void 0.9.3 → 0.10.1

package/dist/{client-DIfOFf1W.mjs → client-D4awzTnj.mjs}

@@ -223,37 +223,58 @@ function page(title, message) {
 <style>:root{color-scheme:light dark}*{margin:0;padding:0;box-sizing:border-box}body{font-family:system-ui,-apple-system,sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#fafafa;color:#111}.card{text-align:center;padding:3rem}h1{font-size:1.5rem;font-weight:600;margin-bottom:.75rem}p{color:#666;font-size:1rem}@media (prefers-color-scheme:dark){body{background:#0a0a0a;color:#fafafa}p{color:#a3a3a3}}</style>
 </head><body><div class="card"><h1>${title}</h1><p>${message}</p></div></body></html>`;
 }
-function openBrowser(url, exec) {
+function openBrowser(url, execFile) {
+	const ignore = () => {};
 	if (process.platform === "win32") {
-		exec(`start "" "${url}"`);
+		execFile("cmd.exe", [
+			"/c",
+			"start",
+			"",
+			url
+		], ignore);
 		return;
 	}
 	if (process.platform === "darwin") {
-		exec(`open "${url}"`);
+		execFile("open", [url], ignore);
 		return;
 	}
 	if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) {
-		exec(`wslview "${url}" 2>/dev/null || cmd.exe /c start "" "${url}" 2>/dev/null`);
+		execFile("wslview", [url], (error) => {
+			if (error) execFile("cmd.exe", [
+				"/c",
+				"start",
+				"",
+				url
+			], ignore);
+		});
 		return;
 	}
-	exec(`xdg-open "${url}"`);
+	execFile("xdg-open", [url], ignore);
 }
 /**
-* Start a local HTTP server, open the browser to the platform login page,
-* and wait for the OAuth callback with a short-lived code. The CLI exchanges
-* the code itself so the localhost callback never accepts bearer tokens.
+* Start a local HTTP callback server, open the browser to a caller-built
+* authorize URL, and wait for the redirect back to `http://localhost:PORT/callback`.
 *
-* `onUrl` is invoked with the login URL once the local server is listening,
-* so callers can show the URL to the user as a manual fallback when the
-* browser fails to open (common on WSL2, headless SSH, Docker, etc.).
+* The server validates the `state` it appended to the callback URL against the
+* incoming request, then runs the caller's `finalize` hook INSIDE the request
+* handler (so the browser only ever sees the success page after the underlying
+* exchange/link actually succeeded). On finalize success it renders the success
+* HTML and resolves with finalize's return value; on finalize failure it
+* renders the same "could not complete" failure page the login flow uses and
+* rejects with the thrown error. The server is always closed before settling.
+*
+* `onUrl` is invoked with the authorize URL once the local server is listening,
+* so callers can show the URL to the user as a manual fallback when the browser
+* fails to open (common on WSL2, headless SSH, Docker, etc.). To match the
+* login flow it fires immediately before the browser is opened.
+*
+* `execFile` is injectable so tests can avoid launching a real browser.
 */
-async function runLogin(root = process.cwd(), provider = "github", onUrl) {
+async function awaitBrowserCallback(options) {
 	const http = await import("node:http");
-	const { exec } = await import("node:child_process");
-	const apiUrl = getApiUrl(root);
-	const state = randomBytes(32).toString("hex");
-	const codeVerifier = createCodeVerifier();
-	const codeChallenge = createCodeChallenge(codeVerifier);
+	const { state, buildAuthUrl, finalize, describeError, validate, onUrl } = options;
+	const timeoutMs = options.timeoutMs ?? 300 * 1e3;
+	const execFile = options.execFile ?? (await import("node:child_process")).execFile;
 	return new Promise((resolve, reject) => {
 		let settled = false;
 		const fail = (error) => {
@@ -262,11 +283,11 @@ async function runLogin(root = process.cwd(), provider = "github", onUrl) {
 			server.close();
 			reject(error);
 		};
-		const succeed = (token) => {
+		const succeed = (result) => {
 			if (settled) return;
 			settled = true;
 			server.close();
-			resolve(token);
+			resolve(result);
 		};
 		const server = http.createServer(async (req, res) => {
 			const url = new URL(req.url, `http://localhost`);
@@ -280,57 +301,93 @@ async function runLogin(root = process.cwd(), provider = "github", onUrl) {
 				res.end(page("Login failed", "Invalid login callback. Please try again."));
 				return;
 			}
-			if (url.searchParams.get("error") === "signup_restricted") {
+			const errorMessage = describeError?.(url.searchParams);
+			if (errorMessage) {
 				res.writeHead(403, { "Content-Type": "text/html" });
-				res.end(page("Signup restricted", "Your email is not on the approved list for this environment."));
-				fail(/* @__PURE__ */ new Error("Signup restricted: your email is not on the approved list for this environment."));
-				return;
-			}
-			if (url.searchParams.has("token")) {
-				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(page("Login failed", "Invalid login callback. Please try again."));
+				res.end(page("Login failed", errorMessage));
+				fail(new Error(errorMessage));
 				return;
 			}
-			const code = url.searchParams.get("code");
-			if (!code) {
+			const invalidMessage = validate?.(url.searchParams);
+			if (invalidMessage) {
 				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(page("Login failed", "No authorization code received. Please try again."));
+				res.end(page("Login failed", invalidMessage));
 				return;
 			}
-			let token;
+			let result;
 			try {
-				token = await exchangeLoginCode(apiUrl, code, state, codeVerifier);
+				result = await finalize(url.searchParams);
 			} catch (err) {
+				if (settled) return;
 				res.writeHead(400, { "Content-Type": "text/html" });
 				res.end(page("Login failed", "Could not complete login. Please try again."));
 				fail(err instanceof Error ? err : /* @__PURE__ */ new Error("auth: Failed to complete login."));
 				return;
 			}
+			if (settled) return;
 			res.writeHead(200, { "Content-Type": "text/html" });
 			res.end(page("Login successful!", "You can close this tab and return to the terminal."));
-			succeed(token);
+			succeed(result);
 		});
 		server.on("connection", (socket) => socket.unref());
-		server.listen(0, "127.0.0.1", () => {
+		server.listen(0, "127.0.0.1", async () => {
 			const addr = server.address();
 			if (!addr || typeof addr === "string") {
-				reject(/* @__PURE__ */ new Error("auth: Failed to start local callback server."));
+				fail(/* @__PURE__ */ new Error("auth: Failed to start local callback server."));
 				return;
 			}
 			const port = addr.port;
-			const redirect = new URL(`http://localhost:${port}/callback`);
-			redirect.searchParams.set("state", state);
+			const callback = new URL(`http://localhost:${port}/callback`);
+			callback.searchParams.set("state", state);
+			let authUrl;
+			try {
+				authUrl = await buildAuthUrl(callback);
+			} catch (err) {
+				fail(err instanceof Error ? err : /* @__PURE__ */ new Error("auth: Failed to build authorize URL."));
+				return;
+			}
+			onUrl?.(authUrl);
+			openBrowser(authUrl, execFile);
+		});
+		setTimeout(() => {
+			fail(/* @__PURE__ */ new Error("auth: Login timed out after 5 minutes. Try again."));
+		}, timeoutMs).unref();
+	});
+}
+/**
+* Start a local HTTP server, open the browser to the platform login page,
+* and wait for the OAuth callback with a short-lived code. The CLI exchanges
+* the code itself so the localhost callback never accepts bearer tokens.
+*
+* `onUrl` is invoked with the login URL once the local server is listening,
+* so callers can show the URL to the user as a manual fallback when the
+* browser fails to open (common on WSL2, headless SSH, Docker, etc.).
+*/
+async function runLogin(root = process.cwd(), provider = "github", onUrl) {
+	const { execFile } = await import("node:child_process");
+	const apiUrl = getApiUrl(root);
+	const state = randomBytes(32).toString("hex");
+	const codeVerifier = createCodeVerifier();
+	const codeChallenge = createCodeChallenge(codeVerifier);
+	return awaitBrowserCallback({
+		state,
+		execFile,
+		onUrl,
+		buildAuthUrl: (callback) => {
 			const loginUrl = new URL("auth/login", apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`);
-			loginUrl.searchParams.set("redirect", redirect.href);
+			loginUrl.searchParams.set("redirect", callback.href);
 			loginUrl.searchParams.set("provider", provider);
 			loginUrl.searchParams.set("code_challenge", codeChallenge);
 			loginUrl.searchParams.set("code_challenge_method", "S256");
-			onUrl?.(loginUrl.href);
-			openBrowser(loginUrl.href, exec);
-		});
-		setTimeout(() => {
-			fail(/* @__PURE__ */ new Error("auth: Login timed out after 5 minutes. Try again."));
-		}, 300 * 1e3).unref();
+			return loginUrl.href;
+		},
+		describeError: (p) => p.get("error") === "signup_restricted" ? "Signup restricted: your email is not on the approved list for this environment." : null,
+		validate: (p) => {
+			if (p.has("token")) return "Invalid login callback. Please try again.";
+			if (!p.get("code")) return "No authorization code received. Please try again.";
+			return null;
+		},
+		finalize: (params) => exchangeLoginCode(apiUrl, params.get("code"), state, codeVerifier)
 	});
 }
 //#endregion
@@ -782,6 +839,53 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to fetch logs", res);
 		return (await res.json()).data;
 	}
+	async getGithubInstallUrl() {
+		const res = await fetch(`${this.baseUrl}/github/install-url`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get GitHub install URL", res);
+		return res.json();
+	}
+	async listGithubInstallations() {
+		const res = await fetch(`${this.baseUrl}/github/installations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list GitHub installations", res);
+		return res.json();
+	}
+	async connectGithub(projectId, body) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to connect GitHub repository", res);
+		return res.json();
+	}
+	async getGithubLinkUrl(redirect, codeChallenge) {
+		const params = new URLSearchParams({
+			redirect,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256"
+		});
+		const res = await fetch(`${this.baseUrl}/github/link-url?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to start GitHub link", res);
+		return res.json();
+	}
+	async completeGithubLink(linkCode, codeVerifier) {
+		const res = await fetch(`${this.baseUrl}/github/link/complete`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				link_code: linkCode,
+				code_verifier: codeVerifier
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to complete GitHub link", res);
+		return res.json();
+	}
 };
 //#endregion
-export { isExpiredTokenError as a, getToken as c, removeToken as d, runLogin as f, isCliOutdatedError as i, getTokenSource as l, PlatformClient as n, parsePlatformErrorBody as o, saveToken as p, client_exports as r, getSiteDomain as s, PlatformApiError as t, isStagingMode as u };
+export { saveToken as _, isExpiredTokenError as a, createCodeChallenge as c, getToken as d, getTokenSource as f, runLogin as g, removeToken as h, isCliOutdatedError as i, createCodeVerifier as l, openBrowser as m, PlatformClient as n, parsePlatformErrorBody as o, isStagingMode as p, client_exports as r, awaitBrowserCallback as s, PlatformApiError as t, getSiteDomain as u };

package/dist/{create-project-DCUrFJxa.mjs → create-project-CGodxfzH.mjs}

@@ -1,6 +1,6 @@
 import { n as __exportAll } from "./chunk-DJd-R1mw.mjs";
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { s as getSiteDomain, t as PlatformApiError } from "./client-DIfOFf1W.mjs";
+import { t as PlatformApiError, u as getSiteDomain } from "./client-D4awzTnj.mjs";
 import { _ as me, c as R, i as Ee, l as Re, v as ue, x as q } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig } from "./project-CH9pdo16.mjs";
 import { n as validateProjectSlug } from "./project-slug-rX3kTOfY.mjs";

package/dist/{db-UW4IYQFw.mjs → db-ERzz4oly.mjs}

@@ -2,15 +2,15 @@ import { a as join, c as resolve, r as extname, s as relative } from "./pathe.M-
 import { i as dim, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DKDsgwOU.mjs";
-import { c as getToken, n as PlatformClient, t as PlatformApiError, u as isStagingMode } from "./client-DIfOFf1W.mjs";
+import { d as getToken, n as PlatformClient, p as isStagingMode, t as PlatformApiError } from "./client-D4awzTnj.mjs";
 import { c as R, g as ge, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { c as getDatabaseDialect, f as readConfig, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
-import { r as detectFramework } from "./plugin-inference--7geW5Z2.mjs";
+import { r as detectFramework } from "./plugin-inference-C3fLzFvP.mjs";
 import { a as writeJournal, i as stripSqlExt, r as readJournal, t as collectMigrations } from "./collect-9rO3JFNM.mjs";
 import { n as listDrizzleArtifacts, r as validateMigrations, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-M3pxItg2.mjs";
-import { formatTimestamp } from "./gen-O5mXZ76K.mjs";
+import { formatTimestamp } from "./gen-Dgi4D7GC.mjs";
 import { existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { execFileSync } from "node:child_process";
@@ -103,7 +103,7 @@ async function runPush(root, dialect) {
 	else {
 		const { mkdirSync } = await import("node:fs");
 		const { dirname } = await import("node:path");
-		const { getMiniflareDatabasePath } = await import("./runner-DLZ9E_cX.mjs");
+		const { getMiniflareDatabasePath } = await import("./runner-BQyKUqAL.mjs");
 		const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 		mkdirSync(dirname(dbPath), { recursive: true });
 		configPath = writeDrizzleConfig(root, dbPath);
@@ -161,7 +161,7 @@ async function runStatus(root, dialect) {
 		localApplied = [];
 	}
 	else {
-		const { getMiniflareDatabasePath, getAppliedMigrations } = await import("./runner-DLZ9E_cX.mjs");
+		const { getMiniflareDatabasePath, getAppliedMigrations } = await import("./runner-BQyKUqAL.mjs");
 		localApplied = await getAppliedMigrations(getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local"));
 	}
 	const localSet = new Set(localApplied.map((m) => m.name));
@@ -219,7 +219,7 @@ async function resetDatabase(root, dialect) {
 		});
 		return migrations.length;
 	}
-	const { getMiniflareDatabasePath, runMigrations } = await import("./runner-DLZ9E_cX.mjs");
+	const { getMiniflareDatabasePath, runMigrations } = await import("./runner-BQyKUqAL.mjs");
 	const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 	rmSync(dbPath, { force: true });
 	rmSync(dbPath + "-wal", { force: true });
@@ -246,7 +246,7 @@ async function runSeed(root, file, dialect) {
 			ye("Done.");
 			return;
 		}
-		const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-DLZ9E_cX.mjs");
+		const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-BQyKUqAL.mjs");
 		const db = await openSqliteDatabase(getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local"));
 		try {
 			db.exec(sql);
@@ -409,7 +409,7 @@ async function runExecute(root, command, file, dialect, remote) {
 		ye("Done.");
 		return;
 	}
-	const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-DLZ9E_cX.mjs");
+	const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-BQyKUqAL.mjs");
 	const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 	if (!existsSync(dbPath)) {
 		R.error("No local database found. Run `void dev` first.");
@@ -512,7 +512,7 @@ async function runMigrate(root, dialect, remote) {
 		return;
 	}
 	if (dialect === "postgresql") {
-		const { applyPgMigrations } = await import("./runner-pg-Cv9V7ydr.mjs");
+		const { applyPgMigrations } = await import("./runner-pg-BAheiT6v.mjs");
 		const applied = await withPgClient(root, async (client) => {
 			let existingRows = [];
 			try {
@@ -536,7 +536,7 @@ async function runMigrate(root, dialect, remote) {
 		ye("Done.");
 		return;
 	}
-	const { getMiniflareDatabasePath, getAppliedMigrations, runMigrations } = await import("./runner-DLZ9E_cX.mjs");
+	const { getMiniflareDatabasePath, getAppliedMigrations, runMigrations } = await import("./runner-BQyKUqAL.mjs");
 	const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 	try {
 		const existingRows = await getAppliedMigrations(dbPath);
@@ -601,7 +601,7 @@ async function runStudio(root, dialect, remote) {
 		return;
 	}
 	const { writeDrizzleConfig } = await import("./config--wXmVOoe.mjs").then((n) => n.t);
-	const { getMiniflareDatabasePath } = await import("./runner-DLZ9E_cX.mjs");
+	const { getMiniflareDatabasePath } = await import("./runner-BQyKUqAL.mjs");
 	const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 	if (!existsSync(dbPath)) {
 		R.error("No local database found. Run `void dev` first.");
@@ -821,7 +821,7 @@ async function runRenameMigrations(root, dialect) {
 		process.exit(1);
 	}
 	else {
-		const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-DLZ9E_cX.mjs");
+		const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-BQyKUqAL.mjs");
 		const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 		if (existsSync(dbPath)) try {
 			const db = await openSqliteDatabase(dbPath);
@@ -899,7 +899,7 @@ async function runExport(root, args, dialect) {
 		} else process.stdout.write(output);
 		return;
 	}
-	const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-DLZ9E_cX.mjs");
+	const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-BQyKUqAL.mjs");
 	const dbPath = getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local");
 	if (!existsSync(dbPath)) {
 		R.error("No local database found. Run `void dev` first.");
@@ -1027,7 +1027,7 @@ async function runSeedModule(root, seedPath, dialect) {
 		return;
 	}
 	const { drizzle } = await import("drizzle-orm/better-sqlite3");
-	const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-DLZ9E_cX.mjs");
+	const { getMiniflareDatabasePath, openSqliteDatabase } = await import("./runner-BQyKUqAL.mjs");
 	const sqlite = await openSqliteDatabase(getMiniflareDatabasePath(getLocalD1PersistRoot(root), "local"));
 	try {
 		const options = getDrizzleSchemaOptions(schema);

package/dist/{delete-CYknzwXU.mjs → delete-CJZGDLBR.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle, r as createSpinner } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
 import { _ as me, c as R, g as ge, l as Re, u as Se, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { i as removeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-D4O1_fZz.mjs";