@void/platform 0.20.0

package/dist/index.mjs

@@ -0,0 +1,895 @@
+//#region src/manifest.ts
+const PLATFORM_DEPLOYMENT_SCHEMA_VERSION = 1;
+const CORE_CAPABILITIES = {
+	ai: true,
+	customDomains: false,
+	email: false,
+	githubActions: false,
+	githubOAuth: true,
+	googleOAuth: false,
+	managedBuilds: false,
+	sandbox: false
+};
+const CONTROL_PLANE_DEFAULTS = {
+	apiHostname: null,
+	dashboardHostname: null,
+	proxyHostname: null
+};
+function assertRecord$1(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object.`);
+}
+function requiredString$1(value, label) {
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`${label} must be a non-empty string.`);
+	return value;
+}
+function normalizeInstallationSlug(value) {
+	const slug = value.trim().toLowerCase().replaceAll(/[^a-z0-9-]+/g, "-").replaceAll(/^-+|-+$/g, "").replaceAll(/-{2,}/g, "-");
+	if (!slug) throw new Error("The installation name must contain a letter or number.");
+	if (slug.length > 40) throw new Error("The installation name must be 40 characters or fewer after normalization.");
+	return slug;
+}
+function normalizeApplicationDomain(value) {
+	let domain = value.trim().toLowerCase();
+	if (domain.endsWith(".")) domain = domain.slice(0, -1);
+	if (domain.length > 253 || !domain.includes(".") || domain.split(".").some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) throw new Error(`Invalid domain: ${JSON.stringify(value)}.`);
+	return domain;
+}
+function createPlatformResourceNames(installationSlug) {
+	const prefix = `void-${normalizeInstallationSlug(installationSlug)}`;
+	const datasetPrefix = prefix.replaceAll("-", "_");
+	return {
+		aiGateway: prefix,
+		apiWorker: `${prefix}-api`,
+		assetsBucket: `${prefix}-assets`,
+		cronQueue: `${prefix}-cron-fires`,
+		dashboardWorker: `${prefix}-dashboard`,
+		dispatchNamespace: `${prefix}-users`,
+		dispatchWorker: `${prefix}-dispatch`,
+		hyperdrive: `${prefix}-database`,
+		isrCacheKv: `${prefix}-isr-cache`,
+		legacyAssetsKv: `${prefix}-legacy-assets`,
+		logsDataset: `${datasetPrefix}_logs`,
+		proxyWorker: `${prefix}-proxy`,
+		requestsDataset: `${datasetPrefix}_requests`,
+		routingKv: `${prefix}-routing`,
+		tailWorker: `${prefix}-tail`,
+		usageQueue: `${prefix}-usage-events`
+	};
+}
+function createApplicationRoutes(application) {
+	if (!application.zoneName && application.workersDev) {
+		if (application.dedicatedZone) throw new Error("workers.dev cannot use a dedicated-zone catch-all.");
+		return [];
+	}
+	const baseDomain = normalizeApplicationDomain(application.baseDomain);
+	const zoneName = normalizeApplicationDomain(application.zoneName);
+	if (baseDomain !== zoneName && !baseDomain.endsWith(`.${zoneName}`)) throw new Error(`Application domain ${baseDomain} is not inside zone ${zoneName}.`);
+	const routes = [{
+		pattern: `*.${baseDomain}/*`,
+		zoneName
+	}, {
+		pattern: `*.${baseDomain}`,
+		zoneName
+	}];
+	if (application.dedicatedZone) {
+		if (baseDomain !== zoneName) throw new Error("A dedicated-zone catch-all requires the application domain to be the zone.");
+		routes.push({
+			pattern: "*/*",
+			zoneName
+		}, {
+			pattern: "*",
+			zoneName
+		});
+	}
+	return routes;
+}
+function createPlatformDeploymentManifest(input) {
+	const installationSlug = normalizeInstallationSlug(input.installationSlug);
+	const baseDomain = normalizeApplicationDomain(input.application.baseDomain);
+	const workersDev = input.application.workersDev;
+	if (workersDev && (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(workersDev.subdomain) || !/^[a-z0-9][a-z0-9-]{0,80}$/.test(workersDev.installationId))) throw new Error("Invalid workers.dev installation identity.");
+	const zoneName = workersDev && input.application.zoneName === "" ? "" : normalizeApplicationDomain(input.application.zoneName);
+	if (!zoneName && baseDomain !== `${workersDev.subdomain}.workers.dev`) throw new Error("workers.dev application domain must match its account subdomain.");
+	const resources = {
+		...createPlatformResourceNames(installationSlug),
+		...input.resources
+	};
+	const capabilities = {
+		...CORE_CAPABILITIES,
+		...input.capabilities
+	};
+	if (capabilities.managedBuilds && !capabilities.githubActions) throw new Error("Managed builds require the GitHub Actions capability.");
+	const providers = input.authentication?.providers ?? ["github"];
+	if (providers.length === 0) throw new Error("At least one authentication provider is required.");
+	if (providers.includes("github") !== capabilities.githubOAuth) throw new Error("The GitHub provider and githubOAuth capability must agree.");
+	if (providers.includes("google") !== capabilities.googleOAuth) throw new Error("The Google provider and googleOAuth capability must agree.");
+	const manifest = {
+		application: {
+			baseDomain,
+			dedicatedZone: input.application.dedicatedZone ?? false,
+			zoneName,
+			...workersDev ? { workersDev: { ...workersDev } } : {},
+			...input.application.zoneId ? { zoneId: requiredString$1(input.application.zoneId, "application.zoneId") } : {}
+		},
+		authentication: { providers: [...providers] },
+		capabilities,
+		controlPlane: {
+			...CONTROL_PLANE_DEFAULTS,
+			...input.controlPlane
+		},
+		displayName: requiredString$1(input.displayName, "displayName").trim(),
+		installationSlug,
+		resources,
+		schemaVersion: workersDev ? 2 : 1
+	};
+	createApplicationRoutes(manifest.application);
+	for (const [key, value] of Object.entries(manifest.controlPlane)) {
+		if (value !== null) normalizeApplicationDomain(value);
+		if (value === "") throw new Error(`controlPlane.${key} must be a hostname or null.`);
+	}
+	for (const [key, value] of Object.entries(manifest.resources)) requiredString$1(value, `resources.${key}`);
+	return manifest;
+}
+function parsePlatformDeploymentManifest(value) {
+	assertRecord$1(value, "Platform deployment manifest");
+	if (value.schemaVersion !== 1 && value.schemaVersion !== 2) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
+	const application = value.application;
+	const authentication = value.authentication;
+	const rawCapabilities = value.capabilities;
+	const controlPlane = value.controlPlane;
+	const rawResources = value.resources;
+	assertRecord$1(application, "application");
+	let workersDev;
+	if (value.schemaVersion === 2) {
+		assertRecord$1(application.workersDev, "application.workersDev");
+		workersDev = {
+			subdomain: requiredString$1(application.workersDev.subdomain, "workersDev.subdomain"),
+			installationId: requiredString$1(application.workersDev.installationId, "workersDev.installationId")
+		};
+	} else if (application.workersDev !== void 0) throw new Error("workers.dev requires platform deployment schema version 2.");
+	assertRecord$1(rawCapabilities, "capabilities");
+	assertRecord$1(controlPlane, "controlPlane");
+	assertRecord$1(authentication, "authentication");
+	assertRecord$1(rawResources, "resources");
+	const capabilityKeys = Object.keys(CORE_CAPABILITIES);
+	const capabilities = {};
+	for (const key of capabilityKeys) {
+		const entry = rawCapabilities[key];
+		if (typeof entry !== "boolean") throw new Error(`capabilities.${key} must be a boolean.`);
+		capabilities[key] = entry;
+	}
+	const providers = authentication.providers;
+	if (!Array.isArray(providers) || providers.some((provider) => provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
+	const resourceDefaults = createPlatformResourceNames(requiredString$1(value.installationSlug, "installationSlug"));
+	const resources = {};
+	for (const key of Object.keys(resourceDefaults)) resources[key] = requiredString$1(rawResources[key], `resources.${key}`);
+	const readHostname = (key) => {
+		const hostname = controlPlane[key];
+		return hostname === null ? null : requiredString$1(hostname, `controlPlane.${key}`);
+	};
+	return createPlatformDeploymentManifest({
+		application: {
+			baseDomain: requiredString$1(application.baseDomain, "application.baseDomain"),
+			dedicatedZone: application.dedicatedZone === true,
+			zoneName: workersDev && application.zoneName === "" ? "" : requiredString$1(application.zoneName, "application.zoneName"),
+			...workersDev ? { workersDev } : {},
+			...typeof application.zoneId === "string" ? { zoneId: application.zoneId } : {}
+		},
+		authentication: { providers },
+		capabilities,
+		controlPlane: {
+			apiHostname: readHostname("apiHostname"),
+			dashboardHostname: readHostname("dashboardHostname"),
+			proxyHostname: readHostname("proxyHostname")
+		},
+		displayName: requiredString$1(value.displayName, "displayName"),
+		installationSlug: requiredString$1(value.installationSlug, "installationSlug"),
+		resources
+	});
+}
+//#endregion
+//#region src/installation.ts
+const PLATFORM_INSTALLATION_SCHEMA_VERSION = 1;
+const PLATFORM_DISABLED_KEY = "__void/platform/disabled/v1";
+const PLATFORM_DISABLED_VALUE = "disabled";
+const PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY = "__void/platform/installation/v1";
+const PLATFORM_SANDBOX_DRAIN_KEY = "__void/platform/sandbox-drain/v1";
+const PLATFORM_R2_OWNERSHIP_MARKER_KEY = "__void/platform/ownership/v1";
+const PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION = 1;
+const PLATFORM_USAGE_PROTOCOL_VERSION = 1;
+const STATUS_TRANSITIONS = {
+	draft: [
+		"planned",
+		"failed",
+		"uninstalling"
+	],
+	planned: [
+		"provisioning",
+		"failed",
+		"uninstalling"
+	],
+	provisioning: [
+		"waiting-for-dns",
+		"waiting-for-oauth",
+		"deploying",
+		"disabling",
+		"failed",
+		"uninstalling"
+	],
+	"waiting-for-dns": [
+		"provisioning",
+		"disabling",
+		"failed",
+		"uninstalling"
+	],
+	"waiting-for-oauth": [
+		"provisioning",
+		"deploying",
+		"disabling",
+		"failed",
+		"uninstalling"
+	],
+	deploying: [
+		"provisioning",
+		"verifying",
+		"disabling",
+		"disabled",
+		"failed",
+		"uninstalling"
+	],
+	verifying: [
+		"provisioning",
+		"installed",
+		"disabling",
+		"failed",
+		"uninstalling"
+	],
+	installed: [
+		"provisioning",
+		"disabling",
+		"uninstalling",
+		"failed"
+	],
+	disabling: [
+		"disabled",
+		"failed",
+		"uninstalling"
+	],
+	disabled: [
+		"provisioning",
+		"uninstalling",
+		"failed"
+	],
+	uninstalling: ["uninstalled", "failed"],
+	uninstalled: [],
+	failed: [
+		"planned",
+		"provisioning",
+		"deploying",
+		"verifying",
+		"disabling",
+		"uninstalling"
+	]
+};
+function assertRecord(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object.`);
+}
+function requiredString(value, label) {
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`${label} must be a non-empty string.`);
+	return value;
+}
+function isInstallationStatus(value) {
+	return typeof value === "string" && Object.hasOwn(STATUS_TRANSITIONS, value);
+}
+function isResourceKind(value) {
+	return value === "ai-gateway" || value === "analytics-dataset" || value === "dispatch-namespace" || value === "dns-record" || value === "hyperdrive" || value === "kv-namespace" || value === "queue" || value === "r2-bucket" || value === "worker" || value === "worker-custom-domain" || value === "worker-route" || value === "zone";
+}
+function isOwnership(value) {
+	return value === "created" || value === "adopted" || value === "external";
+}
+function isResourceState(value) {
+	return value === "ready" || value === "retained" || value === "deleted";
+}
+function assertTimestamp(value, label) {
+	if (!Number.isFinite(Date.parse(value))) throw new Error(`${label} must be an ISO timestamp.`);
+	return value;
+}
+function createPlatformResourceOwnershipMarker(input) {
+	if (!isResourceKind(input.resourceKind)) throw new Error("Invalid ownership marker resource kind.");
+	return {
+		accountId: requiredString(input.accountId, "ownership accountId"),
+		installationId: requiredString(input.installationId, "ownership installationId"),
+		ownershipNonce: requiredString(input.ownershipNonce, "ownership ownershipNonce"),
+		resourceId: requiredString(input.resourceId, "ownership resourceId"),
+		resourceKey: requiredString(input.resourceKey, "ownership resourceKey"),
+		resourceKind: input.resourceKind,
+		resourceName: requiredString(input.resourceName, "ownership resourceName"),
+		schemaVersion: 1
+	};
+}
+function parsePlatformResourceOwnershipMarker(value) {
+	assertRecord(value, "Platform resource ownership marker");
+	if (value.schemaVersion !== 1) throw new Error(`Unsupported platform resource ownership schema version: ${String(value.schemaVersion)}.`);
+	if (!isResourceKind(value.resourceKind)) throw new Error("Invalid ownership marker resource kind.");
+	return createPlatformResourceOwnershipMarker({
+		accountId: requiredString(value.accountId, "ownership accountId"),
+		installationId: requiredString(value.installationId, "ownership installationId"),
+		ownershipNonce: requiredString(value.ownershipNonce, "ownership ownershipNonce"),
+		resourceId: requiredString(value.resourceId, "ownership resourceId"),
+		resourceKey: requiredString(value.resourceKey, "ownership resourceKey"),
+		resourceKind: value.resourceKind,
+		resourceName: requiredString(value.resourceName, "ownership resourceName")
+	});
+}
+function createPlatformInstallationManifest(input) {
+	const createdAt = assertTimestamp(input.createdAt, "createdAt");
+	if (!/^[a-z0-9][a-z0-9-]{7,79}$/.test(input.id)) throw new Error("Installation id must be a lowercase identifier between 8 and 80 characters.");
+	if (!/^[A-Za-z0-9_-]{32,128}$/.test(input.ownershipNonce)) throw new Error("Ownership nonce must contain 32 to 128 URL-safe characters.");
+	return {
+		account: {
+			id: requiredString(input.account.id, "account.id"),
+			name: requiredString(input.account.name, "account.name")
+		},
+		createdAt,
+		databaseSchemaDigest: null,
+		deployment: parsePlatformDeploymentManifest(JSON.parse(JSON.stringify(input.deployment))),
+		desiredState: "enabled",
+		endpoints: {
+			apiUrl: null,
+			dashboardUrl: null,
+			proxyUrl: null
+		},
+		id: input.id,
+		ownershipNonce: input.ownershipNonce,
+		platformVersion: requiredString(input.platformVersion, "platformVersion"),
+		resources: [],
+		runtime: null,
+		safetyProtocols: input.safetyProtocols ?? { sandboxDrain: 0 },
+		schemaVersion: 1,
+		status: "draft",
+		steps: [],
+		updatedAt: createdAt,
+		usageProtocolVersion: input.usageProtocolVersion ?? 0
+	};
+}
+function setInstallationDesiredState(manifest, desiredState, updatedAt) {
+	return {
+		...manifest,
+		desiredState,
+		updatedAt: assertTimestamp(updatedAt, "updatedAt")
+	};
+}
+function normalizeEndpoint(value, label) {
+	if (value === null) return null;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`${label} must be an absolute URL or null.`);
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) throw new Error(`${label} must be a credential-free HTTPS URL.`);
+	url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+	return url.href.replace(/\/$/, "");
+}
+function setInstallationEndpoints(manifest, endpoints, updatedAt) {
+	return {
+		...manifest,
+		endpoints: {
+			apiUrl: normalizeEndpoint(endpoints.apiUrl, "endpoints.apiUrl"),
+			dashboardUrl: normalizeEndpoint(endpoints.dashboardUrl, "endpoints.dashboardUrl"),
+			proxyUrl: normalizeEndpoint(endpoints.proxyUrl, "endpoints.proxyUrl")
+		},
+		updatedAt: assertTimestamp(updatedAt, "updatedAt")
+	};
+}
+function transitionInstallation(manifest, status, updatedAt) {
+	if (status !== manifest.status && !STATUS_TRANSITIONS[manifest.status].includes(status)) throw new Error(`Invalid installation transition: ${manifest.status} -> ${status}.`);
+	return {
+		...manifest,
+		status,
+		updatedAt: assertTimestamp(updatedAt, "updatedAt")
+	};
+}
+function recordInstallationResource(manifest, resource, updatedAt) {
+	requiredString(resource.key, "resource.key");
+	requiredString(resource.id, "resource.id");
+	requiredString(resource.name, "resource.name");
+	requiredString(resource.configHash, "resource.configHash");
+	const collision = manifest.resources.find((entry) => entry.key !== resource.key && entry.kind === resource.kind && entry.id === resource.id);
+	if (collision) throw new Error(`Resource id ${resource.id} is already owned by ${collision.key}.`);
+	const resources = manifest.resources.filter((entry) => entry.key !== resource.key);
+	resources.push({ ...resource });
+	resources.sort((left, right) => left.key.localeCompare(right.key));
+	return {
+		...manifest,
+		resources,
+		updatedAt: assertTimestamp(updatedAt, "updatedAt")
+	};
+}
+function recordInstallationStep(manifest, step, updatedAt) {
+	requiredString(step.key, "step.key");
+	requiredString(step.resultHash, "step.resultHash");
+	assertTimestamp(step.completedAt, "step.completedAt");
+	const existing = manifest.steps.find((entry) => entry.key === step.key);
+	if (existing && existing.resultHash !== step.resultHash) throw new Error(`Completed installation step ${step.key} has a different result.`);
+	const steps = existing ? manifest.steps : [...manifest.steps, { ...step }];
+	return {
+		...manifest,
+		steps,
+		updatedAt: assertTimestamp(updatedAt, "updatedAt")
+	};
+}
+function parsePlatformInstallationManifest(value) {
+	assertRecord(value, "Platform installation manifest");
+	if (value.schemaVersion !== 1) throw new Error(`Unsupported platform installation schema version: ${String(value.schemaVersion)}.`);
+	const account = value.account;
+	const endpoints = value.endpoints;
+	assertRecord(account, "account");
+	assertRecord(endpoints, "endpoints");
+	if (!isInstallationStatus(value.status)) throw new Error(`Invalid installation status: ${String(value.status)}.`);
+	if (!Array.isArray(value.resources)) throw new Error("resources must be an array.");
+	if (!Array.isArray(value.steps)) throw new Error("steps must be an array.");
+	const manifest = createPlatformInstallationManifest({
+		account: {
+			id: requiredString(account.id, "account.id"),
+			name: requiredString(account.name, "account.name")
+		},
+		createdAt: requiredString(value.createdAt, "createdAt"),
+		deployment: parsePlatformDeploymentManifest(value.deployment),
+		id: requiredString(value.id, "id"),
+		ownershipNonce: requiredString(value.ownershipNonce, "ownershipNonce"),
+		platformVersion: requiredString(value.platformVersion, "platformVersion"),
+		safetyProtocols: parseSafetyProtocols(value.safetyProtocols),
+		usageProtocolVersion: parseUsageProtocolVersion$1(value.usageProtocolVersion)
+	});
+	const runtime = parsePlatformRuntimeProvenance(value.runtime);
+	let pendingDomain;
+	if (value.pendingDomain !== void 0) {
+		assertRecord(value.pendingDomain, "pendingDomain");
+		pendingDomain = createPlatformDeploymentManifest({
+			...manifest.deployment,
+			application: value.pendingDomain
+		}).application;
+		if (!manifest.deployment.application.workersDev || !pendingDomain.zoneName || JSON.stringify(pendingDomain.workersDev) !== JSON.stringify(manifest.deployment.application.workersDev)) throw new Error("Pending domain must retain the installation workers.dev identity.");
+	}
+	const updatedAt = assertTimestamp(requiredString(value.updatedAt, "updatedAt"), "updatedAt");
+	let next = setInstallationEndpoints({
+		...manifest,
+		desiredState: value.desiredState === "disabled" || value.desiredState === "enabled" ? value.desiredState : value.status === "disabled" || value.status === "disabling" ? "disabled" : "enabled",
+		status: value.status,
+		runtime,
+		...pendingDomain ? { pendingDomain } : {},
+		updatedAt
+	}, {
+		apiUrl: endpoints.apiUrl === null ? null : requiredString(endpoints.apiUrl, "endpoints.apiUrl"),
+		dashboardUrl: endpoints.dashboardUrl === null ? null : requiredString(endpoints.dashboardUrl, "endpoints.dashboardUrl"),
+		proxyUrl: endpoints.proxyUrl === null ? null : requiredString(endpoints.proxyUrl, "endpoints.proxyUrl")
+	}, updatedAt);
+	for (const [index, entry] of value.resources.entries()) {
+		assertRecord(entry, `resources[${index}]`);
+		if (!isResourceKind(entry.kind)) throw new Error(`Invalid resources[${index}].kind.`);
+		if (!isOwnership(entry.ownership)) throw new Error(`Invalid resources[${index}].ownership.`);
+		if (!isResourceState(entry.state)) throw new Error(`Invalid resources[${index}].state.`);
+		next = recordInstallationResource(next, {
+			configHash: requiredString(entry.configHash, `resources[${index}].configHash`),
+			id: requiredString(entry.id, `resources[${index}].id`),
+			key: requiredString(entry.key, `resources[${index}].key`),
+			kind: entry.kind,
+			name: requiredString(entry.name, `resources[${index}].name`),
+			ownership: entry.ownership,
+			state: entry.state
+		}, next.updatedAt);
+	}
+	for (const [index, entry] of value.steps.entries()) {
+		assertRecord(entry, `steps[${index}]`);
+		next = recordInstallationStep(next, {
+			completedAt: requiredString(entry.completedAt, `steps[${index}].completedAt`),
+			key: requiredString(entry.key, `steps[${index}].key`),
+			resultHash: requiredString(entry.resultHash, `steps[${index}].resultHash`)
+		}, next.updatedAt);
+	}
+	const recordedDatabaseSchemaDigest = value.databaseSchemaDigest === void 0 || value.databaseSchemaDigest === null ? [...next.steps].reverse().find((step) => step.key.startsWith("database-schema:"))?.resultHash ?? null : requiredString(value.databaseSchemaDigest, "databaseSchemaDigest");
+	return {
+		...next,
+		databaseSchemaDigest: recordedDatabaseSchemaDigest,
+		updatedAt
+	};
+}
+function parseUsageProtocolVersion$1(value) {
+	if (value === void 0 || value === 0) return 0;
+	if (value === 1) return 1;
+	throw new Error("usageProtocolVersion must be 0 or 1.");
+}
+function parseSafetyProtocols(value) {
+	if (value === void 0) return { sandboxDrain: 0 };
+	assertRecord(value, "safetyProtocols");
+	if (value.sandboxDrain !== 0 && value.sandboxDrain !== 1 && value.sandboxDrain !== 2) throw new Error("safetyProtocols.sandboxDrain must be 0, 1, or 2.");
+	return { sandboxDrain: value.sandboxDrain };
+}
+function parsePlatformRuntimeProvenance(value) {
+	if (value === void 0 || value === null) return null;
+	assertRecord(value, "runtime");
+	if (value.source !== "custom" && value.source !== "package") throw new Error("runtime.source must be custom or package.");
+	const manifestSha256 = requiredString(value.manifestSha256, "runtime.manifestSha256");
+	if (!/^[0-9a-f]{64}$/.test(manifestSha256)) throw new Error("runtime.manifestSha256 must be a SHA-256 digest.");
+	const sourceRevision = value.sourceRevision === null || value.sourceRevision === void 0 ? null : requiredString(value.sourceRevision, "runtime.sourceRevision");
+	if (sourceRevision !== null && (sourceRevision.length > 200 || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(sourceRevision))) throw new Error("runtime.sourceRevision is invalid.");
+	return {
+		manifestSha256,
+		source: value.source,
+		sourceRevision
+	};
+}
+//#endregion
+//#region src/application.ts
+/** Minimal public-origin adapter; request policy remains in the service-bound dispatcher. */
+const PLATFORM_PROJECT_INGRESS_SOURCE = `export default {
+  fetch(request, env) {
+    if (new URL(request.url).hostname !== env.VOID_APP_HOSTNAME) {
+      return new Response('Not Found', {status: 404});
+    }
+    return env.PLATFORM_DISPATCH.fetch(request);
+  }
+};`;
+function readPlatformApplication(env) {
+	const baseDomain = env.SITE_DOMAIN ?? env.BASE_HOSTNAME ?? "void.app";
+	if (!env.PLATFORM_APPLICATION) return {
+		baseDomain,
+		zoneName: baseDomain,
+		dedicatedZone: false
+	};
+	return createPlatformDeploymentManifest({
+		installationSlug: "runtime",
+		displayName: "Runtime",
+		application: JSON.parse(env.PLATFORM_APPLICATION)
+	}).application;
+}
+function platformWorkersDevAliasKey(hostname) {
+	return `workers-dev:${hostname}`;
+}
+const PLATFORM_APPLICATION_KEY = "__void/platform/application/v1";
+async function resolvePlatformApplicationEnvironment(env) {
+	if (!env.PLATFORM_APPLICATION) return env;
+	const raw = await env.ROUTING.get(PLATFORM_APPLICATION_KEY);
+	if (!raw) return env;
+	const previous = readPlatformApplication(env);
+	const next = readPlatformApplication({ PLATFORM_APPLICATION: raw });
+	if (!previous.workersDev || !next.workersDev || previous.workersDev.installationId !== next.workersDev.installationId || previous.workersDev.subdomain !== next.workersDev.subdomain) throw new Error("Application routing belongs to another platform installation.");
+	return {
+		...env,
+		PLATFORM_APPLICATION: raw,
+		SITE_DOMAIN: next.baseDomain,
+		BASE_HOSTNAME: next.baseDomain,
+		...next.zoneId ? { CF_ZONE_ID: next.zoneId } : {}
+	};
+}
+function platformProjectIngressName(project, workersDev) {
+	if (!/^proj_[a-z0-9]{1,32}$/.test(project.id) || !/^[a-z0-9][a-z0-9-]*$/.test(project.slug)) throw new Error("Invalid platform project identity.");
+	const prefix = `void-${workersDev.installationId.slice(-12)}-`;
+	const suffix = `-${project.id.slice(5)}`;
+	return `${prefix}${project.slug.slice(0, 63 - prefix.length - suffix.length).replace(/-+$/, "")}${suffix}`;
+}
+function platformProjectWorkersDevHostname(project, workersDev) {
+	return `${platformProjectIngressName(project, workersDev)}.${workersDev.subdomain}.workers.dev`;
+}
+function platformProjectHostname(project, application) {
+	if (!application.zoneName && application.workersDev) return platformProjectWorkersDevHostname(project, application.workersDev);
+	return `${project.slug}.${application.baseDomain}`;
+}
+function platformProjectHostnames(project, application) {
+	return [.../* @__PURE__ */ new Set([platformProjectHostname(project, application), ...application.workersDev ? [platformProjectWorkersDevHostname(project, application.workersDev)] : []])];
+}
+//#endregion
+//#region src/discovery.ts
+const PLATFORM_DISCOVERY_SCHEMA_VERSION = 1;
+function normalizeOrigin(value, name) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`${name} must be an absolute URL.`);
+	}
+	if (!(url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1")) && url.protocol !== "https:" || url.username || url.password) throw new Error(`${name} must be a credential-free HTTPS URL.`);
+	if (url.pathname !== "" && url.pathname !== "/" || url.search || url.hash) throw new Error(`${name} must be an origin without a path, query, or fragment.`);
+	return url.origin;
+}
+function createPlatformDiscoveryDocument(input) {
+	if (!input.displayName.trim()) throw new Error("displayName must not be empty.");
+	if (!input.platformVersion.trim()) throw new Error("platformVersion must not be empty.");
+	if (input.applicationRouting) {
+		const application = readPlatformApplication({ PLATFORM_APPLICATION: JSON.stringify(input.applicationRouting) });
+		if (!application.workersDev || application.baseDomain !== input.applicationDomain || application.workersDev.installationId !== input.installationId) throw new Error("Application routing must match the discovery domain and installation identity.");
+	}
+	if (input.usageProtocolVersion !== void 0 && input.usageProtocolVersion !== 0 && input.usageProtocolVersion !== 1) throw new Error("usageProtocolVersion must be 0 or 1.");
+	if (input.authenticationProviders.length === 0) throw new Error("At least one authentication provider is required.");
+	if (input.authenticationProviders.includes("github") !== input.capabilities.githubOAuth || input.authenticationProviders.includes("google") !== input.capabilities.googleOAuth) throw new Error("Authentication providers and capabilities must agree.");
+	return {
+		...input,
+		apiUrl: normalizeOrigin(input.apiUrl, "apiUrl"),
+		applicationDomain: normalizeApplicationDomain(input.applicationDomain),
+		authenticationProviders: [...input.authenticationProviders],
+		displayName: input.displayName.trim(),
+		installationId: input.installationId?.trim() || null,
+		platformVersion: input.platformVersion.trim(),
+		proxyUrl: normalizeOrigin(input.proxyUrl, "proxyUrl"),
+		schemaVersion: input.applicationRouting?.workersDev ? 2 : 1,
+		usageProtocolVersion: input.usageProtocolVersion ?? 0
+	};
+}
+function parsePlatformDiscoveryDocument(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Platform discovery document must be an object.");
+	const document = value;
+	if (document.schemaVersion !== 1 && document.schemaVersion !== 2) throw new Error(`Unsupported platform discovery schema version: ${String(document.schemaVersion)}.`);
+	const capabilities = document.capabilities;
+	if (document.schemaVersion === 1 && document.applicationRouting !== void 0) throw new Error("Application routing requires discovery schema version 2.");
+	if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities)) throw new Error("capabilities must be an object.");
+	const capabilityNames = [
+		"ai",
+		"customDomains",
+		"email",
+		"githubActions",
+		"githubOAuth",
+		"googleOAuth",
+		"managedBuilds",
+		"sandbox"
+	];
+	const parsedCapabilities = {};
+	for (const name of capabilityNames) {
+		const enabled = capabilities[name];
+		if (typeof enabled !== "boolean") throw new Error(`capabilities.${name} must be a boolean.`);
+		parsedCapabilities[name] = enabled;
+	}
+	const providers = document.authenticationProviders;
+	if (!Array.isArray(providers) || providers.some((provider) => provider !== "github" && provider !== "google")) throw new Error("authenticationProviders must contain only github or google.");
+	const string = (name) => {
+		const entry = document[name];
+		if (typeof entry !== "string" || !entry.trim()) throw new Error(`${name} must be a non-empty string.`);
+		return entry;
+	};
+	const apiUrl = string("apiUrl");
+	const proxyUrl = typeof document.proxyUrl === "string" && document.proxyUrl.trim() ? document.proxyUrl : apiUrl === "https://api.void.cloud" ? "https://proxy.void.cloud" : apiUrl === "https://api.staging.void.cloud" ? "https://proxy.staging.void.cloud" : string("proxyUrl");
+	return createPlatformDiscoveryDocument({
+		apiUrl,
+		applicationDomain: string("applicationDomain"),
+		...document.schemaVersion === 2 ? { applicationRouting: readPlatformApplication({ PLATFORM_APPLICATION: JSON.stringify(document.applicationRouting ?? null) }) } : {},
+		authenticationProviders: providers,
+		capabilities: parsedCapabilities,
+		displayName: string("displayName"),
+		installationId: document.installationId === null ? null : string("installationId"),
+		platformVersion: string("platformVersion"),
+		proxyUrl,
+		usageProtocolVersion: parseUsageProtocolVersion(document.usageProtocolVersion)
+	});
+}
+function parseUsageProtocolVersion(value) {
+	if (value === void 0 || value === 0) return 0;
+	if (value === 1) return 1;
+	throw new Error("usageProtocolVersion must be 0 or 1.");
+}
+//#endregion
+//#region src/worker-config.ts
+function createPlatformWorkerConfigs(input) {
+	const { accountId, apiUrl, deployment, healthProbeToken, installationId, ownershipNonce, platformVersion, proxyUrl, resources, runtimeEntrypoints } = input;
+	const publicEndpoints = input.publicEndpoints ?? true;
+	const trafficState = input.trafficState ?? "enabled";
+	const names = deployment.resources;
+	const ownershipVars = (resourceKey, resourceName) => ({ PLATFORM_OWNERSHIP_MARKER: JSON.stringify(createPlatformResourceOwnershipMarker({
+		accountId,
+		installationId,
+		ownershipNonce,
+		resourceId: resourceName,
+		resourceKey,
+		resourceKind: "worker",
+		resourceName
+	})) });
+	const common = {
+		account_id: accountId,
+		compatibility_date: "2026-02-24",
+		observability: { enabled: true },
+		preview_urls: publicEndpoints,
+		workers_dev: publicEndpoints
+	};
+	const kv = [
+		{
+			binding: "ROUTING",
+			id: resources.routingKv
+		},
+		{
+			binding: "ISR_CACHE",
+			id: resources.isrCacheKv
+		},
+		{
+			binding: "STATIC_ASSETS",
+			id: resources.legacyAssetsKv
+		}
+	];
+	const dispatchNamespace = [{
+		binding: "DISPATCH",
+		namespace: names.dispatchNamespace
+	}];
+	const r2 = [{
+		binding: "STATIC_ASSETS_R2",
+		bucket_name: names.assetsBucket
+	}];
+	const fetchWorkersDev = Boolean(deployment.application.workersDev) || [apiUrl, proxyUrl].some((url) => new URL(url).hostname.endsWith(".workers.dev"));
+	const api = {
+		...common,
+		name: names.apiWorker,
+		main: runtimeEntrypoints.api,
+		no_bundle: true,
+		compatibility_flags: ["nodejs_compat", ...fetchWorkersDev ? ["global_fetch_strictly_public"] : []],
+		placement: { mode: "smart" },
+		hyperdrive: [{
+			binding: "HYPERDRIVE",
+			id: resources.hyperdrive
+		}],
+		kv_namespaces: kv,
+		r2_buckets: r2,
+		dispatch_namespaces: dispatchNamespace,
+		durable_objects: { bindings: [
+			{
+				name: "USAGE_COUNTER",
+				class_name: "UsageCounter"
+			},
+			{
+				name: "CRON_SCHEDULER",
+				class_name: "CronScheduler"
+			},
+			{
+				name: "ERROR_ALERT_MONITOR",
+				class_name: "ErrorAlertMonitor"
+			},
+			{
+				name: "SANDBOX_CONCURRENCY_COUNTER",
+				class_name: "SandboxConcurrencyCounter"
+			}
+		] },
+		migrations: [
+			{
+				tag: "v1",
+				new_sqlite_classes: ["UsageCounter"]
+			},
+			{
+				tag: "v2",
+				new_sqlite_classes: ["CronScheduler"]
+			},
+			{
+				tag: "v3",
+				new_sqlite_classes: ["ErrorAlertMonitor"]
+			},
+			{
+				tag: "v4",
+				new_sqlite_classes: ["SandboxConcurrencyCounter"]
+			}
+		],
+		queues: {
+			producers: [{
+				binding: "CRON_FIRES_QUEUE",
+				queue: names.cronQueue
+			}, {
+				binding: "USAGE_EVENTS_QUEUE",
+				queue: names.usageQueue
+			}],
+			consumers: [{
+				queue: names.usageQueue,
+				max_batch_size: 100,
+				max_batch_timeout: 5
+			}, {
+				queue: names.cronQueue,
+				max_batch_size: 50,
+				max_batch_timeout: 1,
+				max_retries: 3
+			}]
+		},
+		triggers: { crons: ["0 * * * *"] },
+		vars: {
+			AUTH_REDIRECT_URI: `${apiUrl}/auth/callback`,
+			AI_GATEWAY_ID: names.aiGateway,
+			CRON_FIRES_QUEUE_NAME: names.cronQueue,
+			DISPATCH_NAMESPACE: names.dispatchNamespace,
+			DISPATCH_WORKER_NAME: names.dispatchWorker,
+			LOGS_DATASET: names.logsDataset,
+			PLATFORM_CAPABILITIES: JSON.stringify(deployment.capabilities),
+			PLATFORM_DISPLAY_NAME: deployment.displayName,
+			PLATFORM_ENV: "production",
+			PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
+			PLATFORM_INSTALLATION_ID: installationId,
+			PLATFORM_TRAFFIC_STATE: trafficState,
+			...ownershipVars("api-worker", names.apiWorker),
+			PLATFORM_VERSION: platformVersion,
+			PROXY_URL: proxyUrl,
+			R2_STATIC_ASSETS_BUCKET: names.assetsBucket,
+			REQUESTS_DATASET: names.requestsDataset,
+			SITE_DOMAIN: deployment.application.baseDomain,
+			...deployment.application.workersDev ? { PLATFORM_APPLICATION: JSON.stringify(deployment.application) } : {},
+			TAIL_SERVICE_NAME: names.tailWorker,
+			VOID_PROXY_SERVICE: names.proxyWorker
+		}
+	};
+	if (publicEndpoints && deployment.controlPlane.apiHostname) api.routes = [{
+		pattern: deployment.controlPlane.apiHostname,
+		custom_domain: true
+	}];
+	const proxy = {
+		...common,
+		name: names.proxyWorker,
+		main: runtimeEntrypoints.proxy,
+		no_bundle: true,
+		compatibility_flags: ["nodejs_compat"],
+		ai: { binding: "AI" },
+		kv_namespaces: [{
+			binding: "ROUTING",
+			id: resources.routingKv
+		}],
+		services: [{
+			binding: "API",
+			service: names.apiWorker
+		}],
+		dispatch_namespaces: dispatchNamespace,
+		vars: {
+			AI_GATEWAY_ID: names.aiGateway,
+			PLATFORM_CAPABILITIES: JSON.stringify(deployment.capabilities),
+			PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
+			PLATFORM_INSTALLATION_ID: installationId,
+			PLATFORM_TRAFFIC_STATE: trafficState,
+			...ownershipVars("proxy-worker", names.proxyWorker)
+		}
+	};
+	if (publicEndpoints && deployment.controlPlane.proxyHostname) proxy.routes = [{
+		pattern: deployment.controlPlane.proxyHostname,
+		custom_domain: true
+	}];
+	return {
+		api,
+		proxy,
+		tail: {
+			...common,
+			name: names.tailWorker,
+			main: runtimeEntrypoints.tail,
+			no_bundle: true,
+			analytics_engine_datasets: [{
+				binding: "ANALYTICS",
+				dataset: names.logsDataset
+			}],
+			vars: {
+				PLATFORM_DISPATCH_WORKER_NAME: names.dispatchWorker,
+				...ownershipVars("tail-worker", names.tailWorker)
+			}
+		},
+		dispatch: {
+			...common,
+			name: names.dispatchWorker,
+			main: runtimeEntrypoints.dispatch,
+			no_bundle: true,
+			...publicEndpoints ? { routes: createApplicationRoutes(deployment.application).map((route) => ({
+				pattern: route.pattern,
+				zone_name: route.zoneName
+			})) } : {},
+			dispatch_namespaces: dispatchNamespace,
+			kv_namespaces: kv,
+			r2_buckets: r2,
+			analytics_engine_datasets: [{
+				binding: "ANALYTICS",
+				dataset: names.requestsDataset
+			}, {
+				binding: "LOGS",
+				dataset: names.logsDataset
+			}],
+			queues: { producers: [{
+				binding: "USAGE_QUEUE",
+				queue: names.usageQueue
+			}] },
+			tail_consumers: [{ service: names.tailWorker }],
+			vars: {
+				BASE_HOSTNAME: deployment.application.baseDomain,
+				...deployment.application.workersDev ? { PLATFORM_APPLICATION: JSON.stringify(deployment.application) } : {},
+				PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
+				PLATFORM_INSTALLATION_ID: installationId,
+				PLATFORM_TRAFFIC_STATE: trafficState,
+				...ownershipVars("dispatch-worker", names.dispatchWorker)
+			}
+		}
+	};
+}
+//#endregion
+export { PLATFORM_APPLICATION_KEY, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectWorkersDevHostname, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation };