void 0.21.2 → 0.21.3

package/dist/{platform-lifecycle-DVzM2T4j.mjs → platform-lifecycle-78H0XQUA.mjs}

@@ -1,14 +1,14 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
-import { a as join } from "./dist-4WkAWhWx.mjs";
+import { a as join } from "./dist-BVqXeR_h.mjs";
 import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-CCH48AMM.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as openBrowser } from "./auth-B9_D6ygs.mjs";
-import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-BJbgZLS1.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-rAZxzMkL.mjs";
+import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
+import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
 import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-Dn6nn2IU.mjs";
-import { o as resolveWranglerArgv } from "./preset-Dowh9tTt.mjs";
-import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-BCmTc1X_.mjs";
-import { g as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-Cck2m3jJ.mjs";
+import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
+import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-B9jPCkV2.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BhreDAOS.mjs";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
@@ -1499,7 +1499,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Dcat-6zu.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-Ba1XqGhn.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1570,8 +1570,8 @@ function verifyExternalPlatformHyperdrive(input) {
 	const { config, expected } = input;
 	const database = platformDatabaseNameFromOwnerUrl(input.databaseUrl);
 	const hash = hyperdriveOriginConfigHash(config.origin);
-	if (config.id !== expected.id || config.name !== expected.name || config.origin.host !== expected.host.toLowerCase() || config.origin.user !== expected.user || config.origin.database !== database || input.recordedHash && input.recordedHash !== hash) throw new Error("platform: The Terraform-managed Hyperdrive does not match the expected database origin.");
-	if (config.cachingDisabled !== true) throw new Error("platform: Disable SQL result caching on the Terraform-managed Hyperdrive before installing.");
+	if (config.id !== expected.id || config.name !== expected.name || config.origin.host !== expected.host.toLowerCase() || config.origin.user !== expected.user || config.origin.database !== database || input.recordedHash && input.recordedHash !== hash) throw new Error("platform: The externally managed Hyperdrive does not match the expected database origin.");
+	if (config.cachingDisabled !== true) throw new Error("platform: Disable SQL result caching on the externally managed Hyperdrive before installing.");
 	return hash;
 }
 /** Authentication requires fresh reads; mutate only the installation-owned configuration. */
@@ -1782,16 +1782,18 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
 	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
 	if (externalHyperdriveId) {
-		if (recordedHyperdrive && (recordedHyperdrive.ownership !== "adopted" || recordedHyperdrive.id !== externalHyperdriveId)) throw new Error("platform: The Terraform-managed Hyperdrive differs from this installation.");
+		if (recordedHyperdrive && (recordedHyperdrive.ownership !== "adopted" || recordedHyperdrive.id !== externalHyperdriveId)) throw new Error("platform: The externally managed Hyperdrive differs from this installation.");
 		const remote = hyperdrives.find((resource) => resource.id === externalHyperdriveId);
-		if (!remote || remote.name !== names.hyperdrive) throw new Error(`platform: Terraform-managed Hyperdrive ${JSON.stringify(externalHyperdriveId)} must exist with the name ${JSON.stringify(names.hyperdrive)}.`);
+		const selectedName = input.externalHyperdrive?.name;
+		const recordedName = recordedHyperdrive?.name;
+		if (!remote || selectedName && remote.name !== selectedName || recordedName && remote.name !== recordedName) throw new Error(`platform: Externally managed Hyperdrive ${JSON.stringify(externalHyperdriveId)} must exist with its selected name.`);
 		actions.push({
 			action: recordedHyperdrive ? "reuse" : "adopt",
 			id: remote.id,
 			key: "hyperdrive",
 			kind: "hyperdrive",
 			name: remote.name,
-			reason: recordedHyperdrive ? "Reuse the recorded Terraform-managed Hyperdrive." : "Use the Terraform-managed Hyperdrive without taking ownership."
+			reason: recordedHyperdrive ? "Reuse the recorded externally managed Hyperdrive." : "Use the externally managed Hyperdrive without taking ownership."
 		});
 	} else addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
 	for (const [key, name] of [
@@ -2427,6 +2429,204 @@ function parseWorkerSecretUpdateIntent(value) {
 function sanitizeWorkerSecretUpdates(updates) {
 	return Object.fromEntries(Object.entries(updates ?? {}).filter(([name, value]) => PLATFORM_WORKER_SECRET_UPDATE_NAMES.includes(name) && typeof value === "string" && value !== ""));
 }
+async function reconcilePlatformInstallationResources(manifest, plan, secrets, zoneId, externalHyperdriveOriginHash, dependencies, now, writeRemoteInstallationCheckpoint, onManifestChange) {
+	for (const action of plan.actions.filter((entry) => entry.key !== "routing-kv" && entry.kind !== "zone" && entry.kind !== "worker")) {
+		const retainedManifest = retainReplacedInstallationResource(manifest, action, now());
+		if (retainedManifest !== manifest) {
+			manifest = retainedManifest;
+			onManifestChange(manifest);
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
+		if (action.action === "adopt") {
+			if (!action.id) throw new Error(`platform: Adopted ${action.kind} ${action.name} has no id.`);
+			manifest = recordAdoptionIntent(manifest, action, action.id, now());
+			onManifestChange(manifest);
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
+			onManifestChange(manifest);
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			continue;
+		}
+		if (action.action === "reuse") {
+			if (action.id && (action.kind === "hyperdrive" || !manifest.resources.some((resource) => resource.key === action.key))) {
+				manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
+				onManifestChange(manifest);
+				writeInstallationManifest(manifest);
+				await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
+				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			}
+			continue;
+		}
+		manifest = recordProvisionIntent(manifest, action, now());
+		onManifestChange(manifest);
+		writeInstallationManifest(manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		const resource = await createResource(dependencies.client, plan, action, secrets.databaseUrl, zoneId);
+		manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : resource.fingerprint);
+		onManifestChange(manifest);
+		writeInstallationManifest(manifest);
+		await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+	}
+	return manifest;
+}
+async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, secrets, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, onManifestChange) {
+	dependencies.onProgress?.("Checking the platform database schema");
+	const rollbackDatabase = dependencies.databaseRollbackSource;
+	const migrationStep = `database-schema:${runtime.database.schemaDigest}`;
+	if (rollbackDatabase) {
+		const verifyDatabase = releaseDatabaseLock.verifyDatabase;
+		if (!verifyDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify the forward-only rollback schema.");
+		await verifyDatabase(rollbackDatabase.directory, rollbackDatabase.manifest.database);
+		manifest = {
+			...manifest,
+			databaseSchemaDigest: rollbackDatabase.manifest.database.schemaDigest,
+			updatedAt: now()
+		};
+		onManifestChange(manifest);
+		writeInstallationManifest(manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+	} else if (!manifest.steps.some((step) => step.key === migrationStep)) {
+		dependencies.onProgress?.("Applying platform database migrations");
+		const legacyMigrationStep = `database-migrations:${runtime.database.journalSha256}`;
+		if (dependencies.migrateDatabase) {
+			if (!manifest.steps.some((step) => step.key === legacyMigrationStep)) await dependencies.migrateDatabase(secrets.databaseUrl, join(runtimeDirectory, "drizzle"));
+		} else {
+			const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
+			if (!prepareDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.");
+			await prepareDatabase(runtimeDirectory, runtime.database, sourcePlatformVersion, hadPriorWorkers);
+		}
+		manifest = recordInstallationStep(manifest, {
+			completedAt: now(),
+			key: migrationStep,
+			resultHash: runtime.database.schemaDigest
+		}, now());
+		manifest = {
+			...manifest,
+			databaseSchemaDigest: runtime.database.schemaDigest,
+			updatedAt: now()
+		};
+		onManifestChange(manifest);
+		writeInstallationManifest(manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+	} else if (releaseDatabaseLock.verifyDatabase) {
+		await releaseDatabaseLock.verifyDatabase(runtimeDirectory, runtime.database);
+		if (manifest.databaseSchemaDigest !== runtime.database.schemaDigest) {
+			manifest = {
+				...manifest,
+				databaseSchemaDigest: runtime.database.schemaDigest,
+				updatedAt: now()
+			};
+			onManifestChange(manifest);
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
+	}
+	return manifest;
+}
+async function recoverInterruptedPlatformWorkerCutover(manifest, interruptedCutover, workerActions, configs, previousConfigs, plan, dependencies, ids, zoneId, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, onManifestChange) {
+	if (interruptedCutover) {
+		for (const key of [...interruptedCutover.staged.keys()].reverse()) {
+			const snapshot = interruptedCutover.staged.get(key);
+			const preservedRoutes = dependencies.recoverWorkerCutover ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, snapshot.workerName);
+			const recoveryConfig = mergePlatformWorkerTrafficConfig({
+				...configs[key],
+				name: snapshot.workerName
+			}, preservedRoutes);
+			const previousRecoveryConfig = mergePlatformWorkerTrafficConfig({
+				...previousConfigs[key],
+				name: snapshot.workerName
+			}, preservedRoutes);
+			if (dependencies.recoverWorkerCutover) await dependencies.recoverWorkerCutover({
+				key,
+				preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
+				previousVersionId: snapshot.previousVersionId,
+				stagedVersionId: snapshot.stagedVersionId,
+				workerName: snapshot.workerName
+			});
+			else {
+				const recoveryTraffic = isolatePlatformWorkerCustomDomains(recoveryConfig);
+				const previousRecoveryTraffic = isolatePlatformWorkerCustomDomains(previousRecoveryConfig);
+				await rollbackPlatformWorker({
+					accountId: plan.account.id,
+					activatedDeploymentId: null,
+					activatedVersionId: snapshot.stagedVersionId,
+					config: recoveryConfig,
+					nextTriggers: readTriggerConfigFromObject(recoveryTraffic.wranglerConfig),
+					previousConfig: previousRecoveryConfig,
+					previousCustomDomains: previousRecoveryTraffic.customDomains,
+					previousDeployment: null,
+					previousTriggers: mergePreservedTriggerRoutes(withoutPlatformCustomDomainTriggers(snapshot.previousTriggers), preservedRoutes),
+					previousVersionId: snapshot.previousVersionId,
+					preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
+					inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`, snapshot.workerName),
+					removeCustomDomains: async () => {
+						if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
+						await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([snapshot.workerName])));
+					},
+					publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
+					retainNewWorker: async () => {
+						await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+					},
+					runner: runPinnedPlatformWrangler,
+					workerExisted: snapshot.previousVersionId !== null,
+					workerName: snapshot.workerName
+				});
+			}
+		}
+		manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "restored", now());
+		manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0, now());
+		let retainedNewWorker = false;
+		for (const [, snapshot] of interruptedCutover.staged) {
+			if (snapshot.previousVersionId !== null) continue;
+			retainedNewWorker = true;
+		}
+		onManifestChange(manifest);
+		writeInstallationManifest(manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		if (retainedNewWorker) {
+			if (!dependencies.replanWorkers) throw new Error("platform: Recovering retained Workers requires a fresh Cloudflare installation plan.");
+			workerActions = validateReplannedWorkerActions(plan, manifest, await dependencies.replanWorkers(manifest)).filter((action) => hasEmailGatewayArtifact || action.key !== "email-gateway-worker");
+		}
+	}
+	return {
+		manifest,
+		workerActions
+	};
+}
+async function recoverFailedPlatformInstallation(error, manifest, plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, now, writeRemoteInstallationCheckpoint) {
+	let failure = error;
+	const currentWorkerRecoveryIncomplete = error instanceof PlatformWorkerRecoveryIncompleteError;
+	if (workerTrafficGuarded) try {
+		await dependencies.client.putKvValue(plan.account.id, requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+	} catch (guardError) {
+		failure = new Error(`platform: ${errorMessage(error)} The installation also failed to retain its routing safety gate: ${errorMessage(guardError)}`, { cause: error });
+	}
+	if (!workerDeploymentCommitted && workerRollbacks.length > 0 && !(authenticationEnforcementActive && authenticationProtocolTransition)) {
+		const rollbackFailures = [];
+		for (const rollback of workerRollbacks.reverse()) try {
+			await rollback();
+		} catch (rollbackError) {
+			rollbackFailures.push(errorMessage(rollbackError));
+		}
+		workerRollbacks = [];
+		if (rollbackFailures.length > 0 || currentWorkerRecoveryIncomplete) failure = new Error(rollbackFailures.length > 0 ? `platform: ${errorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join("; ")} Inspect the installation before retrying.` : `platform: ${errorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`, { cause: error });
+		else if (workerCutoverGeneration > 0) {
+			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "restored", now());
+			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, previousPublicEndpoints, now());
+			writeInstallationManifest(manifest);
+		}
+	} else if (authenticationEnforcementActive && authenticationProtocolTransition) workerRollbacks = [];
+	if (manifest.status !== "failed" && manifest.status !== "uninstalled") try {
+		manifest = transitionInstallation(manifest, "failed", now());
+		writeInstallationManifest(manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+	} catch {}
+	return failure;
+}
 async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
@@ -2457,8 +2657,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
 	let externalHyperdriveOriginHash;
 	if (hyperdriveAction && (hyperdriveAction.action === "adopt" || recordedHyperdrive?.ownership === "adopted")) {
-		if (!hyperdriveAction.id) throw new Error("platform: The Terraform-managed Hyperdrive has no ID.");
-		if (!plan.externalHyperdrive && !recordedHyperdrive) throw new Error("platform: The Terraform-managed Hyperdrive origin must be specified.");
+		if (!hyperdriveAction.id) throw new Error("platform: The externally managed Hyperdrive has no ID.");
+		if (!plan.externalHyperdrive && !recordedHyperdrive) throw new Error("platform: The externally managed Hyperdrive origin must be specified.");
 		const live = await dependencies.client.getHyperdriveConfig(plan.account.id, hyperdriveAction.id);
 		externalHyperdriveOriginHash = verifyExternalPlatformHyperdrive({
 			config: live,
@@ -2747,93 +2947,16 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			}
 		}
 		const zoneId = zone?.id ?? "";
-		for (const action of plan.actions.filter((entry) => entry.key !== "routing-kv" && entry.kind !== "zone" && entry.kind !== "worker")) {
-			const retainedManifest = retainReplacedInstallationResource(manifest, action, now());
-			if (retainedManifest !== manifest) {
-				manifest = retainedManifest;
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			}
-			if (action.action === "adopt") {
-				if (!action.id) throw new Error(`platform: Adopted ${action.kind} ${action.name} has no id.`);
-				manifest = recordAdoptionIntent(manifest, action, action.id, now());
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-				manifest = recordResource(manifest, action, action.id, "adopted", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-				continue;
-			}
-			if (action.action === "reuse") {
-				if (action.id && (action.kind === "hyperdrive" || !manifest.resources.some((resource) => resource.key === action.key))) {
-					manifest = recordResource(manifest, action, action.id, void 0, now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : void 0);
-					writeInstallationManifest(manifest);
-					await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-				}
-				continue;
-			}
-			manifest = recordProvisionIntent(manifest, action, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			const resource = await createResource(dependencies.client, plan, action, secrets.databaseUrl, zoneId);
-			manifest = recordResource(manifest, action, resource.id, "created", now(), secrets.databaseUrl, action.kind === "hyperdrive" ? externalHyperdriveOriginHash : resource.fingerprint);
-			writeInstallationManifest(manifest);
-			await writeR2OwnershipMarkerIfNeeded(dependencies.client, plan, manifest, action);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-		}
+		manifest = await reconcilePlatformInstallationResources(manifest, plan, secrets, zoneId, externalHyperdriveOriginHash, dependencies, now, writeRemoteInstallationCheckpoint, (next) => {
+			manifest = next;
+		});
 		dependencies.onProgress?.("Verifying uncached authentication database reads");
 		const authenticationDatabase = manifest.resources.find((resource) => resource.key === "hyperdrive");
 		if (!authenticationDatabase) throw new Error("platform: The authentication database resource is missing.");
 		await verifyPlatformAuthenticationDatabase(dependencies.client, plan.account.id, authenticationDatabase, secrets.databaseUrl);
-		dependencies.onProgress?.("Checking the platform database schema");
-		const rollbackDatabase = dependencies.databaseRollbackSource;
-		const migrationStep = `database-schema:${runtime.database.schemaDigest}`;
-		if (rollbackDatabase) {
-			const verifyDatabase = releaseDatabaseLock.verifyDatabase;
-			if (!verifyDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify the forward-only rollback schema.");
-			await verifyDatabase(rollbackDatabase.directory, rollbackDatabase.manifest.database);
-			manifest = {
-				...manifest,
-				databaseSchemaDigest: rollbackDatabase.manifest.database.schemaDigest,
-				updatedAt: now()
-			};
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-		} else if (!manifest.steps.some((step) => step.key === migrationStep)) {
-			dependencies.onProgress?.("Applying platform database migrations");
-			const legacyMigrationStep = `database-migrations:${runtime.database.journalSha256}`;
-			if (dependencies.migrateDatabase) {
-				if (!manifest.steps.some((step) => step.key === legacyMigrationStep)) await dependencies.migrateDatabase(secrets.databaseUrl, join(runtimeDirectory, "drizzle"));
-			} else {
-				const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
-				if (!prepareDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.");
-				await prepareDatabase(runtimeDirectory, runtime.database, sourcePlatformVersion, hadPriorWorkers);
-			}
-			manifest = recordInstallationStep(manifest, {
-				completedAt: now(),
-				key: migrationStep,
-				resultHash: runtime.database.schemaDigest
-			}, now());
-			manifest = {
-				...manifest,
-				databaseSchemaDigest: runtime.database.schemaDigest,
-				updatedAt: now()
-			};
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-		} else if (releaseDatabaseLock.verifyDatabase) {
-			await releaseDatabaseLock.verifyDatabase(runtimeDirectory, runtime.database);
-			if (manifest.databaseSchemaDigest !== runtime.database.schemaDigest) {
-				manifest = {
-					...manifest,
-					databaseSchemaDigest: runtime.database.schemaDigest,
-					updatedAt: now()
-				};
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			}
-		}
+		manifest = await preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, secrets, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, (next) => {
+			manifest = next;
+		});
 		dependencies.onProgress?.("Checking platform safety");
 		const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
 		const prepareSandboxDrain = dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
@@ -2937,69 +3060,9 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		});
 		const managedRoutes = platformManagedWorkerTraffic(plan.deployment).routes;
 		let workerActions = plan.actions.filter((action) => action.kind === "worker" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
-		if (interruptedCutover) {
-			for (const key of [...interruptedCutover.staged.keys()].reverse()) {
-				const snapshot = interruptedCutover.staged.get(key);
-				const preservedRoutes = dependencies.recoverWorkerCutover ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, snapshot.workerName);
-				const recoveryConfig = mergePlatformWorkerTrafficConfig({
-					...configs[key],
-					name: snapshot.workerName
-				}, preservedRoutes);
-				const previousRecoveryConfig = mergePlatformWorkerTrafficConfig({
-					...previousConfigs[key],
-					name: snapshot.workerName
-				}, preservedRoutes);
-				if (dependencies.recoverWorkerCutover) await dependencies.recoverWorkerCutover({
-					key,
-					preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
-					previousVersionId: snapshot.previousVersionId,
-					stagedVersionId: snapshot.stagedVersionId,
-					workerName: snapshot.workerName
-				});
-				else {
-					const recoveryTraffic = isolatePlatformWorkerCustomDomains(recoveryConfig);
-					const previousRecoveryTraffic = isolatePlatformWorkerCustomDomains(previousRecoveryConfig);
-					await rollbackPlatformWorker({
-						accountId: plan.account.id,
-						activatedDeploymentId: null,
-						activatedVersionId: snapshot.stagedVersionId,
-						config: recoveryConfig,
-						nextTriggers: readTriggerConfigFromObject(recoveryTraffic.wranglerConfig),
-						previousConfig: previousRecoveryConfig,
-						previousCustomDomains: previousRecoveryTraffic.customDomains,
-						previousDeployment: null,
-						previousTriggers: mergePreservedTriggerRoutes(withoutPlatformCustomDomainTriggers(snapshot.previousTriggers), preservedRoutes),
-						previousVersionId: snapshot.previousVersionId,
-						preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
-						inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`, snapshot.workerName),
-						removeCustomDomains: async () => {
-							if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
-							await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([snapshot.workerName])));
-						},
-						publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
-						retainNewWorker: async () => {
-							await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-						},
-						runner: runPinnedPlatformWrangler,
-						workerExisted: snapshot.previousVersionId !== null,
-						workerName: snapshot.workerName
-					});
-				}
-			}
-			manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "restored", now());
-			manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0, now());
-			let retainedNewWorker = false;
-			for (const [, snapshot] of interruptedCutover.staged) {
-				if (snapshot.previousVersionId !== null) continue;
-				retainedNewWorker = true;
-			}
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			if (retainedNewWorker) {
-				if (!dependencies.replanWorkers) throw new Error("platform: Recovering retained Workers requires a fresh Cloudflare installation plan.");
-				workerActions = validateReplannedWorkerActions(plan, manifest, await dependencies.replanWorkers(manifest)).filter((action) => hasEmailGatewayArtifact || action.key !== "email-gateway-worker");
-			}
-		}
+		({manifest, workerActions} = await recoverInterruptedPlatformWorkerCutover(manifest, interruptedCutover, workerActions, configs, previousConfigs, plan, dependencies, ids, zoneId, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, (next) => {
+			manifest = next;
+		}));
 		workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
 		if (workerSecretUpdateIntent) {
 			manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "pending", workerSecretUpdateIntent.id, now());
@@ -3310,34 +3373,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			zoneNameServers: zone?.nameServers ?? []
 		};
 	} catch (error) {
-		let failure = error;
-		const currentWorkerRecoveryIncomplete = error instanceof PlatformWorkerRecoveryIncompleteError;
-		if (workerTrafficGuarded) try {
-			await dependencies.client.putKvValue(plan.account.id, requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-		} catch (guardError) {
-			failure = new Error(`platform: ${errorMessage(error)} The installation also failed to retain its routing safety gate: ${errorMessage(guardError)}`, { cause: error });
-		}
-		if (!workerDeploymentCommitted && workerRollbacks.length > 0 && !(authenticationEnforcementActive && authenticationProtocolTransition)) {
-			const rollbackFailures = [];
-			for (const rollback of workerRollbacks.reverse()) try {
-				await rollback();
-			} catch (rollbackError) {
-				rollbackFailures.push(errorMessage(rollbackError));
-			}
-			workerRollbacks = [];
-			if (rollbackFailures.length > 0 || currentWorkerRecoveryIncomplete) failure = new Error(rollbackFailures.length > 0 ? `platform: ${errorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join("; ")} Inspect the installation before retrying.` : `platform: ${errorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`, { cause: error });
-			else if (workerCutoverGeneration > 0) {
-				manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "restored", now());
-				manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, previousPublicEndpoints, now());
-				writeInstallationManifest(manifest);
-			}
-		} else if (authenticationEnforcementActive && authenticationProtocolTransition) workerRollbacks = [];
-		if (manifest.status !== "failed" && manifest.status !== "uninstalled") try {
-			manifest = transitionInstallation(manifest, "failed", now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-		} catch {}
-		throw failure;
+		throw await recoverFailedPlatformInstallation(error, manifest, plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, now, writeRemoteInstallationCheckpoint);
 	} finally {
 		await releaseDatabaseLock();
 	}
@@ -5532,14 +5568,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-Ckpd2kXw.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-j9YCXRm6.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-D_KmvdSk.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-Do8VOyDE.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5549,7 +5585,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-44Bxd3YC.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-DzKNsMlt.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -5709,48 +5745,60 @@ async function runPlatformLifecycleCommand(args) {
 			user: externalHyperdriveUser
 		} : void 0;
 		if (!externalHyperdrive && process.stdin.isTTY && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
-			const expectedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
-			const matches = (await client.listHyperdriveConfigs(accountId)).filter((resource) => resource.name === expectedName);
-			if (matches.length > 1) throw new Error(`platform: More than one Hyperdrive named ${expectedName} exists.`);
-			const live = matches[0] ? await client.getHyperdriveConfig(accountId, matches[0].id) : null;
-			if (live) {
-				if (live.id !== matches[0].id || live.name !== expectedName || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${expectedName}.`);
-				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${expectedName}`);
-				const choice = await select({
-					message: "How should Void set up Hyperdrive?",
-					options: [{
+			const suggestedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
+			const configurations = await client.listHyperdriveConfigs(accountId);
+			const suggestedNameAvailable = !configurations.some((resource) => resource.name === suggestedName);
+			const choice = await select({
+				message: "How should Void set up Hyperdrive?",
+				options: [
+					...configurations.length > 0 ? [{
 						value: "existing",
-						label: `Use existing Hyperdrive ${expectedName}`
-					}, {
-						value: "cancel",
-						label: "Cancel installation"
-					}]
+						label: "Use an existing Hyperdrive"
+					}] : [],
+					...suggestedNameAvailable ? [{
+						value: "create",
+						label: "Let Void create Hyperdrive",
+						hint: "recommended"
+					}] : [],
+					{
+						value: "setup",
+						label: "Set up a separately managed Hyperdrive"
+					}
+				]
+			});
+			if (isCancel(choice)) throw new Error("platform: Cancelled.");
+			if (choice === "setup") {
+				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` (for example ${suggestedName})` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+				outro("No Cloudflare or local installation state was changed.");
+				return;
+			}
+			if (choice === "existing") {
+				const selectedId = await select({
+					message: "Which Hyperdrive should Void use?",
+					options: [...configurations].sort((a, b) => Number(b.name === suggestedName) - Number(a.name === suggestedName) || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)).map((resource) => ({
+						value: resource.id,
+						label: resource.name,
+						hint: resource.name === suggestedName ? `suggested · ${resource.id}` : resource.id
+					}))
 				});
-				if (isCancel(choice) || choice === "cancel") throw new Error("platform: Cancelled.");
-				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${expectedName} before installing.`);
+				if (isCancel(selectedId)) throw new Error("platform: Cancelled.");
+				const selected = configurations.find((resource) => resource.id === selectedId);
+				if (!selected) throw new Error("platform: The selected Hyperdrive is no longer available.");
+				const live = await client.getHyperdriveConfig(accountId, selected.id);
+				if (live.id !== selected.id || live.name !== selected.name || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${selected.name}.`);
+				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${live.name}`);
+				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${live.name} before installing.`);
+				const confirmed = await confirm({
+					message: `Use ${live.name} for this platform?`,
+					initialValue: true
+				});
+				if (isCancel(confirmed) || !confirmed) throw new Error("platform: Cancelled.");
 				externalHyperdrive = {
 					id: live.id,
+					name: live.name,
 					host: live.origin.host,
 					user: live.origin.user
 				};
-			} else {
-				const choice = await select({
-					message: "How should Void set up Hyperdrive?",
-					options: [{
-						value: "create",
-						label: "Let Void create Hyperdrive",
-						hint: "recommended"
-					}, {
-						value: "existing",
-						label: "Use a separately managed Hyperdrive"
-					}]
-				});
-				if (isCancel(choice)) throw new Error("platform: Cancelled.");
-				if (choice === "existing") {
-					note(`Create a Hyperdrive in account ${accountId} named ${expectedName}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
-					outro("No Cloudflare or local installation state was changed.");
-					return;
-				}
 			}
 		}
 		let authoritativeProvisionIntents = false;
@@ -5761,7 +5809,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-44Bxd3YC.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DzKNsMlt.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -5990,7 +6038,7 @@ async function runPlatformLifecycleCommand(args) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-44Bxd3YC.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DzKNsMlt.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;

package/dist/{platform-lifecycle-DlpiGcjr.mjs → platform-lifecycle-DDc9zCeJ.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-DVzM2T4j.mjs";
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-78H0XQUA.mjs";
 export { runPlatformLifecycleCommand };