void 0.26.0 → 0.26.1

package/dist/{platform-lifecycle-Cfi0o6xM.mjs → platform-lifecycle-D_QEY32D.mjs}

@@ -1,14 +1,14 @@
 import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-P387v42A.mjs";
 import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-YTlqvAsk.mjs";
-import { u as openBrowser } from "./auth-D52yG7hl.mjs";
-import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./prompts-6OSVA7DJ.mjs";
-import { c as resolveCloudflareOperationArgv } from "./cloudflare-process-B-wekeR6.mjs";
-import { c as import_picocolors, l as note, n as cliCommandName, r as createSpinner } from "./output-BvdaehtE.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Qdc7tw8F.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-VeqAC77A.mjs";
-import { t as parsePlatformArgs } from "./platform-args-DSV2p4nY.mjs";
+import { n as ensurePlatformAccessToken } from "./cf-access-ngGqZpHZ.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D3m88sjf.mjs";
+import { d as printSuccess, l as import_picocolors, n as cliCommandName, r as createSpinner, u as note } from "./output-C50ag2r3.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-2-TfIEzB.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CuxfF6OA.mjs";
+import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BfaLiWbj.mjs";
+import { t as parsePlatformArgs } from "./platform-args-BoZkWQnJ.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-DVe42Ws7.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -16,11 +16,10 @@ import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFI
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
-import { execFile } from "node:child_process";
 import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
+import { createServer, request } from "node:http";
 import { readFile } from "node:fs/promises";
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
-import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
 //#region src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
@@ -722,21 +721,6 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 	async removeRoutes(_accountId, _zoneId, tracked) {
 		if (tracked.routes.length > 0 || tracked.customDomains.length > 0) throw new Error("platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.");
 	}
-	async setWorkerSubdomain(accountId, workerName, enabled) {
-		try {
-			await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}/subdomain`, {
-				body: JSON.stringify({
-					enabled,
-					previews_enabled: enabled
-				}),
-				headers: { "Cloudflare-Workers-Script-Api-Date": "2025-08-01" },
-				method: "POST"
-			});
-		} catch (error) {
-			if (!enabled && error instanceof PlatformCloudflareApiError && error.status === 404) return;
-			throw error;
-		}
-	}
 };
 function accessResourcePath(accountId, kind, id) {
 	return `/accounts/${encodeURIComponent(accountId)}/access/${kind === "application" ? "apps" : "service_tokens"}/${encodeURIComponent(id)}`;
@@ -997,6 +981,18 @@ function platformAccessOverlapsOrigin(destination, origin) {
 	const pattern = "^" + destination.split("/")[0].split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$";
 	return new RegExp(pattern, "i").test(new URL(origin).hostname);
 }
+/** Whether an application path-covers, or exactly covers, any protected platform origin. */
+function platformAccessOverlapsOrigins(application, origins) {
+	return platformAccessPublicDestinations(application).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)));
+}
+/** A definitive 4xx means the create did not happen, so a retry may not find a hidden duplicate. */
+function platformAccessCreateRejected(error) {
+	return error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
+		408,
+		409,
+		429
+	].includes(error.status);
+}
 async function inspectPlatformAccess(client, input) {
 	const authDomain = text(object(await client.get("organizations"), "Access organization").auth_domain, "Access team domain");
 	const teamDomain = authDomain.startsWith("https://") ? authDomain : `https://${authDomain}`;
@@ -1031,7 +1027,6 @@ async function provisionPlatformAccess(client, input, previous, save) {
 		if (url.origin !== value || url.protocol !== "https:") throw new Error("platform: Access requires exact HTTPS origins without credentials, paths, or query strings.");
 		return url.origin;
 	}))];
-	for (const origin of origins) if (!origin.startsWith("https://")) throw new Error("platform: Access protection requires HTTPS platform origins.");
 	const state = previous ? structuredClone(previous) : {
 		version: 1,
 		accountId: input.accountId,
@@ -1063,7 +1058,7 @@ async function provisionPlatformAccess(client, input, previous, save) {
 	}
 	if (input.protection) for (const app of inventory) {
 		if (app.id === input.protection.applicationId || app.id === state.resources.protection?.id || app.name === state.resources.protection?.name) continue;
-		if (platformAccessPublicDestinations(app).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)))) throw new Error("platform: An existing Access application overlaps a platform endpoint. Connect or reconcile it explicitly before provisioning protection.");
+		if (platformAccessOverlapsOrigins(app, origins)) throw new Error("platform: An existing Access application overlaps a platform endpoint. Connect or reconcile it explicitly before provisioning protection.");
 	}
 	const output = { resources: [] };
 	const application = async (key, expected, existingId) => {
@@ -1118,11 +1113,7 @@ async function provisionPlatformAccess(client, input, previous, save) {
 			save(state);
 			return object(await client.get(`apps/${encodeURIComponent(checkpoint.id)}`), "Access application");
 		} catch (error) {
-			if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
-				408,
-				409,
-				429
-			].includes(error.status)) {
+			if (platformAccessCreateRejected(error)) {
 				checkpoint.pending = false;
 				save(state);
 			}
@@ -1277,295 +1268,6 @@ async function verifyPlatformAccessApplication(client, input, app, type, machine
 	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
 }
 //#endregion
-//#region src/cli/platform-setup.ts
-function platformSetupLink(page, hyperlinks = supportsSetupLinks()) {
-	return hyperlinks ? "\x1B]8;;" + page.url + "\x1B\\" + import_picocolors.default.underline(page.title) + "\x1B]8;;\x1B\\" : page.title + ": " + import_picocolors.default.underline(page.url);
-}
-function platformSetupFieldHelp(key) {
-	const docs = (page, section, title) => platformSetupLink({
-		title,
-		url: `https://void.cloud/guide/platform/installation/${page}#${section}`
-	});
-	switch (key) {
-		case "databaseUrl": return {
-			placeholder: "postgresql://user:pw@…/database",
-			description: "Provide a PostgreSQL database URL for platform users, projects, and deployments. Use an empty hosted database, e.g. " + platformSetupLink({
-				title: "Neon",
-				url: "https://neon.com/"
-			}) + ". " + docs("prerequisites", "platform-database", "Database setup")
-		};
-		case "jwtSecret": return { description: `Create a JWT signing key for platform login tokens. Run ${import_picocolors.default.blue("openssl rand -base64 32")}. Save the key in your password manager. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		case "projectSecretKey": return { description: `Generate a project encryption key for app secrets. Run ${import_picocolors.default.blue("openssl rand -base64 32")} separately. Save this key for recovery. ` + docs("credentials", "signing-and-encryption-keys", "Key setup") };
-		default: return;
-	}
-}
-function supportsSetupLinks() {
-	return !!process.stdout.isTTY && ([
-		"ghostty",
-		"iTerm.app",
-		"WezTerm",
-		"vscode",
-		"WarpTerminal"
-	].includes(process.env.TERM_PROGRAM ?? "") || !!process.env.WT_SESSION || !!process.env.VTE_VERSION || !!process.env.KONSOLE_VERSION || process.env.TERM === "xterm-kitty");
-}
-/** Dashboard keys use permission-catalog labels, which can differ from product names. */
-function platformAccountTokenPermissions(includeAiGateway) {
-	return [
-		{
-			key: "account_settings",
-			type: "read"
-		},
-		{
-			key: "workers_scripts",
-			type: "edit"
-		},
-		{
-			key: "workers_kv_storage",
-			type: "edit"
-		},
-		{
-			key: "workers_r2",
-			type: "edit"
-		},
-		{
-			key: "d1",
-			type: "edit"
-		},
-		{
-			key: "queues",
-			type: "edit"
-		},
-		{
-			key: "account_analytics",
-			type: "read"
-		},
-		{
-			key: "workers_tail",
-			type: "read"
-		},
-		{
-			key: "query_cache",
-			type: "edit"
-		},
-		...includeAiGateway ? [{
-			key: "aig",
-			type: "edit"
-		}] : []
-	];
-}
-/**
-* Account token links cannot preselect a zone: Cloudflare documents only
-* `permissionGroupKeys` and `name`, and the form puts zone permissions in an
-* "All Domains" policy. Tell the user which dashboard choice to change.
-*/
-function specifiedDomainsInstruction(zones) {
-	return `Change the zone policy from All Domains to Specified Domains → ${zones.join(" and ")}.`;
-}
-function plansZoneCreation(plan) {
-	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-}
-function platformManagementSetupPage(plan, options = {}) {
-	const createsZone = plansZoneCreation(plan);
-	const zoneName = plan.deployment.application.zoneName;
-	const apiHostname = plan.deployment.controlPlane.apiHostname;
-	const access = options.access ?? (plan.deployment.authentication.accessProtection || plan.deployment.authentication.providers.includes("cloudflare-access") ? {
-		protection: !!plan.deployment.authentication.accessProtection,
-		readOnly: false
-	} : void 0);
-	const zones = [...zoneName ? [zoneName] : [], ...apiHostname && apiHostname !== zoneName && !apiHostname.endsWith(`.${zoneName}`) ? [`the zone for ${apiHostname}`] : []];
-	const accessLevel = access && access.readOnly ? "read" : "edit";
-	const appAccess = !!plan.deployment.appAccess;
-	const appAccessLevel = appAccess ? "edit" : accessLevel;
-	const permissions = [
-		...platformAccountTokenPermissions(true),
-		...zoneName || apiHostname || createsZone ? [
-			{
-				key: "zone",
-				type: createsZone ? "edit" : "read"
-			},
-			{
-				key: "dns",
-				type: "edit"
-			},
-			{
-				key: "workers_routes",
-				type: "edit"
-			}
-		] : [],
-		...access || appAccess ? [
-			{
-				key: "access",
-				type: appAccessLevel
-			},
-			{
-				key: "access_acct",
-				type: "read"
-			},
-			...access && access.protection ? [{
-				key: "access_service_token",
-				type: accessLevel
-			}] : []
-		] : [],
-		...zoneName && plan.deployment.application.baseDomain !== zoneName ? [{
-			key: "ssl_and_certificates",
-			type: "read"
-		}] : []
-	];
-	return {
-		title: "Cloudflare management API token",
-		linkInTitle: true,
-		url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-			to: "/" + plan.account.id + "/api-tokens",
-			name: plan.deployment.displayName + " Management",
-			permissionGroupKeys: JSON.stringify(permissions)
-		}),
-		instructions: [
-			"This token lets the Void CLI install your platform. Void will now open a pre-configured token creation site. Please review the permissions and then paste the token here.",
-			`Scope it to ${plan.account.name}.`,
-			...createsZone ? [`Keep the zone policy on All Domains so Void can create ${zoneName}.`] : zones.length ? [specifiedDomainsInstruction(zones)] : []
-		].join("\n")
-	};
-}
-function platformSetupPages(plan) {
-	const permissions = [
-		...platformAccountTokenPermissions(plan.actions.some((action) => action.kind === "ai-gateway" && action.action === "inspect")),
-		...plan.deployment.application.zoneName ? [{
-			key: "cache",
-			type: "purge"
-		}] : [],
-		...plan.deployment.capabilities.customDomains ? [{
-			key: "ssl_and_certificates",
-			type: "edit"
-		}] : [],
-		...plan.deployment.capabilities.email ? [
-			{
-				key: "zone",
-				type: "read"
-			},
-			{
-				key: "zone_settings",
-				type: "edit"
-			},
-			{
-				key: "email_routing_address",
-				type: "edit"
-			},
-			{
-				key: "email_routing_rule",
-				type: "edit"
-			},
-			{
-				key: "email_sending",
-				type: "edit"
-			}
-		] : []
-	];
-	const zoneName = plan.deployment.application.zoneName;
-	return {
-		runtime: {
-			title: "Cloudflare runtime token",
-			linkInTitle: true,
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/api-tokens",
-				name: plan.deployment.displayName + " Runtime",
-				permissionGroupKeys: JSON.stringify(permissions)
-			}),
-			instructions: ["Create a Cloudflare runtime token that Void can use to manage the platform. Please review the permissions and then paste the token here.", ...zoneName && plansZoneCreation(plan) ? [`Keep the zone policy on All Domains so the token can purge cache on ${zoneName} after Void creates it.`] : zoneName ? [specifiedDomainsInstruction([zoneName, ...plan.deployment.capabilities.email ? ["every zone that will carry mail"] : []])] : []].join("\n")
-		},
-		github: {
-			title: "GitHub OAuth App",
-			url: "https://github.com/settings/applications/new",
-			instructions: "GitHub Auth will be used by the users of your Void Platform instance. Register a GitHub app and generate a client secret.\nHomepage: " + plan.apiUrl + "\nRedirect URI: " + plan.apiUrl + "/auth/callback"
-		},
-		r2: {
-			title: "R2 upload token",
-			url: "https://dash.cloudflare.com/?" + new URLSearchParams({
-				to: "/" + plan.account.id + "/r2/api-tokens/create",
-				type: "account"
-			}),
-			instructions: [
-				"Select Object Read & Write.",
-				"Keep Apply to all buckets in this account selected.",
-				"Create the token, then copy the Access Key ID and Secret Access Key into the CLI."
-			].join("\n")
-		}
-	};
-}
-function formatPlatformSetupPlan(plan, options = {}) {
-	const writesDns = plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse");
-	return [
-		"The installation will guide you through setting up the following credentials:",
-		"",
-		...[
-			...options.managementToken ? [options.managementAccess ? `Cloudflare management API token for ${writesDns ? "DNS changes and " : ""}Access setup` : "Cloudflare management API token for DNS changes"] : [],
-			"PostgreSQL database URL",
-			"Cloudflare runtime token",
-			"R2 upload token",
-			...plan.deployment.authentication.providers.includes("github") ? ["GitHub OAuth App client ID and secret"] : [],
-			...plan.deployment.authentication.providers.filter((provider) => provider !== "github").map((provider) => (provider === "google" ? "Google OAuth" : provider === "oidc" ? "OIDC" : "Cloudflare Access OIDC") + " client ID and secret"),
-			...plan.deployment.authentication.accessProtection ? ["Cloudflare Access application and installer credentials"] : [],
-			...plan.deployment.appAccess ? ["Cloudflare Access check and app-management token when needed (stored encrypted)"] : [],
-			"JWT signing key and project encryption key"
-		].map((credential) => `• ${credential}`)
-	].join("\n");
-}
-function platformInstallCommandArguments(options) {
-	const parts = [
-		options.commandName,
-		"platform",
-		"install"
-	];
-	const flag = (name, value) => {
-		if (value) parts.push(name, value);
-	};
-	if (options.resumeId) {
-		parts.push("--resume");
-		flag("--name", options.resumeId);
-	} else {
-		flag("--name", options.installationSlug);
-		flag("--account", options.accountId);
-		flag("--display-name", options.displayName);
-		if (options.workersDev) parts.push("--workers-dev");
-		else {
-			flag("--application-domain", options.applicationDomain);
-			flag("--zone", options.zoneName);
-			if (options.dedicatedZone) parts.push("--dedicated-zone");
-			else parts.push("--no-dedicated-zone");
-		}
-		flag("--control-plane-domain", options.controlPlaneDomain);
-		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");
-	}
-	flag("--hyperdrive", options.hyperdrive ?? "");
-	flag("--auth-config", options.authConfig ?? "");
-	if (!options.resumeId && options.appAccess) flag("--app-access", options.appAccess);
-	if (!options.authConfig && !options.resumeId && options.authentication) {
-		flag("--login-methods", options.authentication.providers.join(","));
-		parts.push(options.authentication.accessProtection ? "--access-protection" : "--no-access-protection");
-	}
-	flag("--dashboard-url", options.dashboardUrl ?? "");
-	flag("--runtime", options.runtime);
-	if (options.yes) parts.push("--yes");
-	return parts;
-}
-function formatPlatformInstallCommand(options) {
-	return platformInstallCommandArguments(options).map((value) => {
-		if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
-		return process.platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
-	}).join(" ");
-}
-function openPlatformSetupPage(page, dependencies = {}) {
-	log.info((page.linkInTitle ? platformSetupLink(page) : page.title) + "\n" + page.instructions);
-	if (!page.linkInTitle) console.log(platformSetupLink({
-		...page,
-		title: "Open " + page.title
-	}));
-	if (dependencies.interactive ?? process.stdin.isTTY === true) try {
-		(dependencies.open ?? ((url) => openBrowser(url, execFile)))(page.url);
-	} catch {
-		log.info("Could not open the browser. Use the link above.");
-	}
-}
-//#endregion
 //#region src/cli/platform-access-setup.ts
 function accessSetupGuide() {
 	return platformSetupLink({
@@ -1596,11 +1298,11 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 		let choices;
 		if (options.length === 0) {
 			log.info("No reusable Allow or Deny policies were found in this account. Create an Allow policy for your company, or refresh after saving one.");
-			choices = [answer$2(await select({
+			choices = [platformPromptAnswer(await select({
 				message: "Company Access policies:",
 				options: actions
 			}))];
-		} else choices = answer$2(await multiselect({
+		} else choices = platformPromptAnswer(await multiselect({
 			message: "Company Access policies (select all that apply):",
 			options: [...options, ...actions],
 			initialValues: selectedIds,
@@ -1619,7 +1321,7 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 				title: "Open Cloudflare account",
 				url: `https://dash.cloudflare.com/${encodeURIComponent(accountId)}`
 			}));
-			if (!answer$2(await confirm({
+			if (!platformPromptAnswer(await confirm({
 				message: "Have you saved the new policy?",
 				initialValue: true
 			}))) continue;
@@ -1700,10 +1402,6 @@ function parsePlatformAccessSetupSpec(input) {
 	}
 	return value;
 }
-function answer$2(value) {
-	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
-	return value;
-}
 function secretReference(name) {
 	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || !process.env[name]) throw new Error("platform: Supply the referenced Access credential in the environment.");
 	return process.env[name];
@@ -1742,7 +1440,7 @@ async function preparePlatformAccessSetup(input) {
 			if (input.protection) throw new Error("platform: Protection requires cloudflareAccess create or existing application verification in --auth-config.");
 			return;
 		}
-		const mode = answer$2(await select({
+		const mode = platformPromptAnswer(await select({
 			message: "Cloudflare Access setup:",
 			options: [
 				{
@@ -1765,17 +1463,17 @@ async function preparePlatformAccessSetup(input) {
 		spec = { mode };
 		if (mode === "existing") {
 			log.info("Enter the account that owns your company’s Access configuration. This may differ from the account hosting Void.");
-			spec.accountId = answer$2(await text$1({
+			spec.accountId = platformPromptAnswer(await text$1({
 				message: "Cloudflare identity account ID:",
 				initialValue: input.plan.account.id
 			}));
 			if (input.login) {
 				log.info("Enter the ID of the Access application that provides company sign-in to Void.");
-				spec.loginApplicationId = answer$2(await text$1({ message: "Existing Access OIDC application ID:" }));
+				spec.loginApplicationId = platformPromptAnswer(await text$1({ message: "Existing Access OIDC application ID:" }));
 			}
 			if (input.protection) {
 				log.info("Enter the ID of the Access application that protects the platform’s UI and APIs.");
-				spec.protectionApplicationId = answer$2(await text$1({ message: "Existing Access protection application ID:" }));
+				spec.protectionApplicationId = platformPromptAnswer(await text$1({ message: "Existing Access protection application ID:" }));
 			}
 		}
 	}
@@ -1795,7 +1493,7 @@ async function preparePlatformAccessSetup(input) {
 		if (!(error instanceof PlatformCloudflareApiError) || ![401, 403].includes(error.status) || !process.stdin.isTTY || credential) throw error;
 		log.info(`Your current token lacks the required Access permissions for account ${accountId}. Create a token for that account using the permissions in the setup guide.`);
 		console.log(accessSetupGuide());
-		const token = answer$2(await password({ message: "Access setup API token:" }));
+		const token = platformPromptAnswer(await password({ message: "Access setup API token:" }));
 		input.save({ accessManagementToken: token });
 		management = new PlatformCloudflareClient(token, { apiBase: input.client.apiBaseUrl });
 		client = new PlatformAccessClient(management, accountId);
@@ -1804,7 +1502,7 @@ async function preparePlatformAccessSetup(input) {
 		policies = await client.list("policies");
 	}
 	if (!spec.identityProviderIds && process.stdin.isTTY) log.info("Choose how employees sign in—for example, your company’s Okta or Google Workspace connection.");
-	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? answer$2(await multiselect({
+	const identityProviderIds = spec.identityProviderIds ?? (process.stdin.isTTY ? platformPromptAnswer(await multiselect({
 		message: "Company identity providers:",
 		required: true,
 		options: providers.filter((provider) => typeof provider.id === "string").map(platformAccessIdentityProvider).map((provider) => ({
@@ -1839,9 +1537,9 @@ async function preparePlatformAccessSetup(input) {
 		else if (process.stdin.isTTY) {
 			log.info("This lets the installer reach the protected platform during setup. Use a service token allowed by the existing Access application.");
 			serviceToken = {
-				id: answer$2(await text$1({ message: "Existing admitted Access service token ID:" })),
-				clientId: answer$2(await password({ message: "Access service token client ID:" })),
-				clientSecret: answer$2(await password({ message: "Access service token client secret:" }))
+				id: platformPromptAnswer(await text$1({ message: "Existing admitted Access service token ID:" })),
+				clientId: platformPromptAnswer(await password({ message: "Access service token client ID:" })),
+				clientSecret: platformPromptAnswer(await password({ message: "Access service token client secret:" }))
 			};
 			input.save({ accessExistingServiceTokenJson: JSON.stringify(serviceToken) });
 		}
@@ -1862,7 +1560,7 @@ async function preparePlatformAccessSetup(input) {
 	};
 	console.log(JSON.stringify({ accessPlan: reviewed }, null, 2));
 	if (!input.yes) {
-		if (!process.stdin.isTTY || !answer$2(await confirm({
+		if (!process.stdin.isTTY || !platformPromptAnswer(await confirm({
 			message: "Apply this Access configuration?",
 			initialValue: false
 		}))) throw new Error("platform: Access setup changes require confirmation or --yes.");
@@ -1877,7 +1575,7 @@ async function preparePlatformAccessSetup(input) {
 	let loginClientSecret = spec.loginClientSecretEnv ? secretReference(spec.loginClientSecretEnv) : input.checkpoint.accessExistingLoginSecret;
 	if (input.login && spec.mode === "existing" && !loginClientSecret && process.stdin.isTTY) {
 		log.info("Enter the client secret from the existing Access login application’s OIDC settings.");
-		loginClientSecret = answer$2(await password({ message: "Existing Access OIDC client secret:" }));
+		loginClientSecret = platformPromptAnswer(await password({ message: "Existing Access OIDC client secret:" }));
 		input.save({ accessExistingLoginSecret: loginClientSecret });
 	}
 	const result = await provisionPlatformAccess(client, {
@@ -1944,8 +1642,8 @@ async function verifyPlatformManagementAccess(client, accountId, access) {
 }
 function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access) {
 	if (!platformOperatorNeedsManagementToken(credential, plan, access)) return;
-	const createsZone = plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-	const writesDns = plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
+	const createsZone = planCreatesZone(plan);
+	const writesDns = planWritesDns(plan);
 	const permissions = [
 		...createsZone ? ["Account → Zone → Edit"] : [],
 		...writesDns ? ["Zone → DNS → Edit"] : [],
@@ -1958,7 +1656,13 @@ function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access)
 	throw new Error(`platform: Cloudflare browser login cannot authorize the planned ${access ? "Access setup" : "zone or DNS changes"}. Set CLOUDFLARE_API_TOKEN with ${permissions.join(" and ")}, scoped to the selected account${createsZone || writesDns ? " and application zone" : ""}, then rerun the command.`);
 }
 function platformOperatorNeedsManagementToken(credential, plan, access) {
-	return credential.source === "oauth" && (!!access || plan.actions.some((action) => action.kind === "zone" && action.action === "create" || action.kind === "dns-record" && action.action !== "reuse"));
+	return credential.source === "oauth" && (!!access || planCreatesZone(plan) || planWritesDns(plan));
+}
+function planCreatesZone(plan) {
+	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
+}
+function planWritesDns(plan) {
+	return plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
 }
 async function resolvePlatformCloudflareCredential(dependencies = {}) {
 	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
@@ -2022,26 +1726,18 @@ async function readExistingCredential(dependencies, runWrangler) {
 	if (!(dependencies.interactive ?? process.stdin.isTTY === true)) throw new Error("platform: Cloudflare authentication is required. Run `void cloudflare login` interactively, or set CLOUDFLARE_API_TOKEN in CI.");
 	return await readWranglerOAuthCredential(runWrangler);
 }
-async function readWranglerOAuthCredential(runWrangler = (args) => runCloudflareAuthCommand(process.cwd(), args)) {
+async function readWranglerOAuthCredential(runWrangler) {
 	const result = await runWrangler({ type: "auth.token" }, true);
 	if (result.status !== 0 || result.signal || result.error) return null;
-	try {
-		const parsed = result.data;
-		if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
-		return {
-			source: "oauth",
-			token: parsed.token.trim()
-		};
-	} catch {
-		return null;
-	}
+	const parsed = result.data;
+	if (!parsed || parsed.type !== "oauth" || typeof parsed.token !== "string" || !parsed.token.trim()) return null;
+	return {
+		source: "oauth",
+		token: parsed.token.trim()
+	};
 }
 //#endregion
 //#region src/cli/platform-app-access.ts
-function answer$1(value) {
-	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
-	return value;
-}
 async function selectInstallationAppAccess(authentication, recorded, choice) {
 	const config = authentication.file?.appAccess;
 	if (config && (typeof config !== "object" || Array.isArray(config) || "apiToken" in config || config.tokenEnv !== void 0 && (typeof config.tokenEnv !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(config.tokenEnv)))) throw new Error("platform: App access configuration must use tokenEnv; plaintext tokens are not accepted.");
@@ -2057,7 +1753,7 @@ async function selectInstallationAppAccess(authentication, recorded, choice) {
 		return recorded.appAccess;
 	}
 	const protectedPlatform = !!authentication.authentication.accessProtection;
-	const selected = supplied ?? (!process.stdin.isTTY ? protectedPlatform ? "platform" : "public" : answer$1(await select({
+	const selected = supplied ?? (!process.stdin.isTTY ? protectedPlatform ? "platform" : "public" : platformPromptAnswer(await select({
 		message: "Who should be able to access deployed apps?",
 		initialValue: protectedPlatform ? "platform" : "public",
 		options: [
@@ -2128,7 +1824,7 @@ async function prepareInstallationAppAccess(input) {
 	const collectToken = async () => {
 		if (!process.stdin.isTTY) throw new Error("platform: App access requires VOID_PLATFORM_APP_ACCESS_TOKEN or appAccess.tokenEnv in --auth-config, scoped to the hosting account.");
 		tokenPage();
-		const value = String(answer$1(await password({ message: "App access API token (stored encrypted when app rules are needed):" }))).trim();
+		const value = String(platformPromptAnswer(await password({ message: "App access API token (stored encrypted when app rules are needed):" }))).trim();
 		if (!value || /\s/.test(value)) throw new Error("platform: An app access token without whitespace is required.");
 		input.save({
 			appAccessToken: value,
@@ -2172,7 +1868,7 @@ async function prepareInstallationAppAccess(input) {
 	if (!organization) throw new Error(`platform: Enable Zero Trust in account ${input.plan.account.name}, then resume to configure app access.`);
 	if (!token) {
 		log.info("Void needs an Access-management token stored encrypted to manage access for future apps and custom domains.");
-		if (reusable && process.stdin.isTTY && answer$1(await confirm({
+		if (reusable && process.stdin.isTTY && platformPromptAnswer(await confirm({
 			message: "Reuse the setup token for ongoing app access management?",
 			initialValue: true
 		}))) {
@@ -2192,7 +1888,7 @@ async function prepareInstallationAppAccess(input) {
 			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.identityProviderIds in --auth-config for the hosting account.");
 			const providers = (await access.list("identity_providers")).map(platformAccessIdentityProvider);
 			if (!providers.length) throw new Error(`platform: Add an identity provider in Zero Trust for ${input.plan.account.name}, then resume.`);
-			identityProviderIds = answer$1(await multiselect({
+			identityProviderIds = platformPromptAnswer(await multiselect({
 				message: "App identity providers:",
 				required: true,
 				options: providers.map((p) => ({
@@ -5227,11 +4923,7 @@ async function ensurePlatformAccessHealthChecks(input) {
 				recorded.id = created.id;
 				save();
 			} catch (error) {
-				if (error instanceof PlatformCloudflareApiError && error.status >= 400 && error.status < 500 && ![
-					408,
-					409,
-					429
-				].includes(error.status)) {
+				if (platformAccessCreateRejected(error)) {
 					recorded.pending = false;
 					save();
 				}
@@ -5281,7 +4973,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	].map((value) => new URL(value).origin).some((origin) => !origins.includes(origin)) || protection.applications.some((entry) => entry.audience !== app.aud || !platformAccessPublicDestinations(app).includes(new URL(entry.origin).hostname))) throw new Error("platform: Access audiences and complete origin coverage must match the active platform protection. Restore the current Access checkpoint or repair its applications.");
 	for (const other of await access.list("apps")) {
 		if (other.id === app.id) continue;
-		if (platformAccessPublicDestinations(other).some((destination) => origins.some((origin) => platformAccessOverlapsOrigin(destination, origin)) && (destination.includes("/") || origins.some((origin) => destination === new URL(origin).hostname)))) throw new Error("platform: Another Access application overlaps a protected platform origin. Reconcile it before maintenance.");
+		if (platformAccessOverlapsOrigins(other, origins)) throw new Error("platform: Another Access application overlaps a protected platform origin. Reconcile it before maintenance.");
 	}
 	const liveToken = (await access.list("service_tokens")).find((entry) => entry.id === service.id);
 	const expiry = liveToken?.expires_at;
@@ -5292,7 +4984,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DcbL_LW_.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-zxDr0hWW.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -7813,10 +7505,6 @@ function platformManagementAccessForAuthentication(selection, accountId, checkpo
 		readOnly: spec?.mode === "existing"
 	};
 }
-function answer(value) {
-	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
-	return value;
-}
 async function selectInstallationAuthentication(file, recorded, choices = {}) {
 	if (file) {
 		const input = JSON.parse(await readFile(file, "utf8"));
@@ -7841,7 +7529,7 @@ async function selectInstallationAuthentication(file, recorded, choices = {}) {
 		return { authentication: recorded };
 	}
 	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
-	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : answer(await multiselect({
+	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : platformPromptAnswer(await multiselect({
 		message: "Platform login methods (select all that apply):",
 		initialValues: [],
 		required: true,
@@ -7864,7 +7552,7 @@ async function selectInstallationAuthentication(file, recorded, choices = {}) {
 			}
 		]
 	})));
-	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : answer(await confirm({
+	const protection = choices.accessProtection ?? (!process.stdin.isTTY ? false : platformPromptAnswer(await confirm({
 		message: "Also protect the platform UI and APIs with Cloudflare Access?",
 		initialValue: false
 	})));
@@ -7887,7 +7575,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	}
 	const prompt = async (message, initialValue = "", masked = false) => {
 		if (!process.stdin.isTTY) throw new Error(`platform: ${message} Supply it through --auth-config and environment references.`);
-		return masked ? answer(await password({ message })) : answer(await text$1({
+		return masked ? platformPromptAnswer(await password({ message })) : platformPromptAnswer(await text$1({
 			message,
 			initialValue
 		}));
@@ -7954,7 +7642,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 		save({ [partialKey]: JSON.stringify(connection) });
 		connections.push(connection);
 	}
-	const administratorConnectionId = selection.file?.administratorConnectionId ?? (connections.length === 1 ? connections[0].configuration.id : process.stdin.isTTY ? answer(await select({
+	const administratorConnectionId = selection.file?.administratorConnectionId ?? (connections.length === 1 ? connections[0].configuration.id : process.stdin.isTTY ? platformPromptAnswer(await select({
 		message: "Login method for the first administrator:",
 		options: connections.map((entry) => ({
 			value: entry.configuration.id,
@@ -7985,7 +7673,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	} : { mode: "restricted" });
 	if (!selection.file && !protection && process.stdin.isTTY) {
 		const eligible = connections.filter((entry) => entry.configuration.kind !== "github" && (entry.configuration.kind !== "google" || entry.configuration.allowedDomains.length > 0));
-		const mode = answer(await select({
+		const mode = platformPromptAnswer(await select({
 			message: "Who can create an account?",
 			initialValue: eligible.length ? "company" : "restricted",
 			options: [
@@ -8003,7 +7691,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 				}
 			]
 		}));
-		const ids = mode === "company" ? answer(await multiselect({
+		const ids = mode === "company" ? platformPromptAnswer(await multiselect({
 			message: "Company login methods that qualify new users:",
 			required: true,
 			initialValues: eligible.map((entry) => entry.configuration.id),
@@ -8188,24 +7876,25 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-Bsq43AJp.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-p0kobLV8.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-DQAqAQYu.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-PvNS9Nl2.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
 			return;
 		}
-		for (const manifest of recovered) log.success(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
+		for (const manifest of recovered) log.step(`Recovered ${manifest.deployment.displayName} (${manifest.id}) at ${manifest.endpoints.apiUrl}.`);
+		printSuccess(`Recovered ${recovered.length} platform installation${recovered.length === 1 ? "" : "s"}.`);
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-Bbwf6-Dq.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-oi-SvI3f.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -8378,7 +8067,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-Bbwf6-Dq.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-oi-SvI3f.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8783,7 +8472,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-Bbwf6-Dq.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-oi-SvI3f.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8807,7 +8496,6 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
-		log.success(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 		log.info(`API URL: ${plan.apiUrl}`);
 		if (result.emailOperationId) log.info(`Shared email routing ready. Operation: ${result.emailOperationId}.`);
 		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
@@ -8817,7 +8505,8 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			log.info("Confirm your identity in the browser, then test and enable any additional login methods in Settings.");
 		}
 		if (!plan.deployment.application.zoneName) log.info("Apps will use workers.dev addresses. When your domain is ready: void platform domain set <domain>");
-		outro("Run `void account login`, then deploy an app with `void deploy --platform void`.");
+		log.info("Run `void account login`, then deploy an app with `void deploy --platform void`.");
+		printSuccess(`${result.manifest.deployment.displayName} is installed at ${new URL("/admin", plan.apiUrl).href}.`);
 	} catch (error) {
 		progress?.error("Platform installation failed.");
 		progress = void 0;