void 0.10.12 → 0.20.0

package/dist/platform-management-W30iCaTL.mjs

@@ -0,0 +1,698 @@
+import { $ as resolveInstallationManifest, D as log, F as isCancel, O as note, Q as removePlatformConnectionForInstallation, U as listInstallationManifests, Y as readInstallationRecoverySecrets, Z as removeInstallationRecoverySecrets, i as createSpinner, j as select, k as outro, nt as writeInstallationManifest, w as confirm, z as acquirePlatformLifecycleLock } from "./output-tFQLLj26.mjs";
+import { S as resolvePlatformCloudflareCredential, _ as hyperdriveOriginConfigHash, a as installPlatform, assertNoninteractivePlatformMutationAcknowledged, b as verifyPlatformRuntimeTokenPermissions, c as resolveBootstrapGitHubId, d as createPlatformInstallPlan, f as formatPlatformInstallPlan, g as PlatformCloudflareClient, h as revalidatePlatformInstallAction, i as createPlatformInstallationSecrets, m as platformProvisionIntentHash, n as acquirePlatformDatabaseLifecycleLock, o as loadPlatformRuntime, p as platformAdoptionIntentHash, resolvePlatformInstallDatabaseUrl, t as REMOTE_INSTALLATION_MANIFEST_KEY, u as trackedPlatformWorkerTraffic, v as hyperdriveOriginFromConnectionString, x as assertPlatformOperatorCredentialCanApplyPlan, y as hyperdriveOriginMatches } from "./platform-lifecycle-CjSr6xf0.mjs";
+import { createHash } from "node:crypto";
+import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
+//#region src/cli/platform-management.ts
+async function verifyPlatformInstallationOwnership(client, manifest, options = {}) {
+	const ready = manifest.resources.filter((resource) => resource.state === "ready" && isOwnershipVerifiableKind(resource.kind) && !options.retainedReplacementKeys?.has(resource.key));
+	if (!ready.find((resource) => resource.key === "routing-kv")) {
+		const unsafe = ready.filter((resource) => resource.kind !== "zone");
+		if (unsafe.length > 0) throw ownershipError(`the remote installation checkpoint is missing for ${unsafe[0].kind} ${unsafe[0].name}`);
+		const zone = ready.find((resource) => resource.kind === "zone");
+		if (zone) {
+			if ((await client.findZone(manifest.account.id, zone.name))?.id !== zone.id) throw ownershipError(`zone ${zone.name} was replaced`);
+		}
+		return;
+	}
+	await verifyPlatformMutationOwnership(client, manifest, new Set(ready.map((resource) => resource.key)), options);
+}
+function selectAuthoritativePlatformManifest(local, authoritative) {
+	if (!authoritative) return local;
+	if (authoritative.id !== local.id || authoritative.ownershipNonce !== local.ownershipNonce || authoritative.account.id !== local.account.id) throw new Error("platform: The authoritative lifecycle state belongs to another installation.");
+	return authoritative;
+}
+async function runInstalledPlatformCommand(args) {
+	if (args.subcommand !== "upgrade" && args.subcommand !== "rollback" && args.subcommand !== "repair" && args.subcommand !== "disable" && args.subcommand !== "enable" && args.subcommand !== "uninstall") throw new Error(`platform: Unsupported lifecycle command ${args.subcommand}.`);
+	assertNoninteractivePlatformMutationAcknowledged(args, process.stdin.isTTY === true);
+	const manifest = await resolveInstalledPlatformManifest(args.selector);
+	const operatorCredential = await resolvePlatformCloudflareCredential();
+	const operatorClient = new PlatformCloudflareClient(operatorCredential.token);
+	const runtime = args.subcommand === "uninstall" || args.subcommand === "disable" ? null : loadPlatformRuntime(args.runtime);
+	const rollbackSourceRuntime = args.subcommand === "rollback" ? loadPlatformRuntime(args.fromRuntime) : null;
+	let progress;
+	let reportResult;
+	const execute = async (currentManifest, databaseLock, databaseCheckpointExists = false) => {
+		const manifest = currentManifest;
+		if (args.subcommand === "rollback") assertPlatformRollbackCompatibility(manifest, runtime, rollbackSourceRuntime);
+		const recovery = readInstallationRecoverySecrets(manifest);
+		const gatewayToken = process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN || recovery?.cloudflareApiToken;
+		const client = operatorCredential.source === "oauth" && gatewayToken ? operatorClient.withAiGatewayToken(gatewayToken) : operatorClient;
+		const databaseUrl = resolvePlatformInstallDatabaseUrl(recovery, manifest);
+		if (args.subcommand === "disable") {
+			await disablePlatform(client, manifest, args.plan, {
+				checkpoint: databaseLock?.checkpoint,
+				databaseUrl
+			});
+			return;
+		}
+		if (args.subcommand === "uninstall") {
+			await uninstallPlatform(client, manifest, args, {
+				checkpoint: databaseLock?.checkpoint,
+				databaseUrl
+			});
+			return;
+		}
+		if (args.subcommand === "enable" && manifest.desiredState === "enabled" && manifest.status === "installed") {
+			log.info(`${manifest.deployment.displayName} is already enabled.`);
+			return;
+		}
+		const deployment = manifest.deployment;
+		const planInput = {
+			accountId: manifest.account.id,
+			applicationDomain: deployment.application.baseDomain,
+			controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
+			dedicatedZone: deployment.application.dedicatedZone,
+			displayName: deployment.displayName,
+			installationSlug: deployment.installationSlug,
+			zoneName: deployment.application.zoneName
+		};
+		const plan = await createPlatformInstallPlan(client, planInput, manifest, {
+			authoritativeProvisionIntents: databaseCheckpointExists,
+			repairMissing: args.subcommand === "repair",
+			allowUnverifiedAiGateway: args.plan
+		});
+		note(formatPlatformInstallPlan(plan), args.subcommand === "upgrade" ? "Upgrade plan" : args.subcommand === "rollback" ? "Rollback plan" : args.subcommand === "enable" ? "Enable plan" : "Repair plan");
+		note([
+			`Version: ${runtime.manifest.platformVersion}`,
+			`Source: ${runtime.source}`,
+			`Revision: ${runtime.manifest.sourceRevision ?? "not recorded"}`,
+			`Manifest SHA-256: ${runtime.manifestSha256}`
+		].join("\n"), "Platform runtime");
+		if (args.plan) {
+			outro("No Cloudflare or local installation state was changed.");
+			return;
+		}
+		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
+		progress = createSpinner({ onCancel: () => {
+			if (!process.emit("SIGINT")) process.exit(130);
+		} });
+		progress.start(args.subcommand === "upgrade" ? "Upgrading the platform" : args.subcommand === "rollback" ? "Rolling back the platform" : args.subcommand === "enable" ? "Enabling the platform" : "Repairing the platform");
+		const repairingMissingRoutingCheckpoint = args.subcommand === "repair" && plan.actions.some((action) => action.key === "routing-kv" && action.action === "create" && action.id === null);
+		await verifyPlatformMutationOwnership(client, manifest, new Set(manifest.resources.filter((resource) => isOwnershipVerifiableKind(resource.kind) && !plan.actions.some((action) => action.key === resource.key && action.action === "create" && action.name !== resource.name)).map((resource) => resource.key)), {
+			allowMissingRoutingCheckpoint: repairingMissingRoutingCheckpoint,
+			allowUninitializedRoutingCheckpoint: args.subcommand === "repair" && databaseCheckpointExists,
+			databaseUrl
+		});
+		const installation = args.subcommand === "enable" ? setInstallationDesiredState(manifest, "enabled", (/* @__PURE__ */ new Date()).toISOString()) : manifest;
+		if (installation !== manifest) writeInstallationManifest(installation);
+		const bootstrapGitHubLogin = process.env.VOID_PLATFORM_ADMIN_GITHUB_LOGIN || recovery?.bootstrapGitHubLogin || "";
+		const bootstrapGitHubId = process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || recovery?.bootstrapGitHubId || (bootstrapGitHubLogin ? await resolveBootstrapGitHubId(bootstrapGitHubLogin) : "");
+		const secrets = createPlatformInstallationSecrets({
+			bootstrapGitHubId,
+			bootstrapGitHubLogin,
+			cloudflareApiToken: process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN || "",
+			checkpoint: recovery,
+			databaseUrl,
+			existingInstallation: true,
+			updateExistingWorkers: true,
+			githubClientId: process.env.VOID_PLATFORM_GITHUB_CLIENT_ID || "",
+			githubClientSecret: process.env.VOID_PLATFORM_GITHUB_CLIENT_SECRET || "",
+			jwtSecret: process.env.VOID_PLATFORM_JWT_SECRET || "",
+			projectSecretKey: process.env.VOID_PLATFORM_PROJECT_SECRET_KEY || "",
+			projectSecretKeysJson: process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || "",
+			projectSecretActiveKeyVersion: process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION || "",
+			r2AccessKeyId: process.env.VOID_PLATFORM_R2_ACCESS_KEY_ID || "",
+			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || ""
+		});
+		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets);
+		if (runtimeTokenToPreflight) await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(runtimeTokenToPreflight), {
+			accountId: manifest.account.id,
+			applicationDomain: deployment.application.baseDomain,
+			customDomains: plan.deployment.capabilities.customDomains,
+			zoneId: plan.zone?.id ?? null
+		});
+		const result = await installPlatform(plan, secrets, installation, {
+			acquireDatabaseLifecycleLock: async () => Object.assign(async () => {}, {
+				checkpoint: databaseLock?.checkpoint,
+				prepareDatabase: databaseLock?.prepareDatabase,
+				prepareSandboxDrain: databaseLock?.prepareSandboxDrain,
+				requiredSafetyProtocols: databaseLock?.requiredSafetyProtocols,
+				verifyDatabase: databaseLock?.verifyDatabase
+			}),
+			client,
+			databaseRollbackSource: rollbackSourceRuntime ?? void 0,
+			onProgress: (message) => progress?.message(message),
+			runtime,
+			replanWorkers: async (recoveryManifest) => (await createPlatformInstallPlan(client, planInput, recoveryManifest, {
+				authoritativeProvisionIntents: true,
+				repairMissing: true
+			})).actions.filter((action) => action.kind === "worker"),
+			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action, { repairMissing: args.subcommand === "repair" })
+		});
+		progress.message("Finalizing platform changes");
+		reportResult = () => {
+			progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Platform operation paused; progress is saved." : `Platform ${args.subcommand} complete.`);
+			progress = void 0;
+			if (result.waitingForDns) {
+				note(`Wait for ${deployment.application.zoneName} to become active, then rerun this command.`, "Waiting for nameservers");
+				return;
+			}
+			if (result.waitingForSandboxDrain) {
+				note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`; follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this lifecycle command afterward to enable traffic.", "Waiting for managed Sandbox drain");
+				return;
+			}
+			log.success(args.subcommand === "rollback" ? `${deployment.displayName} is running compatible runtime ${runtime.manifest.platformVersion}; PostgreSQL remains at schema ${rollbackSourceRuntime.manifest.database.schemaDigest}.` : `${deployment.displayName} is healthy at ${plan.apiUrl}.`);
+		};
+	};
+	if (args.plan) {
+		await execute(manifest);
+		return;
+	}
+	const release = acquirePlatformLifecycleLock(manifest.account.id, manifest.deployment.installationSlug);
+	try {
+		const current = resolveInstallationManifest(manifest.id);
+		const recovery = readInstallationRecoverySecrets(current);
+		const databaseUrl = resolvePlatformInstallDatabaseUrl(recovery, current);
+		if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to safely serialize lifecycle changes across hosts.");
+		const releaseDatabase = await acquirePlatformDatabaseLifecycleLock(databaseUrl, current.id, current.ownershipNonce);
+		try {
+			const authoritative = releaseDatabase.authoritativeManifest;
+			const databaseCheckpointExists = authoritative !== null && authoritative !== void 0;
+			const currentManifest = selectAuthoritativePlatformManifest(current, authoritative);
+			if (authoritative && JSON.stringify(authoritative) !== JSON.stringify(current)) writeInstallationManifest(authoritative);
+			if (!authoritative) await releaseDatabase.checkpoint?.(currentManifest);
+			await execute(currentManifest, releaseDatabase, databaseCheckpointExists);
+		} finally {
+			await releaseDatabase();
+		}
+		reportResult?.();
+	} catch (error) {
+		progress?.error(`Platform ${args.subcommand} failed.`);
+		progress = void 0;
+		throw error;
+	} finally {
+		try {
+			progress?.clear();
+		} finally {
+			release();
+		}
+	}
+}
+function assertPlatformRollbackCompatibility(installation, target, source) {
+	if (!installation.runtime) throw new Error("platform: The installed runtime has no artifact provenance, so post-success rollback cannot identify its compatibility manifest.");
+	if (source.manifest.platformVersion !== installation.platformVersion || source.manifestSha256 !== installation.runtime.manifestSha256) throw new Error("platform: --from-runtime does not exactly match the installed runtime artifact digest. Supply the runtime used by the current successful deployment.");
+	if (target.manifestSha256 === source.manifestSha256) throw new Error("platform: The rollback target is already the installed runtime artifact.");
+	if (target.manifest.database.lineage !== source.manifest.database.lineage) throw new Error("platform: The rollback target belongs to a different database lineage.");
+	const prefix = source.manifest.database.migrations.slice(0, target.manifest.database.migrations.length);
+	if (JSON.stringify(prefix) !== JSON.stringify(target.manifest.database.migrations)) throw new Error("platform: The rollback target database migrations are not an exact prefix of the installed runtime.");
+	if (!source.manifest.database.rollbackSafeFrom.some((entry) => entry.platformVersion === target.manifest.platformVersion && entry.schemaDigest === target.manifest.database.schemaDigest)) throw new Error(`platform: Installed runtime ${source.manifest.platformVersion} does not declare post-success rollback compatibility with ${target.manifest.platformVersion} at schema ${target.manifest.database.schemaDigest}.`);
+	if (installation.databaseSchemaDigest !== source.manifest.database.schemaDigest) throw new Error("platform: The authoritative installation checkpoint does not record the installed runtime database schema. Repair or roll forward before rollback.");
+	if ((target.manifest.safetyProtocols?.sandboxDrain ?? 0) < (installation.safetyProtocols?.sandboxDrain ?? 0)) throw new Error("platform: The rollback target predates the installed sandbox-drain safety protocol.");
+}
+function resolvePlatformRuntimeTokenToPreflight(plan, secrets) {
+	const explicitUpdate = secrets.workerSecretUpdates?.CF_API_TOKEN;
+	if (explicitUpdate) return explicitUpdate;
+	return plan.actions.some((action) => action.kind === "worker" && action.action === "create") ? secrets.cloudflareApiToken : "";
+}
+async function resolveInstalledPlatformManifest(selector, dependencies = {}) {
+	if (selector) return resolveInstallationManifest(selector);
+	const manifests = listInstallationManifests().filter((manifest) => manifest.status !== "uninstalled");
+	if (manifests.length <= 1) return resolveInstallationManifest("");
+	if (!(dependencies.interactive ?? process.stdin.isTTY)) throw new Error("platform: Multiple local installations exist; specify an installation id.");
+	const picked = dependencies.selectInstallation ? await dependencies.selectInstallation(manifests) : await select({
+		message: "Select an installed Void platform:",
+		options: manifests.map((manifest) => ({
+			hint: `${manifest.account.name} · ${manifest.id}`,
+			label: manifest.deployment.displayName,
+			value: manifest.id
+		}))
+	});
+	if (isCancel(picked)) throw new Error("platform: Cancelled.");
+	return resolveInstallationManifest(String(picked));
+}
+async function disablePlatform(client, initialManifest, planOnly, dependencies = {}) {
+	const reconciled = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
+	const writeLifecycleCheckpoint = (checkpointClient, checkpointManifest) => writeLifecycleCheckpointWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
+	const writeRemoteManifestIfPresent = (checkpointClient, checkpointManifest) => writeRemoteManifestIfPresentWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
+	note("Block platform traffic through installation-owned routing storage. Retain routes and custom domains for explicit dashboard cleanup because Cloudflare cannot condition their deletion on an immutable generation. Workers and all data remain installed.", "Disable plan");
+	if (planOnly) {
+		outro("No Cloudflare or local installation state was changed.");
+		return;
+	}
+	const manifest = reconciled;
+	if (manifest !== initialManifest) writeInstallationManifest(manifest);
+	const alreadyDisabled = manifest.status === "disabled";
+	const missing = await verifyPlatformMutationOwnership(client, manifest, /* @__PURE__ */ new Set([
+		"routing-kv",
+		"zone",
+		...manifest.resources.filter((resource) => resource.kind === "worker").map((resource) => resource.key)
+	]), { databaseUrl: dependencies.databaseUrl });
+	let next = setInstallationDesiredState(manifest, "disabled", (/* @__PURE__ */ new Date()).toISOString());
+	writeInstallationManifest(next);
+	if (!alreadyDisabled) {
+		next = transitionInstallation(next, "disabling", (/* @__PURE__ */ new Date()).toISOString());
+		writeInstallationManifest(next);
+	}
+	try {
+		await writeRemoteManifestIfPresent(client, next);
+		const zone = next.resources.find((resource) => resource.key === "zone");
+		const routing = requireResource(next, "routing-kv");
+		const trafficGeneration = currentTrafficGeneration(next);
+		await client.putKvValue(next.account.id, routing.id, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+		const trackedTraffic = trackedPlatformWorkerTraffic(next);
+		await client.removeRoutes(next.account.id, !zone || missing.has(zone.key) ? null : zone.id, trackedTraffic);
+		next = markTrafficAttachmentsRetained(next);
+		if (!hasLifecycleStep(next, `disable:${trafficGeneration}:routes`)) next = recordLifecycleStep(next, `disable:${trafficGeneration}:routes`);
+		await writeLifecycleCheckpoint(client, next);
+		next = transitionInstallation(next, "disabled", (/* @__PURE__ */ new Date()).toISOString());
+		await writeLifecycleCheckpoint(client, next);
+		log.success(`${next.deployment.displayName} is disabled. Its data was not changed.`);
+	} catch (error) {
+		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
+		writeInstallationManifest(next);
+		await writeRemoteManifestIfPresent(client, next).catch(() => {});
+		throw error;
+	}
+}
+async function uninstallPlatform(client, initialManifest, args, dependencies = {}) {
+	const manifest = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
+	const writeLifecycleCheckpoint = (checkpointClient, checkpointManifest) => writeLifecycleCheckpointWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
+	const writeRemoteManifestIfPresent = (checkpointClient, checkpointManifest) => writeRemoteManifestIfPresentWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
+	const retainData = !args.purgeData;
+	const hasRoutingCheckpoint = manifest.resources.some((resource) => resource.key === "routing-kv" && resource.state === "ready");
+	const createdZone = manifest.resources.find((resource) => resource.key === "zone" && resource.ownership === "created");
+	const interactive = dependencies.interactive ?? process.stdin.isTTY;
+	const confirmAction = dependencies.confirm ?? promptForConfirmation;
+	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
+	const dataMessage = retainData ? "Retain installer-owned Workers, storage, dispatch, AI logs, and Hyperdrive by default." : args.purgeData ? "Delete safely identifiable installer-owned data (--purge-data); retain Workers, R2, AI Gateway, and external PostgreSQL for manual cleanup." : "Retain installer-owned data; external PostgreSQL is never deleted.";
+	note(`Disable all platform traffic through installation-owned routing storage.\nRetain DNS records, routes, and custom domains for explicit dashboard cleanup.\nDelete installer-owned Queues.\n${dataMessage}\n${createdZone ? `Keep zone ${createdZone.name} for explicit manual cleanup.` : "Never delete the adopted application zone."}`, "Uninstall plan");
+	if (args.plan) {
+		outro("No Cloudflare or local installation state was changed.");
+		return;
+	}
+	if (manifest !== initialManifest) writeInstallationManifest(manifest);
+	if (!interactive && !args.yes) throw new Error("platform: Non-interactive `void platform uninstall` requires --yes to acknowledge Cloudflare changes. Run with --plan first to inspect them.");
+	if (interactive && !args.yes) {
+		if (!await confirmAction(args.purgeData ? "Permanently purge installer-owned platform data?" : "Uninstall this platform?", false)) {
+			outro("No changes made.");
+			return;
+		}
+	}
+	const resourcesToDelete = new Set(manifest.resources.filter((resource) => shouldDeleteResource(resource, retainData) && (hasRoutingCheckpoint || resource.kind === "zone") && !(resource.kind === "dns-record" && !manifest.resources.some((entry) => entry.key === "zone"))).map((resource) => resource.key));
+	const ownershipTargets = /* @__PURE__ */ new Set([
+		...hasRoutingCheckpoint ? ["routing-kv"] : [],
+		"zone",
+		...manifest.resources.filter((resource) => resource.kind === "worker").map((resource) => resource.key),
+		...resourcesToDelete
+	]);
+	let missingResources;
+	if (hasRoutingCheckpoint) missingResources = await verifyPlatformMutationOwnership(client, manifest, ownershipTargets, {
+		allowDeletedRoutingCheckpoint: args.purgeData,
+		databaseUrl: dependencies.databaseUrl
+	});
+	else {
+		await verifyPlatformInstallationOwnership(client, manifest, { databaseUrl: dependencies.databaseUrl });
+		missingResources = /* @__PURE__ */ new Set();
+	}
+	let next = transitionInstallation(manifest, "uninstalling", (/* @__PURE__ */ new Date()).toISOString());
+	writeInstallationManifest(next);
+	try {
+		await writeRemoteManifestIfPresent(client, next);
+		const routing = next.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready");
+		if (routing) await client.putKvValue(next.account.id, routing.id, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+		for (const key of missingResources) {
+			const resource = requireResource(next, key);
+			next = updateResourceState(next, key, resource.ownership === "created" ? "deleted" : "retained");
+			await writeLifecycleCheckpoint(client, next);
+		}
+		const workers = new Set(next.resources.filter((resource) => resource.kind === "worker" && resource.state === "ready").map((resource) => resource.name));
+		const zone = next.resources.find((resource) => resource.key === "zone");
+		if (zone?.state === "ready") {
+			for (const worker of next.resources.filter((resource) => resource.kind === "worker" && resource.state === "ready" && workers.has(resource.name))) if (!(await verifyPlatformMutationOwnership(client, next, /* @__PURE__ */ new Set([
+				"routing-kv",
+				"zone",
+				worker.key
+			]), { databaseUrl: dependencies.databaseUrl })).has(worker.key)) {
+				const trackedTraffic = trackedPlatformWorkerTraffic(next, /* @__PURE__ */ new Set([worker.name]));
+				await client.removeRoutes(next.account.id, zone.id, trackedTraffic);
+				next = markTrafficAttachmentsRetained(next);
+				next = recordLifecycleStep(next, `uninstall:routes:${worker.key}`);
+				await writeLifecycleCheckpoint(client, next);
+			}
+		}
+		const deletionPriority = {
+			worker: 0,
+			queue: 1,
+			"ai-gateway": 2,
+			"dns-record": 3,
+			"dispatch-namespace": 4,
+			hyperdrive: 5,
+			"kv-namespace": 6,
+			"r2-bucket": 7,
+			zone: 8
+		};
+		const resources = [...next.resources].sort((left, right) => resourceDeletionPriority(left, deletionPriority) - resourceDeletionPriority(right, deletionPriority));
+		for (const resource of resources) {
+			if (resource.state !== "ready") continue;
+			if (!hasRoutingCheckpoint && resource.kind !== "zone") {
+				next = updateResourceState(next, resource.key, "retained");
+				await writeLifecycleCheckpoint(client, next);
+				continue;
+			}
+			if (!shouldDeleteResource(resource, retainData)) {
+				next = updateResourceState(next, resource.key, "retained");
+				await writeLifecycleCheckpoint(client, next);
+				continue;
+			}
+			if (resource.kind === "dns-record" && !zone) {
+				next = updateResourceState(next, resource.key, "retained");
+				await writeLifecycleCheckpoint(client, next);
+				continue;
+			}
+			if ((await verifyPlatformMutationOwnership(client, next, /* @__PURE__ */ new Set(["routing-kv", resource.key]), {
+				allowDeletedRoutingCheckpoint: args.purgeData,
+				databaseUrl: dependencies.databaseUrl
+			})).has(resource.key)) {
+				next = updateResourceState(next, resource.key, resource.ownership === "created" ? "deleted" : "retained");
+				await writeLifecycleCheckpoint(client, next);
+				continue;
+			}
+			await client.deleteResource(next.account.id, resource.kind, resource.id, zone?.id);
+			next = updateResourceState(next, resource.key, "deleted");
+			await writeLifecycleCheckpoint(client, next);
+		}
+		const completed = transitionInstallation(next, "uninstalled", (/* @__PURE__ */ new Date()).toISOString());
+		await writeRemoteManifestIfPresent(client, completed);
+		next = completed;
+		writeInstallationManifest(completed);
+		if (!retainData) removeInstallationRecoverySecrets(next);
+		removePlatformConnectionForInstallation(next.id);
+		log.success(retainData ? `${next.deployment.displayName} was uninstalled; data resources were retained and recorded in ${next.id}.` : `${next.deployment.displayName} was uninstalled.`);
+	} catch (error) {
+		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
+		writeInstallationManifest(next);
+		await writeRemoteManifestIfPresent(client, next).catch(() => {});
+		throw error;
+	}
+}
+async function recoverDurablyMarkedProvisionIntents(client, manifest) {
+	const pending = [
+		[
+			"api-worker",
+			"worker",
+			manifest.deployment.resources.apiWorker
+		],
+		[
+			"proxy-worker",
+			"worker",
+			manifest.deployment.resources.proxyWorker
+		],
+		[
+			"tail-worker",
+			"worker",
+			manifest.deployment.resources.tailWorker
+		],
+		[
+			"dispatch-worker",
+			"worker",
+			manifest.deployment.resources.dispatchWorker
+		],
+		[
+			"assets-bucket",
+			"r2-bucket",
+			manifest.deployment.resources.assetsBucket
+		]
+	].filter(([key, kind, name]) => !manifest.resources.some((resource) => resource.key === key) && manifest.steps.some((step) => (step.key === `provision-intent:${key}` || step.key.startsWith(`provision-intent:${key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name)));
+	if (pending.length === 0) return manifest;
+	const [workers, buckets] = await Promise.all([client.listWorkerNames(manifest.account.id), client.listR2Buckets(manifest.account.id)]);
+	let recovered = manifest;
+	for (const [key, kind, name] of pending) {
+		const live = kind === "worker" ? workers.includes(name) ? {
+			id: name,
+			name
+		} : null : buckets.find((bucket) => bucket.name === name) ?? null;
+		if (!live) continue;
+		const resource = {
+			configHash: createHash("sha256").update(JSON.stringify({
+				kind,
+				name
+			})).digest("hex"),
+			id: live.id,
+			key,
+			kind,
+			name,
+			ownership: "created",
+			state: "ready"
+		};
+		verifyResourceMarker(kind === "worker" ? (await client.getWorkerPlainTextBindings(manifest.account.id, name)).PLATFORM_OWNERSHIP_MARKER : await client.getR2Object(manifest.account.id, name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), manifest, resource);
+		recovered = recordInstallationResource(recovered, resource, manifest.updatedAt);
+	}
+	return recovered;
+}
+const DATA_RESOURCE_KINDS = /* @__PURE__ */ new Set([
+	"ai-gateway",
+	"dispatch-namespace",
+	"hyperdrive",
+	"kv-namespace",
+	"r2-bucket"
+]);
+function isOwnershipVerifiableKind(kind) {
+	return kind === "ai-gateway" || kind === "dispatch-namespace" || kind === "dns-record" || kind === "hyperdrive" || kind === "kv-namespace" || kind === "queue" || kind === "r2-bucket" || kind === "worker" || kind === "zone";
+}
+function shouldDeleteResource(resource, retainData) {
+	if (resource.state !== "ready" || resource.ownership !== "created") return false;
+	if (resource.kind === "zone") return false;
+	if (resource.kind === "ai-gateway") return false;
+	if (resource.kind === "dns-record") return false;
+	if (resource.kind === "r2-bucket") return false;
+	if (resource.kind === "worker") return false;
+	if (resource.kind === "worker-route" || resource.kind === "worker-custom-domain") return false;
+	return !(retainData && DATA_RESOURCE_KINDS.has(resource.kind));
+}
+function resourceDeletionPriority(resource, priorities) {
+	return resource.key === "routing-kv" ? 100 : priorities[resource.kind] ?? 99;
+}
+async function verifyPlatformMutationOwnership(client, manifest, targetKeys, options = {}) {
+	const routing = requireResource(manifest, "routing-kv");
+	const targetResources = manifest.resources.filter((resource) => targetKeys.has(resource.key) && resource.state === "ready");
+	let rawRemote = null;
+	let remote = null;
+	let replacingMissingRoutingCheckpoint = false;
+	for (let attempt = 0; attempt < 3; attempt++) {
+		rawRemote = await client.getKvValue(manifest.account.id, routing.id, REMOTE_INSTALLATION_MANIFEST_KEY);
+		if (rawRemote !== null) {
+			try {
+				remote = parsePlatformInstallationManifest(JSON.parse(rawRemote));
+			} catch {
+				throw ownershipError("the remote installation checkpoint is invalid");
+			}
+			if (remote.id !== manifest.id || remote.ownershipNonce !== manifest.ownershipNonce || remote.account.id !== manifest.account.id) throw ownershipError("the remote installation identity does not match this installation");
+			if (targetResources.every((resource) => hasMatchingResourceProof(remote, resource))) break;
+		}
+		if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 50 * 2 ** attempt));
+	}
+	if (rawRemote === null) {
+		if ((options.allowMissingRoutingCheckpoint || options.allowUninitializedRoutingCheckpoint) && routing.ownership === "created") {
+			const namespaces = await client.listKvNamespaces(manifest.account.id);
+			const routingMatches = namespaces.some((entry) => entry.id === routing.id && entry.name === routing.name);
+			const routingIdentityCollides = namespaces.some((entry) => entry.id === routing.id || entry.name === routing.name);
+			if (options.allowMissingRoutingCheckpoint && !routingIdentityCollides || options.allowUninitializedRoutingCheckpoint && routingMatches) {
+				remote = manifest;
+				replacingMissingRoutingCheckpoint = true;
+			}
+		}
+		if (!replacingMissingRoutingCheckpoint && options.allowDeletedRoutingCheckpoint && canResumeAfterRoutingCheckpointDeletion(manifest, targetKeys)) {
+			if (!(await client.listKvNamespaces(manifest.account.id)).some((entry) => entry.id === routing.id)) return /* @__PURE__ */ new Set([routing.key]);
+		}
+		if (!replacingMissingRoutingCheckpoint) throw ownershipError("the remote installation checkpoint is missing");
+	}
+	if (!remote) throw ownershipError("the remote installation checkpoint is missing");
+	const localAdvancesRemote = isPlatformManifestMonotonicExtension(remote, manifest);
+	for (const resource of targetResources) {
+		const proof = remote.resources.find((entry) => entry.key === resource.key);
+		if (!hasMatchingResourceProof(remote, resource)) {
+			if (!proof && localAdvancesRemote && resource.kind !== "ai-gateway" && hasMatchingResourceIntent(remote, resource)) continue;
+			throw ownershipError(`the remote checkpoint does not own ${resource.kind} ${resource.name}`);
+		}
+	}
+	const missing = new Set(replacingMissingRoutingCheckpoint ? [routing.key] : []);
+	const accountId = manifest.account.id;
+	const zone = manifest.resources.find((resource) => resource.key === "zone");
+	const [aiGateways, dispatchNamespaces, hyperdrives, kvNamespaces, r2Buckets, workerNames] = await Promise.all([
+		client.listAiGateways(accountId),
+		client.listDispatchNamespaces(accountId),
+		client.listHyperdriveConfigs(accountId),
+		client.listKvNamespaces(accountId),
+		client.listR2Buckets(accountId),
+		client.listWorkerNames(accountId)
+	]);
+	for (const resource of targetResources) {
+		let exists = true;
+		if (resource.kind === "ai-gateway") exists = hasNamedResource(aiGateways, resource);
+		else if (resource.kind === "dispatch-namespace") exists = hasNamedResource(dispatchNamespaces, resource);
+		else if (resource.kind === "hyperdrive") {
+			exists = hasNamedResource(hyperdrives, resource);
+			if (exists) {
+				const live = await client.getHyperdriveConfig(accountId, resource.id);
+				exists = live.id === resource.id && live.name === resource.name;
+				if (exists) {
+					const legacyHash = createHash("sha256").update(JSON.stringify({
+						kind: resource.kind,
+						name: resource.name
+					})).digest("hex");
+					const malformedLegacyHash = !/^[a-f0-9]{64}$/.test(resource.configHash);
+					if (options.databaseUrl) {
+						const expected = hyperdriveOriginFromConnectionString(options.databaseUrl);
+						if (!hyperdriveOriginMatches(live.origin, expected)) throw ownershipError(`hyperdrive ${resource.name} targets a different PostgreSQL origin than this installation's pinned database`);
+						const expectedHash = hyperdriveOriginConfigHash(expected);
+						if (resource.configHash !== expectedHash && resource.configHash !== legacyHash && !malformedLegacyHash) throw ownershipError(`hyperdrive ${resource.name} does not match the installation's database fingerprint`);
+					} else if (resource.configHash !== hyperdriveOriginConfigHash(live.origin) && resource.configHash !== legacyHash && !malformedLegacyHash) throw ownershipError(`hyperdrive ${resource.name} changed configuration`);
+				}
+			}
+		} else if (resource.kind === "kv-namespace") exists = hasNamedResource(kvNamespaces, resource);
+		else if (resource.kind === "queue") exists = hasNamedResource(await client.listQueues(accountId, resource.name), resource);
+		else if (resource.kind === "zone") exists = (await client.findZone(accountId, resource.name))?.id === resource.id;
+		else if (resource.kind === "dns-record") {
+			if (!zone) exists = false;
+			else {
+				const current = (await client.listDnsRecords(zone.id, resource.name)).find((entry) => entry.id === resource.id && entry.name === resource.name);
+				exists = current !== void 0;
+				if (current && resource.ownership === "created") {
+					const liveHash = dnsRecordConfigHash(current.name, current.type, current.content, current.proxied);
+					const legacyHash = createHash("sha256").update(JSON.stringify({
+						kind: resource.kind,
+						name: resource.name
+					})).digest("hex");
+					const expectedHash = dnsRecordConfigHash(resource.name, "AAAA", "100::", true);
+					if (liveHash !== resource.configHash && !(resource.configHash === legacyHash && liveHash === expectedHash)) throw ownershipError(`dns-record ${resource.name} changed configuration after installation`);
+				}
+			}
+		} else if (resource.kind === "worker") {
+			exists = workerNames.includes(resource.name);
+			if (exists) verifyResourceMarker((await client.getWorkerPlainTextBindings(accountId, resource.name)).PLATFORM_OWNERSHIP_MARKER, manifest, resource);
+		} else if (resource.kind === "r2-bucket") {
+			const live = r2Buckets.find((entry) => entry.id === resource.id && entry.name === resource.name);
+			exists = live !== void 0;
+			if (live) {
+				const liveHash = live.fingerprint ? r2BucketConfigHash(resource.name, live.fingerprint) : null;
+				const legacyHash = createHash("sha256").update(JSON.stringify({
+					kind: resource.kind,
+					name: resource.name
+				})).digest("hex");
+				if (liveHash === null || resource.configHash !== liveHash && resource.configHash !== legacyHash) throw ownershipError(`r2-bucket ${resource.name} changed creation fingerprint`);
+				verifyResourceMarker(await client.getR2Object(accountId, resource.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), manifest, resource);
+			}
+		} else throw ownershipError(`live ownership checks do not support ${resource.kind}`);
+		if (!exists) missing.add(resource.key);
+	}
+	return missing;
+}
+function hasMatchingResourceProof(manifest, resource) {
+	const proof = manifest.resources.find((entry) => entry.key === resource.key);
+	return proof?.id === resource.id && proof.kind === resource.kind && proof.name === resource.name && proof.ownership === resource.ownership;
+}
+function hasMatchingResourceIntent(manifest, resource) {
+	if (resource.ownership === "created") {
+		const previousResourceId = manifest.resources.find((entry) => entry.key === resource.key)?.id ?? null;
+		return manifest.steps.some((step) => (step.key === `provision-intent:${resource.key}` || step.key.startsWith(`provision-intent:${resource.key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, resource.key, resource.kind, resource.name, previousResourceId));
+	}
+	if (resource.ownership === "adopted") return manifest.steps.some((step) => step.key === `adoption-intent:${resource.key}` && step.resultHash === platformAdoptionIntentHash(manifest, resource.key, resource.kind, resource.id, resource.name));
+	return false;
+}
+function isPlatformManifestMonotonicExtension(earlier, later) {
+	if (earlier.id !== later.id || earlier.ownershipNonce !== later.ownershipNonce || earlier.account.id !== later.account.id || earlier.createdAt !== later.createdAt || JSON.stringify(earlier.deployment) !== JSON.stringify(later.deployment) || Date.parse(later.updatedAt) < Date.parse(earlier.updatedAt)) return false;
+	const resourcesAdvance = earlier.resources.every((resource) => {
+		const next = later.resources.find((entry) => entry.key === resource.key);
+		return next?.id === resource.id && next.kind === resource.kind && next.name === resource.name && next.ownership === resource.ownership && (next.state === resource.state || resource.state === "ready" && (next.state === "deleted" || next.state === "retained"));
+	});
+	const stepsAdvance = earlier.steps.every((step) => later.steps.some((entry) => entry.key === step.key && entry.completedAt === step.completedAt && entry.resultHash === step.resultHash));
+	return resourcesAdvance && stepsAdvance;
+}
+function hasNamedResource(entries, resource) {
+	return entries.some((entry) => entry.id === resource.id && entry.name === resource.name);
+}
+function dnsRecordConfigHash(name, type, content, proxied) {
+	return createHash("sha256").update(JSON.stringify({
+		content,
+		kind: "dns-record",
+		name,
+		proxied,
+		type
+	})).digest("hex");
+}
+function r2BucketConfigHash(name, fingerprint) {
+	return createHash("sha256").update(JSON.stringify({
+		fingerprint,
+		kind: "r2-bucket",
+		name
+	})).digest("hex");
+}
+function verifyResourceMarker(value, manifest, resource) {
+	if (!value) throw ownershipError(`${resource.kind} ${resource.name} has no ownership marker`);
+	let actual;
+	try {
+		actual = parsePlatformResourceOwnershipMarker(JSON.parse(value));
+	} catch {
+		throw ownershipError(`${resource.kind} ${resource.name} has an invalid ownership marker`);
+	}
+	const expected = createPlatformResourceOwnershipMarker({
+		accountId: manifest.account.id,
+		installationId: manifest.id,
+		ownershipNonce: manifest.ownershipNonce,
+		resourceId: resource.id,
+		resourceKey: resource.key,
+		resourceKind: resource.kind,
+		resourceName: resource.name
+	});
+	if (JSON.stringify(actual) !== JSON.stringify(expected)) throw ownershipError(`${resource.kind} ${resource.name} belongs to another installation`);
+}
+function canResumeAfterRoutingCheckpointDeletion(manifest, targetKeys) {
+	if (manifest.status !== "failed" && manifest.status !== "uninstalling") return false;
+	return manifest.resources.every((resource) => resource.key === "routing-kv" || !targetKeys.has(resource.key) || resource.state !== "ready");
+}
+function ownershipError(reason) {
+	return /* @__PURE__ */ new Error(`platform: Refusing to change Cloudflare resources because ${reason}. Run \`void platform repair\` to restore ownership proofs before retrying.`);
+}
+function requireResource(manifest, key) {
+	const resource = manifest.resources.find((entry) => entry.key === key);
+	if (!resource) throw new Error(`platform: Installation manifest is missing ${key}.`);
+	return resource;
+}
+function updateResourceState(manifest, key, state) {
+	const resource = requireResource(manifest, key);
+	return recordInstallationResource(manifest, {
+		...resource,
+		state
+	}, (/* @__PURE__ */ new Date()).toISOString());
+}
+function markTrafficAttachmentsRetained(manifest) {
+	let next = manifest;
+	for (const resource of manifest.resources) if (resource.state === "ready" && (resource.kind === "worker-route" || resource.kind === "worker-custom-domain")) next = updateResourceState(next, resource.key, "retained");
+	return next;
+}
+function hasLifecycleStep(manifest, key) {
+	return manifest.steps.some((step) => step.key === key);
+}
+function currentTrafficGeneration(manifest) {
+	return Math.max(0, ...manifest.steps.flatMap((step) => {
+		const match = /^traffic-enabled:(\d+)$/.exec(step.key);
+		return match ? [Number(match[1])] : [];
+	}));
+}
+function recordLifecycleStep(manifest, key) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return recordInstallationStep(manifest, {
+		completedAt: now,
+		key,
+		resultHash: "completed"
+	}, now);
+}
+async function writeLifecycleCheckpointWithoutDatabase(client, manifest, databaseCheckpoint) {
+	writeInstallationManifest(manifest);
+	await writeRemoteManifestIfPresentWithoutDatabase(client, manifest, databaseCheckpoint);
+}
+async function writeRemoteManifestIfPresentWithoutDatabase(client, manifest, databaseCheckpoint) {
+	await databaseCheckpoint?.(manifest);
+	const routing = manifest.resources.find((resource) => resource.key === "routing-kv" && resource.state !== "deleted");
+	if (routing) await client.putKvValue(manifest.account.id, routing.id, REMOTE_INSTALLATION_MANIFEST_KEY, JSON.stringify(manifest));
+}
+async function promptForConfirmation(message, initialValue) {
+	const answer = await confirm({
+		message,
+		initialValue
+	});
+	if (isCancel(answer) || typeof answer === "symbol") throw new Error("platform: Cancelled.");
+	return answer;
+}
+//#endregion
+export { isPlatformManifestMonotonicExtension, recoverDurablyMarkedProvisionIntents, resolveInstalledPlatformManifest, runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };