void 0.25.0 → 0.26.1

package/dist/{platform-lifecycle-Dm09JNkn.mjs → platform-lifecycle-D_QEY32D.mjs}

@@ -1,14 +1,14 @@
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { _ as savePlatformConnection, a as listInstallationManifests, b as writePendingInstallationSecrets, d as promoteInstallationSecrets, f as readInstallationRecoverySecrets, g as resolveInstallationManifest, i as latestPlatformWorkerCutoverGeneration, l as platformRegistryDirectory, n as assertPlatformInstallationSlugAvailable, p as readPendingInstallationSecrets, s as normalizePlatformApiUrl, t as acquirePlatformLifecycleLock, u as platformWorkerSecretUpdateIntentState, y as writeInstallationManifest } from "./platform-registry-KfNEF84O.mjs";
+import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-P387v42A.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-AHKBzmuu.mjs";
-import { u as openBrowser } from "./auth-7wuZ5ob8.mjs";
-import { A as confirm, B as note, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./prompts-6OSVA7DJ.mjs";
-import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
-import { c as import_picocolors, n as cliCommandName, r as createSpinner } from "./output-BBsUwdyT.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-Btj1jppf.mjs";
-import { t as parsePlatformArgs } from "./platform-args-Bzf8JPc2.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-ngGqZpHZ.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, l as import_picocolors, n as cliCommandName, r as createSpinner, u as note } from "./output-C50ag2r3.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-2-TfIEzB.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CuxfF6OA.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BfaLiWbj.mjs";
+import { t as parsePlatformArgs } from "./platform-args-BoZkWQnJ.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-DVe42Ws7.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -16,11 +16,10 @@ import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFI
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
-import { execFile } from "node:child_process";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
+import { createServer, request } from "node:http";
 import { readFile } from "node:fs/promises";
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
-import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
 //#region src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
@@ -116,7 +115,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		} catch {
 			throw new PlatformCloudflareApiError(`Cloudflare returned a non-JSON response (HTTP ${response.status}).`, response.status, path.split("?")[0]);
 		}
-		if (!response.ok || envelope.success !== true || envelope.result === void 0) throw new PlatformCloudflareApiError(`Cloudflare API error: ${envelope.errors?.map((error) => error.message).filter(Boolean).join(", ") || `HTTP ${response.status}`} (HTTP ${response.status}; ${init?.method ?? "GET"} ${path.split("?")[0]}).`, response.status, path.split("?")[0]);
+		if (!response.ok || envelope.success !== true || envelope.result === void 0) throw new PlatformCloudflareApiError(`Cloudflare API error: ${cloudflareErrorDetails(envelope, response.status)} (HTTP ${response.status}; ${init?.method ?? "GET"} ${path.split("?")[0]}).`, response.status, path.split("?")[0]);
 		return {
 			result: envelope.result,
 			resultInfo: envelope.result_info
@@ -157,6 +156,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			if (result.length < 50) break;
 		}
 		return entries.map((entry) => ({
+			...withCreatedAt(entry.created_at),
 			id: requiredString(entry.id, "AI Gateway id"),
 			name: requiredString(entry.id, "AI Gateway id")
 		}));
@@ -548,7 +548,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			throw error;
 		}
 	}
-	async emptyR2Bucket(accountId, bucketName, preservedKeys = /* @__PURE__ */ new Set()) {
+	async emptyR2Bucket(accountId, bucketName, preservedKeys = /* @__PURE__ */ new Set(), beforeDelete) {
 		let cursor = "";
 		const observedCursors = /* @__PURE__ */ new Set();
 		for (;;) {
@@ -565,6 +565,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			const envelope = await response.json();
 			if (!response.ok || envelope.success !== true || !Array.isArray(envelope.result)) throw new PlatformCloudflareApiError(`Cloudflare API error listing R2 objects: ${envelope.errors?.map((error) => error.message).filter(Boolean).join(", ") || `HTTP ${response.status}`}`, response.status);
 			const keys = envelope.result.map((object) => requiredString(object.key, "R2 object key")).filter((key) => !preservedKeys.has(key));
+			if (keys.length > 0) await beforeDelete?.();
 			for (let offset = 0; offset < keys.length; offset += 1e3) await this.deleteR2Objects(accountId, bucketName, keys.slice(offset, offset + 1e3));
 			const nextCursor = envelope.result_info?.cursor ?? "";
 			if (!nextCursor) return;
@@ -582,40 +583,173 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		const deletedKeys = new Set(deleted.map((entry) => requiredString(entry.key, "deleted R2 object key")));
 		if (keys.find((key) => !deletedKeys.has(key)) !== void 0) throw new Error("platform: Cloudflare did not confirm every requested R2 object deletion.");
 	}
-	async deleteResource(accountId, kind, id, zoneId) {
+	async deleteResource(accountId, resource, zoneId) {
+		const { kind } = resource;
+		if (kind === "ai-gateway" && this.#aiGatewayClient) return this.#aiGatewayClient.deleteResource(accountId, resource, zoneId);
 		const account = encodeURIComponent(accountId);
-		const encoded = encodeURIComponent(id);
+		const encoded = encodeURIComponent(kind === "dispatch-namespace" || kind === "worker" ? resource.name : resource.id);
 		const path = kind === "kv-namespace" ? `/accounts/${account}/storage/kv/namespaces/${encoded}` : kind === "dns-record" ? zoneId ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}` : null : kind === "ai-gateway" ? `/accounts/${account}/ai-gateway/gateways/${encoded}` : kind === "r2-bucket" ? `/accounts/${account}/r2/buckets/${encoded}` : kind === "queue" ? `/accounts/${account}/queues/${encoded}` : kind === "dispatch-namespace" ? `/accounts/${account}/workers/dispatch/namespaces/${encoded}` : kind === "hyperdrive" ? `/accounts/${account}/hyperdrive/configs/${encoded}` : kind === "worker" ? `/accounts/${account}/workers/scripts/${encoded}` : kind === "zone" ? `/zones/${encoded}` : null;
 		if (!path) throw new Error(`platform: Unsupported Cloudflare deletion kind ${kind}.`);
+		await this.#deleteIfPresent(path);
+	}
+	/**
+	* DELETE one resource by the key Cloudflare addresses it with. Only
+	* `forceDeleteWorker` sends `force`; otherwise Cloudflare refuses a
+	* resource another Worker still uses. A 404 means it is already gone.
+	*/
+	async #deleteIfPresent(path) {
+		const response = await this.#fetcher(`${this.apiBaseUrl}${path}`, {
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${this.#token}`
+			},
+			method: "DELETE",
+			redirect: "manual",
+			signal: AbortSignal.timeout(3e4)
+		});
+		if (response.status === 404) return;
+		let envelope = {};
 		try {
-			await this.request(path, { method: "DELETE" });
+			envelope = await response.json();
+		} catch {
+			envelope = { success: response.ok };
+		}
+		if (!response.ok || envelope.success !== true) throw new PlatformCloudflareApiError(`Cloudflare API error: ${cloudflareErrorDetails(envelope, response.status)} (HTTP ${response.status}; DELETE ${path}).`, response.status, path);
+	}
+	async deleteWorkerRoute(zoneId, routeId) {
+		await this.#deleteIfPresent(`/zones/${encodeURIComponent(zoneId)}/workers/routes/${encodeURIComponent(routeId)}`);
+	}
+	async deleteWorkerDomain(accountId, domainId) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/domains/${encodeURIComponent(domainId)}`);
+	}
+	async listQueueConsumers(accountId, queueId) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/queues/${encodeURIComponent(queueId)}/consumers`)).map((entry) => ({
+			id: requiredString(entry.consumer_id, "Queue consumer id"),
+			script: entry.type === "http_pull" ? null : requiredString(entry.script_name ?? entry.script ?? entry.service, "Queue consumer Worker name")
+		}));
+	}
+	async listWorkerDependents(accountId, workerName) {
+		const account = encodeURIComponent(accountId);
+		const script = encodeURIComponent(workerName);
+		const references = await this.request(`/accounts/${account}/workers/scripts/${script}/references`);
+		const tails = await this.request(`/accounts/${account}/workers/tails/by-consumer/${script}`);
+		const name = (reference) => requiredString(reference?.script ?? reference?.service, "Dependent Worker name");
+		const workers = [
+			...(references.services?.incoming ?? []).map(name),
+			...(references.durable_objects ?? []).map(name).filter((entry) => entry !== workerName),
+			...(references.dispatch_outbounds ?? []).map(name),
+			...tails.map((tail) => name(tail.producer))
+		];
+		return {
+			pagesFunction: references.services?.pages_function === true,
+			workers: [...new Set(workers)]
+		};
+	}
+	/**
+	* DELETE a Worker even though other Workers still bind to it. Cloudflare
+	* leaves those bindings pointing at nothing, so callers first check that
+	* every dependent is going away too.
+	*/
+	async forceDeleteWorker(accountId, workerName) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}?force=true`);
+	}
+	async deleteQueueConsumer(accountId, queueId, consumerId) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/queues/${encodeURIComponent(queueId)}/consumers/${encodeURIComponent(consumerId)}`);
+	}
+	async listDispatchNamespaceScripts(accountId, namespace) {
+		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts`)).map((entry) => requiredString(entry.id, "Dispatch namespace script name"));
+	}
+	async deleteDispatchNamespaceScript(accountId, namespace, scriptName) {
+		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(scriptName)}`);
+	}
+	/** Read one Access application or service token; null when it is gone. */
+	async getAccessResource(accountId, kind, id) {
+		try {
+			const result = await this.request(accessResourcePath(accountId, kind, id));
+			return {
+				id: requiredString(result.id, "Access resource id"),
+				name: requiredString(result.name, "Access resource name")
+			};
 		} catch (error) {
-			if (error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
 			throw error;
 		}
 	}
-	async removeRoutes(_accountId, _zoneId, tracked) {
-		if (tracked.routes.length > 0 || tracked.customDomains.length > 0) throw new Error("platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.");
+	async deleteAccessResource(accountId, kind, id) {
+		await this.#deleteIfPresent(accessResourcePath(accountId, kind, id));
 	}
-	async setWorkerSubdomain(accountId, workerName, enabled) {
-		try {
-			await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}/subdomain`, {
-				body: JSON.stringify({
-					enabled,
-					previews_enabled: enabled
-				}),
-				headers: { "Cloudflare-Workers-Script-Api-Date": "2025-08-01" },
-				method: "POST"
+	/** Email Routing rules in a zone, without the catch-all, which has its own endpoint. */
+	async listEmailRoutingRules(zoneId) {
+		const entries = [];
+		for (let page = 1;; page++) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: "50"
 			});
+			const result = await this.request(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules?${query}`);
+			entries.push(...result);
+			if (result.length < 50) break;
+		}
+		return entries.filter((entry) => !(Array.isArray(entry.matchers) ? entry.matchers : []).some((matcher) => matcher?.type === "all")).map((entry) => ({
+			id: requiredString(entry.id ?? entry.tag, "Email Routing rule id"),
+			...parseEmailRoutingTarget(entry)
+		}));
+	}
+	async deleteEmailRoutingRule(zoneId, ruleId) {
+		await this.#deleteIfPresent(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules/${encodeURIComponent(ruleId)}`);
+	}
+	/** The zone's Email Routing catch-all rule; null when the zone has none. */
+	async getEmailRoutingCatchAll(zoneId) {
+		try {
+			return parseEmailRoutingTarget(await this.request(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules/catch_all`));
 		} catch (error) {
-			if (!enabled && error instanceof PlatformCloudflareApiError && error.status === 404) return;
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
 			throw error;
 		}
 	}
+	/** Point the catch-all back at its disabled default, which drops mail. */
+	async resetEmailRoutingCatchAll(zoneId) {
+		await this.request(`/zones/${encodeURIComponent(zoneId)}/email/routing/rules/catch_all`, {
+			method: "PUT",
+			body: JSON.stringify({
+				matchers: [{ type: "all" }],
+				actions: [{ type: "drop" }],
+				enabled: false
+			})
+		});
+	}
+	async removeRoutes(_accountId, _zoneId, tracked) {
+		if (tracked.routes.length > 0 || tracked.customDomains.length > 0) throw new Error("platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.");
+	}
 };
+function accessResourcePath(accountId, kind, id) {
+	return `/accounts/${encodeURIComponent(accountId)}/access/${kind === "application" ? "apps" : "service_tokens"}/${encodeURIComponent(id)}`;
+}
+function parseEmailRoutingTarget(rule) {
+	const actions = Array.isArray(rule.actions) ? rule.actions : [];
+	const action = actions.length === 1 ? actions[0] : null;
+	const value = Array.isArray(action?.value) ? action.value : [];
+	return {
+		enabled: rule.enabled === true,
+		workerName: action?.type === "worker" && value.length === 1 && typeof value[0] === "string" ? value[0] : null
+	};
+}
+function cloudflareErrorDetails(envelope, status) {
+	return envelope.errors?.filter((error) => error.message).map((error) => error.code === void 0 ? error.message : `${error.message} (code ${error.code})`).join(", ") || `HTTP ${status}`;
+}
 function encodeR2ObjectKey(key) {
 	return key.split("/").map(encodeURIComponent).join("/");
 }
+/**
+* An AI Gateway creation time as ISO 8601 UTC. Cloudflare reports it without a
+* zone ("2026-10-05 18:29:14"), which JavaScript would read as local time.
+*/
+function withCreatedAt(value) {
+	if (typeof value !== "string") return {};
+	const zoneless = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(?:\.\d+)?$/.test(value);
+	const time = Date.parse(zoneless ? `${value.replace(" ", "T")}Z` : value);
+	return Number.isNaN(time) ? {} : { createdAt: new Date(time).toISOString() };
+}
 function requiredString(value, label) {
 	if (typeof value !== "string" || value === "") throw new Error(`platform: ${label} is missing from the Cloudflare response.`);
 	return value;
@@ -847,6 +981,18 @@ function platformAccessOverlapsOrigin(destination, origin) {
 	const pattern = "^" + destination.split("/")[0].split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$";
 	return new RegExp(pattern, "i").test(new URL(origin).hostname);
 }
+/** Whether an application path-covers, or exactly covers, any protected platform origin. */
+function platformAccessOverlapsOrigins(application, origins) {
+	return platformAccessPublicDestinations(application).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)));
+}
+/** A definitive 4xx means the create did not happen, so a retry may not find a hidden duplicate. */
+function platformAccessCreateRejected(error) {
+	return error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
+		408,
+		409,
+		429
+	].includes(error.status);
+}
 async function inspectPlatformAccess(client, input) {
 	const authDomain = text(object(await client.get("organizations"), "Access organization").auth_domain, "Access team domain");
 	const teamDomain = authDomain.startsWith("https://") ? authDomain : `https://${authDomain}`;
@@ -881,7 +1027,6 @@ async function provisionPlatformAccess(client, input, previous, save) {
 		if (url.origin !== value || url.protocol !== "https:") throw new Error("platform: Access requires exact HTTPS origins without credentials, paths, or query strings.");
 		return url.origin;
 	}))];
-	for (const origin of origins) if (!origin.startsWith("https://")) throw new Error("platform: Access protection requires HTTPS platform origins.");
 	const state = previous ? structuredClone(previous) : {
 		version: 1,
 		accountId: input.accountId,
@@ -913,7 +1058,7 @@ async function provisionPlatformAccess(client, input, previous, save) {
 	}
 	if (input.protection) for (const app of inventory) {
 		if (app.id === input.protection.applicationId || app.id === state.resources.protection?.id || app.name === state.resources.protection?.name) continue;
-		if (platformAccessPublicDestinations(app).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)))) throw new Error("platform: An existing Access application overlaps a platform endpoint. Connect or reconcile it explicitly before provisioning protection.");
+		if (platformAccessOverlapsOrigins(app, origins)) throw new Error("platform: An existing Access application overlaps a platform endpoint. Connect or reconcile it explicitly before provisioning protection.");
 	}
 	const output = { resources: [] };
 	const application = async (key, expected, existingId) => {
@@ -968,11 +1113,7 @@ async function provisionPlatformAccess(client, input, previous, save) {
 			save(state);
 			return object(await client.get(`apps/${encodeURIComponent(checkpoint.id)}`), "Access application");
 		} catch (error) {
-			if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
-				408,
-				409,
-				429
-			].includes(error.status)) {
+			if (platformAccessCreateRejected(error)) {
 				checkpoint.pending = false;
 				save(state);
 			}
@@ -1127,282 +1268,6 @@ async function verifyPlatformAccessApplication(client, input, app, type, machine
 	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
 }
 //#endregion
-//#region src/cli/platform-setup.ts
-function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
-	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + import_picocolors.default.underline(page.title) + "\x1B]8;;\x1B\\" : page.title + ": " + import_picocolors.default.underline(page.url);
-}
-function platformSetupFieldHelp(key) {
-	const docs = (page, section, title) => platformSetupLink({
-		title,
-		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
-	});
-	switch (key) {
-		case "databaseUrl": return {
-			placeholder: "postgresql://user:pw@…/database",
-			description: "Provide a PostgreSQL database URL for platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
-				title: "Neon",
-				url: "https://neon.com/"
-			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
-		};
-		case "jwtSecret": return { description: `Create a JWT signing key for platform login tokens. Run ${import_picocolors.default.blue("openssl rand -base64 32")}. Save the key in your password manager. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: `Generate a project encryption key for app secrets. Run ${import_picocolors.default.blue("openssl rand -base64 32")} separately. Save this key for recovery. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		default: return;
-	}
-}
-function supportsSetupLinks() {
-	return !!process.stdout.isTTY && ([
-		"ghostty",
-		"iTerm.app",
-		"WezTerm",
-		"vscode",
-		"WarpTerminal"
-	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
-}
-/** Dashboard keys use permission-catalog labels, which can differ from product names. */
-function platformAccountTokenPermissions(includeAiGateway) {
-	return [
-		{
-			key: "account_settings",
-			type: "read"
-		},
-		{
-			key: "workers_scripts",
-			type: "edit"
-		},
-		{
-			key: "workers_kv_storage",
-			type: "edit"
-		},
-		{
-			key: "workers_r2",
-			type: "edit"
-		},
-		{
-			key: "d1",
-			type: "edit"
-		},
-		{
-			key: "queues",
-			type: "edit"
-		},
-		{
-			key: "account_analytics",
-			type: "read"
-		},
-		{
-			key: "workers_tail",
-			type: "read"
-		},
-		{
-			key: "query_cache",
-			type: "edit"
-		},
-		...includeAiGateway ? [{
-			key: "aig",
-			type: "edit"
-		}] : []
-	];
-}
-function platformManagementSetupPage(plan, options = {}) {
-	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-	const zoneName = plan.deployment.application.zoneName;
-	const apiHostname = plan.deployment.controlPlane.apiHostname;
-	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
-		protection: !!plan.deployment.authentication.accessProtection,
-		readOnly: false
-	} : void 0);
-	const accessLevel = access && access.readOnly ? "read" : "edit";
-	const appAccess = !!plan.deployment.appAccess;
-	const appAccessLevel = appAccess ? "edit" : accessLevel;
-	const permissions = [
-		...platformAccountTokenPermissions(true),
-		...zoneName || apiHostname || createsZone ? [
-			{
-				key: "zone",
-				type: createsZone ? "edit" : "read"
-			},
-			{
-				key: "dns",
-				type: "edit"
-			},
-			{
-				key: "workers_routes",
-				type: "edit"
-			}
-		] : [],
-		...access || appAccess ? [
-			{
-				key: "access",
-				type: appAccessLevel
-			},
-			{
-				key: "access_acct",
-				type: "read"
-			},
-			...access && access.protection ? [{
-				key: "access_service_token",
-				type: accessLevel
-			}] : []
-		] : [],
-		...zoneName && plan.deployment.application.baseDomain !== zoneName ? [{
-			key: "ssl_and_certificates",
-			type: "read"
-		}] : []
-	];
-	return {
-		title: "Cloudflare management API token",
-		linkInTitle: true,
-		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-			to: "/" + plan.account.id + "/api-tokens",
-			name: plan.deployment.displayName + " Management",
-			permissionGroupKeys: JSON.stringify(permissions)
-		}),
-		instructions: [
-			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
-			`Scope it to ${plan.account.name}${createsZone ? "; allow zone creation." : zoneName ? ` and zone ${zoneName}.` : "."}`,
-			...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`Also include the zone for ${apiHostname}.`] : []
-		].join("\n")
-	};
-}
-function platformSetupPages(plan) {
-	const permissions = [
-		...platformAccountTokenPermissions(plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect")),
-		...plan.deployment.application.zoneName ? [{
-			key: "cache",
-			type: "purge"
-		}] : [],
-		...plan.deployment.capabilities.customDomains ? [{
-			key: "ssl_and_certificates",
-			type: "edit"
-		}] : [],
-		...plan.deployment.capabilities.email ? [
-			{
-				key: "zone",
-				type: "read"
-			},
-			{
-				key: "zone_settings",
-				type: "edit"
-			},
-			{
-				key: "email_routing_address",
-				type: "edit"
-			},
-			{
-				key: "email_routing_rule",
-				type: "edit"
-			},
-			{
-				key: "email_sending",
-				type: "edit"
-			}
-		] : []
-	];
-	return {
-		runtime: {
-			title: "Cloudflare runtime token",
-			linkInTitle: true,
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/api-tokens",
-				name: plan.deployment.displayName + " Runtime",
-				permissionGroupKeys: JSON.stringify(permissions)
-			}),
-			instructions: "Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here."
-		},
-		github: {
-			title: "GitHub OAuth App",
-			url: "https://github.com/settings/applications/new",
-			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
-		},
-		r2: {
-			title: "R2 upload token",
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/r2/api-tokens/create",
-				type: "account"
-			}),
-			instructions: [
-				"Select Object Read & Write.",
-				"Keep Apply to all buckets in this account selected.",
-				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
-			].join("\n")
-		}
-	};
-}
-function formatPlatformSetupPlan(plan, options = {}) {
-	const writesDns = plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse");
-	return [
-		"The installation will guide you through setting up the following credentials:",
-		"",
-		...[
-			...options.managementToken ? [options.managementAccess ? `Cloudflare management API token for ${writesDns ? "DNS changes and " : ""}Access setup` : "Cloudflare management API token for DNS changes"] : [],
-			"PostgreSQL database URL",
-			"Cloudflare runtime token",
-			"R2 upload token",
-			...plan.deployment.authentication.providers.includes("github") ? ["GitHub OAuth App client ID and secret"] : [],
-			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
-			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
-			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
-			"JWT signing key and project encryption key"
-		].map((credential) => `• ${credential}`)
-	].join("\n");
-}
-function platformInstallCommandArguments(options) {
-	const parts = [
-		options.commandName,
-		"platform",
-		"install"
-	];
-	const flag = (name, value) => {
-		if (value) parts.push(name, value);
-	};
-	if (options.resumeId) {
-		parts.push("--resume");
-		flag("--name", options.resumeId);
-	} else {
-		flag("--name", options.installationSlug);
-		flag("--account", options.accountId);
-		flag("--display-name", options.displayName);
-		if (options.workersDev) parts.push("--workers-dev");
-		else {
-			flag("--application-domain", options.applicationDomain);
-			flag("--zone", options.zoneName);
-			if (options.dedicatedZone) parts.push("--dedicated-zone");
-			else parts.push("--no-dedicated-zone");
-		}
-		flag("--control-plane-domain", options.controlPlaneDomain);
-		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
-	}
-	flag("--hyperdrive", options.hyperdrive ?? "");
-	flag("--auth-config", options.authConfig ?? "");
-	if (!options.resumeId && options.appAccess) flag("--app-access", options.appAccess);
-	if (!options.authConfig && !options.resumeId && options.authentication) {
-		flag("--login-methods", options.authentication.providers.join(","));
-		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
-	}
-	flag("--dashboard-url", options.dashboardUrl ?? "");
-	flag("--runtime", options.runtime);
-	if (options.yes) parts.push("--yes");
-	return parts;
-}
-function formatPlatformInstallCommand(options) {
-	return platformInstallCommandArguments(options).map((value) => {
-		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
-		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
-	}).join(" ");
-}
-function openPlatformSetupPage(page, dependencies = {}) {
-	log.info((page.linkInTitle ? platformSetupLink(page) : page.title) + "\n" + page.instructions);
-	if (!page.linkInTitle) console.log(platformSetupLink({
-		...page,
-		title: "Open " + page.title
-	}));
-	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
-		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
-	} catch {
-		log.info("Could not open the browser. Use the link above.");
-	}
-}
-//#endregion
 //#region src/cli/platform-access-setup.ts
 function accessSetupGuide() {
 	return platformSetupLink({
@@ -1433,11 +1298,11 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 		let choices;
 		if (options.length === 0) {
 			log.info("No reusable Allow or Deny policies were found in this account. Create an Allow policy for your company, or refresh after saving one.");
-			choices = [answer$2(await select({
+			choices = [platformPromptAnswer(await select({
 				message: "Company Access policies:",
 				options: actions
 			}))];
-		} else choices = answer$2(await multiselect({
+		} else choices = platformPromptAnswer(await multiselect({
 			message: "Company Access policies (select all that apply):",
 			options: [...options, ...actions],
 			initialValues: selectedIds,
@@ -1456,7 +1321,7 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 				title: "Open Cloudflare account",
 				url: `https://dash.cloudflare.com/${encodeURIComponent(accountId)}`
 			}));
-			if (!answer$2(await confirm({
+			if (!platformPromptAnswer(await confirm({
 				message: "Have you saved the new policy?",
 				initialValue: true
 			}))) continue;
@@ -1537,10 +1402,6 @@ function parsePlatformAccessSetupSpec(input) {
 	}
 	return value;
 }
-function answer$2(value) {
-	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
-	return value;
-}
 function secretReference(name) {
 	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || !process.env[name]) throw new Error("platform: Supply the referenced Access credential in the environment.");
 	return process.env[name];
@@ -1579,7 +1440,7 @@ async function preparePlatformAccessSetup(input) {
 			if (input.protection) throw new Error("platform: Protection requires cloudflareAccess create or existing application verification in --auth-config.");
 			return;
 		}
-		const mode = answer$2(await select({
+		const mode = platformPromptAnswer(await select({
 			message: "Cloudflare Access setup:",
 			options: [
 				{
@@ -1602,17 +1463,17 @@ async function preparePlatformAccessSetup(input) {
 		spec = { mode };
 		if (mode === "existing") {
 			log.info("Enter the account that owns your company’s Access configuration. This may differ from the account hosting Void.");
-			spec.accountId = answer$2(await text$1({
+			spec.accountId = platformPromptAnswer(await text$1({
 				message: "Cloudflare identity account ID:",
 				initialValue: input.plan.account.id
 			}));
 			if (input.login) {
 				log.info("Enter the ID of the Access application that provides company sign-in to Void.");
-				spec.loginApplicationId = answer$2(await text$1({ message: "Existing Access OIDC application ID:" }));
+				spec.loginApplicationId = platformPromptAnswer(await text$1({ message: "Existing Access OIDC application ID:" }));
 			}
 			if (input.protection) {
 				log.info("Enter the ID of the Access application that protects the platform’s UI and APIs.");
-				spec.protectionApplicationId = answer$2(await text$1({ message: "Existing Access protection application ID:" }));
+				spec.protectionApplicationId = platformPromptAnswer(await text$1({ message: "Existing Access protection application ID:" }));
 			}
 		}
 	}
@@ -1632,7 +1493,7 @@ async function preparePlatformAccessSetup(input) {
 		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status) || !process.stdin.isTTY || credential) throw error;
 		log.info(`Your current token lacks the required Access permissions for account ${accountId}. Create a token for that account using the permissions in the setup guide.`);
 		console.log(accessSetupGuide());
-		const token = answer$2(await password({ message: "Access setup API token:" }));
+		const token = platformPromptAnswer(await password({ message: "Access setup API token:" }));
 		input.save({ accessManagementToken: token });
 		management = new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl });
 		client = new PlatformAccessClient(management, accountId);
@@ -1641,7 +1502,7 @@ async function preparePlatformAccessSetup(input) {
 		policies = await client.list("policies");
 	}
 	if (!spec.identityProviderIds && process.stdin.isTTY) log.info("Choose how employees sign in—for example, your company’s Okta or Google Workspace connection.");
-	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$2(await multiselect({
+	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? platformPromptAnswer(await multiselect({
 		message: "Company identity providers:",
 		required: true,
 		options: providers.filter((provider) => typeof provider.id === "string").map(platformAccessIdentityProvider).map((provider) => ({
@@ -1676,9 +1537,9 @@ async function preparePlatformAccessSetup(input) {
 		else if (process.stdin.isTTY) {
 			log.info("This lets the installer reach the protected platform during setup. Use a service token allowed by the existing Access application.");
 			serviceToken = {
-				id: answer$2(await text$1({ message: "Existing admitted Access service token ID:" })),
-				clientId: answer$2(await password({ message: "Access service token client ID:" })),
-				clientSecret: answer$2(await password({ message: "Access service token client secret:" }))
+				id: platformPromptAnswer(await text$1({ message: "Existing admitted Access service token ID:" })),
+				clientId: platformPromptAnswer(await password({ message: "Access service token client ID:" })),
+				clientSecret: platformPromptAnswer(await password({ message: "Access service token client secret:" }))
 			};
 			input.save({ accessExistingServiceTokenJson: JSON.stringify(serviceToken) });
 		}
@@ -1699,7 +1560,7 @@ async function preparePlatformAccessSetup(input) {
 	};
 	console.log(JSON.stringify({ accessPlan: reviewed }, null, 2));
 	if (!input.yes) {
-		if (!process.stdin.isTTY || !answer$2(await confirm({
+		if (!process.stdin.isTTY || !platformPromptAnswer(await confirm({
 			message: "Apply this Access configuration?",
 			initialValue: false
 		}))) throw new Error("platform: Access setup changes require confirmation or --yes.");
@@ -1714,7 +1575,7 @@ async function preparePlatformAccessSetup(input) {
 	let loginClientSecret = spec.loginClientSecretEnv ? secretReference(spec.loginClientSecretEnv) : input.checkpoint.accessExistingLoginSecret;
 	if (input.login && spec.mode === "existing" && !loginClientSecret && process.stdin.isTTY) {
 		log.info("Enter the client secret from the existing Access login application’s OIDC settings.");
-		loginClientSecret = answer$2(await password({ message: "Existing Access OIDC client secret:" }));
+		loginClientSecret = platformPromptAnswer(await password({ message: "Existing Access OIDC client secret:" }));
 		input.save({ accessExistingLoginSecret: loginClientSecret });
 	}
 	const result = await provisionPlatformAccess(client, {
@@ -1746,6 +1607,28 @@ async function preparePlatformAccessSetup(input) {
 }
 //#endregion
 //#region src/cli/platform-auth.ts
+/** Use the selected credential for read-only checks before taking lifecycle locks. */
+async function verifyPlatformCloudflareCredential(client, input) {
+	const source = input.source === "saved" ? "saved management token" : input.source === "environment" ? "environment API token" : "Cloudflare browser login";
+	const retry = input.source === "oauth" ? "Run `void cloudflare login`, or set CLOUDFLARE_API_TOKEN for this account, then retry." : "Set CLOUDFLARE_API_TOKEN for this account, then retry.";
+	const check = async (label, permission, action, allowMissing = false) => {
+		try {
+			await action();
+		} catch (cause) {
+			const status = cause instanceof PlatformCloudflareApiError ? cause.status : null;
+			if (status === 404 && allowMissing) return;
+			const detail = status === 401 || status === 403 ? `Check that the credential is valid, scoped to this account, and includes ${permission}. ${retry}` : status === 404 ? "Check the bucket name and account scope before retrying." : status === 429 ? "Cloudflare rate-limited this check. Retry shortly." : "Retry the command after Cloudflare connectivity is restored.";
+			throw new Error(`platform: ${label} is unavailable${status === null ? "" : ` (HTTP ${status})`} using the ${source}. ${detail}`, { cause });
+		}
+	};
+	let accounts = [];
+	await check("Cloudflare account access", "Account → Account Settings → Read", async () => {
+		accounts = await client.listAccounts();
+	});
+	if (!accounts.some((account) => account.id === input.account.id)) throw new Error(`platform: The ${source} cannot access Cloudflare account ${JSON.stringify(input.account.name)} (${input.account.id}). ${retry}`);
+	await check("Cloudflare Workers access", "Account → Workers Scripts → Edit", () => client.listWorkerNames(input.account.id));
+	for (const name of new Set(input.r2Buckets)) await check(`R2 bucket ${JSON.stringify(name)}`, "Account → Workers R2 Storage → Edit", () => client.request(`/accounts/${encodeURIComponent(input.account.id)}/r2/buckets/${encodeURIComponent(name)}`), input.allowMissingR2Buckets);
+}
 /** Check Access inventory permissions before the installer starts provisioning. */
 async function verifyPlatformManagementAccess(client, accountId, access) {
 	const base = `/accounts/${encodeURIComponent(accountId)}/access`;
@@ -1759,8 +1642,8 @@ async function verifyPlatformManagementAccess(client, accountId, access) {
 }
 function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access) {
 	if (!platformOperatorNeedsManagementToken(credential, plan, access)) return;
-	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
+	const createsZone = planCreatesZone(plan);
+	const writesDns = planWritesDns(plan);
 	const permissions = [
 		...createsZone ? ["Account → Zone → Edit"] : [],
 		...writesDns ? ["Zone → DNS → Edit"] : [],
@@ -1773,7 +1656,13 @@ function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access)
 	throw new Error(`platform: Cloudflare browser login cannot authorize the planned ${access ? "Access setup" : "zone or DNS changes"}. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account${createsZone || writesDns ? " and application zone" : ""}, then rerun the command.`);
 }
 function platformOperatorNeedsManagementToken(credential, plan, access) {
-	return credential.source === "oauth" && (!!access || plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse"));
+	return credential.source === "oauth" && (!!access || planCreatesZone(plan) || planWritesDns(plan));
+}
+function planCreatesZone(plan) {
+	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+}
+function planWritesDns(plan) {
+	return plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
 }
 async function resolvePlatformCloudflareCredential(dependencies = {}) {
 	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
@@ -1837,26 +1726,18 @@ async function readExistingCredential(dependencies, runWrangler) {
 	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
 	return await readWranglerOAuthCredential(runWrangler);
 }
-async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
+async function readWranglerOAuthCredential(runWrangler) {
 	const result = await runWrangler({ type: "auth.token" }, true);
 	if (result.status !== 0 || result.signal || result.error) return null;
-	try {
-		const parsed = result.data;
-		if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
-		return {
-			source: "oauth",
-			token: parsed.token.trim()
-		};
-	} catch {
-		return null;
-	}
+	const parsed = result.data;
+	if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+	return {
+		source: "oauth",
+		token: parsed.token.trim()
+	};
 }
 //#endregion
 //#region src/cli/platform-app-access.ts
-function answer$1(value) {
-	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
-	return value;
-}
 async function selectInstallationAppAccess(authentication, recorded, choice) {
 	const config = authentication.file?.appAccess;
 	if (config && (typeof config !== "object" || Array.isArray(config) || "apiToken" in config || config.tokenEnv !== void 0 && (typeof config.tokenEnv !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(config.tokenEnv)))) throw new Error("platform: App access configuration must use tokenEnv; plaintext tokens are not accepted.");
@@ -1872,7 +1753,7 @@ async function selectInstallationAppAccess(authentication, recorded, choice) {
 		return recorded.appAccess;
 	}
 	const protectedPlatform = !!authentication.authentication.accessProtection;
-	const selected = supplied ?? (!process.stdin.isTTY ? protectedPlatform ? "platform" : "public" : answer$1(await select({
+	const selected = supplied ?? (!process.stdin.isTTY ? protectedPlatform ? "platform" : "public" : platformPromptAnswer(await select({
 		message: "Who should be able to access deployed apps?",
 		initialValue: protectedPlatform ? "platform" : "public",
 		options: [
@@ -1943,7 +1824,7 @@ async function prepareInstallationAppAccess(input) {
 	const collectToken = async () => {
 		if (!process.stdin.isTTY) throw new Error("platform: App access requires VOID_PLATFORM_APP_ACCESS_TOKEN or appAccess.tokenEnv in --auth-config, scoped to the hosting account.");
 		tokenPage();
-		const value = String(answer$1(await password({ message: "App access API token (stored encrypted when app rules are needed):" }))).trim();
+		const value = String(platformPromptAnswer(await password({ message: "App access API token (stored encrypted when app rules are needed):" }))).trim();
 		if (!value || /\s/.test(value)) throw new Error("platform: An app access token without whitespace is required.");
 		input.save({
 			appAccessToken: value,
@@ -1987,7 +1868,7 @@ async function prepareInstallationAppAccess(input) {
 	if (!organization) throw new Error(`platform: Enable Zero Trust in account ${input.plan.account.name}, then resume to configure app access.`);
 	if (!token) {
 		log.info("Void needs an Access-management token stored encrypted to manage access for future apps and custom domains.");
-		if (reusable && process.stdin.isTTY && answer$1(await confirm({
+		if (reusable && process.stdin.isTTY && platformPromptAnswer(await confirm({
 			message: "Reuse the setup token for ongoing app access management?",
 			initialValue: true
 		}))) {
@@ -2007,7 +1888,7 @@ async function prepareInstallationAppAccess(input) {
 			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.identityProviderIds in --auth-config for the hosting account.");
 			const providers = (await access.list("identity_providers")).map(platformAccessIdentityProvider);
 			if (!providers.length) throw new Error(`platform: Add an identity provider in Zero Trust for ${input.plan.account.name}, then resume.`);
-			identityProviderIds = answer$1(await multiselect({
+			identityProviderIds = platformPromptAnswer(await multiselect({
 				message: "App identity providers:",
 				required: true,
 				options: providers.map((p) => ({
@@ -2516,7 +2397,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		client.listHyperdriveConfigs(account.id),
 		client.listWorkerNames(account.id)
 	]);
-	const dnsRecords = zone ? await client.listDnsRecords(zone.id, wildcardHostname) : [];
+	const dnsRecords = zone ? await listZoneDnsRecords(client, zone, wildcardHostname) : [];
 	const remoteOwnership = existing ? await readRemoteOwnership(client, account.id, routingKv, existing) : null;
 	const intentProofs = /* @__PURE__ */ new Set();
 	const ambiguousResources = /* @__PURE__ */ new Set();
@@ -2560,7 +2441,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		const matchingDomain = workerDomains.find((domain) => domain.hostname === apiHostname);
 		const expectedWorker = deployment.resources.apiWorker;
 		if (matchingDomain && matchingDomain.service !== expectedWorker) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} is already assigned to Worker ${JSON.stringify(matchingDomain.service)}. Choose another hostname.`);
-		const records = controlPlaneZone ? await client.listDnsRecords(controlPlaneZone.id, apiHostname) : [];
+		const records = controlPlaneZone ? await listZoneDnsRecords(client, controlPlaneZone, apiHostname) : [];
 		const ownedApiWorker = intentProofs.has("api-worker") || existing?.resources.some((resource) => resource.key === "api-worker" && resource.kind === "worker" && resource.name === expectedWorker && resource.state === "ready");
 		if (records.length > 0 && (!matchingDomain || !ownedApiWorker)) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} already has a DNS record that installation would replace. Choose another hostname or remove the record explicitly.`);
 	}
@@ -2926,6 +2807,14 @@ function platformAdoptionIntentHash(manifest, key, kind, id, name) {
 		ownershipNonce: manifest.ownershipNonce
 	})).digest("hex");
 }
+async function listZoneDnsRecords(client, zone, hostname) {
+	try {
+		return await client.listDnsRecords(zone.id, hostname);
+	} catch (error) {
+		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403)) throw new Error(`platform: Cloudflare denied reading DNS records for ${zone.name} (HTTP ${error.status}). Add Zone → DNS → Edit for this zone to the management token, then rerun.`, { cause: error });
+		throw error;
+	}
+}
 async function readRemoteOwnership(client, accountId, routingNamespaces, existing) {
 	for (const namespace of routingNamespaces) {
 		const value = await client.getKvValue(accountId, namespace.id, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY);
@@ -2991,6 +2880,22 @@ function trafficConfigHash(kind, value) {
 		value
 	})).digest("hex");
 }
+/**
+* The installer Worker that a recorded route or custom domain serves, when the
+* record matches exactly what the installer publishes for this deployment.
+*/
+function platformTrafficAttachmentWorker(deployment, resource) {
+	const managed = platformManagedWorkerTraffic(deployment);
+	if (resource.kind === "worker-route") {
+		const target = managed.routes.find((route) => route.pattern === resource.name);
+		return target && trafficConfigHash("worker-route", target) === resource.configHash ? target.script : null;
+	}
+	if (resource.kind === "worker-custom-domain") {
+		const target = managed.customDomains.find((domain) => domain.hostname === resource.name);
+		return target && trafficConfigHash("worker-custom-domain", target) === resource.configHash ? target.service : null;
+	}
+	return null;
+}
 function trackedPlatformWorkerTraffic(_manifest, _workers) {
 	return {
 		customDomains: [],
@@ -3662,7 +3567,7 @@ async function runPlatformWrangler(operation, accountId, cwd, capture) {
 	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
 }
 const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false) {
+async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false, apiToken) {
 	const startedAt = performance.now();
 	const result = await createDefaultRunWrangler(process.cwd(), {
 		launcher: resolveCloudflareOperationArgv(process.cwd()),
@@ -3671,6 +3576,7 @@ async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture,
 	})(operation, {
 		accountId,
 		apiBaseUrl,
+		apiToken,
 		cwd
 	});
 	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
@@ -3802,8 +3708,8 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
 	return result;
 }
-async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl) {
-	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl), upstreamApiBaseUrl);
+async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl, apiToken) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl, false, apiToken), upstreamApiBaseUrl);
 }
 //#endregion
 //#region src/cli/platform-installer-inspection.ts
@@ -4563,7 +4469,7 @@ async function deployPlatformWorker(config, secrets, options) {
 		let uploaded;
 		let uploadError;
 		try {
-			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl);
+			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl, options.operatorApiToken);
 			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
 		} catch (error) {
 			uploadError = error;
@@ -5017,11 +4923,7 @@ async function ensurePlatformAccessHealthChecks(input) {
 				recorded.id = created.id;
 				save();
 			} catch (error) {
-				if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
-					408,
-					409,
-					429
-				].includes(error.status)) {
+				if (platformAccessCreateRejected(error)) {
 					recorded.pending = false;
 					save();
 				}
@@ -5071,7 +4973,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	].map((value) => new URL(value).origin).some((origin) => !origins.includes(origin)) || protection.applications.some((entry) => entry.audience !== app.aud || !platformAccessPublicDestinations(app).includes(new URL(entry.origin).hostname))) throw new Error("platform: Access audiences and complete origin coverage must match the active platform protection. Restore the current Access checkpoint or repair its applications.");
 	for (const other of await access.list("apps")) {
 		if (other.id === app.id) continue;
-		if (platformAccessPublicDestinations(other).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)))) throw new Error("platform: Another Access application overlaps a protected platform origin. Reconcile it before maintenance.");
+		if (platformAccessOverlapsOrigins(other, origins)) throw new Error("platform: Another Access application overlaps a protected platform origin. Reconcile it before maintenance.");
 	}
 	const liveToken = (await access.list("service_tokens")).find((entry) => entry.id === service.id);
 	const expiry = liveToken?.expires_at;
@@ -5082,7 +4984,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DFeJ-JkK.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-zxDr0hWW.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -5343,6 +5245,605 @@ function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
 	}
 }
 //#endregion
+//#region src/cli/platform-teardown.ts
+/**
+* `void platform uninstall --purge-resources` deletes every Cloudflare resource the
+* installation created, in an order Cloudflare accepts:
+*
+*   traffic (routes, custom domains, DNS) -> Access -> Email Routing rules
+*   -> queue consumers -> Workers except tail -> Queues -> dispatch namespace
+*   -> tail Worker -> Hyperdrive and KV -> R2 -> AI Gateway -> routing KV (last)
+*
+* Each resource is proven to belong to this installation right before its
+* DELETE, and Cloudflare refuses a resource that something outside the
+* installation still uses. The only forced DELETE is for a platform Worker
+* that Cloudflare refused while every Worker it names as a dependent is one
+* this installation created: the API and proxy Workers bind to each other, so
+* neither can go first without it. A route, custom domain, DNS
+* record, or Access resource that no longer matches what was recorded is kept
+* and listed with the reason instead of stopping the run. Every finished
+* deletion is checkpointed, so rerunning the command continues where it
+* stopped. The routing KV namespace holds that checkpoint, so uninstall
+* deletes it last.
+*
+* An uninstall without --purge-resources records what it leaves as retained. If it
+* stopped before it finished, --purge-resources considers those resources again.
+*/
+const PURGE_RESOURCES_STEP_PREFIX = "uninstall:purge-resources:";
+const WORKER_ORDER = [
+	"email-gateway-worker",
+	"proxy-worker",
+	"dispatch-worker",
+	"api-worker"
+];
+const PERMISSIONS = {
+	access: "Account → Access: Apps and Policies → Edit",
+	aiGateway: "Account → AI Gateway → Edit",
+	dns: "Zone → DNS → Edit",
+	emailRouting: "Zone → Email Routing Rules → Edit",
+	hyperdrive: "Account → Hyperdrive → Edit",
+	kv: "Account → Workers KV Storage → Edit",
+	queues: "Account → Queues → Edit",
+	r2: "Account → Workers R2 Storage → Edit",
+	routes: "Zone → Workers Routes → Edit",
+	serviceTokens: "Account → Access: Service Tokens → Edit",
+	workers: "Account → Workers Scripts → Edit"
+};
+function isPlatformTailWorker(manifest, resource) {
+	return resource.kind === "worker" && (resource.key === "tail-worker" || resource.name === manifest.deployment.resources.tailWorker);
+}
+function purgeResourcesResumeCommand(manifest) {
+	return `void platform uninstall ${manifest.id} --purge-resources`;
+}
+function accessStepKey(access) {
+	return `${PURGE_RESOURCES_STEP_PREFIX}access:${access.key}`;
+}
+/** Access resources that --purge-resources already deleted. */
+function isPurgedAccessResource(manifest, access) {
+	return manifest.steps.some((step) => step.key === accessStepKey(access));
+}
+function hasStep(manifest, key) {
+	return manifest.steps.some((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${key}`);
+}
+function keptStepKey(key) {
+	return `kept:${key}`;
+}
+/**
+* Why --purge-resources kept a resource it was going to delete, for example because
+* a route now serves another Worker; null when it did not keep it. Access
+* resources use the key `access:<key>`.
+*/
+function purgeResourcesKeptReason(manifest, key) {
+	return manifest.steps.find((step) => step.key === `uninstall:purge-resources:${keptStepKey(key)}`)?.resultHash ?? null;
+}
+/** An uninstall that started has not finished, so what it kept can be reconsidered. */
+function isReopenable(manifest) {
+	return manifest.status !== "uninstalled";
+}
+/**
+* A resource the installation created that --purge-resources may still delete: one
+* that is ready, or one that an uninstall which stopped before it finished
+* recorded as retained. Resources --purge-resources itself kept, and earlier
+* versions of a resource kept when it was replaced, are never reconsidered.
+*/
+function isPurgeResourcesCandidate(manifest, resource) {
+	return resource.ownership === "created" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest) && !resource.key.startsWith("retained:") && purgeResourcesKeptReason(manifest, resource.key) === null);
+}
+/** The zone that routes and DNS records live in, if it can still be used. */
+function usableZone(manifest) {
+	return manifest.resources.find((resource) => resource.key === "zone" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest)));
+}
+/**
+* A recorded resource whose live configuration no longer matches the
+* installation's record. --purge-resources keeps such a DNS record and continues.
+*/
+var PlatformResourceChangedError = class extends Error {
+	resourceKey;
+	reason;
+	constructor(resourceKey, reason, message) {
+		super(message);
+		this.resourceKey = resourceKey;
+		this.reason = reason;
+		this.name = "PlatformResourceChangedError";
+	}
+};
+/** The zone whose Email Routing rules may send mail to the gateway Worker. */
+function emailRoutingZone(manifest) {
+	return manifest.deployment.capabilities.email ? manifest.deployment.emailSharedZoneId ?? null : null;
+}
+/** Everything --purge-resources will delete, in deletion order. */
+function purgeResourcesTargets(manifest) {
+	const resources = manifest.resources;
+	const routing = resources.find((resource) => resource.key === "routing-kv");
+	const candidate = (resource) => isPurgeResourcesCandidate(manifest, resource);
+	if (!routing || routing.state !== "ready" && !candidate(routing)) return [];
+	const zone = usableZone(manifest);
+	const workers = resources.filter((resource) => resource.kind === "worker" && candidate(resource));
+	const targets = [];
+	for (const resource of resources) {
+		if (resource.kind !== "worker-route" && resource.kind !== "worker-custom-domain" || resource.state !== "ready" && resource.state !== "retained" || resource.kind === "worker-route" && !zone || purgeResourcesKeptReason(manifest, resource.key) !== null) continue;
+		const name = platformTrafficAttachmentWorker(manifest.deployment, resource);
+		const worker = workers.find((entry) => entry.name === name);
+		if (worker) targets.push({
+			phase: "traffic",
+			resource,
+			worker
+		});
+	}
+	for (const resource of resources) if (resource.kind === "dns-record" && candidate(resource) && zone) targets.push({
+		phase: "dns",
+		resource
+	});
+	const access = (manifest.authenticationResources ?? []).filter((entry) => entry.ownership === "created" && !isPurgedAccessResource(manifest, entry) && purgeResourcesKeptReason(manifest, `access:${entry.key}`) === null);
+	for (const kind of ["application", "service-token"]) for (const entry of access.filter((candidate) => candidate.kind === kind)) targets.push({
+		phase: "access",
+		access: entry
+	});
+	const gateway = workers.find((worker) => worker.key === "email-gateway-worker");
+	if (gateway && emailRoutingZone(manifest) && !hasStep(manifest, "email-routing")) targets.push({
+		phase: "email",
+		resource: gateway
+	});
+	const queues = resources.filter((resource) => resource.kind === "queue" && candidate(resource));
+	for (const resource of queues) if (!hasStep(manifest, `consumers:${resource.key}`)) targets.push({
+		phase: "queue-consumers",
+		resource
+	});
+	const rank = (resource) => {
+		const index = WORKER_ORDER.indexOf(resource.key);
+		return index < 0 ? WORKER_ORDER.length : index;
+	};
+	for (const resource of workers.filter((worker) => !isPlatformTailWorker(manifest, worker)).sort((left, right) => rank(left) - rank(right) || left.key.localeCompare(right.key))) targets.push({
+		phase: "workers",
+		resource
+	});
+	for (const resource of queues) targets.push({
+		phase: "queues",
+		resource
+	});
+	for (const resource of resources) if (resource.kind === "dispatch-namespace" && candidate(resource)) targets.push({
+		phase: "dispatch",
+		resource
+	});
+	for (const resource of workers.filter((worker) => isPlatformTailWorker(manifest, worker))) targets.push({
+		phase: "tail",
+		resource
+	});
+	for (const kind of ["hyperdrive", "kv-namespace"]) for (const resource of resources) if (resource.kind === kind && resource.key !== "routing-kv" && candidate(resource)) targets.push({
+		phase: "data",
+		resource
+	});
+	for (const kind of ["r2-bucket", "ai-gateway"]) for (const resource of resources) if (resource.kind === kind && candidate(resource)) targets.push({
+		phase: kind === "r2-bucket" ? "r2" : "ai-gateway",
+		resource
+	});
+	if (candidate(routing)) targets.push({
+		phase: "routing",
+		resource: routing
+	});
+	return targets;
+}
+/** Whether --purge-resources removes, or has removed, the rules that send mail to the gateway Worker. */
+function purgeResourcesHandlesEmailRouting(manifest) {
+	return hasStep(manifest, "email-routing") || purgeResourcesTargets(manifest).some((target) => target.phase === "email");
+}
+/** Manifest resources that --purge-resources leaves in the account. */
+function purgeResourcesKeptResources(manifest) {
+	const targets = new Set(purgeResourcesTargets(manifest).flatMap((target) => "resource" in target ? [target.resource.key] : []));
+	return manifest.resources.filter((resource) => (resource.state === "ready" || resource.state === "retained") && !targets.has(resource.key));
+}
+function resourceLabel(resource) {
+	return `${resource.kind}: ${resource.name}${resource.name === resource.id ? "" : ` (${resource.id})`}`;
+}
+/** Plan lines for --purge-resources: what is deleted, in order, then what is kept. */
+function describePurgeResourcesPlan(manifest) {
+	const targets = purgeResourcesTargets(manifest);
+	const lines = [];
+	let step = 0;
+	let previous = null;
+	const consumerQueues = [];
+	for (const target of targets) {
+		if (target.phase === "email") {
+			step++;
+			previous = target.phase;
+			lines.push(`  ${step}. Email Routing rules in zone ${emailRoutingZone(manifest)} that send mail to ${target.resource.name}, and its catch-all rule if it does (reset to drop mail, disabled)`);
+			continue;
+		}
+		if (target.phase !== previous) {
+			step++;
+			previous = target.phase;
+		}
+		const prefix = `  ${step}. `;
+		if (target.phase === "traffic") lines.push(`${prefix}${resourceLabel(target.resource)} -> ${target.worker.name}`);
+		else if (target.phase === "access") lines.push(`${prefix}Access ${target.access.kind}: ${target.access.name} (${target.access.id})`);
+		else if (target.phase === "queue-consumers") {
+			consumerQueues.push(target.resource.name);
+			if (consumerQueues.length === 1) lines.push(`${prefix}queue consumers run by this installation's Workers on:`);
+			lines.push(`       ${target.resource.name}`);
+		} else if (target.phase === "dispatch") lines.push(`${prefix}${resourceLabel(target.resource)}, with any application Workers still in it`);
+		else if (target.phase === "tail") lines.push(`${prefix}${resourceLabel(target.resource)}, the tail Worker, after the others`);
+		else if (target.phase === "workers" && target.resource.key === "api-worker") lines.push(`${prefix}${resourceLabel(target.resource)}, with its Durable Object data`);
+		else if (target.phase === "r2") lines.push(`${prefix}${resourceLabel(target.resource)}, emptied first`);
+		else if (target.phase === "ai-gateway") lines.push(`${prefix}${resourceLabel(target.resource)}, if Cloudflare shows it was created during installation; otherwise kept`);
+		else if (target.phase === "routing") lines.push(`${prefix}${resourceLabel(target.resource)}, last; it holds uninstall progress`);
+		else lines.push(`${prefix}${resourceLabel(target.resource)}`);
+	}
+	return lines.length ? ["Delete every resource this installation created (--purge-resources), in this order:", ...lines] : ["--purge-resources finds no resource it can prove this installation created."];
+}
+/** Lines naming what --purge-resources never removes. */
+function purgeResourcesAlwaysKept() {
+	return [
+		"  The external PostgreSQL database and its data.",
+		"  Analytics Engine datasets; Cloudflare has no API to delete them.",
+		"  Access policies and identity providers you chose.",
+		"  API tokens you created for this platform. Revoke them in the Cloudflare dashboard."
+	];
+}
+/** Token permissions --purge-resources needs for this manifest. */
+function purgeResourcesPermissions(manifest) {
+	const targets = purgeResourcesTargets(manifest);
+	const needed = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		if (target.phase === "access") {
+			needed.add(target.access.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens);
+			continue;
+		}
+		if (target.phase === "email") {
+			needed.add(PERMISSIONS.emailRouting);
+			continue;
+		}
+		const { kind } = target.resource;
+		if (kind === "worker-route") needed.add(PERMISSIONS.routes);
+		else if (kind === "worker" || kind === "worker-custom-domain" || kind === "dispatch-namespace") needed.add(PERMISSIONS.workers);
+		else if (kind === "dns-record") needed.add(PERMISSIONS.dns);
+		else if (kind === "queue") needed.add(PERMISSIONS.queues);
+		else if (kind === "kv-namespace") needed.add(PERMISSIONS.kv);
+		else if (kind === "hyperdrive") needed.add(PERMISSIONS.hyperdrive);
+		else if (kind === "r2-bucket") needed.add(PERMISSIONS.r2);
+		else if (kind === "ai-gateway") needed.add(PERMISSIONS.aiGateway);
+	}
+	return Object.values(PERMISSIONS).filter((permission) => needed.has(permission));
+}
+function deniedStatus(error) {
+	return error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403);
+}
+/**
+* Check resource reads before the first change. Browser login cannot change
+* DNS or Access, so those need an API token. Read probes cannot prove Edit;
+* the plan lists the required permissions.
+*/
+async function checkPurgeResourcesCredentials(client, manifest, credential) {
+	const targets = purgeResourcesTargets(manifest);
+	const resources = targets.flatMap((target) => "resource" in target ? [target.resource] : []);
+	const access = targets.flatMap((target) => "access" in target ? [target.access] : []);
+	const has = (kind) => resources.some((resource) => resource.kind === kind);
+	const zone = manifest.resources.find((resource) => resource.key === "zone");
+	const emailZone = targets.some((target) => target.phase === "email") ? emailRoutingZone(manifest) : null;
+	const accounts = [.../* @__PURE__ */ new Set([manifest.account.id, ...access.map((entry) => entry.accountId)])];
+	const scope = `${accounts.length === 1 ? "account" : "accounts"} ${accounts.join(" and ")}${has("dns-record") || has("worker-route") ? ` and zone ${zone?.name ?? ""}` : ""}${emailZone ? ` and Email Routing zone ${emailZone}` : ""}`;
+	if (credential.source === "oauth") {
+		const browserMissing = [
+			...has("dns-record") ? [PERMISSIONS.dns] : [],
+			...access.some((entry) => entry.kind === "application") ? [PERMISSIONS.access] : [],
+			...access.some((entry) => entry.kind === "service-token") ? [PERMISSIONS.serviceTokens] : [],
+			...has("ai-gateway") && !credential.aiGatewayToken ? [PERMISSIONS.aiGateway] : []
+		];
+		if (browserMissing.length) throw new Error(`platform: Cloudflare browser login cannot delete every resource --purge-resources plans. Set CLOUDFLARE_API_TOKEN to a token with ${purgeResourcesPermissions(manifest).join(", ")}, scoped to ${scope}, then rerun. Browser login is missing: ${browserMissing.join(", ")}. No Cloudflare resource was changed.`);
+	}
+	const probes = [];
+	if (has("worker") || has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerNames(manifest.account.id)]);
+	if (has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerDomains(manifest.account.id)]);
+	if (has("worker-route") && zone) probes.push([PERMISSIONS.routes, () => client.listWorkerRoutes(zone.id)]);
+	for (const resource of resources) if (resource.kind === "dns-record" && zone) probes.push([PERMISSIONS.dns, () => client.listDnsRecords(zone.id, resource.name)]);
+	else if (resource.kind === "queue") probes.push([PERMISSIONS.queues, () => client.listQueueConsumers(manifest.account.id, resource.id)]);
+	for (const entry of access) probes.push([entry.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens, () => client.getAccessResource(entry.accountId, entry.kind, entry.id)]);
+	if (emailZone) probes.push([PERMISSIONS.emailRouting, () => client.listEmailRoutingRules(emailZone)]);
+	if (has("dispatch-namespace")) probes.push([PERMISSIONS.workers, () => client.listDispatchNamespaces(manifest.account.id)]);
+	if (has("kv-namespace")) probes.push([PERMISSIONS.kv, () => client.listKvNamespaces(manifest.account.id)]);
+	if (has("hyperdrive")) probes.push([PERMISSIONS.hyperdrive, () => client.listHyperdriveConfigs(manifest.account.id)]);
+	if (has("r2-bucket")) probes.push([PERMISSIONS.r2, () => client.listR2Buckets(manifest.account.id)]);
+	if (has("ai-gateway")) probes.push([PERMISSIONS.aiGateway, () => client.listAiGateways(manifest.account.id)]);
+	const missing = /* @__PURE__ */ new Set();
+	for (const [permission, probe] of probes) try {
+		await probe();
+	} catch (error) {
+		if (!deniedStatus(error)) throw error;
+		missing.add(permission);
+	}
+	if (missing.size) throw new Error(`platform: The Cloudflare credential cannot read every resource --purge-resources would delete. Add ${[...missing].join(", ")} for ${scope}, then rerun. No Cloudflare resource was changed.`);
+}
+const LISTED_PROJECTS = 20;
+/** Slugs of every project row, including projects whose deletion stopped partway. */
+async function readPlatformProjectSlugsConnection(client) {
+	if ((await client.query(`SELECT to_regclass('public.projects') IS NOT NULL AS "present"`)).rows[0]?.present !== true) return [];
+	return (await client.query("SELECT \"slug\" FROM \"projects\" ORDER BY \"slug\"")).rows.map((row) => row.slug);
+}
+/**
+* Projects own Workers, storage, and domains that only the running platform
+* can delete. --purge-resources deletes the platform, so it refuses before any
+* change while a project remains.
+*/
+async function assertNoPlatformProjects(read) {
+	let slugs;
+	try {
+		if (!read) throw new Error("no platform database connection is available");
+		slugs = await read();
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
+		throw new Error(`platform: Refusing --purge-resources because the project list could not be read from the platform database: ${reason}\nMake the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry.`);
+	}
+	if (slugs.length) throw new Error([
+		`platform: Refusing --purge-resources while the platform still has ${slugs.length === 1 ? "1 project" : `${slugs.length} projects`}.`,
+		"--purge-resources deletes the platform, and only the running platform can delete each project's Workers, storage, and domains.",
+		"Delete each project first with `void project delete <name>`, then retry:",
+		...slugs.slice(0, LISTED_PROJECTS).map((slug) => `  ${slug}`),
+		...slugs.length > LISTED_PROJECTS ? [`  …and ${slugs.length - LISTED_PROJECTS} more`] : []
+	].join("\n"));
+}
+const AI_GATEWAY_CREATION_WINDOW_MS = 6e5;
+/**
+* AI Gateway ids are chosen by the caller and can be reused after a delete,
+* and gateways carry no ownership marker. Only a creation time next to the
+* installer's provision intent shows that this is the gateway it created.
+*/
+function createdDuringInstallation(manifest, resource, createdAt) {
+	const created = createdAt === void 0 ? NaN : Date.parse(createdAt);
+	if (Number.isNaN(created)) return false;
+	return manifest.steps.some((step) => (step.key === `provision-intent:${resource.key}` || step.key.startsWith(`provision-intent:${resource.key}:`)) && Math.abs(created - Date.parse(step.completedAt)) <= AI_GATEWAY_CREATION_WINDOW_MS);
+}
+function ownershipRefusal(manifest, description, reason) {
+	return /* @__PURE__ */ new Error(`platform: Refusing to delete ${description} because ${reason}. It may no longer belong to this installation. Delete or fix it in the Cloudflare dashboard if it is yours, then rerun: ${purgeResourcesResumeCommand(manifest)}`);
+}
+function cloudflareRefusal(manifest, description, error, hint) {
+	if (!(error instanceof PlatformCloudflareApiError)) return error;
+	return new Error(`platform: Cloudflare refused to delete ${description}: ${error.message}\n${hint}\nProgress is saved. Rerun: ${purgeResourcesResumeCommand(manifest)}`, { cause: error });
+}
+/**
+* Delete every target in order. Returns the manifest with each deleted
+* resource recorded; routing KV is left for the caller to delete last.
+*/
+async function runPurgeResourcesTeardown(context, initial) {
+	const { client } = context;
+	let next = initial;
+	const accountId = next.account.id;
+	const save = async (manifest) => {
+		next = manifest;
+		await context.checkpoint(next);
+	};
+	const markDeleted = async (key) => {
+		const resource = next.resources.find((entry) => entry.key === key);
+		await save(recordInstallationResource(next, {
+			...resource,
+			state: "deleted"
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+	};
+	const recordStep = async (key, resultHash = "completed") => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await save(recordInstallationStep(next, {
+			completedAt: now,
+			key: `${PURGE_RESOURCES_STEP_PREFIX}${key}`,
+			resultHash
+		}, now));
+	};
+	/**
+	* Live proof for these keys. A resource an earlier uninstall recorded as
+	* retained is proven like a ready one; only its recorded state differs.
+	*/
+	const verify = (keys) => context.verify({
+		...next,
+		resources: next.resources.map((resource) => keys.has(resource.key) && resource.state === "retained" ? {
+			...resource,
+			state: "ready"
+		} : resource)
+	}, keys);
+	/**
+	* Prove the resource; false when it is already gone (and recorded).
+	*
+	* Cloudflare has no conditional DELETE: Workers and dispatch namespaces are
+	* addressed by name, and a route or custom domain can be changed in place.
+	* Something replaced between this proof and the DELETE can still be removed.
+	* That one-request window is accepted because --purge-resources is opt-in and its
+	* plan lists every resource first. A forced Worker DELETE has the same
+	* window between reading its dependents and the DELETE.
+	*/
+	const prove = async (resource) => {
+		if ((await verify(/* @__PURE__ */ new Set(["routing-kv", resource.key]))).has(resource.key)) {
+			await markDeleted(resource.key);
+			return false;
+		}
+		return true;
+	};
+	/** Keep a resource that no longer matches the record, and save why. */
+	const keep = async (key, reason) => {
+		const resource = next.resources.find((entry) => entry.key === key);
+		if (resource?.state === "ready") await save(recordInstallationResource(next, {
+			...resource,
+			state: "retained"
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+		await recordStep(keptStepKey(key), reason);
+	};
+	const remove = async (resource, hint, zoneId) => {
+		if (!await prove(resource)) return;
+		try {
+			await client.deleteResource(accountId, resource, zoneId);
+		} catch (error) {
+			throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, hint);
+		}
+		await markDeleted(resource.key);
+	};
+	const zone = usableZone(next);
+	const createdWorkerNames = new Set(next.resources.filter((resource) => resource.kind === "worker" && resource.ownership === "created").map((resource) => resource.name));
+	/** The recorded Worker under this name that this run still deletes, if any. */
+	const workerTarget = (name) => next.resources.find((resource) => resource.kind === "worker" && resource.name === name && isPurgeResourcesCandidate(next, resource));
+	const workerHint = "A Worker this installation did not create may still use it, for example by sending it logs as a tail Worker or through a service binding. Remove that link in the Cloudflare dashboard.";
+	/**
+	* Delete a platform Worker. When Cloudflare refuses because other Workers
+	* still bind to it, force the DELETE only if each of them is a Worker this
+	* run deletes too and still carries this installation's ownership marker.
+	*/
+	const removeWorker = async (resource) => {
+		if (!await prove(resource)) return;
+		try {
+			await client.deleteResource(accountId, resource);
+		} catch (error) {
+			if (!(error instanceof PlatformCloudflareApiError)) throw error;
+			const dependents = await client.listWorkerDependents(accountId, resource.name).catch(() => null);
+			const outside = dependents?.workers.filter((name) => !workerTarget(name)) ?? [];
+			const keys = outside.length ? [] : dependents?.workers.map((name) => workerTarget(name).key) ?? [];
+			const missing = dependents && !dependents.pagesFunction && keys.length ? await verify(/* @__PURE__ */ new Set(["routing-kv", ...keys])) : null;
+			if (!dependents || dependents.pagesFunction || dependents.workers.length === 0 || outside.length > 0 || !missing || keys.some((key) => missing.has(key))) throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, outside.length ? `Workers outside this installation still use it: ${outside.join(", ")}. Remove that link in the Cloudflare dashboard.` : workerHint);
+			try {
+				await client.forceDeleteWorker(accountId, resource.name);
+			} catch (forced) {
+				throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, forced, workerHint);
+			}
+		}
+		await markDeleted(resource.key);
+	};
+	for (const target of purgeResourcesTargets(initial)) {
+		if (target.phase === "access") {
+			const { access } = target;
+			const live = await client.getAccessResource(access.accountId, access.kind, access.id);
+			if (live) {
+				if (live.name !== access.name || !access.name.startsWith(`void-${next.id}-`)) {
+					await keep(`access:${access.key}`, `its live name ${JSON.stringify(live.name)} is not the name this installation recorded`);
+					continue;
+				}
+				try {
+					await client.deleteAccessResource(access.accountId, access.kind, access.id);
+				} catch (error) {
+					throw cloudflareRefusal(next, `Access ${access.kind} ${access.name}`, error, "Check that nothing outside this installation still uses it.");
+				}
+			}
+			await recordStep(`access:${access.key}`);
+			continue;
+		}
+		const current = next.resources.find((resource) => resource.key === target.resource.key);
+		if (!current || current.state === "deleted" || purgeResourcesKeptReason(next, current.key) !== null || target.phase !== "traffic" && !isPurgeResourcesCandidate(next, current)) continue;
+		switch (target.phase) {
+			case "traffic": {
+				const worker = next.resources.find((resource) => resource.key === target.worker.key);
+				if (!worker || !isPurgeResourcesCandidate(next, worker) || !await prove(worker)) break;
+				if (current.kind === "worker-route") {
+					const live = (await client.listWorkerRoutes(zone.id)).find((route) => route.id === current.id);
+					if (live && (live.pattern !== current.name || live.script !== worker.name)) {
+						await keep(current.key, `it now sends ${JSON.stringify(live.pattern)} to ${JSON.stringify(live.script)}`);
+						break;
+					}
+					if (live) await client.deleteWorkerRoute(zone.id, current.id);
+				} else {
+					const live = (await client.listWorkerDomains(accountId)).find((domain) => domain.id === current.id);
+					if (live && (live.hostname !== current.name || live.service !== worker.name)) {
+						await keep(current.key, `it now sends ${JSON.stringify(live.hostname)} to ${JSON.stringify(live.service)}`);
+						break;
+					}
+					if (live) await client.deleteWorkerDomain(accountId, current.id);
+				}
+				await markDeleted(current.key);
+				break;
+			}
+			case "dns":
+				try {
+					await remove(current, "Check the record in the Cloudflare dashboard.", zone.id);
+				} catch (error) {
+					if (!(error instanceof PlatformResourceChangedError && error.resourceKey === current.key)) throw error;
+					await keep(current.key, error.reason);
+				}
+				break;
+			case "email": {
+				if (!await prove(current)) break;
+				const zoneId = emailRoutingZone(next);
+				const hint = "Check the Email Routing rules for this zone in the Cloudflare dashboard. Never disable Email Routing for the zone.";
+				try {
+					for (const rule of await client.listEmailRoutingRules(zoneId)) if (rule.workerName === current.name) await client.deleteEmailRoutingRule(zoneId, rule.id);
+					if ((await client.getEmailRoutingCatchAll(zoneId))?.workerName === current.name) await client.resetEmailRoutingCatchAll(zoneId);
+				} catch (error) {
+					throw cloudflareRefusal(next, `Email Routing rules that send mail to ${current.name}`, error, hint);
+				}
+				await recordStep("email-routing");
+				break;
+			}
+			case "queue-consumers":
+				if (!await prove(current)) break;
+				for (const consumer of await client.listQueueConsumers(accountId, current.id)) if (consumer.script && createdWorkerNames.has(consumer.script)) await client.deleteQueueConsumer(accountId, current.id, consumer.id);
+				await recordStep(`consumers:${current.key}`);
+				break;
+			case "workers":
+				await removeWorker(current);
+				break;
+			case "tail":
+				await remove(current, workerHint);
+				break;
+			case "queues":
+				await remove(current, "A Worker this installation did not create may still use the Queue as a producer or consumer. Remove it from that Worker in the Cloudflare dashboard.");
+				break;
+			case "dispatch": {
+				if (!await prove(current)) break;
+				const projects = await context.readProjects();
+				if (projects.length) throw new Error(`platform: Stopped before deleting the application Workers in dispatch namespace ${current.name} because ${projects.length === 1 ? "a project was" : "projects were"} created while this uninstall ran: ${projects.join(", ")}. Nothing in the namespace was deleted. --purge-resources refuses while the platform database lists a project. Remove each one from the "projects" table once you have dealt with its Cloudflare resources, then rerun: ${purgeResourcesResumeCommand(next)}`);
+				for (const script of await client.listDispatchNamespaceScripts(accountId, current.name)) try {
+					await client.deleteDispatchNamespaceScript(accountId, current.name, script);
+				} catch (error) {
+					throw cloudflareRefusal(next, `application Worker ${script}`, error, workerHint);
+				}
+				try {
+					await client.deleteResource(accountId, current);
+				} catch (error) {
+					throw cloudflareRefusal(next, `dispatch-namespace ${current.name}`, error, "Check the namespace in the Cloudflare dashboard.");
+				}
+				await markDeleted(current.key);
+				break;
+			}
+			case "ai-gateway": {
+				const live = (await client.listAiGateways(accountId)).find((gateway) => gateway.id === current.id && gateway.name === current.name);
+				if (live && !createdDuringInstallation(next, current, live.createdAt)) {
+					await keep(current.key, "Cloudflare does not show it was created during installation");
+					break;
+				}
+				await remove(current, "Check that nothing outside this installation still uses it.");
+				break;
+			}
+			case "data":
+				await remove(current, "Check that nothing outside this installation still uses it.");
+				break;
+			case "r2": await purgeBucket(current);
+		}
+	}
+	return next;
+	async function purgeBucket(bucket) {
+		const markerStep = `r2-marker:${bucket.key}`;
+		if (!hasStep(next, markerStep)) {
+			if (!await prove(bucket)) return;
+			await client.emptyR2Bucket(accountId, bucket.name, /* @__PURE__ */ new Set([PLATFORM_R2_OWNERSHIP_MARKER_KEY]), async () => {
+				if ((await verify(/* @__PURE__ */ new Set(["routing-kv", bucket.key]))).has(bucket.key)) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "it disappeared while it was being emptied");
+			});
+			if (!await prove(bucket)) return;
+			const generation = await context.bucketGeneration(next, bucket);
+			if (generation === null) {
+				await markDeleted(bucket.key);
+				return;
+			}
+			await recordStep(markerStep, generation);
+			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
+		} else {
+			const saved = next.steps.find((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${markerStep}`);
+			const generation = await context.bucketGeneration(next, bucket);
+			if (generation === null) {
+				await markDeleted(bucket.key);
+				return;
+			}
+			if (generation !== saved?.resultHash) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "its creation fingerprint changed");
+			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
+		}
+		try {
+			await client.deleteResource(accountId, bucket);
+		} catch (error) {
+			throw cloudflareRefusal(next, `r2-bucket ${bucket.name}`, error, "Cloudflare deletes only empty buckets. If objects were added after it was emptied, delete them in the Cloudflare dashboard.");
+		}
+		await markDeleted(bucket.key);
+	}
+}
+//#endregion
 //#region src/cli/platform-zero-trust-uninstall.ts
 /**
 * Uninstall turns off the platform API, and only that API can remove the
@@ -5444,8 +5945,9 @@ async function readPlatformProjectZeroTrustStateConnection(client) {
 }
 /**
 * Take the Zero Trust configuration lock exclusively on this session. Every
-* API path that records or creates a Void-managed Access application holds
-* the same lock, so none can commit until the returned release runs.
+* API path that records or creates a Void-managed Access application or
+* creates a project holds the same lock, so none can commit until the
+* returned release runs.
 */
 async function lockPlatformProjectZeroTrustConnection(client) {
 	await client.query(`SELECT pg_advisory_lock(${ZERO_TRUST_LOCK})`);
@@ -5689,6 +6191,21 @@ async function readPlatformProjectZeroTrustState(databaseUrl, installationId, ow
 		await pool.end();
 	}
 }
+/** Read project slugs for a --purge-resources plan, which holds no lifecycle lock. */
+async function readPlatformProjectSlugs(databaseUrl, installationId, ownershipNonce) {
+	if (!databaseUrl) throw new Error("the installation database URL is not recorded on this machine");
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: platformDatabaseClientUrl(databaseUrl),
+		max: 1
+	});
+	try {
+		await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
+		return await readPlatformProjectSlugsConnection(pool);
+	} finally {
+		await pool.end();
+	}
+}
 async function inspectPlatformDatabaseStateConnection(client, database) {
 	const relation = await client.query(`SELECT to_regclass('"drizzle"."__drizzle_migrations"')::text AS "relation"`);
 	if (relation.rows.length === 0 || relation.rows[0]?.relation === null) return {
@@ -5817,6 +6334,7 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 		} : null;
 	};
 	release.readProjectZeroTrust = () => readPlatformProjectZeroTrustStateConnection(client);
+	release.readProjects = () => readPlatformProjectSlugsConnection(client);
 	release.lockProjectZeroTrust = () => lockPlatformProjectZeroTrustConnection(client);
 	release.fenceProjectZeroTrust = () => fencePlatformProjectZeroTrustConnection(client);
 	release.liftProjectZeroTrustFence = () => liftPlatformProjectZeroTrustFenceConnection(client);
@@ -6005,7 +6523,7 @@ async function claimPlatformDatabaseConnection(client, installationId, ownership
 		if (!claim) {
 			const contents = await client.query(`SELECT "schemaname", "tablename"
          FROM "pg_catalog"."pg_tables"
-         WHERE "schemaname" = ANY (current_schemas(false))
+         WHERE ("schemaname" = ANY (current_schemas(false)) OR "schemaname" = 'drizzle')
            AND "tablename" <> '__void_platform_installation'
          ORDER BY "schemaname", "tablename"
          LIMIT 1`);
@@ -6209,6 +6727,7 @@ async function uploadInstallationWorkers(input) {
 		const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
 		const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
 			apiBaseUrl: cloudflareApiBaseUrl,
+			operatorApiToken: dependencies.operatorApiToken,
 			...parallelWorkerUploads ? {
 				acquireUploadSlot,
 				onReadyForActivation,
@@ -6388,8 +6907,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
 	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl);
-	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true);
+	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, false, dependencies.operatorApiToken);
+	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true, dependencies.operatorApiToken);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
@@ -6986,10 +7505,6 @@ function platformManagementAccessForAuthentication(selection, accountId, checkpo
 		readOnly: spec?.mode === "existing"
 	};
 }
-function answer(value) {
-	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
-	return value;
-}
 async function selectInstallationAuthentication(file, recorded, choices = {}) {
 	if (file) {
 		const input = JSON.parse(await readFile(file, "utf8"));
@@ -7014,7 +7529,7 @@ async function selectInstallationAuthentication(file, recorded, choices = {}) {
 		return { authentication: recorded };
 	}
 	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
-	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : answer(await multiselect({
+	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : platformPromptAnswer(await multiselect({
 		message: "Platform login methods (select all that apply):",
 		initialValues: [],
 		required: true,
@@ -7037,7 +7552,7 @@ async function selectInstallationAuthentication(file, recorded, choices = {}) {
 			}
 		]
 	})));
-	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : answer(await confirm({
+	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : platformPromptAnswer(await confirm({
 		message: "Also protect the platform UI and APIs with Cloudflare Access?",
 		initialValue: false
 	})));
@@ -7060,7 +7575,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	}
 	const prompt = async (message, initialValue = "", masked = false) => {
 		if (!process.stdin.isTTY) throw new Error(`platform: ${message} Supply it through --auth-config and environment references.`);
-		return masked ? answer(await password({ message })) : answer(await text$1({
+		return masked ? platformPromptAnswer(await password({ message })) : platformPromptAnswer(await text$1({
 			message,
 			initialValue
 		}));
@@ -7127,7 +7642,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 		save({ [partialKey]: JSON.stringify(connection) });
 		connections.push(connection);
 	}
-	const administratorConnectionId = selection.file?.administratorConnectionId ?? (connections.length === 1 ? connections[0].configuration.id : process.stdin.isTTY ? answer(await select({
+	const administratorConnectionId = selection.file?.administratorConnectionId ?? (connections.length === 1 ? connections[0].configuration.id : process.stdin.isTTY ? platformPromptAnswer(await select({
 		message: "Login method for the first administrator:",
 		options: connections.map((entry) => ({
 			value: entry.configuration.id,
@@ -7158,7 +7673,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	} : { mode: "restricted" });
 	if (!selection.file && !protection && process.stdin.isTTY) {
 		const eligible = connections.filter((entry) => entry.configuration.kind !== "github" && (entry.configuration.kind !== "google" || entry.configuration.allowedDomains.length > 0));
-		const mode = answer(await select({
+		const mode = platformPromptAnswer(await select({
 			message: "Who can create an account?",
 			initialValue: eligible.length ? "company" : "restricted",
 			options: [
@@ -7176,7 +7691,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 				}
 			]
 		}));
-		const ids = mode === "company" ? answer(await multiselect({
+		const ids = mode === "company" ? platformPromptAnswer(await multiselect({
 			message: "Company login methods that qualify new users:",
 			required: true,
 			initialValues: eligible.map((entry) => entry.configuration.id),
@@ -7361,24 +7876,25 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-CUdY064e.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-p0kobLV8.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-WOZ95Uze.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-PvNS9Nl2.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
 			return;
 		}
-		for (const manifest of recovered) log.success(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
+		for (const manifest of recovered) log.step(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
+		printSuccess(`Recovered ${recovered.length} platform installation${recovered.length === 1 ? "" : "s"}.`);
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-Bp6aoH2C.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-oi-SvI3f.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7551,7 +8067,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Bp6aoH2C.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-oi-SvI3f.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -7914,6 +8430,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		const result = await installPlatform(plan, secrets, existing, {
 			acquireDatabaseLifecycleLock: acquirePlatformDatabaseLifecycleLock,
 			client,
+			operatorApiToken: managementApiToken || operatorCredential.token,
 			runtime,
 			healthCheckResumeCommand: `${cliCommandName()} platform install --resume --name ${existing.id}`,
 			onProgress: (message) => progress?.message(message),
@@ -7955,7 +8472,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Bp6aoH2C.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-oi-SvI3f.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -7979,7 +8496,6 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
-		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 		log.info(`API URL: ${plan.apiUrl}`);
 		if (result.emailOperationId) log.info(`Shared email routing ready. Operation: ${result.emailOperationId}.`);
 		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
@@ -7989,7 +8505,8 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			log.info("Confirm your identity in the browser, then test and enable any additional login methods in Settings.");
 		}
 		if (!plan.deployment.application.zoneName) log.info("Apps will use workers.dev addresses. When your domain is ready: void platform domain set <domain>");
-		outro("Run `void account login`, then deploy an app with `void deploy --platform void`.");
+		log.info("Run `void account login`, then deploy an app with `void deploy --platform void`.");
+		printSuccess(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 	} catch (error) {
 		progress?.error("Platform installation failed.");
 		progress = void 0;
@@ -8107,4 +8624,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { PlatformCloudflareClient as A, revalidatePlatformInstallAction as C, checkpointPlatformAccessResources as D, resolvePlatformCloudflareCredential as E, hyperdriveOriginFromConnectionString as M, hyperdriveOriginMatches as N, parsePlatformAccessSetupSpec as O, verifyPlatformRuntimeTokenPermissions as P, platformProvisionIntentHash as S, assertPlatformOperatorCredentialCanApplyPlan as T, recordPlatformWorkerTraffic as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, formatPlatformInstallPlan as b, acquirePlatformDatabaseLifecycleLockConnection as c, assertProjectZeroTrustAllowsUninstall as d, loadPlatformRuntime as f, recordResource as g, resolveBootstrapGitHubId as h, verifyPlatformAiGatewayPlan as i, hyperdriveOriginConfigHash as j, preparePlatformAccessSetup as k, platformDatabaseClientUrl as l, createPlatformInstallationSecrets as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, createPlatformHealthProbeToken as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectZeroTrustState as u, trackedPlatformWorkerTraffic as v, platformDatabaseNameFromOwnerUrl as w, platformAdoptionIntentHash as x, createPlatformInstallPlan as y };
+export { resolveBootstrapGitHubId as A, assertPlatformOperatorCredentialCanApplyPlan as B, purgeResourcesKeptReason as C, loadPlatformRuntime as D, runPurgeResourcesTeardown as E, formatPlatformInstallPlan as F, preparePlatformAccessSetup as G, verifyPlatformCloudflareCredential as H, platformAdoptionIntentHash as I, hyperdriveOriginFromConnectionString as J, PlatformCloudflareClient as K, platformProvisionIntentHash as L, recordPlatformWorkerTraffic as M, trackedPlatformWorkerTraffic as N, createPlatformHealthProbeToken as O, createPlatformInstallPlan as P, revalidatePlatformInstallAction as R, purgeResourcesHandlesEmailRouting as S, purgeResourcesPermissions as T, checkpointPlatformAccessResources as U, resolvePlatformCloudflareCredential as V, parsePlatformAccessSetupSpec as W, verifyPlatformRuntimeTokenPermissions as X, hyperdriveOriginMatches as Y, describePurgeResourcesPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, isPurgedAccessResource as b, acquirePlatformDatabaseLifecycleLockConnection as c, readPlatformProjectZeroTrustState as d, assertProjectZeroTrustAllowsUninstall as f, checkPurgeResourcesCredentials as g, assertNoPlatformProjects as h, verifyPlatformAiGatewayPlan as i, recordResource as j, createPlatformInstallationSecrets as k, platformDatabaseClientUrl as l, PlatformResourceChangedError as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, PURGE_RESOURCES_STEP_PREFIX as p, hyperdriveOriginConfigHash as q, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectSlugs as u, isPlatformTailWorker as v, purgeResourcesKeptResources as w, purgeResourcesAlwaysKept as x, isPurgeResourcesCandidate as y, platformDatabaseNameFromOwnerUrl as z };