@void/platform 0.20.1 → 0.20.3

package/dist/index.mjs

@@ -1,3 +1,222 @@
+//#region src/authentication-recovery.ts
+function platformAuthenticationRecoveryMessage(value) {
+	return JSON.stringify([
+		"void-platform-auth-recovery-v1",
+		value.installationId,
+		value.administratorUserId,
+		value.connectionId,
+		value.revision,
+		value.generation,
+		value.testId,
+		value.expiresAt
+	]);
+}
+//#endregion
+//#region src/authentication.ts
+/** Platform login and perimeter configuration are independent of app authentication. */
+const PLATFORM_LOGIN_KINDS = [
+	"github",
+	"google",
+	"oidc",
+	"cloudflare-access"
+];
+/** Operator-side coverage verification, bound to one administrator and settings revision. */
+function platformProtectionProofMessage(input) {
+	return `void-platform-protection-v1\n${JSON.stringify({
+		installationId: input.installationId,
+		origin: input.origin,
+		userId: input.userId,
+		sessionId: input.sessionId,
+		revision: input.revision,
+		lifecycleVersion: input.lifecycleVersion,
+		protection: parsePlatformAccessProtection(input.protection),
+		expiresAt: input.expiresAt
+	})}`;
+}
+function parsePlatformSignupAllowlistEntry(value) {
+	const entry = record(value, "Signup allowlist entry");
+	const note = entry.note;
+	if (note !== void 0 && (typeof note !== "string" || note.length > 1e3)) throw new Error("Signup allowlist notes must be strings of at most 1000 characters.");
+	const optionalNote = note === void 0 ? {} : { note };
+	if (entry.type === "identity") {
+		const connectionId = parsePlatformLoginId(entry.connectionId);
+		if (typeof entry.subject !== "string" || entry.subject.length === 0 || entry.subject.length > 255) throw new Error("Identity subjects must be nonempty strings of at most 255 characters.");
+		return {
+			type: "identity",
+			connectionId,
+			subject: entry.subject,
+			...optionalNote
+		};
+	}
+	if (entry.type !== "github" && entry.type !== "email") throw new Error("Signup allowlist entry type must be github, email, or identity.");
+	if (typeof entry.pattern !== "string" || !entry.pattern || entry.pattern.length > 320 || /[\s,]/.test(entry.pattern)) throw new Error("Signup allowlist patterns must be nonempty strings of at most 320 characters.");
+	return {
+		type: entry.type,
+		pattern: entry.pattern,
+		...optionalNote
+	};
+}
+/** Match one verified login identity against persisted signup grants. */
+function isPlatformSignupAllowed(identity, entries) {
+	return entries.some((entry) => {
+		if (entry.type === "identity") return entry.connectionId === identity.connectionId && entry.subject === identity.subject;
+		if (entry.type === "github") return identity.provider === "github" && entry.pattern.toLowerCase() === identity.login.toLowerCase();
+		if (!identity.email) return false;
+		if (entry.pattern.startsWith("*@")) return identity.email.toLowerCase().endsWith(entry.pattern.slice(1).toLowerCase());
+		return entry.pattern.toLowerCase() === identity.email.toLowerCase();
+	});
+}
+function parsePlatformAuthenticationSetup(value) {
+	const input = record(value, "Authentication setup");
+	if (!Array.isArray(input.connections) || input.connections.length === 0 || input.connections.length > 32) throw new Error("Authentication setup requires between 1 and 32 connections.");
+	const connections = input.connections.map((value) => {
+		const entry = record(value, "Login connection");
+		string(entry.clientSecret, "Client secret", 8192);
+		return {
+			configuration: parsePlatformLoginConfiguration(entry.configuration),
+			clientSecret: entry.clientSecret
+		};
+	});
+	if (new Set(connections.map((entry) => entry.configuration.id)).size !== connections.length) throw new Error("Authentication setup connection IDs must be unique.");
+	const administratorConnectionId = parsePlatformLoginId(input.administratorConnectionId);
+	if (!connections.some((entry) => entry.configuration.id === administratorConnectionId)) throw new Error("The administrator login method must be included in setup.");
+	if (typeof input.bootstrapCredentialHash !== "string" || !/^[a-f0-9]{64}$/.test(input.bootstrapCredentialHash)) throw new Error("A SHA-256 bootstrap credential hash is required.");
+	const admission = parsePlatformAdmissionPolicy(input.admission);
+	const protection = parsePlatformAccessProtection(input.protection ?? null);
+	validatePlatformAdmissionPolicy(admission, connections.map((entry) => entry.configuration), protection);
+	if (input.resetPending !== void 0 && typeof input.resetPending !== "boolean") throw new Error("resetPending must be a boolean.");
+	return {
+		connections,
+		administratorConnectionId,
+		bootstrapCredentialHash: input.bootstrapCredentialHash,
+		admission,
+		protection,
+		...input.resetPending === true ? { resetPending: true } : {}
+	};
+}
+const DEFAULT_PLATFORM_SESSION_SECONDS = 2592e3;
+const GOOGLE_OIDC_ISSUER = "https://accounts.google.com";
+const PLATFORM_AUTH_SETUP_PROOF_PREFIX = "void.platform.auth.setup.v1";
+function record(value, name) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${name} must be an object.`);
+	return value;
+}
+function string(value, name, maximum = 512) {
+	if (typeof value !== "string" || !value.trim() || value.length > maximum || Array.from(value).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new Error(`${name} must be a nonempty string of at most ${maximum} characters.`);
+	return value.trim();
+}
+function strings(value, name, maximum = 100) {
+	if (!Array.isArray(value) || value.length > maximum) throw new Error(`${name} must be an array of at most ${maximum} strings.`);
+	const result = value.map((entry) => string(entry, name));
+	if (new Set(result).size !== result.length) throw new Error(`${name} must not contain duplicates.`);
+	return result;
+}
+function parsePlatformLoginId(value) {
+	if (typeof value !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(value)) throw new Error("Login connection IDs must start with a letter and use 1–64 lowercase letters, digits, or hyphens.");
+	return value;
+}
+/** HTTPS syntax validation; outbound network policy must additionally validate resolved endpoints. */
+function parsePlatformIdentityUrl(value, name, originOnly = false) {
+	const input = string(value, name, 2048);
+	let url;
+	try {
+		url = new URL(input);
+	} catch {
+		throw new Error(`${name} must be a credential-free HTTPS URL.`);
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || originOnly && url.pathname !== "/") throw new Error(`${name} must be a credential-free HTTPS ${originOnly ? "origin" : "URL"} without query or fragment.`);
+	return originOnly ? url.origin : input;
+}
+function parsePlatformLoginDescriptor(value) {
+	const entry = record(value, "Login connection");
+	const id = parsePlatformLoginId(entry.id);
+	if (!PLATFORM_LOGIN_KINDS.includes(entry.kind)) throw new Error("Login kind must be github, google, oidc, or cloudflare-access.");
+	const kind = entry.kind;
+	if ((id === "github" || id === "google") && id !== kind) throw new Error(`Connection ID ${id} is reserved for ${id} login.`);
+	if ((kind === "github" || kind === "google") && id !== kind) throw new Error(`${kind} uses the fixed connection ID ${kind}.`);
+	return {
+		id,
+		kind,
+		label: string(entry.label, "Login label", 100)
+	};
+}
+function parsePlatformLoginConfiguration(value) {
+	const entry = record(value, "Login configuration");
+	const descriptor = parsePlatformLoginDescriptor(entry);
+	const clientId = string(entry.clientId, "Client ID");
+	const allowedDomains = strings(entry.allowedDomains ?? [], "Allowed domains").map((domain) => {
+		const normalized = domain.toLowerCase();
+		if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(normalized)) throw new Error("Allowed domains must be exact domain names, without wildcards.");
+		return normalized;
+	});
+	if (new Set(allowedDomains).size !== allowedDomains.length) throw new Error("Allowed domains must not contain duplicates.");
+	const requiredGroups = strings(entry.requiredGroups ?? [], "Required groups");
+	if (descriptor.kind !== "google" && allowedDomains.length > 0) throw new Error("Workspace domain restrictions are only supported by Google login.");
+	if ((descriptor.kind === "github" || descriptor.kind === "google") && requiredGroups.length > 0) throw new Error("Group restrictions require an OIDC or Cloudflare Access connection.");
+	let issuer;
+	if (descriptor.kind === "google") {
+		if (entry.issuer !== void 0 && entry.issuer !== "https://accounts.google.com") throw new Error("Google login uses the Google issuer.");
+		issuer = GOOGLE_OIDC_ISSUER;
+	} else if (descriptor.kind === "github") {
+		if (entry.issuer !== void 0) throw new Error("GitHub login does not accept an OIDC issuer.");
+	} else {
+		issuer = parsePlatformIdentityUrl(entry.issuer, "OIDC issuer");
+		if (descriptor.kind === "cloudflare-access") {
+			const url = new URL(issuer);
+			if (!/^[a-z0-9-]+\.cloudflareaccess\.com$/.test(url.hostname) || url.port || !url.pathname.startsWith("/cdn-cgi/access/sso/oidc/") || decodeURIComponent(url.pathname.slice(25).replace(/\/$/, "")) !== clientId) throw new Error("Cloudflare Access login requires its application issuer URL and matching client ID. Use generic OIDC for another issuer.");
+		}
+	}
+	return {
+		...descriptor,
+		clientId,
+		...issuer ? { issuer } : {},
+		allowedDomains,
+		requiredGroups
+	};
+}
+function parsePlatformAccessProtection(value) {
+	if (value === null) return null;
+	const entry = record(value, "Access protection");
+	const teamDomain = parsePlatformIdentityUrl(entry.teamDomain, "Access team domain", true);
+	const host = new URL(teamDomain).hostname;
+	if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.cloudflareaccess\.com$/.test(host) || new URL(teamDomain).port) throw new Error("Access team domain must be an HTTPS cloudflareaccess.com team origin.");
+	if (!Array.isArray(entry.applications) || entry.applications.length === 0 || entry.applications.length > 20) throw new Error("Access protection requires between 1 and 20 protected origins.");
+	const applications = entry.applications.map((value) => {
+		const application = record(value, "Access application");
+		return {
+			origin: parsePlatformIdentityUrl(application.origin, "Protected origin", true),
+			audience: string(application.audience, "Access application audience")
+		};
+	});
+	if (new Set(applications.map((app) => app.origin)).size !== applications.length) throw new Error("Each protected origin must have exactly one Access application.");
+	return {
+		teamDomain,
+		applications
+	};
+}
+function parsePlatformAdmissionPolicy(value) {
+	const entry = record(value, "Admission policy");
+	if (entry.mode === "restricted" || entry.mode === "public") return { mode: entry.mode };
+	if (entry.mode !== "company" || typeof entry.access !== "boolean") throw new Error("Admission policy must select restricted, company, or public signup.");
+	const connections = strings(entry.connections, "Company connections").map(parsePlatformLoginId);
+	if (!entry.access && connections.length === 0) throw new Error("Company admission requires a trusted connection or Access protection.");
+	return {
+		mode: "company",
+		connections,
+		access: entry.access
+	};
+}
+/** Run inside the settings mutation transaction, using the resulting enabled connections. */
+function validatePlatformAdmissionPolicy(policy, enabledConnections, protection) {
+	if (policy.mode !== "company") return;
+	if (policy.access && !protection) throw new Error("Company admission through Access requires enabled protection.");
+	for (const id of policy.connections) {
+		const connection = enabledConnections.find((entry) => entry.id === id);
+		if (!connection) throw new Error(`Company admission requires enabled connection ${id}.`);
+		if (connection.kind === "github" || connection.kind === "google" && connection.allowedDomains.length === 0) throw new Error("Unrestricted social login does not establish company membership.");
+	}
+}
+//#endregion
 //#region src/manifest.ts
 const PLATFORM_DEPLOYMENT_SCHEMA_VERSION = 1;
 const CORE_CAPABILITIES = {
@@ -45,6 +264,7 @@ function createPlatformResourceNames(installationSlug) {
 		dashboardWorker: `${prefix}-dashboard`,
 		dispatchNamespace: `${prefix}-users`,
 		dispatchWorker: `${prefix}-dispatch`,
+		emailGatewayWorker: `${prefix}-email-gateway`,
 		hyperdrive: `${prefix}-database`,
 		isrCacheKv: `${prefix}-isr-cache`,
 		legacyAssetsKv: `${prefix}-legacy-assets`,
@@ -84,6 +304,7 @@ function createApplicationRoutes(application) {
 	return routes;
 }
 function createPlatformDeploymentManifest(input) {
+	if (input.emailSharedZoneId === void 0 !== (input.emailSenderDomain === void 0)) throw new Error("Shared email configuration requires both emailSenderDomain and emailSharedZoneId.");
 	const installationSlug = normalizeInstallationSlug(input.installationSlug);
 	const baseDomain = normalizeApplicationDomain(input.application.baseDomain);
 	const workersDev = input.application.workersDev;
@@ -100,6 +321,8 @@ function createPlatformDeploymentManifest(input) {
 	};
 	if (capabilities.managedBuilds && !capabilities.githubActions) throw new Error("Managed builds require the GitHub Actions capability.");
 	const providers = input.authentication?.providers ?? ["github"];
+	if (providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider)) || new Set(providers).size !== providers.length) throw new Error("Authentication providers must be unique supported login kinds.");
+	const configurable = input.authentication?.configurable === true || input.authentication?.accessProtection === true || providers.some((provider) => provider === "oidc" || provider === "cloudflare-access");
 	if (providers.length === 0) throw new Error("At least one authentication provider is required.");
 	if (providers.includes("github") !== capabilities.githubOAuth) throw new Error("The GitHub provider and githubOAuth capability must agree.");
 	if (providers.includes("google") !== capabilities.googleOAuth) throw new Error("The Google provider and googleOAuth capability must agree.");
@@ -111,8 +334,14 @@ function createPlatformDeploymentManifest(input) {
 			...workersDev ? { workersDev: { ...workersDev } } : {},
 			...input.application.zoneId ? { zoneId: requiredString$1(input.application.zoneId, "application.zoneId") } : {}
 		},
-		authentication: { providers: [...providers] },
+		authentication: {
+			providers: [...providers],
+			...configurable ? { configurable: true } : {},
+			...input.authentication?.accessProtection ? { accessProtection: true } : {}
+		},
 		capabilities,
+		...input.emailSharedZoneId !== void 0 ? { emailSharedZoneId: requiredString$1(input.emailSharedZoneId, "emailSharedZoneId") } : {},
+		...input.emailSenderDomain !== void 0 ? { emailSenderDomain: normalizeApplicationDomain(input.emailSenderDomain) } : {},
 		controlPlane: {
 			...CONTROL_PLANE_DEFAULTS,
 			...input.controlPlane
@@ -120,7 +349,7 @@ function createPlatformDeploymentManifest(input) {
 		displayName: requiredString$1(input.displayName, "displayName").trim(),
 		installationSlug,
 		resources,
-		schemaVersion: workersDev ? 2 : 1
+		schemaVersion: configurable ? 3 : workersDev ? 2 : 1
 	};
 	createApplicationRoutes(manifest.application);
 	for (const [key, value] of Object.entries(manifest.controlPlane)) {
@@ -132,7 +361,7 @@ function createPlatformDeploymentManifest(input) {
 }
 function parsePlatformDeploymentManifest(value) {
 	assertRecord$1(value, "Platform deployment manifest");
-	if (value.schemaVersion !== 1 && value.schemaVersion !== 2) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
+	if (value.schemaVersion !== 1 && value.schemaVersion !== 2 && value.schemaVersion !== 3) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
 	const application = value.application;
 	const authentication = value.authentication;
 	const rawCapabilities = value.capabilities;
@@ -140,7 +369,7 @@ function parsePlatformDeploymentManifest(value) {
 	const rawResources = value.resources;
 	assertRecord$1(application, "application");
 	let workersDev;
-	if (value.schemaVersion === 2) {
+	if (value.schemaVersion === 2 || value.schemaVersion === 3 && application.workersDev !== void 0) {
 		assertRecord$1(application.workersDev, "application.workersDev");
 		workersDev = {
 			subdomain: requiredString$1(application.workersDev.subdomain, "workersDev.subdomain"),
@@ -159,10 +388,11 @@ function parsePlatformDeploymentManifest(value) {
 		capabilities[key] = entry;
 	}
 	const providers = authentication.providers;
-	if (!Array.isArray(providers) || providers.some((provider) => provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
+	if (!Array.isArray(providers) || providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider) || value.schemaVersion !== 3 && provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
+	if (value.schemaVersion === 3 && authentication.configurable !== true || value.schemaVersion !== 3 && (authentication.configurable !== void 0 || authentication.accessProtection !== void 0) || authentication.accessProtection !== void 0 && authentication.accessProtection !== true) throw new Error("Configurable authentication requires deployment schema version 3.");
 	const resourceDefaults = createPlatformResourceNames(requiredString$1(value.installationSlug, "installationSlug"));
 	const resources = {};
-	for (const key of Object.keys(resourceDefaults)) resources[key] = requiredString$1(rawResources[key], `resources.${key}`);
+	for (const key of Object.keys(resourceDefaults)) resources[key] = requiredString$1(rawResources[key] ?? (key === "emailGatewayWorker" ? resourceDefaults[key] : void 0), `resources.${key}`);
 	const readHostname = (key) => {
 		const hostname = controlPlane[key];
 		return hostname === null ? null : requiredString$1(hostname, `controlPlane.${key}`);
@@ -175,8 +405,14 @@ function parsePlatformDeploymentManifest(value) {
 			...workersDev ? { workersDev } : {},
 			...typeof application.zoneId === "string" ? { zoneId: application.zoneId } : {}
 		},
-		authentication: { providers },
+		authentication: {
+			providers,
+			...authentication.configurable === true ? { configurable: true } : {},
+			...authentication.accessProtection === true ? { accessProtection: true } : {}
+		},
 		capabilities,
+		...value.emailSharedZoneId !== void 0 ? { emailSharedZoneId: requiredString$1(value.emailSharedZoneId, "emailSharedZoneId") } : {},
+		...value.emailSenderDomain !== void 0 ? { emailSenderDomain: normalizeApplicationDomain(requiredString$1(value.emailSenderDomain, "emailSenderDomain")) } : {},
 		controlPlane: {
 			apiHostname: readHostname("apiHostname"),
 			dashboardHostname: readHostname("dashboardHostname"),
@@ -196,7 +432,7 @@ const PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY = "__void/platform/installation/
 const PLATFORM_SANDBOX_DRAIN_KEY = "__void/platform/sandbox-drain/v1";
 const PLATFORM_R2_OWNERSHIP_MARKER_KEY = "__void/platform/ownership/v1";
 const PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION = 1;
-const PLATFORM_USAGE_PROTOCOL_VERSION = 1;
+const PLATFORM_USAGE_PROTOCOL_VERSION = 2;
 const STATUS_TRANSITIONS = {
 	draft: [
 		"planned",
@@ -459,6 +695,7 @@ function parsePlatformInstallationManifest(value) {
 		status: value.status,
 		runtime,
 		...pendingDomain ? { pendingDomain } : {},
+		...value.authenticationResources !== void 0 ? { authenticationResources: parseAuthenticationResources(value.authenticationResources) } : {},
 		updatedAt
 	}, {
 		apiUrl: endpoints.apiUrl === null ? null : requiredString(endpoints.apiUrl, "endpoints.apiUrl"),
@@ -495,15 +732,33 @@ function parsePlatformInstallationManifest(value) {
 		updatedAt
 	};
 }
+function parseAuthenticationResources(value) {
+	if (!Array.isArray(value) || value.length > 100) throw new Error("Invalid authentication resource inventory.");
+	const resources = value.map((entry) => {
+		assertRecord(entry, "Authentication resource");
+		if (entry.kind !== "application" && entry.kind !== "service-token" || entry.ownership !== "created" && entry.ownership !== "adopted") throw new Error("Invalid authentication resource kind or ownership.");
+		return {
+			key: requiredString(entry.key, "authentication resource key"),
+			kind: entry.kind,
+			accountId: requiredString(entry.accountId, "authentication resource account"),
+			id: requiredString(entry.id, "authentication resource ID"),
+			name: requiredString(entry.name, "authentication resource name"),
+			ownership: entry.ownership
+		};
+	});
+	if (new Set(resources.map((resource) => `${resource.accountId}:${resource.kind}:${resource.id}`)).size !== resources.length) throw new Error("Duplicate authentication resource identity.");
+	return resources;
+}
 function parseUsageProtocolVersion$1(value) {
 	if (value === void 0 || value === 0) return 0;
 	if (value === 1) return 1;
-	throw new Error("usageProtocolVersion must be 0 or 1.");
+	if (value === 2) return 2;
+	throw new Error("usageProtocolVersion must be 0, 1, or 2.");
 }
 function parseSafetyProtocols(value) {
 	if (value === void 0) return { sandboxDrain: 0 };
 	assertRecord(value, "safetyProtocols");
-	if (value.sandboxDrain !== 0 && value.sandboxDrain !== 1 && value.sandboxDrain !== 2) throw new Error("safetyProtocols.sandboxDrain must be 0, 1, or 2.");
+	if (value.sandboxDrain !== 0 && value.sandboxDrain !== 1 && value.sandboxDrain !== 2 && value.sandboxDrain !== 3) throw new Error("safetyProtocols.sandboxDrain must be 0, 1, 2, or 3.");
 	return { sandboxDrain: value.sandboxDrain };
 }
 function parsePlatformRuntimeProvenance(value) {
@@ -600,28 +855,34 @@ function createPlatformDiscoveryDocument(input) {
 		const application = readPlatformApplication({ PLATFORM_APPLICATION: JSON.stringify(input.applicationRouting) });
 		if (!application.workersDev || application.baseDomain !== input.applicationDomain || application.workersDev.installationId !== input.installationId) throw new Error("Application routing must match the discovery domain and installation identity.");
 	}
-	if (input.usageProtocolVersion !== void 0 && input.usageProtocolVersion !== 0 && input.usageProtocolVersion !== 1) throw new Error("usageProtocolVersion must be 0 or 1.");
-	if (input.authenticationProviders.length === 0) throw new Error("At least one authentication provider is required.");
+	if (input.usageProtocolVersion !== void 0 && input.usageProtocolVersion !== 0 && input.usageProtocolVersion !== 1 && input.usageProtocolVersion !== 2) throw new Error("usageProtocolVersion must be 0, 1, or 2.");
+	const authentication = input.authentication ? parseAuthentication(input.authentication) : void 0;
+	if (!authentication && input.authenticationProviders.some((provider) => provider !== "github" && provider !== "google")) throw new Error("Named login methods require authentication discovery descriptors.");
+	if (new Set(input.authenticationProviders).size !== input.authenticationProviders.length) throw new Error("Authentication provider IDs must be unique.");
+	if (input.authenticationProviders.length === 0 && !authentication?.setupPending) throw new Error("At least one authentication provider is required.");
+	if (authentication && (authentication.methods.length !== input.authenticationProviders.length || authentication.methods.some((method, index) => method.id !== input.authenticationProviders[index]))) throw new Error("Authentication method descriptors must match the advertised provider IDs.");
 	if (input.authenticationProviders.includes("github") !== input.capabilities.githubOAuth || input.authenticationProviders.includes("google") !== input.capabilities.googleOAuth) throw new Error("Authentication providers and capabilities must agree.");
 	return {
 		...input,
 		apiUrl: normalizeOrigin(input.apiUrl, "apiUrl"),
 		applicationDomain: normalizeApplicationDomain(input.applicationDomain),
 		authenticationProviders: [...input.authenticationProviders],
+		...authentication ? { authentication } : {},
 		displayName: input.displayName.trim(),
 		installationId: input.installationId?.trim() || null,
 		platformVersion: input.platformVersion.trim(),
 		proxyUrl: normalizeOrigin(input.proxyUrl, "proxyUrl"),
-		schemaVersion: input.applicationRouting?.workersDev ? 2 : 1,
+		schemaVersion: authentication ? 3 : input.applicationRouting?.workersDev ? 2 : 1,
 		usageProtocolVersion: input.usageProtocolVersion ?? 0
 	};
 }
 function parsePlatformDiscoveryDocument(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Platform discovery document must be an object.");
 	const document = value;
-	if (document.schemaVersion !== 1 && document.schemaVersion !== 2) throw new Error(`Unsupported platform discovery schema version: ${String(document.schemaVersion)}.`);
+	if (document.schemaVersion !== 1 && document.schemaVersion !== 2 && document.schemaVersion !== 3) throw new Error(`Unsupported platform discovery schema version: ${String(document.schemaVersion)}.`);
 	const capabilities = document.capabilities;
 	if (document.schemaVersion === 1 && document.applicationRouting !== void 0) throw new Error("Application routing requires discovery schema version 2.");
+	if (document.schemaVersion === 2 && document.applicationRouting === void 0) throw new Error("Discovery schema version 2 requires application routing.");
 	if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities)) throw new Error("capabilities must be an object.");
 	const capabilityNames = [
 		"ai",
@@ -640,7 +901,10 @@ function parsePlatformDiscoveryDocument(value) {
 		parsedCapabilities[name] = enabled;
 	}
 	const providers = document.authenticationProviders;
-	if (!Array.isArray(providers) || providers.some((provider) => provider !== "github" && provider !== "google")) throw new Error("authenticationProviders must contain only github or google.");
+	if (!Array.isArray(providers) || providers.some((provider) => typeof provider !== "string" || document.schemaVersion !== 3 && provider !== "github" && provider !== "google")) throw new Error("authenticationProviders must contain only github or google.");
+	if (document.schemaVersion !== 3 && document.authentication !== void 0) throw new Error("Configurable authentication requires discovery schema version 3.");
+	const authentication = document.schemaVersion === 3 ? parseAuthentication(document.authentication) : void 0;
+	if (authentication) providers.forEach(parsePlatformLoginId);
 	const string = (name) => {
 		const entry = document[name];
 		if (typeof entry !== "string" || !entry.trim()) throw new Error(`${name} must be a non-empty string.`);
@@ -651,8 +915,9 @@ function parsePlatformDiscoveryDocument(value) {
 	return createPlatformDiscoveryDocument({
 		apiUrl,
 		applicationDomain: string("applicationDomain"),
-		...document.schemaVersion === 2 ? { applicationRouting: readPlatformApplication({ PLATFORM_APPLICATION: JSON.stringify(document.applicationRouting ?? null) }) } : {},
+		...document.applicationRouting !== void 0 ? { applicationRouting: readPlatformApplication({ PLATFORM_APPLICATION: JSON.stringify(document.applicationRouting ?? null) }) } : {},
 		authenticationProviders: providers,
+		...authentication ? { authentication } : {},
 		capabilities: parsedCapabilities,
 		displayName: string("displayName"),
 		installationId: document.installationId === null ? null : string("installationId"),
@@ -661,18 +926,37 @@ function parsePlatformDiscoveryDocument(value) {
 		usageProtocolVersion: parseUsageProtocolVersion(document.usageProtocolVersion)
 	});
 }
+function parseAuthentication(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Authentication discovery must be an object.");
+	const authentication = value;
+	if (!Array.isArray(authentication.methods) || authentication.methods.length > 32 || typeof authentication.protectedByAccess !== "boolean" || authentication.setupPending !== void 0 && typeof authentication.setupPending !== "boolean") throw new Error("Authentication discovery requires login methods and a protection flag.");
+	const methods = authentication.methods.map(parsePlatformLoginDescriptor);
+	if (new Set(methods.map((method) => method.id)).size !== methods.length) throw new Error("Authentication connection IDs must be unique.");
+	return {
+		methods,
+		protectedByAccess: authentication.protectedByAccess,
+		...authentication.setupPending === true ? { setupPending: true } : {}
+	};
+}
 function parseUsageProtocolVersion(value) {
 	if (value === void 0 || value === 0) return 0;
 	if (value === 1) return 1;
-	throw new Error("usageProtocolVersion must be 0 or 1.");
+	if (value === 2) return 2;
+	throw new Error("usageProtocolVersion must be 0, 1, or 2.");
 }
 //#endregion
 //#region src/worker-config.ts
 function createPlatformWorkerConfigs(input) {
-	const { accountId, apiUrl, deployment, healthProbeToken, installationId, ownershipNonce, platformVersion, proxyUrl, resources, runtimeEntrypoints } = input;
+	const { accountId, apiUrl, deployment, healthProbeToken, installationId, ownershipNonce, platformVersion, proxyUrl, emailGatewayUrl, resources, runtimeEntrypoints } = input;
 	const publicEndpoints = input.publicEndpoints ?? true;
 	const trafficState = input.trafficState ?? "enabled";
 	const names = deployment.resources;
+	const sharedEmailIngress = deployment.emailSharedZoneId ? {
+		EMAIL_SHARED_ACCOUNT_ID: accountId,
+		EMAIL_SHARED_ZONE_ID: deployment.emailSharedZoneId,
+		EMAIL_SHARED_INGRESS_NAME: names.emailGatewayWorker
+	} : {};
+	const senderDomain = deployment.emailSenderDomain ? { EMAIL_SENDER_DOMAIN: deployment.emailSenderDomain } : {};
 	const ownershipVars = (resourceKey, resourceName) => ({ PLATFORM_OWNERSHIP_MARKER: JSON.stringify(createPlatformResourceOwnershipMarker({
 		accountId,
 		installationId,
@@ -686,7 +970,7 @@ function createPlatformWorkerConfigs(input) {
 		account_id: accountId,
 		compatibility_date: "2026-02-24",
 		observability: { enabled: true },
-		preview_urls: publicEndpoints,
+		preview_urls: publicEndpoints && !deployment.authentication.accessProtection,
 		workers_dev: publicEndpoints
 	};
 	const kv = [
@@ -711,9 +995,15 @@ function createPlatformWorkerConfigs(input) {
 		binding: "STATIC_ASSETS_R2",
 		bucket_name: names.assetsBucket
 	}];
-	const fetchWorkersDev = Boolean(deployment.application.workersDev) || [apiUrl, proxyUrl].some((url) => new URL(url).hostname.endsWith(".workers.dev"));
+	const fetchWorkersDev = Boolean(deployment.application.workersDev) || [
+		apiUrl,
+		proxyUrl,
+		...deployment.capabilities.email ? [emailGatewayUrl] : []
+	].some((url) => new URL(url).hostname.endsWith(".workers.dev"));
 	const api = {
 		...common,
+		version_metadata: { binding: "VERSION_METADATA" },
+		workers_dev: publicEndpoints && (!deployment.authentication.accessProtection || new URL(apiUrl).hostname.endsWith(".workers.dev")),
 		name: names.apiWorker,
 		main: runtimeEntrypoints.api,
 		no_bundle: true,
@@ -724,6 +1014,7 @@ function createPlatformWorkerConfigs(input) {
 			id: resources.hyperdrive
 		}],
 		kv_namespaces: kv,
+		...deployment.capabilities.email ? { send_email: [{ name: "EMAIL" }] } : {},
 		r2_buckets: r2,
 		dispatch_namespaces: dispatchNamespace,
 		durable_objects: { bindings: [
@@ -790,6 +1081,7 @@ function createPlatformWorkerConfigs(input) {
 			DISPATCH_WORKER_NAME: names.dispatchWorker,
 			LOGS_DATASET: names.logsDataset,
 			PLATFORM_CAPABILITIES: JSON.stringify(deployment.capabilities),
+			...input.authenticationDatabaseUncached ? { PLATFORM_AUTH_DATABASE_UNCACHED: "true" } : {},
 			PLATFORM_DISPLAY_NAME: deployment.displayName,
 			PLATFORM_ENV: "production",
 			PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
@@ -798,12 +1090,16 @@ function createPlatformWorkerConfigs(input) {
 			...ownershipVars("api-worker", names.apiWorker),
 			PLATFORM_VERSION: platformVersion,
 			PROXY_URL: proxyUrl,
+			EMAIL_GATEWAY_ORIGIN: emailGatewayUrl,
+			...sharedEmailIngress,
+			...senderDomain,
 			R2_STATIC_ASSETS_BUCKET: names.assetsBucket,
 			REQUESTS_DATASET: names.requestsDataset,
 			SITE_DOMAIN: deployment.application.baseDomain,
 			...deployment.application.workersDev ? { PLATFORM_APPLICATION: JSON.stringify(deployment.application) } : {},
 			TAIL_SERVICE_NAME: names.tailWorker,
-			VOID_PROXY_SERVICE: names.proxyWorker
+			VOID_PROXY_SERVICE: names.proxyWorker,
+			SANDBOX_CONTROL_SERVICE: names.apiWorker
 		}
 	};
 	if (publicEndpoints && deployment.controlPlane.apiHostname) api.routes = [{
@@ -812,6 +1108,7 @@ function createPlatformWorkerConfigs(input) {
 	}];
 	const proxy = {
 		...common,
+		workers_dev: publicEndpoints && (!deployment.authentication.accessProtection || new URL(proxyUrl).hostname.endsWith(".workers.dev")),
 		name: names.proxyWorker,
 		main: runtimeEntrypoints.proxy,
 		no_bundle: true,
@@ -826,12 +1123,14 @@ function createPlatformWorkerConfigs(input) {
 			service: names.apiWorker
 		}],
 		dispatch_namespaces: dispatchNamespace,
+		...deployment.capabilities.email ? { send_email: [{ name: "SEND_EMAIL" }] } : {},
 		vars: {
 			AI_GATEWAY_ID: names.aiGateway,
 			PLATFORM_CAPABILITIES: JSON.stringify(deployment.capabilities),
 			PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
 			PLATFORM_INSTALLATION_ID: installationId,
 			PLATFORM_TRAFFIC_STATE: trafficState,
+			...senderDomain,
 			...ownershipVars("proxy-worker", names.proxyWorker)
 		}
 	};
@@ -842,6 +1141,34 @@ function createPlatformWorkerConfigs(input) {
 	return {
 		api,
 		proxy,
+		emailGateway: {
+			...common,
+			workers_dev: publicEndpoints,
+			preview_urls: false,
+			name: names.emailGatewayWorker,
+			main: runtimeEntrypoints.emailGateway,
+			no_bundle: true,
+			compatibility_flags: ["nodejs_compat"],
+			kv_namespaces: [{
+				binding: "ROUTING",
+				id: resources.routingKv
+			}],
+			services: [{
+				binding: "API",
+				service: names.apiWorker
+			}],
+			dispatch_namespaces: dispatchNamespace,
+			...deployment.capabilities.email ? { send_email: [{ name: "SEND_EMAIL" }] } : {},
+			vars: {
+				PLATFORM_CAPABILITIES: JSON.stringify(deployment.capabilities),
+				PLATFORM_INSTALLATION_ID: installationId,
+				PLATFORM_VERSION: platformVersion,
+				PLATFORM_TRAFFIC_STATE: trafficState,
+				...sharedEmailIngress,
+				...senderDomain,
+				...ownershipVars("email-gateway-worker", names.emailGatewayWorker)
+			}
+		},
 		tail: {
 			...common,
 			name: names.tailWorker,
@@ -892,4 +1219,4 @@ function createPlatformWorkerConfigs(input) {
 	};
 }
 //#endregion
-export { PLATFORM_APPLICATION_KEY, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectWorkersDevHostname, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation };
+export { DEFAULT_PLATFORM_SESSION_SECONDS, GOOGLE_OIDC_ISSUER, PLATFORM_APPLICATION_KEY, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_LOGIN_KINDS, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformSignupAllowed, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformIdentityUrl, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformLoginDescriptor, parsePlatformLoginId, parsePlatformResourceOwnershipMarker, parsePlatformSignupAllowlistEntry, platformAuthenticationRecoveryMessage, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectWorkersDevHostname, platformProtectionProofMessage, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation, validatePlatformAdmissionPolicy };

package/dist/installer.d.mts

@@ -23,17 +23,19 @@ export type PlatformRuntimeDatabaseManifest = Readonly<{
   schemaDigest: string;
 }>;
 export type PlatformRuntimeManifest = Readonly<{
+  authenticationProtocolVersion?: 1;
   applicationRoutingVersion?: 1;
-  artifacts: Readonly<Record<"api" | "dispatch" | "proxy" | "tail", PlatformRuntimeArtifact>>;
+  artifacts: Readonly<Record<"api" | "dispatch" | "proxy" | "tail", PlatformRuntimeArtifact> & Partial<Record<"emailGateway", PlatformRuntimeArtifact>>>;
+  emailProtocolVersion?: 1;
   database: PlatformRuntimeDatabaseManifest;
   platformVersion: string;
   safetyProtocols: Readonly<{
-    sandboxDrain: 0 | 1 | 2;
+    sandboxDrain: 0 | 1 | 2 | 3;
   }>;
   schemaVersion: 2;
   sourceRevision: string | null;
   /** Queue payload contract shared by the API consumer and trusted producers. */
-  usageProtocolVersion: 0 | 1;
+  usageProtocolVersion: 0 | 1 | 2;
 }>;
 export type PlatformRuntime = Readonly<{
   directory: string;