void 0.21.9 → 0.23.0

package/dist/{platform-lifecycle-Bc047IeT.mjs → platform-lifecycle-9OyBALhH.mjs}

@@ -1,20 +1,21 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-CCH48AMM.mjs";
+import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
+import { d as openBrowser } from "./auth-CSkdO2Bb.mjs";
 import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
 import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
-import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-Dn6nn2IU.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
-import { c as runCloudflareAuthCommand, n as announceCloudflareLogin } from "./cloudflare-auth-C4_GPZr0.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BhreDAOS.mjs";
+import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-CTBk70IR.mjs";
+import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-CJFgTZY8.mjs";
+import { c as import_picocolors$1, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { readFile } from "node:fs/promises";
@@ -652,7 +653,7 @@ function parsePostgresConnectionString(value) {
 	let mtls;
 	if (sslmode) {
 		if (sslmode !== "require" && sslmode !== "verify-ca" && sslmode !== "verify-full") throw new Error("platform: Unsupported sslmode. Cloudflare Hyperdrive supports \"require\", \"verify-ca\", or \"verify-full\".");
-		mtls = { sslmode };
+		mtls = { sslmode: "require" };
 	}
 	return {
 		database,
@@ -716,6 +717,14 @@ function text(value, name) {
 	if (typeof value !== "string" || !value || value.length > 8192) throw new Error(`platform: Cloudflare Access did not return ${name}.`);
 	return value;
 }
+function platformAccessIdentityProvider(provider) {
+	const id = text(provider.id, "identity provider ID");
+	const name = provider.name;
+	return {
+		id,
+		name: name == null || typeof name === "string" && !name.trim() ? id : text(name, "identity provider name")
+	};
+}
 function ids(value) {
 	if (!Array.isArray(value)) return [];
 	return value.map((entry) => typeof entry === "string" ? entry : text(object(entry, "policy").id, "policy ID"));
@@ -756,6 +765,11 @@ var PlatformAccessClient = class {
 		throw new Error("platform: Access inventory exceeded the supported pagination limit.");
 	}
 };
+/**
+* Project Zero Trust keeps its own, broader copy of this list in
+* platform/packages/api/src/zero-trust/cloudflare.ts; review both when adding
+* a rule type.
+*/
 function identityRule(rule) {
 	if (rule.email_domain) {
 		const domain = object(rule.email_domain, "email domain").domain;
@@ -840,10 +854,7 @@ async function inspectPlatformAccess(client, input) {
 			audience: "validation"
 		}]
 	});
-	const identityProviders = (await client.list("identity_providers")).map((provider) => ({
-		id: text(provider.id, "identity provider ID"),
-		name: text(provider.name ?? provider.id, "identity provider name")
-	}));
+	const identityProviders = (await client.list("identity_providers")).map(platformAccessIdentityProvider);
 	if (!input.identityProviderIds.length || !input.policyIds.length || input.identityProviderIds.length > 16 || input.policyIds.length > 16 || new Set(input.identityProviderIds).size !== input.identityProviderIds.length || new Set(input.policyIds).size !== input.policyIds.length) throw new Error("platform: Select explicit identity providers and company policies for Access.");
 	if (input.identityProviderIds.some((id) => !identityProviders.some((provider) => provider.id === id))) throw new Error("platform: A selected Access identity provider is unavailable in this account.");
 	const policies = await Promise.all(input.policyIds.map(async (id) => object(await client.get(`policies/${encodeURIComponent(id)}`), "Access policy")));
@@ -1271,9 +1282,9 @@ async function preparePlatformAccessSetup(input) {
 	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
 		message: "Company identity providers:",
 		required: true,
-		options: providers.filter((provider) => typeof provider.id === "string").map((provider) => ({
-			value: String(provider.id),
-			label: stripVTControlCharacters(String(provider.name ?? provider.id))
+		options: providers.filter((provider) => typeof provider.id === "string").map(platformAccessIdentityProvider).map((provider) => ({
+			value: provider.id,
+			label: stripVTControlCharacters(provider.name)
 		}))
 	})) : []);
 	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
@@ -1411,10 +1422,9 @@ async function resolvePlatformCloudflareCredentialWithInput(readInput, dependenc
 			input,
 			credential: result.credential
 		};
-		announceCloudflareLogin();
-		const login = await runWrangler(["login"], false);
+		const login = await runWrangler({ type: "auth.login" }, false);
 		assertNotCancelled();
-		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
+		if (login.status !== 0 || login.signal || login.error) throw new Error("platform: Cloudflare browser login did not complete.");
 		const credential = await readWranglerOAuthCredential(runWrangler);
 		assertNotCancelled();
 		if (!credential) throw new Error("platform: Cloudflare sign-in completed without a usable OAuth credential.");
@@ -1437,15 +1447,11 @@ async function readExistingCredential(dependencies, runWrangler) {
 	return await readWranglerOAuthCredential(runWrangler);
 }
 async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
-	const result = await runWrangler([
-		"auth",
-		"token",
-		"--json"
-	], true);
-	if (result.status !== 0) return null;
+	const result = await runWrangler({ type: "auth.token" }, true);
+	if (result.status !== 0 || result.signal || result.error) return null;
 	try {
-		const parsed = JSON.parse(result.stdout);
-		if (parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+		const parsed = result.data;
+		if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
 		return {
 			source: "oauth",
 			token: parsed.token.trim()
@@ -1485,6 +1491,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	if ([
 		input.plan.apiUrl,
 		input.plan.proxyUrl,
+		...input.dashboardUrl ? [input.dashboardUrl] : [],
 		...input.manifest.endpoints.dashboardUrl ? [input.manifest.endpoints.dashboardUrl] : []
 	].map((value) => new URL(value).origin).some((origin) => !origins.includes(origin)) || protection.applications.some((entry) => entry.audience !== app.aud || !platformAccessPublicDestinations(app).includes(new URL(entry.origin).hostname))) throw new Error("platform: Access audiences and complete origin coverage must match the active platform protection. Restore the current Access checkpoint or repair its applications.");
 	for (const other of await access.list("apps")) {
@@ -1500,7 +1507,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DeE3yr2R.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BDWO_aER.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1593,6 +1600,7 @@ async function verifyPlatformAuthenticationDatabase(client, accountId, resource,
 //#endregion
 //#region src/cli/platform-plan.ts
 async function createPlatformInstallPlan(client, input, existing, options) {
+	const dashboardUrl = input.dashboardUrl !== void 0 ? normalizePlatformDashboardUrl(input.dashboardUrl) : existing ? existing.deployment.controlPlane.dashboardUrl ?? (existing.endpoints.dashboardUrl ? normalizePlatformDashboardUrl(existing.endpoints.dashboardUrl) : null) ?? platformDashboardUrl(existing.deployment) : null;
 	const account = resolveAccount(await client.listAccounts(), input.accountId);
 	if (existing && existing.account.id !== account.id) throw new Error(`platform: Refusing to resume installation ${existing.id} in a different Cloudflare account.`);
 	const providedEmailSharedZoneId = input.emailSharedZoneId?.trim();
@@ -1641,7 +1649,8 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		},
 		controlPlane: {
 			apiHostname: input.controlPlaneDomain || null,
-			dashboardHostname: null,
+			dashboardHostname: dashboardUrl ? new URL(dashboardUrl).hostname : null,
+			...dashboardUrl ? { dashboardUrl } : {},
 			proxyHostname: null
 		},
 		displayName: input.displayName,
@@ -1659,13 +1668,21 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			sandbox: true
 		}
 	} : existingWithoutEmailZone;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithDashboard = {
 		...existingWithSandbox,
+		controlPlane: {
+			...existingWithSandbox.controlPlane,
+			dashboardHostname: deployment.controlPlane.dashboardHostname,
+			...deployment.controlPlane.dashboardUrl ? { dashboardUrl: deployment.controlPlane.dashboardUrl } : {}
+		}
+	};
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithDashboard,
 		capabilities: {
-			...existingWithSandbox.capabilities,
+			...existingWithDashboard.capabilities,
 			email: true
 		}
-	} : existingWithSandbox;
+	} : existingWithDashboard;
 	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
@@ -1689,7 +1706,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		}
 		throw error;
 	});
-	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
+	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, deploymentQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
 		Promise.resolve(accountSubdomain),
 		gatewayInventory,
 		client.listKvNamespaces(account.id, names.routingKv),
@@ -1698,6 +1715,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		client.listR2Buckets(account.id),
 		client.listQueues(account.id, names.usageQueue),
 		client.listQueues(account.id, names.cronQueue),
+		options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue") ? client.listQueues(account.id, names.deploymentQueue) : Promise.resolve([]),
 		client.listDispatchNamespaces(account.id),
 		client.listHyperdriveConfigs(account.id),
 		client.listWorkerNames(account.id)
@@ -1732,11 +1750,13 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		const expectedPatterns = new Set(createApplicationRoutes(deployment.application).map((route) => route.pattern));
 		const expectedWorker = deployment.resources.dispatchWorker;
 		const ownedWorker = intentProofs.has("dispatch-worker") || existing?.resources.some((resource) => resource.key === "dispatch-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
-		const conflicts = (await client.listWorkerRoutes(zone.id)).filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
+		const [workerRoutes, workerDomains] = await Promise.all([client.listWorkerRoutes(zone.id), client.listWorkerDomains(account.id)]);
+		const conflicts = workerRoutes.filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
 		if (conflicts.length > 0) {
 			const conflict = conflicts[0];
 			throw new Error(`platform: Application route ${JSON.stringify(conflict.pattern)} is already assigned to ${JSON.stringify(conflict.script ?? "no Worker")}. Choose another application domain.`);
 		}
+		assertApplicationRoutesPreserveWorkerDomains([...expectedPatterns], expectedWorker, ownedWorker === true, zone.name, workerRoutes, workerDomains);
 	}
 	if (deployment.controlPlane.apiHostname) {
 		const apiHostname = deployment.controlPlane.apiHostname;
@@ -1779,6 +1799,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	addNamedPlan(actions, existing, "assets-bucket", "r2-bucket", names.assetsBucket, r2Buckets.filter((resource) => resource.name === names.assetsBucket), "reuse", options, remoteOwnership, intentProofs, ambiguousResources);
 	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
+	if (options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue")) addNamedPlan(actions, existing, "deployment-queue", "queue", names.deploymentQueue, deploymentQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
 	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
 	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
@@ -1831,6 +1852,18 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	};
 }
 async function revalidatePlatformInstallAction(client, original, manifest, action, options) {
+	if (options?.stableWorkerUpdate && !options.repairMissing && action.kind === "worker" && action.action === "update" && original.actions.some((entry) => entry.key === action.key && entry.kind === action.kind && entry.action === action.action && entry.id === action.id && entry.name === action.name) && original.actions.every((entry) => {
+		const resource = manifest.resources.find((candidate) => candidate.key === entry.key);
+		return (entry.kind === "worker" ? entry.action === "update" : entry.action === "reuse") && resource?.kind === entry.kind && resource.state === "ready" && resource.id === entry.id && resource.name === entry.name;
+	})) {
+		const recorded = manifest.resources.find((resource) => resource.key === action.key);
+		if (!recorded || recorded.kind !== "worker" || recorded.state !== "ready" || recorded.id !== action.name || recorded.name !== action.name) throw new Error(`platform: Worker ${JSON.stringify(action.name)} no longer matches the approved installation plan. Review a new plan before retrying.`);
+		if (!matchesResourceMarker((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, action.key, "worker", {
+			id: action.name,
+			name: action.name
+		})) throw new Error(`platform: Cloudflare Worker ${JSON.stringify(action.name)} no longer has this installation's ownership marker. Review a new plan before retrying.`);
+		return;
+	}
 	const deployment = original.deployment;
 	const current = (await createPlatformInstallPlan(client, {
 		accountId: original.account.id,
@@ -1844,7 +1877,8 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 	}, manifest, {
 		...options,
 		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker"),
-		enableSandbox: original.deployment.capabilities.sandbox
+		enableSandbox: original.deployment.capabilities.sandbox,
+		deploymentExecution: original.actions.some((entry) => entry.key === "deployment-queue")
 	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
@@ -2038,6 +2072,7 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"api-worker": "apiWorker",
 	"assets-bucket": "assetsBucket",
 	"cron-queue": "cronQueue",
+	"deployment-queue": "deploymentQueue",
 	"dispatch-namespace": "dispatchNamespace",
 	"dispatch-worker": "dispatchWorker",
 	hyperdrive: "hyperdrive",
@@ -2049,6 +2084,33 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"tail-worker": "tailWorker",
 	"usage-queue": "usageQueue"
 };
+function assertApplicationRoutesPreserveWorkerDomains(patterns, dispatchWorker, ownedDispatchWorker, zoneName, workerRoutes, workerDomains) {
+	const plannedRoutes = patterns.map(parseWorkerRoutePattern);
+	const existingRoutes = workerRoutes.map((route) => ({
+		...parseWorkerRoutePattern(route.pattern),
+		script: route.script
+	}));
+	for (const domain of workerDomains) {
+		const hostname = domain.hostname.toLowerCase();
+		if (!(domain.zoneName ? domain.zoneName.toLowerCase() === zoneName.toLowerCase() : hostname === zoneName.toLowerCase() || hostname.endsWith(`.${zoneName.toLowerCase()}`)) || domain.service === dispatchWorker && ownedDispatchWorker) continue;
+		for (const planned of plannedRoutes) {
+			if (!workerRouteHostMatches(planned.host, hostname)) continue;
+			if (!["http", "https"].every((scheme) => existingRoutes.some((route) => route.script !== dispatchWorker && route.path === "/*" && (!route.scheme || route.scheme === scheme) && workerRouteHostMatches(route.host, hostname) && route.host.replace(/^\*/, "").length > planned.host.replace(/^\*/, "").length))) throw new Error(`platform: Application route ${JSON.stringify(planned.pattern)} would intercept Worker custom domain ${JSON.stringify(domain.hostname)}, currently served by ${JSON.stringify(domain.service)}. Choose another application domain, or use \`void platform install --workers-dev\` for a new installation and add a suitable domain later.`);
+		}
+	}
+}
+function parseWorkerRoutePattern(pattern) {
+	const match = /^(?:(https?):\/\/)?([^/]+)(\/.*)?$/.exec(pattern);
+	return {
+		host: match?.[2]?.toLowerCase() ?? "",
+		path: match?.[3] ?? "/",
+		pattern,
+		scheme: match?.[1] ?? null
+	};
+}
+function workerRouteHostMatches(host, hostname) {
+	return host.startsWith("*") ? hostname.endsWith(host.slice(1)) : host === hostname;
+}
 function platformProvisionIntentHash(manifest, key, kind, name, previousResourceId = null) {
 	return createHash("sha256").update(JSON.stringify({
 		key,
@@ -2084,10 +2146,12 @@ async function readRemoteOwnership(client, accountId, routingNamespaces, existin
 }
 function formatPlatformInstallPlan(plan) {
 	const lines = [
-		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)} (${plan.account.id})`,
-		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev (testing); add a domain with void platform domain set <domain>`,
+		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
+		`${import_picocolors$1.default.bold("Account:")} ${plan.account.id}`,
+		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev for testing. Add a domain with void platform domain set <domain>`,
 		`${import_picocolors$1.default.bold("Control plane:")} ${plan.apiUrl}`,
 		`${import_picocolors$1.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
+		...platformDashboardUrl(plan.deployment) ? [`${import_picocolors$1.default.bold("Dashboard:")} ${platformDashboardUrl(plan.deployment)} (deploy separately)`] : [],
 		`${import_picocolors$1.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
 		`${import_picocolors$1.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
 		`${import_picocolors$1.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
@@ -2216,6 +2280,284 @@ function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt)
 	return next;
 }
 //#endregion
+//#region src/cli/platform-trigger-proof.ts
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function sameStrings(actual, expected) {
+	const sortedExpected = [...expected].sort();
+	return actual.length === expected.length && [...actual].sort().every((value, index) => value === sortedExpected[index]);
+}
+function desiredQueue(value) {
+	const queue = record(value);
+	if (!queue || typeof queue.queue !== "string" || Object.keys(queue).some((key) => ![
+		"queue",
+		"max_batch_size",
+		"max_batch_timeout",
+		"max_retries",
+		"max_concurrency",
+		"retry_delay",
+		"dead_letter_queue"
+	].includes(key)) || [
+		"max_batch_size",
+		"max_batch_timeout",
+		"max_retries",
+		"max_concurrency",
+		"retry_delay"
+	].some((key) => queue[key] !== void 0 && typeof queue[key] !== "number") || queue.dead_letter_queue !== void 0 && typeof queue.dead_letter_queue !== "string") return null;
+	return queue;
+}
+function matchesQueueConsumer(liveValue, desired, workerName) {
+	const live = record(liveValue);
+	const settings = record(live?.settings);
+	if (!live || live.type !== "worker" || live.script_name !== void 0 && live.script_name !== workerName || live.queue_name !== desired.queue || !settings) return false;
+	const expected = {
+		batch_size: desired.max_batch_size ?? 10,
+		max_wait_time_ms: Number(desired.max_batch_timeout ?? 5) * 1e3,
+		max_retries: desired.max_retries ?? 3,
+		max_concurrency: desired.max_concurrency ?? null,
+		retry_delay: desired.retry_delay ?? 0
+	};
+	return Object.entries(expected).every(([key, value]) => key === "max_concurrency" ? (settings[key] ?? null) === value : settings[key] === value) && (live.dead_letter_queue ?? "") === (desired.dead_letter_queue ?? "");
+}
+/**
+* Read every surface that `triggers deploy` can mutate for a platform Worker. An incomplete
+* response, unsupported trigger kind, or read failure requires normal trigger publication.
+*/
+async function platformWorkerLiveTriggersMatch(options) {
+	const { accountId, workerName, desired, readCloudflare } = options;
+	if (desired.preserve || desired.addresses !== void 0 || desired.workflows.length > 0 || !desired.crons.every((cron) => typeof cron === "string")) return false;
+	const queues = desired.queueConsumers.map(desiredQueue);
+	if (queues.some((queue) => queue === null)) return false;
+	const base = `/accounts/${encodeURIComponent(accountId)}`;
+	const script = `${base}/workers/scripts/${encodeURIComponent(workerName)}`;
+	try {
+		const [workerValue, schedulesValue, workflowsValue, nextWorkflowsValue] = await Promise.all([
+			readCloudflare(`${base}/workers/workers/${encodeURIComponent(workerName)}`),
+			readCloudflare(`${script}/schedules`),
+			readCloudflare(`${base}/workflows?page=1&per_page=100`),
+			readCloudflare(`${base}/workflows?page=2&per_page=100`)
+		]);
+		const worker = record(workerValue);
+		const subdomain = record(worker?.subdomain);
+		const schedules = record(schedulesValue)?.schedules;
+		if (worker?.name !== workerName || !subdomain || !desired.preserveWorkersDev && subdomain.enabled !== desired.workers_dev || !desired.preservePreviewUrls && subdomain.previews_enabled !== desired.preview_urls || !Array.isArray(schedules) || !Array.isArray(worker.references && record(worker.references)?.queues) || !Array.isArray(workflowsValue) || workflowsValue.length >= 100 || !Array.isArray(nextWorkflowsValue) || nextWorkflowsValue.length !== 0) return false;
+		const liveCrons = schedules.map((entry) => record(entry)?.cron);
+		if (!liveCrons.every((cron) => typeof cron === "string") || !sameStrings(liveCrons, desired.crons) || workflowsValue.some((entry) => {
+			const workflow = record(entry);
+			return !workflow || typeof workflow.script_name !== "string" || workflow.script_name === workerName;
+		})) return false;
+		const references = record(worker.references).queues;
+		if (references.length !== queues.length) return false;
+		const matched = /* @__PURE__ */ new Set();
+		const consumers = await Promise.all(references.map(async (value) => {
+			const reference = record(value);
+			if (typeof reference?.queue_id !== "string" || typeof reference.queue_consumer_id !== "string" || typeof reference.queue_name !== "string") return null;
+			return {
+				queueName: reference.queue_name,
+				consumer: await readCloudflare(`${base}/queues/${encodeURIComponent(reference.queue_id)}/consumers/${encodeURIComponent(reference.queue_consumer_id)}`)
+			};
+		}));
+		for (const entry of consumers) {
+			if (!entry || matched.has(entry.queueName)) return false;
+			const desiredQueueConfig = queues.find((queue) => queue?.queue === entry.queueName);
+			if (!desiredQueueConfig || !matchesQueueConsumer(entry.consumer, desiredQueueConfig, workerName)) return false;
+			matched.add(entry.queueName);
+		}
+		return matched.size === queues.length;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/cli/platform-zero-trust-uninstall.ts
+/**
+* Uninstall turns off the platform API, and only that API can remove the
+* Cloudflare Access applications project Zero Trust created. The shared
+* project application covers every hostname under the application domain, so
+* a left-over one keeps asking for sign-in on hosts Void no longer serves.
+* Uninstall therefore reads the saved Zero Trust state straight from
+* PostgreSQL, which works whether or not the API still answers, and refuses
+* while anything remains to clean up or the state cannot be read.
+*/
+const ZERO_TRUST_SETTING = "zeroTrust.configuration";
+const ZERO_TRUST_LOCK = "hashtext('zero-trust:configuration')";
+const UNINSTALL_SETTING = "platform.uninstall";
+const LISTED_APPLICATIONS = 20;
+function isRecord(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function optionalText(value, label) {
+	if (value === null || value === void 0) return null;
+	if (typeof value !== "string") throw new Error(`the saved ${label} is malformed`);
+	return value;
+}
+function savedApplication(value, label) {
+	if (value === null || value === void 0) return null;
+	if (!isRecord(value) || typeof value.id !== "string" || typeof value.name !== "string") throw new Error(`the saved ${label} is malformed`);
+	const destinations = Array.isArray(value.destinations) ? value.destinations.filter((entry) => typeof entry === "string") : [];
+	return {
+		id: value.id,
+		name: value.name,
+		destinations
+	};
+}
+/**
+* Interpret the saved configuration and project rows. Anything that does not
+* have the expected shape throws, so the caller refuses instead of guessing.
+*/
+function projectZeroTrustUninstallState(setting, projectRows) {
+	const applications = [];
+	let active = false;
+	let destinations = [];
+	if (setting !== null && setting !== void 0) {
+		if (!isRecord(setting) || typeof setting.enabled !== "boolean") throw new Error("the saved Zero Trust configuration is malformed");
+		const operation = setting.operation ?? null;
+		if (operation !== null && !isRecord(operation)) throw new Error("the saved Zero Trust operation is malformed");
+		active = setting.enabled || operation !== null;
+		const wildcard = savedApplication(setting.wildcardApplication, "shared project application");
+		const health = savedApplication(setting.healthApplication, "health check exception");
+		const wildcardName = optionalText(setting.wildcardApplicationName, "application name");
+		const healthName = optionalText(setting.healthApplicationName, "application name");
+		if (wildcard || active && wildcardName) applications.push({
+			role: "shared project application",
+			id: wildcard?.id ?? null,
+			name: wildcard?.name ?? wildcardName
+		});
+		if (health || active && healthName) applications.push({
+			role: "health check exception",
+			id: health?.id ?? null,
+			name: health?.name ?? healthName
+		});
+		destinations = wildcard?.destinations ?? [];
+	}
+	const unfinishedDeletions = [];
+	for (const row of projectRows) {
+		const deleting = row.project_status === "deleting";
+		const owned = applications.length;
+		if (row.bypass_application_id || row.bypass_application_name) applications.push({
+			role: `public exception for ${row.project_id}`,
+			id: row.bypass_application_id,
+			name: row.bypass_application_name,
+			...deleting ? { deleting } : {}
+		});
+		if (row.protected_application_id || row.protected_application_name) applications.push({
+			role: `custom domain application for ${row.project_id}`,
+			id: row.protected_application_id,
+			name: row.protected_application_name,
+			...deleting ? { deleting } : {}
+		});
+		if (deleting && applications.length > owned) unfinishedDeletions.push(row.project_slug ?? row.project_id);
+	}
+	return {
+		active,
+		destinations,
+		applications,
+		unfinishedDeletions
+	};
+}
+/** Read the project Zero Trust state from the platform database. */
+async function readPlatformProjectZeroTrustStateConnection(client) {
+	const present = (await client.query(`SELECT to_regclass('public.platform_settings') IS NOT NULL AS "settings",
+            to_regclass('public.project_zero_trust') IS NOT NULL AS "projects"`)).rows[0];
+	if (!present) throw new Error("the database did not report its Zero Trust tables");
+	return projectZeroTrustUninstallState(present.settings ? (await client.query("SELECT \"value\" FROM \"platform_settings\" WHERE \"key\" = $1", [ZERO_TRUST_SETTING])).rows[0]?.value : void 0, present.projects ? (await client.query(`SELECT z."project_id", p."slug" AS "project_slug", p."status" AS "project_status",
+                  z."bypass_application_id", z."bypass_application_name",
+                  z."protected_application_id", z."protected_application_name"
+           FROM "project_zero_trust" z
+           LEFT JOIN "projects" p ON p."id" = z."project_id"
+           WHERE z."bypass_application_id" IS NOT NULL
+              OR z."bypass_application_name" IS NOT NULL
+              OR z."protected_application_id" IS NOT NULL
+              OR z."protected_application_name" IS NOT NULL
+           ORDER BY z."project_id"`)).rows : []);
+}
+/**
+* Take the Zero Trust configuration lock exclusively on this session. Every
+* API path that records or creates a Void-managed Access application holds
+* the same lock, so none can commit until the returned release runs.
+*/
+async function lockPlatformProjectZeroTrustConnection(client) {
+	await client.query(`SELECT pg_advisory_lock(${ZERO_TRUST_LOCK})`);
+	let released = false;
+	return async () => {
+		if (released) return;
+		released = true;
+		await client.query(`SELECT pg_advisory_unlock(${ZERO_TRUST_LOCK})`);
+	};
+}
+async function hasSettingsTable(client) {
+	return (await client.query(`SELECT to_regclass('public.platform_settings') IS NOT NULL AS "present"`)).rows[0]?.present === true;
+}
+/**
+* Record that uninstall passed its final check. Runs while the configuration
+* lock is held. An API request admitted before traffic was disabled may be
+* waiting on that lock; once it gets the lock it reads this record and
+* refuses. Without the settings table the API has no Zero Trust writers.
+*/
+async function fencePlatformProjectZeroTrustConnection(client) {
+	if (!await hasSettingsTable(client)) return;
+	await client.query(`INSERT INTO "platform_settings" ("key", "value") VALUES ($1, $2::jsonb)
+     ON CONFLICT ("key") DO UPDATE SET "value" = EXCLUDED."value", "updated_at" = now()`, [UNINSTALL_SETTING, JSON.stringify({ startedAt: (/* @__PURE__ */ new Date()).toISOString() })]);
+}
+/**
+* Remove the uninstall record. Uninstall does this when it stops before
+* disabling traffic; installing or enabling does it before traffic opens.
+*/
+async function liftPlatformProjectZeroTrustFenceConnection(client) {
+	if (!await hasSettingsTable(client)) return;
+	await client.query("DELETE FROM \"platform_settings\" WHERE \"key\" = $1", [UNINSTALL_SETTING]);
+}
+function formatApplications(applications) {
+	const lines = applications.slice(0, LISTED_APPLICATIONS).map((application) => `  ${application.role}: ${application.name ?? "(name not recorded)"}${application.id ? ` (${application.id})` : ""}`);
+	if (applications.length > LISTED_APPLICATIONS) lines.push(`  …and ${applications.length - LISTED_APPLICATIONS} more`);
+	return lines.join("\n");
+}
+const DASHBOARD_HINT = "To lift sign-in right away, delete these applications in the Cloudflare dashboard under Zero Trust → Access → Applications.";
+function unfinishedDeletionLines(state) {
+	if (!state.unfinishedDeletions.length) return [];
+	return [`Deletion of ${state.unfinishedDeletions.length === 1 ? "project" : "projects"} ${state.unfinishedDeletions.join(", ")} stopped before it removed their Access applications. Rerun \`void project delete <name>\` for each, or delete it again from the admin dashboard. This removes their applications, including ones already deleted in the Cloudflare dashboard, and Void's records of them.`];
+}
+/**
+* Refuse to uninstall while project Zero Trust still owns Access applications,
+* or while its state cannot be read. Runs before uninstall changes anything.
+*/
+async function assertProjectZeroTrustAllowsUninstall(read) {
+	let state;
+	try {
+		if (!read) throw new Error("no platform database connection is available");
+		state = await read();
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
+		throw new Error([
+			`platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
+			"Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.",
+			"Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first."
+		].join("\n"));
+	}
+	if (state.active) {
+		const covered = state.destinations.length ? ` on ${state.destinations.join(" and ")}` : " on every hostname under the application domain";
+		throw new Error([
+			"platform: Refusing to uninstall while project Zero Trust is enabled or still changing.",
+			`Uninstall turns off the platform API, so Void could no longer remove its Cloudflare Access applications, and Access would keep asking for sign-in${covered}, including hostnames Void does not serve.`,
+			"Run `void platform zero-trust disable`, rerun it until `void platform zero-trust status` reports Zero Trust disabled with no operation running, then retry the uninstall.",
+			"If the platform API does not answer, bring it back with `void platform enable` or `void platform repair` first.",
+			...state.applications.length ? ["Void-managed Access applications:", formatApplications(state.applications)] : [],
+			...unfinishedDeletionLines(state),
+			DASHBOARD_HINT
+		].join("\n"));
+	}
+	if (state.applications.length) throw new Error([
+		"platform: Refusing to uninstall while Void-managed Access applications from project Zero Trust remain.",
+		"Zero Trust is disabled, but it could not remove the applications of some projects. Retry the uninstall once they are gone.",
+		"Void-managed Access applications:",
+		formatApplications(state.applications),
+		...state.applications.some((application) => !application.deleting) ? [`Hourly maintenance retries ${state.unfinishedDeletions.length ? "the other applications" : "them"} while the platform is enabled, and clears Void's records of any you delete in the dashboard.`] : [],
+		...unfinishedDeletionLines(state),
+		DASHBOARD_HINT
+	].join("\n"));
+}
+//#endregion
 //#region src/cli/platform-installer.ts
 const REMOTE_INSTALLATION_MANIFEST_KEY = PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY;
 const PLATFORM_WORKER_SECRET_UPDATE_NAMES = [
@@ -2530,7 +2872,13 @@ async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory
 }
 async function recoverInterruptedPlatformWorkerCutover(manifest, interruptedCutover, workerActions, configs, previousConfigs, plan, dependencies, ids, zoneId, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	if (interruptedCutover) {
-		for (const key of [...interruptedCutover.staged.keys()].reverse()) {
+		for (const key of [
+			"dispatch",
+			"tail",
+			"emailGateway",
+			"proxy",
+			"api"
+		].filter((key) => interruptedCutover.staged.has(key))) {
 			const snapshot = interruptedCutover.staged.get(key);
 			const preservedRoutes = dependencies.recoverWorkerCutover ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, snapshot.workerName);
 			const recoveryConfig = mergePlatformWorkerTrafficConfig({
@@ -2632,7 +2980,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-	const runPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl);
+	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl);
+	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
@@ -2724,6 +3073,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		writeInstallationManifest(manifest);
 	}
 	assertRequiredPlatformSecrets(plan, manifest, secrets, !!dependencies.prepareAuthentication);
+	if (hyperdriveAction?.action === "create") {
+		parsePostgresConnectionString(secrets.databaseUrl);
+		assertVoidCreatedHyperdriveTrustsDatabase(secrets.databaseUrl);
+	}
 	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
 	writePendingInstallationSecrets(manifest, {
 		...pendingSecrets,
@@ -2846,6 +3199,12 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = transitionInstallation(manifest, "provisioning", now());
 			writeInstallationManifest(manifest);
 		}
+		if (runtime.deploymentExecution !== 1 && (manifest.deploymentExecution === 1 || dependencies.databaseRollbackSource?.manifest.deploymentExecution === 1)) {
+			if (!releaseDatabaseLock.checkpoint) throw new Error("platform: The database lifecycle lock cannot fence deployment admission.");
+			await releaseDatabaseLock.checkpoint(manifest);
+			dependencies.onProgress?.("Verifying durable deployment operations have drained");
+			await (dependencies.verifyDeploymentExecutionDrain ?? verifyPlatformDeploymentExecutionDrain)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce), manifest.id);
+		}
 		if (dependencies.prepareAuthentication) {
 			dependencies.onProgress?.("Preparing platform authentication");
 			try {
@@ -2897,6 +3256,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				client: dependencies.client,
 				manifest,
 				plan,
+				dashboardUrl: platformDashboardUrl(plan.deployment),
 				protection,
 				checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent)
 			});
@@ -2964,11 +3324,6 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
 		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
 		if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
-		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
-		const writeSandboxDrainMirror = async (preparation) => {
-			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
-		};
-		if (sandboxDrainPreparation) await writeSandboxDrainMirror(sandboxDrainPreparation);
 		const sandboxDrainState = sandboxDrainPreparation?.state ?? "complete";
 		if (targetSandboxDrainProtocol >= 1 && (manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol) {
 			manifest = {
@@ -3027,6 +3382,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			accountId: plan.account.id,
 			apiUrl: plan.apiUrl,
 			deployment: plan.deployment,
+			deploymentExecution: runtime.deploymentExecution,
 			healthProbeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
 			installationId: manifest.id,
 			ownershipNonce: manifest.ownershipNonce,
@@ -3075,7 +3431,59 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			};
 			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
 		}
-		for (const key of workerKeys) {
+		const parallelWorkerUploads = !dependencies.deployWorker && !requiresStagedCommit && !workerSecretUpdateIntent && !recoveringUnsafeTraffic && workerActions.length === workerKeys.length && workerActions.every((action) => action.action === "update");
+		let workerManifestQueue = Promise.resolve();
+		let workerManifestFailed = false;
+		let workerManifestFailure;
+		const checkpointWorkerManifest = (update, safetyRecovery = false) => {
+			if (!parallelWorkerUploads) return update();
+			const result = workerManifestQueue.then(async () => {
+				if (workerManifestFailed && !safetyRecovery) throw workerManifestFailure;
+				try {
+					await update();
+				} catch (error) {
+					workerManifestFailed = true;
+					workerManifestFailure = error;
+					throw error;
+				}
+			});
+			workerManifestQueue = result.then(() => void 0, () => void 0);
+			return result;
+		};
+		let availableUploadSlots = 2;
+		let uploadFailure;
+		const uploadWaiters = [];
+		const acquireUploadSlot = async () => {
+			if (uploadFailure !== void 0) throw uploadFailure;
+			if (availableUploadSlots === 0) await new Promise((resolve, reject) => uploadWaiters.push({
+				resolve,
+				reject
+			}));
+			else availableUploadSlots--;
+			return (failure) => {
+				if (failure !== void 0 && uploadFailure === void 0) {
+					uploadFailure = failure;
+					for (const waiter of uploadWaiters.splice(0)) waiter.reject(failure);
+				}
+				const next = uploadFailure === void 0 ? uploadWaiters.shift() : void 0;
+				if (next) next.resolve();
+				else availableUploadSlots++;
+			};
+		};
+		const workerReady = (parallelWorkerUploads ? workerKeys : []).map(() => {
+			let resolve;
+			let reject;
+			return {
+				promise: new Promise((onResolve, onReject) => {
+					resolve = onResolve;
+					reject = onReject;
+				}),
+				resolve,
+				reject
+			};
+		});
+		const uploadBatch = Promise.all(workerReady.map((ready) => ready.promise)).then(() => ({ error: null }), (error) => ({ error }));
+		const deployOneWorker = async (key, waitForPriorWorker, onReadyForActivation) => {
 			dependencies.onProgress?.(`Deploying the ${key} service`);
 			let workerStepStarted = performance.now();
 			const markWorkerStep = (step) => {
@@ -3084,12 +3492,14 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			};
 			const action = workerActions.find((entry) => entry.key === (key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`));
 			const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
-			const intended = recordProvisionIntent(manifest, action, now());
-			if (intended !== manifest) {
-				manifest = intended;
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			}
+			await checkpointWorkerManifest(async () => {
+				const intended = recordProvisionIntent(manifest, action, now());
+				if (intended !== manifest) {
+					manifest = intended;
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				}
+			});
 			await dependencies.revalidateBeforeWorkerDeploy(manifest, action);
 			markWorkerStep("revalidate");
 			const preservedRoutes = dependencies.deployWorker ? [] : action.action === "create" ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
@@ -3098,29 +3508,40 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
 			const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
 				apiBaseUrl: cloudflareApiBaseUrl,
+				...parallelWorkerUploads ? {
+					acquireUploadSlot,
+					onReadyForActivation,
+					waitForPriorWorker
+				} : {},
 				...dependencies.client.request ? { readCloudflare: (path) => dependencies.client.request(path) } : {},
 				onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
-					manifest = recordWorkerCutoverStage(manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
-					writeInstallationManifest(manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					await checkpointWorkerManifest(async () => {
+						manifest = recordWorkerCutoverStage(manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					});
 				},
 				onTrafficPublished: async () => {
 					if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) throw new Error("platform: Cloudflare traffic inventory is unavailable.");
 					const [customDomains, routes] = await Promise.all([dependencies.client.listWorkerDomains(plan.account.id), zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
-					const next = recordPlatformWorkerTraffic(manifest, action.name, {
-						customDomains,
-						routes
-					}, now());
-					if (JSON.stringify(next.resources) !== JSON.stringify(manifest.resources)) {
-						manifest = next;
-						writeInstallationManifest(manifest);
-						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-					}
+					await checkpointWorkerManifest(async () => {
+						const next = recordPlatformWorkerTraffic(manifest, action.name, {
+							customDomains,
+							routes
+						}, now());
+						if (JSON.stringify(next.resources) !== JSON.stringify(manifest.resources)) {
+							manifest = next;
+							writeInstallationManifest(manifest);
+							await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+						}
+					});
 				},
 				onUnsafeTraffic: async () => {
-					manifest = recordWorkerUnsafeTraffic(manifest, workerCutoverGeneration, key, action.name, now());
-					writeInstallationManifest(manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					await checkpointWorkerManifest(async () => {
+						manifest = recordWorkerUnsafeTraffic(manifest, workerCutoverGeneration, key, action.name, now());
+						writeInstallationManifest(manifest);
+						await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+					}, true);
 				},
 				managedRoutes: preserveDisabled ? [] : managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
 				preservedRoutes,
@@ -3140,22 +3561,40 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				retainNewWorker: async () => {
 					await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 				},
-				runner: runPinnedPlatformWrangler,
+				runner: parallelWorkerUploads ? runParallelPinnedPlatformWrangler : runPinnedPlatformWrangler,
 				workerExisted: action.action !== "create"
 			});
 			markWorkerStep("deploy");
 			if (rollback) workerRollbacks.push(rollback);
-			const recorded = recordResource(manifest, action, action.name, "created", now());
-			if (rollback || dependencies.deployWorker || JSON.stringify(recorded.resources) !== JSON.stringify(manifest.resources)) {
-				manifest = recorded;
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			}
+			await checkpointWorkerManifest(async () => {
+				const recorded = recordResource(manifest, action, action.name, "created", now());
+				if (rollback || dependencies.deployWorker || JSON.stringify(recorded.resources) !== JSON.stringify(manifest.resources)) {
+					manifest = recorded;
+					writeInstallationManifest(manifest);
+					await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+				}
+			});
 			markWorkerStep("record");
-		}
+		};
+		if (parallelWorkerUploads) {
+			const tasks = [];
+			for (const [index, key] of workerKeys.entries()) {
+				const priorWorker = tasks.at(-1);
+				const ready = workerReady[index];
+				const task = deployOneWorker(key, priorWorker ? () => priorWorker : void 0, async () => {
+					ready.resolve();
+					const batch = await uploadBatch;
+					if (batch.error !== null) throw batch.error;
+				});
+				task.then(() => ready.resolve(), (error) => ready.reject(error));
+				tasks.push(task);
+			}
+			const firstFailure = (await Promise.allSettled(tasks)).find((result) => result.status === "rejected");
+			if (firstFailure) throw firstFailure.reason;
+		} else for (const key of workerKeys) await deployOneWorker(key);
 		manifest = setInstallationEndpoints(manifest, {
 			apiUrl: plan.apiUrl,
-			dashboardUrl: null,
+			dashboardUrl: platformDashboardUrl(plan.deployment),
 			proxyUrl: plan.proxyUrl
 		}, now());
 		if (preserveDisabled) {
@@ -3166,6 +3605,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = {
 				...manifest,
 				deployment: plan.deployment,
+				deploymentExecution: runtime.deploymentExecution,
 				platformVersion: version,
 				runtime: runtimeProvenance,
 				updatedAt: now(),
@@ -3264,9 +3704,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 					zoneNameServers: zone?.nameServers ?? []
 				};
 			}
-			const completedDrain = await prepareSandboxDrain();
-			if (completedDrain.state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
-			await writeSandboxDrainMirror(completedDrain);
+			if ((await prepareSandboxDrain()).state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
 		}
 		if (requiresStagedCommit) {
 			if (!authenticationCutoverCommitted) {
@@ -3338,6 +3776,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 					retainNewWorker: async () => {
 						await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 					},
+					reuseMatchingVersion: false,
 					runner: runPinnedPlatformWrangler,
 					workerExisted: true
 				});
@@ -3361,6 +3800,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			dependencies.onProgress?.("Preparing shared email routing");
 			emailOperationId = await (dependencies.bootstrapEmail ?? bootstrapPlatformSharedEmail)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce));
 		}
+		await releaseDatabaseLock.liftProjectZeroTrustFence?.();
 		if (dependencies.client.deleteKvValue) await dependencies.client.deleteKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY);
 		else if (wasDisabled || !previousPublicEndpoints) throw new Error("platform: Routing disablement removal is unavailable.");
 		if (requiresStagedCommit) {
@@ -3375,6 +3815,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		manifest = {
 			...manifest,
 			deployment: plan.deployment,
+			deploymentExecution: runtime.deploymentExecution,
 			platformVersion: version,
 			runtime: runtimeProvenance,
 			safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
@@ -3747,6 +4188,14 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWi
 	}
 	if (missing.size > 0) throw new Error(`platform: Creating a missing platform Worker requires: ${[...missing].sort().join(", ")}. Restore these values from your secret manager and retry.`);
 }
+/**
+* A Hyperdrive that Void creates validates the server against public certificate authorities
+* only, so it cannot honor a private CA that the local database client would trust.
+*/
+function assertVoidCreatedHyperdriveTrustsDatabase(databaseUrl) {
+	const sslrootcert = new URL(databaseUrl).searchParams.getAll("sslrootcert").at(-1);
+	if (sslrootcert && sslrootcert !== "system") throw new Error("platform: A Hyperdrive created by Void trusts only public certificate authorities, so it cannot use the certificate authority in DATABASE_URL sslrootcert. If the database certificate comes from a public certificate authority, use sslrootcert=system. Otherwise create a separately managed Hyperdrive that trusts it, then select it with \"Use an existing Hyperdrive\" when you start a new installation, or set VOID_PLATFORM_HYPERDRIVE_ID, VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST, and VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER.");
+}
 /** Make pg's current strict TLS behavior explicit without rewriting saved connection details. */
 function platformDatabaseClientUrl(databaseUrl) {
 	let url;
@@ -3755,7 +4204,13 @@ function platformDatabaseClientUrl(databaseUrl) {
 	} catch {
 		return databaseUrl;
 	}
-	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:" || url.searchParams.getAll("sslmode").at(-1) !== "require" || url.searchParams.getAll("uselibpqcompat").at(-1) === "true") return databaseUrl;
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return databaseUrl;
+	if (url.searchParams.getAll("sslrootcert").at(-1) === "system") {
+		url.searchParams.delete("sslrootcert");
+		url.searchParams.set("sslmode", "verify-full");
+		return url.toString();
+	}
+	if (url.searchParams.getAll("sslmode").at(-1) !== "require" || url.searchParams.getAll("uselibpqcompat").at(-1) === "true") return databaseUrl;
 	url.searchParams.set("sslmode", "verify-full");
 	return url.toString();
 }
@@ -3812,6 +4267,21 @@ async function readPlatformDatabaseLifecycleManifest(databaseUrl, installationId
 		await pool.end();
 	}
 }
+/** Read project Zero Trust state for a plan, which holds no lifecycle lock. */
+async function readPlatformProjectZeroTrustState(databaseUrl, installationId, ownershipNonce) {
+	if (!databaseUrl) throw new Error("the installation database URL is not recorded on this machine");
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	try {
+		await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
+		return await readPlatformProjectZeroTrustStateConnection(pool);
+	} finally {
+		await pool.end();
+	}
+}
 async function inspectPlatformDatabaseStateConnection(client, database) {
 	const relation = await client.query(`SELECT to_regclass('"drizzle"."__drizzle_migrations"')::text AS "relation"`);
 	if (relation.rows.length === 0 || relation.rows[0]?.relation === null) return {
@@ -3939,6 +4409,10 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 			protection: parsePlatformAccessProtection(settings.protection)
 		} : null;
 	};
+	release.readProjectZeroTrust = () => readPlatformProjectZeroTrustStateConnection(client);
+	release.lockProjectZeroTrust = () => lockPlatformProjectZeroTrustConnection(client);
+	release.fenceProjectZeroTrust = () => fencePlatformProjectZeroTrustConnection(client);
+	release.liftProjectZeroTrustFence = () => liftPlatformProjectZeroTrustFenceConnection(client);
 	release.requiredSafetyProtocols = await readRequiredPlatformSafetyProtocols(client);
 	release.checkpoint = async (manifest) => {
 		if (released) throw new Error("platform: Cannot checkpoint lifecycle state after releasing its lock.");
@@ -3980,14 +4454,6 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
 		return {
 			admissionProtocol: row.admission_protocol,
 			generation: row.generation,
-			mirrorValue: JSON.stringify({
-				version: 1,
-				generation: row.generation,
-				state: row.state,
-				startedAt: row.started_at,
-				updatedAt: row.updated_at,
-				...row.completed_at ? { completedAt: row.completed_at } : {}
-			}),
 			state: row.state === "complete" ? "complete" : "pending"
 		};
 	};
@@ -4154,11 +4620,12 @@ let cachedPlatformUploaderHash;
 function platformWorkerUploaderHash() {
 	if (cachedPlatformUploaderHash !== void 0) return cachedPlatformUploaderHash;
 	try {
-		const launcher = resolveWranglerArgv(process.cwd())[1];
+		const launcher = resolveCloudflareOperationArgv(process.cwd())[1];
 		if (!launcher) return cachedPlatformUploaderHash = null;
 		const digest = createHash("sha256");
 		digest.update("platform-uploader:v1\0");
 		digest.update(process.version);
+		digest.update(readFileSync(launcher));
 		digest.update(readFileSync(resolve(dirname(launcher), "..", "..", "package.json")));
 		const cfDirectory = dirname(fileURLToPath(import.meta.resolve("cf/package.json")));
 		digest.update(readFileSync(join(cfDirectory, "package.json")));
@@ -4268,32 +4735,34 @@ function snapshotPlatformWorkerUploadInputs(config, directory) {
 }
 function platformWorkerApiReadRunner(accountId, workerName, readCloudflare, fallback) {
 	const base = `/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
-	return async (args, account, cwd, capture) => {
-		if (args[0] === "deployments" && (args[1] === "status" || args[1] === "list")) {
-			const response = await readCloudflare(`${base}/deployments`);
-			const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
-			if (!Array.isArray(deployments)) throw new Error(`platform: Cloudflare returned malformed deployment history for ${workerName}.`);
-			return {
-				status: args[1] === "status" && deployments.length === 0 ? 1 : 0,
-				stderr: "",
-				stdout: JSON.stringify(args[1] === "status" ? deployments[0] : deployments)
-			};
-		}
-		if (args[0] === "versions" && args[1] === "view" && args[2]) {
-			const version = await readCloudflare(`${base}/versions/${encodeURIComponent(args[2])}`);
-			return {
+	return async (operation, account, cwd, capture) => {
+		try {
+			if (operation.type === "deployments.status" || operation.type === "deployments.list") {
+				const response = await readCloudflare(`${base}/deployments`);
+				const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
+				if (!Array.isArray(deployments)) throw new Error(`platform: Cloudflare returned malformed deployment history for ${workerName}.`);
+				return {
+					status: operation.type === "deployments.status" && deployments.length === 0 ? 1 : 0,
+					stderr: "",
+					stdout: "",
+					data: operation.type === "deployments.status" ? deployments[0] : deployments
+				};
+			}
+			if (operation.type === "versions.view") return {
 				status: 0,
 				stderr: "",
-				stdout: JSON.stringify(version)
+				stdout: "",
+				data: await readCloudflare(`${base}/versions/${encodeURIComponent(operation.versionId)}`)
 			};
-		}
-		return fallback(args, account, cwd, capture);
+		} catch {}
+		return fallback(operation, account, cwd, capture);
 	};
 }
 async function deployPlatformWorker(config, secrets, options) {
 	const directory = mkdtempSync(join(tmpdir(), "void-platform-deploy-"));
 	const workerName = String(config.name);
 	const accountId = String(config.account_id);
+	const readRunner = options.readCloudflare ? platformWorkerApiReadRunner(accountId, workerName, options.readCloudflare, options.runner) : options.runner;
 	let activatedVersionId = null;
 	let activatedDeploymentId = null;
 	let uploadedVersionId = null;
@@ -4305,13 +4774,22 @@ async function deployPlatformWorker(config, secrets, options) {
 	let uploadConfig = withoutPlatformWorkerTrafficAttachments(nextTraffic.wranglerConfig);
 	const nextTriggers = readTriggerConfigFromObject(nextTraffic.wranglerConfig);
 	const contentHash = secrets === null ? platformWorkerUploadFingerprint(config, options.managedRoutes) : null;
+	const reuseMatchingVersion = options.reuseMatchingVersion !== false;
 	let previousTriggers = readTriggerConfigFromObject(previousTraffic.wranglerConfig);
 	try {
 		const configPath = join(directory, "wrangler.json");
 		writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 		const reconcileExistingVersion = async (versionId, triggerConfig, runner, deploymentId) => {
 			try {
-				assertPlatformTriggerStabilization(await stabilizeCloudflareVersionTriggers({
+				if (deploymentId && options.readCloudflare ? await platformWorkerLiveTriggersMatch({
+					accountId,
+					workerName,
+					desired: nextTriggers,
+					readCloudflare: options.readCloudflare
+				}) : false) {
+					const beforeTraffic = await readPlatformWorkerDeployments(configPath, accountId, workerName, runner);
+					if (beforeTraffic[0]?.id !== deploymentId || !deploymentRunsOnlyVersion(beforeTraffic[0], versionId)) throw new Error(`platform: Worker ${workerName} changed deployment lineage during trigger verification.`);
+				} else assertPlatformTriggerStabilization(await stabilizeCloudflareVersionTriggers({
 					configPath,
 					knownTriggerConfigs: { [versionId]: nextTriggers },
 					manageRoutes: false,
@@ -4344,16 +4822,15 @@ async function deployPlatformWorker(config, secrets, options) {
 				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} traffic reconciliation failed: ${errorMessage(error)}${failures.length > 0 ? ` Safety recovery also failed: ${failures.join("; ")}` : ""}`, { cause: error });
 			}
 		};
-		if (options.workerExisted && contentHash && options.readCloudflare) {
-			const directRunner = platformWorkerApiReadRunner(accountId, workerName, options.readCloudflare, options.runner);
+		if (options.workerExisted && contentHash && reuseMatchingVersion && options.readCloudflare) {
 			let candidate;
 			let changedDuringRead = false;
 			try {
-				const before = await readPlatformWorkerDeployments(configPath, accountId, workerName, directRunner);
+				const before = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 				const activeVersion = before[0]?.versions.length === 1 && before[0].versions[0]?.percentage === 100 ? before[0].versions[0].versionId : null;
 				if (!activeVersion) throw new Error(`platform: Existing Worker ${workerName} has no single active production version.`);
-				const snapshot = await readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), activeVersion, directRunner);
-				const after = await readPlatformWorkerDeployments(configPath, accountId, workerName, directRunner);
+				const snapshot = await readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), activeVersion, readRunner);
+				const after = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 				changedDuringRead = before[0]?.id !== after[0]?.id || !deploymentRunsOnlyVersion(after[0], snapshot.versionId);
 				if (!changedDuringRead && snapshot.contentHash === contentHash) candidate = {
 					deploymentId: after[0].id,
@@ -4363,16 +4840,24 @@ async function deployPlatformWorker(config, secrets, options) {
 				if (error instanceof Error && (error.message.includes("changed concurrently") || error.message.includes("does not belong to this installation"))) throw error;
 			}
 			if (changedDuringRead) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
-			if (candidate && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) return await reconcileExistingVersion(candidate.snapshot.versionId, candidate.snapshot.triggerConfig, directRunner, candidate.deploymentId);
+			if (candidate && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) {
+				await options.onReadyForActivation?.();
+				await options.waitForPriorWorker?.();
+				return await reconcileExistingVersion(candidate.snapshot.versionId, candidate.snapshot.triggerConfig, readRunner, candidate.deploymentId);
+			}
 		}
 		if (options.workerExisted) {
-			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), options.runner);
+			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), readRunner);
 			previousVersionId = previous.versionId;
-			const deployments = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+			const deployments = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (!deploymentRunsOnlyVersion(deployments[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
 			previousDeployment = deployments[0];
 			previousDeploymentId = previousDeployment.id;
-			if (contentHash && previous.contentHash === contentHash && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) return await reconcileExistingVersion(previousVersionId, previous.triggerConfig, options.runner);
+			if (contentHash && reuseMatchingVersion && previous.contentHash === contentHash && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) {
+				await options.onReadyForActivation?.();
+				await options.waitForPriorWorker?.();
+				return await reconcileExistingVersion(previousVersionId, previous.triggerConfig, readRunner);
+			}
 			uploadConfig = withoutCompletedPlatformWorkerMigrations(uploadConfig, previous.migrationTag);
 			writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 			previousTriggers = resolvePlatformPreviousTriggerConfig(withoutPlatformCustomDomainTriggers(previous.triggerConfig), previousTriggers, options.previousPublicEndpoints);
@@ -4388,44 +4873,50 @@ async function deployPlatformWorker(config, secrets, options) {
 			};
 			writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 		}
-		const argv = [
-			...options.workerExisted ? ["versions", "upload"] : ["deploy"],
-			"--config",
+		const operation = {
+			type: options.workerExisted ? "versions.upload" : "worker.deploy",
 			configPath,
-			"--strict",
-			"--experimental-provision=false",
-			"--experimental-auto-create=false",
-			...!options.workerExisted ? ["--autoconfig=false"] : [],
-			"--message",
-			encodeCloudflareVersionMessage([], nextTriggers, uploadedContentHash ?? void 0)
-		];
+			message: encodeCloudflareVersionMessage([], nextTriggers, uploadedContentHash ?? void 0)
+		};
 		if (secrets) {
 			const secretsPath = join(directory, "secrets.json");
 			writeFileSync(secretsPath, JSON.stringify(secrets), { mode: 384 });
-			argv.push("--secrets-file", secretsPath);
+			operation.secretsFilePath = secretsPath;
 		}
-		const uploaded = options.workerExisted ? await options.runner(argv, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(argv, accountId, directory, true, workerName, options.apiBaseUrl);
-		uploadedVersionId = parseUploadedPlatformWorkerVersion(`${uploaded.stdout}\n${uploaded.stderr}`);
+		const releaseUploadSlot = await options.acquireUploadSlot?.();
+		let uploaded;
+		let uploadError;
+		try {
+			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl);
+			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
+		} catch (error) {
+			uploadError = error;
+			throw error;
+		} finally {
+			releaseUploadSlot?.(uploadError);
+		}
+		const uploadData = uploaded.data;
+		uploadedVersionId = typeof uploadData?.versionId === "string" ? uploadData.versionId : null;
 		if (!options.workerExisted) activatedVersionId = uploadedVersionId;
-		assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
 		if (!uploadedVersionId) throw new Error(`platform: Wrangler uploaded ${workerName} without reporting its immutable version id.`);
 		await options.onStaged(previousVersionId, uploadedVersionId, previousTriggers);
+		await options.onReadyForActivation?.();
+		await options.waitForPriorWorker?.();
 		if (options.workerExisted) {
-			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (deploymentsBeforeActivation[0]?.id !== previousDeploymentId || !deploymentRunsOnlyVersion(deploymentsBeforeActivation[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently before activation; refusing to overwrite it.`);
 			activatedVersionId = uploadedVersionId;
-			assertCleanPlatformWrangler(await options.runner([
-				"versions",
-				"deploy",
-				`${uploadedVersionId}@100`,
-				"--config",
+			assertCleanPlatformWrangler(await options.runner({
+				type: "versions.deploy",
 				configPath,
-				"--message",
-				`Void platform activation ${uploadedVersionId}`,
-				"--yes"
-			], accountId, directory, true), `activate ${workerName}`);
-		}
-		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, options.runner);
+				versions: [{
+					versionId: uploadedVersionId,
+					percentage: 100
+				}],
+				message: `Void platform activation ${uploadedVersionId}`
+			}, accountId, directory, true), `activate ${workerName}`);
+		}
+		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 		const lineage = classifyPlatformWorkerDeploymentLineage(deploymentsAfterActivation, uploadedVersionId, previousDeploymentId);
 		if (lineage.kind === "concurrent-after") {
 			activatedVersionId = null;
@@ -4445,7 +4936,7 @@ async function deployPlatformWorker(config, secrets, options) {
 					expectedActiveDeploymentId: lineage.deploymentId,
 					expectedActiveVersionId: uploadedVersionId,
 					restoration: interveningDeployment,
-					runner: options.runner,
+					runner: readRunner,
 					workerName
 				});
 			} catch (recoveryError) {
@@ -4471,7 +4962,7 @@ async function deployPlatformWorker(config, secrets, options) {
 				await options.removeCustomDomains();
 				return cleanPlatformCommandResult();
 			},
-			runWrangler: platformWorkerCommandRunner(accountId, directory, options.runner),
+			runWrangler: platformWorkerCommandRunner(accountId, directory, readRunner),
 			targetTriggerConfig: nextTriggers,
 			targetVersionId: uploadedVersionId,
 			workerName
@@ -4495,7 +4986,7 @@ async function deployPlatformWorker(config, secrets, options) {
 			removeCustomDomains: options.removeCustomDomains,
 			publishCustomDomains: options.publishCustomDomains,
 			retainNewWorker: options.retainNewWorker,
-			runner: options.runner,
+			runner: readRunner,
 			workerExisted: options.workerExisted,
 			workerName
 		});
@@ -4522,7 +5013,7 @@ async function deployPlatformWorker(config, secrets, options) {
 				removeCustomDomains: options.removeCustomDomains,
 				publishCustomDomains: options.publishCustomDomains,
 				retainNewWorker: options.retainNewWorker,
-				runner: options.runner,
+				runner: readRunner,
 				workerExisted: options.workerExisted,
 				workerName
 			}) : null,
@@ -4617,27 +5108,24 @@ async function rollbackPlatformWorker(input) {
 	}
 }
 function platformWorkerCommandRunner(accountId, cwd, runner) {
-	return (args, options) => runner(args, accountId, cwd, options.capture);
+	return (operation, options) => runner(operation, accountId, cwd, options.capture);
 }
-async function runPlatformWrangler(args, accountId, cwd, capture) {
-	return runPlatformWranglerAtApiBase(args, accountId, cwd, capture);
+async function runPlatformWrangler(operation, accountId, cwd, capture) {
+	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
 }
 const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl()) {
+async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
 	const startedAt = performance.now();
 	const result = await createDefaultRunWrangler(process.cwd(), {
-		launcher: resolveWranglerArgv(process.cwd()),
+		launcher: resolveCloudflareOperationArgv(process.cwd()),
+		parallelWorkerUpload,
 		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
-	})([...args], {
+	})(operation, {
 		accountId,
 		apiBaseUrl,
-		captureJson: capture,
 		cwd
 	});
-	if (process.env.VOID_PLATFORM_TIMINGS === "1") {
-		const operation = args[0] === "versions" || args[0] === "deployments" ? `${args[0]} ${args[1] ?? ""}` : args[0] ?? "unknown";
-		process.stderr.write(`[platform timing] wrangler ${operation} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
-	}
+	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
 	const stdout = result.stdout || "";
 	const stderr = result.stderr || "";
 	if (!capture && result.status !== 0) {
@@ -4645,7 +5133,7 @@ async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBa
 		if (stderr) process.stderr.write(stderr);
 	}
 	return {
-		status: result.status,
+		...result,
 		stderr,
 		stdout
 	};
@@ -4676,8 +5164,11 @@ async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId,
 	const upstreamBase = new URL(upstreamApiBaseUrl);
 	if (upstreamBase.protocol !== "http:" && upstreamBase.protocol !== "https:") throw new Error("platform: Cloudflare API base URL must use HTTP or HTTPS.");
 	const basePath = upstreamBase.pathname.replace(/\/+$/, "");
-	const expectedPath = `${basePath}/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
+	const accountPath = `${basePath}/accounts/${encodeURIComponent(accountId)}`;
+	const expectedPath = `${accountPath}/workers/scripts/${encodeURIComponent(workerName)}`;
+	const assetUploadPath = `${accountPath}/workers/assets/upload`;
 	const state = {
+		assetSessionStarted: false,
 		attempted: false,
 		conflictStatus: null,
 		created: false,
@@ -4697,7 +5188,9 @@ async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId,
 			const isConditionalCreate = incoming.method === "PUT" && incomingUrl.pathname === expectedPath && supportedCreateQuery;
 			const isTopLevelWorkerUpload = incoming.method === "PUT" && new RegExp(`^${basePath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/accounts/[^/]+/workers/scripts/[^/]+$`).test(incomingUrl.pathname);
 			const isReadOnly = incoming.method === "GET" || incoming.method === "HEAD" || incoming.method === "OPTIONS";
-			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !state.created) {
+			const isAssetUploadSession = incoming.method === "POST" && incomingUrl.pathname === `${expectedPath}/assets-upload-session` && incomingUrl.search === "";
+			const isAssetUpload = incoming.method === "POST" && state.assetSessionStarted && (incomingUrl.pathname === assetUploadPath && incomingUrl.search === "?base64=true" || incomingUrl.search === "" && incomingUrl.pathname.startsWith(`${assetUploadPath}/`) && /^[0-9a-f]{32}$/.test(incomingUrl.pathname.slice(assetUploadPath.length + 1)));
+			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !isAssetUploadSession && !isAssetUpload && !state.created) {
 				state.rejectedMutation = `${incoming.method ?? "UNKNOWN"} ${incomingUrl.pathname}${incomingUrl.pathname === expectedPath && !supportedCreateQuery ? " (unsupported Worker create query)" : ""}`;
 				incoming.resume();
 				outgoing.writeHead(409, { "Content-Type": "application/json" });
@@ -4710,6 +5203,7 @@ async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId,
 				state.attempted = true;
 				headers["if-none-match"] = "*";
 			}
+			if (isAssetUploadSession) state.assetSessionStarted = true;
 			const upstreamUrl = new URL(`${incomingUrl.pathname}${incomingUrl.search}`, upstreamBase.origin);
 			const request$2 = (upstreamUrl.protocol === "https:" ? request$1 : request)(upstreamUrl, {
 				headers,
@@ -4760,48 +5254,30 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
 	return result;
 }
-async function runPlatformWranglerForConditionalCreate(args, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
-	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
+async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
 }
 async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner([
-		"deployments",
-		"status",
-		"--config",
+	const result = await runner({
+		type: "deployments.status",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
 	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
 	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
 	return active[0].version_id;
 }
 async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner([
-		"deployments",
-		"list",
-		"--config",
+	const result = await runner({
+		type: "deployments.list",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
 	return value.map((entry, index) => {
 		if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.created_on !== "string" || !Array.isArray(entry.versions)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
@@ -4836,16 +5312,15 @@ async function restorePlatformWorkerDeployment(input) {
 	if (restorationVersions.length === 0 || restorationVersions.length > 2 || restorationVersions.some((version, index) => version.percentage > 100 || restorationVersions.findIndex((entry) => entry.versionId === version.versionId) !== index) || Math.abs(totalPercentage - 100) > .001) throw new Error(`Worker ${input.workerName} deployment ${input.restoration.id} has an unsupported traffic distribution.`);
 	const before = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (before[0]?.id !== input.expectedActiveDeploymentId || !deploymentRunsOnlyVersion(before[0], input.expectedActiveVersionId) || before[1]?.id !== input.restoration.id || !samePlatformWorkerTraffic(before[1], input.restoration)) throw new Error(`Worker ${input.workerName} changed concurrently before deployment restoration; refusing to overwrite the newer deployment.`);
-	assertCleanPlatformWrangler(await input.runner([
-		"versions",
-		"deploy",
-		...restorationVersions.map((version) => `${version.versionId}@${version.percentage}`),
-		"--config",
-		input.configPath,
-		"--message",
-		`Void platform restoration ${input.restoration.id}`,
-		"--yes"
-	], input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
+	assertCleanPlatformWrangler(await input.runner({
+		type: "versions.deploy",
+		configPath: input.configPath,
+		versions: restorationVersions.map((version) => ({
+			versionId: version.versionId,
+			percentage: version.percentage
+		})),
+		message: `Void platform restoration ${input.restoration.id}`
+	}, input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
 	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
@@ -4901,23 +5376,14 @@ async function readActivePlatformWorkerSnapshot(configPath, accountId, workerNam
 	});
 }
 async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, versionId, runner, validateCurrentVersion) {
-	const result = await runner([
-		"versions",
-		"view",
+	const result = await runner({
+		type: "versions.view",
 		versionId,
-		"--config",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	assertCleanPlatformWrangler(result, `read rollback metadata for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!value || typeof value !== "object") throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
 	const resources = value.resources;
 	const bindings = resources && typeof resources === "object" && !Array.isArray(resources) ? resources.bindings : null;
@@ -4943,11 +5409,8 @@ function withoutCompletedPlatformWorkerMigrations(config, activeMigrationTag) {
 	delete result.migrations;
 	return result;
 }
-function parseUploadedPlatformWorkerVersion(output) {
-	return /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i.exec(output)?.[1] ?? null;
-}
 function assertCleanPlatformWrangler(result, operation) {
-	if (result.status !== 0) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
+	if (result.status !== 0 || result.signal || result.error) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
 }
 function cleanPlatformCommandResult() {
 	return {
@@ -5068,18 +5531,18 @@ function parseWorkerCutoverSnapshot(value) {
 		return null;
 	}
 }
-function interruptedWorkerCutover(manifest) {
+function workerCutoverGenerations(manifest) {
 	const generations = /* @__PURE__ */ new Map();
 	for (const step of manifest.steps) {
 		const resolution = /^worker-cutover:(\d+):(committed|restored)$/.exec(step.key);
 		if (resolution) {
 			const generation = Number(resolution[1]);
 			const entry = generations.get(generation) ?? {
-				resolved: false,
+				resolution: null,
 				staged: /* @__PURE__ */ new Map(),
 				unsafeTraffic: /* @__PURE__ */ new Set()
 			};
-			entry.resolved = true;
+			entry.resolution = resolution[2];
 			generations.set(generation, entry);
 			continue;
 		}
@@ -5087,7 +5550,7 @@ function interruptedWorkerCutover(manifest) {
 		if (unsafeTraffic) {
 			const generation = Number(unsafeTraffic[1]);
 			const entry = generations.get(generation) ?? {
-				resolved: false,
+				resolution: null,
 				staged: /* @__PURE__ */ new Map(),
 				unsafeTraffic: /* @__PURE__ */ new Set()
 			};
@@ -5101,14 +5564,17 @@ function interruptedWorkerCutover(manifest) {
 		const snapshot = parseWorkerCutoverSnapshot(step.resultHash);
 		if (!snapshot) throw new Error(`platform: Invalid Worker cutover checkpoint ${step.key}.`);
 		const entry = generations.get(generation) ?? {
-			resolved: false,
+			resolution: null,
 			staged: /* @__PURE__ */ new Map(),
 			unsafeTraffic: /* @__PURE__ */ new Set()
 		};
 		entry.staged.set(staged[2], snapshot);
 		generations.set(generation, entry);
 	}
-	const unresolved = [...generations.entries()].filter(([, entry]) => !entry.resolved && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
+	return generations;
+}
+function interruptedWorkerCutover(manifest) {
+	const unresolved = [...workerCutoverGenerations(manifest).entries()].filter(([, entry]) => entry.resolution === null && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
 	return unresolved ? {
 		generation: unresolved[0],
 		staged: unresolved[1].staged,
@@ -5122,8 +5588,8 @@ async function verifyPlatformWorkerCutoverVersions(manifest, generation, configs
 	"tail",
 	"dispatch"
 ]) {
-	const cutover = interruptedWorkerCutover(manifest);
-	if (cutover?.generation !== generation || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
+	const cutover = workerCutoverGenerations(manifest).get(generation);
+	if (!cutover || cutover.resolution === "restored" || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
 	const directory = mkdtempSync(join(tmpdir(), "void-platform-cutover-verify-"));
 	try {
 		for (const key of workerKeys) {
@@ -5214,7 +5680,7 @@ async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicatio
 		redirect: "manual",
 		signal: AbortSignal.timeout(3e4)
 	});
-	const dispatchUrl = dispatchOrigin ?? `https://test.${applicationBaseDomain}`;
+	const dispatchUrl = dispatchOrigin ?? `https://${PLATFORM_HEALTH_HOSTNAME_LABEL}.${applicationBaseDomain}`;
 	const [health, discovery, proxy, dispatch, emailGateway] = await Promise.all([
 		request(`${apiUrl}/health`),
 		request(`${apiUrl}/.well-known/void-platform`),
@@ -5259,9 +5725,8 @@ async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fe
 	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
 	return status.state === "complete";
 }
-async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
-	const response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
-		method: "POST",
+async function verifyPlatformDeploymentExecutionDrain(apiUrl, healthProbeToken, installationId, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/__void/platform/deployment-execution`, {
 		headers: {
 			"X-Void-Platform-Probe": healthProbeToken,
 			...cfAccessHeaders(process.env, apiUrl)
@@ -5269,18 +5734,104 @@ async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher =
 		signal: AbortSignal.timeout(3e4),
 		redirect: "manual"
 	});
+	if (!response.ok) throw new Error(`platform: Deployment execution drain probe failed (HTTP ${response.status}). Keep the current runtime until its durable deployment operations have drained.`);
 	let value;
 	try {
 		value = await response.json();
 	} catch {
-		throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		throw new Error("platform: Deployment execution drain probe returned an invalid document.");
 	}
-	const status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (!response.ok || status?.version !== 1 || status.state !== "ready" || typeof status.operationId !== "string" || status.operationId.length === 0) {
-		const detail = status && typeof status.operationId === "string" ? ` Operation ${status.operationId}: ${typeof status.operationStatus === "string" ? status.operationStatus : "incomplete"}.` : status && typeof status.operationStatus === "string" ? ` Operation status: ${status.operationStatus}.` : "";
+	const status = value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+	if (status?.protocolVersion !== 1 || status.installationId !== installationId || typeof status.admissionClosed !== "boolean" || !Number.isSafeInteger(status.pendingDeployments) || Number(status.pendingDeployments) < 0) throw new Error("platform: Deployment execution drain probe returned an invalid document.");
+	if (!status.admissionClosed || status.pendingDeployments !== 0) throw new Error("platform: Durable deployment operations are still admitted or unfinished. Keep the current runtime and retry this command after they finish.");
+}
+async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
+	const deadline = Date.now() + 3e5;
+	let operationId = null;
+	const timedOut = () => /* @__PURE__ */ new Error(`platform: Shared email bootstrap did not finish within five minutes at ${apiUrl}.${operationId ? ` Operation ${operationId} remains incomplete.` : ""} Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+	const waitForProgress = async () => {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		await new Promise((resolve) => setTimeout(resolve, Math.min(1e3, remaining)));
+	};
+	let response;
+	let value;
+	let status;
+	for (;;) {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		const signal = AbortSignal.timeout(Math.min(12e4, remaining));
+		try {
+			response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
+				method: "POST",
+				headers: {
+					"X-Void-Platform-Probe": healthProbeToken,
+					...cfAccessHeaders(process.env, apiUrl)
+				},
+				signal,
+				redirect: "manual"
+			});
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap request failed at ${apiUrl}. Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+		}
+		try {
+			value = await response.json();
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		}
+		status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+		const observedOperationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		if (status?.version === 1 && observedOperationId) {
+			if (operationId && operationId !== observedOperationId) throw new Error("platform: Shared email bootstrap operation identity changed while waiting. Traffic remains disabled. Inspect the installation before retrying.");
+			operationId = observedOperationId;
+		}
+		if ([
+			200,
+			202,
+			503
+		].includes(response.status) && status?.version === 1 && status.state === "incomplete" && observedOperationId && (status.operationStatus === "pending" || status.operationStatus === "running") && status.failureCode == null) {
+			await waitForProgress();
+			continue;
+		}
+		break;
+	}
+	if (!response.ok || status?.version !== 1 || status.state !== "ready" || operationId === null || status.operationId !== operationId || status.operationStatus != null && status.operationStatus !== "completed" || status.failureCode != null) {
+		const code = (value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,63}$/.test(value) ? value : null;
+		const operationStatus = code(status?.operationStatus);
+		const operationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		const details = operationId ? [`Operation ${operationId}: ${operationStatus ?? "incomplete"}.`] : operationStatus ? [`Operation status: ${operationStatus}.`] : [];
+		const currentStep = code(status?.currentStep);
+		const failureCode = code(status?.failureCode);
+		if (currentStep) details.push(`Step: ${currentStep}.`);
+		if (failureCode) details.push(`Failure: ${failureCode}.`);
+		let domain = null;
+		if (typeof status?.domain === "string") try {
+			domain = normalizeApplicationDomain(status.domain);
+		} catch {}
+		const inboundStatus = code(status?.inboundStatus);
+		if (domain) details.push(`Domain: ${domain}${inboundStatus ? ` (inbound: ${inboundStatus})` : ""}.`);
+		const mxDetail = domain ? `MX records for ${domain} do not route mail to Cloudflare Email Routing` : null;
+		const safeDetails = [
+			...domain ? [mxDetail, `enabled explicit Cloudflare email rules conflict with ${domain}`] : [],
+			"zone catch-all does not point to this ingress",
+			"another enabled catch-all owns this zone"
+		];
+		if (typeof status?.failureDetail === "string" && safeDetails.includes(status.failureDetail)) {
+			details.push(`${status.failureDetail}.`);
+			if (currentStep === "inbound_probe" && status.failureDetail === mxDetail) details.push(`Enable Email Routing for ${domain} in the Cloudflare dashboard, then resume this installation.`);
+		}
+		const detail = details.length ? ` ${details.join(" ")}` : "";
 		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
 	}
-	return status.operationId;
+	return operationId;
 }
 function createPlatformHealthProbeToken(ownershipNonce) {
 	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
@@ -5291,7 +5842,7 @@ function answer(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
-async function selectInstallationAuthentication(file, recorded) {
+async function selectInstallationAuthentication(file, recorded, choices = {}) {
 	if (file) {
 		const input = JSON.parse(await readFile(file, "utf8"));
 		if (!input || typeof input !== "object" || Array.isArray(input) || !("connections" in input) || !Array.isArray(input.connections) || !input.connections.length || input.connections.length > 32) throw new Error("platform: An authentication file must define between 1 and 32 connections.");
@@ -5310,9 +5861,12 @@ async function selectInstallationAuthentication(file, recorded) {
 			file: selected
 		};
 	}
-	if (recorded) return { authentication: recorded };
-	if (!process.stdin.isTTY) return { authentication: { providers: ["github"] } };
-	const providers = answer(await multiselect({
+	if (recorded) {
+		if (choices.loginMethods && JSON.stringify(choices.loginMethods) !== JSON.stringify(recorded.providers) || choices.accessProtection !== void 0 && choices.accessProtection !== !!recorded.accessProtection) throw new Error("platform: Resume with the recorded login methods and protection settings.");
+		return { authentication: recorded };
+	}
+	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
+	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : answer(await multiselect({
 		message: "Platform login methods:",
 		initialValues: ["github"],
 		required: true,
@@ -5334,11 +5888,11 @@ async function selectInstallationAuthentication(file, recorded) {
 				label: "Cloudflare Access login"
 			}
 		]
-	}));
-	const protection = answer(await confirm({
+	})));
+	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : answer(await confirm({
 		message: "Also protect the platform UI and APIs with Cloudflare Access?",
 		initialValue: false
-	}));
+	})));
 	return { authentication: {
 		providers,
 		...protection || providers.length !== 1 || providers[0] !== "github" ? { configurable: true } : {},
@@ -5375,6 +5929,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	const accessEntry = entries.find((entry) => entry.configuration.kind === "cloudflare-access");
 	const prepared = access && (selection.authentication.accessProtection || accessEntry && (!selection.file || selection.file.cloudflareAccess)) ? await preparePlatformAccessSetup({
 		plan,
+		...platformDashboardUrl(plan.deployment) ? { additionalOrigins: [platformDashboardUrl(plan.deployment)] } : {},
 		ownershipNonce: access.ownershipNonce,
 		protection: !!selection.authentication.accessProtection,
 		...accessEntry ? { login: {
@@ -5582,13 +6137,13 @@ function platformSetupFieldHelp(key) {
 	switch (key) {
 		case "databaseUrl": return {
 			placeholder: "postgresql://user:pw@…/database",
-			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
+			description: "Stores platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
 				title: "Neon",
 				url: "https://neon.com/"
 			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
 		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32. Save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately. Save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
 		default: return;
 	}
 }
@@ -5706,8 +6261,8 @@ function platformSetupPages(plan) {
 				type: "account"
 			}),
 			instructions: [
-				"Select Object Read & Write (the form defaults to read-only).",
-				"Keep Apply to all buckets in this account (including newly created buckets) selected.",
+				"Select Object Read & Write.",
+				"Keep Apply to all buckets in this account selected.",
 				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
 			].join("\n")
 		}
@@ -5716,16 +6271,20 @@ function platformSetupPages(plan) {
 function formatPlatformSetupPlan(plan) {
 	const pages = platformSetupPages(plan);
 	return [
-		"Credentials needed (paste them into the installer; keep a password-manager copy):",
+		"Credentials needed during installation:",
+		"PostgreSQL database URL",
 		platformSetupLink(pages.runtime),
-		pages.runtime.instructions,
-		"",
 		platformSetupLink(pages.r2),
-		pages.r2.instructions,
+		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github)] : [],
+		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
+		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
+		platformSetupLink({
+			title: "JWT signing key and project encryption key",
+			url: "https://void.cloud/guide/platform/installation/credentials#signing-and-encryption-keys"
+		}),
 		"",
-		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github), pages.github.instructions] : [],
-		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => `${provider === "google" ? "Google OAuth client" : provider === "oidc" ? "OIDC connection" : "Cloudflare Access OIDC application"}: client ID and secret; callback ${plan.apiUrl}/auth/callback.`),
-		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access protection: configure API and proxy origins and admitted installer/CI credentials."] : []
+		"Login callback: " + plan.apiUrl + "/auth/callback",
+		"Installation collects and validates missing credentials after you confirm the plan."
 	].join("\n");
 }
 function formatPlatformInstallCommand(options) {
@@ -5753,10 +6312,18 @@ function formatPlatformInstallCommand(options) {
 			flag("--application-domain", options.applicationDomain);
 			flag("--zone", options.zoneName);
 			if (options.dedicatedZone) parts.push("--dedicated-zone");
+			else parts.push("--no-dedicated-zone");
 		}
 		flag("--control-plane-domain", options.controlPlaneDomain);
+		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
 	}
+	flag("--hyperdrive", options.hyperdrive ?? "");
 	flag("--auth-config", options.authConfig ?? "");
+	if (!options.authConfig && !options.resumeId && options.authentication) {
+		flag("--login-methods", options.authentication.providers.join(","));
+		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
+	}
+	flag("--dashboard-url", options.dashboardUrl ?? "");
 	flag("--runtime", options.runtime);
 	if (options.yes) parts.push("--yes");
 	return parts.join(" ");
@@ -5816,14 +6383,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-CU1JtJkW.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-BNkcz0OB.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-dvUaptLr.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-D6KSpuFm.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -5833,7 +6400,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-C8tt6D8h.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-CnyTdcWX.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -5948,9 +6515,9 @@ async function runPlatformLifecycleCommand(args) {
 	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", "example.app")));
 	const zoneName = recorded?.application.zoneName ?? (workersDev ? "" : normalizeApplicationDomain(args.zone || await promptText("Cloudflare zone:", applicationDomain)));
 	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationSlug} Void`));
-	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY ? await promptText("Optional custom API hostname (leave empty for workers.dev):", "", true) : "");
+	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY && !args.noControlPlaneDomain ? await promptText("Custom API hostname. Leave empty for workers.dev:", "", true) : "");
 	let dedicatedZone = recorded?.application.dedicatedZone ?? args.dedicatedZone;
-	if (!workersDev && !recorded && !args.dedicatedZone && applicationDomain === zoneName && process.stdin.isTTY) {
+	if (!workersDev && !recorded && !args.dedicatedZone && !args.dedicatedZoneSpecified && applicationDomain === zoneName && process.stdin.isTTY) {
 		const catchAll = await confirm({
 			message: `Dedicate all unmatched ${zoneName} traffic to Void apps?`,
 			initialValue: false
@@ -5992,11 +6559,12 @@ async function runPlatformLifecycleCommand(args) {
 			host: externalHyperdriveHost,
 			user: externalHyperdriveUser
 		} : void 0;
-		if (!externalHyperdrive && process.stdin.isTTY && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
+		if (args.hyperdrive && externalHyperdrive && args.hyperdrive !== externalHyperdrive.id) throw new Error("platform: --hyperdrive conflicts with VOID_PLATFORM_HYPERDRIVE_ID.");
+		if (!externalHyperdrive && args.hyperdrive !== "create" && (process.stdin.isTTY || args.hyperdrive) && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
 			const suggestedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
 			const configurations = await client.listHyperdriveConfigs(accountId);
 			const suggestedNameAvailable = !configurations.some((resource) => resource.name === suggestedName);
-			const choice = await select({
+			const choice = args.hyperdrive ? "existing" : await select({
 				message: "How should Void set up Hyperdrive?",
 				options: [
 					...configurations.length > 0 ? [{
@@ -6016,12 +6584,12 @@ async function runPlatformLifecycleCommand(args) {
 			});
 			if (isCancel(choice)) throw new Error("platform: Cancelled.");
 			if (choice === "setup") {
-				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` (for example ${suggestedName})` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
 				outro("No Cloudflare or local installation state was changed.");
 				return;
 			}
 			if (choice === "existing") {
-				const selectedId = await select({
+				const selectedId = args.hyperdrive ?? await select({
 					message: "Which Hyperdrive should Void use?",
 					options: [...configurations].sort((a, b) => Number(b.name === suggestedName) - Number(a.name === suggestedName) || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)).map((resource) => ({
 						value: resource.id,
@@ -6036,7 +6604,7 @@ async function runPlatformLifecycleCommand(args) {
 				if (live.id !== selected.id || live.name !== selected.name || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${selected.name}.`);
 				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${live.name}`);
 				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${live.name} before installing.`);
-				const confirmed = await confirm({
+				const confirmed = args.hyperdrive ? true : await confirm({
 					message: `Use ${live.name} for this platform?`,
 					initialValue: true
 				});
@@ -6057,7 +6625,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-C8tt6D8h.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CnyTdcWX.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -6065,12 +6633,13 @@ async function runPlatformLifecycleCommand(args) {
 				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
 			}
 		}
-		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication);
+		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication, args);
 		const planInput = {
 			authentication: authenticationSelection.authentication,
 			accountId,
 			applicationDomain,
 			controlPlaneDomain,
+			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
 			dedicatedZone,
 			displayName,
 			...externalHyperdrive ? { externalHyperdrive } : {},
@@ -6084,13 +6653,15 @@ async function runPlatformLifecycleCommand(args) {
 			authoritativeProvisionIntents,
 			allowUnverifiedAiGateway: true,
 			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
-			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
+			deploymentExecution: runtime.manifest.deploymentExecution === 1
 		});
 		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
 		note(formatPlatformRuntime(runtime), "Platform runtime");
 		if (args.plan) {
 			console.log(formatPlatformSetupPlan(plan));
-			console.log(`\n${existing ? "To resume this installation later:" : "To install with these settings later:"}\n${formatPlatformInstallCommand({
+			outro("Plan complete. No installation changes were made.");
+			console.log(`\n${import_picocolors$1.default.bold(import_picocolors$1.default.cyan(existing ? "Next step: run this command to resume" : "Next step: run this command to install"))}\n\n${import_picocolors$1.default.cyan(formatPlatformInstallCommand({
 				commandName: cliCommandName(),
 				accountId,
 				installationSlug,
@@ -6098,15 +6669,16 @@ async function runPlatformLifecycleCommand(args) {
 				applicationDomain,
 				zoneName,
 				controlPlaneDomain,
+				...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
 				dedicatedZone,
 				workersDev,
 				authConfig: args.authConfig,
+				authentication: authenticationSelection.authentication,
+				hyperdrive: !existing || isPlatformSetupDraft(existing) ? externalHyperdrive?.id ?? "create" : void 0,
 				runtime: args.runtime,
 				...existing ? { resumeId: existing.id } : {},
 				yes: args.yes || process.stdin.isTTY !== true
-			})}\n`);
-			if (!existing && !args.authConfig && process.stdin.isTTY) console.log("Choose the same login methods when prompted.\n");
-			outro("No Cloudflare or local installation state was changed.");
+			}))}\n`);
 			return;
 		}
 		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
@@ -6282,11 +6854,12 @@ async function runPlatformLifecycleCommand(args) {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
 				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
-				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
+				deploymentExecution: runtime.manifest.deploymentExecution === 1
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-C8tt6D8h.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CnyTdcWX.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -6298,7 +6871,7 @@ async function runPlatformLifecycleCommand(args) {
 				});
 			}
 		});
-		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused; progress is saved." : "Platform installed.");
+		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused. Progress is saved." : "Platform installed.");
 		progress = void 0;
 		if (result.waitingForDns) {
 			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, "Waiting for nameservers");
@@ -6306,13 +6879,13 @@ async function runPlatformLifecycleCommand(args) {
 			return;
 		}
 		if (result.waitingForSandboxDrain) {
-			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`; follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
+			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`. Follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
 		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 		log.info(`API URL: ${plan.apiUrl}`);
-		if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
+		if (result.emailOperationId) log.info(`Shared email routing ready. Operation: ${result.emailOperationId}.`);
 		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
 		if (result.setupPending && completedAuthCode) {
 			log.info(`First administrator setup: ${plan.apiUrl}/setup`);
@@ -6352,7 +6925,8 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 		verified = await createPlatformInstallPlan(client, input, existing, {
 			authoritativeProvisionIntents,
 			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker"),
-			enableSandbox: preview.deployment.capabilities.sandbox
+			enableSandbox: preview.deployment.capabilities.sandbox,
+			deploymentExecution: preview.actions.some((entry) => entry.key === "deployment-queue")
 		});
 	} catch (error) {
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
@@ -6426,4 +7000,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { hyperdriveOriginFromConnectionString as A, assertPlatformOperatorCredentialCanApplyPlan as C, preparePlatformAccessSetup as D, parsePlatformAccessSetupSpec as E, verifyPlatformRuntimeTokenPermissions as M, PlatformCloudflareClient as O, platformDatabaseNameFromOwnerUrl as S, checkpointPlatformAccessResources as T, createPlatformInstallPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, platformProvisionIntentHash as b, createPlatformHealthProbeToken as c, loadPlatformRuntime as d, platformDatabaseClientUrl as f, trackedPlatformWorkerTraffic as g, recordPlatformWorkerTraffic as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginMatches as j, hyperdriveOriginConfigHash as k, createPlatformInstallationSecrets as l, resolveBootstrapGitHubId as m, resolvePlatformInstallDatabaseUrl as n, acquirePlatformDatabaseLifecycleLock as o, recordResource as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLockConnection as s, assertNoninteractivePlatformMutationAcknowledged as t, installPlatform as u, formatPlatformInstallPlan as v, resolvePlatformCloudflareCredential as w, revalidatePlatformInstallAction as x, platformAdoptionIntentHash as y };
+export { PlatformCloudflareClient as A, revalidatePlatformInstallAction as C, checkpointPlatformAccessResources as D, resolvePlatformCloudflareCredential as E, hyperdriveOriginFromConnectionString as M, hyperdriveOriginMatches as N, parsePlatformAccessSetupSpec as O, verifyPlatformRuntimeTokenPermissions as P, platformProvisionIntentHash as S, assertPlatformOperatorCredentialCanApplyPlan as T, recordPlatformWorkerTraffic as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, formatPlatformInstallPlan as b, createPlatformHealthProbeToken as c, loadPlatformRuntime as d, platformDatabaseClientUrl as f, assertProjectZeroTrustAllowsUninstall as g, resolveBootstrapGitHubId as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginConfigHash as j, preparePlatformAccessSetup as k, createPlatformInstallationSecrets as l, recordResource as m, resolvePlatformInstallDatabaseUrl as n, acquirePlatformDatabaseLifecycleLock as o, readPlatformProjectZeroTrustState as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLockConnection as s, assertNoninteractivePlatformMutationAcknowledged as t, installPlatform as u, trackedPlatformWorkerTraffic as v, platformDatabaseNameFromOwnerUrl as w, platformAdoptionIntentHash as x, createPlatformInstallPlan as y };