void 1.1.0 → 1.1.12

package/dist/{platform-lifecycle-DBiS0cJd.mjs → platform-lifecycle-3CR98Tg2.mjs}

@@ -4,12 +4,12 @@ import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverG
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-Ba6ZbrzY.mjs";
-import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-CeDWJRhj.mjs";
-import { d as resolvePinnedApiBaseUrl, i as createDefaultRunWrangler } from "./provision-BnSSkiED.mjs";
-import { t as parsePlatformArgs } from "./platform-args-CaCL_1Ch.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CqFBDo52.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-YvN9VQXV.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-CKguMgr7.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-CZJ4viYl.mjs";
+import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-DZKYCEJg.mjs";
+import { t as parsePlatformArgs } from "./platform-args-B7ke06up.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-DSvBc1Gu.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-hFbnWAVQ.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -19,6 +19,7 @@ import { tmpdir } from "node:os";
 import { stripVTControlCharacters } from "node:util";
 import { cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, parseCloudflareVersionMessage, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, stabilizeCloudflareVersionTriggers } from "@void/deploy-cloudflare";
 import { createServer, request } from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
 import { request as request$1 } from "node:https";
@@ -45,12 +46,29 @@ var PlatformWorkerRoutesChangedError = class extends Error {
 		this.name = "PlatformWorkerRoutesChangedError";
 	}
 };
+/**
+* The runtime token cannot read the shared email zone. The operator can add
+* the permission to the same token, so callers keep its saved value.
+*/
+var PlatformRuntimeTokenEmailPermissionError = class extends Error {
+	/** Cloudflare answered HTTP 401 at least once: it did not accept the token. */
+	tokenNotValid;
+	constructor(message, tokenNotValid, options) {
+		super(message, options);
+		this.name = "PlatformRuntimeTokenEmailPermissionError";
+		this.tokenNotValid = tokenNotValid;
+	}
+};
 async function verifyPlatformRuntimeTokenPermissions(client, input) {
 	try {
 		await client.listHyperdriveConfigs(input.accountId);
 	} catch (error) {
 		throw runtimeTokenPreflightError("Account → Hyperdrive → Write", error);
 	}
+	if (input.emailZoneId) await verifyPlatformRuntimeTokenEmailPermissions(client, {
+		accountId: input.accountId,
+		zoneId: input.emailZoneId
+	});
 	if (!input.zoneId) return;
 	const probeUrl = `https://${input.applicationDomain}/.well-known/void/runtime-token-preflight-${randomUUID()}`;
 	try {
@@ -67,6 +85,37 @@ async function verifyPlatformRuntimeTokenPermissions(client, input) {
 		throw runtimeTokenPreflightError("Zone → SSL and Certificates → Edit", error);
 	}
 }
+/**
+* Shared email setup uses the runtime token after the platform pauses traffic.
+* Read-only requests find a missing Email Routing permission before that. A
+* read cannot prove Edit access. Email Sending is not checked, because its
+* answer depends on the account plan.
+*/
+async function verifyPlatformRuntimeTokenEmailPermissions(client, input) {
+	const zone = `/zones/${encodeURIComponent(input.zoneId)}`;
+	const probes = [
+		["Zone → Zone → Read", zone],
+		["Zone → Zone Settings → Edit", `${zone}/email/routing`],
+		["Zone → Email Routing Rules → Edit", `${zone}/email/routing/rules?per_page=5`],
+		["Account → Email Routing Addresses → Edit", `/accounts/${encodeURIComponent(input.accountId)}/email/routing/addresses?per_page=5`]
+	];
+	const missing = [];
+	let denial;
+	let tokenNotValid = false;
+	for (const [permission, path] of probes) try {
+		await client.request(path);
+	} catch (error) {
+		if (error instanceof PlatformCloudflareApiError && (error.status === 401 || error.status === 403)) {
+			missing.push(permission);
+			denial ??= error;
+			tokenNotValid ||= error.status === 401;
+		}
+	}
+	if (denial) {
+		const denied = `Cloudflare denied: ${missing.join(", ")} (HTTP ${denial.status}).`;
+		throw new PlatformRuntimeTokenEmailPermissionError(input.savedToken ? `platform: The runtime API token saved on this machine cannot use platform email. ${denied} Void checked this token because VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN is not set. If the platform uses a different runtime token, set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to that token, and Void checks that token instead. Otherwise, check that the zone permissions of the saved token include the email zone ${input.zoneId}. To add a missing permission, edit the token in the Cloudflare dashboard. The token value stays the same. Then run the command again.` : `platform: The runtime API token cannot use platform email. ${denied} Check that the token is valid and that its zone permissions include the email zone ${input.zoneId}. To add a missing permission, edit the token in the Cloudflare dashboard. The token value stays the same. Or set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to a valid token that has these permissions. Then run the command again.`, tokenNotValid, { cause: denial });
+	}
+}
 function runtimeTokenPreflightError(permission, cause) {
 	const status = cause instanceof PlatformCloudflareApiError ? cause.status : null;
 	const message = status === 401 || status === 403 ? `Cloudflare denied the runtime-token check (HTTP ${status}). Check that the token is valid, scoped to this account, and includes ${permission}.` : status === 429 ? `Cloudflare rate-limited the runtime-token check for ${permission} (HTTP 429). Retry shortly; this does not mean the token is missing a permission.` : `Could not complete the runtime-token check for ${permission}${status === null ? "" : ` (Cloudflare HTTP ${status})`}. Retry the check; this failure does not establish that a permission is missing.`;
@@ -535,6 +584,22 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		for (const binding of settings.bindings ?? []) if (binding.type === "plain_text" && typeof binding.name === "string" && typeof binding.text === "string") bindings[binding.name] = binding.text;
 		return bindings;
 	}
+	/**
+	* Where the last change to a Worker came from, for example `cf_cli`, `dash`
+	* (Cloudflare dashboard) or `api` (Workers API). Null when the Worker does
+	* not exist or Cloudflare does not report it.
+	*/
+	async getWorkerLastDeployedFrom(accountId, workerName) {
+		let service;
+		try {
+			service = await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/services/${encodeURIComponent(workerName)}`);
+		} catch (error) {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
+			throw error;
+		}
+		const source = service?.default_environment?.script?.last_deployed_from;
+		return typeof source === "string" && source !== "" ? source : null;
+	}
 	async deleteKvValue(accountId, namespaceId, key) {
 		try {
 			await this.request(`/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}/values/${encodeURIComponent(key)}`, { method: "DELETE" });
@@ -3645,8 +3710,30 @@ function createPlatformHealthProbeToken(ownershipNonce) {
 //#endregion
 //#region src/cli/platform-installer-errors.ts
 const ANALYTICS_ENGINE_NOT_ENABLED = 10089;
+const UPLOAD_CONFLICT = "Aborting the upload operation because of conflicts";
+/** Why the Cloudflare CLI stopped an upload, and what to do. Null for other failures. */
+function uploadConflictMessage(result, operation) {
+	const output = stripVTControlCharacters(`${result.stdout}\n${result.stderr}`);
+	if (!output.includes(UPLOAD_CONFLICT)) return null;
+	const lines = output.split(/\r?\n/).map((line) => line.replace(/^[\s▲│]+/, "").trim());
+	const outsideChange = lines.find((line) => line.includes("last updated via the script API") || line.includes("set via the Cloudflare Dashboard"));
+	if (outsideChange) return `platform: The Cloudflare CLI did not ${operation}: ${outsideChange.replace(/:$/, ".")} This Worker was changed outside Void. Run the same command in a terminal. Void then lists the changes and asks you before it replaces them.`;
+	const secretNames = [...(lines.find((line) => / with (?:an )?existing remote secrets?\./.test(line))?.split(" conflict")[0] ?? "").matchAll(/`[^`]+`/g)].map(([name]) => name);
+	if (secretNames.length === 1) return `platform: The Cloudflare CLI did not ${operation}: the Worker has a secret with the same name as a value that Void sets: ${secretNames[0]}. Delete that secret from the Worker in the Cloudflare dashboard, then run the command again.`;
+	if (secretNames.length > 1) return `platform: The Cloudflare CLI did not ${operation}: the Worker has secrets with the same names as values that Void sets: ${new Intl.ListFormat("en").format(secretNames)}. Delete those secrets from the Worker in the Cloudflare dashboard, then run the command again.`;
+	const workflow = lines.findIndex((line) => line.includes("already exist and belong to different workers"));
+	if (workflow !== -1) {
+		const owners = lines.slice(workflow + 1);
+		const end = owners.findIndex((line) => !line.startsWith("- "));
+		const workflows = owners.slice(0, end === -1 ? void 0 : end);
+		return `platform: The Cloudflare CLI did not ${operation}: ${[lines[workflow], ...workflows].join(" ")}. ${workflows.length > 1 ? "Other Workers own these workflows. Delete each workflow, or rename it in the configuration of the Worker that owns it." : "Another Worker owns this workflow. Delete the workflow, or rename it in the configuration of that Worker."} Then run the command again.`;
+	}
+	return `platform: The Cloudflare CLI did not ${operation}. It stopped the upload because of a conflict that it could not confirm without a terminal. Fix the conflict, then run the command again.`;
+}
 function assertCleanPlatformWrangler(result, operation) {
 	if (result.status !== 0 || result.signal || result.error) {
+		const conflict = uploadConflictMessage(result, operation);
+		if (conflict) throw new Error(conflict);
 		const diagnostic = cloudflareCommandDiagnostic({
 			...result,
 			stderr: result.stderr.trim() || result.errors?.map((error) => error.message).join("\n") || ""
@@ -3675,6 +3762,36 @@ async function readActivePlatformWorkerVersion(configPath, accountId, workerName
 	if (active.length !== 1 || typeof active[0].version_id !== "string") return null;
 	return active[0].version_id;
 }
+/**
+* The active version in a Cloudflare API answer for the deployments of a
+* platform Worker. deployPlatformWorker continues only when the latest
+* deployment sends all traffic to one version (deploymentRunsOnlyVersion).
+* `split` is each other answer, for example a gradual deployment.
+*/
+function readActivePlatformWorkerDeployment(response) {
+	const deployments = response && typeof response === "object" && !Array.isArray(response) ? response.deployments : null;
+	if (!Array.isArray(deployments)) return { kind: "malformed" };
+	if (deployments.length === 0) return { kind: "split" };
+	const latest = deployments[0];
+	const versions = latest && typeof latest === "object" ? latest.versions : null;
+	if (!Array.isArray(versions) || versions.some((version) => !version || typeof version !== "object" || typeof version.version_id !== "string" || !Number.isFinite(Number(version.percentage)))) return { kind: "malformed" };
+	const [only] = versions;
+	return versions.length === 1 && only && Number(only.percentage) === 100 ? {
+		kind: "active",
+		versionId: only.version_id
+	} : { kind: "split" };
+}
+/**
+* Whether a version of a platform Worker has Void's record of its triggers.
+* This is the rule of the upgrade: it refuses a version without the record,
+* for example a version deployed outside Void.
+*/
+async function platformWorkerVersionHasTriggerRecord(readCloudflare, accountId, workerName, versionId) {
+	const version = await readCloudflare(`/accounts/${encodeURIComponent(accountId)}/workers/scripts/${encodeURIComponent(workerName)}/versions/${encodeURIComponent(versionId)}`);
+	const annotations = version && typeof version === "object" ? version.annotations : null;
+	const message = annotations && typeof annotations === "object" ? annotations["workers/message"] : null;
+	return parseCloudflareVersionMessage(typeof message === "string" ? message : null)?.schema === 2;
+}
 async function readPlatformWorkerDeployments(configPath, accountId, workerName, runner = runPlatformWrangler) {
 	const result = await runner({
 		type: "deployments.list",
@@ -3753,15 +3870,15 @@ function readPlatformWorkerOwnershipMarker(config) {
 	if (typeof marker !== "string" || marker === "") throw new Error("platform: Platform Worker config is missing its ownership marker.");
 	return marker;
 }
-async function readActivePlatformWorkerSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, runner = runPlatformWrangler) {
+async function readActivePlatformWorkerSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, runner = runPlatformWrangler, unrecordedTriggerConfig) {
 	const readActiveVersion = () => readActivePlatformWorkerVersion(configPath, accountId, workerName, runner);
 	const versionId = await readActiveVersion();
 	if (!versionId) throw new Error(`platform: Existing Worker ${workerName} has no single active production version.`);
 	return await readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, versionId, runner, async () => {
 		if (await readActiveVersion() !== versionId) throw new Error(`platform: Worker ${workerName} changed concurrently while its active version was inspected.`);
-	});
+	}, unrecordedTriggerConfig);
 }
-async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, versionId, runner, validateCurrentVersion) {
+async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerName, expectedOwnershipMarker, versionId, runner, validateCurrentVersion, unrecordedTriggerConfig) {
 	const result = await runner({
 		type: "versions.view",
 		versionId,
@@ -3779,6 +3896,11 @@ async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerNa
 	const annotations = value.annotations;
 	const message = annotations && typeof annotations === "object" && typeof annotations["workers/message"] === "string" ? annotations["workers/message"] ?? null : null;
 	const metadata = parseCloudflareVersionMessage(message);
+	if (metadata?.schema !== 2 && unrecordedTriggerConfig) return {
+		migrationTag: readCloudflareVersionMigrationTag(value),
+		triggerConfig: unrecordedTriggerConfig,
+		versionId
+	};
 	if (metadata?.schema !== 2) throw new Error(`platform: Active Worker ${workerName} predates safe trigger snapshots. Refusing to upgrade because its routes, cron, and queue consumers could not be restored after a failed cutover.`);
 	const migrationTag = readCloudflareVersionMigrationTag(value);
 	return {
@@ -4383,7 +4505,7 @@ async function deployPlatformWorker(config, secrets, options) {
 			}
 		}
 		if (options.workerExisted) {
-			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), readRunner);
+			const previous = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), readRunner, options.replaceOutsideChanges ? previousTriggers : void 0);
 			previousVersionId = previous.versionId;
 			const deployments = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 			if (!deploymentRunsOnlyVersion(deployments[0], previousVersionId)) throw new Error(`platform: Worker ${workerName} changed concurrently while its deployment lineage was inspected.`);
@@ -4559,6 +4681,37 @@ async function deployPlatformWorker(config, secrets, options) {
 		});
 	}
 }
+/**
+* Upload a version of a platform Worker that was changed outside Void, and do
+* not deploy it. The Cloudflare CLI uses this terminal: it shows what the
+* upload replaces and asks the operator. After the operator agrees, later
+* uploads of this Worker work without a terminal again.
+*/
+async function uploadPlatformWorkerForReview(config, options) {
+	const directory = mkdtempSync(join(tmpdir(), "void-platform-review-"));
+	const workerName = String(config.name);
+	const accountId = String(config.account_id);
+	const readRunner = platformWorkerApiReadRunner(accountId, workerName, options.readCloudflare, options.runner);
+	try {
+		const { wranglerConfig } = isolatePlatformWorkerCustomDomains(config);
+		const configPath = join(directory, "wrangler.json");
+		const writeConfig = (value) => writeFileSync(configPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+		writeConfig(withoutPlatformWorkerTrafficAttachments(wranglerConfig));
+		const active = await readActivePlatformWorkerSnapshot(configPath, accountId, workerName, readPlatformWorkerOwnershipMarker(config), readRunner, readTriggerConfigFromObject(wranglerConfig));
+		writeConfig(withoutCompletedPlatformWorkerMigrations(withoutPlatformWorkerTrafficAttachments(wranglerConfig), active.migrationTag));
+		return await options.runner({
+			type: "versions.upload",
+			configPath,
+			message: "Void: replace changes made outside Void",
+			interactive: true
+		}, accountId, directory, true);
+	} finally {
+		rmSync(directory, {
+			force: true,
+			recursive: true
+		});
+	}
+}
 async function recoverFailedPlatformWorkerDeployment(input) {
 	const failures = [];
 	const attempt = async (label, operation) => {
@@ -4799,6 +4952,7 @@ async function uploadInstallationWorkers(input) {
 			preservedRoutes,
 			previousConfig: previousWorkerConfig,
 			previousPublicEndpoints,
+			...dependencies.replaceOutsideChanges?.includes(action.name) ? { replaceOutsideChanges: true } : {},
 			runner: parallelWorkerUploads ? runParallelPinnedPlatformWrangler : runPinnedPlatformWrangler,
 			workerExisted: action.action !== "create"
 		});
@@ -4942,6 +5096,12 @@ async function verifyPlatformDeploymentExecutionDrain(apiUrl, healthProbeToken,
 	if (status?.protocolVersion !== 1 || status.installationId !== installationId || typeof status.admissionClosed !== "boolean" || !Number.isSafeInteger(status.pendingDeployments) || Number(status.pendingDeployments) < 0) throw new Error("platform: Deployment execution drain probe returned an invalid document.");
 	if (!status.admissionClosed || status.pendingDeployments !== 0) throw new Error("platform: Durable deployment operations are still admitted or unfinished. Keep the current runtime and retry this command after they finish.");
 }
+const sharedEmailStepPermissions = /* @__PURE__ */ new Map([
+	["routing_enable", "Zone → Zone Settings → Edit"],
+	["subaddressing_ensure", "Zone → Zone Settings → Edit"],
+	["inbound_probe", "Zone → Zone Settings → Edit"],
+	["sending_onboard", "Account → Email Sending → Edit"]
+]);
 async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher = fetch) {
 	const deadline = Date.now() + 3e5;
 	let operationId = null;
@@ -5024,6 +5184,9 @@ async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher =
 		if (typeof status?.failureDetail === "string" && safeDetails.includes(status.failureDetail)) {
 			details.push(`${status.failureDetail}.`);
 			if (currentStep === "inbound_probe" && status.failureDetail === mxDetail) details.push(`Enable Email Routing for ${domain} in the Cloudflare dashboard, then resume this installation.`);
+		} else if (failureCode === "blocked" && currentStep && sharedEmailStepPermissions.has(currentStep)) {
+			const permission = sharedEmailStepPermissions.get(currentStep);
+			details.push(`This step needs ${permission} on the runtime API token. If the token does not have it, edit the token in the Cloudflare dashboard and add it. The token value stays the same. Or set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to a token that has it. Then resume this installation.`);
 		}
 		const detail = details.length ? ` ${details.join(" ")}` : "";
 		throw new Error(`platform: Shared email bootstrap did not reach inbound readiness at ${apiUrl} (HTTP ${response.status}).${detail} Traffic remains disabled.`);
@@ -5287,7 +5450,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BXwZiJSF.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-CyLcD6ot.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -6447,6 +6610,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const runtime = resolvedRuntime.manifest;
 	if (plan.deployment.appAccess && runtime.appAccessSetup !== 1) throw new Error("platform: This runtime does not support the installation’s app access setup.");
 	const hasEmailGatewayArtifact = runtime.artifacts.emailGateway !== void 0;
+	if (existing?.steps.some((step) => step.key === "private-previews-initialized:v1") && runtime.privatePreviews !== 1) throw new Error("platform: This installation has private previews. Use a runtime with private preview support.");
 	if (runtime.emailProtocolVersion !== 1 && plan.deployment.capabilities.email) throw new Error("platform: This runtime cannot serve enabled platform email without email protocol version 1.");
 	if (runtime.emailProtocolVersion !== 1 && existing?.resources.some((resource) => resource.key === "email-gateway-worker" && resource.state === "ready")) throw new Error("platform: This runtime cannot replace an installed email gateway Worker. Use a runtime with email protocol version 1.");
 	const workerKeys = hasEmailGatewayArtifact ? [
@@ -6657,22 +6821,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const createsWorker = state.plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
 		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
-		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || state.manifest.usageProtocolVersion !== targetUsageProtocolVersion || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
-		if (requiresTrafficGuard) {
-			await dependencies.client.putKvValue(state.plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
-			workerTrafficGuarded = true;
-			dependencies.onProgress?.("Application traffic paused for a safe platform cutover");
-		}
-		if (!preserveDisabled) {
-			const trafficGeneration = nextTrafficGeneration(state.manifest);
-			state.manifest = recordInstallationStep(state.manifest, {
-				completedAt: now(),
-				key: `traffic-enabled:${trafficGeneration}`,
-				resultHash: String(trafficGeneration)
-			}, now());
-			writeInstallationManifest(state.manifest);
-			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
-		}
+		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || state.manifest.usageProtocolVersion !== targetUsageProtocolVersion || runtime.privatePreviews === 1 && !state.manifest.steps.some((step) => step.key === "private-previews-initialized:v1") || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
 		const configInput = {
 			authenticationDatabaseUncached: true,
 			proxyHealthBinding: true,
@@ -6696,23 +6845,43 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			runtimeEntrypoints: entrypoints,
 			...runtime.assets ? { runtimeApiAssetsDirectory: join(runtimeDirectory, PLATFORM_ADMIN_ASSETS_DIRECTORY) } : {}
 		};
-		const workerDeploymentSecrets = {
-			...state.secrets,
-			workerSecretUpdates: state.workerSecretUpdateIntent?.updates ?? {}
-		};
-		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const enabledConfigs = createPlatformWorkerConfigs({
 			...configInput,
+			privatePreviews: runtime.privatePreviews === 1,
 			publicEndpoints: !preserveDisabled,
 			trafficState: preserveDisabled ? "staging" : "enabled"
 		});
+		const outsideChangeConfigs = workerKeys.map((key) => enabledConfigs[key]).filter((config) => dependencies.replaceOutsideChanges?.includes(String(config.name)));
+		if (outsideChangeConfigs.length > 0) await dependencies.uploadOutsideChanges?.(outsideChangeConfigs);
+		if (requiresTrafficGuard) {
+			await dependencies.client.putKvValue(state.plan.account.id, requireId(ids, "routing-kv"), PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE);
+			workerTrafficGuarded = true;
+			dependencies.onProgress?.("Application traffic paused for a safe platform cutover");
+		}
+		if (!preserveDisabled) {
+			const trafficGeneration = nextTrafficGeneration(state.manifest);
+			state.manifest = recordInstallationStep(state.manifest, {
+				completedAt: now(),
+				key: `traffic-enabled:${trafficGeneration}`,
+				resultHash: String(trafficGeneration)
+			}, now());
+			writeInstallationManifest(state.manifest);
+			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
+		}
+		const workerDeploymentSecrets = {
+			...state.secrets,
+			workerSecretUpdates: state.workerSecretUpdateIntent?.updates ?? {}
+		};
+		const requiresStagedCommit = !preserveDisabled && requiresTrafficGuard;
 		const configs = requiresStagedCommit ? createPlatformWorkerConfigs({
 			...configInput,
+			privatePreviews: runtime.privatePreviews === 1,
 			publicEndpoints: true,
 			trafficState: requiresSandboxDrain ? "sandbox-drain" : "staging"
 		}) : enabledConfigs;
 		const previousConfigs = createPlatformWorkerConfigs({
 			...configInput,
+			privatePreviews: existing?.steps.some((step) => step.key === "private-previews-initialized:v1"),
 			publicEndpoints: previousPublicEndpoints,
 			trafficState: previousPublicEndpoints ? "enabled" : "staging"
 		});
@@ -6943,6 +7112,11 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 			runtime,
 			runtimeProvenance
 		})).emailOperationId;
+		if (runtime.privatePreviews === 1) state.manifest = recordInstallationStep(state.manifest, {
+			key: "private-previews-initialized:v1",
+			completedAt: now(),
+			resultHash: hash("private-previews:v1")
+		}, now());
 		await checkpointOperation("complete");
 		writeInstallationManifest(state.manifest);
 		await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
@@ -7304,6 +7478,171 @@ async function replacePendingInstallationAuthentication(input) {
 	};
 }
 //#endregion
+//#region src/cli/platform-installer-outside-changes.ts
+const OUTSIDE_SOURCES = {
+	dash: "changed in the Cloudflare dashboard",
+	api: "changed in the Cloudflare API",
+	unrecorded: "has an active version without a Void deployment record"
+};
+const PLATFORM_WORKER_KEYS = [
+	"api",
+	"proxy",
+	"emailGateway",
+	"tail",
+	"dispatch"
+];
+const NO_WORKER_CHANGED = "No platform Worker changed. This command did not pause application traffic.";
+/** The wait before the second and the third read of a Worker. */
+const READ_RETRY_DELAYS_MS = [250, 500];
+/** Stop before the run changes a Worker, because Void cannot tell what the run replaces. */
+function unreadablePlatformWorker(workerName, error) {
+	const status = error instanceof PlatformCloudflareApiError ? error.status : null;
+	const answer = status === null ? `no HTTP response: ${error instanceof Error ? error.message : String(error)}` : `HTTP ${status}`;
+	return new Error([
+		`platform: Void cannot read the platform Worker ${workerName} (${answer}), so it cannot find changes made outside Void.`,
+		NO_WORKER_CHANGED,
+		status === 401 || status === 403 ? "Make sure that the Cloudflare API token has Account → Workers Scripts → Edit for this account. Then run the command again." : "Run the command again."
+	].join(" "), { cause: error });
+}
+/**
+* Read a Worker again after a rate limit, a Cloudflare server error or a
+* network failure. Each other failure, or a third failure, stops the run.
+*/
+async function readPlatformWorker(workerName, read) {
+	for (let attempt = 0;; attempt++) try {
+		return await read();
+	} catch (error) {
+		const status = error instanceof PlatformCloudflareApiError ? error.status : null;
+		const wait = READ_RETRY_DELAYS_MS[attempt];
+		if (wait === void 0 || status !== null && status !== 429 && status < 500) throw unreadablePlatformWorker(workerName, error);
+		await setTimeout$1(wait);
+	}
+}
+/** The Cloudflare CLI asks only about these changes. The others need no upload for review. */
+function needsReviewUpload(change) {
+	return change.source !== "unrecorded";
+}
+/**
+* The earlier version of each Worker that the installer makes active again
+* before it deploys. A run that stopped during a Worker cutover left Void's
+* version active, and the next run first restores the earlier one. Like the
+* installer, keep Void's version while the platform changes to configurable
+* sign-in and already requires sign-in. Every Worker that this check reads
+* exists, so the installation had Workers before.
+*/
+async function restoredPlatformWorkerVersions(installation, runtime) {
+	const cutover = interruptedWorkerCutover(installation.manifest);
+	if (!cutover || installation.manifest.deployment.authentication.configurable !== true && runtime.manifest.authenticationProtocolVersion === 1 && (await installation.readAuthenticationState?.())?.sessionsRequired === true) return /* @__PURE__ */ new Map();
+	return new Map([...cutover.staged.values()].flatMap((snapshot) => snapshot.previousVersionId === null ? [] : [[snapshot.workerName, snapshot.previousVersionId]]));
+}
+/** Find the existing platform Workers that a run uploads and that were changed outside Void. */
+async function findPlatformWorkerOutsideChanges(client, plan, runtime, installation) {
+	const workers = PLATFORM_WORKER_KEYS.flatMap((key) => {
+		if (key === "emailGateway" && runtime.manifest.artifacts.emailGateway === void 0) return [];
+		const action = plan.actions.find((entry) => entry.key === platformWorkerResourceKey(key));
+		return action?.kind === "worker" && action.action !== "create" ? [{
+			key,
+			name: action.name
+		}] : [];
+	});
+	const restored = workers.length > 0 ? await restoredPlatformWorkerVersions(installation, runtime) : /* @__PURE__ */ new Map();
+	return (await Promise.all(workers.map(async (worker) => {
+		const readCloudflare = (path) => readPlatformWorker(worker.name, () => client.request(path));
+		const source = await readPlatformWorker(worker.name, () => client.getWorkerLastDeployedFrom(plan.account.id, worker.name));
+		const deployments = await readPlatformWorker(worker.name, () => client.request(`/accounts/${encodeURIComponent(plan.account.id)}/workers/scripts/${encodeURIComponent(worker.name)}/deployments`).catch((error) => {
+			if (error instanceof PlatformCloudflareApiError && error.status === 404) return null;
+			throw error;
+		}));
+		if (deployments === null) return source === "dash" || source === "api" ? {
+			...worker,
+			source
+		} : null;
+		const active = readActivePlatformWorkerDeployment(deployments);
+		if (active.kind === "malformed") throw new Error(`platform: Cloudflare returned malformed deployment data for the platform Worker ${worker.name}, so Void cannot find changes made outside Void. ${NO_WORKER_CHANGED} Run the command again.`);
+		if (active.kind === "split") throw new Error(`platform: The platform Worker ${worker.name} has no single version that gets 100% of traffic, for example after a gradual deployment. This command deploys a new version only when one version gets all traffic. ${NO_WORKER_CHANGED} In the Cloudflare dashboard, deploy one version of ${worker.name} to 100% of traffic. Then run this command once in a terminal, so that you can approve the dashboard change.`);
+		if (source === "dash" || source === "api") return {
+			...worker,
+			source
+		};
+		const restoredVersion = restored.get(worker.name);
+		return (await Promise.all([active.versionId, ...restoredVersion === void 0 ? [] : [restoredVersion]].map((versionId) => platformWorkerVersionHasTriggerRecord(readCloudflare, plan.account.id, worker.name, versionId)))).includes(false) ? {
+			...worker,
+			source: "unrecorded"
+		} : null;
+	}))).filter((change) => change !== null);
+}
+function listPlatformWorkerOutsideChanges(changes) {
+	return changes.map((change) => `${change.name}: ${OUTSIDE_SOURCES[change.source]}`).join("\n");
+}
+/**
+* The list of Workers after a heading. The heading must be true for each
+* source: an older Void release can have deployed the active version.
+*/
+function formatPlatformWorkerOutsideChanges(changes) {
+	return `These platform Workers need your approval before this command replaces their configuration:\n${listPlatformWorkerOutsideChanges(changes)}`;
+}
+/**
+* Do this before a run changes a Worker or pauses traffic. When platform
+* Workers were changed outside Void, stop, or ask the operator in a terminal.
+* Returns the Workers whose outside changes the operator agreed to replace.
+* The installer uploads them later with uploadPlatformWorkerOutsideChanges.
+*/
+async function reviewPlatformWorkerOutsideChanges(input) {
+	const changes = await findPlatformWorkerOutsideChanges(input.client, input.plan, input.runtime, input.installation);
+	if (changes.length === 0) return [];
+	if (!input.interactive) throw new Error([
+		`platform: ${formatPlatformWorkerOutsideChanges(changes)}`,
+		NO_WORKER_CHANGED,
+		"This command replaces their configuration with the Void configuration. It can ask for your approval only in a terminal.",
+		`Run this command once in a terminal to review them:\n${input.command}`
+	].join("\n"));
+	note([
+		listPlatformWorkerOutsideChanges(changes),
+		"",
+		"This command replaces the configuration of these Workers with the Void configuration.",
+		"It removes values that Void does not set, for example an EMAIL_FROM that you added.",
+		"It resets values that Void sets, for example AUTH_REDIRECT_URI.",
+		...changes.some(needsReviewUpload) ? [
+			"First, it prepares the platform resources and the database.",
+			"Then, before it pauses traffic or deploys a Worker, the Cloudflare CLI asks you again for each Worker changed in the Cloudflare dashboard or API. For a dashboard change, it shows the differences.",
+			"It uploads a new version of each of these Workers and does not deploy it."
+		] : []
+	].join("\n"), "Approval needed");
+	const answer = await confirm({
+		message: "Replace the configuration of these Workers?",
+		initialValue: false
+	});
+	if (isCancel(answer) || typeof answer === "symbol" || !answer) throw new Error(`platform: Cancelled. ${NO_WORKER_CHANGED}`);
+	return changes;
+}
+/**
+* Upload a new version of each Worker that the operator agreed to replace, and
+* do not deploy it. The installer gives the configs after it creates the
+* resources that they use, and before it pauses traffic. The Cloudflare CLI
+* uses this terminal: it shows what the upload replaces and asks the operator.
+*/
+async function uploadPlatformWorkerOutsideChanges(configs, input) {
+	const { client } = input;
+	const reviewed = configs.filter((config) => input.changes.some((change) => change.name === config.name && needsReviewUpload(change)));
+	if (reviewed.length === 0) return;
+	const runner = input.runner ?? ((operation, accountId, cwd, capture) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, client.apiBaseUrl, false, input.operatorApiToken));
+	input.progress?.pause();
+	try {
+		for (const config of reviewed) {
+			const name = String(config.name);
+			log.step(`Uploading a new version of ${name} without deploying it`);
+			const uploaded = await uploadPlatformWorkerForReview(config, {
+				readCloudflare: (path) => client.request(path),
+				runner
+			});
+			const source = await client.getWorkerLastDeployedFrom(String(config.account_id), name);
+			if (uploaded.status !== 0 || source === "dash" || source === "api") throw new Error(`platform: The Cloudflare CLI did not replace the changes to ${name}. Its output above shows why. No deployment changed. This command did not pause application traffic.`);
+		}
+	} finally {
+		input.progress?.resume();
+	}
+}
+//#endregion
 //#region src/cli/platform-saved-plans.ts
 function planId(args) {
 	return createHash("sha256").update(JSON.stringify([args.account, args.name])).digest("hex");
@@ -7428,14 +7767,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-CxpvUeo0.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-DDNK2y-4.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-BUGOB4RC.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-Dmsg7lWA.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7446,7 +7785,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-DvBS83rC.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-DAE6g2QU.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7622,7 +7961,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DvBS83rC.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-DAE6g2QU.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -7831,8 +8170,10 @@ async function runPlatformLifecycleCommand(commandArgs) {
 					break;
 				} catch (error) {
 					if (!isPlatformTokenAuthorizationError(error)) throw error;
+					const details = /* @__PURE__ */ new Set();
+					for (let cause = error, depth = 0; depth < 5 && cause instanceof Error; depth++, cause = cause.cause) details.add(cause.message.replaceAll(token, "[redacted]"));
 					forgetRejectedManagementToken();
-					log.warn("Cloudflare rejected this token. Check its permissions and account/zone scope, then paste a replacement.");
+					log.warn([...details, "Check the token permissions and account/zone scope, then paste a replacement."].join("\n"));
 				}
 			}
 		} else if (managementAccess) await verifyPlatformManagementAccess(client, accountId, managementAccess);
@@ -7878,6 +8219,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 					accountId,
 					applicationDomain,
 					customDomains: plan.deployment.capabilities.customDomains,
+					...plan.deployment.capabilities.email && plan.deployment.emailSharedZoneId ? { emailZoneId: plan.deployment.emailSharedZoneId } : {},
 					zoneId: plan.zone?.id ?? null
 				});
 				checkingRuntimePermissions = false;
@@ -7886,7 +8228,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 					plan = await verifyPlatformAiGatewayPlan(client, planInput, existing, plan, authoritativeProvisionIntents);
 				}
 			} catch (error) {
-				if (credentialSetup && token === values.cloudflareApiToken && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
+				if (credentialSetup && token === values.cloudflareApiToken && !(error instanceof PlatformRuntimeTokenEmailPermissionError) && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
 					delete values.cloudflareApiToken;
 					writePendingInstallationSecrets(setupManifest, values);
 					rejectedSavedRuntimeToken = true;
@@ -7981,6 +8323,14 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			title: "About these keys",
 			url: "https://void.cloud/guide/platform/installation/credentials#signing-and-encryption-keys"
 		}));
+		const outsideChanges = await reviewPlatformWorkerOutsideChanges({
+			client,
+			plan,
+			runtime,
+			installation: { manifest: existing },
+			interactive: process.stdin.isTTY === true && process.stdout.isTTY === true && !args.yes,
+			command: `${cliCommandName()} platform install --resume --name ${existing.id}`
+		});
 		progress = startProgress("Installing the platform");
 		if (credentialSetup) {
 			saveValues({
@@ -7999,6 +8349,15 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			},
 			client,
 			operatorApiToken: managementApiToken || operatorCredential.token,
+			...outsideChanges.length > 0 ? {
+				replaceOutsideChanges: outsideChanges.map((change) => change.name),
+				uploadOutsideChanges: (configs) => uploadPlatformWorkerOutsideChanges(configs, {
+					changes: outsideChanges,
+					client,
+					operatorApiToken: managementApiToken || operatorCredential.token,
+					progress
+				})
+			} : {},
 			runtime,
 			healthCheckResumeCommand: `${cliCommandName()} platform install --resume --name ${existing.id}`,
 			onProgress: (message) => progress?.message(message),
@@ -8040,7 +8399,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DvBS83rC.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-DAE6g2QU.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8197,4 +8556,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	return value;
 }
 //#endregion
-export { matchesRecordedR2Fingerprint as A, activatePlatformAccessCredentials as B, platformTrafficAttachmentWorker as C, formatPlatformInstallPlan as D, dnsRecordConfigHash as E, platformDatabaseNameFromOwnerUrl as F, PlatformCloudflareClient as G, parsePlatformAccessSetupSpec as H, turnOffInstalledProjectZeroTrust as I, hyperdriveOriginMatches as J, hyperdriveOriginConfigHash as K, assertPlatformOperatorCredentialCanApplyPlan as L, r2BucketConfigHash as M, resourceMarkerProblem as N, hasProvisionIntentStep as O, revalidatePlatformInstallAction as P, resolvePlatformCloudflareCredential as R, recordResource as S, createPlatformInstallPlan as T, preparePlatformAccessSetup as U, checkpointPlatformAccessResources as V, PlatformCloudflareApiError as W, verifyPlatformRuntimeTokenPermissions as Y, readPlatformDatabase as _, authenticationSetupRequestHash as a, createPlatformInstallationSecrets as b, REMOTE_INSTALLATION_MANIFEST_KEY as c, acquirePlatformDatabaseLifecycleLockConnection as d, platformDatabaseClientUrl as f, formatZeroTrustApplications as g, assertProjectZeroTrustAllowsUninstall as h, verifyPlatformAiGatewayPlan as i, platformAdoptionIntentHash as j, legacyResourceConfigHash as k, installPlatform as l, readPlatformProjectZeroTrustState as m, resolvePlatformInstallDatabaseUrl as n, readLoginReplacementFile as o, readPlatformProjectSlugs as p, hyperdriveOriginFromConnectionString as q, runPlatformLifecycleCommand as r, replacePendingInstallationAuthentication as s, assertNoninteractivePlatformMutationAcknowledged as t, acquirePlatformDatabaseLifecycleLock as u, loadPlatformRuntime as v, recordPlatformWorkerTraffic as w, resolveBootstrapGitHubId as x, createPlatformHealthProbeToken as y, verifyPlatformCloudflareCredential as z };
+export { hyperdriveOriginMatches as $, dnsRecordConfigHash as A, turnOffInstalledProjectZeroTrust as B, createPlatformHealthProbeToken as C, platformTrafficAttachmentWorker as D, recordResource as E, platformAdoptionIntentHash as F, checkpointPlatformAccessResources as G, resolvePlatformCloudflareCredential as H, r2BucketConfigHash as I, PlatformCloudflareApiError as J, parsePlatformAccessSetupSpec as K, resourceMarkerProblem as L, hasProvisionIntentStep as M, legacyResourceConfigHash as N, recordPlatformWorkerTraffic as O, matchesRecordedR2Fingerprint as P, hyperdriveOriginFromConnectionString as Q, revalidatePlatformInstallAction as R, loadPlatformRuntime as S, resolveBootstrapGitHubId as T, verifyPlatformCloudflareCredential as U, assertPlatformOperatorCredentialCanApplyPlan as V, activatePlatformAccessCredentials as W, PlatformRuntimeTokenEmailPermissionError as X, PlatformCloudflareClient as Y, hyperdriveOriginConfigHash as Z, readPlatformProjectSlugs as _, findPlatformWorkerOutsideChanges as a, formatZeroTrustApplications as b, uploadPlatformWorkerOutsideChanges as c, replacePendingInstallationAuthentication as d, verifyPlatformRuntimeTokenEmailPermissions as et, REMOTE_INSTALLATION_MANIFEST_KEY as f, platformDatabaseClientUrl as g, acquirePlatformDatabaseLifecycleLockConnection as h, verifyPlatformAiGatewayPlan as i, formatPlatformInstallPlan as j, createPlatformInstallPlan as k, authenticationSetupRequestHash as l, acquirePlatformDatabaseLifecycleLock as m, resolvePlatformInstallDatabaseUrl as n, formatPlatformWorkerOutsideChanges as o, installPlatform as p, preparePlatformAccessSetup as q, runPlatformLifecycleCommand as r, reviewPlatformWorkerOutsideChanges as s, assertNoninteractivePlatformMutationAcknowledged as t, verifyPlatformRuntimeTokenPermissions as tt, readLoginReplacementFile as u, readPlatformProjectZeroTrustState as v, createPlatformInstallationSecrets as w, readPlatformDatabase as x, assertProjectZeroTrustAllowsUninstall as y, platformDatabaseNameFromOwnerUrl as z };