@void/platform 1.4.0 → 1.6.0

package/dist/browser-page.d.mts

@@ -1,4 +1,3 @@
-//#region src/browser-page.d.ts
 /** Shared, dependency-free presentation for browser onboarding and authentication pages. */
 export declare const browserPageLogo: string;
 export declare const browserPageStyles: string;
@@ -15,5 +14,4 @@ export declare function renderBrowserPage({ title, platformName, content }: {
   platformName?: string;
   content: string;
 }): string;
-export declare function browserPageLead(title: string, description: string): string;
-//#endregion
+export declare function browserPageLead(title: string, description: string): string;

package/dist/browser-page.mjs

@@ -1,4 +1,4 @@
-//#region src/browser-page.ts
+// src/browser-page.ts
 /** Shared, dependency-free presentation for browser onboarding and authentication pages. */
 const browserPageLogo = "<svg role=\"img\" aria-label=\"Void\" viewBox=\"0 0 270 58\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n<circle cx=\"262\" cy=\"48.96\" r=\"8\" fill=\"currentColor\"/>\n<path d=\"M20.72 0.959999L35.52 41.28L50.08 0.959999H70L47.92 56.96H22.32L0.24 0.959999H20.72ZM106.542 57.92C82.9419 57.92 70.6219 48 70.6219 28.96C70.6219 9.92 82.9419 1.90735e-06 106.542 1.90735e-06C130.142 1.90735e-06 142.542 9.92 142.542 28.96C142.542 48 130.142 57.92 106.542 57.92ZM106.542 44.08C117.662 44.08 122.862 39.36 122.862 28.96C122.862 18.48 117.662 13.76 106.542 13.76C95.4219 13.76 90.2219 18.48 90.2219 28.96C90.2219 39.36 95.4219 44.08 106.542 44.08ZM152.265 56.96V0.959999H171.465V56.96H152.265ZM184.687 56.96V0.959999H219.887C239.327 0.959999 250.447 9.84 250.447 28.96C250.447 48.16 239.247 56.96 219.807 56.96H184.687ZM230.767 28.96C230.767 18.48 226.287 14.56 217.167 14.56H203.887V43.36H217.167C226.287 43.36 230.767 39.44 230.767 28.96Z\" fill=\"currentColor\"/>\n</svg>";
 const browserPageStyles = `
@@ -87,5 +87,4 @@ function renderBrowserPage({ title, platformName = "Void", content }) {
 function browserPageLead(title, description) {
 	return "<div class=\"void-auth-lead\"><h1 id=\"void-auth-title\">" + escapeBrowserHtml(title) + "</h1><p>" + escapeBrowserHtml(description) + "</p></div>";
 }
-//#endregion
 export { browserPageIdentity, browserPageLead, browserPageLogo, browserPageStatus, browserPageStyles, escapeBrowserHtml, renderBrowserPage };

package/dist/email-protocol.d.mts

@@ -1,4 +1,3 @@
-//#region src/email-protocol.d.ts
 /** Worker-safe wire contract shared by the platform gateway and tenant entry. */
 export declare const EMAIL_PROTOCOL_VERSION = 1;
 export declare const EMAIL_RECEIPT_PATH = "/__void/email/receipt/v1";
@@ -44,5 +43,4 @@ export declare function signEmailReceipt(claims: EmailReceiptClaims, signingSecr
 export declare function verifyEmailReceipt(token: string, signingSecret: string, expected: Pick<EmailReceiptClaims, "projectId" | "deploymentId" | "recipient">, now?: number): Promise<EmailReceiptClaims | null>;
 export declare function encodeEmailActions(actions: ReadonlyArray<EmailWireAction>): ReadableStream<Uint8Array>;
 /** Read each frame with fixed ceilings before parsing metadata or allocating a reply. */
-export declare function readEmailActions(stream: ReadableStream<Uint8Array>, deadlineMs?: number): Promise<Array<EmailWireAction>>;
-//#endregion
+export declare function readEmailActions(stream: ReadableStream<Uint8Array>, deadlineMs?: number): Promise<Array<EmailWireAction>>;

package/dist/email-protocol.mjs

@@ -1,4 +1,4 @@
-//#region src/email-protocol.ts
+// src/email-protocol.ts
 /** Worker-safe wire contract shared by the platform gateway and tenant entry. */
 const EMAIL_PROTOCOL_VERSION = 1;
 const EMAIL_RECEIPT_PATH = "/__void/email/receipt/v1";
@@ -268,5 +268,4 @@ async function withReader(stream, read) {
 		} catch {}
 	}
 }
-//#endregion
 export { EMAIL_MAX_ACTIONS, EMAIL_MAX_INBOUND_BYTES, EMAIL_MAX_INBOUND_HEADERS, EMAIL_MAX_INBOUND_HEADER_BYTES, EMAIL_MAX_METADATA_BYTES, EMAIL_MAX_REPLY_BYTES, EMAIL_MAX_RESPONSE_BYTES, EMAIL_PROTOCOL_VERSION, EMAIL_RECEIPT_PATH, encodeEmailActions, encodeEmailEnvelope, readEmailActions, readEmailEnvelope, signEmailReceipt, verifyEmailReceipt };

package/dist/index.d.mts

@@ -1,5 +1,4 @@
 import { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits } from "./plans.mjs";
-//#region src/access-policy.d.ts
 /** An exact email domain, such as `example.com`, without wildcards or an `@`. */
 export declare function isPlatformAccessEmailDomain(value: unknown): value is string;
 /** Whether signing in with this Access identity provider proves a company identity. */
@@ -13,8 +12,6 @@ export declare function isPlatformAccessCompanyIdentityProvider(provider: Readon
  * names, so it counts only when `companyLoginMethod` accepts that provider ID.
  */
 export declare function isPlatformAccessIdentityRule(rule: Readonly<Record<string, unknown>>, companyLoginMethod: (identityProviderId: string) => boolean): boolean;
-//#endregion
-//#region src/app-access.d.ts
 export declare const PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
 /** Uninstall handoff that turns off installer-managed project Zero Trust before any user exists. */
 export declare const PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX = "void-platform-app-access-turn-off-v1";
@@ -29,8 +26,6 @@ type PlatformAppAccessSetup = Readonly<{
   policyIds: ReadonlyArray<string>;
 }>;
 export declare function parsePlatformAppAccessSetup(value: unknown): PlatformAppAccessSetup;
-//#endregion
-//#region src/authentication-recovery.d.ts
 /** Owner recovery capabilities authorize a provider test, never a platform session. */
 type PlatformAuthenticationRecovery = Readonly<{
   installationId: string;
@@ -43,8 +38,6 @@ type PlatformAuthenticationRecovery = Readonly<{
   signature: string;
 }>;
 export declare function platformAuthenticationRecoveryMessage(value: Omit<PlatformAuthenticationRecovery, "signature">): string;
-//#endregion
-//#region src/authentication.d.ts
 /** Platform login and perimeter configuration are independent of app authentication. */
 export declare const PLATFORM_LOGIN_KINDS: readonly ["github", "google", "oidc", "cloudflare-access"];
 type PlatformLoginKind = (typeof PLATFORM_LOGIN_KINDS)[number];
@@ -141,8 +134,6 @@ export declare function parsePlatformAccessProtection(value: unknown): PlatformA
 export declare function parsePlatformAdmissionPolicy(value: unknown): PlatformAdmissionPolicy;
 /** Run inside the settings mutation transaction, using the resulting enabled connections. */
 export declare function validatePlatformAdmissionPolicy(policy: PlatformAdmissionPolicy, enabledConnections: ReadonlyArray<PlatformLoginConfiguration>, protection: PlatformAccessProtection | null): void;
-//#endregion
-//#region src/application.d.ts
 /** Public application addressing, independent of the platform API's origin. */
 type PlatformApplication = Readonly<{
   baseDomain: string;
@@ -190,8 +181,6 @@ export declare const PLATFORM_HEALTH_HOSTNAME_LABEL = "void-platform-health";
 export declare function platformHealthHostname(application: PlatformApplication): string | null;
 export declare function platformProjectHostname(project: PlatformApplicationProject, application: PlatformApplication): string;
 export declare function platformProjectHostnames(project: PlatformApplicationProject, application: PlatformApplication): ReadonlyArray<string>;
-//#endregion
-//#region src/manifest.d.ts
 export declare const PLATFORM_DEPLOYMENT_SCHEMA_VERSION: 1;
 type PlatformCapabilities = Readonly<{
   ai: boolean;
@@ -231,6 +220,11 @@ type PlatformResourceNames = Readonly<{
   usageQueue: string;
 }>;
 type PlatformAppAccess = "public" | "platform" | "custom";
+/**
+ * `minimal` keeps request URLs, console messages and exception messages out of
+ * Workers Logs and the platform's request log rows. Omitted means `full`.
+ */
+type PlatformRuntimeLogs = "minimal";
 type PlatformDeploymentManifest = Readonly<{
   /** Initial app-access choice. Omitted on installations created before guided setup. */
   appAccess?: PlatformAppAccess;
@@ -249,7 +243,9 @@ type PlatformDeploymentManifest = Readonly<{
   displayName: string;
   installationSlug: string;
   resources: PlatformResourceNames;
-  schemaVersion: typeof PLATFORM_DEPLOYMENT_SCHEMA_VERSION | 2 | 3 | 4;
+  /** Requires schema version 5, so an older CLI refuses the manifest instead of dropping it. */
+  runtimeLogs?: PlatformRuntimeLogs;
+  schemaVersion: typeof PLATFORM_DEPLOYMENT_SCHEMA_VERSION | 2 | 3 | 4 | 5;
 }>;
 type PlatformDeploymentManifestInput = Readonly<{
   appAccess?: PlatformAppAccess;
@@ -272,6 +268,7 @@ type PlatformDeploymentManifestInput = Readonly<{
   displayName: string;
   installationSlug: string;
   resources?: Partial<PlatformResourceNames>;
+  runtimeLogs?: PlatformRuntimeLogs;
 }>;
 type PlatformApplicationRoute = Readonly<{
   pattern: string;
@@ -285,8 +282,6 @@ export declare function createPlatformResourceNames(installationSlug: string): P
 export declare function createApplicationRoutes(application: PlatformDeploymentManifest["application"]): ReadonlyArray<PlatformApplicationRoute>;
 export declare function createPlatformDeploymentManifest(input: PlatformDeploymentManifestInput): PlatformDeploymentManifest;
 export declare function parsePlatformDeploymentManifest(value: unknown): PlatformDeploymentManifest;
-//#endregion
-//#region src/installation.d.ts
 export declare const PLATFORM_INSTALLATION_SCHEMA_VERSION: 1;
 export declare const PLATFORM_DISABLED_KEY = "__void/platform/disabled/v1";
 export declare const PLATFORM_DISABLED_VALUE = "disabled";
@@ -415,8 +410,6 @@ export declare function transitionInstallation(manifest: PlatformInstallationMan
 export declare function recordInstallationResource(manifest: PlatformInstallationManifest, resource: InstallationResource, updatedAt: string): PlatformInstallationManifest;
 export declare function recordInstallationStep(manifest: PlatformInstallationManifest, step: InstallationStep, updatedAt: string): PlatformInstallationManifest;
 export declare function parsePlatformInstallationManifest(value: unknown): PlatformInstallationManifest;
-//#endregion
-//#region src/discovery.d.ts
 export declare const PLATFORM_DISCOVERY_SCHEMA_VERSION: 1;
 type PlatformAuthenticationDiscovery = Readonly<{
   methods: ReadonlyArray<PlatformLoginDescriptor>;
@@ -452,8 +445,6 @@ type PlatformDiscoveryInput = Omit<PlatformDiscoveryDocument, "directWorkerUploa
  */
 export declare function createPlatformDiscoveryDocument(input: PlatformDiscoveryInput): PlatformDiscoveryDocument;
 export declare function parsePlatformDiscoveryDocument(value: unknown): PlatformDiscoveryDocument;
-//#endregion
-//#region src/worker-config.d.ts
 type PlatformProvisionedResourceIds = Readonly<{
   hyperdrive: string;
   isrCacheKv: string;
@@ -482,5 +473,4 @@ export declare function createPlatformWorkerConfigs(input: {
   runtimeApiAssetsDirectory?: string;
   trafficState?: "enabled" | "sandbox-drain" | "staging";
 }): PlatformWorkerConfigSet;
-//#endregion
-export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, type InstallationResource, type InstallationResourceKind, type InstallationStatus, type InstallationStep, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, type PlatformAccessProtection, type PlatformAdmissionPolicy, type PlatformAppAccess, type PlatformAppAccessSetup, type PlatformApplication, type PlatformApplicationProject, type PlatformApplicationRoute, type PlatformAuthenticationDiscovery, type PlatformAuthenticationRecovery, type PlatformAuthenticationSetup, type PlatformCapabilities, type PlatformControlPlane, type PlatformDeploymentManifest, type PlatformDeploymentManifestInput, type PlatformDiscoveryDocument, type PlatformInstallationEndpoints, type PlatformInstallationManifest, type PlatformLifecycleOperation, type PlatformLoginConfiguration, type PlatformLoginDescriptor, type PlatformLoginKind, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, type PlatformProvisionedResourceIds, type PlatformResourceNames, type PlatformResourceOwnershipMarker, type PlatformRuntimeProvenance, type PlatformSignupAllowlistEntry, type PlatformSignupIdentity, type PlatformWorkerConfigSet, type ResourceOwnership, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits };
+export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, BuildInstanceType, BuiltinPlanId, EditablePlanLimit, type InstallationResource, type InstallationResourceKind, type InstallationStatus, type InstallationStep, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PlanId, PlanLimits, PlanLimitsPatch, type PlatformAccessProtection, type PlatformAdmissionPolicy, type PlatformAppAccess, type PlatformAppAccessSetup, type PlatformApplication, type PlatformApplicationProject, type PlatformApplicationRoute, type PlatformAuthenticationDiscovery, type PlatformAuthenticationRecovery, type PlatformAuthenticationSetup, type PlatformCapabilities, type PlatformControlPlane, type PlatformDeploymentManifest, type PlatformDeploymentManifestInput, type PlatformDiscoveryDocument, type PlatformInstallationEndpoints, type PlatformInstallationManifest, type PlatformLifecycleOperation, type PlatformLoginConfiguration, type PlatformLoginDescriptor, type PlatformLoginKind, PlatformPlanCatalog, PlatformPlanDefinition, PlatformPlanReconciliation, type PlatformProvisionedResourceIds, type PlatformResourceNames, type PlatformResourceOwnershipMarker, type PlatformRuntimeLogs, type PlatformRuntimeProvenance, type PlatformSignupAllowlistEntry, type PlatformSignupIdentity, type PlatformWorkerConfigSet, type ResourceOwnership, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { a as isSourceRevision, c as requiredString, i as isSandboxDrainProtocol, n as isPrintableText, o as isUsageProtocolVersion, s as record, t as assertRecord } from "./validate-DbJR7Q0Z.mjs";
+import { a as isSourceRevision, c as requiredString, i as isSandboxDrainProtocol, n as isPrintableText, o as isUsageProtocolVersion, s as record, t as assertRecord } from "./validate-CTKcW3Vp.mjs";
 import { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits } from "./plans.mjs";
-//#region src/access-policy.ts
+// src/access-policy.ts
 const COMPANY_IDENTITY_RULES = [
 	"email_list",
 	"gsuite",
@@ -52,8 +52,7 @@ function isPlatformAccessIdentityRule(rule, companyLoginMethod) {
 		return plainObject(value) && Object.keys(value).length > 0;
 	});
 }
-//#endregion
-//#region src/app-access.ts
+// src/app-access.ts
 const PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX = "void-platform-app-access-v1";
 /** Uninstall handoff that turns off installer-managed project Zero Trust before any user exists. */
 const PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX = "void-platform-app-access-turn-off-v1";
@@ -81,8 +80,7 @@ function parsePlatformAppAccessSetup(value) {
 		policyIds
 	};
 }
-//#endregion
-//#region src/authentication-recovery.ts
+// src/authentication-recovery.ts
 function platformAuthenticationRecoveryMessage(value) {
 	return JSON.stringify([
 		"void-platform-auth-recovery-v1",
@@ -95,8 +93,7 @@ function platformAuthenticationRecoveryMessage(value) {
 		value.expiresAt
 	]);
 }
-//#endregion
-//#region src/authentication.ts
+// src/authentication.ts
 /** Platform login and perimeter configuration are independent of app authentication. */
 const PLATFORM_LOGIN_KINDS = [
 	"github",
@@ -296,8 +293,7 @@ function validatePlatformAdmissionPolicy(policy, enabledConnections, protection)
 		if (connection.kind === "github" || connection.kind === "google" && connection.allowedDomains.length === 0) throw new Error("Unrestricted social login does not establish company membership.");
 	}
 }
-//#endregion
-//#region src/manifest.ts
+// src/manifest.ts
 const PLATFORM_DEPLOYMENT_SCHEMA_VERSION = 1;
 const CORE_CAPABILITIES = {
 	ai: true,
@@ -415,6 +411,7 @@ function createPlatformDeploymentManifest(input) {
 		"platform",
 		"custom"
 	].includes(input.appAccess)) throw new Error("appAccess must be public, platform, or custom.");
+	if (input.runtimeLogs !== void 0 && input.runtimeLogs !== "minimal") throw new Error("runtimeLogs must be minimal when set.");
 	const providers = input.authentication?.providers ?? ["github"];
 	if (providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider)) || new Set(providers).size !== providers.length) throw new Error("Authentication providers must be unique supported login kinds.");
 	const configurable = input.authentication?.configurable === true || input.authentication?.accessProtection === true || providers.some((provider) => provider === "oidc" || provider === "cloudflare-access");
@@ -450,7 +447,8 @@ function createPlatformDeploymentManifest(input) {
 		displayName: requiredString(input.displayName, "displayName").trim(),
 		installationSlug,
 		resources,
-		schemaVersion: input.appAccess !== void 0 ? 4 : configurable ? 3 : workersDev ? 2 : 1
+		...input.runtimeLogs ? { runtimeLogs: input.runtimeLogs } : {},
+		schemaVersion: input.runtimeLogs ? 5 : input.appAccess !== void 0 ? 4 : configurable ? 3 : workersDev ? 2 : 1
 	};
 	createApplicationRoutes(manifest.application);
 	for (const [key, value] of Object.entries(manifest.controlPlane)) {
@@ -466,7 +464,7 @@ function createPlatformDeploymentManifest(input) {
 }
 function parsePlatformDeploymentManifest(value) {
 	assertRecord(value, "Platform deployment manifest");
-	if (value.schemaVersion !== 1 && value.schemaVersion !== 2 && value.schemaVersion !== 3 && value.schemaVersion !== 4) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
+	if (value.schemaVersion !== 1 && value.schemaVersion !== 2 && value.schemaVersion !== 3 && value.schemaVersion !== 4 && value.schemaVersion !== 5) throw new Error(`Unsupported platform deployment schema version: ${String(value.schemaVersion)}.`);
 	const application = value.application;
 	const authentication = value.authentication;
 	const rawCapabilities = value.capabilities;
@@ -474,7 +472,7 @@ function parsePlatformDeploymentManifest(value) {
 	const rawResources = value.resources;
 	assertRecord(application, "application");
 	let workersDev;
-	if (value.schemaVersion === 2 || (value.schemaVersion === 3 || value.schemaVersion === 4) && application.workersDev !== void 0) {
+	if (value.schemaVersion === 2 || Number(value.schemaVersion) >= 3 && application.workersDev !== void 0) {
 		assertRecord(application.workersDev, "application.workersDev");
 		workersDev = {
 			subdomain: requiredString(application.workersDev.subdomain, "workersDev.subdomain"),
@@ -493,14 +491,19 @@ function parsePlatformDeploymentManifest(value) {
 		capabilities[key] = entry;
 	}
 	const providers = authentication.providers;
-	if (!Array.isArray(providers) || providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider) || value.schemaVersion !== 3 && value.schemaVersion !== 4 && provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
-	if (value.schemaVersion === 3 && authentication.configurable !== true || value.schemaVersion !== 3 && value.schemaVersion !== 4 && (authentication.configurable !== void 0 || authentication.accessProtection !== void 0) || authentication.accessProtection !== void 0 && authentication.accessProtection !== true) throw new Error("Configurable authentication requires deployment schema version 3.");
+	if (!Array.isArray(providers) || providers.some((provider) => !PLATFORM_LOGIN_KINDS.includes(provider) || Number(value.schemaVersion) < 3 && provider !== "github" && provider !== "google")) throw new Error("authentication.providers must contain only github or google.");
+	if (value.schemaVersion === 3 && authentication.configurable !== true || Number(value.schemaVersion) < 3 && (authentication.configurable !== void 0 || authentication.accessProtection !== void 0) || authentication.accessProtection !== void 0 && authentication.accessProtection !== true) throw new Error("Configurable authentication requires deployment schema version 3.");
 	if (value.schemaVersion === 4 ? ![
 		"public",
 		"platform",
 		"custom"
+	].includes(String(value.appAccess)) : value.schemaVersion === 5 ? value.appAccess !== void 0 && ![
+		"public",
+		"platform",
+		"custom"
 	].includes(String(value.appAccess)) : value.appAccess !== void 0) throw new Error("Guided app access requires deployment schema version 4 and a valid appAccess choice.");
 	if (authentication.configurable !== void 0 && authentication.configurable !== true) throw new Error("Invalid configurable authentication flag.");
+	if (value.schemaVersion === 5 ? value.runtimeLogs !== "minimal" : value.runtimeLogs !== void 0) throw new Error("Minimal runtime logs require deployment schema version 5.");
 	const resourceDefaults = createPlatformResourceNames(requiredString(value.installationSlug, "installationSlug"));
 	const resources = {};
 	for (const key of Object.keys(resourceDefaults)) resources[key] = requiredString(rawResources[key] ?? (key === "emailGatewayWorker" || key === "deploymentQueue" ? resourceDefaults[key] : void 0), `resources.${key}`);
@@ -509,7 +512,7 @@ function parsePlatformDeploymentManifest(value) {
 		return hostname === null ? null : requiredString(hostname, `controlPlane.${key}`);
 	};
 	return createPlatformDeploymentManifest({
-		...value.schemaVersion === 4 ? { appAccess: value.appAccess } : {},
+		...Number(value.schemaVersion) >= 4 && value.appAccess !== void 0 ? { appAccess: value.appAccess } : {},
 		application: {
 			baseDomain: requiredString(application.baseDomain, "application.baseDomain"),
 			dedicatedZone: application.dedicatedZone === true,
@@ -533,11 +536,11 @@ function parsePlatformDeploymentManifest(value) {
 		},
 		displayName: requiredString(value.displayName, "displayName"),
 		installationSlug: requiredString(value.installationSlug, "installationSlug"),
-		resources
+		resources,
+		...value.schemaVersion === 5 ? { runtimeLogs: "minimal" } : {}
 	});
 }
-//#endregion
-//#region src/installation.ts
+// src/installation.ts
 const PLATFORM_INSTALLATION_SCHEMA_VERSION = 1;
 const PLATFORM_DISABLED_KEY = "__void/platform/disabled/v1";
 const PLATFORM_DISABLED_VALUE = "disabled";
@@ -909,8 +912,7 @@ function parsePlatformRuntimeProvenance(value) {
 		sourceRevision
 	};
 }
-//#endregion
-//#region src/application.ts
+// src/application.ts
 /** Minimal public-origin adapter; request policy remains in the service-bound dispatcher. */
 const PLATFORM_PROJECT_INGRESS_SOURCE = `export default {
   fetch(request, env) {
@@ -987,8 +989,7 @@ function platformProjectHostname(project, application) {
 function platformProjectHostnames(project, application) {
 	return [.../* @__PURE__ */ new Set([platformProjectHostname(project, application), ...application.workersDev ? [platformProjectWorkersDevHostname(project, application.workersDev)] : []])];
 }
-//#endregion
-//#region src/discovery.ts
+// src/discovery.ts
 const PLATFORM_DISCOVERY_SCHEMA_VERSION = 1;
 function normalizeOrigin(value, name) {
 	let url;
@@ -1111,8 +1112,7 @@ function parseAuthentication(value) {
 		...authentication.setupPending === true ? { setupPending: true } : {}
 	};
 }
-//#endregion
-//#region src/worker-config.ts
+// src/worker-config.ts
 function createPlatformWorkerConfigs(input) {
 	const { accountId, apiUrl, deployment, healthProbeToken, installationId, ownershipNonce, platformVersion, proxyUrl, emailGatewayUrl, resources, runtimeEntrypoints } = input;
 	const publicEndpoints = input.publicEndpoints ?? true;
@@ -1134,10 +1134,11 @@ function createPlatformWorkerConfigs(input) {
 		resourceKind: "worker",
 		resourceName
 	})) });
+	const runtimeLogs = deployment.runtimeLogs ? { PLATFORM_RUNTIME_LOGS: deployment.runtimeLogs } : {};
 	const common = {
 		account_id: accountId,
 		compatibility_date: "2026-02-24",
-		observability: { enabled: true },
+		observability: { enabled: !deployment.runtimeLogs },
 		preview_urls: publicEndpoints && !deployment.authentication.accessProtection,
 		workers_dev: publicEndpoints
 	};
@@ -1283,6 +1284,7 @@ function createPlatformWorkerConfigs(input) {
 			PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
 			...deployment.appAccess ? { PLATFORM_APP_ACCESS: deployment.appAccess } : {},
 			PLATFORM_INSTALLATION_ID: installationId,
+			...runtimeLogs,
 			PLATFORM_TRAFFIC_STATE: trafficState,
 			...ownershipVars("api-worker", names.apiWorker),
 			PLATFORM_VERSION: platformVersion,
@@ -1378,6 +1380,7 @@ function createPlatformWorkerConfigs(input) {
 			}],
 			vars: {
 				PLATFORM_DISPATCH_WORKER_NAME: names.dispatchWorker,
+				...runtimeLogs,
 				...ownershipVars("tail-worker", names.tailWorker)
 			}
 		},
@@ -1415,10 +1418,10 @@ function createPlatformWorkerConfigs(input) {
 				PLATFORM_HEALTH_PROBE_TOKEN: healthProbeToken,
 				PLATFORM_INSTALLATION_ID: installationId,
 				PLATFORM_TRAFFIC_STATE: trafficState,
+				...runtimeLogs,
 				...ownershipVars("dispatch-worker", names.dispatchWorker)
 			}
 		}
 	};
 }
-//#endregion
 export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, DEFAULT_PLATFORM_SESSION_SECONDS, GOOGLE_OIDC_ISSUER, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, PLATFORM_APPLICATION_KEY, PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DEPLOYMENT_SCHEMA_VERSION, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_DISCOVERY_SCHEMA_VERSION, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_INSTALLATION_SCHEMA_VERSION, PLATFORM_LOGIN_KINDS, PLATFORM_PROJECT_INGRESS_SOURCE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_RESOURCE_OWNERSHIP_SCHEMA_VERSION, PLATFORM_SANDBOX_DRAIN_KEY, PLATFORM_USAGE_PROTOCOL_VERSION, createApplicationRoutes, createDefaultPlanCatalog, createPlatformDeploymentManifest, createPlatformDiscoveryDocument, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformAccessCompanyIdentityProvider, isPlatformAccessEmailDomain, isPlatformAccessIdentityRule, isPlatformSignupAllowed, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformDeploymentManifest, parsePlatformDiscoveryDocument, parsePlatformIdentityUrl, parsePlatformInstallationManifest, parsePlatformLifecycleOperation, parsePlatformLoginConfiguration, parsePlatformLoginDescriptor, parsePlatformLoginId, parsePlatformPlanCatalog, parsePlatformPlanId, parsePlatformResourceOwnershipMarker, parsePlatformSignupAllowlistEntry, platformAuthenticationRecoveryMessage, platformDashboardUrl, platformHealthHostname, platformProjectHostname, platformProjectHostnames, platformProjectIngressName, platformProjectIngressPrefix, platformProjectWorkersDevHostname, platformProtectionProofMessage, platformWorkersDevAliasKey, readPlatformApplication, recordInstallationResource, recordInstallationStep, resolvePlatformApplicationEnvironment, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation, validatePlanLimits, validatePlatformAdmissionPolicy };

package/dist/installer.d.mts

@@ -1,4 +1,3 @@
-//#region src/installer.d.ts
 export type PlatformRuntimeArtifact = Readonly<{
   path: string;
   sha256: string;
@@ -27,6 +26,8 @@ export type PlatformRuntimeDatabaseManifest = Readonly<{
 }>;
 export type PlatformRuntimeManifest = Readonly<{
   appAccessSetup?: 1;
+  /** The runtime honours `runtimeLogs: minimal` (PLATFORM_RUNTIME_LOGS). */
+  runtimeLogs?: 1;
   /** Durable deployment Queue payload and PostgreSQL operation journal contract. */
   deploymentExecution?: 1;
   authenticationProtocolVersion?: 1;
@@ -58,5 +59,4 @@ export declare function platformDatabaseSchemaDigest(lineage: string, migrations
 export declare function parsePlatformRuntimeManifest(value: unknown): PlatformRuntimeManifest;
 export declare function getPlatformRuntimeDirectory(): string;
 export declare function readPlatformRuntimeManifest(runtimeDirectory?: string): PlatformRuntimeManifest;
-export declare function resolvePlatformRuntime(customRuntimeDirectory?: string, baseDirectory?: string): PlatformRuntime;
-//#endregion
+export declare function resolvePlatformRuntime(customRuntimeDirectory?: string, baseDirectory?: string): PlatformRuntime;

package/dist/installer.mjs

@@ -1,9 +1,9 @@
-import { a as isSourceRevision, i as isSandboxDrainProtocol, o as isUsageProtocolVersion, r as isRecord } from "./validate-DbJR7Q0Z.mjs";
+import { a as isSourceRevision, i as isSandboxDrainProtocol, o as isUsageProtocolVersion, r as isRecord } from "./validate-CTKcW3Vp.mjs";
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, isAbsolute, join, resolve } from "pathslash";
-//#region src/installer.ts
+// src/installer.ts
 const PLATFORM_ADMIN_ASSETS_DIRECTORY = "api/assets";
 const PLATFORM_ADMIN_CLIENT_ASSET_PATH = `${PLATFORM_ADMIN_ASSETS_DIRECTORY}/admin/client.js`;
 const PLATFORM_ADMIN_STYLE_ASSET_PATH = `${PLATFORM_ADMIN_ASSETS_DIRECTORY}/admin/style.css`;
@@ -25,6 +25,7 @@ function parsePlatformRuntimeManifest(value) {
 	if (root.privatePreviews !== void 0 && root.privatePreviews !== 1) throw new Error("Unsupported private preview protocol.");
 	if (root.schemaVersion !== 2) throw new Error("runtime manifest schemaVersion must be 2");
 	if (root.appAccessSetup !== void 0 && root.appAccessSetup !== 1) throw new Error("Unsupported app access setup protocol.");
+	if (root.runtimeLogs !== void 0 && root.runtimeLogs !== 1) throw new Error("Unsupported runtime logs protocol.");
 	if (root.deploymentExecution !== void 0 && root.deploymentExecution !== 1) throw new Error("Unsupported deployment execution protocol.");
 	if (root.authenticationProtocolVersion !== void 0 && root.authenticationProtocolVersion !== 1) throw new Error("Unsupported authentication protocol version.");
 	if (root.emailProtocolVersion !== void 0 && root.emailProtocolVersion !== 1) throw new Error("Unsupported email protocol version.");
@@ -85,6 +86,7 @@ function parsePlatformRuntimeManifest(value) {
 	return {
 		artifacts,
 		...root.appAccessSetup === 1 ? { appAccessSetup: 1 } : {},
+		...root.runtimeLogs === 1 ? { runtimeLogs: 1 } : {},
 		...root.deploymentExecution === 1 ? { deploymentExecution: 1 } : {},
 		...assets ? { assets } : {},
 		...root.authenticationProtocolVersion === 1 ? { authenticationProtocolVersion: 1 } : {},
@@ -203,5 +205,4 @@ function sha256(value, name) {
 	if (typeof value !== "string" || !SHA256_PATTERN.test(value)) throw new Error(`${name} must be a lowercase SHA-256 digest`);
 	return value;
 }
-//#endregion
 export { PLATFORM_ADMIN_ASSETS_DIRECTORY, PLATFORM_ADMIN_CLIENT_ASSET_PATH, PLATFORM_ADMIN_STYLE_ASSET_PATH, getPlatformRuntimeDirectory, parsePlatformRuntimeManifest, platformDatabaseSchemaDigest, readPlatformRuntimeManifest, resolvePlatformRuntime };

package/dist/plans.d.mts

@@ -1,4 +1,3 @@
-//#region src/plans.d.ts
 /** Installation-defined plan IDs are stable even when a display name changes. */
 export type PlanId = string;
 export type BuiltinPlanId = "free" | "solo" | "pro" | "sponsored" | "custom";
@@ -73,5 +72,4 @@ export declare function parsePlanLimitsPatch(value: unknown): PlanLimitsPatch;
 export declare function validatePlanLimits(limits: PlanLimits): void;
 export declare function parseBuildInstanceType(value: unknown): BuildInstanceType;
 /** Strict saved-state validation: invalid configuration must not silently lift quotas. */
-export declare function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog;
-//#endregion
+export declare function parsePlatformPlanCatalog(value: unknown): PlatformPlanCatalog;

package/dist/plans.mjs

@@ -1,5 +1,5 @@
-import { n as isPrintableText, s as record } from "./validate-DbJR7Q0Z.mjs";
-//#region src/plans.ts
+import { n as isPrintableText, s as record } from "./validate-CTKcW3Vp.mjs";
+// src/plans.ts
 const GB = 1073741824;
 const PLAN_LIMITS = {
 	free: {
@@ -199,5 +199,4 @@ function parsePlatformPlanCatalog(value) {
 		reconciliation
 	};
 }
-//#endregion
 export { BUILD_INSTANCE_FREE, BUILD_INSTANCE_LARGE, PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, createDefaultPlanCatalog, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanCatalog, parsePlatformPlanId, validatePlanLimits };