void 0.28.0 → 1.1.0

package/dist/{platform-lifecycle-DOW-wLfx.mjs → platform-lifecycle-DBiS0cJd.mjs}

@@ -3,17 +3,17 @@ import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
 import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D3m88sjf.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-FNHKw5Ac.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-BVdsO7Py.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-Ba6ZbrzY.mjs";
 import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-CeDWJRhj.mjs";
-import { d as resolvePinnedApiBaseUrl, i as createDefaultRunWrangler } from "./provision-DDh7ITVS.mjs";
-import { t as parsePlatformArgs } from "./platform-args-C6Mb_I3a.mjs";
+import { d as resolvePinnedApiBaseUrl, i as createDefaultRunWrangler } from "./provision-BnSSkiED.mjs";
+import { t as parsePlatformArgs } from "./platform-args-CaCL_1Ch.mjs";
 import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CqFBDo52.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-CTf6MMT9.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-YvN9VQXV.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
-import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY as REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationEndpoints, transitionInstallation } from "@void/platform";
+import { PLATFORM_APP_ACCESS_SETUP_PROOF_PREFIX, PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX, PLATFORM_AUTH_SETUP_PROOF_PREFIX, PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_LOGIN_KINDS, PLATFORM_R2_OWNERSHIP_MARKER_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY as REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, createPlatformInstallationManifest, createPlatformResourceNames, createPlatformResourceOwnershipMarker, createPlatformWorkerConfigs, isPlatformAccessCompanyIdentityProvider, isPlatformAccessEmailDomain, isPlatformAccessIdentityRule, normalizeApplicationDomain, normalizeInstallationSlug, normalizePlatformDashboardUrl, parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformAppAccessSetup, parsePlatformAuthenticationSetup, parsePlatformInstallationManifest, parsePlatformLoginConfiguration, parsePlatformResourceOwnershipMarker, platformDashboardUrl, recordInstallationResource, recordInstallationStep, setInstallationEndpoints, transitionInstallation } from "@void/platform";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
@@ -910,52 +910,41 @@ var PlatformAccessClient = class {
 		throw new Error("platform: Access inventory exceeded the supported pagination limit.");
 	}
 };
-/**
-* Project Zero Trust keeps its own, broader copy of this list in
-* platform/packages/api/src/zero-trust/cloudflare.ts; review both when adding
-* a rule type.
-*/
-function identityRule(rule) {
-	if (rule.email_domain) {
-		const domain = object(rule.email_domain, "email domain").domain;
-		return typeof domain === "string" && /^(?:[a-z0-9-]+\.)+[a-z]{2,63}$/i.test(domain);
-	}
-	if (rule.email) {
-		const email = object(rule.email, "email rule").email;
-		return typeof email === "string" && /^[^\s*@]+@[^\s*@]+\.[^\s*@]+$/.test(email);
-	}
-	return [
-		"email",
-		"email_domain",
-		"email_list",
-		"gsuite",
-		"github-organization",
-		"saml",
-		"okta",
-		"group"
-	].some((key) => Object.hasOwn(rule, key) && !!rule[key] && typeof rule[key] === "object" && !Array.isArray(rule[key]) && Object.keys(rule[key]).length > 0);
-}
+/** The selected providers or policies cannot protect Void; other errors are not about the selection. */
+var PlatformAccessPolicyRejectedError = class extends Error {};
 /** Preserve corporate MFA/device requirements; reject broad policies rather than rewriting them. */
-async function verifyCompanyAccessPolicies(client, policies) {
+async function verifyCompanyAccessPolicies(client, policies, identityProviderIds, identityProviders) {
+	const companyProviders = new Set((identityProviders ?? await client.list("identity_providers")).filter(isPlatformAccessCompanyIdentityProvider).map((provider) => provider.id));
+	const selectedCompanyProviders = new Set(identityProviderIds.filter((id) => companyProviders.has(id)));
+	const identityRule = (entry, name, providers = selectedCompanyProviders) => {
+		const rule = object(entry, name);
+		const entra = rule.azureAD || rule.auth_context;
+		if (entra) {
+			const id = typeof entra === "object" ? entra.identity_provider_id : null;
+			return typeof id === "string" && providers.has(id);
+		}
+		return isPlatformAccessIdentityRule(rule, (id) => providers.has(id));
+	};
+	const restricted = (target, providers) => Array.isArray(target.include) && target.include.length > 0 && (Array.isArray(target.require) && target.require.some((entry) => identityRule(entry, "policy rule", providers)) || target.include.every((entry) => identityRule(entry, "policy rule", providers)));
 	const groups = /* @__PURE__ */ new Set();
 	const checkedGroups = /* @__PURE__ */ new Set();
 	const checkRules = async (value, depth = 0) => {
 		if (value === void 0) return;
-		if (!Array.isArray(value) || value.length > 100 || depth > 8) throw new Error("platform: Unsupported Access policy rule structure.");
+		if (!Array.isArray(value) || value.length > 100 || depth > 8) throw new PlatformAccessPolicyRejectedError("platform: Unsupported Access policy rule structure.");
 		for (const entry of value) {
 			const rule = object(entry, "policy rule");
-			if (Object.hasOwn(rule, "everyone") || Object.hasOwn(rule, "any_valid_service_token")) throw new Error("platform: Company Access policies must not allow Everyone or any valid service token.");
+			if (Object.hasOwn(rule, "everyone") || Object.hasOwn(rule, "any_valid_service_token")) throw new PlatformAccessPolicyRejectedError("platform: Company Access policies must not allow Everyone or any valid service token.");
 			if (rule.group) {
 				const id = text(object(rule.group, "Access group").id, "Access group ID");
-				if (groups.has(id)) throw new Error("platform: Access groups contain a recursive membership rule.");
+				if (groups.has(id)) throw new PlatformAccessPolicyRejectedError("platform: Access groups contain a recursive membership rule.");
 				if (checkedGroups.has(id)) continue;
-				if (checkedGroups.size >= 100) throw new Error("platform: Access group policy exceeds the inspection limit.");
+				if (checkedGroups.size >= 100) throw new PlatformAccessPolicyRejectedError("platform: Access group policy exceeds the inspection limit.");
 				groups.add(id);
 				const group = object(await client.get(`groups/${encodeURIComponent(id)}`), "Access group");
 				await checkRules(group.include, depth + 1);
 				await checkRules(group.require, depth + 1);
-				if (!Array.isArray(group.include) || !group.include.length) throw new Error("platform: Access groups must contain explicit identity rules.");
-				if (!(Array.isArray(group.require) && group.require.some((entry) => identityRule(object(entry, "group rule")))) && !group.include.every((entry) => identityRule(object(entry, "group rule")))) throw new Error("platform: Access groups must restrict company identities.");
+				if (!Array.isArray(group.include) || !group.include.length) throw new PlatformAccessPolicyRejectedError("platform: Access groups must contain explicit identity rules.");
+				if (!(Array.isArray(group.require) && group.require.some((entry) => identityRule(entry, "group rule"))) && !group.include.every((entry) => identityRule(entry, "group rule"))) throw new PlatformAccessPolicyRejectedError("platform: Access groups must restrict company identities.");
 				groups.delete(id);
 				checkedGroups.add(id);
 			}
@@ -968,15 +957,15 @@ async function verifyCompanyAccessPolicies(client, policies) {
 			"deny",
 			"non_identity",
 			"bypass"
-		].includes(String(policy.decision))) throw new Error("platform: Unsupported Access policy decision.");
-		if (policy.decision === "bypass") throw new Error("platform: A bypass policy cannot protect a Void platform.");
+		].includes(String(policy.decision))) throw new PlatformAccessPolicyRejectedError("platform: Unsupported Access policy decision.");
+		if (policy.decision === "bypass") throw new PlatformAccessPolicyRejectedError("platform: A bypass policy cannot protect a Void platform.");
 		if (policy.decision !== "allow") continue;
 		allows++;
 		await checkRules(policy.include);
 		await checkRules(policy.require);
-		if (!Array.isArray(policy.include) || !policy.include.length || !(Array.isArray(policy.require) && policy.require.some((entry) => identityRule(object(entry, "policy rule")))) && !policy.include.every((entry) => identityRule(object(entry, "policy rule")))) throw new Error("platform: Select Access allow policies restricted to company identities.");
+		if (!restricted(policy)) throw new PlatformAccessPolicyRejectedError(restricted(policy, companyProviders) ? "platform: An Access allow policy uses an identity provider that is not one of the selected identity providers." : "platform: Select Access allow policies restricted to company identities.");
 	}
-	if (!allows) throw new Error("platform: Select at least one company Access allow policy.");
+	if (!allows) throw new PlatformAccessPolicyRejectedError("platform: Select at least one company Access allow policy.");
 }
 function platformAccessPublicDestinations(application) {
 	const destinations = Array.isArray(application.destinations) ? application.destinations : [];
@@ -1001,6 +990,19 @@ function platformAccessCreateRejected(error) {
 		429
 	].includes(error.status);
 }
+/** Read reusable policies by ID and check that together they admit only company identities. */
+async function verifySelectedAccessPolicies(client, policyIds, identityProviderIds, identityProviders) {
+	const policies = await Promise.all(policyIds.map(async (id) => {
+		try {
+			return object(await client.get(`policies/${encodeURIComponent(id)}`), "Access policy");
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) throw new PlatformAccessPolicyRejectedError(`platform: The selected Access policy ${encodeURIComponent(id)} is unavailable in this account.`, { cause: error });
+			throw error;
+		}
+	}));
+	await verifyCompanyAccessPolicies(client, policies, identityProviderIds, identityProviders);
+	return policies;
+}
 async function inspectPlatformAccess(client, input) {
 	const authDomain = text(object(await client.get("organizations"), "Access organization").auth_domain, "Access team domain");
 	const teamDomain = authDomain.startsWith("https://") ? authDomain : `https://${authDomain}`;
@@ -1011,15 +1013,14 @@ async function inspectPlatformAccess(client, input) {
 			audience: "validation"
 		}]
 	});
-	const identityProviders = (await client.list("identity_providers")).map(platformAccessIdentityProvider);
-	if (!input.identityProviderIds.length || !input.policyIds.length || input.identityProviderIds.length > 16 || input.policyIds.length > 16 || new Set(input.identityProviderIds).size !== input.identityProviderIds.length || new Set(input.policyIds).size !== input.policyIds.length) throw new Error("platform: Select explicit identity providers and company policies for Access.");
-	if (input.identityProviderIds.some((id) => !identityProviders.some((provider) => provider.id === id))) throw new Error("platform: A selected Access identity provider is unavailable in this account.");
-	const policies = await Promise.all(input.policyIds.map(async (id) => object(await client.get(`policies/${encodeURIComponent(id)}`), "Access policy")));
-	await verifyCompanyAccessPolicies(client, policies);
+	const providers = await client.list("identity_providers");
+	const identityProviders = providers.map(platformAccessIdentityProvider);
+	if (!input.identityProviderIds.length || !input.policyIds.length || input.identityProviderIds.length > 16 || input.policyIds.length > 16 || new Set(input.identityProviderIds).size !== input.identityProviderIds.length || new Set(input.policyIds).size !== input.policyIds.length) throw new PlatformAccessPolicyRejectedError("platform: Select explicit identity providers and company policies for Access.");
+	if (input.identityProviderIds.some((id) => !identityProviders.some((provider) => provider.id === id))) throw new PlatformAccessPolicyRejectedError("platform: A selected Access identity provider is unavailable in this account.");
 	return {
 		teamDomain,
 		identityProviders,
-		policies
+		policies: await verifySelectedAccessPolicies(client, input.policyIds, input.identityProviderIds, providers)
 	};
 }
 async function provisionPlatformAccess(client, input, previous, save) {
@@ -1259,7 +1260,7 @@ async function provisionPlatformAccess(client, input, previous, save) {
 async function verifyPlatformAccessApplication(client, input, app, type, machineId) {
 	if (app.type !== type || !sameSet(ids(app.allowed_idps), input.identityProviderIds)) throw new Error("platform: Access application identity-provider configuration does not match the reviewed plan.");
 	const currentPolicies = await client.list(`apps/${encodeURIComponent(text(app.id, "application ID"))}/policies`);
-	await verifyCompanyAccessPolicies(client, currentPolicies);
+	await verifyCompanyAccessPolicies(client, currentPolicies, input.identityProviderIds);
 	if (!sameSet(currentPolicies.filter((policy) => policy.decision === "allow" || policy.decision === "deny").map((policy) => text(policy.id, "policy ID")), input.policyIds)) throw new Error("platform: Access application policies do not match the reviewed company policies.");
 	for (const policy of currentPolicies.filter((policy) => policy.decision === "non_identity")) {
 		const includes = Array.isArray(policy.include) ? policy.include : [];
@@ -1275,7 +1276,13 @@ function accessSetupGuide() {
 		url: "https://void.cloud/guide/platform/installation/setup#cloudflare-access"
 	});
 }
-async function selectCompanyAccessPolicies(client, initialPolicies, accountId, mode) {
+/** Parse up to ten exact company email domains, or return undefined when any entry is invalid. */
+function companyEmailDomains(value) {
+	const domains = [...new Set(value.split(/[\s,]+/).map((entry) => entry.trim().replace(/^@/, "").toLowerCase()).filter(Boolean))];
+	return domains.length && domains.length <= 10 && domains.every(isPlatformAccessEmailDomain) ? domains : void 0;
+}
+async function selectCompanyAccessPolicies(client, initialPolicies, accountId, mode, identityProviderIds) {
+	const emailDomain = "__email_domain__";
 	const create = "__create__";
 	const refresh = "__refresh__";
 	let policies = initialPolicies;
@@ -1287,14 +1294,22 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 		}));
 		const available = new Set(options.map((option) => option.value));
 		selectedIds = selectedIds.filter((id) => available.has(id));
-		const actions = [{
-			value: create,
-			label: "Create new",
-			hint: "Set up a policy in Cloudflare, then return here"
-		}, {
-			value: refresh,
-			label: "Refresh list"
-		}];
+		const actions = [
+			...mode === "create" ? [{
+				value: emailDomain,
+				label: "Allow my company’s email domain",
+				hint: "Void creates this Allow policy for you"
+			}] : [],
+			{
+				value: create,
+				label: "Create in Cloudflare",
+				hint: "Set up a policy in Cloudflare, then return here"
+			},
+			{
+				value: refresh,
+				label: "Refresh list"
+			}
+		];
 		let choices;
 		if (options.length === 0) {
 			log.info("No reusable Allow or Deny policies were found in this account. Create an Allow policy for your company, or refresh after saving one.");
@@ -1309,7 +1324,26 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 			required: true
 		}));
 		selectedIds = choices.filter((id) => available.has(id));
-		if (choices.includes(create)) {
+		if (choices.includes(emailDomain)) {
+			const domains = companyEmailDomains(platformPromptAnswer(await text$1({
+				message: "Company email domains (comma-separated):",
+				placeholder: "example.com",
+				validate: (value) => companyEmailDomains(value ?? "") ? void 0 : "Enter up to 10 email domains, such as example.com."
+			})));
+			const name = `Emails ending in @${domains[0]}${domains.length > 1 ? ` and ${domains.length - 1} more` : ""}`;
+			try {
+				const created = await client.create("policies", {
+					name,
+					decision: "allow",
+					include: domains.map((domain) => ({ email_domain: { domain } }))
+				});
+				if (typeof created?.id === "string" && created.id) selectedIds.push(created.id);
+				log.info(`Created the Access policy “${name}” in Cloudflare. It stays there for reuse; you can add MFA or device rules to it later.`);
+			} catch (error) {
+				if (!(error instanceof PlatformCloudflareApiError)) throw error;
+				log.warn(`${error.message} Choose “Create in Cloudflare” instead.`);
+			}
+		} else if (choices.includes(create)) {
 			note([
 				"1. Open Zero Trust → Access controls → Policies → Add a policy in this account.",
 				"2. Name the policy and choose Allow.",
@@ -1325,7 +1359,13 @@ async function selectCompanyAccessPolicies(client, initialPolicies, accountId, m
 				message: "Have you saved the new policy?",
 				initialValue: true
 			}))) continue;
-		} else if (!choices.includes(refresh)) return selectedIds;
+		} else if (!choices.includes(refresh)) try {
+			await verifySelectedAccessPolicies(client, selectedIds, identityProviderIds);
+			return selectedIds;
+		} catch (error) {
+			if (!(error instanceof PlatformAccessPolicyRejectedError) && !(error instanceof PlatformCloudflareApiError && error.status === 404)) throw error;
+			log.warn(`${error.message.replace(/^platform: /, "")} Choose other policies, or fix the policy in Cloudflare and refresh the list.`);
+		}
 		policies = await client.list("policies");
 	}
 }
@@ -1518,7 +1558,7 @@ async function preparePlatformAccessSetup(input) {
 		input.save({ accessSetupSpecJson: JSON.stringify(spec) });
 	}
 	if (!spec.policyIds && process.stdin.isTTY) log.info("Choose which existing access rules apply to this platform, including MFA and device requirements.");
-	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? await selectCompanyAccessPolicies(client, policies, accountId, spec.mode) : []);
+	const policyIds = spec.policyIds ?? (process.stdin.isTTY ? await selectCompanyAccessPolicies(client, policies, accountId, spec.mode, identityProviderIds) : []);
 	if (!identityProviderIds.length || !policyIds.length) throw new Error("platform: Access setup requires explicit identityProviderIds and policyIds.");
 	spec = {
 		...spec,
@@ -1578,6 +1618,7 @@ async function preparePlatformAccessSetup(input) {
 		loginClientSecret = platformPromptAnswer(await password({ message: "Existing Access OIDC client secret:" }));
 		input.save({ accessExistingLoginSecret: loginClientSecret });
 	}
+	let provisioning = previous;
 	const result = await provisionPlatformAccess(client, {
 		accountId,
 		installationId: input.plan.installationId,
@@ -1593,7 +1634,18 @@ async function preparePlatformAccessSetup(input) {
 		} } : {},
 		...input.protection ? { protection: { applicationId: spec.protectionApplicationId } } : {},
 		serviceToken
-	}, previous, (state) => input.save({ accessProvisioningJson: JSON.stringify(state) }));
+	}, previous, (state) => {
+		provisioning = state;
+		input.save({ accessProvisioningJson: JSON.stringify(state) });
+	}).catch((error) => {
+		if (!(error instanceof PlatformAccessPolicyRejectedError)) throw error;
+		if (!input.spec && process.stdin.isTTY && !Object.keys(provisioning.resources).length) {
+			const { identityProviderIds: _providers, policyIds: _policies, ...unpicked } = spec;
+			input.save({ accessSetupSpecJson: JSON.stringify(unpicked) });
+			throw new PlatformAccessPolicyRejectedError(`${error.message} Choose other policies when you run the command again, or fix the policy in Cloudflare.`, { cause: error });
+		}
+		throw new PlatformAccessPolicyRejectedError(`${error.message} Fix the selected policy in Cloudflare, then resume.`, { cause: error });
+	});
 	if (result.credentials) {
 		const accessCredentialsJson = JSON.stringify(result.credentials);
 		input.save({ accessCredentialsJson });
@@ -1894,7 +1946,7 @@ async function prepareInstallationAppAccess(input) {
 		}
 		if (!policyIds.length) {
 			if (!process.stdin.isTTY) throw new Error("platform: Set appAccess.policyIds in --auth-config for the hosting account.");
-			policyIds = await selectCompanyAccessPolicies(access, await access.list("policies"), input.plan.account.id, "create");
+			policyIds = await selectCompanyAccessPolicies(access, await access.list("policies"), input.plan.account.id, "create", identityProviderIds);
 			input.save({ appAccessPolicyIds: JSON.stringify(policyIds) });
 		}
 	} else log.info("This account requires Access. Void will create public rules scoped to app hostnames.");
@@ -1961,6 +2013,37 @@ async function initializeInstalledAppAccess(input, fetcher = fetch) {
 	}
 	throw new Error("platform: App access setup is safely checkpointed. Resume installation to finish before app traffic opens.");
 }
+/**
+* Turn off the project Zero Trust the installer enabled, for an uninstall
+* before any platform user exists. Signed with the app access setup authority
+* that turned it on.
+*/
+async function turnOffInstalledProjectZeroTrust(input, fetcher = fetch) {
+	const body = JSON.stringify({ version: 1 });
+	const signature = createHmac("sha256", input.setupToken).update(`${PLATFORM_APP_ACCESS_TURN_OFF_PROOF_PREFIX}\n${input.installationId}\n${body}`).digest("base64url");
+	const response = await fetcher(new URL("/internal/platform/app-access/turn-off", input.apiUrl), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"X-Void-Platform-Probe": input.probeToken,
+			"X-Void-App-Access-Setup": signature,
+			...cfAccessHeaders(process.env, input.apiUrl)
+		},
+		body,
+		redirect: "manual",
+		signal: AbortSignal.timeout(6e4)
+	});
+	let result = {};
+	try {
+		result = await response.json();
+	} catch {}
+	if (response.status === 404 || response.status === 503 && result.error === "Platform disabled" || response.status === 403 && result.error === "access_human_identity_required") throw new Error(`platform: This platform runtime cannot turn off project Zero Trust before an administrator exists. Run \`${input.updateCommand}\`, then retry the uninstall.`);
+	if (result.code === "users_exist") throw new Error("platform: A platform user exists, so an administrator must turn off project Zero Trust. Run `void platform zero-trust disable`, then retry the uninstall.");
+	if (result.code === "app_access_credentials") throw new Error("platform: Cloudflare rejected the saved app access token, so Void cannot turn off project Zero Trust.");
+	if (!response.ok || result.installationId !== input.installationId) throw new Error(`platform: ${result.error || `Turning off project Zero Trust failed (HTTP ${response.status}).`}`);
+	if (!result.turnedOff) throw new Error("platform: Project Zero Trust is still turning off. Rerun the uninstall.");
+	if (result.usersExist) throw new Error("platform: A platform user signed in while project Zero Trust was turning off, so the uninstall stopped. Project Zero Trust is now off and the platform still runs. To keep the platform, an administrator can turn project Zero Trust back on in Admin → Zero Trust or with `void platform zero-trust configure`. To remove it, run the uninstall again.");
+}
 //#endregion
 //#region src/cli/platform-auth-bootstrap.ts
 /** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
@@ -2670,7 +2753,7 @@ function addNamedPlan(context, target) {
 		const remotelyOwned = remoteOwnership?.resources.some((resource) => resource.key === key && resource.kind === kind && resource.id === remote.id && resource.name === name && resource.ownership === "created");
 		const markedProvision = existing !== null && hasUnrecordedProvisionIntent(existing, key, kind, name) && intentProofs.has(key);
 		const ambiguousProvision = existing !== null && options?.authoritativeProvisionIntents === true && isLegacyUniqueProvisionAttempt(existing, key, kind, name) && hasAmbiguousProvisionIntent(existing, key, kind, remote.id, name);
-		if ((!recorded || recorded.id !== remote.id || recorded.kind !== kind) && !remotelyOwned && !markedProvision && !ambiguousProvision) throw new Error(`platform: ${kind} ${JSON.stringify(name)} already exists but is not owned by this installation. Resume the owning installation, or choose another installation name. Nothing was overwritten.`);
+		if ((!recorded || recorded.id !== remote.id || recorded.kind !== kind) && !remotelyOwned && !markedProvision && !ambiguousProvision) throw new Error(existing !== null && hasUnrecordedProvisionIntent(existing, key, kind, name) ? `platform: ${kind} ${JSON.stringify(name)} already exists, and Void cannot tell whether this installation created it. Nothing was overwritten. If an earlier failed attempt of this installation created it, delete it in the Cloudflare dashboard, then rerun the command. Otherwise, choose another installation name.` : `platform: ${kind} ${JSON.stringify(name)} already exists but is not owned by this installation. Resume the owning installation, or choose another installation name. Nothing was overwritten.`);
 		if (ambiguousProvision && !markedProvision && !remotelyOwned) {
 			actions.push({
 				action: "create",
@@ -3268,6 +3351,7 @@ function createPlatformInstallationSecrets(input) {
 		return value;
 	};
 	const existingInstallation = input.existingInstallation === true;
+	const generateIdentityKeys = input.generateIdentityKeys === true && !existingInstallation;
 	const restoredIdentity = (explicit, name) => existingInstallation ? checkpoint[name] || explicit || "" : explicit || checkpoint[name] || "";
 	const configured = (explicit, name) => explicit || checkpoint[name] || "";
 	const authenticationSetupJson = configured(input.authenticationSetupJson ?? "", "authenticationSetupJson");
@@ -3279,7 +3363,7 @@ function createPlatformInstallationSecrets(input) {
 		const setup = parsePlatformAuthenticationSetup(JSON.parse(authenticationSetupJson));
 		if (!existingInstallation && createHash("sha256").update(authBootstrapCode).digest("hex") !== setup.bootstrapCredentialHash) throw new Error("platform: Valid installation setup authority and a matching administrator setup code are required.");
 	}
-	const jwtSecret = restoredIdentity(input.jwtSecret || "", "jwtSecret");
+	const jwtSecret = restoredIdentity(input.jwtSecret || "", "jwtSecret") || (generateIdentityKeys ? randomBytes(32).toString("base64") : "");
 	const resolvedJwtSecret = input.existingInstallation ? jwtSecret : required(jwtSecret, "VOID_PLATFORM_JWT_SECRET");
 	if (!existingInstallation && Buffer.byteLength(resolvedJwtSecret, "utf8") < 32) throw new Error("platform: VOID_PLATFORM_JWT_SECRET must contain at least 32 bytes of secret material unique to this installation.");
 	const emailEnabled = input.emailEnabled === true;
@@ -3295,6 +3379,7 @@ function createPlatformInstallationSecrets(input) {
 	const projectSecretKeyring = resolveProjectSecretKeyring({
 		checkpoint,
 		existingInstallation,
+		generateIdentityKeys,
 		projectSecretActiveKeyVersion: input.projectSecretActiveKeyVersion || "",
 		projectSecretKey: input.projectSecretKey || "",
 		projectSecretKeysJson: input.projectSecretKeysJson || "",
@@ -3356,7 +3441,7 @@ function resolveProjectSecretKeyring(input) {
 	if (!explicitFullKeyring && (checkpointKeysJson !== "" || checkpointActiveVersion !== "") && (!checkpointKeysJson || !checkpointActiveVersion)) throw new Error("platform: Encrypted recovery material must contain both the project-secret keyring and its active version.");
 	if (explicitFullKeyring) return normalizeProjectSecretKeyring(input.projectSecretKeysJson, input.projectSecretActiveKeyVersion, "VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON", "VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION");
 	if (checkpointKeysJson) return normalizeProjectSecretKeyring(checkpointKeysJson, checkpointActiveVersion, "encrypted recovery project-secret keyring", "encrypted recovery project-secret active version");
-	const v1Key = input.existingInstallation ? input.checkpoint.projectSecretKey || input.projectSecretKey || "" : input.required(input.projectSecretKey || input.checkpoint.projectSecretKey || "", "VOID_PLATFORM_PROJECT_SECRET_KEY");
+	const v1Key = input.existingInstallation ? input.checkpoint.projectSecretKey || input.projectSecretKey || "" : input.required(input.projectSecretKey || input.checkpoint.projectSecretKey || (input.generateIdentityKeys ? randomBytes(32).toString("base64") : ""), "VOID_PLATFORM_PROJECT_SECRET_KEY");
 	if (!v1Key) return {
 		activeVersion: "",
 		keysJson: "",
@@ -3559,13 +3644,15 @@ function createPlatformHealthProbeToken(ownershipNonce) {
 }
 //#endregion
 //#region src/cli/platform-installer-errors.ts
+const ANALYTICS_ENGINE_NOT_ENABLED = 10089;
 function assertCleanPlatformWrangler(result, operation) {
 	if (result.status !== 0 || result.signal || result.error) {
 		const diagnostic = cloudflareCommandDiagnostic({
 			...result,
 			stderr: result.stderr.trim() || result.errors?.map((error) => error.message).join("\n") || ""
 		});
-		throw new Error(`platform: Wrangler failed to ${operation} (${diagnostic || `exit ${result.status}`}).`);
+		const analyticsEngineDisabled = result.errorCode === ANALYTICS_ENGINE_NOT_ENABLED || result.errors?.some((error) => error.code === ANALYTICS_ENGINE_NOT_ENABLED) || /\b10089\b/.test(diagnostic ?? "");
+		throw new Error(`platform: Wrangler failed to ${operation} (${diagnostic || `exit ${result.status}`}).` + (analyticsEngineDisabled ? " If the Analytics Engine page offers no way to enable it, follow https://void.cloud/guide/platform/installation/prerequisites#if-cloudflare-rejects-analytics-engine, then retry." : ""));
 	}
 }
 function assertPlatformTriggerStabilization(result, workerName, targetVersionId, operation) {
@@ -5200,7 +5287,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-D5wvsI-Y.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BXwZiJSF.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -5544,9 +5631,10 @@ function projectZeroTrustUninstallState(setting, projectRows) {
 /** Read the project Zero Trust state from the platform database. */
 async function readPlatformProjectZeroTrustStateConnection(client) {
 	const present = (await client.query(`SELECT to_regclass('public.platform_settings') IS NOT NULL AS "settings",
-            to_regclass('public.project_zero_trust') IS NOT NULL AS "projects"`)).rows[0];
+            to_regclass('public.project_zero_trust') IS NOT NULL AS "projects",
+            to_regclass('public.users') IS NOT NULL AS "users"`)).rows[0];
 	if (!present) throw new Error("the database did not report its Zero Trust tables");
-	return projectZeroTrustUninstallState(present.settings ? (await client.query("SELECT \"value\" FROM \"platform_settings\" WHERE \"key\" = $1", [ZERO_TRUST_SETTING])).rows[0]?.value : void 0, present.projects ? (await client.query(`SELECT z."project_id", p."slug" AS "project_slug", p."status" AS "project_status",
+	const state = projectZeroTrustUninstallState(present.settings ? (await client.query("SELECT \"value\" FROM \"platform_settings\" WHERE \"key\" = $1", [ZERO_TRUST_SETTING])).rows[0]?.value : void 0, present.projects ? (await client.query(`SELECT z."project_id", p."slug" AS "project_slug", p."status" AS "project_status",
                   z."bypass_application_id", z."bypass_application_name",
                   z."protected_application_id", z."protected_application_name"
            FROM "project_zero_trust" z
@@ -5556,6 +5644,12 @@ async function readPlatformProjectZeroTrustStateConnection(client) {
               OR z."protected_application_id" IS NOT NULL
               OR z."protected_application_name" IS NOT NULL
            ORDER BY z."project_id"`)).rows : []);
+	if (!state.active) return state;
+	const usersExist = present.users ? (await client.query("SELECT EXISTS(SELECT 1 FROM \"users\") AS \"present\"")).rows[0]?.present === true : false;
+	return {
+		...state,
+		usersExist
+	};
 }
 /**
 * Take the Zero Trust configuration lock exclusively on this session. Every
@@ -5594,7 +5688,7 @@ async function liftPlatformProjectZeroTrustFenceConnection(client) {
 	if (!await hasSettingsTable(client)) return;
 	await client.query("DELETE FROM \"platform_settings\" WHERE \"key\" = $1", [UNINSTALL_SETTING]);
 }
-function formatApplications(applications) {
+function formatZeroTrustApplications(applications) {
 	const lines = applications.slice(0, LISTED_APPLICATIONS).map((application) => `  ${application.role}: ${application.name ?? "(name not recorded)"}${application.id ? ` (${application.id})` : ""}`);
 	if (applications.length > LISTED_APPLICATIONS) lines.push(`  …and ${applications.length - LISTED_APPLICATIONS} more`);
 	return lines.join("\n");
@@ -5607,21 +5701,24 @@ function unfinishedDeletionLines(state) {
 /**
 * Refuse to uninstall while project Zero Trust still owns Access applications,
 * or while its state cannot be read. Runs before uninstall changes anything.
+* With `canTurnOff`, enabled Zero Trust on a platform no user has signed in to
+* is not refused: the applications uninstall must turn off are returned.
 */
-async function assertProjectZeroTrustAllowsUninstall(read) {
+async function assertProjectZeroTrustAllowsUninstall(read, options = {}) {
 	const state = await readPlatformDatabase(read, (reason) => [
 		`platform: Refusing to uninstall because the project Zero Trust state could not be read from the platform database: ${reason}`,
 		"Uninstall turns off the platform API, which Void needs to remove the Cloudflare Access applications that project Zero Trust created.",
 		"Make the installation database reachable (export VOID_PLATFORM_DATABASE_URL if this machine has not recorded it), then retry. If project Zero Trust was ever enabled, run `void platform zero-trust disable` first."
 	].join("\n"));
+	if (state.active && state.usersExist === false && options.canTurnOff) return { turnOff: state.applications };
 	if (state.active) {
 		const covered = state.destinations.length ? ` on ${state.destinations.join(" and ")}` : " on every hostname under the application domain";
 		throw new Error([
 			"platform: Refusing to uninstall while project Zero Trust is enabled or still changing.",
 			`Uninstall turns off the platform API, so Void could no longer remove its Cloudflare Access applications, and Access would keep asking for sign-in${covered}, including hostnames Void does not serve.`,
-			"Run `void platform zero-trust disable`, rerun it until `void platform zero-trust status` reports Zero Trust disabled with no operation running, then retry the uninstall.",
+			state.usersExist === false ? "No platform user exists yet. Run this command on the computer that installed the platform; it keeps the authority to turn off project Zero Trust." : "Run `void platform zero-trust disable`, rerun it until `void platform zero-trust status` reports Zero Trust disabled with no operation running, then retry the uninstall.",
 			"If the platform API does not answer, bring it back with `void platform enable` or `void platform repair` first.",
-			...state.applications.length ? ["Void-managed Access applications:", formatApplications(state.applications)] : [],
+			...state.applications.length ? ["Void-managed Access applications:", formatZeroTrustApplications(state.applications)] : [],
 			...unfinishedDeletionLines(state),
 			DASHBOARD_HINT
 		].join("\n"));
@@ -5630,7 +5727,7 @@ async function assertProjectZeroTrustAllowsUninstall(read) {
 		"platform: Refusing to uninstall while Void-managed Access applications from project Zero Trust remain.",
 		"Zero Trust is disabled, but it could not remove the applications of some projects. Retry the uninstall once they are gone.",
 		"Void-managed Access applications:",
-		formatApplications(state.applications),
+		formatZeroTrustApplications(state.applications),
 		...state.applications.some((application) => !application.deleting) ? [`Hourly maintenance retries ${state.unfinishedDeletions.length ? "the other applications" : "them"} while the platform is enabled, and clears Void's records of any you delete in the dashboard.`] : [],
 		...unfinishedDeletionLines(state),
 		DASHBOARD_HINT
@@ -5797,6 +5894,18 @@ function readPlatformProjectZeroTrustState(databaseUrl, installationId, ownershi
 function readPlatformProjectSlugs(databaseUrl, installationId, ownershipNonce) {
 	return readClaimedPlatformDatabase(databaseUrl, installationId, ownershipNonce, readPlatformProjectSlugsConnection);
 }
+/** Read the first administrator setup row and whether any user exists. */
+async function readPlatformAdministratorSetupConnection(client) {
+	const present = (await client.query(`SELECT to_regclass('public.platform_auth_bootstrap') IS NOT NULL AS "setup",
+            to_regclass('public.users') IS NOT NULL AS "users"`)).rows[0];
+	const setup = present?.setup ? (await client.query("SELECT \"request_hash\", \"consumed_at\" FROM \"platform_auth_bootstrap\" WHERE \"singleton\" = true")).rows[0] : void 0;
+	const usersExist = present?.users ? (await client.query("SELECT EXISTS(SELECT 1 FROM \"users\") AS \"present\"")).rows[0]?.present === true : false;
+	return {
+		pending: !!setup && setup.consumed_at === null,
+		usersExist,
+		requestHash: setup?.request_hash ?? null
+	};
+}
 /** Slugs of every project row, including projects whose deletion stopped partway. */
 async function readPlatformProjectSlugsConnection(client) {
 	if ((await client.query(`SELECT to_regclass('public.projects') IS NOT NULL AS "present"`)).rows[0]?.present !== true) return [];
@@ -5927,6 +6036,7 @@ async function acquirePlatformDatabaseLifecycleLockConnection(client, installati
 			protection: parsePlatformAccessProtection(settings.protection)
 		} : null;
 	};
+	release.readAdministratorSetup = () => readPlatformAdministratorSetupConnection(client);
 	release.readProjectZeroTrust = () => readPlatformProjectZeroTrustStateConnection(client);
 	release.readProjects = () => readPlatformProjectSlugsConnection(client);
 	release.lockProjectZeroTrust = () => lockPlatformProjectZeroTrustConnection(client);
@@ -6129,7 +6239,7 @@ async function claimPlatformDatabaseConnection(client, installationId, ownership
 			await client.query(`INSERT INTO "__void_platform_installation"
            ("singleton", "installation_id", "ownership_nonce")
          VALUES (true, $1, $2)`, [installationId, ownershipNonce]);
-		} else if (claim.installation_id !== installationId || claim.ownership_nonce !== ownershipNonce) throw new Error(`platform: This PostgreSQL database is already claimed by Void platform installation ${claim.installation_id}. Use a dedicated empty database for each installation.`);
+		} else if (claim.installation_id !== installationId || claim.ownership_nonce !== ownershipNonce) throw new Error(`platform: This PostgreSQL database is already claimed by Void platform installation ${claim.installation_id}. Uninstall keeps the database and its data, so use a dedicated empty database for each installation.`);
 		await client.query("COMMIT");
 	} catch (error) {
 		await client.query("ROLLBACK").catch(() => ({ rows: [] }));
@@ -6723,7 +6833,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 				}
 			}, dependencies.initializeAuthentication ?? initializeInstalledPlatformAuthentication)).setupPending) {
 				setupPending = true;
-				dependencies.onProgress?.(`Administrator setup pending: ${state.plan.apiUrl}/setup`);
+				dependencies.onProgress?.("Administrator setup prepared; its link and code are shown when this finishes");
 			}
 			state.manifest = recordInstallationStep(state.manifest, {
 				key: authenticationStep,
@@ -6868,6 +6978,19 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 function defaultConnectionId(kind) {
 	return kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind;
 }
+async function prompt(message, initialValue = "", masked = false) {
+	if (!process.stdin.isTTY) throw new Error(`platform: ${message} Supply it through --auth-config and environment references.`);
+	return masked ? platformPromptAnswer(await password({ message })) : platformPromptAnswer(await text$1({
+		message,
+		initialValue
+	}));
+}
+function clientSecretFromEnvironment(name) {
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error("platform: Invalid clientSecretEnv reference.");
+	const secret = process.env[name];
+	if (!secret) throw new Error(`platform: ${name} must contain the login client secret.`);
+	return secret;
+}
 function platformManagementAccessForAuthentication(selection, accountId, checkpoint) {
 	if (!selection.authentication.accessProtection && (!selection.authentication.providers.includes("cloudflare-access") || selection.file && !selection.file.cloudflareAccess)) return;
 	const spec = selection.file?.cloudflareAccess ?? (checkpoint?.accessSetupSpecJson ? parsePlatformAccessSetupSpec(JSON.parse(checkpoint.accessSetupSpecJson)) : void 0);
@@ -6944,13 +7067,6 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 			authBootstrapCode: checkpoint.authBootstrapCode ?? ""
 		};
 	}
-	const prompt = async (message, initialValue = "", masked = false) => {
-		if (!process.stdin.isTTY) throw new Error(`platform: ${message} Supply it through --auth-config and environment references.`);
-		return masked ? platformPromptAnswer(await password({ message })) : platformPromptAnswer(await text$1({
-			message,
-			initialValue
-		}));
-	};
 	const entries = selection.file?.connections ?? selection.authentication.providers.map((kind) => ({
 		configuration: {
 			kind,
@@ -7000,11 +7116,8 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 		if (kind === "google" && config.allowedDomains === void 0 && !selection.file) config.allowedDomains = (await prompt("Allowed Google Workspace domains (comma-separated, or blank):")).split(",").map((value) => value.trim()).filter(Boolean);
 		const parsed = parsePlatformLoginConfiguration(config);
 		let secret;
-		if (entry.clientSecretEnv) {
-			if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(entry.clientSecretEnv)) throw new Error("platform: Invalid clientSecretEnv reference.");
-			secret = process.env[entry.clientSecretEnv];
-			if (!secret) throw new Error(`platform: ${entry.clientSecretEnv} must contain the login client secret.`);
-		} else if (stored?.clientSecret && stored.configuration?.clientId === parsed.clientId && stored.configuration?.issuer === parsed.issuer) secret = stored.clientSecret;
+		if (entry.clientSecretEnv) secret = clientSecretFromEnvironment(entry.clientSecretEnv);
+		else if (stored?.clientSecret && stored.configuration?.clientId === parsed.clientId && stored.configuration?.issuer === parsed.issuer) secret = stored.clientSecret;
 		else secret = await prompt(`${config.label}: client secret:`, "", true);
 		const connection = {
 			configuration: parsed,
@@ -7109,6 +7222,87 @@ async function collectInstallationAuthentication(selection, plan, checkpoint, sa
 	save(result);
 	return result;
 }
+/** The hash the platform records for accepted login settings; a reset request does not change it. */
+function authenticationSetupRequestHash(setupJson) {
+	const { resetPending: _, ...configuration } = parsePlatformAuthenticationSetup(JSON.parse(setupJson));
+	return createHash("sha256").update(JSON.stringify(configuration)).digest("hex");
+}
+/**
+* Read a repair login file. It may change login settings, not methods or Access
+* protection: it lists the same connection IDs and kinds as the saved setup.
+*/
+async function readLoginReplacementFile(file, authentication, setupJson) {
+	const selection = await selectInstallationAuthentication(file);
+	const installed = parsePlatformAuthenticationSetup(JSON.parse(setupJson)).connections;
+	const connections = (entries) => entries.map(({ configuration: { id, kind } }) => JSON.stringify([id || defaultConnectionId(kind), kind])).sort().join("\n");
+	if (connections(selection.file.connections) !== connections(installed) || !!selection.authentication.accessProtection !== !!authentication.accessProtection) throw new Error(`platform: Repair changes login settings, not which login methods or Access protection the platform uses. List each installed connection with its ID: ${installed.map(({ configuration }) => configuration.id).join(", ")}.`);
+	return selection.file;
+}
+/**
+* New login settings for a first administrator setup that is still pending,
+* from a file or from prompts prefilled with the saved settings. A Cloudflare
+* Access login and Access protection stay as installed. The result resets
+* pending setup with a new setup code; the setup authority does not change.
+*/
+async function replacePendingInstallationAuthentication(input) {
+	const previous = parsePlatformAuthenticationSetup(JSON.parse(input.setupJson));
+	const file = input.file ? await readLoginReplacementFile(input.file, input.authentication, input.setupJson) : void 0;
+	console.log(`Login callback URL: ${formatUrl(`${input.apiUrl}/auth/callback`)}`);
+	const savedConnection = (id) => previous.connections.find((connection) => connection.configuration.id === id);
+	const connections = [];
+	for (const entry of file?.connections ?? []) {
+		const config = { ...entry.configuration };
+		const kind = config.kind;
+		if (!config.id) config.id = defaultConnectionId(kind);
+		if (kind === "cloudflare-access") {
+			const saved = savedConnection(config.id);
+			if (saved?.configuration.kind !== "cloudflare-access") throw new Error("platform: Repair keeps the installed Cloudflare Access login. Use its installed connection ID.");
+			connections.push(saved);
+			continue;
+		}
+		if (!config.label) config.label = kind;
+		if (kind === "oidc" && !config.issuer) config.issuer = await prompt(`${config.label}: issuer URL:`);
+		if (!config.clientId) config.clientId = await prompt(`${config.label}: client ID:`);
+		const configuration = parsePlatformLoginConfiguration(config);
+		connections.push({
+			configuration,
+			clientSecret: entry.clientSecretEnv ? clientSecretFromEnvironment(entry.clientSecretEnv) : await prompt(`${configuration.label}: client secret:`, "", true)
+		});
+	}
+	for (const saved of file ? [] : previous.connections) {
+		const current = saved.configuration;
+		if (current.kind === "cloudflare-access") {
+			connections.push(saved);
+			continue;
+		}
+		const issuer = current.kind === "oidc" ? await prompt(`${current.label}: issuer URL:`, current.issuer ?? "") : current.issuer;
+		const clientId = await prompt(`${current.label}: client ID:`, current.clientId);
+		const allowedDomains = current.kind === "google" ? (await prompt("Allowed Google Workspace domains (comma-separated, or blank):", current.allowedDomains.join(", "))).split(",").map((value) => value.trim()).filter(Boolean) : current.allowedDomains;
+		connections.push({
+			configuration: parsePlatformLoginConfiguration({
+				...current,
+				...issuer ? { issuer } : {},
+				clientId,
+				allowedDomains
+			}),
+			clientSecret: await prompt(`${current.label}: client secret (leave blank to keep it):`, "", true) || saved.clientSecret
+		});
+	}
+	const ids = connections.map((connection) => connection.configuration.id);
+	const authBootstrapCode = randomBytes(32).toString("hex");
+	const setup = parsePlatformAuthenticationSetup({
+		connections,
+		administratorConnectionId: file?.administratorConnectionId ?? (ids.includes(previous.administratorConnectionId) ? previous.administratorConnectionId : ids[0]),
+		admission: file?.admission ?? previous.admission,
+		protection: previous.protection,
+		resetPending: true,
+		bootstrapCredentialHash: createHash("sha256").update(authBootstrapCode).digest("hex")
+	});
+	return {
+		authenticationSetupJson: JSON.stringify(setup),
+		authBootstrapCode
+	};
+}
 //#endregion
 //#region src/cli/platform-saved-plans.ts
 function planId(args) {
@@ -7216,10 +7410,13 @@ function completePlatformSetupDraft(manifest) {
 }
 //#endregion
 //#region src/cli/platform-lifecycle.ts
+function isPlatformInstallDatabaseBound(checkpoint, manifest) {
+	return Boolean(checkpoint?.databaseClaimState === "claimed" || manifest?.resources.some((resource) => resource.state === "ready" && (resource.kind === "hyperdrive" || resource.kind === "worker")) || manifest?.steps.some((step) => step.key.startsWith("database-schema:") || step.key.startsWith("database-migrations:")));
+}
 function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 	const explicit = process.env.VOID_PLATFORM_DATABASE_URL || process.env.DATABASE_URL || "";
 	const recorded = checkpoint?.databaseUrl || "";
-	if (checkpoint?.databaseClaimState === "claimed" || manifest?.resources.some((resource) => resource.state === "ready" && (resource.kind === "hyperdrive" || resource.kind === "worker")) || manifest?.steps.some((step) => step.key.startsWith("database-schema:") || step.key.startsWith("database-migrations:"))) {
+	if (isPlatformInstallDatabaseBound(checkpoint, manifest)) {
 		if (!recorded) {
 			if (explicit) return explicit;
 			throw new Error("platform: The claimed PostgreSQL database URL is missing from local recovery state. Export VOID_PLATFORM_DATABASE_URL with the original installation database before continuing.");
@@ -7231,14 +7428,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-zLXnW1G_.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-CxpvUeo0.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-DeucI7A9.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-BUGOB4RC.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7249,7 +7446,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-CYrLvTGH.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-DvBS83rC.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7406,6 +7603,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		active.start(message);
 		return active;
 	};
+	let usingUnboundDatabase = false;
 	try {
 		if (!existing && !args.plan) assertPlatformInstallationSlugAvailable(installationSlug);
 		if (existing && !args.plan) {
@@ -7418,11 +7616,13 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		if (existing && !isPlatformSetupDraft(existing)) {
 			if (!databaseUrl) throw new Error("platform: DATABASE_URL is required to verify an interrupted installation before resuming it.");
 			progress = startProgress("Reading the saved installation");
+			usingUnboundDatabase = !isPlatformInstallDatabaseBound(checkpoint, existing);
 			const authoritative = await readPlatformDatabaseLifecycleManifest(databaseUrl, existing.id, existing.ownershipNonce);
+			usingUnboundDatabase = false;
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CYrLvTGH.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DvBS83rC.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -7750,6 +7950,8 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			r2SecretAccessKey
 		});
 		const hasFullProjectSecretKeyring = Boolean(checkpoint?.projectSecretKeysJson || checkpoint?.projectSecretActiveKeyVersion || process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION);
+		const generateIdentityKeys = credentialSetup && !!process.stdin.isTTY;
+		const generatedKeys = generateIdentityKeys ? [configured("jwtSecret", "VOID_PLATFORM_JWT_SECRET") ? "" : "JWT signing key", configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || hasFullProjectSecretKeyring ? "" : "project encryption key"].filter(Boolean) : [];
 		const secrets = createPlatformInstallationSecrets({
 			configurableAuthentication: !!authenticationSelection.authentication.configurable,
 			...authenticationSecrets,
@@ -7766,24 +7968,35 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			r2AccessKeyId,
 			r2SecretAccessKey,
 			existingInstallation: !credentialSetup,
-			jwtSecret: await collect("jwtSecret", "VOID_PLATFORM_JWT_SECRET", "JWT signing key:", true, true, credentialSetup ? (value) => Buffer.byteLength(value, "utf8") >= 32 ? void 0 : "The JWT signing secret must contain at least 32 random bytes." : void 0),
-			projectSecretKey: configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || (hasFullProjectSecretKeyring ? "" : await collect("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY", "Project encryption key:", true, true, credentialSetup ? (value) => {
+			generateIdentityKeys,
+			jwtSecret: generateIdentityKeys ? configured("jwtSecret", "VOID_PLATFORM_JWT_SECRET") : await collect("jwtSecret", "VOID_PLATFORM_JWT_SECRET", "JWT signing key:", true, true, credentialSetup ? (value) => Buffer.byteLength(value, "utf8") >= 32 ? void 0 : "The JWT signing secret must contain at least 32 random bytes." : void 0),
+			projectSecretKey: configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || (hasFullProjectSecretKeyring || generateIdentityKeys ? "" : await collect("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY", "Project encryption key:", true, true, credentialSetup ? (value) => {
 				const key = Buffer.from(value, "base64");
 				return key.length === 32 && key.toString("base64") === value ? void 0 : "The project encryption key must be canonical base64 encoding of exactly 32 bytes.";
 			} : void 0)),
 			projectSecretKeysJson: process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || "",
 			projectSecretActiveKeyVersion: process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION || ""
 		});
+		if (generatedKeys.length) log.info(`Void generated the ${generatedKeys.join(" and ")} and keeps ${generatedKeys.length > 1 ? "them" : "it"} in this machine’s encrypted recovery data. ` + platformSetupLink({
+			title: "About these keys",
+			url: "https://void.cloud/guide/platform/installation/credentials#signing-and-encryption-keys"
+		}));
 		progress = startProgress("Installing the platform");
 		if (credentialSetup) {
 			saveValues({
+				jwtSecret: secrets.jwtSecret,
 				projectSecretKey: secrets.projectSecretKey,
 				...secrets.emailEnabled ? { emailSigningSecret: secrets.emailSigningSecret } : {}
 			});
 			existing = completePlatformSetupDraft(existing);
 		}
+		usingUnboundDatabase = !isPlatformInstallDatabaseBound(checkpoint, existing);
 		const result = await installPlatform(plan, secrets, existing, {
 			acquireDatabaseLifecycleLock: acquirePlatformDatabaseLifecycleLock,
+			claimDatabase: async (...claim) => {
+				await claimPlatformDatabase(...claim);
+				usingUnboundDatabase = false;
+			},
 			client,
 			operatorApiToken: managementApiToken || operatorCredential.token,
 			runtime,
@@ -7827,7 +8040,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CYrLvTGH.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DvBS83rC.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -7857,7 +8070,9 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		if (result.setupPending && completedAuthCode) {
 			log.info(`First administrator setup: ${formatUrl(`${plan.apiUrl}/setup`)}`);
 			console.log(`One-time administrator setup code: ${completedAuthCode}`);
+			log.info(`Login callback URL: ${formatUrl(`${plan.apiUrl}/auth/callback`)}`);
 			log.info("Confirm your identity in the browser, then test and enable any additional login methods in Settings.");
+			log.info(`If sign-in fails, run \`void platform repair ${result.manifest.id}\` to change the login settings.`);
 		}
 		if (!plan.deployment.application.zoneName) log.info("Apps will use workers.dev addresses. When your domain is ready: void platform domain set <domain>");
 		log.info("Run `void account login`, then deploy an app with `void deploy --platform void`.");
@@ -7865,7 +8080,10 @@ async function runPlatformLifecycleCommand(commandArgs) {
 	} catch (error) {
 		progress?.error("Platform installation failed.");
 		progress = void 0;
-		if (existing && !args.plan && !(error instanceof PlatformAccessBlockedError)) log.info(`Continue with: ${cliCommandName()} platform install --resume --name ${existing.id}`);
+		if (existing && !args.plan && !(error instanceof PlatformAccessBlockedError)) {
+			log.info(`Continue with: ${cliCommandName()} platform install --resume --name ${existing.id}`);
+			if (usingUnboundDatabase) log.info("To use another PostgreSQL database, set VOID_PLATFORM_DATABASE_URL to its URL first.");
+		}
 		throw error;
 	} finally {
 		try {
@@ -7979,4 +8197,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { revalidatePlatformInstallAction as A, hyperdriveOriginConfigHash as B, formatPlatformInstallPlan as C, platformAdoptionIntentHash as D, matchesRecordedR2Fingerprint as E, checkpointPlatformAccessResources as F, hyperdriveOriginMatches as H, parsePlatformAccessSetupSpec as I, preparePlatformAccessSetup as L, assertPlatformOperatorCredentialCanApplyPlan as M, resolvePlatformCloudflareCredential as N, r2BucketConfigHash as O, verifyPlatformCloudflareCredential as P, PlatformCloudflareApiError as R, dnsRecordConfigHash as S, legacyResourceConfigHash as T, verifyPlatformRuntimeTokenPermissions as U, hyperdriveOriginFromConnectionString as V, resolveBootstrapGitHubId as _, REMOTE_INSTALLATION_MANIFEST_KEY as a, recordPlatformWorkerTraffic as b, acquirePlatformDatabaseLifecycleLockConnection as c, readPlatformProjectZeroTrustState as d, assertProjectZeroTrustAllowsUninstall as f, createPlatformInstallationSecrets as g, createPlatformHealthProbeToken as h, verifyPlatformAiGatewayPlan as i, platformDatabaseNameFromOwnerUrl as j, resourceMarkerProblem as k, platformDatabaseClientUrl as l, loadPlatformRuntime as m, resolvePlatformInstallDatabaseUrl as n, installPlatform as o, readPlatformDatabase as p, runPlatformLifecycleCommand as r, acquirePlatformDatabaseLifecycleLock as s, assertNoninteractivePlatformMutationAcknowledged as t, readPlatformProjectSlugs as u, recordResource as v, hasProvisionIntentStep as w, createPlatformInstallPlan as x, platformTrafficAttachmentWorker as y, PlatformCloudflareClient as z };
+export { matchesRecordedR2Fingerprint as A, activatePlatformAccessCredentials as B, platformTrafficAttachmentWorker as C, formatPlatformInstallPlan as D, dnsRecordConfigHash as E, platformDatabaseNameFromOwnerUrl as F, PlatformCloudflareClient as G, parsePlatformAccessSetupSpec as H, turnOffInstalledProjectZeroTrust as I, hyperdriveOriginMatches as J, hyperdriveOriginConfigHash as K, assertPlatformOperatorCredentialCanApplyPlan as L, r2BucketConfigHash as M, resourceMarkerProblem as N, hasProvisionIntentStep as O, revalidatePlatformInstallAction as P, resolvePlatformCloudflareCredential as R, recordResource as S, createPlatformInstallPlan as T, preparePlatformAccessSetup as U, checkpointPlatformAccessResources as V, PlatformCloudflareApiError as W, verifyPlatformRuntimeTokenPermissions as Y, readPlatformDatabase as _, authenticationSetupRequestHash as a, createPlatformInstallationSecrets as b, REMOTE_INSTALLATION_MANIFEST_KEY as c, acquirePlatformDatabaseLifecycleLockConnection as d, platformDatabaseClientUrl as f, formatZeroTrustApplications as g, assertProjectZeroTrustAllowsUninstall as h, verifyPlatformAiGatewayPlan as i, platformAdoptionIntentHash as j, legacyResourceConfigHash as k, installPlatform as l, readPlatformProjectZeroTrustState as m, resolvePlatformInstallDatabaseUrl as n, readLoginReplacementFile as o, readPlatformProjectSlugs as p, hyperdriveOriginFromConnectionString as q, runPlatformLifecycleCommand as r, replacePendingInstallationAuthentication as s, assertNoninteractivePlatformMutationAcknowledged as t, acquirePlatformDatabaseLifecycleLock as u, loadPlatformRuntime as v, recordPlatformWorkerTraffic as w, resolveBootstrapGitHubId as x, createPlatformHealthProbeToken as y, verifyPlatformCloudflareCredential as z };