void 0.23.0 → 0.24.0

package/dist/{platform-lifecycle-9OyBALhH.mjs → platform-lifecycle-BBoNzojY.mjs}

@@ -1,21 +1,20 @@
-import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
-import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { d as openBrowser } from "./auth-CSkdO2Bb.mjs";
-import { a as listInstallationManifests, d as readInstallationRecoverySecrets, f as readPendingInstallationSecrets, g as savePlatformConnection, h as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformWorkerSecretUpdateIntentState, n as assertPlatformInstallationSlugAvailable, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as promoteInstallationSecrets, v as writeInstallationManifest, y as writePendingInstallationSecrets } from "./platform-registry-QBa4DK32.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-P0iZnu0q.mjs";
-import { B as text$1, E as confirm, F as password, G as settings, I as select, K as u$1, M as multiselect, N as note, O as intro, P as outro, R as symbol, U as CANCEL_SYMBOL, W as isCancel, g as S_PASSWORD_MASK, i as S_BAR_END, j as log, r as S_BAR } from "./dist-CTBk70IR.mjs";
+import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
+import { _ as savePlatformConnection, a as listInstallationManifests, b as writePendingInstallationSecrets, d as promoteInstallationSecrets, f as readInstallationRecoverySecrets, g as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformRegistryDirectory, n as assertPlatformInstallationSlugAvailable, p as readPendingInstallationSecrets, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as platformWorkerSecretUpdateIntentState, y as writeInstallationManifest } from "./platform-registry-DkPPXfp_.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-BGe5sWXF.mjs";
+import { u as openBrowser } from "./auth-CQkSDS50.mjs";
+import { A as confirm, B as note, H as outro, K as select, L as log, N as intro, U as password, X as text$1, tt as isCancel, z as multiselect } from "./prompts-BNUoTiaf.mjs";
 import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
 import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-CJFgTZY8.mjs";
-import { c as import_picocolors$1, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
-import { copyFileSync, cpSync, existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-CaoxO_U7.mjs";
+import { c as import_picocolors, i as createSpinner, n as cliCommandName, r as cliTitle } from "./output-CbM85T4k.mjs";
+import { t as parsePlatformArgs } from "./platform-args-3k8X9-H_.mjs";
+import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { readFile } from "node:fs/promises";
@@ -142,7 +141,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		} catch (error) {
 			const status = error instanceof PlatformCloudflareApiError ? error.status : null;
 			const reason = status === null ? "the request failed" : `HTTP ${status}`;
-			const guidance = status === 401 || status === 403 ? "Check your Cloudflare login or API token permissions for this account, then rerun the command." : status === 404 ? `Check ${setupUrl}. If no subdomain is shown, finish Workers onboarding and choose one; otherwise check account access and retry.` : "Rerun the command. If the dashboard already shows a subdomain, no Workers onboarding change is needed.";
+			const guidance = status === 401 || status === 403 ? "Check your Cloudflare login or API token permissions for this account, then rerun the command." : status === 404 ? `Open ${setupUrl} once to provision your account for Workers automatically, then retry the install.` : "Rerun the command. If the dashboard already shows a subdomain, no Workers onboarding change is needed.";
 			throw new Error(`platform: Could not read the workers.dev subdomain for account ${accountId} (${reason}). ${guidance}`, { cause: error });
 		}
 		if (typeof result?.subdomain !== "string" || result.subdomain.trim() === "") throw new Error(`platform: This Cloudflare account does not have a workers.dev subdomain. Open ${setupUrl}, finish Workers onboarding, choose a subdomain, and rerun the command.`);
@@ -680,11 +679,12 @@ function hyperdriveOriginConfigHash(origin) {
 		host: origin.host.toLowerCase(),
 		port: origin.port,
 		scheme: "postgresql",
-		user: origin.user
+		user: origin.user,
+		...origin.accessClientId ? { accessClientId: origin.accessClientId } : {}
 	})).digest("hex");
 }
 function hyperdriveOriginMatches(live, expected) {
-	return live.database === expected.database && live.host.toLowerCase() === expected.host.toLowerCase() && live.port === expected.port && live.scheme === expected.scheme && (live.user === null || live.user === expected.user);
+	return live.database === expected.database && live.host.toLowerCase() === expected.host.toLowerCase() && live.port === expected.port && live.accessClientId === expected.accessClientId && live.scheme === expected.scheme && (live.user === null || live.user === expected.user);
 }
 function parseHyperdriveConfig(value) {
 	const origin = value.origin;
@@ -692,13 +692,15 @@ function parseHyperdriveConfig(value) {
 	const record = origin;
 	const scheme = requiredString(record.scheme, "Hyperdrive origin scheme").toLowerCase();
 	if (scheme !== "postgres" && scheme !== "postgresql") throw new Error(`platform: Unsupported Hyperdrive origin scheme ${JSON.stringify(scheme)}.`);
-	const port = typeof record.port === "number" ? record.port : Number(record.port);
-	if (!Number.isInteger(port) || port <= 0 || port > 65535) throw new Error("platform: Cloudflare Hyperdrive config has an invalid origin port.");
+	const accessClientId = typeof record.access_client_id === "string" && record.access_client_id ? record.access_client_id : void 0;
+	const port = accessClientId && record.port == null ? null : typeof record.port === "number" || typeof record.port === "string" ? Number(record.port) : NaN;
+	if (port !== null && (!Number.isInteger(port) || port <= 0 || port > 65535)) throw new Error("platform: Cloudflare Hyperdrive config has an invalid origin port.");
 	return {
 		id: requiredString(value.id, "Hyperdrive id"),
 		name: requiredString(value.name, "Hyperdrive name"),
 		cachingDisabled: !!value.caching && typeof value.caching === "object" && !Array.isArray(value.caching) && value.caching.disabled === true,
 		origin: {
+			...accessClientId ? { accessClientId } : {},
 			database: requiredString(record.database, "Hyperdrive origin database"),
 			host: requiredString(record.host, "Hyperdrive origin host").toLowerCase(),
 			port,
@@ -1124,7 +1126,343 @@ async function verifyPlatformAccessApplication(client, input, app, type, machine
 	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
 }
 //#endregion
+//#region src/cli/platform-setup.ts
+function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
+	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + import_picocolors.default.underline(page.title) + "\x1B]8;;\x1B\\" : page.title + ": " + import_picocolors.default.underline(page.url);
+}
+function platformSetupFieldHelp(key) {
+	const docs = (page, section, title) => platformSetupLink({
+		title,
+		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
+	});
+	switch (key) {
+		case "databaseUrl": return {
+			placeholder: "postgresql://user:pw@…/database",
+			description: "Provide a PostgreSQL database URL for platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
+				title: "Neon",
+				url: "https://neon.com/"
+			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
+		};
+		case "jwtSecret": return { description: `Create a JWT signing key for platform login tokens. Run ${import_picocolors.default.blue("openssl rand -base64 32")}. Save the key in your password manager. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		case "projectSecretKey": return { description: `Generate a project encryption key for app secrets. Run ${import_picocolors.default.blue("openssl rand -base64 32")} separately. Save this key for recovery. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
+		default: return;
+	}
+}
+function supportsSetupLinks() {
+	return !!process.stdout.isTTY && ([
+		"ghostty",
+		"iTerm.app",
+		"WezTerm",
+		"vscode",
+		"WarpTerminal"
+	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
+}
+/** Dashboard keys use permission-catalog labels, which can differ from product names. */
+function platformAccountTokenPermissions(includeAiGateway) {
+	return [
+		{
+			key: "account_settings",
+			type: "read"
+		},
+		{
+			key: "workers_scripts",
+			type: "edit"
+		},
+		{
+			key: "workers_kv_storage",
+			type: "edit"
+		},
+		{
+			key: "workers_r2",
+			type: "edit"
+		},
+		{
+			key: "d1",
+			type: "edit"
+		},
+		{
+			key: "queues",
+			type: "edit"
+		},
+		{
+			key: "account_analytics",
+			type: "read"
+		},
+		{
+			key: "workers_tail",
+			type: "read"
+		},
+		{
+			key: "query_cache",
+			type: "edit"
+		},
+		...includeAiGateway ? [{
+			key: "aig",
+			type: "edit"
+		}] : []
+	];
+}
+function platformManagementSetupPage(plan, options = {}) {
+	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+	const zoneName = plan.deployment.application.zoneName;
+	const apiHostname = plan.deployment.controlPlane.apiHostname;
+	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
+		protection: !!plan.deployment.authentication.accessProtection,
+		readOnly: false
+	} : void 0);
+	const accessLevel = access && access.readOnly ? "read" : "edit";
+	const appAccess = !!plan.deployment.appAccess;
+	const appAccessLevel = appAccess ? "edit" : accessLevel;
+	const permissions = [
+		...platformAccountTokenPermissions(true),
+		...zoneName || apiHostname || createsZone ? [
+			{
+				key: "zone",
+				type: createsZone ? "edit" : "read"
+			},
+			{
+				key: "dns",
+				type: "edit"
+			},
+			{
+				key: "workers_routes",
+				type: "edit"
+			}
+		] : [],
+		...access || appAccess ? [
+			{
+				key: "access",
+				type: appAccessLevel
+			},
+			{
+				key: "access_acct",
+				type: "read"
+			},
+			...access && access.protection ? [{
+				key: "access_service_token",
+				type: accessLevel
+			}] : []
+		] : [],
+		...zoneName && plan.deployment.application.baseDomain !== zoneName ? [{
+			key: "ssl_and_certificates",
+			type: "read"
+		}] : []
+	];
+	return {
+		title: "Cloudflare management API token",
+		linkInTitle: true,
+		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+			to: "/" + plan.account.id + "/api-tokens",
+			name: plan.deployment.displayName + " Management",
+			permissionGroupKeys: JSON.stringify(permissions)
+		}),
+		instructions: [
+			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
+			`Scope it to ${plan.account.name}${createsZone ? "; allow zone creation." : zoneName ? ` and zone ${zoneName}.` : "."}`,
+			...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`Also include the zone for ${apiHostname}.`] : []
+		].join("\n")
+	};
+}
+function platformSetupPages(plan) {
+	const permissions = [
+		...platformAccountTokenPermissions(plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect")),
+		...plan.deployment.application.zoneName ? [{
+			key: "cache",
+			type: "purge"
+		}] : [],
+		...plan.deployment.capabilities.customDomains ? [{
+			key: "ssl_and_certificates",
+			type: "edit"
+		}] : [],
+		...plan.deployment.capabilities.email ? [
+			{
+				key: "zone",
+				type: "read"
+			},
+			{
+				key: "zone_settings",
+				type: "edit"
+			},
+			{
+				key: "email_routing_address",
+				type: "edit"
+			},
+			{
+				key: "email_routing_rule",
+				type: "edit"
+			},
+			{
+				key: "email_sending",
+				type: "edit"
+			}
+		] : []
+	];
+	return {
+		runtime: {
+			title: "Cloudflare runtime token",
+			linkInTitle: true,
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/api-tokens",
+				name: plan.deployment.displayName + " Runtime",
+				permissionGroupKeys: JSON.stringify(permissions)
+			}),
+			instructions: "Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here."
+		},
+		github: {
+			title: "GitHub OAuth App",
+			url: "https://github.com/settings/applications/new",
+			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
+		},
+		r2: {
+			title: "R2 upload token",
+			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+				to: "/" + plan.account.id + "/r2/api-tokens/create",
+				type: "account"
+			}),
+			instructions: [
+				"Select Object Read & Write.",
+				"Keep Apply to all buckets in this account selected.",
+				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
+			].join("\n")
+		}
+	};
+}
+function formatPlatformSetupPlan(plan, options = {}) {
+	const writesDns = plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse");
+	return [
+		"The installation will guide you through setting up the following credentials:",
+		"",
+		...[
+			...options.managementToken ? [options.managementAccess ? `Cloudflare management API token for ${writesDns ? "DNS changes and " : ""}Access setup` : "Cloudflare management API token for DNS changes"] : [],
+			"PostgreSQL database URL",
+			"Cloudflare runtime token",
+			"R2 upload token",
+			...plan.deployment.authentication.providers.includes("github") ? ["GitHub OAuth App client ID and secret"] : [],
+			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
+			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
+			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
+			"JWT signing key and project encryption key"
+		].map((credential) => `• ${credential}`)
+	].join("\n");
+}
+function platformInstallCommandArguments(options) {
+	const parts = [
+		options.commandName,
+		"platform",
+		"install"
+	];
+	const flag = (name, value) => {
+		if (value) parts.push(name, value);
+	};
+	if (options.resumeId) {
+		parts.push("--resume");
+		flag("--name", options.resumeId);
+	} else {
+		flag("--name", options.installationSlug);
+		flag("--account", options.accountId);
+		flag("--display-name", options.displayName);
+		if (options.workersDev) parts.push("--workers-dev");
+		else {
+			flag("--application-domain", options.applicationDomain);
+			flag("--zone", options.zoneName);
+			if (options.dedicatedZone) parts.push("--dedicated-zone");
+			else parts.push("--no-dedicated-zone");
+		}
+		flag("--control-plane-domain", options.controlPlaneDomain);
+		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
+	}
+	flag("--hyperdrive", options.hyperdrive ?? "");
+	flag("--auth-config", options.authConfig ?? "");
+	if (!options.resumeId && options.appAccess) flag("--app-access", options.appAccess);
+	if (!options.authConfig && !options.resumeId && options.authentication) {
+		flag("--login-methods", options.authentication.providers.join(","));
+		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
+	}
+	flag("--dashboard-url", options.dashboardUrl ?? "");
+	flag("--runtime", options.runtime);
+	if (options.yes) parts.push("--yes");
+	return parts;
+}
+function formatPlatformInstallCommand(options) {
+	return platformInstallCommandArguments(options).map((value) => {
+		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+	}).join(" ");
+}
+function openPlatformSetupPage(page, dependencies = {}) {
+	log.info((page.linkInTitle ? platformSetupLink(page) : page.title) + "\n" + page.instructions);
+	if (!page.linkInTitle) console.log(platformSetupLink({
+		...page,
+		title: "Open " + page.title
+	}));
+	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
+		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
+	} catch {
+		log.info("Could not open the browser. Use the link above.");
+	}
+}
+//#endregion
 //#region src/cli/platform-access-setup.ts
+function accessSetupGuide() {
+	return platformSetupLink({
+		title: "Setup guide and required permissions",
+		url: "https://void.cloud/guide/platform/installation/setup#cloudflare-access"
+	});
+}
+async function selectCompanyAccessPolicies(client, initialPolicies, accountId, mode) {
+	const create = "__create__";
+	const refresh = "__refresh__";
+	let policies = initialPolicies;
+	let selectedIds = [];
+	while (true) {
+		const options = policies.filter((policy) => typeof policy.id === "string" && ["allow", "deny"].includes(String(policy.decision))).map((policy) => ({
+			value: String(policy.id),
+			label: stripVTControlCharacters(String(policy.name ?? policy.id))
+		}));
+		const available = new Set(options.map((option) => option.value));
+		selectedIds = selectedIds.filter((id) => available.has(id));
+		const actions = [{
+			value: create,
+			label: "Create new",
+			hint: "Set up a policy in Cloudflare, then return here"
+		}, {
+			value: refresh,
+			label: "Refresh list"
+		}];
+		let choices;
+		if (options.length === 0) {
+			log.info("No reusable Allow or Deny policies were found in this account. Create an Allow policy for your company, or refresh after saving one.");
+			choices = [answer$2(await select({
+				message: "Company Access policies:",
+				options: actions
+			}))];
+		} else choices = answer$2(await multiselect({
+			message: "Company Access policies (select all that apply):",
+			options: [...options, ...actions],
+			initialValues: selectedIds,
+			required: true
+		}));
+		selectedIds = choices.filter((id) => available.has(id));
+		if (choices.includes(create)) {
+			note([
+				"1. Open Zero Trust → Access controls → Policies → Add a policy in this account.",
+				"2. Name the policy and choose Allow.",
+				"3. Include your company’s identity-provider group or Emails ending in your company domain, such as example.com.",
+				"4. Require your selected company login method and your company’s MFA/device checks.",
+				...mode === "existing" ? ["5. Save the policy and attach it to the existing Access applications you’re connecting, then return here."] : ["5. Save the policy, then return here."]
+			].join("\n"), import_picocolors.default.bold("Create an Access policy"));
+			console.log(platformSetupLink({
+				title: "Open Cloudflare account",
+				url: `https://dash.cloudflare.com/${encodeURIComponent(accountId)}`
+			}));
+			if (!answer$2(await confirm({
+				message: "Have you saved the new policy?",
+				initialValue: true
+			}))) continue;
+		} else if (!choices.includes(refresh)) return selectedIds;
+		policies = await client.list("policies");
+	}
+}
 function platformAccessResourceInventory(encoded, installationId) {
 	if (!encoded) return [];
 	const state = JSON.parse(encoded);
@@ -1149,6 +1487,10 @@ function checkpointPlatformAccessResources(manifest, encoded, updatedAt) {
 }
 function isPlatformAuthenticationPreparationKey(name) {
 	return name.startsWith("authenticationConnection:") || [
+		"appAccessToken",
+		"appAccessTokenRejected",
+		"appAccessIdentityProviderIds",
+		"appAccessPolicyIds",
 		"accessManagementToken",
 		"accessSetupSpecJson",
 		"accessExistingServiceTokenJson",
@@ -1194,7 +1536,7 @@ function parsePlatformAccessSetupSpec(input) {
 	}
 	return value;
 }
-function answer$1(value) {
+function answer$2(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
@@ -1222,22 +1564,32 @@ function activatePlatformAccessCredentials(encoded, origins) {
 }
 async function preparePlatformAccessSetup(input) {
 	if (!input.login && !input.protection) return;
+	if (process.stdin.isTTY) {
+		note([
+			input.login && input.protection ? "Access lets employees sign in with your company login and controls who can reach the platform’s UI and APIs." : input.login ? "Access lets employees sign in to the platform with your company login." : "Access controls who can reach the platform’s UI and APIs.",
+			"",
+			"Void can create dedicated Access applications using your company’s existing login providers and policies, or use Access applications your company already manages."
+		].join("\n"), import_picocolors.default.bold("Set up Cloudflare Access"));
+		console.log(accessSetupGuide());
+	}
 	let spec = input.spec ?? (input.checkpoint.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson)) : void 0);
 	if (!spec) {
 		if (!process.stdin.isTTY) {
 			if (input.protection) throw new Error("platform: Protection requires cloudflareAccess create or existing application verification in --auth-config.");
 			return;
 		}
-		const mode = answer$1(await select({
+		const mode = answer$2(await select({
 			message: "Cloudflare Access setup:",
 			options: [
 				{
 					value: "create",
-					label: "Create applications automatically in this Cloudflare account"
+					label: "Create Access applications for this platform",
+					hint: "Use this account’s existing Zero Trust setup"
 				},
 				{
 					value: "existing",
-					label: "Connect existing applications (including another account)"
+					label: "Use Access applications your company already manages",
+					hint: "May use another account"
 				},
 				...!input.protection ? [{
 					value: "manual",
@@ -1248,12 +1600,19 @@ async function preparePlatformAccessSetup(input) {
 		if (mode === "manual") return;
 		spec = { mode };
 		if (mode === "existing") {
-			spec.accountId = answer$1(await text$1({
+			log.info("Enter the account that owns your company’s Access configuration. This may differ from the account hosting Void.");
+			spec.accountId = answer$2(await text$1({
 				message: "Cloudflare identity account ID:",
 				initialValue: input.plan.account.id
 			}));
-			if (input.login) spec.loginApplicationId = answer$1(await text$1({ message: "Existing Access OIDC application ID:" }));
-			if (input.protection) spec.protectionApplicationId = answer$1(await text$1({ message: "Existing Access protection application ID:" }));
+			if (input.login) {
+				log.info("Enter the ID of the Access application that provides company sign-in to Void.");
+				spec.loginApplicationId = answer$2(await text$1({ message: "Existing Access OIDC application ID:" }));
+			}
+			if (input.protection) {
+				log.info("Enter the ID of the Access application that protects the platform’s UI and APIs.");
+				spec.protectionApplicationId = answer$2(await text$1({ message: "Existing Access protection application ID:" }));
+			}
 		}
 	}
 	spec = parsePlatformAccessSetupSpec(spec);
@@ -1270,8 +1629,9 @@ async function preparePlatformAccessSetup(input) {
 		policies = await client.list("policies");
 	} catch (error) {
 		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status) || !process.stdin.isTTY || credential) throw error;
-		console.error(`Access setup for account ${accountId} needs Access applications/policies permissions and organization/identity-provider/group read access${input.protection ? ", plus service-token permissions" : ""}.`);
-		const token = answer$1(await password({ message: "Access setup API token (kept out of the platform runtime):" }));
+		log.info(`Your current token lacks the required Access permissions for account ${accountId}. Create a token for that account using the permissions in the setup guide.`);
+		console.log(accessSetupGuide());
+		const token = answer$2(await password({ message: "Access setup API token:" }));
 		input.save({ accessManagementToken: token });
 		management = new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl });
 		client = new PlatformAccessClient(management, accountId);
@@ -1279,7 +1639,8 @@ async function preparePlatformAccessSetup(input) {
 		providers = await client.list("identity_providers");
 		policies = await client.list("policies");
 	}
-	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
+	if (!spec.identityProviderIds && process.stdin.isTTY) log.info("Choose how employees sign in—for example, your company’s Okta or Google Workspace connection.");
+	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$2(await multiselect({
 		message: "Company identity providers:",
 		required: true,
 		options: providers.filter((provider) => typeof provider.id === "string").map(platformAccessIdentityProvider).map((provider) => ({
@@ -1287,14 +1648,15 @@ async function preparePlatformAccessSetup(input) {
 			label: stripVTControlCharacters(provider.name)
 		}))
 	})) : []);
-	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? answer$1(await multiselect({
-		message: "Existing company Access policies (MFA and device requirements are preserved):",
-		required: true,
-		options: policies.filter((policy) => typeof policy.id === "string" && ["allow", "deny"].includes(String(policy.decision))).map((policy) => ({
-			value: String(policy.id),
-			label: stripVTControlCharacters(String(policy.name ?? policy.id))
-		}))
-	})) : []);
+	if (identityProviderIds.length) {
+		spec = {
+			...spec,
+			identityProviderIds
+		};
+		input.save({ accessSetupSpecJson: JSON.stringify(spec) });
+	}
+	if (!spec.policyIds && process.stdin.isTTY) log.info("Choose which existing access rules apply to this platform, including MFA and device requirements.");
+	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? await selectCompanyAccessPolicies(client, policies, accountId, spec.mode) : []);
 	if (!identityProviderIds.length || !policyIds.length) throw new Error("platform: Access setup requires explicit identityProviderIds and policyIds.");
 	spec = {
 		...spec,
@@ -1311,10 +1673,11 @@ async function preparePlatformAccessSetup(input) {
 	if (!serviceToken && spec.mode === "existing" && input.protection) {
 		if (input.checkpoint.accessExistingServiceTokenJson) serviceToken = JSON.parse(input.checkpoint.accessExistingServiceTokenJson);
 		else if (process.stdin.isTTY) {
+			log.info("This lets the installer reach the protected platform during setup. Use a service token allowed by the existing Access application.");
 			serviceToken = {
-				id: answer$1(await text$1({ message: "Existing admitted Access service token ID:" })),
-				clientId: answer$1(await password({ message: "Access service token client ID:" })),
-				clientSecret: answer$1(await password({ message: "Access service token client secret:" }))
+				id: answer$2(await text$1({ message: "Existing admitted Access service token ID:" })),
+				clientId: answer$2(await password({ message: "Access service token client ID:" })),
+				clientSecret: answer$2(await password({ message: "Access service token client secret:" }))
 			};
 			input.save({ accessExistingServiceTokenJson: JSON.stringify(serviceToken) });
 		}
@@ -1335,7 +1698,7 @@ async function preparePlatformAccessSetup(input) {
 	};
 	console.log(JSON.stringify({ accessPlan: reviewed }, null, 2));
 	if (!input.yes) {
-		if (!process.stdin.isTTY || !answer$1(await confirm({
+		if (!process.stdin.isTTY || !answer$2(await confirm({
 			message: "Apply this Access configuration?",
 			initialValue: false
 		}))) throw new Error("platform: Access setup changes require confirmation or --yes.");
@@ -1349,7 +1712,8 @@ async function preparePlatformAccessSetup(input) {
 	};
 	let loginClientSecret = spec.loginClientSecretEnv ? secretReference(spec.loginClientSecretEnv) : input.checkpoint.accessExistingLoginSecret;
 	if (input.login && spec.mode === "existing" && !loginClientSecret && process.stdin.isTTY) {
-		loginClientSecret = answer$1(await password({ message: "Existing Access OIDC client secret:" }));
+		log.info("Enter the client secret from the existing Access login application’s OIDC settings.");
+		loginClientSecret = answer$2(await password({ message: "Existing Access OIDC client secret:" }));
 		input.save({ accessExistingLoginSecret: loginClientSecret });
 	}
 	const result = await provisionPlatformAccess(client, {
@@ -1381,13 +1745,34 @@ async function preparePlatformAccessSetup(input) {
 }
 //#endregion
 //#region src/cli/platform-auth.ts
-function assertPlatformOperatorCredentialCanApplyPlan(credential, plan) {
-	if (credential.source !== "oauth") return;
+/** Check Access inventory permissions before the installer starts provisioning. */
+async function verifyPlatformManagementAccess(client, accountId, access) {
+	const base = `/accounts/${encodeURIComponent(accountId)}/access`;
+	await Promise.all([client.request(`${base}/organizations`), ...[
+		"identity_providers",
+		"groups",
+		"policies",
+		"apps",
+		...access.protection ? ["service_tokens"] : []
+	].map((resource) => client.request(`${base}/${resource}?per_page=1`))]);
+}
+function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access) {
+	if (!platformOperatorNeedsManagementToken(credential, plan, access)) return;
 	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
 	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
-	if (!createsZone && !writesDns) return;
-	const permissions = [...createsZone ? ["Account → Zone → Edit"] : [], ...writesDns ? ["Zone → DNS → Edit"] : []];
-	throw new Error(`platform: Cloudflare browser OAuth grants Zone Read and cannot apply the planned zone or DNS changes. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account and application zone, then rerun the command.`);
+	const permissions = [
+		...createsZone ? ["Account → Zone → Edit"] : [],
+		...writesDns ? ["Zone → DNS → Edit"] : [],
+		...access ? [
+			`Account → Access: Apps and Policies → ${access.readOnly ? "Read" : "Edit"}`,
+			"Account → Access: Organizations, Identity Providers, and Groups → Read",
+			...access.protection ? [`Account → Access: Service Tokens → ${access.readOnly ? "Read" : "Edit"}`] : []
+		] : []
+	];
+	throw new Error(`platform: Cloudflare browser login cannot authorize the planned ${access ? "Access setup" : "zone or DNS changes"}. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account${createsZone || writesDns ? " and application zone" : ""}, then rerun the command.`);
+}
+function platformOperatorNeedsManagementToken(credential, plan, access) {
+	return credential.source === "oauth" && (!!access || plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse"));
 }
 async function resolvePlatformCloudflareCredential(dependencies = {}) {
 	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
@@ -1443,6 +1828,11 @@ async function readExistingCredential(dependencies, runWrangler) {
 		source: "environment",
 		token: environmentToken
 	};
+	const savedManagementToken = dependencies.savedManagementToken?.trim();
+	if (savedManagementToken) return {
+		source: "saved",
+		token: savedManagementToken
+	};
 	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
 	return await readWranglerOAuthCredential(runWrangler);
 }
@@ -1461,6 +1851,116 @@ async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflare
 	}
 }
 //#endregion
+//#region src/cli/platform-access-health.ts
+/** These reserved endpoints require Void's probe token and cannot serve application traffic. */
+function platformAccessHealthTargets(plan) {
+	const destination = `${plan.deployment.application.zoneName ? `${PLATFORM_HEALTH_HOSTNAME_LABEL}.${plan.deployment.application.baseDomain}` : `${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`}/health`;
+	return [{
+		key: `health-dispatch-${createHash("sha256").update(destination).digest("hex").slice(0, 12)}`,
+		destination
+	}];
+}
+async function verifyHealthException(access, app, destination) {
+	const destinations = platformAccessPublicDestinations(app);
+	if (typeof app.id !== "string" || !app.id || app.type !== "self_hosted" || app.domain !== destination || !destinations.length || destinations.some((value) => value !== destination) || app.destinations !== void 0 && (!Array.isArray(app.destinations) || app.destinations.some((value) => !value || value.type !== "public" || value.uri !== destination)) || app.target_criteria != null && (!Array.isArray(app.target_criteria) || app.target_criteria.length > 0)) throw new Error(`platform: The Access health exception must cover only ${destination}.`);
+	const policies = await access.list(`apps/${encodeURIComponent(app.id)}/policies`);
+	const policy = policies[0];
+	if (policies.length !== 1 || policy?.decision !== "bypass" || JSON.stringify(policy.include) !== "[{\"everyone\":{}}]" || policy.require !== void 0 && (!Array.isArray(policy.require) || policy.require.length > 0) || policy.exclude !== void 0 && (!Array.isArray(policy.exclude) || policy.exclude.length > 0)) throw new Error(`platform: The Access policy for ${destination} does not match the reserved health-check exception.`);
+}
+/** Keep the same path-only exception used by project Zero Trust available during bootstrap. */
+async function ensurePlatformAccessHealthChecks(input) {
+	const appAccess = !input.manifest.steps.some((step) => step.key === "app-access-initialized:v1") && input.checkpoint.appAccessSetupJson ? parsePlatformAppAccessSetup(JSON.parse(input.checkpoint.appAccessSetupJson)) : null;
+	if (appAccess && appAccess.accountId !== input.plan.account.id) throw new Error("platform: App access recovery belongs to another Cloudflare account.");
+	if (!input.plan.deployment.authentication.accessProtection && !appAccess?.managed) return;
+	const spec = appAccess?.managed ? {
+		mode: "create",
+		accountId: input.plan.account.id
+	} : parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson || "null"));
+	const accountId = input.plan.account.id;
+	const identityAccountId = spec.accountId ?? accountId;
+	const token = appAccess?.managed ? appAccess.apiToken : identityAccountId === accountId ? process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN || input.checkpoint.accessManagementToken : void 0;
+	if (!token && !input.client.request) throw new Error("platform: Access management is required to configure the reserved health endpoints.");
+	const access = new PlatformAccessClient(token ? new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }) : { request: input.client.request.bind(input.client) }, accountId);
+	const nonce = createHash("sha256").update(`void-access-health:${input.manifest.ownershipNonce}`).digest("hex").slice(0, 32);
+	const state = input.checkpoint.accessHealthProvisioningJson ? JSON.parse(input.checkpoint.accessHealthProvisioningJson) : {
+		version: 1,
+		accountId,
+		installationId: input.manifest.id,
+		nonce,
+		resources: {}
+	};
+	if (!state || state.version !== 1 || state.accountId !== accountId || input.manifest.account.id !== accountId || state.installationId !== input.manifest.id || state.installationId !== input.plan.installationId || state.nonce !== nonce || !state.resources || typeof state.resources !== "object" || Array.isArray(state.resources)) throw new Error("platform: Access health recovery data belongs to a different installation.");
+	const save = () => input.save(JSON.stringify(state));
+	const inventory = await access.list("apps");
+	for (const { key, destination } of platformAccessHealthTargets(input.plan)) {
+		const expected = {
+			type: "self_hosted",
+			domain: destination,
+			destinations: [{
+				type: "public",
+				uri: destination
+			}],
+			policies: [{
+				name: "Void platform health check",
+				decision: "bypass",
+				precedence: 1,
+				include: [{ everyone: {} }]
+			}]
+		};
+		const fingerprint = createHash("sha256").update(JSON.stringify(expected)).digest("hex");
+		let recorded = state.resources[key];
+		const name = `void-${input.manifest.id}-${key}`.slice(0, 90) + "-" + nonce.slice(0, 16);
+		if (recorded && (recorded.name !== name || recorded.fingerprint !== fingerprint || recorded.adopted)) throw new Error("platform: The recorded Access health exception changed identity or scope.");
+		const matching = inventory.filter((app) => platformAccessPublicDestinations(app).includes(destination));
+		if (matching.length > 1 || recorded?.id && matching.some((app) => app.id !== recorded.id)) throw new Error(`platform: Multiple Access applications cover ${destination}. Reconcile them before resuming.`);
+		if (!recorded && matching.length === 1) {
+			await verifyHealthException(access, matching[0], destination);
+			continue;
+		}
+		if (!recorded?.id && recorded?.pending) {
+			const candidates = inventory.filter((app) => app.name === name);
+			if (candidates.length !== 1 || typeof candidates[0]?.id !== "string") throw new Error("platform: Access health application creation has an uncertain outcome. Inspect Cloudflare before retrying; no duplicate was created.");
+			recorded.id = candidates[0].id;
+			save();
+		}
+		if (!recorded?.id) {
+			if (spec.mode !== "create") throw new Error(`platform: Configure an Access exception limited to ${destination}, then resume. Void's private probe token still protects this endpoint.`);
+			if (inventory.some((app) => app.name === name)) throw new Error("platform: An Access health application with this installation identity already exists. Inspect it before resuming.");
+			recorded = {
+				name,
+				fingerprint,
+				pending: true
+			};
+			state.resources[key] = recorded;
+			save();
+			try {
+				const created = await access.create("apps", {
+					...expected,
+					name
+				});
+				if (!created || typeof created.id !== "string" || !created.id) throw new Error("platform: Cloudflare did not return the Access health application ID.");
+				recorded.id = created.id;
+				save();
+			} catch (error) {
+				if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
+					408,
+					409,
+					429
+				].includes(error.status)) {
+					recorded.pending = false;
+					save();
+				}
+				throw error;
+			}
+		}
+		const app = await access.get(`apps/${encodeURIComponent(recorded.id)}`);
+		if (!app || app.id !== recorded.id || app.name !== recorded.name) throw new Error("platform: The Access health application changed ownership identity.");
+		await verifyHealthException(access, app, destination);
+		recorded.pending = false;
+		save();
+	}
+}
+//#endregion
 //#region src/cli/platform-access-preflight.ts
 /** Recheck live protection without invoking any provisioning or configuration write. */
 async function verifyInstalledPlatformAccessProtection(input) {
@@ -1507,7 +2007,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BDWO_aER.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BLadnnct.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -1516,6 +2016,241 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 }
 //#endregion
+//#region src/cli/platform-app-access.ts
+function answer$1(value) {
+	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
+	return value;
+}
+async function selectInstallationAppAccess(authentication, recorded, choice) {
+	const config = authentication.file?.appAccess;
+	if (config && (typeof config !== "object" || Array.isArray(config) || "apiToken" in config || config.tokenEnv !== void 0 && (typeof config.tokenEnv !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(config.tokenEnv)))) throw new Error("platform: App access configuration must use tokenEnv; plaintext tokens are not accepted.");
+	if (choice && config?.mode && choice !== config.mode) throw new Error("platform: --app-access conflicts with the authentication file’s app access choice.");
+	const supplied = choice ?? config?.mode;
+	if (supplied !== void 0 && ![
+		"public",
+		"platform",
+		"custom"
+	].includes(supplied)) throw new Error("platform: App access must be public, platform, or custom.");
+	if (recorded) {
+		if (supplied !== void 0 && supplied !== recorded.appAccess) throw new Error("platform: Resume with the saved app access choice. Manage an installed platform’s app access in Admin → Zero Trust.");
+		return recorded.appAccess;
+	}
+	const protectedPlatform = !!authentication.authentication.accessProtection;
+	const selected = supplied ?? (!process.stdin.isTTY ? protectedPlatform ? "platform" : "public" : answer$1(await select({
+		message: "Who should be able to access deployed apps?",
+		initialValue: protectedPlatform ? "platform" : "public",
+		options: [
+			...protectedPlatform ? [{
+				value: "platform",
+				label: "Same people allowed by the platform’s Access policy",
+				hint: "recommended"
+			}] : [],
+			{
+				value: "public",
+				label: "Anyone — public apps"
+			},
+			{
+				value: "custom",
+				label: protectedPlatform ? "Choose a different Access policy" : "Set up Cloudflare Access protection"
+			}
+		]
+	})));
+	if (selected === "public" && (config?.identityProviderIds?.length || config?.policyIds?.length)) throw new Error("platform: Public apps cannot select identity policies. Choose custom app access to require company login.");
+	if (selected === "platform" && !protectedPlatform) throw new Error("platform: Reusing the platform Access policy requires --access-protection. Choose --app-access custom to protect apps separately.");
+	if (![
+		"public",
+		"platform",
+		"custom"
+	].includes(String(selected))) throw new Error("platform: Choose who can access deployed apps.");
+	return selected;
+}
+/** Collect the hosting-account policy once, with explicit consent for a durable management token. */
+async function prepareInstallationAppAccess(input) {
+	const choice = input.plan.deployment.appAccess;
+	if (!choice) throw new Error("platform: App access was not selected for this installation.");
+	const explicitToken = (input.authentication.file?.appAccess?.tokenEnv ? process.env[input.authentication.file.appAccess.tokenEnv] : void 0) || process.env.VOID_PLATFORM_APP_ACCESS_TOKEN;
+	if (explicitToken && /\s/.test(explicitToken)) throw new Error("platform: App access tokens must not contain whitespace.");
+	if (input.checkpoint.appAccessSetupJson && !input.checkpoint.appAccessTokenRejected) {
+		const saved = parsePlatformAppAccessSetup(JSON.parse(input.checkpoint.appAccessSetupJson));
+		if (saved.accountId !== input.plan.account.id || saved.mode !== (choice === "public" ? "public" : "protected")) throw new Error("platform: Saved app access belongs to another account or choice.");
+		if (saved.managed) {
+			const refreshed = explicitToken ? JSON.stringify({
+				...saved,
+				apiToken: explicitToken
+			}) : input.checkpoint.appAccessSetupJson;
+			input.save({ appAccessSetupJson: refreshed });
+			return refreshed;
+		}
+	}
+	const file = input.authentication.file?.appAccess;
+	if (file?.tokenEnv && !/^[A-Z_][A-Z0-9_]*$/.test(file.tokenEnv)) throw new Error("platform: Invalid app access token environment reference.");
+	let token = explicitToken || (input.checkpoint.appAccessTokenRejected ? void 0 : input.checkpoint.appAccessToken);
+	if (input.checkpoint.appAccessTokenRejected) log.info("The previous app access token was rejected. Provide a replacement to continue.");
+	const setupSpec = input.checkpoint.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson)) : input.authentication.file?.cloudflareAccess;
+	const setupAccount = setupSpec?.accountId ?? input.plan.account.id;
+	const reusable = setupAccount === input.plan.account.id ? process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN || input.checkpoint.accessManagementToken || input.managementToken : input.managementToken;
+	const tokenPage = () => openPlatformSetupPage({
+		title: "App access API token",
+		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
+			to: `/${input.plan.account.id}/api-tokens`,
+			name: `${input.plan.deployment.displayName} App Access`,
+			permissionGroupKeys: JSON.stringify([{
+				key: "access",
+				type: "edit"
+			}, {
+				key: "access_acct",
+				type: "read"
+			}])
+		}),
+		instructions: `Scope the token to ${input.plan.account.name}: Access Apps and Policies Edit; Organizations, Identity Providers, and Groups Read. Void stores it encrypted to manage app access.`
+	});
+	const collectToken = async () => {
+		if (!process.stdin.isTTY) throw new Error("platform: App access requires VOID_PLATFORM_APP_ACCESS_TOKEN or appAccess.tokenEnv in --auth-config, scoped to the hosting account.");
+		tokenPage();
+		const value = String(answer$1(await password({ message: "App access API token (stored encrypted when app rules are needed):" }))).trim();
+		if (!value || /\s/.test(value)) throw new Error("platform: An app access token without whitespace is required.");
+		input.save({
+			appAccessToken: value,
+			appAccessTokenRejected: ""
+		});
+		return value;
+	};
+	if (!token && input.checkpoint.appAccessTokenRejected) token = await collectToken();
+	let access = new PlatformAccessClient(token ? new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }) : input.client, input.plan.account.id);
+	let organization;
+	const readOrganization = async () => {
+		try {
+			return await access.get("organizations");
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
+			throw error;
+		}
+	};
+	try {
+		organization = await readOrganization();
+	} catch (error) {
+		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status)) throw error;
+		log.info("Check this account’s Access requirements before opening app traffic.");
+		token = await collectToken();
+		access = new PlatformAccessClient(new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }), input.plan.account.id);
+		organization = await readOrganization();
+	}
+	const defaultDeny = organization?.deny_unmatched_requests === true;
+	if (choice === "public" && !defaultDeny) {
+		const result = JSON.stringify({
+			version: 1,
+			accountId: input.plan.account.id,
+			mode: "public",
+			managed: false,
+			identityProviderIds: [],
+			policyIds: []
+		});
+		input.save({ appAccessSetupJson: result });
+		return result;
+	}
+	if (!organization) throw new Error(`platform: Enable Zero Trust in account ${input.plan.account.name}, then resume to configure app access.`);
+	if (!token) {
+		log.info("Void needs an Access-management token stored encrypted to manage access for future apps and custom domains.");
+		if (reusable && process.stdin.isTTY && answer$1(await confirm({
+			message: "Reuse the setup token for ongoing app access management?",
+			initialValue: true
+		}))) {
+			token = reusable;
+			input.save({ appAccessToken: token });
+		} else token = await collectToken();
+		access = new PlatformAccessClient(new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl }), input.plan.account.id);
+	}
+	let identityProviderIds = [];
+	let policyIds = [];
+	if (choice !== "public") {
+		const reuse = choice === "platform" && setupAccount === input.plan.account.id;
+		if (choice === "platform" && !reuse) log.info("The platform uses Access in another account. Choose equivalent identities and policies in the hosting account for apps.");
+		identityProviderIds = input.checkpoint.appAccessIdentityProviderIds ? JSON.parse(input.checkpoint.appAccessIdentityProviderIds) : (reuse ? setupSpec?.identityProviderIds : void 0) ?? file?.identityProviderIds ?? [];
+		policyIds = input.checkpoint.appAccessPolicyIds ? JSON.parse(input.checkpoint.appAccessPolicyIds) : (reuse ? setupSpec?.policyIds : void 0) ?? file?.policyIds ?? [];
+		if (!identityProviderIds.length) {
+			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.identityProviderIds in --auth-config for the hosting account.");
+			const providers = (await access.list("identity_providers")).map(platformAccessIdentityProvider);
+			if (!providers.length) throw new Error(`platform: Add an identity provider in Zero Trust for ${input.plan.account.name}, then resume.`);
+			identityProviderIds = answer$1(await multiselect({
+				message: "App identity providers:",
+				required: true,
+				options: providers.map((p) => ({
+					value: p.id,
+					label: stripVTControlCharacters(p.name)
+				}))
+			}));
+			input.save({ appAccessIdentityProviderIds: JSON.stringify(identityProviderIds) });
+		}
+		if (!policyIds.length) {
+			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.policyIds in --auth-config for the hosting account.");
+			policyIds = await selectCompanyAccessPolicies(access, await access.list("policies"), input.plan.account.id, "create");
+			input.save({ appAccessPolicyIds: JSON.stringify(policyIds) });
+		}
+	} else log.info("This account requires Access. Void will create public rules scoped to app hostnames.");
+	const setup = parsePlatformAppAccessSetup({
+		version: 1,
+		accountId: input.plan.account.id,
+		mode: choice === "public" ? "public" : "protected",
+		managed: true,
+		apiToken: token,
+		identityProviderIds,
+		policyIds
+	});
+	if (setup.mode === "protected") try {
+		await inspectPlatformAccess(access, setup);
+	} catch (error) {
+		if (error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status)) input.save({ appAccessTokenRejected: "true" });
+		else input.save({
+			appAccessIdentityProviderIds: "",
+			appAccessPolicyIds: ""
+		});
+		throw error;
+	}
+	const result = JSON.stringify(setup);
+	input.save({
+		appAccessSetupJson: result,
+		appAccessIdentityProviderIds: JSON.stringify(identityProviderIds),
+		appAccessPolicyIds: JSON.stringify(policyIds),
+		appAccessTokenRejected: ""
+	});
+	return result;
+}
+var PlatformAppAccessCredentialError = class extends Error {};
+/** Bounded, resumable handoff to the service that owns Zero Trust state. */
+async function initializeInstalledAppAccess(input, fetcher = fetch) {
+	parsePlatformAppAccessSetup(JSON.parse(input.setupJson));
+	if (!input.setupToken || input.setupToken.length < 32) throw new Error("platform: Restore the encrypted app access setup authority before resuming.");
+	const signature = createHmac("sha256", input.setupToken).update(`${PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX}\n${input.installationId}\n${input.setupJson}`).digest("base64url");
+	for (let attempt = 0; attempt < 10; attempt++) {
+		const response = await fetcher(new URL("/internal/platform/app-access", input.apiUrl), {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"X-Void-Platform-Probe": input.probeToken,
+				"X-Void-App-Access-Setup": signature,
+				...cfAccessHeaders(process.env, input.apiUrl)
+			},
+			body: input.setupJson,
+			redirect: "manual",
+			signal: AbortSignal.timeout(6e4)
+		});
+		if (response.status === 403) {
+			const detail = await response.clone().text();
+			if (/1050|Default-Deny/i.test(detail)) throw new Error(`platform: Account Default-Deny blocks the platform API at ${input.apiUrl}. Configure Access for the platform API and its installer credentials, then resume.`);
+		}
+		let body;
+		try {
+			body = await response.json();
+		} catch {
+			throw new Error(`platform: App access setup did not respond (HTTP ${response.status}). Check platform Access permissions and resume.`);
+		}
+		if (body.code === "app_access_credentials") throw new PlatformAppAccessCredentialError("App access token rejected. Resume installation to provide a replacement.");
+		if (!response.ok || body.installationId !== input.installationId) throw new Error(`platform: ${body.error || "App access setup failed."} Resume installation after correcting the Access configuration.`);
+		if (body.ready) return;
+	}
+	throw new Error("platform: App access setup is safely checkpointed. Resume installation to finish before app traffic opens.");
+}
+//#endregion
 //#region src/cli/platform-auth-bootstrap.ts
 /** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
 async function resumeInstalledPlatformAuthentication(input, initialize = initializeInstalledPlatformAuthentication) {
@@ -1560,6 +2295,26 @@ async function initializeInstalledPlatformAuthentication(apiUrl, installationId,
 }
 //#endregion
 //#region src/cli/platform-auth-database.ts
+/** Restore the selected external origin before an adoption receipt exists. */
+function readPlatformHyperdriveSelection(checkpoint) {
+	if (!checkpoint?.externalHyperdriveJson) return;
+	let value;
+	try {
+		value = JSON.parse(checkpoint.externalHyperdriveJson);
+	} catch {
+		throw new Error("platform: The saved Hyperdrive selection is invalid.");
+	}
+	const selected = value;
+	const nonempty = (value) => typeof value === "string" && value.trim() !== "";
+	if (!selected || typeof selected !== "object" || Array.isArray(selected) || !nonempty(selected.id) || !nonempty(selected.host) || !nonempty(selected.user) || selected.name !== void 0 && (typeof selected.name !== "string" || !selected.name) || selected.database !== void 0 && (typeof selected.database !== "string" || !selected.database)) throw new Error("platform: The saved Hyperdrive selection is invalid.");
+	return {
+		id: selected.id,
+		host: selected.host,
+		user: selected.user,
+		...selected.name ? { name: selected.name } : {},
+		...selected.database ? { database: selected.database } : {}
+	};
+}
 /** Read the database name from an owner URL without applying Hyperdrive origin restrictions. */
 function platformDatabaseNameFromOwnerUrl(databaseUrl) {
 	let url;
@@ -1637,8 +2392,10 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...enableEmail ? { email: true } : {}
 	};
 	if (capabilities.email && options?.includeEmailGateway !== false && !enableEmail) throw new Error("platform: Email-enabled installations require VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID before deploying this runtime.");
+	if (input.appAccess && input.appAccess !== "public" && input.controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${input.applicationDomain.toLowerCase()}`)) throw new Error("platform: The API hostname must be outside the app Access wildcard. Use the application domain apex or workers.dev for the API, then plan again.");
 	const deployment = createPlatformDeploymentManifest({
 		authentication: input.authentication ?? existing?.deployment.authentication,
+		appAccess: input.appAccess ?? existing?.deployment.appAccess,
 		...Object.keys(capabilities).length > 0 ? { capabilities } : {},
 		application: {
 			baseDomain: testing ? `${accountSubdomain}.workers.dev` : input.applicationDomain,
@@ -1844,6 +2601,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		actions,
 		apiUrl,
 		deployment: resolvedDeployment,
+		...resolvedDeployment.appAccess ? { appAccessSetupRequired: !existing?.steps.some((step) => step.key === "app-access-initialized:v1") } : {},
 		...input.externalHyperdrive ? { externalHyperdrive: input.externalHyperdrive } : {},
 		installationId,
 		proxyUrl,
@@ -2146,18 +2904,21 @@ async function readRemoteOwnership(client, accountId, routingNamespaces, existin
 }
 function formatPlatformInstallPlan(plan) {
 	const lines = [
-		`${import_picocolors$1.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
-		`${import_picocolors$1.default.bold("Account:")} ${plan.account.id}`,
-		plan.deployment.application.zoneName ? `${import_picocolors$1.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors$1.default.bold("Applications:")} workers.dev for testing. Add a domain with void platform domain set <domain>`,
-		`${import_picocolors$1.default.bold("Control plane:")} ${plan.apiUrl}`,
-		`${import_picocolors$1.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
-		...platformDashboardUrl(plan.deployment) ? [`${import_picocolors$1.default.bold("Dashboard:")} ${platformDashboardUrl(plan.deployment)} (deploy separately)`] : [],
-		`${import_picocolors$1.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
-		`${import_picocolors$1.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
-		`${import_picocolors$1.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
-		...plan.deployment.authentication.providers.includes("cloudflare-access") ? ["Access login: create a dedicated OIDC application or connect an existing issuer."] : [],
-		...plan.deployment.authentication.accessProtection ? [`Access protection: verify an application covering ${plan.apiUrl} and ${plan.proxyUrl}, with a separate scoped service token for installation and CI.`] : [],
-		`${import_picocolors$1.default.bold("Database:")} Verify uncached Hyperdrive reads for authentication`,
+		`${import_picocolors.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
+		`${import_picocolors.default.bold("Account:")} ${plan.account.id}`,
+		plan.deployment.application.zoneName ? `${import_picocolors.default.bold("Applications:")} *.${plan.deployment.application.baseDomain}` : `${import_picocolors.default.bold("Applications:")} workers.dev for testing. Add a domain with void platform domain set <domain>`,
+		`${import_picocolors.default.bold("Control plane:")} ${plan.apiUrl}`,
+		`${import_picocolors.default.bold("Resource proxy:")} ${plan.proxyUrl}`,
+		...platformDashboardUrl(plan.deployment) ? [`${import_picocolors.default.bold("Dashboard:")} ${platformDashboardUrl(plan.deployment)} (deploy separately)`] : [],
+		`${import_picocolors.default.bold("Login methods:")} ${plan.deployment.authentication.providers.join(", ")}`,
+		`${import_picocolors.default.bold("Access protection:")} ${plan.deployment.authentication.accessProtection ? "Enabled" : "Not enabled"}`,
+		...plan.deployment.appAccess ? [plan.appAccessSetupRequired === false ? `${import_picocolors.default.bold("App access:")} Preserve administrator settings` : `${import_picocolors.default.bold("Default app access:")} ${{
+			public: "Public apps",
+			platform: "Same as platform Access policy",
+			custom: "Selected Access policy"
+		}[plan.deployment.appAccess]}`] : [],
+		`${import_picocolors.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
+		`${import_picocolors.default.bold("Database:")} ${plan.externalHyperdrive?.database || "PostgreSQL"} via Hyperdrive ${plan.deployment.resources.hyperdrive}`,
 		""
 	];
 	for (const action of plan.actions) lines.push(`${action.action.padEnd(6)} ${action.kind.padEnd(19)} ${action.name}`);
@@ -2647,12 +3408,17 @@ function createPlatformInstallationSecrets(input) {
 	});
 	return {
 		authenticationPreparation: Object.fromEntries(Object.entries(checkpoint).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
+		...checkpoint.appAccessSetupToken ? { appAccessSetupToken: checkpoint.appAccessSetupToken } : {},
+		...checkpoint.appAccessSetupJson ? { appAccessSetupJson: checkpoint.appAccessSetupJson } : {},
+		...checkpoint.managementApiToken ? { managementApiToken: checkpoint.managementApiToken } : {},
+		...checkpoint.externalHyperdriveJson ? { externalHyperdriveJson: checkpoint.externalHyperdriveJson } : {},
 		...modernAuthentication ? {
 			authenticationSetupJson,
 			authSetupToken,
 			authBootstrapCode
 		} : {},
 		...checkpoint.accessProvisioningJson ? { accessProvisioningJson: checkpoint.accessProvisioningJson } : {},
+		...checkpoint.accessHealthProvisioningJson ? { accessHealthProvisioningJson: checkpoint.accessHealthProvisioningJson } : {},
 		...checkpoint.accessCredentialsJson ? { accessCredentialsJson: checkpoint.accessCredentialsJson } : {},
 		workerSecretUpdates: input.updateExistingWorkers ? explicitWorkerSecretUpdates : {},
 		pendingWorkerSecretUpdateIntent: input.updateExistingWorkers ? pendingWorkerSecretUpdateIntent : void 0,
@@ -2722,6 +3488,10 @@ function assertCanonicalProjectSecretKey(value, name, uniqueToInstallation = fal
 }
 function secretCheckpoint(secrets, workerSecretUpdateIntent) {
 	return {
+		...secrets.appAccessSetupToken ? { appAccessSetupToken: secrets.appAccessSetupToken } : {},
+		...secrets.appAccessSetupJson ? { appAccessSetupJson: secrets.appAccessSetupJson } : {},
+		...secrets.managementApiToken ? { managementApiToken: secrets.managementApiToken } : {},
+		...secrets.externalHyperdriveJson ? { externalHyperdriveJson: secrets.externalHyperdriveJson } : {},
 		...Object.fromEntries(Object.entries(secrets.authenticationPreparation ?? {}).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
 		...secrets.authSetupToken ? {
 			authenticationSetupJson: secrets.authenticationSetupJson ?? "",
@@ -2729,6 +3499,7 @@ function secretCheckpoint(secrets, workerSecretUpdateIntent) {
 			authBootstrapCode: secrets.authBootstrapCode ?? ""
 		} : {},
 		...secrets.accessProvisioningJson ? { accessProvisioningJson: secrets.accessProvisioningJson } : {},
+		...secrets.accessHealthProvisioningJson ? { accessHealthProvisioningJson: secrets.accessHealthProvisioningJson } : {},
 		...secrets.accessCredentialsJson ? { accessCredentialsJson: secrets.accessCredentialsJson } : {},
 		bootstrapGitHubId: secrets.bootstrapGitHubId,
 		bootstrapGitHubLogin: secrets.bootstrapGitHubLogin,
@@ -2985,6 +3756,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
+	if (plan.deployment.appAccess && runtime.appAccessSetup !== 1) throw new Error("platform: This runtime does not support the installation’s app access setup.");
 	const hasEmailGatewayArtifact = runtime.artifacts.emailGateway !== void 0;
 	if (runtime.emailProtocolVersion !== 1 && plan.deployment.capabilities.email) throw new Error("platform: This runtime cannot serve enabled platform email without email protocol version 1.");
 	if (runtime.emailProtocolVersion !== 1 && existing?.resources.some((resource) => resource.key === "email-gateway-worker" && resource.state === "ready")) throw new Error("platform: This runtime cannot replace an installed email gateway Worker. Use a runtime with email protocol version 1.");
@@ -3077,6 +3849,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		parsePostgresConnectionString(secrets.databaseUrl);
 		assertVoidCreatedHyperdriveTrustsDatabase(secrets.databaseUrl);
 	}
+	if (plan.externalHyperdrive) secrets = {
+		...secrets,
+		externalHyperdriveJson: JSON.stringify(plan.externalHyperdrive)
+	};
 	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
 	writePendingInstallationSecrets(manifest, {
 		...pendingSecrets,
@@ -3117,10 +3893,6 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		throw error;
 	}
 	if (workerSecretUpdateIntent && !hasExplicitWorkerSecretUpdates && platformWorkerSecretUpdateIntentState(manifest, workerSecretUpdateIntent) !== "active") workerSecretUpdateIntent = null;
-	let workerDeploymentSecrets = {
-		...secrets,
-		workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
-	};
 	try {
 		assertPlatformRuntimeSafety(runtime, manifest.safetyProtocols, releaseDatabaseLock.requiredSafetyProtocols);
 		if (existing) await dependencies.verifyExistingOwnership?.(manifest, authoritative !== null && authoritative !== void 0);
@@ -3239,15 +4011,47 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			activateAccessCredentials();
 			assertRequiredPlatformSecrets(plan, manifest, secrets);
 			if (secrets.authenticationSetupJson && createHash("sha256").update(secrets.authBootstrapCode ?? "").digest("hex") !== parsePlatformAuthenticationSetup(JSON.parse(secrets.authenticationSetupJson)).bootstrapCredentialHash) throw new Error("platform: Prepared authentication does not match its administrator setup code.");
-			workerDeploymentSecrets = {
-				...secrets,
-				workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
-			};
 			writePendingInstallationSecrets(manifest, {
 				...secretCheckpoint(secrets, workerSecretUpdateIntent),
 				databaseClaimState: "claimed"
 			});
 		}
+		const appAccessSetupRequired = !!plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1");
+		if (appAccessSetupRequired) {
+			if (dependencies.prepareAppAccess) try {
+				const appAccessSetupJson = await dependencies.prepareAppAccess(manifest, secrets);
+				const latest = readPendingInstallationSecrets(manifest) ?? {};
+				secrets = {
+					...secrets,
+					appAccessSetupJson,
+					authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)))
+				};
+				writePendingInstallationSecrets(manifest, {
+					...secretCheckpoint(secrets, workerSecretUpdateIntent),
+					databaseClaimState: "claimed"
+				});
+			} catch (error) {
+				const latest = readPendingInstallationSecrets(manifest) ?? {};
+				secrets = {
+					...secrets,
+					appAccessSetupJson: latest.appAccessSetupJson || secrets.appAccessSetupJson,
+					authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)))
+				};
+				throw error;
+			}
+			if (!secrets.appAccessSetupJson) throw new Error("platform: Restore the encrypted app access setup checkpoint before resuming.");
+			if (!secrets.appAccessSetupToken) {
+				if (manifest.resources.some((resource) => resource.key === "api-worker" && resource.state === "ready")) throw new Error("platform: Restore the encrypted app access setup authority before resuming.");
+				secrets = {
+					...secrets,
+					appAccessSetupToken: randomBytes(32).toString("hex")
+				};
+				writePendingInstallationSecrets(manifest, {
+					...secretCheckpoint(secrets, workerSecretUpdateIntent),
+					databaseClaimState: "claimed"
+				});
+			}
+		}
 		if (plan.deployment.authentication.accessProtection) {
 			const protection = liveAuthentication ? liveAuthentication.protection : secrets.authenticationSetupJson ? parsePlatformAuthenticationSetup(JSON.parse(secrets.authenticationSetupJson)).protection : null;
 			if (!protection) throw new Error("platform: The active Access protection configuration is unavailable. Restore its database and encrypted setup checkpoint before maintenance.");
@@ -3261,6 +4065,44 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent)
 			});
 		}
+		if (plan.deployment.authentication.accessProtection || appAccessSetupRequired && secrets.appAccessSetupJson && JSON.parse(secrets.appAccessSetupJson).managed === true) {
+			dependencies.onProgress?.("Preparing Access for authenticated platform health checks");
+			try {
+				await (dependencies.prepareHealthAccess ?? ensurePlatformAccessHealthChecks)({
+					client: dependencies.client,
+					manifest,
+					plan,
+					checkpoint: secretCheckpoint(secrets, workerSecretUpdateIntent),
+					save: (accessHealthProvisioningJson) => {
+						secrets = {
+							...secrets,
+							accessHealthProvisioningJson
+						};
+						manifest = checkpointAuthenticationResources(manifest, secrets, now());
+						writePendingInstallationSecrets(manifest, {
+							...secretCheckpoint(secrets, workerSecretUpdateIntent),
+							databaseClaimState: "claimed"
+						});
+						writeInstallationManifest(manifest);
+					}
+				});
+			} catch (error) {
+				if (appAccessSetupRequired && secrets.appAccessSetupJson && JSON.parse(secrets.appAccessSetupJson).managed && error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status)) {
+					secrets = {
+						...secrets,
+						authenticationPreparation: {
+							...secrets.authenticationPreparation,
+							appAccessTokenRejected: "true"
+						}
+					};
+					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+					throw new PlatformAppAccessCredentialError("platform: App access token rejected while preparing health checks. Resume installation to provide a replacement.");
+				}
+				throw error;
+			} finally {
+				await releaseDatabaseLock.checkpoint?.(manifest);
+			}
+		}
 		const routingAction = plan.actions.find((action) => action.key === "routing-kv");
 		if (routingAction.action === "adopt") throw new Error("platform: The routing checkpoint cannot be adopted.");
 		if (routingAction.action === "reuse") {
@@ -3362,7 +4204,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const createsWorker = plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
 		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
-		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain;
+		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1");
 		if (requiresTrafficGuard) {
 			await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 			workerTrafficGuarded = true;
@@ -3379,6 +4221,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		}
 		const configInput = {
 			authenticationDatabaseUncached: true,
+			proxyHealthBinding: true,
 			accountId: plan.account.id,
 			apiUrl: plan.apiUrl,
 			deployment: plan.deployment,
@@ -3399,6 +4242,10 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			runtimeEntrypoints: entrypoints,
 			...runtime.assets ? { runtimeApiAssetsDirectory: join(runtimeDirectory, PLATFORM_ADMIN_ASSETS_DIRECTORY) } : {}
 		};
+		const workerDeploymentSecrets = {
+			...secrets,
+			workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
+		};
 		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const enabledConfigs = createPlatformWorkerConfigs({
 			...configInput,
@@ -3665,6 +4512,37 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			writeInstallationManifest(manifest);
 			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 		}
+		if (plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1")) {
+			dependencies.onProgress?.("Configuring and verifying deployed-app access");
+			try {
+				await (dependencies.initializeAppAccess ?? initializeInstalledAppAccess)({
+					apiUrl: plan.apiUrl,
+					installationId: manifest.id,
+					probeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
+					setupJson: secrets.appAccessSetupJson,
+					setupToken: secrets.appAccessSetupToken
+				});
+			} catch (error) {
+				if (error instanceof PlatformAppAccessCredentialError) {
+					secrets = {
+						...secrets,
+						authenticationPreparation: {
+							...secrets.authenticationPreparation,
+							appAccessTokenRejected: "true"
+						}
+					};
+					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+				}
+				throw error;
+			}
+			manifest = recordInstallationStep(manifest, {
+				key: "app-access-initialized:v1",
+				completedAt: now(),
+				resultHash: hash(secrets.appAccessSetupJson)
+			}, now());
+			writeInstallationManifest(manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		}
 		dependencies.onProgress?.("Verifying platform health");
 		const emailGatewayUrl = hasEmailGatewayArtifact && plan.deployment.capabilities.email ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
 		if (plan.deployment.authentication.accessProtection) {
@@ -3673,6 +4551,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		}
 		const healthCheckContext = {
 			accountName: plan.account.name,
+			...plan.deployment.authentication.accessProtection ? { accessProtected: true } : {},
 			workers: [
 				plan.deployment.resources.apiWorker,
 				plan.deployment.resources.proxyWorker,
@@ -3844,7 +4723,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	}
 }
 function checkpointAuthenticationResources(manifest, secrets, updatedAt) {
-	return checkpointPlatformAccessResources(manifest, secrets.accessProvisioningJson, updatedAt);
+	return checkpointPlatformAccessResources(checkpointPlatformAccessResources(manifest, secrets.accessProvisioningJson, updatedAt), secrets.accessHealthProvisioningJson, updatedAt);
 }
 async function writeR2OwnershipMarkerIfNeeded(client, plan, manifest, action) {
 	if (action.kind !== "r2-bucket") return;
@@ -4094,6 +4973,7 @@ function apiWorkerSecrets(secrets, accountId, zoneId) {
 		JWT_SECRET: secrets.jwtSecret,
 		PLATFORM_BOOTSTRAP_GITHUB_ID: secrets.bootstrapGitHubId,
 		PLATFORM_AUTH_SETUP_TOKEN: secrets.authSetupToken ?? "",
+		PLATFORM_APP_ACCESS_SETUP_TOKEN: secrets.appAccessSetupToken ?? "",
 		...secrets.projectSecretKeysJson && secrets.projectSecretActiveKeyVersion ? {
 			PROJECT_SECRET_ACTIVE_KEY_VERSION: secrets.projectSecretActiveKeyVersion,
 			PROJECT_SECRET_KEYS_JSON: secrets.projectSecretKeysJson
@@ -5642,7 +6522,15 @@ function errorMessage(error) {
 }
 var PlatformAccessBlockedError = class extends Error {
 	constructor(url, context) {
-		super([
+		super(context?.accessProtected ? [
+			"platform: Cloudflare Access blocked a protected platform health check (Default-Deny, error 1050).",
+			`Blocked URL: ${url}`,
+			"Keep employee Access protection and account-wide Default-Deny enabled.",
+			"The reserved dispatch /health endpoint uses a path-only Access exception and still requires Void’s private probe token.",
+			"Resume to verify the health exceptions and saved installer credentials.",
+			...context.resumeCommand ? [`Resume: ${context.resumeCommand}`] : [],
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
+		].join("\n") : [
 			"platform: Cloudflare Access blocked the platform health checks (Default-Deny, error 1050).",
 			`Blocked URL: ${url}`,
 			"",
@@ -5688,16 +6576,16 @@ async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicatio
 		request(`${dispatchUrl}/health`),
 		context?.emailGatewayUrl ? request(`${context.emailGatewayUrl}/health`) : void 0
 	]);
-	if (!health.ok) throw await platformProbeFailure("Health check", apiUrl, health, context);
-	if (!discovery.ok) throw await platformProbeFailure("Discovery check", apiUrl, discovery, context);
+	if (!health.ok) throw await platformProbeFailure("Health check", `${apiUrl}/health`, health, context);
+	if (!discovery.ok) throw await platformProbeFailure("Discovery check", `${apiUrl}/.well-known/void-platform`, discovery, context);
 	const body = await discovery.json();
 	if (body.installationId !== installationId) throw new Error("platform: Deployed API discovery identity does not match this installation.");
 	if (body.platformVersion !== platformVersion) throw new Error("platform: Deployed API discovery version does not match this release.");
 	if ((body.usageProtocolVersion ?? 0) !== usageProtocolVersion) throw new Error("platform: Deployed API usage protocol does not match this runtime. Traffic remains disabled.");
-	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", proxyUrl, proxy, context);
-	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", dispatchUrl, dispatch, context);
+	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", `${proxyUrl}/health`, proxy, context);
+	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", `${dispatchUrl}/health`, dispatch, context);
 	if (emailGateway) {
-		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", context.emailGatewayUrl, emailGateway, context);
+		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", `${context.emailGatewayUrl}/health`, emailGateway, context);
 		const identity = await emailGateway.json();
 		if (identity?.installationId !== installationId || identity.platformVersion !== platformVersion || identity.emailProtocolVersion !== 1) throw new Error("platform: Deployed email gateway identity, version, or protocol does not match this installation.");
 	}
@@ -5838,6 +6726,15 @@ function createPlatformHealthProbeToken(ownershipNonce) {
 }
 //#endregion
 //#region src/cli/platform-install-auth.ts
+function platformManagementAccessForAuthentication(selection, accountId, checkpoint) {
+	if (!selection.authentication.accessProtection && (!selection.authentication.providers.includes("cloudflare-access") || selection.file && !selection.file.cloudflareAccess)) return;
+	const spec = selection.file?.cloudflareAccess ?? (checkpoint?.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(checkpoint.accessSetupSpecJson)) : void 0);
+	if (spec?.accountId && spec.accountId !== accountId) return;
+	return {
+		protection: !!selection.authentication.accessProtection,
+		readOnly: spec?.mode === "existing"
+	};
+}
 function answer(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
@@ -5867,8 +6764,8 @@ async function selectInstallationAuthentication(file, recorded, choices = {}) {
 	}
 	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
 	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : answer(await multiselect({
-		message: "Platform login methods:",
-		initialValues: ["github"],
+		message: "Platform login methods (select all that apply):",
+		initialValues: [],
 		required: true,
 		options: [
 			{
@@ -6076,6 +6973,72 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	return result;
 }
 //#endregion
+//#region src/cli/platform-saved-plans.ts
+function planId(args) {
+	return createHash("sha256").update(JSON.stringify([args.account, args.name])).digest("hex");
+}
+function parseSavedPlan(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected an installation plan.");
+	const record = value;
+	if (record.schemaVersion !== 1 || !Array.isArray(record.arguments) || !record.arguments.every((arg) => typeof arg === "string")) throw new Error("Invalid installation plan format.");
+	const args = parsePlatformArgs(record.arguments);
+	if (args.subcommand !== "install" || args.plan || args.resume || args.yes || !args.account || !args.name || !args.displayName) throw new Error("Saved plans must contain installation choices without mutation approval.");
+	if (typeof record.accountName !== "string" || !record.accountName || typeof record.savedAt !== "string" || !Number.isFinite(Date.parse(record.savedAt))) throw new Error("Invalid installation plan metadata.");
+	return {
+		id: planId(args),
+		args,
+		accountName: record.accountName,
+		savedAt: record.savedAt
+	};
+}
+function savePlatformInstallChoices(arguments_, accountName, directory = platformRegistryDirectory()) {
+	const record = {
+		schemaVersion: 1,
+		arguments: arguments_,
+		accountName,
+		savedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const plan = parseSavedPlan(record);
+	mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const path = join(directory, `plan-${plan.id}.json`);
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	try {
+		writeFileSync(temporary, JSON.stringify(record, null, 2) + "\n", {
+			mode: 384,
+			flag: "wx"
+		});
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+	return plan;
+}
+function listSavedPlatformInstallPlans(directory = platformRegistryDirectory()) {
+	let entries;
+	try {
+		entries = readdirSync(directory, { withFileTypes: true });
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	return entries.filter((entry) => entry.isFile() && /^plan-[a-f0-9]{64}\.json$/.test(entry.name)).map((entry) => {
+		const path = join(directory, entry.name);
+		try {
+			const plan = parseSavedPlan(JSON.parse(readFileSync(path, "utf8")));
+			if (entry.name !== `plan-${plan.id}.json`) throw new Error("Plan identity does not match its file.");
+			return plan;
+		} catch (error) {
+			throw new Error(`platform: Invalid saved installation plan ${path}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}).sort((left, right) => right.savedAt.localeCompare(left.savedAt) || left.id.localeCompare(right.id));
+}
+function removeSavedPlatformInstallPlan(args, directory = platformRegistryDirectory()) {
+	rmSync(join(directory, `plan-${planId(args)}.json`), { force: true });
+}
+//#endregion
 //#region src/cli/platform-setup-draft.ts
 const STARTED = "credential-setup:v1";
 const COMPLETED = "credential-setup-complete:v1";
@@ -6111,7 +7074,7 @@ function savePlatformSetupDraft(plan, version) {
 		resultHash: plan.installationId
 	}, now);
 	writeInstallationManifest(manifest);
-	writePendingInstallationSecrets(manifest, {});
+	writePendingInstallationSecrets(manifest, plan.externalHyperdrive ? { externalHyperdriveJson: JSON.stringify(plan.externalHyperdrive) } : {});
 	return manifest;
 }
 function completePlatformSetupDraft(manifest) {
@@ -6125,246 +7088,10 @@ function completePlatformSetupDraft(manifest) {
 	return completed;
 }
 //#endregion
-//#region src/cli/platform-setup.ts
-function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
-	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + page.title + "\x1B]8;;\x1B\\" : page.title + ": " + page.url;
-}
-function platformSetupFieldHelp(key) {
-	const docs = (page, section, title) => platformSetupLink({
-		title,
-		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
-	});
-	switch (key) {
-		case "databaseUrl": return {
-			placeholder: "postgresql://user:pw@…/database",
-			description: "Stores platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
-				title: "Neon",
-				url: "https://neon.com/"
-			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
-		};
-		case "jwtSecret": return { description: "Signs platform login tokens. Run openssl rand -base64 32. Save the key in your password manager. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: "Encrypts app secrets. Run openssl rand -base64 32 separately. Save this key for recovery. " + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		default: return;
-	}
-}
-function supportsSetupLinks() {
-	return !!process.stdout.isTTY && ([
-		"ghostty",
-		"iTerm.app",
-		"WezTerm",
-		"vscode",
-		"WarpTerminal"
-	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
-}
-/** Dashboard keys use permission-catalog labels, which can differ from product names. */
-function platformSetupPages(plan) {
-	const needsGateway = plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect");
-	const permissions = [
-		{
-			key: "account_settings",
-			type: "read"
-		},
-		{
-			key: "workers_scripts",
-			type: "edit"
-		},
-		{
-			key: "workers_kv_storage",
-			type: "edit"
-		},
-		{
-			key: "workers_r2",
-			type: "edit"
-		},
-		{
-			key: "d1",
-			type: "edit"
-		},
-		{
-			key: "queues",
-			type: "edit"
-		},
-		{
-			key: "account_analytics",
-			type: "read"
-		},
-		{
-			key: "workers_tail",
-			type: "read"
-		},
-		{
-			key: "query_cache",
-			type: "edit"
-		},
-		...needsGateway ? [{
-			key: "aig",
-			type: "edit"
-		}] : [],
-		...plan.deployment.application.zoneName ? [{
-			key: "cache",
-			type: "purge"
-		}] : [],
-		...plan.deployment.capabilities.customDomains ? [{
-			key: "ssl_and_certificates",
-			type: "edit"
-		}] : [],
-		...plan.deployment.capabilities.email ? [
-			{
-				key: "zone",
-				type: "read"
-			},
-			{
-				key: "zone_settings",
-				type: "edit"
-			},
-			{
-				key: "email_routing_address",
-				type: "edit"
-			},
-			{
-				key: "email_routing_rule",
-				type: "edit"
-			},
-			{
-				key: "email_sending",
-				type: "edit"
-			}
-		] : []
-	];
-	return {
-		runtime: {
-			title: "Cloudflare runtime token",
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/api-tokens",
-				name: plan.deployment.displayName + " Runtime",
-				permissionGroupKeys: JSON.stringify(permissions)
-			}),
-			instructions: [
-				"Review the preselected permissions for account " + plan.account.name + ".",
-				"Edit: Workers Scripts, KV, R2, D1, Queues, Hyperdrive" + (needsGateway ? ", AI Gateway." : "."),
-				"Read: Account Settings, Account Analytics, Workers Tail.",
-				...plan.deployment.application.zoneName ? ["Zone " + plan.deployment.application.zoneName + ": Cache Purge: Purge."] : [],
-				...plan.deployment.capabilities.customDomains ? ["Custom project domains also need SSL and Certificates: Edit on that zone."] : [],
-				...plan.deployment.capabilities.email ? ["Email-enabled installations need Email Routing Addresses: Edit and Email Sending: Edit on the account, plus Zone: Read, Zone Settings: Edit and Email Routing Rules: Edit on the mail zones."] : [],
-				"If the form differs, match the permissions above. Create the token, then paste it here."
-			].join("\n")
-		},
-		github: {
-			title: "GitHub OAuth App",
-			url: "https://github.com/settings/applications/new",
-			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
-		},
-		r2: {
-			title: "R2 upload token",
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/r2/api-tokens/create",
-				type: "account"
-			}),
-			instructions: [
-				"Select Object Read & Write.",
-				"Keep Apply to all buckets in this account selected.",
-				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
-			].join("\n")
-		}
-	};
-}
-function formatPlatformSetupPlan(plan) {
-	const pages = platformSetupPages(plan);
-	return [
-		"Credentials needed during installation:",
-		"PostgreSQL database URL",
-		platformSetupLink(pages.runtime),
-		platformSetupLink(pages.r2),
-		...plan.deployment.authentication.providers.includes("github") ? [platformSetupLink(pages.github)] : [],
-		...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
-		...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
-		platformSetupLink({
-			title: "JWT signing key and project encryption key",
-			url: "https://void.cloud/guide/platform/installation/credentials#signing-and-encryption-keys"
-		}),
-		"",
-		"Login callback: " + plan.apiUrl + "/auth/callback",
-		"Installation collects and validates missing credentials after you confirm the plan."
-	].join("\n");
-}
-function formatPlatformInstallCommand(options) {
-	const quote = (value) => {
-		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
-		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
-	};
-	const parts = [
-		options.commandName,
-		"platform",
-		"install"
-	];
-	const flag = (name, value) => {
-		if (value) parts.push(name, quote(value));
-	};
-	if (options.resumeId) {
-		parts.push("--resume");
-		flag("--name", options.resumeId);
-	} else {
-		flag("--name", options.installationSlug);
-		flag("--account", options.accountId);
-		flag("--display-name", options.displayName);
-		if (options.workersDev) parts.push("--workers-dev");
-		else {
-			flag("--application-domain", options.applicationDomain);
-			flag("--zone", options.zoneName);
-			if (options.dedicatedZone) parts.push("--dedicated-zone");
-			else parts.push("--no-dedicated-zone");
-		}
-		flag("--control-plane-domain", options.controlPlaneDomain);
-		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
-	}
-	flag("--hyperdrive", options.hyperdrive ?? "");
-	flag("--auth-config", options.authConfig ?? "");
-	if (!options.authConfig && !options.resumeId && options.authentication) {
-		flag("--login-methods", options.authentication.providers.join(","));
-		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
-	}
-	flag("--dashboard-url", options.dashboardUrl ?? "");
-	flag("--runtime", options.runtime);
-	if (options.yes) parts.push("--yes");
-	return parts.join(" ");
-}
-function openPlatformSetupPage(page, dependencies = {}) {
-	log.info(page.title + "\n" + page.instructions);
-	console.log(platformSetupLink({
-		...page,
-		title: "Open " + page.title
-	}));
-	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
-		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
-	} catch {
-		log.info("Could not open the browser. Use the link above.");
-	}
-}
-//#endregion
 //#region src/cli/prompt-password.ts
-var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
-/** A visual example for an empty secret field; never a default value or an unmasked input. */
-async function passwordWithPlaceholder(options) {
-	return await new u$1({
-		input: options.input,
-		output: options.output,
-		signal: options.signal,
-		mask: options.mask ?? S_PASSWORD_MASK,
-		validate: options.validate,
-		render() {
-			const guide = options.withGuide ?? settings.withGuide;
-			const prefix = `${guide ? `${import_picocolors.default.gray(S_BAR)}\n` : ""}${symbol(this.state)}  ${options.message}\n`;
-			const bar = guide ? `${import_picocolors.default.gray(S_BAR)}  ` : "";
-			if (this.state === "submit" || this.state === "cancel") return `${prefix}${bar}${import_picocolors.default.dim(this.masked)}`;
-			if (this.state === "error") {
-				const masked = this.masked;
-				if (options.clearOnError) this.clear();
-				return `${prefix}${bar}${import_picocolors.default.dim(masked)}\n${guide ? `${import_picocolors.default.yellow(S_BAR_END)}  ` : ""}${import_picocolors.default.yellow(this.error)}\n`;
-			}
-			const input = this.userInput.length === 0 ? import_picocolors.default.dim(options.placeholder) : this.userInputWithCursor;
-			return `${prefix}${guide ? `${import_picocolors.default.cyan(S_BAR)}  ` : ""}${input}\n${guide ? import_picocolors.default.cyan(S_BAR_END) : ""}\n`;
-		}
-	}).prompt() ?? CANCEL_SYMBOL;
+/** A visual example for an empty secret field; never a default value or unmasked input. */
+function passwordWithPlaceholder(options) {
+	return password(options);
 }
 //#endregion
 //#region src/cli/platform-lifecycle.ts
@@ -6381,17 +7108,17 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 	}
 	return explicit || recorded;
 }
-async function runPlatformLifecycleCommand(args) {
-	if (args.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-BNkcz0OB.mjs");
-		await runPlatformDomainCommand(args);
+async function runPlatformLifecycleCommand(commandArgs) {
+	if (commandArgs.subcommand === "domain") {
+		const { runPlatformDomainCommand } = await import("./platform-domain-Di6EYrQl.mjs");
+		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
-	if (args.subcommand === "discover") {
+	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
-		const accountId = await selectAccount(await readAccounts(client), args.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-D6KSpuFm.mjs");
-		const recovered = await recoverPlatformInstallations(client, accountId, void 0, args.selector);
+		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
+		const { recoverPlatformInstallations } = await import("./platform-recovery-BJnQJEtQ.mjs");
+		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
 			return;
@@ -6399,18 +7126,20 @@ async function runPlatformLifecycleCommand(args) {
 		for (const manifest of recovered) log.success(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
 		return;
 	}
-	if (args.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-CnyTdcWX.mjs");
-		await runInstalledPlatformCommand(args);
+	if (commandArgs.subcommand !== "install") {
+		const { runInstalledPlatformCommand } = await import("./platform-management-DG47jys8.mjs");
+		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
-	const runtime = loadPlatformRuntime(args.runtime);
+	let args = commandArgs;
+	let runtime = loadPlatformRuntime(args.runtime);
 	assertNoninteractivePlatformMutationAcknowledged(args, process.stdin.isTTY === true);
 	console.log();
 	intro(cliTitle("platform install"));
 	let existing = args.resume ? resolveInstallationManifest(args.name) : null;
 	let selectedInstall = false;
 	let selectedDraft = false;
+	let installationName = args.name;
 	const { input: installationSlug, credential: operatorCredential } = await resolvePlatformCloudflareCredentialWithInput(async () => {
 		let requestedName = args.name;
 		const resumableInstalls = () => listInstallationManifests().filter((manifest) => isPlatformInstallInProgress(manifest) && (!args.account || manifest.account.id === args.account || manifest.account.name.toLowerCase() === args.account.toLowerCase()));
@@ -6426,21 +7155,42 @@ async function runPlatformLifecycleCommand(args) {
 		};
 		if (!args.resume && process.stdin.isTTY) {
 			const installs = resumableInstalls().filter((manifest) => !args.name || manifest.deployment.installationSlug === normalizeInstallationSlug(args.name));
-			if (installs.length > 0) {
+			const manifests = listInstallationManifests();
+			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
+			if (installs.length > 0 || savedPlans.length > 0) {
 				const choice = await select({
 					message: "Continue a previous platform install?",
-					options: [...installs.map((install) => ({
-						value: install.id,
-						label: `Continue setup for ${install.deployment.displayName} (${install.deployment.installationSlug})`,
-						hint: install.account.name
-					})), {
-						value: "new",
-						label: "Start a new platform install"
-					}]
+					options: [
+						...installs.map((install) => ({
+							value: install.id,
+							label: `Continue setup for ${install.deployment.displayName} (${install.deployment.installationSlug})`,
+							hint: install.account.name
+						})),
+						...savedPlans.map((saved) => ({
+							value: `plan:${saved.id}`,
+							label: `Use saved plan for ${saved.args.displayName} (${saved.args.name})`,
+							hint: `${saved.accountName} · ${saved.args.workersDev ? "workers.dev" : saved.args.applicationDomain}`
+						})),
+						{
+							value: "new",
+							label: "Start a new platform install"
+						}
+					]
 				});
 				if (isCancel(choice) || typeof choice === "symbol") throw new Error("platform: Cancelled.");
 				if (choice === "new") requestedName = "";
-				else {
+				else if (choice.startsWith("plan:")) {
+					const saved = savedPlans.find((plan) => `plan:${plan.id}` === choice);
+					if (!saved) throw new Error("platform: The selected plan is no longer available.");
+					args = {
+						...saved.args,
+						plan: args.plan,
+						yes: args.yes
+					};
+					runtime = loadPlatformRuntime(args.runtime);
+					installationName = args.name;
+					requestedName = args.name;
+				} else {
 					const selected = installs.find((install) => install.id === choice);
 					if (!selected) throw new Error("platform: The selected setup is no longer available.");
 					selectInstall(selected);
@@ -6484,6 +7234,7 @@ async function runPlatformLifecycleCommand(args) {
 				continue;
 			}
 			assertNewNameAvailable(slug);
+			installationName = name.trim();
 			return slug;
 		}
 		if (existing.endpoints.apiUrl && !readPendingInstallationSecrets(existing)) throw new Error(`platform: Installation ${existing.id} has already been deployed. Use \`void platform repair ${existing.id}\` or \`void platform upgrade ${existing.id}\` instead.`);
@@ -6512,10 +7263,10 @@ async function runPlatformLifecycleCommand(args) {
 		if (isCancel(mode)) throw new Error("platform: Cancelled.");
 		workersDev = mode === "workers-dev";
 	}
-	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", "example.app")));
+	const applicationDomain = recorded?.application.baseDomain ?? (workersDev ? "" : normalizeApplicationDomain(args.applicationDomain || await promptText("Application base domain:", { placeholder: "example.com" })));
 	const zoneName = recorded?.application.zoneName ?? (workersDev ? "" : normalizeApplicationDomain(args.zone || await promptText("Cloudflare zone:", applicationDomain)));
-	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationSlug} Void`));
-	const controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY && !args.noControlPlaneDomain ? await promptText("Custom API hostname. Leave empty for workers.dev:", "", true) : "");
+	const displayName = recorded?.displayName ?? (args.displayName || await promptText("Platform display name:", `${installationName || installationSlug} Void`));
+	let controlPlaneDomain = recorded ? recorded.controlPlane.apiHostname ?? "" : args.controlPlaneDomain || (process.stdin.isTTY && !args.noControlPlaneDomain ? await promptText("Where do you want to host the Void Platform API? Leave empty for a workers.dev fallback.", { placeholder: applicationDomain || "platform.example.com" }, true) : "");
 	let dedicatedZone = recorded?.application.dedicatedZone ?? args.dedicatedZone;
 	if (!workersDev && !recorded && !args.dedicatedZone && !args.dedicatedZoneSpecified && applicationDomain === zoneName && process.stdin.isTTY) {
 		const catchAll = await confirm({
@@ -6542,6 +7293,26 @@ async function runPlatformLifecycleCommand(args) {
 		}
 		const checkpoint = existing ? readPendingInstallationSecrets(existing) : null;
 		const databaseUrl = resolvePlatformInstallDatabaseUrl(checkpoint, existing);
+		let authoritativeProvisionIntents = false;
+		if (existing && !isPlatformSetupDraft(existing)) {
+			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
+			progress = startProgress("Reading the saved installation");
+			const authoritative = await readPlatformDatabaseLifecycleManifest(databaseUrl, existing.id, existing.ownershipNonce);
+			progress?.stop("Read the saved installation.");
+			progress = void 0;
+			if (authoritative) {
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DG47jys8.mjs");
+				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
+				authoritativeProvisionIntents = true;
+				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
+				existing = selected;
+				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
+			}
+		}
+		const savedHyperdrive = readPlatformHyperdriveSelection(checkpoint);
+		const requestedHyperdriveId = args.hyperdrive || savedHyperdrive?.id;
+		const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
+		if (savedHyperdrive && requestedHyperdriveId !== savedHyperdrive.id || recordedHyperdrive && requestedHyperdriveId && (requestedHyperdriveId === "create" ? recordedHyperdrive.ownership === "adopted" : recordedHyperdrive.id !== requestedHyperdriveId) || savedHyperdrive && recordedHyperdrive && (recordedHyperdrive.ownership !== "adopted" || recordedHyperdrive.id !== savedHyperdrive.id)) throw new Error("platform: The selected Hyperdrive differs from the saved installation. Resume with its original Hyperdrive.");
 		const externalHyperdriveId = process.env.VOID_PLATFORM_HYPERDRIVE_ID?.trim() || "";
 		const externalHyperdriveHost = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_HOST?.trim() || "";
 		const externalHyperdriveUser = process.env.VOID_PLATFORM_HYPERDRIVE_ORIGIN_USER?.trim() || "";
@@ -6559,12 +7330,14 @@ async function runPlatformLifecycleCommand(args) {
 			host: externalHyperdriveHost,
 			user: externalHyperdriveUser
 		} : void 0;
-		if (args.hyperdrive && externalHyperdrive && args.hyperdrive !== externalHyperdrive.id) throw new Error("platform: --hyperdrive conflicts with VOID_PLATFORM_HYPERDRIVE_ID.");
-		if (!externalHyperdrive && args.hyperdrive !== "create" && (process.stdin.isTTY || args.hyperdrive) && (!existing || isPlatformSetupDraft(existing)) && !existing?.resources.some((resource) => resource.key === "hyperdrive")) {
+		if (requestedHyperdriveId && externalHyperdrive && requestedHyperdriveId !== externalHyperdrive.id) throw new Error("platform: --hyperdrive conflicts with VOID_PLATFORM_HYPERDRIVE_ID.");
+		if (savedHyperdrive && externalHyperdrive && (savedHyperdrive.host.toLowerCase() !== externalHyperdrive.host.toLowerCase() || savedHyperdrive.user !== externalHyperdrive.user)) throw new Error("platform: The Hyperdrive origin differs from the saved installation.");
+		if (savedHyperdrive) externalHyperdrive = recordedHyperdrive ? savedHyperdrive : void 0;
+		if (!externalHyperdrive && requestedHyperdriveId !== "create" && (process.stdin.isTTY || requestedHyperdriveId) && (!existing || isPlatformSetupDraft(existing) || requestedHyperdriveId) && !recordedHyperdrive) {
 			const suggestedName = existing?.deployment.resources.hyperdrive ?? createPlatformResourceNames(installationSlug).hyperdrive;
 			const configurations = await client.listHyperdriveConfigs(accountId);
 			const suggestedNameAvailable = !configurations.some((resource) => resource.name === suggestedName);
-			const choice = args.hyperdrive ? "existing" : await select({
+			const choice = requestedHyperdriveId ? "existing" : await select({
 				message: "How should Void set up Hyperdrive?",
 				options: [
 					...configurations.length > 0 ? [{
@@ -6584,12 +7357,12 @@ async function runPlatformLifecycleCommand(args) {
 			});
 			if (isCancel(choice)) throw new Error("platform: Cancelled.");
 			if (choice === "setup") {
-				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, "Set up Hyperdrive first");
+				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, import_picocolors.default.bold("Set up Hyperdrive first"));
 				outro("No Cloudflare or local installation state was changed.");
 				return;
 			}
 			if (choice === "existing") {
-				const selectedId = args.hyperdrive ?? await select({
+				const selectedId = requestedHyperdriveId ?? await select({
 					message: "Which Hyperdrive should Void use?",
 					options: [...configurations].sort((a, b) => Number(b.name === suggestedName) - Number(a.name === suggestedName) || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)).map((resource) => ({
 						value: resource.id,
@@ -6602,39 +7375,33 @@ async function runPlatformLifecycleCommand(args) {
 				if (!selected) throw new Error("platform: The selected Hyperdrive is no longer available.");
 				const live = await client.getHyperdriveConfig(accountId, selected.id);
 				if (live.id !== selected.id || live.name !== selected.name || !live.origin.user) throw new Error(`platform: Could not verify the database user for existing Hyperdrive ${selected.name}.`);
-				note(`Database: ${live.origin.database}\nHost: ${live.origin.host}\nPort: ${live.origin.port}\nUser: ${live.origin.user}\nSQL result caching: ${live.cachingDisabled ? "disabled" : "enabled"}`, `Existing Hyperdrive ${live.name}`);
+				if (savedHyperdrive && (live.origin.host !== savedHyperdrive.host.toLowerCase() || live.origin.user !== savedHyperdrive.user || savedHyperdrive.name && live.name !== savedHyperdrive.name || savedHyperdrive.database && live.origin.database !== savedHyperdrive.database) || existing && !isPlatformSetupDraft(existing) && live.name !== existing.deployment.resources.hyperdrive) throw new Error("platform: The Hyperdrive origin or name differs from the saved installation.");
+				if (!requestedHyperdriveId) note([
+					`${import_picocolors.default.bold("Database:")} ${live.origin.database}`,
+					`${import_picocolors.default.bold("Host:")} ${live.origin.host}`,
+					`${import_picocolors.default.bold("Port:")} ${live.origin.port ?? "configured by Cloudflare Tunnel"}`,
+					`${import_picocolors.default.bold("User:")} ${live.origin.user}`,
+					`${import_picocolors.default.bold("SQL result caching:")} ${live.cachingDisabled ? "disabled" : "enabled"}`
+				].join("\n"), import_picocolors.default.bold(`Existing Hyperdrive ${live.name}`));
 				if (!live.cachingDisabled) throw new Error(`platform: Disable SQL result caching on existing Hyperdrive ${live.name} before installing.`);
-				const confirmed = args.hyperdrive ? true : await confirm({
-					message: `Use ${live.name} for this platform?`,
-					initialValue: true
-				});
-				if (isCancel(confirmed) || !confirmed) throw new Error("platform: Cancelled.");
 				externalHyperdrive = {
 					id: live.id,
 					name: live.name,
+					database: live.origin.database,
 					host: live.origin.host,
 					user: live.origin.user
 				};
 			}
 		}
-		let authoritativeProvisionIntents = false;
-		if (existing && !isPlatformSetupDraft(existing)) {
-			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
-			progress = startProgress("Reading the saved installation");
-			const authoritative = await readPlatformDatabaseLifecycleManifest(databaseUrl, existing.id, existing.ownershipNonce);
-			progress?.stop("Read the saved installation.");
-			progress = void 0;
-			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CnyTdcWX.mjs");
-				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
-				authoritativeProvisionIntents = true;
-				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
-				existing = selected;
-				if (selectedInstall && !isPlatformInstallInProgress(existing)) throw new Error(`platform: Installation ${existing.id} is no longer unfinished. Run \`void platform status ${existing.id}\` to inspect it.`);
-			}
-		}
 		const authenticationSelection = await selectInstallationAuthentication(args.authConfig, existing?.deployment.authentication, args);
+		const appAccess = await selectInstallationAppAccess(authenticationSelection, existing?.deployment, args.appAccess);
+		while (!existing && process.stdin.isTTY && !args.controlPlaneDomain && appAccess && appAccess !== "public" && controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${applicationDomain.toLowerCase()}`)) {
+			log.info("App Access covers subdomains. Use the domain apex or workers.dev for the platform API.");
+			controlPlaneDomain = await promptText("Platform API hostname. Leave empty for workers.dev:", { placeholder: applicationDomain }, true);
+		}
+		if (appAccess && runtime.manifest.appAccessSetup !== 1) throw new Error("platform: This runtime does not support guided app access. Use the current packaged runtime.");
 		const planInput = {
+			appAccess,
 			authentication: authenticationSelection.authentication,
 			accountId,
 			applicationDomain,
@@ -6649,53 +7416,118 @@ async function runPlatformLifecycleCommand(args) {
 			zoneName,
 			...workersDev ? { workersDev: true } : {}
 		};
-		let plan = await createPlatformInstallPlan(client, planInput, existing, {
+		const planOptions = {
 			authoritativeProvisionIntents,
 			allowUnverifiedAiGateway: true,
 			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
 			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
 			deploymentExecution: runtime.manifest.deploymentExecution === 1
-		});
-		note(formatPlatformInstallPlan(plan), args.plan ? "Read-only installation plan" : "Installation plan");
-		note(formatPlatformRuntime(runtime), "Platform runtime");
+		};
+		let plan = await createPlatformInstallPlan(client, planInput, existing, planOptions);
+		const commandOptions = {
+			commandName: cliCommandName(),
+			accountId,
+			installationSlug,
+			displayName,
+			applicationDomain,
+			zoneName,
+			controlPlaneDomain,
+			...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
+			dedicatedZone,
+			workersDev,
+			authConfig: args.authConfig,
+			appAccess,
+			authentication: authenticationSelection.authentication,
+			hyperdrive: !existing || isPlatformSetupDraft(existing) || externalHyperdrive && !recordedHyperdrive ? externalHyperdrive?.id ?? "create" : void 0,
+			runtime: args.runtime,
+			...existing ? { resumeId: existing.id } : {},
+			yes: args.yes || process.stdin.isTTY !== true
+		};
+		if (!existing) savePlatformInstallChoices(platformInstallCommandArguments({
+			...commandOptions,
+			runtime: args.runtime ? resolve(args.runtime) : "",
+			...args.authConfig ? { authConfig: resolve(args.authConfig) } : {},
+			yes: false
+		}).slice(2), plan.account.name);
+		note(formatPlatformInstallPlan(plan), import_picocolors.default.bold(args.plan ? "Read-only installation plan" : "Installation plan"));
+		note(formatPlatformRuntime(runtime), import_picocolors.default.bold("Platform runtime"));
+		const managementAccess = process.env.VOID_PLATFORM_ACCESS_SETUP_TOKEN ? void 0 : platformManagementAccessForAuthentication(authenticationSelection, accountId, checkpoint);
+		const needsManagementToken = platformOperatorNeedsManagementToken(operatorCredential, plan, managementAccess);
 		if (args.plan) {
-			console.log(formatPlatformSetupPlan(plan));
-			outro("Plan complete. No installation changes were made.");
-			console.log(`\n${import_picocolors$1.default.bold(import_picocolors$1.default.cyan(existing ? "Next step: run this command to resume" : "Next step: run this command to install"))}\n\n${import_picocolors$1.default.cyan(formatPlatformInstallCommand({
-				commandName: cliCommandName(),
-				accountId,
-				installationSlug,
-				displayName,
-				applicationDomain,
-				zoneName,
-				controlPlaneDomain,
-				...args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
-				dedicatedZone,
-				workersDev,
-				authConfig: args.authConfig,
-				authentication: authenticationSelection.authentication,
-				hyperdrive: !existing || isPlatformSetupDraft(existing) ? externalHyperdrive?.id ?? "create" : void 0,
-				runtime: args.runtime,
-				...existing ? { resumeId: existing.id } : {},
-				yes: args.yes || process.stdin.isTTY !== true
-			}))}\n`);
+			note(formatPlatformSetupPlan(plan, {
+				managementToken: needsManagementToken,
+				managementAccess: !!managementAccess
+			}), import_picocolors.default.bold("Required Credentials"));
+			if (!existing) log.info("Plan saved locally for your next install.");
+			outro("Plan complete and ready to execute.");
+			console.log(`\n${import_picocolors.default.bold(existing ? "Next step: run this command to resume" : "Next, run this command to install the platform")}\n\n${import_picocolors.default.blue(formatPlatformInstallCommand(commandOptions))}\n`);
 			return;
 		}
-		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
+		if (!process.stdin.isTTY) assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan, managementAccess);
 		if (process.stdin.isTTY && !args.yes) {
 			const proceed = await confirm({
 				message: "Apply this plan?",
-				initialValue: false
+				initialValue: true
 			});
 			if (isCancel(proceed) || !proceed) {
 				outro("No changes made.");
 				return;
 			}
 		}
+		let managementApiToken = operatorCredential.source === "oauth" ? checkpoint?.managementApiToken || "" : "";
+		if (needsManagementToken || managementApiToken) {
+			let token = managementApiToken;
+			let openedManagementPage = false;
+			const forgetRejectedManagementToken = () => {
+				managementApiToken = "";
+				if (existing && checkpoint?.managementApiToken) {
+					delete checkpoint.managementApiToken;
+					writePendingInstallationSecrets(existing, checkpoint);
+				}
+				token = "";
+			};
+			while (true) {
+				if (!token) {
+					if (!openedManagementPage) {
+						openPlatformSetupPage(platformManagementSetupPage(plan, { access: managementAccess ?? false }));
+						openedManagementPage = true;
+					}
+					token = (await promptSecret("Paste management API token:", true, (value) => value.trim() ? void 0 : "A value is required.")).trim();
+				}
+				const management = new PlatformCloudflareClient(token, { apiBase: client.apiBaseUrl });
+				try {
+					if (!(await management.listAccounts()).some((account) => account.id === accountId)) {
+						forgetRejectedManagementToken();
+						log.warn(`This token cannot access ${plan.account.name}. Check its account scope and try again.`);
+						continue;
+					}
+					const verified = await createPlatformInstallPlan(management, planInput, existing, planOptions);
+					assertPlatformInstallPlanUnchanged(plan, verified, "management API token");
+					if (managementAccess) await verifyPlatformManagementAccess(management, accountId, managementAccess);
+					client = management;
+					plan = verified;
+					managementApiToken = token;
+					break;
+				} catch (error) {
+					if (!isPlatformTokenAuthorizationError(error)) throw error;
+					forgetRejectedManagementToken();
+					log.warn("Cloudflare rejected this token. Check its permissions and account/zone scope, then paste a replacement.");
+				}
+			}
+		} else if (managementAccess) await verifyPlatformManagementAccess(client, accountId, managementAccess);
 		if (!existing) existing = savePlatformSetupDraft(plan, runtime.manifest.platformVersion);
+		removeSavedPlatformInstallPlan({
+			...args,
+			account: accountId,
+			name: installationSlug
+		});
 		const setupManifest = existing;
 		const credentialSetup = isPlatformSetupDraft(existing);
 		const values = { ...checkpoint };
+		if (managementAccess) delete values.accessManagementToken;
+		if (managementApiToken) values.managementApiToken = managementApiToken;
+		if (externalHyperdrive) values.externalHyperdriveJson = JSON.stringify(externalHyperdrive);
+		if (managementApiToken || externalHyperdrive || managementAccess) writePendingInstallationSecrets(setupManifest, values);
 		const saveValues = (updates) => {
 			Object.assign(values, updates);
 			if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
@@ -6733,7 +7565,7 @@ async function runPlatformLifecycleCommand(args) {
 					plan = await verifyPlatformAiGatewayPlan(client, planInput, existing, plan, authoritativeProvisionIntents);
 				}
 			} catch (error) {
-				if (credentialSetup && token === values.cloudflareApiToken && isRuntimeTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
+				if (credentialSetup && token === values.cloudflareApiToken && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
 					delete values.cloudflareApiToken;
 					writePendingInstallationSecrets(setupManifest, values);
 					rejectedSavedRuntimeToken = true;
@@ -6850,6 +7682,20 @@ async function runPlatformLifecycleCommand(args) {
 					accessCredentialsJson: values.accessCredentialsJson
 				};
 			} } : {},
+			...appAccess ? { prepareAppAccess: async () => {
+				progress?.stop("Preparing deployed-app access.");
+				progress = void 0;
+				const setupJson = await prepareInstallationAppAccess({
+					plan,
+					authentication: authenticationSelection,
+					client,
+					managementToken: values.managementApiToken || (operatorCredential.source !== "oauth" ? operatorCredential.token : void 0),
+					checkpoint: values,
+					save: saveAuthenticationValues
+				});
+				progress = startProgress("Continuing platform installation");
+				return setupJson;
+			} } : {},
 			replanWorkers: async (manifest) => (await createPlatformInstallPlan(client, planInput, manifest, {
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
@@ -6859,7 +7705,7 @@ async function runPlatformLifecycleCommand(args) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CnyTdcWX.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DG47jys8.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -6874,12 +7720,12 @@ async function runPlatformLifecycleCommand(args) {
 		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused. Progress is saved." : "Platform installed.");
 		progress = void 0;
 		if (result.waitingForDns) {
-			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, "Waiting for nameservers");
+			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, import_picocolors.default.bold("Waiting for nameservers"));
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
 		if (result.waitingForSandboxDrain) {
-			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`. Follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", "Waiting for managed Sandbox drain");
+			note("The compatible candidate runtime is live in sandbox-drain maintenance mode and application traffic remains disabled. Preview bounded work with `void platform system sandbox-drain --plan`. Follow any returned `nextCursor` with `--cursor '<value>'`. Then apply with `void platform system sandbox-drain --yes` and rerun until it reports DB-backed `complete: true`. Rerun this install command afterward to enable traffic.", import_picocolors.default.bold("Waiting for managed Sandbox drain"));
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
@@ -6907,16 +7753,16 @@ async function runPlatformLifecycleCommand(args) {
 		}
 	}
 }
-function isRuntimeTokenAuthorizationError(error, requestPathIncludes) {
+function isPlatformTokenAuthorizationError(error, requestPathIncludes) {
 	for (let depth = 0; depth < 5 && error instanceof Error; depth++, error = error.cause) if (error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status) && (!requestPathIncludes || error.requestPath?.includes(requestPathIncludes))) return true;
 	return false;
 }
 function formatPlatformRuntime(runtime) {
 	return [
-		`${import_picocolors$1.default.bold("Version:")} ${runtime.manifest.platformVersion}`,
-		`${import_picocolors$1.default.bold("Source:")} ${runtime.source}`,
-		`${import_picocolors$1.default.bold("Revision:")} ${runtime.manifest.sourceRevision ?? "not recorded"}`,
-		`${import_picocolors$1.default.bold("Manifest SHA-256:")} ${runtime.manifestSha256}`
+		`${import_picocolors.default.bold("Version:")} ${runtime.manifest.platformVersion}`,
+		`${import_picocolors.default.bold("Source:")} ${runtime.source}`,
+		`${import_picocolors.default.bold("Revision:")} ${runtime.manifest.sourceRevision ?? "not recorded"}`,
+		`${import_picocolors.default.bold("Manifest SHA-256:")} ${runtime.manifestSha256}`
 	].join("\n");
 }
 async function verifyPlatformAiGatewayPlan(client, input, existing, preview, authoritativeProvisionIntents) {
@@ -6932,6 +7778,10 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
 		throw error;
 	}
+	assertPlatformInstallPlanUnchanged(preview, verified, "AI Gateway access");
+	return verified;
+}
+function assertPlatformInstallPlanUnchanged(preview, verified, check) {
 	const infrastructure = (plan) => plan.actions.filter((action) => action.kind !== "ai-gateway").map(({ action, id, key, kind, name }) => ({
 		action,
 		id,
@@ -6939,8 +7789,7 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 		kind,
 		name
 	}));
-	if (verified.installationId !== preview.installationId || JSON.stringify(verified.deployment) !== JSON.stringify(preview.deployment) || JSON.stringify(infrastructure(verified)) !== JSON.stringify(infrastructure(preview))) throw new Error("platform: Resources changed while checking AI Gateway access. Rerun the command to review the updated plan. No platform resources were created.");
-	return verified;
+	if (verified.installationId !== preview.installationId || JSON.stringify(verified.deployment) !== JSON.stringify(preview.deployment) || JSON.stringify(infrastructure(verified)) !== JSON.stringify(infrastructure(preview))) throw new Error(`platform: Resources changed while checking ${check}. Rerun the command to review the updated plan. No platform resources were created.`);
 }
 function assertNoninteractivePlatformMutationAcknowledged(args, interactive) {
 	if (args.subcommand === "list" || args.subcommand === "use" || args.subcommand === "status" || args.subcommand === "discover" || args.plan || interactive || args.yes) return;
@@ -6954,7 +7803,8 @@ async function readAccounts(client) {
 async function selectAccount(accounts, selector) {
 	if (selector) {
 		const matches = accounts.filter((account) => account.id === selector || account.name.toLowerCase() === selector.toLowerCase());
-		if (matches.length !== 1) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is ambiguous or unavailable.`);
+		if (matches.length === 0) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is unavailable through the current access token. Run ${import_picocolors.default.blue("void cloudflare status")} to see which accounts have access, and re-authenticate if necessary.`);
+		if (matches.length > 1) throw new Error(`platform: Cloudflare account ${JSON.stringify(selector)} is ambiguous. Use --account <id> to select a specific account.`);
 		return matches[0].id;
 	}
 	if (accounts.length === 1) return accounts[0].id;
@@ -6975,10 +7825,17 @@ async function promptText(message, value, optional = false, validate) {
 		if (optional) return "";
 		throw new Error(`platform: ${message.replace(/:$/, "")} is required in non-interactive mode.`);
 	}
+	const defaultValue = typeof value === "string" ? value : void 0;
 	const input = await text$1({
 		message,
-		...typeof value === "string" ? { initialValue: value } : value,
-		validate: (input) => input ? validate?.(input) : optional ? void 0 : "A value is required."
+		...typeof value === "string" ? {
+			placeholder: value,
+			defaultValue
+		} : value,
+		validate: (input) => {
+			const candidate = input || defaultValue;
+			return candidate ? validate?.(candidate) : optional ? void 0 : "A value is required.";
+		}
 	});
 	if (isCancel(input) || typeof input === "symbol") throw new Error("platform: Cancelled.");
 	return input;