void 0.26.1 → 0.28.0

package/dist/{platform-lifecycle-D_QEY32D.mjs → platform-lifecycle-DOW-wLfx.mjs}

@@ -1,22 +1,23 @@
-import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-P387v42A.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { n as ensurePlatformAccessToken } from "./cf-access-ngGqZpHZ.mjs";
+import { a as join, c as resolve, n as dirname } from "./dist-ipQi0Q8y.mjs";
+import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
+import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess, l as import_picocolors, n as cliCommandName, r as createSpinner, u as note } from "./output-C50ag2r3.mjs";
-import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-2-TfIEzB.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CuxfF6OA.mjs";
-import { _ as resolvePinnedApiBaseUrl, o as createDefaultRunWrangler } from "./provision-BfaLiWbj.mjs";
-import { t as parsePlatformArgs } from "./platform-args-BoZkWQnJ.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-DVe42Ws7.mjs";
-import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-FNHKw5Ac.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-CeDWJRhj.mjs";
+import { d as resolvePinnedApiBaseUrl, i as createDefaultRunWrangler } from "./provision-DDh7ITVS.mjs";
+import { t as parsePlatformArgs } from "./platform-args-C6Mb_I3a.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CqFBDo52.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-CTf6MMT9.mjs";
+import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
-import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY as REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY as REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
-import { encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
+import { cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { createServer, request } from "node:http";
 import { readFile } from "node:fs/promises";
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
@@ -201,7 +202,19 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		return null;
 	}
 	async listWorkerDomains(accountId) {
-		return (await this.#listWorkerDomainRecords(accountId)).map((entry) => ({
+		const result = [];
+		const perPage = 100;
+		for (let page = 1;; page++) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: String(perPage)
+			});
+			const response = await this.#requestEnvelope(`/accounts/${encodeURIComponent(accountId)}/workers/domains?${query}`);
+			result.push(...response.result);
+			const totalPages = response.resultInfo?.total_pages;
+			if (typeof totalPages === "number" && page >= totalPages || totalPages === void 0 && response.result.length < perPage) break;
+		}
+		return result.map((entry) => ({
 			hostname: requiredString(entry.hostname, "Worker custom domain hostname"),
 			id: requiredString(entry.id, "Worker custom domain id"),
 			service: requiredString(entry.service, "Worker custom domain service"),
@@ -241,26 +254,8 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		} catch (error) {
 			throw new PlatformWorkerCustomDomainsChangedError(`platform: Custom Domain publication for Worker ${JSON.stringify(workerName)} had an ambiguous outcome; retaining live domains for safe reconciliation.`, { cause: error });
 		}
-		const expected = [...origins].map((origin) => origin.hostname).sort();
 		const inventory = await this.listWorkerDomains(accountId);
-		const actual = inventory.filter((domain) => domain.service === workerName).map((domain) => domain.hostname).sort();
-		if (!expected.every((hostname) => inventory.filter((domain) => domain.hostname === hostname && domain.service === workerName).length === 1) || expected.some((hostname) => !actual.includes(hostname))) throw new PlatformWorkerCustomDomainsChangedError(`platform: Worker ${JSON.stringify(workerName)} Custom Domains changed concurrently after publication; refusing to overwrite the newer traffic state.`);
-	}
-	async #listWorkerDomainRecords(accountId, service) {
-		const entries = [];
-		const perPage = 100;
-		for (let page = 1;; page++) {
-			const query = new URLSearchParams({
-				page: String(page),
-				per_page: String(perPage)
-			});
-			if (service) query.set("service", service);
-			const response = await this.#requestEnvelope(`/accounts/${encodeURIComponent(accountId)}/workers/domains?${query}`);
-			entries.push(...response.result);
-			const totalPages = response.resultInfo?.total_pages;
-			if (typeof totalPages === "number" && page >= totalPages || totalPages === void 0 && response.result.length < perPage) break;
-		}
-		return entries;
+		if (!origins.every(({ hostname }) => inventory.filter((domain) => domain.hostname === hostname && domain.service === workerName).length === 1)) throw new PlatformWorkerCustomDomainsChangedError(`platform: Worker ${JSON.stringify(workerName)} Custom Domains changed concurrently after publication; refusing to overwrite the newer traffic state.`);
 	}
 	async listWorkerRoutes(zoneId) {
 		return (await this.request(`/zones/${encodeURIComponent(zoneId)}/workers/routes`)).map((entry) => ({
@@ -586,9 +581,8 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 	async deleteResource(accountId, resource, zoneId) {
 		const { kind } = resource;
 		if (kind === "ai-gateway" && this.#aiGatewayClient) return this.#aiGatewayClient.deleteResource(accountId, resource, zoneId);
-		const account = encodeURIComponent(accountId);
 		const encoded = encodeURIComponent(kind === "dispatch-namespace" || kind === "worker" ? resource.name : resource.id);
-		const path = kind === "kv-namespace" ? `/accounts/${account}/storage/kv/namespaces/${encoded}` : kind === "dns-record" ? zoneId ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}` : null : kind === "ai-gateway" ? `/accounts/${account}/ai-gateway/gateways/${encoded}` : kind === "r2-bucket" ? `/accounts/${account}/r2/buckets/${encoded}` : kind === "queue" ? `/accounts/${account}/queues/${encoded}` : kind === "dispatch-namespace" ? `/accounts/${account}/workers/dispatch/namespaces/${encoded}` : kind === "hyperdrive" ? `/accounts/${account}/hyperdrive/configs/${encoded}` : kind === "worker" ? `/accounts/${account}/workers/scripts/${encoded}` : kind === "zone" ? `/zones/${encoded}` : null;
+		const path = deletionPath(kind, encodeURIComponent(accountId), encoded, zoneId);
 		if (!path) throw new Error(`platform: Unsupported Cloudflare deletion kind ${kind}.`);
 		await this.#deleteIfPresent(path);
 	}
@@ -718,9 +712,6 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			})
 		});
 	}
-	async removeRoutes(_accountId, _zoneId, tracked) {
-		if (tracked.routes.length > 0 || tracked.customDomains.length > 0) throw new Error("platform: Cloudflare does not support conditional Worker traffic deletion. Retaining routes and custom domains for explicit dashboard cleanup.");
-	}
 };
 function accessResourcePath(accountId, kind, id) {
 	return `/accounts/${encodeURIComponent(accountId)}/access/${kind === "application" ? "apps" : "service_tokens"}/${encodeURIComponent(id)}`;
@@ -734,6 +725,20 @@ function parseEmailRoutingTarget(rule) {
 		workerName: action?.type === "worker" && value.length === 1 && typeof value[0] === "string" ? value[0] : null
 	};
 }
+function deletionPath(kind, account, encoded, zoneId) {
+	switch (kind) {
+		case "kv-namespace": return `/accounts/${account}/storage/kv/namespaces/${encoded}`;
+		case "dns-record": return zoneId ? `/zones/${encodeURIComponent(zoneId)}/dns_records/${encoded}` : null;
+		case "ai-gateway": return `/accounts/${account}/ai-gateway/gateways/${encoded}`;
+		case "r2-bucket": return `/accounts/${account}/r2/buckets/${encoded}`;
+		case "queue": return `/accounts/${account}/queues/${encoded}`;
+		case "dispatch-namespace": return `/accounts/${account}/workers/dispatch/namespaces/${encoded}`;
+		case "hyperdrive": return `/accounts/${account}/hyperdrive/configs/${encoded}`;
+		case "worker": return `/accounts/${account}/workers/scripts/${encoded}`;
+		case "zone": return `/zones/${encoded}`;
+		default: return null;
+	}
+}
 function cloudflareErrorDetails(envelope, status) {
 	return envelope.errors?.filter((error) => error.message).map((error) => error.code === void 0 ? error.message : `${error.message} (code ${error.code})`).join(", ") || `HTTP ${status}`;
 }
@@ -872,6 +877,9 @@ function sameSet(left, right) {
 function fingerprint(value) {
 	return createHash("sha256").update(JSON.stringify(value)).digest("hex");
 }
+function platformAccessNonce(ownershipNonce) {
+	return createHash("sha256").update(`void-access:${ownershipNonce}`).digest("hex").slice(0, 32);
+}
 var PlatformAccessClient = class {
 	client;
 	accountId;
@@ -1015,8 +1023,6 @@ async function inspectPlatformAccess(client, input) {
 	};
 }
 async function provisionPlatformAccess(client, input, previous, save) {
-	if (!input.login && !input.protection) return { resources: [] };
-	if (client.accountId !== input.accountId) throw new Error("platform: Access account selection does not match its management client.");
 	const inspected = await inspectPlatformAccess(client, input);
 	const origins = [...new Set([
 		input.apiUrl,
@@ -1027,13 +1033,7 @@ async function provisionPlatformAccess(client, input, previous, save) {
 		if (url.origin !== value || url.protocol !== "https:") throw new Error("platform: Access requires exact HTTPS origins without credentials, paths, or query strings.");
 		return url.origin;
 	}))];
-	const state = previous ? structuredClone(previous) : {
-		version: 1,
-		accountId: input.accountId,
-		installationId: input.installationId,
-		nonce: randomBytes(16).toString("hex"),
-		resources: {}
-	};
+	const state = structuredClone(previous);
 	if (state.version !== 1 || state.accountId !== input.accountId || state.installationId !== input.installationId || !/^[a-f0-9]{32}$/.test(state.nonce)) throw new Error("platform: Access recovery data belongs to a different installation.");
 	save(state);
 	const policies = input.policyIds.map((id, index) => ({
@@ -1569,7 +1569,7 @@ async function preparePlatformAccessSetup(input) {
 		version: 1,
 		accountId,
 		installationId: input.plan.installationId,
-		nonce: createHash("sha256").update(`void-access:${input.ownershipNonce}`).digest("hex").slice(0, 32),
+		nonce: platformAccessNonce(input.ownershipNonce),
 		resources: {}
 	};
 	let loginClientSecret = spec.loginClientSecretEnv ? secretReference(spec.loginClientSecretEnv) : input.checkpoint.accessExistingLoginSecret;
@@ -1774,11 +1774,6 @@ async function selectInstallationAppAccess(authentication, recorded, choice) {
 	})));
 	if (selected === "public" && (config?.identityProviderIds?.length || config?.policyIds?.length)) throw new Error("platform: Public apps cannot select identity policies. Choose custom app access to require company login.");
 	if (selected === "platform" && !protectedPlatform) throw new Error("platform: Reusing the platform Access policy requires --access-protection. Choose --app-access custom to protect apps separately.");
-	if (![
-		"public",
-		"platform",
-		"custom"
-	].includes(String(selected))) throw new Error("platform: Choose who can access deployed apps.");
 	return selected;
 }
 /** Collect the hosting-account policy once, with explicit consent for a durable management token. */
@@ -1800,7 +1795,6 @@ async function prepareInstallationAppAccess(input) {
 		}
 	}
 	const file = input.authentication.file?.appAccess;
-	if (file?.tokenEnv && !/^[A-Z_][A-Z0-9_]*$/.test(file.tokenEnv)) throw new Error("platform: Invalid app access token environment reference.");
 	let token = explicitToken || (input.checkpoint.appAccessTokenRejected ? void 0 : input.checkpoint.appAccessToken);
 	if (input.checkpoint.appAccessTokenRejected) log.info("The previous app access token was rejected. Provide a replacement to continue.");
 	const setupSpec = input.checkpoint.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(input.checkpoint.accessSetupSpecJson)) : input.authentication.file?.cloudflareAccess;
@@ -2070,207 +2064,161 @@ async function verifyPlatformAuthenticationDatabase(client, accountId, resource,
 	if ((await read()).cachingDisabled !== true) throw new Error("platform: Could not verify uncached Hyperdrive reads. Authentication setup remains closed.");
 }
 //#endregion
-//#region src/cli/platform-installer-health.ts
-var PlatformAccessBlockedError = class extends Error {
-	constructor(url, context) {
-		super(context?.accessProtected ? [
-			"platform: Cloudflare Access blocked a protected platform health check (Default-Deny, error 1050).",
-			`Blocked URL: ${url}`,
-			"Keep employee Access protection and account-wide Default-Deny enabled.",
-			"The reserved dispatch /health endpoint uses a path-only Access exception and still requires Void’s private probe token.",
-			"Resume to verify the health exceptions and saved installer credentials.",
-			...context.resumeCommand ? [`Resume: ${context.resumeCommand}`] : [],
-			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
-		].join("\n") : [
-			"platform: Cloudflare Access blocked the platform health checks (Default-Deny, error 1050).",
-			`Blocked URL: ${url}`,
-			"",
-			"To make this test platform publicly reachable:",
-			"",
-			`1. In ${context ? `account ${JSON.stringify(context.accountName)}` : "your Cloudflare account"}, open:`,
-			"   Zero Trust → Access controls → Applications → Create new application.",
-			"2. Choose Self-hosted. When adding destinations, choose Worker and select:",
-			`   ${context ? context.workers.join(", ") + "." : "This installation's API, proxy, and dispatch Workers."}`,
-			"3. Add a policy: Action → Bypass; Include → Everyone.",
-			context?.resumeCommand ? `4. Save the policy and application, then resume:\n\n   ${context.resumeCommand}` : "4. Save the policy and application, then rerun your platform command.",
-			"",
-			"This removes Cloudflare Access protection for these Workers.",
-			"Void’s own authentication stays enabled. Keep account-wide Default-Deny on.",
-			"",
-			"For platforms that must remain Access-protected:",
-			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
-		].join("\n"));
-	}
-};
-async function platformProbeFailure(label, url, response, context) {
-	const message = `platform: ${label} failed at ${url} (HTTP ${response.status}).`;
-	if (response.status === 403 && response.headers.get("server")?.toLowerCase() === "cloudflare" && response.headers.get("content-type")?.toLowerCase().includes("text/html")) {
-		const body = await response.text().catch(() => "");
-		if (body.includes("Default-Deny") && /errorCode:\s*1050\b/.test(body)) return new PlatformAccessBlockedError(url, context);
-	}
-	return new Error(message);
+//#region src/cli/platform-installer-process.ts
+function platformWorkerCommandRunner(accountId, cwd, runner) {
+	return (operation, options) => runner(operation, accountId, cwd, options.capture);
 }
-async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicationBaseDomain, platformVersion, usageProtocolVersion, healthProbeToken, fetcher = fetch, dispatchOrigin, context) {
-	const request = (url) => fetcher(url, {
-		headers: {
-			"X-Void-Platform-Probe": healthProbeToken,
-			...cfAccessHeaders(process.env, url)
-		},
-		redirect: "manual",
-		signal: AbortSignal.timeout(3e4)
-	});
-	const dispatchUrl = dispatchOrigin ?? `https://${PLATFORM_HEALTH_HOSTNAME_LABEL}.${applicationBaseDomain}`;
-	const [health, discovery, proxy, dispatch, emailGateway] = await Promise.all([
-		request(`${apiUrl}/health`),
-		request(`${apiUrl}/.well-known/void-platform`),
-		request(`${proxyUrl}/health`),
-		request(`${dispatchUrl}/health`),
-		context?.emailGatewayUrl ? request(`${context.emailGatewayUrl}/health`) : void 0
-	]);
-	if (!health.ok) throw await platformProbeFailure("Health check", `${apiUrl}/health`, health, context);
-	if (!discovery.ok) throw await platformProbeFailure("Discovery check", `${apiUrl}/.well-known/void-platform`, discovery, context);
-	const body = await discovery.json();
-	if (body.installationId !== installationId) throw new Error("platform: Deployed API discovery identity does not match this installation.");
-	if (body.platformVersion !== platformVersion) throw new Error("platform: Deployed API discovery version does not match this release.");
-	if ((body.usageProtocolVersion ?? 0) !== usageProtocolVersion) throw new Error("platform: Deployed API usage protocol does not match this runtime. Traffic remains disabled.");
-	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", `${proxyUrl}/health`, proxy, context);
-	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", `${dispatchUrl}/health`, dispatch, context);
-	if (emailGateway) {
-		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", `${context.emailGatewayUrl}/health`, emailGateway, context);
-		const identity = await emailGateway.json();
-		if (identity?.installationId !== installationId || identity.platformVersion !== platformVersion || identity.emailProtocolVersion !== 1) throw new Error("platform: Deployed email gateway identity, version, or protocol does not match this installation.");
-	}
+async function runPlatformWrangler(operation, accountId, cwd, capture) {
+	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
 }
-async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fetch) {
-	const response = await fetcher(`${apiUrl}/internal/platform/sandbox-drain`, {
-		headers: {
-			"X-Void-Platform-Probe": healthProbeToken,
-			...cfAccessHeaders(process.env, apiUrl)
-		},
-		signal: AbortSignal.timeout(3e4),
-		redirect: "manual"
+const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
+/** Opt-in maintainer diagnostics, enabled with VOID_PLATFORM_TIMINGS=1. */
+function writePlatformTiming(label, startedAt) {
+	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] ${label} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
+}
+async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false, apiToken) {
+	const startedAt = performance.now();
+	const result = await createDefaultRunWrangler(process.cwd(), {
+		launcher: resolveCloudflareOperationArgv(),
+		parallelWorkerUpload,
+		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
+	})(operation, {
+		accountId,
+		apiBaseUrl,
+		apiToken,
+		cwd
 	});
-	if (!response.ok) throw new Error(`platform: Sandbox drain probe failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
-	let value;
-	try {
-		value = await response.json();
-	} catch {
-		throw new Error("platform: Sandbox drain probe did not return its DB-backed protocol v1 document. Traffic remains disabled.");
+	writePlatformTiming(`Cloudflare ${operation.type}`, startedAt);
+	const stdout = result.stdout || "";
+	const stderr = result.stderr || "";
+	if (!capture && result.status !== 0) {
+		if (stdout) process.stdout.write(stdout);
+		if (stderr) process.stderr.write(stderr);
 	}
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
-	const status = value;
-	const validState = status.state === "required" || status.state === "draining" || status.state === "complete";
-	const validPhase = status.phase === null || status.phase === "deployments" || status.phase === "resources";
-	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
-	return status.state === "complete";
+	return {
+		...result,
+		stderr,
+		stdout
+	};
 }
-async function verifyPlatformDeploymentExecutionDrain(apiUrl, healthProbeToken, installationId, fetcher = fetch) {
-	const response = await fetcher(`${apiUrl}/__void/platform/deployment-execution`, {
-		headers: {
-			"X-Void-Platform-Probe": healthProbeToken,
-			...cfAccessHeaders(process.env, apiUrl)
-		},
-		signal: AbortSignal.timeout(3e4),
-		redirect: "manual"
+const HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+function forwardHeaders(headers) {
+	return Object.fromEntries(Object.entries(headers).filter(([name]) => !HOP_BY_HOP_HEADERS.has(name.toLowerCase())));
+}
+function closeHttpServer(server) {
+	return new Promise((resolvePromise, rejectPromise) => {
+		server.close((error) => {
+			if (error) rejectPromise(error);
+			else resolvePromise();
+		});
+		server.closeAllConnections();
 	});
-	if (!response.ok) throw new Error(`platform: Deployment execution drain probe failed (HTTP ${response.status}). Keep the current runtime until its durable deployment operations have drained.`);
-	let value;
-	try {
-		value = await response.json();
-	} catch {
-		throw new Error("platform: Deployment execution drain probe returned an invalid document.");
-	}
-	const status = value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (status?.protocolVersion !== 1 || status.installationId !== installationId || typeof status.admissionClosed !== "boolean" || !Number.isSafeInteger(status.pendingDeployments) || Number(status.pendingDeployments) < 0) throw new Error("platform: Deployment execution drain probe returned an invalid document.");
-	if (!status.admissionClosed || status.pendingDeployments !== 0) throw new Error("platform: Durable deployment operations are still admitted or unfinished. Keep the current runtime and retry this command after they finish.");
 }
-async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
-	const deadline = Date.now() + 3e5;
-	let operationId = null;
-	const timedOut = () => /* @__PURE__ */ new Error(`platform: Shared email bootstrap did not finish within five minutes at ${apiUrl}.${operationId ? ` Operation ${operationId} remains incomplete.` : ""} Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
-	const waitForProgress = async () => {
-		const remaining = deadline - Date.now();
-		if (remaining <= 0) throw timedOut();
-		await new Promise((resolve) => setTimeout(resolve, Math.min(1e3, remaining)));
+async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId, workerName) {
+	const upstreamBase = new URL(upstreamApiBaseUrl);
+	if (upstreamBase.protocol !== "http:" && upstreamBase.protocol !== "https:") throw new Error("platform: Cloudflare API base URL must use HTTP or HTTPS.");
+	const basePath = upstreamBase.pathname.replace(/\/+$/, "");
+	const accountPath = `${basePath}/accounts/${encodeURIComponent(accountId)}`;
+	const expectedPath = `${accountPath}/workers/scripts/${encodeURIComponent(workerName)}`;
+	const assetUploadPath = `${accountPath}/workers/assets/upload`;
+	const state = {
+		assetSessionStarted: false,
+		attempted: false,
+		conflictStatus: null,
+		created: false,
+		forwarded: false,
+		rejectedMutation: null
 	};
-	let response;
-	let value;
-	let status;
-	for (;;) {
-		const remaining = deadline - Date.now();
-		if (remaining <= 0) throw timedOut();
-		const signal = AbortSignal.timeout(Math.min(12e4, remaining));
-		try {
-			response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
-				method: "POST",
-				headers: {
-					"X-Void-Platform-Probe": healthProbeToken,
-					...cfAccessHeaders(process.env, apiUrl)
-				},
-				signal,
-				redirect: "manual"
-			});
-		} catch (error) {
-			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
-				await waitForProgress();
-				continue;
-			}
-			throw new Error(`platform: Shared email bootstrap request failed at ${apiUrl}. Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
-		}
-		try {
-			value = await response.json();
-		} catch (error) {
-			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
-				await waitForProgress();
-				continue;
+	const server = createServer((incoming, outgoing) => {
+		(async () => {
+			const incomingUrl = new URL(incoming.url ?? "/", "http://127.0.0.1");
+			if (incomingUrl.pathname !== basePath && !incomingUrl.pathname.startsWith(`${basePath}/`)) {
+				outgoing.writeHead(502, { "Content-Type": "application/json" });
+				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Invalid API proxy path\"}]}");
+				return;
 			}
-			throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
-		}
-		status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-		const observedOperationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
-		if (status?.version === 1 && observedOperationId) {
-			if (operationId && operationId !== observedOperationId) throw new Error("platform: Shared email bootstrap operation identity changed while waiting. Traffic remains disabled. Inspect the installation before retrying.");
-			operationId = observedOperationId;
-		}
-		if ([
-			200,
-			202,
-			503
-		].includes(response.status) && status?.version === 1 && status.state === "incomplete" && observedOperationId && (status.operationStatus === "pending" || status.operationStatus === "running") && status.failureCode == null) {
-			await waitForProgress();
-			continue;
-		}
-		break;
-	}
-	if (!response.ok || status?.version !== 1 || status.state !== "ready" || operationId === null || status.operationId !== operationId || status.operationStatus != null && status.operationStatus !== "completed" || status.failureCode != null) {
-		const code = (value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,63}$/.test(value) ? value : null;
-		const operationStatus = code(status?.operationStatus);
-		const operationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
-		const details = operationId ? [`Operation ${operationId}: ${operationStatus ?? "incomplete"}.`] : operationStatus ? [`Operation status: ${operationStatus}.`] : [];
-		const currentStep = code(status?.currentStep);
-		const failureCode = code(status?.failureCode);
-		if (currentStep) details.push(`Step: ${currentStep}.`);
-		if (failureCode) details.push(`Failure: ${failureCode}.`);
-		let domain = null;
-		if (typeof status?.domain === "string") try {
-			domain = normalizeApplicationDomain(status.domain);
-		} catch {}
-		const inboundStatus = code(status?.inboundStatus);
-		if (domain) details.push(`Domain: ${domain}${inboundStatus ? ` (inbound: ${inboundStatus})` : ""}.`);
-		const mxDetail = domain ? `MX records for ${domain} do not route mail to Cloudflare Email Routing` : null;
-		const safeDetails = [
-			...domain ? [mxDetail, `enabled explicit Cloudflare email rules conflict with ${domain}`] : [],
-			"zone catch-all does not point to this ingress",
-			"another enabled catch-all owns this zone"
-		];
-		if (typeof status?.failureDetail === "string" && safeDetails.includes(status.failureDetail)) {
-			details.push(`${status.failureDetail}.`);
-			if (currentStep === "inbound_probe" && status.failureDetail === mxDetail) details.push(`Enable Email Routing for ${domain} in the Cloudflare dashboard, then resume this installation.`);
-		}
-		const detail = details.length ? ` ${details.join(" ")}` : "";
-		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
+			const createQuery = [...incomingUrl.searchParams];
+			const supportedCreateQuery = new Set(createQuery.map(([key]) => key)).size === createQuery.length && createQuery.every(([key, value]) => key === "excludeScript" && value === "true" || key === "bindings_inherit" && value === "strict");
+			const isConditionalCreate = incoming.method === "PUT" && incomingUrl.pathname === expectedPath && supportedCreateQuery;
+			const isTopLevelWorkerUpload = incoming.method === "PUT" && new RegExp(`^${basePath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/accounts/[^/]+/workers/scripts/[^/]+$`).test(incomingUrl.pathname);
+			const isReadOnly = incoming.method === "GET" || incoming.method === "HEAD" || incoming.method === "OPTIONS";
+			const isAssetUploadSession = incoming.method === "POST" && incomingUrl.pathname === `${expectedPath}/assets-upload-session` && incomingUrl.search === "";
+			const isAssetUpload = incoming.method === "POST" && state.assetSessionStarted && (incomingUrl.pathname === assetUploadPath && incomingUrl.search === "?base64=true" || incomingUrl.search === "" && incomingUrl.pathname.startsWith(`${assetUploadPath}/`) && /^[0-9a-f]{32}$/.test(incomingUrl.pathname.slice(assetUploadPath.length + 1)));
+			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !isAssetUploadSession && !isAssetUpload && !state.created) {
+				state.rejectedMutation = `${incoming.method ?? "UNKNOWN"} ${incomingUrl.pathname}${incomingUrl.pathname === expectedPath && !supportedCreateQuery ? " (unsupported Worker create query)" : ""}`;
+				incoming.resume();
+				outgoing.writeHead(409, { "Content-Type": "application/json" });
+				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Mutation blocked until conditional Worker creation succeeds\"}]}");
+				return;
+			}
+			const headers = forwardHeaders(incoming.headers);
+			delete headers.host;
+			if (isConditionalCreate) {
+				state.attempted = true;
+				headers["if-none-match"] = "*";
+			}
+			if (isAssetUploadSession) state.assetSessionStarted = true;
+			const upstreamUrl = new URL(`${incomingUrl.pathname}${incomingUrl.search}`, upstreamBase.origin);
+			const request$2 = (upstreamUrl.protocol === "https:" ? request$1 : request)(upstreamUrl, {
+				headers,
+				method: incoming.method
+			}, (response) => {
+				if (isConditionalCreate) {
+					state.forwarded = true;
+					if (response.statusCode === 409 || response.statusCode === 412) state.conflictStatus = response.statusCode;
+					state.created = response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300;
+				}
+				const responseHeaders = forwardHeaders(response.headers);
+				outgoing.writeHead(response.statusCode ?? 502, responseHeaders);
+				response.pipe(outgoing);
+			});
+			request$2.on("error", () => {
+				if (!outgoing.headersSent) outgoing.writeHead(502, { "Content-Type": "application/json" });
+				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Cloudflare API proxy request failed\"}]}");
+			});
+			incoming.pipe(request$2);
+		})().catch(() => {
+			if (!outgoing.headersSent) outgoing.writeHead(502, { "Content-Type": "application/json" });
+			outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Cloudflare API proxy failed\"}]}");
+		});
+	});
+	await new Promise((resolvePromise, rejectPromise) => {
+		server.once("error", rejectPromise);
+		server.listen(0, "127.0.0.1", () => {
+			server.off("error", rejectPromise);
+			resolvePromise();
+		});
+	});
+	return {
+		apiBaseUrl: `http://127.0.0.1:${server.address().port}${basePath}`,
+		close: () => closeHttpServer(server),
+		state
+	};
+}
+async function withConditionalPlatformWorkerCreate(accountId, workerName, operation, upstreamApiBaseUrl = resolvePinnedApiBaseUrl()) {
+	const proxy = await startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId, workerName);
+	let result;
+	try {
+		result = await operation(proxy.apiBaseUrl);
+	} finally {
+		await proxy.close();
 	}
-	return operationId;
+	if (proxy.state.rejectedMutation) throw new Error(`platform: Wrangler attempted unexpected mutation ${proxy.state.rejectedMutation} while conditionally creating new Worker ${workerName}; the mutation was blocked.`);
+	if (!proxy.state.attempted || !proxy.state.forwarded) throw new Error(`platform: Wrangler did not use the guarded create endpoint for new Worker ${workerName}; refusing an unverified deployment.`);
+	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
+	return result;
+}
+async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl, apiToken) {
+	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl, false, apiToken), upstreamApiBaseUrl);
 }
 //#endregion
 //#region src/cli/platform-plan.ts
@@ -2383,8 +2331,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		}
 		throw error;
 	});
-	const [workersSubdomain, aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, deploymentQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
-		Promise.resolve(accountSubdomain),
+	const [aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, deploymentQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
 		gatewayInventory,
 		client.listKvNamespaces(account.id, names.routingKv),
 		client.listKvNamespaces(account.id, names.isrCacheKv),
@@ -2405,10 +2352,20 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		const bucket = r2Buckets.find((resource) => resource.name === names.assetsBucket);
 		const recordedBucket = existing.resources.find((resource) => resource.key === "assets-bucket" && resource.kind === "r2-bucket" && resource.ownership === "created" && resource.state === "ready");
 		if (bucket && recordedBucket?.id === bucket.id && recordedBucket.name === bucket.name) {
-			if (!matchesResourceMarker(await client.getR2Object(account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), existing, "assets-bucket", "r2-bucket", bucket) || !matchesRecordedR2Fingerprint(recordedBucket.configHash, bucket)) ambiguousResources.add("assets-bucket");
+			if (resourceMarkerProblem(await client.getR2Object(account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), existing, {
+				id: bucket.id,
+				key: "assets-bucket",
+				kind: "r2-bucket",
+				name: bucket.name
+			}) || !matchesRecordedR2Fingerprint(recordedBucket.configHash, bucket)) ambiguousResources.add("assets-bucket");
 		}
 		if (bucket && hasUnrecordedProvisionIntent(existing, "assets-bucket", "r2-bucket", bucket.name)) {
-			if (matchesResourceMarker(await client.getR2Object(account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), existing, "assets-bucket", "r2-bucket", bucket)) intentProofs.add("assets-bucket");
+			if (!resourceMarkerProblem(await client.getR2Object(account.id, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), existing, {
+				id: bucket.id,
+				key: "assets-bucket",
+				kind: "r2-bucket",
+				name: bucket.name
+			})) intentProofs.add("assets-bucket");
 		}
 		for (const [key, name] of [
 			["api-worker", names.apiWorker],
@@ -2417,8 +2374,10 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			["tail-worker", names.tailWorker],
 			["dispatch-worker", names.dispatchWorker]
 		]) if (workers.includes(name) && hasUnrecordedProvisionIntent(existing, key, "worker", name)) {
-			if (matchesResourceMarker((await client.getWorkerPlainTextBindings(account.id, name)).PLATFORM_OWNERSHIP_MARKER, existing, key, "worker", {
+			if (!resourceMarkerProblem((await client.getWorkerPlainTextBindings(account.id, name)).PLATFORM_OWNERSHIP_MARKER, existing, {
 				id: name,
+				key,
+				kind: "worker",
 				name
 			})) intentProofs.add(key);
 		}
@@ -2446,6 +2405,14 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		if (records.length > 0 && (!matchingDomain || !ownedApiWorker)) throw new Error(`platform: Custom API hostname ${JSON.stringify(apiHostname)} already has a DNS record that installation would replace. Choose another hostname or remove the record explicitly.`);
 	}
 	const actions = [];
+	const named = {
+		actions,
+		existing,
+		options,
+		remoteOwnership,
+		intentProofs,
+		ambiguousResources
+	};
 	if (!testing) {
 		const recordedZone = existing?.resources.find((resource) => resource.key === "zone");
 		const remotelyOwnedZone = remoteOwnership?.resources.some((resource) => resource.key === "zone" && resource.id === zone?.id);
@@ -2469,15 +2436,60 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		name: names.aiGateway,
 		reason: "AI Gateway access will be verified with the runtime token before provisioning (AI Gateway: Edit required)."
 	});
-	else addNamedPlan(actions, existing, "ai-gateway", "ai-gateway", names.aiGateway, aiGateways.filter((resource) => resource.id === names.aiGateway), "reuse", options, remoteOwnership, intentProofs);
-	addNamedPlan(actions, existing, "routing-kv", "kv-namespace", names.routingKv, routingKv, "reuse", options, remoteOwnership, intentProofs);
-	addNamedPlan(actions, existing, "isr-cache-kv", "kv-namespace", names.isrCacheKv, isrKv, "reuse", options, remoteOwnership);
-	addNamedPlan(actions, existing, "legacy-assets-kv", "kv-namespace", names.legacyAssetsKv, legacyKv, "reuse", options, remoteOwnership);
-	addNamedPlan(actions, existing, "assets-bucket", "r2-bucket", names.assetsBucket, r2Buckets.filter((resource) => resource.name === names.assetsBucket), "reuse", options, remoteOwnership, intentProofs, ambiguousResources);
-	addNamedPlan(actions, existing, "usage-queue", "queue", names.usageQueue, usageQueues, "reuse", options, remoteOwnership);
-	addNamedPlan(actions, existing, "cron-queue", "queue", names.cronQueue, cronQueues, "reuse", options, remoteOwnership);
-	if (options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue")) addNamedPlan(actions, existing, "deployment-queue", "queue", names.deploymentQueue, deploymentQueues, "reuse", options, remoteOwnership);
-	addNamedPlan(actions, existing, "dispatch-namespace", "dispatch-namespace", names.dispatchNamespace, dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace), "reuse", options, remoteOwnership);
+	else addNamedPlan(named, {
+		key: "ai-gateway",
+		kind: "ai-gateway",
+		name: names.aiGateway,
+		matches: aiGateways.filter((resource) => resource.id === names.aiGateway)
+	});
+	addNamedPlan(named, {
+		key: "routing-kv",
+		kind: "kv-namespace",
+		name: names.routingKv,
+		matches: routingKv
+	});
+	addNamedPlan(named, {
+		key: "isr-cache-kv",
+		kind: "kv-namespace",
+		name: names.isrCacheKv,
+		matches: isrKv
+	});
+	addNamedPlan(named, {
+		key: "legacy-assets-kv",
+		kind: "kv-namespace",
+		name: names.legacyAssetsKv,
+		matches: legacyKv
+	});
+	addNamedPlan(named, {
+		key: "assets-bucket",
+		kind: "r2-bucket",
+		name: names.assetsBucket,
+		matches: r2Buckets.filter((resource) => resource.name === names.assetsBucket)
+	});
+	addNamedPlan(named, {
+		key: "usage-queue",
+		kind: "queue",
+		name: names.usageQueue,
+		matches: usageQueues
+	});
+	addNamedPlan(named, {
+		key: "cron-queue",
+		kind: "queue",
+		name: names.cronQueue,
+		matches: cronQueues
+	});
+	if (options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue")) addNamedPlan(named, {
+		key: "deployment-queue",
+		kind: "queue",
+		name: names.deploymentQueue,
+		matches: deploymentQueues
+	});
+	addNamedPlan(named, {
+		key: "dispatch-namespace",
+		kind: "dispatch-namespace",
+		name: names.dispatchNamespace,
+		matches: dispatchNamespaces.filter((resource) => resource.name === names.dispatchNamespace)
+	});
 	const recordedHyperdrive = existing?.resources.find((resource) => resource.key === "hyperdrive");
 	const externalHyperdriveId = input.externalHyperdrive?.id || (recordedHyperdrive?.ownership === "adopted" ? recordedHyperdrive.id : "");
 	if (externalHyperdriveId) {
@@ -2494,17 +2506,28 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			name: remote.name,
 			reason: recordedHyperdrive ? "Reuse the recorded externally managed Hyperdrive." : "Use the externally managed Hyperdrive without taking ownership."
 		});
-	} else addNamedPlan(actions, existing, "hyperdrive", "hyperdrive", names.hyperdrive, hyperdrives.filter((resource) => resource.name === names.hyperdrive), "reuse", options, remoteOwnership);
+	} else addNamedPlan(named, {
+		key: "hyperdrive",
+		kind: "hyperdrive",
+		name: names.hyperdrive,
+		matches: hyperdrives.filter((resource) => resource.name === names.hyperdrive)
+	});
 	for (const [key, name] of [
 		["api-worker", names.apiWorker],
 		["proxy-worker", names.proxyWorker],
 		...options?.includeEmailGateway === false ? [] : [["email-gateway-worker", names.emailGatewayWorker]],
 		["tail-worker", names.tailWorker],
 		["dispatch-worker", names.dispatchWorker]
-	]) addNamedPlan(actions, existing, key, "worker", name, workers.includes(name) ? [{
-		id: name,
-		name
-	}] : [], "update", options, remoteOwnership, intentProofs);
+	]) addNamedPlan(named, {
+		key,
+		kind: "worker",
+		name,
+		matches: workers.includes(name) ? [{
+			id: name,
+			name
+		}] : [],
+		existingAction: "update"
+	});
 	const resolvedResources = { ...deployment.resources };
 	for (const action of actions) {
 		const resourceKey = RESOURCE_NAME_KEY_BY_ACTION[action.key];
@@ -2514,8 +2537,8 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...deployment,
 		resources: resolvedResources
 	});
-	const apiUrl = resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${workersSubdomain}.workers.dev`;
-	const proxyUrl = resolvedDeployment.controlPlane.proxyHostname ? `https://${deployment.controlPlane.proxyHostname}` : `https://${resolvedDeployment.resources.proxyWorker}.${workersSubdomain}.workers.dev`;
+	const apiUrl = resolvedDeployment.controlPlane.apiHostname ? `https://${deployment.controlPlane.apiHostname}` : `https://${resolvedDeployment.resources.apiWorker}.${accountSubdomain}.workers.dev`;
+	const proxyUrl = `https://${resolvedDeployment.resources.proxyWorker}.${accountSubdomain}.workers.dev`;
 	return {
 		account,
 		actions,
@@ -2525,10 +2548,13 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...input.externalHyperdrive ? { externalHyperdrive: input.externalHyperdrive } : {},
 		installationId,
 		proxyUrl,
-		workersSubdomain,
+		workersSubdomain: accountSubdomain,
 		zone
 	};
 }
+function platformWorkersDevUrl(plan, workerName) {
+	return `https://${workerName}.${plan.workersSubdomain}.workers.dev`;
+}
 async function revalidatePlatformInstallAction(client, original, manifest, action, options) {
 	if (options?.stableWorkerUpdate && !options.repairMissing && action.kind === "worker" && action.action === "update" && original.actions.some((entry) => entry.key === action.key && entry.kind === action.kind && entry.action === action.action && entry.id === action.id && entry.name === action.name) && original.actions.every((entry) => {
 		const resource = manifest.resources.find((candidate) => candidate.key === entry.key);
@@ -2536,8 +2562,10 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 	})) {
 		const recorded = manifest.resources.find((resource) => resource.key === action.key);
 		if (!recorded || recorded.kind !== "worker" || recorded.state !== "ready" || recorded.id !== action.name || recorded.name !== action.name) throw new Error(`platform: Worker ${JSON.stringify(action.name)} no longer matches the approved installation plan. Review a new plan before retrying.`);
-		if (!matchesResourceMarker((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, action.key, "worker", {
+		if (resourceMarkerProblem((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, {
 			id: action.name,
+			key: action.key,
+			kind: "worker",
 			name: action.name
 		})) throw new Error(`platform: Cloudflare Worker ${JSON.stringify(action.name)} no longer has this installation's ownership marker. Review a new plan before retrying.`);
 		return;
@@ -2560,8 +2588,10 @@ async function revalidatePlatformInstallAction(client, original, manifest, actio
 	})).actions.find((entry) => entry.key === action.key);
 	if (!current || current.kind !== action.kind || current.name !== action.name || current.action !== action.action) throw new Error(`platform: Cloudflare changed after the installation plan was approved for ${action.kind} ${JSON.stringify(action.name)}. Review a new plan before retrying.`);
 	if (action.kind === "worker" && action.action === "update") {
-		if (!matchesResourceMarker((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, action.key, "worker", {
+		if (resourceMarkerProblem((await client.getWorkerPlainTextBindings(original.account.id, action.name)).PLATFORM_OWNERSHIP_MARKER, manifest, {
 			id: action.name,
+			key: action.key,
+			kind: "worker",
 			name: action.name
 		})) throw new Error(`platform: Cloudflare Worker ${JSON.stringify(action.name)} no longer has this installation's ownership marker. Review a new plan before retrying.`);
 	}
@@ -2618,7 +2648,9 @@ function resolveAccount(accounts, selector) {
 	if (matches.length !== 1) throw new Error(matches.length === 0 ? `platform: Cloudflare account ${JSON.stringify(selector)} is not available to this token.` : "platform: Select a Cloudflare account with --account <id>.");
 	return matches[0];
 }
-function addNamedPlan(actions, existing, key, kind, name, matches, existingAction = "reuse", options, remoteOwnership, intentProofs = /* @__PURE__ */ new Set(), ambiguousResources = /* @__PURE__ */ new Set()) {
+function addNamedPlan(context, target) {
+	const { actions, existing, options, remoteOwnership, intentProofs, ambiguousResources } = context;
+	const { key, kind, name, matches, existingAction = "reuse" } = target;
 	if (matches.length > 1) throw new Error(`platform: More than one ${kind} named ${JSON.stringify(name)} exists.`);
 	const remote = matches[0];
 	const recorded = existing?.resources.find((resource) => resource.key === key);
@@ -2685,15 +2717,16 @@ function addNamedPlan(actions, existing, key, kind, name, matches, existingActio
 	});
 }
 function hasUnrecordedProvisionIntent(manifest, key, kind, name) {
-	return !manifest.resources.some((resource) => resource.key === key && resource.state === "ready") && manifest.steps.some((step) => isProvisionIntentStep(step.key, key) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name));
+	return !manifest.resources.some((resource) => resource.key === key && resource.state === "ready") && hasProvisionIntentStep(manifest, key, kind, name);
 }
 function hasAmbiguousProvisionIntent(manifest, key, kind, remoteId, name) {
 	const recorded = manifest.resources.find((resource) => resource.key === key);
 	if (recorded?.id === remoteId && recorded.kind === kind && recorded.name === name) return false;
-	return manifest.steps.some((step) => isProvisionIntentStep(step.key, key) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name, recorded?.id ?? null));
+	return hasProvisionIntentStep(manifest, key, kind, name, recorded?.id ?? null);
 }
-function isProvisionIntentStep(stepKey, resourceKey) {
-	return stepKey === `provision-intent:${resourceKey}` || stepKey.startsWith(`provision-intent:${resourceKey}:`);
+/** Whether the manifest records an intent to provision this resource. */
+function hasProvisionIntentStep(manifest, key, kind, name, previousResourceId = null) {
+	return manifest.steps.some((step) => (step.key === `provision-intent:${key}` || step.key.startsWith(`provision-intent:${key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name, previousResourceId));
 }
 function interruptedProvisionRetryName(manifest, key, kind, name) {
 	const suffix = `-retry-${createHash("sha256").update(JSON.stringify({
@@ -2704,36 +2737,53 @@ function interruptedProvisionRetryName(manifest, key, kind, name) {
 	})).digest("hex").slice(0, 32)}`;
 	return `${name.slice(0, 63 - suffix.length).replace(/-+$/, "")}${suffix}`;
 }
-function matchesRecordedR2Fingerprint(configHash, resource) {
-	if (!resource.fingerprint) return false;
-	const liveHash = createHash("sha256").update(JSON.stringify({
-		fingerprint: resource.fingerprint,
-		kind: "r2-bucket",
-		name: resource.name
+/** Name-only config hash, recorded for resources without a live fingerprint. */
+function legacyResourceConfigHash(kind, name) {
+	return createHash("sha256").update(JSON.stringify({
+		kind,
+		name
 	})).digest("hex");
-	const legacyHash = createHash("sha256").update(JSON.stringify({
+}
+function r2BucketConfigHash(name, fingerprint) {
+	return createHash("sha256").update(JSON.stringify({
+		fingerprint,
 		kind: "r2-bucket",
-		name: resource.name
+		name
+	})).digest("hex");
+}
+function dnsRecordConfigHash(name, type, content, proxied) {
+	return createHash("sha256").update(JSON.stringify({
+		content,
+		kind: "dns-record",
+		name,
+		proxied,
+		type
 	})).digest("hex");
-	return configHash === liveHash || configHash === legacyHash;
 }
-function matchesResourceMarker(value, manifest, key, kind, resource) {
-	if (!value) return false;
+/** Whether a live R2 bucket still matches the creation fingerprint recorded for it. */
+function matchesRecordedR2Fingerprint(configHash, bucket) {
+	if (!bucket.fingerprint) return false;
+	return configHash === r2BucketConfigHash(bucket.name, bucket.fingerprint) || configHash === legacyResourceConfigHash("r2-bucket", bucket.name);
+}
+/** Why `value` is not this installation's ownership marker for the resource, or null when it is. */
+function resourceMarkerProblem(value, manifest, resource) {
+	if (!value) return "has no ownership marker";
+	let actual;
 	try {
-		const actual = parsePlatformResourceOwnershipMarker(JSON.parse(value));
-		const expected = createPlatformResourceOwnershipMarker({
-			accountId: manifest.account.id,
-			installationId: manifest.id,
-			ownershipNonce: manifest.ownershipNonce,
-			resourceId: resource.id,
-			resourceKey: key,
-			resourceKind: kind,
-			resourceName: resource.name
-		});
-		return JSON.stringify(actual) === JSON.stringify(expected);
+		actual = parsePlatformResourceOwnershipMarker(JSON.parse(value));
 	} catch {
-		return false;
+		return "has an invalid ownership marker";
 	}
+	const expected = createPlatformResourceOwnershipMarker({
+		accountId: manifest.account.id,
+		installationId: manifest.id,
+		ownershipNonce: manifest.ownershipNonce,
+		resourceId: resource.id,
+		resourceKey: resource.key,
+		resourceKind: resource.kind,
+		resourceName: resource.name
+	});
+	return JSON.stringify(actual) === JSON.stringify(expected) ? null : "belongs to another installation";
 }
 function isLegacyUniqueProvisionAttempt(manifest, key, kind, name) {
 	const resourceSlug = resourceSlugForManifest(manifest);
@@ -2896,12 +2946,6 @@ function platformTrafficAttachmentWorker(deployment, resource) {
 	}
 	return null;
 }
-function trackedPlatformWorkerTraffic(_manifest, _workers) {
-	return {
-		customDomains: [],
-		routes: []
-	};
-}
 function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt) {
 	const desired = platformManagedWorkerTraffic(manifest.deployment, /* @__PURE__ */ new Set([workerName]));
 	let next = manifest;
@@ -3009,17 +3053,17 @@ function saveInstalledPlatformConnection(plan, manifest) {
 async function writeRemoteInstallationCheckpointWithoutDatabase(client, plan, manifest, databaseLock) {
 	const startedAt = performance.now();
 	await databaseLock?.checkpoint?.(manifest);
-	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] database checkpoint ${(performance.now() - startedAt).toFixed(0)} ms\n`);
+	writePlatformTiming("database checkpoint", startedAt);
 	const routing = manifest.resources.find((resource) => resource.key === "routing-kv" && resource.kind === "kv-namespace" && resource.ownership === "created" && resource.state === "ready");
 	if (!routing) return;
 	const kvStartedAt = performance.now();
 	await client.putKvValue(plan.account.id, routing.id, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, JSON.stringify(manifest));
-	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] remote checkpoint ${(performance.now() - kvStartedAt).toFixed(0)} ms\n`);
+	writePlatformTiming("remote checkpoint", kvStartedAt);
 }
 function recordProvisionIntent(manifest, action, now) {
 	const previousResourceId = manifest.resources.find((resource) => resource.key === action.key)?.id ?? null;
+	if (hasProvisionIntentStep(manifest, action.key, action.kind, action.name, previousResourceId)) return manifest;
 	const resultHash = platformProvisionIntentHash(manifest, action.key, action.kind, action.name, previousResourceId);
-	if (manifest.steps.find((step) => (step.key === `provision-intent:${action.key}` || step.key.startsWith(`provision-intent:${action.key}:`)) && step.resultHash === resultHash)) return manifest;
 	return recordInstallationStep(manifest, {
 		completedAt: now,
 		key: `provision-intent:${action.key}:${resultHash.slice(0, 16)}`,
@@ -3035,7 +3079,7 @@ function recordAdoptionIntent(manifest, action, id, now) {
 }
 function hasProvisionIntent(manifest, action) {
 	const previousResourceId = manifest.resources.find((resource) => resource.key === action.key)?.id ?? null;
-	return manifest.steps.some((step) => (step.key === `provision-intent:${action.key}` || step.key.startsWith(`provision-intent:${action.key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, action.key, action.kind, action.name, previousResourceId));
+	return hasProvisionIntentStep(manifest, action.key, action.kind, action.name, previousResourceId);
 }
 async function createResource(client, plan, action, databaseUrl, zoneId) {
 	switch (action.kind) {
@@ -3052,10 +3096,7 @@ async function createResource(client, plan, action, databaseUrl, zoneId) {
 function recordResource(manifest, action, id, ownership, now, databaseUrl, resourceFingerprint) {
 	const previous = manifest.resources.find((resource) => resource.key === action.key);
 	return recordInstallationResource(manifest, {
-		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && resourceFingerprint ? resourceFingerprint : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : hash(JSON.stringify({
-			kind: action.kind,
-			name: action.name
-		})),
+		configHash: action.kind === "dns-record" ? dnsRecordConfigHash(action.name, "AAAA", "100::", true) : action.kind === "hyperdrive" && resourceFingerprint ? resourceFingerprint : action.kind === "hyperdrive" && databaseUrl ? hyperdriveOriginConfigHash(hyperdriveOriginFromConnectionString(databaseUrl)) : action.kind === "r2-bucket" && resourceFingerprint ? r2BucketConfigHash(action.name, resourceFingerprint) : legacyResourceConfigHash(action.kind, action.name),
 		id,
 		key: action.key,
 		kind: action.kind,
@@ -3064,13 +3105,6 @@ function recordResource(manifest, action, id, ownership, now, databaseUrl, resou
 		state: "ready"
 	}, now);
 }
-function r2BucketConfigHash(name, fingerprint) {
-	return hash(JSON.stringify({
-		fingerprint,
-		kind: "r2-bucket",
-		name
-	}));
-}
 function retainReplacedInstallationResource(manifest, action, now) {
 	const previous = manifest.resources.find((resource) => resource.key === action.key);
 	if (action.action !== "create" || !previous || previous.state !== "ready" || previous.name === action.name) return manifest;
@@ -3098,7 +3132,6 @@ function validateReplannedWorkerActions(original, manifest, actions) {
 	return actions;
 }
 async function inventoryUnmanagedPlatformWorkerTraffic(client, plan, workerName) {
-	if (!client.listWorkerDomains || !client.listWorkerServiceRoutes) throw new Error(`platform: Cloudflare traffic inventory is required before updating Worker ${JSON.stringify(workerName)}.`);
 	const [routes, domains] = await Promise.all([client.listWorkerServiceRoutes(plan.account.id, workerName), client.listWorkerDomains(plan.account.id)]);
 	const managed = platformManagedWorkerTraffic(plan.deployment, /* @__PURE__ */ new Set([workerName]));
 	const managedRoutes = new Set(managed.routes.map((route) => route.pattern));
@@ -3176,10 +3209,6 @@ function requiredBoolean(value, field) {
 	if (typeof value !== "boolean") throw new Error(`platform: ${field} must be a boolean.`);
 	return value;
 }
-async function publishPlatformWorkerCustomDomains(client, accountId, workerName, origins) {
-	if (!client.publishWorkerCustomDomainsSafely) throw new Error("platform: Safe Cloudflare Custom Domain publication is unavailable.");
-	await client.publishWorkerCustomDomainsSafely(accountId, workerName, origins);
-}
 function uniqueTriggerRoutes(routes) {
 	const seen = /* @__PURE__ */ new Set();
 	return routes.filter((route) => {
@@ -3189,15 +3218,6 @@ function uniqueTriggerRoutes(routes) {
 		return true;
 	});
 }
-function dnsRecordConfigHash(name, type, content, proxied) {
-	return hash(JSON.stringify({
-		content,
-		kind: "dns-record",
-		name,
-		proxied,
-		type
-	}));
-}
 function hash(value) {
 	return createHash("sha256").update(value).digest("hex");
 }
@@ -3257,7 +3277,7 @@ function createPlatformInstallationSecrets(input) {
 	if (modernAuthentication && !existingInstallation && (authSetupToken.length < 32 || !/^[a-f0-9]{64}$/.test(authBootstrapCode))) throw new Error("platform: Valid setup authority and an administrator setup code are required.");
 	if (authenticationSetupJson) {
 		const setup = parsePlatformAuthenticationSetup(JSON.parse(authenticationSetupJson));
-		if (!existingInstallation && (authSetupToken.length < 32 || !/^[a-f0-9]{64}$/.test(authBootstrapCode) || createHash("sha256").update(authBootstrapCode).digest("hex") !== setup.bootstrapCredentialHash)) throw new Error("platform: Valid installation setup authority and a matching administrator setup code are required.");
+		if (!existingInstallation && createHash("sha256").update(authBootstrapCode).digest("hex") !== setup.bootstrapCredentialHash) throw new Error("platform: Valid installation setup authority and a matching administrator setup code are required.");
 	}
 	const jwtSecret = restoredIdentity(input.jwtSecret || "", "jwtSecret");
 	const resolvedJwtSecret = input.existingInstallation ? jwtSecret : required(jwtSecret, "VOID_PLATFORM_JWT_SECRET");
@@ -3282,6 +3302,11 @@ function createPlatformInstallationSecrets(input) {
 	});
 	const pendingWorkerSecretUpdateIntent = parseWorkerSecretUpdateIntent(checkpoint.workerSecretUpdatesJson);
 	const emailSigningSecretUpdateAuthorized = emailSigningSecretInScope && !!emailSigningSecret && (emailEnabled && (!existingEmailEnabled || !checkpoint.emailSigningSecret) || !!input.emailSigningSecret);
+	const githubOptional = existingInstallation || modernAuthentication;
+	const resolve = (key, requiredName, optional) => {
+		const value = configured(input[key], key);
+		return optional ? value : required(value, requiredName);
+	};
 	const explicitWorkerSecretUpdates = withoutEmptySecrets({
 		CF_API_TOKEN: input.cloudflareApiToken,
 		...emailSigningSecretUpdateAuthorized ? { EMAIL_SIGNING_SECRET: emailSigningSecret } : {},
@@ -3306,20 +3331,20 @@ function createPlatformInstallationSecrets(input) {
 		...checkpoint.accessCredentialsJson ? { accessCredentialsJson: checkpoint.accessCredentialsJson } : {},
 		workerSecretUpdates: input.updateExistingWorkers ? explicitWorkerSecretUpdates : {},
 		pendingWorkerSecretUpdateIntent: input.updateExistingWorkers ? pendingWorkerSecretUpdateIntent : void 0,
-		bootstrapGitHubId: existingInstallation || modernAuthentication ? configured(input.bootstrapGitHubId, "bootstrapGitHubId") : required(configured(input.bootstrapGitHubId, "bootstrapGitHubId"), "resolved administrator GitHub account id"),
-		bootstrapGitHubLogin: existingInstallation || modernAuthentication ? configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin") : required(configured(input.bootstrapGitHubLogin, "bootstrapGitHubLogin"), "VOID_PLATFORM_ADMIN_GITHUB_LOGIN"),
-		cloudflareApiToken: existingInstallation ? configured(input.cloudflareApiToken, "cloudflareApiToken") : required(configured(input.cloudflareApiToken, "cloudflareApiToken"), "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN"),
+		bootstrapGitHubId: resolve("bootstrapGitHubId", "resolved administrator GitHub account id", githubOptional),
+		bootstrapGitHubLogin: resolve("bootstrapGitHubLogin", "VOID_PLATFORM_ADMIN_GITHUB_LOGIN", githubOptional),
+		cloudflareApiToken: resolve("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN", existingInstallation),
 		databaseUrl: required(input.databaseUrl || checkpoint.databaseUrl || "", "DATABASE_URL"),
 		emailEnabled,
 		emailSigningSecret,
-		githubClientId: existingInstallation || modernAuthentication ? configured(input.githubClientId, "githubClientId") : required(configured(input.githubClientId, "githubClientId"), "VOID_PLATFORM_GITHUB_CLIENT_ID"),
-		githubClientSecret: existingInstallation || modernAuthentication ? configured(input.githubClientSecret, "githubClientSecret") : required(configured(input.githubClientSecret, "githubClientSecret"), "VOID_PLATFORM_GITHUB_CLIENT_SECRET"),
+		githubClientId: resolve("githubClientId", "VOID_PLATFORM_GITHUB_CLIENT_ID", githubOptional),
+		githubClientSecret: resolve("githubClientSecret", "VOID_PLATFORM_GITHUB_CLIENT_SECRET", githubOptional),
 		jwtSecret: resolvedJwtSecret,
 		projectSecretActiveKeyVersion: projectSecretKeyring.activeVersion,
 		projectSecretKey: projectSecretKeyring.v1Key,
 		projectSecretKeysJson: projectSecretKeyring.keysJson,
-		r2AccessKeyId: existingInstallation ? configured(input.r2AccessKeyId, "r2AccessKeyId") : required(configured(input.r2AccessKeyId, "r2AccessKeyId"), "VOID_PLATFORM_R2_ACCESS_KEY_ID"),
-		r2SecretAccessKey: existingInstallation ? configured(input.r2SecretAccessKey, "r2SecretAccessKey") : required(configured(input.r2SecretAccessKey, "r2SecretAccessKey"), "VOID_PLATFORM_R2_SECRET_ACCESS_KEY")
+		r2AccessKeyId: resolve("r2AccessKeyId", "VOID_PLATFORM_R2_ACCESS_KEY_ID", existingInstallation),
+		r2SecretAccessKey: resolve("r2SecretAccessKey", "VOID_PLATFORM_R2_SECRET_ACCESS_KEY", existingInstallation)
 	};
 }
 function resolveProjectSecretKeyring(input) {
@@ -3461,14 +3486,7 @@ function platformWorkerSecretPayload(worker, secrets, accountId, zoneId, existin
 		}
 		return proxyWorkerSecrets(secrets, accountId);
 	}
-	const allowed = worker === "api" ? [
-		"CF_API_TOKEN",
-		"EMAIL_SIGNING_SECRET",
-		"GITHUB_CLIENT_ID",
-		"GITHUB_CLIENT_SECRET",
-		"R2_ACCESS_KEY_ID",
-		"R2_SECRET_ACCESS_KEY"
-	] : worker === "proxy" ? ["CF_API_TOKEN", "EMAIL_SIGNING_SECRET"] : ["EMAIL_SIGNING_SECRET"];
+	const allowed = worker === "api" ? PLATFORM_WORKER_SECRET_UPDATE_NAMES : worker === "proxy" ? ["CF_API_TOKEN", "EMAIL_SIGNING_SECRET"] : ["EMAIL_SIGNING_SECRET"];
 	const updates = Object.fromEntries(Object.entries(secrets.workerSecretUpdates ?? {}).filter(([name, value]) => allowed.includes(name) && typeof value === "string" && value !== ""));
 	return Object.keys(updates).length > 0 ? updates : null;
 }
@@ -3542,220 +3560,64 @@ function createPlatformHealthProbeToken(ownershipNonce) {
 //#endregion
 //#region src/cli/platform-installer-errors.ts
 function assertCleanPlatformWrangler(result, operation) {
-	if (result.status !== 0 || result.signal || result.error) throw new Error(`platform: Wrangler failed to ${operation} (${result.stderr.trim() || `exit ${result.status}`}).`);
-}
-function cleanPlatformCommandResult() {
-	return {
-		status: 0,
-		stderr: "",
-		stdout: ""
-	};
+	if (result.status !== 0 || result.signal || result.error) {
+		const diagnostic = cloudflareCommandDiagnostic({
+			...result,
+			stderr: result.stderr.trim() || result.errors?.map((error) => error.message).join("\n") || ""
+		});
+		throw new Error(`platform: Wrangler failed to ${operation} (${diagnostic || `exit ${result.status}`}).`);
+	}
 }
 function assertPlatformTriggerStabilization(result, workerName, targetVersionId, operation) {
 	if (!result.ok) throw new Error(`platform: Failed to ${operation} triggers for ${workerName} (${result.reason}).`);
 	if (!result.targetOwnsTraffic) throw new Error(`platform: Worker ${workerName} was superseded by ${result.activeVersionId} while publishing ${targetVersionId}; its active trigger state was repaired.`);
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 //#endregion
-//#region src/cli/platform-installer-process.ts
-function platformWorkerCommandRunner(accountId, cwd, runner) {
-	return (operation, options) => runner(operation, accountId, cwd, options.capture);
-}
-async function runPlatformWrangler(operation, accountId, cwd, capture) {
-	return runPlatformWranglerAtApiBase(operation, accountId, cwd, capture);
+//#region src/cli/platform-installer-inspection.ts
+var PlatformWorkerOwnershipError = class extends Error {};
+async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
+	const result = await runner({
+		type: "deployments.status",
+		configPath,
+		workerName
+	}, accountId, process.cwd(), true);
+	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
+	const value = result.data;
+	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
+	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
+	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
+	return active[0].version_id;
 }
-const PLATFORM_WRANGLER_TIMEOUT_MS = 6e5;
-async function runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl = resolvePinnedApiBaseUrl(), parallelWorkerUpload = false, apiToken) {
-	const startedAt = performance.now();
-	const result = await createDefaultRunWrangler(process.cwd(), {
-		launcher: resolveCloudflareOperationArgv(process.cwd()),
-		parallelWorkerUpload,
-		timeoutMs: PLATFORM_WRANGLER_TIMEOUT_MS
-	})(operation, {
-		accountId,
-		apiBaseUrl,
-		apiToken,
-		cwd
-	});
-	if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] Cloudflare ${operation.type} ${(performance.now() - startedAt).toFixed(0)} ms\n`);
-	const stdout = result.stdout || "";
-	const stderr = result.stderr || "";
-	if (!capture && result.status !== 0) {
-		if (stdout) process.stdout.write(stdout);
-		if (stderr) process.stderr.write(stderr);
-	}
-	return {
-		...result,
-		stderr,
-		stdout
-	};
-}
-const HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
-	"connection",
-	"keep-alive",
-	"proxy-authenticate",
-	"proxy-authorization",
-	"te",
-	"trailer",
-	"transfer-encoding",
-	"upgrade"
-]);
-function forwardHeaders(headers) {
-	return Object.fromEntries(Object.entries(headers).filter(([name]) => !HOP_BY_HOP_HEADERS.has(name.toLowerCase())));
-}
-function closeHttpServer(server) {
-	return new Promise((resolvePromise, rejectPromise) => {
-		server.close((error) => {
-			if (error) rejectPromise(error);
-			else resolvePromise();
-		});
-		server.closeAllConnections();
-	});
-}
-async function startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId, workerName) {
-	const upstreamBase = new URL(upstreamApiBaseUrl);
-	if (upstreamBase.protocol !== "http:" && upstreamBase.protocol !== "https:") throw new Error("platform: Cloudflare API base URL must use HTTP or HTTPS.");
-	const basePath = upstreamBase.pathname.replace(/\/+$/, "");
-	const accountPath = `${basePath}/accounts/${encodeURIComponent(accountId)}`;
-	const expectedPath = `${accountPath}/workers/scripts/${encodeURIComponent(workerName)}`;
-	const assetUploadPath = `${accountPath}/workers/assets/upload`;
-	const state = {
-		assetSessionStarted: false,
-		attempted: false,
-		conflictStatus: null,
-		created: false,
-		forwarded: false,
-		rejectedMutation: null
-	};
-	const server = createServer((incoming, outgoing) => {
-		(async () => {
-			const incomingUrl = new URL(incoming.url ?? "/", "http://127.0.0.1");
-			if (incomingUrl.pathname !== basePath && !incomingUrl.pathname.startsWith(`${basePath}/`)) {
-				outgoing.writeHead(502, { "Content-Type": "application/json" });
-				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Invalid API proxy path\"}]}");
-				return;
-			}
-			const createQuery = [...incomingUrl.searchParams];
-			const supportedCreateQuery = new Set(createQuery.map(([key]) => key)).size === createQuery.length && createQuery.every(([key, value]) => key === "excludeScript" && value === "true" || key === "bindings_inherit" && value === "strict");
-			const isConditionalCreate = incoming.method === "PUT" && incomingUrl.pathname === expectedPath && supportedCreateQuery;
-			const isTopLevelWorkerUpload = incoming.method === "PUT" && new RegExp(`^${basePath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/accounts/[^/]+/workers/scripts/[^/]+$`).test(incomingUrl.pathname);
-			const isReadOnly = incoming.method === "GET" || incoming.method === "HEAD" || incoming.method === "OPTIONS";
-			const isAssetUploadSession = incoming.method === "POST" && incomingUrl.pathname === `${expectedPath}/assets-upload-session` && incomingUrl.search === "";
-			const isAssetUpload = incoming.method === "POST" && state.assetSessionStarted && (incomingUrl.pathname === assetUploadPath && incomingUrl.search === "?base64=true" || incomingUrl.search === "" && incomingUrl.pathname.startsWith(`${assetUploadPath}/`) && /^[0-9a-f]{32}$/.test(incomingUrl.pathname.slice(assetUploadPath.length + 1)));
-			if (isTopLevelWorkerUpload && !isConditionalCreate || !isReadOnly && !isConditionalCreate && !isAssetUploadSession && !isAssetUpload && !state.created) {
-				state.rejectedMutation = `${incoming.method ?? "UNKNOWN"} ${incomingUrl.pathname}${incomingUrl.pathname === expectedPath && !supportedCreateQuery ? " (unsupported Worker create query)" : ""}`;
-				incoming.resume();
-				outgoing.writeHead(409, { "Content-Type": "application/json" });
-				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Mutation blocked until conditional Worker creation succeeds\"}]}");
-				return;
-			}
-			const headers = forwardHeaders(incoming.headers);
-			delete headers.host;
-			if (isConditionalCreate) {
-				state.attempted = true;
-				headers["if-none-match"] = "*";
-			}
-			if (isAssetUploadSession) state.assetSessionStarted = true;
-			const upstreamUrl = new URL(`${incomingUrl.pathname}${incomingUrl.search}`, upstreamBase.origin);
-			const request$2 = (upstreamUrl.protocol === "https:" ? request$1 : request)(upstreamUrl, {
-				headers,
-				method: incoming.method
-			}, (response) => {
-				if (isConditionalCreate) {
-					state.forwarded = true;
-					if (response.statusCode === 409 || response.statusCode === 412) state.conflictStatus = response.statusCode;
-					state.created = response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300;
-				}
-				const responseHeaders = forwardHeaders(response.headers);
-				outgoing.writeHead(response.statusCode ?? 502, responseHeaders);
-				response.pipe(outgoing);
-			});
-			request$2.on("error", () => {
-				if (!outgoing.headersSent) outgoing.writeHead(502, { "Content-Type": "application/json" });
-				outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Cloudflare API proxy request failed\"}]}");
-			});
-			incoming.pipe(request$2);
-		})().catch(() => {
-			if (!outgoing.headersSent) outgoing.writeHead(502, { "Content-Type": "application/json" });
-			outgoing.end("{\"success\":false,\"errors\":[{\"message\":\"Cloudflare API proxy failed\"}]}");
-		});
-	});
-	await new Promise((resolvePromise, rejectPromise) => {
-		server.once("error", rejectPromise);
-		server.listen(0, "127.0.0.1", () => {
-			server.off("error", rejectPromise);
-			resolvePromise();
-		});
-	});
-	return {
-		apiBaseUrl: `http://127.0.0.1:${server.address().port}${basePath}`,
-		close: () => closeHttpServer(server),
-		state
-	};
-}
-async function withConditionalPlatformWorkerCreate(accountId, workerName, operation, upstreamApiBaseUrl = resolvePinnedApiBaseUrl()) {
-	const proxy = await startConditionalWorkerCreateProxy(upstreamApiBaseUrl, accountId, workerName);
-	let result;
-	try {
-		result = await operation(proxy.apiBaseUrl);
-	} finally {
-		await proxy.close();
-	}
-	if (proxy.state.rejectedMutation) throw new Error(`platform: Wrangler attempted unexpected mutation ${proxy.state.rejectedMutation} while conditionally creating new Worker ${workerName}; the mutation was blocked.`);
-	if (!proxy.state.attempted || !proxy.state.forwarded) throw new Error(`platform: Wrangler did not use the guarded create endpoint for new Worker ${workerName}; refusing an unverified deployment.`);
-	if (proxy.state.conflictStatus !== null) throw new Error(`platform: Worker ${workerName} was created concurrently (HTTP ${proxy.state.conflictStatus}); no existing Worker was changed. Re-run to inspect the collision.`);
-	return result;
-}
-async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl, apiToken) {
-	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl, false, apiToken), upstreamApiBaseUrl);
-}
-//#endregion
-//#region src/cli/platform-installer-inspection.ts
-async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner({
-		type: "deployments.status",
-		configPath,
-		workerName
-	}, accountId, process.cwd(), true);
-	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
-	const value = result.data;
-	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
-	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
-	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
-	return active[0].version_id;
-}
-async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
-	const result = await runner({
-		type: "deployments.list",
-		configPath,
-		workerName
-	}, accountId, process.cwd(), true);
-	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
-	const value = result.data;
-	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-	return value.map((entry, index) => {
-		if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.created_on !== "string" || !Array.isArray(entry.versions)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-		const createdAt = Date.parse(entry.created_on);
-		if (!Number.isFinite(createdAt)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-		const versions = entry.versions.map((version) => {
-			if (!version || typeof version !== "object" || typeof version.version_id !== "string" || !Number.isFinite(Number(version.percentage))) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
-			return {
-				percentage: Number(version.percentage),
-				versionId: version.version_id
-			};
-		});
-		return {
-			createdAt,
-			id: entry.id,
-			index,
-			versions
-		};
-	}).sort((left, right) => right.createdAt - left.createdAt || left.index - right.index).map(({ id, versions }) => ({
-		id,
-		versions
-	}));
+async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
+	const result = await runner({
+		type: "deployments.list",
+		configPath,
+		workerName
+	}, accountId, process.cwd(), true);
+	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
+	const value = result.data;
+	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+	return value.map((entry, index) => {
+		if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.created_on !== "string" || !Array.isArray(entry.versions)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+		const createdAt = Date.parse(entry.created_on);
+		if (!Number.isFinite(createdAt)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+		const versions = entry.versions.map((version) => {
+			if (!version || typeof version !== "object" || typeof version.version_id !== "string" || !Number.isFinite(Number(version.percentage))) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
+			return {
+				percentage: Number(version.percentage),
+				versionId: version.version_id
+			};
+		});
+		return {
+			createdAt,
+			id: entry.id,
+			index,
+			versions
+		};
+	}).sort((left, right) => right.createdAt - left.createdAt || left.index - right.index).map(({ id, versions }) => ({
+		id,
+		versions
+	}));
 }
 function samePlatformWorkerTraffic(left, right) {
 	if (!left) return false;
@@ -3777,7 +3639,6 @@ function classifyPlatformWorkerDeploymentLineage(deployments, installedVersionId
 	};
 }
 async function inspectNewPlatformWorker(client, accountId, manifest, resourceKey, workerName) {
-	if (!client.listWorkerNames || !client.getWorkerPlainTextBindings) throw new Error("platform: Cloudflare Worker ownership inspection is unavailable.");
 	if (!(await client.listWorkerNames(accountId)).includes(workerName)) return "missing";
 	const bindings = await client.getWorkerPlainTextBindings(accountId, workerName);
 	let marker;
@@ -3826,7 +3687,7 @@ async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerNa
 	const resources = value.resources;
 	const bindings = resources && typeof resources === "object" && !Array.isArray(resources) ? resources.bindings : null;
 	const ownershipBindings = Array.isArray(bindings) ? bindings.filter((binding) => binding && typeof binding === "object" && binding.name === "PLATFORM_OWNERSHIP_MARKER" && binding.type === "plain_text" && typeof binding.text === "string") : [];
-	if (ownershipBindings.length !== 1 || ownershipBindings[0].text !== expectedOwnershipMarker) throw new Error(`platform: Active Worker version ${versionId} for ${workerName} does not belong to this installation.`);
+	if (ownershipBindings.length !== 1 || ownershipBindings[0].text !== expectedOwnershipMarker) throw new PlatformWorkerOwnershipError(`platform: Active Worker version ${versionId} for ${workerName} does not belong to this installation.`);
 	await validateCurrentVersion?.();
 	const annotations = value.annotations;
 	const message = annotations && typeof annotations === "object" && typeof annotations["workers/message"] === "string" ? annotations["workers/message"] ?? null : null;
@@ -4033,7 +3894,7 @@ function resolvePlatformPreviousTriggerConfig(versionSnapshot, configuredSnapsho
 //#endregion
 //#region src/cli/platform-trigger-proof.ts
 function record(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+	return isRecord(value) ? value : null;
 }
 function sameStrings(actual, expected) {
 	const sortedExpected = [...expected].sort();
@@ -4122,7 +3983,23 @@ async function platformWorkerLiveTriggersMatch(options) {
 }
 //#endregion
 //#region src/cli/platform-installer-workers.ts
-async function recoverInterruptedPlatformWorkerCutover(manifest, interruptedCutover, workerActions, configs, previousConfigs, plan, dependencies, ids, zoneId, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, onManifestChange) {
+function platformWorkerResourceKey(key) {
+	return key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`;
+}
+/** Callbacks shared by a platform Worker deploy and its interrupted-cutover rollback. */
+function platformWorkerTrafficCallbacks(input) {
+	const { client, accountId, ids, key, workerName, readManifest } = input;
+	return {
+		inspectNewWorker: () => inspectNewPlatformWorker(client, accountId, readManifest(), platformWorkerResourceKey(key), workerName),
+		publishCustomDomains: (name, origins) => client.publishWorkerCustomDomainsSafely(accountId, name, origins),
+		retainNewWorker: async () => {
+			await client.putKvValue(accountId, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+		}
+	};
+}
+async function recoverInterruptedPlatformWorkerCutover(input) {
+	const { interruptedCutover, configs, previousConfigs, plan, dependencies, ids, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, onManifestChange } = input;
+	let { manifest, workerActions } = input;
 	if (interruptedCutover) {
 		for (const key of [
 			"dispatch",
@@ -4163,15 +4040,14 @@ async function recoverInterruptedPlatformWorkerCutover(manifest, interruptedCuto
 					previousTriggers: mergePreservedTriggerRoutes(withoutPlatformCustomDomainTriggers(snapshot.previousTriggers), preservedRoutes),
 					previousVersionId: snapshot.previousVersionId,
 					preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
-					inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, manifest, key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`, snapshot.workerName),
-					removeCustomDomains: async () => {
-						if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
-						await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(manifest, /* @__PURE__ */ new Set([snapshot.workerName])));
-					},
-					publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
-					retainNewWorker: async () => {
-						await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-					},
+					...platformWorkerTrafficCallbacks({
+						client: dependencies.client,
+						accountId: plan.account.id,
+						ids,
+						key,
+						workerName: snapshot.workerName,
+						readManifest: () => manifest
+					}),
 					runner: runPinnedPlatformWrangler,
 					workerExisted: snapshot.previousVersionId !== null,
 					workerName: snapshot.workerName
@@ -4180,15 +4056,10 @@ async function recoverInterruptedPlatformWorkerCutover(manifest, interruptedCuto
 		}
 		manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "restored", now());
 		manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0, now());
-		let retainedNewWorker = false;
-		for (const [, snapshot] of interruptedCutover.staged) {
-			if (snapshot.previousVersionId !== null) continue;
-			retainedNewWorker = true;
-		}
 		onManifestChange(manifest);
 		writeInstallationManifest(manifest);
 		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-		if (retainedNewWorker) {
+		if ([...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null)) {
 			if (!dependencies.replanWorkers) throw new Error("platform: Recovering retained Workers requires a fresh Cloudflare installation plan.");
 			workerActions = validateReplannedWorkerActions(plan, manifest, await dependencies.replanWorkers(manifest)).filter((action) => hasEmailGatewayArtifact || action.key !== "email-gateway-worker");
 		}
@@ -4202,7 +4073,7 @@ let cachedPlatformUploaderHash;
 function platformWorkerUploaderHash() {
 	if (cachedPlatformUploaderHash !== void 0) return cachedPlatformUploaderHash;
 	try {
-		const launcher = resolveCloudflareOperationArgv(process.cwd())[1];
+		const launcher = resolveCloudflareOperationArgv()[1];
 		if (!launcher) return cachedPlatformUploaderHash = null;
 		const digest = createHash("sha256");
 		digest.update("platform-uploader:v1\0");
@@ -4376,10 +4247,6 @@ async function deployPlatformWorker(config, secrets, options) {
 					knownTriggerConfigs: { [versionId]: nextTriggers },
 					manageRoutes: false,
 					previousTriggerConfig: triggerConfig,
-					publishEmptyCustomDomains: async () => {
-						await options.removeCustomDomains();
-						return cleanPlatformCommandResult();
-					},
 					runWrangler: platformWorkerCommandRunner(accountId, directory, runner),
 					targetTriggerConfig: nextTriggers,
 					targetVersionId: versionId,
@@ -4401,7 +4268,7 @@ async function deployPlatformWorker(config, secrets, options) {
 					rollback: null,
 					unsafeTraffic: true
 				});
-				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} traffic reconciliation failed: ${errorMessage(error)}${failures.length > 0 ? ` Safety recovery also failed: ${failures.join("; ")}` : ""}`, { cause: error });
+				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} traffic reconciliation failed: ${getErrorMessage(error)}${failures.length > 0 ? ` Safety recovery also failed: ${failures.join("; ")}` : ""}`, { cause: error });
 			}
 		};
 		if (options.workerExisted && contentHash && reuseMatchingVersion && options.readCloudflare) {
@@ -4419,7 +4286,7 @@ async function deployPlatformWorker(config, secrets, options) {
 					snapshot
 				};
 			} catch (error) {
-				if (error instanceof Error && (error.message.includes("changed concurrently") || error.message.includes("does not belong to this installation"))) throw error;
+				if (error instanceof PlatformWorkerOwnershipError) throw error;
 			}
 			if (changedDuringRead) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
 			if (candidate && platformWorkerUploadFingerprint(config, options.managedRoutes) === contentHash) {
@@ -4528,7 +4395,7 @@ async function deployPlatformWorker(config, secrets, options) {
 					rollback: null,
 					unsafeTraffic: true
 				});
-				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} changed concurrently during activation, and restoring intervening deployment ${interveningDeployment.id} failed: ${errorMessage(recoveryError)}${recoveryFailures.length > 0 ? ` Safety recovery also failed: ${recoveryFailures.join("; ")}` : ""}`, { cause: recoveryError });
+				throw new PlatformWorkerRecoveryIncompleteError(`platform: Worker ${workerName} changed concurrently during activation, and restoring intervening deployment ${interveningDeployment.id} failed: ${getErrorMessage(recoveryError)}${recoveryFailures.length > 0 ? ` Safety recovery also failed: ${recoveryFailures.join("; ")}` : ""}`, { cause: recoveryError });
 			}
 			throw new Error(`platform: Worker ${workerName} changed concurrently during activation. The intervening deployment was restored without deleting deployment history.`);
 		}
@@ -4540,10 +4407,6 @@ async function deployPlatformWorker(config, secrets, options) {
 			},
 			manageRoutes: false,
 			previousTriggerConfig: previousTriggers,
-			publishEmptyCustomDomains: async () => {
-				await options.removeCustomDomains();
-				return cleanPlatformCommandResult();
-			},
 			runWrangler: platformWorkerCommandRunner(accountId, directory, readRunner),
 			targetTriggerConfig: nextTriggers,
 			targetVersionId: uploadedVersionId,
@@ -4565,7 +4428,6 @@ async function deployPlatformWorker(config, secrets, options) {
 			previousVersionId,
 			preserveCustomDomains: false,
 			inspectNewWorker: options.inspectNewWorker,
-			removeCustomDomains: options.removeCustomDomains,
 			publishCustomDomains: options.publishCustomDomains,
 			retainNewWorker: options.retainNewWorker,
 			runner: readRunner,
@@ -4584,7 +4446,7 @@ async function deployPlatformWorker(config, secrets, options) {
 				activatedDeploymentId,
 				activatedVersionId: rollbackVersionId,
 				config,
-				nextTriggers: readTriggerConfigFromObject(nextTraffic.wranglerConfig),
+				nextTriggers,
 				previousConfig: options.previousConfig,
 				previousCustomDomains: previousTraffic.customDomains,
 				previousDeployment,
@@ -4592,7 +4454,6 @@ async function deployPlatformWorker(config, secrets, options) {
 				previousVersionId,
 				preserveCustomDomains: unsafeTraffic,
 				inspectNewWorker: options.inspectNewWorker,
-				removeCustomDomains: options.removeCustomDomains,
 				publishCustomDomains: options.publishCustomDomains,
 				retainNewWorker: options.retainNewWorker,
 				runner: readRunner,
@@ -4601,8 +4462,8 @@ async function deployPlatformWorker(config, secrets, options) {
 			}) : null,
 			unsafeTraffic
 		});
-		if (recoveryFailures.length > 0) throw new PlatformWorkerRecoveryIncompleteError(`platform: ${errorMessage(error)} Automatic recovery for ${workerName} was incomplete: ${recoveryFailures.join("; ")}`, { cause: error });
-		if (unsafeTraffic) throw new PlatformWorkerRecoveryIncompleteError(`platform: ${errorMessage(error)} The routing gate remains closed and live Custom Domains were retained for safe reconciliation on retry.`, { cause: error });
+		if (recoveryFailures.length > 0) throw new PlatformWorkerRecoveryIncompleteError(`platform: ${getErrorMessage(error)} Automatic recovery for ${workerName} was incomplete: ${recoveryFailures.join("; ")}`, { cause: error });
+		if (unsafeTraffic) throw new PlatformWorkerRecoveryIncompleteError(`platform: ${getErrorMessage(error)} The routing gate remains closed and live Custom Domains were retained for safe reconciliation on retry.`, { cause: error });
 		throw error;
 	} finally {
 		rmSync(directory, {
@@ -4617,7 +4478,7 @@ async function recoverFailedPlatformWorkerDeployment(input) {
 		try {
 			await operation();
 		} catch (error) {
-			failures.push(`${label}: ${errorMessage(error)}`);
+			failures.push(`${label}: ${getErrorMessage(error)}`);
 		}
 	};
 	if (input.unsafeTraffic) {
@@ -4639,7 +4500,6 @@ async function rollbackPlatformWorker(input) {
 			if (currentVersionId !== input.activatedVersionId) throw new Error(`Worker ${input.workerName} changed concurrently from installer version ${input.activatedVersionId} to ${currentVersionId ?? "no active version"}; refusing to delete it.`);
 			if (await input.inspectNewWorker() === "missing") return;
 			await input.retainNewWorker();
-			if (!input.preserveCustomDomains) await input.removeCustomDomains();
 			return;
 		}
 		const currentVersionId = await readActivePlatformWorkerVersion(configPath, input.accountId, input.workerName, input.runner);
@@ -4672,10 +4532,6 @@ async function rollbackPlatformWorker(input) {
 			},
 			manageRoutes: false,
 			previousTriggerConfig: input.nextTriggers,
-			publishEmptyCustomDomains: async () => {
-				await input.removeCustomDomains();
-				return cleanPlatformCommandResult();
-			},
 			runWrangler: platformWorkerCommandRunner(input.accountId, directory, input.runner),
 			targetTriggerConfig: input.previousTriggers,
 			targetVersionId: input.previousVersionId,
@@ -4708,149 +4564,509 @@ async function restorePlatformWorkerDeployment(input) {
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
 //#endregion
-//#region src/cli/platform-install-activation.ts
-async function enableInstallationServices(input) {
-	const { checkpointOperation, requiresStagedCommit, authenticationCutoverCommitted, now, writeRemoteInstallationCheckpoint, dependencies, plan, secrets, workerKeys, workerActions, workerDeploymentSecrets, zoneId, enabledConfigs, configs, cloudflareApiBaseUrl, managedRoutes, ids, runPinnedPlatformWrangler, shouldBootstrapSharedEmail, releaseDatabaseLock, wasDisabled, previousPublicEndpoints, version, targetUsageProtocolVersion, healthCheckContext, runtime, runtimeProvenance } = input;
-	await checkpointOperation("enabling");
-	if (requiresStagedCommit) {
-		if (!authenticationCutoverCommitted) {
-			input.manifest = recordWorkerCutoverResolution(input.manifest, input.workerCutoverGeneration, "committed", now());
-			input.manifest = recordWorkerTrafficState(input.manifest, input.workerCutoverGeneration, false, now());
-			writeInstallationManifest(input.manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-			input.workerRollbacks = [];
-		}
-		input.workerCutoverGeneration = nextWorkerCutoverGeneration(input.manifest);
-		if (input.workerSecretUpdateIntent) {
-			input.manifest = recordWorkerSecretUpdateState(input.manifest, input.workerCutoverGeneration, "pending", input.workerSecretUpdateIntent.id, now());
-			writeInstallationManifest(input.manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-			input.workerSecretUpdateIntent = {
-				...input.workerSecretUpdateIntent,
-				generation: input.workerCutoverGeneration
-			};
-			writePendingInstallationSecrets(input.manifest, secretCheckpoint(secrets, input.workerSecretUpdateIntent));
-		}
-		for (const key of workerKeys) {
-			dependencies.onProgress?.(`Enabling the ${key} service`);
-			const action = workerActions.find((entry) => entry.key === (key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`));
-			const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
-			const preservedRoutes = dependencies.deployWorker ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
-			const workerConfig = mergePlatformWorkerTrafficConfig(enabledConfigs[key], preservedRoutes);
-			const previousWorkerConfig = mergePlatformWorkerTrafficConfig(configs[key], preservedRoutes);
-			const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
-				apiBaseUrl: cloudflareApiBaseUrl,
-				...dependencies.client.request ? { readCloudflare: (path) => dependencies.client.request(path) } : {},
-				onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
-					input.manifest = recordWorkerCutoverStage(input.manifest, input.workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
-					writeInstallationManifest(input.manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-				},
-				onTrafficPublished: async () => {
-					if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) throw new Error("platform: Cloudflare traffic inventory is unavailable.");
-					const [customDomains, routes] = await Promise.all([dependencies.client.listWorkerDomains(plan.account.id), zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
-					const next = recordPlatformWorkerTraffic(input.manifest, action.name, {
-						customDomains,
-						routes
-					}, now());
-					if (JSON.stringify(next.resources) !== JSON.stringify(input.manifest.resources)) {
-						input.manifest = next;
-						writeInstallationManifest(input.manifest);
-						await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-					}
-				},
-				onUnsafeTraffic: async () => {
-					input.manifest = recordWorkerUnsafeTraffic(input.manifest, input.workerCutoverGeneration, key, action.name, now());
-					writeInstallationManifest(input.manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-				},
-				managedRoutes: managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
-				preservedRoutes,
-				publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
-				publishRoutes: async (workerName, patterns) => {
-					if (!dependencies.client.publishWorkerRoutesSafely) throw new Error("platform: Safe Cloudflare Worker route publication is unavailable.");
-					if (zoneId) await dependencies.client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
-					else if (patterns.length > 0) throw new Error("platform: Cannot publish zone routes in workers.dev mode.");
-				},
-				previousConfig: previousWorkerConfig,
-				previousPublicEndpoints: true,
-				inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, input.manifest, action.key, action.name),
-				removeCustomDomains: async () => {
-					if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
-					await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(input.manifest, /* @__PURE__ */ new Set([action.name])));
-				},
-				retainNewWorker: async () => {
-					await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-				},
-				reuseMatchingVersion: false,
-				runner: runPinnedPlatformWrangler,
-				workerExisted: true
+//#region src/cli/platform-install-workers.ts
+function platformWorkerAction(workerActions, key) {
+	return workerActions.find((entry) => entry.key === platformWorkerResourceKey(key));
+}
+/** Deploy callbacks shared by the upload and enable phases for one platform Worker. */
+function platformWorkerDeployCallbacks(input) {
+	const { client, plan, zoneId, ids, key, action, generation, now, readManifest, writeManifest, checkpoint } = input;
+	return {
+		readCloudflare: (path) => client.request(path),
+		onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
+			await checkpoint(async () => {
+				await writeManifest(recordWorkerCutoverStage(readManifest(), generation, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now()));
+			});
+		},
+		onTrafficPublished: async () => {
+			const [customDomains, routes] = await Promise.all([client.listWorkerDomains(plan.account.id), zoneId ? client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
+			await checkpoint(async () => {
+				const manifest = readManifest();
+				const next = recordPlatformWorkerTraffic(manifest, action.name, {
+					customDomains,
+					routes
+				}, now());
+				if (JSON.stringify(next.resources) !== JSON.stringify(manifest.resources)) await writeManifest(next);
 			});
-			if (rollback) input.workerRollbacks.push(rollback);
+		},
+		onUnsafeTraffic: async () => {
+			await checkpoint(async () => {
+				await writeManifest(recordWorkerUnsafeTraffic(readManifest(), generation, key, action.name, now()));
+			}, true);
+		},
+		...platformWorkerTrafficCallbacks({
+			client,
+			accountId: plan.account.id,
+			ids,
+			key,
+			workerName: action.name,
+			readManifest
+		}),
+		publishRoutes: async (workerName, patterns) => {
+			if (zoneId) await client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
+			else if (patterns.length > 0) throw new Error("platform: Cannot publish zone routes in workers.dev mode.");
 		}
-	}
-	const verifyCurrentWorkerCutover = async () => {
-		if (!requiresStagedCommit) return;
-		if (dependencies.verifyWorkerCutover) await dependencies.verifyWorkerCutover(input.manifest, input.workerCutoverGeneration);
-		else if (!dependencies.deployWorker) await verifyPlatformWorkerCutoverVersions(input.manifest, input.workerCutoverGeneration, enabledConfigs, plan.account.id, runPinnedPlatformWrangler, workerKeys);
-	};
-	await verifyCurrentWorkerCutover();
-	let emailOperationId;
-	if (shouldBootstrapSharedEmail) {
-		input.workerDeploymentCommitted = true;
-		input.manifest = recordWorkerCutoverResolution(input.manifest, input.workerCutoverGeneration, "committed", now());
-		if (input.workerSecretUpdateIntent) input.manifest = recordWorkerSecretUpdateState(input.manifest, input.workerCutoverGeneration, "committed", input.workerSecretUpdateIntent.id, now());
-		writeInstallationManifest(input.manifest);
-		await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-		input.workerRollbacks = [];
-		dependencies.onProgress?.("Preparing shared email routing");
-		emailOperationId = await (dependencies.bootstrapEmail ?? bootstrapPlatformSharedEmail)(plan.apiUrl, createPlatformHealthProbeToken(input.manifest.ownershipNonce));
-	}
-	await releaseDatabaseLock.liftProjectZeroTrustFence?.();
-	if (dependencies.client.deleteKvValue) await dependencies.client.deleteKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY);
-	else if (wasDisabled || !previousPublicEndpoints) throw new Error("platform: Routing disablement removal is unavailable.");
-	if (requiresStagedCommit) {
-		dependencies.onProgress?.("Verifying the enabled platform");
-		await (dependencies.verifyHealth ?? verifyPlatformHealth)(plan.apiUrl, input.manifest.id, plan.proxyUrl, plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(input.manifest.ownershipNonce), void 0, !plan.deployment.application.zoneName ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev` : void 0, healthCheckContext);
-		await verifyCurrentWorkerCutover();
-	}
-	input.workerDeploymentCommitted = true;
-	input.manifest = recordWorkerCutoverResolution(input.manifest, input.workerCutoverGeneration, "committed", now());
-	input.manifest = recordWorkerTrafficState(input.manifest, input.workerCutoverGeneration, true, now());
-	if (input.workerSecretUpdateIntent) input.manifest = recordWorkerSecretUpdateState(input.manifest, input.workerCutoverGeneration, "committed", input.workerSecretUpdateIntent.id, now());
-	input.manifest = {
-		...input.manifest,
-		deployment: plan.deployment,
-		deploymentExecution: runtime.deploymentExecution,
-		platformVersion: version,
-		runtime: runtimeProvenance,
-		safetyProtocols: runtime.safetyProtocols ?? { sandboxDrain: 0 },
-		updatedAt: now(),
-		usageProtocolVersion: targetUsageProtocolVersion
 	};
-	input.manifest = transitionInstallation(input.manifest, "installed", now());
-	return { emailOperationId };
-}
-//#endregion
-//#region src/cli/platform-access-health.ts
-/** These reserved endpoints require Void's probe token and cannot serve application traffic. */
-function platformAccessHealthTargets(plan) {
-	const destination = `${plan.deployment.application.zoneName ? `${PLATFORM_HEALTH_HOSTNAME_LABEL}.${plan.deployment.application.baseDomain}` : `${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`}/health`;
-	return [{
-		key: `health-dispatch-${createHash("sha256").update(destination).digest("hex").slice(0, 12)}`,
-		destination
-	}];
-}
-async function verifyHealthException(access, app, destination) {
-	const destinations = platformAccessPublicDestinations(app);
-	if (typeof app.id !== "string" || !app.id || app.type !== "self_hosted" || app.domain !== destination || !destinations.length || destinations.some((value) => value !== destination) || app.destinations !== void 0 && (!Array.isArray(app.destinations) || app.destinations.some((value) => !value || value.type !== "public" || value.uri !== destination)) || app.target_criteria != null && (!Array.isArray(app.target_criteria) || app.target_criteria.length > 0)) throw new Error(`platform: The Access health exception must cover only ${destination}.`);
-	const policies = await access.list(`apps/${encodeURIComponent(app.id)}/policies`);
-	const policy = policies[0];
-	if (policies.length !== 1 || policy?.decision !== "bypass" || JSON.stringify(policy.include) !== "[{\"everyone\":{}}]" || policy.require !== void 0 && (!Array.isArray(policy.require) || policy.require.length > 0) || policy.exclude !== void 0 && (!Array.isArray(policy.exclude) || policy.exclude.length > 0)) throw new Error(`platform: The Access policy for ${destination} does not match the reserved health-check exception.`);
 }
-/** Keep the same path-only exception used by project Zero Trust available during bootstrap. */
-async function ensurePlatformAccessHealthChecks(input) {
-	const appAccess = !input.manifest.steps.some((step) => step.key === "app-access-initialized:v1") && input.checkpoint.appAccessSetupJson ? parsePlatformAppAccessSetup(JSON.parse(input.checkpoint.appAccessSetupJson)) : null;
+async function uploadInstallationWorkers(input) {
+	const { state, dependencies, requiresStagedCommit, recoveringUnsafeTraffic, workerActions, workerKeys, workerDeploymentSecrets, zoneId, now, writeRemoteInstallationCheckpoint, configs, previousConfigs, cloudflareApiBaseUrl, preserveDisabled, managedRoutes, previousPublicEndpoints, ids, runParallelPinnedPlatformWrangler, runPinnedPlatformWrangler } = input;
+	const { plan, workerSecretUpdateIntent, workerCutoverGeneration, workerRollbacks } = state;
+	const parallelWorkerUploads = !dependencies.deployWorker && !requiresStagedCommit && !workerSecretUpdateIntent && !recoveringUnsafeTraffic && workerActions.length === workerKeys.length && workerActions.every((action) => action.action === "update");
+	let workerManifestQueue = Promise.resolve();
+	let workerManifestFailed = false;
+	let workerManifestFailure;
+	const checkpointWorkerManifest = (update, safetyRecovery = false) => {
+		if (!parallelWorkerUploads) return update();
+		const result = workerManifestQueue.then(async () => {
+			if (workerManifestFailed && !safetyRecovery) throw workerManifestFailure;
+			try {
+				await update();
+			} catch (error) {
+				workerManifestFailed = true;
+				workerManifestFailure = error;
+				throw error;
+			}
+		});
+		workerManifestQueue = result.then(() => void 0, () => void 0);
+		return result;
+	};
+	const writeManifest = async (next) => {
+		state.manifest = next;
+		writeInstallationManifest(next);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, next);
+	};
+	let availableUploadSlots = 2;
+	let uploadFailure;
+	const uploadWaiters = [];
+	const acquireUploadSlot = async () => {
+		if (uploadFailure !== void 0) throw uploadFailure;
+		if (availableUploadSlots === 0) await new Promise((resolve, reject) => uploadWaiters.push({
+			resolve,
+			reject
+		}));
+		else availableUploadSlots--;
+		return (failure) => {
+			if (failure !== void 0 && uploadFailure === void 0) {
+				uploadFailure = failure;
+				for (const waiter of uploadWaiters.splice(0)) waiter.reject(failure);
+			}
+			const next = uploadFailure === void 0 ? uploadWaiters.shift() : void 0;
+			if (next) next.resolve();
+			else availableUploadSlots++;
+		};
+	};
+	const workerReady = (parallelWorkerUploads ? workerKeys : []).map(() => {
+		let resolve;
+		let reject;
+		return {
+			promise: new Promise((onResolve, onReject) => {
+				resolve = onResolve;
+				reject = onReject;
+			}),
+			resolve,
+			reject
+		};
+	});
+	const uploadBatch = Promise.all(workerReady.map((ready) => ready.promise)).then(() => ({ error: null }), (error) => ({ error }));
+	const deployOneWorker = async (key, waitForPriorWorker, onReadyForActivation) => {
+		dependencies.onProgress?.(`Deploying the ${key} service`);
+		let workerStepStarted = performance.now();
+		const markWorkerStep = (step) => {
+			writePlatformTiming(`worker ${key} ${step}`, workerStepStarted);
+			workerStepStarted = performance.now();
+		};
+		const action = platformWorkerAction(workerActions, key);
+		const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
+		await checkpointWorkerManifest(async () => {
+			const intended = recordProvisionIntent(state.manifest, action, now());
+			if (intended !== state.manifest) await writeManifest(intended);
+		});
+		await dependencies.revalidateBeforeWorkerDeploy(state.manifest, action);
+		markWorkerStep("revalidate");
+		const preservedRoutes = dependencies.deployWorker ? [] : action.action === "create" ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
+		markWorkerStep("traffic inventory");
+		const workerConfig = mergePlatformWorkerTrafficConfig(configs[key], preservedRoutes);
+		const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
+		const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
+			...platformWorkerDeployCallbacks({
+				client: dependencies.client,
+				plan,
+				zoneId,
+				ids,
+				key,
+				action,
+				generation: workerCutoverGeneration,
+				now,
+				readManifest: () => state.manifest,
+				writeManifest,
+				checkpoint: checkpointWorkerManifest
+			}),
+			apiBaseUrl: cloudflareApiBaseUrl,
+			operatorApiToken: dependencies.operatorApiToken,
+			...parallelWorkerUploads ? {
+				acquireUploadSlot,
+				onReadyForActivation,
+				waitForPriorWorker
+			} : {},
+			managedRoutes: preserveDisabled ? [] : managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
+			preservedRoutes,
+			previousConfig: previousWorkerConfig,
+			previousPublicEndpoints,
+			runner: parallelWorkerUploads ? runParallelPinnedPlatformWrangler : runPinnedPlatformWrangler,
+			workerExisted: action.action !== "create"
+		});
+		markWorkerStep("deploy");
+		if (rollback) workerRollbacks.push(rollback);
+		await checkpointWorkerManifest(async () => {
+			const recorded = recordResource(state.manifest, action, action.name, "created", now());
+			if (rollback || dependencies.deployWorker || JSON.stringify(recorded.resources) !== JSON.stringify(state.manifest.resources)) await writeManifest(recorded);
+		});
+		markWorkerStep("record");
+	};
+	if (parallelWorkerUploads) {
+		const tasks = [];
+		for (const [index, key] of workerKeys.entries()) {
+			const priorWorker = tasks.at(-1);
+			const ready = workerReady[index];
+			const task = deployOneWorker(key, priorWorker ? () => priorWorker : void 0, async () => {
+				ready.resolve();
+				const batch = await uploadBatch;
+				if (batch.error !== null) throw batch.error;
+			});
+			task.then(() => ready.resolve(), (error) => ready.reject(error));
+			tasks.push(task);
+		}
+		const firstFailure = (await Promise.allSettled(tasks)).find((result) => result.status === "rejected");
+		if (firstFailure) throw firstFailure.reason;
+	} else for (const key of workerKeys) await deployOneWorker(key);
+}
+//#endregion
+//#region src/cli/platform-installer-health.ts
+var PlatformAccessBlockedError = class extends Error {
+	constructor(url, context) {
+		super(context?.accessProtected ? [
+			"platform: Cloudflare Access blocked a protected platform health check (Default-Deny, error 1050).",
+			`Blocked URL: ${url}`,
+			"Keep employee Access protection and account-wide Default-Deny enabled.",
+			"The reserved dispatch /health endpoint uses a path-only Access exception and still requires Void’s private probe token.",
+			"Resume to verify the health exceptions and saved installer credentials.",
+			...context.resumeCommand ? [`Resume: ${context.resumeCommand}`] : [],
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
+		].join("\n") : [
+			"platform: Cloudflare Access blocked the platform health checks (Default-Deny, error 1050).",
+			`Blocked URL: ${url}`,
+			"",
+			"To make this test platform publicly reachable:",
+			"",
+			`1. In ${context ? `account ${JSON.stringify(context.accountName)}` : "your Cloudflare account"}, open:`,
+			"   Zero Trust → Access controls → Applications → Create new application.",
+			"2. Choose Self-hosted. When adding destinations, choose Worker and select:",
+			`   ${context ? context.workers.join(", ") + "." : "This installation's API, proxy, and dispatch Workers."}`,
+			"3. Add a policy: Action → Bypass; Include → Everyone.",
+			context?.resumeCommand ? `4. Save the policy and application, then resume:\n\n   ${context.resumeCommand}` : "4. Save the policy and application, then rerun your platform command.",
+			"",
+			"This removes Cloudflare Access protection for these Workers.",
+			"Void’s own authentication stays enabled. Keep account-wide Default-Deny on.",
+			"",
+			"For platforms that must remain Access-protected:",
+			"https://void.cloud/guide/platform/installation/maintenance#cloudflare-access"
+		].join("\n"));
+	}
+};
+async function platformProbeFailure(label, url, response, context) {
+	const message = `platform: ${label} failed at ${url} (HTTP ${response.status}).`;
+	if (response.status === 403 && response.headers.get("server")?.toLowerCase() === "cloudflare" && response.headers.get("content-type")?.toLowerCase().includes("text/html")) {
+		const body = await response.text().catch(() => "");
+		if (body.includes("Default-Deny") && /errorCode:\s*1050\b/.test(body)) return new PlatformAccessBlockedError(url, context);
+	}
+	return new Error(message);
+}
+async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicationBaseDomain, platformVersion, usageProtocolVersion, healthProbeToken, fetcher = fetch, dispatchOrigin, context) {
+	const request = (url) => fetcher(url, {
+		headers: {
+			"X-Void-Platform-Probe": healthProbeToken,
+			...cfAccessHeaders(process.env, url)
+		},
+		redirect: "manual",
+		signal: AbortSignal.timeout(3e4)
+	});
+	const dispatchUrl = dispatchOrigin ?? `https://${PLATFORM_HEALTH_HOSTNAME_LABEL}.${applicationBaseDomain}`;
+	const [health, discovery, proxy, dispatch, emailGateway] = await Promise.all([
+		request(`${apiUrl}/health`),
+		request(`${apiUrl}/.well-known/void-platform`),
+		request(`${proxyUrl}/health`),
+		request(`${dispatchUrl}/health`),
+		context?.emailGatewayUrl ? request(`${context.emailGatewayUrl}/health`) : void 0
+	]);
+	if (!health.ok) throw await platformProbeFailure("Health check", `${apiUrl}/health`, health, context);
+	if (!discovery.ok) throw await platformProbeFailure("Discovery check", `${apiUrl}/.well-known/void-platform`, discovery, context);
+	const body = await discovery.json();
+	if (body.installationId !== installationId) throw new Error("platform: Deployed API discovery identity does not match this installation.");
+	if (body.platformVersion !== platformVersion) throw new Error("platform: Deployed API discovery version does not match this release.");
+	if ((body.usageProtocolVersion ?? 0) !== usageProtocolVersion) throw new Error("platform: Deployed API usage protocol does not match this runtime. Traffic remains disabled.");
+	if (!proxy.ok) throw await platformProbeFailure("Proxy health check", `${proxyUrl}/health`, proxy, context);
+	if (!dispatch.ok) throw await platformProbeFailure("Dispatch health check", `${dispatchUrl}/health`, dispatch, context);
+	if (emailGateway) {
+		if (!emailGateway.ok) throw await platformProbeFailure("Email gateway health check", `${context.emailGatewayUrl}/health`, emailGateway, context);
+		const identity = await emailGateway.json();
+		if (identity?.installationId !== installationId || identity.platformVersion !== platformVersion || identity.emailProtocolVersion !== 1) throw new Error("platform: Deployed email gateway identity, version, or protocol does not match this installation.");
+	}
+}
+async function verifyPlatformSandboxDrain(apiUrl, healthProbeToken, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/internal/platform/sandbox-drain`, {
+		headers: {
+			"X-Void-Platform-Probe": healthProbeToken,
+			...cfAccessHeaders(process.env, apiUrl)
+		},
+		signal: AbortSignal.timeout(3e4),
+		redirect: "manual"
+	});
+	if (!response.ok) throw new Error(`platform: Sandbox drain probe failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error("platform: Sandbox drain probe did not return its DB-backed protocol v1 document. Traffic remains disabled.");
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
+	const status = value;
+	const validState = status.state === "required" || status.state === "draining" || status.state === "complete";
+	const validPhase = status.phase === null || status.phase === "deployments" || status.phase === "resources";
+	if (status.version !== 1 || !validState || typeof status.complete !== "boolean" || !validPhase || status.generation !== null && (typeof status.generation !== "string" || status.generation.length === 0) || status.updatedAt !== null && (typeof status.updatedAt !== "string" || !Number.isFinite(Date.parse(status.updatedAt))) || status.state === "required" && (status.complete || status.generation !== null || status.updatedAt !== null || status.phase !== null) || status.state === "draining" && (status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null) || status.state === "complete" && (!status.complete || typeof status.generation !== "string" || typeof status.updatedAt !== "string" || status.phase === null)) throw new Error("platform: Sandbox drain probe returned an invalid DB-backed protocol v1 document. Traffic remains disabled.");
+	return status.state === "complete";
+}
+async function verifyPlatformDeploymentExecutionDrain(apiUrl, healthProbeToken, installationId, fetcher = fetch) {
+	const response = await fetcher(`${apiUrl}/__void/platform/deployment-execution`, {
+		headers: {
+			"X-Void-Platform-Probe": healthProbeToken,
+			...cfAccessHeaders(process.env, apiUrl)
+		},
+		signal: AbortSignal.timeout(3e4),
+		redirect: "manual"
+	});
+	if (!response.ok) throw new Error(`platform: Deployment execution drain probe failed (HTTP ${response.status}). Keep the current runtime until its durable deployment operations have drained.`);
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error("platform: Deployment execution drain probe returned an invalid document.");
+	}
+	const status = value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+	if (status?.protocolVersion !== 1 || status.installationId !== installationId || typeof status.admissionClosed !== "boolean" || !Number.isSafeInteger(status.pendingDeployments) || Number(status.pendingDeployments) < 0) throw new Error("platform: Deployment execution drain probe returned an invalid document.");
+	if (!status.admissionClosed || status.pendingDeployments !== 0) throw new Error("platform: Durable deployment operations are still admitted or unfinished. Keep the current runtime and retry this command after they finish.");
+}
+async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
+	const deadline = Date.now() + 3e5;
+	let operationId = null;
+	const timedOut = () => /* @__PURE__ */ new Error(`platform: Shared email bootstrap did not finish within five minutes at ${apiUrl}.${operationId ? ` Operation ${operationId} remains incomplete.` : ""} Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+	const waitForProgress = async () => {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		await new Promise((resolve) => setTimeout(resolve, Math.min(1e3, remaining)));
+	};
+	let response;
+	let value;
+	let status;
+	for (;;) {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timedOut();
+		const signal = AbortSignal.timeout(Math.min(12e4, remaining));
+		try {
+			response = await fetcher(`${apiUrl}/internal/platform/email-bootstrap`, {
+				method: "POST",
+				headers: {
+					"X-Void-Platform-Probe": healthProbeToken,
+					...cfAccessHeaders(process.env, apiUrl)
+				},
+				signal,
+				redirect: "manual"
+			});
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap request failed at ${apiUrl}. Traffic remains disabled. Retry the installation's repair or resume command to reconcile the existing email operation.`);
+		}
+		try {
+			value = await response.json();
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && error.name === "TimeoutError") {
+				await waitForProgress();
+				continue;
+			}
+			throw new Error(`platform: Shared email bootstrap failed at ${apiUrl} (HTTP ${response.status}). Traffic remains disabled.`);
+		}
+		status = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+		const observedOperationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		if (status?.version === 1 && observedOperationId) {
+			if (operationId && operationId !== observedOperationId) throw new Error("platform: Shared email bootstrap operation identity changed while waiting. Traffic remains disabled. Inspect the installation before retrying.");
+			operationId = observedOperationId;
+		}
+		if ([
+			200,
+			202,
+			503
+		].includes(response.status) && status?.version === 1 && status.state === "incomplete" && observedOperationId && (status.operationStatus === "pending" || status.operationStatus === "running") && status.failureCode == null) {
+			await waitForProgress();
+			continue;
+		}
+		break;
+	}
+	if (!response.ok || status?.version !== 1 || status.state !== "ready" || operationId === null || status.operationId !== operationId || status.operationStatus != null && status.operationStatus !== "completed" || status.failureCode != null) {
+		const code = (value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,63}$/.test(value) ? value : null;
+		const operationStatus = code(status?.operationStatus);
+		const operationId = typeof status?.operationId === "string" && /^[A-Za-z0-9_-]{1,100}$/.test(status.operationId) ? status.operationId : null;
+		const details = operationId ? [`Operation ${operationId}: ${operationStatus ?? "incomplete"}.`] : operationStatus ? [`Operation status: ${operationStatus}.`] : [];
+		const currentStep = code(status?.currentStep);
+		const failureCode = code(status?.failureCode);
+		if (currentStep) details.push(`Step: ${currentStep}.`);
+		if (failureCode) details.push(`Failure: ${failureCode}.`);
+		let domain = null;
+		if (typeof status?.domain === "string") try {
+			domain = normalizeApplicationDomain(status.domain);
+		} catch {}
+		const inboundStatus = code(status?.inboundStatus);
+		if (domain) details.push(`Domain: ${domain}${inboundStatus ? ` (inbound: ${inboundStatus})` : ""}.`);
+		const mxDetail = domain ? `MX records for ${domain} do not route mail to Cloudflare Email Routing` : null;
+		const safeDetails = [
+			...domain ? [mxDetail, `enabled explicit Cloudflare email rules conflict with ${domain}`] : [],
+			"zone catch-all does not point to this ingress",
+			"another enabled catch-all owns this zone"
+		];
+		if (typeof status?.failureDetail === "string" && safeDetails.includes(status.failureDetail)) {
+			details.push(`${status.failureDetail}.`);
+			if (currentStep === "inbound_probe" && status.failureDetail === mxDetail) details.push(`Enable Email Routing for ${domain} in the Cloudflare dashboard, then resume this installation.`);
+		}
+		const detail = details.length ? ` ${details.join(" ")}` : "";
+		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
+	}
+	return operationId;
+}
+//#endregion
+//#region src/cli/platform-install-activation.ts
+async function enableInstallationServices(input) {
+	const { state, checkpointOperation, requiresStagedCommit, authenticationCutoverCommitted, now, writeRemoteInstallationCheckpoint, dependencies, workerKeys, workerActions, workerDeploymentSecrets, zoneId, enabledConfigs, configs, cloudflareApiBaseUrl, managedRoutes, ids, runPinnedPlatformWrangler, shouldBootstrapSharedEmail, releaseDatabaseLock, version, targetUsageProtocolVersion, healthCheckContext, runtime, runtimeProvenance } = input;
+	const { plan, secrets } = state;
+	await checkpointOperation("enabling");
+	if (requiresStagedCommit) {
+		if (!authenticationCutoverCommitted) {
+			state.manifest = recordWorkerCutoverResolution(state.manifest, state.workerCutoverGeneration, "committed", now());
+			state.manifest = recordWorkerTrafficState(state.manifest, state.workerCutoverGeneration, false, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
+			state.workerRollbacks = [];
+		}
+		state.workerCutoverGeneration = nextWorkerCutoverGeneration(state.manifest);
+		if (state.workerSecretUpdateIntent) {
+			state.manifest = recordWorkerSecretUpdateState(state.manifest, state.workerCutoverGeneration, "pending", state.workerSecretUpdateIntent.id, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
+			state.workerSecretUpdateIntent = {
+				...state.workerSecretUpdateIntent,
+				generation: state.workerCutoverGeneration
+			};
+			writePendingInstallationSecrets(state.manifest, secretCheckpoint(secrets, state.workerSecretUpdateIntent));
+		}
+		const writeManifest = async (next) => {
+			state.manifest = next;
+			writeInstallationManifest(next);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, next);
+		};
+		for (const key of workerKeys) {
+			dependencies.onProgress?.(`Enabling the ${key} service`);
+			const action = platformWorkerAction(workerActions, key);
+			const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
+			const preservedRoutes = dependencies.deployWorker ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
+			const workerConfig = mergePlatformWorkerTrafficConfig(enabledConfigs[key], preservedRoutes);
+			const previousWorkerConfig = mergePlatformWorkerTrafficConfig(configs[key], preservedRoutes);
+			const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
+				...platformWorkerDeployCallbacks({
+					client: dependencies.client,
+					plan,
+					zoneId,
+					ids,
+					key,
+					action,
+					generation: state.workerCutoverGeneration,
+					now,
+					readManifest: () => state.manifest,
+					writeManifest,
+					checkpoint: (update) => update()
+				}),
+				apiBaseUrl: cloudflareApiBaseUrl,
+				managedRoutes: managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
+				preservedRoutes,
+				previousConfig: previousWorkerConfig,
+				previousPublicEndpoints: true,
+				reuseMatchingVersion: false,
+				runner: runPinnedPlatformWrangler,
+				workerExisted: true
+			});
+			if (rollback) state.workerRollbacks.push(rollback);
+		}
+	}
+	const verifyCurrentWorkerCutover = async () => {
+		if (!requiresStagedCommit) return;
+		if (dependencies.verifyWorkerCutover) await dependencies.verifyWorkerCutover(state.manifest, state.workerCutoverGeneration);
+		else if (!dependencies.deployWorker) await verifyPlatformWorkerCutoverVersions(state.manifest, state.workerCutoverGeneration, enabledConfigs, plan.account.id, runPinnedPlatformWrangler, workerKeys);
+	};
+	await verifyCurrentWorkerCutover();
+	let emailOperationId;
+	if (shouldBootstrapSharedEmail) {
+		state.workerDeploymentCommitted = true;
+		state.manifest = recordWorkerCutoverResolution(state.manifest, state.workerCutoverGeneration, "committed", now());
+		if (state.workerSecretUpdateIntent) state.manifest = recordWorkerSecretUpdateState(state.manifest, state.workerCutoverGeneration, "committed", state.workerSecretUpdateIntent.id, now());
+		writeInstallationManifest(state.manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
+		state.workerRollbacks = [];
+		dependencies.onProgress?.("Preparing shared email routing");
+		emailOperationId = await (dependencies.bootstrapEmail ?? bootstrapPlatformSharedEmail)(plan.apiUrl, createPlatformHealthProbeToken(state.manifest.ownershipNonce));
+	}
+	await releaseDatabaseLock.liftProjectZeroTrustFence?.();
+	await dependencies.client.deleteKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY);
+	if (requiresStagedCommit) {
+		dependencies.onProgress?.("Verifying the enabled platform");
+		await (dependencies.verifyHealth ?? verifyPlatformHealth)(plan.apiUrl, state.manifest.id, plan.proxyUrl, plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(state.manifest.ownershipNonce), void 0, !plan.deployment.application.zoneName ? platformWorkersDevUrl(plan, plan.deployment.resources.dispatchWorker) : void 0, healthCheckContext);
+		await verifyCurrentWorkerCutover();
+	}
+	state.workerDeploymentCommitted = true;
+	state.manifest = recordWorkerCutoverResolution(state.manifest, state.workerCutoverGeneration, "committed", now());
+	state.manifest = recordWorkerTrafficState(state.manifest, state.workerCutoverGeneration, true, now());
+	if (state.workerSecretUpdateIntent) state.manifest = recordWorkerSecretUpdateState(state.manifest, state.workerCutoverGeneration, "committed", state.workerSecretUpdateIntent.id, now());
+	state.manifest = {
+		...state.manifest,
+		deployment: plan.deployment,
+		deploymentExecution: runtime.deploymentExecution,
+		platformVersion: version,
+		runtime: runtimeProvenance,
+		safetyProtocols: runtime.safetyProtocols,
+		updatedAt: now(),
+		usageProtocolVersion: targetUsageProtocolVersion
+	};
+	state.manifest = transitionInstallation(state.manifest, "installed", now());
+	return { emailOperationId };
+}
+//#endregion
+//#region src/cli/platform-access-health.ts
+/** These reserved endpoints require Void's probe token and cannot serve application traffic. */
+function platformAccessHealthTargets(plan) {
+	const destination = `${plan.deployment.application.zoneName ? `${PLATFORM_HEALTH_HOSTNAME_LABEL}.${plan.deployment.application.baseDomain}` : `${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`}/health`;
+	return [{
+		key: `health-dispatch-${createHash("sha256").update(destination).digest("hex").slice(0, 12)}`,
+		destination
+	}];
+}
+async function verifyHealthException(access, app, destination) {
+	const destinations = platformAccessPublicDestinations(app);
+	if (typeof app.id !== "string" || !app.id || app.type !== "self_hosted" || app.domain !== destination || !destinations.length || destinations.some((value) => value !== destination) || app.destinations !== void 0 && (!Array.isArray(app.destinations) || app.destinations.some((value) => !value || value.type !== "public" || value.uri !== destination)) || app.target_criteria != null && (!Array.isArray(app.target_criteria) || app.target_criteria.length > 0)) throw new Error(`platform: The Access health exception must cover only ${destination}.`);
+	const policies = await access.list(`apps/${encodeURIComponent(app.id)}/policies`);
+	const policy = policies[0];
+	if (policies.length !== 1 || policy?.decision !== "bypass" || JSON.stringify(policy.include) !== "[{\"everyone\":{}}]" || policy.require !== void 0 && (!Array.isArray(policy.require) || policy.require.length > 0) || policy.exclude !== void 0 && (!Array.isArray(policy.exclude) || policy.exclude.length > 0)) throw new Error(`platform: The Access policy for ${destination} does not match the reserved health-check exception.`);
+}
+/** Keep the same path-only exception used by project Zero Trust available during bootstrap. */
+async function ensurePlatformAccessHealthChecks(input) {
+	const appAccess = !input.manifest.steps.some((step) => step.key === "app-access-initialized:v1") && input.checkpoint.appAccessSetupJson ? parsePlatformAppAccessSetup(JSON.parse(input.checkpoint.appAccessSetupJson)) : null;
 	if (appAccess && appAccess.accountId !== input.plan.account.id) throw new Error("platform: App access recovery belongs to another Cloudflare account.");
 	if (!input.plan.deployment.authentication.accessProtection && !appAccess?.managed) return;
 	const spec = appAccess?.managed ? {
@@ -4949,7 +5165,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	platformAccessResourceInventory(encoded, input.manifest.id);
 	const state = JSON.parse(encoded);
 	const spec = parsePlatformAccessSetupSpec(JSON.parse(specEncoded));
-	if (state.accountId !== (spec.accountId ?? input.manifest.account.id) || state.nonce !== createHash("sha256").update(`void-access:${input.manifest.ownershipNonce}`).digest("hex").slice(0, 32)) throw new Error("platform: The saved Access setup does not match this installation and identity account.");
+	if (state.accountId !== (spec.accountId ?? input.manifest.account.id) || state.nonce !== platformAccessNonce(input.manifest.ownershipNonce)) throw new Error("platform: The saved Access setup does not match this installation and identity account.");
 	const application = state.resources.protection;
 	const service = state.resources["service-token"];
 	if (!application?.id || application.pending || !service?.id || service.pending || spec.protectionApplicationId && spec.protectionApplicationId !== application.id) throw new Error("platform: Complete or restore the Access application and service-token checkpoint before maintenance.");
@@ -4984,7 +5200,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-zxDr0hWW.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-D5wvsI-Y.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -4994,213 +5210,200 @@ async function verifyInstalledPlatformAccessProtection(input) {
 }
 //#endregion
 //#region src/cli/platform-install-preparation.ts
+function withAuthentication(deployment, authentication) {
+	return createPlatformDeploymentManifest({
+		...deployment,
+		authentication,
+		capabilities: {
+			...deployment.capabilities,
+			githubOAuth: authentication.providers.includes("github"),
+			googleOAuth: authentication.providers.includes("google")
+		}
+	});
+}
 async function prepareInstallationAuthentication(input) {
-	const { releaseDatabaseLock, runtime, authenticationProtocolTransition, now, dependencies, workerSecretUpdateIntent } = input;
+	const { state, releaseDatabaseLock, runtime, authenticationProtocolTransition, now, dependencies } = input;
+	const { workerSecretUpdateIntent } = state;
 	const liveAuthentication = await releaseDatabaseLock.readAuthenticationState?.();
 	if (liveAuthentication) {
-		input.authenticationEnforcementActive = liveAuthentication.sessionsRequired;
+		state.authenticationEnforcementActive = liveAuthentication.sessionsRequired;
 		if (liveAuthentication.sessionsRequired && runtime.authenticationProtocolVersion !== 1) throw new Error("platform: This runtime cannot enforce the active authentication configuration. Use an authentication-compatible runtime.");
-		const deployment = mergePlatformLiveAuthenticationDeployment(input.plan.deployment, liveAuthentication);
-		input.plan = {
-			...input.plan,
+		const deployment = mergePlatformLiveAuthenticationDeployment(state.plan.deployment, liveAuthentication);
+		state.plan = {
+			...state.plan,
 			deployment
 		};
-		if (!authenticationProtocolTransition) input.manifest = {
-			...input.manifest,
-			deployment
-		};
-	}
-	if (!liveAuthentication && input.manifest.deployment.authentication.configurable && !input.plan.deployment.authentication.configurable) {
-		const authentication = input.manifest.deployment.authentication;
-		const providers = authentication.providers;
-		input.plan = {
-			...input.plan,
-			deployment: createPlatformDeploymentManifest({
-				...input.plan.deployment,
-				authentication,
-				capabilities: {
-					...input.plan.deployment.capabilities,
-					githubOAuth: providers.includes("github"),
-					googleOAuth: providers.includes("google")
-				}
-			})
-		};
-	}
-	if (authenticationProtocolTransition && !input.plan.deployment.authentication.configurable) {
-		const providers = input.plan.deployment.authentication.providers;
-		const deployment = createPlatformDeploymentManifest({
-			...input.plan.deployment,
-			authentication: {
-				providers,
-				configurable: true
-			},
-			capabilities: {
-				...input.plan.deployment.capabilities,
-				githubOAuth: providers.includes("github"),
-				googleOAuth: providers.includes("google")
-			}
-		});
-		input.plan = {
-			...input.plan,
+		if (!authenticationProtocolTransition) state.manifest = {
+			...state.manifest,
 			deployment
 		};
 	}
+	if (!liveAuthentication && state.manifest.deployment.authentication.configurable && !state.plan.deployment.authentication.configurable) state.plan = {
+		...state.plan,
+		deployment: withAuthentication(state.plan.deployment, state.manifest.deployment.authentication)
+	};
+	if (authenticationProtocolTransition && !state.plan.deployment.authentication.configurable) state.plan = {
+		...state.plan,
+		deployment: withAuthentication(state.plan.deployment, {
+			providers: state.plan.deployment.authentication.providers,
+			configurable: true
+		})
+	};
 	const activateAccessCredentials = () => {
-		if (!input.secrets.accessCredentialsJson) return;
-		const credentials = JSON.parse(input.secrets.accessCredentialsJson);
+		if (!state.secrets.accessCredentialsJson) return;
+		const credentials = JSON.parse(state.secrets.accessCredentialsJson);
 		if (!credentials || typeof credentials !== "object" || Array.isArray(credentials)) throw new Error("platform: Invalid saved Access credentials.");
-		const origins = [input.plan.apiUrl, input.plan.proxyUrl];
+		const origins = [state.plan.apiUrl, state.plan.proxyUrl];
 		activatePlatformAccessCredentials(JSON.stringify(Object.fromEntries(Object.entries(credentials).filter(([origin]) => origins.includes(origin)))), origins);
 	};
 	activateAccessCredentials();
-	input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-	writeInstallationManifest(input.manifest);
-	await releaseDatabaseLock.checkpoint?.(input.manifest);
+	state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+	writeInstallationManifest(state.manifest);
+	await releaseDatabaseLock.checkpoint?.(state.manifest);
 	dependencies.onProgress?.("Checking and creating Cloudflare resources");
-	if (!authenticationProtocolTransition && JSON.stringify(input.manifest.deployment) !== JSON.stringify(input.plan.deployment)) {
-		input.manifest = {
-			...input.manifest,
-			deployment: input.plan.deployment,
+	if (!authenticationProtocolTransition && JSON.stringify(state.manifest.deployment) !== JSON.stringify(state.plan.deployment)) {
+		state.manifest = {
+			...state.manifest,
+			deployment: state.plan.deployment,
 			updatedAt: now()
 		};
-		writeInstallationManifest(input.manifest);
-		await releaseDatabaseLock.checkpoint?.(input.manifest);
+		writeInstallationManifest(state.manifest);
+		await releaseDatabaseLock.checkpoint?.(state.manifest);
 	}
-	await releaseDatabaseLock.checkpoint?.(input.manifest);
-	if (input.manifest.status !== "provisioning") {
-		input.manifest = transitionInstallation(input.manifest, "provisioning", now());
-		writeInstallationManifest(input.manifest);
+	if (state.manifest.status !== "provisioning") {
+		state.manifest = transitionInstallation(state.manifest, "provisioning", now());
+		writeInstallationManifest(state.manifest);
 	}
-	if (runtime.deploymentExecution !== 1 && (input.manifest.deploymentExecution === 1 || dependencies.databaseRollbackSource?.manifest.deploymentExecution === 1)) {
+	if (runtime.deploymentExecution !== 1 && (state.manifest.deploymentExecution === 1 || dependencies.databaseRollbackSource?.manifest.deploymentExecution === 1)) {
 		if (!releaseDatabaseLock.checkpoint) throw new Error("platform: The database lifecycle lock cannot fence deployment admission.");
-		await releaseDatabaseLock.checkpoint(input.manifest);
+		await releaseDatabaseLock.checkpoint(state.manifest);
 		dependencies.onProgress?.("Verifying durable deployment operations have drained");
-		await (dependencies.verifyDeploymentExecutionDrain ?? verifyPlatformDeploymentExecutionDrain)(input.plan.apiUrl, createPlatformHealthProbeToken(input.manifest.ownershipNonce), input.manifest.id);
+		await (dependencies.verifyDeploymentExecutionDrain ?? verifyPlatformDeploymentExecutionDrain)(state.plan.apiUrl, createPlatformHealthProbeToken(state.manifest.ownershipNonce), state.manifest.id);
 	}
 	if (dependencies.prepareAuthentication) {
 		dependencies.onProgress?.("Preparing platform authentication");
 		try {
-			input.secrets = {
-				...input.secrets,
-				...await dependencies.prepareAuthentication(input.manifest, input.secrets)
+			state.secrets = {
+				...state.secrets,
+				...await dependencies.prepareAuthentication(state.manifest, state.secrets)
 			};
 		} catch (error) {
-			const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-			input.secrets = {
-				...input.secrets,
+			const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+			state.secrets = {
+				...state.secrets,
 				authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([name]) => isPlatformAuthenticationPreparationKey(name))),
-				authenticationSetupJson: latest.authenticationSetupJson || input.secrets.authenticationSetupJson,
-				authSetupToken: latest.authSetupToken || input.secrets.authSetupToken,
-				authBootstrapCode: latest.authBootstrapCode || input.secrets.authBootstrapCode,
-				accessProvisioningJson: latest.accessProvisioningJson || input.secrets.accessProvisioningJson,
-				accessCredentialsJson: latest.accessCredentialsJson || input.secrets.accessCredentialsJson
+				authenticationSetupJson: latest.authenticationSetupJson || state.secrets.authenticationSetupJson,
+				authSetupToken: latest.authSetupToken || state.secrets.authSetupToken,
+				authBootstrapCode: latest.authBootstrapCode || state.secrets.authBootstrapCode,
+				accessProvisioningJson: latest.accessProvisioningJson || state.secrets.accessProvisioningJson,
+				accessCredentialsJson: latest.accessCredentialsJson || state.secrets.accessCredentialsJson
 			};
-			input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-			writeInstallationManifest(input.manifest);
-			await releaseDatabaseLock.checkpoint?.(input.manifest);
+			state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+			writeInstallationManifest(state.manifest);
+			await releaseDatabaseLock.checkpoint?.(state.manifest);
 			throw error;
 		}
-		const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-		input.secrets = {
-			...input.secrets,
+		const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+		state.secrets = {
+			...state.secrets,
 			authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([name]) => isPlatformAuthenticationPreparationKey(name)))
 		};
-		input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-		writeInstallationManifest(input.manifest);
-		await releaseDatabaseLock.checkpoint?.(input.manifest);
+		state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+		writeInstallationManifest(state.manifest);
+		await releaseDatabaseLock.checkpoint?.(state.manifest);
 		activateAccessCredentials();
-		assertRequiredPlatformSecrets(input.plan, input.manifest, input.secrets);
-		if (input.secrets.authenticationSetupJson && createHash("sha256").update(input.secrets.authBootstrapCode ?? "").digest("hex") !== parsePlatformAuthenticationSetup(JSON.parse(input.secrets.authenticationSetupJson)).bootstrapCredentialHash) throw new Error("platform: Prepared authentication does not match its administrator setup code.");
-		writePendingInstallationSecrets(input.manifest, {
-			...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+		assertRequiredPlatformSecrets(state.plan, state.manifest, state.secrets);
+		if (state.secrets.authenticationSetupJson && createHash("sha256").update(state.secrets.authBootstrapCode ?? "").digest("hex") !== parsePlatformAuthenticationSetup(JSON.parse(state.secrets.authenticationSetupJson)).bootstrapCredentialHash) throw new Error("platform: Prepared authentication does not match its administrator setup code.");
+		writePendingInstallationSecrets(state.manifest, {
+			...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
 			databaseClaimState: "claimed"
 		});
 	}
-	const appAccessSetupRequired = !!input.plan.deployment.appAccess && !input.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
+	const appAccessSetupRequired = !!state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
 	if (appAccessSetupRequired) {
 		if (dependencies.prepareAppAccess) try {
-			const appAccessSetupJson = await dependencies.prepareAppAccess(input.manifest, input.secrets);
-			const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-			input.secrets = {
-				...input.secrets,
+			const appAccessSetupJson = await dependencies.prepareAppAccess(state.manifest, state.secrets);
+			const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+			state.secrets = {
+				...state.secrets,
 				appAccessSetupJson,
 				authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)))
 			};
-			writePendingInstallationSecrets(input.manifest, {
-				...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+			writePendingInstallationSecrets(state.manifest, {
+				...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
 				databaseClaimState: "claimed"
 			});
 		} catch (error) {
-			const latest = readPendingInstallationSecrets(input.manifest) ?? {};
-			input.secrets = {
-				...input.secrets,
-				appAccessSetupJson: latest.appAccessSetupJson || input.secrets.appAccessSetupJson,
+			const latest = readPendingInstallationSecrets(state.manifest) ?? {};
+			state.secrets = {
+				...state.secrets,
+				appAccessSetupJson: latest.appAccessSetupJson || state.secrets.appAccessSetupJson,
 				authenticationPreparation: Object.fromEntries(Object.entries(latest).filter(([key]) => isPlatformAuthenticationPreparationKey(key)))
 			};
 			throw error;
 		}
-		if (!input.secrets.appAccessSetupJson) throw new Error("platform: Restore the encrypted app access setup checkpoint before resuming.");
-		if (!input.secrets.appAccessSetupToken) {
-			if (input.manifest.resources.some((resource) => resource.key === "api-worker" && resource.state === "ready")) throw new Error("platform: Restore the encrypted app access setup authority before resuming.");
-			input.secrets = {
-				...input.secrets,
+		if (!state.secrets.appAccessSetupJson) throw new Error("platform: Restore the encrypted app access setup checkpoint before resuming.");
+		if (!state.secrets.appAccessSetupToken) {
+			if (state.manifest.resources.some((resource) => resource.key === "api-worker" && resource.state === "ready")) throw new Error("platform: Restore the encrypted app access setup authority before resuming.");
+			state.secrets = {
+				...state.secrets,
 				appAccessSetupToken: randomBytes(32).toString("hex")
 			};
-			writePendingInstallationSecrets(input.manifest, {
-				...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+			writePendingInstallationSecrets(state.manifest, {
+				...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
 				databaseClaimState: "claimed"
 			});
 		}
 	}
-	if (input.plan.deployment.authentication.accessProtection) {
-		const protection = liveAuthentication ? liveAuthentication.protection : input.secrets.authenticationSetupJson ? parsePlatformAuthenticationSetup(JSON.parse(input.secrets.authenticationSetupJson)).protection : null;
+	if (state.plan.deployment.authentication.accessProtection) {
+		const protection = liveAuthentication ? liveAuthentication.protection : state.secrets.authenticationSetupJson ? parsePlatformAuthenticationSetup(JSON.parse(state.secrets.authenticationSetupJson)).protection : null;
 		if (!protection) throw new Error("platform: The active Access protection configuration is unavailable. Restore its database and encrypted setup checkpoint before maintenance.");
 		dependencies.onProgress?.("Verifying current Access policies and protected origins");
 		await (dependencies.verifyAccessProtection ?? verifyInstalledPlatformAccessProtection)({
 			client: dependencies.client,
-			manifest: input.manifest,
-			plan: input.plan,
-			dashboardUrl: platformDashboardUrl(input.plan.deployment),
+			manifest: state.manifest,
+			plan: state.plan,
+			dashboardUrl: platformDashboardUrl(state.plan.deployment),
 			protection,
-			checkpoint: secretCheckpoint(input.secrets, workerSecretUpdateIntent)
+			checkpoint: secretCheckpoint(state.secrets, workerSecretUpdateIntent)
 		});
 	}
-	if (input.plan.deployment.authentication.accessProtection || appAccessSetupRequired && input.secrets.appAccessSetupJson && JSON.parse(input.secrets.appAccessSetupJson).managed === true) {
+	if (state.plan.deployment.authentication.accessProtection || appAccessSetupRequired && state.secrets.appAccessSetupJson && JSON.parse(state.secrets.appAccessSetupJson).managed === true) {
 		dependencies.onProgress?.("Preparing Access for authenticated platform health checks");
 		try {
 			await (dependencies.prepareHealthAccess ?? ensurePlatformAccessHealthChecks)({
 				client: dependencies.client,
-				manifest: input.manifest,
-				plan: input.plan,
-				checkpoint: secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+				manifest: state.manifest,
+				plan: state.plan,
+				checkpoint: secretCheckpoint(state.secrets, workerSecretUpdateIntent),
 				save: (accessHealthProvisioningJson) => {
-					input.secrets = {
-						...input.secrets,
+					state.secrets = {
+						...state.secrets,
 						accessHealthProvisioningJson
 					};
-					input.manifest = checkpointAuthenticationResources(input.manifest, input.secrets, now());
-					writePendingInstallationSecrets(input.manifest, {
-						...secretCheckpoint(input.secrets, workerSecretUpdateIntent),
+					state.manifest = checkpointAuthenticationResources(state.manifest, state.secrets, now());
+					writePendingInstallationSecrets(state.manifest, {
+						...secretCheckpoint(state.secrets, workerSecretUpdateIntent),
 						databaseClaimState: "claimed"
 					});
-					writeInstallationManifest(input.manifest);
+					writeInstallationManifest(state.manifest);
 				}
 			});
 		} catch (error) {
-			if (appAccessSetupRequired && input.secrets.appAccessSetupJson && JSON.parse(input.secrets.appAccessSetupJson).managed && error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status)) {
-				input.secrets = {
-					...input.secrets,
+			if (appAccessSetupRequired && state.secrets.appAccessSetupJson && JSON.parse(state.secrets.appAccessSetupJson).managed && error instanceof PlatformCloudflareApiError && [401, 403].includes(error.status)) {
+				state.secrets = {
+					...state.secrets,
 					authenticationPreparation: {
-						...input.secrets.authenticationPreparation,
+						...state.secrets.authenticationPreparation,
 						appAccessTokenRejected: "true"
 					}
 				};
-				writePendingInstallationSecrets(input.manifest, secretCheckpoint(input.secrets, workerSecretUpdateIntent));
+				writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets, workerSecretUpdateIntent));
 				throw new PlatformAppAccessCredentialError("platform: App access token rejected while preparing health checks. Resume installation to provide a replacement.");
 			}
 			throw error;
 		} finally {
-			await releaseDatabaseLock.checkpoint?.(input.manifest);
+			await releaseDatabaseLock.checkpoint?.(state.manifest);
 		}
 	}
 }
@@ -5218,7 +5421,7 @@ function verifyRuntimeArtifacts(runtimeDirectory, manifest) {
 		try {
 			contents = readFileSync(path);
 		} catch (error) {
-			throw new Error(`platform: Runtime artifact is missing: ${errorMessage(error)}`);
+			throw new Error(`platform: Runtime artifact is missing: ${getErrorMessage(error)}`);
 		}
 		if (contents.byteLength !== artifact.size || hash(contents) !== artifact.sha256) throw new Error(`platform: Runtime artifact failed integrity verification: ${path}.`);
 	}
@@ -5230,7 +5433,7 @@ function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
 	try {
 		journal = readFileSync(journalPath);
 	} catch (error) {
-		throw new Error(`platform: Runtime database migration journal is missing: ${errorMessage(error)}`);
+		throw new Error(`platform: Runtime database migration journal is missing: ${getErrorMessage(error)}`);
 	}
 	if (hash(journal) !== database.journalSha256) throw new Error(`platform: Runtime database migration journal failed integrity verification: ${journalPath}.`);
 	for (const migration of database.migrations) {
@@ -5239,611 +5442,12 @@ function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
 		try {
 			contents = readFileSync(path);
 		} catch (error) {
-			throw new Error(`platform: Runtime database migration is missing: ${errorMessage(error)}`);
+			throw new Error(`platform: Runtime database migration is missing: ${getErrorMessage(error)}`);
 		}
 		if (hash(contents) !== migration.sha256) throw new Error(`platform: Runtime database migration failed integrity verification: ${path}.`);
 	}
 }
 //#endregion
-//#region src/cli/platform-teardown.ts
-/**
-* `void platform uninstall --purge-resources` deletes every Cloudflare resource the
-* installation created, in an order Cloudflare accepts:
-*
-*   traffic (routes, custom domains, DNS) -> Access -> Email Routing rules
-*   -> queue consumers -> Workers except tail -> Queues -> dispatch namespace
-*   -> tail Worker -> Hyperdrive and KV -> R2 -> AI Gateway -> routing KV (last)
-*
-* Each resource is proven to belong to this installation right before its
-* DELETE, and Cloudflare refuses a resource that something outside the
-* installation still uses. The only forced DELETE is for a platform Worker
-* that Cloudflare refused while every Worker it names as a dependent is one
-* this installation created: the API and proxy Workers bind to each other, so
-* neither can go first without it. A route, custom domain, DNS
-* record, or Access resource that no longer matches what was recorded is kept
-* and listed with the reason instead of stopping the run. Every finished
-* deletion is checkpointed, so rerunning the command continues where it
-* stopped. The routing KV namespace holds that checkpoint, so uninstall
-* deletes it last.
-*
-* An uninstall without --purge-resources records what it leaves as retained. If it
-* stopped before it finished, --purge-resources considers those resources again.
-*/
-const PURGE_RESOURCES_STEP_PREFIX = "uninstall:purge-resources:";
-const WORKER_ORDER = [
-	"email-gateway-worker",
-	"proxy-worker",
-	"dispatch-worker",
-	"api-worker"
-];
-const PERMISSIONS = {
-	access: "Account → Access: Apps and Policies → Edit",
-	aiGateway: "Account → AI Gateway → Edit",
-	dns: "Zone → DNS → Edit",
-	emailRouting: "Zone → Email Routing Rules → Edit",
-	hyperdrive: "Account → Hyperdrive → Edit",
-	kv: "Account → Workers KV Storage → Edit",
-	queues: "Account → Queues → Edit",
-	r2: "Account → Workers R2 Storage → Edit",
-	routes: "Zone → Workers Routes → Edit",
-	serviceTokens: "Account → Access: Service Tokens → Edit",
-	workers: "Account → Workers Scripts → Edit"
-};
-function isPlatformTailWorker(manifest, resource) {
-	return resource.kind === "worker" && (resource.key === "tail-worker" || resource.name === manifest.deployment.resources.tailWorker);
-}
-function purgeResourcesResumeCommand(manifest) {
-	return `void platform uninstall ${manifest.id} --purge-resources`;
-}
-function accessStepKey(access) {
-	return `${PURGE_RESOURCES_STEP_PREFIX}access:${access.key}`;
-}
-/** Access resources that --purge-resources already deleted. */
-function isPurgedAccessResource(manifest, access) {
-	return manifest.steps.some((step) => step.key === accessStepKey(access));
-}
-function hasStep(manifest, key) {
-	return manifest.steps.some((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${key}`);
-}
-function keptStepKey(key) {
-	return `kept:${key}`;
-}
-/**
-* Why --purge-resources kept a resource it was going to delete, for example because
-* a route now serves another Worker; null when it did not keep it. Access
-* resources use the key `access:<key>`.
-*/
-function purgeResourcesKeptReason(manifest, key) {
-	return manifest.steps.find((step) => step.key === `uninstall:purge-resources:${keptStepKey(key)}`)?.resultHash ?? null;
-}
-/** An uninstall that started has not finished, so what it kept can be reconsidered. */
-function isReopenable(manifest) {
-	return manifest.status !== "uninstalled";
-}
-/**
-* A resource the installation created that --purge-resources may still delete: one
-* that is ready, or one that an uninstall which stopped before it finished
-* recorded as retained. Resources --purge-resources itself kept, and earlier
-* versions of a resource kept when it was replaced, are never reconsidered.
-*/
-function isPurgeResourcesCandidate(manifest, resource) {
-	return resource.ownership === "created" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest) && !resource.key.startsWith("retained:") && purgeResourcesKeptReason(manifest, resource.key) === null);
-}
-/** The zone that routes and DNS records live in, if it can still be used. */
-function usableZone(manifest) {
-	return manifest.resources.find((resource) => resource.key === "zone" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest)));
-}
-/**
-* A recorded resource whose live configuration no longer matches the
-* installation's record. --purge-resources keeps such a DNS record and continues.
-*/
-var PlatformResourceChangedError = class extends Error {
-	resourceKey;
-	reason;
-	constructor(resourceKey, reason, message) {
-		super(message);
-		this.resourceKey = resourceKey;
-		this.reason = reason;
-		this.name = "PlatformResourceChangedError";
-	}
-};
-/** The zone whose Email Routing rules may send mail to the gateway Worker. */
-function emailRoutingZone(manifest) {
-	return manifest.deployment.capabilities.email ? manifest.deployment.emailSharedZoneId ?? null : null;
-}
-/** Everything --purge-resources will delete, in deletion order. */
-function purgeResourcesTargets(manifest) {
-	const resources = manifest.resources;
-	const routing = resources.find((resource) => resource.key === "routing-kv");
-	const candidate = (resource) => isPurgeResourcesCandidate(manifest, resource);
-	if (!routing || routing.state !== "ready" && !candidate(routing)) return [];
-	const zone = usableZone(manifest);
-	const workers = resources.filter((resource) => resource.kind === "worker" && candidate(resource));
-	const targets = [];
-	for (const resource of resources) {
-		if (resource.kind !== "worker-route" && resource.kind !== "worker-custom-domain" || resource.state !== "ready" && resource.state !== "retained" || resource.kind === "worker-route" && !zone || purgeResourcesKeptReason(manifest, resource.key) !== null) continue;
-		const name = platformTrafficAttachmentWorker(manifest.deployment, resource);
-		const worker = workers.find((entry) => entry.name === name);
-		if (worker) targets.push({
-			phase: "traffic",
-			resource,
-			worker
-		});
-	}
-	for (const resource of resources) if (resource.kind === "dns-record" && candidate(resource) && zone) targets.push({
-		phase: "dns",
-		resource
-	});
-	const access = (manifest.authenticationResources ?? []).filter((entry) => entry.ownership === "created" && !isPurgedAccessResource(manifest, entry) && purgeResourcesKeptReason(manifest, `access:${entry.key}`) === null);
-	for (const kind of ["application", "service-token"]) for (const entry of access.filter((candidate) => candidate.kind === kind)) targets.push({
-		phase: "access",
-		access: entry
-	});
-	const gateway = workers.find((worker) => worker.key === "email-gateway-worker");
-	if (gateway && emailRoutingZone(manifest) && !hasStep(manifest, "email-routing")) targets.push({
-		phase: "email",
-		resource: gateway
-	});
-	const queues = resources.filter((resource) => resource.kind === "queue" && candidate(resource));
-	for (const resource of queues) if (!hasStep(manifest, `consumers:${resource.key}`)) targets.push({
-		phase: "queue-consumers",
-		resource
-	});
-	const rank = (resource) => {
-		const index = WORKER_ORDER.indexOf(resource.key);
-		return index < 0 ? WORKER_ORDER.length : index;
-	};
-	for (const resource of workers.filter((worker) => !isPlatformTailWorker(manifest, worker)).sort((left, right) => rank(left) - rank(right) || left.key.localeCompare(right.key))) targets.push({
-		phase: "workers",
-		resource
-	});
-	for (const resource of queues) targets.push({
-		phase: "queues",
-		resource
-	});
-	for (const resource of resources) if (resource.kind === "dispatch-namespace" && candidate(resource)) targets.push({
-		phase: "dispatch",
-		resource
-	});
-	for (const resource of workers.filter((worker) => isPlatformTailWorker(manifest, worker))) targets.push({
-		phase: "tail",
-		resource
-	});
-	for (const kind of ["hyperdrive", "kv-namespace"]) for (const resource of resources) if (resource.kind === kind && resource.key !== "routing-kv" && candidate(resource)) targets.push({
-		phase: "data",
-		resource
-	});
-	for (const kind of ["r2-bucket", "ai-gateway"]) for (const resource of resources) if (resource.kind === kind && candidate(resource)) targets.push({
-		phase: kind === "r2-bucket" ? "r2" : "ai-gateway",
-		resource
-	});
-	if (candidate(routing)) targets.push({
-		phase: "routing",
-		resource: routing
-	});
-	return targets;
-}
-/** Whether --purge-resources removes, or has removed, the rules that send mail to the gateway Worker. */
-function purgeResourcesHandlesEmailRouting(manifest) {
-	return hasStep(manifest, "email-routing") || purgeResourcesTargets(manifest).some((target) => target.phase === "email");
-}
-/** Manifest resources that --purge-resources leaves in the account. */
-function purgeResourcesKeptResources(manifest) {
-	const targets = new Set(purgeResourcesTargets(manifest).flatMap((target) => "resource" in target ? [target.resource.key] : []));
-	return manifest.resources.filter((resource) => (resource.state === "ready" || resource.state === "retained") && !targets.has(resource.key));
-}
-function resourceLabel(resource) {
-	return `${resource.kind}: ${resource.name}${resource.name === resource.id ? "" : ` (${resource.id})`}`;
-}
-/** Plan lines for --purge-resources: what is deleted, in order, then what is kept. */
-function describePurgeResourcesPlan(manifest) {
-	const targets = purgeResourcesTargets(manifest);
-	const lines = [];
-	let step = 0;
-	let previous = null;
-	const consumerQueues = [];
-	for (const target of targets) {
-		if (target.phase === "email") {
-			step++;
-			previous = target.phase;
-			lines.push(`  ${step}. Email Routing rules in zone ${emailRoutingZone(manifest)} that send mail to ${target.resource.name}, and its catch-all rule if it does (reset to drop mail, disabled)`);
-			continue;
-		}
-		if (target.phase !== previous) {
-			step++;
-			previous = target.phase;
-		}
-		const prefix = `  ${step}. `;
-		if (target.phase === "traffic") lines.push(`${prefix}${resourceLabel(target.resource)} -> ${target.worker.name}`);
-		else if (target.phase === "access") lines.push(`${prefix}Access ${target.access.kind}: ${target.access.name} (${target.access.id})`);
-		else if (target.phase === "queue-consumers") {
-			consumerQueues.push(target.resource.name);
-			if (consumerQueues.length === 1) lines.push(`${prefix}queue consumers run by this installation's Workers on:`);
-			lines.push(`       ${target.resource.name}`);
-		} else if (target.phase === "dispatch") lines.push(`${prefix}${resourceLabel(target.resource)}, with any application Workers still in it`);
-		else if (target.phase === "tail") lines.push(`${prefix}${resourceLabel(target.resource)}, the tail Worker, after the others`);
-		else if (target.phase === "workers" && target.resource.key === "api-worker") lines.push(`${prefix}${resourceLabel(target.resource)}, with its Durable Object data`);
-		else if (target.phase === "r2") lines.push(`${prefix}${resourceLabel(target.resource)}, emptied first`);
-		else if (target.phase === "ai-gateway") lines.push(`${prefix}${resourceLabel(target.resource)}, if Cloudflare shows it was created during installation; otherwise kept`);
-		else if (target.phase === "routing") lines.push(`${prefix}${resourceLabel(target.resource)}, last; it holds uninstall progress`);
-		else lines.push(`${prefix}${resourceLabel(target.resource)}`);
-	}
-	return lines.length ? ["Delete every resource this installation created (--purge-resources), in this order:", ...lines] : ["--purge-resources finds no resource it can prove this installation created."];
-}
-/** Lines naming what --purge-resources never removes. */
-function purgeResourcesAlwaysKept() {
-	return [
-		"  The external PostgreSQL database and its data.",
-		"  Analytics Engine datasets; Cloudflare has no API to delete them.",
-		"  Access policies and identity providers you chose.",
-		"  API tokens you created for this platform. Revoke them in the Cloudflare dashboard."
-	];
-}
-/** Token permissions --purge-resources needs for this manifest. */
-function purgeResourcesPermissions(manifest) {
-	const targets = purgeResourcesTargets(manifest);
-	const needed = /* @__PURE__ */ new Set();
-	for (const target of targets) {
-		if (target.phase === "access") {
-			needed.add(target.access.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens);
-			continue;
-		}
-		if (target.phase === "email") {
-			needed.add(PERMISSIONS.emailRouting);
-			continue;
-		}
-		const { kind } = target.resource;
-		if (kind === "worker-route") needed.add(PERMISSIONS.routes);
-		else if (kind === "worker" || kind === "worker-custom-domain" || kind === "dispatch-namespace") needed.add(PERMISSIONS.workers);
-		else if (kind === "dns-record") needed.add(PERMISSIONS.dns);
-		else if (kind === "queue") needed.add(PERMISSIONS.queues);
-		else if (kind === "kv-namespace") needed.add(PERMISSIONS.kv);
-		else if (kind === "hyperdrive") needed.add(PERMISSIONS.hyperdrive);
-		else if (kind === "r2-bucket") needed.add(PERMISSIONS.r2);
-		else if (kind === "ai-gateway") needed.add(PERMISSIONS.aiGateway);
-	}
-	return Object.values(PERMISSIONS).filter((permission) => needed.has(permission));
-}
-function deniedStatus(error) {
-	return error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403);
-}
-/**
-* Check resource reads before the first change. Browser login cannot change
-* DNS or Access, so those need an API token. Read probes cannot prove Edit;
-* the plan lists the required permissions.
-*/
-async function checkPurgeResourcesCredentials(client, manifest, credential) {
-	const targets = purgeResourcesTargets(manifest);
-	const resources = targets.flatMap((target) => "resource" in target ? [target.resource] : []);
-	const access = targets.flatMap((target) => "access" in target ? [target.access] : []);
-	const has = (kind) => resources.some((resource) => resource.kind === kind);
-	const zone = manifest.resources.find((resource) => resource.key === "zone");
-	const emailZone = targets.some((target) => target.phase === "email") ? emailRoutingZone(manifest) : null;
-	const accounts = [.../* @__PURE__ */ new Set([manifest.account.id, ...access.map((entry) => entry.accountId)])];
-	const scope = `${accounts.length === 1 ? "account" : "accounts"} ${accounts.join(" and ")}${has("dns-record") || has("worker-route") ? ` and zone ${zone?.name ?? ""}` : ""}${emailZone ? ` and Email Routing zone ${emailZone}` : ""}`;
-	if (credential.source === "oauth") {
-		const browserMissing = [
-			...has("dns-record") ? [PERMISSIONS.dns] : [],
-			...access.some((entry) => entry.kind === "application") ? [PERMISSIONS.access] : [],
-			...access.some((entry) => entry.kind === "service-token") ? [PERMISSIONS.serviceTokens] : [],
-			...has("ai-gateway") && !credential.aiGatewayToken ? [PERMISSIONS.aiGateway] : []
-		];
-		if (browserMissing.length) throw new Error(`platform: Cloudflare browser login cannot delete every resource --purge-resources plans. Set CLOUDFLARE_API_TOKEN to a token with ${purgeResourcesPermissions(manifest).join(", ")}, scoped to ${scope}, then rerun. Browser login is missing: ${browserMissing.join(", ")}. No Cloudflare resource was changed.`);
-	}
-	const probes = [];
-	if (has("worker") || has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerNames(manifest.account.id)]);
-	if (has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerDomains(manifest.account.id)]);
-	if (has("worker-route") && zone) probes.push([PERMISSIONS.routes, () => client.listWorkerRoutes(zone.id)]);
-	for (const resource of resources) if (resource.kind === "dns-record" && zone) probes.push([PERMISSIONS.dns, () => client.listDnsRecords(zone.id, resource.name)]);
-	else if (resource.kind === "queue") probes.push([PERMISSIONS.queues, () => client.listQueueConsumers(manifest.account.id, resource.id)]);
-	for (const entry of access) probes.push([entry.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens, () => client.getAccessResource(entry.accountId, entry.kind, entry.id)]);
-	if (emailZone) probes.push([PERMISSIONS.emailRouting, () => client.listEmailRoutingRules(emailZone)]);
-	if (has("dispatch-namespace")) probes.push([PERMISSIONS.workers, () => client.listDispatchNamespaces(manifest.account.id)]);
-	if (has("kv-namespace")) probes.push([PERMISSIONS.kv, () => client.listKvNamespaces(manifest.account.id)]);
-	if (has("hyperdrive")) probes.push([PERMISSIONS.hyperdrive, () => client.listHyperdriveConfigs(manifest.account.id)]);
-	if (has("r2-bucket")) probes.push([PERMISSIONS.r2, () => client.listR2Buckets(manifest.account.id)]);
-	if (has("ai-gateway")) probes.push([PERMISSIONS.aiGateway, () => client.listAiGateways(manifest.account.id)]);
-	const missing = /* @__PURE__ */ new Set();
-	for (const [permission, probe] of probes) try {
-		await probe();
-	} catch (error) {
-		if (!deniedStatus(error)) throw error;
-		missing.add(permission);
-	}
-	if (missing.size) throw new Error(`platform: The Cloudflare credential cannot read every resource --purge-resources would delete. Add ${[...missing].join(", ")} for ${scope}, then rerun. No Cloudflare resource was changed.`);
-}
-const LISTED_PROJECTS = 20;
-/** Slugs of every project row, including projects whose deletion stopped partway. */
-async function readPlatformProjectSlugsConnection(client) {
-	if ((await client.query(`SELECT to_regclass('public.projects') IS NOT NULL AS "present"`)).rows[0]?.present !== true) return [];
-	return (await client.query("SELECT \"slug\" FROM \"projects\" ORDER BY \"slug\"")).rows.map((row) => row.slug);
-}
-/**
-* Projects own Workers, storage, and domains that only the running platform
-* can delete. --purge-resources deletes the platform, so it refuses before any
-* change while a project remains.
-*/
-async function assertNoPlatformProjects(read) {
-	let slugs;
-	try {
-		if (!read) throw new Error("no platform database connection is available");
-		slugs = await read();
-	} catch (error) {
-		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
-		throw new Error(`platform: Refusing --purge-resources because the project list could not be read from the platform database: ${reason}\nMake the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry.`);
-	}
-	if (slugs.length) throw new Error([
-		`platform: Refusing --purge-resources while the platform still has ${slugs.length === 1 ? "1 project" : `${slugs.length} projects`}.`,
-		"--purge-resources deletes the platform, and only the running platform can delete each project's Workers, storage, and domains.",
-		"Delete each project first with `void project delete <name>`, then retry:",
-		...slugs.slice(0, LISTED_PROJECTS).map((slug) => `  ${slug}`),
-		...slugs.length > LISTED_PROJECTS ? [`  …and ${slugs.length - LISTED_PROJECTS} more`] : []
-	].join("\n"));
-}
-const AI_GATEWAY_CREATION_WINDOW_MS = 6e5;
-/**
-* AI Gateway ids are chosen by the caller and can be reused after a delete,
-* and gateways carry no ownership marker. Only a creation time next to the
-* installer's provision intent shows that this is the gateway it created.
-*/
-function createdDuringInstallation(manifest, resource, createdAt) {
-	const created = createdAt === void 0 ? NaN : Date.parse(createdAt);
-	if (Number.isNaN(created)) return false;
-	return manifest.steps.some((step) => (step.key === `provision-intent:${resource.key}` || step.key.startsWith(`provision-intent:${resource.key}:`)) && Math.abs(created - Date.parse(step.completedAt)) <= AI_GATEWAY_CREATION_WINDOW_MS);
-}
-function ownershipRefusal(manifest, description, reason) {
-	return /* @__PURE__ */ new Error(`platform: Refusing to delete ${description} because ${reason}. It may no longer belong to this installation. Delete or fix it in the Cloudflare dashboard if it is yours, then rerun: ${purgeResourcesResumeCommand(manifest)}`);
-}
-function cloudflareRefusal(manifest, description, error, hint) {
-	if (!(error instanceof PlatformCloudflareApiError)) return error;
-	return new Error(`platform: Cloudflare refused to delete ${description}: ${error.message}\n${hint}\nProgress is saved. Rerun: ${purgeResourcesResumeCommand(manifest)}`, { cause: error });
-}
-/**
-* Delete every target in order. Returns the manifest with each deleted
-* resource recorded; routing KV is left for the caller to delete last.
-*/
-async function runPurgeResourcesTeardown(context, initial) {
-	const { client } = context;
-	let next = initial;
-	const accountId = next.account.id;
-	const save = async (manifest) => {
-		next = manifest;
-		await context.checkpoint(next);
-	};
-	const markDeleted = async (key) => {
-		const resource = next.resources.find((entry) => entry.key === key);
-		await save(recordInstallationResource(next, {
-			...resource,
-			state: "deleted"
-		}, (/* @__PURE__ */ new Date()).toISOString()));
-	};
-	const recordStep = async (key, resultHash = "completed") => {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		await save(recordInstallationStep(next, {
-			completedAt: now,
-			key: `${PURGE_RESOURCES_STEP_PREFIX}${key}`,
-			resultHash
-		}, now));
-	};
-	/**
-	* Live proof for these keys. A resource an earlier uninstall recorded as
-	* retained is proven like a ready one; only its recorded state differs.
-	*/
-	const verify = (keys) => context.verify({
-		...next,
-		resources: next.resources.map((resource) => keys.has(resource.key) && resource.state === "retained" ? {
-			...resource,
-			state: "ready"
-		} : resource)
-	}, keys);
-	/**
-	* Prove the resource; false when it is already gone (and recorded).
-	*
-	* Cloudflare has no conditional DELETE: Workers and dispatch namespaces are
-	* addressed by name, and a route or custom domain can be changed in place.
-	* Something replaced between this proof and the DELETE can still be removed.
-	* That one-request window is accepted because --purge-resources is opt-in and its
-	* plan lists every resource first. A forced Worker DELETE has the same
-	* window between reading its dependents and the DELETE.
-	*/
-	const prove = async (resource) => {
-		if ((await verify(/* @__PURE__ */ new Set(["routing-kv", resource.key]))).has(resource.key)) {
-			await markDeleted(resource.key);
-			return false;
-		}
-		return true;
-	};
-	/** Keep a resource that no longer matches the record, and save why. */
-	const keep = async (key, reason) => {
-		const resource = next.resources.find((entry) => entry.key === key);
-		if (resource?.state === "ready") await save(recordInstallationResource(next, {
-			...resource,
-			state: "retained"
-		}, (/* @__PURE__ */ new Date()).toISOString()));
-		await recordStep(keptStepKey(key), reason);
-	};
-	const remove = async (resource, hint, zoneId) => {
-		if (!await prove(resource)) return;
-		try {
-			await client.deleteResource(accountId, resource, zoneId);
-		} catch (error) {
-			throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, hint);
-		}
-		await markDeleted(resource.key);
-	};
-	const zone = usableZone(next);
-	const createdWorkerNames = new Set(next.resources.filter((resource) => resource.kind === "worker" && resource.ownership === "created").map((resource) => resource.name));
-	/** The recorded Worker under this name that this run still deletes, if any. */
-	const workerTarget = (name) => next.resources.find((resource) => resource.kind === "worker" && resource.name === name && isPurgeResourcesCandidate(next, resource));
-	const workerHint = "A Worker this installation did not create may still use it, for example by sending it logs as a tail Worker or through a service binding. Remove that link in the Cloudflare dashboard.";
-	/**
-	* Delete a platform Worker. When Cloudflare refuses because other Workers
-	* still bind to it, force the DELETE only if each of them is a Worker this
-	* run deletes too and still carries this installation's ownership marker.
-	*/
-	const removeWorker = async (resource) => {
-		if (!await prove(resource)) return;
-		try {
-			await client.deleteResource(accountId, resource);
-		} catch (error) {
-			if (!(error instanceof PlatformCloudflareApiError)) throw error;
-			const dependents = await client.listWorkerDependents(accountId, resource.name).catch(() => null);
-			const outside = dependents?.workers.filter((name) => !workerTarget(name)) ?? [];
-			const keys = outside.length ? [] : dependents?.workers.map((name) => workerTarget(name).key) ?? [];
-			const missing = dependents && !dependents.pagesFunction && keys.length ? await verify(/* @__PURE__ */ new Set(["routing-kv", ...keys])) : null;
-			if (!dependents || dependents.pagesFunction || dependents.workers.length === 0 || outside.length > 0 || !missing || keys.some((key) => missing.has(key))) throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, outside.length ? `Workers outside this installation still use it: ${outside.join(", ")}. Remove that link in the Cloudflare dashboard.` : workerHint);
-			try {
-				await client.forceDeleteWorker(accountId, resource.name);
-			} catch (forced) {
-				throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, forced, workerHint);
-			}
-		}
-		await markDeleted(resource.key);
-	};
-	for (const target of purgeResourcesTargets(initial)) {
-		if (target.phase === "access") {
-			const { access } = target;
-			const live = await client.getAccessResource(access.accountId, access.kind, access.id);
-			if (live) {
-				if (live.name !== access.name || !access.name.startsWith(`void-${next.id}-`)) {
-					await keep(`access:${access.key}`, `its live name ${JSON.stringify(live.name)} is not the name this installation recorded`);
-					continue;
-				}
-				try {
-					await client.deleteAccessResource(access.accountId, access.kind, access.id);
-				} catch (error) {
-					throw cloudflareRefusal(next, `Access ${access.kind} ${access.name}`, error, "Check that nothing outside this installation still uses it.");
-				}
-			}
-			await recordStep(`access:${access.key}`);
-			continue;
-		}
-		const current = next.resources.find((resource) => resource.key === target.resource.key);
-		if (!current || current.state === "deleted" || purgeResourcesKeptReason(next, current.key) !== null || target.phase !== "traffic" && !isPurgeResourcesCandidate(next, current)) continue;
-		switch (target.phase) {
-			case "traffic": {
-				const worker = next.resources.find((resource) => resource.key === target.worker.key);
-				if (!worker || !isPurgeResourcesCandidate(next, worker) || !await prove(worker)) break;
-				if (current.kind === "worker-route") {
-					const live = (await client.listWorkerRoutes(zone.id)).find((route) => route.id === current.id);
-					if (live && (live.pattern !== current.name || live.script !== worker.name)) {
-						await keep(current.key, `it now sends ${JSON.stringify(live.pattern)} to ${JSON.stringify(live.script)}`);
-						break;
-					}
-					if (live) await client.deleteWorkerRoute(zone.id, current.id);
-				} else {
-					const live = (await client.listWorkerDomains(accountId)).find((domain) => domain.id === current.id);
-					if (live && (live.hostname !== current.name || live.service !== worker.name)) {
-						await keep(current.key, `it now sends ${JSON.stringify(live.hostname)} to ${JSON.stringify(live.service)}`);
-						break;
-					}
-					if (live) await client.deleteWorkerDomain(accountId, current.id);
-				}
-				await markDeleted(current.key);
-				break;
-			}
-			case "dns":
-				try {
-					await remove(current, "Check the record in the Cloudflare dashboard.", zone.id);
-				} catch (error) {
-					if (!(error instanceof PlatformResourceChangedError && error.resourceKey === current.key)) throw error;
-					await keep(current.key, error.reason);
-				}
-				break;
-			case "email": {
-				if (!await prove(current)) break;
-				const zoneId = emailRoutingZone(next);
-				const hint = "Check the Email Routing rules for this zone in the Cloudflare dashboard. Never disable Email Routing for the zone.";
-				try {
-					for (const rule of await client.listEmailRoutingRules(zoneId)) if (rule.workerName === current.name) await client.deleteEmailRoutingRule(zoneId, rule.id);
-					if ((await client.getEmailRoutingCatchAll(zoneId))?.workerName === current.name) await client.resetEmailRoutingCatchAll(zoneId);
-				} catch (error) {
-					throw cloudflareRefusal(next, `Email Routing rules that send mail to ${current.name}`, error, hint);
-				}
-				await recordStep("email-routing");
-				break;
-			}
-			case "queue-consumers":
-				if (!await prove(current)) break;
-				for (const consumer of await client.listQueueConsumers(accountId, current.id)) if (consumer.script && createdWorkerNames.has(consumer.script)) await client.deleteQueueConsumer(accountId, current.id, consumer.id);
-				await recordStep(`consumers:${current.key}`);
-				break;
-			case "workers":
-				await removeWorker(current);
-				break;
-			case "tail":
-				await remove(current, workerHint);
-				break;
-			case "queues":
-				await remove(current, "A Worker this installation did not create may still use the Queue as a producer or consumer. Remove it from that Worker in the Cloudflare dashboard.");
-				break;
-			case "dispatch": {
-				if (!await prove(current)) break;
-				const projects = await context.readProjects();
-				if (projects.length) throw new Error(`platform: Stopped before deleting the application Workers in dispatch namespace ${current.name} because ${projects.length === 1 ? "a project was" : "projects were"} created while this uninstall ran: ${projects.join(", ")}. Nothing in the namespace was deleted. --purge-resources refuses while the platform database lists a project. Remove each one from the "projects" table once you have dealt with its Cloudflare resources, then rerun: ${purgeResourcesResumeCommand(next)}`);
-				for (const script of await client.listDispatchNamespaceScripts(accountId, current.name)) try {
-					await client.deleteDispatchNamespaceScript(accountId, current.name, script);
-				} catch (error) {
-					throw cloudflareRefusal(next, `application Worker ${script}`, error, workerHint);
-				}
-				try {
-					await client.deleteResource(accountId, current);
-				} catch (error) {
-					throw cloudflareRefusal(next, `dispatch-namespace ${current.name}`, error, "Check the namespace in the Cloudflare dashboard.");
-				}
-				await markDeleted(current.key);
-				break;
-			}
-			case "ai-gateway": {
-				const live = (await client.listAiGateways(accountId)).find((gateway) => gateway.id === current.id && gateway.name === current.name);
-				if (live && !createdDuringInstallation(next, current, live.createdAt)) {
-					await keep(current.key, "Cloudflare does not show it was created during installation");
-					break;
-				}
-				await remove(current, "Check that nothing outside this installation still uses it.");
-				break;
-			}
-			case "data":
-				await remove(current, "Check that nothing outside this installation still uses it.");
-				break;
-			case "r2": await purgeBucket(current);
-		}
-	}
-	return next;
-	async function purgeBucket(bucket) {
-		const markerStep = `r2-marker:${bucket.key}`;
-		if (!hasStep(next, markerStep)) {
-			if (!await prove(bucket)) return;
-			await client.emptyR2Bucket(accountId, bucket.name, /* @__PURE__ */ new Set([PLATFORM_R2_OWNERSHIP_MARKER_KEY]), async () => {
-				if ((await verify(/* @__PURE__ */ new Set(["routing-kv", bucket.key]))).has(bucket.key)) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "it disappeared while it was being emptied");
-			});
-			if (!await prove(bucket)) return;
-			const generation = await context.bucketGeneration(next, bucket);
-			if (generation === null) {
-				await markDeleted(bucket.key);
-				return;
-			}
-			await recordStep(markerStep, generation);
-			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
-		} else {
-			const saved = next.steps.find((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${markerStep}`);
-			const generation = await context.bucketGeneration(next, bucket);
-			if (generation === null) {
-				await markDeleted(bucket.key);
-				return;
-			}
-			if (generation !== saved?.resultHash) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "its creation fingerprint changed");
-			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
-		}
-		try {
-			await client.deleteResource(accountId, bucket);
-		} catch (error) {
-			throw cloudflareRefusal(next, `r2-bucket ${bucket.name}`, error, "Cloudflare deletes only empty buckets. If objects were added after it was emptied, delete them in the Cloudflare dashboard.");
-		}
-		await markDeleted(bucket.key);
-	}
-}
-//#endregion
 //#region src/cli/platform-zero-trust-uninstall.ts
 /**
 * Uninstall turns off the platform API, and only that API can remove the
@@ -5858,6 +5462,16 @@ const ZERO_TRUST_SETTING = "zeroTrust.configuration";
 const ZERO_TRUST_LOCK = "hashtext('zero-trust:configuration')";
 const UNINSTALL_SETTING = "platform.uninstall";
 const LISTED_APPLICATIONS = 20;
+/** Runs an uninstall precheck read; any failure becomes the refusal `refuse` builds. */
+async function readPlatformDatabase(read, refuse) {
+	try {
+		if (!read) throw new Error("no platform database connection is available");
+		return await read();
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
+		throw new Error(refuse(reason));
+	}
+}
 function optionalText(value, label) {
 	if (value === null || value === void 0) return null;
 	if (typeof value !== "string") throw new Error(`the saved ${label} is malformed`);
@@ -5995,18 +5609,11 @@ function unfinishedDeletionLines(state) {
 * or while its state cannot be read. Runs before uninstall changes anything.
 */
 async function assertProjectZeroTrustAllowsUninstall(read) {
-	let state;
-	try {
-		if (!read) throw new Error("no platform database connection is available");
-		state = await read();
-	} catch (error) {
-		const reason = (error instanceof Error ? error.message : String(error)).replace(/^platform: /, "");
-		throw new Error([
-			`platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
-			"Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.",
-			"Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first."
-		].join("\n"));
-	}
+	const state = await readPlatformDatabase(read, (reason) => [
+		`platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
+		"Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.",
+		"Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first."
+	].join("\n"));
 	if (state.active) {
 		const covered = state.destinations.length ? ` on ${state.destinations.join(" and ")}` : " on every hostname under the application domain";
 		throw new Error([
@@ -6031,7 +5638,7 @@ async function assertProjectZeroTrustAllowsUninstall(read) {
 }
 //#endregion
 //#region src/cli/platform-installer-database.ts
-async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, secrets, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, onManifestChange) {
+async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	dependencies.onProgress?.("Checking the platform database schema");
 	const rollbackDatabase = dependencies.databaseRollbackSource;
 	const migrationStep = `database-schema:${runtime.database.schemaDigest}`;
@@ -6049,14 +5656,9 @@ async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory
 		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
 	} else if (!manifest.steps.some((step) => step.key === migrationStep)) {
 		dependencies.onProgress?.("Applying platform database migrations");
-		const legacyMigrationStep = `database-migrations:${runtime.database.journalSha256}`;
-		if (dependencies.migrateDatabase) {
-			if (!manifest.steps.some((step) => step.key === legacyMigrationStep)) await dependencies.migrateDatabase(secrets.databaseUrl, join(runtimeDirectory, "drizzle"));
-		} else {
-			const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
-			if (!prepareDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.");
-			await prepareDatabase(runtimeDirectory, runtime.database, sourcePlatformVersion, hadPriorWorkers);
-		}
+		const prepareDatabase = dependencies.prepareDatabase ?? releaseDatabaseLock.prepareDatabase;
+		if (!prepareDatabase) throw new Error("platform: The PostgreSQL lifecycle lock cannot verify or migrate this database.");
+		await prepareDatabase(runtimeDirectory, runtime.database, sourcePlatformVersion, hadPriorWorkers);
 		manifest = recordInstallationStep(manifest, {
 			completedAt: now(),
 			key: migrationStep,
@@ -6123,20 +5725,28 @@ function platformDatabaseClientUrl(databaseUrl) {
 	url.searchParams.set("sslmode", "verify-full");
 	return url.toString();
 }
-async function claimPlatformDatabase(databaseUrl, installationId, ownershipNonce) {
+async function withPlatformDatabasePool(databaseUrl, use) {
 	const { Pool } = await import("pg");
 	const pool = new Pool({
 		connectionString: platformDatabaseClientUrl(databaseUrl),
 		max: 1
 	});
-	const client = await pool.connect();
 	try {
-		await claimPlatformDatabaseConnection(client, installationId, ownershipNonce);
+		return await use(pool);
 	} finally {
-		client.release();
 		await pool.end();
 	}
 }
+function claimPlatformDatabase(databaseUrl, installationId, ownershipNonce) {
+	return withPlatformDatabasePool(databaseUrl, async (pool) => {
+		const client = await pool.connect();
+		try {
+			await claimPlatformDatabaseConnection(client, installationId, ownershipNonce);
+		} finally {
+			client.release();
+		}
+	});
+}
 async function acquirePlatformDatabaseLifecycleLock(databaseUrl, installationId, ownershipNonce) {
 	const { Pool } = await import("pg");
 	const pool = new Pool({
@@ -6162,49 +5772,35 @@ async function acquirePlatformDatabaseLifecycleLock(databaseUrl, installationId,
 	}
 }
 async function readPlatformDatabaseLifecycleManifest(databaseUrl, installationId, ownershipNonce) {
-	const { Pool } = await import("pg");
-	const pool = new Pool({
-		connectionString: platformDatabaseClientUrl(databaseUrl),
-		max: 1
+	return withPlatformDatabasePool(databaseUrl, async (pool) => {
+		try {
+			return await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
+		} catch (error) {
+			if (error instanceof Error && error.message.startsWith("platform:")) throw error;
+			throw new Error(`platform: Could not read the PostgreSQL lifecycle checkpoint: ${error instanceof Error ? error.message : String(error)}`);
+		}
 	});
-	try {
-		return await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
-	} catch (error) {
-		if (error instanceof Error && error.message.startsWith("platform:")) throw error;
-		throw new Error(`platform: Could not read the PostgreSQL lifecycle checkpoint: ${error instanceof Error ? error.message : String(error)}`);
-	} finally {
-		await pool.end();
-	}
 }
-/** Read project Zero Trust state for a plan, which holds no lifecycle lock. */
-async function readPlatformProjectZeroTrustState(databaseUrl, installationId, ownershipNonce) {
+/** Plans hold no lifecycle lock, so verify the installation claim before reading. */
+async function readClaimedPlatformDatabase(databaseUrl, installationId, ownershipNonce, read) {
 	if (!databaseUrl) throw new Error("the installation database URL is not recorded on this machine");
-	const { Pool } = await import("pg");
-	const pool = new Pool({
-		connectionString: platformDatabaseClientUrl(databaseUrl),
-		max: 1
-	});
-	try {
+	return withPlatformDatabasePool(databaseUrl, async (pool) => {
 		await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
-		return await readPlatformProjectZeroTrustStateConnection(pool);
-	} finally {
-		await pool.end();
-	}
-}
-/** Read project slugs for a --purge-resources plan, which holds no lifecycle lock. */
-async function readPlatformProjectSlugs(databaseUrl, installationId, ownershipNonce) {
-	if (!databaseUrl) throw new Error("the installation database URL is not recorded on this machine");
-	const { Pool } = await import("pg");
-	const pool = new Pool({
-		connectionString: platformDatabaseClientUrl(databaseUrl),
-		max: 1
+		return read(pool);
 	});
-	try {
-		await readPlatformDatabaseLifecycleManifestConnection(pool, installationId, ownershipNonce);
-		return await readPlatformProjectSlugsConnection(pool);
-	} finally {
-		await pool.end();
-	}
+}
+/** Read project Zero Trust state for a plan. */
+function readPlatformProjectZeroTrustState(databaseUrl, installationId, ownershipNonce) {
+	return readClaimedPlatformDatabase(databaseUrl, installationId, ownershipNonce, readPlatformProjectZeroTrustStateConnection);
+}
+/** Read project slugs for a --purge-resources plan. */
+function readPlatformProjectSlugs(databaseUrl, installationId, ownershipNonce) {
+	return readClaimedPlatformDatabase(databaseUrl, installationId, ownershipNonce, readPlatformProjectSlugsConnection);
+}
+/** Slugs of every project row, including projects whose deletion stopped partway. */
+async function readPlatformProjectSlugsConnection(client) {
+	if ((await client.query(`SELECT to_regclass('public.projects') IS NOT NULL AS "present"`)).rows[0]?.present !== true) return [];
+	return (await client.query("SELECT \"slug\" FROM \"projects\" ORDER BY \"slug\"")).rows.map((row) => row.slug);
 }
 async function inspectPlatformDatabaseStateConnection(client, database) {
 	const relation = await client.query(`SELECT to_regclass('"drizzle"."__drizzle_migrations"')::text AS "relation"`);
@@ -6217,14 +5813,12 @@ async function inspectPlatformDatabaseStateConnection(client, database) {
      ORDER BY "created_at", "id"`);
 	if (result.rows.length > database.migrations.length) throw new Error("platform: PostgreSQL contains migrations newer than this Void Platform package.");
 	let previousTimestamp = -1;
-	const seenTimestamps = /* @__PURE__ */ new Set();
 	for (const [position, row] of result.rows.entries()) {
 		const timestampMillis = databaseInteger(row.created_at);
-		if (timestampMillis === null || timestampMillis <= previousTimestamp || seenTimestamps.has(timestampMillis)) throw new Error("platform: PostgreSQL migration history is duplicated or not strictly ordered.");
+		if (timestampMillis === null || timestampMillis <= previousTimestamp) throw new Error("platform: PostgreSQL migration history is duplicated or not strictly ordered.");
 		const expected = database.migrations[position];
 		if (!expected || timestampMillis !== expected.timestampMillis || row.hash !== expected.sha256) throw new Error("platform: PostgreSQL migration history is not an exact prefix of this Void Platform package. Refusing to apply edited, forked, or out-of-order migrations.");
 		previousTimestamp = timestampMillis;
-		seenTimestamps.add(timestampMillis);
 	}
 	const applied = database.migrations.slice(0, result.rows.length);
 	return {
@@ -6359,15 +5953,21 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 	release.verifyDatabase = (runtimeDirectory, database) => verifyPlatformDatabaseConnection(client, runtimeDirectory, database);
 	return release;
 }
-async function preparePlatformSandboxDrainConnection(client, requiredAdmissionProtocol = 0) {
-	if (!(await client.query(`SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`)).rows[0]?.relation) throw new Error("platform: Runtime declares sandbox-drain safety but its database checkpoint table is missing.");
-	const hasAdmissionColumn = (await client.query(`SELECT EXISTS(
+/** Null when the sandbox-drain checkpoint table does not exist. */
+async function readSandboxDrainTable(client) {
+	if (!(await client.query(`SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`)).rows[0]?.relation) return null;
+	return { hasAdmissionColumn: (await client.query(`SELECT EXISTS(
        SELECT 1
        FROM information_schema.columns
        WHERE table_schema = 'public'
          AND table_name = 'sandbox_drain_checkpoints'
          AND column_name = 'admission_protocol'
-     ) AS "present"`)).rows[0]?.present === true;
+     ) AS "present"`)).rows[0]?.present === true };
+}
+async function preparePlatformSandboxDrainConnection(client, requiredAdmissionProtocol = 0) {
+	const table = await readSandboxDrainTable(client);
+	if (!table) throw new Error("platform: Runtime declares sandbox-drain safety but its database checkpoint table is missing.");
+	const { hasAdmissionColumn } = table;
 	if (requiredAdmissionProtocol >= 2 && !hasAdmissionColumn) throw new Error("platform: The runtime database does not include the sandbox deployment admission barrier.");
 	const readCheckpoint = () => client.query(`SELECT ${hasAdmissionColumn ? "\"admission_protocol\"" : "0 AS \"admission_protocol\""}, "generation", "state", "phase", "cursor", "started_at", "updated_at", "completed_at"
        FROM "sandbox_drain_checkpoints"
@@ -6471,14 +6071,9 @@ async function verifyPlatformDatabaseConnection(client, runtimeDirectory, databa
 	if (state.pendingMigrations.length !== 0 || state.schemaDigest !== database.schemaDigest) throw new Error("platform: PostgreSQL is not at the exact forward-only schema recorded by the installed runtime.");
 }
 async function readRequiredPlatformSafetyProtocols(client) {
-	if (!(await client.query(`SELECT to_regclass('"sandbox_drain_checkpoints"')::text AS "relation"`)).rows[0]?.relation) return { sandboxDrain: 0 };
-	if ((await client.query(`SELECT EXISTS(
-       SELECT 1
-       FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = 'sandbox_drain_checkpoints'
-         AND column_name = 'admission_protocol'
-     ) AS "present"`)).rows[0]?.present === true) {
+	const table = await readSandboxDrainTable(client);
+	if (!table) return { sandboxDrain: 0 };
+	if (table.hasAdmissionColumn) {
 		const admission = await client.query(`SELECT EXISTS(
          SELECT 1
          FROM "sandbox_drain_checkpoints"
@@ -6498,7 +6093,7 @@ async function readRequiredPlatformSafetyProtocols(client) {
      ) AS "required"`)).rows[0]?.required === true ? 1 : 0 };
 }
 function assertPlatformRuntimeSafety(runtime, installed, database = { sandboxDrain: 0 }) {
-	const requiredSandboxDrain = Math.max(installed?.sandboxDrain ?? 0, database?.sandboxDrain ?? 0);
+	const requiredSandboxDrain = Math.max(installed.sandboxDrain, database.sandboxDrain);
 	if ((runtime.safetyProtocols?.sandboxDrain ?? 0) < requiredSandboxDrain) throw new Error(`platform: Void Platform ${runtime.platformVersion} predates the required sandbox-drain safety protocol. Refusing to upload or activate a runtime that could reopen sandbox creation after drain.`);
 }
 async function claimPlatformDatabaseConnection(client, installationId, ownershipNonce) {
@@ -6544,48 +6139,49 @@ async function claimPlatformDatabaseConnection(client, installationId, ownership
 //#endregion
 //#region src/cli/platform-install-provisioning.ts
 async function provisionInstallationServices(input) {
-	const { plan, now, releaseDatabaseLock, dependencies, secrets, writeRemoteInstallationCheckpoint, checkpointOperation, externalHyperdriveOriginHash, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers } = input;
+	const { state, now, releaseDatabaseLock, dependencies, writeRemoteInstallationCheckpoint, checkpointOperation, externalHyperdriveOriginHash, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers } = input;
+	const { plan, secrets } = state;
 	const routingAction = plan.actions.find((action) => action.key === "routing-kv");
 	if (routingAction.action === "adopt") throw new Error("platform: The routing checkpoint cannot be adopted.");
 	if (routingAction.action === "reuse") {
-		if (!input.manifest.resources.some((resource) => resource.key === routingAction.key) && routingAction.id) {
-			input.manifest = recordResource(input.manifest, routingAction, routingAction.id, "created", now());
-			writeInstallationManifest(input.manifest);
+		if (!state.manifest.resources.some((resource) => resource.key === routingAction.key) && routingAction.id) {
+			state.manifest = recordResource(state.manifest, routingAction, routingAction.id, "created", now());
+			writeInstallationManifest(state.manifest);
 		}
 	} else {
-		input.manifest = recordProvisionIntent(input.manifest, routingAction, now());
-		writeInstallationManifest(input.manifest);
-		await releaseDatabaseLock.checkpoint?.(input.manifest);
+		state.manifest = recordProvisionIntent(state.manifest, routingAction, now());
+		writeInstallationManifest(state.manifest);
+		await releaseDatabaseLock.checkpoint?.(state.manifest);
 		const routing = await createResource(dependencies.client, plan, routingAction, secrets.databaseUrl, "");
-		input.manifest = recordResource(input.manifest, routingAction, routing.id, "created", now());
-		writeInstallationManifest(input.manifest);
+		state.manifest = recordResource(state.manifest, routingAction, routing.id, "created", now());
+		writeInstallationManifest(state.manifest);
 	}
-	await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+	await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 	const zoneAction = plan.actions.find((action) => action.key === "zone");
 	let zone = plan.zone;
 	if (zoneAction) {
 		if (zoneAction.action === "create") {
-			input.manifest = recordProvisionIntent(input.manifest, zoneAction, now());
-			writeInstallationManifest(input.manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+			state.manifest = recordProvisionIntent(state.manifest, zoneAction, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 			zone = await dependencies.client.createZone(plan.account.id, zoneAction.name);
 		}
 		if (!zone) throw new Error("platform: Cloudflare did not return the platform zone.");
 		if (zoneAction.action === "adopt") {
-			input.manifest = recordAdoptionIntent(input.manifest, zoneAction, zone.id, now());
-			writeInstallationManifest(input.manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+			state.manifest = recordAdoptionIntent(state.manifest, zoneAction, zone.id, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 		}
-		input.manifest = recordResource(input.manifest, zoneAction, zone.id, zoneAction.action === "adopt" ? "adopted" : zoneAction.action === "create" || hasProvisionIntent(input.manifest, zoneAction) ? "created" : void 0, now());
-		writeInstallationManifest(input.manifest);
-		await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+		state.manifest = recordResource(state.manifest, zoneAction, zone.id, zoneAction.action === "adopt" ? "adopted" : zoneAction.action === "create" || hasProvisionIntent(state.manifest, zoneAction) ? "created" : void 0, now());
+		writeInstallationManifest(state.manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 		if (zone.status !== "active") {
-			input.manifest = transitionInstallation(input.manifest, "waiting-for-dns", now());
+			state.manifest = transitionInstallation(state.manifest, "waiting-for-dns", now());
 			await checkpointOperation("waiting-for-dns");
-			writeInstallationManifest(input.manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 			return {
-				manifest: input.manifest,
+				manifest: state.manifest,
 				waitingForDns: true,
 				waitingForSandboxDrain: false,
 				zoneNameServers: zone.nameServers
@@ -6593,47 +6189,47 @@ async function provisionInstallationServices(input) {
 		}
 	}
 	const zoneId = zone?.id ?? "";
-	input.manifest = await reconcilePlatformInstallationResources(input.manifest, plan, secrets, zoneId, externalHyperdriveOriginHash, dependencies, now, writeRemoteInstallationCheckpoint, (next) => {
-		input.manifest = next;
+	state.manifest = await reconcilePlatformInstallationResources(state.manifest, plan, secrets, zoneId, externalHyperdriveOriginHash, dependencies, now, writeRemoteInstallationCheckpoint, (next) => {
+		state.manifest = next;
 	});
 	dependencies.onProgress?.("Verifying uncached authentication database reads");
-	const authenticationDatabase = input.manifest.resources.find((resource) => resource.key === "hyperdrive");
+	const authenticationDatabase = state.manifest.resources.find((resource) => resource.key === "hyperdrive");
 	if (!authenticationDatabase) throw new Error("platform: The authentication database resource is missing.");
 	await verifyPlatformAuthenticationDatabase(dependencies.client, plan.account.id, authenticationDatabase, secrets.databaseUrl);
-	input.manifest = await preparePlatformDatabaseSchema(input.manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, secrets, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, (next) => {
-		input.manifest = next;
+	state.manifest = await preparePlatformDatabaseSchema(state.manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, (next) => {
+		state.manifest = next;
 	});
 	dependencies.onProgress?.("Checking platform safety");
-	const targetSandboxDrainProtocol = runtime.safetyProtocols?.sandboxDrain ?? 0;
+	const targetSandboxDrainProtocol = runtime.safetyProtocols.sandboxDrain;
 	const prepareSandboxDrain = dependencies.prepareSandboxDrain ?? releaseDatabaseLock.prepareSandboxDrain;
 	if (targetSandboxDrainProtocol >= 1 && !prepareSandboxDrain) throw new Error("platform: The PostgreSQL lifecycle lock cannot establish the sandbox-drain safety checkpoint.");
 	const sandboxDrainPreparation = targetSandboxDrainProtocol >= 1 ? await prepareSandboxDrain(targetSandboxDrainProtocol >= 3 ? 3 : targetSandboxDrainProtocol >= 2 ? 2 : 0) : null;
 	if (sandboxDrainPreparation && sandboxDrainPreparation.admissionProtocol < targetSandboxDrainProtocol) throw new Error("platform: The database did not arm the Sandbox admission protocol required by this runtime.");
 	const sandboxDrainState = sandboxDrainPreparation?.state ?? "complete";
-	if (targetSandboxDrainProtocol >= 1 && (input.manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol) {
-		input.manifest = {
-			...input.manifest,
+	if (targetSandboxDrainProtocol >= 1 && (state.manifest.safetyProtocols?.sandboxDrain ?? 0) < targetSandboxDrainProtocol) {
+		state.manifest = {
+			...state.manifest,
 			safetyProtocols: { sandboxDrain: targetSandboxDrainProtocol },
 			updatedAt: now()
 		};
-		writeInstallationManifest(input.manifest);
-		await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
+		writeInstallationManifest(state.manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, plan, state.manifest);
 	}
-	input.manifest = transitionInstallation(input.manifest, "deploying", now());
+	state.manifest = transitionInstallation(state.manifest, "deploying", now());
 	await checkpointOperation("deploying");
-	writeInstallationManifest(input.manifest);
-	const ids = Object.fromEntries(input.manifest.resources.map((resource) => [resource.key, resource.id]));
+	writeInstallationManifest(state.manifest);
+	const ids = Object.fromEntries(state.manifest.resources.map((resource) => [resource.key, resource.id]));
 	const bootstrapStep = "bootstrap-access:v1";
-	if (!input.manifest.steps.some((step) => step.key === bootstrapStep)) {
+	if (!state.manifest.steps.some((step) => step.key === bootstrapStep)) {
 		const routingKv = requireId(ids, "routing-kv");
 		await dependencies.client.putKvValue(plan.account.id, routingKv, "signup:enabled", "true");
 		await dependencies.client.putKvValue(plan.account.id, routingKv, "signup:allowlist", JSON.stringify([]));
-		input.manifest = recordInstallationStep(input.manifest, {
+		state.manifest = recordInstallationStep(state.manifest, {
 			completedAt: now(),
 			key: bootstrapStep,
 			resultHash: hash(secrets.authenticationSetupJson ?? secrets.bootstrapGitHubId)
 		}, now());
-		writeInstallationManifest(input.manifest);
+		writeInstallationManifest(state.manifest);
 	}
 	const entrypoints = Object.fromEntries(Object.entries(runtime.artifacts).map(([key, artifact]) => [key, join(runtimeDirectory, artifact.path)]));
 	return {
@@ -6647,182 +6243,7 @@ async function provisionInstallationServices(input) {
 	};
 }
 //#endregion
-//#region src/cli/platform-install-workers.ts
-async function uploadInstallationWorkers(input) {
-	const { dependencies, requiresStagedCommit, workerSecretUpdateIntent, recoveringUnsafeTraffic, workerActions, workerKeys, workerDeploymentSecrets, plan, zoneId, now, writeRemoteInstallationCheckpoint, configs, previousConfigs, cloudflareApiBaseUrl, workerCutoverGeneration, preserveDisabled, managedRoutes, previousPublicEndpoints, ids, runParallelPinnedPlatformWrangler, runPinnedPlatformWrangler, workerRollbacks } = input;
-	const parallelWorkerUploads = !dependencies.deployWorker && !requiresStagedCommit && !workerSecretUpdateIntent && !recoveringUnsafeTraffic && workerActions.length === workerKeys.length && workerActions.every((action) => action.action === "update");
-	let workerManifestQueue = Promise.resolve();
-	let workerManifestFailed = false;
-	let workerManifestFailure;
-	const checkpointWorkerManifest = (update, safetyRecovery = false) => {
-		if (!parallelWorkerUploads) return update();
-		const result = workerManifestQueue.then(async () => {
-			if (workerManifestFailed && !safetyRecovery) throw workerManifestFailure;
-			try {
-				await update();
-			} catch (error) {
-				workerManifestFailed = true;
-				workerManifestFailure = error;
-				throw error;
-			}
-		});
-		workerManifestQueue = result.then(() => void 0, () => void 0);
-		return result;
-	};
-	let availableUploadSlots = 2;
-	let uploadFailure;
-	const uploadWaiters = [];
-	const acquireUploadSlot = async () => {
-		if (uploadFailure !== void 0) throw uploadFailure;
-		if (availableUploadSlots === 0) await new Promise((resolve, reject) => uploadWaiters.push({
-			resolve,
-			reject
-		}));
-		else availableUploadSlots--;
-		return (failure) => {
-			if (failure !== void 0 && uploadFailure === void 0) {
-				uploadFailure = failure;
-				for (const waiter of uploadWaiters.splice(0)) waiter.reject(failure);
-			}
-			const next = uploadFailure === void 0 ? uploadWaiters.shift() : void 0;
-			if (next) next.resolve();
-			else availableUploadSlots++;
-		};
-	};
-	const workerReady = (parallelWorkerUploads ? workerKeys : []).map(() => {
-		let resolve;
-		let reject;
-		return {
-			promise: new Promise((onResolve, onReject) => {
-				resolve = onResolve;
-				reject = onReject;
-			}),
-			resolve,
-			reject
-		};
-	});
-	const uploadBatch = Promise.all(workerReady.map((ready) => ready.promise)).then(() => ({ error: null }), (error) => ({ error }));
-	const deployOneWorker = async (key, waitForPriorWorker, onReadyForActivation) => {
-		dependencies.onProgress?.(`Deploying the ${key} service`);
-		let workerStepStarted = performance.now();
-		const markWorkerStep = (step) => {
-			if (process.env.VOID_PLATFORM_TIMINGS === "1") process.stderr.write(`[platform timing] worker ${key} ${step} ${(performance.now() - workerStepStarted).toFixed(0)} ms\n`);
-			workerStepStarted = performance.now();
-		};
-		const action = workerActions.find((entry) => entry.key === (key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`));
-		const workerSecrets = platformWorkerSecretPayload(key, workerDeploymentSecrets, plan.account.id, zoneId, action.action !== "create");
-		await checkpointWorkerManifest(async () => {
-			const intended = recordProvisionIntent(input.manifest, action, now());
-			if (intended !== input.manifest) {
-				input.manifest = intended;
-				writeInstallationManifest(input.manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-			}
-		});
-		await dependencies.revalidateBeforeWorkerDeploy(input.manifest, action);
-		markWorkerStep("revalidate");
-		const preservedRoutes = dependencies.deployWorker ? [] : action.action === "create" ? [] : await inventoryUnmanagedPlatformWorkerTraffic(dependencies.client, plan, action.name);
-		markWorkerStep("traffic inventory");
-		const workerConfig = mergePlatformWorkerTrafficConfig(configs[key], preservedRoutes);
-		const previousWorkerConfig = mergePlatformWorkerTrafficConfig(previousConfigs[key], preservedRoutes);
-		const rollback = dependencies.deployWorker ? await dependencies.deployWorker(workerConfig, workerSecrets, previousWorkerConfig) : await deployPlatformWorker(workerConfig, workerSecrets, {
-			apiBaseUrl: cloudflareApiBaseUrl,
-			operatorApiToken: dependencies.operatorApiToken,
-			...parallelWorkerUploads ? {
-				acquireUploadSlot,
-				onReadyForActivation,
-				waitForPriorWorker
-			} : {},
-			...dependencies.client.request ? { readCloudflare: (path) => dependencies.client.request(path) } : {},
-			onStaged: async (previousVersionId, stagedVersionId, previousTriggers) => {
-				await checkpointWorkerManifest(async () => {
-					input.manifest = recordWorkerCutoverStage(input.manifest, workerCutoverGeneration, key, previousVersionId, stagedVersionId, action.name, previousTriggers, now());
-					writeInstallationManifest(input.manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-				});
-			},
-			onTrafficPublished: async () => {
-				if (!dependencies.client.listWorkerDomains || !dependencies.client.listWorkerRoutes) throw new Error("platform: Cloudflare traffic inventory is unavailable.");
-				const [customDomains, routes] = await Promise.all([dependencies.client.listWorkerDomains(plan.account.id), zoneId ? dependencies.client.listWorkerRoutes(zoneId) : Promise.resolve([])]);
-				await checkpointWorkerManifest(async () => {
-					const next = recordPlatformWorkerTraffic(input.manifest, action.name, {
-						customDomains,
-						routes
-					}, now());
-					if (JSON.stringify(next.resources) !== JSON.stringify(input.manifest.resources)) {
-						input.manifest = next;
-						writeInstallationManifest(input.manifest);
-						await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-					}
-				});
-			},
-			onUnsafeTraffic: async () => {
-				await checkpointWorkerManifest(async () => {
-					input.manifest = recordWorkerUnsafeTraffic(input.manifest, workerCutoverGeneration, key, action.name, now());
-					writeInstallationManifest(input.manifest);
-					await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-				}, true);
-			},
-			managedRoutes: preserveDisabled ? [] : managedRoutes.filter((route) => route.script === action.name).map((route) => route.pattern),
-			preservedRoutes,
-			publishCustomDomains: (workerName, origins) => publishPlatformWorkerCustomDomains(dependencies.client, plan.account.id, workerName, origins),
-			publishRoutes: async (workerName, patterns) => {
-				if (!dependencies.client.publishWorkerRoutesSafely) throw new Error("platform: Safe Cloudflare Worker route publication is unavailable.");
-				if (zoneId) await dependencies.client.publishWorkerRoutesSafely(zoneId, workerName, patterns);
-				else if (patterns.length > 0) throw new Error("platform: Cannot publish zone routes in workers.dev mode.");
-			},
-			previousConfig: previousWorkerConfig,
-			previousPublicEndpoints,
-			inspectNewWorker: () => inspectNewPlatformWorker(dependencies.client, plan.account.id, input.manifest, action.key, action.name),
-			removeCustomDomains: async () => {
-				if (!dependencies.client.removeRoutes) throw new Error("platform: Cloudflare route removal is unavailable.");
-				await dependencies.client.removeRoutes(plan.account.id, zoneId, trackedPlatformWorkerTraffic(input.manifest, /* @__PURE__ */ new Set([action.name])));
-			},
-			retainNewWorker: async () => {
-				await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-			},
-			runner: parallelWorkerUploads ? runParallelPinnedPlatformWrangler : runPinnedPlatformWrangler,
-			workerExisted: action.action !== "create"
-		});
-		markWorkerStep("deploy");
-		if (rollback) workerRollbacks.push(rollback);
-		await checkpointWorkerManifest(async () => {
-			const recorded = recordResource(input.manifest, action, action.name, "created", now());
-			if (rollback || dependencies.deployWorker || JSON.stringify(recorded.resources) !== JSON.stringify(input.manifest.resources)) {
-				input.manifest = recorded;
-				writeInstallationManifest(input.manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, input.manifest);
-			}
-		});
-		markWorkerStep("record");
-	};
-	if (parallelWorkerUploads) {
-		const tasks = [];
-		for (const [index, key] of workerKeys.entries()) {
-			const priorWorker = tasks.at(-1);
-			const ready = workerReady[index];
-			const task = deployOneWorker(key, priorWorker ? () => priorWorker : void 0, async () => {
-				ready.resolve();
-				const batch = await uploadBatch;
-				if (batch.error !== null) throw batch.error;
-			});
-			task.then(() => ready.resolve(), (error) => ready.reject(error));
-			tasks.push(task);
-		}
-		const firstFailure = (await Promise.allSettled(tasks)).find((result) => result.status === "rejected");
-		if (firstFailure) throw firstFailure.reason;
-	} else for (const key of workerKeys) await deployOneWorker(key);
-}
-//#endregion
 //#region src/cli/platform-secret-update-authority.ts
-const COMPLETE_WORKER_SECRET_UPDATE_NAMES = [
-	"CF_API_TOKEN",
-	"GITHUB_CLIENT_ID",
-	"GITHUB_CLIENT_SECRET",
-	"R2_ACCESS_KEY_ID",
-	"R2_SECRET_ACCESS_KEY"
-];
-const EMAIL_WORKER_SECRET_UPDATE_NAME = "EMAIL_SIGNING_SECRET";
 /**
 * Prevents a host without the encrypted values for an interrupted credential
 * update from carrying an opaque, possibly partial update into another cutover.
@@ -6860,33 +6281,34 @@ function readLatestWorkerGeneration(manifest) {
 	}));
 }
 function hasCompleteWorkerSecretReplacement(updates, requiresEmailSigningSecret) {
-	return COMPLETE_WORKER_SECRET_UPDATE_NAMES.every((name) => typeof updates[name] === "string" && updates[name] !== "") && (!requiresEmailSigningSecret || typeof updates[EMAIL_WORKER_SECRET_UPDATE_NAME] === "string" && updates[EMAIL_WORKER_SECRET_UPDATE_NAME] !== "");
+	return PLATFORM_WORKER_SECRET_UPDATE_NAMES.every((name) => name === "EMAIL_SIGNING_SECRET" && !requiresEmailSigningSecret || typeof updates[name] === "string" && updates[name] !== "");
 }
 //#endregion
 //#region src/cli/platform-installer.ts
-async function recoverFailedPlatformInstallation(error, manifest, plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, operationStarted, now, writeRemoteInstallationCheckpoint) {
+async function recoverFailedPlatformInstallation(error, state) {
+	const { plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, operationStarted, now, writeRemoteInstallationCheckpoint } = state;
+	let { manifest } = state;
 	let failure = error;
 	const currentWorkerRecoveryIncomplete = error instanceof PlatformWorkerRecoveryIncompleteError;
 	if (workerTrafficGuarded) try {
 		await dependencies.client.putKvValue(plan.account.id, requireId(Object.fromEntries(manifest.resources.map((resource) => [resource.key, resource.id])), "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 	} catch (guardError) {
-		failure = new Error(`platform: ${errorMessage(error)} The installation also failed to retain its routing safety gate: ${errorMessage(guardError)}`, { cause: error });
+		failure = new Error(`platform: ${getErrorMessage(error)} The installation also failed to retain its routing safety gate: ${getErrorMessage(guardError)}`, { cause: error });
 	}
 	if (!workerDeploymentCommitted && workerRollbacks.length > 0 && !(authenticationEnforcementActive && authenticationProtocolTransition)) {
 		const rollbackFailures = [];
 		for (const rollback of workerRollbacks.reverse()) try {
 			await rollback();
 		} catch (rollbackError) {
-			rollbackFailures.push(errorMessage(rollbackError));
+			rollbackFailures.push(getErrorMessage(rollbackError));
 		}
-		workerRollbacks = [];
-		if (rollbackFailures.length > 0 || currentWorkerRecoveryIncomplete) failure = new Error(rollbackFailures.length > 0 ? `platform: ${errorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join("; ")} Inspect the installation before retrying.` : `platform: ${errorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`, { cause: error });
+		if (rollbackFailures.length > 0 || currentWorkerRecoveryIncomplete) failure = new Error(rollbackFailures.length > 0 ? `platform: ${getErrorMessage(error)} Automatic Worker rollback was incomplete: ${rollbackFailures.join("; ")} Inspect the installation before retrying.` : `platform: ${getErrorMessage(error)} The current Worker rollback was incomplete. The cutover remains unresolved and will be recovered on retry.`, { cause: error });
 		else if (workerCutoverGeneration > 0) {
 			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "restored", now());
 			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, previousPublicEndpoints, now());
 			writeInstallationManifest(manifest);
 		}
-	} else if (authenticationEnforcementActive && authenticationProtocolTransition) workerRollbacks = [];
+	}
 	if (manifest.status !== "uninstalled" && (manifest.status !== "failed" || operationStarted)) try {
 		const updatedAt = now();
 		manifest = transitionInstallation(manifest, "failed", updatedAt);
@@ -6906,9 +6328,10 @@ async function recoverFailedPlatformInstallation(error, manifest, plan, dependen
 async function installPlatform(plan, secrets, existing, dependencies) {
 	if (plan.actions.some((action) => action.action === "inspect")) throw new Error("platform: AI Gateway access must be verified before provisioning. Provide AI Gateway: Edit on the runtime token, then retry.");
 	const now = dependencies.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl ?? resolvePinnedApiBaseUrl();
-	const runPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, false, dependencies.operatorApiToken);
-	const runParallelPinnedPlatformWrangler = (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, true, dependencies.operatorApiToken);
+	const cloudflareApiBaseUrl = dependencies.client.apiBaseUrl;
+	const pinnedPlatformWrangler = (parallelWorkerUpload) => (operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, cloudflareApiBaseUrl, parallelWorkerUpload, dependencies.operatorApiToken);
+	const runPinnedPlatformWrangler = pinnedPlatformWrangler(false);
+	const runParallelPinnedPlatformWrangler = pinnedPlatformWrangler(true);
 	const resolvedRuntime = dependencies.runtime ?? resolvePlatformRuntime();
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
@@ -6959,18 +6382,13 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const targetUsageProtocolVersion = runtime.usageProtocolVersion;
 	const sourcePlatformVersion = existing?.platformVersion ?? null;
 	const hadPriorWorkers = existing !== null && (existing.resources.some((resource) => resource.kind === "worker" && resource.state === "ready") || plan.actions.some((action) => action.kind === "worker" && action.action !== "create"));
-	const wasDisabled = existing?.status === "disabled";
 	const preserveDisabled = existing?.desiredState === "disabled";
 	const shouldBootstrapSharedEmail = !preserveDisabled && plan.deployment.capabilities.email && runtime.emailProtocolVersion === 1 && !!plan.deployment.emailSharedZoneId;
 	const previousPublicEndpoints = stablePublicEndpointState(existing);
 	const authenticationProtocolTransition = hadPriorWorkers && existing?.deployment.authentication.configurable !== true && runtime.authenticationProtocolVersion === 1;
-	let workerCutoverGeneration = 0;
-	let workerRollbacks = [];
-	let workerDeploymentCommitted = false;
 	let workerTrafficGuarded = false;
-	let authenticationEnforcementActive = false;
-	let manifest = existing;
-	if (!manifest) {
+	let manifest;
+	if (!existing) {
 		const createdAt = now();
 		manifest = createPlatformInstallationManifest({
 			account: plan.account,
@@ -6982,11 +6400,12 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		});
 		manifest = transitionInstallation(manifest, "planned", now());
 		writeInstallationManifest(manifest);
-	} else if (manifest.status === "uninstalled") throw new Error(`platform: Installation ${manifest.id} has already been uninstalled.`);
+	} else if (existing.status === "uninstalled") throw new Error(`platform: Installation ${existing.id} has already been uninstalled.`);
+	else manifest = existing;
 	const explicitWorkerSecretUpdates = sanitizeWorkerSecretUpdates(secrets.workerSecretUpdates);
 	const hasExplicitWorkerSecretUpdates = Object.keys(explicitWorkerSecretUpdates).length > 0;
 	const resumedWorkerSecretUpdateIntent = secrets.pendingWorkerSecretUpdateIntent && platformWorkerSecretUpdateIntentState(manifest, secrets.pendingWorkerSecretUpdateIntent) === "active" ? secrets.pendingWorkerSecretUpdateIntent : null;
-	let workerSecretUpdateIntent = hasExplicitWorkerSecretUpdates ? {
+	const workerSecretUpdateIntent = hasExplicitWorkerSecretUpdates ? {
 		baselineGeneration: latestPlatformWorkerCutoverGeneration(manifest),
 		generation: null,
 		id: randomUUID(),
@@ -6996,10 +6415,6 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			...explicitWorkerSecretUpdates
 		}
 	} : resumedWorkerSecretUpdateIntent;
-	if (preserveDisabled && manifest.desiredState !== "disabled") {
-		manifest = setInstallationDesiredState(manifest, "disabled", now());
-		writeInstallationManifest(manifest);
-	}
 	assertRequiredPlatformSecrets(plan, manifest, secrets, !!dependencies.prepareAuthentication);
 	if (hyperdriveAction?.action === "create") {
 		parsePostgresConnectionString(secrets.databaseUrl);
@@ -7009,30 +6424,40 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		...secrets,
 		externalHyperdriveJson: JSON.stringify(plan.externalHyperdrive)
 	};
-	const pendingSecrets = secretCheckpoint(secrets, workerSecretUpdateIntent);
-	writePendingInstallationSecrets(manifest, {
+	const state = {
+		manifest,
+		plan,
+		secrets,
+		workerSecretUpdateIntent,
+		workerCutoverGeneration: 0,
+		workerRollbacks: [],
+		workerDeploymentCommitted: false,
+		authenticationEnforcementActive: false
+	};
+	const pendingSecrets = secretCheckpoint(state.secrets, state.workerSecretUpdateIntent);
+	writePendingInstallationSecrets(state.manifest, {
 		...pendingSecrets,
 		databaseClaimState: "claiming"
 	});
 	dependencies.onProgress?.("Preparing the platform database");
 	try {
-		await (dependencies.claimDatabase ?? claimPlatformDatabase)(secrets.databaseUrl, manifest.id, manifest.ownershipNonce);
+		await (dependencies.claimDatabase ?? claimPlatformDatabase)(state.secrets.databaseUrl, state.manifest.id, state.manifest.ownershipNonce);
 	} catch (error) {
-		writePendingInstallationSecrets(manifest, {
+		writePendingInstallationSecrets(state.manifest, {
 			...pendingSecrets,
 			databaseClaimState: "failed"
 		});
 		throw error;
 	}
-	writePendingInstallationSecrets(manifest, {
+	writePendingInstallationSecrets(state.manifest, {
 		...pendingSecrets,
 		databaseClaimState: "claimed"
 	});
 	dependencies.onProgress?.("Acquiring the database lock");
-	const releaseDatabaseLock = await dependencies.acquireDatabaseLifecycleLock(secrets.databaseUrl, manifest.id, manifest.ownershipNonce);
+	const releaseDatabaseLock = await dependencies.acquireDatabaseLifecycleLock(state.secrets.databaseUrl, state.manifest.id, state.manifest.ownershipNonce);
 	const writeRemoteInstallationCheckpoint = (client, checkpointPlan, checkpointManifest) => writeRemoteInstallationCheckpointWithoutDatabase(client, checkpointPlan, checkpointManifest, releaseDatabaseLock);
 	const authoritative = releaseDatabaseLock.authoritativeManifest;
-	if (authoritative && JSON.stringify(authoritative) !== JSON.stringify(manifest)) {
+	if (authoritative && JSON.stringify(authoritative) !== JSON.stringify(state.manifest)) {
 		writeInstallationManifest(authoritative);
 		await releaseDatabaseLock();
 		throw new Error("platform: This installation changed on another host. Local state was refreshed; rerun the command to review a current plan.");
@@ -7040,41 +6465,40 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	try {
 		assertPlatformWorkerSecretUpdateAuthority({
 			explicitUpdates: explicitWorkerSecretUpdates,
-			localIntent: secrets.pendingWorkerSecretUpdateIntent,
-			manifest,
-			requiresEmailSigningSecret: manifest.deployment.capabilities.email || plan.deployment.capabilities.email
+			localIntent: state.secrets.pendingWorkerSecretUpdateIntent,
+			manifest: state.manifest,
+			requiresEmailSigningSecret: state.manifest.deployment.capabilities.email || state.plan.deployment.capabilities.email
 		});
 	} catch (error) {
 		await releaseDatabaseLock();
 		throw error;
 	}
-	if (workerSecretUpdateIntent && !hasExplicitWorkerSecretUpdates && platformWorkerSecretUpdateIntentState(manifest, workerSecretUpdateIntent) !== "active") workerSecretUpdateIntent = null;
 	const checkpointOperation = async (phase) => {
-		if (!manifest?.operation) return;
+		if (!state.manifest.operation) return;
 		const updatedAt = now();
-		manifest = {
-			...manifest,
+		state.manifest = {
+			...state.manifest,
 			operation: {
-				...manifest.operation,
+				...state.manifest.operation,
 				phase,
 				updatedAt
 			},
 			updatedAt
 		};
-		writeInstallationManifest(manifest);
-		await releaseDatabaseLock.checkpoint?.(manifest);
+		writeInstallationManifest(state.manifest);
+		await releaseDatabaseLock.checkpoint?.(state.manifest);
 	};
 	let operationStarted = false;
 	try {
-		assertPlatformRuntimeSafety(runtime, manifest.safetyProtocols, releaseDatabaseLock.requiredSafetyProtocols);
-		if (existing) await dependencies.verifyExistingOwnership?.(manifest, authoritative !== null && authoritative !== void 0);
+		assertPlatformRuntimeSafety(runtime, state.manifest.safetyProtocols, releaseDatabaseLock.requiredSafetyProtocols);
+		if (existing) await dependencies.verifyExistingOwnership?.(state.manifest, authoritative !== null && authoritative !== void 0);
 		const action = dependencies.operation ?? (existing ? "upgrade" : "install");
-		const previousOperation = manifest.operation;
+		const previousOperation = state.manifest.operation;
 		const resuming = previousOperation?.action === action && previousOperation.toVersion === version && previousOperation.runtimeManifestSha256 === resolvedRuntime.manifestSha256 && previousOperation.phase !== "complete";
 		const startedAt = now();
 		operationStarted = true;
-		manifest = {
-			...manifest,
+		state.manifest = {
+			...state.manifest,
 			operation: {
 				id: resuming ? previousOperation.id : randomUUID(),
 				action,
@@ -7089,49 +6513,18 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		};
 		await checkpointOperation("preparing");
 		await prepareInstallationAuthentication({
+			state,
 			releaseDatabaseLock,
-			get authenticationEnforcementActive() {
-				return authenticationEnforcementActive;
-			},
-			set authenticationEnforcementActive(value) {
-				authenticationEnforcementActive = value;
-			},
 			runtime,
-			get plan() {
-				return plan;
-			},
-			set plan(value) {
-				plan = value;
-			},
 			authenticationProtocolTransition,
-			get manifest() {
-				return manifest;
-			},
-			set manifest(value) {
-				manifest = value;
-			},
-			get secrets() {
-				return secrets;
-			},
-			set secrets(value) {
-				secrets = value;
-			},
 			now,
-			dependencies,
-			workerSecretUpdateIntent
+			dependencies
 		});
-		const provisionInstallationServicesResult = await provisionInstallationServices({
-			plan,
-			get manifest() {
-				return manifest;
-			},
-			set manifest(value) {
-				manifest = value;
-			},
+		const provisioned = await provisionInstallationServices({
+			state,
 			now,
 			releaseDatabaseLock,
 			dependencies,
-			secrets,
 			writeRemoteInstallationCheckpoint,
 			checkpointOperation,
 			externalHyperdriveOriginHash,
@@ -7140,55 +6533,49 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			sourcePlatformVersion,
 			hadPriorWorkers
 		});
-		if ("waitingForDns" in provisionInstallationServicesResult) return provisionInstallationServicesResult;
-		const zone = provisionInstallationServicesResult.zone;
-		const zoneId = provisionInstallationServicesResult.zoneId;
-		const targetSandboxDrainProtocol = provisionInstallationServicesResult.targetSandboxDrainProtocol;
-		const prepareSandboxDrain = provisionInstallationServicesResult.prepareSandboxDrain;
-		const sandboxDrainState = provisionInstallationServicesResult.sandboxDrainState;
-		const ids = provisionInstallationServicesResult.ids;
-		const entrypoints = provisionInstallationServicesResult.entrypoints;
-		let interruptedCutover = interruptedWorkerCutover(manifest);
-		if (interruptedCutover && authenticationProtocolTransition && authenticationEnforcementActive) {
-			manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "committed", now());
-			manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, false, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		if ("waitingForDns" in provisioned) return provisioned;
+		const { zone, zoneId, targetSandboxDrainProtocol, prepareSandboxDrain, sandboxDrainState, ids, entrypoints } = provisioned;
+		let interruptedCutover = interruptedWorkerCutover(state.manifest);
+		if (interruptedCutover && authenticationProtocolTransition && state.authenticationEnforcementActive) {
+			state.manifest = recordWorkerCutoverResolution(state.manifest, interruptedCutover.generation, "committed", now());
+			state.manifest = recordWorkerTrafficState(state.manifest, interruptedCutover.generation, false, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
 			interruptedCutover = null;
 		}
 		const recoveringUnsafeTraffic = (interruptedCutover?.unsafeTraffic.size ?? 0) > 0;
-		const createsWorker = plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
+		const createsWorker = state.plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
 		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
-		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1");
+		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || state.manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
 		if (requiresTrafficGuard) {
-			await dependencies.client.putKvValue(plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+			await dependencies.client.putKvValue(state.plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
 			workerTrafficGuarded = true;
 			dependencies.onProgress?.("Application traffic paused for a safe platform cutover");
 		}
 		if (!preserveDisabled) {
-			const trafficGeneration = nextTrafficGeneration(manifest);
-			manifest = recordInstallationStep(manifest, {
+			const trafficGeneration = nextTrafficGeneration(state.manifest);
+			state.manifest = recordInstallationStep(state.manifest, {
 				completedAt: now(),
 				key: `traffic-enabled:${trafficGeneration}`,
 				resultHash: String(trafficGeneration)
 			}, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
 		}
 		const configInput = {
 			authenticationDatabaseUncached: true,
 			proxyHealthBinding: true,
-			accountId: plan.account.id,
-			apiUrl: plan.apiUrl,
-			deployment: plan.deployment,
+			accountId: state.plan.account.id,
+			apiUrl: state.plan.apiUrl,
+			deployment: state.plan.deployment,
 			deploymentExecution: runtime.deploymentExecution,
-			healthProbeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
-			installationId: manifest.id,
-			ownershipNonce: manifest.ownershipNonce,
+			healthProbeToken: createPlatformHealthProbeToken(state.manifest.ownershipNonce),
+			installationId: state.manifest.id,
+			ownershipNonce: state.manifest.ownershipNonce,
 			platformVersion: version,
-			proxyUrl: plan.proxyUrl,
-			emailGatewayUrl: `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev`,
+			proxyUrl: state.plan.proxyUrl,
+			emailGatewayUrl: platformWorkersDevUrl(state.plan, state.plan.deployment.resources.emailGatewayWorker),
 			resources: {
 				hyperdrive: requireId(ids, "hyperdrive"),
 				isrCacheKv: requireId(ids, "isr-cache-kv"),
@@ -7200,8 +6587,8 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			...runtime.assets ? { runtimeApiAssetsDirectory: join(runtimeDirectory, PLATFORM_ADMIN_ASSETS_DIRECTORY) } : {}
 		};
 		const workerDeploymentSecrets = {
-			...secrets,
-			workerSecretUpdates: workerSecretUpdateIntent?.updates ?? {}
+			...state.secrets,
+			workerSecretUpdates: state.workerSecretUpdateIntent?.updates ?? {}
 		};
 		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const enabledConfigs = createPlatformWorkerConfigs({
@@ -7219,80 +6606,86 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			publicEndpoints: previousPublicEndpoints,
 			trafficState: previousPublicEndpoints ? "enabled" : "staging"
 		});
-		const managedRoutes = platformManagedWorkerTraffic(plan.deployment).routes;
-		let workerActions = plan.actions.filter((action) => action.kind === "worker" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
-		({manifest, workerActions} = await recoverInterruptedPlatformWorkerCutover(manifest, interruptedCutover, workerActions, configs, previousConfigs, plan, dependencies, ids, zoneId, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, (next) => {
-			manifest = next;
+		const managedRoutes = platformManagedWorkerTraffic(state.plan.deployment).routes;
+		let workerActions = state.plan.actions.filter((action) => action.kind === "worker" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
+		({manifest: state.manifest, workerActions} = await recoverInterruptedPlatformWorkerCutover({
+			manifest: state.manifest,
+			interruptedCutover,
+			workerActions,
+			configs,
+			previousConfigs,
+			plan: state.plan,
+			dependencies,
+			ids,
+			previousPublicEndpoints,
+			hasEmailGatewayArtifact,
+			runPinnedPlatformWrangler,
+			now,
+			writeRemoteInstallationCheckpoint,
+			onManifestChange: (next) => {
+				state.manifest = next;
+			}
 		}));
-		workerCutoverGeneration = nextWorkerCutoverGeneration(manifest);
-		if (workerSecretUpdateIntent) {
-			manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "pending", workerSecretUpdateIntent.id, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			workerSecretUpdateIntent = {
-				...workerSecretUpdateIntent,
-				generation: workerCutoverGeneration
+		state.workerCutoverGeneration = nextWorkerCutoverGeneration(state.manifest);
+		if (state.workerSecretUpdateIntent) {
+			state.manifest = recordWorkerSecretUpdateState(state.manifest, state.workerCutoverGeneration, "pending", state.workerSecretUpdateIntent.id, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+			state.workerSecretUpdateIntent = {
+				...state.workerSecretUpdateIntent,
+				generation: state.workerCutoverGeneration
 			};
-			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+			writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets, state.workerSecretUpdateIntent));
 		}
 		await uploadInstallationWorkers({
+			state,
 			dependencies,
 			requiresStagedCommit,
-			workerSecretUpdateIntent,
 			recoveringUnsafeTraffic,
 			workerActions,
 			workerKeys,
 			workerDeploymentSecrets,
-			plan,
 			zoneId,
-			get manifest() {
-				return manifest;
-			},
-			set manifest(value) {
-				manifest = value;
-			},
 			now,
 			writeRemoteInstallationCheckpoint,
 			configs,
 			previousConfigs,
 			cloudflareApiBaseUrl,
-			workerCutoverGeneration,
 			preserveDisabled,
 			managedRoutes,
 			previousPublicEndpoints,
 			ids,
 			runParallelPinnedPlatformWrangler,
-			runPinnedPlatformWrangler,
-			workerRollbacks
+			runPinnedPlatformWrangler
 		});
-		manifest = setInstallationEndpoints(manifest, {
-			apiUrl: plan.apiUrl,
-			dashboardUrl: platformDashboardUrl(plan.deployment),
-			proxyUrl: plan.proxyUrl
+		state.manifest = setInstallationEndpoints(state.manifest, {
+			apiUrl: state.plan.apiUrl,
+			dashboardUrl: platformDashboardUrl(state.plan.deployment),
+			proxyUrl: state.plan.proxyUrl
 		}, now());
 		if (preserveDisabled) {
-			workerDeploymentCommitted = true;
-			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
-			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-			if (workerSecretUpdateIntent) manifest = recordWorkerSecretUpdateState(manifest, workerCutoverGeneration, "committed", workerSecretUpdateIntent.id, now());
-			manifest = {
-				...manifest,
-				deployment: plan.deployment,
+			state.workerDeploymentCommitted = true;
+			state.manifest = recordWorkerCutoverResolution(state.manifest, state.workerCutoverGeneration, "committed", now());
+			state.manifest = recordWorkerTrafficState(state.manifest, state.workerCutoverGeneration, false, now());
+			if (state.workerSecretUpdateIntent) state.manifest = recordWorkerSecretUpdateState(state.manifest, state.workerCutoverGeneration, "committed", state.workerSecretUpdateIntent.id, now());
+			state.manifest = {
+				...state.manifest,
+				deployment: state.plan.deployment,
 				deploymentExecution: runtime.deploymentExecution,
 				platformVersion: version,
 				runtime: runtimeProvenance,
 				updatedAt: now(),
 				usageProtocolVersion: targetUsageProtocolVersion
 			};
-			manifest = transitionInstallation(manifest, "disabled", now());
+			state.manifest = transitionInstallation(state.manifest, "disabled", now());
 			await checkpointOperation("complete");
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			writePendingInstallationSecrets(manifest, secretCheckpoint(secrets));
-			promoteInstallationSecrets(manifest);
-			saveInstalledPlatformConnection(plan, manifest);
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+			writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets));
+			promoteInstallationSecrets(state.manifest);
+			saveInstalledPlatformConnection(state.plan, state.manifest);
 			return {
-				manifest,
+				manifest: state.manifest,
 				waitingForDns: false,
 				waitingForSandboxDrain: false,
 				zoneNameServers: zone?.nameServers ?? []
@@ -7300,113 +6693,113 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		}
 		let authenticationCutoverCommitted = false;
 		if (authenticationProtocolTransition && requiresStagedCommit) {
-			manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
-			manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-			workerRollbacks = [];
+			state.manifest = recordWorkerCutoverResolution(state.manifest, state.workerCutoverGeneration, "committed", now());
+			state.manifest = recordWorkerTrafficState(state.manifest, state.workerCutoverGeneration, false, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+			state.workerRollbacks = [];
 			authenticationCutoverCommitted = true;
 		}
-		let authenticationStep = secrets.authenticationSetupJson ? "authentication-initialized:v1:" + hash(secrets.authenticationSetupJson) : "";
+		let authenticationStep = state.secrets.authenticationSetupJson ? "authentication-initialized:v1:" + hash(state.secrets.authenticationSetupJson) : "";
 		let setupPending = false;
-		manifest = transitionInstallation(manifest, "verifying", now());
+		state.manifest = transitionInstallation(state.manifest, "verifying", now());
 		await checkpointOperation("verifying");
-		writeInstallationManifest(manifest);
-		if (plan.deployment.authentication.configurable && authenticationStep) {
-			if (!secrets.authenticationSetupJson || !secrets.authSetupToken) throw new Error("platform: Restore the encrypted authentication setup checkpoint before resuming.");
+		writeInstallationManifest(state.manifest);
+		if (state.plan.deployment.authentication.configurable && authenticationStep) {
+			if (!state.secrets.authenticationSetupJson || !state.secrets.authSetupToken) throw new Error("platform: Restore the encrypted authentication setup checkpoint before resuming.");
 			dependencies.onProgress?.("Initializing platform authentication");
 			if ((await resumeInstalledPlatformAuthentication({
-				apiUrl: plan.apiUrl,
-				installationId: manifest.id,
-				setupToken: secrets.authSetupToken,
-				setupJson: secrets.authenticationSetupJson,
+				apiUrl: state.plan.apiUrl,
+				installationId: state.manifest.id,
+				setupToken: state.secrets.authSetupToken,
+				setupJson: state.secrets.authenticationSetupJson,
 				checkpoint: (replacement) => {
-					secrets = {
-						...secrets,
+					state.secrets = {
+						...state.secrets,
 						...replacement
 					};
 					authenticationStep = "authentication-initialized:v1:" + hash(replacement.authenticationSetupJson);
-					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+					writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets, state.workerSecretUpdateIntent));
 				}
 			}, dependencies.initializeAuthentication ?? initializeInstalledPlatformAuthentication)).setupPending) {
 				setupPending = true;
-				dependencies.onProgress?.(`Administrator setup pending: ${plan.apiUrl}/setup`);
+				dependencies.onProgress?.(`Administrator setup pending: ${state.plan.apiUrl}/setup`);
 			}
-			manifest = recordInstallationStep(manifest, {
+			state.manifest = recordInstallationStep(state.manifest, {
 				key: authenticationStep,
 				completedAt: now(),
-				resultHash: hash(secrets.authenticationSetupJson)
+				resultHash: hash(state.secrets.authenticationSetupJson)
 			}, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
 		}
-		if (plan.deployment.appAccess && !manifest.steps.some((step) => step.key === "app-access-initialized:v1")) {
+		if (state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1")) {
 			dependencies.onProgress?.("Configuring and verifying deployed-app access");
 			try {
 				await (dependencies.initializeAppAccess ?? initializeInstalledAppAccess)({
-					apiUrl: plan.apiUrl,
-					installationId: manifest.id,
-					probeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
-					setupJson: secrets.appAccessSetupJson,
-					setupToken: secrets.appAccessSetupToken
+					apiUrl: state.plan.apiUrl,
+					installationId: state.manifest.id,
+					probeToken: createPlatformHealthProbeToken(state.manifest.ownershipNonce),
+					setupJson: state.secrets.appAccessSetupJson,
+					setupToken: state.secrets.appAccessSetupToken
 				});
 			} catch (error) {
 				if (error instanceof PlatformAppAccessCredentialError) {
-					secrets = {
-						...secrets,
+					state.secrets = {
+						...state.secrets,
 						authenticationPreparation: {
-							...secrets.authenticationPreparation,
+							...state.secrets.authenticationPreparation,
 							appAccessTokenRejected: "true"
 						}
 					};
-					writePendingInstallationSecrets(manifest, secretCheckpoint(secrets, workerSecretUpdateIntent));
+					writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets, state.workerSecretUpdateIntent));
 				}
 				throw error;
 			}
-			manifest = recordInstallationStep(manifest, {
+			state.manifest = recordInstallationStep(state.manifest, {
 				key: "app-access-initialized:v1",
 				completedAt: now(),
-				resultHash: hash(secrets.appAccessSetupJson)
+				resultHash: hash(state.secrets.appAccessSetupJson)
 			}, now());
-			writeInstallationManifest(manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
 		}
 		dependencies.onProgress?.("Verifying platform health");
-		const emailGatewayUrl = hasEmailGatewayArtifact && plan.deployment.capabilities.email ? `https://${plan.deployment.resources.emailGatewayWorker}.${plan.workersSubdomain}.workers.dev` : void 0;
-		if (plan.deployment.authentication.accessProtection) {
-			ensurePlatformAccessToken(plan.apiUrl, false, true);
-			ensurePlatformAccessToken(plan.proxyUrl, false, true);
+		const emailGatewayUrl = hasEmailGatewayArtifact && state.plan.deployment.capabilities.email ? platformWorkersDevUrl(state.plan, state.plan.deployment.resources.emailGatewayWorker) : void 0;
+		if (state.plan.deployment.authentication.accessProtection) {
+			ensurePlatformAccessToken(state.plan.apiUrl, false, true);
+			ensurePlatformAccessToken(state.plan.proxyUrl, false, true);
 		}
 		const healthCheckContext = {
-			accountName: plan.account.name,
-			...plan.deployment.authentication.accessProtection ? { accessProtected: true } : {},
+			accountName: state.plan.account.name,
+			...state.plan.deployment.authentication.accessProtection ? { accessProtected: true } : {},
 			workers: [
-				plan.deployment.resources.apiWorker,
-				plan.deployment.resources.proxyWorker,
-				...emailGatewayUrl ? [plan.deployment.resources.emailGatewayWorker] : [],
-				plan.deployment.resources.dispatchWorker
+				state.plan.deployment.resources.apiWorker,
+				state.plan.deployment.resources.proxyWorker,
+				...emailGatewayUrl ? [state.plan.deployment.resources.emailGatewayWorker] : [],
+				state.plan.deployment.resources.dispatchWorker
 			],
 			resumeCommand: dependencies.healthCheckResumeCommand,
 			...emailGatewayUrl ? { emailGatewayUrl } : {}
 		};
-		await (dependencies.verifyHealth ?? verifyPlatformHealth)(plan.apiUrl, manifest.id, plan.proxyUrl, plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(manifest.ownershipNonce), void 0, !plan.deployment.application.zoneName ? `https://${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev` : void 0, healthCheckContext);
+		await (dependencies.verifyHealth ?? verifyPlatformHealth)(state.plan.apiUrl, state.manifest.id, state.plan.proxyUrl, state.plan.deployment.application.baseDomain, version, targetUsageProtocolVersion, createPlatformHealthProbeToken(state.manifest.ownershipNonce), void 0, !state.plan.deployment.application.zoneName ? platformWorkersDevUrl(state.plan, state.plan.deployment.resources.dispatchWorker) : void 0, healthCheckContext);
 		if (requiresSandboxDrain) {
-			if (!await (dependencies.verifySandboxDrain ?? verifyPlatformSandboxDrain)(plan.apiUrl, createPlatformHealthProbeToken(manifest.ownershipNonce))) {
-				manifest = recordWorkerCutoverResolution(manifest, workerCutoverGeneration, "committed", now());
-				manifest = recordWorkerTrafficState(manifest, workerCutoverGeneration, false, now());
-				manifest = recordInstallationStep(manifest, {
+			if (!await (dependencies.verifySandboxDrain ?? verifyPlatformSandboxDrain)(state.plan.apiUrl, createPlatformHealthProbeToken(state.manifest.ownershipNonce))) {
+				state.manifest = recordWorkerCutoverResolution(state.manifest, state.workerCutoverGeneration, "committed", now());
+				state.manifest = recordWorkerTrafficState(state.manifest, state.workerCutoverGeneration, false, now());
+				state.manifest = recordInstallationStep(state.manifest, {
 					completedAt: now(),
 					key: "sandbox-drain:maintenance-runtime:v1",
 					resultHash: resolvedRuntime.manifestSha256
 				}, now());
 				await checkpointOperation("waiting-for-sandbox-drain");
-				writeInstallationManifest(manifest);
-				await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
-				workerRollbacks = [];
-				workerDeploymentCommitted = true;
-				saveInstalledPlatformConnection(plan, manifest);
+				writeInstallationManifest(state.manifest);
+				await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+				state.workerRollbacks = [];
+				state.workerDeploymentCommitted = true;
+				saveInstalledPlatformConnection(state.plan, state.manifest);
 				return {
-					manifest,
+					manifest: state.manifest,
 					waitingForDns: false,
 					waitingForSandboxDrain: true,
 					zoneNameServers: zone?.nameServers ?? []
@@ -7415,38 +6808,13 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			if ((await prepareSandboxDrain()).state !== "complete") throw new Error("platform: Sandbox drain completion changed while it was being verified. Traffic remains disabled.");
 		}
 		const emailOperationId = (await enableInstallationServices({
+			state,
 			checkpointOperation,
 			requiresStagedCommit,
 			authenticationCutoverCommitted,
-			get manifest() {
-				return manifest;
-			},
-			set manifest(value) {
-				manifest = value;
-			},
-			get workerCutoverGeneration() {
-				return workerCutoverGeneration;
-			},
-			set workerCutoverGeneration(value) {
-				workerCutoverGeneration = value;
-			},
 			now,
 			writeRemoteInstallationCheckpoint,
 			dependencies,
-			plan,
-			get workerRollbacks() {
-				return workerRollbacks;
-			},
-			set workerRollbacks(value) {
-				workerRollbacks = value;
-			},
-			get workerSecretUpdateIntent() {
-				return workerSecretUpdateIntent;
-			},
-			set workerSecretUpdateIntent(value) {
-				workerSecretUpdateIntent = value;
-			},
-			secrets,
 			workerKeys,
 			workerActions,
 			workerDeploymentSecrets,
@@ -7458,15 +6826,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			ids,
 			runPinnedPlatformWrangler,
 			shouldBootstrapSharedEmail,
-			get workerDeploymentCommitted() {
-				return workerDeploymentCommitted;
-			},
-			set workerDeploymentCommitted(value) {
-				workerDeploymentCommitted = value;
-			},
 			releaseDatabaseLock,
-			wasDisabled,
-			previousPublicEndpoints,
 			version,
 			targetUsageProtocolVersion,
 			healthCheckContext,
@@ -7474,14 +6834,14 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			runtimeProvenance
 		})).emailOperationId;
 		await checkpointOperation("complete");
-		writeInstallationManifest(manifest);
-		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
+		writeInstallationManifest(state.manifest);
+		await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
 		workerTrafficGuarded = false;
-		writePendingInstallationSecrets(manifest, secretCheckpoint(secrets));
-		promoteInstallationSecrets(manifest);
-		saveInstalledPlatformConnection(plan, manifest);
+		writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets));
+		promoteInstallationSecrets(state.manifest);
+		saveInstalledPlatformConnection(state.plan, state.manifest);
 		return {
-			manifest,
+			manifest: state.manifest,
 			...emailOperationId ? { emailOperationId } : {},
 			setupPending,
 			waitingForDns: false,
@@ -7489,13 +6849,25 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			zoneNameServers: zone?.nameServers ?? []
 		};
 	} catch (error) {
-		throw await recoverFailedPlatformInstallation(error, manifest, plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, operationStarted, now, writeRemoteInstallationCheckpoint);
+		throw await recoverFailedPlatformInstallation(error, {
+			...state,
+			dependencies,
+			workerTrafficGuarded,
+			authenticationProtocolTransition,
+			previousPublicEndpoints,
+			operationStarted,
+			now,
+			writeRemoteInstallationCheckpoint
+		});
 	} finally {
 		await releaseDatabaseLock();
 	}
 }
 //#endregion
 //#region src/cli/platform-install-auth.ts
+function defaultConnectionId(kind) {
+	return kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind;
+}
 function platformManagementAccessForAuthentication(selection, accountId, checkpoint) {
 	if (!selection.authentication.accessProtection && (!selection.authentication.providers.includes("cloudflare-access") || selection.file && !selection.file.cloudflareAccess)) return;
 	const spec = selection.file?.cloudflareAccess ?? (checkpoint?.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(checkpoint.accessSetupSpecJson)) : void 0);
@@ -7528,7 +6900,6 @@ async function selectInstallationAuthentication(file, recorded, choices = {}) {
 		if (choices.loginMethods && JSON.stringify(choices.loginMethods) !== JSON.stringify(recorded.providers) || choices.accessProtection !== void 0 && choices.accessProtection !== !!recorded.accessProtection) throw new Error("platform: Resume with the recorded login methods and protection settings.");
 		return { authentication: recorded };
 	}
-	if (!process.stdin.isTTY && !choices.loginMethods && choices.accessProtection === void 0) return { authentication: { providers: ["github"] } };
 	const providers = choices.loginMethods ?? (!process.stdin.isTTY ? ["github"] : platformPromptAnswer(await multiselect({
 		message: "Platform login methods (select all that apply):",
 		initialValues: [],
@@ -7583,7 +6954,7 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	const entries = selection.file?.connections ?? selection.authentication.providers.map((kind) => ({
 		configuration: {
 			kind,
-			id: kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind,
+			id: defaultConnectionId(kind),
 			label: kind === "github" ? "GitHub" : kind === "google" ? "Google" : kind === "oidc" ? "Company SSO" : "Cloudflare Access"
 		},
 		clientSecretEnv: void 0
@@ -7606,11 +6977,11 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 		save,
 		yes: access.yes
 	}) : void 0;
-	console.log(`Login callback URL: ${plan.apiUrl}/auth/callback`);
+	console.log(`Login callback URL: ${formatUrl(`${plan.apiUrl}/auth/callback`)}`);
 	for (const entry of entries) {
 		const config = { ...entry.configuration };
 		const kind = config.kind;
-		if (!config.id) config.id = kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind;
+		if (!config.id) config.id = defaultConnectionId(kind);
 		if (prepared?.login && prepared.login.configuration.id === config.id) {
 			const connection = prepared.login;
 			save({ [`authenticationConnection:${connection.configuration.id}`]: JSON.stringify(connection) });
@@ -7769,17 +7140,7 @@ function savePlatformInstallChoices(arguments_, accountName, directory = platfor
 		recursive: true,
 		mode: 448
 	});
-	const path = join(directory, `plan-${plan.id}.json`);
-	const temporary = `${path}.${randomUUID()}.tmp`;
-	try {
-		writeFileSync(temporary, JSON.stringify(record, null, 2) + "\n", {
-			mode: 384,
-			flag: "wx"
-		});
-		renameSync(temporary, path);
-	} finally {
-		rmSync(temporary, { force: true });
-	}
+	writeFileAtomic(join(directory, `plan-${plan.id}.json`), JSON.stringify(record, null, 2) + "\n", 384);
 	return plan;
 }
 function listSavedPlatformInstallPlans(directory = platformRegistryDirectory()) {
@@ -7854,12 +7215,6 @@ function completePlatformSetupDraft(manifest) {
 	return completed;
 }
 //#endregion
-//#region src/cli/prompt-password.ts
-/** A visual example for an empty secret field; never a default value or unmasked input. */
-function passwordWithPlaceholder(options) {
-	return password(options);
-}
-//#endregion
 //#region src/cli/platform-lifecycle.ts
 function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 	const explicit = process.env.VOID_PLATFORM_DATABASE_URL || process.env.DATABASE_URL || "";
@@ -7876,14 +7231,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-p0kobLV8.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-zLXnW1G_.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-PvNS9Nl2.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-DeucI7A9.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7894,7 +7249,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-oi-SvI3f.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-CYrLvTGH.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -8067,7 +7422,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-oi-SvI3f.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CYrLvTGH.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8123,7 +7478,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			});
 			if (isCancel(choice)) throw new Error("platform: Cancelled.");
 			if (choice === "setup") {
-				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: https://developers.cloudflare.com/hyperdrive/get-started/`, import_picocolors.default.bold("Set up Hyperdrive first"));
+				note(`Create a Hyperdrive in account ${accountId} with any unused name${suggestedNameAvailable ? ` such as ${suggestedName}` : ""}. Point it at the same dedicated PostgreSQL database you will give Void, use a runtime database user, and disable SQL result caching. If your organization manages Hyperdrive, ask its administrator to create it. Then rerun this command and select it from the list.\nSetup: ${formatUrl("https://developers.cloudflare.com/hyperdrive/get-started/")}`, import_picocolors.default.bold("Set up Hyperdrive first"));
 				outro("No Cloudflare or local installation state was changed.");
 				return;
 			}
@@ -8472,7 +7827,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-oi-SvI3f.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CYrLvTGH.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8496,11 +7851,11 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			outro(`Installation ${result.manifest.id} is safely checkpointed.`);
 			return;
 		}
-		log.info(`API URL: ${plan.apiUrl}`);
+		log.info(`API URL: ${formatUrl(plan.apiUrl)}`);
 		if (result.emailOperationId) log.info(`Shared email routing ready. Operation: ${result.emailOperationId}.`);
 		const completedAuthCode = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
 		if (result.setupPending && completedAuthCode) {
-			log.info(`First administrator setup: ${plan.apiUrl}/setup`);
+			log.info(`First administrator setup: ${formatUrl(`${plan.apiUrl}/setup`)}`);
 			console.log(`One-time administrator setup code: ${completedAuthCode}`);
 			log.info("Confirm your identity in the browser, then test and enable any additional login methods in Settings.");
 		}
@@ -8542,7 +7897,7 @@ async function verifyPlatformAiGatewayPlan(client, input, existing, preview, aut
 			deploymentExecution: preview.actions.some((entry) => entry.key === "deployment-queue")
 		});
 	} catch (error) {
-		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403) && error.requestPath?.includes("/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
+		if (isPlatformTokenAuthorizationError(error, "/ai-gateway/")) throw new Error("platform: The runtime token could not verify AI Gateway access. Include Account → AI Gateway → Edit for this account, then retry. No platform resources were created.", { cause: error });
 		throw error;
 	}
 	assertPlatformInstallPlanUnchanged(preview, verified, "AI Gateway access");
@@ -8613,10 +7968,10 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 		message,
 		validate: (input) => input ? validate?.(input) : "A value is required."
 	};
-	const value = masked ? placeholder ? await passwordWithPlaceholder({
+	const value = masked ? await password({
 		...options,
 		placeholder
-	}) : await password(options) : await text$1({
+	}) : await text$1({
 		...options,
 		placeholder
 	});
@@ -8624,4 +7979,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { resolveBootstrapGitHubId as A, assertPlatformOperatorCredentialCanApplyPlan as B, purgeResourcesKeptReason as C, loadPlatformRuntime as D, runPurgeResourcesTeardown as E, formatPlatformInstallPlan as F, preparePlatformAccessSetup as G, verifyPlatformCloudflareCredential as H, platformAdoptionIntentHash as I, hyperdriveOriginFromConnectionString as J, PlatformCloudflareClient as K, platformProvisionIntentHash as L, recordPlatformWorkerTraffic as M, trackedPlatformWorkerTraffic as N, createPlatformHealthProbeToken as O, createPlatformInstallPlan as P, revalidatePlatformInstallAction as R, purgeResourcesHandlesEmailRouting as S, purgeResourcesPermissions as T, checkpointPlatformAccessResources as U, resolvePlatformCloudflareCredential as V, parsePlatformAccessSetupSpec as W, verifyPlatformRuntimeTokenPermissions as X, hyperdriveOriginMatches as Y, describePurgeResourcesPlan as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, isPurgedAccessResource as b, acquirePlatformDatabaseLifecycleLockConnection as c, readPlatformProjectZeroTrustState as d, assertProjectZeroTrustAllowsUninstall as f, checkPurgeResourcesCredentials as g, assertNoPlatformProjects as h, verifyPlatformAiGatewayPlan as i, recordResource as j, createPlatformInstallationSecrets as k, platformDatabaseClientUrl as l, PlatformResourceChangedError as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, PURGE_RESOURCES_STEP_PREFIX as p, hyperdriveOriginConfigHash as q, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectSlugs as u, isPlatformTailWorker as v, purgeResourcesKeptResources as w, purgeResourcesAlwaysKept as x, isPurgeResourcesCandidate as y, platformDatabaseNameFromOwnerUrl as z };
+export { revalidatePlatformInstallAction as A, hyperdriveOriginConfigHash as B, formatPlatformInstallPlan as C, platformAdoptionIntentHash as D, matchesRecordedR2Fingerprint as E, checkpointPlatformAccessResources as F, hyperdriveOriginMatches as H, parsePlatformAccessSetupSpec as I, preparePlatformAccessSetup as L, assertPlatformOperatorCredentialCanApplyPlan as M, resolvePlatformCloudflareCredential as N, r2BucketConfigHash as O, verifyPlatformCloudflareCredential as P, PlatformCloudflareApiError as R, dnsRecordConfigHash as S, legacyResourceConfigHash as T, verifyPlatformRuntimeTokenPermissions as U, hyperdriveOriginFromConnectionString as V, resolveBootstrapGitHubId as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, recordPlatformWorkerTraffic as b, acquirePlatformDatabaseLifecycleLockConnection as c, readPlatformProjectZeroTrustState as d, assertProjectZeroTrustAllowsUninstall as f, createPlatformInstallationSecrets as g, createPlatformHealthProbeToken as h, verifyPlatformAiGatewayPlan as i, platformDatabaseNameFromOwnerUrl as j, resourceMarkerProblem as k, platformDatabaseClientUrl as l, loadPlatformRuntime as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, readPlatformDatabase as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectSlugs as u, recordResource as v, hasProvisionIntentStep as w, createPlatformInstallPlan as x, platformTrafficAttachmentWorker as y, PlatformCloudflareClient as z };