void 0.25.0 → 0.26.1

package/dist/{platform-lifecycle-BaUdTRPU.mjs → platform-lifecycle-vFqtNPPa.mjs}

@@ -1,2 +1,2 @@
-import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-Dm09JNkn.mjs";
+import { r as runPlatformLifecycleCommand } from "./platform-lifecycle-D_QEY32D.mjs";
 export { runPlatformLifecycleCommand };

package/dist/{platform-management-BSEc_ZeG.mjs → platform-management-BdYblvvE.mjs}

@@ -1,7 +1,7 @@
-import { a as listInstallationManifests, f as readInstallationRecoverySecrets, g as resolveInstallationManifest, h as removePlatformConnectionForInstallation, m as removeInstallationRecoverySecrets, t as acquirePlatformLifecycleLock, y as writeInstallationManifest } from "./platform-registry-KfNEF84O.mjs";
-import { A as confirm, B as note, H as outro, K as select, L as log, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
-import { r as createSpinner } from "./output-BBsUwdyT.mjs";
-import { A as PlatformCloudflareClient, C as revalidatePlatformInstallAction, E as resolvePlatformCloudflareCredential, M as hyperdriveOriginFromConnectionString, N as hyperdriveOriginMatches, P as verifyPlatformRuntimeTokenPermissions, S as platformProvisionIntentHash, T as assertPlatformOperatorCredentialCanApplyPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as formatPlatformInstallPlan, d as assertProjectZeroTrustAllowsUninstall, f as loadPlatformRuntime, h as resolveBootstrapGitHubId, j as hyperdriveOriginConfigHash, m as createPlatformInstallationSecrets, n as resolvePlatformInstallDatabaseUrl, o as installPlatform, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as readPlatformProjectZeroTrustState, v as trackedPlatformWorkerTraffic, w as platformDatabaseNameFromOwnerUrl, x as platformAdoptionIntentHash, y as createPlatformInstallPlan } from "./platform-lifecycle-Dm09JNkn.mjs";
+import { _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-P387v42A.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, l as import_picocolors, r as createSpinner, u as note } from "./output-C50ag2r3.mjs";
+import { A as resolveBootstrapGitHubId, B as assertPlatformOperatorCredentialCanApplyPlan, C as purgeResourcesKeptReason, D as loadPlatformRuntime, E as runPurgeResourcesTeardown, F as formatPlatformInstallPlan, H as verifyPlatformCloudflareCredential, I as platformAdoptionIntentHash, J as hyperdriveOriginFromConnectionString, K as PlatformCloudflareClient, L as platformProvisionIntentHash, N as trackedPlatformWorkerTraffic, P as createPlatformInstallPlan, R as revalidatePlatformInstallAction, S as purgeResourcesHandlesEmailRouting, T as purgeResourcesPermissions, V as resolvePlatformCloudflareCredential, X as verifyPlatformRuntimeTokenPermissions, Y as hyperdriveOriginMatches, _ as describePurgeResourcesPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as isPurgedAccessResource, d as readPlatformProjectZeroTrustState, f as assertProjectZeroTrustAllowsUninstall, g as checkPurgeResourcesCredentials, h as assertNoPlatformProjects, k as createPlatformInstallationSecrets, m as PlatformResourceChangedError, n as resolvePlatformInstallDatabaseUrl, o as installPlatform, q as hyperdriveOriginConfigHash, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as readPlatformProjectSlugs, v as isPlatformTailWorker, w as purgeResourcesKeptResources, x as purgeResourcesAlwaysKept, y as isPurgeResourcesCandidate, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-D_QEY32D.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { createHash } from "node:crypto";
 //#region src/cli/platform-management.ts
@@ -53,6 +53,13 @@ async function runInstalledPlatformCommand(args) {
 	const manifest = await resolveInstalledPlatformManifest(args.selector);
 	const operatorCredential = await resolvePlatformCloudflareCredential({ savedManagementToken: readInstallationRecoverySecrets(manifest)?.managementApiToken });
 	const operatorClient = new PlatformCloudflareClient(operatorCredential.token);
+	await verifyPlatformCloudflareCredential(operatorClient, {
+		account: manifest.account,
+		source: operatorCredential.source,
+		r2Buckets: args.subcommand === "disable" || args.subcommand === "uninstall" ? [] : manifest.resources.filter((resource) => resource.kind === "r2-bucket").map((resource) => resource.name),
+		allowMissingR2Buckets: args.subcommand === "repair"
+	});
+	markPhase("operator credential");
 	const runtime = args.subcommand === "uninstall" || args.subcommand === "disable" ? null : loadPlatformRuntime(args.runtime);
 	const rollbackSourceRuntime = args.subcommand === "rollback" ? loadPlatformRuntime(args.fromRuntime) : null;
 	let progress;
@@ -78,7 +85,12 @@ async function runInstalledPlatformCommand(args) {
 				readProjectZeroTrust: databaseLock ? databaseLock.readProjectZeroTrust : () => readPlatformProjectZeroTrustState(databaseUrl, manifest.id, manifest.ownershipNonce),
 				lockProjectZeroTrust: databaseLock?.lockProjectZeroTrust,
 				fenceProjectZeroTrust: databaseLock?.fenceProjectZeroTrust,
-				liftProjectZeroTrustFence: databaseLock?.liftProjectZeroTrustFence
+				liftProjectZeroTrustFence: databaseLock?.liftProjectZeroTrustFence,
+				readProjects: databaseLock ? databaseLock.readProjects : () => readPlatformProjectSlugs(databaseUrl, manifest.id, manifest.ownershipNonce),
+				credential: {
+					source: operatorCredential.source,
+					aiGatewayToken: !!gatewayToken
+				}
 			});
 			return;
 		}
@@ -115,20 +127,12 @@ async function runInstalledPlatformCommand(args) {
 			`Revision: ${runtime.manifest.sourceRevision ?? "not recorded"}`,
 			`Manifest SHA-256: ${runtime.manifestSha256}`
 		].join("\n"), "Platform runtime");
-		note([
-			manifest.desiredState === "disabled" && args.subcommand !== "enable" ? "Application traffic will stay paused because this installation is disabled." : "Application traffic may pause during a safe cutover. Traffic resumes after verification.",
-			"Saved progress survives an interruption. Resume with the same runtime files.",
-			`Administrator status: ${plan.apiUrl}/admin/status`
-		].join("\n"), "Availability and progress");
+		log.info(manifest.desiredState === "disabled" && args.subcommand !== "enable" ? "Application traffic will stay paused because this installation is disabled." : "Application traffic may pause briefly during a safe cutover.");
 		if (args.plan) {
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
 		assertPlatformOperatorCredentialCanApplyPlan(operatorCredential, plan);
-		progress = createSpinner({ onCancel: () => {
-			if (!process.emit("SIGINT")) process.exit(130);
-		} });
-		progress.start(args.subcommand === "upgrade" ? "Upgrading the platform" : args.subcommand === "rollback" ? "Rolling back the platform" : args.subcommand === "enable" ? "Enabling the platform" : "Repairing the platform");
 		const repairingMissingRoutingCheckpoint = args.subcommand === "repair" && plan.actions.some((action) => action.key === "routing-kv" && action.action === "create" && action.id === null);
 		await verifyPlatformMutationOwnership(client, manifest, new Set(manifest.resources.filter((resource) => isOwnershipVerifiableKind(resource.kind) && !plan.actions.some((action) => action.key === resource.key && action.action === "create" && action.name !== resource.name)).map((resource) => resource.key)), {
 			allowMissingRoutingCheckpoint: repairingMissingRoutingCheckpoint,
@@ -137,7 +141,6 @@ async function runInstalledPlatformCommand(args) {
 		});
 		markPhase("ownership");
 		const installation = args.subcommand === "enable" ? setInstallationDesiredState(manifest, "enabled", (/* @__PURE__ */ new Date()).toISOString()) : manifest;
-		if (installation !== manifest) writeInstallationManifest(installation);
 		const bootstrapGitHubLogin = process.env.VOID_PLATFORM_ADMIN_GITHUB_LOGIN || recovery?.bootstrapGitHubLogin || "";
 		const bootstrapGitHubId = process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || recovery?.bootstrapGitHubId || (bootstrapGitHubLogin ? await resolveBootstrapGitHubId(bootstrapGitHubLogin) : "");
 		const secrets = createPlatformInstallationSecrets({
@@ -169,6 +172,11 @@ async function runInstalledPlatformCommand(args) {
 		});
 		markPhase("runtime token");
 		if (!databaseLock?.readAuthenticationState) throw new Error("platform: The database lifecycle lock cannot read authoritative authentication settings.");
+		progress = createSpinner({ onCancel: () => {
+			if (!process.emit("SIGINT")) process.exit(130);
+		} });
+		progress.start(args.subcommand === "upgrade" ? "Upgrading the platform" : args.subcommand === "rollback" ? "Rolling back the platform" : args.subcommand === "enable" ? "Enabling the platform" : "Repairing the platform");
+		if (installation !== manifest) writeInstallationManifest(installation);
 		const result = await installPlatform(plan, secrets, installation, {
 			acquireDatabaseLifecycleLock: async () => Object.assign(async () => {}, {
 				checkpoint: databaseLock?.checkpoint,
@@ -180,6 +188,7 @@ async function runInstalledPlatformCommand(args) {
 				verifyDatabase: databaseLock?.verifyDatabase
 			}),
 			client,
+			operatorApiToken: operatorCredential.token,
 			databaseRollbackSource: rollbackSourceRuntime ?? void 0,
 			onProgress: (message) => {
 				markPhase(message);
@@ -218,7 +227,6 @@ async function runInstalledPlatformCommand(args) {
 				].join("\n"), "Waiting for managed Sandbox drain");
 				return;
 			}
-			log.success(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
 			log.info(result.manifest.desiredState === "disabled" ? "Application traffic remains paused. Enable the installation when you are ready." : `Platform verification passed. Traffic is enabled at ${plan.apiUrl}.`);
 			if (args.subcommand === "rollback") log.info("PostgreSQL migrations were retained; rollback changes the runtime only.");
 			if (result.emailOperationId) log.info(`Shared email routing ready (operation ${result.emailOperationId}).`);
@@ -229,6 +237,7 @@ async function runInstalledPlatformCommand(args) {
 					console.log(`One-time administrator setup code: ${code}`);
 				}
 			}
+			printSuccess(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
 		};
 	};
 	if (args.plan) {
@@ -313,7 +322,7 @@ async function disablePlatform(client, initialManifest, planOnly, dependencies =
 	const reconciled = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
 	const writeLifecycleCheckpoint = (checkpointClient, checkpointManifest) => writeLifecycleCheckpointWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
 	const writeRemoteManifestIfPresent = (checkpointClient, checkpointManifest) => writeRemoteManifestIfPresentWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
-	note("Block platform traffic through installation-owned routing storage. Retain routes and custom domains for explicit dashboard cleanup because Cloudflare cannot condition their deletion on an immutable generation. Workers and all data remain installed.", "Disable plan");
+	note("Block all platform traffic and the platform API. Routes, custom domains, Workers, and data stay installed.", "Disable plan");
 	if (planOnly) {
 		outro("No Cloudflare or local installation state was changed.");
 		return;
@@ -345,7 +354,7 @@ async function disablePlatform(client, initialManifest, planOnly, dependencies =
 		await writeLifecycleCheckpoint(client, next);
 		next = transitionInstallation(next, "disabled", (/* @__PURE__ */ new Date()).toISOString());
 		await writeLifecycleCheckpoint(client, next);
-		log.success(`${next.deployment.displayName} is disabled. Its data was not changed.`);
+		printSuccess(`${next.deployment.displayName} is disabled. Its data was not changed.`);
 	} catch (error) {
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
 		writeInstallationManifest(next);
@@ -358,14 +367,33 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	const writeLifecycleCheckpoint = (checkpointClient, checkpointManifest) => writeLifecycleCheckpointWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
 	const writeRemoteManifestIfPresent = (checkpointClient, checkpointManifest) => writeRemoteManifestIfPresentWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
 	const retainData = !args.purgeData;
-	const hasRoutingCheckpoint = manifest.resources.some((resource) => resource.key === "routing-kv" && resource.state === "ready");
+	const purgeResources = args.purgeResources;
+	const routingKv = manifest.resources.find((resource) => resource.key === "routing-kv");
+	const reopenedRouting = purgeResources && routingKv?.state === "retained" && isPurgeResourcesCandidate(manifest, routingKv);
+	const hasRoutingCheckpoint = routingKv?.state === "ready" || reopenedRouting;
 	const createdZone = manifest.resources.find((resource) => resource.key === "zone" && resource.ownership === "created");
 	const interactive = dependencies.interactive ?? process.stdin.isTTY;
 	const confirmAction = dependencies.confirm ?? promptForConfirmation;
 	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
 	await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust);
-	const dataMessage = retainData ? "Retain installer-owned Workers, storage, dispatch, AI logs, and Hyperdrive by default." : args.purgeData ? "Delete safely identifiable installer-owned data (--purge-data); retain Workers, R2, AI Gateway, and external PostgreSQL for manual cleanup." : "Retain installer-owned data; external PostgreSQL is never deleted.";
-	note(`Disable all platform traffic through installation-owned routing storage.\nRetain DNS records, routes, and custom domains for explicit dashboard cleanup.\nDelete installer-owned Queues unless a retained Worker still uses them.\n${dataMessage}\n${createdZone ? `Keep zone ${createdZone.name} for explicit manual cleanup.` : "Never delete the adopted application zone."}${(manifest.authenticationResources ?? []).length ? "\nRetain Access resources for deliberate cleanup:\n" + manifest.authenticationResources.map((resource) => `  ${resource.ownership} ${resource.kind}: ${resource.name} (${resource.id}, account ${resource.accountId})`).join("\n") : ""}`, "Uninstall plan");
+	if (purgeResources) await assertNoPlatformProjects(dependencies.readProjects);
+	const purgeResourcesClient = purgeResources ? requirePurgeResourcesClient(client) : null;
+	if (args.plan || interactive && !args.yes) note(purgeResources ? purgeResourcesPlanText(manifest) : [
+		"Disable platform traffic.",
+		retainData ? "Keep Workers and data." : "Delete eligible data; keep Workers, R2, and AI Gateway.",
+		"Delete unused Queues.",
+		...describeKeptResources(manifest, plannedKeptResources(manifest, retainData, hasRoutingCheckpoint), "Keep for manual cleanup:", "Keep Access resources:")
+	].join("\n"), import_picocolors.default.bold("Uninstall plan"));
+	if (purgeResourcesClient) {
+		const credentialCheck = checkPurgeResourcesCredentials(purgeResourcesClient, manifest, dependencies.credential ?? {
+			source: "environment",
+			aiGatewayToken: false
+		});
+		if (args.plan) await credentialCheck.catch((error) => {
+			log.warn(error instanceof Error ? error.message : String(error));
+		});
+		else await credentialCheck;
+	}
 	if (args.plan) {
 		outro("No Cloudflare or local installation state was changed.");
 		return;
@@ -373,20 +401,29 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	if (manifest !== initialManifest) writeInstallationManifest(manifest);
 	if (!interactive && !args.yes) throw new Error("platform: Non-interactive `void platform uninstall` requires --yes to acknowledge Cloudflare changes. Run with --plan first to inspect them.");
 	if (interactive && !args.yes) {
-		if (!await confirmAction(args.purgeData ? "Permanently purge installer-owned platform data?" : "Uninstall this platform?", false)) {
+		if (!await confirmAction(purgeResources ? "Permanently delete every Cloudflare resource this installation created?" : args.purgeData ? "Permanently purge installer-owned platform data?" : "Uninstall this platform?", false)) {
 			outro("No changes made.");
 			return;
 		}
 	}
-	const resourcesToDelete = new Set(manifest.resources.filter((resource) => shouldDeleteResource(resource, retainData) && (hasRoutingCheckpoint || resource.kind === "zone") && !(resource.kind === "dns-record" && !manifest.resources.some((entry) => entry.key === "zone"))).map((resource) => resource.key));
+	log.step(`Uninstalling ${manifest.deployment.displayName}...`);
+	const purgeResourcesKept = new Set(purgeResources ? purgeResourcesKeptResources(manifest).map((resource) => resource.key) : []);
+	const resourcesToDelete = new Set(manifest.resources.filter((resource) => (shouldDeleteResource(resource, retainData) || purgeResources && (resource.state === "ready" || isPurgeResourcesCandidate(manifest, resource)) && !purgeResourcesKept.has(resource.key) && isOwnershipVerifiableKind(resource.kind) && resource.kind !== "dns-record" && !hasLifecycleStep(manifest, `uninstall:purge-resources:r2-marker:${resource.key}`)) && (hasRoutingCheckpoint || resource.kind === "zone") && !(resource.kind === "dns-record" && !manifest.resources.some((entry) => entry.key === "zone"))).map((resource) => resource.key));
 	const ownershipTargets = /* @__PURE__ */ new Set([
 		...hasRoutingCheckpoint ? ["routing-kv"] : [],
 		"zone",
 		...manifest.resources.filter((resource) => resource.kind === "worker").map((resource) => resource.key),
 		...resourcesToDelete
 	]);
+	const proofManifest = {
+		...manifest,
+		resources: manifest.resources.map((resource) => resource.state === "retained" && resourcesToDelete.has(resource.key) ? {
+			...resource,
+			state: "ready"
+		} : resource)
+	};
 	let missingResources;
-	if (hasRoutingCheckpoint) missingResources = await verifyPlatformMutationOwnership(client, manifest, ownershipTargets, {
+	if (hasRoutingCheckpoint) missingResources = await verifyPlatformMutationOwnership(client, proofManifest, ownershipTargets, {
 		allowDeletedRoutingCheckpoint: args.purgeData,
 		databaseUrl: dependencies.databaseUrl
 	});
@@ -408,6 +445,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	let next = manifest;
 	try {
 		await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust);
+		if (purgeResources) await assertNoPlatformProjects(dependencies.readProjects);
 		fenced = true;
 		await fenceProjectZeroTrust();
 		next = transitionInstallation(manifest, "uninstalling", (/* @__PURE__ */ new Date()).toISOString());
@@ -418,7 +456,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	}
 	try {
 		await writeRemoteManifestIfPresent(client, next);
-		const routing = next.resources.find((resource) => resource.key === "routing-kv" && resource.state === "ready");
+		const routing = hasRoutingCheckpoint ? requireResource(next, "routing-kv") : void 0;
 		disablingTraffic = true;
 		if (routing) await client.putKvValue(next.account.id, routing.id, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 		await releaseProjectZeroTrust();
@@ -442,6 +480,23 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 				await writeLifecycleCheckpoint(client, next);
 			}
 		}
+		if (purgeResourcesClient && hasRoutingCheckpoint) next = await runPurgeResourcesTeardown({
+			client: purgeResourcesClient,
+			checkpoint: async (checkpointManifest) => {
+				next = checkpointManifest;
+				await writeLifecycleCheckpoint(client, checkpointManifest);
+			},
+			verify: (checkpointManifest, keys) => verifyPlatformMutationOwnership(client, checkpointManifest, keys, {
+				allowDeletedRoutingCheckpoint: true,
+				databaseUrl: dependencies.databaseUrl
+			}),
+			bucketGeneration: async (checkpointManifest, bucket) => {
+				const live = (await client.listR2Buckets(checkpointManifest.account.id)).find((entry) => entry.id === bucket.id && entry.name === bucket.name);
+				if (!live) return null;
+				return live.fingerprint === void 0 ? "unknown" : r2BucketConfigHash(bucket.name, live.fingerprint);
+			},
+			readProjects: () => dependencies.readProjects()
+		}, next);
 		const deletionPriority = {
 			worker: 0,
 			queue: 1,
@@ -455,7 +510,11 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		};
 		const resources = [...next.resources].sort((left, right) => resourceDeletionPriority(left, deletionPriority) - resourceDeletionPriority(right, deletionPriority));
 		const queuesInUse = hasRoutingCheckpoint && resources.some((resource) => resource.kind === "queue" && shouldDeleteResource(resource, retainData)) && await hasLiveInstallationWorker(client, next);
-		for (const resource of resources) {
+		for (const listed of resources) {
+			const resource = reopenedRouting && listed.key === "routing-kv" ? {
+				...listed,
+				state: "ready"
+			} : listed;
 			if (resource.state !== "ready") continue;
 			if (!hasRoutingCheckpoint && resource.kind !== "zone") {
 				next = updateResourceState(next, resource.key, "retained");
@@ -463,7 +522,8 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 				continue;
 			}
 			if (!shouldDeleteResource(resource, retainData)) {
-				next = updateResourceState(next, resource.key, "retained");
+				const removed = resource.kind === "ai-gateway" && resource.ownership === "created" && !hasNamedResource(await client.listAiGateways(next.account.id), resource);
+				next = updateResourceState(next, resource.key, removed ? "deleted" : "retained");
 				await writeLifecycleCheckpoint(client, next);
 				continue;
 			}
@@ -480,7 +540,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 				await writeLifecycleCheckpoint(client, next);
 				continue;
 			}
-			await client.deleteResource(next.account.id, resource.kind, resource.id, zone?.id);
+			await client.deleteResource(next.account.id, resource, zone?.id);
 			next = updateResourceState(next, resource.key, "deleted");
 			await writeLifecycleCheckpoint(client, next);
 		}
@@ -490,7 +550,9 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		writeInstallationManifest(completed);
 		if (!retainData) removeInstallationRecoverySecrets(next);
 		removePlatformConnectionForInstallation(next.id);
-		log.success(retainData ? `${next.deployment.displayName} was uninstalled; data resources were retained and recorded in ${next.id}.` : `${next.deployment.displayName} was uninstalled.`);
+		const kept = describeKeptResources(next, next.resources.filter((resource) => resource.state === "retained"), "Cloudflare resources:", "Access resources:", purgeResources && purgeResourcesHandlesEmailRouting(next));
+		if (kept.length) note(kept.join("\n"), import_picocolors.default.bold("Kept resources"));
+		printSuccess(`Uninstalled ${next.deployment.displayName}.`);
 	} catch (error) {
 		await stopProjectZeroTrustHold().catch(() => {});
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
@@ -568,6 +630,87 @@ const DATA_RESOURCE_KINDS = /* @__PURE__ */ new Set([
 function isOwnershipVerifiableKind(kind) {
 	return kind === "ai-gateway" || kind === "dispatch-namespace" || kind === "dns-record" || kind === "hyperdrive" || kind === "kv-namespace" || kind === "queue" || kind === "r2-bucket" || kind === "worker" || kind === "zone";
 }
+const KEPT_RESOURCE_ORDER = [
+	"dns-record",
+	"worker-route",
+	"worker-custom-domain",
+	"queue",
+	"worker",
+	"dispatch-namespace",
+	"kv-namespace",
+	"hyperdrive",
+	"r2-bucket",
+	"ai-gateway",
+	"analytics-dataset",
+	"zone"
+];
+/** Resources an uninstall with these options leaves in the account. */
+function plannedKeptResources(manifest, retainData, hasRoutingCheckpoint) {
+	const workersRemain = manifest.resources.some((resource) => resource.kind === "worker" && resource.state === "ready");
+	return manifest.resources.filter((resource) => resource.state === "retained" || resource.state === "ready" && (!hasRoutingCheckpoint && resource.kind !== "zone" || !shouldDeleteResource(resource, retainData) || resource.kind === "queue" && workersRemain));
+}
+function keptResourceRank(manifest, resource) {
+	return isPlatformTailWorker(manifest, resource) ? KEPT_RESOURCE_ORDER.indexOf("dispatch-namespace") + .5 : KEPT_RESOURCE_ORDER.indexOf(resource.kind);
+}
+function purgeResourcesPlanText(manifest) {
+	const permissions = purgeResourcesPermissions(manifest);
+	const keepManifest = {
+		...manifest,
+		authenticationResources: (manifest.authenticationResources ?? []).filter((resource) => resource.ownership !== "created" || purgeResourcesKeptReason(manifest, `access:${resource.key}`) !== null)
+	};
+	return [
+		"Disable platform traffic.",
+		...describePurgeResourcesPlan(manifest),
+		...describeKeptResources(keepManifest, purgeResourcesKeptResources(manifest), "Keep for manual cleanup:", "Keep Access resources you connected:", purgeResourcesHandlesEmailRouting(manifest)),
+		"Always kept:",
+		...purgeResourcesAlwaysKept(),
+		...permissions.length ? [`API token needs: ${permissions.join(", ")}. Browser login cannot delete DNS records or Access resources.`] : []
+	].join("\n");
+}
+function requirePurgeResourcesClient(client) {
+	if ([
+		"deleteAccessResource",
+		"deleteDispatchNamespaceScript",
+		"deleteEmailRoutingRule",
+		"deleteQueueConsumer",
+		"deleteR2Object",
+		"deleteWorkerDomain",
+		"deleteWorkerRoute",
+		"emptyR2Bucket",
+		"forceDeleteWorker",
+		"getAccessResource",
+		"getEmailRoutingCatchAll",
+		"listDispatchNamespaceScripts",
+		"listEmailRoutingRules",
+		"listQueueConsumers",
+		"listWorkerDependents",
+		"listWorkerRoutes",
+		"resetEmailRoutingCatchAll"
+	].some((method) => typeof client[method] !== "function")) throw new Error("platform: This Cloudflare client cannot run --purge-resources.");
+	return client;
+}
+function describeKeptResources(manifest, resources, heading, accessHeading, emailRulesRemoved = false) {
+	const sorted = [...resources].sort((left, right) => keptResourceRank(manifest, left) - keptResourceRank(manifest, right));
+	const isTraffic = (resource) => KEPT_RESOURCE_ORDER.indexOf(resource.kind) < KEPT_RESOURCE_ORDER.indexOf("queue");
+	const why = (key) => {
+		const reason = purgeResourcesKeptReason(manifest, key);
+		return reason === null ? "" : `, kept because ${reason}`;
+	};
+	const line = (resource) => `  ${resource.kind}: ${resource.name}${resource.name === resource.id ? "" : ` (${resource.id})`}${why(resource.key)}`;
+	const { capabilities, emailSenderDomain, emailSharedZoneId, resources: names } = manifest.deployment;
+	const email = capabilities.email ? [emailRulesRemoved && emailSenderDomain ? `  Email Routing for ${emailSenderDomain} (zone ${emailSharedZoneId}): its settings and the sender domain's MX, SPF, and DKIM records.` : emailSenderDomain ? `  Email Routing for ${emailSenderDomain} (zone ${emailSharedZoneId}): its routing DNS records and any catch-all rule that sends mail to ${names.emailGatewayWorker}.` : `  Email Routing: any catch-all rule that sends mail to ${names.emailGatewayWorker}.`] : [];
+	const remainingAccess = (manifest.authenticationResources ?? []).filter((resource) => !isPurgedAccessResource(manifest, resource));
+	const accessLine = (resource) => `  ${resource.ownership} ${resource.kind}: ${resource.name} (${resource.id}, account ${resource.accountId})${why(`access:${resource.key}`)}`;
+	const keptAccess = (resource) => purgeResourcesKeptReason(manifest, `access:${resource.key}`) !== null;
+	const kept = [
+		...sorted.filter(isTraffic).map(line),
+		...remainingAccess.filter(keptAccess).map(accessLine),
+		...email,
+		...sorted.filter((resource) => !isTraffic(resource)).map(line)
+	];
+	const access = remainingAccess.filter((resource) => !keptAccess(resource)).map(accessLine);
+	return [...kept.length ? [heading, ...kept] : [], ...access.length ? [accessHeading, ...access] : []];
+}
 function shouldDeleteResource(resource, retainData) {
 	if (resource.state !== "ready" || resource.ownership !== "created") return false;
 	if (resource.kind === "zone") return false;
@@ -641,7 +784,7 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 	const zone = manifest.resources.find((resource) => resource.key === "zone");
 	const [aiGateways, dispatchNamespaces, hyperdrives, kvNamespaces, r2Buckets, workerNames] = await Promise.all([
 		client.listAiGateways(accountId),
-		client.listDispatchNamespaces(accountId),
+		targetResources.some((resource) => resource.kind === "dispatch-namespace") ? client.listDispatchNamespaces(accountId) : Promise.resolve([]),
 		client.listHyperdriveConfigs(accountId),
 		client.listKvNamespaces(accountId),
 		client.listR2Buckets(accountId),
@@ -686,7 +829,7 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 						name: resource.name
 					})).digest("hex");
 					const expectedHash = dnsRecordConfigHash(resource.name, "AAAA", "100::", true);
-					if (liveHash !== resource.configHash && !(resource.configHash === legacyHash && liveHash === expectedHash)) throw ownershipError(`dns-record ${resource.name} changed configuration after installation`);
+					if (liveHash !== resource.configHash && !(resource.configHash === legacyHash && liveHash === expectedHash)) throw new PlatformResourceChangedError(resource.key, "its configuration changed after installation", ownershipError(`dns-record ${resource.name} changed configuration after installation`).message);
 				}
 			}
 		} else if (resource.kind === "worker") {
@@ -725,7 +868,7 @@ function isPlatformManifestMonotonicExtension(earlier, later) {
 	if (earlier.id !== later.id || earlier.ownershipNonce !== later.ownershipNonce || earlier.account.id !== later.account.id || earlier.createdAt !== later.createdAt || JSON.stringify(earlier.deployment) !== JSON.stringify(later.deployment) || Date.parse(later.updatedAt) < Date.parse(earlier.updatedAt)) return false;
 	const resourcesAdvance = earlier.resources.every((resource) => {
 		const next = later.resources.find((entry) => entry.key === resource.key);
-		return next?.id === resource.id && next.kind === resource.kind && next.name === resource.name && next.ownership === resource.ownership && (next.state === resource.state || resource.state === "ready" && (next.state === "deleted" || next.state === "retained"));
+		return next?.id === resource.id && next.kind === resource.kind && next.name === resource.name && next.ownership === resource.ownership && (next.state === resource.state || resource.state === "ready" && (next.state === "deleted" || next.state === "retained") || resource.state === "retained" && next.state === "deleted");
 	});
 	const stepsAdvance = earlier.steps.every((step) => later.steps.some((entry) => entry.key === step.key && entry.completedAt === step.completedAt && entry.resultHash === step.resultHash));
 	const authenticationResourcesAdvance = (earlier.authenticationResources ?? []).every((resource) => (later.authenticationResources ?? []).some((next) => JSON.stringify(next) === JSON.stringify(resource)));

package/dist/{platform-management-Bp6aoH2C.mjs → platform-management-oi-SvI3f.mjs}

@@ -1,2 +1,2 @@
-import { c as runInstalledPlatformCommand, d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BSEc_ZeG.mjs";
+import { c as runInstalledPlatformCommand, d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BdYblvvE.mjs";
 export { runInstalledPlatformCommand, selectAuthoritativePlatformManifest, verifyPlatformInstallationOwnership };

package/dist/{platform-plans-config-B0pOVQyW.mjs → platform-plans-config-CjiFv5J4.mjs}

@@ -1,6 +1,7 @@
-import { A as confirm, K as select, X as text, tt as isCancel } from "./prompts-6OSVA7DJ.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-LmwjxT6q.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-CkmTE3rt.mjs";
+import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess } from "./output-C50ag2r3.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BQtzyG-g.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-AzVLbrr3.mjs";
 import { stripVTControlCharacters } from "node:util";
 import { PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanId } from "@void/platform/plans";
 import { readFile } from "node:fs/promises";
@@ -215,7 +216,7 @@ async function apply(client, path, body, args, catalog) {
 		...result
 	};
 	if (args.json) print(completed);
-	else console.log(`Saved ${applied.action ?? "plans.sync"} ${applied.target ?? ""}. Account updates complete.`);
+	else printSuccess(`Saved ${applied.action ?? "plans.sync"} ${applied.target ?? ""}. Account updates complete.`);
 }
 async function runPlatformPlansConfig(args) {
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-recovery-WOZ95Uze.mjs → platform-recovery-PvNS9Nl2.mjs}

@@ -1,7 +1,7 @@
-import { _ as savePlatformConnection, a as listInstallationManifests, t as acquirePlatformLifecycleLock, y as writeInstallationManifest } from "./platform-registry-KfNEF84O.mjs";
+import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-P387v42A.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { a as REMOTE_INSTALLATION_MANIFEST_KEY, y as createPlatformInstallPlan } from "./platform-lifecycle-Dm09JNkn.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-BSEc_ZeG.mjs";
+import { P as createPlatformInstallPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-D_QEY32D.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-BdYblvvE.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{platform-registry-KfNEF84O.mjs → platform-registry-P387v42A.mjs}

@@ -189,6 +189,19 @@ function getActivePlatformConnection(directory = platformRegistryDirectory()) {
 	const registry = readRegistry(directory);
 	return registry.connections.find((connection) => connection.id === registry.activeConnectionId) ?? (registry.connections.length === 1 ? registry.connections[0] : null);
 }
+function platformConnectionSlug(connection, installations) {
+	const matches = installations.filter((manifest) => manifest.status !== "uninstalled" && manifest.id === connection.installationId && (connection.accountId === null || connection.accountId === manifest.account.id));
+	return matches.length === 1 ? matches[0].deployment.installationSlug : null;
+}
+/** Resolve saved platforms without selecting one or changing its credentials. */
+function findPlatformConnections(selector, directory = platformRegistryDirectory(), connections = listPlatformConnections(directory)) {
+	let normalizedUrl = null;
+	try {
+		normalizedUrl = normalizePlatformApiUrl(selector);
+	} catch {}
+	const installations = connections.some((connection) => connection.installationId) ? listInstallationManifests(directory) : [];
+	return connections.filter((entry) => entry.id === selector || entry.installationId === selector || entry.displayName.toLowerCase() === selector.toLowerCase() || entry.apiUrl === normalizedUrl || platformConnectionSlug(entry, installations) === selector.toLowerCase());
+}
 function savePlatformConnection(input, directory = platformRegistryDirectory()) {
 	const apiUrl = normalizePlatformApiUrl(input.apiUrl);
 	const id = platformConnectionId(apiUrl);
@@ -214,14 +227,7 @@ function savePlatformConnection(input, directory = platformRegistryDirectory())
 function selectPlatformConnection(selector, directory = platformRegistryDirectory()) {
 	return withRegistryLock(directory, () => {
 		const current = readRegistry(directory);
-		const normalizedUrl = (() => {
-			try {
-				return normalizePlatformApiUrl(selector);
-			} catch {
-				return null;
-			}
-		})();
-		const matches = current.connections.filter((entry) => entry.id === selector || entry.installationId === selector || entry.displayName.toLowerCase() === selector.toLowerCase() || normalizedUrl !== null && entry.apiUrl === normalizedUrl);
+		const matches = findPlatformConnections(selector, directory, current.connections);
 		if (matches.length !== 1) throw new Error(matches.length === 0 ? `platform: No installed or connected platform matches ${JSON.stringify(selector)}.` : `platform: More than one platform matches ${JSON.stringify(selector)}. Use its id or URL.`);
 		const selected = {
 			...matches[0],
@@ -273,7 +279,8 @@ function listInstallationManifests(directory = platformRegistryDirectory()) {
 	return manifests.sort((left, right) => left.deployment.displayName.localeCompare(right.deployment.displayName));
 }
 function resolveInstallationManifest(selector, directory = platformRegistryDirectory()) {
-	const manifests = listInstallationManifests(directory).filter((manifest) => manifest.status !== "uninstalled" && (!selector || manifest.id === selector || manifest.deployment.installationSlug === selector || manifest.deployment.displayName.toLowerCase() === selector.toLowerCase()));
+	const connection = selector ? listPlatformConnections(directory).find((entry) => entry.id === selector) : void 0;
+	const manifests = listInstallationManifests(directory).filter((manifest) => manifest.status !== "uninstalled" && (!selector || manifest.id === selector || manifest.id === connection?.installationId && (connection.accountId === null || connection.accountId === manifest.account.id) || manifest.deployment.installationSlug === selector || manifest.deployment.displayName.toLowerCase() === selector.toLowerCase()));
 	if (manifests.length !== 1) throw new Error(manifests.length === 0 ? `platform: No local installation matches ${JSON.stringify(selector)}.` : "platform: Multiple local installations match; specify an installation id.");
 	return manifests[0];
 }
@@ -428,4 +435,4 @@ function removePlatformConnectionForInstallation(installationId, directory = pla
 	});
 }
 //#endregion
-export { writeKeyringPassword as C, readKeyringPassword as S, savePlatformConnection as _, listInstallationManifests as a, writePendingInstallationSecrets as b, platformCredentialAccount as c, promoteInstallationSecrets as d, readInstallationRecoverySecrets as f, resolveInstallationManifest as g, removePlatformConnectionForInstallation as h, latestPlatformWorkerCutoverGeneration as i, platformRegistryDirectory as l, removeInstallationRecoverySecrets as m, assertPlatformInstallationSlugAvailable as n, listPlatformConnections as o, readPendingInstallationSecrets as p, getActivePlatformConnection as r, normalizePlatformApiUrl as s, acquirePlatformLifecycleLock as t, platformWorkerSecretUpdateIntentState as u, selectPlatformConnection as v, deleteKeyringPassword as x, writeInstallationManifest as y };
+export { deleteKeyringPassword as C, writePendingInstallationSecrets as S, writeKeyringPassword as T, removePlatformConnectionForInstallation as _, latestPlatformWorkerCutoverGeneration as a, selectPlatformConnection as b, normalizePlatformApiUrl as c, platformRegistryDirectory as d, platformWorkerSecretUpdateIntentState as f, removeInstallationRecoverySecrets as g, readPendingInstallationSecrets as h, getActivePlatformConnection as i, platformConnectionSlug as l, readInstallationRecoverySecrets as m, assertPlatformInstallationSlugAvailable as n, listInstallationManifests as o, promoteInstallationSecrets as p, findPlatformConnections as r, listPlatformConnections as s, acquirePlatformLifecycleLock as t, platformCredentialAccount as u, resolveInstallationManifest as v, readKeyringPassword as w, writeInstallationManifest as x, savePlatformConnection as y };