void 0.21.9 → 0.23.0

package/dist/{platform-domain-CU1JtJkW.mjs → platform-domain-BNkcz0OB.mjs}

@@ -1,10 +1,9 @@
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { d as readInstallationRecoverySecrets, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-QBa4DK32.mjs";
-import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
-import { C as assertPlatformOperatorCredentialCanApplyPlan, O as PlatformCloudflareClient, _ as createPlatformInstallPlan, c as createPlatformHealthProbeToken, h as recordPlatformWorkerTraffic, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, p as recordResource, t as assertNoninteractivePlatformMutationAcknowledged, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Bc047IeT.mjs";
-import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CVpGI9Y5.mjs";
-import { randomUUID } from "node:crypto";
-import { PLATFORM_APPLICATION_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
+import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-CTBk70IR.mjs";
+import { A as PlatformCloudflareClient, E as resolvePlatformCloudflareCredential, T as assertPlatformOperatorCredentialCanApplyPlan, _ as recordPlatformWorkerTraffic, c as createPlatformHealthProbeToken, m as recordResource, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, y as createPlatformInstallPlan } from "./platform-lifecycle-9OyBALhH.mjs";
+import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-CjwLVQwN.mjs";
+import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {
 	const current = manifest.deployment.application;
@@ -44,6 +43,7 @@ async function applyPlatformDomain(client, original, target, plan, dependencies)
 	if (zone.status !== "active") return {
 		manifest,
 		waitingForDns: true,
+		waitingForProtection: false,
 		nameServers: zone.nameServers
 	};
 	await dependencies.verifyRuntimeToken(zone.id);
@@ -80,11 +80,15 @@ async function applyPlatformDomain(client, original, target, plan, dependencies)
 		resources: observed.resources,
 		updatedAt: now()
 	});
-	await (dependencies.probe ?? probePlatformDomain)(`void-check-${randomUUID().slice(0, 8)}.${target.baseDomain}`, manifest);
+	await (dependencies.probe ?? probePlatformDomain)(`${PLATFORM_HEALTH_HOSTNAME_LABEL}.${target.baseDomain}`, manifest);
 	await dependencies.verifyOwnership(manifest);
-	const routing = manifest.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready");
-	if (!routing) throw new Error("platform: Routing storage is missing. Run platform repair first.");
-	await client.putKvValue(manifest.account.id, routing.id, PLATFORM_APPLICATION_KEY, JSON.stringify(deployment.application));
+	if (!manifest.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready")) throw new Error("platform: Routing storage is missing. Run platform repair first.");
+	if (!await (dependencies.activate ?? activatePlatformDomain)(deployment.application, manifest)) return {
+		manifest,
+		waitingForDns: false,
+		waitingForProtection: true,
+		nameServers: []
+	};
 	const { pendingDomain: _pending, ...ready } = manifest;
 	await save({
 		...ready,
@@ -94,9 +98,28 @@ async function applyPlatformDomain(client, original, target, plan, dependencies)
 	return {
 		manifest,
 		waitingForDns: false,
+		waitingForProtection: false,
 		nameServers: []
 	};
 }
+async function activatePlatformDomain(application, manifest) {
+	const url = `${manifest.endpoints.apiUrl}/internal/platform/domain-activate`;
+	const response = await fetch(url, {
+		method: "POST",
+		redirect: "manual",
+		signal: AbortSignal.timeout(12e4),
+		headers: {
+			"Content-Type": "application/json",
+			"X-Void-Platform-Probe": createPlatformHealthProbeToken(manifest.ownershipNonce),
+			...cfAccessHeaders(process.env, url)
+		},
+		body: JSON.stringify({ application })
+	});
+	const body = await response.json().catch(() => null);
+	if (!body || typeof body !== "object" || response.status === 404) throw new Error(`platform: The running platform cannot activate this domain (HTTP ${response.status}). Update the platform runtime with \`void platform upgrade ${manifest.id}\` (or repair it with \`void platform repair ${manifest.id}\`), then rerun this command.`);
+	if (!response.ok || body.ok !== true || body.installationId !== manifest.id || typeof body.ready !== "boolean") throw new Error(`platform: ${body.error ?? "The running platform could not prepare domain protection. Update or repair the platform, then rerun this command."}`);
+	return body.ready;
+}
 async function probePlatformDomain(hostname, manifest) {
 	const url = `https://${hostname}/health`;
 	try {
@@ -195,6 +218,10 @@ async function runPlatformDomainCommand(args) {
 			note(`Set the domain's nameservers at its registrar to:\n${result.nameServers.join("\n")}\nThen rerun: void platform domain set ${domain}`, "Waiting for DNS");
 			return;
 		}
+		if (result.waitingForProtection) {
+			note(`Domain protection is still being prepared. Existing workers.dev URLs remain active. Rerun: void platform domain set ${domain}`, "Preparing application domain");
+			return;
+		}
 		savePlatformConnection({
 			accountId: manifest.account.id,
 			apiUrl: manifest.endpoints.apiUrl,