void 0.10.12 → 0.10.13

package/dist/cli/cli.mjs

@@ -2078,7 +2078,7 @@ else if (command === "deploy") {
 		log.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../deploy-u7Rv9q_q.mjs").then((n) => n.t).then(({ runDeploy }) => {
+	import("../deploy-jBJT1fUT.mjs").then((n) => n.t).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -2096,9 +2096,9 @@ else if (command === "deploy") {
 else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-D_w-4w5B.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
 else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-Dt32J6RI.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
 else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-DiaNQbrl.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-DOiJMRt2.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-C0i0sYMS.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
 else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-CZy5MorI.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-o_w-8yI8.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-BzXf3Jh2.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
 else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-DKcGUNsj.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
 else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-Bujrv5q-.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
 else if (command === "prepare") {
@@ -2110,7 +2110,7 @@ else if (command === "prepare") {
 		log.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../prepare-BoKHgMNx.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-BvvgAz-3.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			log.error(err.message ?? err);
 			process.exit(1);
@@ -2118,7 +2118,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-3rgHKBVi.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-7JCAcKNQ.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -2217,12 +2217,12 @@ else if (command === "-v" || command === "--version") {
 		const root = process.cwd();
 		switch (cmd) {
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-3rgHKBVi.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-7JCAcKNQ.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-u7Rv9q_q.mjs").then((n) => n.t);
+				const { runDeploy } = await import("../deploy-jBJT1fUT.mjs").then((n) => n.t);
 				await runDeploy(root);
 				return;
 			}
@@ -2237,11 +2237,11 @@ else if (command === "-v" || command === "--version") {
 			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-DiaNQbrl.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
 			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-DKcGUNsj.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
 			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-Bujrv5q-.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-DOiJMRt2.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-C0i0sYMS.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
 			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-CZy5MorI.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-o_w-8yI8.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-BzXf3Jh2.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-BoKHgMNx.mjs");
+				const { runPrepareCommand } = await import("../prepare-BvvgAz-3.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}

package/dist/{config-BkTvs43g.mjs → config-qHGgPuWT.mjs}

@@ -58,6 +58,8 @@ const VALID_REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	308
 ]);
 const VALID_DATABASE_VALUES = /* @__PURE__ */ new Set(["pg"]);
+/** Cloudflare's hard maximum for Workers CPU time per request (5 minutes). */
+const MAX_WORKER_CPU_MS = 3e5;
 const VALID_SANDBOX_INSTANCE_TYPES = /* @__PURE__ */ new Set([
 	"dev",
 	"lite",
@@ -439,6 +441,14 @@ function readConfig(root) {
 			if (typeof w.vars !== "object" || w.vars === null || Array.isArray(w.vars)) throw new Error(`config: "worker.vars" in ${CONFIG_FILE} must be an object.`);
 			for (const [key, value] of Object.entries(w.vars)) if (typeof value !== "string") throw new Error(`config: "worker.vars.${key}" in ${CONFIG_FILE} must be a string.`);
 		}
+		if (w.limits !== void 0) {
+			if (typeof w.limits !== "object" || w.limits === null || Array.isArray(w.limits)) throw new Error(`config: "worker.limits" in ${CONFIG_FILE} must be an object.`);
+			const limits = w.limits;
+			for (const key of Object.keys(limits)) if (key !== "cpu_ms") throw new Error(`config: Unknown key 'worker.limits.${key}' in ${CONFIG_FILE}. Valid: cpu_ms.`);
+			if (limits.cpu_ms !== void 0) {
+				if (typeof limits.cpu_ms !== "number" || !Number.isInteger(limits.cpu_ms) || limits.cpu_ms < 1 || limits.cpu_ms > MAX_WORKER_CPU_MS) throw new Error(`config: "worker.limits.cpu_ms" in ${CONFIG_FILE} must be an integer between 1 and ${MAX_WORKER_CPU_MS}.`);
+			}
+		}
 	}
 	if (obj.database !== void 0) {
 		if (typeof obj.database !== "string" || !VALID_DATABASE_VALUES.has(obj.database)) throw new Error(`config: "database" in ${CONFIG_FILE} must be "pg".`);

package/dist/{db-DOiJMRt2.mjs → db-C0i0sYMS.mjs}

@@ -3,11 +3,11 @@ import { D as outro, S as confirm, T as log, a as cliTitle, j as isCancel, s as
 import { n as readProjectPaths } from "./project-paths-BQd7OmIo.mjs";
 import { t as cfAccessHeaders } from "./cf-access-Bqw81xAf.mjs";
 import { b as readProjectConfig, f as getToken, m as isStagingMode, n as PlatformClient, t as PlatformApiError } from "./client-Gb71-XkG.mjs";
-import { c as getDatabaseDialect, f as readConfig, p as resolveBindingNames } from "./config-BkTvs43g.mjs";
+import { c as getDatabaseDialect, f as readConfig, p as resolveBindingNames } from "./config-qHGgPuWT.mjs";
 import { r as detectFramework } from "./plugin-inference-DMeavIJ6.mjs";
 import { c as collectMigrations, d as stripSqlExt, f as writeJournal, n as listDrizzleArtifacts, r as validateMigrations, t as assertJournalCoherence, u as readJournal } from "./validate-Cw_RLeTj.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-D-3_D-Gl.mjs";
-import { formatTimestamp } from "./gen-o_w-8yI8.mjs";
+import { formatTimestamp } from "./gen-BzXf3Jh2.mjs";
 import { existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { execFileSync } from "node:child_process";
@@ -947,7 +947,7 @@ async function runExport(root, args, dialect) {
 	}
 }
 async function runSetUrl(root) {
-	const { readConfig: readVoidConfig, getDatabaseDialect: getDialect } = await import("./config-BkTvs43g.mjs").then((n) => n.n);
+	const { readConfig: readVoidConfig, getDatabaseDialect: getDialect } = await import("./config-qHGgPuWT.mjs").then((n) => n.n);
 	if (getDialect(readVoidConfig(root)) !== "postgresql") {
 		log.error("db: This command is only for PostgreSQL projects. Set \"database\": \"pg\" in void.json.");
 		process.exit(1);

package/dist/{deploy-u7Rv9q_q.mjs → deploy-jBJT1fUT.mjs}

@@ -1,11 +1,11 @@
-import { n as __exportAll } from "./rolldown-runtime-DJK8HYOj.mjs";
+import { n as __exportAll, r as __toESM } from "./rolldown-runtime-DJK8HYOj.mjs";
 import { a as join, c as resolve, i as isAbsolute, n as dirname, o as normalize, r as extname, s as relative, t as basename } from "./dist-DaKKDf8D.mjs";
-import { D as outro, E as note, S as confirm, T as log, a as cliTitle, j as isCancel, o as createSpinner, u as import_picocolors, w as intro } from "./agents-CtgBYqld.mjs";
+import { D as outro, E as note, M as require_picocolors, S as confirm, T as log, a as cliTitle, j as isCancel, o as createSpinner, u as import_picocolors$1, w as intro } from "./agents-CtgBYqld.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-BQd7OmIo.mjs";
-import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes, s as findVoidAuthConfig } from "./scan-DYXkrasO.mjs";
+import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes, s as findVoidAuthConfig } from "./scan-ChWt4pX1.mjs";
 import { t as cfAccessHeaders } from "./cf-access-Bqw81xAf.mjs";
 import { C as ensureCloudflaredToken, S as writeProjectConfig, a as isExpiredTokenError, b as readProjectConfig, f as getToken, i as isCliOutdatedError, m as isStagingMode, n as PlatformClient, o as parsePlatformErrorBody, p as getTokenSource, t as PlatformApiError, u as getApiUrl } from "./client-Gb71-XkG.mjs";
-import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-BkTvs43g.mjs";
+import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-qHGgPuWT.mjs";
 import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-DMeavIJ6.mjs";
 import { o as validateSsrEntry } from "./entry-D7yy4xVH.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
@@ -15,12 +15,12 @@ import { t as findEnvFile } from "./env-types-QBj-ndax.mjs";
 import { a as collectPlaintextVarWarningsFromVars, d as getDeployEnvDefaults, f as readEmittedWorkerVars, i as SelfHostSecretListError, l as fetchRemoteSecretNames, m as validateProdEnv, n as SelfHostFirstDeployError, o as deriveSelfHostEnvContextFromVars, p as selfHostSchemaFailureMessage, r as SelfHostSchemaError, s as dischargeSelfHostEnvContext, t as SelfHostEnvValidationError, u as formatEnvReport } from "./env-validation-Dea3v3ej.mjs";
 import { n as writeDrizzleConfig } from "./config-CutEMNGJ.mjs";
 import { a as buildMigrationPlanBundle, c as collectMigrations, r as validateMigrations, t as assertJournalCoherence } from "./validate-Cw_RLeTj.mjs";
-import { t as scanPages } from "./scan-DEwlM_Xy.mjs";
+import { t as scanPages } from "./scan-NU4xKGci.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-D-3_D-Gl.mjs";
 import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-DsYvl3TB.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BBMtLLV9.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-nsHIFixA.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-ChAADPQu.mjs";
 import { t as promptForLoginToken } from "./login-BT3H8PN3.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -2115,7 +2115,7 @@ async function uploadOne(item, cliLog, fetchImpl) {
 				path: item.path,
 				attempt: attempt + 1,
 				status: res.status,
-				body: truncate(errBody)
+				body: truncate$1(errBody)
 			});
 			await sleep(RETRY_BACKOFF_MS[attempt]);
 			attempt++;
@@ -2126,9 +2126,9 @@ async function uploadOne(item, cliLog, fetchImpl) {
 			path: item.path,
 			durationMs: Date.now() - startedAt,
 			status: res.status,
-			body: truncate(errBody)
+			body: truncate$1(errBody)
 		});
-		throw new DirectR2PutError(res.status, item.hash, item.path, truncate(errBody));
+		throw new DirectR2PutError(res.status, item.hash, item.path, truncate$1(errBody));
 	}
 }
 async function safeReadText(res) {
@@ -2138,7 +2138,7 @@ async function safeReadText(res) {
 		return "";
 	}
 }
-function truncate(s) {
+function truncate$1(s) {
 	return s.length > 500 ? `${s.slice(0, 500)}...` : s;
 }
 function sleep(ms) {
@@ -2270,6 +2270,23 @@ async function safeText(res) {
 //#endregion
 //#region src/cli/log-file.ts
 /**
+* Flatten an already-serialized `ErrChainNode` (as read back out of a JSONL
+* record) to a single inline string. Mirrors `formatErrorChainInline`, which
+* does the same job for a live `Error` before it is written.
+*/
+function formatErrorNodeInline(node, depth = 0) {
+	if (node == null || typeof node !== "object") return String(node);
+	const message = node.message == null ? "" : String(node.message);
+	if (depth > 5) return message;
+	let head = node.name ? `${String(node.name)}: ${message}` : message;
+	const tags = [];
+	if (node.code !== void 0) tags.push(`code=${node.code}`);
+	if (node.errno !== void 0) tags.push(`errno=${node.errno}`);
+	if (tags.length > 0) head = `${head} (${tags.join(" ")})`;
+	if (node.cause != null) return `${head} -> ${formatErrorNodeInline(node.cause, depth + 1)}`;
+	return head;
+}
+/**
 * Walk `err.cause` up to 6 levels and return a plain JSON-friendly chain.
 * Skips stack traces deliberately — keeps output line-oriented and readable.
 */
@@ -2422,6 +2439,160 @@ function openDeployLog(opts) {
 	};
 }
 //#endregion
+//#region src/cli/log-summary.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+const FIELD_VALUE_MAX = 80;
+const LINE_MAX = 160;
+const MSG_COLUMN_MAX = 28;
+const ELAPSED_WIDTH = 7;
+const LEVEL_WIDTH = 5;
+/** Width of `'  ' + elapsed + '  '`, used to indent the error sub-lines. */
+const DETAIL_INDENT = " ".repeat(11);
+/**
+* `runDeploy` writes this record last, and its `err` field is the very message
+* printed above the summary. Keeping it out of the error block avoids echoing
+* the same text twice; it still shows up as one line in the tail.
+*/
+const TERMINAL_ERROR_MSG = "deploy_end";
+const RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"ts",
+	"elapsedMs",
+	"lvl",
+	"msg",
+	"err"
+]);
+/**
+* The trace was a file the user opened by hand; the summary publishes it to
+* whatever reads stderr, which in CI is a stored, often public, log.
+*
+* Scrubbing here covers only credentials this code emits itself — a presigned
+* URL it built, an auth header it set, a field it named. Scrubbing user data is
+* left to the CI platform, which owns the secrets and masks them before the log
+* is written. GitHub Actions does this for everything under `secrets.*`. Void
+* does not guess at credential-shaped names or at credentials embedded in
+* values the user supplied.
+*/
+/** Query parameters whose value must never reach a CI log. */
+const SIGNED_QUERY_RE = /([?&](?:X-Amz-[A-Za-z0-9-]+|[Ss]ignature|sig|token|access_token|key)=)[^&\s]+/g;
+const BEARER_RE = /\b(Bearer\s+)\S+/g;
+/**
+* Field keys whose value is masked whole, whatever it looks like. `auth` is
+* deliberately absent — it matches metadata keys such as `authMethod` far more
+* often than credentials.
+*/
+const SECRET_KEY_RE = /token|secret|password|passwd|credential|cookie|signature|api[-_]?key|private[-_]?key/i;
+function redact(text) {
+	return text.replace(SIGNED_QUERY_RE, "$1[redacted]").replace(BEARER_RE, "$1[redacted]");
+}
+function truncate(text, max) {
+	return text.length <= max ? text : `${text.slice(0, max)}...`;
+}
+/** Collapse every run of whitespace so one record always renders as one line. */
+function oneLine(text) {
+	return text.replace(/\s+/g, " ").trim();
+}
+function stringifyValue(value) {
+	if (typeof value === "string") return value;
+	if (value === null || typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value) ?? String(value);
+	} catch {
+		return String(value);
+	}
+}
+/** Render one `key=value` pair, collapsed, redacted, and length-capped. */
+function formatField(key, value) {
+	if (SECRET_KEY_RE.test(key)) return `${key}=[redacted]`;
+	return `${key}=${truncate(redact(oneLine(stringifyValue(value))), FIELD_VALUE_MAX)}`;
+}
+function fieldPairs(record) {
+	const pairs = [];
+	for (const [key, value] of Object.entries(record)) {
+		if (RESERVED_KEYS.has(key) || value === void 0) continue;
+		pairs.push(formatField(key, value));
+	}
+	if (record.err !== void 0) pairs.push(`err=${truncate(redact(oneLine(formatErrorNodeInline(record.err))), FIELD_VALUE_MAX)}`);
+	return pairs;
+}
+function formatElapsed(elapsedMs) {
+	return `${((typeof elapsedMs === "number" && Number.isFinite(elapsedMs) ? elapsedMs : 0) / 1e3).toFixed(1)}s`.padStart(ELAPSED_WIDTH);
+}
+function colorLevel(level, padded) {
+	if (level === "error") return import_picocolors.default.red(padded);
+	if (level === "warn") return import_picocolors.default.yellow(padded);
+	return import_picocolors.default.dim(padded);
+}
+function parseRecords(lines) {
+	const records = [];
+	for (const raw of lines) {
+		const trimmed = raw.trim();
+		if (!trimmed) continue;
+		try {
+			const parsed = JSON.parse(trimmed);
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) records.push(parsed);
+		} catch {}
+	}
+	return records;
+}
+/** One aligned line: `  8.9s  error  deploy_server_error  message=...`. */
+function formatTailLine(record, msgWidth) {
+	const level = typeof record.lvl === "string" ? record.lvl : "info";
+	const msg = typeof record.msg === "string" ? record.msg : "";
+	const elapsed = formatElapsed(record.elapsedMs);
+	const paddedLevel = level.padEnd(LEVEL_WIDTH);
+	const paddedMsg = msg.padEnd(msgWidth);
+	const head = `  ${elapsed}  ${paddedLevel}  ${paddedMsg}`;
+	const fields = fieldPairs(record).join(" ");
+	if (!fields) return `  ${elapsed}  ${colorLevel(level, paddedLevel)}  ${msg}`;
+	const budget = Math.max(20, LINE_MAX - head.length);
+	return `  ${elapsed}  ${colorLevel(level, paddedLevel)}  ${paddedMsg}  ${truncate(fields, budget)}`;
+}
+/** An error entry: a headline, then one indented line per field. */
+function formatErrorEntry(record) {
+	const msg = typeof record.msg === "string" ? record.msg : "error";
+	const lines = [`  ${formatElapsed(record.elapsedMs)}  ${import_picocolors.default.red(msg)}`];
+	for (const pair of fieldPairs(record)) lines.push(`${DETAIL_INDENT}${pair}`);
+	return lines;
+}
+/**
+* Turn raw JSONL lines into the block appended to a failed deploy's error
+* message. Returns `null` when there is nothing worth printing.
+*
+* The block has two parts: every `error` record with its flattened cause
+* chain, then the last `LOG_TAIL_LIMIT` records for timeline context.
+*/
+function formatDeployLogSummary(lines) {
+	const records = parseRecords(lines);
+	if (records.length === 0) return null;
+	const blocks = [];
+	const errors = records.filter((r) => r.lvl === "error" && r.msg !== TERMINAL_ERROR_MSG);
+	if (errors.length > 0) {
+		const shown = errors.slice(0, 5);
+		const errorLines = shown.flatMap((record) => formatErrorEntry(record));
+		if (errors.length > shown.length) errorLines.push(`${DETAIL_INDENT}(+${errors.length - shown.length} more)`);
+		blocks.push([import_picocolors.default.bold("Errors"), ...errorLines].join("\n"));
+	}
+	const tail = records.slice(-20);
+	const msgWidth = Math.min(MSG_COLUMN_MAX, tail.reduce((max, r) => Math.max(max, typeof r.msg === "string" ? r.msg.length : 0), 0));
+	const heading = records.length > tail.length ? `Last 20 of ${records.length} entries` : `Log (${records.length} ${records.length === 1 ? "entry" : "entries"})`;
+	blocks.push([import_picocolors.default.bold(heading), ...tail.map((record) => formatTailLine(record, msgWidth))].join("\n"));
+	return `\n${blocks.join("\n\n")}`;
+}
+/**
+* Read a deploy JSONL log and format its summary. Returns `null` for a missing
+* path or any read failure — a postmortem aid must never mask the real error.
+*/
+function buildDeployLogSummary(path) {
+	if (!path) return null;
+	let text;
+	try {
+		text = readFileSync(path, "utf-8");
+	} catch {
+		return null;
+	}
+	return formatDeployLogSummary(text.split("\n"));
+}
+//#endregion
 //#region src/shared/utils.ts
 const isWindows = typeof process !== "undefined" && process.platform === "win32";
 function slash(p) {
@@ -2823,6 +2994,7 @@ function buildVoidManifest(opts) {
 	if (options?.workerMain) manifest.workerMain = options.workerMain;
 	if (options?.compatibilityDate) manifest.compatibilityDate = options.compatibilityDate;
 	if (options?.compatibilityFlags && options.compatibilityFlags.length > 0) manifest.compatibilityFlags = options.compatibilityFlags;
+	if (options?.cpuMs) manifest.limits = { cpuMs: options.cpuMs };
 	if (hashedAssetsPrefix) manifest.hashedAssetsPrefix = hashedAssetsPrefix;
 	if (headerRules && headerRules.length > 0) manifest.headerRules = headerRules;
 	if (redirectRules && redirectRules.length > 0) manifest.redirectRules = stripDevOnlyRuleFields(redirectRules);
@@ -2916,6 +3088,7 @@ function buildFrameworkManifest(opts) {
 	manifest.workerMain = po?.workerMain ?? opts.workerMain;
 	if (po?.compatibilityDate) manifest.compatibilityDate = po.compatibilityDate;
 	if (po?.compatibilityFlags && po.compatibilityFlags.length > 0) manifest.compatibilityFlags = po.compatibilityFlags;
+	if (po?.cpuMs) manifest.limits = { cpuMs: po.cpuMs };
 	if (opts.hashedAssetsPrefix) manifest.hashedAssetsPrefix = opts.hashedAssetsPrefix;
 	if (opts.headerRules && opts.headerRules.length > 0) manifest.headerRules = opts.headerRules;
 	if (opts.redirectRules && opts.redirectRules.length > 0) manifest.redirectRules = stripDevOnlyRuleFields(opts.redirectRules);
@@ -3390,7 +3563,7 @@ let loadedProvisionModule;
 * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
 */
 async function loadProvisionModule() {
-	loadedProvisionModule ??= await import("./provision-rShh6MKY.mjs");
+	loadedProvisionModule ??= await import("./provision-CPx2ZxsH.mjs");
 	return loadedProvisionModule;
 }
 /**
@@ -3512,6 +3685,13 @@ async function runDeploy(root, options) {
 		cliLog.info("deploy_end", { ok: true });
 	} catch (err) {
 		cliLog.error("deploy_end", err, { ok: false });
+		await cliLog.close().catch(() => {});
+		try {
+			if (err instanceof Error) {
+				const summary = buildDeployLogSummary(cliLog.path);
+				if (summary) err.message = `${err.message}\n${summary}`;
+			}
+		} catch {}
 		throw err;
 	} finally {
 		await cliLog.close().catch(() => {});
@@ -3575,6 +3755,26 @@ function prependLocalBinToPath(env, root) {
 	return env;
 }
 /**
+* Marks a build child as driven by a MANAGED `void deploy`.
+*
+* The platform resolves the asset routing policy out-of-band (`resolveAssetConfig`
+* → `manifest.assetConfig`) and applies it to the uploaded script, so settings the
+* Vite plugin cannot safely write into the built wrangler config — `routing.notFound`
+* for a Class A framework, which needs an `assets` policy Void does not own there —
+* are still honored on this path. `void:framework-build-wrapper` warns about exactly
+* those when this flag is ABSENT, i.e. on a self-hosted `vite build && wrangler deploy`.
+*
+* Passed through the CHILD env only (never `process.env`), the same way
+* `VOID_DEPLOY_PROJECT_ID` is, so it cannot leak into an unrelated child process or a
+* later `void dev` in the same shell.
+*
+* Deliberately NOT set by `runCloudflareDeploy` (`--backend cloudflare`): that flow
+* hands the built output to `wrangler deploy` against the user's own account and IS the
+* self-host path the warning is about. (It rejects framework SSR outright today, so no
+* Class A build reaches it either way.)
+*/
+const MANAGED_DEPLOY_BUILD_ENV = { VOID_DEPLOY_BUILD: "1" };
+/**
 * Deploy-time env selectors that pin the WRONG worker/config out from under the
 * top-level config this flow provisions + preflights. Scrubbed from every child env
 * and fenced in the project dotenv (see below), on top of the provisioner's transport
@@ -5359,7 +5559,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		log.error(`deploy: ${getErrorMessage(err)}`);
 		return exit(1);
 	}
-	if (scanWebSocketRoutesSync(root, paths).length > 0) {
+	if (scanWebSocketRoutesSync(root, paths, "prod").length > 0) {
 		log.error([
 			"deploy: --backend cloudflare does not yet support WebSocket / Durable Object routes.",
 			"A `.ws.ts` route makes the build emit a key-value-backed Durable Object namespace",
@@ -5949,7 +6149,7 @@ async function promptDeployProjectConfig(root, client, cliLog) {
 		slug: result.project.slug
 	};
 	writeProjectConfig(root, config);
-	log.step(`Linked to ${import_picocolors.default.blue(config.slug)}`);
+	log.step(`Linked to ${import_picocolors$1.default.blue(config.slug)}`);
 	cliLog?.info("project_linked", {
 		projectId: config.projectId,
 		slug: config.slug
@@ -6285,7 +6485,7 @@ async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetad
 		execSync(preset.buildCommand, {
 			cwd: root,
 			stdio: "inherit",
-			env: buildEnv(void 0, { localBinRoot: root })
+			env: buildEnv({ ...MANAGED_DEPLOY_BUILD_ENV }, { localBinRoot: root })
 		});
 		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 	} else if (skipBuild) cliLog?.info("build_skipped", { reason: "skipBuild" });
@@ -6402,7 +6602,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		execSync(voidConfig.inference?.build ?? resolveProjectCommand(root, fwPreset.buildCommand), {
 			cwd: root,
 			stdio: "inherit",
-			env: buildEnv(void 0, { localBinRoot: root })
+			env: buildEnv({ ...MANAGED_DEPLOY_BUILD_ENV }, { localBinRoot: root })
 		});
 		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 	} else cliLog?.info("build_skipped", { reason: "skipBuild" });
@@ -6543,7 +6743,8 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		bindingNames: resolveBindingNames(voidConfig.inference?.bindings),
 		workerMain: actualWorkerMain,
 		compatibilityDate: wranglerCompat?.compatibilityDate,
-		compatibilityFlags: wranglerCompat?.compatibilityFlags
+		compatibilityFlags: wranglerCompat?.compatibilityFlags,
+		cpuMs: voidConfig.worker?.limits?.cpu_ms
 	};
 	const manifest = buildFrameworkManifest({
 		frameworkName: detected.name,
@@ -6597,7 +6798,10 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			execSync(buildExec, {
 				cwd: root,
 				stdio: "inherit",
-				env: buildEnv({ VOID_DEPLOY_PROJECT_ID: config.projectId }, { localBinRoot: root })
+				env: buildEnv({
+					VOID_DEPLOY_PROJECT_ID: config.projectId,
+					...MANAGED_DEPLOY_BUILD_ENV
+				}, { localBinRoot: root })
 			});
 			cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 		} catch (err) {
@@ -6707,9 +6911,10 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	})));
 	const routeScan = await scanRoutes(root, {
 		output: deployConfig.output,
-		paths
+		paths,
+		environment: "prod"
 	});
-	const webSockets = routeScan.websockets ?? scanWebSocketRoutesSync(root, paths);
+	const webSockets = routeScan.websockets ?? scanWebSocketRoutesSync(root, paths, "prod");
 	const liveConfig = await resolveDeployLiveBindingConfig(root, client, config.projectId, {
 		isFrameworkMode,
 		needsLive: effectiveBindings.needsLive,
@@ -6812,6 +7017,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	const voidPackageOptions = {
 		compatibilityDate: wranglerCompat?.compatibilityDate,
 		compatibilityFlags: wranglerCompat?.compatibilityFlags,
+		cpuMs: deployConfig.worker?.limits?.cpu_ms,
 		...workerMain && { workerMain },
 		...sandboxConfig && { sandbox: sandboxConfig },
 		...liveConfig && { live: liveConfig },
@@ -6880,7 +7086,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	outro("Done!");
 }
 async function createProjectFromSlug(root, client, slug, cliLog) {
-	log.step(`Creating project ${import_picocolors.default.blue(slug)}...`);
+	log.step(`Creating project ${import_picocolors$1.default.blue(slug)}...`);
 	cliLog?.info("project_create_start", { slug });
 	const project = await client.createProject(slug);
 	const config = {
@@ -6888,7 +7094,7 @@ async function createProjectFromSlug(root, client, slug, cliLog) {
 		slug: project.slug
 	};
 	writeProjectConfig(root, config);
-	log.success(`Project created: ${import_picocolors.default.blue(config.slug)}`);
+	log.success(`Project created: ${import_picocolors$1.default.blue(config.slug)}`);
 	cliLog?.info("project_create_success", {
 		projectId: config.projectId,
 		slug: config.slug

package/dist/{gen-o_w-8yI8.mjs → gen-BzXf3Jh2.mjs}

@@ -2,7 +2,7 @@ import { a as join, n as dirname, s as relative } from "./dist-DaKKDf8D.mjs";
 import { D as outro, T as log, a as cliTitle, j as isCancel, k as select, w as intro, x as cancel } from "./agents-CtgBYqld.mjs";
 import { n as readProjectPaths } from "./project-paths-BQd7OmIo.mjs";
 import { n as ensureProjectTsconfig } from "./project-tsconfig-B-QtXjLQ.mjs";
-import { c as getDatabaseDialect, f as readConfig } from "./config-BkTvs43g.mjs";
+import { c as getDatabaseDialect, f as readConfig } from "./config-qHGgPuWT.mjs";
 import { n as writeDrizzleConfig } from "./config-CutEMNGJ.mjs";
 import { c as collectMigrations, n as listDrizzleArtifacts, t as assertJournalCoherence, u as readJournal } from "./validate-Cw_RLeTj.mjs";
 import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DJn3SAHF.mjs";

package/dist/{headers-nsHIFixA.mjs → headers-ChAADPQu.mjs}

@@ -1,5 +1,5 @@
 import { a as join } from "./dist-DaKKDf8D.mjs";
-import { a as convertRedirectsConfig, d as parseHostPrefixedSource, i as convertHeadersConfig, o as convertRewritesConfig, r as convertFallbacksConfig, s as countSplats, t as VALID_REDIRECT_STATUSES, u as isProtocolRelative } from "./config-BkTvs43g.mjs";
+import { a as convertRedirectsConfig, d as parseHostPrefixedSource, i as convertHeadersConfig, o as convertRewritesConfig, r as convertFallbacksConfig, s as countSplats, t as VALID_REDIRECT_STATUSES, u as isProtocolRelative } from "./config-qHGgPuWT.mjs";
 import { i as voidWarn } from "./log-ChfPKsVd.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/headers.ts