void 0.22.0 → 0.23.0

package/dist/{platform-lifecycle-k0E0xoxx.mjs → platform-lifecycle-9OyBALhH.mjs}

@@ -2,20 +2,20 @@ import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
+import { d as openBrowser } from "./auth-CSkdO2Bb.mjs";
 import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
 import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
 import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-CTBk70IR.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
-import { s as runCloudflareAuthCommand } from "./cloudflare-auth-DQkqoMYa.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-C4IGqkBf.mjs";
+import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-CJFgTZY8.mjs";
 import { c as import_picocolors$1, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { readFile } from "node:fs/promises";
@@ -717,6 +717,14 @@ function text(value, name) {
 	if (typeof value !== "string" || !value || value.length > 8192) throw new Error(`platform: Cloudflare Access did not return ${name}.`);
 	return value;
 }
+function platformAccessIdentityProvider(provider) {
+	const id = text(provider.id, "identity provider ID");
+	const name = provider.name;
+	return {
+		id,
+		name: name == null || typeof name === "string" && !name.trim() ? id : text(name, "identity provider name")
+	};
+}
 function ids(value) {
 	if (!Array.isArray(value)) return [];
 	return value.map((entry) => typeof entry === "string" ? entry : text(object(entry, "policy").id, "policy ID"));
@@ -846,10 +854,7 @@ async function inspectPlatformAccess(client, input) {
 			audience: "validation"
 		}]
 	});
-	const identityProviders = (await client.list("identity_providers")).map((provider) => ({
-		id: text(provider.id, "identity provider ID"),
-		name: text(provider.name ?? provider.id, "identity provider name")
-	}));
+	const identityProviders = (await client.list("identity_providers")).map(platformAccessIdentityProvider);
 	if (!input.identityProviderIds.length || !input.policyIds.length || input.identityProviderIds.length > 16 || input.policyIds.length > 16 || new Set(input.identityProviderIds).size !== input.identityProviderIds.length || new Set(input.policyIds).size !== input.policyIds.length) throw new Error("platform: Select explicit identity providers and company policies for Access.");
 	if (input.identityProviderIds.some((id) => !identityProviders.some((provider) => provider.id === id))) throw new Error("platform: A selected Access identity provider is unavailable in this account.");
 	const policies = await Promise.all(input.policyIds.map(async (id) => object(await client.get(`policies/${encodeURIComponent(id)}`), "Access policy")));
@@ -1277,9 +1282,9 @@ async function preparePlatformAccessSetup(input) {
 	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
 		message: "Company identity providers:",
 		required: true,
-		options: providers.filter((provider) => typeof provider.id === "string").map((provider) => ({
-			value: String(provider.id),
-			label: stripVTControlCharacters(String(provider.name ?? provider.id))
+		options: providers.filter((provider) => typeof provider.id === "string").map(platformAccessIdentityProvider).map((provider) => ({
+			value: provider.id,
+			label: stripVTControlCharacters(provider.name)
 		}))
 	})) : []);
 	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
@@ -1417,9 +1422,9 @@ async function resolvePlatformCloudflareCredentialWithInput(readInput, dependenc
 			input,
 			credential: result.credential
 		};
-		const login = await runWrangler(["login"], false);
+		const login = await runWrangler({ type: "auth.login" }, false);
 		assertNotCancelled();
-		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
+		if (login.status !== 0 || login.signal || login.error) throw new Error("platform: Cloudflare browser login did not complete.");
 		const credential = await readWranglerOAuthCredential(runWrangler);
 		assertNotCancelled();
 		if (!credential) throw new Error("platform: Cloudflare sign-in completed without a usable OAuth credential.");
@@ -1442,15 +1447,11 @@ async function readExistingCredential(dependencies, runWrangler) {
 	return await readWranglerOAuthCredential(runWrangler);
 }
 async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
-	const result = await runWrangler([
-		"auth",
-		"token",
-		"--json"
-	], true);
-	if (result.status !== 0) return null;
+	const result = await runWrangler({ type: "auth.token" }, true);
+	if (result.status !== 0 || result.signal || result.error) return null;
 	try {
-		const parsed = JSON.parse(result.stdout);
-		if (parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+		const parsed = result.data;
+		if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
 		return {
 			source: "oauth",
 			token: parsed.token.trim()
@@ -1490,6 +1491,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	if ([
 		input.plan.apiUrl,
 		input.plan.proxyUrl,
+		...input.dashboardUrl ? [input.dashboardUrl] : [],
 		...input.manifest.endpoints.dashboardUrl ? [input.manifest.endpoints.dashboardUrl] : []
 	].map((value) => new URL(value).origin).some((origin) => !origins.includes(origin)) || protection.applications.some((entry) => entry.audience !== app.aud || !platformAccessPublicDestinations(app).includes(new URL(entry.origin).hostname))) throw new Error("platform: Access audiences and complete origin coverage must match the active platform protection. Restore the current Access checkpoint or repair its applications.");
 	for (const other of await access.list("apps")) {
@@ -1505,7 +1507,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-7d5aV2Jg.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BDWO_aER.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1598,6 +1600,7 @@ async function verifyPlatformAuthenticationDatabase(client, accountId, resource,
 //#endregion
 //#region src/cli/platform-plan.ts
 async function createPlatformInstallPlan(client, input, existing, options) {
+	const dashboardUrl = input.dashboardUrl !== void 0 ? normalizePlatformDashboardUrl(input.dashboardUrl) : existing ? existing.deployment.controlPlane.dashboardUrl ?? (existing.endpoints.dashboardUrl ? normalizePlatformDashboardUrl(existing.endpoints.dashboardUrl) : null) ?? platformDashboardUrl(existing.deployment) : null;
 	const account = resolveAccount(await client.listAccounts(), input.accountId);
 	if (existing && existing.account.id !== account.id) throw new Error(`platform: Refusing to resume installation ${existing.id} in a different Cloudflare account.`);
 	const providedEmailSharedZoneId = input.emailSharedZoneId?.trim();
@@ -1646,7 +1649,8 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		},
 		controlPlane: {
 			apiHostname: input.controlPlaneDomain || null,
-			dashboardHostname: null,
+			dashboardHostname: dashboardUrl ? new URL(dashboardUrl).hostname : null,
+			...dashboardUrl ? { dashboardUrl } : {},
 			proxyHostname: null
 		},
 		displayName: input.displayName,
@@ -1664,13 +1668,21 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			sandbox: true
 		}
 	} : existingWithoutEmailZone;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithDashboard = {
 		...existingWithSandbox,
+		controlPlane: {
+			...existingWithSandbox.controlPlane,
+			dashboardHostname: deployment.controlPlane.dashboardHostname,
+			...deployment.controlPlane.dashboardUrl ? { dashboardUrl: deployment.controlPlane.dashboardUrl } : {}
+		}
+	};
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithDashboard,
 		capabilities: {
-			...existingWithSandbox.capabilities,
+			...existingWithDashboard.capabilities,
 			email: true
 		}
-	} : existingWithSandbox;
+	} : existingWithDashboard;
 	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
@@ -1694,7 +1706,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		}
 		throw error;
 	});
-	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
+	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, deploymentQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
 		Promise.resolve(accountSubdomain),
 		gatewayInventory,
 		client.listKvNamespaces(account.id, names.routingKv),
@@ -1703,6 +1715,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		client.listR2Buckets(account.id),
 		client.listQueues(account.id, names.usageQueue),
 		client.listQueues(account.id, names.cronQueue),
+		options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue") ? client.listQueues(account.id, names.deploymentQueue) : Promise.resolve([]),
 		client.listDispatchNamespaces(account.id),
 		client.listHyperdriveConfigs(account.id),
 		client.listWorkerNames(account.id)
@@ -1737,11 +1750,13 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		const expectedPatterns = new Set(createApplicationRoutes(deployment.application).map((route) => route.pattern));
 		const expectedWorker = deployment.resources.dispatchWorker;
 		const ownedWorker = intentProofs.has("dispatch-worker") || existing?.resources.some((resource) => resource.key === "dispatch-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
-		const conflicts = (await client.listWorkerRoutes(zone.id)).filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
+		const [workerRoutes, workerDomains] = await Promise.all([client.listWorkerRoutes(zone.id), client.listWorkerDomains(account.id)]);
+		const conflicts = workerRoutes.filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
 		if (conflicts.length > 0) {
 			const conflict = conflicts[0];
 			throw new Error(`platform: Application route ${JSON.stringify(conflict.pattern)} is already assigned to ${JSON.stringify(conflict.script ?? "no Worker")}. Choose another application domain.`);
 		}
+		assertApplicationRoutesPreserveWorkerDomains([...expectedPatterns], expectedWorker, ownedWorker === true, zone.name, workerRoutes, workerDomains);
 	}
 	if (deployment.controlPlane.apiHostname) {
 		const apiHostname = deployment.controlPlane.apiHostname;
@@ -1784,6 +1799,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	addNamedPlan(actions, existing, "assets-bucket", "r2-bucket", names.assetsBucket, r2Buckets.filter((resource) => resource.name === names.assetsBucket), "reuse", options, remoteOwnership, intentProofs, ambiguousResources);
 	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
+	if (options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue")) addNamedPlan(actions, existing, "deployment-queue", "queue", names.deploymentQueue, deploymentQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
 	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
 	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
@@ -1861,7 +1877,8 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 	}, manifest, {
 		...options,
 		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker"),
-		enableSandbox: original.deployment.capabilities.sandbox
+		enableSandbox: original.deployment.capabilities.sandbox,
+		deploymentExecution: original.actions.some((entry) => entry.key === "deployment-queue")
 	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
@@ -2055,6 +2072,7 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"api-worker": "apiWorker",
 	"assets-bucket": "assetsBucket",
 	"cron-queue": "cronQueue",
+	"deployment-queue": "deploymentQueue",
 	"dispatch-namespace": "dispatchNamespace",
 	"dispatch-worker": "dispatchWorker",
 	hyperdrive: "hyperdrive",
@@ -2066,6 +2084,33 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"tail-worker": "tailWorker",
 	"usage-queue": "usageQueue"
 };
+function assertApplicationRoutesPreserveWorkerDomains(patterns, dispatchWorker, ownedDispatchWorker, zoneName, workerRoutes, workerDomains) {
+	const plannedRoutes = patterns.map(parseWorkerRoutePattern);
+	const existingRoutes = workerRoutes.map((route) => ({
+		...parseWorkerRoutePattern(route.pattern),
+		script: route.script
+	}));
+	for (const domain of workerDomains) {
+		const hostname = domain.hostname.toLowerCase();
+		if (!(domain.zoneName ? domain.zoneName.toLowerCase() === zoneName.toLowerCase() : hostname === zoneName.toLowerCase() || hostname.endsWith(`.${zoneName.toLowerCase()}`)) || domain.service === dispatchWorker && ownedDispatchWorker) continue;
+		for (const planned of plannedRoutes) {
+			if (!workerRouteHostMatches(planned.host, hostname)) continue;
+			if (!["http", "https"].every((scheme) => existingRoutes.some((route) => route.script !== dispatchWorker && route.path === "/*" && (!route.scheme || route.scheme === scheme) && workerRouteHostMatches(route.host, hostname) && route.host.replace(/^\*/, "").length > planned.host.replace(/^\*/, "").length))) throw new Error(`platform: Application route ${JSON.stringify(planned.pattern)} would intercept Worker custom domain ${JSON.stringify(domain.hostname)}, currently served by ${JSON.stringify(domain.service)}. Choose another application domain, or use \`void platform install --workers-dev\` for a new installation and add a suitable domain later.`);
+		}
+	}
+}
+function parseWorkerRoutePattern(pattern) {
+	const match = /^(?:(https?):\/\/)?([^/]+)(\/.*)?$/.exec(pattern);
+	return {
+		host: match?.[2]?.toLowerCase() ?? "",
+		path: match?.[3] ?? "/",
+		pattern,
+		scheme: match?.[1] ?? null
+	};
+}
+function workerRouteHostMatches(host, hostname) {
+	return host.startsWith("*") ? hostname.endsWith(host.slice(1)) : host === hostname;
+}
 function platformProvisionIntentHash(manifest, key, kind, name, previousResourceId = null) {
 	return createHash("sha256").update(JSON.stringify({
 		key,
@@ -2101,10 +2146,12 @@ async function readRemoteOwnership(client, accountId, routingNamespaces, existin
 }
 function formatPlatformInstallPlan(plan) {
 	const lines = [
-		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)} (${plan.account.id})`,
-		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev (testing); add a domain with void platform domain set <domain>`,
+		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
+		`${import_picocolors$1.default.bold("Account:")} ${plan.account.id}`,
+		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev for testing. Add a domain with void platform domain set <domain>`,
 		`${import_picocolors$1.default.bold("Control plane:")} ${plan.apiUrl}`,
 		`${import_picocolors$1.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
+		...platformDashboardUrl(plan.deployment) ? [`${import_picocolors$1.default.bold("Dashboard:")} ${platformDashboardUrl(plan.deployment)} (deploy separately)`] : [],
 		`${import_picocolors$1.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
 		`${import_picocolors$1.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
 		`${import_picocolors$1.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
@@ -2933,8 +2980,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-	const runPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl);
-	const runParallelPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl, true);
+	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl);
+	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
@@ -3152,6 +3199,12 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = transitionInstallation(manifest, "provisioning", now());
 			writeInstallationManifest(manifest);
 		}
+		if (runtime.deploymentExecution !== 1 && (manifest.deploymentExecution === 1 || dependencies.databaseRollbackSource?.manifest.deploymentExecution === 1)) {
+			if (!releaseDatabaseLock.checkpoint) throw new Error("platform: The database lifecycle lock cannot fence deployment admission.");
+			await releaseDatabaseLock.checkpoint(manifest);
+			dependencies.onProgress?.("Verifying durable deployment operations have drained");
+			await (dependencies.verifyDeploymentExecutionDrain ?? verifyPlatformDeploymentExecutionDrain)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce), manifest.id);
+		}
 		if (dependencies.prepareAuthentication) {
 			dependencies.onProgress?.("Preparing platform authentication");
 			try {
@@ -3203,6 +3256,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				client: dependencies.client,
 				manifest,
 				plan,
+				dashboardUrl: platformDashboardUrl(plan.deployment),
 				protection,
 				checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent)
 			});
@@ -3270,11 +3324,6 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
 		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
 		if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
-		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
-		const writeSandboxDrainMirror = async (preparation) => {
-			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
-		};
-		if (sandboxDrainPreparation) await writeSandboxDrainMirror(sandboxDrainPreparation);
 		const sandboxDrainState = sandboxDrainPreparation?.state ?? "complete";
 		if (targetSandboxDrainProtocol >= 1 && (manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol) {
 			manifest = {
@@ -3333,6 +3382,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			accountId: plan.account.id,
 			apiUrl: plan.apiUrl,
 			deployment: plan.deployment,
+			deploymentExecution: runtime.deploymentExecution,
 			healthProbeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
 			installationId: manifest.id,
 			ownershipNonce: manifest.ownershipNonce,
@@ -3544,7 +3594,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		} else for (const key of workerKeys) await deployOneWorker(key);
 		manifest = setInstallationEndpoints(manifest, {
 			apiUrl: plan.apiUrl,
-			dashboardUrl: null,
+			dashboardUrl: platformDashboardUrl(plan.deployment),
 			proxyUrl: plan.proxyUrl
 		}, now());
 		if (preserveDisabled) {
@@ -3555,6 +3605,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = {
 				...manifest,
 				deployment: plan.deployment,
+				deploymentExecution: runtime.deploymentExecution,
 				platformVersion: version,
 				runtime: runtimeProvenance,
 				updatedAt: now(),
@@ -3653,9 +3704,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 					zoneNameServers: zone?.nameServers ?? []
 				};
 			}
-			const completedDrain = await prepareSandboxDrain();
-			if (completedDrain.state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
-			await writeSandboxDrainMirror(completedDrain);
+			if ((await prepareSandboxDrain()).state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
 		}
 		if (requiresStagedCommit) {
 			if (!authenticationCutoverCommitted) {
@@ -3766,6 +3815,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		manifest = {
 			...manifest,
 			deployment: plan.deployment,
+			deploymentExecution: runtime.deploymentExecution,
 			platformVersion: version,
 			runtime: runtimeProvenance,
 			safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
@@ -4404,14 +4454,6 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
 		return {
 			admissionProtocol: row.admission_protocol,
 			generation: row.generation,
-			mirrorValue: JSON.stringify({
-				version: 1,
-				generation: row.generation,
-				state: row.state,
-				startedAt: row.started_at,
-				updatedAt: row.updated_at,
-				...row.completed_at ? { completedAt: row.completed_at } : {}
-			}),
 			state: row.state === "complete" ? "complete" : "pending"
 		};
 	};
@@ -4578,11 +4620,12 @@ let cachedPlatformUploaderHash;
 function platformWorkerUploaderHash() {
 	if (cachedPlatformUploaderHash !== void 0) return cachedPlatformUploaderHash;
 	try {
-		const launcher = resolveWranglerArgv(process.cwd())[1];
+		const launcher = resolveCloudflareOperationArgv(process.cwd())[1];
 		if (!launcher) return cachedPlatformUploaderHash = null;
 		const digest = createHash("sha256");
 		digest.update("platform-uploader:v1\0");
 		digest.update(process.version);
+		digest.update(readFileSync(launcher));
 		digest.update(readFileSync(resolve(dirname(launcher), "..", "..", "package.json")));
 		const cfDirectory = dirname(fileURLToPath(import.meta.resolve("cf/package.json")));
 		digest.update(readFileSync(join(cfDirectory, "package.json")));
@@ -4692,28 +4735,27 @@ function snapshotPlatformWorkerUploadInputs(config, directory) {
 }
 function platformWorkerApiReadRunner(accountId, workerName, readCloudflare, fallback) {
 	const base = `/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
-	return async (args, account, cwd, capture) => {
+	return async (operation, account, cwd, capture) => {
 		try {
-			if (args[0] === "deployments" && (args[1] === "status" || args[1] === "list")) {
+			if (operation.type === "deployments.status" || operation.type === "deployments.list") {
 				const response = await readCloudflare(`${base}/deployments`);
 				const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
 				if (!Array.isArray(deployments)) throw new Error(`platform: Cloudflare returned malformed deployment history for ${workerName}.`);
 				return {
-					status: args[1] === "status" && deployments.length === 0 ? 1 : 0,
+					status: operation.type === "deployments.status" && deployments.length === 0 ? 1 : 0,
 					stderr: "",
-					stdout: JSON.stringify(args[1] === "status" ? deployments[0] : deployments)
-				};
-			}
-			if (args[0] === "versions" && args[1] === "view" && args[2]) {
-				const version = await readCloudflare(`${base}/versions/${encodeURIComponent(args[2])}`);
-				return {
-					status: 0,
-					stderr: "",
-					stdout: JSON.stringify(version)
+					stdout: "",
+					data: operation.type === "deployments.status" ? deployments[0] : deployments
 				};
 			}
+			if (operation.type === "versions.view") return {
+				status: 0,
+				stderr: "",
+				stdout: "",
+				data: await readCloudflare(`${base}/versions/${encodeURIComponent(operation.versionId)}`)
+			};
 		} catch {}
-		return fallback(args, account, cwd, capture);
+		return fallback(operation, account, cwd, capture);
 	};
 }
 async function deployPlatformWorker(config, secrets, options) {
@@ -4831,27 +4873,21 @@ async function deployPlatformWorker(config, secrets, options) {
 			};
 			writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 		}
-		const argv = [
-			...options.workerExisted ? ["versions", "upload"] : ["deploy"],
-			"--config",
+		const operation = {
+			type: options.workerExisted ? "versions.upload" : "worker.deploy",
 			configPath,
-			"--strict",
-			"--experimental-provision=false",
-			"--experimental-auto-create=false",
-			...!options.workerExisted ? ["--autoconfig=false"] : [],
-			"--message",
-			encodeCloudflareVersionMessage([], nextTriggers, uploadedContentHash ?? void 0)
-		];
+			message: encodeCloudflareVersionMessage([], nextTriggers, uploadedContentHash ?? void 0)
+		};
 		if (secrets) {
 			const secretsPath = join(directory, "secrets.json");
 			writeFileSync(secretsPath, JSON.stringify(secrets), { mode: 384 });
-			argv.push("--secrets-file", secretsPath);
+			operation.secretsFilePath = secretsPath;
 		}
 		const releaseUploadSlot = await options.acquireUploadSlot?.();
 		let uploaded;
 		let uploadError;
 		try {
-			uploaded = options.workerExisted ? await options.runner(argv, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(argv, accountId, directory, true, workerName, options.apiBaseUrl);
+			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl);
 			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
 		} catch (error) {
 			uploadError = error;
@@ -4859,7 +4895,8 @@ async function deployPlatformWorker(config, secrets, options) {
 		} finally {
 			releaseUploadSlot?.(uploadError);
 		}
-		uploadedVersionId = parseUploadedPlatformWorkerVersion(`${uploaded.stdout}\n${uploaded.stderr}`);
+		const uploadData = uploaded.data;
+		uploadedVersionId = typeof uploadData?.versionId === "string" ? uploadData.versionId : null;
 		if (!options.workerExisted) activatedVersionId = uploadedVersionId;
 		if (!uploadedVersionId) throw new Error(`platform: Wrangler uploaded ${workerName} without reporting its immutable version id.`);
 		await options.onStaged(previousVersionId, uploadedVersionId, previousTriggers);
@@ -4869,16 +4906,15 @@ async function deployPlatformWorker(config, secrets, options) {
 			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (deploymentsBeforeActivation[0]?.id !== previousDeploymentId || !deploymentRunsOnlyVersion(deploymentsBeforeActivation[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently before activation; refusing to overwrite it.`);
 			activatedVersionId = uploadedVersionId;
-			assertCleanPlatformWrangler(await options.runner([
-				"versions",
-				"deploy",
-				`${uploadedVersionId}@100`,
-				"--config",
+			assertCleanPlatformWrangler(await options.runner({
+				type: "versions.deploy",
 				configPath,
-				"--message",
-				`Void platform activation ${uploadedVersionId}`,
-				"--yes"
-			], accountId, directory, true), `activate ${workerName}`);
+				versions: [{
+					versionId: uploadedVersionId,
+					percentage: 100
+				}],
+				message: `Void platform activation ${uploadedVersionId}`
+			}, accountId, directory, true), `activate ${workerName}`);
 		}
 		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 		const lineage = classifyPlatformWorkerDeploymentLineage(deploymentsAfterActivation, uploadedVersionId, previousDeploymentId);
@@ -5072,28 +5108,24 @@ async function rollbackPlatformWorker(input) {
 	}
 }
 function platformWorkerCommandRunner(accountId, cwd, runner) {
-	return (args, options) => runner(args, accountId, cwd, options.capture);
+	return (operation, options) => runner(operation, accountId, cwd, options.capture);
 }
-async function runPlatformWrangler(args, accountId, cwd, capture) {
-	return runPlatformWranglerAtApiBase(args, accountId, cwd, capture);
+async function runPlatformWrangler(operation, accountId, cwd, capture) {
+	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
 }
 const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
+async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
 	const startedAt = performance.now();
 	const result = await createDefaultRunWrangler(process.cwd(), {
-		launcher: resolveWranglerArgv(process.cwd()),
+		launcher: resolveCloudflareOperationArgv(process.cwd()),
 		parallelWorkerUpload,
 		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
-	})([...args], {
+	})(operation, {
 		accountId,
 		apiBaseUrl,
-		captureJson: capture,
 		cwd
 	});
-	if (process.env.VOID_PLATFORM_TIMINGS === "1") {
-		const operation = args[0] === "versions" || args[0] === "deployments" ? `${args[0]} ${args[1] ?? ""}` : args[0] ?? "unknown";
-		process.stderr.write(`[platform timing] wrangler ${operation} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
-	}
+	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
 	const stdout = result.stdout || "";
 	const stderr = result.stderr || "";
 	if (!capture && result.status !== 0) {
@@ -5101,7 +5133,7 @@ async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBa
 		if (stderr) process.stderr.write(stderr);
 	}
 	return {
-		status: result.status,
+		...result,
 		stderr,
 		stdout
 	};
@@ -5222,48 +5254,30 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
 	return result;
 }
-async function runPlatformWranglerForConditionalCreate(args, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
-	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
+async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
 }
 async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner([
-		"deployments",
-		"status",
-		"--config",
+	const result = await runner({
+		type: "deployments.status",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
 	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
 	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
 	return active[0].version_id;
 }
 async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner([
-		"deployments",
-		"list",
-		"--config",
+	const result = await runner({
+		type: "deployments.list",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
 	return value.map((entry, index) => {
 		if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.created_on !== "string" || !Array.isArray(entry.versions)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
@@ -5298,16 +5312,15 @@ async function restorePlatformWorkerDeployment(input) {
 	if (restorationVersions.length === 0 || restorationVersions.length > 2 || restorationVersions.some((version, index) => version.percentage > 100 || restorationVersions.findIndex((entry) => entry.versionId === version.versionId) !== index) || Math.abs(totalPercentage - 100) > .001) throw new Error(`Worker ${input.workerName} deployment ${input.restoration.id} has an unsupported traffic distribution.`);
 	const before = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (before[0]?.id !== input.expectedActiveDeploymentId || !deploymentRunsOnlyVersion(before[0], input.expectedActiveVersionId) || before[1]?.id !== input.restoration.id || !samePlatformWorkerTraffic(before[1], input.restoration)) throw new Error(`Worker ${input.workerName} changed concurrently before deployment restoration; refusing to overwrite the newer deployment.`);
-	assertCleanPlatformWrangler(await input.runner([
-		"versions",
-		"deploy",
-		...restorationVersions.map((version) => `${version.versionId}@${version.percentage}`),
-		"--config",
-		input.configPath,
-		"--message",
-		`Void platform restoration ${input.restoration.id}`,
-		"--yes"
-	], input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
+	assertCleanPlatformWrangler(await input.runner({
+		type: "versions.deploy",
+		configPath: input.configPath,
+		versions: restorationVersions.map((version) => ({
+			versionId: version.versionId,
+			percentage: version.percentage
+		})),
+		message: `Void platform restoration ${input.restoration.id}`
+	}, input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
 	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
@@ -5363,23 +5376,14 @@ async function readActivePlatformWorkerSnapshot(configPath, accountId, workerNam
 	});
 }
 async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, versionId, runner, validateCurrentVersion) {
-	const result = await runner([
-		"versions",
-		"view",
+	const result = await runner({
+		type: "versions.view",
 		versionId,
-		"--config",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	assertCleanPlatformWrangler(result, `read rollback metadata for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!value || typeof value !== "object") throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
 	const resources = value.resources;
 	const bindings = resources && typeof resources === "object" && !Array.isArray(resources) ? resources.bindings : null;
@@ -5405,11 +5409,8 @@ function withoutCompletedPlatformWorkerMigrations(config, activeMigrationTag) {
 	delete result.migrations;
 	return result;
 }
-function parseUploadedPlatformWorkerVersion(output) {
-	return /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i.exec(output)?.[1] ?? null;
-}
 function assertCleanPlatformWrangler(result, operation) {
-	if (result.status !== 0) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
+	if (result.status !== 0 || result.signal || result.error) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
 }
 function cleanPlatformCommandResult() {
 	return {
@@ -5530,18 +5531,18 @@ function parseWorkerCutoverSnapshot(value) {
 		return null;
 	}
 }
-function interruptedWorkerCutover(manifest) {
+function workerCutoverGenerations(manifest) {
 	const generations = /* @__PURE__ */ new Map();
 	for (const step of manifest.steps) {
 		const resolution = /^worker-cutover:(\d+):(committed|restored)$/.exec(step.key);
 		if (resolution) {
 			const generation = Number(resolution[1]);
 			const entry = generations.get(generation) ?? {
-				resolved: false,
+				resolution: null,
 				staged: /* @__PURE__ */ new Map(),
 				unsafeTraffic: /* @__PURE__ */ new Set()
 			};
-			entry.resolved = true;
+			entry.resolution = resolution[2];
 			generations.set(generation, entry);
 			continue;
 		}
@@ -5549,7 +5550,7 @@ function interruptedWorkerCutover(manifest) {
 		if (unsafeTraffic) {
 			const generation = Number(unsafeTraffic[1]);
 			const entry = generations.get(generation) ?? {
-				resolved: false,
+				resolution: null,
 				staged: /* @__PURE__ */ new Map(),
 				unsafeTraffic: /* @__PURE__ */ new Set()
 			};
@@ -5563,14 +5564,17 @@ function interruptedWorkerCutover(manifest) {
 		const snapshot = parseWorkerCutoverSnapshot(step.resultHash);
 		if (!snapshot) throw new Error(`platform: Invalid Worker cutover checkpoint ${step.key}.`);
 		const entry = generations.get(generation) ?? {
-			resolved: false,
+			resolution: null,
 			staged: /* @__PURE__ */ new Map(),
 			unsafeTraffic: /* @__PURE__ */ new Set()
 		};
 		entry.staged.set(staged[2], snapshot);
 		generations.set(generation, entry);
 	}
-	const unresolved = [...generations.entries()].filter(([, entry]) => !entry.resolved && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
+	return generations;
+}
+function interruptedWorkerCutover(manifest) {
+	const unresolved = [...workerCutoverGenerations(manifest).entries()].filter(([, entry]) => entry.resolution === null && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
 	return unresolved ? {
 		generation: unresolved[0],
 		staged: unresolved[1].staged,
@@ -5584,8 +5588,8 @@ async function verifyPlatformWorkerCutoverVersions(manifest, generation, configs
 	"tail",
 	"dispatch"
 ]) {
-	const cutover = interruptedWorkerCutover(manifest);
-	if (cutover?.generation !== generation || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
+	const cutover = workerCutoverGenerations(manifest).get(generation);
+	if (!cutover || cutover.resolution === "restored" || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
 	const directory = mkdtempSync(join(tmpdir(), "void-platform-cutover-verify-"));
 	try {
 		for (const key of workerKeys) {
@@ -5721,9 +5725,8 @@ async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fe
 	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
 	return status.state === "complete";
 }
-async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
-	const response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
-		method: "POST",
+async function verifyPlatformDeploymentExecutionDrain(apiUrl, healthProbeToken, installationId, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/__void/platform/deployment-execution`, {
 		headers: {
 			"X-Void-Platform-Probe": healthProbeToken,
 			...cfAccessHeaders(process.env, apiUrl)
@@ -5731,18 +5734,104 @@ async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher =
 		signal: AbortSignal.timeout(3e4),
 		redirect: "manual"
 	});
+	if (!response.ok) throw new Error(`platform: Deployment execution drain probe failed (HTTP ${response.status}). Keep the current runtime until its durable deployment operations have drained.`);
 	let value;
 	try {
 		value = await response.json();
 	} catch {
-		throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		throw new Error("platform: Deployment execution drain probe returned an invalid document.");
 	}
-	const status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (!response.ok || status?.version !== 1 || status.state !== "ready" || typeof status.operationId !== "string" || status.operationId.length === 0) {
-		const detail = status && typeof status.operationId === "string" ? ` Operation ${status.operationId}: ${typeof status.operationStatus === "string" ? status.operationStatus : "incomplete"}.` : status && typeof status.operationStatus === "string" ? ` Operation status: ${status.operationStatus}.` : "";
+	const status = value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+	if (status?.protocolVersion !== 1 || status.installationId !== installationId || typeof status.admissionClosed !== "boolean" || !Number.isSafeInteger(status.pendingDeployments) || Number(status.pendingDeployments) < 0) throw new Error("platform: Deployment execution drain probe returned an invalid document.");
+	if (!status.admissionClosed || status.pendingDeployments !== 0) throw new Error("platform: Durable deployment operations are still admitted or unfinished. Keep the current runtime and retry this command after they finish.");
+}
+async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
+	const deadline = Date.now() + 3e5;
+	let operationId = null;
+	const timedOut = () => /* @__PURE__ */ new Error(`platform: Shared email bootstrap did not finish within five minutes at ${apiUrl}.${operationId ? ` Operation ${operationId} remains incomplete.` : ""} Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+	const waitForProgress = async () => {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		await new Promise((resolve) => setTimeout(resolve, Math.min(1e3, remaining)));
+	};
+	let response;
+	let value;
+	let status;
+	for (;;) {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		const signal = AbortSignal.timeout(Math.min(12e4, remaining));
+		try {
+			response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
+				method: "POST",
+				headers: {
+					"X-Void-Platform-Probe": healthProbeToken,
+					...cfAccessHeaders(process.env, apiUrl)
+				},
+				signal,
+				redirect: "manual"
+			});
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap request failed at ${apiUrl}. Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+		}
+		try {
+			value = await response.json();
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		}
+		status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+		const observedOperationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		if (status?.version === 1 && observedOperationId) {
+			if (operationId && operationId !== observedOperationId) throw new Error("platform: Shared email bootstrap operation identity changed while waiting. Traffic remains disabled. Inspect the installation before retrying.");
+			operationId = observedOperationId;
+		}
+		if ([
+			200,
+			202,
+			503
+		].includes(response.status) && status?.version === 1 && status.state === "incomplete" && observedOperationId && (status.operationStatus === "pending" || status.operationStatus === "running") && status.failureCode == null) {
+			await waitForProgress();
+			continue;
+		}
+		break;
+	}
+	if (!response.ok || status?.version !== 1 || status.state !== "ready" || operationId === null || status.operationId !== operationId || status.operationStatus != null && status.operationStatus !== "completed" || status.failureCode != null) {
+		const code = (value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,63}$/.test(value) ? value : null;
+		const operationStatus = code(status?.operationStatus);
+		const operationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		const details = operationId ? [`Operation ${operationId}: ${operationStatus ?? "incomplete"}.`] : operationStatus ? [`Operation status: ${operationStatus}.`] : [];
+		const currentStep = code(status?.currentStep);
+		const failureCode = code(status?.failureCode);
+		if (currentStep) details.push(`Step: ${currentStep}.`);
+		if (failureCode) details.push(`Failure: ${failureCode}.`);
+		let domain = null;
+		if (typeof status?.domain === "string") try {
+			domain = normalizeApplicationDomain(status.domain);
+		} catch {}
+		const inboundStatus = code(status?.inboundStatus);
+		if (domain) details.push(`Domain: ${domain}${inboundStatus ? ` (inbound: ${inboundStatus})` : ""}.`);
+		const mxDetail = domain ? `MX records for ${domain} do not route mail to Cloudflare Email Routing` : null;
+		const safeDetails = [
+			...domain ? [mxDetail, `enabled explicit Cloudflare email rules conflict with ${domain}`] : [],
+			"zone catch-all does not point to this ingress",
+			"another enabled catch-all owns this zone"
+		];
+		if (typeof status?.failureDetail === "string" && safeDetails.includes(status.failureDetail)) {
+			details.push(`${status.failureDetail}.`);
+			if (currentStep === "inbound_probe" && status.failureDetail === mxDetail) details.push(`Enable Email Routing for ${domain} in the Cloudflare dashboard, then resume this installation.`);
+		}
+		const detail = details.length ? ` ${details.join(" ")}` : "";
 		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
 	}
-	return status.operationId;
+	return operationId;
 }
 function createPlatformHealthProbeToken(ownershipNonce) {
 	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
@@ -5753,7 +5842,7 @@ function answer(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
-async function selectInstallationAuthentication(file, recorded) {
+async function selectInstallationAuthentication(file, recorded, choices = {}) {
 	if (file) {
 		const input = JSON.parse(await readFile(file, "utf8"));
 		if (!input || typeof input !== "object" || Array.isArray(input) || !("connections" in input) || !Array.isArray(input.connections) || !input.connections.length || input.connections.length > 32) throw new Error("platform: An authentication file must define between 1 and 32 connections.");
@@ -5772,9 +5861,12 @@ async function selectInstallationAuthentication(file, recorded) {
 			file: selected
 		};
 	}
-	if (recorded) return { authentication: recorded };
-	if (!process.stdin.isTTY) return { authentication: { providers: ["github"] } };
-	const providers = answer(await multiselect({
+	if (recorded) {
+		if (choices.loginMethods && JSON.stringify(choices.loginMethods) !== JSON.stringify(recorded.providers) || choices.accessProtection !== void 0 && choices.accessProtection !== !!recorded.accessProtection) throw new Error("platform: Resume with the recorded login methods and protection settings.");
+		return { authentication: recorded };
+	}
+	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
+	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : answer(await multiselect({
 		message: "Platform login methods:",
 		initialValues: ["github"],
 		required: true,
@@ -5796,11 +5888,11 @@ async function selectInstallationAuthentication(file, recorded) {
 				label: "Cloudflare Access login"
 			}
 		]
-	}));
-	const protection = answer(await confirm({
+	})));
+	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : answer(await confirm({
 		message: "Also protect the platform UI and APIs with Cloudflare Access?",
 		initialValue: false
-	}));
+	})));
 	return { authentication: {
 		providers,
 		...protection || providers.length !== 1 || providers[0] !== "github" ? { configurable: true } : {},
@@ -5837,6 +5929,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	const accessEntry = entries.find((entry) => entry.configuration.kind === "cloudflare-access");
 	const prepared = access && (selection.authentication.accessProtection || accessEntry && (!selection.file || selection.file.cloudflareAccess)) ? await preparePlatformAccessSetup({
 		plan,
+		...platformDashboardUrl(plan.deployment) ? { additionalOrigins: [platformDashboardUrl(plan.deployment)] } : {},
 		ownershipNonce: access.ownershipNonce,
 		protection: !!selection.authentication.accessProtection,
 		...accessEntry ? { login: {
@@ -6044,13 +6137,13 @@ function platformSetupFieldHelp(key) {
 	switch (key) {
 		case "databaseUrl": return {
 			placeholder: "postgresql://user:pw@…/database",
-			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
+			description: "Stores platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
 				title: "Neon",
 				url: "https://neon.com/"
 			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
 		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32. Save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately. Save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
 		default: return;
 	}
 }
@@ -6168,8 +6261,8 @@ function platformSetupPages(plan) {
 				type: "account"
 			}),
 			instructions: [
-				"Select Object Read & Write (the form defaults to read-only).",
-				"Keep Apply to all buckets in this account (including newly created buckets) selected.",
+				"Select Object Read & Write.",
+				"Keep Apply to all buckets in this account selected.",
 				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
 			].join("\n")
 		}
@@ -6178,16 +6271,20 @@ function platformSetupPages(plan) {
 function formatPlatformSetupPlan(plan) {
 	const pages = platformSetupPages(plan);
 	return [
-		"Credentials needed (paste them into the installer; keep a password-manager copy):",
+		"Credentials needed during installation:",
+		"PostgreSQL database URL",
 		platformSetupLink(pages.runtime),
-		pages.runtime.instructions,
-		"",
 		platformSetupLink(pages.r2),
-		pages.r2.instructions,
+		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github)] : [],
+		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
+		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
+		platformSetupLink({
+			title: "JWT signing key and project encryption key",
+			url: "https://void.cloud/guide/platform/installation/credentials#signing-and-encryption-keys"
+		}),
 		"",
-		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github), pages.github.instructions] : [],
-		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => `${provider === "google" ? "Google OAuth client" : provider === "oidc" ? "OIDC connection" : "Cloudflare Access OIDC application"}: client ID and secret; callback ${plan.apiUrl}/auth/callback.`),
-		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access protection: configure API and proxy origins and admitted installer/CI credentials."] : []
+		"Login callback: " + plan.apiUrl + "/auth/callback",
+		"Installation collects and validates missing credentials after you confirm the plan."
 	].join("\n");
 }
 function formatPlatformInstallCommand(options) {
@@ -6215,10 +6312,18 @@ function formatPlatformInstallCommand(options) {
 			flag("--application-domain", options.applicationDomain);
 			flag("--zone", options.zoneName);
 			if (options.dedicatedZone) parts.push("--dedicated-zone");
+			else parts.push("--no-dedicated-zone");
 		}
 		flag("--control-plane-domain", options.controlPlaneDomain);
+		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
 	}
+	flag("--hyperdrive", options.hyperdrive ?? "");
 	flag("--auth-config", options.authConfig ?? "");
+	if (!options.authConfig && !options.resumeId && options.authentication) {
+		flag("--login-methods", options.authentication.providers.join(","));
+		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
+	}
+	flag("--dashboard-url", options.dashboardUrl ?? "");
 	flag("--runtime", options.runtime);
 	if (options.yes) parts.push("--yes");
 	return parts.join(" ");
@@ -6278,14 +6383,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(args) {
 	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-D6Xcy9ZX.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-BNkcz0OB.mjs");
 		await runPlatformDomainCommand(args);
 		return;
 	}
 	if (args.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-BvtcXON5.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-D6KSpuFm.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -6295,7 +6400,7 @@ async function runPlatformLifecycleCommand(args) {
 		return;
 	}
 	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-DOtss0BN.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-CnyTdcWX.mjs");
 		await runInstalledPlatformCommand(args);
 		return;
 	}
@@ -6410,9 +6515,9 @@ async function runPlatformLifecycleCommand(args) {
 	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", "example.app")));
 	const zoneName = recorded?.application.zoneName ?? (workersDev ? "" : normalizeApplicationDomain(args.zone || await promptText("Cloudflare zone:", applicationDomain)));
 	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationSlug} Void`));
-	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY ? await promptText("Optional custom API hostname (leave empty for workers.dev):", "", true) : "");
+	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY && !args.noControlPlaneDomain ? await promptText("Custom API hostname. Leave empty for workers.dev:", "", true) : "");
 	let dedicatedZone = recorded?.application.dedicatedZone ?? args.dedicatedZone;
-	if (!workersDev && !recorded && !args.dedicatedZone && applicationDomain === zoneName && process.stdin.isTTY) {
+	if (!workersDev && !recorded && !args.dedicatedZone && !args.dedicatedZoneSpecified && applicationDomain === zoneName && process.stdin.isTTY) {
 		const catchAll = await confirm({
 			message: `Dedicate all unmatched ${zoneName} traffic to Void apps?`,
 			initialValue: false
@@ -6454,11 +6559,12 @@ async function runPlatformLifecycleCommand(args) {
 			host: externalHyperdriveHost,
 			user: externalHyperdriveUser
 		} : void 0;
-		if (!externalHyperdrive && process.stdin.isTTY && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
+		if (args.hyperdrive && externalHyperdrive && args.hyperdrive !== externalHyperdrive.id) throw new Error("platform: --hyperdrive conflicts with VOID_PLATFORM_HYPERDRIVE_ID.");
+		if (!externalHyperdrive && args.hyperdrive !== "create" && (process.stdin.isTTY || args.hyperdrive) && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
 			const suggestedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
 			const configurations = await client.listHyperdriveConfigs(accountId);
 			const suggestedNameAvailable = !configurations.some((resource) => resource.name === suggestedName);
-			const choice = await select({
+			const choice = args.hyperdrive ? "existing" : await select({
 				message: "How should Void set up Hyperdrive?",
 				options: [
 					...configurations.length > 0 ? [{
@@ -6478,12 +6584,12 @@ async function runPlatformLifecycleCommand(args) {
 			});
 			if (isCancel(choice)) throw new Error("platform: Cancelled.");
 			if (choice === "setup") {
-				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` (for example ${suggestedName})` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
 				outro("No Cloudflare or local installation state was changed.");
 				return;
 			}
 			if (choice === "existing") {
-				const selectedId = await select({
+				const selectedId = args.hyperdrive ?? await select({
 					message: "Which Hyperdrive should Void use?",
 					options: [...configurations].sort((a, b) => Number(b.name === suggestedName) - Number(a.name === suggestedName) || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)).map((resource) => ({
 						value: resource.id,
@@ -6498,7 +6604,7 @@ async function runPlatformLifecycleCommand(args) {
 				if (live.id !== selected.id || live.name !== selected.name || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${selected.name}.`);
 				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${live.name}`);
 				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${live.name} before installing.`);
-				const confirmed = await confirm({
+				const confirmed = args.hyperdrive ? true : await confirm({
 					message: `Use ${live.name} for this platform?`,
 					initialValue: true
 				});
@@ -6519,7 +6625,7 @@ async function runPlatformLifecycleCommand(args) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DOtss0BN.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CnyTdcWX.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -6527,12 +6633,13 @@ async function runPlatformLifecycleCommand(args) {
 				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
 			}
 		}
-		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication);
+		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication, args);
 		const planInput = {
 			authentication: authenticationSelection.authentication,
 			accountId,
 			applicationDomain,
 			controlPlaneDomain,
+			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
 			dedicatedZone,
 			displayName,
 			...externalHyperdrive ? { externalHyperdrive } : {},
@@ -6546,13 +6653,15 @@ async function runPlatformLifecycleCommand(args) {
 			authoritativeProvisionIntents,
 			allowUnverifiedAiGateway: true,
 			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
-			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
+			deploymentExecution: runtime.manifest.deploymentExecution === 1
 		});
 		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
 		note(formatPlatformRuntime(runtime), "Platform runtime");
 		if (args.plan) {
 			console.log(formatPlatformSetupPlan(plan));
-			console.log(`\n${existing ? "To resume this installation later:" : "To install with these settings later:"}\n${formatPlatformInstallCommand({
+			outro("Plan complete. No installation changes were made.");
+			console.log(`\n${import_picocolors$1.default.bold(import_picocolors$1.default.cyan(existing ? "Next step: run this command to resume" : "Next step: run this command to install"))}\n\n${import_picocolors$1.default.cyan(formatPlatformInstallCommand({
 				commandName: cliCommandName(),
 				accountId,
 				installationSlug,
@@ -6560,15 +6669,16 @@ async function runPlatformLifecycleCommand(args) {
 				applicationDomain,
 				zoneName,
 				controlPlaneDomain,
+				...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
 				dedicatedZone,
 				workersDev,
 				authConfig: args.authConfig,
+				authentication: authenticationSelection.authentication,
+				hyperdrive: !existing || isPlatformSetupDraft(existing) ? externalHyperdrive?.id ?? "create" : void 0,
 				runtime: args.runtime,
 				...existing ? { resumeId: existing.id } : {},
 				yes: args.yes || process.stdin.isTTY !== true
-			})}\n`);
-			if (!existing && !args.authConfig && process.stdin.isTTY) console.log("Choose the same login methods when prompted.\n");
-			outro("No Cloudflare or local installation state was changed.");
+			}))}\n`);
 			return;
 		}
 		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
@@ -6744,11 +6854,12 @@ async function runPlatformLifecycleCommand(args) {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
 				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
-				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
+				deploymentExecution: runtime.manifest.deploymentExecution === 1
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DOtss0BN.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CnyTdcWX.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -6760,7 +6871,7 @@ async function runPlatformLifecycleCommand(args) {
 				});
 			}
 		});
-		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused; progress is saved." : "Platform installed.");
+		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused. Progress is saved." : "Platform installed.");
 		progress = void 0;
 		if (result.waitingForDns) {
 			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, "Waiting for nameservers");
@@ -6768,13 +6879,13 @@ async function runPlatformLifecycleCommand(args) {
 			return;
 		}
 		if (result.waitingForSandboxDrain) {
-			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`; follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
+			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`. Follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
 		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 		log.info(`API URL: ${plan.apiUrl}`);
-		if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
+		if (result.emailOperationId) log.info(`Shared email routing ready. Operation: ${result.emailOperationId}.`);
 		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
 		if (result.setupPending && completedAuthCode) {
 			log.info(`First administrator setup: ${plan.apiUrl}/setup`);
@@ -6814,7 +6925,8 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 		verified = await createPlatformInstallPlan(client, input, existing, {
 			authoritativeProvisionIntents,
 			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker"),
-			enableSandbox: preview.deployment.capabilities.sandbox
+			enableSandbox: preview.deployment.capabilities.sandbox,
+			deploymentExecution: preview.actions.some((entry) => entry.key === "deployment-queue")
 		});
 	} catch (error) {
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });