void 0.21.9 → 0.22.0

package/dist/{output-CCH48AMM.mjs → picocolors-BTps1_gs.mjs}

@@ -1,5 +1,4 @@
-import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-DXIUcv95.mjs";
-import { L as spinner, j as log, k as isCI } from "./dist-Dn6nn2IU.mjs";
+import { t as __commonJSMin } from "./rolldown-runtime-DXIUcv95.mjs";
 //#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
 var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {};
@@ -70,77 +69,4 @@ var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.createColors = createColors;
 }));
 //#endregion
-//#region src/cli/output.ts
-var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
-/** Keep recovery commands on the same CLI when using the local checkout launcher. */
-function cliCommandName() {
-	const entryName = process.argv[1]?.split(/[\\/]/).at(-1);
-	return entryName === "void-dev" || entryName === "void-dev.cmd" ? "void-dev" : "void";
-}
-/**
-* Terminal-safe spinner wrapper. In CI and redirected output,
-* `@clack/prompts` spinner emits DEC Private Mode cursor hide/show codes
-* (`\x1b[?25l` / `\x1b[?25h`) that render as text artifacts. This wrapper
-* replaces the spinner with plain log output.
-*/
-function createSpinner(options, isTerminal = process.stdout.isTTY === true) {
-	if (!isCI() && isTerminal) return spinner(options);
-	let currentMessage = "";
-	return {
-		start(msg = "") {
-			currentMessage = msg;
-			if (msg) log.step(msg);
-		},
-		stop(msg = "") {
-			if (msg) log.info(msg);
-		},
-		message(msg = "") {
-			if (msg && msg !== currentMessage) {
-				currentMessage = msg;
-				log.step(msg);
-			}
-		},
-		cancel(msg = "") {
-			if (msg) log.warn(msg);
-		},
-		error(msg = "") {
-			if (msg) log.error(msg);
-		},
-		clear() {},
-		get isCancelled() {
-			return false;
-		}
-	};
-}
-function cliTitle(command) {
-	return import_picocolors.default.blue(`void ${command}`);
-}
-function sectionTitle(title) {
-	return import_picocolors.default.reset(import_picocolors.default.blue(title));
-}
-function categoryTitle(title) {
-	return import_picocolors.default.reset(import_picocolors.default.bold(import_picocolors.default.cyan(title)));
-}
-function dim(text) {
-	return import_picocolors.default.dim(text);
-}
-function tablePrefix() {
-	return `${import_picocolors.default.gray("│")}  `;
-}
-function helpLine(command, description) {
-	return `${import_picocolors.default.reset(command.padEnd(34))} ${import_picocolors.default.dim(description)}`;
-}
-/**
-* Ensure a timestamp string will be parsed as UTC by `new Date()`.
-* DB timestamps lack timezone info — appends 'Z' only when no
-* existing indicator (Z, z, or numeric offset) is present.
-*/
-function ensureUtc(s) {
-	const last = s.at(-1);
-	if (last === "Z" || last === "z") return s;
-	if (s.includes("+", 10)) return s;
-	if (s.lastIndexOf("-") > 9) return s;
-	return s + "Z";
-}
-//#endregion
-export { dim as a, import_picocolors as c, require_picocolors as d, createSpinner as i, sectionTitle as l, cliCommandName as n, ensureUtc as o, cliTitle as r, helpLine as s, categoryTitle as t, tablePrefix as u };
+export { require_picocolors as t };

package/dist/{platform-auth-config-z92h63q5.mjs → platform-auth-config-BlN8xTdD.mjs}

@@ -1,5 +1,5 @@
 import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
-import { B as text, E as confirm, F as password, I as select, M as multiselect, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { B as text, E as confirm, F as password, I as select, M as multiselect, W as isCancel } from "./dist-CTBk70IR.mjs";
 import { n as OperatorClient } from "./operator-client-DUwumHpQ.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-8KnOVXVd.mjs";
 import { execFile } from "node:child_process";
@@ -140,11 +140,11 @@ async function configurationInput(args, existing) {
 }
 async function runPlatformAuthConfig(args) {
 	if (args.action === "recover") {
-		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-o_340Ixx.mjs");
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-Dxij8ZbR.mjs");
 		return runPlatformAuthRecovery(args);
 	}
 	if (args.action === "protection") {
-		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-DeE3yr2R.mjs");
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-7d5aV2Jg.mjs");
 		return runPlatformProtectionConfig(args);
 	}
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-auth-protection-DeE3yr2R.mjs → platform-auth-protection-7d5aV2Jg.mjs}

@@ -1,11 +1,11 @@
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
 import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
-import { E as confirm, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { E as confirm, W as isCancel } from "./dist-CTBk70IR.mjs";
 import { n as OperatorClient } from "./operator-client-DUwumHpQ.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-8KnOVXVd.mjs";
-import { D as preparePlatformAccessSetup, E as parsePlatformAccessSetupSpec, O as PlatformCloudflareClient, T as checkpointPlatformAccessResources, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Bc047IeT.mjs";
-import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CVpGI9Y5.mjs";
+import { A as PlatformCloudflareClient, D as checkpointPlatformAccessResources, E as resolvePlatformCloudflareCredential, O as parsePlatformAccessSetupSpec, k as preparePlatformAccessSetup, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock } from "./platform-lifecycle-k0E0xoxx.mjs";
+import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-Brz_BDiT.mjs";
 import { createHmac } from "node:crypto";
 import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
 import { readFile } from "node:fs/promises";

package/dist/{platform-auth-recovery-o_340Ixx.mjs → platform-auth-recovery-Dxij8ZbR.mjs}

@@ -1,9 +1,9 @@
 import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
 import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, t as acquirePlatformLifecycleLock } from "./platform-registry-QBa4DK32.mjs";
-import { E as confirm, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { E as confirm, W as isCancel } from "./dist-CTBk70IR.mjs";
 import { a as resolveOperatorOrigin } from "./operator-auth-8KnOVXVd.mjs";
-import { O as PlatformCloudflareClient, f as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLockConnection, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Bc047IeT.mjs";
-import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CVpGI9Y5.mjs";
+import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, f as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLockConnection } from "./platform-lifecycle-k0E0xoxx.mjs";
+import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-Brz_BDiT.mjs";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";

package/dist/{platform-cmd-DNl8WosH.mjs → platform-cmd-B3hwKrFK.mjs}

@@ -1,8 +1,8 @@
-import { c as import_picocolors } from "./output-CCH48AMM.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { _ as selectPlatformConnection, g as savePlatformConnection, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl } from "./platform-registry-QBa4DK32.mjs";
 import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
-import { B as text, I as select, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { B as text, I as select, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { c as import_picocolors } from "./output-Dm_A4Tbv.mjs";
 import { parsePlatformDiscoveryDocument } from "@void/platform";
 //#region src/cli/platform-cmd.ts
 async function discoverPlatform(input, fetcher = fetch) {
@@ -92,12 +92,12 @@ function saveDiscoveredPlatform(discovery) {
 }
 async function runPlatformCommand(_root, args) {
 	if (args.subcommand === "config") {
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-z92h63q5.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-BlN8xTdD.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-03819ATr.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-BK5CCiT9.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -129,7 +129,7 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-Bs2qx1E3.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-DMh_qrry.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 //#endregion

package/dist/{platform-cmd-C4ZV3Vpy.mjs → platform-cmd-E0FuL212.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-DNl8WosH.mjs";
+import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-B3hwKrFK.mjs";
 export { discoverPlatform, runPlatformCommand };

package/dist/{platform-domain-CU1JtJkW.mjs → platform-domain-D6Xcy9ZX.mjs}

@@ -1,10 +1,9 @@
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { d as readInstallationRecoverySecrets, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
-import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { C as assertPlatformOperatorCredentialCanApplyPlan, O as PlatformCloudflareClient, _ as createPlatformInstallPlan, c as createPlatformHealthProbeToken, h as recordPlatformWorkerTraffic, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, p as recordResource, t as assertNoninteractivePlatformMutationAcknowledged, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Bc047IeT.mjs";
-import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CVpGI9Y5.mjs";
-import { randomUUID } from "node:crypto";
-import { PLATFORM_APPLICATION_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
+import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, T as assertPlatformOperatorCredentialCanApplyPlan, _ as recordPlatformWorkerTraffic, c as createPlatformHealthProbeToken, m as recordResource, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, y as createPlatformInstallPlan } from "./platform-lifecycle-k0E0xoxx.mjs";
+import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-Brz_BDiT.mjs";
+import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {
 	const current = manifest.deployment.application;
@@ -44,6 +43,7 @@ async function applyPlatformDomain(client, original, target, plan, dependencies)
 	if (zone.status !== "active") return {
 		manifest,
 		waitingForDns: true,
+		waitingForProtection: false,
 		nameServers: zone.nameServers
 	};
 	await dependencies.verifyRuntimeToken(zone.id);
@@ -80,11 +80,15 @@ async function applyPlatformDomain(client, original, target, plan, dependencies)
 		resources: observed.resources,
 		updatedAt: now()
 	});
-	await (dependencies.probe ?? probePlatformDomain)(`void-check-${randomUUID().slice(0, 8)}.${target.baseDomain}`, manifest);
+	await (dependencies.probe ?? probePlatformDomain)(`${PLATFORM_HEALTH_HOSTNAME_LABEL}.${target.baseDomain}`, manifest);
 	await dependencies.verifyOwnership(manifest);
-	const routing = manifest.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready");
-	if (!routing) throw new Error("platform: Routing storage is missing. Run platform repair first.");
-	await client.putKvValue(manifest.account.id, routing.id, PLATFORM_APPLICATION_KEY, JSON.stringify(deployment.application));
+	if (!manifest.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready")) throw new Error("platform: Routing storage is missing. Run platform repair first.");
+	if (!await (dependencies.activate ?? activatePlatformDomain)(deployment.application, manifest)) return {
+		manifest,
+		waitingForDns: false,
+		waitingForProtection: true,
+		nameServers: []
+	};
 	const { pendingDomain: _pending, ...ready } = manifest;
 	await save({
 		...ready,
@@ -94,9 +98,28 @@ async function applyPlatformDomain(client, original, target, plan, dependencies)
 	return {
 		manifest,
 		waitingForDns: false,
+		waitingForProtection: false,
 		nameServers: []
 	};
 }
+async function activatePlatformDomain(application, manifest) {
+	const url = `${manifest.endpoints.apiUrl}/internal/platform/domain-activate`;
+	const response = await fetch(url, {
+		method: "POST",
+		redirect: "manual",
+		signal: AbortSignal.timeout(12e4),
+		headers: {
+			"Content-Type": "application/json",
+			"X-Void-Platform-Probe": createPlatformHealthProbeToken(manifest.ownershipNonce),
+			...cfAccessHeaders(process.env, url)
+		},
+		body: JSON.stringify({ application })
+	});
+	const body = await response.json().catch(() => null);
+	if (!body || typeof body !== "object" || response.status === 404) throw new Error(`platform: The running platform cannot activate this domain (HTTP ${response.status}). Update the platform runtime with \`void platform upgrade ${manifest.id}\` (or repair it with \`void platform repair ${manifest.id}\`), then rerun this command.`);
+	if (!response.ok || body.ok !== true || body.installationId !== manifest.id || typeof body.ready !== "boolean") throw new Error(`platform: ${body.error ?? "The running platform could not prepare domain protection. Update or repair the platform, then rerun this command."}`);
+	return body.ready;
+}
 async function probePlatformDomain(hostname, manifest) {
 	const url = `https://${hostname}/health`;
 	try {
@@ -195,6 +218,10 @@ async function runPlatformDomainCommand(args) {
 			note(`Set the domain's nameservers at its registrar to:\n${result.nameServers.join("\n")}\nThen rerun: void platform domain set ${domain}`, "Waiting for DNS");
 			return;
 		}
+		if (result.waitingForProtection) {
+			note(`Domain protection is still being prepared. Existing workers.dev URLs remain active. Rerun: void platform domain set ${domain}`, "Preparing application domain");
+			return;
+		}
 		savePlatformConnection({
 			accountId: manifest.account.id,
 			apiUrl: manifest.endpoints.apiUrl,

package/dist/{platform-lifecycle-Bs2qx1E3.mjs → platform-lifecycle-DMh_qrry.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-Bc047IeT.mjs";
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-k0E0xoxx.mjs";
 export { runPlatformLifecycleCommand };