void 1.1.12 → 1.2.0

package/dist/{platform-cmd-B2ec5eFg.mjs → platform-cmd-PiNRkopU.mjs}

@@ -1 +1 @@
-export { t as discoverPlatform, r as runPlatformCommand } from "./platform-cmd-CX7phm7V.mjs";
+export { t as discoverPlatform, r as runPlatformCommand } from "./platform-cmd-D5I1beUX.mjs";

package/dist/{platform-domain-DDNK2y-4.mjs → platform-domain-jpmBfZeb.mjs}

@@ -1,9 +1,9 @@
 import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { A as confirm, X as text, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { m as printSuccess, p as note } from "./output-CKguMgr7.mjs";
-import { C as createPlatformHealthProbeToken, E as recordResource, H as resolvePlatformCloudflareCredential, O as recordPlatformWorkerTraffic, V as assertPlatformOperatorCredentialCanApplyPlan, Y as PlatformCloudflareClient, k as createPlatformInstallPlan, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-3CR98Tg2.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-o3LCCeE4.mjs";
+import { A as confirm, X as text, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { m as printSuccess, p as note } from "./output-BpgYODYx.mjs";
+import { C as createPlatformHealthProbeToken, E as recordResource, H as resolvePlatformCloudflareCredential, O as recordPlatformWorkerTraffic, V as assertPlatformOperatorCredentialCanApplyPlan, Y as PlatformCloudflareClient, k as createPlatformInstallPlan, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-DyKmuNY6.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management--vDwSn35.mjs";
 import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {

package/dist/{platform-lifecycle-CWc5gr6c.mjs → platform-lifecycle-DH3Yr1qQ.mjs}

@@ -1 +1 @@
-export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-3CR98Tg2.mjs";
+export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-DyKmuNY6.mjs";

package/dist/{platform-lifecycle-3CR98Tg2.mjs → platform-lifecycle-DyKmuNY6.mjs}

@@ -3,13 +3,13 @@ import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
 import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-CKguMgr7.mjs";
-import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-CZJ4viYl.mjs";
-import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-DZKYCEJg.mjs";
-import { t as parsePlatformArgs } from "./platform-args-B7ke06up.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-DSvBc1Gu.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-hFbnWAVQ.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-Cor9XGoz.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-8jEYIeim.mjs";
+import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-DtROpNNI.mjs";
+import { t as parsePlatformArgs } from "./platform-args-DVbVClZl.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Byo_0_N9.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-Ca53gtt0.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -2405,8 +2405,10 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			githubOAuth: input.authentication.providers.includes("github"),
 			googleOAuth: input.authentication.providers.includes("google")
 		} : {},
-		...enableEmail ? { email: true } : {}
+		...enableEmail ? { email: true } : {},
+		...input.customDomains ? { customDomains: true } : {}
 	};
+	if (capabilities.customDomains && (testing || !input.dedicatedZone)) throw new Error("platform: Custom domains need a dedicated application zone. Install with a domain and --dedicated-zone.");
 	if (capabilities.email && options?.includeEmailGateway !== false && !enableEmail) throw new Error("platform: Email-enabled installations require VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID before deploying this runtime.");
 	if (input.appAccess && input.appAccess !== "public" && input.controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${input.applicationDomain.toLowerCase()}`)) throw new Error("platform: The API hostname must be outside the app Access wildcard. Use the application domain apex or workers.dev for the API, then plan again.");
 	const deployment = createPlatformDeploymentManifest({
@@ -2449,13 +2451,20 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			...deployment.controlPlane.dashboardUrl ? { dashboardUrl: deployment.controlPlane.dashboardUrl } : {}
 		}
 	};
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithCustomDomains = existing && deployment.capabilities.customDomains && !existing.deployment.capabilities.customDomains ? {
 		...existingWithDashboard,
 		capabilities: {
 			...existingWithDashboard.capabilities,
-			email: true
+			customDomains: true
 		}
 	} : existingWithDashboard;
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithCustomDomains,
+		capabilities: {
+			...existingWithCustomDomains.capabilities,
+			email: true
+		}
+	} : existingWithCustomDomains;
 	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
@@ -5450,7 +5459,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-CyLcD6ot.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-SHhvim1L.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -7767,14 +7776,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-DDNK2y-4.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-jpmBfZeb.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-Dmsg7lWA.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-BiNpZZab.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7785,7 +7794,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-DAE6g2QU.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-7m-PLaPJ.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7813,7 +7822,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		if (!args.resume && process.stdin.isTTY) {
 			const installs = resumableInstalls().filter((manifest) => !args.name || manifest.deployment.installationSlug === normalizeInstallationSlug(args.name));
 			const manifests = listInstallationManifests();
-			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
+			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 && !args.customDomains ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
 			if (installs.length > 0 || savedPlans.length > 0) {
 				const choice = await select({
 					message: "Continue a previous platform install?",
@@ -7961,7 +7970,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DAE6g2QU.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-7m-PLaPJ.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8067,6 +8076,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			applicationDomain,
 			controlPlaneDomain,
 			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
+			...args.customDomains ? { customDomains: true } : {},
 			dedicatedZone,
 			displayName,
 			...externalHyperdrive ? { externalHyperdrive } : {},
@@ -8093,6 +8103,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			zoneName,
 			controlPlaneDomain,
 			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
+			...args.customDomains ? { customDomains: true } : {},
 			dedicatedZone,
 			workersDev,
 			authConfig: args.authConfig,
@@ -8399,7 +8410,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DAE6g2QU.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-7m-PLaPJ.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;

package/dist/{platform-management-o3LCCeE4.mjs → platform-management--vDwSn35.mjs}

@@ -1,8 +1,8 @@
 import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-CKguMgr7.mjs";
-import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-3CR98Tg2.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-BpgYODYx.mjs";
+import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-DyKmuNY6.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 //#region src/cli/platform-teardown.ts
@@ -624,6 +624,7 @@ function platformLifecycleResumeCommand(args, installationId) {
 	if (args.runtime) command.push("--runtime", commandArgument(args.runtime));
 	if (args.subcommand === "rollback" && args.fromRuntime) command.push("--from-runtime", commandArgument(args.fromRuntime));
 	if ("dashboardUrl" in args && args.dashboardUrl) command.push("--dashboard-url", commandArgument(args.dashboardUrl));
+	if ("customDomains" in args && args.customDomains) command.push("--custom-domains");
 	if (args.yes) command.push("--yes");
 	return command.join(" ");
 }
@@ -714,6 +715,7 @@ async function runInstalledPlatformCommand(args) {
 			applicationDomain: deployment.application.baseDomain,
 			controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
 			...args.subcommand !== "rollback" && args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
+			...args.subcommand !== "rollback" && args.customDomains ? { customDomains: true } : {},
 			dedicatedZone: deployment.application.dedicatedZone,
 			displayName: deployment.displayName,
 			installationSlug: deployment.installationSlug,
@@ -790,7 +792,7 @@ async function runInstalledPlatformCommand(args) {
 			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || "",
 			...replacedLogin
 		});
-		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets);
+		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets, { enablingCustomDomains: plan.deployment.capabilities.customDomains && !manifest.deployment.capabilities.customDomains });
 		const emailZoneId = installation.desiredState !== "disabled" && plan.deployment.capabilities.email ? plan.deployment.emailSharedZoneId : void 0;
 		if (runtimeTokenToPreflight) await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(runtimeTokenToPreflight), {
 			accountId: manifest.account.id,
@@ -975,9 +977,13 @@ function assertPlatformRollbackCompatibility(installation, target, source) {
 	if (installation.databaseSchemaDigest !== source.manifest.database.schemaDigest) throw new Error("platform: The authoritative installation checkpoint does not record the installed runtime database schema. Repair or roll forward before rollback.");
 	if (target.manifest.safetyProtocols.sandboxDrain < installation.safetyProtocols.sandboxDrain) throw new Error("platform: The rollback target predates the installed sandbox-drain safety protocol.");
 }
-function resolvePlatformRuntimeTokenToPreflight(plan, secrets) {
+function resolvePlatformRuntimeTokenToPreflight(plan, secrets, options = {}) {
 	const explicitUpdate = secrets.workerSecretUpdates?.CF_API_TOKEN;
 	if (explicitUpdate) return explicitUpdate;
+	if (options.enablingCustomDomains) {
+		if (!secrets.cloudflareApiToken) throw new Error("platform: Before enabling project custom domains, set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to the platform runtime token with Zone → SSL and Certificates → Edit on the application zone so Void can check its access.");
+		return secrets.cloudflareApiToken;
+	}
 	return plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (action.key === "api-worker" || action.key === "proxy-worker")) ? secrets.cloudflareApiToken : "";
 }
 async function resolveInstalledPlatformManifest(selector, dependencies = {}) {

package/dist/{platform-management-DAE6g2QU.mjs → platform-management-7m-PLaPJ.mjs}

@@ -1 +1 @@
-export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-o3LCCeE4.mjs";
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management--vDwSn35.mjs";

package/dist/{platform-plans-config-CBMZxCep.mjs → platform-plans-config-CeydDSj0.mjs}

@@ -1,5 +1,5 @@
-import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { m as printSuccess } from "./output-CKguMgr7.mjs";
+import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { m as printSuccess } from "./output-BpgYODYx.mjs";
 import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
 import { stripVTControlCharacters } from "node:util";

package/dist/{platform-recovery-Dmsg7lWA.mjs → platform-recovery-BiNpZZab.mjs}

@@ -1,7 +1,7 @@
 import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-3CR98Tg2.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-o3LCCeE4.mjs";
+import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-DyKmuNY6.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management--vDwSn35.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{platform-setup-hFbnWAVQ.mjs → platform-setup-Ca53gtt0.mjs}

@@ -1,6 +1,6 @@
 import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
-import { L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, s as formatLink } from "./output-CKguMgr7.mjs";
+import { L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { f as import_picocolors, s as formatLink } from "./output-BpgYODYx.mjs";
 //#region src/cli/platform-setup.ts
 /** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
 function platformPromptAnswer(value) {
@@ -254,6 +254,7 @@ function platformInstallCommandArguments(options) {
 			flag("--zone", options.zoneName);
 			if (options.dedicatedZone) parts.push("--dedicated-zone");
 			else parts.push("--no-dedicated-zone");
+			if (options.customDomains) parts.push("--custom-domains");
 		}
 		flag("--control-plane-domain", options.controlPlaneDomain);
 		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");