void 1.4.0 → 1.6.0

package/dist/{platform-lifecycle-CPYY7E9B.mjs → platform-lifecycle-D9RdGub1.mjs}

@@ -1,15 +1,16 @@
-import { a as join, c as resolve, n as dirname } from "./dist-ipQi0Q8y.mjs";
-import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
-import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
-import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-Cor9XGoz.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
-import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-8jEYIeim.mjs";
-import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-DztLJ97X.mjs";
-import { t as parsePlatformArgs } from "./platform-args-BMD2gjc_.mjs";
-import { o as runCloudflareAuthCommand } from "./cloudflare-auth-DyD_kVFr.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-Ca53gtt0.mjs";
+import { a as join, c as resolve, n as dirname } from "./dist-DMYe8CZJ.mjs";
+import { t as writeFileAtomic } from "./atomic-write-DA6eD1Kp.mjs";
+import { S as writePendingInstallationSecrets, a as latestPlatformWorkerCutoverGeneration, c as normalizePlatformApiUrl, d as platformRegistryDirectory, f as platformWorkerSecretUpdateIntentState, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, n as assertPlatformInstallationSlugAvailable, o as listInstallationManifests, p as promoteInstallationSecrets, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-DZ_2Xuqd.mjs";
+import { t as cfAccessHeaders } from "./cf-access-pejlJmuy.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-BmBT2h8_.mjs";
+import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D23AAMxT.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BCdLioKP.mjs";
+import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-DjJ638A-.mjs";
+import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-BbCzpbXs.mjs";
+import { t as parsePlatformArgs } from "./platform-args-Cx1M-7bq.mjs";
+import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CEu-1Ps_.mjs";
+import { i as updateProjectWorkerRuntimeLogs, n as assertPlatformRuntimeLogsSupported, r as shouldUpdateProjectWorkerRuntimeLogs } from "./platform-runtime-logs-CdJGnk3f.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, d as planWritesDns, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand, u as planCreatesZone } from "./platform-setup-Vw1AaUN8.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -23,7 +24,7 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { readFile } from "node:fs/promises";
 import { PLATFORM_ADMIN_ASSETS_DIRECTORY, platformDatabaseSchemaDigest, resolvePlatformRuntime } from "@void/platform/installer";
 import { request as request$1 } from "node:https";
-//#region src/cli/platform-cloudflare.ts
+// src/cli/platform-cloudflare.ts
 var PlatformCloudflareApiError = class extends Error {
 	status;
 	requestPath;
@@ -161,7 +162,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			headers: {
 				Accept: "application/json",
 				Authorization: `Bearer ${this.#token}`,
-				...init?.body ? { "Content-Type": "application/json" } : {},
+				...typeof init?.body === "string" ? { "Content-Type": "application/json" } : {},
 				...init?.headers
 			},
 			signal: init?.signal ?? AbortSignal.timeout(3e4),
@@ -733,6 +734,15 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 	async listDispatchNamespaceScripts(accountId, namespace) {
 		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts`)).map((entry) => requiredString(entry.id, "Dispatch namespace script name"));
 	}
+	/** Change settings of one namespace script. Omitted fields, such as bindings, are kept. */
+	async patchDispatchNamespaceScriptSettings(accountId, namespace, scriptName, settings) {
+		const body = new FormData();
+		body.set("settings", new Blob([JSON.stringify(settings)], { type: "application/json" }), "settings.json");
+		await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(scriptName)}/settings`, {
+			method: "PATCH",
+			body
+		});
+	}
 	async deleteDispatchNamespaceScript(accountId, namespace, scriptName) {
 		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(scriptName)}`);
 	}
@@ -936,8 +946,7 @@ function parseHyperdriveConfig(value) {
 		}
 	};
 }
-//#endregion
-//#region src/cli/platform-access-provision.ts
+// src/cli/platform-access-provision.ts
 function object(value, name) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`platform: Invalid ${name} response from Cloudflare Access.`);
 	return value;
@@ -1355,8 +1364,7 @@ async function verifyPlatformAccessApplication(client, input, app, type, machine
 	}
 	if (machineId && !currentPolicies.some((policy) => policy.decision === "non_identity")) throw new Error("platform: The platform service token is not admitted by Access.");
 }
-//#endregion
-//#region src/cli/platform-access-setup.ts
+// src/cli/platform-access-setup.ts
 function accessSetupGuide() {
 	return platformSetupLink({
 		title: "Setup guide and required permissions",
@@ -1744,8 +1752,7 @@ async function preparePlatformAccessSetup(input) {
 	}
 	return result;
 }
-//#endregion
-//#region src/cli/platform-auth.ts
+// src/cli/platform-auth.ts
 /** Use the selected credential for read-only checks before taking lifecycle locks. */
 async function verifyPlatformCloudflareCredential(client, input) {
 	const source = input.source === "saved" ? "saved management token" : input.source === "environment" ? "environment API token" : "Cloudflare browser login";
@@ -1797,12 +1804,6 @@ function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access)
 function platformOperatorNeedsManagementToken(credential, plan, access) {
 	return credential.source === "oauth" && (!!access || planCreatesZone(plan) || planWritesDns(plan));
 }
-function planCreatesZone(plan) {
-	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-}
-function planWritesDns(plan) {
-	return plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
-}
 async function resolvePlatformCloudflareCredential(dependencies = {}) {
 	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
 	return credential;
@@ -1875,8 +1876,7 @@ async function readWranglerOAuthCredential(runWrangler) {
 		token: parsed.token.trim()
 	};
 }
-//#endregion
-//#region src/cli/platform-app-access.ts
+// src/cli/platform-app-access.ts
 async function selectInstallationAppAccess(authentication, recorded, choice) {
 	const config = authentication.file?.appAccess;
 	if (config && (typeof config !== "object" || Array.isArray(config) || "apiToken" in config || config.tokenEnv !== void 0 && (typeof config.tokenEnv !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(config.tokenEnv)))) throw new Error("platform: App access configuration must use tokenEnv; plaintext tokens are not accepted.");
@@ -2131,8 +2131,7 @@ async function turnOffInstalledProjectZeroTrust(input, fetcher = fetch) {
 	if (!result.turnedOff) throw new Error("platform: Project Zero Trust is still turning off. Rerun the uninstall.");
 	if (result.usersExist) throw new Error("platform: A platform user signed in while project Zero Trust was turning off, so the uninstall stopped. Project Zero Trust is now off and the platform still runs. To keep the platform, an administrator can turn project Zero Trust back on in Admin → Zero Trust or with `void platform zero-trust configure`. To remove it, run the uninstall again.");
 }
-//#endregion
-//#region src/cli/platform-auth-bootstrap.ts
+// src/cli/platform-auth-bootstrap.ts
 /** Checkpoint a replacement before submission so an interrupted response is safely replayable. */
 async function resumeInstalledPlatformAuthentication(input, initialize = initializeInstalledPlatformAuthentication) {
 	const result = await initialize(input.apiUrl, input.installationId, input.setupToken, input.setupJson);
@@ -2174,8 +2173,7 @@ async function initializeInstalledPlatformAuthentication(apiUrl, installationId,
 		expiresAt: typeof result.expiresAt === "string" ? result.expiresAt : null
 	};
 }
-//#endregion
-//#region src/cli/platform-auth-database.ts
+// src/cli/platform-auth-database.ts
 /** Restore the selected external origin before an adoption receipt exists. */
 function readPlatformHyperdriveSelection(checkpoint) {
 	if (!checkpoint?.externalHyperdriveJson) return;
@@ -2233,8 +2231,7 @@ async function verifyPlatformAuthenticationDatabase(client, accountId, resource,
 	await client.disableHyperdriveCaching(accountId, resource.id);
 	if ((await read()).cachingDisabled !== true) throw new Error("platform: Could not verify uncached Hyperdrive reads. Authentication setup remains closed.");
 }
-//#endregion
-//#region src/cli/platform-installer-process.ts
+// src/cli/platform-installer-process.ts
 function platformWorkerCommandRunner(accountId, cwd, runner) {
 	return (operation, options) => runner(operation, accountId, cwd, options.capture);
 }
@@ -2390,8 +2387,7 @@ async function withConditionalPlatformWorkerCreate(accountId, workerName, operat
 async function runPlatformWranglerForConditionalCreate(operation, accountId, cwd, capture, workerName, upstreamApiBaseUrl, apiToken) {
 	return withConditionalPlatformWorkerCreate(accountId, workerName, (apiBaseUrl) => runPlatformWranglerAtApiBase(operation, accountId, cwd, capture, apiBaseUrl, false, apiToken), upstreamApiBaseUrl);
 }
-//#endregion
-//#region src/cli/platform-plan.ts
+// src/cli/platform-plan.ts
 async function createPlatformInstallPlan(client, input, existing, options) {
 	const dashboardUrl = input.dashboardUrl !== void 0 ? normalizePlatformDashboardUrl(input.dashboardUrl) : existing ? existing.deployment.controlPlane.dashboardUrl ?? (existing.endpoints.dashboardUrl ? normalizePlatformDashboardUrl(existing.endpoints.dashboardUrl) : null) ?? platformDashboardUrl(existing.deployment) : null;
 	const account = resolveAccount(await client.listAccounts(), input.accountId);
@@ -2433,6 +2429,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	if (capabilities.customDomains && (testing || !input.dedicatedZone)) throw new Error("platform: Custom domains need a dedicated application zone. Install with a domain and --dedicated-zone.");
 	if (capabilities.email && options?.includeEmailGateway !== false && !enableEmail) throw new Error("platform: Email-enabled installations require VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID before deploying this runtime.");
 	if (input.appAccess && input.appAccess !== "public" && input.controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${input.applicationDomain.toLowerCase()}`)) throw new Error("platform: The API hostname must be outside the app Access wildcard. Use the application domain apex or workers.dev for the API, then plan again.");
+	const runtimeLogs = input.runtimeLogs === void 0 ? existing?.deployment.runtimeLogs : input.runtimeLogs === "minimal" ? "minimal" : void 0;
 	const deployment = createPlatformDeploymentManifest({
 		authentication: input.authentication ?? existing?.deployment.authentication,
 		appAccess: input.appAccess ?? existing?.deployment.appAccess,
@@ -2454,7 +2451,8 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...emailSharedZoneId ? { emailSharedZoneId } : {},
 		...normalizedEmailSenderDomain ? { emailSenderDomain: normalizedEmailSenderDomain } : {},
 		installationSlug,
-		resources: existing?.deployment.resources ?? createPlatformResourceNames(installationSlug)
+		resources: existing?.deployment.resources ?? createPlatformResourceNames(installationSlug),
+		...runtimeLogs ? { runtimeLogs } : {}
 	});
 	const { emailSharedZoneId: configuredEmailZone, emailSenderDomain: configuredSenderDomain, ...deploymentWithoutEmailZone } = deployment;
 	const { emailSharedZoneId: recordedEmailZone, emailSenderDomain: recordedSenderDomain, ...existingWithoutEmailZone } = existing?.deployment ?? deployment;
@@ -2480,14 +2478,19 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			customDomains: true
 		}
 	} : existingWithDashboard;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithEmail = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
 		...existingWithCustomDomains,
 		capabilities: {
 			...existingWithCustomDomains.capabilities,
 			email: true
 		}
 	} : existingWithCustomDomains;
-	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
+	const comparable = (value) => {
+		if (!options?.allowRuntimeLogsChange) return JSON.stringify(value);
+		const { runtimeLogs: _runtimeLogs, schemaVersion: _schemaVersion, ...rest } = value;
+		return JSON.stringify(rest);
+	};
+	if (existing && (comparable(existingWithEmail) !== comparable(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
 	const zone = testing ? null : await client.findZone(account.id, deployment.application.zoneName);
@@ -3067,7 +3070,10 @@ async function readRemoteOwnership(client, accountId, routingNamespaces, existin
 	}
 	return null;
 }
-function formatPlatformInstallPlan(plan) {
+/** `previous` is the installed deployment, so a changed setting shows what it was. */
+function formatPlatformInstallPlan(plan, previous) {
+	const runtimeLogs = plan.deployment.runtimeLogs ?? "full";
+	const previousRuntimeLogs = previous ? previous.runtimeLogs ?? "full" : runtimeLogs;
 	const lines = [
 		`${import_picocolors.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
 		`${import_picocolors.default.bold("Account:")} ${plan.account.id}`,
@@ -3082,6 +3088,7 @@ function formatPlatformInstallPlan(plan) {
 			platform: "Same as platform Access policy",
 			custom: "Selected Access policy"
 		}[plan.deployment.appAccess]}`] : [],
+		...runtimeLogs !== previousRuntimeLogs ? [`${import_picocolors.default.bold("Runtime logs:")} ${runtimeLogs} (was ${previousRuntimeLogs})`] : plan.deployment.runtimeLogs ? [`${import_picocolors.default.bold("Runtime logs:")} ${plan.deployment.runtimeLogs}`] : [],
 		`${import_picocolors.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
 		`${import_picocolors.default.bold("Database:")} ${plan.externalHyperdrive?.database || "PostgreSQL"} via Hyperdrive ${plan.deployment.resources.hyperdrive}`,
 		""
@@ -3089,8 +3096,7 @@ function formatPlatformInstallPlan(plan) {
 	for (const action of plan.actions) lines.push(`${action.action.padEnd(6)} ${action.kind.padEnd(19)} ${action.name}`);
 	return lines.join("\n");
 }
-//#endregion
-//#region src/cli/platform-traffic.ts
+// src/cli/platform-traffic.ts
 function platformManagedWorkerTraffic(deployment, workers) {
 	const includes = (worker) => workers === void 0 || workers.has(worker);
 	const names = deployment.resources;
@@ -3166,8 +3172,7 @@ function recordPlatformWorkerTraffic(manifest, workerName, inventory, updatedAt)
 	}
 	return next;
 }
-//#endregion
-//#region src/cli/platform-installer-resources.ts
+// src/cli/platform-installer-resources.ts
 async function reconcilePlatformInstallationResources(manifest, plan, secrets, zoneId, externalHyperdriveOriginHash, dependencies, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	for (const action of plan.actions.filter((entry) => entry.key !== "routing-kv" && entry.kind !== "zone" && entry.kind !== "worker")) {
 		const retainedManifest = retainReplacedInstallationResource(manifest, action, now());
@@ -3413,8 +3418,7 @@ function requireId(ids, key) {
 	if (!id) throw new Error(`platform: Installation manifest is missing ${key}.`);
 	return id;
 }
-//#endregion
-//#region src/cli/platform-installer-types.ts
+// src/cli/platform-installer-types.ts
 const PLATFORM_WORKER_SECRET_UPDATE_NAMES = [
 	"CF_API_TOKEN",
 	"EMAIL_SIGNING_SECRET",
@@ -3446,8 +3450,7 @@ var PlatformWorkerRecoveryIncompleteError = class extends Error {
 		this.name = "PlatformWorkerRecoveryIncompleteError";
 	}
 };
-//#endregion
-//#region src/cli/platform-installer-secrets.ts
+// src/cli/platform-installer-secrets.ts
 function createPlatformInstallationSecrets(input) {
 	const checkpoint = input.checkpoint ?? {};
 	const required = (value, name) => {
@@ -3746,8 +3749,7 @@ function assertRequiredPlatformSecrets(plan, manifest, secrets, authenticationWi
 function createPlatformHealthProbeToken(ownershipNonce) {
 	return createHash("sha256").update("void-platform-health-probe:v1\0").update(ownershipNonce).digest("base64url");
 }
-//#endregion
-//#region src/cli/platform-installer-errors.ts
+// src/cli/platform-installer-errors.ts
 const ANALYTICS_ENGINE_NOT_ENABLED = 10089;
 const UPLOAD_CONFLICT = "Aborting the upload operation because of conflicts";
 /** Why the Cloudflare CLI stopped an upload, and what to do. Null for other failures. */
@@ -3788,8 +3790,7 @@ function assertPlatformTriggerStabilization(result, workerName, targetVersionId,
 	if (!result.ok) throw new Error(`platform: Failed to ${operation} triggers for ${workerName} (${result.reason}).`);
 	if (!result.targetOwnsTraffic) throw new Error(`platform: Worker ${workerName} was superseded by ${result.activeVersionId} while publishing ${targetVersionId}; its active trigger state was repaired.`);
 }
-//#endregion
-//#region src/cli/platform-installer-inspection.ts
+// src/cli/platform-installer-inspection.ts
 var PlatformWorkerOwnershipError = class extends Error {};
 async function readActivePlatformWorkerVersion(configPath, accountId, workerName, runner = runPlatformWrangler) {
 	const result = await runner({
@@ -3952,8 +3953,7 @@ async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerNa
 		versionId
 	};
 }
-//#endregion
-//#region src/cli/platform-installer-cutover.ts
+// src/cli/platform-installer-cutover.ts
 function withoutCompletedPlatformWorkerMigrations(config, activeMigrationTag) {
 	const target = (Array.isArray(config.migrations) ? config.migrations : []).at(-1);
 	if (activeMigrationTag === null || !target || typeof target !== "object" || Array.isArray(target) || target.tag !== activeMigrationTag) return config;
@@ -4145,8 +4145,7 @@ function resolvePlatformPreviousTriggerConfig(versionSnapshot, configuredSnapsho
 		workers_dev: configuredSnapshot.workers_dev
 	};
 }
-//#endregion
-//#region src/cli/platform-trigger-proof.ts
+// src/cli/platform-trigger-proof.ts
 function record(value) {
 	return isRecord(value) ? value : null;
 }
@@ -4235,8 +4234,7 @@ async function platformWorkerLiveTriggersMatch(options) {
 		return false;
 	}
 }
-//#endregion
-//#region src/cli/platform-installer-workers.ts
+// src/cli/platform-installer-workers.ts
 function platformWorkerResourceKey(key) {
 	return key === "emailGateway" ? "email-gateway-worker" : `${key}-worker`;
 }
@@ -4862,8 +4860,7 @@ async function restorePlatformWorkerDeployment(input) {
 	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
-//#endregion
-//#region src/cli/platform-install-workers.ts
+// src/cli/platform-install-workers.ts
 function platformWorkerAction(workerActions, key) {
 	return workerActions.find((entry) => entry.key === platformWorkerResourceKey(key));
 }
@@ -5040,8 +5037,7 @@ async function uploadInstallationWorkers(input) {
 		if (firstFailure) throw firstFailure.reason;
 	} else for (const key of workerKeys) await deployOneWorker(key);
 }
-//#endregion
-//#region src/cli/platform-installer-health.ts
+// src/cli/platform-installer-health.ts
 var PlatformAccessBlockedError = class extends Error {
 	constructor(url, context) {
 		super(context?.accessProtected ? [
@@ -5259,8 +5255,7 @@ async function bootstrapPlatformSharedEmail(apiUrl, healthProbeToken, fetcher =
 	}
 	return operationId;
 }
-//#endregion
-//#region src/cli/platform-install-activation.ts
+// src/cli/platform-install-activation.ts
 async function enableInstallationServices(input) {
 	const { state, checkpointOperation, requiresStagedCommit, authenticationCutoverCommitted, now, writeRemoteInstallationCheckpoint, dependencies, workerKeys, workerActions, workerDeploymentSecrets, zoneId, enabledConfigs, configs, cloudflareApiBaseUrl, managedRoutes, ids, runPinnedPlatformWrangler, shouldBootstrapSharedEmail, releaseDatabaseLock, version, targetUsageProtocolVersion, healthCheckContext, runtime, runtimeProvenance } = input;
 	const { plan, secrets } = state;
@@ -5363,8 +5358,7 @@ async function enableInstallationServices(input) {
 	state.manifest = transitionInstallation(state.manifest, "installed", now());
 	return { emailOperationId };
 }
-//#endregion
-//#region src/cli/platform-access-health.ts
+// src/cli/platform-access-health.ts
 /** These reserved endpoints require Void's probe token and cannot serve application traffic. */
 function platformAccessHealthTargets(plan) {
 	const destination = `${plan.deployment.application.zoneName ? `${PLATFORM_HEALTH_HOSTNAME_LABEL}.${plan.deployment.application.baseDomain}` : `${plan.deployment.resources.dispatchWorker}.${plan.workersSubdomain}.workers.dev`}/health`;
@@ -5469,8 +5463,7 @@ async function ensurePlatformAccessHealthChecks(input) {
 		save();
 	}
 }
-//#endregion
-//#region src/cli/platform-access-preflight.ts
+// src/cli/platform-access-preflight.ts
 /** Recheck live protection without invoking any provisioning or configuration write. */
 async function verifyInstalledPlatformAccessProtection(input) {
 	const protection = parsePlatformAccessProtection(input.protection);
@@ -5516,7 +5509,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-BogLhtHi.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-KF5Vo-1I.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -5524,8 +5517,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 		}, input.manifest, origins, false, { workerNames: existingWorkers });
 	}
 }
-//#endregion
-//#region src/cli/platform-install-preparation.ts
+// src/cli/platform-install-preparation.ts
 function withAuthentication(deployment, authentication) {
 	return createPlatformDeploymentManifest({
 		...deployment,
@@ -5723,8 +5715,7 @@ async function prepareInstallationAuthentication(input) {
 		}
 	}
 }
-//#endregion
-//#region src/cli/platform-installer-runtime.ts
+// src/cli/platform-installer-runtime.ts
 function loadPlatformRuntime(customRuntimeDirectory) {
 	const runtime = resolvePlatformRuntime(customRuntimeDirectory || void 0);
 	verifyRuntimeArtifacts(runtime.directory, runtime.manifest);
@@ -5763,8 +5754,7 @@ function verifyPlatformDatabaseArtifacts(runtimeDirectory, database) {
 		if (hash(contents) !== migration.sha256) throw new Error(`platform: Runtime database migration failed integrity verification: ${path}.`);
 	}
 }
-//#endregion
-//#region src/cli/platform-zero-trust-uninstall.ts
+// src/cli/platform-zero-trust-uninstall.ts
 /**
 * Uninstall turns off the platform API, and only that API can remove the
 * Cloudflare Access applications project Zero Trust created. The shared
@@ -5962,8 +5952,7 @@ async function assertProjectZeroTrustAllowsUninstall(read, options = {}) {
 		DASHBOARD_HINT
 	].join("\n"));
 }
-//#endregion
-//#region src/cli/platform-installer-database.ts
+// src/cli/platform-installer-database.ts
 async function preparePlatformDatabaseSchema(manifest, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers, plan, dependencies, releaseDatabaseLock, now, writeRemoteInstallationCheckpoint, onManifestChange) {
 	dependencies.onProgress?.("Checking the platform database schema");
 	const rollbackDatabase = dependencies.databaseRollbackSource;
@@ -6475,8 +6464,7 @@ async function claimPlatformDatabaseConnection(client, installationId, ownership
 		throw error;
 	}
 }
-//#endregion
-//#region src/cli/platform-install-provisioning.ts
+// src/cli/platform-install-provisioning.ts
 async function provisionInstallationServices(input) {
 	const { state, now, releaseDatabaseLock, dependencies, writeRemoteInstallationCheckpoint, checkpointOperation, externalHyperdriveOriginHash, runtime, runtimeDirectory, sourcePlatformVersion, hadPriorWorkers } = input;
 	const { plan, secrets } = state;
@@ -6581,8 +6569,7 @@ async function provisionInstallationServices(input) {
 		entrypoints
 	};
 }
-//#endregion
-//#region src/cli/platform-secret-update-authority.ts
+// src/cli/platform-secret-update-authority.ts
 /**
 * Prevents a host without the encrypted values for an interrupted credential
 * update from carrying an opaque, possibly partial update into another cutover.
@@ -6622,8 +6609,7 @@ function readLatestWorkerGeneration(manifest) {
 function hasCompleteWorkerSecretReplacement(updates, requiresEmailSigningSecret) {
 	return PLATFORM_WORKER_SECRET_UPDATE_NAMES.every((name) => name === "EMAIL_SIGNING_SECRET" && !requiresEmailSigningSecret || typeof updates[name] === "string" && updates[name] !== "");
 }
-//#endregion
-//#region src/cli/platform-installer.ts
+// src/cli/platform-installer.ts
 async function recoverFailedPlatformInstallation(error, state) {
 	const { plan, dependencies, workerTrafficGuarded, workerDeploymentCommitted, workerRollbacks, authenticationEnforcementActive, authenticationProtocolTransition, workerCutoverGeneration, previousPublicEndpoints, operationStarted, now, writeRemoteInstallationCheckpoint } = state;
 	let { manifest } = state;
@@ -6675,6 +6661,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
 	if (plan.deployment.appAccess && runtime.appAccessSetup !== 1) throw new Error("platform: This runtime does not support the installation’s app access setup.");
+	assertPlatformRuntimeLogsSupported(plan.deployment, runtime);
 	const hasEmailGatewayArtifact = runtime.artifacts.emailGateway !== void 0;
 	if (existing?.steps.some((step) => step.key === "private-previews-initialized:v1") && runtime.privatePreviews !== 1) throw new Error("platform: This installation has private previews. Use a runtime with private preview support.");
 	if (runtime.emailProtocolVersion !== 1 && plan.deployment.capabilities.email) throw new Error("platform: This runtime cannot serve enabled platform email without email protocol version 1.");
@@ -7218,8 +7205,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		await releaseDatabaseLock();
 	}
 }
-//#endregion
-//#region src/cli/platform-install-auth.ts
+// src/cli/platform-install-auth.ts
 function defaultConnectionId(kind) {
 	return kind === "oidc" ? "company" : kind === "cloudflare-access" ? "access" : kind;
 }
@@ -7548,8 +7534,7 @@ async function replacePendingInstallationAuthentication(input) {
 		authBootstrapCode
 	};
 }
-//#endregion
-//#region src/cli/platform-installer-outside-changes.ts
+// src/cli/platform-installer-outside-changes.ts
 const OUTSIDE_SOURCES = {
 	dash: "changed in the Cloudflare dashboard",
 	api: "changed in the Cloudflare API",
@@ -7713,8 +7698,7 @@ async function uploadPlatformWorkerOutsideChanges(configs, input) {
 		input.progress?.resume();
 	}
 }
-//#endregion
-//#region src/cli/platform-saved-plans.ts
+// src/cli/platform-saved-plans.ts
 function planId(args) {
 	return createHash("sha256").update(JSON.stringify([args.account, args.name])).digest("hex");
 }
@@ -7769,8 +7753,7 @@ function listSavedPlatformInstallPlans(directory = platformRegistryDirectory())
 function removeSavedPlatformInstallPlan(args, directory = platformRegistryDirectory()) {
 	rmSync(join(directory, `plan-${planId(args)}.json`), { force: true });
 }
-//#endregion
-//#region src/cli/platform-setup-draft.ts
+// src/cli/platform-setup-draft.ts
 const STARTED = "credential-setup:v1";
 const COMPLETED = "credential-setup-complete:v1";
 /** Includes interrupted provisioning, but not maintenance of an already deployed platform. */
@@ -7818,8 +7801,7 @@ function completePlatformSetupDraft(manifest) {
 	writeInstallationManifest(completed);
 	return completed;
 }
-//#endregion
-//#region src/cli/platform-lifecycle.ts
+// src/cli/platform-lifecycle.ts
 function isPlatformInstallDatabaseBound(checkpoint, manifest) {
 	return Boolean(checkpoint?.databaseClaimState === "claimed" || manifest?.resources.some((resource) => resource.state === "ready" && (resource.kind === "hyperdrive" || resource.kind === "worker")) || manifest?.steps.some((step) => step.key.startsWith("database-schema:") || step.key.startsWith("database-migrations:")));
 }
@@ -7838,14 +7820,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-CRvelPGE.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-rWJshybd.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-noaALXnE.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-DZuZGJtt.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7856,7 +7838,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-lXdgGgAM.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-BfLW0Zlo.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7884,7 +7866,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		if (!args.resume && process.stdin.isTTY) {
 			const installs = resumableInstalls().filter((manifest) => !args.name || manifest.deployment.installationSlug === normalizeInstallationSlug(args.name));
 			const manifests = listInstallationManifests();
-			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 && !args.customDomains ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
+			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 && !args.customDomains && args.runtimeLogs === void 0 ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
 			if (installs.length > 0 || savedPlans.length > 0) {
 				const choice = await select({
 					message: "Continue a previous platform install?",
@@ -8032,7 +8014,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-lXdgGgAM.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-BfLW0Zlo.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8145,6 +8127,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			...process.env.VOID_EMAIL_SHARED_ZONE_ID ? { emailSharedZoneId: process.env.VOID_EMAIL_SHARED_ZONE_ID } : {},
 			...process.env.VOID_EMAIL_SENDER_DOMAIN ? { emailSenderDomain: process.env.VOID_EMAIL_SENDER_DOMAIN } : {},
 			installationSlug,
+			...args.runtimeLogs !== void 0 ? { runtimeLogs: args.runtimeLogs } : {},
 			zoneName,
 			...workersDev ? { workersDev: true } : {}
 		};
@@ -8156,6 +8139,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			deploymentExecution: runtime.manifest.deploymentExecution === 1
 		};
 		let plan = await createPlatformInstallPlan(client, planInput, existing, planOptions);
+		assertPlatformRuntimeLogsSupported(plan.deployment, runtime.manifest);
 		const commandOptions = {
 			commandName: cliCommandName(),
 			accountId,
@@ -8173,6 +8157,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			authentication: authenticationSelection.authentication,
 			hyperdrive: !existing || isPlatformSetupDraft(existing) || externalHyperdrive && !recordedHyperdrive ? externalHyperdrive?.id ?? "create" : void 0,
 			runtime: args.runtime,
+			...!existing && plan.deployment.runtimeLogs ? { runtimeLogs: "minimal" } : {},
 			...existing ? { resumeId: existing.id } : {},
 			yes: args.yes || process.stdin.isTTY !== true
 		};
@@ -8267,7 +8252,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			Object.assign(values, updates);
 			if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
 		};
-		const configured = (key, environment) => credentialSetup ? process.env[environment] || values[key] || "" : values[key] || process.env[environment] || "";
+		const configured = (key, environment) => credentialSetup || key === "cloudflareApiToken" ? process.env[environment] || values[key] || "" : values[key] || process.env[environment] || "";
 		const collect = async (key, environment, message, masked = true, persist = true, validate) => {
 			let value = configured(key, environment);
 			if (!value) {
@@ -8282,7 +8267,8 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		};
 		const pages = platformSetupPages(plan);
 		if (!configured("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN")) openPlatformSetupPage(pages.runtime);
-		const usingSavedRuntimeToken = credentialSetup && !process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN && Boolean(values.cloudflareApiToken);
+		const savedRuntimeToken = checkpoint?.cloudflareApiToken ?? "";
+		const usingSavedRuntimeToken = !process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN && Boolean(values.cloudflareApiToken);
 		let runtimeCloudflareApiToken = await collect("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN", "Paste runtime API token:", true, false);
 		let rejectedSavedRuntimeToken = false;
 		const verifyRuntimeToken = async (token) => {
@@ -8301,9 +8287,9 @@ async function runPlatformLifecycleCommand(commandArgs) {
 					plan = await verifyPlatformAiGatewayPlan(client, planInput, existing, plan, authoritativeProvisionIntents);
 				}
 			} catch (error) {
-				if (credentialSetup && token === values.cloudflareApiToken && !(error instanceof PlatformRuntimeTokenEmailPermissionError) && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
+				if (token === values.cloudflareApiToken && !(error instanceof PlatformRuntimeTokenEmailPermissionError) && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
 					delete values.cloudflareApiToken;
-					writePendingInstallationSecrets(setupManifest, values);
+					if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
 					rejectedSavedRuntimeToken = true;
 				}
 				throw error;
@@ -8367,22 +8353,26 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		const hasFullProjectSecretKeyring = Boolean(checkpoint?.projectSecretKeysJson || checkpoint?.projectSecretActiveKeyVersion || process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION);
 		const generateIdentityKeys = credentialSetup && !!process.stdin.isTTY;
 		const generatedKeys = generateIdentityKeys ? [configured("jwtSecret", "VOID_PLATFORM_JWT_SECRET") ? "" : "JWT signing key", configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || hasFullProjectSecretKeyring ? "" : "project encryption key"].filter(Boolean) : [];
+		const replacingRuntimeToken = !credentialSetup && !!savedRuntimeToken && runtimeCloudflareApiToken !== savedRuntimeToken;
+		const updateExistingWorkers = replacingRuntimeToken || !credentialSetup && Boolean(checkpoint?.workerSecretUpdatesJson);
+		const checkpointValue = (value) => updateExistingWorkers ? "" : value;
 		const secrets = createPlatformInstallationSecrets({
 			configurableAuthentication: !!authenticationSelection.authentication.configurable,
 			...authenticationSecrets,
 			bootstrapGitHubId,
 			bootstrapGitHubLogin,
-			cloudflareApiToken: runtimeCloudflareApiToken,
+			cloudflareApiToken: replacingRuntimeToken ? runtimeCloudflareApiToken : checkpointValue(runtimeCloudflareApiToken),
 			checkpoint: values,
 			databaseUrl: installationDatabaseUrl,
 			emailEnabled: plan.deployment.capabilities.email,
-			emailSigningSecret: process.env.VOID_PLATFORM_EMAIL_SIGNING_SECRET || "",
+			emailSigningSecret: updateExistingWorkers && values.emailSigningSecret ? "" : process.env.VOID_PLATFORM_EMAIL_SIGNING_SECRET || "",
 			existingEmailEnabled: existing.deployment.capabilities.email,
-			githubClientId,
-			githubClientSecret,
-			r2AccessKeyId,
-			r2SecretAccessKey,
+			githubClientId: checkpointValue(githubClientId),
+			githubClientSecret: checkpointValue(githubClientSecret),
+			r2AccessKeyId: checkpointValue(r2AccessKeyId),
+			r2SecretAccessKey: checkpointValue(r2SecretAccessKey),
 			existingInstallation: !credentialSetup,
+			updateExistingWorkers,
 			generateIdentityKeys,
 			jwtSecret: generateIdentityKeys ? configured("jwtSecret", "VOID_PLATFORM_JWT_SECRET") : await collect("jwtSecret", "VOID_PLATFORM_JWT_SECRET", "JWT signing key:", true, true, credentialSetup ? (value) => Buffer.byteLength(value, "utf8") >= 32 ? void 0 : "The JWT signing secret must contain at least 32 random bytes." : void 0),
 			projectSecretKey: configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || (hasFullProjectSecretKeyring || generateIdentityKeys ? "" : await collect("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY", "Project encryption key:", true, true, credentialSetup ? (value) => {
@@ -8472,7 +8462,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-lXdgGgAM.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-BfLW0Zlo.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8484,7 +8474,18 @@ async function runPlatformLifecycleCommand(commandArgs) {
 				});
 			}
 		});
+		const runtimeLogsWarning = !result.waitingForDns && !result.waitingForSandboxDrain && shouldUpdateProjectWorkerRuntimeLogs({
+			previous: setupManifest.deployment,
+			next: result.manifest.deployment,
+			explicit: args.runtimeLogs !== void 0
+		}) ? await updateProjectWorkerRuntimeLogs(client, {
+			accountId,
+			namespace: result.manifest.deployment.resources.dispatchNamespace,
+			minimal: !!result.manifest.deployment.runtimeLogs,
+			installationId: result.manifest.id
+		}) : void 0;
 		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused. Progress is saved." : "Platform installed.");
+		if (runtimeLogsWarning) log.warn(runtimeLogsWarning);
 		progress = void 0;
 		if (result.waitingForDns) {
 			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, import_picocolors.default.bold("Waiting for nameservers"));
@@ -8628,5 +8629,4 @@ async function promptSecret(message, masked = true, validate, placeholder) {
 	if (isCancel(value) || typeof value === "symbol") throw new Error("platform: Cancelled.");
 	return value;
 }
-//#endregion
 export { hyperdriveOriginMatches as $, dnsRecordConfigHash as A, turnOffInstalledProjectZeroTrust as B, createPlatformHealthProbeToken as C, platformTrafficAttachmentWorker as D, recordResource as E, platformAdoptionIntentHash as F, checkpointPlatformAccessResources as G, resolvePlatformCloudflareCredential as H, r2BucketConfigHash as I, PlatformCloudflareApiError as J, parsePlatformAccessSetupSpec as K, resourceMarkerProblem as L, hasProvisionIntentStep as M, legacyResourceConfigHash as N, recordPlatformWorkerTraffic as O, matchesRecordedR2Fingerprint as P, hyperdriveOriginFromConnectionString as Q, revalidatePlatformInstallAction as R, loadPlatformRuntime as S, resolveBootstrapGitHubId as T, verifyPlatformCloudflareCredential as U, assertPlatformOperatorCredentialCanApplyPlan as V, activatePlatformAccessCredentials as W, PlatformRuntimeTokenEmailPermissionError as X, PlatformCloudflareClient as Y, hyperdriveOriginConfigHash as Z, readPlatformProjectSlugs as _, findPlatformWorkerOutsideChanges as a, formatZeroTrustApplications as b, uploadPlatformWorkerOutsideChanges as c, replacePendingInstallationAuthentication as d, verifyPlatformRuntimeTokenEmailPermissions as et, REMOTE_INSTALLATION_MANIFEST_KEY as f, platformDatabaseClientUrl as g, acquirePlatformDatabaseLifecycleLockConnection as h, verifyPlatformAiGatewayPlan as i, formatPlatformInstallPlan as j, createPlatformInstallPlan as k, authenticationSetupRequestHash as l, acquirePlatformDatabaseLifecycleLock as m, resolvePlatformInstallDatabaseUrl as n, formatPlatformWorkerOutsideChanges as o, installPlatform as p, preparePlatformAccessSetup as q, runPlatformLifecycleCommand as r, reviewPlatformWorkerOutsideChanges as s, assertNoninteractivePlatformMutationAcknowledged as t, verifyPlatformRuntimeTokenPermissions as tt, readLoginReplacementFile as u, readPlatformProjectZeroTrustState as v, createPlatformInstallationSecrets as w, readPlatformDatabase as x, assertProjectZeroTrustAllowsUninstall as y, platformDatabaseNameFromOwnerUrl as z };