void 1.5.0 → 1.6.0

package/dist/{platform-args-Bv9hoLEL.mjs → platform-args-Cx1M-7bq.mjs}

@@ -228,6 +228,10 @@ const platformSubcommands = [
 		description: "Safely remove an installed Void platform"
 	}
 ];
+function parseRuntimeLogs(value) {
+	if (value !== "full" && value !== "minimal") throw new Error("platform: --runtime-logs must be full or minimal.");
+	return value;
+}
 function readValue(rest, index, flag) {
 	const value = rest[index + 1];
 	if (!value || value.startsWith("-")) throw new Error(`platform: ${flag} requires a value.`);
@@ -251,6 +255,7 @@ function parseSelector(rest, subcommand, options = {}) {
 }
 function parseLifecycleSelector(rest, subcommand) {
 	const positional = [];
+	let runtimeLogs;
 	let runtime = "";
 	let fromRuntime = "";
 	let authConfig;
@@ -268,7 +273,11 @@ function parseLifecycleSelector(rest, subcommand) {
 			dashboardUrl = normalizePlatformDashboardUrl(value);
 			index = next;
 		} else if (arg === "--custom-domains" && (subcommand === "upgrade" || subcommand === "repair")) customDomains = true;
-		else if (arg === "--auth-config" && subcommand === "repair") {
+		else if (arg === "--runtime-logs" && subcommand === "upgrade") {
+			const [value, next] = readValue(rest, index, arg);
+			runtimeLogs = parseRuntimeLogs(value);
+			index = next;
+		} else if (arg === "--auth-config" && subcommand === "repair") {
 			const [value, next] = readValue(rest, index, arg);
 			authConfig = value;
 			index = next;
@@ -286,7 +295,8 @@ function parseLifecycleSelector(rest, subcommand) {
 		fromRuntime,
 		...authConfig !== void 0 ? { authConfig } : {},
 		...dashboardUrl !== void 0 ? { dashboardUrl } : {},
-		...customDomains ? { customDomains: true } : {}
+		...customDomains ? { customDomains: true } : {},
+		...runtimeLogs !== void 0 ? { runtimeLogs } : {}
 	};
 }
 function parsePlatformArgs(args) {
@@ -379,7 +389,7 @@ function parsePlatformArgs(args) {
 		};
 	}
 	if (subcommand === "upgrade" || subcommand === "rollback" || subcommand === "repair" || subcommand === "disable" || subcommand === "enable") {
-		const { selector, plan, runtime, fromRuntime, yes, authConfig, dashboardUrl, customDomains } = parseLifecycleSelector(rest, subcommand);
+		const { selector, plan, runtime, fromRuntime, yes, authConfig, dashboardUrl, customDomains, runtimeLogs } = parseLifecycleSelector(rest, subcommand);
 		return subcommand === "rollback" ? {
 			subcommand,
 			selector,
@@ -395,7 +405,8 @@ function parsePlatformArgs(args) {
 			yes,
 			...authConfig !== void 0 ? { authConfig } : {},
 			...dashboardUrl !== void 0 ? { dashboardUrl } : {},
-			...customDomains ? { customDomains } : {}
+			...customDomains ? { customDomains } : {},
+			...runtimeLogs !== void 0 ? { runtimeLogs } : {}
 		};
 	}
 	if (subcommand === "uninstall") {
@@ -434,6 +445,7 @@ function parsePlatformArgs(args) {
 			"--display-name",
 			"--name",
 			"--runtime",
+			"--runtime-logs",
 			"--zone"
 		]);
 		let workersDev = false;
@@ -467,6 +479,7 @@ function parsePlatformArgs(args) {
 			"platform",
 			"custom"
 		].includes(appAccess)) throw new Error("platform: --app-access accepts public, platform, or custom.");
+		const runtimeLogs = values.has("--runtime-logs") ? parseRuntimeLogs(values.get("--runtime-logs")) : void 0;
 		const loginMethods = values.get("--login-methods")?.split(",");
 		if (loginMethods && loginMethods.some((method) => !PLATFORM_LOGIN_KINDS.includes(method))) throw new Error("platform: --login-methods accepts github, google, oidc, and cloudflare-access.");
 		if (workersDev && (values.has("--application-domain") || values.has("--zone") || dedicatedZone)) throw new Error("platform: --workers-dev cannot be combined with a domain, zone, or --dedicated-zone.");
@@ -481,6 +494,7 @@ function parsePlatformArgs(args) {
 			...accessProtection !== void 0 ? { accessProtection } : {},
 			...appAccess !== void 0 ? { appAccess } : {},
 			...workersDev ? { workersDev: true } : {},
+			...runtimeLogs !== void 0 ? { runtimeLogs } : {},
 			...values.has("--auth-config") ? { authConfig: values.get("--auth-config") } : {},
 			account: values.get("--account") ?? "",
 			applicationDomain: values.get("--application-domain") ?? "",

package/dist/{platform-auth-config-CLj0EvnB.mjs → platform-auth-config-K4m_LE8b.mjs}

@@ -3,8 +3,8 @@ import { A as confirm, K as select, U as password, X as text, z as multiselect }
 import { l as formatUrl, m as printSuccess } from "./output-BCdLioKP.mjs";
 import { n as OperatorClient } from "./operator-client-BIY4-N_6.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-CfDcmzpo.mjs";
-import { i as humanLines } from "./operator-cmd-CnAvSqJ5.mjs";
-import { o as platformPromptAnswer } from "./platform-setup-VEcHu0Vq.mjs";
+import { i as humanLines } from "./operator-cmd-BUqsdk2K.mjs";
+import { o as platformPromptAnswer } from "./platform-setup-Vw1AaUN8.mjs";
 import { parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration } from "@void/platform";
 import { stripVTControlCharacters } from "node:util";
 import { setTimeout } from "node:timers/promises";
@@ -142,11 +142,11 @@ async function configurationInput(args, existing) {
 }
 async function runPlatformAuthConfig(args) {
 	if (args.action === "recover") {
-		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-DD3oLerq.mjs");
+		const { runPlatformAuthRecovery } = await import("./platform-auth-recovery-BOdFrl7R.mjs");
 		return runPlatformAuthRecovery(args);
 	}
 	if (args.action === "protection") {
-		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-DQDSxVhr.mjs");
+		const { runPlatformProtectionConfig } = await import("./platform-auth-protection-KF5Vo-1I.mjs");
 		return runPlatformProtectionConfig(args);
 	}
 	const origin = resolveOperatorOrigin(args.connection);

package/dist/{platform-auth-protection-DQDSxVhr.mjs → platform-auth-protection-KF5Vo-1I.mjs}

@@ -5,8 +5,8 @@ import { A as confirm, tt as isCancel } from "./dist-D23AAMxT.mjs";
 import { m as printSuccess } from "./output-BCdLioKP.mjs";
 import { n as OperatorClient } from "./operator-client-BIY4-N_6.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-CfDcmzpo.mjs";
-import { G as checkpointPlatformAccessResources, H as resolvePlatformCloudflareCredential, K as parsePlatformAccessSetupSpec, Y as PlatformCloudflareClient, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, q as preparePlatformAccessSetup } from "./platform-lifecycle-BCsFg1Tl.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-nzCDwtiN.mjs";
+import { G as checkpointPlatformAccessResources, H as resolvePlatformCloudflareCredential, K as parsePlatformAccessSetupSpec, Y as PlatformCloudflareClient, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, q as preparePlatformAccessSetup } from "./platform-lifecycle-D9RdGub1.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BRefdHGD.mjs";
 import { parsePlatformAccessProtection, platformProtectionProofMessage } from "@void/platform";
 import { createHmac } from "node:crypto";
 import { readFile } from "node:fs/promises";

package/dist/{platform-auth-recovery-DD3oLerq.mjs → platform-auth-recovery-BOdFrl7R.mjs}

@@ -3,8 +3,8 @@ import { u as openBrowser } from "./auth-Dy8svcqQ.mjs";
 import { A as confirm, tt as isCancel } from "./dist-D23AAMxT.mjs";
 import { l as formatUrl, m as printSuccess } from "./output-BCdLioKP.mjs";
 import { a as resolveOperatorOrigin } from "./operator-auth-CfDcmzpo.mjs";
-import { H as resolvePlatformCloudflareCredential, Y as PlatformCloudflareClient, g as platformDatabaseClientUrl, h as acquirePlatformDatabaseLifecycleLockConnection, n as resolvePlatformInstallDatabaseUrl } from "./platform-lifecycle-BCsFg1Tl.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-nzCDwtiN.mjs";
+import { H as resolvePlatformCloudflareCredential, Y as PlatformCloudflareClient, g as platformDatabaseClientUrl, h as acquirePlatformDatabaseLifecycleLockConnection, n as resolvePlatformInstallDatabaseUrl } from "./platform-lifecycle-D9RdGub1.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-BRefdHGD.mjs";
 import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { setTimeout } from "node:timers/promises";

package/dist/{platform-cmd-WnOmdLzR.mjs → platform-cmd-DpCHawGF.mjs}

@@ -1 +1 @@
-export { t as discoverPlatform, r as runPlatformCommand } from "./platform-cmd-PLNLg-2N.mjs";
+export { t as discoverPlatform, r as runPlatformCommand } from "./platform-cmd-Ds3EAV5t.mjs";

package/dist/{platform-cmd-PLNLg-2N.mjs → platform-cmd-Ds3EAV5t.mjs}

@@ -96,19 +96,19 @@ async function runPlatformCommand(_root, args) {
 					}]
 				});
 				if (isCancel(group)) return;
-				const { parsePlatformArgs } = await import("./platform-args-C1kqYUen.mjs");
+				const { parsePlatformArgs } = await import("./platform-args-C7XUw9mw.mjs");
 				return runPlatformCommand(_root, parsePlatformArgs(["config", group]));
 			}
 			const { runPlatformPlansConfig } = await import("./platform-plans-config-Dx1agneU.mjs");
 			await runPlatformPlansConfig(args);
 			return;
 		}
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-CLj0EvnB.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-K4m_LE8b.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-BhHXIL2G.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-wBYyp8iQ.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -176,12 +176,13 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-BQiN9HN5.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-BH34I0rh.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 function showSavedInstallationStatus(manifest) {
 	console.log(`Saved installation: ${manifest.id} (${manifest.status})`);
 	console.log(`Checkpoint: ${manifest.updatedAt}`);
+	if (manifest.deployment.runtimeLogs) console.log(`Runtime logs: ${manifest.deployment.runtimeLogs}`);
 	if (manifest.operation) {
 		const operation = manifest.operation;
 		console.log(`Saved operation: ${operation.action} — ${operation.phase}`);

package/dist/{platform-domain-Bnq0vg0q.mjs → platform-domain-rWJshybd.mjs}

@@ -2,8 +2,8 @@ import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock
 import { t as cfAccessHeaders } from "./cf-access-pejlJmuy.mjs";
 import { A as confirm, X as text, tt as isCancel } from "./dist-D23AAMxT.mjs";
 import { m as printSuccess, p as note } from "./output-BCdLioKP.mjs";
-import { C as createPlatformHealthProbeToken, E as recordResource, H as resolvePlatformCloudflareCredential, O as recordPlatformWorkerTraffic, V as assertPlatformOperatorCredentialCanApplyPlan, Y as PlatformCloudflareClient, k as createPlatformInstallPlan, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-BCsFg1Tl.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-nzCDwtiN.mjs";
+import { C as createPlatformHealthProbeToken, E as recordResource, H as resolvePlatformCloudflareCredential, O as recordPlatformWorkerTraffic, V as assertPlatformOperatorCredentialCanApplyPlan, Y as PlatformCloudflareClient, k as createPlatformInstallPlan, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-D9RdGub1.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-BRefdHGD.mjs";
 import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 // src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {

package/dist/{platform-lifecycle-BQiN9HN5.mjs → platform-lifecycle-BH34I0rh.mjs}

@@ -1 +1 @@
-export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-BCsFg1Tl.mjs";
+export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-D9RdGub1.mjs";

package/dist/{platform-lifecycle-BCsFg1Tl.mjs → platform-lifecycle-D9RdGub1.mjs}

@@ -6,10 +6,11 @@ import { t as ensurePlatformAccessToken } from "./cf-access-BmBT2h8_.mjs";
 import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-D23AAMxT.mjs";
 import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BCdLioKP.mjs";
 import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-DjJ638A-.mjs";
-import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-CRiNnlfE.mjs";
-import { t as parsePlatformArgs } from "./platform-args-Bv9hoLEL.mjs";
+import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-BbCzpbXs.mjs";
+import { t as parsePlatformArgs } from "./platform-args-Cx1M-7bq.mjs";
 import { o as runCloudflareAuthCommand } from "./cloudflare-auth-CEu-1Ps_.mjs";
-import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-VEcHu0Vq.mjs";
+import { i as updateProjectWorkerRuntimeLogs, n as assertPlatformRuntimeLogsSupported, r as shouldUpdateProjectWorkerRuntimeLogs } from "./platform-runtime-logs-CdJGnk3f.mjs";
+import { a as platformManagementSetupPage, c as platformSetupLink, d as planWritesDns, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand, u as planCreatesZone } from "./platform-setup-Vw1AaUN8.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRecord } from "@void/deploy-core";
@@ -161,7 +162,7 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 			headers: {
 				Accept: "application/json",
 				Authorization: `Bearer ${this.#token}`,
-				...init?.body ? { "Content-Type": "application/json" } : {},
+				...typeof init?.body === "string" ? { "Content-Type": "application/json" } : {},
 				...init?.headers
 			},
 			signal: init?.signal ?? AbortSignal.timeout(3e4),
@@ -733,6 +734,15 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 	async listDispatchNamespaceScripts(accountId, namespace) {
 		return (await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts`)).map((entry) => requiredString(entry.id, "Dispatch namespace script name"));
 	}
+	/** Change settings of one namespace script. Omitted fields, such as bindings, are kept. */
+	async patchDispatchNamespaceScriptSettings(accountId, namespace, scriptName, settings) {
+		const body = new FormData();
+		body.set("settings", new Blob([JSON.stringify(settings)], { type: "application/json" }), "settings.json");
+		await this.request(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(scriptName)}/settings`, {
+			method: "PATCH",
+			body
+		});
+	}
 	async deleteDispatchNamespaceScript(accountId, namespace, scriptName) {
 		await this.#deleteIfPresent(`/accounts/${encodeURIComponent(accountId)}/workers/dispatch/namespaces/${encodeURIComponent(namespace)}/scripts/${encodeURIComponent(scriptName)}`);
 	}
@@ -1794,12 +1804,6 @@ function assertPlatformOperatorCredentialCanApplyPlan(credential, plan, access)
 function platformOperatorNeedsManagementToken(credential, plan, access) {
 	return credential.source === "oauth" && (!!access || planCreatesZone(plan) || planWritesDns(plan));
 }
-function planCreatesZone(plan) {
-	return plan.actions.some((action) => action.kind === "zone" && action.action === "create");
-}
-function planWritesDns(plan) {
-	return plan.actions.some((action) => action.kind === "dns-record" && action.action !== "reuse");
-}
 async function resolvePlatformCloudflareCredential(dependencies = {}) {
 	const { credential } = await resolvePlatformCloudflareCredentialWithInput(async () => void 0, dependencies);
 	return credential;
@@ -2425,6 +2429,7 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 	if (capabilities.customDomains && (testing || !input.dedicatedZone)) throw new Error("platform: Custom domains need a dedicated application zone. Install with a domain and --dedicated-zone.");
 	if (capabilities.email && options?.includeEmailGateway !== false && !enableEmail) throw new Error("platform: Email-enabled installations require VOID_EMAIL_SENDER_DOMAIN and VOID_EMAIL_SHARED_ZONE_ID before deploying this runtime.");
 	if (input.appAccess && input.appAccess !== "public" && input.controlPlaneDomain.toLowerCase().replace(/\.$/, "").endsWith(`.${input.applicationDomain.toLowerCase()}`)) throw new Error("platform: The API hostname must be outside the app Access wildcard. Use the application domain apex or workers.dev for the API, then plan again.");
+	const runtimeLogs = input.runtimeLogs === void 0 ? existing?.deployment.runtimeLogs : input.runtimeLogs === "minimal" ? "minimal" : void 0;
 	const deployment = createPlatformDeploymentManifest({
 		authentication: input.authentication ?? existing?.deployment.authentication,
 		appAccess: input.appAccess ?? existing?.deployment.appAccess,
@@ -2446,7 +2451,8 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		...emailSharedZoneId ? { emailSharedZoneId } : {},
 		...normalizedEmailSenderDomain ? { emailSenderDomain: normalizedEmailSenderDomain } : {},
 		installationSlug,
-		resources: existing?.deployment.resources ?? createPlatformResourceNames(installationSlug)
+		resources: existing?.deployment.resources ?? createPlatformResourceNames(installationSlug),
+		...runtimeLogs ? { runtimeLogs } : {}
 	});
 	const { emailSharedZoneId: configuredEmailZone, emailSenderDomain: configuredSenderDomain, ...deploymentWithoutEmailZone } = deployment;
 	const { emailSharedZoneId: recordedEmailZone, emailSenderDomain: recordedSenderDomain, ...existingWithoutEmailZone } = existing?.deployment ?? deployment;
@@ -2472,14 +2478,19 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 			customDomains: true
 		}
 	} : existingWithDashboard;
-	const comparableExistingWithoutEmailZone = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
+	const existingWithEmail = existing && deployment.capabilities.email && !existing.deployment.capabilities.email ? {
 		...existingWithCustomDomains,
 		capabilities: {
 			...existingWithCustomDomains.capabilities,
 			email: true
 		}
 	} : existingWithCustomDomains;
-	if (existing && (JSON.stringify(comparableExistingWithoutEmailZone) !== JSON.stringify(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
+	const comparable = (value) => {
+		if (!options?.allowRuntimeLogsChange) return JSON.stringify(value);
+		const { runtimeLogs: _runtimeLogs, schemaVersion: _schemaVersion, ...rest } = value;
+		return JSON.stringify(rest);
+	};
+	if (existing && (comparable(existingWithEmail) !== comparable(deploymentWithoutEmailZone) || recordedEmailZone !== void 0 && recordedEmailZone !== configuredEmailZone || recordedSenderDomain !== void 0 && recordedSenderDomain !== configuredSenderDomain)) throw new Error(`platform: --resume inputs do not match installation ${existing.id}. Use its recorded configuration.`);
 	const names = deployment.resources;
 	const wildcardHostname = `*.${deployment.application.baseDomain}`;
 	const zone = testing ? null : await client.findZone(account.id, deployment.application.zoneName);
@@ -3059,7 +3070,10 @@ async function readRemoteOwnership(client, accountId, routingNamespaces, existin
 	}
 	return null;
 }
-function formatPlatformInstallPlan(plan) {
+/** `previous` is the installed deployment, so a changed setting shows what it was. */
+function formatPlatformInstallPlan(plan, previous) {
+	const runtimeLogs = plan.deployment.runtimeLogs ?? "full";
+	const previousRuntimeLogs = previous ? previous.runtimeLogs ?? "full" : runtimeLogs;
 	const lines = [
 		`${import_picocolors.default.bold(`${plan.deployment.displayName} in ${plan.account.name}`)}`,
 		`${import_picocolors.default.bold("Account:")} ${plan.account.id}`,
@@ -3074,6 +3088,7 @@ function formatPlatformInstallPlan(plan) {
 			platform: "Same as platform Access policy",
 			custom: "Selected Access policy"
 		}[plan.deployment.appAccess]}`] : [],
+		...runtimeLogs !== previousRuntimeLogs ? [`${import_picocolors.default.bold("Runtime logs:")} ${runtimeLogs} (was ${previousRuntimeLogs})`] : plan.deployment.runtimeLogs ? [`${import_picocolors.default.bold("Runtime logs:")} ${plan.deployment.runtimeLogs}`] : [],
 		`${import_picocolors.default.bold("Login callback:")} ${plan.apiUrl}/auth/callback`,
 		`${import_picocolors.default.bold("Database:")} ${plan.externalHyperdrive?.database || "PostgreSQL"} via Hyperdrive ${plan.deployment.resources.hyperdrive}`,
 		""
@@ -5494,7 +5509,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-DQDSxVhr.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-KF5Vo-1I.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -6646,6 +6661,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const runtimeDirectory = resolvedRuntime.directory;
 	const runtime = resolvedRuntime.manifest;
 	if (plan.deployment.appAccess && runtime.appAccessSetup !== 1) throw new Error("platform: This runtime does not support the installation’s app access setup.");
+	assertPlatformRuntimeLogsSupported(plan.deployment, runtime);
 	const hasEmailGatewayArtifact = runtime.artifacts.emailGateway !== void 0;
 	if (existing?.steps.some((step) => step.key === "private-previews-initialized:v1") && runtime.privatePreviews !== 1) throw new Error("platform: This installation has private previews. Use a runtime with private preview support.");
 	if (runtime.emailProtocolVersion !== 1 && plan.deployment.capabilities.email) throw new Error("platform: This runtime cannot serve enabled platform email without email protocol version 1.");
@@ -7804,14 +7820,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-Bnq0vg0q.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-rWJshybd.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-DBNoME3I.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-DZuZGJtt.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7822,7 +7838,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-CMJR8Zi-.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-BfLW0Zlo.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7850,7 +7866,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		if (!args.resume && process.stdin.isTTY) {
 			const installs = resumableInstalls().filter((manifest) => !args.name || manifest.deployment.installationSlug === normalizeInstallationSlug(args.name));
 			const manifests = listInstallationManifests();
-			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 && !args.customDomains ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
+			const savedPlans = !args.applicationDomain && !args.workersDev && !args.zone && !args.displayName && !args.hyperdrive && !args.controlPlaneDomain && !args.noControlPlaneDomain && !args.authConfig && !args.loginMethods && !args.runtime && args.accessProtection === void 0 && args.appAccess === void 0 && !args.dedicatedZoneSpecified && args.dashboardUrl === void 0 && !args.customDomains && args.runtimeLogs === void 0 ? listSavedPlatformInstallPlans().filter((saved) => (!args.name || saved.args.name === normalizeInstallationSlug(args.name)) && (!args.account || saved.args.account === args.account || saved.accountName.toLowerCase() === args.account.toLowerCase()) && !manifests.some((manifest) => manifest.status !== "uninstalled" && manifest.account.id === saved.args.account && manifest.deployment.installationSlug === saved.args.name)) : [];
 			if (installs.length > 0 || savedPlans.length > 0) {
 				const choice = await select({
 					message: "Continue a previous platform install?",
@@ -7998,7 +8014,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-CMJR8Zi-.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-BfLW0Zlo.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8111,6 +8127,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			...process.env.VOID_EMAIL_SHARED_ZONE_ID ? { emailSharedZoneId: process.env.VOID_EMAIL_SHARED_ZONE_ID } : {},
 			...process.env.VOID_EMAIL_SENDER_DOMAIN ? { emailSenderDomain: process.env.VOID_EMAIL_SENDER_DOMAIN } : {},
 			installationSlug,
+			...args.runtimeLogs !== void 0 ? { runtimeLogs: args.runtimeLogs } : {},
 			zoneName,
 			...workersDev ? { workersDev: true } : {}
 		};
@@ -8122,6 +8139,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			deploymentExecution: runtime.manifest.deploymentExecution === 1
 		};
 		let plan = await createPlatformInstallPlan(client, planInput, existing, planOptions);
+		assertPlatformRuntimeLogsSupported(plan.deployment, runtime.manifest);
 		const commandOptions = {
 			commandName: cliCommandName(),
 			accountId,
@@ -8139,6 +8157,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			authentication: authenticationSelection.authentication,
 			hyperdrive: !existing || isPlatformSetupDraft(existing) || externalHyperdrive && !recordedHyperdrive ? externalHyperdrive?.id ?? "create" : void 0,
 			runtime: args.runtime,
+			...!existing && plan.deployment.runtimeLogs ? { runtimeLogs: "minimal" } : {},
 			...existing ? { resumeId: existing.id } : {},
 			yes: args.yes || process.stdin.isTTY !== true
 		};
@@ -8233,7 +8252,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			Object.assign(values, updates);
 			if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
 		};
-		const configured = (key, environment) => credentialSetup ? process.env[environment] || values[key] || "" : values[key] || process.env[environment] || "";
+		const configured = (key, environment) => credentialSetup || key === "cloudflareApiToken" ? process.env[environment] || values[key] || "" : values[key] || process.env[environment] || "";
 		const collect = async (key, environment, message, masked = true, persist = true, validate) => {
 			let value = configured(key, environment);
 			if (!value) {
@@ -8248,7 +8267,8 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		};
 		const pages = platformSetupPages(plan);
 		if (!configured("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN")) openPlatformSetupPage(pages.runtime);
-		const usingSavedRuntimeToken = credentialSetup && !process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN && Boolean(values.cloudflareApiToken);
+		const savedRuntimeToken = checkpoint?.cloudflareApiToken ?? "";
+		const usingSavedRuntimeToken = !process.env.VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN && Boolean(values.cloudflareApiToken);
 		let runtimeCloudflareApiToken = await collect("cloudflareApiToken", "VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN", "Paste runtime API token:", true, false);
 		let rejectedSavedRuntimeToken = false;
 		const verifyRuntimeToken = async (token) => {
@@ -8267,9 +8287,9 @@ async function runPlatformLifecycleCommand(commandArgs) {
 					plan = await verifyPlatformAiGatewayPlan(client, planInput, existing, plan, authoritativeProvisionIntents);
 				}
 			} catch (error) {
-				if (credentialSetup && token === values.cloudflareApiToken && !(error instanceof PlatformRuntimeTokenEmailPermissionError) && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
+				if (token === values.cloudflareApiToken && !(error instanceof PlatformRuntimeTokenEmailPermissionError) && isPlatformTokenAuthorizationError(error, checkingRuntimePermissions ? void 0 : "/ai-gateway/")) {
 					delete values.cloudflareApiToken;
-					writePendingInstallationSecrets(setupManifest, values);
+					if (credentialSetup) writePendingInstallationSecrets(setupManifest, values);
 					rejectedSavedRuntimeToken = true;
 				}
 				throw error;
@@ -8333,22 +8353,26 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		const hasFullProjectSecretKeyring = Boolean(checkpoint?.projectSecretKeysJson || checkpoint?.projectSecretActiveKeyVersion || process.env.VOID_PLATFORM_PROJECT_SECRET_KEYS_JSON || process.env.VOID_PLATFORM_PROJECT_SECRET_ACTIVE_KEY_VERSION);
 		const generateIdentityKeys = credentialSetup && !!process.stdin.isTTY;
 		const generatedKeys = generateIdentityKeys ? [configured("jwtSecret", "VOID_PLATFORM_JWT_SECRET") ? "" : "JWT signing key", configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || hasFullProjectSecretKeyring ? "" : "project encryption key"].filter(Boolean) : [];
+		const replacingRuntimeToken = !credentialSetup && !!savedRuntimeToken && runtimeCloudflareApiToken !== savedRuntimeToken;
+		const updateExistingWorkers = replacingRuntimeToken || !credentialSetup && Boolean(checkpoint?.workerSecretUpdatesJson);
+		const checkpointValue = (value) => updateExistingWorkers ? "" : value;
 		const secrets = createPlatformInstallationSecrets({
 			configurableAuthentication: !!authenticationSelection.authentication.configurable,
 			...authenticationSecrets,
 			bootstrapGitHubId,
 			bootstrapGitHubLogin,
-			cloudflareApiToken: runtimeCloudflareApiToken,
+			cloudflareApiToken: replacingRuntimeToken ? runtimeCloudflareApiToken : checkpointValue(runtimeCloudflareApiToken),
 			checkpoint: values,
 			databaseUrl: installationDatabaseUrl,
 			emailEnabled: plan.deployment.capabilities.email,
-			emailSigningSecret: process.env.VOID_PLATFORM_EMAIL_SIGNING_SECRET || "",
+			emailSigningSecret: updateExistingWorkers && values.emailSigningSecret ? "" : process.env.VOID_PLATFORM_EMAIL_SIGNING_SECRET || "",
 			existingEmailEnabled: existing.deployment.capabilities.email,
-			githubClientId,
-			githubClientSecret,
-			r2AccessKeyId,
-			r2SecretAccessKey,
+			githubClientId: checkpointValue(githubClientId),
+			githubClientSecret: checkpointValue(githubClientSecret),
+			r2AccessKeyId: checkpointValue(r2AccessKeyId),
+			r2SecretAccessKey: checkpointValue(r2SecretAccessKey),
 			existingInstallation: !credentialSetup,
+			updateExistingWorkers,
 			generateIdentityKeys,
 			jwtSecret: generateIdentityKeys ? configured("jwtSecret", "VOID_PLATFORM_JWT_SECRET") : await collect("jwtSecret", "VOID_PLATFORM_JWT_SECRET", "JWT signing key:", true, true, credentialSetup ? (value) => Buffer.byteLength(value, "utf8") >= 32 ? void 0 : "The JWT signing secret must contain at least 32 random bytes." : void 0),
 			projectSecretKey: configured("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY") || (hasFullProjectSecretKeyring || generateIdentityKeys ? "" : await collect("projectSecretKey", "VOID_PLATFORM_PROJECT_SECRET_KEY", "Project encryption key:", true, true, credentialSetup ? (value) => {
@@ -8438,7 +8462,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-CMJR8Zi-.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-BfLW0Zlo.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;
@@ -8450,7 +8474,18 @@ async function runPlatformLifecycleCommand(commandArgs) {
 				});
 			}
 		});
+		const runtimeLogsWarning = !result.waitingForDns && !result.waitingForSandboxDrain && shouldUpdateProjectWorkerRuntimeLogs({
+			previous: setupManifest.deployment,
+			next: result.manifest.deployment,
+			explicit: args.runtimeLogs !== void 0
+		}) ? await updateProjectWorkerRuntimeLogs(client, {
+			accountId,
+			namespace: result.manifest.deployment.resources.dispatchNamespace,
+			minimal: !!result.manifest.deployment.runtimeLogs,
+			installationId: result.manifest.id
+		}) : void 0;
 		progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Installation paused. Progress is saved." : "Platform installed.");
+		if (runtimeLogsWarning) log.warn(runtimeLogsWarning);
 		progress = void 0;
 		if (result.waitingForDns) {
 			note(result.zoneNameServers.length > 0 ? `Update the domain at your registrar to use:\n${result.zoneNameServers.join("\n")}\n\nThen rerun: void platform install --resume --name ${result.manifest.id}` : `Wait for ${zoneName} to become active, then rerun:\nvoid platform install --resume --name ${result.manifest.id}`, import_picocolors.default.bold("Waiting for nameservers"));

package/dist/{platform-management-nzCDwtiN.mjs → platform-management-BRefdHGD.mjs}

@@ -2,7 +2,8 @@ import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForI
 import { t as ensurePlatformAccessToken } from "./cf-access-BmBT2h8_.mjs";
 import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-D23AAMxT.mjs";
 import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-BCdLioKP.mjs";
-import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-BCsFg1Tl.mjs";
+import { i as updateProjectWorkerRuntimeLogs, n as assertPlatformRuntimeLogsSupported, r as shouldUpdateProjectWorkerRuntimeLogs } from "./platform-runtime-logs-CdJGnk3f.mjs";
+import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-D9RdGub1.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 // src/cli/platform-teardown.ts
@@ -624,6 +625,7 @@ function platformLifecycleResumeCommand(args, installationId) {
 	if (args.subcommand === "rollback" && args.fromRuntime) command.push("--from-runtime", commandArgument(args.fromRuntime));
 	if ("dashboardUrl" in args && args.dashboardUrl) command.push("--dashboard-url", commandArgument(args.dashboardUrl));
 	if ("customDomains" in args && args.customDomains) command.push("--custom-domains");
+	if ("runtimeLogs" in args && args.runtimeLogs) command.push("--runtime-logs", args.runtimeLogs);
 	if (args.yes) command.push("--yes");
 	return command.join(" ");
 }
@@ -715,6 +717,7 @@ async function runInstalledPlatformCommand(args) {
 			controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
 			...args.subcommand !== "rollback" && args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
 			...args.subcommand !== "rollback" && args.customDomains ? { customDomains: true } : {},
+			...args.subcommand === "upgrade" && args.runtimeLogs !== void 0 ? { runtimeLogs: args.runtimeLogs } : {},
 			dedicatedZone: deployment.application.dedicatedZone,
 			displayName: deployment.displayName,
 			installationSlug: deployment.installationSlug,
@@ -726,10 +729,12 @@ async function runInstalledPlatformCommand(args) {
 			allowUnverifiedAiGateway: args.plan,
 			includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
 			enableSandbox: runtime.manifest.safetyProtocols.sandboxDrain >= 3,
-			deploymentExecution: runtime.manifest.deploymentExecution === 1
+			deploymentExecution: runtime.manifest.deploymentExecution === 1,
+			allowRuntimeLogsChange: args.subcommand === "upgrade"
 		});
+		assertPlatformRuntimeLogsSupported(plan.deployment, runtime.manifest);
 		markPhase("plan");
-		note(formatPlatformInstallPlan(plan), args.subcommand === "upgrade" ? "Upgrade plan" : args.subcommand === "rollback" ? "Rollback plan" : args.subcommand === "enable" ? "Enable plan" : "Repair plan");
+		note(formatPlatformInstallPlan(plan, manifest.deployment), args.subcommand === "upgrade" ? "Upgrade plan" : args.subcommand === "rollback" ? "Rollback plan" : args.subcommand === "enable" ? "Enable plan" : "Repair plan");
 		note([
 			`Version: ${manifest.platformVersion} → ${runtime.manifest.platformVersion}`,
 			`Source: ${runtime.source}`,
@@ -872,6 +877,7 @@ async function runInstalledPlatformCommand(args) {
 			runtime,
 			operation: args.subcommand,
 			replanWorkers: async (recoveryManifest) => (await createPlatformInstallPlan(client, planInput, recoveryManifest, {
+				allowRuntimeLogsChange: args.subcommand === "upgrade",
 				authoritativeProvisionIntents: true,
 				repairMissing: true,
 				includeEmailGateway: runtime.manifest.artifacts.emailGateway !== void 0,
@@ -887,6 +893,16 @@ async function runInstalledPlatformCommand(args) {
 		});
 		progress.message("Finalizing platform changes");
 		markPhase("installer complete");
+		const runtimeLogsWarning = !result.waitingForDns && !result.waitingForSandboxDrain && shouldUpdateProjectWorkerRuntimeLogs({
+			previous: manifest.deployment,
+			next: result.manifest.deployment,
+			explicit: args.subcommand === "upgrade" && args.runtimeLogs !== void 0
+		}) ? await updateProjectWorkerRuntimeLogs(client, {
+			accountId: manifest.account.id,
+			namespace: result.manifest.deployment.resources.dispatchNamespace,
+			minimal: !!result.manifest.deployment.runtimeLogs,
+			installationId: manifest.id
+		}) : void 0;
 		reportResult = () => {
 			progress?.stop(result.waitingForDns || result.waitingForSandboxDrain ? "Platform operation paused; progress is saved." : `Platform ${args.subcommand} complete.`);
 			progress = void 0;
@@ -916,6 +932,7 @@ async function runInstalledPlatformCommand(args) {
 					log.info(`If sign-in fails, run \`void platform repair ${commandArgument(manifest.id)}\` to change the login settings.`);
 				}
 			}
+			if (runtimeLogsWarning) log.warn(runtimeLogsWarning);
 			printSuccess(`${deployment.displayName}: runtime ${runtime.manifest.platformVersion} ${args.subcommand === "rollback" ? "restored" : "ready"}.`);
 		};
 	};
@@ -964,6 +981,7 @@ async function runInstalledPlatformCommand(args) {
 }
 function assertPlatformRollbackCompatibility(installation, target, source) {
 	if (target.manifest.emailProtocolVersion !== 1 && (installation.deployment.capabilities.email || installation.resources.some((resource) => resource.key === "email-gateway-worker" && resource.state === "ready"))) throw new Error("platform: The rollback target predates the email gateway and cannot safely replace this installation. Use a runtime with email protocol version 1.");
+	if (installation.deployment.runtimeLogs && target.manifest.runtimeLogs !== 1) throw new Error("platform: The rollback target cannot keep runtime logs minimal. Run `void platform upgrade --runtime-logs full` first, then roll back.");
 	if (!installation.runtime) throw new Error("platform: The installed runtime has no artifact provenance, so post-success rollback cannot identify its compatibility manifest.");
 	if (source.manifest.platformVersion !== installation.platformVersion || source.manifestSha256 !== installation.runtime.manifestSha256) throw new Error("platform: --from-runtime does not exactly match the installed runtime artifact digest. Supply the runtime used by the current successful deployment.");
 	if (target.manifestSha256 === source.manifestSha256) throw new Error("platform: The rollback target is already the installed runtime artifact.");

package/dist/{platform-management-CMJR8Zi-.mjs → platform-management-BfLW0Zlo.mjs}

@@ -1 +1 @@
-export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-nzCDwtiN.mjs";
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-BRefdHGD.mjs";

package/dist/{platform-recovery-DBNoME3I.mjs → platform-recovery-DZuZGJtt.mjs}

@@ -1,7 +1,7 @@
 import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-DZ_2Xuqd.mjs";
 import { t as cfAccessHeaders } from "./cf-access-pejlJmuy.mjs";
-import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-BCsFg1Tl.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-nzCDwtiN.mjs";
+import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-D9RdGub1.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-BRefdHGD.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 // src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {