void 0.21.9 → 0.22.0

package/dist/{platform-lifecycle-Bc047IeT.mjs → platform-lifecycle-k0E0xoxx.mjs}

@@ -1,20 +1,21 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-CCH48AMM.mjs";
+import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
 import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
 import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
 import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
-import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-Dn6nn2IU.mjs";
+import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-CTBk70IR.mjs";
 import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
-import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-C4_GPZr0.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BhreDAOS.mjs";
+import { s as runCloudflareAuthCommand } from "./cloudflare-auth-DQkqoMYa.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-C4IGqkBf.mjs";
+import { c as import_picocolors$1, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { readFile } from "node:fs/promises";
@@ -652,7 +653,7 @@ function parsePostgresConnectionString(value) {
 	let mtls;
 	if (sslmode) {
 		if (sslmode !== "require" && sslmode !== "verify-ca" && sslmode !== "verify-full") throw new Error("platform: Unsupported sslmode. Cloudflare Hyperdrive supports \"require\", \"verify-ca\", or \"verify-full\".");
-		mtls = { sslmode };
+		mtls = { sslmode: "require" };
 	}
 	return {
 		database,
@@ -756,6 +757,11 @@ var PlatformAccessClient = class {
 		throw new Error("platform: Access inventory exceeded the supported pagination limit.");
 	}
 };
+/**
+* Project Zero Trust keeps its own, broader copy of this list in
+* platform/packages/api/src/zero-trust/cloudflare.ts; review both when adding
+* a rule type.
+*/
 function identityRule(rule) {
 	if (rule.email_domain) {
 		const domain = object(rule.email_domain, "email domain").domain;
@@ -1411,7 +1417,6 @@ async function resolvePlatformCloudflareCredentialWithInput(readInput, dependenc
 			input,
 			credential: result.credential
 		};
-		announceCloudflareLogin();
 		const login = await runWrangler(["login"], false);
 		assertNotCancelled();
 		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
@@ -1500,7 +1505,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DeE3yr2R.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-7d5aV2Jg.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1831,6 +1836,18 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	};
 }
 async function revalidatePlatformInstallAction(client, original, manifest, action, options) {
+	if (options?.stableWorkerUpdate && !options.repairMissing && action.kind === "worker" && action.action === "update" && original.actions.some((entry) => entry.key === action.key && entry.kind === action.kind && entry.action === action.action && entry.id === action.id && entry.name === action.name) && original.actions.every((entry) => {
+		const resource = manifest.resources.find((candidate) => candidate.key === entry.key);
+		return (entry.kind === "worker" ? entry.action === "update" : entry.action === "reuse") && resource?.kind === entry.kind && resource.state === "ready" && resource.id === entry.id && resource.name === entry.name;
+	})) {
+		const recorded = manifest.resources.find((resource) => resource.key === action.key);
+		if (!recorded || recorded.kind !== "worker" || recorded.state !== "ready" || recorded.id !== action.name || recorded.name !== action.name) throw new Error(`platform: Worker ${JSON.stringify(action.name)} no longer matches the approved installation plan. Review a new plan before retrying.`);
+		if (!matchesResourceMarker((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, action.key, "worker", {
+			id: action.name,
+			name: action.name
+		})) throw new Error(`platform: Cloudflare Worker ${JSON.stringify(action.name)} no longer has this installation's ownership marker. Review a new plan before retrying.`);
+		return;
+	}
 	const deployment = original.deployment;
 	const current = (await createPlatformInstallPlan(client, {
 		accountId: original.account.id,
@@ -2216,6 +2233,284 @@ function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt)
 	return next;
 }
 //#endregion
+//#region src/cli/platform-trigger-proof.ts
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function sameStrings(actual, expected) {
+	const sortedExpected = [...expected].sort();
+	return actual.length === expected.length && [...actual].sort().every((value, index) => value === sortedExpected[index]);
+}
+function desiredQueue(value) {
+	const queue = record(value);
+	if (!queue || typeof queue.queue !== "string" || Object.keys(queue).some((key) => ![
+		"queue",
+		"max_batch_size",
+		"max_batch_timeout",
+		"max_retries",
+		"max_concurrency",
+		"retry_delay",
+		"dead_letter_queue"
+	].includes(key)) || [
+		"max_batch_size",
+		"max_batch_timeout",
+		"max_retries",
+		"max_concurrency",
+		"retry_delay"
+	].some((key) => queue[key] !== void 0 && typeof queue[key] !== "number") || queue.dead_letter_queue !== void 0 && typeof queue.dead_letter_queue !== "string") return null;
+	return queue;
+}
+function matchesQueueConsumer(liveValue, desired, workerName) {
+	const live = record(liveValue);
+	const settings = record(live?.settings);
+	if (!live || live.type !== "worker" || live.script_name !== void 0 && live.script_name !== workerName || live.queue_name !== desired.queue || !settings) return false;
+	const expected = {
+		batch_size: desired.max_batch_size ?? 10,
+		max_wait_time_ms: Number(desired.max_batch_timeout ?? 5) * 1e3,
+		max_retries: desired.max_retries ?? 3,
+		max_concurrency: desired.max_concurrency ?? null,
+		retry_delay: desired.retry_delay ?? 0
+	};
+	return Object.entries(expected).every(([key, value]) => key === "max_concurrency" ? (settings[key] ?? null) === value : settings[key] === value) && (live.dead_letter_queue ?? "") === (desired.dead_letter_queue ?? "");
+}
+/**
+* Read every surface that `triggers deploy` can mutate for a platform Worker. An incomplete
+* response, unsupported trigger kind, or read failure requires normal trigger publication.
+*/
+async function platformWorkerLiveTriggersMatch(options) {
+	const { accountId, workerName, desired, readCloudflare } = options;
+	if (desired.preserve || desired.addresses !== void 0 || desired.workflows.length > 0 || !desired.crons.every((cron) => typeof cron === "string")) return false;
+	const queues = desired.queueConsumers.map(desiredQueue);
+	if (queues.some((queue) => queue === null)) return false;
+	const base = `/accounts/${encodeURIComponent(accountId)}`;
+	const script = `${base}/workers/scripts/${encodeURIComponent(workerName)}`;
+	try {
+		const [workerValue, schedulesValue, workflowsValue, nextWorkflowsValue] = await Promise.all([
+			readCloudflare(`${base}/workers/workers/${encodeURIComponent(workerName)}`),
+			readCloudflare(`${script}/schedules`),
+			readCloudflare(`${base}/workflows?page=1&per_page=100`),
+			readCloudflare(`${base}/workflows?page=2&per_page=100`)
+		]);
+		const worker = record(workerValue);
+		const subdomain = record(worker?.subdomain);
+		const schedules = record(schedulesValue)?.schedules;
+		if (worker?.name !== workerName || !subdomain || !desired.preserveWorkersDev && subdomain.enabled !== desired.workers_dev || !desired.preservePreviewUrls && subdomain.previews_enabled !== desired.preview_urls || !Array.isArray(schedules) || !Array.isArray(worker.references && record(worker.references)?.queues) || !Array.isArray(workflowsValue) || workflowsValue.length >= 100 || !Array.isArray(nextWorkflowsValue) || nextWorkflowsValue.length !== 0) return false;
+		const liveCrons = schedules.map((entry) => record(entry)?.cron);
+		if (!liveCrons.every((cron) => typeof cron === "string") || !sameStrings(liveCrons, desired.crons) || workflowsValue.some((entry) => {
+			const workflow = record(entry);
+			return !workflow || typeof workflow.script_name !== "string" || workflow.script_name === workerName;
+		})) return false;
+		const references = record(worker.references).queues;
+		if (references.length !== queues.length) return false;
+		const matched = /* @__PURE__ */ new Set();
+		const consumers = await Promise.all(references.map(async (value) => {
+			const reference = record(value);
+			if (typeof reference?.queue_id !== "string" || typeof reference.queue_consumer_id !== "string" || typeof reference.queue_name !== "string") return null;
+			return {
+				queueName: reference.queue_name,
+				consumer: await readCloudflare(`${base}/queues/${encodeURIComponent(reference.queue_id)}/consumers/${encodeURIComponent(reference.queue_consumer_id)}`)
+			};
+		}));
+		for (const entry of consumers) {
+			if (!entry || matched.has(entry.queueName)) return false;
+			const desiredQueueConfig = queues.find((queue) => queue?.queue === entry.queueName);
+			if (!desiredQueueConfig || !matchesQueueConsumer(entry.consumer, desiredQueueConfig, workerName)) return false;
+			matched.add(entry.queueName);
+		}
+		return matched.size === queues.length;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/cli/platform-zero-trust-uninstall.ts
+/**
+* Uninstall turns off the platform API, and only that API can remove the
+* Cloudflare Access applications project Zero Trust created. The shared
+* project application covers every hostname under the application domain, so
+* a left-over one keeps asking for sign-in on hosts Void no longer serves.
+* Uninstall therefore reads the saved Zero Trust state straight from
+* PostgreSQL, which works whether or not the API still answers, and refuses
+* while anything remains to clean up or the state cannot be read.
+*/
+const ZERO_TRUST_SETTING = "zeroTrust.configuration";
+const ZERO_TRUST_LOCK = "hashtext('zero-trust:configuration')";
+const UNINSTALL_SETTING = "platform.uninstall";
+const LISTED_APPLICATIONS = 20;
+function isRecord(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function optionalText(value, label) {
+	if (value === null || value === void 0) return null;
+	if (typeof value !== "string") throw new Error(`the saved ${label} is malformed`);
+	return value;
+}
+function savedApplication(value, label) {
+	if (value === null || value === void 0) return null;
+	if (!isRecord(value) || typeof value.id !== "string" || typeof value.name !== "string") throw new Error(`the saved ${label} is malformed`);
+	const destinations = Array.isArray(value.destinations) ? value.destinations.filter((entry) => typeof entry === "string") : [];
+	return {
+		id: value.id,
+		name: value.name,
+		destinations
+	};
+}
+/**
+* Interpret the saved configuration and project rows. Anything that does not
+* have the expected shape throws, so the caller refuses instead of guessing.
+*/
+function projectZeroTrustUninstallState(setting, projectRows) {
+	const applications = [];
+	let active = false;
+	let destinations = [];
+	if (setting !== null && setting !== void 0) {
+		if (!isRecord(setting) || typeof setting.enabled !== "boolean") throw new Error("the saved Zero Trust configuration is malformed");
+		const operation = setting.operation ?? null;
+		if (operation !== null && !isRecord(operation)) throw new Error("the saved Zero Trust operation is malformed");
+		active = setting.enabled || operation !== null;
+		const wildcard = savedApplication(setting.wildcardApplication, "shared project application");
+		const health = savedApplication(setting.healthApplication, "health check exception");
+		const wildcardName = optionalText(setting.wildcardApplicationName, "application name");
+		const healthName = optionalText(setting.healthApplicationName, "application name");
+		if (wildcard || active && wildcardName) applications.push({
+			role: "shared project application",
+			id: wildcard?.id ?? null,
+			name: wildcard?.name ?? wildcardName
+		});
+		if (health || active && healthName) applications.push({
+			role: "health check exception",
+			id: health?.id ?? null,
+			name: health?.name ?? healthName
+		});
+		destinations = wildcard?.destinations ?? [];
+	}
+	const unfinishedDeletions = [];
+	for (const row of projectRows) {
+		const deleting = row.project_status === "deleting";
+		const owned = applications.length;
+		if (row.bypass_application_id || row.bypass_application_name) applications.push({
+			role: `public exception for ${row.project_id}`,
+			id: row.bypass_application_id,
+			name: row.bypass_application_name,
+			...deleting ? { deleting } : {}
+		});
+		if (row.protected_application_id || row.protected_application_name) applications.push({
+			role: `custom domain application for ${row.project_id}`,
+			id: row.protected_application_id,
+			name: row.protected_application_name,
+			...deleting ? { deleting } : {}
+		});
+		if (deleting && applications.length > owned) unfinishedDeletions.push(row.project_slug ?? row.project_id);
+	}
+	return {
+		active,
+		destinations,
+		applications,
+		unfinishedDeletions
+	};
+}
+/** Read the project Zero Trust state from the platform database. */
+async function readPlatformProjectZeroTrustStateConnection(client) {
+	const present = (await client.query(`SELECT to_regclass('public.platform_settings') IS NOT NULL AS "settings",
+            to_regclass('public.project_zero_trust') IS NOT NULL AS "projects"`)).rows[0];
+	if (!present) throw new Error("the database did not report its Zero Trust tables");
+	return projectZeroTrustUninstallState(present.settings ? (await client.query("SELECT \"value\" FROM \"platform_settings\" WHERE \"key\" = $1", [ZERO_TRUST_SETTING])).rows[0]?.value : void 0, present.projects ? (await client.query(`SELECT z."project_id", p."slug" AS "project_slug", p."status" AS "project_status",
+                  z."bypass_application_id", z."bypass_application_name",
+                  z."protected_application_id", z."protected_application_name"
+           FROM "project_zero_trust" z
+           LEFT JOIN "projects" p ON p."id" = z."project_id"
+           WHERE z."bypass_application_id" IS NOT NULL
+              OR z."bypass_application_name" IS NOT NULL
+              OR z."protected_application_id" IS NOT NULL
+              OR z."protected_application_name" IS NOT NULL
+           ORDER BY z."project_id"`)).rows : []);
+}
+/**
+* Take the Zero Trust configuration lock exclusively on this session. Every
+* API path that records or creates a Void-managed Access application holds
+* the same lock, so none can commit until the returned release runs.
+*/
+async function lockPlatformProjectZeroTrustConnection(client) {
+	await client.query(`SELECT pg_advisory_lock(${ZERO_TRUST_LOCK})`);
+	let released = false;
+	return async () => {
+		if (released) return;
+		released = true;
+		await client.query(`SELECT pg_advisory_unlock(${ZERO_TRUST_LOCK})`);
+	};
+}
+async function hasSettingsTable(client) {
+	return (await client.query(`SELECT to_regclass('public.platform_settings') IS NOT NULL AS "present"`)).rows[0]?.present === true;
+}
+/**
+* Record that uninstall passed its final check. Runs while the configuration
+* lock is held. An API request admitted before traffic was disabled may be
+* waiting on that lock; once it gets the lock it reads this record and
+* refuses. Without the settings table the API has no Zero Trust writers.
+*/
+async function fencePlatformProjectZeroTrustConnection(client) {
+	if (!await hasSettingsTable(client)) return;
+	await client.query(`INSERT INTO "platform_settings" ("key", "value") VALUES ($1, $2::jsonb)
+     ON CONFLICT ("key") DO UPDATE SET "value" = EXCLUDED."value", "updated_at" = now()`, [UNINSTALL_SETTING, JSON.stringify({ startedAt: (/* @__PURE__ */ new Date()).toISOString() })]);
+}
+/**
+* Remove the uninstall record. Uninstall does this when it stops before
+* disabling traffic; installing or enabling does it before traffic opens.
+*/
+async function liftPlatformProjectZeroTrustFenceConnection(client) {
+	if (!await hasSettingsTable(client)) return;
+	await client.query("DELETE FROM \"platform_settings\" WHERE \"key\" = $1", [UNINSTALL_SETTING]);
+}
+function formatApplications(applications) {
+	const lines = applications.slice(0, LISTED_APPLICATIONS).map((application) => `  ${application.role}: ${application.name ?? "(name not recorded)"}${application.id ? ` (${application.id})` : ""}`);
+	if (applications.length > LISTED_APPLICATIONS) lines.push(`  …and ${applications.length - LISTED_APPLICATIONS} more`);
+	return lines.join("\n");
+}
+const DASHBOARD_HINT = "To lift sign-in right away, delete these applications in the Cloudflare dashboard under Zero Trust → Access → Applications.";
+function unfinishedDeletionLines(state) {
+	if (!state.unfinishedDeletions.length) return [];
+	return [`Deletion of ${state.unfinishedDeletions.length === 1 ? "project" : "projects"} ${state.unfinishedDeletions.join(", ")} stopped before it removed their Access applications. Rerun \`void project delete <name>\` for each, or delete it again from the admin dashboard. This removes their applications, including ones already deleted in the Cloudflare dashboard, and Void's records of them.`];
+}
+/**
+* Refuse to uninstall while project Zero Trust still owns Access applications,
+* or while its state cannot be read. Runs before uninstall changes anything.
+*/
+async function assertProjectZeroTrustAllowsUninstall(read) {
+	let state;
+	try {
+		if (!read) throw new Error("no platform database connection is available");
+		state = await read();
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
+		throw new Error([
+			`platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
+			"Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.",
+			"Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first."
+		].join("\n"));
+	}
+	if (state.active) {
+		const covered = state.destinations.length ? ` on ${state.destinations.join(" and ")}` : " on every hostname under the application domain";
+		throw new Error([
+			"platform: Refusing to uninstall while project Zero Trust is enabled or still changing.",
+			`Uninstall turns off the platform API, so Void could no longer remove its Cloudflare Access applications, and Access would keep asking for sign-in${covered}, including hostnames Void does not serve.`,
+			"Run `void platform zero-trust disable`, rerun it until `void platform zero-trust status` reports Zero Trust disabled with no operation running, then retry the uninstall.",
+			"If the platform API does not answer, bring it back with `void platform enable` or `void platform repair` first.",
+			...state.applications.length ? ["Void-managed Access applications:", formatApplications(state.applications)] : [],
+			...unfinishedDeletionLines(state),
+			DASHBOARD_HINT
+		].join("\n"));
+	}
+	if (state.applications.length) throw new Error([
+		"platform: Refusing to uninstall while Void-managed Access applications from project Zero Trust remain.",
+		"Zero Trust is disabled, but it could not remove the applications of some projects. Retry the uninstall once they are gone.",
+		"Void-managed Access applications:",
+		formatApplications(state.applications),
+		...state.applications.some((application) => !application.deleting) ? [`Hourly maintenance retries ${state.unfinishedDeletions.length ? "the other applications" : "them"} while the platform is enabled, and clears Void's records of any you delete in the dashboard.`] : [],
+		...unfinishedDeletionLines(state),
+		DASHBOARD_HINT
+	].join("\n"));
+}
+//#endregion
 //#region src/cli/platform-installer.ts
 const REMOTE_INSTALLATION_MANIFEST_KEY = PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY;
 const PLATFORM_WORKER_SECRET_UPDATE_NAMES = [
@@ -2530,7 +2825,13 @@ async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory
 }
 async function recoverInterruptedPlatformWorkerCutover(manifest, interruptedCutover, workerActions, configs, previousConfigs, plan, dependencies, ids, zoneId, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	if (interruptedCutover) {
-		for (const key of [...interruptedCutover.staged.keys()].reverse()) {
+		for (const key of [
+			"dispatch",
+			"tail",
+			"emailGateway",
+			"proxy",
+			"api"
+		].filter((key) => interruptedCutover.staged.has(key))) {
 			const snapshot = interruptedCutover.staged.get(key);
 			const preservedRoutes = dependencies.recoverWorkerCutover ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, snapshot.workerName);
 			const recoveryConfig = mergePlatformWorkerTrafficConfig({
@@ -2633,6 +2934,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
 	const runPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl);
+	const runParallelPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl, true);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
@@ -2724,6 +3026,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		writeInstallationManifest(manifest);
 	}
 	assertRequiredPlatformSecrets(plan, manifest, secrets, !!dependencies.prepareAuthentication);
+	if (hyperdriveAction?.action === "create") {
+		parsePostgresConnectionString(secrets.databaseUrl);
+		assertVoidCreatedHyperdriveTrustsDatabase(secrets.databaseUrl);
+	}
 	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
 	writePendingInstallationSecrets(manifest, {
 		...pendingSecrets,
@@ -3075,7 +3381,59 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			};
 			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
 		}
-		for (const key of workerKeys) {
+		const parallelWorkerUploads = !dependencies.deployWorker && !requiresStagedCommit && !workerSecretUpdateIntent && !recoveringUnsafeTraffic && workerActions.length === workerKeys.length && workerActions.every((action) => action.action === "update");
+		let workerManifestQueue = Promise.resolve();
+		let workerManifestFailed = false;
+		let workerManifestFailure;
+		const checkpointWorkerManifest = (update, safetyRecovery = false) => {
+			if (!parallelWorkerUploads) return update();
+			const result = workerManifestQueue.then(async () => {
+				if (workerManifestFailed && !safetyRecovery) throw workerManifestFailure;
+				try {
+					await update();
+				} catch (error) {
+					workerManifestFailed = true;
+					workerManifestFailure = error;
+					throw error;
+				}
+			});
+			workerManifestQueue = result.then(() => void 0, () => void 0);
+			return result;
+		};
+		let availableUploadSlots = 2;
+		let uploadFailure;
+		const uploadWaiters = [];
+		const acquireUploadSlot = async () => {
+			if (uploadFailure !== void 0) throw uploadFailure;
+			if (availableUploadSlots === 0) await new Promise((resolve, reject) => uploadWaiters.push({
+				resolve,
+				reject
+			}));
+			else availableUploadSlots--;
+			return (failure) => {
+				if (failure !== void 0 && uploadFailure === void 0) {
+					uploadFailure = failure;
+					for (const waiter of uploadWaiters.splice(0)) waiter.reject(failure);
+				}
+				const next = uploadFailure === void 0 ? uploadWaiters.shift() : void 0;
+				if (next) next.resolve();
+				else availableUploadSlots++;
+			};
+		};
+		const workerReady = (parallelWorkerUploads ? workerKeys : []).map(() => {
+			let resolve;
+			let reject;
+			return {
+				promise: new Promise((onResolve, onReject) => {
+					resolve = onResolve;
+					reject = onReject;
+				}),
+				resolve,
+				reject
+			};
+		});
+		const uploadBatch = Promise.all(workerReady.map((ready) => ready.promise)).then(() => ({ error: null }), (error) => ({ error }));
+		const deployOneWorker = async (key, waitForPriorWorker, onReadyForActivation) => {
 			dependencies.onProgress?.(`Deploying the ${key} service`);
 			let workerStepStarted = performance.now();
 			const markWorkerStep = (step) => {
@@ -3084,12 +3442,14 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			};
 			const action = workerActions.find((entry) => entry.key === (key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`));
 			const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
-			const intended = recordProvisionIntent(manifest, action, now());
-			if (intended !== manifest) {
-				manifest = intended;
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			}
+			await checkpointWorkerManifest(async () => {
+				const intended = recordProvisionIntent(manifest, action, now());
+				if (intended !== manifest) {
+					manifest = intended;
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				}
+			});
 			await dependencies.revalidateBeforeWorkerDeploy(manifest, action);
 			markWorkerStep("revalidate");
 			const preservedRoutes = dependencies.deployWorker ? [] : action.action === "create" ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
@@ -3098,29 +3458,40 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
 			const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
 				apiBaseUrl: cloudflareApiBaseUrl,
+				...parallelWorkerUploads ? {
+					acquireUploadSlot,
+					onReadyForActivation,
+					waitForPriorWorker
+				} : {},
 				...dependencies.client.request ? { readCloudflare: (path) => dependencies.client.request(path) } : {},
 				onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
-					manifest = recordWorkerCutoverStage(manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
-					writeInstallationManifest(manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					await checkpointWorkerManifest(async () => {
+						manifest = recordWorkerCutoverStage(manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					});
 				},
 				onTrafficPublished: async () => {
 					if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) throw new Error("platform: Cloudflare traffic inventory is unavailable.");
 					const [customDomains, routes] = await Promise.all([dependencies.client.listWorkerDomains(plan.account.id), zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
-					const next = recordPlatformWorkerTraffic(manifest, action.name, {
-						customDomains,
-						routes
-					}, now());
-					if (JSON.stringify(next.resources) !== JSON.stringify(manifest.resources)) {
-						manifest = next;
-						writeInstallationManifest(manifest);
-						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-					}
+					await checkpointWorkerManifest(async () => {
+						const next = recordPlatformWorkerTraffic(manifest, action.name, {
+							customDomains,
+							routes
+						}, now());
+						if (JSON.stringify(next.resources) !== JSON.stringify(manifest.resources)) {
+							manifest = next;
+							writeInstallationManifest(manifest);
+							await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+						}
+					});
 				},
 				onUnsafeTraffic: async () => {
-					manifest = recordWorkerUnsafeTraffic(manifest, workerCutoverGeneration, key, action.name, now());
-					writeInstallationManifest(manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					await checkpointWorkerManifest(async () => {
+						manifest = recordWorkerUnsafeTraffic(manifest, workerCutoverGeneration, key, action.name, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					}, true);
 				},
 				managedRoutes: preserveDisabled ? [] : managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
 				preservedRoutes,
@@ -3140,19 +3511,37 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				retainNewWorker: async () => {
 					await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 				},
-				runner: runPinnedPlatformWrangler,
+				runner: parallelWorkerUploads ? runParallelPinnedPlatformWrangler : runPinnedPlatformWrangler,
 				workerExisted: action.action !== "create"
 			});
 			markWorkerStep("deploy");
 			if (rollback) workerRollbacks.push(rollback);
-			const recorded = recordResource(manifest, action, action.name, "created", now());
-			if (rollback || dependencies.deployWorker || JSON.stringify(recorded.resources) !== JSON.stringify(manifest.resources)) {
-				manifest = recorded;
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			}
+			await checkpointWorkerManifest(async () => {
+				const recorded = recordResource(manifest, action, action.name, "created", now());
+				if (rollback || dependencies.deployWorker || JSON.stringify(recorded.resources) !== JSON.stringify(manifest.resources)) {
+					manifest = recorded;
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				}
+			});
 			markWorkerStep("record");
-		}
+		};
+		if (parallelWorkerUploads) {
+			const tasks = [];
+			for (const [index, key] of workerKeys.entries()) {
+				const priorWorker = tasks.at(-1);
+				const ready = workerReady[index];
+				const task = deployOneWorker(key, priorWorker ? () => priorWorker : void 0, async () => {
+					ready.resolve();
+					const batch = await uploadBatch;
+					if (batch.error !== null) throw batch.error;
+				});
+				task.then(() => ready.resolve(), (error) => ready.reject(error));
+				tasks.push(task);
+			}
+			const firstFailure = (await Promise.allSettled(tasks)).find((result) => result.status === "rejected");
+			if (firstFailure) throw firstFailure.reason;
+		} else for (const key of workerKeys) await deployOneWorker(key);
 		manifest = setInstallationEndpoints(manifest, {
 			apiUrl: plan.apiUrl,
 			dashboardUrl: null,
@@ -3338,6 +3727,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 					retainNewWorker: async () => {
 						await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 					},
+					reuseMatchingVersion: false,
 					runner: runPinnedPlatformWrangler,
 					workerExisted: true
 				});
@@ -3361,6 +3751,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			dependencies.onProgress?.("Preparing shared email routing");
 			emailOperationId = await (dependencies.bootstrapEmail ?? bootstrapPlatformSharedEmail)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce));
 		}
+		await releaseDatabaseLock.liftProjectZeroTrustFence?.();
 		if (dependencies.client.deleteKvValue) await dependencies.client.deleteKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY);
 		else if (wasDisabled || !previousPublicEndpoints) throw new Error("platform: Routing disablement removal is unavailable.");
 		if (requiresStagedCommit) {
@@ -3747,6 +4138,14 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWi
 	}
 	if (missing.size > 0) throw new Error(`platform: Creating a missing platform Worker requires: ${[...missing].sort().join(", ")}. Restore these values from your secret manager and retry.`);
 }
+/**
+* A Hyperdrive that Void creates validates the server against public certificate authorities
+* only, so it cannot honor a private CA that the local database client would trust.
+*/
+function assertVoidCreatedHyperdriveTrustsDatabase(databaseUrl) {
+	const sslrootcert = new URL(databaseUrl).searchParams.getAll("sslrootcert").at(-1);
+	if (sslrootcert && sslrootcert !== "system") throw new Error("platform: A Hyperdrive created by Void trusts only public certificate authorities, so it cannot use the certificate authority in DATABASE_URL sslrootcert. If the database certificate comes from a public certificate authority, use sslrootcert=system. Otherwise create a separately managed Hyperdrive that trusts it, then select it with \"Use an existing Hyperdrive\" when you start a new installation, or set VOID_PLATFORM_HYPERDRIVE_ID, VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST, and VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER.");
+}
 /** Make pg's current strict TLS behavior explicit without rewriting saved connection details. */
 function platformDatabaseClientUrl(databaseUrl) {
 	let url;
@@ -3755,7 +4154,13 @@ function platformDatabaseClientUrl(databaseUrl) {
 	} catch {
 		return databaseUrl;
 	}
-	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:" || url.searchParams.getAll("sslmode").at(-1) !== "require" || url.searchParams.getAll("uselibpqcompat").at(-1) === "true") return databaseUrl;
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return databaseUrl;
+	if (url.searchParams.getAll("sslrootcert").at(-1) === "system") {
+		url.searchParams.delete("sslrootcert");
+		url.searchParams.set("sslmode", "verify-full");
+		return url.toString();
+	}
+	if (url.searchParams.getAll("sslmode").at(-1) !== "require" || url.searchParams.getAll("uselibpqcompat").at(-1) === "true") return databaseUrl;
 	url.searchParams.set("sslmode", "verify-full");
 	return url.toString();
 }
@@ -3812,6 +4217,21 @@ async function readPlatformDatabaseLifecycleManifest(databaseUrl, installationId
 		await pool.end();
 	}
 }
+/** Read project Zero Trust state for a plan, which holds no lifecycle lock. */
+async function readPlatformProjectZeroTrustState(databaseUrl, installationId, ownershipNonce) {
+	if (!databaseUrl) throw new Error("the installation database URL is not recorded on this machine");
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	try {
+		await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
+		return await readPlatformProjectZeroTrustStateConnection(pool);
+	} finally {
+		await pool.end();
+	}
+}
 async function inspectPlatformDatabaseStateConnection(client, database) {
 	const relation = await client.query(`SELECT to_regclass('"drizzle"."__drizzle_migrations"')::text AS "relation"`);
 	if (relation.rows.length === 0 || relation.rows[0]?.relation === null) return {
@@ -3939,6 +4359,10 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 			protection: parsePlatformAccessProtection(settings.protection)
 		} : null;
 	};
+	release.readProjectZeroTrust = () => readPlatformProjectZeroTrustStateConnection(client);
+	release.lockProjectZeroTrust = () => lockPlatformProjectZeroTrustConnection(client);
+	release.fenceProjectZeroTrust = () => fencePlatformProjectZeroTrustConnection(client);
+	release.liftProjectZeroTrustFence = () => liftPlatformProjectZeroTrustFenceConnection(client);
 	release.requiredSafetyProtocols = await readRequiredPlatformSafetyProtocols(client);
 	release.checkpoint = async (manifest) => {
 		if (released) throw new Error("platform: Cannot checkpoint lifecycle state after releasing its lock.");
@@ -4269,24 +4693,26 @@ function snapshotPlatformWorkerUploadInputs(config, directory) {
 function platformWorkerApiReadRunner(accountId, workerName, readCloudflare, fallback) {
 	const base = `/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
 	return async (args, account, cwd, capture) => {
-		if (args[0] === "deployments" && (args[1] === "status" || args[1] === "list")) {
-			const response = await readCloudflare(`${base}/deployments`);
-			const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
-			if (!Array.isArray(deployments)) throw new Error(`platform: Cloudflare returned malformed deployment history for ${workerName}.`);
-			return {
-				status: args[1] === "status" && deployments.length === 0 ? 1 : 0,
-				stderr: "",
-				stdout: JSON.stringify(args[1] === "status" ? deployments[0] : deployments)
-			};
-		}
-		if (args[0] === "versions" && args[1] === "view" && args[2]) {
-			const version = await readCloudflare(`${base}/versions/${encodeURIComponent(args[2])}`);
-			return {
-				status: 0,
-				stderr: "",
-				stdout: JSON.stringify(version)
-			};
-		}
+		try {
+			if (args[0] === "deployments" && (args[1] === "status" || args[1] === "list")) {
+				const response = await readCloudflare(`${base}/deployments`);
+				const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
+				if (!Array.isArray(deployments)) throw new Error(`platform: Cloudflare returned malformed deployment history for ${workerName}.`);
+				return {
+					status: args[1] === "status" && deployments.length === 0 ? 1 : 0,
+					stderr: "",
+					stdout: JSON.stringify(args[1] === "status" ? deployments[0] : deployments)
+				};
+			}
+			if (args[0] === "versions" && args[1] === "view" && args[2]) {
+				const version = await readCloudflare(`${base}/versions/${encodeURIComponent(args[2])}`);
+				return {
+					status: 0,
+					stderr: "",
+					stdout: JSON.stringify(version)
+				};
+			}
+		} catch {}
 		return fallback(args, account, cwd, capture);
 	};
 }
@@ -4294,6 +4720,7 @@ async function deployPlatformWorker(config, secrets, options) {
 	const directory = mkdtempSync(join(tmpdir(), "void-platform-deploy-"));
 	const workerName = String(config.name);
 	const accountId = String(config.account_id);
+	const readRunner = options.readCloudflare ? platformWorkerApiReadRunner(accountId, workerName, options.readCloudflare, options.runner) : options.runner;
 	let activatedVersionId = null;
 	let activatedDeploymentId = null;
 	let uploadedVersionId = null;
@@ -4305,13 +4732,22 @@ async function deployPlatformWorker(config, secrets, options) {
 	let uploadConfig = withoutPlatformWorkerTrafficAttachments(nextTraffic.wranglerConfig);
 	const nextTriggers = readTriggerConfigFromObject(nextTraffic.wranglerConfig);
 	const contentHash = secrets === null ? platformWorkerUploadFingerprint(config, options.managedRoutes) : null;
+	const reuseMatchingVersion = options.reuseMatchingVersion !== false;
 	let previousTriggers = readTriggerConfigFromObject(previousTraffic.wranglerConfig);
 	try {
 		const configPath = join(directory, "wrangler.json");
 		writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 		const reconcileExistingVersion = async (versionId, triggerConfig, runner, deploymentId) => {
 			try {
-				assertPlatformTriggerStabilization(await stabilizeCloudflareVersionTriggers({
+				if (deploymentId && options.readCloudflare ? await platformWorkerLiveTriggersMatch({
+					accountId,
+					workerName,
+					desired: nextTriggers,
+					readCloudflare: options.readCloudflare
+				}) : false) {
+					const beforeTraffic = await readPlatformWorkerDeployments(configPath, accountId, workerName, runner);
+					if (beforeTraffic[0]?.id !== deploymentId || !deploymentRunsOnlyVersion(beforeTraffic[0], versionId)) throw new Error(`platform: Worker ${workerName} changed deployment lineage during trigger verification.`);
+				} else assertPlatformTriggerStabilization(await stabilizeCloudflareVersionTriggers({
 					configPath,
 					knownTriggerConfigs: { [versionId]: nextTriggers },
 					manageRoutes: false,
@@ -4344,16 +4780,15 @@ async function deployPlatformWorker(config, secrets, options) {
 				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} traffic reconciliation failed: ${errorMessage(error)}${failures.length > 0 ? ` Safety recovery also failed: ${failures.join("; ")}` : ""}`, { cause: error });
 			}
 		};
-		if (options.workerExisted && contentHash && options.readCloudflare) {
-			const directRunner = platformWorkerApiReadRunner(accountId, workerName, options.readCloudflare, options.runner);
+		if (options.workerExisted && contentHash && reuseMatchingVersion && options.readCloudflare) {
 			let candidate;
 			let changedDuringRead = false;
 			try {
-				const before = await readPlatformWorkerDeployments(configPath, accountId, workerName, directRunner);
+				const before = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 				const activeVersion = before[0]?.versions.length === 1 && before[0].versions[0]?.percentage === 100 ? before[0].versions[0].versionId : null;
 				if (!activeVersion) throw new Error(`platform: Existing Worker ${workerName} has no single active production version.`);
-				const snapshot = await readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), activeVersion, directRunner);
-				const after = await readPlatformWorkerDeployments(configPath, accountId, workerName, directRunner);
+				const snapshot = await readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), activeVersion, readRunner);
+				const after = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 				changedDuringRead = before[0]?.id !== after[0]?.id || !deploymentRunsOnlyVersion(after[0], snapshot.versionId);
 				if (!changedDuringRead && snapshot.contentHash === contentHash) candidate = {
 					deploymentId: after[0].id,
@@ -4363,16 +4798,24 @@ async function deployPlatformWorker(config, secrets, options) {
 				if (error instanceof Error && (error.message.includes("changed concurrently") || error.message.includes("does not belong to this installation"))) throw error;
 			}
 			if (changedDuringRead) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
-			if (candidate && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) return await reconcileExistingVersion(candidate.snapshot.versionId, candidate.snapshot.triggerConfig, directRunner, candidate.deploymentId);
+			if (candidate && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) {
+				await options.onReadyForActivation?.();
+				await options.waitForPriorWorker?.();
+				return await reconcileExistingVersion(candidate.snapshot.versionId, candidate.snapshot.triggerConfig, readRunner, candidate.deploymentId);
+			}
 		}
 		if (options.workerExisted) {
-			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), options.runner);
+			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), readRunner);
 			previousVersionId = previous.versionId;
-			const deployments = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+			const deployments = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (!deploymentRunsOnlyVersion(deployments[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
 			previousDeployment = deployments[0];
 			previousDeploymentId = previousDeployment.id;
-			if (contentHash && previous.contentHash === contentHash && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) return await reconcileExistingVersion(previousVersionId, previous.triggerConfig, options.runner);
+			if (contentHash && reuseMatchingVersion && previous.contentHash === contentHash && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) {
+				await options.onReadyForActivation?.();
+				await options.waitForPriorWorker?.();
+				return await reconcileExistingVersion(previousVersionId, previous.triggerConfig, readRunner);
+			}
 			uploadConfig = withoutCompletedPlatformWorkerMigrations(uploadConfig, previous.migrationTag);
 			writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 			previousTriggers = resolvePlatformPreviousTriggerConfig(withoutPlatformCustomDomainTriggers(previous.triggerConfig), previousTriggers, options.previousPublicEndpoints);
@@ -4404,14 +4847,26 @@ async function deployPlatformWorker(config, secrets, options) {
 			writeFileSync(secretsPath, JSON.stringify(secrets), { mode: 384 });
 			argv.push("--secrets-file", secretsPath);
 		}
-		const uploaded = options.workerExisted ? await options.runner(argv, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(argv, accountId, directory, true, workerName, options.apiBaseUrl);
+		const releaseUploadSlot = await options.acquireUploadSlot?.();
+		let uploaded;
+		let uploadError;
+		try {
+			uploaded = options.workerExisted ? await options.runner(argv, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(argv, accountId, directory, true, workerName, options.apiBaseUrl);
+			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
+		} catch (error) {
+			uploadError = error;
+			throw error;
+		} finally {
+			releaseUploadSlot?.(uploadError);
+		}
 		uploadedVersionId = parseUploadedPlatformWorkerVersion(`${uploaded.stdout}\n${uploaded.stderr}`);
 		if (!options.workerExisted) activatedVersionId = uploadedVersionId;
-		assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
 		if (!uploadedVersionId) throw new Error(`platform: Wrangler uploaded ${workerName} without reporting its immutable version id.`);
 		await options.onStaged(previousVersionId, uploadedVersionId, previousTriggers);
+		await options.onReadyForActivation?.();
+		await options.waitForPriorWorker?.();
 		if (options.workerExisted) {
-			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (deploymentsBeforeActivation[0]?.id !== previousDeploymentId || !deploymentRunsOnlyVersion(deploymentsBeforeActivation[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently before activation; refusing to overwrite it.`);
 			activatedVersionId = uploadedVersionId;
 			assertCleanPlatformWrangler(await options.runner([
@@ -4425,7 +4880,7 @@ async function deployPlatformWorker(config, secrets, options) {
 				"--yes"
 			], accountId, directory, true), `activate ${workerName}`);
 		}
-		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 		const lineage = classifyPlatformWorkerDeploymentLineage(deploymentsAfterActivation, uploadedVersionId, previousDeploymentId);
 		if (lineage.kind === "concurrent-after") {
 			activatedVersionId = null;
@@ -4445,7 +4900,7 @@ async function deployPlatformWorker(config, secrets, options) {
 					expectedActiveDeploymentId: lineage.deploymentId,
 					expectedActiveVersionId: uploadedVersionId,
 					restoration: interveningDeployment,
-					runner: options.runner,
+					runner: readRunner,
 					workerName
 				});
 			} catch (recoveryError) {
@@ -4471,7 +4926,7 @@ async function deployPlatformWorker(config, secrets, options) {
 				await options.removeCustomDomains();
 				return cleanPlatformCommandResult();
 			},
-			runWrangler: platformWorkerCommandRunner(accountId, directory, options.runner),
+			runWrangler: platformWorkerCommandRunner(accountId, directory, readRunner),
 			targetTriggerConfig: nextTriggers,
 			targetVersionId: uploadedVersionId,
 			workerName
@@ -4495,7 +4950,7 @@ async function deployPlatformWorker(config, secrets, options) {
 			removeCustomDomains: options.removeCustomDomains,
 			publishCustomDomains: options.publishCustomDomains,
 			retainNewWorker: options.retainNewWorker,
-			runner: options.runner,
+			runner: readRunner,
 			workerExisted: options.workerExisted,
 			workerName
 		});
@@ -4522,7 +4977,7 @@ async function deployPlatformWorker(config, secrets, options) {
 				removeCustomDomains: options.removeCustomDomains,
 				publishCustomDomains: options.publishCustomDomains,
 				retainNewWorker: options.retainNewWorker,
-				runner: options.runner,
+				runner: readRunner,
 				workerExisted: options.workerExisted,
 				workerName
 			}) : null,
@@ -4623,10 +5078,11 @@ async function runPlatformWrangler(args, accountId, cwd, capture) {
 	return runPlatformWranglerAtApiBase(args, accountId, cwd, capture);
 }
 const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl()) {
+async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
 	const startedAt = performance.now();
 	const result = await createDefaultRunWrangler(process.cwd(), {
 		launcher: resolveWranglerArgv(process.cwd()),
+		parallelWorkerUpload,
 		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
 	})([...args], {
 		accountId,
@@ -4676,8 +5132,11 @@ async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId,
 	const upstreamBase = new URL(upstreamApiBaseUrl);
 	if (upstreamBase.protocol !== "http:" && upstreamBase.protocol !== "https:") throw new Error("platform: Cloudflare API base URL must use HTTP or HTTPS.");
 	const basePath = upstreamBase.pathname.replace(/\/+$/, "");
-	const expectedPath = `${basePath}/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
+	const accountPath = `${basePath}/accounts/${encodeURIComponent(accountId)}`;
+	const expectedPath = `${accountPath}/workers/scripts/${encodeURIComponent(workerName)}`;
+	const assetUploadPath = `${accountPath}/workers/assets/upload`;
 	const state = {
+		assetSessionStarted: false,
 		attempted: false,
 		conflictStatus: null,
 		created: false,
@@ -4697,7 +5156,9 @@ async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId,
 			const isConditionalCreate = incoming.method === "PUT" && incomingUrl.pathname === expectedPath && supportedCreateQuery;
 			const isTopLevelWorkerUpload = incoming.method === "PUT" && new RegExp(`^${basePath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/accounts/[^/]+/workers/scripts/[^/]+$`).test(incomingUrl.pathname);
 			const isReadOnly = incoming.method === "GET" || incoming.method === "HEAD" || incoming.method === "OPTIONS";
-			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !state.created) {
+			const isAssetUploadSession = incoming.method === "POST" && incomingUrl.pathname === `${expectedPath}/assets-upload-session` && incomingUrl.search === "";
+			const isAssetUpload = incoming.method === "POST" && state.assetSessionStarted && (incomingUrl.pathname === assetUploadPath && incomingUrl.search === "?base64=true" || incomingUrl.search === "" && incomingUrl.pathname.startsWith(`${assetUploadPath}/`) && /^[0-9a-f]{32}$/.test(incomingUrl.pathname.slice(assetUploadPath.length + 1)));
+			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !isAssetUploadSession && !isAssetUpload && !state.created) {
 				state.rejectedMutation = `${incoming.method ?? "UNKNOWN"} ${incomingUrl.pathname}${incomingUrl.pathname === expectedPath && !supportedCreateQuery ? " (unsupported Worker create query)" : ""}`;
 				incoming.resume();
 				outgoing.writeHead(409, { "Content-Type": "application/json" });
@@ -4710,6 +5171,7 @@ async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId,
 				state.attempted = true;
 				headers["if-none-match"] = "*";
 			}
+			if (isAssetUploadSession) state.assetSessionStarted = true;
 			const upstreamUrl = new URL(`${incomingUrl.pathname}${incomingUrl.search}`, upstreamBase.origin);
 			const request$2 = (upstreamUrl.protocol === "https:" ? request$1 : request)(upstreamUrl, {
 				headers,
@@ -5214,7 +5676,7 @@ async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicatio
 		redirect: "manual",
 		signal: AbortSignal.timeout(3e4)
 	});
-	const dispatchUrl = dispatchOrigin ?? `https://test.${applicationBaseDomain}`;
+	const dispatchUrl = dispatchOrigin ?? `https://${PLATFORM_HEALTH_HOSTNAME_LABEL}.${applicationBaseDomain}`;
 	const [health, discovery, proxy, dispatch, emailGateway] = await Promise.all([
 		request(`${apiUrl}/health`),
 		request(`${apiUrl}/.well-known/void-platform`),
@@ -5816,14 +6278,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-CU1JtJkW.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-D6Xcy9ZX.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-dvUaptLr.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-BvtcXON5.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5833,7 +6295,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-C8tt6D8h.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-DOtss0BN.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -6057,7 +6519,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-C8tt6D8h.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DOtss0BN.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -6286,7 +6748,7 @@ async function runPlatformLifecycleCommand(args) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-C8tt6D8h.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DOtss0BN.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -6426,4 +6888,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { hyperdriveOriginFromConnectionString as A, assertPlatformOperatorCredentialCanApplyPlan as C, preparePlatformAccessSetup as D, parsePlatformAccessSetupSpec as E, verifyPlatformRuntimeTokenPermissions as M, PlatformCloudflareClient as O, platformDatabaseNameFromOwnerUrl as S, checkpointPlatformAccessResources as T, createPlatformInstallPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, platformProvisionIntentHash as b, createPlatformHealthProbeToken as c, loadPlatformRuntime as d, platformDatabaseClientUrl as f, trackedPlatformWorkerTraffic as g, recordPlatformWorkerTraffic as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginMatches as j, hyperdriveOriginConfigHash as k, createPlatformInstallationSecrets as l, resolveBootstrapGitHubId as m, resolvePlatformInstallDatabaseUrl as n, acquirePlatformDatabaseLifecycleLock as o, recordResource as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLockConnection as s, assertNoninteractivePlatformMutationAcknowledged as t, installPlatform as u, formatPlatformInstallPlan as v, resolvePlatformCloudflareCredential as w, revalidatePlatformInstallAction as x, platformAdoptionIntentHash as y };
+export { PlatformCloudflareClient as A, revalidatePlatformInstallAction as C, checkpointPlatformAccessResources as D, resolvePlatformCloudflareCredential as E, hyperdriveOriginFromConnectionString as M, hyperdriveOriginMatches as N, parsePlatformAccessSetupSpec as O, verifyPlatformRuntimeTokenPermissions as P, platformProvisionIntentHash as S, assertPlatformOperatorCredentialCanApplyPlan as T, recordPlatformWorkerTraffic as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, formatPlatformInstallPlan as b, createPlatformHealthProbeToken as c, loadPlatformRuntime as d, platformDatabaseClientUrl as f, assertProjectZeroTrustAllowsUninstall as g, resolveBootstrapGitHubId as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginConfigHash as j, preparePlatformAccessSetup as k, createPlatformInstallationSecrets as l, recordResource as m, resolvePlatformInstallDatabaseUrl as n, acquirePlatformDatabaseLifecycleLock as o, readPlatformProjectZeroTrustState as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLockConnection as s, assertNoninteractivePlatformMutationAcknowledged as t, installPlatform as u, trackedPlatformWorkerTraffic as v, platformDatabaseNameFromOwnerUrl as w, platformAdoptionIntentHash as x, createPlatformInstallPlan as y };