void 1.3.0 → 1.5.0

package/dist/{platform-lifecycle-3dwFJmnq.mjs → platform-lifecycle-BCsFg1Tl.mjs}

@@ -1,15 +1,15 @@
-import { a as join, c as resolve, n as dirname } from "./dist-ipQi0Q8y.mjs";
-import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
-import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
-import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-Cor9XGoz.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
-import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-8jEYIeim.mjs";
-import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-B7UFrBH7.mjs";
-import { t as parsePlatformArgs } from "./platform-args-BMD2gjc_.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Byo_0_N9.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-Ca53gtt0.mjs";
+import { a as join, c as resolve, n as dirname } from "./dist-DMYe8CZJ.mjs";
+import { t as writeFileAtomic } from "./atomic-write-DA6eD1Kp.mjs";
+import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-DZ_2Xuqd.mjs";
+import { t as cfAccessHeaders } from "./cf-access-pejlJmuy.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-BmBT2h8_.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D23AAMxT.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BCdLioKP.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-DjJ638A-.mjs";
+import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-CRiNnlfE.mjs";
+import { t as parsePlatformArgs } from "./platform-args-Bv9hoLEL.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CEu-1Ps_.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-VEcHu0Vq.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -23,7 +23,7 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
 import { request as request$1 } from "node:https";
-//#region src/cli/platform-cloudflare.ts
+// src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
 	status;
 	requestPath;
@@ -936,8 +936,7 @@ function parseHyperdriveConfig(value) {
 		}
 	};
 }
-//#endregion
-//#region src/cli/platform-access-provision.ts
+// src/cli/platform-access-provision.ts
 function object(value, name) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`platform: Invalid ${name} response from Cloudflare Access.`);
 	return value;
@@ -1355,8 +1354,7 @@ async function verifyPlatformAccessApplication(client, input, app, type, machine
 	}
 	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
 }
-//#endregion
-//#region src/cli/platform-access-setup.ts
+// src/cli/platform-access-setup.ts
 function accessSetupGuide() {
 	return platformSetupLink({
 		title: "Setup guide and required permissions",
@@ -1744,8 +1742,7 @@ async function preparePlatformAccessSetup(input) {
 	}
 	return result;
 }
-//#endregion
-//#region src/cli/platform-auth.ts
+// src/cli/platform-auth.ts
 /** Use the selected credential for read-only checks before taking lifecycle locks. */
 async function verifyPlatformCloudflareCredential(client, input) {
 	const source = input.source === "saved" ? "saved management token" : input.source === "environment" ? "environment API token" : "Cloudflare browser login";
@@ -1875,8 +1872,7 @@ async function readWranglerOAuthCredential(runWrangler) {
 		token: parsed.token.trim()
 	};
 }
-//#endregion
-//#region src/cli/platform-app-access.ts
+// src/cli/platform-app-access.ts
 async function selectInstallationAppAccess(authentication, recorded, choice) {
 	const config = authentication.file?.appAccess;
 	if (config && (typeof config !== "object" || Array.isArray(config) || "apiToken" in config || config.tokenEnv !== void 0 && (typeof config.tokenEnv !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(config.tokenEnv)))) throw new Error("platform: App access configuration must use tokenEnv; plaintext tokens are not accepted.");
@@ -2131,8 +2127,7 @@ async function turnOffInstalledProjectZeroTrust(input, fetcher = fetch) {
 	if (!result.turnedOff) throw new Error("platform: Project Zero Trust is still turning off. Rerun the uninstall.");
 	if (result.usersExist) throw new Error("platform: A platform user signed in while project Zero Trust was turning off, so the uninstall stopped. Project Zero Trust is now off and the platform still runs. To keep the platform, an administrator can turn project Zero Trust back on in Admin → Zero Trust or with `void platform zero-trust configure`. To remove it, run the uninstall again.");
 }
-//#endregion
-//#region src/cli/platform-auth-bootstrap.ts
+// src/cli/platform-auth-bootstrap.ts
 /** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
 async function resumeInstalledPlatformAuthentication(input, initialize = initializeInstalledPlatformAuthentication) {
 	const result = await initialize(input.apiUrl, input.installationId, input.setupToken, input.setupJson);
@@ -2174,8 +2169,7 @@ async function initializeInstalledPlatformAuthentication(apiUrl, installationId,
 		expiresAt: typeof result.expiresAt === "string" ? result.expiresAt : null
 	};
 }
-//#endregion
-//#region src/cli/platform-auth-database.ts
+// src/cli/platform-auth-database.ts
 /** Restore the selected external origin before an adoption receipt exists. */
 function readPlatformHyperdriveSelection(checkpoint) {
 	if (!checkpoint?.externalHyperdriveJson) return;
@@ -2233,8 +2227,7 @@ async function verifyPlatformAuthenticationDatabase(client, accountId, resource,
 	await client.disableHyperdriveCaching(accountId, resource.id);
 	if ((await read()).cachingDisabled !== true) throw new Error("platform: Could not verify uncached Hyperdrive reads. Authentication setup remains closed.");
 }
-//#endregion
-//#region src/cli/platform-installer-process.ts
+// src/cli/platform-installer-process.ts
 function platformWorkerCommandRunner(accountId, cwd, runner) {
 	return (operation, options) => runner(operation, accountId, cwd, options.capture);
 }
@@ -2390,8 +2383,7 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl, apiToken) {
 	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl, false, apiToken), upstreamApiBaseUrl);
 }
-//#endregion
-//#region src/cli/platform-plan.ts
+// src/cli/platform-plan.ts
 async function createPlatformInstallPlan(client, input, existing, options) {
 	const dashboardUrl = input.dashboardUrl !== void 0 ? normalizePlatformDashboardUrl(input.dashboardUrl) : existing ? existing.deployment.controlPlane.dashboardUrl ?? (existing.endpoints.dashboardUrl ? normalizePlatformDashboardUrl(existing.endpoints.dashboardUrl) : null) ?? platformDashboardUrl(existing.deployment) : null;
 	const account = resolveAccount(await client.listAccounts(), input.accountId);
@@ -3089,8 +3081,7 @@ function formatPlatformInstallPlan(plan) {
 	for (const action of plan.actions) lines.push(`${action.action.padEnd(6)} ${action.kind.padEnd(19)} ${action.name}`);
 	return lines.join("\n");
 }
-//#endregion
-//#region src/cli/platform-traffic.ts
+// src/cli/platform-traffic.ts
 function platformManagedWorkerTraffic(deployment, workers) {
 	const includes = (worker) => workers === void 0 || workers.has(worker);
 	const names = deployment.resources;
@@ -3166,8 +3157,7 @@ function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt)
 	}
 	return next;
 }
-//#endregion
-//#region src/cli/platform-installer-resources.ts
+// src/cli/platform-installer-resources.ts
 async function reconcilePlatformInstallationResources(manifest, plan, secrets, zoneId, externalHyperdriveOriginHash, dependencies, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	for (const action of plan.actions.filter((entry) => entry.key !== "routing-kv" && entry.kind !== "zone" && entry.kind !== "worker")) {
 		const retainedManifest = retainReplacedInstallationResource(manifest, action, now());
@@ -3413,8 +3403,7 @@ function requireId(ids, key) {
 	if (!id) throw new Error(`platform: Installation manifest is missing ${key}.`);
 	return id;
 }
-//#endregion
-//#region src/cli/platform-installer-types.ts
+// src/cli/platform-installer-types.ts
 const PLATFORM_WORKER_SECRET_UPDATE_NAMES = [
 	"CF_API_TOKEN",
 	"EMAIL_SIGNING_SECRET",
@@ -3446,8 +3435,7 @@ var PlatformWorkerRecoveryIncompleteError = class extends Error {
 		this.name = "PlatformWorkerRecoveryIncompleteError";
 	}
 };
-//#endregion
-//#region src/cli/platform-installer-secrets.ts
+// src/cli/platform-installer-secrets.ts
 function createPlatformInstallationSecrets(input) {
 	const checkpoint = input.checkpoint ?? {};
 	const required = (value, name) => {
@@ -3746,8 +3734,7 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWi
 function createPlatformHealthProbeToken(ownershipNonce) {
 	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
 }
-//#endregion
-//#region src/cli/platform-installer-errors.ts
+// src/cli/platform-installer-errors.ts
 const ANALYTICS_ENGINE_NOT_ENABLED = 10089;
 const UPLOAD_CONFLICT = "Aborting the upload operation because of conflicts";
 /** Why the Cloudflare CLI stopped an upload, and what to do. Null for other failures. */
@@ -3788,8 +3775,7 @@ function assertPlatformTriggerStabilization(result, workerName, targetVersionId,
 	if (!result.ok) throw new Error(`platform: Failed to ${operation} triggers for ${workerName} (${result.reason}).`);
 	if (!result.targetOwnsTraffic) throw new Error(`platform: Worker ${workerName} was superseded by ${result.activeVersionId} while publishing ${targetVersionId}; its active trigger state was repaired.`);
 }
-//#endregion
-//#region src/cli/platform-installer-inspection.ts
+// src/cli/platform-installer-inspection.ts
 var PlatformWorkerOwnershipError = class extends Error {};
 async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
 	const result = await runner({
@@ -3952,8 +3938,7 @@ async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerNa
 		versionId
 	};
 }
-//#endregion
-//#region src/cli/platform-installer-cutover.ts
+// src/cli/platform-installer-cutover.ts
 function withoutCompletedPlatformWorkerMigrations(config, activeMigrationTag) {
 	const target = (Array.isArray(config.migrations) ? config.migrations : []).at(-1);
 	if (activeMigrationTag === null || !target || typeof target !== "object" || Array.isArray(target) || target.tag !== activeMigrationTag) return config;
@@ -4145,8 +4130,7 @@ function resolvePlatformPreviousTriggerConfig(versionSnapshot, configuredSnapsho
 		workers_dev: configuredSnapshot.workers_dev
 	};
 }
-//#endregion
-//#region src/cli/platform-trigger-proof.ts
+// src/cli/platform-trigger-proof.ts
 function record(value) {
 	return isRecord(value) ? value : null;
 }
@@ -4235,8 +4219,7 @@ async function platformWorkerLiveTriggersMatch(options) {
 		return false;
 	}
 }
-//#endregion
-//#region src/cli/platform-installer-workers.ts
+// src/cli/platform-installer-workers.ts
 function platformWorkerResourceKey(key) {
 	return key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`;
 }
@@ -4862,8 +4845,7 @@ async function restorePlatformWorkerDeployment(input) {
 	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
-//#endregion
-//#region src/cli/platform-install-workers.ts
+// src/cli/platform-install-workers.ts
 function platformWorkerAction(workerActions, key) {
 	return workerActions.find((entry) => entry.key === platformWorkerResourceKey(key));
 }
@@ -5040,8 +5022,7 @@ async function uploadInstallationWorkers(input) {
 		if (firstFailure) throw firstFailure.reason;
 	} else for (const key of workerKeys) await deployOneWorker(key);
 }
-//#endregion
-//#region src/cli/platform-installer-health.ts
+// src/cli/platform-installer-health.ts
 var PlatformAccessBlockedError = class extends Error {
 	constructor(url, context) {
 		super(context?.accessProtected ? [
@@ -5259,8 +5240,7 @@ async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher =
 	}
 	return operationId;
 }
-//#endregion
-//#region src/cli/platform-install-activation.ts
+// src/cli/platform-install-activation.ts
 async function enableInstallationServices(input) {
 	const { state, checkpointOperation, requiresStagedCommit, authenticationCutoverCommitted, now, writeRemoteInstallationCheckpoint, dependencies, workerKeys, workerActions, workerDeploymentSecrets, zoneId, enabledConfigs, configs, cloudflareApiBaseUrl, managedRoutes, ids, runPinnedPlatformWrangler, shouldBootstrapSharedEmail, releaseDatabaseLock, version, targetUsageProtocolVersion, healthCheckContext, runtime, runtimeProvenance } = input;
 	const { plan, secrets } = state;
@@ -5363,8 +5343,7 @@ async function enableInstallationServices(input) {
 	state.manifest = transitionInstallation(state.manifest, "installed", now());
 	return { emailOperationId };
 }
-//#endregion
-//#region src/cli/platform-access-health.ts
+// src/cli/platform-access-health.ts
 /** These reserved endpoints require Void's probe token and cannot serve application traffic. */
 function platformAccessHealthTargets(plan) {
 	const destination = `${plan.deployment.application.zoneName ? `${PLATFORM_HEALTH_HOSTNAME_LABEL}.${plan.deployment.application.baseDomain}` : `${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`}/health`;
@@ -5469,8 +5448,7 @@ async function ensurePlatformAccessHealthChecks(input) {
 		save();
 	}
 }
-//#endregion
-//#region src/cli/platform-access-preflight.ts
+// src/cli/platform-access-preflight.ts
 /** Recheck live protection without invoking any provisioning or configuration write. */
 async function verifyInstalledPlatformAccessProtection(input) {
 	const protection = parsePlatformAccessProtection(input.protection);
@@ -5516,7 +5494,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-NjRejttU.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DQDSxVhr.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -5524,8 +5502,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 		}, input.manifest, origins, false, { workerNames: existingWorkers });
 	}
 }
-//#endregion
-//#region src/cli/platform-install-preparation.ts
+// src/cli/platform-install-preparation.ts
 function withAuthentication(deployment, authentication) {
 	return createPlatformDeploymentManifest({
 		...deployment,
@@ -5723,8 +5700,7 @@ async function prepareInstallationAuthentication(input) {
 		}
 	}
 }
-//#endregion
-//#region src/cli/platform-installer-runtime.ts
+// src/cli/platform-installer-runtime.ts
 function loadPlatformRuntime(customRuntimeDirectory) {
 	const runtime = resolvePlatformRuntime(customRuntimeDirectory || void 0);
 	verifyRuntimeArtifacts(runtime.directory, runtime.manifest);
@@ -5763,8 +5739,7 @@ function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
 		if (hash(contents) !== migration.sha256) throw new Error(`platform: Runtime database migration failed integrity verification: ${path}.`);
 	}
 }
-//#endregion
-//#region src/cli/platform-zero-trust-uninstall.ts
+// src/cli/platform-zero-trust-uninstall.ts
 /**
 * Uninstall turns off the platform API, and only that API can remove the
 * Cloudflare Access applications project Zero Trust created. The shared
@@ -5962,8 +5937,7 @@ async function assertProjectZeroTrustAllowsUninstall(read, options = {}) {
 		DASHBOARD_HINT
 	].join("\n"));
 }
-//#endregion
-//#region src/cli/platform-installer-database.ts
+// src/cli/platform-installer-database.ts
 async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	dependencies.onProgress?.("Checking the platform database schema");
 	const rollbackDatabase = dependencies.databaseRollbackSource;
@@ -6475,8 +6449,7 @@ async function claimPlatformDatabaseConnection(client, installationId, ownership
 		throw error;
 	}
 }
-//#endregion
-//#region src/cli/platform-install-provisioning.ts
+// src/cli/platform-install-provisioning.ts
 async function provisionInstallationServices(input) {
 	const { state, now, releaseDatabaseLock, dependencies, writeRemoteInstallationCheckpoint, checkpointOperation, externalHyperdriveOriginHash, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers } = input;
 	const { plan, secrets } = state;
@@ -6581,8 +6554,7 @@ async function provisionInstallationServices(input) {
 		entrypoints
 	};
 }
-//#endregion
-//#region src/cli/platform-secret-update-authority.ts
+// src/cli/platform-secret-update-authority.ts
 /**
 * Prevents a host without the encrypted values for an interrupted credential
 * update from carrying an opaque, possibly partial update into another cutover.
@@ -6622,8 +6594,7 @@ function readLatestWorkerGeneration(manifest) {
 function hasCompleteWorkerSecretReplacement(updates, requiresEmailSigningSecret) {
 	return PLATFORM_WORKER_SECRET_UPDATE_NAMES.every((name) => name === "EMAIL_SIGNING_SECRET" && !requiresEmailSigningSecret || typeof updates[name] === "string" && updates[name] !== "");
 }
-//#endregion
-//#region src/cli/platform-installer.ts
+// src/cli/platform-installer.ts
 async function recoverFailedPlatformInstallation(error, state) {
 	const { plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, operationStarted, now, writeRemoteInstallationCheckpoint } = state;
 	let { manifest } = state;
@@ -7218,8 +7189,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		await releaseDatabaseLock();
 	}
 }
-//#endregion
-//#region src/cli/platform-install-auth.ts
+// src/cli/platform-install-auth.ts
 function defaultConnectionId(kind) {
 	return kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind;
 }
@@ -7548,8 +7518,7 @@ async function replacePendingInstallationAuthentication(input) {
 		authBootstrapCode
 	};
 }
-//#endregion
-//#region src/cli/platform-installer-outside-changes.ts
+// src/cli/platform-installer-outside-changes.ts
 const OUTSIDE_SOURCES = {
 	dash: "changed in the Cloudflare dashboard",
 	api: "changed in the Cloudflare API",
@@ -7713,8 +7682,7 @@ async function uploadPlatformWorkerOutsideChanges(configs, input) {
 		input.progress?.resume();
 	}
 }
-//#endregion
-//#region src/cli/platform-saved-plans.ts
+// src/cli/platform-saved-plans.ts
 function planId(args) {
 	return createHash("sha256").update(JSON.stringify([args.account, args.name])).digest("hex");
 }
@@ -7769,8 +7737,7 @@ function listSavedPlatformInstallPlans(directory = platformRegistryDirectory())
 function removeSavedPlatformInstallPlan(args, directory = platformRegistryDirectory()) {
 	rmSync(join(directory, `plan-${planId(args)}.json`), { force: true });
 }
-//#endregion
-//#region src/cli/platform-setup-draft.ts
+// src/cli/platform-setup-draft.ts
 const STARTED = "credential-setup:v1";
 const COMPLETED = "credential-setup-complete:v1";
 /** Includes interrupted provisioning, but not maintenance of an already deployed platform. */
@@ -7818,8 +7785,7 @@ function completePlatformSetupDraft(manifest) {
 	writeInstallationManifest(completed);
 	return completed;
 }
-//#endregion
-//#region src/cli/platform-lifecycle.ts
+// src/cli/platform-lifecycle.ts
 function isPlatformInstallDatabaseBound(checkpoint, manifest) {
 	return Boolean(checkpoint?.databaseClaimState === "claimed" || manifest?.resources.some((resource) => resource.state === "ready" && (resource.kind === "hyperdrive" || resource.kind === "worker")) || manifest?.steps.some((step) => step.key.startsWith("database-schema:") || step.key.startsWith("database-migrations:")));
 }
@@ -7838,14 +7804,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-DLSQ8GF8.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-Bnq0vg0q.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-8vNE5dNN.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-DBNoME3I.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7856,7 +7822,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-ZK6XcbCo.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-CMJR8Zi-.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -8032,7 +7998,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-ZK6XcbCo.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CMJR8Zi-.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8472,7 +8438,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-ZK6XcbCo.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CMJR8Zi-.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8628,5 +8594,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
-//#endregion
 export { hyperdriveOriginMatches as $, dnsRecordConfigHash as A, turnOffInstalledProjectZeroTrust as B, createPlatformHealthProbeToken as C, platformTrafficAttachmentWorker as D, recordResource as E, platformAdoptionIntentHash as F, checkpointPlatformAccessResources as G, resolvePlatformCloudflareCredential as H, r2BucketConfigHash as I, PlatformCloudflareApiError as J, parsePlatformAccessSetupSpec as K, resourceMarkerProblem as L, hasProvisionIntentStep as M, legacyResourceConfigHash as N, recordPlatformWorkerTraffic as O, matchesRecordedR2Fingerprint as P, hyperdriveOriginFromConnectionString as Q, revalidatePlatformInstallAction as R, loadPlatformRuntime as S, resolveBootstrapGitHubId as T, verifyPlatformCloudflareCredential as U, assertPlatformOperatorCredentialCanApplyPlan as V, activatePlatformAccessCredentials as W, PlatformRuntimeTokenEmailPermissionError as X, PlatformCloudflareClient as Y, hyperdriveOriginConfigHash as Z, readPlatformProjectSlugs as _, findPlatformWorkerOutsideChanges as a, formatZeroTrustApplications as b, uploadPlatformWorkerOutsideChanges as c, replacePendingInstallationAuthentication as d, verifyPlatformRuntimeTokenEmailPermissions as et, REMOTE_INSTALLATION_MANIFEST_KEY as f, platformDatabaseClientUrl as g, acquirePlatformDatabaseLifecycleLockConnection as h, verifyPlatformAiGatewayPlan as i, formatPlatformInstallPlan as j, createPlatformInstallPlan as k, authenticationSetupRequestHash as l, acquirePlatformDatabaseLifecycleLock as m, resolvePlatformInstallDatabaseUrl as n, formatPlatformWorkerOutsideChanges as o, installPlatform as p, preparePlatformAccessSetup as q, runPlatformLifecycleCommand as r, reviewPlatformWorkerOutsideChanges as s, assertNoninteractivePlatformMutationAcknowledged as t, verifyPlatformRuntimeTokenPermissions as tt, readLoginReplacementFile as u, readPlatformProjectZeroTrustState as v, createPlatformInstallationSecrets as w, readPlatformDatabase as x, assertProjectZeroTrustAllowsUninstall as y, platformDatabaseNameFromOwnerUrl as z };

package/dist/{platform-lifecycle-BRqcxerG.mjs → platform-lifecycle-BQiN9HN5.mjs}

@@ -1 +1 @@
-export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-3dwFJmnq.mjs";
+export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-BCsFg1Tl.mjs";

package/dist/{platform-management-ZK6XcbCo.mjs → platform-management-CMJR8Zi-.mjs}

@@ -1 +1 @@
-export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-ZZ6bQM5j.mjs";
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-nzCDwtiN.mjs";

package/dist/{platform-management-ZZ6bQM5j.mjs → platform-management-nzCDwtiN.mjs}

@@ -1,11 +1,11 @@
-import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
-import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-BpgYODYx.mjs";
-import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-3dwFJmnq.mjs";
+import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-DZ_2Xuqd.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-BmBT2h8_.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-D23AAMxT.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-BCdLioKP.mjs";
+import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-BCsFg1Tl.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
-//#region src/cli/platform-teardown.ts
+// src/cli/platform-teardown.ts
 /**
 * `void platform uninstall --purge-resources` deletes every Cloudflare resource the
 * installation created, in an order Cloudflare accepts:
@@ -591,8 +591,7 @@ async function runPurgeResourcesTeardown(context, initial) {
 		await markDeleted(bucket.key);
 	}
 }
-//#endregion
-//#region src/cli/platform-management.ts
+// src/cli/platform-management.ts
 async function verifyPlatformInstallationOwnership(client, manifest, options = {}) {
 	const ready = manifest.resources.filter((resource) => resource.state === "ready" && isOwnershipVerifiableKind(resource.kind) && !options.retainedReplacementKeys?.has(resource.key));
 	if (!ready.find((resource) => resource.key === "routing-kv")) {
@@ -1578,5 +1577,4 @@ async function promptForConfirmation(message, initialValue) {
 	if (isCancel(answer) || typeof answer === "symbol") throw new Error("platform: Cancelled.");
 	return answer;
 }
-//#endregion
 export { recoverDurablyMarkedProvisionIntents as a, runInstalledPlatformCommand as c, verifyPlatformInstallationOwnership as d, platformLifecycleResumeCommand as i, selectAuthoritativePlatformManifest as l, disablePlatform as n, resolveInstalledPlatformManifest as o, isPlatformManifestMonotonicExtension as r, resolvePlatformRuntimeTokenToPreflight as s, assertPlatformRollbackCompatibility as t, uninstallPlatform as u };

package/dist/{platform-plans-config-CeydDSj0.mjs → platform-plans-config-Dx1agneU.mjs}

@@ -1,11 +1,11 @@
-import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-Cor9XGoz.mjs";
-import { m as printSuccess } from "./output-BpgYODYx.mjs";
-import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
-import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
+import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-D23AAMxT.mjs";
+import { m as printSuccess } from "./output-BCdLioKP.mjs";
+import { n as OperatorClient, r as OperatorClientError } from "./operator-client-BIY4-N_6.mjs";
+import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-CfDcmzpo.mjs";
 import { stripVTControlCharacters } from "node:util";
 import { PLAN_EDITABLE_LIMIT_KEYS, PLAN_LIMITS, parseBuildInstanceType, parsePlanLimitsPatch, parsePlanName, parsePlatformPlanId } from "@void/platform/plans";
 import { readFile } from "node:fs/promises";
-//#region src/cli/platform-plans-config.ts
+// src/cli/platform-plans-config.ts
 const limitLabels = {
 	requestsPerMonth: "Requests per billing month",
 	cpuMsPerRequest: "Default CPU per request (ms)",
@@ -360,5 +360,4 @@ async function runPlatformPlansConfig(args) {
 	}
 	await apply(client, path, body, args, catalog);
 }
-//#endregion
 export { runPlatformPlansConfig };

package/dist/{platform-recovery-8vNE5dNN.mjs → platform-recovery-DBNoME3I.mjs}

@@ -1,9 +1,9 @@
-import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
-import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-3dwFJmnq.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-ZZ6bQM5j.mjs";
+import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-DZ_2Xuqd.mjs";
+import { t as cfAccessHeaders } from "./cf-access-pejlJmuy.mjs";
+import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-BCsFg1Tl.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-nzCDwtiN.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
-//#region src/cli/platform-recovery.ts
+// src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {
 	const namespaces = await client.listKvNamespaces(accountId);
 	const recovered = [];
@@ -93,5 +93,4 @@ async function verifyInstallationEndpoint(manifest, fetcher = fetch) {
 	if (!response.ok) throw new Error(`platform: Installation ${manifest.id} is not reachable (HTTP ${response.status}).`);
 	if ((await response.json()).installationId !== manifest.id) throw new Error(`platform: Installation ${manifest.id} endpoint identity does not match.`);
 }
-//#endregion
 export { recoverPlatformInstallations };

package/dist/{platform-registry-B9mWX9LO.mjs → platform-registry-DZ_2Xuqd.mjs}

@@ -1,11 +1,11 @@
-import { a as join, c as resolve } from "./dist-ipQi0Q8y.mjs";
-import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
+import { a as join, c as resolve } from "./dist-DMYe8CZJ.mjs";
+import { t as writeFileAtomic } from "./atomic-write-DA6eD1Kp.mjs";
 import { closeSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { parsePlatformInstallationManifest } from "@void/platform";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { homedir, hostname } from "node:os";
 import { Entry } from "@napi-rs/keyring";
-//#region src/cli/keyring.ts
+// src/cli/keyring.ts
 function readKeyringPassword(service, account) {
 	try {
 		return new Entry(service, account).getPassword();
@@ -29,8 +29,7 @@ function deleteKeyringPassword(service, account) {
 		return false;
 	}
 }
-//#endregion
-//#region src/cli/platform-registry.ts
+// src/cli/platform-registry.ts
 const PLATFORM_REGISTRY_SCHEMA_VERSION = 1;
 const DEFAULT_REGISTRY = {
 	activeConnectionId: null,
@@ -433,5 +432,4 @@ function removePlatformConnectionForInstallation(installationId, directory = pla
 		});
 	});
 }
-//#endregion
 export { deleteKeyringPassword as C, writePendingInstallationSecrets as S, writeKeyringPassword as T, removePlatformConnectionForInstallation as _, latestPlatformWorkerCutoverGeneration as a, selectPlatformConnection as b, normalizePlatformApiUrl as c, platformRegistryDirectory as d, platformWorkerSecretUpdateIntentState as f, removeInstallationRecoverySecrets as g, readPendingInstallationSecrets as h, getActivePlatformConnection as i, platformConnectionSlug as l, readInstallationRecoverySecrets as m, assertPlatformInstallationSlugAvailable as n, listInstallationManifests as o, promoteInstallationSecrets as p, findPlatformConnections as r, listPlatformConnections as s, acquirePlatformLifecycleLock as t, platformCredentialAccount as u, resolveInstallationManifest as v, readKeyringPassword as w, writeInstallationManifest as x, savePlatformConnection as y };

package/dist/{platform-setup-Ca53gtt0.mjs → platform-setup-VEcHu0Vq.mjs}

@@ -1,7 +1,7 @@
-import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
-import { L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
-import { f as import_picocolors, s as formatLink } from "./output-BpgYODYx.mjs";
-//#region src/cli/platform-setup.ts
+import { u as openBrowser } from "./auth-Dy8svcqQ.mjs";
+import { L as log, tt as isCancel } from "./dist-D23AAMxT.mjs";
+import { f as import_picocolors, s as formatLink } from "./output-BCdLioKP.mjs";
+// src/cli/platform-setup.ts
 /** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
 function platformPromptAnswer(value) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
@@ -289,5 +289,4 @@ function openPlatformSetupPage(page, dependencies = {}) {
 		log.info("Could not open the browser. Use the link above.");
 	}
 }
-//#endregion
 export { platformManagementSetupPage as a, platformSetupLink as c, platformInstallCommandArguments as i, platformSetupPages as l, formatPlatformSetupPlan as n, platformPromptAnswer as o, openPlatformSetupPage as r, platformSetupFieldHelp as s, formatPlatformInstallCommand as t };