void 0.27.0 → 1.0.3

package/dist/mysql-migration-sql-BIS5vbNk.mjs

@@ -0,0 +1,241 @@
+import { n as splitMigrationSql } from "./migration-handler-Cg0Y4EPu.mjs";
+import { createHash, randomUUID } from "node:crypto";
+//#region src/runtime/migration-lock-mysql.ts
+/**
+* Migration runs on one MySQL database exclude each other with two kinds of lock, and each run
+* checks for the other kind after it takes its own:
+*
+* - The CLI runner holds a named lock (GET_LOCK) for its session, so it ends with the connection.
+* - The hosted handler reaches MySQL through Hyperdrive, which pools connections per transaction,
+*   so a session lock could stay on a pooled connection or be reset away. It writes a lease row
+*   with an expiry instead, using one statement at a time. Lease times are UTC: NOW() follows
+*   each session's time zone and its DST changes, and DATETIME stores no zone.
+*/
+/** Hyperdrive ends a statement after 60 seconds, and the hosted handler renews before each one. */
+const LEASE_SECONDS = 120;
+/** A deploy waits long enough for the lease of a run that stopped early to expire. */
+const DEPLOY_WAIT_MS = 13e4;
+const POLL_MS = 1e3;
+/** How often the lease is renewed while statements that cannot renew it themselves run. */
+const KEEP_ALIVE_MS = 3e4;
+/**
+* The CLI runner's named lock. Lock names are server-wide and at most 64 characters, so the name
+* carries a hash of the database name. Vitess reports a connection's target (`app@primary`,
+* `app:-80@replica`) in DATABASE(), and the lock belongs to the keyspace.
+*/
+function mySqlMigrationLockName(database) {
+	return `void_migrations:${createHash("sha1").update(database.split(/[:@]/)[0]).digest("hex")}`;
+}
+function mySqlMigrationLockError(database, retry) {
+	return /* @__PURE__ */ new Error(`Another migration run is applying migrations to MySQL database "${database}". Wait for it to finish, then ${retry}.`);
+}
+/**
+* Seconds left on a deploy's lease, or undefined when no deploy holds one. The CLI runner calls
+* this while it holds the named lock.
+*/
+async function readMySqlMigrationLease(query) {
+	try {
+		const [row] = rowsOf(await query("SELECT TIMESTAMPDIFF(SECOND, UTC_TIMESTAMP(6), `expires_at`) AS remaining FROM `_void_migration_lock` WHERE `name` = 'app' AND `expires_at` > UTC_TIMESTAMP(6)"));
+		return row ? Number(row.remaining) : void 0;
+	} catch (error) {
+		if (isMissingTable(error)) return;
+		throw error;
+	}
+}
+/**
+* Takes the lease for a hosted run. It waits while another deploy holds the lease or a CLI run
+* holds the named lock, and throws when that takes too long.
+*/
+async function acquireMySqlMigrationLease(query) {
+	const [row] = rowsOf(await query("SELECT DATABASE() AS db"));
+	const database = String(row?.db ?? "");
+	const lockName = mySqlMigrationLockName(database);
+	const owner = randomUUID();
+	await query("CREATE TABLE IF NOT EXISTS `_void_migration_lock` (`name` VARCHAR(64) NOT NULL PRIMARY KEY, `owner` VARCHAR(64) NOT NULL, `expires_at` DATETIME(6) NOT NULL)");
+	const lease = {
+		async renew() {
+			if (affectedRows(await query("UPDATE `_void_migration_lock` SET `expires_at` = UTC_TIMESTAMP(6) + INTERVAL ? SECOND WHERE `name` = 'app' AND `owner` = ? AND `expires_at` > UTC_TIMESTAMP(6)", [LEASE_SECONDS, owner])) !== 1) throw new Error(`The migration lock on MySQL database "${database}" expired before this run finished. Deploy again.`);
+		},
+		async release() {
+			await query("UPDATE `_void_migration_lock` SET `expires_at` = UTC_TIMESTAMP(6) - INTERVAL 1 SECOND WHERE `name` = 'app' AND `owner` = ?", [owner]);
+		}
+	};
+	const deadline = Date.now() + DEPLOY_WAIT_MS;
+	for (;;) {
+		if (await take(query, owner)) {
+			const [lock] = rowsOf(await query("SELECT IS_USED_LOCK(?)", [lockName]));
+			if (Object.values(lock ?? {})[0] == null) return lease;
+			await lease.release();
+		}
+		if (Date.now() >= deadline) throw mySqlMigrationLockError(database, "deploy again");
+		await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+	}
+}
+/**
+* Runs `work`, whose statements cannot renew the lease before each one (Better Auth's migrations),
+* and renews the lease in the background meanwhile. Throws after `work` when a renewal failed,
+* because another run may have taken the lease.
+*/
+async function holdMySqlMigrationLease(lease, work) {
+	await lease.renew();
+	let failure;
+	let renewal = Promise.resolve();
+	const timer = setInterval(() => {
+		renewal = renewal.then(() => lease.renew()).catch((error) => {
+			failure ??= { error };
+		});
+	}, KEEP_ALIVE_MS);
+	let result;
+	try {
+		result = await work();
+	} finally {
+		clearInterval(timer);
+		await renewal;
+	}
+	if (failure) throw failure.error;
+	return result;
+}
+async function take(query, owner) {
+	try {
+		return await tryTake(query, owner);
+	} catch (error) {
+		if (errnoOf(error) === 1213) return false;
+		throw error;
+	}
+}
+async function tryTake(query, owner) {
+	if (affectedRows(await query("INSERT IGNORE INTO `_void_migration_lock` (`name`, `owner`, `expires_at`) VALUES ('app', ?, UTC_TIMESTAMP(6) + INTERVAL ? SECOND)", [owner, LEASE_SECONDS])) === 1) return true;
+	return affectedRows(await query("UPDATE `_void_migration_lock` SET `owner` = ?, `expires_at` = UTC_TIMESTAMP(6) + INTERVAL ? SECOND WHERE `name` = 'app' AND `expires_at` < UTC_TIMESTAMP(6)", [owner, LEASE_SECONDS])) === 1;
+}
+function rowsOf(result) {
+	return Array.isArray(result) ? result : [];
+}
+function affectedRows(result) {
+	return Number(result?.affectedRows ?? 0);
+}
+function isMissingTable(error) {
+	const value = typeof error === "object" && error !== null ? error : void 0;
+	return value?.code === "ER_NO_SUCH_TABLE" || value?.errno === 1146;
+}
+function errnoOf(error) {
+	return typeof error === "object" && error !== null ? error.errno : void 0;
+}
+//#endregion
+//#region src/runtime/mysql-migration-sql.ts
+/**
+* Splits a MySQL migration file into the statements Void runs one query at a time. Hyperdrive
+* does not accept several statements in one query, and a file that runs statement by statement
+* can tell whether a failure left earlier statements committed.
+*
+* The file first splits at drizzle-kit `--> statement-breakpoint` lines. Each part then splits at
+* semicolons outside strings, quoted names and comments, and drops comments after its last
+* statement. A statement that defines a trigger, routine or event keeps the rest of its part with
+* it: the semicolons in its BEGIN ... END body cannot be told apart from the ones between
+* statements without a parser.
+*/
+function splitMySqlMigrationSql(sql) {
+	return splitMySqlMigrationStatements(sql).map((statement) => statement.sql);
+}
+/** {@link splitMySqlMigrationSql}, with each statement marked. */
+function splitMySqlMigrationStatements(sql) {
+	return splitMigrationSql(sql).flatMap((part) => {
+		const statements = splitMySqlStatements(part);
+		return statements.length > 0 ? statements : [{
+			sql: part,
+			program: false
+		}];
+	});
+}
+/**
+* The start of a statement whose body can hold semicolons: a stored program, after options such
+* as DEFINER, or a compound statement that MariaDB also runs outside one. It is matched against
+* the statement with quoted text and comments blanked out, so a column named `event` or a plain
+* `BEGIN` transaction does not match.
+*/
+const COMPOUND_START = new RegExp([
+	`^\\s*(?:CREATE|ALTER)\\s+(?:(?!(?:TABLE|INDEX|VIEW|DATABASE|SCHEMA|USER|ROLE|TABLESPACE|SERVER|UNIQUE|FULLTEXT|SPATIAL|TEMPORARY)\\b)\\S+\\s+){0,8}?(?:TRIGGER|PROCEDURE|FUNCTION|EVENT|PACKAGE)\\b`,
+	"^\\s*BEGIN\\s+NOT\\s+ATOMIC\\b",
+	"^\\s*(?:\\w+\\s*:\\s*)?(?:BEGIN|IF|CASE|LOOP|REPEAT|WHILE)\\b(?!\\s*(?:WORK\\s*)?$)"
+].join("|"), "i");
+/** The statements in `sql`, without the comments around them. */
+function splitMySqlStatements(sql) {
+	const statements = [];
+	let bare = "";
+	let start = -1;
+	let end = -1;
+	let compound = false;
+	let index = 0;
+	const take = (from, to) => {
+		if (start === -1) start = from;
+		end = to;
+	};
+	while (index < sql.length) {
+		const character = sql[index];
+		const next = sql[index + 1];
+		if (character === "'" || character === "\"" || character === "`") {
+			const close = skipQuoted(sql, index, character);
+			take(index, close);
+			bare += " ";
+			index = close;
+			continue;
+		}
+		if (character === "#" || character === "-" && next === "-" && !/\S/.test(sql[index + 2] ?? " ")) {
+			const newline = sql.indexOf("\n", index);
+			index = newline === -1 ? sql.length : newline;
+			bare += " ";
+			continue;
+		}
+		if (character === "/" && next === "*") {
+			const close = sql.indexOf("*/", index + 2);
+			const commentEnd = close === -1 ? sql.length : close + 2;
+			if (sql[index + 2] === "!" || sql[index + 2] === "+") take(index, commentEnd);
+			bare += " ";
+			index = commentEnd;
+			continue;
+		}
+		if (character === ";" && !compound) {
+			if (start !== -1 && COMPOUND_START.test(bare)) compound = true;
+			else {
+				if (start !== -1) statements.push({
+					sql: sql.slice(start, index + 1),
+					program: false
+				});
+				start = -1;
+				end = -1;
+				bare = "";
+				index++;
+				continue;
+			}
+		}
+		bare += character;
+		if (!/\s/.test(character)) take(index, index + 1);
+		index++;
+	}
+	if (start !== -1) statements.push({
+		sql: sql.slice(start, end),
+		program: compound
+	});
+	return statements;
+}
+/** The index after the quoted string or name that opens at `open`. */
+function skipQuoted(sql, open, quote) {
+	let index = open + 1;
+	while (index < sql.length) {
+		const character = sql[index];
+		if (character === "\\" && quote !== "`") {
+			index += 2;
+			continue;
+		}
+		if (character === quote) {
+			if (sql[index + 1] === quote) {
+				index += 2;
+				continue;
+			}
+			return index + 1;
+		}
+		index++;
+	}
+	return sql.length;
+}
+//#endregion
+export { mySqlMigrationLockError as a, holdMySqlMigrationLease as i, splitMySqlMigrationStatements as n, mySqlMigrationLockName as o, acquireMySqlMigrationLease as r, readMySqlMigrationLease as s, splitMySqlMigrationSql as t };

package/dist/nitro.d.mts

@@ -0,0 +1,30 @@
+//#region src/nitro.d.ts
+/** The parts of a Nitro instance that the module uses. */
+type NitroInstance = {
+  options: {
+    dev: boolean;
+    rootDir: string;
+    buildDir: string;
+    exportConditions?: Array<string>;
+    plugins: Array<string>;
+    virtual: Record<string, string | (() => string | Promise<string>)>;
+    rollupConfig?: {
+      plugins?: unknown;
+    };
+    cloudflare?: {
+      nodeCompat?: boolean;
+    };
+  };
+};
+/**
+ * Nitro module for apps whose server routes Nitro bundles (Nuxt and Analog). Nitro's bundler
+ * does not run Vite plugins, so without this module `void/db` in a server route, page server
+ * load or cron job is the package's D1 client without the app's schema. Register it in the
+ * Nitro config: `modules: ['void/nitro']`.
+ */
+declare const voidNitroModule: {
+  name: string;
+  setup(nitro: NitroInstance): void;
+};
+//#endregion
+export { voidNitroModule as default };

package/dist/nitro.mjs

@@ -0,0 +1,88 @@
+import { a as join, n as dirname } from "./dist-ipQi0Q8y.mjs";
+import { d as readConfig, s as getDatabaseDialect } from "./config-Bx_1SpnO.mjs";
+import { r as voidDbBundlerPlugin } from "./dispatch-DrTTk8Xg.mjs";
+import { n as bundleWorkerSqlDriver } from "./wrapper-CwhpNWtH.mjs";
+import { fileURLToPath } from "node:url";
+import { normalizePath } from "vite";
+import { resolve } from "node:path/win32";
+//#region src/nitro.ts
+const envModuleFile = fileURLToPath(import.meta.resolve("#self/_env"));
+const packageDistDir = `${normalizePath(dirname(dirname(envModuleFile)))}/`;
+const REQUEST_SCOPE_PLUGIN = "#void/nitro-request-scope";
+const NODEJS_COMPAT_FLAGS = /* @__PURE__ */ new Set(["nodejs_compat", "nodejs_compat_v2"]);
+/**
+* `path` as Nitro's Rollup names its modules: with backslashes on Windows, as its node-resolve
+* plugin returns them. That plugin looks up an absolute import, such as the `global` polyfill
+* Nitro adds to pg, by walking up from the importer to a package.json. From a module named with
+* forward slashes there, the walk does not stop at the drive root, so it never ends when no
+* package.json is above the module.
+*/
+function nitroModuleId(path) {
+	return process.platform === "win32" ? resolve(path) : path;
+}
+/**
+* A Nitro runtime plugin that runs each request in Void's request scope, as the Class A wrapper
+* does, so void/db keeps one PostgreSQL or MySQL client per request instead of one per query.
+*/
+function requestScopePluginSource() {
+	return `import { withRuntimeEnv } from ${JSON.stringify(envModuleFile)};
+
+export default function voidRequestScope(nitroApp) {
+  const handler = nitroApp.h3App.handler;
+  // Nitro's Cloudflare entry and dev plugins keep the env here; a dev plugin may first set a
+  // promise of it.
+  nitroApp.h3App.handler = async (event) =>
+    withRuntimeEnv(await globalThis.__env__, () => handler(event));
+}
+`;
+}
+/**
+* Keep Void's `node:async_hooks` imports for workerd's own module. With its `cloudflare.nodeCompat`
+* option off, Nitro bundles a stub whose AsyncLocalStorage loses the request scope at the first
+* await.
+*/
+const nativeAsyncHooksPlugin = {
+	name: "void:nitro-async-hooks",
+	resolveId(id, importer) {
+		if (id === "node:async_hooks" && importer !== void 0 && normalizePath(importer).startsWith(packageDistDir)) return {
+			id,
+			external: true
+		};
+		return null;
+	}
+};
+/**
+* Nitro module for apps whose server routes Nitro bundles (Nuxt and Analog). Nitro's bundler
+* does not run Vite plugins, so without this module `void/db` in a server route, page server
+* load or cron job is the package's D1 client without the app's schema. Register it in the
+* Nitro config: `modules: ['void/nitro']`.
+*/
+const voidNitroModule = {
+	name: "void",
+	setup(nitro) {
+		const { options } = nitro;
+		const config = readConfig(options.rootDir);
+		const dialect = getDatabaseDialect(config);
+		const workerd = !options.dev && options.exportConditions?.includes("workerd") === true;
+		const plugins = [voidDbBundlerPlugin(options.rootDir, {
+			config,
+			...workerd && { sqlDriver: async (sqlDialect, entry) => nitroModuleId(await bundleWorkerSqlDriver(sqlDialect, entry, join(options.buildDir, "void"))) }
+		})];
+		const nodeCompat = (flags) => flags?.some((flag) => NODEJS_COMPAT_FLAGS.has(flag)) === true;
+		const cloudflareFlags = config.cloudflare?.compatibility_flags;
+		if (workerd && (dialect !== "sqlite" || nodeCompat(cloudflareFlags) && nodeCompat(config.worker?.compatibility_flags ?? cloudflareFlags))) {
+			options.cloudflare ??= {};
+			options.cloudflare.nodeCompat ??= true;
+		}
+		if (dialect !== "sqlite") {
+			options.virtual[REQUEST_SCOPE_PLUGIN] = requestScopePluginSource();
+			options.plugins.push(REQUEST_SCOPE_PLUGIN);
+			if (workerd) plugins.push(nativeAsyncHooksPlugin);
+		}
+		const rollupConfig = options.rollupConfig ??= {};
+		const existing = rollupConfig.plugins;
+		rollupConfig.plugins = [...plugins, ...Array.isArray(existing) ? existing : existing ? [existing] : []];
+	}
+};
+//#endregion
+export { voidNitroModule as default };

package/dist/{node-DJicPvPj.mjs → node-cPadMgUO.mjs}

@@ -1,12 +1,11 @@
-import { a as join } from "./dist-BVqXeR_h.mjs";
-import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig } from "./config-DiowPT80.mjs";
-import { r as getMiniflareDatabasePath } from "./runner-DMBKSrRk.mjs";
-import { o as loadLocalEnv } from "./env-BxocywBB.mjs";
+import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-D0GY5ItR.mjs";
+import { d as readConfig } from "./config-Bx_1SpnO.mjs";
+import { r as getMiniflareDatabasePath } from "./runner-CabsQ-iM.mjs";
+import { o as loadLocalEnv } from "./env-BJjULvL0.mjs";
 import { r as resolveVoidAuthMigrationSchema } from "./drizzle-CF84FOVM.mjs";
-import { n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-BwHgeEsD.mjs";
+import { a as pgMigrationRunner, i as mysqlMigrationRunner, n as applyPgAuthMigrations, r as applySqliteAuthMigrations, t as applyMySqlAuthMigrations } from "./auth-migrations-Cgs0k6lS.mjs";
 //#region src/auth/node.ts
-async function runLocalVoidAuthMigrations(root, dialect, persistRoot = join(root, ".void"), databaseId = "local", configPath = findVoidAuthConfig(root)) {
+async function runLocalVoidAuthMigrations(root, dialect, persistRoot, databaseId, configPath = findVoidAuthConfig(root), databaseUrl) {
 	const authConfig = await loadVoidAuthConfig(configPath);
 	const runtime = {
 		dialect,
@@ -35,21 +34,13 @@ async function runLocalVoidAuthMigrations(root, dialect, persistRoot = join(root
 		}
 		return;
 	}
-	const connectionString = typeof env.DATABASE_URL === "string" && env.DATABASE_URL.length > 0 ? env.DATABASE_URL : void 0;
+	const connectionString = databaseUrl ?? (typeof env.DATABASE_URL === "string" && env.DATABASE_URL.length > 0 ? env.DATABASE_URL : void 0);
 	if (!connectionString) return;
 	if (dialect === "mysql") {
 		const { createConnection } = await import("mysql2/promise");
 		const connection = await createConnection(connectionString);
 		try {
-			await applyMySqlAuthMigrations({
-				async all(sql, params) {
-					const [rows] = await connection.query(sql, params);
-					return rows;
-				},
-				async run(sql, params) {
-					await connection.query(sql, params);
-				}
-			}, migrationSchema);
+			await applyMySqlAuthMigrations(mysqlMigrationRunner(connection), migrationSchema);
 		} finally {
 			await connection.end();
 		}
@@ -59,14 +50,7 @@ async function runLocalVoidAuthMigrations(root, dialect, persistRoot = join(root
 	const client = new Client({ connectionString });
 	await client.connect();
 	try {
-		await applyPgAuthMigrations({
-			async all(sql, params) {
-				return (await client.query(sql, params)).rows;
-			},
-			async run(sql, params) {
-				await client.query(sql, params);
-			}
-		}, migrationSchema);
+		await applyPgAuthMigrations(pgMigrationRunner(client), migrationSchema);
 	} finally {
 		await client.end();
 	}

package/dist/{operator-args-DOBhIaIg.mjs → operator-args-UnE8Y2eK.mjs}

@@ -1,4 +1,5 @@
-import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-DbDv4vtE.mjs";
+import { t as OPERATOR_MAX_TIMEOUT_MS } from "./operator-client-C-ROjk1I.mjs";
+import { parsePlatformLoginId } from "@void/platform";
 //#region src/cli/operator-args.ts
 const operatorCommands = [
 	{
@@ -7,7 +8,7 @@ const operatorCommands = [
 		description: "Sign in as a platform administrator",
 		path: "/session",
 		values: { provider: "OAuth provider" },
-		booleans: ["token-stdin"]
+		booleans: { "token-stdin": "Read a full API session from stdin for explicit operator session exchange" }
 	},
 	{
 		group: "auth",
@@ -26,7 +27,7 @@ const operatorCommands = [
 		action: "token",
 		description: "Print an operator token; exchange an API session with --token-stdin",
 		path: "/session",
-		booleans: ["token-stdin"]
+		booleans: { "token-stdin": "Read a full API session from stdin for explicit operator session exchange" }
 	},
 	{
 		group: "user",
@@ -121,7 +122,7 @@ const operatorCommands = [
 		action: "status",
 		description: "Inspect saved platform Zero Trust configuration and project state counts",
 		path: "/zero-trust",
-		booleans: ["check"]
+		booleans: { check: "Also check the saved settings against Cloudflare Access (several API calls)" }
 	},
 	{
 		group: "zero-trust",
@@ -133,11 +134,11 @@ const operatorCommands = [
 			policies: "Comma-separated reusable Access policy IDs",
 			"existing-projects": "Required when enabling: protected or public for existing projects"
 		},
-		booleans: [
-			"token-stdin",
-			"protect-new-projects",
-			"public-apps"
-		],
+		booleans: {
+			"token-stdin": "Read the Access management API token from stdin",
+			"protect-new-projects": "Protect newly created projects by default",
+			"public-apps": "Manage public app rules without identity policies"
+		},
 		method: "POST"
 	},
 	{
@@ -230,7 +231,7 @@ const operatorCommands = [
 			since: "Duration or ISO timestamp",
 			cursor: "Opaque continuation cursor"
 		},
-		booleans: ["follow"]
+		booleans: { follow: "Poll new logs until interrupted or the build ends" }
 	},
 	{
 		group: "build",
@@ -246,7 +247,7 @@ const operatorCommands = [
 		path: "/builds/:id/logs",
 		positional: ["id"],
 		values: { since: "Last received sequence number" },
-		booleans: ["follow"]
+		booleans: { follow: "Poll new logs until interrupted or the build ends" }
 	},
 	{
 		group: "signup",
@@ -372,7 +373,7 @@ const operatorCommands = [
 		description: "Rotate project proxy tokens on tenant Workers",
 		path: "/system/rotate-proxy-tokens",
 		values: { project: "Project ID" },
-		booleans: ["all"],
+		booleans: { all: "Rotate every project" },
 		method: "POST"
 	},
 	{
@@ -437,7 +438,7 @@ const operatorCommands = [
 		path: "/email/attempts/:id/resolve",
 		positional: ["id"],
 		values: { reason: "Audit reason without recipient or message content" },
-		booleans: ["ended"],
+		booleans: { ended: "Attest that the original provider execution has ended" },
 		method: "POST"
 	},
 	{
@@ -450,7 +451,7 @@ const operatorCommands = [
 			outcome: "Provider outcome: applied or not-applied",
 			reason: "Audit reason for the verified provider outcome"
 		},
-		booleans: ["ended"],
+		booleans: { ended: "Attest that the original provider execution has ended" },
 		method: "POST"
 	},
 	{
@@ -470,7 +471,7 @@ const operatorCommands = [
 			outcome: "Provider outcome: applied or not-applied",
 			reason: "Audit reason for the verified provider outcome"
 		},
-		booleans: ["ended"],
+		booleans: { ended: "Attest that the original provider execution has ended" },
 		method: "POST"
 	},
 	{
@@ -487,7 +488,7 @@ const operatorCommands = [
 		path: "/email/domains",
 		positional: ["domain"],
 		values: { project: "Project id or slug" },
-		booleans: ["token-stdin"],
+		booleans: { "token-stdin": "Read a scoped Cloudflare API token from stdin" },
 		method: "POST"
 	},
 	{
@@ -519,7 +520,7 @@ const operatorCommands = [
 		description: "Remove an email domain and its Cloudflare setup",
 		path: "/email/domains/:domain/remove",
 		positional: ["domain"],
-		booleans: ["token-stdin"],
+		booleans: { "token-stdin": "Read a replacement Cloudflare token for blocked project cleanup from stdin" },
 		method: "POST"
 	},
 	{
@@ -573,11 +574,8 @@ function parseOperatorArgs(args) {
 		"json",
 		"plan",
 		"yes",
-		"follow",
-		"token-stdin",
 		"force",
-		"ended",
-		...operatorCommands.flatMap((command) => command.booleans ?? [])
+		...operatorCommands.flatMap((command) => Object.keys(command.booleans ?? {}))
 	]);
 	for (let index = 0; index < args.length; index++) {
 		const arg = args[index];
@@ -607,8 +605,7 @@ function parseOperatorArgs(args) {
 		yes: flags.has("yes"),
 		follow: flags.has("follow"),
 		tokenStdin: flags.has("token-stdin"),
-		provider: values.provider ?? "github",
-		...values.provider ? { providerExplicit: true } : {},
+		provider: values.provider,
 		method: "GET",
 		path: "",
 		query: {},
@@ -633,7 +630,7 @@ function parseOperatorArgs(args) {
 	for (const name of flags) if (![
 		"json",
 		...command.method ? ["yes", "plan"] : [],
-		...command.booleans ?? []
+		...Object.keys(command.booleans ?? {})
 	].includes(name)) throw new Error(`platform: Unknown flag '--${name}' for ${group} ${action}.`);
 	if (parsed.plan && parsed.yes) throw new Error("platform: --plan and --yes cannot be combined.");
 	parsed.path = command.path;
@@ -641,7 +638,11 @@ function parseOperatorArgs(args) {
 	if (identitySignupEntry) {
 		const connectionId = parameters[1];
 		const subject = parameters[2];
-		if (!/^[a-z][a-z0-9-]{0,63}$/.test(connectionId)) throw new Error("platform: Invalid login connection ID.");
+		try {
+			parsePlatformLoginId(connectionId);
+		} catch {
+			throw new Error("platform: Invalid login connection ID.");
+		}
 		if (!subject || subject.length > 255) throw new Error("platform: Identity subject must be 1–255 characters.");
 		parsed.body = {
 			type: "identity",
@@ -678,7 +679,7 @@ function parseOperatorArgs(args) {
 		"email",
 		"identity"
 	].includes(String(parsed.body.type))) throw new Error("platform: Signup grant type must be github, email, or identity.");
-	for (const name of command.booleans ?? []) if (name !== "token-stdin" && flags.has(name)) parsed.body[name] = true;
+	for (const name of Object.keys(command.booleans ?? {})) if (name !== "token-stdin" && flags.has(name)) parsed.body[name] = true;
 	if (group === "zero-trust" && action === "configure") {
 		if (!parsed.tokenStdin) throw new Error("platform: zero-trust configure requires --token-stdin.");
 		const identityProviderIds = values["identity-providers"]?.split(",").map((entry) => entry.trim()).filter(Boolean);

package/dist/{operator-auth-BEZ_u0Cz.mjs → operator-auth-Cr2zCc-J.mjs}

@@ -1,5 +1,5 @@
-import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, r as findPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-Cjv2Qf0r.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-DbDv4vtE.mjs";
+import { C as deleteKeyringPassword, T as writeKeyringPassword, c as normalizePlatformApiUrl, i as getActivePlatformConnection, r as findPlatformConnections, u as platformCredentialAccount, w as readKeyringPassword } from "./platform-registry-B9mWX9LO.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
 /** Operator authority never comes from repository-controlled metadata. */
 function resolveOperatorOrigin(connection = "") {
 	if (connection) {

package/dist/{operator-client-DbDv4vtE.mjs → operator-client-C-ROjk1I.mjs}

@@ -1,6 +1,6 @@
-import { c as normalizePlatformApiUrl } from "./platform-registry-Cjv2Qf0r.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-BcIBSKqG.mjs";
+import { c as normalizePlatformApiUrl } from "./platform-registry-B9mWX9LO.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 const OPERATOR_MAX_TIMEOUT_MS = 36e5;
 var OperatorClientError = class extends Error {
 	code;
@@ -36,7 +36,7 @@ var OperatorClient = class {
 		const timeoutMs = options.timeoutMs ?? (options.method === "POST" ? 3e5 : 3e4);
 		if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1e3 || timeoutMs > 36e5) throw new OperatorClientError(`Operator request timeout must be an integer from 1 to ${OPERATOR_MAX_TIMEOUT_MS / 1e3} seconds.`, "invalid_timeout");
 		const url = new URL(`${this.origin}/operator/v1${path}`);
-		ensureCloudflaredToken(this.origin);
+		ensurePlatformAccessToken(this.origin);
 		for (const [name, value] of Object.entries(options.query ?? {})) url.searchParams.set(name, value);
 		const timeoutController = new AbortController();
 		const timer = setTimeout(() => timeoutController.abort(), timeoutMs);

package/dist/operator-cmd-D6gnZsnK.mjs

@@ -0,0 +1 @@
+export { a as runOperatorCommand } from "./operator-cmd-DHieWtFp.mjs";

package/dist/{operator-cmd-BT4hgavL.mjs → operator-cmd-DHieWtFp.mjs}

@@ -1,6 +1,6 @@
-import { d as printSuccess, f as sanitizeTerminalText } from "./output-C50ag2r3.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-DbDv4vtE.mjs";
-import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-BEZ_u0Cz.mjs";
+import { h as sanitizeTerminalText, m as printSuccess } from "./output-Ba6ZbrzY.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
+import { a as resolveOperatorOrigin, i as removeOperatorToken, n as readOperatorApiTokenStdin, o as saveOperatorToken, r as readOperatorToken, t as exchangeOperatorSession } from "./operator-auth-Cr2zCc-J.mjs";
 import { createHash } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
@@ -163,10 +163,10 @@ async function runAuth(origin, args) {
 	if (args.action === "login" || args.action === "token" && args.tokenStdin) {
 		if (!args.tokenStdin && !process.stdin.isTTY) throw new OperatorClientError("Browser login requires an interactive terminal. Use --token-stdin to exchange an API session.", "interactive_login_required");
 		const apiToken = args.tokenStdin ? await readOperatorApiTokenStdin() : await (async () => {
-			const { discoverPlatform } = await import("./platform-cmd-BbmJiq5O.mjs");
-			const { selectPlatformLoginMethod } = await import("./login-mx_ydhmp.mjs");
-			const { runPlatformLogin } = await import("./auth-LMJcNESe.mjs");
-			return runPlatformLogin(origin, (await selectPlatformLoginMethod(await discoverPlatform(origin), args.providerExplicit ? args.provider : void 0)).id, (url) => process.stderr.write(`Sign in at ${url}\n`));
+			const { discoverPlatform } = await import("./platform-cmd-PT4YwMLM.mjs");
+			const { selectPlatformLoginMethod } = await import("./login-XD844Xs-.mjs");
+			const { runPlatformLogin } = await import("./auth-Cbqi1iVX.mjs");
+			return runPlatformLogin(origin, (await selectPlatformLoginMethod(await discoverPlatform(origin), args.provider)).id, (url) => process.stderr.write(`Sign in at ${url}\n`));
 		})();
 		const session = await exchangeOperatorSession(origin, apiToken);
 		const { token, ...identity } = session;
@@ -344,7 +344,7 @@ async function migrateDeploymentAssets(client, origin, args) {
 }
 async function runOperatorCommand(args) {
 	if (!args.action) {
-		const { printHelpPage } = await import("./help-DfQYVfGY.mjs");
+		const { printHelpPage } = await import("./help-i2YGGnTH.mjs");
 		printHelpPage(["platform", args.group]);
 		return;
 	}