void 0.27.0 → 0.28.0

package/dist/pages/protocol.mjs

@@ -1,3 +1,3 @@
 import { t as ValidationError } from "../validation-error-Dg9Recn1.mjs";
-import { i as safeJsonStringify, n as handlePageGet, r as handlePageMutation, t as flattenValidationErrors } from "../protocol-CfaUwNs8.mjs";
+import { i as safeJsonStringify, n as handlePageGet, r as handlePageMutation, t as flattenValidationErrors } from "../protocol-RNP0u7UY.mjs";
 export { ValidationError, flattenValidationErrors, handlePageGet, handlePageMutation, safeJsonStringify };

package/dist/pages/serialize.mjs

@@ -1,2 +1,2 @@
-import { t as serializePageData } from "../serialize-BPvnNQuA.mjs";
+import { t as serializePageData } from "../serialize-BtQyaYoC.mjs";
 export { serializePageData };

package/dist/{platform-args-DUeXY9Om.mjs → platform-args-C6Mb_I3a.mjs}

@@ -1,4 +1,4 @@
-import { n as operatorGroups, r as parseOperatorArgs } from "./operator-args-DOBhIaIg.mjs";
+import { n as operatorGroups, r as parseOperatorArgs } from "./operator-args-UnE8Y2eK.mjs";
 import { PLATFORM_LOGIN_KINDS, normalizePlatformDashboardUrl, parsePlatformLoginId } from "@void/platform";
 import { parsePlatformPlanId } from "@void/platform/plans";
 //#region src/cli/platform-config-args.ts
@@ -18,38 +18,14 @@ const PLATFORM_AUTH_ACTIONS = [
 ];
 function parsePlatformConfigArgs(args) {
 	if (args.length && args[0] !== "auth") throw new Error("platform: Usage: void platform config auth [command] [options].");
-	const positional = [];
-	const flags = /* @__PURE__ */ new Set();
-	const values = /* @__PURE__ */ new Map();
-	const valueFlags = [
+	const { positional, flags, values } = parseConfigFlags(args, "auth", [
 		"connection",
 		"installation",
 		"id",
 		"file",
 		"client-secret-env",
 		"test-id"
-	];
-	for (let index = 1; index < args.length; index++) {
-		const arg = args[index];
-		if (!arg.startsWith("-")) {
-			positional.push(arg);
-			continue;
-		}
-		const name = arg.slice(2);
-		if (!arg.startsWith("--") || ![
-			"json",
-			"plan",
-			"yes"
-		].includes(name) && !valueFlags.includes(name)) throw new Error(`platform: Unknown config auth flag ${arg}.`);
-		if (flags.has(name) || values.has(name)) throw new Error(`platform: Duplicate flag ${arg}.`);
-		if (!valueFlags.includes(name)) {
-			flags.add(name);
-			continue;
-		}
-		const value = args[++index];
-		if (!value || value.startsWith("-")) throw new Error(`platform: ${arg} requires a value.`);
-		values.set(name, value);
-	}
+	]);
 	const [action = "", target = "", ...extra] = positional;
 	if (extra.length || action && !PLATFORM_AUTH_ACTIONS.includes(action)) throw new Error(`platform: Usage: void platform config auth <${PLATFORM_AUTH_ACTIONS.join("|")}>.`);
 	const needsTarget = action && action !== "list" && action !== "initialize" && action !== "admission";
@@ -97,30 +73,11 @@ function parsePlatformConfigArgs(args) {
 		yes: flags.has("yes")
 	};
 }
-//#endregion
-//#region src/cli/platform-plans-args.ts
-const PLATFORM_PLAN_ACTIONS = [
-	"show",
-	"add",
-	"set",
-	"reset",
-	"archive",
-	"restore",
-	"remove",
-	"default",
-	"sync"
-];
-function parsePlatformPlansArgs(args) {
+/** Parses `config <group>` flags: --json, --plan, --yes, and the given value flags. */
+function parseConfigFlags(args, group, valueFlags) {
 	const positional = [];
 	const flags = /* @__PURE__ */ new Set();
 	const values = /* @__PURE__ */ new Map();
-	const valueFlags = [
-		"connection",
-		"file",
-		"name",
-		"copy",
-		"replacement"
-	];
 	for (let index = 1; index < args.length; index++) {
 		const arg = args[index];
 		if (!arg.startsWith("-")) {
@@ -132,7 +89,7 @@ function parsePlatformPlansArgs(args) {
 			"json",
 			"plan",
 			"yes"
-		].includes(name) && !valueFlags.includes(name)) throw new Error(`platform: Unknown config plans flag ${arg}.`);
+		].includes(name) && !valueFlags.includes(name)) throw new Error(`platform: Unknown config ${group} flag ${arg}.`);
 		if (flags.has(name) || values.has(name)) throw new Error(`platform: Duplicate flag ${arg}.`);
 		if (!valueFlags.includes(name)) {
 			flags.add(name);
@@ -142,6 +99,33 @@ function parsePlatformPlansArgs(args) {
 		if (!value || value.startsWith("-")) throw new Error(`platform: ${arg} requires a value.`);
 		values.set(name, value);
 	}
+	return {
+		positional,
+		flags,
+		values
+	};
+}
+//#endregion
+//#region src/cli/platform-plans-args.ts
+const PLATFORM_PLAN_ACTIONS = [
+	"show",
+	"add",
+	"set",
+	"reset",
+	"archive",
+	"restore",
+	"remove",
+	"default",
+	"sync"
+];
+function parsePlatformPlansArgs(args) {
+	const { positional, flags, values } = parseConfigFlags(args, "plans", [
+		"connection",
+		"file",
+		"name",
+		"copy",
+		"replacement"
+	]);
 	const [action = "", target = "", ...extra] = positional;
 	if (extra.length || action && !PLATFORM_PLAN_ACTIONS.includes(action)) throw new Error(`platform: Usage: void platform config plans [${PLATFORM_PLAN_ACTIONS.join("|")}] [plan-id] [options].`);
 	const needsTarget = action && action !== "show" && action !== "sync";
@@ -362,21 +346,13 @@ function parsePlatformArgs(args) {
 		if (rest.length > 0) throw new Error(`platform: Unexpected argument '${rest[0]}'.`);
 		return { subcommand };
 	}
-	if (subcommand === "use") {
+	if (subcommand === "use" || subcommand === "status") {
 		const { selector } = parseSelector(rest, subcommand);
 		return {
 			subcommand,
 			selector
 		};
 	}
-	if (subcommand === "status") {
-		const { selector, plan } = parseSelector(rest, subcommand);
-		if (plan) throw new Error("platform: Unknown flag '--plan'.");
-		return {
-			subcommand,
-			selector
-		};
-	}
 	if (subcommand === "discover") {
 		let account = "";
 		let selector = "";

package/dist/platform-args-Cm7x-fot.mjs

@@ -0,0 +1,2 @@
+import { t as parsePlatformArgs } from "./platform-args-C6Mb_I3a.mjs";
+export { parsePlatformArgs };

package/dist/{platform-auth-config-CkSx3usH.mjs → platform-auth-config-CJmNkFT2.mjs}

@@ -1,13 +1,12 @@
-import { u as openBrowser } from "./auth-Dn2vw-SG.mjs";
+import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
 import { A as confirm, K as select, U as password, X as text, z as multiselect } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess } from "./output-C50ag2r3.mjs";
-import { n as OperatorClient } from "./operator-client-DbDv4vtE.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-BEZ_u0Cz.mjs";
-import { i as humanLines } from "./operator-cmd-BT4hgavL.mjs";
-import { o as platformPromptAnswer } from "./platform-setup-BBxRxmFC.mjs";
+import { l as formatUrl, m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { n as OperatorClient } from "./operator-client-C-ROjk1I.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
+import { i as humanLines } from "./operator-cmd-C5lCctnc.mjs";
+import { o as platformPromptAnswer } from "./platform-setup-CTf6MMT9.mjs";
 import { parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
-import { execFile } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 //#region src/cli/platform-auth-config.ts
@@ -46,8 +45,8 @@ async function waitForPlatformLoginTest(client, launch, signal) {
 	if (url.origin !== client.origin || url.pathname !== "/auth/test" || url.username || url.password || url.hash) throw new Error("platform: The login test belongs to a different platform.");
 	const expiry = Date.parse(launch.expiresAt);
 	if (!Number.isFinite(expiry) || expiry > Date.now() + 66e4) throw new Error("platform: Invalid login test expiry.");
-	console.log(`Complete the login test in your browser: ${url.href}`);
-	openBrowser(url.href, execFile);
+	console.log(`Complete the login test in your browser: ${formatUrl(url.href)}`);
+	openBrowser(url.href);
 	while (Date.now() < expiry) {
 		signal?.throwIfAborted();
 		const result = await client.request(`/config/auth/tests/${encodeURIComponent(launch.id)}`, { signal });
@@ -143,11 +142,11 @@ async function configurationInput(args, existing) {
 }
 async function runPlatformAuthConfig(args) {
 	if (args.action === "recover") {
-		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-BU6izFAU.mjs");
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-D_0I3n-1.mjs");
 		return runPlatformAuthRecovery(args);
 	}
 	if (args.action === "protection") {
-		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-BJimB_p9.mjs");
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-D5wvsI-Y.mjs");
 		return runPlatformProtectionConfig(args);
 	}
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-auth-protection-BJimB_p9.mjs → platform-auth-protection-D5wvsI-Y.mjs}

@@ -1,12 +1,12 @@
-import { S as writePendingInstallationSecrets, c as normalizePlatformApiUrl, m as readInstallationRecoverySecrets, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-Cjv2Qf0r.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-BcIBSKqG.mjs";
+import { S as writePendingInstallationSecrets, c as normalizePlatformApiUrl, m as readInstallationRecoverySecrets, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { A as confirm, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess } from "./output-C50ag2r3.mjs";
-import { n as OperatorClient } from "./operator-client-DbDv4vtE.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-BEZ_u0Cz.mjs";
-import { G as preparePlatformAccessSetup, K as PlatformCloudflareClient, U as checkpointPlatformAccessResources, V as resolvePlatformCloudflareCredential, W as parsePlatformAccessSetupSpec, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLock } from "./platform-lifecycle-DzCwqhFq.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-CuuVDhyt.mjs";
+import { m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { n as OperatorClient } from "./operator-client-C-ROjk1I.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
+import { F as checkpointPlatformAccessResources, I as parsePlatformAccessSetupSpec, L as preparePlatformAccessSetup, N as resolvePlatformCloudflareCredential, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLock, z as PlatformCloudflareClient } from "./platform-lifecycle-DOW-wLfx.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-t7HKy4-U.mjs";
 import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
 import { createHmac } from "node:crypto";
 import { readFile } from "node:fs/promises";
@@ -55,6 +55,21 @@ async function verifyProtectionWorkerOrigins(client, manifest, origins, disableP
 		if (current.enabled !== update.enabled || current.previews_enabled !== false) throw new Error("platform: Worker alternate origins changed during protection setup. Reconcile them before retrying.");
 	}
 }
+function stringList(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
+}
+function protectionContext(value) {
+	const { installationId, userId, sessionId, revision, lifecycleVersion } = value;
+	const origins = stringList(value.origins);
+	return typeof installationId === "string" && typeof userId === "string" && typeof sessionId === "string" && typeof revision === "number" && Number.isSafeInteger(revision) && typeof lifecycleVersion === "string" && origins ? {
+		installationId,
+		userId,
+		sessionId,
+		revision,
+		lifecycleVersion,
+		origins
+	} : void 0;
+}
 async function runPlatformProtectionConfig(args) {
 	const manifest = args.target === "show" ? void 0 : resolveInstallationManifest(args.installation);
 	const origin = args.connection ? resolveOperatorOrigin(args.connection) : manifest?.endpoints.apiUrl ? normalizePlatformApiUrl(manifest.endpoints.apiUrl) : resolveOperatorOrigin("");
@@ -64,16 +79,16 @@ async function runPlatformProtectionConfig(args) {
 		const provisioning = saved?.accessProvisioningJson ? JSON.parse(saved.accessProvisioningJson) : void 0;
 		if (manifest.deployment.authentication.accessProtection || provisioning?.resources?.protection?.id) ensurePlatformAccessToken(origin, false, true);
 	}
-	let context = await operator.request("/config/auth/protection");
+	const live = await operator.request("/config/auth/protection");
 	if (args.target === "show") {
 		console.log(JSON.stringify({
-			protection: context.protection,
-			origins: context.origins
+			protection: live.protection,
+			origins: live.origins
 		}, null, 2));
 		return;
 	}
-	if (!manifest || manifest.status !== "installed" || !manifest.endpoints.proxyUrl || normalizePlatformApiUrl(manifest.endpoints.apiUrl ?? "") !== origin || context.installationId !== manifest.id || typeof context.userId !== "string" || typeof context.sessionId !== "string" || typeof context.revision !== "number" || typeof context.lifecycleVersion !== "string" || !Number.isSafeInteger(context.revision) || !Array.isArray(context.origins) || context.origins.some((value) => typeof value !== "string")) throw new Error("platform: Protection settings must belong to this completed installation. Repair or upgrade it first.");
-	let lifecycleVersion = context.lifecycleVersion;
+	let context = protectionContext(live);
+	if (!manifest || manifest.status !== "installed" || !manifest.endpoints.proxyUrl || normalizePlatformApiUrl(manifest.endpoints.apiUrl ?? "") !== origin || !context || context.installationId !== manifest.id) throw new Error("platform: Protection settings must belong to this completed installation. Repair or upgrade it first.");
 	let origins = context.origins;
 	if (!origins.includes(origin) || !origins.includes(new URL(manifest.endpoints.proxyUrl).origin)) throw new Error("platform: The live API and proxy origins differ from installation recovery state. Repair the installation first.");
 	const spec = args.file ? parsePlatformAccessSetupSpec(JSON.parse(await readFile(args.file, "utf8"))) : void 0;
@@ -126,10 +141,9 @@ async function runPlatformProtectionConfig(args) {
 				currentManifest = selectAuthoritativePlatformManifest(currentManifest, releaseDatabase.authoritativeManifest);
 				if (!releaseDatabase.authoritativeManifest) await releaseDatabase.checkpoint?.(currentManifest);
 				else writeInstallationManifest(currentManifest);
-				context = await operator.request("/config/auth/protection");
-				const rawLockedOrigins = context.origins;
-				const lockedOrigins = Array.isArray(rawLockedOrigins) ? rawLockedOrigins.filter((value) => typeof value === "string") : [];
-				if (normalizePlatformApiUrl(currentManifest.endpoints.apiUrl ?? "") !== origin || !currentManifest.endpoints.proxyUrl || context.installationId !== currentManifest.id || lockedOrigins.length !== (Array.isArray(rawLockedOrigins) ? rawLockedOrigins.length : -1) || !lockedOrigins.includes(origin) || !lockedOrigins.includes(new URL(currentManifest.endpoints.proxyUrl).origin)) throw new Error("platform: Platform origins changed before Access provisioning. Review and retry.");
+				const locked = await operator.request("/config/auth/protection");
+				const lockedOrigins = stringList(locked.origins);
+				if (normalizePlatformApiUrl(currentManifest.endpoints.apiUrl ?? "") !== origin || !currentManifest.endpoints.proxyUrl || locked.installationId !== currentManifest.id || !lockedOrigins || !lockedOrigins.includes(origin) || !lockedOrigins.includes(new URL(currentManifest.endpoints.proxyUrl).origin)) throw new Error("platform: Platform origins changed before Access provisioning. Review and retry.");
 				origins = lockedOrigins;
 				await verifyPlatformInstallationOwnership(cloudflare, currentManifest);
 				await verifyProtectionWorkerOrigins(cloudflare, currentManifest, origins, true);
@@ -168,9 +182,8 @@ async function runPlatformProtectionConfig(args) {
 			}
 			ensurePlatformAccessToken(origin, false, true);
 			if (!cfAccessHeaders(process.env, origin)["cf-access-token"]) throw new Error("platform: Sign in interactively through company Access to enable protection. Service credentials cannot authorize this change.");
-			context = await operator.request("/config/auth/protection");
-			if (context.installationId !== currentManifest.id || typeof context.userId !== "string" || typeof context.sessionId !== "string" || typeof context.revision !== "number" || typeof context.lifecycleVersion !== "string" || !Array.isArray(context.origins) || context.origins.some((value) => typeof value !== "string") || JSON.stringify(context.origins) !== JSON.stringify(origins)) throw new Error("platform: Protection settings changed while Access resources were being checkpointed. Review and retry.");
-			lifecycleVersion = context.lifecycleVersion;
+			context = protectionContext(await operator.request("/config/auth/protection"));
+			if (!context || context.installationId !== currentManifest.id || JSON.stringify(context.origins) !== JSON.stringify(origins)) throw new Error("platform: Protection settings changed while Access resources were being checkpointed. Review and retry.");
 			await verifyProtectionWorkerOrigins(cloudflare, currentManifest, origins, false);
 		}
 		const expiresAt = new Date(Date.now() + 3e5).toISOString();
@@ -180,13 +193,13 @@ async function runPlatformProtectionConfig(args) {
 			userId: context.userId,
 			sessionId: context.sessionId,
 			revision: context.revision,
-			lifecycleVersion,
+			lifecycleVersion: context.lifecycleVersion,
 			protection,
 			expiresAt
 		})).digest("base64url");
 		const body = {
 			revision: context.revision,
-			lifecycleVersion,
+			lifecycleVersion: context.lifecycleVersion,
 			protection,
 			expiresAt,
 			signature
@@ -203,10 +216,7 @@ async function runPlatformProtectionConfig(args) {
 			method: "POST",
 			body
 		});
-		save({ protectionUpdateJson: JSON.stringify({
-			revision: result.revision,
-			protection
-		}) });
+		writePendingInstallationSecrets(currentManifest, checkpoint);
 		promoteInstallationSecrets(currentManifest);
 		console.log(JSON.stringify({
 			...result,

package/dist/{platform-auth-recovery-BU6izFAU.mjs → platform-auth-recovery-D_0I3n-1.mjs}

@@ -1,13 +1,12 @@
-import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest } from "./platform-registry-Cjv2Qf0r.mjs";
-import { u as openBrowser } from "./auth-Dn2vw-SG.mjs";
+import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
+import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
 import { A as confirm, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess } from "./output-C50ag2r3.mjs";
-import { a as resolveOperatorOrigin } from "./operator-auth-BEZ_u0Cz.mjs";
-import { K as PlatformCloudflareClient, V as resolvePlatformCloudflareCredential, c as acquirePlatformDatabaseLifecycleLockConnection, l as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl } from "./platform-lifecycle-DzCwqhFq.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-CuuVDhyt.mjs";
+import { l as formatUrl, m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { a as resolveOperatorOrigin } from "./operator-auth-Cr2zCc-J.mjs";
+import { N as resolvePlatformCloudflareCredential, c as acquirePlatformDatabaseLifecycleLockConnection, l as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, z as PlatformCloudflareClient } from "./platform-lifecycle-DOW-wLfx.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-t7HKy4-U.mjs";
 import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
-import { execFile } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 //#region src/cli/platform-auth-recovery-core.ts
@@ -271,8 +270,8 @@ async function runPlatformAuthRecovery(args) {
 				const url = new URL("/auth/test", manifest.endpoints.apiUrl);
 				url.searchParams.set("id", testId);
 				url.searchParams.set("proof", proof);
-				console.log(`Complete the recovery login in your browser: ${url.href}`);
-				if (process.stdin.isTTY) openBrowser(url.href, execFile);
+				console.log(`Complete the recovery login in your browser: ${formatUrl(url.href)}`);
+				if (process.stdin.isTTY) openBrowser(url.href);
 				let tested;
 				while (Date.now() < Date.parse(expiresAt)) {
 					tested = (await db.query("SELECT issuer,subject,login FROM platform_login_tests WHERE id = $1 AND user_id = $2 AND expires_at > now()", [testId, input.administratorUserId])).rows[0];

package/dist/{platform-cmd-BbmJiq5O.mjs → platform-cmd-Cuj4oUVo.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-BbY1dWiM.mjs";
+import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-DxxZO6e5.mjs";
 export { discoverPlatform, runPlatformCommand };

package/dist/{platform-cmd-BbY1dWiM.mjs → platform-cmd-DxxZO6e5.mjs}

@@ -1,9 +1,9 @@
-import { b as selectPlatformConnection, c as normalizePlatformApiUrl, i as getActivePlatformConnection, l as platformConnectionSlug, o as listInstallationManifests, s as listPlatformConnections, y as savePlatformConnection } from "./platform-registry-Cjv2Qf0r.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-BcIBSKqG.mjs";
+import { b as selectPlatformConnection, c as normalizePlatformApiUrl, i as getActivePlatformConnection, l as platformConnectionSlug, o as listInstallationManifests, s as listPlatformConnections, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
+import { r as isCloudflareAccessChallenge, t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { K as select, L as log, X as text, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess, l as import_picocolors } from "./output-C50ag2r3.mjs";
-import { n as readPlatformDiscoveryResponse, t as PlatformDisabledError } from "./platform-discovery-DIYz8V63.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess } from "./output-FNHKw5Ac.mjs";
+import { n as readPlatformDiscoveryResponse, t as PlatformDisabledError } from "./platform-discovery-CHhNs8Nn.mjs";
 //#region src/cli/platform-cmd.ts
 function normalizePlatformInputUrl(input) {
 	const value = input.trim();
@@ -12,7 +12,7 @@ function normalizePlatformInputUrl(input) {
 }
 async function discoverPlatform(input, fetcher = fetch) {
 	const apiUrl = normalizePlatformInputUrl(input);
-	ensureCloudflaredToken(apiUrl);
+	ensurePlatformAccessToken(apiUrl);
 	const request = () => fetcher(`${apiUrl}/.well-known/void-platform`, {
 		headers: {
 			Accept: "application/json",
@@ -66,7 +66,7 @@ async function resolveConnection(selector) {
 function showPlatform(connection, installations) {
 	const slug = platformConnectionSlug(connection, installations);
 	console.log(`  ${import_picocolors.default.bold(connection.displayName)}${slug ? ` ${import_picocolors.default.dim(`(${slug})`)}` : ""}`);
-	console.log(`    ${connection.apiUrl}`);
+	console.log(`    ${formatUrl(connection.apiUrl)}`);
 	if (connection.applicationDomain) console.log(connection.applicationDomain.endsWith(".workers.dev") ? "    apps: workers.dev (testing)" : `    apps: *.${connection.applicationDomain}`);
 }
 function saveDiscoveredPlatform(discovery) {
@@ -96,19 +96,19 @@ async function runPlatformCommand(_root, args) {
 					}]
 				});
 				if (isCancel(group)) return;
-				const { parsePlatformArgs } = await import("./platform-args-D4E1PjVw.mjs");
+				const { parsePlatformArgs } = await import("./platform-args-Cm7x-fot.mjs");
 				return runPlatformCommand(_root, parsePlatformArgs(["config", group]));
 			}
-			const { runPlatformPlansConfig } = await import("./platform-plans-config-CN-heS4q.mjs");
+			const { runPlatformPlansConfig } = await import("./platform-plans-config-CNH6zbPX.mjs");
 			await runPlatformPlansConfig(args);
 			return;
 		}
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-CkSx3usH.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-CJmNkFT2.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-CwBB-1yb.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-Cjk5DiRx.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -166,8 +166,8 @@ async function runPlatformCommand(_root, args) {
 			throw error;
 		}
 		log.info(`${discovery.displayName} is reachable.`);
-		console.log(`API: ${discovery.apiUrl}`);
-		console.log(`Proxy: ${discovery.proxyUrl}`);
+		console.log(`API: ${formatUrl(discovery.apiUrl)}`);
+		console.log(`Proxy: ${formatUrl(discovery.proxyUrl)}`);
 		if (discovery.applicationRouting?.workersDev && !discovery.applicationRouting.zoneName) {
 			console.log("Application domain: workers.dev (testing)");
 			console.log("Add a domain: void platform domain set <domain>");
@@ -176,7 +176,7 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-ByAlpkhV.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-_gfnjUBr.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 function showSavedInstallationStatus(manifest) {
@@ -187,7 +187,7 @@ function showSavedInstallationStatus(manifest) {
 		console.log(`Saved operation: ${operation.action} — ${operation.phase}`);
 		console.log(`Runtime: ${operation.fromVersion ?? "new installation"} → ${operation.toVersion}`);
 	}
-	if (manifest.endpoints.apiUrl) console.log(`Administrator status: ${manifest.endpoints.apiUrl}/admin/status`);
+	if (manifest.endpoints.apiUrl) console.log(`Administrator status: ${formatUrl(`${manifest.endpoints.apiUrl}/admin/status`)}`);
 }
 //#endregion
 export { saveDiscoveredPlatform as i, promptPlatformUrl as n, runPlatformCommand as r, discoverPlatform as t };

package/dist/{platform-discovery-DIYz8V63.mjs → platform-discovery-CHhNs8Nn.mjs}

@@ -1,4 +1,4 @@
-import { c as normalizePlatformApiUrl } from "./platform-registry-Cjv2Qf0r.mjs";
+import { c as normalizePlatformApiUrl } from "./platform-registry-B9mWX9LO.mjs";
 import { parsePlatformDiscoveryDocument } from "@void/platform";
 //#region src/cli/platform-discovery.ts
 /** Discovery was refused because the platform traffic gate is closed. */

package/dist/{platform-domain-CHVS6cV0.mjs → platform-domain-zLXnW1G_.mjs}

@@ -1,9 +1,9 @@
-import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-Cjv2Qf0r.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { A as confirm, X as text, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess, u as note } from "./output-C50ag2r3.mjs";
-import { B as assertPlatformOperatorCredentialCanApplyPlan, K as PlatformCloudflareClient, M as recordPlatformWorkerTraffic, O as createPlatformHealthProbeToken, P as createPlatformInstallPlan, V as resolvePlatformCloudflareCredential, j as recordResource, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-DzCwqhFq.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-CuuVDhyt.mjs";
+import { m as printSuccess, p as note } from "./output-FNHKw5Ac.mjs";
+import { M as assertPlatformOperatorCredentialCanApplyPlan, N as resolvePlatformCloudflareCredential, b as recordPlatformWorkerTraffic, h as createPlatformHealthProbeToken, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, v as recordResource, x as createPlatformInstallPlan, z as PlatformCloudflareClient } from "./platform-lifecycle-DOW-wLfx.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-t7HKy4-U.mjs";
 import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {