void 0.20.0 → 0.20.2

package/dist/platform-auth-config-DrbQXXiW.mjs

@@ -0,0 +1,368 @@
+import { I as isCancel, M as select, O as multiselect, P as text, j as password, w as confirm } from "./output-B0cfNSx5.mjs";
+import { f as openBrowser } from "./auth-DPl6kck4.mjs";
+import { n as OperatorClient } from "./operator-client-LUZnlnYk.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-B3e08unv.mjs";
+import { execFile } from "node:child_process";
+import { parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration } from "@void/platform";
+import { stripVTControlCharacters } from "node:util";
+import { setTimeout } from "node:timers/promises";
+import { readFile } from "node:fs/promises";
+//#region src/cli/platform-auth-config.ts
+function value(input) {
+	if (isCancel(input) || typeof input === "symbol") throw new Error("platform: Cancelled.");
+	return input;
+}
+function print(result) {
+	console.log(JSON.stringify(result, null, 2));
+}
+async function apply(client, path, body, args) {
+	const preview = await client.request(path, {
+		method: "POST",
+		body: {
+			...body,
+			dryRun: true
+		}
+	});
+	if (args.plan) return preview;
+	if (!args.yes) {
+		if (!process.stdin.isTTY) throw new Error("platform: Configuration changes require --yes or --plan in non-interactive mode.");
+		console.error(JSON.stringify(preview, null, 2));
+		if (!value(await confirm({
+			message: `Apply this change to ${client.origin}?`,
+			initialValue: false
+		}))) throw new Error("platform: Cancelled.");
+	}
+	return client.request(path, {
+		method: "POST",
+		body
+	});
+}
+async function waitForPlatformLoginTest(client, launch, signal) {
+	if (typeof launch.id !== "string" || typeof launch.expiresAt !== "string" || typeof launch.url !== "string") throw new Error("platform: Invalid login test response.");
+	const url = new URL(launch.url);
+	if (url.origin !== client.origin || url.pathname !== "/auth/test" || url.username || url.password || url.hash) throw new Error("platform: The login test belongs to a different platform.");
+	const expiry = Date.parse(launch.expiresAt);
+	if (!Number.isFinite(expiry) || expiry > Date.now() + 66e4) throw new Error("platform: Invalid login test expiry.");
+	console.log(`Complete the login test in your browser: ${url.href}`);
+	openBrowser(url.href, execFile);
+	while (Date.now() < expiry) {
+		signal?.throwIfAborted();
+		const result = await client.request(`/config/auth/tests/${encodeURIComponent(launch.id)}`, { signal });
+		if (result.complete === true) return result;
+		await setTimeout(1e3, void 0, { signal });
+	}
+	throw new Error("platform: The login test expired. Run it again.");
+}
+async function testMethod(client, id, args) {
+	const path = `/config/auth/connections/${encodeURIComponent(id)}/test`;
+	if (args.plan) return client.request(path, {
+		method: "POST",
+		body: { dryRun: true }
+	});
+	const launch = await client.request(path, {
+		method: "POST",
+		body: {}
+	});
+	if (!process.stdin.isTTY || args.json) return launch;
+	const controller = new AbortController();
+	const abort = () => controller.abort();
+	process.once("SIGINT", abort);
+	try {
+		return await waitForPlatformLoginTest(client, launch, controller.signal);
+	} finally {
+		process.removeListener("SIGINT", abort);
+	}
+}
+async function configurationInput(args, existing) {
+	let input = existing ? { ...existing.configuration } : {};
+	if (args.file) {
+		const file = JSON.parse(await readFile(args.file, "utf8"));
+		if (!file || typeof file !== "object" || Array.isArray(file)) throw new Error("platform: Configuration files must contain a JSON object.");
+		if ("clientSecret" in file) throw new Error("platform: Supply the client secret with --client-secret-env, not in the configuration file.");
+		input = {
+			...input,
+			...file
+		};
+	}
+	const kind = existing?.configuration.kind ?? args.target;
+	if (input.kind !== void 0 && input.kind !== kind || existing && input.id !== existing.id || args.id && input.id !== void 0 && input.id !== args.id) throw new Error("platform: The file must match the selected connection ID and kind. Use add for a different connection.");
+	const id = existing?.id ?? args.id ?? input.id;
+	input.kind = kind;
+	input.id = id || input.id || (kind === "github" || kind === "google" ? kind : kind === "oidc" ? "company" : "access");
+	const interactive = !!process.stdin.isTTY && !args.file;
+	if (interactive) {
+		if (!existing && kind !== "github" && kind !== "google" && !args.id) input.id = value(await text({
+			message: "Connection ID:",
+			initialValue: String(input.id)
+		}));
+		input.label = value(await text({
+			message: "Login button label:",
+			initialValue: String(input.label ?? {
+				github: "GitHub",
+				google: "Google",
+				oidc: "Company SSO",
+				"cloudflare-access": "Cloudflare Access"
+			}[kind])
+		}));
+		if (kind === "oidc" || kind === "cloudflare-access") input.issuer = value(await text({
+			message: "OIDC issuer URL:",
+			initialValue: String(input.issuer ?? "")
+		}));
+		input.clientId = value(await text({
+			message: "Client ID:",
+			initialValue: String(input.clientId ?? "")
+		}));
+		if (kind === "google") {
+			const domains = value(await text({
+				message: "Allowed Workspace domains (comma-separated; blank allows any Google account):",
+				initialValue: Array.isArray(input.allowedDomains) ? input.allowedDomains.join(", ") : ""
+			}));
+			input.allowedDomains = domains.split(",").map((domain) => domain.trim()).filter(Boolean);
+		}
+		if (kind === "oidc" || kind === "cloudflare-access") {
+			const groups = value(await text({
+				message: "Allowed groups (comma-separated; blank uses the provider’s access policy):",
+				initialValue: Array.isArray(input.requiredGroups) ? input.requiredGroups.join(", ") : ""
+			}));
+			input.requiredGroups = groups.split(",").map((group) => group.trim()).filter(Boolean);
+		}
+	}
+	const configuration = parsePlatformLoginConfiguration(input);
+	if (existing && configuration.id !== existing.id) throw new Error("platform: Use add to create a connection with a new ID.");
+	let secret = args.clientSecretEnv ? process.env[args.clientSecretEnv] : void 0;
+	if (args.clientSecretEnv && !secret) throw new Error(`platform: ${args.clientSecretEnv} must contain the client secret.`);
+	if (!args.clientSecretEnv && interactive) secret = value(await password({ message: existing ? "Client secret (leave blank to keep the saved secret):" : "Client secret:" })) || void 0;
+	if (!existing && !secret) throw new Error("platform: Provide --client-secret-env or enter a client secret interactively.");
+	return {
+		configuration,
+		...secret ? { clientSecret: secret } : {}
+	};
+}
+async function runPlatformAuthConfig(args) {
+	if (args.action === "recover") {
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-CeOKGVeJ.mjs");
+		return runPlatformAuthRecovery(args);
+	}
+	if (args.action === "protection") {
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-Bhtvp0B_.mjs");
+		return runPlatformProtectionConfig(args);
+	}
+	const origin = resolveOperatorOrigin(args.connection);
+	const client = new OperatorClient(origin, readOperatorToken(origin));
+	const listing = await client.request("/config/auth");
+	if (!args.action) {
+		if (!process.stdin.isTTY || args.json) {
+			print(listing);
+			return;
+		}
+		if (!listing.initialized) {
+			print(await apply(client, "/config/auth/initialize", {}, args));
+			console.log("Run void platform auth login, then return to void platform config auth.");
+			return;
+		}
+		const chosen = value(await select({
+			message: "Platform authentication:",
+			options: [
+				...listing.methods.map((method) => ({
+					value: method.id,
+					label: `${stripVTControlCharacters(method.label)} (${method.enabled ? "enabled" : "disabled"})`
+				})),
+				{
+					value: ":add",
+					label: "Add login method"
+				},
+				{
+					value: ":admission",
+					label: "Who can join?"
+				},
+				{
+					value: ":protection",
+					label: "Platform protection (Cloudflare Access)"
+				}
+			]
+		}));
+		if (chosen === ":protection") {
+			const target = value(await select({
+				message: "Platform protection:",
+				options: [
+					{
+						value: "show",
+						label: "Show current protection"
+					},
+					{
+						value: "enable",
+						label: "Create or connect Access protection"
+					},
+					{
+						value: "disable",
+						label: "Remove runtime protection and revoke sessions"
+					}
+				]
+			}));
+			return runPlatformAuthConfig({
+				...args,
+				action: "protection",
+				target
+			});
+		}
+		if (chosen === ":admission") return runPlatformAuthConfig({
+			...args,
+			action: "admission"
+		});
+		if (chosen === ":add") {
+			const kind = value(await select({
+				message: "Login method:",
+				options: [
+					{
+						value: "github",
+						label: "GitHub"
+					},
+					{
+						value: "google",
+						label: "Google"
+					},
+					{
+						value: "oidc",
+						label: "Generic OIDC"
+					},
+					{
+						value: "cloudflare-access",
+						label: "Cloudflare Access"
+					}
+				]
+			}));
+			return runPlatformAuthConfig({
+				...args,
+				action: "add",
+				target: kind
+			});
+		}
+		const method = listing.methods.find((method) => method.id === chosen);
+		const action = value(await select({
+			message: stripVTControlCharacters(method.label),
+			options: [
+				{
+					value: "test",
+					label: "Test login"
+				},
+				{
+					value: "configure",
+					label: "Edit configuration"
+				},
+				{
+					value: method.enabled ? "disable" : "enable",
+					label: method.enabled ? "Disable" : "Enable"
+				},
+				{
+					value: "link",
+					label: "Link this login to my account"
+				}
+			]
+		}));
+		return runPlatformAuthConfig({
+			...args,
+			action,
+			target: chosen
+		});
+	}
+	if (args.action === "list") {
+		print(listing);
+		return;
+	}
+	if (args.action === "initialize") {
+		print(await apply(client, "/config/auth/initialize", {}, args));
+		return;
+	}
+	if (!listing.initialized) throw new Error("platform: Run void platform config auth initialize, then sign in again.");
+	if (args.action === "admission") {
+		let admission;
+		if (args.file) admission = JSON.parse(await readFile(args.file, "utf8"));
+		else {
+			if (!process.stdin.isTTY || args.json) throw new Error("platform: Supply --file with the signup policy in non-interactive mode.");
+			const mode = value(await select({
+				message: "Who can create an account?",
+				initialValue: listing.admission?.mode ?? "restricted",
+				options: [
+					{
+						value: "restricted",
+						label: "Invited or allowlisted users"
+					},
+					{
+						value: "company",
+						label: "Company-approved users — automatic accounts"
+					},
+					{
+						value: "public",
+						label: "Public signup — all enabled logins"
+					}
+				]
+			}));
+			if (mode === "company") {
+				const access = !!listing.protection && value(await confirm({
+					message: "Allow everyone approved by Cloudflare Access protection?",
+					initialValue: true
+				}));
+				const eligible = listing.methods.filter((method) => method.enabled && method.configuration.kind !== "github" && (method.configuration.kind !== "google" || method.configuration.allowedDomains.length > 0));
+				if (!access && eligible.length === 0) throw new Error("platform: Configure a company-restricted login or Access protection first.");
+				admission = {
+					mode,
+					access,
+					connections: eligible.length ? value(await multiselect({
+						message: "Login methods whose company policies qualify new users:",
+						required: !access,
+						options: eligible.map((method) => ({
+							value: method.id,
+							label: stripVTControlCharacters(method.label)
+						}))
+					})) : []
+				};
+			} else admission = { mode };
+		}
+		print(await apply(client, "/config/auth/admission", {
+			revision: listing.revision,
+			admission: parsePlatformAdmissionPolicy(admission)
+		}, args));
+		return;
+	}
+	const method = listing.methods.find((method) => method.id === args.target);
+	if (args.action !== "add" && !method) throw new Error("platform: Login method not found. Run void platform config auth list.");
+	if (args.action === "show") {
+		print(method);
+		return;
+	}
+	if (args.action === "test") {
+		print(await testMethod(client, args.target, args));
+		return;
+	}
+	if (args.action === "add" || args.action === "configure") {
+		console.error(`Register this callback URL with the provider: ${listing.callbackUrl ?? `${origin}/auth/callback`}`);
+		const input = await configurationInput(args, args.action === "configure" ? method : void 0);
+		print(await apply(client, `/config/auth/connections/${encodeURIComponent(input.configuration.id)}/configure`, {
+			...input,
+			revision: args.action === "add" ? null : method.revision
+		}, args));
+		if (!args.plan && !args.json) console.log(`Test and enable it with void platform config auth enable ${input.configuration.id}.`);
+		return;
+	}
+	let testId = args.testId;
+	if ((args.action === "enable" || args.action === "link") && !testId) {
+		if (!process.stdin.isTTY || args.plan || args.json) throw new Error("platform: Complete a login test and supply its --test-id.");
+		const tested = await testMethod(client, args.target, args);
+		print(tested);
+		if (tested.complete !== true || typeof tested.id !== "string") throw new Error("platform: Complete the browser test before enabling or linking this login.");
+		testId = tested.id;
+		if (args.action === "enable" && value(await confirm({
+			message: "Link this verified identity to your administrator account?",
+			initialValue: true
+		}))) await apply(client, `/config/auth/connections/${encodeURIComponent(args.target)}/link`, {
+			revision: method.revision,
+			testId
+		}, args);
+	}
+	print(await apply(client, `/config/auth/connections/${encodeURIComponent(args.target)}/${args.action}`, {
+		revision: method.revision,
+		...testId ? { testId } : {}
+	}, args));
+}
+//#endregion
+export { runPlatformAuthConfig };

package/dist/platform-auth-protection-Bhtvp0B_.mjs

@@ -0,0 +1,219 @@
+import { $ as promoteInstallationSecrets, I as isCancel, V as ensurePlatformAccessToken, W as acquirePlatformLifecycleLock, X as normalizePlatformApiUrl, ct as writePendingInstallationSecrets, et as readInstallationRecoverySecrets, it as resolveInstallationManifest, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { n as OperatorClient } from "./operator-client-LUZnlnYk.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-B3e08unv.mjs";
+import { C as PlatformCloudflareClient, S as preparePlatformAccessSetup, b as checkpointPlatformAccessResources, n as acquirePlatformDatabaseLifecycleLock, resolvePlatformInstallDatabaseUrl, x as parsePlatformAccessSetupSpec, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BwAIgz-t.mjs";
+import { selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-COogu_Se.mjs";
+import { createHmac } from "node:crypto";
+import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
+import { readFile } from "node:fs/promises";
+//#region src/cli/platform-auth-protection.ts
+/** Read every externally routed control-plane Worker before changing its preview settings. */
+async function verifyProtectionWorkerOrigins(client, manifest, origins, disablePreviews, options = {}) {
+	const domains = await client.listWorkerDomains(manifest.account.id);
+	const allowed = new Set(origins.map((origin) => new URL(origin).hostname));
+	const workers = [
+		manifest.deployment.resources.apiWorker,
+		manifest.deployment.resources.proxyWorker,
+		...manifest.resources.some((resource) => resource.name === manifest.deployment.resources.dashboardWorker && resource.state === "ready") || domains.some((domain) => domain.service === manifest.deployment.resources.dashboardWorker) ? [manifest.deployment.resources.dashboardWorker] : []
+	];
+	const updates = [];
+	for (const worker of workers) {
+		if (options.workerNames && !options.workerNames.includes(worker)) continue;
+		const path = `/accounts/${encodeURIComponent(manifest.account.id)}/workers/scripts/${encodeURIComponent(worker)}/subdomain`;
+		const subdomain = await client.request(path);
+		const expectedWorkersDev = origins.some((origin) => new URL(origin).hostname.startsWith(`${worker}.`) && new URL(origin).hostname.endsWith(".workers.dev"));
+		if (typeof subdomain.enabled !== "boolean" || typeof subdomain.previews_enabled !== "boolean") throw new Error("platform: Cannot verify Worker alternate origins. Check Workers read permissions.");
+		if (subdomain.enabled && !expectedWorkersDev) updates.push({
+			path,
+			enabled: false
+		});
+		else if (subdomain.previews_enabled) updates.push({
+			path,
+			enabled: expectedWorkersDev && subdomain.enabled
+		});
+		for (const domain of domains.filter((domain) => domain.service === worker)) if (!allowed.has(domain.hostname)) throw new Error(`platform: Protect or remove the additional Worker domain ${domain.hostname} before enabling Access.`);
+		for (const route of await client.listWorkerServiceRoutes(manifest.account.id, worker)) {
+			const hostname = route.pattern.replace(/^https?:\/\//, "").split("/")[0];
+			if (!allowed.has(hostname)) throw new Error("platform: A control-plane Worker has an additional or wildcard route. Protect or remove it before enabling Access.");
+		}
+	}
+	if (updates.length && !disablePreviews) throw new Error("platform: Worker alternate and preview URLs must be disabled before enabling Access.");
+	for (const update of updates) {
+		await client.request(update.path, {
+			method: "POST",
+			body: JSON.stringify({
+				enabled: update.enabled,
+				previews_enabled: false
+			}),
+			headers: { "Cloudflare-Workers-Script-Api-Date": "2025-08-01" }
+		});
+		const current = await client.request(update.path);
+		if (current.enabled !== update.enabled || current.previews_enabled !== false) throw new Error("platform: Worker alternate origins changed during protection setup. Reconcile them before retrying.");
+	}
+}
+async function runPlatformProtectionConfig(args) {
+	const manifest = args.target === "show" ? void 0 : resolveInstallationManifest(args.installation);
+	const origin = args.connection ? resolveOperatorOrigin(args.connection) : manifest?.endpoints.apiUrl ? normalizePlatformApiUrl(manifest.endpoints.apiUrl) : resolveOperatorOrigin("");
+	const operator = new OperatorClient(origin, readOperatorToken(origin));
+	if (manifest) {
+		const saved = readInstallationRecoverySecrets(manifest);
+		const provisioning = saved?.accessProvisioningJson ? JSON.parse(saved.accessProvisioningJson) : void 0;
+		if (manifest.deployment.authentication.accessProtection || provisioning?.resources?.protection?.id) ensurePlatformAccessToken(origin, false, true);
+	}
+	let context = await operator.request("/config/auth/protection");
+	if (args.target === "show") {
+		console.log(JSON.stringify({
+			protection: context.protection,
+			origins: context.origins
+		}, null, 2));
+		return;
+	}
+	if (!manifest || manifest.status !== "installed" || !manifest.endpoints.proxyUrl || normalizePlatformApiUrl(manifest.endpoints.apiUrl ?? "") !== origin || context.installationId !== manifest.id || typeof context.userId !== "string" || typeof context.sessionId !== "string" || typeof context.revision !== "number" || typeof context.lifecycleVersion !== "string" || !Number.isSafeInteger(context.revision) || !Array.isArray(context.origins) || context.origins.some((value) => typeof value !== "string")) throw new Error("platform: Protection settings must belong to this completed installation. Repair or upgrade it first.");
+	let lifecycleVersion = context.lifecycleVersion;
+	let origins = context.origins;
+	if (!origins.includes(origin) || !origins.includes(new URL(manifest.endpoints.proxyUrl).origin)) throw new Error("platform: The live API and proxy origins differ from installation recovery state. Repair the installation first.");
+	const spec = args.file ? parsePlatformAccessSetupSpec(JSON.parse(await readFile(args.file, "utf8"))) : void 0;
+	if (args.target === "disable" && spec) throw new Error("platform: Removing protection does not accept an Access application configuration.");
+	const reviewed = {
+		action: args.target,
+		installationId: manifest.id,
+		origin,
+		origins,
+		...spec ? { cloudflareAccess: spec } : {},
+		revokeHumanSessions: true,
+		retainAccessApplications: true,
+		disableUnprotectedWorkerAlternateOrigins: args.target === "enable"
+	};
+	if (args.plan) {
+		console.log(JSON.stringify({
+			dryRun: true,
+			...reviewed
+		}, null, 2));
+		return;
+	}
+	if (!args.yes) {
+		console.error(JSON.stringify(reviewed, null, 2));
+		if (!process.stdin.isTTY) throw new Error("platform: Protection changes require --yes or --plan in non-interactive mode.");
+		const accepted = await confirm({
+			message: "Apply this protection change and revoke human sessions?",
+			initialValue: false
+		});
+		if (isCancel(accepted) || !accepted) throw new Error("platform: Cancelled.");
+	}
+	const release = acquirePlatformLifecycleLock(manifest.account.id, manifest.deployment.installationSlug);
+	try {
+		let currentManifest = resolveInstallationManifest(manifest.id);
+		const recovery = readInstallationRecoverySecrets(currentManifest);
+		if (!recovery?.jwtSecret) throw new Error("platform: Restore the original encrypted installation recovery credentials before changing protection.");
+		const credential = await resolvePlatformCloudflareCredential();
+		const cloudflare = new PlatformCloudflareClient(credential.token);
+		let protection = null;
+		const checkpoint = { ...recovery };
+		const save = (values) => {
+			Object.assign(checkpoint, values);
+			writePendingInstallationSecrets(currentManifest, checkpoint);
+		};
+		if (args.target === "disable") await verifyPlatformInstallationOwnership(cloudflare, currentManifest);
+		if (args.target === "enable") {
+			const databaseUrl = resolvePlatformInstallDatabaseUrl(recovery, currentManifest);
+			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to checkpoint Access resource ownership safely.");
+			const releaseDatabase = await acquirePlatformDatabaseLifecycleLock(databaseUrl, currentManifest.id, currentManifest.ownershipNonce);
+			try {
+				currentManifest = selectAuthoritativePlatformManifest(currentManifest, releaseDatabase.authoritativeManifest);
+				if (!releaseDatabase.authoritativeManifest) await releaseDatabase.checkpoint?.(currentManifest);
+				else writeInstallationManifest(currentManifest);
+				context = await operator.request("/config/auth/protection");
+				const rawLockedOrigins = context.origins;
+				const lockedOrigins = Array.isArray(rawLockedOrigins) ? rawLockedOrigins.filter((value) => typeof value === "string") : [];
+				if (normalizePlatformApiUrl(currentManifest.endpoints.apiUrl ?? "") !== origin || !currentManifest.endpoints.proxyUrl || context.installationId !== currentManifest.id || lockedOrigins.length !== (Array.isArray(rawLockedOrigins) ? rawLockedOrigins.length : -1) || !lockedOrigins.includes(origin) || !lockedOrigins.includes(new URL(currentManifest.endpoints.proxyUrl).origin)) throw new Error("platform: Platform origins changed before Access provisioning. Review and retry.");
+				origins = lockedOrigins;
+				await verifyPlatformInstallationOwnership(cloudflare, currentManifest);
+				await verifyProtectionWorkerOrigins(cloudflare, currentManifest, origins, true);
+				const originalCredentials = process.env.VOID_ACCESS_CREDENTIALS;
+				try {
+					const prepared = await preparePlatformAccessSetup({
+						plan: {
+							account: currentManifest.account,
+							installationId: currentManifest.id,
+							apiUrl: origin,
+							proxyUrl: currentManifest.endpoints.proxyUrl
+						},
+						ownershipNonce: currentManifest.ownershipNonce,
+						protection: true,
+						additionalOrigins: origins,
+						spec,
+						client: cloudflare,
+						checkpoint,
+						save,
+						yes: args.yes
+					});
+					protection = parsePlatformAccessProtection(prepared?.protection);
+					if (!protection) throw new Error("platform: Access protection could not be verified.");
+				} finally {
+					if (originalCredentials === void 0) delete process.env.VOID_ACCESS_CREDENTIALS;
+					else process.env.VOID_ACCESS_CREDENTIALS = originalCredentials;
+				}
+			} finally {
+				try {
+					currentManifest = checkpointPlatformAccessResources(currentManifest, checkpoint.accessProvisioningJson, (/* @__PURE__ */ new Date()).toISOString());
+					writeInstallationManifest(currentManifest);
+					await releaseDatabase.checkpoint?.(currentManifest);
+				} finally {
+					await releaseDatabase();
+				}
+			}
+			ensurePlatformAccessToken(origin, false, true);
+			if (!cfAccessHeaders(process.env, origin)["cf-access-token"]) throw new Error("platform: Sign in interactively through company Access to enable protection. Service credentials cannot authorize this change.");
+			context = await operator.request("/config/auth/protection");
+			if (context.installationId !== currentManifest.id || typeof context.userId !== "string" || typeof context.sessionId !== "string" || typeof context.revision !== "number" || typeof context.lifecycleVersion !== "string" || !Array.isArray(context.origins) || context.origins.some((value) => typeof value !== "string") || JSON.stringify(context.origins) !== JSON.stringify(origins)) throw new Error("platform: Protection settings changed while Access resources were being checkpointed. Review and retry.");
+			lifecycleVersion = context.lifecycleVersion;
+			await verifyProtectionWorkerOrigins(cloudflare, currentManifest, origins, false);
+		}
+		const expiresAt = new Date(Date.now() + 3e5).toISOString();
+		const signature = createHmac("sha256", recovery.jwtSecret).update(platformProtectionProofMessage({
+			installationId: currentManifest.id,
+			origin,
+			userId: context.userId,
+			sessionId: context.sessionId,
+			revision: context.revision,
+			lifecycleVersion,
+			protection,
+			expiresAt
+		})).digest("base64url");
+		const body = {
+			revision: context.revision,
+			lifecycleVersion,
+			protection,
+			expiresAt,
+			signature
+		};
+		const preview = await operator.request("/config/auth/protection", {
+			method: "POST",
+			body: {
+				...body,
+				dryRun: true
+			}
+		});
+		if (!args.json) console.error(JSON.stringify(preview, null, 2));
+		const result = await operator.request("/config/auth/protection", {
+			method: "POST",
+			body
+		});
+		save({ protectionUpdateJson: JSON.stringify({
+			revision: result.revision,
+			protection
+		}) });
+		promoteInstallationSecrets(currentManifest);
+		console.log(JSON.stringify({
+			...result,
+			protection,
+			retainedAccessApplications: true
+		}, null, 2));
+		if (!args.json) console.log("Sign in again with void platform auth login. Existing Access applications and policies were retained.");
+	} finally {
+		release();
+	}
+}
+//#endregion
+export { runPlatformProtectionConfig, verifyProtectionWorkerOrigins };