void 0.27.0 → 1.0.3

package/dist/{platform-management-CuuVDhyt.mjs → platform-management-DhEFdQAf.mjs}

@@ -1,9 +1,597 @@
-import { _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-Cjv2Qf0r.mjs";
-import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess, l as import_picocolors, r as createSpinner, u as note } from "./output-C50ag2r3.mjs";
-import { A as resolveBootstrapGitHubId, B as assertPlatformOperatorCredentialCanApplyPlan, C as purgeResourcesKeptReason, D as loadPlatformRuntime, E as runPurgeResourcesTeardown, F as formatPlatformInstallPlan, H as verifyPlatformCloudflareCredential, I as platformAdoptionIntentHash, J as hyperdriveOriginFromConnectionString, K as PlatformCloudflareClient, L as platformProvisionIntentHash, N as trackedPlatformWorkerTraffic, P as createPlatformInstallPlan, R as revalidatePlatformInstallAction, S as purgeResourcesHandlesEmailRouting, T as purgeResourcesPermissions, V as resolvePlatformCloudflareCredential, X as verifyPlatformRuntimeTokenPermissions, Y as hyperdriveOriginMatches, _ as describePurgeResourcesPlan, a as REMOTE_INSTALLATION_MANIFEST_KEY, b as isPurgedAccessResource, d as readPlatformProjectZeroTrustState, f as assertProjectZeroTrustAllowsUninstall, g as checkPurgeResourcesCredentials, h as assertNoPlatformProjects, k as createPlatformInstallationSecrets, m as PlatformResourceChangedError, n as resolvePlatformInstallDatabaseUrl, o as installPlatform, q as hyperdriveOriginConfigHash, s as acquirePlatformDatabaseLifecycleLock, t as assertNoninteractivePlatformMutationAcknowledged, u as readPlatformProjectSlugs, v as isPlatformTailWorker, w as purgeResourcesKeptResources, x as purgeResourcesAlwaysKept, y as isPurgeResourcesCandidate, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-DzCwqhFq.mjs";
-import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, createPlatformResourceOwnershipMarker, parsePlatformInstallationManifest, parsePlatformResourceOwnershipMarker, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
-import { createHash } from "node:crypto";
+import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-Ba6ZbrzY.mjs";
+import { A as matchesRecordedR2Fingerprint, B as activatePlatformAccessCredentials, C as platformTrafficAttachmentWorker, D as formatPlatformInstallPlan, E as dnsRecordConfigHash, F as platformDatabaseNameFromOwnerUrl, G as PlatformCloudflareClient, I as turnOffInstalledProjectZeroTrust, J as hyperdriveOriginMatches, K as hyperdriveOriginConfigHash, L as assertPlatformOperatorCredentialCanApplyPlan, M as r2BucketConfigHash, N as resourceMarkerProblem, O as hasProvisionIntentStep, P as revalidatePlatformInstallAction, R as resolvePlatformCloudflareCredential, T as createPlatformInstallPlan, W as PlatformCloudflareApiError, Y as verifyPlatformRuntimeTokenPermissions, _ as readPlatformDatabase, a as authenticationSetupRequestHash, b as createPlatformInstallationSecrets, c as REMOTE_INSTALLATION_MANIFEST_KEY, g as formatZeroTrustApplications, h as assertProjectZeroTrustAllowsUninstall, j as platformAdoptionIntentHash, k as legacyResourceConfigHash, l as installPlatform, m as readPlatformProjectZeroTrustState, n as resolvePlatformInstallDatabaseUrl, o as readLoginReplacementFile, p as readPlatformProjectSlugs, q as hyperdriveOriginFromConnectionString, s as replacePendingInstallationAuthentication, t as assertNoninteractivePlatformMutationAcknowledged, u as acquirePlatformDatabaseLifecycleLock, v as loadPlatformRuntime, x as resolveBootstrapGitHubId, y as createPlatformHealthProbeToken, z as verifyPlatformCloudflareCredential } from "./platform-lifecycle-DBiS0cJd.mjs";
+import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
+import { setTimeout } from "node:timers/promises";
+//#region src/cli/platform-teardown.ts
+/**
+* `void platform uninstall --purge-resources` deletes every Cloudflare resource the
+* installation created, in an order Cloudflare accepts:
+*
+*   traffic (routes, custom domains, DNS) -> Access -> Email Routing rules
+*   -> queue consumers -> Workers except tail -> Queues -> dispatch namespace
+*   -> tail Worker -> Hyperdrive and KV -> R2 -> AI Gateway -> routing KV (last)
+*
+* Each resource is proven to belong to this installation right before its
+* DELETE, and Cloudflare refuses a resource that something outside the
+* installation still uses. The only forced DELETE is for a platform Worker
+* that Cloudflare refused while every Worker it names as a dependent is one
+* this installation created: the API and proxy Workers bind to each other, so
+* neither can go first without it. A route, custom domain, DNS
+* record, or Access resource that no longer matches what was recorded is kept
+* and listed with the reason instead of stopping the run. Every finished
+* deletion is checkpointed, so rerunning the command continues where it
+* stopped. The routing KV namespace holds that checkpoint, so uninstall
+* deletes it last.
+*
+* An uninstall without --purge-resources records what it leaves as retained. If it
+* stopped before it finished, --purge-resources considers those resources again.
+*/
+const PURGE_RESOURCES_STEP_PREFIX = "uninstall:purge-resources:";
+const WORKER_ORDER = [
+	"email-gateway-worker",
+	"proxy-worker",
+	"dispatch-worker",
+	"api-worker"
+];
+const PERMISSIONS = {
+	access: "Account → Access: Apps and Policies → Edit",
+	aiGateway: "Account → AI Gateway → Edit",
+	dns: "Zone → DNS → Edit",
+	emailRouting: "Zone → Email Routing Rules → Edit",
+	hyperdrive: "Account → Hyperdrive → Edit",
+	kv: "Account → Workers KV Storage → Edit",
+	queues: "Account → Queues → Edit",
+	r2: "Account → Workers R2 Storage → Edit",
+	routes: "Zone → Workers Routes → Edit",
+	serviceTokens: "Account → Access: Service Tokens → Edit",
+	workers: "Account → Workers Scripts → Edit"
+};
+function isPlatformTailWorker(manifest, resource) {
+	return resource.kind === "worker" && (resource.key === "tail-worker" || resource.name === manifest.deployment.resources.tailWorker);
+}
+function purgeResourcesResumeCommand(manifest) {
+	return `void platform uninstall ${manifest.id} --purge-resources`;
+}
+function accessStepKey(access) {
+	return `${PURGE_RESOURCES_STEP_PREFIX}access:${access.key}`;
+}
+/** Access resources that --purge-resources already deleted. */
+function isPurgedAccessResource(manifest, access) {
+	return manifest.steps.some((step) => step.key === accessStepKey(access));
+}
+function hasStep(manifest, key) {
+	return manifest.steps.some((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${key}`);
+}
+function keptStepKey(key) {
+	return `kept:${key}`;
+}
+/**
+* Why --purge-resources kept a resource it was going to delete, for example because
+* a route now serves another Worker; null when it did not keep it. Access
+* resources use the key `access:<key>`.
+*/
+function purgeResourcesKeptReason(manifest, key) {
+	return manifest.steps.find((step) => step.key === `uninstall:purge-resources:${keptStepKey(key)}`)?.resultHash ?? null;
+}
+/** An uninstall that started has not finished, so what it kept can be reconsidered. */
+function isReopenable(manifest) {
+	return manifest.status !== "uninstalled";
+}
+/**
+* A resource the installation created that --purge-resources may still delete: one
+* that is ready, or one that an uninstall which stopped before it finished
+* recorded as retained. Resources --purge-resources itself kept, and earlier
+* versions of a resource kept when it was replaced, are never reconsidered.
+*/
+function isPurgeResourcesCandidate(manifest, resource) {
+	return resource.ownership === "created" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest) && !resource.key.startsWith("retained:") && purgeResourcesKeptReason(manifest, resource.key) === null);
+}
+/** The zone that routes and DNS records live in, if it can still be used. */
+function usableZone(manifest) {
+	return manifest.resources.find((resource) => resource.key === "zone" && (resource.state === "ready" || resource.state === "retained" && isReopenable(manifest)));
+}
+/**
+* A recorded resource whose live configuration no longer matches the
+* installation's record. --purge-resources keeps such a DNS record and continues.
+*/
+var PlatformResourceChangedError = class extends Error {
+	resourceKey;
+	reason;
+	constructor(resourceKey, reason, message) {
+		super(message);
+		this.resourceKey = resourceKey;
+		this.reason = reason;
+		this.name = "PlatformResourceChangedError";
+	}
+};
+/** The zone whose Email Routing rules may send mail to the gateway Worker. */
+function emailRoutingZone(manifest) {
+	return manifest.deployment.capabilities.email ? manifest.deployment.emailSharedZoneId ?? null : null;
+}
+/** Everything --purge-resources will delete, in deletion order. */
+function purgeResourcesTargets(manifest) {
+	const resources = manifest.resources;
+	const routing = resources.find((resource) => resource.key === "routing-kv");
+	const candidate = (resource) => isPurgeResourcesCandidate(manifest, resource);
+	if (!routing || routing.state !== "ready" && !candidate(routing)) return [];
+	const zone = usableZone(manifest);
+	const workers = resources.filter((resource) => resource.kind === "worker" && candidate(resource));
+	const targets = [];
+	for (const resource of resources) {
+		if (resource.kind !== "worker-route" && resource.kind !== "worker-custom-domain" || resource.state !== "ready" && resource.state !== "retained" || resource.kind === "worker-route" && !zone || purgeResourcesKeptReason(manifest, resource.key) !== null) continue;
+		const name = platformTrafficAttachmentWorker(manifest.deployment, resource);
+		const worker = workers.find((entry) => entry.name === name);
+		if (worker) targets.push({
+			phase: "traffic",
+			resource,
+			worker
+		});
+	}
+	for (const resource of resources) if (resource.kind === "dns-record" && candidate(resource) && zone) targets.push({
+		phase: "dns",
+		resource
+	});
+	const access = (manifest.authenticationResources ?? []).filter((entry) => entry.ownership === "created" && !isPurgedAccessResource(manifest, entry) && purgeResourcesKeptReason(manifest, `access:${entry.key}`) === null);
+	for (const kind of ["application", "service-token"]) for (const entry of access.filter((candidate) => candidate.kind === kind)) targets.push({
+		phase: "access",
+		access: entry
+	});
+	const gateway = workers.find((worker) => worker.key === "email-gateway-worker");
+	if (gateway && emailRoutingZone(manifest) && !hasStep(manifest, "email-routing")) targets.push({
+		phase: "email",
+		resource: gateway
+	});
+	const queues = resources.filter((resource) => resource.kind === "queue" && candidate(resource));
+	for (const resource of queues) if (!hasStep(manifest, `consumers:${resource.key}`)) targets.push({
+		phase: "queue-consumers",
+		resource
+	});
+	const rank = (resource) => {
+		const index = WORKER_ORDER.indexOf(resource.key);
+		return index < 0 ? WORKER_ORDER.length : index;
+	};
+	for (const resource of workers.filter((worker) => !isPlatformTailWorker(manifest, worker)).sort((left, right) => rank(left) - rank(right) || left.key.localeCompare(right.key))) targets.push({
+		phase: "workers",
+		resource
+	});
+	for (const resource of queues) targets.push({
+		phase: "queues",
+		resource
+	});
+	for (const resource of resources) if (resource.kind === "dispatch-namespace" && candidate(resource)) targets.push({
+		phase: "dispatch",
+		resource
+	});
+	for (const resource of workers.filter((worker) => isPlatformTailWorker(manifest, worker))) targets.push({
+		phase: "tail",
+		resource
+	});
+	for (const kind of ["hyperdrive", "kv-namespace"]) for (const resource of resources) if (resource.kind === kind && resource.key !== "routing-kv" && candidate(resource)) targets.push({
+		phase: "data",
+		resource
+	});
+	for (const kind of ["r2-bucket", "ai-gateway"]) for (const resource of resources) if (resource.kind === kind && candidate(resource)) targets.push({
+		phase: kind === "r2-bucket" ? "r2" : "ai-gateway",
+		resource
+	});
+	if (candidate(routing)) targets.push({
+		phase: "routing",
+		resource: routing
+	});
+	return targets;
+}
+/** Whether --purge-resources removes, or has removed, the rules that send mail to the gateway Worker. */
+function purgeResourcesHandlesEmailRouting(manifest) {
+	return hasStep(manifest, "email-routing") || purgeResourcesTargets(manifest).some((target) => target.phase === "email");
+}
+/** Manifest resources that --purge-resources leaves in the account. */
+function purgeResourcesKeptResources(manifest) {
+	const targets = new Set(purgeResourcesTargets(manifest).flatMap((target) => "resource" in target ? [target.resource.key] : []));
+	return manifest.resources.filter((resource) => (resource.state === "ready" || resource.state === "retained") && !targets.has(resource.key));
+}
+function resourceLabel(resource) {
+	return `${resource.kind}: ${resource.name}${resource.name === resource.id ? "" : ` (${resource.id})`}`;
+}
+/** Plan lines for --purge-resources: what is deleted, in order, then what is kept. */
+function describePurgeResourcesPlan(manifest) {
+	const targets = purgeResourcesTargets(manifest);
+	const lines = [];
+	let step = 0;
+	let previous = null;
+	const consumerQueues = [];
+	for (const target of targets) {
+		if (target.phase === "email") {
+			step++;
+			previous = target.phase;
+			lines.push(`  ${step}. Email Routing rules in zone ${emailRoutingZone(manifest)} that send mail to ${target.resource.name}, and its catch-all rule if it does (reset to drop mail, disabled)`);
+			continue;
+		}
+		if (target.phase !== previous) {
+			step++;
+			previous = target.phase;
+		}
+		const prefix = `  ${step}. `;
+		if (target.phase === "traffic") lines.push(`${prefix}${resourceLabel(target.resource)} -> ${target.worker.name}`);
+		else if (target.phase === "access") lines.push(`${prefix}Access ${target.access.kind}: ${target.access.name} (${target.access.id})`);
+		else if (target.phase === "queue-consumers") {
+			consumerQueues.push(target.resource.name);
+			if (consumerQueues.length === 1) lines.push(`${prefix}queue consumers run by this installation's Workers on:`);
+			lines.push(`       ${target.resource.name}`);
+		} else if (target.phase === "dispatch") lines.push(`${prefix}${resourceLabel(target.resource)}, with any application Workers still in it`);
+		else if (target.phase === "tail") lines.push(`${prefix}${resourceLabel(target.resource)}, the tail Worker, after the others`);
+		else if (target.phase === "workers" && target.resource.key === "api-worker") lines.push(`${prefix}${resourceLabel(target.resource)}, with its Durable Object data`);
+		else if (target.phase === "r2") lines.push(`${prefix}${resourceLabel(target.resource)}, emptied first`);
+		else if (target.phase === "ai-gateway") lines.push(`${prefix}${resourceLabel(target.resource)}, if Cloudflare shows it was created during installation; otherwise kept`);
+		else if (target.phase === "routing") lines.push(`${prefix}${resourceLabel(target.resource)}, last; it holds uninstall progress`);
+		else lines.push(`${prefix}${resourceLabel(target.resource)}`);
+	}
+	return lines.length ? ["Delete every resource this installation created (--purge-resources), in this order:", ...lines] : ["--purge-resources finds no resource it can prove this installation created."];
+}
+/** Lines naming what --purge-resources never removes. */
+function purgeResourcesAlwaysKept() {
+	return [
+		"  The external PostgreSQL database and its data.",
+		"  Analytics Engine datasets; Cloudflare has no API to delete them.",
+		"  Access policies and identity providers you chose.",
+		"  API tokens you created for this platform. Revoke them in the Cloudflare dashboard."
+	];
+}
+/** Token permissions --purge-resources needs for this manifest. */
+function purgeResourcesPermissions(manifest) {
+	const targets = purgeResourcesTargets(manifest);
+	const needed = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		if (target.phase === "access") {
+			needed.add(target.access.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens);
+			continue;
+		}
+		if (target.phase === "email") {
+			needed.add(PERMISSIONS.emailRouting);
+			continue;
+		}
+		const { kind } = target.resource;
+		if (kind === "worker-route") needed.add(PERMISSIONS.routes);
+		else if (kind === "worker" || kind === "worker-custom-domain" || kind === "dispatch-namespace") needed.add(PERMISSIONS.workers);
+		else if (kind === "dns-record") needed.add(PERMISSIONS.dns);
+		else if (kind === "queue") needed.add(PERMISSIONS.queues);
+		else if (kind === "kv-namespace") needed.add(PERMISSIONS.kv);
+		else if (kind === "hyperdrive") needed.add(PERMISSIONS.hyperdrive);
+		else if (kind === "r2-bucket") needed.add(PERMISSIONS.r2);
+		else if (kind === "ai-gateway") needed.add(PERMISSIONS.aiGateway);
+	}
+	return Object.values(PERMISSIONS).filter((permission) => needed.has(permission));
+}
+function deniedStatus(error) {
+	return error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403);
+}
+/**
+* Check resource reads before the first change. Browser login cannot change
+* DNS or Access, so those need an API token. Read probes cannot prove Edit;
+* the plan lists the required permissions.
+*/
+async function checkPurgeResourcesCredentials(client, manifest, credential) {
+	const targets = purgeResourcesTargets(manifest);
+	const resources = targets.flatMap((target) => "resource" in target ? [target.resource] : []);
+	const access = targets.flatMap((target) => "access" in target ? [target.access] : []);
+	const has = (kind) => resources.some((resource) => resource.kind === kind);
+	const zone = manifest.resources.find((resource) => resource.key === "zone");
+	const emailZone = targets.some((target) => target.phase === "email") ? emailRoutingZone(manifest) : null;
+	const accounts = [.../* @__PURE__ */ new Set([manifest.account.id, ...access.map((entry) => entry.accountId)])];
+	const scope = `${accounts.length === 1 ? "account" : "accounts"} ${accounts.join(" and ")}${has("dns-record") || has("worker-route") ? ` and zone ${zone?.name ?? ""}` : ""}${emailZone ? ` and Email Routing zone ${emailZone}` : ""}`;
+	if (credential.source === "oauth") {
+		const browserMissing = [
+			...has("dns-record") ? [PERMISSIONS.dns] : [],
+			...access.some((entry) => entry.kind === "application") ? [PERMISSIONS.access] : [],
+			...access.some((entry) => entry.kind === "service-token") ? [PERMISSIONS.serviceTokens] : [],
+			...has("ai-gateway") && !credential.aiGatewayToken ? [PERMISSIONS.aiGateway] : []
+		];
+		if (browserMissing.length) throw new Error(`platform: Cloudflare browser login cannot delete every resource --purge-resources plans. Set CLOUDFLARE_API_TOKEN to a token with ${purgeResourcesPermissions(manifest).join(", ")}, scoped to ${scope}, then rerun. Browser login is missing: ${browserMissing.join(", ")}. No Cloudflare resource was changed.`);
+	}
+	const probes = [];
+	if (has("worker") || has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerNames(manifest.account.id)]);
+	if (has("worker-custom-domain")) probes.push([PERMISSIONS.workers, () => client.listWorkerDomains(manifest.account.id)]);
+	if (has("worker-route") && zone) probes.push([PERMISSIONS.routes, () => client.listWorkerRoutes(zone.id)]);
+	for (const resource of resources) if (resource.kind === "dns-record" && zone) probes.push([PERMISSIONS.dns, () => client.listDnsRecords(zone.id, resource.name)]);
+	else if (resource.kind === "queue") probes.push([PERMISSIONS.queues, () => client.listQueueConsumers(manifest.account.id, resource.id)]);
+	for (const entry of access) probes.push([entry.kind === "application" ? PERMISSIONS.access : PERMISSIONS.serviceTokens, () => client.getAccessResource(entry.accountId, entry.kind, entry.id)]);
+	if (emailZone) probes.push([PERMISSIONS.emailRouting, () => client.listEmailRoutingRules(emailZone)]);
+	if (has("dispatch-namespace")) probes.push([PERMISSIONS.workers, () => client.listDispatchNamespaces(manifest.account.id)]);
+	if (has("kv-namespace")) probes.push([PERMISSIONS.kv, () => client.listKvNamespaces(manifest.account.id)]);
+	if (has("hyperdrive")) probes.push([PERMISSIONS.hyperdrive, () => client.listHyperdriveConfigs(manifest.account.id)]);
+	if (has("r2-bucket")) probes.push([PERMISSIONS.r2, () => client.listR2Buckets(manifest.account.id)]);
+	if (has("ai-gateway")) probes.push([PERMISSIONS.aiGateway, () => client.listAiGateways(manifest.account.id)]);
+	const missing = /* @__PURE__ */ new Set();
+	for (const [permission, probe] of probes) try {
+		await probe();
+	} catch (error) {
+		if (!deniedStatus(error)) throw error;
+		missing.add(permission);
+	}
+	if (missing.size) throw new Error(`platform: The Cloudflare credential cannot read every resource --purge-resources would delete. Add ${[...missing].join(", ")} for ${scope}, then rerun. No Cloudflare resource was changed.`);
+}
+const LISTED_PROJECTS = 20;
+/**
+* Projects own Workers, storage, and domains that only the running platform
+* can delete. --purge-resources deletes the platform, so it refuses before any
+* change while a project remains.
+*/
+async function assertNoPlatformProjects(read) {
+	const slugs = await readPlatformDatabase(read, (reason) => `platform: Refusing --purge-resources because the project list could not be read from the platform database: ${reason}\nMake the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry.`);
+	if (slugs.length) throw new Error([
+		`platform: Refusing --purge-resources while the platform still has ${slugs.length === 1 ? "1 project" : `${slugs.length} projects`}.`,
+		"--purge-resources deletes the platform, and only the running platform can delete each project's Workers, storage, and domains.",
+		"Delete each project first with `void project delete <name>`, then retry:",
+		...slugs.slice(0, LISTED_PROJECTS).map((slug) => `  ${slug}`),
+		...slugs.length > LISTED_PROJECTS ? [`  …and ${slugs.length - LISTED_PROJECTS} more`] : []
+	].join("\n"));
+}
+const AI_GATEWAY_CREATION_WINDOW_MS = 6e5;
+/**
+* AI Gateway ids are chosen by the caller and can be reused after a delete,
+* and gateways carry no ownership marker. Only a creation time next to the
+* installer's provision intent shows that this is the gateway it created.
+*/
+function createdDuringInstallation(manifest, resource, createdAt) {
+	const created = createdAt === void 0 ? NaN : Date.parse(createdAt);
+	if (Number.isNaN(created)) return false;
+	return manifest.steps.some((step) => (step.key === `provision-intent:${resource.key}` || step.key.startsWith(`provision-intent:${resource.key}:`)) && Math.abs(created - Date.parse(step.completedAt)) <= AI_GATEWAY_CREATION_WINDOW_MS);
+}
+function ownershipRefusal(manifest, description, reason) {
+	return /* @__PURE__ */ new Error(`platform: Refusing to delete ${description} because ${reason}. It may no longer belong to this installation. Delete or fix it in the Cloudflare dashboard if it is yours, then rerun: ${purgeResourcesResumeCommand(manifest)}`);
+}
+function cloudflareRefusal(manifest, description, error, hint) {
+	if (!(error instanceof PlatformCloudflareApiError)) return error;
+	return new Error(`platform: Cloudflare refused to delete ${description}: ${error.message}\n${hint}\nProgress is saved. Rerun: ${purgeResourcesResumeCommand(manifest)}`, { cause: error });
+}
+/**
+* Delete every target in order. Returns the manifest with each deleted
+* resource recorded; routing KV is left for the caller to delete last.
+*/
+async function runPurgeResourcesTeardown(context, initial) {
+	const { client } = context;
+	let next = initial;
+	const accountId = next.account.id;
+	const save = async (manifest) => {
+		next = manifest;
+		await context.checkpoint(next);
+	};
+	const markDeleted = async (key) => {
+		const resource = next.resources.find((entry) => entry.key === key);
+		await save(recordInstallationResource(next, {
+			...resource,
+			state: "deleted"
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+	};
+	const recordStep = async (key, resultHash = "completed") => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await save(recordInstallationStep(next, {
+			completedAt: now,
+			key: `${PURGE_RESOURCES_STEP_PREFIX}${key}`,
+			resultHash
+		}, now));
+	};
+	/**
+	* Live proof for these keys. A resource an earlier uninstall recorded as
+	* retained is proven like a ready one; only its recorded state differs.
+	*/
+	const verify = (keys) => context.verify({
+		...next,
+		resources: next.resources.map((resource) => keys.has(resource.key) && resource.state === "retained" ? {
+			...resource,
+			state: "ready"
+		} : resource)
+	}, keys);
+	/**
+	* Prove the resource; false when it is already gone (and recorded).
+	*
+	* Cloudflare has no conditional DELETE: Workers and dispatch namespaces are
+	* addressed by name, and a route or custom domain can be changed in place.
+	* Something replaced between this proof and the DELETE can still be removed.
+	* That one-request window is accepted because --purge-resources is opt-in and its
+	* plan lists every resource first. A forced Worker DELETE has the same
+	* window between reading its dependents and the DELETE.
+	*/
+	const prove = async (resource) => {
+		if ((await verify(/* @__PURE__ */ new Set(["routing-kv", resource.key]))).has(resource.key)) {
+			await markDeleted(resource.key);
+			return false;
+		}
+		return true;
+	};
+	/** Keep a resource that no longer matches the record, and save why. */
+	const keep = async (key, reason) => {
+		const resource = next.resources.find((entry) => entry.key === key);
+		if (resource?.state === "ready") await save(recordInstallationResource(next, {
+			...resource,
+			state: "retained"
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+		await recordStep(keptStepKey(key), reason);
+	};
+	const remove = async (resource, hint, zoneId) => {
+		if (!await prove(resource)) return;
+		try {
+			await client.deleteResource(accountId, resource, zoneId);
+		} catch (error) {
+			throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, hint);
+		}
+		await markDeleted(resource.key);
+	};
+	const zone = usableZone(next);
+	const createdWorkerNames = new Set(next.resources.filter((resource) => resource.kind === "worker" && resource.ownership === "created").map((resource) => resource.name));
+	/** The recorded Worker under this name that this run still deletes, if any. */
+	const workerTarget = (name) => next.resources.find((resource) => resource.kind === "worker" && resource.name === name && isPurgeResourcesCandidate(next, resource));
+	const workerHint = "A Worker this installation did not create may still use it, for example by sending it logs as a tail Worker or through a service binding. Remove that link in the Cloudflare dashboard.";
+	/**
+	* Delete a platform Worker. When Cloudflare refuses because other Workers
+	* still bind to it, force the DELETE only if each of them is a Worker this
+	* run deletes too and still carries this installation's ownership marker.
+	*/
+	const removeWorker = async (resource) => {
+		if (!await prove(resource)) return;
+		try {
+			await client.deleteResource(accountId, resource);
+		} catch (error) {
+			if (!(error instanceof PlatformCloudflareApiError)) throw error;
+			const dependents = await client.listWorkerDependents(accountId, resource.name).catch(() => null);
+			const outside = dependents?.workers.filter((name) => !workerTarget(name)) ?? [];
+			const keys = outside.length ? [] : dependents?.workers.map((name) => workerTarget(name).key) ?? [];
+			const missing = dependents && !dependents.pagesFunction && keys.length ? await verify(/* @__PURE__ */ new Set(["routing-kv", ...keys])) : null;
+			if (!dependents || dependents.pagesFunction || dependents.workers.length === 0 || outside.length > 0 || !missing || keys.some((key) => missing.has(key))) throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, error, outside.length ? `Workers outside this installation still use it: ${outside.join(", ")}. Remove that link in the Cloudflare dashboard.` : workerHint);
+			try {
+				await client.forceDeleteWorker(accountId, resource.name);
+			} catch (forced) {
+				throw cloudflareRefusal(next, `${resource.kind} ${resource.name}`, forced, workerHint);
+			}
+		}
+		await markDeleted(resource.key);
+	};
+	for (const target of purgeResourcesTargets(initial)) {
+		if (target.phase === "access") {
+			const { access } = target;
+			const live = await client.getAccessResource(access.accountId, access.kind, access.id);
+			if (live) {
+				if (live.name !== access.name || !access.name.startsWith(`void-${next.id}-`)) {
+					await keep(`access:${access.key}`, `its live name ${JSON.stringify(live.name)} is not the name this installation recorded`);
+					continue;
+				}
+				try {
+					await client.deleteAccessResource(access.accountId, access.kind, access.id);
+				} catch (error) {
+					throw cloudflareRefusal(next, `Access ${access.kind} ${access.name}`, error, "Check that nothing outside this installation still uses it.");
+				}
+			}
+			await recordStep(`access:${access.key}`);
+			continue;
+		}
+		const current = next.resources.find((resource) => resource.key === target.resource.key);
+		if (!current || current.state === "deleted" || purgeResourcesKeptReason(next, current.key) !== null || target.phase !== "traffic" && !isPurgeResourcesCandidate(next, current)) continue;
+		switch (target.phase) {
+			case "traffic": {
+				const worker = next.resources.find((resource) => resource.key === target.worker.key);
+				if (!worker || !isPurgeResourcesCandidate(next, worker) || !await prove(worker)) break;
+				if (current.kind === "worker-route") {
+					const live = (await client.listWorkerRoutes(zone.id)).find((route) => route.id === current.id);
+					if (live && (live.pattern !== current.name || live.script !== worker.name)) {
+						await keep(current.key, `it now sends ${JSON.stringify(live.pattern)} to ${JSON.stringify(live.script)}`);
+						break;
+					}
+					if (live) await client.deleteWorkerRoute(zone.id, current.id);
+				} else {
+					const live = (await client.listWorkerDomains(accountId)).find((domain) => domain.id === current.id);
+					if (live && (live.hostname !== current.name || live.service !== worker.name)) {
+						await keep(current.key, `it now sends ${JSON.stringify(live.hostname)} to ${JSON.stringify(live.service)}`);
+						break;
+					}
+					if (live) await client.deleteWorkerDomain(accountId, current.id);
+				}
+				await markDeleted(current.key);
+				break;
+			}
+			case "dns":
+				try {
+					await remove(current, "Check the record in the Cloudflare dashboard.", zone.id);
+				} catch (error) {
+					if (!(error instanceof PlatformResourceChangedError && error.resourceKey === current.key)) throw error;
+					await keep(current.key, error.reason);
+				}
+				break;
+			case "email": {
+				if (!await prove(current)) break;
+				const zoneId = emailRoutingZone(next);
+				const hint = "Check the Email Routing rules for this zone in the Cloudflare dashboard. Never disable Email Routing for the zone.";
+				try {
+					for (const rule of await client.listEmailRoutingRules(zoneId)) if (rule.workerName === current.name) await client.deleteEmailRoutingRule(zoneId, rule.id);
+					if ((await client.getEmailRoutingCatchAll(zoneId))?.workerName === current.name) await client.resetEmailRoutingCatchAll(zoneId);
+				} catch (error) {
+					throw cloudflareRefusal(next, `Email Routing rules that send mail to ${current.name}`, error, hint);
+				}
+				await recordStep("email-routing");
+				break;
+			}
+			case "queue-consumers":
+				if (!await prove(current)) break;
+				for (const consumer of await client.listQueueConsumers(accountId, current.id)) if (consumer.script && createdWorkerNames.has(consumer.script)) await client.deleteQueueConsumer(accountId, current.id, consumer.id);
+				await recordStep(`consumers:${current.key}`);
+				break;
+			case "workers":
+				await removeWorker(current);
+				break;
+			case "tail":
+				await remove(current, workerHint);
+				break;
+			case "queues":
+				await remove(current, "A Worker this installation did not create may still use the Queue as a producer or consumer. Remove it from that Worker in the Cloudflare dashboard.");
+				break;
+			case "dispatch": {
+				if (!await prove(current)) break;
+				const projects = await context.readProjects();
+				if (projects.length) throw new Error(`platform: Stopped before deleting the application Workers in dispatch namespace ${current.name} because ${projects.length === 1 ? "a project was" : "projects were"} created while this uninstall ran: ${projects.join(", ")}. Nothing in the namespace was deleted. --purge-resources refuses while the platform database lists a project. Remove each one from the "projects" table once you have dealt with its Cloudflare resources, then rerun: ${purgeResourcesResumeCommand(next)}`);
+				for (const script of await client.listDispatchNamespaceScripts(accountId, current.name)) try {
+					await client.deleteDispatchNamespaceScript(accountId, current.name, script);
+				} catch (error) {
+					throw cloudflareRefusal(next, `application Worker ${script}`, error, workerHint);
+				}
+				try {
+					await client.deleteResource(accountId, current);
+				} catch (error) {
+					throw cloudflareRefusal(next, `dispatch-namespace ${current.name}`, error, "Check the namespace in the Cloudflare dashboard.");
+				}
+				await markDeleted(current.key);
+				break;
+			}
+			case "ai-gateway": {
+				const live = (await client.listAiGateways(accountId)).find((gateway) => gateway.id === current.id && gateway.name === current.name);
+				if (live && !createdDuringInstallation(next, current, live.createdAt)) {
+					await keep(current.key, "Cloudflare does not show it was created during installation");
+					break;
+				}
+				await remove(current, "Check that nothing outside this installation still uses it.");
+				break;
+			}
+			case "data":
+				await remove(current, "Check that nothing outside this installation still uses it.");
+				break;
+			case "r2": await purgeBucket(current);
+		}
+	}
+	return next;
+	async function purgeBucket(bucket) {
+		const markerStep = `r2-marker:${bucket.key}`;
+		if (!hasStep(next, markerStep)) {
+			if (!await prove(bucket)) return;
+			await client.emptyR2Bucket(accountId, bucket.name, /* @__PURE__ */ new Set([PLATFORM_R2_OWNERSHIP_MARKER_KEY]), async () => {
+				if ((await verify(/* @__PURE__ */ new Set(["routing-kv", bucket.key]))).has(bucket.key)) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "it disappeared while it was being emptied");
+			});
+			if (!await prove(bucket)) return;
+			const generation = await context.bucketGeneration(next, bucket);
+			if (generation === null) {
+				await markDeleted(bucket.key);
+				return;
+			}
+			await recordStep(markerStep, generation);
+			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
+		} else {
+			const saved = next.steps.find((step) => step.key === `${PURGE_RESOURCES_STEP_PREFIX}${markerStep}`);
+			const generation = await context.bucketGeneration(next, bucket);
+			if (generation === null) {
+				await markDeleted(bucket.key);
+				return;
+			}
+			if (generation !== saved?.resultHash) throw ownershipRefusal(next, `R2 bucket ${bucket.name}`, "its creation fingerprint changed");
+			await client.deleteR2Object(accountId, bucket.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY);
+		}
+		try {
+			await client.deleteResource(accountId, bucket);
+		} catch (error) {
+			throw cloudflareRefusal(next, `r2-bucket ${bucket.name}`, error, "Cloudflare deletes only empty buckets. If objects were added after it was emptied, delete them in the Cloudflare dashboard.");
+		}
+		await markDeleted(bucket.key);
+	}
+}
+//#endregion
 //#region src/cli/platform-management.ts
 async function verifyPlatformInstallationOwnership(client, manifest, options = {}) {
 	const ready = manifest.resources.filter((resource) => resource.state === "ready" && isOwnershipVerifiableKind(resource.kind) && !options.retainedReplacementKeys?.has(resource.key));
@@ -64,8 +652,7 @@ async function runInstalledPlatformCommand(args) {
 	const rollbackSourceRuntime = args.subcommand === "rollback" ? loadPlatformRuntime(args.fromRuntime) : null;
 	let progress;
 	let reportResult;
-	const execute = async (currentManifest, databaseLock, databaseCheckpointExists = false) => {
-		const manifest = currentManifest;
+	const execute = async (manifest, databaseLock, databaseCheckpointExists = false) => {
 		if (args.subcommand === "rollback") assertPlatformRollbackCompatibility(manifest, runtime, rollbackSourceRuntime);
 		const recovery = readInstallationRecoverySecrets(manifest);
 		const gatewayToken = process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN || recovery?.cloudflareApiToken;
@@ -79,6 +666,8 @@ async function runInstalledPlatformCommand(args) {
 			return;
 		}
 		if (args.subcommand === "uninstall") {
+			const apiUrl = manifest.endpoints.apiUrl;
+			const appAccessSetupToken = recovery?.appAccessSetupToken;
 			await uninstallPlatform(client, manifest, args, {
 				checkpoint: databaseLock?.checkpoint,
 				databaseUrl,
@@ -90,7 +679,19 @@ async function runInstalledPlatformCommand(args) {
 				credential: {
 					source: operatorCredential.source,
 					aiGatewayToken: !!gatewayToken
-				}
+				},
+				...apiUrl && appAccessSetupToken ? { turnOffProjectZeroTrust: async () => {
+					const saved = recovery?.accessCredentialsJson ? JSON.parse(recovery.accessCredentialsJson) : {};
+					if (saved && typeof saved === "object" && apiUrl in saved) activatePlatformAccessCredentials(JSON.stringify({ [apiUrl]: saved[apiUrl] }), [apiUrl]);
+					if (manifest.deployment.authentication.accessProtection) ensurePlatformAccessToken(apiUrl, false, true);
+					await turnOffInstalledProjectZeroTrust({
+						apiUrl,
+						installationId: manifest.id,
+						probeToken: createPlatformHealthProbeToken(manifest.ownershipNonce),
+						setupToken: appAccessSetupToken,
+						updateCommand: readPendingInstallationSecrets(manifest) ? `void platform install --resume --name ${commandArgument(manifest.id)}` : `void platform upgrade ${commandArgument(manifest.id)}`
+					});
+				} } : {}
 			});
 			return;
 		}
@@ -98,6 +699,13 @@ async function runInstalledPlatformCommand(args) {
 			log.info(`${manifest.deployment.displayName} is already enabled.`);
 			return;
 		}
+		const loginFile = args.subcommand === "repair" ? args.authConfig : void 0;
+		if (loginFile !== void 0) {
+			if (manifest.desiredState === "disabled") throw new Error(`platform: This platform is disabled. Run \`void platform enable ${commandArgument(manifest.id)}\` first, then repair to change the login settings.`);
+			if (!manifest.deployment.authentication.configurable) throw new Error("platform: This installation signs in with the GitHub OAuth App from its installation settings. Set VOID_PLATFORM_GITHUB_CLIENT_ID and VOID_PLATFORM_GITHUB_CLIENT_SECRET when running repair to replace it.");
+			if (!recovery?.authenticationSetupJson || !recovery.authSetupToken) throw new Error("platform: Changing the login settings needs the setup authority saved on the computer that installed the platform. Run this repair there.");
+			await readLoginReplacementFile(loginFile, manifest.deployment.authentication, recovery.authenticationSetupJson);
+		}
 		const deployment = manifest.deployment;
 		const planInput = {
 			accountId: manifest.account.id,
@@ -129,6 +737,7 @@ async function runInstalledPlatformCommand(args) {
 		].join("\n"), "Platform runtime");
 		log.info(manifest.desiredState === "disabled" && args.subcommand !== "enable" ? "Application traffic will stay paused because this installation is disabled." : "Application traffic may pause briefly during a safe cutover.");
 		if (args.plan) {
+			if (loginFile !== void 0) log.info(`Login settings will be replaced from ${loginFile}; a new setup code is printed at the end.`);
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
@@ -140,6 +749,21 @@ async function runInstalledPlatformCommand(args) {
 			databaseUrl
 		});
 		markPhase("ownership");
+		let replacedLogin;
+		if (args.subcommand === "repair" && (loginFile !== void 0 || process.stdin.isTTY && !args.yes) && manifest.desiredState !== "disabled" && manifest.deployment.authentication.configurable && recovery?.authenticationSetupJson && recovery.authSetupToken) {
+			const setup = await databaseLock?.readAdministratorSetup?.();
+			if (loginFile !== void 0) {
+				if (!setup) throw new Error("platform: The database lifecycle lock cannot read the administrator setup.");
+				if (setup.usersExist || setup.requestHash !== null && !setup.pending) throw new Error("platform: The first administrator has already signed in. Change login methods with `void platform config auth`.");
+				if (setup.requestHash === null) throw new Error(`platform: Administrator setup was never started. Resume the install with \`void platform install --resume --name ${commandArgument(manifest.id)}\`.`);
+			}
+			if (setup?.pending && !setup.usersExist && (loginFile !== void 0 || await promptForConfirmation("First administrator setup is not finished. Change the login settings before continuing?", false))) replacedLogin = await replacePendingInstallationAuthentication({
+				...loginFile !== void 0 ? { file: loginFile } : {},
+				authentication: manifest.deployment.authentication,
+				setupJson: recovery.authenticationSetupJson,
+				apiUrl: plan.apiUrl
+			});
+		}
 		const installation = args.subcommand === "enable" ? setInstallationDesiredState(manifest, "enabled", (/* @__PURE__ */ new Date()).toISOString()) : manifest;
 		const bootstrapGitHubLogin = process.env.VOID_PLATFORM_ADMIN_GITHUB_LOGIN || recovery?.bootstrapGitHubLogin || "";
 		const bootstrapGitHubId = process.env.VOID_PLATFORM_ADMIN_GITHUB_ID || recovery?.bootstrapGitHubId || (bootstrapGitHubLogin ? await resolveBootstrapGitHubId(bootstrapGitHubLogin) : "");
@@ -161,7 +785,8 @@ async function runInstalledPlatformCommand(args) {
 			projectSecretKeysJson: process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || "",
 			projectSecretActiveKeyVersion: process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION || "",
 			r2AccessKeyId: process.env.VOID_PLATFORM_R2_ACCESS_KEY_ID || "",
-			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || ""
+			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || "",
+			...replacedLogin
 		});
 		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets);
 		if (runtimeTokenToPreflight) await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(runtimeTokenToPreflight), {
@@ -177,6 +802,17 @@ async function runInstalledPlatformCommand(args) {
 		} });
 		progress.start(args.subcommand === "upgrade" ? "Upgrading the platform" : args.subcommand === "rollback" ? "Rolling back the platform" : args.subcommand === "enable" ? "Enabling the platform" : "Repairing the platform");
 		if (installation !== manifest) writeInstallationManifest(installation);
+		const keepAcceptedLogin = async (error) => {
+			const after = replacedLogin ? await databaseLock?.readAdministratorSetup?.().catch(() => void 0) : void 0;
+			if (!after || !recovery?.authenticationSetupJson || after.requestHash !== authenticationSetupRequestHash(recovery.authenticationSetupJson) || !after.usersExist && after.pending) return error;
+			const pending = readPendingInstallationSecrets(installation);
+			if (pending) writePendingInstallationSecrets(installation, {
+				...pending,
+				authenticationSetupJson: recovery.authenticationSetupJson,
+				...recovery.authBootstrapCode ? { authBootstrapCode: recovery.authBootstrapCode } : {}
+			});
+			return new Error("platform: The first administrator signed in before the new login settings were applied. Nothing changed. Change login methods with `void platform config auth`.", { cause: error });
+		};
 		const result = await installPlatform(plan, secrets, installation, {
 			acquireDatabaseLifecycleLock: async () => Object.assign(async () => {}, {
 				checkpoint: databaseLock?.checkpoint,
@@ -207,6 +843,8 @@ async function runInstalledPlatformCommand(args) {
 				repairMissing: args.subcommand === "repair",
 				stableWorkerUpdate: args.subcommand === "upgrade"
 			})
+		}).catch(async (error) => {
+			throw await keepAcceptedLogin(error);
 		});
 		progress.message("Finalizing platform changes");
 		markPhase("installer complete");
@@ -233,8 +871,10 @@ async function runInstalledPlatformCommand(args) {
 			if (result.setupPending) {
 				const code = readInstallationRecoverySecrets(result.manifest)?.authBootstrapCode;
 				if (code) {
-					log.info(`First administrator setup: ${plan.apiUrl}/setup`);
+					log.info(`First administrator setup: ${formatUrl(`${plan.apiUrl}/setup`)}`);
 					console.log(`One-time administrator setup code: ${code}`);
+					log.info(`Login callback URL: ${formatUrl(`${plan.apiUrl}/auth/callback`)}`);
+					log.info(`If sign-in fails, run \`void platform repair ${commandArgument(manifest.id)}\` to change the login settings.`);
 				}
 			}
 			printSuccess(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
@@ -295,7 +935,7 @@ function assertPlatformRollbackCompatibility(installation, target, source) {
 	if (JSON.stringify(prefix) !== JSON.stringify(target.manifest.database.migrations)) throw new Error("platform: The rollback target database migrations are not an exact prefix of the installed runtime.");
 	if (!source.manifest.database.rollbackSafeFrom.some((entry) => entry.platformVersion === target.manifest.platformVersion && entry.schemaDigest === target.manifest.database.schemaDigest)) throw new Error(`platform: Installed runtime ${source.manifest.platformVersion} does not declare post-success rollback compatibility with ${target.manifest.platformVersion} at schema ${target.manifest.database.schemaDigest}.`);
 	if (installation.databaseSchemaDigest !== source.manifest.database.schemaDigest) throw new Error("platform: The authoritative installation checkpoint does not record the installed runtime database schema. Repair or roll forward before rollback.");
-	if ((target.manifest.safetyProtocols?.sandboxDrain ?? 0) < (installation.safetyProtocols?.sandboxDrain ?? 0)) throw new Error("platform: The rollback target predates the installed sandbox-drain safety protocol.");
+	if (target.manifest.safetyProtocols.sandboxDrain < installation.safetyProtocols.sandboxDrain) throw new Error("platform: The rollback target predates the installed sandbox-drain safety protocol.");
 }
 function resolvePlatformRuntimeTokenToPreflight(plan, secrets) {
 	const explicitUpdate = secrets.workerSecretUpdates?.CF_API_TOKEN;
@@ -319,18 +959,17 @@ async function resolveInstalledPlatformManifest(selector, dependencies = {}) {
 	return resolveInstallationManifest(String(picked));
 }
 async function disablePlatform(client, initialManifest, planOnly, dependencies = {}) {
-	const reconciled = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
-	const writeLifecycleCheckpoint = (checkpointClient, checkpointManifest) => writeLifecycleCheckpointWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
-	const writeRemoteManifestIfPresent = (checkpointClient, checkpointManifest) => writeRemoteManifestIfPresentWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
+	const manifest = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
+	const saveCheckpoint = (state) => writeLifecycleCheckpoint(client, state, dependencies.checkpoint);
+	const saveRemoteManifest = (state) => writeRemoteManifest(client, state, dependencies.checkpoint);
 	note("Block all platform traffic and the platform API. Routes, custom domains, Workers, and data stay installed.", "Disable plan");
 	if (planOnly) {
 		outro("No Cloudflare or local installation state was changed.");
 		return;
 	}
-	const manifest = reconciled;
 	if (manifest !== initialManifest) writeInstallationManifest(manifest);
 	const alreadyDisabled = manifest.status === "disabled";
-	const missing = await verifyPlatformMutationOwnership(client, manifest, /* @__PURE__ */ new Set([
+	await verifyPlatformMutationOwnership(client, manifest, /* @__PURE__ */ new Set([
 		"routing-kv",
 		"zone",
 		...manifest.resources.filter((resource) => resource.kind === "worker").map((resource) => resource.key)
@@ -342,30 +981,27 @@ async function disablePlatform(client, initialManifest, planOnly, dependencies =
 		writeInstallationManifest(next);
 	}
 	try {
-		await writeRemoteManifestIfPresent(client, next);
-		const zone = next.resources.find((resource) => resource.key === "zone");
+		await saveRemoteManifest(next);
 		const routing = requireResource(next, "routing-kv");
 		const trafficGeneration = currentTrafficGeneration(next);
 		await client.putKvValue(next.account.id, routing.id, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-		const trackedTraffic = trackedPlatformWorkerTraffic(next);
-		await client.removeRoutes(next.account.id, !zone || missing.has(zone.key) ? null : zone.id, trackedTraffic);
 		next = markTrafficAttachmentsRetained(next);
 		if (!hasLifecycleStep(next, `disable:${trafficGeneration}:routes`)) next = recordLifecycleStep(next, `disable:${trafficGeneration}:routes`);
-		await writeLifecycleCheckpoint(client, next);
+		await saveCheckpoint(next);
 		next = transitionInstallation(next, "disabled", (/* @__PURE__ */ new Date()).toISOString());
-		await writeLifecycleCheckpoint(client, next);
+		await saveCheckpoint(next);
 		printSuccess(`${next.deployment.displayName} is disabled. Its data was not changed.`);
 	} catch (error) {
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
 		writeInstallationManifest(next);
-		await writeRemoteManifestIfPresent(client, next).catch(() => {});
+		await saveRemoteManifest(next).catch(() => {});
 		throw error;
 	}
 }
 async function uninstallPlatform(client, initialManifest, args, dependencies = {}) {
 	const manifest = await recoverDurablyMarkedProvisionIntents(client, initialManifest);
-	const writeLifecycleCheckpoint = (checkpointClient, checkpointManifest) => writeLifecycleCheckpointWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
-	const writeRemoteManifestIfPresent = (checkpointClient, checkpointManifest) => writeRemoteManifestIfPresentWithoutDatabase(checkpointClient, checkpointManifest, dependencies.checkpoint);
+	const saveCheckpoint = (state) => writeLifecycleCheckpoint(client, state, dependencies.checkpoint);
+	const saveRemoteManifest = (state) => writeRemoteManifest(client, state, dependencies.checkpoint);
 	const retainData = !args.purgeData;
 	const purgeResources = args.purgeResources;
 	const routingKv = manifest.resources.find((resource) => resource.key === "routing-kv");
@@ -375,17 +1011,16 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	const interactive = dependencies.interactive ?? process.stdin.isTTY;
 	const confirmAction = dependencies.confirm ?? promptForConfirmation;
 	if (createdZone && args.deleteZone === true) throw new Error(`platform: Refusing to delete Cloudflare zone ${JSON.stringify(createdZone.name)} automatically. A zone can contain unrelated DNS, settings, and products that the installer cannot exhaustively prove ownership of. Uninstall with --keep-zone, inspect the retained zone in Cloudflare, and delete it manually if appropriate.`);
-	await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust);
+	const zeroTrust = await assertProjectZeroTrustAllowsUninstall(dependencies.readProjectZeroTrust, { canTurnOff: !!dependencies.turnOffProjectZeroTrust });
 	if (purgeResources) await assertNoPlatformProjects(dependencies.readProjects);
-	const purgeResourcesClient = purgeResources ? requirePurgeResourcesClient(client) : null;
-	if (args.plan || interactive && !args.yes) note(purgeResources ? purgeResourcesPlanText(manifest) : [
+	if (args.plan || interactive && !args.yes) note([...zeroTrust ? zeroTrust.turnOff.length ? ["Turn off project Zero Trust; no platform user exists yet. Delete its Access applications:", formatZeroTrustApplications(zeroTrust.turnOff)] : ["Turn off project Zero Trust; no platform user exists yet."] : [], purgeResources ? purgeResourcesPlanText(manifest) : [
 		"Disable platform traffic.",
 		retainData ? "Keep Workers and data." : "Delete eligible data; keep Workers, R2, and AI Gateway.",
 		"Delete unused Queues.",
 		...describeKeptResources(manifest, plannedKeptResources(manifest, retainData, hasRoutingCheckpoint), "Keep for manual cleanup:", "Keep Access resources:")
-	].join("\n"), import_picocolors.default.bold("Uninstall plan"));
-	if (purgeResourcesClient) {
-		const credentialCheck = checkPurgeResourcesCredentials(purgeResourcesClient, manifest, dependencies.credential ?? {
+	].join("\n")].join("\n"), import_picocolors.default.bold("Uninstall plan"));
+	if (purgeResources) {
+		const credentialCheck = checkPurgeResourcesCredentials(client, manifest, dependencies.credential ?? {
 			source: "environment",
 			aiGatewayToken: false
 		});
@@ -399,7 +1034,6 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		return;
 	}
 	if (manifest !== initialManifest) writeInstallationManifest(manifest);
-	if (!interactive && !args.yes) throw new Error("platform: Non-interactive `void platform uninstall` requires --yes to acknowledge Cloudflare changes. Run with --plan first to inspect them.");
 	if (interactive && !args.yes) {
 		if (!await confirmAction(purgeResources ? "Permanently delete every Cloudflare resource this installation created?" : args.purgeData ? "Permanently purge installer-owned platform data?" : "Uninstall this platform?", false)) {
 			outro("No changes made.");
@@ -433,6 +1067,10 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 	}
 	const { fenceProjectZeroTrust, liftProjectZeroTrustFence, lockProjectZeroTrust } = dependencies;
 	if (!lockProjectZeroTrust || !fenceProjectZeroTrust || !liftProjectZeroTrustFence) throw new Error("platform: Refusing to uninstall because no platform database connection is available to hold off project Zero Trust changes.");
+	if (zeroTrust) {
+		log.step("Turning off project Zero Trust");
+		await dependencies.turnOffProjectZeroTrust();
+	}
 	const releaseProjectZeroTrust = await lockProjectZeroTrust();
 	let fenced = false;
 	let disablingTraffic = false;
@@ -455,7 +1093,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		throw error;
 	}
 	try {
-		await writeRemoteManifestIfPresent(client, next);
+		await saveRemoteManifest(next);
 		const routing = hasRoutingCheckpoint ? requireResource(next, "routing-kv") : void 0;
 		disablingTraffic = true;
 		if (routing) await client.putKvValue(next.account.id, routing.id, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
@@ -463,7 +1101,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		for (const key of missingResources) {
 			const resource = requireResource(next, key);
 			next = updateResourceState(next, key, resource.ownership === "created" ? "deleted" : "retained");
-			await writeLifecycleCheckpoint(client, next);
+			await saveCheckpoint(next);
 		}
 		const workers = new Set(next.resources.filter((resource) => resource.kind === "worker" && resource.state === "ready").map((resource) => resource.name));
 		const zone = next.resources.find((resource) => resource.key === "zone");
@@ -473,18 +1111,16 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 				"zone",
 				worker.key
 			]), { databaseUrl: dependencies.databaseUrl })).has(worker.key)) {
-				const trackedTraffic = trackedPlatformWorkerTraffic(next, /* @__PURE__ */ new Set([worker.name]));
-				await client.removeRoutes(next.account.id, zone.id, trackedTraffic);
 				next = markTrafficAttachmentsRetained(next);
 				next = recordLifecycleStep(next, `uninstall:routes:${worker.key}`);
-				await writeLifecycleCheckpoint(client, next);
+				await saveCheckpoint(next);
 			}
 		}
-		if (purgeResourcesClient && hasRoutingCheckpoint) next = await runPurgeResourcesTeardown({
-			client: purgeResourcesClient,
+		if (purgeResources && hasRoutingCheckpoint) next = await runPurgeResourcesTeardown({
+			client,
 			checkpoint: async (checkpointManifest) => {
 				next = checkpointManifest;
-				await writeLifecycleCheckpoint(client, checkpointManifest);
+				await saveCheckpoint(checkpointManifest);
 			},
 			verify: (checkpointManifest, keys) => verifyPlatformMutationOwnership(client, checkpointManifest, keys, {
 				allowDeletedRoutingCheckpoint: true,
@@ -518,18 +1154,18 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 			if (resource.state !== "ready") continue;
 			if (!hasRoutingCheckpoint && resource.kind !== "zone") {
 				next = updateResourceState(next, resource.key, "retained");
-				await writeLifecycleCheckpoint(client, next);
+				await saveCheckpoint(next);
 				continue;
 			}
 			if (!shouldDeleteResource(resource, retainData)) {
 				const removed = resource.kind === "ai-gateway" && resource.ownership === "created" && !hasNamedResource(await client.listAiGateways(next.account.id), resource);
 				next = updateResourceState(next, resource.key, removed ? "deleted" : "retained");
-				await writeLifecycleCheckpoint(client, next);
+				await saveCheckpoint(next);
 				continue;
 			}
 			if (resource.kind === "dns-record" && !zone || resource.kind === "queue" && queuesInUse) {
 				next = updateResourceState(next, resource.key, "retained");
-				await writeLifecycleCheckpoint(client, next);
+				await saveCheckpoint(next);
 				continue;
 			}
 			if ((await verifyPlatformMutationOwnership(client, next, /* @__PURE__ */ new Set(["routing-kv", resource.key]), {
@@ -537,15 +1173,15 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 				databaseUrl: dependencies.databaseUrl
 			})).has(resource.key)) {
 				next = updateResourceState(next, resource.key, resource.ownership === "created" ? "deleted" : "retained");
-				await writeLifecycleCheckpoint(client, next);
+				await saveCheckpoint(next);
 				continue;
 			}
 			await client.deleteResource(next.account.id, resource, zone?.id);
 			next = updateResourceState(next, resource.key, "deleted");
-			await writeLifecycleCheckpoint(client, next);
+			await saveCheckpoint(next);
 		}
 		const completed = transitionInstallation(next, "uninstalled", (/* @__PURE__ */ new Date()).toISOString());
-		await writeRemoteManifestIfPresent(client, completed);
+		await saveRemoteManifest(completed);
 		next = completed;
 		writeInstallationManifest(completed);
 		if (!retainData) removeInstallationRecoverySecrets(next);
@@ -557,7 +1193,7 @@ async function uninstallPlatform(client, initialManifest, args, dependencies = {
 		await stopProjectZeroTrustHold().catch(() => {});
 		next = transitionInstallation(next, "failed", (/* @__PURE__ */ new Date()).toISOString());
 		writeInstallationManifest(next);
-		await writeRemoteManifestIfPresent(client, next).catch(() => {});
+		await saveRemoteManifest(next).catch(() => {});
 		throw error;
 	}
 }
@@ -593,7 +1229,7 @@ async function recoverDurablyMarkedProvisionIntents(client, manifest) {
 			"r2-bucket",
 			manifest.deployment.resources.assetsBucket
 		]
-	].filter(([key, kind, name]) => !manifest.resources.some((resource) => resource.key === key) && manifest.steps.some((step) => (step.key === `provision-intent:${key}` || step.key.startsWith(`provision-intent:${key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, key, kind, name)));
+	].filter(([key, kind, name]) => !manifest.resources.some((resource) => resource.key === key) && hasProvisionIntentStep(manifest, key, kind, name));
 	if (pending.length === 0) return manifest;
 	const [workers, buckets] = await Promise.all([client.listWorkerNames(manifest.account.id), client.listR2Buckets(manifest.account.id)]);
 	let recovered = manifest;
@@ -604,10 +1240,7 @@ async function recoverDurablyMarkedProvisionIntents(client, manifest) {
 		} : null : buckets.find((bucket) => bucket.name === name) ?? null;
 		if (!live) continue;
 		const resource = {
-			configHash: createHash("sha256").update(JSON.stringify({
-				kind,
-				name
-			})).digest("hex"),
+			configHash: legacyResourceConfigHash(kind, name),
 			id: live.id,
 			key,
 			kind,
@@ -667,28 +1300,6 @@ function purgeResourcesPlanText(manifest) {
 		...permissions.length ? [`API token needs: ${permissions.join(", ")}. Browser login cannot delete DNS records or Access resources.`] : []
 	].join("\n");
 }
-function requirePurgeResourcesClient(client) {
-	if ([
-		"deleteAccessResource",
-		"deleteDispatchNamespaceScript",
-		"deleteEmailRoutingRule",
-		"deleteQueueConsumer",
-		"deleteR2Object",
-		"deleteWorkerDomain",
-		"deleteWorkerRoute",
-		"emptyR2Bucket",
-		"forceDeleteWorker",
-		"getAccessResource",
-		"getEmailRoutingCatchAll",
-		"listDispatchNamespaceScripts",
-		"listEmailRoutingRules",
-		"listQueueConsumers",
-		"listWorkerDependents",
-		"listWorkerRoutes",
-		"resetEmailRoutingCatchAll"
-	].some((method) => typeof client[method] !== "function")) throw new Error("platform: This Cloudflare client cannot run --purge-resources.");
-	return client;
-}
 function describeKeptResources(manifest, resources, heading, accessHeading, emailRulesRemoved = false) {
 	const sorted = [...resources].sort((left, right) => keptResourceRank(manifest, left) - keptResourceRank(manifest, right));
 	const isTraffic = (resource) => KEPT_RESOURCE_ORDER.indexOf(resource.kind) < KEPT_RESOURCE_ORDER.indexOf("queue");
@@ -753,7 +1364,7 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 			if (remote.id !== manifest.id || remote.ownershipNonce !== manifest.ownershipNonce || remote.account.id !== manifest.account.id) throw ownershipError("the remote installation identity does not match this installation");
 			if (targetResources.every((resource) => hasMatchingResourceProof(remote, resource))) break;
 		}
-		if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 50 * 2 ** attempt));
+		if (attempt < 2) await setTimeout(50 * 2 ** attempt);
 	}
 	if (rawRemote === null) {
 		if ((options.allowMissingRoutingCheckpoint || options.allowUninitializedRoutingCheckpoint) && routing.ownership === "created") {
@@ -800,10 +1411,7 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 				const live = await client.getHyperdriveConfig(accountId, resource.id);
 				exists = live.id === resource.id && live.name === resource.name;
 				if (exists) {
-					const legacyHash = createHash("sha256").update(JSON.stringify({
-						kind: resource.kind,
-						name: resource.name
-					})).digest("hex");
+					const legacyHash = legacyResourceConfigHash(resource.kind, resource.name);
 					const malformedLegacyHash = !/^[a-f0-9]{64}$/.test(resource.configHash);
 					if (options.databaseUrl && resource.ownership !== "adopted") {
 						const expected = hyperdriveOriginFromConnectionString(options.databaseUrl);
@@ -824,10 +1432,7 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 				exists = current !== void 0;
 				if (current && resource.ownership === "created") {
 					const liveHash = dnsRecordConfigHash(current.name, current.type, current.content, current.proxied);
-					const legacyHash = createHash("sha256").update(JSON.stringify({
-						kind: resource.kind,
-						name: resource.name
-					})).digest("hex");
+					const legacyHash = legacyResourceConfigHash(resource.kind, resource.name);
 					const expectedHash = dnsRecordConfigHash(resource.name, "AAAA", "100::", true);
 					if (liveHash !== resource.configHash && !(resource.configHash === legacyHash && liveHash === expectedHash)) throw new PlatformResourceChangedError(resource.key, "its configuration changed after installation", ownershipError(`dns-record ${resource.name} changed configuration after installation`).message);
 				}
@@ -839,12 +1444,7 @@ async function verifyPlatformMutationOwnership(client, manifest, targetKeys, opt
 			const live = r2Buckets.find((entry) => entry.id === resource.id && entry.name === resource.name);
 			exists = live !== void 0;
 			if (live) {
-				const liveHash = live.fingerprint ? r2BucketConfigHash(resource.name, live.fingerprint) : null;
-				const legacyHash = createHash("sha256").update(JSON.stringify({
-					kind: resource.kind,
-					name: resource.name
-				})).digest("hex");
-				if (liveHash === null || resource.configHash !== liveHash && resource.configHash !== legacyHash) throw ownershipError(`r2-bucket ${resource.name} changed creation fingerprint`);
+				if (!matchesRecordedR2Fingerprint(resource.configHash, live)) throw ownershipError(`r2-bucket ${resource.name} changed creation fingerprint`);
 				verifyResourceMarker(await client.getR2Object(accountId, resource.name, PLATFORM_R2_OWNERSHIP_MARKER_KEY), manifest, resource);
 			}
 		} else throw ownershipError(`live ownership checks do not support ${resource.kind}`);
@@ -857,10 +1457,7 @@ function hasMatchingResourceProof(manifest, resource) {
 	return proof?.id === resource.id && proof.kind === resource.kind && proof.name === resource.name && proof.ownership === resource.ownership;
 }
 function hasMatchingResourceIntent(manifest, resource) {
-	if (resource.ownership === "created") {
-		const previousResourceId = manifest.resources.find((entry) => entry.key === resource.key)?.id ?? null;
-		return manifest.steps.some((step) => (step.key === `provision-intent:${resource.key}` || step.key.startsWith(`provision-intent:${resource.key}:`)) && step.resultHash === platformProvisionIntentHash(manifest, resource.key, resource.kind, resource.name, previousResourceId));
-	}
+	if (resource.ownership === "created") return hasProvisionIntentStep(manifest, resource.key, resource.kind, resource.name);
 	if (resource.ownership === "adopted") return manifest.steps.some((step) => step.key === `adoption-intent:${resource.key}` && step.resultHash === platformAdoptionIntentHash(manifest, resource.key, resource.kind, resource.id, resource.name));
 	return false;
 }
@@ -877,40 +1474,9 @@ function isPlatformManifestMonotonicExtension(earlier, later) {
 function hasNamedResource(entries, resource) {
 	return entries.some((entry) => entry.id === resource.id && entry.name === resource.name);
 }
-function dnsRecordConfigHash(name, type, content, proxied) {
-	return createHash("sha256").update(JSON.stringify({
-		content,
-		kind: "dns-record",
-		name,
-		proxied,
-		type
-	})).digest("hex");
-}
-function r2BucketConfigHash(name, fingerprint) {
-	return createHash("sha256").update(JSON.stringify({
-		fingerprint,
-		kind: "r2-bucket",
-		name
-	})).digest("hex");
-}
 function verifyResourceMarker(value, manifest, resource) {
-	if (!value) throw ownershipError(`${resource.kind} ${resource.name} has no ownership marker`);
-	let actual;
-	try {
-		actual = parsePlatformResourceOwnershipMarker(JSON.parse(value));
-	} catch {
-		throw ownershipError(`${resource.kind} ${resource.name} has an invalid ownership marker`);
-	}
-	const expected = createPlatformResourceOwnershipMarker({
-		accountId: manifest.account.id,
-		installationId: manifest.id,
-		ownershipNonce: manifest.ownershipNonce,
-		resourceId: resource.id,
-		resourceKey: resource.key,
-		resourceKind: resource.kind,
-		resourceName: resource.name
-	});
-	if (JSON.stringify(actual) !== JSON.stringify(expected)) throw ownershipError(`${resource.kind} ${resource.name} belongs to another installation`);
+	const problem = resourceMarkerProblem(value, manifest, resource);
+	if (problem) throw ownershipError(`${resource.kind} ${resource.name} ${problem}`);
 }
 function canResumeAfterRoutingCheckpointDeletion(manifest, targetKeys) {
 	if (manifest.status !== "failed" && manifest.status !== "uninstalling") return false;
@@ -953,11 +1519,11 @@ function recordLifecycleStep(manifest, key) {
 		resultHash: "completed"
 	}, now);
 }
-async function writeLifecycleCheckpointWithoutDatabase(client, manifest, databaseCheckpoint) {
+async function writeLifecycleCheckpoint(client, manifest, databaseCheckpoint) {
 	writeInstallationManifest(manifest);
-	await writeRemoteManifestIfPresentWithoutDatabase(client, manifest, databaseCheckpoint);
+	await writeRemoteManifest(client, manifest, databaseCheckpoint);
 }
-async function writeRemoteManifestIfPresentWithoutDatabase(client, manifest, databaseCheckpoint) {
+async function writeRemoteManifest(client, manifest, databaseCheckpoint) {
 	await databaseCheckpoint?.(manifest);
 	const routing = manifest.resources.find((resource) => resource.key === "routing-kv" && resource.state !== "deleted");
 	if (routing) await client.putKvValue(manifest.account.id, routing.id, REMOTE_INSTALLATION_MANIFEST_KEY, JSON.stringify(manifest));