void 0.22.0 → 0.24.0

package/dist/{platform-lifecycle-k0E0xoxx.mjs → platform-lifecycle-BBoNzojY.mjs}

@@ -1,21 +1,20 @@
-import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as openBrowser } from "./auth-DLNN0D3Z.mjs";
-import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
-import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-CTBk70IR.mjs";
-import { o as resolveWranglerArgv } from "./preset-UHj9ARyP.mjs";
-import { s as runCloudflareAuthCommand } from "./cloudflare-auth-DQkqoMYa.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-C4IGqkBf.mjs";
-import { c as import_picocolors$1, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
-import { copyFileSync, cpSync, existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { _ as savePlatformConnection, a as listInstallationManifests, b as writePendingInstallationSecrets, d as promoteInstallationSecrets, f as readInstallationRecoverySecrets, g as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformRegistryDirectory, n as assertPlatformInstallationSlugAvailable, p as readPendingInstallationSecrets, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as platformWorkerSecretUpdateIntentState, y as writeInstallationManifest } from "./platform-registry-DkPPXfp_.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-BGe5sWXF.mjs";
+import { u as openBrowser } from "./auth-CQkSDS50.mjs";
+import { A as confirm, B as note, H as outro, K as select, L as log, N as intro, U as password, X as text$1, tt as isCancel, z as multiselect } from "./prompts-BNUoTiaf.mjs";
+import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-CaoxO_U7.mjs";
+import { c as import_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-CbM85T4k.mjs";
+import { t as parsePlatformArgs } from "./platform-args-3k8X9-H_.mjs";
+import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_SANDBOX_DRAIN_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { readFile } from "node:fs/promises";
@@ -142,7 +141,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		} catch (error) {
 			const status = error instanceof PlatformCloudflareApiError ? error.status : null;
 			const reason = status === null ? "the request failed" : `HTTP ${status}`;
-			const guidance = status === 401 || status === 403 ? "Check your Cloudflare login or API token permissions for this account, then rerun the command." : status === 404 ? `Check ${setupUrl}. If no subdomain is shown, finish Workers onboarding and choose one; otherwise check account access and retry.` : "Rerun the command. If the dashboard already shows a subdomain, no Workers onboarding change is needed.";
+			const guidance = status === 401 || status === 403 ? "Check your Cloudflare login or API token permissions for this account, then rerun the command." : status === 404 ? `Open ${setupUrl} once to provision your account for Workers automatically, then retry the install.` : "Rerun the command. If the dashboard already shows a subdomain, no Workers onboarding change is needed.";
 			throw new Error(`platform: Could not read the workers.dev subdomain for account ${accountId} (${reason}). ${guidance}`, { cause: error });
 		}
 		if (typeof result?.subdomain !== "string" || result.subdomain.trim() === "") throw new Error(`platform: This Cloudflare account does not have a workers.dev subdomain. Open ${setupUrl}, finish Workers onboarding, choose a subdomain, and rerun the command.`);
@@ -680,11 +679,12 @@ function hyperdriveOriginConfigHash(origin) {
 		host: origin.host.toLowerCase(),
 		port: origin.port,
 		scheme: "postgresql",
-		user: origin.user
+		user: origin.user,
+		...origin.accessClientId ? { accessClientId: origin.accessClientId } : {}
 	})).digest("hex");
 }
 function hyperdriveOriginMatches(live, expected) {
-	return live.database === expected.database && live.host.toLowerCase() === expected.host.toLowerCase() && live.port === expected.port && live.scheme === expected.scheme && (live.user === null || live.user === expected.user);
+	return live.database === expected.database && live.host.toLowerCase() === expected.host.toLowerCase() && live.port === expected.port && live.accessClientId === expected.accessClientId && live.scheme === expected.scheme && (live.user === null || live.user === expected.user);
 }
 function parseHyperdriveConfig(value) {
 	const origin = value.origin;
@@ -692,13 +692,15 @@ function parseHyperdriveConfig(value) {
 	const record = origin;
 	const scheme = requiredString(record.scheme, "Hyperdrive origin scheme").toLowerCase();
 	if (scheme !== "postgres" && scheme !== "postgresql") throw new Error(`platform: Unsupported Hyperdrive origin scheme ${JSON.stringify(scheme)}.`);
-	const port = typeof record.port === "number" ? record.port : Number(record.port);
-	if (!Number.isInteger(port) || port <= 0 || port > 65535) throw new Error("platform: Cloudflare Hyperdrive config has an invalid origin port.");
+	const accessClientId = typeof record.access_client_id === "string" && record.access_client_id ? record.access_client_id : void 0;
+	const port = accessClientId && record.port == null ? null : typeof record.port === "number" || typeof record.port === "string" ? Number(record.port) : NaN;
+	if (port !== null && (!Number.isInteger(port) || port <= 0 || port > 65535)) throw new Error("platform: Cloudflare Hyperdrive config has an invalid origin port.");
 	return {
 		id: requiredString(value.id, "Hyperdrive id"),
 		name: requiredString(value.name, "Hyperdrive name"),
 		cachingDisabled: !!value.caching && typeof value.caching === "object" && !Array.isArray(value.caching) && value.caching.disabled === true,
 		origin: {
+			...accessClientId ? { accessClientId } : {},
 			database: requiredString(record.database, "Hyperdrive origin database"),
 			host: requiredString(record.host, "Hyperdrive origin host").toLowerCase(),
 			port,
@@ -717,6 +719,14 @@ function text(value, name) {
 	if (typeof value !== "string" || !value || value.length > 8192) throw new Error(`platform: Cloudflare Access did not return ${name}.`);
 	return value;
 }
+function platformAccessIdentityProvider(provider) {
+	const id = text(provider.id, "identity provider ID");
+	const name = provider.name;
+	return {
+		id,
+		name: name == null || typeof name === "string" && !name.trim() ? id : text(name, "identity provider name")
+	};
+}
 function ids(value) {
 	if (!Array.isArray(value)) return [];
 	return value.map((entry) => typeof entry === "string" ? entry : text(object(entry, "policy").id, "policy ID"));
@@ -846,10 +856,7 @@ async function inspectPlatformAccess(client, input) {
 			audience: "validation"
 		}]
 	});
-	const identityProviders = (await client.list("identity_providers")).map((provider) => ({
-		id: text(provider.id, "identity provider ID"),
-		name: text(provider.name ?? provider.id, "identity provider name")
-	}));
+	const identityProviders = (await client.list("identity_providers")).map(platformAccessIdentityProvider);
 	if (!input.identityProviderIds.length || !input.policyIds.length || input.identityProviderIds.length > 16 || input.policyIds.length > 16 || new Set(input.identityProviderIds).size !== input.identityProviderIds.length || new Set(input.policyIds).size !== input.policyIds.length) throw new Error("platform: Select explicit identity providers and company policies for Access.");
 	if (input.identityProviderIds.some((id) => !identityProviders.some((provider) => provider.id === id))) throw new Error("platform: A selected Access identity provider is unavailable in this account.");
 	const policies = await Promise.all(input.policyIds.map(async (id) => object(await client.get(`policies/${encodeURIComponent(id)}`), "Access policy")));
@@ -1119,7 +1126,343 @@ async function verifyPlatformAccessApplication(client, input, app, type, machine
 	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
 }
 //#endregion
+//#region src/cli/platform-setup.ts
+function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
+	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + import_picocolors.default.underline(page.title) + "\x1B]8;;\x1B\\" : page.title + ": " + import_picocolors.default.underline(page.url);
+}
+function platformSetupFieldHelp(key) {
+	const docs = (page, section, title) => platformSetupLink({
+		title,
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
+	});
+	switch (key) {
+		case "databaseUrl": return {
+			placeholder: "postgresql://user:pw@…/database",
+			description: "Provide a PostgreSQL database URL for platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
+				title: "Neon",
+				url: "https://neon.com/"
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
+		};
+		case "jwtSecret": return { description: `Create a JWT signing key for platform login tokens. Run ${import_picocolors.default.blue("openssl rand -base64 32")}. Save the key in your password manager. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: `Generate a project encryption key for app secrets. Run ${import_picocolors.default.blue("openssl rand -base64 32")} separately. Save this key for recovery. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		default: return;
+	}
+}
+function supportsSetupLinks() {
+	return !!process.stdout.isTTY && ([
+		"ghostty",
+		"iTerm.app",
+		"WezTerm",
+		"vscode",
+		"WarpTerminal"
+	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
+}
+/** Dashboard keys use permission-catalog labels, which can differ from product names. */
+function platformAccountTokenPermissions(includeAiGateway) {
+	return [
+		{
+			key: "account_settings",
+			type: "read"
+		},
+		{
+			key: "workers_scripts",
+			type: "edit"
+		},
+		{
+			key: "workers_kv_storage",
+			type: "edit"
+		},
+		{
+			key: "workers_r2",
+			type: "edit"
+		},
+		{
+			key: "d1",
+			type: "edit"
+		},
+		{
+			key: "queues",
+			type: "edit"
+		},
+		{
+			key: "account_analytics",
+			type: "read"
+		},
+		{
+			key: "workers_tail",
+			type: "read"
+		},
+		{
+			key: "query_cache",
+			type: "edit"
+		},
+		...includeAiGateway ? [{
+			key: "aig",
+			type: "edit"
+		}] : []
+	];
+}
+function platformManagementSetupPage(plan, options = {}) {
+	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+	const zoneName = plan.deployment.application.zoneName;
+	const apiHostname = plan.deployment.controlPlane.apiHostname;
+	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
+		protection: !!plan.deployment.authentication.accessProtection,
+		readOnly: false
+	} : void 0);
+	const accessLevel = access && access.readOnly ? "read" : "edit";
+	const appAccess = !!plan.deployment.appAccess;
+	const appAccessLevel = appAccess ? "edit" : accessLevel;
+	const permissions = [
+		...platformAccountTokenPermissions(true),
+		...zoneName || apiHostname || createsZone ? [
+			{
+				key: "zone",
+				type: createsZone ? "edit" : "read"
+			},
+			{
+				key: "dns",
+				type: "edit"
+			},
+			{
+				key: "workers_routes",
+				type: "edit"
+			}
+		] : [],
+		...access || appAccess ? [
+			{
+				key: "access",
+				type: appAccessLevel
+			},
+			{
+				key: "access_acct",
+				type: "read"
+			},
+			...access && access.protection ? [{
+				key: "access_service_token",
+				type: accessLevel
+			}] : []
+		] : [],
+		...zoneName && plan.deployment.application.baseDomain !== zoneName ? [{
+			key: "ssl_and_certificates",
+			type: "read"
+		}] : []
+	];
+	return {
+		title: "Cloudflare management API token",
+		linkInTitle: true,
+		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+			to: "/" + plan.account.id + "/api-tokens",
+			name: plan.deployment.displayName + " Management",
+			permissionGroupKeys: JSON.stringify(permissions)
+		}),
+		instructions: [
+			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
+			`Scope it to ${plan.account.name}${createsZone ? "; allow zone creation." : zoneName ? ` and zone ${zoneName}.` : "."}`,
+			...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`Also include the zone for ${apiHostname}.`] : []
+		].join("\n")
+	};
+}
+function platformSetupPages(plan) {
+	const permissions = [
+		...platformAccountTokenPermissions(plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect")),
+		...plan.deployment.application.zoneName ? [{
+			key: "cache",
+			type: "purge"
+		}] : [],
+		...plan.deployment.capabilities.customDomains ? [{
+			key: "ssl_and_certificates",
+			type: "edit"
+		}] : [],
+		...plan.deployment.capabilities.email ? [
+			{
+				key: "zone",
+				type: "read"
+			},
+			{
+				key: "zone_settings",
+				type: "edit"
+			},
+			{
+				key: "email_routing_address",
+				type: "edit"
+			},
+			{
+				key: "email_routing_rule",
+				type: "edit"
+			},
+			{
+				key: "email_sending",
+				type: "edit"
+			}
+		] : []
+	];
+	return {
+		runtime: {
+			title: "Cloudflare runtime token",
+			linkInTitle: true,
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/api-tokens",
+				name: plan.deployment.displayName + " Runtime",
+				permissionGroupKeys: JSON.stringify(permissions)
+			}),
+			instructions: "Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here."
+		},
+		github: {
+			title: "GitHub OAuth App",
+			url: "https://github.com/settings/applications/new",
+			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
+		},
+		r2: {
+			title: "R2 upload token",
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/r2/api-tokens/create",
+				type: "account"
+			}),
+			instructions: [
+				"Select Object Read & Write.",
+				"Keep Apply to all buckets in this account selected.",
+				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
+			].join("\n")
+		}
+	};
+}
+function formatPlatformSetupPlan(plan, options = {}) {
+	const writesDns = plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse");
+	return [
+		"The installation will guide you through setting up the following credentials:",
+		"",
+		...[
+			...options.managementToken ? [options.managementAccess ? `Cloudflare management API token for ${writesDns ? "DNS changes and " : ""}Access setup` : "Cloudflare management API token for DNS changes"] : [],
+			"PostgreSQL database URL",
+			"Cloudflare runtime token",
+			"R2 upload token",
+			...plan.deployment.authentication.providers.includes("github") ? ["GitHub OAuth App client ID and secret"] : [],
+			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
+			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
+			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
+			"JWT signing key and project encryption key"
+		].map((credential) => `• ${credential}`)
+	].join("\n");
+}
+function platformInstallCommandArguments(options) {
+	const parts = [
+		options.commandName,
+		"platform",
+		"install"
+	];
+	const flag = (name, value) => {
+		if (value) parts.push(name, value);
+	};
+	if (options.resumeId) {
+		parts.push("--resume");
+		flag("--name", options.resumeId);
+	} else {
+		flag("--name", options.installationSlug);
+		flag("--account", options.accountId);
+		flag("--display-name", options.displayName);
+		if (options.workersDev) parts.push("--workers-dev");
+		else {
+			flag("--application-domain", options.applicationDomain);
+			flag("--zone", options.zoneName);
+			if (options.dedicatedZone) parts.push("--dedicated-zone");
+			else parts.push("--no-dedicated-zone");
+		}
+		flag("--control-plane-domain", options.controlPlaneDomain);
+		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
+	}
+	flag("--hyperdrive", options.hyperdrive ?? "");
+	flag("--auth-config", options.authConfig ?? "");
+	if (!options.resumeId && options.appAccess) flag("--app-access", options.appAccess);
+	if (!options.authConfig && !options.resumeId && options.authentication) {
+		flag("--login-methods", options.authentication.providers.join(","));
+		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
+	}
+	flag("--dashboard-url", options.dashboardUrl ?? "");
+	flag("--runtime", options.runtime);
+	if (options.yes) parts.push("--yes");
+	return parts;
+}
+function formatPlatformInstallCommand(options) {
+	return platformInstallCommandArguments(options).map((value) => {
+		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+	}).join(" ");
+}
+function openPlatformSetupPage(page, dependencies = {}) {
+	log.info((page.linkInTitle ? platformSetupLink(page) : page.title) + "\n" + page.instructions);
+	if (!page.linkInTitle) console.log(platformSetupLink({
+		...page,
+		title: "Open " + page.title
+	}));
+	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
+		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
+	} catch {
+		log.info("Could not open the browser. Use the link above.");
+	}
+}
+//#endregion
 //#region src/cli/platform-access-setup.ts
+function accessSetupGuide() {
+	return platformSetupLink({
+		title: "Setup guide and required permissions",
+		url: "https://void.cloud/guide/platform/installation/setup#cloudflare-access"
+	});
+}
+async function selectCompanyAccessPolicies(client, initialPolicies, accountId, mode) {
+	const create = "__create__";
+	const refresh = "__refresh__";
+	let policies = initialPolicies;
+	let selectedIds = [];
+	while (true) {
+		const options = policies.filter((policy) => typeof policy.id === "string" && ["allow", "deny"].includes(String(policy.decision))).map((policy) => ({
+			value: String(policy.id),
+			label: stripVTControlCharacters(String(policy.name ?? policy.id))
+		}));
+		const available = new Set(options.map((option) => option.value));
+		selectedIds = selectedIds.filter((id) => available.has(id));
+		const actions = [{
+			value: create,
+			label: "Create new",
+			hint: "Set up a policy in Cloudflare, then return here"
+		}, {
+			value: refresh,
+			label: "Refresh list"
+		}];
+		let choices;
+		if (options.length === 0) {
+			log.info("No reusable Allow or Deny policies were found in this account. Create an Allow policy for your company, or refresh after saving one.");
+			choices = [answer$2(await select({
+				message: "Company Access policies:",
+				options: actions
+			}))];
+		} else choices = answer$2(await multiselect({
+			message: "Company Access policies (select all that apply):",
+			options: [...options, ...actions],
+			initialValues: selectedIds,
+			required: true
+		}));
+		selectedIds = choices.filter((id) => available.has(id));
+		if (choices.includes(create)) {
+			note([
+				"1. Open Zero Trust → Access controls → Policies → Add a policy in this account.",
+				"2. Name the policy and choose Allow.",
+				"3. Include your company’s identity-provider group or Emails ending in your company domain, such as example.com.",
+				"4. Require your selected company login method and your company’s MFA/device checks.",
+				...mode === "existing" ? ["5. Save the policy and attach it to the existing Access applications you’re connecting, then return here."] : ["5. Save the policy, then return here."]
+			].join("\n"), import_picocolors.default.bold("Create an Access policy"));
+			console.log(platformSetupLink({
+				title: "Open Cloudflare account",
+				url: `https://dash.cloudflare.com/${encodeURIComponent(accountId)}`
+			}));
+			if (!answer$2(await confirm({
+				message: "Have you saved the new policy?",
+				initialValue: true
+			}))) continue;
+		} else if (!choices.includes(refresh)) return selectedIds;
+		policies = await client.list("policies");
+	}
+}
 function platformAccessResourceInventory(encoded, installationId) {
 	if (!encoded) return [];
 	const state = JSON.parse(encoded);
@@ -1144,6 +1487,10 @@ function checkpointPlatformAccessResources(manifest, encoded, updatedAt) {
 }
 function isPlatformAuthenticationPreparationKey(name) {
 	return name.startsWith("authenticationConnection:") || [
+		"appAccessToken",
+		"appAccessTokenRejected",
+		"appAccessIdentityProviderIds",
+		"appAccessPolicyIds",
 		"accessManagementToken",
 		"accessSetupSpecJson",
 		"accessExistingServiceTokenJson",
@@ -1189,7 +1536,7 @@ function parsePlatformAccessSetupSpec(input) {
 	}
 	return value;
 }
-function answer$1(value) {
+function answer$2(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
@@ -1217,22 +1564,32 @@ function activatePlatformAccessCredentials(encoded, origins) {
 }
 async function preparePlatformAccessSetup(input) {
 	if (!input.login && !input.protection) return;
+	if (process.stdin.isTTY) {
+		note([
+			input.login && input.protection ? "Access lets employees sign in with your company login and controls who can reach the platform’s UI and APIs." : input.login ? "Access lets employees sign in to the platform with your company login." : "Access controls who can reach the platform’s UI and APIs.",
+			"",
+			"Void can create dedicated Access applications using your company’s existing login providers and policies, or use Access applications your company already manages."
+		].join("\n"), import_picocolors.default.bold("Set up Cloudflare Access"));
+		console.log(accessSetupGuide());
+	}
 	let spec = input.spec ?? (input.checkpoint.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson)) : void 0);
 	if (!spec) {
 		if (!process.stdin.isTTY) {
 			if (input.protection) throw new Error("platform: Protection requires cloudflareAccess create or existing application verification in --auth-config.");
 			return;
 		}
-		const mode = answer$1(await select({
+		const mode = answer$2(await select({
 			message: "Cloudflare Access setup:",
 			options: [
 				{
 					value: "create",
-					label: "Create applications automatically in this Cloudflare account"
+					label: "Create Access applications for this platform",
+					hint: "Use this account’s existing Zero Trust setup"
 				},
 				{
 					value: "existing",
-					label: "Connect existing applications (including another account)"
+					label: "Use Access applications your company already manages",
+					hint: "May use another account"
 				},
 				...!input.protection ? [{
 					value: "manual",
@@ -1243,12 +1600,19 @@ async function preparePlatformAccessSetup(input) {
 		if (mode === "manual") return;
 		spec = { mode };
 		if (mode === "existing") {
-			spec.accountId = answer$1(await text$1({
+			log.info("Enter the account that owns your company’s Access configuration. This may differ from the account hosting Void.");
+			spec.accountId = answer$2(await text$1({
 				message: "Cloudflare identity account ID:",
 				initialValue: input.plan.account.id
 			}));
-			if (input.login) spec.loginApplicationId = answer$1(await text$1({ message: "Existing Access OIDC application ID:" }));
-			if (input.protection) spec.protectionApplicationId = answer$1(await text$1({ message: "Existing Access protection application ID:" }));
+			if (input.login) {
+				log.info("Enter the ID of the Access application that provides company sign-in to Void.");
+				spec.loginApplicationId = answer$2(await text$1({ message: "Existing Access OIDC application ID:" }));
+			}
+			if (input.protection) {
+				log.info("Enter the ID of the Access application that protects the platform’s UI and APIs.");
+				spec.protectionApplicationId = answer$2(await text$1({ message: "Existing Access protection application ID:" }));
+			}
 		}
 	}
 	spec = parsePlatformAccessSetupSpec(spec);
@@ -1265,8 +1629,9 @@ async function preparePlatformAccessSetup(input) {
 		policies = await client.list("policies");
 	} catch (error) {
 		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status) || !process.stdin.isTTY || credential) throw error;
-		console.error(`Access setup for account ${accountId} needs Access applications/policies permissions and organization/identity-provider/group read access${input.protection ? ", plus service-token permissions" : ""}.`);
-		const token = answer$1(await password({ message: "Access setup API token (kept out of the platform runtime):" }));
+		log.info(`Your current token lacks the required Access permissions for account ${accountId}. Create a token for that account using the permissions in the setup guide.`);
+		console.log(accessSetupGuide());
+		const token = answer$2(await password({ message: "Access setup API token:" }));
 		input.save({ accessManagementToken: token });
 		management = new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl });
 		client = new PlatformAccessClient(management, accountId);
@@ -1274,22 +1639,24 @@ async function preparePlatformAccessSetup(input) {
 		providers = await client.list("identity_providers");
 		policies = await client.list("policies");
 	}
-	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
+	if (!spec.identityProviderIds && process.stdin.isTTY) log.info("Choose how employees sign in—for example, your company’s Okta or Google Workspace connection.");
+	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$2(await multiselect({
 		message: "Company identity providers:",
 		required: true,
-		options: providers.filter((provider) => typeof provider.id === "string").map((provider) => ({
-			value: String(provider.id),
-			label: stripVTControlCharacters(String(provider.name ?? provider.id))
-		}))
-	})) : []);
-	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
-		message: "Existing company Access policies (MFA and device requirements are preserved):",
-		required: true,
-		options: policies.filter((policy) => typeof policy.id === "string" && ["allow", "deny"].includes(String(policy.decision))).map((policy) => ({
-			value: String(policy.id),
-			label: stripVTControlCharacters(String(policy.name ?? policy.id))
+		options: providers.filter((provider) => typeof provider.id === "string").map(platformAccessIdentityProvider).map((provider) => ({
+			value: provider.id,
+			label: stripVTControlCharacters(provider.name)
 		}))
 	})) : []);
+	if (identityProviderIds.length) {
+		spec = {
+			...spec,
+			identityProviderIds
+		};
+		input.save({ accessSetupSpecJson: JSON.stringify(spec) });
+	}
+	if (!spec.policyIds && process.stdin.isTTY) log.info("Choose which existing access rules apply to this platform, including MFA and device requirements.");
+	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? await selectCompanyAccessPolicies(client, policies, accountId, spec.mode) : []);
 	if (!identityProviderIds.length || !policyIds.length) throw new Error("platform: Access setup requires explicit identityProviderIds and policyIds.");
 	spec = {
 		...spec,
@@ -1306,10 +1673,11 @@ async function preparePlatformAccessSetup(input) {
 	if (!serviceToken && spec.mode === "existing" && input.protection) {
 		if (input.checkpoint.accessExistingServiceTokenJson) serviceToken = JSON.parse(input.checkpoint.accessExistingServiceTokenJson);
 		else if (process.stdin.isTTY) {
+			log.info("This lets the installer reach the protected platform during setup. Use a service token allowed by the existing Access application.");
 			serviceToken = {
-				id: answer$1(await text$1({ message: "Existing admitted Access service token ID:" })),
-				clientId: answer$1(await password({ message: "Access service token client ID:" })),
-				clientSecret: answer$1(await password({ message: "Access service token client secret:" }))
+				id: answer$2(await text$1({ message: "Existing admitted Access service token ID:" })),
+				clientId: answer$2(await password({ message: "Access service token client ID:" })),
+				clientSecret: answer$2(await password({ message: "Access service token client secret:" }))
 			};
 			input.save({ accessExistingServiceTokenJson: JSON.stringify(serviceToken) });
 		}
@@ -1330,7 +1698,7 @@ async function preparePlatformAccessSetup(input) {
 	};
 	console.log(JSON.stringify({ accessPlan: reviewed }, null, 2));
 	if (!input.yes) {
-		if (!process.stdin.isTTY || !answer$1(await confirm({
+		if (!process.stdin.isTTY || !answer$2(await confirm({
 			message: "Apply this Access configuration?",
 			initialValue: false
 		}))) throw new Error("platform: Access setup changes require confirmation or --yes.");
@@ -1344,7 +1712,8 @@ async function preparePlatformAccessSetup(input) {
 	};
 	let loginClientSecret = spec.loginClientSecretEnv ? secretReference(spec.loginClientSecretEnv) : input.checkpoint.accessExistingLoginSecret;
 	if (input.login && spec.mode === "existing" && !loginClientSecret && process.stdin.isTTY) {
-		loginClientSecret = answer$1(await password({ message: "Existing Access OIDC client secret:" }));
+		log.info("Enter the client secret from the existing Access login application’s OIDC settings.");
+		loginClientSecret = answer$2(await password({ message: "Existing Access OIDC client secret:" }));
 		input.save({ accessExistingLoginSecret: loginClientSecret });
 	}
 	const result = await provisionPlatformAccess(client, {
@@ -1376,13 +1745,34 @@ async function preparePlatformAccessSetup(input) {
 }
 //#endregion
 //#region src/cli/platform-auth.ts
-function assertPlatformOperatorCredentialCanApplyPlan(credential, plan) {
-	if (credential.source !== "oauth") return;
+/** Check Access inventory permissions before the installer starts provisioning. */
+async function verifyPlatformManagementAccess(client, accountId, access) {
+	const base = `/accounts/${encodeURIComponent(accountId)}/access`;
+	await Promise.all([client.request(`${base}/organizations`), ...[
+		"identity_providers",
+		"groups",
+		"policies",
+		"apps",
+		...access.protection ? ["service_tokens"] : []
+	].map((resource) => client.request(`${base}/${resource}?per_page=1`))]);
+}
+function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access) {
+	if (!platformOperatorNeedsManagementToken(credential, plan, access)) return;
 	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
 	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
-	if (!createsZone && !writesDns) return;
-	const permissions = [...createsZone ? ["Account → Zone → Edit"] : [], ...writesDns ? ["Zone → DNS → Edit"] : []];
-	throw new Error(`platform: Cloudflare browser OAuth grants Zone Read and cannot apply the planned zone or DNS changes. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account and application zone, then rerun the command.`);
+	const permissions = [
+		...createsZone ? ["Account → Zone → Edit"] : [],
+		...writesDns ? ["Zone → DNS → Edit"] : [],
+		...access ? [
+			`Account → Access: Apps and Policies → ${access.readOnly ? "Read" : "Edit"}`,
+			"Account → Access: Organizations, Identity Providers, and Groups → Read",
+			...access.protection ? [`Account → Access: Service Tokens → ${access.readOnly ? "Read" : "Edit"}`] : []
+		] : []
+	];
+	throw new Error(`platform: Cloudflare browser login cannot authorize the planned ${access ? "Access setup" : "zone or DNS changes"}. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account${createsZone || writesDns ? " and application zone" : ""}, then rerun the command.`);
+}
+function platformOperatorNeedsManagementToken(credential, plan, access) {
+	return credential.source === "oauth" && (!!access || plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse"));
 }
 async function resolvePlatformCloudflareCredential(dependencies = {}) {
 	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
@@ -1417,9 +1807,9 @@ async function resolvePlatformCloudflareCredentialWithInput(readInput, dependenc
 			input,
 			credential: result.credential
 		};
-		const login = await runWrangler(["login"], false);
+		const login = await runWrangler({ type: "auth.login" }, false);
 		assertNotCancelled();
-		if (login.status !== 0) throw new Error("platform: Cloudflare browser login did not complete.");
+		if (login.status !== 0 || login.signal || login.error) throw new Error("platform: Cloudflare browser login did not complete.");
 		const credential = await readWranglerOAuthCredential(runWrangler);
 		assertNotCancelled();
 		if (!credential) throw new Error("platform: Cloudflare sign-in completed without a usable OAuth credential.");
@@ -1438,19 +1828,20 @@ async function readExistingCredential(dependencies, runWrangler) {
 		source: "environment",
 		token: environmentToken
 	};
+	const savedManagementToken = dependencies.savedManagementToken?.trim();
+	if (savedManagementToken) return {
+		source: "saved",
+		token: savedManagementToken
+	};
 	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
 	return await readWranglerOAuthCredential(runWrangler);
 }
 async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
-	const result = await runWrangler([
-		"auth",
-		"token",
-		"--json"
-	], true);
-	if (result.status !== 0) return null;
+	const result = await runWrangler({ type: "auth.token" }, true);
+	if (result.status !== 0 || result.signal || result.error) return null;
 	try {
-		const parsed = JSON.parse(result.stdout);
-		if (parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+		const parsed = result.data;
+		if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
 		return {
 			source: "oauth",
 			token: parsed.token.trim()
@@ -1460,6 +1851,116 @@ async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflare
 	}
 }
 //#endregion
+//#region src/cli/platform-access-health.ts
+/** These reserved endpoints require Void's probe token and cannot serve application traffic. */
+function platformAccessHealthTargets(plan) {
+	const destination = `${plan.deployment.application.zoneName ? `${PLATFORM_HEALTH_HOSTNAME_LABEL}.${plan.deployment.application.baseDomain}` : `${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`}/health`;
+	return [{
+		key: `health-dispatch-${createHash("sha256").update(destination).digest("hex").slice(0, 12)}`,
+		destination
+	}];
+}
+async function verifyHealthException(access, app, destination) {
+	const destinations = platformAccessPublicDestinations(app);
+	if (typeof app.id !== "string" || !app.id || app.type !== "self_hosted" || app.domain !== destination || !destinations.length || destinations.some((value) => value !== destination) || app.destinations !== void 0 && (!Array.isArray(app.destinations) || app.destinations.some((value) => !value || value.type !== "public" || value.uri !== destination)) || app.target_criteria != null && (!Array.isArray(app.target_criteria) || app.target_criteria.length > 0)) throw new Error(`platform: The Access health exception must cover only ${destination}.`);
+	const policies = await access.list(`apps/${encodeURIComponent(app.id)}/policies`);
+	const policy = policies[0];
+	if (policies.length !== 1 || policy?.decision !== "bypass" || JSON.stringify(policy.include) !== "[{\"everyone\":{}}]" || policy.require !== void 0 && (!Array.isArray(policy.require) || policy.require.length > 0) || policy.exclude !== void 0 && (!Array.isArray(policy.exclude) || policy.exclude.length > 0)) throw new Error(`platform: The Access policy for ${destination} does not match the reserved health-check exception.`);
+}
+/** Keep the same path-only exception used by project Zero Trust available during bootstrap. */
+async function ensurePlatformAccessHealthChecks(input) {
+	const appAccess = !input.manifest.steps.some((step) => step.key === "app-access-initialized:v1") && input.checkpoint.appAccessSetupJson ? parsePlatformAppAccessSetup(JSON.parse(input.checkpoint.appAccessSetupJson)) : null;
+	if (appAccess && appAccess.accountId !== input.plan.account.id) throw new Error("platform: App access recovery belongs to another Cloudflare account.");
+	if (!input.plan.deployment.authentication.accessProtection && !appAccess?.managed) return;
+	const spec = appAccess?.managed ? {
+		mode: "create",
+		accountId: input.plan.account.id
+	} : parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson || "null"));
+	const accountId = input.plan.account.id;
+	const identityAccountId = spec.accountId ?? accountId;
+	const token = appAccess?.managed ? appAccess.apiToken : identityAccountId === accountId ? process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN || input.checkpoint.accessManagementToken : void 0;
+	if (!token && !input.client.request) throw new Error("platform: Access management is required to configure the reserved health endpoints.");
+	const access = new PlatformAccessClient(token ? new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }) : { request: input.client.request.bind(input.client) }, accountId);
+	const nonce = createHash("sha256").update(`void-access-health:${input.manifest.ownershipNonce}`).digest("hex").slice(0, 32);
+	const state = input.checkpoint.accessHealthProvisioningJson ? JSON.parse(input.checkpoint.accessHealthProvisioningJson) : {
+		version: 1,
+		accountId,
+		installationId: input.manifest.id,
+		nonce,
+		resources: {}
+	};
+	if (!state || state.version !== 1 || state.accountId !== accountId || input.manifest.account.id !== accountId || state.installationId !== input.manifest.id || state.installationId !== input.plan.installationId || state.nonce !== nonce || !state.resources || typeof state.resources !== "object" || Array.isArray(state.resources)) throw new Error("platform: Access health recovery data belongs to a different installation.");
+	const save = () => input.save(JSON.stringify(state));
+	const inventory = await access.list("apps");
+	for (const { key, destination } of platformAccessHealthTargets(input.plan)) {
+		const expected = {
+			type: "self_hosted",
+			domain: destination,
+			destinations: [{
+				type: "public",
+				uri: destination
+			}],
+			policies: [{
+				name: "Void platform health check",
+				decision: "bypass",
+				precedence: 1,
+				include: [{ everyone: {} }]
+			}]
+		};
+		const fingerprint = createHash("sha256").update(JSON.stringify(expected)).digest("hex");
+		let recorded = state.resources[key];
+		const name = `void-${input.manifest.id}-${key}`.slice(0, 90) + "-" + nonce.slice(0, 16);
+		if (recorded && (recorded.name !== name || recorded.fingerprint !== fingerprint || recorded.adopted)) throw new Error("platform: The recorded Access health exception changed identity or scope.");
+		const matching = inventory.filter((app) => platformAccessPublicDestinations(app).includes(destination));
+		if (matching.length > 1 || recorded?.id && matching.some((app) => app.id !== recorded.id)) throw new Error(`platform: Multiple Access applications cover ${destination}. Reconcile them before resuming.`);
+		if (!recorded && matching.length === 1) {
+			await verifyHealthException(access, matching[0], destination);
+			continue;
+		}
+		if (!recorded?.id && recorded?.pending) {
+			const candidates = inventory.filter((app) => app.name === name);
+			if (candidates.length !== 1 || typeof candidates[0]?.id !== "string") throw new Error("platform: Access health application creation has an uncertain outcome. Inspect Cloudflare before retrying; no duplicate was created.");
+			recorded.id = candidates[0].id;
+			save();
+		}
+		if (!recorded?.id) {
+			if (spec.mode !== "create") throw new Error(`platform: Configure an Access exception limited to ${destination}, then resume. Void's private probe token still protects this endpoint.`);
+			if (inventory.some((app) => app.name === name)) throw new Error("platform: An Access health application with this installation identity already exists. Inspect it before resuming.");
+			recorded = {
+				name,
+				fingerprint,
+				pending: true
+			};
+			state.resources[key] = recorded;
+			save();
+			try {
+				const created = await access.create("apps", {
+					...expected,
+					name
+				});
+				if (!created || typeof created.id !== "string" || !created.id) throw new Error("platform: Cloudflare did not return the Access health application ID.");
+				recorded.id = created.id;
+				save();
+			} catch (error) {
+				if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
+					408,
+					409,
+					429
+				].includes(error.status)) {
+					recorded.pending = false;
+					save();
+				}
+				throw error;
+			}
+		}
+		const app = await access.get(`apps/${encodeURIComponent(recorded.id)}`);
+		if (!app || app.id !== recorded.id || app.name !== recorded.name) throw new Error("platform: The Access health application changed ownership identity.");
+		await verifyHealthException(access, app, destination);
+		recorded.pending = false;
+		save();
+	}
+}
+//#endregion
 //#region src/cli/platform-access-preflight.ts
 /** Recheck live protection without invoking any provisioning or configuration write. */
 async function verifyInstalledPlatformAccessProtection(input) {
@@ -1490,6 +1991,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	if ([
 		input.plan.apiUrl,
 		input.plan.proxyUrl,
+		...input.dashboardUrl ? [input.dashboardUrl] : [],
 		...input.manifest.endpoints.dashboardUrl ? [input.manifest.endpoints.dashboardUrl] : []
 	].map((value) => new URL(value).origin).some((origin) => !origins.includes(origin)) || protection.applications.some((entry) => entry.audience !== app.aud || !platformAccessPublicDestinations(app).includes(new URL(entry.origin).hostname))) throw new Error("platform: Access audiences and complete origin coverage must match the active platform protection. Restore the current Access checkpoint or repair its applications.");
 	for (const other of await access.list("apps")) {
@@ -1505,7 +2007,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-7d5aV2Jg.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BLadnnct.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1514,8 +2016,243 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 }
 //#endregion
-//#region src/cli/platform-auth-bootstrap.ts
-/** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
+//#region src/cli/platform-app-access.ts
+function answer$1(value) {
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+async function selectInstallationAppAccess(authentication, recorded, choice) {
+	const config = authentication.file?.appAccess;
+	if (config && (typeof config !== "object" || Array.isArray(config) || "apiToken" in config || config.tokenEnv !== void 0 && (typeof config.tokenEnv !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(config.tokenEnv)))) throw new Error("platform: App access configuration must use tokenEnv; plaintext tokens are not accepted.");
+	if (choice && config?.mode && choice !== config.mode) throw new Error("platform: --app-access conflicts with the authentication file’s app access choice.");
+	const supplied = choice ?? config?.mode;
+	if (supplied !== void 0 && ![
+		"public",
+		"platform",
+		"custom"
+	].includes(supplied)) throw new Error("platform: App access must be public, platform, or custom.");
+	if (recorded) {
+		if (supplied !== void 0 && supplied !== recorded.appAccess) throw new Error("platform: Resume with the saved app access choice. Manage an installed platform’s app access in Admin → Zero Trust.");
+		return recorded.appAccess;
+	}
+	const protectedPlatform = !!authentication.authentication.accessProtection;
+	const selected = supplied ?? (!process.stdin.isTTY ? protectedPlatform ? "platform" : "public" : answer$1(await select({
+		message: "Who should be able to access deployed apps?",
+		initialValue: protectedPlatform ? "platform" : "public",
+		options: [
+			...protectedPlatform ? [{
+				value: "platform",
+				label: "Same people allowed by the platform’s Access policy",
+				hint: "recommended"
+			}] : [],
+			{
+				value: "public",
+				label: "Anyone — public apps"
+			},
+			{
+				value: "custom",
+				label: protectedPlatform ? "Choose a different Access policy" : "Set up Cloudflare Access protection"
+			}
+		]
+	})));
+	if (selected === "public" && (config?.identityProviderIds?.length || config?.policyIds?.length)) throw new Error("platform: Public apps cannot select identity policies. Choose custom app access to require company login.");
+	if (selected === "platform" && !protectedPlatform) throw new Error("platform: Reusing the platform Access policy requires --access-protection. Choose --app-access custom to protect apps separately.");
+	if (![
+		"public",
+		"platform",
+		"custom"
+	].includes(String(selected))) throw new Error("platform: Choose who can access deployed apps.");
+	return selected;
+}
+/** Collect the hosting-account policy once, with explicit consent for a durable management token. */
+async function prepareInstallationAppAccess(input) {
+	const choice = input.plan.deployment.appAccess;
+	if (!choice) throw new Error("platform: App access was not selected for this installation.");
+	const explicitToken = (input.authentication.file?.appAccess?.tokenEnv ? process.env[input.authentication.file.appAccess.tokenEnv] : void 0) || process.env.VOID_PLATFORM_APP_ACCESS_TOKEN;
+	if (explicitToken && /\s/.test(explicitToken)) throw new Error("platform: App access tokens must not contain whitespace.");
+	if (input.checkpoint.appAccessSetupJson && !input.checkpoint.appAccessTokenRejected) {
+		const saved = parsePlatformAppAccessSetup(JSON.parse(input.checkpoint.appAccessSetupJson));
+		if (saved.accountId !== input.plan.account.id || saved.mode !== (choice === "public" ? "public" : "protected")) throw new Error("platform: Saved app access belongs to another account or choice.");
+		if (saved.managed) {
+			const refreshed = explicitToken ? JSON.stringify({
+				...saved,
+				apiToken: explicitToken
+			}) : input.checkpoint.appAccessSetupJson;
+			input.save({ appAccessSetupJson: refreshed });
+			return refreshed;
+		}
+	}
+	const file = input.authentication.file?.appAccess;
+	if (file?.tokenEnv && !/^[A-Z_][A-Z0-9_]*$/.test(file.tokenEnv)) throw new Error("platform: Invalid app access token environment reference.");
+	let token = explicitToken || (input.checkpoint.appAccessTokenRejected ? void 0 : input.checkpoint.appAccessToken);
+	if (input.checkpoint.appAccessTokenRejected) log.info("The previous app access token was rejected. Provide a replacement to continue.");
+	const setupSpec = input.checkpoint.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson)) : input.authentication.file?.cloudflareAccess;
+	const setupAccount = setupSpec?.accountId ?? input.plan.account.id;
+	const reusable = setupAccount === input.plan.account.id ? process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN || input.checkpoint.accessManagementToken || input.managementToken : input.managementToken;
+	const tokenPage = () => openPlatformSetupPage({
+		title: "App access API token",
+		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+			to: `/${input.plan.account.id}/api-tokens`,
+			name: `${input.plan.deployment.displayName} App Access`,
+			permissionGroupKeys: JSON.stringify([{
+				key: "access",
+				type: "edit"
+			}, {
+				key: "access_acct",
+				type: "read"
+			}])
+		}),
+		instructions: `Scope the token to ${input.plan.account.name}: Access Apps and Policies Edit; Organizations, Identity Providers, and Groups Read. Void stores it encrypted to manage app access.`
+	});
+	const collectToken = async () => {
+		if (!process.stdin.isTTY) throw new Error("platform: App access requires VOID_PLATFORM_APP_ACCESS_TOKEN or appAccess.tokenEnv in --auth-config, scoped to the hosting account.");
+		tokenPage();
+		const value = String(answer$1(await password({ message: "App access API token (stored encrypted when app rules are needed):" }))).trim();
+		if (!value || /\s/.test(value)) throw new Error("platform: An app access token without whitespace is required.");
+		input.save({
+			appAccessToken: value,
+			appAccessTokenRejected: ""
+		});
+		return value;
+	};
+	if (!token && input.checkpoint.appAccessTokenRejected) token = await collectToken();
+	let access = new PlatformAccessClient(token ? new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }) : input.client, input.plan.account.id);
+	let organization;
+	const readOrganization = async () => {
+		try {
+			return await access.get("organizations");
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
+			throw error;
+		}
+	};
+	try {
+		organization = await readOrganization();
+	} catch (error) {
+		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status)) throw error;
+		log.info("Check this account’s Access requirements before opening app traffic.");
+		token = await collectToken();
+		access = new PlatformAccessClient(new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }), input.plan.account.id);
+		organization = await readOrganization();
+	}
+	const defaultDeny = organization?.deny_unmatched_requests === true;
+	if (choice === "public" && !defaultDeny) {
+		const result = JSON.stringify({
+			version: 1,
+			accountId: input.plan.account.id,
+			mode: "public",
+			managed: false,
+			identityProviderIds: [],
+			policyIds: []
+		});
+		input.save({ appAccessSetupJson: result });
+		return result;
+	}
+	if (!organization) throw new Error(`platform: Enable Zero Trust in account ${input.plan.account.name}, then resume to configure app access.`);
+	if (!token) {
+		log.info("Void needs an Access-management token stored encrypted to manage access for future apps and custom domains.");
+		if (reusable && process.stdin.isTTY && answer$1(await confirm({
+			message: "Reuse the setup token for ongoing app access management?",
+			initialValue: true
+		}))) {
+			token = reusable;
+			input.save({ appAccessToken: token });
+		} else token = await collectToken();
+		access = new PlatformAccessClient(new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }), input.plan.account.id);
+	}
+	let identityProviderIds = [];
+	let policyIds = [];
+	if (choice !== "public") {
+		const reuse = choice === "platform" && setupAccount === input.plan.account.id;
+		if (choice === "platform" && !reuse) log.info("The platform uses Access in another account. Choose equivalent identities and policies in the hosting account for apps.");
+		identityProviderIds = input.checkpoint.appAccessIdentityProviderIds ? JSON.parse(input.checkpoint.appAccessIdentityProviderIds) : (reuse ? setupSpec?.identityProviderIds : void 0) ?? file?.identityProviderIds ?? [];
+		policyIds = input.checkpoint.appAccessPolicyIds ? JSON.parse(input.checkpoint.appAccessPolicyIds) : (reuse ? setupSpec?.policyIds : void 0) ?? file?.policyIds ?? [];
+		if (!identityProviderIds.length) {
+			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.identityProviderIds in --auth-config for the hosting account.");
+			const providers = (await access.list("identity_providers")).map(platformAccessIdentityProvider);
+			if (!providers.length) throw new Error(`platform: Add an identity provider in Zero Trust for ${input.plan.account.name}, then resume.`);
+			identityProviderIds = answer$1(await multiselect({
+				message: "App identity providers:",
+				required: true,
+				options: providers.map((p) => ({
+					value: p.id,
+					label: stripVTControlCharacters(p.name)
+				}))
+			}));
+			input.save({ appAccessIdentityProviderIds: JSON.stringify(identityProviderIds) });
+		}
+		if (!policyIds.length) {
+			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.policyIds in --auth-config for the hosting account.");
+			policyIds = await selectCompanyAccessPolicies(access, await access.list("policies"), input.plan.account.id, "create");
+			input.save({ appAccessPolicyIds: JSON.stringify(policyIds) });
+		}
+	} else log.info("This account requires Access. Void will create public rules scoped to app hostnames.");
+	const setup = parsePlatformAppAccessSetup({
+		version: 1,
+		accountId: input.plan.account.id,
+		mode: choice === "public" ? "public" : "protected",
+		managed: true,
+		apiToken: token,
+		identityProviderIds,
+		policyIds
+	});
+	if (setup.mode === "protected") try {
+		await inspectPlatformAccess(access, setup);
+	} catch (error) {
+		if (error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status)) input.save({ appAccessTokenRejected: "true" });
+		else input.save({
+			appAccessIdentityProviderIds: "",
+			appAccessPolicyIds: ""
+		});
+		throw error;
+	}
+	const result = JSON.stringify(setup);
+	input.save({
+		appAccessSetupJson: result,
+		appAccessIdentityProviderIds: JSON.stringify(identityProviderIds),
+		appAccessPolicyIds: JSON.stringify(policyIds),
+		appAccessTokenRejected: ""
+	});
+	return result;
+}
+var PlatformAppAccessCredentialError = class extends Error {};
+/** Bounded, resumable handoff to the service that owns Zero Trust state. */
+async function initializeInstalledAppAccess(input, fetcher = fetch) {
+	parsePlatformAppAccessSetup(JSON.parse(input.setupJson));
+	if (!input.setupToken || input.setupToken.length < 32) throw new Error("platform: Restore the encrypted app access setup authority before resuming.");
+	const signature = createHmac("sha256", input.setupToken).update(`${PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX}\n${input.installationId}\n${input.setupJson}`).digest("base64url");
+	for (let attempt = 0; attempt < 10; attempt++) {
+		const response = await fetcher(new URL("/internal/platform/app-access", input.apiUrl), {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"X-Void-Platform-Probe": input.probeToken,
+				"X-Void-App-Access-Setup": signature,
+				...cfAccessHeaders(process.env, input.apiUrl)
+			},
+			body: input.setupJson,
+			redirect: "manual",
+			signal: AbortSignal.timeout(6e4)
+		});
+		if (response.status === 403) {
+			const detail = await response.clone().text();
+			if (/1050|Default-Deny/i.test(detail)) throw new Error(`platform: Account Default-Deny blocks the platform API at ${input.apiUrl}. Configure Access for the platform API and its installer credentials, then resume.`);
+		}
+		let body;
+		try {
+			body = await response.json();
+		} catch {
+			throw new Error(`platform: App access setup did not respond (HTTP ${response.status}). Check platform Access permissions and resume.`);
+		}
+		if (body.code === "app_access_credentials") throw new PlatformAppAccessCredentialError("App access token rejected. Resume installation to provide a replacement.");
+		if (!response.ok || body.installationId !== input.installationId) throw new Error(`platform: ${body.error || "App access setup failed."} Resume installation after correcting the Access configuration.`);
+		if (body.ready) return;
+	}
+	throw new Error("platform: App access setup is safely checkpointed. Resume installation to finish before app traffic opens.");
+}
+//#endregion
+//#region src/cli/platform-auth-bootstrap.ts
+/** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
 async function resumeInstalledPlatformAuthentication(input, initialize = initializeInstalledPlatformAuthentication) {
 	const result = await initialize(input.apiUrl, input.installationId, input.setupToken, input.setupJson);
 	if (!result.setupPending || !result.expiresAt || Date.parse(result.expiresAt) > Date.now()) return result;
@@ -1558,6 +2295,26 @@ async function initializeInstalledPlatformAuthentication(apiUrl, installationId,
 }
 //#endregion
 //#region src/cli/platform-auth-database.ts
+/** Restore the selected external origin before an adoption receipt exists. */
+function readPlatformHyperdriveSelection(checkpoint) {
+	if (!checkpoint?.externalHyperdriveJson) return;
+	let value;
+	try {
+		value = JSON.parse(checkpoint.externalHyperdriveJson);
+	} catch {
+		throw new Error("platform: The saved Hyperdrive selection is invalid.");
+	}
+	const selected = value;
+	const nonempty = (value) => typeof value === "string" && value.trim() !== "";
+	if (!selected || typeof selected !== "object" || Array.isArray(selected) || !nonempty(selected.id) || !nonempty(selected.host) || !nonempty(selected.user) || selected.name !== void 0 && (typeof selected.name !== "string" || !selected.name) || selected.database !== void 0 && (typeof selected.database !== "string" || !selected.database)) throw new Error("platform: The saved Hyperdrive selection is invalid.");
+	return {
+		id: selected.id,
+		host: selected.host,
+		user: selected.user,
+		...selected.name ? { name: selected.name } : {},
+		...selected.database ? { database: selected.database } : {}
+	};
+}
 /** Read the database name from an owner URL without applying Hyperdrive origin restrictions. */
 function platformDatabaseNameFromOwnerUrl(databaseUrl) {
 	let url;
@@ -1598,6 +2355,7 @@ async function verifyPlatformAuthenticationDatabase(client, accountId, resource,
 //#endregion
 //#region src/cli/platform-plan.ts
 async function createPlatformInstallPlan(client, input, existing, options) {
+	const dashboardUrl = input.dashboardUrl !== void 0 ? normalizePlatformDashboardUrl(input.dashboardUrl) : existing ? existing.deployment.controlPlane.dashboardUrl ?? (existing.endpoints.dashboardUrl ? normalizePlatformDashboardUrl(existing.endpoints.dashboardUrl) : null) ?? platformDashboardUrl(existing.deployment) : null;
 	const account = resolveAccount(await client.listAccounts(), input.accountId);
 	if (existing && existing.account.id !== account.id) throw new Error(`platform: Refusing to resume installation ${existing.id} in a different Cloudflare account.`);
 	const providedEmailSharedZoneId = input.emailSharedZoneId?.trim();
@@ -1634,8 +2392,10 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...enableEmail ? { email: true } : {}
 	};
 	if (capabilities.email && options?.includeEmailGateway !== false && !enableEmail) throw new Error("platform: Email-enabled installations require VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID before deploying this runtime.");
+	if (input.appAccess && input.appAccess !== "public" && input.controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${input.applicationDomain.toLowerCase()}`)) throw new Error("platform: The API hostname must be outside the app Access wildcard. Use the application domain apex or workers.dev for the API, then plan again.");
 	const deployment = createPlatformDeploymentManifest({
 		authentication: input.authentication ?? existing?.deployment.authentication,
+		appAccess: input.appAccess ?? existing?.deployment.appAccess,
 		...Object.keys(capabilities).length > 0 ? { capabilities } : {},
 		application: {
 			baseDomain: testing ? `${accountSubdomain}.workers.dev` : input.applicationDomain,
@@ -1646,7 +2406,8 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		},
 		controlPlane: {
 			apiHostname: input.controlPlaneDomain || null,
-			dashboardHostname: null,
+			dashboardHostname: dashboardUrl ? new URL(dashboardUrl).hostname : null,
+			...dashboardUrl ? { dashboardUrl } : {},
 			proxyHostname: null
 		},
 		displayName: input.displayName,
@@ -1664,13 +2425,21 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			sandbox: true
 		}
 	} : existingWithoutEmailZone;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithDashboard = {
 		...existingWithSandbox,
+		controlPlane: {
+			...existingWithSandbox.controlPlane,
+			dashboardHostname: deployment.controlPlane.dashboardHostname,
+			...deployment.controlPlane.dashboardUrl ? { dashboardUrl: deployment.controlPlane.dashboardUrl } : {}
+		}
+	};
+	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+		...existingWithDashboard,
 		capabilities: {
-			...existingWithSandbox.capabilities,
+			...existingWithDashboard.capabilities,
 			email: true
 		}
-	} : existingWithSandbox;
+	} : existingWithDashboard;
 	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
@@ -1694,7 +2463,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		}
 		throw error;
 	});
-	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
+	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, deploymentQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
 		Promise.resolve(accountSubdomain),
 		gatewayInventory,
 		client.listKvNamespaces(account.id, names.routingKv),
@@ -1703,6 +2472,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		client.listR2Buckets(account.id),
 		client.listQueues(account.id, names.usageQueue),
 		client.listQueues(account.id, names.cronQueue),
+		options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue") ? client.listQueues(account.id, names.deploymentQueue) : Promise.resolve([]),
 		client.listDispatchNamespaces(account.id),
 		client.listHyperdriveConfigs(account.id),
 		client.listWorkerNames(account.id)
@@ -1737,11 +2507,13 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		const expectedPatterns = new Set(createApplicationRoutes(deployment.application).map((route) => route.pattern));
 		const expectedWorker = deployment.resources.dispatchWorker;
 		const ownedWorker = intentProofs.has("dispatch-worker") || existing?.resources.some((resource) => resource.key === "dispatch-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
-		const conflicts = (await client.listWorkerRoutes(zone.id)).filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
+		const [workerRoutes, workerDomains] = await Promise.all([client.listWorkerRoutes(zone.id), client.listWorkerDomains(account.id)]);
+		const conflicts = workerRoutes.filter((route) => expectedPatterns.has(route.pattern) && (route.script !== expectedWorker || !ownedWorker));
 		if (conflicts.length > 0) {
 			const conflict = conflicts[0];
 			throw new Error(`platform: Application route ${JSON.stringify(conflict.pattern)} is already assigned to ${JSON.stringify(conflict.script ?? "no Worker")}. Choose another application domain.`);
 		}
+		assertApplicationRoutesPreserveWorkerDomains([...expectedPatterns], expectedWorker, ownedWorker === true, zone.name, workerRoutes, workerDomains);
 	}
 	if (deployment.controlPlane.apiHostname) {
 		const apiHostname = deployment.controlPlane.apiHostname;
@@ -1784,6 +2556,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	addNamedPlan(actions, existing, "assets-bucket", "r2-bucket", names.assetsBucket, r2Buckets.filter((resource) => resource.name === names.assetsBucket), "reuse", options, remoteOwnership, intentProofs, ambiguousResources);
 	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
+	if (options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue")) addNamedPlan(actions, existing, "deployment-queue", "queue", names.deploymentQueue, deploymentQueues, "reuse", options, remoteOwnership);
 	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
 	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
 	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
@@ -1828,6 +2601,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		actions,
 		apiUrl,
 		deployment: resolvedDeployment,
+		...resolvedDeployment.appAccess ? { appAccessSetupRequired: !existing?.steps.some((step) => step.key === "app-access-initialized:v1") } : {},
 		...input.externalHyperdrive ? { externalHyperdrive: input.externalHyperdrive } : {},
 		installationId,
 		proxyUrl,
@@ -1861,7 +2635,8 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 	}, manifest, {
 		...options,
 		includeEmailGateway: original.actions.some((entry) => entry.key === "email-gateway-worker"),
-		enableSandbox: original.deployment.capabilities.sandbox
+		enableSandbox: original.deployment.capabilities.sandbox,
+		deploymentExecution: original.actions.some((entry) => entry.key === "deployment-queue")
 	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
@@ -2055,6 +2830,7 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"api-worker": "apiWorker",
 	"assets-bucket": "assetsBucket",
 	"cron-queue": "cronQueue",
+	"deployment-queue": "deploymentQueue",
 	"dispatch-namespace": "dispatchNamespace",
 	"dispatch-worker": "dispatchWorker",
 	hyperdrive: "hyperdrive",
@@ -2066,6 +2842,33 @@ const RESOURCE_NAME_KEY_BY_ACTION = {
 	"tail-worker": "tailWorker",
 	"usage-queue": "usageQueue"
 };
+function assertApplicationRoutesPreserveWorkerDomains(patterns, dispatchWorker, ownedDispatchWorker, zoneName, workerRoutes, workerDomains) {
+	const plannedRoutes = patterns.map(parseWorkerRoutePattern);
+	const existingRoutes = workerRoutes.map((route) => ({
+		...parseWorkerRoutePattern(route.pattern),
+		script: route.script
+	}));
+	for (const domain of workerDomains) {
+		const hostname = domain.hostname.toLowerCase();
+		if (!(domain.zoneName ? domain.zoneName.toLowerCase() === zoneName.toLowerCase() : hostname === zoneName.toLowerCase() || hostname.endsWith(`.${zoneName.toLowerCase()}`)) || domain.service === dispatchWorker && ownedDispatchWorker) continue;
+		for (const planned of plannedRoutes) {
+			if (!workerRouteHostMatches(planned.host, hostname)) continue;
+			if (!["http", "https"].every((scheme) => existingRoutes.some((route) => route.script !== dispatchWorker && route.path === "/*" && (!route.scheme || route.scheme === scheme) && workerRouteHostMatches(route.host, hostname) && route.host.replace(/^\*/, "").length > planned.host.replace(/^\*/, "").length))) throw new Error(`platform: Application route ${JSON.stringify(planned.pattern)} would intercept Worker custom domain ${JSON.stringify(domain.hostname)}, currently served by ${JSON.stringify(domain.service)}. Choose another application domain, or use \`void platform install --workers-dev\` for a new installation and add a suitable domain later.`);
+		}
+	}
+}
+function parseWorkerRoutePattern(pattern) {
+	const match = /^(?:(https?):\/\/)?([^/]+)(\/.*)?$/.exec(pattern);
+	return {
+		host: match?.[2]?.toLowerCase() ?? "",
+		path: match?.[3] ?? "/",
+		pattern,
+		scheme: match?.[1] ?? null
+	};
+}
+function workerRouteHostMatches(host, hostname) {
+	return host.startsWith("*") ? hostname.endsWith(host.slice(1)) : host === hostname;
+}
 function platformProvisionIntentHash(manifest, key, kind, name, previousResourceId = null) {
 	return createHash("sha256").update(JSON.stringify({
 		key,
@@ -2101,16 +2904,21 @@ async function readRemoteOwnership(client, accountId, routingNamespaces, existin
 }
 function formatPlatformInstallPlan(plan) {
 	const lines = [
-		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)} (${plan.account.id})`,
-		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev (testing); add a domain with void platform domain set <domain>`,
-		`${import_picocolors$1.default.bold("Control plane:")} ${plan.apiUrl}`,
-		`${import_picocolors$1.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
-		`${import_picocolors$1.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
-		`${import_picocolors$1.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
-		`${import_picocolors$1.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
-		...plan.deployment.authentication.providers.includes("cloudflare-access") ? ["Access login: create a dedicated OIDC application or connect an existing issuer."] : [],
-		...plan.deployment.authentication.accessProtection ? [`Access protection: verify an application covering ${plan.apiUrl} and ${plan.proxyUrl}, with a separate scoped service token for installation and CI.`] : [],
-		`${import_picocolors$1.default.bold("Database:")} Verify uncached Hyperdrive reads for authentication`,
+		`${import_picocolors.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
+		`${import_picocolors.default.bold("Account:")} ${plan.account.id}`,
+		plan.deployment.application.zoneName ? `${import_picocolors.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors.default.bold("Applications:")} workers.dev for testing. Add a domain with void platform domain set <domain>`,
+		`${import_picocolors.default.bold("Control plane:")} ${plan.apiUrl}`,
+		`${import_picocolors.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
+		...platformDashboardUrl(plan.deployment) ? [`${import_picocolors.default.bold("Dashboard:")} ${platformDashboardUrl(plan.deployment)} (deploy separately)`] : [],
+		`${import_picocolors.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
+		`${import_picocolors.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
+		...plan.deployment.appAccess ? [plan.appAccessSetupRequired === false ? `${import_picocolors.default.bold("App access:")} Preserve administrator settings` : `${import_picocolors.default.bold("Default app access:")} ${{
+			public: "Public apps",
+			platform: "Same as platform Access policy",
+			custom: "Selected Access policy"
+		}[plan.deployment.appAccess]}`] : [],
+		`${import_picocolors.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
+		`${import_picocolors.default.bold("Database:")} ${plan.externalHyperdrive?.database || "PostgreSQL"} via Hyperdrive ${plan.deployment.resources.hyperdrive}`,
 		""
 	];
 	for (const action of plan.actions) lines.push(`${action.action.padEnd(6)} ${action.kind.padEnd(19)} ${action.name}`);
@@ -2600,12 +3408,17 @@ function createPlatformInstallationSecrets(input) {
 	});
 	return {
 		authenticationPreparation: Object.fromEntries(Object.entries(checkpoint).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
+		...checkpoint.appAccessSetupToken ? { appAccessSetupToken: checkpoint.appAccessSetupToken } : {},
+		...checkpoint.appAccessSetupJson ? { appAccessSetupJson: checkpoint.appAccessSetupJson } : {},
+		...checkpoint.managementApiToken ? { managementApiToken: checkpoint.managementApiToken } : {},
+		...checkpoint.externalHyperdriveJson ? { externalHyperdriveJson: checkpoint.externalHyperdriveJson } : {},
 		...modernAuthentication ? {
 			authenticationSetupJson,
 			authSetupToken,
 			authBootstrapCode
 		} : {},
 		...checkpoint.accessProvisioningJson ? { accessProvisioningJson: checkpoint.accessProvisioningJson } : {},
+		...checkpoint.accessHealthProvisioningJson ? { accessHealthProvisioningJson: checkpoint.accessHealthProvisioningJson } : {},
 		...checkpoint.accessCredentialsJson ? { accessCredentialsJson: checkpoint.accessCredentialsJson } : {},
 		workerSecretUpdates: input.updateExistingWorkers ? explicitWorkerSecretUpdates : {},
 		pendingWorkerSecretUpdateIntent: input.updateExistingWorkers ? pendingWorkerSecretUpdateIntent : void 0,
@@ -2675,6 +3488,10 @@ function assertCanonicalProjectSecretKey(value, name, uniqueToInstallation = fal
 }
 function secretCheckpoint(secrets, workerSecretUpdateIntent) {
 	return {
+		...secrets.appAccessSetupToken ? { appAccessSetupToken: secrets.appAccessSetupToken } : {},
+		...secrets.appAccessSetupJson ? { appAccessSetupJson: secrets.appAccessSetupJson } : {},
+		...secrets.managementApiToken ? { managementApiToken: secrets.managementApiToken } : {},
+		...secrets.externalHyperdriveJson ? { externalHyperdriveJson: secrets.externalHyperdriveJson } : {},
 		...Object.fromEntries(Object.entries(secrets.authenticationPreparation ?? {}).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
 		...secrets.authSetupToken ? {
 			authenticationSetupJson: secrets.authenticationSetupJson ?? "",
@@ -2682,6 +3499,7 @@ function secretCheckpoint(secrets, workerSecretUpdateIntent) {
 			authBootstrapCode: secrets.authBootstrapCode ?? ""
 		} : {},
 		...secrets.accessProvisioningJson ? { accessProvisioningJson: secrets.accessProvisioningJson } : {},
+		...secrets.accessHealthProvisioningJson ? { accessHealthProvisioningJson: secrets.accessHealthProvisioningJson } : {},
 		...secrets.accessCredentialsJson ? { accessCredentialsJson: secrets.accessCredentialsJson } : {},
 		bootstrapGitHubId: secrets.bootstrapGitHubId,
 		bootstrapGitHubLogin: secrets.bootstrapGitHubLogin,
@@ -2933,11 +3751,12 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-	const runPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl);
-	const runParallelPinnedPlatformWrangler = (args, accountId, cwd, capture) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, cloudflareApiBaseUrl, true);
+	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl);
+	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
+	if (plan.deployment.appAccess && runtime.appAccessSetup !== 1) throw new Error("platform: This runtime does not support the installation’s app access setup.");
 	const hasEmailGatewayArtifact = runtime.artifacts.emailGateway !== void 0;
 	if (runtime.emailProtocolVersion !== 1 && plan.deployment.capabilities.email) throw new Error("platform: This runtime cannot serve enabled platform email without email protocol version 1.");
 	if (runtime.emailProtocolVersion !== 1 && existing?.resources.some((resource) => resource.key === "email-gateway-worker" && resource.state === "ready")) throw new Error("platform: This runtime cannot replace an installed email gateway Worker. Use a runtime with email protocol version 1.");
@@ -3030,6 +3849,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		parsePostgresConnectionString(secrets.databaseUrl);
 		assertVoidCreatedHyperdriveTrustsDatabase(secrets.databaseUrl);
 	}
+	if (plan.externalHyperdrive) secrets = {
+		...secrets,
+		externalHyperdriveJson: JSON.stringify(plan.externalHyperdrive)
+	};
 	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
 	writePendingInstallationSecrets(manifest, {
 		...pendingSecrets,
@@ -3070,10 +3893,6 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		throw error;
 	}
 	if (workerSecretUpdateIntent && !hasExplicitWorkerSecretUpdates && platformWorkerSecretUpdateIntentState(manifest, workerSecretUpdateIntent) !== "active") workerSecretUpdateIntent = null;
-	let workerDeploymentSecrets = {
-		...secrets,
-		workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
-	};
 	try {
 		assertPlatformRuntimeSafety(runtime, manifest.safetyProtocols, releaseDatabaseLock.requiredSafetyProtocols);
 		if (existing) await dependencies.verifyExistingOwnership?.(manifest, authoritative !== null && authoritative !== void 0);
@@ -3152,6 +3971,12 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = transitionInstallation(manifest, "provisioning", now());
 			writeInstallationManifest(manifest);
 		}
+		if (runtime.deploymentExecution !== 1 && (manifest.deploymentExecution === 1 || dependencies.databaseRollbackSource?.manifest.deploymentExecution === 1)) {
+			if (!releaseDatabaseLock.checkpoint) throw new Error("platform: The database lifecycle lock cannot fence deployment admission.");
+			await releaseDatabaseLock.checkpoint(manifest);
+			dependencies.onProgress?.("Verifying durable deployment operations have drained");
+			await (dependencies.verifyDeploymentExecutionDrain ?? verifyPlatformDeploymentExecutionDrain)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce), manifest.id);
+		}
 		if (dependencies.prepareAuthentication) {
 			dependencies.onProgress?.("Preparing platform authentication");
 			try {
@@ -3186,15 +4011,47 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			activateAccessCredentials();
 			assertRequiredPlatformSecrets(plan, manifest, secrets);
 			if (secrets.authenticationSetupJson && createHash("sha256").update(secrets.authBootstrapCode ?? "").digest("hex") !== parsePlatformAuthenticationSetup(JSON.parse(secrets.authenticationSetupJson)).bootstrapCredentialHash) throw new Error("platform: Prepared authentication does not match its administrator setup code.");
-			workerDeploymentSecrets = {
-				...secrets,
-				workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
-			};
 			writePendingInstallationSecrets(manifest, {
 				...secretCheckpoint(secrets, workerSecretUpdateIntent),
 				databaseClaimState: "claimed"
 			});
 		}
+		const appAccessSetupRequired = !!plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1");
+		if (appAccessSetupRequired) {
+			if (dependencies.prepareAppAccess) try {
+				const appAccessSetupJson = await dependencies.prepareAppAccess(manifest, secrets);
+				const latest = readPendingInstallationSecrets(manifest) ?? {};
+				secrets = {
+					...secrets,
+					appAccessSetupJson,
+					authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)))
+				};
+				writePendingInstallationSecrets(manifest, {
+					...secretCheckpoint(secrets, workerSecretUpdateIntent),
+					databaseClaimState: "claimed"
+				});
+			} catch (error) {
+				const latest = readPendingInstallationSecrets(manifest) ?? {};
+				secrets = {
+					...secrets,
+					appAccessSetupJson: latest.appAccessSetupJson || secrets.appAccessSetupJson,
+					authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)))
+				};
+				throw error;
+			}
+			if (!secrets.appAccessSetupJson) throw new Error("platform: Restore the encrypted app access setup checkpoint before resuming.");
+			if (!secrets.appAccessSetupToken) {
+				if (manifest.resources.some((resource) => resource.key === "api-worker" && resource.state === "ready")) throw new Error("platform: Restore the encrypted app access setup authority before resuming.");
+				secrets = {
+					...secrets,
+					appAccessSetupToken: randomBytes(32).toString("hex")
+				};
+				writePendingInstallationSecrets(manifest, {
+					...secretCheckpoint(secrets, workerSecretUpdateIntent),
+					databaseClaimState: "claimed"
+				});
+			}
+		}
 		if (plan.deployment.authentication.accessProtection) {
 			const protection = liveAuthentication ? liveAuthentication.protection : secrets.authenticationSetupJson ? parsePlatformAuthenticationSetup(JSON.parse(secrets.authenticationSetupJson)).protection : null;
 			if (!protection) throw new Error("platform: The active Access protection configuration is unavailable. Restore its database and encrypted setup checkpoint before maintenance.");
@@ -3203,10 +4060,49 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				client: dependencies.client,
 				manifest,
 				plan,
+				dashboardUrl: platformDashboardUrl(plan.deployment),
 				protection,
 				checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent)
 			});
 		}
+		if (plan.deployment.authentication.accessProtection || appAccessSetupRequired && secrets.appAccessSetupJson && JSON.parse(secrets.appAccessSetupJson).managed === true) {
+			dependencies.onProgress?.("Preparing Access for authenticated platform health checks");
+			try {
+				await (dependencies.prepareHealthAccess ?? ensurePlatformAccessHealthChecks)({
+					client: dependencies.client,
+					manifest,
+					plan,
+					checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent),
+					save: (accessHealthProvisioningJson) => {
+						secrets = {
+							...secrets,
+							accessHealthProvisioningJson
+						};
+						manifest = checkpointAuthenticationResources(manifest, secrets, now());
+						writePendingInstallationSecrets(manifest, {
+							...secretCheckpoint(secrets, workerSecretUpdateIntent),
+							databaseClaimState: "claimed"
+						});
+						writeInstallationManifest(manifest);
+					}
+				});
+			} catch (error) {
+				if (appAccessSetupRequired && secrets.appAccessSetupJson && JSON.parse(secrets.appAccessSetupJson).managed && error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status)) {
+					secrets = {
+						...secrets,
+						authenticationPreparation: {
+							...secrets.authenticationPreparation,
+							appAccessTokenRejected: "true"
+						}
+					};
+					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+					throw new PlatformAppAccessCredentialError("platform: App access token rejected while preparing health checks. Resume installation to provide a replacement.");
+				}
+				throw error;
+			} finally {
+				await releaseDatabaseLock.checkpoint?.(manifest);
+			}
+		}
 		const routingAction = plan.actions.find((action) => action.key === "routing-kv");
 		if (routingAction.action === "adopt") throw new Error("platform: The routing checkpoint cannot be adopted.");
 		if (routingAction.action === "reuse") {
@@ -3270,11 +4166,6 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
 		const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
 		if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
-		const sandboxDrainRoutingKvId = requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv");
-		const writeSandboxDrainMirror = async (preparation) => {
-			await dependencies.client.putKvValue(plan.account.id, sandboxDrainRoutingKvId, PLATFORM_SANDBOX_DRAIN_KEY, preparation.mirrorValue);
-		};
-		if (sandboxDrainPreparation) await writeSandboxDrainMirror(sandboxDrainPreparation);
 		const sandboxDrainState = sandboxDrainPreparation?.state ?? "complete";
 		if (targetSandboxDrainProtocol >= 1 && (manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol) {
 			manifest = {
@@ -3313,7 +4204,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const createsWorker = plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
 		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
-		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain;
+		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1");
 		if (requiresTrafficGuard) {
 			await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 			workerTrafficGuarded = true;
@@ -3330,9 +4221,11 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		}
 		const configInput = {
 			authenticationDatabaseUncached: true,
+			proxyHealthBinding: true,
 			accountId: plan.account.id,
 			apiUrl: plan.apiUrl,
 			deployment: plan.deployment,
+			deploymentExecution: runtime.deploymentExecution,
 			healthProbeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
 			installationId: manifest.id,
 			ownershipNonce: manifest.ownershipNonce,
@@ -3349,6 +4242,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			runtimeEntrypoints: entrypoints,
 			...runtime.assets ? { runtimeApiAssetsDirectory: join(runtimeDirectory, PLATFORM_ADMIN_ASSETS_DIRECTORY) } : {}
 		};
+		const workerDeploymentSecrets = {
+			...secrets,
+			workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
+		};
 		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const enabledConfigs = createPlatformWorkerConfigs({
 			...configInput,
@@ -3544,7 +4441,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		} else for (const key of workerKeys) await deployOneWorker(key);
 		manifest = setInstallationEndpoints(manifest, {
 			apiUrl: plan.apiUrl,
-			dashboardUrl: null,
+			dashboardUrl: platformDashboardUrl(plan.deployment),
 			proxyUrl: plan.proxyUrl
 		}, now());
 		if (preserveDisabled) {
@@ -3555,6 +4452,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			manifest = {
 				...manifest,
 				deployment: plan.deployment,
+				deploymentExecution: runtime.deploymentExecution,
 				platformVersion: version,
 				runtime: runtimeProvenance,
 				updatedAt: now(),
@@ -3614,6 +4512,37 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			writeInstallationManifest(manifest);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 		}
+		if (plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1")) {
+			dependencies.onProgress?.("Configuring and verifying deployed-app access");
+			try {
+				await (dependencies.initializeAppAccess ?? initializeInstalledAppAccess)({
+					apiUrl: plan.apiUrl,
+					installationId: manifest.id,
+					probeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
+					setupJson: secrets.appAccessSetupJson,
+					setupToken: secrets.appAccessSetupToken
+				});
+			} catch (error) {
+				if (error instanceof PlatformAppAccessCredentialError) {
+					secrets = {
+						...secrets,
+						authenticationPreparation: {
+							...secrets.authenticationPreparation,
+							appAccessTokenRejected: "true"
+						}
+					};
+					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+				}
+				throw error;
+			}
+			manifest = recordInstallationStep(manifest, {
+				key: "app-access-initialized:v1",
+				completedAt: now(),
+				resultHash: hash(secrets.appAccessSetupJson)
+			}, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
 		dependencies.onProgress?.("Verifying platform health");
 		const emailGatewayUrl = hasEmailGatewayArtifact && plan.deployment.capabilities.email ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
 		if (plan.deployment.authentication.accessProtection) {
@@ -3622,6 +4551,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		}
 		const healthCheckContext = {
 			accountName: plan.account.name,
+			...plan.deployment.authentication.accessProtection ? { accessProtected: true } : {},
 			workers: [
 				plan.deployment.resources.apiWorker,
 				plan.deployment.resources.proxyWorker,
@@ -3653,9 +4583,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 					zoneNameServers: zone?.nameServers ?? []
 				};
 			}
-			const completedDrain = await prepareSandboxDrain();
-			if (completedDrain.state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
-			await writeSandboxDrainMirror(completedDrain);
+			if ((await prepareSandboxDrain()).state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
 		}
 		if (requiresStagedCommit) {
 			if (!authenticationCutoverCommitted) {
@@ -3766,6 +4694,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		manifest = {
 			...manifest,
 			deployment: plan.deployment,
+			deploymentExecution: runtime.deploymentExecution,
 			platformVersion: version,
 			runtime: runtimeProvenance,
 			safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
@@ -3794,7 +4723,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	}
 }
 function checkpointAuthenticationResources(manifest, secrets, updatedAt) {
-	return checkpointPlatformAccessResources(manifest, secrets.accessProvisioningJson, updatedAt);
+	return checkpointPlatformAccessResources(checkpointPlatformAccessResources(manifest, secrets.accessProvisioningJson, updatedAt), secrets.accessHealthProvisioningJson, updatedAt);
 }
 async function writeR2OwnershipMarkerIfNeeded(client, plan, manifest, action) {
 	if (action.kind !== "r2-bucket") return;
@@ -4044,6 +4973,7 @@ function apiWorkerSecrets(secrets, accountId, zoneId) {
 		JWT_SECRET: secrets.jwtSecret,
 		PLATFORM_BOOTSTRAP_GITHUB_ID: secrets.bootstrapGitHubId,
 		PLATFORM_AUTH_SETUP_TOKEN: secrets.authSetupToken ?? "",
+		PLATFORM_APP_ACCESS_SETUP_TOKEN: secrets.appAccessSetupToken ?? "",
 		...secrets.projectSecretKeysJson && secrets.projectSecretActiveKeyVersion ? {
 			PROJECT_SECRET_ACTIVE_KEY_VERSION: secrets.projectSecretActiveKeyVersion,
 			PROJECT_SECRET_KEYS_JSON: secrets.projectSecretKeysJson
@@ -4404,14 +5334,6 @@ async function preparePlatformSandboxDrainConnection(client, requiredAdmissionPr
 		return {
 			admissionProtocol: row.admission_protocol,
 			generation: row.generation,
-			mirrorValue: JSON.stringify({
-				version: 1,
-				generation: row.generation,
-				state: row.state,
-				startedAt: row.started_at,
-				updatedAt: row.updated_at,
-				...row.completed_at ? { completedAt: row.completed_at } : {}
-			}),
 			state: row.state === "complete" ? "complete" : "pending"
 		};
 	};
@@ -4578,11 +5500,12 @@ let cachedPlatformUploaderHash;
 function platformWorkerUploaderHash() {
 	if (cachedPlatformUploaderHash !== void 0) return cachedPlatformUploaderHash;
 	try {
-		const launcher = resolveWranglerArgv(process.cwd())[1];
+		const launcher = resolveCloudflareOperationArgv(process.cwd())[1];
 		if (!launcher) return cachedPlatformUploaderHash = null;
 		const digest = createHash("sha256");
 		digest.update("platform-uploader:v1\0");
 		digest.update(process.version);
+		digest.update(readFileSync(launcher));
 		digest.update(readFileSync(resolve(dirname(launcher), "..", "..", "package.json")));
 		const cfDirectory = dirname(fileURLToPath(import.meta.resolve("cf/package.json")));
 		digest.update(readFileSync(join(cfDirectory, "package.json")));
@@ -4692,28 +5615,27 @@ function snapshotPlatformWorkerUploadInputs(config, directory) {
 }
 function platformWorkerApiReadRunner(accountId, workerName, readCloudflare, fallback) {
 	const base = `/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}`;
-	return async (args, account, cwd, capture) => {
+	return async (operation, account, cwd, capture) => {
 		try {
-			if (args[0] === "deployments" && (args[1] === "status" || args[1] === "list")) {
+			if (operation.type === "deployments.status" || operation.type === "deployments.list") {
 				const response = await readCloudflare(`${base}/deployments`);
 				const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
 				if (!Array.isArray(deployments)) throw new Error(`platform: Cloudflare returned malformed deployment history for ${workerName}.`);
 				return {
-					status: args[1] === "status" && deployments.length === 0 ? 1 : 0,
+					status: operation.type === "deployments.status" && deployments.length === 0 ? 1 : 0,
 					stderr: "",
-					stdout: JSON.stringify(args[1] === "status" ? deployments[0] : deployments)
-				};
-			}
-			if (args[0] === "versions" && args[1] === "view" && args[2]) {
-				const version = await readCloudflare(`${base}/versions/${encodeURIComponent(args[2])}`);
-				return {
-					status: 0,
-					stderr: "",
-					stdout: JSON.stringify(version)
+					stdout: "",
+					data: operation.type === "deployments.status" ? deployments[0] : deployments
 				};
 			}
+			if (operation.type === "versions.view") return {
+				status: 0,
+				stderr: "",
+				stdout: "",
+				data: await readCloudflare(`${base}/versions/${encodeURIComponent(operation.versionId)}`)
+			};
 		} catch {}
-		return fallback(args, account, cwd, capture);
+		return fallback(operation, account, cwd, capture);
 	};
 }
 async function deployPlatformWorker(config, secrets, options) {
@@ -4831,27 +5753,21 @@ async function deployPlatformWorker(config, secrets, options) {
 			};
 			writeFileSync(configPath, `${JSON.stringify(uploadConfig, null, 2)}\n`, { mode: 384 });
 		}
-		const argv = [
-			...options.workerExisted ? ["versions", "upload"] : ["deploy"],
-			"--config",
+		const operation = {
+			type: options.workerExisted ? "versions.upload" : "worker.deploy",
 			configPath,
-			"--strict",
-			"--experimental-provision=false",
-			"--experimental-auto-create=false",
-			...!options.workerExisted ? ["--autoconfig=false"] : [],
-			"--message",
-			encodeCloudflareVersionMessage([], nextTriggers, uploadedContentHash ?? void 0)
-		];
+			message: encodeCloudflareVersionMessage([], nextTriggers, uploadedContentHash ?? void 0)
+		};
 		if (secrets) {
 			const secretsPath = join(directory, "secrets.json");
 			writeFileSync(secretsPath, JSON.stringify(secrets), { mode: 384 });
-			argv.push("--secrets-file", secretsPath);
+			operation.secretsFilePath = secretsPath;
 		}
 		const releaseUploadSlot = await options.acquireUploadSlot?.();
 		let uploaded;
 		let uploadError;
 		try {
-			uploaded = options.workerExisted ? await options.runner(argv, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(argv, accountId, directory, true, workerName, options.apiBaseUrl);
+			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl);
 			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
 		} catch (error) {
 			uploadError = error;
@@ -4859,7 +5775,8 @@ async function deployPlatformWorker(config, secrets, options) {
 		} finally {
 			releaseUploadSlot?.(uploadError);
 		}
-		uploadedVersionId = parseUploadedPlatformWorkerVersion(`${uploaded.stdout}\n${uploaded.stderr}`);
+		const uploadData = uploaded.data;
+		uploadedVersionId = typeof uploadData?.versionId === "string" ? uploadData.versionId : null;
 		if (!options.workerExisted) activatedVersionId = uploadedVersionId;
 		if (!uploadedVersionId) throw new Error(`platform: Wrangler uploaded ${workerName} without reporting its immutable version id.`);
 		await options.onStaged(previousVersionId, uploadedVersionId, previousTriggers);
@@ -4869,16 +5786,15 @@ async function deployPlatformWorker(config, secrets, options) {
 			const deploymentsBeforeActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (deploymentsBeforeActivation[0]?.id !== previousDeploymentId || !deploymentRunsOnlyVersion(deploymentsBeforeActivation[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently before activation; refusing to overwrite it.`);
 			activatedVersionId = uploadedVersionId;
-			assertCleanPlatformWrangler(await options.runner([
-				"versions",
-				"deploy",
-				`${uploadedVersionId}@100`,
-				"--config",
+			assertCleanPlatformWrangler(await options.runner({
+				type: "versions.deploy",
 				configPath,
-				"--message",
-				`Void platform activation ${uploadedVersionId}`,
-				"--yes"
-			], accountId, directory, true), `activate ${workerName}`);
+				versions: [{
+					versionId: uploadedVersionId,
+					percentage: 100
+				}],
+				message: `Void platform activation ${uploadedVersionId}`
+			}, accountId, directory, true), `activate ${workerName}`);
 		}
 		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 		const lineage = classifyPlatformWorkerDeploymentLineage(deploymentsAfterActivation, uploadedVersionId, previousDeploymentId);
@@ -5072,28 +5988,24 @@ async function rollbackPlatformWorker(input) {
 	}
 }
 function platformWorkerCommandRunner(accountId, cwd, runner) {
-	return (args, options) => runner(args, accountId, cwd, options.capture);
+	return (operation, options) => runner(operation, accountId, cwd, options.capture);
 }
-async function runPlatformWrangler(args, accountId, cwd, capture) {
-	return runPlatformWranglerAtApiBase(args, accountId, cwd, capture);
+async function runPlatformWrangler(operation, accountId, cwd, capture) {
+	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
 }
 const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
+async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
 	const startedAt = performance.now();
 	const result = await createDefaultRunWrangler(process.cwd(), {
-		launcher: resolveWranglerArgv(process.cwd()),
+		launcher: resolveCloudflareOperationArgv(process.cwd()),
 		parallelWorkerUpload,
 		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
-	})([...args], {
+	})(operation, {
 		accountId,
 		apiBaseUrl,
-		captureJson: capture,
 		cwd
 	});
-	if (process.env.VOID_PLATFORM_TIMINGS === "1") {
-		const operation = args[0] === "versions" || args[0] === "deployments" ? `${args[0]} ${args[1] ?? ""}` : args[0] ?? "unknown";
-		process.stderr.write(`[platform timing] wrangler ${operation} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
-	}
+	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
 	const stdout = result.stdout || "";
 	const stderr = result.stderr || "";
 	if (!capture && result.status !== 0) {
@@ -5101,7 +6013,7 @@ async function runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBa
 		if (stderr) process.stderr.write(stderr);
 	}
 	return {
-		status: result.status,
+		...result,
 		stderr,
 		stdout
 	};
@@ -5222,48 +6134,30 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
 	return result;
 }
-async function runPlatformWranglerForConditionalCreate(args, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
-	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(args, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
+async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
 }
 async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner([
-		"deployments",
-		"status",
-		"--config",
+	const result = await runner({
+		type: "deployments.status",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
 	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
 	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
 	return active[0].version_id;
 }
 async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner([
-		"deployments",
-		"list",
-		"--config",
+	const result = await runner({
+		type: "deployments.list",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
 	return value.map((entry, index) => {
 		if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.created_on !== "string" || !Array.isArray(entry.versions)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
@@ -5298,16 +6192,15 @@ async function restorePlatformWorkerDeployment(input) {
 	if (restorationVersions.length === 0 || restorationVersions.length > 2 || restorationVersions.some((version, index) => version.percentage > 100 || restorationVersions.findIndex((entry) => entry.versionId === version.versionId) !== index) || Math.abs(totalPercentage - 100) > .001) throw new Error(`Worker ${input.workerName} deployment ${input.restoration.id} has an unsupported traffic distribution.`);
 	const before = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (before[0]?.id !== input.expectedActiveDeploymentId || !deploymentRunsOnlyVersion(before[0], input.expectedActiveVersionId) || before[1]?.id !== input.restoration.id || !samePlatformWorkerTraffic(before[1], input.restoration)) throw new Error(`Worker ${input.workerName} changed concurrently before deployment restoration; refusing to overwrite the newer deployment.`);
-	assertCleanPlatformWrangler(await input.runner([
-		"versions",
-		"deploy",
-		...restorationVersions.map((version) => `${version.versionId}@${version.percentage}`),
-		"--config",
-		input.configPath,
-		"--message",
-		`Void platform restoration ${input.restoration.id}`,
-		"--yes"
-	], input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
+	assertCleanPlatformWrangler(await input.runner({
+		type: "versions.deploy",
+		configPath: input.configPath,
+		versions: restorationVersions.map((version) => ({
+			versionId: version.versionId,
+			percentage: version.percentage
+		})),
+		message: `Void platform restoration ${input.restoration.id}`
+	}, input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
 	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
@@ -5363,23 +6256,14 @@ async function readActivePlatformWorkerSnapshot(configPath, accountId, workerNam
 	});
 }
 async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, versionId, runner, validateCurrentVersion) {
-	const result = await runner([
-		"versions",
-		"view",
+	const result = await runner({
+		type: "versions.view",
 		versionId,
-		"--config",
 		configPath,
-		"--name",
-		workerName,
-		"--json"
-	], accountId, process.cwd(), true);
+		workerName
+	}, accountId, process.cwd(), true);
 	assertCleanPlatformWrangler(result, `read rollback metadata for ${workerName}`);
-	let value;
-	try {
-		value = JSON.parse(result.stdout);
-	} catch {
-		throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
-	}
+	const value = result.data;
 	if (!value || typeof value !== "object") throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
 	const resources = value.resources;
 	const bindings = resources && typeof resources === "object" && !Array.isArray(resources) ? resources.bindings : null;
@@ -5405,11 +6289,8 @@ function withoutCompletedPlatformWorkerMigrations(config, activeMigrationTag) {
 	delete result.migrations;
 	return result;
 }
-function parseUploadedPlatformWorkerVersion(output) {
-	return /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i.exec(output)?.[1] ?? null;
-}
 function assertCleanPlatformWrangler(result, operation) {
-	if (result.status !== 0) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
+	if (result.status !== 0 || result.signal || result.error) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
 }
 function cleanPlatformCommandResult() {
 	return {
@@ -5530,18 +6411,18 @@ function parseWorkerCutoverSnapshot(value) {
 		return null;
 	}
 }
-function interruptedWorkerCutover(manifest) {
+function workerCutoverGenerations(manifest) {
 	const generations = /* @__PURE__ */ new Map();
 	for (const step of manifest.steps) {
 		const resolution = /^worker-cutover:(\d+):(committed|restored)$/.exec(step.key);
 		if (resolution) {
 			const generation = Number(resolution[1]);
 			const entry = generations.get(generation) ?? {
-				resolved: false,
+				resolution: null,
 				staged: /* @__PURE__ */ new Map(),
 				unsafeTraffic: /* @__PURE__ */ new Set()
 			};
-			entry.resolved = true;
+			entry.resolution = resolution[2];
 			generations.set(generation, entry);
 			continue;
 		}
@@ -5549,7 +6430,7 @@ function interruptedWorkerCutover(manifest) {
 		if (unsafeTraffic) {
 			const generation = Number(unsafeTraffic[1]);
 			const entry = generations.get(generation) ?? {
-				resolved: false,
+				resolution: null,
 				staged: /* @__PURE__ */ new Map(),
 				unsafeTraffic: /* @__PURE__ */ new Set()
 			};
@@ -5563,14 +6444,17 @@ function interruptedWorkerCutover(manifest) {
 		const snapshot = parseWorkerCutoverSnapshot(step.resultHash);
 		if (!snapshot) throw new Error(`platform: Invalid Worker cutover checkpoint ${step.key}.`);
 		const entry = generations.get(generation) ?? {
-			resolved: false,
+			resolution: null,
 			staged: /* @__PURE__ */ new Map(),
 			unsafeTraffic: /* @__PURE__ */ new Set()
 		};
 		entry.staged.set(staged[2], snapshot);
 		generations.set(generation, entry);
 	}
-	const unresolved = [...generations.entries()].filter(([, entry]) => !entry.resolved && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
+	return generations;
+}
+function interruptedWorkerCutover(manifest) {
+	const unresolved = [...workerCutoverGenerations(manifest).entries()].filter(([, entry]) => entry.resolution === null && entry.staged.size > 0).sort(([left], [right]) => right - left)[0];
 	return unresolved ? {
 		generation: unresolved[0],
 		staged: unresolved[1].staged,
@@ -5584,8 +6468,8 @@ async function verifyPlatformWorkerCutoverVersions(manifest, generation, configs
 	"tail",
 	"dispatch"
 ]) {
-	const cutover = interruptedWorkerCutover(manifest);
-	if (cutover?.generation !== generation || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
+	const cutover = workerCutoverGenerations(manifest).get(generation);
+	if (!cutover || cutover.resolution === "restored" || cutover.staged.size !== workerKeys.length) throw new Error(`platform: Worker cutover generation ${generation} is missing a complete immutable-version checkpoint.`);
 	const directory = mkdtempSync(join(tmpdir(), "void-platform-cutover-verify-"));
 	try {
 		for (const key of workerKeys) {
@@ -5638,7 +6522,15 @@ function errorMessage(error) {
 }
 var PlatformAccessBlockedError = class extends Error {
 	constructor(url, context) {
-		super([
+		super(context?.accessProtected ? [
+			"platform: Cloudflare Access blocked a protected platform health check (Default-Deny, error 1050).",
+			`Blocked URL: ${url}`,
+			"Keep employee Access protection and account-wide Default-Deny enabled.",
+			"The reserved dispatch /health endpoint uses a path-only Access exception and still requires Void’s private probe token.",
+			"Resume to verify the health exceptions and saved installer credentials.",
+			...context.resumeCommand ? [`Resume: ${context.resumeCommand}`] : [],
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
+		].join("\n") : [
 			"platform: Cloudflare Access blocked the platform health checks (Default-Deny, error 1050).",
 			`Blocked URL: ${url}`,
 			"",
@@ -5684,16 +6576,16 @@ async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicatio
 		request(`${dispatchUrl}/health`),
 		context?.emailGatewayUrl ? request(`${context.emailGatewayUrl}/health`) : void 0
 	]);
-	if (!health.ok) throw await platformProbeFailure("Health check", apiUrl, health, context);
-	if (!discovery.ok) throw await platformProbeFailure("Discovery check", apiUrl, discovery, context);
+	if (!health.ok) throw await platformProbeFailure("Health check", `${apiUrl}/health`, health, context);
+	if (!discovery.ok) throw await platformProbeFailure("Discovery check", `${apiUrl}/.well-known/void-platform`, discovery, context);
 	const body = await discovery.json();
 	if (body.installationId !== installationId) throw new Error("platform: Deployed API discovery identity does not match this installation.");
 	if (body.platformVersion !== platformVersion) throw new Error("platform: Deployed API discovery version does not match this release.");
 	if ((body.usageProtocolVersion ?? 0) !== usageProtocolVersion) throw new Error("platform: Deployed API usage protocol does not match this runtime. Traffic remains disabled.");
-	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", proxyUrl, proxy, context);
-	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", dispatchUrl, dispatch, context);
+	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", `${proxyUrl}/health`, proxy, context);
+	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", `${dispatchUrl}/health`, dispatch, context);
 	if (emailGateway) {
-		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", context.emailGatewayUrl, emailGateway, context);
+		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", `${context.emailGatewayUrl}/health`, emailGateway, context);
 		const identity = await emailGateway.json();
 		if (identity?.installationId !== installationId || identity.platformVersion !== platformVersion || identity.emailProtocolVersion !== 1) throw new Error("platform: Deployed email gateway identity, version, or protocol does not match this installation.");
 	}
@@ -5721,9 +6613,8 @@ async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fe
 	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
 	return status.state === "complete";
 }
-async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
-	const response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
-		method: "POST",
+async function verifyPlatformDeploymentExecutionDrain(apiUrl, healthProbeToken, installationId, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/__void/platform/deployment-execution`, {
 		headers: {
 			"X-Void-Platform-Probe": healthProbeToken,
 			...cfAccessHeaders(process.env, apiUrl)
@@ -5731,29 +6622,124 @@ async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher =
 		signal: AbortSignal.timeout(3e4),
 		redirect: "manual"
 	});
+	if (!response.ok) throw new Error(`platform: Deployment execution drain probe failed (HTTP ${response.status}). Keep the current runtime until its durable deployment operations have drained.`);
 	let value;
 	try {
 		value = await response.json();
 	} catch {
-		throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		throw new Error("platform: Deployment execution drain probe returned an invalid document.");
 	}
-	const status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (!response.ok || status?.version !== 1 || status.state !== "ready" || typeof status.operationId !== "string" || status.operationId.length === 0) {
-		const detail = status && typeof status.operationId === "string" ? ` Operation ${status.operationId}: ${typeof status.operationStatus === "string" ? status.operationStatus : "incomplete"}.` : status && typeof status.operationStatus === "string" ? ` Operation status: ${status.operationStatus}.` : "";
+	const status = value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+	if (status?.protocolVersion !== 1 || status.installationId !== installationId || typeof status.admissionClosed !== "boolean" || !Number.isSafeInteger(status.pendingDeployments) || Number(status.pendingDeployments) < 0) throw new Error("platform: Deployment execution drain probe returned an invalid document.");
+	if (!status.admissionClosed || status.pendingDeployments !== 0) throw new Error("platform: Durable deployment operations are still admitted or unfinished. Keep the current runtime and retry this command after they finish.");
+}
+async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
+	const deadline = Date.now() + 3e5;
+	let operationId = null;
+	const timedOut = () => /* @__PURE__ */ new Error(`platform: Shared email bootstrap did not finish within five minutes at ${apiUrl}.${operationId ? ` Operation ${operationId} remains incomplete.` : ""} Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+	const waitForProgress = async () => {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		await new Promise((resolve) => setTimeout(resolve, Math.min(1e3, remaining)));
+	};
+	let response;
+	let value;
+	let status;
+	for (;;) {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		const signal = AbortSignal.timeout(Math.min(12e4, remaining));
+		try {
+			response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
+				method: "POST",
+				headers: {
+					"X-Void-Platform-Probe": healthProbeToken,
+					...cfAccessHeaders(process.env, apiUrl)
+				},
+				signal,
+				redirect: "manual"
+			});
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap request failed at ${apiUrl}. Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+		}
+		try {
+			value = await response.json();
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		}
+		status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+		const observedOperationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		if (status?.version === 1 && observedOperationId) {
+			if (operationId && operationId !== observedOperationId) throw new Error("platform: Shared email bootstrap operation identity changed while waiting. Traffic remains disabled. Inspect the installation before retrying.");
+			operationId = observedOperationId;
+		}
+		if ([
+			200,
+			202,
+			503
+		].includes(response.status) && status?.version === 1 && status.state === "incomplete" && observedOperationId && (status.operationStatus === "pending" || status.operationStatus === "running") && status.failureCode == null) {
+			await waitForProgress();
+			continue;
+		}
+		break;
+	}
+	if (!response.ok || status?.version !== 1 || status.state !== "ready" || operationId === null || status.operationId !== operationId || status.operationStatus != null && status.operationStatus !== "completed" || status.failureCode != null) {
+		const code = (value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,63}$/.test(value) ? value : null;
+		const operationStatus = code(status?.operationStatus);
+		const operationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		const details = operationId ? [`Operation ${operationId}: ${operationStatus ?? "incomplete"}.`] : operationStatus ? [`Operation status: ${operationStatus}.`] : [];
+		const currentStep = code(status?.currentStep);
+		const failureCode = code(status?.failureCode);
+		if (currentStep) details.push(`Step: ${currentStep}.`);
+		if (failureCode) details.push(`Failure: ${failureCode}.`);
+		let domain = null;
+		if (typeof status?.domain === "string") try {
+			domain = normalizeApplicationDomain(status.domain);
+		} catch {}
+		const inboundStatus = code(status?.inboundStatus);
+		if (domain) details.push(`Domain: ${domain}${inboundStatus ? ` (inbound: ${inboundStatus})` : ""}.`);
+		const mxDetail = domain ? `MX records for ${domain} do not route mail to Cloudflare Email Routing` : null;
+		const safeDetails = [
+			...domain ? [mxDetail, `enabled explicit Cloudflare email rules conflict with ${domain}`] : [],
+			"zone catch-all does not point to this ingress",
+			"another enabled catch-all owns this zone"
+		];
+		if (typeof status?.failureDetail === "string" && safeDetails.includes(status.failureDetail)) {
+			details.push(`${status.failureDetail}.`);
+			if (currentStep === "inbound_probe" && status.failureDetail === mxDetail) details.push(`Enable Email Routing for ${domain} in the Cloudflare dashboard, then resume this installation.`);
+		}
+		const detail = details.length ? ` ${details.join(" ")}` : "";
 		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
 	}
-	return status.operationId;
+	return operationId;
 }
 function createPlatformHealthProbeToken(ownershipNonce) {
 	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
 }
 //#endregion
 //#region src/cli/platform-install-auth.ts
+function platformManagementAccessForAuthentication(selection, accountId, checkpoint) {
+	if (!selection.authentication.accessProtection && (!selection.authentication.providers.includes("cloudflare-access") || selection.file && !selection.file.cloudflareAccess)) return;
+	const spec = selection.file?.cloudflareAccess ?? (checkpoint?.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(checkpoint.accessSetupSpecJson)) : void 0);
+	if (spec?.accountId && spec.accountId !== accountId) return;
+	return {
+		protection: !!selection.authentication.accessProtection,
+		readOnly: spec?.mode === "existing"
+	};
+}
 function answer(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
-async function selectInstallationAuthentication(file, recorded) {
+async function selectInstallationAuthentication(file, recorded, choices = {}) {
 	if (file) {
 		const input = JSON.parse(await readFile(file, "utf8"));
 		if (!input || typeof input !== "object" || Array.isArray(input) || !("connections" in input) || !Array.isArray(input.connections) || !input.connections.length || input.connections.length > 32) throw new Error("platform: An authentication file must define between 1 and 32 connections.");
@@ -5772,11 +6758,14 @@ async function selectInstallationAuthentication(file, recorded) {
 			file: selected
 		};
 	}
-	if (recorded) return { authentication: recorded };
-	if (!process.stdin.isTTY) return { authentication: { providers: ["github"] } };
-	const providers = answer(await multiselect({
-		message: "Platform login methods:",
-		initialValues: ["github"],
+	if (recorded) {
+		if (choices.loginMethods && JSON.stringify(choices.loginMethods) !== JSON.stringify(recorded.providers) || choices.accessProtection !== void 0 && choices.accessProtection !== !!recorded.accessProtection) throw new Error("platform: Resume with the recorded login methods and protection settings.");
+		return { authentication: recorded };
+	}
+	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
+	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : answer(await multiselect({
+		message: "Platform login methods (select all that apply):",
+		initialValues: [],
 		required: true,
 		options: [
 			{
@@ -5796,11 +6785,11 @@ async function selectInstallationAuthentication(file, recorded) {
 				label: "Cloudflare Access login"
 			}
 		]
-	}));
-	const protection = answer(await confirm({
+	})));
+	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : answer(await confirm({
 		message: "Also protect the platform UI and APIs with Cloudflare Access?",
 		initialValue: false
-	}));
+	})));
 	return { authentication: {
 		providers,
 		...protection || providers.length !== 1 || providers[0] !== "github" ? { configurable: true } : {},
@@ -5837,6 +6826,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	const accessEntry = entries.find((entry) => entry.configuration.kind === "cloudflare-access");
 	const prepared = access && (selection.authentication.accessProtection || accessEntry && (!selection.file || selection.file.cloudflareAccess)) ? await preparePlatformAccessSetup({
 		plan,
+		...platformDashboardUrl(plan.deployment) ? { additionalOrigins: [platformDashboardUrl(plan.deployment)] } : {},
 		ownershipNonce: access.ownershipNonce,
 		protection: !!selection.authentication.accessProtection,
 		...accessEntry ? { login: {
@@ -5983,6 +6973,72 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	return result;
 }
 //#endregion
+//#region src/cli/platform-saved-plans.ts
+function planId(args) {
+	return createHash("sha256").update(JSON.stringify([args.account, args.name])).digest("hex");
+}
+function parseSavedPlan(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected an installation plan.");
+	const record = value;
+	if (record.schemaVersion !== 1 || !Array.isArray(record.arguments) || !record.arguments.every((arg) => typeof arg === "string")) throw new Error("Invalid installation plan format.");
+	const args = parsePlatformArgs(record.arguments);
+	if (args.subcommand !== "install" || args.plan || args.resume || args.yes || !args.account || !args.name || !args.displayName) throw new Error("Saved plans must contain installation choices without mutation approval.");
+	if (typeof record.accountName !== "string" || !record.accountName || typeof record.savedAt !== "string" || !Number.isFinite(Date.parse(record.savedAt))) throw new Error("Invalid installation plan metadata.");
+	return {
+		id: planId(args),
+		args,
+		accountName: record.accountName,
+		savedAt: record.savedAt
+	};
+}
+function savePlatformInstallChoices(arguments_, accountName, directory = platformRegistryDirectory()) {
+	const record = {
+		schemaVersion: 1,
+		arguments: arguments_,
+		accountName,
+		savedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const plan = parseSavedPlan(record);
+	mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const path = join(directory, `plan-${plan.id}.json`);
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	try {
+		writeFileSync(temporary, JSON.stringify(record, null, 2) + "\n", {
+			mode: 384,
+			flag: "wx"
+		});
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+	return plan;
+}
+function listSavedPlatformInstallPlans(directory = platformRegistryDirectory()) {
+	let entries;
+	try {
+		entries = readdirSync(directory, { withFileTypes: true });
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	return entries.filter((entry) => entry.isFile() && /^plan-[a-f0-9]{64}\.json$/.test(entry.name)).map((entry) => {
+		const path = join(directory, entry.name);
+		try {
+			const plan = parseSavedPlan(JSON.parse(readFileSync(path, "utf8")));
+			if (entry.name !== `plan-${plan.id}.json`) throw new Error("Plan identity does not match its file.");
+			return plan;
+		} catch (error) {
+			throw new Error(`platform: Invalid saved installation plan ${path}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}).sort((left, right) => right.savedAt.localeCompare(left.savedAt) || left.id.localeCompare(right.id));
+}
+function removeSavedPlatformInstallPlan(args, directory = platformRegistryDirectory()) {
+	rmSync(join(directory, `plan-${planId(args)}.json`), { force: true });
+}
+//#endregion
 //#region src/cli/platform-setup-draft.ts
 const STARTED = "credential-setup:v1";
 const COMPLETED = "credential-setup-complete:v1";
@@ -6018,7 +7074,7 @@ function savePlatformSetupDraft(plan, version) {
 		resultHash: plan.installationId
 	}, now);
 	writeInstallationManifest(manifest);
-	writePendingInstallationSecrets(manifest, {});
+	writePendingInstallationSecrets(manifest, plan.externalHyperdrive ? { externalHyperdriveJson: JSON.stringify(plan.externalHyperdrive) } : {});
 	return manifest;
 }
 function completePlatformSetupDraft(manifest) {
@@ -6032,234 +7088,10 @@ function completePlatformSetupDraft(manifest) {
 	return completed;
 }
 //#endregion
-//#region src/cli/platform-setup.ts
-function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
-	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + page.title + "\x1B]8;;\x1B\\" : page.title + ": " + page.url;
-}
-function platformSetupFieldHelp(key) {
-	const docs = (page, section, title) => platformSetupLink({
-		title,
-		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
-	});
-	switch (key) {
-		case "databaseUrl": return {
-			placeholder: "postgresql://user:pw@…/database",
-			description: "Stores platform users, projects, and deployments; use an empty hosted database, e.g. " + platformSetupLink({
-				title: "Neon",
-				url: "https://neon.com/"
-			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
-		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32; save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately; save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		default: return;
-	}
-}
-function supportsSetupLinks() {
-	return !!process.stdout.isTTY && ([
-		"ghostty",
-		"iTerm.app",
-		"WezTerm",
-		"vscode",
-		"WarpTerminal"
-	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
-}
-/** Dashboard keys use permission-catalog labels, which can differ from product names. */
-function platformSetupPages(plan) {
-	const needsGateway = plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect");
-	const permissions = [
-		{
-			key: "account_settings",
-			type: "read"
-		},
-		{
-			key: "workers_scripts",
-			type: "edit"
-		},
-		{
-			key: "workers_kv_storage",
-			type: "edit"
-		},
-		{
-			key: "workers_r2",
-			type: "edit"
-		},
-		{
-			key: "d1",
-			type: "edit"
-		},
-		{
-			key: "queues",
-			type: "edit"
-		},
-		{
-			key: "account_analytics",
-			type: "read"
-		},
-		{
-			key: "workers_tail",
-			type: "read"
-		},
-		{
-			key: "query_cache",
-			type: "edit"
-		},
-		...needsGateway ? [{
-			key: "aig",
-			type: "edit"
-		}] : [],
-		...plan.deployment.application.zoneName ? [{
-			key: "cache",
-			type: "purge"
-		}] : [],
-		...plan.deployment.capabilities.customDomains ? [{
-			key: "ssl_and_certificates",
-			type: "edit"
-		}] : [],
-		...plan.deployment.capabilities.email ? [
-			{
-				key: "zone",
-				type: "read"
-			},
-			{
-				key: "zone_settings",
-				type: "edit"
-			},
-			{
-				key: "email_routing_address",
-				type: "edit"
-			},
-			{
-				key: "email_routing_rule",
-				type: "edit"
-			},
-			{
-				key: "email_sending",
-				type: "edit"
-			}
-		] : []
-	];
-	return {
-		runtime: {
-			title: "Cloudflare runtime token",
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/api-tokens",
-				name: plan.deployment.displayName + " Runtime",
-				permissionGroupKeys: JSON.stringify(permissions)
-			}),
-			instructions: [
-				"Review the preselected permissions for account " + plan.account.name + ".",
-				"Edit: Workers Scripts, KV, R2, D1, Queues, Hyperdrive" + (needsGateway ? ", AI Gateway." : "."),
-				"Read: Account Settings, Account Analytics, Workers Tail.",
-				...plan.deployment.application.zoneName ? ["Zone " + plan.deployment.application.zoneName + ": Cache Purge: Purge."] : [],
-				...plan.deployment.capabilities.customDomains ? ["Custom project domains also need SSL and Certificates: Edit on that zone."] : [],
-				...plan.deployment.capabilities.email ? ["Email-enabled installations need Email Routing Addresses: Edit and Email Sending: Edit on the account, plus Zone: Read, Zone Settings: Edit and Email Routing Rules: Edit on the mail zones."] : [],
-				"If the form differs, match the permissions above. Create the token, then paste it here."
-			].join("\n")
-		},
-		github: {
-			title: "GitHub OAuth App",
-			url: "https://github.com/settings/applications/new",
-			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
-		},
-		r2: {
-			title: "R2 upload token",
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/r2/api-tokens/create",
-				type: "account"
-			}),
-			instructions: [
-				"Select Object Read & Write (the form defaults to read-only).",
-				"Keep Apply to all buckets in this account (including newly created buckets) selected.",
-				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
-			].join("\n")
-		}
-	};
-}
-function formatPlatformSetupPlan(plan) {
-	const pages = platformSetupPages(plan);
-	return [
-		"Credentials needed (paste them into the installer; keep a password-manager copy):",
-		platformSetupLink(pages.runtime),
-		pages.runtime.instructions,
-		"",
-		platformSetupLink(pages.r2),
-		pages.r2.instructions,
-		"",
-		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github), pages.github.instructions] : [],
-		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => `${provider === "google" ? "Google OAuth client" : provider === "oidc" ? "OIDC connection" : "Cloudflare Access OIDC application"}: client ID and secret; callback ${plan.apiUrl}/auth/callback.`),
-		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access protection: configure API and proxy origins and admitted installer/CI credentials."] : []
-	].join("\n");
-}
-function formatPlatformInstallCommand(options) {
-	const quote = (value) => {
-		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
-		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
-	};
-	const parts = [
-		options.commandName,
-		"platform",
-		"install"
-	];
-	const flag = (name, value) => {
-		if (value) parts.push(name, quote(value));
-	};
-	if (options.resumeId) {
-		parts.push("--resume");
-		flag("--name", options.resumeId);
-	} else {
-		flag("--name", options.installationSlug);
-		flag("--account", options.accountId);
-		flag("--display-name", options.displayName);
-		if (options.workersDev) parts.push("--workers-dev");
-		else {
-			flag("--application-domain", options.applicationDomain);
-			flag("--zone", options.zoneName);
-			if (options.dedicatedZone) parts.push("--dedicated-zone");
-		}
-		flag("--control-plane-domain", options.controlPlaneDomain);
-	}
-	flag("--auth-config", options.authConfig ?? "");
-	flag("--runtime", options.runtime);
-	if (options.yes) parts.push("--yes");
-	return parts.join(" ");
-}
-function openPlatformSetupPage(page, dependencies = {}) {
-	log.info(page.title + "\n" + page.instructions);
-	console.log(platformSetupLink({
-		...page,
-		title: "Open " + page.title
-	}));
-	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
-		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
-	} catch {
-		log.info("Could not open the browser. Use the link above.");
-	}
-}
-//#endregion
 //#region src/cli/prompt-password.ts
-var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
-/** A visual example for an empty secret field; never a default value or an unmasked input. */
-async function passwordWithPlaceholder(options) {
-	return await new u$1({
-		input: options.input,
-		output: options.output,
-		signal: options.signal,
-		mask: options.mask ?? S_PASSWORD_MASK,
-		validate: options.validate,
-		render() {
-			const guide = options.withGuide ?? settings.withGuide;
-			const prefix = `${guide ? `${import_picocolors.default.gray(S_BAR)}\n` : ""}${symbol(this.state)}  ${options.message}\n`;
-			const bar = guide ? `${import_picocolors.default.gray(S_BAR)}  ` : "";
-			if (this.state === "submit" || this.state === "cancel") return `${prefix}${bar}${import_picocolors.default.dim(this.masked)}`;
-			if (this.state === "error") {
-				const masked = this.masked;
-				if (options.clearOnError) this.clear();
-				return `${prefix}${bar}${import_picocolors.default.dim(masked)}\n${guide ? `${import_picocolors.default.yellow(S_BAR_END)}  ` : ""}${import_picocolors.default.yellow(this.error)}\n`;
-			}
-			const input = this.userInput.length === 0 ? import_picocolors.default.dim(options.placeholder) : this.userInputWithCursor;
-			return `${prefix}${guide ? `${import_picocolors.default.cyan(S_BAR)}  ` : ""}${input}\n${guide ? import_picocolors.default.cyan(S_BAR_END) : ""}\n`;
-		}
-	}).prompt() ?? CANCEL_SYMBOL;
+/** A visual example for an empty secret field; never a default value or unmasked input. */
+function passwordWithPlaceholder(options) {
+	return password(options);
 }
 //#endregion
 //#region src/cli/platform-lifecycle.ts
@@ -6276,17 +7108,17 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 	}
 	return explicit || recorded;
 }
-async function runPlatformLifecycleCommand(args) {
-	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-D6Xcy9ZX.mjs");
-		await runPlatformDomainCommand(args);
+async function runPlatformLifecycleCommand(commandArgs) {
+	if (commandArgs.subcommand === "domain") {
+		const { runPlatformDomainCommand } = await import("./platform-domain-Di6EYrQl.mjs");
+		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
-	if (args.subcommand === "discover") {
+	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
-		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-BvtcXON5.mjs");
-		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
+		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
+		const { recoverPlatformInstallations } = await import("./platform-recovery-BJnQJEtQ.mjs");
+		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
 			return;
@@ -6294,18 +7126,20 @@ async function runPlatformLifecycleCommand(args) {
 		for (const manifest of recovered) log.success(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
 		return;
 	}
-	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-DOtss0BN.mjs");
-		await runInstalledPlatformCommand(args);
+	if (commandArgs.subcommand !== "install") {
+		const { runInstalledPlatformCommand } = await import("./platform-management-DG47jys8.mjs");
+		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
-	const runtime = loadPlatformRuntime(args.runtime);
+	let args = commandArgs;
+	let runtime = loadPlatformRuntime(args.runtime);
 	assertNoninteractivePlatformMutationAcknowledged(args, process.stdin.isTTY === true);
 	console.log();
 	intro(cliTitle("platform install"));
 	let existing = args.resume ? resolveInstallationManifest(args.name) : null;
 	let selectedInstall = false;
 	let selectedDraft = false;
+	let installationName = args.name;
 	const { input: installationSlug, credential: operatorCredential } = await resolvePlatformCloudflareCredentialWithInput(async () => {
 		let requestedName = args.name;
 		const resumableInstalls = () => listInstallationManifests().filter((manifest) => isPlatformInstallInProgress(manifest) && (!args.account || manifest.account.id === args.account || manifest.account.name.toLowerCase() === args.account.toLowerCase()));
@@ -6321,21 +7155,42 @@ async function runPlatformLifecycleCommand(args) {
 		};
 		if (!args.resume && process.stdin.isTTY) {
 			const installs = resumableInstalls().filter((manifest) => !args.name || manifest.deployment.installationSlug === normalizeInstallationSlug(args.name));
-			if (installs.length > 0) {
+			const manifests = listInstallationManifests();
+			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
+			if (installs.length > 0 || savedPlans.length > 0) {
 				const choice = await select({
 					message: "Continue a previous platform install?",
-					options: [...installs.map((install) => ({
-						value: install.id,
-						label: `Continue setup for ${install.deployment.displayName} (${install.deployment.installationSlug})`,
-						hint: install.account.name
-					})), {
-						value: "new",
-						label: "Start a new platform install"
-					}]
+					options: [
+						...installs.map((install) => ({
+							value: install.id,
+							label: `Continue setup for ${install.deployment.displayName} (${install.deployment.installationSlug})`,
+							hint: install.account.name
+						})),
+						...savedPlans.map((saved) => ({
+							value: `plan:${saved.id}`,
+							label: `Use saved plan for ${saved.args.displayName} (${saved.args.name})`,
+							hint: `${saved.accountName} · ${saved.args.workersDev ? "workers.dev" : saved.args.applicationDomain}`
+						})),
+						{
+							value: "new",
+							label: "Start a new platform install"
+						}
+					]
 				});
 				if (isCancel(choice) || typeof choice === "symbol") throw new Error("platform: Cancelled.");
 				if (choice === "new") requestedName = "";
-				else {
+				else if (choice.startsWith("plan:")) {
+					const saved = savedPlans.find((plan) => `plan:${plan.id}` === choice);
+					if (!saved) throw new Error("platform: The selected plan is no longer available.");
+					args = {
+						...saved.args,
+						plan: args.plan,
+						yes: args.yes
+					};
+					runtime = loadPlatformRuntime(args.runtime);
+					installationName = args.name;
+					requestedName = args.name;
+				} else {
 					const selected = installs.find((install) => install.id === choice);
 					if (!selected) throw new Error("platform: The selected setup is no longer available.");
 					selectInstall(selected);
@@ -6379,6 +7234,7 @@ async function runPlatformLifecycleCommand(args) {
 				continue;
 			}
 			assertNewNameAvailable(slug);
+			installationName = name.trim();
 			return slug;
 		}
 		if (existing.endpoints.apiUrl && !readPendingInstallationSecrets(existing)) throw new Error(`platform: Installation ${existing.id} has already been deployed. Use \`void platform repair ${existing.id}\` or \`void platform upgrade ${existing.id}\` instead.`);
@@ -6407,12 +7263,12 @@ async function runPlatformLifecycleCommand(args) {
 		if (isCancel(mode)) throw new Error("platform: Cancelled.");
 		workersDev = mode === "workers-dev";
 	}
-	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", "example.app")));
+	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", { placeholder: "example.com" })));
 	const zoneName = recorded?.application.zoneName ?? (workersDev ? "" : normalizeApplicationDomain(args.zone || await promptText("Cloudflare zone:", applicationDomain)));
-	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationSlug} Void`));
-	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY ? await promptText("Optional custom API hostname (leave empty for workers.dev):", "", true) : "");
+	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationName || installationSlug} Void`));
+	let controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY && !args.noControlPlaneDomain ? await promptText("Where do you want to host the Void Platform API? Leave empty for a workers.dev fallback.", { placeholder: applicationDomain || "platform.example.com" }, true) : "");
 	let dedicatedZone = recorded?.application.dedicatedZone ?? args.dedicatedZone;
-	if (!workersDev && !recorded && !args.dedicatedZone && applicationDomain === zoneName && process.stdin.isTTY) {
+	if (!workersDev && !recorded && !args.dedicatedZone && !args.dedicatedZoneSpecified && applicationDomain === zoneName && process.stdin.isTTY) {
 		const catchAll = await confirm({
 			message: `Dedicate all unmatched ${zoneName} traffic to Void apps?`,
 			initialValue: false
@@ -6437,6 +7293,26 @@ async function runPlatformLifecycleCommand(args) {
 		}
 		const checkpoint = existing ? readPendingInstallationSecrets(existing) : null;
 		const databaseUrl = resolvePlatformInstallDatabaseUrl(checkpoint, existing);
+		let authoritativeProvisionIntents = false;
+		if (existing && !isPlatformSetupDraft(existing)) {
+			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
+			progress = startProgress("Reading the saved installation");
+			const authoritative = await readPlatformDatabaseLifecycleManifest(databaseUrl, existing.id, existing.ownershipNonce);
+			progress?.stop("Read the saved installation.");
+			progress = void 0;
+			if (authoritative) {
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DG47jys8.mjs");
+				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
+				authoritativeProvisionIntents = true;
+				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
+				existing = selected;
+				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
+			}
+		}
+		const savedHyperdrive = readPlatformHyperdriveSelection(checkpoint);
+		const requestedHyperdriveId = args.hyperdrive || savedHyperdrive?.id;
+		const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
+		if (savedHyperdrive && requestedHyperdriveId !== savedHyperdrive.id || recordedHyperdrive && requestedHyperdriveId && (requestedHyperdriveId === "create" ? recordedHyperdrive.ownership === "adopted" : recordedHyperdrive.id !== requestedHyperdriveId) || savedHyperdrive && recordedHyperdrive && (recordedHyperdrive.ownership !== "adopted" || recordedHyperdrive.id !== savedHyperdrive.id)) throw new Error("platform: The selected Hyperdrive differs from the saved installation. Resume with its original Hyperdrive.");
 		const externalHyperdriveId = process.env.VOID_PLATFORM_HYPERDRIVE_ID?.trim() || "";
 		const externalHyperdriveHost = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST?.trim() || "";
 		const externalHyperdriveUser = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER?.trim() || "";
@@ -6454,11 +7330,14 @@ async function runPlatformLifecycleCommand(args) {
 			host: externalHyperdriveHost,
 			user: externalHyperdriveUser
 		} : void 0;
-		if (!externalHyperdrive && process.stdin.isTTY && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
+		if (requestedHyperdriveId && externalHyperdrive && requestedHyperdriveId !== externalHyperdrive.id) throw new Error("platform: --hyperdrive conflicts with VOID_PLATFORM_HYPERDRIVE_ID.");
+		if (savedHyperdrive && externalHyperdrive && (savedHyperdrive.host.toLowerCase() !== externalHyperdrive.host.toLowerCase() || savedHyperdrive.user !== externalHyperdrive.user)) throw new Error("platform: The Hyperdrive origin differs from the saved installation.");
+		if (savedHyperdrive) externalHyperdrive = recordedHyperdrive ? savedHyperdrive : void 0;
+		if (!externalHyperdrive && requestedHyperdriveId !== "create" && (process.stdin.isTTY || requestedHyperdriveId) && (!existing || isPlatformSetupDraft(existing) || requestedHyperdriveId) && !recordedHyperdrive) {
 			const suggestedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
 			const configurations = await client.listHyperdriveConfigs(accountId);
 			const suggestedNameAvailable = !configurations.some((resource) => resource.name === suggestedName);
-			const choice = await select({
+			const choice = requestedHyperdriveId ? "existing" : await select({
 				message: "How should Void set up Hyperdrive?",
 				options: [
 					...configurations.length > 0 ? [{
@@ -6478,12 +7357,12 @@ async function runPlatformLifecycleCommand(args) {
 			});
 			if (isCancel(choice)) throw new Error("platform: Cancelled.");
 			if (choice === "setup") {
-				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` (for example ${suggestedName})` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, import_picocolors.default.bold("Set up Hyperdrive first"));
 				outro("No Cloudflare or local installation state was changed.");
 				return;
 			}
 			if (choice === "existing") {
-				const selectedId = await select({
+				const selectedId = requestedHyperdriveId ?? await select({
 					message: "Which Hyperdrive should Void use?",
 					options: [...configurations].sort((a, b) => Number(b.name === suggestedName) - Number(a.name === suggestedName) || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)).map((resource) => ({
 						value: resource.id,
@@ -6496,43 +7375,38 @@ async function runPlatformLifecycleCommand(args) {
 				if (!selected) throw new Error("platform: The selected Hyperdrive is no longer available.");
 				const live = await client.getHyperdriveConfig(accountId, selected.id);
 				if (live.id !== selected.id || live.name !== selected.name || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${selected.name}.`);
-				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${live.name}`);
+				if (savedHyperdrive && (live.origin.host !== savedHyperdrive.host.toLowerCase() || live.origin.user !== savedHyperdrive.user || savedHyperdrive.name && live.name !== savedHyperdrive.name || savedHyperdrive.database && live.origin.database !== savedHyperdrive.database) || existing && !isPlatformSetupDraft(existing) && live.name !== existing.deployment.resources.hyperdrive) throw new Error("platform: The Hyperdrive origin or name differs from the saved installation.");
+				if (!requestedHyperdriveId) note([
+					`${import_picocolors.default.bold("Database:")} ${live.origin.database}`,
+					`${import_picocolors.default.bold("Host:")} ${live.origin.host}`,
+					`${import_picocolors.default.bold("Port:")} ${live.origin.port ?? "configured by Cloudflare Tunnel"}`,
+					`${import_picocolors.default.bold("User:")} ${live.origin.user}`,
+					`${import_picocolors.default.bold("SQL result caching:")} ${live.cachingDisabled ? "disabled" : "enabled"}`
+				].join("\n"), import_picocolors.default.bold(`Existing Hyperdrive ${live.name}`));
 				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${live.name} before installing.`);
-				const confirmed = await confirm({
-					message: `Use ${live.name} for this platform?`,
-					initialValue: true
-				});
-				if (isCancel(confirmed) || !confirmed) throw new Error("platform: Cancelled.");
 				externalHyperdrive = {
 					id: live.id,
 					name: live.name,
+					database: live.origin.database,
 					host: live.origin.host,
 					user: live.origin.user
 				};
 			}
 		}
-		let authoritativeProvisionIntents = false;
-		if (existing && !isPlatformSetupDraft(existing)) {
-			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
-			progress = startProgress("Reading the saved installation");
-			const authoritative = await readPlatformDatabaseLifecycleManifest(databaseUrl, existing.id, existing.ownershipNonce);
-			progress?.stop("Read the saved installation.");
-			progress = void 0;
-			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DOtss0BN.mjs");
-				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
-				authoritativeProvisionIntents = true;
-				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
-				existing = selected;
-				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
-			}
+		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication, args);
+		const appAccess = await selectInstallationAppAccess(authenticationSelection, existing?.deployment, args.appAccess);
+		while (!existing && process.stdin.isTTY && !args.controlPlaneDomain && appAccess && appAccess !== "public" && controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${applicationDomain.toLowerCase()}`)) {
+			log.info("App Access covers subdomains. Use the domain apex or workers.dev for the platform API.");
+			controlPlaneDomain = await promptText("Platform API hostname. Leave empty for workers.dev:", { placeholder: applicationDomain }, true);
 		}
-		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication);
+		if (appAccess && runtime.manifest.appAccessSetup !== 1) throw new Error("platform: This runtime does not support guided app access. Use the current packaged runtime.");
 		const planInput = {
+			appAccess,
 			authentication: authenticationSelection.authentication,
 			accountId,
 			applicationDomain,
 			controlPlaneDomain,
+			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
 			dedicatedZone,
 			displayName,
 			...externalHyperdrive ? { externalHyperdrive } : {},
@@ -6542,50 +7416,118 @@ async function runPlatformLifecycleCommand(args) {
 			zoneName,
 			...workersDev ? { workersDev: true } : {}
 		};
-		let plan = await createPlatformInstallPlan(client, planInput, existing, {
+		const planOptions = {
 			authoritativeProvisionIntents,
 			allowUnverifiedAiGateway: true,
 			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
-			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
-		});
-		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
-		note(formatPlatformRuntime(runtime), "Platform runtime");
+			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
+			deploymentExecution: runtime.manifest.deploymentExecution === 1
+		};
+		let plan = await createPlatformInstallPlan(client, planInput, existing, planOptions);
+		const commandOptions = {
+			commandName: cliCommandName(),
+			accountId,
+			installationSlug,
+			displayName,
+			applicationDomain,
+			zoneName,
+			controlPlaneDomain,
+			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
+			dedicatedZone,
+			workersDev,
+			authConfig: args.authConfig,
+			appAccess,
+			authentication: authenticationSelection.authentication,
+			hyperdrive: !existing || isPlatformSetupDraft(existing) || externalHyperdrive && !recordedHyperdrive ? externalHyperdrive?.id ?? "create" : void 0,
+			runtime: args.runtime,
+			...existing ? { resumeId: existing.id } : {},
+			yes: args.yes || process.stdin.isTTY !== true
+		};
+		if (!existing) savePlatformInstallChoices(platformInstallCommandArguments({
+			...commandOptions,
+			runtime: args.runtime ? resolve(args.runtime) : "",
+			...args.authConfig ? { authConfig: resolve(args.authConfig) } : {},
+			yes: false
+		}).slice(2), plan.account.name);
+		note(formatPlatformInstallPlan(plan), import_picocolors.default.bold(args.plan ? "Read-only installation plan" : "Installation plan"));
+		note(formatPlatformRuntime(runtime), import_picocolors.default.bold("Platform runtime"));
+		const managementAccess = process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN ? void 0 : platformManagementAccessForAuthentication(authenticationSelection, accountId, checkpoint);
+		const needsManagementToken = platformOperatorNeedsManagementToken(operatorCredential, plan, managementAccess);
 		if (args.plan) {
-			console.log(formatPlatformSetupPlan(plan));
-			console.log(`\n${existing ? "To resume this installation later:" : "To install with these settings later:"}\n${formatPlatformInstallCommand({
-				commandName: cliCommandName(),
-				accountId,
-				installationSlug,
-				displayName,
-				applicationDomain,
-				zoneName,
-				controlPlaneDomain,
-				dedicatedZone,
-				workersDev,
-				authConfig: args.authConfig,
-				runtime: args.runtime,
-				...existing ? { resumeId: existing.id } : {},
-				yes: args.yes || process.stdin.isTTY !== true
-			})}\n`);
-			if (!existing && !args.authConfig && process.stdin.isTTY) console.log("Choose the same login methods when prompted.\n");
-			outro("No Cloudflare or local installation state was changed.");
+			note(formatPlatformSetupPlan(plan, {
+				managementToken: needsManagementToken,
+				managementAccess: !!managementAccess
+			}), import_picocolors.default.bold("Required Credentials"));
+			if (!existing) log.info("Plan saved locally for your next install.");
+			outro("Plan complete and ready to execute.");
+			console.log(`\n${import_picocolors.default.bold(existing ? "Next step: run this command to resume" : "Next, run this command to install the platform")}\n\n${import_picocolors.default.blue(formatPlatformInstallCommand(commandOptions))}\n`);
 			return;
 		}
-		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
+		if (!process.stdin.isTTY) assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan, managementAccess);
 		if (process.stdin.isTTY && !args.yes) {
 			const proceed = await confirm({
 				message: "Apply this plan?",
-				initialValue: false
+				initialValue: true
 			});
 			if (isCancel(proceed) || !proceed) {
 				outro("No changes made.");
 				return;
 			}
 		}
+		let managementApiToken = operatorCredential.source === "oauth" ? checkpoint?.managementApiToken || "" : "";
+		if (needsManagementToken || managementApiToken) {
+			let token = managementApiToken;
+			let openedManagementPage = false;
+			const forgetRejectedManagementToken = () => {
+				managementApiToken = "";
+				if (existing && checkpoint?.managementApiToken) {
+					delete checkpoint.managementApiToken;
+					writePendingInstallationSecrets(existing, checkpoint);
+				}
+				token = "";
+			};
+			while (true) {
+				if (!token) {
+					if (!openedManagementPage) {
+						openPlatformSetupPage(platformManagementSetupPage(plan, { access: managementAccess ?? false }));
+						openedManagementPage = true;
+					}
+					token = (await promptSecret("Paste management API token:", true, (value) => value.trim() ? void 0 : "A value is required.")).trim();
+				}
+				const management = new PlatformCloudflareClient(token, { apiBase: client.apiBaseUrl });
+				try {
+					if (!(await management.listAccounts()).some((account) => account.id === accountId)) {
+						forgetRejectedManagementToken();
+						log.warn(`This token cannot access ${plan.account.name}. Check its account scope and try again.`);
+						continue;
+					}
+					const verified = await createPlatformInstallPlan(management, planInput, existing, planOptions);
+					assertPlatformInstallPlanUnchanged(plan, verified, "management API token");
+					if (managementAccess) await verifyPlatformManagementAccess(management, accountId, managementAccess);
+					client = management;
+					plan = verified;
+					managementApiToken = token;
+					break;
+				} catch (error) {
+					if (!isPlatformTokenAuthorizationError(error)) throw error;
+					forgetRejectedManagementToken();
+					log.warn("Cloudflare rejected this token. Check its permissions and account/zone scope, then paste a replacement.");
+				}
+			}
+		} else if (managementAccess) await verifyPlatformManagementAccess(client, accountId, managementAccess);
 		if (!existing) existing = savePlatformSetupDraft(plan, runtime.manifest.platformVersion);
+		removeSavedPlatformInstallPlan({
+			...args,
+			account: accountId,
+			name: installationSlug
+		});
 		const setupManifest = existing;
 		const credentialSetup = isPlatformSetupDraft(existing);
 		const values = { ...checkpoint };
+		if (managementAccess) delete values.accessManagementToken;
+		if (managementApiToken) values.managementApiToken = managementApiToken;
+		if (externalHyperdrive) values.externalHyperdriveJson = JSON.stringify(externalHyperdrive);
+		if (managementApiToken || externalHyperdrive || managementAccess) writePendingInstallationSecrets(setupManifest, values);
 		const saveValues = (updates) => {
 			Object.assign(values, updates);
 			if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
@@ -6623,7 +7565,7 @@ async function runPlatformLifecycleCommand(args) {
 					plan = await verifyPlatformAiGatewayPlan(client, planInput, existing, plan, authoritativeProvisionIntents);
 				}
 			} catch (error) {
-				if (credentialSetup && token === values.cloudflareApiToken && isRuntimeTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
+				if (credentialSetup && token === values.cloudflareApiToken && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
 					delete values.cloudflareApiToken;
 					writePendingInstallationSecrets(setupManifest, values);
 					rejectedSavedRuntimeToken = true;
@@ -6740,15 +7682,30 @@ async function runPlatformLifecycleCommand(args) {
 					accessCredentialsJson: values.accessCredentialsJson
 				};
 			} } : {},
+			...appAccess ? { prepareAppAccess: async () => {
+				progress?.stop("Preparing deployed-app access.");
+				progress = void 0;
+				const setupJson = await prepareInstallationAppAccess({
+					plan,
+					authentication: authenticationSelection,
+					client,
+					managementToken: values.managementApiToken || (operatorCredential.source !== "oauth" ? operatorCredential.token : void 0),
+					checkpoint: values,
+					save: saveAuthenticationValues
+				});
+				progress = startProgress("Continuing platform installation");
+				return setupJson;
+			} } : {},
 			replanWorkers: async (manifest) => (await createPlatformInstallPlan(client, planInput, manifest, {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
 				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
-				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3
+				enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
+				deploymentExecution: runtime.manifest.deploymentExecution === 1
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DOtss0BN.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DG47jys8.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -6760,21 +7717,21 @@ async function runPlatformLifecycleCommand(args) {
 				});
 			}
 		});
-		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused; progress is saved." : "Platform installed.");
+		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused. Progress is saved." : "Platform installed.");
 		progress = void 0;
 		if (result.waitingForDns) {
-			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, "Waiting for nameservers");
+			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, import_picocolors.default.bold("Waiting for nameservers"));
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
 		if (result.waitingForSandboxDrain) {
-			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`; follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
+			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`. Follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", import_picocolors.default.bold("Waiting for managed Sandbox drain"));
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
 		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 		log.info(`API URL: ${plan.apiUrl}`);
-		if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
+		if (result.emailOperationId) log.info(`Shared email routing ready. Operation: ${result.emailOperationId}.`);
 		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
 		if (result.setupPending && completedAuthCode) {
 			log.info(`First administrator setup: ${plan.apiUrl}/setup`);
@@ -6796,16 +7753,16 @@ async function runPlatformLifecycleCommand(args) {
 		}
 	}
 }
-function isRuntimeTokenAuthorizationError(error, requestPathIncludes) {
+function isPlatformTokenAuthorizationError(error, requestPathIncludes) {
 	for (let depth = 0; depth < 5 && error instanceof Error; depth++, error = error.cause) if (error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status) && (!requestPathIncludes || error.requestPath?.includes(requestPathIncludes))) return true;
 	return false;
 }
 function formatPlatformRuntime(runtime) {
 	return [
-		`${import_picocolors$1.default.bold("Version:")} ${runtime.manifest.platformVersion}`,
-		`${import_picocolors$1.default.bold("Source:")} ${runtime.source}`,
-		`${import_picocolors$1.default.bold("Revision:")} ${runtime.manifest.sourceRevision ?? "not recorded"}`,
-		`${import_picocolors$1.default.bold("Manifest SHA-256:")} ${runtime.manifestSha256}`
+		`${import_picocolors.default.bold("Version:")} ${runtime.manifest.platformVersion}`,
+		`${import_picocolors.default.bold("Source:")} ${runtime.source}`,
+		`${import_picocolors.default.bold("Revision:")} ${runtime.manifest.sourceRevision ?? "not recorded"}`,
+		`${import_picocolors.default.bold("Manifest SHA-256:")} ${runtime.manifestSha256}`
 	].join("\n");
 }
 async function verifyPlatformAiGatewayPlan(client, input, existing, preview, authoritativeProvisionIntents) {
@@ -6814,12 +7771,17 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 		verified = await createPlatformInstallPlan(client, input, existing, {
 			authoritativeProvisionIntents,
 			includeEmailGateway: preview.actions.some((entry) => entry.key === "email-gateway-worker"),
-			enableSandbox: preview.deployment.capabilities.sandbox
+			enableSandbox: preview.deployment.capabilities.sandbox,
+			deploymentExecution: preview.actions.some((entry) => entry.key === "deployment-queue")
 		});
 	} catch (error) {
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
 		throw error;
 	}
+	assertPlatformInstallPlanUnchanged(preview, verified, "AI Gateway access");
+	return verified;
+}
+function assertPlatformInstallPlanUnchanged(preview, verified, check) {
 	const infrastructure = (plan) => plan.actions.filter((action) => action.kind !== "ai-gateway").map(({ action, id, key, kind, name }) => ({
 		action,
 		id,
@@ -6827,8 +7789,7 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 		kind,
 		name
 	}));
-	if (verified.installationId !== preview.installationId || JSON.stringify(verified.deployment) !== JSON.stringify(preview.deployment) || JSON.stringify(infrastructure(verified)) !== JSON.stringify(infrastructure(preview))) throw new Error("platform: Resources changed while checking AI Gateway access. Rerun the command to review the updated plan. No platform resources were created.");
-	return verified;
+	if (verified.installationId !== preview.installationId || JSON.stringify(verified.deployment) !== JSON.stringify(preview.deployment) || JSON.stringify(infrastructure(verified)) !== JSON.stringify(infrastructure(preview))) throw new Error(`platform: Resources changed while checking ${check}. Rerun the command to review the updated plan. No platform resources were created.`);
 }
 function assertNoninteractivePlatformMutationAcknowledged(args, interactive) {
 	if (args.subcommand === "list" || args.subcommand === "use" || args.subcommand === "status" || args.subcommand === "discover" || args.plan || interactive || args.yes) return;
@@ -6842,7 +7803,8 @@ async function readAccounts(client) {
 async function selectAccount(accounts, selector) {
 	if (selector) {
 		const matches = accounts.filter((account) => account.id === selector || account.name.toLowerCase() === selector.toLowerCase());
-		if (matches.length !== 1) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is ambiguous or unavailable.`);
+		if (matches.length === 0) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is unavailable through the current access token. Run ${import_picocolors.default.blue("void cloudflare status")} to see which accounts have access, and re-authenticate if necessary.`);
+		if (matches.length > 1) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is ambiguous. Use --account <id> to select a specific account.`);
 		return matches[0].id;
 	}
 	if (accounts.length === 1) return accounts[0].id;
@@ -6863,10 +7825,17 @@ async function promptText(message, value, optional = false, validate) {
 		if (optional) return "";
 		throw new Error(`platform: ${message.replace(/:$/, "")} is required in non-interactive mode.`);
 	}
+	const defaultValue = typeof value === "string" ? value : void 0;
 	const input = await text$1({
 		message,
-		...typeof value === "string" ? { initialValue: value } : value,
-		validate: (input) => input ? validate?.(input) : optional ? void 0 : "A value is required."
+		...typeof value === "string" ? {
+			placeholder: value,
+			defaultValue
+		} : value,
+		validate: (input) => {
+			const candidate = input || defaultValue;
+			return candidate ? validate?.(candidate) : optional ? void 0 : "A value is required.";
+		}
 	});
 	if (isCancel(input) || typeof input === "symbol") throw new Error("platform: Cancelled.");
 	return input;