void 0.10.13 → 0.20.1

package/dist/platform-lifecycle-DN4MzJF_.mjs

@@ -0,0 +1,4450 @@
+import { r as __toESM } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { o as join } from "./dist-BrsS7cai.mjs";
+import { $ as resolveInstallationManifest, A as password, B as assertPlatformInstallationSlugAvailable, D as log, E as intro, F as isCancel, H as latestPlatformWorkerCutoverGeneration, I as settings, J as promoteInstallationSecrets, L as u$1, M as symbol, N as text, O as note, P as CANCEL_SYMBOL, U as listInstallationManifests, X as readPendingInstallationSecrets, c as import_picocolors$1, et as savePlatformConnection, h as S_BAR_END, i as createSpinner, j as select, k as outro, m as S_BAR, n as cliCommandName, nt as writeInstallationManifest, q as platformWorkerSecretUpdateIntentState, r as cliTitle, rt as writePendingInstallationSecrets, st as require_picocolors, v as S_PASSWORD_MASK, w as confirm, z as acquirePlatformLifecycleLock } from "./output-tFQLLj26.mjs";
+import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
+import { d as openBrowser } from "./auth-W9WII-mN.mjs";
+import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
+import { l as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-B1QtTO1b.mjs";
+import { n as createDefaultRunWrangler, o as resolvePinnedApiBaseUrl } from "./provision-Blnstcm2.mjs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { execFile } from "node:child_process";
+import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
+import { createServer, request } from "node:http";
+import { request as request$1 } from "node:https";
+import { platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
+//#region src/cli/platform-auth.ts
+function assertPlatformOperatorCredentialCanApplyPlan(credential, plan) {
+	if (credential.source !== "oauth") return;
+	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
+	if (!createsZone && !writesDns) return;
+	const permissions = [...createsZone ? ["Account → Zone → Edit"] : [], ...writesDns ? ["Zone → DNS → Edit"] : []];
+	throw new Error(`platform: Cloudflare browser OAuth grants Zone Read and cannot apply the planned zone or DNS changes. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account and application zone, then rerun the command.`);
+}
+async function resolvePlatformCloudflareCredential(dependencies = {}) {
+	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
+	return credential;
+}
+/** Check saved credentials during input, but never start browser login until it succeeds. */
+async function resolvePlatformCloudflareCredentialWithInput(readInput, dependencies = {}) {
+	const controller = new AbortController();
+	const runner = dependencies.runWrangler ?? ((args) => runCloudflareAuthCommand(process.cwd(), args, controller.signal));
+	const runWrangler = (args, capture) => {
+		controller.signal.throwIfAborted();
+		return runner(args, capture);
+	};
+	const pending = readExistingCredential(dependencies, runWrangler).then((credential) => ({
+		ok: true,
+		credential
+	}), (error) => ({
+		ok: false,
+		error
+	}));
+	const cancel = () => controller.abort();
+	const assertNotCancelled = () => {
+		if (controller.signal.aborted) throw new Error("platform: Cancelled.");
+	};
+	try {
+		const input = await readInput();
+		process.once("SIGINT", cancel);
+		const result = await pending;
+		assertNotCancelled();
+		if (!result.ok) throw result.error;
+		if (result.credential) return {
+			input,
+			credential: result.credential
+		};
+		announceCloudflareLogin();
+		const login = await runWrangler(["login", "--use-keyring"], true);
+		assertNotCancelled();
+		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
+		const credential = await readWranglerOAuthCredential(runWrangler);
+		assertNotCancelled();
+		if (!credential) throw new Error("platform: Cloudflare sign-in completed without a usable OAuth credential.");
+		return {
+			input,
+			credential
+		};
+	} finally {
+		process.removeListener("SIGINT", cancel);
+		controller.abort();
+	}
+}
+async function readExistingCredential(dependencies, runWrangler) {
+	const environmentToken = process.env.CLOUDFLARE_API_TOKEN?.trim() || process.env.CF_API_TOKEN?.trim() || "";
+	if (environmentToken) return {
+		source: "environment",
+		token: environmentToken
+	};
+	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
+	if ((await runWrangler([
+		"auth",
+		"keyring",
+		"enable"
+	], true)).status !== 0) throw new Error("platform: Could not enable secure Cloudflare credential storage. Refusing to use a plaintext OAuth credential.");
+	return await readWranglerOAuthCredential(runWrangler);
+}
+async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
+	const result = await runWrangler([
+		"auth",
+		"token",
+		"--json"
+	], true);
+	if (result.status !== 0) return null;
+	try {
+		const parsed = JSON.parse(result.stdout);
+		if (parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+		return {
+			source: "oauth",
+			token: parsed.token.trim()
+		};
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/cli/platform-cloudflare.ts
+var PlatformCloudflareApiError = class extends Error {
+	status;
+	requestPath;
+	constructor(message, status, requestPath) {
+		super(message);
+		this.name = "PlatformCloudflareApiError";
+		this.status = status;
+		this.requestPath = requestPath;
+	}
+};
+var PlatformWorkerCustomDomainsChangedError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PlatformWorkerCustomDomainsChangedError";
+	}
+};
+var PlatformWorkerRoutesChangedError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PlatformWorkerRoutesChangedError";
+	}
+};
+async function verifyPlatformRuntimeTokenPermissions(client, input) {
+	try {
+		await client.listHyperdriveConfigs(input.accountId);
+	} catch (error) {
+		throw runtimeTokenPreflightError("Account → Hyperdrive → Write", error);
+	}
+	if (!input.zoneId) return;
+	const probeUrl = `https://${input.applicationDomain}/.well-known/void/runtime-token-preflight-${randomUUID()}`;
+	try {
+		await client.request(`/zones/${encodeURIComponent(input.zoneId)}/purge_cache`, {
+			body: JSON.stringify({ files: [probeUrl] }),
+			method: "POST"
+		});
+	} catch (error) {
+		throw runtimeTokenPreflightError("Zone → Cache Purge → Purge", error);
+	}
+	if (input.customDomains) try {
+		await client.request(`/zones/${encodeURIComponent(input.zoneId)}/custom_hostnames?per_page=1`);
+	} catch (error) {
+		throw runtimeTokenPreflightError("Zone → SSL and Certificates → Edit", error);
+	}
+}
+function runtimeTokenPreflightError(permission, cause) {
+	const status = cause instanceof PlatformCloudflareApiError ? cause.status : null;
+	const message = status === 401 || status === 403 ? `Cloudflare denied the runtime-token check (HTTP ${status}). Check that the token is valid, scoped to this account, and includes ${permission}.` : status === 429 ? `Cloudflare rate-limited the runtime-token check for ${permission} (HTTP 429). Retry shortly; this does not mean the token is missing a permission.` : `Could not complete the runtime-token check for ${permission}${status === null ? "" : ` (Cloudflare HTTP ${status})`}. Retry the check; this failure does not establish that a permission is missing.`;
+	return new Error(`platform: ${message}`, { cause });
+}
+var PlatformCloudflareClient = class PlatformCloudflareClient {
+	apiBaseUrl;
+	#fetcher;
+	#token;
+	#aiGatewayClient;
+	constructor(token, options) {
+		if (!token) throw new Error("platform: CLOUDFLARE_API_TOKEN is required. The installed control plane also uses this scoped token to provision app resources.");
+		this.#token = token;
+		this.apiBaseUrl = (options?.apiBase ?? resolvePinnedApiBaseUrl()).replace(/\/+$/, "");
+		this.#fetcher = options?.fetcher ?? fetch;
+		if (options?.aiGatewayToken) this.#aiGatewayClient = new PlatformCloudflareClient(options.aiGatewayToken, {
+			apiBase: this.apiBaseUrl,
+			fetcher: this.#fetcher
+		});
+	}
+	/** Keep operator auth for infrastructure; use the existing runtime credential only for AI Gateway. */
+	withAiGatewayToken(token) {
+		return new PlatformCloudflareClient(this.#token, {
+			apiBase: this.apiBaseUrl,
+			fetcher: this.#fetcher,
+			aiGatewayToken: token
+		});
+	}
+	async request(path, init) {
+		return (await this.#requestEnvelope(path, init)).result;
+	}
+	async #requestEnvelope(path, init) {
+		const response = await this.#fetcher(`${this.apiBaseUrl}${path}`, {
+			...init,
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${this.#token}`,
+				...init?.body ? { "Content-Type": "application/json" } : {},
+				...init?.headers
+			},
+			signal: init?.signal ?? AbortSignal.timeout(3e4)
+		});
+		let envelope;
+		try {
+			envelope = await response.json();
+		} catch {
+			throw new PlatformCloudflareApiError(`Cloudflare returned a non-JSON response (HTTP ${response.status}).`, response.status, path.split("?")[0]);
+		}
+		if (!response.ok || envelope.success !== true || envelope.result === void 0) throw new PlatformCloudflareApiError(`Cloudflare API error: ${envelope.errors?.map((error) => error.message).filter(Boolean).join(", ") || `HTTP ${response.status}`} (HTTP ${response.status}; ${init?.method ?? "GET"} ${path.split("?")[0]}).`, response.status, path.split("?")[0]);
+		return {
+			result: envelope.result,
+			resultInfo: envelope.result_info
+		};
+	}
+	async listAccounts() {
+		const entries = [];
+		for (let page = 1;; page++) {
+			const result = await this.request(`/accounts?page=${page}&per_page=50`);
+			entries.push(...result);
+			if (result.length < 50) break;
+		}
+		return entries.map((entry) => ({
+			id: requiredString(entry.id, "Cloudflare account id"),
+			name: requiredString(entry.name, "Cloudflare account name")
+		}));
+	}
+	async getWorkersSubdomain(accountId) {
+		const setupUrl = `https://dash.cloudflare.com/${encodeURIComponent(accountId)}/workers-and-pages`;
+		let result;
+		try {
+			result = await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/subdomain`);
+		} catch (error) {
+			const status = error instanceof PlatformCloudflareApiError ? error.status : null;
+			const reason = status === null ? "the request failed" : `HTTP ${status}`;
+			const guidance = status === 401 || status === 403 ? "Check your Cloudflare login or API token permissions for this account, then rerun the command." : status === 404 ? `Check ${setupUrl}. If no subdomain is shown, finish Workers onboarding and choose one; otherwise check account access and retry.` : "Rerun the command. If the dashboard already shows a subdomain, no Workers onboarding change is needed.";
+			throw new Error(`platform: Could not read the workers.dev subdomain for account ${accountId} (${reason}). ${guidance}`, { cause: error });
+		}
+		if (typeof result?.subdomain !== "string" || result.subdomain.trim() === "") throw new Error(`platform: This Cloudflare account does not have a workers.dev subdomain. Open ${setupUrl}, finish Workers onboarding, choose a subdomain, and rerun the command.`);
+		return result.subdomain.trim();
+	}
+	async listAiGateways(accountId) {
+		if (this.#aiGatewayClient) return this.#aiGatewayClient.listAiGateways(accountId);
+		const entries = [];
+		for (let page = 1;; page++) {
+			const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/ai-gateway/gateways?page=${page}&per_page=50`);
+			entries.push(...result);
+			if (result.length < 50) break;
+		}
+		return entries.map((entry) => ({
+			id: requiredString(entry.id, "AI Gateway id"),
+			name: requiredString(entry.id, "AI Gateway id")
+		}));
+	}
+	async createAiGateway(accountId, id) {
+		if (this.#aiGatewayClient) return this.#aiGatewayClient.createAiGateway(accountId, id);
+		return {
+			id: requiredString((await this.request(`/accounts/${encodeURIComponent(accountId)}/ai-gateway/gateways`, {
+				method: "POST",
+				body: JSON.stringify({
+					cache_invalidate_on_update: false,
+					cache_ttl: null,
+					collect_logs: true,
+					id,
+					rate_limiting_interval: null,
+					rate_limiting_limit: null
+				})
+			})).id, "AI Gateway id"),
+			name: id
+		};
+	}
+	async findZone(accountId, name) {
+		const exact = (await this.request(`/zones?account.id=${encodeURIComponent(accountId)}&name=${encodeURIComponent(name)}&per_page=50`)).find((zone) => zone.name === name);
+		return exact ? parseZone(exact) : null;
+	}
+	async createZone(accountId, name) {
+		return parseZone(await this.request("/zones", {
+			method: "POST",
+			body: JSON.stringify({
+				account: { id: accountId },
+				name,
+				type: "full"
+			})
+		}));
+	}
+	async findZoneForHostname(accountId, hostname) {
+		const labels = hostname.split(".");
+		for (let index = 0; index <= labels.length - 2; index++) {
+			const zone = await this.findZone(accountId, labels.slice(index).join("."));
+			if (zone) return zone;
+		}
+		return null;
+	}
+	async listWorkerDomains(accountId) {
+		return (await this.#listWorkerDomainRecords(accountId)).map((entry) => ({
+			hostname: requiredString(entry.hostname, "Worker custom domain hostname"),
+			id: requiredString(entry.id, "Worker custom domain id"),
+			service: requiredString(entry.service, "Worker custom domain service"),
+			...typeof entry.zone_name === "string" ? { zoneName: entry.zone_name } : {}
+		}));
+	}
+	/**
+	* Add missing Custom Domains without replacing the Worker's existing set or
+	* authorizing takeover of another Worker origin or DNS record. Wrangler
+	* enables destructive overrides automatically without a TTY, so the
+	* installer deliberately owns this mutation through the API instead.
+	*/
+	async publishWorkerCustomDomainsSafely(accountId, workerName, origins) {
+		const before = await this.listWorkerDomains(accountId);
+		const pending = origins.filter((origin) => {
+			const matches = before.filter((domain) => domain.hostname === origin.hostname);
+			if (matches.length > 1 || matches.some((domain) => domain.service !== workerName)) throw new PlatformWorkerCustomDomainsChangedError(`platform: Custom Domain ${JSON.stringify(origin.hostname)} changed concurrently before publication; refusing to replace its traffic state.`);
+			return matches.length === 0;
+		});
+		if (pending.length === 0) return;
+		try {
+			await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}/domains/records`, {
+				method: "PUT",
+				body: JSON.stringify({
+					override_scope: false,
+					override_existing_origin: false,
+					override_existing_dns_record: false,
+					origins: pending.map((origin) => ({
+						hostname: origin.hostname,
+						...origin.zoneId ? { zone_id: origin.zoneId } : {},
+						...origin.zoneName ? { zone_name: origin.zoneName } : {},
+						...origin.enabled === void 0 ? {} : { enabled: origin.enabled },
+						...origin.previewsEnabled === void 0 ? {} : { previews_enabled: origin.previewsEnabled }
+					}))
+				})
+			});
+		} catch (error) {
+			throw new PlatformWorkerCustomDomainsChangedError(`platform: Custom Domain publication for Worker ${JSON.stringify(workerName)} had an ambiguous outcome; retaining live domains for safe reconciliation.`, { cause: error });
+		}
+		const expected = [...origins].map((origin) => origin.hostname).sort();
+		const inventory = await this.listWorkerDomains(accountId);
+		const actual = inventory.filter((domain) => domain.service === workerName).map((domain) => domain.hostname).sort();
+		if (!expected.every((hostname) => inventory.filter((domain) => domain.hostname === hostname && domain.service === workerName).length === 1) || expected.some((hostname) => !actual.includes(hostname))) throw new PlatformWorkerCustomDomainsChangedError(`platform: Worker ${JSON.stringify(workerName)} Custom Domains changed concurrently after publication; refusing to overwrite the newer traffic state.`);
+	}
+	async #listWorkerDomainRecords(accountId, service) {
+		const entries = [];
+		const perPage = 100;
+		for (let page = 1;; page++) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: String(perPage)
+			});
+			if (service) query.set("service", service);
+			const response = await this.#requestEnvelope(`/accounts/${encodeURIComponent(accountId)}/workers/domains?${query}`);
+			entries.push(...response.result);
+			const totalPages = response.resultInfo?.total_pages;
+			if (typeof totalPages === "number" && page >= totalPages || totalPages === void 0 && response.result.length < perPage) break;
+		}
+		return entries;
+	}
+	async listWorkerRoutes(zoneId) {
+		return (await this.request(`/zones/${encodeURIComponent(zoneId)}/workers/routes`)).map((entry) => ({
+			id: requiredString(entry.id, "Worker route id"),
+			pattern: requiredString(entry.pattern, "Worker route pattern"),
+			script: typeof entry.script === "string" ? entry.script : null
+		}));
+	}
+	async publishWorkerRoutesSafely(zoneId, workerName, patterns) {
+		const before = await this.listWorkerRoutes(zoneId);
+		const pending = patterns.filter((pattern) => {
+			const matches = before.filter((route) => route.pattern === pattern);
+			if (matches.length > 1 || matches.some((route) => route.script !== workerName)) throw new PlatformWorkerRoutesChangedError(`platform: Worker route ${JSON.stringify(pattern)} changed concurrently before publication; refusing to replace its traffic state.`);
+			return matches.length === 0;
+		});
+		for (const pattern of pending) try {
+			await this.request(`/zones/${encodeURIComponent(zoneId)}/workers/routes`, {
+				body: JSON.stringify({
+					pattern,
+					script: workerName
+				}),
+				method: "POST"
+			});
+		} catch (error) {
+			throw new PlatformWorkerRoutesChangedError(`platform: Worker route publication for ${JSON.stringify(pattern)} had an ambiguous outcome; retaining live routes for safe reconciliation.`, { cause: error });
+		}
+		const after = await this.listWorkerRoutes(zoneId);
+		for (const pattern of patterns) {
+			const matches = after.filter((route) => route.pattern === pattern);
+			if (matches.length !== 1 || matches[0].script !== workerName) throw new PlatformWorkerRoutesChangedError(`platform: Worker route ${JSON.stringify(pattern)} changed concurrently after publication; retaining live routes for safe reconciliation.`);
+		}
+	}
+	async listWorkerServiceRoutes(accountId, workerName) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/services/${encodeURIComponent(workerName)}/environments/production/routes?show_zonename=true`)).map((entry) => ({
+			pattern: requiredString(entry.pattern, "Worker service route pattern"),
+			zoneName: requiredString(entry.zone_name, "Worker service route zone name")
+		}));
+	}
+	async listDnsRecords(zoneId, name) {
+		const query = new URLSearchParams({
+			name,
+			per_page: "100"
+		});
+		return (await this.request(`/zones/${encodeURIComponent(zoneId)}/dns_records?${query}`)).map(parseDnsRecord);
+	}
+	/** Read deployed edge certificates; requesting a pack is not proof of issuance. */
+	async hasActiveCertificateForHostname(zoneId, hostname) {
+		const expected = hostname.toLowerCase().replace(/\.$/, "");
+		const covers = (value) => {
+			if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+			const cert = value;
+			if (cert.status !== "active" || !Array.isArray(cert.hosts)) return false;
+			if (cert.expires_on !== void 0 && (typeof cert.expires_on !== "string" || !Number.isFinite(Date.parse(cert.expires_on)) || Date.parse(cert.expires_on) <= Date.now())) return false;
+			return cert.hosts.some((host) => typeof host === "string" && host.toLowerCase().replace(/\.$/, "") === expected);
+		};
+		for (const kind of ["ssl/certificate_packs", "custom_certificates"]) for (let page = 1; page <= 200; page++) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: "50"
+			});
+			if (kind === "ssl/certificate_packs") query.set("deploy", "production");
+			const { result, resultInfo } = await this.#requestEnvelope(`/zones/${encodeURIComponent(zoneId)}/${kind}?${query}`);
+			if (!Array.isArray(result)) throw new Error("platform: Cloudflare returned an invalid certificate inventory.");
+			for (const entry of result) if ((kind === "ssl/certificate_packs" ? Array.isArray(entry.certificates) ? entry.certificates : [] : [entry]).some(covers)) return true;
+			if (result.length === 0 || (resultInfo?.total_pages !== void 0 ? page >= resultInfo.total_pages : result.length < 50)) break;
+			if (page === 200) throw new Error("platform: Certificate inventory is too large to verify safely.");
+		}
+		return false;
+	}
+	async createDnsRecord(zoneId, name) {
+		return parseDnsRecord(await this.request(`/zones/${encodeURIComponent(zoneId)}/dns_records`, {
+			method: "POST",
+			body: JSON.stringify({
+				content: "100::",
+				name,
+				proxied: true,
+				ttl: 1,
+				type: "AAAA"
+			})
+		}));
+	}
+	async listKvNamespaces(accountId, title) {
+		const entries = [];
+		for (let page = 1;; page++) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: "100"
+			});
+			const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces?${query}`);
+			entries.push(...result);
+			if (result.length < 100) break;
+		}
+		const namespaces = entries.map((entry) => ({
+			id: requiredString(entry.id, "KV namespace id"),
+			name: requiredString(entry.title, "KV namespace title")
+		}));
+		return title ? namespaces.filter((namespace) => namespace.name === title) : namespaces;
+	}
+	async createKvNamespace(accountId, title) {
+		const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces`, {
+			method: "POST",
+			body: JSON.stringify({ title })
+		});
+		return {
+			id: requiredString(result.id, "KV namespace id"),
+			name: typeof result.title === "string" ? result.title : title
+		};
+	}
+	async listR2Buckets(accountId) {
+		const buckets = [];
+		let startAfter = "";
+		for (;;) {
+			const query = new URLSearchParams({
+				direction: "asc",
+				order: "name",
+				per_page: "1000"
+			});
+			if (startAfter) query.set("start_after", startAfter);
+			const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/r2/buckets?${query}`);
+			const page = Array.isArray(result) ? result : "buckets" in result ? result.buckets ?? [] : [];
+			buckets.push(...page);
+			if (page.length < 1e3) break;
+			const next = requiredString(page.at(-1)?.name, "R2 bucket name");
+			if (next === startAfter) throw new Error("platform: Cloudflare returned a non-advancing R2 bucket page.");
+			startAfter = next;
+		}
+		return buckets.map((entry) => {
+			const name = requiredString(entry.name, "R2 bucket name");
+			return {
+				fingerprint: requiredString(entry.creation_date, "R2 bucket creation date"),
+				id: name,
+				name
+			};
+		});
+	}
+	async createR2Bucket(accountId, name) {
+		const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/r2/buckets`, {
+			method: "POST",
+			body: JSON.stringify({ name })
+		});
+		const resultName = typeof result.name === "string" ? result.name : name;
+		const fingerprint = typeof result.creation_date === "string" && result.creation_date ? result.creation_date : (await this.listR2Buckets(accountId)).find((bucket) => bucket.name === resultName)?.fingerprint;
+		if (!fingerprint) throw new Error(`platform: Cloudflare created R2 bucket ${JSON.stringify(resultName)} without returning a verifiable creation fingerprint.`);
+		return {
+			fingerprint,
+			id: resultName,
+			name: resultName
+		};
+	}
+	async listQueues(accountId, name) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/queues?name=${encodeURIComponent(name)}&per_page=100`)).map((entry) => ({
+			id: requiredString(entry.queue_id, "Queue id"),
+			name: requiredString(entry.queue_name, "Queue name")
+		}));
+	}
+	async createQueue(accountId, name) {
+		const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/queues`, {
+			method: "POST",
+			body: JSON.stringify({ queue_name: name })
+		});
+		return {
+			id: requiredString(result.queue_id, "Queue id"),
+			name: typeof result.queue_name === "string" ? result.queue_name : name
+		};
+	}
+	async listDispatchNamespaces(accountId) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces`)).map((entry) => ({
+			id: requiredString(entry.namespace_id, "Dispatch namespace id"),
+			name: requiredString(entry.namespace_name, "Dispatch namespace name")
+		}));
+	}
+	async createDispatchNamespace(accountId, name) {
+		const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces`, {
+			method: "POST",
+			body: JSON.stringify({ name })
+		});
+		return {
+			id: requiredString(result.namespace_id, "Dispatch namespace id"),
+			name: typeof result.namespace_name === "string" ? result.namespace_name : name
+		};
+	}
+	async listHyperdriveConfigs(accountId) {
+		const entries = [];
+		for (let page = 1;; page++) {
+			const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/hyperdrive/configs?page=${page}&per_page=50`);
+			entries.push(...result);
+			if (result.length < 50) break;
+		}
+		return entries.map((entry) => ({
+			id: requiredString(entry.id, "Hyperdrive id"),
+			name: requiredString(entry.name, "Hyperdrive name")
+		}));
+	}
+	async getHyperdriveConfig(accountId, id) {
+		return parseHyperdriveConfig(await this.request(`/accounts/${encodeURIComponent(accountId)}/hyperdrive/configs/${encodeURIComponent(id)}`));
+	}
+	async createHyperdrive(accountId, name, connectionString) {
+		const parsed = parsePostgresConnectionString(connectionString);
+		const result = await this.request(`/accounts/${encodeURIComponent(accountId)}/hyperdrive/configs`, {
+			method: "POST",
+			body: JSON.stringify({
+				name,
+				origin: {
+					database: parsed.database,
+					host: parsed.host,
+					password: parsed.password,
+					port: parsed.port,
+					scheme: "postgresql",
+					user: parsed.user
+				},
+				...parsed.mtls ? { mtls: parsed.mtls } : {}
+			})
+		});
+		return {
+			id: requiredString(result.id, "Hyperdrive id"),
+			name: typeof result.name === "string" ? result.name : name
+		};
+	}
+	async listWorkerNames(accountId) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts`)).map((entry) => requiredString(entry.id, "Worker name"));
+	}
+	async putKvValue(accountId, namespaceId, key, value) {
+		await this.request(`/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}/values/${encodeURIComponent(key)}`, {
+			method: "PUT",
+			body: value,
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async getKvValue(accountId, namespaceId, key) {
+		const response = await this.#fetcher(`${this.apiBaseUrl}/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}/values/${encodeURIComponent(key)}`, {
+			headers: { Authorization: `Bearer ${this.#token}` },
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (response.status === 404) return null;
+		if (!response.ok) throw new PlatformCloudflareApiError(`Cloudflare API error reading the installation manifest (HTTP ${response.status}).`, response.status);
+		return response.text();
+	}
+	async putR2Object(accountId, bucketName, key, value) {
+		const response = await this.#fetcher(`${this.apiBaseUrl}/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects/${encodeR2ObjectKey(key)}`, {
+			body: value,
+			headers: {
+				Authorization: `Bearer ${this.#token}`,
+				"Content-Type": "application/json"
+			},
+			method: "PUT",
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (!response.ok) throw new PlatformCloudflareApiError(`Cloudflare API error writing the R2 ownership marker (HTTP ${response.status}).`, response.status);
+	}
+	async getR2Object(accountId, bucketName, key) {
+		const response = await this.#fetcher(`${this.apiBaseUrl}/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects/${encodeR2ObjectKey(key)}`, {
+			headers: { Authorization: `Bearer ${this.#token}` },
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (response.status === 404) return null;
+		if (!response.ok) throw new PlatformCloudflareApiError(`Cloudflare API error reading the R2 ownership marker (HTTP ${response.status}).`, response.status);
+		return response.text();
+	}
+	async deleteR2Object(accountId, bucketName, key) {
+		try {
+			await this.deleteR2Objects(accountId, bucketName, [key]);
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			throw error;
+		}
+	}
+	async getWorkerPlainTextBindings(accountId, workerName) {
+		const settings = await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}/settings`);
+		const bindings = {};
+		for (const binding of settings.bindings ?? []) if (binding.type === "plain_text" && typeof binding.name === "string" && typeof binding.text === "string") bindings[binding.name] = binding.text;
+		return bindings;
+	}
+	async deleteKvValue(accountId, namespaceId, key) {
+		try {
+			await this.request(`/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}/values/${encodeURIComponent(key)}`, { method: "DELETE" });
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			throw error;
+		}
+	}
+	async emptyR2Bucket(accountId, bucketName, preservedKeys = /* @__PURE__ */ new Set()) {
+		let cursor = "";
+		const observedCursors = /* @__PURE__ */ new Set();
+		for (;;) {
+			const query = new URLSearchParams({ per_page: "1000" });
+			if (cursor) query.set("cursor", cursor);
+			const response = await this.#fetcher(`${this.apiBaseUrl}/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects?${query}`, {
+				headers: {
+					Accept: "application/json",
+					Authorization: `Bearer ${this.#token}`
+				},
+				signal: AbortSignal.timeout(3e4)
+			});
+			if (response.status === 404) return;
+			const envelope = await response.json();
+			if (!response.ok || envelope.success !== true || !Array.isArray(envelope.result)) throw new PlatformCloudflareApiError(`Cloudflare API error listing R2 objects: ${envelope.errors?.map((error) => error.message).filter(Boolean).join(", ") || `HTTP ${response.status}`}`, response.status);
+			const keys = envelope.result.map((object) => requiredString(object.key, "R2 object key")).filter((key) => !preservedKeys.has(key));
+			for (let offset = 0; offset < keys.length; offset += 1e3) await this.deleteR2Objects(accountId, bucketName, keys.slice(offset, offset + 1e3));
+			const nextCursor = envelope.result_info?.cursor ?? "";
+			if (!nextCursor) return;
+			if (observedCursors.has(nextCursor)) throw new Error("platform: Cloudflare returned a repeated R2 object cursor.");
+			observedCursors.add(nextCursor);
+			cursor = nextCursor;
+		}
+	}
+	async deleteR2Objects(accountId, bucketName, keys) {
+		if (keys.length === 0) return;
+		const deleted = await this.request(`/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects`, {
+			body: JSON.stringify(keys),
+			method: "DELETE"
+		});
+		const deletedKeys = new Set(deleted.map((entry) => requiredString(entry.key, "deleted R2 object key")));
+		if (keys.find((key) => !deletedKeys.has(key)) !== void 0) throw new Error("platform: Cloudflare did not confirm every requested R2 object deletion.");
+	}
+	async deleteResource(accountId, kind, id, zoneId) {
+		const account = encodeURIComponent(accountId);
+		const encoded = encodeURIComponent(id);
+		const path = kind === "kv-namespace" ? `/accounts/${account}/storage/kv/namespaces/${encoded}` : kind === "dns-record" ? zoneId ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}` : null : kind === "ai-gateway" ? `/accounts/${account}/ai-gateway/gateways/${encoded}` : kind === "r2-bucket" ? `/accounts/${account}/r2/buckets/${encoded}` : kind === "queue" ? `/accounts/${account}/queues/${encoded}` : kind === "dispatch-namespace" ? `/accounts/${account}/workers/dispatch/namespaces/${encoded}` : kind === "hyperdrive" ? `/accounts/${account}/hyperdrive/configs/${encoded}` : kind === "worker" ? `/accounts/${account}/workers/scripts/${encoded}` : kind === "zone" ? `/zones/${encoded}` : null;
+		if (!path) throw new Error(`platform: Unsupported Cloudflare deletion kind ${kind}.`);
+		try {
+			await this.request(path, { method: "DELETE" });
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			throw error;
+		}
+	}
+	async removeRoutes(_accountId, _zoneId, tracked) {
+		if (tracked.routes.length > 0 || tracked.customDomains.length > 0) throw new Error("platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.");
+	}
+	async setWorkerSubdomain(accountId, workerName, enabled) {
+		try {
+			await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}/subdomain`, {
+				body: JSON.stringify({
+					enabled,
+					previews_enabled: enabled
+				}),
+				headers: { "Cloudflare-Workers-Script-Api-Date": "2025-08-01" },
+				method: "POST"
+			});
+		} catch (error) {
+			if (!enabled && error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			throw error;
+		}
+	}
+};
+function encodeR2ObjectKey(key) {
+	return key.split("/").map(encodeURIComponent).join("/");
+}
+function requiredString(value, label) {
+	if (typeof value !== "string" || value === "") throw new Error(`platform: ${label} is missing from the Cloudflare response.`);
+	return value;
+}
+function parseZone(value) {
+	return {
+		id: requiredString(value.id, "Zone id"),
+		name: requiredString(value.name, "Zone name"),
+		nameServers: Array.isArray(value.name_servers) ? value.name_servers.filter((entry) => typeof entry === "string") : [],
+		status: requiredString(value.status, "Zone status")
+	};
+}
+function parseDnsRecord(value) {
+	return {
+		content: requiredString(value.content, "DNS record content"),
+		id: requiredString(value.id, "DNS record id"),
+		name: requiredString(value.name, "DNS record name"),
+		proxied: value.proxied === true,
+		type: requiredString(value.type, "DNS record type")
+	};
+}
+function parsePostgresConnectionString(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("platform: DATABASE_URL must be a PostgreSQL connection string.");
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:" || !url.hostname) throw new Error("platform: DATABASE_URL must use postgres:// or postgresql://.");
+	const database = decodeURIComponent(url.pathname.replace(/^\//, ""));
+	if (!url.username || !url.password || !database) throw new Error("platform: DATABASE_URL must include username, password, host, and database.");
+	const port = url.port ? Number(url.port) : 5432;
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) throw new Error("platform: DATABASE_URL has an invalid PostgreSQL port.");
+	const sslmode = url.searchParams.get("sslmode");
+	let mtls;
+	if (sslmode) {
+		if (sslmode !== "require" && sslmode !== "verify-ca" && sslmode !== "verify-full") throw new Error("platform: Unsupported sslmode. Cloudflare Hyperdrive supports \"require\", \"verify-ca\", or \"verify-full\".");
+		mtls = { sslmode };
+	}
+	return {
+		database,
+		host: url.hostname,
+		...mtls ? { mtls } : {},
+		password: decodeURIComponent(url.password),
+		port,
+		user: decodeURIComponent(url.username)
+	};
+}
+function hyperdriveOriginFromConnectionString(value) {
+	const parsed = parsePostgresConnectionString(value);
+	return {
+		database: parsed.database,
+		host: parsed.host.toLowerCase(),
+		port: parsed.port,
+		scheme: "postgresql",
+		user: parsed.user
+	};
+}
+function hyperdriveOriginConfigHash(origin) {
+	return createHash("sha256").update(JSON.stringify({
+		database: origin.database,
+		host: origin.host.toLowerCase(),
+		port: origin.port,
+		scheme: "postgresql",
+		user: origin.user
+	})).digest("hex");
+}
+function hyperdriveOriginMatches(live, expected) {
+	return live.database === expected.database && live.host.toLowerCase() === expected.host.toLowerCase() && live.port === expected.port && live.scheme === expected.scheme && (live.user === null || live.user === expected.user);
+}
+function parseHyperdriveConfig(value) {
+	const origin = value.origin;
+	if (!origin || typeof origin !== "object" || Array.isArray(origin)) throw new Error("platform: Cloudflare Hyperdrive config has no origin metadata.");
+	const record = origin;
+	const scheme = requiredString(record.scheme, "Hyperdrive origin scheme").toLowerCase();
+	if (scheme !== "postgres" && scheme !== "postgresql") throw new Error(`platform: Unsupported Hyperdrive origin scheme ${JSON.stringify(scheme)}.`);
+	const port = typeof record.port === "number" ? record.port : Number(record.port);
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) throw new Error("platform: Cloudflare Hyperdrive config has an invalid origin port.");
+	return {
+		id: requiredString(value.id, "Hyperdrive id"),
+		name: requiredString(value.name, "Hyperdrive name"),
+		origin: {
+			database: requiredString(record.database, "Hyperdrive origin database"),
+			host: requiredString(record.host, "Hyperdrive origin host").toLowerCase(),
+			port,
+			scheme: "postgresql",
+			user: typeof record.user === "string" && record.user ? record.user : null
+		}
+	};
+}
+//#endregion
+//#region src/cli/platform-plan.ts
+async function createPlatformInstallPlan(client, input, existing, options) {
+	const account = resolveAccount(await client.listAccounts(), input.accountId);
+	if (existing && existing.account.id !== account.id) throw new Error(`platform: Refusing to resume installation ${existing.id} in a different Cloudflare account.`);
+	const installationSlug = normalizeInstallationSlug(input.installationSlug);
+	const installationId = existing?.id ?? `${installationSlug}-${createHash("sha256").update(JSON.stringify({
+		accountId: account.id,
+		applicationDomain: input.applicationDomain,
+		controlPlaneDomain: input.controlPlaneDomain,
+		installationSlug,
+		zoneName: input.zoneName
+	})).digest("hex").slice(0, 12)}`;
+	const accountSubdomain = await client.getWorkersSubdomain(account.id);
+	const workersDev = existing?.deployment.application.workersDev ?? (input.workersDev ? {
+		subdomain: accountSubdomain,
+		installationId
+	} : void 0);
+	if (workersDev && workersDev.subdomain !== accountSubdomain) throw new Error("platform: The account workers.dev subdomain changed. Restore it before continuing.");
+	const testing = !!workersDev && !input.zoneName;
+	const deployment = createPlatformDeploymentManifest({
+		application: {
+			baseDomain: testing ? `${accountSubdomain}.workers.dev` : input.applicationDomain,
+			dedicatedZone: input.dedicatedZone,
+			zoneName: input.zoneName,
+			...workersDev ? { workersDev } : {},
+			...existing?.deployment.application.zoneId ? { zoneId: existing.deployment.application.zoneId } : {}
+		},
+		controlPlane: {
+			apiHostname: input.controlPlaneDomain || null,
+			dashboardHostname: null,
+			proxyHostname: null
+		},
+		displayName: input.displayName,
+		installationSlug,
+		resources: existing?.deployment.resources ?? createPlatformResourceNames(installationSlug)
+	});
+	if (existing && JSON.stringify(existing.deployment) !== JSON.stringify(deployment)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
+	const names = deployment.resources;
+	const wildcardHostname = `*.${deployment.application.baseDomain}`;
+	const zone = testing ? null : await client.findZone(account.id, deployment.application.zoneName);
+	if (!testing && deployment.application.baseDomain !== deployment.application.zoneName) {
+		const certificateHelp = `Use the zone apex ${deployment.application.zoneName} as --application-domain, or provision an active ${wildcardHostname} edge certificate in the existing zone before installing. Cloudflare Advanced Certificate Manager is a paid add-on; an existing custom wildcard certificate also works. Manage certificates at https://dash.cloudflare.com/${account.id}/${deployment.application.zoneName}/ssl-tls/edge-certificates. Certificate inspection requires Zone > SSL and Certificates > Read (or Edit) on this zone.`;
+		if (!zone || zone.status !== "active") throw new Error(`platform: Nested application domain ${deployment.application.baseDomain} needs an active zone and wildcard certificate. ${certificateHelp}`);
+		let covered;
+		try {
+			covered = await client.hasActiveCertificateForHostname(zone.id, wildcardHostname);
+		} catch (error) {
+			throw new Error(`platform: Could not verify edge certificate coverage for ${wildcardHostname}. ${certificateHelp}`, { cause: error });
+		}
+		if (!covered) throw new Error(`platform: No active edge certificate covers ${wildcardHostname}. Universal SSL for ${deployment.application.zoneName} does not cover these deeper application hostnames. ${certificateHelp}`);
+	}
+	let needsAiGatewayCredential = false;
+	const gatewayInventory = client.listAiGateways(account.id).catch((error) => {
+		if (options?.allowUnverifiedAiGateway && error instanceof PlatformCloudflareApiError && error.status === 403) {
+			needsAiGatewayCredential = true;
+			return [];
+		}
+		throw error;
+	});
+	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
+		Promise.resolve(accountSubdomain),
+		gatewayInventory,
+		client.listKvNamespaces(account.id, names.routingKv),
+		client.listKvNamespaces(account.id, names.isrCacheKv),
+		client.listKvNamespaces(account.id, names.legacyAssetsKv),
+		client.listR2Buckets(account.id),
+		client.listQueues(account.id, names.usageQueue),
+		client.listQueues(account.id, names.cronQueue),
+		client.listDispatchNamespaces(account.id),
+		client.listHyperdriveConfigs(account.id),
+		client.listWorkerNames(account.id)
+	]);
+	const dnsRecords = zone ? await client.listDnsRecords(zone.id, wildcardHostname) : [];
+	const remoteOwnership = existing ? await readRemoteOwnership(client, account.id, routingKv, existing) : null;
+	const intentProofs = /* @__PURE__ */ new Set();
+	const ambiguousResources = /* @__PURE__ */ new Set();
+	if (existing) {
+		const bucket = r2Buckets.find((resource) => resource.name === names.assetsBucket);
+		const recordedBucket = existing.resources.find((resource) => resource.key === "assets-bucket" && resource.kind === "r2-bucket" && resource.ownership === "created" && resource.state === "ready");
+		if (bucket && recordedBucket?.id === bucket.id && recordedBucket.name === bucket.name) {
+			if (!matchesResourceMarker(await client.getR2Object(account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), existing, "assets-bucket", "r2-bucket", bucket) || !matchesRecordedR2Fingerprint(recordedBucket.configHash, bucket)) ambiguousResources.add("assets-bucket");
+		}
+		if (bucket && hasUnrecordedProvisionIntent(existing, "assets-bucket", "r2-bucket", bucket.name)) {
+			if (matchesResourceMarker(await client.getR2Object(account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), existing, "assets-bucket", "r2-bucket", bucket)) intentProofs.add("assets-bucket");
+		}
+		for (const [key, name] of [
+			["api-worker", names.apiWorker],
+			["proxy-worker", names.proxyWorker],
+			["tail-worker", names.tailWorker],
+			["dispatch-worker", names.dispatchWorker]
+		]) if (workers.includes(name) && hasUnrecordedProvisionIntent(existing, key, "worker", name)) {
+			if (matchesResourceMarker((await client.getWorkerPlainTextBindings(account.id, name)).PLATFORM_OWNERSHIP_MARKER, existing, key, "worker", {
+				id: name,
+				name
+			})) intentProofs.add(key);
+		}
+	}
+	if (zone) {
+		const expectedPatterns = new Set(createApplicationRoutes(deployment.application).map((route) => route.pattern));
+		const expectedWorker = deployment.resources.dispatchWorker;
+		const ownedWorker = intentProofs.has("dispatch-worker") || existing?.resources.some((resource) => resource.key === "dispatch-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
+		const conflicts = (await client.listWorkerRoutes(zone.id)).filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
+		if (conflicts.length > 0) {
+			const conflict = conflicts[0];
+			throw new Error(`platform: Application route ${JSON.stringify(conflict.pattern)} is already assigned to ${JSON.stringify(conflict.script ?? "no Worker")}. Choose another application domain.`);
+		}
+	}
+	if (deployment.controlPlane.apiHostname) {
+		const apiHostname = deployment.controlPlane.apiHostname;
+		const [workerDomains, controlPlaneZone] = await Promise.all([client.listWorkerDomains(account.id), client.findZoneForHostname(account.id, apiHostname)]);
+		const matchingDomain = workerDomains.find((domain) => domain.hostname === apiHostname);
+		const expectedWorker = deployment.resources.apiWorker;
+		if (matchingDomain && matchingDomain.service !== expectedWorker) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} is already assigned to Worker ${JSON.stringify(matchingDomain.service)}. Choose another hostname.`);
+		const records = controlPlaneZone ? await client.listDnsRecords(controlPlaneZone.id, apiHostname) : [];
+		const ownedApiWorker = intentProofs.has("api-worker") || existing?.resources.some((resource) => resource.key === "api-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
+		if (records.length > 0 && (!matchingDomain || !ownedApiWorker)) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} already has a DNS record that installation would replace. Choose another hostname or remove the record explicitly.`);
+	}
+	const actions = [];
+	if (!testing) {
+		const recordedZone = existing?.resources.find((resource) => resource.key === "zone");
+		const remotelyOwnedZone = remoteOwnership?.resources.some((resource) => resource.key === "zone" && resource.id === zone?.id);
+		const repairCreatedZone = options?.repairMissing && recordedZone?.ownership === "created" && !zone;
+		if (recordedZone && !repairCreatedZone && (!zone || recordedZone.id !== zone.id || recordedZone.kind !== "zone")) throw new Error(`platform: Recorded zone ${recordedZone.name} (${recordedZone.id}) no longer matches the Cloudflare account.`);
+		actions.push({
+			action: repairCreatedZone ? "create" : recordedZone || zone && remotelyOwnedZone ? "reuse" : zone ? "adopt" : "create",
+			id: zone?.id ?? null,
+			key: "zone",
+			kind: "zone",
+			name: deployment.application.zoneName,
+			reason: repairCreatedZone ? "Recreate the missing installer-owned zone." : recordedZone || remotelyOwnedZone ? "Reuse the recorded zone." : zone ? "Use the existing zone without taking ownership." : "Create the requested zone."
+		});
+		addDnsPlan(actions, existing, wildcardHostname, dnsRecords, options);
+	}
+	if (needsAiGatewayCredential) actions.push({
+		action: "inspect",
+		id: null,
+		key: "ai-gateway",
+		kind: "ai-gateway",
+		name: names.aiGateway,
+		reason: "AI Gateway access will be verified with the runtime token before provisioning (AI Gateway: Edit required)."
+	});
+	else addNamedPlan(actions, existing, "ai-gateway", "ai-gateway", names.aiGateway, aiGateways.filter((resource) => resource.id === names.aiGateway), "reuse", options, remoteOwnership, intentProofs);
+	addNamedPlan(actions, existing, "routing-kv", "kv-namespace", names.routingKv, routingKv, "reuse", options, remoteOwnership, intentProofs);
+	addNamedPlan(actions, existing, "isr-cache-kv", "kv-namespace", names.isrCacheKv, isrKv, "reuse", options, remoteOwnership);
+	addNamedPlan(actions, existing, "legacy-assets-kv", "kv-namespace", names.legacyAssetsKv, legacyKv, "reuse", options, remoteOwnership);
+	addNamedPlan(actions, existing, "assets-bucket", "r2-bucket", names.assetsBucket, r2Buckets.filter((resource) => resource.name === names.assetsBucket), "reuse", options, remoteOwnership, intentProofs, ambiguousResources);
+	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
+	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
+	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
+	addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
+	for (const [key, name] of [
+		["api-worker", names.apiWorker],
+		["proxy-worker", names.proxyWorker],
+		["tail-worker", names.tailWorker],
+		["dispatch-worker", names.dispatchWorker]
+	]) addNamedPlan(actions, existing, key, "worker", name, workers.includes(name) ? [{
+		id: name,
+		name
+	}] : [], "update", options, remoteOwnership, intentProofs);
+	const resolvedResources = { ...deployment.resources };
+	for (const action of actions) {
+		const resourceKey = RESOURCE_NAME_KEY_BY_ACTION[action.key];
+		if (resourceKey && action.name !== resolvedResources[resourceKey]) resolvedResources[resourceKey] = action.name;
+	}
+	const resolvedDeployment = createPlatformDeploymentManifest({
+		...deployment,
+		resources: resolvedResources
+	});
+	return {
+		account,
+		actions,
+		apiUrl: resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`,
+		deployment: resolvedDeployment,
+		installationId,
+		proxyUrl: resolvedDeployment.controlPlane.proxyHostname ? `https://${deployment.controlPlane.proxyHostname}` : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`,
+		workersSubdomain,
+		zone
+	};
+}
+async function revalidatePlatformInstallAction(client, original, manifest, action, options) {
+	const deployment = original.deployment;
+	const current = (await createPlatformInstallPlan(client, {
+		accountId: original.account.id,
+		applicationDomain: deployment.application.baseDomain,
+		controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
+		dedicatedZone: deployment.application.dedicatedZone,
+		displayName: deployment.displayName,
+		installationSlug: deployment.installationSlug,
+		zoneName: deployment.application.zoneName
+	}, manifest, options)).actions.find((entry) => entry.key === action.key);
+	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
+	if (action.kind === "worker" && action.action === "update") {
+		if (!matchesResourceMarker((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, action.key, "worker", {
+			id: action.name,
+			name: action.name
+		})) throw new Error(`platform: Cloudflare Worker ${JSON.stringify(action.name)} no longer has this installation's ownership marker. Review a new plan before retrying.`);
+	}
+}
+function resourceSlugForManifest(manifest) {
+	const apiWorker = manifest.deployment.resources.apiWorker;
+	if (!apiWorker.startsWith("void-") || !apiWorker.endsWith("-api")) return manifest.deployment.installationSlug;
+	const resourceSlug = apiWorker.slice(5, -4);
+	const suffix = resourceSlug.slice(resourceSlug.lastIndexOf("-") + 1);
+	if (!/^(?:[a-f0-9]{12}|[a-f0-9]{32})$/.test(suffix)) return manifest.deployment.installationSlug;
+	return resourceSlug;
+}
+function addDnsPlan(actions, existing, name, records, options) {
+	const compatible = records.filter((record) => record.proxied);
+	if (records.some((record) => !record.proxied)) throw new Error(`platform: DNS name ${JSON.stringify(name)} contains an unproxied record. Proxy every record at this wildcard name through Cloudflare or choose another application domain.`);
+	const recorded = existing?.resources.find((resource) => resource.key === "application-dns");
+	const remote = recorded ? compatible.find((record) => record.id === recorded.id) : compatible.sort((left, right) => left.id.localeCompare(right.id))[0];
+	if (recorded) {
+		if (remote && recorded.id === remote.id && recorded.kind === "dns-record") {
+			actions.push({
+				action: "reuse",
+				id: remote.id,
+				key: "application-dns",
+				kind: "dns-record",
+				name,
+				reason: "Reuse the recorded wildcard application DNS record."
+			});
+			return;
+		}
+		if (!remote && options?.repairMissing && recorded.ownership === "created") {
+			actions.push({
+				action: "create",
+				id: null,
+				key: "application-dns",
+				kind: "dns-record",
+				name,
+				reason: "Recreate the missing installer-owned wildcard application DNS record."
+			});
+			return;
+		}
+		throw new Error(`platform: Recorded DNS record ${JSON.stringify(recorded.name)} (${recorded.id}) no longer matches the Cloudflare zone.`);
+	}
+	actions.push({
+		action: remote ? "adopt" : "create",
+		id: remote?.id ?? null,
+		key: "application-dns",
+		kind: "dns-record",
+		name,
+		reason: remote ? "Use the existing compatible wildcard DNS record without taking ownership." : "Create an installer-owned proxied wildcard DNS record for application traffic."
+	});
+}
+function resolveAccount(accounts, selector) {
+	const matches = selector ? accounts.filter((account) => account.id === selector || account.name.toLowerCase() === selector.toLowerCase()) : accounts;
+	if (matches.length !== 1) throw new Error(matches.length === 0 ? `platform: Cloudflare account ${JSON.stringify(selector)} is not available to this token.` : "platform: Select a Cloudflare account with --account <id>.");
+	return matches[0];
+}
+function addNamedPlan(actions, existing, key, kind, name, matches, existingAction = "reuse", options, remoteOwnership, intentProofs = /* @__PURE__ */ new Set(), ambiguousResources = /* @__PURE__ */ new Set()) {
+	if (matches.length > 1) throw new Error(`platform: More than one ${kind} named ${JSON.stringify(name)} exists.`);
+	const remote = matches[0];
+	const recorded = existing?.resources.find((resource) => resource.key === key);
+	if (remote) {
+		if (existing && ambiguousResources.has(key)) {
+			if (!isLegacyUniqueProvisionAttempt(existing, key, kind, name)) throw new Error(`platform: Ownership of ${kind} ${JSON.stringify(name)} could not be verified. The resource was left untouched. Restore this installation's ownership record before resuming, or choose another installation name for a new platform.`);
+			actions.push({
+				action: "create",
+				id: null,
+				key,
+				kind,
+				name: interruptedProvisionRetryName(existing, key, kind, name),
+				reason: "Retain the ambiguously owned resource and create a fresh installer-scoped replacement."
+			});
+			return;
+		}
+		const remotelyOwned = remoteOwnership?.resources.some((resource) => resource.key === key && resource.kind === kind && resource.id === remote.id && resource.name === name && resource.ownership === "created");
+		const markedProvision = existing !== null && hasUnrecordedProvisionIntent(existing, key, kind, name) && intentProofs.has(key);
+		const ambiguousProvision = existing !== null && options?.authoritativeProvisionIntents === true && isLegacyUniqueProvisionAttempt(existing, key, kind, name) && hasAmbiguousProvisionIntent(existing, key, kind, remote.id, name);
+		if ((!recorded || recorded.id !== remote.id || recorded.kind !== kind) && !remotelyOwned && !markedProvision && !ambiguousProvision) throw new Error(`platform: ${kind} ${JSON.stringify(name)} already exists but is not owned by this installation. Resume the owning installation, or choose another installation name. Nothing was overwritten.`);
+		if (ambiguousProvision && !markedProvision && !remotelyOwned) {
+			actions.push({
+				action: "create",
+				id: null,
+				key,
+				kind,
+				name: interruptedProvisionRetryName(existing, key, kind, name),
+				reason: "Leave the ambiguous same-name resource untouched and create a fresh installer-scoped replacement."
+			});
+			return;
+		}
+		actions.push({
+			action: existingAction,
+			id: remote.id,
+			key,
+			kind,
+			name,
+			reason: markedProvision ? "Recover the resource with its matching ownership marker from an interrupted provisioning attempt." : existingAction === "update" ? "Deploy the current platform version." : "Reuse the recorded resource."
+		});
+		return;
+	}
+	if (recorded && recorded.state === "ready") {
+		if (options?.repairMissing && recorded.ownership === "created") {
+			actions.push({
+				action: "create",
+				id: null,
+				key,
+				kind,
+				name,
+				reason: `Recreate the missing installer-owned ${kind}.`
+			});
+			return;
+		}
+		if (options?.repairMissing && recorded.ownership !== "created") throw new Error(`platform: Recorded ${recorded.ownership} ${kind} ${JSON.stringify(name)} (${recorded.id}) is missing. Repair will not recreate a resource the installer does not own.`);
+		throw new Error(`platform: Recorded ${kind} ${JSON.stringify(name)} (${recorded.id}) is missing. Run \`void platform repair ${existing.id}\` to reconcile it.`);
+	}
+	actions.push({
+		action: "create",
+		id: null,
+		key,
+		kind,
+		name,
+		reason: `Create an installer-owned ${kind}.`
+	});
+}
+function hasUnrecordedProvisionIntent(manifest, key, kind, name) {
+	return !manifest.resources.some((resource) => resource.key === key && resource.state === "ready") && manifest.steps.some((step) => isProvisionIntentStep(step.key, key) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name));
+}
+function hasAmbiguousProvisionIntent(manifest, key, kind, remoteId, name) {
+	const recorded = manifest.resources.find((resource) => resource.key === key);
+	if (recorded?.id === remoteId && recorded.kind === kind && recorded.name === name) return false;
+	return manifest.steps.some((step) => isProvisionIntentStep(step.key, key) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name, recorded?.id ?? null));
+}
+function isProvisionIntentStep(stepKey, resourceKey) {
+	return stepKey === `provision-intent:${resourceKey}` || stepKey.startsWith(`provision-intent:${resourceKey}:`);
+}
+function interruptedProvisionRetryName(manifest, key, kind, name) {
+	const suffix = `-retry-${createHash("sha256").update(JSON.stringify({
+		key,
+		kind,
+		name,
+		ownershipNonce: manifest.ownershipNonce
+	})).digest("hex").slice(0, 32)}`;
+	return `${name.slice(0, 63 - suffix.length).replace(/-+$/, "")}${suffix}`;
+}
+function matchesRecordedR2Fingerprint(configHash, resource) {
+	if (!resource.fingerprint) return false;
+	const liveHash = createHash("sha256").update(JSON.stringify({
+		fingerprint: resource.fingerprint,
+		kind: "r2-bucket",
+		name: resource.name
+	})).digest("hex");
+	const legacyHash = createHash("sha256").update(JSON.stringify({
+		kind: "r2-bucket",
+		name: resource.name
+	})).digest("hex");
+	return configHash === liveHash || configHash === legacyHash;
+}
+function matchesResourceMarker(value, manifest, key, kind, resource) {
+	if (!value) return false;
+	try {
+		const actual = parsePlatformResourceOwnershipMarker(JSON.parse(value));
+		const expected = createPlatformResourceOwnershipMarker({
+			accountId: manifest.account.id,
+			installationId: manifest.id,
+			ownershipNonce: manifest.ownershipNonce,
+			resourceId: resource.id,
+			resourceKey: key,
+			resourceKind: kind,
+			resourceName: resource.name
+		});
+		return JSON.stringify(actual) === JSON.stringify(expected);
+	} catch {
+		return false;
+	}
+}
+function isLegacyUniqueProvisionAttempt(manifest, key, kind, name) {
+	const resourceSlug = resourceSlugForManifest(manifest);
+	if (resourceSlug === manifest.deployment.installationSlug) return false;
+	const expectedNames = createPlatformResourceNames(resourceSlug);
+	const resourceKey = RESOURCE_NAME_KEY_BY_ACTION[key];
+	if (!resourceKey) return false;
+	const expectedName = expectedNames[resourceKey];
+	const uniquePrefix = expectedName.slice(0, expectedName.lastIndexOf("-") + 1);
+	return manifest.deployment.resources[resourceKey] === name && (name === expectedName || name.startsWith(uniquePrefix)) && kind !== "zone" && kind !== "dns-record";
+}
+const RESOURCE_NAME_KEY_BY_ACTION = {
+	"ai-gateway": "aiGateway",
+	"api-worker": "apiWorker",
+	"assets-bucket": "assetsBucket",
+	"cron-queue": "cronQueue",
+	"dispatch-namespace": "dispatchNamespace",
+	"dispatch-worker": "dispatchWorker",
+	hyperdrive: "hyperdrive",
+	"isr-cache-kv": "isrCacheKv",
+	"legacy-assets-kv": "legacyAssetsKv",
+	"proxy-worker": "proxyWorker",
+	"routing-kv": "routingKv",
+	"tail-worker": "tailWorker",
+	"usage-queue": "usageQueue"
+};
+function platformProvisionIntentHash(manifest, key, kind, name, previousResourceId = null) {
+	return createHash("sha256").update(JSON.stringify({
+		key,
+		kind,
+		name,
+		ownershipNonce: manifest.ownershipNonce,
+		...previousResourceId ? { previousResourceId } : {}
+	})).digest("hex");
+}
+function platformAdoptionIntentHash(manifest, key, kind, id, name) {
+	return createHash("sha256").update(JSON.stringify({
+		id,
+		key,
+		kind,
+		name,
+		ownershipNonce: manifest.ownershipNonce
+	})).digest("hex");
+}
+async function readRemoteOwnership(client, accountId, routingNamespaces, existing) {
+	for (const namespace of routingNamespaces) {
+		const value = await client.getKvValue(accountId, namespace.id, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY);
+		if (value === null) continue;
+		let remote;
+		try {
+			remote = parsePlatformInstallationManifest(JSON.parse(value));
+		} catch {
+			throw new Error(`platform: Routing namespace ${JSON.stringify(namespace.name)} contains invalid ownership metadata.`);
+		}
+		const routing = remote.resources.find((resource) => resource.key === "routing-kv");
+		if (remote.id === existing.id && remote.ownershipNonce === existing.ownershipNonce && remote.account.id === accountId && routing?.id === namespace.id && routing.name === namespace.name && routing.ownership === "created") return remote;
+	}
+	return null;
+}
+function formatPlatformInstallPlan(plan) {
+	const lines = [
+		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)} (${plan.account.id})`,
+		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev (testing); add a domain with void platform domain set <domain>`,
+		`${import_picocolors$1.default.bold("Control plane:")} ${plan.apiUrl}`,
+		`${import_picocolors$1.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
+		""
+	];
+	for (const action of plan.actions) lines.push(`${action.action.padEnd(6)} ${action.kind.padEnd(19)} ${action.name}`);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/cli/platform-secret-update-authority.ts
+const COMPLETE_WORKER_SECRET_UPDATE_NAMES = [
+	"CF_API_TOKEN",
+	"GITHUB_CLIENT_ID",
+	"GITHUB_CLIENT_SECRET",
+	"R2_ACCESS_KEY_ID",
+	"R2_SECRET_ACCESS_KEY"
+];
+/**
+* Prevents a host without the encrypted values for an interrupted credential
+* update from carrying an opaque, possibly partial update into another cutover.
+*/
+function assertPlatformWorkerSecretUpdateAuthority(input) {
+	const unresolved = unresolvedWorkerSecretUpdate(input.manifest);
+	if (!unresolved) return;
+	const latestWorkerGeneration = readLatestWorkerGeneration(input.manifest);
+	if (unresolved.generation === latestWorkerGeneration && input.localIntent?.id === unresolved.id && (input.localIntent.generation === null || input.localIntent.generation === unresolved.generation) || hasCompleteWorkerSecretReplacement(input.explicitUpdates)) return;
+	throw new Error("platform: An unresolved Worker credential update is owned by another encrypted recovery checkpoint. Resume on the host that owns that checkpoint, restore its encrypted pending recovery material, or provide all supported Worker credential values together as a complete replacement.");
+}
+function unresolvedWorkerSecretUpdate(manifest) {
+	const markers = manifest.steps.flatMap((step) => {
+		const match = /^worker-secret-updates:(\d+):(pending|committed)$/.exec(step.key);
+		return match ? [{
+			generation: Number(match[1]),
+			id: step.resultHash,
+			state: match[2]
+		}] : [];
+	});
+	const latestGeneration = Math.max(0, ...markers.map((marker) => marker.generation));
+	const latest = markers.filter((marker) => marker.generation === latestGeneration);
+	const committed = new Set(latest.filter((marker) => marker.state === "committed").map((marker) => marker.id));
+	const pending = latest.filter((marker) => marker.state === "pending" && !committed.has(marker.id));
+	if (pending.length === 0) return null;
+	return {
+		generation: latestGeneration,
+		id: pending[0].id
+	};
+}
+function readLatestWorkerGeneration(manifest) {
+	return Math.max(0, ...manifest.steps.flatMap((step) => {
+		const match = /^worker-(?:cutover|secret-updates|traffic-state):(\d+)/.exec(step.key);
+		return match ? [Number(match[1])] : [];
+	}));
+}
+function hasCompleteWorkerSecretReplacement(updates) {
+	return COMPLETE_WORKER_SECRET_UPDATE_NAMES.every((name) => typeof updates[name] === "string" && updates[name] !== "");
+}
+//#endregion
+//#region src/cli/platform-traffic.ts
+function platformManagedWorkerTraffic(deployment, workers) {
+	const includes = (worker) => workers === void 0 || workers.has(worker);
+	const names = deployment.resources;
+	const customDomains = [];
+	if (deployment.controlPlane.apiHostname && includes(names.apiWorker)) customDomains.push({
+		hostname: deployment.controlPlane.apiHostname,
+		service: names.apiWorker
+	});
+	if (deployment.controlPlane.proxyHostname && includes(names.proxyWorker)) customDomains.push({
+		hostname: deployment.controlPlane.proxyHostname,
+		service: names.proxyWorker
+	});
+	return {
+		customDomains,
+		routes: includes(names.dispatchWorker) ? createApplicationRoutes(deployment.application).map((route) => ({
+			pattern: route.pattern,
+			script: names.dispatchWorker
+		})) : []
+	};
+}
+function trafficConfigHash(kind, value) {
+	return createHash("sha256").update(JSON.stringify({
+		kind,
+		value
+	})).digest("hex");
+}
+function trackedPlatformWorkerTraffic(_manifest, _workers) {
+	return {
+		customDomains: [],
+		routes: []
+	};
+}
+function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt) {
+	const desired = platformManagedWorkerTraffic(manifest.deployment, /* @__PURE__ */ new Set([workerName]));
+	let next = manifest;
+	for (const target of desired.routes) {
+		const matches = inventory.routes.filter((route) => route.pattern === target.pattern && route.script === target.script);
+		if (matches.length !== 1) throw new Error(`platform: Expected exactly one published Worker route for ${JSON.stringify(target.pattern)} and ${JSON.stringify(target.script)}.`);
+		const route = matches[0];
+		next = recordInstallationResource(next, {
+			configHash: trafficConfigHash("worker-route", target),
+			id: route.id,
+			key: `worker-route:${route.id}`,
+			kind: "worker-route",
+			name: route.pattern,
+			ownership: "external",
+			state: "retained"
+		}, updatedAt);
+	}
+	for (const target of desired.customDomains) {
+		const matches = inventory.customDomains.filter((domain) => domain.hostname === target.hostname && domain.service === target.service);
+		if (matches.length !== 1) throw new Error(`platform: Expected exactly one published Worker custom domain for ${JSON.stringify(target.hostname)} and ${JSON.stringify(target.service)}.`);
+		const domain = matches[0];
+		next = recordInstallationResource(next, {
+			configHash: trafficConfigHash("worker-custom-domain", target),
+			id: domain.id,
+			key: `worker-custom-domain:${domain.id}`,
+			kind: "worker-custom-domain",
+			name: domain.hostname,
+			ownership: "external",
+			state: "retained"
+		}, updatedAt);
+	}
+	return next;
+}
+//#endregion
+//#region src/cli/platform-installer.ts
+const REMOTE_INSTALLATION_MANIFEST_KEY = PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY;
+const PLATFORM_WORKER_SECRET_UPDATE_NAMES = [
+	"CF_API_TOKEN",
+	"GITHUB_CLIENT_ID",
+	"GITHUB_CLIENT_SECRET",
+	"R2_ACCESS_KEY_ID",
+	"R2_SECRET_ACCESS_KEY"
+];
+var PlatformWorkerRecoveryIncompleteError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PlatformWorkerRecoveryIncompleteError";
+	}
+};
+function loadPlatformRuntime(customRuntimeDirectory) {
+	const runtime = resolvePlatformRuntime(customRuntimeDirectory || void 0);
+	verifyRuntimeArtifacts(runtime.directory, runtime.manifest);
+	return runtime;
+}
+function createPlatformInstallationSecrets(input) {
+	const checkpoint = input.checkpoint ?? {};
+	const required = (value, name) => {
+		if (!value) throw new Error(`platform: ${name} is required to install the platform.`);
+		return value;
+	};
+	const existingInstallation = input.existingInstallation === true;
+	const restoredIdentity = (explicit, name) => existingInstallation ? checkpoint[name] || explicit || "" : explicit || checkpoint[name] || "";
+	const configured = (explicit, name) => explicit || checkpoint[name] || "";
+	const jwtSecret = restoredIdentity(input.jwtSecret || "", "jwtSecret");
+	const resolvedJwtSecret = input.existingInstallation ? jwtSecret : required(jwtSecret, "VOID_PLATFORM_JWT_SECRET");
+	if (!existingInstallation && Buffer.byteLength(resolvedJwtSecret, "utf8") < 32) throw new Error("platform: VOID_PLATFORM_JWT_SECRET must contain at least 32 bytes of secret material unique to this installation.");
+	const projectSecretKeyring = resolveProjectSecretKeyring({
+		checkpoint,
+		existingInstallation,
+		projectSecretActiveKeyVersion: input.projectSecretActiveKeyVersion || "",
+		projectSecretKey: input.projectSecretKey || "",
+		projectSecretKeysJson: input.projectSecretKeysJson || "",
+		required
+	});
+	const pendingWorkerSecretUpdateIntent = parseWorkerSecretUpdateIntent(checkpoint.workerSecretUpdatesJson);
+	const explicitWorkerSecretUpdates = withoutEmptySecrets({
+		CF_API_TOKEN: input.cloudflareApiToken,
+		GITHUB_CLIENT_ID: input.githubClientId,
+		GITHUB_CLIENT_SECRET: input.githubClientSecret,
+		R2_ACCESS_KEY_ID: input.r2AccessKeyId,
+		R2_SECRET_ACCESS_KEY: input.r2SecretAccessKey
+	});
+	return {
+		workerSecretUpdates: input.updateExistingWorkers ? explicitWorkerSecretUpdates : {},
+		pendingWorkerSecretUpdateIntent: input.updateExistingWorkers ? pendingWorkerSecretUpdateIntent : void 0,
+		bootstrapGitHubId: existingInstallation ? configured(input.bootstrapGitHubId, "bootstrapGitHubId") : required(configured(input.bootstrapGitHubId, "bootstrapGitHubId"), "resolved administrator GitHub account id"),
+		bootstrapGitHubLogin: existingInstallation ? configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin") : required(configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin"), "VOID_PLATFORM_ADMIN_GITHUB_LOGIN"),
+		cloudflareApiToken: existingInstallation ? configured(input.cloudflareApiToken, "cloudflareApiToken") : required(configured(input.cloudflareApiToken, "cloudflareApiToken"), "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN"),
+		databaseUrl: required(input.databaseUrl || checkpoint.databaseUrl || "", "DATABASE_URL"),
+		githubClientId: existingInstallation ? configured(input.githubClientId, "githubClientId") : required(configured(input.githubClientId, "githubClientId"), "VOID_PLATFORM_GITHUB_CLIENT_ID"),
+		githubClientSecret: existingInstallation ? configured(input.githubClientSecret, "githubClientSecret") : required(configured(input.githubClientSecret, "githubClientSecret"), "VOID_PLATFORM_GITHUB_CLIENT_SECRET"),
+		jwtSecret: resolvedJwtSecret,
+		projectSecretActiveKeyVersion: projectSecretKeyring.activeVersion,
+		projectSecretKey: projectSecretKeyring.v1Key,
+		projectSecretKeysJson: projectSecretKeyring.keysJson,
+		r2AccessKeyId: existingInstallation ? configured(input.r2AccessKeyId, "r2AccessKeyId") : required(configured(input.r2AccessKeyId, "r2AccessKeyId"), "VOID_PLATFORM_R2_ACCESS_KEY_ID"),
+		r2SecretAccessKey: existingInstallation ? configured(input.r2SecretAccessKey, "r2SecretAccessKey") : required(configured(input.r2SecretAccessKey, "r2SecretAccessKey"), "VOID_PLATFORM_R2_SECRET_ACCESS_KEY")
+	};
+}
+function resolveProjectSecretKeyring(input) {
+	const explicitFullKeyring = input.projectSecretKeysJson !== "" || input.projectSecretActiveKeyVersion !== "";
+	if (explicitFullKeyring && (!input.projectSecretKeysJson || !input.projectSecretActiveKeyVersion)) throw new Error("platform: VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON and VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION must be supplied together.");
+	if (explicitFullKeyring && !input.existingInstallation) throw new Error("platform: Fresh installations use VOID_PLATFORM_PROJECT_SECRET_KEY to initialize key version v1. The full project-secret keyring inputs are for restoring an existing installation.");
+	const checkpointKeysJson = input.checkpoint.projectSecretKeysJson || "";
+	const checkpointActiveVersion = input.checkpoint.projectSecretActiveKeyVersion || "";
+	if (!explicitFullKeyring && (checkpointKeysJson !== "" || checkpointActiveVersion !== "") && (!checkpointKeysJson || !checkpointActiveVersion)) throw new Error("platform: Encrypted recovery material must contain both the project-secret keyring and its active version.");
+	if (explicitFullKeyring) return normalizeProjectSecretKeyring(input.projectSecretKeysJson, input.projectSecretActiveKeyVersion, "VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON", "VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION");
+	if (checkpointKeysJson) return normalizeProjectSecretKeyring(checkpointKeysJson, checkpointActiveVersion, "encrypted recovery project-secret keyring", "encrypted recovery project-secret active version");
+	const v1Key = input.existingInstallation ? input.checkpoint.projectSecretKey || input.projectSecretKey || "" : input.required(input.projectSecretKey || input.checkpoint.projectSecretKey || "", "VOID_PLATFORM_PROJECT_SECRET_KEY");
+	if (!v1Key) return {
+		activeVersion: "",
+		keysJson: "",
+		v1Key: ""
+	};
+	assertCanonicalProjectSecretKey(v1Key, "VOID_PLATFORM_PROJECT_SECRET_KEY", true);
+	return {
+		activeVersion: "v1",
+		keysJson: JSON.stringify({ v1: v1Key }),
+		v1Key
+	};
+}
+function normalizeProjectSecretKeyring(keysJson, activeVersion, keysName, activeVersionName) {
+	let parsed;
+	try {
+		parsed = JSON.parse(keysJson);
+	} catch {
+		throw new Error(`platform: ${keysName} must be valid JSON.`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`platform: ${keysName} must be a JSON object.`);
+	const entries = Object.entries(parsed);
+	if (entries.length === 0) throw new Error(`platform: ${keysName} must define at least one key.`);
+	for (const [version, key] of entries) {
+		if (!version || typeof key !== "string" || !key) throw new Error(`platform: ${keysName} must map non-empty versions to keys.`);
+		assertCanonicalProjectSecretKey(key, `${keysName} entry ${JSON.stringify(version)}`);
+	}
+	if (!Object.hasOwn(parsed, activeVersion)) throw new Error(`platform: ${activeVersionName} must identify a key in ${keysName}.`);
+	const keys = Object.fromEntries(entries.sort(([left], [right]) => left.localeCompare(right)));
+	return {
+		activeVersion,
+		keysJson: JSON.stringify(keys),
+		v1Key: keys.v1 || ""
+	};
+}
+function assertCanonicalProjectSecretKey(value, name, uniqueToInstallation = false) {
+	const decoded = Buffer.from(value, "base64");
+	if (decoded.byteLength !== 32 || decoded.toString("base64") !== value) throw new Error(`platform: ${name} must be the canonical base64 encoding of a 32-byte key${uniqueToInstallation ? " unique to this installation" : ""}.`);
+}
+function secretCheckpoint(secrets, workerSecretUpdateIntent) {
+	return {
+		bootstrapGitHubId: secrets.bootstrapGitHubId,
+		bootstrapGitHubLogin: secrets.bootstrapGitHubLogin,
+		cloudflareApiToken: secrets.cloudflareApiToken,
+		databaseUrl: secrets.databaseUrl,
+		githubClientId: secrets.githubClientId,
+		githubClientSecret: secrets.githubClientSecret,
+		jwtSecret: secrets.jwtSecret,
+		projectSecretActiveKeyVersion: secrets.projectSecretActiveKeyVersion,
+		projectSecretKey: secrets.projectSecretKey,
+		projectSecretKeysJson: secrets.projectSecretKeysJson,
+		r2AccessKeyId: secrets.r2AccessKeyId,
+		r2SecretAccessKey: secrets.r2SecretAccessKey,
+		...workerSecretUpdateIntent ? { workerSecretUpdatesJson: JSON.stringify(workerSecretUpdateIntent) } : {}
+	};
+}
+function parseWorkerSecretUpdateIntent(value) {
+	if (!value) return;
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		throw new Error("platform: Encrypted pending Worker secret updates must be valid JSON.");
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !("schema" in parsed) || parsed.schema !== 1 || !("id" in parsed) || typeof parsed.id !== "string" || parsed.id === "" || !("baselineGeneration" in parsed) || !Number.isSafeInteger(parsed.baselineGeneration) || Number(parsed.baselineGeneration) < 0 || !("generation" in parsed) || parsed.generation !== null && (!Number.isSafeInteger(parsed.generation) || Number(parsed.generation) <= 0) || !("updates" in parsed) || !parsed.updates || typeof parsed.updates !== "object" || Array.isArray(parsed.updates)) throw new Error("platform: Encrypted pending Worker secret update intent is invalid.");
+	const updates = {};
+	for (const [name, entry] of Object.entries(parsed.updates)) {
+		if (!PLATFORM_WORKER_SECRET_UPDATE_NAMES.includes(name) || typeof entry !== "string" || entry === "") throw new Error("platform: Encrypted pending Worker secret updates are invalid.");
+		updates[name] = entry;
+	}
+	if (Object.keys(updates).length === 0) throw new Error("platform: Encrypted pending Worker secret update intent is empty.");
+	return {
+		baselineGeneration: Number(parsed.baselineGeneration),
+		generation: parsed.generation === null ? null : Number(parsed.generation),
+		id: parsed.id,
+		schema: 1,
+		updates
+	};
+}
+function sanitizeWorkerSecretUpdates(updates) {
+	return Object.fromEntries(Object.entries(updates ?? {}).filter(([name, value]) => PLATFORM_WORKER_SECRET_UPDATE_NAMES.includes(name) && typeof value === "string" && value !== ""));
+}
+async function installPlatform(plan, secrets, existing, dependencies) {
+	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
+	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
+	const runPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl);
+	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
+	const runtimeDirectory = resolvedRuntime.directory;
+	const runtime = resolvedRuntime.manifest;
+	if (plan.deployment.application.workersDev && runtime.applicationRoutingVersion !== 1) throw new Error("platform: This runtime does not support workers.dev application routing. Use a current platform runtime.");
+	verifyRuntimeArtifacts(runtimeDirectory, runtime);
+	const runtimeProvenance = {
+		manifestSha256: resolvedRuntime.manifestSha256,
+		source: resolvedRuntime.source,
+		sourceRevision: runtime.sourceRevision
+	};
+	const version = runtime.platformVersion;
+	const targetUsageProtocolVersion = runtime.usageProtocolVersion;
+	const sourcePlatformVersion = existing?.platformVersion ?? null;
+	const hadPriorWorkers = existing !== null && (existing.resources.some((resource) => resource.kind === "worker" && resource.state === "ready") || plan.actions.some((action) => action.kind === "worker" && action.action !== "create"));
+	const wasDisabled = existing?.status === "disabled";
+	const preserveDisabled = existing?.desiredState === "disabled";
+	const previousPublicEndpoints = stablePublicEndpointState(existing);
+	let workerCutoverGeneration = 0;
+	let workerRollbacks = [];
+	let workerDeploymentCommitted = false;
+	let workerTrafficGuarded = false;
+	let manifest = existing;
+	if (!manifest) {
+		const createdAt = now();
+		manifest = createPlatformInstallationManifest({
+			account: plan.account,
+			createdAt,
+			deployment: plan.deployment,
+			id: plan.installationId,
+			ownershipNonce: randomBytes(32).toString("base64url"),
+			platformVersion: version
+		});
+		manifest = transitionInstallation(manifest, "planned", now());
+		writeInstallationManifest(manifest);
+	} else if (manifest.status === "uninstalled") throw new Error(`platform: Installation ${manifest.id} has already been uninstalled.`);
+	const explicitWorkerSecretUpdates = sanitizeWorkerSecretUpdates(secrets.workerSecretUpdates);
+	const hasExplicitWorkerSecretUpdates = Object.keys(explicitWorkerSecretUpdates).length > 0;
+	const resumedWorkerSecretUpdateIntent = secrets.pendingWorkerSecretUpdateIntent && platformWorkerSecretUpdateIntentState(manifest, secrets.pendingWorkerSecretUpdateIntent) === "active" ? secrets.pendingWorkerSecretUpdateIntent : null;
+	let workerSecretUpdateIntent = hasExplicitWorkerSecretUpdates ? {
+		baselineGeneration: latestPlatformWorkerCutoverGeneration(manifest),
+		generation: null,
+		id: randomUUID(),
+		schema: 1,
+		updates: {
+			...resumedWorkerSecretUpdateIntent?.updates,
+			...explicitWorkerSecretUpdates
+		}
+	} : resumedWorkerSecretUpdateIntent;
+	if (preserveDisabled && manifest.desiredState !== "disabled") {
+		manifest = setInstallationDesiredState(manifest, "disabled", now());
+		writeInstallationManifest(manifest);
+	}
+	assertRequiredPlatformSecrets(plan, manifest, secrets);
+	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
+	writePendingInstallationSecrets(manifest, {
+		...pendingSecrets,
+		databaseClaimState: "claiming"
+	});
+	dependencies.onProgress?.("Preparing the platform database");
+	try {
+		await (dependencies.claimDatabase ?? claimPlatformDatabase)(secrets.databaseUrl, manifest.id, manifest.ownershipNonce);
+	} catch (error) {
+		writePendingInstallationSecrets(manifest, {
+			...pendingSecrets,
+			databaseClaimState: "failed"
+		});
+		throw error;
+	}
+	writePendingInstallationSecrets(manifest, {
+		...pendingSecrets,
+		databaseClaimState: "claimed"
+	});
+	dependencies.onProgress?.("Acquiring the database lock");
+	const releaseDatabaseLock = await dependencies.acquireDatabaseLifecycleLock(secrets.databaseUrl, manifest.id, manifest.ownershipNonce);
+	const writeRemoteInstallationCheckpoint = (client, checkpointPlan, checkpointManifest) => writeRemoteInstallationCheckpointWithoutDatabase(client, checkpointPlan, checkpointManifest, releaseDatabaseLock);
+	const authoritative = releaseDatabaseLock.authoritativeManifest;
+	if (authoritative && JSON.stringify(authoritative) !== JSON.stringify(manifest)) {
+		writeInstallationManifest(authoritative);
+		await releaseDatabaseLock();
+		throw new Error("platform: This installation changed on another host. Local state was refreshed; rerun the command to review a current plan.");
+	}
+	try {
+		assertPlatformWorkerSecretUpdateAuthority({
+			explicitUpdates: explicitWorkerSecretUpdates,
+			localIntent: secrets.pendingWorkerSecretUpdateIntent,
+			manifest
+		});
+	} catch (error) {
+		await releaseDatabaseLock();
+		throw error;
+	}
+	if (workerSecretUpdateIntent && !hasExplicitWorkerSecretUpdates && platformWorkerSecretUpdateIntentState(manifest, workerSecretUpdateIntent) !== "active") workerSecretUpdateIntent = null;
+	const workerDeploymentSecrets = {
+		...secrets,
+		workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
+	};
+	try {
+		assertPlatformRuntimeSafety(runtime, manifest.safetyProtocols, releaseDatabaseLock.requiredSafetyProtocols);
+		if (existing) await dependencies.verifyExistingOwnership?.(manifest, authoritative !== null && authoritative !== void 0);
+		dependencies.onProgress?.("Checking and creating Cloudflare resources");
+		if (JSON.stringify(manifest.deployment) !== JSON.stringify(plan.deployment)) {
+			manifest = {
+				...manifest,
+				deployment: plan.deployment,
+				updatedAt: now()
+			};
+			writeInstallationManifest(manifest);
+			await releaseDatabaseLock.checkpoint?.(manifest);
+		}
+		await releaseDatabaseLock.checkpoint?.(manifest);
+		if (manifest.status !== "provisioning") {
+			manifest = transitionInstallation(manifest, "provisioning", now());
+			writeInstallationManifest(manifest);
+		}
+		const routingAction = plan.actions.find((action) => action.key === "routing-kv");
+		if (routingAction.action === "adopt") throw new Error("platform: The routing checkpoint cannot be adopted.");
+		if (routingAction.action === "reuse") {
+			if (!manifest.resources.some((resource) => resource.key === routingAction.key) && routingAction.id) {
+				manifest = recordResource(manifest, routingAction, routingAction.id, "created", now());
+				writeInstallationManifest(manifest);
+			}
+		} else {
+			manifest = recordProvisionIntent(manifest, routingAction, now());
+			writeInstallationManifest(manifest);
+			await releaseDatabaseLock.checkpoint?.(manifest);
+			const routing = await createResource(dependencies.client, plan, routingAction, secrets.databaseUrl, "");
+			manifest = recordResource(manifest, routingAction, routing.id, "created", now());
+			writeInstallationManifest(manifest);
+		}
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		const zoneAction = plan.actions.find((action) => action.key === "zone");
+		let zone = plan.zone;
+		if (zoneAction) {
+			if (zoneAction.action === "create") {
+				manifest = recordProvisionIntent(manifest, zoneAction, now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				zone = await dependencies.client.createZone(plan.account.id, zoneAction.name);
+			}
+			if (!zone) throw new Error("platform: Cloudflare did not return the platform zone.");
+			if (zoneAction.action === "adopt") {
+				manifest = recordAdoptionIntent(manifest, zoneAction, zone.id, now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			}
+			manifest = recordResource(manifest, zoneAction, zone.id, zoneAction.action === "adopt" ? "adopted" : zoneAction.action === "create" || hasProvisionIntent(manifest, zoneAction) ? "created" : void 0, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			if (zone.status !== "active") {
+				manifest = transitionInstallation(manifest, "waiting-for-dns", now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				return {
+					manifest,
+					waitingForDns: true,
+					waitingForSandboxDrain: false,
+					zoneNameServers: zone.nameServers
+				};
+			}
+		}
+		const zoneId = zone?.id ?? "";
+		for (const action of plan.actions.filter((entry) => entry.key !== "routing-kv" && entry.kind !== "zone" && entry.kind !== "worker")) {
+			const retainedManifest = retainReplacedInstallationResource(manifest, action, now());
+			if (retainedManifest !== manifest) {
+				manifest = retainedManifest;
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			}
+			if (action.action === "adopt") {
+				if (!action.id) throw new Error(`platform: Adopted ${action.kind} ${action.name} has no id.`);
+				manifest = recordAdoptionIntent(manifest, action, action.id, now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl);
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				continue;
+			}
+			if (action.action === "reuse") {
+				if (action.id && (action.kind === "hyperdrive" || !manifest.resources.some((resource) => resource.key === action.key))) {
+					manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl);
+					writeInstallationManifest(manifest);
+					await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				}
+				continue;
+			}
+			manifest = recordProvisionIntent(manifest, action, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			const resource = await createResource(dependencies.client, plan, action, secrets.databaseUrl, zoneId);
+			manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, resource.fingerprint);
+			writeInstallationManifest(manifest);
+			await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
+		dependencies.onProgress?.("Checking the platform database schema");
+		const rollbackDatabase = dependencies.databaseRollbackSource;
+		const migrationStep = `database-schema:${runtime.database.schemaDigest}`;
+		if (rollbackDatabase) {
+			const verifyDatabase = releaseDatabaseLock.verifyDatabase;
+			if (!verifyDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify the forward-only rollback schema.");
+			await verifyDatabase(rollbackDatabase.directory, rollbackDatabase.manifest.database);
+			manifest = {
+				...manifest,
+				databaseSchemaDigest: rollbackDatabase.manifest.database.schemaDigest,
+				updatedAt: now()
+			};
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		} else if (!manifest.steps.some((step) => step.key === migrationStep)) {
+			dependencies.onProgress?.("Applying platform database migrations");
+			const legacyMigrationStep = `database-migrations:${runtime.database.journalSha256}`;
+			if (dependencies.migrateDatabase) {
+				if (!manifest.steps.some((step) => step.key === legacyMigrationStep)) await dependencies.migrateDatabase(secrets.databaseUrl, join(runtimeDirectory, "drizzle"));
+			} else {
+				const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
+				if (!prepareDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.");
+				await prepareDatabase(runtimeDirectory, runtime.database, sourcePlatformVersion, hadPriorWorkers);
+			}
+			manifest = recordInstallationStep(manifest, {
+				completedAt: now(),
+				key: migrationStep,
+				resultHash: runtime.database.schemaDigest
+			}, now());
+			manifest = {
+				...manifest,
+				databaseSchemaDigest: runtime.database.schemaDigest,
+				updatedAt: now()
+			};
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		} else if (releaseDatabaseLock.verifyDatabase) {
+			await releaseDatabaseLock.verifyDatabase(runtimeDirectory, runtime.database);
+			if (manifest.databaseSchemaDigest !== runtime.database.schemaDigest) {
+				manifest = {
+					...manifest,
+					databaseSchemaDigest: runtime.database.schemaDigest,
+					updatedAt: now()
+				};
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			}
+		}
+		dependencies.onProgress?.("Checking platform safety");
+		const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
+		const prepareSandboxDrain = dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
+		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
+		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
+		const writeSandboxDrainMirror = async (preparation) => {
+			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
+		};
+		if (sandboxDrainPreparation) await writeSandboxDrainMirror(sandboxDrainPreparation);
+		const sandboxDrainState = sandboxDrainPreparation?.state ?? "complete";
+		if (targetSandboxDrainProtocol >= 1 && (manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol) {
+			manifest = {
+				...manifest,
+				safetyProtocols: { sandboxDrain: targetSandboxDrainProtocol },
+				updatedAt: now()
+			};
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
+		manifest = transitionInstallation(manifest, "deploying", now());
+		writeInstallationManifest(manifest);
+		const ids = Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id]));
+		const bootstrapStep = "bootstrap-access:v1";
+		if (!manifest.steps.some((step) => step.key === bootstrapStep)) {
+			const routingKv = requireId(ids, "routing-kv");
+			await dependencies.client.putKvValue(plan.account.id, routingKv, "signup:enabled", "true");
+			await dependencies.client.putKvValue(plan.account.id, routingKv, "signup:allowlist", JSON.stringify([]));
+			manifest = recordInstallationStep(manifest, {
+				completedAt: now(),
+				key: bootstrapStep,
+				resultHash: hash(secrets.bootstrapGitHubId)
+			}, now());
+			writeInstallationManifest(manifest);
+		}
+		const entrypoints = Object.fromEntries(Object.entries(runtime.artifacts).map(([key, artifact]) => [key, join(runtimeDirectory, artifact.path)]));
+		const interruptedCutover = interruptedWorkerCutover(manifest);
+		const recoveringUnsafeTraffic = (interruptedCutover?.unsafeTraffic.size ?? 0) > 0;
+		const createsWorker = plan.actions.some((action) => action.kind === "worker" && action.action === "create");
+		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
+		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
+		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || requiresSandboxDrain;
+		if (requiresTrafficGuard) {
+			await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+			workerTrafficGuarded = true;
+		}
+		if (!preserveDisabled) {
+			const trafficGeneration = nextTrafficGeneration(manifest);
+			manifest = recordInstallationStep(manifest, {
+				completedAt: now(),
+				key: `traffic-enabled:${trafficGeneration}`,
+				resultHash: String(trafficGeneration)
+			}, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
+		const configInput = {
+			accountId: plan.account.id,
+			apiUrl: plan.apiUrl,
+			deployment: plan.deployment,
+			healthProbeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
+			installationId: manifest.id,
+			ownershipNonce: manifest.ownershipNonce,
+			platformVersion: version,
+			proxyUrl: plan.proxyUrl,
+			resources: {
+				hyperdrive: requireId(ids, "hyperdrive"),
+				isrCacheKv: requireId(ids, "isr-cache-kv"),
+				legacyAssetsKv: requireId(ids, "legacy-assets-kv"),
+				routingKv: requireId(ids, "routing-kv"),
+				zone: zoneId
+			},
+			runtimeEntrypoints: entrypoints
+		};
+		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
+		const enabledConfigs = createPlatformWorkerConfigs({
+			...configInput,
+			publicEndpoints: !preserveDisabled,
+			trafficState: preserveDisabled ? "staging" : "enabled"
+		});
+		const configs = requiresStagedCommit ? createPlatformWorkerConfigs({
+			...configInput,
+			publicEndpoints: true,
+			trafficState: requiresSandboxDrain ? "sandbox-drain" : "staging"
+		}) : enabledConfigs;
+		const previousConfigs = createPlatformWorkerConfigs({
+			...configInput,
+			publicEndpoints: previousPublicEndpoints,
+			trafficState: previousPublicEndpoints ? "enabled" : "staging"
+		});
+		const managedRoutes = platformManagedWorkerTraffic(plan.deployment).routes;
+		let workerActions = plan.actions.filter((action) => action.kind === "worker");
+		if (interruptedCutover) {
+			for (const key of [...interruptedCutover.staged.keys()].reverse()) {
+				const snapshot = interruptedCutover.staged.get(key);
+				const preservedRoutes = dependencies.recoverWorkerCutover ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, snapshot.workerName);
+				const recoveryConfig = mergePlatformWorkerTrafficConfig({
+					...configs[key],
+					name: snapshot.workerName
+				}, preservedRoutes);
+				const previousRecoveryConfig = mergePlatformWorkerTrafficConfig({
+					...previousConfigs[key],
+					name: snapshot.workerName
+				}, preservedRoutes);
+				if (dependencies.recoverWorkerCutover) await dependencies.recoverWorkerCutover({
+					key,
+					preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
+					previousVersionId: snapshot.previousVersionId,
+					stagedVersionId: snapshot.stagedVersionId,
+					workerName: snapshot.workerName
+				});
+				else {
+					const recoveryTraffic = isolatePlatformWorkerCustomDomains(recoveryConfig);
+					const previousRecoveryTraffic = isolatePlatformWorkerCustomDomains(previousRecoveryConfig);
+					await rollbackPlatformWorker({
+						accountId: plan.account.id,
+						activatedDeploymentId: null,
+						activatedVersionId: snapshot.stagedVersionId,
+						config: recoveryConfig,
+						nextTriggers: readTriggerConfigFromObject(recoveryTraffic.wranglerConfig),
+						previousConfig: previousRecoveryConfig,
+						previousCustomDomains: previousRecoveryTraffic.customDomains,
+						previousDeployment: null,
+						previousTriggers: mergePreservedTriggerRoutes(withoutPlatformCustomDomainTriggers(snapshot.previousTriggers), preservedRoutes),
+						previousVersionId: snapshot.previousVersionId,
+						preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
+						inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, `${key}-worker`, snapshot.workerName),
+						removeCustomDomains: async () => {
+							if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
+							await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([snapshot.workerName])));
+						},
+						publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
+						retainNewWorker: async () => {
+							await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+						},
+						runner: runPinnedPlatformWrangler,
+						workerExisted: snapshot.previousVersionId !== null,
+						workerName: snapshot.workerName
+					});
+				}
+			}
+			manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "restored", now());
+			manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0, now());
+			let retainedNewWorker = false;
+			for (const [, snapshot] of interruptedCutover.staged) {
+				if (snapshot.previousVersionId !== null) continue;
+				retainedNewWorker = true;
+			}
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			if (retainedNewWorker) {
+				if (!dependencies.replanWorkers) throw new Error("platform: Recovering retained Workers requires a fresh Cloudflare installation plan.");
+				workerActions = validateReplannedWorkerActions(plan, manifest, await dependencies.replanWorkers(manifest));
+			}
+		}
+		workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
+		if (workerSecretUpdateIntent) {
+			manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "pending", workerSecretUpdateIntent.id, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			workerSecretUpdateIntent = {
+				...workerSecretUpdateIntent,
+				generation: workerCutoverGeneration
+			};
+			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+		}
+		for (const key of [
+			"api",
+			"proxy",
+			"tail",
+			"dispatch"
+		]) {
+			dependencies.onProgress?.(`Deploying the ${key} service`);
+			const action = workerActions.find((entry) => entry.key === `${key}-worker`);
+			const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
+			manifest = recordProvisionIntent(manifest, action, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			await dependencies.revalidateBeforeWorkerDeploy(manifest, action);
+			const preservedRoutes = dependencies.deployWorker ? [] : action.action === "create" ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
+			const workerConfig = mergePlatformWorkerTrafficConfig(configs[key], preservedRoutes);
+			const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
+			const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
+				apiBaseUrl: cloudflareApiBaseUrl,
+				onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
+					manifest = recordWorkerCutoverStage(manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				},
+				onTrafficPublished: async () => {
+					if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) throw new Error("platform: Cloudflare traffic inventory is unavailable.");
+					const [customDomains, routes] = await Promise.all([dependencies.client.listWorkerDomains(plan.account.id), zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
+					manifest = recordPlatformWorkerTraffic(manifest, action.name, {
+						customDomains,
+						routes
+					}, now());
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				},
+				onUnsafeTraffic: async () => {
+					manifest = recordWorkerUnsafeTraffic(manifest, workerCutoverGeneration, key, action.name, now());
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				},
+				managedRoutes: preserveDisabled ? [] : managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
+				preservedRoutes,
+				publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
+				publishRoutes: async (workerName, patterns) => {
+					if (!dependencies.client.publishWorkerRoutesSafely) throw new Error("platform: Safe Cloudflare Worker route publication is unavailable.");
+					if (zoneId) await dependencies.client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
+					else if (patterns.length > 0) throw new Error("platform: Cannot publish zone routes in workers.dev mode.");
+				},
+				previousConfig: previousWorkerConfig,
+				previousPublicEndpoints,
+				inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, action.key, action.name),
+				removeCustomDomains: async () => {
+					if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
+					await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([action.name])));
+				},
+				retainNewWorker: async () => {
+					await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+				},
+				runner: runPinnedPlatformWrangler,
+				workerExisted: action.action !== "create"
+			});
+			if (rollback) workerRollbacks.push(rollback);
+			manifest = recordResource(manifest, action, action.name, "created", now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
+		manifest = setInstallationEndpoints(manifest, {
+			apiUrl: plan.apiUrl,
+			dashboardUrl: null,
+			proxyUrl: plan.proxyUrl
+		}, now());
+		if (preserveDisabled) {
+			workerDeploymentCommitted = true;
+			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
+			if (workerSecretUpdateIntent) manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "committed", workerSecretUpdateIntent.id, now());
+			manifest = {
+				...manifest,
+				platformVersion: version,
+				runtime: runtimeProvenance,
+				updatedAt: now(),
+				usageProtocolVersion: targetUsageProtocolVersion
+			};
+			manifest = transitionInstallation(manifest, "disabled", now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets));
+			promoteInstallationSecrets(manifest);
+			saveInstalledPlatformConnection(plan, manifest);
+			return {
+				manifest,
+				waitingForDns: false,
+				waitingForSandboxDrain: false,
+				zoneNameServers: zone?.nameServers ?? []
+			};
+		}
+		manifest = transitionInstallation(manifest, "verifying", now());
+		writeInstallationManifest(manifest);
+		dependencies.onProgress?.("Verifying platform health");
+		const healthCheckContext = {
+			accountName: plan.account.name,
+			workers: [
+				plan.deployment.resources.apiWorker,
+				plan.deployment.resources.proxyWorker,
+				plan.deployment.resources.dispatchWorker
+			],
+			resumeCommand: dependencies.healthCheckResumeCommand
+		};
+		await (dependencies.verifyHealth ?? verifyPlatformHealth)(plan.apiUrl, manifest.id, plan.proxyUrl, plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(manifest.ownershipNonce), void 0, !plan.deployment.application.zoneName ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev` : void 0, healthCheckContext);
+		if (requiresSandboxDrain) {
+			if (!await (dependencies.verifySandboxDrain ?? verifyPlatformSandboxDrain)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce))) {
+				manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+				manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
+				manifest = recordInstallationStep(manifest, {
+					completedAt: now(),
+					key: "sandbox-drain:maintenance-runtime:v1",
+					resultHash: resolvedRuntime.manifestSha256
+				}, now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				workerRollbacks = [];
+				workerDeploymentCommitted = true;
+				saveInstalledPlatformConnection(plan, manifest);
+				return {
+					manifest,
+					waitingForDns: false,
+					waitingForSandboxDrain: true,
+					zoneNameServers: zone?.nameServers ?? []
+				};
+			}
+			const completedDrain = await prepareSandboxDrain();
+			if (completedDrain.state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
+			await writeSandboxDrainMirror(completedDrain);
+		}
+		if (requiresStagedCommit) {
+			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			workerRollbacks = [];
+			workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
+			if (workerSecretUpdateIntent) {
+				manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "pending", workerSecretUpdateIntent.id, now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				workerSecretUpdateIntent = {
+					...workerSecretUpdateIntent,
+					generation: workerCutoverGeneration
+				};
+				writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+			}
+			for (const key of [
+				"api",
+				"proxy",
+				"tail",
+				"dispatch"
+			]) {
+				dependencies.onProgress?.(`Enabling the ${key} service`);
+				const action = workerActions.find((entry) => entry.key === `${key}-worker`);
+				const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
+				const preservedRoutes = dependencies.deployWorker ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
+				const workerConfig = mergePlatformWorkerTrafficConfig(enabledConfigs[key], preservedRoutes);
+				const previousWorkerConfig = mergePlatformWorkerTrafficConfig(configs[key], preservedRoutes);
+				const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
+					apiBaseUrl: cloudflareApiBaseUrl,
+					onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
+						manifest = recordWorkerCutoverStage(manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					},
+					onTrafficPublished: async () => {
+						if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) throw new Error("platform: Cloudflare traffic inventory is unavailable.");
+						const [customDomains, routes] = await Promise.all([dependencies.client.listWorkerDomains(plan.account.id), zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
+						manifest = recordPlatformWorkerTraffic(manifest, action.name, {
+							customDomains,
+							routes
+						}, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					},
+					onUnsafeTraffic: async () => {
+						manifest = recordWorkerUnsafeTraffic(manifest, workerCutoverGeneration, key, action.name, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					},
+					managedRoutes: managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
+					preservedRoutes,
+					publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
+					publishRoutes: async (workerName, patterns) => {
+						if (!dependencies.client.publishWorkerRoutesSafely) throw new Error("platform: Safe Cloudflare Worker route publication is unavailable.");
+						if (zoneId) await dependencies.client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
+						else if (patterns.length > 0) throw new Error("platform: Cannot publish zone routes in workers.dev mode.");
+					},
+					previousConfig: previousWorkerConfig,
+					previousPublicEndpoints: true,
+					inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, action.key, action.name),
+					removeCustomDomains: async () => {
+						if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
+						await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([action.name])));
+					},
+					retainNewWorker: async () => {
+						await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+					},
+					runner: runPinnedPlatformWrangler,
+					workerExisted: true
+				});
+				if (rollback) workerRollbacks.push(rollback);
+			}
+		}
+		const verifyCurrentWorkerCutover = async () => {
+			if (!requiresStagedCommit) return;
+			if (dependencies.verifyWorkerCutover) await dependencies.verifyWorkerCutover(manifest, workerCutoverGeneration);
+			else if (!dependencies.deployWorker) await verifyPlatformWorkerCutoverVersions(manifest, workerCutoverGeneration, enabledConfigs, plan.account.id, runPinnedPlatformWrangler);
+		};
+		await verifyCurrentWorkerCutover();
+		if (dependencies.client.deleteKvValue) await dependencies.client.deleteKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY);
+		else if (wasDisabled || !previousPublicEndpoints) throw new Error("platform: Routing disablement removal is unavailable.");
+		if (requiresStagedCommit) {
+			dependencies.onProgress?.("Verifying the enabled platform");
+			await (dependencies.verifyHealth ?? verifyPlatformHealth)(plan.apiUrl, manifest.id, plan.proxyUrl, plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(manifest.ownershipNonce), void 0, !plan.deployment.application.zoneName ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev` : void 0, healthCheckContext);
+			await verifyCurrentWorkerCutover();
+		}
+		workerDeploymentCommitted = true;
+		manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+		manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, true, now());
+		if (workerSecretUpdateIntent) manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "committed", workerSecretUpdateIntent.id, now());
+		manifest = {
+			...manifest,
+			platformVersion: version,
+			runtime: runtimeProvenance,
+			safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
+			updatedAt: now(),
+			usageProtocolVersion: targetUsageProtocolVersion
+		};
+		manifest = transitionInstallation(manifest, "installed", now());
+		writeInstallationManifest(manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		workerTrafficGuarded = false;
+		writePendingInstallationSecrets(manifest, secretCheckpoint(secrets));
+		promoteInstallationSecrets(manifest);
+		saveInstalledPlatformConnection(plan, manifest);
+		return {
+			manifest,
+			waitingForDns: false,
+			waitingForSandboxDrain: false,
+			zoneNameServers: zone?.nameServers ?? []
+		};
+	} catch (error) {
+		let failure = error;
+		const currentWorkerRecoveryIncomplete = error instanceof PlatformWorkerRecoveryIncompleteError;
+		if (workerTrafficGuarded) try {
+			await dependencies.client.putKvValue(plan.account.id, requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+		} catch (guardError) {
+			failure = new Error(`platform: ${errorMessage(error)} The installation also failed to retain its routing safety gate: ${errorMessage(guardError)}`, { cause: error });
+		}
+		if (!workerDeploymentCommitted && workerRollbacks.length > 0) {
+			const rollbackFailures = [];
+			for (const rollback of workerRollbacks.reverse()) try {
+				await rollback();
+			} catch (rollbackError) {
+				rollbackFailures.push(errorMessage(rollbackError));
+			}
+			workerRollbacks = [];
+			if (rollbackFailures.length > 0 || currentWorkerRecoveryIncomplete) failure = new Error(rollbackFailures.length > 0 ? `platform: ${errorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join("; ")} Inspect the installation before retrying.` : `platform: ${errorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`, { cause: error });
+			else if (workerCutoverGeneration > 0) {
+				manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "restored", now());
+				manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, previousPublicEndpoints, now());
+				writeInstallationManifest(manifest);
+			}
+		}
+		if (manifest.status !== "failed" && manifest.status !== "uninstalled") try {
+			manifest = transitionInstallation(manifest, "failed", now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		} catch {}
+		throw failure;
+	} finally {
+		await releaseDatabaseLock();
+	}
+}
+async function writeR2OwnershipMarkerIfNeeded(client, plan, manifest, action) {
+	if (action.kind !== "r2-bucket") return;
+	const bucket = manifest.resources.find((resource) => resource.key === action.key && resource.state === "ready");
+	if (!bucket || bucket.ownership !== "created") return;
+	await client.putR2Object(plan.account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY, JSON.stringify(createPlatformResourceOwnershipMarker({
+		accountId: plan.account.id,
+		installationId: manifest.id,
+		ownershipNonce: manifest.ownershipNonce,
+		resourceId: bucket.id,
+		resourceKey: bucket.key,
+		resourceKind: bucket.kind,
+		resourceName: bucket.name
+	})));
+}
+function saveInstalledPlatformConnection(plan, manifest) {
+	savePlatformConnection({
+		accountId: plan.account.id,
+		apiUrl: plan.apiUrl,
+		applicationDomain: plan.deployment.application.baseDomain,
+		displayName: plan.deployment.displayName,
+		installationId: manifest.id,
+		kind: "installed",
+		proxyUrl: plan.proxyUrl
+	});
+}
+async function writeRemoteInstallationCheckpointWithoutDatabase(client, plan, manifest, databaseLock) {
+	await databaseLock?.checkpoint?.(manifest);
+	const routing = manifest.resources.find((resource) => resource.key === "routing-kv" && resource.kind === "kv-namespace" && resource.ownership === "created" && resource.state === "ready");
+	if (!routing) return;
+	await client.putKvValue(plan.account.id, routing.id, REMOTE_INSTALLATION_MANIFEST_KEY, JSON.stringify(manifest));
+}
+function recordProvisionIntent(manifest, action, now) {
+	const previousResourceId = manifest.resources.find((resource) => resource.key === action.key)?.id ?? null;
+	const resultHash = platformProvisionIntentHash(manifest, action.key, action.kind, action.name, previousResourceId);
+	if (manifest.steps.find((step) => (step.key === `provision-intent:${action.key}` || step.key.startsWith(`provision-intent:${action.key}:`)) && step.resultHash === resultHash)) return manifest;
+	return recordInstallationStep(manifest, {
+		completedAt: now,
+		key: `provision-intent:${action.key}:${resultHash.slice(0, 16)}`,
+		resultHash
+	}, now);
+}
+function recordAdoptionIntent(manifest, action, id, now) {
+	return recordInstallationStep(manifest, {
+		completedAt: now,
+		key: `adoption-intent:${action.key}`,
+		resultHash: platformAdoptionIntentHash(manifest, action.key, action.kind, id, action.name)
+	}, now);
+}
+function hasProvisionIntent(manifest, action) {
+	const previousResourceId = manifest.resources.find((resource) => resource.key === action.key)?.id ?? null;
+	return manifest.steps.some((step) => (step.key === `provision-intent:${action.key}` || step.key.startsWith(`provision-intent:${action.key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, action.key, action.kind, action.name, previousResourceId));
+}
+async function createResource(client, plan, action, databaseUrl, zoneId) {
+	switch (action.kind) {
+		case "ai-gateway": return client.createAiGateway(plan.account.id, action.name);
+		case "dns-record": return client.createDnsRecord(zoneId, action.name);
+		case "kv-namespace": return client.createKvNamespace(plan.account.id, action.name);
+		case "r2-bucket": return client.createR2Bucket(plan.account.id, action.name);
+		case "queue": return client.createQueue(plan.account.id, action.name);
+		case "dispatch-namespace": return client.createDispatchNamespace(plan.account.id, action.name);
+		case "hyperdrive": return client.createHyperdrive(plan.account.id, action.name, databaseUrl);
+		default: throw new Error(`platform: Cannot provision ${action.kind} in the resource phase.`);
+	}
+}
+function recordResource(manifest, action, id, ownership, now, databaseUrl, resourceFingerprint) {
+	const previous = manifest.resources.find((resource) => resource.key === action.key);
+	return recordInstallationResource(manifest, {
+		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : hash(JSON.stringify({
+			kind: action.kind,
+			name: action.name
+		})),
+		id,
+		key: action.key,
+		kind: action.kind,
+		name: action.name,
+		ownership: ownership ?? previous?.ownership ?? "created",
+		state: "ready"
+	}, now);
+}
+function r2BucketConfigHash(name, fingerprint) {
+	return hash(JSON.stringify({
+		fingerprint,
+		kind: "r2-bucket",
+		name
+	}));
+}
+function retainReplacedInstallationResource(manifest, action, now) {
+	const previous = manifest.resources.find((resource) => resource.key === action.key);
+	if (action.action !== "create" || !previous || previous.state !== "ready" || previous.name === action.name) return manifest;
+	const retainedKey = `retained:${action.key}:${hash(previous.id).slice(0, 16)}`;
+	const resources = manifest.resources.filter((resource) => resource.key !== action.key && resource.key !== retainedKey).concat({
+		...previous,
+		key: retainedKey,
+		state: "retained"
+	}).sort((left, right) => left.key.localeCompare(right.key));
+	return {
+		...manifest,
+		resources,
+		updatedAt: now
+	};
+}
+function validateReplannedWorkerActions(original, manifest, actions) {
+	const expected = original.actions.filter((action) => action.kind === "worker");
+	if (actions.length !== expected.length) throw new Error("platform: Fresh Cloudflare planning did not return every platform Worker.");
+	for (const previous of expected) {
+		const matches = actions.filter((action) => action.key === previous.key);
+		const current = matches[0];
+		if (matches.length !== 1 || !current || current.kind !== "worker" || current.name !== previous.name) throw new Error(`platform: Fresh Cloudflare planning changed the identity of Worker ${JSON.stringify(previous.name)}.`);
+		if (manifest.resources.find((entry) => entry.key === current.key)?.state === "deleted" && current.action !== "create") throw new Error(`platform: Fresh Cloudflare planning did not recreate deleted Worker ${JSON.stringify(current.name)}.`);
+	}
+	return actions;
+}
+async function inventoryUnmanagedPlatformWorkerTraffic(client, plan, workerName) {
+	if (!client.listWorkerDomains || !client.listWorkerServiceRoutes) throw new Error(`platform: Cloudflare traffic inventory is required before updating Worker ${JSON.stringify(workerName)}.`);
+	const [routes, domains] = await Promise.all([client.listWorkerServiceRoutes(plan.account.id, workerName), client.listWorkerDomains(plan.account.id)]);
+	const managed = platformManagedWorkerTraffic(plan.deployment, /* @__PURE__ */ new Set([workerName]));
+	const managedRoutes = new Set(managed.routes.map((route) => route.pattern));
+	const managedDomains = new Set(managed.customDomains.map((domain) => domain.hostname));
+	return uniqueTriggerRoutes([...routes.filter((route) => !managedRoutes.has(route.pattern)).map((route) => ({
+		pattern: route.pattern,
+		zone_name: route.zoneName
+	})), ...domains.filter((domain) => domain.service === workerName && !managedDomains.has(domain.hostname)).map((domain) => ({
+		pattern: domain.hostname,
+		custom_domain: true,
+		...domain.zoneName ? { zone_name: domain.zoneName } : {}
+	}))]);
+}
+function mergePlatformWorkerTrafficConfig(config, preservedRoutes) {
+	if (preservedRoutes.length === 0) return config;
+	return {
+		...config,
+		routes: uniqueTriggerRoutes([...Array.isArray(config.routes) ? config.routes : [], ...preservedRoutes])
+	};
+}
+function mergePreservedTriggerRoutes(config, preservedRoutes) {
+	return preservedRoutes.length === 0 ? config : {
+		...config,
+		routes: uniqueTriggerRoutes([...config.routes, ...preservedRoutes])
+	};
+}
+function isolatePlatformWorkerCustomDomains(config) {
+	if (config.routes === void 0) return {
+		customDomains: [],
+		wranglerConfig: config
+	};
+	if (!Array.isArray(config.routes)) throw new Error("platform: Generated Worker routes must be an array.");
+	const customDomains = [];
+	const wranglerRoutes = [];
+	for (const route of config.routes) {
+		if (typeof route !== "object" || route === null || route.custom_domain !== true) {
+			wranglerRoutes.push(route);
+			continue;
+		}
+		const entry = route;
+		const hostname = requiredNonEmptyString(entry.pattern, "Worker Custom Domain hostname");
+		customDomains.push({
+			hostname,
+			...entry.zone_id === void 0 ? {} : { zoneId: requiredNonEmptyString(entry.zone_id, `zone id for ${hostname}`) },
+			...entry.zone_name === void 0 ? {} : { zoneName: requiredNonEmptyString(entry.zone_name, `zone name for ${hostname}`) },
+			...entry.enabled === void 0 ? {} : { enabled: requiredBoolean(entry.enabled, `enabled for ${hostname}`) },
+			...entry.previews_enabled === void 0 ? {} : { previewsEnabled: requiredBoolean(entry.previews_enabled, `previews_enabled for ${hostname}`) }
+		});
+	}
+	return {
+		customDomains,
+		wranglerConfig: {
+			...config,
+			routes: wranglerRoutes
+		}
+	};
+}
+function withoutPlatformWorkerTrafficAttachments(config) {
+	const isolated = { ...config };
+	delete isolated.route;
+	delete isolated.routes;
+	return isolated;
+}
+function withoutPlatformCustomDomainTriggers(config) {
+	return {
+		...config,
+		routes: config.routes.filter((route) => typeof route !== "object" || route === null || route.custom_domain !== true)
+	};
+}
+function requiredNonEmptyString(value, field) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`platform: ${field} must be a non-empty string.`);
+	return value;
+}
+function requiredBoolean(value, field) {
+	if (typeof value !== "boolean") throw new Error(`platform: ${field} must be a boolean.`);
+	return value;
+}
+async function publishPlatformWorkerCustomDomains(client, accountId, workerName, origins) {
+	if (!client.publishWorkerCustomDomainsSafely) throw new Error("platform: Safe Cloudflare Custom Domain publication is unavailable.");
+	await client.publishWorkerCustomDomainsSafely(accountId, workerName, origins);
+}
+function uniqueTriggerRoutes(routes) {
+	const seen = /* @__PURE__ */ new Set();
+	return routes.filter((route) => {
+		const key = JSON.stringify(route);
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function dnsRecordConfigHash(name, type, content, proxied) {
+	return hash(JSON.stringify({
+		content,
+		kind: "dns-record",
+		name,
+		proxied,
+		type
+	}));
+}
+function hash(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function databaseInteger(value) {
+	if (typeof value === "number" && Number.isSafeInteger(value)) return value;
+	if (typeof value === "bigint") {
+		const number = Number(value);
+		return Number.isSafeInteger(number) ? number : null;
+	}
+	if (typeof value === "string" && /^[0-9]+$/.test(value)) {
+		const number = Number(value);
+		return Number.isSafeInteger(number) ? number : null;
+	}
+	return null;
+}
+function requireId(ids, key) {
+	const id = ids[key];
+	if (!id) throw new Error(`platform: Installation manifest is missing ${key}.`);
+	return id;
+}
+function apiWorkerSecrets(secrets, accountId, zoneId) {
+	return withoutEmptySecrets({
+		CF_ACCOUNT_ID: accountId,
+		CF_API_TOKEN: secrets.cloudflareApiToken,
+		CF_ZONE_ID: zoneId,
+		GITHUB_CLIENT_ID: secrets.githubClientId,
+		GITHUB_CLIENT_SECRET: secrets.githubClientSecret,
+		JWT_SECRET: secrets.jwtSecret,
+		PLATFORM_BOOTSTRAP_GITHUB_ID: secrets.bootstrapGitHubId,
+		...secrets.projectSecretKeysJson && secrets.projectSecretActiveKeyVersion ? {
+			PROJECT_SECRET_ACTIVE_KEY_VERSION: secrets.projectSecretActiveKeyVersion,
+			PROJECT_SECRET_KEYS_JSON: secrets.projectSecretKeysJson
+		} : {},
+		R2_ACCESS_KEY_ID: secrets.r2AccessKeyId,
+		R2_SECRET_ACCESS_KEY: secrets.r2SecretAccessKey
+	});
+}
+/** Existing Workers inherit live secrets, including complete encryption keyrings. */
+function platformWorkerSecretPayload(worker, secrets, accountId, zoneId, existingWorker) {
+	if (worker !== "api" && worker !== "proxy") return null;
+	if (!existingWorker) return worker === "api" ? apiWorkerSecrets(secrets, accountId, zoneId) : proxyWorkerSecrets(secrets, accountId);
+	const allowed = worker === "api" ? [
+		"CF_API_TOKEN",
+		"GITHUB_CLIENT_ID",
+		"GITHUB_CLIENT_SECRET",
+		"R2_ACCESS_KEY_ID",
+		"R2_SECRET_ACCESS_KEY"
+	] : ["CF_API_TOKEN"];
+	const updates = Object.fromEntries(Object.entries(secrets.workerSecretUpdates ?? {}).filter(([name, value]) => allowed.includes(name) && typeof value === "string" && value !== ""));
+	return Object.keys(updates).length > 0 ? updates : null;
+}
+async function resolveBootstrapGitHubId(login, fetcher = fetch) {
+	const normalizedLogin = login.trim();
+	if (!normalizedLogin) throw new Error("platform: VOID_PLATFORM_ADMIN_GITHUB_LOGIN is required.");
+	const response = await fetcher(`https://api.github.com/users/${encodeURIComponent(normalizedLogin)}`, {
+		headers: {
+			Accept: "application/vnd.github+json",
+			"User-Agent": "void-platform-installer"
+		},
+		redirect: "follow",
+		signal: AbortSignal.timeout(15e3)
+	});
+	if (!response.ok) throw new Error(`platform: Could not resolve GitHub user ${JSON.stringify(normalizedLogin)} (HTTP ${response.status}). Verify the username and retry.`);
+	const body = await response.json();
+	const id = typeof body.id === "number" && Number.isSafeInteger(body.id) ? String(body.id) : "";
+	if (!/^[1-9][0-9]*$/.test(id)) throw new Error("platform: GitHub returned an invalid account id for the initial administrator.");
+	return id;
+}
+function proxyWorkerSecrets(secrets, accountId) {
+	return withoutEmptySecrets({
+		CF_ACCOUNT_ID: accountId,
+		CF_API_TOKEN: secrets.cloudflareApiToken,
+		JWT_SECRET: secrets.jwtSecret
+	});
+}
+function withoutEmptySecrets(secrets) {
+	return Object.fromEntries(Object.entries(secrets).filter(([, value]) => value !== ""));
+}
+function assertRequiredPlatformSecrets(plan, manifest, secrets) {
+	const missing = /* @__PURE__ */ new Set();
+	const requireSecret = (value, name) => {
+		if (!value) missing.add(name);
+	};
+	if (!manifest.steps.some((step) => step.key === "bootstrap-access:v1")) {
+		requireSecret(secrets.bootstrapGitHubId, "VOID_PLATFORM_ADMIN_GITHUB_ID");
+		requireSecret(secrets.bootstrapGitHubLogin, "VOID_PLATFORM_ADMIN_GITHUB_LOGIN");
+	}
+	if (plan.actions.some((action) => action.key === "api-worker" && action.kind === "worker" && action.action === "create")) {
+		requireSecret(secrets.cloudflareApiToken, "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN");
+		requireSecret(secrets.githubClientId, "VOID_PLATFORM_GITHUB_CLIENT_ID");
+		requireSecret(secrets.githubClientSecret, "VOID_PLATFORM_GITHUB_CLIENT_SECRET");
+		requireSecret(secrets.jwtSecret, "VOID_PLATFORM_JWT_SECRET");
+		requireSecret(secrets.projectSecretKeysJson, "VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON (or VOID_PLATFORM_PROJECT_SECRET_KEY for v1)");
+		requireSecret(secrets.projectSecretActiveKeyVersion, "VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION (or VOID_PLATFORM_PROJECT_SECRET_KEY for v1)");
+		requireSecret(secrets.r2AccessKeyId, "VOID_PLATFORM_R2_ACCESS_KEY_ID");
+		requireSecret(secrets.r2SecretAccessKey, "VOID_PLATFORM_R2_SECRET_ACCESS_KEY");
+	}
+	if (plan.actions.some((action) => action.key === "proxy-worker" && action.kind === "worker" && action.action === "create")) {
+		requireSecret(secrets.cloudflareApiToken, "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN");
+		requireSecret(secrets.jwtSecret, "VOID_PLATFORM_JWT_SECRET");
+	}
+	if (missing.size > 0) throw new Error(`platform: Creating a missing platform Worker requires: ${[...missing].sort().join(", ")}. Restore these values from your secret manager and retry.`);
+}
+/** Make pg's current strict TLS behavior explicit without rewriting saved connection details. */
+function platformDatabaseClientUrl(databaseUrl) {
+	let url;
+	try {
+		url = new URL(databaseUrl);
+	} catch {
+		return databaseUrl;
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:" || url.searchParams.getAll("sslmode").at(-1) !== "require" || url.searchParams.getAll("uselibpqcompat").at(-1) === "true") return databaseUrl;
+	url.searchParams.set("sslmode", "verify-full");
+	return url.toString();
+}
+async function claimPlatformDatabase(databaseUrl, installationId, ownershipNonce) {
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	const client = await pool.connect();
+	try {
+		await claimPlatformDatabaseConnection(client, installationId, ownershipNonce);
+	} finally {
+		client.release();
+		await pool.end();
+	}
+}
+async function acquirePlatformDatabaseLifecycleLock(databaseUrl, installationId, ownershipNonce) {
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	const client = await pool.connect();
+	try {
+		const releaseConnectionLock = await acquirePlatformDatabaseLifecycleLockConnection(client, installationId, ownershipNonce);
+		const release = async () => {
+			try {
+				await releaseConnectionLock();
+			} finally {
+				client.release();
+				await pool.end();
+			}
+		};
+		return Object.assign(release, releaseConnectionLock);
+	} catch (error) {
+		client.release();
+		await pool.end();
+		throw error;
+	}
+}
+async function readPlatformDatabaseLifecycleManifest(databaseUrl, installationId, ownershipNonce) {
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	try {
+		return await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
+	} catch (error) {
+		if (error instanceof Error && error.message.startsWith("platform:")) throw error;
+		throw new Error(`platform: Could not read the PostgreSQL lifecycle checkpoint: ${error instanceof Error ? error.message : String(error)}`);
+	} finally {
+		await pool.end();
+	}
+}
+async function inspectPlatformDatabaseStateConnection(client, database) {
+	const relation = await client.query(`SELECT to_regclass('"drizzle"."__drizzle_migrations"')::text AS "relation"`);
+	if (relation.rows.length === 0 || relation.rows[0]?.relation === null) return {
+		pendingMigrations: database.migrations,
+		schemaDigest: platformDatabaseSchemaDigest(database.lineage, [])
+	};
+	const result = await client.query(`SELECT "id", "hash", "created_at"
+     FROM "drizzle"."__drizzle_migrations"
+     ORDER BY "created_at", "id"`);
+	if (result.rows.length > database.migrations.length) throw new Error("platform: PostgreSQL contains migrations newer than this Void Platform package.");
+	let previousTimestamp = -1;
+	const seenTimestamps = /* @__PURE__ */ new Set();
+	for (const [position, row] of result.rows.entries()) {
+		const timestampMillis = databaseInteger(row.created_at);
+		if (timestampMillis === null || timestampMillis <= previousTimestamp || seenTimestamps.has(timestampMillis)) throw new Error("platform: PostgreSQL migration history is duplicated or not strictly ordered.");
+		const expected = database.migrations[position];
+		if (!expected || timestampMillis !== expected.timestampMillis || row.hash !== expected.sha256) throw new Error("platform: PostgreSQL migration history is not an exact prefix of this Void Platform package. Refusing to apply edited, forked, or out-of-order migrations.");
+		previousTimestamp = timestampMillis;
+		seenTimestamps.add(timestampMillis);
+	}
+	const applied = database.migrations.slice(0, result.rows.length);
+	return {
+		pendingMigrations: database.migrations.slice(result.rows.length),
+		schemaDigest: platformDatabaseSchemaDigest(database.lineage, applied)
+	};
+}
+async function preparePlatformDatabaseConnection(client, runtimeDirectory, database, sourcePlatformVersion, hasPriorWorkers) {
+	verifyPlatformDatabaseArtifacts(runtimeDirectory, database);
+	const before = await inspectPlatformDatabaseStateConnection(client, database);
+	if (before.pendingMigrations.length === 0) {
+		if (before.schemaDigest !== database.schemaDigest) throw new Error("platform: PostgreSQL schema digest does not match the packaged runtime.");
+		return {
+			appliedMigrations: 0,
+			previousSchemaDigest: before.schemaDigest,
+			schemaDigest: before.schemaDigest
+		};
+	}
+	if (hasPriorWorkers && !database.rollbackSafeFrom.some((entry) => entry.platformVersion === sourcePlatformVersion && entry.schemaDigest === before.schemaDigest)) throw new Error(`platform: Void Platform ${sourcePlatformVersion ?? "unknown"} cannot safely roll back after migrating database schema ${before.schemaDigest} to this release. Upgrade through a supported intermediate version or install into a fresh database.`);
+	await client.query("BEGIN");
+	try {
+		await client.query("CREATE SCHEMA IF NOT EXISTS \"drizzle\"");
+		await client.query(`
+      CREATE TABLE IF NOT EXISTS "drizzle"."__drizzle_migrations" (
+        "id" serial PRIMARY KEY,
+        "hash" text NOT NULL,
+        "created_at" bigint
+      )
+    `);
+		const rechecked = await inspectPlatformDatabaseStateConnection(client, database);
+		if (rechecked.schemaDigest !== before.schemaDigest) throw new Error("platform: PostgreSQL migration history changed while preparing this upgrade.");
+		for (const migration of rechecked.pendingMigrations) {
+			const sql = readFileSync(join(runtimeDirectory, "drizzle", `${migration.tag}.sql`), "utf8");
+			for (const statement of sql.split("--> statement-breakpoint").map((value) => value.trim()).filter(Boolean)) await client.query(statement);
+			await client.query(`INSERT INTO "drizzle"."__drizzle_migrations" ("hash", "created_at")
+         VALUES ($1, $2)`, [migration.sha256, migration.timestampMillis]);
+		}
+		await client.query("COMMIT");
+	} catch (error) {
+		await client.query("ROLLBACK").catch(() => ({ rows: [] }));
+		throw error;
+	}
+	const after = await inspectPlatformDatabaseStateConnection(client, database);
+	if (after.pendingMigrations.length !== 0 || after.schemaDigest !== database.schemaDigest) throw new Error("platform: PostgreSQL migration transaction completed without reaching the packaged schema.");
+	return {
+		appliedMigrations: before.pendingMigrations.length,
+		previousSchemaDigest: before.schemaDigest,
+		schemaDigest: after.schemaDigest
+	};
+}
+async function readPlatformDatabaseLifecycleManifestConnection(client, installationId, ownershipNonce) {
+	const relation = await client.query(`SELECT to_regclass('"__void_platform_installation"')::text AS "relation"`);
+	if (relation.rows[0]?.relation === null || relation.rows.length === 0) return null;
+	const result = await client.query(`SELECT "installation_id", "ownership_nonce", "lifecycle_manifest"
+     FROM "__void_platform_installation"
+     WHERE "singleton" = true`);
+	const row = result.rows[0];
+	if (result.rows.length !== 1 || row?.installation_id !== installationId || row.ownership_nonce !== ownershipNonce) throw new Error("platform: The PostgreSQL database ownership claim does not match this installation.");
+	if (row.lifecycle_manifest === null || row.lifecycle_manifest === void 0) return null;
+	const manifest = parsePlatformInstallationManifest(row.lifecycle_manifest);
+	if (manifest.id !== installationId || manifest.ownershipNonce !== ownershipNonce) throw new Error("platform: The PostgreSQL lifecycle checkpoint does not match this installation.");
+	return manifest;
+}
+async function acquirePlatformDatabaseLifecycleLockConnection(client, installationId, ownershipNonce) {
+	await client.query(`ALTER TABLE "__void_platform_installation"
+     ADD COLUMN IF NOT EXISTS "lifecycle_manifest" jsonb`);
+	const owner = (await client.query(`SELECT "installation_id", "ownership_nonce"
+     FROM "__void_platform_installation"
+     WHERE "singleton" = true`)).rows[0];
+	if (!owner || owner.installation_id !== installationId || owner.ownership_nonce !== ownershipNonce) throw new Error("platform: The PostgreSQL database ownership claim does not match this installation.");
+	const lockIdentity = `void-platform-lifecycle-v1:${installationId}:${ownershipNonce}`;
+	if ((await client.query("SELECT pg_try_advisory_lock(hashtextextended($1, 0)) AS \"acquired\"", [lockIdentity])).rows[0]?.acquired !== true) throw new Error(`platform: Another lifecycle operation is active for installation ${installationId} on another host.`);
+	let authoritativeManifest = null;
+	try {
+		const checkpoint = await client.query(`SELECT "lifecycle_manifest"
+       FROM "__void_platform_installation"
+       WHERE "singleton" = true
+         AND "installation_id" = $1
+         AND "ownership_nonce" = $2`, [installationId, ownershipNonce]);
+		const value = checkpoint.rows[0]?.lifecycle_manifest;
+		if (checkpoint.rows.length !== 1) throw new Error("platform: The PostgreSQL database ownership claim changed unexpectedly.");
+		if (value !== null && value !== void 0) {
+			authoritativeManifest = parsePlatformInstallationManifest(value);
+			if (authoritativeManifest.id !== installationId || authoritativeManifest.ownershipNonce !== ownershipNonce) throw new Error("platform: The PostgreSQL lifecycle checkpoint does not match this installation.");
+		}
+	} catch (error) {
+		await client.query("SELECT pg_advisory_unlock(hashtextextended($1, 0))", [lockIdentity]);
+		if (error instanceof Error && error.message.startsWith("platform:")) throw error;
+		throw new Error(`platform: The PostgreSQL lifecycle checkpoint is invalid: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	let released = false;
+	const release = async () => {
+		if (released) return;
+		released = true;
+		await client.query("SELECT pg_advisory_unlock(hashtextextended($1, 0))", [lockIdentity]);
+	};
+	release.authoritativeManifest = authoritativeManifest;
+	release.requiredSafetyProtocols = await readRequiredPlatformSafetyProtocols(client);
+	release.checkpoint = async (manifest) => {
+		if (released) throw new Error("platform: Cannot checkpoint lifecycle state after releasing its lock.");
+		if (manifest.id !== installationId || manifest.ownershipNonce !== ownershipNonce) throw new Error("platform: Refusing to checkpoint lifecycle state for another installation.");
+		if ((await client.query(`UPDATE "__void_platform_installation"
+       SET "lifecycle_manifest" = $1::jsonb
+       WHERE "singleton" = true
+         AND "installation_id" = $2
+         AND "ownership_nonce" = $3
+       RETURNING "singleton"`, [
+			JSON.stringify(manifest),
+			installationId,
+			ownershipNonce
+		])).rows.length !== 1) throw new Error("platform: The PostgreSQL database ownership claim changed unexpectedly.");
+		release.authoritativeManifest = manifest;
+	};
+	release.prepareDatabase = (runtimeDirectory, database, sourcePlatformVersion, hasPriorWorkers) => preparePlatformDatabaseConnection(client, runtimeDirectory, database, sourcePlatformVersion, hasPriorWorkers);
+	release.prepareSandboxDrain = (requiredAdmissionProtocol) => preparePlatformSandboxDrainConnection(client, requiredAdmissionProtocol);
+	release.verifyDatabase = (runtimeDirectory, database) => verifyPlatformDatabaseConnection(client, runtimeDirectory, database);
+	return release;
+}
+async function preparePlatformSandboxDrainConnection(client, requiredAdmissionProtocol = 0) {
+	if (!(await client.query(`SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`)).rows[0]?.relation) throw new Error("platform: Runtime declares sandbox-drain safety but its database checkpoint table is missing.");
+	const hasAdmissionColumn = (await client.query(`SELECT EXISTS(
+       SELECT 1
+       FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'sandbox_drain_checkpoints'
+         AND column_name = 'admission_protocol'
+     ) AS "present"`)).rows[0]?.present === true;
+	if (requiredAdmissionProtocol === 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
+	const readCheckpoint = () => client.query(`SELECT ${hasAdmissionColumn ? "\"admission_protocol\"" : "0 AS \"admission_protocol\""}, "generation", "state", "phase", "cursor", "started_at", "updated_at", "completed_at"
+       FROM "sandbox_drain_checkpoints"
+       WHERE "singleton" = true`);
+	const classify = (row) => {
+		if (!row) return null;
+		const cursor = row.cursor;
+		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
+		return {
+			admissionProtocol: row.admission_protocol,
+			generation: row.generation,
+			mirrorValue: JSON.stringify({
+				version: 1,
+				generation: row.generation,
+				state: row.state,
+				startedAt: row.started_at,
+				updatedAt: row.updated_at,
+				...row.completed_at ? { completedAt: row.completed_at } : {}
+			}),
+			state: row.state === "complete" ? "complete" : "pending"
+		};
+	};
+	const existingState = classify((await readCheckpoint()).rows[0]);
+	if (existingState && (requiredAdmissionProtocol === 0 || existingState.admissionProtocol >= requiredAdmissionProtocol)) return existingState;
+	if (requiredAdmissionProtocol === 2) {
+		const generation = randomUUID();
+		await client.query("BEGIN");
+		try {
+			await client.query("LOCK TABLE \"deployments\" IN SHARE MODE");
+			await client.query(`INSERT INTO "sandbox_drain_checkpoints" (
+           "singleton", "admission_protocol", "generation", "state", "phase", "cursor"
+         ) VALUES (true, 2, $1, 'draining', 'deployments', '{"pass":"1"}'::jsonb)
+         ON CONFLICT ("singleton") DO UPDATE
+         SET "admission_protocol" = 2,
+             "generation" = EXCLUDED."generation",
+             "state" = 'draining',
+             "phase" = 'deployments',
+             "cursor" = '{"pass":"1"}'::jsonb,
+             "lease_owner" = NULL,
+             "lease_expires_at" = NULL,
+             "started_at" = now(),
+             "updated_at" = now(),
+             "completed_at" = NULL`, [generation]);
+			if ((await client.query(`SELECT
+           NOT EXISTS(SELECT 1 FROM "deployments" LIMIT 1)
+           AND NOT EXISTS(SELECT 1 FROM "resources" WHERE "type" = 'container' LIMIT 1)
+           AS "empty"`)).rows[0]?.empty === true) await client.query(`UPDATE "sandbox_drain_checkpoints"
+           SET "state" = 'complete',
+               "phase" = 'resources',
+               "cursor" = '{"pass":"2"}'::jsonb,
+               "lease_owner" = NULL,
+               "lease_expires_at" = NULL,
+               "updated_at" = now(),
+               "completed_at" = now()
+           WHERE "singleton" = true
+             AND "admission_protocol" = 2
+             AND "generation" = $1`, [generation]);
+			const armed = classify((await readCheckpoint()).rows[0]);
+			if (!armed || armed.admissionProtocol !== 2) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
+			await client.query("COMMIT");
+			return armed;
+		} catch (error) {
+			await client.query("ROLLBACK").catch(() => void 0);
+			throw error;
+		}
+	}
+	const empty = (await client.query(`SELECT
+       NOT EXISTS(SELECT 1 FROM "deployments" LIMIT 1)
+       AND NOT EXISTS(SELECT 1 FROM "resources" WHERE "type" = 'container' LIMIT 1)
+       AS "empty"`)).rows[0]?.empty === true;
+	const generation = randomUUID();
+	const state = empty ? "complete" : "draining";
+	const phase = empty ? "resources" : "deployments";
+	const cursor = JSON.stringify({ pass: empty ? "2" : "1" });
+	await client.query(`INSERT INTO "sandbox_drain_checkpoints" (
+       "singleton", "generation", "state", "phase", "cursor", "completed_at"
+     ) VALUES (true, $1, $2, $3, $4::jsonb, CASE WHEN $2 = 'complete' THEN now() ELSE NULL END)
+     ON CONFLICT ("singleton") DO NOTHING`, [
+		generation,
+		state,
+		phase,
+		cursor
+	]);
+	const preparedState = classify((await readCheckpoint()).rows[0]);
+	if (!preparedState) throw new Error("platform: The sandbox-drain database checkpoint could not be established.");
+	return preparedState;
+}
+async function verifyPlatformDatabaseConnection(client, runtimeDirectory, database) {
+	verifyPlatformDatabaseArtifacts(runtimeDirectory, database);
+	const state = await inspectPlatformDatabaseStateConnection(client, database);
+	if (state.pendingMigrations.length !== 0 || state.schemaDigest !== database.schemaDigest) throw new Error("platform: PostgreSQL is not at the exact forward-only schema recorded by the installed runtime.");
+}
+async function readRequiredPlatformSafetyProtocols(client) {
+	if (!(await client.query(`SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`)).rows[0]?.relation) return { sandboxDrain: 0 };
+	if ((await client.query(`SELECT EXISTS(
+       SELECT 1
+       FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'sandbox_drain_checkpoints'
+         AND column_name = 'admission_protocol'
+     ) AS "present"`)).rows[0]?.present === true) {
+		if ((await client.query(`SELECT EXISTS(
+         SELECT 1
+         FROM "sandbox_drain_checkpoints"
+         WHERE "singleton" = true
+           AND "admission_protocol" >= 2
+       ) AS "required"`)).rows[0]?.required === true) return { sandboxDrain: 2 };
+	}
+	return { sandboxDrain: (await client.query(`SELECT EXISTS(
+       SELECT 1
+       FROM "sandbox_drain_checkpoints"
+       WHERE "singleton" = true
+     ) AS "required"`)).rows[0]?.required === true ? 1 : 0 };
+}
+function assertPlatformRuntimeSafety(runtime, installed, database = { sandboxDrain: 0 }) {
+	const requiredSandboxDrain = Math.max(installed?.sandboxDrain ?? 0, database?.sandboxDrain ?? 0);
+	if ((runtime.safetyProtocols?.sandboxDrain ?? 0) < requiredSandboxDrain) throw new Error(`platform: Void Platform ${runtime.platformVersion} predates the required sandbox-drain safety protocol. Refusing to upload or activate a runtime that could reopen sandbox creation after drain.`);
+}
+async function claimPlatformDatabaseConnection(client, installationId, ownershipNonce) {
+	await client.query("BEGIN");
+	try {
+		await client.query(`SELECT pg_advisory_xact_lock(hashtext('void-platform-installation-ownership-v1'))`);
+		await client.query(`
+      CREATE TABLE IF NOT EXISTS "__void_platform_installation" (
+        "singleton" boolean PRIMARY KEY DEFAULT true CHECK ("singleton"),
+        "installation_id" text NOT NULL,
+        "ownership_nonce" text NOT NULL,
+        "claimed_at" timestamptz NOT NULL DEFAULT now(),
+        "lifecycle_manifest" jsonb
+      )
+    `);
+		await client.query(`ALTER TABLE "__void_platform_installation"
+       ADD COLUMN IF NOT EXISTS "lifecycle_manifest" jsonb`);
+		const claim = (await client.query(`SELECT "installation_id", "ownership_nonce"
+       FROM "__void_platform_installation"
+       WHERE "singleton" = true
+       FOR UPDATE`)).rows[0];
+		if (!claim) {
+			const contents = await client.query(`SELECT "schemaname", "tablename"
+         FROM "pg_catalog"."pg_tables"
+         WHERE "schemaname" = ANY (current_schemas(false))
+           AND "tablename" <> '__void_platform_installation'
+         ORDER BY "schemaname", "tablename"
+         LIMIT 1`);
+			if (contents.rows.length > 0) {
+				const table = contents.rows[0];
+				throw new Error(`platform: Refusing to claim a non-empty PostgreSQL database (found ${table.schemaname}.${table.tablename}). Use a dedicated empty database for each installation.`);
+			}
+			await client.query(`INSERT INTO "__void_platform_installation"
+           ("singleton", "installation_id", "ownership_nonce")
+         VALUES (true, $1, $2)`, [installationId, ownershipNonce]);
+		} else if (claim.installation_id !== installationId || claim.ownership_nonce !== ownershipNonce) throw new Error(`platform: This PostgreSQL database is already claimed by Void platform installation ${claim.installation_id}. Use a dedicated empty database for each installation.`);
+		await client.query("COMMIT");
+	} catch (error) {
+		await client.query("ROLLBACK").catch(() => ({ rows: [] }));
+		throw error;
+	}
+}
+async function deployPlatformWorker(config, secrets, options) {
+	const directory = mkdtempSync(join(tmpdir(), "void-platform-deploy-"));
+	const workerName = String(config.name);
+	const accountId = String(config.account_id);
+	let activatedVersionId = null;
+	let activatedDeploymentId = null;
+	let uploadedVersionId = null;
+	let previousDeployment = null;
+	let previousDeploymentId = null;
+	let previousVersionId = null;
+	const nextTraffic = isolatePlatformWorkerCustomDomains(config);
+	const previousTraffic = isolatePlatformWorkerCustomDomains(options.previousConfig);
+	let uploadConfig = withoutPlatformWorkerTrafficAttachments(nextTraffic.wranglerConfig);
+	const nextTriggers = readTriggerConfigFromObject(nextTraffic.wranglerConfig);
+	let previousTriggers = readTriggerConfigFromObject(previousTraffic.wranglerConfig);
+	try {
+		const configPath = join(directory, "wrangler.json");
+		writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
+		if (options.workerExisted) {
+			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), options.runner);
+			previousVersionId = previous.versionId;
+			const deployments = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+			if (!deploymentRunsOnlyVersion(deployments[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
+			previousDeployment = deployments[0];
+			previousDeploymentId = previousDeployment.id;
+			uploadConfig = withoutCompletedPlatformWorkerMigrations(uploadConfig, previous.migrationTag);
+			writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
+			previousTriggers = resolvePlatformPreviousTriggerConfig(withoutPlatformCustomDomainTriggers(previous.triggerConfig), previousTriggers, options.previousPublicEndpoints);
+			previousTriggers = withoutPlatformCustomDomainTriggers(mergePreservedTriggerRoutes(previousTriggers, options.preservedRoutes));
+		}
+		const argv = [
+			...options.workerExisted ? ["versions", "upload"] : ["deploy"],
+			"--config",
+			configPath,
+			"--strict",
+			"--experimental-provision=false",
+			"--experimental-auto-create=false",
+			...!options.workerExisted ? ["--autoconfig=false"] : [],
+			"--message",
+			encodeCloudflareVersionMessage([], nextTriggers)
+		];
+		if (secrets) {
+			const secretsPath = join(directory, "secrets.json");
+			writeFileSync(secretsPath, JSON.stringify(secrets), { mode: 384 });
+			argv.push("--secrets-file", secretsPath);
+		}
+		const uploaded = options.workerExisted ? await options.runner(argv, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(argv, accountId, directory, true, workerName, options.apiBaseUrl);
+		uploadedVersionId = parseUploadedPlatformWorkerVersion(`${uploaded.stdout}\n${uploaded.stderr}`);
+		if (!options.workerExisted) activatedVersionId = uploadedVersionId;
+		assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
+		if (!uploadedVersionId) throw new Error(`platform: Wrangler uploaded ${workerName} without reporting its immutable version id.`);
+		await options.onStaged(previousVersionId, uploadedVersionId, previousTriggers);
+		if (options.workerExisted) {
+			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+			if (deploymentsBeforeActivation[0]?.id !== previousDeploymentId || !deploymentRunsOnlyVersion(deploymentsBeforeActivation[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently before activation; refusing to overwrite it.`);
+			activatedVersionId = uploadedVersionId;
+			assertCleanPlatformWrangler(await options.runner([
+				"versions",
+				"deploy",
+				`${uploadedVersionId}@100`,
+				"--config",
+				configPath,
+				"--message",
+				`Void platform activation ${uploadedVersionId}`,
+				"--yes"
+			], accountId, directory, true), `activate ${workerName}`);
+		}
+		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+		const lineage = classifyPlatformWorkerDeploymentLineage(deploymentsAfterActivation, uploadedVersionId, previousDeploymentId);
+		if (lineage.kind === "concurrent-after") {
+			activatedVersionId = null;
+			throw new Error(`platform: Worker ${workerName} changed concurrently after activation; refusing to overwrite the newer deployment.`);
+		}
+		activatedDeploymentId = lineage.deploymentId;
+		if (lineage.kind === "intervening") {
+			const interveningDeployment = deploymentsAfterActivation[1];
+			activatedVersionId = null;
+			activatedDeploymentId = null;
+			if (!interveningDeployment) throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} lost its previous deployment during activation. The cutover cannot be recovered automatically.`);
+			try {
+				await restorePlatformWorkerDeployment({
+					accountId,
+					configPath,
+					directory,
+					expectedActiveDeploymentId: lineage.deploymentId,
+					expectedActiveVersionId: uploadedVersionId,
+					restoration: interveningDeployment,
+					runner: options.runner,
+					workerName
+				});
+			} catch (recoveryError) {
+				const recoveryFailures = await recoverFailedPlatformWorkerDeployment({
+					checkpointUnsafeTraffic: options.onUnsafeTraffic,
+					closeRoutingGate: options.retainNewWorker,
+					rollback: null,
+					unsafeTraffic: true
+				});
+				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} changed concurrently during activation, and restoring intervening deployment ${interveningDeployment.id} failed: ${errorMessage(recoveryError)}${recoveryFailures.length > 0 ? ` Safety recovery also failed: ${recoveryFailures.join("; ")}` : ""}`, { cause: recoveryError });
+			}
+			throw new Error(`platform: Worker ${workerName} changed concurrently during activation. The intervening deployment was restored without deleting deployment history.`);
+		}
+		assertPlatformTriggerStabilization(await stabilizeCloudflareVersionTriggers({
+			configPath,
+			knownTriggerConfigs: {
+				[uploadedVersionId]: nextTriggers,
+				...previousVersionId ? { [previousVersionId]: previousTriggers } : {}
+			},
+			manageRoutes: false,
+			previousTriggerConfig: previousTriggers,
+			publishEmptyCustomDomains: async () => {
+				await options.removeCustomDomains();
+				return cleanPlatformCommandResult();
+			},
+			runWrangler: platformWorkerCommandRunner(accountId, directory, options.runner),
+			targetTriggerConfig: nextTriggers,
+			targetVersionId: uploadedVersionId,
+			workerName
+		}), workerName, uploadedVersionId, "publish");
+		if (nextTraffic.customDomains.length > 0) await options.publishCustomDomains(workerName, nextTraffic.customDomains);
+		if (options.managedRoutes.length > 0) await options.publishRoutes(workerName, options.managedRoutes);
+		await options.onTrafficPublished();
+		const rollback = () => rollbackPlatformWorker({
+			accountId,
+			activatedDeploymentId,
+			activatedVersionId: uploadedVersionId,
+			config,
+			nextTriggers,
+			previousConfig: options.previousConfig,
+			previousCustomDomains: previousTraffic.customDomains,
+			previousDeployment,
+			previousTriggers,
+			previousVersionId,
+			preserveCustomDomains: false,
+			inspectNewWorker: options.inspectNewWorker,
+			removeCustomDomains: options.removeCustomDomains,
+			publishCustomDomains: options.publishCustomDomains,
+			retainNewWorker: options.retainNewWorker,
+			runner: options.runner,
+			workerExisted: options.workerExisted,
+			workerName
+		});
+		return rollback;
+	} catch (error) {
+		const unsafeTraffic = error instanceof PlatformWorkerCustomDomainsChangedError || error instanceof PlatformWorkerRoutesChangedError;
+		const rollbackVersionId = activatedVersionId && uploadedVersionId ? uploadedVersionId : null;
+		const recoveryFailures = await recoverFailedPlatformWorkerDeployment({
+			checkpointUnsafeTraffic: options.onUnsafeTraffic,
+			closeRoutingGate: options.retainNewWorker,
+			rollback: rollbackVersionId ? () => rollbackPlatformWorker({
+				accountId,
+				activatedDeploymentId,
+				activatedVersionId: rollbackVersionId,
+				config,
+				nextTriggers: readTriggerConfigFromObject(nextTraffic.wranglerConfig),
+				previousConfig: options.previousConfig,
+				previousCustomDomains: previousTraffic.customDomains,
+				previousDeployment,
+				previousTriggers,
+				previousVersionId,
+				preserveCustomDomains: unsafeTraffic,
+				inspectNewWorker: options.inspectNewWorker,
+				removeCustomDomains: options.removeCustomDomains,
+				publishCustomDomains: options.publishCustomDomains,
+				retainNewWorker: options.retainNewWorker,
+				runner: options.runner,
+				workerExisted: options.workerExisted,
+				workerName
+			}) : null,
+			unsafeTraffic
+		});
+		if (recoveryFailures.length > 0) throw new PlatformWorkerRecoveryIncompleteError(`platform: ${errorMessage(error)} Automatic recovery for ${workerName} was incomplete: ${recoveryFailures.join("; ")}`, { cause: error });
+		if (unsafeTraffic) throw new PlatformWorkerRecoveryIncompleteError(`platform: ${errorMessage(error)} The routing gate remains closed and live Custom Domains were retained for safe reconciliation on retry.`, { cause: error });
+		throw error;
+	} finally {
+		rmSync(directory, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+async function recoverFailedPlatformWorkerDeployment(input) {
+	const failures = [];
+	const attempt = async (label, operation) => {
+		try {
+			await operation();
+		} catch (error) {
+			failures.push(`${label}: ${errorMessage(error)}`);
+		}
+	};
+	if (input.unsafeTraffic) {
+		await attempt("closing the routing gate failed", input.closeRoutingGate);
+		await attempt("checkpointing unsafe traffic failed", input.checkpointUnsafeTraffic);
+	}
+	if (input.rollback) await attempt("Worker rollback failed", input.rollback);
+	return failures;
+}
+async function rollbackPlatformWorker(input) {
+	const directory = mkdtempSync(join(tmpdir(), "void-platform-rollback-"));
+	try {
+		const configPath = join(directory, "wrangler.json");
+		const currentTraffic = isolatePlatformWorkerCustomDomains(input.config);
+		writeFileSync(configPath, `${JSON.stringify(currentTraffic.wranglerConfig, null, 2)}\n`, { mode: 384 });
+		if (!input.workerExisted) {
+			if (await input.inspectNewWorker() === "missing") return;
+			const currentVersionId = await readActivePlatformWorkerVersion(configPath, input.accountId, input.workerName, input.runner);
+			if (currentVersionId !== input.activatedVersionId) throw new Error(`Worker ${input.workerName} changed concurrently from installer version ${input.activatedVersionId} to ${currentVersionId ?? "no active version"}; refusing to delete it.`);
+			if (await input.inspectNewWorker() === "missing") return;
+			await input.retainNewWorker();
+			if (!input.preserveCustomDomains) await input.removeCustomDomains();
+			return;
+		}
+		const currentVersionId = await readActivePlatformWorkerVersion(configPath, input.accountId, input.workerName, input.runner);
+		if (currentVersionId !== input.previousVersionId && currentVersionId !== input.activatedVersionId) throw new Error(`Worker ${input.workerName} changed concurrently from installer version ${input.activatedVersionId} to ${currentVersionId ?? "no active version"}; refusing to overwrite it.`);
+		if (!input.previousVersionId) throw new Error(`Worker ${input.workerName} has no previous version to restore.`);
+		if (currentVersionId === input.activatedVersionId) {
+			const currentDeployments = await readPlatformWorkerDeployments(configPath, input.accountId, input.workerName, input.runner);
+			const activeDeploymentId = input.activatedDeploymentId ?? currentDeployments[0]?.id ?? null;
+			const restoration = input.previousDeployment ?? currentDeployments[1];
+			if (!activeDeploymentId || currentDeployments[0]?.id !== activeDeploymentId || !deploymentRunsOnlyVersion(currentDeployments[0], input.activatedVersionId) || !restoration || currentDeployments[1]?.id !== restoration.id || !deploymentRunsOnlyVersion(restoration, input.previousVersionId)) throw new Error(`Worker ${input.workerName} changed concurrently after installer deployment; refusing to alter its deployment history.`);
+			await restorePlatformWorkerDeployment({
+				accountId: input.accountId,
+				configPath,
+				directory,
+				expectedActiveDeploymentId: activeDeploymentId,
+				expectedActiveVersionId: input.activatedVersionId,
+				restoration,
+				runner: input.runner,
+				workerName: input.workerName
+			});
+			if (await readActivePlatformWorkerVersion(configPath, input.accountId, input.workerName, input.runner) !== input.previousVersionId) throw new Error(`Worker ${input.workerName} did not restore immutable version ${input.previousVersionId} after rolling back installer deployment ${activeDeploymentId}.`);
+		}
+		const previousConfigPath = join(directory, "wrangler.previous.json");
+		writeFileSync(previousConfigPath, `${JSON.stringify(input.previousConfig, null, 2)}\n`, { mode: 384 });
+		assertPlatformTriggerStabilization(await stabilizeCloudflareVersionTriggers({
+			configPath: previousConfigPath,
+			knownTriggerConfigs: {
+				[input.activatedVersionId]: input.nextTriggers,
+				[input.previousVersionId]: input.previousTriggers
+			},
+			manageRoutes: false,
+			previousTriggerConfig: input.nextTriggers,
+			publishEmptyCustomDomains: async () => {
+				await input.removeCustomDomains();
+				return cleanPlatformCommandResult();
+			},
+			runWrangler: platformWorkerCommandRunner(input.accountId, directory, input.runner),
+			targetTriggerConfig: input.previousTriggers,
+			targetVersionId: input.previousVersionId,
+			workerName: input.workerName
+		}), input.workerName, input.previousVersionId, "restore");
+		if (!input.preserveCustomDomains && input.previousCustomDomains.length > 0) await input.publishCustomDomains(input.workerName, input.previousCustomDomains);
+	} finally {
+		rmSync(directory, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+function platformWorkerCommandRunner(accountId, cwd, runner) {
+	return (args, options) => runner(args, accountId, cwd, options.capture);
+}
+async function runPlatformWrangler(args, accountId, cwd, capture) {
+	return runPlatformWranglerAtApiBase(args, accountId, cwd, capture);
+}
+const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
+async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl()) {
+	const result = await createDefaultRunWrangler(process.cwd(), {
+		launcher: resolveWranglerArgv(process.cwd()),
+		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
+	})([...args], {
+		accountId,
+		apiBaseUrl,
+		captureJson: capture,
+		cwd
+	});
+	const stdout = result.stdout || "";
+	const stderr = result.stderr || "";
+	if (!capture && result.status !== 0) {
+		if (stdout) process.stdout.write(stdout);
+		if (stderr) process.stderr.write(stderr);
+	}
+	return {
+		status: result.status,
+		stderr,
+		stdout
+	};
+}
+const HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+function forwardHeaders(headers) {
+	return Object.fromEntries(Object.entries(headers).filter(([name]) => !HOP_BY_HOP_HEADERS.has(name.toLowerCase())));
+}
+function closeHttpServer(server) {
+	return new Promise((resolvePromise, rejectPromise) => {
+		server.close((error) => {
+			if (error) rejectPromise(error);
+			else resolvePromise();
+		});
+		server.closeAllConnections();
+	});
+}
+async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId, workerName) {
+	const upstreamBase = new URL(upstreamApiBaseUrl);
+	if (upstreamBase.protocol !== "http:" && upstreamBase.protocol !== "https:") throw new Error("platform: Cloudflare API base URL must use HTTP or HTTPS.");
+	const basePath = upstreamBase.pathname.replace(/\/+$/, "");
+	const expectedPath = `${basePath}/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
+	const state = {
+		attempted: false,
+		conflictStatus: null,
+		created: false,
+		forwarded: false,
+		rejectedMutation: null
+	};
+	const server = createServer((incoming, outgoing) => {
+		(async () => {
+			const incomingUrl = new URL(incoming.url ?? "/", "http://127.0.0.1");
+			if (incomingUrl.pathname !== basePath && !incomingUrl.pathname.startsWith(`${basePath}/`)) {
+				outgoing.writeHead(502, { "Content-Type": "application/json" });
+				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Invalid API proxy path\"}]}");
+				return;
+			}
+			const createQuery = [...incomingUrl.searchParams];
+			const supportedCreateQuery = new Set(createQuery.map(([key]) => key)).size === createQuery.length && createQuery.every(([key, value]) => key === "excludeScript" && value === "true" || key === "bindings_inherit" && value === "strict");
+			const isConditionalCreate = incoming.method === "PUT" && incomingUrl.pathname === expectedPath && supportedCreateQuery;
+			const isTopLevelWorkerUpload = incoming.method === "PUT" && new RegExp(`^${basePath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/accounts/[^/]+/workers/scripts/[^/]+$`).test(incomingUrl.pathname);
+			const isReadOnly = incoming.method === "GET" || incoming.method === "HEAD" || incoming.method === "OPTIONS";
+			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !state.created) {
+				state.rejectedMutation = `${incoming.method ?? "UNKNOWN"} ${incomingUrl.pathname}${incomingUrl.pathname === expectedPath && !supportedCreateQuery ? " (unsupported Worker create query)" : ""}`;
+				incoming.resume();
+				outgoing.writeHead(409, { "Content-Type": "application/json" });
+				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Mutation blocked until conditional Worker creation succeeds\"}]}");
+				return;
+			}
+			const headers = forwardHeaders(incoming.headers);
+			delete headers.host;
+			if (isConditionalCreate) {
+				state.attempted = true;
+				headers["if-none-match"] = "*";
+			}
+			const upstreamUrl = new URL(`${incomingUrl.pathname}${incomingUrl.search}`, upstreamBase.origin);
+			const request$2 = (upstreamUrl.protocol === "https:" ? request$1 : request)(upstreamUrl, {
+				headers,
+				method: incoming.method
+			}, (response) => {
+				if (isConditionalCreate) {
+					state.forwarded = true;
+					if (response.statusCode === 409 || response.statusCode === 412) state.conflictStatus = response.statusCode;
+					state.created = response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300;
+				}
+				const responseHeaders = forwardHeaders(response.headers);
+				outgoing.writeHead(response.statusCode ?? 502, responseHeaders);
+				response.pipe(outgoing);
+			});
+			request$2.on("error", () => {
+				if (!outgoing.headersSent) outgoing.writeHead(502, { "Content-Type": "application/json" });
+				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Cloudflare API proxy request failed\"}]}");
+			});
+			incoming.pipe(request$2);
+		})().catch(() => {
+			if (!outgoing.headersSent) outgoing.writeHead(502, { "Content-Type": "application/json" });
+			outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Cloudflare API proxy failed\"}]}");
+		});
+	});
+	await new Promise((resolvePromise, rejectPromise) => {
+		server.once("error", rejectPromise);
+		server.listen(0, "127.0.0.1", () => {
+			server.off("error", rejectPromise);
+			resolvePromise();
+		});
+	});
+	return {
+		apiBaseUrl: `http://127.0.0.1:${server.address().port}${basePath}`,
+		close: () => closeHttpServer(server),
+		state
+	};
+}
+async function withConditionalPlatformWorkerCreate(accountId, workerName, operation, upstreamApiBaseUrl = resolvePinnedApiBaseUrl()) {
+	const proxy = await startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId, workerName);
+	let result;
+	try {
+		result = await operation(proxy.apiBaseUrl);
+	} finally {
+		await proxy.close();
+	}
+	if (proxy.state.rejectedMutation) throw new Error(`platform: Wrangler attempted unexpected mutation ${proxy.state.rejectedMutation} while conditionally creating new Worker ${workerName}; the mutation was blocked.`);
+	if (!proxy.state.attempted || !proxy.state.forwarded) throw new Error(`platform: Wrangler did not use the guarded create endpoint for new Worker ${workerName}; refusing an unverified deployment.`);
+	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
+	return result;
+}
+async function runPlatformWranglerForConditionalCreate(args, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
+}
+async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
+	const result = await runner([
+		"deployments",
+		"status",
+		"--config",
+		configPath,
+		"--name",
+		workerName,
+		"--json"
+	], accountId, process.cwd(), true);
+	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
+	let value;
+	try {
+		value = JSON.parse(result.stdout);
+	} catch {
+		throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
+	}
+	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
+	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
+	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
+	return active[0].version_id;
+}
+async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
+	const result = await runner([
+		"deployments",
+		"list",
+		"--config",
+		configPath,
+		"--name",
+		workerName,
+		"--json"
+	], accountId, process.cwd(), true);
+	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
+	let value;
+	try {
+		value = JSON.parse(result.stdout);
+	} catch {
+		throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+	}
+	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+	return value.map((entry, index) => {
+		if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.created_on !== "string" || !Array.isArray(entry.versions)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+		const createdAt = Date.parse(entry.created_on);
+		if (!Number.isFinite(createdAt)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+		const versions = entry.versions.map((version) => {
+			if (!version || typeof version !== "object" || typeof version.version_id !== "string" || !Number.isFinite(Number(version.percentage))) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+			return {
+				percentage: Number(version.percentage),
+				versionId: version.version_id
+			};
+		});
+		return {
+			createdAt,
+			id: entry.id,
+			index,
+			versions
+		};
+	}).sort((left, right) => right.createdAt - left.createdAt || left.index - right.index).map(({ id, versions }) => ({
+		id,
+		versions
+	}));
+}
+function samePlatformWorkerTraffic(left, right) {
+	if (!left) return false;
+	const normalize = (deployment) => deployment.versions.filter((version) => version.percentage > 0).map((version) => `${version.versionId}@${version.percentage}`).sort();
+	return JSON.stringify(normalize(left)) === JSON.stringify(normalize(right));
+}
+async function restorePlatformWorkerDeployment(input) {
+	const restorationVersions = input.restoration.versions.filter((version) => version.percentage > 0);
+	const totalPercentage = restorationVersions.reduce((total, version) => total + version.percentage, 0);
+	if (restorationVersions.length === 0 || restorationVersions.length > 2 || restorationVersions.some((version, index) => version.percentage > 100 || restorationVersions.findIndex((entry) => entry.versionId === version.versionId) !== index) || Math.abs(totalPercentage - 100) > .001) throw new Error(`Worker ${input.workerName} deployment ${input.restoration.id} has an unsupported traffic distribution.`);
+	const before = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
+	if (before[0]?.id !== input.expectedActiveDeploymentId || !deploymentRunsOnlyVersion(before[0], input.expectedActiveVersionId) || before[1]?.id !== input.restoration.id || !samePlatformWorkerTraffic(before[1], input.restoration)) throw new Error(`Worker ${input.workerName} changed concurrently before deployment restoration; refusing to overwrite the newer deployment.`);
+	assertCleanPlatformWrangler(await input.runner([
+		"versions",
+		"deploy",
+		...restorationVersions.map((version) => `${version.versionId}@${version.percentage}`),
+		"--config",
+		input.configPath,
+		"--message",
+		`Void platform restoration ${input.restoration.id}`,
+		"--yes"
+	], input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
+	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
+	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
+}
+function deploymentRunsOnlyVersion(deployment, versionId) {
+	return versionId !== null && deployment?.versions.length === 1 && deployment.versions[0]?.versionId === versionId && deployment.versions[0].percentage === 100;
+}
+function classifyPlatformWorkerDeploymentLineage(deployments, installedVersionId, previousDeploymentId) {
+	const installed = deployments[0];
+	if (!deploymentRunsOnlyVersion(installed, installedVersionId)) return { kind: "concurrent-after" };
+	return (deployments[1]?.id ?? null) === previousDeploymentId ? {
+		deploymentId: installed.id,
+		kind: "committed"
+	} : {
+		deploymentId: installed.id,
+		kind: "intervening"
+	};
+}
+async function inspectNewPlatformWorker(client, accountId, manifest, resourceKey, workerName) {
+	if (!client.listWorkerNames || !client.getWorkerPlainTextBindings) throw new Error("platform: Cloudflare Worker ownership inspection is unavailable.");
+	if (!(await client.listWorkerNames(accountId)).includes(workerName)) return "missing";
+	const bindings = await client.getWorkerPlainTextBindings(accountId, workerName);
+	let marker;
+	try {
+		marker = parsePlatformResourceOwnershipMarker(JSON.parse(bindings.PLATFORM_OWNERSHIP_MARKER ?? "null"));
+	} catch {
+		throw new Error(`platform: Worker ${workerName} no longer has this installation's ownership marker; refusing to treat it as installer-owned.`);
+	}
+	const expected = createPlatformResourceOwnershipMarker({
+		accountId,
+		installationId: manifest.id,
+		ownershipNonce: manifest.ownershipNonce,
+		resourceId: workerName,
+		resourceKey,
+		resourceKind: "worker",
+		resourceName: workerName
+	});
+	if (marker.accountId !== expected.accountId || marker.installationId !== expected.installationId || marker.ownershipNonce !== expected.ownershipNonce || marker.resourceId !== expected.resourceId || marker.resourceKey !== expected.resourceKey || marker.resourceKind !== expected.resourceKind || marker.resourceName !== expected.resourceName) throw new Error(`platform: Worker ${workerName} no longer has this installation's ownership marker; refusing to treat it as installer-owned.`);
+	return "owned";
+}
+function readPlatformWorkerOwnershipMarker(config) {
+	const vars = config.vars;
+	if (!vars || typeof vars !== "object" || Array.isArray(vars)) throw new Error("platform: Platform Worker config is missing its ownership bindings.");
+	const marker = vars.PLATFORM_OWNERSHIP_MARKER;
+	if (typeof marker !== "string" || marker === "") throw new Error("platform: Platform Worker config is missing its ownership marker.");
+	return marker;
+}
+async function readActivePlatformWorkerSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, runner = runPlatformWrangler) {
+	const readActiveVersion = () => readActivePlatformWorkerVersion(configPath, accountId, workerName, runner);
+	const versionId = await readActiveVersion();
+	if (!versionId) throw new Error(`platform: Existing Worker ${workerName} has no single active production version.`);
+	const result = await runner([
+		"versions",
+		"view",
+		versionId,
+		"--config",
+		configPath,
+		"--name",
+		workerName,
+		"--json"
+	], accountId, process.cwd(), true);
+	assertCleanPlatformWrangler(result, `read rollback metadata for ${workerName}`);
+	let value;
+	try {
+		value = JSON.parse(result.stdout);
+	} catch {
+		throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
+	}
+	if (!value || typeof value !== "object") throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
+	const resources = value.resources;
+	const bindings = resources && typeof resources === "object" && !Array.isArray(resources) ? resources.bindings : null;
+	const ownershipBindings = Array.isArray(bindings) ? bindings.filter((binding) => binding && typeof binding === "object" && binding.name === "PLATFORM_OWNERSHIP_MARKER" && binding.type === "plain_text" && typeof binding.text === "string") : [];
+	if (ownershipBindings.length !== 1 || ownershipBindings[0].text !== expectedOwnershipMarker) throw new Error(`platform: Active Worker version ${versionId} for ${workerName} does not belong to this installation.`);
+	if (await readActiveVersion() !== versionId) throw new Error(`platform: Worker ${workerName} changed concurrently while its active version was inspected.`);
+	const annotations = value.annotations;
+	const message = annotations && typeof annotations === "object" && typeof annotations["workers/message"] === "string" ? annotations["workers/message"] ?? null : null;
+	const metadata = parseCloudflareVersionMessage(message);
+	if (metadata?.schema !== 2) throw new Error(`platform: Active Worker ${workerName} predates safe trigger snapshots. Refusing to upgrade because its routes, cron, and queue consumers could not be restored after a failed cutover.`);
+	return {
+		migrationTag: readCloudflareVersionMigrationTag(value),
+		triggerConfig: metadata.triggerConfig,
+		versionId
+	};
+}
+function withoutCompletedPlatformWorkerMigrations(config, activeMigrationTag) {
+	const target = (Array.isArray(config.migrations) ? config.migrations : []).at(-1);
+	if (activeMigrationTag === null || !target || typeof target !== "object" || Array.isArray(target) || target.tag !== activeMigrationTag) return config;
+	const result = { ...config };
+	delete result.migrations;
+	return result;
+}
+function parseUploadedPlatformWorkerVersion(output) {
+	return /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i.exec(output)?.[1] ?? null;
+}
+function assertCleanPlatformWrangler(result, operation) {
+	if (result.status !== 0) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
+}
+function cleanPlatformCommandResult() {
+	return {
+		status: 0,
+		stderr: "",
+		stdout: ""
+	};
+}
+function assertPlatformTriggerStabilization(result, workerName, targetVersionId, operation) {
+	if (!result.ok) throw new Error(`platform: Failed to ${operation} triggers for ${workerName} (${result.reason}).`);
+	if (!result.targetOwnsTraffic) throw new Error(`platform: Worker ${workerName} was superseded by ${result.activeVersionId} while publishing ${targetVersionId}; its active trigger state was repaired.`);
+}
+function readTriggerConfigFromObject(config) {
+	const directory = mkdtempSync(join(tmpdir(), "void-platform-triggers-"));
+	try {
+		const path = join(directory, "wrangler.json");
+		writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+		return readCloudflareTriggerConfig(path);
+	} finally {
+		rmSync(directory, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+function verifyRuntimeArtifacts(runtimeDirectory, manifest) {
+	for (const artifact of Object.values(manifest.artifacts)) {
+		const path = join(runtimeDirectory, artifact.path);
+		let contents;
+		try {
+			contents = readFileSync(path);
+		} catch (error) {
+			throw new Error(`platform: Runtime Worker artifact is missing: ${errorMessage(error)}`);
+		}
+		if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) throw new Error(`platform: Runtime Worker artifact failed integrity verification: ${path}.`);
+	}
+	verifyPlatformDatabaseArtifacts(runtimeDirectory, manifest.database);
+}
+function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
+	const journalPath = join(runtimeDirectory, "drizzle", "meta", "_journal.json");
+	let journal;
+	try {
+		journal = readFileSync(journalPath);
+	} catch (error) {
+		throw new Error(`platform: Runtime database migration journal is missing: ${errorMessage(error)}`);
+	}
+	if (hash(journal) !== database.journalSha256) throw new Error(`platform: Runtime database migration journal failed integrity verification: ${journalPath}.`);
+	for (const migration of database.migrations) {
+		const path = join(runtimeDirectory, "drizzle", `${migration.tag}.sql`);
+		let contents;
+		try {
+			contents = readFileSync(path);
+		} catch (error) {
+			throw new Error(`platform: Runtime database migration is missing: ${errorMessage(error)}`);
+		}
+		if (hash(contents) !== migration.sha256) throw new Error(`platform: Runtime database migration failed integrity verification: ${path}.`);
+	}
+}
+function nextTrafficGeneration(manifest) {
+	return Math.max(0, ...manifest.steps.flatMap((step) => {
+		const match = /^traffic-enabled:(\d+)$/.exec(step.key);
+		return match ? [Number(match[1])] : [];
+	})) + 1;
+}
+function nextWorkerCutoverGeneration(manifest) {
+	return latestPlatformWorkerCutoverGeneration(manifest) + 1;
+}
+function recordWorkerSecretUpdateState(manifest, generation, state, intentId, completedAt) {
+	return recordInstallationStep(manifest, {
+		completedAt,
+		key: `worker-secret-updates:${generation}:${state}`,
+		resultHash: intentId
+	}, completedAt);
+}
+function recordWorkerCutoverStage(manifest, generation, key, previousVersionId, stagedVersionId, workerName, previousTriggers, completedAt) {
+	return recordInstallationStep(manifest, {
+		completedAt,
+		key: `worker-cutover:${generation}:staged:${key}`,
+		resultHash: Buffer.from(JSON.stringify({
+			previousTriggers,
+			previousVersionId,
+			schema: 1,
+			stagedVersionId,
+			workerName
+		})).toString("base64url")
+	}, completedAt);
+}
+function recordWorkerCutoverResolution(manifest, generation, resolution, completedAt) {
+	return recordInstallationStep(manifest, {
+		completedAt,
+		key: `worker-cutover:${generation}:${resolution}`,
+		resultHash: resolution
+	}, completedAt);
+}
+function recordWorkerUnsafeTraffic(manifest, generation, key, workerName, completedAt) {
+	return recordInstallationStep(manifest, {
+		completedAt,
+		key: `worker-cutover:${generation}:unsafe-traffic:${key}`,
+		resultHash: workerName
+	}, completedAt);
+}
+function parseWorkerCutoverSnapshot(value) {
+	try {
+		const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+		const metadata = parseCloudflareVersionMessage(`void:${JSON.stringify({
+			migrations: [],
+			schema: 2,
+			triggerConfig: parsed.previousTriggers
+		})}`);
+		if (parsed.schema !== 1 || parsed.previousVersionId !== null && typeof parsed.previousVersionId !== "string" || typeof parsed.stagedVersionId !== "string" || parsed.stagedVersionId === "" || typeof parsed.workerName !== "string" || parsed.workerName === "" || metadata?.schema !== 2) return null;
+		return {
+			previousTriggers: metadata.triggerConfig,
+			previousVersionId: parsed.previousVersionId,
+			stagedVersionId: parsed.stagedVersionId,
+			workerName: parsed.workerName
+		};
+	} catch {
+		return null;
+	}
+}
+function interruptedWorkerCutover(manifest) {
+	const generations = /* @__PURE__ */ new Map();
+	for (const step of manifest.steps) {
+		const resolution = /^worker-cutover:(\d+):(committed|restored)$/.exec(step.key);
+		if (resolution) {
+			const generation = Number(resolution[1]);
+			const entry = generations.get(generation) ?? {
+				resolved: false,
+				staged: /* @__PURE__ */ new Map(),
+				unsafeTraffic: /* @__PURE__ */ new Set()
+			};
+			entry.resolved = true;
+			generations.set(generation, entry);
+			continue;
+		}
+		const unsafeTraffic = /^worker-cutover:(\d+):unsafe-traffic:(api|proxy|tail|dispatch)$/.exec(step.key);
+		if (unsafeTraffic) {
+			const generation = Number(unsafeTraffic[1]);
+			const entry = generations.get(generation) ?? {
+				resolved: false,
+				staged: /* @__PURE__ */ new Map(),
+				unsafeTraffic: /* @__PURE__ */ new Set()
+			};
+			entry.unsafeTraffic.add(unsafeTraffic[2]);
+			generations.set(generation, entry);
+			continue;
+		}
+		const staged = /^worker-cutover:(\d+):staged:(api|proxy|tail|dispatch)$/.exec(step.key);
+		if (!staged) continue;
+		const generation = Number(staged[1]);
+		const snapshot = parseWorkerCutoverSnapshot(step.resultHash);
+		if (!snapshot) throw new Error(`platform: Invalid Worker cutover checkpoint ${step.key}.`);
+		const entry = generations.get(generation) ?? {
+			resolved: false,
+			staged: /* @__PURE__ */ new Map(),
+			unsafeTraffic: /* @__PURE__ */ new Set()
+		};
+		entry.staged.set(staged[2], snapshot);
+		generations.set(generation, entry);
+	}
+	const unresolved = [...generations.entries()].filter(([, entry]) => !entry.resolved && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
+	return unresolved ? {
+		generation: unresolved[0],
+		staged: unresolved[1].staged,
+		unsafeTraffic: unresolved[1].unsafeTraffic
+	} : null;
+}
+async function verifyPlatformWorkerCutoverVersions(manifest, generation, configs, accountId, runner = runPlatformWrangler) {
+	const cutover = interruptedWorkerCutover(manifest);
+	if (cutover?.generation !== generation || cutover.staged.size !== 4) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
+	const directory = mkdtempSync(join(tmpdir(), "void-platform-cutover-verify-"));
+	try {
+		for (const key of [
+			"api",
+			"proxy",
+			"tail",
+			"dispatch"
+		]) {
+			const snapshot = cutover.staged.get(key);
+			if (!snapshot) throw new Error(`platform: Worker cutover generation ${generation} is missing its ${key} checkpoint.`);
+			const config = configs[key];
+			const configPath = join(directory, `${key}.wrangler.json`);
+			writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+			const active = await readActivePlatformWorkerSnapshot(configPath, accountId, snapshot.workerName, readPlatformWorkerOwnershipMarker(config), runner);
+			if (active.versionId !== snapshot.stagedVersionId) throw new Error(`platform: Worker ${snapshot.workerName} changed concurrently from staged version ${snapshot.stagedVersionId} to ${active.versionId}; refusing to enable platform traffic.`);
+		}
+	} finally {
+		rmSync(directory, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+function recordWorkerTrafficState(manifest, generation, enabled, completedAt) {
+	return recordInstallationStep(manifest, {
+		completedAt,
+		key: `worker-traffic-state:${generation}`,
+		resultHash: enabled ? "enabled" : "disabled"
+	}, completedAt);
+}
+function stablePublicEndpointState(existing) {
+	if (!existing) return false;
+	if (existing.status === "disabled" || existing.desiredState === "disabled") return false;
+	const latest = existing.steps.flatMap((step) => {
+		const match = /^worker-traffic-state:(\d+)$/.exec(step.key);
+		return match ? [{
+			generation: Number(match[1]),
+			state: step.resultHash
+		}] : [];
+	}).sort((left, right) => right.generation - left.generation)[0];
+	if (latest) return latest.state === "enabled";
+	return existing.status === "installed";
+}
+function resolvePlatformPreviousTriggerConfig(versionSnapshot, configuredSnapshot, publicEndpoints) {
+	if (publicEndpoints) return versionSnapshot;
+	return {
+		...versionSnapshot,
+		preview_urls: configuredSnapshot.preview_urls,
+		routes: configuredSnapshot.routes,
+		workers_dev: configuredSnapshot.workers_dev
+	};
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+var PlatformAccessBlockedError = class extends Error {
+	constructor(url, context) {
+		super([
+			"platform: Cloudflare Access blocked the platform health checks (Default-Deny, error 1050).",
+			`Blocked URL: ${url}`,
+			"",
+			"To make this test platform publicly reachable:",
+			"",
+			`1. In ${context ? `account ${JSON.stringify(context.accountName)}` : "your Cloudflare account"}, open:`,
+			"   Zero Trust → Access controls → Applications → Create new application.",
+			"2. Choose Self-hosted. When adding destinations, choose Worker and select:",
+			`   ${context ? context.workers.join(", ") + "." : "This installation's API, proxy, and dispatch Workers."}`,
+			"3. Add a policy: Action → Bypass; Include → Everyone.",
+			context?.resumeCommand ? `4. Save the policy and application, then resume:\n\n   ${context.resumeCommand}` : "4. Save the policy and application, then rerun your platform command.",
+			"",
+			"This removes Cloudflare Access protection for these Workers.",
+			"Void’s own authentication stays enabled. Keep account-wide Default-Deny on.",
+			"",
+			"For platforms that must remain Access-protected:",
+			"https://void.cloud/guide/self-hosted-platform#cloudflare-access"
+		].join("\n"));
+	}
+};
+async function platformProbeFailure(label, url, response, context) {
+	const message = `platform: ${label} failed at ${url} (HTTP ${response.status}).`;
+	if (response.status === 403 && response.headers.get("server")?.toLowerCase() === "cloudflare" && response.headers.get("content-type")?.toLowerCase().includes("text/html")) {
+		const body = await response.text().catch(() => "");
+		if (body.includes("Default-Deny") && /errorCode:\s*1050\b/.test(body)) return new PlatformAccessBlockedError(url, context);
+	}
+	return new Error(message);
+}
+async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicationBaseDomain, platformVersion, usageProtocolVersion, healthProbeToken, fetcher = fetch, dispatchOrigin, context) {
+	const request = (url) => fetcher(url, {
+		headers: {
+			"X-Void-Platform-Probe": healthProbeToken,
+			...cfAccessHeaders(process.env, url)
+		},
+		redirect: "manual",
+		signal: AbortSignal.timeout(3e4)
+	});
+	const dispatchUrl = dispatchOrigin ?? `https://test.${applicationBaseDomain}`;
+	const [health, discovery, proxy, dispatch] = await Promise.all([
+		request(`${apiUrl}/health`),
+		request(`${apiUrl}/.well-known/void-platform`),
+		request(`${proxyUrl}/health`),
+		request(`${dispatchUrl}/health`)
+	]);
+	if (!health.ok) throw await platformProbeFailure("Health check", apiUrl, health, context);
+	if (!discovery.ok) throw await platformProbeFailure("Discovery check", apiUrl, discovery, context);
+	const body = await discovery.json();
+	if (body.installationId !== installationId) throw new Error("platform: Deployed API discovery identity does not match this installation.");
+	if (body.platformVersion !== platformVersion) throw new Error("platform: Deployed API discovery version does not match this release.");
+	if ((body.usageProtocolVersion ?? 0) !== usageProtocolVersion) throw new Error("platform: Deployed API usage protocol does not match this runtime. Traffic remains disabled.");
+	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", proxyUrl, proxy, context);
+	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", dispatchUrl, dispatch, context);
+}
+async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/internal/platform/sandbox-drain`, {
+		headers: {
+			"X-Void-Platform-Probe": healthProbeToken,
+			...cfAccessHeaders(process.env, apiUrl)
+		},
+		signal: AbortSignal.timeout(3e4)
+	});
+	if (!response.ok) throw new Error(`platform: Sandbox drain probe failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error("platform: Sandbox drain probe did not return its DB-backed protocol v1 document. Traffic remains disabled.");
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
+	const status = value;
+	const validState = status.state === "required" || status.state === "draining" || status.state === "complete";
+	const validPhase = status.phase === null || status.phase === "deployments" || status.phase === "resources";
+	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
+	return status.state === "complete";
+}
+function createPlatformHealthProbeToken(ownershipNonce) {
+	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
+}
+//#endregion
+//#region src/cli/platform-setup-draft.ts
+const STARTED = "credential-setup:v1";
+const COMPLETED = "credential-setup-complete:v1";
+/** Includes interrupted provisioning, but not maintenance of an already deployed platform. */
+function isPlatformInstallInProgress(manifest) {
+	return manifest.runtime === null && manifest.desiredState === "enabled" && !manifest.resources.some((resource) => resource.state === "deleted") && [
+		"planned",
+		"provisioning",
+		"waiting-for-dns",
+		"waiting-for-oauth",
+		"deploying",
+		"verifying",
+		"failed"
+	].includes(manifest.status);
+}
+function isPlatformSetupDraft(manifest) {
+	return manifest.status === "planned" && manifest.resources.length === 0 && manifest.endpoints.apiUrl === null && manifest.steps.some((step) => step.key === STARTED) && !manifest.steps.some((step) => step.key === COMPLETED);
+}
+function savePlatformSetupDraft(plan, version) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	let manifest = createPlatformInstallationManifest({
+		account: plan.account,
+		deployment: plan.deployment,
+		id: plan.installationId,
+		createdAt: now,
+		platformVersion: version,
+		ownershipNonce: randomBytes(32).toString("base64url")
+	});
+	manifest = transitionInstallation(manifest, "planned", now);
+	manifest = recordInstallationStep(manifest, {
+		key: STARTED,
+		completedAt: now,
+		resultHash: plan.installationId
+	}, now);
+	writeInstallationManifest(manifest);
+	writePendingInstallationSecrets(manifest, {});
+	return manifest;
+}
+function completePlatformSetupDraft(manifest) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const completed = recordInstallationStep(manifest, {
+		key: COMPLETED,
+		completedAt: now,
+		resultHash: manifest.id
+	}, now);
+	writeInstallationManifest(completed);
+	return completed;
+}
+//#endregion
+//#region src/cli/platform-setup.ts
+function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
+	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + page.title + "\x1B]8;;\x1B\\" : page.title + ": " + page.url;
+}
+function platformSetupFieldHelp(key) {
+	const docs = (section, title) => platformSetupLink({
+		title,
+		url: "https://void.cloud/guide/self-hosted-platform#" + section
+	});
+	switch (key) {
+		case "databaseUrl": return {
+			placeholder: "postgresql://user:pw@…/database",
+			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
+				title: "Neon",
+				url: "https://neon.com/"
+			}) + ". " + docs("platform-database", "Database setup")
+		};
+		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("signing-and-encryption-keys", "Key setup") };
+		default: return;
+	}
+}
+function supportsSetupLinks() {
+	return !!process.stdout.isTTY && ([
+		"ghostty",
+		"iTerm.app",
+		"WezTerm",
+		"vscode",
+		"WarpTerminal"
+	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
+}
+/** Dashboard keys use permission-catalog labels, which can differ from product names. */
+function platformSetupPages(plan) {
+	const needsGateway = plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect");
+	const permissions = [
+		{
+			key: "account_settings",
+			type: "read"
+		},
+		{
+			key: "workers_scripts",
+			type: "edit"
+		},
+		{
+			key: "workers_kv_storage",
+			type: "edit"
+		},
+		{
+			key: "workers_r2",
+			type: "edit"
+		},
+		{
+			key: "d1",
+			type: "edit"
+		},
+		{
+			key: "queues",
+			type: "edit"
+		},
+		{
+			key: "account_analytics",
+			type: "read"
+		},
+		{
+			key: "workers_tail",
+			type: "read"
+		},
+		{
+			key: "query_cache",
+			type: "edit"
+		},
+		...needsGateway ? [{
+			key: "aig",
+			type: "edit"
+		}] : [],
+		...plan.deployment.application.zoneName ? [{
+			key: "cache",
+			type: "purge"
+		}] : [],
+		...plan.deployment.capabilities.customDomains ? [{
+			key: "ssl_and_certificates",
+			type: "edit"
+		}] : []
+	];
+	return {
+		runtime: {
+			title: "Cloudflare runtime token",
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/api-tokens",
+				name: plan.deployment.displayName + " Runtime",
+				permissionGroupKeys: JSON.stringify(permissions)
+			}),
+			instructions: [
+				"Review the preselected permissions for account " + plan.account.name + ".",
+				"Edit: Workers Scripts, KV, R2, D1, Queues, Hyperdrive" + (needsGateway ? ", AI Gateway." : "."),
+				"Read: Account Settings, Account Analytics, Workers Tail.",
+				...plan.deployment.application.zoneName ? ["Zone " + plan.deployment.application.zoneName + ": Cache Purge: Purge."] : [],
+				...plan.deployment.capabilities.customDomains ? ["Custom project domains also need SSL and Certificates: Edit on that zone."] : [],
+				"If the form differs, match the permissions above. Create the token, then paste it here."
+			].join("\n")
+		},
+		github: {
+			title: "GitHub OAuth App",
+			url: "https://github.com/settings/applications/new",
+			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
+		},
+		r2: {
+			title: "R2 upload token",
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/r2/api-tokens/create",
+				type: "account"
+			}),
+			instructions: [
+				"Select Object Read & Write (the form defaults to read-only).",
+				"Keep Apply to all buckets in this account (including newly created buckets) selected.",
+				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
+			].join("\n")
+		}
+	};
+}
+function formatPlatformSetupPlan(plan) {
+	const pages = platformSetupPages(plan);
+	return [
+		"Credentials needed (paste them into the installer; keep a password-manager copy):",
+		platformSetupLink(pages.runtime),
+		pages.runtime.instructions,
+		"",
+		platformSetupLink(pages.r2),
+		pages.r2.instructions,
+		"",
+		platformSetupLink(pages.github),
+		pages.github.instructions
+	].join("\n");
+}
+function openPlatformSetupPage(page, dependencies = {}) {
+	log.info(page.title + "\n" + page.instructions);
+	console.log(platformSetupLink({
+		...page,
+		title: "Open " + page.title
+	}));
+	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
+		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
+	} catch {
+		log.info("Could not open the browser. Use the link above.");
+	}
+}
+//#endregion
+//#region src/cli/prompt-password.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+/** A visual example for an empty secret field; never a default value or an unmasked input. */
+async function passwordWithPlaceholder(options) {
+	return await new u$1({
+		input: options.input,
+		output: options.output,
+		signal: options.signal,
+		mask: options.mask ?? S_PASSWORD_MASK,
+		validate: options.validate,
+		render() {
+			const guide = options.withGuide ?? settings.withGuide;
+			const prefix = `${guide ? `${import_picocolors.default.gray(S_BAR)}\n` : ""}${symbol(this.state)}  ${options.message}\n`;
+			const bar = guide ? `${import_picocolors.default.gray(S_BAR)}  ` : "";
+			if (this.state === "submit" || this.state === "cancel") return `${prefix}${bar}${import_picocolors.default.dim(this.masked)}`;
+			if (this.state === "error") {
+				const masked = this.masked;
+				if (options.clearOnError) this.clear();
+				return `${prefix}${bar}${import_picocolors.default.dim(masked)}\n${guide ? `${import_picocolors.default.yellow(S_BAR_END)}  ` : ""}${import_picocolors.default.yellow(this.error)}\n`;
+			}
+			const input = this.userInput.length === 0 ? import_picocolors.default.dim(options.placeholder) : this.userInputWithCursor;
+			return `${prefix}${guide ? `${import_picocolors.default.cyan(S_BAR)}  ` : ""}${input}\n${guide ? import_picocolors.default.cyan(S_BAR_END) : ""}\n`;
+		}
+	}).prompt() ?? CANCEL_SYMBOL;
+}
+//#endregion
+//#region src/cli/platform-lifecycle.ts
+function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
+	const explicit = process.env.VOID_PLATFORM_DATABASE_URL || process.env.DATABASE_URL || "";
+	const recorded = checkpoint?.databaseUrl || "";
+	if (checkpoint?.databaseClaimState === "claimed" || manifest?.resources.some((resource) => resource.state === "ready" && (resource.kind === "hyperdrive" || resource.kind === "worker")) || manifest?.steps.some((step) => step.key.startsWith("database-schema:") || step.key.startsWith("database-migrations:"))) {
+		if (!recorded) {
+			if (explicit) return explicit;
+			throw new Error("platform: The claimed PostgreSQL database URL is missing from local recovery state. Export VOID_PLATFORM_DATABASE_URL with the original installation database before continuing.");
+		}
+		if (explicit && explicit !== recorded) throw new Error("platform: This installation is already bound to its recorded PostgreSQL database. Unset DATABASE_URL and VOID_PLATFORM_DATABASE_URL before resuming; changing databases requires an explicit migration flow.");
+		return recorded;
+	}
+	return explicit || recorded;
+}
+async function runPlatformLifecycleCommand(args) {
+	if (args.subcommand === "domain") {
+		const { runPlatformDomainCommand } = await import("./platform-domain-ChvbJkdy.mjs");
+		await runPlatformDomainCommand(args);
+		return;
+	}
+	if (args.subcommand === "discover") {
+		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
+		const accountId = await selectAccount(await readAccounts(client), args.account);
+		const { recoverPlatformInstallations } = await import("./platform-recovery-C_YO-tIs.mjs");
+		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
+		if (recovered.length === 0) {
+			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
+			return;
+		}
+		for (const manifest of recovered) log.success(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
+		return;
+	}
+	if (args.subcommand !== "install") {
+		const { runInstalledPlatformCommand } = await import("./platform-management-Db2PXw0B.mjs");
+		await runInstalledPlatformCommand(args);
+		return;
+	}
+	const runtime = loadPlatformRuntime(args.runtime);
+	assertNoninteractivePlatformMutationAcknowledged(args, process.stdin.isTTY === true);
+	console.log();
+	intro(cliTitle("platform install"));
+	let existing = args.resume ? resolveInstallationManifest(args.name) : null;
+	let selectedInstall = false;
+	let selectedDraft = false;
+	const { input: installationSlug, credential: operatorCredential } = await resolvePlatformCloudflareCredentialWithInput(async () => {
+		let requestedName = args.name;
+		const resumableInstalls = () => listInstallationManifests().filter((manifest) => isPlatformInstallInProgress(manifest) && (!args.account || manifest.account.id === args.account || manifest.account.name.toLowerCase() === args.account.toLowerCase()));
+		const selectInstall = (manifest) => {
+			existing = manifest;
+			selectedInstall = true;
+			selectedDraft = isPlatformSetupDraft(manifest);
+		};
+		const assertNewNameAvailable = (slug) => {
+			const collision = listInstallationManifests().find((manifest) => manifest.status !== "uninstalled" && manifest.deployment.installationSlug === slug);
+			if (collision && !isPlatformInstallInProgress(collision)) throw new Error(`platform: ${collision.deployment.displayName} (${slug}) already exists (${collision.status}). Run \`void platform status ${collision.id}\` to inspect it.`);
+			assertPlatformInstallationSlugAvailable(slug);
+		};
+		if (!args.resume && process.stdin.isTTY) {
+			const installs = resumableInstalls().filter((manifest) => !args.name || manifest.deployment.installationSlug === normalizeInstallationSlug(args.name));
+			if (installs.length > 0) {
+				const choice = await select({
+					message: "Continue a previous platform install?",
+					options: [...installs.map((install) => ({
+						value: install.id,
+						label: `Continue setup for ${install.deployment.displayName} (${install.deployment.installationSlug})`,
+						hint: install.account.name
+					})), {
+						value: "new",
+						label: "Start a new platform install"
+					}]
+				});
+				if (isCancel(choice) || typeof choice === "symbol") throw new Error("platform: Cancelled.");
+				if (choice === "new") requestedName = "";
+				else {
+					const selected = installs.find((install) => install.id === choice);
+					if (!selected) throw new Error("platform: The selected setup is no longer available.");
+					selectInstall(selected);
+				}
+			}
+		}
+		while (!existing) {
+			const name = requestedName || await promptText("Installation name:", { placeholder: "company" }, false, (value) => {
+				try {
+					const slug = normalizeInstallationSlug(value);
+					if (!resumableInstalls().some((install) => install.deployment.installationSlug === slug)) assertNewNameAvailable(slug);
+				} catch (error) {
+					return error instanceof Error ? error.message : "Choose another installation name.";
+				}
+			});
+			const slug = normalizeInstallationSlug(name);
+			const matches = resumableInstalls().filter((install) => install.deployment.installationSlug === slug);
+			if (process.stdin.isTTY && matches.length > 0) {
+				let selected = matches[0];
+				if (matches.length > 1) {
+					const choice = await select({
+						message: `Which ${slug} installation do you want to resume?`,
+						options: matches.map((install) => ({
+							value: install.id,
+							label: install.deployment.displayName,
+							hint: install.account.name
+						}))
+					});
+					if (isCancel(choice) || typeof choice === "symbol") throw new Error("platform: Cancelled.");
+					const matching = matches.find((install) => install.id === choice);
+					if (!matching) throw new Error("platform: The selected setup is no longer available.");
+					selected = matching;
+				}
+				const resume = await confirm({
+					message: `Resume installation for ${selected.deployment.displayName} (${slug})?`,
+					initialValue: true
+				});
+				if (isCancel(resume) || typeof resume === "symbol") throw new Error("platform: Cancelled.");
+				if (resume) selectInstall(selected);
+				else requestedName = "";
+				continue;
+			}
+			assertNewNameAvailable(slug);
+			return slug;
+		}
+		if (existing.endpoints.apiUrl && !readPendingInstallationSecrets(existing)) throw new Error(`platform: Installation ${existing.id} has already been deployed. Use \`void platform repair ${existing.id}\` or \`void platform upgrade ${existing.id}\` instead.`);
+		return existing.deployment.installationSlug;
+	});
+	let client = new PlatformCloudflareClient(operatorCredential.token);
+	const accounts = await readAccounts(client);
+	const accountId = existing ? existing.account.id : await selectAccount(accounts, args.account);
+	if (existing && args.account && await selectAccount(accounts, args.account) !== existing.account.id) throw new Error("platform: The installation belongs to a different Cloudflare account.");
+	const recorded = existing?.deployment;
+	if (existing && isPlatformSetupDraft(existing) && (args.applicationDomain && normalizeApplicationDomain(args.applicationDomain) !== recorded.application.baseDomain || args.zone && normalizeApplicationDomain(args.zone) !== recorded.application.zoneName || args.workersDev && !!recorded.application.zoneName || args.controlPlaneDomain && normalizeApplicationDomain(args.controlPlaneDomain) !== recorded.controlPlane.apiHostname || args.dedicatedZone && !recorded.application.dedicatedZone)) throw new Error("platform: These options differ from the saved setup. Resume its recorded configuration or choose another installation name.");
+	let workersDev = !!recorded?.application.workersDev && !recorded.application.zoneName || args.workersDev === true;
+	if (!recorded && !args.workersDev && !args.applicationDomain && !args.zone && process.stdin.isTTY) {
+		const mode = await select({
+			message: "Where should your apps live?",
+			options: [{
+				value: "domain",
+				label: "Use a domain",
+				hint: "recommended"
+			}, {
+				value: "workers-dev",
+				label: "Use workers.dev for testing",
+				hint: "add a domain later"
+			}]
+		});
+		if (isCancel(mode)) throw new Error("platform: Cancelled.");
+		workersDev = mode === "workers-dev";
+	}
+	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", "example.app")));
+	const zoneName = recorded?.application.zoneName ?? (workersDev ? "" : normalizeApplicationDomain(args.zone || await promptText("Cloudflare zone:", applicationDomain)));
+	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationSlug} Void`));
+	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY ? await promptText("Optional custom API hostname (leave empty for workers.dev):", "", true) : "");
+	let dedicatedZone = recorded?.application.dedicatedZone ?? args.dedicatedZone;
+	if (!workersDev && !recorded && !args.dedicatedZone && applicationDomain === zoneName && process.stdin.isTTY) {
+		const catchAll = await confirm({
+			message: `Dedicate all unmatched ${zoneName} traffic to Void apps?`,
+			initialValue: false
+		});
+		if (isCancel(catchAll) || typeof catchAll === "symbol") throw new Error("platform: Cancelled.");
+		dedicatedZone = catchAll;
+	}
+	const release = args.plan ? null : acquirePlatformLifecycleLock(accountId, installationSlug);
+	let progress;
+	const startProgress = (message) => {
+		const active = createSpinner({ onCancel: () => {
+			if (!process.emit("SIGINT")) process.exit(130);
+		} });
+		active.start(message);
+		return active;
+	};
+	try {
+		if (!existing && !args.plan) assertPlatformInstallationSlugAvailable(installationSlug);
+		if (existing && !args.plan) {
+			existing = resolveInstallationManifest(existing.id);
+			if (selectedInstall && (!isPlatformInstallInProgress(existing) || selectedDraft && !isPlatformSetupDraft(existing))) throw new Error("platform: Setup advanced in another process. Rerun with --resume to review its current state.");
+		}
+		const checkpoint = existing ? readPendingInstallationSecrets(existing) : null;
+		const databaseUrl = resolvePlatformInstallDatabaseUrl(checkpoint, existing);
+		let authoritativeProvisionIntents = false;
+		if (existing && !isPlatformSetupDraft(existing)) {
+			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
+			progress = startProgress("Reading the saved installation");
+			const authoritative = await readPlatformDatabaseLifecycleManifest(databaseUrl, existing.id, existing.ownershipNonce);
+			progress?.stop("Read the saved installation.");
+			progress = void 0;
+			if (authoritative) {
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Db2PXw0B.mjs");
+				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
+				authoritativeProvisionIntents = true;
+				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
+				existing = selected;
+				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
+			}
+		}
+		const planInput = {
+			accountId,
+			applicationDomain,
+			controlPlaneDomain,
+			dedicatedZone,
+			displayName,
+			installationSlug,
+			zoneName,
+			...workersDev ? { workersDev: true } : {}
+		};
+		let plan = await createPlatformInstallPlan(client, planInput, existing, {
+			authoritativeProvisionIntents,
+			allowUnverifiedAiGateway: true
+		});
+		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
+		note(formatPlatformRuntime(runtime), "Platform runtime");
+		if (args.plan) {
+			console.log(formatPlatformSetupPlan(plan));
+			outro("No Cloudflare or local installation state was changed.");
+			return;
+		}
+		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
+		if (process.stdin.isTTY && !args.yes) {
+			const proceed = await confirm({
+				message: "Apply this plan?",
+				initialValue: false
+			});
+			if (isCancel(proceed) || !proceed) {
+				outro("No changes made.");
+				return;
+			}
+		}
+		if (!existing) existing = savePlatformSetupDraft(plan, runtime.manifest.platformVersion);
+		const setupManifest = existing;
+		const credentialSetup = isPlatformSetupDraft(existing);
+		const values = { ...checkpoint };
+		const saveValues = (updates) => {
+			Object.assign(values, updates);
+			if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
+		};
+		const configured = (key, environment) => credentialSetup ? process.env[environment] || values[key] || "" : values[key] || process.env[environment] || "";
+		const collect = async (key, environment, message, masked = true, persist = true, validate) => {
+			let value = configured(key, environment);
+			if (!value) {
+				const help = platformSetupFieldHelp(key);
+				if (help && process.stdin.isTTY) log.info(help.description);
+				value = await promptSecret(message, masked, validate, help?.placeholder);
+			}
+			const error = validate?.(value);
+			if (error) throw new Error("platform: " + error);
+			if (persist) saveValues({ [key]: value });
+			return value;
+		};
+		const pages = platformSetupPages(plan);
+		if (!configured("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN")) openPlatformSetupPage(pages.runtime);
+		const usingSavedRuntimeToken = credentialSetup && !process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN && Boolean(values.cloudflareApiToken);
+		let runtimeCloudflareApiToken = await collect("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN", "Paste runtime API token:", true, false);
+		let rejectedSavedRuntimeToken = false;
+		const verifyRuntimeToken = async (token) => {
+			let checkingRuntimePermissions = true;
+			try {
+				await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(token), {
+					accountId,
+					applicationDomain,
+					customDomains: plan.deployment.capabilities.customDomains,
+					zoneId: plan.zone?.id ?? null
+				});
+				checkingRuntimePermissions = false;
+				if (plan.actions.some((action) => action.action === "inspect")) {
+					client = client.withAiGatewayToken(token);
+					plan = await verifyPlatformAiGatewayPlan(client, planInput, existing, plan, authoritativeProvisionIntents);
+				}
+			} catch (error) {
+				if (credentialSetup && token === values.cloudflareApiToken && isRuntimeTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
+					delete values.cloudflareApiToken;
+					writePendingInstallationSecrets(setupManifest, values);
+					rejectedSavedRuntimeToken = true;
+				}
+				throw error;
+			}
+		};
+		try {
+			await verifyRuntimeToken(runtimeCloudflareApiToken);
+		} catch (error) {
+			if (!usingSavedRuntimeToken || !process.stdin.isTTY || !rejectedSavedRuntimeToken) throw error;
+			log.warn("Cloudflare rejected the saved runtime token. Create a replacement to continue setup.");
+			openPlatformSetupPage(pages.runtime);
+			runtimeCloudflareApiToken = await collect("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN", "Paste runtime API token:", true, false);
+			await verifyRuntimeToken(runtimeCloudflareApiToken);
+		}
+		saveValues({ cloudflareApiToken: runtimeCloudflareApiToken });
+		const previousLogin = values.bootstrapGitHubLogin;
+		const bootstrapGitHubLogin = await collect("bootstrapGitHubLogin", "VOID_PLATFORM_ADMIN_GITHUB_LOGIN", "Initial administrator GitHub username:", false);
+		const bootstrapGitHubId = (previousLogin === bootstrapGitHubLogin ? values.bootstrapGitHubId : "") || process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || await resolveBootstrapGitHubId(bootstrapGitHubLogin);
+		saveValues({ bootstrapGitHubId });
+		const installationDatabaseUrl = databaseUrl || await collect("databaseUrl", "VOID_PLATFORM_DATABASE_URL", "PostgreSQL DATABASE_URL:");
+		saveValues({ databaseUrl: installationDatabaseUrl });
+		if (!configured("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID") || !configured("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET")) openPlatformSetupPage(configured("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID") ? {
+			...pages.github,
+			url: "https://github.com/settings/developers"
+		} : pages.github);
+		const githubClientId = await collect("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID", "GitHub OAuth client ID:", false, false);
+		const githubClientSecret = await collect("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET", "GitHub OAuth client secret:", true, false);
+		saveValues({
+			githubClientId,
+			githubClientSecret
+		});
+		if (!configured("r2AccessKeyId", "VOID_PLATFORM_R2_ACCESS_KEY_ID") || !configured("r2SecretAccessKey", "VOID_PLATFORM_R2_SECRET_ACCESS_KEY")) openPlatformSetupPage(pages.r2);
+		const r2AccessKeyId = await collect("r2AccessKeyId", "VOID_PLATFORM_R2_ACCESS_KEY_ID", "Access Key ID:", false, false);
+		const r2SecretAccessKey = await collect("r2SecretAccessKey", "VOID_PLATFORM_R2_SECRET_ACCESS_KEY", "Secret Access Key:", true, false);
+		saveValues({
+			r2AccessKeyId,
+			r2SecretAccessKey
+		});
+		const hasFullProjectSecretKeyring = Boolean(checkpoint?.projectSecretKeysJson || checkpoint?.projectSecretActiveKeyVersion || process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION);
+		const secrets = createPlatformInstallationSecrets({
+			bootstrapGitHubId,
+			bootstrapGitHubLogin,
+			cloudflareApiToken: runtimeCloudflareApiToken,
+			checkpoint: values,
+			databaseUrl: installationDatabaseUrl,
+			githubClientId,
+			githubClientSecret,
+			r2AccessKeyId,
+			r2SecretAccessKey,
+			existingInstallation: !credentialSetup,
+			jwtSecret: await collect("jwtSecret", "VOID_PLATFORM_JWT_SECRET", "JWT signing key:", true, true, credentialSetup ? (value) => Buffer.byteLength(value, "utf8") >= 32 ? void 0 : "The JWT signing secret must contain at least 32 random bytes." : void 0),
+			projectSecretKey: configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || (hasFullProjectSecretKeyring ? "" : await collect("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY", "Project encryption key:", true, true, credentialSetup ? (value) => {
+				const key = Buffer.from(value, "base64");
+				return key.length === 32 && key.toString("base64") === value ? void 0 : "The project encryption key must be canonical base64 encoding of exactly 32 bytes.";
+			} : void 0)),
+			projectSecretKeysJson: process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || "",
+			projectSecretActiveKeyVersion: process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION || ""
+		});
+		progress = startProgress("Installing the platform");
+		if (credentialSetup) {
+			saveValues({ projectSecretKey: secrets.projectSecretKey });
+			existing = completePlatformSetupDraft(existing);
+		}
+		const result = await installPlatform(plan, secrets, existing, {
+			acquireDatabaseLifecycleLock: acquirePlatformDatabaseLifecycleLock,
+			client,
+			runtime,
+			healthCheckResumeCommand: `${cliCommandName()} platform install --resume --name ${existing.id}`,
+			onProgress: (message) => progress?.message(message),
+			replanWorkers: async (manifest) => (await createPlatformInstallPlan(client, planInput, manifest, {
+				authoritativeProvisionIntents: true,
+				repairMissing: true
+			})).actions.filter((action) => action.kind === "worker"),
+			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
+			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Db2PXw0B.mjs");
+				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
+					const previous = manifest.resources.find((resource) => resource.key === action.key);
+					return action.action === "create" && previous && previous.name !== action.name;
+				}).map((action) => action.key));
+				await verifyPlatformInstallationOwnership(client, manifest, {
+					allowUninitializedRoutingCheckpoint: databaseCheckpointExists,
+					databaseUrl: secrets.databaseUrl,
+					retainedReplacementKeys
+				});
+			}
+		});
+		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused; progress is saved." : "Platform installed.");
+		progress = void 0;
+		if (result.waitingForDns) {
+			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, "Waiting for nameservers");
+			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
+			return;
+		}
+		if (result.waitingForSandboxDrain) {
+			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`; follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
+			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
+			return;
+		}
+		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
+		log.info(`API URL: ${plan.apiUrl}`);
+		if (!plan.deployment.application.zoneName) log.info("Apps will use workers.dev addresses. When your domain is ready: void platform domain set <domain>");
+		outro("Run `void auth login`, then deploy an app with `void deploy --platform void`.");
+	} catch (error) {
+		progress?.error("Platform installation failed.");
+		progress = void 0;
+		if (existing && !args.plan && !(error instanceof PlatformAccessBlockedError)) log.info(`Continue with: ${cliCommandName()} platform install --resume --name ${existing.id}`);
+		throw error;
+	} finally {
+		try {
+			progress?.clear();
+		} finally {
+			release?.();
+		}
+	}
+}
+function isRuntimeTokenAuthorizationError(error, requestPathIncludes) {
+	for (let depth = 0; depth < 5 && error instanceof Error; depth++, error = error.cause) if (error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status) && (!requestPathIncludes || error.requestPath?.includes(requestPathIncludes))) return true;
+	return false;
+}
+function formatPlatformRuntime(runtime) {
+	return [
+		`${import_picocolors$1.default.bold("Version:")} ${runtime.manifest.platformVersion}`,
+		`${import_picocolors$1.default.bold("Source:")} ${runtime.source}`,
+		`${import_picocolors$1.default.bold("Revision:")} ${runtime.manifest.sourceRevision ?? "not recorded"}`,
+		`${import_picocolors$1.default.bold("Manifest SHA-256:")} ${runtime.manifestSha256}`
+	].join("\n");
+}
+async function verifyPlatformAiGatewayPlan(client, input, existing, preview, authoritativeProvisionIntents) {
+	let verified;
+	try {
+		verified = await createPlatformInstallPlan(client, input, existing, { authoritativeProvisionIntents });
+	} catch (error) {
+		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
+		throw error;
+	}
+	const infrastructure = (plan) => plan.actions.filter((action) => action.kind !== "ai-gateway").map(({ action, id, key, kind, name }) => ({
+		action,
+		id,
+		key,
+		kind,
+		name
+	}));
+	if (verified.installationId !== preview.installationId || JSON.stringify(verified.deployment) !== JSON.stringify(preview.deployment) || JSON.stringify(infrastructure(verified)) !== JSON.stringify(infrastructure(preview))) throw new Error("platform: Resources changed while checking AI Gateway access. Rerun the command to review the updated plan. No platform resources were created.");
+	return verified;
+}
+function assertNoninteractivePlatformMutationAcknowledged(args, interactive) {
+	if (args.subcommand === "list" || args.subcommand === "use" || args.subcommand === "status" || args.subcommand === "discover" || args.plan || interactive || args.yes) return;
+	throw new Error(`platform: Non-interactive \`void platform ${args.subcommand}\` requires --yes to acknowledge Cloudflare changes. Run with --plan first to inspect them.`);
+}
+async function readAccounts(client) {
+	const accounts = await client.listAccounts();
+	if (accounts.length === 0) throw new Error("platform: This Cloudflare token has no accessible accounts.");
+	return accounts;
+}
+async function selectAccount(accounts, selector) {
+	if (selector) {
+		const matches = accounts.filter((account) => account.id === selector || account.name.toLowerCase() === selector.toLowerCase());
+		if (matches.length !== 1) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is ambiguous or unavailable.`);
+		return matches[0].id;
+	}
+	if (accounts.length === 1) return accounts[0].id;
+	if (!process.stdin.isTTY) throw new Error("platform: --account <id> is required when the token can access multiple accounts.");
+	const value = await select({
+		message: "Cloudflare account:",
+		options: accounts.map((account) => ({
+			label: account.name,
+			value: account.id,
+			hint: account.id
+		}))
+	});
+	if (isCancel(value)) throw new Error("platform: Cancelled.");
+	return String(value);
+}
+async function promptText(message, value, optional = false, validate) {
+	if (!process.stdin.isTTY) {
+		if (optional) return "";
+		throw new Error(`platform: ${message.replace(/:$/, "")} is required in non-interactive mode.`);
+	}
+	const input = await text({
+		message,
+		...typeof value === "string" ? { initialValue: value } : value,
+		validate: (input) => input ? validate?.(input) : optional ? void 0 : "A value is required."
+	});
+	if (isCancel(input) || typeof input === "symbol") throw new Error("platform: Cancelled.");
+	return input;
+}
+async function promptSecret(message, masked = true, validate, placeholder) {
+	if (!process.stdin.isTTY) throw new Error(`platform: ${message.replace(/:$/, "")} is required in non-interactive mode. Set the documented VOID_PLATFORM_* environment variable.`);
+	const options = {
+		message,
+		validate: (input) => input ? validate?.(input) : "A value is required."
+	};
+	const value = masked ? placeholder ? await passwordWithPlaceholder({
+		...options,
+		placeholder
+	}) : await password(options) : await text({
+		...options,
+		placeholder
+	});
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+//#endregion
+export { resolvePlatformCloudflareCredential as S, hyperdriveOriginConfigHash as _, installPlatform as a, assertNoninteractivePlatformMutationAcknowledged, verifyPlatformRuntimeTokenPermissions as b, resolveBootstrapGitHubId as c, createPlatformInstallPlan as d, formatPlatformInstallPlan as f, PlatformCloudflareClient as g, revalidatePlatformInstallAction as h, createPlatformInstallationSecrets as i, recordPlatformWorkerTraffic as l, platformProvisionIntentHash as m, acquirePlatformDatabaseLifecycleLock as n, loadPlatformRuntime as o, platformAdoptionIntentHash as p, createPlatformHealthProbeToken as r, resolvePlatformInstallDatabaseUrl, runPlatformLifecycleCommand, recordResource as s, REMOTE_INSTALLATION_MANIFEST_KEY as t, trackedPlatformWorkerTraffic as u, hyperdriveOriginFromConnectionString as v, assertPlatformOperatorCredentialCanApplyPlan as x, hyperdriveOriginMatches as y };