void 0.20.2 → 0.21.0

package/dist/{platform-lifecycle-BwAIgz-t.mjs → platform-lifecycle-BquAaU-5.mjs}

@@ -1,11 +1,14 @@
-import { r as __toESM } from "./rolldown-runtime-rQ84J-ij.mjs";
-import { o as join } from "./dist-BrsS7cai.mjs";
-import { $ as promoteInstallationSecrets, A as outro, D as log, E as intro, F as CANCEL_SYMBOL, G as assertPlatformInstallationSlugAvailable, I as isCancel, J as listInstallationManifests, L as settings, M as select, N as symbol, O as multiselect, P as text$1, Q as platformWorkerSecretUpdateIntentState, R as u$1, V as ensurePlatformAccessToken, W as acquirePlatformLifecycleLock, X as normalizePlatformApiUrl, at as savePlatformConnection, c as import_picocolors$1, ct as writePendingInstallationSecrets, et as readInstallationRecoverySecrets, ft as require_picocolors, h as S_BAR_END, i as createSpinner, it as resolveInstallationManifest, j as password, k as note, m as S_BAR, n as cliCommandName, q as latestPlatformWorkerCutoverGeneration, r as cliTitle, st as writeInstallationManifest, tt as readPendingInstallationSecrets, v as S_PASSWORD_MASK, w as confirm } from "./output-B0cfNSx5.mjs";
+import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
+import { a as join } from "./dist-4WkAWhWx.mjs";
+import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-urU86XeT.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { f as openBrowser } from "./auth-DPl6kck4.mjs";
-import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
-import { l as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-6M5llVPC.mjs";
-import { n as createDefaultRunWrangler, o as resolvePinnedApiBaseUrl } from "./provision-CSJOjjQk.mjs";
+import { d as openBrowser } from "./auth-B9_D6ygs.mjs";
+import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-BJbgZLS1.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-rAZxzMkL.mjs";
+import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-Dn6nn2IU.mjs";
+import { o as resolveWranglerArgv } from "./preset-Dowh9tTt.mjs";
+import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-BCmTc1X_.mjs";
+import { g as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-Cck2m3jJ.mjs";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
@@ -16,7 +19,7 @@ import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readClou
 import { readFile } from "node:fs/promises";
 import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
-import { platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
+import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
 //#region src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
 	status;
@@ -1408,7 +1411,7 @@ async function resolvePlatformCloudflareCredentialWithInput(readInput, dependenc
 			credential: result.credential
 		};
 		announceCloudflareLogin();
-		const login = await runWrangler(["login", "--use-keyring"], true);
+		const login = await runWrangler(["login"], false);
 		assertNotCancelled();
 		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
 		const credential = await readWranglerOAuthCredential(runWrangler);
@@ -1430,11 +1433,6 @@ async function readExistingCredential(dependencies, runWrangler) {
 		token: environmentToken
 	};
 	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
-	if ((await runWrangler([
-		"auth",
-		"keyring",
-		"enable"
-	], true)).status !== 0) throw new Error("platform: Could not enable secure Cloudflare credential storage. Refusing to use a plaintext OAuth credential.");
 	return await readWranglerOAuthCredential(runWrangler);
 }
 async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
@@ -1501,7 +1499,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Bhtvp0B_.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Jb0yftay.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1554,13 +1552,36 @@ async function initializeInstalledPlatformAuthentication(apiUrl, installationId,
 }
 //#endregion
 //#region src/cli/platform-auth-database.ts
+/** Read the database name from an owner URL without applying Hyperdrive origin restrictions. */
+function platformDatabaseNameFromOwnerUrl(databaseUrl) {
+	let url;
+	try {
+		url = new URL(databaseUrl);
+	} catch {
+		throw new Error("platform: DATABASE_URL must be a PostgreSQL connection string.");
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:" || !url.hostname) throw new Error("platform: DATABASE_URL must use postgres:// or postgresql://.");
+	const database = decodeURIComponent(url.pathname.replace(/^\//, ""));
+	if (!database) throw new Error("platform: DATABASE_URL must include a database.");
+	return database;
+}
+/** Pin an externally managed Hyperdrive without treating the owner URL as its runtime origin. */
+function verifyExternalPlatformHyperdrive(input) {
+	const { config, expected } = input;
+	const database = platformDatabaseNameFromOwnerUrl(input.databaseUrl);
+	const hash = hyperdriveOriginConfigHash(config.origin);
+	if (config.id !== expected.id || config.name !== expected.name || config.origin.host !== expected.host.toLowerCase() || config.origin.user !== expected.user || config.origin.database !== database || input.recordedHash && input.recordedHash !== hash) throw new Error("platform: The Terraform-managed Hyperdrive does not match the expected database origin.");
+	if (config.cachingDisabled !== true) throw new Error("platform: Disable SQL result caching on the Terraform-managed Hyperdrive before installing.");
+	return hash;
+}
 /** Authentication requires fresh reads; mutate only the installation-owned configuration. */
 async function verifyPlatformAuthenticationDatabase(client, accountId, resource, databaseUrl) {
 	if (resource.kind !== "hyperdrive" || resource.key !== "hyperdrive" || resource.state !== "ready") throw new Error("platform: Authentication database verification requires the platform Hyperdrive resource.");
-	const expected = hyperdriveOriginFromConnectionString(databaseUrl);
+	const expectedDatabase = resource.ownership === "adopted" ? platformDatabaseNameFromOwnerUrl(databaseUrl) : void 0;
+	const expectedOrigin = resource.ownership !== "adopted" ? hyperdriveOriginFromConnectionString(databaseUrl) : void 0;
 	const read = async () => {
 		const current = await client.getHyperdriveConfig(accountId, resource.id);
-		if (current.id !== resource.id || current.name !== resource.name || !hyperdriveOriginMatches(current.origin, expected)) throw new Error("platform: Hyperdrive does not match this installation’s pinned database. No authentication configuration was activated.");
+		if (current.id !== resource.id || current.name !== resource.name || (resource.ownership === "adopted" ? current.origin.database !== expectedDatabase || hyperdriveOriginConfigHash(current.origin) !== resource.configHash : expectedOrigin === void 0 || !hyperdriveOriginMatches(current.origin, expectedOrigin))) throw new Error("platform: Hyperdrive does not match this installation’s pinned database. No authentication configuration was activated.");
 		return current;
 	};
 	if ((await read()).cachingDisabled === true) return;
@@ -1599,6 +1620,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	const enableEmail = options?.includeEmailGateway !== false && !!emailSharedZoneId && !!normalizedEmailSenderDomain;
 	const capabilities = {
 		...existing?.deployment.capabilities,
+		...options?.enableSandbox ? { sandbox: true } : {},
 		...input.authentication ? {
 			githubOAuth: input.authentication.providers.includes("github"),
 			googleOAuth: input.authentication.providers.includes("google")
@@ -1629,13 +1651,20 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	});
 	const { emailSharedZoneId: configuredEmailZone, emailSenderDomain: configuredSenderDomain, ...deploymentWithoutEmailZone } = deployment;
 	const { emailSharedZoneId: recordedEmailZone, emailSenderDomain: recordedSenderDomain, ...existingWithoutEmailZone } = existing?.deployment ?? deployment;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithSandbox = existing && options?.enableSandbox ? {
 		...existingWithoutEmailZone,
 		capabilities: {
 			...existingWithoutEmailZone.capabilities,
-			email: true
+			sandbox: true
 		}
 	} : existingWithoutEmailZone;
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithSandbox,
+		capabilities: {
+			...existingWithSandbox.capabilities,
+			email: true
+		}
+	} : existingWithSandbox;
 	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
@@ -1750,7 +1779,21 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
-	addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
+	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
+	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
+	if (externalHyperdriveId) {
+		if (recordedHyperdrive && (recordedHyperdrive.ownership !== "adopted" || recordedHyperdrive.id !== externalHyperdriveId)) throw new Error("platform: The Terraform-managed Hyperdrive differs from this installation.");
+		const remote = hyperdrives.find((resource) => resource.id === externalHyperdriveId);
+		if (!remote || remote.name !== names.hyperdrive) throw new Error(`platform: Terraform-managed Hyperdrive ${JSON.stringify(externalHyperdriveId)} must exist with the name ${JSON.stringify(names.hyperdrive)}.`);
+		actions.push({
+			action: recordedHyperdrive ? "reuse" : "adopt",
+			id: remote.id,
+			key: "hyperdrive",
+			kind: "hyperdrive",
+			name: remote.name,
+			reason: recordedHyperdrive ? "Reuse the recorded Terraform-managed Hyperdrive." : "Use the Terraform-managed Hyperdrive without taking ownership."
+		});
+	} else addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
 	for (const [key, name] of [
 		["api-worker", names.apiWorker],
 		["proxy-worker", names.proxyWorker],
@@ -1770,13 +1813,16 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...deployment,
 		resources: resolvedResources
 	});
+	const apiUrl = resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`;
+	const proxyUrl = resolvedDeployment.controlPlane.proxyHostname ? `https://${deployment.controlPlane.proxyHostname}` : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`;
 	return {
 		account,
 		actions,
-		apiUrl: resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`,
+		apiUrl,
 		deployment: resolvedDeployment,
+		...input.externalHyperdrive ? { externalHyperdrive: input.externalHyperdrive } : {},
 		installationId,
-		proxyUrl: resolvedDeployment.controlPlane.proxyHostname ? `https://${deployment.controlPlane.proxyHostname}` : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`,
+		proxyUrl,
 		workersSubdomain,
 		zone
 	};
@@ -1789,11 +1835,13 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 		controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
 		dedicatedZone: deployment.application.dedicatedZone,
 		displayName: deployment.displayName,
+		...original.externalHyperdrive ? { externalHyperdrive: original.externalHyperdrive } : {},
 		installationSlug: deployment.installationSlug,
 		zoneName: deployment.application.zoneName
 	}, manifest, {
 		...options,
-		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker")
+		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker"),
+		enableSandbox: original.deployment.capabilities.sandbox
 	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
@@ -2405,6 +2453,25 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.deployment.authentication.configurable && runtime.authenticationProtocolVersion !== 1) throw new Error("platform: This runtime does not support configurable authentication. Upgrade Void or use a compatible runtime.");
 	if (plan.deployment.application.workersDev && runtime.applicationRoutingVersion !== 1) throw new Error("platform: This runtime does not support workers.dev application routing. Use a current platform runtime.");
 	verifyRuntimeArtifacts(runtimeDirectory, runtime);
+	const hyperdriveAction = plan.actions.find((action) => action.key === "hyperdrive");
+	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
+	let externalHyperdriveOriginHash;
+	if (hyperdriveAction && (hyperdriveAction.action === "adopt" || recordedHyperdrive?.ownership === "adopted")) {
+		if (!hyperdriveAction.id) throw new Error("platform: The Terraform-managed Hyperdrive has no ID.");
+		if (!plan.externalHyperdrive && !recordedHyperdrive) throw new Error("platform: The Terraform-managed Hyperdrive origin must be specified.");
+		const live = await dependencies.client.getHyperdriveConfig(plan.account.id, hyperdriveAction.id);
+		externalHyperdriveOriginHash = verifyExternalPlatformHyperdrive({
+			config: live,
+			databaseUrl: secrets.databaseUrl,
+			expected: {
+				id: hyperdriveAction.id,
+				name: hyperdriveAction.name,
+				host: plan.externalHyperdrive?.host ?? live.origin.host,
+				user: plan.externalHyperdrive?.user ?? live.origin.user ?? ""
+			},
+			...recordedHyperdrive ? { recordedHash: recordedHyperdrive.configHash } : {}
+		});
+	}
 	const runtimeProvenance = {
 		manifestSha256: resolvedRuntime.manifestSha256,
 		source: resolvedRuntime.source,
@@ -2692,14 +2759,14 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				manifest = recordAdoptionIntent(manifest, action, action.id, now());
 				writeInstallationManifest(manifest);
 				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-				manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl);
+				manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
 				writeInstallationManifest(manifest);
 				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 				continue;
 			}
 			if (action.action === "reuse") {
 				if (action.id && (action.kind === "hyperdrive" || !manifest.resources.some((resource) => resource.key === action.key))) {
-					manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl);
+					manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
 					writeInstallationManifest(manifest);
 					await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
 					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
@@ -2710,7 +2777,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			writeInstallationManifest(manifest);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 			const resource = await createResource(dependencies.client, plan, action, secrets.databaseUrl, zoneId);
-			manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, resource.fingerprint);
+			manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : resource.fingerprint);
 			writeInstallationManifest(manifest);
 			await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
@@ -2771,7 +2838,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
 		const prepareSandboxDrain = dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
 		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
-		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
+		if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
 		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
 		const writeSandboxDrainMirror = async (preparation) => {
 			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
@@ -2848,7 +2916,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				routingKv: requireId(ids, "routing-kv"),
 				zone: zoneId
 			},
-			runtimeEntrypoints: entrypoints
+			runtimeEntrypoints: entrypoints,
+			...runtime.assets ? { runtimeApiAssetsDirectory: join(runtimeDirectory, PLATFORM_ADMIN_ASSETS_DIRECTORY) } : {}
 		};
 		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const enabledConfigs = createPlatformWorkerConfigs({
@@ -3074,7 +3143,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 		}
 		dependencies.onProgress?.("Verifying platform health");
-		const emailGatewayUrl = hasEmailGatewayArtifact ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
+		const emailGatewayUrl = hasEmailGatewayArtifact && plan.deployment.capabilities.email ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
 		if (plan.deployment.authentication.accessProtection) {
 			ensurePlatformAccessToken(plan.apiUrl, false, true);
 			ensurePlatformAccessToken(plan.proxyUrl, false, true);
@@ -3084,7 +3153,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			workers: [
 				plan.deployment.resources.apiWorker,
 				plan.deployment.resources.proxyWorker,
-				...hasEmailGatewayArtifact ? [plan.deployment.resources.emailGatewayWorker] : [],
+				...emailGatewayUrl ? [plan.deployment.resources.emailGatewayWorker] : [],
 				plan.deployment.resources.dispatchWorker
 			],
 			resumeCommand: dependencies.healthCheckResumeCommand,
@@ -3343,7 +3412,7 @@ async function createResource(client, plan, action, databaseUrl, zoneId) {
 function recordResource(manifest, action, id, ownership, now, databaseUrl, resourceFingerprint) {
 	const previous = manifest.resources.find((resource) => resource.key === action.key);
 	return recordInstallationResource(manifest, {
-		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : hash(JSON.stringify({
+		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && resourceFingerprint ? resourceFingerprint : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : hash(JSON.stringify({
 			kind: action.kind,
 			name: action.name
 		})),
@@ -3583,7 +3652,7 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWi
 	const requireSecret = (value, name) => {
 		if (!value) missing.add(name);
 	};
-	if (plan.deployment.authentication.configurable && !manifest.steps.some((step) => step.key.startsWith("authentication-initialized:v1:"))) {
+	if (plan.deployment.authentication.configurable && !manifest.steps.some((step) => step.key.startsWith("authentication-initialized:v1:")) && !(manifest.deployment.authentication.configurable && manifest.steps.some((step) => step.key === "bootstrap-access:v1"))) {
 		if (!authenticationWillBePrepared) requireSecret(secrets.authenticationSetupJson ?? "", "authentication setup configuration");
 		requireSecret(secrets.authSetupToken ?? "", "installation authentication setup authority");
 		requireSecret(secrets.authBootstrapCode ?? "", "administrator setup code");
@@ -3836,14 +3905,14 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
      ) AS "present"`)).rows[0]?.present === true;
-	if (requiredAdmissionProtocol === 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
+	if (requiredAdmissionProtocol >= 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
 	const readCheckpoint = () => client.query(`SELECT ${hasAdmissionColumn ? "\"admission_protocol\"" : "0 AS \"admission_protocol\""}, "generation", "state", "phase", "cursor", "started_at", "updated_at", "completed_at"
        FROM "sandbox_drain_checkpoints"
        WHERE "singleton" = true`);
 	const classify = (row) => {
 		if (!row) return null;
 		const cursor = row.cursor;
-		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
+		if (!row.generation || row.admission_protocol !== 0 && row.admission_protocol !== 2 && row.admission_protocol !== 3 || !row.started_at || !row.updated_at || row.state !== "draining" && row.state !== "complete" || row.phase !== "deployments" && row.phase !== "resources" || !cursor || cursor.pass !== "1" && cursor.pass !== "2" || row.state === "complete" && (!row.completed_at || row.phase !== "resources" || cursor.pass !== "2") || row.state === "draining" && row.completed_at !== null) throw new Error("platform: The authoritative sandbox-drain database checkpoint is invalid. Traffic remains disabled.");
 		return {
 			admissionProtocol: row.admission_protocol,
 			generation: row.generation,
@@ -3860,7 +3929,23 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
 	};
 	const existingState = classify((await readCheckpoint()).rows[0]);
 	if (existingState && (requiredAdmissionProtocol === 0 || existingState.admissionProtocol >= requiredAdmissionProtocol)) return existingState;
-	if (requiredAdmissionProtocol === 2) {
+	if (requiredAdmissionProtocol >= 2) {
+		if (existingState && existingState.admissionProtocol >= 2) {
+			await client.query("BEGIN");
+			try {
+				await client.query("LOCK TABLE \"deployments\" IN SHARE MODE");
+				await client.query(`UPDATE "sandbox_drain_checkpoints"
+           SET "admission_protocol" = GREATEST("admission_protocol", $1), "updated_at" = now()
+           WHERE "singleton" = true`, [requiredAdmissionProtocol]);
+				const advanced = classify((await readCheckpoint()).rows[0]);
+				if (!advanced || advanced.admissionProtocol < requiredAdmissionProtocol) throw new Error("platform: The Sandbox controller admission barrier could not be armed.");
+				await client.query("COMMIT");
+				return advanced;
+			} catch (error) {
+				await client.query("ROLLBACK").catch(() => void 0);
+				throw error;
+			}
+		}
 		const generation = randomUUID();
 		await client.query("BEGIN");
 		try {
@@ -3893,8 +3978,10 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
            WHERE "singleton" = true
              AND "admission_protocol" = 2
              AND "generation" = $1`, [generation]);
+			if (requiredAdmissionProtocol >= 3) await client.query(`UPDATE "sandbox_drain_checkpoints" SET "admission_protocol" = $1
+           WHERE "singleton" = true`, [requiredAdmissionProtocol]);
 			const armed = classify((await readCheckpoint()).rows[0]);
-			if (!armed || armed.admissionProtocol !== 2) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
+			if (!armed || armed.admissionProtocol < requiredAdmissionProtocol) throw new Error("platform: The sandbox deployment admission barrier could not be armed.");
 			await client.query("COMMIT");
 			return armed;
 		} catch (error) {
@@ -3937,12 +4024,17 @@ async function readRequiredPlatformSafetyProtocols(client) {
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
      ) AS "present"`)).rows[0]?.present === true) {
-		if ((await client.query(`SELECT EXISTS(
+		const admission = await client.query(`SELECT EXISTS(
          SELECT 1
          FROM "sandbox_drain_checkpoints"
          WHERE "singleton" = true
            AND "admission_protocol" >= 2
-       ) AS "required"`)).rows[0]?.required === true) return { sandboxDrain: 2 };
+       ) AS "required", (SELECT "admission_protocol" FROM "sandbox_drain_checkpoints"
+                         WHERE "singleton" = true) AS "protocol"`);
+		if (admission.rows[0]?.required === true) {
+			if (admission.rows[0].protocol != null && admission.rows[0].protocol > 3) throw new Error("platform: The database requires a newer Sandbox controller protocol.");
+			return { sandboxDrain: admission.rows[0].protocol === 3 ? 3 : 2 };
+		}
 	}
 	return { sandboxDrain: (await client.query(`SELECT EXISTS(
        SELECT 1
@@ -4598,15 +4690,15 @@ function readTriggerConfigFromObject(config) {
 	}
 }
 function verifyRuntimeArtifacts(runtimeDirectory, manifest) {
-	for (const artifact of Object.values(manifest.artifacts)) {
+	for (const artifact of [...Object.values(manifest.artifacts), ...manifest.assets ? [manifest.assets.adminClient, ...manifest.assets.adminStyle ? [manifest.assets.adminStyle] : []] : []]) {
 		const path = join(runtimeDirectory, artifact.path);
 		let contents;
 		try {
 			contents = readFileSync(path);
 		} catch (error) {
-			throw new Error(`platform: Runtime Worker artifact is missing: ${errorMessage(error)}`);
+			throw new Error(`platform: Runtime artifact is missing: ${errorMessage(error)}`);
 		}
-		if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) throw new Error(`platform: Runtime Worker artifact failed integrity verification: ${path}.`);
+		if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) throw new Error(`platform: Runtime artifact failed integrity verification: ${path}.`);
 	}
 	verifyPlatformDatabaseArtifacts(runtimeDirectory, manifest.database);
 }
@@ -4817,7 +4909,7 @@ var PlatformAccessBlockedError = class extends Error {
 			"Void’s own authentication stays enabled. Keep account-wide Default-Deny on.",
 			"",
 			"For platforms that must remain Access-protected:",
-			"https://void.cloud/guide/self-hosted-platform#cloudflare-access"
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
 		].join("\n"));
 	}
 };
@@ -5199,9 +5291,9 @@ function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
 	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + page.title + "\x1B]8;;\x1B\\" : page.title + ": " + page.url;
 }
 function platformSetupFieldHelp(key) {
-	const docs = (section, title) => platformSetupLink({
+	const docs = (page, section, title) => platformSetupLink({
 		title,
-		url: "https://void.cloud/guide/self-hosted-platform#" + section
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
 	});
 	switch (key) {
 		case "databaseUrl": return {
@@ -5209,10 +5301,10 @@ function platformSetupFieldHelp(key) {
 			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
 				title: "Neon",
 				url: "https://neon.com/"
-			}) + ". " + docs("platform-database", "Database setup")
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
 		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("signing-and-encryption-keys", "Key setup") };
+		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
 		default: return;
 	}
 }
@@ -5352,6 +5444,39 @@ function formatPlatformSetupPlan(plan) {
 		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access protection: configure API and proxy origins and admitted installer/CI credentials."] : []
 	].join("\n");
 }
+function formatPlatformInstallCommand(options) {
+	const quote = (value) => {
+		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+	};
+	const parts = [
+		options.commandName,
+		"platform",
+		"install"
+	];
+	const flag = (name, value) => {
+		if (value) parts.push(name, quote(value));
+	};
+	if (options.resumeId) {
+		parts.push("--resume");
+		flag("--name", options.resumeId);
+	} else {
+		flag("--name", options.installationSlug);
+		flag("--account", options.accountId);
+		flag("--display-name", options.displayName);
+		if (options.workersDev) parts.push("--workers-dev");
+		else {
+			flag("--application-domain", options.applicationDomain);
+			flag("--zone", options.zoneName);
+			if (options.dedicatedZone) parts.push("--dedicated-zone");
+		}
+		flag("--control-plane-domain", options.controlPlaneDomain);
+	}
+	flag("--auth-config", options.authConfig ?? "");
+	flag("--runtime", options.runtime);
+	if (options.yes) parts.push("--yes");
+	return parts.join(" ");
+}
 function openPlatformSetupPage(page, dependencies = {}) {
 	log.info(page.title + "\n" + page.instructions);
 	console.log(platformSetupLink({
@@ -5407,14 +5532,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-C74PULqV.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-IjiXgrXJ.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-ewqLefp1.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-DS8ih1SW.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5424,7 +5549,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-COogu_Se.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-Cgyed0WY.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -5566,6 +5691,68 @@ async function runPlatformLifecycleCommand(args) {
 		}
 		const checkpoint = existing ? readPendingInstallationSecrets(existing) : null;
 		const databaseUrl = resolvePlatformInstallDatabaseUrl(checkpoint, existing);
+		const externalHyperdriveId = process.env.VOID_PLATFORM_HYPERDRIVE_ID?.trim() || "";
+		const externalHyperdriveHost = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST?.trim() || "";
+		const externalHyperdriveUser = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER?.trim() || "";
+		if ([
+			externalHyperdriveId,
+			externalHyperdriveHost,
+			externalHyperdriveUser
+		].some(Boolean) && ![
+			externalHyperdriveId,
+			externalHyperdriveHost,
+			externalHyperdriveUser
+		].every(Boolean)) throw new Error("platform: VOID_PLATFORM_HYPERDRIVE_ID, VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST, and VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER must be set together.");
+		let externalHyperdrive = externalHyperdriveId ? {
+			id: externalHyperdriveId,
+			host: externalHyperdriveHost,
+			user: externalHyperdriveUser
+		} : void 0;
+		if (!externalHyperdrive && process.stdin.isTTY && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
+			const expectedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
+			const matches = (await client.listHyperdriveConfigs(accountId)).filter((resource) => resource.name === expectedName);
+			if (matches.length > 1) throw new Error(`platform: More than one Hyperdrive named ${expectedName} exists.`);
+			const live = matches[0] ? await client.getHyperdriveConfig(accountId, matches[0].id) : null;
+			if (live) {
+				if (live.id !== matches[0].id || live.name !== expectedName || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${expectedName}.`);
+				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${expectedName}`);
+				const choice = await select({
+					message: "How should Void set up Hyperdrive?",
+					options: [{
+						value: "existing",
+						label: `Use existing Hyperdrive ${expectedName}`
+					}, {
+						value: "cancel",
+						label: "Cancel installation"
+					}]
+				});
+				if (isCancel(choice) || choice === "cancel") throw new Error("platform: Cancelled.");
+				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${expectedName} before installing.`);
+				externalHyperdrive = {
+					id: live.id,
+					host: live.origin.host,
+					user: live.origin.user
+				};
+			} else {
+				const choice = await select({
+					message: "How should Void set up Hyperdrive?",
+					options: [{
+						value: "create",
+						label: "Let Void create Hyperdrive",
+						hint: "recommended"
+					}, {
+						value: "existing",
+						label: "Use a separately managed Hyperdrive"
+					}]
+				});
+				if (isCancel(choice)) throw new Error("platform: Cancelled.");
+				if (choice === "existing") {
+					note(`Create a Hyperdrive in account ${accountId} named ${expectedName}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+					outro("No Cloudflare or local installation state was changed.");
+					return;
+				}
+			}
+		}
 		let authoritativeProvisionIntents = false;
 		if (existing && !isPlatformSetupDraft(existing)) {
 			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
@@ -5574,7 +5761,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-COogu_Se.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Cgyed0WY.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -5590,6 +5777,7 @@ async function runPlatformLifecycleCommand(args) {
 			controlPlaneDomain,
 			dedicatedZone,
 			displayName,
+			...externalHyperdrive ? { externalHyperdrive } : {},
 			...process.env.VOID_EMAIL_SHARED_ZONE_ID ? { emailSharedZoneId: process.env.VOID_EMAIL_SHARED_ZONE_ID } : {},
 			...process.env.VOID_EMAIL_SENDER_DOMAIN ? { emailSenderDomain: process.env.VOID_EMAIL_SENDER_DOMAIN } : {},
 			installationSlug,
@@ -5599,12 +5787,29 @@ async function runPlatformLifecycleCommand(args) {
 		let plan = await createPlatformInstallPlan(client, planInput, existing, {
 			authoritativeProvisionIntents,
 			allowUnverifiedAiGateway: true,
-			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 		});
 		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
 		note(formatPlatformRuntime(runtime), "Platform runtime");
 		if (args.plan) {
 			console.log(formatPlatformSetupPlan(plan));
+			console.log(`\n${existing ? "To resume this installation later:" : "To install with these settings later:"}\n${formatPlatformInstallCommand({
+				commandName: cliCommandName(),
+				accountId,
+				installationSlug,
+				displayName,
+				applicationDomain,
+				zoneName,
+				controlPlaneDomain,
+				dedicatedZone,
+				workersDev,
+				authConfig: args.authConfig,
+				runtime: args.runtime,
+				...existing ? { resumeId: existing.id } : {},
+				yes: args.yes || process.stdin.isTTY !== true
+			})}\n`);
+			if (!existing && !args.authConfig && process.stdin.isTTY) console.log("Choose the same login methods when prompted.\n");
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
@@ -5780,11 +5985,12 @@ async function runPlatformLifecycleCommand(args) {
 			replanWorkers: async (manifest) => (await createPlatformInstallPlan(client, planInput, manifest, {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
-				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0
+				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-COogu_Se.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Cgyed0WY.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -5849,7 +6055,8 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 	try {
 		verified = await createPlatformInstallPlan(client, input, existing, {
 			authoritativeProvisionIntents,
-			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker")
+			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker"),
+			enableSandbox: preview.deployment.capabilities.sandbox
 		});
 	} catch (error) {
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
@@ -5923,4 +6130,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { PlatformCloudflareClient as C, verifyPlatformRuntimeTokenPermissions as D, hyperdriveOriginMatches as E, preparePlatformAccessSetup as S, hyperdriveOriginFromConnectionString as T, revalidatePlatformInstallAction as _, createPlatformInstallationSecrets as a, assertNoninteractivePlatformMutationAcknowledged, checkpointPlatformAccessResources as b, platformDatabaseClientUrl as c, recordPlatformWorkerTraffic as d, trackedPlatformWorkerTraffic as f, platformProvisionIntentHash as g, platformAdoptionIntentHash as h, createPlatformHealthProbeToken as i, recordResource as l, formatPlatformInstallPlan as m, acquirePlatformDatabaseLifecycleLock as n, installPlatform as o, createPlatformInstallPlan as p, acquirePlatformDatabaseLifecycleLockConnection as r, resolvePlatformInstallDatabaseUrl, runPlatformLifecycleCommand, loadPlatformRuntime as s, REMOTE_INSTALLATION_MANIFEST_KEY as t, resolveBootstrapGitHubId as u, assertPlatformOperatorCredentialCanApplyPlan as v, hyperdriveOriginConfigHash as w, parsePlatformAccessSetupSpec as x, resolvePlatformCloudflareCredential as y };
+export { hyperdriveOriginFromConnectionString as A, assertPlatformOperatorCredentialCanApplyPlan as C, preparePlatformAccessSetup as D, parsePlatformAccessSetupSpec as E, verifyPlatformRuntimeTokenPermissions as M, PlatformCloudflareClient as O, platformDatabaseNameFromOwnerUrl as S, checkpointPlatformAccessResources as T, createPlatformInstallPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, platformProvisionIntentHash as b, createPlatformHealthProbeToken as c, loadPlatformRuntime as d, platformDatabaseClientUrl as f, trackedPlatformWorkerTraffic as g, recordPlatformWorkerTraffic as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginMatches as j, hyperdriveOriginConfigHash as k, createPlatformInstallationSecrets as l, resolveBootstrapGitHubId as m, resolvePlatformInstallDatabaseUrl as n, acquirePlatformDatabaseLifecycleLock as o, recordResource as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLockConnection as s, assertNoninteractivePlatformMutationAcknowledged as t, installPlatform as u, formatPlatformInstallPlan as v, resolvePlatformCloudflareCredential as w, revalidatePlatformInstallAction as x, platformAdoptionIntentHash as y };