void 0.20.1 → 0.20.3

package/dist/{platform-lifecycle-DN4MzJF_.mjs → platform-lifecycle-R9xAxvtG.mjs}

@@ -1,111 +1,22 @@
 import { r as __toESM } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { o as join } from "./dist-BrsS7cai.mjs";
-import { $ as resolveInstallationManifest, A as password, B as assertPlatformInstallationSlugAvailable, D as log, E as intro, F as isCancel, H as latestPlatformWorkerCutoverGeneration, I as settings, J as promoteInstallationSecrets, L as u$1, M as symbol, N as text, O as note, P as CANCEL_SYMBOL, U as listInstallationManifests, X as readPendingInstallationSecrets, c as import_picocolors$1, et as savePlatformConnection, h as S_BAR_END, i as createSpinner, j as select, k as outro, m as S_BAR, n as cliCommandName, nt as writeInstallationManifest, q as platformWorkerSecretUpdateIntentState, r as cliTitle, rt as writePendingInstallationSecrets, st as require_picocolors, v as S_PASSWORD_MASK, w as confirm, z as acquirePlatformLifecycleLock } from "./output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { d as openBrowser } from "./auth-W9WII-mN.mjs";
+import { $ as promoteInstallationSecrets, A as outro, D as log, E as intro, F as CANCEL_SYMBOL, G as assertPlatformInstallationSlugAvailable, I as isCancel, J as listInstallationManifests, L as settings, M as select, N as symbol, O as multiselect, P as text$1, Q as platformWorkerSecretUpdateIntentState, R as u$1, V as ensurePlatformAccessToken, W as acquirePlatformLifecycleLock, X as normalizePlatformApiUrl, at as savePlatformConnection, c as import_picocolors$1, ct as writePendingInstallationSecrets, et as readInstallationRecoverySecrets, ft as require_picocolors, h as S_BAR_END, i as createSpinner, it as resolveInstallationManifest, j as password, k as note, m as S_BAR, n as cliCommandName, q as latestPlatformWorkerCutoverGeneration, r as cliTitle, st as writeInstallationManifest, tt as readPendingInstallationSecrets, v as S_PASSWORD_MASK, w as confirm } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { f as openBrowser } from "./auth-DPl6kck4.mjs";
 import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
-import { l as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-B1QtTO1b.mjs";
-import { n as createDefaultRunWrangler, o as resolvePinnedApiBaseUrl } from "./provision-Blnstcm2.mjs";
+import { l as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-6M5llVPC.mjs";
+import { n as createDefaultRunWrangler, o as resolvePinnedApiBaseUrl } from "./provision-CSJOjjQk.mjs";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { stripVTControlCharacters } from "node:util";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
+import { readFile } from "node:fs/promises";
 import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
 import { platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
-//#region src/cli/platform-auth.ts
-function assertPlatformOperatorCredentialCanApplyPlan(credential, plan) {
-	if (credential.source !== "oauth") return;
-	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
-	if (!createsZone && !writesDns) return;
-	const permissions = [...createsZone ? ["Account → Zone → Edit"] : [], ...writesDns ? ["Zone → DNS → Edit"] : []];
-	throw new Error(`platform: Cloudflare browser OAuth grants Zone Read and cannot apply the planned zone or DNS changes. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account and application zone, then rerun the command.`);
-}
-async function resolvePlatformCloudflareCredential(dependencies = {}) {
-	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
-	return credential;
-}
-/** Check saved credentials during input, but never start browser login until it succeeds. */
-async function resolvePlatformCloudflareCredentialWithInput(readInput, dependencies = {}) {
-	const controller = new AbortController();
-	const runner = dependencies.runWrangler ?? ((args) => runCloudflareAuthCommand(process.cwd(), args, controller.signal));
-	const runWrangler = (args, capture) => {
-		controller.signal.throwIfAborted();
-		return runner(args, capture);
-	};
-	const pending = readExistingCredential(dependencies, runWrangler).then((credential) => ({
-		ok: true,
-		credential
-	}), (error) => ({
-		ok: false,
-		error
-	}));
-	const cancel = () => controller.abort();
-	const assertNotCancelled = () => {
-		if (controller.signal.aborted) throw new Error("platform: Cancelled.");
-	};
-	try {
-		const input = await readInput();
-		process.once("SIGINT", cancel);
-		const result = await pending;
-		assertNotCancelled();
-		if (!result.ok) throw result.error;
-		if (result.credential) return {
-			input,
-			credential: result.credential
-		};
-		announceCloudflareLogin();
-		const login = await runWrangler(["login", "--use-keyring"], true);
-		assertNotCancelled();
-		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
-		const credential = await readWranglerOAuthCredential(runWrangler);
-		assertNotCancelled();
-		if (!credential) throw new Error("platform: Cloudflare sign-in completed without a usable OAuth credential.");
-		return {
-			input,
-			credential
-		};
-	} finally {
-		process.removeListener("SIGINT", cancel);
-		controller.abort();
-	}
-}
-async function readExistingCredential(dependencies, runWrangler) {
-	const environmentToken = process.env.CLOUDFLARE_API_TOKEN?.trim() || process.env.CF_API_TOKEN?.trim() || "";
-	if (environmentToken) return {
-		source: "environment",
-		token: environmentToken
-	};
-	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
-	if ((await runWrangler([
-		"auth",
-		"keyring",
-		"enable"
-	], true)).status !== 0) throw new Error("platform: Could not enable secure Cloudflare credential storage. Refusing to use a plaintext OAuth credential.");
-	return await readWranglerOAuthCredential(runWrangler);
-}
-async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
-	const result = await runWrangler([
-		"auth",
-		"token",
-		"--json"
-	], true);
-	if (result.status !== 0) return null;
-	try {
-		const parsed = JSON.parse(result.stdout);
-		if (parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
-		return {
-			source: "oauth",
-			token: parsed.token.trim()
-		};
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
 	status;
@@ -191,7 +102,8 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 				...init?.body ? { "Content-Type": "application/json" } : {},
 				...init?.headers
 			},
-			signal: init?.signal ?? AbortSignal.timeout(3e4)
+			signal: init?.signal ?? AbortSignal.timeout(3e4),
+			redirect: "manual"
 		});
 		let envelope;
 		try {
@@ -546,6 +458,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			method: "POST",
 			body: JSON.stringify({
 				name,
+				caching: { disabled: true },
 				origin: {
 					database: parsed.database,
 					host: parsed.host,
@@ -565,6 +478,12 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 	async listWorkerNames(accountId) {
 		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts`)).map((entry) => requiredString(entry.id, "Worker name"));
 	}
+	async disableHyperdriveCaching(accountId, id) {
+		await this.request(`/accounts/${encodeURIComponent(accountId)}/hyperdrive/configs/${encodeURIComponent(id)}`, {
+			method: "PATCH",
+			body: JSON.stringify({ caching: { disabled: true } })
+		});
+	}
 	async putKvValue(accountId, namespaceId, key, value) {
 		await this.request(`/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}/values/${encodeURIComponent(key)}`, {
 			method: "PUT",
@@ -773,6 +692,7 @@ function parseHyperdriveConfig(value) {
 	return {
 		id: requiredString(value.id, "Hyperdrive id"),
 		name: requiredString(value.name, "Hyperdrive name"),
+		cachingDisabled: !!value.caching && typeof value.caching === "object" && !Array.isArray(value.caching) && value.caching.disabled === true,
 		origin: {
 			database: requiredString(record.database, "Hyperdrive origin database"),
 			host: requiredString(record.host, "Hyperdrive origin host").toLowerCase(),
@@ -783,10 +703,880 @@ function parseHyperdriveConfig(value) {
 	};
 }
 //#endregion
+//#region src/cli/platform-access-provision.ts
+function object(value, name) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`platform: Invalid ${name} response from Cloudflare Access.`);
+	return value;
+}
+function text(value, name) {
+	if (typeof value !== "string" || !value || value.length > 8192) throw new Error(`platform: Cloudflare Access did not return ${name}.`);
+	return value;
+}
+function ids(value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => typeof entry === "string" ? entry : text(object(entry, "policy").id, "policy ID"));
+}
+function sameSet(left, right) {
+	return left.length === right.length && [...left].sort().every((id, index) => id === [...right].sort()[index]);
+}
+function fingerprint(value) {
+	return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+var PlatformAccessClient = class {
+	client;
+	accountId;
+	constructor(client, accountId) {
+		this.client = client;
+		this.accountId = accountId;
+	}
+	path(suffix) {
+		return `/accounts/${encodeURIComponent(this.accountId)}/access/${suffix}`;
+	}
+	get(suffix) {
+		return this.client.request(this.path(suffix));
+	}
+	create(suffix, body) {
+		return this.client.request(this.path(suffix), {
+			method: "POST",
+			body: JSON.stringify(body)
+		});
+	}
+	async list(suffix) {
+		const result = [];
+		for (let page = 1; page <= 100; page++) {
+			const value = await this.get(`${suffix}?page=${page}&per_page=100`);
+			if (!Array.isArray(value)) throw new Error("platform: Invalid Access inventory response.");
+			result.push(...value.map((entry) => object(entry, "inventory")));
+			if (value.length < 100) return result;
+		}
+		throw new Error("platform: Access inventory exceeded the supported pagination limit.");
+	}
+};
+function identityRule(rule) {
+	if (rule.email_domain) {
+		const domain = object(rule.email_domain, "email domain").domain;
+		return typeof domain === "string" && /^(?:[a-z0-9-]+\.)+[a-z]{2,63}$/i.test(domain);
+	}
+	if (rule.email) {
+		const email = object(rule.email, "email rule").email;
+		return typeof email === "string" && /^[^\s*@]+@[^\s*@]+\.[^\s*@]+$/.test(email);
+	}
+	return [
+		"email",
+		"email_domain",
+		"email_list",
+		"gsuite",
+		"github-organization",
+		"saml",
+		"okta",
+		"group"
+	].some((key) => Object.hasOwn(rule, key) && !!rule[key] && typeof rule[key] === "object" && !Array.isArray(rule[key]) && Object.keys(rule[key]).length > 0);
+}
+/** Preserve corporate MFA/device requirements; reject broad policies rather than rewriting them. */
+async function verifyCompanyAccessPolicies(client, policies) {
+	const groups = /* @__PURE__ */ new Set();
+	const checkedGroups = /* @__PURE__ */ new Set();
+	const checkRules = async (value, depth = 0) => {
+		if (value === void 0) return;
+		if (!Array.isArray(value) || value.length > 100 || depth > 8) throw new Error("platform: Unsupported Access policy rule structure.");
+		for (const entry of value) {
+			const rule = object(entry, "policy rule");
+			if (Object.hasOwn(rule, "everyone") || Object.hasOwn(rule, "any_valid_service_token")) throw new Error("platform: Company Access policies must not allow Everyone or any valid service token.");
+			if (rule.group) {
+				const id = text(object(rule.group, "Access group").id, "Access group ID");
+				if (groups.has(id)) throw new Error("platform: Access groups contain a recursive membership rule.");
+				if (checkedGroups.has(id)) continue;
+				if (checkedGroups.size >= 100) throw new Error("platform: Access group policy exceeds the inspection limit.");
+				groups.add(id);
+				const group = object(await client.get(`groups/${encodeURIComponent(id)}`), "Access group");
+				await checkRules(group.include, depth + 1);
+				await checkRules(group.require, depth + 1);
+				if (!Array.isArray(group.include) || !group.include.length) throw new Error("platform: Access groups must contain explicit identity rules.");
+				if (!(Array.isArray(group.require) && group.require.some((entry) => identityRule(object(entry, "group rule")))) && !group.include.every((entry) => identityRule(object(entry, "group rule")))) throw new Error("platform: Access groups must restrict company identities.");
+				groups.delete(id);
+				checkedGroups.add(id);
+			}
+		}
+	};
+	let allows = 0;
+	for (const policy of policies) {
+		if (![
+			"allow",
+			"deny",
+			"non_identity",
+			"bypass"
+		].includes(String(policy.decision))) throw new Error("platform: Unsupported Access policy decision.");
+		if (policy.decision === "bypass") throw new Error("platform: A bypass policy cannot protect a Void platform.");
+		if (policy.decision !== "allow") continue;
+		allows++;
+		await checkRules(policy.include);
+		await checkRules(policy.require);
+		if (!Array.isArray(policy.include) || !policy.include.length || !(Array.isArray(policy.require) && policy.require.some((entry) => identityRule(object(entry, "policy rule")))) && !policy.include.every((entry) => identityRule(object(entry, "policy rule")))) throw new Error("platform: Select Access allow policies restricted to company identities.");
+	}
+	if (!allows) throw new Error("platform: Select at least one company Access allow policy.");
+}
+function platformAccessPublicDestinations(application) {
+	const destinations = Array.isArray(application.destinations) ? application.destinations : [];
+	return [...typeof application.domain === "string" ? [application.domain] : [], ...destinations.flatMap((value) => {
+		const entry = object(value, "Access destination");
+		return entry.type === "public" && typeof entry.uri === "string" ? [entry.uri] : [];
+	})];
+}
+function platformAccessOverlapsOrigin(destination, origin) {
+	const pattern = "^" + destination.split("/")[0].split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$";
+	return new RegExp(pattern, "i").test(new URL(origin).hostname);
+}
+async function inspectPlatformAccess(client, input) {
+	const authDomain = text(object(await client.get("organizations"), "Access organization").auth_domain, "Access team domain");
+	const teamDomain = authDomain.startsWith("https://") ? authDomain : `https://${authDomain}`;
+	parsePlatformAccessProtection({
+		teamDomain,
+		applications: [{
+			origin: "https://validation.example.com",
+			audience: "validation"
+		}]
+	});
+	const identityProviders = (await client.list("identity_providers")).map((provider) => ({
+		id: text(provider.id, "identity provider ID"),
+		name: text(provider.name ?? provider.id, "identity provider name")
+	}));
+	if (!input.identityProviderIds.length || !input.policyIds.length || input.identityProviderIds.length > 16 || input.policyIds.length > 16 || new Set(input.identityProviderIds).size !== input.identityProviderIds.length || new Set(input.policyIds).size !== input.policyIds.length) throw new Error("platform: Select explicit identity providers and company policies for Access.");
+	if (input.identityProviderIds.some((id) => !identityProviders.some((provider) => provider.id === id))) throw new Error("platform: A selected Access identity provider is unavailable in this account.");
+	const policies = await Promise.all(input.policyIds.map(async (id) => object(await client.get(`policies/${encodeURIComponent(id)}`), "Access policy")));
+	await verifyCompanyAccessPolicies(client, policies);
+	return {
+		teamDomain,
+		identityProviders,
+		policies
+	};
+}
+async function provisionPlatformAccess(client, input, previous, save) {
+	if (!input.login && !input.protection) return { resources: [] };
+	if (client.accountId !== input.accountId) throw new Error("platform: Access account selection does not match its management client.");
+	const inspected = await inspectPlatformAccess(client, input);
+	const origins = [...new Set([
+		input.apiUrl,
+		input.proxyUrl,
+		...input.additionalOrigins ?? []
+	].map((value) => {
+		const url = new URL(value);
+		if (url.origin !== value || url.protocol !== "https:") throw new Error("platform: Access requires exact HTTPS origins without credentials, paths, or query strings.");
+		return url.origin;
+	}))];
+	for (const origin of origins) if (!origin.startsWith("https://")) throw new Error("platform: Access protection requires HTTPS platform origins.");
+	const state = previous ? structuredClone(previous) : {
+		version: 1,
+		accountId: input.accountId,
+		installationId: input.installationId,
+		nonce: randomBytes(16).toString("hex"),
+		resources: {}
+	};
+	if (state.version !== 1 || state.accountId !== input.accountId || state.installationId !== input.installationId || !/^[a-f0-9]{32}$/.test(state.nonce)) throw new Error("platform: Access recovery data belongs to a different installation.");
+	save(state);
+	const policies = input.policyIds.map((id, index) => ({
+		id,
+		precedence: index + 1
+	}));
+	const inventory = await client.list("apps");
+	const tokenInventory = input.protection ? await client.list("service_tokens") : [];
+	if (input.protection?.applicationId && !input.serviceToken) throw new Error("platform: Connecting an existing protection application requires its admitted service token.");
+	if (input.serviceToken) {
+		const token = tokenInventory.find((token) => token.id === input.serviceToken.id);
+		if (!token || token.client_id !== input.serviceToken.clientId || token.enabled === false || typeof token.expires_at === "string" && Date.parse(token.expires_at) <= Date.now()) throw new Error("platform: The selected Access service token is unavailable, expired, or belongs to another client.");
+		const prior = state.resources["service-token"];
+		state.resources["service-token"] = {
+			id: input.serviceToken.id,
+			name: text(token.name, "service token name"),
+			fingerprint: fingerprint({ origins }),
+			pending: false,
+			adopted: prior?.id === input.serviceToken.id ? prior.adopted : true
+		};
+		save(state);
+	}
+	if (input.protection) for (const app of inventory) {
+		if (app.id === input.protection.applicationId || app.id === state.resources.protection?.id || app.name === state.resources.protection?.name) continue;
+		if (platformAccessPublicDestinations(app).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)))) throw new Error("platform: An existing Access application overlaps a platform endpoint. Connect or reconcile it explicitly before provisioning protection.");
+	}
+	const output = { resources: [] };
+	const application = async (key, expected, existingId) => {
+		if (existingId) {
+			const found = object(await client.get(`apps/${encodeURIComponent(existingId)}`), "Access application");
+			if (found.id !== existingId) throw new Error("platform: Access returned a different application ID.");
+			state.resources[key] = {
+				id: existingId,
+				name: text(found.name, "application name"),
+				fingerprint: fingerprint(expected),
+				pending: true,
+				adopted: true
+			};
+			save(state);
+			return found;
+		}
+		const desiredHash = fingerprint(expected);
+		let checkpoint = state.resources[key];
+		if (checkpoint && checkpoint.fingerprint !== desiredHash) throw new Error("platform: Access setup changed after provisioning started. Connect the existing application explicitly rather than overwriting it.");
+		if (checkpoint?.id) {
+			const found = object(await client.get(`apps/${encodeURIComponent(checkpoint.id)}`), "Access application");
+			if (found.id !== checkpoint.id || found.name !== checkpoint.name) throw new Error("platform: The recorded Access application changed ownership identity.");
+			return found;
+		}
+		if (checkpoint?.pending) {
+			const matching = inventory.filter((app) => app.name === checkpoint.name);
+			if (matching.length !== 1) throw new Error("platform: An Access application creation has an uncertain outcome. Inspect Cloudflare and connect the existing application; no creation was retried.");
+			checkpoint.id = text(matching[0].id, "application ID");
+			save(state);
+			return object(await client.get(`apps/${encodeURIComponent(checkpoint.id)}`), "Access application");
+		}
+		const name = `void-${input.installationId}-${key}`.slice(0, 90) + "-" + state.nonce.slice(0, 16);
+		if (inventory.some((app) => app.name === name)) throw new Error("platform: An Access application with this installation identity already exists. Connect it explicitly; no duplicate was created.");
+		checkpoint = {
+			name,
+			fingerprint: desiredHash,
+			pending: true
+		};
+		state.resources[key] = checkpoint;
+		save(state);
+		try {
+			const created = object(await client.create("apps", {
+				...expected,
+				name
+			}), "Access application");
+			checkpoint.id = text(created.id, "application ID");
+			if (created.saas_app) {
+				const oidc = object(created.saas_app, "OIDC application");
+				checkpoint.clientId = text(oidc.client_id, "OIDC client ID");
+				checkpoint.clientSecret = typeof oidc.client_secret === "string" ? oidc.client_secret : void 0;
+			}
+			save(state);
+			return object(await client.get(`apps/${encodeURIComponent(checkpoint.id)}`), "Access application");
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
+				408,
+				409,
+				429
+			].includes(error.status)) {
+				checkpoint.pending = false;
+				save(state);
+			}
+			throw error;
+		}
+	};
+	const completeApplication = (key, app) => {
+		const checkpoint = state.resources[key];
+		if (!checkpoint?.id || checkpoint.id !== app.id || checkpoint.name !== app.name) throw new Error("platform: The verified Access application changed ownership identity.");
+		checkpoint.pending = false;
+		save(state);
+	};
+	if (input.login) {
+		const key = `login-${input.login.id}`;
+		const app = await application(key, {
+			type: "saas",
+			allowed_idps: [...input.identityProviderIds],
+			auto_redirect_to_identity: input.identityProviderIds.length === 1,
+			policies,
+			session_duration: "12h",
+			saas_app: {
+				auth_type: "oidc",
+				redirect_uris: [`${input.apiUrl}/auth/callback`],
+				grant_types: ["authorization_code_with_pkce"],
+				allow_pkce_without_client_secret: false,
+				scopes: input.login.requiredGroups?.length ? [
+					"openid",
+					"email",
+					"profile",
+					"groups"
+				] : [
+					"openid",
+					"email",
+					"profile"
+				]
+			}
+		}, input.login.applicationId);
+		await verifyPlatformAccessApplication(client, input, app, "saas");
+		const oidc = object(app.saas_app, "OIDC configuration");
+		if (oidc.auth_type !== "oidc" || !sameSet(ids(oidc.redirect_uris), [`${input.apiUrl}/auth/callback`]) || !sameSet(ids(oidc.grant_types), ["authorization_code_with_pkce"]) || oidc.allow_pkce_without_client_secret === true) throw new Error("platform: Access OIDC redirect or flow settings do not match Void.");
+		const clientId = text(oidc.client_id, "OIDC client ID");
+		const clientSecret = input.login.clientSecret ?? state.resources[key]?.clientSecret;
+		if (!clientSecret) throw new Error("platform: The Access application exists but its client secret was not recovered. Supply its secret explicitly; no duplicate application was created.");
+		output.login = {
+			configuration: parsePlatformLoginConfiguration({
+				id: input.login.id,
+				kind: "cloudflare-access",
+				label: input.login.label,
+				issuer: `${inspected.teamDomain}/cdn-cgi/access/sso/oidc/${clientId}`,
+				clientId,
+				requiredGroups: input.login.requiredGroups ?? []
+			}),
+			clientSecret
+		};
+		completeApplication(key, app);
+	}
+	if (input.protection) {
+		let service = input.serviceToken;
+		const tokenKey = "service-token";
+		if (!service) {
+			let saved = state.resources[tokenKey];
+			if (!saved) {
+				saved = {
+					name: `void-${input.installationId}-access-probes-${state.nonce.slice(0, 16)}`,
+					fingerprint: fingerprint({ origins }),
+					pending: true
+				};
+				state.resources[tokenKey] = saved;
+				save(state);
+				if (tokenInventory.some((token) => token.name === saved.name)) throw new Error("platform: An Access service token for this installation already exists. Supply its credentials explicitly; no duplicate was created.");
+				const created = object(await client.create("service_tokens", {
+					name: saved.name,
+					duration: "8760h"
+				}), "Access service token");
+				saved.id = text(created.id, "service token ID");
+				saved.clientId = text(created.client_id, "service token client ID");
+				saved.clientSecret = text(created.client_secret, "service token secret");
+				saved.pending = false;
+				save(state);
+			}
+			if (!saved.id || !saved.clientId || !saved.clientSecret) {
+				const found = (await client.list("service_tokens")).filter((token) => token.name === saved.name);
+				if (found.length === 1) {
+					saved.id = text(found[0].id, "service token ID");
+					save(state);
+				}
+				throw new Error("platform: Access service-token creation has an uncertain outcome or its secret was lost. Supply an existing admitted service token; no creation was retried.");
+			}
+			if (saved.fingerprint !== fingerprint({ origins })) throw new Error("platform: The saved Access service token belongs to different platform origins. Connect the intended service token explicitly.");
+			service = {
+				id: saved.id,
+				clientId: saved.clientId,
+				clientSecret: saved.clientSecret
+			};
+		}
+		const app = await application("protection", {
+			type: "self_hosted",
+			domain: new URL(input.apiUrl).hostname,
+			destinations: origins.map((origin) => ({
+				type: "public",
+				uri: new URL(origin).hostname
+			})),
+			allowed_idps: [...input.identityProviderIds],
+			auto_redirect_to_identity: input.identityProviderIds.length === 1,
+			session_duration: "12h",
+			policies: [...policies, {
+				name: "Void installer and CI",
+				decision: "non_identity",
+				precedence: 0,
+				include: [{ service_token: { token_id: service.id } }]
+			}]
+		}, input.protection.applicationId);
+		await verifyPlatformAccessApplication(client, input, app, "self_hosted", service.id);
+		const covered = platformAccessPublicDestinations(app);
+		if (origins.some((origin) => !covered.includes(new URL(origin).hostname))) throw new Error("platform: Access must protect both the API and proxy origins without path exclusions.");
+		const audience = text(app.aud, "application audience");
+		output.protection = parsePlatformAccessProtection({
+			teamDomain: inspected.teamDomain,
+			applications: origins.map((origin) => ({
+				origin,
+				audience
+			}))
+		});
+		output.credentials = Object.fromEntries(origins.map((origin) => [origin, {
+			CF_ACCESS_CLIENT_ID: service.clientId,
+			CF_ACCESS_CLIENT_SECRET: service.clientSecret
+		}]));
+		completeApplication("protection", app);
+		const savedService = state.resources[tokenKey];
+		if (savedService?.id === service.id) {
+			savedService.pending = false;
+			save(state);
+		}
+	}
+	output.resources = Object.entries(state.resources).flatMap(([key, value]) => value.id ? [{
+		key,
+		id: value.id,
+		name: value.name,
+		adopted: value.adopted === true
+	}] : []);
+	return output;
+}
+async function verifyPlatformAccessApplication(client, input, app, type, machineId) {
+	if (app.type !== type || !sameSet(ids(app.allowed_idps), input.identityProviderIds)) throw new Error("platform: Access application identity-provider configuration does not match the reviewed plan.");
+	const currentPolicies = await client.list(`apps/${encodeURIComponent(text(app.id, "application ID"))}/policies`);
+	await verifyCompanyAccessPolicies(client, currentPolicies);
+	if (!sameSet(currentPolicies.filter((policy) => policy.decision === "allow" || policy.decision === "deny").map((policy) => text(policy.id, "policy ID")), input.policyIds)) throw new Error("platform: Access application policies do not match the reviewed company policies.");
+	for (const policy of currentPolicies.filter((policy) => policy.decision === "non_identity")) {
+		const includes = Array.isArray(policy.include) ? policy.include : [];
+		if (!machineId || includes.length !== 1 || object(includes[0], "service policy").service_token === void 0 || object(object(includes[0], "service policy").service_token, "service token rule").token_id !== machineId) throw new Error("platform: Access application contains an unexpected machine policy.");
+	}
+	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
+}
+//#endregion
+//#region src/cli/platform-access-setup.ts
+function platformAccessResourceInventory(encoded, installationId) {
+	if (!encoded) return [];
+	const state = JSON.parse(encoded);
+	if (state.version !== 1 || state.installationId !== installationId || typeof state.accountId !== "string" || !state.resources) throw new Error("platform: Access resource recovery data belongs to another installation.");
+	return Object.entries(state.resources).flatMap(([key, resource]) => resource.id ? [{
+		key,
+		kind: key.includes("service-token") ? "service-token" : "application",
+		accountId: state.accountId,
+		id: resource.id,
+		name: resource.name,
+		ownership: resource.adopted ? "adopted" : "created"
+	}] : []);
+}
+function checkpointPlatformAccessResources(manifest, encoded, updatedAt) {
+	const resources = platformAccessResourceInventory(encoded, manifest.id);
+	const previous = manifest.authenticationResources ?? [];
+	return resources.length ? {
+		...manifest,
+		authenticationResources: [...previous, ...resources.filter((resource) => !previous.some((saved) => saved.accountId === resource.accountId && saved.kind === resource.kind && saved.id === resource.id))],
+		updatedAt
+	} : manifest;
+}
+function isPlatformAuthenticationPreparationKey(name) {
+	return name.startsWith("authenticationConnection:") || [
+		"accessManagementToken",
+		"accessSetupSpecJson",
+		"accessExistingServiceTokenJson",
+		"accessExistingLoginSecret"
+	].includes(name);
+}
+/** Validate before planning; credential references are resolved only during provisioning. */
+function parsePlatformAccessSetupSpec(input) {
+	if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("platform: cloudflareAccess must contain an Access setup configuration.");
+	const value = input;
+	const allowed = /* @__PURE__ */ new Set([
+		"mode",
+		"accountId",
+		"identityProviderIds",
+		"policyIds",
+		"loginApplicationId",
+		"protectionApplicationId",
+		"loginClientSecretEnv",
+		"serviceToken"
+	]);
+	if (Object.keys(value).some((key) => !allowed.has(key))) throw new Error("platform: Unknown Access setup field. Use environment references for credentials.");
+	if (value.mode !== "create" && value.mode !== "existing") throw new Error("platform: Access setup mode must be create or existing.");
+	for (const key of [
+		"accountId",
+		"loginApplicationId",
+		"protectionApplicationId",
+		"loginClientSecretEnv"
+	]) if (value[key] !== void 0 && (typeof value[key] !== "string" || !value[key] || String(value[key]).length > 256)) throw new Error(`platform: Invalid Access ${key}.`);
+	for (const key of ["identityProviderIds", "policyIds"]) {
+		const ids = value[key];
+		if (ids !== void 0 && (!Array.isArray(ids) || !ids.length || ids.length > 16 || ids.some((id) => typeof id !== "string" || !id || id.length > 256) || new Set(ids).size !== ids.length)) throw new Error(`platform: Invalid Access ${key}.`);
+	}
+	if (value.loginClientSecretEnv && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(value.loginClientSecretEnv))) throw new Error("platform: Invalid Access client secret environment reference.");
+	if (value.serviceToken !== void 0) {
+		const token = value.serviceToken;
+		if (!token || typeof token !== "object" || Array.isArray(token) || Object.keys(token).some((key) => ![
+			"id",
+			"clientIdEnv",
+			"clientSecretEnv"
+		].includes(key))) throw new Error("platform: Access service tokens require an ID and environment references.");
+		const fields = token;
+		if (typeof fields.id !== "string" || !fields.id || fields.id.length > 256 || ["clientIdEnv", "clientSecretEnv"].some((key) => typeof fields[key] !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(fields[key]))) throw new Error("platform: Invalid Access service token environment references.");
+	}
+	return value;
+}
+function answer$1(value) {
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+function secretReference(name) {
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || !process.env[name]) throw new Error("platform: Supply the referenced Access credential in the environment.");
+	return process.env[name];
+}
+/** Only scoped credentials for the reviewed platform origins enter the process environment. */
+function activatePlatformAccessCredentials(encoded, origins) {
+	if (!encoded) return;
+	const entries = JSON.parse(encoded);
+	if (!entries || typeof entries !== "object" || Array.isArray(entries)) throw new Error("platform: Invalid saved Access credentials.");
+	const allowed = new Set(origins.map((origin) => new URL(origin).origin));
+	for (const [origin, value] of Object.entries(entries)) {
+		if (!allowed.has(origin) || !value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Access credentials must be scoped to this platform’s API or proxy.");
+		const headers = cfAccessHeaders({ VOID_ACCESS_CREDENTIALS: JSON.stringify({ [origin]: value }) }, origin);
+		if (!Object.keys(headers).length) throw new Error("platform: Saved Access credentials are incomplete.");
+	}
+	const current = process.env.VOID_ACCESS_CREDENTIALS ? JSON.parse(process.env.VOID_ACCESS_CREDENTIALS) : {};
+	if (!current || typeof current !== "object" || Array.isArray(current)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed object.");
+	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
+		...current,
+		...entries
+	});
+}
+async function preparePlatformAccessSetup(input) {
+	if (!input.login && !input.protection) return;
+	let spec = input.spec ?? (input.checkpoint.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson)) : void 0);
+	if (!spec) {
+		if (!process.stdin.isTTY) {
+			if (input.protection) throw new Error("platform: Protection requires cloudflareAccess create or existing application verification in --auth-config.");
+			return;
+		}
+		const mode = answer$1(await select({
+			message: "Cloudflare Access setup:",
+			options: [
+				{
+					value: "create",
+					label: "Create applications automatically in this Cloudflare account"
+				},
+				{
+					value: "existing",
+					label: "Connect existing applications (including another account)"
+				},
+				...!input.protection ? [{
+					value: "manual",
+					label: "Connect an existing OIDC issuer without Cloudflare management access"
+				}] : []
+			]
+		}));
+		if (mode === "manual") return;
+		spec = { mode };
+		if (mode === "existing") {
+			spec.accountId = answer$1(await text$1({
+				message: "Cloudflare identity account ID:",
+				initialValue: input.plan.account.id
+			}));
+			if (input.login) spec.loginApplicationId = answer$1(await text$1({ message: "Existing Access OIDC application ID:" }));
+			if (input.protection) spec.protectionApplicationId = answer$1(await text$1({ message: "Existing Access protection application ID:" }));
+		}
+	}
+	spec = parsePlatformAccessSetupSpec(spec);
+	input.save({ accessSetupSpecJson: JSON.stringify(spec) });
+	const accountId = spec.accountId ?? input.plan.account.id;
+	const credential = process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN || input.checkpoint.accessManagementToken;
+	let management = credential ? new PlatformCloudflareClient(credential, { apiBase: input.client.apiBaseUrl }) : input.client;
+	let client = new PlatformAccessClient(management, accountId);
+	let providers;
+	let policies;
+	try {
+		await client.get("organizations");
+		providers = await client.list("identity_providers");
+		policies = await client.list("policies");
+	} catch (error) {
+		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status) || !process.stdin.isTTY || credential) throw error;
+		console.error(`Access setup for account ${accountId} needs Access applications/policies permissions and organization/identity-provider/group read access${input.protection ? ", plus service-token permissions" : ""}.`);
+		const token = answer$1(await password({ message: "Access setup API token (kept out of the platform runtime):" }));
+		input.save({ accessManagementToken: token });
+		management = new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl });
+		client = new PlatformAccessClient(management, accountId);
+		await client.get("organizations");
+		providers = await client.list("identity_providers");
+		policies = await client.list("policies");
+	}
+	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
+		message: "Company identity providers:",
+		required: true,
+		options: providers.filter((provider) => typeof provider.id === "string").map((provider) => ({
+			value: String(provider.id),
+			label: stripVTControlCharacters(String(provider.name ?? provider.id))
+		}))
+	})) : []);
+	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
+		message: "Existing company Access policies (MFA and device requirements are preserved):",
+		required: true,
+		options: policies.filter((policy) => typeof policy.id === "string" && ["allow", "deny"].includes(String(policy.decision))).map((policy) => ({
+			value: String(policy.id),
+			label: stripVTControlCharacters(String(policy.name ?? policy.id))
+		}))
+	})) : []);
+	if (!identityProviderIds.length || !policyIds.length) throw new Error("platform: Access setup requires explicit identityProviderIds and policyIds.");
+	spec = {
+		...spec,
+		identityProviderIds,
+		policyIds
+	};
+	input.save({ accessSetupSpecJson: JSON.stringify(spec) });
+	if (spec.mode === "existing" && (input.login && !spec.loginApplicationId || input.protection && !spec.protectionApplicationId)) throw new Error("platform: Existing Access setup requires application IDs for each selected capability.");
+	let serviceToken = spec.serviceToken ? {
+		id: spec.serviceToken.id,
+		clientId: secretReference(spec.serviceToken.clientIdEnv),
+		clientSecret: secretReference(spec.serviceToken.clientSecretEnv)
+	} : void 0;
+	if (!serviceToken && spec.mode === "existing" && input.protection) {
+		if (input.checkpoint.accessExistingServiceTokenJson) serviceToken = JSON.parse(input.checkpoint.accessExistingServiceTokenJson);
+		else if (process.stdin.isTTY) {
+			serviceToken = {
+				id: answer$1(await text$1({ message: "Existing admitted Access service token ID:" })),
+				clientId: answer$1(await password({ message: "Access service token client ID:" })),
+				clientSecret: answer$1(await password({ message: "Access service token client secret:" }))
+			};
+			input.save({ accessExistingServiceTokenJson: JSON.stringify(serviceToken) });
+		}
+	}
+	if (spec.mode === "existing" && input.protection && !serviceToken) throw new Error("platform: Supply the service token already admitted by the existing protection application.");
+	const reviewed = {
+		accountId,
+		login: input.login?.id ?? null,
+		protection: input.protection,
+		identityProviderIds,
+		policyIds,
+		origins: input.protection ? [
+			input.plan.apiUrl,
+			input.plan.proxyUrl,
+			...input.additionalOrigins ?? []
+		] : [],
+		mode: spec.mode
+	};
+	console.log(JSON.stringify({ accessPlan: reviewed }, null, 2));
+	if (!input.yes) {
+		if (!process.stdin.isTTY || !answer$1(await confirm({
+			message: "Apply this Access configuration?",
+			initialValue: false
+		}))) throw new Error("platform: Access setup changes require confirmation or --yes.");
+	}
+	const previous = input.checkpoint.accessProvisioningJson ? JSON.parse(input.checkpoint.accessProvisioningJson) : {
+		version: 1,
+		accountId,
+		installationId: input.plan.installationId,
+		nonce: createHash("sha256").update(`void-access:${input.ownershipNonce}`).digest("hex").slice(0, 32),
+		resources: {}
+	};
+	let loginClientSecret = spec.loginClientSecretEnv ? secretReference(spec.loginClientSecretEnv) : input.checkpoint.accessExistingLoginSecret;
+	if (input.login && spec.mode === "existing" && !loginClientSecret && process.stdin.isTTY) {
+		loginClientSecret = answer$1(await password({ message: "Existing Access OIDC client secret:" }));
+		input.save({ accessExistingLoginSecret: loginClientSecret });
+	}
+	const result = await provisionPlatformAccess(client, {
+		accountId,
+		installationId: input.plan.installationId,
+		apiUrl: input.plan.apiUrl,
+		proxyUrl: input.plan.proxyUrl,
+		additionalOrigins: input.additionalOrigins,
+		identityProviderIds,
+		policyIds,
+		...input.login ? { login: {
+			...input.login,
+			applicationId: spec.loginApplicationId,
+			...loginClientSecret ? { clientSecret: loginClientSecret } : {}
+		} } : {},
+		...input.protection ? { protection: { applicationId: spec.protectionApplicationId } } : {},
+		serviceToken
+	}, previous, (state) => input.save({ accessProvisioningJson: JSON.stringify(state) }));
+	if (result.credentials) {
+		const accessCredentialsJson = JSON.stringify(result.credentials);
+		input.save({ accessCredentialsJson });
+		activatePlatformAccessCredentials(accessCredentialsJson, [
+			input.plan.apiUrl,
+			input.plan.proxyUrl,
+			...input.additionalOrigins ?? []
+		]);
+	}
+	return result;
+}
+//#endregion
+//#region src/cli/platform-auth.ts
+function assertPlatformOperatorCredentialCanApplyPlan(credential, plan) {
+	if (credential.source !== "oauth") return;
+	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
+	if (!createsZone && !writesDns) return;
+	const permissions = [...createsZone ? ["Account → Zone → Edit"] : [], ...writesDns ? ["Zone → DNS → Edit"] : []];
+	throw new Error(`platform: Cloudflare browser OAuth grants Zone Read and cannot apply the planned zone or DNS changes. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account and application zone, then rerun the command.`);
+}
+async function resolvePlatformCloudflareCredential(dependencies = {}) {
+	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
+	return credential;
+}
+/** Check saved credentials during input, but never start browser login until it succeeds. */
+async function resolvePlatformCloudflareCredentialWithInput(readInput, dependencies = {}) {
+	const controller = new AbortController();
+	const runner = dependencies.runWrangler ?? ((args) => runCloudflareAuthCommand(process.cwd(), args, controller.signal));
+	const runWrangler = (args, capture) => {
+		controller.signal.throwIfAborted();
+		return runner(args, capture);
+	};
+	const pending = readExistingCredential(dependencies, runWrangler).then((credential) => ({
+		ok: true,
+		credential
+	}), (error) => ({
+		ok: false,
+		error
+	}));
+	const cancel = () => controller.abort();
+	const assertNotCancelled = () => {
+		if (controller.signal.aborted) throw new Error("platform: Cancelled.");
+	};
+	try {
+		const input = await readInput();
+		process.once("SIGINT", cancel);
+		const result = await pending;
+		assertNotCancelled();
+		if (!result.ok) throw result.error;
+		if (result.credential) return {
+			input,
+			credential: result.credential
+		};
+		announceCloudflareLogin();
+		const login = await runWrangler(["login", "--use-keyring"], true);
+		assertNotCancelled();
+		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
+		const credential = await readWranglerOAuthCredential(runWrangler);
+		assertNotCancelled();
+		if (!credential) throw new Error("platform: Cloudflare sign-in completed without a usable OAuth credential.");
+		return {
+			input,
+			credential
+		};
+	} finally {
+		process.removeListener("SIGINT", cancel);
+		controller.abort();
+	}
+}
+async function readExistingCredential(dependencies, runWrangler) {
+	const environmentToken = process.env.CLOUDFLARE_API_TOKEN?.trim() || process.env.CF_API_TOKEN?.trim() || "";
+	if (environmentToken) return {
+		source: "environment",
+		token: environmentToken
+	};
+	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
+	if ((await runWrangler([
+		"auth",
+		"keyring",
+		"enable"
+	], true)).status !== 0) throw new Error("platform: Could not enable secure Cloudflare credential storage. Refusing to use a plaintext OAuth credential.");
+	return await readWranglerOAuthCredential(runWrangler);
+}
+async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
+	const result = await runWrangler([
+		"auth",
+		"token",
+		"--json"
+	], true);
+	if (result.status !== 0) return null;
+	try {
+		const parsed = JSON.parse(result.stdout);
+		if (parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+		return {
+			source: "oauth",
+			token: parsed.token.trim()
+		};
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/cli/platform-access-preflight.ts
+/** Recheck live protection without invoking any provisioning or configuration write. */
+async function verifyInstalledPlatformAccessProtection(input) {
+	const protection = parsePlatformAccessProtection(input.protection);
+	if (!protection) return;
+	const encoded = input.checkpoint.accessProvisioningJson;
+	const specEncoded = input.checkpoint.accessSetupSpecJson;
+	if (!encoded || !specEncoded) throw new Error("platform: Restore the current encrypted Access setup checkpoint before maintaining this protected installation.");
+	platformAccessResourceInventory(encoded, input.manifest.id);
+	const state = JSON.parse(encoded);
+	const spec = parsePlatformAccessSetupSpec(JSON.parse(specEncoded));
+	if (state.accountId !== (spec.accountId ?? input.manifest.account.id) || state.nonce !== createHash("sha256").update(`void-access:${input.manifest.ownershipNonce}`).digest("hex").slice(0, 32)) throw new Error("platform: The saved Access setup does not match this installation and identity account.");
+	const application = state.resources.protection;
+	const service = state.resources["service-token"];
+	if (!application?.id || application.pending || !service?.id || service.pending || spec.protectionApplicationId && spec.protectionApplicationId !== application.id) throw new Error("platform: Complete or restore the Access application and service-token checkpoint before maintenance.");
+	if (!input.client.request || !input.client.listWorkerDomains || !input.client.listWorkerServiceRoutes) throw new Error("platform: Read-only Access and Worker origin verification is required before maintaining protection.");
+	const token = process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN || input.checkpoint.accessManagementToken;
+	const access = new PlatformAccessClient(token ? new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }) : { request: input.client.request.bind(input.client) }, state.accountId);
+	const policy = {
+		identityProviderIds: spec.identityProviderIds ?? [],
+		policyIds: spec.policyIds ?? []
+	};
+	if ((await inspectPlatformAccess(access, policy)).teamDomain !== protection.teamDomain) throw new Error("platform: The live Access team domain does not match the active platform protection.");
+	const app = await access.get(`apps/${encodeURIComponent(application.id)}`);
+	if (!app || app.id !== application.id || app.name !== application.name) throw new Error("platform: The saved Access protection application no longer matches its resource.");
+	await verifyPlatformAccessApplication(access, policy, app, "self_hosted", service.id);
+	const origins = protection.applications.map((entry) => entry.origin);
+	if ([
+		input.plan.apiUrl,
+		input.plan.proxyUrl,
+		...input.manifest.endpoints.dashboardUrl ? [input.manifest.endpoints.dashboardUrl] : []
+	].map((value) => new URL(value).origin).some((origin) => !origins.includes(origin)) || protection.applications.some((entry) => entry.audience !== app.aud || !platformAccessPublicDestinations(app).includes(new URL(entry.origin).hostname))) throw new Error("platform: Access audiences and complete origin coverage must match the active platform protection. Restore the current Access checkpoint or repair its applications.");
+	for (const other of await access.list("apps")) {
+		if (other.id === app.id) continue;
+		if (platformAccessPublicDestinations(other).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)))) throw new Error("platform: Another Access application overlaps a protected platform origin. Reconcile it before maintenance.");
+	}
+	const liveToken = (await access.list("service_tokens")).find((entry) => entry.id === service.id);
+	const expiry = liveToken?.expires_at;
+	if (!liveToken || liveToken.enabled === false || typeof expiry === "string" && (!Number.isFinite(Date.parse(expiry)) || Date.parse(expiry) <= Date.now())) throw new Error("platform: The platform Access service token is unavailable or expired. Restore its admitted credentials before maintenance.");
+	for (const origin of origins) {
+		const headers = cfAccessHeaders(input.checkpoint.accessCredentialsJson ? { VOID_ACCESS_CREDENTIALS: input.checkpoint.accessCredentialsJson } : process.env, origin);
+		if (headers["CF-Access-Client-Id"] !== liveToken.client_id || !headers["CF-Access-Client-Secret"]) throw new Error("platform: Restore the origin-scoped Access service credentials admitted by the active protection application.");
+	}
+	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
+	if (existingWorkers.length) {
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Drl0qhrn.mjs");
+		await verifyProtectionWorkerOrigins({
+			request: input.client.request.bind(input.client),
+			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
+			listWorkerServiceRoutes: input.client.listWorkerServiceRoutes.bind(input.client)
+		}, input.manifest, origins, false, { workerNames: existingWorkers });
+	}
+}
+//#endregion
+//#region src/cli/platform-auth-bootstrap.ts
+/** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
+async function resumeInstalledPlatformAuthentication(input, initialize = initializeInstalledPlatformAuthentication) {
+	const result = await initialize(input.apiUrl, input.installationId, input.setupToken, input.setupJson);
+	if (!result.setupPending || !result.expiresAt || Date.parse(result.expiresAt) > Date.now()) return result;
+	const authBootstrapCode = randomBytes(32).toString("hex");
+	const authenticationSetupJson = JSON.stringify({
+		...parsePlatformAuthenticationSetup(JSON.parse(input.setupJson)),
+		resetPending: true,
+		bootstrapCredentialHash: createHash("sha256").update(authBootstrapCode).digest("hex")
+	});
+	input.checkpoint({
+		authenticationSetupJson,
+		authBootstrapCode
+	});
+	return initialize(input.apiUrl, input.installationId, input.setupToken, authenticationSetupJson);
+}
+async function initializeInstalledPlatformAuthentication(apiUrl, installationId, setupToken, setupJson, fetcher = fetch) {
+	const origin = normalizePlatformApiUrl(apiUrl);
+	const setup = parsePlatformAuthenticationSetup(JSON.parse(setupJson));
+	if (setup.protection) ensurePlatformAccessToken(origin, false, true);
+	const body = JSON.stringify(setup);
+	const signature = createHmac("sha256", setupToken).update(`${PLATFORM_AUTH_SETUP_PROOF_PREFIX}\n${installationId}\n${body}`).digest("base64url");
+	const response = await fetcher(`${origin}/internal/platform/auth-initialize`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"X-Void-Auth-Setup": signature,
+			...cfAccessHeaders(process.env, origin)
+		},
+		body,
+		redirect: "manual",
+		signal: AbortSignal.timeout(3e4)
+	});
+	if (!response.ok) throw new Error(`platform: Authentication setup failed (HTTP ${response.status}). Its outcome may be unknown; preserve the encrypted setup checkpoint and resume installation.`);
+	const result = await response.json();
+	if (typeof result.setupPending !== "boolean" || result.setupPending && (typeof result.expiresAt !== "string" || !Number.isFinite(Date.parse(result.expiresAt)))) throw new Error("platform: The platform returned an invalid authentication setup response.");
+	return {
+		setupPending: result.setupPending,
+		expiresAt: typeof result.expiresAt === "string" ? result.expiresAt : null
+	};
+}
+//#endregion
+//#region src/cli/platform-auth-database.ts
+/** Authentication requires fresh reads; mutate only the installation-owned configuration. */
+async function verifyPlatformAuthenticationDatabase(client, accountId, resource, databaseUrl) {
+	if (resource.kind !== "hyperdrive" || resource.key !== "hyperdrive" || resource.state !== "ready") throw new Error("platform: Authentication database verification requires the platform Hyperdrive resource.");
+	const expected = hyperdriveOriginFromConnectionString(databaseUrl);
+	const read = async () => {
+		const current = await client.getHyperdriveConfig(accountId, resource.id);
+		if (current.id !== resource.id || current.name !== resource.name || !hyperdriveOriginMatches(current.origin, expected)) throw new Error("platform: Hyperdrive does not match this installation’s pinned database. No authentication configuration was activated.");
+		return current;
+	};
+	if ((await read()).cachingDisabled === true) return;
+	if (resource.ownership !== "created") throw new Error("platform: The adopted Hyperdrive must have SQL result caching disabled by its owner before authentication can be configured.");
+	await client.disableHyperdriveCaching(accountId, resource.id);
+	if ((await read()).cachingDisabled !== true) throw new Error("platform: Could not verify uncached Hyperdrive reads. Authentication setup remains closed.");
+}
+//#endregion
 //#region src/cli/platform-plan.ts
 async function createPlatformInstallPlan(client, input, existing, options) {
 	const account = resolveAccount(await client.listAccounts(), input.accountId);
 	if (existing && existing.account.id !== account.id) throw new Error(`platform: Refusing to resume installation ${existing.id} in a different Cloudflare account.`);
+	const providedEmailSharedZoneId = input.emailSharedZoneId?.trim();
+	const providedEmailSenderDomain = input.emailSenderDomain?.trim();
+	if (existing?.deployment.emailSharedZoneId && providedEmailSharedZoneId && existing.deployment.emailSharedZoneId !== providedEmailSharedZoneId) throw new Error("platform: The shared email zone is already recorded for this installation.");
+	if (existing?.deployment.emailSenderDomain && providedEmailSenderDomain && existing.deployment.emailSenderDomain !== normalizeApplicationDomain(providedEmailSenderDomain)) throw new Error("platform: The shared email sender domain is already recorded for this installation.");
 	const installationSlug = normalizeInstallationSlug(input.installationSlug);
 	const installationId = existing?.id ?? `${installationSlug}-${createHash("sha256").update(JSON.stringify({
 		accountId: account.id,
@@ -802,7 +1592,24 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	} : void 0);
 	if (workersDev && workersDev.subdomain !== accountSubdomain) throw new Error("platform: The account workers.dev subdomain changed. Restore it before continuing.");
 	const testing = !!workersDev && !input.zoneName;
+	const emailSharedZoneId = (existing?.deployment.emailSharedZoneId ?? providedEmailSharedZoneId)?.trim();
+	const emailSenderDomain = existing?.deployment.emailSenderDomain ?? providedEmailSenderDomain;
+	if (!!emailSharedZoneId !== !!emailSenderDomain) throw new Error("platform: Set VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID together to enable email.");
+	const normalizedEmailSenderDomain = emailSenderDomain ? normalizeApplicationDomain(emailSenderDomain) : void 0;
+	const enableEmail = options?.includeEmailGateway !== false && !!emailSharedZoneId && !!normalizedEmailSenderDomain;
+	const capabilities = {
+		...existing?.deployment.capabilities,
+		...options?.enableSandbox ? { sandbox: true } : {},
+		...input.authentication ? {
+			githubOAuth: input.authentication.providers.includes("github"),
+			googleOAuth: input.authentication.providers.includes("google")
+		} : {},
+		...enableEmail ? { email: true } : {}
+	};
+	if (capabilities.email && options?.includeEmailGateway !== false && !enableEmail) throw new Error("platform: Email-enabled installations require VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID before deploying this runtime.");
 	const deployment = createPlatformDeploymentManifest({
+		authentication: input.authentication ?? existing?.deployment.authentication,
+		...Object.keys(capabilities).length > 0 ? { capabilities } : {},
 		application: {
 			baseDomain: testing ? `${accountSubdomain}.workers.dev` : input.applicationDomain,
 			dedicatedZone: input.dedicatedZone,
@@ -816,10 +1623,28 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			proxyHostname: null
 		},
 		displayName: input.displayName,
+		...emailSharedZoneId ? { emailSharedZoneId } : {},
+		...normalizedEmailSenderDomain ? { emailSenderDomain: normalizedEmailSenderDomain } : {},
 		installationSlug,
 		resources: existing?.deployment.resources ?? createPlatformResourceNames(installationSlug)
 	});
-	if (existing && JSON.stringify(existing.deployment) !== JSON.stringify(deployment)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
+	const { emailSharedZoneId: configuredEmailZone, emailSenderDomain: configuredSenderDomain, ...deploymentWithoutEmailZone } = deployment;
+	const { emailSharedZoneId: recordedEmailZone, emailSenderDomain: recordedSenderDomain, ...existingWithoutEmailZone } = existing?.deployment ?? deployment;
+	const existingWithSandbox = existing && options?.enableSandbox ? {
+		...existingWithoutEmailZone,
+		capabilities: {
+			...existingWithoutEmailZone.capabilities,
+			sandbox: true
+		}
+	} : existingWithoutEmailZone;
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithSandbox,
+		capabilities: {
+			...existingWithSandbox.capabilities,
+			email: true
+		}
+	} : existingWithSandbox;
+	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
 	const zone = testing ? null : await client.findZone(account.id, deployment.application.zoneName);
@@ -871,6 +1696,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		for (const [key, name] of [
 			["api-worker", names.apiWorker],
 			["proxy-worker", names.proxyWorker],
+			["email-gateway-worker", names.emailGatewayWorker],
 			["tail-worker", names.tailWorker],
 			["dispatch-worker", names.dispatchWorker]
 		]) if (workers.includes(name) && hasUnrecordedProvisionIntent(existing, key, "worker", name)) {
@@ -936,6 +1762,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	for (const [key, name] of [
 		["api-worker", names.apiWorker],
 		["proxy-worker", names.proxyWorker],
+		...options?.includeEmailGateway === false ? [] : [["email-gateway-worker", names.emailGatewayWorker]],
 		["tail-worker", names.tailWorker],
 		["dispatch-worker", names.dispatchWorker]
 	]) addNamedPlan(actions, existing, key, "worker", name, workers.includes(name) ? [{
@@ -972,7 +1799,11 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 		displayName: deployment.displayName,
 		installationSlug: deployment.installationSlug,
 		zoneName: deployment.application.zoneName
-	}, manifest, options)).actions.find((entry) => entry.key === action.key);
+	}, manifest, {
+		...options,
+		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker"),
+		enableSandbox: original.deployment.capabilities.sandbox
+	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
 		if (!matchesResourceMarker((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, action.key, "worker", {
@@ -1171,6 +2002,7 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"isr-cache-kv": "isrCacheKv",
 	"legacy-assets-kv": "legacyAssetsKv",
 	"proxy-worker": "proxyWorker",
+	"email-gateway-worker": "emailGatewayWorker",
 	"routing-kv": "routingKv",
 	"tail-worker": "tailWorker",
 	"usage-queue": "usageQueue"
@@ -1214,6 +2046,12 @@ function formatPlatformInstallPlan(plan) {
 		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev (testing); add a domain with void platform domain set <domain>`,
 		`${import_picocolors$1.default.bold("Control plane:")} ${plan.apiUrl}`,
 		`${import_picocolors$1.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
+		`${import_picocolors$1.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
+		`${import_picocolors$1.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
+		`${import_picocolors$1.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
+		...plan.deployment.authentication.providers.includes("cloudflare-access") ? ["Access login: create a dedicated OIDC application or connect an existing issuer."] : [],
+		...plan.deployment.authentication.accessProtection ? [`Access protection: verify an application covering ${plan.apiUrl} and ${plan.proxyUrl}, with a separate scoped service token for installation and CI.`] : [],
+		`${import_picocolors$1.default.bold("Database:")} Verify uncached Hyperdrive reads for authentication`,
 		""
 	];
 	for (const action of plan.actions) lines.push(`${action.action.padEnd(6)} ${action.kind.padEnd(19)} ${action.name}`);
@@ -1228,6 +2066,7 @@ const COMPLETE_WORKER_SECRET_UPDATE_NAMES = [
 	"R2_ACCESS_KEY_ID",
 	"R2_SECRET_ACCESS_KEY"
 ];
+const EMAIL_WORKER_SECRET_UPDATE_NAME = "EMAIL_SIGNING_SECRET";
 /**
 * Prevents a host without the encrypted values for an interrupted credential
 * update from carrying an opaque, possibly partial update into another cutover.
@@ -1236,7 +2075,7 @@ function assertPlatformWorkerSecretUpdateAuthority(input) {
 	const unresolved = unresolvedWorkerSecretUpdate(input.manifest);
 	if (!unresolved) return;
 	const latestWorkerGeneration = readLatestWorkerGeneration(input.manifest);
-	if (unresolved.generation === latestWorkerGeneration && input.localIntent?.id === unresolved.id && (input.localIntent.generation === null || input.localIntent.generation === unresolved.generation) || hasCompleteWorkerSecretReplacement(input.explicitUpdates)) return;
+	if (unresolved.generation === latestWorkerGeneration && input.localIntent?.id === unresolved.id && (input.localIntent.generation === null || input.localIntent.generation === unresolved.generation) || hasCompleteWorkerSecretReplacement(input.explicitUpdates, input.requiresEmailSigningSecret)) return;
 	throw new Error("platform: An unresolved Worker credential update is owned by another encrypted recovery checkpoint. Resume on the host that owns that checkpoint, restore its encrypted pending recovery material, or provide all supported Worker credential values together as a complete replacement.");
 }
 function unresolvedWorkerSecretUpdate(manifest) {
@@ -1264,8 +2103,8 @@ function readLatestWorkerGeneration(manifest) {
 		return match ? [Number(match[1])] : [];
 	}));
 }
-function hasCompleteWorkerSecretReplacement(updates) {
-	return COMPLETE_WORKER_SECRET_UPDATE_NAMES.every((name) => typeof updates[name] === "string" && updates[name] !== "");
+function hasCompleteWorkerSecretReplacement(updates, requiresEmailSigningSecret) {
+	return COMPLETE_WORKER_SECRET_UPDATE_NAMES.every((name) => typeof updates[name] === "string" && updates[name] !== "") && (!requiresEmailSigningSecret || typeof updates[EMAIL_WORKER_SECRET_UPDATE_NAME] === "string" && updates[EMAIL_WORKER_SECRET_UPDATE_NAME] !== "");
 }
 //#endregion
 //#region src/cli/platform-traffic.ts
@@ -1339,11 +2178,29 @@ function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt)
 const REMOTE_INSTALLATION_MANIFEST_KEY = PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY;
 const PLATFORM_WORKER_SECRET_UPDATE_NAMES = [
 	"CF_API_TOKEN",
+	"EMAIL_SIGNING_SECRET",
 	"GITHUB_CLIENT_ID",
 	"GITHUB_CLIENT_SECRET",
 	"R2_ACCESS_KEY_ID",
 	"R2_SECRET_ACCESS_KEY"
 ];
+/** Preserve database-authoritative authentication choices while upgrading old manifests. */
+function mergePlatformLiveAuthenticationDeployment(deployment, live) {
+	const providers = live.enabledProviders.length > 0 ? live.enabledProviders : deployment.authentication.providers;
+	return createPlatformDeploymentManifest({
+		...deployment,
+		authentication: {
+			providers,
+			...live.sessionsRequired ? { configurable: true } : {},
+			...live.protectedByAccess ? { accessProtection: true } : {}
+		},
+		capabilities: {
+			...deployment.capabilities,
+			githubOAuth: providers.includes("github"),
+			googleOAuth: providers.includes("google")
+		}
+	});
+}
 var PlatformWorkerRecoveryIncompleteError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -1364,9 +2221,28 @@ function createPlatformInstallationSecrets(input) {
 	const existingInstallation = input.existingInstallation === true;
 	const restoredIdentity = (explicit, name) => existingInstallation ? checkpoint[name] || explicit || "" : explicit || checkpoint[name] || "";
 	const configured = (explicit, name) => explicit || checkpoint[name] || "";
+	const authenticationSetupJson = configured(input.authenticationSetupJson ?? "", "authenticationSetupJson");
+	const authSetupToken = configured(input.authSetupToken ?? "", "authSetupToken");
+	const authBootstrapCode = configured(input.authBootstrapCode ?? "", "authBootstrapCode");
+	const modernAuthentication = input.configurableAuthentication === true || !!authenticationSetupJson;
+	if (modernAuthentication && !existingInstallation && (authSetupToken.length < 32 || !/^[a-f0-9]{64}$/.test(authBootstrapCode))) throw new Error("platform: Valid setup authority and an administrator setup code are required.");
+	if (authenticationSetupJson) {
+		const setup = parsePlatformAuthenticationSetup(JSON.parse(authenticationSetupJson));
+		if (!existingInstallation && (authSetupToken.length < 32 || !/^[a-f0-9]{64}$/.test(authBootstrapCode) || createHash("sha256").update(authBootstrapCode).digest("hex") !== setup.bootstrapCredentialHash)) throw new Error("platform: Valid installation setup authority and a matching administrator setup code are required.");
+	}
 	const jwtSecret = restoredIdentity(input.jwtSecret || "", "jwtSecret");
 	const resolvedJwtSecret = input.existingInstallation ? jwtSecret : required(jwtSecret, "VOID_PLATFORM_JWT_SECRET");
 	if (!existingInstallation && Buffer.byteLength(resolvedJwtSecret, "utf8") < 32) throw new Error("platform: VOID_PLATFORM_JWT_SECRET must contain at least 32 bytes of secret material unique to this installation.");
+	const emailEnabled = input.emailEnabled === true;
+	const existingEmailEnabled = input.existingEmailEnabled === true;
+	const emailSigningSecretInScope = emailEnabled || existingEmailEnabled;
+	let emailSigningSecret = emailSigningSecretInScope ? restoredIdentity(input.emailSigningSecret || "", "emailSigningSecret") : checkpoint.emailSigningSecret || "";
+	if (emailEnabled && !emailSigningSecret) {
+		if (existingInstallation && existingEmailEnabled) throw new Error("platform: VOID_PLATFORM_EMAIL_SIGNING_SECRET is required to maintain an email-enabled installation without its encrypted recovery state.");
+		emailSigningSecret = randomBytes(32).toString("base64");
+	}
+	if (emailSigningSecretInScope && emailSigningSecret && Buffer.byteLength(emailSigningSecret, "utf8") < 32) throw new Error("platform: VOID_PLATFORM_EMAIL_SIGNING_SECRET must contain at least 32 bytes of secret material unique to this installation.");
+	if (emailSigningSecretInScope && emailSigningSecret && emailSigningSecret === resolvedJwtSecret) throw new Error("platform: VOID_PLATFORM_EMAIL_SIGNING_SECRET must be different from VOID_PLATFORM_JWT_SECRET.");
 	const projectSecretKeyring = resolveProjectSecretKeyring({
 		checkpoint,
 		existingInstallation,
@@ -1376,22 +2252,34 @@ function createPlatformInstallationSecrets(input) {
 		required
 	});
 	const pendingWorkerSecretUpdateIntent = parseWorkerSecretUpdateIntent(checkpoint.workerSecretUpdatesJson);
+	const emailSigningSecretUpdateAuthorized = emailSigningSecretInScope && !!emailSigningSecret && (emailEnabled && (!existingEmailEnabled || !checkpoint.emailSigningSecret) || !!input.emailSigningSecret);
 	const explicitWorkerSecretUpdates = withoutEmptySecrets({
 		CF_API_TOKEN: input.cloudflareApiToken,
+		...emailSigningSecretUpdateAuthorized ? { EMAIL_SIGNING_SECRET: emailSigningSecret } : {},
 		GITHUB_CLIENT_ID: input.githubClientId,
 		GITHUB_CLIENT_SECRET: input.githubClientSecret,
 		R2_ACCESS_KEY_ID: input.r2AccessKeyId,
 		R2_SECRET_ACCESS_KEY: input.r2SecretAccessKey
 	});
 	return {
+		authenticationPreparation: Object.fromEntries(Object.entries(checkpoint).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
+		...modernAuthentication ? {
+			authenticationSetupJson,
+			authSetupToken,
+			authBootstrapCode
+		} : {},
+		...checkpoint.accessProvisioningJson ? { accessProvisioningJson: checkpoint.accessProvisioningJson } : {},
+		...checkpoint.accessCredentialsJson ? { accessCredentialsJson: checkpoint.accessCredentialsJson } : {},
 		workerSecretUpdates: input.updateExistingWorkers ? explicitWorkerSecretUpdates : {},
 		pendingWorkerSecretUpdateIntent: input.updateExistingWorkers ? pendingWorkerSecretUpdateIntent : void 0,
-		bootstrapGitHubId: existingInstallation ? configured(input.bootstrapGitHubId, "bootstrapGitHubId") : required(configured(input.bootstrapGitHubId, "bootstrapGitHubId"), "resolved administrator GitHub account id"),
-		bootstrapGitHubLogin: existingInstallation ? configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin") : required(configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin"), "VOID_PLATFORM_ADMIN_GITHUB_LOGIN"),
+		bootstrapGitHubId: existingInstallation || modernAuthentication ? configured(input.bootstrapGitHubId, "bootstrapGitHubId") : required(configured(input.bootstrapGitHubId, "bootstrapGitHubId"), "resolved administrator GitHub account id"),
+		bootstrapGitHubLogin: existingInstallation || modernAuthentication ? configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin") : required(configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin"), "VOID_PLATFORM_ADMIN_GITHUB_LOGIN"),
 		cloudflareApiToken: existingInstallation ? configured(input.cloudflareApiToken, "cloudflareApiToken") : required(configured(input.cloudflareApiToken, "cloudflareApiToken"), "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN"),
 		databaseUrl: required(input.databaseUrl || checkpoint.databaseUrl || "", "DATABASE_URL"),
-		githubClientId: existingInstallation ? configured(input.githubClientId, "githubClientId") : required(configured(input.githubClientId, "githubClientId"), "VOID_PLATFORM_GITHUB_CLIENT_ID"),
-		githubClientSecret: existingInstallation ? configured(input.githubClientSecret, "githubClientSecret") : required(configured(input.githubClientSecret, "githubClientSecret"), "VOID_PLATFORM_GITHUB_CLIENT_SECRET"),
+		emailEnabled,
+		emailSigningSecret,
+		githubClientId: existingInstallation || modernAuthentication ? configured(input.githubClientId, "githubClientId") : required(configured(input.githubClientId, "githubClientId"), "VOID_PLATFORM_GITHUB_CLIENT_ID"),
+		githubClientSecret: existingInstallation || modernAuthentication ? configured(input.githubClientSecret, "githubClientSecret") : required(configured(input.githubClientSecret, "githubClientSecret"), "VOID_PLATFORM_GITHUB_CLIENT_SECRET"),
 		jwtSecret: resolvedJwtSecret,
 		projectSecretActiveKeyVersion: projectSecretKeyring.activeVersion,
 		projectSecretKey: projectSecretKeyring.v1Key,
@@ -1450,6 +2338,14 @@ function assertCanonicalProjectSecretKey(value, name, uniqueToInstallation = fal
 }
 function secretCheckpoint(secrets, workerSecretUpdateIntent) {
 	return {
+		...Object.fromEntries(Object.entries(secrets.authenticationPreparation ?? {}).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
+		...secrets.authSetupToken ? {
+			authenticationSetupJson: secrets.authenticationSetupJson ?? "",
+			authSetupToken: secrets.authSetupToken ?? "",
+			authBootstrapCode: secrets.authBootstrapCode ?? ""
+		} : {},
+		...secrets.accessProvisioningJson ? { accessProvisioningJson: secrets.accessProvisioningJson } : {},
+		...secrets.accessCredentialsJson ? { accessCredentialsJson: secrets.accessCredentialsJson } : {},
 		bootstrapGitHubId: secrets.bootstrapGitHubId,
 		bootstrapGitHubLogin: secrets.bootstrapGitHubLogin,
 		cloudflareApiToken: secrets.cloudflareApiToken,
@@ -1457,6 +2353,7 @@ function secretCheckpoint(secrets, workerSecretUpdateIntent) {
 		githubClientId: secrets.githubClientId,
 		githubClientSecret: secrets.githubClientSecret,
 		jwtSecret: secrets.jwtSecret,
+		emailSigningSecret: secrets.emailSigningSecret,
 		projectSecretActiveKeyVersion: secrets.projectSecretActiveKeyVersion,
 		projectSecretKey: secrets.projectSecretKey,
 		projectSecretKeysJson: secrets.projectSecretKeysJson,
@@ -1499,6 +2396,22 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
+	const hasEmailGatewayArtifact = runtime.artifacts.emailGateway !== void 0;
+	if (runtime.emailProtocolVersion !== 1 && plan.deployment.capabilities.email) throw new Error("platform: This runtime cannot serve enabled platform email without email protocol version 1.");
+	if (runtime.emailProtocolVersion !== 1 && existing?.resources.some((resource) => resource.key === "email-gateway-worker" && resource.state === "ready")) throw new Error("platform: This runtime cannot replace an installed email gateway Worker. Use a runtime with email protocol version 1.");
+	const workerKeys = hasEmailGatewayArtifact ? [
+		"api",
+		"proxy",
+		"emailGateway",
+		"tail",
+		"dispatch"
+	] : [
+		"api",
+		"proxy",
+		"tail",
+		"dispatch"
+	];
+	if (plan.deployment.authentication.configurable && runtime.authenticationProtocolVersion !== 1) throw new Error("platform: This runtime does not support configurable authentication. Upgrade Void or use a compatible runtime.");
 	if (plan.deployment.application.workersDev && runtime.applicationRoutingVersion !== 1) throw new Error("platform: This runtime does not support workers.dev application routing. Use a current platform runtime.");
 	verifyRuntimeArtifacts(runtimeDirectory, runtime);
 	const runtimeProvenance = {
@@ -1512,11 +2425,14 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const hadPriorWorkers = existing !== null && (existing.resources.some((resource) => resource.kind === "worker" && resource.state === "ready") || plan.actions.some((action) => action.kind === "worker" && action.action !== "create"));
 	const wasDisabled = existing?.status === "disabled";
 	const preserveDisabled = existing?.desiredState === "disabled";
+	const shouldBootstrapSharedEmail = !preserveDisabled && plan.deployment.capabilities.email && runtime.emailProtocolVersion === 1 && !!plan.deployment.emailSharedZoneId;
 	const previousPublicEndpoints = stablePublicEndpointState(existing);
+	const authenticationProtocolTransition = hadPriorWorkers && existing?.deployment.authentication.configurable !== true && runtime.authenticationProtocolVersion === 1;
 	let workerCutoverGeneration = 0;
 	let workerRollbacks = [];
 	let workerDeploymentCommitted = false;
 	let workerTrafficGuarded = false;
+	let authenticationEnforcementActive = false;
 	let manifest = existing;
 	if (!manifest) {
 		const createdAt = now();
@@ -1548,7 +2464,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		manifest = setInstallationDesiredState(manifest, "disabled", now());
 		writeInstallationManifest(manifest);
 	}
-	assertRequiredPlatformSecrets(plan, manifest, secrets);
+	assertRequiredPlatformSecrets(plan, manifest, secrets, !!dependencies.prepareAuthentication);
 	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
 	writePendingInstallationSecrets(manifest, {
 		...pendingSecrets,
@@ -1581,22 +2497,83 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		assertPlatformWorkerSecretUpdateAuthority({
 			explicitUpdates: explicitWorkerSecretUpdates,
 			localIntent: secrets.pendingWorkerSecretUpdateIntent,
-			manifest
+			manifest,
+			requiresEmailSigningSecret: manifest.deployment.capabilities.email || plan.deployment.capabilities.email
 		});
 	} catch (error) {
 		await releaseDatabaseLock();
 		throw error;
 	}
 	if (workerSecretUpdateIntent && !hasExplicitWorkerSecretUpdates && platformWorkerSecretUpdateIntentState(manifest, workerSecretUpdateIntent) !== "active") workerSecretUpdateIntent = null;
-	const workerDeploymentSecrets = {
+	let workerDeploymentSecrets = {
 		...secrets,
 		workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
 	};
 	try {
 		assertPlatformRuntimeSafety(runtime, manifest.safetyProtocols, releaseDatabaseLock.requiredSafetyProtocols);
 		if (existing) await dependencies.verifyExistingOwnership?.(manifest, authoritative !== null && authoritative !== void 0);
+		const liveAuthentication = await releaseDatabaseLock.readAuthenticationState?.();
+		if (liveAuthentication) {
+			authenticationEnforcementActive = liveAuthentication.sessionsRequired;
+			if (liveAuthentication.sessionsRequired && runtime.authenticationProtocolVersion !== 1) throw new Error("platform: This runtime cannot enforce the active authentication configuration. Use an authentication-compatible runtime.");
+			const deployment = mergePlatformLiveAuthenticationDeployment(plan.deployment, liveAuthentication);
+			plan = {
+				...plan,
+				deployment
+			};
+			if (!authenticationProtocolTransition) manifest = {
+				...manifest,
+				deployment
+			};
+		}
+		if (!liveAuthentication && manifest.deployment.authentication.configurable && !plan.deployment.authentication.configurable) {
+			const authentication = manifest.deployment.authentication;
+			const providers = authentication.providers;
+			plan = {
+				...plan,
+				deployment: createPlatformDeploymentManifest({
+					...plan.deployment,
+					authentication,
+					capabilities: {
+						...plan.deployment.capabilities,
+						githubOAuth: providers.includes("github"),
+						googleOAuth: providers.includes("google")
+					}
+				})
+			};
+		}
+		if (authenticationProtocolTransition && !plan.deployment.authentication.configurable) {
+			const providers = plan.deployment.authentication.providers;
+			const deployment = createPlatformDeploymentManifest({
+				...plan.deployment,
+				authentication: {
+					providers,
+					configurable: true
+				},
+				capabilities: {
+					...plan.deployment.capabilities,
+					githubOAuth: providers.includes("github"),
+					googleOAuth: providers.includes("google")
+				}
+			});
+			plan = {
+				...plan,
+				deployment
+			};
+		}
+		const activateAccessCredentials = () => {
+			if (!secrets.accessCredentialsJson) return;
+			const credentials = JSON.parse(secrets.accessCredentialsJson);
+			if (!credentials || typeof credentials !== "object" || Array.isArray(credentials)) throw new Error("platform: Invalid saved Access credentials.");
+			const origins = [plan.apiUrl, plan.proxyUrl];
+			activatePlatformAccessCredentials(JSON.stringify(Object.fromEntries(Object.entries(credentials).filter(([origin]) => origins.includes(origin)))), origins);
+		};
+		activateAccessCredentials();
+		manifest = checkpointAuthenticationResources(manifest, secrets, now());
+		writeInstallationManifest(manifest);
+		await releaseDatabaseLock.checkpoint?.(manifest);
 		dependencies.onProgress?.("Checking and creating Cloudflare resources");
-		if (JSON.stringify(manifest.deployment) !== JSON.stringify(plan.deployment)) {
+		if (!authenticationProtocolTransition && JSON.stringify(manifest.deployment) !== JSON.stringify(plan.deployment)) {
 			manifest = {
 				...manifest,
 				deployment: plan.deployment,
@@ -1610,6 +2587,61 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = transitionInstallation(manifest, "provisioning", now());
 			writeInstallationManifest(manifest);
 		}
+		if (dependencies.prepareAuthentication) {
+			dependencies.onProgress?.("Preparing platform authentication");
+			try {
+				secrets = {
+					...secrets,
+					...await dependencies.prepareAuthentication(manifest, secrets)
+				};
+			} catch (error) {
+				const latest = readPendingInstallationSecrets(manifest) ?? {};
+				secrets = {
+					...secrets,
+					authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
+					authenticationSetupJson: latest.authenticationSetupJson || secrets.authenticationSetupJson,
+					authSetupToken: latest.authSetupToken || secrets.authSetupToken,
+					authBootstrapCode: latest.authBootstrapCode || secrets.authBootstrapCode,
+					accessProvisioningJson: latest.accessProvisioningJson || secrets.accessProvisioningJson,
+					accessCredentialsJson: latest.accessCredentialsJson || secrets.accessCredentialsJson
+				};
+				manifest = checkpointAuthenticationResources(manifest, secrets, now());
+				writeInstallationManifest(manifest);
+				await releaseDatabaseLock.checkpoint?.(manifest);
+				throw error;
+			}
+			const latest = readPendingInstallationSecrets(manifest) ?? {};
+			secrets = {
+				...secrets,
+				authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([name]) => isPlatformAuthenticationPreparationKey(name)))
+			};
+			manifest = checkpointAuthenticationResources(manifest, secrets, now());
+			writeInstallationManifest(manifest);
+			await releaseDatabaseLock.checkpoint?.(manifest);
+			activateAccessCredentials();
+			assertRequiredPlatformSecrets(plan, manifest, secrets);
+			if (secrets.authenticationSetupJson && createHash("sha256").update(secrets.authBootstrapCode ?? "").digest("hex") !== parsePlatformAuthenticationSetup(JSON.parse(secrets.authenticationSetupJson)).bootstrapCredentialHash) throw new Error("platform: Prepared authentication does not match its administrator setup code.");
+			workerDeploymentSecrets = {
+				...secrets,
+				workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
+			};
+			writePendingInstallationSecrets(manifest, {
+				...secretCheckpoint(secrets, workerSecretUpdateIntent),
+				databaseClaimState: "claimed"
+			});
+		}
+		if (plan.deployment.authentication.accessProtection) {
+			const protection = liveAuthentication ? liveAuthentication.protection : secrets.authenticationSetupJson ? parsePlatformAuthenticationSetup(JSON.parse(secrets.authenticationSetupJson)).protection : null;
+			if (!protection) throw new Error("platform: The active Access protection configuration is unavailable. Restore its database and encrypted setup checkpoint before maintenance.");
+			dependencies.onProgress?.("Verifying current Access policies and protected origins");
+			await (dependencies.verifyAccessProtection ?? verifyInstalledPlatformAccessProtection)({
+				client: dependencies.client,
+				manifest,
+				plan,
+				protection,
+				checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent)
+			});
+		}
 		const routingAction = plan.actions.find((action) => action.key === "routing-kv");
 		if (routingAction.action === "adopt") throw new Error("platform: The routing checkpoint cannot be adopted.");
 		if (routingAction.action === "reuse") {
@@ -1692,6 +2724,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 		}
+		dependencies.onProgress?.("Verifying uncached authentication database reads");
+		const authenticationDatabase = manifest.resources.find((resource) => resource.key === "hyperdrive");
+		if (!authenticationDatabase) throw new Error("platform: The authentication database resource is missing.");
+		await verifyPlatformAuthenticationDatabase(dependencies.client, plan.account.id, authenticationDatabase, secrets.databaseUrl);
 		dependencies.onProgress?.("Checking the platform database schema");
 		const rollbackDatabase = dependencies.databaseRollbackSource;
 		const migrationStep = `database-schema:${runtime.database.schemaDigest}`;
@@ -1744,7 +2780,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
 		const prepareSandboxDrain = dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
 		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
-		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
 		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
 		const writeSandboxDrainMirror = async (preparation) => {
 			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
@@ -1771,17 +2808,24 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = recordInstallationStep(manifest, {
 				completedAt: now(),
 				key: bootstrapStep,
-				resultHash: hash(secrets.bootstrapGitHubId)
+				resultHash: hash(secrets.authenticationSetupJson ?? secrets.bootstrapGitHubId)
 			}, now());
 			writeInstallationManifest(manifest);
 		}
 		const entrypoints = Object.fromEntries(Object.entries(runtime.artifacts).map(([key, artifact]) => [key, join(runtimeDirectory, artifact.path)]));
-		const interruptedCutover = interruptedWorkerCutover(manifest);
+		let interruptedCutover = interruptedWorkerCutover(manifest);
+		if (interruptedCutover && authenticationProtocolTransition && authenticationEnforcementActive) {
+			manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "committed", now());
+			manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, false, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			interruptedCutover = null;
+		}
 		const recoveringUnsafeTraffic = (interruptedCutover?.unsafeTraffic.size ?? 0) > 0;
-		const createsWorker = plan.actions.some((action) => action.kind === "worker" && action.action === "create");
+		const createsWorker = plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
 		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
-		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || requiresSandboxDrain;
+		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain;
 		if (requiresTrafficGuard) {
 			await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 			workerTrafficGuarded = true;
@@ -1797,6 +2841,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 		}
 		const configInput = {
+			authenticationDatabaseUncached: true,
 			accountId: plan.account.id,
 			apiUrl: plan.apiUrl,
 			deployment: plan.deployment,
@@ -1805,6 +2850,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			ownershipNonce: manifest.ownershipNonce,
 			platformVersion: version,
 			proxyUrl: plan.proxyUrl,
+			emailGatewayUrl: `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev`,
 			resources: {
 				hyperdrive: requireId(ids, "hyperdrive"),
 				isrCacheKv: requireId(ids, "isr-cache-kv"),
@@ -1831,7 +2877,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			trafficState: previousPublicEndpoints ? "enabled" : "staging"
 		});
 		const managedRoutes = platformManagedWorkerTraffic(plan.deployment).routes;
-		let workerActions = plan.actions.filter((action) => action.kind === "worker");
+		let workerActions = plan.actions.filter((action) => action.kind === "worker" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		if (interruptedCutover) {
 			for (const key of [...interruptedCutover.staged.keys()].reverse()) {
 				const snapshot = interruptedCutover.staged.get(key);
@@ -1866,7 +2912,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 						previousTriggers: mergePreservedTriggerRoutes(withoutPlatformCustomDomainTriggers(snapshot.previousTriggers), preservedRoutes),
 						previousVersionId: snapshot.previousVersionId,
 						preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
-						inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, `${key}-worker`, snapshot.workerName),
+						inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`, snapshot.workerName),
 						removeCustomDomains: async () => {
 							if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
 							await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([snapshot.workerName])));
@@ -1892,7 +2938,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 			if (retainedNewWorker) {
 				if (!dependencies.replanWorkers) throw new Error("platform: Recovering retained Workers requires a fresh Cloudflare installation plan.");
-				workerActions = validateReplannedWorkerActions(plan, manifest, await dependencies.replanWorkers(manifest));
+				workerActions = validateReplannedWorkerActions(plan, manifest, await dependencies.replanWorkers(manifest)).filter((action) => hasEmailGatewayArtifact || action.key !== "email-gateway-worker");
 			}
 		}
 		workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
@@ -1906,14 +2952,9 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			};
 			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
 		}
-		for (const key of [
-			"api",
-			"proxy",
-			"tail",
-			"dispatch"
-		]) {
+		for (const key of workerKeys) {
 			dependencies.onProgress?.(`Deploying the ${key} service`);
-			const action = workerActions.find((entry) => entry.key === `${key}-worker`);
+			const action = workerActions.find((entry) => entry.key === (key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`));
 			const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
 			manifest = recordProvisionIntent(manifest, action, now());
 			writeInstallationManifest(manifest);
@@ -1982,6 +3023,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			if (workerSecretUpdateIntent) manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "committed", workerSecretUpdateIntent.id, now());
 			manifest = {
 				...manifest,
+				deployment: plan.deployment,
 				platformVersion: version,
 				runtime: runtimeProvenance,
 				updatedAt: now(),
@@ -2000,17 +3042,63 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				zoneNameServers: zone?.nameServers ?? []
 			};
 		}
+		let authenticationCutoverCommitted = false;
+		if (authenticationProtocolTransition && requiresStagedCommit) {
+			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			workerRollbacks = [];
+			authenticationCutoverCommitted = true;
+		}
+		let authenticationStep = secrets.authenticationSetupJson ? "authentication-initialized:v1:" + hash(secrets.authenticationSetupJson) : "";
+		let setupPending = false;
 		manifest = transitionInstallation(manifest, "verifying", now());
 		writeInstallationManifest(manifest);
+		if (plan.deployment.authentication.configurable && authenticationStep) {
+			if (!secrets.authenticationSetupJson || !secrets.authSetupToken) throw new Error("platform: Restore the encrypted authentication setup checkpoint before resuming.");
+			dependencies.onProgress?.("Initializing platform authentication");
+			if ((await resumeInstalledPlatformAuthentication({
+				apiUrl: plan.apiUrl,
+				installationId: manifest.id,
+				setupToken: secrets.authSetupToken,
+				setupJson: secrets.authenticationSetupJson,
+				checkpoint: (replacement) => {
+					secrets = {
+						...secrets,
+						...replacement
+					};
+					authenticationStep = "authentication-initialized:v1:" + hash(replacement.authenticationSetupJson);
+					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+				}
+			}, dependencies.initializeAuthentication ?? initializeInstalledPlatformAuthentication)).setupPending) {
+				setupPending = true;
+				dependencies.onProgress?.(`Administrator setup pending: ${plan.apiUrl}/setup`);
+			}
+			manifest = recordInstallationStep(manifest, {
+				key: authenticationStep,
+				completedAt: now(),
+				resultHash: hash(secrets.authenticationSetupJson)
+			}, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
 		dependencies.onProgress?.("Verifying platform health");
+		const emailGatewayUrl = hasEmailGatewayArtifact ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
+		if (plan.deployment.authentication.accessProtection) {
+			ensurePlatformAccessToken(plan.apiUrl, false, true);
+			ensurePlatformAccessToken(plan.proxyUrl, false, true);
+		}
 		const healthCheckContext = {
 			accountName: plan.account.name,
 			workers: [
 				plan.deployment.resources.apiWorker,
 				plan.deployment.resources.proxyWorker,
+				...hasEmailGatewayArtifact ? [plan.deployment.resources.emailGatewayWorker] : [],
 				plan.deployment.resources.dispatchWorker
 			],
-			resumeCommand: dependencies.healthCheckResumeCommand
+			resumeCommand: dependencies.healthCheckResumeCommand,
+			...emailGatewayUrl ? { emailGatewayUrl } : {}
 		};
 		await (dependencies.verifyHealth ?? verifyPlatformHealth)(plan.apiUrl, manifest.id, plan.proxyUrl, plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(manifest.ownershipNonce), void 0, !plan.deployment.application.zoneName ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev` : void 0, healthCheckContext);
 		if (requiresSandboxDrain) {
@@ -2039,11 +3127,13 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			await writeSandboxDrainMirror(completedDrain);
 		}
 		if (requiresStagedCommit) {
-			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
-			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			workerRollbacks = [];
+			if (!authenticationCutoverCommitted) {
+				manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+				manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
+				writeInstallationManifest(manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				workerRollbacks = [];
+			}
 			workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
 			if (workerSecretUpdateIntent) {
 				manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "pending", workerSecretUpdateIntent.id, now());
@@ -2055,14 +3145,9 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				};
 				writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
 			}
-			for (const key of [
-				"api",
-				"proxy",
-				"tail",
-				"dispatch"
-			]) {
+			for (const key of workerKeys) {
 				dependencies.onProgress?.(`Enabling the ${key} service`);
-				const action = workerActions.find((entry) => entry.key === `${key}-worker`);
+				const action = workerActions.find((entry) => entry.key === (key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`));
 				const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
 				const preservedRoutes = dependencies.deployWorker ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
 				const workerConfig = mergePlatformWorkerTrafficConfig(enabledConfigs[key], preservedRoutes);
@@ -2116,9 +3201,20 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const verifyCurrentWorkerCutover = async () => {
 			if (!requiresStagedCommit) return;
 			if (dependencies.verifyWorkerCutover) await dependencies.verifyWorkerCutover(manifest, workerCutoverGeneration);
-			else if (!dependencies.deployWorker) await verifyPlatformWorkerCutoverVersions(manifest, workerCutoverGeneration, enabledConfigs, plan.account.id, runPinnedPlatformWrangler);
+			else if (!dependencies.deployWorker) await verifyPlatformWorkerCutoverVersions(manifest, workerCutoverGeneration, enabledConfigs, plan.account.id, runPinnedPlatformWrangler, workerKeys);
 		};
 		await verifyCurrentWorkerCutover();
+		let emailOperationId;
+		if (shouldBootstrapSharedEmail) {
+			workerDeploymentCommitted = true;
+			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
+			if (workerSecretUpdateIntent) manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "committed", workerSecretUpdateIntent.id, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			workerRollbacks = [];
+			dependencies.onProgress?.("Preparing shared email routing");
+			emailOperationId = await (dependencies.bootstrapEmail ?? bootstrapPlatformSharedEmail)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce));
+		}
 		if (dependencies.client.deleteKvValue) await dependencies.client.deleteKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY);
 		else if (wasDisabled || !previousPublicEndpoints) throw new Error("platform: Routing disablement removal is unavailable.");
 		if (requiresStagedCommit) {
@@ -2132,6 +3228,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		if (workerSecretUpdateIntent) manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "committed", workerSecretUpdateIntent.id, now());
 		manifest = {
 			...manifest,
+			deployment: plan.deployment,
 			platformVersion: version,
 			runtime: runtimeProvenance,
 			safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
@@ -2147,6 +3244,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		saveInstalledPlatformConnection(plan, manifest);
 		return {
 			manifest,
+			...emailOperationId ? { emailOperationId } : {},
+			setupPending,
 			waitingForDns: false,
 			waitingForSandboxDrain: false,
 			zoneNameServers: zone?.nameServers ?? []
@@ -2159,7 +3258,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		} catch (guardError) {
 			failure = new Error(`platform: ${errorMessage(error)} The installation also failed to retain its routing safety gate: ${errorMessage(guardError)}`, { cause: error });
 		}
-		if (!workerDeploymentCommitted && workerRollbacks.length > 0) {
+		if (!workerDeploymentCommitted && workerRollbacks.length > 0 && !(authenticationEnforcementActive && authenticationProtocolTransition)) {
 			const rollbackFailures = [];
 			for (const rollback of workerRollbacks.reverse()) try {
 				await rollback();
@@ -2173,7 +3272,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, previousPublicEndpoints, now());
 				writeInstallationManifest(manifest);
 			}
-		}
+		} else if (authenticationEnforcementActive && authenticationProtocolTransition) workerRollbacks = [];
 		if (manifest.status !== "failed" && manifest.status !== "uninstalled") try {
 			manifest = transitionInstallation(manifest, "failed", now());
 			writeInstallationManifest(manifest);
@@ -2184,6 +3283,9 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		await releaseDatabaseLock();
 	}
 }
+function checkpointAuthenticationResources(manifest, secrets, updatedAt) {
+	return checkpointPlatformAccessResources(manifest, secrets.accessProvisioningJson, updatedAt);
+}
 async function writeR2OwnershipMarkerIfNeeded(client, plan, manifest, action) {
 	if (action.kind !== "r2-bucket") return;
 	const bucket = manifest.resources.find((resource) => resource.key === action.key && resource.state === "ready");
@@ -2424,8 +3526,10 @@ function apiWorkerSecrets(secrets, accountId, zoneId) {
 		CF_ZONE_ID: zoneId,
 		GITHUB_CLIENT_ID: secrets.githubClientId,
 		GITHUB_CLIENT_SECRET: secrets.githubClientSecret,
+		...secrets.emailEnabled ? { EMAIL_SIGNING_SECRET: secrets.emailSigningSecret } : {},
 		JWT_SECRET: secrets.jwtSecret,
 		PLATFORM_BOOTSTRAP_GITHUB_ID: secrets.bootstrapGitHubId,
+		PLATFORM_AUTH_SETUP_TOKEN: secrets.authSetupToken ?? "",
 		...secrets.projectSecretKeysJson && secrets.projectSecretActiveKeyVersion ? {
 			PROJECT_SECRET_ACTIVE_KEY_VERSION: secrets.projectSecretActiveKeyVersion,
 			PROJECT_SECRET_KEYS_JSON: secrets.projectSecretKeysJson
@@ -2436,15 +3540,23 @@ function apiWorkerSecrets(secrets, accountId, zoneId) {
 }
 /** Existing Workers inherit live secrets, including complete encryption keyrings. */
 function platformWorkerSecretPayload(worker, secrets, accountId, zoneId, existingWorker) {
-	if (worker !== "api" && worker !== "proxy") return null;
-	if (!existingWorker) return worker === "api" ? apiWorkerSecrets(secrets, accountId, zoneId) : proxyWorkerSecrets(secrets, accountId);
+	if (worker !== "api" && worker !== "proxy" && worker !== "emailGateway") return null;
+	if (!existingWorker) {
+		if (worker === "api") return apiWorkerSecrets(secrets, accountId, zoneId);
+		if (worker === "emailGateway") {
+			const payload = withoutEmptySecrets({ EMAIL_SIGNING_SECRET: secrets.emailEnabled ? secrets.emailSigningSecret : "" });
+			return Object.keys(payload).length > 0 ? payload : null;
+		}
+		return proxyWorkerSecrets(secrets, accountId);
+	}
 	const allowed = worker === "api" ? [
 		"CF_API_TOKEN",
+		"EMAIL_SIGNING_SECRET",
 		"GITHUB_CLIENT_ID",
 		"GITHUB_CLIENT_SECRET",
 		"R2_ACCESS_KEY_ID",
 		"R2_SECRET_ACCESS_KEY"
-	] : ["CF_API_TOKEN"];
+	] : worker === "proxy" ? ["CF_API_TOKEN", "EMAIL_SIGNING_SECRET"] : ["EMAIL_SIGNING_SECRET"];
 	const updates = Object.fromEntries(Object.entries(secrets.workerSecretUpdates ?? {}).filter(([name, value]) => allowed.includes(name) && typeof value === "string" && value !== ""));
 	return Object.keys(updates).length > 0 ? updates : null;
 }
@@ -2469,26 +3581,34 @@ function proxyWorkerSecrets(secrets, accountId) {
 	return withoutEmptySecrets({
 		CF_ACCOUNT_ID: accountId,
 		CF_API_TOKEN: secrets.cloudflareApiToken,
+		...secrets.emailEnabled ? { EMAIL_SIGNING_SECRET: secrets.emailSigningSecret } : {},
 		JWT_SECRET: secrets.jwtSecret
 	});
 }
 function withoutEmptySecrets(secrets) {
 	return Object.fromEntries(Object.entries(secrets).filter(([, value]) => value !== ""));
 }
-function assertRequiredPlatformSecrets(plan, manifest, secrets) {
+function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWillBePrepared = false) {
 	const missing = /* @__PURE__ */ new Set();
 	const requireSecret = (value, name) => {
 		if (!value) missing.add(name);
 	};
-	if (!manifest.steps.some((step) => step.key === "bootstrap-access:v1")) {
+	if (plan.deployment.authentication.configurable && !manifest.steps.some((step) => step.key.startsWith("authentication-initialized:v1:"))) {
+		if (!authenticationWillBePrepared) requireSecret(secrets.authenticationSetupJson ?? "", "authentication setup configuration");
+		requireSecret(secrets.authSetupToken ?? "", "installation authentication setup authority");
+		requireSecret(secrets.authBootstrapCode ?? "", "administrator setup code");
+	} else if (!plan.deployment.authentication.configurable && !manifest.steps.some((step) => step.key === "bootstrap-access:v1")) {
 		requireSecret(secrets.bootstrapGitHubId, "VOID_PLATFORM_ADMIN_GITHUB_ID");
 		requireSecret(secrets.bootstrapGitHubLogin, "VOID_PLATFORM_ADMIN_GITHUB_LOGIN");
 	}
 	if (plan.actions.some((action) => action.key === "api-worker" && action.kind === "worker" && action.action === "create")) {
 		requireSecret(secrets.cloudflareApiToken, "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN");
-		requireSecret(secrets.githubClientId, "VOID_PLATFORM_GITHUB_CLIENT_ID");
-		requireSecret(secrets.githubClientSecret, "VOID_PLATFORM_GITHUB_CLIENT_SECRET");
+		if (!plan.deployment.authentication.configurable) {
+			requireSecret(secrets.githubClientId, "VOID_PLATFORM_GITHUB_CLIENT_ID");
+			requireSecret(secrets.githubClientSecret, "VOID_PLATFORM_GITHUB_CLIENT_SECRET");
+		}
 		requireSecret(secrets.jwtSecret, "VOID_PLATFORM_JWT_SECRET");
+		if (plan.deployment.capabilities.email) requireSecret(secrets.emailSigningSecret, "VOID_PLATFORM_EMAIL_SIGNING_SECRET");
 		requireSecret(secrets.projectSecretKeysJson, "VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON (or VOID_PLATFORM_PROJECT_SECRET_KEY for v1)");
 		requireSecret(secrets.projectSecretActiveKeyVersion, "VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION (or VOID_PLATFORM_PROJECT_SECRET_KEY for v1)");
 		requireSecret(secrets.r2AccessKeyId, "VOID_PLATFORM_R2_ACCESS_KEY_ID");
@@ -2497,6 +3617,10 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets) {
 	if (plan.actions.some((action) => action.key === "proxy-worker" && action.kind === "worker" && action.action === "create")) {
 		requireSecret(secrets.cloudflareApiToken, "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN");
 		requireSecret(secrets.jwtSecret, "VOID_PLATFORM_JWT_SECRET");
+		if (plan.deployment.capabilities.email) requireSecret(secrets.emailSigningSecret, "VOID_PLATFORM_EMAIL_SIGNING_SECRET");
+	}
+	if (plan.actions.some((action) => action.key === "email-gateway-worker" && action.kind === "worker" && action.action === "create")) {
+		if (plan.deployment.capabilities.email) requireSecret(secrets.emailSigningSecret, "VOID_PLATFORM_EMAIL_SIGNING_SECRET");
 	}
 	if (missing.size > 0) throw new Error(`platform: Creating a missing platform Worker requires: ${[...missing].sort().join(", ")}. Restore these values from your secret manager and retry.`);
 }
@@ -2681,6 +3805,17 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 		await client.query("SELECT pg_advisory_unlock(hashtextextended($1, 0))", [lockIdentity]);
 	};
 	release.authoritativeManifest = authoritativeManifest;
+	release.readAuthenticationState = async () => {
+		if (!(await client.query("SELECT to_regclass('public.platform_auth_settings') IS NOT NULL AS present")).rows[0]?.present) return null;
+		const [result, enabledProviders] = await Promise.all([client.query("SELECT sessions_required, protection FROM platform_auth_settings WHERE singleton = true"), client.query("SELECT DISTINCT kind FROM platform_login_connections WHERE enabled = true ORDER BY kind")]);
+		const settings = result.rows[0];
+		return settings ? {
+			enabledProviders: enabledProviders.rows.map((row) => row.kind),
+			sessionsRequired: settings.sessions_required,
+			protectedByAccess: settings.protection !== null,
+			protection: parsePlatformAccessProtection(settings.protection)
+		} : null;
+	};
 	release.requiredSafetyProtocols = await readRequiredPlatformSafetyProtocols(client);
 	release.checkpoint = async (manifest) => {
 		if (released) throw new Error("platform: Cannot checkpoint lifecycle state after releasing its lock.");
@@ -2711,14 +3846,14 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
      ) AS "present"`)).rows[0]?.present === true;
-	if (requiredAdmissionProtocol === 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
+	if (requiredAdmissionProtocol >= 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
 	const readCheckpoint = () => client.query(`SELECT ${hasAdmissionColumn ? "\"admission_protocol\"" : "0 AS \"admission_protocol\""}, "generation", "state", "phase", "cursor", "started_at", "updated_at", "completed_at"
        FROM "sandbox_drain_checkpoints"
        WHERE "singleton" = true`);
 	const classify = (row) => {
 		if (!row) return null;
 		const cursor = row.cursor;
-		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
+		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 && row.admission_protocol !== 3 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
 		return {
 			admissionProtocol: row.admission_protocol,
 			generation: row.generation,
@@ -2735,7 +3870,23 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
 	};
 	const existingState = classify((await readCheckpoint()).rows[0]);
 	if (existingState && (requiredAdmissionProtocol === 0 || existingState.admissionProtocol >= requiredAdmissionProtocol)) return existingState;
-	if (requiredAdmissionProtocol === 2) {
+	if (requiredAdmissionProtocol >= 2) {
+		if (existingState && existingState.admissionProtocol >= 2) {
+			await client.query("BEGIN");
+			try {
+				await client.query("LOCK TABLE \"deployments\" IN SHARE MODE");
+				await client.query(`UPDATE "sandbox_drain_checkpoints"
+           SET "admission_protocol" = GREATEST("admission_protocol", $1), "updated_at" = now()
+           WHERE "singleton" = true`, [requiredAdmissionProtocol]);
+				const advanced = classify((await readCheckpoint()).rows[0]);
+				if (!advanced || advanced.admissionProtocol < requiredAdmissionProtocol) throw new Error("platform: The Sandbox controller admission barrier could not be armed.");
+				await client.query("COMMIT");
+				return advanced;
+			} catch (error) {
+				await client.query("ROLLBACK").catch(() => void 0);
+				throw error;
+			}
+		}
 		const generation = randomUUID();
 		await client.query("BEGIN");
 		try {
@@ -2768,8 +3919,10 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
            WHERE "singleton" = true
              AND "admission_protocol" = 2
              AND "generation" = $1`, [generation]);
+			if (requiredAdmissionProtocol >= 3) await client.query(`UPDATE "sandbox_drain_checkpoints" SET "admission_protocol" = $1
+           WHERE "singleton" = true`, [requiredAdmissionProtocol]);
 			const armed = classify((await readCheckpoint()).rows[0]);
-			if (!armed || armed.admissionProtocol !== 2) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
+			if (!armed || armed.admissionProtocol < requiredAdmissionProtocol) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
 			await client.query("COMMIT");
 			return armed;
 		} catch (error) {
@@ -2812,12 +3965,17 @@ async function readRequiredPlatformSafetyProtocols(client) {
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
      ) AS "present"`)).rows[0]?.present === true) {
-		if ((await client.query(`SELECT EXISTS(
+		const admission = await client.query(`SELECT EXISTS(
          SELECT 1
          FROM "sandbox_drain_checkpoints"
          WHERE "singleton" = true
            AND "admission_protocol" >= 2
-       ) AS "required"`)).rows[0]?.required === true) return { sandboxDrain: 2 };
+       ) AS "required", (SELECT "admission_protocol" FROM "sandbox_drain_checkpoints"
+                         WHERE "singleton" = true) AS "protocol"`);
+		if (admission.rows[0]?.required === true) {
+			if (admission.rows[0].protocol != null && admission.rows[0].protocol > 3) throw new Error("platform: The database requires a newer Sandbox controller protocol.");
+			return { sandboxDrain: admission.rows[0].protocol === 3 ? 3 : 2 };
+		}
 	}
 	return { sandboxDrain: (await client.query(`SELECT EXISTS(
        SELECT 1
@@ -3582,7 +4740,7 @@ function interruptedWorkerCutover(manifest) {
 			generations.set(generation, entry);
 			continue;
 		}
-		const unsafeTraffic = /^worker-cutover:(\d+):unsafe-traffic:(api|proxy|tail|dispatch)$/.exec(step.key);
+		const unsafeTraffic = /^worker-cutover:(\d+):unsafe-traffic:(api|proxy|emailGateway|tail|dispatch)$/.exec(step.key);
 		if (unsafeTraffic) {
 			const generation = Number(unsafeTraffic[1]);
 			const entry = generations.get(generation) ?? {
@@ -3594,7 +4752,7 @@ function interruptedWorkerCutover(manifest) {
 			generations.set(generation, entry);
 			continue;
 		}
-		const staged = /^worker-cutover:(\d+):staged:(api|proxy|tail|dispatch)$/.exec(step.key);
+		const staged = /^worker-cutover:(\d+):staged:(api|proxy|emailGateway|tail|dispatch)$/.exec(step.key);
 		if (!staged) continue;
 		const generation = Number(staged[1]);
 		const snapshot = parseWorkerCutoverSnapshot(step.resultHash);
@@ -3614,17 +4772,18 @@ function interruptedWorkerCutover(manifest) {
 		unsafeTraffic: unresolved[1].unsafeTraffic
 	} : null;
 }
-async function verifyPlatformWorkerCutoverVersions(manifest, generation, configs, accountId, runner = runPlatformWrangler) {
+async function verifyPlatformWorkerCutoverVersions(manifest, generation, configs, accountId, runner = runPlatformWrangler, workerKeys = [
+	"api",
+	"proxy",
+	"emailGateway",
+	"tail",
+	"dispatch"
+]) {
 	const cutover = interruptedWorkerCutover(manifest);
-	if (cutover?.generation !== generation || cutover.staged.size !== 4) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
+	if (cutover?.generation !== generation || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
 	const directory = mkdtempSync(join(tmpdir(), "void-platform-cutover-verify-"));
 	try {
-		for (const key of [
-			"api",
-			"proxy",
-			"tail",
-			"dispatch"
-		]) {
+		for (const key of workerKeys) {
 			const snapshot = cutover.staged.get(key);
 			if (!snapshot) throw new Error(`platform: Worker cutover generation ${generation} is missing its ${key} checkpoint.`);
 			const config = configs[key];
@@ -3691,7 +4850,7 @@ var PlatformAccessBlockedError = class extends Error {
 			"Void’s own authentication stays enabled. Keep account-wide Default-Deny on.",
 			"",
 			"For platforms that must remain Access-protected:",
-			"https://void.cloud/guide/self-hosted-platform#cloudflare-access"
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
 		].join("\n"));
 	}
 };
@@ -3713,11 +4872,12 @@ async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicatio
 		signal: AbortSignal.timeout(3e4)
 	});
 	const dispatchUrl = dispatchOrigin ?? `https://test.${applicationBaseDomain}`;
-	const [health, discovery, proxy, dispatch] = await Promise.all([
+	const [health, discovery, proxy, dispatch, emailGateway] = await Promise.all([
 		request(`${apiUrl}/health`),
 		request(`${apiUrl}/.well-known/void-platform`),
 		request(`${proxyUrl}/health`),
-		request(`${dispatchUrl}/health`)
+		request(`${dispatchUrl}/health`),
+		context?.emailGatewayUrl ? request(`${context.emailGatewayUrl}/health`) : void 0
 	]);
 	if (!health.ok) throw await platformProbeFailure("Health check", apiUrl, health, context);
 	if (!discovery.ok) throw await platformProbeFailure("Discovery check", apiUrl, discovery, context);
@@ -3727,6 +4887,11 @@ async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicatio
 	if ((body.usageProtocolVersion ?? 0) !== usageProtocolVersion) throw new Error("platform: Deployed API usage protocol does not match this runtime. Traffic remains disabled.");
 	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", proxyUrl, proxy, context);
 	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", dispatchUrl, dispatch, context);
+	if (emailGateway) {
+		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", context.emailGatewayUrl, emailGateway, context);
+		const identity = await emailGateway.json();
+		if (identity?.installationId !== installationId || identity.platformVersion !== platformVersion || identity.emailProtocolVersion !== 1) throw new Error("platform: Deployed email gateway identity, version, or protocol does not match this installation.");
+	}
 }
 async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fetch) {
 	const response = await fetcher(`${apiUrl}/internal/platform/sandbox-drain`, {
@@ -3734,7 +4899,8 @@ async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fe
 			"X-Void-Platform-Probe": healthProbeToken,
 			...cfAccessHeaders(process.env, apiUrl)
 		},
-		signal: AbortSignal.timeout(3e4)
+		signal: AbortSignal.timeout(3e4),
+		redirect: "manual"
 	});
 	if (!response.ok) throw new Error(`platform: Sandbox drain probe failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
 	let value;
@@ -3750,10 +4916,268 @@ async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fe
 	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
 	return status.state === "complete";
 }
+async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
+		method: "POST",
+		headers: {
+			"X-Void-Platform-Probe": healthProbeToken,
+			...cfAccessHeaders(process.env, apiUrl)
+		},
+		signal: AbortSignal.timeout(3e4),
+		redirect: "manual"
+	});
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+	}
+	const status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+	if (!response.ok || status?.version !== 1 || status.state !== "ready" || typeof status.operationId !== "string" || status.operationId.length === 0) {
+		const detail = status && typeof status.operationId === "string" ? ` Operation ${status.operationId}: ${typeof status.operationStatus === "string" ? status.operationStatus : "incomplete"}.` : status && typeof status.operationStatus === "string" ? ` Operation status: ${status.operationStatus}.` : "";
+		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
+	}
+	return status.operationId;
+}
 function createPlatformHealthProbeToken(ownershipNonce) {
 	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
 }
 //#endregion
+//#region src/cli/platform-install-auth.ts
+function answer(value) {
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+async function selectInstallationAuthentication(file, recorded) {
+	if (file) {
+		const input = JSON.parse(await readFile(file, "utf8"));
+		if (!input || typeof input !== "object" || Array.isArray(input) || !("connections" in input) || !Array.isArray(input.connections) || !input.connections.length || input.connections.length > 32) throw new Error("platform: An authentication file must define between 1 and 32 connections.");
+		const entries = input.connections;
+		if (entries.some((entry) => !entry || typeof entry !== "object" || !entry.configuration || typeof entry.configuration !== "object" || Array.isArray(entry.configuration) || !PLATFORM_LOGIN_KINDS.includes(entry.configuration.kind) || entry.clientSecret !== void 0 || entry.configuration.clientSecret !== void 0)) throw new Error("platform: Each connection needs a supported configuration and a clientSecretEnv reference; plaintext secrets are not accepted in the file.");
+		const selected = input;
+		if (selected.cloudflareAccess !== void 0) selected.cloudflareAccess = parsePlatformAccessSetupSpec(selected.cloudflareAccess);
+		const authentication = {
+			providers: [...new Set(entries.map((entry) => entry.configuration.kind))],
+			configurable: true,
+			...selected.protection ? { accessProtection: true } : {}
+		};
+		if (recorded && JSON.stringify(authentication) !== JSON.stringify(recorded)) throw new Error("platform: Resume with the recorded login methods and protection settings.");
+		return {
+			authentication,
+			file: selected
+		};
+	}
+	if (recorded) return { authentication: recorded };
+	if (!process.stdin.isTTY) return { authentication: { providers: ["github"] } };
+	const providers = answer(await multiselect({
+		message: "Platform login methods:",
+		initialValues: ["github"],
+		required: true,
+		options: [
+			{
+				value: "github",
+				label: "GitHub"
+			},
+			{
+				value: "google",
+				label: "Google"
+			},
+			{
+				value: "oidc",
+				label: "Generic OIDC"
+			},
+			{
+				value: "cloudflare-access",
+				label: "Cloudflare Access login"
+			}
+		]
+	}));
+	const protection = answer(await confirm({
+		message: "Also protect the platform UI and APIs with Cloudflare Access?",
+		initialValue: false
+	}));
+	return { authentication: {
+		providers,
+		...protection || providers.length !== 1 || providers[0] !== "github" ? { configurable: true } : {},
+		...protection ? { accessProtection: true } : {}
+	} };
+}
+async function collectInstallationAuthentication(selection, plan, checkpoint, save, access) {
+	if (!selection.authentication.configurable) return;
+	activatePlatformAccessCredentials(checkpoint.accessCredentialsJson, [plan.apiUrl, plan.proxyUrl]);
+	if (checkpoint.authenticationSetupJson && !selection.file) {
+		parsePlatformAuthenticationSetup(JSON.parse(checkpoint.authenticationSetupJson));
+		return {
+			authenticationSetupJson: checkpoint.authenticationSetupJson,
+			authSetupToken: checkpoint.authSetupToken ?? "",
+			authBootstrapCode: checkpoint.authBootstrapCode ?? ""
+		};
+	}
+	const prompt = async (message, initialValue = "", masked = false) => {
+		if (!process.stdin.isTTY) throw new Error(`platform: ${message} Supply it through --auth-config and environment references.`);
+		return masked ? answer(await password({ message })) : answer(await text$1({
+			message,
+			initialValue
+		}));
+	};
+	const entries = selection.file?.connections ?? selection.authentication.providers.map((kind) => ({
+		configuration: {
+			kind,
+			id: kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind,
+			label: kind === "github" ? "GitHub" : kind === "google" ? "Google" : kind === "oidc" ? "Company SSO" : "Cloudflare Access"
+		},
+		clientSecretEnv: void 0
+	}));
+	const connections = [];
+	const accessEntry = entries.find((entry) => entry.configuration.kind === "cloudflare-access");
+	const prepared = access && (selection.authentication.accessProtection || accessEntry && (!selection.file || selection.file.cloudflareAccess)) ? await preparePlatformAccessSetup({
+		plan,
+		ownershipNonce: access.ownershipNonce,
+		protection: !!selection.authentication.accessProtection,
+		...accessEntry ? { login: {
+			id: String(accessEntry.configuration.id ?? "access"),
+			label: String(accessEntry.configuration.label ?? "Cloudflare Access"),
+			...Array.isArray(accessEntry.configuration.requiredGroups) ? { requiredGroups: accessEntry.configuration.requiredGroups } : {}
+		} } : {},
+		spec: selection.file?.cloudflareAccess,
+		client: access.client,
+		checkpoint,
+		save,
+		yes: access.yes
+	}) : void 0;
+	console.log(`Login callback URL: ${plan.apiUrl}/auth/callback`);
+	for (const entry of entries) {
+		const config = { ...entry.configuration };
+		const kind = config.kind;
+		if (!config.id) config.id = kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind;
+		if (prepared?.login && prepared.login.configuration.id === config.id) {
+			const connection = prepared.login;
+			save({ [`authenticationConnection:${connection.configuration.id}`]: JSON.stringify(connection) });
+			connections.push(connection);
+			continue;
+		}
+		const partialKey = `authenticationConnection:${String(config.id)}`;
+		const stored = checkpoint[partialKey] ? JSON.parse(checkpoint[partialKey]) : void 0;
+		Object.assign(config, {
+			...stored?.configuration,
+			...config
+		});
+		if (!config.label) config.label = kind;
+		if ((kind === "oidc" || kind === "cloudflare-access") && !config.issuer) config.issuer = await prompt(`${config.label}: issuer URL:`);
+		if (!config.clientId) config.clientId = await prompt(`${config.label}: client ID:`);
+		if (kind === "google" && config.allowedDomains === void 0 && !selection.file) config.allowedDomains = (await prompt("Allowed Google Workspace domains (comma-separated, or blank):")).split(",").map((value) => value.trim()).filter(Boolean);
+		const parsed = parsePlatformLoginConfiguration(config);
+		let secret;
+		if (entry.clientSecretEnv) {
+			if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(entry.clientSecretEnv)) throw new Error("platform: Invalid clientSecretEnv reference.");
+			secret = process.env[entry.clientSecretEnv];
+			if (!secret) throw new Error(`platform: ${entry.clientSecretEnv} must contain the login client secret.`);
+		} else if (stored?.clientSecret && stored.configuration?.clientId === parsed.clientId && stored.configuration?.issuer === parsed.issuer) secret = stored.clientSecret;
+		else secret = await prompt(`${config.label}: client secret:`, "", true);
+		const connection = {
+			configuration: parsed,
+			clientSecret: secret
+		};
+		save({ [partialKey]: JSON.stringify(connection) });
+		connections.push(connection);
+	}
+	const administratorConnectionId = selection.file?.administratorConnectionId ?? (connections.length === 1 ? connections[0].configuration.id : process.stdin.isTTY ? answer(await select({
+		message: "Login method for the first administrator:",
+		options: connections.map((entry) => ({
+			value: entry.configuration.id,
+			label: entry.configuration.label
+		}))
+	})) : connections[0].configuration.id);
+	let protection = prepared?.protection ?? selection.file?.protection ?? null;
+	if (selection.authentication.accessProtection && !protection) {
+		const teamDomain = await prompt("Access team origin (https://team.cloudflareaccess.com):");
+		const apiAudience = await prompt(`Access application audience for ${plan.apiUrl}:`);
+		const proxyAudience = await prompt(`Access application audience for ${plan.proxyUrl}:`, apiAudience);
+		protection = {
+			teamDomain,
+			applications: [{
+				origin: plan.apiUrl,
+				audience: apiAudience
+			}, {
+				origin: plan.proxyUrl,
+				audience: proxyAudience
+			}]
+		};
+	}
+	protection = parsePlatformAccessProtection(protection);
+	let admissionInput = selection.file?.admission ?? (protection ? {
+		mode: "company",
+		access: true,
+		connections: []
+	} : { mode: "restricted" });
+	if (!selection.file && !protection && process.stdin.isTTY) {
+		const eligible = connections.filter((entry) => entry.configuration.kind !== "github" && (entry.configuration.kind !== "google" || entry.configuration.allowedDomains.length > 0));
+		const mode = answer(await select({
+			message: "Who can create an account?",
+			initialValue: eligible.length ? "company" : "restricted",
+			options: [
+				{
+					value: "restricted",
+					label: "Invited or allowlisted users"
+				},
+				...eligible.length ? [{
+					value: "company",
+					label: "Users approved by company login methods — automatic accounts"
+				}] : [],
+				{
+					value: "public",
+					label: "Anyone who completes an enabled login"
+				}
+			]
+		}));
+		const ids = mode === "company" ? answer(await multiselect({
+			message: "Company login methods that qualify new users:",
+			required: true,
+			initialValues: eligible.map((entry) => entry.configuration.id),
+			options: eligible.map((entry) => ({
+				value: entry.configuration.id,
+				label: entry.configuration.label
+			}))
+		})) : [];
+		admissionInput = mode === "company" ? {
+			mode,
+			connections: ids,
+			access: false
+		} : { mode };
+	}
+	const admission = parsePlatformAdmissionPolicy(admissionInput);
+	let authBootstrapCode = checkpoint.authBootstrapCode || randomBytes(32).toString("hex");
+	const authSetupToken = checkpoint.authSetupToken || randomBytes(32).toString("hex");
+	let setup = parsePlatformAuthenticationSetup({
+		connections,
+		administratorConnectionId,
+		admission,
+		protection,
+		bootstrapCredentialHash: createHash("sha256").update(authBootstrapCode).digest("hex")
+	});
+	if (selection.file && checkpoint.authenticationSetupJson) {
+		const previous = parsePlatformAuthenticationSetup(JSON.parse(checkpoint.authenticationSetupJson));
+		if (JSON.stringify({
+			...previous,
+			resetPending: void 0
+		}) !== JSON.stringify(setup)) {
+			authBootstrapCode = randomBytes(32).toString("hex");
+			setup = parsePlatformAuthenticationSetup({
+				...setup,
+				resetPending: true,
+				bootstrapCredentialHash: createHash("sha256").update(authBootstrapCode).digest("hex")
+			});
+		}
+	}
+	const result = {
+		authenticationSetupJson: JSON.stringify(setup),
+		authBootstrapCode,
+		authSetupToken
+	};
+	save(result);
+	return result;
+}
+//#endregion
 //#region src/cli/platform-setup-draft.ts
 const STARTED = "credential-setup:v1";
 const COMPLETED = "credential-setup-complete:v1";
@@ -3808,9 +5232,9 @@ function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
 	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + page.title + "\x1B]8;;\x1B\\" : page.title + ": " + page.url;
 }
 function platformSetupFieldHelp(key) {
-	const docs = (section, title) => platformSetupLink({
+	const docs = (page, section, title) => platformSetupLink({
 		title,
-		url: "https://void.cloud/guide/self-hosted-platform#" + section
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
 	});
 	switch (key) {
 		case "databaseUrl": return {
@@ -3818,10 +5242,10 @@ function platformSetupFieldHelp(key) {
 			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
 				title: "Neon",
 				url: "https://neon.com/"
-			}) + ". " + docs("platform-database", "Database setup")
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
 		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("signing-and-encryption-keys", "Key setup") };
+		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
 		default: return;
 	}
 }
@@ -3885,7 +5309,29 @@ function platformSetupPages(plan) {
 		...plan.deployment.capabilities.customDomains ? [{
 			key: "ssl_and_certificates",
 			type: "edit"
-		}] : []
+		}] : [],
+		...plan.deployment.capabilities.email ? [
+			{
+				key: "zone",
+				type: "read"
+			},
+			{
+				key: "zone_settings",
+				type: "edit"
+			},
+			{
+				key: "email_routing_address",
+				type: "edit"
+			},
+			{
+				key: "email_routing_rule",
+				type: "edit"
+			},
+			{
+				key: "email_sending",
+				type: "edit"
+			}
+		] : []
 	];
 	return {
 		runtime: {
@@ -3901,6 +5347,7 @@ function platformSetupPages(plan) {
 				"Read: Account Settings, Account Analytics, Workers Tail.",
 				...plan.deployment.application.zoneName ? ["Zone " + plan.deployment.application.zoneName + ": Cache Purge: Purge."] : [],
 				...plan.deployment.capabilities.customDomains ? ["Custom project domains also need SSL and Certificates: Edit on that zone."] : [],
+				...plan.deployment.capabilities.email ? ["Email-enabled installations need Email Routing Addresses: Edit and Email Sending: Edit on the account, plus Zone: Read, Zone Settings: Edit and Email Routing Rules: Edit on the mail zones."] : [],
 				"If the form differs, match the permissions above. Create the token, then paste it here."
 			].join("\n")
 		},
@@ -3933,8 +5380,9 @@ function formatPlatformSetupPlan(plan) {
 		platformSetupLink(pages.r2),
 		pages.r2.instructions,
 		"",
-		platformSetupLink(pages.github),
-		pages.github.instructions
+		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github), pages.github.instructions] : [],
+		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => `${provider === "google" ? "Google OAuth client" : provider === "oidc" ? "OIDC connection" : "Cloudflare Access OIDC application"}: client ID and secret; callback ${plan.apiUrl}/auth/callback.`),
+		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access protection: configure API and proxy origins and admitted installer/CI credentials."] : []
 	].join("\n");
 }
 function openPlatformSetupPage(page, dependencies = {}) {
@@ -3992,14 +5440,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-ChvbJkdy.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-4GiDlcqx.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-C_YO-tIs.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-CbK-I1FB.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -4009,7 +5457,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-Db2PXw0B.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-BfWsXHEW.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -4159,7 +5607,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Db2PXw0B.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-BfWsXHEW.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -4167,19 +5615,25 @@ async function runPlatformLifecycleCommand(args) {
 				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
 			}
 		}
+		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication);
 		const planInput = {
+			authentication: authenticationSelection.authentication,
 			accountId,
 			applicationDomain,
 			controlPlaneDomain,
 			dedicatedZone,
 			displayName,
+			...process.env.VOID_EMAIL_SHARED_ZONE_ID ? { emailSharedZoneId: process.env.VOID_EMAIL_SHARED_ZONE_ID } : {},
+			...process.env.VOID_EMAIL_SENDER_DOMAIN ? { emailSenderDomain: process.env.VOID_EMAIL_SENDER_DOMAIN } : {},
 			installationSlug,
 			zoneName,
 			...workersDev ? { workersDev: true } : {}
 		};
 		let plan = await createPlatformInstallPlan(client, planInput, existing, {
 			authoritativeProvisionIntents,
-			allowUnverifiedAiGateway: true
+			allowUnverifiedAiGateway: true,
+			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 		});
 		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
 		note(formatPlatformRuntime(runtime), "Platform runtime");
@@ -4258,22 +5712,44 @@ async function runPlatformLifecycleCommand(args) {
 			await verifyRuntimeToken(runtimeCloudflareApiToken);
 		}
 		saveValues({ cloudflareApiToken: runtimeCloudflareApiToken });
-		const previousLogin = values.bootstrapGitHubLogin;
-		const bootstrapGitHubLogin = await collect("bootstrapGitHubLogin", "VOID_PLATFORM_ADMIN_GITHUB_LOGIN", "Initial administrator GitHub username:", false);
-		const bootstrapGitHubId = (previousLogin === bootstrapGitHubLogin ? values.bootstrapGitHubId : "") || process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || await resolveBootstrapGitHubId(bootstrapGitHubLogin);
-		saveValues({ bootstrapGitHubId });
+		const deferAuthentication = !!authenticationSelection.authentication.accessProtection || authenticationSelection.authentication.providers.includes("cloudflare-access");
+		const saveAuthenticationValues = (updates) => {
+			Object.assign(values, updates);
+			const latest = readPendingInstallationSecrets(setupManifest) ?? {};
+			writePendingInstallationSecrets(setupManifest, {
+				...latest,
+				...updates
+			});
+		};
+		const authenticationSecrets = deferAuthentication ? {
+			authSetupToken: values.authSetupToken || randomBytes(32).toString("hex"),
+			authBootstrapCode: values.authBootstrapCode || randomBytes(32).toString("hex")
+		} : await collectInstallationAuthentication(authenticationSelection, plan, values, saveAuthenticationValues);
+		if (authenticationSecrets) saveAuthenticationValues(authenticationSecrets);
+		let bootstrapGitHubLogin = "";
+		let bootstrapGitHubId = "";
+		let githubClientId = "";
+		let githubClientSecret = "";
+		if (!authenticationSecrets) {
+			const previousLogin = values.bootstrapGitHubLogin;
+			bootstrapGitHubLogin = await collect("bootstrapGitHubLogin", "VOID_PLATFORM_ADMIN_GITHUB_LOGIN", "Initial administrator GitHub username:", false);
+			bootstrapGitHubId = (previousLogin === bootstrapGitHubLogin ? values.bootstrapGitHubId : "") || process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || await resolveBootstrapGitHubId(bootstrapGitHubLogin);
+			saveValues({ bootstrapGitHubId });
+		}
 		const installationDatabaseUrl = databaseUrl || await collect("databaseUrl", "VOID_PLATFORM_DATABASE_URL", "PostgreSQL DATABASE_URL:");
 		saveValues({ databaseUrl: installationDatabaseUrl });
-		if (!configured("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID") || !configured("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET")) openPlatformSetupPage(configured("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID") ? {
-			...pages.github,
-			url: "https://github.com/settings/developers"
-		} : pages.github);
-		const githubClientId = await collect("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID", "GitHub OAuth client ID:", false, false);
-		const githubClientSecret = await collect("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET", "GitHub OAuth client secret:", true, false);
-		saveValues({
-			githubClientId,
-			githubClientSecret
-		});
+		if (!authenticationSecrets) {
+			if (!configured("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID") || !configured("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET")) openPlatformSetupPage(configured("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID") ? {
+				...pages.github,
+				url: "https://github.com/settings/developers"
+			} : pages.github);
+			githubClientId = await collect("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID", "GitHub OAuth client ID:", false, false);
+			githubClientSecret = await collect("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET", "GitHub OAuth client secret:", true, false);
+			saveValues({
+				githubClientId,
+				githubClientSecret
+			});
+		}
 		if (!configured("r2AccessKeyId", "VOID_PLATFORM_R2_ACCESS_KEY_ID") || !configured("r2SecretAccessKey", "VOID_PLATFORM_R2_SECRET_ACCESS_KEY")) openPlatformSetupPage(pages.r2);
 		const r2AccessKeyId = await collect("r2AccessKeyId", "VOID_PLATFORM_R2_ACCESS_KEY_ID", "Access Key ID:", false, false);
 		const r2SecretAccessKey = await collect("r2SecretAccessKey", "VOID_PLATFORM_R2_SECRET_ACCESS_KEY", "Secret Access Key:", true, false);
@@ -4283,11 +5759,16 @@ async function runPlatformLifecycleCommand(args) {
 		});
 		const hasFullProjectSecretKeyring = Boolean(checkpoint?.projectSecretKeysJson || checkpoint?.projectSecretActiveKeyVersion || process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION);
 		const secrets = createPlatformInstallationSecrets({
+			configurableAuthentication: !!authenticationSelection.authentication.configurable,
+			...authenticationSecrets,
 			bootstrapGitHubId,
 			bootstrapGitHubLogin,
 			cloudflareApiToken: runtimeCloudflareApiToken,
 			checkpoint: values,
 			databaseUrl: installationDatabaseUrl,
+			emailEnabled: plan.deployment.capabilities.email,
+			emailSigningSecret: process.env.VOID_PLATFORM_EMAIL_SIGNING_SECRET || "",
+			existingEmailEnabled: existing.deployment.capabilities.email,
 			githubClientId,
 			githubClientSecret,
 			r2AccessKeyId,
@@ -4303,7 +5784,10 @@ async function runPlatformLifecycleCommand(args) {
 		});
 		progress = startProgress("Installing the platform");
 		if (credentialSetup) {
-			saveValues({ projectSecretKey: secrets.projectSecretKey });
+			saveValues({
+				projectSecretKey: secrets.projectSecretKey,
+				...secrets.emailEnabled ? { emailSigningSecret: secrets.emailSigningSecret } : {}
+			});
 			existing = completePlatformSetupDraft(existing);
 		}
 		const result = await installPlatform(plan, secrets, existing, {
@@ -4312,13 +5796,30 @@ async function runPlatformLifecycleCommand(args) {
 			runtime,
 			healthCheckResumeCommand: `${cliCommandName()} platform install --resume --name ${existing.id}`,
 			onProgress: (message) => progress?.message(message),
+			...deferAuthentication ? { prepareAuthentication: async (manifest) => {
+				progress?.stop("Preparing Cloudflare Access configuration.");
+				progress = void 0;
+				const result = await collectInstallationAuthentication(authenticationSelection, plan, values, saveAuthenticationValues, {
+					client,
+					ownershipNonce: manifest.ownershipNonce,
+					yes: args.yes
+				});
+				progress = startProgress("Continuing platform installation");
+				return {
+					...result,
+					accessProvisioningJson: values.accessProvisioningJson,
+					accessCredentialsJson: values.accessCredentialsJson
+				};
+			} } : {},
 			replanWorkers: async (manifest) => (await createPlatformInstallPlan(client, planInput, manifest, {
 				authoritativeProvisionIntents: true,
-				repairMissing: true
+				repairMissing: true,
+				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Db2PXw0B.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-BfWsXHEW.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -4344,6 +5845,13 @@ async function runPlatformLifecycleCommand(args) {
 		}
 		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 		log.info(`API URL: ${plan.apiUrl}`);
+		if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
+		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
+		if (result.setupPending && completedAuthCode) {
+			log.info(`First administrator setup: ${plan.apiUrl}/setup`);
+			console.log(`One-time administrator setup code: ${completedAuthCode}`);
+			log.info("Confirm your identity in the browser, then test and enable any additional login methods in Settings.");
+		}
 		if (!plan.deployment.application.zoneName) log.info("Apps will use workers.dev addresses. When your domain is ready: void platform domain set <domain>");
 		outro("Run `void auth login`, then deploy an app with `void deploy --platform void`.");
 	} catch (error) {
@@ -4374,7 +5882,11 @@ function formatPlatformRuntime(runtime) {
 async function verifyPlatformAiGatewayPlan(client, input, existing, preview, authoritativeProvisionIntents) {
 	let verified;
 	try {
-		verified = await createPlatformInstallPlan(client, input, existing, { authoritativeProvisionIntents });
+		verified = await createPlatformInstallPlan(client, input, existing, {
+			authoritativeProvisionIntents,
+			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker"),
+			enableSandbox: preview.deployment.capabilities.sandbox
+		});
 	} catch (error) {
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
 		throw error;
@@ -4422,7 +5934,7 @@ async function promptText(message, value, optional = false, validate) {
 		if (optional) return "";
 		throw new Error(`platform: ${message.replace(/:$/, "")} is required in non-interactive mode.`);
 	}
-	const input = await text({
+	const input = await text$1({
 		message,
 		...typeof value === "string" ? { initialValue: value } : value,
 		validate: (input) => input ? validate?.(input) : optional ? void 0 : "A value is required."
@@ -4439,7 +5951,7 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	const value = masked ? placeholder ? await passwordWithPlaceholder({
 		...options,
 		placeholder
-	}) : await password(options) : await text({
+	}) : await password(options) : await text$1({
 		...options,
 		placeholder
 	});
@@ -4447,4 +5959,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { resolvePlatformCloudflareCredential as S, hyperdriveOriginConfigHash as _, installPlatform as a, assertNoninteractivePlatformMutationAcknowledged, verifyPlatformRuntimeTokenPermissions as b, resolveBootstrapGitHubId as c, createPlatformInstallPlan as d, formatPlatformInstallPlan as f, PlatformCloudflareClient as g, revalidatePlatformInstallAction as h, createPlatformInstallationSecrets as i, recordPlatformWorkerTraffic as l, platformProvisionIntentHash as m, acquirePlatformDatabaseLifecycleLock as n, loadPlatformRuntime as o, platformAdoptionIntentHash as p, createPlatformHealthProbeToken as r, resolvePlatformInstallDatabaseUrl, runPlatformLifecycleCommand, recordResource as s, REMOTE_INSTALLATION_MANIFEST_KEY as t, trackedPlatformWorkerTraffic as u, hyperdriveOriginFromConnectionString as v, assertPlatformOperatorCredentialCanApplyPlan as x, hyperdriveOriginMatches as y };
+export { PlatformCloudflareClient as C, verifyPlatformRuntimeTokenPermissions as D, hyperdriveOriginMatches as E, preparePlatformAccessSetup as S, hyperdriveOriginFromConnectionString as T, revalidatePlatformInstallAction as _, createPlatformInstallationSecrets as a, assertNoninteractivePlatformMutationAcknowledged, checkpointPlatformAccessResources as b, platformDatabaseClientUrl as c, recordPlatformWorkerTraffic as d, trackedPlatformWorkerTraffic as f, platformProvisionIntentHash as g, platformAdoptionIntentHash as h, createPlatformHealthProbeToken as i, recordResource as l, formatPlatformInstallPlan as m, acquirePlatformDatabaseLifecycleLock as n, installPlatform as o, createPlatformInstallPlan as p, acquirePlatformDatabaseLifecycleLockConnection as r, resolvePlatformInstallDatabaseUrl, runPlatformLifecycleCommand, loadPlatformRuntime as s, REMOTE_INSTALLATION_MANIFEST_KEY as t, resolveBootstrapGitHubId as u, assertPlatformOperatorCredentialCanApplyPlan as v, hyperdriveOriginConfigHash as w, parsePlatformAccessSetupSpec as x, resolvePlatformCloudflareCredential as y };