@void/platform 0.20.1 → 0.20.2

package/README.md

@@ -16,12 +16,19 @@ for administrator sessions and audit records. See
 [Platform Administration](../../docs/guide/platform-administration.md) to operate
 an installed platform from your terminal.
 
+Platforms can use GitHub, Google, generic OIDC, Cloudflare Access, or a combination.
+Access protection is independent from login methods and can admit company-approved
+users automatically. Login settings, explicit account linking, and provider recovery
+are available through Void; upgrades preserve live settings and reject runtimes
+that cannot enforce their session revocation. See the installation and administration
+guides for setup, scoped CI credentials, and recovery requirements.
+
 The package contains:
 
 - versioned deployment and installation manifests
 - deterministic resource naming and application-route generation
 - discovery-document and capability contracts
-- Cloudflare Worker configuration generation for the core API, proxy, tail, and dispatch Workers
+- Cloudflare Worker configuration generation for the API, proxy, tail, dispatch, and email gateway Workers
 - A shared installation-owned traffic-disable protocol used by lifecycle-safe retained Workers
 - integrity-checked, deployable Worker bundles plus a schema-versioned PostgreSQL migration and rollback-compatibility manifest under the `./installer` export
 
@@ -31,6 +38,8 @@ Interactive lifecycle operations authenticate the human operator through Cloudfl
 
 Fresh installations require a unique JWT signing secret with at least 32 bytes of random material and a unique, canonical base64-encoded 32-byte project-encryption key from the operator's durable secret manager. The installer never makes an ephemeral workstation or CI registry the only custodian of these installation identity keys. Existing Workers preserve their deployed values during routine lifecycle operations.
 
+Email-enabled installations also need an independent email signing key. The installer generates it in encrypted recovery state, or accepts `VOID_PLATFORM_EMAIL_SIGNING_SECRET` from the operator's secret manager. Keep that original value for recovery on another machine and for headless upgrades without persistent recovery files.
+
 Browser OAuth cannot manage AI Gateway. Installation previews mark an inaccessible gateway as requiring inspection; apply rechecks it with the already-required runtime token (AI Gateway: Edit) before provisioning. All other provider operations keep the operator credential. Later OAuth lifecycle operations can reuse that token from encrypted local recovery storage. On another workstation, use a management API token with AI Gateway access or supply the runtime token explicitly for that check.
 
 Runtime and installation manifests record the last usage protocol proven live across the complete Worker set. A protocol transition gates traffic before the first Worker update and opens it only after target health and immutable versions pass; interrupted transitions remain gated and resumable.

package/dist/email-protocol.d.mts

@@ -0,0 +1,48 @@
+//#region src/email-protocol.d.ts
+/** Worker-safe wire contract shared by the platform gateway and tenant entry. */
+export declare const EMAIL_PROTOCOL_VERSION = 1;
+export declare const EMAIL_RECEIPT_PATH = "/__void/email/receipt/v1";
+export declare const EMAIL_MAX_ACTIONS: number;
+export declare const EMAIL_MAX_METADATA_BYTES: number;
+export declare const EMAIL_MAX_RESPONSE_BYTES: number;
+export declare const EMAIL_MAX_REPLY_BYTES: number;
+export declare const EMAIL_MAX_INBOUND_BYTES: number;
+export declare const EMAIL_MAX_INBOUND_HEADERS: number;
+export declare const EMAIL_MAX_INBOUND_HEADER_BYTES: number;
+export type EmailWireAction = {
+  type: "reject";
+  reason: string;
+} | {
+  type: "forward";
+  to: string;
+  headers?: Record<string, string>;
+} | {
+  type: "reply";
+  from: string;
+  to: string;
+  raw: Uint8Array;
+};
+export type EmailReceiptClaims = {
+  version: 1;
+  receiptId: string;
+  projectId: string;
+  deploymentId: string;
+  recipient: string;
+  expiresAt: number;
+};
+export type EmailWireEnvelope = {
+  from: string;
+  to: string;
+  headers: Record<string, string>;
+  raw: Uint8Array;
+  rawSize: number;
+  viaDomain?: string;
+};
+export declare function encodeEmailEnvelope(envelope: EmailWireEnvelope): Uint8Array;
+export declare function readEmailEnvelope(stream: ReadableStream<Uint8Array> | null, deadlineMs?: number): Promise<EmailWireEnvelope>;
+export declare function signEmailReceipt(claims: EmailReceiptClaims, signingSecret: string): Promise<string>;
+export declare function verifyEmailReceipt(token: string, signingSecret: string, expected: Pick<EmailReceiptClaims, "projectId" | "deploymentId" | "recipient">, now?: number): Promise<EmailReceiptClaims | null>;
+export declare function encodeEmailActions(actions: ReadonlyArray<EmailWireAction>): ReadableStream<Uint8Array>;
+/** Read each frame with fixed ceilings before parsing metadata or allocating a reply. */
+export declare function readEmailActions(stream: ReadableStream<Uint8Array>, deadlineMs?: number): Promise<Array<EmailWireAction>>;
+//#endregion

package/dist/email-protocol.mjs

@@ -0,0 +1,278 @@
+//#region src/email-protocol.ts
+/** Worker-safe wire contract shared by the platform gateway and tenant entry. */
+const EMAIL_PROTOCOL_VERSION = 1;
+const EMAIL_RECEIPT_PATH = "/__void/email/receipt/v1";
+const EMAIL_MAX_ACTIONS = 100;
+const EMAIL_MAX_METADATA_BYTES = 8192;
+const EMAIL_MAX_RESPONSE_BYTES = 8388608;
+const EMAIL_MAX_REPLY_BYTES = 5242880;
+const EMAIL_MAX_INBOUND_BYTES = 10485760;
+const EMAIL_MAX_INBOUND_HEADERS = 1024;
+const EMAIL_MAX_INBOUND_HEADER_BYTES = 131072;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+function assertFlatJson(bytes, maxDepth, maxFields) {
+	let depth = 0;
+	let fields = 0;
+	let quoted = false;
+	let escaped = false;
+	for (const byte of bytes) if (quoted) {
+		if (escaped) escaped = false;
+		else if (byte === 92) escaped = true;
+		else if (byte === 34) quoted = false;
+	} else if (byte === 34) quoted = true;
+	else if (byte === 123 || byte === 91) {
+		if (++depth > maxDepth) throw new Error("email metadata too deep");
+	} else if (byte === 125 || byte === 93) {
+		if (--depth < 0) throw new Error("invalid email metadata");
+	} else if (byte === 58 && ++fields > maxFields) throw new Error("too many email metadata fields");
+	if (quoted || depth !== 0) throw new Error("invalid email metadata");
+}
+function encodeEmailEnvelope(envelope) {
+	const metadata = encoder.encode(JSON.stringify({
+		from: envelope.from,
+		to: envelope.to,
+		headers: envelope.headers,
+		rawSize: envelope.rawSize,
+		...envelope.viaDomain ? { viaDomain: envelope.viaDomain } : {}
+	}));
+	if (metadata.byteLength > 131072 || envelope.raw.byteLength > 10485760) throw new Error("email envelope too large");
+	const bytes = new Uint8Array(4 + metadata.byteLength + envelope.raw.byteLength);
+	new DataView(bytes.buffer).setUint32(0, metadata.byteLength);
+	bytes.set(metadata, 4);
+	bytes.set(envelope.raw, 4 + metadata.byteLength);
+	return bytes;
+}
+async function readEmailEnvelope(stream, deadlineMs = 15e3) {
+	if (!stream) throw new Error("missing email envelope");
+	const reader = stream.getReader();
+	const limit = 10616836;
+	let bytes = /* @__PURE__ */ new Uint8Array(1024);
+	let total = 0;
+	const deadline = Date.now() + deadlineMs;
+	try {
+		for (;;) {
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) throw new Error("email envelope timeout");
+			let timer;
+			const chunk = await Promise.race([reader.read(), new Promise((_, reject) => {
+				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("email envelope timeout")), remaining);
+			})]).finally(() => {
+				if (timer !== void 0) clearTimeout(timer);
+			});
+			if (chunk.done) break;
+			const nextTotal = total + chunk.value.byteLength;
+			if (nextTotal > limit) throw new Error("email envelope too large");
+			if (nextTotal > bytes.byteLength) {
+				let capacity = bytes.byteLength;
+				while (capacity < nextTotal) capacity = Math.min(limit, capacity * 2);
+				const grown = new Uint8Array(capacity);
+				grown.set(bytes.subarray(0, total));
+				bytes = grown;
+			}
+			bytes.set(chunk.value, total);
+			total = nextTotal;
+		}
+	} catch (error) {
+		reader.cancel().catch(() => {});
+		throw error;
+	} finally {
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+	if (total < 4) throw new Error("truncated email envelope");
+	const metadataLength = new DataView(bytes.buffer).getUint32(0);
+	if (metadataLength > 131072 || total < 4 + metadataLength) throw new Error("invalid email envelope");
+	const metadataBytes = bytes.subarray(4, 4 + metadataLength);
+	assertFlatJson(metadataBytes, 2, 1032);
+	const metadata = JSON.parse(decoder.decode(metadataBytes));
+	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) throw new Error("invalid email envelope");
+	const value = metadata;
+	const raw = bytes.subarray(4 + metadataLength, total);
+	if (raw.byteLength > 10485760 || typeof value.from !== "string" || value.from.length > 320 || typeof value.to !== "string" || value.to.length > 320 || typeof value.rawSize !== "number" || value.rawSize !== raw.byteLength || !value.headers || typeof value.headers !== "object" || Array.isArray(value.headers) || Object.keys(value.headers).length > 1024 || Object.values(value.headers).some((header) => typeof header !== "string") || value.viaDomain !== void 0 && (typeof value.viaDomain !== "string" || value.viaDomain.length > 253)) throw new Error("invalid email envelope");
+	return {
+		from: value.from,
+		to: value.to,
+		headers: value.headers,
+		raw,
+		rawSize: raw.byteLength,
+		...value.viaDomain ? { viaDomain: value.viaDomain } : {}
+	};
+}
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function unbase64url(value) {
+	if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length > 1024) throw new Error("invalid receipt");
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4));
+	return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+async function receiptKey(secret, usage) {
+	if (!secret) throw new Error("Email signing key is not configured");
+	return crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, [usage]);
+}
+async function signEmailReceipt(claims, signingSecret) {
+	const payload = encoder.encode(JSON.stringify(claims));
+	const signature = new Uint8Array(await crypto.subtle.sign("HMAC", await receiptKey(signingSecret, "sign"), payload));
+	return `${base64url(payload)}.${base64url(signature)}`;
+}
+async function verifyEmailReceipt(token, signingSecret, expected, now = Date.now()) {
+	try {
+		if (token.length > 1536) return null;
+		const parts = token.split(".");
+		if (parts.length !== 2) return null;
+		const payload = unbase64url(parts[0]);
+		const signature = unbase64url(parts[1]);
+		if (payload.byteLength > 768 || signature.byteLength !== 32) return null;
+		if (!await crypto.subtle.verify("HMAC", await receiptKey(signingSecret, "verify"), Uint8Array.from(signature), Uint8Array.from(payload))) return null;
+		const claims = JSON.parse(decoder.decode(payload));
+		if (typeof claims !== "object" || claims === null) return null;
+		const value = claims;
+		if (value.version !== 1 || typeof value.receiptId !== "string" || !/^[a-f0-9-]{16,64}$/.test(value.receiptId) || value.projectId !== expected.projectId || value.deploymentId !== expected.deploymentId || value.recipient !== expected.recipient || typeof value.expiresAt !== "number" || !Number.isSafeInteger(value.expiresAt) || value.expiresAt < now || value.expiresAt > now + 6e4) return null;
+		return value;
+	} catch {
+		return null;
+	}
+}
+function frame(kind, payload) {
+	const bytes = new Uint8Array(5 + payload.byteLength);
+	new DataView(bytes.buffer).setUint32(0, payload.byteLength);
+	bytes[4] = kind;
+	bytes.set(payload, 5);
+	return bytes;
+}
+function encodeEmailActionMetadata(action) {
+	return encoder.encode(JSON.stringify(action.type === "reply" ? {
+		type: action.type,
+		from: action.from,
+		to: action.to
+	} : action));
+}
+function emailActionWireSizeFromMetadata(action, metadata) {
+	return 5 + metadata.byteLength + (action.type === "reply" ? 5 + action.raw.byteLength : 0);
+}
+function encodeEmailActions(actions) {
+	if (actions.length > 100) throw new Error("too many email actions");
+	let index = 0;
+	let pending = null;
+	let total = 0;
+	return new ReadableStream({ pull(controller) {
+		if (pending) {
+			controller.enqueue(pending);
+			pending = null;
+			return;
+		}
+		if (index === actions.length) {
+			controller.enqueue(frame(0, /* @__PURE__ */ new Uint8Array()));
+			controller.close();
+			return;
+		}
+		const action = actions[index++];
+		const metadata = encodeEmailActionMetadata(action);
+		if (metadata.byteLength > 8192) throw new Error("email action metadata too large");
+		if (action.type === "reply") {
+			if (action.raw.byteLength > 5242880) throw new Error("email reply too large");
+			pending = frame(2, action.raw);
+		}
+		total += emailActionWireSizeFromMetadata(action, metadata);
+		if (total + 5 > 8388608) throw new Error("email actions too large");
+		controller.enqueue(frame(1, metadata));
+	} });
+}
+/** Read each frame with fixed ceilings before parsing metadata or allocating a reply. */
+async function readEmailActions(stream, deadlineMs = 15e3) {
+	const reader = stream.getReader();
+	const actions = [];
+	let stash = /* @__PURE__ */ new Uint8Array(0);
+	let total = 0;
+	const deadline = Date.now() + deadlineMs;
+	async function readChunk() {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw new Error("email response timeout");
+		let timer;
+		return Promise.race([reader.read(), new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("email response timeout")), remaining);
+		})]).finally(() => {
+			if (timer !== void 0) clearTimeout(timer);
+		});
+	}
+	async function exact(length) {
+		const result = new Uint8Array(length);
+		let offset = 0;
+		while (offset < length) {
+			if (stash.byteLength === 0) {
+				const chunk = await readChunk();
+				if (chunk.done) throw new Error("truncated email response");
+				total += chunk.value.byteLength;
+				if (total > 8388608) throw new Error("email response too large");
+				stash = chunk.value;
+			}
+			const used = Math.min(stash.byteLength, length - offset);
+			result.set(stash.subarray(0, used), offset);
+			stash = stash.subarray(used);
+			offset += used;
+		}
+		return result;
+	}
+	try {
+		for (;;) {
+			const head = await exact(5);
+			const length = new DataView(head.buffer).getUint32(0);
+			const kind = head[4];
+			if (kind === 0) {
+				if (length !== 0 || stash.byteLength !== 0) throw new Error("invalid email response tail");
+				if (!(await readChunk()).done) throw new Error("invalid email response tail");
+				if (actions.some((action) => action.type === "reject") && actions.length !== 1) throw new Error("email reject cannot accompany delivery actions");
+				return actions;
+			}
+			if (kind !== 1 || length > 8192 || actions.length >= 100) throw new Error("invalid email action frame");
+			const metadataBytes = await exact(length);
+			assertFlatJson(metadataBytes, 2, 40);
+			const value = JSON.parse(decoder.decode(metadataBytes));
+			if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid email action");
+			const action = value;
+			if (action.type === "reply") {
+				if (typeof action.from !== "string" || typeof action.to !== "string" || Object.keys(action).length !== 3) throw new Error("invalid email reply");
+				const rawHead = await exact(5);
+				const rawLength = new DataView(rawHead.buffer).getUint32(0);
+				if (rawHead[4] !== 2 || rawLength > 5242880) throw new Error("invalid email reply frame");
+				actions.push({
+					type: "reply",
+					from: action.from,
+					to: action.to,
+					raw: await exact(rawLength)
+				});
+			} else if (action.type === "forward") {
+				if (typeof action.to !== "string" || Object.keys(action).length > 3 || action.headers !== void 0 && (typeof action.headers !== "object" || action.headers === null || Array.isArray(action.headers))) throw new Error("invalid email forward");
+				const headers = action.headers;
+				if (headers && (Object.keys(headers).length > 32 || Object.values(headers).some((v) => typeof v !== "string"))) throw new Error("invalid email headers");
+				actions.push({
+					type: "forward",
+					to: action.to,
+					...headers ? { headers } : {}
+				});
+			} else if (action.type === "reject") {
+				if (typeof action.reason !== "string" || Object.keys(action).length !== 2) throw new Error("invalid email reject");
+				actions.push({
+					type: "reject",
+					reason: action.reason
+				});
+			} else throw new Error("unknown email action");
+		}
+	} catch (error) {
+		reader.cancel().catch(() => {});
+		throw error;
+	} finally {
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+}
+//#endregion
+export { EMAIL_MAX_ACTIONS, EMAIL_MAX_INBOUND_BYTES, EMAIL_MAX_INBOUND_HEADERS, EMAIL_MAX_INBOUND_HEADER_BYTES, EMAIL_MAX_METADATA_BYTES, EMAIL_MAX_REPLY_BYTES, EMAIL_MAX_RESPONSE_BYTES, EMAIL_PROTOCOL_VERSION, EMAIL_RECEIPT_PATH, encodeEmailActions, encodeEmailEnvelope, readEmailActions, readEmailEnvelope, signEmailReceipt, verifyEmailReceipt };

package/dist/index.d.mts

@@ -1,3 +1,115 @@
+//#region src/authentication-recovery.d.ts
+/** Owner recovery capabilities authorize a provider test, never a platform session. */
+type PlatformAuthenticationRecovery = Readonly<{
+  installationId: string;
+  administratorUserId: string;
+  connectionId: string;
+  revision: number;
+  generation: number;
+  testId: string;
+  expiresAt: string;
+  signature: string;
+}>;
+export declare function platformAuthenticationRecoveryMessage(value: Omit<PlatformAuthenticationRecovery, "signature">): string;
+//#endregion
+//#region src/authentication.d.ts
+/** Platform login and perimeter configuration are independent of app authentication. */
+export declare const PLATFORM_LOGIN_KINDS: readonly ["github", "google", "oidc", "cloudflare-access"];
+type PlatformLoginKind = (typeof PLATFORM_LOGIN_KINDS)[number];
+type PlatformLoginConfiguration = Readonly<{
+  id: string;
+  kind: PlatformLoginKind;
+  label: string;
+  clientId: string;
+  /** Exact OIDC issuer; GitHub does not use OIDC. */
+  issuer?: string;
+  /** Google Workspace hosted domains, checked against the signed hd claim. */
+  allowedDomains: ReadonlyArray<string>;
+  /** An identity must belong to at least one configured group. */
+  requiredGroups: ReadonlyArray<string>;
+}>;
+type PlatformLoginDescriptor = Readonly<{
+  id: string;
+  kind: PlatformLoginKind;
+  label: string;
+}>;
+type PlatformAccessProtection = Readonly<{
+  teamDomain: string;
+  /** Each externally reachable platform origin has its own expected application audience. */
+  applications: ReadonlyArray<Readonly<{
+    origin: string;
+    audience: string;
+  }>>;
+}>;
+/** Operator-side coverage verification, bound to one administrator and settings revision. */
+export declare function platformProtectionProofMessage(input: {
+  installationId: string;
+  origin: string;
+  userId: string;
+  sessionId: string;
+  revision: number;
+  lifecycleVersion: string;
+  protection: PlatformAccessProtection | null;
+  expiresAt: string;
+}): string;
+type PlatformAdmissionPolicy = Readonly<{
+  mode: "restricted" | "public";
+}> | Readonly<{
+  mode: "company";
+  /** Explicitly trusted connections whose own configured restrictions must pass. */
+  connections: ReadonlyArray<string>;
+  /** A verified human Access identity qualifies, independently of the login method. */
+  access: boolean;
+}>;
+/** One persisted grant used by invited/allowlisted platform signup. */
+type PlatformSignupAllowlistEntry = Readonly<{
+  type: "github" | "email";
+  pattern: string;
+  note?: string;
+}> | Readonly<{
+  type: "identity";
+  /** Stable login connection namespace. */
+  connectionId: string;
+  /** Exact, case-sensitive provider subject. */
+  subject: string;
+  note?: string;
+}>;
+type PlatformSignupIdentity = Readonly<{
+  connectionId: string;
+  subject: string;
+  provider: string;
+  login: string;
+  /** Only pass a provider email after its verification claim has been validated. */
+  email: string | null;
+}>;
+export declare function parsePlatformSignupAllowlistEntry(value: unknown): PlatformSignupAllowlistEntry;
+/** Match one verified login identity against persisted signup grants. */
+export declare function isPlatformSignupAllowed(identity: PlatformSignupIdentity, entries: ReadonlyArray<PlatformSignupAllowlistEntry>): boolean;
+type PlatformAuthenticationSetup = Readonly<{
+  connections: ReadonlyArray<Readonly<{
+    configuration: PlatformLoginConfiguration;
+    clientSecret: string;
+  }>>;
+  administratorConnectionId: string;
+  bootstrapCredentialHash: string;
+  admission: PlatformAdmissionPolicy;
+  protection: PlatformAccessProtection | null;
+  resetPending?: boolean;
+}>;
+export declare function parsePlatformAuthenticationSetup(value: unknown): PlatformAuthenticationSetup;
+export declare const DEFAULT_PLATFORM_SESSION_SECONDS: number;
+export declare const GOOGLE_OIDC_ISSUER = "https://accounts.google.com";
+export declare const PLATFORM_AUTH_SETUP_PROOF_PREFIX = "void.platform.auth.setup.v1";
+export declare function parsePlatformLoginId(value: unknown): string;
+/** HTTPS syntax validation; outbound network policy must additionally validate resolved endpoints. */
+export declare function parsePlatformIdentityUrl(value: unknown, name: string, originOnly?: boolean): string;
+export declare function parsePlatformLoginDescriptor(value: unknown): PlatformLoginDescriptor;
+export declare function parsePlatformLoginConfiguration(value: unknown): PlatformLoginConfiguration;
+export declare function parsePlatformAccessProtection(value: unknown): PlatformAccessProtection | null;
+export declare function parsePlatformAdmissionPolicy(value: unknown): PlatformAdmissionPolicy;
+/** Run inside the settings mutation transaction, using the resulting enabled connections. */
+export declare function validatePlatformAdmissionPolicy(policy: PlatformAdmissionPolicy, enabledConnections: ReadonlyArray<PlatformLoginConfiguration>, protection: PlatformAccessProtection | null): void;
+//#endregion
 //#region src/application.d.ts
 /** Public application addressing, independent of the platform API's origin. */
 type PlatformApplication = Readonly<{
@@ -61,6 +173,7 @@ type PlatformResourceNames = Readonly<{
   dashboardWorker: string;
   dispatchNamespace: string;
   dispatchWorker: string;
+  emailGatewayWorker: string;
   hyperdrive: string;
   isrCacheKv: string;
   legacyAssetsKv: string;
@@ -73,15 +186,21 @@ type PlatformResourceNames = Readonly<{
 }>;
 type PlatformDeploymentManifest = Readonly<{
   application: PlatformApplication;
+  /** Zone that owns the installation's shared sender mail domain. */
+  emailSharedZoneId?: string;
+  /** Shared sender domain registered for managed email. */
+  emailSenderDomain?: string;
   authentication: Readonly<{
-    providers: ReadonlyArray<"github" | "google">;
+    providers: ReadonlyArray<PlatformLoginKind>;
+    configurable?: true;
+    accessProtection?: true;
   }>;
   capabilities: PlatformCapabilities;
   controlPlane: PlatformControlPlane;
   displayName: string;
   installationSlug: string;
   resources: PlatformResourceNames;
-  schemaVersion: typeof PLATFORM_DEPLOYMENT_SCHEMA_VERSION | 2;
+  schemaVersion: typeof PLATFORM_DEPLOYMENT_SCHEMA_VERSION | 2 | 3;
 }>;
 type PlatformDeploymentManifestInput = Readonly<{
   application: Readonly<{
@@ -91,8 +210,12 @@ type PlatformDeploymentManifestInput = Readonly<{
     workersDev?: PlatformApplication["workersDev"];
     zoneId?: string;
   }>;
+  emailSharedZoneId?: string;
+  emailSenderDomain?: string;
   authentication?: Readonly<{
-    providers?: ReadonlyArray<"github" | "google">;
+    providers?: ReadonlyArray<PlatformLoginKind>;
+    configurable?: true;
+    accessProtection?: true;
   }>;
   capabilities?: Partial<PlatformCapabilities>;
   controlPlane?: Partial<PlatformControlPlane>;
@@ -119,7 +242,7 @@ export declare const PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY = "__void/platfor
 export declare const PLATFORM_SANDBOX_DRAIN_KEY = "__void/platform/sandbox-drain/v1";
 export declare const PLATFORM_R2_OWNERSHIP_MARKER_KEY = "__void/platform/ownership/v1";
 export declare const PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION: 1;
-export declare const PLATFORM_USAGE_PROTOCOL_VERSION: 1;
+export declare const PLATFORM_USAGE_PROTOCOL_VERSION: 2;
 type InstallationStatus = "draft" | "planned" | "provisioning" | "waiting-for-dns" | "waiting-for-oauth" | "deploying" | "verifying" | "installed" | "disabling" | "disabled" | "uninstalling" | "uninstalled" | "failed";
 type ResourceOwnership = "created" | "adopted" | "external";
 type InstallationResourceKind = "ai-gateway" | "analytics-dataset" | "dispatch-namespace" | "dns-record" | "hyperdrive" | "kv-namespace" | "queue" | "r2-bucket" | "worker" | "worker-custom-domain" | "worker-route" | "zone";
@@ -148,6 +271,14 @@ type PlatformRuntimeProvenance = Readonly<{
   sourceRevision: string | null;
 }>;
 type PlatformInstallationManifest = Readonly<{
+  authenticationResources?: ReadonlyArray<Readonly<{
+    key: string;
+    kind: "application" | "service-token";
+    accountId: string;
+    id: string;
+    name: string;
+    ownership: "created" | "adopted";
+  }>>;
   account: Readonly<{
     id: string;
     name: string;
@@ -173,7 +304,7 @@ type PlatformInstallationManifest = Readonly<{
   steps: ReadonlyArray<InstallationStep>;
   updatedAt: string;
   /** Last usage protocol proven live across the installed Worker set. */
-  usageProtocolVersion: 0 | 1;
+  usageProtocolVersion: 0 | 1 | 2;
 }>;
 type PlatformResourceOwnershipMarker = Readonly<{
   accountId: string;
@@ -208,7 +339,7 @@ export declare function createPlatformInstallationManifest(input: {
   safetyProtocols?: Readonly<{
     sandboxDrain: 0 | 1 | 2;
   }>;
-  usageProtocolVersion?: 0 | 1;
+  usageProtocolVersion?: 0 | 1 | 2;
 }): PlatformInstallationManifest;
 export declare function setInstallationDesiredState(manifest: PlatformInstallationManifest, desiredState: PlatformInstallationManifest["desiredState"], updatedAt: string): PlatformInstallationManifest;
 export declare function setInstallationEndpoints(manifest: PlatformInstallationManifest, endpoints: PlatformInstallationEndpoints, updatedAt: string): PlatformInstallationManifest;
@@ -219,21 +350,27 @@ export declare function parsePlatformInstallationManifest(value: unknown): Platf
 //#endregion
 //#region src/discovery.d.ts
 export declare const PLATFORM_DISCOVERY_SCHEMA_VERSION: 1;
+type PlatformAuthenticationDiscovery = Readonly<{
+  methods: ReadonlyArray<PlatformLoginDescriptor>;
+  protectedByAccess: boolean;
+  setupPending?: boolean;
+}>;
 type PlatformDiscoveryDocument = Readonly<{
   apiUrl: string;
   applicationDomain: string;
   applicationRouting?: PlatformApplication;
-  authenticationProviders: ReadonlyArray<"github" | "google">;
+  authenticationProviders: ReadonlyArray<string>;
+  authentication?: PlatformAuthenticationDiscovery;
   capabilities: PlatformCapabilities;
   displayName: string;
   installationId: string | null;
   platformVersion: string;
   proxyUrl: string;
-  schemaVersion: typeof PLATFORM_DISCOVERY_SCHEMA_VERSION | 2;
-  usageProtocolVersion: 0 | 1;
+  schemaVersion: typeof PLATFORM_DISCOVERY_SCHEMA_VERSION | 2 | 3;
+  usageProtocolVersion: 0 | 1 | 2;
 }>;
 export declare function createPlatformDiscoveryDocument(input: Omit<PlatformDiscoveryDocument, "schemaVersion" | "usageProtocolVersion"> & {
-  usageProtocolVersion?: 0 | 1;
+  usageProtocolVersion?: 0 | 1 | 2;
 }): PlatformDiscoveryDocument;
 export declare function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscoveryDocument;
 //#endregion
@@ -245,8 +382,9 @@ type PlatformProvisionedResourceIds = Readonly<{
   routingKv: string;
   zone: string;
 }>;
-type PlatformWorkerConfigSet = Readonly<Record<"api" | "dispatch" | "proxy" | "tail", Record<string, unknown>>>;
+type PlatformWorkerConfigSet = Readonly<Record<"api" | "dispatch" | "proxy" | "tail" | "emailGateway", Record<string, unknown>>>;
 export declare function createPlatformWorkerConfigs(input: {
+  authenticationDatabaseUncached?: boolean;
   accountId: string;
   apiUrl: string;
   deployment: PlatformDeploymentManifest;
@@ -256,9 +394,10 @@ export declare function createPlatformWorkerConfigs(input: {
   platformVersion: string;
   publicEndpoints?: boolean;
   proxyUrl: string;
+  emailGatewayUrl: string;
   resources: PlatformProvisionedResourceIds;
-  runtimeEntrypoints: Readonly<Record<"api" | "dispatch" | "proxy" | "tail", string>>;
+  runtimeEntrypoints: Readonly<Record<"api" | "dispatch" | "proxy" | "tail" | "emailGateway", string>>;
   trafficState?: "enabled" | "sandbox-drain" | "staging";
 }): PlatformWorkerConfigSet;
 //#endregion
-export type { InstallationResource, InstallationResourceKind, InstallationStatus, InstallationStep, PlatformApplication, PlatformApplicationProject, PlatformApplicationRoute, PlatformCapabilities, PlatformControlPlane, PlatformDeploymentManifest, PlatformDeploymentManifestInput, PlatformDiscoveryDocument, PlatformInstallationEndpoints, PlatformInstallationManifest, PlatformProvisionedResourceIds, PlatformResourceNames, PlatformResourceOwnershipMarker, PlatformRuntimeProvenance, PlatformWorkerConfigSet, ResourceOwnership };
+export type { InstallationResource, InstallationResourceKind, InstallationStatus, InstallationStep, PlatformAccessProtection, PlatformAdmissionPolicy, PlatformApplication, PlatformApplicationProject, PlatformApplicationRoute, PlatformAuthenticationDiscovery, PlatformAuthenticationRecovery, PlatformAuthenticationSetup, PlatformCapabilities, PlatformControlPlane, PlatformDeploymentManifest, PlatformDeploymentManifestInput, PlatformDiscoveryDocument, PlatformInstallationEndpoints, PlatformInstallationManifest, PlatformLoginConfiguration, PlatformLoginDescriptor, PlatformLoginKind, PlatformProvisionedResourceIds, PlatformResourceNames, PlatformResourceOwnershipMarker, PlatformRuntimeProvenance, PlatformSignupAllowlistEntry, PlatformSignupIdentity, PlatformWorkerConfigSet, ResourceOwnership };