
+	apiUrl: "https://api.void.cloud",
+	applicationDomain: "void.app",
+	displayName: "Void Cloud",
+	proxyUrl: "https://proxy.void.cloud"
+});
+const VOID_CLOUD_STAGING_PLATFORM = Object.freeze({
+	apiUrl: "https://api.staging.void.cloud",
+	applicationDomain: "staging.void.app",
+	displayName: "Void Cloud staging",
+	proxyUrl: "https://proxy.staging.void.cloud"
+});
+const HOSTED_PLATFORMS = [VOID_CLOUD_PLATFORM, VOID_CLOUD_STAGING_PLATFORM];
+function hostedPlatformForApiUrl(apiUrl) {
+	if (typeof apiUrl !== "string") return null;
+	let normalized;
+	try {
+		const parsed = new URL(apiUrl);
+		if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "") return null;
+		normalized = parsed.origin;
+	} catch {
+		return null;
+	}
+	return HOSTED_PLATFORMS.find((platform) => platform.apiUrl === normalized) ?? null;
+}
+/** Resolve an old ~/.void/config.json selection without returning credential values. */
+function readLegacyHostedPlatformSelection(configPath = join(homedir(), ".void", "config.json")) {
+	let value = {};
+	try {
+		value = JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {
+		return null;
+	}
+	if (value.api !== void 0) {
+		const platform = hostedPlatformForApiUrl(value.api);
+		return platform ? {
+			...platform,
+			source: "configured-api"
+		} : null;
+	}
+	if (typeof value.token === "string" && value.token !== "") return {
+		...VOID_CLOUD_PLATFORM,
+		source: "legacy-credential"
+	};
+	if (typeof value.stagingToken === "string" && value.stagingToken !== "") return {
+		...VOID_CLOUD_STAGING_PLATFORM,
+		source: "legacy-credential"
+	};
+	return null;
+}
+//#endregion
+//#region src/cli/project.ts
+var project_exports = /* @__PURE__ */ __exportAll({
+	attachSelectedPlatform: () => attachSelectedPlatform,
+	isLegacyVoidCloudProject: () => isLegacyVoidCloudProject,
+	isVoidInternalStaging: () => isVoidInternalStaging,
+	readDeploymentPlatform: () => readDeploymentPlatform,
+	readProjectApplicationDomain: () => readProjectApplicationDomain,
+	readProjectConfig: () => readProjectConfig,
+	readProjectPlatformUrl: () => readProjectPlatformUrl,
+	removeProjectConfig: () => removeProjectConfig,
+	writeDeploymentPlatform: () => writeDeploymentPlatform,
+	writePlatformSelection: () => writePlatformSelection,
+	writeProjectConfig: () => writeProjectConfig
+});
+const PROJECT_FILE = ".void/project.json";
+function readProjectConfigFile(root) {
+	const filePath = join(root, PROJECT_FILE);
+	try {
+		const raw = readFileSync(filePath, "utf-8");
+		const config = JSON.parse(raw);
+		if (typeof config !== "object" || config === null || Array.isArray(config)) return null;
+		return config;
+	} catch {
+		return null;
+	}
+}
+/**
+* Read the project config from the project root.
+* Returns null if no project.json exists.
+* A file containing only internal metadata is not treated as a linked project.
+*/
+function readProjectConfig(root) {
+	const config = readProjectConfigFile(root);
+	if (!config || typeof config.projectId !== "string" || typeof config.slug !== "string") return null;
+	const result = {
+		projectId: config.projectId,
+		slug: config.slug
+	};
+	if (typeof config.platformUrl === "string") result.platformUrl = normalizePlatformApiUrl(config.platformUrl);
+	if (typeof config.applicationDomain === "string") result.applicationDomain = normalizeApplicationDomain(config.applicationDomain);
+	if (typeof config.proxyUrl === "string") result.proxyUrl = normalizePlatformApiUrl(config.proxyUrl);
+	if (config.voidInternalStaging === true) result.voidInternalStaging = true;
+	return result;
+}
+/**
+* Read the deployment platform selected during `void init`.
+*
+* Linked project files created before the platform field existed implicitly
+* target Void. A metadata-only file has no deployment preference.
+*/
+function readDeploymentPlatform(root) {
+	const config = readProjectConfigFile(root);
+	if (!config) return null;
+	if (config.platform === "cloudflare" || config.platform === "void" || config.platform === "none") return config.platform;
+	if (typeof config.projectId === "string" && typeof config.slug === "string") return "void";
+	return null;
+}
+/**
+* Persist a deployment preference without discarding an existing Void project
+* link. Keeping the link makes switching back to Void non-destructive.
+*/
+function writeDeploymentPlatform(root, platform) {
+	const filePath = join(root, PROJECT_FILE);
+	const existing = readProjectConfigFile(root);
+	const next = { platform };
+	if (typeof existing?.projectId === "string") next.projectId = existing.projectId;
+	if (typeof existing?.platformUrl === "string") next.platformUrl = existing.platformUrl;
+	if (typeof existing?.applicationDomain === "string") next.applicationDomain = existing.applicationDomain;
+	if (typeof existing?.proxyUrl === "string") next.proxyUrl = existing.proxyUrl;
+	if (typeof existing?.slug === "string") next.slug = existing.slug;
+	if (existing?.voidInternalStaging === true) next.voidInternalStaging = true;
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+}
+/** Select a verified platform without changing an existing project link. */
+function writePlatformSelection(root, connection) {
+	const existing = readProjectConfigFile(root);
+	const linked = readProjectConfig(root);
+	const pinnedUrl = isVoidInternalStaging(root) ? VOID_CLOUD_STAGING_PLATFORM.apiUrl : linked ? linked.platformUrl ?? VOID_CLOUD_PLATFORM.apiUrl : null;
+	if (pinnedUrl && pinnedUrl !== connection.apiUrl) return false;
+	const filePath = join(root, PROJECT_FILE);
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, JSON.stringify({
+		...existing,
+		platform: "void",
+		platformUrl: normalizePlatformApiUrl(connection.apiUrl),
+		applicationDomain: normalizeApplicationDomain(connection.applicationDomain),
+		proxyUrl: normalizePlatformApiUrl(connection.proxyUrl)
+	}, null, 2) + "\n");
+	return true;
+}
+/**
+* Internal-only platform developers' staging switch.
+* This intentionally lives with the project link state, not public void.json.
+*/
+function isVoidInternalStaging(root) {
+	return readProjectConfigFile(root)?.voidInternalStaging === true;
+}
+function readProjectPlatformUrl(root) {
+	const value = readProjectConfigFile(root)?.platformUrl;
+	return typeof value === "string" && value !== "" ? normalizePlatformApiUrl(value) : null;
+}
+function readProjectApplicationDomain(root) {
+	const value = readProjectConfigFile(root)?.applicationDomain;
+	return typeof value === "string" && value !== "" ? normalizeApplicationDomain(value) : null;
+}
+/** Resolve the immutable platform identity that every newly linked project records. */
+function attachSelectedPlatform(root, config, platformApiUrl) {
+	const apiUrl = normalizePlatformApiUrl(platformApiUrl);
+	const hosted = hostedPlatformForApiUrl(apiUrl);
+	if (hosted) return {
+		...config,
+		applicationDomain: hosted.applicationDomain,
+		platformUrl: hosted.apiUrl,
+		proxyUrl: hosted.proxyUrl,
+		...isVoidInternalStaging(root) && hosted.apiUrl === VOID_CLOUD_STAGING_PLATFORM.apiUrl ? { voidInternalStaging: true } : {}
+	};
+	const connection = listPlatformConnections().find((entry) => entry.apiUrl === apiUrl);
+	if (connection?.applicationDomain && connection.proxyUrl) return {
+		...config,
+		applicationDomain: connection.applicationDomain,
+		platformUrl: connection.apiUrl,
+		proxyUrl: connection.proxyUrl
+	};
+	throw new Error(`platform: No verified metadata is registered for ${apiUrl}. Run \`void connect ${apiUrl}\` before linking a project.`);
+}
+function isLegacyVoidCloudProject(root) {
+	const config = readProjectConfigFile(root);
+	return typeof config?.projectId === "string" && typeof config.slug === "string" && typeof config.platformUrl !== "string";
+}
+/**
+* Write the project config to the project root.
+*/
+function writeProjectConfig(root, config) {
+	const filePath = join(root, PROJECT_FILE);
+	const existing = readProjectConfigFile(root);
+	const next = {
+		platform: "void",
+		projectId: config.projectId,
+		slug: config.slug
+	};
+	if (config.platformUrl) next.platformUrl = normalizePlatformApiUrl(config.platformUrl);
+	else if (typeof existing?.platformUrl === "string") next.platformUrl = existing.platformUrl;
+	if (config.applicationDomain) next.applicationDomain = normalizeApplicationDomain(config.applicationDomain);
+	else if (typeof existing?.applicationDomain === "string") next.applicationDomain = existing.applicationDomain;
+	if (config.proxyUrl) next.proxyUrl = normalizePlatformApiUrl(config.proxyUrl);
+	else if (typeof existing?.proxyUrl === "string") next.proxyUrl = existing.proxyUrl;
+	if (config.voidInternalStaging === true || existing?.voidInternalStaging === true) next.voidInternalStaging = true;
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+}
+/**
+* Remove the project config file. Returns true if removed, false if it didn't exist.
+*/
+function removeProjectConfig(root) {
+	const filePath = join(root, PROJECT_FILE);
+	try {
+		rmSync(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/cli/auth.ts
+var auth_exports = /* @__PURE__ */ __exportAll({
+	awaitBrowserCallback: () => awaitBrowserCallback,
+	createCodeChallenge: () => createCodeChallenge,
+	createCodeVerifier: () => createCodeVerifier,
+	getApiUrl: () => getApiUrl,
+	getProxyUrl: () => getProxyUrl,
+	getSiteDomain: () => getSiteDomain,
+	getToken: () => getToken,
+	getTokenSource: () => getTokenSource,
+	isStagingMode: () => isStagingMode,
+	openBrowser: () => openBrowser,
+	readPlatformToken: () => readPlatformToken,
+	removeToken: () => removeToken,
+	runLogin: () => runLogin,
+	runPlatformLogin: () => runPlatformLogin,
+	savePlatformToken: () => savePlatformToken,
+	saveToken: () => saveToken
+});
+const CONFIG_DIR = join(homedir(), ".void");
+const CONFIG_PATH = join(CONFIG_DIR, "config.json");
+const KEYRING_SERVICE = "dev.void.cli";
+function keyringGet(account) {
+	return readKeyringPassword(KEYRING_SERVICE, account);
+}
+function keyringSet(account, password) {
+	return writeKeyringPassword(KEYRING_SERVICE, account, password);
+}
+function keyringDelete(account) {
+	return deleteKeyringPassword(KEYRING_SERVICE, account);
+}
+function readConfig() {
+	try {
+		return JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+	} catch {
+		return {};
+	}
+}
+function writeConfig(config) {
+	mkdirSync(CONFIG_DIR, { recursive: true });
+	writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+}
+function isStagingMode(root = process.cwd()) {
+	return isVoidInternalStaging(root);
+}
+function getSiteDomain(root = process.cwd()) {
+	const legacySelection = readLegacyHostedPlatformSelection();
+	const domain = readProjectApplicationDomain(root) ?? (isStagingMode(root) ? VOID_CLOUD_STAGING_PLATFORM.applicationDomain : void 0) ?? (isLegacyVoidCloudProject(root) || process.env.VOID_TOKEN && process.env.VOID_API_URL === void 0 ? VOID_CLOUD_PLATFORM.applicationDomain : void 0) ?? getActivePlatformConnection()?.applicationDomain ?? legacySelection?.applicationDomain;
+	if (!domain) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
+	return domain;
+}
+/**
+* Read the deploy token.
+* Priority: origin-bound VOID_TOKEN > system keychain > migrated config.
+* An unscoped environment token retains its historical Void Cloud destination.
+*/
+function getToken(root = process.cwd()) {
+	const envToken = process.env.VOID_TOKEN;
+	let apiUrl;
+	try {
+		apiUrl = getApiUrl(root);
+	} catch (error) {
+		if (envToken) throw error;
+		return null;
+	}
+	if (envToken) {
+		const tokenOrigin = process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL;
+		if (apiUrl !== tokenOrigin) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
+		return envToken;
+	}
+	const account = platformCredentialAccount(apiUrl);
+	const keyringToken = keyringGet(account);
+	if (keyringToken) return keyringToken;
+	const config = readConfig();
+	const normalizedApiUrl = normalizePlatformApiUrl(apiUrl);
+	const fileToken = config.tokens?.[normalizedApiUrl];
+	if (fileToken) {
+		if (keyringSet(account, fileToken)) {
+			delete config.tokens[normalizedApiUrl];
+			if (Object.keys(config.tokens).length === 0) delete config.tokens;
+			try {
+				writeConfig(config);
+			} catch {}
+		}
+		return fileToken;
+	}
+	const legacyAccount = legacyCredentialAccount(root, normalizedApiUrl, config);
+	if (legacyAccount) {
+		const legacyKeyringToken = keyringGet(legacyAccount);
+		if (legacyKeyringToken) {
+			keyringSet(account, legacyKeyringToken);
+			return legacyKeyringToken;
+		}
+	}
+	if (!legacyAccount) return null;
+	const legacyFileToken = config[legacyAccount];
+	if (legacyFileToken) {
+		if (keyringSet(account, legacyFileToken)) {
+			config.api ??= normalizedApiUrl;
+			delete config[legacyAccount];
+			try {
+				writeConfig(config);
+			} catch {}
+		}
+		return legacyFileToken;
+	}
+	return null;
+}
+function getTokenSource() {
+	return process.env.VOID_TOKEN ? "ci" : "manual";
+}
+function saveToken(token, root = process.cwd(), dependencies = {}) {
+	savePlatformToken(token, getApiUrl(root), dependencies);
+}
+function readPlatformToken(apiUrl) {
+	return keyringGet(platformCredentialAccount(normalizePlatformApiUrl(apiUrl)));
+}
+function savePlatformToken(token, origin, dependencies = {}) {
+	const apiUrl = normalizePlatformApiUrl(origin);
+	const account = platformCredentialAccount(apiUrl);
+	if ((dependencies.keyringSet ?? keyringSet)(account, token)) return;
+	throw new Error("auth: The system keychain is unavailable. Refusing to store your platform token in plaintext. Configure a system keychain, or set VOID_TOKEN from a secret manager in headless environments.");
+}
+function removeToken(root = process.cwd()) {
+	const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
+	const account = platformCredentialAccount(apiUrl);
+	let removed = false;
+	if (keyringDelete(account)) removed = true;
+	try {
+		const config = readConfig();
+		let configChanged = false;
+		const legacyAccount = legacyCredentialAccount(root, apiUrl, config);
+		if (legacyAccount && keyringDelete(legacyAccount)) removed = true;
+		if (legacyAccount && config[legacyAccount]) {
+			delete config[legacyAccount];
+			configChanged = true;
+			removed = true;
+		}
+		if (config.tokens?.[apiUrl]) {
+			delete config.tokens[apiUrl];
+			if (Object.keys(config.tokens).length === 0) delete config.tokens;
+			configChanged = true;
+			removed = true;
+		}
+		if (configChanged) writeConfig(config);
+	} catch {}
+	return removed;
+}
+const DEFAULT_API_URL = VOID_CLOUD_PLATFORM.apiUrl;
+const STAGING_API_URL = VOID_CLOUD_STAGING_PLATFORM.apiUrl;
+function legacyCredentialAccount(root, normalizedApiUrl, config) {
+	const account = isStagingMode(root) ? "stagingToken" : "token";
+	let configuredUrl;
+	try {
+		configuredUrl = normalizePlatformApiUrl(config.api ?? (isStagingMode(root) ? STAGING_API_URL : DEFAULT_API_URL));
+	} catch {
+		return null;
+	}
+	return configuredUrl === normalizedApiUrl ? account : null;
+}
+function base64Url(buffer) {
+	return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function createCodeVerifier() {
+	return base64Url(randomBytes(32));
+}
+function createCodeChallenge(verifier) {
+	return base64Url(createHash("sha256").update(verifier).digest());
+}
+async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
+	const base = apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
+	ensureCloudflaredToken(apiUrl);
+	const res = await fetch(new URL("auth/cli/token", base), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...cfAccessHeaders(process.env, apiUrl)
+		},
+		body: JSON.stringify({
+			code,
+			state,
+			code_verifier: codeVerifier
+		})
+	});
+	if (!res.ok) throw new Error(`auth: Failed to exchange login code (${res.status}). Try logging in again.`);
+	let body;
+	try {
+		body = await res.json();
+	} catch {
+		throw new Error("auth: Login code exchange returned an invalid response.");
+	}
+	if (!body || typeof body !== "object" || !("token" in body) || typeof body.token !== "string" || body.token.length === 0) throw new Error("auth: Login code exchange did not return a token.");
+	return body.token;
+}
+/**
+* Read the API URL from environment or config file.
+* Priority: VOID_API_URL env var > ~/.void/config.json > default
+*/
+function getApiUrl(root = process.cwd()) {
+	if (process.env.VOID_API_URL) return normalizePlatformApiUrl(process.env.VOID_API_URL);
+	if (isStagingMode(root)) return STAGING_API_URL;
+	const projectApiUrl = readProjectPlatformUrl(root);
+	if (projectApiUrl) {
+		if (projectApiUrl === DEFAULT_API_URL || projectApiUrl === STAGING_API_URL) return projectApiUrl;
+		if (listPlatformConnections().some((connection) => connection.apiUrl === projectApiUrl)) return projectApiUrl;
+		throw new Error(`platform: Project metadata selected unverified platform ${projectApiUrl}. Connect to it explicitly with \`void connect ${projectApiUrl}\` before forwarding credentials.`);
+	}
+	const config = readConfig();
+	const legacySelection = readLegacyHostedPlatformSelection();
+	let apiUrl = (isLegacyVoidCloudProject(root) ? DEFAULT_API_URL : void 0) ?? getActivePlatformConnection()?.apiUrl ?? config.api ?? legacySelection?.apiUrl;
+	apiUrl ??= process.env.VOID_TOKEN ? DEFAULT_API_URL : void 0;
+	if (!apiUrl) {
+		apiUrl = keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : void 0;
+		if (apiUrl) try {
+			writeConfig({
+				...config,
+				api: apiUrl
+			});
+		} catch {}
+	}
+	if (!apiUrl) throw new Error("platform: No Void platform selected. Run `void connect <url>` or `void platform install` first.");
+	return normalizePlatformApiUrl(apiUrl);
+}
+function getProxyUrl(root = process.cwd()) {
+	if (process.env.VOID_PROXY_URL) return normalizePlatformApiUrl(process.env.VOID_PROXY_URL);
+	const apiUrl = normalizePlatformApiUrl(getApiUrl(root));
+	if (apiUrl === STAGING_API_URL) return STAGING_PROXY_URL;
+	if (apiUrl === DEFAULT_API_URL) return DEFAULT_PROXY_URL;
+	const proxyUrl = listPlatformConnections().find((connection) => connection.apiUrl === apiUrl)?.proxyUrl;
+	if (proxyUrl === null || proxyUrl === void 0) throw new Error(`platform: No verified proxy is registered for ${apiUrl}. Reconnect with \`void connect ${apiUrl}\` or set VOID_PROXY_URL explicitly.`);
+	return proxyUrl;
+}
+function page(title, message) {
+	return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${title} - Void</title>
+<style>:root{color-scheme:light dark}*{margin:0;padding:0;box-sizing:border-box}body{font-family:system-ui,-apple-system,sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#fafafa;color:#111}.card{text-align:center;padding:3rem}h1{font-size:1.5rem;font-weight:600;margin-bottom:.75rem}p{color:#666;font-size:1rem}@media (prefers-color-scheme:dark){body{background:#0a0a0a;color:#fafafa}p{color:#a3a3a3}}</style>
+</head><body><div class="card"><h1>${title}</h1><p>${message}</p></div></body></html>`;
+}
+function openBrowser(url, execFile) {
+	const ignore = () => {};
+	if (process.platform === "win32") {
+		execFile("rundll32.exe", ["url.dll,FileProtocolHandler", url], ignore);
+		return;
+	}
+	if (process.platform === "darwin") {
+		execFile("open", [url], ignore);
+		return;
+	}
+	if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) {
+		execFile("wslview", [url], (error) => {
+			if (error) execFile("rundll32.exe", ["url.dll,FileProtocolHandler", url], ignore);
+		});
+		return;
+	}
+	execFile("xdg-open", [url], ignore);
+}
+/**
+* Start a local HTTP callback server, open the browser to a caller-built
+* authorize URL, and wait for the redirect back to `http://localhost:PORT/callback`.
+*
+* The server validates the `state` it appended to the callback URL against the
+* incoming request, then runs the caller's `finalize` hook INSIDE the request
+* handler (so the browser only ever sees the success page after the underlying
+* exchange/link actually succeeded). On finalize success it renders the success
+* HTML and resolves with finalize's return value; on finalize failure it
+* renders the same "could not complete" failure page the login flow uses and
+* rejects with the thrown error. The server is always closed before settling.
+*
+* `onUrl` is invoked with the authorize URL once the local server is listening,
+* so callers can show the URL to the user as a manual fallback when the browser
+* fails to open (common on WSL2, headless SSH, Docker, etc.). To match the
+* login flow it fires immediately before the browser is opened.
+*
+* `execFile` is injectable so tests can avoid launching a real browser.
+*/
+async function awaitBrowserCallback(options) {
+	const http = await import("node:http");
+	const { state, buildAuthUrl, finalize, describeError, validate, onUrl } = options;
+	const timeoutMs = options.timeoutMs ?? 3e5;
+	const execFile = options.execFile ?? (await import("node:child_process")).execFile;
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			server.close();
+			reject(error);
+		};
+		const succeed = (result) => {
+			if (settled) return;
+			settled = true;
+			server.close();
+			resolve(result);
+		};
+		const server = http.createServer(async (req, res) => {
+			const url = new URL(req.url, `http://localhost`);
+			if (url.pathname !== "/callback") {
+				res.writeHead(404);
+				res.end("Not found");
+				return;
+			}
+			if (url.searchParams.get("state") !== state) {
+				res.writeHead(400, { "Content-Type": "text/html" });
+				res.end(page("Login failed", "Invalid login callback. Please try again."));
+				return;
+			}
+			const errorMessage = describeError?.(url.searchParams);
+			if (errorMessage) {
+				res.writeHead(403, { "Content-Type": "text/html" });
+				res.end(page("Login failed", errorMessage));
+				fail(new Error(errorMessage));
+				return;
+			}
+			const invalidMessage = validate?.(url.searchParams);
+			if (invalidMessage) {
+				res.writeHead(400, { "Content-Type": "text/html" });
+				res.end(page("Login failed", invalidMessage));
+				return;
+			}
+			let result;
+			try {
+				result = await finalize(url.searchParams);
+			} catch (err) {
+				if (settled) return;
+				res.writeHead(400, { "Content-Type": "text/html" });
+				res.end(page("Login failed", "Could not complete login. Please try again."));
+				fail(err instanceof Error ? err : /* @__PURE__ */ new Error("auth: Failed to complete login."));
+				return;
+			}
+			if (settled) return;
+			res.writeHead(200, { "Content-Type": "text/html" });
+			res.end(page("Login successful!", "You can close this tab and return to the terminal."));
+			succeed(result);
+		});
+		server.on("connection", (socket) => socket.unref());
+		server.listen(0, "127.0.0.1", async () => {
+			const addr = server.address();
+			if (!addr || typeof addr === "string") {
+				fail(/* @__PURE__ */ new Error("auth: Failed to start local callback server."));
+				return;
+			}
+			const port = addr.port;
+			const callback = new URL(`http://localhost:${port}/callback`);
+			callback.searchParams.set("state", state);
+			let authUrl;
+			try {
+				authUrl = await buildAuthUrl(callback);
+			} catch (err) {
+				fail(err instanceof Error ? err : /* @__PURE__ */ new Error("auth: Failed to build authorize URL."));
+				return;
+			}
+			onUrl?.(authUrl);
+			openBrowser(authUrl, execFile);
+		});
+		setTimeout(() => {
+			fail(/* @__PURE__ */ new Error("auth: Login timed out after 5 minutes. Try again."));
+		}, timeoutMs).unref();
+	});
+}
+/**
+* Start a local HTTP server, open the browser to the platform login page,
+* and wait for the OAuth callback with a short-lived code. The CLI exchanges
+* the code itself so the localhost callback never accepts bearer tokens.
+*
+* `onUrl` is invoked with the login URL once the local server is listening,
+* so callers can show the URL to the user as a manual fallback when the
+* browser fails to open (common on WSL2, headless SSH, Docker, etc.).
+*/
+async function runLogin(root = process.cwd(), provider = "github", onUrl) {
+	return runPlatformLogin(getApiUrl(root), provider, onUrl);
+}
+async function runPlatformLogin(origin, provider = "github", onUrl) {
+	const { execFile } = await import("node:child_process");
+	const apiUrl = normalizePlatformApiUrl(origin);
+	const state = randomBytes(32).toString("hex");
+	const codeVerifier = createCodeVerifier();
+	const codeChallenge = createCodeChallenge(codeVerifier);
+	return awaitBrowserCallback({
+		state,
+		execFile,
+		onUrl,
+		buildAuthUrl: (callback) => {
+			const loginUrl = new URL("auth/login", apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`);
+			loginUrl.searchParams.set("redirect", callback.href);
+			loginUrl.searchParams.set("provider", provider);
+			loginUrl.searchParams.set("code_challenge", codeChallenge);
+			loginUrl.searchParams.set("code_challenge_method", "S256");
+			return loginUrl.href;
+		},
+		describeError: (p) => p.get("error") === "signup_restricted" ? "Signup restricted: your email is not on the approved list for this environment." : null,
+		validate: (p) => {
+			if (p.has("token")) return "Invalid login callback. Please try again.";
+			if (!p.get("code")) return "No authorization code received. Please try again.";
+			return null;
+		},
+		finalize: (params) => exchangeLoginCode(apiUrl, params.get("code"), state, codeVerifier)
+	});
+}
+//#endregion
+export { writeDeploymentPlatform as C, STAGING_PROXY_URL as D, DEFAULT_PROXY_URL as E, removeProjectConfig as S, writeProjectConfig as T, saveToken as _, getApiUrl as a, readDeploymentPlatform as b, getToken as c, openBrowser as d, readPlatformToken as f, savePlatformToken as g, runPlatformLogin as h, createCodeVerifier as i, getTokenSource as l, runLogin as m, awaitBrowserCallback as n, getProxyUrl as o, removeToken as p, createCodeChallenge as r, getSiteDomain as s, auth_exports as t, isStagingMode as u, attachSelectedPlatform as v, writePlatformSelection as w, readProjectConfig as x, project_exports as y };

package/dist/{auth-cmd-BqsdZJp5.mjs → auth-cmd-CAH62yDU.mjs}

@@ -1,6 +1,7 @@
-import { T as log } from "./agents-CtgBYqld.mjs";
-import { f as getToken, g as removeToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
-import { n as runLoginCommand } from "./login-BT3H8PN3.mjs";
+import { D as log } from "./output-tFQLLj26.mjs";
+import { c as getToken, p as removeToken } from "./auth-W9WII-mN.mjs";
+import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { n as runLoginCommand } from "./login-pV69H-ZO.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/auth-cmd.ts
 async function runAuthCommand(root, args) {