@weft-js/cli 0.1.0 → 0.1.1

package/README.md

@@ -1,6 +1,6 @@
 # @weft-js/cli
 
-> **Early release (0.1.0).** APIs will change between minor versions.
+> **Early release (0.1.1).** APIs will change between minor versions.
 
 The `weft` command. It runs an app (`dev`, `build`, `start`), checks it (`check`, `tsc`, `fix`), serves its docs to people
 and agents (`docs`, `agents-md`, `mcp`) and manages plugins (`add`, `plugins`). An app made with `npm create @weft-js`

package/docs/deploy.md

@@ -0,0 +1,83 @@
+# Deploy: from `weft build` to a live URL
+
+weft reads what the app uses and says which hosts can run it, before a build and before an account exists. Then it
+writes the host's files and a workflow, and `weft deploy` runs the host's own CLI and reports the URL.
+
+```bash
+weft deploy hosts          # which hosts fit, why not, what each costs, and the suggestion
+weft deploy init           # the suggested host's files, a GitHub workflow, and `deploy` in weft.config.ts
+weft deploy                # a dry run: the build and the exact commands --yes would run
+weft deploy --yes          # a preview deploy; add --prod for production
+```
+
+`weft deploy` without `--yes` runs nothing. An agent runs the dry run on its own, and asks before `--yes`: a deploy
+publishes, and a host may bill for it. Nothing in weft creates a site, an app, a volume or a DNS record; `init` prints the
+one command per host that does, for you to run.
+
+## Which host
+
+| The app uses | Netlify / Vercel | Cloudflare | Fly / Render |
+|---|---|---|---|
+| pages, queries, mutations, forms, `stream()` | ✓ | ✓ | ✓ |
+| `channel`, `sharedState`, `realtime({ share })` | ✗ E001 | ✓ (Durable Objects) | ✓ |
+| `.live({ required })`, `remote()` sidecars | ✗ E002 | ✗ E002 | ✓ |
+| a SQLite file, media uploads | ✗ E003 | ✗ E003 | with a volume or disk (billed) |
+| `changes` without an external listener | degraded (R014) | degraded | ✓ |
+
+The suggestion: Netlify when nothing needs a server that stays up (a CDN with functions is the cheapest and fastest
+host), Cloudflare when channels are all that need one, Fly when data must last on disk, else Fly or Render.
+
+A function host blocked by a channel has a third way, the split: pages on the function host, realtime on a small server.
+It needs a second origin and a cookie both can read, and is designed (research 46 §10), not built.
+
+## `deploy` in weft.config.ts
+
+```ts
+deploy: {
+  target: 'fly',                                       // netlify | vercel | cloudflare | fly | render
+  fly: { app: 'shop', region: 'iad', volume: { name: 'data', sizeGb: 1 } },
+  ci: 'github',                                        // the workflow; false for none
+  branch: 'main',
+  cdn: { proxy: 'cloudflare', images: { provider: 'cloudinary', cloud: 'shop' } },
+}
+```
+
+Names, regions and sizes only. Every token comes from the environment, and one written into the config, a host file or a
+workflow is **E008**. With `deploy.target` set, `weft build` builds for it, and `weft check` reports E001–E003 for it.
+
+A volume or disk mounts at `/app/.data`: SQLite's default `file:.data/app.db` is already there, and uploads go to
+`.data/media` (`WEFT_MEDIA_DIR`).
+
+## What each target writes and runs
+
+| Target | Files | `weft deploy --yes` runs | Reads |
+|---|---|---|---|
+| netlify | `netlify.toml` | `weft build --preset netlify`, `netlify deploy --dir dist --functions .netlify/functions-internal --json` | `NETLIFY_AUTH_TOKEN`, `NETLIFY_SITE_ID` |
+| vercel | `vercel.json` | `weft build --preset vercel`, `vercel deploy --prebuilt` | `VERCEL_TOKEN`, `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` |
+| cloudflare | `wrangler.toml` | `weft build --preset cloudflare_durable`, `wrangler deploy` in `.output/` | `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID` |
+| fly | `fly.toml`, `Dockerfile`, `.dockerignore` | `flyctl deploy --remote-only` (Fly builds the image) | `FLY_API_TOKEN` |
+| render | `render.yaml`, `Dockerfile`, `.dockerignore` | the deploy hook (Render builds the pushed commit) | `RENDER_DEPLOY_HOOK_URL` |
+
+Every target also gets `.github/workflows/weft-deploy.yml`: on push to `branch`, install, `weft check`, then `weft deploy
+--yes --prod`; on a pull request, a preview where the host has them. Add the variables as repository secrets (`gh secret
+set NAME`). Netlify, Vercel and Cloudflare deploy what was built, so build where the host runs: the workflow builds on
+Linux, and a native addon built on a Mac is **E004**.
+
+Each written file starts with `# weft deploy init <target>, sha <hash>`. Change the config and `weft check` reports the
+file as stale (**E006**); `init` rewrites it. A file you edited keeps its old hash, and `init` leaves it alone unless
+`--force`.
+
+## CDN and media
+
+- **Cloudflare in front of a server host** (`cdn.proxy: 'cloudflare'`): proxy the domain to the Fly or Render origin.
+  Hashed assets are already `immutable`, and pages are `private` unless a route caches, so the proxy can't serve one
+  user's page to another. E010: `site.url` is still the host's own domain. E011: a proxy in front of a CDN host.
+- **Cloudinary for uploads** (`cdn.images`): checked (E012 without `@weft-js/plugin-media`, E013 without a cloud or with
+  two), not yet wired: uploads still go to the media server's disk (E014). `?media` imports never need it: the build
+  already makes sized AVIF and WebP files that any CDN serves.
+
+## Codes
+
+E001 sockets on a function host, E002 a held process or a sidecar, E003 data on a disk that doesn't last, E004 a native
+addon deployed from another OS, E005 no target (with the suggestion), E006 a stale host file, E007 an unset variable,
+E008 a written credential, E009 the memory bus on many instances, E010–E014 CDN and media. `weft docs E003` explains one.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weft-js/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The weft command: dev, build, check, the agent layer and the MCP server",
   "license": "MIT",
   "type": "module",
@@ -15,14 +15,14 @@
     "node": ">=26"
   },
   "dependencies": {
-    "@weft-js/create": "0.1.0",
+    "@weft-js/create": "0.1.1",
     "axe-core": "4.14.0",
     "typescript": "6.0.3",
     "yaml": "2.9.1",
     "zod": "4.6.7"
   },
   "peerDependencies": {
-    "@weft-js/core": "^0.1.0"
+    "@weft-js/core": "^0.1.1"
   },
   "publishConfig": {
     "access": "public"

package/src/audit.mjs

@@ -99,7 +99,8 @@ export function serveStatic(dir) {
     const missing = join(dir, '404.html')
     if (!file) {
       res.writeHead(404, { 'content-type': TYPES['.html'] })
-      return res.end(existsSync(missing) ? readFileSync(missing) : 'not found')
+      // a doctype even here: a frame showing this would put Chrome in Quirks Mode, an issue of the audit's own making
+      return res.end(existsSync(missing) ? readFileSync(missing) : '<!doctype html><title>Not found</title><p>Not found</p>')
     }
     res.writeHead(200, { 'content-type': TYPES[extname(file)] ?? 'application/octet-stream' })
     res.end(readFileSync(file))
@@ -163,6 +164,29 @@ const SHIFT = `new Promise(ok => {
   setTimeout(() => ok({ cls: Math.round(cls * 1000) / 1000, moved }), 50)
 })`
 
+/**
+ * The app's own pages as a test on a path (`src/routes`, `[id]` and `[...rest]` included). A build served as files has
+ * only its prerendered pages: a request for one of the others is the server's to answer, not a missing file.
+ */
+export function appRoutes(root) {
+  const dir = join(root, 'src', 'routes')
+  if (!existsSync(dir)) return () => false
+  const tests = []
+  const walk = (at, prefix) => {
+    for (const e of readdirSync(at, { withFileTypes: true })) {
+      const name = e.name.replace(/^\(.*\)$/, '')
+      if (e.isDirectory()) { walk(join(at, e.name), name ? `${prefix}/${name}` : prefix); continue }
+      if (!/\.[jt]sx?$/.test(e.name) || /\.(server|test|spec)\./.test(e.name) || e.name.startsWith('_')) continue
+      const leaf = e.name.replace(/\.[jt]sx?$/, '')
+      const path = leaf === 'index' ? prefix : `${prefix}/${leaf}`
+      const re = path.split('/').map(seg => (/^\[\.\.\.\w+\]$/.test(seg) ? '\0' : /^\[\w+\]$/.test(seg) ? '[^/]+' : seg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))).join('/').replace(/\/\0/g, '(?:/.+)?')
+      tests.push(new RegExp(`^${re || ''}/?$`))
+    }
+  }
+  walk(dir, '')
+  return path => tests.some(t => t.test(path))
+}
+
 /** In the page: what a crawler reads from the head, and what pokes past a phone's right edge. */
 const HEAD = `(() => {
   const meta = n => document.querySelector('meta[name="' + n + '"]')?.getAttribute('content')?.trim() ?? null
@@ -181,11 +205,12 @@ const HEAD = `(() => {
   return {
     title: document.title.trim(), lang: document.documentElement.getAttribute('lang') ?? '', description: meta('description'),
     viewport: meta('viewport'), robots: meta('robots'), scroll: document.documentElement.scrollWidth - innerWidth, wide,
+    icon: !!document.querySelector('link[rel~="icon"]'),
   }
 })()`
 
 /** Audit one page in one form factor: what Chrome said while it loaded, its head, its layout, and axe-core's rules. */
-async function auditPage(browser, url, form, statics) {
+async function auditPage(browser, url, form, statics, served) {
   const { targetId } = await browser.send('Target.createTarget', { url: 'about:blank' })
   const { sessionId } = await browser.send('Target.attachToTarget', { targetId, flatten: true })
   const send = (m, p) => browser.send(m, p, sessionId)
@@ -209,6 +234,9 @@ async function auditPage(browser, url, form, statics) {
     } else if (m.method === 'Log.entryAdded' && p.entry.level === 'error') {
       // a build's pages served as files have no server: its realtime and function routes answer 404 here and nowhere else
       if (statics && /\/_weft\/(rt|ws|fn|data|m|x)\b/.test(`${p.entry.url ?? ''} ${p.entry.text}`)) return
+      if (statics && p.entry.url && /status of 404/.test(p.entry.text) && served(new URL(p.entry.url).pathname)) return
+      // the favicon: Chrome asks for it lazily, once a session, so the head probe asks instead (below)
+      if (/\/favicon\.ico$/.test(p.entry.url ?? '')) return
       found.push({ code: 'L011', key: `${p.entry.url ?? ''} ${p.entry.text}`, at: where(p.entry.url), text: p.entry.text })
     } else if (m.method === 'Audits.issueAdded') {
       const { code, details } = p.issue
@@ -229,6 +257,10 @@ async function auditPage(browser, url, form, statics) {
     if (document && document.status >= 400) found.push({ code: 'L025', key: String(document.status), text: `HTTP ${document.status}` })
     const header = Object.entries(document?.headers ?? {}).find(([k]) => k.toLowerCase() === 'x-robots-tag')?.[1]
     const head = (await send('Runtime.evaluate', { expression: HEAD, returnByValue: true })).result.value
+    if (!head.icon) {
+      const status = (await send('Runtime.evaluate', { expression: `fetch('/favicon.ico', { method: 'HEAD' }).then(r => r.status, () => 0)`, awaitPromise: true, returnByValue: true })).result.value
+      if (status >= 400) found.push({ code: 'L011', key: 'favicon', at: '/favicon.ico', text: `HTTP ${status}` })
+    }
     if (!head.title) found.push({ code: 'L020', key: 'title' })
     if (!head.description) found.push({ code: 'L021', key: 'description' })
     if (!head.lang) found.push({ code: 'L022', key: 'lang' })
@@ -300,6 +332,7 @@ export async function audit(root, options = {}) {
     base = server.url
   }
   routes ??= ['/']
+  const served = appRoutes(root)
   const browser = await chrome(exe)
   const findings = new Map()
   try {
@@ -307,7 +340,7 @@ export async function audit(root, options = {}) {
     let i = 0
     const worker = async () => {
       for (let job; (job = jobs[i++]);) {
-        for (const f of await auditPage(browser, `${base}${job.route}`, job.form, !!server)) {
+        for (const f of await auditPage(browser, `${base}${job.route}`, job.form, !!server, served)) {
           const key = `${f.code} ${f.key}`
           const seen = findings.get(key) ?? { ...f, routes: new Set(), forms: new Set() }
           seen.routes.add(job.route)

package/src/browser/client.mjs

@@ -83,7 +83,7 @@ export async function launch(root, route = '/', { url, headed = false } = {}) {
   const base = await devUrl(root, url)
   const profile = join(root, '.weft', 'browser', 'profile')
   mkdirSync(profile, { recursive: true })
-  const args = [`--user-data-dir=${profile}`, '--remote-debugging-port=0', '--no-first-run', '--no-default-browser-check', '--disable-background-timer-throttling', '--disable-renderer-backgrounding', ...(headed ? [] : ['--headless=new']), `${base}${route.startsWith('/') ? route : `/${route}`}`]
+  const args = [`--user-data-dir=${profile}`, '--remote-debugging-port=0', '--no-first-run', '--no-default-browser-check', '--disable-background-timer-throttling', '--disable-renderer-backgrounding', ...(headed ? [] : ['--headless=new']), ...(process.getuid?.() === 0 ? ['--no-sandbox'] : []) /* Chrome won't start as root with its sandbox: a container, CI */, `${base}${route.startsWith('/') ? route : `/${route}`}`]
   const child = spawn(exe, args, { detached: true, stdio: 'ignore' })
   child.unref()
   writeFileSync(stateFile(root), JSON.stringify({ pid: child.pid, profile, exe }))

package/src/catalog.mjs

@@ -3,7 +3,7 @@
 // research 11 §8.5 and 15 §7.5 as built in research 26 §7 (Phase 2's X-codes, M001–M013), research 27 §6 (Q001–Q010,
 // server functions, and S011), research 28 §7 (Q011–Q015, the database; A001–A004, auth; C001–C002, the contract),
 // research 29 §7 (S001, S002, S012, S013, state on the server; F001–F003, forms; M016–M018, the media route), research
-// 30 §8 (W052, W053, T013, R001–R023, realtime), research 36 §8 and 39 (R101–R109, Rust), plus the codes proposed in research 17 (marked `proposed`).
+// 30 §8 (W052, W053, T013, R001–R023, realtime), research 36 §8 and 39 (R101–R109, Rust), research 46 §12 (E001–E014, deploy), plus the codes proposed in research 17 (marked `proposed`).
 //
 // W-codes come from the compiler. Each has an `example` that should trigger it; `probe()` runs the installed
 // compiler over the examples, so AGENTS.md and `docs` only claim what this weft version actually reports. T-codes
@@ -367,7 +367,24 @@ export const catalog = [
   { code: 'R021', severity: 'error', by: 'cli', catches: 'A `verify` target isn\'t available here: fails `weft build`, and `weft check` warns and skips', fix: 'Set `WEFT_STAGING_URL`, `STAGING_DATABASE_URL`, or the variable its target names' },
   { code: 'R022', severity: 'error', by: 'cli', catches: 'A `verify` target that looks like production, or that nothing marks as not: a round trip writes rows', fix: 'Name it in `live.targets` with `production: false`; a name or host that says production is always refused' },
   { code: 'R023', severity: 'warning', by: 'cli', catches: 'A `verify` passed with only one kind of target, so some links went untested', fix: 'Give it both a URL and a database' },
+  { code: 'R024', severity: 'error', by: 'cli', catches: 'A `channel` or `sharedState` built for a target that can\'t hold a WebSocket (Netlify, Vercel, AWS Lambda): `weft build` fails, and where it is let through the page never dials, the channel\'s `status` is `unavailable` and a send rejects with R024', fix: '`weft deploy hosts`, then a server host (`fly`, `render`); or `--unsafe-allow R024` with why, for a demo that may stay offline there' },
   { code: 'R018', severity: 'warning', by: 'cli', catches: 'A table in `changes` that no migration gives a change trigger (`weft check`, `weft build`): the server would fall back to polling', fix: 'Run `weft db live`' },
+  // Deploy (research 46): what a host can run, the files and env a deploy needs, CDN and media setup. `weft check` reports
+  // them for `deploy.target` (or the host `--preset` names), `weft deploy` before it builds, `weft doctor` for every host.
+  { code: 'E001', severity: 'error', by: 'cli', catches: 'A `channel`, `sharedState` or `realtime({ share })` on a deploy target that can\'t hold a WebSocket (Netlify, Vercel, AWS Lambda): the page loads and never connects (at runtime: R024)', fix: "`deploy: { target: 'fly' }` or `'render'`, `'cloudflare'` (Durable Objects), or the split: pages here, realtime on a server (`weft docs deploy`)" },
+  { code: 'E002', severity: 'error', by: 'cli', catches: 'Something that needs a process between requests on a target that keeps none: a `required` live query (R013), or a `remote()` sidecar', fix: "A server host (`fly`, `render`); for a feed, `weft db listen` on one with `listener: 'external'`; for a sidecar, deploy it on its own with `rust.services.<name>.external: true`" },
+  { code: 'E003', severity: 'error', by: 'cli', catches: 'A SQLite file or media uploads on local disk, on a target whose disk is gone after a request or a deploy, or on a server host with no volume or disk configured (a warning in `weft deploy hosts`)', fix: '`deploy.fly.volume` or `deploy.render.disk` (both billed; they mount at `/app/.data`), or a hosted database' },
+  { code: 'E004', severity: 'warning', by: 'cli', catches: 'A native npm addon (`better-sqlite3`, `sharp`, `bcrypt`…) built on this machine and deployed from here to a Linux function host', fix: "Deploy from CI (`deploy.ci: 'github'` builds on Linux), or drop the addon" },
+  { code: 'E005', severity: 'info', by: 'cli', catches: 'No `deploy.target` (`weft doctor`, `weft deploy hosts`): which hosts can run this app, and the one weft suggests', fix: '`weft deploy init <target>`' },
+  { code: 'E006', severity: 'warning', by: 'cli', catches: 'A file `weft deploy init` writes for `deploy.target` (`fly.toml`, `Dockerfile`, the workflow…) is missing, or was written from an older config', fix: '`weft deploy init` (a file edited by hand is left alone; `--force` overwrites it)' },
+  { code: 'E007', severity: 'error', by: 'cli', catches: 'A variable `weft deploy --yes` reads is unset (an error in CI or for an id the CLI can\'t find; a warning where the host CLI\'s own login stands in)', fix: "Set it in the environment, or log in with the host's CLI here. Never in a file" },
+  { code: 'E008', severity: 'error', by: 'cli', catches: "A deploy credential in a committed file: a Netlify or Fly token, a Render deploy hook, a Cloudinary URL with its secret, or a long value for a key named token, secret, api key or password, in the config, a host file or a workflow", fix: 'Move it to the environment (host settings, or GitHub secrets as `${{ secrets.NAME }}`), and rotate it' },
+  { code: 'E009', severity: 'warning', by: 'cli', catches: 'The memory bus on a target that runs many instances: a message reaches one instance\'s clients (`weft build` fails on it as R002)', fix: "`weft add redis` or `weft add nats`, `postgresBus({ url })`, or `durableObjectBus` on Cloudflare" },
+  { code: 'E010', severity: 'warning', by: 'cli', catches: '`deploy.cdn.proxy` is Cloudflare, and `site.url` is the host\'s own domain (`*.fly.dev`, `*.onrender.com`): nothing goes through the proxy', fix: 'Set `site.url` to the domain Cloudflare proxies' },
+  { code: 'E011', severity: 'warning', by: 'cli', catches: '`deploy.cdn.proxy` in front of a host that is a CDN already (Netlify, Vercel, Cloudflare): two caches, and a deploy purges only its own', fix: 'Drop `cdn.proxy`, or deploy to `fly` or `render` behind it' },
+  { code: 'E012', severity: 'error', by: 'cli', catches: '`deploy.cdn.images` is Cloudinary, and `@weft-js/plugin-media` isn\'t in `plugins`', fix: '`weft add media`, or drop `cdn.images`' },
+  { code: 'E013', severity: 'error', by: 'cli', catches: '`deploy.cdn.images` with no `cloud` and no `CLOUDINARY_URL`, or the two naming different clouds (a warning when only the env var is unset, at a deploy)', fix: "Set `cdn.images.cloud`, and `CLOUDINARY_URL` in the host's environment" },
+  { code: 'E014', severity: 'info', by: 'cli', catches: '`deploy.cdn.images` is checked, and this weft doesn\'t send uploads to Cloudinary yet: they go to `media({ server: { dir } })`', fix: 'Nothing yet (research 46 §9); on a function host, uploads need a server host with a disk (E003)' },
   { code: 'R101', severity: 'error', by: 'cli', catches: 'A function with `impl` has no `output`, a type JSON can\'t carry (`z.date()`, `z.bigint()`, `z.void()`, `z.custom()`), or a one-way `.transform()` on its input (`weft build`, `weft check`, `weft dev`)', fix: 'Use a codec: `z.codec(z.iso.datetime(), z.date(), { decode, encode })`. `z.null()` says a function returns nothing' },
   { code: 'R102', severity: 'error', by: 'cli', catches: 'A plain `z.union` of objects in a function with `impl`: it has no tag, so Rust can\'t tell its arms apart reliably. Scalar unions and `.nullable()` are fine', fix: "Use `z.discriminatedUnion`, or set `rust: { unions: 'allow' }`" },
   { code: 'R103', severity: 'error', by: 'cli', catches: 'A sidecar doesn\'t match the contract: cargo stops where a generated type or method no longer fits (with the function\'s id), a binary built from another contract, an output the `output` schema rejects, or input serde refuses', fix: 'Fix the Rust to fit the TS declaration, which is the source of truth; `.weft/rust/<service>.rs` shows what\'s generated' },

package/src/check.mjs

@@ -26,6 +26,7 @@ import { textChecks } from './text-checks.mjs'
 import { loadCompiler, resolveWeft } from './weft.mjs'
 import { dbLayer } from './db-layer.mjs'
 import { routeDiagnostics, schemaHash, siteOf, start } from './start.mjs'
+import { deployChecks } from './deploy/index.mjs'
 
 const posix = p => p.split('\\').join('/')
 
@@ -161,6 +162,7 @@ export async function check(root, options = {}) {
     ...schemaDrift(root, await dbLayer(root, loaded)),
     ...(await rustChecks(root, loaded)),
     ...(await liveChecks(root, loaded, options.preset)),
+    ...(loaded.diagnostics.some(d => d.code === 'P007') ? [] : deployChecks(root, config, { preset: options.preset })),
   ]
   diagnostics.push(...await routeChecks(root, loaded, given, new Set(loaded.diagnostics.map(d => d.code))))
   sortDiagnostics(diagnostics)

package/src/cli.mjs

@@ -24,7 +24,8 @@ import { formatGate, gate } from './gate.mjs'
 import { browserCommand } from './browser/cli.mjs'
 import { metaTable } from './meta-table.mjs'
 import { audit } from './audit.mjs'
-import { buildCommand, dbCommand, devCommand, doctorCommand, routesCommand, startCommand } from './start.mjs'
+import { buildCommand, dbCommand, devCommand, doctorCommand, routesCommand, startCommand, unsafeAllowed } from './start.mjs'
+import { deployCommand, formatHosts, hostsCommand, initCommand } from './deploy/index.mjs'
 import { explainTarget, findGroups, formatExplain, formatFind, styleMatrix, writeMatrixFile } from './style.mjs'
 
 const usage = `usage: weft <command> [--json] [--root <dir>]
@@ -44,6 +45,11 @@ const usage = `usage: weft <command> [--json] [--root <dir>]
                       [--unsafe-allow <codes>]  go past these codes (R002, L003, a family like L, or all): forces a deploy
   audit [routes…] [--url <u>] [--all] [--max <n>]  the built pages, or a running site, in a clean Chrome at a phone's
                       and a desktop's width: axe-core's WCAG rules, console, deprecations, head, sideways scroll, shift
+  deploy [--prod] [--yes] [--target t]  fit check, build for the target, then the host's own CLI; without --yes a dry
+                      run that prints what would run. Netlify, Vercel, Cloudflare, Fly, Render; the live URL at the end
+  deploy hosts        which hosts can run this app, why not, what each costs, and the one weft suggests
+  deploy init [target] [--dry-run] [--force]  the host's files (netlify.toml, fly.toml + Dockerfile…), a GitHub
+                      workflow that checks and deploys on push, and \`deploy\` in the config
   start [--runtime r] run .output/ on its runtime (the config's \`runtime\`, node by default)
   db generate [name]  a migration for the schema's changes (it applies on the next request)
   db live             a migration with change triggers for the tables in \`changes\`
@@ -67,10 +73,10 @@ const usage = `usage: weft <command> [--json] [--root <dir>]
   mcp                 MCP server on stdio: docs, check, tasks, style_find, style_explain, test_gate, browser_*`
 
 /** Flags that take a value (`--base main` or `--base=main`), and boolean flags, beyond the global ones. */
-const valued = new Set(['layer', 'base', 'budget', 'max-mutants', 'concurrency', 'url', 'tab', 'out', 'component', 'from', 'props', 'name', 'scope', 'timeout', 'preset', 'port', 'runtime', 'unsafe-allow', 'max'])
+const valued = new Set(['layer', 'base', 'budget', 'max-mutants', 'concurrency', 'url', 'tab', 'out', 'component', 'from', 'props', 'name', 'scope', 'timeout', 'preset', 'port', 'runtime', 'unsafe-allow', 'max', 'target'])
 /** `weft style explain` takes the group's own axes as flags (`--status late`); these are its fixed ones. */
 const styleFlags = new Set(['states', 'accent', 'part'])
-const booleans = new Set(['dry-run', 'no-install', 'remote', 'gate', 'refactor', 'no-mutation', 'interactive', 'delta', 'graph-only', 'no-graph', 'headed', 'full', 'reload', 'meta', 'all', 'verbose'])
+const booleans = new Set(['dry-run', 'no-install', 'remote', 'gate', 'refactor', 'no-mutation', 'interactive', 'delta', 'graph-only', 'no-graph', 'headed', 'full', 'reload', 'meta', 'all', 'verbose', 'prod', 'yes', 'force'])
 
 export function parse(argv) {
   const out = { command: argv[0], positional: [], json: false, root: process.cwd(), check: false, stdout: false, flags: {} }
@@ -125,8 +131,9 @@ export async function main(argv, io = { stdout: process.stdout, stderr: process.
         // What this install compiles with, always; what live data does on the target, for an app that has any.
         const result = doctor(args.root)
         const plan = args.flags.preset || existsSync(join(args.root, 'src/realtime.server.ts')) ? await doctorCommand(args.root, { preset: args.flags.preset, runtime: args.flags.runtime }) : undefined
-        if (args.json) print({ ...result, live: plan })
-        else say(formatDoctor(result))
+        const hosts = hostsCommand(args.root, (await loadConfig(args.root)).config)
+        if (args.json) print({ ...result, live: plan, deploy: hosts })
+        else say(`${formatDoctor(result)}\n\nweft doctor: deploy${hosts.target ? ` (target ${hosts.target})` : ''}\n${formatHosts(hosts).replace(/^/gm, '  ')}`)
         if (!plan) return 0
         say(`weft doctor: ${plan.preset} (${plan.host})\n  live mode: ${plan.mode}\n  ${plan.says}${plan.required.length ? `\n  required: ${plan.required.join(', ')}` : ''}${plan.options.length ? `\n  options:\n${plan.options.map(o => `    - ${o}`).join('\n')}` : ''}`)
         say(formatHuman(plan.diagnostics))
@@ -169,6 +176,31 @@ export async function main(argv, io = { stdout: process.stdout, stderr: process.
         say(`weft audit: ${result.skipped ?? `${result.pages.length} pages at a phone's and a desktop's width, ${result.diagnostics.length} findings (${result.ms} ms)`}`)
         return result.ok ? 0 : 1
       }
+      case 'deploy': {
+        const loaded = await loadConfig(args.root)
+        const sub = args.positional[0]
+        if (sub === 'hosts') {
+          const result = hostsCommand(args.root, loaded.config)
+          if (args.json) print(result)
+          else say(formatHosts(result))
+          return 0
+        }
+        const unsafe = unsafeAllowed(args.flags['unsafe-allow'], loaded.config)
+        if (sub === 'init') {
+          const result = initCommand(args.root, loaded.config, { target: args.positional[1] ?? args.flags.target, dryRun: !!args.flags['dry-run'], force: !!args.flags.force, unsafe })
+          if (args.json) print(result)
+          say(formatHuman(result.findings))
+          say([`weft deploy init ${result.target}${result.dryRun ? ' (dry run: nothing written)' : ''}:`, ...result.actions.map(a => `  ${a}`), '', 'then, once:', ...result.next.map(n => `  ${n}`)].join('\n'))
+          return 0
+        }
+        if (sub !== undefined) throw Object.assign(new Error(`weft deploy ${sub}: use \`weft deploy\`, \`weft deploy hosts\` or \`weft deploy init [target]\``), { code: 'E_USAGE' })
+        const result = await deployCommand(args.root, loaded.config, { target: args.flags.target, prod: !!args.flags.prod, yes: !!args.flags.yes, unsafe, build: (root, o) => buildCommand(root, { ...o, unsafeAllow: args.flags['unsafe-allow'] }) })
+        if (args.json) print(result)
+        say(formatHuman(result.diagnostics))
+        if (result.dryRun) say([`weft deploy: a dry run for ${result.target}${result.prod ? ' (production)' : ' (a preview)'}. With --yes it runs:`, ...result.steps.map(s => `  ${s.what}${s.reads.length ? `\n      reads ${s.reads.join(', ')} from the environment` : ''}`)].join('\n'))
+        else say(`weft deploy: ${result.target}${result.prod ? ' (production)' : ''} → ${result.url ?? 'deployed; the host printed no URL'}`)
+        return 0
+      }
       case 'start':
         return await startCommand(args.root, { runtime: args.flags.runtime })
       case 'db': {

package/src/deploy/cdn.mjs

@@ -0,0 +1,64 @@
+// What a half-set-up deploy looks like, without touching a provider (research 46 §8, §9): a credential written into a
+// file (E008), Cloudflare in front of nothing or in front of a CDN (E010, E011), and Cloudinary without what it needs
+// (E012–E014).
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { host } from './hosts.mjs'
+
+/** Credentials with a shape of their own, and a value assigned to a key that names one. */
+const SHAPED = [
+  [/\bnfp_[A-Za-z0-9]{20,}/, 'a Netlify token'],
+  [/\bFlyV1\s+fm\d_[A-Za-z0-9+/=_-]{20,}/, 'a Fly token'],
+  [/api\.render\.com\/deploy\/srv-[\w-]+\?key=[\w-]+/, 'a Render deploy hook (its key deploys the service)'],
+  [/cloudinary:\/\/\d+:[^@\s'"]+@/, 'a Cloudinary URL with its secret'],
+]
+const KEYED = /\b[\w-]*(token|secret|api[_-]?key|password)[\w-]*["']?\s*[:=]\s*["']([^"'\s$]{16,})["']/i
+
+const FILES = ['weft.config.ts', 'weft.config.mts', 'weft.config.js', 'weft.config.mjs', 'weft.config.json', 'weft.config.yaml', 'weft.config.yml', 'netlify.toml', 'vercel.json', 'wrangler.toml', 'fly.toml', 'render.yaml', 'Dockerfile']
+
+/** E008: a credential in a file that gets committed, comments included. An env var's name, or `${{ secrets.X }}`, is never one. */
+export function writtenSecrets(root) {
+  const out = []
+  const wf = join(root, '.github/workflows')
+  const files = [...FILES, ...(existsSync(wf) ? readdirSync(wf).filter(f => /\.ya?ml$/.test(f)).map(f => `.github/workflows/${f}`) : [])]
+  for (const file of files) {
+    let text
+    try { text = readFileSync(join(root, file), 'utf8') } catch { continue }
+    text.split('\n').forEach((line, i) => {
+      const shaped = SHAPED.find(([re]) => re.test(line))
+      const keyed = !shaped && KEYED.exec(line)
+      if (shaped || keyed) out.push({ file, line: i + 1, what: shaped ? shaped[1] : `a value for \`${keyed[0].split(/["':=\s]/)[0]}\`` })
+    })
+  }
+  return out
+}
+
+/** Hosts whose own domain says the proxy isn't in front. */
+const OWN = /\.(fly\.dev|onrender\.com|netlify\.app|vercel\.app|workers\.dev|pages\.dev)$/
+
+/** E010–E014 from the config, and the environment when `env` is given (a deploy or `weft doctor`). */
+export function cdnFindings(config = {}, { env } = {}) {
+  const out = []
+  const cdn = config.deploy?.cdn ?? {}
+  const target = config.deploy?.target && host(config.deploy.target)
+  const add = (code, severity, why, fix) => out.push({ code, severity, file: 'weft.config.ts', why, fix })
+  if (cdn.proxy === 'cloudflare') {
+    let url
+    try { url = config.site?.url && new URL(config.site.url).hostname } catch {}
+    if (url && OWN.test(url)) add('E010', 'warning', `\`deploy.cdn.proxy\` is Cloudflare, and \`site.url\` is \`${url}\`, the host's own domain: nothing goes through the proxy, and canonical URLs point past it`, 'Set `site.url` to the domain Cloudflare proxies, with its DNS record proxied (orange cloud) to the host')
+    if (target && target.kind !== 'server') add('E011', 'warning', `\`deploy.cdn.proxy\` puts Cloudflare in front of ${target.name}, which is a CDN already: two caches, and a deploy purges only its own`, 'Drop `cdn.proxy`, or deploy to a server host (`fly`, `render`) behind it')
+  }
+  const images = cdn.images
+  if (images?.provider === 'cloudinary') {
+    const plugins = (config.plugins ?? []).map(p => p?.name ?? p)
+    if (!plugins.some(n => typeof n === 'string' && n.includes('plugin-media'))) add('E012', 'error', '`deploy.cdn.images` is Cloudinary, and `@weft-js/plugin-media` is not in `plugins`: nothing would send it an image', '`weft add media`, or drop `cdn.images`')
+    const given = env?.CLOUDINARY_URL
+    const cloud = given && /@([\w-]+)\/?$/.exec(given)?.[1]
+    if (!images.cloud && !given) add('E013', 'error', '`deploy.cdn.images` names no `cloud`, and `CLOUDINARY_URL` is unset: there is no account to send images to', "Set `cdn.images.cloud` to the cloud's name, and `CLOUDINARY_URL` in the host's environment (never in a file)")
+    else if (cloud && images.cloud && cloud !== images.cloud) add('E013', 'error', `\`cdn.images.cloud\` is \`${images.cloud}\`, and \`CLOUDINARY_URL\` here names \`${cloud}\`: one of them is another account`, 'Make them name the same cloud')
+    else if (env && !given) add('E013', 'warning', '`CLOUDINARY_URL` is unset here: the server needs it in the host\'s environment', 'Set it in the host\'s environment settings, never in a file')
+    add('E014', 'info', '`cdn.images` is checked, but this weft doesn\'t send uploads to Cloudinary yet: they still go to `media({ server: { dir } })`', 'Nothing yet: research 46 §9 is the plan. On a function host, uploads need a server host with a disk until then (E003)')
+  }
+  return out
+}

package/src/deploy/files.mjs

@@ -0,0 +1,187 @@
+// The files a host needs, written by `weft deploy init` and compared by `weft check` (research 46 §7). Each text file
+// starts with `# weft deploy init <target>, sha <hash>`, the hash of what follows: a matching hash that differs from what
+// init writes now is stale (E006), and a hash that doesn't match was edited by hand, so weft leaves it alone.
+
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { host, presetFor } from './hosts.mjs'
+
+/** The lockfile's manager: how the image and the workflow install. */
+const MANAGERS = [
+  ['pnpm-lock.yaml', { name: 'pnpm', install: 'corepack enable && pnpm install --frozen-lockfile', x: 'pnpm exec', cache: 'pnpm' }],
+  ['yarn.lock', { name: 'yarn', install: 'corepack enable && yarn install --immutable', x: 'yarn', cache: 'yarn' }],
+  ['bun.lock', { name: 'bun', install: 'bun install --frozen-lockfile', x: 'bunx', cache: '' }],
+  ['package-lock.json', { name: 'npm', install: 'npm ci', x: 'npx', cache: 'npm' }],
+]
+export const managerOf = root => (MANAGERS.find(([lock]) => existsSync(join(root, lock))) ?? [null, { name: 'npm', install: 'npm install', x: 'npx', cache: '' }])[1]
+
+/** Where a server host keeps what must last: SQLite's default `file:.data/app.db` lands on it unchanged. */
+export const DATA = '/app/.data'
+
+const sha = body => createHash('sha256').update(body).digest('hex').slice(0, 12)
+const stamp = (target, body) => `# weft deploy init ${target}, sha ${sha(body)}\n${body}`
+const STAMP = /^# weft deploy init (\w+), sha ([0-9a-f]{12})\n/
+
+const IMAGES = { node: 'node:26-slim', bun: 'oven/bun:1-slim', deno: 'denoland/deno:latest' }
+const RUN = { node: '["node", ".output/server/index.mjs"]', bun: '["bun", "run", ".output/server/index.mjs"]', deno: '["deno", "run", "-A", ".output/server/index.mjs"]' }
+
+/** A two-stage image: build with the lockfile's manager, run the server. A sidecar needs cargo to build and `weft start` to run. */
+function dockerfile({ runtime, manager, needs }) {
+  const rust = needs.sidecar || needs.native
+  const lines = [
+    `FROM ${IMAGES.node} AS build`,
+    'WORKDIR /app',
+    ...(rust ? ['RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates build-essential && curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal', 'ENV PATH=/root/.cargo/bin:$PATH'] : []),
+    'COPY . .',
+    `RUN ${manager.install}`,
+    `RUN ${manager.x} weft build --preset ${presetFor({}, runtime)}`,
+    '',
+    `FROM ${needs.sidecar ? IMAGES.node : IMAGES[runtime] ?? IMAGES.node}`,
+    'WORKDIR /app',
+    'ENV NODE_ENV=production HOST=0.0.0.0 PORT=8080',
+    // `weft start` runs each sidecar next to the server; without one the server is all there is
+    ...(needs.sidecar ? ['COPY --from=build /app ./', 'EXPOSE 8080', `CMD ["${manager.x.split(' ')[0]}", ${manager.x.includes(' ') ? `"${manager.x.split(' ')[1]}", ` : ''}"weft", "start"]`] : ['COPY --from=build /app/.output ./.output', 'EXPOSE 8080', `CMD ${RUN[runtime] ?? RUN.node}`]),
+  ]
+  return `${lines.join('\n')}\n`
+}
+
+const DOCKERIGNORE = 'node_modules\n.output\n.weft/*\n!.weft/plugins.lock.json\n.env\n.env.*\n.git\n.netlify\n.vercel\ntarget\n'
+
+function flyToml({ deploy, needs }) {
+  const fly = deploy.fly ?? {}
+  const held = needs.required || needs.feed || needs.sidecar
+  const lines = [
+    `app = ${JSON.stringify(fly.app ?? 'my-app')}`,
+    `primary_region = ${JSON.stringify(fly.region ?? 'iad')}`,
+    '',
+    '[env]',
+    '  PORT = "8080"',
+    ...(needs.uploads && fly.volume ? [`  WEFT_MEDIA_DIR = "${fly.volume.path ?? DATA}/media"`] : []),
+    '',
+    '[http_service]',
+    '  internal_port = 8080',
+    '  force_https = true',
+    '  auto_stop_machines = "stop"',
+    '  auto_start_machines = true',
+    // a change feed is a listener: a stopped machine hears nothing
+    `  min_machines_running = ${held ? 1 : 0}`,
+    ...(fly.volume ? ['', '[[mounts]]', `  source = ${JSON.stringify(fly.volume.name ?? 'data')}`, `  destination = ${JSON.stringify(fly.volume.path ?? DATA)}`, `  initial_size = "${fly.volume.sizeGb ?? 1}gb"`] : []),
+    '',
+    '[[vm]]',
+    `  memory = ${JSON.stringify(fly.memory ?? '512mb')}`,
+  ]
+  return `${lines.join('\n')}\n`
+}
+
+function renderYaml({ deploy, needs }) {
+  const r = deploy.render ?? {}
+  const lines = [
+    'services:',
+    '  - type: web',
+    `    name: ${r.service ?? 'my-app'}`,
+    '    runtime: docker',
+    `    plan: ${r.plan ?? (r.disk ? 'starter' : 'free')}`,
+    `    region: ${r.region ?? 'oregon'}`,
+    // the workflow deploys once `weft check` passes, through the deploy hook
+    '    autoDeploy: false',
+    '    healthCheckPath: /',
+    '    envVars:',
+    '      - key: NODE_ENV',
+    '        value: production',
+    ...(needs.uploads && r.disk ? ['      - key: WEFT_MEDIA_DIR', `        value: ${r.disk.path ?? DATA}/media`] : []),
+    ...(r.disk ? ['    disk:', '      name: data', `      mountPath: ${r.disk.path ?? DATA}`, `      sizeGB: ${r.disk.sizeGb ?? 1}`] : []),
+  ]
+  return `${lines.join('\n')}\n`
+}
+
+const netlifyToml = ({ manager }) => `[build]\n  command = "${manager.x} weft build --preset netlify"\n  publish = "dist"\n\n[build.environment]\n  NODE_VERSION = "26"\n`
+
+const vercelJson = ({ manager }) => `${JSON.stringify({ $schema: 'https://openapi.vercel.sh/vercel.json', framework: null, installCommand: manager.install.replace(/^corepack enable && /, ''), buildCommand: `${manager.x} weft build --preset vercel` }, null, 2)}\n`
+
+const wranglerToml = ({ deploy }) => `name = ${JSON.stringify(deploy.cloudflare?.name ?? 'my-app')}\ncompatibility_flags = ["nodejs_compat"]\n`
+
+/** The workflow: on push to the branch, check and deploy to production; on a pull request, a preview where the host has one. */
+function workflow({ target, deploy, manager }) {
+  const h = host(target)
+  const previews = h.kind !== 'server'
+  const node = manager.name === 'bun' ? ['      - uses: oven-sh/setup-bun@v2'] : ['      - uses: actions/setup-node@v4', '        with:', '          node-version: 26', ...(manager.cache ? [`          cache: ${manager.cache}`] : [])]
+  const lines = [
+    'name: weft deploy',
+    'on:',
+    '  push:',
+    `    branches: [${deploy.branch ?? 'main'}]`,
+    ...(previews ? ['  pull_request:'] : []),
+    'permissions:',
+    '  contents: read',
+    'concurrency:',
+    '  group: weft-deploy-${{ github.ref }}',
+    '  cancel-in-progress: true',
+    'jobs:',
+    '  deploy:',
+    '    runs-on: ubuntu-latest',
+    '    steps:',
+    '      - uses: actions/checkout@v4',
+    ...node,
+    ...(target === 'fly' ? ['      - uses: superfly/flyctl-actions/setup-flyctl@master'] : []),
+    `      - run: ${manager.install}`,
+    `      - run: ${manager.x} weft check`,
+    `      - run: ${manager.x} weft deploy --yes${previews ? " ${{ github.event_name == 'push' && '--prod' || '' }}" : ' --prod'}`,
+    '        env:',
+    ...h.env.map(k => `          ${k}: \${{ secrets.${k} }}`),
+  ]
+  return `${lines.join('\n')}\n`
+}
+
+const WORKFLOW = '.github/workflows/weft-deploy.yml'
+
+/**
+ * What `weft deploy init <target>` writes, as `{ path, text }`, every text one stamped.
+ * @param {{ target: string, deploy: any, needs: any, runtime: string, manager: any }} ctx
+ */
+export function filesFor(ctx) {
+  const { target } = ctx
+  const out = []
+  const text = (path, body) => out.push({ path, text: stamp(target, body) })
+  if (target === 'netlify') text('netlify.toml', netlifyToml(ctx))
+  if (target === 'vercel') out.push({ path: 'vercel.json', text: vercelJson(ctx), json: true })
+  if (target === 'cloudflare') text('wrangler.toml', wranglerToml(ctx))
+  if (target === 'fly') text('fly.toml', flyToml(ctx))
+  if (target === 'render') text('render.yaml', renderYaml(ctx))
+  if (target === 'fly' || target === 'render') {
+    text('Dockerfile', dockerfile(ctx))
+    out.push({ path: '.dockerignore', text: DOCKERIGNORE, plain: true })
+  }
+  if ((ctx.deploy.ci ?? 'github') === 'github') text(WORKFLOW, workflow(ctx))
+  return out
+}
+
+/**
+ * Each generated file's state: `missing`, `current`, `stale` (weft's, from an older config), `edited` (by hand: left
+ * alone), or `foreign` (no stamp: not weft's).
+ */
+export function fileStates(root, files) {
+  return files.map(f => {
+    const abs = join(root, f.path)
+    if (!existsSync(abs)) return { ...f, state: 'missing' }
+    const now = readFileSync(abs, 'utf8')
+    if (now === f.text) return { ...f, state: 'current' }
+    if (f.json) return { ...f, state: JSON.parse(now || '{}').buildCommand?.includes('weft build --preset vercel') ? 'edited' : 'stale' }
+    if (f.plain) return { ...f, state: 'edited' }
+    const m = STAMP.exec(now)
+    if (!m) return { ...f, state: 'foreign' }
+    return { ...f, state: sha(now.slice(m[0].length)) === m[2] ? 'stale' : 'edited' }
+  })
+}
+
+/** Write what's missing or stale. Never a file weft didn't write, or one edited since. */
+export function writeFiles(root, states, { force = false } = {}) {
+  const written = []
+  for (const f of states) {
+    if (f.state === 'current' || (!force && (f.state === 'edited' || f.state === 'foreign'))) continue
+    mkdirSync(dirname(join(root, f.path)), { recursive: true })
+    writeFileSync(join(root, f.path), f.text)
+    written.push(f.path)
+  }
+  return written
+}

package/src/deploy/fit.mjs

@@ -0,0 +1,62 @@
+// Which hosts can run an app, and which one to suggest (research 46 §4). A finding is a need the host can't meet: an
+// error when nothing on that host fixes it, a warning when it runs degraded or needs a paid add-on.
+
+import { HOSTS } from './hosts.mjs'
+
+const SERVERS = "`deploy: { target: 'fly' }` or `'render'`: a server that stays up"
+const SPLIT = 'or keep the pages here and run realtime on a small server (the split, `weft docs deploy`)'
+
+/** What a disk need asks of a host, with the config that gives it one. */
+function disk(h, need, cfg = {}, assume) {
+  if (h.disk === 'none') return { severity: 'error', fix: need.what === 'a SQLite file' ? `${SERVERS}, with a volume or disk, or a hosted database here (Postgres on Neon or Supabase, Turso for SQLite)` : `${SERVERS}, with a volume or disk: this weft has no object store for uploads yet (research 46 §9)` }
+  const has = h.id === 'fly' ? cfg.fly?.volume : cfg.render?.disk
+  if (has) return
+  const add = h.id === 'fly' ? "`deploy.fly.volume: { name: 'data', sizeGb: 1 }` (billed)" : "`deploy.render.disk: { sizeGb: 1 }` (a paid plan)"
+  return { severity: assume ? 'warning' : 'error', fix: `add ${add}: it mounts at \`/app/.data\`, where SQLite's default \`file:.data/app.db\` already is, and uploads go to \`.data/media\`` }
+}
+
+/**
+ * @param {ReturnType<import('./needs.mjs').needsOf>} needs
+ * @param {import('./hosts.mjs').Host} h
+ * @param {{ deploy?: any, assume?: boolean, local?: boolean }} [options] `assume`: a paid add-on is a warning (the hosts list,
+ *   before a target is chosen). `local`: the build is deployed from this machine.
+ * @returns {{ host: string, fits: boolean, findings: { code: string, severity: string, file: string, why: string, fix: string }[] }}
+ */
+export function fit(needs, h, { deploy = {}, assume = false, local = false } = {}) {
+  const findings = []
+  const add = (code, severity, need, why, fix) => findings.push({ code, severity, file: need.file, why, fix })
+  if (needs.sockets && !h.sockets) add('E001', 'error', needs.sockets, `${needs.sockets.what} holds a WebSocket, and ${h.name} ends each process with its request: the page would load and never connect (R024)`, `${SERVERS}, or \`'cloudflare'\` (Durable Objects), ${SPLIT}`)
+  if (needs.required && !h.held) add('E002', 'error', needs.required, `${needs.required.what} needs a change feed that stays connected, and ${h.name} keeps no process between requests (R013)`, `${SERVERS}, run \`weft db listen\` on one with \`listener: 'external'\`, or drop \`required\``)
+  if (needs.sidecar && !h.sidecars) add('E002', 'error', needs.sidecar, `${needs.sidecar.what} is a second process next to the server, and ${h.name} runs only the server`, `${SERVERS} (the image runs both), or deploy the sidecar on its own and set \`rust.services.<name>.external: true\` with its \`WEFT_RUST_<NAME>_URL\``)
+  if (needs.native && h.kind === 'workers') add('R104', 'error', needs.native, `${needs.native.what} loads an addon or a \`.wasm\` file, and ${h.name} has no file system`, "use `remote()`, or a server host")
+  for (const key of ['sqlite', 'uploads']) {
+    const need = needs[key]
+    const d = need && disk(h, need, deploy, assume)
+    if (d) add('E003', d.severity, need, `${need.what} is kept on local disk, and ${h.disk === 'none' ? `${h.name}'s disk is gone after each request` : `${h.name} wipes it on each deploy without one`}`, d.fix)
+  }
+  if (needs.feed && !h.held) add('R014', 'warning', needs.feed, `${needs.feed.what} needs a process that stays up: on ${h.name}, writes from outside the app won't reach \`.live()\``, `${SERVERS}, or \`weft db listen\` on one with \`listener: 'external'\``)
+  if (needs.memoryBus && h.many) add('E009', 'warning', needs.memoryBus, `${needs.memoryBus.what} reaches the clients of one instance, and ${h.name} runs many`, h.id === 'cloudflare' ? '`durableObjectBus` in `src/realtime.server.ts`' : '`weft add redis` or `weft add nats`, or `postgresBus({ url })` in `src/realtime.server.ts`')
+  if (needs.addons && local && h.prebuilt && process.platform !== 'linux') add('E004', 'warning', needs.addons, `${needs.addons.what} has a compiled addon, built here for ${process.platform}, and ${h.name} runs Linux`, 'deploy from CI (`deploy.ci: \'github\'` builds on Linux), or drop the addon')
+  return { host: h.id, fits: !findings.some(f => f.severity === 'error'), findings }
+}
+
+/** Every host, fitted, and the one to suggest (research 46 §4), with why. */
+export function hostsReport(needs, { deploy = {} } = {}) {
+  const fits = HOSTS.map(h => ({ ...fit(needs, h, { deploy, assume: true }), name: h.name, kind: h.kind, cost: h.cost, pricing: h.pricing, deploys: h.deploys }))
+  return { fits, suggestion: suggest(needs, fits) }
+}
+
+/** @returns {{ host: string, why: string, alternative?: string }} */
+export function suggest(needs, fits = HOSTS.map(h => fit(needs, h, { assume: true }))) {
+  const ok = id => fits.find(f => f.host === id)?.fits
+  const clean = id => ok(id) && !fits.find(f => f.host === id).findings.length
+  const held = needs.required || needs.sidecar || needs.feed
+  const kept = needs.sqlite || needs.uploads
+  if (!needs.sockets && !held && !kept) {
+    if (clean('netlify')) return { host: 'netlify', why: 'nothing here needs a server that stays up: a CDN with functions behind it is the cheapest and fastest host', alternative: 'vercel' }
+    if (ok('netlify')) return { host: 'netlify', why: 'nothing here needs a server that stays up, once the warnings are fixed', alternative: 'vercel' }
+  }
+  if (needs.sockets && !held && !kept && !needs.native && clean('cloudflare')) return { host: 'cloudflare', why: 'channels need a socket, and a Durable Object holds one for each room without a server to run', alternative: 'fly' }
+  if (kept) return { host: 'fly', why: `${kept.what} needs a disk that lasts: a Fly volume is per machine and cheap`, alternative: 'render' }
+  return { host: 'fly', why: `${(needs.sockets ?? held).what} needs a server that stays up, and Fly runs the app as it is. Render's free instance does too, but sleeps after 15 idle minutes`, alternative: 'render' }
+}

package/src/deploy/hosts.mjs

@@ -0,0 +1,56 @@
+// The hosts `weft deploy` knows (research 46 §3): what each can run, its preset, what its CLI reads, and a cost hint.
+// The fit (fit.mjs) and the generated files (files.mjs) both read this table, so they can't disagree about a host.
+
+/**
+ * @typedef {{
+ *   id: string, name: string, kind: 'functions' | 'workers' | 'server',
+ *   preset?: string, sockets: boolean, held: boolean, disk: 'none' | 'volume' | 'paid-disk', sidecars: boolean,
+ *   many: boolean, prebuilt: boolean, env: string[], cost: string, pricing: string, docs: string, deploys: boolean,
+ * }} Host
+ * `preset`: the Nitro preset, or none for the runtime's server preset. `prebuilt`: what is built here is what ships, so a
+ * native addon from this machine goes too. `deploys`: `weft deploy` drives it (AWS is a fit only, research 46 §11).
+ */
+
+/** @type {Host[]} */
+export const HOSTS = [
+  {
+    id: 'netlify', name: 'Netlify', kind: 'functions', preset: 'netlify', sockets: false, held: false, disk: 'none', sidecars: false, many: true, prebuilt: true,
+    env: ['NETLIFY_AUTH_TOKEN', 'NETLIFY_SITE_ID'], deploys: true,
+    cost: 'free tier; usage past it is billed in credits', pricing: 'https://www.netlify.com/pricing/', docs: 'https://docs.netlify.com/cli/get-started/',
+  },
+  {
+    id: 'vercel', name: 'Vercel', kind: 'functions', preset: 'vercel', sockets: false, held: false, disk: 'none', sidecars: false, many: true, prebuilt: true,
+    env: ['VERCEL_TOKEN', 'VERCEL_ORG_ID', 'VERCEL_PROJECT_ID'], deploys: true,
+    cost: 'Hobby is free for non-commercial use; Pro is per seat', pricing: 'https://vercel.com/pricing', docs: 'https://vercel.com/docs/cli',
+  },
+  {
+    id: 'cloudflare', name: 'Cloudflare Workers', kind: 'workers', preset: 'cloudflare_durable', sockets: true, held: false, disk: 'none', sidecars: false, many: true, prebuilt: true,
+    env: ['CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_ACCOUNT_ID'], deploys: true,
+    cost: 'free tier includes Workers and SQLite-backed Durable Objects', pricing: 'https://developers.cloudflare.com/workers/platform/pricing/', docs: 'https://developers.cloudflare.com/workers/wrangler/',
+  },
+  {
+    id: 'fly', name: 'Fly.io', kind: 'server', sockets: true, held: true, disk: 'volume', sidecars: true, many: false, prebuilt: false,
+    env: ['FLY_API_TOKEN'], deploys: true,
+    cost: 'pay as you go, no free tier for new organizations', pricing: 'https://fly.io/docs/about/pricing/', docs: 'https://fly.io/docs/flyctl/',
+  },
+  {
+    id: 'render', name: 'Render', kind: 'server', sockets: true, held: true, disk: 'paid-disk', sidecars: true, many: false, prebuilt: false,
+    env: ['RENDER_DEPLOY_HOOK_URL'], deploys: true,
+    cost: 'free instance sleeps after 15 idle minutes and has no disk; paid plans add a disk', pricing: 'https://render.com/pricing', docs: 'https://render.com/docs/blueprint-spec',
+  },
+  {
+    id: 'aws', name: 'AWS Lambda', kind: 'functions', preset: 'aws_lambda', sockets: false, held: false, disk: 'none', sidecars: false, many: true, prebuilt: true,
+    env: [], deploys: false,
+    cost: 'Lambda has a free tier; a server would go on App Runner, billed per running instance', pricing: 'https://aws.amazon.com/pricing/', docs: 'https://nitro.build/deploy/providers/aws',
+  },
+]
+
+export const TARGETS = HOSTS.filter(h => h.deploys).map(h => h.id)
+
+export const host = id => HOSTS.find(h => h.id === id)
+
+/** `runtime` in the config as the server preset a container runs. */
+const SERVER_PRESETS = { node: 'node', bun: 'bun', deno: 'deno_server' }
+
+/** The preset a build for this host uses. */
+export const presetFor = (h, runtime = 'node') => h.preset ?? SERVER_PRESETS[runtime] ?? 'node'

package/src/deploy/index.mjs

@@ -0,0 +1,273 @@
+// `weft deploy`, `weft deploy hosts`, `weft deploy init`, and what `weft check` and `weft doctor` say about the deploy
+// (research 46). Nothing here talks to a provider except `weft deploy --yes`, which runs the host's own CLI.
+
+import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import ts from 'typescript'
+import { diagnostic, locate } from '../diag.mjs'
+import { findConfig, isDataConfig } from '../load-config.mjs'
+import { cdnFindings, writtenSecrets } from './cdn.mjs'
+import { fileStates, filesFor, managerOf, writeFiles } from './files.mjs'
+import { fit, hostsReport } from './fit.mjs'
+import { HOSTS, TARGETS, host, presetFor } from './hosts.mjs'
+import { needsOf } from './needs.mjs'
+
+export { HOSTS, TARGETS, fit, hostsReport, needsOf }
+
+const usage = message => Object.assign(new Error(message), { code: 'E_USAGE' })
+const refused = message => Object.assign(new Error(message), { code: 'E_REFUSED' })
+
+/** A finding as a diagnostic, pointing at the file that shows the need. */
+function toDiagnostic(root, f) {
+  let text = ''
+  try { text = readFileSync(join(root, f.file), 'utf8') } catch {}
+  const at = f.line ? { span: [f.line, 1, f.line, 1] } : text && f.needle ? locate(text, f.needle) : {}
+  return diagnostic({ code: f.code, severity: f.severity, file: f.file, ...at, why: f.why, help: f.fix })
+}
+
+/** The target this run is about: `--target`, then `deploy.target`, then the host whose preset `--preset` names. */
+export function targetOf(config, { target, preset } = {}) {
+  const id = target ?? config.deploy?.target ?? (preset && HOSTS.find(h => h.preset === preset)?.id)
+  if (id && !host(id)) throw usage(`unknown deploy target \`${id}\`: use ${TARGETS.join(', ')}`)
+  return id
+}
+
+/** E001–E004, E006, E008–E014 for `weft check`: the configured target's fit, its files, written secrets, CDN setup. */
+export function deployChecks(root, config, { preset } = {}) {
+  const out = writtenSecrets(root).map(s => ({ code: 'E008', severity: 'error', file: s.file, line: s.line, why: `${s.file}:${s.line} has ${s.what} in it: it would be committed, and anyone with the repository could deploy or bill as you`, fix: 'Move it to the environment (the host\'s settings, or GitHub\'s secrets for the workflow), and rotate it: it has been seen' }))
+  let id
+  try { id = targetOf(config, { preset }) } catch { id = undefined }
+  const deploy = config.deploy ?? {}
+  if (id) {
+    out.push(...fit(needsOf(root, config), host(id), { deploy }).findings)
+    if (deploy.target === id && host(id).deploys) {
+      for (const f of fileStates(root, filesFor(initContext(root, config, id)))) {
+        if (f.state === 'missing' || f.state === 'stale') out.push({ code: 'E006', severity: 'warning', file: f.path, why: `\`${f.path}\` is ${f.state === 'missing' ? 'missing' : 'from an older config'}: ${host(id).name} would deploy ${f.state === 'missing' ? 'without it' : 'what it said then'}`, fix: '`weft deploy init` writes it (a file edited by hand is left alone)' })
+      }
+    }
+  }
+  out.push(...cdnFindings(config))
+  return out.map(f => toDiagnostic(root, f))
+}
+
+/** What the generators read. */
+export function initContext(root, config, target) {
+  return { target, deploy: config.deploy ?? {}, needs: needsOf(root, config), runtime: config.runtime ?? 'node', manager: managerOf(root) }
+}
+
+/** `weft deploy hosts`, and the `deploy` part of `weft doctor`: every host's fit and the suggestion (E005 when none is set). */
+export function hostsCommand(root, config) {
+  const needs = needsOf(root, config)
+  const report = hostsReport(needs, { deploy: config.deploy })
+  const used = Object.entries(needs).filter(([k, v]) => k !== 'runtime' && v).map(([k, v]) => ({ need: k, ...v }))
+  const diagnostics = config.deploy?.target ? [] : [diagnostic({ code: 'E005', severity: 'info', file: findConfig(root) ? relative(root, findConfig(root)) : 'weft.config.ts', why: `No \`deploy.target\`. ${report.fits.filter(f => f.fits && f.deploys).map(f => f.name).join(', ')} can run this app; weft suggests ${host(report.suggestion.host).name}: ${report.suggestion.why}.`, help: `\`weft deploy init ${report.suggestion.host}\`` })]
+  return { needs: used, ...report, target: config.deploy?.target ?? null, diagnostics }
+}
+
+export function formatHosts(r) {
+  const lines = [`needs: ${r.needs.length ? r.needs.map(n => `${n.what} (${n.file})`).join(', ') : 'nothing a CDN with functions can\'t give'}`, '']
+  for (const f of r.fits) {
+    const mark = f.fits ? (f.findings.length ? '~' : '✓') : '✗'
+    lines.push(`${mark} ${f.host.padEnd(11)} ${f.name}${f.deploys ? '' : ' (fit only: `weft deploy` doesn\'t drive it yet)'}`)
+    for (const x of f.findings) lines.push(`    ${x.code} ${x.why}. Fix: ${x.fix}`)
+    lines.push(`    cost: ${f.cost} (${f.pricing})`)
+  }
+  lines.push('', `suggested: ${r.suggestion.host}, because ${r.suggestion.why}${r.suggestion.alternative ? `. Next best: ${r.suggestion.alternative}` : ''}`)
+  return lines.join('\n')
+}
+
+/** The object literal `export default` gives, directly or through `defineConfig(…)`. */
+function configObject(sf) {
+  for (const st of sf.statements) {
+    if (!ts.isExportAssignment(st)) continue
+    const value = ts.isCallExpression(st.expression) ? st.expression.arguments[0] : st.expression
+    if (value && ts.isObjectLiteralExpression(value)) return value
+  }
+}
+
+/** The `deploy` block init writes when the config has none: the names a host needs, from package.json, and a disk when data needs one. */
+export function defaultDeploy(root, target, needs) {
+  let name = 'my-app'
+  try { name = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).name?.replace(/^@[^/]+\//, '').replace(/[^a-z0-9-]/gi, '-').toLowerCase() || name } catch {}
+  const kept = needs.sqlite || needs.uploads
+  const per = {
+    netlify: { site: name }, vercel: { project: name }, cloudflare: { name },
+    fly: { app: name, region: 'iad', ...(kept && { volume: { name: 'data', sizeGb: 1 } }) },
+    render: { service: name, ...(kept && { plan: 'starter', disk: { sizeGb: 1 } }) },
+  }
+  return { target, [target]: per[target], ci: 'github', branch: 'main' }
+}
+
+const literal = (v, pad = '  ') => {
+  if (v && typeof v === 'object') return `{ ${Object.entries(v).map(([k, x]) => `${k}: ${literal(x, pad)}`).join(', ')} }`
+  return typeof v === 'string' ? `'${v}'` : String(v)
+}
+
+/** The config with `deploy` added. Refuses to touch one that already has it, or that isn't a plain object. */
+export function withDeploy(file, text, deploy) {
+  if (isDataConfig(file)) {
+    if (file.endsWith('.json')) return `${JSON.stringify({ ...JSON.parse(text), deploy }, null, 2)}\n`
+    return `${text.replace(/\n*$/, '\n')}deploy:\n${Object.entries(deploy).map(([k, v]) => `  ${k}: ${JSON.stringify(v)}`).join('\n')}\n`
+  }
+  const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true)
+  const object = configObject(sf)
+  if (!object) throw refused(`${file} doesn't export a plain object, so \`weft deploy init\` can't add \`deploy\` to it. Add \`deploy: ${literal(deploy)}\` by hand. Nothing was changed.`)
+  const block = `deploy: ${literal(deploy)},`
+  const last = object.properties.at(-1)
+  return last ? text.slice(0, object.properties.end) + `${object.properties.hasTrailingComma ? '' : ','}\n  ${block}` + text.slice(object.properties.end) : text.slice(0, object.getStart(sf) + 1) + `\n  ${block}\n` + text.slice(object.getStart(sf) + 1)
+}
+
+/**
+ * `weft deploy init [target]`: the host's files and workflow, and `deploy` in the config when it has none. Refuses a
+ * target the app doesn't fit unless `unsafe` lets the codes through.
+ */
+export function initCommand(root, config, { target, dryRun = false, force = false, unsafe } = {}) {
+  const needs = needsOf(root, config)
+  const id = targetOf(config, { target }) ?? hostsReport(needs).suggestion.host
+  const h = host(id)
+  if (!h.deploys) throw usage(`\`weft deploy\` doesn't drive ${h.name} yet (research 46 §11): ${TARGETS.join(', ')} it does`)
+  if (config.deploy?.target && target && config.deploy.target !== target) throw refused(`\`deploy.target\` is \`${config.deploy.target}\` in the config. Change it there to move to \`${target}\`, then run this again. Nothing was changed.`)
+  const deploy = config.deploy ?? defaultDeploy(root, id, needs)
+  const result = fit(needs, h, { deploy })
+  const blocking = result.findings.filter(f => f.severity === 'error' && !unsafe?.allows(f))
+  if (blocking.length) throw refused(`${h.name} can't run this app:\n${blocking.map(f => `  ${f.code} ${f.file}: ${f.why}.\n       Fix: ${f.fix}`).join('\n')}\n\`weft deploy hosts\` shows which hosts can. Nothing was changed.`)
+  const ctx = { ...initContext(root, { ...config, deploy }, id) }
+  const states = fileStates(root, filesFor(ctx))
+  const configFile = findConfig(root)
+  const actions = []
+  let written = []
+  if (!config.deploy) {
+    const file = configFile ?? join(root, 'weft.config.ts')
+    const text = configFile ? readFileSync(configFile, 'utf8') : "import { defineConfig } from '@weft-js/core/config'\n\nexport default defineConfig({})\n"
+    actions.push(`${relative(root, file)}: ${configFile ? '' : '(new) '}deploy: ${literal(deploy)}`)
+    if (!dryRun) writeFileSync(file, withDeploy(file, text, deploy))
+  }
+  for (const f of states) actions.push(`${f.path}: ${{ missing: 'write', stale: 'rewrite (from an older config)', current: 'current', edited: force ? 'overwrite (edited by hand; --force)' : 'edited by hand: left alone', foreign: force ? 'overwrite (--force)' : 'not written by weft: left alone' }[f.state]}`)
+  if (!dryRun) written = writeFiles(root, states, { force })
+  const next = [
+    ...{
+      netlify: [`netlify sites:create --name ${deploy.netlify?.site ?? '<name>'}   (once; or link an existing site with \`netlify link\`)`],
+      vercel: [`vercel link --project ${deploy.vercel?.project ?? '<name>'}   (once: writes .vercel/project.json with the org and project ids)`],
+      cloudflare: ['wrangler login   (once, locally; CI reads CLOUDFLARE_API_TOKEN)'],
+      fly: [`flyctl apps create ${deploy.fly?.app ?? '<name>'}   (once; billed per running machine)`, ...(deploy.fly?.volume ? [`flyctl volumes create ${deploy.fly.volume.name ?? 'data'} --size ${deploy.fly.volume.sizeGb ?? 1} --region ${deploy.fly.region ?? 'iad'} -a ${deploy.fly.app}   (once; billed)`] : [])],
+      render: ['Create the service from render.yaml: Render dashboard → New → Blueprint, on this repository (once)', 'Copy the service\'s deploy hook (Settings → Deploy Hook) into RENDER_DEPLOY_HOOK_URL'],
+    }[id],
+    ...((deploy.ci ?? 'github') === 'github' ? [`gh secret set ${h.env.join(' / ')}   (each one, from the host's dashboard: weft never writes them)`] : []),
+    `weft deploy   (a dry run: shows what --yes would run)`,
+  ]
+  return { ok: true, target: id, dryRun, actions, written, next, findings: result.findings.map(f => toDiagnostic(root, f)) }
+}
+
+/** The host's CLI: on PATH, else through npx for the ones on npm. */
+function cliFor(name, { which = cmd => spawnSync(process.platform === 'win32' ? 'where' : 'which', [cmd], { encoding: 'utf8' }).status === 0 } = {}) {
+  const npm = { netlify: 'netlify-cli', vercel: 'vercel', wrangler: 'wrangler' }
+  for (const cmd of name === 'flyctl' ? ['flyctl', 'fly'] : [name]) if (which(cmd)) return [cmd]
+  if (npm[name]) return ['npx', '--yes', npm[name]]
+  throw refused(`\`${name}\` isn't installed: ${name === 'flyctl' ? 'https://fly.io/docs/flyctl/install/' : `npm install -g ${npm[name] ?? name}`}`)
+}
+
+/**
+ * The steps `weft deploy` takes for a target, as data: a dry run prints them, `--yes` runs them. A step reads env vars
+ * by name; their values are filled in only as it runs.
+ */
+export function deploySteps(root, config, { target, prod = false, which } = {}) {
+  const h = host(target)
+  const deploy = config.deploy ?? {}
+  const runtime = config.runtime ?? 'node'
+  const needs = needsOf(root, config)
+  const steps = []
+  const build = { kind: 'build', what: `weft build --preset ${presetFor(h, runtime)}`, preset: presetFor(h, runtime) }
+  if (target === 'netlify') {
+    const site = process.env.NETLIFY_SITE_ID ? [] : deploy.netlify?.site ? ['--site', deploy.netlify.site] : []
+    steps.push(build, { kind: 'run', cli: 'netlify', args: ['deploy', '--dir', 'dist', '--functions', '.netlify/functions-internal', '--json', ...site, ...(prod ? ['--prod'] : [])], reads: ['NETLIFY_AUTH_TOKEN', 'NETLIFY_SITE_ID'], url: 'json' })
+  }
+  if (target === 'vercel') steps.push(build, { kind: 'run', cli: 'vercel', args: ['deploy', '--prebuilt', '--yes', ...(prod ? ['--prod'] : [])], token: 'VERCEL_TOKEN', reads: ['VERCEL_TOKEN', 'VERCEL_ORG_ID', 'VERCEL_PROJECT_ID'], url: 'last-line' })
+  if (target === 'cloudflare') steps.push(build, { kind: 'run', cli: 'wrangler', args: ['deploy'], cwd: '.output', reads: ['CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_ACCOUNT_ID'], url: 'workers' })
+  if (target === 'fly') {
+    // one machine unless a bus reaches the others: a second machine would split the rooms, and a volume is per machine
+    const one = needs.memoryBus || deploy.fly?.volume
+    steps.push({ kind: 'run', cli: 'flyctl', args: ['deploy', '--remote-only', ...(deploy.fly?.app ? ['--app', deploy.fly.app] : []), ...(one ? ['--ha=false'] : [])], reads: ['FLY_API_TOKEN'], url: deploy.fly?.app ? `https://${deploy.fly.app}.fly.dev` : 'fly' })
+  }
+  if (target === 'render') steps.push({ kind: 'hook', what: 'POST $RENDER_DEPLOY_HOOK_URL (Render builds the pushed commit)', reads: ['RENDER_DEPLOY_HOOK_URL'], url: deploy.render?.service ? `https://${deploy.render.service}.onrender.com` : undefined })
+  for (const s of steps) if (s.cli) s.what = `${s.cli} ${s.args.join(' ')}${s.token ? ` --token $${s.token}` : ''}${s.cwd ? `   (in ${s.cwd}/)` : ''}`
+  return steps
+}
+
+/** A variable a step reads, and whether its absence stops the deploy (E007). */
+function missingEnv(root, target, config, env) {
+  const ci = !!env.CI
+  const linked = { netlify: existsSync(join(root, '.netlify/state.json')) || !!config.deploy?.netlify?.site, vercel: existsSync(join(root, '.vercel/project.json')) }
+  // a token: the CLI's own login stands in, except in CI. An id: needed unless the project is linked.
+  const token = (k, how) => [k, ci ? 'error' : 'warning', how, ': the CLI\'s own login is used']
+  const id = (k, known, how) => [k, known ? null : 'error', how, '']
+  const need = {
+    netlify: [token('NETLIFY_AUTH_TOKEN', '`netlify login` here, or a personal access token from User settings → Applications'), id('NETLIFY_SITE_ID', linked.netlify, '`netlify link`, `deploy.netlify.site`, or the site id from Site configuration')],
+    vercel: [token('VERCEL_TOKEN', '`vercel login` here, or a token from Account Settings → Tokens'), id('VERCEL_ORG_ID', linked.vercel, '`vercel link` writes it to .vercel/project.json'), id('VERCEL_PROJECT_ID', linked.vercel, '`vercel link` writes it to .vercel/project.json')],
+    cloudflare: [token('CLOUDFLARE_API_TOKEN', '`wrangler login` here, or a token with Workers Scripts: Edit'), id('CLOUDFLARE_ACCOUNT_ID', !ci, 'the account id on the Workers overview page')],
+    fly: [token('FLY_API_TOKEN', '`flyctl auth login` here, or `flyctl tokens create deploy`')],
+    render: [id('RENDER_DEPLOY_HOOK_URL', false, "the service's Settings → Deploy Hook")],
+  }[target]
+  return need.filter(([k, severity]) => severity && !env[k]).map(([k, severity, how, local]) => ({ code: 'E007', severity, file: 'weft.config.ts', why: `\`${k}\` is unset${severity === 'warning' ? local : ''}`, fix: `${how}. Set it in the environment (never a file)` }))
+}
+
+/** The URL a host's CLI printed. */
+export function urlFrom(step, stdout) {
+  if (step.url === 'json') {
+    try { const j = JSON.parse(stdout.slice(stdout.indexOf('{'))); return j.url ?? j.deploy_url } catch { return }
+  }
+  if (step.url === 'last-line') return stdout.trim().split('\n').reverse().find(l => /^https:\/\//.test(l.trim()))?.trim()
+  if (step.url === 'workers') return /https:\/\/[\w.-]+\.workers\.dev/.exec(stdout)?.[0]
+  if (step.url === 'fly') return /https:\/\/[\w.-]+\.fly\.dev/.exec(stdout)?.[0]
+  return step.url
+}
+
+/**
+ * `weft deploy`: fit, then the steps. Without `yes` nothing runs: the result says what would. `build` is `weft build`
+ * in-process (start.mjs's buildCommand), `exec` runs a host CLI; both are injectable for tests.
+ */
+export async function deployCommand(root, config, { target, prod = false, yes = false, unsafe, env = process.env, build, exec = defaultExec, which, post = (url) => fetch(url, { method: 'POST' }) } = {}) {
+  const id = targetOf(config, { target })
+  if (!id) {
+    const s = hostsReport(needsOf(root, config)).suggestion
+    throw refused(`no deploy target: set \`deploy.target\` (\`weft deploy init\` does, and writes the host's files), or pass --target. weft suggests \`${s.host}\`: ${s.why}`)
+  }
+  const h = host(id)
+  if (!h.deploys) throw usage(`\`weft deploy\` doesn't drive ${h.name} yet (research 46 §11)`)
+  if (h.kind === 'server' && !prod) throw usage(`${h.name} has no preview deploys: pass --prod to deploy production`)
+  const needs = needsOf(root, config)
+  const findings = fit(needs, h, { deploy: config.deploy ?? {}, local: !env.CI }).findings
+  const blocking = findings.filter(f => f.severity === 'error' && !unsafe?.allows(f))
+  if (blocking.length) throw refused(`${h.name} can't run this app:\n${blocking.map(f => `  ${f.code} ${f.file}: ${f.why}.\n       Fix: ${f.fix}`).join('\n')}\nTo deploy anyway: --unsafe-allow ${[...new Set(blocking.map(f => f.code))].join(',')}`)
+  const steps = deploySteps(root, config, { target: id, prod, which })
+  const envFindings = missingEnv(root, id, config, env)
+  const diagnostics = [...findings, ...envFindings, ...cdnFindings(config, { env })].map(f => toDiagnostic(root, f))
+  if (!yes) return { ok: true, dryRun: true, target: id, prod, steps: steps.map(s => ({ what: s.what, reads: s.reads ?? [] })), diagnostics }
+  const stop = envFindings.find(f => f.severity === 'error')
+  if (stop) throw refused(`E007: ${stop.why}. ${stop.fix}.`)
+  let url
+  for (const s of steps) {
+    if (s.kind === 'build') {
+      const built = await build(root, { preset: s.preset })
+      diagnostics.push(...built.diagnostics)
+      if (!built.ok) throw refused('weft build failed: nothing was deployed. Fix the errors above.')
+    } else if (s.kind === 'hook') {
+      const res = await post(env.RENDER_DEPLOY_HOOK_URL)
+      if (!res.ok) throw refused(`Render's deploy hook answered ${res.status}: nothing was deployed. Check RENDER_DEPLOY_HOOK_URL.`)
+      url = s.url
+    } else {
+      const [cmd, ...pre] = cliFor(s.cli, { which })
+      const args = [...pre, ...s.args, ...(s.token && env[s.token] ? ['--token', env[s.token]] : [])]
+      const r = await exec(cmd, args, { cwd: join(root, s.cwd ?? ''), env })
+      if (r.code !== 0) throw refused(`${s.cli} failed (exit ${r.code}): nothing more was run.\n${(r.stderr || r.stdout).trim().split('\n').slice(-15).join('\n')}`)
+      url = urlFrom(s, r.stdout) ?? url
+    }
+  }
+  return { ok: true, dryRun: false, target: id, prod, url: url ?? null, diagnostics }
+}
+
+/** A host CLI with its progress on stderr, as it goes, and stdout kept for the URL. */
+function defaultExec(cmd, args, { cwd, env }) {
+  const r = spawnSync(cmd, args, { cwd, env, encoding: 'utf8', stdio: ['inherit', 'pipe', 'inherit'], maxBuffer: 64 * 1024 * 1024 })
+  return { code: r.status ?? 1, stdout: r.stdout ?? '', stderr: r.error?.message ?? '' }
+}

package/src/deploy/needs.mjs

@@ -0,0 +1,92 @@
+// What an app needs from a host (research 46 §2), read from its files in one pass: no Vite server, no build. Each need
+// carries the file that shows it, so a diagnostic can point there.
+
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
+
+const SKIP = new Set(['node_modules', '.weft', '.output', 'dist', '.netlify', '.vercel'])
+/** npm packages with a compiled addon: one built on a Mac doesn't load on a Linux function. */
+const ADDONS = /^(better-sqlite3|sqlite3|sharp|bcrypt|argon2|canvas|@node-rs\/.+|@napi-rs\/canvas|bufferutil|utf-8-validate)$/
+/** A bus that reaches every instance. The memory bus is what's left when none is named. */
+const BUSES = /\b(postgresBus|redisBus|natsBus|durableObjectBus)\s*\(|@weft-js\/realtime-(redis|nats|durable-object)/
+
+const posix = p => p.replaceAll('\\', '/')
+
+function sources(root) {
+  const out = []
+  const walk = dir => {
+    for (const d of readdirSync(dir, { withFileTypes: true })) {
+      const f = join(dir, d.name)
+      if (d.isDirectory()) { if (!SKIP.has(d.name)) walk(f) } else if (/\.[cm]?[jt]sx?$/.test(d.name) && !/\.(test|spec)\.|\.d\.ts$/.test(d.name)) out.push(f)
+    }
+  }
+  if (existsSync(join(root, 'src'))) walk(join(root, 'src'))
+  return out
+}
+
+/** `.weft/contract.json`, when it's newer than every source file: what the last build saw is then what's there. */
+function freshContract(root, files) {
+  const file = join(root, '.weft', 'contract.json')
+  if (!existsSync(file)) return
+  const at = statSync(file).mtimeMs
+  if (files.some(f => statSync(f).mtimeMs > at)) return
+  try { return JSON.parse(readFileSync(file, 'utf8')) } catch {}
+}
+
+const read = file => { try { return readFileSync(file, 'utf8') } catch { return '' } }
+
+/**
+ * @param {string} root
+ * @param {any} [config] the loaded weft.config
+ * @returns {{ sockets?: Need, required?: Need, feed?: Need, memoryBus?: Need, sidecar?: Need, native?: Need, sqlite?: Need, uploads?: Need, addons?: Need, runtime: string }}
+ * @typedef {{ file: string, what: string }} Need
+ */
+export function needsOf(root, config = {}) {
+  const files = sources(root)
+  const rel = f => posix(relative(root, f))
+  const needs = { runtime: config.runtime ?? 'node' }
+  const contract = freshContract(root, files)
+  const realtimeFile = join(root, 'src/realtime.server.ts')
+  const realtime = read(realtimeFile)
+  let streams = false
+  if (contract) {
+    const live = contract.functions?.find(f => f.kind === 'channel' || f.kind === 'shared')
+    if (live) needs.sockets = { file: '.weft/contract.json', what: `\`${live.name}\` is a ${live.kind === 'shared' ? '`sharedState`' : '`channel`'}` }
+    streams = contract.functions?.some(f => ['stream', 'channel', 'shared'].includes(f.kind))
+    const native = Object.entries(contract.services ?? {}).find(([, s]) => s.kind === 'native')
+    if (native) needs.native = { file: '.weft/contract.json', what: `\`native('${native[0]}')\`` }
+  }
+  for (const f of files) {
+    const text = read(f)
+    const server = /^src\/server\/|\.server\.[cm]?[jt]sx?$/.test(rel(f))
+    if (!contract && server) {
+      const m = /\b(channel|sharedState)\s*[(<]/.exec(text)
+      if (m && !needs.sockets) needs.sockets = { file: rel(f), what: `a \`${m[1]}\`` }
+      if (/\b(stream|channel|sharedState)\s*[(<]/.test(text)) streams = true
+    }
+    if (/\.live\(/.test(text)) streams = true
+    if (/['"]@weft-js\/start\/rust['"]/.test(text)) {
+      for (const m of text.matchAll(/\bremote\(\s*['"`]rust:\/\/([\w-]+)/g)) if (!config.rust?.services?.[m[1]]?.external) needs.sidecar ??= { file: rel(f), what: `\`remote('rust://${m[1]}')\`` }
+      const n = /\bnative\(\s*['"`]([\w-]+)/.exec(text)
+      if (n) needs.native ??= { file: rel(f), what: `\`native('${n[1]}')\`` }
+    }
+    if (!/listener:\s*['"]external['"]/.test(realtime) && /\.live\(([^;\n]*?)\brequired:\s*true|\blive:\s*\{[^}]*required:\s*true/.test(text)) needs.required ??= { file: rel(f), what: 'a live query marked `required`' }
+    if (/\bctx\.media\b|\bz\.media\b/.test(text)) needs.uploads ??= { file: rel(f), what: 'media uploads' }
+  }
+  if (!needs.sockets && /\bshare\s*[:,}]/.test(realtime)) needs.sockets = { file: 'src/realtime.server.ts', what: '`realtime({ share })`' }
+  if (/\bchanges\s*[:,}]/.test(realtime) && !/listener:\s*['"]external['"]/.test(realtime)) needs.feed = { file: 'src/realtime.server.ts', what: '`changes`' }
+  const plugins = (config.plugins ?? []).map(p => p?.name ?? p).filter(n => typeof n === 'string')
+  const configText = ['weft.config.ts', 'weft.config.mts', 'weft.config.js', 'weft.config.mjs'].map(n => read(join(root, n))).join('\n')
+  if ((streams || needs.sockets) && !BUSES.test(realtime) && !plugins.some(n => /realtime-(redis|nats|durable-object)/.test(n)) && !BUSES.test(configText)) needs.memoryBus = { file: existsSync(realtimeFile) ? 'src/realtime.server.ts' : 'src', what: 'the memory bus' }
+  if (!needs.uploads && /encoder:\s*['"]server['"]/.test(configText)) needs.uploads = { file: 'weft.config.ts', what: "`media({ encoder: 'server' })`" }
+  if (needs.uploads && !plugins.some(n => n.includes('plugin-media')) && !configText.includes('plugin-media')) delete needs.uploads // M017 says that one
+  const db = read(join(root, 'src/db/index.server.ts'))
+  const drizzle = read(join(root, 'drizzle.config.ts'))
+  if (/\/db\/sqlite['"]/.test(db) || (/dialect:\s*['"](sqlite|turso)['"]/.test(drizzle) && !/libsql:|turso/.test(drizzle + db))) needs.sqlite = { file: db ? 'src/db/index.server.ts' : 'drizzle.config.ts', what: 'a SQLite file' }
+  try {
+    const pkg = JSON.parse(read(join(root, 'package.json')) || '{}')
+    const addon = Object.keys(pkg.dependencies ?? {}).find(n => ADDONS.test(n))
+    if (addon) needs.addons = { file: 'package.json', what: `\`${addon}\`` }
+  } catch {}
+  return needs
+}

package/src/docs.mjs

@@ -22,6 +22,7 @@ export const topics = {
   async: 'resource, <Boundary pending error>, @weft-js/core/ssr and hydrate; W012',
   start: 'full stack: routes, load, query, mutation, the database, auth, realtime, runtimes; Q001–Q016, A001–A004, C001–C002, F001–F003, R001–R023',
   rust: 'Rust bodies: native() addons with a WASM fallback, remote() sidecars, weft add rust, impl, the weft crate, build.rs, Ctx, touch, weft dev reload, deployment; R101–R109',
+  deploy: 'Deploy: which hosts can run the app, weft deploy hosts/init, the push workflow, Netlify, Vercel, Cloudflare, Fly, Render, CDN and Cloudinary; E001–E014',
   plugins: 'Build a plugin: slots, server extensions, check hooks, docs, `weft add`, conformance. Walks through how @weft-js/pay is built',
   testing: '@weft-js/core/test: render, screen, user, flush, clock, touches and toTouchAtMost(n, { runs }); T001–T009',
   browser: '@weft-js/core/browser: online, visible, lifecycle, media, on, interval; the net/page fakes; W050, W051, W054, W056, T012',

package/src/load-config.mjs

@@ -13,7 +13,7 @@ import { contributions } from './contributions.mjs'
 import { bindSlots } from './slots.mjs'
 
 export const configNames = ['weft.config.ts', 'weft.config.mts', 'weft.config.js', 'weft.config.mjs', 'weft.config.json', 'weft.config.yaml', 'weft.config.yml']
-export const builtinNames = ['add', 'map', 'dev', 'build', 'start', 'db', 'test', 'check', 'doctor', 'fix', 'tokens', 'browser', 'mcp', 'tasks', 'run', 'create', 'docs', 'agents-md', 'plugins']
+export const builtinNames = ['add', 'map', 'dev', 'build', 'start', 'db', 'test', 'check', 'doctor', 'fix', 'tokens', 'browser', 'mcp', 'tasks', 'run', 'create', 'docs', 'agents-md', 'plugins', 'deploy']
 
 const configModule = pathToFileURL(join(fileURLToPath(new URL('.', import.meta.url)), 'config.mjs')).href
 const nativeRequire = createRequire(import.meta.url)
@@ -46,6 +46,14 @@ function hook() {
           return { url: configModule, shortCircuit: true }
         }
       }
+      // the app's own imports are bundler-style (`./src/expression`): try what Vite would before failing
+      if (/^\.{1,2}\//.test(specifier) && !/\.[cm]?[jt]sx?$|\.json$/.test(specifier)) {
+        for (const end of ['', '.ts', '.tsx', '.mts', '.js', '/index.ts', '/index.tsx', '/index.js']) {
+          try {
+            return next(specifier + end, context)
+          } catch {}
+        }
+      }
       return next(specifier, context)
     },
     load(url, context, next) {
@@ -147,6 +155,27 @@ export const configSchema = z.strictObject({
     unions: z.literal('allow').optional(),
     services: z.record(z.string(), z.strictObject({ crate: z.string().optional(), external: z.boolean().optional(), wasm: z.literal(false).optional() })).optional(),
   }).optional(),
+  /** `weft deploy` (research 46): names, regions and sizes. Credentials come from the environment, never here (E008). */
+  deploy: z.strictObject({
+    target: z.enum(['netlify', 'vercel', 'cloudflare', 'fly', 'render']).optional(),
+    netlify: z.strictObject({ site: z.string().min(1).optional() }).optional(),
+    vercel: z.strictObject({ project: z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/i, 'a name: letters, digits and dashes').optional() }).optional(),
+    cloudflare: z.strictObject({ name: z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/i, 'a name: letters, digits and dashes').optional() }).optional(),
+    fly: z.strictObject({
+      app: z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/i, 'a name: letters, digits and dashes').optional(), region: z.string().regex(/^[a-z]{3}$/, 'a Fly region code, like `iad`').optional(), memory: z.string().regex(/^\d+(mb|gb)$/, 'like `512mb`').optional(),
+      volume: z.strictObject({ name: z.string().regex(/^[a-z0-9_]+$/, 'lowercase letters, digits and underscores').optional(), path: z.string().startsWith('/').optional(), sizeGb: z.number().int().positive().optional() }).optional(),
+    }).optional(),
+    render: z.strictObject({
+      service: z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/i, 'a name: letters, digits and dashes').optional(), plan: z.string().optional(), region: z.string().optional(),
+      disk: z.strictObject({ path: z.string().startsWith('/').optional(), sizeGb: z.number().int().positive().optional() }).optional(),
+    }).optional(),
+    ci: z.union([z.literal('github'), z.literal(false)]).optional(),
+    branch: z.string().min(1).optional(),
+    cdn: z.strictObject({
+      proxy: z.literal('cloudflare').optional(),
+      images: z.strictObject({ provider: z.literal('cloudinary'), cloud: z.string().regex(/^[\w-]+$/, "the cloud's name, not its URL").optional() }).optional(),
+    }).optional(),
+  }).optional(),
   /** Named targets for a query's `live: { verify: 'staging' }`. `db` is an env var's name. */
   live: z.strictObject({
     targets: z.record(z.string(), z.strictObject({ url: z.string().optional(), db: z.string().optional(), production: z.boolean().optional() })).optional(),

package/src/mcp.mjs

@@ -136,7 +136,7 @@ export async function handle(root, msg) {
       return reply({
         protocolVersion: versions.includes(asked) ? asked : versions[0],
         capabilities: { tools: { listChanged: false } },
-        serverInfo: { name: 'weft', version: '0.1.0' },
+        serverInfo: { name: 'weft', version: '0.1.1' },
         instructions: 'weft is a fine-grained reactive TSX framework, not React. Read `docs` topic `rules` first, and run `check` after every edit. Every page sets `meta` from its own context as part of building it (`docs` topic `meta`). Style with groups from @weft-js/core/style, not class lists: `style_find` before you write one. Verify behavior in the running app with the browser_* tools (or `__weft__.agent` in your own browser), and run `test_gate` before you call a change done.',
       })
     }

package/src/start.mjs

@@ -16,6 +16,7 @@ import { loadConfig } from './load-config.mjs'
 import { sync } from './plugins.mjs'
 import { requireTrust } from './trust.mjs'
 import { attachProps } from './props-listener.mjs'
+import { host, presetFor } from './deploy/hosts.mjs'
 
 export async function start(root, sub) {
   let file
@@ -36,7 +37,7 @@ async function site(root) {
   if (!loaded.diagnostics.some(d => d.code === 'P007') && loaded.config?.plugins?.length) sync(root, loaded)
   // A build on a config that doesn't load would quietly drop every plugin: fonts, tokens and slots.
   const bad = loaded.diagnostics.find(d => d.code === 'P007')
-  if (bad) throw Object.assign(new Error(`P007: ${bad.message ?? bad.why}`), { code: 'E_USAGE' })
+  if (bad) throw Object.assign(new Error(`P007: ${bad.message ?? bad.why}`), { code: 'E_REFUSED' }) // the config's fault, not the command's
   return { site: siteOf(loaded), hydration: loaded.config?.hydration, diagnostics: loaded.diagnostics }
 }
 
@@ -102,6 +103,9 @@ export async function buildCommand(root, { preset, runtime, unsafeAllow } = {})
   const t = performance.now()
   const config = await site(root)
   const chosen = runtime ?? (await loadConfig(root)).config?.runtime ?? hostRuntime()
+  // `deploy.target` picks the preset when nothing else does: a build for Fly is the runtime's server, for Netlify `netlify`
+  const target = !preset && !runtime && (await loadConfig(root)).config?.deploy?.target
+  if (target) preset = presetFor(host(target), chosen)
   if (!preset && !PRESETS[chosen]) throw Object.assign(new Error(`unknown runtime "${chosen}": use ${Object.keys(PRESETS).join(', ')}`), { code: 'E_USAGE' })
   preset ??= PRESETS[chosen]
   // A build holds no secrets: an app's env check stands down, and server modules load without a database.