@void/platform 0.23.0 → 0.24.0

package/dist/runtime/api/index.js

@@ -556,6 +556,30 @@ var init_plans = __esm({
 });
 
 // ../../home/runner/work/void/void/packages/platform/dist/index.mjs
+function parsePlatformAppAccessSetup(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid app access setup.");
+  const input2 = value;
+  if (input2.version !== 1 || !["public", "protected"].includes(String(input2.mode)) || typeof input2.managed !== "boolean" || typeof input2.accountId !== "string" || !input2.accountId) throw new Error("Invalid app access setup.");
+  const ids2 = /* @__PURE__ */ __name((name) => {
+    const entries2 = input2[name];
+    if (!Array.isArray(entries2) || entries2.length > 16 || entries2.some((id2) => typeof id2 !== "string" || !id2.trim() || id2.length > 128) || new Set(entries2).size !== entries2.length) throw new Error(`Invalid app access ${name}.`);
+    return [...entries2];
+  }, "ids");
+  const identityProviderIds = ids2("identityProviderIds");
+  const policyIds = ids2("policyIds");
+  if (input2.mode === "protected" && (!input2.managed || !identityProviderIds.length || !policyIds.length)) throw new Error("Protected apps require identity providers, policies, and an Access-management token.");
+  if (input2.mode === "public" && (identityProviderIds.length || policyIds.length)) throw new Error("Public app access cannot include identity policies.");
+  if (input2.managed ? typeof input2.apiToken !== "string" || !input2.apiToken.trim() || /\s/.test(input2.apiToken) || input2.apiToken.length > 8192 : input2.apiToken !== void 0) throw new Error("Managed app access requires a token; unmanaged public access must not retain one.");
+  return {
+    version: 1,
+    accountId: input2.accountId,
+    mode: input2.mode,
+    managed: input2.managed,
+    ...input2.managed ? { apiToken: input2.apiToken } : {},
+    identityProviderIds,
+    policyIds
+  };
+}
 function platformAuthenticationRecoveryMessage(value) {
   return JSON.stringify([
     "void-platform-auth-recovery-v1",
@@ -854,6 +878,11 @@ function createPlatformDeploymentManifest(input2) {
     ...input2.capabilities
   };
   if (capabilities.managedBuilds && !capabilities.githubActions) throw new Error("Managed builds require the GitHub Actions capability.");
+  if (input2.appAccess !== void 0 && ![
+    "public",
+    "platform",
+    "custom"
+  ].includes(input2.appAccess)) throw new Error("appAccess must be public, platform, or custom.");
   const providers2 = input2.authentication?.providers ?? ["github"];
   if (providers2.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider)) || new Set(providers2).size !== providers2.length) throw new Error("Authentication providers must be unique supported login kinds.");
   const configurable = input2.authentication?.configurable === true || input2.authentication?.accessProtection === true || providers2.some((provider) => provider === "oidc" || provider === "cloudflare-access");
@@ -862,6 +891,7 @@ function createPlatformDeploymentManifest(input2) {
   if (providers2.includes("google") !== capabilities.googleOAuth) throw new Error("The Google provider and googleOAuth capability must agree.");
   const dashboardUrl = input2.controlPlane?.dashboardUrl === void 0 ? void 0 : normalizePlatformDashboardUrl(input2.controlPlane.dashboardUrl);
   const manifest = {
+    ...input2.appAccess !== void 0 ? { appAccess: input2.appAccess } : {},
     application: {
       baseDomain,
       dedicatedZone: input2.application.dedicatedZone ?? false,
@@ -888,7 +918,7 @@ function createPlatformDeploymentManifest(input2) {
     displayName: requiredString$1(input2.displayName, "displayName").trim(),
     installationSlug,
     resources: resources2,
-    schemaVersion: configurable ? 3 : workersDev ? 2 : 1
+    schemaVersion: input2.appAccess !== void 0 ? 4 : configurable ? 3 : workersDev ? 2 : 1
   };
   createApplicationRoutes(manifest.application);
   for (const [key, value] of Object.entries(manifest.controlPlane)) {
@@ -1008,12 +1038,14 @@ function parseAuthentication(value) {
     ...authentication.setupPending === true ? { setupPending: true } : {}
   };
 }
-var PLATFORM_LOGIN_KINDS, GOOGLE_OIDC_ISSUER, PLATFORM_AUTH_SETUP_PROOF_PREFIX, CORE_CAPABILITIES, CONTROL_PLANE_DEFAULTS, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_USAGE_PROTOCOL_VERSION, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_APPLICATION_KEY, PLATFORM_HEALTH_HOSTNAME_LABEL;
+var PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_LOGIN_KINDS, GOOGLE_OIDC_ISSUER, PLATFORM_AUTH_SETUP_PROOF_PREFIX, CORE_CAPABILITIES, CONTROL_PLANE_DEFAULTS, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_USAGE_PROTOCOL_VERSION, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_APPLICATION_KEY, PLATFORM_HEALTH_HOSTNAME_LABEL;
 var init_dist = __esm({
   "../../home/runner/work/void/void/packages/platform/dist/index.mjs"() {
     "use strict";
     init_performance2();
     init_plans();
+    PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
+    __name(parsePlatformAppAccessSetup, "parsePlatformAppAccessSetup");
     __name(platformAuthenticationRecoveryMessage, "platformAuthenticationRecoveryMessage");
     PLATFORM_LOGIN_KINDS = [
       "github",
@@ -30326,24 +30358,46 @@ __export(cloudflare_api_exports, {
   updateHyperdrive: () => updateHyperdrive
 });
 async function cfFetch(url2, apiToken, init) {
-  const response = await fetch(url2, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${apiToken}`,
-      "Content-Type": "application/json",
-      ...init?.headers
-    }
-  });
-  const json3 = await response.json();
-  if (!json3.success) {
-    const message2 = json3.errors.map((error63) => error63.message).join(", ");
-    throw new CloudflareApiError(
-      `Cloudflare API error: ${message2}`,
-      response.status,
-      json3.errors.map((error63) => error63.code)
+  const deadline = new AbortController();
+  const method = init?.method ?? "GET";
+  const pathname = new URL(url2).pathname;
+  const timer = setTimeout(() => {
+    deadline.abort(
+      new Error(
+        `Cloudflare API request timed out after 60 seconds: ${method} ${pathname}.` + (method === "GET" || method === "HEAD" ? "" : " The write may have succeeded; inspect its state before retrying.")
+      )
     );
+  }, 6e4);
+  const signal2 = init?.signal ? AbortSignal.any([init.signal, deadline.signal]) : deadline.signal;
+  try {
+    signal2.throwIfAborted();
+    const response = await fetch(url2, {
+      ...init,
+      signal: signal2,
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        "Content-Type": "application/json",
+        ...init?.headers
+      }
+    });
+    const json3 = await response.json();
+    if (!json3.success) {
+      const message2 = json3.errors.map((error63) => error63.message).join(", ");
+      throw new CloudflareApiError(
+        `Cloudflare API error: ${message2}`,
+        response.status,
+        json3.errors.map((error63) => error63.code)
+      );
+    }
+    return json3.result;
+  } catch (error63) {
+    if (deadline.signal.aborted && !init?.signal?.aborted) {
+      throw deadline.signal.reason;
+    }
+    throw error63;
+  } finally {
+    clearTimeout(timer);
   }
-  return json3.result;
 }
 async function createD1Database(accountId, apiToken, name) {
   return cfFetch(`${CF_API_BASE}/${accountId}/d1/database`, apiToken, {
@@ -51729,10 +51783,10 @@ function cloudDomainFromHost(host) {
 function systemHealthCheckNames(installed) {
   return ["api", "proxy", ...installed ? [] : ["dashboard"], "dispatch", "db"];
 }
-async function checkUrl(name, url2, headers) {
+async function checkUrl(name, url2, headers, request = fetch) {
   const start = Date.now();
   try {
-    const res = await fetch(url2, {
+    const res = await request(url2, {
       headers,
       // Do not forward probe credentials to a login redirect or treat its HTML
       // login page as a successful health check.
@@ -51837,7 +51891,8 @@ async function systemHealth(db, env2, requestUrl) {
       checkUrl(
         "proxy",
         `${proxyUrl.replace(/\/$/, "")}/health`,
-        installed ? dispatchHeaders : void 0
+        installed ? dispatchHeaders : void 0,
+        installed && env2.PLATFORM_PROXY ? (url2, init) => env2.PLATFORM_PROXY.fetch(url2, init) : void 0
       ),
       ...!installed ? [
         checkUrl(
@@ -57083,6 +57138,27 @@ function healthCheckApplication(name, hostname3) {
     policies: bypassPolicy("Void platform health check")
   };
 }
+function publicAppManagementDestination(apiUrl) {
+  const url2 = new URL(apiUrl);
+  if (url2.protocol !== "https:" || url2.username || url2.password) {
+    throw new Error("Public app management requires an HTTPS dispatch origin.");
+  }
+  return url2.host + "/__void/app-access-management";
+}
+function publicAppManagementApplication(name, destination) {
+  return {
+    name,
+    destinations: [destination],
+    policies: [
+      {
+        name: "App access management check",
+        decision: "deny",
+        precedence: 1,
+        include: [{ everyone: {} }]
+      }
+    ]
+  };
+}
 var ZeroTrustCloudflareError, ZeroTrustCloudflareClient;
 var init_cloudflare = __esm({
   "../../home/runner/work/void/void/platform/packages/api/src/zero-trust/cloudflare.ts"() {
@@ -57398,6 +57474,78 @@ var init_cloudflare = __esm({
           throw error63;
         }
       }
+      /** An installer/operator-owned health exception is verified, never modified or adopted. */
+      async verifyExistingHealthApplication(application, hostname3, current) {
+        const id2 = text2(application.id, "application id");
+        const name = text2(application.name, "application name");
+        const audience = text2(application.aud, "application audience");
+        const destination = `${hostname3}/health`;
+        if (current && (id2 !== current.id || name !== current.name || audience !== current.audience) || application.type !== "self_hosted" || application.domain !== destination || !sameDestinations(application, [destination]) || application.destinations !== void 0 && (!Array.isArray(application.destinations) || application.destinations.some((entry) => {
+          const value = object3(entry, "Access application destination");
+          return value.type !== "public" || value.uri !== destination;
+        })) || application.target_criteria != null && (!Array.isArray(application.target_criteria) || application.target_criteria.length > 0)) {
+          throw new Error(
+            `The existing Access health application must cover only ${destination} and retain its recorded identity.`
+          );
+        }
+        const policies = await this.request(
+          `apps/${encodeURIComponent(id2)}/policies?page=1&per_page=2`
+        );
+        const policy = policies?.[0];
+        if (!Array.isArray(policies) || policies.length !== 1 || policy?.decision !== "bypass" || JSON.stringify(policy.include) !== '[{"everyone":{}}]' || policy.require !== void 0 && (!Array.isArray(policy.require) || policy.require.length > 0) || policy.exclude !== void 0 && (!Array.isArray(policy.exclude) || policy.exclude.length > 0)) {
+          throw new Error(
+            `The existing Access policy for ${destination} must remain the reserved health-check exception.`
+          );
+        }
+        return { id: id2, name, audience, destinations: [destination] };
+      }
+      async ensureHealthApplication(name, hostname3, current) {
+        if (current && current.name !== name) {
+          const application2 = await this.application(current.id);
+          if (!application2) {
+            throw new Error(
+              "The existing Access health application is missing. Restore it before reconciling project Zero Trust."
+            );
+          }
+          return this.verifyExistingHealthApplication(application2, hostname3, current);
+        }
+        const { application, inventory } = await this.locateOwnedApplication(current?.id, name);
+        if (application) {
+          return this.ensureApplication(healthCheckApplication(name, hostname3), {
+            id: text2(application.id, "application id"),
+            name
+          });
+        }
+        const matches = [...inventory.values()].filter(
+          (entry) => destinationList(entry).includes(`${hostname3}/health`)
+        );
+        if (matches.length > 1) {
+          throw new Error(
+            `Multiple Access applications cover ${hostname3}/health. Reconcile them before retrying.`
+          );
+        }
+        if (matches[0]) {
+          const existing = await this.application(text2(matches[0].id, "application id"));
+          if (!existing) {
+            throw new Error(
+              "The existing Access health application disappeared. Inspect Access before retrying."
+            );
+          }
+          return this.verifyExistingHealthApplication(existing, hostname3);
+        }
+        return this.ensureApplication(healthCheckApplication(name, hostname3), { name });
+      }
+      async inspectHealthApplication(current, managedName, hostname3) {
+        if (current.name === managedName) {
+          return this.inspectApplication(current, healthCheckApplication(current.name, hostname3));
+        }
+        const application = await this.application(current.id);
+        if (!application) {
+          return { present: false, drifted: true };
+        }
+        await this.verifyExistingHealthApplication(application, hostname3, current);
+        return { present: true, drifted: false };
+      }
       async deleteApplication(id2, expectedName) {
         if (!id2 && !expectedName) {
           return;
@@ -57419,6 +57567,8 @@ var init_cloudflare = __esm({
     __name(reusablePolicyReferences, "reusablePolicyReferences");
     __name(bypassPolicy, "bypassPolicy");
     __name(healthCheckApplication, "healthCheckApplication");
+    __name(publicAppManagementDestination, "publicAppManagementDestination");
+    __name(publicAppManagementApplication, "publicAppManagementApplication");
   }
 });
 
@@ -57465,8 +57615,8 @@ function timestamp2(value, label) {
   }
   return result;
 }
-function ids(value, label) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > 16) {
+function ids(value, label, minimum = 1) {
+  if (!Array.isArray(value) || value.length < minimum || value.length > 16) {
     throw new ZeroTrustConfigurationError(`${label} must contain between 1 and 16 ids`);
   }
   const result = value.map((entry) => requiredText(entry, `${label} id`, 128));
@@ -57588,6 +57738,9 @@ function parseZeroTrustConfiguration(value) {
   if (typeof input2.enabled !== "boolean" || typeof input2.protectNewProjects !== "boolean") {
     throw new ZeroTrustConfigurationError("Zero Trust configuration flags are invalid");
   }
+  if (input2.publicAccess !== void 0 && input2.publicAccess !== true || input2.managePublicCustomDomains !== void 0 && input2.managePublicCustomDomains !== true || input2.publicAccess && input2.protectNewProjects) {
+    throw new ZeroTrustConfigurationError("invalid public app access configuration");
+  }
   const teamDomain = requiredText(input2.teamDomain, "Access team domain", 512).replace(/\/+$/, "");
   let parsedTeamDomain;
   try {
@@ -57602,9 +57755,29 @@ function parseZeroTrustConfiguration(value) {
       "Access team domain must be an HTTPS cloudflareaccess.com origin"
     );
   }
+  let publicAccessGuardDestination;
+  if (input2.publicAccess) {
+    publicAccessGuardDestination = requiredText(
+      input2.publicAccessGuardDestination,
+      "public app management destination",
+      512
+    );
+    try {
+      if (publicAppManagementDestination("https://" + publicAccessGuardDestination) !== publicAccessGuardDestination) {
+        throw new Error("invalid destination");
+      }
+    } catch {
+      throw new ZeroTrustConfigurationError("Invalid public app management destination");
+    }
+  }
   const wildcardApplication = parseApplication(input2.wildcardApplication);
   const healthApplication = parseApplication(input2.healthApplication ?? null);
   const operation = parseOperation(input2.operation);
+  if (input2.publicAccess && (operation?.existingProjects === "protected" || Array.isArray(input2.identityProviderIds) && input2.identityProviderIds.length > 0 || Array.isArray(input2.policyIds) && input2.policyIds.length > 0)) {
+    throw new ZeroTrustConfigurationError(
+      "Public app access cannot contain identity policies or protected project choices"
+    );
+  }
   if (operation?.phase === "bypass-delete" && (input2.enabled || wildcardApplication)) {
     throw new ZeroTrustConfigurationError("Zero Trust bypass cleanup requires wildcard removal");
   }
@@ -57620,8 +57793,14 @@ function parseZeroTrustConfiguration(value) {
     protectNewProjects: input2.protectNewProjects,
     accountId: requiredText(input2.accountId, "Cloudflare account id", 128),
     teamDomain,
-    identityProviderIds: ids(input2.identityProviderIds, "identity providers"),
-    policyIds: ids(input2.policyIds, "policies"),
+    ...input2.publicAccess === true ? { publicAccess: true, publicAccessGuardDestination } : {},
+    ...input2.managePublicCustomDomains === true ? { managePublicCustomDomains: true } : {},
+    identityProviderIds: ids(
+      input2.identityProviderIds,
+      "identity providers",
+      input2.publicAccess ? 0 : 1
+    ),
+    policyIds: ids(input2.policyIds, "policies", input2.publicAccess ? 0 : 1),
     credential: parseCredential(input2.credential),
     wildcardApplicationName: requiredText(
       input2.wildcardApplicationName,
@@ -57648,8 +57827,13 @@ function normalizeZeroTrustConfigureInput(input2) {
   const apiToken = requiredText(value.apiToken, "Cloudflare API token", 8192);
   return {
     apiToken,
-    identityProviderIds: ids(value.identityProviderIds, "identity providers"),
-    policyIds: ids(value.policyIds, "policies"),
+    ...value.publicAccess === true ? { publicAccess: true, managePublicCustomDomains: true } : {},
+    identityProviderIds: ids(
+      value.identityProviderIds,
+      "identity providers",
+      value.publicAccess === true ? 0 : 1
+    ),
+    policyIds: ids(value.policyIds, "policies", value.publicAccess === true ? 0 : 1),
     protectNewProjects: value.protectNewProjects,
     ...existingProjects ? { existingProjects } : {}
   };
@@ -57713,6 +57897,7 @@ var init_configuration2 = __esm({
     init_drizzle_orm();
     init_platform_settings();
     init_schema2();
+    init_cloudflare();
     ZERO_TRUST_SETTING = "zeroTrust.configuration";
     ZERO_TRUST_CREDENTIAL_ID = "zero-trust-cloudflare-api-token";
     __name(zeroTrustConfigurationStatus, "zeroTrustConfigurationStatus");
@@ -57935,22 +58120,36 @@ async function updateProjectState(db, projectId, values2) {
   }
   return row;
 }
-async function projectDestinations(env2, db, project2, protectedProject) {
+async function projectDestinations(env2, db, project2, protectedProject, verifiedDomainId) {
   const application = readPlatformApplication(
     await resolveZeroTrustApplicationEnvironment(env2, db)
   );
   const platform = [...new Set(platformProjectHostnames(project2, application))];
-  if (!protectedProject) {
+  const reserved = [env2.AUTH_REDIRECT_URI, env2.PROXY_URL, env2.EMAIL_GATEWAY_ORIGIN].filter((value) => !!value && URL.canParse(value)).map((value) => new URL(value).hostname.toLowerCase());
+  const checkHostnames = /* @__PURE__ */ __name((values2) => {
+    if (values2.some((hostname3) => reserved.includes(hostname3.toLowerCase()))) {
+      throw new ZeroTrustUnavailableError(
+        "The project hostname overlaps a platform API, proxy, or email endpoint. Choose another hostname."
+      );
+    }
+  }, "checkHostnames");
+  checkHostnames(platform);
+  if (!protectedProject && !(await readZeroTrustConfigurationStrict(db))?.managePublicCustomDomains) {
     return { platform, custom: [] };
   }
   const custom2 = [
-    ...new Set((await getDomainsByProjectId(db, project2.id)).map((domain2) => domain2.hostname))
+    ...new Set(
+      (await getDomainsByProjectId(db, project2.id)).filter(
+        (domain2) => protectedProject || domain2.status === "active" || domain2.id === verifiedDomainId
+      ).map((domain2) => domain2.hostname)
+    )
   ];
   if (custom2.length > MAX_ZERO_TRUST_CUSTOM_DOMAINS_PER_PROJECT) {
     throw new ZeroTrustUnavailableError(
       `Project Zero Trust supports at most ${MAX_ZERO_TRUST_CUSTOM_DOMAINS_PER_PROJECT} custom domains per project.`
     );
   }
+  checkHostnames(custom2);
   return { platform, custom: custom2 };
 }
 async function markProjectCustomDomainsChanged(db, projectId) {
@@ -58382,7 +58581,18 @@ async function checkpointProjectReconciliation(env2, db, projectId, options) {
     }
     const existing = await getProjectZeroTrustState(lockedDb, projectId);
     const desired = options?.desiredProtection ?? existing?.desired_protected ?? initialProjectProtection(configuration, project2);
-    const destinations = await projectDestinations(env2, lockedDb, project2, desired);
+    if (desired && configuration.publicAccess) {
+      throw new ZeroTrustUnavailableError(
+        "Choose company identity providers and policies in Admin \u2192 Zero Trust before protecting a project."
+      );
+    }
+    const destinations = await projectDestinations(
+      env2,
+      lockedDb,
+      project2,
+      desired,
+      options?.verifiedDomainId
+    );
     const values2 = {
       desired_protected: desired,
       status: "reconciling",
@@ -58392,13 +58602,13 @@ async function checkpointProjectReconciliation(env2, db, projectId, options) {
     if (!desired && !existing?.bypass_application_name) {
       values2.bypass_application_name = await applicationName(env2, `public-${project2.id}`);
     }
-    if (desired && destinations.custom.length > 0 && !existing?.protected_application_name) {
+    if ((desired || configuration.managePublicCustomDomains) && destinations.custom.length > 0 && !existing?.protected_application_name) {
       values2.protected_application_name = await applicationName(env2, `protected-${project2.id}`);
     }
     return putProjectState(lockedDb, projectId, values2);
   });
 }
-async function reconcilePublicProjectLocked(env2, lockedDb, project2, current, platformDestinations, client2, configuration, routingBudget) {
+async function reconcilePublicProjectLocked(env2, lockedDb, project2, current, platformDestinations, customDestinations, client2, configuration, routingBudget) {
   if (!current.bypass_application_name) {
     throw new Error("The project public application checkpoint is missing.");
   }
@@ -58414,18 +58624,39 @@ async function reconcilePublicProjectLocked(env2, lockedDb, project2, current, p
     bypass_application_id: bypass.id,
     bypass_application_name: bypass.name
   });
+  let publicCustom = null;
+  if (configuration.managePublicCustomDomains && customDestinations.length) {
+    if (!current.protected_application_name) {
+      throw new Error("The custom-domain Access checkpoint is missing.");
+    }
+    publicCustom = await client2.ensureApplication(
+      {
+        name: current.protected_application_name,
+        destinations: customDestinations,
+        policies: bypassPolicy("Void project is public")
+      },
+      projectApplicationReference(current, "protected")
+    );
+    await updateProjectState(lockedDb, project2.id, {
+      protected_application_id: publicCustom.id,
+      protected_application_name: publicCustom.name,
+      protected_application_audience: publicCustom.audience
+    });
+  }
   if (!await publishProjectZeroTrustRoutingLocked(env2, lockedDb, project2, null, routingBudget)) {
     return await getProjectZeroTrustState(lockedDb, project2.id);
   }
   const row = await updateProjectState(lockedDb, project2.id, { effective_protected: false });
-  await client2.deleteApplication(row.protected_application_id, row.protected_application_name);
+  if (!publicCustom) {
+    await client2.deleteApplication(row.protected_application_id, row.protected_application_name);
+  }
   return updateProjectState(lockedDb, project2.id, {
     effective_protected: false,
     status: "ready",
     reconciled_operation: completedProjectOperation(configuration, true),
-    protected_application_id: null,
-    protected_application_name: null,
-    protected_application_audience: null,
+    protected_application_id: publicCustom?.id ?? null,
+    protected_application_name: publicCustom?.name ?? null,
+    protected_application_audience: publicCustom?.audience ?? null,
     last_error: null
   });
 }
@@ -58448,7 +58679,8 @@ async function reconcileProjectZeroTrustLocked(env2, lockedDb, projectId, record
     env2,
     lockedDb,
     project2,
-    existing.desired_protected
+    existing.desired_protected,
+    options?.verifiedDomainId
   );
   return recordErrors(async () => {
     let row = existing;
@@ -58459,6 +58691,7 @@ async function reconcileProjectZeroTrustLocked(env2, lockedDb, projectId, record
         project2,
         row,
         destinations.platform,
+        destinations.custom,
         client2,
         configuration,
         options?.routingBudget
@@ -58580,6 +58813,7 @@ async function reconcilePublicProjectForOperation(env2, db, projectId, configura
         project2,
         row,
         destinations.platform,
+        destinations.custom,
         client2,
         configuration,
         routingBudget
@@ -58659,7 +58893,7 @@ async function cleanupProjectZeroTrust(env2, db, projectId) {
   await client2.deleteApplication(row.bypass_application_id, row.bypass_application_name);
   await client2.deleteApplication(row.protected_application_id, row.protected_application_name);
 }
-async function reconcileProjectZeroTrustDomains(env2, db, projectId) {
+async function reconcileProjectZeroTrustDomains(env2, db, projectId, options) {
   const [configuration, row] = await Promise.all([
     readZeroTrustConfigurationStrict(db),
     getProjectZeroTrustState(db, projectId)
@@ -58667,7 +58901,10 @@ async function reconcileProjectZeroTrustDomains(env2, db, projectId) {
   if (!configuration?.enabled || configuration.operation?.kind === "disable" || !row) {
     return row;
   }
-  return reconcileProjectZeroTrust(env2, db, projectId, { duringOperation: true });
+  return reconcileProjectZeroTrust(env2, db, projectId, {
+    duringOperation: true,
+    verifiedDomainId: options?.verifiedDomainId
+  });
 }
 var init_project = __esm({
   "../../home/runner/work/void/void/platform/packages/api/src/zero-trust/project.ts"() {
@@ -128664,6 +128901,7 @@ function ZeroTrustPage({ path, platformName, username }) {
     operation?.existingProjects === "public" ? "public" : "protected"
   );
   const badge = statusBadge(configured, enabled, status2 ?? null);
+  const publicOnly = configured && status2 !== "invalid_configuration" && identityProviderIds.length === 0 && policyIds.length === 0;
   return /* @__PURE__ */ jsx5(Layout2, { platformName, title: "Zero Trust", username, children: /* @__PURE__ */ jsxs2("div", { className: "void-admin-zero-trust", children: [
     /* @__PURE__ */ jsxs2("header", { className: "void-admin-zero-trust-intro", children: [
       /* @__PURE__ */ jsx5(Heading, { level: 1, children: "Project Zero Trust" }),
@@ -128734,6 +128972,7 @@ function ZeroTrustPage({ path, platformName, username }) {
         operation && /* @__PURE__ */ jsx5("p", { children: "To replace an expired or revoked token, keep the saved settings and submit a new token. The pending operation will resume." })
       ] }),
       /* @__PURE__ */ jsxs2("form", { method: "post", action: `${HOME4}/configure`, className: "void-admin-zero-trust-form", children: [
+        publicOnly && /* @__PURE__ */ jsx5("p", { children: "Void manages public app rules for this account. Leave policy fields blank to replace its token, or enter company identities and policies to configure protection." }),
         /* @__PURE__ */ jsx5(
           FormTextInput,
           {
@@ -128751,8 +128990,8 @@ function ZeroTrustPage({ path, platformName, username }) {
             label: "Identity provider IDs",
             name: "identityProviderIds",
             initialValue: identityProviderIds.join(", "),
-            description: "Separate IDs with commas or spaces.",
-            required: true,
+            description: publicOnly ? "Leave blank to keep public app rules, or enter company IDs to configure protection." : "Separate IDs with commas or spaces.",
+            required: !publicOnly,
             width: 480
           }
         ),
@@ -128763,7 +129002,7 @@ function ZeroTrustPage({ path, platformName, username }) {
             name: "policyIds",
             initialValue: policyIds.join(", "),
             description: "Separate IDs with commas or spaces.",
-            required: true,
+            required: !publicOnly,
             width: 480
           }
         ),
@@ -128803,7 +129042,7 @@ function ZeroTrustPage({ path, platformName, username }) {
           {
             method: "post",
             action: `${HOME4}/disable`,
-            "data-confirm": "Disable Zero Trust and make every project public?",
+            "data-confirm": "Remove Void-managed Access protection? Apps may become public or be blocked by account-wide Default-Deny.",
             children: /* @__PURE__ */ jsx5(
               Button,
               {
@@ -129616,21 +129855,28 @@ async function zeroTrustStatus(env2, db, options = {}) {
     try {
       env2 = await resolveZeroTrustApplicationEnvironment(env2, db, configuration);
       const client2 = await clientForConfiguration(env2, configuration);
-      const selection = await client2.validateSelection({
+      const selection = configuration.publicAccess ? await client2.getOrganization() : await client2.validateSelection({
         identityProviderIds: configuration.identityProviderIds,
         policyIds: configuration.policyIds
       });
-      live = await client2.inspectApplication(configuration.wildcardApplication, {
-        name: configuration.wildcardApplicationName,
-        destinations: zeroTrustWildcardDestinations(readPlatformApplication(env2)),
-        allowedIdentityProviderIds: configuration.identityProviderIds,
-        policies: reusablePolicyReferences(configuration.policyIds)
-      });
+      live = await client2.inspectApplication(
+        configuration.wildcardApplication,
+        configuration.publicAccess ? publicAppManagementApplication(
+          configuration.wildcardApplicationName,
+          configuration.publicAccessGuardDestination
+        ) : {
+          name: configuration.wildcardApplicationName,
+          destinations: zeroTrustWildcardDestinations(readPlatformApplication(env2)),
+          allowedIdentityProviderIds: configuration.identityProviderIds,
+          policies: reusablePolicyReferences(configuration.policyIds)
+        }
+      );
       const healthHostname = platformHealthHostname(readPlatformApplication(env2));
       if (healthHostname) {
-        const health = configuration.healthApplication ? await client2.inspectApplication(
+        const health = configuration.healthApplication ? await client2.inspectHealthApplication(
           configuration.healthApplication,
-          healthCheckApplication(configuration.healthApplication.name, healthHostname)
+          configuration.healthApplicationName,
+          healthHostname
         ) : { present: false, drifted: true };
         live = {
           present: live.present && health.present,
@@ -149935,10 +150181,17 @@ async function handleManifestOnlyDeploy(context) {
         terminalEvent = event;
         return;
       }
-      persistedEvents = persistedEvents.then(
-        () => appendDeploymentEvent(context.get("db"), preDeployment.id, cutoverOwnerId, event)
-      );
-      void persistedEvents.catch(() => {
+      persistedEvents = persistedEvents.then(async () => {
+        for (let attempt = 0; attempt < 2; attempt++) {
+          try {
+            await appendDeploymentEvent(context.get("db"), preDeployment.id, cutoverOwnerId, event);
+            return;
+          } catch (error63) {
+            if (attempt === 1) {
+              logger.warn("progress", "persist_failed", { event: event.event, err: String(error63) });
+            }
+          }
+        }
       });
       return;
     }
@@ -152796,7 +153049,14 @@ async function deploymentExecutionStatus(db, installationId2) {
   });
 }
 async function getDeploymentOperation(db, id2) {
-  const [operation] = await db.select().from(deploymentOperations).where(eq(deploymentOperations.id, id2));
+  const [operation] = await db.select({
+    ...getTableColumns(deploymentOperations),
+    // The stored lease is a timestamp without time zone. Resolve it in the
+    // SQL session's zone so observers receive an unambiguous UTC instant.
+    lease_expires_at: sql`to_char(
+        ${deploymentOperations.lease_expires_at} AT TIME ZONE current_setting('TimeZone') AT TIME ZONE 'UTC',
+        'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`
+  }).from(deploymentOperations).where(eq(deploymentOperations.id, id2));
   return operation ?? null;
 }
 async function findDeploymentOperation(db, projectId, actorId, key) {
@@ -152886,7 +153146,18 @@ function deploymentEventPage(operation, since) {
     deploymentId: operation.id,
     events,
     lastSeq,
-    terminal: operation.status === "terminal" && lastSeq >= operation.last_seq
+    terminal: operation.status === "terminal" && lastSeq >= operation.last_seq,
+    ...operation.status !== "terminal" && {
+      heartbeat: {
+        event: "heartbeat",
+        deploymentId: operation.id,
+        step: operation.status === "recovering" ? "recovery" : operation.events.at(-1)?.event.event ?? "queued",
+        status: operation.status,
+        ...operation.lease_expires_at && {
+          recoveryAt: new Date(operation.lease_expires_at).toISOString()
+        }
+      }
+    }
   };
 }
 function deploymentReceiptResponse(db, id2) {
@@ -152922,7 +153193,8 @@ function deploymentReceiptResponse(db, id2) {
             return;
           }
           if (!page.events.length) {
-            controller.enqueue(encoder12.encode('{"event":"heartbeat","step":"queued"}\n'));
+            controller.enqueue(encoder12.encode(`${JSON.stringify(page.heartbeat)}
+`));
           }
           timer = setTimeout(() => {
             void poll();
@@ -154842,10 +155114,10 @@ async function runConfigureOperation(env2, db, initial, suppliedClient, supplied
   try {
     env2 = await resolveZeroTrustApplicationEnvironment(env2, db, configuration);
     const client2 = suppliedClient ?? await clientForConfiguration(env2, configuration);
-    const selection = suppliedSelection ?? await client2.validateSelection({
+    const selection = suppliedSelection ?? await (configuration.publicAccess ? client2.getOrganization() : client2.validateSelection({
       identityProviderIds: configuration.identityProviderIds,
       policyIds: configuration.policyIds
-    });
+    }));
     if (selection.teamDomain !== configuration.teamDomain) {
       configuration = await patchConfiguration(db, configuration, {
         teamDomain: selection.teamDomain
@@ -154944,15 +155216,13 @@ async function runConfigureOperation(env2, db, initial, suppliedClient, supplied
         }
         const name = configuration.wildcardApplicationName;
         configuration = await withZeroTrustOperationLock(db, configuration, async (lockedDb) => {
-          const health = healthHostname && configuration.healthApplicationName ? await client2.ensureApplication(
-            healthCheckApplication(configuration.healthApplicationName, healthHostname),
-            {
-              id: configuration.healthApplication?.id,
-              name: configuration.healthApplicationName
-            }
+          const health = healthHostname && configuration.healthApplicationName ? await client2.ensureHealthApplication(
+            configuration.healthApplicationName,
+            healthHostname,
+            configuration.healthApplication
           ) : configuration.healthApplication;
           const wildcard = await client2.ensureApplication(
-            {
+            configuration.publicAccess ? publicAppManagementApplication(name, configuration.publicAccessGuardDestination) : {
               name,
               destinations: zeroTrustWildcardDestinations(readPlatformApplication(env2)),
               allowedIdentityProviderIds: configuration.identityProviderIds,
@@ -155140,10 +155410,12 @@ async function runDisableOperation(env2, db, initial) {
             configuration.wildcardApplication?.id,
             configuration.wildcardApplicationName
           );
-          await client2.deleteApplication(
-            configuration.healthApplication?.id,
-            configuration.healthApplicationName
-          );
+          if (!configuration.healthApplication || configuration.healthApplication.name === configuration.healthApplicationName) {
+            await client2.deleteApplication(
+              configuration.healthApplication?.id,
+              configuration.healthApplicationName
+            );
+          }
           return advanceOperation(lockedDb, configuration, "bypass-delete", {
             enabled: false,
             wildcardApplication: null,
@@ -155229,7 +155501,9 @@ async function activatePlatformApplication(env2, db, value) {
     if (!current) {
       throw new ZeroTrustUnavailableError("Project Zero Trust configuration is unavailable.");
     }
-    assertWildcardExcludesControlPlane(env2, zeroTrustWildcardDestinations(target));
+    if (!current.publicAccess) {
+      assertWildcardExcludesControlPlane(env2, zeroTrustWildcardDestinations(target));
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const configuration = {
       ...current,
@@ -155284,6 +155558,16 @@ function assertWildcardExcludesControlPlane(env2, destinations, requestUrl) {
 }
 __name(assertWildcardExcludesControlPlane, "assertWildcardExcludesControlPlane");
 function assertExistingProjectsChoice(current, input2) {
+  if (input2.publicAccess && (input2.existingProjects === "protected" || input2.protectNewProjects || input2.identityProviderIds.length || input2.policyIds.length)) {
+    throw new ZeroTrustUnavailableError(
+      "Public app access cannot require identities or protect new projects."
+    );
+  }
+  if (input2.publicAccess && current?.enabled && !current.publicAccess) {
+    throw new ZeroTrustUnavailableError(
+      "Disable the existing protected configuration before enabling public-only app rules."
+    );
+  }
   const operation = current?.operation;
   if (operation) {
     if (input2.existingProjects === void 0 || input2.existingProjects === operation.existingProjects) {
@@ -155317,11 +155601,19 @@ async function configurePlatformZeroTrust(env2, db, input2, options = {}) {
   const previous = await readZeroTrustConfigurationStrict(db);
   assertExistingProjectsChoice(previous, input2);
   const replacingDisableCredential = previous?.operation?.kind === "disable";
-  if (!replacingDisableCredential) {
+  if (!replacingDisableCredential && !input2.publicAccess) {
     assertWildcardExcludesControlPlane(env2, destinations, options.requestUrl);
   }
+  const application = readPlatformApplication(env2);
+  const publicGuardHostname = platformHealthHostname(application) ?? (application.workersDev && env2.DISPATCH_WORKER_NAME ? `${env2.DISPATCH_WORKER_NAME}.${application.workersDev.subdomain}.workers.dev` : null);
+  if (input2.publicAccess && !publicGuardHostname) {
+    throw new ZeroTrustUnavailableError(
+      "The installation\u2019s reserved dispatch hostname is unavailable. Repair the installation before configuring public app rules."
+    );
+  }
+  const publicAccessGuardDestination = input2.publicAccess ? publicAppManagementDestination("https://" + publicGuardHostname) : void 0;
   const client2 = new ZeroTrustCloudflareClient(accountId, input2.apiToken);
-  const selection = replacingDisableCredential ? await client2.getOrganization() : await client2.validateSelection(input2);
+  const selection = replacingDisableCredential || input2.publicAccess ? await client2.getOrganization() : await client2.validateSelection(input2);
   const credential = await encryptPlatformCredential(
     env2,
     installationId(env2),
@@ -155337,7 +155629,7 @@ async function configurePlatformZeroTrust(env2, db, input2, options = {}) {
     assertExistingProjectsChoice(current, input2);
     if (current?.operation) {
       const sameIds = /* @__PURE__ */ __name((left, right) => left.length === right.length && left.every((id2) => right.includes(id2)), "sameIds");
-      if (current.accountId !== accountId || current.protectNewProjects !== input2.protectNewProjects || !sameIds(current.identityProviderIds, input2.identityProviderIds) || !sameIds(current.policyIds, input2.policyIds)) {
+      if (current.accountId !== accountId || !!current.publicAccess !== !!input2.publicAccess || current.protectNewProjects !== input2.protectNewProjects || !sameIds(current.identityProviderIds, input2.identityProviderIds) || !sameIds(current.policyIds, input2.policyIds)) {
         throw new ZeroTrustUnavailableError(
           "A saved Zero Trust operation is pending. To replace its API token, configure again with the same identity providers, policies, and project selections."
         );
@@ -155355,6 +155647,8 @@ async function configurePlatformZeroTrust(env2, db, input2, options = {}) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     return {
       version: 1,
+      ...input2.publicAccess ? { publicAccess: true, publicAccessGuardDestination } : {},
+      ...input2.managePublicCustomDomains || current?.managePublicCustomDomains ? { managePublicCustomDomains: true } : {},
       revision: (current?.revision ?? 0) + 1,
       enabled: current?.enabled ?? false,
       protectNewProjects: input2.protectNewProjects,
@@ -155541,6 +155835,7 @@ zeroTrustOperatorRoutes.post("/zero-trust/configure", async (context) => {
     return context.json(
       preview("zero-trust.configure", "platform", {
         accountId: context.env.CF_ACCOUNT_ID,
+        ...input2.publicAccess ? { appAccess: "public" } : {},
         identityProviderIds: input2.identityProviderIds,
         policyIds: input2.policyIds,
         protectNewProjects: input2.protectNewProjects,
@@ -156616,7 +156911,9 @@ app11.post("/configure", async (context) => {
   const form = await context.req.parseBody();
   let input2;
   try {
+    const saved = await readZeroTrustConfigurationStrict(context.get("db"));
     input2 = normalizeZeroTrustConfigureInput({
+      publicAccess: !!saved?.publicAccess && !values(form.identityProviderIds).length && !values(form.policyIds).length,
       apiToken: form.apiToken,
       identityProviderIds: values(form.identityProviderIds),
       policyIds: values(form.policyIds),
@@ -158108,7 +158405,7 @@ var import_headless = __toESM(require_xterm_headless(), 1);
 // ../../home/runner/work/void/void/packages/void/package.json
 var package_default = {
   name: "void",
-  version: "0.23.0",
+  version: "0.24.0",
   repository: {
     type: "git",
     url: "git+https://github.com/voidzero-dev/void.git",
@@ -158483,13 +158780,12 @@ var package_default = {
     undici: "8.11.2"
   },
   devDependencies: {
-    "@clack/core": "^1.5.1",
-    "@clack/prompts": "catalog:",
     "@electric-sql/pglite": "0.5.8",
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "catalog:",
     "@types/pg": "^8.23.1",
     "@types/proper-lockfile": "^4.1.4",
+    "@voidzero-dev/vite-plus-prompts": "workspace:*",
     arktype: "^2.2.5",
     "ci-info": "^4.4.0",
     "estree-walker": "^3.0.3",
@@ -160127,6 +160423,7 @@ var BuildManager = class extends Container {
         SOURCE_TOKEN: sourceToken,
         VOID_TOKEN: voidToken,
         VOID_API_URL: voidApiUrl,
+        ...this.env.PROXY_URL ? { VOID_PROXY_URL: this.env.PROXY_URL } : {},
         VOID_PROJECT: config2.projectSlug,
         VOID_CLI_VERSION: PINNED_VOID_CLI_VERSION,
         DO_LOG_URL: "https://manager/logs",
@@ -162308,7 +162605,8 @@ var platformAccessProtection = /* @__PURE__ */ __name(async (context, next) => {
     const path = context.req.path;
     const method = context.req.method;
     const probe = context.env.PLATFORM_HEALTH_PROBE_TOKEN && context.req.header("X-Void-Platform-Probe") === context.env.PLATFORM_HEALTH_PROBE_TOKEN;
-    if (path === "/.well-known/void-platform" && method === "GET" || probe && (path === "/health" && method === "GET" || path === "/internal/platform/sandbox-drain" && method === "GET" || path === "/__void/platform/deployment-execution" && method === "GET" || path === "/internal/platform/email-bootstrap" && method === "POST" || path === "/internal/platform/domain-preflight" && method === "POST" || path === "/internal/platform/domain-activate" && method === "POST")) {
+    if (path === "/.well-known/void-platform" && method === "GET" || probe && (path === "/health" && method === "GET" || path === "/internal/platform/sandbox-drain" && method === "GET" || path === "/__void/platform/deployment-execution" && method === "GET" || path === "/internal/platform/email-bootstrap" && method === "POST" || // The handler also requires its installation-specific setup HMAC.
+    path === "/internal/platform/app-access" && method === "POST" || path === "/internal/platform/domain-preflight" && method === "POST" || path === "/internal/platform/domain-activate" && method === "POST")) {
       return next();
     }
     if (path === "/auth/github-oidc" && method === "POST") {
@@ -164356,6 +164654,185 @@ operatorApi.notFound(
   (context) => context.json({ error: "not_found", message: "Unknown operator API endpoint." }, 404)
 );
 
+// ../../home/runner/work/void/void/platform/packages/api/src/platform-app-access.ts
+init_performance2();
+init_dist();
+init_drizzle_orm();
+init_platform_settings();
+init_cloudflare();
+init_configuration2();
+init_errors4();
+init_lock();
+init_status();
+var SETTING = "appAccess.installation.v1";
+function sameSelection(current, setup) {
+  return current.accountId === setup.accountId && !!current.publicAccess === (setup.mode === "public") && current.protectNewProjects === (setup.mode === "protected") && JSON.stringify(current.identityProviderIds) === JSON.stringify(setup.identityProviderIds) && JSON.stringify(current.policyIds) === JSON.stringify(setup.policyIds);
+}
+__name(sameSelection, "sameSelection");
+async function initializePlatformAppAccess(env2, db, setup) {
+  if (!env2.PLATFORM_APP_ACCESS || !env2.PLATFORM_INSTALLATION_ID || setup.accountId !== env2.CF_ACCOUNT_ID || setup.mode !== (env2.PLATFORM_APP_ACCESS === "public" ? "public" : "protected")) {
+    throw new Error("App access does not match the installation\u2019s account or saved choice.");
+  }
+  const { apiToken: _token, ...identity } = setup;
+  const digest2 = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(identity)))
+  );
+  const requestHash = Array.from(digest2, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const claim2 = await db.transaction(async (tx) => {
+    await lockZeroTrustConfiguration(tx, "exclusive");
+    const value = await getPlatformSetting(tx, SETTING);
+    const receipt = value;
+    if (receipt && (receipt.version !== 1 || typeof receipt.requestHash !== "string" || typeof receipt.complete !== "boolean")) {
+      throw new Error("The saved app access setup receipt is invalid.");
+    }
+    if (receipt?.complete) {
+      return { complete: true };
+    }
+    if (receipt && receipt.requestHash !== requestHash) {
+      throw new Error("Resume with the saved app access selections.");
+    }
+    const result = await tx.execute(
+      sql`SELECT installation_id, lifecycle_manifest FROM __void_platform_installation WHERE singleton = true FOR SHARE`
+    );
+    const row = result.rows[0];
+    if (!row || row.installation_id !== env2.PLATFORM_INSTALLATION_ID || row.lifecycle_manifest?.id !== env2.PLATFORM_INSTALLATION_ID || row.lifecycle_manifest?.deployment?.appAccess !== env2.PLATFORM_APP_ACCESS || !["provisioning", "deploying", "verifying"].includes(row.lifecycle_manifest?.status ?? "")) {
+      throw new Error(
+        "App access initialization is only available during the recorded installation setup."
+      );
+    }
+    const current2 = await readZeroTrustConfigurationStrict(tx);
+    if (!receipt && current2) {
+      if (current2.operation || current2.lastError) {
+        throw new Error("Reconcile the existing app access settings before resuming installation.");
+      }
+      await setPlatformSetting(tx, SETTING, {
+        version: 1,
+        requestHash,
+        complete: true
+      });
+      return { complete: true };
+    }
+    if (current2 && !sameSelection(current2, setup)) {
+      throw new Error(
+        "App access was changed outside installation. Inspect Admin \u2192 Zero Trust before resuming."
+      );
+    }
+    await setPlatformSetting(tx, SETTING, {
+      version: 1,
+      requestHash,
+      complete: !setup.managed
+    });
+    return { complete: !setup.managed };
+  });
+  if (claim2.complete) {
+    return { ready: true };
+  }
+  const current = await readZeroTrustConfigurationStrict(db);
+  if (current?.operation?.kind === "disable") {
+    throw new Error(
+      "An administrator is disabling app access. Finish that operation before resuming installation."
+    );
+  }
+  const existingProjects = current?.operation ? current.operation.existingProjects ?? void 0 : current?.enabled ? void 0 : setup.mode === "protected" ? "protected" : "public";
+  await configurePlatformZeroTrust(env2, db, {
+    apiToken: setup.apiToken,
+    identityProviderIds: setup.identityProviderIds,
+    policyIds: setup.policyIds,
+    protectNewProjects: setup.mode === "protected",
+    ...existingProjects ? { existingProjects } : {},
+    ...setup.mode === "public" ? { publicAccess: true } : {},
+    managePublicCustomDomains: true
+  });
+  const status2 = await zeroTrustStatus(env2, db, { check: true });
+  if (!status2.enabled || status2.status !== "ready" || !status2.live?.present || status2.live.drifted || status2.projects.some((project2) => project2.state === "error" || project2.state === "reconciling")) {
+    return { ready: false };
+  }
+  await db.transaction(async (tx) => {
+    await lockZeroTrustConfiguration(tx, "exclusive");
+    const receipt = await getPlatformSetting(tx, SETTING);
+    const current2 = await readZeroTrustConfigurationStrict(tx);
+    if (receipt?.requestHash !== requestHash || !current2 || !sameSelection(current2, setup) || current2.operation || current2.lastError) {
+      throw new Error("App access changed while setup was being verified. Resume installation.");
+    }
+    await setPlatformSetting(tx, SETTING, { ...receipt, complete: true });
+  });
+  return { ready: true };
+}
+__name(initializePlatformAppAccess, "initializePlatformAppAccess");
+async function platformAppAccess(context) {
+  const token = context.env.PLATFORM_HEALTH_PROBE_TOKEN;
+  if (!token || context.req.header("X-Void-Platform-Probe") !== token || !context.env.PLATFORM_INSTALLATION_ID || !context.env.PLATFORM_APP_ACCESS) {
+    return context.json({ error: "not found" }, 404);
+  }
+  const setupKey = context.env.PLATFORM_APP_ACCESS_SETUP_TOKEN;
+  const signature = context.req.header("X-Void-App-Access-Setup") ?? "";
+  if (!setupKey || setupKey.length < 32 || !/^[A-Za-z0-9_-]{43}$/.test(signature)) {
+    return context.json({ error: "not found" }, 404);
+  }
+  const body = await context.req.text();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(setupKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const proof = Uint8Array.from(
+    atob(signature.replaceAll("-", "+").replaceAll("_", "/")),
+    (byte) => byte.charCodeAt(0)
+  );
+  if (!await crypto.subtle.verify(
+    "HMAC",
+    key,
+    proof,
+    new TextEncoder().encode(
+      `${PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX}
+${context.env.PLATFORM_INSTALLATION_ID}
+${body}`
+    )
+  )) {
+    return context.json({ error: "not found" }, 404);
+  }
+  let setup;
+  try {
+    setup = parsePlatformAppAccessSetup(JSON.parse(body));
+  } catch {
+    return context.json({ error: "Invalid app access setup." }, 400);
+  }
+  try {
+    const receipt = await getPlatformSetting(context.get("db"), SETTING);
+    if (!receipt?.complete && context.env.PLATFORM_TRAFFIC_STATE !== "staging" && await context.env.ROUTING.get(PLATFORM_DISABLED_KEY) !== PLATFORM_DISABLED_VALUE) {
+      return context.json({ error: "Close app traffic before initializing app access." }, 409);
+    }
+    const result = await initializePlatformAppAccess(context.env, context.get("db"), setup);
+    return context.json(
+      { installationId: context.env.PLATFORM_INSTALLATION_ID, ...result },
+      result.ready ? 200 : 202
+    );
+  } catch (error63) {
+    console.error("[platform] app access setup failed", error63);
+    if (error63 instanceof ZeroTrustCloudflareError && [401, 403].includes(error63.status)) {
+      return context.json(
+        {
+          error: "The app access token needs Access Apps and Policies Edit plus Organizations, Identity Providers, and Groups Read in the hosting account.",
+          code: "app_access_credentials"
+        },
+        403
+      );
+    }
+    if (error63 instanceof ZeroTrustUnavailableError) {
+      return context.json({ error: error63.message }, 409);
+    }
+    return context.json(
+      {
+        error: "App access is not ready. Check the Access token, identity providers, and policy selections, then resume."
+      },
+      503
+    );
+  }
+}
+__name(platformAppAccess, "platformAppAccess");
+
 // ../../home/runner/work/void/void/platform/packages/api/src/platform-domain-activation.ts
 init_performance2();
 init_configuration2();
@@ -164869,7 +165346,7 @@ async function tryActivateDomain(env2, db, domain2, project2, options) {
   let slugRouting = null;
   let activated = false;
   if (gateOk && wasPending) {
-    await reconcileProjectZeroTrustDomains(env2, db, project2.id);
+    await reconcileProjectZeroTrustDomains(env2, db, project2.id, { verifiedDomainId: domain2.id });
     await db.transaction(async (tx) => {
       await tx.execute(sql`SELECT id FROM projects WHERE id = ${project2.id} FOR UPDATE`);
       const txDb = tx;
@@ -174689,7 +175166,7 @@ var app36 = new Hono3().use("*", async (context, next) => {
   return context.json({ error: "Internal Server Error" }, 500);
 }).use("*", async (context, next) => {
   const healthProbeToken = context.env.PLATFORM_HEALTH_PROBE_TOKEN;
-  const installerProbe = healthProbeToken !== void 0 && healthProbeToken !== "" && context.req.header("X-Void-Platform-Probe") === healthProbeToken && (context.req.path === "/health" || context.req.path === "/.well-known/void-platform" || context.req.path === "/internal/platform/sandbox-drain" || context.req.path === "/__void/platform/deployment-execution" || context.req.path === "/internal/platform/email-bootstrap" && context.req.method === "POST" || context.req.path === "/internal/platform/domain-preflight" && context.req.method === "POST" || context.req.path === "/internal/platform/domain-activate" && context.req.method === "POST");
+  const installerProbe = healthProbeToken !== void 0 && healthProbeToken !== "" && context.req.header("X-Void-Platform-Probe") === healthProbeToken && (context.req.path === "/health" || context.req.path === "/.well-known/void-platform" || context.req.path === "/internal/platform/sandbox-drain" || context.req.path === "/__void/platform/deployment-execution" || context.req.path === "/internal/platform/email-bootstrap" && context.req.method === "POST" || context.req.path === "/internal/platform/app-access" && context.req.method === "POST" || context.req.path === "/internal/platform/domain-preflight" && context.req.method === "POST" || context.req.path === "/internal/platform/domain-activate" && context.req.method === "POST");
   const maintenanceSandboxDrain = context.env.PLATFORM_TRAFFIC_STATE === "sandbox-drain" && isSandboxDrainMaintenanceRequest(context.req.raw);
   const authenticationSetup = context.env.PLATFORM_AUTH_SETUP_TOKEN && context.req.header("X-Void-Auth-Setup") && context.req.method === "POST" && context.req.path === "/internal/platform/auth-initialize";
   if (!authenticationSetup && !installerProbe && !maintenanceSandboxDrain && (context.env.PLATFORM_TRAFFIC_STATE === "staging" || context.env.PLATFORM_TRAFFIC_STATE === "sandbox-drain" || context.env.PLATFORM_INSTALLATION_ID && await context.env.ROUTING.get(PLATFORM_DISABLED_KEY) === PLATFORM_DISABLED_VALUE)) {
@@ -174764,7 +175241,7 @@ var app36 = new Hono3().use("*", async (context, next) => {
       usageProtocolVersion: USAGE_PROTOCOL_VERSION
     })
   );
-}).post("/internal/platform/domain-preflight", platformDomainPreflight).post("/internal/platform/domain-activate", platformDomainActivation).post("/internal/platform/email-bootstrap", async (context) => {
+}).post("/internal/platform/app-access", platformAppAccess).post("/internal/platform/domain-preflight", platformDomainPreflight).post("/internal/platform/domain-activate", platformDomainActivation).post("/internal/platform/email-bootstrap", async (context) => {
   const healthProbeToken = context.env.PLATFORM_HEALTH_PROBE_TOKEN;
   if (!healthProbeToken || context.req.header("X-Void-Platform-Probe") !== healthProbeToken || !context.env.PLATFORM_INSTALLATION_ID || !getPlatformCapabilities(context.env).email) {
     return context.json({ error: "not found" }, 404);