Use this as the canonical checklist when onboarding a new domain/subdomain.
.search/domain-registry.json){
"domain": "api.factory-wager.com",
"zone": "factory-wager.com",
"bucket": "bun-secrets",
"prefix": "domains/api.factory-wager/cloudflare",
"requiredHeader": "x-factory-domain-token",
"tokenEnvVar": "FACTORY_WAGER_TOKEN_API"
}
DOMAIN_REGISTRY_PATH=.search/domain-registry.json
SEARCH_BENCH_DOMAIN=factory-wager.com
FACTORY_WAGER_REQUIRED_HEADER=x-factory-domain-token
FACTORY_WAGER_TOKEN_API=replace_me
Set the real value later in secret stores:
FACTORY_WAGER_TOKEN_APIFACTORY_WAGER_TOKEN_APIFACTORY_WAGER_TOKEN_<DOMAIN_LABEL>
Examples:
api.factory-wager.com -> FACTORY_WAGER_TOKEN_APIdocs.factory-wager.com -> FACTORY_WAGER_TOKEN_DOCSfactory-wager.com -> FACTORY_WAGER_TOKEN_ROOTRun:
bun run search:domain:doctor -- --json
Check:
bucketMapped includes the new domainheaderConfigured includes the new domaintokenPresent becomes true after real secret is setCommands:
bun run search:domain:doctor
bun run search:domain:doctor -- --fix
bun run search:domain:doctor -- --json
bun run search:domain:doctor -- --emit-secrets-commands
What doctor checks:
What --fix can auto-set safely:
replace_meWhat --fix cannot set:
To print ready-to-run secret command templates for missing tokens:
bun run search:domain:doctor -- --emit-secrets-commands