@sleepy-hollow/framework 0.3.0 → 0.3.1

package/dist/cli.js

@@ -8,8 +8,7 @@ import {
 } from "./chunk-D4U3ZY4O.js";
 import "./chunk-BAKXP7IR.js";
 import {
-  composeProjectSecurity,
-  redactSecurityData
+  composeProjectSecurity
 } from "./chunk-DGTHFZPZ.js";
 import {
   normalizeRoutes
@@ -25,7 +24,7 @@ import "./chunk-5WRI5ZAA.js";
 import { pathToFileURL as pathToFileURL4 } from "url";
 
 // cli/adapters.ts
-import { isAbsolute as isAbsolute5, join as join3, relative as relative5, sep as sep6 } from "path";
+import { isAbsolute as isAbsolute5, join as join4, relative as relative5, sep as sep6 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // cli/check/render.ts
@@ -652,13 +651,13 @@ function verify(inventory2) {
 
 // cli/check/command.ts
 function parse(args) {
-  let json3 = false;
+  let json2 = false;
   let scope = { kind: "full" };
   let scopeSeen = false;
   for (let index = 0; index < args.length; index++) {
     const argument = args[index];
     if (argument === "--json") {
-      json3 = true;
+      json2 = true;
       continue;
     }
     if (argument === "--full") {
@@ -699,7 +698,7 @@ function parse(args) {
   if (scope.kind === "route" && (!/^[A-Z]+$/.test(scope.method) || !scope.path.startsWith("/") || scope.path.includes(".."))) {
     throw new TypeError("Route scope uses an unsafe method or path");
   }
-  return { json: json3, scope };
+  return { json: json2, scope };
 }
 function safeMessage(error) {
   return error instanceof Error ? error.message.slice(0, 500) : "Verification evidence could not be collected";
@@ -753,299 +752,245 @@ async function runCheckCommand(args, io, load) {
 var MAX_OUTPUT = 1024 * 1024;
 var MAX_TIMEOUT = 10 * 60 * 1e3;
 
-// cli/check/mod.ts
-function verifyProject(inventory2) {
-  return verify(inventory2);
-}
-
-// cli/deploy/adapter.ts
-var TOKEN_VARIABLE = "FLY_API_TOKEN";
-function resolveToken(env) {
-  const raw = env[TOKEN_VARIABLE];
-  if (typeof raw !== "string" || raw.trim().length === 0) {
-    throw new Error(
-      `No Fly.io access token is available. Set ${TOKEN_VARIABLE} to an app-scoped token before deploying.`
-    );
-  }
-  const token = raw.trim();
-  if (/\s/.test(token)) {
-    throw new Error(`${TOKEN_VARIABLE} must be a single token with no whitespace.`);
+// cli/deploy/prepare.ts
+import { createHash } from "crypto";
+import { join } from "path";
+var OWNER = "# Generated by Sleepy Hollow. Managed deployment artifact.";
+var APP = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var REGION = /^[a-z]{3}$/;
+var DeploymentPreparationError = class extends Error {
+  diagnostics;
+  constructor(diagnostics) {
+    super(diagnostics[0]?.summary ?? "Deployment preparation failed.");
+    this.name = "DeploymentPreparationError";
+    this.diagnostics = diagnostics;
   }
-  return token;
-}
-function outcome(id, status, observedStatus, evidence) {
-  return { id, status, observedStatus, evidence };
-}
-function flyAdapter(options) {
-  return {
-    async upload(request) {
-      const result = await options.runner.run({
-        command: ["flyctl", "deploy", "--app", request.target.project, "--remote-only"],
-        environment: { [TOKEN_VARIABLE]: request.token }
-      });
-      const url = `https://${request.target.project}.fly.dev`;
-      return {
-        url,
-        revision: result.stdout.trim() || request.revision
-      };
-    },
-    async health(request) {
-      try {
-        const response = await options.transport(new URL("/", request.url));
-        return outcome("HEALTH", response.ok ? "passed" : "failed", response.status, `GET / returned ${response.status}`);
-      } catch (error) {
-        return outcome("HEALTH", "failed", 0, `GET / failed: ${error instanceof Error ? error.message : "unknown transport error"}`);
-      }
-    },
-    async smoke(request) {
-      try {
-        const response = await options.transport(new URL(request.test.path, request.url), { method: request.test.method });
-        return outcome(request.test.id, response.status === request.test.expectedStatus ? "passed" : "failed", response.status, `${request.test.method} ${request.test.path} returned ${response.status}, expected ${request.test.expectedStatus}`);
-      } catch (error) {
-        return outcome(request.test.id, "failed", 0, `${request.test.method} ${request.test.path} failed: ${error instanceof Error ? error.message : "unknown transport error"}`);
-      }
-    }
-  };
+};
+function failure(code, summary, correction) {
+  throw new DeploymentPreparationError([{ code, summary, correction }]);
 }
-
-// cli/deploy/plan.ts
-function plan(inventory2) {
-  const deployed = new Set(inventory2.deployedEnvironmentKeys);
-  const current = new Set(inventory2.environmentKeys);
-  const environmentKeyChanges = [
-    ...inventory2.environmentKeys.filter((key) => !deployed.has(key)).map((key) => ({ key, change: "added" })),
-    ...inventory2.deployedEnvironmentKeys.filter((key) => !current.has(key)).map(
-      (key) => ({ key, change: "removed" })
-    )
-  ].sort((left, right) => left.key.localeCompare(right.key));
-  const breaking = inventory2.contractChanges.some(
-    (change) => change.severity === "breaking"
-  );
-  const unchanged = inventory2.deployedRevision === inventory2.revision && environmentKeyChanges.length === 0 && inventory2.contractChanges.length === 0;
-  return {
-    target: inventory2.target,
-    revision: inventory2.revision,
-    ...inventory2.deployedRevision ? { deployedRevision: inventory2.deployedRevision } : {},
-    environmentKeyChanges,
-    contractChanges: [...inventory2.contractChanges],
-    smokeTests: [...inventory2.smokeTests],
-    requiresConfirmation: !unchanged && (inventory2.firstExternalDeployment || breaking),
-    unchanged
-  };
+function digest(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
 }
-
-// cli/deploy/types.ts
-var DEPLOY_TARGET_KINDS = ["fly"];
-
-// cli/deploy/deployment.ts
-function blocked(request, built, diagnostics) {
-  return {
-    schema: "sleepy-hollow-deploy-result/v1",
-    ok: false,
-    command: "deploy",
-    projectRoot: request.inventory.projectRootDisplay,
-    outcome: "blocked",
-    plan: built,
-    smokeResults: [],
-    diagnostics
-  };
+function quote(value) {
+  return JSON.stringify(value);
 }
-async function deploy(request, adapter, now) {
-  const { inventory: inventory2 } = request;
-  const built = plan(inventory2);
-  if (!DEPLOY_TARGET_KINDS.includes(inventory2.target.kind)) {
-    return blocked(request, built, [{
-      code: "SH_DEPLOY_TARGET_UNSUPPORTED",
-      severity: "error",
-      summary: `Deployment target ${inventory2.target.kind} is not supported in this release.`,
-      evidence: [`requested target: ${inventory2.target.kind}`],
-      correction: `Deploy to a supported target: ${DEPLOY_TARGET_KINDS.join(", ")}.`
-    }]);
+function normalize(request) {
+  if (request.target.kind !== "fly") {
+    return failure("SH_DEPLOY_TARGET_UNSUPPORTED", "Only Fly deployment preparation is supported.", "Use --target fly:<app>.");
   }
-  if (!inventory2.verification.ok) {
-    const evidence = inventory2.verification.diagnostics.filter((item) => item.severity === "error").map((item) => `${item.code}: ${item.summary}`);
-    return blocked(request, built, [{
-      code: "SH_DEPLOY_VERIFICATION_FAILED",
-      severity: "error",
-      summary: "Required verification failed, so nothing was uploaded.",
-      evidence: evidence.length > 0 ? evidence : [
-        `hollow check reported ${inventory2.verification.summary.failed} failed checks`
-      ],
-      correction: "Resolve every reported diagnostic and rerun hollow check."
-    }]);
+  const app = request.target.app.trim();
+  if (!APP.test(app)) {
+    return failure("SH_DEPLOY_TARGET_INVALID", "The Fly app name is invalid.", "Use a Fly app name containing lowercase letters, numbers, and hyphens.");
   }
-  if (built.unchanged) {
-    return {
-      schema: "sleepy-hollow-deploy-result/v1",
-      ok: true,
-      command: "deploy",
-      projectRoot: inventory2.projectRootDisplay,
-      outcome: "unchanged",
-      plan: built,
-      deployedRevision: inventory2.revision,
-      openApiPath: inventory2.openApiPath,
-      documentationPath: inventory2.documentationPath,
-      smokeResults: [],
-      completedAt: now(),
-      diagnostics: []
-    };
+  if (request.database !== "sqlite" && request.database !== "postgres") {
+    return failure("SH_DEPLOY_DATABASE_INVALID", "The deployment database profile is invalid.", "Use --database sqlite or --database postgres.");
   }
-  if (built.requiresConfirmation && !request.confirmed) {
-    return {
-      schema: "sleepy-hollow-deploy-result/v1",
-      ok: false,
-      command: "deploy",
-      projectRoot: inventory2.projectRootDisplay,
-      outcome: "confirmation-required",
-      plan: built,
-      smokeResults: [],
-      diagnostics: [{
-        code: "SH_DEPLOY_CONFIRMATION_REQUIRED",
-        severity: "error",
-        summary: "The first external deployment or a materially risky change requires explicit confirmation.",
-        evidence: [
-          `target: ${inventory2.target.kind}:${inventory2.target.project}`,
-          `revision: ${inventory2.revision}`
-        ],
-        correction: "Review the deployment plan and confirm before deploying."
-      }]
-    };
+  const region = request.region?.trim();
+  if (request.database === "sqlite" && !region) {
+    return failure("SH_DEPLOY_REGION_REQUIRED", "SQLite preparation requires a Fly region for its data volume.", "Add --region <three-letter-region>.");
   }
-  const upload = await adapter.upload({
-    target: inventory2.target,
-    revision: inventory2.revision,
-    token: request.token
-  });
-  const health = await adapter.health({ url: upload.url });
-  const smokeResults = [];
-  for (const test of inventory2.smokeTests) {
-    smokeResults.push(await adapter.smoke({ url: upload.url, test }));
+  if (region && !REGION.test(region)) {
+    return failure("SH_DEPLOY_REGION_INVALID", "The Fly region must be a three-letter region code.", "Use a valid Fly region, such as iad.");
   }
-  const requiredFailures = smokeResults.filter(
-    (outcome2, index) => outcome2.status === "failed" && inventory2.smokeTests[index].required
-  );
-  const failed = health.status === "failed" || requiredFailures.length > 0;
   return {
-    schema: "sleepy-hollow-deploy-result/v1",
-    ok: !failed,
-    command: "deploy",
-    projectRoot: inventory2.projectRootDisplay,
-    outcome: failed ? "smoke-failed" : "deployed",
-    plan: built,
-    url: upload.url,
-    deployedRevision: upload.revision,
-    openApiPath: inventory2.openApiPath,
-    documentationPath: inventory2.documentationPath,
-    health,
-    smokeResults,
-    completedAt: now(),
-    diagnostics: failed ? [{
-      code: "SH_DEPLOY_SMOKE_FAILED",
-      severity: "error",
-      summary: "The deployment is live but a required smoke test failed. It is not a successful deployment.",
-      evidence: [
-        `live revision: ${upload.revision}`,
-        ...health.status === "failed" ? [`health: ${health.evidence}`] : [],
-        ...requiredFailures.map(
-          (outcome2) => `${outcome2.id}: ${outcome2.evidence}`
-        )
-      ],
-      correction: "Investigate the live revision, then repair and redeploy or roll back."
-    }] : []
+    projectRoot: request.projectRoot,
+    target: { kind: "fly", app },
+    database: request.database,
+    ...region ? { region } : {},
+    ...request.force ? { force: true } : {}
   };
 }
-
-// cli/deploy/render.ts
-var outcomes = {
-  deployed: "Deployed",
-  unchanged: "No change",
-  blocked: "Blocked before upload",
-  "confirmation-required": "Awaiting confirmation",
-  "smoke-failed": "Deployed with failed smoke tests"
-};
-function human2(result) {
-  const lines = [];
-  const { plan: plan3 } = result;
-  lines.push(
-    `${outcomes[result.outcome]}: ${plan3.target.kind}:${plan3.target.project}`
-  );
-  lines.push(`  revision       ${plan3.revision}`);
-  if (plan3.deployedRevision) {
-    lines.push(`  previously     ${plan3.deployedRevision}`);
-  }
-  if (result.url) lines.push(`  url            ${result.url}`);
-  if (result.deployedRevision) {
-    lines.push(`  live revision  ${result.deployedRevision}`);
-  }
-  if (result.openApiPath) {
-    lines.push(`  openapi        ${result.openApiPath}`);
-  }
-  if (result.documentationPath) {
-    lines.push(`  documentation  ${result.documentationPath}`);
-  }
-  if (result.completedAt) {
-    lines.push(`  completed      ${result.completedAt}`);
-  }
-  for (const change of plan3.environmentKeyChanges) {
-    lines.push(`  env ${change.change}    ${change.key}`);
-  }
-  for (const change of plan3.contractChanges) {
-    lines.push(
-      `  contract       ${change.severity} ${change.code} ${change.operationId}`
-    );
-  }
-  if (result.health) {
-    lines.push(
-      `  health         ${result.health.status} ${result.health.evidence}`
-    );
+async function runtime(projectRoot) {
+  let manifest;
+  try {
+    manifest = JSON.parse(await platform.readTextFile(join(projectRoot, "package.json")));
+  } catch (error) {
+    if (platform.isNotFound(error)) {
+      return failure("SH_DEPLOY_PACKAGE_MISSING", "A deployable project must contain package.json.", "Create a Node or Bun package manifest with a start script.");
+    }
+    return failure("SH_DEPLOY_PACKAGE_INVALID", "package.json could not be read as JSON.", "Repair package.json and include a start script.");
   }
-  for (const outcome2 of result.smokeResults) {
-    lines.push(
-      `  smoke          ${outcome2.id} ${outcome2.status} ${outcome2.evidence}`
-    );
+  if (typeof manifest.scripts?.start !== "string" || manifest.scripts.start.trim().length === 0) {
+    return failure("SH_DEPLOY_START_MISSING", "A deployable project must declare a non-empty start script.", "Add scripts.start to package.json before preparing deployment.");
   }
-  for (const diagnostic6 of result.diagnostics) {
-    lines.push(
-      `  ${diagnostic6.severity}: ${diagnostic6.code} ${diagnostic6.summary}`
-    );
-    for (const evidence of diagnostic6.evidence) {
-      lines.push(`      ${evidence}`);
-    }
-    lines.push(`      correction: ${diagnostic6.correction}`);
+  return typeof manifest.packageManager === "string" && manifest.packageManager.startsWith("bun@") ? "bun" : "node";
+}
+function dockerfile(runtime2) {
+  if (runtime2 === "bun") {
+    return `${OWNER}
+FROM oven/bun:1.3.14
+
+WORKDIR /app
+COPY package.json ./
+RUN bun install --production
+COPY . .
+
+ENV NODE_ENV=production
+ENV PORT=3000
+EXPOSE 3000
+CMD ["bun", "run", "start"]
+`;
   }
-  return `${lines.join("\n")}
+  return `${OWNER}
+FROM node:24-bookworm-slim
+
+WORKDIR /app
+COPY package.json ./
+RUN npm install --omit=dev
+COPY . .
+
+ENV NODE_ENV=production
+ENV PORT=3000
+EXPOSE 3000
+CMD ["npm", "run", "start"]
 `;
 }
-function json2(result) {
-  return `${JSON.stringify(redactSecurityData(result), null, 2)}
+function dockerignore() {
+  return `${OWNER}
+.git
+.gitignore
+node_modules
+.env
+.env.*
+!.env.example
+*.db
+*.sqlite
+*.sqlite3
+data
+coverage
+generated/capture.json
 `;
 }
+function flyToml(request) {
+  const shared = `${OWNER}
+app = ${quote(request.target.app)}
+${request.region ? `primary_region = ${quote(request.region)}
+` : ""}
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_stop_machines = "stop"
+  auto_start_machines = true
+  min_machines_running = 0
+  processes = ["app"]
+
+[[http_service.checks]]
+  grace_period = "10s"
+  interval = "30s"
+  method = "GET"
+  timeout = "5s"
+  path = "/"
+`;
+  if (request.database === "postgres") return shared;
+  return `${shared}
+[env]
+  DATABASE_URL = "file:/data/sleepy-hollow.db"
 
-// cli/deploy/mod.ts
-function buildDeployPlan(inventory2) {
-  return plan(inventory2);
+[mounts]
+  source = "data"
+  destination = "/data"
+  processes = ["app"]
+`;
 }
-function runDeployment(request, adapter, now) {
-  return deploy(request, adapter, now);
+async function read(path) {
+  try {
+    return await platform.readTextFile(path);
+  } catch (error) {
+    if (platform.isNotFound(error)) return void 0;
+    throw error;
+  }
 }
-function renderHumanDeployResult(result) {
-  return human2(result);
+function owned(content) {
+  return content.startsWith(`${OWNER}
+`);
 }
-function renderJsonDeployResult(result) {
-  return json2(result);
+async function artifacts(request, projectRuntime) {
+  const desired = [
+    { path: ".dockerignore", content: dockerignore() },
+    { path: "Dockerfile", content: dockerfile(projectRuntime) },
+    { path: "fly.toml", content: flyToml(request) }
+  ];
+  const pending = await Promise.all(desired.map(async (item) => {
+    const existing = await read(join(request.projectRoot, item.path));
+    if (existing === void 0) return { ...item, status: "created" };
+    if (existing === item.content) return { ...item, existing, status: "unchanged" };
+    if (!owned(existing)) {
+      return failure(
+        "SH_DEPLOY_ARTIFACT_UNOWNED",
+        `Refusing to replace unrecognized deployment artifact ${item.path}.`,
+        "Move the user-owned artifact or create the managed file in a clean project."
+      );
+    }
+    if (!request.force) {
+      return failure(
+        "SH_DEPLOY_ARTIFACT_CONFLICT",
+        `Managed deployment artifact ${item.path} would change.`,
+        "Review the new plan and rerun with --force to replace the managed artifact."
+      );
+    }
+    return { ...item, existing, status: "updated" };
+  }));
+  return pending;
+}
+function commands(request) {
+  const app = request.target.app;
+  if (request.database === "sqlite") {
+    return [
+      `fly apps create ${app}`,
+      `fly volumes create data --app ${app} --region ${request.region}`,
+      `fly deploy --app ${app}`
+    ];
+  }
+  return [
+    `fly apps create ${app}`,
+    `fly secrets set DATABASE_URL=<your-postgresql-connection-url> --app ${app}`,
+    `fly deploy --app ${app}`
+  ];
 }
-function resolveDeployToken(env = process.env) {
-  return resolveToken(env);
+async function prepareFlyDeployment(input) {
+  const request = normalize(input);
+  const projectRuntime = await runtime(request.projectRoot);
+  const pending = await artifacts(request, projectRuntime);
+  for (const artifact2 of pending) {
+    if (artifact2.status !== "unchanged") {
+      await platform.writeTextFile(join(request.projectRoot, artifact2.path), artifact2.content);
+    }
+  }
+  return {
+    schema: "sleepy-hollow-deploy-prepare-result/v1",
+    ok: true,
+    command: "deploy",
+    action: "prepare",
+    target: request.target,
+    database: request.database,
+    ...request.region ? { region: request.region } : {},
+    artifacts: pending.map((artifact2) => ({
+      path: artifact2.path,
+      digest: digest(artifact2.content),
+      status: artifact2.status
+    })),
+    environmentKeys: request.database === "postgres" ? ["DATABASE_URL"] : [],
+    ...request.database === "sqlite" ? { storage: { volume: "data", mountPath: "/data", machines: 1 } } : {},
+    commands: commands(request)
+  };
 }
-function createFlyAdapter(options) {
-  return flyAdapter({
-    runner: options.runner,
-    transport: options.transport ?? globalThis.fetch
-  });
+function renderFlyPreparation(result) {
+  const lines = [
+    `Prepared Fly deployment artifacts for ${result.target.app} (${result.database}).`,
+    ...result.artifacts.map((artifact2) => `  ${artifact2.status.padEnd(9)} ${artifact2.path} ${artifact2.digest}`),
+    ...result.storage ? [`  volume     ${result.storage.volume} \u2192 ${result.storage.mountPath} (${result.storage.machines} writable Machine)`] : [],
+    ...result.environmentKeys.length ? [`  secret     ${result.environmentKeys.join(", ")}`] : [],
+    "",
+    "Next (run these yourself after authenticating with Fly):",
+    ...result.commands.map((command) => `  ${command}`)
+  ];
+  return `${lines.join("\n")}
+`;
 }
 
 // cli/create/create.ts
-import { join, resolve } from "path";
+import { join as join2, resolve } from "path";
 
 // cli/create/types.ts
 var CreationError = class extends Error {
@@ -1060,7 +1005,7 @@ var CreationError = class extends Error {
 };
 
 // cli/create/create.ts
-var VERSION = "0.3.0";
+var VERSION = "0.3.1";
 var NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 function files(name) {
   return {
@@ -1105,6 +1050,15 @@ to plan this application. The planning source of truth is
 \`\`\`bash
 npm run verify
 \`\`\`
+
+## Prepare deployment
+
+After adding a production \`start\` script, prepare reviewable Fly deployment
+files locally. This command does not log in to or deploy to Fly:
+
+\`\`\`bash
+hollow deploy prepare --target fly:${name} --database sqlite --region iad
+\`\`\`
 `,
     "tests/capture.ts": `import { rename, writeFile } from "fs/promises";
 
@@ -1134,7 +1088,8 @@ test("capture artifact is persisted", async () => { await persist(); });
         type: "module",
         engines: { node: ">=24" },
         scripts: { check: "tsc --noEmit", test: "vitest run", verify: "npm run check && npm run test && node .sleepyhollow/verify.ts" },
-        devDependencies: { "@sleepy-hollow/framework": `^${FRAMEWORK_VERSION}`, typescript: "5.9.3", vitest: "4.1.11" }
+        dependencies: { "@sleepy-hollow/framework": `^${FRAMEWORK_VERSION}` },
+        devDependencies: { typescript: "5.9.3", vitest: "4.1.11" }
       },
       null,
       2
@@ -1186,7 +1141,7 @@ async function pathExists(path) {
     throw error;
   }
 }
-var FRAMEWORK_VERSION = "0.3.0";
+var FRAMEWORK_VERSION = "0.3.1";
 async function createProject(options) {
   if (!NAME.test(options.name) || options.name.length > 64) {
     throw creationError(
@@ -1197,7 +1152,7 @@ async function createProject(options) {
     );
   }
   const parent = resolve(options.directory);
-  const destination = join(parent, options.name);
+  const destination = join2(parent, options.name);
   if (await pathExists(destination)) {
     throw creationError(
       "SH_CREATE_DESTINATION_EXISTS",
@@ -1208,14 +1163,14 @@ async function createProject(options) {
   }
   const contents = files(options.name);
   const createdFiles = Object.keys(contents).sort();
-  const staging = join(
+  const staging = join2(
     parent,
     `.${options.name}.sleepyhollow-${crypto.randomUUID()}`
   );
   try {
     await platform.mkdir(staging);
     for (const relative6 of createdFiles) {
-      const target = join(staging, relative6);
+      const target = join2(staging, relative6);
       await platform.mkdir(resolve(target, ".."), { recursive: true });
       await platform.writeTextFile(target, contents[relative6], { createNew: true });
     }
@@ -1547,8 +1502,8 @@ function normalizeDiagnostics(diagnostics) {
     )
   );
 }
-function renderDevEvent(event, json3) {
-  if (json3) return JSON.stringify(event);
+function renderDevEvent(event, json2) {
+  if (json2) return JSON.stringify(event);
   const label = event.type === "diagnostic" ? `generation ${event.generation} rejected` : event.type === "shutdown" ? `development server stopped (${event.reason ?? "failure"})` : `${event.type} active at ${event.url} (generation ${event.generation}, ${event.routeCount} routes)`;
   const lines = [`[${event.sequence}] ${label}`];
   if (event.changedFiles?.length) {
@@ -1575,20 +1530,20 @@ function renderDevEvent(event, json3) {
 // cli/dev/command.ts
 var diagnostic2 = (code, summary, correction) => ({ code, severity: "error", summary, correction });
 function parse2(args) {
-  let json3 = false;
+  let json2 = false;
   let port = 8e3;
   let portSeen = false;
   for (let index = 0; index < args.length; index += 1) {
     const value = args[index];
     if (value === "--json") {
-      if (json3) {
+      if (json2) {
         return diagnostic2(
           "SH_DEV_USAGE_INVALID",
           "The --json option was provided more than once",
           "Use hollow dev [--port <1-65535>] [--json]."
         );
       }
-      json3 = true;
+      json2 = true;
       continue;
     }
     if (value === "--port") {
@@ -1624,9 +1579,9 @@ function parse2(args) {
       "Use hollow dev [--port <1-65535>] [--json]."
     );
   }
-  return { json: json3, port };
+  return { json: json2, port };
 }
-function failure(error, fallback) {
+function failure2(error, fallback) {
   return normalizeDiagnostics(
     error instanceof DevCommandError ? error.diagnostics : [fallback]
   );
@@ -1733,7 +1688,7 @@ ${parsed.correction}`
         diagnostics: []
       });
     } catch (error) {
-      const diagnostics = failure(
+      const diagnostics = failure2(
         error,
         diagnostic2(
           "SH_DEV_STARTUP_FAILED",
@@ -1759,7 +1714,7 @@ ${parsed.correction}`
         type: "diagnostic",
         state: "rejected",
         generation,
-        diagnostics: failure(
+        diagnostics: failure2(
           error,
           diagnostic2(
             "SH_DEV_WATCH_FAILED",
@@ -1808,7 +1763,7 @@ ${parsed.correction}`
           state: "rejected",
           generation: nextGeneration,
           changedFiles: changes,
-          diagnostics: failure(
+          diagnostics: failure2(
             error,
             diagnostic2(
               "SH_DEV_RELOAD_FAILED",
@@ -1843,7 +1798,7 @@ ${parsed.correction}`
           state: "rejected",
           generation: nextGeneration,
           changedFiles: changes,
-          diagnostics: failure(
+          diagnostics: failure2(
             error,
             diagnostic2(
               "SH_DEV_ACTIVATION_FAILED",
@@ -1876,7 +1831,7 @@ ${parsed.correction}`
       type: "diagnostic",
       state: "rejected",
       generation,
-      diagnostics: failure(
+      diagnostics: failure2(
         error,
         diagnostic2(
           "SH_DEV_SUPERVISOR_FAILED",
@@ -1999,12 +1954,12 @@ async function loadRuntime(projectRoot) {
     });
   }
   const routes2 = await discoverRoutes(realApiRoot);
-  const runtime = await composeProjectSecurity(routes2, {
+  const runtime2 = await composeProjectSecurity(routes2, {
     mode: "development",
     root,
     ...project.securityModule === void 0 ? {} : { securityModule: project.securityModule }
   });
-  return { runtime, routeCount: runtime.routes.length };
+  return { runtime: runtime2, routeCount: runtime2.routes.length };
 }
 async function runDevWorker(args) {
   if (args.length !== 4 || !["validate", "serve"].includes(args[0])) return 2;
@@ -2012,12 +1967,12 @@ async function runDevWorker(args) {
   const port = Number(rawPort);
   if (hostname !== "127.0.0.1" || !Number.isInteger(port) || port < 1 || port > 65535) return 2;
   try {
-    const { runtime, routeCount } = await loadRuntime(projectRoot);
+    const { runtime: runtime2, routeCount } = await loadRuntime(projectRoot);
     if (intent === "validate") {
       console.log(JSON.stringify({ ready: true, routeCount }));
       return 0;
     }
-    const server = platform.serve({ hostname, port }, (request) => runtime.fetch(request));
+    const server = platform.serve({ hostname, port }, (request) => runtime2.fetch(request));
     console.log(JSON.stringify({ ready: true, routeCount }));
     await new Promise((resolve5, reject) => {
       server.once("close", resolve5);
@@ -2036,10 +1991,10 @@ async function runDevWorker(args) {
 }
 
 // cli/generate/artifacts.ts
-import { basename, dirname, join as join2 } from "path";
+import { basename, dirname, join as join3 } from "path";
 
 // cli/generate/canonical.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function stable(value) {
   if (Array.isArray(value)) return value.map(stable);
   if (value && typeof value === "object") {
@@ -2053,8 +2008,8 @@ function canonicalJson(value) {
   return `${JSON.stringify(stable(value), null, 2)}
 `;
 }
-function digest(content) {
-  return createHash("sha256").update(content).digest("hex");
+function digest2(content) {
+  return createHash2("sha256").update(content).digest("hex");
 }
 function stableSummary(value) {
   return JSON.stringify(stable(value));
@@ -2909,7 +2864,7 @@ var ownedPaths = [
   "manifest.json"
 ];
 function artifact(path, content) {
-  return { path, content, digest: digest(content) };
+  return { path, content, digest: digest2(content) };
 }
 function renderArtifacts(inventory2) {
   const normalized = normalizeInventory(inventory2);
@@ -2924,15 +2879,15 @@ function renderArtifacts(inventory2) {
   ];
   const manifestContent = canonicalJson({
     schema: "sleepy-hollow-generated-manifest/v1",
-    generatorVersion: "0.3.0",
+    generatorVersion: "0.3.1",
     serviceId: normalized.serviceId,
-    inputDigest: digest(input),
+    inputDigest: digest2(input),
     artifacts: Object.fromEntries(
       rendered.map((item) => [item.path, item.digest])
     )
   });
   return {
-    inputDigest: digest(input),
+    inputDigest: digest2(input),
     artifacts: [...rendered, artifact("manifest.json", manifestContent)]
   };
 }
@@ -2958,7 +2913,7 @@ async function copyEntry(source, target) {
   if (info.isDirectory()) {
     await platform.mkdir(target, { recursive: true });
     for await (const entry of platform.readDir(source)) {
-      await copyEntry(join2(source, entry.name), join2(target, entry.name));
+      await copyEntry(join3(source, entry.name), join3(target, entry.name));
     }
     return;
   }
@@ -2975,28 +2930,28 @@ function outputFailure(error) {
   }]);
 }
 async function previousOwned(generatedDirectory) {
-  const source = await readText(join2(generatedDirectory, "manifest.json"));
+  const source = await readText(join3(generatedDirectory, "manifest.json"));
   if (!source) return void 0;
   try {
     const manifest = JSON.parse(source);
     if (manifest.schema !== "sleepy-hollow-generated-manifest/v1") {
       return void 0;
     }
-    const artifacts = manifest.artifacts;
-    if (!artifacts || typeof artifacts !== "object" || Array.isArray(artifacts)) return void 0;
-    return /* @__PURE__ */ new Set([...Object.keys(artifacts), "manifest.json"]);
+    const artifacts2 = manifest.artifacts;
+    if (!artifacts2 || typeof artifacts2 !== "object" || Array.isArray(artifacts2)) return void 0;
+    return /* @__PURE__ */ new Set([...Object.keys(artifacts2), "manifest.json"]);
   } catch {
     return void 0;
   }
 }
 async function writeAtomically(projectRoot, rendered) {
-  const target = join2(projectRoot, "generated");
+  const target = join3(projectRoot, "generated");
   await platform.mkdir(projectRoot, { recursive: true });
   const targetExists = await exists(target);
   const priorOwned = targetExists ? await previousOwned(target) : void 0;
   if (targetExists && !priorOwned) {
     for (const path of ownedPaths) {
-      if (await exists(join2(target, path))) {
+      if (await exists(join3(target, path))) {
         throw new GenerationError([{
           code: "SH_GENERATE_UNKNOWN_TARGET",
           summary: `Refusing to replace unowned file generated/${path}`,
@@ -3016,11 +2971,11 @@ async function writeAtomically(projectRoot, rendered) {
     if (targetExists) {
       for await (const entry of platform.readDir(target)) {
         if (priorOwned?.has(entry.name)) continue;
-        await copyEntry(join2(target, entry.name), join2(stage, entry.name));
+        await copyEntry(join3(target, entry.name), join3(stage, entry.name));
       }
     }
     for (const item of rendered.artifacts) {
-      await platform.writeTextFile(join2(stage, item.path), item.content);
+      await platform.writeTextFile(join3(stage, item.path), item.content);
     }
     if (targetExists) {
       await platform.rename(target, backup);
@@ -3038,10 +2993,10 @@ async function writeAtomically(projectRoot, rendered) {
 }
 async function generate(options) {
   const rendered = renderArtifacts(options.inventory);
-  const generatedDirectory = join2(options.projectRoot, "generated");
-  const artifacts = await Promise.all(rendered.artifacts.map(async (item) => {
-    const current = await readText(join2(generatedDirectory, item.path));
-    const actualDigest = current === void 0 ? void 0 : digest(current);
+  const generatedDirectory = join3(options.projectRoot, "generated");
+  const artifacts2 = await Promise.all(rendered.artifacts.map(async (item) => {
+    const current = await readText(join3(generatedDirectory, item.path));
+    const actualDigest = current === void 0 ? void 0 : digest2(current);
     return {
       path: `generated/${item.path}`,
       digest: item.digest,
@@ -3054,7 +3009,7 @@ async function generate(options) {
   );
   let previous = options.previousOpenApi;
   if (!previous) {
-    const source = await readText(join2(generatedDirectory, "openapi.json"));
+    const source = await readText(join3(generatedDirectory, "openapi.json"));
     if (source) {
       try {
         previous = JSON.parse(source);
@@ -3072,7 +3027,7 @@ async function generate(options) {
     digest: "absent",
     stale: true
   }));
-  const inspectedArtifacts = [...artifacts, ...extraOwned];
+  const inspectedArtifacts = [...artifacts2, ...extraOwned];
   const stale = inspectedArtifacts.filter((item) => item.stale);
   const diagnostics = stale.map((item) => ({
     code: "SH_GENERATE_ARTIFACT_STALE",
@@ -3100,7 +3055,7 @@ async function generate(options) {
     schema: "sleepy-hollow-generate-result/v1",
     serviceId: options.inventory.serviceId,
     inputDigest: rendered.inputDigest,
-    artifacts: artifacts.map((item) => ({
+    artifacts: artifacts2.map((item) => ({
       ...item,
       actualDigest: item.digest,
       stale: false
@@ -3198,7 +3153,7 @@ function inventoryFromRoutes(routes2, options) {
   return {
     serviceId: options.serviceId,
     title: options.title ?? options.serviceId,
-    version: options.version ?? "0.3.0",
+    version: options.version ?? "0.3.1",
     ...options.description ? { description: options.description } : {},
     operations,
     securitySchemes: options.securitySchemes ?? {}
@@ -3211,7 +3166,7 @@ function generateContracts(options) {
 }
 
 // cli/test/result.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var MAX_EVIDENCE = 8 * 1024;
 function safe(value) {
   return value.replace(
@@ -3235,12 +3190,12 @@ function eventKey(event) {
   return `${event.file}\0${event.name}`;
 }
 function unmappedId(event) {
-  return `unmapped:${createHash2("sha256").update(eventKey(event)).digest("hex").slice(0, 12)}`;
+  return `unmapped:${createHash3("sha256").update(eventKey(event)).digest("hex").slice(0, 12)}`;
 }
-function normalizeRunnerResult(plan3, inventory2, runner) {
-  const diagnostics = [...plan3.diagnostics];
+function normalizeRunnerResult(plan2, inventory2, runner) {
+  const diagnostics = [...plan2.diagnostics];
   const selectedEntries = inventory2.manifest.tests.filter(
-    (test) => plan3.selectedTests.includes(test.id)
+    (test) => plan2.selectedTests.includes(test.id)
   );
   const byEvent = new Map(selectedEntries.map((test) => [
     eventKey({ file: test.sourcePath, name: test.registeredName }),
@@ -3343,7 +3298,7 @@ function normalizeRunnerResult(plan3, inventory2, runner) {
   }
   tests.sort((left, right) => left.id.localeCompare(right.id));
   const selectedRequirements = inventory2.requirements.filter(
-    (requirement) => plan3.selectedRequirements.includes(requirement.id)
+    (requirement) => plan2.selectedRequirements.includes(requirement.id)
   );
   const selectedManifest = {
     schema: "sleepy-hollow-test-manifest/v1",
@@ -3373,10 +3328,10 @@ function normalizeRunnerResult(plan3, inventory2, runner) {
     schema: "sleepy-hollow-test-result/v1",
     ok,
     command: "test",
-    requestedScope: plan3.requestedScope,
-    effectiveScope: plan3.effectiveScope,
-    selectedRequirements: Object.freeze([...plan3.selectedRequirements]),
-    selectedTests: Object.freeze([...plan3.selectedTests]),
+    requestedScope: plan2.requestedScope,
+    effectiveScope: plan2.effectiveScope,
+    selectedRequirements: Object.freeze([...plan2.selectedRequirements]),
+    selectedTests: Object.freeze([...plan2.selectedTests]),
     tests: Object.freeze(tests),
     criteria: Object.freeze(criteria),
     diagnostics: Object.freeze(diagnostics),
@@ -3394,8 +3349,8 @@ function normalizeRunnerResult(plan3, inventory2, runner) {
     verificationStateChanged: false
   });
 }
-function failedWithoutRunner(plan3, inventory2) {
-  return normalizeRunnerResult(plan3, inventory2, {
+function failedWithoutRunner(plan2, inventory2) {
+  return normalizeRunnerResult(plan2, inventory2, {
     status: "failed",
     durationMs: 0,
     events: []
@@ -3418,9 +3373,9 @@ function projectPath(root, path) {
   }
   return local;
 }
-function invocation(plan3, options) {
+function invocation(plan2, options) {
   const root = resolve4(options.projectRoot);
-  const files2 = [...new Set(plan3.files.map((path) => projectPath(root, path)))].sort();
+  const files2 = [...new Set(plan2.files.map((path) => projectPath(root, path)))].sort();
   if (files2.length === 0) {
     throw new TypeError(
       "A native test run requires at least one exact source file"
@@ -3430,7 +3385,7 @@ function invocation(plan3, options) {
     "./node_modules/vitest/vitest.mjs",
     "run",
     "--reporter=verbose",
-    ...plan3.filter ? ["--testNamePattern", plan3.filter] : [],
+    ...plan2.filter ? ["--testNamePattern", plan2.filter] : [],
     ...files2
   ];
   return Object.freeze({
@@ -3489,14 +3444,14 @@ function parseTap(source, inventory2, failureEvidence) {
   }
   return { valid: validHeader && validPlan && validStructure, events };
 }
-async function runNative(plan3, inventory2, options) {
+async function runNative(plan2, inventory2, options) {
   const timeoutMs = options.timeoutMs ?? MAX_TIMEOUT2;
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT2) {
     throw new TypeError(
       "Test timeout must be from 1 through 600000 milliseconds"
     );
   }
-  const command = invocation(plan3, options);
+  const command = invocation(plan2, options);
   const started = performance.now();
   const child = new platform.Command(command.command, {
     cwd: command.cwd,
@@ -3556,7 +3511,7 @@ async function runNative(plan3, inventory2, options) {
 }
 
 // cli/test/scope.ts
-import { isAbsolute as isAbsolute4, normalize, sep as sep5 } from "path";
+import { isAbsolute as isAbsolute4, normalize as normalize2, sep as sep5 } from "path";
 var stableId = /^[A-Za-z][A-Za-z0-9._-]*$/;
 function sorted2(values) {
   return [...new Set(values)].sort();
@@ -3572,13 +3527,13 @@ function diagnostic4(code, severity, summary, correction, requirementId) {
 }
 function safePath(path) {
   const portable3 = path.split(sep5).join("/");
-  const normalized = normalize(path).split(sep5).join("/");
+  const normalized = normalize2(path).split(sep5).join("/");
   return !isAbsolute4(path) && portable3 !== "" && portable3 !== ".." && !portable3.startsWith("../") && normalized === portable3 && !portable3.includes("\0");
 }
 function escaped(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function plan2(inventory2, requestedScope) {
+function plan(inventory2, requestedScope) {
   const diagnostics = [];
   const requirements2 = /* @__PURE__ */ new Map();
   for (const requirement of inventory2.requirements) {
@@ -3843,14 +3798,14 @@ function renderJson(result) {
 
 // cli/test/command.ts
 function parse3(args) {
-  let json3 = false;
+  let json2 = false;
   let scope = { kind: "full" };
   let scopeSeen = false;
   for (let index = 0; index < args.length; index++) {
     const argument = args[index];
     if (argument === "--json") {
-      if (json3) throw new TypeError("--json may appear once");
-      json3 = true;
+      if (json2) throw new TypeError("--json may appear once");
+      json2 = true;
       continue;
     }
     if (argument === "--full") {
@@ -3893,9 +3848,9 @@ function parse3(args) {
     }
     throw new TypeError(`Unknown test argument: ${argument.slice(0, 80)}`);
   }
-  return { json: json3, scope };
+  return { json: json2, scope };
 }
-function usage(summary, json3, io) {
+function usage(summary, json2, io) {
   const result = {
     ok: false,
     command: "test",
@@ -3908,7 +3863,7 @@ function usage(summary, json3, io) {
     }]
   };
   io.stderr(
-    json3 ? JSON.stringify(result) : `SH_TEST_USAGE_INVALID: ${summary}
+    json2 ? JSON.stringify(result) : `SH_TEST_USAGE_INVALID: ${summary}
 ${result.diagnostics[0].correction}`
   );
   return 2;
@@ -3944,9 +3899,9 @@ function loadFailure(scope) {
     verificationStateChanged: false
   };
 }
-function emit(result, json3, io) {
+function emit(result, json2, io) {
   (result.ok ? io.stdout : io.stderr)(
-    json3 ? renderJson(result) : renderHuman(result)
+    json2 ? renderJson(result) : renderHuman(result)
   );
   return result.ok ? 0 : 1;
 }
@@ -3969,7 +3924,7 @@ async function execute(args, io, load, runner) {
   }
   const capturePath = `${io.cwd}/generated/capture.json`;
   inventory2 = { ...inventory2, captureArtifactPath: capturePath };
-  const testPlan = plan2(inventory2, parsed.scope);
+  const testPlan = plan(inventory2, parsed.scope);
   if (testPlan.diagnostics.some((item) => item.severity === "error")) {
     return emit(failedWithoutRunner(testPlan, inventory2), parsed.json, io);
   }
@@ -4052,7 +4007,7 @@ var CLI_COMMANDS = [
   "generate",
   "deploy"
 ];
-var CLI_VERSION = "0.3.0";
+var CLI_VERSION = "0.3.1";
 var commandMetadata = {
   create: {
     description: "Create one deterministic Sleepy Hollow project.",
@@ -4075,8 +4030,8 @@ var commandMetadata = {
     usage: "hollow generate [--check] [--json]"
   },
   deploy: {
-    description: "Preview and deliver one verified platform Deploy revision.",
-    usage: "hollow deploy [--preview] [--confirm <digest>] [--json]"
+    description: "Prepare local Fly deployment artifacts; Fly performs deployment.",
+    usage: "hollow deploy prepare --target fly:<app> --database <sqlite|postgres> [--region <region>] [--force] [--json]"
   }
 };
 function topLevelHelp() {
@@ -4207,9 +4162,9 @@ function renderJson2(result) {
     diagnostics: result.diagnostics
   });
 }
-function emitResult(result, json3, io, exitCode) {
+function emitResult(result, json2, io, exitCode) {
   const normalized = normalizeResult(result);
-  const output = json3 ? renderJson2(normalized) : renderHuman2(normalized);
+  const output = json2 ? renderJson2(normalized) : renderHuman2(normalized);
   (normalized.ok ? io.stdout : io.stderr)(output);
   return exitCode ?? (normalized.ok ? 0 : 1);
 }
@@ -4227,9 +4182,9 @@ function usageResult(code, summary) {
     }]
   });
 }
-function emitUsage(code, summary, json3, io) {
+function emitUsage(code, summary, json2, io) {
   io.stderr(
-    json3 ? usageResult(code, summary) : `${code}: ${summary}
+    json2 ? usageResult(code, summary) : `${code}: ${summary}
 Run hollow --help and use one documented invocation.`
   );
   return 2;
@@ -4264,12 +4219,12 @@ function confirmationFailure(result) {
   };
 }
 async function runCommandSurface(args, io, handlers) {
-  const json3 = args.includes("--json");
+  const json2 = args.includes("--json");
   if (containsModelOption(args)) {
     return emitUsage(
       "SH_CLI_USAGE_INVALID",
       "Model selection is not part of the Sleepy Hollow CLI.",
-      json3,
+      json2,
       io
     );
   }
@@ -4289,7 +4244,7 @@ async function runCommandSurface(args, io, handlers) {
     return emitUsage(
       "SH_CLI_USAGE_INVALID",
       "Help expects exactly one supported command.",
-      json3,
+      json2,
       io
     );
   }
@@ -4298,7 +4253,7 @@ async function runCommandSurface(args, io, handlers) {
     return emitUsage(
       invalid === "option" ? "SH_CLI_USAGE_INVALID" : "SH_CLI_COMMAND_UNKNOWN",
       `Unknown ${invalid}: ${safeToken(args[0])}`,
-      json3,
+      json2,
       io
     );
   }
@@ -4311,7 +4266,7 @@ async function runCommandSurface(args, io, handlers) {
     return emitUsage(
       "SH_CLI_USAGE_INVALID",
       `Invalid help invocation for ${selected}.`,
-      json3,
+      json2,
       io
     );
   }
@@ -4319,7 +4274,7 @@ async function runCommandSurface(args, io, handlers) {
     const response = await handlers[selected]({
       args: args.slice(1),
       cwd: io.cwd,
-      json: json3,
+      json: json2,
       io
     });
     if (response.result.command !== selected) {
@@ -4337,14 +4292,14 @@ async function runCommandSurface(args, io, handlers) {
     }
     if (!response.result.ok) {
       if (response.rendered) return response.exitCode ?? 1;
-      return emitResult(response.result, json3, io, response.exitCode);
+      return emitResult(response.result, json2, io, response.exitCode);
     }
     if (response.rendered) return response.exitCode ?? 0;
     if (!response.operation || response.operation.intent === "preview") {
-      return emitResult(response.result, json3, io, response.exitCode);
+      return emitResult(response.result, json2, io, response.exitCode);
     }
     if (!response.operation.providedConfirmation || response.operation.providedConfirmation !== response.operation.confirmationDigest) {
-      return emitResult(confirmationFailure(response.result), json3, io);
+      return emitResult(confirmationFailure(response.result), json2, io);
     }
     const applied = await response.operation.apply();
     if (applied.command !== selected) {
@@ -4353,7 +4308,7 @@ async function runCommandSurface(args, io, handlers) {
     if (!applied.schema && !applied.version) {
       throw new TypeError("Command application returned an unversioned result");
     }
-    return emitResult(applied, json3, io);
+    return emitResult(applied, json2, io);
   } catch {
     return emitResult(
       {
@@ -4368,7 +4323,7 @@ async function runCommandSurface(args, io, handlers) {
           correction: "Inspect the project evidence and retry the documented command."
         }]
       },
-      json3,
+      json2,
       io
     );
   }
@@ -4438,7 +4393,7 @@ ${created.nextActions.map((item) => `  ${item}`).join("\n")}`,
       summary: "Project creation failed",
       correction: "Inspect the protected failure and retry safely."
     }];
-    const json3 = {
+    const json2 = {
       ok: false,
       command: "create",
       version: CLI_VERSION,
@@ -4454,7 +4409,7 @@ ${created.nextActions.map((item) => `  ${item}`).join("\n")}`,
         version: CLI_VERSION,
         summary: "Project creation failed.",
         diagnostics: creationDiagnostics(diagnostics, cwd),
-        json: json3
+        json: json2
       }
     };
   }
@@ -4500,11 +4455,11 @@ var generate2 = async ({ args, cwd }) => {
   }
   const check = args.includes("--check");
   try {
-    const configPath = join3(cwd, "sleepyhollow.config.ts");
+    const configPath = join4(cwd, "sleepyhollow.config.ts");
     const imported = await import(`${pathToFileURL2(configPath).href}?generate=${Date.now()}`);
     const config = imported.default;
     const routes2 = await discoverRoutes(
-      join3(cwd, config.apiDirectory ?? "api")
+      join4(cwd, config.apiDirectory ?? "api")
     );
     const generated = await generateContracts({
       inventory: inventoryFromRoutes(routes2, {
@@ -4538,7 +4493,7 @@ Review ${generated.changes.length} contract change(s).` : ""}`;
       summary: "Contract generation failed",
       correction: "Inspect route, schema, configuration, and output diagnostics before retrying."
     }];
-    const json3 = {
+    const json2 = {
       ok: false,
       command: "generate",
       schema: "sleepy-hollow-generate-result/v1",
@@ -4556,7 +4511,7 @@ Review ${generated.changes.length} contract change(s).` : ""}`;
         schema: "sleepy-hollow-generate-result/v1",
         summary: "Contract generation failed.",
         diagnostics: generationDiagnostics(diagnostics),
-        json: json3
+        json: json2
       }
     };
   }
@@ -4618,123 +4573,76 @@ function checkHandler(loader) {
     };
   };
 }
-function deployPlanDigest(plan3) {
-  const encoded = new TextEncoder().encode(JSON.stringify(plan3));
-  let hash = 2166136261;
-  for (const byte of encoded) {
-    hash ^= byte;
-    hash = Math.imul(hash, 16777619) >>> 0;
-  }
-  return hash.toString(16).padStart(8, "0");
-}
-function deployHandler(load, adapter, token) {
+function deployHandler() {
   return async ({ args, cwd }) => {
-    const index = args.indexOf("--confirm");
-    const provided = index >= 0 ? args[index + 1] : void 0;
-    const preview = args.includes("--preview");
-    let inventory2;
-    try {
-      inventory2 = await load({ projectRoot: cwd });
-    } catch (error) {
-      return deployPrecondition(error);
+    if (args[0] !== "prepare") {
+      return usage2(
+        "deploy",
+        "Expected hollow deploy prepare --target fly:<app> --database <sqlite|postgres> [--region <region>] [--force] [--json]."
+      );
     }
-    const built = buildDeployPlan(inventory2);
-    const digest2 = deployPlanDigest(built);
-    const run = async (confirmed) => {
-      let result;
-      try {
-        result = await runDeployment(
-          {
-            inventory: inventory2,
-            token: (token ?? resolveDeployToken)(),
-            confirmed,
-            ...confirmed ? { confirmationSource: `operator confirmed plan ${digest2}` } : {}
-          },
-          adapter ?? createFlyAdapter({
-            runner: {
-              async run() {
-                throw new Error("No Fly command runner was configured for this invocation.");
-              }
-            }
-          }),
-          () => (/* @__PURE__ */ new Date()).toISOString()
-        );
-      } catch (error) {
-        return deployPrecondition(error).result;
+    let target;
+    let database;
+    let region;
+    let force = false;
+    if (args.filter((argument) => argument === "--json").length > 1) {
+      return usage2("deploy", "Deployment preparation accepts --json at most once.");
+    }
+    for (let index = 1; index < args.length; index++) {
+      const argument = args[index];
+      if (argument === "--json") continue;
+      if (argument === "--force" && !force) {
+        force = true;
+        continue;
+      }
+      if ((argument === "--target" || argument === "--database" || argument === "--region") && index + 1 < args.length) {
+        const value = args[++index];
+        if (argument === "--target" && !target) target = value;
+        else if (argument === "--database" && !database && (value === "sqlite" || value === "postgres")) database = value;
+        else if (argument === "--region" && !region) region = value;
+        else return usage2("deploy", "Deployment preparation options must occur once with a valid value.");
+        continue;
       }
+      return usage2("deploy", "Deployment preparation options are invalid.");
+    }
+    if (!target?.startsWith("fly:") || !database) {
+      return usage2("deploy", "Deployment preparation requires --target fly:<app> and --database sqlite or postgres.");
+    }
+    try {
+      const prepared = await prepareFlyDeployment({
+        projectRoot: cwd,
+        target: { kind: "fly", app: target.slice("fly:".length) },
+        database,
+        ...region ? { region } : {},
+        ...force ? { force: true } : {}
+      });
       return {
-        ok: result.ok,
-        command: "deploy",
-        schema: result.schema,
-        summary: renderHumanDeployResult(result).split("\n")[0] ?? "",
-        diagnostics: result.diagnostics.map((item) => ({
-          code: item.code,
-          severity: item.severity,
-          summary: item.summary,
-          correction: item.correction
-        })),
-        json: JSON.parse(renderJsonDeployResult(result))
+        result: {
+          ok: true,
+          command: "deploy",
+          schema: prepared.schema,
+          summary: renderFlyPreparation(prepared).trimEnd(),
+          diagnostics: [],
+          json: prepared
+        }
       };
-    };
-    if (preview || built.requiresConfirmation) {
-      const previewed = await run(false);
+    } catch (error) {
+      const diagnostics = error instanceof DeploymentPreparationError ? error.diagnostics : [{
+        code: "SH_DEPLOY_PREPARE_FAILED",
+        summary: "Deployment preparation failed.",
+        correction: "Inspect the project files and retry the documented command."
+      }];
       return {
+        exitCode: 1,
         result: {
-          ...previewed,
-          summary: preview ? previewed.summary : `${previewed.summary} Confirm with --confirm ${digest2}`
-        },
-        operation: {
-          intent: preview ? "preview" : "apply",
-          confirmationDigest: digest2,
-          ...provided ? { providedConfirmation: provided } : {},
-          apply: () => run(true)
+          ok: false,
+          command: "deploy",
+          schema: "sleepy-hollow-deploy-prepare-result/v1",
+          summary: diagnostics[0].summary,
+          diagnostics: diagnostics.map((item) => ({ ...item, severity: "error" }))
         }
       };
     }
-    const applied = await run(true);
-    return { exitCode: applied.ok ? 0 : 1, result: applied };
-  };
-}
-function deployPrecondition(error) {
-  const summary = error instanceof Error ? error.message : "Deployment could not start.";
-  return {
-    exitCode: 1,
-    result: {
-      ok: false,
-      command: "deploy",
-      schema: "sleepy-hollow-deploy-result/v1",
-      summary,
-      diagnostics: [{
-        code: "SH_DEPLOY_PRECONDITION_UNMET",
-        severity: "error",
-        summary,
-        correction: "Resolve the reported condition and rerun hollow deploy."
-      }]
-    }
-  };
-}
-function unavailable(command) {
-  return ({ args }) => {
-    if (args.some((argument) => argument !== "--json")) {
-      return usage2(
-        command,
-        `${command} options are unavailable until its canonical feature is installed.`
-      );
-    }
-    return {
-      result: {
-        ok: false,
-        command,
-        schema: `sleepy-hollow-${command}-result/v1`,
-        summary: `${command} is not available in this build.`,
-        diagnostics: [{
-          code: "SH_CLI_FEATURE_UNAVAILABLE",
-          severity: "error",
-          summary: `The canonical ${command} command API is not implemented.`,
-          correction: "Install a build containing the governed canonical feature."
-        }]
-      }
-    };
   };
 }
 function testHandler(loader, runner) {
@@ -4800,11 +4708,7 @@ function createCliHandlers(dependencies = {}) {
     ),
     check: checkHandler(dependencies.checkInventoryLoader),
     generate: generate2,
-    deploy: dependencies.deployInventoryLoader ? deployHandler(
-      dependencies.deployInventoryLoader,
-      dependencies.deployAdapter,
-      dependencies.deployToken
-    ) : unavailable("deploy")
+    deploy: deployHandler()
   };
   return Object.fromEntries(CLI_COMMANDS.map((command) => [
     command,
@@ -4972,7 +4876,7 @@ async function locations(options) {
 }
 
 // skills/sleepy-hollow/planning/parser.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { parse as parse4 } from "yaml";
 
 // skills/sleepy-hollow/planning/planning_error.ts
@@ -5058,13 +4962,13 @@ function frontmatterOf(source, path) {
       schema: "core"
     });
   } catch (error) {
-    const failure2 = error;
-    const message = failure2.message ?? String(error);
+    const failure3 = error;
+    const message = failure3.message ?? String(error);
     diagnostics.push(diagnostic5(
       /duplicat/i.test(message) ? "SH_PLANNING_YAML_DUPLICATE_KEY" : "SH_PLANNING_YAML_INVALID",
       path,
-      (failure2.mark?.line ?? 0) + 2,
-      (failure2.mark?.column ?? 0) + 1,
+      (failure3.mark?.line ?? 0) + 2,
+      (failure3.mark?.column ?? 0) + 1,
       `Invalid requirement frontmatter: ${message}`,
       "Correct the YAML frontmatter without adding proprietary syntax."
     ));
@@ -5229,9 +5133,9 @@ function digestOf(source, path) {
     )]);
   }
   const normalized = normalizedFrontmatter + governed.slice(frontmatter.length);
-  return createHash3("sha256").update(normalized).digest("hex");
+  return createHash4("sha256").update(normalized).digest("hex");
 }
-function approvalOf(source, digest2, criteria) {
+function approvalOf(source, digest3, criteria) {
   const governance = source.slice(source.indexOf("## Governance record"));
   const approvalStart = governance.indexOf("### Approval");
   if (approvalStart < 0) return void 0;
@@ -5250,7 +5154,7 @@ function approvalOf(source, digest2, criteria) {
     (item) => criterionText.includes(item.id)
   ).map((item) => item.id);
   const valid = Boolean(
-    approver && approvedAt && decisionSource && recordedDigest === digest2 && criteria.length > 0 && approvedCriteria.length === criteria.length
+    approver && approvedAt && decisionSource && recordedDigest === digest3 && criteria.length > 0 && approvedCriteria.length === criteria.length
   );
   return {
     approver: approver ?? "",
@@ -5495,7 +5399,7 @@ async function collect(absoluteRoot, displayRoot, serviceId2, options) {
   return found;
 }
 async function requirements(project, options) {
-  const read = options.readTextFile ?? ((path) => platform.readTextFile(path));
+  const read2 = options.readTextFile ?? ((path) => platform.readTextFile(path));
   const roots = project.services.length > 0 ? project.services.map((service) => ({
     absolute: `${project.projectRoot}/${service.apiRoot}`,
     display: service.apiRoot,
@@ -5527,7 +5431,7 @@ async function requirements(project, options) {
     }
     let source;
     try {
-      source = await read(file.absolutePath);
+      source = await read2(file.absolutePath);
     } catch {
       diagnostics.push(issue2(
         "SH_EVIDENCE_REQUIREMENT_UNREADABLE",
@@ -5617,10 +5521,10 @@ async function requirements(project, options) {
 var CAPTURE_FILE = "capture.json";
 async function capture(project, options) {
   const path = `${project.projectRoot}/${project.generatedDirectory}/${CAPTURE_FILE}`;
-  const read = options.readTextFile ?? ((target) => platform.readTextFile(target));
+  const read2 = options.readTextFile ?? ((target) => platform.readTextFile(target));
   let source;
   try {
-    source = await read(path);
+    source = await read2(path);
   } catch {
     throw new EvidenceError([{
       code: "SH_EVIDENCE_CAPTURE_MISSING",
@@ -5804,25 +5708,6 @@ async function checkLoader(projectRoot, revision2, _scope) {
     }
   };
 }
-async function deployLoader(projectRoot, options) {
-  const project = await locations({ projectRoot });
-  const verification = verifyProject(
-    await checkLoader(projectRoot, options.revision, void 0)
-  );
-  return {
-    projectRootDisplay: projectRoot,
-    target: options.target,
-    revision: options.revision,
-    verification,
-    environmentKeys: [],
-    deployedEnvironmentKeys: [],
-    contractChanges: [],
-    openApiPath: `${project.generatedDirectory}/openapi.json`,
-    documentationPath: `${project.generatedDirectory}/docs.html`,
-    smokeTests: [],
-    firstExternalDeployment: true
-  };
-}
 async function testLoader(projectRoot) {
   const project = await locations({ projectRoot });
   const governed = await requirements(project, { projectRoot });
@@ -5857,12 +5742,6 @@ function createCheckInventoryLoader(options) {
 function createTestInventoryLoader() {
   return (request) => testLoader(request.projectRoot);
 }
-function createDeployInventoryLoader(options) {
-  return (request) => deployLoader(request.projectRoot, {
-    revision: typeof options.revision === "function" ? options.revision() : options.revision,
-    target: options.target
-  });
-}
 
 // cli/main.ts
 var VERSION2 = CLI_VERSION;
@@ -5875,13 +5754,6 @@ function revision() {
     }
   };
 }
-function projectName() {
-  try {
-    return platform.env.get("SLEEPY_HOLLOW_PROJECT") ?? platform.cwd().split("/").filter(Boolean).pop() ?? "sleepy-hollow";
-  } catch {
-    return "sleepy-hollow";
-  }
-}
 function runCli(args, io, dependencies = {}) {
   return runCommandSurface(args, io, createCliHandlers(dependencies));
 }
@@ -5895,11 +5767,7 @@ if (process.argv[1] && import.meta.url === pathToFileURL4(process.argv[1]).href)
     stderr: console.error
   }, {
     checkInventoryLoader: createCheckInventoryLoader({ revision: revision() }),
-    testInventoryLoader: createTestInventoryLoader(),
-    deployInventoryLoader: createDeployInventoryLoader({
-      revision: revision(),
-      target: { kind: "fly", project: projectName() }
-    })
+    testInventoryLoader: createTestInventoryLoader()
   });
   platform.exit(code);
 }