@void/platform 0.23.0 → 0.24.0

package/README.md

@@ -4,9 +4,17 @@ Public, target-neutral contracts and packaged runtime artifacts for installing a
 
 For a first installation, follow [Install a Void Platform](../../docs/guide/self-hosted-platform.md). It explains how to prepare the Cloudflare account, domain, PostgreSQL database, and credentials before deploying. Void creates the platform resources and database tables.
 
-The CLI provides direct credential setup links in plans and opens missing-credential pages during an approved interactive install. The runtime-token link preselects all required account permissions, including Workers Tail, Hyperdrive, and AI Gateway when needed, with a readable fallback summary. Local credential drafts preserve the final Worker names and OAuth callback before provisioning, with partial secrets encrypted by the existing recovery store. A completed credential-setup marker separates these drafts from database-claimed installation recovery.
+The installer also chooses default app access, reuses eligible company Access
+selections, and detects account-wide Default-Deny. App rules are configured and
+verified before traffic opens. An app-management token is stored encrypted;
+reusing an installer token requires explicit consent. Initial setup is resumable,
+and later upgrades preserve administrator changes. Deployment schema 4 and the
+runtime's `appAccessSetup` capability keep older installers or runtimes from skipping
+this handoff.
 
-Interactive installation lists unfinished installs, including interrupted provisioning, and offers to continue one or start a new platform install. Entering an existing unfinished name asks to resume it; declining returns to name entry. New installs leave previous setup, credentials, and resources untouched. Completed platforms are excluded. Explicit `--resume` skips the choice; non-interactive recovery requires it. Read-only plans do not save drafts. Their printed install command preserves the API hostname choice, Hyperdrive selection, login methods, Access protection, and domain settings.
+Plans list required credentials in a dedicated box. The CLI opens missing-credential setup pages during an approved interactive install. The runtime-token link preselects all required account permissions, including Workers Tail, Hyperdrive, and AI Gateway when needed, with a readable fallback summary. Local credential drafts preserve the final Worker names and OAuth callback before provisioning, with partial secrets encrypted by the existing recovery store. This includes prompted management API tokens, which are validated and reused on resume; rejected tokens can be replaced in the same run. A completed credential-setup marker separates these drafts from database-claimed installation recovery.
+
+Interactive installation lists saved plans and unfinished installs, including interrupted provisioning, and offers to continue one or start a new platform install. Entering an existing unfinished name asks to resume it; declining returns to name entry. New installs leave previous setup, credentials, and resources untouched. Completed platforms are excluded. Explicit `--resume` skips the choice; non-interactive recovery requires it. Completed `--plan` previews save choices locally without secrets or Cloudflare changes. Selecting a saved plan checks the current Cloudflare state before confirmation. Once setup starts, its checkpoint takes precedence over the preview. The printed install command also preserves the API hostname choice, Hyperdrive selection, login methods, Access protection, and domain settings.
 
 New platforms use readable resource names such as `void-team-api` and `void-team-routing`, without random suffixes. Choose an installation name that is unused in the selected account. Conflicting resources are never silently adopted, overwritten, or bypassed by choosing random names. Existing installations keep their recorded resource names, including older suffixed names; application/user resource naming is independent.
 
@@ -34,13 +42,13 @@ The package contains:
 
 The `void` CLI consumes this package for `void platform install`, `repair`, `upgrade`, `discover`, and `uninstall`. Platform implementation sources remain under `platform/packages/*`; their deployable core output is bundled here so a user installs one normal public `void` package rather than cloning or deploying the repository.
 
-Interactive lifecycle operations authenticate the human operator through Cloudflare browser sign-in with OS-keychain storage. Wrangler browser OAuth has Zone Read, so plans that create a zone or DNS record require an explicit management API token with the corresponding Zone Edit and DNS Edit permissions. A new account must finish Workers onboarding and choose its workers.dev subdomain before planning. The installed control plane receives a separate scoped runtime token. Its core permissions include Hyperdrive: Write at account scope and Cache Purge: Purge on the application zone; SSL and Certificates: Edit is needed only by a custom runtime that enables custom project domains. The installer preflights account and Hyperdrive access and, for an existing zone, verifies cache-purge access with a unique nonexistent URL. Local recovery checkpoints are AES-256-GCM encrypted with a key held in the OS keychain; normal upgrades preserve existing Cloudflare Worker secrets rather than downloading or rewriting them.
+Lifecycle maintenance uses an explicit environment API token first, then the selected installation’s saved management token, and finally Cloudflare browser sign-in with OS-keychain storage. Installation plans that create a zone or DNS record, or configure Access in the installation account, flag the management API token requirement. After plan confirmation, the installer opens a token-creation link and collects the token in a masked prompt; scripts use `CLOUDFLARE_API_TOKEN`. The initial token link includes the corresponding DNS and Access permissions. Access setup in the same account reuses the management token after checking Access reads before provisioning. Applications in another identity account may need a separate setup credential. A new account must finish Workers onboarding and choose its workers.dev subdomain before planning. The installed control plane receives a separate scoped runtime token. Its core permissions include Hyperdrive: Write at account scope and Cache Purge: Purge on the application zone; SSL and Certificates: Edit is needed only by a custom runtime that enables custom project domains. The installer preflights account and Hyperdrive access and, for an existing zone, verifies cache-purge access with a unique nonexistent URL. Local recovery checkpoints are AES-256-GCM encrypted with a key held in the OS keychain; normal upgrades preserve existing Cloudflare Worker secrets rather than downloading or rewriting them.
 
 Fresh installations require a unique JWT signing secret with at least 32 bytes of random material and a unique, canonical base64-encoded 32-byte project-encryption key from the operator's durable secret manager. The installer never makes an ephemeral workstation or CI registry the only custodian of these installation identity keys. Existing Workers preserve their deployed values during routine lifecycle operations.
 
 Email-enabled installations also need an independent email signing key. The installer generates it in encrypted recovery state, or accepts `VOID_PLATFORM_EMAIL_SIGNING_SECRET` from the operator's secret manager. Keep that original value for recovery on another machine and for headless upgrades without persistent recovery files.
 
-Browser OAuth cannot manage AI Gateway. Installation previews mark an inaccessible gateway as requiring inspection; apply rechecks it with the already-required runtime token (AI Gateway: Edit) before provisioning. All other provider operations keep the operator credential. Later OAuth lifecycle operations can reuse that token from encrypted local recovery storage. On another workstation, use a management API token with AI Gateway access or supply the runtime token explicitly for that check.
+Browser OAuth cannot manage AI Gateway. Installation previews mark an inaccessible gateway as requiring inspection; apply rechecks it with the already-required runtime token (AI Gateway: Edit) before provisioning. All other provider operations keep the operator credential. Maintenance uses the saved management token for all provider operations when available. Without one, OAuth lifecycle operations can reuse the saved runtime token specifically for the AI Gateway check. On another workstation, use a management API token with AI Gateway access or supply the runtime token explicitly for that check.
 
 Runtime and installation manifests record the last usage protocol proven live across the complete Worker set. A protocol transition gates traffic before the first Worker update and opens it only after target health and immutable versions pass; interrupted transitions remain gated and resumable.
 

package/dist/index.d.mts

@@ -1,4 +1,18 @@
 import { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits } from "./plans.mjs";
+//#region src/app-access.d.ts
+export declare const PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
+/** Installer handoff. Token values belong only in encrypted recovery and request bodies. */
+type PlatformAppAccessSetup = Readonly<{
+  version: 1;
+  accountId: string;
+  mode: "public" | "protected";
+  managed: boolean;
+  apiToken?: string;
+  identityProviderIds: ReadonlyArray<string>;
+  policyIds: ReadonlyArray<string>;
+}>;
+export declare function parsePlatformAppAccessSetup(value: unknown): PlatformAppAccessSetup;
+//#endregion
 //#region src/authentication-recovery.d.ts
 /** Owner recovery capabilities authorize a provider test, never a platform session. */
 type PlatformAuthenticationRecovery = Readonly<{
@@ -199,7 +213,10 @@ type PlatformResourceNames = Readonly<{
   tailWorker: string;
   usageQueue: string;
 }>;
+type PlatformAppAccess = "public" | "platform" | "custom";
 type PlatformDeploymentManifest = Readonly<{
+  /** Initial app-access choice. Omitted on installations created before guided setup. */
+  appAccess?: PlatformAppAccess;
   application: PlatformApplication;
   /** Zone that owns the installation's shared sender mail domain. */
   emailSharedZoneId?: string;
@@ -215,9 +232,10 @@ type PlatformDeploymentManifest = Readonly<{
   displayName: string;
   installationSlug: string;
   resources: PlatformResourceNames;
-  schemaVersion: typeof PLATFORM_DEPLOYMENT_SCHEMA_VERSION | 2 | 3;
+  schemaVersion: typeof PLATFORM_DEPLOYMENT_SCHEMA_VERSION | 2 | 3 | 4;
 }>;
 type PlatformDeploymentManifestInput = Readonly<{
+  appAccess?: PlatformAppAccess;
   application: Readonly<{
     baseDomain: string;
     dedicatedZone?: boolean;
@@ -414,6 +432,7 @@ export declare function createPlatformWorkerConfigs(input: {
   installationId: string;
   ownershipNonce: string;
   platformVersion: string;
+  proxyHealthBinding?: boolean;
   publicEndpoints?: boolean;
   proxyUrl: string;
   emailGatewayUrl: string;
@@ -423,4 +442,4 @@ export declare function createPlatformWorkerConfigs(input: {
   trafficState?: "enabled" | "sandbox-drain" | "staging";
 }): PlatformWorkerConfigSet;
 //#endregion
-export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, type InstallationResource, type InstallationResourceKind, type InstallationStatus, type InstallationStep, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, type PlatformAccessProtection, type PlatformAdmissionPolicy, type PlatformApplication, type PlatformApplicationProject, type PlatformApplicationRoute, type PlatformAuthenticationDiscovery, type PlatformAuthenticationRecovery, type PlatformAuthenticationSetup, type PlatformCapabilities, type PlatformControlPlane, type PlatformDeploymentManifest, type PlatformDeploymentManifestInput, type PlatformDiscoveryDocument, type PlatformInstallationEndpoints, type PlatformInstallationManifest, type PlatformLoginConfiguration, type PlatformLoginDescriptor, type PlatformLoginKind, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, type PlatformProvisionedResourceIds, type PlatformResourceNames, type PlatformResourceOwnershipMarker, type PlatformRuntimeProvenance, type PlatformSignupAllowlistEntry, type PlatformSignupIdentity, type PlatformWorkerConfigSet, type ResourceOwnership, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits };
+export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, type InstallationResource, type InstallationResourceKind, type InstallationStatus, type InstallationStep, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, type PlatformAccessProtection, type PlatformAdmissionPolicy, type PlatformAppAccess, type PlatformAppAccessSetup, type PlatformApplication, type PlatformApplicationProject, type PlatformApplicationRoute, type PlatformAuthenticationDiscovery, type PlatformAuthenticationRecovery, type PlatformAuthenticationSetup, type PlatformCapabilities, type PlatformControlPlane, type PlatformDeploymentManifest, type PlatformDeploymentManifestInput, type PlatformDiscoveryDocument, type PlatformInstallationEndpoints, type PlatformInstallationManifest, type PlatformLoginConfiguration, type PlatformLoginDescriptor, type PlatformLoginKind, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, type PlatformProvisionedResourceIds, type PlatformResourceNames, type PlatformResourceOwnershipMarker, type PlatformRuntimeProvenance, type PlatformSignupAllowlistEntry, type PlatformSignupIdentity, type PlatformWorkerConfigSet, type ResourceOwnership, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits };

package/dist/index.mjs

@@ -1,4 +1,31 @@
 import { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits } from "./plans.mjs";
+//#region src/app-access.ts
+const PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
+function parsePlatformAppAccessSetup(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid app access setup.");
+	const input = value;
+	if (input.version !== 1 || !["public", "protected"].includes(String(input.mode)) || typeof input.managed !== "boolean" || typeof input.accountId !== "string" || !input.accountId) throw new Error("Invalid app access setup.");
+	const ids = (name) => {
+		const entries = input[name];
+		if (!Array.isArray(entries) || entries.length > 16 || entries.some((id) => typeof id !== "string" || !id.trim() || id.length > 128) || new Set(entries).size !== entries.length) throw new Error(`Invalid app access ${name}.`);
+		return [...entries];
+	};
+	const identityProviderIds = ids("identityProviderIds");
+	const policyIds = ids("policyIds");
+	if (input.mode === "protected" && (!input.managed || !identityProviderIds.length || !policyIds.length)) throw new Error("Protected apps require identity providers, policies, and an Access-management token.");
+	if (input.mode === "public" && (identityProviderIds.length || policyIds.length)) throw new Error("Public app access cannot include identity policies.");
+	if (input.managed ? typeof input.apiToken !== "string" || !input.apiToken.trim() || /\s/.test(input.apiToken) || input.apiToken.length > 8192 : input.apiToken !== void 0) throw new Error("Managed app access requires a token; unmanaged public access must not retain one.");
+	return {
+		version: 1,
+		accountId: input.accountId,
+		mode: input.mode,
+		managed: input.managed,
+		...input.managed ? { apiToken: input.apiToken } : {},
+		identityProviderIds,
+		policyIds
+	};
+}
+//#endregion
 //#region src/authentication-recovery.ts
 function platformAuthenticationRecoveryMessage(value) {
 	return JSON.stringify([
@@ -338,6 +365,11 @@ function createPlatformDeploymentManifest(input) {
 		...input.capabilities
 	};
 	if (capabilities.managedBuilds && !capabilities.githubActions) throw new Error("Managed builds require the GitHub Actions capability.");
+	if (input.appAccess !== void 0 && ![
+		"public",
+		"platform",
+		"custom"
+	].includes(input.appAccess)) throw new Error("appAccess must be public, platform, or custom.");
 	const providers = input.authentication?.providers ?? ["github"];
 	if (providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider)) || new Set(providers).size !== providers.length) throw new Error("Authentication providers must be unique supported login kinds.");
 	const configurable = input.authentication?.configurable === true || input.authentication?.accessProtection === true || providers.some((provider) => provider === "oidc" || provider === "cloudflare-access");
@@ -346,6 +378,7 @@ function createPlatformDeploymentManifest(input) {
 	if (providers.includes("google") !== capabilities.googleOAuth) throw new Error("The Google provider and googleOAuth capability must agree.");
 	const dashboardUrl = input.controlPlane?.dashboardUrl === void 0 ? void 0 : normalizePlatformDashboardUrl(input.controlPlane.dashboardUrl);
 	const manifest = {
+		...input.appAccess !== void 0 ? { appAccess: input.appAccess } : {},
 		application: {
 			baseDomain,
 			dedicatedZone: input.application.dedicatedZone ?? false,
@@ -372,7 +405,7 @@ function createPlatformDeploymentManifest(input) {
 		displayName: requiredString$1(input.displayName, "displayName").trim(),
 		installationSlug,
 		resources,
-		schemaVersion: configurable ? 3 : workersDev ? 2 : 1
+		schemaVersion: input.appAccess !== void 0 ? 4 : configurable ? 3 : workersDev ? 2 : 1
 	};
 	createApplicationRoutes(manifest.application);
 	for (const [key, value] of Object.entries(manifest.controlPlane)) {
@@ -389,7 +422,7 @@ function createPlatformDeploymentManifest(input) {
 }
 function parsePlatformDeploymentManifest(value) {
 	assertRecord$1(value, "Platform deployment manifest");
-	if (value.schemaVersion !== 1 && value.schemaVersion !== 2 && value.schemaVersion !== 3) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
+	if (value.schemaVersion !== 1 && value.schemaVersion !== 2 && value.schemaVersion !== 3 && value.schemaVersion !== 4) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
 	const application = value.application;
 	const authentication = value.authentication;
 	const rawCapabilities = value.capabilities;
@@ -397,7 +430,7 @@ function parsePlatformDeploymentManifest(value) {
 	const rawResources = value.resources;
 	assertRecord$1(application, "application");
 	let workersDev;
-	if (value.schemaVersion === 2 || value.schemaVersion === 3 && application.workersDev !== void 0) {
+	if (value.schemaVersion === 2 || (value.schemaVersion === 3 || value.schemaVersion === 4) && application.workersDev !== void 0) {
 		assertRecord$1(application.workersDev, "application.workersDev");
 		workersDev = {
 			subdomain: requiredString$1(application.workersDev.subdomain, "workersDev.subdomain"),
@@ -416,8 +449,14 @@ function parsePlatformDeploymentManifest(value) {
 		capabilities[key] = entry;
 	}
 	const providers = authentication.providers;
-	if (!Array.isArray(providers) || providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider) || value.schemaVersion !== 3 && provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
-	if (value.schemaVersion === 3 && authentication.configurable !== true || value.schemaVersion !== 3 && (authentication.configurable !== void 0 || authentication.accessProtection !== void 0) || authentication.accessProtection !== void 0 && authentication.accessProtection !== true) throw new Error("Configurable authentication requires deployment schema version 3.");
+	if (!Array.isArray(providers) || providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider) || value.schemaVersion !== 3 && value.schemaVersion !== 4 && provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
+	if (value.schemaVersion === 3 && authentication.configurable !== true || value.schemaVersion !== 3 && value.schemaVersion !== 4 && (authentication.configurable !== void 0 || authentication.accessProtection !== void 0) || authentication.accessProtection !== void 0 && authentication.accessProtection !== true) throw new Error("Configurable authentication requires deployment schema version 3.");
+	if (value.schemaVersion === 4 ? ![
+		"public",
+		"platform",
+		"custom"
+	].includes(String(value.appAccess)) : value.appAccess !== void 0) throw new Error("Guided app access requires deployment schema version 4 and a valid appAccess choice.");
+	if (authentication.configurable !== void 0 && authentication.configurable !== true) throw new Error("Invalid configurable authentication flag.");
 	const resourceDefaults = createPlatformResourceNames(requiredString$1(value.installationSlug, "installationSlug"));
 	const resources = {};
 	for (const key of Object.keys(resourceDefaults)) resources[key] = requiredString$1(rawResources[key] ?? (key === "emailGatewayWorker" || key === "deploymentQueue" ? resourceDefaults[key] : void 0), `resources.${key}`);
@@ -426,6 +465,7 @@ function parsePlatformDeploymentManifest(value) {
 		return hostname === null ? null : requiredString$1(hostname, `controlPlane.${key}`);
 	};
 	return createPlatformDeploymentManifest({
+		...value.schemaVersion === 4 ? { appAccess: value.appAccess } : {},
 		application: {
 			baseDomain: requiredString$1(application.baseDomain, "application.baseDomain"),
 			dedicatedZone: application.dedicatedZone === true,
@@ -959,7 +999,7 @@ function parsePlatformDiscoveryDocument(value) {
 		return entry;
 	};
 	const apiUrl = string("apiUrl");
-	const proxyUrl = typeof document.proxyUrl === "string" && document.proxyUrl.trim() ? document.proxyUrl : apiUrl === "https://api.void.cloud" ? "https://proxy.void.cloud" : apiUrl === "https://api.staging.void.cloud" ? "https://proxy.staging.void.cloud" : string("proxyUrl");
+	const proxyUrl = string("proxyUrl");
 	return createPlatformDiscoveryDocument({
 		apiUrl,
 		applicationDomain: string("applicationDomain"),
@@ -1052,6 +1092,10 @@ function createPlatformWorkerConfigs(input) {
 	].some((url) => new URL(url).hostname.endsWith(".workers.dev"));
 	const api = {
 		...common,
+		...input.proxyHealthBinding && publicEndpoints && trafficState === "enabled" ? { services: [{
+			binding: "PLATFORM_PROXY",
+			service: names.proxyWorker
+		}] } : {},
 		version_metadata: { binding: "VERSION_METADATA" },
 		workers_dev: publicEndpoints && (!deployment.authentication.accessProtection || new URL(apiUrl).hostname.endsWith(".workers.dev")),
 		name: names.apiWorker,
@@ -1155,6 +1199,7 @@ function createPlatformWorkerConfigs(input) {
 			PLATFORM_DISPLAY_NAME: deployment.displayName,
 			PLATFORM_ENV: "production",
 			PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
+			...deployment.appAccess ? { PLATFORM_APP_ACCESS: deployment.appAccess } : {},
 			PLATFORM_INSTALLATION_ID: installationId,
 			PLATFORM_TRAFFIC_STATE: trafficState,
 			...ownershipVars("api-worker", names.apiWorker),
@@ -1289,4 +1334,4 @@ function createPlatformWorkerConfigs(input) {
 	};
 }
 //#endregion
-export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, DEFAULT_PLATFORM_SESSION_SECONDS, GOOGLE_OIDC_ISSUER, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PLATFORM_APPLICATION_KEY, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_LOGIN_KINDS, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createDefaultPlanCatalog, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformSignupAllowed, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformIdentityUrl, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformLoginDescriptor, parsePlatformLoginId, parsePlatformPlanCatalog, parsePlatformPlanId, parsePlatformResourceOwnershipMarker, parsePlatformSignupAllowlistEntry, platformAuthenticationRecoveryMessage, platformDashboardUrl, platformHealthHostname, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectIngressPrefix, platformProjectWorkersDevHostname, platformProtectionProofMessage, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation, validatePlanLimits, validatePlatformAdmissionPolicy };
+export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, DEFAULT_PLATFORM_SESSION_SECONDS, GOOGLE_OIDC_ISSUER, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PLATFORM_APPLICATION_KEY, PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_LOGIN_KINDS, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createDefaultPlanCatalog, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformSignupAllowed, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformIdentityUrl, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformLoginDescriptor, parsePlatformLoginId, parsePlatformPlanCatalog, parsePlatformPlanId, parsePlatformResourceOwnershipMarker, parsePlatformSignupAllowlistEntry, platformAuthenticationRecoveryMessage, platformDashboardUrl, platformHealthHostname, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectIngressPrefix, platformProjectWorkersDevHostname, platformProtectionProofMessage, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation, validatePlanLimits, validatePlatformAdmissionPolicy };

package/dist/installer.d.mts

@@ -26,6 +26,7 @@ export type PlatformRuntimeDatabaseManifest = Readonly<{
   schemaDigest: string;
 }>;
 export type PlatformRuntimeManifest = Readonly<{
+  appAccessSetup?: 1;
   /** Durable deployment Queue payload and PostgreSQL operation journal contract. */
   deploymentExecution?: 1;
   authenticationProtocolVersion?: 1;

package/dist/installer.mjs

@@ -22,6 +22,7 @@ function platformDatabaseSchemaDigest(lineage, migrations) {
 function parsePlatformRuntimeManifest(value) {
 	const root = record(value, "runtime manifest");
 	if (root.schemaVersion !== 2) throw new Error("runtime manifest schemaVersion must be 2");
+	if (root.appAccessSetup !== void 0 && root.appAccessSetup !== 1) throw new Error("Unsupported app access setup protocol.");
 	if (root.deploymentExecution !== void 0 && root.deploymentExecution !== 1) throw new Error("Unsupported deployment execution protocol.");
 	if (root.authenticationProtocolVersion !== void 0 && root.authenticationProtocolVersion !== 1) throw new Error("Unsupported authentication protocol version.");
 	if (root.emailProtocolVersion !== void 0 && root.emailProtocolVersion !== 1) throw new Error("Unsupported email protocol version.");
@@ -81,6 +82,7 @@ function parsePlatformRuntimeManifest(value) {
 	if (rollbackSafeFrom.some((entry) => !prefixDigests.has(entry.schemaDigest))) throw new Error("runtime manifest database rollback compatibility must reference this migration lineage");
 	return {
 		artifacts,
+		...root.appAccessSetup === 1 ? { appAccessSetup: 1 } : {},
 		...root.deploymentExecution === 1 ? { deploymentExecution: 1 } : {},
 		...assets ? { assets } : {},
 		...root.authenticationProtocolVersion === 1 ? { authenticationProtocolVersion: 1 } : {},

package/dist/runtime/api/README.md

@@ -1 +1 @@
-This folder contains the built output assets for the worker "void-runtime-build-api" generated at 2026-10-02T09:44:01.246Z.
+This folder contains the built output assets for the worker "void-runtime-build-api" generated at 2026-10-03T03:31:21.212Z.