void 0.20.1 → 0.20.2

package/dist/platform-auth-recovery-CeOKGVeJ.mjs

@@ -0,0 +1,310 @@
+import { I as isCancel, W as acquirePlatformLifecycleLock, et as readInstallationRecoverySecrets, it as resolveInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
+import { f as openBrowser } from "./auth-DPl6kck4.mjs";
+import { a as resolveOperatorOrigin } from "./operator-auth-B3e08unv.mjs";
+import { C as PlatformCloudflareClient, c as platformDatabaseClientUrl, r as acquirePlatformDatabaseLifecycleLockConnection, resolvePlatformInstallDatabaseUrl, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BwAIgz-t.mjs";
+import { selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-COogu_Se.mjs";
+import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";
+import { setTimeout } from "node:timers/promises";
+import { readFile } from "node:fs/promises";
+//#region src/cli/platform-auth-recovery-core.ts
+function parseAuthenticationRecoveryInput(value, connectionId) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Recovery requires a JSON object.");
+	const input = value;
+	if (Object.keys(input).some((key) => ![
+		"administratorUserId",
+		"expectedIdentity",
+		"configuration"
+	].includes(key)) || typeof input.administratorUserId !== "string" || !input.administratorUserId.trim()) throw new Error("platform: Recovery requires an existing administratorUserId and accepts no plaintext secrets.");
+	let expectedIdentity;
+	if (input.expectedIdentity !== void 0) {
+		const identity = input.expectedIdentity;
+		if (!identity || typeof identity !== "object" || typeof identity.issuer !== "string" || !identity.issuer || typeof identity.subject !== "string" || !identity.subject || Object.keys(identity).some((key) => key !== "issuer" && key !== "subject")) throw new Error("platform: expectedIdentity requires the exact issuer and subject.");
+		expectedIdentity = {
+			issuer: identity.issuer,
+			subject: identity.subject
+		};
+	}
+	const configuration = input.configuration === void 0 ? void 0 : parsePlatformLoginConfiguration(input.configuration);
+	if (configuration && configuration.id !== connectionId) throw new Error("platform: Recovery configuration must match the selected connection.");
+	return {
+		administratorUserId: input.administratorUserId,
+		expectedIdentity,
+		configuration
+	};
+}
+function credentialKey(keysJson, version) {
+	const keys = JSON.parse(keysJson);
+	const raw = typeof keys[version] === "string" ? Buffer.from(keys[version], "base64") : null;
+	if (!raw || raw.length !== 32) throw new Error("platform: Restore the original platform encryption keyring before recovery.");
+	return Buffer.from(hkdfSync("sha256", raw, "void-platform-auth-v1", "login-client-credentials", 32));
+}
+function recoverAuthenticationCredential(keysJson, installationId, connectionId, revision, saved) {
+	try {
+		const encrypted = Buffer.from(saved.ciphertext, "base64");
+		const decipher = createDecipheriv("aes-256-gcm", credentialKey(keysJson, saved.keyVersion), Buffer.from(saved.iv, "base64"));
+		decipher.setAAD(Buffer.from(JSON.stringify([installationId, JSON.stringify([connectionId, revision])])));
+		decipher.setAuthTag(encrypted.subarray(-16));
+		return Buffer.concat([decipher.update(encrypted.subarray(0, -16)), decipher.final()]).toString("utf8");
+	} catch {
+		throw new Error("platform: The original platform encryption keyring is required for authentication recovery.");
+	}
+}
+function encryptCredential(keysJson, version, installationId, connectionId, revision, secret) {
+	const iv = Buffer.from(randomBytes(12));
+	const cipher = createCipheriv("aes-256-gcm", credentialKey(keysJson, version), iv);
+	cipher.setAAD(Buffer.from(JSON.stringify([installationId, JSON.stringify([connectionId, revision])])));
+	const ciphertext = Buffer.concat([
+		cipher.update(secret, "utf8"),
+		cipher.final(),
+		cipher.getAuthTag()
+	]);
+	return {
+		keyVersion: version,
+		iv: iv.toString("base64"),
+		ciphertext: ciphertext.toString("base64")
+	};
+}
+async function transaction(db, action) {
+	await db.query("BEGIN");
+	try {
+		const result = await action();
+		await db.query("COMMIT");
+		return result;
+	} catch (error) {
+		await db.query("ROLLBACK");
+		throw error;
+	}
+}
+async function requireAdministrator(db, id) {
+	if (!(await db.query("SELECT id FROM users WHERE id = $1 AND role = 'admin' AND (suspended_reason IS NULL OR suspended_reason IN ('requests_exceeded', 'sandbox_runtime_exceeded')) FOR UPDATE", [id])).rows[0]) throw new Error("platform: Recovery can only restore an existing active administrator.");
+}
+async function readConnection(db, id) {
+	return (await db.query("SELECT c.id, c.kind, c.revision, c.generation, r.configuration, r.secret FROM platform_login_connections c JOIN platform_login_revisions r ON r.connection_id = c.id AND r.revision = c.revision WHERE c.id = $1", [id])).rows[0];
+}
+async function validateRecoveryAdmission(db, connectionId, revision) {
+	const settings = (await db.query("SELECT admission, protection FROM platform_auth_settings WHERE singleton = true FOR UPDATE")).rows[0];
+	if (!settings) throw new Error("platform: Authentication settings are unavailable for recovery.");
+	const prospective = await db.query("SELECT r.configuration FROM platform_login_connections c JOIN platform_login_revisions r ON r.connection_id = c.id AND r.revision = CASE WHEN c.id = $1 THEN $2 ELSE c.active_revision END WHERE c.enabled = true OR c.id = $1", [connectionId, revision]);
+	validatePlatformAdmissionPolicy(parsePlatformAdmissionPolicy(settings.admission), prospective.rows.map((row) => parsePlatformLoginConfiguration(row.configuration)), parsePlatformAccessProtection(settings.protection));
+}
+async function commitAuthenticationRecovery(db, input) {
+	const { recovery, identity } = input;
+	await transaction(db, async () => {
+		await db.query("LOCK TABLE platform_auth_settings IN SHARE ROW EXCLUSIVE MODE");
+		await requireAdministrator(db, recovery.administratorUserId);
+		const connection = await readConnection(db, recovery.connectionId);
+		if (!connection || connection.revision !== recovery.revision || connection.generation !== recovery.generation || Date.parse(recovery.expiresAt) <= Date.now()) throw new Error("platform: Recovery expired or configuration changed. Start again.");
+		await validateRecoveryAdmission(db, recovery.connectionId, recovery.revision);
+		if (!(await db.query("DELETE FROM platform_login_tests WHERE id = $1 AND user_id = $2 AND connection_id = $3 AND revision = $4 AND issuer = $5 AND subject = $6 AND expires_at > now() RETURNING id", [
+			recovery.testId,
+			recovery.administratorUserId,
+			recovery.connectionId,
+			recovery.revision,
+			identity.issuer,
+			identity.subject
+		])).rows[0]) throw new Error("platform: Recovery requires a fresh successful login test of this exact identity.");
+		const owner = (await db.query("SELECT user_id FROM platform_login_identities WHERE connection_id = $1 AND issuer = $2 AND subject = $3", [
+			recovery.connectionId,
+			identity.issuer,
+			identity.subject
+		])).rows[0];
+		if (owner && owner.user_id !== recovery.administratorUserId) throw new Error("platform: This identity belongs to another account. Recovery cannot take it over.");
+		if (connection.kind === "github" || connection.kind === "google") {
+			const legacyOwner = (await db.query("SELECT user_id FROM oauth_accounts WHERE provider = $1 AND provider_id = $2", [connection.kind, identity.subject])).rows[0];
+			if (legacyOwner && legacyOwner.user_id !== recovery.administratorUserId) throw new Error("platform: This identity belongs to another account.");
+			await db.query("DELETE FROM oauth_accounts WHERE provider = $1 AND user_id = $2", [connection.kind, recovery.administratorUserId]);
+			await db.query("INSERT INTO oauth_accounts (id, user_id, provider, provider_id) VALUES ($1,$2,$3,$4)", [
+				randomUUID(),
+				recovery.administratorUserId,
+				connection.kind,
+				identity.subject
+			]);
+		}
+		await db.query("DELETE FROM platform_login_identities WHERE connection_id = $1 AND user_id = $2", [recovery.connectionId, recovery.administratorUserId]);
+		await db.query("INSERT INTO platform_login_identities (id, user_id, connection_id, issuer, subject) VALUES ($1,$2,$3,$4,$5)", [
+			randomUUID(),
+			recovery.administratorUserId,
+			recovery.connectionId,
+			identity.issuer,
+			identity.subject
+		]);
+		await db.query("UPDATE platform_login_connections SET enabled = true, active_revision = $2, generation = generation + 1 WHERE id = $1", [recovery.connectionId, recovery.revision]);
+		await db.query("UPDATE platform_auth_settings SET revision = revision + 1, sessions_required = true WHERE singleton = true");
+		await db.query("UPDATE platform_human_sessions SET revoked_at = now() WHERE (connection_id = $1 OR user_id = $2) AND revoked_at IS NULL", [recovery.connectionId, recovery.administratorUserId]);
+		await db.query("DELETE FROM operator_sessions WHERE user_id = $1 OR human_session_id IS NULL", [recovery.administratorUserId]);
+		await db.query("DELETE FROM platform_login_tests WHERE connection_id = $1", [recovery.connectionId]);
+		await db.query("INSERT INTO operator_events (id,user_id,login,action,target,status,http_status) VALUES ($1,$2,$3,$4,$5,$6,$7)", [
+			randomUUID(),
+			recovery.administratorUserId,
+			"Installation owner recovery",
+			"auth.recovery.confirm",
+			JSON.stringify({
+				installationId: recovery.installationId,
+				connectionId: recovery.connectionId,
+				revision: recovery.revision,
+				identity
+			}),
+			"success",
+			200
+		]);
+	});
+}
+//#endregion
+//#region src/cli/platform-auth-recovery.ts
+async function runPlatformAuthRecovery(args) {
+	if (!args.file) throw new Error("platform: Recovery requires --file with administratorUserId and optional expectedIdentity/configuration.");
+	const input = parseAuthenticationRecoveryInput(JSON.parse(await readFile(args.file, "utf8")), args.target);
+	if (!args.plan && (!process.stdin.isTTY || args.yes) && (!args.yes || !input.expectedIdentity)) throw new Error("platform: Unattended recovery requires --yes and the exact expectedIdentity issuer and subject in --file.");
+	let manifest = resolveInstallationManifest(args.installation ?? "");
+	if (args.connection && resolveOperatorOrigin(args.connection) !== manifest.endpoints.apiUrl) throw new Error("platform: The selected connection does not match the recovery installation.");
+	const secrets = readInstallationRecoverySecrets(manifest);
+	if (!secrets?.jwtSecret || !secrets.projectSecretKeysJson || !secrets.projectSecretActiveKeyVersion) throw new Error("platform: Restore the original encrypted installation recovery secrets before recovering a login.");
+	const databaseUrl = resolvePlatformInstallDatabaseUrl(secrets, manifest);
+	const credential = await resolvePlatformCloudflareCredential();
+	const releaseLocal = acquirePlatformLifecycleLock(manifest.account.id, manifest.deployment.installationSlug);
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	try {
+		const db = await pool.connect();
+		try {
+			const releaseDatabase = await acquirePlatformDatabaseLifecycleLockConnection(db, manifest.id, manifest.ownershipNonce);
+			try {
+				manifest = selectAuthoritativePlatformManifest(manifest, releaseDatabase.authoritativeManifest);
+				await verifyPlatformInstallationOwnership(new PlatformCloudflareClient(credential.token), manifest, { databaseUrl });
+				if (!manifest.endpoints.apiUrl) throw new Error("platform: Recover or repair the installed API endpoint first.");
+				const existing = await readConnection(db, args.target);
+				const keyProbe = existing ?? (await db.query("SELECT c.id,c.kind,r.revision,c.generation,r.configuration,r.secret FROM platform_login_connections c JOIN platform_login_revisions r ON c.id = r.connection_id LIMIT 1")).rows[0];
+				if (!keyProbe) throw new Error("platform: Finish first-administrator setup before using provider recovery.");
+				recoverAuthenticationCredential(secrets.projectSecretKeysJson, manifest.id, keyProbe.id, keyProbe.revision, keyProbe.secret);
+				const configuration = input.configuration ?? existing?.configuration;
+				if (!configuration) throw new Error("platform: A replacement connection requires configuration in --file.");
+				if (existing && (configuration.kind !== existing.kind || configuration.clientId !== existing.configuration.clientId || configuration.issuer !== existing.configuration.issuer)) throw new Error("platform: A different identity namespace requires a new connection ID.");
+				const suppliedSecret = args.clientSecretEnv ? process.env[args.clientSecretEnv] : void 0;
+				if (args.clientSecretEnv && !suppliedSecret || !existing && !suppliedSecret) throw new Error("platform: Supply the replacement client secret using --client-secret-env.");
+				if (suppliedSecret && suppliedSecret.length > 8192) throw new Error("platform: The client secret is too long.");
+				await requireAdministrator(db, input.administratorUserId);
+				const preview = {
+					installationId: manifest.id,
+					administratorUserId: input.administratorUserId,
+					connectionId: args.target,
+					configuration,
+					expectedIdentity: input.expectedIdentity,
+					effect: "Test this login, explicitly confirm the identity, and restore the existing administrator. Revoke affected human sessions."
+				};
+				console.log(JSON.stringify(preview, null, 2));
+				if (args.plan) return;
+				const proof = randomBytes(32).toString("hex");
+				const testId = `test.${randomUUID()}`;
+				const expiresAt = new Date(Date.now() + 6e5).toISOString();
+				const recovery = await transaction(db, async () => {
+					await db.query("LOCK TABLE platform_auth_settings IN SHARE ROW EXCLUSIVE MODE");
+					await requireAdministrator(db, input.administratorUserId);
+					const latest = await readConnection(db, args.target);
+					if (JSON.stringify(latest) !== JSON.stringify(existing)) throw new Error("platform: Login configuration changed. Start recovery again.");
+					let revision = existing?.revision ?? 1;
+					if (suppliedSecret || input.configuration) {
+						revision = existing ? existing.revision + 1 : 1;
+						const secret = suppliedSecret ?? recoverAuthenticationCredential(secrets.projectSecretKeysJson, manifest.id, existing.id, existing.revision, existing.secret);
+						const encrypted = encryptCredential(secrets.projectSecretKeysJson, secrets.projectSecretActiveKeyVersion, manifest.id, args.target, revision, secret);
+						if (!existing) await db.query("INSERT INTO platform_login_connections (id,kind) VALUES ($1,$2)", [args.target, configuration.kind]);
+						await db.query("INSERT INTO platform_login_revisions (connection_id,revision,configuration,secret) VALUES ($1,$2,$3::jsonb,$4::jsonb)", [
+							args.target,
+							revision,
+							JSON.stringify(configuration),
+							JSON.stringify(encrypted)
+						]);
+						await db.query("UPDATE platform_login_connections SET revision = $2 WHERE id = $1", [args.target, revision]);
+						await db.query("UPDATE platform_auth_settings SET revision = revision + 1 WHERE singleton = true");
+					}
+					const unsigned = {
+						installationId: manifest.id,
+						administratorUserId: input.administratorUserId,
+						connectionId: args.target,
+						revision,
+						generation: existing?.generation ?? 1,
+						testId,
+						expiresAt
+					};
+					const recovery = {
+						...unsigned,
+						signature: createHmac("sha256", secrets.jwtSecret).update(platformAuthenticationRecoveryMessage(unsigned)).digest("base64url")
+					};
+					await db.query("INSERT INTO platform_auth_attempts (id,connection_id,revision,generation,purpose,browser_hash,context,expires_at) VALUES ($1,$2,$3,$4,'test',$5,$6::jsonb,$7)", [
+						testId,
+						args.target,
+						revision,
+						recovery.generation,
+						createHash("sha256").update(proof).digest("hex"),
+						JSON.stringify({
+							phase: "launch",
+							actor: {
+								userId: input.administratorUserId,
+								sessionId: "",
+								audience: "api"
+							},
+							recovery
+						}),
+						expiresAt
+					]);
+					await db.query("INSERT INTO operator_events (id,user_id,login,action,target,status,http_status) VALUES ($1,$2,$3,$4,$5,$6,$7)", [
+						randomUUID(),
+						input.administratorUserId,
+						"Installation owner recovery",
+						"auth.recovery.start",
+						JSON.stringify({
+							connectionId: args.target,
+							revision,
+							testId
+						}),
+						"success",
+						200
+					]);
+					return recovery;
+				});
+				const url = new URL("/auth/test", manifest.endpoints.apiUrl);
+				url.searchParams.set("id", testId);
+				url.searchParams.set("proof", proof);
+				console.log(`Complete the recovery login in your browser: ${url.href}`);
+				if (process.stdin.isTTY) openBrowser(url.href, execFile);
+				let tested;
+				while (Date.now() < Date.parse(expiresAt)) {
+					tested = (await db.query("SELECT issuer,subject,login FROM platform_login_tests WHERE id = $1 AND user_id = $2 AND expires_at > now()", [testId, input.administratorUserId])).rows[0];
+					if (tested) break;
+					await setTimeout(1e3);
+				}
+				if (!tested) throw new Error("platform: The recovery login expired. Run recovery again.");
+				console.log(JSON.stringify({
+					administratorUserId: input.administratorUserId,
+					authenticatedIdentity: tested
+				}, null, 2));
+				if (input.expectedIdentity && (input.expectedIdentity.issuer !== tested.issuer || input.expectedIdentity.subject !== tested.subject)) throw new Error("platform: The authenticated identity does not match expectedIdentity. No administrator link was changed.");
+				if (!args.yes) {
+					const accepted = await confirm({
+						message: `Bind issuer ${JSON.stringify(tested.issuer)}, subject ${JSON.stringify(tested.subject)} to existing administrator ${JSON.stringify(input.administratorUserId)}?`,
+						initialValue: false
+					});
+					if (isCancel(accepted) || !accepted) throw new Error("platform: Recovery cancelled.");
+				}
+				await commitAuthenticationRecovery(db, {
+					recovery,
+					identity: tested
+				});
+				console.log("Administrator login recovered. Sign in again with this login method.");
+			} finally {
+				await releaseDatabase();
+			}
+		} finally {
+			db.release();
+		}
+	} finally {
+		await pool.end();
+		releaseLocal();
+	}
+}
+//#endregion
+export { runPlatformAuthRecovery };

package/dist/{platform-cmd-DxJ2FRwR.mjs → platform-cmd-BFhieCdV.mjs}

@@ -1,12 +1,11 @@
-import { D as log, F as isCancel, G as normalizePlatformApiUrl, N as text, V as getActivePlatformConnection, W as listPlatformConnections, c as import_picocolors, et as savePlatformConnection, j as select, tt as selectPlatformConnection } from "./output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-DsSsZUPr.mjs";
+import { B as ensureCloudflaredToken, D as log, I as isCancel, K as getActivePlatformConnection, M as select, P as text, U as isCloudflareAccessChallenge, V as ensurePlatformAccessToken, X as normalizePlatformApiUrl, Y as listPlatformConnections, at as savePlatformConnection, c as import_picocolors, ot as selectPlatformConnection } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { parsePlatformDiscoveryDocument } from "@void/platform";
 //#region src/cli/platform-cmd.ts
 async function discoverPlatform(input, fetcher = fetch) {
 	const apiUrl = normalizePlatformApiUrl(input);
 	ensureCloudflaredToken(apiUrl);
-	const response = await fetcher(`${apiUrl}/.well-known/void-platform`, {
+	const request = () => fetcher(`${apiUrl}/.well-known/void-platform`, {
 		headers: {
 			Accept: "application/json",
 			...cfAccessHeaders(process.env, apiUrl)
@@ -14,6 +13,12 @@ async function discoverPlatform(input, fetcher = fetch) {
 		redirect: "manual",
 		signal: AbortSignal.timeout(15e3)
 	});
+	let response = await request();
+	if (isCloudflareAccessChallenge(response)) {
+		await response.body?.cancel();
+		ensurePlatformAccessToken(apiUrl, true);
+		response = await request();
+	}
 	if (!response.ok) throw new Error(`platform: Discovery failed at ${apiUrl} (HTTP ${response.status}).`);
 	let value;
 	try {
@@ -83,8 +88,13 @@ function saveDiscoveredPlatform(discovery) {
 	});
 }
 async function runPlatformCommand(_root, args) {
+	if (args.subcommand === "config") {
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-DrbQXXiW.mjs");
+		await runPlatformAuthConfig(args);
+		return;
+	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-DYWRbWUA.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-CjOTmAYE.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -116,7 +126,7 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-DN4MzJF_.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-BwAIgz-t.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 //#endregion

package/dist/{platform-domain-ChvbJkdy.mjs → platform-domain-C74PULqV.mjs}

@@ -1,7 +1,7 @@
-import { D as log, F as isCancel, N as text, O as note, Y as readInstallationRecoverySecrets, et as savePlatformConnection, nt as writeInstallationManifest, w as confirm, z as acquirePlatformLifecycleLock } from "./output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { S as resolvePlatformCloudflareCredential, assertNoninteractivePlatformMutationAcknowledged, d as createPlatformInstallPlan, g as PlatformCloudflareClient, l as recordPlatformWorkerTraffic, n as acquirePlatformDatabaseLifecycleLock, r as createPlatformHealthProbeToken, resolvePlatformInstallDatabaseUrl, s as recordResource, x as assertPlatformOperatorCredentialCanApplyPlan } from "./platform-lifecycle-DN4MzJF_.mjs";
-import { resolveInstalledPlatformManifest, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-Db2PXw0B.mjs";
+import { D as log, I as isCancel, P as text, W as acquirePlatformLifecycleLock, at as savePlatformConnection, et as readInstallationRecoverySecrets, k as note, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { C as PlatformCloudflareClient, assertNoninteractivePlatformMutationAcknowledged, d as recordPlatformWorkerTraffic, i as createPlatformHealthProbeToken, l as recordResource, n as acquirePlatformDatabaseLifecycleLock, p as createPlatformInstallPlan, resolvePlatformInstallDatabaseUrl, v as assertPlatformOperatorCredentialCanApplyPlan, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-BwAIgz-t.mjs";
+import { resolveInstalledPlatformManifest, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-COogu_Se.mjs";
 import { randomUUID } from "node:crypto";
 import { PLATFORM_APPLICATION_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts