void 0.20.1 → 0.20.2

package/dist/{cloudflare-auth-B1QtTO1b.mjs → cloudflare-auth-6M5llVPC.mjs}

@@ -1,4 +1,4 @@
-import { D as log } from "./output-tFQLLj26.mjs";
+import { D as log } from "./output-B0cfNSx5.mjs";
 import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
 import { execFile, spawn, spawnSync } from "node:child_process";
 //#region src/cli/cloudflare-auth.ts
@@ -202,7 +202,7 @@ function cloudflareAuthEnvironment(source = process.env) {
 		"WRANGLER_OUTPUT_FILE_PATH",
 		"WRANGLER_LOG_SANITIZE"
 	]);
-	for (const key of Object.keys(env)) if (/^VOID_PLATFORM_/i.test(key) || /^(?:DATABASE_URL|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET|CF_ACCESS_TOKEN)$/i.test(key) || scrubbedWranglerKeys.has(key.toUpperCase())) delete env[key];
+	for (const key of Object.keys(env)) if (/^VOID_PLATFORM_/i.test(key) || /^(?:DATABASE_URL|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET|CF_ACCESS_TOKEN|VOID_ACCESS_CREDENTIALS|VOID_ACCESS_ORIGIN)$/i.test(key) || scrubbedWranglerKeys.has(key.toUpperCase())) delete env[key];
 	env.CLOUDFLARE_AUTH_USE_KEYRING = "true";
 	env.WRANGLER_LOG_SANITIZE = "true";
 	return env;

package/dist/{cloudflare-cmd-B6_OZx2V.mjs → cloudflare-cmd-4RPGN3KB.mjs}

@@ -1,7 +1,7 @@
 import { t as basename } from "./dist-BrsS7cai.mjs";
-import { D as log } from "./output-tFQLLj26.mjs";
+import { D as log } from "./output-B0cfNSx5.mjs";
 import { v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
-import { a as createBundledCloudflareAuthRunner, c as parseCloudflareAuthSession, o as enableCloudflareKeyring, r as cloudflareCredentialOverrides, s as ensureCloudflareAuthentication } from "./cloudflare-auth-B1QtTO1b.mjs";
+import { a as createBundledCloudflareAuthRunner, c as parseCloudflareAuthSession, o as enableCloudflareKeyring, r as cloudflareCredentialOverrides, s as ensureCloudflareAuthentication } from "./cloudflare-auth-6M5llVPC.mjs";
 //#region src/cli/cloudflare-cmd.ts
 async function runCloudflareCommand(root, args) {
 	const runWrangler = createBundledCloudflareAuthRunner(root);

package/dist/{cloudflare-connect-j5D4hhrG.mjs → cloudflare-connect-t1UU5svD.mjs}

@@ -1,7 +1,7 @@
 import { o as join, t as basename } from "./dist-BrsS7cai.mjs";
-import { D as log, F as isCancel, j as select } from "./output-tFQLLj26.mjs";
+import { D as log, I as isCancel, M as select } from "./output-B0cfNSx5.mjs";
 import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
-import { a as createBundledCloudflareAuthRunner, s as ensureCloudflareAuthentication } from "./cloudflare-auth-B1QtTO1b.mjs";
+import { a as createBundledCloudflareAuthRunner, s as ensureCloudflareAuthentication } from "./cloudflare-auth-6M5llVPC.mjs";
 import { existsSync } from "node:fs";
 //#region src/cli/cloudflare-connect.ts
 async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY)) {

package/dist/{cloudflare-operations-CPTpRW6d.mjs → cloudflare-operations-BzWnlC1_.mjs}

@@ -3,7 +3,7 @@ import { o as join } from "./dist-BrsS7cai.mjs";
 import { A as writeWranglerPublishedTrafficSnapshot, O as updateWranglerCustomDomain, S as readWranglerPublishedTrafficSnapshot, b as readWranglerCustomDomains } from "./wrangler--imS8n0d.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
 import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
-import { i as provisionEnv, o as resolvePinnedApiBaseUrl, r as deleteEnvVarCaseAware, t as assertNoTransportRedirectInProjectDotenv } from "./provision-Blnstcm2.mjs";
+import { i as provisionEnv, o as resolvePinnedApiBaseUrl, r as deleteEnvVarCaseAware, t as assertNoTransportRedirectInProjectDotenv } from "./provision-CSJOjjQk.mjs";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";

package/dist/{config-BQFq7QvD.mjs → config-uNGuFsI2.mjs}

@@ -2,7 +2,7 @@ import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { o as join } from "./dist-BrsS7cai.mjs";
 import { a as validateSourceDir } from "./project-paths-SK8nMHPp.mjs";
 import { i as isVoidAuthProvider, t as VOID_AUTH_PROVIDERS } from "./providers-CJlNS3kT.mjs";
-import { a as parseAddress, n as MimeError } from "./mime-BJD7d_qL.mjs";
+import { a as parseAddress, n as MimeError } from "./mime-D5Nmdzf7.mjs";
 import { readFileSync } from "node:fs";
 //#region src/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({

package/dist/{connect-C04Wdy_h.mjs → connect-Bfk31O_8.mjs}

@@ -1,9 +1,9 @@
-import { D as log, F as isCancel, G as normalizePlatformApiUrl, W as listPlatformConnections, j as select } from "./output-tFQLLj26.mjs";
-import { C as writeDeploymentPlatform, b as readDeploymentPlatform, f as readPlatformToken, w as writePlatformSelection } from "./auth-W9WII-mN.mjs";
-import { a as isExpiredTokenError, n as PlatformClient } from "./client-Clirrol3.mjs";
-import { t as promptForLoginToken } from "./login-pV69H-ZO.mjs";
-import { t as connectCloudflare } from "./cloudflare-connect-j5D4hhrG.mjs";
-import { discoverPlatform, promptPlatformUrl, saveDiscoveredPlatform } from "./platform-cmd-DxJ2FRwR.mjs";
+import { D as log, I as isCancel, M as select, X as normalizePlatformApiUrl, Y as listPlatformConnections } from "./output-B0cfNSx5.mjs";
+import { T as writePlatformSelection, p as readPlatformToken, w as writeDeploymentPlatform, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { a as isExpiredTokenError, n as PlatformClient } from "./client-dHfSJvAN.mjs";
+import { n as promptForLoginToken } from "./login-Uvferzmm.mjs";
+import { discoverPlatform, promptPlatformUrl, saveDiscoveredPlatform } from "./platform-cmd-BFhieCdV.mjs";
+import { t as connectCloudflare } from "./cloudflare-connect-t1UU5svD.mjs";
 //#region src/cli/connect.ts
 async function selectVoidPlatform(interactive) {
 	if (!interactive) throw new Error("connect: Supply a Void platform URL in non-interactive mode.");

package/dist/{create-project-ChGZ1DFd.mjs → create-project-Bk9Z0-Jg.mjs}

@@ -1,7 +1,7 @@
 import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
-import { C as cancel, D as log, F as isCancel, N as text, c as import_picocolors, j as select, w as confirm } from "./output-tFQLLj26.mjs";
-import { T as writeProjectConfig, s as getSiteDomain, v as attachSelectedPlatform } from "./auth-W9WII-mN.mjs";
-import { t as PlatformApiError } from "./client-Clirrol3.mjs";
+import { C as cancel, D as log, I as isCancel, M as select, P as text, c as import_picocolors, w as confirm } from "./output-B0cfNSx5.mjs";
+import { E as writeProjectConfig, c as getSiteDomain, y as attachSelectedPlatform } from "./auth-DPl6kck4.mjs";
+import { t as PlatformApiError } from "./client-dHfSJvAN.mjs";
 import { n as inferDefaultSlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/project-slug.ts
 var project_slug_exports = /* @__PURE__ */ __exportAll({
@@ -39,7 +39,8 @@ async function promptProjectSelection(projects, message = "Select a project:", r
 		label: "Create new project"
 	}], ...projects.map((p) => ({
 		value: p.id,
-		label: `${p.slug} (${p.url ?? `${p.slug}.${getSiteDomain(root)}`})`
+		label: `${p.slug} (${p.url ?? `${p.slug}.${getSiteDomain(root)}`})`,
+		...p.role ? { hint: p.role === "reader" ? "reader (read-only)" : p.role } : {}
 	}))];
 	const result = await select({
 		message,
@@ -52,7 +53,7 @@ async function promptProjectSelection(projects, message = "Select a project:", r
 	if (result === "__create__") return { action: "create" };
 	const project = projects.find((p) => p.id === result);
 	if (options.confirmExisting) {
-		const confirmed = await confirm({ message: `Linking to an existing project. Running \`void deploy\` will overwrite the current deployment of ${project.url ?? `${project.slug}.${getSiteDomain(root)}`}. Continue?` });
+		const confirmed = await confirm({ message: project.role === "reader" ? `Link to ${project.slug} with read-only access? Deploying requires collaborator access or higher.` : `Linking to an existing project. Running \`void deploy\` will overwrite the current deployment of ${project.url ?? `${project.slug}.${getSiteDomain(root)}`}. Continue?` });
 		if (isCancel(confirmed) || !confirmed) {
 			cancel("Project link cancelled.");
 			process.exit(0);

package/dist/{db-D2d_mUsB.mjs → db-BkRoptAt.mjs}

@@ -1,15 +1,15 @@
 import { c as relative, i as extname, l as resolve, o as join, t as basename } from "./dist-BrsS7cai.mjs";
-import { D as log, E as intro, F as isCancel, a as dim, c as import_picocolors, k as outro, r as cliTitle, w as confirm } from "./output-tFQLLj26.mjs";
+import { A as outro, D as log, E as intro, H as ensurePlatformProxyAccess, I as isCancel, U as isCloudflareAccessChallenge, V as ensurePlatformAccessToken, a as dim, c as import_picocolors, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
 import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { b as readDeploymentPlatform, c as getToken, o as getProxyUrl, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { c as getDatabaseDialect, f as readConfig, p as resolveBindingNames } from "./config-BQFq7QvD.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { S as readProjectConfig, l as getToken, s as getProxyUrl, x as readDeploymentPlatform } from "./auth-DPl6kck4.mjs";
+import { c as getDatabaseDialect, f as readConfig, p as resolveBindingNames } from "./config-uNGuFsI2.mjs";
 import { r as detectFramework } from "./plugin-inference-BDRfZngg.mjs";
 import { c as collectMigrations, d as stripSqlExt, f as writeJournal, n as listDrizzleArtifacts, r as validateMigrations, t as assertJournalCoherence, u as readJournal } from "./validate-tBBN_dXH.mjs";
 import { t as resolveLocalD1Target } from "./local-d1-D2I6Ox5F.mjs";
-import { a as loadLocalEnv } from "./env-D4Emu-M_.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-Clirrol3.mjs";
-import { formatTimestamp } from "./gen-DI2YwdBM.mjs";
+import { a as loadLocalEnv } from "./env-DBKmK4vc.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-dHfSJvAN.mjs";
+import { formatTimestamp } from "./gen-B_wPnVTK.mjs";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -233,7 +233,7 @@ async function runConnect(root, dialect, args) {
 		if (result.dashboardUrl) log.info(`Dashboard: ${result.dashboardUrl}`);
 	}
 	if (!connectionString) {
-		const { text: promptText, isCancel: isCancelCheck } = await import("./output-tFQLLj26.mjs").then((n) => n.T);
+		const { text: promptText, isCancel: isCancelCheck } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
 		const answer = await promptText({
 			message: `Enter your ${dialect === "mysql" ? "MySQL" : "PostgreSQL"} connection string:`,
 			placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/database" : "postgresql://user:pass@host:5432/database"
@@ -278,7 +278,7 @@ async function runPush(root, dialect) {
 	outro("Done.");
 }
 async function runGenerate(root, dialect) {
-	const { prepareProject } = await import("./prepare-CBetXvsN.mjs");
+	const { prepareProject } = await import("./prepare-CtDJjoOj.mjs");
 	const { writeDrizzleConfig } = await import("./config-NOG_U1aK.mjs").then((n) => n.t);
 	await prepareProject(root);
 	const authSchemaPath = join(root, ".void", "better-auth-schema.ts");
@@ -359,7 +359,7 @@ async function runStatus(root, dialect) {
 				applied_at: ""
 			}));
 		} else {
-			const { readCloudflareD1Migrations, resolveCloudflareD1Context } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+			const { readCloudflareD1Migrations, resolveCloudflareD1Context } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 			remoteApplied = (await readCloudflareD1Migrations(resolveCloudflareD1Context(root, resolveBindingNames(readConfig(root).inference?.bindings)?.d1 ?? "DB"))).map((name) => ({
 				name,
 				applied_at: ""
@@ -601,7 +601,7 @@ async function runExecute(root, command, file, dialect, remote) {
 				process.exit(0);
 			}
 			if (dialect === "sqlite") {
-				const { executeCloudflareD1Sql, resolveCloudflareD1Context } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+				const { executeCloudflareD1Sql, resolveCloudflareD1Context } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 				const rows = await executeCloudflareD1Sql(resolveCloudflareD1Context(root, resolveBindingNames(readConfig(root).inference?.bindings)?.d1 ?? "DB"), sql);
 				if (rows.length > 0) printTable(rows);
 				else log.success("Executed successfully.");
@@ -643,21 +643,38 @@ async function runExecute(root, command, file, dialect, remote) {
 			if (d1Resource) binding = d1Resource.binding_name;
 		} catch {}
 		const proxyUrl = getProxyUrl(root);
-		const res = await fetch(`${proxyUrl}/d1/query`, {
-			method: "POST",
-			headers: {
-				Authorization: `Bearer ${token}`,
-				"Content-Type": "application/json",
-				...cfAccessHeaders(process.env, proxyUrl)
-			},
-			body: JSON.stringify({
-				projectId: projectConfig.projectId,
-				binding,
-				sql,
-				params: [],
-				method: "all"
-			})
-		});
+		ensurePlatformProxyAccess(platformClient.apiUrl, proxyUrl);
+		const capturedAccessHeaders = cfAccessHeaders(process.env, proxyUrl);
+		const requestProxy = () => {
+			const currentAccessHeaders = cfAccessHeaders(process.env, proxyUrl);
+			const accessHeaders = Object.keys(currentAccessHeaders).length > 0 ? currentAccessHeaders : capturedAccessHeaders;
+			return {
+				accessHeaders,
+				response: fetch(`${proxyUrl}/d1/query`, {
+					method: "POST",
+					headers: {
+						Authorization: `Bearer ${token}`,
+						"Content-Type": "application/json",
+						...accessHeaders
+					},
+					body: JSON.stringify({
+						projectId: projectConfig.projectId,
+						binding,
+						sql,
+						params: [],
+						method: "all"
+					}),
+					redirect: "manual"
+				})
+			};
+		};
+		const first = requestProxy();
+		let res = await first.response;
+		if (isCloudflareAccessChallenge(res) && !first.accessHeaders["CF-Access-Client-Id"]) {
+			await res.body?.cancel();
+			ensurePlatformAccessToken(proxyUrl, true, false, first.accessHeaders["cf-access-token"]);
+			res = await requestProxy().response;
+		}
 		if (!res.ok) {
 			const text = await res.text().catch(() => res.statusText);
 			log.error(`db: Proxy request failed with ${res.status}: '${text}'.`);
@@ -789,7 +806,7 @@ async function runMigrate(root, dialect, remote) {
 				outro("Done.");
 				return;
 			}
-			const { applyCloudflareD1Migrations, readCloudflareD1Migrations, resolveCloudflareD1Context } = await import("./cloudflare-operations-CPTpRW6d.mjs").then((n) => n.t);
+			const { applyCloudflareD1Migrations, readCloudflareD1Migrations, resolveCloudflareD1Context } = await import("./cloudflare-operations-BzWnlC1_.mjs").then((n) => n.t);
 			const binding = resolveBindingNames(readConfig(root).inference?.bindings)?.d1 ?? "DB";
 			const context = resolveCloudflareD1Context(root, binding);
 			const remoteBefore = new Set(await readCloudflareD1Migrations(context));
@@ -805,7 +822,7 @@ async function runMigrate(root, dialect, remote) {
 				log.error(getErrorMessage(error));
 				process.exit(1);
 			}
-			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-iXZ3F0N6.mjs").then((n) => n.n);
+			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-DTaWUS1S.mjs").then((n) => n.n);
 			const applySet = await checkWranglerMigrationApplySet(context.operation.configPath, parseRootWranglerConfig(context.operation.configPath), binding, context.migrationsDir, rawMigrations);
 			if (!applySet.ok) {
 				log.error(applySet.reason);
@@ -1419,7 +1436,7 @@ async function runExport(root, args, dialect) {
 	}
 }
 async function runSetUrl(root) {
-	const { readConfig: readVoidConfig, getDatabaseDialect: getDialect } = await import("./config-BQFq7QvD.mjs").then((n) => n.n);
+	const { readConfig: readVoidConfig, getDatabaseDialect: getDialect } = await import("./config-uNGuFsI2.mjs").then((n) => n.n);
 	const dialect = getDialect(readVoidConfig(root));
 	if (dialect === "sqlite") {
 		log.error("db: This command is only for PostgreSQL and MySQL projects. Set \"database\" to \"pg\" or \"mysql\" in void.json.");
@@ -1435,7 +1452,7 @@ async function runSetUrl(root) {
 		log.error("No project linked. Run `void deploy` first or link a project.");
 		process.exit(1);
 	}
-	const { text: promptText, isCancel: isCancelCheck } = await import("./output-tFQLLj26.mjs").then((n) => n.T);
+	const { text: promptText, isCancel: isCancelCheck } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
 	const connectionString = await promptText({
 		message: `Enter your ${dialect === "mysql" ? "MySQL" : "PostgreSQL"} connection string:`,
 		placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",

package/dist/{delete-D8GigDk8.mjs → delete-DouASY9P.mjs}

@@ -1,6 +1,6 @@
-import { C as cancel, D as log, E as intro, F as isCancel, N as text, O as note, i as createSpinner, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
-import { S as removeProjectConfig, c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { A as outro, C as cancel, D as log, E as intro, I as isCancel, P as text, i as createSpinner, k as note, r as cliTitle } from "./output-B0cfNSx5.mjs";
+import { C as removeProjectConfig, S as readProjectConfig, l as getToken } from "./auth-DPl6kck4.mjs";
+import { n as PlatformClient } from "./client-dHfSJvAN.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/delete.ts
 async function runDeleteCommand(root, slug, options) {