void 0.20.3 → 0.21.1

package/dist/{platform-auth-config-CdVWRRJr.mjs → platform-auth-config-C-hv-_Ok.mjs}

@@ -1,7 +1,7 @@
-import { I as isCancel, M as select, O as multiselect, P as text, j as password, w as confirm } from "./output-B0cfNSx5.mjs";
-import { f as openBrowser } from "./auth-DPl6kck4.mjs";
-import { n as OperatorClient } from "./operator-client-LUZnlnYk.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-B3e08unv.mjs";
+import { d as openBrowser } from "./auth-B9_D6ygs.mjs";
+import { B as text, E as confirm, F as password, I as select, M as multiselect, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { n as OperatorClient } from "./operator-client-A0iex2yi.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-BkVgJqv-.mjs";
 import { execFile } from "node:child_process";
 import { parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
@@ -140,11 +140,11 @@ async function configurationInput(args, existing) {
 }
 async function runPlatformAuthConfig(args) {
 	if (args.action === "recover") {
-		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-CmKEWpDo.mjs");
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-Cr0r8TEb.mjs");
 		return runPlatformAuthRecovery(args);
 	}
 	if (args.action === "protection") {
-		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-Drl0qhrn.mjs");
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-DjTE5Hj-.mjs");
 		return runPlatformProtectionConfig(args);
 	}
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-auth-protection-Drl0qhrn.mjs → platform-auth-protection-DjTE5Hj-.mjs}

@@ -1,9 +1,11 @@
-import { $ as promoteInstallationSecrets, I as isCancel, V as ensurePlatformAccessToken, W as acquirePlatformLifecycleLock, X as normalizePlatformApiUrl, ct as writePendingInstallationSecrets, et as readInstallationRecoverySecrets, it as resolveInstallationManifest, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { n as OperatorClient } from "./operator-client-LUZnlnYk.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-B3e08unv.mjs";
-import { C as PlatformCloudflareClient, S as preparePlatformAccessSetup, b as checkpointPlatformAccessResources, n as acquirePlatformDatabaseLifecycleLock, resolvePlatformInstallDatabaseUrl, x as parsePlatformAccessSetupSpec, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-R9xAxvtG.mjs";
-import { selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-BfWsXHEW.mjs";
+import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-BJbgZLS1.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-rAZxzMkL.mjs";
+import { E as confirm, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { n as OperatorClient } from "./operator-client-A0iex2yi.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-BkVgJqv-.mjs";
+import { D as preparePlatformAccessSetup, E as parsePlatformAccessSetupSpec, O as PlatformCloudflareClient, T as checkpointPlatformAccessResources, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Di0LbhPM.mjs";
+import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-eaiaU3uM.mjs";
 import { createHmac } from "node:crypto";
 import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
 import { readFile } from "node:fs/promises";

package/dist/{platform-auth-recovery-CmKEWpDo.mjs → platform-auth-recovery-Cr0r8TEb.mjs}

@@ -1,8 +1,9 @@
-import { I as isCancel, W as acquirePlatformLifecycleLock, et as readInstallationRecoverySecrets, it as resolveInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
-import { f as openBrowser } from "./auth-DPl6kck4.mjs";
-import { a as resolveOperatorOrigin } from "./operator-auth-B3e08unv.mjs";
-import { C as PlatformCloudflareClient, c as platformDatabaseClientUrl, r as acquirePlatformDatabaseLifecycleLockConnection, resolvePlatformInstallDatabaseUrl, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-R9xAxvtG.mjs";
-import { selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-BfWsXHEW.mjs";
+import { d as openBrowser } from "./auth-B9_D6ygs.mjs";
+import { d as readInstallationRecoverySecrets, h as resolveInstallationManifest, t as acquirePlatformLifecycleLock } from "./platform-registry-BJbgZLS1.mjs";
+import { E as confirm, W as isCancel } from "./dist-Dn6nn2IU.mjs";
+import { a as resolveOperatorOrigin } from "./operator-auth-BkVgJqv-.mjs";
+import { O as PlatformCloudflareClient, f as platformDatabaseClientUrl, n as resolvePlatformInstallDatabaseUrl, s as acquirePlatformDatabaseLifecycleLockConnection, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Di0LbhPM.mjs";
+import { c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-eaiaU3uM.mjs";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";

package/dist/{platform-cmd-5q_k56xS.mjs → platform-cmd-0tEh2ZtA.mjs}

@@ -1,5 +1,8 @@
-import { B as ensureCloudflaredToken, D as log, I as isCancel, K as getActivePlatformConnection, M as select, P as text, U as isCloudflareAccessChallenge, V as ensurePlatformAccessToken, X as normalizePlatformApiUrl, Y as listPlatformConnections, at as savePlatformConnection, c as import_picocolors, ot as selectPlatformConnection } from "./output-B0cfNSx5.mjs";
+import { c as import_picocolors } from "./output-CCH48AMM.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { _ as selectPlatformConnection, g as savePlatformConnection, o as listPlatformConnections, r as getActivePlatformConnection, s as normalizePlatformApiUrl } from "./platform-registry-BJbgZLS1.mjs";
+import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-rAZxzMkL.mjs";
+import { B as text, I as select, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
 import { parsePlatformDiscoveryDocument } from "@void/platform";
 //#region src/cli/platform-cmd.ts
 async function discoverPlatform(input, fetcher = fetch) {
@@ -89,12 +92,12 @@ function saveDiscoveredPlatform(discovery) {
 }
 async function runPlatformCommand(_root, args) {
 	if (args.subcommand === "config") {
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-CdVWRRJr.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-C-hv-_Ok.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-CKJ7xIRs.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-BwAS2XZt.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -126,8 +129,8 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-R9xAxvtG.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-Dhx9Pnub.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 //#endregion
-export { discoverPlatform, promptPlatformUrl, runPlatformCommand, saveDiscoveredPlatform };
+export { saveDiscoveredPlatform as i, promptPlatformUrl as n, runPlatformCommand as r, discoverPlatform as t };

package/dist/platform-cmd-DE6dw45v.mjs

@@ -0,0 +1,2 @@
+import { r as runPlatformCommand, t as discoverPlatform } from "./platform-cmd-0tEh2ZtA.mjs";
+export { discoverPlatform, runPlatformCommand };

package/dist/{platform-domain-4GiDlcqx.mjs → platform-domain-B_7x6Iqx.mjs}

@@ -1,7 +1,8 @@
-import { D as log, I as isCancel, P as text, W as acquirePlatformLifecycleLock, at as savePlatformConnection, et as readInstallationRecoverySecrets, k as note, st as writeInstallationManifest, w as confirm } from "./output-B0cfNSx5.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { C as PlatformCloudflareClient, assertNoninteractivePlatformMutationAcknowledged, d as recordPlatformWorkerTraffic, i as createPlatformHealthProbeToken, l as recordResource, n as acquirePlatformDatabaseLifecycleLock, p as createPlatformInstallPlan, resolvePlatformInstallDatabaseUrl, v as assertPlatformOperatorCredentialCanApplyPlan, y as resolvePlatformCloudflareCredential } from "./platform-lifecycle-R9xAxvtG.mjs";
-import { resolveInstalledPlatformManifest, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership } from "./platform-management-BfWsXHEW.mjs";
+import { d as readInstallationRecoverySecrets, g as savePlatformConnection, t as acquirePlatformLifecycleLock, v as writeInstallationManifest } from "./platform-registry-BJbgZLS1.mjs";
+import { B as text, E as confirm, N as note, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { C as assertPlatformOperatorCredentialCanApplyPlan, O as PlatformCloudflareClient, _ as createPlatformInstallPlan, c as createPlatformHealthProbeToken, h as recordPlatformWorkerTraffic, n as resolvePlatformInstallDatabaseUrl, o as acquirePlatformDatabaseLifecycleLock, p as recordResource, t as assertNoninteractivePlatformMutationAcknowledged, w as resolvePlatformCloudflareCredential } from "./platform-lifecycle-Di0LbhPM.mjs";
+import { a as resolveInstalledPlatformManifest, c as selectAuthoritativePlatformManifest, u as verifyPlatformInstallationOwnership } from "./platform-management-eaiaU3uM.mjs";
 import { randomUUID } from "node:crypto";
 import { PLATFORM_APPLICATION_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts

package/dist/platform-lifecycle-Dhx9Pnub.mjs

@@ -0,0 +1,2 @@
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-Di0LbhPM.mjs";
+export { runPlatformLifecycleCommand };

package/dist/{platform-lifecycle-R9xAxvtG.mjs → platform-lifecycle-Di0LbhPM.mjs}

@@ -1,11 +1,14 @@
-import { r as __toESM } from "./rolldown-runtime-rQ84J-ij.mjs";
-import { o as join } from "./dist-BrsS7cai.mjs";
-import { $ as promoteInstallationSecrets, A as outro, D as log, E as intro, F as CANCEL_SYMBOL, G as assertPlatformInstallationSlugAvailable, I as isCancel, J as listInstallationManifests, L as settings, M as select, N as symbol, O as multiselect, P as text$1, Q as platformWorkerSecretUpdateIntentState, R as u$1, V as ensurePlatformAccessToken, W as acquirePlatformLifecycleLock, X as normalizePlatformApiUrl, at as savePlatformConnection, c as import_picocolors$1, ct as writePendingInstallationSecrets, et as readInstallationRecoverySecrets, ft as require_picocolors, h as S_BAR_END, i as createSpinner, it as resolveInstallationManifest, j as password, k as note, m as S_BAR, n as cliCommandName, q as latestPlatformWorkerCutoverGeneration, r as cliTitle, st as writeInstallationManifest, tt as readPendingInstallationSecrets, v as S_PASSWORD_MASK, w as confirm } from "./output-B0cfNSx5.mjs";
+import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
+import { a as join } from "./dist-4WkAWhWx.mjs";
+import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-CCH48AMM.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { f as openBrowser } from "./auth-DPl6kck4.mjs";
-import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
-import { l as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-6M5llVPC.mjs";
-import { n as createDefaultRunWrangler, o as resolvePinnedApiBaseUrl } from "./provision-CSJOjjQk.mjs";
+import { d as openBrowser } from "./auth-B9_D6ygs.mjs";
+import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-BJbgZLS1.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-rAZxzMkL.mjs";
+import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-Dn6nn2IU.mjs";
+import { o as resolveWranglerArgv } from "./preset-Dowh9tTt.mjs";
+import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-BCmTc1X_.mjs";
+import { g as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-Cck2m3jJ.mjs";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
@@ -16,7 +19,7 @@ import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readClou
 import { readFile } from "node:fs/promises";
 import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
-import { platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
+import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
 //#region src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
 	status;
@@ -1408,7 +1411,7 @@ async function resolvePlatformCloudflareCredentialWithInput(readInput, dependenc
 			credential: result.credential
 		};
 		announceCloudflareLogin();
-		const login = await runWrangler(["login", "--use-keyring"], true);
+		const login = await runWrangler(["login"], false);
 		assertNotCancelled();
 		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
 		const credential = await readWranglerOAuthCredential(runWrangler);
@@ -1430,11 +1433,6 @@ async function readExistingCredential(dependencies, runWrangler) {
 		token: environmentToken
 	};
 	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
-	if ((await runWrangler([
-		"auth",
-		"keyring",
-		"enable"
-	], true)).status !== 0) throw new Error("platform: Could not enable secure Cloudflare credential storage. Refusing to use a plaintext OAuth credential.");
 	return await readWranglerOAuthCredential(runWrangler);
 }
 async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
@@ -1501,7 +1499,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Drl0qhrn.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DjTE5Hj-.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1554,13 +1552,36 @@ async function initializeInstalledPlatformAuthentication(apiUrl, installationId,
 }
 //#endregion
 //#region src/cli/platform-auth-database.ts
+/** Read the database name from an owner URL without applying Hyperdrive origin restrictions. */
+function platformDatabaseNameFromOwnerUrl(databaseUrl) {
+	let url;
+	try {
+		url = new URL(databaseUrl);
+	} catch {
+		throw new Error("platform: DATABASE_URL must be a PostgreSQL connection string.");
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:" || !url.hostname) throw new Error("platform: DATABASE_URL must use postgres:// or postgresql://.");
+	const database = decodeURIComponent(url.pathname.replace(/^\//, ""));
+	if (!database) throw new Error("platform: DATABASE_URL must include a database.");
+	return database;
+}
+/** Pin an externally managed Hyperdrive without treating the owner URL as its runtime origin. */
+function verifyExternalPlatformHyperdrive(input) {
+	const { config, expected } = input;
+	const database = platformDatabaseNameFromOwnerUrl(input.databaseUrl);
+	const hash = hyperdriveOriginConfigHash(config.origin);
+	if (config.id !== expected.id || config.name !== expected.name || config.origin.host !== expected.host.toLowerCase() || config.origin.user !== expected.user || config.origin.database !== database || input.recordedHash && input.recordedHash !== hash) throw new Error("platform: The Terraform-managed Hyperdrive does not match the expected database origin.");
+	if (config.cachingDisabled !== true) throw new Error("platform: Disable SQL result caching on the Terraform-managed Hyperdrive before installing.");
+	return hash;
+}
 /** Authentication requires fresh reads; mutate only the installation-owned configuration. */
 async function verifyPlatformAuthenticationDatabase(client, accountId, resource, databaseUrl) {
 	if (resource.kind !== "hyperdrive" || resource.key !== "hyperdrive" || resource.state !== "ready") throw new Error("platform: Authentication database verification requires the platform Hyperdrive resource.");
-	const expected = hyperdriveOriginFromConnectionString(databaseUrl);
+	const expectedDatabase = resource.ownership === "adopted" ? platformDatabaseNameFromOwnerUrl(databaseUrl) : void 0;
+	const expectedOrigin = resource.ownership !== "adopted" ? hyperdriveOriginFromConnectionString(databaseUrl) : void 0;
 	const read = async () => {
 		const current = await client.getHyperdriveConfig(accountId, resource.id);
-		if (current.id !== resource.id || current.name !== resource.name || !hyperdriveOriginMatches(current.origin, expected)) throw new Error("platform: Hyperdrive does not match this installation’s pinned database. No authentication configuration was activated.");
+		if (current.id !== resource.id || current.name !== resource.name || (resource.ownership === "adopted" ? current.origin.database !== expectedDatabase || hyperdriveOriginConfigHash(current.origin) !== resource.configHash : expectedOrigin === void 0 || !hyperdriveOriginMatches(current.origin, expectedOrigin))) throw new Error("platform: Hyperdrive does not match this installation’s pinned database. No authentication configuration was activated.");
 		return current;
 	};
 	if ((await read()).cachingDisabled === true) return;
@@ -1758,7 +1779,21 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
-	addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
+	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
+	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
+	if (externalHyperdriveId) {
+		if (recordedHyperdrive && (recordedHyperdrive.ownership !== "adopted" || recordedHyperdrive.id !== externalHyperdriveId)) throw new Error("platform: The Terraform-managed Hyperdrive differs from this installation.");
+		const remote = hyperdrives.find((resource) => resource.id === externalHyperdriveId);
+		if (!remote || remote.name !== names.hyperdrive) throw new Error(`platform: Terraform-managed Hyperdrive ${JSON.stringify(externalHyperdriveId)} must exist with the name ${JSON.stringify(names.hyperdrive)}.`);
+		actions.push({
+			action: recordedHyperdrive ? "reuse" : "adopt",
+			id: remote.id,
+			key: "hyperdrive",
+			kind: "hyperdrive",
+			name: remote.name,
+			reason: recordedHyperdrive ? "Reuse the recorded Terraform-managed Hyperdrive." : "Use the Terraform-managed Hyperdrive without taking ownership."
+		});
+	} else addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
 	for (const [key, name] of [
 		["api-worker", names.apiWorker],
 		["proxy-worker", names.proxyWorker],
@@ -1778,13 +1813,16 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...deployment,
 		resources: resolvedResources
 	});
+	const apiUrl = resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`;
+	const proxyUrl = resolvedDeployment.controlPlane.proxyHostname ? `https://${deployment.controlPlane.proxyHostname}` : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`;
 	return {
 		account,
 		actions,
-		apiUrl: resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`,
+		apiUrl,
 		deployment: resolvedDeployment,
+		...input.externalHyperdrive ? { externalHyperdrive: input.externalHyperdrive } : {},
 		installationId,
-		proxyUrl: resolvedDeployment.controlPlane.proxyHostname ? `https://${deployment.controlPlane.proxyHostname}` : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`,
+		proxyUrl,
 		workersSubdomain,
 		zone
 	};
@@ -1797,6 +1835,7 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 		controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
 		dedicatedZone: deployment.application.dedicatedZone,
 		displayName: deployment.displayName,
+		...original.externalHyperdrive ? { externalHyperdrive: original.externalHyperdrive } : {},
 		installationSlug: deployment.installationSlug,
 		zoneName: deployment.application.zoneName
 	}, manifest, {
@@ -2414,6 +2453,25 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.deployment.authentication.configurable && runtime.authenticationProtocolVersion !== 1) throw new Error("platform: This runtime does not support configurable authentication. Upgrade Void or use a compatible runtime.");
 	if (plan.deployment.application.workersDev && runtime.applicationRoutingVersion !== 1) throw new Error("platform: This runtime does not support workers.dev application routing. Use a current platform runtime.");
 	verifyRuntimeArtifacts(runtimeDirectory, runtime);
+	const hyperdriveAction = plan.actions.find((action) => action.key === "hyperdrive");
+	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
+	let externalHyperdriveOriginHash;
+	if (hyperdriveAction && (hyperdriveAction.action === "adopt" || recordedHyperdrive?.ownership === "adopted")) {
+		if (!hyperdriveAction.id) throw new Error("platform: The Terraform-managed Hyperdrive has no ID.");
+		if (!plan.externalHyperdrive && !recordedHyperdrive) throw new Error("platform: The Terraform-managed Hyperdrive origin must be specified.");
+		const live = await dependencies.client.getHyperdriveConfig(plan.account.id, hyperdriveAction.id);
+		externalHyperdriveOriginHash = verifyExternalPlatformHyperdrive({
+			config: live,
+			databaseUrl: secrets.databaseUrl,
+			expected: {
+				id: hyperdriveAction.id,
+				name: hyperdriveAction.name,
+				host: plan.externalHyperdrive?.host ?? live.origin.host,
+				user: plan.externalHyperdrive?.user ?? live.origin.user ?? ""
+			},
+			...recordedHyperdrive ? { recordedHash: recordedHyperdrive.configHash } : {}
+		});
+	}
 	const runtimeProvenance = {
 		manifestSha256: resolvedRuntime.manifestSha256,
 		source: resolvedRuntime.source,
@@ -2701,14 +2759,14 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				manifest = recordAdoptionIntent(manifest, action, action.id, now());
 				writeInstallationManifest(manifest);
 				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-				manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl);
+				manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
 				writeInstallationManifest(manifest);
 				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 				continue;
 			}
 			if (action.action === "reuse") {
 				if (action.id && (action.kind === "hyperdrive" || !manifest.resources.some((resource) => resource.key === action.key))) {
-					manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl);
+					manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
 					writeInstallationManifest(manifest);
 					await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
 					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
@@ -2719,7 +2777,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			writeInstallationManifest(manifest);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 			const resource = await createResource(dependencies.client, plan, action, secrets.databaseUrl, zoneId);
-			manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, resource.fingerprint);
+			manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : resource.fingerprint);
 			writeInstallationManifest(manifest);
 			await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
@@ -2858,7 +2916,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				routingKv: requireId(ids, "routing-kv"),
 				zone: zoneId
 			},
-			runtimeEntrypoints: entrypoints
+			runtimeEntrypoints: entrypoints,
+			...runtime.assets ? { runtimeApiAssetsDirectory: join(runtimeDirectory, PLATFORM_ADMIN_ASSETS_DIRECTORY) } : {}
 		};
 		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const enabledConfigs = createPlatformWorkerConfigs({
@@ -3084,7 +3143,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 		}
 		dependencies.onProgress?.("Verifying platform health");
-		const emailGatewayUrl = hasEmailGatewayArtifact ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
+		const emailGatewayUrl = hasEmailGatewayArtifact && plan.deployment.capabilities.email ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
 		if (plan.deployment.authentication.accessProtection) {
 			ensurePlatformAccessToken(plan.apiUrl, false, true);
 			ensurePlatformAccessToken(plan.proxyUrl, false, true);
@@ -3094,7 +3153,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			workers: [
 				plan.deployment.resources.apiWorker,
 				plan.deployment.resources.proxyWorker,
-				...hasEmailGatewayArtifact ? [plan.deployment.resources.emailGatewayWorker] : [],
+				...emailGatewayUrl ? [plan.deployment.resources.emailGatewayWorker] : [],
 				plan.deployment.resources.dispatchWorker
 			],
 			resumeCommand: dependencies.healthCheckResumeCommand,
@@ -3353,7 +3412,7 @@ async function createResource(client, plan, action, databaseUrl, zoneId) {
 function recordResource(manifest, action, id, ownership, now, databaseUrl, resourceFingerprint) {
 	const previous = manifest.resources.find((resource) => resource.key === action.key);
 	return recordInstallationResource(manifest, {
-		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : hash(JSON.stringify({
+		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && resourceFingerprint ? resourceFingerprint : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : hash(JSON.stringify({
 			kind: action.kind,
 			name: action.name
 		})),
@@ -3593,7 +3652,7 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWi
 	const requireSecret = (value, name) => {
 		if (!value) missing.add(name);
 	};
-	if (plan.deployment.authentication.configurable && !manifest.steps.some((step) => step.key.startsWith("authentication-initialized:v1:"))) {
+	if (plan.deployment.authentication.configurable && !manifest.steps.some((step) => step.key.startsWith("authentication-initialized:v1:")) && !(manifest.deployment.authentication.configurable && manifest.steps.some((step) => step.key === "bootstrap-access:v1"))) {
 		if (!authenticationWillBePrepared) requireSecret(secrets.authenticationSetupJson ?? "", "authentication setup configuration");
 		requireSecret(secrets.authSetupToken ?? "", "installation authentication setup authority");
 		requireSecret(secrets.authBootstrapCode ?? "", "administrator setup code");
@@ -4631,15 +4690,15 @@ function readTriggerConfigFromObject(config) {
 	}
 }
 function verifyRuntimeArtifacts(runtimeDirectory, manifest) {
-	for (const artifact of Object.values(manifest.artifacts)) {
+	for (const artifact of [...Object.values(manifest.artifacts), ...manifest.assets ? [manifest.assets.adminClient, ...manifest.assets.adminStyle ? [manifest.assets.adminStyle] : []] : []]) {
 		const path = join(runtimeDirectory, artifact.path);
 		let contents;
 		try {
 			contents = readFileSync(path);
 		} catch (error) {
-			throw new Error(`platform: Runtime Worker artifact is missing: ${errorMessage(error)}`);
+			throw new Error(`platform: Runtime artifact is missing: ${errorMessage(error)}`);
 		}
-		if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) throw new Error(`platform: Runtime Worker artifact failed integrity verification: ${path}.`);
+		if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) throw new Error(`platform: Runtime artifact failed integrity verification: ${path}.`);
 	}
 	verifyPlatformDatabaseArtifacts(runtimeDirectory, manifest.database);
 }
@@ -5385,6 +5444,39 @@ function formatPlatformSetupPlan(plan) {
 		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access protection: configure API and proxy origins and admitted installer/CI credentials."] : []
 	].join("\n");
 }
+function formatPlatformInstallCommand(options) {
+	const quote = (value) => {
+		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+	};
+	const parts = [
+		options.commandName,
+		"platform",
+		"install"
+	];
+	const flag = (name, value) => {
+		if (value) parts.push(name, quote(value));
+	};
+	if (options.resumeId) {
+		parts.push("--resume");
+		flag("--name", options.resumeId);
+	} else {
+		flag("--name", options.installationSlug);
+		flag("--account", options.accountId);
+		flag("--display-name", options.displayName);
+		if (options.workersDev) parts.push("--workers-dev");
+		else {
+			flag("--application-domain", options.applicationDomain);
+			flag("--zone", options.zoneName);
+			if (options.dedicatedZone) parts.push("--dedicated-zone");
+		}
+		flag("--control-plane-domain", options.controlPlaneDomain);
+	}
+	flag("--auth-config", options.authConfig ?? "");
+	flag("--runtime", options.runtime);
+	if (options.yes) parts.push("--yes");
+	return parts.join(" ");
+}
 function openPlatformSetupPage(page, dependencies = {}) {
 	log.info(page.title + "\n" + page.instructions);
 	console.log(platformSetupLink({
@@ -5440,14 +5532,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-4GiDlcqx.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-B_7x6Iqx.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-CbK-I1FB.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-BxfA8E5C.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5457,7 +5549,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-BfWsXHEW.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-B9LUtMt9.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -5599,6 +5691,68 @@ async function runPlatformLifecycleCommand(args) {
 		}
 		const checkpoint = existing ? readPendingInstallationSecrets(existing) : null;
 		const databaseUrl = resolvePlatformInstallDatabaseUrl(checkpoint, existing);
+		const externalHyperdriveId = process.env.VOID_PLATFORM_HYPERDRIVE_ID?.trim() || "";
+		const externalHyperdriveHost = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST?.trim() || "";
+		const externalHyperdriveUser = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER?.trim() || "";
+		if ([
+			externalHyperdriveId,
+			externalHyperdriveHost,
+			externalHyperdriveUser
+		].some(Boolean) && ![
+			externalHyperdriveId,
+			externalHyperdriveHost,
+			externalHyperdriveUser
+		].every(Boolean)) throw new Error("platform: VOID_PLATFORM_HYPERDRIVE_ID, VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST, and VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER must be set together.");
+		let externalHyperdrive = externalHyperdriveId ? {
+			id: externalHyperdriveId,
+			host: externalHyperdriveHost,
+			user: externalHyperdriveUser
+		} : void 0;
+		if (!externalHyperdrive && process.stdin.isTTY && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
+			const expectedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
+			const matches = (await client.listHyperdriveConfigs(accountId)).filter((resource) => resource.name === expectedName);
+			if (matches.length > 1) throw new Error(`platform: More than one Hyperdrive named ${expectedName} exists.`);
+			const live = matches[0] ? await client.getHyperdriveConfig(accountId, matches[0].id) : null;
+			if (live) {
+				if (live.id !== matches[0].id || live.name !== expectedName || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${expectedName}.`);
+				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${expectedName}`);
+				const choice = await select({
+					message: "How should Void set up Hyperdrive?",
+					options: [{
+						value: "existing",
+						label: `Use existing Hyperdrive ${expectedName}`
+					}, {
+						value: "cancel",
+						label: "Cancel installation"
+					}]
+				});
+				if (isCancel(choice) || choice === "cancel") throw new Error("platform: Cancelled.");
+				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${expectedName} before installing.`);
+				externalHyperdrive = {
+					id: live.id,
+					host: live.origin.host,
+					user: live.origin.user
+				};
+			} else {
+				const choice = await select({
+					message: "How should Void set up Hyperdrive?",
+					options: [{
+						value: "create",
+						label: "Let Void create Hyperdrive",
+						hint: "recommended"
+					}, {
+						value: "existing",
+						label: "Use a separately managed Hyperdrive"
+					}]
+				});
+				if (isCancel(choice)) throw new Error("platform: Cancelled.");
+				if (choice === "existing") {
+					note(`Create a Hyperdrive in account ${accountId} named ${expectedName}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+					outro("No Cloudflare or local installation state was changed.");
+					return;
+				}
+			}
+		}
 		let authoritativeProvisionIntents = false;
 		if (existing && !isPlatformSetupDraft(existing)) {
 			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
@@ -5607,7 +5761,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-BfWsXHEW.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-B9LUtMt9.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -5623,6 +5777,7 @@ async function runPlatformLifecycleCommand(args) {
 			controlPlaneDomain,
 			dedicatedZone,
 			displayName,
+			...externalHyperdrive ? { externalHyperdrive } : {},
 			...process.env.VOID_EMAIL_SHARED_ZONE_ID ? { emailSharedZoneId: process.env.VOID_EMAIL_SHARED_ZONE_ID } : {},
 			...process.env.VOID_EMAIL_SENDER_DOMAIN ? { emailSenderDomain: process.env.VOID_EMAIL_SENDER_DOMAIN } : {},
 			installationSlug,
@@ -5639,6 +5794,22 @@ async function runPlatformLifecycleCommand(args) {
 		note(formatPlatformRuntime(runtime), "Platform runtime");
 		if (args.plan) {
 			console.log(formatPlatformSetupPlan(plan));
+			console.log(`\n${existing ? "To resume this installation later:" : "To install with these settings later:"}\n${formatPlatformInstallCommand({
+				commandName: cliCommandName(),
+				accountId,
+				installationSlug,
+				displayName,
+				applicationDomain,
+				zoneName,
+				controlPlaneDomain,
+				dedicatedZone,
+				workersDev,
+				authConfig: args.authConfig,
+				runtime: args.runtime,
+				...existing ? { resumeId: existing.id } : {},
+				yes: args.yes || process.stdin.isTTY !== true
+			})}\n`);
+			if (!existing && !args.authConfig && process.stdin.isTTY) console.log("Choose the same login methods when prompted.\n");
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
@@ -5819,7 +5990,7 @@ async function runPlatformLifecycleCommand(args) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-BfWsXHEW.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-B9LUtMt9.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -5959,4 +6130,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { PlatformCloudflareClient as C, verifyPlatformRuntimeTokenPermissions as D, hyperdriveOriginMatches as E, preparePlatformAccessSetup as S, hyperdriveOriginFromConnectionString as T, revalidatePlatformInstallAction as _, createPlatformInstallationSecrets as a, assertNoninteractivePlatformMutationAcknowledged, checkpointPlatformAccessResources as b, platformDatabaseClientUrl as c, recordPlatformWorkerTraffic as d, trackedPlatformWorkerTraffic as f, platformProvisionIntentHash as g, platformAdoptionIntentHash as h, createPlatformHealthProbeToken as i, recordResource as l, formatPlatformInstallPlan as m, acquirePlatformDatabaseLifecycleLock as n, installPlatform as o, createPlatformInstallPlan as p, acquirePlatformDatabaseLifecycleLockConnection as r, resolvePlatformInstallDatabaseUrl, runPlatformLifecycleCommand, loadPlatformRuntime as s, REMOTE_INSTALLATION_MANIFEST_KEY as t, resolveBootstrapGitHubId as u, assertPlatformOperatorCredentialCanApplyPlan as v, hyperdriveOriginConfigHash as w, parsePlatformAccessSetupSpec as x, resolvePlatformCloudflareCredential as y };
+export { hyperdriveOriginFromConnectionString as A, assertPlatformOperatorCredentialCanApplyPlan as C, preparePlatformAccessSetup as D, parsePlatformAccessSetupSpec as E, verifyPlatformRuntimeTokenPermissions as M, PlatformCloudflareClient as O, platformDatabaseNameFromOwnerUrl as S, checkpointPlatformAccessResources as T, createPlatformInstallPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, platformProvisionIntentHash as b, createPlatformHealthProbeToken as c, loadPlatformRuntime as d, platformDatabaseClientUrl as f, trackedPlatformWorkerTraffic as g, recordPlatformWorkerTraffic as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginMatches as j, hyperdriveOriginConfigHash as k, createPlatformInstallationSecrets as l, resolveBootstrapGitHubId as m, resolvePlatformInstallDatabaseUrl as n, acquirePlatformDatabaseLifecycleLock as o, recordResource as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLockConnection as s, assertNoninteractivePlatformMutationAcknowledged as t, installPlatform as u, formatPlatformInstallPlan as v, resolvePlatformCloudflareCredential as w, revalidatePlatformInstallAction as x, platformAdoptionIntentHash as y };

package/dist/platform-management-B9LUtMt9.mjs

@@ -0,0 +1,2 @@
+import { c as selectAuthoritativePlatformManifest, s as runInstalledPlatformCommand, u as verifyPlatformInstallationOwnership } from "./platform-management-eaiaU3uM.mjs";
+export { runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };