void 0.25.0 → 0.26.0

package/dist/{platform-lifecycle-Dm09JNkn.mjs → platform-lifecycle-Cfi0o6xM.mjs}

@@ -1,14 +1,14 @@
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { _ as savePlatformConnection, a as listInstallationManifests, b as writePendingInstallationSecrets, d as promoteInstallationSecrets, f as readInstallationRecoverySecrets, g as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformRegistryDirectory, n as assertPlatformInstallationSlugAvailable, p as readPendingInstallationSecrets, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as platformWorkerSecretUpdateIntentState, y as writeInstallationManifest } from "./platform-registry-KfNEF84O.mjs";
+import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-P387v42A.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-AHKBzmuu.mjs";
-import { u as openBrowser } from "./auth-7wuZ5ob8.mjs";
-import { A as confirm, B as note, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./prompts-6OSVA7DJ.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-YTlqvAsk.mjs";
+import { u as openBrowser } from "./auth-D52yG7hl.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./prompts-6OSVA7DJ.mjs";
 import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
-import { c as import_picocolors, n as cliCommandName, r as createSpinner } from "./output-BBsUwdyT.mjs";
+import { c as import_picocolors, l as note, n as cliCommandName, r as createSpinner } from "./output-BvdaehtE.mjs";
 import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-Btj1jppf.mjs";
-import { t as parsePlatformArgs } from "./platform-args-Bzf8JPc2.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-VeqAC77A.mjs";
+import { t as parsePlatformArgs } from "./platform-args-DSV2p4nY.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -116,7 +116,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		} catch {
 			throw new PlatformCloudflareApiError(`Cloudflare returned a non-JSON response (HTTP ${response.status}).`, response.status, path.split("?")[0]);
 		}
-		if (!response.ok || envelope.success !== true || envelope.result === void 0) throw new PlatformCloudflareApiError(`Cloudflare API error: ${envelope.errors?.map((error) => error.message).filter(Boolean).join(", ") || `HTTP ${response.status}`} (HTTP ${response.status}; ${init?.method ?? "GET"} ${path.split("?")[0]}).`, response.status, path.split("?")[0]);
+		if (!response.ok || envelope.success !== true || envelope.result === void 0) throw new PlatformCloudflareApiError(`Cloudflare API error: ${cloudflareErrorDetails(envelope, response.status)} (HTTP ${response.status}; ${init?.method ?? "GET"} ${path.split("?")[0]}).`, response.status, path.split("?")[0]);
 		return {
 			result: envelope.result,
 			resultInfo: envelope.result_info
@@ -157,6 +157,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			if (result.length < 50) break;
 		}
 		return entries.map((entry) => ({
+			...withCreatedAt(entry.created_at),
 			id: requiredString(entry.id, "AI Gateway id"),
 			name: requiredString(entry.id, "AI Gateway id")
 		}));
@@ -548,7 +549,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			throw error;
 		}
 	}
-	async emptyR2Bucket(accountId, bucketName, preservedKeys = /* @__PURE__ */ new Set()) {
+	async emptyR2Bucket(accountId, bucketName, preservedKeys = /* @__PURE__ */ new Set(), beforeDelete) {
 		let cursor = "";
 		const observedCursors = /* @__PURE__ */ new Set();
 		for (;;) {
@@ -565,6 +566,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			const envelope = await response.json();
 			if (!response.ok || envelope.success !== true || !Array.isArray(envelope.result)) throw new PlatformCloudflareApiError(`Cloudflare API error listing R2 objects: ${envelope.errors?.map((error) => error.message).filter(Boolean).join(", ") || `HTTP ${response.status}`}`, response.status);
 			const keys = envelope.result.map((object) => requiredString(object.key, "R2 object key")).filter((key) => !preservedKeys.has(key));
+			if (keys.length > 0) await beforeDelete?.();
 			for (let offset = 0; offset < keys.length; offset += 1e3) await this.deleteR2Objects(accountId, bucketName, keys.slice(offset, offset + 1e3));
 			const nextCursor = envelope.result_info?.cursor ?? "";
 			if (!nextCursor) return;
@@ -582,18 +584,141 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		const deletedKeys = new Set(deleted.map((entry) => requiredString(entry.key, "deleted R2 object key")));
 		if (keys.find((key) => !deletedKeys.has(key)) !== void 0) throw new Error("platform: Cloudflare did not confirm every requested R2 object deletion.");
 	}
-	async deleteResource(accountId, kind, id, zoneId) {
+	async deleteResource(accountId, resource, zoneId) {
+		const { kind } = resource;
+		if (kind === "ai-gateway" && this.#aiGatewayClient) return this.#aiGatewayClient.deleteResource(accountId, resource, zoneId);
 		const account = encodeURIComponent(accountId);
-		const encoded = encodeURIComponent(id);
+		const encoded = encodeURIComponent(kind === "dispatch-namespace" || kind === "worker" ? resource.name : resource.id);
 		const path = kind === "kv-namespace" ? `/accounts/${account}/storage/kv/namespaces/${encoded}` : kind === "dns-record" ? zoneId ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}` : null : kind === "ai-gateway" ? `/accounts/${account}/ai-gateway/gateways/${encoded}` : kind === "r2-bucket" ? `/accounts/${account}/r2/buckets/${encoded}` : kind === "queue" ? `/accounts/${account}/queues/${encoded}` : kind === "dispatch-namespace" ? `/accounts/${account}/workers/dispatch/namespaces/${encoded}` : kind === "hyperdrive" ? `/accounts/${account}/hyperdrive/configs/${encoded}` : kind === "worker" ? `/accounts/${account}/workers/scripts/${encoded}` : kind === "zone" ? `/zones/${encoded}` : null;
 		if (!path) throw new Error(`platform: Unsupported Cloudflare deletion kind ${kind}.`);
+		await this.#deleteIfPresent(path);
+	}
+	/**
+	* DELETE one resource by the key Cloudflare addresses it with. Only
+	* `forceDeleteWorker` sends `force`; otherwise Cloudflare refuses a
+	* resource another Worker still uses. A 404 means it is already gone.
+	*/
+	async #deleteIfPresent(path) {
+		const response = await this.#fetcher(`${this.apiBaseUrl}${path}`, {
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${this.#token}`
+			},
+			method: "DELETE",
+			redirect: "manual",
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (response.status === 404) return;
+		let envelope = {};
+		try {
+			envelope = await response.json();
+		} catch {
+			envelope = { success: response.ok };
+		}
+		if (!response.ok || envelope.success !== true) throw new PlatformCloudflareApiError(`Cloudflare API error: ${cloudflareErrorDetails(envelope, response.status)} (HTTP ${response.status}; DELETE ${path}).`, response.status, path);
+	}
+	async deleteWorkerRoute(zoneId, routeId) {
+		await this.#deleteIfPresent(`/zones/${encodeURIComponent(zoneId)}/workers/routes/${encodeURIComponent(routeId)}`);
+	}
+	async deleteWorkerDomain(accountId, domainId) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/domains/${encodeURIComponent(domainId)}`);
+	}
+	async listQueueConsumers(accountId, queueId) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/queues/${encodeURIComponent(queueId)}/consumers`)).map((entry) => ({
+			id: requiredString(entry.consumer_id, "Queue consumer id"),
+			script: entry.type === "http_pull" ? null : requiredString(entry.script_name ?? entry.script ?? entry.service, "Queue consumer Worker name")
+		}));
+	}
+	async listWorkerDependents(accountId, workerName) {
+		const account = encodeURIComponent(accountId);
+		const script = encodeURIComponent(workerName);
+		const references = await this.request(`/accounts/${account}/workers/scripts/${script}/references`);
+		const tails = await this.request(`/accounts/${account}/workers/tails/by-consumer/${script}`);
+		const name = (reference) => requiredString(reference?.script ?? reference?.service, "Dependent Worker name");
+		const workers = [
+			...(references.services?.incoming ?? []).map(name),
+			...(references.durable_objects ?? []).map(name).filter((entry) => entry !== workerName),
+			...(references.dispatch_outbounds ?? []).map(name),
+			...tails.map((tail) => name(tail.producer))
+		];
+		return {
+			pagesFunction: references.services?.pages_function === true,
+			workers: [...new Set(workers)]
+		};
+	}
+	/**
+	* DELETE a Worker even though other Workers still bind to it. Cloudflare
+	* leaves those bindings pointing at nothing, so callers first check that
+	* every dependent is going away too.
+	*/
+	async forceDeleteWorker(accountId, workerName) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}?force=true`);
+	}
+	async deleteQueueConsumer(accountId, queueId, consumerId) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/queues/${encodeURIComponent(queueId)}/consumers/${encodeURIComponent(consumerId)}`);
+	}
+	async listDispatchNamespaceScripts(accountId, namespace) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts`)).map((entry) => requiredString(entry.id, "Dispatch namespace script name"));
+	}
+	async deleteDispatchNamespaceScript(accountId, namespace, scriptName) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(scriptName)}`);
+	}
+	/** Read one Access application or service token; null when it is gone. */
+	async getAccessResource(accountId, kind, id) {
 		try {
-			await this.request(path, { method: "DELETE" });
+			const result = await this.request(accessResourcePath(accountId, kind, id));
+			return {
+				id: requiredString(result.id, "Access resource id"),
+				name: requiredString(result.name, "Access resource name")
+			};
 		} catch (error) {
-			if (error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
+			throw error;
+		}
+	}
+	async deleteAccessResource(accountId, kind, id) {
+		await this.#deleteIfPresent(accessResourcePath(accountId, kind, id));
+	}
+	/** Email Routing rules in a zone, without the catch-all, which has its own endpoint. */
+	async listEmailRoutingRules(zoneId) {
+		const entries = [];
+		for (let page = 1;; page++) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: "50"
+			});
+			const result = await this.request(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules?${query}`);
+			entries.push(...result);
+			if (result.length < 50) break;
+		}
+		return entries.filter((entry) => !(Array.isArray(entry.matchers) ? entry.matchers : []).some((matcher) => matcher?.type === "all")).map((entry) => ({
+			id: requiredString(entry.id ?? entry.tag, "Email Routing rule id"),
+			...parseEmailRoutingTarget(entry)
+		}));
+	}
+	async deleteEmailRoutingRule(zoneId, ruleId) {
+		await this.#deleteIfPresent(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules/${encodeURIComponent(ruleId)}`);
+	}
+	/** The zone's Email Routing catch-all rule; null when the zone has none. */
+	async getEmailRoutingCatchAll(zoneId) {
+		try {
+			return parseEmailRoutingTarget(await this.request(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules/catch_all`));
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
 			throw error;
 		}
 	}
+	/** Point the catch-all back at its disabled default, which drops mail. */
+	async resetEmailRoutingCatchAll(zoneId) {
+		await this.request(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules/catch_all`, {
+			method: "PUT",
+			body: JSON.stringify({
+				matchers: [{ type: "all" }],
+				actions: [{ type: "drop" }],
+				enabled: false
+			})
+		});
+	}
 	async removeRoutes(_accountId, _zoneId, tracked) {
 		if (tracked.routes.length > 0 || tracked.customDomains.length > 0) throw new Error("platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.");
 	}
@@ -613,9 +738,34 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		}
 	}
 };
+function accessResourcePath(accountId, kind, id) {
+	return `/accounts/${encodeURIComponent(accountId)}/access/${kind === "application" ? "apps" : "service_tokens"}/${encodeURIComponent(id)}`;
+}
+function parseEmailRoutingTarget(rule) {
+	const actions = Array.isArray(rule.actions) ? rule.actions : [];
+	const action = actions.length === 1 ? actions[0] : null;
+	const value = Array.isArray(action?.value) ? action.value : [];
+	return {
+		enabled: rule.enabled === true,
+		workerName: action?.type === "worker" && value.length === 1 && typeof value[0] === "string" ? value[0] : null
+	};
+}
+function cloudflareErrorDetails(envelope, status) {
+	return envelope.errors?.filter((error) => error.message).map((error) => error.code === void 0 ? error.message : `${error.message} (code ${error.code})`).join(", ") || `HTTP ${status}`;
+}
 function encodeR2ObjectKey(key) {
 	return key.split("/").map(encodeURIComponent).join("/");
 }
+/**
+* An AI Gateway creation time as ISO 8601 UTC. Cloudflare reports it without a
+* zone ("2026-10-05 18:29:14"), which JavaScript would read as local time.
+*/
+function withCreatedAt(value) {
+	if (typeof value !== "string") return {};
+	const zoneless = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(?:\.\d+)?$/.test(value);
+	const time = Date.parse(zoneless ? `${value.replace(" ", "T")}Z` : value);
+	return Number.isNaN(time) ? {} : { createdAt: new Date(time).toISOString() };
+}
 function requiredString(value, label) {
 	if (typeof value !== "string" || value === "") throw new Error(`platform: ${label} is missing from the Cloudflare response.`);
 	return value;
@@ -1203,14 +1353,26 @@ function platformAccountTokenPermissions(includeAiGateway) {
 		}] : []
 	];
 }
+/**
+* Account token links cannot preselect a zone: Cloudflare documents only
+* `permissionGroupKeys` and `name`, and the form puts zone permissions in an
+* "All Domains" policy. Tell the user which dashboard choice to change.
+*/
+function specifiedDomainsInstruction(zones) {
+	return `Change the zone policy from All Domains to Specified Domains → ${zones.join(" and ")}.`;
+}
+function plansZoneCreation(plan) {
+	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+}
 function platformManagementSetupPage(plan, options = {}) {
-	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+	const createsZone = plansZoneCreation(plan);
 	const zoneName = plan.deployment.application.zoneName;
 	const apiHostname = plan.deployment.controlPlane.apiHostname;
 	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
 		protection: !!plan.deployment.authentication.accessProtection,
 		readOnly: false
 	} : void 0);
+	const zones = [...zoneName ? [zoneName] : [], ...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`the zone for ${apiHostname}`] : []];
 	const accessLevel = access && access.readOnly ? "read" : "edit";
 	const appAccess = !!plan.deployment.appAccess;
 	const appAccessLevel = appAccess ? "edit" : accessLevel;
@@ -1259,8 +1421,8 @@ function platformManagementSetupPage(plan, options = {}) {
 		}),
 		instructions: [
 			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
-			`Scope it to ${plan.account.name}${createsZone ? "; allow zone creation." : zoneName ? ` and zone ${zoneName}.` : "."}`,
-			...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`Also include the zone for ${apiHostname}.`] : []
+			`Scope it to ${plan.account.name}.`,
+			...createsZone ? [`Keep the zone policy on All Domains so Void can create ${zoneName}.`] : zones.length ? [specifiedDomainsInstruction(zones)] : []
 		].join("\n")
 	};
 }
@@ -1298,6 +1460,7 @@ function platformSetupPages(plan) {
 			}
 		] : []
 	];
+	const zoneName = plan.deployment.application.zoneName;
 	return {
 		runtime: {
 			title: "Cloudflare runtime token",
@@ -1307,7 +1470,7 @@ function platformSetupPages(plan) {
 				name: plan.deployment.displayName + " Runtime",
 				permissionGroupKeys: JSON.stringify(permissions)
 			}),
-			instructions: "Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here."
+			instructions: ["Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.", ...zoneName && plansZoneCreation(plan) ? [`Keep the zone policy on All Domains so the token can purge cache on ${zoneName} after Void creates it.`] : zoneName ? [specifiedDomainsInstruction([zoneName, ...plan.deployment.capabilities.email ? ["every zone that will carry mail"] : []])] : []].join("\n")
 		},
 		github: {
 			title: "GitHub OAuth App",
@@ -1746,6 +1909,28 @@ async function preparePlatformAccessSetup(input) {
 }
 //#endregion
 //#region src/cli/platform-auth.ts
+/** Use the selected credential for read-only checks before taking lifecycle locks. */
+async function verifyPlatformCloudflareCredential(client, input) {
+	const source = input.source === "saved" ? "saved management token" : input.source === "environment" ? "environment API token" : "Cloudflare browser login";
+	const retry = input.source === "oauth" ? "Run `void cloudflare login`, or set CLOUDFLARE_API_TOKEN for this account, then retry." : "Set CLOUDFLARE_API_TOKEN for this account, then retry.";
+	const check = async (label, permission, action, allowMissing = false) => {
+		try {
+			await action();
+		} catch (cause) {
+			const status = cause instanceof PlatformCloudflareApiError ? cause.status : null;
+			if (status === 404 && allowMissing) return;
+			const detail = status === 401 || status === 403 ? `Check that the credential is valid, scoped to this account, and includes ${permission}. ${retry}` : status === 404 ? "Check the bucket name and account scope before retrying." : status === 429 ? "Cloudflare rate-limited this check. Retry shortly." : "Retry the command after Cloudflare connectivity is restored.";
+			throw new Error(`platform: ${label} is unavailable${status === null ? "" : ` (HTTP ${status})`} using the ${source}. ${detail}`, { cause });
+		}
+	};
+	let accounts = [];
+	await check("Cloudflare account access", "Account → Account Settings → Read", async () => {
+		accounts = await client.listAccounts();
+	});
+	if (!accounts.some((account) => account.id === input.account.id)) throw new Error(`platform: The ${source} cannot access Cloudflare account ${JSON.stringify(input.account.name)} (${input.account.id}). ${retry}`);
+	await check("Cloudflare Workers access", "Account → Workers Scripts → Edit", () => client.listWorkerNames(input.account.id));
+	for (const name of new Set(input.r2Buckets)) await check(`R2 bucket ${JSON.stringify(name)}`, "Account → Workers R2 Storage → Edit", () => client.request(`/accounts/${encodeURIComponent(input.account.id)}/r2/buckets/${encodeURIComponent(name)}`), input.allowMissingR2Buckets);
+}
 /** Check Access inventory permissions before the installer starts provisioning. */
 async function verifyPlatformManagementAccess(client, accountId, access) {
 	const base = `/accounts/${encodeURIComponent(accountId)}/access`;
@@ -2516,7 +2701,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		client.listHyperdriveConfigs(account.id),
 		client.listWorkerNames(account.id)
 	]);
-	const dnsRecords = zone ? await client.listDnsRecords(zone.id, wildcardHostname) : [];
+	const dnsRecords = zone ? await listZoneDnsRecords(client, zone, wildcardHostname) : [];
 	const remoteOwnership = existing ? await readRemoteOwnership(client, account.id, routingKv, existing) : null;
 	const intentProofs = /* @__PURE__ */ new Set();
 	const ambiguousResources = /* @__PURE__ */ new Set();
@@ -2560,7 +2745,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		const matchingDomain = workerDomains.find((domain) => domain.hostname === apiHostname);
 		const expectedWorker = deployment.resources.apiWorker;
 		if (matchingDomain && matchingDomain.service !== expectedWorker) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} is already assigned to Worker ${JSON.stringify(matchingDomain.service)}. Choose another hostname.`);
-		const records = controlPlaneZone ? await client.listDnsRecords(controlPlaneZone.id, apiHostname) : [];
+		const records = controlPlaneZone ? await listZoneDnsRecords(client, controlPlaneZone, apiHostname) : [];
 		const ownedApiWorker = intentProofs.has("api-worker") || existing?.resources.some((resource) => resource.key === "api-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
 		if (records.length > 0 && (!matchingDomain || !ownedApiWorker)) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} already has a DNS record that installation would replace. Choose another hostname or remove the record explicitly.`);
 	}
@@ -2926,6 +3111,14 @@ function platformAdoptionIntentHash(manifest, key, kind, id, name) {
 		ownershipNonce: manifest.ownershipNonce
 	})).digest("hex");
 }
+async function listZoneDnsRecords(client, zone, hostname) {
+	try {
+		return await client.listDnsRecords(zone.id, hostname);
+	} catch (error) {
+		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403)) throw new Error(`platform: Cloudflare denied reading DNS records for ${zone.name} (HTTP ${error.status}). Add Zone → DNS → Edit for this zone to the management token, then rerun.`, { cause: error });
+		throw error;
+	}
+}
 async function readRemoteOwnership(client, accountId, routingNamespaces, existing) {
 	for (const namespace of routingNamespaces) {
 		const value = await client.getKvValue(accountId, namespace.id, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY);
@@ -2991,6 +3184,22 @@ function trafficConfigHash(kind, value) {
 		value
 	})).digest("hex");
 }
+/**
+* The installer Worker that a recorded route or custom domain serves, when the
+* record matches exactly what the installer publishes for this deployment.
+*/
+function platformTrafficAttachmentWorker(deployment, resource) {
+	const managed = platformManagedWorkerTraffic(deployment);
+	if (resource.kind === "worker-route") {
+		const target = managed.routes.find((route) => route.pattern === resource.name);
+		return target && trafficConfigHash("worker-route", target) === resource.configHash ? target.script : null;
+	}
+	if (resource.kind === "worker-custom-domain") {
+		const target = managed.customDomains.find((domain) => domain.hostname === resource.name);
+		return target && trafficConfigHash("worker-custom-domain", target) === resource.configHash ? target.service : null;
+	}
+	return null;
+}
 function trackedPlatformWorkerTraffic(_manifest, _workers) {
 	return {
 		customDomains: [],
@@ -3662,7 +3871,7 @@ async function runPlatformWrangler(operation, accountId, cwd, capture) {
 	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
 }
 const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
+async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false, apiToken) {
 	const startedAt = performance.now();
 	const result = await createDefaultRunWrangler(process.cwd(), {
 		launcher: resolveCloudflareOperationArgv(process.cwd()),
@@ -3671,6 +3880,7 @@ async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture,
 	})(operation, {
 		accountId,
 		apiBaseUrl,
+		apiToken,
 		cwd
 	});
 	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
@@ -3802,8 +4012,8 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
 	return result;
 }
-async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
-	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
+async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl, apiToken) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl, false, apiToken), upstreamApiBaseUrl);
 }
 //#endregion
 //#region src/cli/platform-installer-inspection.ts
@@ -4563,7 +4773,7 @@ async function deployPlatformWorker(config, secrets, options) {
 		let uploaded;
 		let uploadError;
 		try {
-			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl);
+			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl, options.operatorApiToken);
 			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
 		} catch (error) {
 			uploadError = error;
@@ -5082,7 +5292,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DFeJ-JkK.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DcbL_LW_.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -5343,6 +5553,605 @@ function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
 	}
 }
 //#endregion
+//#region src/cli/platform-teardown.ts
+/**
+* `void platform uninstall --purge-resources` deletes every Cloudflare resource the
+* installation created, in an order Cloudflare accepts:
+*
+*   traffic (routes, custom domains, DNS) -> Access -> Email Routing rules
+*   -> queue consumers -> Workers except tail -> Queues -> dispatch namespace
+*   -> tail Worker -> Hyperdrive and KV -> R2 -> AI Gateway -> routing KV (last)
+*
+* Each resource is proven to belong to this installation right before its
+* DELETE, and Cloudflare refuses a resource that something outside the
+* installation still uses. The only forced DELETE is for a platform Worker
+* that Cloudflare refused while every Worker it names as a dependent is one
+* this installation created: the API and proxy Workers bind to each other, so
+* neither can go first without it. A route, custom domain, DNS
+* record, or Access resource that no longer matches what was recorded is kept
+* and listed with the reason instead of stopping the run. Every finished
+* deletion is checkpointed, so rerunning the command continues where it
+* stopped. The routing KV namespace holds that checkpoint, so uninstall
+* deletes it last.
+*
+* An uninstall without --purge-resources records what it leaves as retained. If it
+* stopped before it finished, --purge-resources considers those resources again.
+*/
+const PURGE_RESOURCES_STEP_PREFIX = "uninstall:purge-resources:";
+const WORKER_ORDER = [
+	"email-gateway-worker",
+	"proxy-worker",
+	"dispatch-worker",
+	"api-worker"
+];
+const PERMISSIONS = {
+	access: "Account → Access: Apps and Policies → Edit",
+	aiGateway: "Account → AI Gateway → Edit",
+	dns: "Zone → DNS → Edit",
+	emailRouting: "Zone → Email Routing Rules → Edit",
+	hyperdrive: "Account → Hyperdrive → Edit",
+	kv: "Account → Workers KV Storage → Edit",
+	queues: "Account → Queues → Edit",
+	r2: "Account → Workers R2 Storage → Edit",
+	routes: "Zone → Workers Routes → Edit",
+	serviceTokens: "Account → Access: Service Tokens → Edit",
+	workers: "Account → Workers Scripts → Edit"
+};
+function isPlatformTailWorker(manifest, resource) {
+	return resource.kind === "worker" && (resource.key === "tail-worker" || resource.name === manifest.deployment.resources.tailWorker);
+}
+function purgeResourcesResumeCommand(manifest) {
+	return `void platform uninstall ${manifest.id} --purge-resources`;
+}
+function accessStepKey(access) {
+	return `${PURGE_RESOURCES_STEP_PREFIX}access:${access.key}`;
+}
+/** Access resources that --purge-resources already deleted. */
+function isPurgedAccessResource(manifest, access) {
+	return manifest.steps.some((step) => step.key === accessStepKey(access));
+}
+function hasStep(manifest, key) {
+	return manifest.steps.some((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${key}`);
+}
+function keptStepKey(key) {
+	return `kept:${key}`;
+}
+/**
+* Why --purge-resources kept a resource it was going to delete, for example because
+* a route now serves another Worker; null when it did not keep it. Access
+* resources use the key `access:<key>`.
+*/
+function purgeResourcesKeptReason(manifest, key) {
+	return manifest.steps.find((step) => step.key === `uninstall:purge-resources:${keptStepKey(key)}`)?.resultHash ?? null;
+}
+/** An uninstall that started has not finished, so what it kept can be reconsidered. */
+function isReopenable(manifest) {
+	return manifest.status !== "uninstalled";
+}
+/**
+* A resource the installation created that --purge-resources may still delete: one
+* that is ready, or one that an uninstall which stopped before it finished
+* recorded as retained. Resources --purge-resources itself kept, and earlier
+* versions of a resource kept when it was replaced, are never reconsidered.
+*/
+function isPurgeResourcesCandidate(manifest, resource) {
+	return resource.ownership === "created" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest) && !resource.key.startsWith("retained:") && purgeResourcesKeptReason(manifest, resource.key) === null);
+}
+/** The zone that routes and DNS records live in, if it can still be used. */
+function usableZone(manifest) {
+	return manifest.resources.find((resource) => resource.key === "zone" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest)));
+}
+/**
+* A recorded resource whose live configuration no longer matches the
+* installation's record. --purge-resources keeps such a DNS record and continues.
+*/
+var PlatformResourceChangedError = class extends Error {
+	resourceKey;
+	reason;
+	constructor(resourceKey, reason, message) {
+		super(message);
+		this.resourceKey = resourceKey;
+		this.reason = reason;
+		this.name = "PlatformResourceChangedError";
+	}
+};
+/** The zone whose Email Routing rules may send mail to the gateway Worker. */
+function emailRoutingZone(manifest) {
+	return manifest.deployment.capabilities.email ? manifest.deployment.emailSharedZoneId ?? null : null;
+}
+/** Everything --purge-resources will delete, in deletion order. */
+function purgeResourcesTargets(manifest) {
+	const resources = manifest.resources;
+	const routing = resources.find((resource) => resource.key === "routing-kv");
+	const candidate = (resource) => isPurgeResourcesCandidate(manifest, resource);
+	if (!routing || routing.state !== "ready" && !candidate(routing)) return [];
+	const zone = usableZone(manifest);
+	const workers = resources.filter((resource) => resource.kind === "worker" && candidate(resource));
+	const targets = [];
+	for (const resource of resources) {
+		if (resource.kind !== "worker-route" && resource.kind !== "worker-custom-domain" || resource.state !== "ready" && resource.state !== "retained" || resource.kind === "worker-route" && !zone || purgeResourcesKeptReason(manifest, resource.key) !== null) continue;
+		const name = platformTrafficAttachmentWorker(manifest.deployment, resource);
+		const worker = workers.find((entry) => entry.name === name);
+		if (worker) targets.push({
+			phase: "traffic",
+			resource,
+			worker
+		});
+	}
+	for (const resource of resources) if (resource.kind === "dns-record" && candidate(resource) && zone) targets.push({
+		phase: "dns",
+		resource
+	});
+	const access = (manifest.authenticationResources ?? []).filter((entry) => entry.ownership === "created" && !isPurgedAccessResource(manifest, entry) && purgeResourcesKeptReason(manifest, `access:${entry.key}`) === null);
+	for (const kind of ["application", "service-token"]) for (const entry of access.filter((candidate) => candidate.kind === kind)) targets.push({
+		phase: "access",
+		access: entry
+	});
+	const gateway = workers.find((worker) => worker.key === "email-gateway-worker");
+	if (gateway && emailRoutingZone(manifest) && !hasStep(manifest, "email-routing")) targets.push({
+		phase: "email",
+		resource: gateway
+	});
+	const queues = resources.filter((resource) => resource.kind === "queue" && candidate(resource));
+	for (const resource of queues) if (!hasStep(manifest, `consumers:${resource.key}`)) targets.push({
+		phase: "queue-consumers",
+		resource
+	});
+	const rank = (resource) => {
+		const index = WORKER_ORDER.indexOf(resource.key);
+		return index < 0 ? WORKER_ORDER.length : index;
+	};
+	for (const resource of workers.filter((worker) => !isPlatformTailWorker(manifest, worker)).sort((left, right) => rank(left) - rank(right) || left.key.localeCompare(right.key))) targets.push({
+		phase: "workers",
+		resource
+	});
+	for (const resource of queues) targets.push({
+		phase: "queues",
+		resource
+	});
+	for (const resource of resources) if (resource.kind === "dispatch-namespace" && candidate(resource)) targets.push({
+		phase: "dispatch",
+		resource
+	});
+	for (const resource of workers.filter((worker) => isPlatformTailWorker(manifest, worker))) targets.push({
+		phase: "tail",
+		resource
+	});
+	for (const kind of ["hyperdrive", "kv-namespace"]) for (const resource of resources) if (resource.kind === kind && resource.key !== "routing-kv" && candidate(resource)) targets.push({
+		phase: "data",
+		resource
+	});
+	for (const kind of ["r2-bucket", "ai-gateway"]) for (const resource of resources) if (resource.kind === kind && candidate(resource)) targets.push({
+		phase: kind === "r2-bucket" ? "r2" : "ai-gateway",
+		resource
+	});
+	if (candidate(routing)) targets.push({
+		phase: "routing",
+		resource: routing
+	});
+	return targets;
+}
+/** Whether --purge-resources removes, or has removed, the rules that send mail to the gateway Worker. */
+function purgeResourcesHandlesEmailRouting(manifest) {
+	return hasStep(manifest, "email-routing") || purgeResourcesTargets(manifest).some((target) => target.phase === "email");
+}
+/** Manifest resources that --purge-resources leaves in the account. */
+function purgeResourcesKeptResources(manifest) {
+	const targets = new Set(purgeResourcesTargets(manifest).flatMap((target) => "resource" in target ? [target.resource.key] : []));
+	return manifest.resources.filter((resource) => (resource.state === "ready" || resource.state === "retained") && !targets.has(resource.key));
+}
+function resourceLabel(resource) {
+	return `${resource.kind}: ${resource.name}${resource.name === resource.id ? "" : ` (${resource.id})`}`;
+}
+/** Plan lines for --purge-resources: what is deleted, in order, then what is kept. */
+function describePurgeResourcesPlan(manifest) {
+	const targets = purgeResourcesTargets(manifest);
+	const lines = [];
+	let step = 0;
+	let previous = null;
+	const consumerQueues = [];
+	for (const target of targets) {
+		if (target.phase === "email") {
+			step++;
+			previous = target.phase;
+			lines.push(`  ${step}. Email Routing rules in zone ${emailRoutingZone(manifest)} that send mail to ${target.resource.name}, and its catch-all rule if it does (reset to drop mail, disabled)`);
+			continue;
+		}
+		if (target.phase !== previous) {
+			step++;
+			previous = target.phase;
+		}
+		const prefix = `  ${step}. `;
+		if (target.phase === "traffic") lines.push(`${prefix}${resourceLabel(target.resource)} -> ${target.worker.name}`);
+		else if (target.phase === "access") lines.push(`${prefix}Access ${target.access.kind}: ${target.access.name} (${target.access.id})`);
+		else if (target.phase === "queue-consumers") {
+			consumerQueues.push(target.resource.name);
+			if (consumerQueues.length === 1) lines.push(`${prefix}queue consumers run by this installation's Workers on:`);
+			lines.push(`       ${target.resource.name}`);
+		} else if (target.phase === "dispatch") lines.push(`${prefix}${resourceLabel(target.resource)}, with any application Workers still in it`);
+		else if (target.phase === "tail") lines.push(`${prefix}${resourceLabel(target.resource)}, the tail Worker, after the others`);
+		else if (target.phase === "workers" && target.resource.key === "api-worker") lines.push(`${prefix}${resourceLabel(target.resource)}, with its Durable Object data`);
+		else if (target.phase === "r2") lines.push(`${prefix}${resourceLabel(target.resource)}, emptied first`);
+		else if (target.phase === "ai-gateway") lines.push(`${prefix}${resourceLabel(target.resource)}, if Cloudflare shows it was created during installation; otherwise kept`);
+		else if (target.phase === "routing") lines.push(`${prefix}${resourceLabel(target.resource)}, last; it holds uninstall progress`);
+		else lines.push(`${prefix}${resourceLabel(target.resource)}`);
+	}
+	return lines.length ? ["Delete every resource this installation created (--purge-resources), in this order:", ...lines] : ["--purge-resources finds no resource it can prove this installation created."];
+}
+/** Lines naming what --purge-resources never removes. */
+function purgeResourcesAlwaysKept() {
+	return [
+		"  The external PostgreSQL database and its data.",
+		"  Analytics Engine datasets; Cloudflare has no API to delete them.",
+		"  Access policies and identity providers you chose.",
+		"  API tokens you created for this platform. Revoke them in the Cloudflare dashboard."
+	];
+}
+/** Token permissions --purge-resources needs for this manifest. */
+function purgeResourcesPermissions(manifest) {
+	const targets = purgeResourcesTargets(manifest);
+	const needed = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		if (target.phase === "access") {
+			needed.add(target.access.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens);
+			continue;
+		}
+		if (target.phase === "email") {
+			needed.add(PERMISSIONS.emailRouting);
+			continue;
+		}
+		const { kind } = target.resource;
+		if (kind === "worker-route") needed.add(PERMISSIONS.routes);
+		else if (kind === "worker" || kind === "worker-custom-domain" || kind === "dispatch-namespace") needed.add(PERMISSIONS.workers);
+		else if (kind === "dns-record") needed.add(PERMISSIONS.dns);
+		else if (kind === "queue") needed.add(PERMISSIONS.queues);
+		else if (kind === "kv-namespace") needed.add(PERMISSIONS.kv);
+		else if (kind === "hyperdrive") needed.add(PERMISSIONS.hyperdrive);
+		else if (kind === "r2-bucket") needed.add(PERMISSIONS.r2);
+		else if (kind === "ai-gateway") needed.add(PERMISSIONS.aiGateway);
+	}
+	return Object.values(PERMISSIONS).filter((permission) => needed.has(permission));
+}
+function deniedStatus(error) {
+	return error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403);
+}
+/**
+* Check resource reads before the first change. Browser login cannot change
+* DNS or Access, so those need an API token. Read probes cannot prove Edit;
+* the plan lists the required permissions.
+*/
+async function checkPurgeResourcesCredentials(client, manifest, credential) {
+	const targets = purgeResourcesTargets(manifest);
+	const resources = targets.flatMap((target) => "resource" in target ? [target.resource] : []);
+	const access = targets.flatMap((target) => "access" in target ? [target.access] : []);
+	const has = (kind) => resources.some((resource) => resource.kind === kind);
+	const zone = manifest.resources.find((resource) => resource.key === "zone");
+	const emailZone = targets.some((target) => target.phase === "email") ? emailRoutingZone(manifest) : null;
+	const accounts = [.../* @__PURE__ */ new Set([manifest.account.id, ...access.map((entry) => entry.accountId)])];
+	const scope = `${accounts.length === 1 ? "account" : "accounts"} ${accounts.join(" and ")}${has("dns-record") || has("worker-route") ? ` and zone ${zone?.name ?? ""}` : ""}${emailZone ? ` and Email Routing zone ${emailZone}` : ""}`;
+	if (credential.source === "oauth") {
+		const browserMissing = [
+			...has("dns-record") ? [PERMISSIONS.dns] : [],
+			...access.some((entry) => entry.kind === "application") ? [PERMISSIONS.access] : [],
+			...access.some((entry) => entry.kind === "service-token") ? [PERMISSIONS.serviceTokens] : [],
+			...has("ai-gateway") && !credential.aiGatewayToken ? [PERMISSIONS.aiGateway] : []
+		];
+		if (browserMissing.length) throw new Error(`platform: Cloudflare browser login cannot delete every resource --purge-resources plans. Set CLOUDFLARE_API_TOKEN to a token with ${purgeResourcesPermissions(manifest).join(", ")}, scoped to ${scope}, then rerun. Browser login is missing: ${browserMissing.join(", ")}. No Cloudflare resource was changed.`);
+	}
+	const probes = [];
+	if (has("worker") || has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerNames(manifest.account.id)]);
+	if (has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerDomains(manifest.account.id)]);
+	if (has("worker-route") && zone) probes.push([PERMISSIONS.routes, () => client.listWorkerRoutes(zone.id)]);
+	for (const resource of resources) if (resource.kind === "dns-record" && zone) probes.push([PERMISSIONS.dns, () => client.listDnsRecords(zone.id, resource.name)]);
+	else if (resource.kind === "queue") probes.push([PERMISSIONS.queues, () => client.listQueueConsumers(manifest.account.id, resource.id)]);
+	for (const entry of access) probes.push([entry.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens, () => client.getAccessResource(entry.accountId, entry.kind, entry.id)]);
+	if (emailZone) probes.push([PERMISSIONS.emailRouting, () => client.listEmailRoutingRules(emailZone)]);
+	if (has("dispatch-namespace")) probes.push([PERMISSIONS.workers, () => client.listDispatchNamespaces(manifest.account.id)]);
+	if (has("kv-namespace")) probes.push([PERMISSIONS.kv, () => client.listKvNamespaces(manifest.account.id)]);
+	if (has("hyperdrive")) probes.push([PERMISSIONS.hyperdrive, () => client.listHyperdriveConfigs(manifest.account.id)]);
+	if (has("r2-bucket")) probes.push([PERMISSIONS.r2, () => client.listR2Buckets(manifest.account.id)]);
+	if (has("ai-gateway")) probes.push([PERMISSIONS.aiGateway, () => client.listAiGateways(manifest.account.id)]);
+	const missing = /* @__PURE__ */ new Set();
+	for (const [permission, probe] of probes) try {
+		await probe();
+	} catch (error) {
+		if (!deniedStatus(error)) throw error;
+		missing.add(permission);
+	}
+	if (missing.size) throw new Error(`platform: The Cloudflare credential cannot read every resource --purge-resources would delete. Add ${[...missing].join(", ")} for ${scope}, then rerun. No Cloudflare resource was changed.`);
+}
+const LISTED_PROJECTS = 20;
+/** Slugs of every project row, including projects whose deletion stopped partway. */
+async function readPlatformProjectSlugsConnection(client) {
+	if ((await client.query(`SELECT to_regclass('public.projects') IS NOT NULL AS "present"`)).rows[0]?.present !== true) return [];
+	return (await client.query("SELECT \"slug\" FROM \"projects\" ORDER BY \"slug\"")).rows.map((row) => row.slug);
+}
+/**
+* Projects own Workers, storage, and domains that only the running platform
+* can delete. --purge-resources deletes the platform, so it refuses before any
+* change while a project remains.
+*/
+async function assertNoPlatformProjects(read) {
+	let slugs;
+	try {
+		if (!read) throw new Error("no platform database connection is available");
+		slugs = await read();
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
+		throw new Error(`platform: Refusing --purge-resources because the project list could not be read from the platform database: ${reason}\nMake the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry.`);
+	}
+	if (slugs.length) throw new Error([
+		`platform: Refusing --purge-resources while the platform still has ${slugs.length === 1 ? "1 project" : `${slugs.length} projects`}.`,
+		"--purge-resources deletes the platform, and only the running platform can delete each project's Workers, storage, and domains.",
+		"Delete each project first with `void project delete <name>`, then retry:",
+		...slugs.slice(0, LISTED_PROJECTS).map((slug) => `  ${slug}`),
+		...slugs.length > LISTED_PROJECTS ? [`  …and ${slugs.length - LISTED_PROJECTS} more`] : []
+	].join("\n"));
+}
+const AI_GATEWAY_CREATION_WINDOW_MS = 6e5;
+/**
+* AI Gateway ids are chosen by the caller and can be reused after a delete,
+* and gateways carry no ownership marker. Only a creation time next to the
+* installer's provision intent shows that this is the gateway it created.
+*/
+function createdDuringInstallation(manifest, resource, createdAt) {
+	const created = createdAt === void 0 ? NaN : Date.parse(createdAt);
+	if (Number.isNaN(created)) return false;
+	return manifest.steps.some((step) => (step.key === `provision-intent:${resource.key}` || step.key.startsWith(`provision-intent:${resource.key}:`)) && Math.abs(created - Date.parse(step.completedAt)) <= AI_GATEWAY_CREATION_WINDOW_MS);
+}
+function ownershipRefusal(manifest, description, reason) {
+	return /* @__PURE__ */ new Error(`platform: Refusing to delete ${description} because ${reason}. It may no longer belong to this installation. Delete or fix it in the Cloudflare dashboard if it is yours, then rerun: ${purgeResourcesResumeCommand(manifest)}`);
+}
+function cloudflareRefusal(manifest, description, error, hint) {
+	if (!(error instanceof PlatformCloudflareApiError)) return error;
+	return new Error(`platform: Cloudflare refused to delete ${description}: ${error.message}\n${hint}\nProgress is saved. Rerun: ${purgeResourcesResumeCommand(manifest)}`, { cause: error });
+}
+/**
+* Delete every target in order. Returns the manifest with each deleted
+* resource recorded; routing KV is left for the caller to delete last.
+*/
+async function runPurgeResourcesTeardown(context, initial) {
+	const { client } = context;
+	let next = initial;
+	const accountId = next.account.id;
+	const save = async (manifest) => {
+		next = manifest;
+		await context.checkpoint(next);
+	};
+	const markDeleted = async (key) => {
+		const resource = next.resources.find((entry) => entry.key === key);
+		await save(recordInstallationResource(next, {
+			...resource,
+			state: "deleted"
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+	};
+	const recordStep = async (key, resultHash = "completed") => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await save(recordInstallationStep(next, {
+			completedAt: now,
+			key: `${PURGE_RESOURCES_STEP_PREFIX}${key}`,
+			resultHash
+		}, now));
+	};
+	/**
+	* Live proof for these keys. A resource an earlier uninstall recorded as
+	* retained is proven like a ready one; only its recorded state differs.
+	*/
+	const verify = (keys) => context.verify({
+		...next,
+		resources: next.resources.map((resource) => keys.has(resource.key) && resource.state === "retained" ? {
+			...resource,
+			state: "ready"
+		} : resource)
+	}, keys);
+	/**
+	* Prove the resource; false when it is already gone (and recorded).
+	*
+	* Cloudflare has no conditional DELETE: Workers and dispatch namespaces are
+	* addressed by name, and a route or custom domain can be changed in place.
+	* Something replaced between this proof and the DELETE can still be removed.
+	* That one-request window is accepted because --purge-resources is opt-in and its
+	* plan lists every resource first. A forced Worker DELETE has the same
+	* window between reading its dependents and the DELETE.
+	*/
+	const prove = async (resource) => {
+		if ((await verify(/* @__PURE__ */ new Set(["routing-kv", resource.key]))).has(resource.key)) {
+			await markDeleted(resource.key);
+			return false;
+		}
+		return true;
+	};
+	/** Keep a resource that no longer matches the record, and save why. */
+	const keep = async (key, reason) => {
+		const resource = next.resources.find((entry) => entry.key === key);
+		if (resource?.state === "ready") await save(recordInstallationResource(next, {
+			...resource,
+			state: "retained"
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+		await recordStep(keptStepKey(key), reason);
+	};
+	const remove = async (resource, hint, zoneId) => {
+		if (!await prove(resource)) return;
+		try {
+			await client.deleteResource(accountId, resource, zoneId);
+		} catch (error) {
+			throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, hint);
+		}
+		await markDeleted(resource.key);
+	};
+	const zone = usableZone(next);
+	const createdWorkerNames = new Set(next.resources.filter((resource) => resource.kind === "worker" && resource.ownership === "created").map((resource) => resource.name));
+	/** The recorded Worker under this name that this run still deletes, if any. */
+	const workerTarget = (name) => next.resources.find((resource) => resource.kind === "worker" && resource.name === name && isPurgeResourcesCandidate(next, resource));
+	const workerHint = "A Worker this installation did not create may still use it, for example by sending it logs as a tail Worker or through a service binding. Remove that link in the Cloudflare dashboard.";
+	/**
+	* Delete a platform Worker. When Cloudflare refuses because other Workers
+	* still bind to it, force the DELETE only if each of them is a Worker this
+	* run deletes too and still carries this installation's ownership marker.
+	*/
+	const removeWorker = async (resource) => {
+		if (!await prove(resource)) return;
+		try {
+			await client.deleteResource(accountId, resource);
+		} catch (error) {
+			if (!(error instanceof PlatformCloudflareApiError)) throw error;
+			const dependents = await client.listWorkerDependents(accountId, resource.name).catch(() => null);
+			const outside = dependents?.workers.filter((name) => !workerTarget(name)) ?? [];
+			const keys = outside.length ? [] : dependents?.workers.map((name) => workerTarget(name).key) ?? [];
+			const missing = dependents && !dependents.pagesFunction && keys.length ? await verify(/* @__PURE__ */ new Set(["routing-kv", ...keys])) : null;
+			if (!dependents || dependents.pagesFunction || dependents.workers.length === 0 || outside.length > 0 || !missing || keys.some((key) => missing.has(key))) throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, outside.length ? `Workers outside this installation still use it: ${outside.join(", ")}. Remove that link in the Cloudflare dashboard.` : workerHint);
+			try {
+				await client.forceDeleteWorker(accountId, resource.name);
+			} catch (forced) {
+				throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, forced, workerHint);
+			}
+		}
+		await markDeleted(resource.key);
+	};
+	for (const target of purgeResourcesTargets(initial)) {
+		if (target.phase === "access") {
+			const { access } = target;
+			const live = await client.getAccessResource(access.accountId, access.kind, access.id);
+			if (live) {
+				if (live.name !== access.name || !access.name.startsWith(`void-${next.id}-`)) {
+					await keep(`access:${access.key}`, `its live name ${JSON.stringify(live.name)} is not the name this installation recorded`);
+					continue;
+				}
+				try {
+					await client.deleteAccessResource(access.accountId, access.kind, access.id);
+				} catch (error) {
+					throw cloudflareRefusal(next, `Access ${access.kind} ${access.name}`, error, "Check that nothing outside this installation still uses it.");
+				}
+			}
+			await recordStep(`access:${access.key}`);
+			continue;
+		}
+		const current = next.resources.find((resource) => resource.key === target.resource.key);
+		if (!current || current.state === "deleted" || purgeResourcesKeptReason(next, current.key) !== null || target.phase !== "traffic" && !isPurgeResourcesCandidate(next, current)) continue;
+		switch (target.phase) {
+			case "traffic": {
+				const worker = next.resources.find((resource) => resource.key === target.worker.key);
+				if (!worker || !isPurgeResourcesCandidate(next, worker) || !await prove(worker)) break;
+				if (current.kind === "worker-route") {
+					const live = (await client.listWorkerRoutes(zone.id)).find((route) => route.id === current.id);
+					if (live && (live.pattern !== current.name || live.script !== worker.name)) {
+						await keep(current.key, `it now sends ${JSON.stringify(live.pattern)} to ${JSON.stringify(live.script)}`);
+						break;
+					}
+					if (live) await client.deleteWorkerRoute(zone.id, current.id);
+				} else {
+					const live = (await client.listWorkerDomains(accountId)).find((domain) => domain.id === current.id);
+					if (live && (live.hostname !== current.name || live.service !== worker.name)) {
+						await keep(current.key, `it now sends ${JSON.stringify(live.hostname)} to ${JSON.stringify(live.service)}`);
+						break;
+					}
+					if (live) await client.deleteWorkerDomain(accountId, current.id);
+				}
+				await markDeleted(current.key);
+				break;
+			}
+			case "dns":
+				try {
+					await remove(current, "Check the record in the Cloudflare dashboard.", zone.id);
+				} catch (error) {
+					if (!(error instanceof PlatformResourceChangedError && error.resourceKey === current.key)) throw error;
+					await keep(current.key, error.reason);
+				}
+				break;
+			case "email": {
+				if (!await prove(current)) break;
+				const zoneId = emailRoutingZone(next);
+				const hint = "Check the Email Routing rules for this zone in the Cloudflare dashboard. Never disable Email Routing for the zone.";
+				try {
+					for (const rule of await client.listEmailRoutingRules(zoneId)) if (rule.workerName === current.name) await client.deleteEmailRoutingRule(zoneId, rule.id);
+					if ((await client.getEmailRoutingCatchAll(zoneId))?.workerName === current.name) await client.resetEmailRoutingCatchAll(zoneId);
+				} catch (error) {
+					throw cloudflareRefusal(next, `Email Routing rules that send mail to ${current.name}`, error, hint);
+				}
+				await recordStep("email-routing");
+				break;
+			}
+			case "queue-consumers":
+				if (!await prove(current)) break;
+				for (const consumer of await client.listQueueConsumers(accountId, current.id)) if (consumer.script && createdWorkerNames.has(consumer.script)) await client.deleteQueueConsumer(accountId, current.id, consumer.id);
+				await recordStep(`consumers:${current.key}`);
+				break;
+			case "workers":
+				await removeWorker(current);
+				break;
+			case "tail":
+				await remove(current, workerHint);
+				break;
+			case "queues":
+				await remove(current, "A Worker this installation did not create may still use the Queue as a producer or consumer. Remove it from that Worker in the Cloudflare dashboard.");
+				break;
+			case "dispatch": {
+				if (!await prove(current)) break;
+				const projects = await context.readProjects();
+				if (projects.length) throw new Error(`platform: Stopped before deleting the application Workers in dispatch namespace ${current.name} because ${projects.length === 1 ? "a project was" : "projects were"} created while this uninstall ran: ${projects.join(", ")}. Nothing in the namespace was deleted. --purge-resources refuses while the platform database lists a project. Remove each one from the "projects" table once you have dealt with its Cloudflare resources, then rerun: ${purgeResourcesResumeCommand(next)}`);
+				for (const script of await client.listDispatchNamespaceScripts(accountId, current.name)) try {
+					await client.deleteDispatchNamespaceScript(accountId, current.name, script);
+				} catch (error) {
+					throw cloudflareRefusal(next, `application Worker ${script}`, error, workerHint);
+				}
+				try {
+					await client.deleteResource(accountId, current);
+				} catch (error) {
+					throw cloudflareRefusal(next, `dispatch-namespace ${current.name}`, error, "Check the namespace in the Cloudflare dashboard.");
+				}
+				await markDeleted(current.key);
+				break;
+			}
+			case "ai-gateway": {
+				const live = (await client.listAiGateways(accountId)).find((gateway) => gateway.id === current.id && gateway.name === current.name);
+				if (live && !createdDuringInstallation(next, current, live.createdAt)) {
+					await keep(current.key, "Cloudflare does not show it was created during installation");
+					break;
+				}
+				await remove(current, "Check that nothing outside this installation still uses it.");
+				break;
+			}
+			case "data":
+				await remove(current, "Check that nothing outside this installation still uses it.");
+				break;
+			case "r2": await purgeBucket(current);
+		}
+	}
+	return next;
+	async function purgeBucket(bucket) {
+		const markerStep = `r2-marker:${bucket.key}`;
+		if (!hasStep(next, markerStep)) {
+			if (!await prove(bucket)) return;
+			await client.emptyR2Bucket(accountId, bucket.name, /* @__PURE__ */ new Set([PLATFORM_R2_OWNERSHIP_MARKER_KEY]), async () => {
+				if ((await verify(/* @__PURE__ */ new Set(["routing-kv", bucket.key]))).has(bucket.key)) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "it disappeared while it was being emptied");
+			});
+			if (!await prove(bucket)) return;
+			const generation = await context.bucketGeneration(next, bucket);
+			if (generation === null) {
+				await markDeleted(bucket.key);
+				return;
+			}
+			await recordStep(markerStep, generation);
+			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
+		} else {
+			const saved = next.steps.find((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${markerStep}`);
+			const generation = await context.bucketGeneration(next, bucket);
+			if (generation === null) {
+				await markDeleted(bucket.key);
+				return;
+			}
+			if (generation !== saved?.resultHash) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "its creation fingerprint changed");
+			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
+		}
+		try {
+			await client.deleteResource(accountId, bucket);
+		} catch (error) {
+			throw cloudflareRefusal(next, `r2-bucket ${bucket.name}`, error, "Cloudflare deletes only empty buckets. If objects were added after it was emptied, delete them in the Cloudflare dashboard.");
+		}
+		await markDeleted(bucket.key);
+	}
+}
+//#endregion
 //#region src/cli/platform-zero-trust-uninstall.ts
 /**
 * Uninstall turns off the platform API, and only that API can remove the
@@ -5444,8 +6253,9 @@ async function readPlatformProjectZeroTrustStateConnection(client) {
 }
 /**
 * Take the Zero Trust configuration lock exclusively on this session. Every
-* API path that records or creates a Void-managed Access application holds
-* the same lock, so none can commit until the returned release runs.
+* API path that records or creates a Void-managed Access application or
+* creates a project holds the same lock, so none can commit until the
+* returned release runs.
 */
 async function lockPlatformProjectZeroTrustConnection(client) {
 	await client.query(`SELECT pg_advisory_lock(${ZERO_TRUST_LOCK})`);
@@ -5689,6 +6499,21 @@ async function readPlatformProjectZeroTrustState(databaseUrl, installationId, ow
 		await pool.end();
 	}
 }
+/** Read project slugs for a --purge-resources plan, which holds no lifecycle lock. */
+async function readPlatformProjectSlugs(databaseUrl, installationId, ownershipNonce) {
+	if (!databaseUrl) throw new Error("the installation database URL is not recorded on this machine");
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	try {
+		await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
+		return await readPlatformProjectSlugsConnection(pool);
+	} finally {
+		await pool.end();
+	}
+}
 async function inspectPlatformDatabaseStateConnection(client, database) {
 	const relation = await client.query(`SELECT to_regclass('"drizzle"."__drizzle_migrations"')::text AS "relation"`);
 	if (relation.rows.length === 0 || relation.rows[0]?.relation === null) return {
@@ -5817,6 +6642,7 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 		} : null;
 	};
 	release.readProjectZeroTrust = () => readPlatformProjectZeroTrustStateConnection(client);
+	release.readProjects = () => readPlatformProjectSlugsConnection(client);
 	release.lockProjectZeroTrust = () => lockPlatformProjectZeroTrustConnection(client);
 	release.fenceProjectZeroTrust = () => fencePlatformProjectZeroTrustConnection(client);
 	release.liftProjectZeroTrustFence = () => liftPlatformProjectZeroTrustFenceConnection(client);
@@ -6005,7 +6831,7 @@ async function claimPlatformDatabaseConnection(client, installationId, ownership
 		if (!claim) {
 			const contents = await client.query(`SELECT "schemaname", "tablename"
          FROM "pg_catalog"."pg_tables"
-         WHERE "schemaname" = ANY (current_schemas(false))
+         WHERE ("schemaname" = ANY (current_schemas(false)) OR "schemaname" = 'drizzle')
            AND "tablename" <> '__void_platform_installation'
          ORDER BY "schemaname", "tablename"
          LIMIT 1`);
@@ -6209,6 +7035,7 @@ async function uploadInstallationWorkers(input) {
 		const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
 		const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
 			apiBaseUrl: cloudflareApiBaseUrl,
+			operatorApiToken: dependencies.operatorApiToken,
 			...parallelWorkerUploads ? {
 				acquireUploadSlot,
 				onReadyForActivation,
@@ -6388,8 +7215,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl);
-	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true);
+	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, false, dependencies.operatorApiToken);
+	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true, dependencies.operatorApiToken);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
@@ -7361,14 +8188,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-CUdY064e.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-Bsq43AJp.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-WOZ95Uze.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-DQAqAQYu.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7378,7 +8205,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-Bp6aoH2C.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-Bbwf6-Dq.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7551,7 +8378,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Bp6aoH2C.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Bbwf6-Dq.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -7914,6 +8741,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		const result = await installPlatform(plan, secrets, existing, {
 			acquireDatabaseLifecycleLock: acquirePlatformDatabaseLifecycleLock,
 			client,
+			operatorApiToken: managementApiToken || operatorCredential.token,
 			runtime,
 			healthCheckResumeCommand: `${cliCommandName()} platform install --resume --name ${existing.id}`,
 			onProgress: (message) => progress?.message(message),
@@ -7955,7 +8783,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Bp6aoH2C.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Bbwf6-Dq.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8107,4 +8935,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { PlatformCloudflareClient as A, revalidatePlatformInstallAction as C, checkpointPlatformAccessResources as D, resolvePlatformCloudflareCredential as E, hyperdriveOriginFromConnectionString as M, hyperdriveOriginMatches as N, parsePlatformAccessSetupSpec as O, verifyPlatformRuntimeTokenPermissions as P, platformProvisionIntentHash as S, assertPlatformOperatorCredentialCanApplyPlan as T, recordPlatformWorkerTraffic as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, formatPlatformInstallPlan as b, acquirePlatformDatabaseLifecycleLockConnection as c, assertProjectZeroTrustAllowsUninstall as d, loadPlatformRuntime as f, recordResource as g, resolveBootstrapGitHubId as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginConfigHash as j, preparePlatformAccessSetup as k, platformDatabaseClientUrl as l, createPlatformInstallationSecrets as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, createPlatformHealthProbeToken as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectZeroTrustState as u, trackedPlatformWorkerTraffic as v, platformDatabaseNameFromOwnerUrl as w, platformAdoptionIntentHash as x, createPlatformInstallPlan as y };
+export { resolveBootstrapGitHubId as A, assertPlatformOperatorCredentialCanApplyPlan as B, purgeResourcesKeptReason as C, loadPlatformRuntime as D, runPurgeResourcesTeardown as E, formatPlatformInstallPlan as F, preparePlatformAccessSetup as G, verifyPlatformCloudflareCredential as H, platformAdoptionIntentHash as I, hyperdriveOriginFromConnectionString as J, PlatformCloudflareClient as K, platformProvisionIntentHash as L, recordPlatformWorkerTraffic as M, trackedPlatformWorkerTraffic as N, createPlatformHealthProbeToken as O, createPlatformInstallPlan as P, revalidatePlatformInstallAction as R, purgeResourcesHandlesEmailRouting as S, purgeResourcesPermissions as T, checkpointPlatformAccessResources as U, resolvePlatformCloudflareCredential as V, parsePlatformAccessSetupSpec as W, verifyPlatformRuntimeTokenPermissions as X, hyperdriveOriginMatches as Y, describePurgeResourcesPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, isPurgedAccessResource as b, acquirePlatformDatabaseLifecycleLockConnection as c, readPlatformProjectZeroTrustState as d, assertProjectZeroTrustAllowsUninstall as f, checkPurgeResourcesCredentials as g, assertNoPlatformProjects as h, verifyPlatformAiGatewayPlan as i, recordResource as j, createPlatformInstallationSecrets as k, platformDatabaseClientUrl as l, PlatformResourceChangedError as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, PURGE_RESOURCES_STEP_PREFIX as p, hyperdriveOriginConfigHash as q, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectSlugs as u, isPlatformTailWorker as v, purgeResourcesKeptResources as w, purgeResourcesAlwaysKept as x, isPurgeResourcesCandidate as y, platformDatabaseNameFromOwnerUrl as z };