void 0.20.0 → 0.20.2

package/README.md

@@ -9,6 +9,10 @@ See [Platform Administration](../../docs/guide/platform-administration.md) for a
 walkthrough and the [CLI reference](../../docs/reference/cli.md#operator-commands)
 for every command.
 
+Use `void platform config auth` to manage login methods and company signup.
+Cloudflare Access protection has separate create/connect controls. Users can
+link another enabled login to their account with `void auth link`.
+
 ## What It Covers
 
 - file-based API routes from `routes/`
@@ -58,7 +62,7 @@ export default defineConfig({
 - `void platform *` — list, select, inspect, install, recover, repair, upgrade, disable, and safely uninstall a company platform
 - `void deploy` — build and deploy to the saved Cloudflare or Void target
 - `void db *` — local DB and migration commands
-- `void project *` — target-aware status, logs, rollback, and managed-project operations
+- `void project *` — target-aware status, logs, rollback, managed-project operations, and scoped CI deploy credentials
 - `void secret *` / `void domain *` — target-aware Worker secrets and custom domains
 
 Runtime helpers include:

package/dist/{auth-W9WII-mN.mjs → auth-DPl6kck4.mjs}

@@ -1,8 +1,7 @@
 import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { n as dirname, o as join } from "./dist-BrsS7cai.mjs";
-import { G as normalizePlatformApiUrl, K as platformCredentialAccount, V as getActivePlatformConnection, W as listPlatformConnections, at as readKeyringPassword, it as deleteKeyringPassword, ot as writeKeyringPassword } from "./output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-DsSsZUPr.mjs";
+import { B as ensureCloudflaredToken, K as getActivePlatformConnection, X as normalizePlatformApiUrl, Y as listPlatformConnections, Z as platformCredentialAccount, dt as writeKeyringPassword, lt as deleteKeyringPassword, ut as readKeyringPassword } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
@@ -232,6 +231,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	awaitBrowserCallback: () => awaitBrowserCallback,
 	createCodeChallenge: () => createCodeChallenge,
 	createCodeVerifier: () => createCodeVerifier,
+	getAccountCredential: () => getAccountCredential,
 	getApiUrl: () => getApiUrl,
 	getProxyUrl: () => getProxyUrl,
 	getSiteDomain: () => getSiteDomain,
@@ -269,6 +269,22 @@ function writeConfig(config) {
 	mkdirSync(CONFIG_DIR, { recursive: true });
 	writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
 }
+function readOriginScopedToken(apiUrl, config) {
+	const normalizedApiUrl = normalizePlatformApiUrl(apiUrl);
+	const account = platformCredentialAccount(normalizedApiUrl);
+	const keyringToken = keyringGet(account);
+	if (keyringToken) return keyringToken;
+	const fileToken = config.tokens?.[normalizedApiUrl];
+	if (!fileToken) return null;
+	if (keyringSet(account, fileToken)) {
+		delete config.tokens[normalizedApiUrl];
+		if (Object.keys(config.tokens).length === 0) delete config.tokens;
+		try {
+			writeConfig(config);
+		} catch {}
+	}
+	return fileToken;
+}
 function isStagingMode(root = process.cwd()) {
 	return isVoidInternalStaging(root);
 }
@@ -292,28 +308,28 @@ function getToken(root = process.cwd()) {
 		if (envToken) throw error;
 		return null;
 	}
+	const config = readConfig();
+	return readTokenForOrigin(apiUrl, config, legacyCredentialAccount(root, apiUrl, config));
+}
+/** Account actions follow the selected connection, independently of application metadata. */
+function getAccountCredential() {
+	const config = readConfig();
+	const apiUrl = normalizePlatformApiUrl(process.env.VOID_API_URL || (process.env.VOID_TOKEN ? DEFAULT_API_URL : getActivePlatformConnection()?.apiUrl ?? config.api ?? readLegacyHostedPlatformSelection()?.apiUrl ?? (keyringGet("token") ? DEFAULT_API_URL : keyringGet("stagingToken") ? STAGING_API_URL : DEFAULT_API_URL)));
+	return {
+		apiUrl,
+		token: readTokenForOrigin(apiUrl, config, legacyCredentialAccountForMode(apiUrl === STAGING_API_URL, apiUrl, config))
+	};
+}
+function readTokenForOrigin(apiUrl, config, legacyAccount) {
+	const envToken = process.env.VOID_TOKEN;
 	if (envToken) {
-		const tokenOrigin = process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL;
-		if (apiUrl !== tokenOrigin) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
+		if (apiUrl !== (process.env.VOID_API_URL ? normalizePlatformApiUrl(process.env.VOID_API_URL) : DEFAULT_API_URL)) throw new Error(`auth: VOID_TOKEN is not bound to ${apiUrl}. Set VOID_API_URL to this platform's URL with its matching token, or unset VOID_TOKEN to use the saved login.`);
 		return envToken;
 	}
-	const account = platformCredentialAccount(apiUrl);
-	const keyringToken = keyringGet(account);
-	if (keyringToken) return keyringToken;
-	const config = readConfig();
 	const normalizedApiUrl = normalizePlatformApiUrl(apiUrl);
-	const fileToken = config.tokens?.[normalizedApiUrl];
-	if (fileToken) {
-		if (keyringSet(account, fileToken)) {
-			delete config.tokens[normalizedApiUrl];
-			if (Object.keys(config.tokens).length === 0) delete config.tokens;
-			try {
-				writeConfig(config);
-			} catch {}
-		}
-		return fileToken;
-	}
-	const legacyAccount = legacyCredentialAccount(root, normalizedApiUrl, config);
+	const originToken = readOriginScopedToken(normalizedApiUrl, config);
+	if (originToken) return originToken;
+	const account = platformCredentialAccount(normalizedApiUrl);
 	if (legacyAccount) {
 		const legacyKeyringToken = keyringGet(legacyAccount);
 		if (legacyKeyringToken) {
@@ -342,7 +358,7 @@ function saveToken(token, root = process.cwd(), dependencies = {}) {
 	savePlatformToken(token, getApiUrl(root), dependencies);
 }
 function readPlatformToken(apiUrl) {
-	return keyringGet(platformCredentialAccount(normalizePlatformApiUrl(apiUrl)));
+	return readOriginScopedToken(apiUrl, readConfig());
 }
 function savePlatformToken(token, origin, dependencies = {}) {
 	const apiUrl = normalizePlatformApiUrl(origin);
@@ -378,10 +394,13 @@ function removeToken(root = process.cwd()) {
 const DEFAULT_API_URL = VOID_CLOUD_PLATFORM.apiUrl;
 const STAGING_API_URL = VOID_CLOUD_STAGING_PLATFORM.apiUrl;
 function legacyCredentialAccount(root, normalizedApiUrl, config) {
-	const account = isStagingMode(root) ? "stagingToken" : "token";
+	return legacyCredentialAccountForMode(isStagingMode(root), normalizedApiUrl, config);
+}
+function legacyCredentialAccountForMode(staging, normalizedApiUrl, config) {
+	const account = staging ? "stagingToken" : "token";
 	let configuredUrl;
 	try {
-		configuredUrl = normalizePlatformApiUrl(config.api ?? (isStagingMode(root) ? STAGING_API_URL : DEFAULT_API_URL));
+		configuredUrl = normalizePlatformApiUrl(config.api ?? (staging ? STAGING_API_URL : DEFAULT_API_URL));
 	} catch {
 		return null;
 	}
@@ -409,7 +428,8 @@ async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
 			code,
 			state,
 			code_verifier: codeVerifier
-		})
+		}),
+		redirect: "manual"
 	});
 	if (!res.ok) throw new Error(`auth: Failed to exchange login code (${res.status}). Try logging in again.`);
 	let body;
@@ -627,4 +647,4 @@ async function runPlatformLogin(origin, provider = "github", onUrl) {
 	});
 }
 //#endregion
-export { writeDeploymentPlatform as C, STAGING_PROXY_URL as D, DEFAULT_PROXY_URL as E, removeProjectConfig as S, writeProjectConfig as T, saveToken as _, getApiUrl as a, readDeploymentPlatform as b, getToken as c, openBrowser as d, readPlatformToken as f, savePlatformToken as g, runPlatformLogin as h, createCodeVerifier as i, getTokenSource as l, runLogin as m, awaitBrowserCallback as n, getProxyUrl as o, removeToken as p, createCodeChallenge as r, getSiteDomain as s, auth_exports as t, isStagingMode as u, attachSelectedPlatform as v, writePlatformSelection as w, readProjectConfig as x, project_exports as y };
+export { removeProjectConfig as C, DEFAULT_PROXY_URL as D, writeProjectConfig as E, STAGING_PROXY_URL as O, readProjectConfig as S, writePlatformSelection as T, savePlatformToken as _, getAccountCredential as a, project_exports as b, getSiteDomain as c, isStagingMode as d, openBrowser as f, runPlatformLogin as g, runLogin as h, createCodeVerifier as i, getToken as l, removeToken as m, awaitBrowserCallback as n, getApiUrl as o, readPlatformToken as p, createCodeChallenge as r, getProxyUrl as s, auth_exports as t, getTokenSource as u, saveToken as v, writeDeploymentPlatform as w, readDeploymentPlatform as x, attachSelectedPlatform as y };

package/dist/{auth-cmd-CYVhSNFy.mjs → auth-cmd-gniL2fNt.mjs}

@@ -1,12 +1,13 @@
-import { D as log } from "./output-tFQLLj26.mjs";
-import { c as getToken, p as removeToken } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
-import { n as runLoginCommand } from "./login-C8-UuLnp.mjs";
+import { D as log } from "./output-B0cfNSx5.mjs";
+import { l as getToken, m as removeToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { r as runLoginCommand } from "./login-Uvferzmm.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/auth-cmd.ts
 async function runAuthCommand(root, args) {
 	switch (args.subcommand) {
 		case "login": return runLoginCommand(root);
+		case "link": return import("./auth-link-NZdjCmSc.mjs").then(({ runAuthLink }) => runAuthLink(root, args.connectionId));
 		case "logout":
 			if (removeToken(root)) log.success("Logged out.");
 			else log.info("Not logged in.");

package/dist/auth-link-NZdjCmSc.mjs

@@ -0,0 +1,28 @@
+import { D as log } from "./output-B0cfNSx5.mjs";
+import { _ as savePlatformToken, f as openBrowser, g as runPlatformLogin, l as getToken, o as getApiUrl } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { i as selectPlatformLoginMethod } from "./login-Uvferzmm.mjs";
+import { discoverPlatform } from "./platform-cmd-BFhieCdV.mjs";
+import { execFile } from "node:child_process";
+//#region src/cli/auth-link.ts
+async function runAuthLink(root, connectionId) {
+	const token = getToken(root);
+	if (!token) throw new Error("auth: Sign in to your existing account with `void auth login` first.");
+	const apiUrl = getApiUrl(root);
+	const platform = await discoverPlatform(apiUrl);
+	if (!platform.authentication) throw new Error("auth: This platform must be upgraded before linking login methods.");
+	const target = await selectPlatformLoginMethod(platform, connectionId);
+	const existing = await new PlatformClient(token, apiUrl).whoami();
+	if (!existing.id) throw new Error("auth: This platform does not support account linking.");
+	log.info(`Sign in again to ${existing.login} using an already linked login method.`);
+	const source = await selectPlatformLoginMethod(platform);
+	const freshToken = await runPlatformLogin(apiUrl, source.id, (url) => log.info(`Sign in: ${url}`));
+	const client = new PlatformClient(freshToken, apiUrl);
+	if ((await client.whoami()).id !== existing.id) throw new Error("auth: You signed in to a different Void account. Start again with a login method already linked to your original account.");
+	savePlatformToken(freshToken, apiUrl);
+	const launch = await client.startIdentityLink(target.id);
+	log.info(`Authenticate with ${target.label}, then review and confirm the identity in your browser.\n${launch.url}`);
+	openBrowser(launch.url, execFile);
+}
+//#endregion
+export { runAuthLink };

package/dist/{build-cmd-CkVD1uOh.mjs → build-cmd-sI18tX_O.mjs}

@@ -1,6 +1,6 @@
-import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-CyCHWSO_.mjs";
+import { A as outro, D as log, E as intro, a as dim, c as import_picocolors, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-dHfSJvAN.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts

package/dist/{cache-QcUfR-ff.mjs → cache-IHn5MwBC.mjs}

@@ -1,6 +1,6 @@
-import { D as log, E as intro, a as dim, i as createSpinner, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { A as outro, D as log, E as intro, a as dim, i as createSpinner, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {

package/dist/{cancel-deploy-DsvWKFTe.mjs → cancel-deploy-C5qTOdLi.mjs}

@@ -1,6 +1,6 @@
-import { D as log, E as intro, F as isCancel, k as outro, r as cliTitle, w as confirm } from "./output-tFQLLj26.mjs";
-import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { A as outro, D as log, E as intro, I as isCancel, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
+import { S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 	"pending",

package/dist/cf-access-DRsQRe6k.mjs

@@ -0,0 +1,75 @@
+//#region src/shared/cf-access.ts
+/**
+* Resolve Cloudflare Access headers from an env-like object.
+*
+* Priority:
+*   1. Service token pair (`CF_ACCESS_CLIENT_ID` + `CF_ACCESS_CLIENT_SECRET`) — CI path
+*   2. User JWT (`CF_ACCESS_TOKEN`) — dev path, typically populated via `cloudflared access token`
+*   3. No headers — prod, or unprotected hostnames
+*/
+function isVoidAccessGatedUrl(targetUrl) {
+	try {
+		const url = new URL(targetUrl);
+		return url.protocol === "https:" && (url.hostname.endsWith(".staging.void.cloud") || url.hostname.endsWith(".staging.void.app"));
+	} catch {
+		return false;
+	}
+}
+function accessHeaders(env) {
+	const id = env.CF_ACCESS_CLIENT_ID;
+	const secret = env.CF_ACCESS_CLIENT_SECRET;
+	if (typeof id === "string" && typeof secret === "string" && id.length > 0 && secret.length > 0) return {
+		"CF-Access-Client-Id": id,
+		"CF-Access-Client-Secret": secret
+	};
+	const token = env.CF_ACCESS_TOKEN;
+	if (typeof token === "string" && token.length > 0) return { "cf-access-token": token };
+	return {};
+}
+/** Attach shared Void Access credentials only to known hosted staging origins. */
+function cfAccessHeaders(env, targetUrl) {
+	let origin;
+	try {
+		const target = new URL(targetUrl);
+		if (target.protocol !== "https:" || target.username || target.password) return {};
+		origin = target.origin;
+	} catch {
+		return {};
+	}
+	const encoded = env.VOID_ACCESS_CREDENTIALS ?? env.__VOID_ACCESS_CREDENTIALS;
+	if (typeof encoded === "string" && encoded) try {
+		const records = JSON.parse(encoded);
+		if (!records || typeof records !== "object" || Array.isArray(records)) return {};
+		const entry = records && typeof records === "object" && !Array.isArray(records) && Object.hasOwn(records, origin) ? records[origin] : void 0;
+		if (entry && typeof entry === "object" && !Array.isArray(entry)) return accessHeaders(entry);
+		if (Object.hasOwn(records, origin)) return {};
+	} catch {
+		return {};
+	}
+	if (typeof env.VOID_ACCESS_ORIGIN === "string" && env.VOID_ACCESS_ORIGIN) try {
+		const selected = new URL(env.VOID_ACCESS_ORIGIN);
+		return selected.protocol === "https:" && !selected.username && !selected.password && selected.pathname === "/" && !selected.search && !selected.hash && selected.origin === origin ? accessHeaders(env) : {};
+	} catch {
+		return {};
+	}
+	return isVoidAccessGatedUrl(targetUrl) ? accessHeaders(env) : {};
+}
+/**
+* Capture credentials for a Cloudflare Worker readiness request whose target
+* is resolved and constrained by the direct-deploy adapter rather than a
+* user-connected Void platform URL.
+*/
+function trustedCloudflareWorkerAccessHeaders(env) {
+	return accessHeaders(env);
+}
+/** Keep only this recipient's credentials when crossing into a local Worker runtime. */
+function scopedAccessCredentials(env, targetUrl) {
+	const headers = cfAccessHeaders(env, targetUrl);
+	if (Object.keys(headers).length === 0) return;
+	return JSON.stringify({ [new URL(targetUrl).origin]: headers["CF-Access-Client-Id"] ? {
+		CF_ACCESS_CLIENT_ID: headers["CF-Access-Client-Id"],
+		CF_ACCESS_CLIENT_SECRET: headers["CF-Access-Client-Secret"]
+	} : { CF_ACCESS_TOKEN: headers["cf-access-token"] } });
+}
+//#endregion
+export { trustedCloudflareWorkerAccessHeaders as i, isVoidAccessGatedUrl as n, scopedAccessCredentials as r, cfAccessHeaders as t };