naro-cli 0.6.1 → 0.8.0

package/dist/{chunk-WKJELBOU.js → chunk-ONALKL7O.js}

@@ -6,10 +6,10 @@ var __export = (target, all) => {
 };
 
 // src/deploy.ts
-import { existsSync as existsSync6 } from "fs";
-import { cp, mkdtemp as mkdtemp2, readFile as readFile7, rm as rm2 } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { cp as cp2, mkdtemp as mkdtemp2, readFile as readFile13, rm as rm3 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename, dirname, join as join15, resolve as resolve4 } from "path";
+import { basename as basename3, dirname as dirname4, join as join23, resolve as resolve9 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -142,8 +142,8 @@ async function restoreCache(args) {
 async function saveCache(args) {
   const { scope, key, sourceDir, ports, observer } = args;
   try {
-    const info2 = await stat(sourceDir);
-    if (!info2.isDirectory()) throw new Error("not a directory");
+    const info3 = await stat(sourceDir);
+    if (!info3.isDirectory()) throw new Error("not a directory");
   } catch {
     await log(
       observer,
@@ -226,9 +226,9 @@ function hashAsset(data, contentType2) {
 }
 
 // ../../packages/build/src/local-build-executor.ts
-import { mkdtemp, rm } from "fs/promises";
+import { access as access8, mkdtemp, readFile as readFile12, rm as rm2 } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join8 } from "path";
+import { dirname as dirname3, join as join16, resolve as resolve7 } from "path";
 
 // ../../packages/core/src/artifact-manifest.ts
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
@@ -244,6 +244,9 @@ var PHASES = [
 ];
 var ACTIVE_STATUSES = new Set(PHASES);
 
+// ../../packages/core/src/deployment-strategy.ts
+var MIN_SUPPORTED_NEXT_MAJOR = 15;
+
 // ../../packages/core/src/errors.ts
 var DeploymentError = class extends Error {
   code;
@@ -278,6 +281,9 @@ function pathnameOf(url2) {
   }
 }
 
+// ../../packages/core/src/internal-auth.ts
+import { Buffer as Buffer2 } from "buffer";
+
 // ../../packages/core/src/paths.ts
 function projectPath(teamSlug, projectSlug) {
   return `/${teamSlug}/projects/${projectSlug}`;
@@ -2468,9 +2474,9 @@ var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst,
     });
   };
 });
-function handleCheckPropertyResult(result, payload, property) {
+function handleCheckPropertyResult(result, payload, property2) {
   if (result.issues.length) {
-    payload.issues.push(...prefixIssues(property, result.issues));
+    payload.issues.push(...prefixIssues(property2, result.issues));
   }
 }
 var $ZodCheckProperty = /* @__PURE__ */ $constructor("$ZodCheckProperty", (inst, def) => {
@@ -11297,10 +11303,10 @@ function _endsWith(suffix, params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _property(property, schema, params) {
+function _property(property2, schema, params) {
   return new $ZodCheckProperty({
     check: "property",
-    property,
+    property: property2,
     schema,
     ...normalizeParams(params)
   });
@@ -11397,28 +11403,28 @@ function _tuple(Class2, items, _paramsOrRest, _params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _record(Class2, keyType, valueType, params) {
+function _record(Class2, keyType, valueType2, params) {
   return new Class2({
     type: "record",
     keyType,
-    valueType,
+    valueType: valueType2,
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _map(Class2, keyType, valueType, params) {
+function _map(Class2, keyType, valueType2, params) {
   return new Class2({
     type: "map",
     keyType,
-    valueType,
+    valueType: valueType2,
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _set(Class2, valueType, params) {
+function _set(Class2, valueType2, params) {
   return new Class2({
     type: "set",
-    valueType,
+    valueType: valueType2,
     ...normalizeParams(params)
   });
 }
@@ -13784,37 +13790,37 @@ var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
-function record(keyType, valueType, params) {
-  if (!valueType || !valueType._zod) {
+function record(keyType, valueType2, params) {
+  if (!valueType2 || !valueType2._zod) {
     return new ZodRecord({
       type: "record",
       keyType: string2(),
       valueType: keyType,
-      ...util_exports.normalizeParams(valueType)
+      ...util_exports.normalizeParams(valueType2)
     });
   }
   return new ZodRecord({
     type: "record",
     keyType,
-    valueType,
+    valueType: valueType2,
     ...util_exports.normalizeParams(params)
   });
 }
-function partialRecord(keyType, valueType, params) {
+function partialRecord(keyType, valueType2, params) {
   const k = clone(keyType);
   k._zod.values = void 0;
   return new ZodRecord({
     type: "record",
     keyType: k,
-    valueType,
+    valueType: valueType2,
     ...util_exports.normalizeParams(params)
   });
 }
-function looseRecord(keyType, valueType, params) {
+function looseRecord(keyType, valueType2, params) {
   return new ZodRecord({
     type: "record",
     keyType,
-    valueType,
+    valueType: valueType2,
     mode: "loose",
     ...util_exports.normalizeParams(params)
   });
@@ -13830,11 +13836,11 @@ var ZodMap = /* @__PURE__ */ $constructor("ZodMap", (inst, def) => {
   inst.max = (...args) => inst.check(_maxSize(...args));
   inst.size = (...args) => inst.check(_size(...args));
 });
-function map(keyType, valueType, params) {
+function map(keyType, valueType2, params) {
   return new ZodMap({
     type: "map",
     keyType,
-    valueType,
+    valueType: valueType2,
     ...util_exports.normalizeParams(params)
   });
 }
@@ -13847,10 +13853,10 @@ var ZodSet = /* @__PURE__ */ $constructor("ZodSet", (inst, def) => {
   inst.max = (...args) => inst.check(_maxSize(...args));
   inst.size = (...args) => inst.check(_size(...args));
 });
-function set(valueType, params) {
+function set(valueType2, params) {
   return new ZodSet({
     type: "set",
-    valueType,
+    valueType: valueType2,
     ...util_exports.normalizeParams(params)
   });
 }
@@ -14809,6 +14815,7 @@ var RESERVED_SUBDOMAINS = [
   "docs",
   "help",
   "imap",
+  "ingest",
   "mail",
   "mx",
   "naro",
@@ -14888,6 +14895,87 @@ var connectRepositorySchema = external_exports.object({
   })
 });
 
+// ../../packages/core/src/sql-classifier.ts
+var NUL = String.fromCharCode(0);
+
+// ../../packages/build/src/next-version.ts
+var NEXT_RELEASE_DATES = {
+  16: "2025-10-21",
+  15: "2024-10-21",
+  14: "2023-10-26",
+  13: "2022-10-26",
+  12: "2021-10-26"
+};
+var SUPPORT_WINDOW_YEARS = 2;
+var PEER_LOWER = { major: 15, minor: 5, patch: 21 };
+var PEER_16_FLOOR = { major: 16, minor: 2, patch: 11 };
+function parseNextVersion(raw) {
+  const match = /^\s*(\d+)\.(\d+)\.(\d+)/.exec(raw);
+  if (!match) return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+function declaredNextMajor(range) {
+  const trimmed = range.trim();
+  if (trimmed === "") return null;
+  const match = /^[\^~]?(\d+)(?:\.\d+)*$/.exec(trimmed);
+  return match ? Number(match[1]) : null;
+}
+function supportEndsAt(major) {
+  const released = NEXT_RELEASE_DATES[major];
+  if (!released) return null;
+  const end = new Date(released);
+  end.setUTCFullYear(end.getUTCFullYear() + SUPPORT_WINDOW_YEARS);
+  return end;
+}
+function compare(a, b) {
+  return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+function withinPeerRange(version2) {
+  if (version2.major === 15) return compare(version2, PEER_LOWER) >= 0;
+  if (version2.major === 16) return compare(version2, PEER_16_FLOOR) >= 0;
+  return version2.major > 16;
+}
+function formatDate(date5) {
+  return date5.toISOString().slice(0, 10);
+}
+function classifyNextVersion(raw, now) {
+  const version2 = parseNextVersion(raw);
+  if (!version2) {
+    return {
+      status: "unknown",
+      version: null,
+      reason: `Could not read a Next.js version from "${raw}".`
+    };
+  }
+  const windowEnd = supportEndsAt(version2.major);
+  if (!windowEnd || version2.major < PEER_LOWER.major) {
+    return {
+      status: "too-old",
+      version: version2,
+      reason: `Next.js ${raw} is too old to deploy. @opennextjs/cloudflare supports Next.js 15.5.21 and newer. Upgrade to Next.js 16.`
+    };
+  }
+  if (now > windowEnd) {
+    return {
+      status: "needs-unsupported-flag",
+      version: version2,
+      reason: `Next.js ${version2.major} left its support window on ${formatDate(windowEnd)}. The build continues, but unsupported releases stop receiving security patches \u2014 upgrade to Next.js 16. See https://nextjs.org/support-policy`
+    };
+  }
+  if (!withinPeerRange(version2)) {
+    return {
+      status: "outside-peer-range",
+      version: version2,
+      reason: `Next.js ${raw} is outside the range @opennextjs/cloudflare declares support for (>=15.5.21 <16 || >=16.2.11). The build may fail in ways naro cannot explain.`
+    };
+  }
+  return { status: "supported", version: version2, reason: "" };
+}
+
 // ../../packages/build/src/package-manager.ts
 import { access, readFile as readFile2 } from "fs/promises";
 import { join as join2 } from "path";
@@ -14915,14 +15003,20 @@ async function detectPackageManager(root) {
     return {
       name: "pnpm",
       install: ["pnpm", "install", "--frozen-lockfile"],
-      cacheArgs: (dir) => ["--store-dir", dir]
+      cacheArgs: (dir) => ["--store-dir", dir],
+      // pnpm only warns about skipped esbuild/workerd build scripts here (it is
+      // `pnpm install` that exits 1 over them), and a vinext build succeeds
+      // without those postinstalls.
+      addArgs: (specs) => ["pnpm", "add", ...specs]
     };
   }
   if (await exists(join2(root, "package-lock.json"))) {
     return {
       name: "npm",
       install: ["npm", "ci"],
-      cacheArgs: (dir) => ["--cache", dir]
+      cacheArgs: (dir) => ["--cache", dir],
+      // --no-save keeps package.json and the lockfile untouched.
+      addArgs: (specs) => ["npm", "install", "--no-save", ...specs]
     };
   }
   if (await exists(join2(root, "yarn.lock"))) {
@@ -14935,7 +15029,8 @@ async function detectPackageManager(root) {
         modern ? "--immutable" : "--frozen-lockfile"
       ],
       // Berry takes no install-time cache flag; YARN_CACHE_FOLDER covers it.
-      cacheArgs: (dir) => modern ? [] : ["--cache-folder", dir]
+      cacheArgs: (dir) => modern ? [] : ["--cache-folder", dir],
+      addArgs: (specs) => ["yarn", "add", ...specs]
     };
   }
   throw new DeploymentError(
@@ -14980,215 +15075,22 @@ async function convertProxyToMiddleware(appRoot) {
   return { converted: false };
 }
 
-// ../../packages/build/src/platform-config.ts
-import { access as access3, writeFile as writeFile3 } from "fs/promises";
-import { createRequire } from "module";
-import { join as join4 } from "path";
-var COMPATIBILITY_DATE = "2026-08-19";
-var NEXT_CONFIG_FILES = [
-  "next.config.js",
-  "next.config.mjs",
-  "next.config.cjs",
-  "next.config.ts"
-];
-async function pathExists(path) {
-  try {
-    await access3(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function createPackageManagerConfig(appRoot, writer = async (path, contents) => {
-  await writeFile3(path, contents, "utf8");
-}) {
-  const packageManagerConfigPath = join4(appRoot, ".next-deploy-user.npmrc");
-  await writer(
-    packageManagerConfigPath,
-    "# Host package-manager credentials are intentionally unavailable.\n"
-  );
-  return packageManagerConfigPath;
-}
-async function createPlatformBuildConfig(appRoot, deploymentId, writer = async (path, contents) => {
-  await writeFile3(path, contents, "utf8");
-}, cloudflareModulePath = createRequire(import.meta.url).resolve(
-  "@opennextjs/cloudflare"
-), exists3 = pathExists) {
-  const openNextConfigPath = join4(appRoot, ".next-deploy-open-next.config.mjs");
-  const wranglerConfigPath = join4(appRoot, ".next-deploy-wrangler.json");
-  const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
-  let hasNextConfig = false;
-  for (const name of NEXT_CONFIG_FILES) {
-    if (await exists3(join4(appRoot, name))) {
-      hasNextConfig = true;
-      break;
-    }
-  }
-  if (!hasNextConfig) {
-    await writer(
-      join4(appRoot, "next.config.mjs"),
-      'export default { output: "standalone" };\n'
-    );
-  }
-  await writer(
-    openNextConfigPath,
-    `import { defineCloudflareConfig } from ${JSON.stringify(cloudflareModulePath)};
-
-export default defineCloudflareConfig({});
-`
-  );
-  await writer(
-    wranglerConfigPath,
-    `${JSON.stringify(
-      {
-        name: `next-deploy-${safeDeploymentId}`,
-        main: ".open-next/worker.js",
-        compatibility_date: COMPATIBILITY_DATE,
-        compatibility_flags: ["nodejs_compat"],
-        assets: {
-          directory: ".open-next/assets",
-          binding: "ASSETS"
-        }
-      },
-      null,
-      2
-    )}
-`
-  );
-  const packageManagerConfigPath = await createPackageManagerConfig(
-    appRoot,
-    writer
-  );
-  return {
-    openNextConfigPath,
-    wranglerConfigPath,
-    packageManagerConfigPath
-  };
-}
-
-// ../../packages/build/src/frameworks.ts
-import { readFile as readFile4 } from "fs/promises";
-import { join as join5 } from "path";
-var FRAMEWORK_PRESETS = {
-  next: {
-    id: "next",
-    detectDependency: "next",
-    defaultBuildScript: "build",
-    defaultOutputDirectory: ".open-next",
-    needsServerRuntime: true,
-    spaFallback: false,
-    cachePath: ".next/cache"
-  },
-  vite: {
-    id: "vite",
-    detectDependency: "vite",
-    defaultBuildScript: "build",
-    defaultOutputDirectory: "dist",
-    needsServerRuntime: false,
-    spaFallback: true,
-    cachePath: "node_modules/.vite"
-  },
-  cra: {
-    id: "cra",
-    detectDependency: "react-scripts",
-    defaultBuildScript: "build",
-    defaultOutputDirectory: "build",
-    needsServerRuntime: false,
-    spaFallback: true,
-    cachePath: "node_modules/.cache"
-  },
-  static: {
-    id: "static",
-    detectDependency: null,
-    defaultBuildScript: null,
-    defaultOutputDirectory: ".",
-    needsServerRuntime: false,
-    spaFallback: false,
-    cachePath: null
-  }
-};
-var DETECTION_ORDER = ["next", "vite", "cra"];
-var FRAMEWORK_LABELS = {
-  next: "Next.js",
-  vite: "Vite",
-  cra: "Create React App",
-  static: "static files"
-};
-function dependencyVersion(packageJson, name) {
-  const version2 = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
-  return typeof version2 === "string" && version2.trim() !== "" ? version2 : null;
-}
-async function readPackageJson(root) {
-  let source;
-  try {
-    source = await readFile4(join5(root, "package.json"), "utf8");
-  } catch (error51) {
-    if (error51.code === "ENOENT") return null;
-    throw new DeploymentError(
-      "FRAMEWORK_DETECTION_FAILED",
-      "Could not read package.json.",
-      { cause: error51 }
-    );
-  }
-  try {
-    return JSON.parse(source);
-  } catch (error51) {
-    throw new DeploymentError(
-      "FRAMEWORK_DETECTION_FAILED",
-      "The selected root does not contain a valid package.json.",
-      { cause: error51 }
-    );
-  }
-}
-async function detectFramework(root, overrides = {}) {
-  const packageJson = await readPackageJson(root);
-  let preset;
-  if (overrides.framework) {
-    const candidate = FRAMEWORK_PRESETS[overrides.framework] ?? null;
-    if (!candidate || candidate.id !== overrides.framework)
-      throw new DeploymentError(
-        "FRAMEWORK_DETECTION_FAILED",
-        `Unknown framework "${overrides.framework}".`
-      );
-    preset = candidate;
-  } else if (!packageJson) {
-    preset = FRAMEWORK_PRESETS.static;
-  } else {
-    const detected = DETECTION_ORDER.map((id) => FRAMEWORK_PRESETS[id]).find(
-      (candidate) => candidate.detectDependency !== null && dependencyVersion(packageJson, candidate.detectDependency) !== null
-    );
-    if (!detected)
-      throw new DeploymentError(
-        "FRAMEWORK_DETECTION_FAILED",
-        "Could not detect the project framework from package.json. Set a framework (and build command / output directory) in the project settings."
-      );
-    preset = detected;
-  }
-  const buildScript = overrides.buildCommand ?? preset.defaultBuildScript;
-  if (buildScript !== null) {
-    if (!packageJson)
-      throw new DeploymentError(
-        "FRAMEWORK_DETECTION_FAILED",
-        "A build command requires a package.json."
-      );
-    if (typeof packageJson.scripts?.[buildScript] !== "string")
-      throw new DeploymentError(
-        "BUILD_FAILED",
-        `The project must declare a "${buildScript}" script.`
-      );
-  }
-  const version2 = packageJson && preset.detectDependency ? dependencyVersion(packageJson, preset.detectDependency) : null;
-  return {
-    preset,
-    buildScript,
-    outputDirectory: overrides.outputDirectory ?? preset.defaultOutputDirectory,
-    description: version2 ? `${FRAMEWORK_LABELS[preset.id]} ${version2}` : FRAMEWORK_LABELS[preset.id]
-  };
-}
+// ../../packages/build/src/vinext.ts
+import { access as access5, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
+import { join as join6, resolve as resolve2 } from "path";
 
 // ../../packages/build/src/open-next.ts
-import { access as access4, readdir, readFile as readFile5 } from "fs/promises";
-import { extname, isAbsolute, join as join6, relative, resolve, sep } from "path";
+import { access as access3, readdir, readFile as readFile4 } from "fs/promises";
+import {
+  basename,
+  dirname,
+  extname,
+  isAbsolute,
+  join as join4,
+  relative,
+  resolve,
+  sep
+} from "path";
 function parseJsonc(source) {
   let output = "";
   let index = 0;
@@ -15228,19 +15130,19 @@ function parseJsonc(source) {
   }
   return JSON.parse(output.replace(/,\s*([}\]])/g, "$1"));
 }
-function confinedPath(root, configuredPath, label) {
+function confinedPath(root, configuredPath, label2, base2 = root) {
   if (isAbsolute(configuredPath)) {
     throw new DeploymentError(
       "ARTIFACT_INVALID",
-      `${label} must be relative to the application root.`
+      `${label2} must be relative to the application root.`
     );
   }
-  const resolved = resolve(root, configuredPath);
+  const resolved = resolve(base2, configuredPath);
   const relation = relative(root, resolved);
   if (relation === ".." || relation.startsWith(`..${sep}`) || isAbsolute(relation)) {
     throw new DeploymentError(
       "ARTIFACT_INVALID",
-      `${label} escapes the application root.`
+      `${label2} escapes the application root.`
     );
   }
   return resolved;
@@ -15294,25 +15196,25 @@ function contentType(path) {
       return "application/octet-stream";
   }
 }
-async function listFiles(root) {
+async function listArtifactFiles(root, label2 = "OpenNext") {
   const files = [];
   async function visit(directory) {
     const entries = await readdir(directory, { withFileTypes: true });
     for (const entry of entries.sort(
       (left, right) => left.name.localeCompare(right.name)
     )) {
-      const path = join6(directory, entry.name);
+      const path = join4(directory, entry.name);
       if (entry.isSymbolicLink()) {
         throw new DeploymentError(
           "ARTIFACT_INVALID",
-          "OpenNext output cannot contain symbolic links."
+          `${label2} output cannot contain symbolic links.`
         );
       }
       if (entry.isDirectory()) await visit(path);
       else if (entry.isFile()) {
         files.push({
           name: relative(root, path).split(sep).join("/"),
-          data: await readFile5(path),
+          data: await readFile4(path),
           contentType: contentType(path)
         });
       }
@@ -15331,13 +15233,13 @@ async function findWranglerConfig(root, configuredPath) {
         "Wrangler config escapes the application root."
       );
     }
-    await access4(resolved);
+    await access3(resolved);
     return resolved;
   }
   for (const name of ["wrangler.jsonc", "wrangler.json"]) {
-    const path = join6(root, name);
+    const path = join4(root, name);
     try {
-      await access4(path);
+      await access3(path);
       return path;
     } catch {
     }
@@ -15347,11 +15249,26 @@ async function findWranglerConfig(root, configuredPath) {
     "A wrangler.jsonc or wrangler.json file is required."
   );
 }
+var OPEN_NEXT_LAYOUT = {
+  outputRoot: ".open-next",
+  bundleDir: ".open-next/worker-bundle"
+};
+var listFiles = (root) => listArtifactFiles(root);
 async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
+  const configPath = await findWranglerConfig(appRoot, wranglerConfigPath);
+  return readWorkerArtifact(appRoot, identity, {
+    wranglerConfigPath: configPath,
+    ...OPEN_NEXT_LAYOUT
+  });
+}
+async function readWorkerArtifact(appRoot, identity, layout) {
   try {
-    const configPath = await findWranglerConfig(appRoot, wranglerConfigPath);
+    const configPath = await findWranglerConfig(
+      appRoot,
+      layout.wranglerConfigPath
+    );
     const metadata = parseJsonc(
-      await readFile5(configPath, "utf8")
+      await readFile4(configPath, "utf8")
     );
     if (typeof metadata.main !== "string" || typeof metadata.compatibility_date !== "string") {
       throw new DeploymentError(
@@ -15359,43 +15276,50 @@ async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
         "Wrangler metadata must declare main and compatibility_date."
       );
     }
-    const outputRoot = resolve(appRoot, ".open-next");
+    const configDir = dirname(configPath);
+    const outputRoot = confinedPath(appRoot, layout.outputRoot, "Output root");
     const entrypointPath = confinedPath(
       appRoot,
       metadata.main,
-      "Worker entrypoint"
+      "Worker entrypoint",
+      configDir
     );
     const entryRelation = relative(outputRoot, entrypointPath);
     if (entryRelation === ".." || entryRelation.startsWith(`..${sep}`) || isAbsolute(entryRelation)) {
       throw new DeploymentError(
         "ARTIFACT_INVALID",
-        "Worker entrypoint must be inside .open-next."
+        `Worker entrypoint must be inside ${layout.outputRoot}.`
       );
     }
-    await access4(entrypointPath);
-    const configuredAssets = typeof metadata.assets?.directory === "string" ? confinedPath(appRoot, metadata.assets.directory, "Assets directory") : join6(outputRoot, "assets");
+    await access3(entrypointPath);
+    const configuredAssets = typeof metadata.assets?.directory === "string" ? confinedPath(
+      appRoot,
+      metadata.assets.directory,
+      "Assets directory",
+      configDir
+    ) : join4(outputRoot, "assets");
     const assetsRelation = relative(outputRoot, configuredAssets);
     if (assetsRelation === ".." || assetsRelation.startsWith(`..${sep}`) || isAbsolute(assetsRelation)) {
       throw new DeploymentError(
         "ARTIFACT_INVALID",
-        "Assets directory must be inside .open-next."
+        `Assets directory must be inside ${layout.outputRoot}.`
       );
     }
-    const bundleRoot = join6(outputRoot, "worker-bundle");
+    const bundleRoot = confinedPath(appRoot, layout.bundleDir, "Bundle dir");
     let bundleFiles = null;
     try {
-      await access4(bundleRoot);
+      await access3(bundleRoot);
       bundleFiles = await listFiles(bundleRoot);
     } catch {
     }
     const outputFiles = bundleFiles ?? await listFiles(outputRoot);
-    const entrypointName = bundleFiles ? "worker.js" : relative(outputRoot, entrypointPath).split(sep).join("/");
+    const entrypointName = bundleFiles ? basename(entrypointPath) : relative(outputRoot, entrypointPath).split(sep).join("/");
     const assetsPrefix = `${relative(outputRoot, configuredAssets).split(sep).join("/")}/`;
     const entrypoint = outputFiles.find((file2) => file2.name === entrypointName);
     if (!entrypoint)
       throw new DeploymentError(
         "ARTIFACT_INVALID",
-        "OpenNext worker entrypoint is missing."
+        "Worker entrypoint is missing from the build output."
       );
     return {
       ...identity,
@@ -15414,28 +15338,483 @@ async function readOpenNextArtifact(appRoot, identity, wranglerConfigPath) {
     if (error51 instanceof DeploymentError) throw error51;
     throw new DeploymentError(
       "ARTIFACT_INVALID",
-      "Could not read the OpenNext deployment output.",
+      "Could not read the Worker build output.",
       { cause: error51 }
     );
   }
 }
 
-// ../../packages/build/src/process.ts
-import { spawn } from "child_process";
-import { createInterface } from "readline";
-
-// ../../packages/build/src/redact.ts
-var SECRET_ASSIGNMENT = /\b(CLOUDFLARE_API_TOKEN|SUPABASE_SERVICE_ROLE_KEY|BUILD_CALLBACK_SECRET)=([^\s]+)/gi;
-function redactLog(message) {
-  return message.replace(/\bBearer\s+[^\s]+/gi, "Bearer [REDACTED]").replace(/(https?:\/\/)[^/@\s]+@/gi, "$1[REDACTED]@").replace(SECRET_ASSIGNMENT, "$1=[REDACTED]");
+// ../../packages/build/src/platform-config.ts
+import { access as access4, writeFile as writeFile3 } from "fs/promises";
+import { createRequire } from "module";
+import { join as join5 } from "path";
+var COMPATIBILITY_DATE = "2026-08-19";
+var NEXT_CONFIG_FILES = [
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.cjs",
+  "next.config.ts"
+];
+async function pathExists(path) {
+  try {
+    await access4(path);
+    return true;
+  } catch {
+    return false;
+  }
 }
-
-// ../../packages/build/src/process.ts
-var CommandExecutionError = class extends DeploymentError {
-  exitCode;
-  timedOut;
-  constructor(code, message, options) {
-    super(
+async function createPackageManagerConfig(appRoot, writer = async (path, contents) => {
+  await writeFile3(path, contents, "utf8");
+}) {
+  const packageManagerConfigPath = join5(appRoot, ".next-deploy-user.npmrc");
+  await writer(
+    packageManagerConfigPath,
+    "# Host package-manager credentials are intentionally unavailable.\n"
+  );
+  return packageManagerConfigPath;
+}
+async function createPlatformBuildConfig(appRoot, deploymentId, writer = async (path, contents) => {
+  await writeFile3(path, contents, "utf8");
+}, cloudflareModulePath = createRequire(import.meta.url).resolve(
+  "@opennextjs/cloudflare"
+), exists5 = pathExists) {
+  const openNextConfigPath = join5(appRoot, ".next-deploy-open-next.config.mjs");
+  const wranglerConfigPath = join5(appRoot, ".next-deploy-wrangler.json");
+  const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
+  let hasNextConfig = false;
+  for (const name of NEXT_CONFIG_FILES) {
+    if (await exists5(join5(appRoot, name))) {
+      hasNextConfig = true;
+      break;
+    }
+  }
+  if (!hasNextConfig) {
+    await writer(
+      join5(appRoot, "next.config.mjs"),
+      'export default { output: "standalone" };\n'
+    );
+  }
+  await writer(
+    openNextConfigPath,
+    `import { defineCloudflareConfig } from ${JSON.stringify(cloudflareModulePath)};
+
+export default defineCloudflareConfig({});
+`
+  );
+  await writer(
+    wranglerConfigPath,
+    `${JSON.stringify(
+      {
+        name: `next-deploy-${safeDeploymentId}`,
+        main: ".open-next/worker.js",
+        compatibility_date: COMPATIBILITY_DATE,
+        compatibility_flags: ["nodejs_compat"],
+        assets: {
+          directory: ".open-next/assets",
+          binding: "ASSETS"
+        }
+      },
+      null,
+      2
+    )}
+`
+  );
+  const packageManagerConfigPath = await createPackageManagerConfig(
+    appRoot,
+    writer
+  );
+  return {
+    openNextConfigPath,
+    wranglerConfigPath,
+    packageManagerConfigPath
+  };
+}
+
+// ../../packages/build/src/vinext.ts
+var VINEXT_TOOLCHAIN = [
+  "vinext@1.0.0-beta.9",
+  "@cloudflare/vite-plugin@1.54.7",
+  "@vitejs/plugin-react@6.1.1",
+  "@vitejs/plugin-rsc@0.5.34",
+  "react-server-dom-webpack@19.2.8",
+  "vite@8.2.2"
+];
+var VINEXT_COMPATIBILITY_DATE = COMPATIBILITY_DATE;
+var VITE_CONFIG_NAMES = [
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.cjs",
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.cts"
+];
+var GENERATED_VITE_CONFIG = "vite.config.mjs";
+var OUTPUT_DIR = "dist";
+var SERVER_DIR = "server";
+var CLIENT_DIR = "client";
+var WRANGLER_OUTPUT_NAME = "wrangler.json";
+async function exists3(path) {
+  try {
+    await access5(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createVinextBuildConfig(appRoot, deploymentId, writer = async (path, contents) => {
+  await writeFile4(path, contents, "utf8");
+}) {
+  for (const name of VITE_CONFIG_NAMES) {
+    if (await exists3(join6(appRoot, name))) {
+      throw new DeploymentError(
+        "ARTIFACT_INVALID",
+        `The project already has a ${name}. vinext offers no way to point at a different config, and overwriting it would change how the project's own tooling builds.`
+      );
+    }
+  }
+  const safeDeploymentId = deploymentId.replace(/[^a-z0-9-]/gi, "-");
+  const viteConfigPath = join6(appRoot, GENERATED_VITE_CONFIG);
+  const wranglerConfigPath = join6(appRoot, "wrangler.jsonc");
+  await writer(
+    viteConfigPath,
+    [
+      'import { defineConfig } from "vite";',
+      'import vinext from "vinext";',
+      'import { cloudflare } from "@cloudflare/vite-plugin";',
+      "",
+      "export default defineConfig({",
+      "  plugins: [",
+      "    vinext(),",
+      '    cloudflare({ viteEnvironment: { name: "rsc", childEnvironments: ["ssr"] } }),',
+      "  ],",
+      "});",
+      ""
+    ].join("\n")
+  );
+  await writer(
+    wranglerConfigPath,
+    `${JSON.stringify(
+      {
+        name: `naro-vinext-${safeDeploymentId}`,
+        compatibility_date: VINEXT_COMPATIBILITY_DATE,
+        compatibility_flags: ["nodejs_compat"],
+        main: "vinext/server/fetch-handler",
+        assets: {
+          directory: `${OUTPUT_DIR}/${CLIENT_DIR}`,
+          binding: "ASSETS"
+        }
+      },
+      null,
+      2
+    )}
+`
+  );
+  return { viteConfigPath, wranglerConfigPath };
+}
+var AUTO_FIXED_ISSUES = [/Missing "type": "module"/i];
+var ISSUE_LINE = /^\s*✗\s+(.+)$/;
+var ANSI_ESCAPE = /\u001B\[[0-9;]*m/g;
+var SUMMARY_LINE = /Overall:\s*(\d+)%\s*compatible\s*\(\s*(\d+)\s+supported,\s*(\d+)\s+partial,\s*(\d+)\s+issues?\s*\)/i;
+function parseVinextCheckReport(output) {
+  const plain = output.replace(ANSI_ESCAPE, "");
+  const match = SUMMARY_LINE.exec(plain);
+  if (!match) return null;
+  const issueLines = [
+    ...new Set(
+      plain.split("\n").map((line) => ISSUE_LINE.exec(line)?.[1]?.trim()).filter((line) => Boolean(line))
+    )
+  ];
+  return {
+    percent: Number(match[1]),
+    supported: Number(match[2]),
+    partial: Number(match[3]),
+    issues: Number(match[4]),
+    issueLines
+  };
+}
+function vinextRouteFromCheck(report) {
+  if (!report)
+    return {
+      eligible: false,
+      reason: "vinext check output could not be read; staying on OpenNext. Expected if vinext changed its report format."
+    };
+  const autoFixed = report.issueLines.filter(
+    (line) => AUTO_FIXED_ISSUES.some((pattern) => pattern.test(line))
+  );
+  const blocking = Math.max(0, report.issues - autoFixed.length);
+  if (blocking > 0)
+    return {
+      eligible: false,
+      reason: `vinext check reported ${blocking} unsupported item(s) (${report.percent}% compatible); staying on OpenNext.`
+    };
+  if (autoFixed.length > 0)
+    return {
+      eligible: true,
+      reason: `vinext check found only issues vinext build fixes itself (${autoFixed.join("; ")}); attempting a vinext build.`
+    };
+  return {
+    eligible: true,
+    reason: report.partial > 0 ? `vinext check found no blocking issues (${report.partial} partially supported); attempting a vinext build.` : "vinext check found no issues; attempting a vinext build."
+  };
+}
+function globToRegExp(glob) {
+  let source = "";
+  for (let index = 0; index < glob.length; index += 1) {
+    const char = glob[index];
+    if (char !== "*") {
+      source += char?.replace(/[.+?^${}()|[\]\\]/g, String.raw`\$&`) ?? "";
+      continue;
+    }
+    if (glob[index + 1] !== "*") {
+      source += "[^/]*";
+      continue;
+    }
+    if (glob[index + 2] === "/") {
+      source += "(?:[^/]*/)*";
+      index += 2;
+    } else {
+      source += ".*";
+      index += 1;
+    }
+  }
+  return new RegExp(`^${source}$`);
+}
+function moduleMatchers(rules) {
+  if (!Array.isArray(rules)) return [];
+  return rules.flatMap((rule) => {
+    const globs = rule.globs;
+    return Array.isArray(globs) ? globs : [];
+  }).filter((glob) => typeof glob === "string").map(globToRegExp);
+}
+async function readVinextArtifact(appRoot, identity) {
+  try {
+    const outputRoot = resolve2(appRoot, OUTPUT_DIR);
+    const serverRoot = join6(outputRoot, SERVER_DIR);
+    const clientRoot = join6(outputRoot, CLIENT_DIR);
+    const configPath = join6(serverRoot, WRANGLER_OUTPUT_NAME);
+    if (!await exists3(configPath)) {
+      throw new DeploymentError(
+        "ARTIFACT_INVALID",
+        `vinext build produced no ${OUTPUT_DIR}/${SERVER_DIR}/${WRANGLER_OUTPUT_NAME}.`
+      );
+    }
+    const metadata = JSON.parse(
+      await readFile5(configPath, "utf8")
+    );
+    if (typeof metadata.main !== "string" || typeof metadata.compatibility_date !== "string") {
+      throw new DeploymentError(
+        "ARTIFACT_INVALID",
+        "vinext wrangler output must declare main and compatibility_date."
+      );
+    }
+    const entrypointName = metadata.main.split(/[\\/]/).join("/");
+    const matchers = moduleMatchers(metadata.rules);
+    const isModule = (name) => matchers.length === 0 || matchers.some((matcher) => matcher.test(name));
+    const serverFiles = await listArtifactFiles(serverRoot, "vinext");
+    const entrypoint = serverFiles.find((file2) => file2.name === entrypointName);
+    if (!entrypoint) {
+      throw new DeploymentError(
+        "ARTIFACT_INVALID",
+        `vinext worker entrypoint "${entrypointName}" is missing from the build output.`
+      );
+    }
+    return {
+      ...identity,
+      entrypoint,
+      modules: serverFiles.filter(
+        (file2) => file2.name !== entrypointName && file2.name !== WRANGLER_OUTPUT_NAME && !file2.name.endsWith(".map") && isModule(file2.name)
+      ),
+      assets: await listArtifactFiles(clientRoot, "vinext"),
+      compatibilityDate: metadata.compatibility_date,
+      compatibilityFlags: Array.isArray(metadata.compatibility_flags) ? metadata.compatibility_flags.filter(
+        (flag) => typeof flag === "string"
+      ) : [],
+      assetsBinding: typeof metadata.assets?.binding === "string" ? metadata.assets.binding : "ASSETS"
+    };
+  } catch (error51) {
+    if (error51 instanceof DeploymentError) throw error51;
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      "Could not read the vinext deployment output.",
+      { cause: error51 }
+    );
+  }
+}
+
+// ../../packages/build/src/frameworks.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join as join7 } from "path";
+var FRAMEWORK_PRESETS = {
+  next: {
+    id: "next",
+    detectDependency: "next",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: ".open-next",
+    needsServerRuntime: true,
+    spaFallback: false,
+    cachePath: ".next/cache"
+  },
+  "next-export": {
+    id: "next-export",
+    detectDependency: "next",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "out",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: ".next/cache"
+  },
+  vite: {
+    id: "vite",
+    detectDependency: "vite",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "dist",
+    needsServerRuntime: false,
+    spaFallback: true,
+    cachePath: "node_modules/.vite"
+  },
+  cra: {
+    id: "cra",
+    detectDependency: "react-scripts",
+    defaultBuildScript: "build",
+    defaultOutputDirectory: "build",
+    needsServerRuntime: false,
+    spaFallback: true,
+    cachePath: "node_modules/.cache"
+  },
+  static: {
+    id: "static",
+    detectDependency: null,
+    defaultBuildScript: null,
+    defaultOutputDirectory: ".",
+    needsServerRuntime: false,
+    spaFallback: false,
+    cachePath: null
+  }
+};
+var DETECTION_ORDER = ["next", "vite", "cra"];
+var FRAMEWORK_LABELS = {
+  next: "Next.js",
+  "next-export": "Next.js static export",
+  vite: "Vite",
+  cra: "Create React App",
+  static: "static files"
+};
+function dependencyVersion(packageJson, name) {
+  const version2 = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+  return typeof version2 === "string" && version2.trim() !== "" ? version2 : null;
+}
+var STATIC_EXPORT = /(?:^|[\s,{;])output\s*:\s*(["'`])export\1/;
+function declaresStaticExport(source) {
+  const code = source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/.*$/gm, "$1");
+  return STATIC_EXPORT.test(code);
+}
+async function usesStaticExport(root) {
+  for (const name of NEXT_CONFIG_FILES) {
+    try {
+      return declaresStaticExport(await readFile6(join7(root, name), "utf8"));
+    } catch {
+      continue;
+    }
+  }
+  return false;
+}
+async function readPackageJson(root) {
+  let source;
+  try {
+    source = await readFile6(join7(root, "package.json"), "utf8");
+  } catch (error51) {
+    if (error51.code === "ENOENT") return null;
+    throw new DeploymentError(
+      "FRAMEWORK_DETECTION_FAILED",
+      "Could not read package.json.",
+      { cause: error51 }
+    );
+  }
+  try {
+    return JSON.parse(source);
+  } catch (error51) {
+    throw new DeploymentError(
+      "FRAMEWORK_DETECTION_FAILED",
+      "The selected root does not contain a valid package.json.",
+      { cause: error51 }
+    );
+  }
+}
+async function detectFramework(root, overrides = {}) {
+  const packageJson = await readPackageJson(root);
+  let preset;
+  if (overrides.framework) {
+    const candidate = FRAMEWORK_PRESETS[overrides.framework] ?? null;
+    if (!candidate || candidate.id !== overrides.framework)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        `Unknown framework "${overrides.framework}".`
+      );
+    preset = candidate;
+  } else if (!packageJson) {
+    preset = FRAMEWORK_PRESETS.static;
+  } else {
+    const detected = DETECTION_ORDER.map((id) => FRAMEWORK_PRESETS[id]).find(
+      (candidate) => candidate.detectDependency !== null && dependencyVersion(packageJson, candidate.detectDependency) !== null
+    );
+    if (!detected)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        "Could not detect the project framework from package.json. Set a framework (and build command / output directory) in the project settings."
+      );
+    preset = detected;
+  }
+  if (preset.id === "next" && await usesStaticExport(root))
+    preset = FRAMEWORK_PRESETS["next-export"];
+  const buildScript = overrides.buildCommand ?? preset.defaultBuildScript;
+  if (buildScript !== null) {
+    if (!packageJson)
+      throw new DeploymentError(
+        "FRAMEWORK_DETECTION_FAILED",
+        "A build command requires a package.json."
+      );
+    if (typeof packageJson.scripts?.[buildScript] !== "string")
+      throw new DeploymentError(
+        "BUILD_FAILED",
+        `The project must declare a "${buildScript}" script.`
+      );
+  }
+  const version2 = packageJson && preset.detectDependency ? dependencyVersion(packageJson, preset.detectDependency) : null;
+  return {
+    preset,
+    buildScript,
+    outputDirectory: overrides.outputDirectory ?? preset.defaultOutputDirectory,
+    description: version2 ? `${FRAMEWORK_LABELS[preset.id]} ${version2}` : FRAMEWORK_LABELS[preset.id],
+    dependencyRange: version2
+  };
+}
+
+// ../../packages/build/src/process.ts
+import { spawn } from "child_process";
+import { createInterface } from "readline";
+
+// ../../packages/build/src/log-format.ts
+var CSI_SEQUENCE = /\u001B\[[0-9;?]*[\u0020-\u002F]*[@-~]/g;
+var OSC_SEQUENCE = /\u001B\][^\u0007\u001B]*(?:\u0007|\u001B\\)/g;
+function formatLogLine(raw) {
+  const line = raw.replace(/\r+$/, "");
+  const lastFrame = line.slice(line.lastIndexOf("\r") + 1);
+  const plain = lastFrame.replace(OSC_SEQUENCE, "").replace(CSI_SEQUENCE, "").trimEnd();
+  return plain.trim() === "" ? null : plain;
+}
+
+// ../../packages/build/src/redact.ts
+var SECRET_ASSIGNMENT = /\b(CLOUDFLARE_API_TOKEN|SUPABASE_SERVICE_ROLE_KEY|BUILD_CALLBACK_SECRET)=([^\s]+)/gi;
+function redactLog(message) {
+  return message.replace(/\bBearer\s+[^\s]+/gi, "Bearer [REDACTED]").replace(/(https?:\/\/)[^/@\s]+@/gi, "$1[REDACTED]@").replace(SECRET_ASSIGNMENT, "$1=[REDACTED]");
+}
+
+// ../../packages/build/src/process.ts
+var CommandExecutionError = class extends DeploymentError {
+  exitCode;
+  timedOut;
+  constructor(code, message, options) {
+    super(
       code,
       message,
       options.cause === void 0 ? void 0 : { cause: options.cause }
@@ -15457,202 +15836,1537 @@ var PASSTHROUGH_ENVIRONMENT = [
   "COREPACK_HOME",
   "XDG_CACHE_HOME"
 ];
-var MAX_CAPTURED_LINES = 2e3;
-function commandEnvironment(overrides) {
-  const environment = {
-    NODE_ENV: process.env.NODE_ENV ?? "production"
+var MAX_CAPTURED_LINES = 2e3;
+function commandEnvironment(overrides) {
+  const environment = {
+    NODE_ENV: process.env.NODE_ENV ?? "production"
+  };
+  for (const name of PASSTHROUGH_ENVIRONMENT) {
+    const value = process.env[name];
+    if (value !== void 0) environment[name] = value;
+  }
+  return { ...environment, ...overrides };
+}
+var startProcess = (spec, observer) => {
+  const detached = process.platform !== "win32";
+  const child = spawn(spec.command, [...spec.args], {
+    cwd: spec.cwd,
+    shell: false,
+    env: commandEnvironment(spec.env),
+    detached,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const consume = async (input, level) => {
+    const lines = createInterface({ input });
+    for await (const message of lines) {
+      const formatted = formatLogLine(message);
+      if (formatted === null) continue;
+      await observer.onLog({
+        level,
+        stage: spec.stage,
+        message: redactLog(formatted)
+      });
+    }
+  };
+  const outputComplete = Promise.all([
+    consume(child.stdout, "INFO"),
+    consume(child.stderr, "WARN")
+  ]);
+  const kill = (signal) => {
+    if (detached && child.pid) {
+      try {
+        process.kill(-child.pid, signal);
+        return;
+      } catch {
+      }
+    }
+    child.kill(signal);
+  };
+  let exitCode = null;
+  let done = false;
+  const exited = new Promise((resolveExit) => {
+    child.once("error", (error51) => {
+      done = true;
+      void observer.onLog({
+        level: "WARN",
+        stage: spec.stage,
+        message: `Could not start ${spec.command}: ${error51.message}`
+      });
+      resolveExit(null);
+    });
+    child.once("close", (code) => {
+      done = true;
+      exitCode = code;
+      resolveExit(code);
+    });
+  });
+  let stopping;
+  return {
+    exited,
+    stop: () => {
+      stopping ??= (async () => {
+        if (!done) {
+          kill("SIGTERM");
+          const forceKill = setTimeout(() => kill("SIGKILL"), 2e3);
+          forceKill.unref();
+          await exited;
+          clearTimeout(forceKill);
+        }
+        await outputComplete;
+        void exitCode;
+      })();
+      return stopping;
+    }
+  };
+};
+async function runCommand(spec, observer) {
+  const detached = process.platform !== "win32";
+  const child = spawn(spec.command, [...spec.args], {
+    cwd: spec.cwd,
+    shell: false,
+    env: commandEnvironment(spec.env),
+    detached,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let timedOut = false;
+  const captured = { stdout: [], stderr: [] };
+  const consume = async (input, level) => {
+    const lines = createInterface({ input });
+    for await (const message of lines) {
+      const output = captured[level === "INFO" ? "stdout" : "stderr"];
+      if (output.length < MAX_CAPTURED_LINES) output.push(message);
+      const formatted = formatLogLine(message);
+      if (formatted === null) continue;
+      await observer.onLog({
+        level,
+        stage: spec.stage,
+        message: redactLog(formatted)
+      });
+    }
+  };
+  const outputComplete = Promise.all([
+    consume(child.stdout, "INFO"),
+    consume(child.stderr, "ERROR")
+  ]);
+  const kill = (signal) => {
+    if (detached && child.pid) {
+      try {
+        process.kill(-child.pid, signal);
+        return;
+      } catch {
+      }
+    }
+    child.kill(signal);
+  };
+  let forceKill;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    kill("SIGTERM");
+    forceKill = setTimeout(() => kill("SIGKILL"), 2e3);
+    forceKill.unref();
+  }, spec.timeoutMs);
+  const outcome = await new Promise((resolveOutcome) => {
+    child.once("error", (error51) => resolveOutcome({ type: "error", error: error51 }));
+    child.once(
+      "close",
+      (exitCode, signal) => resolveOutcome({ type: "close", exitCode, signal })
+    );
+  });
+  clearTimeout(timeout);
+  if (forceKill) clearTimeout(forceKill);
+  await outputComplete;
+  if (outcome.type === "error") {
+    throw new CommandExecutionError(
+      spec.errorCode,
+      `Could not start ${spec.command}`,
+      {
+        exitCode: null,
+        timedOut,
+        cause: outcome.error
+      }
+    );
+  }
+  if (timedOut) {
+    throw new CommandExecutionError(
+      spec.errorCode,
+      `${spec.command} exceeded its ${spec.timeoutMs}ms time limit`,
+      { exitCode: outcome.exitCode, timedOut: true }
+    );
+  }
+  if (outcome.exitCode !== 0) {
+    throw new CommandExecutionError(
+      spec.errorCode,
+      `${spec.command} exited with code ${String(outcome.exitCode)}${outcome.signal ? ` (${outcome.signal})` : ""}`,
+      { exitCode: outcome.exitCode, timedOut: false }
+    );
+  }
+  return captured;
+}
+
+// ../../packages/build/src/repository.ts
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3 } from "path";
+function resolveAppRoot(checkout, configuredRoot) {
+  const checkoutRoot = resolve3(checkout);
+  if (!configuredRoot) return checkoutRoot;
+  if (isAbsolute2(configuredRoot)) {
+    throw new Error("Configured root directory escapes repository");
+  }
+  const appRoot = resolve3(checkoutRoot, configuredRoot);
+  const relativeRoot = relative2(checkoutRoot, appRoot);
+  if (relativeRoot === ".." || relativeRoot.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute2(relativeRoot)) {
+    throw new Error("Configured root directory escapes repository");
+  }
+  return appRoot;
+}
+
+// ../../packages/build/src/static-artifact.ts
+import { readdir as readdir2, readFile as readFile7 } from "fs/promises";
+import { isAbsolute as isAbsolute3, join as join8, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
+var SHIM_WORKER_SOURCE = "export default { fetch: (request, env) => env.ASSETS.fetch(request) };\n";
+var EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules"]);
+var ALLOWED_DOTFILE = ".well-known";
+function excluded(name) {
+  if (name === ALLOWED_DOTFILE) return false;
+  return name.startsWith(".") || EXCLUDED_DIRECTORIES.has(name);
+}
+async function readStaticArtifact(appRoot, outputDirectory, identity, options, onWarn) {
+  if (isAbsolute3(outputDirectory))
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      "Output directory must be relative to the application root."
+    );
+  const outputRoot = resolve4(appRoot, outputDirectory);
+  const relation = relative3(appRoot, outputRoot);
+  if (relation === ".." || relation.startsWith(`..${sep2}`) || isAbsolute3(relation))
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      "Output directory escapes the application root."
+    );
+  const assets = [];
+  async function visit(directory) {
+    const entries = await readdir2(directory, { withFileTypes: true });
+    for (const entry of entries.sort(
+      (left, right) => left.name.localeCompare(right.name)
+    )) {
+      if (excluded(entry.name)) continue;
+      const path = join8(directory, entry.name);
+      if (entry.isSymbolicLink())
+        throw new DeploymentError(
+          "ARTIFACT_INVALID",
+          "Static output cannot contain symbolic links."
+        );
+      if (entry.isDirectory()) await visit(path);
+      else if (entry.isFile()) {
+        assets.push({
+          name: relative3(outputRoot, path).split(sep2).join("/"),
+          data: await readFile7(path),
+          contentType: contentType(path)
+        });
+      }
+    }
+  }
+  try {
+    await visit(outputRoot);
+  } catch (error51) {
+    if (error51 instanceof DeploymentError) throw error51;
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      `Could not read the build output directory "${outputDirectory}".`,
+      { cause: error51 }
+    );
+  }
+  if (assets.length === 0)
+    throw new DeploymentError(
+      "ARTIFACT_INVALID",
+      `The build output directory "${outputDirectory}" contains no files.`
+    );
+  if (!assets.some((file2) => file2.name === "index.html"))
+    await onWarn?.(
+      `No index.html in "${outputDirectory}" \u2014 the site root will not serve a page.`
+    );
+  return {
+    ...identity,
+    entrypoint: {
+      name: "worker.js",
+      data: new TextEncoder().encode(SHIM_WORKER_SOURCE),
+      contentType: "application/javascript"
+    },
+    modules: [],
+    assets,
+    compatibilityDate: COMPATIBILITY_DATE,
+    compatibilityFlags: [],
+    assetsBinding: "ASSETS",
+    assetsConfig: {
+      notFoundHandling: options.spaFallback ? "single-page-application" : "404-page"
+    }
+  };
+}
+
+// ../../packages/build/src/strategy/fingerprint.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile8 } from "fs/promises";
+import { join as join9, relative as relative4, sep as sep3 } from "path";
+var APP_ROOT_FILES = [
+  "package.json",
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.cjs",
+  "next.config.ts",
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs",
+  "open-next.config.ts",
+  "open-next.config.js",
+  "open-next.config.mjs",
+  "wrangler.jsonc",
+  "wrangler.json",
+  "wrangler.toml",
+  "vinext.config.ts",
+  "vinext.config.js",
+  "vinext.config.mjs",
+  ".vinextrc"
+];
+var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mjs", "mts"];
+var SOURCE_FILES = ["middleware", "proxy", "src/middleware", "src/proxy"];
+var CHECKOUT_FILES = [
+  "package.json",
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-workspace.yaml",
+  ".npmrc"
+];
+function sha256(data) {
+  return createHash3("sha256").update(data).digest("hex");
+}
+async function hashFile(path) {
+  try {
+    return sha256(await readFile8(path));
+  } catch {
+    return null;
+  }
+}
+async function hashStrategyInputs(checkout, appRoot) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const name of CHECKOUT_FILES) candidates.add(join9(checkout, name));
+  for (const name of APP_ROOT_FILES) candidates.add(join9(appRoot, name));
+  for (const base2 of SOURCE_FILES) {
+    for (const ext of SOURCE_EXTENSIONS) {
+      candidates.add(join9(appRoot, `${base2}.${ext}`));
+    }
+  }
+  const entries = [];
+  for (const path of candidates) {
+    const digest = await hashFile(path);
+    if (digest === null) continue;
+    entries.push([relative4(checkout, path).split(sep3).join("/"), digest]);
+  }
+  return entries.toSorted(
+    ([left], [right]) => left < right ? -1 : left > right ? 1 : 0
+  );
+}
+async function computeStrategyFingerprint(input) {
+  const entries = input.entries ?? await hashStrategyInputs(input.checkout, input.appRoot);
+  const lines = [
+    `next=${input.nextVersion}`,
+    `root=${input.rootDirectory ?? ""}`,
+    `vinext=${input.vinextEnabled ? "on" : "off"}`,
+    ...entries.map(([name, digest]) => `${name}\0${digest}`)
+  ];
+  return {
+    hash: sha256(lines.join("\n")),
+    inputs: entries.map(([name]) => name)
   };
-  for (const name of PASSTHROUGH_ENVIRONMENT) {
-    const value = process.env[name];
-    if (value !== void 0) environment[name] = value;
+}
+
+// ../../packages/build/src/strategy/project-facts.ts
+import { access as access6, readFile as readFile9 } from "fs/promises";
+import { join as join10 } from "path";
+var SOURCE_EXTENSIONS2 = ["ts", "tsx", "js", "jsx", "mjs", "mts"];
+var SOURCE_DIRECTORIES = ["", "src"];
+var VITE_CONFIGS = [
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs"
+];
+async function exists4(path) {
+  try {
+    await access6(path);
+    return true;
+  } catch {
+    return false;
   }
-  return { ...environment, ...overrides };
 }
-async function runCommand(spec, observer) {
-  const detached = process.platform !== "win32";
-  const child = spawn(spec.command, [...spec.args], {
-    cwd: spec.cwd,
-    shell: false,
-    env: commandEnvironment(spec.env),
-    detached,
-    stdio: ["ignore", "pipe", "pipe"]
+async function findSourceFile(appRoot, basename4) {
+  for (const dir of SOURCE_DIRECTORIES) {
+    for (const ext of SOURCE_EXTENSIONS2) {
+      const rel = dir ? `${dir}/${basename4}.${ext}` : `${basename4}.${ext}`;
+      if (await exists4(join10(appRoot, rel))) return rel;
+    }
+  }
+  return null;
+}
+function matcherRoutesFromSource(source) {
+  const matcher = /matcher\s*:\s*(\[[\s\S]*?\]|["'`][^"'`]*["'`])/.exec(source);
+  if (!matcher?.[1]) return [];
+  const literals = [...matcher[1].matchAll(/["'`]([^"'`]*)["'`]/g)].map((entry) => entry[1] ?? "").map((entry) => entry.trim());
+  const routes = /* @__PURE__ */ new Set();
+  for (const literal2 of literals) {
+    if (!literal2.startsWith("/")) continue;
+    if (/[:*+?()[\]{}\\|]/.test(literal2)) continue;
+    routes.add(literal2);
+    if (routes.size >= 5) break;
+  }
+  return [...routes];
+}
+async function readIfExists(path) {
+  try {
+    return await readFile9(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function collectProjectFacts(appRoot) {
+  const proxyFile = await findSourceFile(appRoot, "proxy");
+  const middlewareFile = await findSourceFile(appRoot, "middleware");
+  const routeSourceFile = middlewareFile ?? proxyFile;
+  const routeSource = routeSourceFile ? await readIfExists(join10(appRoot, routeSourceFile)) : null;
+  let usesVinext = false;
+  let nextSpec = null;
+  const packageJsonSource = await readIfExists(join10(appRoot, "package.json"));
+  if (packageJsonSource) {
+    try {
+      const packageJson = JSON.parse(packageJsonSource);
+      const dependency = (name) => {
+        const value = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+        return typeof value === "string" ? value : null;
+      };
+      nextSpec = dependency("next");
+      if (dependency("vinext") !== null) {
+        for (const name of VITE_CONFIGS) {
+          const config2 = await readIfExists(join10(appRoot, name));
+          if (config2 && /\bvinext\s*\(/.test(config2) && /@cloudflare\/vite-plugin/.test(config2)) {
+            usesVinext = true;
+            break;
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return {
+    proxyFile,
+    middlewareFile,
+    matcherRoutes: routeSource ? matcherRoutesFromSource(routeSource) : [],
+    usesVinext,
+    nextSpec
+  };
+}
+
+// ../../packages/build/src/strategy/resolver.ts
+function label(strategy) {
+  return `P${String(strategy.priority)} ${strategy.id}`;
+}
+function describeOutcome(outcome) {
+  switch (outcome.status) {
+    case "success":
+      return "succeeded";
+    case "failed":
+      return `failed at ${outcome.stage}: ${outcome.reason}`;
+    case "skipped":
+      return `skipped: ${outcome.reason}`;
+  }
+}
+async function evaluateOne(strategy, context, observer) {
+  let outcome;
+  try {
+    outcome = await strategy.evaluate(context, observer);
+  } catch (error51) {
+    outcome = {
+      status: "failed",
+      stage: "build",
+      reason: error51 instanceof Error ? error51.message : String(error51)
+    };
+  }
+  await observer.onLog({
+    level: outcome.status === "success" ? "INFO" : "WARN",
+    stage: "BUILDING",
+    message: `${label(strategy)} ${describeOutcome(outcome)}.`
   });
-  let timedOut = false;
-  const captured = { stdout: [], stderr: [] };
-  const consume = async (input, level) => {
-    const lines = createInterface({ input });
-    for await (const message of lines) {
-      const output = captured[level === "INFO" ? "stdout" : "stderr"];
-      if (output.length < MAX_CAPTURED_LINES) output.push(message);
+  return { id: strategy.id, priority: strategy.priority, outcome };
+}
+async function runPool(tasks, limit) {
+  const results = Array.from({ length: tasks.length });
+  let next = 0;
+  const workers = Array.from(
+    { length: Math.max(1, Math.min(limit, tasks.length)) },
+    async () => {
+      for (; ; ) {
+        const index = next++;
+        const task = tasks[index];
+        if (!task) return;
+        results[index] = await task();
+      }
+    }
+  );
+  await Promise.all(workers);
+  return results;
+}
+function pickBest(candidates, attempts) {
+  const successes = attempts.filter(
+    (attempt) => attempt.outcome.status === "success"
+  ).toSorted((left, right) => left.priority - right.priority);
+  const best = successes[0];
+  if (!best) return null;
+  const strategy = candidates.find((candidate) => candidate.id === best.id);
+  return strategy ? { strategy, outcome: best.outcome } : null;
+}
+function record2(strategy, outcome, context, options) {
+  return {
+    strategy: strategy.id,
+    priority: strategy.priority,
+    nextMajor: context.nextMajor,
+    ...outcome.variant ? { variant: outcome.variant } : {},
+    fingerprint: options.fingerprint,
+    resolvedAt: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+    deploymentId: context.identity.deploymentId
+  };
+}
+async function resolveDeploymentStrategy(strategies, context, observer, options) {
+  const ordered = strategies.toSorted(
+    (left, right) => left.priority - right.priority
+  );
+  const candidates = [];
+  for (const strategy of ordered) {
+    const support = strategy.supports(context);
+    if (support.supported) {
+      candidates.push(strategy);
+    } else {
       await observer.onLog({
-        level,
-        stage: spec.stage,
-        message: redactLog(message)
+        level: "INFO",
+        stage: "BUILDING",
+        message: `${label(strategy)} not a candidate: ${support.reason}`
       });
     }
-  };
-  const outputComplete = Promise.all([
-    consume(child.stdout, "INFO"),
-    consume(child.stderr, "ERROR")
-  ]);
-  const kill = (signal) => {
-    if (detached && child.pid) {
-      try {
-        process.kill(-child.pid, signal);
-        return;
-      } catch {
+  }
+  if (candidates.length === 0) {
+    throw new DeploymentError(
+      "NO_DEPLOYMENT_STRATEGY",
+      `No deployment strategy can build Next.js ${context.nextVersion} on this platform.`
+    );
+  }
+  const attempts = [];
+  const pinnedStrategy = options.pinned ? candidates.find((candidate) => candidate.id === options.pinned?.strategy) : void 0;
+  if (options.pinned && pinnedStrategy) {
+    const pinned = options.pinned;
+    const stale = pinned.fingerprint !== options.fingerprint ? "its inputs changed" : pinned.nextMajor !== context.nextMajor ? `Next.js moved from ${String(pinned.nextMajor)} to ${String(context.nextMajor)}` : null;
+    if (stale) {
+      await observer.onLog({
+        level: "INFO",
+        stage: "BUILDING",
+        message: `Stored strategy ${label(pinnedStrategy)} is stale (${stale}); resolving again.`
+      });
+    } else {
+      await observer.onLog({
+        level: "INFO",
+        stage: "BUILDING",
+        message: `Reusing stored strategy ${label(pinnedStrategy)}${pinned.variant ? ` (${pinned.variant})` : ""}.`
+      });
+      const attempt = await evaluateOne(
+        pinnedStrategy,
+        pinned.variant ? { ...context, pinnedVariant: pinned.variant } : context,
+        observer
+      );
+      attempts.push(attempt);
+      if (attempt.outcome.status === "success") {
+        const outcome = attempt.outcome;
+        const unchanged = (outcome.variant ?? null) === (pinned.variant ?? null);
+        return {
+          strategy: pinnedStrategy,
+          outcome,
+          record: unchanged ? pinned : record2(pinnedStrategy, outcome, context, options),
+          pinned: true,
+          attempts
+        };
       }
+      await observer.onLog({
+        level: "WARN",
+        stage: "BUILDING",
+        message: `Stored strategy ${label(pinnedStrategy)} no longer works; resolving again with the remaining candidates.`
+      });
     }
-    child.kill(signal);
-  };
-  let forceKill;
-  const timeout = setTimeout(() => {
-    timedOut = true;
-    kill("SIGTERM");
-    forceKill = setTimeout(() => kill("SIGKILL"), 2e3);
-    forceKill.unref();
-  }, spec.timeoutMs);
-  const outcome = await new Promise((resolveOutcome) => {
-    child.once("error", (error51) => resolveOutcome({ type: "error", error: error51 }));
-    child.once(
-      "close",
-      (exitCode, signal) => resolveOutcome({ type: "close", exitCode, signal })
+  } else if (options.pinned) {
+    await observer.onLog({
+      level: "INFO",
+      stage: "BUILDING",
+      message: `Stored strategy ${options.pinned.strategy} is not a candidate for this checkout; resolving again.`
+    });
+  }
+  const remaining = candidates.filter(
+    (candidate) => !attempts.some((attempt) => attempt.id === candidate.id)
+  );
+  await observer.onLog({
+    level: "INFO",
+    stage: "BUILDING",
+    message: `Resolving deployment strategy for Next.js ${context.nextVersion}: ${remaining.map(label).join(
+      ", "
+    )}${options.concurrency > 1 && remaining.length > 1 ? " (in parallel)" : ""}.`
+  });
+  if (options.concurrency > 1) {
+    const results = await runPool(
+      remaining.map(
+        (strategy) => () => evaluateOne(strategy, context, observer)
+      ),
+      options.concurrency
+    );
+    attempts.push(...results);
+  } else {
+    for (const strategy of remaining) {
+      const attempt = await evaluateOne(strategy, context, observer);
+      attempts.push(attempt);
+      if (attempt.outcome.status === "success") break;
+    }
+  }
+  const best = pickBest(candidates, attempts);
+  if (!best) {
+    throw new DeploymentError(
+      "NO_DEPLOYMENT_STRATEGY",
+      `No deployment strategy succeeded for Next.js ${context.nextVersion}: ${attempts.map(
+        (attempt) => `P${String(attempt.priority)} ${attempt.id} ${describeOutcome(attempt.outcome)}`
+      ).join("; ")}.`
     );
+  }
+  await observer.onLog({
+    level: "INFO",
+    stage: "BUILDING",
+    message: `Selected ${label(best.strategy)}${best.outcome.variant ? ` (${best.outcome.variant})` : ""}.`
   });
-  clearTimeout(timeout);
-  if (forceKill) clearTimeout(forceKill);
-  await outputComplete;
-  if (outcome.type === "error") {
-    throw new CommandExecutionError(
-      spec.errorCode,
-      `Could not start ${spec.command}`,
+  return {
+    strategy: best.strategy,
+    outcome: best.outcome,
+    record: record2(best.strategy, best.outcome, context, options),
+    pinned: false,
+    attempts
+  };
+}
+
+// ../../packages/build/src/strategy/smoke.ts
+import { createServer } from "net";
+function allocateLoopbackPort() {
+  return new Promise((resolvePort, rejectPort) => {
+    const server = createServer();
+    server.unref();
+    server.once("error", rejectPort);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address !== null ? address.port : null;
+      server.close(() => {
+        if (port === null) rejectPort(new Error("Could not allocate a port."));
+        else resolvePort(port);
+      });
+    });
+  });
+}
+function sleep(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+async function fetchStatus(fetchImpl, url2, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url2, {
+      method: "GET",
+      redirect: "manual",
+      signal: controller.signal,
+      headers: { "user-agent": "naro-smoke/1" }
+    });
+    await response.arrayBuffer().catch(() => void 0);
+    return { status: response.status };
+  } catch (error51) {
+    return { error: error51 instanceof Error ? error51.message : String(error51) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function probeOk(status) {
+  return status < 500;
+}
+function createSmokeTester(options = {}) {
+  const start = options.startProcess ?? startProcess;
+  const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+  const allocatePort = options.allocatePort ?? allocateLoopbackPort;
+  const pollIntervalMs = options.pollIntervalMs ?? 1e3;
+  async function runOnce(request, observer) {
+    const stage = request.stage ?? "BUILDING";
+    const errorCode = request.errorCode ?? "BUILD_FAILED";
+    const bootTimeoutMs = request.bootTimeoutMs ?? 9e4;
+    const probeTimeoutMs = request.probeTimeoutMs ?? 15e3;
+    const port = await allocatePort();
+    const origin = `http://127.0.0.1:${String(port)}`;
+    const boot = request.boot(port);
+    const recent = [];
+    const server = start(
+      { ...boot, stage, errorCode },
+      // The dev server is chatty; keep its stderr from reading as build
+      // errors in the deployment log.
       {
-        exitCode: null,
-        timedOut,
-        cause: outcome.error
+        ...observer,
+        onLog: (log2) => {
+          if (log2.message.trim() !== "") {
+            recent.push(log2.message.trim());
+            if (recent.length > 6) recent.shift();
+          }
+          return observer.onLog({
+            ...log2,
+            level: log2.level === "ERROR" ? "WARN" : log2.level
+          });
+        }
       }
     );
+    const probes = [];
+    const withOutput = (reason) => recent.length > 0 ? `${reason} Last output: ${recent.join(" | ")}` : reason;
+    try {
+      const deadline = Date.now() + bootTimeoutMs;
+      let booted = false;
+      let lastError = "no response";
+      while (Date.now() < deadline) {
+        const exit = await Promise.race([
+          server.exited.then((code) => ({ exited: code })),
+          sleep(0).then(() => null)
+        ]);
+        if (exit) {
+          return {
+            ok: false,
+            reason: withOutput(
+              `The server exited with code ${String(exit.exited)} before answering a request.`
+            ),
+            probes,
+            // The port was free when allocated and taken by the time the
+            // server bound it — a race, not a broken build.
+            portTaken: recent.some(
+              (line) => /EADDRINUSE|address already in use/i.test(line)
+            )
+          };
+        }
+        const answer = await fetchStatus(
+          fetchImpl,
+          `${origin}/`,
+          probeTimeoutMs
+        );
+        if ("status" in answer) {
+          booted = true;
+          break;
+        }
+        lastError = answer.error;
+        await sleep(pollIntervalMs);
+      }
+      if (!booted) {
+        return {
+          ok: false,
+          reason: withOutput(
+            `The server did not answer within ${String(bootTimeoutMs)}ms (${lastError}).`
+          ),
+          probes
+        };
+      }
+      for (const probe of request.probes) {
+        const answer = await fetchStatus(
+          fetchImpl,
+          `${origin}${probe.path}`,
+          probeTimeoutMs
+        );
+        const result = "status" in answer ? { ...probe, status: answer.status, ok: probeOk(answer.status) } : { ...probe, status: null, ok: false, detail: answer.error };
+        probes.push(result);
+        await observer.onLog({
+          level: result.ok ? "INFO" : "ERROR",
+          stage,
+          message: `Smoke ${probe.label}: GET ${probe.path} -> ${result.status === null ? result.detail ?? "no response" : String(result.status)}`
+        });
+      }
+      const failed2 = probes.filter((probe) => !probe.ok);
+      if (failed2.length > 0) {
+        return {
+          ok: false,
+          reason: `${String(failed2.length)} of ${String(probes.length)} smoke probes failed: ${failed2.map(
+            (probe) => `${probe.path} (${probe.status === null ? probe.detail ?? "no response" : String(probe.status)})`
+          ).join(", ")}.`,
+          probes
+        };
+      }
+      return { ok: true, probes };
+    } finally {
+      await server.stop();
+    }
+  }
+  return {
+    async run(request, observer) {
+      const first = await runOnce(request, observer);
+      if (first.ok || !first.portTaken) return first;
+      await observer.onLog({
+        level: "WARN",
+        stage: request.stage ?? "BUILDING",
+        message: "Smoke port was taken before the server bound it; retrying on a fresh port."
+      });
+      return runOnce(request, observer);
+    }
+  };
+}
+function defaultSmokeProbes(matcherRoutes) {
+  const probes = [{ path: "/", label: "root" }];
+  for (const route of matcherRoutes) {
+    if (route === "/") continue;
+    probes.push({ path: route, label: "middleware matcher" });
+  }
+  return probes;
+}
+
+// ../../packages/build/src/strategy/strategies/opennext-aws.ts
+import { writeFile as writeFile6 } from "fs/promises";
+import { join as join12 } from "path";
+
+// ../../packages/build/src/strategy/strategies/shared.ts
+import { access as access7, readFile as readFile10, rm, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname2, join as join11, resolve as resolve5 } from "path";
+function capturingObserver(observer) {
+  const lines = [];
+  return {
+    lines,
+    observer: {
+      ...observer,
+      onLog: (log2) => {
+        lines.push(log2.message);
+        return observer.onLog(log2);
+      }
+    }
+  };
+}
+async function runStep(context, spec, observer) {
+  const capture = capturingObserver(observer);
+  try {
+    return {
+      ok: true,
+      result: await context.ports.runCommand(spec, capture.observer)
+    };
+  } catch (error51) {
+    return { ok: false, error: error51, output: capture.lines };
+  }
+}
+function describeError(error51) {
+  return error51 instanceof Error ? error51.message : String(error51);
+}
+function describeFailure(step) {
+  const tail = step.output.map((line) => line.trim()).filter((line) => line !== "").slice(-4);
+  return tail.length > 0 ? `${describeError(step.error)} \u2014 ${tail.join(" | ")}` : describeError(step.error);
+}
+function failed(stage, reason) {
+  return { status: "failed", stage, reason };
+}
+async function info(observer, message) {
+  await observer.onLog({ level: "INFO", stage: "BUILDING", message });
+}
+async function warn(observer, message) {
+  await observer.onLog({ level: "WARN", stage: "BUILDING", message });
+}
+async function pathExists2(path) {
+  try {
+    await access7(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findProjectBin(appRoot, checkout, name) {
+  let dir = resolve5(appRoot);
+  const stop = resolve5(checkout);
+  for (; ; ) {
+    const candidate = join11(dir, "node_modules", ".bin", name);
+    if (await pathExists2(candidate)) return candidate;
+    if (dir === stop) return null;
+    const parent = dirname2(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function dotenvQuote(value) {
+  if (!value.includes("'")) return `'${value}'`;
+  if (!value.includes("`")) return `\`${value}\``;
+  return `"${value.replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r")}"`;
+}
+async function withDevVars(wranglerConfigPath, env, run) {
+  const path = join11(dirname2(wranglerConfigPath), ".dev.vars");
+  const keys = Object.keys(env).filter(
+    (key) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)
+  );
+  if (keys.length === 0) return run();
+  await writeFile5(
+    path,
+    `${keys.map((key) => `${key}=${dotenvQuote(env[key] ?? "")}`).join("\n")}
+`,
+    { mode: 384 }
+  );
+  try {
+    return await run();
+  } finally {
+    await rm(path, { force: true });
+  }
+}
+async function bundleWorker(context, layout, observer, errorCode) {
+  return runStep(
+    context,
+    {
+      command: context.toolchain.wrangler,
+      args: [
+        "deploy",
+        "--dry-run",
+        "--config",
+        layout.wranglerConfigPath,
+        "--outdir",
+        layout.bundleDir
+      ],
+      cwd: layout.appRoot,
+      env: {
+        CI: "1",
+        WRANGLER_LOG_PATH: join11(
+          layout.appRoot,
+          layout.outputRoot,
+          "wrangler.log"
+        )
+      },
+      timeoutMs: 5 * 6e4,
+      stage: "BUILDING",
+      errorCode
+    },
+    observer
+  );
+}
+async function smokeWorker(context, layout, observer) {
+  return withDevVars(
+    layout.wranglerConfigPath,
+    context.env,
+    () => context.ports.smoke.run(
+      {
+        boot: (port) => ({
+          command: context.toolchain.wrangler,
+          args: [
+            "dev",
+            "--config",
+            layout.wranglerConfigPath,
+            "--local",
+            "--ip",
+            "127.0.0.1",
+            "--port",
+            String(port),
+            "--show-interactive-dev-session=false",
+            "--log-level=warn",
+            "--persist-to",
+            join11(layout.appRoot, layout.outputRoot, ".naro-smoke-state")
+          ],
+          cwd: layout.appRoot,
+          env: {
+            CI: "1",
+            WRANGLER_LOG_PATH: join11(
+              layout.appRoot,
+              layout.outputRoot,
+              "wrangler-dev.log"
+            )
+          }
+        }),
+        probes: defaultSmokeProbes(context.facts.matcherRoutes),
+        stage: "BUILDING",
+        errorCode: "BUILD_FAILED"
+      },
+      observer
+    )
+  );
+}
+async function approvePnpmBuilds(checkout, packages) {
+  const path = join11(checkout, "pnpm-workspace.yaml");
+  let source = "";
+  try {
+    source = await readFile10(path, "utf8");
+  } catch {
+  }
+  let next = source;
+  const mapEntries = packages.map((name) => `  ${name}: true`).join("\n");
+  const flowMap = /^(allowBuilds\s*:\s*\{)([^}]*)\}/m;
+  if (flowMap.test(next)) {
+    next = next.replace(flowMap, (_match, open, body) => {
+      const items = body.trim();
+      const added = packages.map((name) => `${name}: true`).join(", ");
+      return `${open} ${items ? `${items.replace(/,\s*$/, "")}, ` : ""}${added} }`;
+    });
+  } else if (/^allowBuilds\s*:/m.test(next)) {
+    next = next.replace(/^(allowBuilds\s*:[^\n]*\n)/m, `$1${mapEntries}
+`);
+  } else {
+    next = `${next}${next.endsWith("\n") || next === "" ? "" : "\n"}allowBuilds:
+${mapEntries}
+`;
   }
-  if (timedOut) {
-    throw new CommandExecutionError(
-      spec.errorCode,
-      `${spec.command} exceeded its ${spec.timeoutMs}ms time limit`,
-      { exitCode: outcome.exitCode, timedOut: true }
+  const listEntries = packages.map((name) => `  - ${name}`).join("\n");
+  const flowList = /^(onlyBuiltDependencies\s*:\s*\[)([^\]]*)\]/m;
+  if (flowList.test(next)) {
+    next = next.replace(flowList, (_match, open, body) => {
+      const items = body.trim();
+      return `${open}${items ? `${items.replace(/,\s*$/, "")}, ` : ""}${packages.join(", ")}]`;
+    });
+  } else if (/^onlyBuiltDependencies\s*:/m.test(next)) {
+    next = next.replace(
+      /^(onlyBuiltDependencies\s*:[^\n]*\n)/m,
+      `$1${listEntries}
+`
     );
+  } else {
+    next = `${next}onlyBuiltDependencies:
+${listEntries}
+`;
   }
-  if (outcome.exitCode !== 0) {
-    throw new CommandExecutionError(
-      spec.errorCode,
-      `${spec.command} exited with code ${String(outcome.exitCode)}${outcome.signal ? ` (${outcome.signal})` : ""}`,
-      { exitCode: outcome.exitCode, timedOut: false }
-    );
+  if (next === source) return true;
+  try {
+    await writeFile5(path, next, "utf8");
+    return true;
+  } catch {
+    return false;
   }
-  return captured;
 }
 
-// ../../packages/build/src/repository.ts
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "path";
-function resolveAppRoot(checkout, configuredRoot) {
-  const checkoutRoot = resolve2(checkout);
-  if (!configuredRoot) return checkoutRoot;
-  if (isAbsolute2(configuredRoot)) {
-    throw new Error("Configured root directory escapes repository");
-  }
-  const appRoot = resolve2(checkoutRoot, configuredRoot);
-  const relativeRoot = relative2(checkoutRoot, appRoot);
-  if (relativeRoot === ".." || relativeRoot.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute2(relativeRoot)) {
-    throw new Error("Configured root directory escapes repository");
-  }
-  return appRoot;
+// ../../packages/build/src/strategy/strategies/opennext-aws.ts
+var CONFIG_NAME = ".next-deploy-open-next-aws.config.ts";
+var SERVER_FUNCTION = ".open-next/server-functions/default/index.mjs";
+function smokeConfig(buildCommand) {
+  return [
+    "const config = {",
+    `  buildCommand: ${JSON.stringify(buildCommand)},`,
+    "  default: {",
+    '    override: { wrapper: "node", converter: "node", incrementalCache: "dummy", tagCache: "dummy", queue: "dummy" },',
+    "  },",
+    '  imageOptimization: { loader: "dummy" },',
+    "  dangerous: { disableIncrementalCache: true, disableTagCache: true },",
+    "};",
+    "export default config;",
+    ""
+  ].join("\n");
+}
+function createOpenNextAwsStrategy() {
+  return {
+    id: "opennext-aws",
+    priority: 5,
+    target: "aws",
+    supports(context) {
+      if (!context.targets.aws)
+        return {
+          supported: false,
+          reason: "No AWS deploy target is configured on this control plane (no provider, credentials, or routing exist for it)."
+        };
+      if (!context.toolchain.openNextAws)
+        return {
+          supported: false,
+          reason: "The @opennextjs/aws toolchain is not installed on this build runner."
+        };
+      return { supported: true };
+    },
+    async evaluate(context, observer) {
+      await info(
+        observer,
+        "P5 opennext-aws: building with the OpenNext AWS adapter."
+      );
+      let fork;
+      try {
+        fork = await context.workspace.fork("opennext-aws");
+      } catch (error51) {
+        return failed("prepare", describeError(error51));
+      }
+      const configPath = join12(fork.appRoot, CONFIG_NAME);
+      try {
+        await writeFile6(
+          configPath,
+          smokeConfig(
+            `${context.packageManager.name} run ${context.buildScript}`
+          ),
+          "utf8"
+        );
+      } catch (error51) {
+        return failed("prepare", describeError(error51));
+      }
+      const build = await runStep(
+        context,
+        {
+          command: context.toolchain.openNextAws ?? "open-next",
+          args: ["build", "--config-path", configPath],
+          cwd: fork.appRoot,
+          env: {
+            ...context.env,
+            NPM_CONFIG_USERCONFIG: context.packageManagerConfigPath
+          },
+          timeoutMs: 20 * 6e4,
+          stage: "BUILDING",
+          errorCode: "BUILD_FAILED"
+        },
+        observer
+      );
+      if (!build.ok) return failed("build", describeFailure(build));
+      const serverFunction = join12(fork.appRoot, SERVER_FUNCTION);
+      if (!await pathExists2(serverFunction))
+        return failed("bundle", `OpenNext AWS produced no ${SERVER_FUNCTION}.`);
+      const smoke = await context.ports.smoke.run(
+        {
+          boot: (port) => ({
+            command: process.execPath,
+            args: [serverFunction],
+            cwd: fork.appRoot,
+            env: { ...context.env, PORT: String(port), NODE_ENV: "production" }
+          }),
+          probes: defaultSmokeProbes(context.facts.matcherRoutes),
+          stage: "BUILDING",
+          errorCode: "BUILD_FAILED"
+        },
+        observer
+      );
+      if (!smoke.ok) return failed("smoke", smoke.reason);
+      return {
+        status: "success",
+        artifact: {
+          kind: "opennext-aws",
+          outputRoot: join12(fork.appRoot, ".open-next"),
+          serverFunction
+        },
+        notes: [
+          "Verified with the Node wrapper; an AWS deploy needs a Lambda-wrapper build against provisioned resources."
+        ]
+      };
+    }
+  };
 }
 
-// ../../packages/build/src/static-artifact.ts
-import { readdir as readdir2, readFile as readFile6 } from "fs/promises";
-import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve3, sep as sep2 } from "path";
-var SHIM_WORKER_SOURCE = "export default { fetch: (request, env) => env.ASSETS.fetch(request) };\n";
-var EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules"]);
-var ALLOWED_DOTFILE = ".well-known";
-function excluded(name) {
-  if (name === ALLOWED_DOTFILE) return false;
-  return name.startsWith(".") || EXCLUDED_DIRECTORIES.has(name);
+// ../../packages/build/src/strategy/strategies/opennext-cloudflare.ts
+import { readFile as readFile11 } from "fs/promises";
+import { join as join13 } from "path";
+var PROXY_TO_MIDDLEWARE_VARIANT = "proxy-to-middleware";
+var NODE_MIDDLEWARE_REFUSAL = /Node\.js middleware is not (?:currently )?supported/i;
+async function buildDeclaresNodeMiddleware(appRoot) {
+  try {
+    const manifest2 = JSON.parse(
+      await readFile11(
+        join13(appRoot, ".next", "server", "functions-config-manifest.json"),
+        "utf8"
+      )
+    );
+    return Boolean(manifest2.functions?.["/_middleware"]);
+  } catch {
+    return false;
+  }
 }
-async function readStaticArtifact(appRoot, outputDirectory, identity, options, onWarn) {
-  if (isAbsolute3(outputDirectory))
-    throw new DeploymentError(
-      "ARTIFACT_INVALID",
-      "Output directory must be relative to the application root."
+function createOpenNextCloudflareStrategy(options) {
+  async function attempt(context, roots, observer) {
+    let platform;
+    try {
+      platform = await options.createPlatformBuildConfig(
+        roots.appRoot,
+        context.identity.deploymentId
+      );
+    } catch (error51) {
+      return {
+        ok: false,
+        nodeMiddleware: false,
+        outcome: failed("prepare", describeError(error51))
+      };
+    }
+    const nextBuild = await runStep(
+      context,
+      {
+        command: context.packageManager.name,
+        args: ["run", context.buildScript],
+        cwd: roots.appRoot,
+        env: {
+          ...context.env,
+          NEXT_PRIVATE_STANDALONE: "true",
+          NPM_CONFIG_USERCONFIG: platform.packageManagerConfigPath
+        },
+        timeoutMs: 15 * 6e4,
+        stage: "BUILDING",
+        errorCode: "BUILD_FAILED"
+      },
+      observer
     );
-  const outputRoot = resolve3(appRoot, outputDirectory);
-  const relation = relative3(appRoot, outputRoot);
-  if (relation === ".." || relation.startsWith(`..${sep2}`) || isAbsolute3(relation))
-    throw new DeploymentError(
-      "ARTIFACT_INVALID",
-      "Output directory escapes the application root."
+    if (!nextBuild.ok) {
+      return {
+        ok: false,
+        nodeMiddleware: false,
+        outcome: failed("build", describeFailure(nextBuild))
+      };
+    }
+    const openNext = await runStep(
+      context,
+      {
+        command: context.toolchain.openNextCloudflare,
+        args: [
+          "build",
+          "--skip-next-build",
+          "--openNextConfigPath",
+          platform.openNextConfigPath,
+          "--config",
+          platform.wranglerConfigPath,
+          ...context.nextSupport.status === "needs-unsupported-flag" ? ["--dangerouslyUseUnsupportedNextVersion"] : []
+        ],
+        cwd: roots.appRoot,
+        timeoutMs: 15 * 6e4,
+        stage: "BUILDING",
+        errorCode: "OPENNEXT_FAILED"
+      },
+      observer
     );
-  const assets = [];
-  async function visit(directory) {
-    const entries = await readdir2(directory, { withFileTypes: true });
-    for (const entry of entries.sort(
-      (left, right) => left.name.localeCompare(right.name)
-    )) {
-      if (excluded(entry.name)) continue;
-      const path = join7(directory, entry.name);
-      if (entry.isSymbolicLink())
-        throw new DeploymentError(
-          "ARTIFACT_INVALID",
-          "Static output cannot contain symbolic links."
+    if (!openNext.ok) {
+      const nodeMiddleware = openNext.output.some((line) => NODE_MIDDLEWARE_REFUSAL.test(line)) || await buildDeclaresNodeMiddleware(roots.appRoot);
+      return {
+        ok: false,
+        nodeMiddleware,
+        outcome: failed(
+          "build",
+          nodeMiddleware ? "OpenNext Cloudflare does not support Node.js middleware (Next.js 16 proxy.ts)." : describeFailure(openNext)
+        )
+      };
+    }
+    const layout = {
+      appRoot: roots.appRoot,
+      wranglerConfigPath: platform.wranglerConfigPath,
+      ...OPEN_NEXT_LAYOUT
+    };
+    const bundle = await bundleWorker(
+      context,
+      layout,
+      observer,
+      "OPENNEXT_FAILED"
+    );
+    if (!bundle.ok) {
+      return {
+        ok: false,
+        nodeMiddleware: false,
+        outcome: failed("bundle", describeFailure(bundle))
+      };
+    }
+    let artifact;
+    try {
+      artifact = await options.readOpenNextArtifact(
+        roots.appRoot,
+        context.identity,
+        platform.wranglerConfigPath
+      );
+    } catch (error51) {
+      return {
+        ok: false,
+        nodeMiddleware: false,
+        outcome: failed("bundle", describeError(error51))
+      };
+    }
+    const smoke = await smokeWorker(context, layout, observer);
+    if (!smoke.ok) {
+      return {
+        ok: false,
+        nodeMiddleware: false,
+        outcome: failed("smoke", smoke.reason)
+      };
+    }
+    return { ok: true, artifact };
+  }
+  return {
+    id: "opennext-cloudflare",
+    priority: 2,
+    target: "cloudflare",
+    supports: () => ({ supported: true }),
+    async evaluate(context, observer) {
+      const rememberedRewrite = context.pinnedVariant === PROXY_TO_MIDDLEWARE_VARIANT && context.facts.proxyFile !== null;
+      if (rememberedRewrite) {
+        await info(
+          observer,
+          `P2 opennext-cloudflare: the stored strategy already needed ${context.facts.proxyFile ?? "proxy"} rewritten to Edge middleware; building that way directly.`
+        );
+      } else {
+        await info(
+          observer,
+          "P2 opennext-cloudflare: building the project as written."
+        );
+        const first = await attempt(context, context.workspace, observer);
+        if (first.ok) {
+          return {
+            status: "success",
+            artifact: { kind: "cloudflare-worker", artifact: first.artifact },
+            notes: []
+          };
+        }
+        if (!first.nodeMiddleware || !context.facts.proxyFile)
+          return first.outcome;
+        await warn(
+          observer,
+          `P2 opennext-cloudflare: OpenNext refused the Node.js middleware compiled from ${context.facts.proxyFile}. Retrying in a temporary workspace with it rewritten to Edge middleware.`
+        );
+      }
+      let fork;
+      try {
+        fork = await context.workspace.fork("opennext-proxy-to-middleware");
+      } catch (error51) {
+        return failed("prepare", describeError(error51));
+      }
+      const conversion = await options.convertProxyToMiddleware(fork.appRoot);
+      if (!conversion.converted) {
+        return failed(
+          "prepare",
+          `Could not rewrite ${context.facts.proxyFile} to middleware (a middleware file already exists).`
         );
-      if (entry.isDirectory()) await visit(path);
-      else if (entry.isFile()) {
-        assets.push({
-          name: relative3(outputRoot, path).split(sep2).join("/"),
-          data: await readFile6(path),
-          contentType: contentType(path)
-        });
       }
+      await warn(
+        observer,
+        `Converted ${conversion.file ?? context.facts.proxyFile} to edge middleware for this build only. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable. Your repository is unchanged.`
+      );
+      const second = await attempt(context, fork, observer);
+      if (!second.ok) return second.outcome;
+      return {
+        status: "success",
+        artifact: { kind: "cloudflare-worker", artifact: second.artifact },
+        variant: PROXY_TO_MIDDLEWARE_VARIANT,
+        notes: [
+          `${conversion.file ?? "proxy"} was rewritten to Edge middleware for the build.`
+        ]
+      };
     }
-  }
+  };
+}
+
+// ../../packages/build/src/strategy/strategies/unavailable.ts
+function createUnavailableStrategy(options) {
+  return {
+    id: options.id,
+    priority: options.priority,
+    target: options.target,
+    supports: () => ({ supported: false, reason: options.reason }),
+    evaluate: async () => ({ status: "skipped", reason: options.reason })
+  };
+}
+function createSplitCloudflareStrategy() {
+  return createUnavailableStrategy({
+    id: "split-cloudflare",
+    priority: 3,
+    target: "cloudflare-split",
+    reason: "Split Cloudflare deployment needs the dispatcher to chain a middleware Worker in front of the app Worker; the runtime plane routes one Worker per hostname today."
+  });
+}
+function createAwsMiddlewareCloudflareAppStrategy() {
+  return createUnavailableStrategy({
+    id: "aws-middleware-cloudflare-app",
+    priority: 4,
+    target: "aws-hybrid",
+    reason: "Hybrid AWS middleware + Cloudflare app needs an AWS deploy target and cross-cloud request chaining; neither exists on this control plane."
+  });
+}
+
+// ../../packages/build/src/strategy/strategies/vinext-cloudflare.ts
+import { join as join14 } from "path";
+var VINEXT_MIN_NEXT_MAJOR = 16;
+var VINEXT_BUILD_SCRIPTS = ["esbuild", "workerd"];
+var VINEXT_OUTPUT = {
+  outputRoot: "dist",
+  bundleDir: "dist/.naro-bundle"
+};
+async function runCheck(context, observer) {
+  if (!context.toolchain.vinext) return null;
+  const held = [];
   try {
-    await visit(outputRoot);
-  } catch (error51) {
-    if (error51 instanceof DeploymentError) throw error51;
-    throw new DeploymentError(
-      "ARTIFACT_INVALID",
-      `Could not read the build output directory "${outputDirectory}".`,
-      { cause: error51 }
+    const result = await context.ports.runCommand(
+      {
+        command: context.toolchain.vinext,
+        args: ["check"],
+        cwd: context.workspace.appRoot,
+        timeoutMs: 2 * 6e4,
+        stage: "BUILDING",
+        errorCode: "BUILD_FAILED"
+      },
+      {
+        onLog: (log2) => {
+          held.push(log2);
+        }
+      }
     );
+    const report = parseVinextCheckReport(result.stdout.join("\n"));
+    if (!report || report.issues > 0) {
+      for (const log2 of held) await observer.onLog(log2);
+    }
+    return report;
+  } catch (error51) {
+    for (const log2 of held) await observer.onLog(log2);
+    await observer.onLog({
+      level: "WARN",
+      stage: "BUILDING",
+      message: `vinext check could not run: ${describeError(error51)}`
+    });
+    return null;
   }
-  if (assets.length === 0)
-    throw new DeploymentError(
-      "ARTIFACT_INVALID",
-      `The build output directory "${outputDirectory}" contains no files.`
-    );
-  if (!assets.some((file2) => file2.name === "index.html"))
-    await onWarn?.(
-      `No index.html in "${outputDirectory}" \u2014 the site root will not serve a page.`
-    );
+}
+function createVinextCloudflareStrategy(options) {
+  const toolchain = options.toolchain ?? VINEXT_TOOLCHAIN;
   return {
-    ...identity,
-    entrypoint: {
-      name: "worker.js",
-      data: new TextEncoder().encode(SHIM_WORKER_SOURCE),
-      contentType: "application/javascript"
+    id: "vinext-cloudflare",
+    priority: 1,
+    target: "cloudflare",
+    supports(context) {
+      if (!context.vinextEnabled)
+        return {
+          supported: false,
+          reason: "vinext is disabled for this project."
+        };
+      if (context.nextMajor < VINEXT_MIN_NEXT_MAJOR)
+        return {
+          supported: false,
+          reason: `vinext targets Next.js ${String(VINEXT_MIN_NEXT_MAJOR)}; this project runs Next.js ${String(context.nextMajor)}.`
+        };
+      if (!context.toolchain.vinext)
+        return {
+          supported: false,
+          reason: "The vinext toolchain is not installed on this build runner."
+        };
+      return { supported: true };
     },
-    modules: [],
-    assets,
-    compatibilityDate: COMPATIBILITY_DATE,
-    compatibilityFlags: [],
-    assetsBinding: "ASSETS",
-    assetsConfig: {
-      notFoundHandling: options.spaFallback ? "single-page-application" : "404-page"
+    async evaluate(context, observer) {
+      const adopt = !context.facts.usesVinext;
+      if (adopt) {
+        const decision = vinextRouteFromCheck(
+          await runCheck(context, observer)
+        );
+        await info(observer, `P1 vinext-cloudflare: ${decision.reason}`);
+        if (!decision.eligible) return failed("check", decision.reason);
+      } else {
+        await info(
+          observer,
+          "P1 vinext-cloudflare: the project already builds with vinext; using its own configuration."
+        );
+      }
+      let fork;
+      try {
+        fork = await context.workspace.fork("vinext");
+      } catch (error51) {
+        return failed("prepare", describeError(error51));
+      }
+      if (adopt) {
+        try {
+          await options.createVinextBuildConfig(
+            fork.appRoot,
+            context.identity.deploymentId
+          );
+        } catch (error51) {
+          return failed("prepare", describeError(error51));
+        }
+        if (context.packageManager.name === "pnpm") {
+          await approvePnpmBuilds(fork.checkout, VINEXT_BUILD_SCRIPTS);
+        }
+        const [addCommand, ...addArgs] = context.packageManager.addArgs(toolchain);
+        if (!addCommand) {
+          return failed(
+            "prepare",
+            new DeploymentError(
+              "UNSUPPORTED_PACKAGE_MANAGER",
+              "Package manager cannot add packages."
+            ).message
+          );
+        }
+        const added = await runStep(
+          context,
+          {
+            command: addCommand,
+            args: addArgs,
+            cwd: fork.appRoot,
+            // Not production: npm and classic Yarn read that as omit=dev and
+            // would prune the project's devDependencies while adding ours.
+            env: {
+              NODE_ENV: "development",
+              NPM_CONFIG_USERCONFIG: context.packageManagerConfigPath
+            },
+            timeoutMs: 10 * 6e4,
+            stage: "BUILDING",
+            errorCode: "INSTALL_FAILED"
+          },
+          observer
+        );
+        if (!added.ok) return failed("prepare", describeFailure(added));
+      }
+      const projectBin = adopt ? null : await findProjectBin(fork.appRoot, fork.checkout, "vinext");
+      const build = await runStep(
+        context,
+        {
+          command: projectBin ?? context.toolchain.vinext ?? "vinext",
+          args: ["build"],
+          cwd: fork.appRoot,
+          env: { ...context.env, CI: "1" },
+          timeoutMs: 15 * 6e4,
+          stage: "BUILDING",
+          errorCode: "BUILD_FAILED"
+        },
+        observer
+      );
+      if (!build.ok) return failed("build", describeFailure(build));
+      let artifact;
+      try {
+        artifact = await options.readVinextArtifact(
+          fork.appRoot,
+          context.identity
+        );
+      } catch (error51) {
+        return failed("bundle", describeError(error51));
+      }
+      const smoke = await smokeWorker(
+        context,
+        {
+          appRoot: fork.appRoot,
+          wranglerConfigPath: join14(
+            fork.appRoot,
+            "dist",
+            "server",
+            "wrangler.json"
+          ),
+          ...VINEXT_OUTPUT
+        },
+        observer
+      );
+      if (!smoke.ok) return failed("smoke", smoke.reason);
+      return {
+        status: "success",
+        artifact: { kind: "cloudflare-worker", artifact },
+        notes: adopt ? [
+          "Built with the naro-provided vinext toolchain in a temporary workspace."
+        ] : ["Built with the project's own vinext configuration."]
+      };
     }
   };
 }
 
+// ../../packages/build/src/strategy/workspace.ts
+import { cp } from "fs/promises";
+import { basename as basename2, join as join15, relative as relative5, resolve as resolve6 } from "path";
+var SKIPPED_ANYWHERE = /* @__PURE__ */ new Set(["node_modules"]);
+function shouldCopy(path) {
+  const name = basename2(path);
+  if (SKIPPED_ANYWHERE.has(name)) return false;
+  return !name.startsWith(".next-deploy-");
+}
+async function copyCheckout(source, target) {
+  const origin = resolve6(source);
+  await cp(origin, target, {
+    recursive: true,
+    verbatimSymlinks: true,
+    filter: (path) => resolve6(path) === origin || shouldCopy(path)
+  });
+}
+function forkedAppRoot(checkout, appRoot, forkCheckout) {
+  return join15(forkCheckout, relative5(checkout, appRoot));
+}
+
 // ../../packages/build/src/local-build-executor.ts
-var defaultDependencies = {
-  createWorkspace: () => mkdtemp(join8(tmpdir(), "next-deploy-build-")),
-  removeWorkspace: (path) => rm(path, { recursive: true, force: true }),
+function concurrencyFromEnvironment() {
+  const raw = Number(process.env.NARO_RESOLVER_CONCURRENCY ?? "1");
+  return Number.isInteger(raw) && raw > 0 ? raw : 1;
+}
+var defaultLocalBuildDependencies = {
+  createWorkspace: () => mkdtemp(join16(tmpdir(), "next-deploy-build-")),
+  removeWorkspace: (path) => rm2(path, { recursive: true, force: true }),
   runCommand,
   detectPackageManager,
   resolveAppRoot,
@@ -15665,8 +17379,38 @@ var defaultDependencies = {
   wranglerCommand: "wrangler",
   cacheFetch: (input, init) => fetch(input, init),
   convertProxyToMiddleware,
-  commandAvailable: hasCommand
+  commandAvailable: hasCommand,
+  readInstalledNextVersion,
+  now: () => /* @__PURE__ */ new Date(),
+  createVinextBuildConfig,
+  readVinextArtifact,
+  vinextCommand: "vinext",
+  forkWorkspace: copyCheckout,
+  collectProjectFacts,
+  hashFingerprintInputs: hashStrategyInputs,
+  computeFingerprint: computeStrategyFingerprint,
+  targets: { cloudflare: true },
+  resolverConcurrency: concurrencyFromEnvironment()
 };
+async function readInstalledNextVersion(appRoot, checkout) {
+  let dir = resolve7(appRoot);
+  const stop = resolve7(checkout);
+  for (; ; ) {
+    try {
+      const source = await readFile12(
+        join16(dir, "node_modules", "next", "package.json"),
+        "utf8"
+      );
+      const version2 = JSON.parse(source).version;
+      return typeof version2 === "string" ? version2 : null;
+    } catch {
+    }
+    if (dir === stop) return null;
+    const parent = dirname3(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
 async function hasCommand(command) {
   try {
     await runCommand(
@@ -15685,6 +17429,14 @@ async function hasCommand(command) {
     return false;
   }
 }
+async function pathExists3(path) {
+  try {
+    await access8(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function sanitizeCacheKey(value) {
   return value.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 128);
 }
@@ -15714,25 +17466,42 @@ async function trySave(scope, key, sourceDir, ports, observer) {
 async function notifyStatus(observer, status) {
   await observer.onStatus?.(status);
 }
-async function info(observer, stage, message) {
+async function info2(observer, stage, message) {
   await observer.onLog({ level: "INFO", stage, message });
 }
+function defaultStrategies(dependencies) {
+  return [
+    createVinextCloudflareStrategy({
+      createVinextBuildConfig: dependencies.createVinextBuildConfig ?? createVinextBuildConfig,
+      readVinextArtifact: dependencies.readVinextArtifact ?? readVinextArtifact
+    }),
+    createOpenNextCloudflareStrategy({
+      createPlatformBuildConfig: dependencies.createPlatformBuildConfig,
+      convertProxyToMiddleware: dependencies.convertProxyToMiddleware ?? convertProxyToMiddleware,
+      readOpenNextArtifact: dependencies.readOpenNextArtifact
+    }),
+    createSplitCloudflareStrategy(),
+    createAwsMiddlewareCloudflareAppStrategy(),
+    createOpenNextAwsStrategy()
+  ];
+}
 var LocalBuildExecutor = class {
-  constructor(dependencies = defaultDependencies) {
+  constructor(dependencies = defaultLocalBuildDependencies) {
     this.dependencies = dependencies;
   }
   async build(input, observer, cache) {
     const workspace = await this.dependencies.createWorkspace();
-    const checkout = join8(workspace, "checkout");
-    const pmCacheDir = join8(workspace, ".pm-store");
+    const checkout = join16(workspace, "checkout");
+    const pmCacheDir = join16(workspace, ".pm-store");
     let cacheSeq = 0;
+    const commandAvailable = this.dependencies.commandAvailable ?? hasCommand;
     const compressor = "zstd";
-    const canCompress = cache ? await (this.dependencies.commandAvailable ?? hasCommand)(compressor) : false;
+    const canCompress = cache ? await commandAvailable(compressor) : false;
     const cachePorts = cache && canCompress ? {
       transport: cache,
       fetch: this.dependencies.cacheFetch ?? ((url2, init) => fetch(url2, init)),
       runCommand: this.dependencies.runCommand,
-      tmpFile: (suffix) => join8(workspace, `cache-${String(cacheSeq++)}${suffix}`),
+      tmpFile: (suffix) => join16(workspace, `cache-${String(cacheSeq++)}${suffix}`),
       // One latch for the whole build so a disabled cache warns once.
       report: { unavailable: false }
     } : null;
@@ -15809,27 +17578,31 @@ var LocalBuildExecutor = class {
         buildCommand: input.buildCommand ?? null,
         outputDirectory: input.outputDirectory ?? null
       });
-      await info(observer, "CLONING", `Detected ${resolved.description}`);
+      await info2(observer, "CLONING", `Detected ${resolved.description}`);
       const isNext = resolved.preset.id === "next";
-      let platformConfig = null;
-      let packageManagerConfigPath = null;
-      if (isNext) {
-        const conversion = await (this.dependencies.convertProxyToMiddleware ?? convertProxyToMiddleware)(appRoot);
-        if (conversion.converted) {
-          await observer.onLog({
-            level: "WARN",
-            stage: "CLONING",
-            message: `Converted ${conversion.file ?? "proxy"} to edge middleware. Next.js 16 proxy runs on the Node.js runtime, which Cloudflare does not support; middleware runs on the Edge runtime, so Node.js-only APIs are unavailable.`
-          });
+      if (isNext && resolved.dependencyRange) {
+        const declared = declaredNextMajor(resolved.dependencyRange);
+        if (declared !== null && declared < MIN_SUPPORTED_NEXT_MAJOR) {
+          throw new DeploymentError(
+            "NEXT_VERSION_UNSUPPORTED",
+            `Naro deploys Next.js ${String(MIN_SUPPORTED_NEXT_MAJOR)} or newer; this project declares next@${resolved.dependencyRange}. Upgrade Next.js and deploy again.`
+          );
         }
-        platformConfig = await this.dependencies.createPlatformBuildConfig(
-          appRoot,
-          input.deploymentId
-        );
-        packageManagerConfigPath = platformConfig.packageManagerConfigPath;
-      } else if (resolved.buildScript !== null) {
+      }
+      let packageManagerConfigPath = null;
+      if (resolved.buildScript !== null) {
         packageManagerConfigPath = await this.dependencies.createPackageManagerConfig(appRoot);
       }
+      const fingerprintEntries = isNext ? await (this.dependencies.hashFingerprintInputs ?? hashStrategyInputs)(
+        checkout,
+        appRoot
+      ) : [];
+      let artifact = null;
+      let strategyRecord;
+      const identity = {
+        deploymentId: input.deploymentId,
+        projectId: input.projectId
+      };
       if (resolved.buildScript !== null) {
         await notifyStatus(observer, "INSTALLING");
         const packageManager = await this.dependencies.detectPackageManager(checkout);
@@ -15853,28 +17626,57 @@ var LocalBuildExecutor = class {
             );
           }
         }
-        await this.dependencies.runCommand(
-          {
-            command: installCommand,
-            args: cachePorts ? [...installArgs, ...packageManager.cacheArgs(pmCacheDir)] : installArgs,
-            cwd: checkout,
-            env: {
-              NODE_ENV: "development",
-              NPM_CONFIG_USERCONFIG: packageManagerConfigPath,
-              ...cachePorts ? {
-                npm_config_store_dir: pmCacheDir,
-                npm_config_cache: pmCacheDir,
-                YARN_CACHE_FOLDER: pmCacheDir
-              } : {}
+        const install = async (cwd) => {
+          await this.dependencies.runCommand(
+            {
+              command: installCommand,
+              args: cachePorts ? [...installArgs, ...packageManager.cacheArgs(pmCacheDir)] : installArgs,
+              cwd,
+              env: {
+                NODE_ENV: "development",
+                NPM_CONFIG_USERCONFIG: packageManagerConfigPath,
+                ...cachePorts ? {
+                  npm_config_store_dir: pmCacheDir,
+                  npm_config_cache: pmCacheDir,
+                  YARN_CACHE_FOLDER: pmCacheDir
+                } : {}
+              },
+              timeoutMs: 10 * 6e4,
+              stage: "INSTALLING",
+              errorCode: "INSTALL_FAILED"
             },
-            timeoutMs: 10 * 6e4,
-            stage: "INSTALLING",
-            errorCode: "INSTALL_FAILED"
-          },
-          observer
-        );
+            observer
+          );
+        };
+        await install(checkout);
+        let nextSupport = {
+          status: "unknown",
+          version: null,
+          reason: ""
+        };
+        if (isNext) {
+          const installed = await (this.dependencies.readInstalledNextVersion ?? readInstalledNextVersion)(appRoot, checkout);
+          if (installed) {
+            nextSupport = classifyNextVersion(
+              installed,
+              (this.dependencies.now ?? (() => /* @__PURE__ */ new Date()))()
+            );
+            if (nextSupport.status === "too-old")
+              throw new DeploymentError(
+                "NEXT_VERSION_UNSUPPORTED",
+                nextSupport.reason
+              );
+            if (nextSupport.status === "needs-unsupported-flag" || nextSupport.status === "outside-peer-range") {
+              await observer.onLog({
+                level: "WARN",
+                stage: "BUILDING",
+                message: nextSupport.reason
+              });
+            }
+          }
+        }
         await notifyStatus(observer, "BUILDING");
-        const buildCacheDir = resolved.preset.cachePath ? join8(appRoot, resolved.preset.cachePath) : null;
+        const buildCacheDir = resolved.preset.cachePath ? join16(appRoot, resolved.preset.cachePath) : null;
         const buildCacheKey = sanitizeCacheKey(input.branch);
         if (cachePorts && buildCacheDir) {
           await tryRestore(
@@ -15885,59 +17687,97 @@ var LocalBuildExecutor = class {
             observer
           );
         }
-        await this.dependencies.runCommand(
-          {
-            command: packageManager.name,
-            args: ["run", resolved.buildScript],
-            cwd: appRoot,
-            env: {
-              ...input.env,
-              ...isNext ? { NEXT_PRIVATE_STANDALONE: "true" } : {},
-              NPM_CONFIG_USERCONFIG: packageManagerConfigPath
-            },
-            timeoutMs: 15 * 6e4,
-            stage: "BUILDING",
-            errorCode: "BUILD_FAILED"
-          },
-          observer
-        );
         if (isNext) {
-          await this.dependencies.runCommand(
-            {
-              command: this.dependencies.openNextCommand,
-              args: [
-                "build",
-                "--skip-next-build",
-                "--openNextConfigPath",
-                platformConfig.openNextConfigPath,
-                "--config",
-                platformConfig.wranglerConfigPath
-              ],
-              cwd: appRoot,
-              timeoutMs: 15 * 6e4,
-              stage: "BUILDING",
-              errorCode: "OPENNEXT_FAILED"
+          const nextVersion = nextSupport.version;
+          const declaredMajor = resolved.dependencyRange ? declaredNextMajor(resolved.dependencyRange) : null;
+          const nextMajor = nextVersion?.major ?? declaredMajor ?? 16;
+          const facts = await (this.dependencies.collectProjectFacts ?? collectProjectFacts)(appRoot);
+          const fingerprint = await (this.dependencies.computeFingerprint ?? computeStrategyFingerprint)({
+            checkout,
+            appRoot,
+            rootDirectory: input.rootDirectory,
+            vinextEnabled: input.vinextEnabled !== false,
+            entries: fingerprintEntries,
+            nextVersion: nextVersion ? `${String(nextVersion.major)}.${String(nextVersion.minor)}.${String(nextVersion.patch)}` : "unknown"
+          });
+          const pristine = join16(workspace, "pristine");
+          const fork = this.dependencies.forkWorkspace ?? defaultFork;
+          await fork(checkout, pristine);
+          let forks = 0;
+          const forkWorkspace = async (label2) => {
+            const target = join16(
+              workspace,
+              "forks",
+              `${String(forks++)}-${label2.replace(/[^a-z0-9-]/gi, "-")}`
+            );
+            await fork(pristine, target);
+            await install(target);
+            return {
+              checkout: target,
+              appRoot: forkedAppRoot(checkout, appRoot, target)
+            };
+          };
+          const vinextCommand = this.dependencies.vinextCommand;
+          const openNextAwsCommand = this.dependencies.openNextAwsCommand;
+          const context = {
+            identity,
+            branch: input.branch,
+            env: input.env ?? {},
+            packageManager,
+            packageManagerConfigPath,
+            buildScript: resolved.buildScript,
+            nextVersion: nextVersion ? `${String(nextVersion.major)}.${String(nextVersion.minor)}.${String(nextVersion.patch)}` : "unknown",
+            nextMajor,
+            nextSupport,
+            vinextEnabled: input.vinextEnabled !== false,
+            facts,
+            workspace: { checkout, appRoot, fork: forkWorkspace },
+            toolchain: {
+              openNextCloudflare: this.dependencies.openNextCommand,
+              wrangler: this.dependencies.wranglerCommand,
+              ...vinextCommand && await commandAvailable(vinextCommand) ? { vinext: vinextCommand } : {},
+              ...openNextAwsCommand && await commandAvailable(openNextAwsCommand) ? { openNextAws: openNextAwsCommand } : {}
             },
-            observer
+            targets: this.dependencies.targets ?? { cloudflare: true },
+            ports: {
+              runCommand: this.dependencies.runCommand,
+              smoke: this.dependencies.smokeTester ?? createSmokeTester(),
+              commandAvailable
+            }
+          };
+          const resolution = await resolveDeploymentStrategy(
+            this.dependencies.strategies ?? defaultStrategies(this.dependencies),
+            context,
+            observer,
+            {
+              pinned: input.strategy ?? null,
+              fingerprint: fingerprint.hash,
+              concurrency: this.dependencies.resolverConcurrency ?? 1,
+              ...this.dependencies.now ? { now: this.dependencies.now } : {}
+            }
           );
+          if (resolution.outcome.artifact.kind !== "cloudflare-worker") {
+            throw new DeploymentError(
+              "NO_DEPLOYMENT_STRATEGY",
+              `Strategy ${resolution.strategy.id} produced a ${resolution.outcome.artifact.kind} artifact, which this control plane cannot deploy.`
+            );
+          }
+          artifact = resolution.outcome.artifact.artifact;
+          strategyRecord = resolution.record;
+          await observer.onMetadata?.({ strategy: resolution.record });
+        } else {
           await this.dependencies.runCommand(
             {
-              command: this.dependencies.wranglerCommand,
-              args: [
-                "deploy",
-                "--dry-run",
-                "--config",
-                platformConfig.wranglerConfigPath,
-                "--outdir",
-                ".open-next/worker-bundle"
-              ],
+              command: packageManager.name,
+              args: ["run", resolved.buildScript],
               cwd: appRoot,
               env: {
-                WRANGLER_LOG_PATH: join8(appRoot, ".open-next", "wrangler.log")
+                ...input.env,
+                NPM_CONFIG_USERCONFIG: packageManagerConfigPath
               },
-              timeoutMs: 5 * 6e4,
+              timeoutMs: 15 * 6e4,
               stage: "BUILDING",
-              errorCode: "OPENNEXT_FAILED"
+              errorCode: "BUILD_FAILED"
             },
             observer
           );
@@ -15946,7 +17786,7 @@ var LocalBuildExecutor = class {
           if (depsKey && !depsRestored) {
             await trySave("deps", depsKey, pmCacheDir, cachePorts, observer);
           }
-          if (buildCacheDir) {
+          if (buildCacheDir && await pathExists3(buildCacheDir)) {
             await trySave(
               "next",
               buildCacheKey,
@@ -15958,27 +17798,101 @@ var LocalBuildExecutor = class {
         }
       }
       await notifyStatus(observer, "DEPLOYING");
-      const identity = {
-        deploymentId: input.deploymentId,
-        projectId: input.projectId
+      artifact ??= await this.readStatic(appRoot, resolved, identity, observer);
+      return {
+        gitCommitSha,
+        artifact,
+        ...strategyRecord ? { strategy: strategyRecord } : {}
       };
-      const artifact = isNext ? await this.dependencies.readOpenNextArtifact(
-        appRoot,
-        identity,
-        platformConfig.wranglerConfigPath
-      ) : await this.dependencies.readStaticArtifact(
-        appRoot,
-        resolved.outputDirectory,
-        identity,
-        { spaFallback: resolved.preset.spaFallback },
-        (message) => observer.onLog({ level: "WARN", stage: "DEPLOYING", message })
-      );
-      return { gitCommitSha, artifact };
     } finally {
       await this.dependencies.removeWorkspace(workspace);
     }
   }
+  readStatic(appRoot, resolved, identity, observer) {
+    return this.dependencies.readStaticArtifact(
+      appRoot,
+      resolved.outputDirectory,
+      identity,
+      { spaFallback: resolved.preset.spaFallback },
+      (message) => observer.onLog({
+        level: "WARN",
+        stage: "DEPLOYING",
+        message
+      })
+    );
+  }
 };
+var defaultFork = copyCheckout;
+
+// ../../packages/build/src/log-batch.ts
+var DEPLOYMENT_LOG_BATCH_LIMIT = 40;
+var DEPLOYMENT_LOG_FLUSH_MS = 1e3;
+function createLogBatcher(options) {
+  let buffer = [];
+  let timer = null;
+  let pending = null;
+  function disarm() {
+    if (timer === null) return;
+    clearTimeout(timer);
+    timer = null;
+  }
+  async function flush() {
+    disarm();
+    if (pending !== null) {
+      const { error: error51 } = pending;
+      pending = null;
+      throw error51;
+    }
+    if (buffer.length === 0) return;
+    const batch = buffer;
+    buffer = [];
+    await options.send(batch);
+  }
+  function arm() {
+    if (timer !== null || !options.intervalMs) return;
+    timer = setTimeout(() => {
+      timer = null;
+      flush().catch((error51) => {
+        pending ??= { error: error51 };
+      });
+    }, options.intervalMs);
+    timer.unref?.();
+  }
+  return {
+    add: async (log2) => {
+      buffer.push(log2);
+      if (buffer.length >= options.limit) {
+        await flush();
+        return;
+      }
+      arm();
+    },
+    flush
+  };
+}
+
+// ../../packages/build/src/log-sender.ts
+function createLogSender(ports) {
+  let warned = false;
+  return async (logs) => {
+    if (ports.toIngest !== null) {
+      try {
+        const response = await ports.toIngest(logs);
+        if (response.ok) return;
+      } catch {
+      }
+    }
+    await ports.toControlPlane(logs);
+    if (warned) return;
+    warned = true;
+    try {
+      await ports.warn(
+        ports.toIngest === null ? "Sent build logs through the control plane because no log ingest URL was configured." : `Sent build logs through the control plane because the log ingest worker at ${ports.ingestUrl ?? "the configured URL"} did not accept them.`
+      );
+    } catch {
+    }
+  };
+}
 
 // ../../packages/sdk/src/auth.ts
 import { homedir as homedir2 } from "os";
@@ -16023,6 +17937,8 @@ async function errorFromResponse(response, context) {
   if (body?.error?.fields !== void 0) details.fields = body.error.fields;
   if (typeof body?.error?.installUrl === "string")
     details.installUrl = body.error.installUrl;
+  if (typeof body?.error?.statementIndex === "number")
+    details.statementIndex = body.error.statementIndex;
   return new NaroError(
     code,
     serverMessage ?? `${context} failed: the control plane returned ${String(response.status)}.`,
@@ -16036,12 +17952,12 @@ async function errorFromResponse(response, context) {
 // ../../packages/sdk/src/session.ts
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join9 } from "path";
+import { join as join17 } from "path";
 function credentialsDir(home = homedir()) {
-  return join9(home, ".naro");
+  return join17(home, ".naro");
 }
 function credentialsFile(home = homedir()) {
-  return join9(credentialsDir(home), "credentials.json");
+  return join17(credentialsDir(home), "credentials.json");
 }
 function saveSession(session, home = homedir()) {
   mkdirSync(credentialsDir(home), { recursive: true, mode: 448 });
@@ -16082,7 +17998,7 @@ function controlPlaneUrl(env = process.env) {
 }
 
 // ../../packages/sdk/src/callback-server.ts
-import { createServer } from "http";
+import { createServer as createServer2 } from "http";
 
 // ../../packages/sdk/src/callback-page.ts
 function escapeHtml(value) {
@@ -16229,11 +18145,11 @@ function sendPage(res, status, html) {
 async function startCallbackServer() {
   let resolveCode;
   let rejectCode;
-  const codePromise = new Promise((resolve5, reject) => {
-    resolveCode = resolve5;
+  const codePromise = new Promise((resolve10, reject) => {
+    resolveCode = resolve10;
     rejectCode = reject;
   });
-  const server = createServer((req, res) => {
+  const server = createServer2((req, res) => {
     const url2 = new URL(req.url ?? "/", "http://localhost");
     if (url2.pathname !== "/callback") {
       res.statusCode = 404;
@@ -16259,7 +18175,7 @@ async function startCallbackServer() {
     sendPage(res, 200, successPage());
     resolveCode(code);
   });
-  await new Promise((resolve5) => server.listen(0, "127.0.0.1", resolve5));
+  await new Promise((resolve10) => server.listen(0, "127.0.0.1", resolve10));
   const port = server.address().port;
   return {
     port,
@@ -16484,10 +18400,12 @@ function buildLogEntry(row) {
 }
 
 // ../../packages/sdk/src/client.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 45e3;
 var NaroClient = class {
   baseUrl;
   getAccessToken;
   doFetch;
+  requestTimeoutMs;
   teams;
   projects;
   github;
@@ -16495,10 +18413,12 @@ var NaroClient = class {
   env;
   domains;
   logs;
+  db;
   constructor(options) {
     this.baseUrl = (options.baseUrl ?? controlPlaneUrl()).replace(/\/$/, "");
     this.getAccessToken = options.getAccessToken;
     this.doFetch = options.fetch ?? fetch;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     this.teams = new TeamsApi(this);
     this.projects = new ProjectsApi(this);
     this.github = new GithubApi(this);
@@ -16506,6 +18426,7 @@ var NaroClient = class {
     this.env = new EnvApi(this);
     this.domains = new DomainsApi(this);
     this.logs = new LogsApi(this);
+    this.db = new DbApi(this);
   }
   async request(path, options) {
     const token = await this.getAccessToken();
@@ -16517,9 +18438,17 @@ var NaroClient = class {
           Authorization: `Bearer ${token}`,
           ...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
         },
-        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {}
+        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+        signal: AbortSignal.timeout(this.requestTimeoutMs)
       });
     } catch (error51) {
+      if (error51 instanceof Error && (error51.name === "TimeoutError" || error51.name === "AbortError")) {
+        throw new NaroError(
+          "TIMEOUT",
+          `${options.context} timed out after ${String(Math.round(this.requestTimeoutMs / 1e3))}s.`,
+          { cause: error51 }
+        );
+      }
       throw new NaroError(
         "NETWORK_ERROR",
         `${options.context} failed: could not reach ${this.baseUrl}.`,
@@ -16687,11 +18616,23 @@ var DeploymentsApi = class {
     );
     return deploymentInfo(body.deployment);
   }
+  /**
+   * Stops an in-flight build (QUEUED through BUILDING) and marks the row
+   * FAILED/CANCELED. A deployment that has reached DEPLOYING is past the
+   * point where stopping is safe and answers DEPLOYMENT_NOT_CANCELABLE.
+   */
+  async cancel(projectId, deploymentId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/deployments/${encodeURIComponent(deploymentId)}/cancel`,
+      { method: "POST", context: "Cancel deployment" }
+    );
+    return deploymentInfo(body.deployment);
+  }
   /** Polls a deployment until READY/FAILED, streaming new build logs. */
   async wait(deploymentId, options = {}) {
     const intervalMs = options.intervalMs ?? 2500;
     const timeoutMs = options.timeoutMs ?? 15 * 6e4;
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+    const sleep2 = options.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
     const startedAt = Date.now();
     let lastStatus = null;
     let lastSequence = -1;
@@ -16715,7 +18656,7 @@ var DeploymentsApi = class {
           { details: { deploymentId } }
         );
       }
-      await sleep(intervalMs);
+      await sleep2(intervalMs);
     }
   }
 };
@@ -16771,6 +18712,9 @@ var EnvApi = class {
     return matches.length;
   }
 };
+function normalizeHostname(hostname3) {
+  return hostname3.trim().toLowerCase().replace(/\.+$/, "");
+}
 var DomainsApi = class {
   constructor(client) {
     this.client = client;
@@ -16782,12 +18726,27 @@ var DomainsApi = class {
     );
     return body.domains;
   }
-  async add(projectId, hostname3) {
-    const body = await this.client.request(
-      `/api/projects/${encodeURIComponent(projectId)}/domains`,
-      { method: "POST", body: { hostname: hostname3 }, context: "Add domain" }
-    );
-    return body.domain;
+  /**
+   * Attaches a hostname.
+   *
+   * `withWww` is the apex pair the web panel offers, ticked by default: the
+   * server also registers www.<apex> and turns the apex into a 308 redirect to
+   * it, because most registrars (Gabia, Whois, Cafe24, GoDaddy) cannot put a
+   * CNAME on an apex at all. Leaving it out is not the same as passing false —
+   * it means "don't ask for the pair" — so any caller that wants the panel's
+   * behaviour has to send it. The server ignores it for a hostname that is not
+   * an apex, so it is safe to pass unconditionally.
+   */
+  async add(projectId, hostname3, options = {}) {
+    const body = await this.client.request(`/api/projects/${encodeURIComponent(projectId)}/domains`, {
+      method: "POST",
+      body: {
+        hostname: hostname3,
+        ...options.withWww === void 0 ? {} : { withWww: options.withWww }
+      },
+      context: "Add domain"
+    });
+    return body.companion ? { ...body.domain, companion: body.companion } : body.domain;
   }
   async refresh(projectId, domainId) {
     const body = await this.client.request(
@@ -16796,6 +18755,38 @@ var DomainsApi = class {
     );
     return body.domain;
   }
+  /**
+   * Forces a check instead of reading the last one back: the control plane
+   * asks Cloudflare to revalidate now (skipping its hours-long backoff),
+   * probes DNS and returns the recomputed diagnosis. This is what turns a
+   * stuck "pending" into something the user can act on, so `refresh` is not
+   * a substitute for it.
+   *
+   * `auto: true` marks a check nobody asked for (a polling loop, a page that
+   * refreshes itself). Revalidating rotates Cloudflare's DCV token, so a
+   * background check would invalidate the TXT value the user is halfway
+   * through pasting into their registrar; the server reads the stored state
+   * instead for those. The DNS probe happens either way — it is the cheap half.
+   *
+   * The body is always sent, even for the default: a POST with no body at all
+   * is the shape a JSON-parsing route rejects outright.
+   */
+  async verify(projectId, domainId, options = {}) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}/verify`,
+      {
+        method: "POST",
+        body: { auto: options.auto === true },
+        context: "Verify domain"
+      }
+    );
+    return body.domain;
+  }
+  /** Verifies by the handle users actually have: the hostname. */
+  async verifyByHostname(projectId, hostname3, options = {}) {
+    const match = await this.findByHostname(projectId, hostname3);
+    return this.verify(projectId, match.id, options);
+  }
   async removeById(projectId, domainId) {
     await this.client.request(
       `/api/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domainId)}`,
@@ -16804,8 +18795,19 @@ var DomainsApi = class {
   }
   /** Removes a domain by hostname. */
   async remove(projectId, hostname3) {
+    const match = await this.findByHostname(projectId, hostname3);
+    await this.removeById(projectId, match.id);
+  }
+  /**
+   * Domain ids exist only in our database, so every hostname-shaped call has
+   * to translate through the list first.
+   */
+  async findByHostname(projectId, hostname3) {
+    const wanted = normalizeHostname(hostname3);
     const domains = await this.list(projectId);
-    const match = domains.find((domain2) => domain2.hostname === hostname3);
+    const match = domains.find(
+      (domain2) => normalizeHostname(domain2.hostname) === wanted
+    );
     if (!match) {
       throw new NaroError(
         "DOMAIN_NOT_FOUND",
@@ -16813,7 +18815,7 @@ var DomainsApi = class {
         { details: { hostname: hostname3 } }
       );
     }
-    await this.removeById(projectId, match.id);
+    return match;
   }
 };
 var LogsApi = class {
@@ -16831,10 +18833,234 @@ var LogsApi = class {
     return body.entries;
   }
 };
+var EXPORT_FIRST_POLL_MS = 1e3;
+var EXPORT_MAX_POLL_MS = 5e3;
+var EXPORT_TIMEOUT_MS = 15 * 6e4;
+var DbApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  path(projectId, suffix = "") {
+    return `/api/projects/${encodeURIComponent(projectId)}/database${suffix}`;
+  }
+  async info(projectId) {
+    const body = await this.client.request(
+      this.path(projectId),
+      { context: "Read database" }
+    );
+    return body.database;
+  }
+  /** Idempotent: turns the provider on and provisions the D1 when there is none. */
+  async enable(projectId) {
+    const body = await this.client.request(
+      this.path(projectId),
+      { method: "POST", body: {}, context: "Enable database" }
+    );
+    return body.database;
+  }
+  async query(projectId, input) {
+    const body = await this.client.request(
+      this.path(projectId, "/query"),
+      {
+        method: "POST",
+        // Only the keys given: the server validates each one it sees.
+        body: {
+          sql: input.sql,
+          ...input.params !== void 0 ? { params: input.params } : {},
+          ...input.readOnly !== void 0 ? { readOnly: input.readOnly } : {}
+        },
+        context: "Run SQL"
+      }
+    );
+    return body.result;
+  }
+  async tables(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/tables"),
+      { context: "List tables" }
+    );
+    return body.tables;
+  }
+  /** The `d1_migrations` ledger, oldest first; [] when nothing was ever applied. */
+  async migrations(projectId) {
+    const body = await this.client.request(
+      this.path(projectId, "/migrations"),
+      { context: "List migrations" }
+    );
+    return body.migrations;
+  }
+  /**
+   * Runs one migration file and records it. All-or-nothing: when a statement
+   * fails, D1 rolls the whole file back and nothing is recorded. The
+   * request makes three round trips against the 45s client timeout, so a
+   * `TIMEOUT` here leaves the outcome unknown — check `migrations()` before
+   * retrying rather than re-running the file blind.
+   */
+  async applyMigration(projectId, input) {
+    return this.client.request(
+      this.path(projectId, "/migrations"),
+      {
+        method: "POST",
+        body: { name: input.name, sql: input.sql },
+        context: "Apply migration"
+      }
+    );
+  }
+  /**
+   * The current Time Travel bookmark, or the one `timestamp` (RFC 3339 with a
+   * timezone, or Unix seconds) names. The server checks the range - the last
+   * 30 days, not before the database existed - before asking Cloudflare.
+   */
+  async bookmark(projectId, options = {}) {
+    const query = options.timestamp === void 0 ? "" : `?timestamp=${encodeURIComponent(options.timestamp)}`;
+    const body = await this.client.request(
+      this.path(projectId, `/bookmark${query}`),
+      { context: "Read bookmark" }
+    );
+    return { bookmark: body.bookmark, timestamp: body.timestamp };
+  }
+  /**
+   * Rolls the database back to a bookmark or a timestamp - rows, schema and
+   * the migration ledger alike - and cancels queries in flight. Restoring to
+   * `previousBookmark` undoes it.
+   */
+  async restore(projectId, target) {
+    const given = target;
+    const body = await this.client.request(
+      this.path(projectId, "/restore"),
+      {
+        method: "POST",
+        body: {
+          ...given.bookmark !== void 0 ? { bookmark: given.bookmark } : {},
+          ...given.timestamp !== void 0 ? { timestamp: given.timestamp } : {}
+        },
+        context: "Restore database"
+      }
+    );
+    return { bookmark: body.bookmark, previousBookmark: body.previousBookmark };
+  }
+  /**
+   * One step of an export: starts it, or - with the first step's
+   * `atBookmark` as `currentBookmark` - polls it. See `export` for the loop.
+   */
+  async exportStep(projectId, options = {}) {
+    const body = await this.client.request(
+      this.path(projectId, "/export"),
+      {
+        method: "POST",
+        // Only the keys given: the server validates each one it sees.
+        body: {
+          ...options.schemaOnly !== void 0 ? { schemaOnly: options.schemaOnly } : {},
+          ...options.dataOnly !== void 0 ? { dataOnly: options.dataOnly } : {},
+          ...options.tables !== void 0 ? { tables: options.tables } : {},
+          ...options.currentBookmark !== void 0 ? { currentBookmark: options.currentBookmark } : {}
+        },
+        context: "Export database"
+      }
+    );
+    return body.export;
+  }
+  /**
+   * Exports the database and polls until the dump is ready. The server takes
+   * one Cloudflare step per call - a big database runs for minutes, longer
+   * than a Worker should wait - so the loop is here: 1 s, then 1.5x per poll
+   * up to 5 s. Cloudflare holds every other query to the database while the
+   * export runs.
+   *
+   * On TIMEOUT the export is still running at Cloudflare; nothing was
+   * cancelled.
+   */
+  async export(projectId, options = {}, wait = {}) {
+    const timeoutMs = wait.timeoutMs ?? EXPORT_TIMEOUT_MS;
+    const sleep2 = wait.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+    const given = wait.pollIntervalMs;
+    const firstPollMs = given !== void 0 && Number.isFinite(given) && given > 0 ? given : EXPORT_FIRST_POLL_MS;
+    const maxPollMs = Math.max(EXPORT_MAX_POLL_MS, firstPollMs);
+    const startedAt = Date.now();
+    let step = await this.exportStep(projectId, options);
+    wait.onProgress?.(step);
+    const currentBookmark = step.atBookmark;
+    const polled = {
+      ...options,
+      ...step.tables !== void 0 ? { tables: step.tables } : {}
+    };
+    let intervalMs = firstPollMs;
+    while (step.status !== "complete") {
+      if (Date.now() - startedAt >= timeoutMs) {
+        throw new NaroError(
+          "TIMEOUT",
+          `The export was still running after ${String(Math.round(timeoutMs / 6e4))} minutes. Cloudflare keeps it going; run naro db dump again later.`,
+          { details: { atBookmark: currentBookmark } }
+        );
+      }
+      await sleep2(intervalMs);
+      intervalMs = Math.min(intervalMs * 1.5, maxPollMs);
+      step = await this.exportStep(projectId, { ...polled, currentBookmark });
+      wait.onProgress?.(step);
+    }
+    return step;
+  }
+  /**
+   * Records the remote schema as the already-applied migration `name` and
+   * returns its SQL - a baseline for a database that has none. Refused with
+   * DATABASE_HAS_MIGRATIONS when the ledger has rows, DATABASE_EMPTY when
+   * there is no schema. The caller writes the file.
+   */
+  async pull(projectId, input) {
+    return this.client.request(this.path(projectId, "/pull"), {
+      method: "POST",
+      body: { name: input.name },
+      context: "Pull schema"
+    });
+  }
+};
+
+// ../../packages/sdk/src/database.ts
+var BOOKMARK_RE = /^[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{8}-[0-9a-f]{32}$/;
+var BOOKMARK_FORMAT_MESSAGE = "bookmark must look like 00000001-00000008-000050ed-272153b8520cfb93b49834d93a1a1ab3 (four hyphen-separated hex groups, 59 characters).";
+function isBookmark(value) {
+  return typeof value === "string" && BOOKMARK_RE.test(value);
+}
+var RESTORE_OUTCOME_UNKNOWN_CODES = /* @__PURE__ */ new Set([
+  "DATABASE_RESTORE_FAILED",
+  "DATABASE_UNAVAILABLE",
+  "TIMEOUT",
+  "NETWORK_ERROR"
+]);
+var MAX_CELL_CHARS = 60;
+function formatCell(value) {
+  if (value === null || value === void 0) return "NULL";
+  const text = typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+  const oneLine = text.replace(/\s+/g, " ");
+  return oneLine.length > MAX_CELL_CHARS ? `${oneLine.slice(0, MAX_CELL_CHARS - 1)}\u2026` : oneLine;
+}
+function renderRows(statement) {
+  if (statement.columns.length === 0) return [];
+  const cells = statement.rows.map(
+    (row) => statement.columns.map((_, index) => formatCell(row[index]))
+  );
+  const widths = statement.columns.map(
+    (column, index) => Math.max(column.length, ...cells.map((row) => row[index]?.length ?? 0))
+  );
+  const line = (values) => values.map((value, index) => value.padEnd(widths[index] ?? 0)).join("  ").trimEnd();
+  return [
+    line(statement.columns),
+    widths.map((width) => "-".repeat(width)).join("  "),
+    ...cells.map(line)
+  ];
+}
+function formatMs(ms) {
+  return ms >= 100 ? String(Math.round(ms)) : ms.toFixed(1);
+}
+function summarizeStatement(statement) {
+  const rows = statement.rows.length;
+  const { meta: meta3 } = statement;
+  return `\u21B3 ${String(rows)} row${rows === 1 ? "" : "s"} \xB7 ${String(meta3.rowsRead)} read \xB7 ${String(meta3.rowsWritten)} written \xB7 ${formatMs(meta3.durationMs)} ms`;
+}
 
 // ../../packages/sdk/src/dotenv.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join as join10 } from "path";
+import { join as join18 } from "path";
 function parseDotenv(text) {
   const out = {};
   for (const line of text.split(/\r?\n/)) {
@@ -16852,7 +19078,7 @@ function parseDotenv(text) {
 }
 function readProjectEnv(dir) {
   for (const name of [".env.local", ".env.production", ".env"]) {
-    const path = join10(dir, name);
+    const path = join18(dir, name);
     if (existsSync(path)) return parseDotenv(readFileSync2(path, "utf8"));
   }
   return {};
@@ -16867,8 +19093,8 @@ function serializeDotenv(vars) {
 
 // ../../packages/sdk/src/env-scan.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
-import { join as join11 } from "path";
-var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+import { join as join19 } from "path";
+var SOURCE_EXTENSIONS3 = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
   ".js",
@@ -16922,7 +19148,7 @@ function collect(dir, out) {
   for (const entry of entries) {
     if (out.length >= MAX_FILES) return;
     if (entry.isSymbolicLink()) continue;
-    const path = join11(dir, entry.name);
+    const path = join19(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRECTORIES.has(entry.name))
         continue;
@@ -16931,7 +19157,7 @@ function collect(dir, out) {
     }
     if (!entry.isFile()) continue;
     const dot = entry.name.lastIndexOf(".");
-    if (dot < 0 || !SOURCE_EXTENSIONS.has(entry.name.slice(dot))) continue;
+    if (dot < 0 || !SOURCE_EXTENSIONS3.has(entry.name.slice(dot))) continue;
     out.push(path);
   }
 }
@@ -16954,7 +19180,7 @@ function scanEnvReferences(dir) {
     }
   }
   for (const name of EXAMPLE_FILES) {
-    const path = join11(dir, name);
+    const path = join19(dir, name);
     if (!existsSync2(path)) continue;
     let parsed;
     try {
@@ -16972,11 +19198,11 @@ function scanEnvReferences(dir) {
 
 // ../../packages/sdk/src/framework.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join12 } from "path";
+import { join as join20 } from "path";
 function readPackageJson2(dir) {
   try {
     return JSON.parse(
-      readFileSync4(join12(dir, "package.json"), "utf8")
+      readFileSync4(join20(dir, "package.json"), "utf8")
     );
   } catch {
     return null;
@@ -16987,7 +19213,7 @@ function hasDependency(pkg, name) {
 }
 function hasConfig(dir, base2, evidence) {
   for (const ext of ["js", "mjs", "cjs", "ts", "mts"]) {
-    if (existsSync3(join12(dir, `${base2}.${ext}`))) {
+    if (existsSync3(join20(dir, `${base2}.${ext}`))) {
       evidence.push(`${base2}.${ext}`);
       return true;
     }
@@ -16999,8 +19225,8 @@ function detectFramework2(dir) {
   const pkg = readPackageJson2(dir);
   if (hasDependency(pkg, "next") || hasConfig(dir, "next.config", evidence)) {
     if (hasDependency(pkg, "next")) evidence.push("package.json: next");
-    if (existsSync3(join12(dir, "app"))) evidence.push("app/");
-    if (existsSync3(join12(dir, "pages"))) evidence.push("pages/");
+    if (existsSync3(join20(dir, "app"))) evidence.push("app/");
+    if (existsSync3(join20(dir, "pages"))) evidence.push("pages/");
     return {
       framework: "nextjs",
       name: "Next.js",
@@ -17054,7 +19280,7 @@ function detectFramework2(dir) {
       deployable: true
     };
   }
-  if (!pkg && existsSync3(join12(dir, "index.html"))) {
+  if (!pkg && existsSync3(join20(dir, "index.html"))) {
     evidence.push("index.html (no package.json)");
     return {
       framework: "static",
@@ -17075,6 +19301,71 @@ function detectFramework2(dir) {
   };
 }
 
+// ../../packages/sdk/src/generate-types.ts
+var HEADER = [
+  "// Generated by `naro gen types`. Do not edit - re-run the command instead.",
+  "// `D1Database` comes from @cloudflare/workers-types."
+];
+function valueType(declared) {
+  const type = declared.toUpperCase();
+  if (type.trim() === "") return "number | string | ArrayBuffer";
+  if (type.includes("INT")) return "number";
+  if (type.includes("CHAR") || type.includes("CLOB") || type.includes("TEXT"))
+    return "string";
+  if (type.includes("BLOB")) return "ArrayBuffer";
+  if (type.includes("REAL") || type.includes("FLOA") || type.includes("DOUB"))
+    return "number";
+  return "number | string";
+}
+function interfaceBase(tableName) {
+  const pascal = tableName.split(/[^A-Za-z0-9$]+/).filter((word) => word.length > 0).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("").replace(/[^A-Za-z0-9_$]/g, "");
+  return pascal === "" || /^[0-9]/.test(pascal) ? `_${pascal}` : pascal;
+}
+function rowidAlias(table) {
+  const keys = table.columns.filter((column) => column.primaryKey);
+  const only = keys.length === 1 ? keys[0] : void 0;
+  return only && only.type.trim().toUpperCase() === "INTEGER" ? only.name : null;
+}
+var UNICODE_ESCAPE = `${String.fromCharCode(92)}u`;
+function keyLiteral(name) {
+  return JSON.stringify(name).replace(
+    /[^ -~]/g,
+    (unit) => `${UNICODE_ESCAPE}${unit.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+}
+function property(column, alias) {
+  const nullable2 = !column.notNull && column.name !== alias;
+  return `  ${keyLiteral(column.name)}: ${valueType(column.type)}${nullable2 ? " | null" : ""};`;
+}
+function block(name, lines) {
+  return lines.length === 0 ? [`export interface ${name} {}`] : [`export interface ${name} {`, ...lines, "}"];
+}
+function generateTypes(tables) {
+  const used = /* @__PURE__ */ new Set();
+  const out = [...HEADER];
+  const map2 = [];
+  for (const table of tables) {
+    const base2 = `${interfaceBase(table.name)}Row`;
+    let name = base2;
+    for (let suffix = 2; used.has(name); suffix += 1)
+      name = `${base2}_${String(suffix)}`;
+    used.add(name);
+    const alias = rowidAlias(table);
+    out.push(
+      "",
+      ...block(
+        name,
+        table.columns.map((column) => property(column, alias))
+      )
+    );
+    map2.push(`  ${keyLiteral(table.name)}: ${name};`);
+  }
+  out.push("", ...block("Database", map2));
+  out.push("", ...block("Env", ["  DB: D1Database;"]));
+  return `${out.join("\n")}
+`;
+}
+
 // ../../packages/sdk/src/link.ts
 import {
   existsSync as existsSync4,
@@ -17083,12 +19374,12 @@ import {
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join13 } from "path";
+import { join as join21 } from "path";
 function linkDir(dir) {
-  return join13(dir, ".naro");
+  return join21(dir, ".naro");
 }
 function linkFile(dir) {
-  return join13(linkDir(dir), "project.json");
+  return join21(linkDir(dir), "project.json");
 }
 function readProjectLink(dir) {
   try {
@@ -17110,7 +19401,7 @@ function writeProjectLink(dir, link) {
   writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
 `);
   writeFileSync2(
-    join13(linkDir(dir), "README.txt"),
+    join21(linkDir(dir), "README.txt"),
     "This directory links the project to Naro and should not be committed.\n"
   );
 }
@@ -17120,9 +19411,9 @@ function removeProjectLink(dir) {
   return true;
 }
 function ensureGitignoreHasNaro(dir) {
-  const gitignorePath = join13(dir, ".gitignore");
+  const gitignorePath = join21(dir, ".gitignore");
   const hasGitignore = existsSync4(gitignorePath);
-  if (!hasGitignore && !existsSync4(join13(dir, ".git"))) return false;
+  if (!hasGitignore && !existsSync4(join21(dir, ".git"))) return false;
   const current = hasGitignore ? readFileSync5(gitignorePath, "utf8") : "";
   const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
   if (covered) return false;
@@ -17132,9 +19423,94 @@ function ensureGitignoreHasNaro(dir) {
   return true;
 }
 
+// ../../packages/sdk/src/migrations.ts
+import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
+import { resolve as resolve8 } from "path";
+function resolveMigrationsDir(input) {
+  if (input.dir) return resolve8(input.baseDir, input.dir);
+  return resolve8(input.baseDir, input.rootDirectory ?? "", "migrations");
+}
+function normalizeMigrationName(name) {
+  return name.trim().toLowerCase().replace(/\.sql$/, "").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function leadingNumber(name) {
+  const match = /^(\d+)/.exec(name);
+  return match ? Number(match[1]) : null;
+}
+function sortMigrationNames(names) {
+  return names.toSorted((a, b) => {
+    const left = leadingNumber(a);
+    const right = leadingNumber(b);
+    if (left !== null && right !== null && left !== right) return left - right;
+    if (left === null && right !== null) return 1;
+    if (left !== null && right === null) return -1;
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}
+function highestMigrationNumber(names) {
+  return names.reduce(
+    (max, name) => Math.max(max, leadingNumber(name) ?? 0),
+    0
+  );
+}
+function listMigrationFiles(dir) {
+  if (!existsSync5(dir)) return [];
+  return sortMigrationNames(
+    readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name)
+  );
+}
+function nextMigrationFileName(existing, name) {
+  const normalized = normalizeMigrationName(name);
+  if (normalized === "")
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      "Migration name must contain letters or digits."
+    );
+  const number4 = String(highestMigrationNumber(existing) + 1).padStart(4, "0");
+  return `${number4}_${normalized}.sql`;
+}
+function compareMigrations(local, applied) {
+  const ledger = new Map(applied.map((row) => [row.name, row]));
+  const highestApplied = highestMigrationNumber(applied.map((row) => row.name));
+  const rows = [];
+  for (const name of local) {
+    const exact = ledger.get(name);
+    if (exact) {
+      ledger.delete(name);
+      rows.push({ name, status: "applied", appliedAt: exact.appliedAt });
+      continue;
+    }
+    const bare = ledger.get(name.replace(/\.sql$/, ""));
+    if (bare) {
+      ledger.delete(bare.name);
+      rows.push({
+        name,
+        status: "applied",
+        appliedAt: bare.appliedAt,
+        warning: "ledger-name-missing-extension"
+      });
+      continue;
+    }
+    const number4 = leadingNumber(name);
+    rows.push({
+      name,
+      status: "pending",
+      ...number4 !== null && number4 < highestApplied ? { warning: "out-of-order" } : {}
+    });
+  }
+  for (const row of ledger.values())
+    rows.push({
+      name: row.name,
+      status: "remote-only",
+      appliedAt: row.appliedAt
+    });
+  const order = sortMigrationNames(rows.map((row) => row.name));
+  return rows.toSorted((a, b) => order.indexOf(a.name) - order.indexOf(b.name));
+}
+
 // src/env-consent.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join22 } from "path";
 var DOTENV_FILES = [".env.local", ".env.production", ".env"];
 var PUBLIC_PREFIXES = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_"];
 function maskEnvValue(key, value) {
@@ -17143,7 +19519,7 @@ function maskEnvValue(key, value) {
   return value.length <= 8 ? "****" : `${value.slice(0, 4)}****`;
 }
 function findDotenvFile(dir) {
-  for (const name of DOTENV_FILES) if (existsSync5(join14(dir, name))) return name;
+  for (const name of DOTENV_FILES) if (existsSync6(join22(dir, name))) return name;
   return null;
 }
 function envAddGuidance(keys) {
@@ -17200,10 +19576,10 @@ var SUPPORTED_REMOTE = [
   /^ssh:\/\/[^\s]+$/,
   /^git@[A-Za-z0-9.-]+:[A-Za-z0-9._/-]+(\.git)?$/
 ];
-var defaultExec = (args, cwd) => new Promise((resolve5, reject) => {
+var defaultExec = (args, cwd) => new Promise((resolve10, reject) => {
   execFile("git", args, { cwd }, (error51, stdout) => {
     if (error51) reject(error51);
-    else resolve5(stdout);
+    else resolve10(stdout);
   });
 });
 async function tryExec(exec, args, cwd) {
@@ -17335,8 +19711,8 @@ function parseDotenv2(text) {
 function readProjectEnv2(dir) {
   return readProjectEnv(dir);
 }
-function eventsObserver(cp2, deploymentId, token, fetchImpl = fetch) {
-  const post = (body) => fetchImpl(`${cp2}/api/internal/deployments/${deploymentId}/events`, {
+function eventsObserver(cp3, deploymentId, token, fetchImpl = fetch, logIngestUrl) {
+  const post = (body) => fetchImpl(`${cp3}/api/internal/deployments/${deploymentId}/events`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -17353,18 +19729,48 @@ function eventsObserver(cp2, deploymentId, token, fetchImpl = fetch) {
       } catch (error51) {
         lastError = error51;
         await new Promise(
-          (resolve5) => setTimeout(resolve5, 500 * (attempt + 1))
+          (resolve10) => setTimeout(resolve10, 500 * (attempt + 1))
         );
       }
     }
     throw lastError;
   };
+  const send = createLogSender({
+    ...logIngestUrl ? { ingestUrl: logIngestUrl } : {},
+    toIngest: logIngestUrl ? (logs) => fetchImpl(`${logIngestUrl}/deployments/${deploymentId}/logs`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({ logs })
+    }) : null,
+    toControlPlane: (logs) => post({ type: "logs", logs }),
+    // The CLI swallows log failures so a deploy never dies over a log line.
+    warn: (message) => post({
+      type: "log",
+      log: { level: "WARN", stage: "BUILDING", message }
+    }).catch(() => void 0)
+  });
+  const batcher = createLogBatcher({
+    limit: DEPLOYMENT_LOG_BATCH_LIMIT,
+    intervalMs: DEPLOYMENT_LOG_FLUSH_MS,
+    send
+  });
+  const flushLogs = () => batcher.flush().catch(() => {
+  });
   return {
-    onStatus: (status) => postStatus({ type: "status", status }),
-    onLog: (log2) => post({ type: "log", log: log2 }).catch(() => {
+    onStatus: async (status) => {
+      await flushLogs();
+      await postStatus({ type: "status", status });
+    },
+    onLog: (log2) => batcher.add(log2).catch(() => {
     }),
-    onMetadata: (metadata) => post({ type: "metadata", metadata }).catch(() => {
-    })
+    onMetadata: async (metadata) => {
+      await flushLogs();
+      await post({ type: "metadata", metadata }).catch(() => {
+      });
+    }
   };
 }
 function slugify2(value) {
@@ -17374,20 +19780,20 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile7(join15(sourceDir, "package.json"), "utf8")
+      await readFile13(join23(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
   }
-  return basename(sourceDir);
+  return basename3(sourceDir);
 }
 var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.turbo|\.naro)([\\/]|$)/;
 function resolveBin(name) {
-  let dir = dirname(fileURLToPath(import.meta.url));
+  let dir = dirname4(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const candidate = join15(dir, "node_modules", ".bin", name);
-    if (existsSync6(candidate)) return candidate;
-    const parent = dirname(dir);
+    const candidate = join23(dir, "node_modules", ".bin", name);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname4(dir);
     if (parent === dir) return name;
     dir = parent;
   }
@@ -17405,20 +19811,25 @@ async function detectPackageManagerLenient(root) {
         "--no-fund",
         "--legacy-peer-deps"
       ],
+      addArgs: (specs) => ["npm", "install", "--no-save", ...specs],
       cacheArgs: (dir) => ["--cache", dir]
     };
   }
 }
 function localDependencies(sourceDir) {
   return {
-    createWorkspace: () => mkdtemp2(join15(tmpdir2(), "naro-build-")),
-    removeWorkspace: (path) => rm2(path, { recursive: true, force: true }),
+    createWorkspace: () => mkdtemp2(join23(tmpdir2(), "naro-build-")),
+    removeWorkspace: (path) => rm3(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
         const checkout = spec.args.at(-1);
         if (!checkout) throw new Error("Missing checkout path.");
-        await cp(sourceDir, checkout, {
+        await cp2(sourceDir, checkout, {
           recursive: true,
+          // Relative symlinks must stay relative: resolved, they would point
+          // back into the developer's real tree, and a strategy's temporary
+          // rewrite (proxy -> middleware, vinext toolchain) would land there.
+          verbatimSymlinks: true,
           filter: (src) => !COPY_SKIP.test(src)
         });
         return { stdout: [], stderr: [] };
@@ -17439,13 +19850,16 @@ function localDependencies(sourceDir) {
     createPlatformBuildConfig,
     readOpenNextArtifact,
     openNextCommand: resolveBin("opennextjs-cloudflare"),
-    wranglerCommand: resolveBin("wrangler")
+    wranglerCommand: resolveBin("wrangler"),
+    // `vinext check` runs on the bare checkout, before the toolchain is added
+    // to the user's tree, so this binary has to come from the CLI's own deps.
+    vinextCommand: resolveBin("vinext")
   };
 }
 async function deployDirectory(sourceDir, options, log2) {
   const cpUrl = controlPlaneUrl();
   const production = options.production ?? false;
-  const appRoot = options.rootDirectory ? resolve4(sourceDir, options.rootDirectory) : sourceDir;
+  const appRoot = options.rootDirectory ? resolve9(sourceDir, options.rootDirectory) : sourceDir;
   const framework = detectFramework2(appRoot);
   if (!framework.deployable && !options.force) {
     throw new NaroError(
@@ -17518,7 +19932,8 @@ async function deployDirectory(sourceDir, options, log2) {
     cpUrl,
     ctx.deploymentId,
     ctx.callbackToken,
-    options.fetch
+    options.fetch,
+    ctx.logIngestUrl
   );
   let artifact;
   try {
@@ -17529,7 +19944,9 @@ async function deployDirectory(sourceDir, options, log2) {
         repositoryUrl: sourceDir,
         branch: ctx.branch,
         rootDirectory: options.rootDirectory ?? null,
-        env: { ...ctx.env, ...envToSend }
+        env: { ...ctx.env, ...envToSend },
+        strategy: ctx.strategy ?? null,
+        ...ctx.vinextEnabled === void 0 ? {} : { vinextEnabled: ctx.vinextEnabled }
       },
       observer,
       createCacheTransport({
@@ -17609,11 +20026,21 @@ export {
   openBrowser,
   isTerminalStatus,
   NaroClient,
+  BOOKMARK_FORMAT_MESSAGE,
+  isBookmark,
+  RESTORE_OUTCOME_UNKNOWN_CODES,
+  renderRows,
+  summarizeStatement,
   serializeDotenv,
+  generateTypes,
   readProjectLink,
   writeProjectLink,
   removeProjectLink,
   ensureGitignoreHasNaro,
+  resolveMigrationsDir,
+  listMigrationFiles,
+  nextMigrationFileName,
+  compareMigrations,
   promptForMissingEnv,
   detectGitInfo,
   parseDotenv2 as parseDotenv,