void 0.7.9 → 0.7.11

package/dist/{auth-cmd-D3DNf9j9.mjs → auth-cmd-bS88H4Lb.mjs}

@@ -1,6 +1,6 @@
-import { c as R } from "./dist-Dayj3gCK.mjs";
-import { c as getToken, d as removeToken, n as PlatformClient } from "./client-Dw8roLzc.mjs";
-import { n as runLoginCommand } from "./login-21aIqVPD.mjs";
+import { c as getToken, d as removeToken, n as PlatformClient } from "./client-C_DYiXeu.mjs";
+import { c as R } from "./dist-D2L3_KTK.mjs";
+import { n as runLoginCommand } from "./login-C_MfDjhu.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/auth-cmd.ts
 async function runAuthCommand(root, args) {

package/dist/{better-auth-shared-CjnJZFC0.mjs → better-auth-shared-D2JaoCs4.mjs}

@@ -1,4 +1,4 @@
-import { a as isVoidSocialAuthProvider, r as getVoidAuthProviderEnvNames } from "./providers-B3aMxWzP.mjs";
+import { a as isVoidSocialAuthProvider, r as getVoidAuthProviderEnvNames } from "./providers-BlFNPYen.mjs";
 import { authContext } from "./runtime/auth.mjs";
 import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
 import { betterAuth } from "better-auth";

package/dist/{cache-DcDAmion.mjs → cache-DUDCNty6.mjs}

@@ -1,7 +1,7 @@
-import { i as dim, n as cliTitle, r as createSpinner } from "./output-BwlcIYSR.mjs";
-import { c as R, g as ge, y as ye } from "./dist-Dayj3gCK.mjs";
-import { r as readProjectConfig } from "./project-TqORyHn8.mjs";
-import { c as getToken, n as PlatformClient } from "./client-Dw8roLzc.mjs";
+import { i as dim, n as cliTitle, r as createSpinner } from "./output-D3g5otMC.mjs";
+import { c as getToken, n as PlatformClient } from "./client-C_DYiXeu.mjs";
+import { c as R, g as ge, y as ye } from "./dist-D2L3_KTK.mjs";
+import { r as readProjectConfig } from "./project-DhB4A8_g.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-DdjLQ2tB.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {

package/dist/{cancel-deploy-CrMlOCW0.mjs → cancel-deploy-DOuSbPwX.mjs}

@@ -1,7 +1,7 @@
-import { n as cliTitle } from "./output-BwlcIYSR.mjs";
-import { c as R, g as ge, v as ue, x as q, y as ye } from "./dist-Dayj3gCK.mjs";
-import { r as readProjectConfig } from "./project-TqORyHn8.mjs";
-import { c as getToken, n as PlatformClient } from "./client-Dw8roLzc.mjs";
+import { n as cliTitle } from "./output-D3g5otMC.mjs";
+import { c as getToken, n as PlatformClient } from "./client-C_DYiXeu.mjs";
+import { c as R, g as ge, v as ue, x as q, y as ye } from "./dist-D2L3_KTK.mjs";
+import { r as readProjectConfig } from "./project-DhB4A8_g.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = new Set([
 	"pending",

package/dist/cli/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as join } from "../pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { c as sectionTitle, o as helpLine, s as import_picocolors, t as categoryTitle } from "../output-BwlcIYSR.mjs";
-import { c as R, u as Se, y as ye } from "../dist-Dayj3gCK.mjs";
+import { c as sectionTitle, o as helpLine, s as import_picocolors, t as categoryTitle } from "../output-D3g5otMC.mjs";
+import { c as R, u as Se, y as ye } from "../dist-D2L3_KTK.mjs";
 import { r as getPackageDir } from "../agents-DqkFfc2c.mjs";
 import { readFileSync } from "node:fs";
 import { parseArgs } from "node:util";
@@ -1474,7 +1474,7 @@ async function runSubcommandGroup(command, subcommands, parse, run) {
 	const sub = args[1];
 	try {
 		if ((!sub || sub.startsWith("-")) && process.stdin.isTTY) {
-			const { promptSubcommand } = await import("../subcommand-prompt-BMS1TNG5.mjs");
+			const { promptSubcommand } = await import("../subcommand-prompt-q9T06dpg.mjs");
 			const result = await promptSubcommand(command, subcommands);
 			if (!result) process.exit(0);
 			await run(root, parse(buildArgs(result, args.slice(1))));
@@ -1503,7 +1503,7 @@ else if (command === "deploy") {
 		R.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../deploy-Bfn434ed.mjs").then((n) => n.t).then(({ runDeploy }) => {
+	import("../deploy-CPAEgVQm.mjs").then((n) => n.t).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -1515,13 +1515,13 @@ else if (command === "deploy") {
 			process.exit(1);
 		});
 	});
-} else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-D3DNf9j9.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-qzFonrph.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-DAfThcYQ.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-DUFBO_ob.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-Daa0zMHP.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Bt-92Ji0.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-CpeKIqlM.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+} else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-bS88H4Lb.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-CeXO06hG.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-NDvlqAN2.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-Dvj7u8tr.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-j-XdTjQD.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Bjl0rzuf.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-DU8NIdrH.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
 else if (command === "prepare") {
 	const root = process.cwd();
 	let prepareArgs;
@@ -1531,7 +1531,7 @@ else if (command === "prepare") {
 		R.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../prepare-CKzO06-Z.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-BEkH89oX.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			R.error(err.message ?? err);
 			process.exit(1);
@@ -1539,7 +1539,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-DwJ0Z0SL.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-iIiQWzyB.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -1552,7 +1552,7 @@ else if (command === "prepare") {
 			process.exit(1);
 		});
 	});
-} else if (command === "mcp") import("../mcp-CJduPlRn.mjs").then(({ runMcp }) => {
+} else if (command === "mcp") import("../mcp-vA0880_K.mjs").then(({ runMcp }) => {
 	runMcp();
 });
 else if (command === "-v" || command === "--version") {
@@ -1621,36 +1621,36 @@ else if (command === "-v" || command === "--version") {
 	];
 	(async () => {
 		printVoidHeader();
-		const { promptSubcommand } = await import("../subcommand-prompt-BMS1TNG5.mjs");
+		const { promptSubcommand } = await import("../subcommand-prompt-q9T06dpg.mjs");
 		const result = await promptSubcommand("", topLevelCommands);
 		if (!result) process.exit(0);
 		const cmd = result.subcommand;
 		const root = process.cwd();
 		switch (cmd) {
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-DwJ0Z0SL.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-iIiQWzyB.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-Bfn434ed.mjs").then((n) => n.t);
+				const { runDeploy } = await import("../deploy-CPAEgVQm.mjs").then((n) => n.t);
 				await runDeploy(root);
 				return;
 			}
 			case "mcp": {
-				const { runMcp } = await import("../mcp-CJduPlRn.mjs");
+				const { runMcp } = await import("../mcp-vA0880_K.mjs");
 				runMcp();
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-D3DNf9j9.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-qzFonrph.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-DAfThcYQ.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-DUFBO_ob.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-Daa0zMHP.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Bt-92Ji0.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-CpeKIqlM.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-bS88H4Lb.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-CeXO06hG.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-NDvlqAN2.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-Dvj7u8tr.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-j-XdTjQD.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Bjl0rzuf.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-DU8NIdrH.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-CKzO06-Z.mjs");
+				const { runPrepareCommand } = await import("../prepare-BEkH89oX.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}

package/dist/{client-Dw8roLzc.mjs → client-C_DYiXeu.mjs}

@@ -1,14 +1,86 @@
 import { n as __exportAll } from "./chunk-DJd-R1mw.mjs";
 import { a as join } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { s as import_picocolors } from "./output-BwlcIYSR.mjs";
-import { t as isVoidInternalStaging } from "./project-TqORyHn8.mjs";
-import { t as cfAccessHeaders } from "./cf-access-Dee5cXxL.mjs";
+import { s as import_picocolors } from "./output-D3g5otMC.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BW8K93Fm.mjs";
+import { t as isVoidInternalStaging } from "./project-DhB4A8_g.mjs";
 import { r as getPackageDir } from "./agents-DqkFfc2c.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { Entry } from "@napi-rs/keyring";
 import { spawnSync } from "node:child_process";
+//#region src/cli/cf-access.ts
+const probedHosts = /* @__PURE__ */ new Set();
+/**
+* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
+* probe the locally-installed `cloudflared` binary for a cached user JWT
+* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
+* token, open a browser login flow to populate the cache, then re-read it.
+*
+* Cached per-host so that an early non-gated call (e.g. prod) does not
+* permanently disable the probe for a later gated call (e.g. staging) in
+* the same process. Noop when:
+*   - a service-token pair is already set (CI path)
+*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
+*   - the target host is not gated
+*   - `cloudflared` is not installed
+*/
+function ensureCloudflaredToken(apiUrl) {
+	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
+	if (process.env.CF_ACCESS_TOKEN) return;
+	if (!isGatedHost(apiUrl)) return;
+	const host = new URL(apiUrl).hostname;
+	if (probedHosts.has(host)) return;
+	probedHosts.add(host);
+	let token = runCloudflared([
+		"access",
+		"token",
+		`-app=${apiUrl}`
+	]);
+	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
+		runCloudflared([
+			"access",
+			"login",
+			apiUrl
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+		token = runCloudflared([
+			"access",
+			"token",
+			`-app=${apiUrl}`
+		]);
+	}
+	if (token) process.env.CF_ACCESS_TOKEN = token;
+}
+function runCloudflared(args, opts) {
+	try {
+		const result = spawnSync("cloudflared", args, {
+			encoding: "utf-8",
+			stdio: opts?.inherit ? "inherit" : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			timeout: opts?.timeoutMs ?? 5e3
+		});
+		if (result.error || result.status !== 0) return null;
+		const out = (result.stdout ?? "").trim();
+		return out.length > 0 ? out : null;
+	} catch {
+		return null;
+	}
+}
+function isGatedHost(apiUrl) {
+	try {
+		const host = new URL(apiUrl).hostname;
+		return host.endsWith(".staging.void.cloud") || host.endsWith(".staging.void.app");
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/cli/auth.ts
 const CONFIG_DIR = join(homedir(), ".void");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
@@ -103,6 +175,40 @@ function removeToken(root = process.cwd()) {
 }
 const DEFAULT_API_URL = "https://api.void.cloud";
 const STAGING_API_URL = "https://api.staging.void.cloud";
+function base64Url(buffer) {
+	return buffer.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function createCodeVerifier() {
+	return base64Url(randomBytes(32));
+}
+function createCodeChallenge(verifier) {
+	return base64Url(createHash("sha256").update(verifier).digest());
+}
+async function exchangeLoginCode(apiUrl, code, state, codeVerifier) {
+	const base = apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
+	ensureCloudflaredToken(apiUrl);
+	const res = await fetch(new URL("auth/cli/token", base), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...cfAccessHeaders(process.env)
+		},
+		body: JSON.stringify({
+			code,
+			state,
+			code_verifier: codeVerifier
+		})
+	});
+	if (!res.ok) throw new Error(`auth: Failed to exchange login code (${res.status}). Try logging in again.`);
+	let body;
+	try {
+		body = await res.json();
+	} catch {
+		throw new Error("auth: Login code exchange returned an invalid response.");
+	}
+	if (!body || typeof body !== "object" || !("token" in body) || typeof body.token !== "string" || body.token.length === 0) throw new Error("auth: Login code exchange did not return a token.");
+	return body.token;
+}
 /**
 * Read the API URL from environment or config file.
 * Priority: VOID_API_URL env var > ~/.void/config.json > default
@@ -134,7 +240,8 @@ function openBrowser(url, exec) {
 }
 /**
 * Start a local HTTP server, open the browser to the platform login page,
-* and wait for the OAuth callback with a JWT token.
+* and wait for the OAuth callback with a short-lived code. The CLI exchanges
+* the code itself so the localhost callback never accepts bearer tokens.
 *
 * `onUrl` is invoked with the login URL once the local server is listening,
 * so callers can show the URL to the user as a manual fallback when the
@@ -145,8 +252,23 @@ async function runLogin(root = process.cwd(), provider = "github", onUrl) {
 	const { exec } = await import("node:child_process");
 	const apiUrl = getApiUrl(root);
 	const state = randomBytes(32).toString("hex");
+	const codeVerifier = createCodeVerifier();
+	const codeChallenge = createCodeChallenge(codeVerifier);
 	return new Promise((resolve, reject) => {
-		const server = http.createServer((req, res) => {
+		let settled = false;
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			server.close();
+			reject(error);
+		};
+		const succeed = (token) => {
+			if (settled) return;
+			settled = true;
+			server.close();
+			resolve(token);
+		};
+		const server = http.createServer(async (req, res) => {
 			const url = new URL(req.url, `http://localhost`);
 			if (url.pathname !== "/callback") {
 				res.writeHead(404);
@@ -161,22 +283,32 @@ async function runLogin(root = process.cwd(), provider = "github", onUrl) {
 			if (url.searchParams.get("error") === "signup_restricted") {
 				res.writeHead(403, { "Content-Type": "text/html" });
 				res.end(page("Signup restricted", "Your email is not on the approved list for this environment."));
-				server.close();
-				reject(/* @__PURE__ */ new Error("Signup restricted: your email is not on the approved list for this environment."));
+				fail(/* @__PURE__ */ new Error("Signup restricted: your email is not on the approved list for this environment."));
+				return;
+			}
+			if (url.searchParams.has("token")) {
+				res.writeHead(400, { "Content-Type": "text/html" });
+				res.end(page("Login failed", "Invalid login callback. Please try again."));
 				return;
 			}
-			const token = url.searchParams.get("token");
-			if (!token) {
+			const code = url.searchParams.get("code");
+			if (!code) {
 				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(page("Login failed", "No token received. Please try again."));
-				server.close();
-				reject(/* @__PURE__ */ new Error("auth: No token received from callback. Try logging in again."));
+				res.end(page("Login failed", "No authorization code received. Please try again."));
+				return;
+			}
+			let token;
+			try {
+				token = await exchangeLoginCode(apiUrl, code, state, codeVerifier);
+			} catch (err) {
+				res.writeHead(400, { "Content-Type": "text/html" });
+				res.end(page("Login failed", "Could not complete login. Please try again."));
+				fail(err instanceof Error ? err : /* @__PURE__ */ new Error("auth: Failed to complete login."));
 				return;
 			}
 			res.writeHead(200, { "Content-Type": "text/html" });
 			res.end(page("Login successful!", "You can close this tab and return to the terminal."));
-			server.close();
-			resolve(token);
+			succeed(token);
 		});
 		server.on("connection", (socket) => socket.unref());
 		server.listen(0, "127.0.0.1", () => {
@@ -191,88 +323,17 @@ async function runLogin(root = process.cwd(), provider = "github", onUrl) {
 			const loginUrl = new URL("auth/login", apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`);
 			loginUrl.searchParams.set("redirect", redirect.href);
 			loginUrl.searchParams.set("provider", provider);
+			loginUrl.searchParams.set("code_challenge", codeChallenge);
+			loginUrl.searchParams.set("code_challenge_method", "S256");
 			onUrl?.(loginUrl.href);
 			openBrowser(loginUrl.href, exec);
 		});
 		setTimeout(() => {
-			server.close();
-			reject(/* @__PURE__ */ new Error("auth: Login timed out after 5 minutes. Try again."));
+			fail(/* @__PURE__ */ new Error("auth: Login timed out after 5 minutes. Try again."));
 		}, 300 * 1e3).unref();
 	});
 }
 //#endregion
-//#region src/cli/cf-access.ts
-const probedHosts = /* @__PURE__ */ new Set();
-/**
-* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
-* probe the locally-installed `cloudflared` binary for a cached user JWT
-* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
-* token, open a browser login flow to populate the cache, then re-read it.
-*
-* Cached per-host so that an early non-gated call (e.g. prod) does not
-* permanently disable the probe for a later gated call (e.g. staging) in
-* the same process. Noop when:
-*   - a service-token pair is already set (CI path)
-*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
-*   - the target host is not gated
-*   - `cloudflared` is not installed
-*/
-function ensureCloudflaredToken(apiUrl) {
-	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
-	if (process.env.CF_ACCESS_TOKEN) return;
-	if (!isGatedHost(apiUrl)) return;
-	const host = new URL(apiUrl).hostname;
-	if (probedHosts.has(host)) return;
-	probedHosts.add(host);
-	let token = runCloudflared([
-		"access",
-		"token",
-		`-app=${apiUrl}`
-	]);
-	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
-		runCloudflared([
-			"access",
-			"login",
-			apiUrl
-		], {
-			inherit: true,
-			timeoutMs: 12e4
-		});
-		token = runCloudflared([
-			"access",
-			"token",
-			`-app=${apiUrl}`
-		]);
-	}
-	if (token) process.env.CF_ACCESS_TOKEN = token;
-}
-function runCloudflared(args, opts) {
-	try {
-		const result = spawnSync("cloudflared", args, {
-			encoding: "utf-8",
-			stdio: opts?.inherit ? "inherit" : [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			timeout: opts?.timeoutMs ?? 5e3
-		});
-		if (result.error || result.status !== 0) return null;
-		const out = (result.stdout ?? "").trim();
-		return out.length > 0 ? out : null;
-	} catch {
-		return null;
-	}
-}
-function isGatedHost(apiUrl) {
-	try {
-		const host = new URL(apiUrl).hostname;
-		return host.endsWith(".staging.void.cloud") || host.endsWith(".staging.void.app");
-	} catch {
-		return false;
-	}
-}
-//#endregion
 //#region src/cli/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	PlatformApiError: () => PlatformApiError,

package/dist/{config-DqkeX_Fa.mjs → config-CeRQg3Lz.mjs}

@@ -1,6 +1,6 @@
 import { n as __exportAll } from "./chunk-DJd-R1mw.mjs";
 import { a as join } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { i as isVoidAuthProvider, t as VOID_AUTH_PROVIDERS } from "./providers-B3aMxWzP.mjs";
+import { i as isVoidAuthProvider, t as VOID_AUTH_PROVIDERS } from "./providers-BlFNPYen.mjs";
 import { readFileSync } from "node:fs";
 //#region src/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({

package/dist/{config-BzM9Dy7T.mjs → config-DyUSwbeX.mjs}

@@ -1,6 +1,6 @@
 import { n as __exportAll } from "./chunk-DJd-R1mw.mjs";
 import { a as join } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { r as schemaSpecifier, t as discoverSchema } from "./discover-B7FkXBLB.mjs";
+import { r as schemaSpecifier, t as discoverSchema } from "./discover-CKGQpis8.mjs";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/drizzle/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({ writeDrizzleConfig: () => writeDrizzleConfig });

package/dist/{create-project-CcPOkfA4.mjs → create-project-hvFe6rbI.mjs}

@@ -1,7 +1,7 @@
-import { s as import_picocolors } from "./output-BwlcIYSR.mjs";
-import { _ as me, c as R, i as Ee, l as Re, x as q } from "./dist-Dayj3gCK.mjs";
-import { a as writeProjectConfig } from "./project-TqORyHn8.mjs";
-import { s as getSiteDomain, t as PlatformApiError } from "./client-Dw8roLzc.mjs";
+import { s as import_picocolors } from "./output-D3g5otMC.mjs";
+import { s as getSiteDomain, t as PlatformApiError } from "./client-C_DYiXeu.mjs";
+import { _ as me, c as R, i as Ee, l as Re, x as q } from "./dist-D2L3_KTK.mjs";
+import { a as writeProjectConfig } from "./project-DhB4A8_g.mjs";
 import { n as validateProjectSlug } from "./project-slug-KRvHQEQI.mjs";
 import { n as inferDefaultSlug } from "./resolve-project-DdjLQ2tB.mjs";
 //#region src/cli/prompt.ts